docs(qa): wave-3 checklist accuracy slice S6 — api-backend, ai and automation - #28362

Requested by Sam · project thread
Fixes #28340

Part of #27377 (wave-3 checklist accuracy, slice S6).

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：三份测试清单（api-backend、ai、automation）里 18 个条目按当前代码改正文字，每个条目 revision +1、追加一行 history；automation 的 qa-flow-status-doors 夹具新增第 6 步。
• 为什么改：18.3.0 第三波 QA（QA run · release-18.3.0-w3-manual-api (25/25) · c4c515ad · 2026-10-29 · 23 PASS / 2 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #27392、QA run · release-18.3.0-w3-tier1-a (73/73) · c4c515ad · 2026-10-29 · 59 PASS / 14 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #27409、QA run · release-18.3.0-w3-manual-browser (54/55) · c4c515ad · 2026-10-29 · 44 PASS / 2 PARTIAL / 8 FAIL / 0 BLOCKED / 1 NOT-RUN #27441）发现这些条目的步骤或判据与产品现状不符，跑测的人按旧文字会误判。
• 风险与回滚：只改 docs/qa 下三个 JSON，不碰产品代码；没有条款被放宽，回滚即 revert。
• 先看：automation.json（新夹具第 6 步与 trigger-status-contract）、ai.json（mcp-oauth-private-host-transport 的未持有私网地址读法）、api-backend.json（formula-stdlib-matrix 29→30）。
• 两分钟验证：pnpm check:platform-checklist，预期末行 OK、352 items。
• 需要你做的：无，席位落地。

What changes

25 of the slice's 26 census rows still held at 488b3ed0 and are corrected to what the code says today; one row needs no edit. Every touched item gets revision +1 and exactly one appended history row citing its run record and #27377. main's history is an exact prefix of every touched item (the edit script asserted it, and the parsed result equals the intended model).

Highlights:

• aggregate-contract-matrix: the retirement message's tail is AGG_RETIRED_TAIL (names os migrate meta and the protocol upgrade guide, no --from 16); a grouped empty where answers no groups, so the empty-where identities are read ungrouped; knownGaps[0] names the seeded rows (a null annual_revenue row, 2025-12-29 Monday and 2026-01-04 Sunday in ISO 2026-W01, 2027-01-01 in 2026-W53).
• api-methods-verb-gate: the import body is spelled (format: 'json', rows, writeMode, matchFields for update), and the parser's 400 INVALID_REQUEST is named as not-the-gate; both legacy warnings print once per process (per combination, per object name), so each legacy leg takes its own object name.
• error-envelope-ledger: sign-up answers 403 SELF_REGISTRATION_CLOSED under the invite_only default; a third identity comes from admin create-user or an invitation.
• query-contract-matrix: compound AST filters are prefix-form ['and', cond, cond]; the four substring operators are case-sensitive, $icontains is the ASCII-fold twin.
• formula-stdlib-matrix: the count is 30 (29 chained calls plus the label() macro); a label() known-answer row is added; the scratch-object legs name a writable package with a declared namespace.
• mcp-run-action-exposure-gate (GAP): a staging recipe for the permitted half of list_actions — a runtime declarative update action, ai-exposed, requiring manage_metadata.
• agent-tool-skill-metadata-roundtrip: agent.tools / agent.knowledge / skill.triggerPhrases are plain unknown keys naming the upgrade guide since spec: retire tombstones, conversions and migration entries older than one protocol major; a strict unknown-key refusal with an upgrade-guide link takes over (maintainer ruling D2 = A) #25767; the surviving prescriptions are listed and agent.lifecycle is probed.
• mcp-oauth-private-host-transport (STALE + GAP): boot (a) is staged by the base URL's host literal, held or not; a held address stays required for the real-client leg only.
• mcp-http-surface: acceptance[4] names the HTTP door; stdio serves 9 tools because its bridge has no action methods.
• mcp-validate-expression: a new negative and step for blank input (the save gate's verdict, invalid_union).
• mcp-coded-refusals-and-runtime-exposure: names the qa_ai_mark producer the run used for acceptance[3].
• trigger-status-contract: the recipe gains step 6 (qa_input_schema_invalid, the 422 FLOW_INPUT_SCHEMA_INVALID row), the "no stock trigger" knownGap is dropped, and the purge leg warns that showcase_inquiry_purge really deletes.
• durable-suspend-restart: the PT1M follow-up may complete on the new process before the re-read; that completion is its survival proof, and the nested pair must still read paused and identical.
• packaged-flow-clone-contract: an empty-string name answers invalid_type; the arm is added.

Tests

No code changed. The three files are validated by pnpm check:platform-checklist (green). The two new staging bodies were parsed against the built spec at 8de73450: the recipe's step-6 flow parses with FlowSchema, both action bodies (qa_ai_gated, qa_ai_mark) parse with ActionSchema, and a control with an illegal inputSchema type is refused.

Acceptance notes

• Row 37 (automation.paused-run-trigger-record-masked) is not edited. Its fixtures.requires[1] already asks for an object with an internal: true field; the run used showcase_field_zoo, which has none. That is a runner deviation, not a ledger gap.
• Row 47 / 27 is a reading, flagged for the seat. The census called it a light ruling. The code judges only the configured base URL's host literal (isOAuthEligibleBaseUrl), and the run reproduced the whole (a) shape on an unheld 10.0.0.5, so the item now scores (a) that way and keeps a held address for the real-client leg. No clause text changed. If the seat wants a ruling first, this one hunk can be reverted on its own.
• Two GAP recipes are derived from source, not yet run live: qa_ai_gated (row 1) and the fast time_relative clone (row 58, whose interval spelling is the showcase's own schedule: { type: 'interval', intervalMs: 60000 }). The history rows say so.
• Not edited, noticed on the way: ai.agent-tool-skill-metadata-roundtrip's variants still label agent.tools, agent.knowledge and skill.triggerPhrases as "retiredKey" and list no agent.lifecycle variant. Changing variants changes the run matrix, so it is left for a seat call.
• No product defect was found while re-verifying.

Verification

node scripts/check-adr-links.mjs :: exit 0
node scripts/check-adr-links.mjs --self-test :: exit 0
node scripts/check-closing-keyword-parity.mjs :: exit 0
node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0
node scripts/check-comment-mask-corpus.mjs :: exit 0
node scripts/ci/plan-test-core-shards.mjs --self-test :: exit 0
pnpm --filter @objectstack/lint run check:doc-formula-expressions :: exit 0 (first run exit 3, prerequisite unbuilt; re-run after building formula + lint)
pnpm check:ci-filter-parity :: exit 0
pnpm check:cross-package-test-inputs :: exit 0
pnpm check:doc-authoring :: exit 0
pnpm check:driver-memory-census :: exit 0
pnpm check:gitlink-declared :: exit 0
pnpm check:nul-bytes :: exit 0
pnpm check:platform-checklist :: exit 0
pnpm check:refd-timer-probe :: exit 0
pnpm check:watch-hint-literal :: exit 0

check-platform-checklist: OK — 16 areas, 352 items (347 active, 1 planned); provisioning: 10 area recipes, 15 item references resolved (2 area-qualified), 10/10 recipes referenced; symbol anchors: 1066/1076 resolved (was 1064/1074 at base)

Generated by Claude Code