docs(qa): classify the manifest capability in the platform-checklist coverage ratchet

[claude]

Fixes#11421

check:platform-checklist was red on main with exactly one problem:
coverage.json · manifest: UNCLASSIFIED. The manifest liveness ledger
(packages/spec/liveness/manifest.json) landed on 2026-08-23 and the checklist
neither tested nor waived the capability it governs. This is authoring work in
docs/qa/platform-checklist/ — the gate script is untouched.

The decision this card actually turns on: items, not a waiver

The card asks for "items or a waiver" without saying which, and the honest answer
depends on what the manifest capability is. Read against source rather than
inferred from the name, it is an authored, enforced, user-facing surface, not
an internal ledger:

what a manifest declares	what enforces it
engines.protocol / engines.platform / engine.objectstack	assertProtocolCompat(manifest) runs beforeregistry.installPackage (metadata-protocol/src/protocol.ts:19755) and throws OS_PROTOCOL_INCOMPATIBLE with a migrateCommand
namespace	ADR-0048 install-time ownership gate — NamespaceConflictError (objectql/src/registry.ts:3473-3490), shareable namespaces exempt, same-package reinstall excluded
(absent)namespace	derived from the package id for runtime-created packages (protocol.ts:19744-19748), so the prefix rule is not silently inert for Studio-authored packages
packaging	a real artifact fork in os plugin build — manifest-deps externalizes declared deps and packs package.json into the archive, bundled inlines them (cli/src/commands/plugin/build.ts:155-166, :202-207)
id / version	required by ManifestSchema, re-guarded post-parse in build, and refused server-side as 400 PACKAGE_MANIFEST_INVALID (rest/src/package-routes.ts:532)

A waiver, per the checklist README, "is a debt marker, not an exemption: it names
what fixture or surface is missing". No fixture is missing here — every gate above
is drivable against os dev or a scratch plugin directory today. A waiver would
have been the thin reason the dispatch warned against.

What landed

Two new items, authored verify-first (every clause traced to a file:line before
it was written), plus the coverage mapping.

• platform-core.manifest-install-contract (P1, api) — the install boundary.
  The handshake refusal and the two reads proving nothing was written; the
  structured diagnostic's fields; protocol-first precedence across all three range
  rungs, with the mixed pair as the load-bearing probe; the two non-determinations
  (no-range, unparsed range) admitting with a warning rather than falsely
  rejecting; the namespace ownership gate on all three legs (conflict, same-package
  reinstall, shareable exemption); namespace derivation read back from storage.
• cli.plugin-manifest-build-contract (P2, cli) — the packaging boundary.
  Located refusals with no artifact written; the two identity guards as
  different refusals; the packaging artifact fork; the compiled manifest
  (main + integrity) read back out of the archive; the
  protocol/missing-engines-range lint nudge and its manifest scoping.
• coverage.json maps manifest to both, plus the existing
  api-backend.package-rest-lifecycle — which already drives manifest keys over
  the install door (its 409 "no silent manifest clobber" guard is literally a
  manifest assertion), so the mapping reflects what the checklist really covers
  rather than only what this PR added.

Two sketch claims were corrected against source before they became clauses, and both
corrections are recorded in the items' history: id/version are required by
ManifestSchema (so build's explicit guard is the empty-string arm, not the only
identity check), and the file os plugin build reads is objectstack.plugin.json,
not the objectstack.config.ts the liveness ledger names first.

Two findings recorded as negative, not scored as working

The manifest's declared-but-inert half is on the enforce-or-remove worklist, and an
item that scored either as machinery would be authoring false coverage:

• runtime (the plugin trust tier) is printed by build and publish and
  dispatched on nowhere (manifest.runtime — the ADR-0025 §3.6 plugin trust tier — is read only to be echoed in two CLI lines, and loading's own tombstone tells upgrading authors it is enforced #11330 is open).
• integrity is computed and written into the compiled manifest, and nothing
  re-verifies it at unpack (manifest.integrity declares per-file artifact digests the spec says the runtime re-verifies at unpack — nothing computes them and nothing checks them #11331 is open).

Both are named in the items' negative blocks so a runner cannot tick them.

Verification — and why local runs are the only signal this will ever get

⚠️check:platform-checklist is not CI-wired. Its absence from CI is a recorded
maintainer decision quoted in .github/workflows/lint.yml, and no CI job will
confirm anything below. The same disclosure #10810 and #11508 both carried. This PR
does not change that posture, does not schedule the gate, and does not build a
reporting path — both were fenced on the card.

The gate was already red before this change, so a red-then-green pass/fail proves
nothing. The evidence is a diff of problem lists:

$ diff <(grep '✗' base-gate.txt) <(grep '✗' after-gate.txt)
1d0
< ✗ coverage.json · manifest: UNCLASSIFIED — the platform has this capability
(liveness ledger exists) but the checklist neither tests nor waives it.
Add items or a waiver with a reason.

Exactly one problem removed, none added.

Gate union re-run at the final commit 0315605d, each verdict quoted from the
gate's own printed line:

✓ check-platform-checklist --self-test: 36 assertions — the trap-table extractor reads a good table and REFUSES an empty/renamed/reshaped one; `fixtures.provisioning.use` resolves against its own area and fires on a dangling one.
check-platform-checklist: OK — 15 areas, 207 items (207 active); coverage: 31 kinds mapped, 0 waived; traps: 19 documented, 19 in use; provisioning: 4 area recipes, 6 item references resolved (self-checks: 22 trap-vocabulary + 14 provisioning-resolve assertions).
✓ doc authoring guard: 389 files clean — no bare metadata literals.
✓ check:doc-formula-expressions: 22 record-scoped formula example(s) across 420 files / 1449 TS blocks judged clean by @objectstack/formula.
check-nul-bytes: OK (scanned 6455 text file(s) -- 6455 tracked, 0 untracked-not-ignored; skipped 5 binary; no raw ASCII control bytes).

The gate set was derived, not recalled:
node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack names
check:doc-authoring and check:doc-formula-expressions for this surface; both were
run, alongside the card's own check:platform-checklist family and check:nul-bytes.
Coverage counts re-derived rather than inherited from the card: 31 liveness kinds vs
30 coverage entries before, manifest the only gap, no orphans — the card's
arithmetic still held.

No changeset: this is a docs-only change to an internal QA ledger and releases
nothing (dispatch-gates agrees — "write one unless this card is docs-only").
skip-changeset applied.

Coordination

#11508 is in flight over docs/qa/platform-checklist/README.md,
areas/records-forms.json, areas/search.json and
scripts/check-platform-checklist.mjs. This PR touches none of them — its whole
surface is coverage.json plus the two area files that carry the new items
(platform-core.json, cli.json), and both changes are pure appends.

Generated by Claude Code

---

Generated by Claude Code