tracking: full platform-checklist regression against main @ e4e5c6e3 — five-round orchestration

[os-zhuang]

⛔ READ THIS FIRST — corrected rule for access-control findings (supersedes every dispatch prompt)

If you find an authentication or authorization hole, do NOT write the reproduction anywhere on GitHub — not in your qa-run issue, and NOT in a comment on this card.

Earlier dispatch prompts told runners to withhold such a reproduction from the run issue and post it "here for the maintainer instead". That instruction was wrong and is withdrawn. This card is a public issue in a public repository; "not the run issue" is not the same as "not public", and a runner followed it in good faith before anyone caught the mistake.

Instead: record the clause fail in your run issue as "access-control finding — detail withheld pending maintainer; held by the runner", naming item and clause and nothing more; post a one-line comment here saying the same; hold the reproduction in your session. A finding whose existence is public but whose recipe is not is still a complete, actionable report.

⚠️ Inherited facts are briefing material, not verdicts

The list below exists to stop rounds re-deriving what earlier rounds measured. It is not exempt from evidence. One entry in it was wrong and cost nothing only because a runner checked anyway instead of obeying it. If your own measurement contradicts an entry here, follow your evidence and say so in your run record — correcting this card is a better outcome than a verdict that inherits a mistake.

---

Coordination card for a complete run of the platform test checklist against main. Filed on the maintainer direct-dispatch channel (authorization: 「按照你的建议执行」, 2026-08-17).

Delegation

Owning session session_01Ai9gUdihXjg7FumzsBNSSs (PM seat). Declared territory: no repo-tree file surface — rounds write only to /tmp/qa-wave/**, git-ignored build output in the objectstack-qa-wave worktree, and GitHub issues. Other PMs: skip this subtree when gathering candidates (pm:epic).

Baseline pin

• Subject sha under test: e4e5c6e3c608b1b807c83a0d5b734f213eb1a1dd — it does not move, whatever main does.
• objectui pin 665661ab093263f39f2e660a295ea615dbcee35a; QA tree objectstack-qa-wave, console dist built and stamped to it.
• Spec advances, subject does not: git checkout origin/main -- docs/qa/platform-checklist/. main moves during a wave — one round caught an item mid-flight at a stale revision — so re-sync at the start of every round and pin each item's revision.

Ledger

190 items, 15 areas, 18 P0, 30 kinds mapped, 0 waived (post-R4, #9309).

Rounds

round	scope	status
R0 (#9298)	machine lane: tree, repo gates, console build	✅ repo green — 135/135 tasks, 43,531 tests, 0 failed suites
R4 (#9299 / PR #9309)	checklist-author coverage sweep	✅ landed — 182→190 items, both stale waivers retired
R1 (#9334)	priority:P0, 18 items	✅ 7 PASS / 7 PARTIAL / 2 FAIL / 2 BLOCKED
R3 cloud ×3	15 areas	⚠️ abandoned at ~27% — cold containers, see the cost note below
Tier-1 (#9401)	all 77 automated.ref items	✅ 35 PASS / 39 PARTIAL / 0 FAIL / 3 BLOCKED
Tier-2A (#9417)	23 unpinned P0/P1 api·cli·build	✅ 23/23 — 15 PASS / 6 PARTIAL / 1 FAIL / 1 BLOCKED
Tier-2B (#9453)	21 unpinned P0/P1 browser·mixed	✅ 21/21 — 7 PASS / 12 PARTIAL / 2 FAIL
Tier-2C	final 18 unpinned P0/P1 browser·mixed	🔄 running
Tier-3	47 unpinned P2	deferred by decision

Cost note, measured: three cold cloud containers burned ~72M cache-read tokens between them and left ⅔ of their areas unrun; the warm local tree finished every round it was given. The expensive thing is a cold environment, not a checklist item. One provisioned tree, reused.

Standing rules for every round

• One selector = one run = one qa-run issue. Labels qa-run + tests only — no bug (run records carry no work labels; defects extract into their own cards, which is the PM's close-out duty) and no tracking (the sweep now excludes qa-run records by name, docs(qa,pm): qa-run joins the sweep exclusion list; run records owe defect extraction at close-out #9366).
• Done = every item in scope has a verdict. Cannot finish → file what you have plus a handoff list naming the unreached items, consulted fraction in the title. ⛔ Never title a partial round (FULL …).
• Clause-grained verdicts; item verdict derived. Half-proved is partial with the unproven clauses named — that gap list is worth more than the PASS column. No evidence → not-run, never pass.
• Oracle hierarchy: server truth > screenshot > DOM. Screenshot before DOM — post-navigation dumps return transitional emptiness and are the top source of fake "feature missing" findings.
• A fail costs two reproductions, the automation self-check, and ruling out the item's listed traps. P0 fails get a second independent re-derivation.
• Both sides of every gate: entitled persona sees it, unentitled one is refused by the server.
• Nothing lands in the repo. Text only — never attach or link screenshots.
• Console/Studio UI defects belong to objectstack-ai/objectui, after ruling out a stale vendored bundle.

Facts earlier rounds paid for (see the ⚠️ block above before inheriting one)

1. objectstack verify --rls is a separate invocation. Bare verify emits no RLS section at all; citing it as an RLS oracle means the oracle was never consulted.
2. Playwright needs executablePath=/opt/pw-browsers/chromium-1194/chrome-linux/chrome — 1.62.1 wants build 1234, only 1194 is installed; the stock config reports 31 spurious failures without it.
3. ?id= on /api/v1/meta/app keys on the app NAME, not the package id (showcase_app / setup / account). A package id returns {"items":[]} — reads exactly like missing metadata.
4. ss is blind to sockets in these containers — it returns empty for a port that is serving. Liveness is curl … /api/v1/health.
5. The console authenticates by bearer token in localStorage (auth-session-token), not by cookie. A clearCookies() gesture expires nothing and leaves a fully authed shell rendering — an artifact that nearly produced a fake P0. True expiry is POST /auth/sign-out, which behaves correctly.
6. access-security.no-active-org-session-semantics (P0) is unrunnable on stock: the deployment is tenancy: single so ADR-0095 Layer 0 is inert and every clause is vacuous, and booting OS_TENANCY_POSTURE=isolated is correctly refused because @objectstack/organizations is not declared. Three rounds have now confirmed it; the item still lacks a ledger blocked marker, which is why a fourth would re-derive it.
7. The objectui pins are runnable with zero installs — .cache/objectui-665661ab0932 in the QA tree is a checkout at the exact .objectui-sha pin with node_modules present. The sibling /home/user/objectui is at a different sha and has none.
8. studio-authoring.first-run-loop is unscoreable because Studio is not installed. WRONG — corrected 2026-08-18 by the Tier-2B round (QA run · tier2b:browser-1 (21/21) · e4e5c6e3 · 2026-08-18 · 7 PASS / 12 PARTIAL / 2 FAIL #9453). The Studio app registration is absent from the admin's app list, but the App Builder UI is reachable at /_console/studio, and the full first-run loop closes end to end: 6/6 clauses pass, zero restarts. The PM propagated this from an earlier round's inference and instructed Tier-2B to record blocked and move on; the runner checked anyway and scored it pass. Left visible rather than deleted — a struck-through wrong fact teaches the ⚠️ rule above; a deleted one teaches nothing.