chore(deps): resolve @objectstack/spec at 17.3.0 in the lockfile - #7685

Part of #7122

⚠️ Three measurement epochs, not one. §7a is measured on 7be4b2456; §7's table on 901c4b867; §3's arithmetic on 34a1578ef. Each section names its own head — do not read one head across all of them. Base merged: origin/main f5d2acc35. Everything the previous round left red is now green locally, including the two ceilings the maintainer authorised raising.

⭐ This round applies the contract review's required remediation, which ruled needs:contract-review not dischargeable as it stands. The two items on this seat are done: the lookup guard's whitespace-only refusal is now a declared divergence rather than a silent one (§6 — and the message it prints is accurate for all four refused states), and the three package entries that graded objectui's own breaking behaviour patch are raised to minor with the breaking semantics written into the changeset bodies (AGENTS.md:239). §6 is replaced with the reviewer's own wording; two test-quality nits went with them. All of it is in §7a, measured on a freshly merged tree.

⛔ Still draft. ready not flipped, not enqueued, auto-merge not armed — review first.

⭐ What this round changed

⚠️ The previous body's red set (8 assertions / 6 files) was a measurement of a tree two heads back and has been rebuilt from this seat's own run, not patched. The real set on 2761082b7 was 7 files / 24 assertions. Section 2 gives the reconciliation.

1. origin/main was merged first, and it barely moved the payload

fa73d58a9 had already merged 900f8d995; this round merged 6bca0e4e8 on top (7 commits, clean, no conflicts, no file overlap with anything repaired here).

⚠️ The merge was worth doing for correctness — it makes the baseline the tree CI weighs, and keeps BASELINE.commit's "differs only by this file" claim true — but ⛔ it did not recover bytes. CI measured both sides: pre-merge e328e369c 3468.0 KB, merged 5ac59ff43 3467.8 KB. 6bca0e4e8's ActionCallback deletion is worth 0.2 KB. That is the finding; it is not a saving.

⛔ origin/main was deliberately not chased further. It moved again during the build (3f93fe47d); a tree that matches CI's merge ref exactly is impossible by construction, and the drift is what headroom is for.

⭐ Merged again before the §7a push, because by then the branch was 38 commits behind: f5d2acc35 is merged in at 7be4b2456, clean, no conflicts, 136 files, and — the reason it was not optional — the aggregate ceiling's 45.8 KB of headroom had been sized against ~4 commits of drift, not 38. ⛔ It did not cost bytes: see the merged-tree re-measure in §7a. No manifest dependency and no lockfile line moved in the merge (two scripts entries in the root package.json, one type-check script in packages/vscode-extension), so no reinstall was needed.

2. The real red set, and where each one went

24 assertions in 7 files, measured here before any repair and reproducing CI's aggregate exactly. All 24 are @objectstack/spec 17.3.0's, none is a regression this branch wrote.

Already red at the previous body's f389bec90, or new since? All four families are 17.3.0 effects and were present on the branch before the main merge — they were invisible to the old catalogue because that catalogue was written from a --project unit run, which is a subset: pnpm test (what CI shards) also runs the per-package projects and the dom projects, where every one of these 24 lives. ⭐ Nothing appeared because of the merge, and nothing disappeared without being fixed.

A — 14 assertions, one fix, and why it qualified as a family

Every one was expected '(message)' to contain '#7496', across five distinct refusal messages, while the sibling toContain('RELATIVE path only') assertions stayed green. 17.3.0 kept every refusal, its reasoning and its prescription, and restated provenance as (ruled 2026-08-11).

So the pins asserted the citation form, not the citation — the objectui#7702 defect shape, which main has since corrected in its own lane. They now assert the durable property through a documented CITES_ITS_RULING, which does the job the #7496 assertion existed for: discriminating the spec's own prose from a locally hand-written sentence (the load-bearing mutation probe in ObjectForm.submitRedirect.test.tsx's header depends on exactly that).

⚠️ Corrected in §7a, and the review was right to catch it. That regex was first written /\(ruled \d{4}-\d{2}-\d{2}\)|#\d{3,}/, and the loose alternative discriminated nothing — this repo's own hand-written messages routinely cite objectui#NNNN, so a local sentence satisfied it, which is exactly the case the assertion exists to reject. It was also unnecessary: measured on both installed artifacts, 17.2.0 prints (ruled 2026-08-11 on #7496) and 17.3.0 prints (ruled 2026-08-11), so the issue number never appears outside that parenthesis and (ruled + a date already matched both. It is now /\(ruled \d{4}-\d{2}-\d{2}(?: on #\d{3,})?\)/ — both upstream spellings still match, a bare local #7122 no longer does.

⛔ Not re-pinned to the new prose verbatim, which would move the brittleness one release along instead of removing it.

B — three exemptions the contract outgrew

Four of the five reds were one fact wearing four assertion names, two of which appear to contradict each other ("a published key must lose its entry" vs "spec no longer declares object-grid.defaultSort"). Resolved against the installed artifact, not the assertion names: neither reading is right. 17.3.0 made object-grid.defaultSort an ADR-0087 D2 tombstone — member is z.never().optional(), description opens [REMOVED] … removed in @objectstack/spec 17 (ADR-0049), and safeParse answers invalid_type expected: 'never' at that path. It left the authorable set while staying listed, which is precisely how the eight tombstones before it were harvested. Its exemption, its GA-pending entry and its carve-out row are deleted.

The block's prose claiming a tombstone "would NOT make them stale here" is corrected — its own cited counter-example, the record_picker trio, was harvested exactly that way.

The fifth emptied OFF_SPEC_ARM_EXEMPTIONS entirely. Both arms converged upstream in the direction their own reasons named, measured with the gate's own probes:

• element:number.filter accepts [] and judges content at filter.0 — objectui#6206's first option, "widening the spec entry to the ViewFilterRule array form every sibling filter uses";
• object-grid.data answers invalid_union at data.provider, i.e. the discriminated ViewDataSchema shape ObjectGridSchema.data already resolved to — objectui#6207's "convergence is upstream".

⛔ Neither was closed by editing a declaration; both declarations are byte-identical. objectui#6206 and objectui#6207 are closable as resolved-upstream.

C — two negative pins, re-derived rather than inverted

• object-master-detail-form.formType pinned that the manifest enum does not make a value unpublishable. 17.3.0 closed that gap deliberately — invalid_value naming the honoured pair, plus a bespoke prescription for the near-miss wizard citing ADR-0001 and the renderer measurement behind it. Graded as an intended tightening, so the pin now records that both authorities agree, checks each independently, keeps a positive control on simple/tabbed, and pins the refusal's shape so "the enum closed" cannot be confused with a dropped key or a cross-field rule.
• LocationField.optionalKeys pinned that the location value schema is non-strict. 17.3.0 closed the shape (unrecognized_keys, naming the retired latitude/longitude pair and prescribing the rename). The test carried a note for this exact event — "if the spec ever turns strict, the guard could then be delegated to it" — and the re-derived answer is no: the fence guards the object handed to onChange, and no parse stands on that path, so strictness changed the consequence of a spread regression (a loud refusal at the next parsing boundary instead of a silent survival), not the widget's exposure to it. The key-level assertions stay and now say why; the strictness itself is pinned.

D — the ninth platform capability

17.3.0 declares manage_org_presentation and the curated set carried eight, so the picker fell back to the registry's English label in every locale — the exact defect objectui#6285 filed when manage_sharing did this. objectui#6285 already ruled the curated set is the spec's set in both directions, so carrying the name executes that ruling.

The English label is the spec artifact's own (Manage Organization Presentation), read off the installed build. It is authored everywhere the widget's docblock requires: useFieldTranslation.ts and all ten locale packs. ⚠️ The nine non-English strings are composed from each pack's own established sibling vocabulary (manage_org_users, manage_platform_settings) rather than machine-translated — a native review pass is welcome on them; nothing behavioural depends on the wording. check:i18n-keys (now 114 exactly-checked members, was 113), check:i18n-drift and check:i18n-dead-keys all exit 0.

3. ⭐ The ceiling raise — authorised, and what the bytes buy

Raising a gate ceiling is a gate weakening and sits on the manual floor, so it is a human's decision. The authorisation, verbatim:

维护者 sam@objectstack.ai 于本轮明确授权：「抬上限，把 7685 弄绿」

recorded on #7122 as decision batch 1 item 1 = B + A — a one-time, cause-recorded adjustment of exactly the measured delta, with the upstream card filed alongside.

⛔ This is not routine growth and must not be read as one. The residue is @objectstack/spec 17.3.0's own browser-dist growth: +292.2 KB gzip on the spec package alone, whose measured mechanism is that 17.3.0 lengthened the Zod .describe() doc strings shipped in the browser build. It is authoring documentation prose, delivered on every page load.

⛔ It is not duplication. That was the larger, separate problem and this branch already fixed it by moving the @objectstack/* family together in the lockfile: −671 KB, with markers unique to 17.2.0 falling from 92.3% to 1.0% of 104 and the single survivor accounted for. No chunk entered or left the closure; the eager chunk count is unchanged.

⇒ ⭐ The honest long-term fix is upstream, and this ceiling is its marker, not its answer. A describe()-stripped browser build returns ~292 KB to every consumer of the spec, not just this console. Filed as objectstack#16063, and recorded in the gate as the restore condition: when it lands, re-measure and bring ceiling and baseline back down together.

The arithmetic, so the sensitivity constraint is checkable by reading

Four constants, two ceiling/baseline pairs. Measured by pnpm build (exit 0, 43/43) reading apps/console/dist/eager-closure.json on 34a1578ef — ⛔ not taken from CI's report, not from an earlier round, not extrapolated.

Both are strictly below the 91,136-byte regression the gate exists to catch, so it still reds on a repeat of objectui#5266 — the ceiling is not decorative. Both match the proportion the file already used rather than a newly invented one. Headroom also absorbs the unclosable merge-ref gap: CI's merged-head reading is 3,551,027 bytes against this tree's 3,551,191, a 164-byte difference.

BASELINE.commit names 34a1578ef. ⚠️ The usual invariant — the named tree differs from the pushed tree only by the checker, its unit test and this changeset — held when the raise was written (observed, not argued: the re-read build reported 43/43 tasks CACHED on that commit), and is no longer true of the current head: 7be4b2456 merged 38 commits of origin/main plus three authored commits on top of it. The baseline is nonetheless still sound, and by measurement rather than by argument — §7a re-ran check:eager-closure on the merged tree and the aggregate came in at 3,551,183, eight bytes below the pinned 3,551,191. Read §7a's re-measure as the live figure; this section is the derivation that produced the constants.

⛔ No other ceiling was moved. The three per-chunk lines that still pass were left exactly as they are, and they are reported here because two are tight:

⚠️ The ten capability labels added by this PR cost +141 bytes in i18n-locales, which fits — so this is not a third ceiling/baseline pair and is deliberately not presented as one. ⛔ No exemption added, no import made lazy.

check:eager-closure exits 0 with Ceiling sensitivity ✅ on all five ceilings. Ceiling freshness reports "not applicable to a local run" (it compares a merge ref against the branch it would land on); CI evaluates it.

4. The two rescue commits — what was verified, and what was changed

9c1a1ac5f and 2761082b7 were PM rescue commits carrying work two killed agents never gated, both marked INCOMPLETE AND UNREVIEWED. Nothing in them was assumed correct. Every load-bearing claim was re-measured against the installed 17.3.0 artifact:

Changed rather than kept: nothing in the rescue commits was reverted. The corrections this round made are in files the rescue commits did not touch (sections 2A–2D), plus the budget file.

5. ⚠️ Ownership flag — the lookup guard is #7714's work, and it is here

#7122's ruling of 2026-09-05T23:00Z (item 4, A1) says the designer hunks "belong to #7714's PR — the driver either moves them there or drops them from this branch; ⛔ not both places."

They are currently in one place: this branch. #7714 is pm:queue, unassigned, with no PR, so "moving them there" would mean opening a PR in another card's lane, which is outside this dispatch's fence. They were kept rather than dropped because dropping them destroys a verified product fix and leaves a known-broken save path, and re-adding is cheap.

⇒ This needs a decision before landing, and it is not this seat's to make: either #7714 closes as delivered-here (and its dogfood reproduction becomes its own follow-up), or its owner takes these hunks and they come off this branch. ⛔ They must not land twice. The work is preserved in this branch's history at 9c1a1ac5f either way.

6. Clause ② — yes, on three authored repairs and on the inherited set

Authored by this branch (objectui's own accept/refuse or surface changes):

• @object-ui/app-shell MetadataService.saveFields / saveObject and @object-ui/plugin-designer MetadataFieldsPage now refuse a lookup / master_detail field whose reference is missing or empty, before any PUT (previously PUT, and accepted by a 17.2.0 backend). Objectui-authored, ruled When bumping @objectstack/spec past objectstack#14075: list-view spec-parity pins need the CalendarConfig titleField-optional update #7122 item 4 = A; measured against the installed 17.3.0: exactly those two of FieldSchema's 49 types are refused at reference (custom), and the whole ObjectSchema document fails with them. Ownership per ruling A1 is open (§5). ⚠️ The guard also refuses whitespace-only reference, which the spec accepts — declared deliberate, on the ground that a whitespace-only reference names no object at all, so admitting it would only move the identical failure past the PUT into a stored document. Declared in both writers' docblocks, in the changeset and in the refusal message itself, pinned in both writers' tests, and the spec's acceptance of ' ' filed upstream as objectstack#16126.
• @object-ui/components registerPlaceholders() no longer registers user:profile; a page naming it renders "Unknown component type" in opted-in hosts. @object-ui/cli objectui check now warns on that type (exit code unchanged). Ruled B1; upstream objectstack#14159.
• @object-ui/core SPEC_ACTION_KEYS gains operation / patch, so classifyActionKeys and the dev-mode unknown-key warning stop reporting them (ruled item 3; recorded in the inventory because the forward-parity gate's owed set has no runtime reader for either key). @object-ui/types ObjectSchemaClientExtensions is retired to Record<never, never>; ObjectSchemaMetadata.editMode is now carried by the spec (ruled item 2).

Inherited from @objectstack/spec 17.3.0, reaching this repo's console build and test corpus through the lockfile (consumers on ^17.x already resolve 17.3.0 — npm latest since 2026-09-04): formType narrows to simple | tabbed (invalid_value); object-grid.defaultSort is an ADR-0087 tombstone (invalid_type expecting never); FieldSchema.reference required on the two relationship types; PageComponentSchema refuses user:profile by name — which the Studio save gate (validateMetadataDraft → PageSchema) now enforces; element:number.filter record form and object-grid.data array form refused; location values strict. ⛔ None of these is a product-path change in objectui except the Studio user:profile refusal: the Studio gate does not validate block properties, no runtime path parses ComponentPropsMap, and objectui's manifest gate already refused formType: 'wizzard' (objectui#5939).

Contract-neutral: the #7496 re-pin, the two re-derived negative pins, the exemption harvests, the manage_org_presentation label (selectability is the server registry's; only the label localises), the flow-inspector renames (not on any published entry), the ValidationPanel label, the data-objectstack type alias, the ceiling raise (§3).

needs:contract-review stays on both carriers until the tier review passes.

7. Gates

Exit codes captured before any pipe (cmd (redirect) file 2(redirect)1; EXIT=$?), and every verdict read from the gate's own printed line rather than a bare $?.

⚠️ The unit-suite figure is the full pnpm test, not --project unit. The previous body's suite numbers came from the latter, which is a subset — that is why its red set was smaller than CI's.

7a. The contract-review remediation, and its gates on the merged tree 7be4b2456

What changed, file by file. 8 source/test files and 3 changesets.

Gates. Exit codes captured before any pipe, all on the merged tree.

⭐ The merged-tree closure re-measure — the margin, on the record

38 commits of main cost the eager closure nothing, and returned 613 bytes on framework. ⛔ No constant was edited; every ceiling below is the one this PR already carries.

The three lines the review flagged as passing but tight are all still passing: two are byte-identical across the merge and framework gained 613 bytes of room. The aggregate came in 8 bytes below the pinned BASELINE.gzipBytes, so the raise the maintainer authorised still covers the payload with the same 0.50x proportion it was sized at, and no second raise is needed or taken.

8. Still open, with owners

Generated by Claude Code