docs(qa): dedupe the private D11 defect and correct four stale sharing/security checklist texts (#7687) (#7717)

Checklist maintenance falling out of QA run #7637 (access-security FULL area).
Five itemised corrections under docs/qa/platform-checklist/, each verified
against origin/main before it was written down:

1. Dedupe the private D11 defect. #7637 recorded ONE defect on two clauses
   (rls-both-sides c5 and owd-sharing-matrix c4). rls-both-sides c5 becomes the
   canonical expected-fail probe; owd-sharing-matrix c4 cross-references it, so
   a run counts it once. The text is non-disclosing and names only the
   FOLLOW-UPS D11 handle (private per the #7463 ruling); a negative pins the
   naming collision with the unrelated "ADR-0090 D11".

2. suggested-binding-loop knownGaps: stock produces NO suggestion row at all —
   not the "confirmed (observed)" row the old text claimed. Records the
   auto-bind-at-boot cause (suggested-audience-bindings.ts `if (bound) continue`),
   the per-clause dependency split, and the unbind sequence that provisions a
   genuine PENDING row.

3. record-share-grant-revoke c6: a rule-materialized share carries
   source_id = the sys_sharing_rule ROW ID, not the rule name — the stable FK
   purgeRuleGrants(ruleId) reconciles on.

4. sharing-rule-authoring-ui: retargeted from showcase_project (which declares
   sharingModel 'public_read_write', so a rule on it widens nothing observable)
   to showcase_contact, genuinely OWD private and covered by no seeded rule.
   Carries the same source_id correction as (3).

5. RUNNER.md briefing: `view` IS in the overlay-allowed set
   (view, dashboard, report, translation, email_template — derived from the
   metadata-type registry), so PUT /api/v1/meta/view/<name> works on the stock
   read-only showcase package with no escape hatch.

Docs-only; no changeset.


Claude-Session: https://claude.ai/code/session_01S4sFAfxfUgTMtjLvc95inS

Co-authored-by: Claude <noreply@anthropic.com>

Author: huangyiirene

docs/qa/platform-checklist/RUNNER.md

@@ -76,6 +76,26 @@ test-run output the clause's `evidence` field names.
    captured evidence alone (not from the first agent's narrative) before it is acted
    on. Disagreement → re-run the item.
 
+### Environment facts the runner should not re-derive
+
+Standing facts about the stock showcase environment that have each cost a run a
+detour. They are briefing material, not verdicts — re-confirm one only when a run
+contradicts it, and correct it here when it does.
+
+- **`view` is in the overlay-allowed set, so authoring a view on the stock read-only
+  showcase package is NOT blocked and needs no escape hatch.** The org-overridable
+  types are derived from the metadata-type registry, not a hand-written list, and are
+  exactly **`view`, `dashboard`, `report`, `translation`, `email_template`**
+  (`packages/spec/src/kernel/metadata-plugin.zod.ts` — the `allowOrgOverride: true`
+  entries; pinned by `protocol.org-scoped-write-refused.test.ts` G5). So
+  `PUT /api/v1/meta/view/<name>` answers 2xx on stock showcase with no
+  `OS_METADATA_WRITABLE` and no `?package=` trick, while the same shape on `object`,
+  `field`, `hook`, `seed`, `mapping` or `flow` is refused. ⛔ Do not record a view
+  step as `blocked(environment)` on a "the showcase package is read-only" assumption:
+  read-only-ness is per metadata TYPE here, not per package, and the read-only-package
+  lock the console renders is a *different* gate (see
+  `access-security.readonly-package-locks-studio`).
+
 ### Trap vocabulary (`traps` field)
 
 | trap | what it fakes | counter |