QA run · surface:cli (21/26) · 580fd4ed · 2026-10-20 · 12 PASS / 9 PARTIAL / 0 FAIL / 0 BLOCKED / 5 NOT-RUN #24786

QA run record for the 18.0 round-3 top-up, server half (2): surface:cli. The anchor is #24579. The maintainer approved this top-up, dispatched from session session_01CfRDy7SuTfUqaTu2AEH2Hi on 2026-10-20. Earlier rounds ran at 5b14b7f3 (round 1, cli area record #24551) and ba4afcc2 (round 2, Tier 1 record #24598). Sibling records from this round: surface:build (filed next) and the walled pass #24783.

Environment fingerprint

• framework: 580fd4ed3c98a1752dfb0041b45cc713644fef7e. The console was NOT built, by dispatch decision. /_console/ answers 503 "The ObjectStack Console is not built …", and the plugin list shows ConsoleNotBuilt.
• build: pnpm install --frozen-lockfile (35 s), then pnpm build --concurrency=2, 76/76 tasks in 10 m 24 s. check-dev-prereqs is green.
• Tier 1: each pin file ran in its own vitest invocation (npx vitest run --maxWorkers=1 FILE from the owning package). *.e2e.test.* files ran with OS_TEST_TIERS=nightly, everything else without it. 61 files, 05:09–05:40 UTC.
• Tier 2: two runner agents ran in parallel, driving the built CLI (node packages/cli/bin/run.js, @objectstack/cli/18.0.0-next.5, node v22.22.0) on scratch copies, 05:09–05:26 UTC.
  • One runner had boot-free items. The other had boot-needing items: at most one server of its own at a time, each on a random high port with its own file DB, and OS_PORT exported beside -p.
  • Seed admin admin@objectos.ai.
• Tier 3: deferred, not run.
• checklist-select.mjs surface:cli --json resolved 26 runnable items. Revisions are listed below.

Scope (selector surface:cli, 26 items; revision each)

• Tier 1 (16): ai.mcp-stdio-fail-closed r6 · automation.flow-authoring-refusals-v18 r3 · cli.migrate-plan-apply-json r6 · cli.verify-verdict-exit-mapping r2 · cli.datasource-introspect-codegen r6 · cli.dev-automigrate-policy r3 · cli.migrate-meta-write-stored-and-all r2 · cli.organization-ownership-ceremony r2 · cli.meta-package-flags-and-explain r2 · cli.validate-v18-authoring-verdicts r1 · cli.verify-derived-proof-families r2 · integration-system.connector-stdio-default-deny r2 · integration-system.connector-descriptor-audit r2 · integration-system.external-schema-drift-gate r3 · platform-core.v18-boot-refusals r4 · platform-core.serve-composition-v18 r2
• Tier 2 (6): cli.dev-boot-contract r5 (P0) · cli.qa-suite-execution r7 · cli.migrate-meta-codemod r5 · cli.doctor-health-report r4 · cli.migrate-duplicates-inventory r8 · cli.hook-body-extraction-gates r4
• Tier 3 (4, not run): cli.flag-command-error-ux r3 · cli.doctor-deprecation-scan r3 · cli.lint-severity-exit-contract r1 · cli.plugin-manifest-build-contract r3
• P0 items (4): ai.mcp-stdio-fail-closed, cli.dev-boot-contract, cli.organization-ownership-ceremony, platform-core.v18-boot-refusals.

Tier 1: pins (RUNNER rule 6, evidence = the pin output only)

Every named file collected at least one test and reported 0 failed. Coverage is read from the clauses: a pin that is a unit or spec test does not score a clause whose oracle is a live os validate exit, a REST door or a log line, unless the pin itself drives that CLI or door.

• ai.mcp-stdio-fail-closed (P0) → PARTIAL.
  • Pin: mcp/src/__tests__/plugin.test.ts 17 passed.
  • Covers a[0], a[1], a[7]. Uncovered: a[2]–a[6] (live member-keyed MCP reads, aggregate, FLS gate, revocation).
• automation.flow-authoring-refusals-v18 → PARTIAL.
  • Pins, 9 files, 662 passed: flow-value-slot-template 172, flow-text-slot-template 32, flow-builtin-node-config-keys 38, flow-builtin-node-config-values 55, flow-bound-variable-name 115, flow.test 139, lint validate-expressions.flow-cel-root 80, retry-policy 17, anonymous-elevated-flow-gate 14.
  • Covers a[0]. Uncovered: a[1] (os validate exits and located refusals), a[2] (the PUT /api/v1/meta/flow door's 422s), a[3] (controls validate and save). These pins are spec and lint units that run neither the CLI nor the door.
• cli.migrate-plan-apply-json → PARTIAL.
  • Pin: format.exit-code 4 passed. Covers a[2] only, as the ref says. Uncovered: a[0], a[1], a[3]–a[6].
• cli.verify-verdict-exit-mapping → PARTIAL.
  • Pin: verify-tenancy-posture 7 passed. Covers a[4] only. Uncovered: a[0]–a[3].
• cli.datasource-introspect-codegen → NOT-RUN.
  • Pins, 3 files: remote-tables-twin.equivalence 10, external-datasource-service 42, envelope-unwrap 12 passed.
  • They cover only acceptance[0]'s narrowing half, so no full clause; a[0]–a[5] need the run.
• cli.dev-automigrate-policy → PARTIAL.
  • Pin: sql-driver-schema-drift 13 passed. Covers a[2]. Uncovered: a[0], a[1], a[3]–a[5].
• cli.migrate-meta-write-stored-and-all → PASS.
  • Pins, 5 files: test/migrate-meta-write 23, meta.report-order 21, semantic-relevance 22, canonicalize-stored-flow 40, refused-shapes 46 passed.
  • The CLI pins drive the command over fixture trees.
• cli.organization-ownership-ceremony (P0) → PASS.
  • Pins, 8 files, 168 passed: apply-flags 7, organization-ownership-apply 112, occupancy.integration 5, dialect 19, apply-organization-ownership-gate.integration 5, comment-reactions.integration 7, host-supplement.integration 7, release-refusal 6.
  • Also corroborated live; see "Closed-card verification" (platform-checklist + cli: three findings from the 18.0 QA sweep at 5b14b7f3 — two clauses mis-asserted against documented contracts, and a refusal that prescribes a withdrawn command (family card) #24567 row 3).
• cli.meta-package-flags-and-explain → PASS.
  • Pins, 5 files: register-package 8, delete-reset-carriers 29, register-force 7, explain-rule-id 14, delete-noop-line 7 passed.
• cli.validate-v18-authoring-verdicts → PARTIAL.
  • Pins, 7 files: define-seed-record-keys 9, validate-field-existence-spellings 31, stack-duplicate-entry 138, master-detail-required 24, stack-cbp-extension-master 12, validate-component-props 89, stack-email-sms 16 passed.
  • Covers a[0]. Uncovered: a[1] (each arm fails os validate, exit ≠ 0, and build refuses) and a[2] (the controls pass). These are spec and lint unit pins and none runs the CLI.
• cli.verify-derived-proof-families → PASS.
  • Pins, 5 files, 3 passed each: verify-reference-shapes, verify-delete-behaviors, verify-unique-scopes, verify-parent-write-reach, verify-dashboard-windows. They cover a[0] and a[2] (each file's NEGATIVE CONTROL, including "reports a cascade a hook undid … exits 1").
  • a[1] was run live, because the pins use their own fixtures, not the showcase. os verify --reference-shapes --delete-behaviors --unique-scopes --parent-write-reach --dashboard-windows --json on a showcase copy gave exit 0, hardFailures: 0, and all five reports present (referenceShapes, deleteBehaviors, uniqueScopes, parentWriteReach, dashboardWindows).
  • uniqueScopes.boot.legs.across reads not-run on single, which is the item's declared posture.
• integration-system.connector-stdio-default-deny → PASS. Pin: mcp-provider 19 passed.
• integration-system.connector-descriptor-audit → PARTIAL.
  • Pin: connector-descriptor-audit 9 passed. Covers a[0]. Uncovered: a[1], a[2].
• integration-system.external-schema-drift-gate → PARTIAL.
  • Pins: external-validation-plugin 17, external-validation-checkonboot 13, list-diagnosed-consumer-sweep 9 passed.
  • Covers a[1]–a[6]. Uncovered: a[0] (the live boot-abort arm, as the ref says).
• platform-core.v18-boot-refusals (P0) → PASS.
  • Pins: organization-ownership-boot-guard 22, …boot-guard.kernel 9, authz-identity-objects-boot-refusal 3 passed.
• platform-core.serve-composition-v18 → PASS.
  • Pins: serve-config-boot-residual.integration 14, serve-organization-record-page.e2e 2 (nightly tier), serve-datasource-mapping-before-sync.integration 2, datasource-mapping-before-schema-sync 3, serve-no-storage-boot-guard.integration 5, console.not-built 15 passed.

Tier 2: driven by hand

cli.dev-boot-contract (P0) → PARTIAL

Boot: OS_PORT=P pnpm -C examples/app-showcase exec objectstack dev --ui --seed-admin -p P -d file:RUN/dev/data.db.

• a[0] → blocked, environment (the console is not built, by dispatch decision).
  • Health answered 200 after about 20 s.
  • GET /api/v1/ready → {"success":true,"data":{"status":"ready","state":"running"}}.
  • /_console/ → 503 "Console is not built", so the console leg could not be consulted.
• a[1] → pass.
  • Boot 1: sign-in as admin@objectos.ai / admin123 → 200. A wrong-password control → 401 INVALID_EMAIL_OR_PASSWORD.
  • Boot 2 on the same DB with --admin-password changed99: admin123 → 200, same user id and createdAt; changed99 → 401.
• a[2] → pass. The Database line printed per variant:
  • -d file → that file.
  • -d :memory: → :memory: with SqlDriver(better-sqlite3).
  • OS_DATABASE_URL and DATABASE_URL → their files.
  • Config-declared default datasource (scratch stack) → its file, and no .objectstack/data was created.
  • Legacy dev.db → that file, with the notice.
  • Nothing chosen → file:CWD/.objectstack/data/objectstack.db.
• a[3] → pass.
  • 🧪 Fresh OS_HOME: /tmp/objectstack-dev-…, with the DB inside it. The directory was gone after SIGINT.
  • showcase_external.db side files are the documented dev --fresh claims the tempdir owns ALL persistent state, but app-declared cwd-relative datasource paths still write into the project tree and survive exit #5594 carve-out.
• a[4] → pass. ↪ server bound to port 47732 (requested 47731), and both ports answered health 200.
• a[5] → pass.
  • After touching src/ui/actions/index.ts: ⚠ dist/objectstack.json is OLDER than your sources — this boot serves the STALE build., then the newest-source and fix lines.
  • The server still came up.
• a[6] → pass.
  • In an empty directory: EXIT=1, stdout ✗ Config file not found in …, stderr Run in a directory with objectstack.config.ts, pass --artifact PATH-OR-URL (angle brackets in the original), or run from the monorepo root.
• negative[0]–[3] → pass.
  • A planted row survived a nothing-chosen restart.
  • --database-driver memory → oclif allowlist error, exit 2.
  • OS_DATABASE_DRIVER=memory|mingo|in-memory → exit 1 before any Database line.
  • -d memory:// and -d mingo:// → refused after the Database line, exit 1, naming --fresh and :memory:.
  • With a legacy dev.db present, no fresh objectstack.db was created.
  • The shifted port was always the one reported.
• steps[8] exit codes: plain dev SIGINT → 0; --fresh SIGINT → 130; --fresh SIGTERM → 143; no config → 1.

cli.qa-suite-execution → PASS

Boot: OS_PORT=P pnpm dev -- --fresh -p P.

• a[0] → pass. Bare os test --url … --token … from examples/app-showcase:
  • Found 1 test suites.
  • ✅ … [health-liveness] (42ms) and ✅ … [category-create-read-roundtrip] (194ms)
  • SUCCESS: All 2 scenarios passed., EXIT=0, and green again on a second run.
  • The category list was the same 4 rows before and after both runs.
• a[1] → pass.
  • A no-teardown copy passed reading back via {{categoryId}}.
  • An independent GET found exactly one created row.
  • A GET of the literal {{categoryId}} → 404.
• a[2] → pass. Assertion failed: data.status expected degraded, got ok under Step Failed: GET health expecting degraded, EXIT=1.
• a[3] → pass. … data.nope cannot be evaluated by 'contains' — expected an array or a string at that path, got undefined … Use 'is_null' …
• a[4] → pass.
  • qa/a-malformed.test.json is not a valid Quality Protocol suite (TestSuiteSchema): / ✗ scenarios.0.steps: Invalid input: expected array, received undefined.
  • No Scenario line followed it; the sibling suites still ran. EXIT=1.
• a[5] → pass. The scenario failed (❌), and the created row was gone after teardown.
• a[6] → pass.
  • ✅ api_call, wait, create_record, read_record, update_record, delete_record, query_records.
  • ❌ Unsupported action type in HttpAdapter: run_script.
• a[7] → pass. Bare os test took 4.9 s; 'qa/**/*.test.json' took 4.4 s, with the same suite in sorted order.
• negative[0]–[4] → pass.
  • Zero match: Found 0 test suites. … Exiting 0 — an empty match is not a failure., EXIT=0; with --fail-on-empty, EXIT=1.
  • With no token, health passes (✅) and the roundtrip fails (❌) with HTTP 401.

cli.migrate-meta-codemod → PASS

Planted on a scratch showcase copy: ui/Dashboard:refreshInterval and data/Object:externalSharingModel.

• Registries: retired-defs 224, retired-keys 273, semantic 483.
• a[0] → pass. Applied 5 mechanical change(s): includes:
  • dashboards[1].refreshIntervalSeconds: refreshInterval → refreshIntervalSeconds (dashboard-refresh-interval-to-refresh-interval-seconds)
  • objects[13].externalSharingModel: externalSharingModel → (removed) (object-external-sharing-model-removed)
• a[1] → pass. The md5 list of 162 files was identical across 4 no-write runs.
• a[2] → pass.
  • The snapshot is migrated, and ✓ Migrated stack is schema-valid agrees with schemaValid: true.
  • A pollInterval probe → ⚠ Migrated stack does not yet pass schema validation … with schemaValid: false.
• a[3] → pass.
  • The written tree run --from 17 has no Applied block, EXIT=0.
  • Identical runs diff empty.
  • --from 18 → ⚠ No migration step exists for protocol 18 → 18 … not a finding that the metadata is canonical.
• a[4] → pass. --from 15 → ✗ Cannot migrate from protocol 15: the chain's support floor is 16 (ADR-0087 D3), exit 1; with --json → unsupported_from_major, exit 1.
• a[5] → pass. 406 ⚠ [protocol N] advisories, separate from the Applied lines.
• a[6] → pass. --json exit 0, and --write --json exit 0.
• a[7] → pass.
  • Wrote 5 of 5 mechanical change(s) into 3 file(s): then ✓ Re-ran the chain over the written sources: no mechanical change remains.
  • diff -r shows only the 5 listed hunks.
  • A spread plant → not written [spread].
• negative[0]–[6] → pass.

cli.doctor-health-report → PASS

Run in a scaffold (create-objectstack blank, workspace-linked) and at the monorepo cwd.

• a[0] → pass. The unconditional rows print; there is no @objectstack/spec row in the scaffold; the NODE_ENV row prints only while NODE_ENV is unset.
• a[1] → pass. .env holding OS_TENANCY_POSTURE=isolatd → ✓ Environment files .env … — OS_TENANCY_POSTURE from .env, plus the posture error row, exit 1.
• a[2] → pass. ✗ Tenancy posture OS_TENANCY_POSTURE="isolatd" is not a recognized tenancy posture …; the later sections still print; exit 1, with no "Could not load config".
• a[3] → pass. A broken installed-packages/broken.json with no posture set → ⚠ Installed packages 1 installed-package ledger entry could not be read …
• a[4] → pass. Under isolated with the broken ledger, no ✓ Unique scope line prints; after removing the file it prints.
• a[5] → pass.
  • Staged: circular, unused and orphan-view warnings, each naming its offender.
  • Clean, with a view over the starter note: the three ✓ rows and ✅ Environment is healthy.
• a[6] → pass. Warnings-only runs exit 0; the posture-error runs exit 1.
• a[7] → pass.
  • ℹ Test coverage Skipped — no packages/spec/src in this directory (monorepo-only check) and the same for Deprecations.
  • -v adds the → Looked for … line; at the monorepo cwd the scans run.
• negative[0]–[5] → pass.

cli.migrate-duplicates-inventory → PASS

The fixture is a minimal scratch stack (qadup_ticket and qadup_note), seeded with SQL after one os dev boot (see accuracy finding C2).

• a[0] → pass. Every contract key is present (report duplicate-identifiers, reportVersion 2, globalPartition __global__, the counters, three preflight entries, the summary keys). The contract pin passed.
• a[1] → pass. The cross-partition 0001 is reported with partitions [__global__, org_…]; the within-partition DUPX appears nowhere.
• a[2] → pass. The sha256 of the row, sequence and sqlite_master dumps is identical before and after every run.
• a[3] → pass. idx_sys_metadata_overlay_active is blocked (qa_b_dup_view, rowCount 2), the other two are clear, and os migrate plan does not see it.
• a[4] → pass.
  • liveConditions reports globalLastValue: 1 and an org counter at 4.
  • With the org counter deleted the list is empty.
  • With the sequences table dropped, counters.status is absent and the duplicates are still reported.
• a[5] → pass. .filter is null, then {object:qadup_ticket}, then {object:qadup_note}.
• a[6] → pass.
  • OS_DATABASE_URL and --database-url give the same database and equal duplicates.
  • With a dropped table, .skipped names it with a reason.
• a[7] → pass.
  • The null-seam, contract and pre-repair pins: 3 files, 18 tests passed.
  • --database-url memory://qa → {"error":"boot_failed",…}, EXIT=1.
• negative[0]–[3] → pass.
  • --json → Nonexistent flag: --json, exit 2 (the declared contract).
  • stdout is one JSON document, and the boot logs go to stderr.

cli.hook-body-extraction-gates → PASS

FORBIDDEN_PATTERNS holds 14 entries; one hook was authored per entry.

• a[0] → pass.
  • ✗ --strict-body: 14 callable(s) lack a metadata body, with each worded reason (import and fetch → "declare a Connector recipe instead"; the host members each name their in-sandbox alternative).
  • Exit 1; --json → {success:false,error:"strict-body: missing body",issues[14]}.
• a[1] → pass. ["api.read"], ["api.write"], and the alias gives ["api.read"].
• a[2] → pass. ["crypto.uuid"], ["log"], and hash gives [].
• a[3] → pass. Declared capabilities are carried verbatim; a retired @capabilities comment is inert.
• a[4] → pass. The free identifier is BUNDLED with exit 0; --strict-body exits 1 with the same message.
• a[5] → pass. → Skipping legacy runtime bundle (all 9 callables are body-only), and no .mjs is left in dist.
• a[6] → pass.
  • ⚠ 14 handlers could not be lowered to a metadata body — bundled via the legacy runtime module instead (build still succeeds), with 14 lines, exit 0.
  • --json bodyExtractionWarnings carries 14 records.
• negative[0]–[3] → pass. negative[4] is skipped (a scope note).

Tier 3 handover (not run)

cli.flag-command-error-ux · cli.doctor-deprecation-scan · cli.lint-severity-exit-contract · cli.plugin-manifest-build-contract. Also not run: cli.datasource-introspect-codegen, whose pin covers no full clause. A run should drive it against the showcase showcase_external datasource.

Derived item verdicts

• PASS (12): migrate-meta-write-stored-and-all, organization-ownership-ceremony, meta-package-flags-and-explain, verify-derived-proof-families, connector-stdio-default-deny, v18-boot-refusals, serve-composition-v18, qa-suite-execution, migrate-meta-codemod, doctor-health-report, migrate-duplicates-inventory, hook-body-extraction-gates.
• PARTIAL (9): mcp-stdio-fail-closed, flow-authoring-refusals-v18, migrate-plan-apply-json, verify-verdict-exit-mapping, dev-automigrate-policy, validate-v18-authoring-verdicts, connector-descriptor-audit, external-schema-drift-gate, dev-boot-contract.
• FAIL (0). BLOCKED (0).
• NOT-RUN (5): datasource-introspect-codegen and the four Tier 3 items.
• No fail, so no reproduction rule is owed. No authentication or authorization finding on this surface.

Change against round 2 (ba4afcc)

There is no PASS → FAIL. The changes are coverage readings or environment:

• automation.flow-authoring-refusals-v18 and cli.validate-v18-authoring-verdicts: PASS in QA run · tier1:automated-pins (149/166) · ba4afcc2 · 2026-10-19 · 60 PASS / 89 PARTIAL / 0 FAIL / 0 BLOCKED / 17 NOT-RUN #24598, PARTIAL here.
  • Their non-test clauses have a CLI or REST oracle, and the pins are spec and lint units that drive neither. QA run · tier1:automated-pins (149/166) · ba4afcc2 · 2026-10-19 · 60 PASS / 89 PARTIAL / 0 FAIL / 0 BLOCKED / 17 NOT-RUN #24598 scored them as covered.
  • This is a reading of coverage, not a product change: every pin still passes.
• cli.dev-boot-contract: PASS in round 1 (QA run · cli (18/22) · 5b14b7f3 · 2026-10-19 · 17 PASS / 0 PARTIAL / 1 FAIL / 0 BLOCKED / 4 NOT-RUN #24551; round 2 did not rerun it), PARTIAL here. The cause is a[0]'s console leg on a tree without a console build, which this round chose not to build.
• cli.verify-derived-proof-families: PASS both times. This round adds the showcase live leg for a[1].
• cli.organization-ownership-ceremony: PASS both times. The pin count is now 8 files and 168 tests (7 files and 162 tests in QA run · tier1:automated-pins (149/166) · ba4afcc2 · 2026-10-19 · 60 PASS / 89 PARTIAL / 0 FAIL / 0 BLOCKED / 17 NOT-RUN #24598).
• Every other Tier 1 item: same verdict as QA run · tier1:automated-pins (149/166) · ba4afcc2 · 2026-10-19 · 60 PASS / 89 PARTIAL / 0 FAIL / 0 BLOCKED / 17 NOT-RUN #24598.
• Tier 2 items not rerun in round 2: the same PASS as round 1, except dev-boot-contract.

Closed-card verification (fixes from earlier rounds, re-measured at 580fd4e)

• A list view bound to an object outside the writing package's dependency closure skips the field-reference check: unknown columns fields are accepted (200 active, draft → publish) where the same body is refused 422 list-view-field-unknown #24563, list view outside the writing package's closure: the fix holds. Measured on a single showcase boot (scratch copy, os dev --seed-admin, own DB).
  • POST /api/v1/packages creates com.qa.vfy3 (no dependencies).
  • PUT /api/v1/meta/view/showcase_task.qavfy_r1?package=com.qa.vfy3 with columns title and zzz_nope → 422 INVALID_METADATA list-view-object-outside-closure at views[0].data.object.
  • The draft save is 200, then POST /packages/com.qa.vfy3/publish-drafts → outcome: "refused", failedCount 1, with the same rule.
  • Binding nosuch_obj → the same 422.
  • Controls: the overlay (no ?package) → 422 list-view-field-unknown at views[0].columns[1].field. A package declaring dependencies: {"com.example.showcase": "*"} → the same 422 list-view-field-unknown, and a known field → 200. The GET of the refused view → 404.
• platform-checklist + cli: three findings from the 18.0 QA sweep at 5b14b7f3 — two clauses mis-asserted against documented contracts, and a refusal that prescribes a withdrawn command (family card) #24567, three CLI-sweep findings: all three rows hold.
  • Row 1: platform-core.v18-boot-refusals is at r4, and acceptance[2] reads "the refused boot wrote no row and ran no D10 step …".
  • Row 2: access-security.security-catalog-one-holder-and-boot-report is at r2, and acceptance[1] reads "… 422 PLUGIN_REGISTER_FAILED whose message names each conflicting name and its holder".
  • Row 3, measured live on a v17-shaped SQLite: a v18 DB from os migrate apply --yes --json, then ALTER TABLE sys_platform_setting ADD COLUMN organization_id TEXT.
    • os migrate apply --allow-destructive --yes → exit 1, ✗ Refusing this --allow-destructive run: it would drop organization_id from sys_platform_setting, a drop the organization-ownership ceremony owns … 18.0 supports fresh installs only and does not upgrade a v17 database: keep a v17 database on a 17.x release until the 18.x release that carries the upgrade path, whose ceremony drops these columns itself … Nothing in this run was applied.
    • --json → message: refused_organization_ownership_unmigrated, tables: ["sys_platform_setting"].
    • The output no longer names os migrate organization-ownership --out or --plan-file. os migrate organization-ownership --help EXAMPLES now show the 18.0 refusal.

Checklist-accuracy findings / fixture gaps (for the anchor #24579, not extracted)

• C1 cli.migrate-duplicates-inventory acceptance[3] verify: plan's [Registry] Registered view: … lines are on stderr at 580fd4e, not stdout; stdout is pure JSON. The conclusion still holds.
• C2 cli.migrate-duplicates-inventory fixture: stock showcase declares one org-scoped identifier (showcase_field_zoo.f_autonumber). The within-partition repeat needs a second one, and seeding it needs the partitioned unique index (uniq_OBJ_organization_id_FIELD) dropped first, after which os migrate plan reports the drop as index_mismatch. requires[1] should say both.
• C3 cli.dev-boot-contract acceptance[0]: the console leg needs pnpm objectui:build. State it in requires or knownGaps; on an unbuilt tree /_console/ answers 503 "Console is not built".
• C4 cli.dev-boot-contract, config-default-datasource variant: the scratch stack's object must declare sharingModel, or compile fails on security-owd-unset and the boot exits 1.
• C5 cli.migrate-meta-codemod steps[6]: the warning now reads ⚠ Migrated stack does not yet pass schema validation — 1 refusal left after the chain. Resolve them, then run \os validate`:`.
• C6 cli.doctor-health-report acceptance[0]: a seventh unconditional row, Package-authored scheduled work (ON or OFF), always prints, and the config block also prints a Platform protocol row. The clause names six.
• C7 cli.hook-body-extraction-gates acceptance[6] verify still says "the forbidden seven"; steps[0] and acceptance[0] say fourteen, and 14 is measured.
• C8 Tier 1 refs that over-claim: automation.flow-authoring-refusals-v18 and cli.validate-v18-authoring-verdicts list unit pins with no clause qualifier, though their build and api clauses need the CLI or door run. cli.verify-derived-proof-families pins use their own fixtures, so acceptance[1]'s "on the showcase" needs the live run. The same class as QA run · tier1:automated-pins (149/166) · ba4afcc2 · 2026-10-19 · 60 PASS / 89 PARTIAL / 0 FAIL / 0 BLOCKED / 17 NOT-RUN #24598's "Bare file-list refs over-claim".
• C9 cli.qa-suite-execution requires[0]: pnpm dev -- --fresh -p PORT boots without a console build (check:console-sha skips with "No console dist").

Observations (no clause, not filed)

• The runtime bundle filename hash (objectstack-runtime.HASH.mjs) differed across back-to-back builds of an unchanged config: three consecutive builds of the 14-forbidden-hooks config gave three hashes.
• os migrate duplicates --object X still lists another object's liveConditions. The command documents that --object does not narrow the preflight, but says nothing on liveConditions.
• os test prints each failure as Error: Error: ….

Times

• Environment preparation: about 12 min (install 35 s, build 10 m 24 s, prerequisite check).
• Tier 1 pins: 05:09–05:40, sequential, sharing the container with the other runs.
• Tier 2: 05:09–05:26, two runners in parallel.
• Closed-card checks: 05:30–05:33.