Checklist maintenance (docs/qa/platform-checklist): dedupe the private D11 defect and fix five stale/incorrect item texts

[huangyiirene]

Symptom

Maintenance items for docs/qa/platform-checklist/ falling out of the run. Itemised:

1. Dedupe the private defect. owd-sharing-matrix clause 4 and rls-both-sides clause 5 are the same defect (delivered privately as FOLLOW-UPS.md D11) — dedupe so it is not counted twice.
2. suggested-binding-loop knownGaps text is wrong. Stock produces no suggestion row at all (not a "confirmed (observed)" row), so the dependent clauses have nothing to run against until the unbind sequence is performed.
3. record-share-grant-revoke clause 6 text is wrong. It says the materialized share carries source_id = the rule name; the implementation writes the rule row id (the stable FK purgeRuleGrants relies on). Semantic intent holds, text is wrong.
4. sharing-rule-authoring-ui names the wrong object. It calls showcase_project "a private-OWD object", but it reports sharingModel:'public_read_write', so a rule on it widens nothing observable. The real private-OWD showcase objects are showcase_contact, showcase_inquiry, showcase_private_note (the runner substituted showcase_contact).
5. Runner-environment fact worth adding to the briefing. view is in the overlay-allowed set (view, dashboard, report, translation, email_template), so PUT /api/v1/meta/view/<name> works on the stock read-only showcase package with no escape hatch.

Root cause

Not code — checklist text drift under docs/qa/platform-checklist/, itemised above.

Reproduction

Read the named items under docs/qa/platform-checklist/ and compare against the run's observed behaviour recorded in #7637.

Suggested fix

Apply the five edits above: dedupe D11 across owd-sharing-matrix/rls-both-sides; correct the suggested-binding-loop knownGaps; fix record-share-grant-revoke clause 6 source_id wording; retarget sharing-rule-authoring-ui to a genuine private-OWD object; add the view-overlay-allowed fact to the briefing.

Source

Extracted from the QA run #7637 (framework 92f26f7, console 09987b680).

[claude]

Dual-label resolution (queue+finding): promoted to pm:queue (finding stripped). Five itemised text corrections under docs/qa/platform-checklist/, each naming its item and the observed contradiction (run record #7637). Mechanical doc maintenance in the devx lane; no product question inside. domain:devx stands.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[huangyiirene]

Claim: PM loop round 3 (devx seat, 2026-08-11 term) — wave 3 unit B
Session: session_01GZKbx4xyF7U5WXj6ch49BM
Branch: claude/issue-7687-sharing-checklist
Worktree: cloud session, own clone
Domain: domain:devx
File surface: the sharing/security checklist area file(s) under docs/qa/platform-checklist/ holding the five named items, plus the runner briefing doc for item 5. ⛔ Not platform-core.json / i18n / attachments / cli area files (other wave-3 units own those) and ⛔ not coverage.json (no item added/retired here; stop and report if a gate demands it)
Container & model: M (five-item authoring pass), mode:cloud, model: opus
Serial constraints cleared: wave-3 units are pairwise file-disjoint by area file; no other claim or open PR touches the sharing area (checked at claim time).

---

Generated by Claude Code

[huangyiirene]

{
 "issue": 7687,
 "status": "done",
 "branch": "claude/issue-7687-sharing-checklist",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/7717",
 "premise_still_valid": true,
 "summary": "All five itemised corrections landed; every one was premise-checked against origin/main first and all five premises held (none had already been fixed). (1) D11 dedupe: rls-both-sides c5 is now the CANONICAL non-disclosing expected-fail probe (handle-only reference, plus a negative pinning the one-count rule and the ADR-0090-D11 naming collision), owd-sharing-matrix c4 cross-references it. (2) suggested-binding-loop knownGaps rewritten: stock surfaces NO row at all, with the auto-bind-at-boot cause, the per-clause dependency split, and the unbind provisioning sequence. (3) record-share-grant-revoke c6: source_id = the sys_sharing_rule ROW ID, not the name. (4) sharing-rule-authoring-ui retargeted showcase_project -> showcase_contact with criteria stage=='qualified'. (5) RUNNER.md gains an 'Environment facts the runner should not re-derive' section carrying the view-is-overlay-allowed fact. Two things the PM should see: (a) the FOLLOW-UPS D11 handle does NOT resolve in this repo -- FOLLOW-UPS.md carries D1-D8 only and D11 lives in the maintainer's private register; the item text says so rather than implying a row exists here, and no placeholder row was added (outside the card's file surface, and it would put the handle in the public tree without a ruling). (b) One correction beyond the five, disclosed in the PR body and the item history: sharing-rule-authoring-ui c2 and step 5 carried the SAME source_id-is-the-rule-name error as edit 3, fixed in the same revision rather than left in an item being rewritten anyway. Four items bumped revision + appended history (rls-both-sides 2->3, owd-sharing-matrix 1->2, record-share-grant-revoke 1->2, suggested-binding-loop 1->2, sharing-rule-authoring-ui 1->2). coverage.json untouched; no other area file touched; docs-only so no changeset.",
 "tests": "No package tests apply (docs-only, 2 files). Gates run in the worktree, foreground: (1) `node scripts/check-platform-checklist.mjs` -- BASE reading first: `check-platform-checklist: 1 problem(s) / coverage.json - qa: UNCLASSIFIED`, the known #7347 red; BRANCH reading: the IDENTICAL single problem, no new findings, so revision/history consistency (validator-enforced: revision must equal the last history entry's revision) is green on all four touched items and no gate demanded coverage.json. (2) JSON validity: `node -e JSON.parse(...access-security.json)` -> `JSON OK`. (3) `node scripts/check-nul-bytes.mjs` -> `OK (scanned 7104 text file(s) ... no raw ASCII control bytes)`. (4) self-scan `grep -naP '[\\x00-\\x08\\x0b\\x0c\\x0e-\\x1f\\x7f]'` over both touched files -> no hits. Product-fact verification against origin/main (each written into the ledger only after being re-derived from source): project.object.ts:16 sharingModel 'public_read_write' (so the issue's premise for edit 4 holds); contact.object.ts:37 / inquiry.object.ts:30 / private-note.object.ts:27 all 'private'; sharing-rules.ts seeds four rules over showcase_project x2 / showcase_inquiry / showcase_task and NONE over showcase_contact (so the sharing-rules-widen non-overlap now holds structurally); sharing-rule-service.ts:746 purgeRuleGrants(ruleId) filters `where {source:'rule', source_id: ruleId}` with ruleId = rule.id at callers :287/:300, sys-sharing-rule.object.ts:12 documents `source_id={rule.id}`, sharing-rule.test.ts:277 asserts `s.source_id === r.id`; metadata-plugin.zod.ts allowOrgOverride:true entries are exactly view/dashboard/report/translation/email_template, pinned by protocol.org-scoped-write-refused.test.ts:536 (G5, derived-from-registry case); suggested-audience-bindings.ts:224 `if (bound) continue` with the confirmed-observed transition at :211 firing only for an already-pending row. CI gate-job conclusions at report time: in_progress (draft PR just opened; per #6644 L2 the convergence read is the PM's).",
 "open_questions": [],
 "out_of_scope_findings": [
 "not filed, PM call: FOLLOW-UPS.md section 3 still lists 'a not-auto-bound audience suggestion' as what would unblock the confirm/dismiss half of suggested-binding-loop. Run #7637 closed that half by provisioning (the unbind sequence) instead, so the line is now stale-ish. FOLLOW-UPS.md was outside this card's declared file surface, so it was left alone and the superseding fact was recorded on the item's knownGaps instead.",
 "not filed, already tracked: the audience-provisioning gap found while verifying edit 4 -- stock's ONLY showcase_contact grant is showcase_manager { allowRead: true, readScope: 'org' } (permission-sets.ts:124), whose org-depth read masks any widening, and no other stock set grants the object at all. So a showcase_contact sharing rule needs a scratch permission set + scratch position for its audience. Recorded as a fixtures.requires + knownGap + a vacuous-pass negative on the item rather than filed, since it is fixture know-how of exactly the kind the ledger exists to accumulate."
 ]
}

---

Generated by Claude Code

[huangyiirene]

ACCEPT — PR #7717. Review record: files are RUNNER.md + areas/access-security.json, inside the claimed surface. All five edits land as specified: the D11 dedupe stays non-disclosing (handle-only, one canonical home, the ADR-0090-D11 naming collision pinned as a negative — good catch), the source_id = row-id fix is source-grounded to purgeRuleGrants, the retarget to showcase_contact makes the sharing-rules-widen non-overlap structural, and the briefing fact carries its registry derivation. The disclosed sixth correction (the same source_id error inside the item already being rewritten) is the right call — same defect, same revision, disclosed not smuggled. The FOLLOW-UPS D11 handle-doesn't-resolve-here note is accepted as-is; the FOLLOW-UPS.md §3 staleness observation stays a PM note (that file is maintainer territory). Landing: flip + arm once gate jobs conclude.

---

Generated by Claude Code