[objectstack-fleet]

Fixes #24864
Clause-②: no — the internal QA ledger and its runner protocol; nothing published

Summary

records-forms.record-discussion-mentions goes to revision 5 with the clause #24802 deferred. Under RUNNER rule 2 it had to wait until #24785's fix merged. That fix, #24794, merged as e5b3de06a6.

• acceptance[9] (api oracle). An @mention notification reaches a mentioned user only when that user can read the comment's record. That holds whether the mention names them by user id or by email, and the author is never notified. The clause is stated at the level of fix(plugin-audit): @mention notifications reach only mentioned users who can read the record #24794's Summary. The gate sits at the producer, plugin-audit's mention writer. It judges each mentioned user in their own envelope, using the grant resolver, organization-claim vetting and parent-read evaluator a request uses.
• steps[13] drives the stock single leg: a same-organization member whom the record's own sharing excludes. It uses an owner-only showcase_private_note against a showcase_account the member can read. On a walled boot it repeats the note-shaped leg across organizations.
• fixtures.requires[2] adds the records and the second member.
• knownGaps[2]: the cross-organization leg needs a walled boot.
• negative[6] covers both directions: no notification to a non-reader, and no withheld notification for a reader.
• automated.ref names packages/plugins/plugin-audit/src/mention-recipient-gate.integration.test.ts and, per RUNNER rule 6, the layer it drives. That layer is the engine: a real kernel, ObjectQL engine and SQLite driver, with plugin-security's read layer played by a middleware and messaging by an emit() recorder. The pin therefore scores the clause partial at most and names HTTP and the real plugin-security as missing.
• source gains QA-source: #24783 · records-forms.record-discussion-mentions · acceptance[4] and the gate file.
• history gains a revision 5 row naming collaboration: authorization / tenancy-wall defect in record-discussion mention notifications under a walled posture (18.0 round-3 walled pass) — detail withheld pending maintainer #24785 and fix(plugin-audit): @mention notifications reach only mentioned users who can read the record #24794.

The clause describes the mechanism only; no step-by-step cross-organization reproduction is written anywhere. acceptance[4] is unchanged: it scores whose bell gains a row, while this clause scores which of the mentioned users may.

Verification

Stock showcase at 81120caac8 (this branch's base, with e5b3de06a6 on it). Build: pnpm build --concurrency=2, 76/76. Boot: objectstack dev --seed-admin, Tenancy: single, fresh DB. The server was stopped by process group afterwards.

• Member setup. Sign-up answers 403 SELF_REGISTRATION_CLOSED (audience posture invite_only). The member was minted with POST /api/v1/auth/admin/create-user and landed in the default organization. It changed its password and signed in again. Its session's activeOrganizationId is the default organization.
• Access, as the member. GET /api/v1/data/showcase_private_note/ID → 404; GET /api/v1/data/showcase_account/ID → 200.
• Comments. As admin, three sys_comment creates → 201 each: on the note mentioning the member by id; on the note by email; on the account mentioning the member by id and the admin itself.
• Member inbox (GET /api/v1/notifications): exactly one collab.mention, for the account comment, with actionUrl /showcase_account/ID and unreadCount 1. None for either note comment.
• Admin inbox: no collab.mention at all. Its three rows are seeded approval.requested.
• Log: two lines [audit] mention notification withheld {"reason":"cannot_read_source","userId":…,"commentId":…}, one per note comment. The email mention resolved to the member's id. The author is dropped without a line.

The single leg is green on current main, as expected after #24794. The cross-organization leg was not run: it needs a walled boot (knownGaps[2]).

Gates

On head 45f8e20b:

• node scripts/check-platform-checklist.mjs → exit 0. Output: check-platform-checklist: OK — 16 areas, 328 items (323 active, 1 planned).
• node scripts/pm/dispatch-gates.mjs --commands derived 13 commands, each run and each exit 0:
  • node scripts/check-ci-filter-parity.mjs 0
  • node scripts/check-closing-keyword-parity.mjs 0
  • node scripts/check-closing-keyword-parity.mjs --self-test 0
  • node scripts/check-comment-mask-corpus.mjs 0
  • pnpm --filter @objectstack/lint run check:doc-formula-expressions 0
  • pnpm check:cross-package-test-inputs 0
  • pnpm check:doc-authoring 0
  • pnpm check:driver-memory-census 0
  • pnpm check:gitlink-declared 0
  • pnpm check:nul-bytes 0
  • pnpm check:platform-checklist 0
  • pnpm check:refd-timer-probe 0
  • pnpm check:watch-hint-literal 0
• node scripts/pm/dispatch-gates.mjs --ran → exit 0: 13 derived, 13 run, 0 NOT-MEASURED.

Acceptance notes

• This item's knownGaps[0] still says the mention target is "a second signed-up user". On a stock boot, self-sign-up is closed (SELF_REGISTRATION_CLOSED, invite_only), so the new step mints the member through admin/create-user instead. knownGaps[0]'s own wording is the wave anchor's to correct, and is not touched here. It is noted for qa(checklist): 18.0 release sweep anchor at 5b14b7f3 — re-point 5 red-row clauses + the wave's checklist-accuracy findings, fixture gaps and not-run handover (18 records) #24579.
• The inbox row's discriminator field is type (collab.mention), under data.notifications[]. The verify text names that shape.

---

Generated by Claude Code

[objectstack-fleet]

席位核对 — ACCEPT (#24864, head 45f8e20bca)

Reviewed by the dispatch session session_01CfRDy7SuTfUqaTu2AEH2Hi against its own read of the diff (git diff origin/main... on the head), not against the report.

1. Shape. One file, the claimed surface: docs/qa/platform-checklist/areas/records-forms.json (+25 / −7). records-forms.record-discussion-mentions moves to revision 5 and gains:
   • acceptance[9]: an @mention reaches only a mentioned user who can read the record, by id or by email, and the author is never notified;
   • steps[13], negative[6], fixtures.requires[2] and knownGaps[2];
   • an automated.ref that names mention-recipient-gate.integration.test.ts and the layer it drives (the engine), so the pin scores the clause partial at most, per RUNNER rule 6;
   • QA-source: #24783 · … · acceptance[4], and a history row naming collaboration: authorization / tenancy-wall defect in record-discussion mention notifications under a walled posture (18.0 round-3 walled pass) — detail withheld pending maintainer #24785 and fix(plugin-audit): @mention notifications reach only mentioned users who can read the record #24794.
2. Disclosure. collaboration: authorization / tenancy-wall defect in record-discussion mention notifications under a walled posture (18.0 round-3 walled pass) — detail withheld pending maintainer #24785's fix (fix(plugin-audit): @mention notifications reach only mentioned users who can read the record #24794, e5b3de06a6) is merged, so RUNNER rule 2's wait is over. The cross-organization leg is stated as a walled-boot leg recorded blocked(fixture) without one. No step-by-step cross-organization reproduction appears.
3. Premise measured. The single leg was driven on a stock showcase at 81120caac8 and is green on main:
   • the member, who cannot read an owner-only note, got no collab.mention for either spelling, and two "withheld" log lines were written;
   • the account comment notified the member once, with the right deep link;
   • the author got nothing.
4. Gates.
   • CI on 45f8e20bca: 32 success, 13 skipped, 0 failing. Mergeable: clean.
   • Locally, check-platform-checklist.mjs and the 13 derived commands all exit 0.
   • check-governed-merges.mjs --pr 24869: NOT governed, +25 / −7.
5. Out-of-scope finding. The item's knownGaps[0] and personas[1] still describe the second user as self-signed-up. A stock boot is invite_only, so the second user is created through admin/create-user, as the new steps[13] says. That goes to the anchor qa(checklist): 18.0 release sweep anchor at 5b14b7f3 — re-point 5 red-row clauses + the wave's checklist-accuracy findings, fixture gaps and not-run handover (18 records) #24579's lane.
6. Landing. Clause-② no; not governed; ordinary queue landing: ready, then auto-merge.

---

Generated by Claude Code