QA run · release-18.3.0-w4-c2b (86/86) · 7fa9873f · 2026-11-02 · 7 PASS / 79 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN

domain:devx#1 · os-warren · session_01JQwxbYXnfyuxgv3GQP9G1h
Part of #27377 (wave 4, W4-C2b)

Selector release-18.3.0-w4-c2b: Tier 1 half B of the 18.3.0 release-candidate sweep, wave 4. It covers the 86 pinned, non-P0 items in dashboards, i18n, identity-auth, integration-system, platform-core, records-forms, search and studio-authoring, as the wave-4 brief lists them (computed from the ledger at the subject). This is a release-candidate rerun (SKILL §5 trigger 1), dispatched from the 18.3.0 release-planning thread. It is a QA run, not a lane card.

Result: 86/86 judged · 7 PASS / 79 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN. No item is planned. Clause rows: 185 pass, 315 partial, 186 skipped, 2 blocked, 0 fail (688 in all).

Coverage mode: this card ran the pins, not the live legs. The wave-4 brief scopes C2b to "build closure only; run each item's automated.ref in per-area vitest batches", the same as W4-C2a. So a clause whose oracle sits on a live or browser leg that no pin drives is skipped here, and a pin that stops below its clause's oracle layer scores that clause partial (RUNNER rule 6). Wave 3 (#27438) drove those live legs with a full console and 12 runners. So the PASS→PARTIAL deltas below are this coverage mode, not regressions: no pin failed. For the same reason, the four wave-3 FAILs were not re-driven here (see the delta section).

1. Environment fingerprint

Framework: objectstack-ai/objectstack @ 7fa9873f38f7a0158e3ce17338dcc0f446b113e3, detached; it never followed main or the Version PR chore: version packages #26517. ui/ is in the same tree. The subject's push CI (Live E2E UI included) is green.
Build: cold tree. npm_config_nodedir=/opt/node22 pnpm install --frozen-lockfile (25 s), then pnpm exec turbo run build --concurrency=2 under scripts/pm/os-verify-lock.sh: 118/118 tasks, 16m03s. That build also wrote packages/console/dist. check-dev-prereqs: 106 artefacts present. Node v22.23.4, pnpm 10.31.0, Playwright chromium build 1243 from /opt/pw-browsers, 4 CPUs, about 15 GiB.
Pins: one vitest invocation per package (32 batches), sequential, --maxWorkers=1, ui/ jsdom suites from the ui/ root. The one cli *.e2e.test.* ran in its own invocation under OS_TEST_TIERS=nightly. Bare basenames and brace lists in the refs were resolved to repo paths before the run (273 files named; 257 vitest files plus 16 Playwright specs).
Boots for the Playwright pins:
- Showcase A: OS_PORT=41501 OS_STORAGE_LOCAL_ROOT=RUN/uploads setsid pnpm -C examples/app-showcase exec objectstack dev --ui --no-watch --seed-admin -p 41501 -d file:RUN/data.db.
- Showcase B (the CI Live E2E UI shape): OS_PORT=41510 OS_CLOUD_URL=off objectstack dev --seed-admin --fresh --no-watch --no-compile -p 41510.
- app-crm (for import-console-undo, whose defaults are crm_app / crm_lead): objectstack dev --seed-admin --fresh --no-watch -p 41530.
- Console: VITE_BASE_PATH=/ vite build of ui/apps/console into a scratch dir, served by vite preview with DEV_PROXY_TARGET on 5190 / 5191 / 5193, the topology the CI Live E2E UI job uses. Also a vite dev server on 5180 (see §6).
Seed: --seed-admin (admin@objectos.ai) plus the stock showcase and CRM seeds.
Clock: 2026-11-02 03:35Z to 05:00Z (UTC).
Execution: one runner session ran every build, pin, spec and probe itself. Five scoring subagents (effort high, one per area group) then mapped the captured output to clauses, reading each pin's harness for its layer. The runner checked their verdicts against the evidence and downgraded six rows (§3 note).

2. Scope: selector and the revision each verdict is valid for

dashboards (3): dataset-report-authoring r4, empty-null-bucket-boundaries r2, analytics-exposure-gate-and-measure-aggregate r3
i18n (2): surface-matrix r13, flow-copy-translation-and-host-override r3
identity-auth (8): auth-method-matrix r10, invitation-scope-gates r6, admin-lifecycle-operations r10, implicit-account-linking-ownership r5, auth-gate-held-session-raw-host-families r4, api-key-expiry-lifecycle r3, cookie-session-renewal-in-process r2, import-invitation-and-sso-domain-answers r3
integration-system (11): connector-declarative-boot r6, connector-stdio-default-deny r3, connector-descriptor-audit r3, email-template-render r12, datasource-admin-lifecycle r8, external-schema-introspection r8, external-schema-drift-gate r6, connector-auth-kind-application r5, external-schema-browser-ui r7, inbound-mailbox-association r3, notification-org-and-redeliver-eligibility r5
platform-core (11): metadata-registry-serving r4, metadata-authoring-roundtrip r8, interrupted-migration-boot-report r3, activation-ledger-registration-home r7, activation-ledger-row-contract r9, url-overlay-contract r4, lifecycle-retention-sweep r8, settings-audit-secret-fingerprint r5, protocol-18-handshake-and-stored-replay r3, settings-organization-isolation-and-platform-rung r6, serve-composition-v18 r4
records-forms (30): field-type-matrix r8, list-view-capabilities r8, view-type-gallery r3, conditional-rules-header r8, conditional-rules-grid r11, cascading-options r7, master-detail-atomic-save r9, related-list-server-pagination r11, action-param-widgets r6, import-wizard-encoding-and-hints r9, gantt-interactions r8, form-dirty-guard r7, adhoc-filter-sort-builder r8, concurrent-edit-conflict r5, record-discussion-mentions r13, bulk-select-all-matching r6, import-job-undo-cancel r8, object-hook-lifecycle r11, field-type-constraints r6, cascading-multilevel-and-clear r9, encrypted-field-behavior r7, field-unique-enforcement r13, delete-behavior-matrix r5, record-clone-contract r3, field-history-tracking r11, predicate-relationship-traversal r6, write-time-option-and-element-shape-judgement r2, write-answer-advisories-rollback-and-tree-delete r3, comment-reactions-and-edit-stamps r5, v18-semantic-defaults r6
search (3): cross-field-object-search r4, field-scoped-narrowing r3, global-search-skips-unreadable r5
studio-authoring (18): object-designer-roundtrip r10, record-page-roundtrip r11, org-override-registry-gate r7, expression-editors r8, permission-matrix-editor-ux r7, metadata-diagnostics-sweep r10, meta-save-preconditions-and-draft-rows r2, multi-package-item-rows r4, save-door-runs-authoring-rules r4, held-edit-publish-refusal r3, automations-rail-and-new-flow r2, org-scope-flows r2, flow-status-matches-runtime r2, validation-rules-authoring r3, hooks-tab-authoring r3, actions-tab-presets r3, object-api-tab-curl r2, interfaces-create-dialogs r2

Every revision equals the one in the wave-4 item list and in the area file at the subject.

3. Tier 1 pins (RUNNER rule 6)

Vitest: 257 files across 32 packages, 5,559 tests passed, 0 failed, 0 skipped. Every file a ref names exists at the subject and collected tests.

package	files / tests
packages/qa/dogfood	49 / 378
packages/objectql	29 / 728
ui (app-shell 29, plugin-grid 7, plugin-gantt 6, plugin-detail 2, plugin-form 2, components 1, apps/console 1)	48 / 534
packages/runtime	16 / 221
packages/rest	14 / 193
packages/spec	12 / 1077
packages/metadata-protocol	10 / 446
packages/cli (+ nightly tier)	8 / 97 + 1 / 2
packages/plugins/plugin-audit	8 / 111
packages/services/service-datasource	8 / 252
packages/plugins/plugin-auth	7 / 161
packages/services/service-automation · service-settings · service-mailbox · service-analytics	6/208 · 6/133 · 5/74 · 4/66
the other 18 packages	1–3 files each, all green

Playwright specs:

spec	result
`examples/app-showcase/e2e/showcase-smoke.spec.ts`	50 passed, twice
`ui/e2e/live`: cascading-options, field-conditional-rules, form-view-subforms, grid-conditional-rules, grid-parent-rules, inline-edit-polish-2572, master-detail, record-history-display, required-when-submit, saved-view-filter, user-filters	18 passed
`ui/e2e/live/studio-editor.spec.ts`, `studio-object-designer.spec.ts`	6 passed, three times, on the CI topology (preview console). On a vite dev server with `VITE_SERVER_URL` set they failed 3/3 (§6)
`ui/e2e/import-console/import-console-undo.spec.ts`	passed twice (`IMPORT_CONSOLE_LIVE=1`, app-crm boot)
`ui/e2e/import-harness/import-undo.spec.ts`	skipped itself: its harness config `ui/packages/plugin-grid/demo/vite.live.config.ts` no longer exists, so it evidences nothing

Each clause row names the layer its pin drives. A booted stack answering through Hono app.request counts as the HTTP layer, as in wave 3 and W4-C2a.

Runner downgrades of scorer rows (all pass → partial): search.global-search-skips-unreadable A1, A2, N0, N2 (the ref says this planted-pair pin never reads the stock fixture the clauses name); records-forms.record-discussion-mentions A8 (the unit fallback oracle applies only once the live milestone channel is shown unavailable, which was not driven); integration-system.connector-stdio-default-deny A3 (the green pin is connector-declarative-boot's ref, not this item's).

4. Derived item verdicts

Derivation: FAIL if any clause fails; PASS if every clause passes (SCOPE-pointer rows excluded); otherwise PARTIAL when any clause passed or partially passed.

PASS (7): records-forms.object-hook-lifecycle, records-forms.encrypted-field-behavior, records-forms.predicate-relationship-traversal, records-forms.write-time-option-and-element-shape-judgement, records-forms.write-answer-advisories-rollback-and-tree-delete, records-forms.comment-reactions-and-edit-stamps, search.cross-field-object-search.
FAIL (0). No reproduction rule is owed.
PARTIAL (79), each with what kept it below PASS:
- dashboards.dataset-report-authoring: only acceptance[0] is pinned; [1]-[7] and both negatives are live legs
- dashboards.empty-null-bucket-boundaries: only the two test-oracle clauses are pinned; the render/network/api legs are live
- dashboards.analytics-exposure-gate-and-measure-aggregate: A1-A3 pinned below their api/log layer (engine/plugin-unit); CUBE_NOT_FOUND and the dimension-column half unasserted
- i18n.surface-matrix: A5-A8 pinned only partly (jsdom, or one key / subset at HTTP); every screenshot leg and A9/A10 are live
- i18n.flow-copy-translation-and-host-override: A1-A4 pinned below their api/build layer
- identity-auth.auth-method-matrix: 4 of 10 acceptance clauses pinned, 3 of them only partly; the rest are live
- identity-auth.invitation-scope-gates: A0 pending half, A4-A6 and N2 are live legs
- identity-auth.admin-lifecycle-operations: ban enforcement, revoke live-session, stop-impersonating, owned-row reads, non-admin state reads and the invite-only walled boot are live
- identity-auth.implicit-account-linking-ownership: A0-A3 and N0-N3 pinned at unit layer only; the booted OIDC fixture leg is live
- identity-auth.auth-gate-held-session-raw-host-families: A1-A3 and N0 pinned below the booted HTTP door
- identity-auth.api-key-expiry-lifecycle: A2 no-key half and A3 pinned only at unit layer
- identity-auth.cookie-session-renewal-in-process: A1's meta leg is unpinned
- identity-auth.import-invitation-and-sso-domain-answers: A1-A3 pinned only over a memory-engine mount
- integration-system.connector-declarative-boot: only negative[0] is pinned whole; acceptance[0]-[2] pinned for the mcp half only, acceptance[3]-[5] and negative[1] below their oracle layer
- integration-system.connector-stdio-default-deny: boot-output clauses acceptance[0]-[2] and negative[1] are pinned only at the provider unit
- integration-system.connector-descriptor-audit: boot-half pinned in process only; the reload path and provider-bound carve-out are live legs
- integration-system.email-template-render: acceptance[6] unpinned; every other clause pinned only in half or below its oracle layer (unit service, route layer over a mail double)
- integration-system.datasource-admin-lifecycle: every api clause is pinned only at the route layer over stubbed services or at the service unit; negative[2] unpinned
- integration-system.external-schema-introspection: live mount over the real sqlite fixture, the draft twin and the 403 message are unpinned; most clauses pinned only at route or service layer
- integration-system.external-schema-drift-gate: the boot-log clauses acceptance[0]-[3] and negatives 0/1/3/5 need an induced-drift / federation-free served boot; pinned only at the plugin over stubs
- integration-system.connector-auth-kind-application: no echo-upstream or served-boot leg; every clause pinned only at provider/engine/schema layer, oauth2 half unpinned
- integration-system.external-schema-browser-ui: only acceptance[6] is a test-oracle clause; the panel render, network and api legs are live and out of this card
- integration-system.inbound-mailbox-association: live api clauses need the IMAP fixture (knownGaps[0]); association/attachment pinned at engine only, the member-vs-holder read not at all
- integration-system.notification-org-and-redeliver-eligibility: the three api clauses are pinned only in process (engine, service unit, LiteKernel door); served reads are the live leg
- platform-core.metadata-registry-serving: acceptance[3]-[6] are live reads outside this card; acceptance[0] pinned in half
- platform-core.metadata-authoring-roundtrip: the ref names no pin that scores a clause; only protocol-layer evidence for the package gate
- platform-core.interrupted-migration-boot-report: the boot-log/api clauses need the three-boot live sequence; only the two degradation arms are test-oracle
- platform-core.activation-ledger-registration-home: negative[2] (second registrant boot failure) is live-only by its own text
- platform-core.activation-ledger-row-contract: the generic-door 405s, the unique index, the INSERT probes and the sharing_rule/webhook reads are live legs; most clauses pinned in half
- platform-core.url-overlay-contract: browser surface: every screenshot/network clause is a live leg; the ci(spec): retire the generated paths filter — every artifact gate moves to the unfiltered required job #4292 fail-closed matrix is pinned at component layer only
- platform-core.lifecycle-retention-sweep: the real-timer, onlyWhen and kill-switch legs need the live boot; the class-vocabulary build read is outside this card
- platform-core.settings-audit-secret-fingerprint: the ledger rows are never read back over the API; acceptance[0]-[4] pinned at the service over stub sinks only
- platform-core.protocol-18-handshake-and-stored-replay: acceptance[1]-[3] pinned only below their door/boot layer
- platform-core.settings-organization-isolation-and-platform-rung: the api clauses are pinned in process only; the walled legs need a walled boot (knownGaps[0])
- platform-core.serve-composition-v18: acceptance[5] is pinned on the plugin's Hono mount, not on a served boot
- records-forms.field-type-matrix: live legs not driven A1
- records-forms.list-view-capabilities: partial A0,A1,A5,A7; live legs not driven A2,A3,A4,A6,A8,A9,N0,N1,N2
- records-forms.view-type-gallery: partial A1,A2; live legs not driven A0,A3,A4,N0,N1
- records-forms.conditional-rules-header: partial A2,A5; live legs not driven A4,N2
- records-forms.conditional-rules-grid: partial A0,A2,N1; live legs not driven A1,A3,A4,N0
- records-forms.cascading-options: partial A0,A2; live legs not driven A3
- records-forms.master-detail-atomic-save: partial A0,A3,N1
- records-forms.related-list-server-pagination: partial A1,A4,A5,N1,N2; live legs not driven A0,A2,A3,N0
- records-forms.action-param-widgets: partial A3; live legs not driven A0,A1
- records-forms.import-wizard-encoding-and-hints: partial A3,N1; live legs not driven N0
- records-forms.gantt-interactions: partial A0,A1,A2; live legs not driven A3,N0
- records-forms.form-dirty-guard: partial A0,N0; live legs not driven A1
- records-forms.adhoc-filter-sort-builder: partial A4; live legs not driven A0,A1,A2,A3,N0,N1,N2,N3
- records-forms.concurrent-edit-conflict: partial A1,A3,N0,N2; live legs not driven A0,A2,A4,A5,N1
- records-forms.record-discussion-mentions: partial A0,A4,A5,A6,A9,N1,N2,N3,N4,N5,N6; live legs not driven A1,A2,A3,A7,N0
- records-forms.bulk-select-all-matching: every clause pinned only at component-jsdom over a mocked data source; live network/api/dom legs not driven
- records-forms.import-job-undo-cancel: cancel legs unpinned; per-row results, marker-filter count and post-revert revertedAt not read by the spec
- records-forms.field-type-constraints: refusal codes (max_length, range, scale, invalid_option, invalid_type) unpinned; reference/autonumber only at engine
- records-forms.cascading-multilevel-and-clear: picker network leg (A3) unpinned; A0 submit half and A1 verify vector/message key not asserted
- records-forms.field-unique-enforcement: predicate updateMany has no REST door; that half rests on the memory-driver pin
- records-forms.delete-behavior-matrix: api clauses pinned only at the engine layer; no REST DELETE pin
- records-forms.record-clone-contract: gate, not-found and override-forge legs unpinned; body shape only at protocol/mock-route level
- records-forms.field-history-tracking: read-gate network legs (A2 absence half, N1) not driven by any pin
- records-forms.v18-semantic-defaults: browser legs A1–A3 outside this pins-only card
- search.field-scoped-narrowing: A1/A3/A4 and both negatives pinned at route-handler level; A2 unpinned
- search.global-search-skips-unreadable: A1/A2/N0/N2 pinned at HTTP on a planted pair only, not the stock fixture; A0 count half, A3 row scope and A4 hidden field are not pinned end to end
- studio-authoring.object-designer-roundtrip: live e2e drives a sibling door (All-metadata designer) and a draft, not the Studio Data pillar publish; reorder/edit and the 3-option published read unpinned
- studio-authoring.record-page-roundtrip: only the picker clause passes; Kind=full create, publish read and end-user render are the live leg
- studio-authoring.org-override-registry-gate: unit pin over a mock engine stops above HTTP; no artifact-backed overlay and no DELETE reset driven
- studio-authoring.expression-editors: jsdom/unit pins only; screenshot, dom and api legs (returnType stamp, held save, publish parity) not driven
- studio-authoring.permission-matrix-editor-ux: jsdom repaint only; saved fields map and narrow-viewport scroll not driven
- studio-authoring.metadata-diagnostics-sweep: only the outage pin scores; REST sweep, scoping, refusals at the door and both browser surfaces are the live leg
- studio-authoring.meta-save-preconditions-and-draft-rows: pins stop above HTTP (RestServer over a mock server, repository and protocol units); api clauses are the live leg
- studio-authoring.multi-package-item-rows: pins stop above HTTP (protocol, REST handler, HttpDispatcher); api clauses are the live leg
- studio-authoring.save-door-runs-authoring-rules: pins run saveMetaItem over a stub engine; the HTTP door answers and read-backs are the live leg
- studio-authoring.held-edit-publish-refusal: jsdom over a client double; toast screenshot, network trace and publish-drafts answer not driven; Data-pillar case unpinned
- studio-authoring.automations-rail-and-new-flow: jsdom only; rail grouping and legend unpinned; draft read not driven
- studio-authoring.org-scope-flows: jsdom over a save/publish double; drafts row, network trace and live read not driven
- studio-authoring.flow-status-matches-runtime: jsdom against a _status double; live pairing, runs and the scheduled-work boot not driven
- studio-authoring.validation-rules-authoring: jsdom/spec-schema only; invalid-condition hold, publish and per-type enforcement not driven
- studio-authoring.hooks-tab-authoring: jsdom over a client double; drafts read, runtime gating and retry/On Error not driven
- studio-authoring.actions-tab-presets: jsdom/spec-schema only; member-side runs, script action and ai.exposed not driven
- studio-authoring.object-api-tab-curl: jsdom only; the copied cURLs are never run against the server
- studio-authoring.interfaces-create-dialogs: jsdom over a save double; PUT answers, published app and launcher not driven

The two blocked rows: identity-auth.auth-method-matrix N2 (dependency: no magic-link or passkey login UI, objectui#4179 closed not_planned) and integration-system.inbound-mailbox-association A3 (fixture: knownGaps[0], no IMAP double or sync composition in the repo).

5. Delta against wave 3 (#27438, at `c4c515a`)

PASS→PARTIAL: 70 · PARTIAL→PARTIAL: 5 · FAIL→PARTIAL: 4 · PASS→PASS: 6 · PARTIAL→PASS: 1.

PASS→PARTIAL (70): coverage mode. Wave 3 scored these from live or browser legs this pins-only card did not drive. No pin regressed. Items: dashboards.dataset-report-authoring, dashboards.empty-null-bucket-boundaries, dashboards.analytics-exposure-gate-and-measure-aggregate, i18n.surface-matrix, i18n.flow-copy-translation-and-host-override, identity-auth.invitation-scope-gates, identity-auth.admin-lifecycle-operations, identity-auth.implicit-account-linking-ownership, identity-auth.auth-gate-held-session-raw-host-families, identity-auth.api-key-expiry-lifecycle, identity-auth.cookie-session-renewal-in-process, identity-auth.import-invitation-and-sso-domain-answers, integration-system.connector-declarative-boot, integration-system.connector-stdio-default-deny, integration-system.connector-descriptor-audit, integration-system.datasource-admin-lifecycle, integration-system.external-schema-introspection, integration-system.connector-auth-kind-application, integration-system.external-schema-browser-ui, integration-system.notification-org-and-redeliver-eligibility, platform-core.metadata-registry-serving, platform-core.metadata-authoring-roundtrip, platform-core.interrupted-migration-boot-report, platform-core.activation-ledger-registration-home, platform-core.activation-ledger-row-contract, platform-core.url-overlay-contract, platform-core.lifecycle-retention-sweep, platform-core.settings-audit-secret-fingerprint, platform-core.protocol-18-handshake-and-stored-replay, platform-core.settings-organization-isolation-and-platform-rung, records-forms.field-type-matrix, records-forms.list-view-capabilities, records-forms.view-type-gallery, records-forms.conditional-rules-header, records-forms.conditional-rules-grid, records-forms.cascading-options, records-forms.master-detail-atomic-save, records-forms.related-list-server-pagination, records-forms.action-param-widgets, records-forms.import-wizard-encoding-and-hints, records-forms.form-dirty-guard, records-forms.adhoc-filter-sort-builder, records-forms.concurrent-edit-conflict, records-forms.record-discussion-mentions, records-forms.bulk-select-all-matching, records-forms.import-job-undo-cancel, records-forms.field-type-constraints, records-forms.cascading-multilevel-and-clear, records-forms.field-unique-enforcement, records-forms.delete-behavior-matrix, records-forms.record-clone-contract, records-forms.v18-semantic-defaults, search.field-scoped-narrowing, search.global-search-skips-unreadable, studio-authoring.object-designer-roundtrip, studio-authoring.record-page-roundtrip, studio-authoring.org-override-registry-gate, studio-authoring.permission-matrix-editor-ux, studio-authoring.metadata-diagnostics-sweep, studio-authoring.meta-save-preconditions-and-draft-rows, studio-authoring.multi-package-item-rows, studio-authoring.save-door-runs-authoring-rules, studio-authoring.held-edit-publish-refusal, studio-authoring.automations-rail-and-new-flow, studio-authoring.org-scope-flows, studio-authoring.flow-status-matches-runtime, studio-authoring.validation-rules-authoring, studio-authoring.hooks-tab-authoring, studio-authoring.actions-tab-presets, studio-authoring.interfaces-create-dialogs.
FAIL→PARTIAL (4): not re-judged, not fixed by this record. The wave-3 FAIL clauses were live legs, and this card scored them skipped. Their extracted cards: integration-system.email-template-render N0 → email templates: after a source edit and hot reload, the by-name read serves the new template while the list read and every send keep the old copy until a cold restart #27488 (closed 10-29); records-forms.field-history-tracking A2 → checklist: re-point records-forms.field-history-tracking acceptance[2] to the record page v3 Timeline › Changes stream — the History tab it asserts was removed by design (#27055) #27492 (re-point, closed 10-29); studio-authoring.object-api-tab-curl A1/A2/N0 → Studio API tab: the example body puts the placeholder id "related_record_id" into every reference field (owner_id included), so the copied Create/Update cURL is refused 400 reference_not_found #27490 (closed 10-29); studio-authoring.expression-editors A2/A4/A6/N0/N1 → Studio: an expression the engine refuses (RLS USING on a formula field, a null-unsafe validation predicate) keeps autosaving — the server verdict is shown on the field but never holds the save #27482 (still open) and Studio Data › Form: closing the field inspector releases the CEL error hold and autosaves the broken formula (returnType dropped); switching object discards the held edit silently #27485 (closed 10-29). W4-C3b1 carries the live retest of expression-editors. The other three are owed a live retest (SKILL §5 trigger 2), listed on [sweep] v18.3.0 release test sweep #27377.
PARTIAL→PASS (1): records-forms.encrypted-field-behavior. Its wave-3 blocked A3/N1 (no unwired boot) are now pinned at the REST door: encrypted-field-behavior.dogfood.test.ts drives the fail-closed write on a scratch stack with the provider unset.
PARTIAL→PARTIAL (5): identity-auth.auth-method-matrix, integration-system.external-schema-drift-gate, integration-system.inbound-mailbox-association, platform-core.serve-composition-v18, records-forms.gantt-interactions.
PASS→PASS (6): records-forms.object-hook-lifecycle, records-forms.predicate-relationship-traversal, records-forms.write-time-option-and-element-shape-judgement, records-forms.write-answer-advisories-rollback-and-tree-delete, records-forms.comment-reactions-and-edit-stamps, search.cross-field-object-search.
This record does not supersede QA run · release-18.3.0-w3-tier1-b (89/89) · c4c515ad · 2026-10-29 · 79 PASS / 6 PARTIAL / 4 FAIL / 0 BLOCKED / 0 NOT-RUN #27438: it re-judged the pinned layer only, so the wave-3 live-leg verdicts stay on QA run · release-18.3.0-w3-tier1-b (89/89) · c4c515ad · 2026-10-29 · 79 PASS / 6 PARTIAL / 4 FAIL / 0 BLOCKED / 0 NOT-RUN #27438.

6. Off-clause probes (RUNNER rule 8)

About 15 min, on showcase boot A, as admin and as a cross-origin browser page. Doors: GET /api/v1/search (empty q, a no-hit q, objects= an unknown name), POST /data/showcase_account/query (searchFields unknown and empty), GET /meta/:type (unknown type), GET /meta/object/:name (unknown name), GET /meta/dashboard/:name?state=draft (no draft), PUT /meta/view/ (empty name), GET /i18n/translations/zz-ZZ, GET /data/showcase_account/:id (unknown id), and the CORS preflight and cross-origin PUT /meta/page/:name?mode=draft. Boundary classes: empty string, unknown id or name, missing draft, and a cross-origin caller.

Every same-origin answer was coded and named the problem (400 VALIDATION_FAILED / invalid_request, 404 RESOURCE_NOT_FOUND / RECORD_NOT_FOUND / NO_DRAFT, 405 METHOD_NOT_ALLOWED), or was the documented empty answer (objects= unknown equals a no-such-object scope, by design; zz-ZZ an empty map).
One product defect, extracted (its number is in the close-out comment): the default CORS policy (DEFAULT_CORS_ALLOW_HEADERS / DEFAULT_CORS_EXPOSE_HEADERS in plugin-hono-server) allows If-Match but not If-None-Match, and exposes no ETag. From a page on another origin, a draft PUT with If-None-Match: * dies at the preflight (TypeError: Failed to fetch), while the same PUT with no conditional header answers 200 and with If-Match answers 409. This is why studio-editor "Add block … stored" and studio-object-designer F4 timed out 3/3 waiting for the draft PUT on a vite dev server with VITE_SERVER_URL set: the Studio's first-draft saves send ifNoneMatch: '*'. On the same-origin preview topology they pass. The card scopes itself away from the console's ruled split-host mode (objectui#5702).
Observed, not extracted: on a stack with no crypto provider, the refused secret write answers 500 INTERNAL_ERROR and keeps its fail-closed message server-side (records-forms.encrypted-field-behavior A3 pin). No stock boot runs without a provider, and the clause asks only for the refusal.

No security finding.

7. Time: environment prep vs testing

Environment prep: install 25 s and full build 16m03s (03:35Z–03:51Z), then about 8 min of boots and console builds for the Playwright pins, about 25 min in all.
Testing: vitest pins 03:51Z–04:17Z (25 min, sequential), Playwright specs and their reruns about 25 min, probes about 15 min, clause scoring 04:43Z–04:55Z (five scorers in parallel).
Ratio about 1 to 3. Wall clock about 80 min to verdicts.

8. Per-clause verdicts

One row per clause (A = acceptance, N = negative), with the layer and one line of text evidence: 688 rows. partial means the pin passed below the clause's oracle layer or covered half of it; skipped means a live or browser leg outside this pins-only card, or a SCOPE pointer. The tables are in the comments below, one per area group. Checklist-accuracy findings and coverage gaps go to the anchor #27377.

Generated by Claude Code

domain:devx#1 · os-warren · session_01JQwxbYXnfyuxgv3GQP9G1h

Per-clause verdicts (1/6): dashboards, i18n, identity-auth, search.

item · rev	clause	verdict	layer · text evidence
dashboards.dataset-report-authoring · r4	A0	pass	HTTP-in-process: dashboard-designer-roundtrip (bootShowcase, Hono app.request): 'saves the layout-less draft (was 422 …)' PUT ?mode=draft 200 and 'publishes the saved draft to live …' POST publish 200
dashboards.dataset-report-authoring · r4	A1	skipped	api: live leg, out of this pins-only card: GET /meta/dashboard/qa_designer_probe body check for dataset+values and absent object/categoryField/valueField/aggregate; the pin's read-back asserts only 3 widgets with no layout
dashboards.dataset-report-authoring · r4	A2	skipped	screenshot: live leg, out of this pins-only card: browser render of the published layout-less dashboard drawing all three widgets
dashboards.dataset-report-authoring · r4	A3	skipped	api: live leg, out of this pins-only card: row-by-row reconciliation of the summary report against a direct dataset aggregate
dashboards.dataset-report-authoring · r4	A4	skipped	api: live leg, out of this pins-only card: 3 spot-checked matrix cells vs aggregate query values
dashboards.dataset-report-authoring · r4	A5	skipped	api: live leg, out of this pins-only card: joined report block totals vs filtered/unfiltered aggregates per measure
dashboards.dataset-report-authoring · r4	A6	skipped	screenshot: live leg, out of this pins-only card: embedded Hours by Status chart bar heights vs table values
dashboards.dataset-report-authoring · r4	A7	skipped	screenshot: live leg, out of this pins-only card: per-variant artifact set (summary, matrix, joined, tabular via ListView)
dashboards.dataset-report-authoring · r4	N0	skipped	api: live leg, out of this pins-only card: parse-time rejection of a joined block nested in blocks[]; no pin drives it
dashboards.dataset-report-authoring · r4	N1	skipped	api: live leg, out of this pins-only card: publish-door 422 widget-dataset-unknown / measure / dimension for a dangling binding
dashboards.empty-null-bucket-boundaries · r2	A0	skipped	screenshot: live leg, out of this pins-only card: empty-window dashboard screenshot + console capture
dashboards.empty-null-bucket-boundaries · r2	A1	skipped	network: live leg, out of this pins-only card: network trace of dataset queries carrying the 2020 window bounds
dashboards.empty-null-bucket-boundaries · r2	A2	skipped	api: live leg, out of this pins-only card: KPI tile values vs direct aggregate with the same bounds
dashboards.empty-null-bucket-boundaries · r2	A3	pass	test-oracle (driver: driver-sql better-sqlite3 + driver-sqlite-wasm): date-bucket-parity-conformance.test.ts green: 'buckets identically pushed-down and in-memory, on both storage forms' per driver, plus checkDateBucketParity detector self-checks
dashboards.empty-null-bucket-boundaries · r2	A4	pass	test-oracle (driver: driver-sql + driver-sqlite-wasm): empty-group-bucket-parity.test.ts green: 'keys the empty bucket identically on both paths — plain groupBy' and '— date-bucketed groupBy' (same shape, null key, total 2, no '(null)' string)
dashboards.empty-null-bucket-boundaries · r2	A5	skipped	screenshot: live leg, out of this pins-only card: single-datapoint chart screenshot with the trap annotation
dashboards.empty-null-bucket-boundaries · r2	N0	partial	driver: date-bucket-parity-conformance guards the #3773 cause (pushed-down vs in-memory bucket parity per granularity); the trend chart over the multi-month seed is not rendered — chart leg is live
dashboards.empty-null-bucket-boundaries · r2	N1	skipped	network: live leg, out of this pins-only card: empty-window re-query trace vs stale widget values
dashboards.analytics-exposure-gate-and-measure-aggregate · r3	A0	pass	test-oracle: service-analytics package run: 4 files passed, 66 tests, 0 failed — api-exposure-door, unexposed-definition-registration, dimension-label-exposure, preview-column-enrichment
dashboards.analytics-exposure-gate-and-measure-aggregate · r3	A1	partial	engine (AnalyticsService over real ObjectQL + SqlDriver, no HTTP): api-exposure-door: 'an apiEnabled: false object is refused 404 OBJECT_API_DISABLED on every door …' and 'an internal: true field is refused 400 INVALID_FIELD in every member position …' as member and admin; no HTTP door, and no case asserts CUBE_NOT_FOUND
dashboards.analytics-exposure-gate-and-measure-aggregate · r3	A2	partial	engine (plugin init over real ObjectQL, recording logger): unexposed-definition-registration: 'the plugin's configured cubes over unexposed objects are refused at init, warned, and absent from getMeta'; the boot log line and GET /analytics/meta on a booted server are live
dashboards.analytics-exposure-gate-and-measure-aggregate · r3	A3	partial	plugin-unit (AnalyticsService over a stub executeAggregate): preview-column-enrichment: 'builtinAggregate (#14492) …' asserts builtinAggregate 'count' on the count measure and live/preview descriptor parity; no case asserts the aggregate key's value or its absence on dimension columns, nor sys_user_metrics over HTTP
i18n.surface-matrix · r13	A0	skipped	screenshot: live leg, out of this pins-only card: one zh-CN screenshot per variant surface
i18n.surface-matrix · r13	A1	skipped	api: live leg, out of this pins-only card: translation read + per-variant key map grounding the screenshots; showcase-anonymous-deny-surfaces reads the zh-CN bundle but only checks one key
i18n.surface-matrix · r13	A2	skipped	screenshot: live leg, out of this pins-only card: fallback screenshots for two known-untranslated keys
i18n.surface-matrix · r13	A3	skipped	screenshot: live leg, out of this pins-only card: status/priority option labels in list cell, form select and list filter
i18n.surface-matrix · r13	A4	skipped	screenshot: live leg, out of this pins-only card: showcase_task list header row 100% zh-CN
i18n.surface-matrix · r13	A5	partial	component-jsdom: page-header-action-i18n: 'renders the translated button AND opens the confirm dialog with the translated body', 'passes the translated successMessage …'; record-quick-actions.actionText-i18n: 'resolves the button AND the confirm dialog body …', 'resolves successMessage …'; vi.fn handlers, no 2xx
i18n.surface-matrix · r13	A6	partial	HTTP-in-process: showcase-anonymous-deny-surfaces 'a signed-in member on $face is served 200 — the control' (the locale list): success true and data.locales contains en + zh-CN; exact-set equality (never a superset) not asserted
i18n.surface-matrix · r13	A7	partial	HTTP-in-process: same control case on /i18n/translations/zh-CN: 200, locale zh-CN, objects.showcase_task.label = 任务 (non-empty); the sixteen-group vocabulary check is not asserted
i18n.surface-matrix · r13	A8	partial	HTTP-in-process: same control case on /i18n/labels/showcase_task/zh-CN: labels.title.label = 标题 (nested shape resolves, not {}); agreement with the rendered zh-CN list header is a browser leg
i18n.surface-matrix · r13	A9	skipped	api: live leg, out of this pins-only card: /i18n/translations/zz-ZZ and /i18n/labels/showcase_task/zz-ZZ bodies
i18n.surface-matrix · r13	A10	skipped	screenshot: live leg, out of this pins-only card: activity feed read as zh-CN and en reader for a row written on the run's boot
i18n.surface-matrix · r13	N0	skipped	screenshot: live leg, out of this pins-only card: session-wide scan for rendered dotted keys
i18n.surface-matrix · r13	N1	skipped	screenshot: live leg, out of this pins-only card: addressable _sections surfaces rendering their translation
i18n.surface-matrix · r13	N2	pass	HTTP-in-process: showcase-anonymous-deny-surfaces 'a signed-in member on $face is served 200 — the control' (the locale list) asserts body.success === true and data.locales present — not a bare array
i18n.surface-matrix · r13	N3	skipped	api: live leg, out of this pins-only card: /labels response compared with the rendered list headers for the same object+locale
i18n.flow-copy-translation-and-host-override · r3	A0	pass	test-oracle: all 8 named files green: service-automation (6 files/208), runtime (16/221), spec (12/1077), platform-objects (2/32), cli (8/97) package runs, 0 failed — includes end-node-refusal-translation, flow-run-locale, flow-screen-option-key, translation, plugin.translations, the three i18n-flow-*-coverage
i18n.flow-copy-translation-and-host-override · r3	A1	partial	plugin-unit (AutomationEngine + memory i18n): end-node-refusal-translation: 'renders the zh-CN template with its hole filled, on the result and on the history row', 'a run with no locale (no person started it) stores the authored message'; no screen-title zh case, no HTTP call
i18n.flow-copy-translation-and-host-override · r3	A2	partial	plugin-unit (extractTranslations): i18n-flow-refusal/screen/toast-option-coverage: 'emits the message of the refused end only …', 'writes the whole flows..screens.. drill …', 'emits each option label …', 'emits the completion toast …'; the os i18n extract command and its file diff are not run
i18n.flow-copy-translation-and-host-override · r3	A3	partial	spec-schema: translation.test.ts 'refuses a single-brace {token} in a translated title, through the one text-slot judge (#22627)'; os validate exit code not run
i18n.flow-copy-translation-and-host-override · r3	A4	partial	plugin-unit (PlatformObjectsPlugin + memory i18n): plugin.translations: 'a host bundle loaded BEFORE the platform bundles serves the host label' and '… AFTER kernel:ready also serves the host label'; the served definition over HTTP is live
identity-auth.auth-method-matrix · r10	A0	skipped	api: live leg, out of this pins-only card: per-variant on/off /api/v1/auth/config reads (SSO/device variants also lack a stock boot switch per knownGaps)
identity-auth.auth-method-matrix · r10	A1	skipped	api: live leg, out of this pins-only card: sign-in, get-session, sign-out, get-session sequence
identity-auth.auth-method-matrix · r10	A2	skipped	api: live leg, out of this pins-only card: phone+password sign-in on a phoneNumber-on boot
identity-auth.auth-method-matrix · r10	A3	partial	plugin-unit (AuthManager.handleRequest over memory engine): phone-otp-no-sms-service-refusal: 'no SMS service wired: answers 400 SMS_SERVICE_REQUIRED, never a bare 500', 'production with a log-only SMS transport: the same 400 …'; the NODE_ENV=production boot door and features.phoneNumberOtp absence in /auth/config are live
identity-auth.auth-method-matrix · r10	A4	skipped	screenshot: live leg, out of this pins-only card: login page screenshots per boot vs /auth/config
identity-auth.auth-method-matrix · r10	A5	skipped	api: live leg, out of this pins-only card: forged calls to each disabled method's endpoint
identity-auth.auth-method-matrix · r10	A6	partial	HTTP-in-process: two-factor-lockout (bootShowcase): beginChallenge asserts sign-in answers twoFactorRedirect:true with a two-factor cookie; 'resets the count when a correct code lands' verify-totp via that cookie 200; no get-session-before-completion read
identity-auth.auth-method-matrix · r10	A7	pass	test-oracle (HTTP-in-process): oidc-authorization-code-flow green: 'authorize: skip_consent client gets an immediate code redirect', 'token exchange succeeds and persists the access-token row …', 'userinfo answers with the signed-in subject'
identity-auth.auth-method-matrix · r10	A8	skipped	api: live leg, out of this pins-only card: /.well-known/openid-configuration and oauth-authorization-server + jwks cross-check
identity-auth.auth-method-matrix · r10	A9	partial	plugin-unit (AuthManager): change-email-delete-user-wiring: 'accepts the change, mails the NEW address, and changes nothing until the link is followed', 'refuses an authenticated self-delete with 404 NOT_FOUND, deleting nothing' (anon 401), 'refuses the /delete-user/callback half too …'; booted door is live
identity-auth.auth-method-matrix · r10	N0	skipped	api: live leg, out of this pins-only card: silent-200 check on disabled method endpoints
identity-auth.auth-method-matrix · r10	N1	partial	plugin-unit (AuthManager): phone-otp-no-sms-service-refusal 'no SMS service wired: answers 400 SMS_SERVICE_REQUIRED, never a bare 500'; booted send-otp door is live
identity-auth.auth-method-matrix · r10	N2	blocked	browser-live: knownGaps: magic-link/passkeys have no login UI (objectui#4179 closed not_planned), so the browser-lane variants are blocked(dependency)
identity-auth.auth-method-matrix · r10	N3	skipped	api: live leg, out of this pins-only card: /api/v1/auth/config payload check for features.magicLink / features.passkeys
identity-auth.auth-method-matrix · r10	N4	skipped	api: live leg, out of this pins-only card: discovery-document issuer/endpoint base check
identity-auth.invitation-scope-gates · r6	A0	partial	HTTP-in-process: delegated-admin-invite 'a delegated_admin CAN issue an invitation — the gate finally has a caller': 200 and one sys_invitation row with role member; status 'pending' not asserted
identity-auth.invitation-scope-gates · r6	A1	pass	HTTP-in-process: 'the same delegate issuing admin is REFUSED, with no invitation row left behind': 403 INVITE_ROLE_ABOVE_ISSUER
identity-auth.invitation-scope-gates · r6	A2	pass	HTTP-in-process: same case: sys_invitation read for the admin invitee email returns 0 rows after the 403 (engine read on the booted stack)
identity-auth.invitation-scope-gates · r6	A3	pass	HTTP-in-process: 'a plain member still cannot invite at all — the ROLE is what opened the endpoint': 403 and no row
identity-auth.invitation-scope-gates · r6	A4	skipped	screenshot: live leg, out of this pins-only card: invite affordance visible to delegated_admin, absent for plain member
identity-auth.invitation-scope-gates · r6	A5	skipped	api: live leg, out of this pins-only card: invitation status vocabulary, cancel/resend effects and delegated_admin cancel refusal
identity-auth.invitation-scope-gates · r6	A6	skipped	api: live leg, out of this pins-only card: two GET /api/v1/security/my-delegable-scope responses vs the DelegableScope shape
identity-auth.invitation-scope-gates · r6	N0	pass	HTTP-in-process: 'the same delegate issuing admin is REFUSED …': 403 INVITE_ROLE_ABOVE_ISSUER and zero sys_invitation rows
identity-auth.invitation-scope-gates · r6	N1	pass	HTTP-in-process: server half: 'a plain member still cannot invite at all …' forged request 403, no row; the affordance half is A4 per the clause
identity-auth.invitation-scope-gates · r6	N2	skipped	api: live leg, out of this pins-only card: my-delegable-scope over-reporting check
identity-auth.admin-lifecycle-operations · r10	A0	partial	HTTP-in-process: admin-platform-admin-standing 'C0 — ban persists and reverses for a platform admin …': sys_user.banned + ban_reason stored, unban clears it; the banned user's refused sign-in and post-unban sign-in are not driven
identity-auth.admin-lifecycle-operations · r10	A1	pass	HTTP-in-process: admin-credential-lifecycle 'set-user-password rotates the credential: the new password signs in, the old is refused': new 200, old 401 with the named credential code
identity-auth.admin-lifecycle-operations · r10	A2	pass	HTTP-in-process: 'create-user with BOTH an explicit password and generatePassword:true applies the EXPLICIT one' (explicit signs in, no generated password returned, credential row) with the contrast 'a generated-password create is the contrast …'
identity-auth.admin-lifecycle-operations · r10	A3	pass	HTTP-in-process: 'the eight consumer-less admin routes refuse the platform admin BY DESIGN, each with its ruled code': set-role 403 YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE; no-effect control re-reads sys_user, role unchanged and not 'admin'
identity-auth.admin-lifecycle-operations · r10	A4	partial	HTTP-in-process: same case pins revoke-user-sessions 403 YOU_ARE_NOT_ALLOWED_TO_REVOKE_USERS_SESSIONS; no protected request is sent as the target afterwards
identity-auth.admin-lifecycle-operations · r10	A5	partial	HTTP-in-process + plugin-unit: same case: remove-user 403 YOU_ARE_NOT_ALLOWED_TO_DELETE_USERS and the target sys_user row survives; security-plugin '[#3023] an engine referential FK clear (__referentialFieldClear) is exempt …' green; the user's owned rows are not re-read
identity-auth.admin-lifecycle-operations · r10	A6	partial	HTTP-in-process: 'C6 — the platform admin may impersonate, and the session records the attribution': 200, session.impersonatedBy and stored sys_session.impersonated_by = admin; stop-impersonating not driven
identity-auth.admin-lifecycle-operations · r10	A7	skipped	screenshot: live leg, out of this pins-only card: console impersonation indicator screenshot
identity-auth.admin-lifecycle-operations · r10	A8	pass	test-oracle (HTTP-in-process): admin-identity-audit-trail green: 'POST /admin/create-user: plugin-audit's hook fires …', 'POST /admin/set-user-password: … the explicit row is the ONLY trail', 'POST /admin/import-users: the run-level row …'
identity-auth.admin-lifecycle-operations · r10	A9	partial	HTTP-in-process: admin-route-nonadmin-refusal 'no anonymous caller and no plain member ever gets a 2xx from an /admin/ route' over 31 derived routes; unchanged-state reads only for create-user/set-user-password ('a non-admin cannot create a user or rotate a password, and neither leaves a trace')
identity-auth.admin-lifecycle-operations · r10	A10	pass	HTTP-in-process: create-user-organization-join (bootStack posture-only, 'guard the guard: a real multi-org posture' isolated): 'J1 in an organization …' organizationId = admin's active org, membershipCreated true, one sys_member row role member
identity-auth.admin-lifecycle-operations · r10	A11	pass	HTTP-in-process: 'J2 no current organization: refused, and no user is created': 400 NO_ACTIVE_ORGANIZATION and sys_user read for the email has 0 rows
identity-auth.admin-lifecycle-operations · r10	A12	partial	plugin-unit (runAdminCreateUser over mock deps): admin-user-endpoints 'under invite-only: still joined — creating a user in your organization is an explicit act'; invite-only walled boot is live
identity-auth.admin-lifecycle-operations · r10	N0	pass	HTTP-in-process: admin-route-nonadmin-refusal 'no anonymous caller and no plain member ever gets a 2xx from an /admin/ route' (has-permission's 200 asserted negative)
identity-auth.admin-lifecycle-operations · r10	N1	skipped	api: live leg, out of this pins-only card: banned user's sign-in refusal (the C0 case attempts no sign-in)
identity-auth.admin-lifecycle-operations · r10	N2	skipped	api: moot while revoke-user-sessions stays ruled (#9969); applies only on a re-mount — nothing to assert at this subject
identity-auth.admin-lifecycle-operations · r10	N3	pass	plugin-unit + HTTP-in-process: security-plugin '[#3023] an engine referential FK clear (__referentialFieldClear) is exempt …' and admin-credential-lifecycle 'create-user with BOTH an explicit password and generatePassword:true applies the EXPLICIT one'
identity-auth.implicit-account-linking-ownership · r5	A0	partial	plugin-unit (AuthManager.handleRequest over in-memory engine): implicit-account-linking 'refuses an unverified local row, writes no link and leaves the row unverified'; sys_account read is off the fake, not an admin read on a booted server
identity-auth.implicit-account-linking-ownership · r5	A1	partial	plugin-unit: 'links a verified local row and signs the caller in'; booted-server redirect/get-session/sys_account reads are live
identity-auth.implicit-account-linking-ownership · r5	A2	partial	plugin-unit: 'after an unlink, an implicit sign-in is refused; an explicit link is allowed and lifts the refusal' (refusal half); live leg remains
identity-auth.implicit-account-linking-ownership · r5	A3	partial	plugin-unit: same case (explicit link lifts the refusal) + 'allows an explicit link-social for an unverified user, without marking the email verified'; live leg remains
identity-auth.implicit-account-linking-ownership · r5	A4	pass	test-oracle (plugin-unit): green incl. 'exempts the platform identity provider from the local-verification precondition', 'binds the platform exception to the OAuth sign-in method, not the provider id alone', 'keeps the platform identity provider exception …', 'honours an unlink for every provider …'
identity-auth.implicit-account-linking-ownership · r5	N0	partial	plugin-unit: 'refuses an unverified local row, writes no link and leaves the row unverified'; booted leg live
identity-auth.implicit-account-linking-ownership · r5	N1	partial	plugin-unit: same case asserts no verification flip on refusal; booted leg live
identity-auth.implicit-account-linking-ownership · r5	N2	partial	plugin-unit: 'after an unlink, an implicit sign-in is refused …'; booted leg live
identity-auth.implicit-account-linking-ownership · r5	N3	partial	plugin-unit: 'allows an explicit link-social for an unverified user …'; booted leg live
identity-auth.implicit-account-linking-ownership · r5	N4	pass	test-oracle (plugin-unit): 'binds the platform exception to the OAuth sign-in method, not the provider id alone' — the knownGaps score the platform exception from this pin
identity-auth.implicit-account-linking-ownership · r5	N5	skipped	api: live-leg procedure guard (fixture provider email_verified); asserts nothing a pin covers
identity-auth.implicit-account-linking-ownership · r5	N6	skipped	api: live-leg procedure guard (fresh context per implicit sign-in); asserts nothing a pin covers
identity-auth.auth-gate-held-session-raw-host-families · r4	A0	pass	test-oracle: all 11 named files green: service-storage, service-settings, plugin-sharing, plugin-webhooks, service-datasource, cloud-connection, runtime, verify, rest, core package runs, 0 failed
identity-auth.auth-gate-held-session-raw-host-families · r4	A1	partial	plugin-unit (handlers with fake IHttpRequest/IHttpResponse): storage/settings/share-link/webhook/datasource/cloud-connection pins: e.g. '%s · held by PASSWORD_EXPIRED → 403 PASSWORD_EXPIRED', 'HELD (…): all seven session doors answer 403 with the gate's code' with un-held CONTROLs; no booted-server HTTP request
identity-auth.auth-gate-held-session-raw-host-families · r4	A2	partial	HTTP-in-process: held-session-vendor-admin-doors 'refuses a platform admin's impersonation 403 PASSWORD_RESET_REQUIRED …' with the hold armed by a system write; the set-user-password forced-reset door itself is not driven
identity-auth.auth-gate-held-session-raw-host-families · r4	A3	partial	plugin-unit (RestServer.enforceAuth / HttpDispatcher with fakes): rest-api-key-account-posture 'REFUSES a key whose owner holds MFA_REQUIRED …', 'SERVES a key whose owner holds only credential-scope postures' (dispatcher twin likewise); no HTTP x-api-key call
identity-auth.auth-gate-held-session-raw-host-families · r4	N0	partial	plugin-unit: un-held CONTROL cases across the family pins and cloud-connection 'anonymous: every session door still answers 401 UNAUTHENTICATED'; over a booted server is live
identity-auth.api-key-expiry-lifecycle · r3	A0	pass	test-oracle: rest (14 files/193), runtime (16/221), qa/dogfood (49/378) package runs green, 0 failed — rest-api-key-lifecycle.pin, api-key-lifecycle.pin, api-key-lifecycle.dogfood
identity-auth.api-key-expiry-lifecycle · r3	A1	pass	HTTP-in-process: api-key-lifecycle.dogfood 'signs with the 90-day default, refuses a date past the ceiling, and stamps the first use': POST /keys 201, expires_at within ±60 s of now+90 d
identity-auth.api-key-expiry-lifecycle · r3	A2	partial	HTTP-in-process: same case: 400 API_KEY_EXPIRY_TOO_LONG at HTTP; 'nothing is stored' only in runtime pin 'a day past the ceiling is refused 400 …, and nothing is stored' over a fake objectql — live key count is the run's
identity-auth.api-key-expiry-lifecycle · r3	A3	partial	plugin-unit (HTTP stub / fake ql, fake kernel): rest-api-key-lifecycle 'revoked, expired and inactive answer 403 with three distinct codes'; runtime 'a revoked key leaves dispatch() as the branded 403 API_KEY_REVOKED …'; no live revoked/expired key
identity-auth.cookie-session-renewal-in-process · r2	A0	pass	test-oracle: runtime and rest package runs green, 0 failed — in-process-session-renewal.pin and in-process-session-read.pin
identity-auth.cookie-session-renewal-in-process · r2	A1	partial	HTTP-in-process: in-process-session-renewal (composed kernel, Hono app.request): 'GET /data/:object (rest computeExecCtx) — by cookie: no renewal, no cookie' (stored expires_at unchanged, no Set-Cookie); the meta read GET /meta/object/showcase_task has no door in the pin
identity-auth.cookie-session-renewal-in-process · r2	A2	pass	HTTP-in-process: 'renews an aged session and re-issues the cookie with Max-Age = expiresIn' (control — browser-facing get-session); also 'by cookie: resolves the principal without renewal — and get-session then still renews AND re-issues'
identity-auth.import-invitation-and-sso-domain-answers · r3	A0	pass	test-oracle: plugin-auth (7 files/161) and plugin-email (2/48) package runs green, 0 failed — sso-domain-verification-unknown-provider.pin, admin-import-users-invite-link, admin-import-users-account-invitation, auth-account-invitation-template
identity-auth.import-invitation-and-sso-domain-answers · r3	A1	partial	plugin-unit (mounted AuthPlugin over a memory engine): admin-import-users-account-invitation '① through the mounted import: the new account, its inviter, the set-password link and its real expiry', '② NEGATIVE CONTROL: a user-requested reset still sends auth.password_reset …'; booted-server mail capture is live
identity-auth.import-invitation-and-sso-domain-answers · r3	A2	partial	plugin-unit (Hono-mounted AuthPlugin over a memory engine): admin-import-users-invite-link '① through the mounted import, lands on the Console set-password page with the origin check on': link 302 to the set-password page ?token=, reset POST 200; booted server leg live
identity-auth.import-invitation-and-sso-domain-answers · r3	A3	partial	plugin-unit (Hono over createMemoryEngine): sso-domain-verification-unknown-provider: ON '…: 404 RESOURCE_NOT_FOUND naming the provider …', OFF '…: 400 DOMAIN_VERIFICATION_DISABLED, vendor never asked'; the two booted servers are live
search.cross-field-object-search · r4	A0	pass	HTTP-in-process: showcase-search (shared showcase, POST /data/showcase_account/query): 'multi-field match: "retail" returns Northwind via industry, not name' incl. the premise guard and the ['industry']-restricted rerun
search.cross-field-object-search · r4	A1	pass	HTTP-in-process: same case: names.some(n contains 'retail') beside Northwind in one result set (the verify accepts this form)
search.cross-field-object-search · r4	A2	pass	HTTP-in-process: 'textual case-fold: "retail" and "Retail" both match the capitalized name "Acme Retail"' with ['name'] narrowing
search.cross-field-object-search · r4	A3	pass	HTTP-in-process: 'select label→value mapping: the capitalized label "Retail" also matches' — Northwind returned
search.cross-field-object-search · r4	A4	pass	HTTP-in-process: 'terms AND: "retail northwind" still matches; "retail contoso" does not' — neither Northwind nor Contoso in the cross result
search.cross-field-object-search · r4	N0	pass	HTTP-in-process: 'terms AND …' asserts 'retail contoso' does not return Contoso
search.cross-field-object-search · r4	N1	pass	HTTP-in-process: 'multi-field match …' asserts 'retail' returns Northwind (search not dropped)
search.cross-field-object-search · r4	N2	pass	HTTP-in-process: 'textual case-fold …' asserts lowercase 'retail' narrowed to name returns Acme Retail
search.field-scoped-narrowing · r3	A0	pass	HTTP-in-process: showcase-search '$searchFields narrows: "retail" restricted to name matches nothing' (Northwind absent) + 'multi-field match …' ['industry'] rerun keeps Northwind
search.field-scoped-narrowing · r3	A1	partial	engine (rest route handler, no HTTP): list-view-grouping-query-door 'a grouped query whose searchFields names a column search cannot scan is REFUSED …' 400 INVALID_FIELD for a typo; real-but-unsearchable field and the live REST ingress are unpinned
search.field-scoped-narrowing · r3	A2	skipped	api: live leg, out of this pins-only card: ['__search'] override refusal and no __search key in record bodies; no pin mentions __search
search.field-scoped-narrowing · r3	A3	partial	engine (rest route handlers over SqlDriver): data-empty-search-fields-door 'controls: a named override narrows …' and 'parity: the body schema refuses exactly the values the protocol door refuses …' drive the GET $search/$searchFields handler; GET-vs-POST result parity on the showcase is live
search.field-scoped-narrowing · r3	A4	partial	engine (rest route handlers over real SqlDriver): data-empty-search-fields-door 'GET list: 400 VALIDATION_ERROR naming the querystring spelling — no read', 'POST query: … 400 VALIDATION_FAILED naming the key', parity case [''] → INVALID_FIELD; booted ingress is live
search.field-scoped-narrowing · r3	N0	partial	engine (rest route handler): list-view-grouping-query-door unscannable searchFields refused 400 INVALID_FIELD (not 200 unnarrowed); booted ingress leg live
search.field-scoped-narrowing · r3	N1	partial	engine (rest route handlers): data-empty-search-fields-door refusals precede any read ('… no read'); booted ingress leg live
search.global-search-skips-unreadable · r5	A0	partial	HTTP-in-process: search-skip-unreadable.dogfood (planted pair) 'the member's UNSCOPED search answers the readable object's hit and never names the walled one': 200, no walled name/id; totalObjects not asserted on the unscoped search
search.global-search-skips-unreadable · r5	A1	partial	HTTP-in-process: 'an explicit objects= naming the walled object answers the readable hits only': mixed → readable hit only, totalObjects 1; objects=walled body toEqual objects=no_such_object, hits [] and totalObjects 0 (planted W, not stock) — downgraded by the runner: the ref says this planted-pair pin corroborates and never reads the stock fixture the clause names
search.global-search-skips-unreadable · r5	A2	partial	HTTP-in-process: 'control: the walled object is refused to the member at its own door' (403) + 'negative control: the administrator still gets the hits from both objects' (planted W) — downgraded by the runner: the ref says this planted-pair pin corroborates and never reads the stock fixture the clause names
search.global-search-skips-unreadable · r5	A3	skipped	api: live leg, out of this pins-only card: member vs admin showcase_invoice hits (INV-1003) and the member's readable-row read
search.global-search-skips-unreadable · r5	A4	partial	plugin-unit (protocol searchAll over stubs): protocol.search-skip-unreadable 'a partial queryable set is handed to the engine as searchFields'; the member's sys_user role=user search on a pinyin-off boot is live
search.global-search-skips-unreadable · r5	N0	partial	HTTP-in-process: unscoped member search answers 200, not 403 (dogfood unscoped case); protocol 'control: without the pre-filter the middleware denial fails the whole search with 403' shows the defect shape — downgraded by the runner: the ref says this planted-pair pin corroborates and never reads the stock fixture the clause names
search.global-search-skips-unreadable · r5	N1	partial	HTTP-in-process: dogfood asserts no walled name/id in the unscoped and mixed bodies and totalObjects 1 on the mixed scope; the unscoped count is unasserted
search.global-search-skips-unreadable · r5	N2	partial	HTTP-in-process: dogfood objects=walled body toEqual objects=no_such_object body — downgraded by the runner: the ref says this planted-pair pin corroborates and never reads the stock fixture the clause names
search.global-search-skips-unreadable · r5	N3	partial	plugin-unit: protocol.search-skip-unreadable 'a partial queryable set is handed to the engine as searchFields'; hidden-field hit check on the booted stock is live
search.global-search-skips-unreadable · r5	N4	partial	plugin-unit: protocol.search-skip-unreadable 'an object with NO queryable search field is skipped, unqueried and uncounted' and the partial-set case; booted leg live
search.global-search-skips-unreadable · r5	N5	skipped	api: live-leg persona guard; the pin's deny side already runs as a signed-up member, asserts nothing beyond that

Generated by Claude Code

domain:devx#1 · os-warren · session_01JQwxbYXnfyuxgv3GQP9G1h

Per-clause verdicts (2/6): integration-system.

item · rev	clause	verdict	layer · text evidence
integration-system.connector-declarative-boot · r6	A0	partial	HTTP-in-process: showcase-declarative-mcp.dogfood 'materializes all three generic-executor instances at boot — mcp included, state ready' (GET /automation/connectors): mcp origin declarative + state ready; rest/openapi state ready only, origin unasserted — one verdict per variant is wanted
integration-system.connector-declarative-boot · r6	A1	partial	HTTP-in-process: same case asserts mcp actions toContain('echo_upper') (containment, not equality with tools/list); the openapi instance's actions vs status-openapi.json operations (getHealth) asserted by no pin
integration-system.connector-declarative-boot · r6	A2	partial	HTTP-in-process: 'dispatches the MCP tool end-to-end through the flow connector_action': POST /automation/showcase_mcp_connector_echo/trigger success, output contains OBJECTSTACK; the rest ping flow (ShowcaseDeclarativeConnectorPingFlow) is triggered by no pin
integration-system.connector-declarative-boot · r6	A3	partial	spec-schema: connector-provider.test.ts 'rejects `providerConfig` without a provider', 'rejects authored `actions` on a provider-bound instance', 'rejects inline `authentication` secrets on a provider-bound instance (§3)' — regex fragments at schema parse; no build is run
integration-system.connector-declarative-boot · r6	A4	partial	engine: connector-materialization.test.ts 'fails boot loudly when the provider has no registered factory' (LiteKernel bootstrap rejects /no provider factory/) in process over a fake registry; the served boot's fatal output for provider 'no_such_provider' is the live leg
integration-system.connector-declarative-boot · r6	A5	partial	engine: connector-materialization.test.ts 'skips a provider-bound instance marked enabled:false', 'unregisters and tears down an instance removed after boot', 'tears down an instance newly marked enabled:false' (LiteKernel, fake provider); the served listings are the live leg
integration-system.connector-declarative-boot · r6	N0	pass	HTTP-in-process: 'materializes all three generic-executor instances at boot — mcp included, state ready': expect(byName['showcase_erp_catalog']).toBeUndefined() on the booted showcase's GET /automation/connectors
integration-system.connector-declarative-boot · r6	N1	partial	spec-schema: connector-provider.test.ts asserts the three superRefine refusals (providerConfig-without-provider, authored actions, inline authentication) at schema parse; no build of the three malformed entries is run
integration-system.connector-stdio-default-deny · r3	A0	partial	plugin-unit: mcp-provider.test.ts 'DENIES a declarative stdio transport by default, as a plain (non-retryable) fault': factory rejects /stdio transports are disabled by default/ with the declarativeStdio opt-in hint over a fake client factory; the served boot output line is the live leg
integration-system.connector-stdio-default-deny · r3	A1	partial	plugin-unit: 'allowlist admits exactly the listed command and rejects others': /not in the host's declarativeStdio allowlist [npx, my-mcp]/ for command 'bash' at the provider factory; the mismatch boot's error text (python3 vs [node]) is the live leg
integration-system.connector-stdio-default-deny · r3	A2	partial	plugin-unit: the deny and mismatch cases assert isConnectorUpstreamUnavailable(err) === false (plain configuration fault, not retryable); that the served boot aborts with no 'registered DEGRADED' line or retry loop is the live leg
integration-system.connector-stdio-default-deny · r3	A3	partial	HTTP-in-process: sibling pin showcase-declarative-mcp.dogfood (green this run, not in this ref) 'materializes all three generic-executor instances at boot': showcase_mcp_tools state ready, actions contain echo_upper, with ConnectorMcpPlugin({ declarativeStdio: ['node'] }) — downgraded by the runner: the green pin is connector-declarative-boot's ref, not this item's
integration-system.connector-stdio-default-deny · r3	N0	pass	plugin-unit: 'DENIES a declarative stdio transport by default…': seen.transport stays undefined — the factory rejects before the client factory (the spawner) is handed any transport, so nothing is spawned
integration-system.connector-stdio-default-deny · r3	N1	partial	plugin-unit: deny/mismatch cases assert the fault is not upstream-unavailable (so not graded degraded/retryable) at the provider; a served boot showing no state:'degraded' husk with backoff is the live leg
integration-system.connector-descriptor-audit · r3	A0	partial	engine: connector-descriptor-audit.test.ts 'warns once at boot for an inert declared connector, naming it' (LiteKernel, warn spy): one warning with crm_billing and 'catalog descriptors (descriptor-only contract)'; the remedy wording and the served boot log are the live leg
integration-system.connector-descriptor-audit · r3	A1	partial	engine: (a) 'stays silent for a deliberate catalog-only entry (enabled: false)' and (b) 'stays silent when the declared connector is plugin-registered' at kernel:ready in process; (c) provider-bound instances never audited is fed to no case; the per-condition served boot logs are the live leg
integration-system.connector-descriptor-audit · r3	A2	skipped	log: live leg, out of this pins-only card: enable the scratch descriptor at runtime and read the warning after the metadata:reloaded reconcile; the pin fires kernel:ready only
integration-system.connector-descriptor-audit · r3	N0	partial	engine: the silencing contract holds in process ('stays silent for a deliberate catalog-only entry (enabled: false)'); that the stock showcase boot emits no warning (the shipped showcase_erp_catalog keeps enabled:false) is read off no pin
integration-system.connector-descriptor-audit · r3	N1	skipped	log: live leg, out of this pins-only card: grep the showcase boot log for the audit warning naming showcase_status_api / showcase_status_openapi / showcase_mcp_tools; no case feeds a provider-bound instance to the audit
integration-system.email-template-render · r12	A0	partial	engine: materialization dogfood 'renders the authored template through sendTemplate — the built-in copy does not reach the wire': subject exact 'Authored reset for Ada', body only toContain('Authored body') — body triple-brace url hole and zero residue unasserted; fixture package, not showcase
integration-system.email-template-render · r12	A1	partial	plugin-unit: send-template.test.ts 'throws MISSING_VARIABLES when required vars absent': rejects /MISSING_VARIABLES: resetUrl/ (names the variable) over a fake loader; the sys_notification_delivery row status 'dead' and the optional-variable-absent render are the live leg
integration-system.email-template-render · r12	A2	partial	plugin-unit: send-template.test.ts 'throws TEMPLATE_INACTIVE for active=false rows' over a fake loader; the registry-resolved inactive item and its dead sys_notification_delivery row read over GET /api/v1/data are the live leg
integration-system.email-template-render · r12	A3	partial	engine: two-locales dogfood: zh-CN sends its own wording (exact member reachable); 'control: a locale nobody saved keeps the package ladder' (ja-JP → en-US); unit 'falls back to en-US…' and 'throws TEMPLATE_NOT_FOUND when loader returns null'; no case sends 'zh' to prove no subtag folding onto zh-CN
integration-system.email-template-render · r12	A4	partial	plugin-unit: send-template.test.ts 'uses template fromOverride when supplied' (from 'Security Team' at security@x.com) and 'auto-derives plain text from HTML when body_text omitted'; replyTo and the row keeping bodyText absent are asserted by no pin
integration-system.email-template-render · r12	A5	partial	HTTP-in-process: overlay-survives-boot dogfood 'after a cold boot the metadata door and the rendered mail both carry the admin's wording' (GET /meta/email_template/showcase_task_done_email 200 + admin subject on the showcase); the declared-source edit served on metadata reload is unpinned
integration-system.email-template-render · r12	A6	skipped	build: live leg, out of this pins-only card: parse EmailTemplateDefinitionSchema probes (stray content key → bodyHtml alias prescription; non-dotted-snake-case name) — no pin named
integration-system.email-template-render · r12	A7	partial	HTTP-route-layer: email-send-door-bounds.test.ts (real HonoHttpServer + RestServer, mail double): 200 top-level result; 403 member/sentBy/from/headers/org/identityMail; 401 anonymous; 400 INVALID_REQUEST; 501 no provider. VALIDATION_FAILED, dev-transport landing, sys_email row are live
integration-system.email-template-render · r12	N0	pass	engine: materialization dogfood 'renders the authored template…built-in copy does not reach the wire' and 'a Studio save over the authored template sends on the very next mail, with no restart'; overlay dogfood: admin wording sends at once and after a cold boot
integration-system.email-template-render · r12	N1	partial	engine: subjects asserted exact (no residue) in every dogfood send and unit 'renders template + delivers via transport' checks html/text substituted values by containment; no case asserts zero { {…}} residue across the whole delivered body
integration-system.email-template-render · r12	N2	skipped	api: live leg, out of this pins-only card: POST /api/v1/email/send with bodyHtml answering 400 'at least one of text or html is required' — a NOT-a-FAIL guard no pin drives
integration-system.datasource-admin-lifecycle · r8	A0	partial	HTTP-route-layer: admin-routes.test.ts 'GET /api/v1/datasources/drivers returns the driver catalog with configSchema' (no service mounted) and auth-guard 'GET /datasources/drivers (driver catalog) answers 401 UNAUTHENTICATED with no session' — real Hono registrar over fake auth; served answers are live
integration-system.datasource-admin-lifecycle · r8	A1	partial	HTTP-route-layer: admin-routes-auth-guard.test.ts: all 11 routes '… answers 401 UNAUTHENTICATED with no session' and '… answers 403 PERMISSION_DENIED without manage_platform_settings' (message names it), dispatch spies uncalled — over fake auth and grants engine; the served floor probes are the live leg
integration-system.datasource-admin-lifecycle · r8	A2	partial	HTTP-route-layer: 'POST /api/v1/datasources/test splits the inline secret out of the draft': testConnection called with the secret-free draft + { value }; no-persistence (unchanged GET listing) and the ledger rows for both spellings are the live leg over a stubbed service
integration-system.datasource-admin-lifecycle · r8	A3	partial	plugin-unit: datasource-admin-plugin.test.ts 're-homes through the host binder when it can bind AND resolve' and 'refuses when the host binder cannot READ a secret back' (status 'refused') at the service; POST /:name/migrate-credential's 200 plan outcomes and the post-migration redacted read are the live leg
integration-system.datasource-admin-lifecycle · r8	A4	partial	HTTP-in-process: datasource-meta-door-reaches-admin-door.dogfood 'a datasource the admin door creates is edited and removed through the metadata door…': POST /datasources 201 and listing origin 'runtime' on the booted showcase; the health `status` field is asserted by no pin
integration-system.datasource-admin-lifecycle · r8	A5	partial	plugin-unit: datasource-config-redaction.test.ts 'RED ON MAIN — a stored row's cleartext password does not reach the caller' and datasource-admin-plugin 'persists a credentialsRef (not cleartext) when a binder is wired' at the service; the HTTP list/detail bodies (hasSecret, no secret anywhere) are the live leg
integration-system.datasource-admin-lifecycle · r8	A6	partial	HTTP-route-layer: admin-routes.test.ts 'surfaces lifecycle errors as 400 with the service message' and envelope 'a lifecycle failure carries the service message → 400 DATASOURCE_ADMIN_ERROR' over a throwing stub; a real malformed draft refused by the real service is the live leg
integration-system.datasource-admin-lifecycle · r8	A7	pass	test-oracle: admin-routes.test.ts '… degrades to 503 naming external-datasource (#4225)' for remote-tables, :name/test, :name/object-draft and 'a wired datasource-admin does not answer for an unwired external-datasource (#4225)'; envelope 'the external-datasource service is not wired' — green
integration-system.datasource-admin-lifecycle · r8	A8	partial	HTTP-route-layer: ledger half whole: route-ledger.conformance 'every mounted datasource-admin route has a ledger entry', 'every ledger entry is really mounted by the registrar', 'compared against a real enumeration'; 404 half over a stub only (envelope '…does not exist → 404 RESOURCE_NOT_FOUND')
integration-system.datasource-admin-lifecycle · r8	N0	partial	plugin-unit: datasource-config-redaction 'RED ON MAIN — the SERVED config is redacted while the STORED record keeps its credential' and getDatasource redaction cases at the service door; a grep of the HTTP list/detail bodies is the live leg
integration-system.datasource-admin-lifecycle · r8	N1	partial	HTTP-route-layer: admin-routes-auth-guard.test.ts: no route answers 200 to anonymous (401) or the unentitled (403) on the real registrar over fake auth; the served stack's floor is the live leg
integration-system.datasource-admin-lifecycle · r8	N2	skipped	api: live leg, out of this pins-only card: POST /api/v1/datasources/test then GET /api/v1/datasources showing no persisted row and 'test' never captured as a name — every pin stubs the service, so persistence is unobserved
integration-system.datasource-admin-lifecycle · r8	N3	partial	plugin-unit: datasource-admin-plugin.test.ts credential re-homing cases ('re-homes…', 'refuses when the host binder cannot READ a secret back') at the service; the door answering 200 (not 400) for an already-clean row and the post-bind read are the live leg
integration-system.datasource-admin-lifecycle · r8	N4	pass	HTTP-route-layer: admin-routes.test.ts '#4225' table: each federation route's 503 message is 'The external-datasource service is not available.' while datasource-admin still serves — the attribution is owned by the route layer
integration-system.datasource-admin-lifecycle · r8	N5	pass	HTTP-route-layer: admin-routes.test.ts '… refuses as 400 DATASOURCE_ADMIN_ERROR (#4249)' for the six admin routes and '… refuses as 400 EXTERNAL_DATASOURCE_ERROR (#4249)' for the three federation routes, each mount wiring only the resolving service
integration-system.external-schema-introspection · r8	A0	partial	plugin-unit: external-datasource-service.test.ts 'lists tables with parsed schema + column counts' (fake introspector, fact_orders columnCount 6); GET /api/v1/datasources/showcase_external/remote-tables answering customers/orders with columnCount 7 over real sqlite is the live leg
integration-system.external-schema-introspection · r8	A1	pass	test-oracle: remote-tables-twin.equivalence.test.ts '#7955' describe green: '?schema= returns the SAME filtered set on both spellings', 'no ?schema=…unfiltered', 'a repeated ?schema= degrades to no filter…', 'an empty ?schema= is no filter…' (real Hono + real service, fake introspector)
integration-system.external-schema-introspection · r8	A2	partial	plugin-unit: external-datasource-service.test.ts 'maps columns to field types and flags lossy/unknown for review': order_id toEqual { type: 'text' }, review flags geo, source has '// Remote primary key: order_id'; first-line header, value import and typecheck unpinned
integration-system.external-schema-introspection · r8	A3	partial	test-oracle: the remote-tables ≡ external/tables twin is pinned whole by remote-tables-twin.equivalence.test.ts; the object-draft ≡ external/tables/:remote/draft twin and the shared 400 EXTERNAL_DATASOURCE_ERROR across both spellings have no pin
integration-system.external-schema-introspection · r8	A4	partial	HTTP-route-layer: twin test 'an anonymous caller is refused identically on both spellings' (401) and '[#9901] an authenticated but UNENTITLED caller is refused identically…' / '…keyed on the CAPABILITY…' (403) over fake auth; the 403 message and served stack are live
integration-system.external-schema-introspection · r8	N0	partial	HTTP-route-layer: admin-routes.test.ts '#4249' and '#4225' tables: the admin spelling's introspection routes refuse 400 EXTERNAL_DATASOURCE_ERROR and 503 naming external-datasource; the federation spelling (external/tables, …/draft) refusal attribution is in no named pin
integration-system.external-schema-introspection · r8	N1	partial	HTTP-route-layer: twin test 'an anonymous caller is refused identically on both spellings' and 'a credential the deployment does not admit is refused identically…': 401 on both, no listing leaked — route layer over fake auth; the served stack is the live leg
integration-system.external-schema-introspection · r8	N2	partial	HTTP-route-layer: admin-routes.test.ts 'POST /api/v1/datasources/:name/object-draft generates a draft (400 without table)' asserts status 400 only — the message 'Body field "table" is required.' is unasserted
integration-system.external-schema-introspection · r8	N3	pass	test-oracle: twin test 'a repeated ?schema= degrades to no filter on both spellings, identically' (full unfiltered set, statuses equal — no 500) and 'an empty ?schema= is no filter on both spellings, identically'
integration-system.external-schema-drift-gate · r6	A0	partial	plugin-unit: external-validation-plugin.test.ts 'throws ExternalSchemaMismatchError on failure with default (fail) policy' and 'defaults to fail when the datasource definition is unavailable' (stubs, error class only); the induced-drift boot's abort output is the live leg
integration-system.external-schema-drift-gate · r6	A1	partial	plugin-unit: 'warns instead of throwing when onMismatch=warn' over stubbed services; a completed boot answering /ready with the '[external-validation] external schema drift' line is the live leg (needs an induced drift, knownGaps[0])
integration-system.external-schema-drift-gate · r6	A2	partial	plugin-unit: 'does nothing when onMismatch=ignore' over stubbed services; the grepped boot log with no drift warn is the live leg
integration-system.external-schema-drift-gate · r6	A3	partial	plugin-unit: checkonboot test: 'a MEASURED mismatch cannot abort boot through a checkOnBoot:false datasource', 'does not raise the unreachable-remote warning…', 'an ABSENT checkOnBoot still aborts boot', rejected spellings — plugin layer; the SKIPPED info line on a drifted boot is live
integration-system.external-schema-drift-gate · r6	A4	pass	test-oracle: external-validation-checkonboot.test.ts 'scope: the gate covers the BOOT STEP ONLY' → 'checkOnBoot:false still arms the background drift checker it asked for' green
integration-system.external-schema-drift-gate · r6	A5	pass	test-oracle: list-diagnosed-consumer-sweep.test.ts '#6504 — the ADR-0015 boot gate must not announce an all-clear over an incomplete sweep': all four cases green (withholds the claim while a loader is down; claims once every loader answers; predating service; completeness not DETERMINED)
integration-system.external-schema-drift-gate · r6	A6	pass	test-oracle: external-validation-plugin.test.ts 'background drift detection (ADR-0015 §5.2)': 'runDriftCheck emits one external.schema.drift event per drifted object', 'schedules a timer only for datasources declaring checkIntervalMs', 'runDriftCheck is a no-op (no throw) when the scoped validation rejects'
integration-system.external-schema-drift-gate · r6	N0	partial	plugin-unit: 'throws ExternalSchemaMismatchError on failure with default (fail) policy' at the plugin; a drifted boot coming up serving anyway is read only off an induced-drift served boot
integration-system.external-schema-drift-gate · r6	N1	partial	plugin-unit: checkonboot test: measured mismatch on a checkOnBoot:false datasource cannot abort, skip line emitted only when one opts out ('emits no skip line when no datasource opts out'), watcher still armed — plugin layer; the boot's info line is the live leg
integration-system.external-schema-drift-gate · r6	N2	pass	test-oracle: list-diagnosed-consumer-sweep.test.ts 'withholds the "all federated objects match" claim while a loader is down' green
integration-system.external-schema-drift-gate · r6	N3	partial	spec-schema: external-errors.test.ts 'renderDiffMessage' → 'renders one line per diff entry with type detail' and 'ExternalSchemaMismatchError carries code, datasource, object, diffs and a rendered message' as pure functions; the message a boot prints is the live leg
integration-system.external-schema-drift-gate · r6	N4	pass	test-oracle: external-validation-plugin.test.ts 'runDriftCheck is a no-op (no throw) when the scoped validation rejects' green
integration-system.external-schema-drift-gate · r6	N5	partial	plugin-unit: 'is a no-op when the external-datasource service is absent' asserts the call resolves undefined, not the absence of warn/error lines; a federation-free boot's log is the live leg
integration-system.connector-auth-kind-application · r5	A0	partial	plugin-unit: rest-connector.test.ts 'static auth': 'injects a bearer token', 'injects a basic auth header', 'injects an api-key header by default', 'injects an api-key as a query param when paramName is set', 'adds no auth for type none' — stubbed fetch; echo-upstream capture is live
integration-system.connector-auth-kind-application · r5	A1	partial	engine: connector-materialization.test.ts 'resolves auth.credentialRef through the credential resolver before handing it to the factory' and 'falls back to environment variables for credentialRef (open tier)' on a LiteKernel; the meta read of the ref vs the echo capture of the value is the live leg
integration-system.connector-auth-kind-application · r5	A2	partial	engine: materialization 'degrades the instance, naming the reference, when credentialRef does not resolve' (factory not called) and credential-door 'missing → degraded naming the reference; set → ready; clear → degraded again' in process; served listing and dispatch failure are live
integration-system.connector-auth-kind-application · r5	A3	partial	spec-schema: connector-provider.test.ts 'rejects inline `authentication` secrets on a catalog descriptor' and '… on a provider-bound instance (§3)' at schema parse; the oauth2 discriminator refusal of ConnectorInstanceAuthSchema is fed to no case and no build is run
integration-system.connector-auth-kind-application · r5	A4	partial	engine: credential-door 'not in a log record, the listing, the connector descriptors or an engine read of the row': no value in getConnectorDescriptors(), listing, engine read or logs (real ObjectQL/SQLite); served GET /automation/connectors and /meta bodies are live
integration-system.connector-auth-kind-application · r5	N0	partial	engine: same credential-door case: the stored value appears in no descriptor, listing, engine read or log record in process; full HTTP listing/meta body greps are the live leg
integration-system.connector-auth-kind-application · r5	N1	partial	spec-schema: the inline non-'none' `authentication` refusal is pinned at schema parse (connector-provider.test.ts); an oauth2-authored entry building clean is checked by no pin
integration-system.connector-auth-kind-application · r5	N2	partial	engine: materialization 'degrades the instance…' (boot not failed, factory never called) and credential-door listing state 'degraded' via engine.listConnectorCredentialRefs in process; the entry on GET /api/v1/automation/connectors naming the reference is the live leg
integration-system.external-schema-browser-ui · r7	A0	skipped	screenshot: live leg, out of this pins-only card: screenshot the External Datasource panel on showcase_external vs a managed datasource, and the network trace of datasource/new for a name-less /datasources//external call
integration-system.external-schema-browser-ui · r7	A1	skipped	dom: live leg, out of this pins-only card: SchemaBrowser's rendered table list diffed against GET …/external/tables (customers/orders, columnCount 7) after a screenshot; api.test.ts 'lists remote tables out of the { success, data: { tables } } envelope' is the client reader only
integration-system.external-schema-browser-ui · r7	A2	partial	component-jsdom: api.test.ts 'imports a draft as an object via PUT /meta/object/:name' and 'POSTs draft generation with the remote schema option and reads data.draft' (stubbed fetch); the object landing in /meta and answering /data, and server POST …/import 201, are live
integration-system.external-schema-browser-ui · r7	A3	partial	component-jsdom: api.test.ts 'refreshes the catalog and reads data.catalog, snapshotAt included' over a stubbed fetch; the header button's captured POST …/external/refresh-catalog and the rendered timestamp are the live leg
integration-system.external-schema-browser-ui · r7	A4	partial	component-jsdom: api.test.ts 'validates and reads the { ok, results } verdict out of data' over a stubbed fetch; ValidationPanel's rendered verdict rows and diff-kind labels against the captured response are the live leg
integration-system.external-schema-browser-ui · r7	A5	partial	route-handler-unit: external-datasource-routes-auth-guard.test.ts '[#9686] … 401 UNAUTHENTICATED on every route', '[#9901] … holding NOTHING on all five routes — 403', 'the read/write split is real', '[#10255] validate requires the READ capability' — handlers over fake auth; served stack live
integration-system.external-schema-browser-ui · r7	A6	pass	test-oracle: ui api.test.ts '%s maps 503 SERVICE_UNAVAILABLE to the typed error' (all four reads) and 'a 503 whose envelope names another code is not read as "federation not wired"' green; the live unavailable render is not-applicable on a stock boot (knownGaps[0])
integration-system.external-schema-browser-ui · r7	N0	skipped	dom: live leg, out of this pins-only card: compare rendered table/verdict rows to the API responses on a live console
integration-system.external-schema-browser-ui · r7	N1	skipped	api: live leg, out of this pins-only card: import through the dialog, then GET /api/v1/meta/object/‹name› to confirm the row landed
integration-system.external-schema-browser-ui · r7	N2	partial	route-handler-unit: external-datasource-routes-auth-guard.test.ts: no federation route (import / refresh-catalog / validate) answers 200 to anonymous (401) or a no-capability caller (403) — handlers over fake auth, no adapter or served stack
integration-system.external-schema-browser-ui · r7	N3	skipped	api: live leg, out of this pins-only card: a POST /api/v1/data/‹imported object› write against the read-only showcase_external refused
integration-system.external-schema-browser-ui · r7	N4	skipped	screenshot: live leg, out of this pins-only card: the panel's loading / error / unavailable / save-first states rendered in the console; api.test.ts 'surfaces the refusal envelope message and code, never "[object Object]"' is the client reader only, no panel render
integration-system.inbound-mailbox-association · r3	A0	pass	test-oracle: all six named files green this run: mailbox-service-kernel (1 case), mailbox-sync-kernel (4), inline-forward (11), mail-ingest-service (36), mailbox-attachments-kernel (7), spec field-mail-association (9) — every file ≥1 case, 0 failed
integration-system.inbound-mailbox-association · r3	A1	partial	engine: mail-ingest-service.test.ts 'a forward quoted INLINE…' → '…the forward associates through the original sender’s flagged field…' and 'an unmatched message lands in the pool, and the re-match associates it…' on a real engine; served association rows need the IMAP fixture
integration-system.inbound-mailbox-association · r3	A2	partial	engine: mailbox-attachments-kernel.test.ts 'one forwarded message with one file: one row, two attachments on it, both in the mailbox’s organization' (real file-attachments verb, booted kernel); GET sys_attachment / sys_file is live, blocked on the IMAP fixture
integration-system.inbound-mailbox-association · r3	A3	blocked	api: knownGaps[0]: no in-repo app composes IMAP sync, a mailAssociation email field and an IMAP double, so no unmatched message lands on a served stack; no pin reads it as member (404) vs manage_mailboxes holder ('who may call' covers rematch/ingest only)
integration-system.notification-org-and-redeliver-eligibility · r5	A0	pass	test-oracle: all five named files green this run: notification-organization-follows-event.integration (4 cases), messaging-service.test.ts, webhook-redeliver-member, webhook-redeliver-entitlement, mcp-stdio-cwd (7 cases) — each ≥1 case, 0 failed
integration-system.notification-org-and-redeliver-eligibility · r5	A1	partial	engine: notification-organization-follows-event 'single, one organization: the event row and every row below it carry the sole organization (inline)' and '…delivery row…(outbox)' on ObjectQL over SqlDriver; served row read and log grep are the live leg
integration-system.notification-org-and-redeliver-eligibility · r5	A2	partial	plugin-unit: messaging-service.test.ts '[#22026] markRead writes a read receipt only for a notification delivered to that user' → '⛔ the non-recipient half: the same notification writes no row, counts 0…' and '⛔ the in-process door answers the same…'; the served POST /api/v1/notifications/read is the live leg
integration-system.notification-org-and-redeliver-eligibility · r5	A3	partial	HTTP-route-layer: webhook-redeliver-member '[#22804] … inactive: 409 DELIVERY_NOT_ELIGIBLE naming the webhook, its state and the remedy, on both faces' (member handler + Hono app on a LiteKernel) and entitlement '…control — … inactive subscription'; served POST is live

Generated by Claude Code

domain:devx#1 · os-warren · session_01JQwxbYXnfyuxgv3GQP9G1h

Per-clause verdicts (3/6): platform-core.

item · rev	clause	verdict	layer · text evidence
platform-core.metadata-registry-serving · r4	A0	partial	HTTP-in-process: meta-types-create-seed.dogfood (bootShowcase + apiAs): beforeAll GET /meta/types 200 with a non-empty entries[] and 'answers the same body as GET /meta — the two paths are one handler'; the steps[1] presence table of the registry kinds is checked by no case
platform-core.metadata-registry-serving · r4	A1	pass	test-oracle: meta-types-create-seed.dogfood green: 'carries the dashboard create seed (widgets: [])', 'carries the action create seed with a valid executable body', 'omits a seed for report…', 'every seeded type that is also a registered /meta/types entry exposes its exact seed'
platform-core.metadata-registry-serving · r4	A2	pass	HTTP-in-process: 'answers the same body as GET /meta — the two paths are one handler' (both 200, bodies toEqual) and 'is not the /meta/:type catch-all wearing a 200' (body.items undefined, entries[] array; bogus type 400 INVALID_REQUEST) on the booted showcase
platform-core.metadata-registry-serving · r4	A3	skipped	api: live leg, out of this pins-only card: GET /api/v1/meta/view/showcase_task and its authored list/listViews/formViews keys
platform-core.metadata-registry-serving · r4	A4	skipped	api: live leg, out of this pins-only card: GET /api/v1/meta/view enumerating the showcase's authored view families
platform-core.metadata-registry-serving · r4	A5	skipped	api: live leg, out of this pins-only card: GET /api/v1/meta/object/showcase_account carrying loyalty_tier, linkedin_url, csat_score from account.extension.ts
platform-core.metadata-registry-serving · r4	A6	skipped	api: live leg, out of this pins-only card: PATCH /api/v1/data/showcase_account/‹id› {loyalty_tier, csat_score} round-trip plus a form screenshot
platform-core.metadata-registry-serving · r4	N0	partial	HTTP-in-process: 'every seeded type that is also a registered /meta/types entry exposes its exact seed' guards the registry contract of seeded types; a registered type missing from GET /meta is not checked against the registry by any case
platform-core.metadata-registry-serving · r4	N1	skipped	api: live leg, out of this pins-only card: extension fields present in /meta/object/showcase_account and writable through /data
platform-core.metadata-registry-serving · r4	N2	skipped	api: live leg, out of this pins-only card: an unauthenticated GET /api/v1/meta probe (the pin signs in before every read)
platform-core.metadata-authoring-roundtrip · r8	A0	skipped	api: live leg, out of this pins-only card: PUT /api/v1/meta/view/showcase_task.os_qa_view_RUNID answering state=draft and GET /api/v1/meta/_drafts listing it
platform-core.metadata-authoring-roundtrip · r8	A1	skipped	api: live leg, out of this pins-only card: POST /packages/:id/publish-drafts, GET /meta/view/:name/published, console screenshot after reload
platform-core.metadata-authoring-roundtrip · r8	A2	skipped	network: live leg, out of this pins-only card: capture PUT /api/v1/meta/page/‹name› during Studio record-page create; studio-object-designer.spec (green 4/4 on preview) drives the object designer and package switcher, not this request
platform-core.metadata-authoring-roundtrip · r8	A3	partial	engine: package-first-authoring.dogfood 'saveMetaItem(runtime-only) into a loaded code package throws writable_package_required' with control 'the same create into a fresh writable base id is NOT rejected' — protocol.saveMetaItem in process, no /api/v1/meta PUT
platform-core.metadata-authoring-roundtrip · r8	A4	skipped	api: live leg, out of this pins-only card: an object-targeting overlay PUT answering 403 not_overridable beside an accepted view PUT
platform-core.metadata-authoring-roundtrip · r8	A5	skipped	api: live leg, out of this pins-only card: PUT /api/v1/meta/view/showcase_task.os_qa_bad_RUNID with columns: 42 refused 4xx naming the validation failure, then a GET finding nothing stored
platform-core.metadata-authoring-roundtrip · r8	N0	partial	engine: the read-only-package half is pinned at the protocol layer (WRITABLE_PACKAGE_REQUIRED, in process); no HTTP answer on either deny side and the locked-overlay-type half are pinned by nothing
platform-core.metadata-authoring-roundtrip · r8	N1	skipped	api: live leg, out of this pins-only card: a malformed PUT stored as-is (200 then garbage on GET) — no named pin drives the meta write door with a bad body
platform-core.metadata-authoring-roundtrip · r8	N2	skipped	screenshot: live leg, out of this pins-only card: the published view appearing in the console switcher after reload
platform-core.interrupted-migration-boot-report · r3	A0	partial	plugin-unit: migration-recovery-plugin.test.ts 'warns per interrupted run and names the command that acts' (run, plan, 'UNKNOWN outcome', 'os migrate resume', 'NOT resumed automatically') and the unresumable-plan describeInterruptedRun case, stub engine; the served boot log is live
platform-core.interrupted-migration-boot-report · r3	A1	partial	plugin-unit: 'does not resume — booting never writes to the journal' (stub engine insert not called); health/ready 200 after the warning and the sqlite row count of sys_migration_journal before vs after are the live leg
platform-core.interrupted-migration-boot-report · r3	A2	partial	plugin-unit: 'says nothing when every run concluded' over a stub engine; silence on served boots 1 and 3 beside the warning boot 2 on one composition and DB is the live leg
platform-core.interrupted-migration-boot-report · r3	A3	pass	test-oracle: migration-recovery-plugin.test.ts 'skips silently when sys_migration_journal is not registered' green (ctx._warns toEqual [])
platform-core.interrupted-migration-boot-report · r3	A4	pass	test-oracle: migration-recovery-plugin.test.ts 'reports a scan FAILURE rather than reading it as "nothing found"' green
platform-core.interrupted-migration-boot-report · r3	N0	partial	plugin-unit: 'does not resume — booting never writes to the journal' asserts no insert on a stub engine; a journal diff across a real served boot is the live leg
platform-core.interrupted-migration-boot-report · r3	N1	pass	test-oracle: the two degradation arms stay apart in the green pins: 'skips silently when sys_migration_journal is not registered' (zero warns) and 'reports a scan FAILURE rather than reading it as "nothing found"' (warn names scan failed / NOT detected)
platform-core.interrupted-migration-boot-report · r3	N2	skipped	log: live leg, out of this pins-only card: the absence-inference guard governs reading the clean-journal served boots after boot 2 proved the scan; no boot was driven
platform-core.activation-ledger-registration-home · r7	A0	pass	test-oracle: ledger-reach dogfood '#12359' describe green: 'the automation service really is absent…', 'the flip that answered 503 SERVICE_UNAVAILABLE now succeeds', 'writes ONE deployment-level row…no tenant column', 'dispatch consults it', 're-enabling re-arms dispatch…'
platform-core.activation-ledger-registration-home · r7	A1	pass	HTTP-in-process: '#12159 Part 1' describe on the booted showcase: 'the ACTION projection hydrates: a flip lands and dispatch refuses' (200 then 409), 'the FLOW projection hydrates from the same table…', 'both consumers share ONE table without touching each other's rows'
platform-core.activation-ledger-registration-home · r7	A2	pass	test-oracle: dogfood 'the ledger object has exactly ONE owner…' (com.objectstack.platform-objects.activation-ledger), activation-ledger-registration 'does not name sys_metadata_activation in any manifest it registers', plugin.test.ts 'registers SysMetadataActivation under its OWN manifest…'
platform-core.activation-ledger-registration-home · r7	A3	pass	test-oracle: platform-objects plugin.test.ts 'registers SysMetadataActivation under its OWN manifest, carrying the routing verbatim' (system / sys / cloud) and dogfood 'the table keeps the datasource binding…' (undefined on no-cloud; sys_automation_run read is parity only)
platform-core.activation-ledger-registration-home · r7	A4	pass	spec-schema: platform-object-names.test.ts 'registers exactly the objects each package declares' green, and platform-object-names.ts names 'sys_metadata_activation' once, at line 64 inside the 'platform-objects' array (opens line 46) — one-owner membership, no count used
platform-core.activation-ledger-registration-home · r7	N0	pass	HTTP-in-process: dogfood 'the flip that answered 503 SERVICE_UNAVAILABLE now succeeds' (no-automation) and 'the ACTION projection hydrates…' (with automation): the activation door answers 200, not 503, on both compositions carrying PlatformObjectsPlugin
platform-core.activation-ledger-registration-home · r7	N1	pass	test-oracle: dogfood anti-vacuity controls green: 'the automation service really is absent from this composition' and 'the automation service really is composed here'
platform-core.activation-ledger-registration-home · r7	N2	skipped	log: live leg, out of this pins-only card: a second registrant of sys_metadata_activation throwing 'already owned by package …' at boot — by the clause's own text no pin drives it, so it scores only from a live observation
platform-core.activation-ledger-registration-home · r7	N3	pass	engine: dogfood 'the table keeps the datasource binding it had before the registrar moved' (resolveEffectiveDatasource('sys_metadata_activation') undefined on the no-cloud composition) with plugin.test.ts's unchanged scope/namespace/defaultDatasource triple
platform-core.activation-ledger-row-contract · r9	A0	skipped	api: live leg, out of this pins-only card: GET /api/v1/data/sys_metadata_activation 200 and the three generic-data writes answering 405 with the allowed set [get, list, aggregate, search, export]; no named pin drives the generic data door on this object
platform-core.activation-ledger-row-contract · r9	A1	partial	plugin-unit: action-activation.test.ts 'UPDATES the existing install-level row rather than writing a second one' — the store keeps one row per (metadata_type, name); the declared unique:'global' index refusing a second row (UNIQUE constraint naming the two key columns) is the live leg
platform-core.activation-ledger-row-contract · r9	A2	partial	engine: ledger-reach dogfood 'writes ONE deployment-level row, and the TABLE has no tenant column at all': the driver SELECT's key set lacks organization_id (anti-vacuity keys present) — column-absence half; PRAGMA and the refused/control INSERTs are live
platform-core.activation-ledger-row-contract · r9	A3	partial	HTTP-in-process: update-not-delete pinned for action (dogfood 're-enabling re-arms dispatch…', store 're-enabling UPDATES the row instead of deleting it'), flow (flow-activation-ledger) and position (door 're-enabling UPDATES the one row'); sharing_rule and webhook reads are live
platform-core.activation-ledger-row-contract · r9	A4	partial	HTTP-in-process: door half: catalog-activation-door.dogfood 'a type with no switch is refused 400 by the door itself' and 'the audience anchor `everyone`/`guest` is refused 400 and nothing is written' on the booted showcase; distinct metadata_type over the full table after every stock switch is the live leg
platform-core.activation-ledger-row-contract · r9	A5	partial	plugin-unit: action-activation.test.ts 'an EMPTY ledger changes nothing anywhere (ADR-0126 §4, the stock boot)' and flow 'a stock boot with an EMPTY ledger arms and runs every flow' (absence reads as active); the pre/post-restart row diff and the no-lifecycle declaration are the live leg
platform-core.activation-ledger-row-contract · r9	N0	skipped	api: live leg, out of this pins-only card: generic-data-API create/update/delete on sys_metadata_activation answering 2xx would be the FAIL; no named pin drives it
platform-core.activation-ledger-row-contract · r9	N1	pass	engine: dogfood 'writes ONE deployment-level row, and the TABLE has no tenant column at all': Object.keys of the driver's own SELECT row over the physical table not.toContain('organization_id') on a booted stack, with the anti-vacuity key check
platform-core.activation-ledger-row-contract · r9	N2	partial	HTTP-in-process: the update-not-delete pins for action, flow and position (see A3) hold; a sharing_rule or webhook row deleted by re-enable is watched by no pin
platform-core.activation-ledger-row-contract · r9	N3	skipped	log: live leg, out of this pins-only card: a second (metadata_type, name) row accepted by the table — only the live duplicate INSERT reads the unique index
platform-core.activation-ledger-row-contract · r9	N4	skipped	n/a: checklist-reading guard (the variants are hand-enumerated, not a pinned enum); it asserts nothing of the platform at this item
platform-core.activation-ledger-row-contract · r9	N5	pass	HTTP-in-process: catalog-activation-door.dogfood 'a type with no switch is refused 400 by the door itself' and 'the audience anchor … is refused 400 and nothing is written' (booted showcase); handler 'refuses /_activation/capability/manage_metadata … 400' with no writes
platform-core.url-overlay-contract · r4	A0	skipped	screenshot: live leg, out of this pins-only card: open drawer / form overlays, screenshot, browser Back, screenshot; useUrlOverlay.test.tsx asserts param state only, no history push
platform-core.url-overlay-contract · r4	A1	skipped	screenshot: live leg, out of this pins-only card: N tab switches plus palette/shortcuts, then one Back leaving the page; no pin asserts replace semantics
platform-core.url-overlay-contract · r4	A2	skipped	screenshot: live leg, out of this pins-only card: fresh navigation to ‹record›?tab=‹value› landing on that tab
platform-core.url-overlay-contract · r4	A3	skipped	screenshot: live leg, out of this pins-only card: formObject/formLink pre-linked FK on first open and after a cold reload
platform-core.url-overlay-contract · r4	A4	skipped	screenshot: live leg, out of this pins-only card: ?from= drill trail back links, one level per link, surviving refresh
platform-core.url-overlay-contract · r4	A5	partial	component-jsdom: FormPage.recordObject.test.tsx 'a mismatching recordObject ⇒ error state…', 'issues no /data/ request at all…', 'and no write can follow…', 'refuses on case difference too…', agreeing control — over a stubbed fetch; the live /data trace is the browser leg
platform-core.url-overlay-contract · r4	N0	skipped	screenshot: live leg, out of this pins-only card: Back paging through tab switches or re-opening the palette
platform-core.url-overlay-contract · r4	N1	partial	component-jsdom: FormPage.recordObject.test.tsx 'issues no /data/ request at all — the refusal precedes the read' and 'and no write can follow, since there is no form to submit' in jsdom; the live network trace on the mismatch is the browser leg
platform-core.url-overlay-contract · r4	N2	skipped	n/a: live leg, out of this pins-only card: review of page-scoped params reusing reserved names (?recordId, ?form) against the registry; no pin
platform-core.url-overlay-contract · r4	N3	skipped	screenshot: live leg, out of this pins-only card: cold reload of a captured overlay URL keeping the overlay and the pre-link; useUrlOverlay 'is open when the param is present on first render (deep-link)' is hook state only
platform-core.lifecycle-retention-sweep · r8	A0	partial	plugin-unit: lifecycle-service.test.ts 'reaps telemetry by retention.maxAge with an ISO cutoff on created_at, multi + system context' over a fake engine recording deletes; the real hourly timer (first sweep at 60s), the aggregate sweep log line and before/after sqlite reads are the live leg
platform-core.lifecycle-retention-sweep · r8	A1	partial	plugin-unit: 'merges retention.onlyWhen into the reap filter (mixed tables, #2834)' and '#5194 … still honours retention.onlyWhen — the predicate moves to the candidate READ' over a fake engine; seeded paused/running rows surviving a real sweep is the live leg
platform-core.lifecycle-retention-sweep · r8	A2	partial	test-oracle: pinned half green: 'retains everything and reports archive-pending when the archive datasource is missing' and 'skips hot deletion entirely while an archive is declared'; the live half (the 100d-old sys_audit_log row surviving a real sweep) was not driven
platform-core.lifecycle-retention-sweep · r8	A3	pass	test-oracle: 'LifecycleService.sweep — unguarded reap batching (#5194)': 'bounds the FIRST sweep over a large backlog, and drains the rest on later sweeps', 'leaves the steady state alone…', 'never turns an id-less row into a predicate delete' — green; the live reaped-count line is corroboration only
platform-core.lifecycle-retention-sweep · r8	A4	partial	plugin-unit: 'no-ops when disabled via option or OS_LIFECYCLE_DISABLED' at the service; the bracketed armed-control boot vs disabled boot (survivor + empty grep) is the live leg
platform-core.lifecycle-retention-sweep · r8	A5	skipped	build: build read, out of this pins-only card: LifecycleClassSchema (5 members) at packages/spec/src/data/object.zod.ts beside SYSTEM_LEDGER_LIFECYCLE_CLASSES in engine.ts — no test pin by the item's own ref; the enumSource ratchet is check:platform-checklist, not run here
platform-core.lifecycle-retention-sweep · r8	N0	partial	plugin-unit: the onlyWhen predicate reaches the reap filter and the candidate read ('merges retention.onlyWhen…', '…still honours retention.onlyWhen') over a fake engine; real non-terminal rows surviving is acceptance[1]'s live read
platform-core.lifecycle-retention-sweep · r8	N1	partial	plugin-unit: 'skips hot deletion entirely while an archive is declared', 'retains everything and reports archive-pending when the archive datasource is missing', 'copies past-window rows to the cold store, then hot-deletes exactly the copied ids' — fake engine and cold store
platform-core.lifecycle-retention-sweep · r8	N2	skipped	log: live leg, out of this pins-only card: the 60s-delay and bracketed-composition reading guard applies to the served boots, none driven
platform-core.lifecycle-retention-sweep · r8	N3	skipped	log: live leg, out of this pins-only card: grep a real sweep for per-row log lines; the pins assert report entries, not log output
platform-core.lifecycle-retention-sweep · r8	N4	skipped	n/a: run-method guard (backdating is sqlite-only by design); asserts nothing of the platform at this item
platform-core.settings-audit-secret-fingerprint · r5	A0	partial	plugin-unit: settings-audit-secret-digest.test.ts 'records the provider keyed digest on both ledgers, not the unkeyed hash of the value' — SettingsService over stub audit sinks; the hmac-sha256 shape on sys_platform_setting_audit.new_hash and sys_audit_log new_value read back over the API is the live leg
platform-core.settings-audit-secret-fingerprint · r5	A1	partial	plugin-unit: same case asserts the recorded fingerprint is not the unkeyed hash of the value at the service; the offline search over the served rows with its non-secret positive control is the live leg
platform-core.settings-audit-secret-fingerprint · r5	A2	partial	plugin-unit: 'is stable for equal values and distinct for different ones' over stub sinks; the three served writes' fingerprints on each ledger are the live leg
platform-core.settings-audit-secret-fingerprint · r5	A3	partial	plugin-unit: 'records no fingerprint on a reset' over stub sinks; the served reset rows (new_hash null, config_change new_value null) are the live leg
platform-core.settings-audit-secret-fingerprint · r5	A4	partial	plugin-unit: 'record the declared SHA-256 of the canonical JSON on both ledgers, not the adapter digest (#26465)' over stub sinks; mail.from_email's served rows against an offline SHA-256 are the live leg
platform-core.settings-audit-secret-fingerprint · r5	A5	pass	test-oracle: 'legacy inline-adapter path with no provider records no fingerprint and reports it once' and 'a provider that refuses a keyed digest leaves the write intact and records no fingerprint' green (service-settings run)
platform-core.settings-audit-secret-fingerprint · r5	N0	partial	plugin-unit: 'records the provider keyed digest on both ledgers, not the unkeyed hash of the value' at the service; the served rows' offline digest search is the live leg
platform-core.settings-audit-secret-fingerprint · r5	N1	partial	plugin-unit: the secret-setting cases record a digest, never the value, into stub sinks; a field-by-field read of both served ledgers for the plaintext is the live leg
platform-core.settings-audit-secret-fingerprint · r5	N2	pass	test-oracle: 'legacy inline-adapter path with no provider records no fingerprint and reports it once' — no unkeyed fallback on a host with no keyed digest
platform-core.settings-audit-secret-fingerprint · r5	N3	pass	test-oracle: 'a provider that refuses a keyed digest leaves the write intact and records no fingerprint' — the save is not vetoed
platform-core.settings-audit-secret-fingerprint · r5	N4	skipped	api: live leg, out of this pins-only card: the scoring guard on acceptance[1]'s offline search (needs step 7's positive control on served rows)
platform-core.protocol-18-handshake-and-stored-replay · r3	A0	pass	test-oracle: all five named files green in this run (runtime, cli, spec, metadata-protocol, metadata packages all rc=0): packages-install-protocol-incompatible, migrate-meta-protocol-range, conversions/stored, protocol.stored-migration, plugin-artifact-forward-conversion-major-step — each ≥1 case, 0 failed
platform-core.protocol-18-handshake-and-stored-replay · r3	A1	partial	HTTP-route-layer: packages-install-protocol-incompatible 'pin 1: answers 422 OS_PROTOCOL_INCOMPATIBLE with all five diagnostic fields in error.details' (migrateCommand ends --from targetMajor), 'lit control: a compatible range installs…' — HttpDispatcher over a fake kernel
platform-core.protocol-18-handshake-and-stored-replay · r3	A2	partial	spec-schema: conversions/stored.test.ts 'replays a RETIRED conversion over a stored object row…' (applyConversionsToStoredItem, the serving replay) as a unit; the served GET of a planted row and the old-shape PUT's 422 tombstone prescription are the live leg
platform-core.protocol-18-handshake-and-stored-replay · r3	A3	partial	plugin-unit: plugin-artifact-forward-conversion-major-step.test.ts 'logs one summary naming the conversion and its site count…' (one warn, '1 site(s)', the conversion id) off a mocked logger; the served boot log grep is the live leg
platform-core.settings-organization-isolation-and-platform-rung · r6	A0	pass	test-oracle: all four named files green in this run (service-settings rc=0, 6 files 133 tests): settings-organization-isolation.pin, settings-read-door.pin, settings-admission-tenancy-posture, config-change-audit — each ≥1 case, 0 failed
platform-core.settings-organization-isolation-and-platform-rung · r6	A1	partial	engine: config-change-audit '#8145 — dual-write… (the global rung in sys_platform_setting_audit)' and isolation 'a global row is read by both organizations' in process; read-door 'a principal lacking a namespace's readPermission does not read its rows' for the member half
platform-core.settings-organization-isolation-and-platform-rung · r6	A2	partial	engine: isolation pin 'each organization reads its own value, and one organization's write leaves the other's unchanged' and 'a lock on one organization's tenant row does not lock another organization's write' under a walled posture in process; the walled served boot (knownGaps[0]) is the live leg
platform-core.settings-organization-isolation-and-platform-rung · r6	A3	partial	engine: isolation pin: the organization-less tenant write refuses SETTINGS_VALIDATION under a walled posture and 'is not refused under the 'single' posture…' in process; the served 400 on a walled boot (knownGaps[0]) is the live leg
platform-core.settings-organization-isolation-and-platform-rung · r6	N0	partial	HTTP-route-layer: isolation pin 'an organization administrator's PUT over its own locked row is 409 SETTINGS_LOCKED naming the key and the tenant lock' (value unchanged) — registerSettingsRoutes over a route double; the walled served PUT /api/settings/‹ns› is the live leg
platform-core.serve-composition-v18 · r4	A0	pass	test-oracle: all six named files green: cli serve-config-boot-residual, serve-datasource-mapping-before-sync, serve-no-storage-boot-guard, console.not-built; runtime datasource-mapping-before-schema-sync; serve-organization-record-page.e2e under the nightly tier (1 file, 2 tests)
platform-core.serve-composition-v18 · r4	A1	pass	CLI-process: serve-config-boot-residual '#22521 row 4…' → 'the artifact boot lists the object and the expanded view under the manifest id…' (acme_note.default@com.example.acme.release, one residual line) and 'the config boot gives the artifact boot's answer' — spawned os serve
platform-core.serve-composition-v18 · r4	A2	pass	CLI-process: serve-organization-record-page.e2e 'an app with its own sys_organization default boots, and its page is the single default': spawned os serve output not matching DEFAULT_RECORD_PAGE_CONFLICT, served defaults sys_organization = ['orgpage_organization_detail of com.example.orgpage']
platform-core.serve-composition-v18 · r4	A3	pass	CLI-process: serve-datasource-mapping-before-sync.integration 'boots over ONE store: the mapped datasource holds the platform tables and the Default Organization': spawned production os serve reaches its banner, output not.toContain the no-such-table text, sys_* tables on the mapped store
platform-core.serve-composition-v18 · r4	A4	pass	CLI-process: serve-no-storage-boot-guard.integration 'refuses before any plugin starts when the auth service needs a driver, naming the remedies': exit 1, refusal names OS_DATABASE_URL, new DriverPlugin(driver), --dev; controls boot silently
platform-core.serve-composition-v18 · r4	A5	partial	HTTP-route-layer: console.not-built.test.ts 'GET %s answers 503 naming `pnpm console:build`' — the console-not-built plugin on a real HonoHttpServer via app.request, not a served os serve boot; the served GET /_console/ is the live leg

Generated by Claude Code

domain:devx#1 · os-warren · session_01JQwxbYXnfyuxgv3GQP9G1h

Per-clause verdicts (4/6): records-forms.

item · rev	clause	verdict	layer · text evidence
records-forms.field-type-matrix · r8	A0	pass	HTTP-in-process: field-zoo-roundtrip.dogfood.test.ts green: every MATRIX vector's case '‹type› (‹field›) round-trips' (setEqual for arrays, equal for objects) over bootShowcase apiAs POST then GET; MATRIX carries no xfail rows at the subject
records-forms.field-type-matrix · r8	A1	skipped	dom: live leg, out of this pins-only card: the Specimen Full edit form's 47 types, autonumber on the detail page and summary carriers, each matched to its dedicated widget with a screenshot crop; no pin drives the console widgets
records-forms.field-type-matrix · r8	A2	pass	HTTP-in-process: field-type-matrix-server-refusals: 'acceptance[2], negative[0]: an out-of-set select is refused invalid_option, and the row count does not grow' and 'acceptance[2]: a create with no name is refused naming name with required...' (400 VALIDATION_FAILED, exact fields[])
records-forms.field-type-matrix · r8	A3	pass	HTTP-in-process: field-zoo-roundtrip: 'secret (f_secret) round-trips' and 'password (f_password) round-trips' are kind masked: the REST GET is not the written value and equals SECRET_MASK
records-forms.field-type-matrix · r8	A4	pass	HTTP-in-process: field-zoo-roundtrip: 'autonumber (f_autonumber) round-trips' (present, non-null; the create body never writes it, so server-assigned) and 'formula (f_formula) round-trips' (computed, 31.5)
records-forms.field-type-matrix · r8	A5	pass	HTTP-in-process: round-trip half: 'lookup (f_lookup)/master_detail (f_master_detail)/tree (f_tree) round-trips' equal the REFERENCE_TARGETS ids; refusal half: it.each 'acceptance[5], negative[1]: a dangling %s is refused reference_not_found, and nothing is stored'
records-forms.field-type-matrix · r8	A6	pass	HTTP-in-process: field-type-matrix-server-refusals: 'acceptance[6]: every seeded invoice total is the server-side sum of its lines' and 'acceptance[6]: EXP-2001 reads total 1500.5 and the filtered approved roll-up 960'
records-forms.field-type-matrix · r8	N0	pass	HTTP-in-process: 'acceptance[2], negative[0]: an out-of-set select is refused invalid_option...': not_an_option answers 400, row count unchanged; the in-set 'high' is the 201 control
records-forms.field-type-matrix · r8	N1	pass	HTTP-in-process: it.each 'acceptance[5], negative[1]: a dangling %s is refused reference_not_found, and nothing is stored' for f_lookup, f_master_detail, f_tree: 400 naming the field, zero rows by name
records-forms.field-type-matrix · r8	N2	pass	HTTP-in-process: field-zoo-roundtrip masked checks: the GET of the created row returns SECRET_MASK, not the plaintext, for f_secret and f_password
records-forms.list-view-capabilities · r8	A0	partial	browser-live: pins give evidence for 3 variants only, each partly (saved-view filter 200 half, viz whitelist, inline-edit PATCH); search, paging, sort, export, bulk actions, legacy rowActions carry no artifact
records-forms.list-view-capabilities · r8	A1	partial	browser-live: saved-view-filter.spec.ts 'a saved view filter reaches $filter as AST, and the server answers 200': no showcase_task data response at 400 or above, count bar starts '2 '; it never captures the AST filter param or compares the response total
records-forms.list-view-capabilities · r8	A2	skipped	api: live leg, out of this pins-only card: quick-search request carrying search and the 'huaning' to 华宁科技 CJK recall, console and direct GET
records-forms.list-view-capabilities · r8	A3	skipped	network: live leg, out of this pins-only card: top/skip page requests and the walked-page id union
records-forms.list-view-capabilities · r8	A4	skipped	network: live leg, out of this pins-only card: the tabular view request carrying sort=-estimate_hours and server row order
records-forms.list-view-capabilities · r8	A5	partial	browser-live: inline-edit-polish-2572.spec.ts 'record inline-edit polish (#2572) — showcase Project end-to-end': PATCH carries budget and not spent, on a Project record page, not this item's grid cell; no post-reload re-read of untouched fields
records-forms.list-view-capabilities · r8	A6	skipped	network: live leg, out of this pins-only card: Export footer formats with the provisioned export grant and the downloaded files holding the 2 in_progress rows
records-forms.list-view-capabilities · r8	A7	partial	browser-live: user-filters.spec.ts 'visualization switcher is a single dropdown offering the whitelist' reads exactly Grid, Kanban, Gallery, Calendar, Timeline, Gantt; after switching it reads only the trigger label, not the SAME records per renderer
records-forms.list-view-capabilities · r8	A8	skipped	network: live leg, out of this pins-only card: POST counts per selection for per-record vs aggregate showcase_recalc_selection (_selectedIds at body top level)
records-forms.list-view-capabilities · r8	A9	skipped	dom: live leg, out of this pins-only card: legacy_row_actions row menu: showcase_recalc_estimate dispatches, showcase_quick_view appears once
records-forms.list-view-capabilities · r8	N0	skipped	network: live leg, out of this pins-only card: staged refused filter overlay on showcase_task.done (400 INVALID_FILTER) and the grid showing zero rows, not all rows
records-forms.list-view-capabilities · r8	N1	skipped	dom: live leg, out of this pins-only card: tabs-element userFilters absent on an object list view; the user-filters tabs case runs on the Task Triage interface page, not an object list
records-forms.list-view-capabilities · r8	N2	skipped	network: live leg, out of this pins-only card: export of a filtered view returning only the filtered rows
records-forms.view-type-gallery · r3	A0	skipped	screenshot: live leg, out of this pins-only card: one screenshot per ListViewSchema type showing its real visualization; the smoke asserts render health, not the visualization's structure
records-forms.view-type-gallery · r3	A1	partial	HTTP-in-process: view-type-gallery-data-halves 'acceptance[1]: the kanban groups by status, every column holds seeded tasks, and the server aggregate agrees per column'; the on-canvas column headers and totals are not read
records-forms.view-type-gallery · r3	A2	partial	HTTP-in-process: 'acceptance[2]: the temporal views name their true date fields, and the seeded tasks carry them' (calendar due_date, timeline created_at, gantt start_date/end_date/progress); on-canvas placement of sampled tasks not read
records-forms.view-type-gallery · r3	A3	skipped	dom: live leg, out of this pins-only card: map markers per located task and the task chart's plotted SVG marks
records-forms.view-type-gallery · r3	A4	skipped	dom: live leg, out of this pins-only card: Organization Chart tree nesting vs parent fields
records-forms.view-type-gallery · r3	A5	pass	browser-live: showcase-smoke.spec.ts 50/50 twice: 'surface renders cleanly: All Views / Task Board / Task Calendar / Task Gallery / Team Schedule / Activity Timeline / Work Map' assert no pageerror and non-empty main past the boot splash
records-forms.view-type-gallery · r3	N0	skipped	screenshot: live leg, out of this pins-only card: per-variant check that no type silently fell back to a grid
records-forms.view-type-gallery · r3	N1	skipped	dom: live leg, out of this pins-only card: chart datapoint count noted beside the chart variant
records-forms.conditional-rules-header · r8	A0	pass	browser-live: required-when-submit.spec.ts 'requiredWhen blocks submit with a field error, and relaxes when FALSE' (Issued On is required, zero batch POSTs) + field-conditional-rules.spec.ts required marker; Playwright visibility waits stand in for the screenshot step
records-forms.conditional-rules-header · r8	A1	pass	HTTP-in-process: invoice-conditional-rules-server 'acceptance[1], negative[0]: a sent invoice with no issued_on is refused, naming issued_on, and nothing is stored' (400 VALIDATION_FAILED, exactly issued_on required; draft and dated twins 201)
records-forms.conditional-rules-header · r8	A2	partial	HTTP-in-process: server half: 'acceptance[2], negative[1]: a tax_rate PATCH on the paid invoice answers 200 and is discarded' (re-read unchanged; draft control persists); the client lock on a paid edit form is unpinned
records-forms.conditional-rules-header · r8	A3	pass	browser-live: field-conditional-rules.spec.ts 'header fields react to Status via CEL visibleWhen / readonlyWhen / requiredWhen': paid_on count 0 at draft/sent, 1 and required at paid, on the New Invoice dialog
records-forms.conditional-rules-header · r8	A4	skipped	dom: live leg, out of this pins-only card: paid vs draft invoice row menus: Edit visible-but-disabled, Delete hidden on paid
records-forms.conditional-rules-header · r8	A5	partial	HTTP-in-process: requiredWhen one-rule half holds (A0 client block plus A1 server refusal); the readonlyWhen cross-check needs the unpinned client lock on a paid edit form
records-forms.conditional-rules-header · r8	N0	pass	HTTP-in-process: 'acceptance[1], negative[0]: a sent invoice with no issued_on is refused...' answers 400, nothing stored
records-forms.conditional-rules-header · r8	N1	pass	HTTP-in-process: 'acceptance[2], negative[1]: a tax_rate PATCH on the paid invoice answers 200 and is discarded': tax_rate 99 does not persist, status stays paid
records-forms.conditional-rules-header · r8	N2	skipped	dom: live leg, out of this pins-only card: absence of a Delete affordance on a paid invoice row
records-forms.conditional-rules-grid · r11	A0	partial	browser-live: grid-conditional-rules.spec.ts 'a line cell flags required per row from a row-scoped requiredWhen': row 0 unflagged at Qty 2, flagged at 100, clears once filled; no unflagged sibling row, no blocked save or unchanged-rows read
records-forms.conditional-rules-grid · r11	A1	skipped	api: live leg, out of this pins-only card: direct batch with a quantity 100 line and empty description refused naming description, line count unchanged
records-forms.conditional-rules-grid · r11	A2	partial	browser-live: grid-parent-rules.spec.ts 'a line locks when the header status becomes "paid" and unlocks when it changes back': Qty and Unit Price only; the Product cell is not asserted
records-forms.conditional-rules-grid · r11	A3	skipped	api: live leg, out of this pins-only card: receipt upload, re-read of the line holding the sys_file id, file retrievable
records-forms.conditional-rules-grid · r11	A4	skipped	api: live leg, out of this pins-only card: before/after line diff on an invoice with distinct stored positions
records-forms.conditional-rules-grid · r11	N0	skipped	api: live leg, out of this pins-only card: no pin saves; a quantity 120 empty-description batch must be refused client and server
records-forms.conditional-rules-grid · r11	N1	partial	browser-live: grid-parent-rules case: Qty and Unit Price disabled at paid and enabled again at draft, live; Product not asserted
records-forms.cascading-options · r7	A0	partial	browser-live: cascading-options.spec.ts 'province options re-filter live as country changes, and the stale value clears': cn offers gd,zj, us offers ca,tx, Zhejiang dropped; the gate before any country is chosen is not read
records-forms.cascading-options · r7	A1	pass	HTTP-live: cascading-options.spec.ts 'the server rejects an out-of-set option value, and accepts an in-set one': Playwright request against the booted showcase, 400 VALIDATION_FAILED province invalid_option, in-set 201
records-forms.cascading-options · r7	A2	partial	HTTP-in-process: cascade-role-gated-option 'acceptance[2]: a member holding org_admin stores tier restricted, and it re-reads' and the plain-member 400 tier invalid_option case; the picker 'sees' half is unpinned
records-forms.cascading-options · r7	A3	skipped	network: live leg, out of this pins-only card: invoice contact picker account-scoped candidate requests, 26 Northwind vs 2 Contoso
records-forms.cascading-options · r7	A4	pass	HTTP-in-process: cascade-role-gated-option 'acceptance[4]: a legal cascade selection re-reads verbatim' (GET by id returns country cn, province zj)
records-forms.cascading-options · r7	N0	pass	HTTP-live: cascading-options.spec.ts server case: us/zj answers 400 invalid_option, not 200
records-forms.cascading-options · r7	N1	pass	HTTP-in-process: 'acceptance[2], negative[1]: a plain member's direct tier restricted POST is refused invalid_option, and nothing is stored' (standard is the 201 control)
records-forms.master-detail-atomic-save · r9	A0	partial	browser-live: master-detail.spec.ts 'Create stores the populated parent through one atomic batch' / 'Create with a task line stores the child referencing the parent' + form-view-subforms invoice batch (line invoice {$ref:0}); one child, batch count not asserted
records-forms.master-detail-atomic-save · r9	A1	pass	HTTP-in-process: master-detail-batch-atomic 'acceptance[1], acceptance[5], acceptance[2]: one batch lands the invoice and two lines...': REST re-read of invoice + WIDGET-A/SERVICE-HR lines with catalog description and unit_price
records-forms.master-detail-atomic-save · r9	A2	pass	HTTP-in-process: same case: expectTotalIsSum after the atomic create, after a line POST and after a line DELETE (total == sum of line amounts)
records-forms.master-detail-atomic-save · r9	A3	partial	HTTP-in-process: 'acceptance[3], negative[0]: a failing child aborts the whole batch — no invoice and no sibling line survive' (400 product required, zero rows); the form's named error is unpinned
records-forms.master-detail-atomic-save · r9	A4	pass	browser-live: form-view-subforms.spec.ts 'New ‹object› modal renders relationship-derived subforms and submits an atomic batch': stock New Invoice dialog shows the Line Items heading and line grid
records-forms.master-detail-atomic-save · r9	A5	pass	browser-live + HTTP-in-process: client: form-view-subforms reads the read-only data-computed amount 59.98 after Qty 2, before save; persisted: master-detail-batch-atomic stored amount = quantity x unit_price, client-sent amount 1 does not stand
records-forms.master-detail-atomic-save · r9	N0	pass	HTTP-in-process: 'acceptance[3], negative[0]: a failing child aborts the whole batch...': REST filtered reads find no invoice and no sibling line
records-forms.master-detail-atomic-save · r9	N1	partial	browser-live: form-view-subforms and master-detail read one batch carrying parent and child ops; neither counts the writes the save sends, so one-write-per-row is not excluded
records-forms.related-list-server-pagination · r11	A0	skipped	network: live leg, out of this pins-only card: the console's child-list requests carrying top/skip and the parent filter, none unbounded
records-forms.related-list-server-pagination · r11	A1	partial	HTTP-in-process: related-list-server-paging-and-gate 'acceptance[1], negative[1]: the filtered total is 26 and $top/$skip pages partition it'; the console pager ('Page 2 of 2' at 25 rows) is unread
records-forms.related-list-server-pagination · r11	A2	skipped	dom: live leg, out of this pins-only card: relationship-derived Projects/Invoices tables and Contacts card on the stock Account detail
records-forms.related-list-server-pagination · r11	A3	skipped	dom: live leg, out of this pins-only card: Invoices related table's authored title and columns
records-forms.related-list-server-pagination · r11	A4	partial	HTTP-in-process: 'acceptance[4]: each served child re-reads by its own API id with the same row'; clicking a child row in the related list is unpinned
records-forms.related-list-server-pagination · r11	A5	partial	HTTP-in-process: 'acceptance[5], negative[2]: the contributor is refused the parent-scoped child query 403; the manager reads it 200 with rows'; the Contacts card absent/present in the UI is unpinned
records-forms.related-list-server-pagination · r11	N0	skipped	network: live leg, out of this pins-only card: any console child-list request lacking a top bound
records-forms.related-list-server-pagination · r11	N1	partial	HTTP-in-process: the direct filtered count (total 26) is pinned; the pager total it must agree with is not read
records-forms.related-list-server-pagination · r11	N2	partial	HTTP-in-process: server half pinned: contributor's child query is 403 with no rows; the Contacts section not rendering for the contributor is unpinned
records-forms.action-param-widgets · r6	A0	skipped	dom: live leg, out of this pins-only card: each gallery param's rendered widget in the action dialog
records-forms.action-param-widgets · r6	A1	skipped	dom: live leg, out of this pins-only card: accept/multiple attributes on p_cover and p_attachments inputs
records-forms.action-param-widgets · r6	A2	pass	HTTP-in-process: action-param-gallery-dispatch 'acceptance[2]: the conformant bag passes and the body echoes the keys it received' and 'acceptance[2], negative[1]: a malformed bag is refused 400 and the body never ran'; action-params-contract 'default: a malformed param bag is rejected 400 before the handler runs'
records-forms.action-param-widgets · r6	A3	partial	HTTP-in-process: server half: 'acceptance[3]: a bag missing only the required p_text is refused server-side, naming it, and the body never ran'; the dialog's confirm block is unpinned
records-forms.action-param-widgets · r6	N0	skipped	n/a: SCOPE pointer: maxSize enforcement is scored at records-forms.upload-guard-blocks-confirm; asserts nothing at this item
records-forms.action-param-widgets · r6	N1	pass	HTTP-in-process: 'acceptance[2], negative[1]: a malformed bag is refused 400 and the body never ran': 400 names p_priority and bogus and carries no received echo
records-forms.import-wizard-encoding-and-hints · r9	A0	pass	component-jsdom: importParsers.test.ts green: 'decodes a GBK/GB18030 .csv (zh-CN Excel default) via fallback' yields exactly 名称 , 编号 , 测试岛2, TEST-001
records-forms.import-wizard-encoding-and-hints · r9	A1	pass	component-jsdom: importMissingRequiredHint.test.tsx green: 'names each unmapped required field as `label (name)` and disables Next' and 'clears the hint and enables Next once the required column is supplied'
records-forms.import-wizard-encoding-and-hints · r9	A2	pass	component-jsdom: importLegacyReferenceGuard.test.tsx green (pin-only by design, knownGaps[1]): 'flags the result degraded and shows a downgrade notice on the scalar path' (import-degraded-notice, 'compatibility fallback')
records-forms.import-wizard-encoding-and-hints · r9	A3	partial	HTTP-in-process: import-lands-readable-rows 'acceptance[3], negative[1]: the created count equals the filtered read...': direct POST /data/showcase_contact/import, 3 CJK rows re-read intact; a wizard-completed import is not driven
records-forms.import-wizard-encoding-and-hints · r9	N0	skipped	dom: live leg, out of this pins-only card: the wired wizard's preview of a GBK file showing no mojibake
records-forms.import-wizard-encoding-and-hints · r9	N1	partial	HTTP-in-process: route answer created 3 equals the filtered GET's 3 rows; the wizard's own success report is not driven
records-forms.gantt-interactions · r8	A0	partial	component-jsdom: GanttView.dnd.test.tsx 'move: dragging the bar body shifts both start AND end by the snapped day delta' stops at onTaskUpdate; no PATCH or API re-read
records-forms.gantt-interactions · r8	A1	partial	component-jsdom: GanttView.autoscheduledlg 'computes first and asks — nothing is written before confirm', 'cancel discards without writing', 'confirm applies the shift' + countinterp 'body and skipped both interpolate...'; no row-set diff (needs a dependenciesField)
records-forms.gantt-interactions · r8	A2	partial	component-jsdom: scheduling.selfextent 'a locked violated task is reported in skippedLocked and left in place' + GanttView.dnd 'summary drag skips locked descendants...'; no before/after row read, direct locked-leaf drag unpinned
records-forms.gantt-interactions · r8	A3	skipped	api: live leg, out of this pins-only card: a vetoed bar update landing no write and the re-read unchanged
records-forms.gantt-interactions · r8	N0	skipped	api: live leg, out of this pins-only card: captured PATCH for a bar drag and the bar's position after a refused PATCH
records-forms.form-dirty-guard · r7	A0	partial	component-jsdom: discardGuard.test.tsx 'accidental close (the X) intercepts with a confirm dialog when dirty', 'Cancel closes immediately even when dirty...', 'Cancel closes immediately when the form is pristine'; Escape and backdrop not driven, no screenshot, no re-read
records-forms.form-dirty-guard · r7	A1	skipped	api: live leg, out of this pins-only card: server re-read after the discard exit and after the save exit
records-forms.form-dirty-guard · r7	A2	pass	component-jsdom: discardGuard.test.tsx ran green in the ui package run (48 files / 534 tests, 0 failed); per-file count not broken out in ui.log
records-forms.form-dirty-guard · r7	N0	partial	component-jsdom: X close on a dirty form prompts (ModalForm and DrawerForm cases), pristine Cancel does not; Escape/backdrop legs and a pristine X close are not driven
records-forms.adhoc-filter-sort-builder · r8	A0	skipped	network: live leg, out of this pins-only card: data request's filter param merging the in_progress view rule with two toolbar conditions
records-forms.adhoc-filter-sort-builder · r8	A1	skipped	network: live leg, out of this pins-only card: SortBuilder sort reaching the request as sort and server row order
records-forms.adhoc-filter-sort-builder · r8	A2	skipped	dom: live leg, out of this pins-only card: toolbar filter, search and sort restored after an in-app navigation away and back
records-forms.adhoc-filter-sort-builder · r8	A3	skipped	dom: live leg, out of this pins-only card: per-user preference row and list-state cache key; a second account sees none of A's filters
records-forms.adhoc-filter-sort-builder · r8	A4	partial	browser-live: user-filters.spec.ts 'dropdown selection filters, keeps counts, persists, and restores' (uf_priority) and 'filter tabs render exclusively, persist to URL, and restore on reload' (uf__tab): URL and count bar only, no data request or row identity
records-forms.adhoc-filter-sort-builder · r8	N0	skipped	network: live leg, out of this pins-only card: rows outside the view's stored filter after a toolbar filter
records-forms.adhoc-filter-sort-builder · r8	N1	skipped	dom: live leg, out of this pins-only card: tabs-element userFilters leaking onto a bare object list view
records-forms.adhoc-filter-sort-builder · r8	N2	skipped	dom: live leg, out of this pins-only card: account B on the same browser seeing account A's cached filter
records-forms.adhoc-filter-sort-builder · r8	N3	skipped	network: live leg, out of this pins-only card: an incomplete FilterBuilder row dropped rather than emitted as an empty-value condition
records-forms.concurrent-edit-conflict · r5	A0	skipped	api: live leg, out of this pins-only card: B's stale PATCH answering 409 CONCURRENT_UPDATE and A's value intact on re-read
records-forms.concurrent-edit-conflict · r5	A1	partial	component-jsdom: occSave.test.tsx '409 → conflict dialog; "keep editing" writes nothing more...' and ModalForm '409 → "keep editing" leaves the modal open; overwrite closes it' over a mocked source; the inline ConcurrentUpdateDialog half and the rendered screenshot are missing
records-forms.concurrent-edit-conflict · r5	A2	skipped	api: live leg, out of this pins-only card: inline-edit Reload discarding B's edit and showing A's value from a fresh GET
records-forms.concurrent-edit-conflict · r5	A3	partial	component-jsdom: occSave.test.tsx '409 → "overwrite" retries re-keyed to the server currentVersion and completes the save' (mocked); the 200 answer and the one-winner re-read are missing
records-forms.concurrent-edit-conflict · r5	A4	skipped	network: live leg, out of this pins-only card: the single two-key PATCH with If-Match from an inline two-surface edit
records-forms.concurrent-edit-conflict · r5	A5	skipped	api: live leg, out of this pins-only card: a stale inline PATCH answering 409 and the conflict dialog
records-forms.concurrent-edit-conflict · r5	N0	partial	component-jsdom: client half: a mocked 409 raises the conflict dialog rather than overwriting; the server's 409 on the losing save is not pinned
records-forms.concurrent-edit-conflict · r5	N1	skipped	network: live leg, out of this pins-only card: PATCH count and key set of an inline two-surface save
records-forms.concurrent-edit-conflict · r5	N2	partial	component-jsdom: form half: occSave.test.tsx 'sends ifMatch = the updated_at the form read' (mocked); the inline save's If-Match is unpinned
records-forms.record-discussion-mentions · r13	A0	partial	HTTP-in-process: comments-permission-matrix '(d) a member who can only READ the record may still comment on it': REST POST of sys_comment then GET lists its body, on its own cmt_readonly fixture; no console post, no thread_id-filtered, created_at-ordered read
records-forms.record-discussion-mentions · r13	A1	skipped	dom: live leg, out of this pins-only card: one feed row per posted comment across the optimistic post and refetch (mergeFeedRows)
records-forms.record-discussion-mentions · r13	A2	skipped	dom: live leg, out of this pins-only card: sys_activity rows interleaved in time order on the timeline stream and the record:discussion panel
records-forms.record-discussion-mentions · r13	A3	skipped	dom: live leg, out of this pins-only card: mentioned user's bell, deep link, unreadCount and mark-as-read
records-forms.record-discussion-mentions · r13	A4	partial	engine: mention-recipient-gate.integration 'notifies a fellow member who can read the record...' (audience exactly the mentioned reader) and 'never notifies the author, by id or by email' over an emit() recorder; the bells and GET /api/v1/notifications are unread
records-forms.record-discussion-mentions · r13	A5	partial	HTTP-in-process: comments-permission-matrix '(f) enable.feeds:false still answers FEEDS_DISABLED — the capability gate is orthogonal': 403 + code on its cmt_nofeeds fixture; the zero-row read-back and a same-fixture 2xx control are missing, qafeeds_nofeeds not driven
records-forms.record-discussion-mentions · r13	A6	partial	engine: capability-gate-update-verb '[#10170] enable.feeds is asked on the UPDATE verb too': 'by-id: re-threading into a feeds-disabled object → 403 FEEDS_DISABLED' (thread_id unchanged) + enabled controls; real ObjectQL on a stub driver, no REST PATCH
records-forms.record-discussion-mentions · r13	A7	skipped	dom: live leg, out of this pins-only card: each FeedFilterMode's rendered subset on the record:discussion panel and the return to all
records-forms.record-discussion-mentions · r13	A8	partial	component-unit: verdict rests on the clause's named fallback oracle recordActivityFeed.test.ts: 'RENDERS an author-extended type through the fallback presentation' (UNMAPPED_ACTIVITY_FEED_TYPE, row kept, one named warn); milestone channel not driven — downgraded by the runner: the unit fallback oracle applies once the live milestone channel is shown unavailable, which this pins-only card did not drive
records-forms.record-discussion-mentions · r13	A9	partial	engine: mention-recipient-gate.integration isolated/group/single cases and 'withholds the notification from a mentioned user who may read the record but not the comment, by id or by email'; plugin-security played by middleware, no HTTP inbox reads (knownGaps[2])
records-forms.record-discussion-mentions · r13	N0	skipped	dom: live leg, out of this pins-only card: a duplicate or phantom optimistic comment row after refetch
records-forms.record-discussion-mentions · r13	N1	partial	engine: mention-recipient-gate: audiences equal only the mentioned readers ('notifies a fellow member...' yields exactly CAROL); no per-user inbox read
records-forms.record-discussion-mentions · r13	N2	partial	HTTP-in-process: server half: '(f) enable.feeds:false still answers FEEDS_DISABLED...' is 403 over REST; the hidden panel and the skipped sys_comment fetch are console legs not driven
records-forms.record-discussion-mentions · r13	N3	partial	engine: capability-gate-update-verb: by-id and predicate re-threads onto a feeds-disabled parent are refused and the re-read thread_id still names the original parent; REST PATCH not reached
records-forms.record-discussion-mentions · r13	N4	partial	engine + HTTP-in-process: engine pin pairs every feeds refusal with a feeds-ENABLED success; the REST (f) case attributes the 403 by code FEEDS_DISABLED on a record the caller can read and edit, but carries no same-fixture 2xx comment control
records-forms.record-discussion-mentions · r13	N5	partial	component-unit: unknown-type half: 'RENDERS an author-extended type through the fallback presentation' keeps the row in the feed model; the per-mode rendered subsets (RecordActivityTimeline filterItems) are not pinned
records-forms.record-discussion-mentions · r13	N6	partial	engine: mention-recipient-gate: withheld from users who cannot read the record or the comment (id and email), notified when they can read both; engine with plugin-security stand-ins, no HTTP inbox
records-forms.bulk-select-all-matching · r6	A0	partial	component-jsdom: BulkActionBar.test.tsx 'offers "Select all N matching" when full page is selected and more exist' + 'does not show cross-page banner when total ≤ page' assert banner reads totalMatching prop in jsdom; no live find-response total vs banner (network).
records-forms.bulk-select-all-matching · r6	A1	partial	component-jsdom: bulkFanoutHostParams.test.tsx 'issues the host's $filter/$orderby/$search/$select…' + 'fans out from the ref, byte for byte…' drive the paged fan-out over a mocked data source; no live dispatched set vs filtered GET count (api).
records-forms.bulk-select-all-matching · r6	A2	partial	component-jsdom: objectBulkActionDispatch.test.tsx 'issues exactly ONE request carrying every selected id under _selectedIds' + 'a per-record def with the same shape still fans out' (fetch mocked, jsdom); no live POST trace on the showcase_task Bulk Actions view.
records-forms.bulk-select-all-matching · r6	A3	partial	component-jsdom: bulkActionRefresh.test.tsx 'bulk bar Clear resets both selection sources (#4140)': 'unticks the row checkboxes…partial selection', '…whole page was selected', 'drops the cross-page all matching state'; jsdom, no rendered-page screenshot.
records-forms.bulk-select-all-matching · r6	A4	partial	component-jsdom: bulkFanoutHostParams.test.tsx 'still honours HARD_CAP over a match set larger than the cap' (6000 total, 10 pages, 5000 delivered); mocked data source, no live collected-set vs server total.
records-forms.bulk-select-all-matching · r6	A5	partial	component-jsdom: bulkFanoutHostParams 'still honours HARD_CAP…' asserts the post-select banner text equals grid.bulkAllMatchingSelectedCapped (cap 5000, total 6000) in jsdom; offer line + selected count before Select all and the rendered dom leg not asserted by a run pin.
records-forms.bulk-select-all-matching · r6	N0	partial	component-jsdom: bulkFanoutHostParams 'fans out from the ref, byte for byte…' shows the handler gets every matching id, not the page rows; component layer over a mocked source, no live filtered count.
records-forms.bulk-select-all-matching · r6	N1	partial	component-jsdom: BulkActionBar 'Select all 137 matching' + HARD_CAP case (banner names total 6000 = find total) assert banner = find result.total in jsdom; no live filtered API count comparison.
records-forms.bulk-select-all-matching · r6	N2	partial	component-jsdom: bulkActionRefresh '…Clear resets both selection sources (#4140)' cases assert toolbar gone AND row/header checkboxes unchecked in jsdom; dom oracle wants the rendered page.
records-forms.import-job-undo-cancel · r8	A0	partial	browser-live: import-console-undo.spec.ts 'a small background import made through the console is undoable' passed 2/2 (IMPORT_CONSOLE_LIVE=1, app-crm crm_lead): fresh {undoable, !revertedAt} job found; per-row GET /import/jobs/:jobId/results never read.
records-forms.import-job-undo-cancel · r8	A1	partial	browser-live: same case: unfiltered page-bounded GET /data/crm_lead records.length goes baseline → +3 → baseline after Undo; not the clause's marker-filter count.
records-forms.import-job-undo-cancel · r8	A2	skipped	: live leg, out of this pins-only card: cancel mid-job then read committed rows + job state via /import/jobs/:jobId/cancel; no pin drives cancel.
records-forms.import-job-undo-cancel · r8	A3	partial	browser-live: same case reads GET /api/v1/data/import/jobs once before undo (jobId, undoable, createdAt, filter !revertedAt); revertedAt after the revert is confirmed only via console testid import-history-reverted-ID, not the jobs list.
records-forms.import-job-undo-cancel · r8	N0	partial	browser-live: same case: count returns exactly to baseline after Undo (+3 then -3) on an unfiltered, page-bounded list read; no marker filter.
records-forms.import-job-undo-cancel · r8	N1	skipped	: live leg, out of this pins-only card: cancel coherence (no torn row / dangling FK) after POST …/cancel; no pin drives cancel.
records-forms.import-job-undo-cancel · r8	N2	pass	test-oracle: the console spec ran with the gate set and reported ✓ passed (impcrm1/impcrm2), not skipped; import-harness/import-undo.spec.ts SKIPPED (its vite.live.config.ts is absent) and is counted as no evidence.
records-forms.object-hook-lifecycle · r11	A0	pass	HTTP-in-process: object-hook-lifecycle-showcase 'acceptance[0]: an inquiry POSTed through /data with no source reads back source web and status new' (booted showcase, REST).
records-forms.object-hook-lifecycle · r11	A1	pass	HTTP-in-process: 'acceptance[1]: one multi-event hook trims the title on the create and again on the update' — POST padded then PATCH padded, both re-read trimmed.
records-forms.object-hook-lifecycle · r11	A2	pass	HTTP-in-process + server log: 'acceptance[2], acceptance[3], negative[2], negative[3]: the completing update logs the audit…' — settle finds exactly one 'task completed: TITLE' on stdout/stderr.
records-forms.object-hook-lifecycle · r11	A3	pass	HTTP-in-process + server log: same case: a priority-only PATCH of the done task leaves log.matching('task completed: ') at 1 after 1.5s.
records-forms.object-hook-lifecycle · r11	A4	pass	HTTP-in-process + server log: 'acceptance[4], acceptance[5]: a spent-only PATCH above budget logs the warn…' — 'project over budget: NAME (1100 / 1000)' logged once.
records-forms.object-hook-lifecycle · r11	A5	pass	HTTP-in-process + server log: same case: spent-only PATCH 1100 over stored budget 1000 warns (budget merged from storage); under-budget PATCH 900 logs no warn.
records-forms.object-hook-lifecycle · r11	A6	pass	HTTP-in-process: object-hook-lifecycle-scratch 'acceptance[6], negative[0]: a throwing beforeInsert under abort refuses the POST and lands no row' — 400 HOOK_ABORTED with the sentence, count 0 before/after.
records-forms.object-hook-lifecycle · r11	A7	pass	HTTP-in-process + server log: 'acceptance[7], negative[1]: a throwing async afterUpdate under log keeps the PATCH…' — 200, re-read note kept, '[hook] handler failed (onError=log; suppressing)' names ohl_async_thrower, no fire-and-forget line.
records-forms.object-hook-lifecycle · r11	A8	pass	HTTP-in-process: 'acceptance[8], negative[4]: an unevaluable condition fails closed…' — 400 VALIDATION_ERROR naming the hook + 'operation aborted', no condition source, no row, no '[REST] Unhandled error'; numeric name 201 control.
records-forms.object-hook-lifecycle · r11	A9	pass	HTTP-in-process + server log: 'acceptance[9]: two hooks on one object+event run lowest priority first' — log order [10, 90].
records-forms.object-hook-lifecycle · r11	N0	pass	HTTP-in-process: scratch 'acceptance[6], negative[0]…' (beforeInsert abort, no row) + hook-error-format.dogfood.test.ts (beforeDelete abort leaves the row) both green.
records-forms.object-hook-lifecycle · r11	N1	pass	HTTP-in-process: scratch 'acceptance[7], negative[1]…' — the PATCH persists (note 'kept') despite the throwing async onError:log hook.
records-forms.object-hook-lifecycle · r11	N2	pass	HTTP-in-process + server log: showcase 'acceptance[2]…negative[2]…' — the done false→true transition emits the audit line once settled.
records-forms.object-hook-lifecycle · r11	N3	pass	HTTP-in-process + server log: showcase 'acceptance[2]…negative[3]…' — no second 'task completed' line on the non-transition edit.
records-forms.object-hook-lifecycle · r11	N4	pass	HTTP-in-process: scratch 'acceptance[8], negative[4]…' — the unevaluable condition aborts (400) under onError:log, never a silent skip.
records-forms.field-type-constraints · r6	A0	skipped	: live leg, out of this pins-only card: POST a 201-char name to /data/showcase_field_zoo (max_length envelope + count) and a 200-char control; no named pin asserts the refusal.
records-forms.field-type-constraints · r6	A1	partial	HTTP-in-process: field-zoo-roundtrip 'field-type capability matrix round-trips over HTTP' writes f_number 42 and re-reads it verbatim (in-range half only); min_value / max_value / invalid_number refusals unpinned.
records-forms.field-type-constraints · r6	A2	skipped	: live leg, out of this pins-only card: scratch number field 1234.567 → 400 max_scale, currency-with-scale save refusal, f_currency 1234.567 unrounded re-read; the roundtrip's f_currency 1234.56 probes no scale.
records-forms.field-type-constraints · r6	A3	skipped	: live leg, out of this pins-only card: direct POSTs f_select='not-a-value' and showcase_invoice.status='archived' expecting invalid_option + options[]; no named pin.
records-forms.field-type-constraints · r6	A4	partial	HTTP-in-process: field-zoo-roundtrip matrix f_multiselect setEqual ['red','blue'] re-read over HTTP (valid-array half); scalar coercion, invalid_type and invalid_option element refusals unpinned.
records-forms.field-type-constraints · r6	A5	partial	HTTP-in-process + engine: roundtrip re-reads f_lookup verbatim over HTTP; engine-lookup-referential-integrity '[#4441] a lookup id that resolves to nothing is refused' is engine-only; dangling id at /data and the dependsOn 201 carrier not at HTTP.
records-forms.field-type-constraints · r6	A6	partial	engine: engine-autonumber-runtime-owned 'strips a caller-supplied record number and issues the sequence value instead' + UPDATE 'strips a caller-supplied record number — the stored number is unchanged' (ObjectQL in-process); roundtrip only checks f_autonumber present.
records-forms.field-type-constraints · r6	A7	partial	HTTP-in-process: roundtrip matrix f_formula computed 31.5 re-read over HTTP; a direct write to f_formula and showcase_invoice.total = Σ line.amount not read.
records-forms.field-type-constraints · r6	N0	skipped	: live leg, out of this pins-only card: 201-char name POST must refuse, never truncate-and-store; no named pin.
records-forms.field-type-constraints · r6	N1	skipped	: live leg, out of this pins-only card: out-of-set select/status POST must not answer 200; no named pin.
records-forms.field-type-constraints · r6	N2	partial	engine: engine-autonumber-runtime-owned INSERT/UPDATE strip cases prove a forged f_autonumber is not persisted at the engine; no /data door read-back.
records-forms.field-type-constraints · r6	N3	skipped	: live leg, out of this pins-only card: scale-rounding probe on a scratch number field; no named pin.
records-forms.field-type-constraints · r6	N4	partial	engine: engine-lookup-referential-integrity 'an ordinary application object is covered too' + 'an UPDATE that repoints a lookup at nothing is refused' (engine); no /data 400 reference_not_found.
records-forms.cascading-multilevel-and-clear · r9	A0	partial	browser-live: cascading-options.spec.ts 'province options re-filter live as country changes, and the stale value clears' — cn offers gd,zj; us offers ca,tx; Zhejiang leaves the trigger. It never submits, so 'not carried into the submit' is undriven.
records-forms.cascading-multilevel-and-clear · r9	A1	partial	browser-live (live HTTP): cascading-options 'the server rejects an out-of-set option value, and accepts an in-set one' — {us,zj} 400 VALIDATION_FAILED invalid_option on province, {cn,zj} 201; verify's cn/ca vector and option_unavailable key not asserted.
records-forms.cascading-multilevel-and-clear · r9	A2	pass	HTTP-in-process: cascade-server-boundary 'acceptance[2], negative[2]: a parent-only PATCH is accepted and the stale child is kept (recorded gap)' — create {cn,zj}, PATCH {country:us} 200, re-read province zj.
records-forms.cascading-multilevel-and-clear · r9	A3	skipped	: live leg, out of this pins-only card: invoice contact picker request traces scoped by account, re-issued on account switch, and the cleared field; no pin.
records-forms.cascading-multilevel-and-clear · r9	A4	pass	HTTP-in-process: cascade-server-boundary 'acceptance[4], negative[2]: a cross-account contact that exists is stored…; a fabricated one is reference_not_found' — 201 stored as sent; 400 reference_not_found, nothing stored.
records-forms.cascading-multilevel-and-clear · r9	A5	pass	HTTP-in-process: cascade-server-boundary 'acceptance[5]: a legal selection on each cascade re-reads verbatim' — cn/zj and Northwind + Northwind contact.
records-forms.cascading-multilevel-and-clear · r9	N0	pass	HTTP-in-process: cascade-server-boundary control in the acceptance[2] case: PATCH {us, zj} with the child in payload → 400 [['province','invalid_option']].
records-forms.cascading-multilevel-and-clear · r9	N1	pass	browser-live + HTTP-in-process: cascading-options 'the server rejects an out-of-set option value…' ({us,zj} 400) + the dogfood in-payload control; never 200.
records-forms.cascading-multilevel-and-clear · r9	N2	pass	HTTP-in-process: cascade-server-boundary pins both recorded gaps as they stand (parent-only PATCH keeps zj; cross-account contact 201), so neither can be ticked as server-enforced.
records-forms.encrypted-field-behavior · r7	A0	pass	HTTP-in-process + driver row: encrypted-field-behavior 'acceptance[2], negative[2]: an echoed mask leaves the stored secret unchanged' — POST body lacks plaintext, driver-held f_secret matches /^secret:/, resolveSecretField returns the original; roundtrip masked GET.
records-forms.encrypted-field-behavior · r7	A1	pass	HTTP-in-process: field-zoo-roundtrip matrix kind 'masked' for f_secret and f_password — both re-read as SECRET_MASK for the signed-in admin.
records-forms.encrypted-field-behavior · r7	A2	pass	HTTP-in-process: 'acceptance[2], negative[2]: an echoed mask leaves the stored secret unchanged' — PATCH with SECRET_MASK 200, stored ref byte-identical, resolveSecretField still the original.
records-forms.encrypted-field-behavior · r7	A3	pass	HTTP-in-process: 'acceptance[3], negative[1]: a non-empty secret write is refused and nothing is persisted' (provider unset on a scratch stack: 500 INTERNAL_ERROR, no row, no cleartext) + 'acceptance[3]: a password write needs no provider' 201 masked. Message text stays server-side.
records-forms.encrypted-field-behavior · r7	A4	pass	HTTP-in-process: 'acceptance[4], negative[3]: a group-by or MIN/MAX over a credential column is refused, not answered' — 400 INVALID_FIELD for 4 queries; group-by name 200 control.
records-forms.encrypted-field-behavior · r7	N0	pass	HTTP-in-process: roundtrip masked vectors + encrypted-field-behavior asserts no response text contains the written secret/password.
records-forms.encrypted-field-behavior · r7	N1	pass	HTTP-in-process: 'acceptance[3], negative[1]…' refuses the no-provider write, stores no row; the A2 case shows the business row holds a secret: ref, not cleartext.
records-forms.encrypted-field-behavior · r7	N2	pass	HTTP-in-process: 'acceptance[2], negative[2]…' — the echoed mask leaves the stored ref unchanged and the secret resolvable.
records-forms.encrypted-field-behavior · r7	N3	pass	HTTP-in-process: 'acceptance[4], negative[3]…' — no aggregate over f_secret/f_password returns a distribution.
records-forms.field-unique-enforcement · r13	A0	pass	HTTP-in-process (SQLite): field-unique-rest-refusal 'acceptance[0], negative[0], negative[1]: a colliding create on %s is 409 UNIQUE_VIOLATION, driver-anonymous, and nothing lands' — sku: generic error + label developerMessage; gsku: 'Global SKU' named, field gsku.
records-forms.field-unique-enforcement · r13	A1	pass	HTTP-in-process: 'acceptance[1]: two rows with no sku both land (NULL-distinct)'.
records-forms.field-unique-enforcement · r13	A2	pass	HTTP-in-process: 'acceptance[2]: an update onto a taken value is refused and the row keeps its old value; a self-update passes' — 409 UNIQUE_VIOLATION, sku kept; nick-only and same-value PATCH 200.
records-forms.field-unique-enforcement · r13	A3	partial	HTTP-in-process + driver: 'acceptance[3], negative[2]: an atomic updateMany…' drives per-id updateMany with atomic (ROLLED_BACK + UNIQUE_VIOLATION, rows unchanged); the predicate update the clause names is memory-driver only ('updateMany refuses BEFORE mutating anything').
records-forms.field-unique-enforcement · r13	A4	pass	driver (test oracle): memory-unique-constraint "[#13197] scoping matches driver-sql's ADR-0120 D1/D3 rule" cases + sql-driver-8577 and declared-index-organization-respelling ('AFTER: the same cross-organization create is accepted', plain organization key) green.
records-forms.field-unique-enforcement · r13	A5	pass	driver (test oracle): memory-unique-constraint 'the refusal is recognisable to the ENGINE, so the autonumber resync converges' green.
records-forms.field-unique-enforcement · r13	N0	pass	HTTP-in-process: 'acceptance[0], negative[0], negative[1]…' — the second create is 409 and only one row holds the value.
records-forms.field-unique-enforcement · r13	N1	pass	HTTP-in-process: same case's expectDriverAnonymous: no [driver- prefix, no 'UNIQUE constraint failed', no bound value in the body (PATCH refusal too).
records-forms.field-unique-enforcement · r13	N2	partial	HTTP-in-process + driver: REST atomic updateMany leaves both rows unchanged; predicate-update half rests on memory pin 'updateMany refuses BEFORE mutating anything — no half-applied batch'.
records-forms.field-unique-enforcement · r13	N3	pass	driver (test oracle): memory '`unique: true` on an object WITH a tenant column scopes per organization' + sql-driver-8577 'AFTER: the same cross-organization create is accepted — 409 flips to 201'; live two-org probe not provisioned (knownGaps[2]).
records-forms.delete-behavior-matrix · r5	A0	partial	engine: engine-cascade-delete 'nulls the FK for an OPTIONAL (nullable) lookup child and deletes the parent' + multivalue-probe 'a SINGLE-valued set_null still clears the foreign key to null'; ObjectQL over a test driver, no DELETE at /data.
records-forms.delete-behavior-matrix · r5	A1	partial	engine: engine-cascade-delete-multivalue-probe '[#9438] a DEFAULTED set_null removes the deleted member and keeps the rest' + 'every dependent row loses the member…'; engine only.
records-forms.delete-behavior-matrix · r5	A2	partial	engine: engine-cascade-delete 'honors an explicit deleteBehavior:cascade on a required FK' + #23221 cascade-issued child delete cases + atomic 'commits the whole cascade'; engine only, no invoice/lines at /data.
records-forms.delete-behavior-matrix · r5	A3	partial	engine: engine-cascade-delete 'refuses to delete a parent with a REQUIRED-FK child (DELETE_RESTRICTED, 409)' + '[#9688] dependentCount counts ONLY the rows…'; envelope at engine, no HTTP; persona count-disclosure shape not driven.
records-forms.delete-behavior-matrix · r5	A4	partial	engine: engine-cascade-delete 'refuses to delete a parent with a REQUIRED-FK child…' + '[#9625] escalates an EXPLICITLY written set_null on a required lookup' + 'deletes a parent that has no dependents'; engine only.
records-forms.delete-behavior-matrix · r5	A5	pass	engine + spec-schema: field.test.ts 'deleteBehavior: set_null on master_detail is a parse-time rejection' + engine-cascade-delete '[#9689] … logs via logger.error when the parent delete coerces an authored set_null to cascade' green; the PUT refusal has no pin.
records-forms.delete-behavior-matrix · r5	N0	partial	engine: engine-cascade-delete required-FK escalation cases answer DELETE_RESTRICTED, never the child's required 400; engine only.
records-forms.delete-behavior-matrix · r5	N1	partial	engine: multivalue-probe '[#9438]…keeps the rest' and 'removal compares WHOLE members'; engine only.
records-forms.delete-behavior-matrix · r5	N2	partial	engine: engine-cascade-delete '[#23221]…' (child delete through the public dispatch, hooks fire) + atomic 'hook firing is unchanged by the transaction wrap'; engine only.
records-forms.delete-behavior-matrix · r5	N3	partial	engine: engine-cascade-delete '[#9688] dependentCount counts ONLY the rows that would be emptied'; engine only.
records-forms.record-clone-contract · r3	A0	skipped	: live leg, out of this pins-only card: POST /data/qa_noclone/ID/clone → 403 CLONE_DISABLED (scratch object) and showcase_account clone 201; no pin.
records-forms.record-clone-contract · r3	A1	partial	protocol unit (engine double): search-clone-schema-conformance 'emits a body that parses…' (override name 'Acme Copy' lands on the clone) over a mocked engine; a readonly key smuggled through overrides is not driven.
records-forms.record-clone-contract · r3	A2	partial	protocol unit + route over mock server: search-clone-route-schema-conformance 'answers a 201 body that parses against CloneDataResponseSchema' + 'describes the WHOLE body — this mount answers bare, no envelope' (mocked protocol, no HTTP adapter/engine).
records-forms.record-clone-contract · r3	A3	pass	test-oracle: protocol.write-response-internal-fields.tripwire '#7823 tripwire: every generic data ingress strips internal: true…' (enumerates cloneData) + search-clone-schema-conformance green.
records-forms.record-clone-contract · r3	A4	skipped	: live leg, out of this pins-only card: clone of an unknown id (404 RECORD_NOT_FOUND) and of an unregistered object (assertObjectRegistered refusal); no pin.
records-forms.record-clone-contract · r3	N0	skipped	: live leg, out of this pins-only card: enable.clone:false clone must refuse and a default object must answer 201; no pin.
records-forms.record-clone-contract · r3	N1	skipped	: live leg, out of this pins-only card: overrides carrying a readonly value must be dropped on the clone re-read; no pin drives the overrides door with a readonly key.
records-forms.record-clone-contract · r3	N2	partial	route over mock server: search-clone-route-schema-conformance 'describes the WHOLE body — this mount answers bare, no envelope'; no booted HTTP answer.
records-forms.record-clone-contract · r3	N3	skipped	: SCOPE pointer: a run-record note (docs drift, no console caller of data.clone), not a clause; asserts nothing at this item.
records-forms.field-history-tracking · r11	A0	pass	HTTP-in-process: field-history-tracking-activity 'acceptance[0], negative[2]: a tracked edit lands the old → new summary in labels, never raw values' — sys_activity summary 'Industry: Retail → Finance', key fieldChanges.
records-forms.field-history-tracking · r11	A1	pass	HTTP-in-process: 'acceptance[1], negative[0]: a website-only edit lands the generic frame, never an old → new diff' — summary names the Website label, no arrow, no URLs.
records-forms.field-history-tracking · r11	A2	partial	browser-live: record-history-display.spec.ts 'the timeline stream's Changes chip shows display values…' passed on showcase_account (flag-true DOM half); no network log, task-detail absence of the sys_audit_log read never driven.
records-forms.field-history-tracking · r11	A3	pass	HTTP-in-process: 'acceptance[3]: the derived history operation is offered on showcase_account and not on showcase_task' — GET /auth/me/permissions apiOperations.
records-forms.field-history-tracking · r11	A4	pass	plugin-unit (test oracle): audit-lookup-summary '[#7230] renders BOTH sides of a reference change as titles' + 'a tracked change with NO reference field pays ZERO extra reads' / 'ONE tracked reference change costs exactly ONE read' green.
records-forms.field-history-tracking · r11	N0	pass	HTTP-in-process: 'acceptance[1], negative[0]…' — the untracked website edit's rendered summary carries no old→new diff.
records-forms.field-history-tracking · r11	N1	skipped	: live leg, out of this pins-only card: the network log of the rendered showcase_task detail page must show no sys_audit_log read; no pin reads it.
records-forms.field-history-tracking · r11	N2	pass	HTTP-in-process: 'acceptance[0], negative[2]…' — option labels Retail/Finance, never raw values; audit-option-label-summary '[#7289] localizes the option label on BOTH sides' beside it.

Generated by Claude Code

domain:devx#1 · os-warren · session_01JQwxbYXnfyuxgv3GQP9G1h

Per-clause verdicts (5/6): records-forms.

item · rev	clause	verdict	layer · text evidence
records-forms.predicate-relationship-traversal · r6	A0	pass	HTTP-in-process: predicate-relationship-traversal 'acceptance[0]: a write against a non-churned account passes and reads back' — 2xx, no 'could not be evaluated', GET 200.
records-forms.predicate-relationship-traversal · r6	A1	pass	HTTP-in-process: 'acceptance[1], negative[0]: a write against a churned account is refused with the authored message, and nothing is stored' — 400 VALIDATION_FAILED, one {_record, rule_violation, authored message}.
records-forms.predicate-relationship-traversal · r6	A2	pass	HTTP-in-process: 'acceptance[2]: a patch carrying only the repointed account is judged against the account it lands on' — refused, stored account unchanged.
records-forms.predicate-relationship-traversal · r6	A3	pass	HTTP-in-process: scratch pair: 'control: the member really cannot read the parent' (403 PERMISSION_DENIED), 'acceptance[3]: a legitimate write against a non-tripping parent goes through', 'acceptance[3], negative[2]: …refused with the authored message'.
records-forms.predicate-relationship-traversal · r6	N0	pass	HTTP-in-process: 'acceptance[1], negative[0]…' — the churned-account create is 400, nothing stored.
records-forms.predicate-relationship-traversal · r6	N1	pass	HTTP-in-process: 'negative[1]: an unrelated patch on an invoice whose account is readable is not refused by the rule' + expectAdmitted/expectRuleRefusal never contain the unevaluable fault.
records-forms.predicate-relationship-traversal · r6	N2	pass	HTTP-in-process: 'acceptance[3], negative[2]: a write against a tripping parent is refused with the authored message, never the unevaluable fault' for the member who cannot read the parent.
records-forms.write-time-option-and-element-shape-judgement · r2	A0	pass	test-oracle: all 7 objectql pin files (option-visibility, field-predicate-fault, import-kept-option-values, record-validator.kept-option-values, validate-update-stored-row, validate-preview-parent, multi-reference-element-shape) green in packages/objectql (29 files, 728 tests, 0 failed) at `7fa9873`.
records-forms.write-time-option-and-element-shape-judgement · r2	A1	pass	HTTP-in-process: write-time-option-and-element-shape 'acceptance[1]: picking the option whose visibleWhen faults is 400 rule_violation, reason unevaluable, and nothing is stored'.
records-forms.write-time-option-and-element-shape-judgement · r2	A2	pass	HTTP-in-process: 'acceptance[2]: createMissingOptions stores the unmatched value, its dry run agrees, and a later PATCH sending it back is invalid_option'.
records-forms.write-time-option-and-element-shape-judgement · r2	A3	pass	HTTP-in-process: 'acceptance[3]: the dry run of a matched row admits where the import admits, and refuses where it refuses'.
records-forms.write-time-option-and-element-shape-judgement · r2	A4	pass	HTTP-in-process: 'acceptance[4]: each malformed multi-lookup element is 400 invalid_type naming its index' — object/false/number each 'at index 1:'.
records-forms.write-answer-advisories-rollback-and-tree-delete · r3	A0	pass	test-oracle: advisory-write-answer, engine-after-hook-abort-unit, engine-cascade-delete, engine-cascade-delete-tree (objectql) and verify delete-behavior-referenceless-tree green at `7fa9873` (0 failed).
records-forms.write-answer-advisories-rollback-and-tree-delete · r3	A1	pass	HTTP-in-process: write-answer-warnings-rest 'a health jump answers 2xx with the hit in warnings[], and the write is stored' + 'control: a one-step change answers 2xx with no warnings key'.
records-forms.write-answer-advisories-rollback-and-tree-delete · r3	A2	pass	HTTP-in-process: hook-after-abort-rollback 'REST createData: the refused create leaves neither the row nor the hook chain's ctx.api write' — refused (500 INTERNAL_ERROR), 0 rows, 0 notes.
records-forms.write-answer-advisories-rollback-and-tree-delete · r3	A3	pass	HTTP-in-process: verify delete-behavior-referenceless-tree (bootStack, REST DELETE): 'set_null…clears the child's parent', 'restrict…refused with the envelope' (409 DELETE_RESTRICTED), 'cascade: DELETE of the parent deletes the subtree'.
records-forms.write-answer-advisories-rollback-and-tree-delete · r3	N0	pass	HTTP-in-process: hook-after-abort-rollback 'REST createData: the refused create leaves neither the row…' — the aborted row is not readable.
records-forms.comment-reactions-and-edit-stamps · r5	A0	pass	test-oracle: sys-comment-reaction.object, comment-reaction-own-record-floor, comment-edit-stamp.integration, sys-comment-reactions-door.integration, activity-field-redaction green (plugin-audit 8 files / plugin-security 2 files, 0 failed).
records-forms.comment-reactions-and-edit-stamps · r5	A1	pass	HTTP-in-process: comment-reactions-and-edit-stamps: '…201 with user_id forced to the caller, and a duplicate is 409 UNIQUE_VIOLATION', '…cannot read is 403 RECORD_NOT_ACCESSIBLE', '…never updated (405), another member's reaction never deleted (403)'.
records-forms.comment-reactions-and-edit-stamps · r5	A2	pass	HTTP-in-process: 'acceptance[2]: sys_comment.reactions on a write or a filter is 400 INVALID_FIELD, and reads carry no such key'.
records-forms.comment-reactions-and-edit-stamps · r5	A3	pass	HTTP-in-process: 'acceptance[3]: a body edit is platform-stamped — is_edited true, a server edited_at — and the client-sent values are dropped'.
records-forms.v18-semantic-defaults · r6	A0	pass	spec-schema (test oracle): field-autonumber-default-unique.test.ts, ui/view.test.ts, record-surface.test.ts green in packages/spec (12 files, 1077 tests, 0 failed) at `7fa9873`.
records-forms.v18-semantic-defaults · r6	A1	skipped	: live leg, out of this pins-only card: render a list view with no pageSize over more than 50 seeded rows and count the 50 rendered rows after a screenshot.
records-forms.v18-semantic-defaults · r6	A2	skipped	: live leg, out of this pins-only card: Edit inline switch present for an updater, absent for a read-only member, per-persona screenshots.
records-forms.v18-semantic-defaults · r6	A3	skipped	: live leg, out of this pins-only card: heavy create form as a bounded modal at desktop and full-screen at mobile, screenshots per viewport.

Generated by Claude Code

domain:devx#1 · os-warren · session_01JQwxbYXnfyuxgv3GQP9G1h

Per-clause verdicts (6/6): studio-authoring.

item · rev	clause	verdict	layer · text evidence
studio-authoring.object-designer-roundtrip · r10	A0	partial	browser-live: F4 'adding a picklist + an empty option row does not trip spec validation, and is not stored' saves and reads the DRAFT back via GET /meta/object ?state=draft (one picklist, one option); no edit, no reorder, no publish, Studio Data pillar not driven.
studio-authoring.object-designer-roundtrip · r10	A1	partial	browser-live: F3 'a field API name derives from its label on blur' asserts field-apiname-input = asset_code, at the Studio All-metadata object editor (/studio/PKG/metadata/object/new), not the Data pillar; stored record column key not read.
studio-authoring.object-designer-roundtrip · r10	A2	partial	browser-live: F2 'object Name accepts a typed underscore (no per-keystroke trim)' types repair_ticket char by char and keeps the underscore; stored-name preview NS_repair_asset and the meta read's name are not asserted, and the door differs.
studio-authoring.object-designer-roundtrip · r10	A3	partial	browser-live: F4 asserts no metadata-validation-banner / 'System identifier must be' after the empty row and a draft read holding only [{open}]: ONE option not three, draft not published; the 3-option published read is the live leg.
studio-authoring.object-designer-roundtrip · r10	N0	partial	browser-live: F3 asserts the API name derives to asset_code on blur (not frozen at field_N), at the All-metadata designer door; the Studio Data pillar door the item drives is not pinned.
studio-authoring.record-page-roundtrip · r11	A0	skipped	-: live leg, out of this pins-only card: Kind=full record page create on showcase_contact and its captured PUT body (type record, kind full, seeded regions with record:highlights); studio-editor.spec.ts copies an app page via API instead.
studio-authoring.record-page-roundtrip · r11	A1	pass	browser-live: 'Add block opens a block-type picker with configurable block kinds, and the added block is stored' (studio-editor.spec.ts, 2/2 green on preview) asserts the dialog offers Card, Section and Record details on an editable page copy.
studio-authoring.record-page-roundtrip · r11	A2	partial	browser-live: same case picks Card, waits for the PUT ?mode=draft and reads GET /meta/page ?state=draft: the first region gains a page:card block. DRAFT round trip only; publish and the published read are not driven.
studio-authoring.record-page-roundtrip · r11	A3	skipped	-: live leg, out of this pins-only card: open a showcase_contact record as the end user and screenshot the authored page with the added block.
studio-authoring.record-page-roundtrip · r11	N0	skipped	-: live leg, out of this pins-only card: explicit Kind=full create must not open as a blank canvas (regions: []); no pin drives the create form.
studio-authoring.org-override-registry-gate · r7	A0	partial	spec-schema: 'every type in OVERLAY_ALLOWED_TYPES has allowEnvironmentOverlay:true in the registry' asserts object is not overlay-allowed (registry flag only). No case writes an artifact-backed object; the 403 NOT_OVERRIDABLE at PUT /meta is the live leg.
studio-authoring.org-override-registry-gate · r7	A1	partial	plugin-unit: 'accepts view' (saveMetaItem over a vi.fn mock engine) asserts success:true for a view write; the read-side overlay precedence and the HTTP door are not driven.
studio-authoring.org-override-registry-gate · r7	A2	partial	plugin-unit: 'rejects job — jobs are code artifacts' asserts 403 with code matching NOT_OVERRIDABLE\|NOT_CREATABLE at saveMetaItem over a mock engine; it does not pin NOT_CREATABLE specifically and no HTTP door.
studio-authoring.org-override-registry-gate · r7	A3	partial	plugin-unit: 'accepts brand-new object' (tenant_widget, sharingModel private) asserts success at saveMetaItem over a mock engine; the paired artifact-backed refusal in the same run is not in this file; no HTTP.
studio-authoring.org-override-registry-gate · r7	A4	skipped	-: live leg, out of this pins-only card: DELETE /api/v1/meta/view/‹name› reset:true/false and the follow-up GET serving the artifact body.
studio-authoring.org-override-registry-gate · r7	N0	skipped	-: live leg, out of this pins-only card: an overlay write against an artifact-backed object/field answering 200; the pin seeds no artifact (its own comment defers provenance-aware rejection to protocol-meta.test.ts).
studio-authoring.expression-editors · r8	A0	partial	component-jsdom: CelPredicateField 'shows the inferred type for a proven-Number formula' and 'reports Unknown with the pinning hint when the type cannot be proven' (real @objectstack/formula, jsdom); the live screenshot in ObjectFieldInspector is not taken.
studio-authoring.expression-editors · r8	A1	skipped	-: live leg, out of this pins-only card: save an edited formula field and GET /meta/object for returnType, plus the un-edited sibling (formulaEdited guard); no named pin asserts the stamp.
studio-authoring.expression-editors · r8	A2	partial	plugin-unit (in-process lint): celAuthoring 'rates a USING clause the runtime cannot lower an error, worded by @objectstack/lint' equals validateRlsPredicateEnforceability; record-scope 'flags a BARE field reference as an error'. Unit only; no build/publish 422; formula-field probe absent.
studio-authoring.expression-editors · r8	A3	partial	component-jsdom: CelPredicateField 'completes field names after record.', 'does not suggest after a member-access dot on an unknown-shape root' (current_user.), 'withholds BARE field suggestions in record scope'. Mocked introspect; previous. not driven; jsdom.
studio-authoring.expression-editors · r8	A4	partial	component-jsdom: PermissionAdvancedFacets 'reports a USING clause the runtime cannot lower up as blocking' and 'reports blocking CEL errors up so the host can gate Save' (count 1). The held state (perm.cel.saveBlocked / perm-autosave-held, no PUT) and formula-field probe are not asserted.
studio-authoring.expression-editors · r8	A5	partial	component-jsdom: CelTestRunDialog 'reports ALLOW when the predicate is satisfied', 'reports DENY when the predicate is not satisfied', 'flags a non-boolean result as an authoring smell' (real engine, jsdom); no live dialog screenshot, no separate engine evaluate.
studio-authoring.expression-editors · r8	A6	partial	plugin-unit (in-process lint): celAuthoring runs the real @objectstack/formula and compares the lowerability verdict to @objectstack/lint byte for byte; no per-probe parity table against validate_expression / build captured.
studio-authoring.expression-editors · r8	A7	pass	test-oracle: celAuthoring.test.ts describe 'celAuthoring · graceful degradation' green (ui batch 48/48 files): 'lint returns [] when the engine is unavailable', 'test-run reports "unavailable"...', 'swallows a loader that throws'.
studio-authoring.expression-editors · r8	N0	partial	plugin-unit (in-process lint): celAuthoring lowerability case asserts the editor finding equals @objectstack/lint's for the same source (unit parity); formula/conditional-rule parity against validate_expression is not driven.
studio-authoring.expression-editors · r8	N1	partial	component-jsdom: PermissionAdvancedFacets 'reports blocking CEL errors up so the host can gate Save' (parse fault 'organization_id ==' → 1); the host's actual Save gate and the formula editor's gate are not asserted.
studio-authoring.expression-editors · r8	N2	partial	component-jsdom: CelPredicateField 'does not suggest after a member-access dot on an unknown-shape root', 'withholds BARE field suggestions in record scope'; celAuthoring 'flags a BARE field reference as an error with the record.‹field› fix'. jsdom/unit.
studio-authoring.permission-matrix-editor-ux · r7	A0	partial	component-jsdom: fieldBulk 'the filter narrows the field set and bulk acts only on what is visible': filter 're' leaves region/revenue, email row absent, '2 / 8' shown. jsdom over a stub client; no live screenshot.
studio-authoring.permission-matrix-editor-ux · r7	A1	partial	component-jsdom: same case: Write all, filter, Read-only all revokes write on region only, clearing the filter shows email still editable. jsdom checkbox states.
studio-authoring.permission-matrix-editor-ux · r7	A2	skipped	-: live leg, out of this pins-only card: Save and GET /meta/permission/‹name›: fields-map keys a subset of fields visible at bulk time; the pin's client.save is a stub nobody asserts.
studio-authoring.permission-matrix-editor-ux · r7	A3	partial	component-jsdom: fieldBulk 'Clear drops the rules so the rows draw the object grant again' (row inherited, readable not editable) at component state; the SAVED fields map lacking the keys is not read.
studio-authoring.permission-matrix-editor-ux · r7	A4	skipped	-: live leg, out of this pins-only card: narrow viewport, scrollWidth > clientWidth on the matrix container, scroll and screenshot the Bulk column.
studio-authoring.permission-matrix-editor-ux · r7	A5	partial	component-jsdom: readonly 'locks the whole matrix and hides Save when readOnly is set', 'shows the package read-only badge'; artifactTier '…the caption names the ARTIFACT tier'. jsdom; field-bulk buttons ABSENT is not asserted; no live screenshot.
studio-authoring.permission-matrix-editor-ux · r7	N0	partial	component-jsdom: fieldBulk 'the filter narrows the field set and bulk acts only on what is visible' shows hidden fields untouched in the repaint; the clause makes the SAVED fields map the authority, which no pin reads.
studio-authoring.permission-matrix-editor-ux · r7	N1	skipped	-: live leg, out of this pins-only card: Bulk column clipped at narrow width with no horizontal scroll (browser viewport).
studio-authoring.metadata-diagnostics-sweep · r10	A0	partial	plugin-unit: 'a healthy store still counts the rows it holds' / 'an unprovisioned sys_metadata still answers benignly' assert scannedTypes = registry-with-schema count, entries/total, at getMetaDiagnostics over a stub engine; the live REST bare body is not read.
studio-authoring.metadata-diagnostics-sweep · r10	A1	partial	plugin-unit: 'a healthy store still counts the rows it holds' asserts stats.object.count 1 and packages ['crm'] over a stub engine; parity against GET /meta/‹type› lists and the envelope lock is the live leg.
studio-authoring.metadata-diagnostics-sweep · r10	A2	skipped	-: live leg, out of this pins-only card: ?package= scoped sweep vs unscoped, and the Studio directory tile counts.
studio-authoring.metadata-diagnostics-sweep · r10	A3	partial	plugin-unit: 'an unrecognised spelling of a declared type rejects with the producer's 400, not 200-with-empty-stats' (400 INVALID_REQUEST naming both spellings) at the protocol layer; REST door and the repeated-param refusal not driven.
studio-authoring.metadata-diagnostics-sweep · r10	A4	skipped	-: live leg, out of this pins-only card: GET /meta/diagnostics?severity=warning vs severity=error entries diffed.
studio-authoring.metadata-diagnostics-sweep · r10	A5	skipped	-: live leg, out of this pins-only card: DiagnosticsPage empty state screenshot and absent directory diagnostics button.
studio-authoring.metadata-diagnostics-sweep · r10	A6	skipped	-: live leg, out of this pins-only card: planted invalid row on the run's scratch DB, located path, page grouping and deep link.
studio-authoring.metadata-diagnostics-sweep · r10	A7	pass	test-oracle: protocol.diagnostics-store-outage.test.ts green (metadata-protocol 10/10 files): 'the whole-corpus sweep propagates the 503 instead of answering total: 0, stats: {}' and 'the single-type sweep is held to the same rule' (503 SERVICE_UNAVAILABLE).
studio-authoring.metadata-diagnostics-sweep · r10	N0	partial	plugin-unit: same #8924 case asserts the misspelling rejects 400, never 200 with empty stats, at the protocol layer; the REST door is the clause's oracle.
studio-authoring.metadata-diagnostics-sweep · r10	N1	pass	test-oracle: 'an outage and a first boot are now distinguishable by the caller' and the 503 cases assert an unreadable store is never answered as a clean sweep; outage is pin-only by the item's own step.
studio-authoring.metadata-diagnostics-sweep · r10	N2	skipped	-: live leg, out of this pins-only card: blank diagnostics region vs designed empty state in the browser.
studio-authoring.metadata-diagnostics-sweep · r10	N3	skipped	-: recording guard (dispatcher-vs-hono-route): asserts nothing a pin can drive; applies to the live leg.
studio-authoring.meta-save-preconditions-and-draft-rows · r2	A0	pass	test-oracle: all 5 named files ran green at the subject: packages/rest 14/14, packages/runtime 16/16, packages/objectql 29/29 files passed (pins/SUMMARY); each file is in the batch and has cases (e.g. 'two readers save in turn: the second is refused 409').
studio-authoring.meta-save-preconditions-and-draft-rows · r2	A1	partial	engine + REST handler (no HTTP): meta-item-version-token-occ: 'draft: ?state=draft serves the draft save receipt's version', 'two readers save in turn: the second is refused 409', If-None-Match cases 'refused 400 VALIDATION_ERROR, nothing written'. RestServer over createMockServer + SqlDriver; no HTTP.
studio-authoring.meta-save-preconditions-and-draft-rows · r2	A2	partial	plugin-unit: sys-metadata-repository-list-drafts 'projects headers ONLY — a draft row's stored body never reaches the caller (#6599)' asserts the row's label 'Account'; repository unit, no /meta/_drafts HTTP read.
studio-authoring.meta-save-preconditions-and-draft-rows · r2	A3	partial	engine: protocol-metadata-row-actor 'a second write with actor B keeps created_by A and moves updated_by to B' over ObjectQL + memory driver; the HTTP history entry read is the live leg.
studio-authoring.multi-package-item-rows · r4	A0	pass	test-oracle: all 9 named files ran green at the subject: packages/rest 14/14, runtime 16/16, objectql 29/29, metadata-protocol 10/10 files passed (pins/SUMMARY); every file is in its batch with cases.
studio-authoring.multi-package-item-rows · r4	A1	partial	engine: protocol.packageless-save-address '409 RESOURCE_CONFLICT naming both packages, and nothing is written' and 'the card's probe: the write is what the item read serves next, no second row'; protocol layer, no HTTP and no /layers read.
studio-authoring.multi-package-item-rows · r4	A2	partial	engine: protocol-runtime-owner-overlay-refusal 'Q's save is refused with the D9.9 envelope, before any write' asserts OBJECT_OVERLAY_PACKAGE_MISMATCH / 422 and nothing stored, over ObjectQL; no HTTP.
studio-authoring.multi-package-item-rows · r4	A3	partial	REST handler (createMockServer, stub engine): rest-meta-sealed-first-draft-remedy 'PUT draft and publish, unpinned and pinned If-None-Match: *, all read the one sentence' asserts 403 NOT_OVERRIDABLE and the exact ruled sentence; handler called directly, no HTTP.
studio-authoring.multi-package-item-rows · r4	A4	partial	dispatcher (HttpDispatcher.handlePackages): package-revert-stored-members '(a) a published package with one draft: 200, the draft is gone', '(a) an item created after the last publish … the revert removes it', '(b) a never-published package: 409 RESOURCE_CONFLICT'; no booted HTTP.
studio-authoring.save-door-runs-authoring-rules · r4	A0	pass	test-oracle: all 8 named files ran green at the subject: metadata-protocol 10/10, objectql 29/29, spec 12/12, rest 14/14, lint 2/2 files passed (pins/SUMMARY); each file is in its batch with cases.
studio-authoring.save-door-runs-authoring-rules · r4	A1	partial	plugin-unit: runtime-authoring-gate '(a) refuses a page carrying an undeclared component prop' (422, rule, path, nothing landed); save-door-protection/lock-family 'refused with a located 400 VALIDATION_ERROR'; default-record-page 'is refused … naming both'. Protocol over stub; no HTTP read-back.
studio-authoring.save-door-runs-authoring-rules · r4	A2	partial	plugin-unit: runtime-authoring-gate '(a) refuses a page carrying an undeclared component prop, and the refusal carries the fix' asserts the message contains '`titel` → `title`'; saveMetaItem over a stub engine, not the HTTP body.
studio-authoring.save-door-runs-authoring-rules · r4	A3	partial	plugin-unit: runtime-authoring-gate "(a) REFUSES the same body on a draft's PROMOTION" asserts the draft save resolves success and publishMetaItem answers 422 INVALID_METADATA; protocol layer, no HTTP.
studio-authoring.save-door-runs-authoring-rules · r4	N0	partial	plugin-unit: refusal cases assert nothing stored at the protocol/stub layer ('Nothing landed', 'no row is stored', meta-view-chart-binding 'nothing is stored'); a live GET after the 4xx is the run's.
studio-authoring.held-edit-publish-refusal · r3	A0	partial	component-jsdom: heldPublish 'a new Notify step not yet filled in: Publish refuses naming the step and its input' and heldWidgetPublish 'a new widget not yet bound: Publish refuses naming the widget' assert the engine.studio.held.publish toast; the Data-pillar field held case is not pinned.
studio-authoring.held-edit-publish-refusal · r3	A1	partial	component-jsdom: same cases assert mockClient.publishPackageDrafts not called ('Publish must not go around the held edit'); a client double, not the browser network trace, and no _drafts / live re-read.
studio-authoring.held-edit-publish-refusal · r3	A2	partial	component-jsdom: 'once the step is filled in and saved, Publish goes' / 'once the widget is bound and saved, Publish goes' assert publishPackageDrafts(PKG) called; the 200 publish answer, toast count and live read are not.
studio-authoring.held-edit-publish-refusal · r3	N0	partial	component-jsdom: the refusal cases assert publish is not sent while the held strip shows; component layer against a client double.
studio-authoring.automations-rail-and-new-flow · r2	A0	skipped	-: live leg, out of this pins-only card: rail grouping by watched object and per-row trigger glyph / status dot; no named pin asserts the grouping.
studio-authoring.automations-rail-and-new-flow · r2	A1	skipped	-: live leg, out of this pins-only card: auto-rail-legend content before and after disabling a flow; no named pin reads the legend.
studio-authoring.automations-rail-and-new-flow · r2	A2	partial	component-jsdom: railSearch 'matches the label, case-insensitively', 'matches the machine name where the label does not hold it', 'a search that matches nothing says so, and clearing it brings every flow back'. jsdom.
studio-authoring.automations-rail-and-new-flow · r2	A3	partial	component-jsdom: flowPresets 'a record preset with no object sends nothing and says what it needs'; flowStatusTruth '"New" saves status: obsolete, a spec-valid flow' with Start config objectName. Saves to a double; no server draft read.
studio-authoring.automations-rail-and-new-flow · r2	N0	partial	component-jsdom: railSearch no-match case asserts the engine.list.emptyQuery message, never a blank rail; jsdom.
studio-authoring.automations-rail-and-new-flow · r2	N1	partial	component-jsdom: flowStatusTruth '"New" saves status: obsolete … the switch reads Disabled under "Off by default"' and flowPresets no-object case sending nothing; jsdom over a save double.
studio-authoring.org-scope-flows · r2	A0	partial	component-jsdom: packageLessFlows 'lists the clone and none of the packaged flows', 'offers its one pillar, no Create app…', 'a package-less scope URL on another pillar lands on its one pillar'. jsdom.
studio-authoring.org-scope-flows · r2	A1	partial	component-jsdom: 'opens it editable, and an edit saves a draft bound to no package' asserts save mode draft with packageId undefined to a double; the PUT URL and /meta/_drafts row are the live leg.
studio-authoring.org-scope-flows · r2	A2	partial	component-jsdom: 'publishes each package-less flow draft by reference, and nothing through the package batch door' asserts publishedByRef [flow] and packageBatches []; no network trace, live read or toast count.
studio-authoring.org-scope-flows · r2	N0	partial	component-jsdom: 'the packaged control: a read-only package stays read-only' + the by-reference publish case (no batch door) at the component layer.
studio-authoring.flow-status-matches-runtime · r2	A0	partial	component-jsdom: flowStatusTruth 'a published flow with no status key reads On…', 'an unbound schedule flow reads "Not running here"…'; FlowStatusDot 'shows "Off" for a disabled flow'. Against a _status double; no live pairing table.
studio-authoring.flow-status-matches-runtime · r2	A1	partial	component-jsdom: railUnboundReason 'titles a policy-unbound schedule flow with the platform reason, verbatim'; flowStatusTruth 'Problems says so too: a note carrying the reason, not counted as a problem'. jsdom double.
studio-authoring.flow-status-matches-runtime · r2	A2	skipped	-: live leg, out of this pins-only card: enable/publish a record-triggered flow, create records and read the runs.
studio-authoring.flow-status-matches-runtime · r2	A3	skipped	-: live leg, out of this pins-only card: second boot with OS_AUTOMATION_SCHEDULED_WORK_ENABLED=1, _status bound:true and a schedule run.
studio-authoring.flow-status-matches-runtime · r2	N0	partial	component-jsdom: flowStatusTruth unbound-schedule case asserts not On and no emerald/destructive styling, Problems note not an error; jsdom over a _status double.
studio-authoring.validation-rules-authoring · r3	A0	partial	component-jsdom: presets 'offers 3–5 presets first, in plain words, and folds the type list under Advanced' (six types in order), '"Reject the save when…" is held, not written, and opens with the condition focused'. onPatch double, no network trace.
studio-authoring.validation-rules-authoring · r3	A1	skipped	-: live leg, out of this pins-only card: an invalid CEL condition's inline error and no object PUT until fixed; neither named pin drives an invalid condition.
studio-authoring.validation-rules-authoring · r3	A2	partial	spec-schema: presets cases call expectSpecAccepts (ValidationRuleSchema + ObjectSchema parse) on the written rules; the 200 PUTs and the live validations[] read are the live leg.
studio-authoring.validation-rules-authoring · r3	A3	skipped	-: live leg, out of this pins-only card: per-type 400 VALIDATION_FAILED codes on violating writes and 2xx twins; the presets file's CEL evaluate of conditions is not the write door.
studio-authoring.validation-rules-authoring · r3	A4	skipped	-: live leg, out of this pins-only card: warning-severity write 2xx with warnings, inactive rule not firing.
studio-authoring.validation-rules-authoring · r3	N0	skipped	-: live leg, out of this pins-only card: published rule enforcing at the data write door.
studio-authoring.hooks-tab-authoring · r3	A0	partial	component-jsdom: firstSavePinned 'a new hook is created with the first-write pin', 'a hook with a pending draft: the first save sends If-Match with the version its draft read served'. Client double, not PUT headers on the wire.
studio-authoring.hooks-tab-authoring · r3	A1	partial	component-jsdom: autosave 'holds a rename typed with a pause between its parts, and saves once the name is back': no save, hooks-rename-held names guard_hook. The /meta/_drafts read is the live leg.
studio-authoring.hooks-tab-authoring · r3	A2	partial	component-jsdom: celGate 'holds the malformed hook, and says why' / 'sends the hook once the guard parses again' (save half only); the runtime gating on a matching record is not driven.
studio-authoring.hooks-tab-authoring · r3	A3	skipped	-: live leg, out of this pins-only card: retry attempts in the server log, On Error log 201 and abort 400 with nothing stored.
studio-authoring.hooks-tab-authoring · r3	N0	partial	component-jsdom: same rename case asserts no draft is staged under either partial name (save not called); component layer.
studio-authoring.actions-tab-presets · r3	A0	partial	component-jsdom: presets 'offers 3–5 presets first, in plain words', '"Change a picklist field" is written at once, asking for the author's own picklist', '… is disabled, saying what it needs'. jsdom; no draft read.
studio-authoring.actions-tab-presets · r3	A1	partial	component-jsdom: '"Run a flow" is held, not written, until the editor gives it a flow' and 'Delete drops a held action unsent' assert onPatch not called; no network trace or draft read.
studio-authoring.actions-tab-presets · r3	A2	skipped	-: live leg, out of this pins-only card: member clicks each published preset: picklist change, flow run, URL with real record id, dialog page.
studio-authoring.actions-tab-presets · r3	A3	partial	spec-schema: 'the %s preset ends as an action the spec accepts' (ActionSchema + ObjectSchema parse per preset); newActionDefault 'parses through the spec's ActionSchema…'. The 200 autosave statuses are the live leg.
studio-authoring.actions-tab-presets · r3	A4	skipped	-: live leg, out of this pins-only card: advanced editor script action saved type script and run from the record.
studio-authoring.actions-tab-presets · r3	A5	skipped	-: live leg, out of this pins-only card: Expose to AI agents PUT body ai.exposed and 200; no named pin asserts it.
studio-authoring.actions-tab-presets · r3	N0	partial	component-jsdom: held-preset cases assert nothing is written before a target is given; 'published preset does nothing when clicked' is the live leg.
studio-authoring.object-api-tab-curl · r2	A0	partial	component-jsdom: 'the copied Create and Update calls carry the same body' reads rows[1] as -X POST and rows[3] as -X PATCH; the full five-row list and /api/v1/data/OBJ paths are not asserted.
studio-authoring.object-api-tab-curl · r2	A1	partial	component-jsdom: 'every non-computed field type shows a value its stored-form contract accepts' and select/location cases parse each value with the stored-form schema, rendered from the draft prop; the 201 create is the live leg.
studio-authoring.object-api-tab-curl · r2	A2	partial	component-jsdom: 'carries the Authorization header and the example body' asserts -H 'Authorization: Bearer …' on the copied create; running the five commands against the server is the live leg.
studio-authoring.object-api-tab-curl · r2	N0	partial	component-jsdom: 'leaves owner_id out…', 'leaves every optional reference out', 'shows a required reference as a placeholder naming its target, never as an id' plus stored-form parses; jsdom, not the write path.
studio-authoring.object-api-tab-curl · r2	N1	skipped	-: scoring guard (a pre-publish 400 is not this item's FAIL): asserts nothing a pin drives.
studio-authoring.interfaces-create-dialogs · r2	A0	partial	component-jsdom: createAppOpensInterfaces 'from another pillar, a clean create lands on Interfaces…; the write is unchanged' (app draft = buildAppSkeleton with one object entry, ifNoneMatch *). Box-off empty nav and server draft reads not driven.
studio-authoring.interfaces-create-dialogs · r2	A1	partial	component-jsdom: interfacesCreate 'New dashboard saves a spec-valid draft, links it from the navigation, and opens it on the dashboard canvas' (mode draft, ifNoneMatch *), report and interfacesCreatePage html/React cases. Save double, no 200s.
studio-authoring.interfaces-create-dialogs · r2	A2	partial	component-jsdom: 'a report with no dataset chosen is refused in the dialog, and nothing is written' (save not called); the no-measure attempt is not a separate case; no network trace.
studio-authoring.interfaces-create-dialogs · r2	A3	partial	component-jsdom: refusals pinned: dashboard in another package, report draft, page in another package, page draft. The clause's dashboard-held-by-a-draft refusal is not pinned; component layer.
studio-authoring.interfaces-create-dialogs · r2	A4	skipped	-: live leg, out of this pins-only card: published app listed by /meta/app, on the Home launcher, every entry rendering.
studio-authoring.interfaces-create-dialogs · r2	N0	partial	component-jsdom: 'a refused item save stays in the dialog and links nothing' and 'a refused nav save shows the canvas refusal strip…' assert the item/menu pairing outcomes on a save double.

Generated by Claude Code

domain:devx#1 · os-warren · session_01JQwxbYXnfyuxgv3GQP9G1h

Close-out for this record (SKILL §5).

Extracted: #28970 · studio-authoring.record-page-roundtrip · observed beside the clauses
Parked-on: #27377 · 79 PARTIAL items: pins-only coverage (186 skipped live legs, 315 partial rows), 15 retests owed from landed wave-3 cards, and 44 checklist-accuracy findings (anchor comment 6569512017)

There is no clause FAIL, so no four-way disposition is owed. The four wave-3 FAILs were not re-judged here (their clauses are live legs, skipped in this record). They stay on #27438, which this record does not supersede.

No security finding.

Generated by Claude Code

Navigation Menu

Repository navigation

QA run · release-18.3.0-w4-c2b (86/86) · 7fa9873f · 2026-11-02 · 7 PASS / 79 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #28965

1. Environment fingerprint

2. Scope: selector and the revision each verdict is valid for

3. Tier 1 pins (RUNNER rule 6)

4. Derived item verdicts

5. Delta against wave 3 (#27438, at `c4c515a`)

6. Off-clause probes (RUNNER rule 8)

7. Time: environment prep vs testing

8. Per-clause verdicts

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

QA run · release-18.3.0-w4-c2b (86/86) · 7fa9873f · 2026-11-02 · 7 PASS / 79 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #28965

Description

1. Environment fingerprint

2. Scope: selector and the revision each verdict is valid for

3. Tier 1 pins (RUNNER rule 6)

4. Derived item verdicts

5. Delta against wave 3 (#27438, at c4c515a)

6. Off-clause probes (RUNNER rule 8)

7. Time: environment prep vs testing

8. Per-clause verdicts

Activity

objectstack-fleet commented on Nov 2, 2026

objectstack-fleet commented on Nov 2, 2026

objectstack-fleet commented on Nov 2, 2026

objectstack-fleet commented on Nov 2, 2026

objectstack-fleet commented on Nov 2, 2026

objectstack-fleet commented on Nov 2, 2026

objectstack-fleet commented on Nov 2, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

5. Delta against wave 3 (#27438, at `c4c515a`)