docs(qa): api-backend checklist says what each pin asserts and at which layer (18.2.0 sweep, 28 lines) (#26115)

<!-- claude-projects-attribution: {"github_login":"os-steve"} -->
_Requested by **Steve** · [project
thread](https://claude.ai/code/project/chan_01FdL1XeUyvVNxLreh3F4Qi9?thread=cmsg_01FdL1XeUyvVNxLreh3F4Qi9VvigEWYo4KrkZvUgfw5EG6)_
Fixes #25837

Clause-②: no
Metadata-protocol: none

Wave anchor: #25807 (the 18.2.0 release test sweep; it stays open).

## What changes

One file, `docs/qa/platform-checklist/areas/api-backend.json`. Fourteen
items are revised from the 28 checklist-accuracy lines of QA runs #25815
(`release-18.2.0-tier1`) and #25817 (`release-18.2.0-manual-set`), both
at `6679644a`. Each revised item bumps `revision` by one and appends one
`history` row that cites its run record and the findings it applies. No
clause, oracle or priority changed. Every line was re-read against
`origin/main` at `f6c61932` before it was edited.

Most lines are one shape: an item's `automated.ref` or a clause's
`verify` said a pin covered more than the pin asserts, or did not say
which layer the pin reaches. Under RUNNER rule 6 a pin scores only the
layer it drives, so the edits name that layer (unit, engine, or HTTP)
and say which half of each clause the live run still owes.

| Item | Findings | Edit |
|:--|:--|:--|
| `action-activation-door-contract` | a2, a5, a6 | knownGaps[0],
acceptance[2], [5] and [6] verify, `automated.ref`: the 400s are
asserted by code only (no `fields[0]`, no non-object-body case); the
ledger pin finds the row with `rows.find` and checks the flip's status,
not its body; the ambiguity case asserts only the twin's name
`crm_account`. Names `field-error-code-catalog.test.ts` as a unit read
of the shared body reader. |
| `bulk-write-contract` | ref, a3 | `automated.ref`: the dogfood file's
bulk cases are engine calls (`ql.update` / `ql.delete` with `multi:
true`), not the HTTP bulk doors, so it scores no clause; adds
`rest-batch-size-cap.test.ts` as unit evidence for a3, partial at most.
|
| `data-request-shape-and-query-arity` | a1–a4, a1 | `automated.ref`
names the layer of every file (none boots the Hono adapter, so they
score a0 only) and adds `data-update-expected-version.test.ts`;
acceptance[1].verify says the empty-token leg is the PATCH door's. |
| `declarative-endpoint-execution` | a1, a2 | acceptance[1] and [2]
verify, `automated.ref`: no pin asserts the 401's code; gate (a) asserts
the fix sentence (script) and the SSRF reason (proxy), never the
endpoint's name; the #5488 withdrawal and the CLI refusal are the run's.
|
| `error-sentences-and-unique-violation-wire-code` | a1, a2 |
acceptance[1] and [2] verify: the hook-envelope pin calls `mapDataError`
directly (unit); the unique-violation pin is `HttpDispatcher` over a
real engine and SqlDriver, no Hono. |
| `meta-read-doors-v18` | a4, a1–a3 | acceptance[4].verify and
`automated.ref`: adds `showcase-fls-read-mask-strip.dogfood.test.ts` for
the data-sort 403; every other pin drives the protocol, route handlers
or the dispatcher with a stub server, so a1–a3 are live legs. |
| `packaged-action-disabled-dispatch` | a0, a3/a6/n1 |
acceptance[0].verify and `automated.ref`: the dogfood asserts 409 and
`/ACTION_DISABLED\|is disabled/` only; the exact sentence and the 403,
flow-type and absence legs are pinned by a unit `HttpDispatcher` over
fakes. |
| `query-contract-matrix` | a4, n0, whole item | `automated.ref`: the
`[#2850]` case proves middleware routing on a mock driver, not a
withheld contact over HTTP; the request-schema pin is a mocked protocol;
no clause has a pin at its oracle's layer, so every clause runs live.
`automated` is kept: the pins are real evidence of their layers. |
| `rest-batch-config-contract` | a5 | acceptance[5].verify: §E asserts
the key plus `/never built/` and `/options.atomic/`, never
`BatchEndpointsConfigSchema` or the upsert replacement. |
| `rest-crud-config-contract` | a3, a4 | `automated.ref` and
acceptance[4].verify: adds
`discovery-services-route-follows-mount.test.ts` for the advertisement
half of a3 (the moved route table has no pin); §E never matches the
declarative-endpoint prescription. |
| `rest-metadata-config-contract` | a1, a3, a5 | `automated.ref` and
acceptance[5].verify: §D pins prefix survival through `normalizeConfig`,
not a mount; adds the discovery pin for a1's advertisement half and
`meta-object-fls.test.ts` for a3's masking effect at the route-handler
layer; §E never asserts the replacement. |
| `rest-route-generation-tombstones` | a0 | `automated.ref`: §E matches
`/was removed/`, not the clause's `was removed in @objectstack/spec 17`.
|
| `aggregate-contract-matrix` | #25817 | negative[2]: the #24618
negative-offset shift no longer reproduces (re-measured by #25817 under
UTC, America/Los_Angeles and Pacific/Auckland); #24618 is closed as
completed. |
| `formula-stdlib-matrix` | #25817 | fixtures.requires[1], steps[5] and
steps[6]: every scratch object declares a `sharingModel`, or an active
save answers 422 `security-owd-unset` before the formula is judged. |

### Lines not applied as written

- `packaged-action-disabled-dispatch` a5: the record says the ref is
correct that the restart leg stays manual. Nothing to change; the
sentence is unchanged.
- `data-request-shape-and-query-arity` a1 asked whether the clause meant
DELETE for the empty token. It means PATCH (steps[1]). The PATCH refusal
is pinned in `data-update-expected-version.test.ts`, which the ref did
not name; the edit adds it rather than re-pointing the clause.
- `rest-metadata-config-contract` a1 and a3 are applied, but the tree is
narrower than the record on two points.
`discovery-services-route-follows-mount.test.ts` does read
`routes.metadata` at prefix `/metadata` (it was outside the ref).
`meta-object-fls.test.ts` does pin the masking effect and the
`maskObjectFields: false` opt-out, at the route-handler layer. Both are
now named, with the layer they score.
- `formula-stdlib-matrix`: the record names steps[5] and requires[1].
steps[6] is edited too: its active-door probe also reads a 422, and
without a `sharingModel` it would capture `security-owd-unset` instead
of the expression refusal.

No line turned out to be a product defect, so no card is owed from this
PR. The retired `objectui:build` / `.objectui-sha` / pin-script wording
does not occur in this file (0 hits), so nothing was carried over from
#26035.

## Verification

At head `8bbb36f0`:

- `pnpm check:platform-checklist` exit 0: `check-platform-checklist: OK
— 16 areas, 329 items (324 active, 1 planned)`; symbol anchors 986/996
resolved, 10 on the named residual, 18 file floors held; line citations
0.
- `node scripts/pm/dispatch-gates.mjs --commands --repo
objectstack-ai/objectstack` derived 13 families. All 13 were run
locally, each exit 0: `check-ci-filter-parity`,
`check-closing-keyword-parity` (and `--self-test`),
`check-comment-mask-corpus`, `@objectstack/lint
check:doc-formula-expressions` (after building `@objectstack/formula`
and `@objectstack/lint`), `check:cross-package-test-inputs`,
`check:doc-authoring`, `check:driver-memory-census`,
`check:gitlink-declared`, `check:nul-bytes`, `check:platform-checklist`,
`check:refd-timer-probe`, `check:watch-hint-literal`. `--ran`
reconciliation: 13 derived, 13 run, 0 NOT-MEASURED, 0 UNRUN.
- The edit was applied as exact, asserted substring replacements, and
the file round-trips through `JSON.stringify(…, 2)` byte-for-byte, so
only the edited fields and the new history rows move (126 insertions, 42
deletions).

Docs-only: the ledger is not in any package's `files[]`, so this PR
carries `skip-changeset`.

## Acceptance notes

- Three lines of `api-console-discovery-execute` still spell the Console
sources as the sibling repo, `objectui
apps/console/src/pages/developer/…`. Those files now live under
`ui/apps/console/src/pages/developer/`. This is path spelling, not the
retired pin wording, and it is outside this card's lines. Carrier: none.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01MosPkPhtm6BKBKAmyfGtfw)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]