docs(qa): 18.0 sweep round 9 — three pin over-claims narrowed, comma-range line citations re-pointed

[objectstack-fleet]

Refs #24579
Clause-②: no

Round 9 of the 18.0 release sweep's wave anchor (#24579), claim 6282463055. One PR in two parts. These are checklist defects only: no product code, test, pin or objectui spec changes, in either repository. Each of the 23 edited items takes one revision bump and one history row (3 in part A, 20 in part B). The rows' ref is a placeholder in this head; a fill commit replaces exactly those strings with this PR's number.

Base: origin/main 39e93b9ef9 (fast-forwarded; the branch carries no merge). objectui was read only, with git show at the shipped pin 12dc7b47c340 and at the sweep pin 4016370af3c9, and older objectui files were fetched as raw text at the pin each item was authored against.

Part A — records-forms.json, the seat ruling and round 8's three half-claims

item	fields	revision	spec / pin	what it asserts	choice
records-forms.conditional-rules-grid	automated.ref, automated.stale (removed), acceptance[2].verify, acceptance[3].verify	7 → 8	objectui e2e/live/grid-file-upload.spec.ts (blob feb5ff39 at both pins)	uploads a file into the New Invoice dialog's first-line Receipt cell and asserts only that the submitted /api/v1/batch carries a receipt with a name and an http(s) url; it never re-reads the line or fetches the file	drop (seat ruling 6281811723): named in automated.ref as dropped at revision 8. stale.partial named only this spec, so the whole stale block goes. acceptance[3].verify no longer says it pins the clause
same item	(same)	(same)	objectui e2e/live/grid-parent-rules.spec.ts (blob b94e2d63 at both pins)	on the New Invoice dialog's first line, with Qty filled: Qty and Unit Price enabled at draft, disabled at paid with the typed value kept, enabled again at draft. It never asserts the Product cell, which declares the same readonlyWhen: parent.status == 'paid' (invoice.object.ts)	narrow: acceptance[2].verify and the ref's note now say Qty and Unit Price only, and name the Product cell as unpinned. acceptance[0]'s inline-flag narrowing is left as round 8 wrote it
records-forms.master-detail-atomic-save	acceptance[0].verify, automated.ref	5 → 6	objectui e2e/live/master-detail.spec.ts (blob fdfaf571 at both pins)	on showcase_project_workspace ("New Project + Tasks"): the first POST /api/v1/batch the save sends opens with the populated showcase_project op, and carries one showcase_task op whose project is {$ref: 0}; one child, staged through the per-row form	narrow, not drop, by round 6's theme-B rule: the clause is carrier-neutral (master and children in one atomic batch, the child ops referencing the parent), and both tests assert exactly that on their own carrier, so the pin asserts a full clause. The verify now says what it asserts and that this run's two-line invoice payload is read from the network trace. Tier 1 run #24598 scored acceptance[0] pass on it (2/2)
records-forms.field-type-constraints	acceptance[7].verify, fixtures.knownGaps[0]	1 → 2	objectui e2e/live/summary-rollup.spec.ts (blob 49338c81 at both pins)	two tests on showcase_project's total_estimate (SUM) and task_count (COUNT) over showcase_task, through a direct /api/v1/batch; it never reads showcase_invoice.total	correct the verify: it now says no pin reads invoice.total. The spec was never in this item's automated.ref (API pins only), so there is nothing to drop there. Bounded in-place fix in the same item: knownGaps[0]'s createColumn ~7354-7368, a tilde line range no gate reads, became the sql-driver.ts#createColumn anchor its own text already named

Run records named in the history rows: #24598 (Tier 1), #24572 (round 1, records-forms) and #24616 (round 2, records-forms).

Part B — the comma-range line-citation sweep

Round 7's report (6281433885, out_of_scope_findings[1]) named the spelling file.ts,NNN / file.ts,NNN-MMM. It is the residue of #13786's strip (cd354fd5e8): that commit removed only the first range of each colon list (:A,B became ,B), and the line-citation limb reads only the colon spellings, so nothing caught what was left.

Census, re-taken over every string of every areas/*.json file (items and area-level recipes), with a rule wider than round 7's: a comma and 2–5 digits right after a word character, or an extension, a comma, a space and digits.

reading	at BASE 39e93b9ef9	at head 347186527d
matches	46	6
line citations among them	42	2
— in round 7's 20 named items	36 (35 fields)	0
— in area-level recipes (attachments-storage ×3, automation ×1)	4	0
— in access-security.platform-owner-email-anchor, held by open PR #24667	2	2
not citations (a count after a file name: cli.dev-automigrate-policy history[1], integration-system.datasource-admin-lifecycle acceptance[8], platform-core.settings-hub-roundtrip history[2], records-forms.adhoc-filter-sort-builder stale.partial)	4	4
in the excluded items	0	0

Round 7 counted 21 items; the list it gives has 20, and all 20 hit. The wider rule also found two forms its rule missed: the share-link item's branch,190-234 and the packaged-automation board's (529 clone-dialog validation,516 …).

How each was re-pointed. For every citation I found the commit that authored the original colon list (git log -S, before cd354fd5e8) and read the cited lines there, then found that code at this base. An objectstack citation became a file#symbol anchor the shared resolver accepts; a test file is cited by its case or block title; an objectui citation names the component, function or branch in prose, read at the shipped pin 12dc7b47c340. Where the surrounding words still described the range the strip had removed, the new citation names that code too (for example both auth-manager gates, both code literals of the clone test, both invoice arms). The history rows do not contain any path-qualified anchors or comma ranges, so a later rename never forces an edit to a dated record.

Gate readings (node scripts/check-platform-checklist.mjs): symbol anchors 918/928 at BASE → 949/959 at head, +31 new anchor occurrences (28 resolve as declaration, 3 as literal: #RESOURCE_CONFLICT, #RESOURCE_NOT_FOUND, #regenerate_backup_codes), none refused, 18 file floors held; line citations 0 survive.

PM hypotheses, measured:

1. Holds. LINE_ANCHOR needs a colon and PATHLESS_COLON_CITATION a colon too, so a comma-range passes today; the count rose by exactly the anchors added and none was refused. Two runs on the way caught my own history text writing a colon-digit range and a path-qualified anchor, and both were reworded before any commit.
2. Holds, but the measured discriminator is the authoring commit, not the last revision. Of the 40 re-pointed citations, 34 no longer pointed at their code at BASE or at the shipped pin; 5 still did (useAiSurface.ts, the clone test, the index-drift test, the unique-constraint test's line 141, the showcase apps index); and the memory-driver range never held the comment it quotes, even at the commit that authored it. Diffing each cited file between the item's last revision and BASE answers "unchanged" for 9 of 19 file pairs, including files whose cited lines had already moved before that revision, so that diff alone would have kept stale lines.
3. Holds. grid-file-upload.spec.ts stays in attachments-storage.inline-grid-receipt-cells' automated.ref, and summary-rollup.spec.ts stays in records-forms.field-type-matrix's source[4] and in master-detail-atomic-save's dropped-at-revision-5 note; only the three named items changed.

Part B mapping (39 fields, 40 citations; the 20 items each carry one revision bump and one history row; the 3 recipes carry neither field)

item	field	old citation	new anchor or prose	read at
access-security.record-view-read-audit	acceptance[2].clause	read-audit.ts,516-521	— packages/plugins/plugin-audit/src/read-audit.ts#buildRow writes both as null, for the reason the file header's section 'The row records NO field values, and that is load-bearing' gives)	BASE 39e93b9ef9
access-security.share-link-landing-page	fixtures.knownGaps[1]	SharedRecordPage.tsx,190-234	(objectui SharedRecordPage.tsx: the SharedRecordPage component's ai_conversations branch, with its messages-fetch effect and the ChatbotEnhanced readOnly transcript)	objectui 12dc7b47c340
access-security.share-link-landing-page	acceptance[1].verify	SharedRecordPage.tsx,143-176	the three round-trips (objectui SharedRecordPage.tsx: the component's password-gate branch, gate === 'password'):	objectui 12dc7b47c340
access-security.share-link-landing-page	acceptance[2].verify	SharedRecordPage.tsx,178-186	(objectui SharedRecordPage.tsx: the component's error branch, which renders the message fetchResolve sets for a 404 or a 410)	objectui 12dc7b47c340
access-security.share-link-landing-page	source[1]	branch,190-234	ai_conversations branch)	objectui 12dc7b47c340
ai.console-ai-surface-gating	source[0]	packages/app-shell/src/hooks/useAiSurface.ts,71-88	objectui packages/app-shell/src/hooks/useAiSurface.ts, its useAiSurfaceEnabled hook (the ONE signal:	objectui 12dc7b47c340
attachments-storage recipe qa-scratch-authz	sequence[1].source	packages/runtime/src/domains/meta.ts,319	(packages/runtime/src/domains/meta.ts#handleMetadataRequest, its PUT /metadata/:type/:name save branch, through packages/rest/src/rest-server.ts#metaItemPackageBinding)	BASE 39e93b9ef9
attachments-storage recipe qa-media-constraints	why	examples/app-showcase/src/ui/actions/index.ts,337	(examples/app-showcase/src/ui/actions/index.ts#ActionParamGalleryAction, its p_cover and p_attachments params — the dialog-widget/ADR-0059 upload-guard lane)	BASE 39e93b9ef9
attachments-storage recipe qa-media-constraints	sequence[1].source	meta.ts,319	(packages/runtime/src/domains/meta.ts#handleMetadataRequest for ?package=)	BASE 39e93b9ef9
attachments-storage.field-accept-maxsize-server-enforced	fixtures.requires[1]	storage-routes.ts,255	(packages/services/service-storage/src/storage-routes.ts#registerStorageFamily: its POST /storage/upload/presigned handler persists the pending sys_file row with the declared mimeType and size)	BASE 39e93b9ef9
attachments-storage.field-accept-maxsize-server-enforced	fixtures.knownGaps[0]	examples/app-showcase/src/ui/actions/index.ts,337	(examples/app-showcase/src/ui/actions/index.ts#ActionParamGalleryAction, its p_cover and p_attachments params)	BASE 39e93b9ef9
attachments-storage.field-accept-maxsize-server-enforced	source[5]	examples/app-showcase/src/ui/actions/index.ts,337	examples/app-showcase/src/ui/actions/index.ts#ActionParamGalleryAction)	BASE 39e93b9ef9
automation recipe qa-flow-status-doors	sequence[1].source	packages/runtime/src/domains/meta.ts,319	(packages/runtime/src/domains/meta.ts#handleMetadataRequest, its PUT /metadata/:type/:name save branch, through packages/rest/src/rest-server.ts#metaItemPackageBinding)	BASE 39e93b9ef9
automation.packaged-flow-subflow-disable-refusal	source[4]	examples/app-showcase/src/automation/flows/index.ts,707,795,816,1322,1339	examples/app-showcase/src/automation/flows/index.ts#TaskDoneNotifyOwnerFlow + examples/app-showcase/src/automation/flows/index.ts#ProjectClosureFlow + examples/app-showcase/src/automation/flows/index.ts#ReleaseSignoffFlow (the three stock caller→child pairs: each caller's subflow or map node names its child by config.flowName — showcase_notify_owner, showcase_closure_signoff and showcase_one_task_signoff)	BASE 39e93b9ef9
automation.packaged-flow-clone-contract	acceptance[3].verify	automation-flow-clone.test.ts,439	Codes pinned in packages/runtime/src/domains/automation-flow-clone.test.ts#RESOURCE_CONFLICT and packages/runtime/src/domains/automation-flow-clone.test.ts#RESOURCE_NOT_FOUND (its same-name 409 cases and its unknown-source 404 case)	BASE 39e93b9ef9
automation.setup-packaged-automation-board	acceptance[6].verify	PackagedAutomationPage.tsx,529	(cloneNameValid, which disables the clone dialog's submit button in objectui PackagedAutomationPage.tsx — so	objectui 12dc7b47c340
automation.setup-packaged-automation-board	source[1]	(529 clone-dialog validation,516	PackagedAutomationPage.tsx (the clone dialog's validation — cloneNameValid, which disables its submit button — and its role=alert rendering of clone.refusal)	objectui 12dc7b47c340
cli.dev-automigrate-policy	source[4]	sql-driver-index-drift.test.ts,322-342	+ sql-driver-index-drift.test.ts, its describe block "dev auto-reconcile (autoMigrate: 'safe')" (the pins:	BASE 39e93b9ef9
identity-auth.identity-import-wizard	fixtures.knownGaps[1]	service-sms/src/sms-plugin.ts,169	(a log transport is the no-provider fallback: packages/services/service-sms/src/sms-plugin.ts#resolveInitialTransport answers LogSmsTransport, and init logs 'no provider configured')	BASE 39e93b9ef9
identity-auth.identity-import-wizard	source[2]	auth-manager.ts,4074	+ packages/plugins/plugin-auth/src/auth-manager.ts#isEmailServiceAvailable + packages/plugins/plugin-auth/src/auth-manager.ts#isPhoneOtpDeliverable (the two gates	BASE 39e93b9ef9
identity-auth.two-factor-backup-codes	acceptance[3].clause	sys-two-factor.object.ts,120	('Previous backup codes are now invalid': the resultDialog of the regenerate_backup_codes action, packages/platform-objects/src/identity/sys-two-factor.object.ts#regenerate_backup_codes)	BASE 39e93b9ef9
identity-auth.first-run-owner-bootstrap	acceptance[0].verify	auth-plugin.ts,1936-1949	(packages/plugins/plugin-auth/src/auth-plugin.ts#registerAuthRoutes: its ADR-0069 D5 network-gating middleware lets /config and /bootstrap-status through)	BASE 39e93b9ef9
identity-auth.first-run-owner-bootstrap	source[6]	packages/cli/src/commands/dev.ts,339	packages/cli/src/commands/dev.ts#seedAdmin (seed-admin defaults ON	BASE 39e93b9ef9
identity-auth.self-signup-gate	variants[0]	audience-posture.ts,398-402	invitation carve-out admits — packages/plugins/plugin-auth/src/audience-posture.ts#decideAudienceAdmission, whose pending-invitation branch admits before the posture switch)	BASE 39e93b9ef9
identity-auth.self-signup-gate	variants[1]	audience-posture.ts,411-421	+tag irrelevant: packages/plugins/plugin-auth/src/audience-posture.ts#emailDomainAllowed, which the email_domain case of packages/plugins/plugin-auth/src/audience-posture.ts#decideAudienceAdmission asks)	BASE 39e93b9ef9
identity-auth.self-signup-gate	source[3]	apps/console/src/pages/auth/RegisterPage.tsx,69-88	objectui apps/console/src/pages/auth/RegisterPage.tsx (the RegisterPage component's getAuthConfig probe, and its effect that bounces to /login when decideSignUpOffer answers 'closed', which is disableSignUp;	objectui 12dc7b47c340
identity-auth.self-signup-gate	source[4]	apps/console/src/pages/auth/LoginPage.tsx,136,298	objectui apps/console/src/pages/auth/LoginPage.tsx (the LoginPage component passes registerUrl to LoginFormCard only once the /auth/config read is known and decideSignUpOffer answers 'form', so never under disableSignUp; the signUpDisabled state it used to keep is gone)	objectui 12dc7b47c340
identity-auth.email-verification-loop	steps[1]	LoginPage.tsx,346,360	(objectui LoginPage.tsx: the onError of its LoginFormCard)	objectui 12dc7b47c340
identity-auth.email-verification-loop	source[6]	apps/console/src/pages/auth/LoginPage.tsx,346,360	objectui apps/console/src/pages/auth/LoginPage.tsx (the onError of its LoginFormCard: EMAIL_NOT_VERIFIED → /verify-email-prompt redirect) + objectui packages/app-shell/src/console/auth/signInRefusalMessages.ts (signInRefusalMessages: the named error copy, which moved there from LoginPage.tsx)	objectui 12dc7b47c340
platform-core.docs-portal-render	source[0]	AppContent.tsx,176-185	+ AppContent.tsx, its systemRoutes (app-scoped /apps/:packageId/docs	objectui 12dc7b47c340
records-forms.field-unique-enforcement	acceptance[2].verify	memory-unique-constraint.test.ts,141	(pins: packages/drivers/driver-memory/src/memory-unique-constraint.test.ts, the cases 'update onto a taken value is refused and the row keeps its old value' and 'a row does not collide with ITSELF — an update that leaves the unique field alone passes')	BASE 39e93b9ef9
records-forms.field-unique-enforcement	acceptance[3].verify	memory-driver.ts,627-631	(packages/drivers/driver-memory/src/memory-driver.ts#updateMany 'Prepare and CHECK every row before mutating any of them'; pin)	BASE 39e93b9ef9
records-forms.delete-behavior-matrix	source[2]	examples/app-showcase/src/data/objects/invoice.object.ts,184	examples/app-showcase/src/data/objects/invoice.object.ts#InvoiceLine (its invoice master_detail, deleteBehavior 'cascade') + examples/app-showcase/src/data/objects/invoice.object.ts#Invoice (its required account lookup, the required-FK escalation);	BASE 39e93b9ef9
records-forms.field-history-tracking	fixtures.requires[1]	task.object.ts,60	(examples/app-showcase/src/data/objects/task.object.ts#Task: its status and priority fields declare trackHistory)	BASE 39e93b9ef9
records-forms.field-history-tracking	source[3]	task.object.ts,60	, examples/app-showcase/src/data/objects/task.object.ts#Task (its status and priority fields declare trackHistory)	BASE 39e93b9ef9
search.command-palette-navigation	acceptance[0].verify	CommandPalette.tsx,391-402	(objectui CommandPalette.tsx: its flattenNavigation function, and the CommandPalette component's per-type CommandGroup blocks)	objectui 12dc7b47c340
search.command-palette-navigation	source[2]	examples/app-showcase/src/ui/apps/index.ts,50-65,92-95,102-105	examples/app-showcase/src/ui/apps/index.ts#ShowcaseApp (the fixture: its navigation's page/object/dashboard/report declarations — the grp_data object leaves, and grp_analytics's command-center page, dashboards and reports — inside nested groups)	BASE 39e93b9ef9
studio-authoring.org-override-registry-gate	source[5]	ResourceEditPage.tsx, 1311-1323	ResourceEditPage.tsx (its isArtifactItem test, the artifact-backed heuristic behind the read-only banner;	objectui 12dc7b47c340
studio-authoring.metadata-diagnostics-sweep	source[5]	DirectoryPage.tsx,242-254; console/AppContent.tsx,982	+ DirectoryPage.tsx (MetadataDirectoryPage: the package-scoped useGlobalDiagnostics sweep drives tile badges; the diagnostics link renders only when diagSummary.total > 0) + console/AppContent.tsx (the AppContent component's metadata/_diagnostics route)	objectui 12dc7b47c340

Area-level provisioning recipes (qa-scratch-authz, qa-media-constraints, qa-flow-status-doors) carry no revision or history (README, area-level fixtures), so their four edits are recorded here only.

Left alone, with reasons

• access-security.platform-owner-email-anchor source[5] / source[7]: env.ts#PLATFORM_OWNER_EMAIL_ENV,200 and admin-routes.ts#manage_platform_settings,261, the same residue behind an anchor that feat(qa): resolve platform-checklist symbol anchors against real source #15159 added later. Open PR feat(objectql,cli,plugin-webhooks)!: 18.x step 4: the walled lift (8b walled half, the os serve lift, the declared-webhook name guard, declared webhooks deployment-wide) #24667's head 1e8338d3b669 edits this item (steps[0], revision, history), so it is out of this claim, although the dispatch's excluded list does not name it. Read at the authoring commit 45397edf53, ,200 was resolvePlatformOwnerEmail and ,261 the DATASOURCE_ADMIN_CAPABILITY declaration, which is what a later round should anchor.
• The dispatch's excluded items (records-forms.object-hook-lifecycle, cli.migrate-plan-apply-json, cli.organization-ownership-ceremony, access-security.org-admin-assignment-boundary, the seven walled-theme items) and RUNNER.md: none carries a comma-range citation at BASE, and none was edited. PRs fix(types): an unevaluable hook condition's refusal answers 400 VALIDATION_ERROR at every data door #24714, feat(cli,plugin-audit): os migrate audit-mail-bodies masks the mail bodies that pre-#24688 audit and activity copies still hold in clear #24722 and feat(plugin-security): organization administrators assign positions and permission sets inside the D12 organization boundary #24732 have merged since the dispatch; their items stay out of this claim.
• The four count-after-file-name matches in the census table: they are not line citations, and two sit in dated history rows.
• docs/qa/platform-checklist/FOLLOW-UPS.md: 11 comma-range citations. It is the sweeps' decision register, whose own header says "append, never rewrite", and it is outside the area ledger and this claim's file surface.

Choice I settled myself: objectui citations in prose, not as objectui: anchors

The grammar declares a cross-repo objectui: form, but this corpus registers no objectui checkout (crossRepos is empty), so the gate would report such an anchor as skipped and never judge it. By the four axes: business need — a runner needs the code located, and the component and branch names do that at the pin; long-term fit — an anchor the gate cannot check looks verified and is not, the "declared ≠ enforced" shape; AI-error prevention — a later agent would read a #symbol as gate-checked; no scope creep — the cross-repo form would invite registering a checkout, a new gate surface nobody asked for. Round 7 re-pointed its objectui comma-range (ExternalDatasourcePanel.tsx) in prose too. Each objectui symbol named here was read at 12dc7b47c340.

Acceptance notes (noted, not filed)

• Residues of the same fix(qa): drop the rotting :NNN source-line citations from the platform checklist #13786 strip that carry no number, and so do not rot: parentheticals left as (…), (…) once their colon prefixes went, for example automation.packaged-flow-subflow-disable-refusal source[1] and search.command-palette-navigation source[0]. They point at no line; a reader loses only the position. carrier: qa(checklist): 18.0 release sweep anchor at 5b14b7f3 — re-point 5 red-row clauses + the wave's checklist-accuracy findings, fixture gaps and not-run handover (18 records) #24579.
• records-forms carries prose line numbers ("line 124", "lines …") in the permission-zoo text of one item; no gate reads them. carrier: qa(checklist): 18.0 release sweep anchor at 5b14b7f3 — re-point 5 red-row clauses + the wave's checklist-accuracy findings, fixture gaps and not-run handover (18 records) #24579.
• git merge-tree against PR feat(cli,runtime)!: the upgrade ceremony opens — v17 and 18.0 databases take it, and a server serves only a database it created or one the ceremony certified (18.x steps 5 and 6) #24681's head exits 1 with three conflicts (content/docs/deployment/cli.mdx, organization-ownership-boot-guard.ts and its test). The same three come from origin/main against that head alone, with none of this branch's commits, and cli.json auto-merges; the conflict is between feat(cli,runtime)!: the upgrade ceremony opens — v17 and 18.0 databases take it, and a server serves only a database it created or one the ceremony certified (18.x steps 5 and 6) #24681 and main.

Merge-tree against the open PRs that hold excluded items

Measured at head 347186527d (origin/main was still 39e93b9ef9):

PR	head	git merge-tree --write-tree exit	conflicts
#24731	aaec01614444	0	none
#24681	edb2db1e82b8	1	3, all between #24681 and main (control leg: origin/main against that head gives the same 3)
#24667	1e8338d3b669	0	none

Gates

Derived with node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths; 10 paths vs merge base 39e93b9ef): 13 families. All 13 ran on head 347186527d, each exit captured before any pipe, all exit 0: node scripts/check-ci-filter-parity.mjs; node scripts/check-closing-keyword-parity.mjs; node scripts/check-closing-keyword-parity.mjs --self-test; node scripts/check-comment-mask-corpus.mjs; pnpm --filter @objectstack/lint run check:doc-formula-expressions; pnpm check:cross-package-test-inputs; pnpm check:doc-authoring; pnpm check:driver-memory-census; pnpm check:gitlink-declared; pnpm check:nul-bytes; pnpm check:platform-checklist; pnpm check:refd-timer-probe; pnpm check:watch-hint-literal. --ran: "13 derived famil(ies) accounted for — 13 run, 0 NOT-MEASURED". check:doc-formula-expressions first answered exit 3 (its prerequisite: @objectstack/lint unbuilt) and exit 0 after bash scripts/pm/os-verify-lock.sh -c 'pnpm exec turbo run build --concurrency=2 --filter=@objectstack/formula --filter=@objectstack/lint' ("VERDICT command-exit 0"). check:platform-checklist runs in no per-PR CI, so the local reading is its evidence: "OK — 16 areas, 328 items (323 active, 1 planned)", symbol anchors 949/959.

Editing discipline: every area-file edit went through round 6's span-recording textual editor (span-edit.mjs, md5 25b593a1721e1baaadd973794394f622), extended with a replace op that pins its prior text (exactly one occurrence) and with recipe paths outside items. It never re-serialises a file, and it asserts that the new document equals the old with the declared ops applied, that every other item and top-level key is value-equal, that the changed leaf paths are the declared fields plus revision and one new history row, and that the text outside the edited spans is byte-identical.

No changeset: docs/qa/** ships in no package (the root package is private and no files[] names it), so the PR carries skip-changeset.

---

Generated by Claude Code

[objectstack-fleet]

Seat review

ACCEPT · domain:devx seat 1 · os-warren · session_01FM29ZqLTrnPNXxijioZwMp · 2026-10-20T04:46Z · head a5a72cf7f9 · card #24579, round 9 (claim 6282463055)

• Form. Draft, base main. The first line is Refs #24579: the wave anchor stays open, and §4 and the residues below are still owed. Then Clause-②: no. Assignee os-warren, labels size/m and skip-changeset. node scripts/pm/check-governed-merges.mjs --pr 24752 → NOT governed. git merge-tree against main 580fd4ed3c (PR feat(objectql,cli,plugin-webhooks)!: 18.x step 4: the walled lift (8b walled half, the os serve lift, the declared-webhook name guard, declared webhooks deployment-wide) #24667 included) is clean.
• Ledger invariants, parsed, merge base 39e93b9ef9 vs head.
  • 10 area files, 23 items changed. Each has exactly one revision bump and one appended history row with ref: "#24752".
  • No item is added, removed or reordered. Top-level keys are unchanged.
  • The only top-level edits are the 4 recipe leaves the PR body names: attachments-storage qa-scratch-authz and qa-media-constraints ×2, and automation qa-flow-status-doors. Each is a citation string.
  • None of the claim's excluded items is touched: records-forms.object-hook-lifecycle, cli.migrate-plan-apply-json, cli.organization-ownership-ceremony, access-security.org-admin-assignment-boundary. Neither is access-security.platform-owner-email-anchor, which PR feat(objectql,cli,plugin-webhooks)!: 18.x step 4: the walled lift (8b walled half, the os serve lift, the declared-webhook name guard, declared webhooks deployment-wide) #24667 held at pr_create.
• Part A, read against the seat ruling 6281811723.
  • records-forms.conditional-rules-grid (rev 8) drops grid-file-upload.spec.ts from automated.ref, names it as dropped, and removes the stale record that named only it. acceptance[2] and the ref now say that grid-parent-rules.spec.ts pins Qty and Unit Price, not the Product cell.
  • master-detail-atomic-save (rev 6) is narrowed by round 6's theme-B rule.
  • field-type-constraints (rev 2) stops citing summary-rollup.spec.ts for invoice.total. Its tilde range becomes sql-driver.ts#createColumn, a bounded in-place fix, named.
• Part B. The PR re-points 40 comma-range line citations. The census is 42 → 2; the 2 left sit in the item feat(objectql,cli,plugin-webhooks)!: 18.x step 4: the walled lift (8b walled half, the os serve lift, the declared-webhook name guard, declared webhooks deployment-wide) #24667 held.
  • Each new anchor names the code its prose describes. objectui and test files get prose, because the corpus registers no objectui checkout, and a #symbol the gate never checks would read as verified.
  • Spot-checked on the head: read-audit.ts#buildRow, memory-driver.ts#updateMany (its "Prepare and CHECK every row" comment is there), audience-posture.ts#emailDomainAllowed, dev.ts#seedAdmin, apps/index.ts#ShowcaseApp, sms-plugin.ts#resolveInitialTransport. All present.
• Gates.
  • The seat ran node scripts/check-platform-checklist.mjs at the head; it is in no per-PR CI. Exit 0: 16 areas, 328 items, line citations: 0 survive, symbol anchors: 949/959 resolved, 18 file floors held.
  • The dev's dispatch-gates union is 13 derived, 13 run, all exit 0; --ran reconciles.
  • Check-runs at a5a72cf7f9: 39, 31 success, 8 skipped, 0 failing or pending. node scripts/pm/check-expected-skips.mjs --pr 24752 → OK (all 8 skips in the roster). No review, no comment.
• Carried to the next round of qa(checklist): 18.0 release sweep anchor at 5b14b7f3 — re-point 5 red-row clauses + the wave's checklist-accuracy findings, fixture gaps and not-run handover (18 records) #24579 (the dev's out-of-scope findings).
  • access-security.platform-owner-email-anchor source[5] (env.ts#PLATFORM_OWNER_EMAIL_ENV,200) and source[7] (admin-routes.ts#manage_platform_settings,261): the item is free now that PR feat(objectql,cli,plugin-webhooks)!: 18.x step 4: the walled lift (8b walled half, the os serve lift, the declared-webhook name guard, declared webhooks deployment-wide) #24667 has merged as fc34d000fc. At the authoring commit 45397edf53 they were resolvePlatformOwnerEmail and the DATASOURCE_ADMIN_CAPABILITY declaration. docs(qa): re-author access-security.platform-owner-email-anchor for the Default Organization grant — PR #24373 landed #11979, the trigger the item names for its own re-author #24465 (p3, queued) re-authors other fields of the same item; whichever lands second merges the other.
  • Parenthetical residues of the fix(qa): drop the rotting :NNN source-line citations from the platform checklist #13786 strip that carry no number, and related-list-server-pagination's prose line numbers. No gate reads either; low value.
  • Not carried: FOLLOW-UPS.md's 11 comma ranges. It is the append-only decision register, outside the area ledger.

This seat readies the PR and queues it with auto-merge.

---

Generated by Claude Code