R3 runner, area 3 of 4. Part of the #9296 wave. No clause failed. Nine items were not reached and are recorded not-run rather than inferred.
⚠️ Title deviates from the wave's (FULL area) convention on purpose — 4 of 13 items consulted.
Environment fingerprint
Same tree as #9330 / #9332: framework e4e5c6e3c608b1b807c83a0d5b734f213eb1a1dd · .objectui-sha 665661ab093263f39f2e660a295ea615dbcee35a · console dist stamp equals pin (check:console-sha ✓) · port 3301 · file:/tmp/qa-r3b/access-security-rls-both-sides.db · --seed-admin · 2026-08-17. Driving used http://localhost:<port>.
Spec provenance: checklist from PR #9309 head fbd1c049 (open, held pending the maintainer), not merged main. Validator (pinned): 190 items (190 active); 30 kinds mapped, 0 waived. Selector area:platform-core → 13 runnable, 0 blocked.
Per-clause verdicts
platform-core.boot-health — rev 2, P0, mixed → pass
| clause |
verdict |
oracle evidence (text) |
A0 /api/v1/health 200 in the boot window |
pass |
200; on the smoke boot health went green 2.2s after launch |
A1 /api/v1/ready 200 (readiness, not just liveness) |
pass |
200 {"success":true,"data":{"status":"ready","state":"running"}} |
| A2 no ⚠ in the Flows banner, no ERROR lines |
pass |
banner: Flows: 29 flow(s) 22 bound to triggers (record_change, schedule, time_relative, api) · 7 draft — no ⚠. See the ERROR-line ruling-out below. |
| A3 console served + merged app metadata resolves |
pass |
GET /_console/ → 200 text/html; GET /api/v1/meta/app?id=showcase_app → 200, item carries navigation, _provenance, _diagnostics: {valid:true} |
| A4 served nav matches the authored app |
pass |
17 objectName entries served vs 17 authored in src/ui/apps/index.ts — same multiset, 13 unique objects, showcase_task ×5 on both sides. Nothing dropped at merge. |
| N0 no SeedLoader rejection lines |
pass |
banner: Seeds: com.example.showcase 130 rows; zero reject/fail/error seed lines in the boot log |
| N1 health 200 with ERROR lines is not a clean boot |
pass |
see below |
A2 / N1 — the one ERROR line was self-inflicted, and is not recorded as a defect. The boot log carries exactly one ERROR:
ERROR [Better Auth]: Invalid origin: http://127.0.0.1:3301
That is my own driver. My first probes addressed the server as 127.0.0.1, which better-auth rejects as an untrusted origin (403 INVALID_ORIGIN); I switched to localhost and every subsequent call succeeded. This is the RUNNER rule 2 automation self-check catching a fake finding: recorded as a driving artifact, not a boot-log failure. The clean-boot clause passes on the server's own behaviour.
Worth surfacing (not a failure of this item): boot diagnostics report 3 warnings, one of which is substantive — #8686, a seed/API tenancy split on showcase_field_zoo.f_autonumber:
"The install reports tenancy posture 'single' but holds 0 rows in sys_organization … Until this is resolved these objects run two autonumber counters and can mint the same "unique" identifier twice." (globalLastValue: 2, organizationLastValue: 0, organizationCount: 0)
A2 gates on ERROR-level lines and the Flows banner, so this WARN does not fail the clause, and #8686 already exists. Flagging it because "can mint the same unique identifier twice" is the kind of warning that reads as noise until it isn't.
platform-core.seed-integrity — rev 1, P0, api → partial
| clause |
verdict |
oracle evidence (text) |
| A2 boot log reports every seed load as success |
pass |
Seeds: com.example.showcase 130 rows; grep for seed lines matching reject/fail/error/skip returned nothing — the #3415 silent-rejection class is absent at this sha |
| A0 per-object counts equal the authored seed |
not-run |
the expected-vs-actual count table was not built |
| A1 seed values land verbatim (Specimen — Full spot-diff) |
not-run |
|
| A3 replay idempotence across restart |
not-run |
|
| A4 deliberately-unseeded fields stay unseeded |
not-run |
|
| N0 zero rows on a nav-visible object |
not reached |
depends on A0 |
The seed-data-thin trap is partially bounded from the other direction: objectstack verify (see #9330) exercised 23 showcase objects with needsFixture: 1 and createFailed: 0, so the corpus is not empty — but that is not the authored-count diff A0 asks for, so A0 stays not-run.
platform-core.metadata-registry-serving — rev 2, P1, api → partial
Pin meta-types-create-seed.dogfood.test.ts — 6/6 passed:
- "carries the dashboard create seed (widgets: [])"
- "carries the action create seed with a valid executable body"
- "omits a seed for report (a canvas-create type whose dataset is picked interactively)"
- "every seeded type that is also a registered /meta/types entry exposes its exact seed"
- "answers the same body as GET /meta — the two paths are one handler"
- "is not the /meta/:type catch-all wearing a 200"
That last one directly discharges the item's dispatcher-vs-hono-route trap. Of 7 acceptance clauses the pin covers the registry/seed-serving surface; the remainder was not separately driven, so partial rather than pass.
platform-core.metadata-authoring-roundtrip — rev 2, P1, mixed → partial
Pin package-first-authoring.dogfood.test.ts — 5/5 passed, covering the framework half including both sides of the writable-package gate:
- "saveMetaItem(runtime-only) into a loaded code package throws
writable_package_required" — the refusal
- "the same create into a fresh writable base id is NOT rejected (control)" — the entitled contrast
- "create → bind → publish → editable → discoverable → delete-cascade"
- "reassignOrphanedMetadata rebinds a legacy package-less row onto a base"
- "clones ACTIVE items into a new base, re-namespacing names AND rewriting references"
The item's automated.ref also names two objectui e2e specs (studio-record-page, studio-object-designer); those were not run, so the console half is unproven → partial.
Not-run (9)
No oracle consulted, not inferred: console-login (P0, browser) · nav-surfaces-render (P0, browser) · builtin-apps-nav-render (P0, browser) · settings-hub-roundtrip (P1, 13 acceptance clauses) · package-lifecycle-enable-disable (P1) · notification-center (P1) · shell-nav-personalization (P2, browser) · app-management-toggle (P2) · docs-audience-gate (P1 — new in the R4 sweep, never run).
docs-audience-gate deserves a note for whoever takes it: its knownGaps warn that stock showcase is not known to author a public or {permissionSet}-gated book, and that the org default "is the one audience every authenticated caller passes and therefore proves nothing about the gate". So step s0 (GET /meta/book, read each audience) must run first and decide how much of the item is blocked(fixture). Its A2 also has an unusual shape worth honouring: if packages/spec/src/system/book.zod.ts has no case pinning permissionSets: undefined → false, that absence is itself the finding.
nav-surfaces-render's automated.ref is a Playwright spec (examples/app-showcase/e2e/showcase-smoke.spec.ts), a different runner from the vitest pins used here. Chromium and Playwright 1.62.1 are present in this environment (/opt/pw-browsers, resolvable via the .pnpm path), so it is runnable — just not reached.
Coverage honesty
4 of 13 items consulted; no clause failed; 1 pass, 3 partial, 9 not-run. All four P0 browser items (console-login, nav-surfaces-render, builtin-apps-nav-render) are among the unreached — this area's remaining risk is concentrated there, and the console dist is built and stamped-correct, so there is no standing prerequisite blocking them.
Every verdict here rests on server truth (api, build/log, test). No DOM oracle was used; the one screenshot-class question (does /_console/ actually render) was answered by HTTP status + content-type + shell markup, not by a picture.
Links: #9296 (wave) · #9330 (area 1) · #9332 (area 2) · #9309 (spec provenance) · #8686 (autonumber tenancy split, pre-existing).
R3 runner, area 3 of 4. Part of the #9296 wave. No clause failed. Nine items were not reached and are recorded
not-runrather than inferred.(FULL area)convention on purpose — 4 of 13 items consulted.Environment fingerprint
Same tree as #9330 / #9332: framework
e4e5c6e3c608b1b807c83a0d5b734f213eb1a1dd·.objectui-sha665661ab093263f39f2e660a295ea615dbcee35a· console dist stamp equals pin (check:console-sha✓) · port 3301 ·file:/tmp/qa-r3b/access-security-rls-both-sides.db·--seed-admin· 2026-08-17. Driving usedhttp://localhost:<port>.Spec provenance: checklist from PR #9309 head
fbd1c049(open, held pending the maintainer), not mergedmain. Validator (pinned):190 items (190 active); 30 kinds mapped, 0 waived. Selectorarea:platform-core→ 13 runnable, 0 blocked.Per-clause verdicts
platform-core.boot-health— rev 2, P0, mixed → pass/api/v1/health200 in the boot window200; on the smoke boot health went green 2.2s after launch/api/v1/ready200 (readiness, not just liveness)200 {"success":true,"data":{"status":"ready","state":"running"}}Flows: 29 flow(s) 22 bound to triggers (record_change, schedule, time_relative, api) · 7 draft— no ⚠. See the ERROR-line ruling-out below.GET /_console/→200 text/html;GET /api/v1/meta/app?id=showcase_app→200, item carriesnavigation,_provenance,_diagnostics: {valid:true}objectNameentries served vs 17 authored insrc/ui/apps/index.ts— same multiset, 13 unique objects,showcase_task×5 on both sides. Nothing dropped at merge.Seeds: com.example.showcase 130 rows; zero reject/fail/error seed lines in the boot logA2 / N1 — the one ERROR line was self-inflicted, and is not recorded as a defect. The boot log carries exactly one ERROR:
That is my own driver. My first probes addressed the server as
127.0.0.1, which better-auth rejects as an untrusted origin (403 INVALID_ORIGIN); I switched tolocalhostand every subsequent call succeeded. This is the RUNNER rule 2 automation self-check catching a fake finding: recorded as a driving artifact, not a boot-log failure. The clean-boot clause passes on the server's own behaviour.Worth surfacing (not a failure of this item): boot diagnostics report 3 warnings, one of which is substantive —
#8686, a seed/API tenancy split onshowcase_field_zoo.f_autonumber:A2 gates on ERROR-level lines and the Flows banner, so this WARN does not fail the clause, and #8686 already exists. Flagging it because "can mint the same unique identifier twice" is the kind of warning that reads as noise until it isn't.
platform-core.seed-integrity— rev 1, P0, api → partialSeeds: com.example.showcase 130 rows; grep for seed lines matching reject/fail/error/skip returned nothing — the #3415 silent-rejection class is absent at this shaThe
seed-data-thintrap is partially bounded from the other direction:objectstack verify(see #9330) exercised 23 showcase objects withneedsFixture: 1andcreateFailed: 0, so the corpus is not empty — but that is not the authored-count diff A0 asks for, so A0 staysnot-run.platform-core.metadata-registry-serving— rev 2, P1, api → partialPin
meta-types-create-seed.dogfood.test.ts— 6/6 passed:That last one directly discharges the item's
dispatcher-vs-hono-routetrap. Of 7 acceptance clauses the pin covers the registry/seed-serving surface; the remainder was not separately driven, sopartialrather thanpass.platform-core.metadata-authoring-roundtrip— rev 2, P1, mixed → partialPin
package-first-authoring.dogfood.test.ts— 5/5 passed, covering the framework half including both sides of the writable-package gate:writable_package_required" — the refusalThe item's
automated.refalso names two objectui e2e specs (studio-record-page,studio-object-designer); those were not run, so the console half is unproven →partial.Not-run (9)
No oracle consulted, not inferred:
console-login(P0, browser) ·nav-surfaces-render(P0, browser) ·builtin-apps-nav-render(P0, browser) ·settings-hub-roundtrip(P1, 13 acceptance clauses) ·package-lifecycle-enable-disable(P1) ·notification-center(P1) ·shell-nav-personalization(P2, browser) ·app-management-toggle(P2) ·docs-audience-gate(P1 — new in the R4 sweep, never run).docs-audience-gatedeserves a note for whoever takes it: itsknownGapswarn that stock showcase is not known to author apublicor{permissionSet}-gated book, and that theorgdefault "is the one audience every authenticated caller passes and therefore proves nothing about the gate". So step s0 (GET /meta/book, read eachaudience) must run first and decide how much of the item isblocked(fixture). Its A2 also has an unusual shape worth honouring: ifpackages/spec/src/system/book.zod.tshas no case pinningpermissionSets: undefined → false, that absence is itself the finding.nav-surfaces-render'sautomated.refis a Playwright spec (examples/app-showcase/e2e/showcase-smoke.spec.ts), a different runner from the vitest pins used here. Chromium and Playwright 1.62.1 are present in this environment (/opt/pw-browsers, resolvable via the.pnpmpath), so it is runnable — just not reached.Coverage honesty
4 of 13 items consulted; no clause failed; 1 pass, 3 partial, 9 not-run. All four P0 browser items (
console-login,nav-surfaces-render,builtin-apps-nav-render) are among the unreached — this area's remaining risk is concentrated there, and the console dist is built and stamped-correct, so there is no standing prerequisite blocking them.Every verdict here rests on server truth (
api,build/log,test). No DOM oracle was used; the one screenshot-class question (does/_console/actually render) was answered by HTTP status + content-type + shell markup, not by a picture.Links: #9296 (wave) · #9330 (area 1) · #9332 (area 2) · #9309 (spec provenance) · #8686 (autonumber tenancy split, pre-existing).