qa+fix: ADR-0126 scoped checklist sweep (#12438) + Setup nav entry for the packaged-automation page (#12457)

[baozhoutao]

Two commits, one scope — the ADR-0126 packaged flow/action disable+clone surface (acceptance card #12438, Epic #12150).

1. qa(checklist) — scoped coverage sweep (#12438)

The shipped ADR-0126 surface (sys_metadata_activation ledger, packaged flow toggle + subflow guard, flow clone, ACTION_DISABLED dispatch consult, §5 operator gate, Setup packaged-automation board) had zero checklist coverage. Three read-only gap hunters (routes/runtime · Setup/Studio UI · docs claims) → 14 new items across 5 areas + 1 revision, ledger 207 → 221:

• automation ×4: packaged-flow-disable-durable (P0, restart durability), packaged-flow-subflow-disable-refusal, packaged-flow-clone-contract, setup-packaged-automation-board (browser); flow-toggle-kill-switch rev 2 (re-sourced off the retired flowEnabled map onto the ledger projection)
• api-backend ×2: packaged-action-disabled-dispatch (P0, both doors + gate ordering), action-activation-door-contract
• access-security ×3: activation-write-operator-gate (with a TenancyPostureSchema enumSource pin), packaged-flow-write-door-parity, packaged-permission-set-lifecycle (card F1 / Studio save of a package-declared permission set forks it into a silent, undiscoverable overlay #11513 regression guard)
• platform-core ×3: activation-ledger-registration-home (card G1 / Ledger convergence: registration home + one store implementation (ADR-0126 §4/§8, maintainer-ruled) #12419), activation-ledger-row-contract (scope wall: rows only for flow/action), packaged-object-extend-only
• studio-authoring ×2: packaged-automation-studio-lock (card F2), packaged-display-class-direct-edit

coverage.json maps every new item (still 0 waivers). FOLLOW-UPS.md §8 carries what is NOT a checklist item: product defects D16–D22 found while grounding (each captured as an expected-fail probe), docs drift, card-accuracy notes for the tester, and fixture asks. Validator green: 221 items, 31 kinds mapped, traps 19/19, all provisioning recipes resolved.

2. fix(platform-objects) — Setup nav entry for the packaged-automation page (fixes#12457, = D16)

The page shipped complete in objectui (component ref automation:packaged) but no framework NavigationContribution ever named the ref — Setup's sidebar carried no entry and the page was reachable only by a hand-typed URL (card A1 failed by construction). This adds nav_packaged_automation in group_apps beside Packages (ADR-0084: package administration is Operate; ADR-0126 §7.4: "Studio keeps the editing; Setup gets the operational state"), deliberately with no requiresService: 'automation' (the action switches work without the automation service, #12419) and no requiredPermissions (matches nav_packages; the write doors enforce manage_metadata / the §5 operator gate server-side). Labels in all four locales with recorded source hashes; setup-packaged-automation-nav.test.ts pins the framework half of the cross-repo contract (objectui's PackagedAutomationPage.navContribution.test.tsx pins its half); changeset included (@objectstack/platform-objects patch).

Verification

• node scripts/check-platform-checklist.mjs → OK (221 items, 31 kinds, 0 waived)
• platform-objects vitest suites green (204 tests incl. i18n parity / tombstone / source-hash / the new nav pin)
• check:app-nav-i18n green: 54 merged setup nav ids × 4 locales
• Server-authoritative: GET /api/v1/meta/app?id=setup on a booted showcase serves the entry in group_apps
• Browser (objectui main HMR console → the booted server): admin signs in → sidebar shows "Packaged Automation" → sidebar click (not a typed URL) lands on /component/automation/packaged → page renders 29 packaged flows (toggle + Clone) and the 143-row packaged-actions section; no "Component not registered" (screenshots on 缺陷:Setup 导航缺「Packaged automation」入口 —— objectui 页面已合并,framework nav contribution 从未落地(ADR-0126 §7.4,验收卡 A1 必失败) #12457)

Out of scope, flagged for the maintainer

The .objectui-sha pin (seeded at 190fbd01 by #12347) predates the page's objectui merge (#6382/#6415), so a stock vendored-console build cannot resolve automation:packaged until the pin is bumped ≥ 9602dc8 and the console bundle rebuilt. That bump moves ~700 objectui PRs of console delta — deliberately not ridden on this PR (detail on #12457).

Refs #12438 · Epic #12150 · ADR-0126 · fixes#12457

🤖 Generated with Claude Code

https://claude.ai/code/session_01SKUXt6sKgAeCEtjiuwNuhq

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/platform-objects, touching 5 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/ui/setup-app.mdx(via SETUP_NAV_CONTRIBUTIONS (symbol))

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 2 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 04600d939b291a4c070313726bf2e9cf6c1e2b3d → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 1edd3560000273095e99492cddf8b20be3a3a894 — the merge of head 763adcde4cf546b5b9f6de8d41770cd4354aacff into base 04600d939b291a4c070313726bf2e9cf6c1e2b3d, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 1edd3560000273095e99492cddf8b20be3a3a894 && git checkout 1edd3560000273095e99492cddf8b20be3a3a894
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 04600d939b291a4c070313726bf2e9cf6c1e2b3d 763adcde4cf546b5b9f6de8d41770cd4354aacff && git checkout -B drift-repro 04600d939b291a4c070313726bf2e9cf6c1e2b3d && git merge --no-ff 763adcde4cf546b5b9f6de8d41770cd4354aacff
node scripts/docs-audit/affected-docs.mjs --json 04600d939b291a4c070313726bf2e9cf6c1e2b3d

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 04600d939b291a4c070313726bf2e9cf6c1e2b3d → pass the list as
args.docs, on the commit named under Which tree this was computed on.