docs(qa): correct the checklist and close the fixture gaps the 17.1.0 sweep found

[os-elon]

Fixes#10236

Checklist-accuracy and fixture work from the 17.1.0 post-release QA sweep. No product defect is involved — every change is to the QA ledger (docs/qa/platform-checklist/areas/*.json) and its runner protocol (RUNNER.md). No packages/spec/src/** change; no contract's accept/reject behaviour moves; no public surface widens.

Every item edit is revise + revision bump + a history entry, per the README lifecycle. No row was deleted.

Premises verified before building — three changed the fix

The card is a set of findings, so each was re-derived rather than trusted. Three did not survive contact with the source, and in each case the corrected reading produced a better fix than the one requested.

1. The 422 FLOW_NO_START_NODE arm is not a knownGap — it is authorable. The card expected to waive it for want of a no-start-node flow on showcase. FlowSchema declares nodes: z.array(FlowNodeSchema) with no .min(1) and no refinement requiring a start member (packages/spec/src/automation/flow.zod.ts:658), and nothing refuses a start-less flow at publish — the refusal happens at dispatch, in the engine (service-automation/src/engine.ts:3212-3220). So the row is reachable through a scratch package exactly as qa-scratch-authz authors objects, and it became a provisioned clause instead of a waiver.

2. The connector fetch failed is a boot misconfiguration, not a network-restricted runner. The card recorded connector_action(showcase_status_api.request) failed: fetch failed on every record-change firing and proposed a declared stub or blocked(environment). The showcase's declarative connectors dial the server itself via resolveShowcaseSelfUrl() (examples/app-showcase/src/system/self-url.ts), which reads SHOWCASE_SELF_URL → OS_PORT → PORT → the literal http://127.0.0.1:3000from the environment. The CLI's -p flag only takes its default fromOS_PORT (cli/src/commands/serve.ts:220) and nothing writes it back — confirmed by grep: no code path assigns process.env.OS_PORT. So the dogfood §0 isolated boot (-p PORT, env untouched) listens on that port while every connector dials 3000. That module's own header records this failure class and warns it is indistinguishable from a sandbox egress block — #7516 burned a run proving it was an address problem with a TCP forwarder. Recording it as blocked, or building a stub, would have waived a clause that runs fine with OS_PORT exported.

3. The contributor-bound member was never missing. The card called it "the one persona gap that is real". It is provisionable on stock fixtures today — a sign-up plus one sys_user_position row — and run #7629 already drove search.rls-both-personas to 4/4 PASS on exactly that persona. What was missing was a replayable recipe: the sequence existed only as prose on one item, so the 17.1.0 runner reached for the seeded demo personas instead and recorded blocked(fixture). Both measurements the card reports are mechanically explained by the permission sets: Mei holds no position, so showcase_contributor never merges and the object gate answers PERMISSION_DENIED (no rows at all); Ada holds auditor → showcase_auditor, which carries showcase_invoice: { allowRead: true, viewAllRecords: true } — VAMA bypasses record scope, so she sees all 12. Neither is a subset; a contributor-bound member is, via invoice_own_rows (owner == current_user.email).

B2's premise held, and is stronger than stated. The card asked whether Studio's absence is a product choice by the showcase or an oversight, and to report a fork if the latter. It is neither: no stock boot registers Studio at all, by design at the platform layer. Both boot paths carry the identical note — @objectstack/studio is intentionally NOT default-loaded because "the console ships a dedicated Studio surface at /_console/studio/{pkg}/{pillar}, so Studio no longer needs to exist as a navigable app tile" (plugin-dev/src/dev-plugin.ts:620, cli/src/commands/serve.ts:2302; both register only @objectstack/setup and @objectstack/account, and cli/src/adr-0048-app-split.test.ts:14 states the same). So the ruling was applied — reword to the apps a stock boot registers, carve-out into fixtures.knownGaps — and Studio was not installed.

A3's measurement re-derived, and it is stronger than the card's. The card said a REST 200 proves nothing because JSON parsing rounds 2**53 + 1. True, and there are two independent reasons, the second decisive: the literal 9007199254740993 parses to 9007199254740992, which isFILTER_COMPARAND_BIGINT_EXACT_LIMIT and so is inside the inclusive <= bound; and the refusal arm is guarded by typeof value === 'bigint', which JSON.parse never produces at any magnitude. The door is in-process by construction, so the fix is both halves — name the engine door in verifyand mark the clause door-specific.

A2's stale count explained rather than swapped.client-brief.object.ts was added to the showcase between the two sweep subjects, which is the 15 verified → 16 verified move. The --rls figure is not stale but not comparable: formatRlsReport emits a per-persona line and an all personas total whose unit the source stamps into the line — [unit: one object × persona probe]. RUNNER.md was quoting the per-persona line against a total.

What changed

A1 — new item automation.trigger-status-contract (P1, api). The area asserted flow behaviour but never the status a caller observes, so reverting any of 17.1.0's three BREAKING status changes left it fully green. The 14-variant matrix is derived from the three changesets' own tables, then reconciled against the single runtime definition in packages/runtime/src/flow-dispatch-status.ts — which is wider than the changesets: the same table is read by /actions, the MCP run_action bridge and declared endpoints, and it carries a sixth non-terminal row (PAUSED, #9510) the changesets do not tabulate. Clauses cover both trigger routes, all seven resume arms, the cross-door single-mapper property, and the SDK's reject-on-non-2xx half. Ships with the area recipe qa-flow-status-doors for the two rows stock fixtures cannot reach.

A2 — RUNNER.md. Corrected both environment facts, plus the ?id= bullet, which named studio as a real stock name.

A3 — api-backend.filter-comparand-conformance clause 2 → oracle: test, pointed at engine-comparand-type-door.test.ts and the five driver conformance suites, marked door-specific, with the REST verdict recorded as not-applicable rather than blocked.

A4 — platform-core.builtin-apps-nav-render clause 4 reworded for whole-app refusal. The member cannot obtain the setup app at all (200 {"items":[]}), so there is no member-side Setup nav to diff. The clause now also names the account app as an explicit non-substitute: every one of its entries is gated by requiresObject/requiresService (presence gates), so admin and member navs are identical (7 vs 7) by construction — scoring the gate off that comparison is a false pass.

A5 — five per-item notes. Chart synonyms (identical tiles are the expected observation, with an explicit exemption from the wrong-family negative); connector self-URL (above); boot-health clause 2 scoped to the boot window, because a caller-error refusal logs at ERROR with a full stack before answering 4xx; the demo personas named on error-envelope-ledger; and the objectui-pinned items — measured at 23, not the 15 the card estimated (items whose automated.ref names objectui exclusively; five more mix objectui with a framework pin and are partly runnable here). The protocol lives once in RUNNER.md, with a one-line pointer on each of the 23.

B1 — area recipe qa-contributor-bound-member in areas/search.json, referenced by search.rls-both-personas via provisioning.use. Its step 4 is a premise guard that distinguishes all three outcomes — 403 = the binding did not take, 12 rows = a VAMA set, 0 of 12 = correct — so mis-provisioning is caught before any verdict rests on it. records-forms.crud-roundtrip clause 7 now names showcase_invoice + INV-1003 (it cannot be scored on showcase_account, which is public_read_write) and states the 404-vs-403 discriminator the sweep tripped on.

B2/B3 — as described above.

Deviations from the dispatch

• The 422 arm is a clause, not a knownGap (premise 1). PM asked for exactly this check.
• The connector fix is a runner-protocol note, not a stub or blocked(environment) (premise 2).
• B1 is a promoted-and-hardened recipe, not a newly-invented one (premise 3). Route 8's shape was followed; the why records that nothing was missing from the fixtures.
• Cross-area recipe reference.records-forms.crud-roundtrip needs search.json's recipe, but provisioning.use is area-scoped, so it cross-references by name in knownGaps with an explicit "do not fork a second copy". Filed as finding: the checklist's area-scoped fixtures recipe convention has hit its stated revisit trigger — 3 areas, and a consumer that cannot reference the recipe it needs #10593 — this trips the revisit condition the README states for docs(qa-checklist): attachments-storage maintenance — totalSize step fix, ADR-0104 D3 receipt clause, and the scratch authz fixture landed permanently #7716's deferred option C.
• A5's objectui set is 23, not 15. Annotating only 15 would have left the same rediscovery cost on the rest.

Gates

Run at b6471387e (the final commit; tree clean), after merging origin/main:

gate	result
node scripts/checklist-select.mjs --self-test	✓ checklist-select self-test: 17 cases pass.
node scripts/check-platform-checklist.mjs	check-platform-checklist: OK — 15 areas, 205 items (205 active); coverage: 30 kinds mapped, 0 waived.
node scripts/check-nul-bytes.mjs	check-nul-bytes: OK (scanned 6187 text file(s) ... no raw ASCII control bytes).
node scripts/pm/dispatch-gates.mjs (no paths — derives its own changeset)	No check family names the given paths in its own source, and no workflow's path filter schedules one for them. · residue 0 matched · 40 undetermined · 81 silent

Together the first two are pnpm check:platform-checklist. ⚠️That gate is deliberately not in CI (maintainer decision, recorded in lint.yml:805-811 and the checklist README: it is a QA ledger, not a per-PR code gate), so the local run above is the only authority for it — CI will not re-derive it. check-nul-bytes was run because the diff discusses control characters.

dispatch-gates also lists five changeset-triggered families that "apply once a changeset exists, unless this card is docs-only". It is docs-only — docs/qa/platform-checklist/** publishes no package — so this PR carries skip-changeset instead.

One thing no path derivation can check: provisioning.use is not resolved by the validator (deferred, #7716 option C). All six references in the tree were verified by hand to resolve against their own area's block, and both new recipes are referenced by at least one item — no dangling pointers, no dead text.

Out of scope, filed not fixed

• @objectstack/studio's package header describes a pending boot-path switch that already concluded the other way #10592 — packages/apps/studio/src/index.ts's header still says the package is "NOT yet wired into the dev/serve plugin set" and that removing the app from plugin-auth's manifest "lands separately". Both halves are stale in opposite directions, and the first reads as an unfinished chore whose obvious next step would put a Studio tile back into every stock boot.
• finding: the checklist's area-scoped fixtures recipe convention has hit its stated revisit trigger — 3 areas, and a consumer that cannot reference the recipe it needs #10593 (finding) — the area-scoped recipe convention has hit its stated revisit trigger: three areas now, plus the first consumer that cannot reference the recipe it needs.

---

Generated by Claude Code