chore(deps): upgrade @objectstack/* 17.0.0-rc.5 → 17.0.0-rc.6 (maintainer order), and re-measure tracked upstream-mirror behavior #1059

Activity

1. huangyiirene

   self-assigned this

   on Aug 11, 2026
2. huangyiirene

   added

   configurationBuild and app configuration filesBuild and app configuration files

   prio:p1

   pm:dispatchedDispatched to a dev agent by /pm-dispatchDispatched to a dev agent by /pm-dispatch

   on Aug 11, 2026
3. huangyiirene commented on Aug 11, 2026

   

   huangyiirene

   on Aug 11, 2026 – with Claude

   CollaboratorAuthor

   More actions

   Claim: PM loop round 1 (hotcrm whole-repo seat)
   Session: session_01NM6o28jmBgsyTRQHutn7LC
   Branch: claude/issue-1059-upgrade-objectstack-rc6
   Worktree: dedicated cloud session (fresh clone)
   Domain: hotcrm whole-repo seat
   File surface: package.json, pnpm-lock.yaml, objectstack.config.ts, objectstack.manifest.json, .changeset/*
   Container & model: M, mode:cloud (dedicated session), model: claude-opus-5
   Serial constraints cleared: dependabot #1057/#1058 touch package.json (left open, expected to self-rebase after this lands); the #494 successor card is deliberately pm:blocked behind this card to avoid a same-file collision; no other in-flight claim touches these files.

   ---

   Generated by Claude Code
4. huangyiirene commented on Aug 11, 2026

   

   huangyiirene

   on Aug 11, 2026 – with Claude

   CollaboratorAuthor

   More actions

   {
     "issue": 1059,
     "status": "done",
     "branch": "claude/issue-1059-upgrade-objectstack-rc6",
     "pr": "https://github.com/objectstack-ai/hotcrm/pull/1066",
     "premise_still_valid": true,
     "summary": "PM premise confirmed before any edit: all 12 @objectstack/* packages this app depends on are published at 17.0.0-rc.6 on npm (pnpm view, spot-checked across spec/runtime/cli/metadata/objectql/account/driver-memory/driver-sql/driver-sqlite-wasm/service-analytics/service-automation/formula). Bumped every pin to 17.0.0-rc.6, regenerated pnpm-lock.yaml (402 rc.6 refs, zero rc.5 left), and moved objectstack.config.ts engines.protocol + objectstack.manifest.json specVersion/engines.protocol to ^17.0.0-rc.6 per #728. Five upstream behavior changes reached the app and were each baselined against rc.5 before being followed (the six affected test files were re-run on rc.5 with the bumped files stashed: 164/164 passed, so every failure was rc.6-induced, not pre-existing): (1) filter-empty-node is a NEW author-time error that FAILED THE BUILD - forecast_snapshot's 'find every user' node declared filter:{}, which reduces to TRUE and is indistinguishable from an absent key; the key is deleted, as the rule prescribes; (2) $regex is retired upstream - no app metadata used it, only the premise block in account-name-normalized-match, which now measures the retirement and reaches the same conclusion via $icontains, the declared replacement; (3) the restrict-delete message now speaks in display labels instead of API names - the refusal is unchanged, so two assertions follow the wording while still pinning that the message names the blocking object and field; (4) ctx.permissions now enumerates the platform baseline set member_default - reach is unchanged (every sharing assertion still passes), so the negative control now pins the absence of admin_full_access directly instead of an exact one-element list; (5) the approvals plugin relabelled my_pending in zh-CN (我的待办 -> 待我审批) - four docs pages follow, and the #973 guard that retired 待我审批 as 'a sidebar label, not a view' is released with its reasoning recorded, since the string now occurs exactly once in the shipped bundle, as that view's label. Docs stating the installed platform version moved to rc.6; docs/MAINTENANCE.md's rc.5 reference was deliberately left, being a historical fact about which release added a migration rather than a current-version claim. Scope kept tight: e2e/** untouched, dependabot #1057/#1058 neither merged nor rebased, no unrelated riders.",
     "tests": "pnpm build -> exit 0 (failed first on the new filter-empty-node rule; green after the fix). pnpm validate -> exit 0, 'Validation passed'. pnpm lint -> exit 0, 153 warnings / 10 suggestions, all pre-existing advisory. pnpm test -> 81 files, 1887 passed, 1 skipped, 0 failed (first run after the bump: 10 failed across 6 files; all 10 traced to rc.6 behavior changes and resolved). rc.5 baseline control: same 6 files re-run with the bumped files stashed and rc.5 reinstalled -> 6 files, 164 passed, 0 failed, proving the failures were upgrade-induced. Dev-server boot smoke check: pnpm start on a reset datastore -> 'Server is ready', GET /_console/login -> HTTP 200, SqlDriver(better-sqlite3), 38 plugins loaded, 24 flows with 18 trigger-bound; one pre-existing warning (inline seed exceeding its 8s budget, continuing in background), no rc.6-related boot error.",
     "open_questions": [
       "Self-resolved, recorded not blocking: the 5 test files whose expectations moved were adapted rather than reverted, since the underlying behavior (delete still refused, reach unchanged, premise still true) is intact in every case and only the observable wording/enumeration changed. Two that changed an assertion's SHAPE rather than its wording - the member_default enumeration and the released #973 guard - each carry an in-file comment recording the measurement that justified it.",
       "Follow-up work surfaced by the probes but deliberately NOT done in this PR (dependency bump only, each has its own review surface): #651's workaround in lead_conversion (the init_defaults assignment node) is now removable since FlowVariableSchema.defaultValue and its engine seeding both exist; #1004's pages.components translation face now exists, so the 12 page-component strings could be populated across 4 locales and test/i18n-references.test.ts extended to walk the new face. Both noted in comments on those cards.",
       "#705 got a partial verdict only: the owner_only_writes/owner_only_deletes RLS floor still ships, while access_level narrowed to ['read','edit'] with the source stating read AND write gates match it. That is static evidence; confirming whether writes actually widen needs the live multi-token matrix, which is outside a bounded probe."
     ],
     "out_of_scope_findings": []
   }

   ---

   Generated by Claude Code
5. huangyiirene commented on Aug 11, 2026

   

   huangyiirene

   on Aug 11, 2026 – with Claude

   CollaboratorAuthor

   More actions

   Pushed fb8dfa0 to claude/issue-1059-upgrade-objectstack-rc6 (fast-forward, no force): regenerated the stale package-lock.json to 17.0.0-rc.6 via the gate's own npm install --package-lock-only --ignore-scripts recipe (360 rc.6 refs, 0 rc.5), and merged origin/main (#1064/#1065/#1067) with no conflicts — both sides' intent verified intact in the three shared docs files — after which pnpm build / validate / lint all exit 0 and the suite is 80 files / 1875 passed / 1 skipped.

   ---

   Generated by Claude Code
6. huangyiirene commented on Aug 11, 2026

   

   huangyiirene

   on Aug 11, 2026 – with Claude

   CollaboratorAuthor

   More actions

   Pushed 46dee87. A sixth rc.6 behavior change reached the app — recording it here because it is the one my first-pass gates could not have caught.

   ReportInput is retired from @objectstack/spec/ui. Read from the installed .d.mts, rc.5 vs rc.6:

   	rc.5	rc.6
   ReportInput	z.input<typeof ReportSchema>	removed
   Report	z.infer (parsed)	z.input (authoring)
   ReportParsed	z.infer	z.infer (parsed)

   So this is not a plain rename — rc.6 moved the bare name onto the opposite shape, under the ADR-0122 convention that X is the input type and XParsed the post-parse one. Report is therefore the correct replacement for ReportInput (identical underlying type), and the five src/reports/*.report.ts annotations now use it with their typing intent preserved.

   The part worth carrying to other apps making this jump: Action, Dashboard and Page swapped the same way. Because those names survived, any annotation already saying Report / Action / Dashboard / Page changed meaning silently rather than failing to compile. Only ReportInput, removed outright, announced itself. This app happens to use all four on authoring literals — the side the swap made more correct — so nothing broke behaviourally, but that was luck, not design. The rename and this trap are written into src/reports/index.ts so the next reader does not re-derive it.

   On the miss. pnpm typecheck was not in my verification list, and objectstack build does not typecheck app sources — so build, validate, lint, 1875 tests and a dev-server boot all passed green while tsc --noEmit had five errors. Type-level upstream changes are invisible to every other gate in this repo. typecheck is in my gate list from here on; it ran first this round.

   Now verified: pnpm typecheck / build / validate / lint all exit 0, suite 80 files / 1875 passed / 1 skipped. git fetch && git merge origin/main before pushing: already up to date (#595 / #1017 not landed yet). PR body change list updated to six.

   ---

   Generated by Claude Code
7. huangyiirene

   closed this as completedin #1066on Aug 11, 2026
8. huangyiirene commented on Aug 11, 2026

   

   huangyiirene

   on Aug 11, 2026 – with Claude

   CollaboratorAuthor

   More actions

   ACCEPT — PR #1066 reviewed and MERGED (e9c4996). The maintainer's order is fulfilled: every @objectstack/* pin is at 17.0.0-rc.6, both lockfiles regenerated, config/manifest carried across per #728.

   Review notes:

   • Diff scope matches the claim (pins + both lockfiles + config/manifest + the files rc.6 forced to move); no riders.
   • Two patch rounds, both diagnosed by signature rather than re-queued: (1) package-lock.json stale — this repo keeps two lockfiles and only pnpm-lock.yaml had been regenerated; (2) tsc --noEmit red on five src/reports/*.report.ts. The second was a real rc.6 breaking change and its root cause is worth keeping: pnpm typecheck was absent from the verification list, and objectstack build does not typecheck app sources — build, validate, lint, the full suite and a dev-server boot were all green while five type errors stood. Type-level upstream changes are invisible to every other gate in this repo.
   • The ReportInput finding is bigger than its own fix and is recorded in the PR body: under ADR-0122, Report/Action/Dashboard/Page swapped from the parsed shape to the authoring shape while keeping their names, so annotations using them changed meaning silently. Only ReportInput, removed outright, announced itself. This app uses all four on authoring literals — the side the swap made more correct — so nothing broke behaviourally.

   Upstream-mirror re-probe (the second deliverable of this card): 8 of 14 tracked cards changed behavior on rc.6. The table lives in the PR body; the follow-up sweep to re-test and unblock them is queued for the next round.

   ---

   Generated by Claude Code
9. claude

   added

   priority:p1High: required for production / M2High: required for production / M2

   and removed

   prio:p1

   on Sep 9, 2026