docs(qa): correct five approvals checklist items against the #7517 run

[huangyiirene]

Fixes#7530

Five checklist-authoring corrections in the approvals area, all evidenced against the full-area QA run #7517. No product code changes — in every case the build behaves correctly (or correctly refuses) and the checklist was asserting a shape the implementation does not have. Two of the five were the sole reason their items scored PARTIAL, so leaving them would keep re-manufacturing false amber on every run.

The five corrections

#	Where it lands	Before	After
1	decision-action-matrix — the revise/resubmit acceptance clause, its step, source; rev 1 → 2	one combined clause: "resubmit moves returned → pending as round 2 with a fresh approver slate"	three clauses — revise parks the run · resubmit MINTS a round-N+1 request · the resubmitted row stays terminally returned; the step re-reads both sides, and maxRevisions now names which request the auto-reject lands on
2	dynamic-approver-routing — the vars clause, steps, new knownGaps, source; rev 1 → 2	oracle: "the stage-1 outputs present in the run variables snapshot", read off run-detail	oracle is the functional resolution, driven twice: 1 pick → 1 stage-2 pending_approvers, 2 picks → 2, same order. A knownGaps entry records that a paused run's detail carries no variables key at all — structural, not a data gap
3	ooo-delegation-reroute — personas, fixtures.requires, knownGaps, steps, the delegate-identity clause, a new negative, source; rev 1 → 2	the admin writes the delegation on behalf of a non-admin delegator who has no auth account	A = the signed-in admin delegating their OWN slot (a self-service write); B = a second real runtime account deciding with its own bearer token. The forged-delegator refusal is added as a negative
4	knownGaps on per-group-signoff (rev 3 → 4), viewer-gating-submitter-side (rev 3 → 4) and ooo-delegation-reroute (folded into rev 1 → 2)	the sign-in gap recorded only as "needs a better-auth account provisioned at runtime" — cause unstated, rediscovered every sweep	records the actual one-field cause: better-auth 1.7.0-rc.2 requires the credential account's issuer to equal local:credential, else sign-in fails INVALID_EMAIL_OR_PASSWORD behind a misleading "User not found" warn
5	notification-deep-link — fixtures.requires, new knownGaps, steps, the cold-load clause's verify/evidence, source; rev 3 → 4	requires "a request whose open notified the signed-in approver"; evidence "two screenshots with the URL visible"	requires the remind / reassign path (no approval.opened topic exists); evidence is the drawer field-matched against the API, because the console consumes the query param before the drawer is capturable

Premise verification — all five confirmed on origin/main @ 8c20f75

Per the issue-is-a-lead rule, each premise was checked against source before editing; none had expired.

1. ApprovalService.resubmit (packages/plugins/plugin-approvals/src/approval-service.ts) — its own docstring: "traversal walks the declared back-edge into the approval node, whose executor opens the round-N+1 request — fresh approver slate, record re-locks." The method never rewrites raw.status, so the resubmitted row stays returned. sendBack counts prior rounds as returned siblings on flow_run_id + flow_node_id — which is only coherent under the mint-a-new-request shape.
2. packages/services/service-automation/src/engine.ts — both status: 'paused'recordLog calls pass steps and trigger but novariables / output key, while the adjacent suspended-run bookkeeping does capture variables. So the snapshot exists, it is just not on the surface run-detail serves.
3. bindDelegationWriteGuard (packages/plugins/plugin-approvals/src/lifecycle-hooks.ts) — a foreign delegator_id is rejected with FORBIDDEN / statusCode 403, an absent one is stamped to the caller, and there is no admin exemption (deliberately removed in plugin-approvals 的 admin 豁免读 session.roles,而 ObjectQL 的 buildSession() 从不填充它 —— 记录锁/delegation 守卫的 admin 覆盖在真实引擎路径上永不生效 #4839). The old fixture was therefore unconstructible by anybody, not merely inconvenient.
4. packages/plugins/plugin-auth/src/backfill-account-issuer.ts — CREDENTIAL_ISSUER === 'local:credential'; better-auth is pinned at 1.7.0-rc.2 in packages/plugins/plugin-auth/package.json.
5. The emitting topic set in approval-service.ts is approval.{reminder,reassigned,returned,request_info,comment,ooo_substituted,ooo_skipped,escalated,sla_breached} — no approval.opened member, so opening a request notifies nobody. ApprovalService.notify rewrites a bare /system/approvals actionUrl into the ?request= deep link centrally, so the remind and reassign paths both do produce a real deep-linked notification.

Diff — maps 1:1 to the table above

docs/qa/platform-checklist/areas/approvals.json | 124 +++++++++++++++---------
1 file changed, 80 insertions(+), 44 deletions(-)

coverage.json needed no change and carries none. It maps governed metadata kinds to item ids; this pass adds no item, retires none and renames none, so its two approvals entries (position → approvals.per-group-signoff, approvals.dynamic-approver-routing) stay exactly right. Called out explicitly because this branch was the wave's sole holder of that file.

Gates

• pnpm check:platform-checklist — the BASE is already red, and the reading is unchanged by this PR. Measured on origin/main @ 8c20f75 with a pristine checklist tree, before the edit: exit 1, exactly one problem — coverage.json · qa: UNCLASSIFIED. After the edit: byte-identical output, same exit 1. Not chased: it is the new qa liveness ledger needing a coverage.json row, already filed and open as finding: check:platform-checklist is red on main — the new qa liveness ledger is neither mapped nor waived in coverage.json #7347, and deciding between "author a real qa item" and "waive it" is a separate scoping call.
• JSON validity — JSON.parse of the edited area file is green; every touched item's revision equals the max revision in its own history (checked mechanically for all six).
• pnpm check:nul-bytes — green: OK (scanned 7061 text file(s) ... no raw ASCII control bytes), exit 0. Plus a targeted self-scan of the edited file for the wider control-byte class: no matches.

Changeset

None, deliberately. This is docs-only — it touches docs/qa/platform-checklist/ and nothing that ships in a package, so it releases nothing and a changeset would be noise. Needs the skip-changeset label.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Aug 11, 2026 9:46am