QA run · surface:mixed (90/90) · 36b2889c · 2026-10-12 · 72 PASS / 10 PARTIAL / 8 FAIL / 0 BLOCKED / 0 NOT-RUN #23166

Half 2 of #23104, mixed selector. The maintainer's order, verbatim: 「objectui pin 更新到最新版，并使用浏览器对前端界面进行完整的测试」. Every runnable surface:mixed item (API truth plus a console surface) was driven against objectstack 36b2889c, with the console built from the new objectui pin 1fb1ced36243 (a local stand-in for PR #23110's head). The surface:browser record for the same subject and run is #23163. Text only: screenshots were consulted live as oracles and are not attached. The durable truth stays in docs/qa/platform-checklist/areas/.

Environment fingerprint

• Framework (subject): objectstack-ai/objectstack 36b2889cddc5e38acf7f85b8e186b02e6ef786c6, in the detached worktree /home/user/objectstack-qa-23104, framework and console built.
• Console: .objectui-sha set LOCALLY to 1fb1ced36243c325acc801bdde26bd096a15f5f5, with sdui.manifest.json and scripts/sdui-manifest.record.json regenerated from the built objectui tree at that pin (sha256 f545b851c4bb…, byte-identical to PR chore(objectui): move the console pin to 1fb1ced36243 (objectui main tip, Half 1 of #23104) #23110's). The console dist stamp equals the pin, both in packages/console/dist/.objectui-sha and as served by GET /_console/.objectui-sha.
• Why this tree stands in for the pin PR: it differs from PR chore(objectui): move the console pin to 1fb1ced36243 (objectui main tip, Half 1 of #23104) #23110's head 043b81d13 only in pin-citation strings inside spec descriptions, the sdui-parser lockstep JSON, two changesets and one docs reference page. Runtime code and console bundle are identical. PR chore(objectui): move the console pin to 1fb1ced36243 (objectui main tip, Half 1 of #23104) #23110 has since landed on main as f451a5964, and CI push run 38332364381 at bcebd8409, the first full-battery main run carrying it, passed with Console Pin Gate included.
• Checklist: items, RUNNER.md and the selector come from the subject tree. Revisions in the table match the selector's output.
• App / boots: examples/app-showcase booted with objectstack dev --ui --seed-admin -p PORT -d file:/tmp/qa-23104/LANE/ITEM.db, with OS_PORT exported and a per-boot OS_HOME and OS_STORAGE_LOCAL_ROOT. Lanes A / B / C used the ports 44100–44399 / 44400–44699 / 44700–44999. Browser: Playwright on /opt/pw-browsers/chromium. Admin admin@objectos.ai came from --seed-admin. Other personas were minted per item, and identity was proven with get-session before each persona cell.
• Execution: three parallel runner subagents (lanes A, B, C) in Claude Code session session_016JB93R2KcQP4GgKaUnseVF, PM seat domain:devx#2, from about 23:30Z on 2026-10-12.
  • A container restart around 02:30Z killed all three. Each lane resumed from its own results file: judged items were kept byte-identical, and not-run items were re-run from scratch on fresh -r2 state.
  • The lanes finished on 2026-10-13, between 03:32Z and 04:28Z. Concurrency stayed at three lanes.
  • Tier-1 pins in this repository ran under os-verify-lock and are cited. objectui-only pins were driven by hand, or run from an objectui checkout at the pin where installed.
• Hop regression: none. Every fail clause records hop_suspect: false. concurrent-edit-conflict N2 also carries an explicit hop-range git log over ObjectGrid.tsx that returned empty.
• Deviations, stated (the full list is on QA run · surface:browser (65/65) · 36b2889c · 2026-10-12 · 50 PASS / 2 PARTIAL / 12 FAIL / 1 BLOCKED / 0 NOT-RUN #23163):
  • The CRM manifest incident (03:44:53–03:45:18Z, removed through the API, git status unchanged). No boot that scored an app-list clause started in that window.
  • Declared shared boots: lane B S1 / S2, lane C studio1, and one shared DB for lifecycle-retention-sweep + interrupted-migration-boot-report.
  • Scratch showcase copies under /tmp: capability probes, walled-posture boots, the picklist fixture, job fixtures and webhook stacks.
  • Non-default boots:
    • OS_LOG_LEVEL=info for the lifecycle / migration INFO lines; at the default level every migration-recovery line is WARN, so it cannot hide one.
    • OS_LOCALIZATION_TIMEZONE / OS_MAIL_SMTP_PASSWORD (env-lock legs) and OS_TENANCY_POSTURE=group|isolated with OS_PLATFORM_OWNER_EMAIL and OS_AUTH_MEMBERSHIP_POLICY=invite-only.
    • OS_PAGE_REACT=off, the scheduled-work boot, the local OIDC provider fixture (oidc2) and a scratch PostgreSQL 16 on 127.0.0.1:44790.
  • The two cli.scaffold-* items took the PUBLISHED path. create-objectstack@latest = 17.7.0 and the published console = objectui 0abd4f9f8769, so their verdicts describe the released bits, not the local pin. The tree's CLI refuses a 17.x scaffold on the ADR-0087 D1 protocol handshake, and the pre-release variant is handed off (see Scope).
  • Pins re-run at resume: one lane-B Tier-1 pin was re-run under the lock (2 files, 33/33), and so was lane C's metadata-diagnostics-sweep A7.
  • Time split (environment / test minutes, lane estimates): A 17 / 103 (resumed portion only), B ≈38 / 220, C ≈34 / 190.

Scope

node scripts/checklist-select.mjs surface:mixed --json on the subject tree returned 90 runnable items, all 90 judged (lane split A 21, B 37, C 32). The selector hid no item as blocked. One planned item matched and is recorded as planned: not driven, and not in the title's counts.

• records-forms.picklist-shared-across-objects (rev 2): planned.

Handoff, not run: the pre-release (local-registry) variant of cli.scaffold-first-run and cli.scaffold-console-first-paint against the protocol-18 candidate. It needs a scratch monorepo build plus a localhost registry with no upstream. The published-path verdicts are recorded below.

Clause ids are the lanes' own labels, which the extracted cards cite.

Totals: 72 PASS / 10 PARTIAL / 8 FAIL / 0 BLOCKED / 0 NOT-RUN (planned: 1, outside the counts).

• 3 fails carry a product defect: plugin-grid: list inline edit saves without If-Match, so a stale grid edit silently overwrites a concurrent write (data integrity) — defaultRowSave / defaultBatchSave call dataSource.update with no optimistic-concurrency token objectui#12292, console Setup › Apps: Delete and Disable report success for writes that changed nothing — handleDelete ignores reset:false, and handleToggleActive saves a package-owned app with no package scope objectui#12300 and plugin-auth: the user-import wizard's automatic invitation link is dead — admin-import-users.ts calls requestPasswordReset with no redirectTo, so the emailed link carries an empty callbackURL and lands on INVALID_TOKEN #23152.
• 4 fail on checklist clauses only: owd-save-gate, auth-method-matrix, self-signup-gate and formula-stdlib-matrix are all rows on platform-checklist: items whose clauses pin shapes the product has since ruled away — found by the browser pass at objectui 1fb1ced36243; re-point or re-word each (family card) #23121 and were revised on main by docs(qa): six platform-checklist clauses re-pointed to the behaviour the product has since ruled (#23121) #23132.
• 1 is an authorization finding withheld pending the maintainer (RUNNER rule 2 carve-out).
• No hop regression.

Fails — reproduction rules and dispositions

Product defects

records-forms.concurrent-edit-conflict · N2: product defect, objectstack-ai/objectui#12292.

1. On a fresh boot as admin, open /_console/apps/showcase_app/showcase_task/view/grid (inline edit on). Note that Ingest pipeline's Estimate reads 60.
2. Concurrently PATCH /api/v1/data/showcase_task/ID {estimate_hours:77} with If-Match set to its updated_at → 200.
3. In the stale grid, click the Estimate cell, type 61, press Enter and click "Save All (1)".

• Expected: the grid save rides the OCC token, and the stale write is refused 409 with the conflict dialog (the item's negative: an unguarded inline save is a FAIL).
• Actual: PATCH /api/v1/data/showcase_task/ID {estimate_hours:61} goes out with no If-Match → 200, and the re-read is 61. No 409, dialog or toast. Reproduced twice (77 → 61, 33 → 31).
• Source: plugin-grid ObjectGrid.tsx defaultRowSave / defaultBatchSave call dataSource.update(object, id, changes) with no ifMatch. The hop range is empty.

platform-core.app-management-toggle · C5b: product defect, objectstack-ai/objectui#12300.

1. On the stock showcase, sign in as admin through the form and open /_console/apps/setup/system/apps.
2. Click getByRole('button',{name:'Delete Showcase'}), then getByRole('button',{name:'Confirm delete Showcase'}).

• Wire: DELETE /api/v1/meta/app/showcase_app → 200 {success:true, reset:false, message:'No customization overlay found … already at artifact default.'}.
• Expected: no "deleted" success; a neutral "nothing to reset" notice or an error instead.
• Actual: a success toast "Showcase deleted", while the row stays "Showcase Active" and /meta/app still lists showcase_app after reload. Seen on 2 fresh loads.
• Source: objectui apps/console/src/pages/system/AppManagementPage.tsx handleDelete calls toast.success without reading reset.

platform-core.app-management-toggle · N1: product defect, objectstack-ai/objectui#12300.

1. As admin, POST /api/v1/packages {manifest:{id:'com.qa.lanebapp', name:'x', version:'0.1.0', type:'app'}}.
2. PUT /api/v1/meta/app/lanebapp_app?package=com.qa.lanebapp with {name, label, icon, active:true, navigation:[{id, type:'object', objectName:'showcase_task', label}]}.
3. In the console, open /_console/apps/setup/system/apps and click getByRole('button',{name:'Disable QA LaneB App'}).

• Wire: PUT /api/v1/meta/app/lanebapp_app with the body {…app, active:false} and no package query → 200 "Saved app … (env-wide, state=active)".
• Expected: the app goes inactive and the launcher drops it, or the write is refused with an error toast.
• Actual: a success toast "disabled", the app unchanged everywhere (GET reports active:true from com.qa.lanebapp), and a new shadow sys_metadata row with package_id null and active:false that is never served. Seen on 2 fresh loads.
• Source: client handleToggleActive calls meta.saveItem('app', name, {...app, active}) with no package scope. On the server, a PUT without ?package= on a package-owned item writes an env-wide row the reader never serves, and answers 200. Set-default and Bulk take the same path.

identity-auth.identity-import-wizard · C2b: product defect, #23152.

1. On the stock showcase (dev log email transport), as admin, go to Setup › Users › Import.
2. Upload a CSV email,name with one row, click Next, choose the policy Automatic, then Import. Wire: POST /api/v1/auth/admin/import-users {rows:[{email,name}], mode:'insert', passwordPolicy:'auto'} → 200 delivery email.
3. Read the sys_email row to that address: the body link is /api/v1/auth/reset-password/TOKEN?callbackURL= (empty).
4. GET that link.

• Expected: landing on a set-password page (/_console/reset-password?token=…), as the console's own forgot-password flow does.
• Actual: 302 to /api/v1/auth/error?error=INVALID_TOKEN, then a console login banner reading "Single sign-on could not be completed". The token is valid: POSTing it to /auth/reset-password answers 200.
• Control: request-password-reset WITH redirectTo yields a working link. Reproduced on two wizard imports.
• Source: packages/plugins/plugin-auth/src/admin-import-users.ts:704 calls requestPasswordReset({ body: { email } }) with no redirectTo.
• Secondary, on the card: the invitation reuses the password-reset copy.

Authorization finding (RUNNER rule 2 carve-out)

access-security.packaged-permission-set-lifecycle · C1: detail withheld pending maintainer.

Checklist clauses (no product defect)

access-security.owd-save-gate · A3: stale spec, #23121 (item rev 4 on main via #23132).

• Driven: with the admin bearer, GET /api/v1/meta/object/showcase_announcement and set sharingModel public_read_write, externalSharingModel private. Then PUT /api/v1/meta/object/showcase_announcement with that body.
• Clause expects: 403 {code:'PERMISSION_DENIED', declaredCode:'owd_widening_forbidden'}.
• Actual: 403 {code:'NOT_OVERRIDABLE'} ("sealed against in-place edits … ADR-0131") with no declaredCode. The tightened control and ?package=com.example.showcase are refused the same way, and the object stays byte-identical.
• Why the product is right: the ADR-0131 D6 managed-content seal (feat(metadata-protocol)!: managed content is sealed — OS_METADATA_WRITABLE no longer opens an item a managed package ships (ADR-0131 D6, #15206 S2) #22401) now answers ahead of the plugin-security R1 gate the clause pins. The protection holds.

identity-auth.auth-method-matrix · A9: assertion defect, #23121 (rev 7 via #23132).

• Actual: POST /api/v1/auth/delete-user {} with no credentials → 401 UNAUTHORIZED; with a member bearer → 404; the callback → 404. No caller gets 2xx.
• Clause expects: 404 for every caller.
• Why the product is right: packages/plugins/plugin-auth/src/change-email-delete-user-wiring.test.ts pins anonymous 401 (mounted, session-guarded) next to authed 404. Re-word: authed 404, anonymous 401, never 2xx.

identity-auth.self-signup-gate · N5: stale spec, #23121 (rev 3 via #23132).

• Actual: on a stock boot (no auth.audience declared), /_console/login shows no Sign up link, and /_console/register renders [data-testid=register-by-invitation] with no inputs.
• Control: /_console/register?redirect=%2Faccept-invitation%2FINVITATION-ID renders the full form.
• Clause expects: the link and the form for every visitor.
• Why the product is right: objectui RegisterPage.tsx / signUpOffer.ts have offered the form only to invitation redirects and zero-owner deployments since objectui#11691 / objectui#11705.

api-backend.formula-stdlib-matrix · C1: stale spec, #23121 (rev 2 via #23132).

• Actual: step 1's re-count moved. registerStdLib registers 29 functions: the item's 27 plus isoDate and isoDatetime (345d3f3d8, feat(formula): isoDate(t) / isoDatetime(t), the string form of a CEL timestamp #22347). content/docs/data-modeling/formulas.mdx lists the same 29.
• All 29 pass their known answers against the built packages/formula/dist: 73/73 asserted rows. Int / double types were asserted CEL-side.
• Inside the item: the literal row joinNonEmpty(['a', null, ' ', 'b'], '-') cannot evaluate, because cel-js refuses a heterogeneous list. The same semantics over record fields give 'a-b'.

api-backend.formula-stdlib-matrix · C6: stale spec, #23121 (rev 2 via #23132).

• Actual: PUT /api/v1/meta/object/qa_formula_probe adding a field bad_f = sqrt(4) → 422 INVALID_METADATA "… sqrt is not a callable name here — a NAME fault …", and nothing is stored. Reproduced twice.
• Clause expects: a silent null at head. The authoring door now refuses first, so the clause flips to the positive refusal its own text anticipates.
• Not ticked green.

Partial and blocked coverage (named, not dropped)

• approvals.decision-action-matrix A9-wire: blocked(fixture). The live 500 envelope needs an org-less request, which no stock flow opens (knownGaps).
• automation.flow-node-type-matrix A1-http: blocked(environment). Egress is denied, so every http step fails "fetch failed".
• identity-auth.workspace-org-switch C3b: skipped. The premise is retired, because metadata writes are deployment-level and no org-only metadata id exists (see accuracy list).
• integration-system.email-template-render A5: partial. The admin half passes; the declared-source half needs a writable showcase copy.
• integration-system.external-schema-browser-ui A6: blocked(environment). The objectui checkout is not installed, and the stock boot always wires federation.
• integration-system.notification-preference-suppression A3-mandatory: blocked(fixture). The stock showcase declares no mandatoryTopics, and they are not runtime-writable.
• integration-system.notify-inbox-delivery A3-501: blocked(fixture). The 501 arm needs a boot without MessagingServicePlugin, and the showcase requires messaging.
• integration-system.webhook-lifecycle:
  • A2: blocked(dependency, tenant wall). Flow multi-writes publish bulk events with no organizationId, the org-owned subscription refuses them, and an org-less subscription cannot be authored.
  • N1 / N2: skipped for time.
• studio-authoring.expression-editors A7: blocked(environment). It is a pin-only clause, and the objectui checkout has no install.
• studio-authoring.metadata-diagnostics-sweep A6: blocked(fixture). No invalid stored row is plantable on a stock boot; it is pending a stale-row DB snapshot fixture.

Fixture gaps / checklist accuracy

Recorded on passing clauses, or as fixture prerequisites. Each one closes out through the family card #23121.

1. identity-auth.workspace-org-switch fixtures.requires names only OS_TENANCY_POSTURE. A walled posture refuses to boot the stock showcase without:

   • @objectstack/organizations declared in the host app's package.json (ADR-0093 D5);
   • OS_PLATFORM_OWNER_EMAIL;
   • a declared membership policy (OS_AUTH_MEMBERSHIP_POLICY). With invite-only, the invitee must also accept-invitation.

   C3b's meta half needs re-grounding, because metadata writes are env-wide now.

2. platform-core.lifecycle-retention-sweep step 3: the [lifecycle] line is INFO and os dev defaults to warn, so the grep needs OS_LOG_LEVEL=info. Step 5's idle-proof expectation does not hold: a clean DB still logs "18 policy(ies) applied, ~0 rows reaped" on every sweep. A ruling is owed: stale step, or product defect.

3. identity-auth.email-verification-loop C2 / step 4 name a POST variant. POST /auth/verify-email answers 404, and the console uses GET (VerifyEmailPage.tsx:47-56).

4. cli.scaffold-first-run C2: the verify text says "each of the six templates", which is stale against variants [blank] (rev 2).

5. records-forms.field-group-visible-when A3 expects the detail half to FAIL per objectui#11630. At this pin the detail page gates the group correctly (stale spec).

6. dashboards.system-overview-live-counts:

   • A1's "no active-only filter" caveat is stale: the widget now filters revoked_at null, expires_at > now.
   • A3's roster is stale: there is no widget_organizations and no permission-events KPI.

7. records-forms.object-hook-lifecycle A7: the log wording differs from the quoted [hook] async handler error (fire-and-forget). It is wording drift only.

8. Persona recipe search:qa-contributor-bound-member step 5: a member-created showcase_invoice is invisible to its creator unless the body sets owner to the member's email. The same class applies to showcase_task: a contributor's own task needs assignee set to the member's email.

9. attachments-storage.download-authz-both-sides (qa-scratch-authz step 6): persona B also needs sys_attachment read. Without it the panel shows "You don't have access to these attachments." before any download.

10. search.console-global-search step 6: "Open Full Search Page" is offered only for an empty query or one matching "search all results full page". Reach /search by URL or through that query.

11. approvals.ooo-delegation-reroute A0: steps 3–4 prescribe an autolaunched flow started by POST /api/v1/automation/FLOW/trigger. That route cannot open an approval, because buildAutomationContext maps the record into params only and the engine seeds $record from context.record ("no record id in $record"). Reword to a record-triggered start.

12. studio-authoring.custom-page-source-tiers A5 (step 8, knownGaps[0]): an html compile error is refused at save / publish (422 INVALID_METADATA), so the runtime error panel is reachable only in the designer's draft preview. Name the preview and the 422 gate as the observable surfaces.

13. studio-authoring.metadata-diagnostics-sweep A1: stats.locked is the served envelope lock (finding(metadata-protocol): two lock reports the #21670 read fix left unaligned — a host-config kernel's _lock gate admits a save the read now calls non-editable, and getMetaDiagnostics().stats[type].locked counts declared _lock only #21694), not rows whose declared _lock is not none. Compare against the item envelope's lock.

14. studio-authoring.object-designer-roundtrip A3: step 4's literal "no banner for the empty row" (and objectui F4's toHaveCount(0)) collides with the select-needs-options rule whenever no real option exists yet. Assert with real options present.

15. studio-authoring.record-page-roundtrip A0: the create form's Page type now defaults to list, so add "set Page type = record" to step 1.

16. studio-authoring.draft-publish-lifecycle A8: step 10's ?from=1&to=2 compares the first draft save with its own publish, because history counts drafts and publishes. Name the publish versions read off /history.

17. studio-authoring.doc-on-app-menu A0: the knownGaps recipe says the doc editor refuses the read-only package with 422. It now saves an env-wide draft, so drive the writable base over ?package=.

18. automation.flow-runs-page-test-trigger A2: filling new_assignee in step 6 satisfies the screen, and the run completes without pausing. Leave it empty to exercise the hand-off.

19. automation.flow-node-type-matrix A1: notify steps fail loudly for tasks or projects created without an assignee or owner. That is a correct refusal; set an assignee in the recipe.

20. integration-system.webhook-lifecycle A1: the shipped showcase_task_changed webhook materializes org-less, so it can never fan out on the org-walled showcase. Author the webhook inside the organization, or org-stamp the fixture.

21. integration-system.email-template-render:

    • A0 / step 1: templates no longer materialize to sys_email_template (0 rows; the registry serves the item), so rewrite step 1 and A5's "post-reboot row" against GET /api/v1/meta/email_template/NAME.
    • A6: fixtures.requires still names the retired category key.

22. integration-system.external-schema-browser-ui:

    • A1 expects 5 columns, but the fixture DB carries 7 (API and panel agree).
    • A4's knownGap ("ValidationPanel lacks unreachable") is stale at this pin.

23. identity-auth.implicit-account-linking-ownership C3: the local IdP derives sub from the email, so a second identity is a distinct sub (fixture note).

24. Fixture gaps already in their items' knownGaps, parked for completeness:

    • metadata-diagnostics-sweep A6 (stale-row DB snapshot);
    • decision-action-matrix A9-wire (org-less request);
    • notify-inbox-delivery A3-501 (boot without messaging);
    • notification-preference-suppression A3-mandatory (mandatoryTopics);
    • email-template-render A5 (writable showcase copy).

Observations outside any clause (not verdicts)

Unverified product observations, UI polish and maintainer questions. None of them is scored, and none is filed unless a card is named.

• identity-auth.oauth-app-consent-loop C2: the consent heading reads "CLIENT-ID wants to access your account" instead of the app name. OAuthConsentPage.tsx fetches /api/v1/auth/oauth2/applications/ID/public, a route the server does not serve. Filed: console OAuth consent page shows the raw client_id instead of the app's name — it fetches /oauth2/applications/ID/public, a route the server does not serve (its public-client lookup is /oauth2/public-client) objectui#12301.
• identity-auth.oauth-app-consent-loop C1: registering a loopback redirect (http://127.0.0.1:… or localhost) is refused with a message calling the loopback host non-loopback, and the refusal is HTTP 500 OAUTH_REGISTER_FAILED rather than a 4xx.
• records-forms.field-type-matrix: the DRAFT flow showcase_approver_bindings (served status draft) opens an approval on every showcase_field_zoo update and locks the row. The next write answers 409 RECORD_LOCKED.
• identity-auth.workspace-org-switch C5: with no active org on the server, the switcher still shows "Default Organization", and a create answers 500 ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED instead of a designed 4xx.
• platform-core.package-lifecycle-enable-disable A0: while a package is disabled, the by-name GET /api/v1/meta/app/NAME still answers 200 with the full app, so the list and by-name routes disagree.
• automation.time-relative-trigger A0: the start node's Trigger select reads "—", and the populated sweep fields carry the amber "Kept, not in effect" stamp, although the flow is bound and sweeping (FlowNodeConfigField.tsx). A product-defect candidate, seen once, not a hop regression.
• integration-system.notification-preference-suppression A4: a template row authored with locale en-US is never reached on an en-default deployment. The ladder walks tag → primary subtag → en and never climbs to en-US.
• identity-auth.admin-lifecycle-operations A7: the impersonation banner names the administrator by raw user id, and the page underneath stays on a Setup URL the target cannot open.
• approvals.ooo-delegation-reroute A3: the drawer Activity shows the raw action key ooo_substitute with a "—" actor, and raw user ids in the comment.
• identity-auth.email-verification-loop C3: verification tokens are stateless and reusable until expiry.
• identity-auth.linked-accounts-social C3: even on a provider-configured boot, Linked Accounts offers no link affordance. Linking is reachable only through link-social or the login page.
• identity-auth.identity-import-wizard C3: the wizard offers "Update existing (skip if no match)", which the identity adapter refuses client-side with an honest message.
• access-security.permission-matrix-edit-loop A5: the lower matrix renders title as editable=false although the set declares no title entry, and the member's create with a title succeeds (a display default).
• platform-core.interrupted-migration-boot-report C1: describeInterruptedRun joins its sentence parts with no separator ("committed 1 chunk(s)").
• cli.scaffold-console-first-paint C4: the scaffold object is in no app nav, and its activity line reads "System" while Created by reads Dev Admin.
• studio-authoring.permission-matrix-editor-ux A4: at 820 px the breadcrumb row overprints the type / badge chips.
• studio-authoring.metadata-diagnostics-sweep A5: the all-clear badge "0 issue(s)" renders in the red destructive style.
• studio-authoring.doc-on-app-menu A2: after clicking "Gated doc", the highlighted entry is "Gated page in book", because three entries resolve to one URL.
• Maintainer question (integration-system.webhook-lifecycle A2): as built, bulk webhook events from in-org flow predicate writes are undeliverable to any tenant subscription. Is the missing attribution of flow-node multi-writes intended?

Generated by Claude Code