docs(qa): access-security ledger edits from the 18.2.0 sweep (#25835) (#26101)

<!-- claude-projects-attribution: {"github_login":"os-elon-musk"} -->
_Requested by **Elon** · [project
thread](https://claude.ai/code/project/chan_01WedDzV26nniwxv7jC88B9D?thread=cmsg_01WedDzV26nniwxv7jC88B9DFYiPmjmUVVNwXn3h6CGthD)_

Fixes #25835

Wave anchor: #25807 (18.2.0 release test sweep). Docs only: one file,
`docs/qa/platform-checklist/areas/access-security.json`.

## What changed

All 65 lines of the card were re-read against `main` at `b4199c96`
before editing (the records measured `6679644a`, pin `b41ed7f68956`; the
pin is retired, #25745). 62 lines are applied, 3 are answered on the
card instead (below). 24 items are revised, plus one more for the
retired-pin text, 25 in all. Each revised item has its `revision` bumped
once and one new `history` entry that cites the record(s) its lines came
from (#25812, #25815, #25817, #25823) and says which lines did not hold.
⛔ No item status changed and no clause's assertion changed: almost every
line was the ledger overclaiming what a pin asserts, or not naming the
layer a pin reaches (RUNNER rule 6). So most edits are to
`automated.ref`, which now says per clause what each pin asserts, at
which layer, and which legs stay hand-driven.

| item | lines | rev | the edit |
|:--|:-:|:-:|:--|
| crud-permission-matrix | 6 | 7→8 | knownGaps[1] and the ref: a plain
member reads the org's whole `sys_user` directory
(`sys_user_org_members`), not a self-scoped row. The ref no longer reads
`objectstack verify --rls` as a pin. It no longer claims clauses 3 and 6
whole, and it says the zoo's out-of-subtree case asserts only a non-2xx.
acceptance[6].verify says which 164 cells the pin judges. |
| walled-environment-metadata-operator-only | 2 | 5→6 | knownGaps[0]:
the wall-* pins boot the CRM example, not the showcase, and their single
leg is a `manage_metadata` holder, not the seeded admin. |
| activation-write-operator-gate | 4 | 9→10 | The ref no longer claims
the full matrix. It names `automation-toggle-deny-message.test.ts`,
`automation-write-capability-gate.test.ts` and
`packaged-activation-ledger-reach.dogfood.test.ts` with their layers and
personas, and names the unpinned re-hydration leg. |
| anonymous-deny-surfaces | 3 | 3→4 | The ref names three hand-driven
legs: the /meta contrast is `.not.toBe(401)`, there is no forms
contrast, and there is no post-DELETE read-back. |
| anonymous-floor-v18-doors | 4 | 3→4 | The ref says per clause what the
pins assert. `EVERYTHING_ELSE` never reads `error.code`, the share-link
class accepts 401, the docs pin does not compare against the control
path, and the 201 is pinned only over a protocol double. |
| deployment-tables-platform-only | 2 | 2→3 |
`authz-identity-objects-boot-refusal.test.ts` left the ref (it pins
something else). acceptance[1] and acceptance[2] are named live-run. |
| fls-mask-and-strip | 2 | 5→6 | STILL MANUAL now names the admin budget
write and the name re-read. |
| grant-table-write-contract | 2 | 6→7 | The ref names the engine layer
of the plugin-security pins, and the legs the HTTP window case does not
assert. |
| me-permissions-aggregation-parity | 3 | 3→4 |
`current-user-endpoints-localization.test.ts` joins the ref. STILL
MANUAL names the admin half of /me/apps and the anonymous trio on a real
stack. |
| meta-authoring-trail-and-audience-gates | 2 | 2→3 | The ref names the
unit layer of the audience-gate pin, the doors it lacks, and the
unit-only 304. |
| no-active-org-session-semantics | 6 | 8→9 | The ref quotes the group
case as it reads now (refusal, #24784 / PR #24819). It no longer claims
every clause, and it names three existing pins with their layers. After
#25626, personas, fixtures.requires[1] and knownGaps[0] mint producer
(2)'s member through create-user, and record producer (1)
blocked(fixture). |
| org-admin-assignment-boundary | 1 | 1→2 | The ref says that per
posture only `admin_full_access` is exercised. |
| owd-sharing-matrix | 3 | 4→5 | The ref names each unpinned model and
leg, the cbp fallback set, and the synthetic fixture. |
| parent-and-organization-write-guards | 1 | 5→6 | The ref names the
in-process layer, and says the #24840 PASS predates the layer rule. |
| platform-owner-email-anchor | 2 | 8→9 | The ref says
`ADMIN_STANDING_NON_TABLE_INPUTS` is asserted by no test. The a0–a3 line
confirmed the ledger. |
| public-form-withdrawal-layers | 2 | 3→4 | The ref says acceptance[0]
does not score from pins alone, and names the layers of the a2–a5 pins.
|
| record-access-explain | 2 | 3→4 | The ref says the zoo case calls
`explain()` in-process under `isSystem`, and that no deny-side explain
is pinned. |
| record-view-read-audit | 2 | 3→4 | negative[0] now says once per CAUSE
(#18247). The ref says the exclusion pin probes other names and that no
pin reads the install line. |
| rls-both-sides | 2 | 7→8 | The ref names the command, not a source
file, as the proof, and says where the row-unchanged re-read is pinned.
|
| security-catalog-activation-and-clone-doors | 2 | 1→2 | The ref says
which refusal arms are HTTP-pinned and which are unit-only. |
| security-catalog-one-holder-and-boot-report | 4 | 2→3 |
`marketplace-install-local-catalog-name-collision.test.ts` joins the
ref. The ref names the registerApp layer, the in-process CLI, and the
unasserted 50-name cap. |
| share-link-combined-gates | 2 | 3→4 |
`share-links-refusal-order.test.ts` joins the ref. Both runtime pins are
named in-process, so they score acceptance[0] only. |
| write-path-guards | 4 | 6→7 | The ref names what the bulk,
readonlyWhen and static-readonly pins do not assert, and the fake-driver
objectql pins. |
| capability-declaration-lifecycle | 2 | 6→7 | steps[7]: the located
path is `capabilities.N.scope` (`.2` when appended). The `mixed` line
was answered, not applied. |
| share-link-landing-page | retired pin | 4→5 | knownGaps[2] no longer
prescribes `.objectui-sha`. It names `pnpm console:build` into
`packages/console/dist` (which `pnpm build` does not refresh) and
`ui/apps/console/src/pages/SharedRecordPage.tsx`. History line cites
#26035. |

Answered on the card, not edited (with reasons in the card report):
- crud-permission-matrix, the pin header's "6 delegate × sys_* rows".
The stale number is a comment in the test file, outside this card's
one-file surface. The ledger already says 4.
- platform-owner-email-anchor a0–a3. The record confirms the ledger
already records these as STILL MANUAL.
- capability-declaration-lifecycle `mixed` without a browser oracle. In
this ledger `mixed` means more than one execution surface: 31 other
active `mixed` items have no screenshot or dom oracle, and this item is
driven over the API and the build / CLI.

Two lines held only in part on this tree, and the history says so.
activation a0/n2: `FLOW_ENABLEMENT_DENY_MESSAGE`'s sentence is asserted,
by value, in `automation-toggle-deny-message.test.ts`. anonymous-floor
a1: `UNAUTHENTICATED` is asserted on other faces of /notifications,
/keys and /share-links, but not on the three GET faces the step lists.

No line described a product defect, so nothing was filed.

## Verified

- Gate families derived by `node scripts/pm/dispatch-gates.mjs
--commands` on head `9738ffad` (one path vs merge base `b4199c968`):

  - `node scripts/check-ci-filter-parity.mjs` — exit 0
  - `node scripts/check-closing-keyword-parity.mjs` — exit 0
  - `node scripts/check-closing-keyword-parity.mjs --self-test` — exit 0
  - `node scripts/check-comment-mask-corpus.mjs` — exit 0
- `pnpm --filter @objectstack/lint run check:doc-formula-expressions` —
exit 0
  - `pnpm check:cross-package-test-inputs` — exit 0
  - `pnpm check:doc-authoring` — exit 0
  - `pnpm check:driver-memory-census` — exit 0
  - `pnpm check:gitlink-declared` — exit 0
  - `pnpm check:nul-bytes` — exit 0
  - `pnpm check:platform-checklist` — exit 0
  - `pnpm check:refd-timer-probe` — exit 0
  - `pnpm check:watch-hint-literal` — exit 0
- `check:doc-formula-expressions` first exited 3 (PREREQUISITE NOT MET)
in the fresh worktree; after `pnpm --filter '@objectstack/lint...'
build` (lock VERDICT command-exit 0) it exits 0.
- `node scripts/pm/dispatch-gates.mjs --ran`: 13 derived, 13 run, 0
NOT-MEASURED.

- `node scripts/pm/check-governed-merges.mjs --test
docs/qa/platform-checklist/areas/access-security.json`: "NOT governed —
ordinary queue landing applies". No contract review is triggered, and
this is not Tier H.
- Diff: 1 file, 207 insertions and 57 deletions, so no split is needed.
Edits were made as text replacements inside each item, so the file's own
formatting is kept (a JSON re-serialise would have rewritten 22 one-line
history rows).

## Acceptance notes (found beside the lines, outside this card's
surface)

-
`packages/qa/dogfood/test/showcase-crud-persona-matrix.dogfood.test.ts`:
the header comment still says "6 `showcase_field_ops_delegate` × `sys_*`
rows", while its own assertion says 4. This is test-file text and needs
no card. Carrier: none.
- no-active-org-session-semantics knownGaps[4] and [5] still read #24784
as open, but it closed 2026-10-20 (PR #24819). Their own text asks for a
live walled `group` re-run before the line drops, so they are left for
that run.
- After #25626, `identity-auth.workspace-org-switch` personas[2] and
RUNNER.md's "Walled personas come from the admin door"
`membershipCreated: false` sentence are stale too (#25823). They belong
to the identity-auth card and the RUNNER card (#25850).
- RUNNER.md's standing fact still calls `automated.ref` paths under
objectui "objectui-repo-only", while `ui/` is now in this repo.
share-link-landing-page knownGaps[0] and its ref stay in step with
RUNNER until #25850 changes it.

`skip-changeset`: docs only, nothing published.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01GgKuGD9Ats95jBbJRZrf4a)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]