QA wave R4: coverage sweep (checklist-author) — re-audit the ledger against the 727 commits since the 2026-08-08 sweep

[os-zhuang]

Part of #9296. Round 4 — runs in parallel with R0, no dependency on it.

Why

pnpm check:platform-checklist is green, but its two ratchets only catch a new metadata kind (liveness-derived coverage) and a new member of a pinned enum (enumSource freshness). Neither can see new behavior inside an existing kind — which is where 727 commits / 3992 changed files since 2026-08-11 most likely hid something. That class is exactly what the five-angle sweep exists to find (docs/qa/platform-checklist/SWEEP.md).

Ledger today: 182 active items, 15 areas, coverage 28 kinds mapped / 2 waived. By since: v15 41 · v15.1 19 · v16 108 · v17 only 14 — for a tree whose spec package is already at 17.0.0, that ratio is itself a signal worth testing.

Scope

Run the checklist-author skill and follow SWEEP.md as written — it is the method, this card is not a second copy of it. Two scoping notes specific to this round:

• Bias the five hunters toward the delta: the ledger was built by the 2026-08-08 sweep, so the highest-yield surface is what landed after it. Ground every hunter in real file paths (git log/git diff against that window is available — the clone is full-depth).
• Re-audit every waiver. In the 2026-08 sweep four of six waivers turned out factually stale. A waiver is a claim that ages; the two current ones (book, doc) each get re-checked against the runtime, not against their own prose.

Constraints

• ⛔ Do not run pnpm install. scripts/check-platform-checklist.mjs and scripts/checklist-select.mjs are zero-dependency (node:fs / node:path only) and run straight from a fresh worktree. R0 owns the one install in this container and the disk allowance is shared.
• Worktree-first, per CLAUDE.md — your own tree, branch claude/issue-<n>-<slug>.
• Deliverable: areas/*.json additions/revisions + a reconciled coverage.json, validator green (node scripts/check-platform-checklist.mjs), plus FOLLOW-UPS.md entries for product defects and docs drift found while grounding. Every new item obeys the deep-test contract in README.md: a fixture that does not exist is blocked/knownGaps, never faked coverage.
• Security-sensitive findings are NOT filed publicly — they go to the maintainer through the PM.
• Draft PR, do not merge, do not enable auto-merge. If the Check Changeset gate demands a changeset for a docs-only diff, use the repo's real skip-changeset mechanism rather than inventing one.

Fold in while you are in this file (two known defects in the ledger's own prose)

1. SWEEP.md L9–10 states check-platform-checklist.mjs runs in "CI, every PR". It does not, by maintainer decision — see this dir's README.md "Operating cadence" and the recorded note at .github/workflows/lint.yml:426. Measured cost, for the record while you correct the text: the validator is ~80 ms, and the full pnpm check:platform-checklist (selector self-test + validator) is 0.165 s — so the sentence is wrong about the fact, not about the cost. Fix the fact; ⛔ do not change the CI posture, that is a maintainer decision.
2. Anything else in README.md/SWEEP.md/RUNNER.md your grounding proves stale gets corrected in the same PR, each with a one-line rationale.

[os-zhuang]

Claim: PM loop round 1 (QA wave #9296)
Session: session_01Ai9gUdihXjg7FumzsBNSSs
Branch: claude/issue-9299-checklist-coverage-sweep
Worktree: objectstack-issue-9299
Domain: domain:devx
File surface: docs/qa/platform-checklist/** (areas/*.json, coverage.json, README.md, RUNNER.md, SWEEP.md, FOLLOW-UPS.md). Stop on breach and explain in the report — in particular, ⛔ no scripts/ changes and ⛔ no CI/workflow changes on this card.
Container & model: M, mode:subagent, model: opus — not a mandatory-fable card: the diff touches the QA ledger, not packages/spec contract behavior and not .claude/skills/pm-dispatch/**.
Serial constraints cleared: no other in-flight card touches docs/qa/platform-checklist/**. Disjoint from #9298 by construction (that card writes only git-ignored build output and /tmp).

Routing authority: maintainer direct-dispatch channel — 「按照你的建议执行」 (2026-08-17), authorizing the five-round orchestration proposed in-session and recorded on #9296.

---

Generated by Claude Code

[os-zhuang]

{
 "issue": 9299,
 "status": "done",
 "branch": "claude/issue-9299-checklist-coverage-sweep",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/9309",
 "premise_still_valid": true,
 "summary": "Re-audited the ledger against the window since the 2026-08-08 sweep. Ledger 182 -> 190 items; coverage 28 mapped/2 waived -> 30 mapped/0 waived. BOTH surviving waivers (book, doc) were factually stale: they claimed 'display-only, no runtime behavior to gate beyond serving', but the REST read layer runs a three-member audience vocabulary with an ADR-0049 fail-closed branch, a two-layer gate (book audience then per-entry doc-audience union), a deliberate orphan-group non-leak rule, and locale resolution — an access-control surface. Retired both; running total is now 6 of 6 waivers ever written turned out stale. Authored 8 items, two carrying enumSource-pinned matrices (ACCEPTED_FILTER_COMPARAND_TYPES=6, DATE_RANGE_PRESETS=13). Corrected the SWEEP.md 'CI, every PR' fact without touching the CI posture. DEVIATION from the skill's orchestration contract: no Task/subagent tool exists in this session, so the five hunter angles and the per-area writers were run by me sequentially rather than as a parallel fleet; the method (ground every claim in a real file path before asserting, dedupe across angles, reconcile coverage centrally) was followed as written.",
 "tests": "Gate union run AFTER the final commit, at ef2480b48 (git rev-parse --short HEAD), tree clean. `node scripts/checklist-select.mjs --self-test` -> '✓ checklist-select self-test: 17 cases pass.' `node scripts/check-platform-checklist.mjs` -> 'check-platform-checklist: OK — 15 areas, 190 items (190 active); coverage: 30 kinds mapped, 0 waived.' (baseline before edits: 'OK — 15 areas, 182 items (182 active); coverage: 28 kinds mapped, 2 waived.'). `node scripts/check-nul-bytes.mjs` -> 'OK (scanned 6067 text file(s) ... no raw ASCII control bytes)'. All 8 new ids resolve through checklist-select.mjs, including the two new since: values (since:v14.1 -> 1 item, since:v14.7 -> 1 item); since:v17 goes 14 -> 20. enumSource counts were not eyeballed — I re-ran the validator's own extractEnumMembers against each candidate, which is how SCALAR_FILTER_HEAD_TYPES was rejected as unpinnable (it is a new Set([...]), read as 0 members, so a pin would have been a permanently vacuous green). No pnpm install was run, per the ruling. `node scripts/pm/dispatch-gates.mjs` on the changed paths places zero gate families (docs-only surface).",
 "open_questions": [
 {
 "question": "The blank scaffold's own `dev` script is `objectstack dev` with no `--ui`, but quick-start.mdx tells a newcomer to run `npx os dev --ui` and open /_console/, and --ui is documented in the CLI as the flag that enables that portal. A newcomer who runs `npm run dev` (the script the scaffold hands them) gets no console. Which side is wrong?",
 "options": [
 "A — add --ui to the blank template's dev script, so the scaffold's own script matches what the docs promise",
 "B — change quick-start.mdx to tell newcomers to run `npm run dev -- --ui` (or to pass the flag explicitly), leaving the template alone",
 "C — leave both; treat the console as opt-in and document that explicitly at the point the docs mention /_console/"
 ],
 "recommendation": "A, because the failure lands on the very first project of a brand-new developer and the docs' own verification step ('create a record, watch an action show/hide') is unreachable without it. But this is a product decision on the newcomer default, not an agent's call — I recorded it in FOLLOW-UPS.md E1 and captured it as an expected-divergence probe on cli.scaffold-console-first-paint rather than asserting a defect I did not boot."
 },
 {
 "question": "The cost figures supplied with the card did not reproduce here: I measured the validator at ~0.12-0.18 s (card: ~80 ms) and `pnpm check:platform-checklist` at ~2.9 s wall (card: 0.165 s). The container was under load from the parallel cold install, and pnpm's own startup dominates the wall figure. What should the runbook record?",
 "options": [
 "A — record the direct-node cost (~0.25 s for self-test + validator) and warn that timing through pnpm measures the wrapper (what I did)",
 "B — record the card's supplied figures verbatim",
 "C — record no number at all, just 'sub-second, zero-dependency, token-free'"
 ],
 "recommendation": "A, because SWEEP.md is being corrected in this very PR for carrying a stale factual claim, so baking in a precise ms figure measured on one loaded container would plant the next one. The corrected text keeps the maintainer's point intact — cost is not why it stays out of CI, PR independence is — while stating a number that survives a different machine."
 }
 ],
 "out_of_scope_findings": [
 "NOT filed as issues — routed to FOLLOW-UPS.md §5 per the card's explicit instruction ('Product defects and docs drift found while grounding -> FOLLOW-UPS.md'). E1: the blank template's dev script omits --ui while quick-start.mdx sends newcomers to /_console/ (see open_questions).",
 "E2 (docs drift, outside this card's file surface so reported not edited): packages/spec/liveness/doc.json's _note records 'DocSchema declares no tags ... the tag rule can currently never match'. That defect is FIXED — DocSchema declares tags now (packages/spec/src/system/doc.zod.ts:126, with the history in the surrounding comment). The ledger note describes a bug that no longer exists — the same stale-claim class this PR is correcting in SWEEP.md.",
 "Checked and CLEAN, recorded in FOLLOW-UPS.md §5b so the next sweep need not re-derive it: no published doc prescribes a retired scaffolder template (zero hits across content/docs/ for todo/compliance/content/contracts/procurement as -t operands; every documented invocation is a bare `npx create-objectstack my-app` resolving to blank, the only TEMPLATES entry), and `npm run validate` is the same binary as `npx os validate`. No duplicates of cli.scaffold-first-run or studio-authoring.first-run-loop were authored.",
 "No security-sensitive finding to withhold. The two P0 items authored assert guards that are already shipped and already public in their ADRs/issues; nothing here discloses an unfixed hole."
 ]
}

Refinement to the card's PM hypotheses, from evidence rather than framing:

• The blind-spot hypothesis held. The window added 156 non-test source files and
  zero new metadata kinds. Every finding is new behavior inside an already-mapped
  kind — invisible to the coverage ratchet (no new kind) and to the enumSource ratchet
  (no new enum member). None of it could have been caught by check:platform-checklist
  however often it ran; that is now stated explicitly in SWEEP.md.
• The v17 under-authoring hypothesis held but was incomplete. since:v17 goes 14 →
  20 here, so the ratio was a real signal. But two of the eight items cover capabilities
  that predate the ledger's own baseline (since: v14.1 — the docs audience gate, landed
  at spec 14.1.0 in feat(security)!: enforce book audience at the REST read layer; finish the ADR-0090 D2/D3 cleanup the P1 wave missed #2774; since: v14.7 — the os migrate meta codemod). Those were
  never authored at all, so the gap is not only recency: it is also long-standing surface
  that no previous angle enumerated.

---

Generated by Claude Code

[os-zhuang]

ACCEPT — PR #9309 at d23a746c7, after one patch round. Reviewer of record: PM loop round 1 (QA wave #9296), session session_01Ai9gUdihXjg7FumzsBNSSs.

Verified against origin/main and the PR branch directly, not against the report:

check	reading
file surface	8 files, all under docs/qa/platform-checklist/; git diff --name-only origin/main..FETCH_HEAD grep-inverted for the prefix returns empty
first line	Fixes #9299 — correct, the card is fully delivered, nothing left open
coverage.json diff	book and doc waivers replaced by items: [platform-core.docs-audience-gate]; no other kind touched
validator	OK — 15 areas, 190 items (190 active); coverage: 30 kinds mapped, 0 waived (baseline 182/28/2)
CI at d23a746c7	all completed jobs success or skipped, zero failures; ESLint + TypeScript still converging at review time
changeset	Check Changeset skipped by path filter — the docs-only diff never reached the gate

The patch round, and why it was worth one

The sweep's E1 claimed the blank template's bare "dev": "objectstack dev" strands a newcomer without a console, since quick-start sends them to /_console/. Source-checking refuted it: serve.ts:221 declares ui with default: true, allowNo: true; dev.ts:370 forwards --ui add-only and never forwards --no-ui; cli.mdx:139 states the console is "already on by default in dev". The bare script is correct and --ui on dev is a no-op forwarder.

The rework did better than deleting the claim. cli.scaffold-console-first-paint clause 3 now asserts the two invocations agree, and its negatives name the exact regressions that would break the newcomer path — a future ui default of false on dev, or --no-ui getting forwarded. The false finding became a pin on the behavior that refuted it. A future edit to that chain now fails an item instead of silently stranding first-run users, and the history entry records the refutation so no later sweep re-derives it.

Keeping revision: 1 was right: the item has never been published or run, so no run record pins revision 1, and a phantom revision 2 would imply a semantic change to something that shipped.

Spot-checks that carried weight

• Both waiver retirements hold. book/doc claimed "no independent runtime behavior to gate beyond serving"; the REST read layer runs a three-member audience vocabulary with an ADR-0049 fail-closed branch, a two-layer gate (book audience, then per-entry doc-audience union), and a deliberate orphan-group non-leak rule. That is an access-control surface. Running total: 6 of 6 waivers ever written aged into falsehood — the strongest available argument for re-auditing every waiver against the runtime rather than its own prose.
• Rejecting the SCALAR_FILTER_HEAD_TYPES pin was the right call. It is a new Set([...]), which the validator's extractor reads as zero members — the pin would have been a permanently vacuous green. Verifying candidates by re-running the extractor instead of counting by eye is the standard to keep.

Declared deviation, accepted with its cost stated

The runner reported no Task/subagent tool in its session, so the five SWEEP angles and the per-area writers ran sequentially by one reader rather than as a parallel fleet. The method was followed — every claim grounded in a real file path, cross-angle dedupe, central coverage reconciliation — and the eight items stand on their own evidence. But SWEEP.md's premise is that different angles catch different miss classes because the readers are independent, so what is weakened is not the findings, it is the "nothing else was missed" conclusion. Recorded here rather than waved through; a narrow re-sweep with genuinely parallel hunters is a separate call.

One correction the sweep earned against my own dispatch

I framed the gap as recency. Evidence says otherwise: two of the eight items cover capabilities predating the ledger's own baseline (since: v14.1, v14.7) that were simply never authored. Under-authoring of v17 is real (since:v17 14 → 20), but recency was not the whole story — the runner corrected the PM here and is right.

Landing: flipping to ready and enqueuing once ESLint and TypeScript report success. This is not an ADR/skills path, so it lands through the lane rather than waiting for a human merge.

---

Generated by Claude Code