docs(qa): automation ledger — 23 checklist-accuracy findings of the 18.2.0 sweep, and the retired objectui pin wording (#26118)

<!-- claude-projects-attribution: {"github_login":"os-steve"} -->
_Requested by **Steve** · [project
thread](https://claude.ai/code/project/chan_01FdL1XeUyvVNxLreh3F4Qi9?thread=cmsg_01FdL1XeUyvVNxLreh3F4Qi94s6gRi2E8RhbDCCcrXW4Tp)_
Fixes #25840
Clause-②: no
Metadata-protocol: none

Applies the 24 `automation.json` lines of the 18.2.0 release sweep (wave
anchor #25807) to `docs/qa/platform-checklist/areas/automation.json`,
the only file touched. 23 lines are applied: 13 items revised, each with
`revision` bumped and a `history` row citing the run record the line
came from, plus the area recipe `qa-flow-status-doors` (recipes carry no
revision of their own; the edit is recorded on
`automation.trigger-status-contract`, its consumer). One line confirmed
an item accurate and needs no edit. No line turned out to be a product
defect.

The same file's retired objectui pin wording, which #26035 left to this
card, is respelled to the current form (#26052): the objectui tree lives
under `ui/` and `pnpm console:build` builds the console from it. History
rows keep the old wording as records.

Every line was re-read against `origin/main` at base `9753d1637f` before
editing; the file had no commit since the card was filed (last change
2026-10-24).

## Line by line

| Run record | Item | Line | Disposition |
|:--|:--|:--|:--|
| #25812 | `packaged-flow-disable-durable` | steps 2/8/10 task POST
needs `project`; step 4 "reads are open" | applied: rev 6,
steps[1]/[7]/[9] name the required `project` (a required master-detail
field), steps[3] says `apiMethods` names the verbs the door serves, not
who may read |
| #25815 | `durable-suspend-restart` | a0/a1/a4: the pin drives its own
fixture | applied: rev 3, `automated.ref` scopes the pin to the generic
halves of a0/a1/a4/n0 over `flow_durable_suspend` |
| #25815 | `durable-suspend-restart` | a1: "cold boot" is a second
bootStack in one process | applied: same row, `automated.ref` names the
layer |
| #25815 | `flow-authoring-refusals-v18` | ref is accurate | no edit:
confirmed at base, all nine files exist and each holds tests; the ref
already scopes them to acceptance[0] |
| #25815 | `flow-run-semantics-v18` | a2/n0: wire pins missing from the
ref | applied: rev 3, adds
`packages/verify/src/automation-trigger-elevated-door.test.ts` and
`packages/qa/dogfood/test/flow-door-elevated-start.dogfood.test.ts`,
says which door each pin drives |
| #25815 | `flow-run-semantics-v18` | a1: no HTTP read-back pin |
applied: same row, a1 stays the live run's |
| #25815 | `inbound-hook-timestamped-signature` | a2: no cross-arm byte
comparison | applied: rev 2, acceptance[2].verify says the comparison is
live-only |
| #25815 | `paused-run-trigger-record-masked` | a0: engine read + data
door checks only `record`; null-where-unset unexercised | applied: rev
5, `automated.ref` |
| #25815 | `paused-run-trigger-record-masked` | a3: second bootStack,
same process | applied: same row |
| #25815 | `paused-run-trigger-record-masked` | n0: every reader is the
admin token | applied: same row |
| #25815 | `scheduled-work-opt-in` | a1/a2: pins assert arming, not a
served boot | applied: rev 2, acceptance[1]/[2].verify |
| #25815 | `screen-flow-roundtrip` | a4: final assertion is the grid
cell | applied: rev 6, `automated.ref` + acceptance[4].verify |
| #25815 | `screen-flow-roundtrip` | a0/a3: the spec never reads the run
| applied: same row, `automated.ref` |
| #25815 | `setup-packaged-automation-board` | a0: navContribution test
not in the ref | applied: rev 9, `automated.ref` adds it (component
layer, scores nothing on its own) |
| #25815 | `trigger-type-matrix` | n0: anonymous-deny pin not in the ref
| applied: rev 8, `automated.ref` adds it for n0's 401 half only |
| #25817 | `trigger-status-contract` | steps[7]: no stock flow reaches
all three doors | applied: rev 6, steps[7] + acceptance[2].verify |
| #25817 | `trigger-status-contract` | the runner's door pairs |
applied: steps[7] names both stock pairs |
| #25817 | `trigger-status-contract` | `/actions` 400/422 need a
type:'flow' action | applied: steps[7] names the authoring route the run
suggests, and says the recipe does not carry it |
| #25817 | `trigger-status-contract` | recipe "NOT yet proven by a live
run" is stale | applied: recipe `provenance` and `knownGaps[1]` |
| #25817 | `trigger-status-contract` | a bodyless resume answers 400
`INVALID_SCREEN_INPUT` | applied: steps[5] |
| #25817 | `packaged-flow-subflow-disable-refusal` | knownGaps[0] partly
stale | applied: rev 9, knownGaps[0] |
| #25817 | `packaged-flow-subflow-disable-refusal` | `?package=` flow is
deployment-authored | applied: knownGaps[0] + negative[1] |
| #25817 | `packaged-flow-clone-contract` | `{}` details name only the
first missing field | applied: rev 8, acceptance[0].verify |
| #25817 | `flow-run-step-nesting` | steps[4] Studio route | applied:
rev 8, steps[4] |

Retired pin wording, re-spelled in the same commit:
`setup-packaged-automation-board` `fixtures.requires[0]` (the
`.objectui-sha` bundle) and `fixtures.knownGaps[1]`, and
`screen-flow-roundtrip` `fixtures.knownGaps[0]` (specs only runnable in
an objectui checkout at the pinned revision; no console bundle built
here). Both `automated.ref` rows now name their `ui/` paths. After the
edit, a walk over every non-history string in the file finds no
`objectui:build|refresh|bump|clean`, `.objectui-sha`, `build-console`,
"pinned revision", "objectui checkout" or "objectui REPO".

## Gates

At head `890110d4` (base `9753d1637f`):

- `pnpm check:platform-checklist`: exit 0, `check-platform-checklist: OK
— 16 areas, 329 items (324 active, 1 planned)`, line citations 0, symbol
anchors 986/996 with 10 on the named residual.
- `node scripts/pm/dispatch-gates.mjs --commands --repo
objectstack-ai/objectstack`: 13 derived families, each run with its exit
captured before any pipe, all exit 0. `--ran` reconciliation: 13
derived, 13 run, 0 NOT-MEASURED, 0 UNRUN.
`check:doc-formula-expressions` needed `@objectstack/formula` and
`@objectstack/lint` built first (prerequisite exit 3, then exit 0).
- No package is touched, so no build or test closure is owed.
`skip-changeset`: the diff is a QA ledger under `docs/qa/`, which no
package ships.

## Acceptance notes

- `docs/qa/platform-checklist/RUNNER.md`'s standing fact on items whose
`automated.ref` lives "ENTIRELY in the objectui repo" still says those
specs are not in this checkout and that option (b) is running the pin
"inside an objectui checkout at the pinned revision". After the `ui/`
import those paths exist here. This PR does not touch RUNNER.md (file
surface). Carrier: #26035, whose slice 2 respelled RUNNER.md's
pin-script lines but not this standing fact.
- `setup-packaged-automation-board` `fixtures.knownGaps[0]` still routes
"a locator or copy fix" to objectui under ADR-0054, and several `source`
rows across the file cite `objectui packages/...` paths. Neither is
pin-script wording, so both are left as written. Carrier: none, noted
only.
- History rows cite `#25840` as `ref`, since the PR number is not known
at authoring time.

---
_Generated by [Claude
Code](https://claude.ai/code/session_013McZY67kjPnKvQ8Kz3XrpW)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]