v17 verification tracker — browser-verify every user-facing change in the 17.0.0 train #3909

Activity

1. os-zhuang

   self-assigned this

   on Jul 30, 2026
2. baozhoutao

   self-assigned this

   on Aug 1, 2026
3. baozhoutao commented on Aug 1, 2026

   

   baozhoutao

   on Aug 1, 2026

   Contributor

   More actions

   rc.1 verification run 1 — section F

   Environment: framework main @ 1ee48bc60 (post-rc.1), showcase example under os serve --dev --ui on an isolated SQLite datastore, @objectstack/console@17.0.0-rc.1 (the published vendored SPA, pin 7d9734d5e321) at /_console/, Node 22.22. Driven as admin@objectos.ai plus a second signed-up member for every two-principal check.

   19 items ticked. Highlights of what actually held up under a live request:

   • Actions (F1). An undeclared action name is refused with the prescriptive ADR-0110 404; script runs, flow dispatches (returns status:"paused" with the screen payload), and a url/modal action reaching the server is refused with a message naming its client-side nature. Param enforcement is strict by default and precise: missing required → 400 naming the param, unknown key → "Unknown action param … not declared on this action", bad option → the allowed list. Field validation localizes properly (Accept-Language: zh-CN → 优先级必须是以下值之一) and carries per-field fields[] with labels.
   • Sharing (F2). The ADR-0111 verb boundary is real: an edit-level share lets the recipient read and PATCH, and refuses DELETE (403) and share-management ("requires record ownership or Modify All Data (ADR-0111 D1)"). A criteria-less rule is refused with the ADR-0049 message. A non-participant cannot read an approval request (404). Anonymous data access is denied on both read and write, while audience:'public' book metadata is served without a session.
   • Query strictness (F3). Every silent-drop this train closed refuses correctly, each with an actionable message: unknown query param, sort/select/expand/dotted-path sort naming a missing field, non-AST $filter. Implicit field filters AND-merge with an explicit filter (verified by counts: 2 ∧ 1 → 1). deleteMany is ids-only (a where body is rejected), the batch cap fires at 200, and sorted and unsorted paging are exact partitions (page union == full set, no dupes/gaps).
   • Temporal (F4). +08:00 input stores as UTC …T10:30:00.000Z, time stores wall-clock 09:15:30, and a bare-day upper bound ($lte: '2026-08-15') covers the whole day on both date and datetime.
   • Analytics (F5). /analytics validates at the entry (unknown body key rejected by name), a sum measure emits SUM(total) not COUNT(*), $or/$not reach the SQL, and a monthly timeDimensions bucket projects into rows in date order.
   • New capabilities (F6). The multi-value lookup seed resolves (f_lookups: ['Northwind','Contoso'] → a two-id array). required enforces on write with per-field errors, and the Console form shows the same three fields as required. The approval chain worked end to end in the browser and over REST: submit → request created → structured reassign to a second user → that user approves → status: approved, and sys_approval_action attributes each decision to the acting user (submit/reassign → admin, approve → member). The screen flow ran from the list toolbar, collected input, and the write landed (assignee = the value typed in the dialog).
   • Boot/CLI (F7). os serve boots a stack with no compiled artifact; the undeclared-stack-key lint reports each key with a remedy (including the storage → OS_STORAGE_* guidance); rc.1 tarballs carry CHANGELOG.md and a files whitelist (@objectstack/client ships 10 files).

   Failures filed (7)

   #	Area	What
   #4431	actions	a sandbox capability denial answers 400 as a deliberate rejection — the crash contract (#3951) says 500 — and leaks the SandboxError: debug prefix
   #4432	metadata	/meta/<type> overlay writes don't normalize the type segment: plural vs singular land in different namespaces, one overlay row shadows the whole code-authored listing, and the row is undeletable
   #4433	sharing	deactivating a rule never withdraws its materialized grants — not on record touch, not after a full restart
   #4434	sharing	DELETE /sharing/rules/:idOrName 500s for both address forms — no sharing rule can be deleted over REST (compounds #4433: an over-granting rule is unrecoverable)
   #4435	data	PATCH/DELETE of a nonexistent record answer 200 success (record: null / success: true) where GET correctly 404s; deleteMany reports every typo'd id as deleted
   #4436	data	the unsupported-filter-operator refusal ships without error.code and leaks the [sql-driver] prefix (ADR-0112)
   #4437	analytics	a measure naming a missing field 500s with SQLITE_ERROR instead of a 400 naming the field

   Notes for the next run

   • Two toast strings in the Console are still English on a zh-CN session ("This flow runs on a single record — select a row first.", "Done") — worth a pass against the objectui i18n packs before RC exit rather than filing per-string.
   • The showcase's own dev script resolves a stale global @objectstack/cli@9.0.0 from the user PATH instead of the workspace CLI, which fails the boot with a misleading "plugin-approvals … not installed". Not a platform defect; worth a line in the contributor docs since it costs a debugging cycle.
   • Not yet covered in this run and still open in section F: the file/attachment axis (F6 #4208/#4285 gate), flow run summaries (selected/acted/skipped), os migrate value-shapes, and the F8 docs sweep.
4. baozhoutao commented on Aug 1, 2026

   

   baozhoutao

   on Aug 1, 2026

   Contributor

   More actions

   rc.0 verification run 2 — sections A / B / C

   Run 1 covered only the F supplement. This run works the rc.0 checklist (A–D) on the same environment (framework main @ 1ee48bc60, showcase under os serve --dev --ui, published @objectstack/console@17.0.0-rc.1, isolated SQLite, admin + a second signed-up member). 7 more items ticked — 26 of 59 total. Three new defects filed.

   A. Breaking behavior

   • Export opt-in (用户级 export 权限轴(接入 P1 预留的 userExportAllowed 槽) #3544/定时报表的 CSV 附件绕过用户级 export 权限轴(#3544 的第二道出数据的门) #3710/security 服务 getReadableFields 查询面(export 列投影的长期正解) #3547) — all five branches hold. A member_default user is refused (EXPORT_NOT_PERMITTED 403). Binding a set carrying viewAllRecords on showcase_invoice lets that user read every invoice (200) while export stays 403 — read genuinely no longer implies export. Adding allowExport: true to that one object flips export to 200, and a second object in the same set (no allowExport) stays 403, so the grant is per-object, not per-set. An empty result still emits the full header row plus content-disposition / x-export-format / x-export-limit. The anchor gate refuses both everyone and guest, and — checked with a set carrying only allowRead + allowExport, no VAMA — names the right reason: "it carries bulk export on 'showcase_announcement' (ADR-0090 D5/D9)".
   • ApiMethod shrink (P2:ApiMethod 枚举收缩至 6 原语(breaking,独立版本) #3543) — the authoring half is exemplary. enable: { apiMethods: ['upsert','aggregate'] } produces a per-value FROM→TO mapping (upsert: declare ['create','update'], aggregate: declare ['list']), the deny-all consequence spelled out ("After stripping, this whitelist is EMPTY — [] means DENY-ALL"), and a codemod path. Authoring apiMethods at object root is separately caught as an undeclared key.
   • Alias retirement ([P3] Retire the three deprecated aliases — via the ADR-0087 D2 conversion layer, not by deleting the keys #3855/feat(spec,lint)!: accept ADR-0109, remove agent.tools[], lint agent authoring, model AI exposure in tool resolution (#3820) #3894) — all four, and the migration runs. field.conditionalRequired → requiredWhen and action.execute → target are hard parse errors naming the rename; agent.tools and agent.knowledge are tombstoned with a paragraph each on what to do instead (not a silent strip). os migrate meta --from 16 reports both rewrites and --out produces a snapshot carrying requiredWhen / target. Note the shape: migrate rewrites the stack snapshot, it does not edit your TS source — worth stating in the upgrade guide, since the checklist wording ("rewrites all three") reads as an in-place codemod.
   • Approval participant visibility (审批请求的可见性是「按租户」而非「按参与者」——getRequest 用 SYSTEM_CTX 读、只按 organization_id 收窄 #3590). A non-participant authenticated user gets 404 on another user's request; after a structured reassign makes them a participant, 200.

   B. Removed surfaces

   • SDK removals verified by instantiating the client, not by grep (grep is misleading here — nlq/suggest/insights still appear in comments documenting their removal). On a live ObjectStackClient: permissions, realtime, workflow, views, projects.listTemplates are all undefined; client.ai exposes only chat, chatStream, complete, models, conversations, agents, pendingActions; client.notifications exposes only list, markRead, markAllRead (no device/preference delegates).
   • Marketplace move (POST /api/v1/packages is a publish-vs-install shape collision — REST registers first and shadows the dispatcher (#3587 finding) #3610). POST /packages is the install surface again ({"code":"VALIDATION_ERROR","message":"Package id is required"} — reachable, no collision).
   • /graphql → 404 ✅, but discovery still advertises the slot: services.graphql = {"enabled":false,"status":"unavailable","message":"No implementation ships for the 'graphql' slot — register a service under it to enable"}. That message invites someone to fill a slot for a surface v17 deliberately removed, and it contradicts the docs sweep's own run-1 fix (services-checklist was reduced to 16 services with every graphql row deleted). Left unticked pending a call on whether the slot should be dropped from CORE_SERVICE_PROVIDERS or the message reworded.
   • Not verifiable here: POST /packages/publish answers 405 (Allowed: DELETE, GET, HEAD, PATCH) — the route-manager's /packages/:id matches with id="publish" and shadows it. The ledger declares the publish route as source: 'direct-mount', disposition: 'server-only', so it is presumably registered only where the marketplace publish plugin is loaded. Worth confirming on a deployment that has it — the shadowing means route-registration ORDER decides the winner.

   New defects (3)

   #	Area	What
   #4441	data / RBAC	a lookup accepts an id that does not exist in the referenced object — including sys_position_permission_set.permission_set_id, so a grant row can point at nothing while the audience-anchor gate has to resolve that set to judge it. Found by accident: a shell variable expanded to FAIL and the platform stored it against the everyone position.
   #4447	data	created_at is client-writable on an ordinary PATCH and persists (1999-01-01 written and read back). updated_at and created_by are correctly protected — this is one field of the audit trio. Its metadata says readonly: false.
   —	—	(the two #3909 F-section notes from run 1 stand)

   While chasing #4447 I could not find any input on this build that produces a non-empty droppedFields: computed fields (f_formula, f_summary) are rejected 400 INVALID_FIELD, unknown fields 400, and system fields are simply written. The #3794 contract may only have live coverage on the FLS path — worth a targeted check before RC exit rather than assuming the C-section item passes.

   Remaining

   33 unchecked. The bulk needs setup this run did not build: a runAs:'user' record-change flow fired by a system write (#3760), a per-tenant unique specimen (#3696), multi-org / membership-grade (ADR-0108, ADR-0105), better-auth 1.7 account migration, datasource fail-fast (#3741), the files-as-records axis (ADR-0104), historical import, and the Console-side items (objectui#28xx). Section D (docs) is untouched.
5. baozhoutao commented on Aug 1, 2026

   

   baozhoutao

   on Aug 1, 2026

   Contributor

   More actions

   rc.0 + rc.1 verification run 3 — the remaining sections

   Continuing from runs 1–2. Same environment; this run built a dedicated probe stack (examples/rc1-probe, removed afterwards) for the items the showcase has no specimen for, plus a synthetic pre-v17 datastore for the migration items.

   40 of 59 ticked (was 26). Five new defects filed, one of them the most serious found across all three runs.

   🔴 #4467 — /analytics/query ignores record-level scoping

   A plain member with shares on 2 of 5 private notes:

   GET  /data/showcase_private_note              → total 2      ✅
   POST /analytics/query {cube, measures:[count]} → count 5      ❌
   POST /analytics/query {…, dimensions:["title"]} →
      returns the TITLES of all 5, including the 3 they cannot read
   

   Any authenticated caller who can reach /analytics can enumerate field values of every row of any cube-exposed object, past OWD, sharing rules and RLS. The other analytics items on the checklist (#4019 capability mount, #4010 entry validation, #4184 declared aggregates, #3650 dateRange, #3921 time ordering) all hold — the scoping layer is the piece that is absent; the returned data.sql carries only the caller's own predicates and no owner/share filter.

   Method warning for whoever re-tests: a viewAllRecords set left bound from an earlier test makes both paths agree at 5/5 and look correct. Confirm the data path returns fewer rows than admin before reading anything into the analytics numbers — I got a false negative from exactly this.

   Other new defects

   #	What
   #4462	an object mapped to an unreachable datasource silently reads/writes the DEFAULT store — boot succeeds, broken never appears in the log, /ready 200, listing says status:"unvalidated". Against all three claims of the A5 item.
   #4466	an admin override of a properly-staffed approver slate is recorded as an ordinary approval — sys_approval_action has no override column at all, so bypassing designated approvers is byte-identical to being one.
   #4455	os migrate value-shapes misses a lookup holding an embedded record object — the exact case its own docstring names — because ReferenceIdValueSchema is z.string().min(1). The gate then closes on evidence it never gathered.
   #4441	a lookup accepts an id that exists nowhere, including the RBAC permission-set link tables.

   Verified this run

   • Export axis (用户级 export 权限轴(接入 P1 预留的 userExportAllowed 槽) #3544/定时报表的 CSV 附件绕过用户级 export 权限轴(#3544 的第二道出数据的门) #3710/security 服务 getReadableFields 查询面(export 列投影的长期正解) #3547), all five branches. The decisive one: with viewAllRecords bound, the member reads every invoice (200) while export stays 403. allowExport flips it per-object; a second object in the same set stays denied. Empty result still emits the header row + content-disposition. The anchor gate refuses everyone/guest and — tested with a set carrying only allowExport, no VAMA — names the right reason ("carries bulk export").
   • The #1888 user-less fail-open is wider than the lint that guards it — record-change flows fired by a system write run UNSCOPED, unlinted #3760 user-less flow runs, all three assertions. A runAs:'system' flow's write fired a runAs:'user' flow; the latter was refused with the UnscopedRunDataAccessError naming runAs:'system', the originating write still succeeded, and the sibling system flow ran normally.
   • record_change flow start node binds to a single lifecycle event — no create-OR-update in one flow #3427 record-after-write. One flow, both legs: previous is null on create and the full prior snapshot on update.
   • 多租户缺陷:unique 物化为全局唯一索引、无视 tenancy,与按租户分裂的 autonumber 序列自相矛盾(跨租户必然撞号 + 存在性探测泄露) #3696 per-tenant unique. The index is literally UNIQUE (organization_id, sku); two tenants hold the same SKU, same-tenant duplicate is 409, and the message leaks no cross-tenant existence.
   • 审批流无法在「运行中」动态确定审批人——审批人在提交时即被 $trigger 快照锁定（动态路由 / 动态会签受阻） #3447 dynamic approver routing, end to end. Required decisionOutputs enforced on approve; an undeclared key rejected and the declared keys listed; stage 2 spawned its own request whose pending_approvers was exactly the user stage 1's lead named — expression resolution over vars.lead_review.next_reviewers works. lockRecord held during, released after (Approval: a dead approval run can leave the record RECORD_LOCKED (#3424 follow-up, expected-behavior 3) #3456).
   • ADR-0104 files, full chain. A PNG bound to accept:['application/pdf'] → 400 naming field and allowed types (direct API, not the widget); oversize → 400 naming both sizes; valid → stored as a sys_file id that reads back expanded to {id,name,size,mimeType,url}; download carries filename="ok.pdf" + application/pdf; anonymous download 401. os migrate files-to-references dry-run reports honestly and writes nothing.
   • P2:ApiMethod 枚举收缩至 6 原语(breaking,独立版本) #3543 apiMethods shrink — per-value FROM→TO mapping, the deny-all consequence spelled out, codemod path given. [P3] Retire the three deprecated aliases — via the ADR-0087 D2 conversion layer, not by deleting the keys #3855/feat(spec,lint)!: accept ADR-0109, remove agent.tools[], lint agent authoring, model AI exposure in tool resolution (#3820) #3894 aliases — all four hard-rejected with renames; os migrate meta --from 16 --out produces a snapshot carrying requiredWhen/target.
   • fix(cli,driver-sql): os migrate plan lists the datetime storage convergence (#3954) #3964 / fix(cli,driver-sql): defer migrate DDL until confirmed + detect SQLite occupancy (#3917) #3924 — migrate plan lists normalize_datetime_storage: created_at — 2 row update(s); destructive index changes gated behind --allow-destructive; occupancy detection names the holding pid.
   • ADR-0105 D12 — OS_TENANCY_POSTURE=group without @objectstack/organizations is a FATAL refusal with three remedies. ADR-0108 — sys_member.role is a four-value closed select, sys_member/sys_invitation are read-only over REST; the owner→org_owner projection is the deliberate ADR-0095 D3 boundary, not the retired channel.
   • showcase: 4/5 projects and 9/10 tasks are silently rejected on every boot (FSM initialStates vs seed data) #3415/os dev: surface seed / sample-data-heal outcomes in the boot summary (info logs are swallowed by the default warn log level) #3430 seeds — a seed row with a bad reference turns the banner yellow: ⚠ Seeds: com.rc1.probe 2 ok / 1 error ⚠ + the OS_LOG_LEVEL=info hint.
   • Console/docs — Kanban grows a 未分类 lane for a null-status row (objectui#2804); total stays the match count under a 3-row page (objectui#2873); SQLite datetime grouping buckets correctly (SQLite 上 Field.datetime 的 dateGranularity 分桶恒为 NULL —— 趋势图塌成一根柱子 #3773) and an empty bucket is a real null (空分组桶的键两条路不一致:下推 SQL 给 null,内存兜底给 "(null)"(不限日期分桶) #3839); /docs/releases/v17 renders with the Console section and Upgrade checklist, reachable from the sidebar (docs(releases,nav): v17 follow-up — Console gap backfill, sidebar restore, first docs sweep #3908).

   Two checklist-wording corrections

   1. Seeds. The item promises Seeds: X inserted · Y updated · Z skipped. That shape does not exist — printSeedSummary deliberately collapses the three into one N rows / N ok / M errors count and uses · to separate sources. The code's contract is coherent; the checklist text is stale.
   2. os migrate meta. "rewrites all three" reads as an in-place codemod. It rewrites the stack snapshot (--out), not your TypeScript sources.

   Still open (19)

   Mostly Console-side objectui items needing UI-level assertions (API console AI family, dropped-field toasts, quorum chips, historical-import wizard), better-auth 1.7 account migration (needs pre-existing social/SSO rows), the four items blocked on the defects above, and the two close-out items that can only run at changeset pre exit.

   Also unresolved from run 2: I still cannot produce a non-empty droppedFields on any input — computed fields 400, unknown fields 400, system fields are written. #3794's contract may only have live coverage on the FLS path.
6. baozhoutao commented on Aug 1, 2026

   

   baozhoutao

   on Aug 1, 2026

   Contributor

   More actions

   Final run — the checklist is worked through

   48 of 59 verified. The remaining 11 are now annotated inline: 10 are blocked on defects filed from this verification (they cannot be ticked until a fix lands), and 1 (changeset pre exit close-out) can only run after RC exit. Nothing is left untested for lack of effort.

   Four more defects this round, on top of the nine already filed.

   🔴 #4477 — screen-flow resume performs no server-side validation

   A two-field screen node (kind required; escalation_reason required + visibleWhen: "kind == 'escalate'"):

   resumed with	expected	actual
   {"kind":"normal"} — conditional field hidden	accept	200 ✅
   {"kind":"escalate"} — field VISIBLE, required, missing	reject	200 ❌
   {} — kind itself required, missing	reject	200 ❌
   {"kind":"normal","totally_bogus":"x"} — undeclared key	reject	200 ❌

   The render half is fine — the screen payload carries visibleWhen intact. But "honored in validation" passes only vacuously: nothing validates, so the conditional case cannot be got wrong. A client that posts straight to resume bypasses every required the author declared. This is the one gap in an otherwise consistent row — action params (#4213), record writes (ADR-0113), and approval decisionOutputs (#3447) all enforce their declared contracts, verified working.

   #4475 — every Setup System Overview tile reads 0

   Users 0 (actually 4), Sessions 0 (actually 16), all event counts 0. The widget's own response gives the cause:

   {"rows":[{"user_count":0}],
    "sql":"SELECT COUNT(*) AS \"user_count\" FROM \"sys_user\" WHERE created_at = $1"}

   An "all time" range is lowered to WHERE created_at = $1 — an equality test on a timestamp. The cube path lowers ranges correctly (>= $1 AND < $2), so this is specific to the dataset path. First screen an operator sees, every number wrong, no error surfaced.

   #4476 — docs date the #4286 removals to spec 18; they ship in 17

   Nine passages across three hand-written pages say query.cursor / distinct / joins / windowFunctions were "removed in @objectstack/spec 18". PROTOCOL_VERSION = '17.0.0', the package is 17.0.0-rc.1, and os migrate meta --from 16 labels all four [protocol 17]. A reader on 16 is told the break is a major away and plans accordingly. Found by the sweep run the tracker asks for — the sweep's fingerprint list should gain a version-number check, not just surface names.

   #4478 — quorum progress and per-group chips do not render

   The server publishes behavior:"quorum", minApprovals:2, per-approver group labels, and even a pre-rendered __nodeLabel: "Committee Sign-off (2 of 3)". The Console renders none of it: scraping the approval panel gives {lockBadge: true, approveBtn: true, quorumHint: false, groupChips: false}. An approver on a quorum node cannot see how many more approvals are needed. The lockRecord half of the same line does render (审批中已锁定 badge), so the panel is otherwise correct — this is specifically the progress surface. Fix belongs in objectui #2811; no framework change needed, the data is already on the wire.

   Verified this round

   • Sharing vocabulary (fix(sharing): 「完全访问」声明了删除/转移/共享，实现上与「编辑」等价 #3865/[P0] Metadata property liveness audit: ~half of all spec properties are dead; a cluster of security props is parsed-but-unenforced #1878). group and guest recipients rejected with the legal list; team / business_unit accepted; accessLevel:'full' stored as 'edit'. Note: the spec rejects type:'owner' (pinned by test) but the REST rule route silently drops type and any other unknown key — inconsistent with the 未知键静默剥离仍是全仓默认:把 #3405 的 strict 收紧从一个 schema 推广到整个可授权面(ADR-0078 完整性闸门) #4001 posture the data routes apply (a permission-set write rejects active with a prescriptive message). Worth a follow-up.
   • better-auth 1.7. sys_account carries a distinct issuer column, backfilled (local:credential), and id (row) is separate from account_id — the precondition for unlink-by-row-id. Password sign-in worked throughout all four runs.
   • droppedFields (审批场景下记录可写性的反馈全线失真:能改的显示「已锁定」,改不了的提示「更新成功」 #3794) — found it. The trigger is a readonly field, not a system or computed one:

     PATCH /data/showcase_contact/<id> {"lead_score":999}
     → x-objectstack-dropped-fields: lead_score;reason=readonly
     → body: {"droppedFields":[{"object":"showcase_contact","fields":["lead_score"],"reason":"readonly"}]}
     

     Both channels carry it. This closes the open question from runs 2–3 — the contract does have live coverage; computed fields 400 and system fields are a different path (created_at being writable is data: created_at is client-writable on an ordinary PATCH — the audit anchor can be forged silently #4447).
   • Historical import (data import: mid-lifecycle rows rejected by state_machine.initialStates — historical-data migration blocked (#3433 sibling) #3479/data import: a "historical" import can't preserve original timestamps / audit fields — updated_at is stamped now, readonly fields stripped on upsert (#3479 follow-up) #3493/Identity import: raw SQL leaks into row errors; DB constraint failures need sanitized, friendly messages #3566). A row with created_at: "2020-03-15" and status: "done" imports with the timestamp preserved and the state machine skipped. Dry-run row errors are human-readable and located: {"row":2,"field":"status","code":"invalid_option","error":"Status: \"NOT_A_STATUS\" is not a known option"} — no raw SQL.
   • FormSection.pane (feat(spec): FormSection.pane — explicit split-pane placement (objectui#2153 follow-up) #4160) — pane: "primary" / "secondary" reach the client in the view metadata.
   • AI family (B4) — /ai/nlq, /ai/suggest, /ai/insights answer 501 (honest empty slot), not 404 and not a fabricated response; /ai/agents serves the real surface.
   • ADR-0104 D3 wave 2 (feat(storage): 开启回收 — 释放的字段文件按部署门禁进入墓碑与回收 — ADR-0104 D3 wave 2 (PR-5b) (#3459) #4208) — on an unmigrated deployment an invalid media value is warn-first and says so ("accepted for now … run os migrate files-to-references --apply to migrate this deployment and enforce"), collection stays off. The strict FileReferenceIdValueSchema demonstrably works — it caught the showcase's own data-URI cover.
   • Docs sweep run 2 — every retired-surface fingerprint hit outside releases/ and references/ documents the removal correctly; the only drift is the version number in docs: nine passages date the #4286 query-surface removals to spec 18 — they ship in 17 #4476.

   One open judgement call for the maintainers

   /graphql correctly 404s, but discovery still reports a graphql service slot: {"enabled":false,"status":"unavailable","message":"No implementation ships for the 'graphql' slot — register a service under it to enable"}. That message invites someone to fill a slot for a surface v17 deliberately removed, and it contradicts the docs sweep's own run-1 fix (services-checklist reduced to 16 services with every graphql row deleted). Left unticked: whether to drop the slot from CORE_SERVICE_PROVIDERS or reword the remedy is a design call, not a test result.

   All 13 defects from this verification

   Security / correctness: #4467 (analytics ignores record scoping — reads values a caller cannot read), #4433 + #4434 (a sharing rule's grants cannot be withdrawn and the rule cannot be deleted), #4447 (created_at forgeable), #4441 (dangling lookup references incl. RBAC link tables), #4462 (unreachable datasource silently uses the default store), #4477 (screen resume unvalidated), #4466 (admin override unrecorded).

   Contract / envelope: #4431 (capability denial 400 vs the 500 the crash contract promises), #4435 (missing-record writes report success), #4436 (filter-operator refusal has no error.code), #4437 (analytics measure 500s with SQLITE_ERROR), #4432 (meta overlay type-segment phantom rows), #4455 (value-shapes gate misses its own headline case).

   UI / docs: #4475 (Setup overview all zeros), #4478 (quorum chips), #4476 (docs version drift).
7. baozhoutao commented on Aug 1, 2026

   

   baozhoutao

   on Aug 1, 2026

   Contributor

   More actions

   All defects from this verification are now rolled up in #4482 — 17 issues grouped as security/data-integrity (8), contract/envelope (6), UI/docs (3), with a suggested RC-exit triage and the two non-defect judgement calls (/graphql discovery slot; two stale checklist claims).

   Note a correction to my run-4 comment above: it said "13 defects". The grouped list was right, the total was a miscount — it is 17.
8. xuyushun441-sys

   added

   trackingGenerated anchor/tracker issue — not dispatchable; exempt from the half-state sweep's findingsGenerated anchor/tracker issue — not dispatchable; exempt from the half-state sweep's findings

   domain:cliRetired 2026-10-22, alias of domain:server (cli surface); in-flight cards keep it until they landRetired 2026-10-22, alias of domain:server (cli surface); in-flight cards keep it until they land

   target:v17Release blocker for v17 — on the board until fixed, dropped as no longer valid, or accepted for GARelease blocker for v17 — on the board until fixed, dropped as no longer valid, or accepted for GA

   on Aug 3, 2026
9. baozhoutao commented on Aug 4, 2026

   

   baozhoutao

   on Aug 4, 2026

   Contributor

   More actions

   rc.3 verification — G1 regression + G2–G10 first pass

   Environment: main @ a1a855a28 (the rc.3 train tip — note rc.3's version commit c6a52d3a4 was tagged and published to the npm rc dist-tag but not merged back, so main's package.json still reads 17.0.0-rc.2 while main sits 56 commits past the rc.3 cut). Real showcase boot, two live principals, purpose-built probe stacks for the rest.

   73 of 113 ticked. Two new defects.

   G1 — 16 of 17 fixes verified landed, 1 residual

   I re-ran every original repro rather than trusting the close. The fixes are real and several are better than what I asked for:

   • analytics: /analytics/query ignores record-level scoping — a member counts and reads dimension values of records they cannot read #4467 (the aggregate-disclosure one) — member with shares on 2 of 5 notes: data 2, analytics 2, and dimensions:["title"] returns only the two titles they may read.
   • datasource: an object mapped to an unreachable datasource silently reads/writes the DEFAULT store — no boot failure, /ready still 200 #4462 — boot now fails, naming the datasource, naming the object routed to it, stating the consequence ("their reads/writes would otherwise land in a DIFFERENT database than the one they declare ⇒ fail-fast per ADR-0062 D5"), and offering OS_ALLOW_DRIVER_CONNECT_FAILURE=1.
   • sharing: deactivating a rule never withdraws its materialized grants — not on touch, not at boot #4433 / sharing: DELETE /sharing/rules/:idOrName answers 500 for both address forms — rules cannot be deleted over REST #4434 — deactivating a rule withdraws immediately (200 → 404); DELETE returns 204, not 500.
   • screen flows: resume performs no server-side validation — missing required fields and undeclared keys all complete the run #4477 — resume validates: missing required 400, undeclared key 400, valid 200 and the write lands. (Method note: the envelope is {"inputs":{…}}. I first tested flat and got a false failure — the docs say inputs, I was wrong.)
   • approvals: an admin override of a staffed approver slate is recorded as an ordinary approval — no override marker anywhere #4466 — via_override: true is written on the override decision, null on the ordinary one.
   • actions: sandbox capability denial answers 400 as a deliberate rejection, not the 500 the crash contract promises #4431 capability denial → 500 INTERNAL_ERROR, no SandboxError: prefix. data: created_at is client-writable on an ordinary PATCH — the audit anchor can be forged silently #4447 created_at unchanged. data: a lookup accepts an id that does not exist in the referenced object — including the RBAC permission-set link tables #4441 dangling lookup 400. data: PATCH/DELETE of a nonexistent record answer 200 success instead of RECORD_NOT_FOUND #4435 PATCH/DELETE missing → 404. data: unsupported-filter-operator refusal ships without error.code and leaks the [sql-driver] prefix #4436 INVALID_FILTER, no driver prefix. analytics: a measure naming a missing field 500s with SQLITE_ERROR instead of a 400 naming the field #4437 measure → 400. migrate value-shapes: a lookup holding an embedded record object passes the scan — the exact case the ADR-0104 D1 gate exists to find #4455 scan reports the embedded reference with a correct-id example.

   Residual → #5079. #4432's namespace normalisation, shadowing and immediate dispatch are all fixed, but after DELETE the overlay stays in the /meta listing while dispatch correctly 404s. The delete is real (reset:true, no sys_metadata row); only the enumeration view is stale — the mirror of the seam #4521 fixed on the write side.

   G2–G10 — what passed

   • ADR-0118 — sys_metadata_history.recorded_by is NULL on every row, no 'system' sentinel. Boot banner reads Tenancy: single (resolved posture, not the legacy boolean).
   • ADR-0119 atomic batch, proven by rollback. An atomic deleteMany of [valid, nonexistent]: the valid row comes back ROLLED_BACK, the missing one RECORD_NOT_FOUND, and the valid row still exists afterwards (GET 200). Per-row results carry the declared BatchOperationResultSchema shape with index + errors[], and the new NOT_ATTEMPTED code appears on rows after an abort.
   • G4 — the semantic reversal landed. An unevaluable hook condition now aborts: 400 Hook 'x' could not evaluate its condition (runtime: No such key: …) — operation aborted, naming the field and giving two remedies. And the root cause is gone: the rc.1 boot logged dozens of condition evaluation failed; treating as false — No such key: done; on rc.3 that count is 0 (bug(objectql): hook 条件对着「只含本次更新字段」的残缺 record 求值，取不到的字段被吞成 false —— 审计 hook 静默不触发 #4770 + bug(objectql/docs): hook condition 的 CEL 作用域只绑定 record —— 文档教的 previous.x / ctx.record 根本不存在,过渡型条件写不出来 #4784).
   • G6 — a env: ['prod'] seed loads 0 rows in dev (fix(seed): enforce Seed.env against the runtime environment #4836); NOW() resolves per field type (datetime → full instant, date → calendar day, data: the NOW() defaultValue token is unresolved on non-SQL datasources — the engine stamps the literal string, and the record validator then rejects the insert #4597); a fresh DB reports "Physical schema is in sync — nothing to migrate" instead of the phantom drift rc.1 showed ([schema-drift] Fresh DB boots "drifted": detector can't read COALESCE index columns, then tells the operator to --allow-destructive away a legitimate unique index #4884).
   • G7/G8 — the retirement diagnostics are the best I have seen in this codebase. areas[].visible doesn't just say "removed": it explains the key was a gate that failed open, which layer to move to, and that server-enforced gating requires the top-level tree because "the server does not walk areas". datasource.retryPolicy warns against renaming your way around it because hook.retryPolicy is a genuinely-enforced different key. composeStacks (composeStacks silently drops every non-array top-level key — api: today, server: as of #4910 #5005) is three-for-three: undeclared key warns, conflict throws naming both stacks, same value passes.
   • G10 docs sweep run 3 — every fingerprint hit for this window's retired keys is either documenting the removal or a same-name-different-thing (a plugin's healthCheck() method, responsiveStyles). Clean.

   New defect → #5086

   allowRuntimeCreate: false is not enforced. #4509 set the flag on job and its changeset says "no 'create job' in Studio or via PUT /meta". It still creates one:

   PUT /api/v1/meta/job/rc3_runtime_job {"schedule":{"type":"cron","expression":"0 0 * * *"},"handler":"nope"}
   → 200 "Saved customization overlay (env-wide) — type=job"     … and it lists, with handler "nope"
   

   agent, the only other flagged type, behaves the same. supportsOverlay: false looks equally unenforced — the success message calls the row a "customization overlay" for a type declared not to support them.

   This is the ADR-0049 failure mode one level up: the enforcement flag itself is the silently-inert declaration. It is easy to miss because a minimal payload 422s on schema validation first — only a payload that passes the schema reveals that the gate never runs. Studio presumably reads the flag to hide "create", so the UI honours a rule the API does not.

   Remaining 40

   Mostly G5 (metadata-plane honesty: publishDraft drain, DDL loudness, history/event_seq invention), G9 (client-react hook loops — needs a React harness), the G8 spec-rename family (compile-time, best covered by a typecheck of a consumer rather than a runtime probe), and the close-out item that can only run at changeset pre exit.
10. baozhoutao commented on Aug 4, 2026

    

    baozhoutao

    on Aug 4, 2026

    Contributor

    More actions

    rc.3 verification — complete

    108 of 113 verified. The 5 open items are: 2 blocked on defects filed from this pass (#5086, #5088), 2 close-out items that can only run after changeset pre exit, and the #4432 residual tracked in #5079.

    Three new defects this round, on top of the seventeen from the A–F passes (all of which are now closed and re-verified as genuinely fixed, not merely closed).

    New defects

    #	What
    #5086	allowRuntimeCreate: false is not enforced. PUT /meta creates job and agent items the registry declares code-only. supportsOverlay: false looks equally unenforced — the success message calls the row a "customization overlay" for a type declared not to support them. This is the ADR-0049 failure mode one level up: the enforcement flag itself is the silently-inert declaration.
    #5088	updateMany runs hooks for a nonexistent id. With no stored record to merge, the hook condition evaluates against a payload-only record, #4775's abort fires, and the row fails INTERNAL_ERROR accusing a correct hook of naming an undeclared field — where single-record PATCH correctly answers RECORD_NOT_FOUND. Under atomic one stale id poisons the whole batch via NOT_ATTEMPTED.
    #5079	#4432 residual — a deleted overlay stays in the /meta listing while dispatch correctly 404s.

    The seventeen earlier fixes: verified, not assumed

    I re-ran every original repro. All landed. Several exceed what was asked:

    • datasource: an object mapped to an unreachable datasource silently reads/writes the DEFAULT store — no boot failure, /ready still 200 #4462 now fails the boot naming the datasource, naming the object routed to it, stating the consequence ("their reads/writes would otherwise land in a DIFFERENT database"), and offering an escape hatch.
    • analytics: /analytics/query ignores record-level scoping — a member counts and reads dimension values of records they cannot read #4467 — member with shares on 2 of 5 notes: data 2, analytics 2, dimensions:["title"] returns only their two titles.
    • screen flows: resume performs no server-side validation — missing required fields and undeclared keys all complete the run #4477 — resume validates three ways and the write lands. (The envelope is {"inputs":{…}}; I first tested flat and produced a false failure. The docs were right.)
    • Console approvals: quorum progress and per-group chips do not render, though the server sends minApprovals / group / __nodeLabel #4478 — the quorum UI now renders 会签 — 已完成 0 / 共 2 个组 with a progress bar and per-group chips finance 0/1, manager 0/1.
    • Setup System Overview: every KPI tile reads 0 — the dataset path lowers an all-time range to WHERE created_at = $1 #4475 — Setup System Overview reads Users 4, Sessions 7. Real counts.

    Highlights from the rc.2/rc.3 window

    • ADR-0119 atomicity proven by rollback, not by wording: an atomic deleteMany of [valid, missing] marks the valid row ROLLED_BACK and the row still exists afterwards.
    • The G4 semantic reversal is real and its root cause is gone. An unevaluable hook condition now aborts with a prescriptive 400; the condition evaluation failed; treating as false warnings that flooded the rc.1 boot log are down to 0. The same fail-closed posture holds for validation predicates (Script validation rules are silently skipped when their predicate fails to evaluate — fail-open is the wrong direction for a validation #4649).
    • Parent-scoped readonlyWhen is unenforced server-side — the field lock fails open, so a paid invoice's frozen lines can be rewritten over the API #4889 parent-scoped readonlyWhen is enforced server-side — on a paid invoice both product and unit_price come back in droppedFields with reason=readonly_when and the stored values are unchanged, while the same fields on a draft parent write normally. (My first attempt passed vacuously because I re-sent the existing value — worth stating for whoever re-tests.)
    • 审批记录锁 bindApprovalLockHook 对谓词式(multi)更新完全失效:if (!id) return 把「没解析到行」当成「允许」 #4778 the record lock holds on the predicate/multi path (RECORD_LOCKED per row), not just single PATCH.
    • The retirement diagnostics are the strongest work in this window. areas[].visible explains it was a gate that failed open and which layer actually enforces; datasource.retryPolicy warns against renaming your way around it because hook.retryPolicy is a genuinely-enforced different key; composeStacks is three-for-three (undeclared warns, conflict throws naming both stacks, same value passes).
    • G8 spec convergence — 15 renamed exports checked across 10 subpaths: no duplicate owners. G10 docs sweep run 3 — every fingerprint hit is documenting a removal or a same-name-different-thing; clean.

    One operational note, not a defect

    On this build /api/v1/meta/object takes ~11s (680 KB) and /meta/view ~9s. The Console blocks its splash on both, so a cold /_console/ load sits on "Connecting to data source" for ~20s before rendering. It does render correctly. Worth a look before GA if that is not expected for a 24-object app.
11. os-zhuang

    closed this as completedon Aug 4, 2026