docs(qa): identity-auth — 23 ledger edits from the 18.2.0 release sweep (#26117)

<!-- claude-projects-attribution: {"github_login":"os-steve"} -->
_Requested by **Steve** · [project
thread](https://claude.ai/code/project/chan_01FdL1XeUyvVNxLreh3F4Qi9?thread=cmsg_01FdL1XeUyvVNxLreh3F4Qi9EMu8UWdshoTMchMGb77EbH)_
Fixes #25843

Clause-②: no
Metadata-protocol: none

Ledger edits to `docs/qa/platform-checklist/areas/identity-auth.json`
only: the 23 checklist-accuracy lines the 18.2.0 release sweep parked on
card #25843 (wave anchor #25807). Every line is applied or answered
below. Each touched item has its text revised, its `revision` bumped and
one `history` row appended that cites the QA run the line came from (ref
`#25843`, the parking card, as the 18.0 sweep's rows cite theirs). 11
items, docs-only, nothing published.

Premise checked against `origin/main`: the file is unchanged since the
card was filed (its last change predates 2026-10-24, shallow boundary
deepened to read it), so every line was re-read against current code
before it was edited.

## Per-line disposition (23)

| Run | Item · line | Disposition |
|:--|:--|:--|
| #25812 | `default-organization-boot-invariant` (3 facts) | Applied,
rev 3. `steps[2]` filters `sys_member?organization_id=DEFAULT_ORG_ID`
(the slug-default row's id; the column is `organization_id`).
`fixtures.requires` boots with `--log-level info` and a second entry
names the `--fresh` SQLite file (`FRESH_HOME/data/objectstack.db`, read
while the server runs). `acceptance[0].verify` says `--maxWorkers=1`,
RUNNER.md's memory fact. |
| #25815 | `admin-lifecycle-operations` a4 | Applied, rev 10.
`acceptance[4].verify`: the standing pin asserts the 403 + code only;
the target's protected request is driven by hand. |
| #25815 | `admin-lifecycle-operations` a0/n1 | Applied.
`acceptance[0].verify` and `automated.ref`: the clause-0 case asserts
`banned`/`ban_reason` and the unban, no sign-in by the banned user, so
the enforcement half and `negative[1]` are manual. |
| #25815 | `admin-lifecycle-operations` ref-parse | Applied.
`automated.ref` names the remove-user atomicity unit test as a contrast
without spelling its path, so a ref parser no longer counts it as a pin.
|
| #25815 | `api-key-expiry-lifecycle` a2 | Applied, rev 2.
`acceptance[0]` names the pin layers; `acceptance[2].verify` drives the
key count live (the no-key half is pinned only over a fake objectql). |
| #25815 | `api-key-expiry-lifecycle` a3 | Applied.
`acceptance[3].verify` drives a revoked and an expired key live; the
three 403 codes are pinned at unit layer only. |
| #25815 | `auth-gate-held-session-raw-host-families` a2 | Applied, rev
3. `acceptance[2].verify` drives the forced-reset door, `POST
/api/v1/auth/admin/set-user-password`, and notes it revokes the member's
sessions and keys by default (`runAdminSetUserPassword`). |
| #25815 | `auth-gate-held-session-raw-host-families` a3 | Applied.
`acceptance[3].verify`: the two posture pins drive
`RestServer.enforceAuth` / `HttpDispatcher` with fakes, so the x-api-key
calls are made over HTTP. |
| #25815 | `auth-gate-held-session-raw-host-families` a1 | Applied.
`acceptance[0]` names the mixed layers (storage, settings, share-link,
cloud-connection pins use fake request/response); `acceptance[1].verify`
scores every family from a real request. |
| #25815 | `auth-method-matrix` a3 | Applied, rev 9. The pin joins
`automated.ref`; `acceptance[3].verify` says it drives AuthManager, not
the production boot's send-otp door, so it scores partial. |
| #25815 | `auth-method-matrix` a6 | Applied.
`two-factor-lockout.dogfood.test.ts` joins `automated.ref`. |
| #25815 | `auth-method-matrix` a9 | Applied.
`change-email-delete-user-wiring.test.ts` joins `automated.ref`;
`acceptance[9].verify` names its unit layer. |
| #25815 | `auth-method-matrix` ref | Applied. `automated.ref` lists the
four pins with the clause and layer each scores (4 of 10 clauses);
`kind` reads `dogfood` instead of `e2e`. |
| #25815 | `cookie-session-renewal-in-process` a1 | Applied, rev 2.
`acceptance[0]` names the runtime pin's three doors;
`acceptance[1].verify` scores the meta read on its own. |
| #25815 | `implicit-account-linking-ownership` a0–a3 | Applied, rev 4.
`automated.ref` and `steps[7]`: the "end to end" cases run over a
hand-rolled in-memory engine, so `acceptance[0]`–`[3]` are scored live
and the pin scores `acceptance[4]`. |
| #25815 | `import-invitation-and-sso-domain-answers` a1 | Applied, rev
2. `admin-import-users-account-invitation.test.ts` (cases ① and ②) joins
`automated.ref`; `acceptance[0]` names both halves. |
| #25815 | `import-invitation-and-sso-domain-answers` a3 | Applied.
`acceptance[0]`: the SSO pin runs over `createMemoryEngine`, unit layer
only; `acceptance[3].verify` drives the doors live. |
| #25815 | `invitation-scope-gates` a0 | Answered, no edit:
`automated.ref` already says the pending half is scored live. Recorded
in the item's rev 6 history row. |
| #25815 | `invitation-scope-gates` n1 | Applied, rev 6. `negative[1]`
says the forged-request half is pinned and the affordance-hidden half is
`acceptance[4]`'s browser work. |
| #25817 | `two-factor-backup-codes` A4 | Applied, rev 5.
`fixtures.requires[2]`, `steps[7]`, `acceptance[4].verify`: the at-rest
read is out of band, from the DB file, because `backup_codes` is
`internal: true` and REST never returns it. The same three places quoted
the column's old "JSON-serialized" description; they now quote the
current one (encrypted at rest, one opaque ciphertext). |
| #25823 | `admin-lifecycle-operations` coverage gap | Applied. New
`acceptance[10]`–`[12]` for the walled Create User join: joins the
caller's active organization as `member` and a body `organizationId`
chooses nothing; `400 NO_ACTIVE_ORGANIZATION` with no row; `invite-only`
still joins. Plus `fixtures.requires[2]` (a walled boot declaring
`OS_AUTH_MEMBERSHIP_POLICY=invite-only`), two steps, and `automated.ref`
entries for `create-user-organization-join.dogfood.test.ts` (J1, J2,
HTTP) and the `admin-user-endpoints.test.ts` invite-only case (plugin
unit, so partial). Appended after clause 9, so no existing clause index
moved. |
| #25823 | `workspace-org-switch` personas[2] | Applied, rev 6. The
operator creates and set-actives an organization before Create User,
else `400 NO_ACTIVE_ORGANIZATION`. |
| #25823 | `admin-lifecycle-operations` ref overclaims | Applied.
`automated.ref`'s STILL MANUAL list now names clause 0's sign-ins,
clause 4's live-session half, clause 6's stop half and clause 9's state
read-back beyond create-user and set-user-password. |

## Acceptance notes

- **The `--maxWorkers=2` correction is applied to five items, not one.**
The card cites it on `default-organization-boot-invariant` only; the
same sentence sat in four other items this PR revises for their own
lines (`api-key-expiry-lifecycle`,
`auth-gate-held-session-raw-host-families`,
`cookie-session-renewal-in-process`,
`import-invitation-and-sso-domain-answers`). Each history row says so.
`implicit-account-linking-ownership` `steps[7]` gains `--maxWorkers=1`
the same way. Zero `--maxWorkers=2` remain in the file.
- **Retired objectui pin wording (handed to this card by #26035, current
form per #26052): zero live hits in this file.** `git grep -nE
"objectui:(build|refresh|bump|clean)|\.objectui-sha|build-console"` over
the file finds only `history` rows of `self-signup-gate` and
`email-verification-loop`, which record what a past revision read at a
past pin. Those are records and are left as written, as #26035 asks for
records. The `stale-console-bundle` trap name is unchanged (RUNNER.md
keeps it).
- No line turned out to be a product defect, so nothing goes to
`out_of_scope_findings`.
- Clauses 0–9 of `admin-lifecycle-operations` and every other item's
clause assertions are unchanged; edits re-point verify text, refs and
fixtures to what the pins actually reach (RUNNER.md rule 6, "a pin
scores only the layer it drives").

## Gates

All at head `95f651ad` (branch merged with `origin/main` `f6c61932`
first; that range touches nothing under `docs/qa/`).

- `pnpm check:platform-checklist`: exit 0, `check-platform-checklist: OK
— 16 areas, 329 items (324 active, 1 planned)`, line citations 0
surviving.
- `node scripts/pm/dispatch-gates.mjs --commands --repo
objectstack-ai/objectstack`: 13 derived families, each run locally, all
exit 0: `check-ci-filter-parity`, `check-closing-keyword-parity` (+
`--self-test`), `check-comment-mask-corpus`, `@objectstack/lint
check:doc-formula-expressions` (first run exit 3, prerequisite not met;
re-run after `turbo run build --filter=@objectstack/formula
--filter=@objectstack/lint`, exit 0), `check:cross-package-test-inputs`,
`check:doc-authoring`, `check:driver-memory-census`,
`check:gitlink-declared`, `check:nul-bytes`, `check:platform-checklist`,
`check:refd-timer-probe`, `check:watch-hint-literal`.
- `--ran` reconciliation with exit codes recorded: 13 derived, 13 run, 0
NOT-MEASURED, 0 UNRUN.
- Families CI owns (the required contexts, the artifact rosters, the
wide-population families) are left to this PR's check-runs.

`skip-changeset`: the diff is one file under `docs/qa/`, which no
package's `files[]` ships.

---
_Generated by [Claude
Code](https://claude.ai/code/session_016gb7qhsFoBRVmSNDpHG9Nh)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]