QA run · platform-core (4/13 items consulted) · e4e5c6e3 · 2026-08-17 · 1 PASS / 3 PARTIAL / 0 FAIL / 9 NOT-RUN

[os-zhuang]

R3 runner, area 3 of 4. Part of the #9296 wave. No clause failed. Nine items were not reached and are recorded not-run rather than inferred.

⚠️ Title deviates from the wave's (FULL area) convention on purpose — 4 of 13 items consulted.

Environment fingerprint

Same tree as #9330 / #9332: framework e4e5c6e3c608b1b807c83a0d5b734f213eb1a1dd · .objectui-sha 665661ab093263f39f2e660a295ea615dbcee35a · console dist stamp equals pin (check:console-sha ✓) · port 3301 · file:/tmp/qa-r3b/access-security-rls-both-sides.db · --seed-admin · 2026-08-17. Driving used http://localhost:<port>.

Spec provenance: checklist from PR #9309 head fbd1c049 (open, held pending the maintainer), not merged main. Validator (pinned): 190 items (190 active); 30 kinds mapped, 0 waived. Selector area:platform-core → 13 runnable, 0 blocked.

Per-clause verdicts

platform-core.boot-health — rev 2, P0, mixed → pass

clause	verdict	oracle evidence (text)
A0 /api/v1/health 200 in the boot window	pass	200; on the smoke boot health went green 2.2s after launch
A1 /api/v1/ready 200 (readiness, not just liveness)	pass	200 {"success":true,"data":{"status":"ready","state":"running"}}
A2 no ⚠ in the Flows banner, no ERROR lines	pass	banner: Flows: 29 flow(s) 22 bound to triggers (record_change, schedule, time_relative, api) · 7 draft — no ⚠. See the ERROR-line ruling-out below.
A3 console served + merged app metadata resolves	pass	GET /_console/ → 200 text/html; GET /api/v1/meta/app?id=showcase_app → 200, item carries navigation, _provenance, _diagnostics: {valid:true}
A4 served nav matches the authored app	pass	17 objectName entries served vs 17 authored in src/ui/apps/index.ts — same multiset, 13 unique objects, showcase_task ×5 on both sides. Nothing dropped at merge.
N0 no SeedLoader rejection lines	pass	banner: Seeds: com.example.showcase 130 rows; zero reject/fail/error seed lines in the boot log
N1 health 200 with ERROR lines is not a clean boot	pass	see below

A2 / N1 — the one ERROR line was self-inflicted, and is not recorded as a defect. The boot log carries exactly one ERROR:

ERROR [Better Auth]: Invalid origin: http://127.0.0.1:3301

That is my own driver. My first probes addressed the server as 127.0.0.1, which better-auth rejects as an untrusted origin (403 INVALID_ORIGIN); I switched to localhost and every subsequent call succeeded. This is the RUNNER rule 2 automation self-check catching a fake finding: recorded as a driving artifact, not a boot-log failure. The clean-boot clause passes on the server's own behaviour.

Worth surfacing (not a failure of this item): boot diagnostics report 3 warnings, one of which is substantive — #8686, a seed/API tenancy split on showcase_field_zoo.f_autonumber:

"The install reports tenancy posture 'single' but holds 0 rows in sys_organization … Until this is resolved these objects run two autonumber counters and can mint the same "unique" identifier twice." (globalLastValue: 2, organizationLastValue: 0, organizationCount: 0)

A2 gates on ERROR-level lines and the Flows banner, so this WARN does not fail the clause, and #8686 already exists. Flagging it because "can mint the same unique identifier twice" is the kind of warning that reads as noise until it isn't.

platform-core.seed-integrity — rev 1, P0, api → partial

clause	verdict	oracle evidence (text)
A2 boot log reports every seed load as success	pass	Seeds: com.example.showcase 130 rows; grep for seed lines matching reject/fail/error/skip returned nothing — the #3415 silent-rejection class is absent at this sha
A0 per-object counts equal the authored seed	not-run	the expected-vs-actual count table was not built
A1 seed values land verbatim (Specimen — Full spot-diff)	not-run
A3 replay idempotence across restart	not-run
A4 deliberately-unseeded fields stay unseeded	not-run
N0 zero rows on a nav-visible object	not reached	depends on A0

The seed-data-thin trap is partially bounded from the other direction: objectstack verify (see #9330) exercised 23 showcase objects with needsFixture: 1 and createFailed: 0, so the corpus is not empty — but that is not the authored-count diff A0 asks for, so A0 stays not-run.

platform-core.metadata-registry-serving — rev 2, P1, api → partial

Pin meta-types-create-seed.dogfood.test.ts — 6/6 passed:

• "carries the dashboard create seed (widgets: [])"
• "carries the action create seed with a valid executable body"
• "omits a seed for report (a canvas-create type whose dataset is picked interactively)"
• "every seeded type that is also a registered /meta/types entry exposes its exact seed"
• "answers the same body as GET /meta — the two paths are one handler"
• "is not the /meta/:type catch-all wearing a 200"

That last one directly discharges the item's dispatcher-vs-hono-route trap. Of 7 acceptance clauses the pin covers the registry/seed-serving surface; the remainder was not separately driven, so partial rather than pass.

platform-core.metadata-authoring-roundtrip — rev 2, P1, mixed → partial

Pin package-first-authoring.dogfood.test.ts — 5/5 passed, covering the framework half including both sides of the writable-package gate:

• "saveMetaItem(runtime-only) into a loaded code package throws writable_package_required" — the refusal
• "the same create into a fresh writable base id is NOT rejected (control)" — the entitled contrast
• "create → bind → publish → editable → discoverable → delete-cascade"
• "reassignOrphanedMetadata rebinds a legacy package-less row onto a base"
• "clones ACTIVE items into a new base, re-namespacing names AND rewriting references"

The item's automated.ref also names two objectui e2e specs (studio-record-page, studio-object-designer); those were not run, so the console half is unproven → partial.

Not-run (9)

No oracle consulted, not inferred: console-login (P0, browser) · nav-surfaces-render (P0, browser) · builtin-apps-nav-render (P0, browser) · settings-hub-roundtrip (P1, 13 acceptance clauses) · package-lifecycle-enable-disable (P1) · notification-center (P1) · shell-nav-personalization (P2, browser) · app-management-toggle (P2) · docs-audience-gate (P1 — new in the R4 sweep, never run).

docs-audience-gate deserves a note for whoever takes it: its knownGaps warn that stock showcase is not known to author a public or {permissionSet}-gated book, and that the org default "is the one audience every authenticated caller passes and therefore proves nothing about the gate". So step s0 (GET /meta/book, read each audience) must run first and decide how much of the item is blocked(fixture). Its A2 also has an unusual shape worth honouring: if packages/spec/src/system/book.zod.ts has no case pinning permissionSets: undefined → false, that absence is itself the finding.

nav-surfaces-render's automated.ref is a Playwright spec (examples/app-showcase/e2e/showcase-smoke.spec.ts), a different runner from the vitest pins used here. Chromium and Playwright 1.62.1 are present in this environment (/opt/pw-browsers, resolvable via the .pnpm path), so it is runnable — just not reached.

Coverage honesty

4 of 13 items consulted; no clause failed; 1 pass, 3 partial, 9 not-run. All four P0 browser items (console-login, nav-surfaces-render, builtin-apps-nav-render) are among the unreached — this area's remaining risk is concentrated there, and the console dist is built and stamped-correct, so there is no standing prerequisite blocking them.

Every verdict here rests on server truth (api, build/log, test). No DOM oracle was used; the one screenshot-class question (does /_console/ actually render) was answered by HTTP status + content-type + shell markup, not by a picture.

Links: #9296 (wave) · #9330 (area 1) · #9332 (area 2) · #9309 (spec provenance) · #8686 (autonumber tenancy split, pre-existing).

[os-zhuang]

Close-out — superseded, nothing carried forward. Wave #9296, executed under #9480. This re-judges nothing.

Supersede check, per item. All four items consulted were re-covered:

• boot-health (P0, mixed) — re-run by Tier-2B QA run · tier2b:browser-1 (21/21) · e4e5c6e3 · 2026-08-18 · 7 PASS / 12 PARTIAL / 2 FAIL #9453, pass; also pass in QA run · priority:P0 · e4e5c6e3 · 2026-08-17 · 7 PASS / 7 PARTIAL / 2 FAIL / 2 BLOCKED #9334. The ERROR line this record correctly attributed to its own 127.0.0.1 driver stayed attributed there.
• seed-integrity (P0, api) — re-run by Tier-2A QA run · tier2a:api-cli-build (23/23) · e4e5c6e3 · 2026-08-17 · 15 PASS / 6 PARTIAL / 1 FAIL #9417, pass 5/5, with the per-object count table this record had to leave not-run (A0/A1/A3/A4) driven in full, counts re-derived from the app's own built seed rather than the item's prose baseline.
• metadata-registry-serving (P1, pinned) — Tier-1 QA run · tier1:automated-pins (77 items) · e4e5c6e3 · 2026-08-17 · 35 PASS / 39 PARTIAL / 0 FAIL #9401, partial, same 6/6 pin.
• metadata-authoring-roundtrip (P1, pinned) — Tier-1 QA run · tier1:automated-pins (77 items) · e4e5c6e3 · 2026-08-17 · 35 PASS / 39 PARTIAL / 0 FAIL #9401, partial; its studio-record-page objectui ref is ledger-stale, and Tier-1 reproduced exactly the documented staleness rather than scoring it a fail.

Nothing in this record is P2-unpinned, so no verdict falls outside tier coverage.

No clause failed, so nothing is owed to the four-way FAIL disposition. The #8686 autonumber tenancy WARN surfaced here is already filed and is not a verdict of this run; #9334 adds the boot-ordering reading that the "0 rows in sys_organization" it reports is measured 3 s before the default org row is created.

Superseded-by: #9401 #9417 #9453
Carried-forward: (none — every consulted item was re-derived by a tier run)
Parked-on: #9296

---

Generated by Claude Code