test(dogfood): pin five api-backend checklist items at the HTTP layer - #26787

Requested by Warren · project thread
Refs #26572 (slice 1 of about 3: items declarative-endpoint-execution, second-object-exposure-and-internal-fields, data-request-shape-and-query-arity, meta-read-doors-v18, error-sentences-and-unique-violation-wire-code)

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：给 api-backend 清单里 5 个被 18.2.0 Tier 1 扫描判为 PARTIAL 的条目补上 HTTP 层（真实 Hono 栈）的 dogfood 钉子，并把这 5 条的 automated.ref、verify 文本、revision 和 history 更新。
• 为什么改：这些条款的判据在 HTTP 或构建层，旧钉子只到单元/引擎层，每次发版扫描都要人工再跑活腿；现在变成常驻、可重跑的证明。
• 风险与回滚：只加测试和清单文本，不改任何产品代码；回滚就是 revert 本 PR。dogfood 只在 main 的定时/推送批次跑，不进 PR 和合并队列。
• 先看：packages/qa/dogfood/test/declarative-endpoint-authoring-refusal.dogfood.test.ts（子进程跑 CLI）、packages/qa/dogfood/test/fixtures/second-object-exposure-fixture.ts（共享 fixture 加了一个 internal 字段）、docs/qa/platform-checklist/areas/api-backend.json。
• 两分钟验证：pnpm --filter @objectstack/dogfood exec vitest run --maxWorkers=2 test/data-request-shape-live.dogfood.test.ts，预期 13 个用例全绿。
• 需要你做的：无，席位落地。

What changes

Five api-backend checklist items that the release-18.2.0 Tier 1 sweep (#26468) scored PARTIAL now carry pins at the layer their oracle names. Every new case drives a booted stack through @objectstack/verify's real HTTP surface (Hono request injection), or the CLI's own bin/run.js as a child process for the one build oracle.

Each item's automated.ref names the new pins and what they assert, the verify texts that said "live leg" now say which pin carries the clause, revision is bumped and a history row cites #26572. No clause text changed. No product code changed.

Why

The card's ruled scope (triage 6437722483): pin the 11 api-backend Tier 1 clauses the 18.2.0 sweep scored PARTIAL at the layer their oracle names, in packages/qa/dogfood/**, with the checklist item revisions bumped, in slices of about five items, with no new CI lane. This is the first slice. The other six items (packaged-action-disabled-dispatch, action-activation-door-contract, rest-crud-config-contract, rest-batch-config-contract, rest-metadata-config-contract, rest-route-generation-tombstones) are left for later slices.

Tests

All seven touched dogfood files on the final head 19a4d70, under the verify lock, after rebuilding the one package main moved since the base (driver-sql):

pnpm --filter @objectstack/dogfood exec vitest run --maxWorkers=2 test/data-request-shape-live.dogfood.test.ts test/meta-read-doors-live.dogfood.test.ts test/error-sentences-live.dogfood.test.ts test/declarative-endpoint-authoring-refusal.dogfood.test.ts test/second-object-exposure.dogfood.test.ts test/import-reference-exposure.dogfood.test.ts test/showcase-declarative-endpoints.dogfood.test.ts
 Test Files  7 passed (7)
      Tests  119 passed (119)
os-verify-lock: VERDICT command-exit 0

import-reference-exposure.dogfood.test.ts is in the run because it shares the fixture that gained a field. Every expectation was first measured against the live answer on a probe boot and checked against the clause text before it was written down. No ablation: the diff changes no tested behaviour, only adds pins over behaviour that already holds.

Acceptance notes

• Dogfood runs only in main's scheduled and push battery (Dogfood Regression Gate's if: excludes pull_request and merge_group), so the PR's CI does not run these files; the local run above is their evidence until the next main battery.
• The CLI pin writes its scratch config through defineStack(…, { strict: false }) with @objectstack/spec linked into a temporary node_modules: the commands accept only a stack defineStack returned, and the strict factory would refuse the endpoint at import, before the command's own gate.
• The located position of a nested-relation refusal lives only in the refusal sentence (… at 'filter.REL' …); the pin asserts that token, the code, the status and object.
• The storage fault is forced by putting the local adapter's root under a regular file, so the write fails with ENOTDIR; the pin asserts 500 INTERNAL and that neither the errno, the path nor a stack line reaches the body.

Verification

No changeset: @objectstack/dogfood is private and docs/qa/** ships in no package, so this PR carries skip-changeset.

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic. (not touched)
• 2. Every name I added uses the casing for its kind.
• 3. No formatter ran; pnpm lint passes. (eslint over the touched files)
• 4. One issue, one branch off an up-to-date main, one pull request.
• 5. A change that publishes carries a changeset. (nothing publishes)
• 6. packages/spec touched: n/a.
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English.

🤖 Generated with Claude Code

https://claude.ai/code/session_01JQwxbWUpGqdpDRiD79LqXV

Generated by Claude Code