docs(qa): wave-3 checklist accuracy slice S6 — api-backend, ai and automation (#28362)

<!-- claude-projects-attribution: {"github_login":"os-zhuang"} -->
_Requested by **Sam** · [project
thread](https://claude.ai/code/project/chan_01LjZwNRFiG2fkp8SNf6rHNx?thread=cmsg_01LjZwNRFiG2fkp8SNf6rHNxNVTbwyL9LkMqUayiw5y7EE)_
Fixes #28340

Part of #27377 (wave-3 checklist accuracy, slice S6).

Clause-②: no
Metadata-protocol: none

## 维护者速读

- 改了什么：三份测试清单（api-backend、ai、automation）里 18 个条目按当前代码改正文字，每个条目 revision
+1、追加一行 history；automation 的 qa-flow-status-doors 夹具新增第 6 步。
- 为什么改：18.3.0 第三波
QA（#27392、#27409、#27441）发现这些条目的步骤或判据与产品现状不符，跑测的人按旧文字会误判。
- 风险与回滚：只改 docs/qa 下三个 JSON，不碰产品代码；没有条款被放宽，回滚即 revert。
- 先看：automation.json（新夹具第 6 步与
trigger-status-contract）、ai.json（mcp-oauth-private-host-transport
的未持有私网地址读法）、api-backend.json（formula-stdlib-matrix 29→30）。
- 两分钟验证：`pnpm check:platform-checklist`，预期末行 OK、352 items。
- 需要你做的：无，席位落地。

## What changes

25 of the slice's 26 census rows still held at `488b3ed0` and are
corrected to what the code says today; one row needs no edit. Every
touched item gets `revision` +1 and exactly one appended `history` row
citing its run record and #27377. main's history is an exact prefix of
every touched item (the edit script asserted it, and the parsed result
equals the intended model).

| file | item | census rows | run |
|---|---|---|---|
| api-backend | aggregate-contract-matrix | 4, 5, 6 | #27392 |
| api-backend | api-methods-verb-gate | 7, 8 | #27392 |
| api-backend | error-envelope-ledger | 9 | #27392 |
| api-backend | query-contract-matrix | 49, 50 | #27409 |
| api-backend | formula-stdlib-matrix | 70, 124 | #27441 |
| ai | mcp-run-action-exposure-gate | 1 | #27392 |
| ai | agent-tool-skill-metadata-roundtrip | 10 | #27392 |
| ai | mcp-oauth-private-host-transport | 27, 47 | #27409 |
| ai | mcp-http-surface | 44 | #27409 |
| ai | mcp-validate-expression | 46 | #27409 |
| ai | mcp-coded-refusals-and-runtime-exposure | 48 | #27409 |
| automation | packaged-flow-subflow-disable-refusal | 13 | #27392 |
| automation | trigger-status-contract (+ the qa-flow-status-doors
recipe) | 14, 15 | #27392 |
| automation | trigger-type-matrix | 58 | #27409 |
| automation | durable-suspend-restart | 59 | #27409 |
| automation | flow-authoring-refusals-v18 | 60 | #27409 |
| automation | flow-node-type-matrix | 109 | #27441 |
| automation | packaged-flow-clone-contract | 110 | #27441 |

Highlights:

- **aggregate-contract-matrix**: the retirement message's tail is
`AGG_RETIRED_TAIL` (names `os migrate meta` and the protocol upgrade
guide, no `--from 16`); a grouped empty `where` answers no groups, so
the empty-where identities are read ungrouped; knownGaps[0] names the
seeded rows (a null `annual_revenue` row, 2025-12-29 Monday and
2026-01-04 Sunday in ISO 2026-W01, 2027-01-01 in 2026-W53).
- **api-methods-verb-gate**: the import body is spelled (`format:
'json'`, `rows`, `writeMode`, `matchFields` for update), and the
parser's 400 INVALID_REQUEST is named as not-the-gate; both legacy
warnings print once per process (per combination, per object name), so
each legacy leg takes its own object name.
- **error-envelope-ledger**: sign-up answers 403
SELF_REGISTRATION_CLOSED under the invite_only default; a third identity
comes from admin create-user or an invitation.
- **query-contract-matrix**: compound AST filters are prefix-form
`['and', cond, cond]`; the four substring operators are case-sensitive,
`$icontains` is the ASCII-fold twin.
- **formula-stdlib-matrix**: the count is 30 (29 chained calls plus the
`label()` macro); a `label()` known-answer row is added; the
scratch-object legs name a writable package with a declared namespace.
- **mcp-run-action-exposure-gate** (GAP): a staging recipe for the
permitted half of `list_actions` — a runtime declarative update action,
ai-exposed, requiring `manage_metadata`.
- **agent-tool-skill-metadata-roundtrip**: `agent.tools` /
`agent.knowledge` / `skill.triggerPhrases` are plain unknown keys naming
the upgrade guide since #25767; the surviving prescriptions are listed
and `agent.lifecycle` is probed.
- **mcp-oauth-private-host-transport** (STALE + GAP): boot (a) is staged
by the base URL's host literal, held or not; a held address stays
required for the real-client leg only.
- **mcp-http-surface**: acceptance[4] names the HTTP door; stdio serves
9 tools because its bridge has no action methods.
- **mcp-validate-expression**: a new negative and step for blank input
(the save gate's verdict, `invalid_union`).
- **mcp-coded-refusals-and-runtime-exposure**: names the `qa_ai_mark`
producer the run used for acceptance[3].
- **trigger-status-contract**: the recipe gains step 6
(`qa_input_schema_invalid`, the 422 FLOW_INPUT_SCHEMA_INVALID row), the
"no stock trigger" knownGap is dropped, and the purge leg warns that
`showcase_inquiry_purge` really deletes.
- **durable-suspend-restart**: the PT1M follow-up may complete on the
new process before the re-read; that completion is its survival proof,
and the nested pair must still read paused and identical.
- **packaged-flow-clone-contract**: an empty-string name answers
`invalid_type`; the arm is added.

## Tests

No code changed. The three files are validated by `pnpm
check:platform-checklist` (green). The two new staging bodies were
parsed against the built spec at `8de73450`: the recipe's step-6 flow
parses with `FlowSchema`, both action bodies (`qa_ai_gated`,
`qa_ai_mark`) parse with `ActionSchema`, and a control with an illegal
`inputSchema` type is refused.

## Acceptance notes

- **Row 37 (`automation.paused-run-trigger-record-masked`) is not
edited.** Its fixtures.requires[1] already asks for an object with an
`internal: true` field; the run used `showcase_field_zoo`, which has
none. That is a runner deviation, not a ledger gap.
- **Row 47 / 27 is a reading, flagged for the seat.** The census called
it a light ruling. The code judges only the configured base URL's host
literal (`isOAuthEligibleBaseUrl`), and the run reproduced the whole (a)
shape on an unheld 10.0.0.5, so the item now scores (a) that way and
keeps a held address for the real-client leg. No clause text changed. If
the seat wants a ruling first, this one hunk can be reverted on its own.
- **Two GAP recipes are derived from source, not yet run live**:
`qa_ai_gated` (row 1) and the fast `time_relative` clone (row 58, whose
interval spelling is the showcase's own `schedule: { type: 'interval',
intervalMs: 60000 }`). The history rows say so.
- Not edited, noticed on the way:
`ai.agent-tool-skill-metadata-roundtrip`'s `variants` still label
`agent.tools`, `agent.knowledge` and `skill.triggerPhrases` as
"retiredKey" and list no `agent.lifecycle` variant. Changing variants
changes the run matrix, so it is left for a seat call.
- No product defect was found while re-verifying.

## Verification

<details><summary>dispatch-gates (16 derived families, all exit
0)</summary>

Derived at `8de73450` with `node scripts/pm/dispatch-gates.mjs
--commands --repo objectstack-ai/objectstack`, change set 3 paths, 244
changed lines.

```text
node scripts/check-adr-links.mjs :: exit 0
node scripts/check-adr-links.mjs --self-test :: exit 0
node scripts/check-closing-keyword-parity.mjs :: exit 0
node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0
node scripts/check-comment-mask-corpus.mjs :: exit 0
node scripts/ci/plan-test-core-shards.mjs --self-test :: exit 0
pnpm --filter @objectstack/lint run check:doc-formula-expressions :: exit 0 (first run exit 3, prerequisite unbuilt; re-run after building formula + lint)
pnpm check:ci-filter-parity :: exit 0
pnpm check:cross-package-test-inputs :: exit 0
pnpm check:doc-authoring :: exit 0
pnpm check:driver-memory-census :: exit 0
pnpm check:gitlink-declared :: exit 0
pnpm check:nul-bytes :: exit 0
pnpm check:platform-checklist :: exit 0
pnpm check:refd-timer-probe :: exit 0
pnpm check:watch-hint-literal :: exit 0
```

`--ran` reconciliation: 16 derived, 16 run, 0 NOT-MEASURED (a derived
zero: all 16 recorded an exit code).

</details>

<details><summary>check:platform-checklist</summary>

```text
check-platform-checklist: OK — 16 areas, 352 items (347 active, 1 planned); provisioning: 10 area recipes, 15 item references resolved (2 area-qualified), 10/10 recipes referenced; symbol anchors: 1066/1076 resolved (was 1064/1074 at base)
```

</details>

---
_Generated by [Claude
Code](https://claude.ai/code/session_01QUs3BvdUqqhcRdQJHjUSXA)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]