# 0047 — Cross-Cutting Misc — Module-less Issues

**Milestone:** TBD
**Owner:** TBD
**Status:** planning

## Goal

Consolidates 307 legacy issues from the
`MetaDrivenPlatform4AI` repo that share the same module / area label,
so they can be triaged together by the corresponding domain IC.

Issues without a strong module label or in clusters smaller than 3. Phase 3 review will likely split this into smaller groupings as patterns emerge.

## Acceptance criteria

- [ ] All `ported` children below have a Story or Bug filed in pingcap-pack
- [ ] All filed Stories / Bugs have a linked test (existing or to-write task with scaffold)
- [ ] Engineering review confirms which children are still applicable under the new project's design

## Stories / Bugs (filed as GitHub issues)

307 children classified `ported`. Phase 3/4 will file each as
a Story (capability) or Bug (defect) in this repo and back-reference the
legacy issue. Initial child list:

- [ ] #TBD — legacy MetaDrivenPlatform4AI#24 — Update .gitignore to prevent excluding untracked files in cmd/server/
- [ ] #TBD — legacy MetaDrivenPlatform4AI#27 — [API] UI API clone defaults response schema does not match Salesforce
- [ ] #TBD — legacy MetaDrivenPlatform4AI#28 — [API] Folders shares request/response schema differs from Salesforce
- [ ] #TBD — legacy MetaDrivenPlatform4AI#29 — [API] Missing GET /services/data/v63.0/actions endpoint
- [ ] #TBD — legacy MetaDrivenPlatform4AI#30 — [API] sObject listviews response uses fabricated IDs and hard-coded URLs
- [ ] #TBD — legacy MetaDrivenPlatform4AI#31 — [P2][API] Query API hard-codes record attributes.url to v63.0
- [ ] #TBD — legacy MetaDrivenPlatform4AI#32 — Missing `GET /services/data/v63.0/actions` endpoint (root Actions resource)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#33 — Composite SObject PATCH per-record errors don't match Salesforce status codes
- [ ] #TBD — legacy MetaDrivenPlatform4AI#34 — Tooling Flow GET endpoint missing Salesforce fields (ApiVersion; FullName; attributes)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#35 — Missing Tooling endpoint `POST /tooling/sobjects/ProfileLayout`
- [ ] #TBD — legacy MetaDrivenPlatform4AI#36 — Missing Recycle Bin endpoints (DELETE; POST restore; GET)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#37 — [API] Tooling Flow retrieve returns partial object vs Salesforce
- [ ] #TBD — legacy MetaDrivenPlatform4AI#38 — Flow Invocation API returns wrong status + schema (missing Salesforce fields)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#39 — [API] Discovery root omits folders resource
- [ ] #TBD — legacy MetaDrivenPlatform4AI#40 — Run Report error payload differs (missing specificErrorCode)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#42 — UI API record-ui endpoint hard-limits recordIds to 50 (Salesforce accepts >50)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#43 — Dashboard results endpoint returns wrong wire format (missing componentData array + wrapper)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#45 — Missing GET /actions/custom discovery endpoint (breaks Flow action discovery)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#46 — SObject DELETE invalid ID returns wrong HTTP status/errorCode
- [ ] #TBD — legacy MetaDrivenPlatform4AI#47 — [API] UI API apps endpoint requires formFactor and response shape differs
- [ ] #TBD — legacy MetaDrivenPlatform4AI#48 — [API] Analytics dashboards endpoint returns envelope instead of array and missing URL fields
- [ ] #TBD — legacy MetaDrivenPlatform4AI#49 — Tooling Flow create endpoint too permissive - accepts empty payload (Salesforce requires Metadata)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#50 — Missing listviews/:listViewId/results endpoint (resultsUrl advertised but not implemented)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#51 — NexusCRM missing `GET /services/data/v63.0/actions`
- [ ] #TBD — legacy MetaDrivenPlatform4AI#53 — Tooling ValidationRule sObject endpoint missing (frontend expects it)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#54 — PATCH /analytics/dashboards/:dashboardId differs in no-op behavior and response shape
- [ ] #TBD — legacy MetaDrivenPlatform4AI#55 — Missing Tooling Endpoint for ProfileLayout POST
- [ ] #TBD — legacy MetaDrivenPlatform4AI#56 — search/scopeOrder returns different default behavior (Salesforce returns [])
- [ ] #TBD — legacy MetaDrivenPlatform4AI#57 — [API] Folder children response fields and pagination semantics differ
- [ ] #TBD — legacy MetaDrivenPlatform4AI#58 — `GET /analytics/reports/:reportId/describe` error handling likely returns non-Salesforce 500/object instead of Salesforce 404 array
- [ ] #TBD — legacy MetaDrivenPlatform4AI#59 — Query pagination `nextRecordsUrl` locator format incompatible with Salesforce
- [ ] #TBD — legacy MetaDrivenPlatform4AI#60 — `GET /sobjects/:sobject/listviews` returns synthetic IDs instead of Salesforce list view IDs
- [ ] #TBD — legacy MetaDrivenPlatform4AI#61 — Folders shares API request/response schema mismatches Salesforce
- [ ] #TBD — legacy MetaDrivenPlatform4AI#63 — Quick Action Describe endpoint is unimplemented (returns 404)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#64 — Tooling `GET /tooling/sobjects/Flow/:id` response missing many Salesforce fields (and `attributes`)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#65 — Missing Actions Index Endpoint (`GET /services/data/v63.0/actions`)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#66 — NexusCRM missing `POST /tooling/sobjects/ProfileLayout` (Salesforce returns 400 error response)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#67 — Analytics Report Describe Response Missing Required Envelopes
- [ ] #TBD — legacy MetaDrivenPlatform4AI#68 — [API] External-ID GET returns wrong status/error code for invalid field
- [ ] #TBD — legacy MetaDrivenPlatform4AI#69 — UI API Clone Defaults Response Shape Mismatch
- [ ] #TBD — legacy MetaDrivenPlatform4AI#70 — Missing Tooling query endpoint (GET /tooling/query)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#71 — sObject ListViews Return Synthetic IDs and Limited View Set
- [ ] #TBD — legacy MetaDrivenPlatform4AI#73 — Folder Shares Response Format Mismatch (`POST /folders/:id/shares`)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#74 — Tooling Flow GET Missing Salesforce Fields and Types
- [ ] #TBD — legacy MetaDrivenPlatform4AI#75 — sobjects/relevantItems response format mismatch (Salesforce groups by object)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#76 — Analytics PATCH /reports/:reportId returns 400 for invalid reportId (Salesforce returns 404)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#77 — [API] UI API layout endpoint only accepts objectApiName; not layoutId
- [ ] #TBD — legacy MetaDrivenPlatform4AI#78 — QuickActions response missing `urls` and wrong `actionEnumOrId`
- [ ] #TBD — legacy MetaDrivenPlatform4AI#79 — Folder share delete should be idempotent (Salesforce returns 204 even when missing)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#80 — `GET /actions` missing in NexusCRM (Salesforce returns discovery URLs)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#81 — Analytics report describe response missing Salesforce top-level fields
- [ ] #TBD — legacy MetaDrivenPlatform4AI#82 — UI API clone record-defaults response shape does not match Salesforce
- [ ] #TBD — legacy MetaDrivenPlatform4AI#83 — Limits API response incomplete and diverges from Salesforce key naming
- [ ] #TBD — legacy MetaDrivenPlatform4AI#84 — Dashboard create returns non-Salesforce error payload
- [ ] #TBD — legacy MetaDrivenPlatform4AI#85 — UI API record-defaults/create response schema mismatch
- [ ] #TBD — legacy MetaDrivenPlatform4AI#86 — [API] QuickAction execution endpoint not implemented
- [ ] #TBD — legacy MetaDrivenPlatform4AI#87 — Bulk ingest job creation returns different HTTP status and omits `contentUrl`
- [ ] #TBD — legacy MetaDrivenPlatform4AI#90 — Analytics reports list response envelope mismatch (returns object instead of array)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#91 — Composite delete missing `ids` parameter returns wrong errorCode (INVALID_REQUEST vs REQUIRED_FIELD_MISSING)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#93 — Streaming subscribe does not validate channels (accepts invalid subscriptions)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#94 — Missing UI API endpoint: GET /ui-api/nav-items
- [ ] #TBD — legacy MetaDrivenPlatform4AI#95 — Tooling Flow GET by id omits many Salesforce fields (and `attributes`)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#97 — [Salesforce Compat] Missing `GET /actions` endpoint (Actions discovery)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#98 — [Salesforce API] Query API missing `q` parameter uses incorrect errorCode
- [ ] #TBD — legacy MetaDrivenPlatform4AI#102 — Metadata deployRequest expects multipart upload but Salesforce requires validatedDeployRequestId
- [ ] #TBD — legacy MetaDrivenPlatform4AI#103 — Connect user files endpoint missing in backend
- [ ] #TBD — legacy MetaDrivenPlatform4AI#104 — [Salesforce Compat] `GET /query` missing `q` returns different errorCode/message
- [ ] #TBD — legacy MetaDrivenPlatform4AI#105 — [Salesforce Compat] UI API clone defaults response schema does not match Salesforce
- [ ] #TBD — legacy MetaDrivenPlatform4AI#111 — [Salesforce Compat] Global error middleware returns non-Salesforce error envelope (object vs array)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#115 — [Salesforce Compat] Missing `DELETE /recyclebin/:id` (purge) endpoint
- [ ] #TBD — legacy MetaDrivenPlatform4AI#116 — [API] GET /sobjects/:sobject/:id injects non-Salesforce *_Name fields and hard-codes v63.0 in attributes.url
- [ ] #TBD — legacy MetaDrivenPlatform4AI#117 — Streaming CometD connect response missing Salesforce fields
- [ ] #TBD — legacy MetaDrivenPlatform4AI#120 — /ws endpoint diverges from Salesforce Streaming API (Salesforce returns 404 HTML)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#124 — Missing Chatter current user endpoint (GET /chatter/users/me)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#125 — `/services/data/v63.0/event` advertised but not implemented
- [ ] #TBD — legacy MetaDrivenPlatform4AI#129 — [API] Chatter followers endpoint missing
- [ ] #TBD — legacy MetaDrivenPlatform4AI#130 — [API] GET /parameterizedSearch returns extra Name field even when fields parameter is omitted
- [ ] #TBD — legacy MetaDrivenPlatform4AI#131 — SObject describe endpoint missing Salesforce fields (deepCloneable; sobjectDescribeOption)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#132 — [API] Missing Chatter API endpoint GET /chatter/users/:userId/following (advertised but not implemented)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#135 — Incorrect field type mapping for Currency fields
- [ ] #TBD — legacy MetaDrivenPlatform4AI#136 — [P1] Upsert-by-external-ID accepts any field and uses read-then-write pattern
- [ ] #TBD — legacy MetaDrivenPlatform4AI#137 — Record IDs are UUIDs while API advertises Salesforce keyPrefix semantics
- [ ] #TBD — legacy MetaDrivenPlatform4AI#138 — Missing picklist field validation in sObject describe
- [ ] #TBD — legacy MetaDrivenPlatform4AI#139 — Required field validation missing for Create operations
- [ ] #TBD — legacy MetaDrivenPlatform4AI#142 — Permission errors return wrong HTTP status codes (500/400 instead of 401/403)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#143 — Describe response has type/nullability mismatches (keyPrefix; listviewable; lookupLayoutable)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#144 — Missing input validation allows SQL injection in query endpoint
- [ ] #TBD — legacy MetaDrivenPlatform4AI#145 — HTTP status codes don't match Salesforce API specification
- [ ] #TBD — legacy MetaDrivenPlatform4AI#146 — P1 Data Integrity: Required field validation missing for Contact.LastName
- [ ] #TBD — legacy MetaDrivenPlatform4AI#147 — P2 Response Format: Describe endpoint missing 'deepCloneable' and 'sobjectDescribeOption' fields
- [ ] #TBD — legacy MetaDrivenPlatform4AI#149 — returns empty list when unauthenticated (`backend/internal...
- [ ] #TBD — legacy MetaDrivenPlatform4AI#150 — UUID ids are generated but Describe advertises Salesforce id/reference length + ...
- [ ] #TBD — legacy MetaDrivenPlatform4AI#151 — global describe omits key entries Salesforce provides; eviden...
- [ ] #TBD — legacy MetaDrivenPlatform4AI#152 — advertises endpoints that aren’t implemente...
- [ ] #TBD — legacy MetaDrivenPlatform4AI#155 — accepts arbitrary and trus...
- [ ] #TBD — legacy MetaDrivenPlatform4AI#156 — SOQL // break because SQL walker doesn’t support unary/array ...
- [ ] #TBD — legacy MetaDrivenPlatform4AI#157 — field list ignored; backend always selects “visibleFields” (`backend/in...
- [ ] #TBD — legacy MetaDrivenPlatform4AI#158 — returns instead of a JSON array (`backend/int...
- [ ] #TBD — legacy MetaDrivenPlatform4AI#159 — pagination emits next URL (`backend/internal/interfaces/...
- [ ] #TBD — legacy MetaDrivenPlatform4AI#160 — returns as and omits key...
- [ ] #TBD — legacy MetaDrivenPlatform4AI#161 — ignores and never 404s invalid ...
- [ ] #TBD — legacy MetaDrivenPlatform4AI#162 — Describe builds relationships by scanning all schemas/fields per request (`backe...
- [ ] #TBD — legacy MetaDrivenPlatform4AI#164 — Backend server build fails (`registerRoutes` missing)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#165 — Hardcoded “test” Connected App seeded in production startup enables credential reuse
- [ ] #TBD — legacy MetaDrivenPlatform4AI#166 — Default test Connected App enables remote System Admin access via `client_credentials`
- [ ] #TBD — legacy MetaDrivenPlatform4AI#167 — Default System Administrator seeded with known credentials on every startup
- [ ] #TBD — legacy MetaDrivenPlatform4AI#171 — `PersistenceService.Insert` skips required-field validation + validation rules + uniqueness checks
- [ ] #TBD — legacy MetaDrivenPlatform4AI#172 — External-ID upsert accepts arbitrary fields; `LIMIT 1` update can corrupt data (non-deterministic record selection)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#174 — Record retrieval leaks related-record names via permission-bypassing lookup hydration
- [ ] #TBD — legacy MetaDrivenPlatform4AI#176 — Upsert-by-external-id can corrupt data (accepts arbitrary fields + non-atomic read-then-write)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#178 — Hard-coded default JWT secret enables token forgery in misconfigured deployments
- [ ] #TBD — legacy MetaDrivenPlatform4AI#180 — Aggregate SELECT aliases are ignored and multiple aggregate functions are rejected
- [ ] #TBD — legacy MetaDrivenPlatform4AI#184 — PATCH can silently no-op when only read-only / non-editable fields are provided
- [ ] #TBD — legacy MetaDrivenPlatform4AI#192 — Bulk Query API ignores `operation=queryAll` and does not match Bulk v2 wire format (CSV/locator)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#202 — Query error responses use incorrect Salesforce error codes/status (missing `q`; permission/object errors)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#203 — Hard-coded API version in query record `attributes.url` breaks versioned endpoints
- [ ] #TBD — legacy MetaDrivenPlatform4AI#204 — `describe` response includes `null` for fields Salesforce expects to be boolean
- [ ] #TBD — legacy MetaDrivenPlatform4AI#207 — API version parameter ignored in embedded URLs (hard-coded `v63.0`)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#208 — Field `createable` in `describe` is computed using editability (breaks create-only profiles)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#209 — Describe `externalId`/`idLookup` flags incorrectly derived from `unique`
- [ ] #TBD — legacy MetaDrivenPlatform4AI#210 — `GET /sobjects/{sObject}/{id}` ignores the `fields` query parameter
- [ ] #TBD — legacy MetaDrivenPlatform4AI#222 — REST API compatibility
- [ ] #TBD — legacy MetaDrivenPlatform4AI#223 — UI API compatibility
- [ ] #TBD — legacy MetaDrivenPlatform4AI#229 — chore: audit all hardcoded table names — enforce constants usage
- [ ] #TBD — legacy MetaDrivenPlatform4AI#233 — Salesforce-compatible metadata API migration is incomplete and leaves frontend/backend contract drift
- [ ] #TBD — legacy MetaDrivenPlatform4AI#234 — Salesforce compatibility tracking
- [ ] #TBD — legacy MetaDrivenPlatform4AI#236 — fix: N+1 query in hydrateLookups — batch lookup field resolution
- [ ] #TBD — legacy MetaDrivenPlatform4AI#238 — sec: fix 4 high-severity npm vulnerabilities in frontend
- [ ] #TBD — legacy MetaDrivenPlatform4AI#239 — ci: add frontend tests to CI pipeline
- [ ] #TBD — legacy MetaDrivenPlatform4AI#335 — Metadata API compatibility
- [ ] #TBD — legacy MetaDrivenPlatform4AI#337 — Bulk API V2 compatibility
- [ ] #TBD — legacy MetaDrivenPlatform4AI#339 — Connect API compatibility
- [ ] #TBD — legacy MetaDrivenPlatform4AI#340 — Streaming API compatibility
- [ ] #TBD — legacy MetaDrivenPlatform4AI#349 — Salesforce A/B contract test: 8 backend incompatibilities found
- [ ] #TBD — legacy MetaDrivenPlatform4AI#350 — Confirmed issues: business logic; data integrity; and UI stability gaps from manual testing
- [ ] #TBD — legacy MetaDrivenPlatform4AI#351 — fix(formula): validation rule engine missing NOT(); ISCHANGED(); and user context variables
- [ ] #TBD — legacy MetaDrivenPlatform4AI#352 — feat(flow): support $GlobalConstant.True/False in Flow Builder assignment nodes
- [ ] #TBD — legacy MetaDrivenPlatform4AI#353 — fix(import): Approval Process Approver User IDs not cross-reference resolved during import
- [ ] #TBD — legacy MetaDrivenPlatform4AI#355 — fix(metadata): object count mismatch and field labels reset to API Names after data refresh
- [ ] #TBD — legacy MetaDrivenPlatform4AI#357 — perf: session initialization extremely slow — User >2min; Accounts/Opportunity >1min
- [ ] #TBD — legacy MetaDrivenPlatform4AI#358 — feat(auth): support creating role-based test accounts (Sales role) for validation/flow testing
- [ ] #TBD — legacy MetaDrivenPlatform4AI#364 — fix(flow): Flow Builder does not render Assignment nodes created via API
- [ ] #TBD — legacy MetaDrivenPlatform4AI#365 — fix(frontend): crypto.randomUUID() fails on non-HTTPS deployments; breaking multiple pages
- [ ] #TBD — legacy MetaDrivenPlatform4AI#593 — Remove default "All Records" option from list view selector
- [ ] #TBD — legacy MetaDrivenPlatform4AI#618 — Local multi-instance dev is blocked by hard-coded localhost origin allowlists
- [ ] #TBD — legacy MetaDrivenPlatform4AI#639 — design: define virtual related list metadata contract and action resolution
- [ ] #TBD — legacy MetaDrivenPlatform4AI#679 — Hardcoded __c custom field/object names in source code violate metadata-driven architecture
- [ ] #TBD — legacy MetaDrivenPlatform4AI#696 — UX/Perf: Related List Quick Links scroll position drifts after content loads; 12 separate count API calls on account page load
- [ ] #TBD — legacy MetaDrivenPlatform4AI#698 — design: API Access Control — Connected App scope enforcement + per-app integration user
- [ ] #TBD — legacy MetaDrivenPlatform4AI#750 — Connected App delete broken — generic CRUD assumes all tables have IsDeleted
- [ ] #TBD — legacy MetaDrivenPlatform4AI#752 — Permission Editor: architectural gaps between Object Permissions and System Permissions tabs
- [ ] #TBD — legacy MetaDrivenPlatform4AI#766 — refactor: unify system permission storage to single SSoT (_System_PermissionSetPermission)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#769 — feat: Permission Editor — show all 63 system permissions from catalog table
- [ ] #TBD — legacy MetaDrivenPlatform4AI#809 — Remove inline Subtotal and Record Count rows from report view and edit view
- [ ] #TBD — legacy MetaDrivenPlatform4AI#819 — Private/personal reports from Salesforce not visible in Reports list
- [ ] #TBD — legacy MetaDrivenPlatform4AI#904 — fix: before-save Flow bypasses NormalizeSObject and Validation — systemic pipeline ordering flaw
- [ ] #TBD — legacy MetaDrivenPlatform4AI#905 — chore: remove dead code — ~80 unused symbols across ~30 files
- [ ] #TBD — legacy MetaDrivenPlatform4AI#911 — Bad Smell: Hardcoded default credential 'Admin123!' across 6 locations
- [ ] #TBD — legacy MetaDrivenPlatform4AI#914 — Bad Smell: Schema Bootstrap Monolith (2;042 LOC) with swallowed errors and deep nesting
- [ ] #TBD — legacy MetaDrivenPlatform4AI#915 — Bad Smell: Inconsistent Error Handling & Mixed Logging Strategies
- [ ] #TBD — legacy MetaDrivenPlatform4AI#916 — Bad Smell: Post-construction wiring hack breaks type safety in PersistenceService
- [ ] #TBD — legacy MetaDrivenPlatform4AI#917 — Bad Smell: Duplicated Hardcoded Column Alias Maps (SSoT Violation)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#918 — Bad Smell: ReportService silently drops query filters and columns on error
- [ ] #TBD — legacy MetaDrivenPlatform4AI#919 — Bad Smell: Hardcoded Default Admin Password 'Admin123!' in 9 Locations
- [ ] #TBD — legacy MetaDrivenPlatform4AI#920 — Bad Smell: God Components in Frontend (3 files; 2;429 LOC)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#921 — Bad Smell: Inconsistent Port Defaults & Root-Level File Clutter
- [ ] #TBD — legacy MetaDrivenPlatform4AI#922 — Bad Smell: Duplicated Auth Boilerplate Across 37 REST Handler Files (130 Occurrences)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#924 — Bad Smell: Frontend Components Bypass API Service Layer with Inline SOQL Queries
- [ ] #TBD — legacy MetaDrivenPlatform4AI#925 — Bad Smell: Hardcoded Approval Status Strings — Fragile State Machine
- [ ] #TBD — legacy MetaDrivenPlatform4AI#955 — Bad Smell: Inline SOQL with wrong escape pattern in ApprovalProcessDetailPage
- [ ] #TBD — legacy MetaDrivenPlatform4AI#984 — Bad Smell: Duplicated type-extraction helpers — local closures reimplementing pkg/utils.GetSObjectString
- [ ] #TBD — legacy MetaDrivenPlatform4AI#987 — Bad Smell: Two parallel E2E test runners with duplicated orchestration logic (841 LOC)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1028 — E2E API Tests fail: QuoteLineItem and OrderItem not registered as metadata objects
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1070 — [identifier-engine] Unbounded {SEQ:N} width is an OOM vector via metadata
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1084 — Backend cold-start DDL race: two ECS tasks stomp on each other when lockConn times out mid-DDL
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1100 — records: isGuardFieldTruthy should warn on unexpected types (drift detection)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1101 — persistence: composite/bulk delete skips CleanupProfilePermissionSet for Profile
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1103 — codegen: verify-generated check should include z_generated_protected.go
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1104 — codegen: validate protectedRecords guard_field exists + policy whitelist
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1105 — api: preserve protectedRecords errorCode in REST response (not just message)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1120 — flow: audit REST/scheduled callers that may now persist via implicit-$Record default
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1121 — flow: executor_record_ops takes in-place branch unconditionally when update.Object == ""; even in AfterSave
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1122 — flow: RecordBeforeDelete sets WithBeforeSaveFlow — recordUpdate on $Record silently discarded when delete proceeds
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1123 — flow: $Flow.CurrentDateTime not resolved in PoC_Start_Date_Create recordUpdate
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1124 — flow: Lead BeforeSave flow filterExpr uses 'AND(' with no space — expression parser fails; blocks Lead creation
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1212 — parseLockedUntil fails open on unparseable LockedUntil — silent; no log
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1379 — [List View] Filter value input missing for Created Date and Last Modified Date fields
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1398 — design: API Access Control — Connected App scope enforcement + per-app integration user
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1404 — Audit CI Test Suite Reliability and Remove Flaky Tests
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1459 — Migrate Contract.Archived_Contract__c from legacy Salesforce HTML href to linked File
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1528 — test
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1544 — Dashboard email subscription and scheduling not implemented
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1546 — Task detail page not accessible — clicking activity timeline entry does not open full Task record
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1548 — Global Search takes >30s and lacks object-scoped search filter
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1631 — [cutover] Production prerequisites for PR #1612 — required actions before enabling tenant-pack carve-out
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1632 — [verify] V8 autonumber invariant is over-strict for orgs without full managed-package footprint
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1636 — [RFC] Lead Convert v2 — Simplify by decoupling Account creation
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1642 — flow-formula: tighten __Record.<Rel>. regex scan to pre-literal-restore form
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1643 — flow-formula: add non-tagged integration test for buildFormulaFetcher → loadRelatedRecord chain
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1645 — [tech-debt] Post-review cleanups from PR #1612 gate review round 2
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1658 — Order-object AfterSave flows are systematically skipped by flow dispatcher
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1660 — Move autonumber seed live-data scan off backend startup hot path
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1671 — [follow-up] Autonumber V8 invariant: distinguish required vs optional seeds (PR #1612 cutover #1631)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1675 — Record Detail inline edit: formula fields not refreshed after save
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1676 — [follow-up] Decide fate of 2 legacy 2024 Contract.Name rows — #1631 FU-2
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1679 — outbox: tighten outboxNoSubscriberObjects filter to event-type granularity
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1680 — executor: recordUpdate stores literal element-reference name instead of resolved formula value
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1683 — fix(records): multi-picklist serialization asymmetry causes infinite self-update loop in record-triggered flows
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1686 — validate: reject ';' in multi-picklist option values (SF wire-format constraint)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1694 — flow: Lead_Convert_Validation_rules writes to non-existent Lead.LeadValidation__c field
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1695 — validate: thread FieldMetadata option validation into persistence layer (covers _System_Field CRUD + BatchSaveFieldMetadata)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1705 — fix(records): areValuesEqual mis-compares []byte vs string (residual always-dirty fields after #1684)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1708 — Contract.Name: 2 rows with invalid 'YY-MM-DD-NN' format from 2026-04-19 — investigate source path
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1715 — Refactor curated page layout installers into a shared metadata-driven path
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1718 — convertLead ForecastCategory fallback: edge cases from PR #1711 review
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1719 — Validation rules: cross-object resolution; errorDisplayField; and metadata gaps vs SFDC parity
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1721 — hubspot-cm-extension: metrics + alerts for SUCCESS-at-enqueue worker gap
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1722 — hubspot-cm-extension: rate-limit + audit log on options endpoint
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1723 — hubspot-api: migrate Custom Workflow Action registration from hapikey to private-app PAT
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1724 — hubspot-cm-extension: production portal (36601034) deployment
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1725 — hubspot-cm-extension: action-definition single-writer coordination ritual
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1726 — hubspot-cm-extension: cleanup Phase 0b + Phase 1h-4 sandbox test actions
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1727 — hubspot-cm-extension: per-endpoint HMAC client_secret config (HUBSPOT_ACTION_CLIENT_SECRET)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1728 — #1582 v1.6-C-3 — clean up residual Source / IsCompound / ComposedFrom plumbing
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1730 — ci(deploy): ECS waiter + auto-revert double-fault on slow backend cold-start
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1731 — perf(bootstrap): instrument the two silent gaps dominating backend cold start (~6.5 min of 8.6 min)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1736 — perf(bootstrap): BackfillContentCompatSystemFiles runs 23K-iteration N+1 every startup (~2 min)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1739 — hubspot-cm-extension: harden redactSecrets to scrub all occurrences + preserve diagnostic tail
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1767 — [Ops] Drop residual _System_Field.Source / IsCompound / ComposedFrom columns (#1728 C-3c)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1785 — Control Plane Refactor: Replace direct-SQL tenant overlay with metadata-bundle + installer CLI
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1812 — fix(flow): investigate true root cause of #1788 / #1789 (Event + PoC__c AfterSave flows not dispatching)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1816 — investigate: summary of 18 Flow runnability analysis (3 RUNNABLE / 3 PARTIAL / 8 BLOCKED / 4 UNKNOWN)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1820 — [SOQL] Parser rejects Owner.Name (relationship path) in aggregate SELECT / GROUP BY
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1829 — Opportunity Clone fails with 'invalid URL format' on URL fields without http/https prefix
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1835 — Apply for PoC: Opportunity lookup not auto-populated from URL query params
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1836 — Apply for PoC: Owner defaults to Opportunity Owner instead of current user
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1847 — Move Quote-to-Order line-item cloning out of generic persistence engine
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1848 — Move Lead status timestamp logic out of generic persistence update path
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1851 — Order-from-Quote gate hardcodes tenant __c fields + status literals + RecordType across backend AND frontend
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1854 — Standard action satellites should reconcile against the persisted parent action Id
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1855 — Flow-native convertLead lost the old best-effort handling for invalid mapped field values
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1856 — convertLead still advertises optional opportunityName; but the server-side fallback was narrowed
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1857 — Order page — Upload Archived OF button has no response after selecting file and clicking Upload
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1858 — Order page — Upload Archived OF button has no response after selecting file and clicking Upload
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1870 — Approval submit fails: ServiceContext doesn't bypass CRUD on ProcessInstance tables
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1871 — Account RecordTypeId not persistable: createable=false; updateable=false
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1881 — Flow version INSERT omits MasterLabel column; landing NULL in DB
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1882 — TOCTOU: ActivateFlowVersion / DeactivateFlowVersion / DeleteFlowVersion read version outside tx
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1883 — Flow.Source constants duplicated across three packages (risk of drift)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1890 — Follow-up: fix stale ChildCloneRule comment after workflow.childCopy runtime retirement
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1895 — FlowDefinition PATCH surface exposes ActiveVersionId / LatestVersionId; bypassing activation path
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1896 — PatchFlowDefinition / UpdateFlowDefinition return 204 on tombstoned rows instead of 404
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1897 — Add regression tests: DELETE-then-PATCH tombstone invariant; empty PATCH body; unknown fields
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1898 — PageLayout / ApprovalPageLayout admin Save silently un-tombstones soft-deleted rows (same bug class as #1852)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1899 — Silent-no-op mocks hide regressions: MarkLayoutCustomized; CleanupProfilePermissionSet; WithTransaction; etc.
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1900 — toolingOnlyTables whitelist has only 2 entries — 20+ _System_* tables with specialized services are ungated
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1901 — _System_AutoNumberCounter has no write protection — corrupted sequences possible via generic CRUD
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1917 — PR #1850 follow-up: V2 audit head row not observed with Entrypoint=REST_API during staging canary (needs re-verification)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1918 — reconcileNullability's MODIFY COLUMN silently drops DEFAULT / COLLATE / CHARSET / COMMENT / ON UPDATE
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1931 — buildRelaxNullabilityDDL: handle generated/expression/numeric DEFAULT and virtual columns
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1932 — e2e-api CON-005: add AUDIT_V2_ENABLED env-gate skip and deterministic head-row assertion
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1970 — Implicit-CRUD child-object parity — metadata-driven redesign (replaces #1966)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1982 — [SF-parity] Boolean SOQL: NexusCRM treats '= false' and '= null' as disjoint; real SF treats them as overlapping — silent data loss risk on Boolean fields with NULL rows
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2019 — Move quote_product__c out of standard_objects_spec.json (tenant quarantine violation)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2022 — Tenant identifier 'IQM' leaked into platform binary at discover_tables.go:804 (#1894 follow-up)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2025 — Declare Task as standard SObject in standard_objects_spec.json (follow-up to #1993 / #2022)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2029 — [Architecture] Add tenant-owned object apply path so quote_product__c can leave standard_objects_spec.json
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2049 — Investigate bulk insert Label duplicate failures from runtime-derived values
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2060 — fix(records): formula compute should run BEFORE validation + audit emission (#2053 followup)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2061 — fix(metadata): reconcile FieldMetadata.FormulaMode contract comment vs live data semantics (#2053 followup)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2067 — refactor(formula): consolidate records/buildRecordFetcher and automation/buildFormulaFetcher into shared helper (R10)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2068 — fix(records): formula compute should re-run after BeforeSave triggers (#2057 R2 codex F1 PARTIAL)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2070 — controlplane/packs: opportunity_page_layout.json ships PingCAP/TiDB sales-methodology fields in default binary
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2071 — platform-binary-cleanliness: CI gate has structural blind spots — pattern asymmetry and no binary strings scan
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2072 — auth: SuperUser/admin checks use ProfileId string match instead of metadata-driven permission keys
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2073 — metadata: virtual_relationships.go and related_list_defaults.go hardcode tenant __c objects in L0
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2074 — records & automation: generic engines branch on SObject name + status literals (Order/Activated; Approval/Approved-Rejected)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2080 — Architecture rescue plan v5: explicit preconditions for permission; related-list; and Order Activate cutovers
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2085 — Analytics shape-fact audit: SFColumnToField; sfReportTypeToObject; related shape registries in features/analytics
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2108 — [Layout] Opportunity record name truncated/hidden by action buttons on detail page
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2118 — bug: tenant overlay flow versions are seeded as standard-source
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2126 — Autonumber unresolved-token returns HTTP 500 with opaque message; should be 4xx with actionable detail
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2128 — REGRESSION  Lead Convert API rejects every convertedStatus value — 'is not an active option tagged converted on Lead.Status'
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2130 — Convert Lead modal surfaces internal engine element names in error toast (FailAlreadyConverted / FailContactAccountMismatch)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2131 — Convert button remains enabled on already-converted Lead — should be hidden/disabled when IsConverted=true
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2134 — Convert Lead modal lacks client-side cross-Account contact validation — mismatch only surfaces after submit
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2136 — Already-converted Lead detail missing CONVERTED banner; Account/Contact/Opportunity nav links; and Edit/ChangeOwner/Submit buttons not disabled
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2145 — refactor(packspec): move business custom fields out of standard spec
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2146 — refactor(packs): split standard packs from business overlays
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2148 — refactor(metadata): move business related-list defaults to private overlay
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2150 — refactor(frontend): move business gating out of generic pages
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2151 — refactor(rest): remove business-facing assumptions from generic handlers
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2152 — refactor(frontend): clean app contexts for extraction readiness
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2154 — Lead Convert modal missing Campaign attribution preview/warning
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2158 — Convert Modal: Account search does not pre-fill default query from Lead.Company
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2170 — Convert Modal: Title and Email requiredness
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2196 — Weekly Update save fails with 400: Task Type "Weekly Update" not a valid picklist option
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2236 — Move tenant-specific PingCAP metadata out of public core into installable tenant packs
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2248 — Convert Lead reuse-Account path requires Account UPDATE permission — blocks SDR/AE collaboration; diverges from Salesforce parity
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2251 — DX: log.Printf from backend/internal/features/automation/ is silently dropped by zerolog intercept
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2252 — test-infra: /tmp/2220-evidence/*.py reproducers race AfterSave outbox worker with fixed time.sleep(2)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2261 — PingCAP Lead Status: add 'converted' tag to 'Open Opportunity' so AEs can convert into Open Opportunity terminal state
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2263 — permissions: persistence_service.buildUserContext duplicates flow's user formula scope (R10)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2283 — Sales Ops profile Lead object permissions diverge across Salesforce; staging; and production
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2285 — bug(contract): Upload Archived Contr. fails with HTTP 403 — contract status does not transition to Effective
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2292 — [Atomic-cutover required for #1792 S2] Soft-delete uniqueness — app-level + storage-layer SF parity
- [ ] #TBD — legacy MetaDrivenPlatform4AI#2310 — [Ops Portal] Tenant-overlay cutover gates for PR #1947

## Non-goals

- Re-port legacy fixes that are no longer relevant under the new project's
  pure-platform design — engineering identifies these case-by-case
- Layer-belonging classification (L0 / L1 / L2) — engineering's job

## History

- 2026-05-03 — created during Phase 2 from clustered orphan issues.

## Stories (filed in Phase 3)

_Pending Phase 3 synthesis._