chore(deps): take the 17.4.0 @objectstack/* line — the lockfile still pins 17.3.0, and a cluster of pm:on-hold cards is waiting on the pin, not on a merge

This repo consumes @objectstack/* as published packages, so the unlock criterion for its cross-repo cards is consumer-installable, never upstream merged. The pin is one release behind.

Measured, 2026-09-09T04:2xZ

reading	value
npm `@objectstack/spec` `dist-tags.latest`	17.4.0 (published 2026-09-09T03:57:51Z)
this repo's `package.json` declaration	`"@objectstack/spec": "^17.0.0"` (caret)
this repo's `pnpm-lock.yaml`	17.3.0

The lockfile holds seven packages on the 17.3.0 line — read from origin/main:

@objectstack/client@17.3.0   @objectstack/core@17.3.0     @objectstack/formula@17.3.0
@objectstack/lint@17.3.0     @objectstack/sdui-parser@17.3.0
@objectstack/spec@17.3.0     @objectstack/types@17.3.0

The declaration is a caret, so the manifest needs no edit — a lockfile refresh floats the line to 17.4.0. Move the family as one line, not package by package.

⚠️ This bump is EXPECTED to turn some pins red — that is the point, and they must not be patched green

At least one held card says so in its own title: #7267 — "flips red the day objectui takes the @objectstack/spec release carrying objectstack#13802" (LocationField.optionalKeys.test.tsx pins LocationValueSchema as NOT strict). Others in the pin-gated cluster may behave the same way.

⛔ A pin that flips by design is a card to route, not a test to silence. When one goes red:

find the held card that predicted it (the cluster is listed below),
if the red is that card's declared trigger, say so in this PR and let that card be dispatched separately — do not carry its repair here,
if the red is not predicted by any card, stop and report: that is an unannounced upstream behaviour change and it needs its own triage.

What this unblocks (routing note, ⛔ not this card's work)

These carry a release/pin gate rather than a dependency on another card. Each is re-judged individually against its own criterion once the pin moves — ⛔ this card does not close any of them and does not pre-judge which actually clear:

#6328 · #5291 · #5831 · #7267 · #7614 · #7663 · #7716 · #7783 · #7845

⭐ #7716 is the one to look at first — its stated gate is @objectstack/spec 17.3.0, which the lockfile already holds, so it may have been waiting on nothing for some time.

⚠️ Two other clusters look similar in the listing and are not unblocked by this bump — deprecation-window / stage-2 cards (#5919 #5892 #5674 #5861 #6354 #5817) and "UI half of objectstack#N" cards (#6246 #5987 #5920). Different mechanisms; don't sweep them in.

Acceptance

pnpm-lock.yaml resolves all seven @objectstack/* entries to 17.4.0; package.json unchanged (the caret already admits it).
Build, typecheck and the test suite green — or, for each red, the classification above (predicted-by-card / unannounced) stated explicitly.
The reds that are a held card's declared trigger are named in the PR body with their card number, not repaired here.

Provenance

Filed by the PM session verifying objectstack#16500's fix on the published 17.4.0. Maintainer instruction, verbatim (⛔ 照抄不译): 「先 bump，两张卡都开出来」 and 「这两个任务都你处理」. domain:* / priority:* are triage's; domain:devx set here per the anchoring table (engineering surface) on the maintainer direct-dispatch channel — ⛔ a pm:retriage if triage disagrees, not a precedent.

Companion card: the hold-condition encoding audit (filed alongside this one) — several of the cards above cannot be woken by any scan today.

Claim: PM loop, maintainer direct dispatch
Session: session_019wtfW1ZxGnP1XKGc9uZVms
Branch: claude/issue-8772-objectstack-17-4-0-line
Worktree: objectui-issue-8772
Domain: domain:devx
File surface: pnpm-lock.yaml (+ package.json only if a caret genuinely blocks the line; expected untouched) — plus whatever a by-design pin flip forces, which is to be REPORTED not repaired (stop on breach; explain in the report)
Container & model: S, mode:subagent, model: opus — default judgment tier. The mechanical half is a lockfile refresh; the judgment half is classifying each red as predicted-by-card vs unannounced, which is why this is not the floor tier.
Clause-②: no — a dependency line move; no accept set widens and no public surface of this repo changes.
Thread-read: none (no comments on the card at claim time)
Serial constraints cleared: pnpm-lock.yaml — ⚠️ NOT measured against open PRs this round. The maintainer asked to 简化加速; recorded as an unmeasured constraint rather than a clean reading. The lockfile is the single highest-collision file in any repo, so the dev merges origin/main immediately before opening the PR and re-runs the install rather than hand-resolving.

Authorisation — maintainer instruction, verbatim (⛔ 照抄不译): 「先 bump，两张卡都开出来」 then 「这两个任务都你处理」.

⚠️ Companion #8773 is claimed by this same session as PM work (issue metadata, no PR). Ordering is deliberate and stated on both cards: this one lands first.

Generated by Claude Code

os-dev-report

{
  "issue": 8772,
  "status": "done",
  "branch": "claude/issue-8772-objectstack-17-4-0-line",
  "pr": "https://github.com/objectstack-ai/objectui/pull/8783",
  "premise_still_valid": true,
  "premise_checks": {
    "lockfile_held_seven_at_17.3.0": "confirmed on origin/main 33f4a19 (snapshot keys client/core/formula/lint/sdui-parser/spec/types)",
    "all_seven_publish_17.4.0_on_npm": "confirmed, each dist-tags.latest=17.4.0",
    "package_json_untouched": "confirmed: every declared range is a caret inside major 17; final diff touches no manifest",
    "dedicated_bump_script_exists": false
  },
  "files_changed": [
    "pnpm-lock.yaml",
    "e2e/live/ci/backend.env",
    "scripts/__tests__/check-lockfile-integrity.test.ts"
  ],
  "gates": {
    "build": "PASS — turbo run build, 43/43 successful",
    "type-check": "FAIL(1) — turbo run type-check --continue, 80/81 successful; sole red is the #7783 row in red_pins",
    "test": "FAIL(16) — pnpm test shards 1..4/4; 2809 files, 36579 passing; 15 failing tests + 1 failing suite, all in red_pins. Measured at feb0b82",
    "eslint(changed file)": "PASS — exit 0",
    "check:lockfile-integrity": "PASS — 'VERDICT clean - no @objectstack/* identity moved backward and no package gained a copy', 1822 -> 1822 resolutions",
    "check-changeset-presence": "PASS — '3 file(s) changed, 0 of them published source... no changeset is owed'",
    "check-control-bytes": "PASS — 6980 tracked text files",
    "check-governed-queue-guard --test": "NOT GOVERNED — 3 paths, 0 of 5 governed surfaces matched",
    "pnpm install --frozen-lockfile": "PASS — lockfile consistent with untouched manifests"
  },
  "red_pins": [
    {
      "test": "packages/types/src/__tests__/zod-mirror-parity.test.ts:2746 (type-check)",
      "predicted_by_card": "#7783",
      "evidence": "DashboardComponentSchema measured drift gained 'refreshInterval'; probed Exclude(Measured,Recorded)='refreshInterval' with a control leg proving the probe compiled. spec 17.4.0 ships refreshIntervalSeconds (14 occ) + retiredKey tombstone; 17.3.0 ships neither"
    },
    {
      "test": "packages/plugin-dashboard/src/__tests__/dashboardAuthoredInputs.test.tsx",
      "predicted_by_card": "#7783",
      "evidence": "ZodError names the tombstone verbatim: 'dashboard.refreshInterval was renamed to refreshIntervalSeconds'. Card names this file at lines 159,170,221,333,353"
    },
    {
      "test": "packages/app-shell/src/views/metadata-admin/metadata-form-i18n.test.ts:89",
      "predicted_by_card": "#7783",
      "evidence": "fieldByName(zh,'refreshInterval').label is undefined; card names metadata-form-i18n.ts:91 as a reader site"
    },
    {
      "test": "packages/components/src/__tests__/record-picker-inputs-spec-parity.test.ts (2 tests)",
      "predicted_by_card": "#7663",
      "evidence": "card states 'Both go red the moment a released spec carrying objectstack#14406 is installed'; failure is filter:object 'the contract refuses the KIND itself'"
    },
    {
      "test": "apps/console/src/__tests__/registry-inputs-spec-parity.test.ts > element:record_picker declares no arm the spec refuses outright",
      "predicted_by_card": "#7663",
      "evidence": "card names this file at 1837-1856, 'only the arm changes'"
    },
    {
      "test": "apps/console/src/__tests__/registry-inputs-spec-parity.test.ts > object-kanban publishes every top-level key its spec props schema declares",
      "predicted_by_card": "#8172",
      "evidence": "undiscoverableSpecKeys('object-kanban') = ['limit']; spec 17.4.0 now declares limit, which #8172 filed as refused-by-name at 17.2.0"
    },
    {
      "test": "packages/app-shell/src/views/metadata-admin/previews/__tests__/block-config-schema-parity-8216.test.ts (2 tests)",
      "predicted_by_card": "#8172",
      "evidence": "stale ledger row names the card literally: 'object-kanban::limit@spec (objectui#8172) - no longer a violation; delete this row'; SPEC_ORACLES kanban.safeParse withLimit now succeeds"
    },
    {
      "test": "packages/plugin-gantt/src/ObjectGantt.blockPrecedence.test.tsx",
      "predicted_by_card": "#7845",
      "evidence": "FLAT_GANTT_CONFIG_KEYS 40 total vs 30 unique = 10 duplicates, exactly the ten gantt extension keys the card says the spec now declares"
    },
    {
      "test": "packages/plugin-chatbot/src/__tests__/toolLabels-locale-parity-7481.test.ts",
      "predicted_by_card": "#7481",
      "evidence": "self-declared catch-up tripwire named in the test title; 'remove these from AHEAD_OF_PIN - the pinned spec now lists them': get_authoring_rules +4"
    },
    {
      "test": "packages/app-shell/src/services/MetadataService.specKeyReference.test.ts",
      "predicted_by_card": "objectstack#16920",
      "evidence": "test's own prose: 'This is a TRIPWIRE, not an endorsement: objectstack#16920 trims before the test, so this line reddens when the pin reaches it - at which point the reading becomes false and nothing else here moves'"
    },
    {
      "test": "apps/console/src/__tests__/preview-samples-spec-valid.test.ts > job sample is valid metadata",
      "predicted_by_card": "UNPREDICTED",
      "evidence": "path jobs.0.timeout: 'job.timeout was removed in @objectstack/spec 17 ... Rename the key to timeoutMs'. Tombstone present in 17.4.0 dist, absent in 17.3.0 dist. No hit for 'timeoutMs' across 148 held cards (pm:blocked + pm:on-hold)"
    },
    {
      "test": "apps/console/src/__tests__/preview-samples-spec-valid.test.ts > flow sample is valid metadata",
      "predicted_by_card": "UNPREDICTED",
      "evidence": "path flows.0.nodes.13.config.outcome: 'Invalid option: expected one of completed|refused'. Neither enum member present in 17.3.0 automation dist, both present in 17.4.0. #7707 consumes outcome:'refused' but predicts no red"
    },
    {
      "test": "packages/app-shell/src/views/metadata-admin/metadata-form-i18n.test.ts > drops the 'Tailwind units' developer vocabulary",
      "predicted_by_card": "UNPREDICTED",
      "evidence": "asserts the ENGLISH producer copy still matches /Tailwind/i; spec 17.4.0 rewrote gap helpText to 'Space between widgets, in steps of 0.25rem (4 = 1rem)'. Measured: 'Tailwind' 14 occ in 17.3.0 ui dist vs 11 in 17.4.0; 'in steps of 0.25rem' 0 vs 3"
    },
    {
      "test": "scripts/__tests__/ci-cd-pipeline-doc.test.ts > pins OBJECTSTACK_VERSION to the version the lockfile resolves",
      "predicted_by_card": "FIXED_HERE",
      "evidence": "repo rule requires backend.env == lockfile spec version in the same PR (objectui#7689); bumped 17.3.0 -> 17.4.0"
    },
    {
      "test": "scripts/__tests__/check-lockfile-integrity.test.ts (suite-level)",
      "predicted_by_card": "FIXED_HERE",
      "evidence": "its own assertion message prescribes it: 'the spec snapshot key moved - rebuild this sample before trusting it'. Anchor moved 17.3.0 -> 17.4.0; downgrade target 17.2.0 and all assertions unchanged"
    }
  ],
  "unpredicted_count": 3,
  "cards_whose_trigger_did_NOT_fire": [
    {
      "card": "#7267",
      "finding": "premise already false — NOT a consequence of this bump",
      "evidence": "LocationField.optionalKeys.test.tsx runs and all 12 tests pass. It already asserts safeParse(polluted).success===false and its prose records '@objectstack/spec 17.3.0 closed the shape ... Re-derived rather than inverted'. Last commit touching it (86ef0c7) is an ancestor of BASE 33f4a19 (merge-base --is-ancestor exit 0). Probed at 17.4.0: LocationValueSchema refuses latitude/longitude with unrecognized_keys — strict, as the card said, but absorbed under the 17.3.0 pin the lockfile already held. Needs re-triage, not dispatch"
    }
  ],
  "deviations": [
    "Lockfile re-resolve required suppressing collateral float. A plain `pnpm update -r \"@objectstack/*\"` rewrote 29 package.json files AND floated zod ^4.4.3 -> 4.5.4, forking ai@7.0.65's peer context into two physical copies each of spec/formula/lint (the objectui#8326/#8333 defect class check-lockfile-integrity.mjs catches), plus seroval and @mongodb-js/saslprep drift. Landed instead by pinning zod/seroval/seroval-plugins/@mongodb-js/saslprep via a TEMPORARY root pnpm.overrides block, running the update, restoring all manifests from HEAD, then settling with plain `pnpm install`. Verified: final diff touches no manifest; every changed lockfile line is an @objectstack identity or integrity hash; zod/seroval/saslprep byte-identical to base; 1822 -> 1822 resolutions. The float is NOT caused by this bump — spec and core declare identical `zod: ^4.4.3` at both 17.3.0 and 17.4.0.",
    "Two files outside pnpm-lock.yaml were edited, both mechanically coupled to the lockfile by this repo's own rules and each naming this exact event (backend.env OBJECTSTACK_VERSION; check-lockfile-integrity.test.ts sample anchor). Declared rather than assumed in-scope.",
    "Full 4-shard test suite was measured at feb0b82, BEFORE the origin/main merge (6fae5e2). Post-merge the ratchet family was re-run green (lockfile-integrity, changeset-presence, control-bytes, both repaired test files, eslint). main had not touched pnpm-lock.yaml, so no lockfile conflict occurred and nothing was hand-resolved. CI runs the full farm on the merged head.",
    "Repo-wide `pnpm lint` not run locally (CI-owned repo-scale scan); eslint run on the one changed TypeScript file, exit 0."
  ],
  "out_of_scope_findings": [
    "noted, not filed: e2e/live/ci/backend.env instructs retiring BETTER_AUTH_VERSION + e2e/live/ci/better-auth-pin.mjs 'in the PR that bumps OBJECTSTACK_VERSION past the upstream fix' (objectstack#16186). Condition now appears met: @objectstack/plugin-auth 17.4.0 pins the better-auth family EXACTLY at 1.7.2 (caret dropped) where 17.3.0 declared ^1.7.2. Not acted on — retiring changes live-e2e lane behaviour and adds a verification surface this PR cannot exercise. Carrier: whoever owns the live-e2e lane; recommend PM file it.",
    "noted, not filed: `pnpm update` floating an already-satisfied range is a live foot-gun for any future dependency bump in this repo — it silently produces exactly the lockfile shape check-lockfile-integrity.mjs was built to catch. No documented procedure warns of it. Carrier: any future deps card.",
    "noted, not filed: the three UNPREDICTED reds above (job.timeout, flow outcome enum, gap help text) each need their own card; reported here for PM to file since they are upstream-behaviour triage, not this card's work."
  ],
  "mcp_calls": "0 — all GitHub reads and writes went through repo-scoped REST plus git; no MCP GitHub tool was called",
  "open_questions": []
}

Generated by Claude Code

os-dev-report

{
  "issue": 8772,
  "status": "done",
  "branch": "claude/issue-8772-objectstack-17-4-0-line",
  "pr": "https://github.com/objectstack-ai/objectui/pull/8783",
  "head": "5f90b36",
  "merge_base": "42ddd7f",
  "premise_still_valid": true,
  "premise_checks": {
    "pr_8783_produced_16_reds": "confirmed — reproduced all 16 on the branch head before touching anything (14 failing tests across 9 files, plus the type-check red, plus the two lockfile-coupled files the bump commit had already repaired)",
    "red_to_card_mapping_in_8783_table": "re-verified independently; every row held. Two rows carry corrections, recorded in falsified_assumptions",
    "claims_name_this_branch": "confirmed on all five member cards (comments 5601353618 #7783, 5601355857 #7663, 5601358475 #8172, 5601360584 #7845, 5601362970 #8785) — each names claude/issue-8772-objectstack-17-4-0-line. No second claim posted.",
    "lockfile_work_preserved": "confirmed — check-lockfile-integrity reports 1822 -> 1822 resolutions against merge base 42ddd7f, VERDICT clean; residue after excluding @objectstack identities, integrity hashes and the seven version lines is EMPTY"
  },
  "reds_resolved": [
    {
      "test": "packages/types/src/__tests__/zod-mirror-parity.test.ts (type-check, assertionDriftMatchesLedger)",
      "card": "objectui#7783",
      "repair_kind": "re-point-pin"
    },
    {
      "test": "packages/plugin-dashboard/src/__tests__/dashboardAuthoredInputs.test.tsx > the spec accepts the full declared document",
      "card": "objectui#7783",
      "repair_kind": "re-point-pin"
    },
    {
      "test": "packages/app-shell/src/views/metadata-admin/metadata-form-i18n.test.ts > translates the layout field labels and hints the card named",
      "card": "objectui#7783",
      "repair_kind": "re-point-pin"
    },
    {
      "test": "packages/components/src/__tests__/record-picker-inputs-spec-parity.test.ts > publishes `filter`, which the renderer has read all along",
      "card": "objectui#7663",
      "repair_kind": "re-point-pin"
    },
    {
      "test": "packages/components/src/__tests__/record-picker-inputs-spec-parity.test.ts > declares `object` as the type the spec actually accepts, not `array`",
      "card": "objectui#7663",
      "repair_kind": "re-point-pin"
    },
    {
      "test": "apps/console/src/__tests__/registry-inputs-spec-parity.test.ts > element:record_picker declares no arm the spec refuses outright",
      "card": "objectui#7663",
      "repair_kind": "re-point-pin"
    },
    {
      "test": "apps/console/src/__tests__/registry-inputs-spec-parity.test.ts > object-kanban publishes every top-level key its spec props schema declares",
      "card": "objectui#8172",
      "repair_kind": "other"
    },
    {
      "test": "packages/app-shell/src/views/metadata-admin/previews/__tests__/block-config-schema-parity-8216.test.ts > every ledger row still applies",
      "card": "objectui#8172",
      "repair_kind": "delete-duplication"
    },
    {
      "test": "packages/app-shell/src/views/metadata-admin/previews/__tests__/block-config-schema-parity-8216.test.ts > every SPEC-face ledger row is a real parser refusal, named",
      "card": "objectui#8172",
      "repair_kind": "delete-duplication"
    },
    {
      "test": "packages/plugin-gantt/src/ObjectGantt.blockPrecedence.test.tsx > covers the spec-modelled half by derivation and the extensions by list",
      "card": "objectui#7845",
      "repair_kind": "delete-duplication"
    },
    {
      "test": "packages/plugin-chatbot/src/__tests__/toolLabels-locale-parity-7481.test.ts > AHEAD_OF_PIN carries only names the pinned registry still lacks",
      "card": "objectui#7481 (CLOSED — not reopened, not touched)",
      "repair_kind": "delete-duplication"
    },
    {
      "test": "packages/app-shell/src/services/MetadataService.specKeyReference.test.ts > the VERSION SKEW is real at THIS pin",
      "card": "objectstack#16920 (other repo — not touched)",
      "repair_kind": "re-point-pin"
    },
    {
      "test": "apps/console/src/__tests__/preview-samples-spec-valid.test.ts > job sample is valid metadata",
      "card": "objectui#8785",
      "repair_kind": "fix-sample"
    },
    {
      "test": "apps/console/src/__tests__/preview-samples-spec-valid.test.ts > flow sample is valid metadata",
      "card": "objectui#8785",
      "repair_kind": "fix-sample"
    },
    {
      "test": "packages/app-shell/src/views/metadata-admin/metadata-form-i18n.test.ts > drops the \"Tailwind units\" developer vocabulary",
      "card": "objectui#8785",
      "repair_kind": "re-point-pin"
    },
    {
      "test": "scripts/__tests__/ci-cd-pipeline-doc.test.ts + scripts/__tests__/check-lockfile-integrity.test.ts",
      "card": "objectui#8772 (lockfile-coupled)",
      "repair_kind": "other"
    }
  ],
  "reds_remaining": [],
  "gates": {
    "build": "PASS — pnpm build, 43/43 successful, exit 0 (head 5f90b36)",
    "type-check": "PASS — pnpm type-check, 81/81 successful, exit 0. This is where objectui#7783's red was.",
    "test (targeted, merged head)": "PASS — pnpm vitest run over the nine touched packages + scripts: 1562 files, 19054 tests, 0 failing, exit 0",
    "test (FULL suite, earlier head)": "RUN TO COMPLETION — 2816 files, 36682 passing, 2 failing; both were doc ratchets this branch's own edits had moved, both repaired and re-verified (154 passing)",
    "eslint (28 changed TS/JS files, --no-inline-config)": "PASS — exit 0, 0 errors, 231 warnings (all pre-existing no-explicit-any, counted file-wide)",
    "check:lockfile-integrity": "PASS — 'VERDICT clean - no @objectstack/* identity moved backward and no package gained a copy'; 1822 -> 1822 resolutions vs base 42ddd7f",
    "check:i18n-designer-parity": "PASS — NEW gate on main since this branch opened (objectui#8834); it reads the designer string tables this PR edits, picked up from the merged tree",
    "25 check:* scripts total": "PASS — every exit code 0: lockfile-integrity, control-bytes, spec-symbols, sdui-registration-pins, element-data-source-declaration, designer-field-key-parity, handler-key-reads, i18n-keys, i18n-drift, i18n-dead-keys, i18n-designer-parity, self-import, unreferenced-sources, readme-exports, side-effects-array, phantom-deps, icon-record-names, action-forward-parity, doc-fences, shell-escape-residue, vi-mock-specifiers, vi-mock-inherit, changeset-presence, changeset-fixed, changeset-no-major",
    "check-governed-queue-guard --test": "NOT GOVERNED — 36 paths, 0 of 5 governed surfaces matched",
    "check-published-dist-tooling": "EXIT 1 — NOT this PR's and NOT a PR gate. published-dist-gate.yml fires nightly and on changes to its own wiring only. The 10 findings are dist/tsconfig.tsbuildinfo build records produced by running a local build at all; 8 of the 10 packages are untouched by this PR. Known objectui#7003 class.",
    "pnpm install --after-merge": "PASS — lockfile unchanged by the install"
  },
  "files_changed": [
    ".changeset/8772-objectstack-17-4-0-line.md",
    ".changeset/dashboard-declare-honoured-inputs.md",
    "apps/console/src/__tests__/registry-inputs-spec-parity.test.ts",
    "apps/console/src/preview-samples.ts",
    "content/docs/api/schema-reference.md",
    "content/docs/plugins/plugin-dashboard.mdx",
    "content/docs/plugins/plugin-kanban.mdx",
    "e2e/live/ci/backend.env",
    "packages/app-shell/src/services/MetadataService.specKeyReference.test.ts",
    "packages/app-shell/src/views/metadata-admin/SchemaForm.tsx",
    "packages/app-shell/src/views/metadata-admin/metadata-form-i18n.test.ts",
    "packages/app-shell/src/views/metadata-admin/metadata-form-i18n.ts",
    "packages/app-shell/src/views/metadata-admin/previews/__tests__/block-config-schema-parity-8216.test.ts",
    "packages/components/src/__tests__/record-picker-inputs-spec-parity.test.ts",
    "packages/components/src/renderers/basic/record-picker.tsx",
    "packages/plugin-chatbot/src/__tests__/toolLabels-locale-parity-7481.test.ts",
    "packages/plugin-dashboard/README.md",
    "packages/plugin-dashboard/src/DashboardConfigPanel.tsx",
    "packages/plugin-dashboard/src/DashboardGridLayout.tsx",
    "packages/plugin-dashboard/src/DashboardRenderer.tsx",
    "packages/plugin-dashboard/src/__tests__/ConfigPanel.i18nWiring.test.tsx",
    "packages/plugin-dashboard/src/__tests__/dashboardAuthoredInputs.test.tsx",
    "packages/plugin-dashboard/src/index.tsx",
    "packages/plugin-gantt/src/ObjectGantt.blockPrecedence.test.tsx",
    "packages/plugin-gantt/src/ObjectGantt.tsx",
    "packages/plugin-kanban/src/index.tsx",
    "packages/types/src/__tests__/dashboard-config.test.ts",
    "packages/types/src/__tests__/page-app-dashboard-spec-parity.test.ts",
    "packages/types/src/complex.ts",
    "packages/types/src/designer.ts",
    "packages/types/src/objectql.ts",
    "packages/types/src/zod/complex.zod.ts",
    "packages/types/src/zod/objectql.zod.ts",
    "pnpm-lock.yaml",
    "scripts/__tests__/check-lockfile-integrity.test.ts",
    "scripts/check-doc-example-types.mjs"
  ],
  "changeset": ".changeset/8772-objectstack-17-4-0-line.md — OWED and added, measured not assumed: check-changeset-presence.mjs refused with '26 of them published source of a package the release covers'. Scored minor across the eight packages whose src/ moved, never major (fixed group tracks the @objectstack major). Also corrected one stale token in the pending .changeset/dashboard-declare-honoured-inputs.md, which named a key this PR renames before either ships.",
  "falsified_assumptions": [
    "objectui#7783's site table lists packages/types/src/data.ts and packages/types/src/ai.ts among 'the TS types' for the refreshInterval rename. Both are FALSE positives: DataBinding.refreshInterval and AIInsightsSchema.refreshInterval have no zod mirror and no @objectstack/spec counterpart (spec/ui exports nothing matching either name), so no producer stands behind a rename — and DataBinding's is documented in MILLISECONDS, making refreshIntervalSeconds the wrong name for it outright. Left alone; this is the same trap the card itself flagged for the report component.",
    "objectui#7845 item 3 names packages/core/src/utils/__tests__/normalize-list-view.test.ts:351 as prose to correct. Premise false: that test needs no change. It asserts kanban.swimlaneField and timeline.endField survive normalization, and BOTH are still absent from the spec's KanbanConfigSchema / TimelineConfigSchema — the passthrough carrying them is objectui's own local schema, not the spec's. What WAS false is the note in zod/objectql.zod.ts justifying that local .passthrough() 'for the same reason the spec puts it on GanttConfigSchema/TreeConfigSchema'; that precedent is gone and only the local reason survives. Corrected there instead.",
    "objectui#8172's spec-seat comment records that at pin a472b07 the declaring type was the plugin's own KanbanSchema, not @object-ui/types' ObjectKanbanSchema. Re-measured at this pin: BOTH @object-ui/types faces declare limit (objectql.ts and the zod mirror objectql.zod.ts). So there was no missing type declaration to add; the only face still out of step was this repo's registration.",
    "objectui#7845's card describes GANTT_CONFIG_EXTENSION_KEYS / GanttConfigExtensionFields as possibly carrying describes or aliases the spec lacks, and asks for a finding on any real difference. Compared member for member: the spec covers the same ten keys, the same interactions (move/resize/progress/link) and timeSegments (dayStart/bands/showMidnight) sub-shapes and the same band members, with strictly FULLER describes. No difference to file."
  ],
  "deviations": [
    "TWO reds were CREATED by this branch's own edits and are not among the sixteen; both were caught by the full suite and repaired in their own commit. (1) check-doc-example-types.mjs's UNGATED_EXAMPLES is keyed by 'path:line symbol' and the gantt prose corrections shifted ObjectFormSchema's @example by six lines. (2) doc-version-claims refuses an unanchored version literal on a doc surface; the schema-reference.md row added for refreshIntervalSeconds carried '@objectstack/spec 17.4.0'. The literal was DELETED rather than added to KNOWN_CLAIMS, which is the remedy that gate itself prefers.",
    "The line-number-keyed ledger row above collided on BOTH merges — main had shifted it too. Resolved by measuring the @example line in the merged tree (1614), not by adding the two shifts.",
    "Full pnpm test was run to completion once, then narrowed on each re-merge to the nine touched packages plus scripts. The two merges brought 45 commits of other people's already-CI-green work and produced exactly one conflict (the ledger row above). DECLARED narrowing; CI runs the full farm on the merged head.",
    "Repo-wide pnpm lint is CI-owned; eslint was narrowed to this PR's own changed files. The narrowing is sound rather than convenient: eslint.config.js declares no parserOptions.project, no projectService and no *TypeChecked preset (measured: zero occurrences of parserOptions), so linting is per-file and type-unaware and this diff cannot move the verdict on an untouched file.",
    "The worktree /home/user/objectui-issue-8772 is deliberately LEFT IN PLACE rather than removed. It was PM-provisioned for this branch, the PR is extended in place and stays draft, and the dispatch contract anticipates follow-up patch rounds on the same claim; removing it would force a full rebuild for the next round.",
    "PR #8783 was left as a DRAFT and no label or state set by another actor was touched, per the standing rule that a state this seat did not set is another actor's."
  ],
  "out_of_scope_findings": [
    "noted, not filed: e2e/live/ci/backend.env instructs retiring BETTER_AUTH_VERSION + e2e/live/ci/better-auth-pin.mjs 'in the PR that bumps OBJECTSTACK_VERSION past the upstream fix' (objectstack#16186). Condition now appears met: @objectstack/plugin-auth 17.4.0 pins the better-auth family EXACTLY at 1.7.2 (caret dropped) where 17.3.0 declared ^1.7.2. Not acted on — retiring it changes live-e2e lane behaviour and adds a verification surface this PR cannot exercise. Carrier: whoever owns the live-e2e lane; recommend PM file it.",
    "noted, not filed: content/docs/api/schema-reference.md documented the dashboard auto-refresh key as MILLISECONDS with a 30000 sample. It was never milliseconds — the renderer multiplies by 1000. Corrected in passing with the rename it belongs to, so no card is owed; recorded because the class (a doc unit that contradicts the renderer) is exactly what objectstack#14478 ruling B exists to stop.",
    "noted, not filed: check-published-dist-tooling exits 1 on 10 dist/tsconfig.tsbuildinfo records in packages built locally, 8 of them untouched by this PR. Known objectui#7003 class and the gate is nightly-only, so it blocks nothing here. Carrier: objectui#7003.",
    "noted, not filed: the record-picker filter input's coarse 'array' type has no member arm, so a tuple list ([['a','=',1]]) passes the manifest check and is refused only by the spec at filter.0. Named in the test rather than repaired — closing it would mean a member vocabulary in ComponentInput.type, which is a contract decision, not this card's. Carrier: whoever revisits ComponentInput.type."
  ],
  "mcp_calls": "0 - every GitHub read and write went through repo-scoped REST plus git; no MCP GitHub tool was called",
  "open_questions": []
}

Generated by Claude Code

ACCEPT — family dispatch, six cards, verified against GitHub

Reviewing seat: PM session session_019wtfW1ZxGnP1XKGc9uZVms, 2026-09-09T17:0xZ. ⛔ Verified against the PR and its checks, not against the report's self-description.

CI on head `5f90b36` — 34 checks, zero failures

The decisive reading. Every red this branch previously carried is gone:

check	before (`571080a`)	now
Test shard 1/4 · 2/4 · 3/4 · 4/4	all failure	all success
Type Check	failure	success

Also green and load-bearing: Lockfile Integrity Check (the gate that would catch a zod fork), Bundle Analysis (single-copy vendor-objectstack), Governed Surface Queue Guard, Build & E2E, Lint, and all four changeset checks (Declaration, Fixed Group, Bump Policy, Overwrite Report).

⭐ The bump's original property survived sixteen repairs and two merges of other people's work: check-lockfile-integrity reports 1822 → 1822 resolutions against merge base 42ddd7f, VERDICT clean.

Path surface

NOT GOVERNED — and this is CI's own verdict, not the dev's: the Governed Surface Queue Guard ran on this head and passed. So the ordinary accept path applies; ⛔ no maintainer-facing four-piece is owed.

What was checked beyond the green

Clause ②, re-declared from the delivered diff. plugin-kanban/src/index.tsx now publishes the limit input, which looks like widening a public surface. It is not: spec 17.4.0 declares limit on object-kanban, so this repo is being pulled onto an already-published contract — 「拉回已声明契约不触条款②」. The same reasoning covers element:record_picker registry inputs.filter still declares type: 'object' and its parity pins assert the record form — flip both to the ViewFilterRule array arm once the spec that converged the entry reaches the pin (objectstack#14406) #7663 (the spec narrowed filter onto the ViewFilterRule array) and plugin-gantt / types: derive the ten gantt extension keys from GanttConfigSchema.shape now that the spec declares them — retire GANTT_CONFIG_EXTENSION_KEYS and GanttConfigExtensionFields, and the prose that still calls the spec loose (objectstack#15469 follow-up) #7845 (a local extension list deleted in favour of the spec's shape). All three narrow or track; none widens.
Two reds the branch created itself were caught by the full suite and repaired in their own commit — a line-number-keyed UNGATED_EXAMPLES row shifted by prose edits, and a version literal on a doc surface. ⭐ The second was fixed by deleting the literal rather than adding it to KNOWN_CLAIMS, which is the remedy that gate itself prefers. Declared, not buried.
reds_remaining: [], and CI agrees.

⭐ Three card premises falsified — corrections that outlive this PR

The dev refused to build on card text it measured false. Recorded here because the cards are wrong, not just this round:

dashboard refreshInterval → refreshIntervalSeconds: two declarations and six reader sites to move when the spec rename ships #7783's site table names two false positives — packages/types/src/data.ts and ai.ts. Neither DataBinding.refreshInterval nor AIInsightsSchema.refreshInterval has a zod mirror or a spec counterpart, so no producer stands behind a rename; ⚠️ and DataBinding's is documented in milliseconds, which would have made refreshIntervalSeconds actively wrong there. Left alone, correctly.
plugin-gantt / types: derive the ten gantt extension keys from GanttConfigSchema.shape now that the spec declares them — retire GANTT_CONFIG_EXTENSION_KEYS and GanttConfigExtensionFields, and the prose that still calls the spec loose (objectstack#15469 follow-up) #7845 item 3's premise is false — normalize-list-view.test.ts:351 needed no change; the passthrough carrying swimlaneField / endField is objectui's own local schema, not the spec's. What was false was a note in objectql.zod.ts citing a spec precedent that no longer exists; corrected there instead.
plugin-kanban: the docs and ObjectKanbanSchema teach limit on an object-kanban, the renderer reads it as $top — and the spec's strict ComponentPropsMap refuses it by name #8172's pinned observation is stale — at this pin both @object-ui/types faces already declare limit; the only face out of step was this repo's registration.

⚠️ A fourth was checked and came back clean: #7845's extension keys vs the spec, compared member for member — same ten keys, same sub-shapes, strictly fuller describes. No finding owed, and saying so is the useful result.

Verdict

ACCEPT. Flipping to ready and arming auto-merge. Closes #8772, #7783, #7663, #8172, #7845, #8785 on merge; objectui#7481 (closed) and objectstack#16920 (other repo) had their reds repaired without their cards being touched, as dispatched.

⚠️ Carried forward, not blocking: e2e/live/ci/backend.env's instruction to retire BETTER_AUTH_VERSION + better-auth-pin.mjs now has its condition met (plugin-auth 17.4.0 pins the better-auth family exactly at 1.7.2). It changes live-e2e behaviour and needs its own card.

Generated by Claude Code

Navigation Menu

Repository navigation

chore(deps): take the 17.4.0 @objectstack/* line — the lockfile still pins 17.3.0, and a cluster of pm:on-hold cards is waiting on the pin, not on a merge #8772

Measured, 2026-09-09T04:2xZ

⚠️ This bump is EXPECTED to turn some pins red — that is the point, and they must not be patched green

What this unblocks (routing note, ⛔ not this card's work)

Acceptance

Provenance

ACCEPT — family dispatch, six cards, verified against GitHub

CI on head `5f90b36` — 34 checks, zero failures

Path surface

What was checked beyond the green

⭐ Three card premises falsified — corrections that outlive this PR

Verdict

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

chore(deps): take the 17.4.0 @objectstack/* line — the lockfile still pins 17.3.0, and a cluster of pm:on-hold cards is waiting on the pin, not on a merge #8772

Description

Measured, 2026-09-09T04:2xZ

⚠️ This bump is EXPECTED to turn some pins red — that is the point, and they must not be patched green

What this unblocks (routing note, ⛔ not this card's work)

Acceptance

Provenance

Activity

os-bill commented on Sep 9, 2026

os-bill commented on Sep 9, 2026

os-bill commented on Sep 9, 2026

os-bill commented on Sep 9, 2026

ACCEPT — family dispatch, six cards, verified against GitHub

CI on head 5f90b36 — 34 checks, zero failures

Path surface

What was checked beyond the green

⭐ Three card premises falsified — corrections that outlive this PR

Verdict

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

CI on head `5f90b36` — 34 checks, zero failures