QA run · priority:P0 (10/23) · 77392e90 · 2026-10-23 · 9 PASS / 1 PARTIAL / 0 FAIL / 0 BLOCKED / 13 NOT-RUN #25478

Pre-release re-test for 18.1.0 of the priority:P0 items that carry no automated pin (the manual ten), on main at the head of 2026-10-23 13:00Z. It follows QA run #25227 (e5f194b, 2026-10-22: 19 PASS / 3 PARTIAL / 1 FAIL), after 112 more commits landed on main. The other 13 P0 items were deliberately not driven in this round: they are pinned and run in CI, and they score NOT-RUN here, which is honest rather than a gap in what was asked.

Environment fingerprint

• framework 77392e901cce58316e803144971f2741ef049fc4 (origin/main, 2026-10-23 12:56Z); .objectui-sha 5fef032b1ada5b86bad640637e7331e26ee5da6e. The pin move chore(console): move the objectui pin 1d178e06ac5e → 6fb31dcc9954, past objectui#13370, so the console builds against the spec again #25455 (to 6fb31dcc9954) was open, not merged.
• tree: pnpm install --frozen-lockfile, then pnpm build --concurrency=2 (76/76 tasks, 9m49s). node scripts/check-dev-prereqs.mjs was green.
• console, with a deviation the reader must weigh: pnpm objectui:build at the pin FAILS on this main. @object-ui/plugin-view's declaration build reports TS2322 at ObjectView.tsx:2615, because feat(spec,lint): a bulk action's confirmText is a template slot over count and its params, judged at validate, compile and the publish gate #24947 (925fd077) made a bulk action's confirmText envelope source optional and objectui typed it as required. This is hourly full run: red on main (CI) #25438 (Console Pin Gate red on main, fixed by objectui#13370 and the pin move chore(console): move the objectui pin 1d178e06ac5e → 6fb31dcc9954, past objectui#13370, so the console builds against the spec again #25455), so it is not re-filed here. To keep testing, the console was built by pnpm objectui:build at the SAME pin from a sibling worktree at f0fdd45b (925fd077's parent), then copied into packages/console/dist. The dist stamp equals the pin and pnpm check:console-sha passes. The bundle's embedded @objectstack/spec is f0fdd45b's; the server is 77392e90.
• container: 4 vCPU, 15 GiB. Chromium 141 headless at /opt/pw-browsers/chromium (playwright-core 1.63.0).
• boots: stock examples/app-showcase via OS_PORT=PORT objectstack dev --ui --seed-admin -p PORT -d file:(scratch)/NAME.db. Each runner used its own port range (476xx) and file DBs, started with setsid and stopped by process group. Items that write into the app directory (dev-boot-contract steps 4/6/7/9) used a scratch copy under examples/, deleted afterwards.
• execution: three runner agents in parallel (boot/CLI · console/nav/CRUD · approvals/studio/datasource). git status stayed clean.

Scope

Selector priority:P0 resolves to 23 runnable items. 10 were judged. Hidden (blocked): access-security.no-active-org-session-semantics. No planned items matched.

NOT-RUN this round (pinned, CI-run, not re-driven by hand): access-security.rls-both-sides, access-security.write-path-guards, access-security.crud-permission-matrix, access-security.owd-sharing-matrix, access-security.anonymous-deny-surfaces, access-security.walled-environment-metadata-operator-only, ai.mcp-stdio-fail-closed, api-backend.query-contract-matrix, api-backend.packaged-action-disabled-dispatch, cli.organization-ownership-ceremony, identity-auth.default-organization-boot-invariant, platform-core.nav-surfaces-render, platform-core.v18-boot-refusals.

Derived: 9 PASS / 1 PARTIAL / 0 FAIL / 0 BLOCKED / 13 NOT-RUN.

Per-clause evidence

platform-core.boot-health (rev 9)

• A0 pass: health 200, 19.4 s after process start.
• A1 pass: /ready 200 {"status":"ready","state":"running"}.
• A2 pass: 0 ERROR lines in the boot window. The Flows banner reads 32 flow(s) 19 bound … 8 draft; its only extra lines are two ℹ deployment-policy lines (showcase_task_due_reminder, showcase_scheduled_digest), and none of the four misauthored shapes appears.
• A3 pass: meta/app?id=showcase_app 200, with keys type,items.
• A4 pass: the served grp_data lists 12 objects, identical in order to src/ui/apps/index.ts.
• A5 pass: /_console/ 200 text/html on the console described above. Before that console existed, the route answered 503 text/plain "not built".
• Negatives held.

platform-core.seed-integrity (rev 4)

• A0 pass: 19 objects and 132 rows, derived by evaluating ShowcaseSeedData, with zero count mismatches.
• A1 pass: 37 Specimen-Full fields diffed. Only normalisations differ: the datetime gains .000Z, f_time becomes 14:30:00, and f_password is masked.
• A2 pass: the Seeds: com.example.showcase 132 rows row is plain, with no Seeder warn.
• A3 pass: a restart on the same DB gave an empty count diff, and ids and updated_at were unchanged.
• A4 pass: f_user, f_users and f_secret are null, and cover is null on 10 of 10 tasks.

cli.dev-boot-contract (rev 7)

• A0 pass: health 200 and ready 200.
• A1 pass: after the restart with --admin-password changed99, admin123 signs in (200) and changed99 is refused (401).
• A2 pass, with one Database line per tier:
  • explicit -d;
  • env OS_DATABASE_URL;
  • config-declared default datasource (qa_home, built with os build), which prints file:…/.objectstack/data/qa_home.db (the first live replay of steps[9]);
  • legacy dev.db, with one notice line;
  • nothing chosen, which prints the unified .objectstack/data/objectstack.db;
  • -d :memory:.
• A3 pass: --fresh names its tempdir, which is gone after exit. SIGINT exits 130 and SIGTERM 143. showcase_external.db surviving is the dev --fresh claims the tempdir owns ALL persistent state, but app-declared cwd-relative datasource paths still write into the project tree and survive exit #5594 carve-out.
• A4 pass: ↪ server bound to port 47614 (requested 47613), and health 200 on 47614.
• A5 pass: the "OLDER than your sources" block names the newest source and the fix, and the boot still reaches healthy.
• A6 pass: no config exits 1 with the remedy line.
• A7 pass: /_console/ renders the sign-in page (screenshot), and a form sign-in lands on /home.
• Negatives held:
  • --database-driver memory exits 2;
  • OS_DATABASE_DRIVER=memory|mingo exits 1 before any Database line;
  • -d memory:// and mingo:// exit 1 after the Database line.

automation.packaged-flow-disable-durable (rev 5)

• A0 pass: toggle off returns 200. Exactly one sys_metadata_activation row exists (flow, showcase_urgent_task_alert, com.example.showcase, active false). Its key set has no organization_id, and PRAGMA confirms there is no such column.
• A1 pass: 409 FLOW_DISABLED, with the message naming the "packaged-metadata activation ledger (sys_metadata_activation, ADR-0126 §7.2)" and both remedies.
• A2 pass: after a cold restart at --log-level info, the log reads Activation ledger: 1 packaged flow(s) are switched off … 'showcase_urgent_task_alert', and /_status reports enabled:false, bound:false.
• A3 pass: the run count stays at 1 across a post-restart urgent create.
• A4 pass: re-enable returns the same row id with active true (updated_at moved), the row is not deleted, and the next create adds a new run (runs 2).

platform-core.console-login (rev 4)

• A0 pass: form sign-in returns 200 with a session cookie and lands on /_console/home, showing the header and launcher with no sidebar.
• A1 pass: a reload keeps the route; get-session 200 and meta/app?id=showcase_app 200.
• A2 pass: after a server-side POST /auth/sign-out, the same bearer gets meta/app 401 UNAUTHENTICATED.
• A3 pass: full navigation goes to /_console/login?redirect=…. An in-SPA click shows the named "Sign in required … Retry" state with no grid data.
• A4 pass: re-sign-in lands on the same route; reads return 200 and a create returns 201.
• Negatives held: a wrong password gets 401 INVALID_EMAIL_OR_PASSWORD, no cookie and no token, and a visible "Invalid email or password" alert.

platform-core.builtin-apps-nav-render (rev 7)

• A0 partial. Setup 42/42 and Account 8/8 destinations render, with collapsed groups expanded first, screenshot first, 0 pageerrors and no blank main or placeholder. All 9 settings namespaces open. The one exception is Browse Marketplace: it renders the named "Failed to load marketplace (HTTP 502)" state because GET /api/v1/marketplace/packages answers 502 MARKETPLACE_PROXY_FAILED (container egress to cloud.objectos.ai is denied). Catalog content is blocked(environment) per the item's knownGap.
• A1 pass: Setup's 9 groups and 42 leaves equal the shell plus contributions; Account has 8.
• A2 pass: as Mei, Setup shows meta/app/com.objectstack.setup 403 and "You don't have access to this app", while Account opens.
• A3 pass: forged as Mei, ?id=setup answers 200 items:[] and /meta/app/setup answers 403 PERMISSION_DENIED.
• A4 pass: Mei's setup payload is empty. The Account nav is identical for admin and Mei (8 vs 8), shown as the control only.
• A5 pass: nav_organizations and nav_jwks are absent, and nav_business_units is present and renders.
• A6 pass: nav_sso_providers is absent (features.sso:false).
• ?id=studio answers 200 items:[], asserted as expected.

records-forms.crud-roundtrip (rev 13)

• A0 pass: the form create sends POST {industry,status,sales_region,name} and gets 201. The filtered re-read is verbatim and website is null.
• A1 pass: PATCH {"annual_revenue":1234567} returns 200. In the full-row diff only annual_revenue and updated_at change.
• A2 pass: the UI delete with confirm sends DELETE and gets 200; the filtered read returns total 0 and a read by id returns 404.
• A3 pass: post-reload list screenshots at create and at delete.
• A4 pass: History shows CREATE and UPDATE with option labels and the actor. A localized date (Customer Since: 3/15/2024) was observed on a scratch row.
• A5 pass: os-qa-rb2-华宁 round-trips byte-identical, and $search=华宁 finds it, as does the list quick-search.
• A6 pass:
  • The clone returns 201 with a new id; only id, timestamps and name differ.
  • A contributor cloning a seeded zoo row gets owner_id = the cloner and f_autonumber re-derived.
  • A planted lead_score=42 (written with node:sqlite while stopped) is cloned with droppedFields lead_score reason readonly, and the clone reads null.
• A7 pass: a contributor-bound member cloning INV-1003 gets 404 RECORD_NOT_FOUND, and the count is unchanged. Discriminator: cloning a readable account without the create grant answers 403 PERMISSION_DENIED.
• Negatives held:
  • a save with the required name empty is blocked;
  • a POST without name gets 400 VALIDATION_FAILED with code required;
  • a bad tax_id gets 400 invalid_format.

approvals.account-app-entry (rev 4)

The runtime persona (contributor + finance) launched a NEW sign-off on an invoice it owns. The surface scored is the served sys_approval_request record page (objectui#12484 replaced the drawer).

• A0 pass: the dist stamp equals the pin, and the entry chunk carries the approvals:inbox register call.
• A1 pass: the inbox tabs My Pending / Submitted by me / All render, with the row and the hint bar.
• A2 pass: the persona's meta/app returns ["showcase_app","account"], ?id=setup is empty, and nav_account_approvals is kept.
• A3 pass: the page renders the fields and Approve / Reject / Reassign / Send back / Request info / Send reminder / Recall / Reply. Approve returns 200, progress goes from 0/2 to 1/2, viewer.can_act becomes false, the approver actions are gone, and the timeline has 2 entries. QA run · priority:P0 (23/23) · e5f194ba · 2026-10-22 · 19 PASS / 3 PARTIAL / 1 FAIL / 0 BLOCKED / 0 NOT-RUN #25227's blank-page FAIL does not reproduce.
• A4 pass: a ?request= cold load opens that exact request, in 2 fresh contexts.
• A5 pass: the row href is /_console/apps/com.objectstack.account/showcase_invoice/record/…, and the persona's direct read returns 200.
• A6 pass: in zh-CN, the nav reads 待我审批, the tabs read 待我审批 / 我发起的 / 全部, and the badge reads 待审批.

studio-authoring.first-run-loop (rev 6)

• A0 pass: the package create returns 201 and the switcher lists 维修中心 with no reload (a marker survived and there were 0 load events).
• A1 pass: before publish, meta/object/repairs_repair_ticket returns 404. After Publish all (publish-drafts 200) the status select has exactly 3 options.
• A2 pass: the record create returns 201, and a read shows status:"in_progress".
• A3 pass: the Repair Center tile is in the launcher, and the end-user list shows the "In Progress" label chip (the raw value is absent from the DOM).
• A4 pass: one "Server is ready" in the log and the same listener pid throughout.
• A5 pass, on forged writes into com.example.showcase:
  • a new object gets 422 WRITABLE_PACKAGE_REQUIRED;
  • an added field gets 403 ITEM_LOCKED;
  • a forged app gets 422;
  • nothing landed.

integration-system.datasource-credential-refusal-matrix (rev 5)

The run used a scratch PostgreSQL 16 for the connect leg. Legacy rows were planted with node:sqlite while the server was stopped.

• A0 pass: 25 build-door cases each exit 1 and name the path, and every credential refusal points at external.credentialsRef. The runtime POST /datasources answers 400 DATASOURCE_ADMIN_ERROR on the same doors; the doors agree on every case.
• A1 pass: binding through secret gets 201, and the stored row holds only the credentialsRef handle. /test returns ok:true and pg_stat_activity shows the role.
• A2 pass: the admin door, the meta door and data/sys_metadata?type=datasource were grepped for every planted value with 0 hits; apiSecret is the ruled boundary.
• A3 pass: hasSecret true vs false on otherwise identical configs.
• A4 pass: the legacy pg (passwd, pwd) and turso (token, jwt, auth_token, authtoken, encryptionKey beside a file: url) keys are all withheld on every door.
• A5 pass: on the unknown driver, password, authToken and passwd are withheld and URL userinfo is stripped, while apiSecret is served as written (decision: how a datasource driver with no shipped config contract keeps credentials out of metadata (declaration vs. key-name heuristic) #21921 boundary).
• A6 pass: an echoed-config PATCH returns 200, the secret row is unchanged and /test stays ok. PUT returns 405.
• A7 pass: a member gets 403 and anonymous gets 401 on all 14 reads.

Findings outside the clauses

• Fixed since QA run · priority:P0 (23/23) · e5f194ba · 2026-10-22 · 19 PASS / 3 PARTIAL / 1 FAIL / 0 BLOCKED / 0 NOT-RUN #25227: the data-API paging defect is fixed. $top=-1, $skip=-5 and $top=abc now answer 400 "must be a non-negative integer".
• Product defects: extracted at close-out; the closing comment lists them.
• Authorization-adjacent, low severity: one observation on the approvals doors, detail withheld pending maintainer.

Checklist-accuracy findings and fixture gaps (not extracted)

• RUNNER environment fact, OS_PORT / connector self-URL: the Check is now wrong. With OS_PORT exported, GET /api/v1/meta/connector/showcase_status_api still reports providerConfig.baseUrl http://127.0.0.1:3000 (the compiled artifact's value), while showcase_declarative_connector_ping dispatches to the OS_PORT server and completes. Judge connector reachability by a run's output, not by that read.
• platform-core.boot-health acceptance[2]: the deployment-policy lines print with ℹ, not ⚠.
• platform-core.seed-integrity: list f_password as expected-masked, and f_time / f_datetime as format-normalised.
• cli.dev-boot-contract:
  • steps[9] has now been replayed live, so "not yet replayed live" can go.
  • The 🔑 Dev admin row did not print on the changed-password restart.
• automation.packaged-flow-disable-durable: the urgent task create needs project.
• builtin-apps-nav-render steps[5]:
  • Account › Approvals is the approvals:inbox component.
  • Setup › Datasources lands on /apps/setup/metadata/datasource.
• records-forms.crud-roundtrip:
  • the New form also submits industry:'technology' when the field is left untouched;
  • no step sets a date for acceptance[4];
  • f_formula cannot show re-derivation with unchanged inputs;
  • the search:qa-contributor-bound-member recipe's knownGap says 15 accounts, and this boot had 14.
• approvals.account-app-entry acceptance[3]/[4]:
  • "drawer" should name the served record page, and no separate can_act=false sentence exists on it;
  • Avatar › Profile lands on /apps/account/… while the entry uses /apps/com.objectstack.account/….
• datasource matrix:
  • the former aliases are per driver, and a cross-driver alias (pg auth_token) is refused only as "Unrecognized key", with no credentialsRef pointer;
  • the knownGaps[2] PG recipe cannot live under a 0700 scratch root;
  • a refused os build exits 1, not 2.
• studio-authoring.first-run-loop steps[3]: the Changes panel goes straight to the review sheet.

Off-clause probe line (rule 8)

About 30 runner-minutes, after the clauses had verdicts. Personas: admin, Mei, contributor and approver personas, and anonymous.

Doors probed:

• health/ready methods;
• meta/app id spellings;
• data paging and unknown ids;
• the clone door (unknown, empty and space ids, a string overrides, a forced id, readonly and owner overrides);
• automation toggle bodies and the ledger write doors;
• sign-in boundary classes;
• settings as a member;
• approvals act/read as a non-participant;
• studio package/publish doors with unknown and duplicate ids;
• datasource admin/meta/sys_secret doors and filter side channels.

Found:

• the paging fix above;
• an unknown-resource family: POST /packages/<unknown>/publish-drafts → 200 nothing_to_publish, and PATCH /datasources/<unknown> → 400 where GET answers 404 (extracted);
• the withheld approvals observation.

Cosmetic, not extracted:

• clone {overrides:"notanobject"} is accepted as no overrides;
• History shows a currency change raw;
• Setup's "Notifications" nav vs the "Notification Events" page title;
• Mei on a settings URL inside the showcase app sees "No settings registered" chrome rather than the app refusal (the server is correct).

Handover

None. Every item within the stated scope has a verdict. The browser items will be re-driven on the final pin once #25455 lands.