chore: raise the `@objectstack/spec` pin from `^17.0.0-rc.6` to 17.0.0 GA (lockfile resolution + green-keeping adaptations)

[yinlianghui]

Filed by the repo:objectui seat (session session_01RnQd8iMMUwXQEV1crFmQiQ, round 1, 2026-08-14), acting on the handoff record #4635's first-check item.

Blocked-by: #4910
Blocked-by: #4911

(Blocker history — #4648 exhausted 2026-08-17: PR #4901 merged 03:05Z. The 2026-08-17 re-point round (PR #4639 @ 47c7cc3, takeover claim by session session_01DbRmJD3iPhXjKr6vhd4Qkv) then met the lockfile criterion in full and cut the farm red from 9 files / 17 tests to 3 / 3 — every remaining red owned by the two cards above (#4910 owns two, #4911 owns one); see the os-dev report and PM disposition comments of 2026-08-17. Earlier: Blocked-by lines for #4649 and #4650 removed 2026-08-14 ~16:35Z — both adaptation PRs MERGED (#4657, #4660). Sequencing ruled 2026-08-14, option A of the dev report on this card: the bump PR #4639 stays a parked draft until its expected-red list is empty, then flips; gate-weakening option C is rejected.)

Context

@objectstack/spec@17.0.0 (GA) is published on npm (dist-tags.latest = 17.0.0; the former rc tag stops at 17.0.0-rc.6). objectui's package.json ranges say ^17.0.0-rc.6, and the criterion that matters is the lockfile-resolved version (established on the old tracking card #3374: the ^ range is not the pin).

Re-check commands:

• git grep -h '"@objectstack/spec"' origin/main -- '**/package.json' | sort -u
• grep -A1 '@objectstack/spec' pnpm-lock.yaml | head (resolved version)
• npm view @objectstack/spec dist-tags --json

The work

1. Raise the pin so the lockfile resolves @objectstack/spec@17.0.0 everywhere in the workspace (all package.json occurrences + pnpm-lock.yaml). Done in PR chore(deps): raise the @objectstack/* pin from ^17.0.0-rc.6 to 17.0.0 GA #4639 (with client/formula/lint raised too — their exact pins otherwise nest a second rc.6 spec copy; measured in that PR). Re-pointed onto post-adaptation main 2026-08-17 (47c7cc3): all 30 importers resolve 17.0.0, single physical copy, zero rc.6 strings in the lockfile.
2. Run the full regression; adaptations beyond green-keeping were split out: Unwind the objectstack#7176 striped/bordered/virtualScroll forwarding chain (types → react spec-bridge → plugin-list → plugin-view → app-shell) + drop ObjectGrid.component.yml's retired declarations #4649 (retirement unwind, MERGED as PR refactor: unwind the retired striped/bordered/virtualScroll list-view surface (objectstack#7176) #4657), Resolve the spec-named symbol collisions with 17.0.0 GA exports (check:spec-symbols): SECRET_MASK + ObjectCalendarProps/ObjectFormProps/ObjectGridProps/ObjectKanbanProps + one more #4650 (symbol collisions, MERGED as PR fix(plugins,app-shell): resolve the six spec-named symbol collisions with 17.0.0 GA #4660), [Decision] spec 17.0.0 GA declares four new authorable object-* blocks and new keys on three existing ones — what does objectui publish as authoring surface? #4648 (authoring-surface ruling, CLOSED via PR feat(plugins): publish the four GA object-* blocks' authoring surfaces (#4648) #4901), spec 17.0.0 GA made the element props schemas strict — two spec-parity tests still encode rc.6 strip-mode as their control #4910 (GA strict-mode parity probes, open), FilterConditionField cannot author spec 17.0.0 GA's new $like / $ilike — the same shape as the closed $icontains gap (#4023) #4911 ($like/$ilike builder reachability, open — decision box).

Known unlocks gated on this bump (do NOT do them in this PR)

• console: FormPage's post-submit redirect uses the authored URL verbatim — undecided whether it is a console route or an arbitrary destination #4190 and Reconcile exportOptions with the spec's new object form (#8010 spec half): false alignment comment, local 'pdf', and the as any streaming read #4535 (item 4) — both hold on "the spec pin covers objectstack#7657's schema change"; their restart conditions are written on each card.
• objectstack#7100 — already unblocked (retirement present in rc.6; measured in PR chore(deps): raise the @objectstack/* pin from ^17.0.0-rc.6 to 17.0.0 GA #4639); dispatched independently.
• objectstack#6275 — final pin-bump batch anchor.
• [tracking] 抬 spec pin 至 rc.4+(发布后):联动适配清单 —— 等 rc.4 的单都挂这里 #3374 — the stale rc.4-era tracking umbrella; the seat will disposition it separately after this lands.

Acceptance

• Lockfile resolves 17.0.0 (evidence in PR chore(deps): raise the @objectstack/* pin from ^17.0.0-rc.6 to 17.0.0 GA #4639's body). ✅ met at 47c7cc3
• Full farm green; every adaptation included is named in the PR body with its trigger. ⏳ 3 tests red, owned by spec 17.0.0 GA made the element props schemas strict — two spec-parity tests still encode rc.6 strip-mode as their control #4910 / FilterConditionField cannot author spec 17.0.0 GA's new $like / $ilike — the same shape as the closed $icontains gap (#4023) #4911

[yinlianghui]

Claim: PM loop round 1
Session: session_01RnQd8iMMUwXQEV1crFmQiQ
Branch: claude/issue-4636-spec-pin-ga
Worktree: objectui-issue-4636
Domain: repo:objectui
File surface: workspace package.json files (the @objectstack/spec range lines only) + pnpm-lock.yaml + minimal green-keeping adaptations wherever the rc.6→GA delta forces them (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus
Serial constraints cleared: in-flight #8500 declares packages/app-shell/src/views/, #8096 declares packages/app-shell/src/layout/ + src/console/organizations/, #4633 declares scripts/regenerate-catalog-index.py + examples/schema-catalog/src/index.ts — if a green-keeping adaptation lands inside ANY of those declared regions, stop and report instead of editing (serial with the in-flight card). Lockfile is exclusive to this card this batch (no other in-flight card changes dependencies).

---

Generated by Claude Code

[yinlianghui]

{
  "issue": 4636,
  "status": "needs_decision",
  "branch": "claude/issue-4636-spec-pin-ga",
  "pr": "https://github.com/objectstack-ai/objectui/pull/4639",
  "premise_still_valid": true,
  "summary": "Premise verified and the bump landed: npm dist-tags.latest = 17.0.0 (rc stops at 17.0.0-rc.6) and main's lockfile did resolve rc.6. Raised the range on all 32 package.json occurrences; the lockfile now resolves @objectstack/spec@17.0.0 for all 30 importers with a single copy in the tree. Measured and important: a spec-ONLY bump does NOT achieve this — @objectstack/client, /formula and /lint each EXACT-pin their own spec ('17.0.0-rc.6' at rc.6, '17.0.0' at GA), so raising spec alone produced two copies (17.0.0 for importers + a nested 17.0.0-rc.6). Raising all four is what yields the single GA resolution, so it is part of the bump. STOPPED before adaptations per the card's own 机制假设 instruction: the rc.6->GA delta is NOT small (165 json-schema files differ beyond version-string churn, 9 schemas removed, 8 added, 2 source modules deleted), and the adaptations it forces exceed the scope ceiling. PR is DRAFT and says 'Part of #4636', not 'Fixes' — merging it would not complete the card (farm is red) and I must not silently close the card. Also note: PM assumption #2 answered — 17.0.0 DOES contain the global_nav ACTION_LOCATIONS retirement, but it was ALREADY in rc.6, so anything gated purely on that fact was already unblocked and never needed this bump.",
  "tests": "All at pushed HEAD 48b0fde (working tree clean). BUILD: turbo run build --filter=!@object-ui/site --concurrency=2 => 43/43 successful. TYPE-CHECK: turbo run type-check => 1 error, packages/types/src/__tests__/p1-spec-alignment.test.ts(67,7) TS2322 'Type true is not assignable to type undefined' (virtualScroll retired). app-shell type-checks clean standalone; its earlier failure was a turbo cascade. FULL FARM: pnpm exec vitest run --maxWorkers=2 => 'Test Files 9 failed | 1452 passed (1461); Tests 17 failed | 18340 passed | 1 skipped (18358)', Duration 1741.65s. SCOPED RE-RUN of all 193 spec-importing test files => 8 failed | 185 passed, 15 failing tests, reproducing consistently. GATES at 48b0fde: check-changeset-presence PASS, check-changeset-fixed PASS, check-changeset-no-major PASS, check-phantom-dependencies PASS, check-control-bytes PASS, check-spec-symbol-derivation FAIL (exit 1, 6 symbol collisions). LOCKFILE EVIDENCE: 30 importers 'specifier: ^17.0.0' / 'version: 17.0.0(ai@7.0.56(zod@4.4.3))'; package entries show a single @objectstack/{client,core,formula,lint,sdui-parser,spec}@17.0.0. ACCOUNTING GAP, stated rather than papered over: farm said 9 files/17 tests, scoped reproduction finds 8 files/15 tests; 1 file + 2 tests are outside the spec-importing set and I did NOT identify them. Possibly load-dependent flakes (documented in this repo) but unproven, so recorded as unknown. NO ablation/reverse-verification was applicable here (dependency bump, no fix to ablate).",
  "open_questions": [
    {
      "question": "Keeping the farm green after this bump requires work the card explicitly puts OUT of scope, and part of it lands inside regions declared by in-flight sibling cards. How should the remaining adaptation surface be sequenced? (Surfacing rather than choosing, per the stop instruction.) The surface: (a) FOUR brand-new GA authorable blocks — object-form, object-grid, object-master-detail-form, object-metric — auto-discovered by apps/console's repo-wide registry-inputs parity test; object-grid alone needs 34 top-level keys published, and page:header / page:tabs / record:details gained keys; (b) the objectstack#7176 retirement of striped/bordered/virtualScroll, whose forwarding chain the spec itself traces react spec-bridge -> plugin-list -> plugin-view/app-shell and which TERMINATES at packages/app-shell/src/views/ObjectView.tsx:1766-1838 — inside #8500's declared region; (c) six spec-named symbol collisions failing check:spec-symbols, one of which (SECRET_MASK, packages/app-shell/src/views/metadata-admin/widgets.tsx:1852) is ALSO inside #8500's region; (d) six smaller parity decisions about what objectui publishes as an authoring surface (record_picker filter, text_input defaultValue, record:highlights readonly now stripped, record:details section member key, a new FormFieldSchema key needing a behavioral row, and GA's new $like/$ilike operators that no filter-builder operator can author).",
      "options": [
        "A — Land this bump PR only after a follow-up batch makes the farm green: file (a)-(d) as separate cards, sequence (b) and (c) AFTER #8500 releases packages/app-shell/src/views/, then flip this PR ready last. Keeps main green at all times; costs the most rounds.",
        "B — Widen THIS card's scope to cover (b), (c) and (d) but not (a), and wait for #8500 to land before the app-shell edits. Fewer PRs, but it still cannot go green — (a) alone keeps apps/console's parity test red, so main would still not accept it.",
        "C — Land the bump now with the failing gates accepted as known-red (e.g. temporary skips/allowlist entries on the parity and symbol gates) and pay down (a)-(d) afterwards. Fastest to get GA resolved into the lockfile; deliberately blinds the exact gates that are reporting real authoring-surface drift.",
        "D — Treat (a) as the real product question first: decide whether objectui SHOULD publish authoring surfaces for the four new object-* blocks at all, since the maintainer's #7176 ruling already established that a spec key objectui only forwards without applying is dead and gets retired rather than implemented."
      ],
      "recommendation": "A, with D answered first as its input — and explicitly NOT C. On real business need: (a) is the only large item, and nothing measured shows a consumer for those four blocks' authoring surfaces in this repo today — the spec declared them, objectui publishes none of their keys, and no example app or console flow was found reading them. That is exactly the shape the maintainer's 2026-08-10 #7176 ruling addressed from the other side (a forwarded-but-never-applied key is dead and gets retired, and 'if objectui wants one of these as real behavior, that is an implementation card filed first'). So (a) should be answered as a product question (D) before anyone writes 34 inspector keys on the assumption that a declared surface must be consumed — startup focus says a declared surface with no pull is handled implementation-first. On long-term soundness: C is the one option that damages it — skipping or allowlisting the parity and symbol gates disables precisely the mechanisms that detect producer/renderer contract drift, and this bump is the first event proving those gates work as designed; a temporary skip on a drift detector reliably outlives its justification. B is dominated because it cannot reach green, so it buys no merge and still splits the work. On making AI-written metadata hard to get wrong: the parity gates failing loudly is the CORRECT behavior — they are catching that GA declares authorable keys the renderer would silently ignore, which is the exact class of authoring error (author gets a success receipt for configuration that does nothing) that these tests exist to prevent. Keeping them honest, sequencing behind #8500, and deciding (a) deliberately preserves that. One caveat I cannot resolve from here: the 1 unaccounted failing file must be identified before any 'green' claim, since an unexplained failure could be a real regression rather than a flake."
    },
    {
      "question": "Two deviations from the dispatch prompt that I did not decide silently, per the instruction to surface conflicts rather than pick a side.",
      "options": [
        "The prompt said the PR's first line must be 'Fixes #4636'. I wrote 'Part of #4636' instead, because merging this PR does not satisfy the card's own acceptance criterion ('Full farm green') and a closing keyword would close the card on merge while the work is unfinished.",
        "The prompt scoped the bump to @objectstack/spec. I also raised client/formula/lint, because their exact pins otherwise leave a nested spec@17.0.0-rc.6 in the tree and the stated acceptance criterion (lockfile resolves 17.0.0 GA across the workspace) is not actually met by a spec-only bump. Evidence is in the PR body."
      ],
      "recommendation": "Keep both. Re-point them if the PM disagrees — the 'Part of' wording is a one-line change, and the client/formula/lint bump can be split into its own commit, though splitting it would knowingly leave two spec copies in the tree."
    }
  ],
  "out_of_scope_findings": [
    "NOT filed as issues — deliberately, since the card said 'report such findings, do not implement them here' and stated the seat would sequence them; filing four overlapping cards unilaterally would duplicate that sequencing. Say the word and I will file them. The list: (1) apps/console registry-inputs parity — four new GA blocks (object-form/object-grid/object-master-detail-form/object-metric) publish zero of their declared keys, object-grid needs 34; page:header/page:tabs/record:details gained keys. (2) objectstack#7176 striped/bordered/virtualScroll retirement follow-through across types -> react spec-bridge -> plugin-list -> plugin-view -> app-shell. (3) check:spec-symbols — 6 collisions: SECRET_MASK, ObjectCalendarProps, ObjectFormProps, ObjectGridProps, ObjectKanbanProps. (4) six authoring-surface parity decisions incl. GA's new $like/$ilike filter operators unreachable from the builder.",
    "Informational, affects another card's premise: the global_nav ACTION_LOCATIONS retirement (objectstack#6888) was already present in 17.0.0-rc.6, not introduced at GA. objectstack#7100 was gated on 'the retirement is present in the installed spec' and was therefore already unblocked before this bump.",
    "Informational, no action: the GA removals of external-lookup and message-queue surfaces (ExternalLookup, ExternalDataSource, ExternalFieldMapping, MessageQueueConfig, MessageQueueProvider, TopicConfig, ConsumerConfig, DeadLetterQueue) have zero references in objectui — verified by grep across packages/apps/examples/scripts/e2e.",
    "Process note: my full-farm run held the shared /tmp/os-heavy-verify.lock for ~29 minutes with two sibling agents queued behind it. I released it and switched to scoped runs. A full-farm verification and a shared single-lock convention are in tension for dependency-bump cards; worth a convention tweak (e.g. a separate lock class or an agreed budget) if whole-farm cards recur."
  ]
}

---

Generated by Claude Code

[yinlianghui]

Sequencing ruling recorded (seat repo:objectui, session session_01RnQd8iMMUwXQEV1crFmQiQ, 2026-08-14) — the body above now carries the state; this comment is the audit trail for the dev report's open questions:

1. Option A adopted (main stays green; adaptations split out; bump PR chore(deps): raise the @objectstack/* pin from ^17.0.0-rc.6 to 17.0.0 GA #4639 stays a parked draft with its expected-red list until the blockers land, then re-points onto post-adaptation main). Option C rejected outright — skipping/allowlisting the parity and symbol gates is gate-weakening, which is not this seat's to grant and would defeat the first live proof that those drift detectors work.
2. Both dispatch deviations endorsed: Part of instead of Fixes (a closing keyword would have closed this card with the farm red — correct catch), and raising client/formula/lint alongside spec (a spec-only bump measurably fails the card's own acceptance criterion by nesting a second rc.6 copy).
3. Split executed: Unwind the objectstack#7176 striped/bordered/virtualScroll forwarding chain (types → react spec-bridge → plugin-list → plugin-view → app-shell) + drop ObjectGrid.component.yml's retired declarations #4649 (retirement unwind, dispatched), Resolve the spec-named symbol collisions with 17.0.0 GA exports (check:spec-symbols): SECRET_MASK + ObjectCalendarProps/ObjectFormProps/ObjectGridProps/ObjectKanbanProps + one more #4650 (symbol collisions, dispatched), [Decision] spec 17.0.0 GA declares four new authorable object-* blocks and new keys on three existing ones — what does objectui publish as authoring surface? #4648 (authoring-surface product decision — maintainer inbox; items 3–4 of its key-level list are contract pull-backs and fold into the adaptation work regardless of the ruling).
4. The unaccounted 1 file / 2 tests from the farm run: to be identified before any green claim on PR chore(deps): raise the @objectstack/* pin from ^17.0.0-rc.6 to 17.0.0 GA #4639 — carried as an explicit checklist line on that PR when it re-points.
5. The lock-contention observation (full-farm runs vs the single shared heavy-verify lock) is a mechanizable-process item, not prose: it will be filed as a finding for the skills lane per the three-category rule.

---

Generated by Claude Code