v17 verification tracker — browser-verify every user-facing change in the 17.0.0 train

[os-zhuang]

Tracking issue for end-to-end browser verification of the v17 (17.0.0-rc) train, per the release plan. A dedicated agent will work through this checklist against a running app (PORT=3000 pnpm dev showcase + :5180 objectui dev server where UI-side, or the dogfood-verification flow), acting as a real admin/user. Check items off as they are verified; file a separate issue for every failure found and link it here.

Defect rollups: #4482 (rc.0/rc.1 — 17 defects, all closed) · #5145 (rc.2/rc.3 — 3 defects, 2 open). Individual issues are also linked from the item they block, below.

Sources of truth: the curated release page content/docs/releases/v17.mdx, the 300+ pending changesets in .changeset/, and the objectui window cf2d56e32a11 → 4a4829d0ef39 (incl. the backfilled range 2cb8d78e24ad...c6cfdf1288b6, see PR #3908). The docs-sweep log lives at docs/v17-docs-sweep.md.

A. Breaking behavior — verify the new posture actually enforces

• Export opt-in (用户级 export 权限轴(接入 P1 预留的 userExportAllowed 槽) #3544/定时报表的 CSV 附件绕过用户级 export 权限轴(#3544 的第二道出数据的门) #3710): as a member_default user, export on any list is denied; after an admin adds allowExport: true to the set, export works; viewAllRecords alone does NOT grant export; a set carrying allowExport cannot bind to everyone/guest anchors; export headers still emit on an empty result (security 服务 getReadableFields 查询面(export 列投影的长期正解) #3547); reports covered by the same axis.
• ApiMethod shrink (P2:ApiMethod 枚举收缩至 6 原语(breaking,独立版本) #3543): an object authored with a legacy value (e.g. apiMethods: ['upsert']) strips to deny-all with a FROM→TO warning; primitives-declared objects still derive search/export/history correctly; Console renders the server's effective operation set (objectui#2823) and detail/form edit & delete are gated on it (objectui#2832), matching grid rows (objectui#2889).
• User-less flow runs refused (The #1888 user-less fail-open is wider than the lint that guards it — record-change flows fired by a system write run UNSCOPED, unlinted #3760): a runAs:'user' record-change flow fired by a system write (e.g. approvals status mirror) refuses data ops with UnscopedRunDataAccessError naming runAs:'system'; the originating write still succeeds; a runAs:'system' flow works and is audit-attributed.
• Alias retirement ([P3] Retire the three deprecated aliases — via the ADR-0087 D2 conversion layer, not by deleting the keys #3855): authoring action.execute / field.conditionalRequired / agent.knowledge.topics is rejected with the rename in the error; os migrate meta --from 16 rewrites all three; agent.tools is tombstoned (parse error, not silent strip) (feat(spec,lint)!: accept ADR-0109, remove agent.tools[], lint agent authoring, model AI exposure in tool resolution (#3820) #3894).
• Approval participant visibility (审批请求的可见性是「按租户」而非「按参与者」——getRequest 用 SYSTEM_CTX 读、只按 organization_id 收窄 #3590): a non-participant authenticated user cannot read another user's approval request (list/get/count), incl. payload snapshot, decision history, attachments; participants and admin override still can.
• Sharing (fix(sharing): 「完全访问」声明了删除/转移/共享，实现上与「编辑」等价 #3865/[P0] Metadata property liveness audit: ~half of all spec properties are dead; a cluster of security props is parsed-but-unenforced #1878): accessLevel:'full' converts to 'edit' at load; group recipient rejected (renamed team); business_unit recipient enforced; owner-type/guest rules no longer parse; the sharing-rule dialog is usable and permission-aware (objectui#2920); switching a rule off actually withdraws access (fix(sharing,driver-sql): a rule authored in Setup actually applies — and switching it off actually withdraws access #3850).
• Membership grade closed (ADR-0108/sys_member.role app-role channel reverses ADR-0057 D4 ("never as the authority for RBAC") — pin to the built-ins before the next RC; placement is the governed channel #3723): a value in sys_member.role no longer projects into current_user.positions; sys_member writes are governed (ADR-0105 D8: the scope-bounded issuance path has no caller — every principal who may invite is already a tenant admin #3697); delegated_admin reachable in Console with narrowed pickers (objectui#2891); scoped invitations place into unit+positions (objectui#2868).
• better-auth 1.7 (rc.2): existing password/social/SSO accounts sign in after the issuer backfill; unlink uses the account ROW id; boot log names non-derivable federated rows; 2FA obeys the operator lockout policy (2FA lockout is hardcoded to better-auth's defaults while the password lockout is operator-configurable — the second factor ignores the settings UI #3690); SCIM provider creation works when enabled (SCIM: 停在 @better-auth/scim rc.1,等正式版再整体迁移 —— rc.2 换掉了整套模型 #3653).
• Datasource fail-fast (ObjectQLEngine.init() 吞掉 driver 连接失败：连不上数据库的服务器照常启动，driver 的启动期致命错误被降级成运行时报错 #3741/显式绑定的 datasource 连不上只降级成一条 warning：绑上去的对象在启动后全废，直到查询时才炸 #3758/ADR-0062 D1 收尾:default driver 的 connect 与失败判决仍是第二份实现(阻塞点已定位) #3826): a bound datasource with a bad URL fails the boot with an operator-readable error; /ready 503s when a driver stops answering; Setup datasource list shows the real connect verdict + reason (objectui#2926); startup banner reads DSN datasources and prints no credentials (启动横幅对 DSN 形式的 datasource 显示 → (unknown)：describeRegisteredDriver 不认 connectionString #3793). — blocked on datasource: an object mapped to an unreachable datasource silently reads/writes the DEFAULT store — no boot failure, /ready still 200 #4462
• Per-tenant unique (多租户缺陷:unique 物化为全局唯一索引、无视 tenancy,与按租户分裂的 autonumber 序列自相矛盾(跨租户必然撞号 + 存在性探测泄露) #3696): two tenants can hold the same unique value; violation message no longer leaks cross-tenant existence.
• Multi-org entitlement (ADR-0105 D12): group posture refuses to activate without @objectstack/organizations; org switcher acts as write context with org attribution (objectui#2858).
• Node 22 floor (CI validates every PR gate on Node 20 (EOL 2026-04-30) while release/publish runs Node 22 #3825): dev/serve/CLI on Node 22; EBADENGINE warning on Node 20.

B. Removed surfaces — verify they are actually gone (and loud)

• /graphql → 404 (was 501); no GraphQL advertisement in discovery. — blocked on the discovery slot question below
• SDK: client.ai.{nlq,suggest,insights}, client.permissions.*, client.realtime.*, client.workflow.*, client.views CRUD, notifications device/preference helpers, projects.listTemplates() — absent (compile error), not 404s.
• CLI: os environments create --template rejected as unknown flag.
• Console: API console lists the real AI family, tool preview links no 404 (objectui#2925/test(app-showcase): round-3 permission-model retest — issues register with evidence #2921); useClientNotifications no longer exposes device/preference delegates (objectui#2862). — blocked on Console approvals: quorum progress and per-group chips do not render, though the server sends minApprovals / group / __nodeLabel #4478 (quorum/group chips)
• Marketplace publish moved: client.packages.install works (POST /packages no longer collides, POST /api/v1/packages is a publish-vs-install shape collision — REST registers first and shadows the dispatcher (#3587 finding) #3610); publish at POST /packages/publish.

C. New capabilities — verify they work end-to-end

• Files as records (ADR-0104): upload against a field with accept/maxSize → violations rejected server-side (FileConstraintError, direct API call too, not just the widget); stored value is a sys_file id, read expands; downloads carry real filename+content-type (fix(approvals+storage): 审批决策附件在时间线里没名字、点击无反应、下载名是乱码 token (objectui #2820) #3504); governed download denies an unauthorized caller; os migrate files-to-references dry-run reports / --apply converts+verifies; strict mode only after the flag; Console adopts the reference shape incl. localized upload widget (objectui#2828/docs(adr): ADR-0092 标记 Accepted，关联实现 issue #2816 / #2817 #2819); image fields render consistently with click-to-zoom (objectui#2837).
• Dynamic approver routing (审批流无法在「运行中」动态确定审批人——审批人在提交时即被 $trigger 快照锁定（动态路由 / 动态会签受阻） #3447): expression approvers resolve at node entry over current/trigger/vars (bare record rejected with prescriptive error); resolveAs + per_group sign-off; onEmptyApprovers all three policies (incl. auto_approve continuing the approve edge); decision outputs: declared keys accepted → resume as <nodeId>.<key> vars, undeclared rejected, typed outputs render record pickers (objectui#2831/docs+build(releases): whole-platform 12.0→14.x history + a maintenance model that includes the frontend #2827); live field/manager resolution lets an earlier step route a later one.
• Approvals UX: quorum progress, per-group chips (objectui#2811), admin override for unstaffed approver (Approval routed to an empty position permanently locks the record (no admin override, no recovery) #3424, objectui#2810), timeline attachment chip opens (objectui#2821), lockRecord honored — "in approval (editable)" vs locked (objectui#2906/feat(cli): surface migration guide when specVersion trails the installed platform #2914), decision recorded against the authenticated caller (approvals: the acting identity must be resolved server-side, not taken from the request payload #3800), status mirror names the human (Approvals status mirror drops the acting user, forcing every downstream record-change flow to runAs:'system' #3783), dead run leaves no RECORD_LOCKED (Approval: a dead approval run can leave the record RECORD_LOCKED (#3424 follow-up, expected-behavior 3) #3456). — blocked on Console approvals: quorum progress and per-group chips do not render, though the server sends minApprovals / group / __nodeLabel #4478 / approvals: an admin override of a staffed approver slate is recorded as an ordinary approval — no override marker anywhere #4466
• Write observability: PATCH/POST /data returns droppedFields (single, bulk, cross-object batch 审批场景下记录可写性的反馈全线失真:能改的显示「已锁定」,改不了的提示「更新成功」 #3794); Console toasts on silently-dropped read-only fields (objectui#2814) and keeps warnings on detail (objectui#2914); flow step warnings in Runs panel (service-automation: update_record reports success when written fields are silently stripped — no observability for dropped writes (split from #3356) #3407).
• record-after-write trigger (record_change flow start node binds to a single lifecycle event — no create-OR-update in one flow #3427): fires on create OR update with previous null on create; Studio offers the new trigger and hides never-firing record-change.
• Screen flows (Console: screen-flow Submit never calls the resume endpoint — every screen flow is un-completable from the UI #3528): pause → Console completes it; visibleWhen honored in render+validation; runner doesn't tear down its host. — blocked on screen flows: resume performs no server-side validation — missing required fields and undeclared keys all complete the run #4477
• Analytics: RLS/tenant scope on ObjectQL path (security(analytics): ObjectQLStrategy 不消费 getReadScope — NativeSQL 回落后聚合查询无 RLS/租户谓词(#2852 修复未覆盖的另一半) #3597), dateRange applied (analytics: ObjectQLStrategy 静默忽略 timeDimensions[].dateRange —— 恰好是 date-granularity 图表必走的那条路 #3650), effective granularity in labels+drills (Analytics query builder ignores widget dateGranularity, sortBy/sortOrder, and funnel stage order #3588), FK-expand cross-object grouping / fail-closed (analytics/objectql: 跨对象(点号 lookup)维度聚合在 ObjectQL 路径上静默塌成 (null) 桶 / native SQL 报错 #3654), label lookups RLS-scoped (analytics: 让 executeAggregate 桥携带 ExecutionContext(#3597 的纵深防御第二层)+ 两处残留无 scope 调用 #3602), widget dateGranularity/sortBy/limit honored (objectui#2864), funnel stage order, {current_user_id} in widget filters (objectui#2857). — blocked on analytics: /analytics/query ignores record-level scoping — a member counts and reads dimension values of records they cannot read #4467
• Historical import (data import: mid-lifecycle rows rejected by state_machine.initialStates — historical-data migration blocked (#3433 sibling) #3479/data import: a "historical" import can't preserve original timestamps / audit fields — updated_at is stamped now, readonly fields stripped on upsert (#3479 follow-up) #3493/data import undo: 撤销一次「historical」导入无法还原被保留的 readonly / 审计字段 — undo 的 writeCtx 缺 preserveAudit (#3493 follow-up) #3549): wizard "Import as historical data" (objectui#2815) skips state machine + preserves audit timeline, undo included; row errors human-readable, no raw SQL (Identity import: raw SQL leaks into row errors; DB constraint failures need sanitized, friendly messages #3566); email format validated in preview (objectui#2840).
• i18n: /i18n/labels emits declared shape with help/options (GetFieldLabelsResponse declares rich label entries; both surfaces emit bare strings #3847); product-authored translations render (i18n: two unbridged bundle shapes — file-authored objects.<name> vs the runtime translation metadata type's o.<object>, so translations cannot be authored in the product #3778); all ten Console packs at key parity (objectui#2909); system-settings hub localized (objectui#2859); SSO/SCIM/user-position/import-job admin objects translated.
• Seeds: boot banner Seeds: X inserted · Y updated · Z skipped + yellow REJECTED line (showcase: 4/5 projects and 9/10 tasks are silently rejected on every boot (FSM initialStates vs seed data) #3415/os dev: surface seed / sample-data-heal outcomes in the boot summary (info logs are swallowed by the default warn log level) #3430); marketplace rehydrate heals sample data.
• Grid/detail: eleven summary aggregations (objectui#2890), real match total under server pagination (objectui#2873), Kanban Uncategorized lane (objectui#2804), $or filters AND their contents (driver-sql), datetime grouping not collapsing to (null) on SQLite (SQLite 上 Field.datetime 的 dateGranularity 分桶恒为 NULL —— 趋势图塌成一根柱子 #3773), empty group bucket is real null (空分组桶的键两条路不一致:下推 SQL 给 null,内存兜底给 "(null)"(不限日期分桶) #3839).

D. Docs verification (site)

• /docs/releases reachable from the left sidebar (restored in docs(releases,nav): v17 follow-up — Console gap backfill, sidebar restore, first docs sweep #3908) and /docs/releases/v17 renders with Console section + upgrade checklist.
• Re-run the docs sweep per docs/v17-docs-sweep.md (watermark: a641d10 · 305 changesets · objectui 4a4829d0ef39) — v17 is still iterating; append run 2+ to the log.

E. Known out-of-scope items already logged

• Spec comment drift: core-services.zod.ts 'ai' member comment still says "NLQ, Chat, Suggest, Insights" (comment-only, spec-touching PR).
• content/docs/releases/implementation-status.mdx predates the v17 window; needs its own regeneration pass.
• RC exit: after changeset pre exit, re-check the v17 page's version wording and this checklist's remaining items.

---

F. 17.0.0-rc.1 supplement

Sections A–E were written against the rc.0 cut (watermark a641d10, just after the rc.0 version commit fc156fa4a). This section adds what shipped in 17.0.0-rc.1 (version commit 2bafe62e8, 2026-07-31): the window a641d10 → 2bafe62e8, ~340 non-release commits, objectui pin advanced 4a4829d0ef39 → e651c936870e → a136322f8723 → bebaebd39ace → 7d9734d5e321. (Commits after 2bafe62e8 — #4421/#4423/#4424/#4425/#4427/#4429 — are post-rc.1 and belong to the next rc's checklist.) Same rules: check off what passes, file a separate issue per failure and link it here.

F1. Actions — identity, dispatch, and failure semantics (ADR-0110 / ADR-0112)

• Undeclared executables refused (feat(runtime,objectql,metadata)!: ADR-0110 — action identity is name; refuse undeclared executables (#3935) #3958/feat(runtime)!: the undeclared-action refusal has no opt-out — drop OS_ALLOW_UNDECLARED_ACTIONS (ADR-0110 D3 revised) #3987): invoking an action name the object never declared is refused; the OS_ALLOW_UNDECLARED_ACTIONS opt-out no longer exists; action identity is name (Console carries the D1 fix, objectui a136322f8723).
• Dispatch honors the declared type (fix(actions): dispatch on the declared action type over REST (#3915) #3919/fix(actions): reach global actions at their real registration key, and 404 an action that never dispatched (#3913) #3930/fix(actions): seed a flow action's params with the row id (#3915 follow-up) #3934): a flow action runs its flow (params seeded with the row id), a script action runs its body over REST; a global (object-less) action is reachable at its real key (/actions//:action, fix(actions): mount the object-less /actions//:action shape; bump objectui to e651c936870e #4005) — showcase ships a global-action specimen and a bulk selected-records action (feat(showcase): 演示作用于选中记录的批量 action #4201).
• Failures speak HTTP (fix(actions)!: failures speak HTTP — rejections are 400, success is a single wrap (#3962) #3969/fix(actions): an action that CRASHED is a 500, not a 200 reporting success:false (#3913 follow-up) #3951/fix(runtime): serve VALIDATION_FAILED as 400 with fields[] from both dispatcher exits (#3918) #3920): a rejected action → 400 with the declared envelope; a CRASHED action → 500, never a 200 with success:false; VALIDATION_FAILED → 400 with fields[], and a form action anchors those field errors on the form controls across the sandbox boundary (fix(runtime): carry code/fields across the sandbox boundary so form actions can anchor validation errors (#3918 follow-up) #3937). — blocked on actions: sandbox capability denial answers 400 as a deliberate rejection, not the 500 the crash contract promises #4431
• Error vocabulary is one catalog (ADR-0112, feat(spec,core,runtime,docs)!: ADR-0112 batch 1 — one error-code vocabulary, SCREAMING_SNAKE, schema-enforced (#3841) #3988/refactor!: ADR-0112 batch 2 — sweep the lowercase error-code emitters (#4003) #4021/fix(runtime,spec)!: the dispatcher's error.code is the semantic string; the HTTP status moves to httpStatus (#3842) #3971): error.code is SCREAMING_SNAKE semantic string, HTTP status lives in httpStatus; field-validation messages are localized and name the field by its label (fix(spec,objectql,rest,runtime): localize field-validation messages, name the field by its label (#3957) #4014); no raw Zod shapes leak onto the wire (feat(spec,rest,objectql)!: a closed field-level error catalog, and Zod stops leaking onto the wire (#3977) #4035).
• Action params enforced by default (feat(runtime)!: 动作参数默认严格，opt-in 开关删除（#3438 D2 翻转，17.0 车次） #4213): an out-of-contract param is refused with no opt-in flag; an action body writing ctx.record where it cannot land is visible at call time (feat(runtime): action body 被丢弃的 ctx.record 写在调用时可见 (#4345) #4357).

F2. Sharing & security hardening (ADR-0111)

• Share management has an authorization layer (fix(sharing)!: give the share-management surface the authorization layer it never had (ADR-0111 P0, #3902) #3965): a user who merely sees a record cannot manage its shares; a record's share-manager can revoke share-links on it (feat(sharing): a record's share-manager may revoke any share-link on that record (ADR-0111 D8, framework) #3986); hierarchy managers manage shares only within their write DEPTH (feat(sharing): hierarchy managers may manage shares within their write DEPTH (ADR-0111 D1 DEPTH, framework) #3997).
• Verb boundary (fix(sharing)!: an edit-level share no longer grants delete (ADR-0111 D3, the verb boundary) #3975): an edit-level share does NOT grant delete.
• Fail-closed rules: a sharing rule with no criteria shares nothing (fix(sharing)!: a rule with no criteria shares NOTHING, not every record (#3896) #3929); criteria_json is declaratively required (feat(sharing): criteria_json is declaratively required — ADR-0113 P2, the first consumer (P1 browser-verified) #4044); a disabled RLS policy no longer grants (fix(security)!: a disabled RLS policy no longer grants — security-subset liveness re-verification (#3896 follow-up) #3980). — blocked on sharing: deactivating a rule never withdraws its materialized grants — not on touch, not at boot #4433 / sharing: DELETE /sharing/rules/:idOrName answers 500 for both address forms — rules cannot be deleted over REST #4434
• Anonymous access is always denied for data (feat(auth)!: retire the api.requireAuth opt-out — anonymous data access is always denied (#3963 step 2) #4043): the api.requireAuth opt-out is gone; audience:'public' still publishes a book anonymously on a secure-by-default deployment (feat(rest): audience:'public' publishes a book anonymously on a secure-by-default deployment (#3963 step 1) #3995); with no auth implementation the /auth domain answers 501 instead of fabricating a login (fix(runtime)!: the /auth domain answers 501 instead of fabricating a login (#4113) #4179); dev security stubs refuse to load under NODE_ENV=production (fix(plugin-dev,plugin-hono-server): retire the security dev stubs; refuse to load under NODE_ENV=production (#4093) #4126).

F3. Query/write strictness — silent drops became refusals

• List/query params: unknown list query params are rejected, not read as zero-matching filters (fix(data): reject unknown list query params instead of reading them as zero-matching filters (#4134) #4169); sort/select/expand naming a missing field are rejected (fix(data): sort / select / expand 指向不存在的字段时被拒绝，而不是静默丢弃 (#4226) #4240); a dotted-path sort is refused (fix(data): sort 的点号路径被拒绝（400 INVALID_SORT），不再静默降级为不排序 (#4256) #4303); searchFields/groupBy/aggregations naming a missing field are rejected (fix(data): searchFields / groupBy / aggregations 指向不存在的字段时被拒绝，而不是静默降级 (#4254) #4315); a filter the server cannot apply is rejected (fix(data): a filter the server cannot apply is rejected, not silently ignored (#4181) #4209), and an uncompilable filter throws instead of matching everything (fix(driver-sql,driver-memory): an uncompilable filter throws instead of matching everything (#3948) #4029).
• Filter semantics: implicit field filters AND-merge with an explicit filter instead of being dropped (fix(data): implicit field filters AND-merge with an explicit filter instead of being silently dropped (#4164) #4190); a $filter array that is not a filter AST is rejected (fix(metadata)!: a $filter array that is not a filter AST is rejected, not passed through (#4121) #4200).
• Writes: bulk writes bind to the object in the path, not the body (updateMany 让请求体覆盖路径上的 object —— 暴露闸门查的是 A,写进去的是 B #3933); deleteMany selects on the id list only (deleteManyData 把请求体的 options 展开在 where 之后 —— body 可覆盖 id 谓词,把"删这几条"放大成"删调用者可见的全部" #3897); the batch-size cap is enforced (批量写路由的 "max 200" 一处都没在拦 —— 而且同一个端点有两份互相矛盾的 Zod #3939). — blocked on data: PATCH/DELETE of a nonexistent record answer 200 success instead of RECORD_NOT_FOUND #4435
• Paging determinism (objectui#3106, fix(data): paging a sorted read is a partition of the result set, not five queries that share a WHERE clause (objectui#3106) #4367/fix(batch,drivers): 分页确定性的两个后续 —— 把「有 gate」变成真的，把批处理翻页改成 keyset (#4363) #4416): paging a sorted grid is a partition — no duplicated/missing rows across pages; GET /data/:object/export honours a search term (fix(rest): GET /data/:object/export honours a search term #4230).

F4. Temporal correctness (ADR-0053 D-A3/D-D)

• Field.datetime stores one UTC form per dialect (fix(driver-sql): give Field.datetime one UTC storage form per dialect (#3912, #3942) #3953); Field.time stores wall-clock HH:MM:SS text (fix(driver-sql): Field.time 规范化存储 — HH:MM:SS[.fff] 墙钟文本，三方言统一 (#3994) #4020); Field.date NOW() default reads the UTC calendar day (fix(driver-sql): Field.date 的 NOW() 默认值改读 UTC 日历日 (#4022)；调高 cloud-connection seed-lookup 测试超时 #4026).
• A bare-day upper bound (<= 2026-07-31) covers the whole day on SQL, memory and mongo drivers (fix(driver-sql,service-analytics): bare-day upper bounds cover the whole day on Field.datetime (#3777) #4041/fix(driver-memory,driver-mongodb): bare-day upper bounds cover the whole day (#4042) #4048), and the RLS write-side check evaluator honours the same calendar-day bounds (fix(formula,spec,core): the RLS write-side check evaluator honours calendar-day upper bounds (ADR-0053 D-D) #4076).
• os migrate plan lists the datetime storage convergence for a pre-v17 datastore (fix(cli,driver-sql): os migrate plan lists the datetime storage convergence (#3954) #3964).

F5. Analytics honesty

• Empty analytics slot 404s — the degraded shim serving unscoped aggregates is retired (fix(metadata-protocol,objectql)!: retire the degraded analytics shim — empty slot 404s instead of serving unscoped aggregates (#3891) #3989); /analytics mounts only when the capability exists (feat(runtime): /analytics 路由按能力条件挂载——没装 service-analytics 连 405 都不再有（#3891 收尾，ADR-0076 D11） #4019); request bodies are validated at entry (fix(spec,runtime)!: AnalyticsQueryRequest 即裸 AnalyticsQuery；/analytics 入口 Zod 校验，畸形请求 400（#3878 建议 1） #4010). — blocked on analytics: /analytics/query ignores record-level scoping — a member counts and reads dimension values of records they cannot read #4467 / analytics: a measure naming a missing field 500s with SQLITE_ERROR instead of a 400 naming the field #4437
• A measure emits its declared aggregate, not COUNT(*) (fix(analytics)!: a measure emits what it declares, instead of COUNT(*) (#4157) #4184/fix(analytics): a new spec aggregate can no longer silently return a row count #4153); $or/$not filters reach the query (fix(service-analytics): $or / $not filters reach the query (#4128 follow-up) #4175); the time axis is ordered by default and report.order is live (feat(analytics): order the time axis by default, give reports a sort declaration (#3916) #3921/chore(liveness): flip report.order to live now that objectui lowers it (#3916) #3938); a timeDimensions bucket projects into result rows (fix(analytics): timeDimensions 分桶维度回到结果的 rows 与 fields (#4033) #4069).

F6. New capabilities since the rc.0 cut

• Multi-value lookup seeds (seed-loader: 多值 lookup（multiple: true）的自然键数组被静默丢弃，记录落库但整个关联字段缺失 #3911): a seed row with a natural-key array on a multiple:true lookup resolves to references (showcase specimen); dropped reference fields are counted in the boot banner (seed-loader: a dropped reference FIELD is invisible in the summary — totalErrored counts dropped records only, so the boot banner reads clean #3932).
• ADR-0113 required split (feat(spec,objectql,driver-sql)!: ADR-0113 accepted — required is a write contract, storage.notNull is the column constraint #4031): required enforces on write (yields fields[]), storage.notNull is the column constraint; the contradictory uniqueness double-declaration lints (feat(cli): lint the contradictory uniqueness double-declaration (#3991) #4034).
• Approvals: decisionOutputs may be declared required (objectui#2955); structured reassign hand-off ([approvals] 转签审计默认 comment 落裸用户 ID("<from_id> → <to_id>"),审批动态里看不出谁转给谁 #4365) and flow system-write audit attribution ([automation/audit] runAs:'system' 流回写的审计行无归因(user_id/actor 双空),console 历史显示「未知用户」 #4366) via fix(automation,objectql,spec,approvals): flow system-write audit attribution (#4366) + structured reassign hand-off (#4365) #4403; per-run flow summaries selected / acted / skipped in Runs (feat(spec,service-automation): surface per-run flow summaries — selected / acted / skipped (#4354) #4377), with an honest marker when acted is incomplete (feat(spec,service-automation): a run says when its acted count is incomplete, instead of guessing (#4354) #4397).
• UI metadata: FormSection.pane split-pane placement renders (feat(spec): FormSection.pane — explicit split-pane placement (objectui#2153 follow-up) #4160); element:button declares its action via InlineActionSchema (objectui#2997, feat(spec): element:button declares the action it executes — InlineActionSchema (objectui#2997) #4135); legacy string rowActions still render (objectui#2960, test(showcase): a specimen for legacy string rowActions (objectui#2960) #4101).
• Files (ADR-0104 D3 wave 2): released-field-file collection runs behind the per-deployment migration gate (feat(storage): 开启回收 — 释放的字段文件按部署门禁进入墓碑与回收 — ADR-0104 D3 wave 2 (PR-5b) (#3459) #4208), proven end-to-end on a real boot (test(dogfood): 字段文件回收的真实启动端到端证明 — ADR-0104 PR-5b 全周期 + 两条否决路径 (#3459) #4285).

F7. Boot / CLI / authoring strictness

• os serve boots the platform with no compiled artifact (fix(cli,core,metadata,runtime): the platform boots with no application — os serve no longer needs a compiled artifact (#4085) #4110); a config-booted app keeps its module code so action handlers reach the engine (fix(cli): a config-booted app keeps its module code — action handlers reach the engine again (#4095) #4129, regression from serve 对「bare defineStack config + objects、无 dist artifact」的形态启动失败:Service 'manifest' is async - use await #3887); the boot merge keeps the authored api block (fix(cli): the boot merge no longer discards the authored api block (#4002) #4008); boot-quiet window buffers plugin logs instead of discarding them (fix(cli): serve's boot-quiet window buffers plugin log lines instead of discarding them (#4012) #4084).
• os migrate value-shapes gates reference/structured-JSON value shapes per deployment (feat(migrate): os migrate value-shapes —— 引用/结构化 JSON 值形态的按部署门禁（#3438 第 2 项） #4235); migrate DDL is deferred until confirmed and SQLite occupancy is detected (fix(cli,driver-sql): defer migrate DDL until confirmed + detect SQLite occupancy (#3917) #3924); scaffolds stamp engines.protocol (fix(cli): stamp engines.protocol into scaffolds and example apps #4239).
• Unknown-key rejection wave (未知键静默剥离仍是全仓默认:把 #3405 的 strict 收紧从一个 schema 推广到整个可授权面(ADR-0078 完整性闸门) #4001 line): authoring an unknown key on flow/permission (feat(spec)!: 未知键在 flow / permission 授权 schema 上大声拒绝（#4001 Tier-A 切片） #4071), RLS/sharing/positions (feat(spec)!: RLS 策略 / 共享规则 / 岗位 schema 拒绝未知键（#4001 第 2 步） #4099), approvals (feat(spec)!: 审批授权 schema 拒绝未知键（#4001 第 3 步） #4119), app shell/navigation (feat(spec)!: 应用外壳与导航树拒绝未知键（#4001 app 步 PR B） #4165), hooks/datasources (feat(spec)!: hook 与 datasource 拒绝未知键（#4001 data 步，收尾最后两个待验证分类） #4207) fails validation loudly — incl. nested metadata (feat(spec): 未知键 lint 下探到嵌套元数据（补上 227 个此前无声的站点） #4218); the nested-select object form in select lists is removed (refactor(data)!: a select-list entry is a field name — the nested-select object form is removed (#4196) #4268); seven dead AppSchema keys are tombstoned (feat(spec)!: AppSchema 七个死键墓碑化（#4001 app 步 PR A） #4142).
• Packaging: every published rc tarball carries CHANGELOG.md (chore(packaging): CHANGELOG.md ships in every npm tarball (#4261) #4297) and a files whitelist (chore(packaging): every published package declares a files whitelist (#4248) #4262); plugin-hono-server no longer serves CRUD/discovery (transport adapter only, feat(plugin-hono-server)!: 删除 CRUD/discovery 便利面 —— 插件回归纯传输适配器（#4073 终点） #4296) and registerStandardEndpoints defaults to false (feat(plugin-hono-server): registerStandardEndpoints 默认翻 false —— 便利面改为显式 opt-in（#4073 第一步） #4280).

F8. Docs (run 2+)

• Re-run the docs sweep per docs/v17-docs-sweep.md from watermark a641d10 → 2bafe62e8; append the run entry.
• At changeset pre exit: re-check the v17 release page wording and close out sections A–F.

---

G. 17.0.0-rc.2 / rc.3 supplement

Sections A–E cover rc.0, F covers rc.1. This section covers the window 2bafe62e8 (rc.1) → a1a855a28 — 277 non-release commits, 283 new changesets, objectui pin 7d9734d5e321 → f5bc4c78be76. Two release cuts fall inside it: rc.2 (89d2a4eb3) and rc.3 (cut at 2e284b254, published as the npm rc dist-tag; main has since moved 56 commits past that point, and main's package.json still reads 17.0.0-rc.2 because the version commit was not merged back).

All 17 defects filed from the A–F verification are closed; G1 re-verifies them rather than trusting the close.

Three new ADRs land in this window: ADR-0118 (non-user actor contract), ADR-0119 (reachable transactions + honest atomic batch), ADR-0121 (declarative-endpoint routing, rules only — implementation tracked separately).

G1. Regression — the A–F defects stay fixed

• analytics: /analytics/query ignores record-level scoping — a member counts and reads dimension values of records they cannot read #4467 analytics scoping. A member with shares on 2 of 5 private notes counts 2 (not 5), and dimensions:["title"] returns only the titles they may read.
• sharing: deactivating a rule never withdraws its materialized grants — not on touch, not at boot #4433 / sharing: DELETE /sharing/rules/:idOrName answers 500 for both address forms — rules cannot be deleted over REST #4434 sharing-rule lifecycle. Deactivating a rule withdraws its materialized grants; DELETE /sharing/rules/:idOrName succeeds on both address forms and withdraws with it.
• data: created_at is client-writable on an ordinary PATCH — the audit anchor can be forged silently #4447 created_at. A client-supplied created_at on an ordinary PATCH is dropped (and reported in droppedFields), not persisted.
• data: a lookup accepts an id that does not exist in the referenced object — including the RBAC permission-set link tables #4441 dangling lookups. A lookup value resolving to no row is refused, including sys_position_permission_set.permission_set_id.
• datasource: an object mapped to an unreachable datasource silently reads/writes the DEFAULT store — no boot failure, /ready still 200 #4462 datasource binding. An object mapped to an unreachable datasource fails loudly rather than silently using the default store.
• screen flows: resume performs no server-side validation — missing required fields and undeclared keys all complete the run #4477 screen-flow resume. A missing required field and an undeclared key are both refused.
• approvals: an admin override of a staffed approver slate is recorded as an ordinary approval — no override marker anywhere #4466 approval override. An admin override of a staffed slate is distinguishable in sys_approval_action.
• actions: sandbox capability denial answers 400 as a deliberate rejection, not the 500 the crash contract promises #4431 / data: PATCH/DELETE of a nonexistent record answer 200 success instead of RECORD_NOT_FOUND #4435 / data: unsupported-filter-operator refusal ships without error.code and leaks the [sql-driver] prefix #4436 / analytics: a measure naming a missing field 500s with SQLITE_ERROR instead of a 400 naming the field #4437 envelopes. Capability denial → 500; PATCH/DELETE of a missing record → 404; filter-operator refusal carries error.code and no driver prefix; an analytics measure naming a missing field → 400 naming the field.
• meta overlays: unnormalized type segment creates phantom rows that shadow the code-authored listing and cannot be deleted #4432 meta overlays. Both type spellings address one namespace; an overlay never shadows the code-authored listing; DELETE removes what it addresses (see 6beb70856 — overlays now write through the SchemaRegistry). — partially: namespace + shadowing + immediate dispatch fixed; the deleted-overlay-still-listed branch survives → meta overlays: a deleted overlay stays in the /meta listing though dispatch correctly 404s (#4432 residual) #5079
• migrate value-shapes: a lookup holding an embedded record object passes the scan — the exact case the ADR-0104 D1 gate exists to find #4455 value-shapes. A lookup holding an embedded record object is reported by the scan.
• Setup System Overview: every KPI tile reads 0 — the dataset path lowers an all-time range to WHERE created_at = $1 #4475 / Console approvals: quorum progress and per-group chips do not render, though the server sends minApprovals / group / __nodeLabel #4478 / docs: nine passages date the #4286 query-surface removals to spec 18 — they ship in 17 #4476 UI+docs. Setup System Overview shows real counts; quorum progress and per-group chips render; the #4286 removals are dated to 17.

G2. ADR-0118 — the non-user actor contract

• sys_metadata_history.recorded_by stores NULL for a non-user actor, not the sentinel string 'system' (sys_metadata_history.recorded_by 是 lookup('sys_user') 却存哨兵字符串 'system'——声明的类型与实际存的值不是一回事 #4556); readers tolerate both on rows written before the change.
• A write with no resolvable actor is fail-closed rather than attributed to a fabricated principal; isSystem is explicit at every call site that means it.
• The boot banner reports the resolved tenancy posture, not the legacy boolean (CLI 启动 banner 的 Tenancy: 读布尔 multiTenant，与 ADR-0105 D1 的权威 knob OS_TENANCY_POSTURE 对不上——isolated 会显示成 single-tenant #4801).

G3. ADR-0119 — atomic means atomic, or it refuses

• deleteMany / updateMany with atomic: true either run in one transaction or refuse — no partial application reported as success (fix(metadata-protocol): deleteManyData has the same fake-atomic as batchData, updateManyData ignores atomic entirely #4620).
• Batch per-row results deliver the declared BatchOperationResultSchema shape (fix(metadata-protocol)!: batch 逐行结果迁移到 BatchOperationResultSchema 形状 —— 方案 B 已拍板,硬切 + 诚实迁移说明(Blocked-by #4620) #4793, hard cut); the new ROLLED_BACK / NOT_ATTEMPTED row codes appear on the rows they describe.
• A bulk-write limitation is reported as the platform's, naming the constraint, instead of blaming the author ([rc 止血] 批量写上引用 previous 的 hook 条件:泛化失败换成点名批量限制的专门诊断 + ADR 补遗 #5037). — data: updateMany runs hooks for a nonexistent id — the row fails INTERNAL_ERROR from a hook-condition abort instead of RECORD_NOT_FOUND #5088 fixed and re-verified: updateMany / deleteMany / atomic all answer RECORD_NOT_FOUND for a row naming no record

G4. Hook / validation evaluation — the #4649 family

• A hook condition the platform cannot evaluate ABORTS the operation rather than defaulting to false (hook 的 condition 求不出值时:全局 fail loud —— 抛错并中断该次操作(方案 B 已拍板;Blocked-by #4770) #4775) — the inverse of the pre-fix behaviour.
• A hook condition evaluates against the complete record (stored ⊕ payload), so a predicate over an unchanged field resolves (bug(objectql): hook 条件对着「只含本次更新字段」的残缺 record 求值，取不到的字段被吞成 false —— 审计 hook 静默不触发 #4770).
• The hook-condition CEL scope carries previous, so transition semantics are expressible and aligned with validation predicates (bug(objectql/docs): hook condition 的 CEL 作用域只绑定 record —— 文档教的 previous.x / ctx.record 根本不存在,过渡型条件写不出来 #4784).
• An unevaluable validation predicate fails closed, and the merged record is total (Script validation rules are silently skipped when their predicate fails to evaluate — fail-open is the wrong direction for a validation #4649).
• Parent-scoped readonlyWhen is enforced server-side, not only in the client (Parent-scoped readonlyWhen is unenforced server-side — the field lock fails open, so a paid invoice's frozen lines can be rewritten over the API #4889).

G5. Metadata plane honesty

• A failed history read never invents event_seq / version ([metadata-protocol] SysMetadataRepository 的 nextEventSeq()/nextItemVersion() 同样把读失败当「表还没建」，静默从 1 重新发号 —— #4825 在 canonical 路径上的同形缺陷 #4867, [metadata] nextEventSeq() 把驱动读失败也当成「表还没建」,静默从 1 重新发号 —— #4632 同形,机械检查覆盖不到 #4825).
• sys_metadata DDL failure is loud; only "table already exists" is swallowed ([metadata] database-loader 吞掉 sys_metadata 的 DDL 失败后仍置 schemaReady=true —— 第二类降级(#4632 规则),本轮因包冻结未修 #4728).
• publishDraft's draft-drain discriminates by cause instead of swallowing every failure ([metadata-protocol] SysMetadataRepository.publishDraft() 把 draft 清理的全部失败都当「并发发布者已抽走」,静默留下一条永远 pending 的 draft 行 #4981).
• Saved overlays are written through the SchemaRegistry and are dispatchable immediately (meta overlay: a just-saved overlay is listed but not dispatchable for a short window — a cache between saveMeta and resolveRouteActionDeclaration lags the write #4521) — no restart, no cache lag.
• Audit history and global search sort by order, not direction (fix(metadata-protocol): two internal engine.find calls sort by direction, a key no driver reads — audit history and global search silently return ASCENDING #4674).
• subscribeMetadata delivers true MetadataEvents (client realtime declared ≠ enforced:subscribeMetadata 回调把 RealtimeEventPayload 硬铸成 MetadataEvent,声明的顶层字段运行时是 undefined #4602); subscribeData delivers a real DataEvent (client realtime declared ≠ enforced:subscribeData 回调把 RealtimeEventPayload 硬铸成 DataEvent,顶层 recordId/changes/id 运行时是 undefined #4626).

G6. Seeds / boot / driver

• Seed.env is enforced against the runtime environment — a seed scoped to another env does not load (fix(seed): enforce Seed.env against the runtime environment #4836).
• The seed-loader records a counted failure as an error, never a warn ([metadata-protocol] seed-loader 的「LOUD FAILURE」注释要求 error,代码却记 warn —— 第二类降级(#4632 规则),本轮因包冻结未修 #4729).
• The per-org tenant stamp survives seeding instead of being resolved as a natural key (fix(seed-loader): keep the per-org tenant stamp instead of resolving it as a natural key #4644).
• A fresh DB does not boot reported as "drifted", and --allow-destructive is never aimed at a framework-created index ([schema-drift] Fresh DB boots "drifted": detector can't read COALESCE index columns, then tells the operator to --allow-destructive away a legitimate unique index #4884).
• A fresh datastore attests on this boot's own data, not remembered emptiness (bug(objectql): ADR-0104「空库即已迁移」自证写在首启 seed 之前 —— 部署证明了一个它同一次启动就违反的契约，第二次 pnpm dev 起永久 10 条 ERROR #4769).
• An identical driver re-registration is told apart from a real name collision (bug: 每次启动都报 Driver already registered, skipping {"driverName":"com.objectstack.driver.sql"} —— SQL driver 被注册了两次 #4773).
• The engine resolves the NOW() defaultValue token (data: the NOW() defaultValue token is unresolved on non-SQL datasources — the engine stamps the literal string, and the record validator then rejects the insert #4597).

G7. Authorization surfaces

• The two session.roles admin exemptions are gone from approvals — record lock and delegation guard (plugin-approvals 的 admin 豁免读 session.roles,而 ObjectQL 的 buildSession() 从不填充它 —— 记录锁/delegation 守卫的 admin 覆盖在真实引擎路径上永不生效 #4839).
• The record lock holds for predicate (multi) updates (审批记录锁 bindApprovalLockHook 对谓词式(multi)更新完全失效:if (!id) return 把「没解析到行」当成「允许」 #4778).
• Nav-item gates are enforced inside areas[], not only on the top-level tree (filterAppForUser 只走 app 顶层 navigation —— areas[] 里的 nav 项权限过滤仅客户端生效（#4651 移除假闸门后剩下的真缺口） #4722).
• app.areas[].visible / .requiredPermissions are retired as fail-open gates (app.areas[] 的 visible / requiredPermissions 是 fail-open 的访问闸门 —— 服务端从不走 areas（ADR-0049，v17 限时） #4651) — authoring them is refused.
• Permission-set projection writes only spec-recognised keys; a failed backfill is loud (permission-set backfill (ADR-0094 D4) 现在 100% 失败：行里的 active 存储列喂进了 #4001 之后严格化的 permission spec #4669).
• action.body binds only for type: 'script' (action.body 的 type 门是 declared ≠ enforced —— spec 说只在 type:'script' 生效,runtime 有 body 就绑 #4352).

G8. The #4001 / ADR-0049 close-out wave

This window is dominated by spec surface convergence — dual-source name collapses and inert-key retirements. Most are compile-time; verify the ones with a runtime face:

• Retired datasource keys are refused at authoring: capabilities, healthCheck, retryPolicy, readReplicas (datasource 账本判定的 20 条死键至今无人处置：三个块整块无人读，其中 readOnly 让一个 shipped 示例的「只读副本」可写（ADR-0049 enforce-or-remove） #4583, datasource.readReplicas 声明了、strict 了、刚被加了校验——但没有任何消费者（ADR-0049 enforce-or-remove，#4410 收尾发现） #4468).
• connector.rateLimitConfig and the per-provider connector template cluster are refused (「v17」ConnectorRateLimitConfig 出站限流词表按 ADR-0049 摘除 —— 执行引擎不存在(#4686 拆向之二) #4911, DatabaseConnector.readReplicaConfig 是读副本的第二处死声明（ADR-0049 enforce-or-remove，#4468 收尾发现） #4480).
• dashboard.widgets[].responsive is refused (spec: DashboardWidgetSchema.responsive 按断点建模 —— objectui#3173 维护者已裁决；目标 17.0.0 正式版，带回退条款 #4876).
• job is a code artifact — runtime creation and org overrides are withdrawn (#4488 审计发现的四个"授权门断连"：email_template / job / validation 的元数据条目到不了执行点，action 导航项点不动 #4509). — FAILS: PUT /meta still creates job and agent → metadata: allowRuntimeCreate:false is not enforced — PUT /meta creates job and agent items the registry declares code-only #5086
• composeStacks no longer silently drops top-level keys: same value passes, conflict errors, undeclared warns (composeStacks silently drops every non-array top-level key — api: today, server: as of #4910 #5005).
• IDataDriver.findStream and the 31 inert DriverCapabilities bits are gone (IDataDriver.findStream 没有任何调用方，两个 driver 的实现还正好做了它承诺要避免的事（ADR-0049 enforce-or-remove） #4484, DriverCapabilities.streaming 在 findStream 退休后指向不存在的能力，且从来没有读者（ADR-0049，#4484 收尾发现） #4634).
• crypto.hash is retired across all four layers (crypto.hash 能力声明了、构建期还会自动推断,但沙箱从没实现 —— 调用直接抛(declared ≠ enforced) #4391).
• The renamed spec exports resolve to exactly one declaration each (✅ spec 双源清账主单:基线 52 → 0(2026-08-03 收官)—— #4446 gate 落地后的偿还 worklist #4535 family: ActionLocation, ConflictResolution, EventSchema, HttpMethod, PackageDependency, FieldMapping, RateLimitConfig, MetadataFormat, CacheStrategy, notification vocabulary).

G9. Client / React

• The five client-react hooks no longer loop on dependency identity (useQuery 在文档示例用法下是无界请求循环:内联 options 300ms 内发出 8830 次 find #4693, useAutoRefresh 在 refetch 身份不稳定时每渲染一次就重订阅一次(两条流都churn) #4694).
• @objectstack/organizations resolves from the host app, and an organizations failure is classified by STAGE — import ≠ mount (serve.ts 的 ADR-0093 D5 catch 把 OrganizationsPlugin 抛出的任何错误都改写成「包加载不出来」，并给出会误导的 OS_ALLOW_DEGRADED_TENANCY 解法 #4818, cloud#1013).
• The AI route's req.user carries the capability channel (AI 路由的 req.user 丢失 capability 通道 —— ec.systemPermissions 从不透传，AI 域无法做任何 capability gate #4705).

G10. Docs & close-out

• Docs sweep run 3: 2bafe62e8 → a1a855a28, adding the retired keys from G8 to the fingerprint table, plus the version-number check docs: nine passages date the #4286 query-surface removals to spec 18 — they ship in 17 #4476 called for.
• At changeset pre exit: re-check the v17 page's version wording and close out sections A–G.

[baozhoutao]

rc.1 verification run 1 — section F

Environment: framework main @ 1ee48bc60 (post-rc.1), showcase example under os serve --dev --ui on an isolated SQLite datastore, @objectstack/console@17.0.0-rc.1 (the published vendored SPA, pin 7d9734d5e321) at /_console/, Node 22.22. Driven as admin@objectos.ai plus a second signed-up member for every two-principal check.

19 items ticked. Highlights of what actually held up under a live request:

• Actions (F1). An undeclared action name is refused with the prescriptive ADR-0110 404; script runs, flow dispatches (returns status:"paused" with the screen payload), and a url/modal action reaching the server is refused with a message naming its client-side nature. Param enforcement is strict by default and precise: missing required → 400 naming the param, unknown key → "Unknown action param … not declared on this action", bad option → the allowed list. Field validation localizes properly (Accept-Language: zh-CN → 优先级必须是以下值之一) and carries per-field fields[] with labels.
• Sharing (F2). The ADR-0111 verb boundary is real: an edit-level share lets the recipient read and PATCH, and refuses DELETE (403) and share-management ("requires record ownership or Modify All Data (ADR-0111 D1)"). A criteria-less rule is refused with the ADR-0049 message. A non-participant cannot read an approval request (404). Anonymous data access is denied on both read and write, while audience:'public' book metadata is served without a session.
• Query strictness (F3). Every silent-drop this train closed refuses correctly, each with an actionable message: unknown query param, sort/select/expand/dotted-path sort naming a missing field, non-AST $filter. Implicit field filters AND-merge with an explicit filter (verified by counts: 2 ∧ 1 → 1). deleteMany is ids-only (a where body is rejected), the batch cap fires at 200, and sorted and unsorted paging are exact partitions (page union == full set, no dupes/gaps).
• Temporal (F4). +08:00 input stores as UTC …T10:30:00.000Z, time stores wall-clock 09:15:30, and a bare-day upper bound ($lte: '2026-08-15') covers the whole day on both date and datetime.
• Analytics (F5). /analytics validates at the entry (unknown body key rejected by name), a sum measure emits SUM(total) not COUNT(*), $or/$not reach the SQL, and a monthly timeDimensions bucket projects into rows in date order.
• New capabilities (F6). The multi-value lookup seed resolves (f_lookups: ['Northwind','Contoso'] → a two-id array). required enforces on write with per-field errors, and the Console form shows the same three fields as required. The approval chain worked end to end in the browser and over REST: submit → request created → structured reassign to a second user → that user approves → status: approved, and sys_approval_action attributes each decision to the acting user (submit/reassign → admin, approve → member). The screen flow ran from the list toolbar, collected input, and the write landed (assignee = the value typed in the dialog).
• Boot/CLI (F7). os serve boots a stack with no compiled artifact; the undeclared-stack-key lint reports each key with a remedy (including the storage → OS_STORAGE_* guidance); rc.1 tarballs carry CHANGELOG.md and a files whitelist (@objectstack/client ships 10 files).

Failures filed (7)

#	Area	What
#4431	actions	a sandbox capability denial answers 400 as a deliberate rejection — the crash contract (#3951) says 500 — and leaks the SandboxError: debug prefix
#4432	metadata	/meta/<type> overlay writes don't normalize the type segment: plural vs singular land in different namespaces, one overlay row shadows the whole code-authored listing, and the row is undeletable
#4433	sharing	deactivating a rule never withdraws its materialized grants — not on record touch, not after a full restart
#4434	sharing	DELETE /sharing/rules/:idOrName 500s for both address forms — no sharing rule can be deleted over REST (compounds #4433: an over-granting rule is unrecoverable)
#4435	data	PATCH/DELETE of a nonexistent record answer 200 success (record: null / success: true) where GET correctly 404s; deleteMany reports every typo'd id as deleted
#4436	data	the unsupported-filter-operator refusal ships without error.code and leaks the [sql-driver] prefix (ADR-0112)
#4437	analytics	a measure naming a missing field 500s with SQLITE_ERROR instead of a 400 naming the field

Notes for the next run

• Two toast strings in the Console are still English on a zh-CN session ("This flow runs on a single record — select a row first.", "Done") — worth a pass against the objectui i18n packs before RC exit rather than filing per-string.
• The showcase's own dev script resolves a stale global @objectstack/cli@9.0.0 from the user PATH instead of the workspace CLI, which fails the boot with a misleading "plugin-approvals … not installed". Not a platform defect; worth a line in the contributor docs since it costs a debugging cycle.
• Not yet covered in this run and still open in section F: the file/attachment axis (F6 #4208/#4285 gate), flow run summaries (selected/acted/skipped), os migrate value-shapes, and the F8 docs sweep.

[baozhoutao]

rc.0 verification run 2 — sections A / B / C

Run 1 covered only the F supplement. This run works the rc.0 checklist (A–D) on the same environment (framework main @ 1ee48bc60, showcase under os serve --dev --ui, published @objectstack/console@17.0.0-rc.1, isolated SQLite, admin + a second signed-up member). 7 more items ticked — 26 of 59 total. Three new defects filed.

A. Breaking behavior

• Export opt-in (用户级 export 权限轴(接入 P1 预留的 userExportAllowed 槽) #3544/定时报表的 CSV 附件绕过用户级 export 权限轴(#3544 的第二道出数据的门) #3710/security 服务 getReadableFields 查询面(export 列投影的长期正解) #3547) — all five branches hold. A member_default user is refused (EXPORT_NOT_PERMITTED 403). Binding a set carrying viewAllRecords on showcase_invoice lets that user read every invoice (200) while export stays 403 — read genuinely no longer implies export. Adding allowExport: true to that one object flips export to 200, and a second object in the same set (no allowExport) stays 403, so the grant is per-object, not per-set. An empty result still emits the full header row plus content-disposition / x-export-format / x-export-limit. The anchor gate refuses both everyone and guest, and — checked with a set carrying only allowRead + allowExport, no VAMA — names the right reason: "it carries bulk export on 'showcase_announcement' (ADR-0090 D5/D9)".
• ApiMethod shrink (P2:ApiMethod 枚举收缩至 6 原语(breaking,独立版本) #3543) — the authoring half is exemplary. enable: { apiMethods: ['upsert','aggregate'] } produces a per-value FROM→TO mapping (upsert: declare ['create','update'], aggregate: declare ['list']), the deny-all consequence spelled out ("After stripping, this whitelist is EMPTY — [] means DENY-ALL"), and a codemod path. Authoring apiMethods at object root is separately caught as an undeclared key.
• Alias retirement ([P3] Retire the three deprecated aliases — via the ADR-0087 D2 conversion layer, not by deleting the keys #3855/feat(spec,lint)!: accept ADR-0109, remove agent.tools[], lint agent authoring, model AI exposure in tool resolution (#3820) #3894) — all four, and the migration runs. field.conditionalRequired → requiredWhen and action.execute → target are hard parse errors naming the rename; agent.tools and agent.knowledge are tombstoned with a paragraph each on what to do instead (not a silent strip). os migrate meta --from 16 reports both rewrites and --out produces a snapshot carrying requiredWhen / target. Note the shape: migrate rewrites the stack snapshot, it does not edit your TS source — worth stating in the upgrade guide, since the checklist wording ("rewrites all three") reads as an in-place codemod.
• Approval participant visibility (审批请求的可见性是「按租户」而非「按参与者」——getRequest 用 SYSTEM_CTX 读、只按 organization_id 收窄 #3590). A non-participant authenticated user gets 404 on another user's request; after a structured reassign makes them a participant, 200.

B. Removed surfaces

• SDK removals verified by instantiating the client, not by grep (grep is misleading here — nlq/suggest/insights still appear in comments documenting their removal). On a live ObjectStackClient: permissions, realtime, workflow, views, projects.listTemplates are all undefined; client.ai exposes only chat, chatStream, complete, models, conversations, agents, pendingActions; client.notifications exposes only list, markRead, markAllRead (no device/preference delegates).
• Marketplace move (POST /api/v1/packages is a publish-vs-install shape collision — REST registers first and shadows the dispatcher (#3587 finding) #3610). POST /packages is the install surface again ({"code":"VALIDATION_ERROR","message":"Package id is required"} — reachable, no collision).
• /graphql → 404 ✅, but discovery still advertises the slot: services.graphql = {"enabled":false,"status":"unavailable","message":"No implementation ships for the 'graphql' slot — register a service under it to enable"}. That message invites someone to fill a slot for a surface v17 deliberately removed, and it contradicts the docs sweep's own run-1 fix (services-checklist was reduced to 16 services with every graphql row deleted). Left unticked pending a call on whether the slot should be dropped from CORE_SERVICE_PROVIDERS or the message reworded.
• Not verifiable here: POST /packages/publish answers 405 (Allowed: DELETE, GET, HEAD, PATCH) — the route-manager's /packages/:id matches with id="publish" and shadows it. The ledger declares the publish route as source: 'direct-mount', disposition: 'server-only', so it is presumably registered only where the marketplace publish plugin is loaded. Worth confirming on a deployment that has it — the shadowing means route-registration ORDER decides the winner.

New defects (3)

#	Area	What
#4441	data / RBAC	a lookup accepts an id that does not exist in the referenced object — including sys_position_permission_set.permission_set_id, so a grant row can point at nothing while the audience-anchor gate has to resolve that set to judge it. Found by accident: a shell variable expanded to FAIL and the platform stored it against the everyone position.
#4447	data	created_at is client-writable on an ordinary PATCH and persists (1999-01-01 written and read back). updated_at and created_by are correctly protected — this is one field of the audit trio. Its metadata says readonly: false.
—	—	(the two #3909 F-section notes from run 1 stand)

While chasing #4447 I could not find any input on this build that produces a non-empty droppedFields: computed fields (f_formula, f_summary) are rejected 400 INVALID_FIELD, unknown fields 400, and system fields are simply written. The #3794 contract may only have live coverage on the FLS path — worth a targeted check before RC exit rather than assuming the C-section item passes.

Remaining

33 unchecked. The bulk needs setup this run did not build: a runAs:'user' record-change flow fired by a system write (#3760), a per-tenant unique specimen (#3696), multi-org / membership-grade (ADR-0108, ADR-0105), better-auth 1.7 account migration, datasource fail-fast (#3741), the files-as-records axis (ADR-0104), historical import, and the Console-side items (objectui#28xx). Section D (docs) is untouched.

[baozhoutao]

rc.0 + rc.1 verification run 3 — the remaining sections

Continuing from runs 1–2. Same environment; this run built a dedicated probe stack (examples/rc1-probe, removed afterwards) for the items the showcase has no specimen for, plus a synthetic pre-v17 datastore for the migration items.

40 of 59 ticked (was 26). Five new defects filed, one of them the most serious found across all three runs.

🔴 #4467 — /analytics/query ignores record-level scoping

A plain member with shares on 2 of 5 private notes:

GET  /data/showcase_private_note              → total 2      ✅
POST /analytics/query {cube, measures:[count]} → count 5      ❌
POST /analytics/query {…, dimensions:["title"]} →
   returns the TITLES of all 5, including the 3 they cannot read

Any authenticated caller who can reach /analytics can enumerate field values of every row of any cube-exposed object, past OWD, sharing rules and RLS. The other analytics items on the checklist (#4019 capability mount, #4010 entry validation, #4184 declared aggregates, #3650 dateRange, #3921 time ordering) all hold — the scoping layer is the piece that is absent; the returned data.sql carries only the caller's own predicates and no owner/share filter.

Method warning for whoever re-tests: a viewAllRecords set left bound from an earlier test makes both paths agree at 5/5 and look correct. Confirm the data path returns fewer rows than admin before reading anything into the analytics numbers — I got a false negative from exactly this.

Other new defects

#	What
#4462	an object mapped to an unreachable datasource silently reads/writes the DEFAULT store — boot succeeds, broken never appears in the log, /ready 200, listing says status:"unvalidated". Against all three claims of the A5 item.
#4466	an admin override of a properly-staffed approver slate is recorded as an ordinary approval — sys_approval_action has no override column at all, so bypassing designated approvers is byte-identical to being one.
#4455	os migrate value-shapes misses a lookup holding an embedded record object — the exact case its own docstring names — because ReferenceIdValueSchema is z.string().min(1). The gate then closes on evidence it never gathered.
#4441	a lookup accepts an id that exists nowhere, including the RBAC permission-set link tables.

Verified this run

• Export axis (用户级 export 权限轴(接入 P1 预留的 userExportAllowed 槽) #3544/定时报表的 CSV 附件绕过用户级 export 权限轴(#3544 的第二道出数据的门) #3710/security 服务 getReadableFields 查询面(export 列投影的长期正解) #3547), all five branches. The decisive one: with viewAllRecords bound, the member reads every invoice (200) while export stays 403. allowExport flips it per-object; a second object in the same set stays denied. Empty result still emits the header row + content-disposition. The anchor gate refuses everyone/guest and — tested with a set carrying only allowExport, no VAMA — names the right reason ("carries bulk export").
• The #1888 user-less fail-open is wider than the lint that guards it — record-change flows fired by a system write run UNSCOPED, unlinted #3760 user-less flow runs, all three assertions. A runAs:'system' flow's write fired a runAs:'user' flow; the latter was refused with the UnscopedRunDataAccessError naming runAs:'system', the originating write still succeeded, and the sibling system flow ran normally.
• record_change flow start node binds to a single lifecycle event — no create-OR-update in one flow #3427 record-after-write. One flow, both legs: previous is null on create and the full prior snapshot on update.
• 多租户缺陷:unique 物化为全局唯一索引、无视 tenancy,与按租户分裂的 autonumber 序列自相矛盾(跨租户必然撞号 + 存在性探测泄露) #3696 per-tenant unique. The index is literally UNIQUE (organization_id, sku); two tenants hold the same SKU, same-tenant duplicate is 409, and the message leaks no cross-tenant existence.
• 审批流无法在「运行中」动态确定审批人——审批人在提交时即被 $trigger 快照锁定（动态路由 / 动态会签受阻） #3447 dynamic approver routing, end to end. Required decisionOutputs enforced on approve; an undeclared key rejected and the declared keys listed; stage 2 spawned its own request whose pending_approvers was exactly the user stage 1's lead named — expression resolution over vars.lead_review.next_reviewers works. lockRecord held during, released after (Approval: a dead approval run can leave the record RECORD_LOCKED (#3424 follow-up, expected-behavior 3) #3456).
• ADR-0104 files, full chain. A PNG bound to accept:['application/pdf'] → 400 naming field and allowed types (direct API, not the widget); oversize → 400 naming both sizes; valid → stored as a sys_file id that reads back expanded to {id,name,size,mimeType,url}; download carries filename="ok.pdf" + application/pdf; anonymous download 401. os migrate files-to-references dry-run reports honestly and writes nothing.
• P2:ApiMethod 枚举收缩至 6 原语(breaking,独立版本) #3543 apiMethods shrink — per-value FROM→TO mapping, the deny-all consequence spelled out, codemod path given. [P3] Retire the three deprecated aliases — via the ADR-0087 D2 conversion layer, not by deleting the keys #3855/feat(spec,lint)!: accept ADR-0109, remove agent.tools[], lint agent authoring, model AI exposure in tool resolution (#3820) #3894 aliases — all four hard-rejected with renames; os migrate meta --from 16 --out produces a snapshot carrying requiredWhen/target.
• fix(cli,driver-sql): os migrate plan lists the datetime storage convergence (#3954) #3964 / fix(cli,driver-sql): defer migrate DDL until confirmed + detect SQLite occupancy (#3917) #3924 — migrate plan lists normalize_datetime_storage: created_at — 2 row update(s); destructive index changes gated behind --allow-destructive; occupancy detection names the holding pid.
• ADR-0105 D12 — OS_TENANCY_POSTURE=group without @objectstack/organizations is a FATAL refusal with three remedies. ADR-0108 — sys_member.role is a four-value closed select, sys_member/sys_invitation are read-only over REST; the owner→org_owner projection is the deliberate ADR-0095 D3 boundary, not the retired channel.
• showcase: 4/5 projects and 9/10 tasks are silently rejected on every boot (FSM initialStates vs seed data) #3415/os dev: surface seed / sample-data-heal outcomes in the boot summary (info logs are swallowed by the default warn log level) #3430 seeds — a seed row with a bad reference turns the banner yellow: ⚠ Seeds: com.rc1.probe 2 ok / 1 error ⚠ + the OS_LOG_LEVEL=info hint.
• Console/docs — Kanban grows a 未分类 lane for a null-status row (objectui#2804); total stays the match count under a 3-row page (objectui#2873); SQLite datetime grouping buckets correctly (SQLite 上 Field.datetime 的 dateGranularity 分桶恒为 NULL —— 趋势图塌成一根柱子 #3773) and an empty bucket is a real null (空分组桶的键两条路不一致:下推 SQL 给 null,内存兜底给 "(null)"(不限日期分桶) #3839); /docs/releases/v17 renders with the Console section and Upgrade checklist, reachable from the sidebar (docs(releases,nav): v17 follow-up — Console gap backfill, sidebar restore, first docs sweep #3908).

Two checklist-wording corrections

1. Seeds. The item promises Seeds: X inserted · Y updated · Z skipped. That shape does not exist — printSeedSummary deliberately collapses the three into one N rows / N ok / M errors count and uses · to separate sources. The code's contract is coherent; the checklist text is stale.
2. os migrate meta. "rewrites all three" reads as an in-place codemod. It rewrites the stack snapshot (--out), not your TypeScript sources.

Still open (19)

Mostly Console-side objectui items needing UI-level assertions (API console AI family, dropped-field toasts, quorum chips, historical-import wizard), better-auth 1.7 account migration (needs pre-existing social/SSO rows), the four items blocked on the defects above, and the two close-out items that can only run at changeset pre exit.

Also unresolved from run 2: I still cannot produce a non-empty droppedFields on any input — computed fields 400, unknown fields 400, system fields are written. #3794's contract may only have live coverage on the FLS path.

[baozhoutao]

Final run — the checklist is worked through

48 of 59 verified. The remaining 11 are now annotated inline: 10 are blocked on defects filed from this verification (they cannot be ticked until a fix lands), and 1 (changeset pre exit close-out) can only run after RC exit. Nothing is left untested for lack of effort.

Four more defects this round, on top of the nine already filed.

🔴 #4477 — screen-flow resume performs no server-side validation

A two-field screen node (kind required; escalation_reason required + visibleWhen: "kind == 'escalate'"):

resumed with	expected	actual
{"kind":"normal"} — conditional field hidden	accept	200 ✅
{"kind":"escalate"} — field VISIBLE, required, missing	reject	200 ❌
{} — kind itself required, missing	reject	200 ❌
{"kind":"normal","totally_bogus":"x"} — undeclared key	reject	200 ❌

The render half is fine — the screen payload carries visibleWhen intact. But "honored in validation" passes only vacuously: nothing validates, so the conditional case cannot be got wrong. A client that posts straight to resume bypasses every required the author declared. This is the one gap in an otherwise consistent row — action params (#4213), record writes (ADR-0113), and approval decisionOutputs (#3447) all enforce their declared contracts, verified working.

#4475 — every Setup System Overview tile reads 0

Users 0 (actually 4), Sessions 0 (actually 16), all event counts 0. The widget's own response gives the cause:

{"rows":[{"user_count":0}],
 "sql":"SELECT COUNT(*) AS \"user_count\" FROM \"sys_user\" WHERE created_at = $1"}

An "all time" range is lowered to WHERE created_at = $1 — an equality test on a timestamp. The cube path lowers ranges correctly (>= $1 AND < $2), so this is specific to the dataset path. First screen an operator sees, every number wrong, no error surfaced.

#4476 — docs date the #4286 removals to spec 18; they ship in 17

Nine passages across three hand-written pages say query.cursor / distinct / joins / windowFunctions were "removed in @objectstack/spec 18". PROTOCOL_VERSION = '17.0.0', the package is 17.0.0-rc.1, and os migrate meta --from 16 labels all four [protocol 17]. A reader on 16 is told the break is a major away and plans accordingly. Found by the sweep run the tracker asks for — the sweep's fingerprint list should gain a version-number check, not just surface names.

#4478 — quorum progress and per-group chips do not render

The server publishes behavior:"quorum", minApprovals:2, per-approver group labels, and even a pre-rendered __nodeLabel: "Committee Sign-off (2 of 3)". The Console renders none of it: scraping the approval panel gives {lockBadge: true, approveBtn: true, quorumHint: false, groupChips: false}. An approver on a quorum node cannot see how many more approvals are needed. The lockRecord half of the same line does render (审批中已锁定 badge), so the panel is otherwise correct — this is specifically the progress surface. Fix belongs in objectui #2811; no framework change needed, the data is already on the wire.

Verified this round

• Sharing vocabulary (fix(sharing): 「完全访问」声明了删除/转移/共享，实现上与「编辑」等价 #3865/[P0] Metadata property liveness audit: ~half of all spec properties are dead; a cluster of security props is parsed-but-unenforced #1878). group and guest recipients rejected with the legal list; team / business_unit accepted; accessLevel:'full' stored as 'edit'. Note: the spec rejects type:'owner' (pinned by test) but the REST rule route silently drops type and any other unknown key — inconsistent with the 未知键静默剥离仍是全仓默认:把 #3405 的 strict 收紧从一个 schema 推广到整个可授权面(ADR-0078 完整性闸门) #4001 posture the data routes apply (a permission-set write rejects active with a prescriptive message). Worth a follow-up.
• better-auth 1.7. sys_account carries a distinct issuer column, backfilled (local:credential), and id (row) is separate from account_id — the precondition for unlink-by-row-id. Password sign-in worked throughout all four runs.
• droppedFields (审批场景下记录可写性的反馈全线失真:能改的显示「已锁定」,改不了的提示「更新成功」 #3794) — found it. The trigger is a readonly field, not a system or computed one:

  PATCH /data/showcase_contact/<id> {"lead_score":999}
  → x-objectstack-dropped-fields: lead_score;reason=readonly
  → body: {"droppedFields":[{"object":"showcase_contact","fields":["lead_score"],"reason":"readonly"}]}
  

  Both channels carry it. This closes the open question from runs 2–3 — the contract does have live coverage; computed fields 400 and system fields are a different path (created_at being writable is data: created_at is client-writable on an ordinary PATCH — the audit anchor can be forged silently #4447).
• Historical import (data import: mid-lifecycle rows rejected by state_machine.initialStates — historical-data migration blocked (#3433 sibling) #3479/data import: a "historical" import can't preserve original timestamps / audit fields — updated_at is stamped now, readonly fields stripped on upsert (#3479 follow-up) #3493/Identity import: raw SQL leaks into row errors; DB constraint failures need sanitized, friendly messages #3566). A row with created_at: "2020-03-15" and status: "done" imports with the timestamp preserved and the state machine skipped. Dry-run row errors are human-readable and located: {"row":2,"field":"status","code":"invalid_option","error":"Status: \"NOT_A_STATUS\" is not a known option"} — no raw SQL.
• FormSection.pane (feat(spec): FormSection.pane — explicit split-pane placement (objectui#2153 follow-up) #4160) — pane: "primary" / "secondary" reach the client in the view metadata.
• AI family (B4) — /ai/nlq, /ai/suggest, /ai/insights answer 501 (honest empty slot), not 404 and not a fabricated response; /ai/agents serves the real surface.
• ADR-0104 D3 wave 2 (feat(storage): 开启回收 — 释放的字段文件按部署门禁进入墓碑与回收 — ADR-0104 D3 wave 2 (PR-5b) (#3459) #4208) — on an unmigrated deployment an invalid media value is warn-first and says so ("accepted for now … run os migrate files-to-references --apply to migrate this deployment and enforce"), collection stays off. The strict FileReferenceIdValueSchema demonstrably works — it caught the showcase's own data-URI cover.
• Docs sweep run 2 — every retired-surface fingerprint hit outside releases/ and references/ documents the removal correctly; the only drift is the version number in docs: nine passages date the #4286 query-surface removals to spec 18 — they ship in 17 #4476.

One open judgement call for the maintainers

/graphql correctly 404s, but discovery still reports a graphql service slot: {"enabled":false,"status":"unavailable","message":"No implementation ships for the 'graphql' slot — register a service under it to enable"}. That message invites someone to fill a slot for a surface v17 deliberately removed, and it contradicts the docs sweep's own run-1 fix (services-checklist reduced to 16 services with every graphql row deleted). Left unticked: whether to drop the slot from CORE_SERVICE_PROVIDERS or reword the remedy is a design call, not a test result.

All 13 defects from this verification

Security / correctness: #4467 (analytics ignores record scoping — reads values a caller cannot read), #4433 + #4434 (a sharing rule's grants cannot be withdrawn and the rule cannot be deleted), #4447 (created_at forgeable), #4441 (dangling lookup references incl. RBAC link tables), #4462 (unreachable datasource silently uses the default store), #4477 (screen resume unvalidated), #4466 (admin override unrecorded).

Contract / envelope: #4431 (capability denial 400 vs the 500 the crash contract promises), #4435 (missing-record writes report success), #4436 (filter-operator refusal has no error.code), #4437 (analytics measure 500s with SQLITE_ERROR), #4432 (meta overlay type-segment phantom rows), #4455 (value-shapes gate misses its own headline case).

UI / docs: #4475 (Setup overview all zeros), #4478 (quorum chips), #4476 (docs version drift).

[baozhoutao]

All defects from this verification are now rolled up in #4482 — 17 issues grouped as security/data-integrity (8), contract/envelope (6), UI/docs (3), with a suggested RC-exit triage and the two non-defect judgement calls (/graphql discovery slot; two stale checklist claims).

Note a correction to my run-4 comment above: it said "13 defects". The grouped list was right, the total was a miscount — it is 17.

[baozhoutao]

rc.3 verification — G1 regression + G2–G10 first pass

Environment: main @ a1a855a28 (the rc.3 train tip — note rc.3's version commit c6a52d3a4 was tagged and published to the npm rc dist-tag but not merged back, so main's package.json still reads 17.0.0-rc.2 while main sits 56 commits past the rc.3 cut). Real showcase boot, two live principals, purpose-built probe stacks for the rest.

73 of 113 ticked. Two new defects.

G1 — 16 of 17 fixes verified landed, 1 residual

I re-ran every original repro rather than trusting the close. The fixes are real and several are better than what I asked for:

• analytics: /analytics/query ignores record-level scoping — a member counts and reads dimension values of records they cannot read #4467 (the aggregate-disclosure one) — member with shares on 2 of 5 notes: data 2, analytics 2, and dimensions:["title"] returns only the two titles they may read.
• datasource: an object mapped to an unreachable datasource silently reads/writes the DEFAULT store — no boot failure, /ready still 200 #4462 — boot now fails, naming the datasource, naming the object routed to it, stating the consequence ("their reads/writes would otherwise land in a DIFFERENT database than the one they declare ⇒ fail-fast per ADR-0062 D5"), and offering OS_ALLOW_DRIVER_CONNECT_FAILURE=1.
• sharing: deactivating a rule never withdraws its materialized grants — not on touch, not at boot #4433 / sharing: DELETE /sharing/rules/:idOrName answers 500 for both address forms — rules cannot be deleted over REST #4434 — deactivating a rule withdraws immediately (200 → 404); DELETE returns 204, not 500.
• screen flows: resume performs no server-side validation — missing required fields and undeclared keys all complete the run #4477 — resume validates: missing required 400, undeclared key 400, valid 200 and the write lands. (Method note: the envelope is {"inputs":{…}}. I first tested flat and got a false failure — the docs say inputs, I was wrong.)
• approvals: an admin override of a staffed approver slate is recorded as an ordinary approval — no override marker anywhere #4466 — via_override: true is written on the override decision, null on the ordinary one.
• actions: sandbox capability denial answers 400 as a deliberate rejection, not the 500 the crash contract promises #4431 capability denial → 500 INTERNAL_ERROR, no SandboxError: prefix. data: created_at is client-writable on an ordinary PATCH — the audit anchor can be forged silently #4447 created_at unchanged. data: a lookup accepts an id that does not exist in the referenced object — including the RBAC permission-set link tables #4441 dangling lookup 400. data: PATCH/DELETE of a nonexistent record answer 200 success instead of RECORD_NOT_FOUND #4435 PATCH/DELETE missing → 404. data: unsupported-filter-operator refusal ships without error.code and leaks the [sql-driver] prefix #4436 INVALID_FILTER, no driver prefix. analytics: a measure naming a missing field 500s with SQLITE_ERROR instead of a 400 naming the field #4437 measure → 400. migrate value-shapes: a lookup holding an embedded record object passes the scan — the exact case the ADR-0104 D1 gate exists to find #4455 scan reports the embedded reference with a correct-id example.

Residual → #5079. #4432's namespace normalisation, shadowing and immediate dispatch are all fixed, but after DELETE the overlay stays in the /meta listing while dispatch correctly 404s. The delete is real (reset:true, no sys_metadata row); only the enumeration view is stale — the mirror of the seam #4521 fixed on the write side.

G2–G10 — what passed

• ADR-0118 — sys_metadata_history.recorded_by is NULL on every row, no 'system' sentinel. Boot banner reads Tenancy: single (resolved posture, not the legacy boolean).
• ADR-0119 atomic batch, proven by rollback. An atomic deleteMany of [valid, nonexistent]: the valid row comes back ROLLED_BACK, the missing one RECORD_NOT_FOUND, and the valid row still exists afterwards (GET 200). Per-row results carry the declared BatchOperationResultSchema shape with index + errors[], and the new NOT_ATTEMPTED code appears on rows after an abort.
• G4 — the semantic reversal landed. An unevaluable hook condition now aborts: 400 Hook 'x' could not evaluate its condition (runtime: No such key: …) — operation aborted, naming the field and giving two remedies. And the root cause is gone: the rc.1 boot logged dozens of condition evaluation failed; treating as false — No such key: done; on rc.3 that count is 0 (bug(objectql): hook 条件对着「只含本次更新字段」的残缺 record 求值，取不到的字段被吞成 false —— 审计 hook 静默不触发 #4770 + bug(objectql/docs): hook condition 的 CEL 作用域只绑定 record —— 文档教的 previous.x / ctx.record 根本不存在,过渡型条件写不出来 #4784).
• G6 — a env: ['prod'] seed loads 0 rows in dev (fix(seed): enforce Seed.env against the runtime environment #4836); NOW() resolves per field type (datetime → full instant, date → calendar day, data: the NOW() defaultValue token is unresolved on non-SQL datasources — the engine stamps the literal string, and the record validator then rejects the insert #4597); a fresh DB reports "Physical schema is in sync — nothing to migrate" instead of the phantom drift rc.1 showed ([schema-drift] Fresh DB boots "drifted": detector can't read COALESCE index columns, then tells the operator to --allow-destructive away a legitimate unique index #4884).
• G7/G8 — the retirement diagnostics are the best I have seen in this codebase. areas[].visible doesn't just say "removed": it explains the key was a gate that failed open, which layer to move to, and that server-enforced gating requires the top-level tree because "the server does not walk areas". datasource.retryPolicy warns against renaming your way around it because hook.retryPolicy is a genuinely-enforced different key. composeStacks (composeStacks silently drops every non-array top-level key — api: today, server: as of #4910 #5005) is three-for-three: undeclared key warns, conflict throws naming both stacks, same value passes.
• G10 docs sweep run 3 — every fingerprint hit for this window's retired keys is either documenting the removal or a same-name-different-thing (a plugin's healthCheck() method, responsiveStyles). Clean.

New defect → #5086

allowRuntimeCreate: false is not enforced. #4509 set the flag on job and its changeset says "no 'create job' in Studio or via PUT /meta". It still creates one:

PUT /api/v1/meta/job/rc3_runtime_job {"schedule":{"type":"cron","expression":"0 0 * * *"},"handler":"nope"}
→ 200 "Saved customization overlay (env-wide) — type=job"     … and it lists, with handler "nope"

agent, the only other flagged type, behaves the same. supportsOverlay: false looks equally unenforced — the success message calls the row a "customization overlay" for a type declared not to support them.

This is the ADR-0049 failure mode one level up: the enforcement flag itself is the silently-inert declaration. It is easy to miss because a minimal payload 422s on schema validation first — only a payload that passes the schema reveals that the gate never runs. Studio presumably reads the flag to hide "create", so the UI honours a rule the API does not.

Remaining 40

Mostly G5 (metadata-plane honesty: publishDraft drain, DDL loudness, history/event_seq invention), G9 (client-react hook loops — needs a React harness), the G8 spec-rename family (compile-time, best covered by a typecheck of a consumer rather than a runtime probe), and the close-out item that can only run at changeset pre exit.

[baozhoutao]

rc.3 verification — complete

108 of 113 verified. The 5 open items are: 2 blocked on defects filed from this pass (#5086, #5088), 2 close-out items that can only run after changeset pre exit, and the #4432 residual tracked in #5079.

Three new defects this round, on top of the seventeen from the A–F passes (all of which are now closed and re-verified as genuinely fixed, not merely closed).

New defects

#	What
#5086	allowRuntimeCreate: false is not enforced. PUT /meta creates job and agent items the registry declares code-only. supportsOverlay: false looks equally unenforced — the success message calls the row a "customization overlay" for a type declared not to support them. This is the ADR-0049 failure mode one level up: the enforcement flag itself is the silently-inert declaration.
#5088	updateMany runs hooks for a nonexistent id. With no stored record to merge, the hook condition evaluates against a payload-only record, #4775's abort fires, and the row fails INTERNAL_ERROR accusing a correct hook of naming an undeclared field — where single-record PATCH correctly answers RECORD_NOT_FOUND. Under atomic one stale id poisons the whole batch via NOT_ATTEMPTED.
#5079	#4432 residual — a deleted overlay stays in the /meta listing while dispatch correctly 404s.

The seventeen earlier fixes: verified, not assumed

I re-ran every original repro. All landed. Several exceed what was asked:

• datasource: an object mapped to an unreachable datasource silently reads/writes the DEFAULT store — no boot failure, /ready still 200 #4462 now fails the boot naming the datasource, naming the object routed to it, stating the consequence ("their reads/writes would otherwise land in a DIFFERENT database"), and offering an escape hatch.
• analytics: /analytics/query ignores record-level scoping — a member counts and reads dimension values of records they cannot read #4467 — member with shares on 2 of 5 notes: data 2, analytics 2, dimensions:["title"] returns only their two titles.
• screen flows: resume performs no server-side validation — missing required fields and undeclared keys all complete the run #4477 — resume validates three ways and the write lands. (The envelope is {"inputs":{…}}; I first tested flat and produced a false failure. The docs were right.)
• Console approvals: quorum progress and per-group chips do not render, though the server sends minApprovals / group / __nodeLabel #4478 — the quorum UI now renders 会签 — 已完成 0 / 共 2 个组 with a progress bar and per-group chips finance 0/1, manager 0/1.
• Setup System Overview: every KPI tile reads 0 — the dataset path lowers an all-time range to WHERE created_at = $1 #4475 — Setup System Overview reads Users 4, Sessions 7. Real counts.

Highlights from the rc.2/rc.3 window

• ADR-0119 atomicity proven by rollback, not by wording: an atomic deleteMany of [valid, missing] marks the valid row ROLLED_BACK and the row still exists afterwards.
• The G4 semantic reversal is real and its root cause is gone. An unevaluable hook condition now aborts with a prescriptive 400; the condition evaluation failed; treating as false warnings that flooded the rc.1 boot log are down to 0. The same fail-closed posture holds for validation predicates (Script validation rules are silently skipped when their predicate fails to evaluate — fail-open is the wrong direction for a validation #4649).
• Parent-scoped readonlyWhen is unenforced server-side — the field lock fails open, so a paid invoice's frozen lines can be rewritten over the API #4889 parent-scoped readonlyWhen is enforced server-side — on a paid invoice both product and unit_price come back in droppedFields with reason=readonly_when and the stored values are unchanged, while the same fields on a draft parent write normally. (My first attempt passed vacuously because I re-sent the existing value — worth stating for whoever re-tests.)
• 审批记录锁 bindApprovalLockHook 对谓词式(multi)更新完全失效:if (!id) return 把「没解析到行」当成「允许」 #4778 the record lock holds on the predicate/multi path (RECORD_LOCKED per row), not just single PATCH.
• The retirement diagnostics are the strongest work in this window. areas[].visible explains it was a gate that failed open and which layer actually enforces; datasource.retryPolicy warns against renaming your way around it because hook.retryPolicy is a genuinely-enforced different key; composeStacks is three-for-three (undeclared warns, conflict throws naming both stacks, same value passes).
• G8 spec convergence — 15 renamed exports checked across 10 subpaths: no duplicate owners. G10 docs sweep run 3 — every fingerprint hit is documenting a removal or a same-name-different-thing; clean.

One operational note, not a defect

On this build /api/v1/meta/object takes ~11s (680 KB) and /meta/view ~9s. The Console blocks its splash on both, so a cold /_console/ load sits on "Connecting to data source" for ~20s before rendering. It does render correctly. Worth a look before GA if that is not expected for a 24-object app.