docs(qa): wave-2 checklist-accuracy close-out, slice B — six areas - #27009

Part of #25807 (wave-2 accuracy, slice B)

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：按 18.2.0 第二波五份测试记录，修正 ai、approvals、attachments-storage、i18n、platform-core、records-forms 六个领域共 35 条测试清单条目里的过时描述。只改文档，不动产品代码。
• 为什么改：这些条目的步骤、字段、错误码、界面文案或引用的测试文件已与当前代码不符（例如审批抽屉已移除、货币字段不再带 scale、动态摘要按读者语言渲染），下一轮运行会被误导或误判。
• 风险与回滚：只影响 QA 清单文本。三条断言随产品已变的行为改写（i18n.surface-matrix 的 a7/a10、records-forms.field-type-constraints 的 a2），旧版本的判定不再沿用。每条 revision +1、追加一行 history，回滚即 revert 本 PR。
• 先看：areas/records-forms.json 的 field-type-constraints（scale 从“已知缺口”改为“拒收、不舍入”）；areas/i18n.json 的 surface-matrix（a10 改为读者语言，plugin-audit: an activity summary is rendered once, at write time, in the workspace locale — store it as a key and render it in the reader's language #26167）；areas/approvals.json 的 quorum-m-of-n（抽屉改为请求记录页）。
• 两分钟验证：node scripts/check-platform-checklist.mjs，预期打印 check-platform-checklist: OK、退出码 0。
• 需要你做的：无，席位落地。

What changes

The slice-B close-out of the wave-2 checklist-accuracy findings that RUNNER.md routes to the wave anchor ("close out through the wave's anchor card … not extracted"). Sources: anchor comments 6433587719, 6433708086, 6433784748, 6433878766, 6433966437 and the run records #26450, #26456, #26468, #26476, #26481. Every finding was read against the code at base fd246c22 before its edit; each item's new history row names the files read.

• 35 items in ai (5), approvals (7), attachments-storage (8), i18n (2), platform-core (9) and records-forms (4): revision +1 from main's value and one appended history row each, citing the run record that found it (ref is the anchor [sweep] v18.2.0 release test sweep #25807, as slice A's rows are). No existing history row is changed; the previous last row only gains the comma the appended row needs.
• Three clauses change meaning with the product, and say so in their history rows (a verdict for an older revision does not carry): i18n.surface-matrix acceptance[7] (the served document is fifteen groups, not twelve) and acceptance[10] (activity summaries render in the reader's locale since plugin-audit: an activity summary is rendered once, at write time, in the workspace locale — store it as a key and render it in the reader's language #26167, not the write locale); records-forms.field-type-constraints acceptance[2] (scale is enforced by rejection, max_scale, and currency carries no scale; it was recorded as an unenforced gap).
• attachments-storage.upload-limits-scope-and-ownership acceptance[3] now scores pass from a pin the ref did not name (storage-upload-door-ownership.wall.test.ts, HTTP over a booted wall); attachments-storage.chunked-upload-integrity knownGaps[0] is closed for its pin half by storage-upload-organization-change.wall.test.ts.
• No pin upgrades of the Parked-on: #25807 partials. No studio-authoring, access-security, slice-A area file or RUNNER.md is touched.

No change, because …

• ai.skill-instructions-mcp-prompts, approvals.email-action-token-door, attachments-storage.read-inherits-parent-rls, attachments-storage.attach-requires-parent-edit, attachments-storage.orphan-tombstone-reap: the run's line is "ref accurate" (a confirmation); re-read, still true.
• ai.mcp-coded-refusals-and-runtime-exposure: a confirmation that revision 3 already names both files; both exist.
• approvals.request-page-reply-and-reader-visibility: ref accurate; the extra service-unit comment cases corroborate acceptance[1] below its layer only.
• approvals.decision-action-matrix A1: an observation (a skipped exec_review step is logged); the run says the discriminator holds.
• approvals.account-app-entry acceptance[0] "the runner builds the console itself": that is the clause's design.
• approvals.approver-resolution-matrix "administrators are identified by sys_member role": the item identifies them by their grants, as approval-service.ts organizationAdministrators does; the membership role is only the grant's provisioning source.
• attachments-storage.field-accept-maxsize-server-enforced recipe line (media_qa_media): already closed by revision 6 (qa(checklist): two more package-authored QA recipes (qa-media-constraints, qa-feeds-disabled) answer 422 NAMESPACE_PREFIX at their first object save, and neither may declare the namespace qa #26876, qamedia_media). The item's other three lines are edited above.
• records-forms.action-location-matrix ("authoring refuses a throwing visible"): already in knownGaps[2] since revision 16 (qa(checklist): records-forms — provisioning recipes for a walled two-organization mention leg, a packaged action specimen, and the app-crm import specs #26625), which cites QA run · release-18.2.0-w2-manual-browser (34/34) · 756220c4 · 2026-10-27 · 30 PASS / 3 PARTIAL / 1 FAIL / 0 BLOCKED / 0 NOT-RUN #26456.
• records-forms.record-discussion-mentions (qa_nofeeds → 422 NAMESPACE_PREFIX): already renamed qafeeds_nofeeds (revision 11).
• records-forms.field-group-visible-when namespace line: steps[1] already declares namespace qagroup and names qagroup_group_gate. Its other line is edited above.
• platform-core.boot-health "no default-level line names the Console mount path": no clause reads a mount line; acceptance[5] reads GET /_console/.
• ai.mcp-oauth-private-host-transport "missing clause: AS metadata issuer equals authorization_servers[0]": that is the open product defect oauth: on a private plain-HTTP deployment the authorization-server metadata publishes an https:// issuer while authorization_servers[0] and every endpoint are http:// (RFC 8414 §3.3 mismatch) #26472; its fix owns the clause.
• The other items the sources name in these areas (approvals.per-group-signoff, i18n.notification-localized-and-clears, i18n.flow-copy-translation-and-host-override, platform-core console-login, nav-surfaces-render, metadata-registry-serving, metadata-authoring-roundtrip, interrupted-migration-boot-report, activation-ledger-registration-home, activation-ledger-row-contract, url-overlay-contract, lifecycle-retention-sweep, settings-audit-secret-fingerprint, protocol-18-handshake-and-stored-replay, settings-organization-isolation-and-platform-rung, serve-composition-v18, and the remaining records-forms items of QA run · release-18.2.0-w2-tier1-b (80/80) · 756220c4 · 2026-10-27 · 15 PASS / 64 PARTIAL / 1 FAIL / 0 BLOCKED / 0 NOT-RUN #26450): named only with clause verdicts or parked partial coverage, no accuracy line. QA run · priority:P0 (23/23) · 756220c4 · 2026-10-27 · 20 PASS / 3 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #26481 re-checked every wave-1 line on its P0 items and found them fixed.
• Gaps, not edited (need a pin or a run, not text): approvals.decision-only-via-service has no pin and QA run · release-18.2.0-w2-tier1-a (73/73) · 756220c4 · 2026-10-27 · 13 PASS / 60 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #26468 carried it NOT-RUN; records-forms.record-edit-undo is carried BLOCKED (no packaged undoable update action on the showcase).

Tests

No product code changed, so no package test is owed. node scripts/check-platform-checklist.mjs exits 0 at the head (check-platform-checklist: OK — 16 areas, 329 items (324 active, 1 planned)). The edits were applied by a script that rebuilds each file from base text and asserts, per area, that only the 35 items differ, each at base revision + 1 with exactly one appended history row and every earlier row equal.

Acceptance notes

• approvals: four items not named by any wave-2 source still describe the retired request drawer (viewer-gating-submitter-side, notification-deep-link, dynamic-approver-routing, inbox-keyboard-flow). Rewriting them is not mechanical (inbox-keyboard-flow's drawer walk may describe removed behaviour), so they are reported for the anchor, not edited here.
• approvals.approver-resolution-matrix steps[6] / acceptance[5] still describe queue as a dead slot (审批节点「处理人 Value」应改为记录 lookup(现查 metadata 端点→只能手填);附 approver value 语义核实 + queue 未实现 #3508), while approval-service.ts now expands a queue to its members (ADR-0142 D6) and only warns when it expands to nobody. Not named by a wave-2 source; reported for the anchor.

Verification

Generated by Claude Code