QA run · tier2b:browser-1 (21/21) · e4e5c6e3 · 2026-08-18 · 7 PASS / 12 PARTIAL / 2 FAIL #9453

Tier-2B runner for the platform-checklist QA wave — 21 unpinned P0/P1 items on the browser / mixed surfaces, the half no automation touches. Every one of the 21 carries a verdict. Links #9296.

Environment fingerprint

Scope + per-item revision + derived verdict

7 PASS / 12 PARTIAL / 2 FAIL / 0 not-run items. No access-control finding — the #9296 carve-out was not triggered.

Per-clause verdicts

Oracle evidence is text only. Screenshot oracles are recorded as a one-line description of what the screenshot showed; no images are attached or linked anywhere.

1 · platform-core.boot-health — pass

Recorded observation: the boot log carries a ⚠ Boot diagnostics — 3 warnings banner — #8686 autonumber tenancy split on showcase_field_zoo.f_autonumber (already filed), plus two SHARING_NOT_ENABLED rule-backfill warns. All WARN, no ERROR; the clause as written is satisfied.

2 · platform-core.console-login — pass

3 · platform-core.builtin-apps-nav-render — partial

Server-truth control run alongside (member vs admin, direct API): sys_permission_set 403/200 · sys_audit_log 403/200 · sys_capability 403/200 · /api/settings/localization 403/200 · sys_user RLS-scoped 2 rows vs 4. The app-level gate is intact and no privileged dataset leaked.

4 · platform-core.settings-hub-roundtrip — partial

5 · platform-core.package-lifecycle-enable-disable — partial

Recorded observation: after disable, the data door 404s but GET /api/v1/meta/object/<probe_object> still answers 200 — a disabled package's schema stays readable through the metadata door. The clause's own verify (the data/route reads) is met, so this is filed as an observation, not a fail.

6 · platform-core.notification-center — partial

7 · records-forms.crud-roundtrip — FAIL (c2)

8 · records-forms.form-view-gallery — partial

9 · records-forms.record-discussion-mentions — partial

Positive observation for the wave: the mention autocomplete works — typing @QA opened the suggestion list with "QA Member T2B", and selecting it resolved the member's real id into the mentions array. The composer's action bar is [Bold, Italic, List, Inline code, Mention someone, Preview, Submit (Ctrl+Enter)].

10 · studio-authoring.first-run-loop — pass (contradicts the wave's standing "blocked")

This overturns the standing wave fact. #9296 and the R1 record say this item is blocked(fixture) because Studio is not installed. The app registration is indeed absent (GET /meta/app = showcase_app, setup, account) — but the Studio App Builder UI is reachable at /_console/studio and at /_console/apps/setup/component/studio/builder, and Home carries the "Build an app" tile the item's step 2 starts from. The whole loop closes. See CF-4.

11 · studio-authoring.view-authoring-live — FAIL (c3)

12 · studio-authoring.authoring-validation-not-persisted — partial

Known spurious _diagnostics banner (knownGap) was not observed this run.

13 · approvals.account-app-entry — pass

14 · approvals.per-group-signoff — partial

Recorded observation for the wave: a reassign to a user outside the node's group yields a 200 approve that satisfies no group and silently re-resolves the slate back to the group's real holder. Coherent with per-group semantics (a group needs one approval from that group), but the 200 gives the actor no signal that their decision counted for nothing. No clause covers it; recorded, not scored.

15 · approvals.inbox-metadata-actions — pass

16 · approvals.decision-action-matrix — pass

Named gap: resubmit-by-a-non-submitter was not attempted, so that half of c3's "refused for anyone but the submitter" is unproven.

17 · access-security.audit-log-browser — pass

18 · access-security.owd-save-gate — partial

19 · access-security.public-form-intake — partial

Also passed (step 8, no clause): a __proto__-nested owner_id/status smuggle landed nothing inherited — the row came back with owner_id:null, status:'new'.

20 · access-security.permission-matrix-edit-loop — partial

Useful mechanics recorded: the permission-set matrix key is objects, not objectPermissions — the server's guidance error says so outright ("Unrecognized key(s) … Did you mean objectPermissions → objects? Until #4001 these were dropped silently"). The grant field is permission_set_id and it wants the sys_permission_set row id (ps_…), not the metadata name; a runtime-authored set is projected into that table (ps_msxzisf0v1jy79ti | qa_t2b_set).

21 · access-security.capability-declaration-lifecycle — partial

Recorded: the four REQUIRE-side specimens exist and are correctly declared — GET /api/v1/meta/action (70 actions) lists showcase_zoo_perm_held (requiredPermissions:['showcase.export_data']), _missing (['showcase.restricted_ops']), _and (both), _empty ([]), all type:'script' on showcase_field_zoo. OpsPermissionSet grants showcase.export_data via systemPermissions as documented.

Reproduction rules

R-1 — records-forms.crud-roundtrip c2 · DELETE is refused for any object targeted by a multiple: true reference

Not a new defect. Already twice-derived and reported this wave — #9296 comment (R1) and #9351 (R3). Confirmed a third time here, and for the first time through the console door.

pnpm -C examples/app-showcase exec objectstack dev --ui --seed-admin -p 3161 -d file:/tmp/qa-wave/t2b-a.db
POST /api/v1/auth/sign-in/email  {"email":"admin@objectos.ai","password":"admin123"}
# create through the console: Accounts -> New -> name/industry/status -> Create   (POST /api/v1/data/showcase_account -> 201)
DELETE /api/v1/data/showcase_account/<id>

• expected: 200, row gone.
• actual: 400 — "The bare equality spelling { "f_lookups": value } WAS NOT APPLIED: "f_lookups" is a multi-value (or otherwise JSON-valued) field, stored by this driver as a JSON TEXT column … Use "$contains" for membership" — and GET /api/v1/data/showcase_account/<id> still answers 200.

Reproduced ×2 on distinct fresh ids in this run (sXI6lveJX_4Wv-km, eIvHMCjKKc0AvJ1R). Control ruling out "DELETE is broken": DELETE /api/v1/data/showcase_category/<id> → 200 on the same boot, same session.

R-2 — studio-authoring.view-authoring-live c3 · a runtime-authored view is accepted with a 200 state:'active' receipt but is served by no read door

New defect. P1. Not an auth/authz finding — a metadata read-path gap, so the recipe is published in full.

pnpm -C examples/app-showcase exec objectstack dev --ui --seed-admin -p 3162 -d file:/tmp/qa-wave/t2b-b.db
POST /api/v1/auth/sign-in/email  {"email":"admin@objectos.ai","password":"admin123"}   # use the bearer token it returns

# 1. baseline — the read door works for shipped views
GET  /api/v1/meta/view?object=showcase_task                 -> 200, 20 items

# 2. author a view container over the SAME object
PUT  /api/v1/meta/view/qa_t2b_task_views
     {"name":"qa_t2b_task_views","object":"showcase_task",
      "list":{"type":"grid","columns":["name","status"]}}
                                                            -> 200
     {"success":true,"version":"sha256:8f18ae7d…","seq":5,"state":"active",
      "message":"Saved view 'qa_t2b_task_views' (org=org_msxx3cuqkidc7f5c, state=active) [seq=5]"}

# 3. read it back
GET  /api/v1/meta/view?object=showcase_task                 -> 200, still 20 items; 'qa_t2b_task_views' ABSENT
GET  /api/v1/meta/view/qa_t2b_task_views                    -> 404 RESOURCE_NOT_FOUND
GET  /api/v1/meta/view                                      -> 200, 35 items; 'qa_t2b_task_views' ABSENT

• expected: the published/active container is served by GET /meta/view?object=… (the getViewsByObject consumer door) and by its direct name.
• actual: accepted, versioned, sequenced — and invisible to every read door. An authored view can never render.

The ?mode=draft → POST …/publish path behaves identically: draft receipt {state:'draft', seq:2}, publish 200 {"message":"Published draft — type=view, name=qa_repair_asset_views [seq=3]"}, then the same 404 / [] / absent-from-listing triple.

Scope measured, not assumed — 4 saves, 3 names, 2 objects, 2 independent boots:

Traps and confounds ruled out

• stale-console-bundle — n/a: every oracle is a direct HTTP call to the running objectstack dev; no console, no DOM.
• hydration-race — n/a: no DOM oracle anywhere in this finding.
• dispatcher-vs-hono-route — the oracle is the live server, not a simulated dispatch.
• automation self-check — plain fetch with a Bearer header; no coordinate clicks, no React controlled inputs. The server's own 200 receipt is the acceptance evidence.
• read door broken? No — the same request in the same session returns the 20 shipped showcase_task views.
• org-scoping mismatch? No — sys_organization holds exactly 1 row, org_msxx3cuqkidc7f5c, and GET /api/v1/auth/organization/get-full-organization resolves that same id as the session's active org: the write org and the read org are identical.
• writability? RUNNER's standing environment fact says view is in the overlay-allowed set, so a 2xx write is expected and observed. The failure is on the read side, after an accepted write.

Because c3 fails, c2 and c4 (the post-publish rendering clauses) are recorded blocked(dependency) — no screenshot was taken and no screenshot verdict is claimed.

Checklist-accuracy findings (for the wave anchor, not extraction)

• CF-1 — ?id= on /api/v1/meta/app keys on the app NAME. ?id=com.example.showcase returns {"items":[]} even authenticated; ?id=showcase_app returns the merged app. Re-confirmed; boot-health step 6 / c3 still carry the package-id spelling. (Already known from R1.)
• CF-2 — owd-save-gate c1 names a retired refusal. The item (rev 1) expects 403 owd_external_wider on a ?mode=draft PUT. That gate was retired by the [3 of #7891] Flip the registration: runtimeTypes gains object + permission/book — whole rule families cross the publish door #8310 maintainer ruling (2026-08-13) — object-posture-gate.ts says so in its header, and draft saves defer to the draft→active promotion by design. The live refusal is 422 INVALID_METADATA, rule security-external-wider-than-internal, raised at the active-state door. Item needs the code/status/door corrected and revision bumped.
• CF-3 — owd-save-gate's knownGap mispredicts which layer answers. It says R1 owd_widening_forbidden is reachable only via OS_METADATA_WRITABLE=object, and that a stock deploy answers WRITABLE_PACKAGE_REQUIRED first. On this stock deploy R1 answered directly with 403 owd_widening_forbidden.
• CF-4 — first-run-loop is NOT blocked on stock showcase. tracking: full platform-checklist regression against main @ e4e5c6e3 — five-round orchestration #9296 finding 4 and R1 record it blocked(fixture) because Studio is not installed. The app is indeed unregistered (meta/app = showcase_app, setup, account), but the App Builder UI is reachable at /_console/studio and /_console/apps/setup/component/studio/builder, Home carries the "Build an app" tile, and the whole loop closes (item 10 above: 6/6 clauses pass). The standing fact should be narrowed to "the Studio app registration is absent" and the item taken off the blocked list.
• CF-5 — permission-matrix-edit-loop c1 names a route that 404s for permission. POST /api/v1/meta/permission/<name>/publish → 404; the same sub-route works for view (200) and is mounted for object. The PUT lands state:'active' directly, so the publish step is unnecessary here — but the clause requires a 2xx from it.
• CF-6 — capability-declaration-lifecycle names the wrong object. The fixture block says the four specimens are "type:'script' on the zoo object"; they are on showcase_field_zoo. An invoke keyed on zoo returns "Action … not found on object 'zoo'", which reads like a missing specimen.
• CF-7 — settings-hub-roundtrip says 10 open-framework namespaces; the build serves 11. GET /api/settings enumerates branding, company, localization, auth, mail, sms, storage, ai, knowledge, feature_flags plus lifecycle (5 specifiers).
• CF-8 — console-login step 5's expiry gesture is wrong for this console. "clear the auth cookies for the origin" does not expire the session: the console authenticates with a bearer token in localStorage under auth-session-token, sent as an Authorization header (requests carry authHdr=true, cookie=NO; the only cookie, better-auth.session_token, is not used by the console's own client). Clearing cookies leaves a fully valid session, and the shell then legitimately renders authed data — which reads exactly like the "dead shell rendering stale data" failure c3 warns about. This run nearly filed that false P0; the automation self-check caught it. The step should say: sign out server-side (POST /api/v1/auth/sign-out) or clear localStorage as well.
• CF-9 — audit-log-browser c2's "Action filter" control does not exist as described. The console offers prebuilt filtered views (Recent / Writes / Auth / Config) plus a generic "Filter Records / Where / Add filter" builder, not an Action dropdown. Server-side narrowing is provable through the Writes view; the clause should name the actual control.

Fixture gaps

• FG-1 — the three platform apps are not all present on a stock boot. builtin-apps-nav-render's fixture block asserts Setup/Studio/Account "register as one-app packages … present on any stock boot, no showcase-specific fixture". Studio is not served (GET /meta/app?id=studio → {"items":[]} for admin and member alike), so three of the item's seven clauses cannot be completed. Either the fixture must install @objectstack/studio or the item must scope itself to the apps a stock boot actually registers.
• FG-2 — the capability REQUIRE-side specimens are unreachable on every surface this build boots. REST mounts no action-invoke route by design (capability-declaration-lifecycle: no shipped resource enforces a package capability server-side (no REST action-invoke route on this build) #7680, confirmed 404). The MCP run_action bridge refuses them at the ai.exposed opt-in gate — before the capability check and identically for every persona — so the ADR-0066 D4 actionPermissionError is never reached. Making c1 runnable needs either ai: { exposed: true } on the four predicate-matrix.action.ts specimens, or a build that mounts the dispatcher /actions domain.
• FG-3 — no credentialed persona holds the finance group. per-group-signoff c3 stays blocked: Ada Auditor (usr_showcase_auditor_demo) is a routable sys_user with no better-auth credential account, and neither can_override nor reassign substitutes — reassigning the slot to an out-of-group user produces a 200 approve that satisfies nothing. The item's own knownGap names the fix (provision the account with issuer local:credential); it remains unprovisioned on stock.
• FG-4 — no non-reading persona for showcase_account. crud-roundtrip c7 (clone RLS refusal) cannot be driven: the object is public_read_write, so no bound persona is unable to read the source row.
• FG-5 — the object designer will not open a runtime-authored object for editing. Both owd-save-gate c0 and authoring-validation-not-persisted c3 need the Studio designer's Settings/save path, but a published runtime object reads back as source "Artifact" with "This object is provided by an installed package, so it is read-only at runtime". A draft-state object in a writable package that the designer opens editable is the missing fixture.
• FG-6 — the public form's browser page route is unknown. public-form-intake c5 needs the anonymous rendered form; the publicLink value /forms/contact-us answers {"error":"Not found"} while /api/v1/forms/contact-us serves correctly.
• FG-7 — package commit history could not be exercised. GET /packages/:id/commits answers {"commits":[]} after two successful publish-drafts, and POST /packages/:id/publish reports "No metadata items found for package" for drafts saved with ?package=<id>. package-lifecycle c3/c4 need whichever publish path actually mints commits.

Other observations (no clause covers these)

• A disabled package's schema stays readable. After PATCH /packages/:id/disable, GET /api/v1/data/<obj> → 404 but GET /api/v1/meta/object/<obj> → 200.
• reassign across a per-group boundary is silently ineffective. Detailed under item 14.
• Boot diagnostics carry Seed loader writes untenanted rows while the REST path stamps an organization — one single-tenant install runs two autonumber scopes and mints duplicate business identifiers, silently (17.0.0 GA) #8686 on both instances: showcase_field_zoo.f_autonumber runs two autonumber counters (globalLastValue:2, organizationLastValue:0, organizationCount:0). WARN-level, already filed, fails no clause.
• Playwright confirmed again: executablePath=/opt/pw-browsers/chromium-1194/chrome-linux/chrome is required; nothing in this run contradicts the standing note.
• POST /auth/sign-up/email yields a genuinely loginable second persona — used throughout for every both-sides gate proof here. Confirms the R3 note.