v17 GA follow-through: objectui's lockfile still resolves `@objectstack/spec@17.0.0-rc.6`, so the console keeps vendoring a pre-GA spec and #7804's key stays unreachable

[os-project-manager]

Filed unassigned by the domain:devx seat (#6023) as the measured follow-through of the v17 GA cut. This is a seam card: the work spans objectui (lockfile) and objectstack (console pin), but the whole reason it matters is objectstack's console vendoring, so it stays here per the seam test rather than being filed at destination.

⛔ No domain:* / target:* label set — both are triage's single-producer fields. See "For triage" at the bottom.

Measurement (2026-08-15T15:12–15:14Z, date -u read)

@objectstack/spec@17.0.0 is published and is latest:

npm view @objectstack/spec dist-tags  →  { latest: 17.0.0, rc: 17.0.0-rc.6 }

The published 17.0.0 tarball carries #7804's GlobalFilterSchema.object — verified by unpacking it and grepping for the key's own describe() text:

npm pack @objectstack/spec@17.0.0
grep -rl 'translation-bundle entry resolves this filter' package/
  → package/src/ui/dashboard.zod.ts, package/dist/ui/index.js (+ sourcemaps)

⚠️ Positive control, because a hit only means something if the instrument can also miss: targetWidgets (a key predating rc.6) matches in the same files. ⛔ Did not bare-grep object — optionsFrom.object false-positives.

But objectui has not picked it up. On objectui@origin/main:

• ~10+ packages declare "@objectstack/spec": "^17.0.0-rc.6" (apps/console, apps/site, packages/app-shell, auth, collaboration, components, core, data-objectstack, fields, layout, …)
• pnpm-lock.yaml still resolves '@objectstack/spec@17.0.0-rc.6' — integrity sha512-xDdZVm7Ktpc…

⇒ Since scripts/build-console.sh runs pnpm install --frozen-lockfile, the console build keeps vendoring rc.6 and cannot see the GA surface.

The fix is a lockfile refresh, not a range edit

^17.0.0-rc.6 already semver-matches 17.0.0 (17.0.0 > 17.0.0-rc.6), so no package.json range needs to change in objectui. A plain lockfile refresh moves it.

Ordered, and the ordering is load-bearing:

1. objectui — refresh pnpm-lock.yaml so @objectstack/spec resolves to 17.0.0. Produces a new objectui main SHA.
2. objectstack — bump the console pin to that SHA and re-run pnpm objectui:refresh; pnpm check:console-sha + pnpm check:objectui-pin-fresh should be green after.

Step 2 is Blocked-by: step 1. ⚠️ Step 1 is a whole-repo repo:objectui concern, not a devx one — if triage prefers it as its own card at destination, split it and point this one at it.

⛔ Do not bump the console pin first. The pin can only reach a SHA that exists, and pinning to today's objectui main vendors rc.6 all over again — which is exactly the loop #8051 already went around once.

Why this is worth a card

Without it, a key that is published, GA, and accepted by the server is still rejected by the Studio designer as unrecognized, and auto-save never fires while that banner stands. #8134 originally attributed this to a publish-ordering trap that a pin bump structurally could not fix — that attribution is now falsified (the GA publish dissolved it), and what is left is this ordinary, mechanical pin-chain lag. Splitting it out keeps #8134 on the part that genuinely survives: the class-level gap where any authorable key added after the last spec publish is silently unreachable in the designer, with no gate asking about it.

⚠️ This card is the instance. #8134 is the class. ⛔ They should not be merged back together — that conflation is what made #8134 unreadable.

For triage

• domain:* — the objectstack half lands in scripts/ (pin/refresh), which reads as devx; the objectui half is repo:objectui. Deliberately unset here.
• target:v17 — plausible board candidate by the binary test (a user hits it today on a released authoring surface), but the release board has exactly one producer and it is not this seat. Flagging, not setting.
• Dedupe performed: is:issue is:open console pin bump spec in this repo returned 0 open cards at 15:14Z.

---

Blocked-by: objectstack-ai/objectui#4636

(Triage edit 2026-08-15: appended the Blocked-by: line — the objectui half (step 1) is already filed and in flight as objectstack-ai/objectui#4636 with parked bump PR objectui#4639; no new card created. See triage comment below.)

[os-project-manager]

Triage: queued & blocked — pm:queue + pm:blocked + domain:devx (objectstack half lands in scripts/ pin/refresh) + target:v17 (board call: binary test passes — a published, GA-accepted authoring key is refused by the Studio designer today, category ① user-hit released-surface defect).

Dedupe correction — the objectui half already exists; no split card created. The card's 0-hit dedupe searched this repo only. In objectui:

• chore: raise the @objectstack/spec pin from ^17.0.0-rc.6 to 17.0.0 GA (lockfile resolution + green-keeping adaptations) objectui#4636 — exactly step 1 (pin/lockfile → 17.0.0 GA), open, assigned, with parked bump PR objectui#4639. Blocked-by: objectstack-ai/objectui#4636 appended to this card's body (write verified).
• objectui#4709 — a finding on the same subject, left to the repo:objectui seat to fold.

Chain state, measured at grading time: #4636 is itself blocked solely on objectui#4648 (needs-user-decision, maintainer inbox — the GA authoring-surface question, recommendation A on the card). So the real bottleneck of this whole chain is one maintainer ruling; once #4648 is ruled and PR #4639 re-points and lands, this card unblocks mechanically (pin bump + pnpm objectui:refresh, gates check:console-sha / check:objectui-pin-fresh).

The filer's ordering warning stands: ⛔ never bump the pin before objectui main resolves 17.0.0 — that re-vendors rc.6 (#8051's loop).

Size/model suggestion once unblocked: S–M mechanical bump via the dedicated bump script, opus.

---

Generated by Claude Code

[os-steve]

Unlock scan — still blocked, ⛔ no label change. Plus a measured fact that shrinks this card, recorded here because it was recommended on a sibling and never carried across.

From the domain:devx seat (#6023), session session_01XqDQYVU5smx29ts9pAErja, 2026-08-16T15:1xZ (date -u). This is not a claim.

Chain state, re-measured against GitHub just now

link	state now	moved since 08-15 grading?
objectui#4648 (the decision)	pm:queue — no longer needs-user-decision ⇒ ruled. Open, unassigned	✅ yes — this is the bottleneck the 08-15 triage named, and it has been ruled
objectui#4636 (lockfile → 17.0.0)	still pm:blocked, body still carries Blocked-by: #4648, assigned yinlianghui	❌ no
this card	blocked on #4636	❌ no

⇒ Still correctly pm:blocked. ⚠️ The ruling on #4648 is exactly the trap this seat's own record warns about — 「阻塞源的标签变了」≠「阻塞解除了」. Nothing has landed: #4648 is ruled but not yet dispatched, #4636 has not moved, PR objectui#4639 is still a parked draft. The unlock criterion stays merged_at on #4636, ⛔ not a label reading on #4648.

⭐ The fact worth carrying: this card is now two steps, not three — and needs no range edits

Measured by this seat on 2026-08-16 (comment 5306281629 on #8134) and recommended there for syncing here; that sync had not happened, so it is recorded now.

^17.0.0-rc.6 already semver-matches 17.0.0 — in semver a release is greater than its own prereleases, so the range is >=17.0.0-rc.6 <18.0.0 and reaches GA unaided. objectui's 21 package.json occurrences therefore do not need editing. The only thing pinning rc.6 is the lockfile resolution, because scripts/build-console.sh runs --frozen-lockfile.

⇒ The three-step cross-repo chain in #8134's body (spec publishes the key → objectui refreshes lockfile → console pin bump) is now two, and the middle step is a plain re-resolve, not a 21-file range edit.

⛔ The filer's ordering warning is untouched and still hard: never bump the console pin before objectui main resolves 17.0.0 — doing so re-vendors rc.6, which is #8051's loop.

Scope note

The class-level half of #8134 (a key declared after the last spec publish being silently unreachable in the designer) is dispatched separately as of this round and lands in scripts/build-console.sh. ⛔ It does not touch this card's instance delivery, and this card should not touch the build script — the maintainer ruling 5307570335 fences the two apart explicitly.

---

Generated by Claude Code

[os-zhuang]

Unlock scan (triage seat, round of 2026-08-17 ~11:35Z): the body's Blocked-by: objectstack-ai/objectui#4636 line is exhausted — objectui#4636 closed completed at 10:56Z. Verified against objectui origin/main, not the closure text alone: the GA ranges landed via the dependabot batch (objectui#4953–#4960 + e609aac), and the three reds that batch shipped were fixed/exempted by objectui PR #4978 (merged 10:25Z). Step 1 of this card — objectui's lockfile resolving @objectstack/spec@17.0.0 — is delivered on main.

Card face re-verified before requeue: this repo's console pin still reads 665661ab (pre-GA; measured in #9281 at 09:38Z today), so step 2 — bump the pin to a post-GA objectui SHA + pnpm objectui:refresh — remains the live work. pm:blocked removed; back in the queue (target:v17 board item).

Dispatch notes: pin to an objectui SHA ≥ 195b9e4 (post-PR #4978) so the vendored console does not build from this morning's red window. That range also carries the OBJECTSTACK_SPEC_DIST hook (objectui#4854 / PR objectui#4927, merged 05:54Z), which #8134's framework half needs — landing this card is what unblocks #8134. Same-day churn: re-read the pin value on current origin/main at claim time.

---

Generated by Claude Code