QA run · surface:browser (61/61) · 316be321 · 2026-10-04 · 38 PASS / 8 PARTIAL / 15 FAIL / 0 BLOCKED / 0 NOT-RUN #21782

17.7 pre-release verification, browser half: every runnable surface:browser item against origin/main as it stood when the browser run started, with the Console built from the bumped pin (#21710). 17.7 is not cut yet, and the packages still read 17.6.0. The non-browser half is #21720 (subject 251a7dd4). surface:mixed gets its own record against the same subject. Text only. Screenshots were consulted live as oracles and are not attached. The durable truth stays in docs/qa/platform-checklist/areas/.

Environment fingerprint

• Framework (subject): objectstack-ai/objectstack 316be321 (fix(runtime)!: an app-authored body may not read the stored-metadata tables; it reaches them through the metadata API only (#21594) (#21660)). This is 25 commits past 251a7dd4 and includes the console pin bump chore(objectui): bump the console pin to 2e818d0b51ec (carries objectui#11466, #11574, #11578, #11581 and #11583) #21710. It ran in a dedicated detached worktree. Framework and console both built, and a smoke boot answered health 200 and /_console 200.
• Console: built from objectui pin 2e818d0b51ec (.objectui-sha, chore(objectui): bump the console pin to 2e818d0b51ec (carries objectui#11466, #11574, #11578, #11581 and #11583) #21710). Every lane checked that the dist stamp equals the pin. Console source questions were read at that revision (git show 2e818d0b51ec:{path}). For the "predates 17.6.0" notes, the 17.6.0 references are framework 617f25f8a and objectui pin 31971ff1e.
• Checklist: items, RUNNER.md and scripts/checklist-select.mjs come from the subject tree. The table gives every item's revision, and each one matches areas/*.json.
• App / boots: examples/app-showcase booted with OS_PORT={p} objectstack dev --ui --seed-admin -p {p} -d file:/tmp/qa1770fe/{lane}/{item}.db. Each item had its own file DB, and lanes used disjoint port ranges inside 44101–45909 (the egress proxy port 41333 was excluded). The browser was Playwright on /opt/pw-browsers/chromium. Admins signed in through the console form, so both the bearer and the cookie halves existed. Members were minted with admin invite-member + sign-up/email or with admin/create-user + change-password. Identity was proven with GET /auth/get-session before each persona cell. Scratch fixtures were authored at runtime inside each item's own DB, or in a scratch copy of the showcase under /tmp.
• Deviations, stated:
  • CRM package in the shared tree. Lane FE2 installed the CRM package (os package install, needed for the marketplace item) into the shared subject examples/app-showcase/.objectstack/installed-packages/ from 12:28 to 12:36Z. FE1's boots on 44105–44108 (account-app-entry, docs-portal-render, home-admin-cluster-links, url-overlay-contract) started in that window and registered crm_app next to the three stock apps. None of their clauses depends on the app list, so the clauses are unaffected. FE2 removed the package through the API, and lanes were ordered from then on to install only into scratch copies.
  • One shared DB in FE2. Seven FE2 items ran on one boot with one shared main.db: keyboard, theme, installability, palette, ai-gating, api-console, and marketplace boot A. As a result, the api-console tree also listed Data: crm_* groups.
  • Port moved in FE4. One FE4 item moved from 44408 to 44409 because the session process held 44408 as an outbound ephemeral port.
• Execution: this selector was run by six parallel runner subagents (FE1–FE6). Independent verifiers VF1–VF4 checked the results under RUNNER rule 7, and VF3 and VF4 re-derived every fail in this selector. Everything ran in Claude Code session session_018zT8d8NpiQ1ExhuNd5TxY6. The lanes ran on 2026-10-04 from 12:06Z, and verification finished on 2026-10-05. After an earlier overload of the box, concurrency was capped at three lanes (a maintainer order), with verifiers counted as lanes. Tier-1 pins that live in this repository were run and are cited in the table. Items whose automated.ref lives only in objectui were driven by hand as manual browser runs (RUNNER environment facts, option a).

Scope

node scripts/checklist-select.mjs surface:browser --json returned 61 runnable items. One item is hidden as blocked and was not run: approvals.quorum-m-of-n. The selector returned no planned items. All 61 items received a verdict.

Totals: 38 PASS / 8 PARTIAL / 15 FAIL / 0 BLOCKED / 0 NOT-RUN. The 15 fails break down as follows:

• 4 carry a verified product defect, all in the objectui console and all predating 17.6.0. One of the four, marketplace-console-honesty, also carries a stale clause.
• 2 are held: the runner observed a fail and reproduced it, but the verifier could not confirm the mechanism, so no card is filed and a live re-run is owed.
• 1 is a known expected-fail probe only (keyboard-shortcut-surface, K1a / K1b).
• 8 fail on checklist clauses only. ai-gating's A6 there is also the known expected-fail K2.

One more defect lies outside the clauses (dashboards.chart-type-matrix, which passes) and is extracted with the four.

Every fail was re-derived by an independent verifier (VF3 or VF4). Where a verifier changed a disposition, the verifier's is recorded:

• VF4 upgraded shell-nav-personalization A3 from assertion-defect to product defect.
• VF3 refuted form-view-gallery A1 as a product defect (now assertion defect) and conditional-rules-grid A5 (now invalid pairing).
• VF4 refuted action-location-matrix A1 (now invalid pairing).
• VF3 ruled that chart-type-matrix A8's clause holds and the mislabel lies outside it.
• VF4 recorded inbox-metadata-actions A2 and global-filters-rescope A6 as stale clauses.

One item verdict is derived differently from its lane's summary: form-dirty-guard is PARTIAL rather than pass, because its A3 pin is objectui-only and was not run (RUNNER per-item derivation).

Fails — reproduction rules and dispositions

Product defects

platform-core.shell-nav-personalization A3 {card-1}: drag-reorder is never offered on grouped navigation, and every stock app's navigation is grouped.

• Server truth: the served GET /api/v1/meta/app?id=showcase_app navigation is grouped (8 groups), and so are the Setup and Account navigations.
• Browser:
  1. Sign in as admin.
  2. Open /_console/apps/showcase_app/showcase_task.
  3. Hover and try to drag any sidebar entry.
• Expected: a grip, and an order that is restored after reload (useNavOrder, localStorage objectui-nav-order-showcase_app).
• Actual: 0 [aria-label="Drag to reorder"], no sortable, and the localStorage key is never written. Seen on two loads.
• Root cause (VF4):
  • objectui NavigationRenderer.tsx:1590 computes hasGroups.
  • The DndContext / SortableNavigationItem path exists only in the !hasGroups arm (:1614-1631). The grouped arm (:1650 ff.) renders plain items.
  • UnifiedSidebar.tsx:583 passes enableReorder={!isMobile} unconditionally.
  • useNavOrder persists only __root__.
• Predates 17.6.0: identical at objectui 31971ff1e.
• Verifier VF4: CONFIRMED, P3. If the maintainers rule that reorder is meant for flat navigation only, the clause becomes an assertion defect; VF4's corrected wording is with the re-point.

platform-core.marketplace-console-honesty A3 {card-2}: on an offline boot, the installed package's Details page is a dead end, so reseed and purge cannot be reached from the console.

• Server truth:
  • Boot with OS_CLOUD_URL=off. /runtime/config reports marketplace:false.
  • os package install examples/app-crm/dist/objectstack.json -r http://localhost:{p}. Installed Apps then lists com.example.crm v4.0.0.
• Browser:
  1. Go to Setup → Installed Apps. The row offers Refresh / Details / Uninstall.
  2. Click Details. It opens /system/marketplace/com.example.crm.
• Expected: reseed / purge affordances that issue POST /api/v1/marketplace/install-local/com.example.crm/{reseed,purge}-sample-data.
• Actual: the page renders "App Marketplace is turned off" and makes 0 install-local wire calls. Seen twice.
• Root cause (VF4):
  • objectui InstalledListWidget.tsx:155 links Details to /system/marketplace/:packageId.
  • MarketplacePackagePage.tsx:568 returns the MarketplaceDisabled card before the page reaches its local reseed/purge menu (:752).
• Predates 17.6.0: identical at objectui 31971ff1e.
• Verifier VF4: CONFIRMED, P3.
• Related: the endpoint behind the purge affordance has its own defect, marketplace: install-local purge-sample-data always answers 500 DRIVER_UNAVAILABLE (looks up a bare "driver" service nothing registers) — and seed records carry no id to purge by #21728 (purge answers 500), which is scored by the api lane.

records-forms.view-type-gallery A2 {card-3}: the kanban board never renders its summarizeField per-column totals.

• Server truth:
  • The fixture board showcase_task.board declares {groupByField:'status', summarizeField:'estimate_hours'} (examples/app-showcase/src/ui/views/task.view.ts:262-275).
  • Summing estimate_hours per status over GET /api/v1/data/showcase_task gives backlog 30 / todo 36 / in_progress 100 / in_review 54 / done 24.
• Browser: as admin, open /_console/apps/com.example.showcase/showcase_task/view/showcase_task.board.
• Expected: those five totals in the column headers.
• Actual: the headers show only the count badge ("BACKLOG 2" … "DONE 2"), and the board's data request selects no estimate_hours. Seen twice by the runner and twice by the verifier, all on fresh loads.
• Root cause (VF3):
  • Nothing in objectui packages/plugin-kanban/src reads summarizeField (column header around KanbanImpl.tsx:1066-1100).
  • The only consumers, plugin-list/src/ListView.tsx:2002 and :2517, add the field to the projection.
  • The spec declares the key at packages/spec/src/ui/view.zod.ts:1789 with no liveness verdict, making it an ADR-0049 declared-but-unenforced key.
• Predates 17.6.0: no reader at objectui 31971ff1e either.
• Verifier VF3: CONFIRMED, P3.

records-forms.grid-personalization A2 {card-4}: the row height (density) is lost on reload.

• Browser:
  1. As admin, open /_console/apps/com.example.showcase/showcase_task. The runner also used …/view/showcase_task.grid.
  2. Click "Density: Compact (click to cycle)". It changes to "Comfortable" and rows go from 41 px to 45 px.
• Server truth:
  • The console sends PUT /api/v1/meta/view/showcase_task.default and gets 200 "Saved customization overlay".
  • The body is the whole served item (config{…}, _provenance, scope, _diagnostics) with a flat top-level "rowHeight":"medium".
  • Afterwards, GET /api/v1/meta/view/showcase_task.default carries no rowHeight, either at top level or in config.
  • A reload in a fresh context shows "Density: Compact" again.
• Expected: the chosen row height survives reload.
• Control: the same item PUT with config.rowHeight:"tall" reads back "rowHeight":"tall".
• Root cause (VF3):
  • objectui packages/app-shell/src/views/ObjectView.tsx:1181 buildPersistedViewBody spreads the patch at the envelope top level instead of into config, for views the switcher classes as saved views.
  • The framework save door stores only the declared keys of a view body (ADR-0005 appendix (c)), so it drops the misplaced key while still answering 200. Dropping it is by design, so the fix belongs to the client.
  • VF3 adds a design note: a 200 that silently discards an undeclared envelope key is a silent-loss shape, and a save diagnostic would have surfaced it.
  • sort and hiddenFields patches probably take the same path (not driven).
• Predates 17.6.0: identical at objectui 31971ff1e.
• Verifier VF3: CONFIRMED, P2.

dashboards.chart-type-matrix, outside the item's clauses {card-5}: a previousPeriod comparison on the dataset path is labelled "vs yesterday". Clause A8 passes because the comparison renders; only the label is wrong.

• Server truth:
  1. As admin, PUT /api/v1/meta/dashboard/qa_compareto_probe?mode=draft with:
     • dateRange:{field:'created_at', defaultRange:'last_30_days'};
     • a metric widget on dataset showcase_task_metrics, values:['task_count'], compareTo:{kind:'previousPeriod'}.
  2. POST …/publish.
  3. The dataset query shifts the whole 30-day window (timeDimensions dateRange [2026-09-04, 2026-10-04], task_count__compare: 1).
• Browser: open /_console/apps/showcase_app/dashboard/qa_compareto_probe.
• Expected: "vs previous period".
• Actual: the metric shows "9 ↑800%" with the label "vs yesterday", and the line legend reads "Tasks · vs yesterday".
• Root cause (VF3):
  • objectui packages/core/src/utils/compare-to.ts:124-136 compareToTrendLabelKey derives the label by regex-sniffing the raw filter for macro tokens (today → vsYesterday).
  • plugin-dashboard/src/DatasetWidget.tsx:1097 reuses it on the ADR-0021 dataset path, where the executor shifts the dimension window (service-analytics dataset-executor.ts:810-819 shiftRange).
  • The heuristic is only right on the inline path.
• Predates 17.6.0: the same code is at objectui 31971ff1e.
• Verifier VF3: CONFIRMED by code (not live-driven). P3.
• Evidence strength: the runner observed it once.

Held: observed, not verified, not extracted

i18n.surface-matrix A1 (relative-dates variant) and i18n.studio-follows-app-locale A3: dates render in the browser's language when the app locale code is the language-only zh.

• Server truth: GET /api/v1/i18n/translations/zh-CN is the expectation set.
• Browser:
  1. Fresh boot. Create a Chromium context with locale:'en-US'.
  2. Set localStorage['objectui-locale']='zh' before the first load. This is the code i18n.notification-localized-and-clears tells runners to write.
  3. Sign in as admin and open /_console/apps/showcase_app/showcase_task.
• Expected: date cells in zh, like the rest of the page.
• Actual:
  • Headers are zh, but due-date cells read "Sep 16", "Oct 24", "In 3 days" next to "逾期 6 天".
  • The record page reads "截止日期 Sep 16" next to "创建于 20天前".
  • The bell's activity tab reads "12 seconds ago".
• Discriminators:
  • The same zh session in a zh-CN browser renders 9月16日 / 3天后.
  • The code zh-CN (what the LocaleSwitcher writes) renders zh in an en-US browser.
  • html lang is zh in the failing case and zh-CN in the passing one.
  • Flipping the tenant locale has no effect (A/B on the same boot).
• Reproduction count: 2 fresh boots × 3 loads.
• Studio-specific note: Studio's own timestamps follow the app locale under zh-CN. The studio clause fails only through the shared formatter.
• Verifier VF3: UNCONFIRMED.
  • The code contradicts the stated mechanism. useDisplayLocale passes zh to Intl verbatim, and the date-fns resolution maps it to zh-CN.
  • VF3 did not render live.
  • VF3 found a different possible cause: an unconfigured tenant's en-US default from GET /api/v1/auth/me/localization outranks the UI language. A tenant locale of zh itself is refused by settings.
• Disposition: held. The observation stands, the mechanism is disputed, and no card is filed. A live re-run of both items is owed (RUNNER rule 7). If the observation stands, the defect belongs to the objectui console. It predates 17.6.0 by code.

Checklist clauses (no product defect)

Known expected-fail (not re-filed)

• platform-core.keyboard-shortcut-surface A3 / A4: defects K1a and K1b, owned by the 2026-08-30 sweep's follow-ups. Both are still present at the pin.
  • A3 (K1a): bare B leaves the sidebar expanded while the dialog advertises "B". Only ⌘/Ctrl+B is handled.
  • A4 (K1b): each advertised ⌘/, Ctrl+/, N, R, Ctrl/Meta+E and Ctrl/Meta+D was probed on /_console/apps/showcase_app/showcase_task with focus on the body. None changed the URL, focus, dialogs, the root class or data. Seen on two fresh loads.
  • Verifier VF4: confirmed. KeyboardShortcutsDialog.tsx:49 lists bare B, sidebar.tsx:42,122 requires the modifier, and no handler exists for the five advertised accelerators.
• ai.console-ai-surface-gating A6: defect K2, from the same follow-ups row.
  • Repro: sign in as admin through the form, open /_console/apps/setup/system/ai-approvals and watch for 15 s.
  • Observed: "No actions waiting" renders under the 501 error alert, and pending-actions is re-polled at about +0, +4.9 and +10 s with no backoff. Seen on two runs.
  • Verifier VF4: confirmed at the pin (AiPendingActionsInbox.tsx:327/:373, usePendingActions.ts:294-295).

Partial-coverage gaps (named, not dropped)

• records-forms.crud-roundtrip A7 readonly half: blocked(fixture). No stock readonly column can be set over HTTP; the server answers x-objectstack-dropped-fields: lead_score;reason=readonly.
• platform-core.console-installability-indicators A3 error leg: not-run. The connection chip tracks only the initial discovery (see candidates).
• search.command-palette-navigation A5: blocked(fixture). No stock nav item carries a visibility predicate.
• identity-auth.phone-signin-surfaces A2 / A3: blocked(fixture). features.phoneNumber is false, and plugins.phoneNumber is code config with no runtime setting.
• records-forms.import-wizard-encoding-and-hints A3: blocked(dependency). The legacy per-row path exists only when the data source lacks importRecords, the live server always has it, and the pin is objectui-only.
• records-forms.gantt-interactions A2 / A3: blocked(fixture). The stock view has no dependenciesField, and lockField is not a GanttConfig key.
• records-forms.form-dirty-guard A3: not-run. The discardGuard.test.tsx pin exists only in objectui.
• records-forms.bulk-select-all-matching A5: not-run. Match sets of 26 and 10 cannot reach the 5000 cap.
• Blocked legs inside judged items:
  • records-forms.grid-personalization A1 reorder / pin: reorderableColumns is off, and there is no runtime pin control.
  • records-forms.action-location-matrix A3 url / api dispatch: the fixture hosts no ⋯ surface.
  • i18n.surface-matrix A6 confirm half: no zh confirmText.
  • platform-core.keyboard-shortcut-surface A5 and the ai.console-ai-surface-gating A2 entitled side: blocked(fixture) as their clauses prescribe.
  • Marketplace catalog content (builtin-apps-nav-render, marketplace-console-honesty boot A): blocked(environment), because egress to the catalog is denied.

Fixed since the last run

• objectui#11326 (the account-app approvals entry stayed English under zh-CN) no longer reproduces. approvals.account-app-entry A7 holds on two loads (待我审批 / 我发起的 / 全部).

Candidates — not verified, not extracted

Each of these was seen by a runner outside the clauses. They are low severity or possibly by design, and they are listed so they are not lost:

• GET /api/v1/data/{object}?top=0 answers total:0 while top=1 gives the real total, and the console sends top=0 as its record-count probe. Two lanes saw it (FE3, FE4).
• A malformed JSON body on POST /api/v1/data/showcase_task is treated as an empty body: the answer is 400 "Title is required; Project is required", not a parse error.
• CSV export renders booleans as hard-coded 是 / 否 regardless of locale, under English headers.
• On New, select options marked default: true are not pre-selected (invoice status / region), so "Status is required" blocks create. Separately, an edit save wrote region:"amer" into a row whose region was null.
• A wizard default form renders flat, with no step chrome, in the New modal. Only the /new page route honours it.
• The action-param dialog is taller than the viewport with no scroll (top at y=-198), so Confirm cannot be reached at 1440×900 or 1600×1200.
• The Log Time form dispatch leaves the app shell, heads the page with the raw target "showcase_task.form", and toasts "Action completed successfully" before any submit.
• Line amounts are computed in floating point and never rounded (3598.7999999999997).
• Related-list pages and inline-grid child fetches carry no sort, so their page order relies on natural order.
• The Field Zoo row tint does not paint the frozen #/Name columns.
• Record History shows a currency change unformatted ("— → 4250000"), while the grid shows "$4,250,000.00".
• After the submitter has approved as an approver, the approvals drawer still says "only the assigned approvers can approve or reject".
• The approvals drawer opened on an unknown ?request= id leaves an empty "Approval Request" sheet behind the correct toast.
• showcase_invoice shows two fields both labelled "Owner" (the system owner_id and its own owner).
• The record feed shows an admin's PATCH as authored by "System". The inlineEdit grid renders two "Actions" header columns.
• Deleting the view set as default leaves the object with no default view.
• The home-navigation block in UnifiedSidebar (Home, Documentation, the Administration cluster) has no rendering surface. VF4 also notes this and suggests an item revision rather than a defect.
• A cross-reference inside the app-scoped docs reader leaves the app container for /docs/….
• Every console page logs 404 GET /api/v1/usage/storage.
• Selecting a theme command in the palette (Dark / Light / System) leaves the palette open. Navigation commands close it.
• The connection chip shows nothing after a backend loss mid-session. A single aborted /api/v1/discovery at load strands the splash at "Preparing workspace" for 45 s or more, with no retry and no error.
• The PWA manifest icon type is hard-coded image/svg+xml even when the favicon is a PNG.
• On SSO-enforced boots, LoginForm briefly renders "Sign up" during the config-loading frame. An unenforced invite_only boot shows "Don't have an account? Sign up", which leads to the 403.
• Recents use humanized names ("Showcase Hours By Status") instead of nav labels.
• Every navigation PATCHes sys_user_preference (recents), which floods the bell activity feed with "更新了 用户偏好".
• The sys_user list "updated" cell renders date and time with no separator (10/4/20263:22 pm).
• On the read-only Studio Automations pillar, a mouse click on a flow node never opens the inspector, while keyboard Enter does.
• The connector picker keeps the previous connector's action and input map after a connector switch.
• ResourceHistoryPage hard-codes English ("Back to item", "by …") on a zh session.
• The view designer says "This view has no object binding yet" on showcase_task, while its Object field reads "Task".
• The first click of a custom date range commits a one-day query before the second click.
• For dates, an unconfigured tenant's en-US default (/auth/me/localization) may outrank the UI language. This is VF3's alternative reading of the held zh-date finding and needs a live render.
• The spec still declares FormView.type drawer / modal and drawerSide with no live renderer path. This is ADR-0049 debt pending ADR-0050 (VF3).
• records-forms.record-edit-undo A4, observe-and-flag: an undo after a concurrent edit sends a bare PATCH with no If-Match and silently overwrites the other session's value. This is recorded as the clause asks, not as a fail.
• Three authorization-class observations, withheld pending maintainer (RUNNER rule 2).

Generated by Claude Code