docs(qa): dedupe the private D11 defect and correct four stale sharing/security checklist texts

[huangyiirene]

Fixes#7687

Checklist maintenance falling out of QA run #7637 (access-security, FULL area). Five itemised corrections, docs-only. Every named product fact was verified against origin/main before it was written into the ledger.

The five edits (落点 | before | after)

#	落点	before	after
1	rls-both-sides c5 + owd-sharing-matrix c4	one private defect stated on two clauses, counted twice	rls-both-sides c5 is the canonical expected-fail probe; owd-sharing-matrix c4 cross-references it — one defect, one count. Text is non-disclosing and names only the FOLLOW-UPSD11 handle
2	suggested-binding-loopfixtures.knownGaps	"the reconcile marks that suggestion confirmed (observed), NOT pending"	stock produces no suggestion row at all — {suggestions: [], synced: {created: 0}}; the row-dependent clauses have nothing to run against until the unbind sequence provisions one
3	record-share-grant-revoke c6	"source_id the rule name"	"source_id = the rule's ROW ID (sys_sharing_rule.id)" — the stable FK purgeRuleGrants reconciles on
4	sharing-rule-authoring-ui fixtures/steps/acceptance/negatives	showcase_project called "a private-OWD object"	retargeted to showcase_contact (genuinely sharingModel: 'private'), criteria health=='green' → stage=='qualified', audience-provisioning requirement recorded
5	RUNNER.md runner briefing	(absent)	new "Environment facts the runner should not re-derive" — viewis overlay-allowed, so a view PUT on the stock read-only showcase package needs no escape hatch

git diff --stat maps 1:1 onto that table — two files, areas/access-security.json (edits 1–4) and RUNNER.md (edit 5). Each touched item bumps revision and appends a history entry per README's Change lifecycle.

Fact verification against origin/main

Every claim written into the ledger was re-derived from source, not carried over from the run narrative:

• showcase_project is not private-OWD — examples/app-showcase/src/data/objects/project.object.ts:16 declares sharingModel: 'public_read_write'. The genuinely private ones are showcase_contact (contact.object.ts:37), showcase_inquiry (inquiry.object.ts:30), showcase_private_note (private-note.object.ts:27). Confirms the issue's premise.
• showcase_contact is disjoint from sharing-rules-widen — the four seeded rules in src/security/sharing-rules.ts cover showcase_project (×2), showcase_inquiry and showcase_task; none covers showcase_contact. So the non-overlap the item previously kept by a criteria-distinctness convention now holds structurally.
• Audience caveat, found while verifying and recorded on the item — stock's only showcase_contact grant is showcase_manager { allowRead: true, readScope: 'org' } (permission-sets.ts:124), whose org-depth read already sees every contact and would mask the widening; no other stock set grants the object at all. So the audience needs a scratch set + position, which is now a stated fixture requirement plus a vacuous-pass negative.
• source_id is the row id — purgeRuleGrants(ruleId) deletes on where {source: 'rule', source_id: ruleId} with ruleId = rule.id (sharing-rule-service.ts:746, callers at :287/:300); sys-sharing-rule.object.ts:12 documents source_id={rule.id}; sharing-rule.test.ts:277 asserts s.source_id === r.id.
• The overlay-allowed set is registry-derived — the allowOrgOverride: true entries of DEFAULT_METADATA_TYPE_REGISTRY (packages/spec/src/kernel/metadata-plugin.zod.ts) are exactly view, dashboard, report, translation, email_template, pinned by protocol.org-scoped-write-refused.test.ts G5 (case "the refused set is DERIVED from the registry").
• The no-row cause — suggested-audience-bindings.ts:224if (bound) continue; // satisfied before ever being surfaced — nothing pending, with the confirmed (observed) transition at :211 firing only for a row already pending. Cause and effect both match the run; the product defect behind it is suggested-binding-loop (a): the isDefault audience-binding suggestion is never surfaced on stock (auto-bound at boot, then skipped) #7677.

Privacy handling of D11

The D11 write-up was delivered privately under the ruling recorded on #7463, so the checklist text references the handle only and explicitly instructs a runner not to restate the defect in a public run issue. Two notes for the reviewer:

• The handle does not resolve inside this repo — docs/qa/platform-checklist/FOLLOW-UPS.md carries D1–D8 only, and D11 lives in the maintainer's private register. The item text says so rather than implying a row exists here. Adding even a placeholder row was deliberately not done: it is outside the card's file surface and would put the handle's existence in the public tree without a ruling.
• A negative clause pins the naming collision flagged on QA run · access-security (FULL area) · 92f26f75 · 2026-08-11 · 8 PASS / 2 PARTIAL / 8 FAIL / 1 BLOCKED #7637: the private FOLLOW-UPS D11 is unrelated to ADR-0090 D11 (the external-OWD authoring clause cited by access-security.owd-save-gate).

One correction beyond the five, disclosed

sharing-rule-authoring-ui c2 and its step 5 carried the samesource_id-is-the-rule-name error as edit 3. It is fixed in the same revision rather than left behind in an item being rewritten anyway; the item's history entry says so. No other item was touched.

Gates

gate	reading
node scripts/check-platform-checklist.mjs	base: 1 problem — coverage.json · qa: UNCLASSIFIED (the known red, #7347). branch: the identical 1 problem, no new findings. Not chased, per the card.
JSON validity	JSON.parse on areas/access-security.json → OK
revision/history consistency	validator-enforced (revision must equal the last history entry's revision); green on all four touched items
node scripts/check-nul-bytes.mjs	OK — 7104 text files scanned, no raw control bytes
self-scan	grep -naP '[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]' over both touched files → no hits

Docs-only, releases nothing → no changeset; skip-changeset applied.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Aug 11, 2026 11:54am