QA run · card:12438 (15/15) · 6bff748b · 2026-09-29 · 6 PASS / 1 PARTIAL / 8 FAIL / 0 BLOCKED / 0 NOT-RUN #20674

Checklist run for the manual acceptance card #12438 (Epic #12150, ADR-0126 packaged-metadata customization), executed per docs/qa/platform-checklist/RUNNER.md by the domain:spec#5 seat's dispatched runner (seat post #19357; claim on #12438 comment 5893356874). Text-only record; no artifact of this run lands in the tree.

Environment fingerprint

Scope

Selector: every checklist item whose definition cites #12438 or ADR-0126 — resolved one id at a time with node scripts/checklist-select.mjs ID --json --include-blocked. The runner's own enumeration over docs/qa/platform-checklist/areas/*.json found exactly the same 15 items (no 16th). None is planned; none resolved as blocked.

Tier 1 — pinned automation (run first, cited as evidence)

• packages/qa/dogfood: test/packaged-activation-ledger-reach.dogfood.test.ts + test/action-params-contract.dogfood.test.ts — 2 files, 16/16 passed. The first describe ("Packaged-action disable is unavailable without the automation service — sys_metadata_activation has only one registrant #12359 — actions and NO automation service") passed all five of its tests, including its anti-vacuity control "the automation service really is absent from this composition".
• packages/runtime: action-activation-posture-gate.test.ts, automation-activation-posture-gate.test.ts, action-activation-dispatch.test.ts, automation-flow-clone.test.ts — 4 files, 75/75.
• packages/services/service-automation: activation-ledger-registration.test.ts, flow-activation-ledger.test.ts — 2 files, 31/31.
• packages/objectql: action-activation.test.ts — 18/18.
• packages/platform-objects: plugin.test.ts, apps/setup-packaged-automation-nav.test.ts — 26/26.
• packages/plugins/plugin-security: packaged-permission-set-lock.test.ts, packaged-permission-set-restore-leg.test.ts — 22/22.

⚠️ automation-flow-clone.test.ts is green while the live clone door answers 404 (see F-1): it calls the domain handler directly, so it cannot see the missing HTTP mount — the dispatcher-vs-hono-route trap exactly.

Derived item verdicts

Per-clause verdicts

Clause numbers are 1-based positions in each item's acceptance array. Oracle evidence is text (server truth first; a screenshot is described in one line, never attached).

platform-core.activation-ledger-registration-home (rev 2) — pass

platform-core.activation-ledger-row-contract (rev 2) — pass

platform-core.packaged-object-extend-only (rev 1) — pass

api-backend.packaged-action-disabled-dispatch (rev 2) — pass

api-backend.action-activation-door-contract (rev 2) — pass

automation.flow-toggle-kill-switch (rev 2) — pass

access-security.activation-write-operator-gate (rev 2) — partial

Side note (posture, not a verdict): a member's GET /api/v1/data/sys_metadata_activation answers 403 PERMISSION_DENIED. Several items describe the ledger reads as open; they are open to the admin only on this build.

automation.packaged-flow-disable-durable (rev 2) — fail

automation.packaged-flow-subflow-disable-refusal (rev 1) — fail

automation.packaged-flow-clone-contract (rev 1) — fail

automation.setup-packaged-automation-board (rev 2) — fail

access-security.packaged-flow-write-door-parity (rev 1) — fail

studio-authoring.packaged-automation-studio-lock (rev 1) — fail

studio-authoring.packaged-display-class-direct-edit (rev 1) — fail

access-security.packaged-permission-set-lifecycle (rev 1) — fail

Reproduction rules for every fail

F-1 — the flow clone door is not mounted on the HTTP server. Clauses: automation.packaged-flow-clone-contract c1, c4 (c2, c3, c5, c6, c7 blocked); automation.setup-packaged-automation-board c7 (c5 blocked).

1. Boot showcase as above; sign in as the seeded admin.
2. POST /api/v1/automation/showcase_urgent_task_alert/clone body {"name":"qa_urgent_alert_clone","label":"QA urgent alert clone"}.
3. Expected: 200 with the cloned flow and the clone notice (or the door's own 400/404/409 arms). Actual: 404 {"success":false,"error":{"code":"ENDPOINT_NOT_FOUND","message":"Not found"}} for every body, method and caller (anonymous too); GET /api/v1/automation/qa_urgent_alert_clone → 404 RESOURCE_NOT_FOUND. Positive control on the same prefix: POST /api/v1/automation/showcase_notify_owner/toggle {"enabled":true} → 200.
4. UI: Setup → Packaged Automation → Clone on any flow row → fill a legal name and label → Create clone → dialog alert "Not found"; network POST /api/v1/automation/(flow)/clone → 404.
   Mechanism (read, for the fix): the domain arm exists (packages/runtime/src/domains/automation.ts, POST /:name/clone), but registerAutomationRoutes in packages/runtime/src/dispatcher-plugin.ts mounts each /automation route explicitly and has no /:name/clone mount (none in its history), so Hono's not-found answers before the dispatcher runs. The route is also absent from packages/runtime/src/route-ledger.ts.

F-2 — after a restart, a ledger-disabled packaged flow's trigger is re-armed. Clause: automation.packaged-flow-disable-durable c3.

1. Boot with a file DB; admin: POST /api/v1/automation/showcase_urgent_task_alert/toggle {"enabled":false} → 200; GET /api/v1/automation/_status → enabled:false, bound:false.
2. Stop the server process entirely; boot again over the same DB file (OS_LOG_LEVEL=info to see the lines below).
3. GET /api/v1/automation/_status. Expected: enabled:false, bound:false. Actual: enabled:false, bound:true (stable after waiting).
4. Boot log order: "[Automation] Activation ledger: 1 packaged flow(s) are switched off for this installation and were left unbound — 'showcase_urgent_task_alert'." then "[Automation] Bound 30 flow(s) from the protocol at kernel:ready" then "Trigger registered: record_change".
5. POST /api/v1/data/showcase_task with priority: 'urgent': no run is recorded (execution is still refused), but the server logs at ERROR "Trigger-fired run of flow 'showcase_urgent_task_alert' failed (trigger 'record_change') — … the terminal failure is recorded in the flow's run history …" with the FLOW_DISABLED sentence, and GET /api/v1/automation/showcase_urgent_task_alert/runs (also ?status=failed) shows no such run.
   Mechanism (read, for the fix): AutomationEngine.registerTrigger (packages/services/service-automation/src/engine.ts) calls activateFlowTrigger for every unbound flow of the new trigger type without consulting isFlowEnabled, and trigger plugins register at kernel:ready, after hydrateFlowActivations ran in start(). registerFlow does consult the ledger; this path does not.

F-3 — the subflow refusal's own remedy cannot be followed (FOLLOW-UPS §8a D19). Clause: automation.packaged-flow-subflow-disable-refusal c5.

1. Admin: POST /api/v1/automation/showcase_notify_owner/toggle {"enabled":false} → 409 DELETE_RESTRICTED "… Disable the calling flow first, or leave this one armed."
2. POST /api/v1/automation/showcase_task_done_notify_owner/toggle {"enabled":false} → 200 (ledger row active false; /_status enabled false).
3. Retry step 1. Expected: 200 and a ledger row active false. Actual: 409 DELETE_RESTRICTED naming the now-disabled caller. Same on the map pair (showcase_release_signoff disabled, then showcase_one_task_signoff still refused).
   Mechanism: packagedSubflowCallers (engine.ts) scans registered flows with no activation check.

F-4 — write-door parity on a packaged flow. Clauses: access-security.packaged-flow-write-door-parity c2, c3. Detail withheld pending maintainer (RUNNER rule 2 carve-out); the reproduction stays with the runner session and was reported to the dispatching seat.

F-5 — Studio Automations pillar ignores the read-only package flag on two affordances (objectui). Clauses: studio-authoring.packaged-automation-studio-lock c3, c4.

1. Admin → /_console/studio/com.example.showcase/automations?surface=flow%3Ashowcase_urgent_task_alert (the package reads Read-only; GET /api/v1/packages → writable false).
2. Click the header "Enabled" switch. Expected: disabled or inert, no request. Actual: clickable; PUT /api/v1/meta/flow/showcase_urgent_task_alert?mode=draft&package=com.example.showcase → 403 ITEM_LOCKED; banner shows the server text; the switch and canvas status keep showing "Disabled" / "obsolete" until reload.
3. Click the start node; in the inspector change Label. Expected: inputs disabled or an announced will-not-persist state. Actual: inputs editable, the edit shows on the canvas, no write leaves the browser, nothing is announced, and it is gone after reopening the pillar.
   Mechanism (pinned objectui dd3f7e1b, packages/app-shell/src/views/studio-design/StudioDesignSurface.tsx): the pillar switch's disabled omits readOnly; the flow inspector is mounted with readOnly: false hardcoded. Residual of objectui#2259 (fixed for the Data pillar).

F-6 — the built-in system_overview dashboard: a published org overlay is never served. Clause: studio-authoring.packaged-display-class-direct-edit c3.

1. Admin → /_console/apps/com.objectstack.setup/metadata/dashboard/system_overview; select the "Total Users" widget; change its title to "Total Users (QA-12438)"; Publish.
2. Network: PUT /api/v1/meta/dashboard/system_overview?mode=draft → 200, POST /api/v1/meta/dashboard/system_overview/publish → 200 "Published draft".
3. GET /api/v1/meta/dashboard/system_overview?layers=true → overlay and effective carry the new title, overlayScope org.
4. GET /api/v1/meta/dashboard/system_overview and GET /api/v1/meta/dashboard → the first widget title is still "Total Users" (admin and member, with a cache-busting query parameter, after waiting); the Setup → System Overview board renders "Total Users".
5. Control on the same boot: the same PUT + publish on the showcase-packaged showcase_ops_dashboard → the plain read serves the new title.
   Notes: the built-in's served _packageId is com.objectstack.plugin-auth, while the dashboard is declared in packages/platform-objects/src/apps/dashboards/system_overview.dashboard.ts. Not re-tested across a restart. Overlays were reset afterwards (DELETE → reset:true).

F-7 — the packaged permission-set lock refusal is replaced in the Setup form. Clause: access-security.packaged-permission-set-lifecycle c6.

1. Admin → Setup → Permission Sets → row "Showcase Contributor" → menu → Edit; change Description; Update.
2. Network: PATCH /api/v1/data/sys_permission_set/(id) → 403 NOT_OVERRIDABLE with the clone-path sentence.
3. Rendered: banner and toast "You don't have permission to save this record." Expected by the clause: the server's clone-path sentence.
   Mechanism: objectui's form substitutes form.noPermissionToSave for permission errors unless the producer sets userMessage (ruled behaviour, objectstack#3821); the lock error sets none. Same class as The ownership-transfer refusal names the field it refused, but sets no userMessage, so every console substitutes an opaque 「no permission to save」 (from objectui#10108) #19397 (closed not_planned; its triage names a dogfood report of the opaque message as the reopen trigger).

Fixture gaps and environment blocks

• access-security.activation-write-operator-gate c5: no group/isolated posture boot on stock (enterprise organizations runtime) — blocked(fixture); card row D2.
• Card row F3 (upgrade from a pre-upgrade dataset): no pre-upgrade dataset on a stock boot — blocked(fixture); not simulated.
• The plain-member cells of the board needed a scratch set carrying only setup.access: a member without it cannot open the Setup app at all.
• Self-registration is closed (invite-only), so fresh members were created through POST /api/v1/auth/admin/create-user and had to change their password before any gate would answer (PASSWORD_EXPIRED otherwise).

Checklist-accuracy notes (for the wave anchor, not extracted)

• platform-core.activation-ledger-registration-home c5: the platform-objects array holds 46 names, not 41.
• studio-authoring.packaged-automation-studio-lock c2 names 422 writable_package_required; the live refusal is 403 ITEM_LOCKED (the /meta protocol layer answers first).
• automation.setup-packaged-automation-board c6/c8 assume a plain member reaches the page; the Setup app requires setup.access. The member-read posture of sys_metadata_activation (403 for non-admins) contradicts the "reads are open" wording in several items.
• studio-authoring.packaged-display-class-direct-edit: system_overview is served under _packageId com.objectstack.plugin-auth, not platform-objects; views are single items (showcase_task.default), not a container.
• platform-core.activation-ledger-row-contract step 7: the physical column list also carries __search.
• Observation, not scored: the layered read of the packaged flow showcase_urgent_task_alert reports editable: true, deletable: true, lock: "none" while the /meta door refuses writes to it.

Generated by Claude Code