v17 verification tracker — browser-verify every user-facing change in the 17.0.0 train #3909

Activity

1. os-zhuang

   self-assigned this

   on Jul 30, 2026
2. baozhoutao

   self-assigned this

   on Aug 1, 2026
3. baozhoutao commented on Aug 1, 2026

   

   baozhoutao

   on Aug 1, 2026

   Contributor

   More actions

   rc.1 verification run 1 — section F

   Environment: framework main @ 1ee48bc60 (post-rc.1), showcase example under os serve --dev --ui on an isolated SQLite datastore, @objectstack/console@17.0.0-rc.1 (the published vendored SPA, pin 7d9734d5e321) at /_console/, Node 22.22. Driven as admin@objectos.ai plus a second signed-up member for every two-principal check.

   19 items ticked. Highlights of what actually held up under a live request:

   • Actions (F1). An undeclared action name is refused with the prescriptive ADR-0110 404; script runs, flow dispatches (returns status:"paused" with the screen payload), and a url/modal action reaching the server is refused with a message naming its client-side nature. Param enforcement is strict by default and precise: missing required → 400 naming the param, unknown key → "Unknown action param … not declared on this action", bad option → the allowed list. Field validation localizes properly (Accept-Language: zh-CN → 优先级必须是以下值之一) and carries per-field fields[] with labels.
   • Sharing (F2). The ADR-0111 verb boundary is real: an edit-level share lets the recipient read and PATCH, and refuses DELETE (403) and share-management ("requires record ownership or Modify All Data (ADR-0111 D1)"). A criteria-less rule is refused with the ADR-0049 message. A non-participant cannot read an approval request (404). Anonymous data access is denied on both read and write, while audience:'public' book metadata is served without a session.
   • Query strictness (F3). Every silent-drop this train closed refuses correctly, each with an actionable message: unknown query param, sort/select/expand/dotted-path sort naming a missing field, non-AST $filter. Implicit field filters AND-merge with an explicit filter (verified by counts: 2 ∧ 1 → 1). deleteMany is ids-only (a where body is rejected), the batch cap fires at 200, and sorted and unsorted paging are exact partitions (page union == full set, no dupes/gaps).
   • Temporal (F4). +08:00 input stores as UTC …T10:30:00.000Z, time stores wall-clock 09:15:30, and a bare-day upper bound ($lte: '2026-08-15') covers the whole day on both date and datetime.
   • Analytics (F5). /analytics validates at the entry (unknown body key rejected by name), a sum measure emits SUM(total) not COUNT(*), $or/$not reach the SQL, and a monthly timeDimensions bucket projects into rows in date order.
   • New capabilities (F6). The multi-value lookup seed resolves (f_lookups: ['Northwind','Contoso'] → a two-id array). required enforces on write with per-field errors, and the Console form shows the same three fields as required. The approval chain worked end to end in the browser and over REST: submit → request created → structured reassign to a second user → that user approves → status: approved, and sys_approval_action attributes each decision to the acting user (submit/reassign → admin, approve → member). The screen flow ran from the list toolbar, collected input, and the write landed (assignee = the value typed in the dialog).
   • Boot/CLI (F7). os serve boots a stack with no compiled artifact; the undeclared-stack-key lint reports each key with a remedy (including the storage → OS_STORAGE_* guidance); rc.1 tarballs carry CHANGELOG.md and a files whitelist (@objectstack/client ships 10 files).

   Failures filed (7)

   #	Area	What
   #4431	actions	a sandbox capability denial answers 400 as a deliberate rejection — the crash contract (#3951) says 500 — and leaks the SandboxError: debug prefix
   #4432	metadata	/meta/<type> overlay writes don't normalize the type segment: plural vs singular land in different namespaces, one overlay row shadows the whole code-authored listing, and the row is undeletable
   #4433	sharing	deactivating a rule never withdraws its materialized grants — not on record touch, not after a full restart
   #4434	sharing	DELETE /sharing/rules/:idOrName 500s for both address forms — no sharing rule can be deleted over REST (compounds #4433: an over-granting rule is unrecoverable)
   #4435	data	PATCH/DELETE of a nonexistent record answer 200 success (record: null / success: true) where GET correctly 404s; deleteMany reports every typo'd id as deleted
   #4436	data	the unsupported-filter-operator refusal ships without error.code and leaks the [sql-driver] prefix (ADR-0112)
   #4437	analytics	a measure naming a missing field 500s with SQLITE_ERROR instead of a 400 naming the field

   Notes for the next run

   • Two toast strings in the Console are still English on a zh-CN session ("This flow runs on a single record — select a row first.", "Done") — worth a pass against the objectui i18n packs before RC exit rather than filing per-string.
   • The showcase's own dev script resolves a stale global @objectstack/cli@9.0.0 from the user PATH instead of the workspace CLI, which fails the boot with a misleading "plugin-approvals … not installed". Not a platform defect; worth a line in the contributor docs since it costs a debugging cycle.
   • Not yet covered in this run and still open in section F: the file/attachment axis (F6 #4208/#4285 gate), flow run summaries (selected/acted/skipped), os migrate value-shapes, and the F8 docs sweep.
4. baozhoutao commented on Aug 1, 2026

   

   baozhoutao

   on Aug 1, 2026

   Contributor

   More actions

   rc.0 verification run 2 — sections A / B / C

   Run 1 covered only the F supplement. This run works the rc.0 checklist (A–D) on the same environment (framework main @ 1ee48bc60, showcase under os serve --dev --ui, published @objectstack/console@17.0.0-rc.1, isolated SQLite, admin + a second signed-up member). 7 more items ticked — 26 of 59 total. Three new defects filed.

   A. Breaking behavior

   • Export opt-in (用户级 export 权限轴(接入 P1 预留的 userExportAllowed 槽) #3544/定时报表的 CSV 附件绕过用户级 export 权限轴(#3544 的第二道出数据的门) #3710/security 服务 getReadableFields 查询面(export 列投影的长期正解) #3547) — all five branches hold. A member_default user is refused (EXPORT_NOT_PERMITTED 403). Binding a set carrying viewAllRecords on showcase_invoice lets that user read every invoice (200) while export stays 403 — read genuinely no longer implies export. Adding allowExport: true to that one object flips export to 200, and a second object in the same set (no allowExport) stays 403, so the grant is per-object, not per-set. An empty result still emits the full header row plus content-disposition / x-export-format / x-export-limit. The anchor gate refuses both everyone and guest, and — checked with a set carrying only allowRead + allowExport, no VAMA — names the right reason: "it carries bulk export on 'showcase_announcement' (ADR-0090 D5/D9)".
   • ApiMethod shrink (P2:ApiMethod 枚举收缩至 6 原语(breaking,独立版本) #3543) — the authoring half is exemplary. enable: { apiMethods: ['upsert','aggregate'] } produces a per-value FROM→TO mapping (upsert: declare ['create','update'], aggregate: declare ['list']), the deny-all consequence spelled out ("After stripping, this whitelist is EMPTY — [] means DENY-ALL"), and a codemod path. Authoring apiMethods at object root is separately caught as an undeclared key.
   • Alias retirement ([P3] Retire the three deprecated aliases — via the ADR-0087 D2 conversion layer, not by deleting the keys #3855/feat(spec,lint)!: accept ADR-0109, remove agent.tools[], lint agent authoring, model AI exposure in tool resolution (#3820) #3894) — all four, and the migration runs. field.conditionalRequired → requiredWhen and action.execute → target are hard parse errors naming the rename; agent.tools and agent.knowledge are tombstoned with a paragraph each on what to do instead (not a silent strip). os migrate meta --from 16 reports both rewrites and --out produces a snapshot carrying requiredWhen / target. Note the shape: migrate rewrites the stack snapshot, it does not edit your TS source — worth stating in the upgrade guide, since the checklist wording ("rewrites all three") reads as an in-place codemod.
   • Approval participant visibility (审批请求的可见性是「按租户」而非「按参与者」——getRequest 用 SYSTEM_CTX 读、只按 organization_id 收窄 #3590). A non-participant authenticated user gets 404 on another user's request; after a structured reassign makes them a participant, 200.

   B. Removed surfaces

   • SDK removals verified by instantiating the client, not by grep (grep is misleading here — nlq/suggest/insights still appear in comments documenting their removal). On a live ObjectStackClient: permissions, realtime, workflow, views, projects.listTemplates are all undefined; client.ai exposes only chat, chatStream, complete, models, conversations, agents, pendingActions; client.notifications exposes only list, markRead, markAllRead (no device/preference delegates).
   • Marketplace move (POST /api/v1/packages is a publish-vs-install shape collision — REST registers first and shadows the dispatcher (#3587 finding) #3610). POST /packages is the install surface again ({"code":"VALIDATION_ERROR","message":"Package id is required"} — reachable, no collision).
   • /graphql → 404 ✅, but discovery still advertises the slot: services.graphql = {"enabled":false,"status":"unavailable","message":"No implementation ships for the 'graphql' slot — register a service under it to enable"}. That message invites someone to fill a slot for a surface v17 deliberately removed, and it contradicts the docs sweep's own run-1 fix (services-checklist was reduced to 16 services with every graphql row deleted). Left unticked pending a call on whether the slot should be dropped from CORE_SERVICE_PROVIDERS or the message reworded.
   • Not verifiable here: POST /packages/publish answers 405 (Allowed: DELETE, GET, HEAD, PATCH) — the route-manager's /packages/:id matches with id="publish" and shadows it. The ledger declares the publish route as source: 'direct-mount', disposition: 'server-only', so it is presumably registered only where the marketplace publish plugin is loaded. Worth confirming on a deployment that has it — the shadowing means route-registration ORDER decides the winner.

   New defects (3)

   #	Area	What
   #4441	data / RBAC	a lookup accepts an id that does not exist in the referenced object — including sys_position_permission_set.permission_set_id, so a grant row can point at nothing while the audience-anchor gate has to resolve that set to judge it. Found by accident: a shell variable expanded to FAIL and the platform stored it against the everyone position.
   #4447	data	created_at is client-writable on an ordinary PATCH and persists (1999-01-01 written and read back). updated_at and created_by are correctly protected — this is one field of the audit trio. Its metadata says readonly: false.
   —	—	(the two #3909 F-section notes from run 1 stand)

   While chasing #4447 I could not find any input on this build that produces a non-empty droppedFields: computed fields (f_formula, f_summary) are rejected 400 INVALID_FIELD, unknown fields 400, and system fields are simply written. The #3794 contract may only have live coverage on the FLS path — worth a targeted check before RC exit rather than assuming the C-section item passes.

   Remaining

   33 unchecked. The bulk needs setup this run did not build: a runAs:'user' record-change flow fired by a system write (#3760), a per-tenant unique specimen (#3696), multi-org / membership-grade (ADR-0108, ADR-0105), better-auth 1.7 account migration, datasource fail-fast (#3741), the files-as-records axis (ADR-0104), historical import, and the Console-side items (objectui#28xx). Section D (docs) is untouched.
5. baozhoutao commented on Aug 1, 2026

   

   baozhoutao

   on Aug 1, 2026

   Contributor

   More actions

   rc.0 + rc.1 verification run 3 — the remaining sections

   Continuing from runs 1–2. Same environment; this run built a dedicated probe stack (examples/rc1-probe, removed afterwards) for the items the showcase has no specimen for, plus a synthetic pre-v17 datastore for the migration items.

   40 of 59 ticked (was 26). Five new defects filed, one of them the most serious found across all three runs.

   🔴 #4467 — /analytics/query ignores record-level scoping

   A plain member with shares on 2 of 5 private notes:

   GET  /data/showcase_private_note              → total 2      ✅
   POST /analytics/query {cube, measures:[count]} → count 5      ❌
   POST /analytics/query {…, dimensions:["title"]} →
      returns the TITLES of all 5, including the 3 they cannot read
   

   Any authenticated caller who can reach /analytics can enumerate field values of every row of any cube-exposed object, past OWD, sharing rules and RLS. The other analytics items on the checklist (#4019 capability mount, #4010 entry validation, #4184 declared aggregates, #3650 dateRange, #3921 time ordering) all hold — the scoping layer is the piece that is absent; the returned data.sql carries only the caller's own predicates and no owner/share filter.

   Method warning for whoever re-tests: a viewAllRecords set left bound from an earlier test makes both paths agree at 5/5 and look correct. Confirm the data path returns fewer rows than admin before reading anything into the analytics numbers — I got a false negative from exactly this.

   Other new defects

   #	What
   #4462	an object mapped to an unreachable datasource silently reads/writes the DEFAULT store — boot succeeds, broken never appears in the log, /ready 200, listing says status:"unvalidated". Against all three claims of the A5 item.
   #4466	an admin override of a properly-staffed approver slate is recorded as an ordinary approval — sys_approval_action has no override column at all, so bypassing designated approvers is byte-identical to being one.
   #4455	os migrate value-shapes misses a lookup holding an embedded record object — the exact case its own docstring names — because ReferenceIdValueSchema is z.string().min(1). The gate then closes on evidence it never gathered.
   #4441	a lookup accepts an id that exists nowhere, including the RBAC permission-set link tables.

   Verified this run

   • Export axis (用户级 export 权限轴(接入 P1 预留的 userExportAllowed 槽) #3544/定时报表的 CSV 附件绕过用户级 export 权限轴(#3544 的第二道出数据的门) #3710/security 服务 getReadableFields 查询面(export 列投影的长期正解) #3547), all five branches. The decisive one: with viewAllRecords bound, the member reads every invoice (200) while export stays 403. allowExport flips it per-object; a second object in the same set stays denied. Empty result still emits the header row + content-disposition. The anchor gate refuses everyone/guest and — tested with a set carrying only allowExport, no VAMA — names the right reason ("carries bulk export").
   • The #1888 user-less fail-open is wider than the lint that guards it — record-change flows fired by a system write run UNSCOPED, unlinted #3760 user-less flow runs, all three assertions. A runAs:'system' flow's write fired a runAs:'user' flow; the latter was refused with the UnscopedRunDataAccessError naming runAs:'system', the originating write still succeeded, and the sibling system flow ran normally.
   • record_change flow start node binds to a single lifecycle event — no create-OR-update in one flow #3427 record-after-write. One flow, both legs: previous is null on create and the full prior snapshot on update.
   • 多租户缺陷:unique 物化为全局唯一索引、无视 tenancy,与按租户分裂的 autonumber 序列自相矛盾(跨租户必然撞号 + 存在性探测泄露) #3696 per-tenant unique. The index is literally UNIQUE (organization_id, sku); two tenants hold the same SKU, same-tenant duplicate is 409, and the message leaks no cross-tenant existence.
   • 审批流无法在「运行中」动态确定审批人——审批人在提交时即被 $trigger 快照锁定（动态路由 / 动态会签受阻） #3447 dynamic approver routing, end to end. Required decisionOutputs enforced on approve; an undeclared key rejected and the declared keys listed; stage 2 spawned its own request whose pending_approvers was exactly the user stage 1's lead named — expression resolution over vars.lead_review.next_reviewers works. lockRecord held during, released after (Approval: a dead approval run can leave the record RECORD_LOCKED (#3424 follow-up, expected-behavior 3) #3456).
   • ADR-0104 files, full chain. A PNG bound to accept:['application/pdf'] → 400 naming field and allowed types (direct API, not the widget); oversize → 400 naming both sizes; valid → stored as a sys_file id that reads back expanded to {id,name,size,mimeType,url}; download carries filename="ok.pdf" + application/pdf; anonymous download 401. os migrate files-to-references dry-run reports honestly and writes nothing.
   • P2:ApiMethod 枚举收缩至 6 原语(breaking,独立版本) #3543 apiMethods shrink — per-value FROM→TO mapping, the deny-all consequence spelled out, codemod path given. [P3] Retire the three deprecated aliases — via the ADR-0087 D2 conversion layer, not by deleting the keys #3855/feat(spec,lint)!: accept ADR-0109, remove agent.tools[], lint agent authoring, model AI exposure in tool resolution (#3820) #3894 aliases — all four hard-rejected with renames; os migrate meta --from 16 --out produces a snapshot carrying requiredWhen/target.
   • fix(cli,driver-sql): os migrate plan lists the datetime storage convergence (#3954) #3964 / fix(cli,driver-sql): defer migrate DDL until confirmed + detect SQLite occupancy (#3917) #3924 — migrate plan lists normalize_datetime_storage: created_at — 2 row update(s); destructive index changes gated behind --allow-destructive; occupancy detection names the holding pid.
   • ADR-0105 D12 — OS_TENANCY_POSTURE=group without @objectstack/organizations is a FATAL refusal with three remedies. ADR-0108 — sys_member.role is a four-value closed select, sys_member/sys_invitation are read-only over REST; the owner→org_owner projection is the deliberate ADR-0095 D3 boundary, not the retired channel.
   • showcase: 4/5 projects and 9/10 tasks are silently rejected on every boot (FSM initialStates vs seed data) #3415/os dev: surface seed / sample-data-heal outcomes in the boot summary (info logs are swallowed by the default warn log level) #3430 seeds — a seed row with a bad reference turns the banner yellow: ⚠ Seeds: com.rc1.probe 2 ok / 1 error ⚠ + the OS_LOG_LEVEL=info hint.
   • Console/docs — Kanban grows a 未分类 lane for a null-status row (objectui#2804); total stays the match count under a 3-row page (objectui#2873); SQLite datetime grouping buckets correctly (SQLite 上 Field.datetime 的 dateGranularity 分桶恒为 NULL —— 趋势图塌成一根柱子 #3773) and an empty bucket is a real null (空分组桶的键两条路不一致:下推 SQL 给 null,内存兜底给 "(null)"(不限日期分桶) #3839); /docs/releases/v17 renders with the Console section and Upgrade checklist, reachable from the sidebar (docs(releases,nav): v17 follow-up — Console gap backfill, sidebar restore, first docs sweep #3908).

   Two checklist-wording corrections

   1. Seeds. The item promises Seeds: X inserted · Y updated · Z skipped. That shape does not exist — printSeedSummary deliberately collapses the three into one N rows / N ok / M errors count and uses · to separate sources. The code's contract is coherent; the checklist text is stale.
   2. os migrate meta. "rewrites all three" reads as an in-place codemod. It rewrites the stack snapshot (--out), not your TypeScript sources.

   Still open (19)

   Mostly Console-side objectui items needing UI-level assertions (API console AI family, dropped-field toasts, quorum chips, historical-import wizard), better-auth 1.7 account migration (needs pre-existing social/SSO rows), the four items blocked on the defects above, and the two close-out items that can only run at changeset pre exit.

   Also unresolved from run 2: I still cannot produce a non-empty droppedFields on any input — computed fields 400, unknown fields 400, system fields are written. #3794's contract may only have live coverage on the FLS path.
6. baozhoutao commented on Aug 1, 2026

   

   baozhoutao

   on Aug 1, 2026

   Contributor

   More actions

   Final run — the checklist is worked through

   48 of 59 verified. The remaining 11 are now annotated inline: 10 are blocked on defects filed from this verification (they cannot be ticked until a fix lands), and 1 (changeset pre exit close-out) can only run after RC exit. Nothing is left untested for lack of effort.

   Four more defects this round, on top of the nine already filed.

   🔴 #4477 — screen-flow resume performs no server-side validation

   A two-field screen node (kind required; escalation_reason required + visibleWhen: "kind == 'escalate'"):

   resumed with	expected	actual
   {"kind":"normal"} — conditional field hidden	accept	200 ✅
   {"kind":"escalate"} — field VISIBLE, required, missing	reject	200 ❌
   {} — kind itself required, missing	reject	200 ❌
   {"kind":"normal","totally_bogus":"x"} — undeclared key	reject	200 ❌

   The render half is fine — the screen payload carries visibleWhen intact. But "honored in validation" passes only vacuously: nothing validates, so the conditional case cannot be got wrong. A client that posts straight to resume bypasses every required the author declared. This is the one gap in an otherwise consistent row — action params (#4213), record writes (ADR-0113), and approval decisionOutputs (#3447) all enforce their declared contracts, verified working.

   #4475 — every Setup System Overview tile reads 0

   Users 0 (actually 4), Sessions 0 (actually 16), all event counts 0. The widget's own response gives the cause:

   {"rows":[{"user_count":0}],
    "sql":"SELECT COUNT(*) AS \"user_count\" FROM \"sys_user\" WHERE created_at = $1"}

   An "all time" range is lowered to WHERE created_at = $1 — an equality test on a timestamp. The cube path lowers ranges correctly (>= $1 AND < $2), so this is specific to the dataset path. First screen an operator sees, every number wrong, no error surfaced.

   #4476 — docs date the #4286 removals to spec 18; they ship in 17

   Nine passages across three hand-written pages say query.cursor / distinct / joins / windowFunctions were "removed in @objectstack/spec 18". PROTOCOL_VERSION = '17.0.0', the package is 17.0.0-rc.1, and os migrate meta --from 16 labels all four [protocol 17]. A reader on 16 is told the break is a major away and plans accordingly. Found by the sweep run the tracker asks for — the sweep's fingerprint list should gain a version-number check, not just surface names.

   #4478 — quorum progress and per-group chips do not render

   The server publishes behavior:"quorum", minApprovals:2, per-approver group labels, and even a pre-rendered __nodeLabel: "Committee Sign-off (2 of 3)". The Console renders none of it: scraping the approval panel gives {lockBadge: true, approveBtn: true, quorumHint: false, groupChips: false}. An approver on a quorum node cannot see how many more approvals are needed. The lockRecord half of the same line does render (审批中已锁定 badge), so the panel is otherwise correct — this is specifically the progress surface. Fix belongs in objectui #2811; no framework change needed, the data is already on the wire.

   Verified this round

   • Sharing vocabulary (fix(sharing): 「完全访问」声明了删除/转移/共享，实现上与「编辑」等价 #3865/[P0] Metadata property liveness audit: ~half of all spec properties are dead; a cluster of security props is parsed-but-unenforced #1878). group and guest recipients rejected with the legal list; team / business_unit accepted; accessLevel:'full' stored as 'edit'. Note: the spec rejects type:'owner' (pinned by test) but the REST rule route silently drops type and any other unknown key — inconsistent with the 未知键静默剥离仍是全仓默认:把 #3405 的 strict 收紧从一个 schema 推广到整个可授权面(ADR-0078 完整性闸门) #4001 posture the data routes apply (a permission-set write rejects active with a prescriptive message). Worth a follow-up.
   • better-auth 1.7. sys_account carries a distinct issuer column, backfilled (local:credential), and id (row) is separate from account_id — the precondition for unlink-by-row-id. Password sign-in worked throughout all four runs.
   • droppedFields (审批场景下记录可写性的反馈全线失真:能改的显示「已锁定」,改不了的提示「更新成功」 #3794) — found it. The trigger is a readonly field, not a system or computed one:

     PATCH /data/showcase_contact/<id> {"lead_score":999}
     → x-objectstack-dropped-fields: lead_score;reason=readonly
     → body: {"droppedFields":[{"object":"showcase_contact","fields":["lead_score"],"reason":"readonly"}]}
     

     Both channels carry it. This closes the open question from runs 2–3 — the contract does have live coverage; computed fields 400 and system fields are a different path (created_at being writable is data: created_at is client-writable on an ordinary PATCH — the audit anchor can be forged silently #4447).
   • Historical import (data import: mid-lifecycle rows rejected by state_machine.initialStates — historical-data migration blocked (#3433 sibling) #3479/data import: a "historical" import can't preserve original timestamps / audit fields — updated_at is stamped now, readonly fields stripped on upsert (#3479 follow-up) #3493/Identity import: raw SQL leaks into row errors; DB constraint failures need sanitized, friendly messages #3566). A row with created_at: "2020-03-15" and status: "done" imports with the timestamp preserved and the state machine skipped. Dry-run row errors are human-readable and located: {"row":2,"field":"status","code":"invalid_option","error":"Status: \"NOT_A_STATUS\" is not a known option"} — no raw SQL.
   • FormSection.pane (feat(spec): FormSection.pane — explicit split-pane placement (objectui#2153 follow-up) #4160) — pane: "primary" / "secondary" reach the client in the view metadata.
   • AI family (B4) — /ai/nlq, /ai/suggest, /ai/insights answer 501 (honest empty slot), not 404 and not a fabricated response; /ai/agents serves the real surface.
   • ADR-0104 D3 wave 2 (feat(storage): 开启回收 — 释放的字段文件按部署门禁进入墓碑与回收 — ADR-0104 D3 wave 2 (PR-5b) (#3459) #4208) — on an unmigrated deployment an invalid media value is warn-first and says so ("accepted for now … run os migrate files-to-references --apply to migrate this deployment and enforce"), collection stays off. The strict FileReferenceIdValueSchema demonstrably works — it caught the showcase's own data-URI cover.
   • Docs sweep run 2 — every retired-surface fingerprint hit outside releases/ and references/ documents the removal correctly; the only drift is the version number in docs: nine passages date the #4286 query-surface removals to spec 18 — they ship in 17 #4476.

   One open judgement call for the maintainers

   /graphql correctly 404s, but discovery still reports a graphql service slot: {"enabled":false,"status":"unavailable","message":"No implementation ships for the 'graphql' slot — register a service under it to enable"}. That message invites someone to fill a slot for a surface v17 deliberately removed, and it contradicts the docs sweep's own run-1 fix (services-checklist reduced to 16 services with every graphql row deleted). Left unticked: whether to drop the slot from CORE_SERVICE_PROVIDERS or reword the remedy is a design call, not a test result.

   All 13 defects from this verification

   Security / correctness: #4467 (analytics ignores record scoping — reads values a caller cannot read), #4433 + #4434 (a sharing rule's grants cannot be withdrawn and the rule cannot be deleted), #4447 (created_at forgeable), #4441 (dangling lookup references incl. RBAC link tables), #4462 (unreachable datasource silently uses the default store), #4477 (screen resume unvalidated), #4466 (admin override unrecorded).

   Contract / envelope: #4431 (capability denial 400 vs the 500 the crash contract promises), #4435 (missing-record writes report success), #4436 (filter-operator refusal has no error.code), #4437 (analytics measure 500s with SQLITE_ERROR), #4432 (meta overlay type-segment phantom rows), #4455 (value-shapes gate misses its own headline case).

   UI / docs: #4475 (Setup overview all zeros), #4478 (quorum chips), #4476 (docs version drift).
7. baozhoutao commented on Aug 1, 2026

   

   baozhoutao

   on Aug 1, 2026

   Contributor

   More actions

   All defects from this verification are now rolled up in #4482 — 17 issues grouped as security/data-integrity (8), contract/envelope (6), UI/docs (3), with a suggested RC-exit triage and the two non-defect judgement calls (/graphql discovery slot; two stale checklist claims).

   Note a correction to my run-4 comment above: it said "13 defects". The grouped list was right, the total was a miscount — it is 17.
8. xuyushun441-sys

   added

   tracking

   domain:cli

   target:v17

   on Aug 3, 2026
9. baozhoutao commented on Aug 4, 2026

   

   baozhoutao

   on Aug 4, 2026

   Contributor

   More actions

   rc.3 verification — G1 regression + G2–G10 first pass

   Environment: main @ a1a855a28 (the rc.3 train tip — note rc.3's version commit c6a52d3a4 was tagged and published to the npm rc dist-tag but not merged back, so main's package.json still reads 17.0.0-rc.2 while main sits 56 commits past the rc.3 cut). Real showcase boot, two live principals, purpose-built probe stacks for the rest.

   73 of 113 ticked. Two new defects.

   G1 — 16 of 17 fixes verified landed, 1 residual

   I re-ran every original repro rather than trusting the close. The fixes are real and several are better than what I asked for:

   • analytics: /analytics/query ignores record-level scoping — a member counts and reads dimension values of records they cannot read #4467 (the aggregate-disclosure one) — member with shares on 2 of 5 notes: data 2, analytics 2, and dimensions:["title"] returns only the two titles they may read.
   • datasource: an object mapped to an unreachable datasource silently reads/writes the DEFAULT store — no boot failure, /ready still 200 #4462 — boot now fails, naming the datasource, naming the object routed to it, stating the consequence ("their reads/writes would otherwise land in a DIFFERENT database than the one they declare ⇒ fail-fast per ADR-0062 D5"), and offering OS_ALLOW_DRIVER_CONNECT_FAILURE=1.
   • sharing: deactivating a rule never withdraws its materialized grants — not on touch, not at boot #4433 / sharing: DELETE /sharing/rules/:idOrName answers 500 for both address forms — rules cannot be deleted over REST #4434 — deactivating a rule withdraws immediately (200 → 404); DELETE returns 204, not 500.
   • screen flows: resume performs no server-side validation — missing required fields and undeclared keys all complete the run #4477 — resume validates: missing required 400, undeclared key 400, valid 200 and the write lands. (Method note: the envelope is {"inputs":{…}}. I first tested flat and got a false failure — the docs say inputs, I was wrong.)
   • approvals: an admin override of a staffed approver slate is recorded as an ordinary approval — no override marker anywhere #4466 — via_override: true is written on the override decision, null on the ordinary one.
   • actions: sandbox capability denial answers 400 as a deliberate rejection, not the 500 the crash contract promises #4431 capability denial → 500 INTERNAL_ERROR, no SandboxError: prefix. data: created_at is client-writable on an ordinary PATCH — the audit anchor can be forged silently #4447 created_at unchanged. data: a lookup accepts an id that does not exist in the referenced object — including the RBAC permission-set link tables #4441 dangling lookup 400. data: PATCH/DELETE of a nonexistent record answer 200 success instead of RECORD_NOT_FOUND #4435 PATCH/DELETE missing → 404. data: unsupported-filter-operator refusal ships without error.code and leaks the [sql-driver] prefix #4436 INVALID_FILTER, no driver prefix. analytics: a measure naming a missing field 500s with SQLITE_ERROR instead of a 400 naming the field #4437 measure → 400. migrate value-shapes: a lookup holding an embedded record object passes the scan — the exact case the ADR-0104 D1 gate exists to find #4455 scan reports the embedded reference with a correct-id example.

   Residual → #5079. #4432's namespace normalisation, shadowing and immediate dispatch are all fixed, but after DELETE the overlay stays in the /meta listing while dispatch correctly 404s. The delete is real (reset:true, no sys_metadata row); only the enumeration view is stale — the mirror of the seam #4521 fixed on the write side.

   G2–G10 — what passed

   • ADR-0118 — sys_metadata_history.recorded_by is NULL on every row, no 'system' sentinel. Boot banner reads Tenancy: single (resolved posture, not the legacy boolean).
   • ADR-0119 atomic batch, proven by rollback. An atomic deleteMany of [valid, nonexistent]: the valid row comes back ROLLED_BACK, the missing one RECORD_NOT_FOUND, and the valid row still exists afterwards (GET 200). Per-row results carry the declared BatchOperationResultSchema shape with index + errors[], and the new NOT_ATTEMPTED code appears on rows after an abort.
   • G4 — the semantic reversal landed. An unevaluable hook condition now aborts: 400 Hook 'x' could not evaluate its condition (runtime: No such key: …) — operation aborted, naming the field and giving two remedies. And the root cause is gone: the rc.1 boot logged dozens of condition evaluation failed; treating as false — No such key: done; on rc.3 that count is 0 (bug(objectql): hook 条件对着「只含本次更新字段」的残缺 record 求值，取不到的字段被吞成 false —— 审计 hook 静默不触发 #4770 + bug(objectql/docs): hook condition 的 CEL 作用域只绑定 record —— 文档教的 previous.x / ctx.record 根本不存在,过渡型条件写不出来 #4784).
   • G6 — a env: ['prod'] seed loads 0 rows in dev (fix(seed): enforce Seed.env against the runtime environment #4836); NOW() resolves per field type (datetime → full instant, date → calendar day, data: the NOW() defaultValue token is unresolved on non-SQL datasources — the engine stamps the literal string, and the record validator then rejects the insert #4597); a fresh DB reports "Physical schema is in sync — nothing to migrate" instead of the phantom drift rc.1 showed ([schema-drift] Fresh DB boots "drifted": detector can't read COALESCE index columns, then tells the operator to --allow-destructive away a legitimate unique index #4884).
   • G7/G8 — the retirement diagnostics are the best I have seen in this codebase. areas[].visible doesn't just say "removed": it explains the key was a gate that failed open, which layer to move to, and that server-enforced gating requires the top-level tree because "the server does not walk areas". datasource.retryPolicy warns against renaming your way around it because hook.retryPolicy is a genuinely-enforced different key. composeStacks (composeStacks silently drops every non-array top-level key — api: today, server: as of #4910 #5005) is three-for-three: undeclared key warns, conflict throws naming both stacks, same value passes.
   • G10 docs sweep run 3 — every fingerprint hit for this window's retired keys is either documenting the removal or a same-name-different-thing (a plugin's healthCheck() method, responsiveStyles). Clean.

   New defect → #5086

   allowRuntimeCreate: false is not enforced. #4509 set the flag on job and its changeset says "no 'create job' in Studio or via PUT /meta". It still creates one:

   PUT /api/v1/meta/job/rc3_runtime_job {"schedule":{"type":"cron","expression":"0 0 * * *"},"handler":"nope"}
   → 200 "Saved customization overlay (env-wide) — type=job"     … and it lists, with handler "nope"
   

   agent, the only other flagged type, behaves the same. supportsOverlay: false looks equally unenforced — the success message calls the row a "customization overlay" for a type declared not to support them.

   This is the ADR-0049 failure mode one level up: the enforcement flag itself is the silently-inert declaration. It is easy to miss because a minimal payload 422s on schema validation first — only a payload that passes the schema reveals that the gate never runs. Studio presumably reads the flag to hide "create", so the UI honours a rule the API does not.

   Remaining 40

   Mostly G5 (metadata-plane honesty: publishDraft drain, DDL loudness, history/event_seq invention), G9 (client-react hook loops — needs a React harness), the G8 spec-rename family (compile-time, best covered by a typecheck of a consumer rather than a runtime probe), and the close-out item that can only run at changeset pre exit.
10. baozhoutao commented on Aug 4, 2026

    

    baozhoutao

    on Aug 4, 2026

    Contributor

    More actions

    rc.3 verification — complete

    108 of 113 verified. The 5 open items are: 2 blocked on defects filed from this pass (#5086, #5088), 2 close-out items that can only run after changeset pre exit, and the #4432 residual tracked in #5079.

    Three new defects this round, on top of the seventeen from the A–F passes (all of which are now closed and re-verified as genuinely fixed, not merely closed).

    New defects

    #	What
    #5086	allowRuntimeCreate: false is not enforced. PUT /meta creates job and agent items the registry declares code-only. supportsOverlay: false looks equally unenforced — the success message calls the row a "customization overlay" for a type declared not to support them. This is the ADR-0049 failure mode one level up: the enforcement flag itself is the silently-inert declaration.
    #5088	updateMany runs hooks for a nonexistent id. With no stored record to merge, the hook condition evaluates against a payload-only record, #4775's abort fires, and the row fails INTERNAL_ERROR accusing a correct hook of naming an undeclared field — where single-record PATCH correctly answers RECORD_NOT_FOUND. Under atomic one stale id poisons the whole batch via NOT_ATTEMPTED.
    #5079	#4432 residual — a deleted overlay stays in the /meta listing while dispatch correctly 404s.

    The seventeen earlier fixes: verified, not assumed

    I re-ran every original repro. All landed. Several exceed what was asked:

    • datasource: an object mapped to an unreachable datasource silently reads/writes the DEFAULT store — no boot failure, /ready still 200 #4462 now fails the boot naming the datasource, naming the object routed to it, stating the consequence ("their reads/writes would otherwise land in a DIFFERENT database"), and offering an escape hatch.
    • analytics: /analytics/query ignores record-level scoping — a member counts and reads dimension values of records they cannot read #4467 — member with shares on 2 of 5 notes: data 2, analytics 2, dimensions:["title"] returns only their two titles.
    • screen flows: resume performs no server-side validation — missing required fields and undeclared keys all complete the run #4477 — resume validates three ways and the write lands. (The envelope is {"inputs":{…}}; I first tested flat and produced a false failure. The docs were right.)
    • Console approvals: quorum progress and per-group chips do not render, though the server sends minApprovals / group / __nodeLabel #4478 — the quorum UI now renders 会签 — 已完成 0 / 共 2 个组 with a progress bar and per-group chips finance 0/1, manager 0/1.
    • Setup System Overview: every KPI tile reads 0 — the dataset path lowers an all-time range to WHERE created_at = $1 #4475 — Setup System Overview reads Users 4, Sessions 7. Real counts.

    Highlights from the rc.2/rc.3 window

    • ADR-0119 atomicity proven by rollback, not by wording: an atomic deleteMany of [valid, missing] marks the valid row ROLLED_BACK and the row still exists afterwards.
    • The G4 semantic reversal is real and its root cause is gone. An unevaluable hook condition now aborts with a prescriptive 400; the condition evaluation failed; treating as false warnings that flooded the rc.1 boot log are down to 0. The same fail-closed posture holds for validation predicates (Script validation rules are silently skipped when their predicate fails to evaluate — fail-open is the wrong direction for a validation #4649).
    • Parent-scoped readonlyWhen is unenforced server-side — the field lock fails open, so a paid invoice's frozen lines can be rewritten over the API #4889 parent-scoped readonlyWhen is enforced server-side — on a paid invoice both product and unit_price come back in droppedFields with reason=readonly_when and the stored values are unchanged, while the same fields on a draft parent write normally. (My first attempt passed vacuously because I re-sent the existing value — worth stating for whoever re-tests.)
    • 审批记录锁 bindApprovalLockHook 对谓词式(multi)更新完全失效:if (!id) return 把「没解析到行」当成「允许」 #4778 the record lock holds on the predicate/multi path (RECORD_LOCKED per row), not just single PATCH.
    • The retirement diagnostics are the strongest work in this window. areas[].visible explains it was a gate that failed open and which layer actually enforces; datasource.retryPolicy warns against renaming your way around it because hook.retryPolicy is a genuinely-enforced different key; composeStacks is three-for-three (undeclared warns, conflict throws naming both stacks, same value passes).
    • G8 spec convergence — 15 renamed exports checked across 10 subpaths: no duplicate owners. G10 docs sweep run 3 — every fingerprint hit is documenting a removal or a same-name-different-thing; clean.

    One operational note, not a defect

    On this build /api/v1/meta/object takes ~11s (680 KB) and /meta/view ~9s. The Console blocks its splash on both, so a cold /_console/ load sits on "Connecting to data source" for ~20s before rendering. It does render correctly. Worth a look before GA if that is not expected for a 24-object app.
11. os-zhuang

    closed this as completedon Aug 4, 2026