Upgrade the @objectstack/* dependencies from 17.4.0 to 17.7.0, walking the official upgrade checklists of 17.5, 17.6 and 17.7

Ruled: 6393739591 · letter C · 2026-10-25T05:02Z

Unblocked: the 17.7.0 → 18.1.0 upgrade landed as PR #110 (7b736a0).

Maintainer directive, 2026-10-09, verbatim: 「按照官网文档，objectstack平台升级到 17.7，并继续派发任务。」

@objectstack/* 17.7.0 was published to latest on 2026-10-06. This card moves the app onto it the way the official docs say to, and proves the app still works on a real boot in a real browser — not by the version string changing. Precedent for the shape: #35 (17.3.0 → 17.4.0, PR #37).

Where the repo is (readings, 2026-10-09)

Reading	Value	How
Declared range	`^17.0.0` on `@objectstack/spec`, `runtime`, `plugin-hono-server`, `cli`	`package.json` @ `origin/main` `14c899f`
Resolved pin	17.4.0, every `@objectstack/*` package	`pnpm-lock.yaml` @ `14c899f`
`latest` on npm	17.7.0	`npm view @objectstack/spec dist-tags` → `{"latest":"17.7.0"}`
Protocol	`engines.protocol: '^17'`	17.7.0 still implements protocol 17 — ⛔ leave both protocol declarations on 17

So this is three minor releases (17.5, 17.6, 17.7), not one.

"The official docs" — what to follow, exactly

Published from objectstack-ai/objectstack → content/docs/; read them on origin/main (35ef501 at filing):

/docs/upgrading (content/docs/upgrading.mdx) — Moving the dependency pins (bump every @objectstack/* dependency together, to the same version, devDependencies included; regenerate and commit the lockfile, reading the peer-dependency warnings it prints; check the two protocol declarations) and The loop (os validate before os build).
/docs/releases/v17/17-5, 17-6, 17-7 (content/docs/releases/v17/17-{5,6,7}.mdx) — each page's Upgrade checklist and Breaking changes & migration. The docs say: one checklist per release, for the release you are landing on and every release you cross to get there — so all three are walked.

⚠️ Those checklists say how far they have been walked: 17.5 — 7 lines exercised (on HotCRM); 17.6 — 19 lines exercised (HotCRM); 17.7 — not exercised at all. A line marked Not exercised is accurate about what changed and unproven about what it costs. This app is the first to cross 17.7; record what each line actually cost here.

Exposure the PM measured — leads, not answers

Counts are git grep -nE PATTERN origin/main -- src objectstack.config.ts scripts on 14c899f. Same-instrument controls: Field\.select\( → 39 hits, approval → 255, so the instrument sees src/.

⚠️ Scheduled work is off until a deployment turns it on (17.5). src/flows/_daily-sweep.ts:181 builds type: 'schedule' flows and src/flows/expiration-sweep.flow.ts:52 declares a cron. That is card 09's reminder layer — M3's acceptance 「到期、逾期提醒在收件箱可见」. After the bump the sweeps do not run unless OS_AUTOMATION_SCHEDULED_WORK_ENABLED=true. Measure it (os doctor prints the effective value). If restoring the behaviour for pnpm dev / pnpm demo is a mechanical env setting, do it and say where; if it needs a product choice, stop and return needs_decision with options and a recommendation.
The TEMPORARY FIXTURE in pnpm-workspace.yaml (overrides: pinning the @better-auth/* family to 1.7.2) says remove when objectstack-ai/objectstack#16186 lands. That issue is closed completed (2026-09-07), and the 17.5 checklist says to move the @better-auth/* members to exactly 1.7.3 together. The fixture is ours to delete — delete it only after a boot proves the auth plugin loads without it; measured, not assumed.
subCaption — 3 hits; 17.7 retires the widget translation subCaption key.
breadcrumb — 1 hit; 17.6 deletes page:header breadcrumb.
funnel|'pie'|donut — 13 hits; 17.7 refuses pie/donut/funnel widgets with a dimension and two or more values; 17.6 refuses dimensionless ones.
Field.select( — 39 hits; 17.7 refuses select/radio with neither options nor picklist.
Approvals — src/flows/ approval nodes: 17.7 holds them to ApprovalNodeConfigSchema and deprecates an approver type over a position name.
src/datasets/ — 17.6: a dataset member field must be a column reference; 17.6 also re-types analytics.
Security — 17.5 RLS fails closed on what it cannot enforce; 17.6 gives a caller that resolves no permission set the deny baseline and takes FLS to every query door. This app binds several audiences; the browser pass must cover more than the admin.

Measured absent (re-verify before relying on it): defineJob 0 · type: 'api' 0 · authRequired 0 · globalActions 0 · resizableColumns 0 · 'heading'|'subheading' 0 · sortField 0 · formViews 0 · refreshKey 0 · publicPicker 0 · picklist 0.

Declared increment — #31's unlock probe, report only

#31 is pm:blocked; its criterion is 「本仓升到含该修复的版本后那条错路确实报错」. Its upstream (objectstack-ai/objectstack#16737, AVG() over a Field.datetime) is closed completed (2026-09-10), and #80 measured on 17.4.0 that the wrong path still renders -0.86. Re-run #80's probe on 17.7.0 — #80's report is the recipe — and say which of the three outcomes holds (errors · renders nothing · still renders a plausible number). ⛔ No code for #31; the probe dataset is never committed and the tree is restored byte-identical. What #31 becomes is the seat's call.

Acceptance

pnpm verify — all four gates exit 0, each exit code captured before any pipe.
package.json: all four @objectstack/* dependencies moved together to ^17.7.0. pnpm-lock.yaml shows 17.7.0 for every @objectstack/* package and is committed.
os migrate meta --from 17 run; its output filtered for the refusals that name this app's sources, and each one resolved or explained. ⛔ Nothing to migrate is not completion of the checklists.
A per-release checklist table in the PR body — 17.5, 17.6 and 17.7 — one row per checklist line: applies (what you did, with the reading) · does not apply (the reading that shows it) · blocked (why). This table is what 「按照官网文档」 means.
A boot-log diff against main — same seed, clean .objectstack/data, both read at seeder quiescence (row count stable and log stable), not at the ready banner. Report new warnings, dropped fields, and any System started with degraded capabilities or plugin that failed to load.
Browser (pnpm dev --seed-admin, Chromium at /opt/pw-browsers/, ⛔ no playwright install): sign in; 我的合同; the contract detail page's tabs; every dashboard; the inbox reminders (the scheduled-work risk); one step of the approval path; one non-admin audience; one pass in zh-CN. Report what the browser and console did, not what you expect.
⛔ Bump and migrate only. A 17.5–17.7 capability that would make an existing workaround obsolete is reported, not adopted here — a separate card. A source comment the bump makes false is corrected; a comment that is merely improvable is left.
⛔ No governed surface: AGENTS.md · CLAUDE.md · DESIGN.md §01–§04 · LICENSE · CHANGELOG.md · docs/design/**. If the bump makes governed prose stale, list it in ## Acceptance notes.
If a breaking change needs a product decision rather than a mechanical migration, stop and return needs_decision with options and a recommendation. ⛔ Do not decide it in the diff.
A platform defect found on the way goes into the report with symptom, minimal repro and version; the seat files it upstream.

Claim: PM loop round 7
Session: session_01HihZ11bQSqjCgjzHbpv4M1
Account: zhuangjianguo (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-82-objectstack-17-7
Worktree: hotclm-issue-82
Domain: repo:hotclm (single-lane sister repo — no domain:*)
Seat: repo:hotclm#1
File surface: package.json · pnpm-lock.yaml · pnpm-workspace.yaml · src/** · scripts/** · README.md (only if run instructions change) — stop on breach; explain in the report
Container & model: L, mode:subagent, model: opus (TIER_DEFAULT; hand-derived — dispatch-gates --tier refuses a sister repo from an objectstack checkout)
Clause-②: no
Responsibility: n/a — not a defect card
Thread-read: none
Serial constraints cleared: PR #81 (#78) holds AGENTS.md · CLAUDE.md · docs/backlog/README.md — disjoint from this surface, and this card is forbidden all three; no other card in flight
Read at: 2026-10-09T14:37Z

Maintainer direct dispatch — the instruction, verbatim, given to this PM session on 2026-10-09: 「按照官网文档，objectstack平台升级到 17.7，并继续派发任务。」

The dev inherits this claim and the assignee: it checks that this is the newest Claim: on the thread and that it names its branch, and ⛔ posts no second claim and never writes the assignee field.

Generated by Claude Code

chore(deps): move @objectstack/* to ^17.7.0; drop retired currency sc…

os-dev-report

{
  "issue": 82,
  "status": "needs_decision",
  "branch": "claude/issue-82-objectstack-17-7",
  "pr": "https://github.com/objectstack-ai/hotclm/pull/85",
  "session": "session_01HihZ11bQSqjCgjzHbpv4M1",
  "premise_still_valid": true,
  "summary": "All four @objectstack/* deps moved together to ^17.7.0; lockfile committed with 53 distinct @objectstack/* packages all at 17.7.0 and zero 17.4.0 strings; protocol declarations left on 17. The 17.5/17.6/17.7 checklists are walked line by line in PR #85 (115 rows, each applies / does not apply / not converging, with the reading and which DB it ran on: fresh 17.7 DB and an in-place 17.4-created DB). Forced edits only: 6 retired `scale` keys on currency fields (os validate exited 1), the retired page:header `breadcrumb`, the better-auth 1.7.2 TEMPORARY FIXTURE removed (measured: keeping it on 17.7 refuses the dev-admin seed on `sys_account.issuer` and sign-in answers 401; without it all eleven family members resolve to 1.7.3 and auth works on both DB paths), 36 zh-CN keys the 17.7 i18n coverage now demands (the intake wizard's flow copy plus the record header) because lint:i18n-gate exited 1, and comments/printed operator text the bump made false (owner_id is now claimed for the dev admin on every seed settle; the inline-translation rationale is superseded from 17.5). Boot, seed (820 rows, per-column identical), browser (5 audiences, 7 tabs, 3 dashboards, inbox, one approval step, zh-CN) and #31's probe (17.7: errors at every door) are all measured. Status is needs_decision for exactly one item the dispatch defined as a product choice: whether pnpm dev / pnpm demo turn 17.5's scheduled work back on. Not decided in the diff; the PR says `Part of #82` for that reason.",
  "gates": {
    "head": "56c7501",
    "validate": 0,
    "lint": 0,
    "typecheck": 0,
    "lint:i18n-gate": 0,
    "how": "one locked batch, each exit code written to its own file before any pipe; tails in the PR body"
  },
  "line_budget": "n/a — this card carries no line budget",
  "files_changed": [
    "package.json",
    "pnpm-lock.yaml",
    "pnpm-workspace.yaml",
    "scripts/demo.mjs",
    "src/dashboards/executive.dashboard.ts",
    "src/dashboards/finance.dashboard.ts",
    "src/dashboards/legal.dashboard.ts",
    "src/data/contract.seed.ts",
    "src/data/keys.ts",
    "src/objects/approval-rule.object.ts",
    "src/objects/contract.object.ts",
    "src/objects/payment-plan.object.ts",
    "src/pages/contract_detail.page.ts",
    "src/translations/en.ts",
    "src/translations/en/app.ts",
    "src/translations/en/flows.ts",
    "src/translations/zh-CN.ts",
    "src/translations/zh-CN/app.ts",
    "src/translations/zh-CN/flows.ts"
  ],
  "tests": "GATES on 56c7501: VALIDATE_EXIT=0 (49 author-time rules, '✓ Validation passed (1341ms)'), LINT_EXIT=0 ('6 suggestion(s)'), TYPECHECK_EXIT=0 ('tsc --noEmit', no output), I18NGATE_EXIT=0 ('COVERAGE : 0 missing keys across 2 locale(s)'). Baseline main@14c899f (17.4.0): all four 0, validate 44 rules, lint '21 warning(s), 5 suggestion(s)'. On 17.7 before fixes: VALIDATE_EXIT=1 (6 x `scale` on currency) and I18NGATE_EXIT=1 (36 missing zh-CN keys). || MIGRATE META --from 17: first run 6 refusals (all src/objects scale) + 38 mechanical + 304 generic to-dos; on 56c7501 schemaValid true, 0 refusals, 37 flow-decision-mode-inclusive-explicit offers declined after dumping all 37 decisions (each an explicit partition), 0 data migrations. validate --strict exits 1 on the 7 existing advisories only (gate does not use --strict). spec-changes.json release 17.6.0->17.7.0: 50 added / 15 removed / 0 converted / 0 migrated. || AUTH: 17.7 + 1.7.2 fixture: 'WARN [auth] dev admin seed skipped: Unknown field 'issuer' on object 'sys_account'', POST /api/v1/auth/sign-in/email 401, sign-up 403 SELF_REGISTRATION_CLOSED. Without it: sign-in 200, get-session 200; in-place DB: 17.4-created admin and requester sign in 200, admin/create-user 200, new account signs in 200. || BOOT DIFF (pnpm demo, clean DB, 6 stable reads + 90s log silence): inserted 820 / errored 404 both sides; rows per table identical; 268 columns' non-null counts identical except platform owner_id (NULL x820 on 17.4, Dev Admin x820 on 17.7); plugins 38 -> 41; flows 9 bound -> 3 bound; no degraded-capabilities / plugin-failed line either side; the two 17.4 platform ERROR lines (_objectstack_sequences, sys_oauth_resource UNIQUE) gone on 17.7. || IN-PLACE DB (b): account-issuer clean (11 rows), plan 0 changes, apply --allow-destructive --yes 0 destructive (issuer column remains), meta --stored 0 rows, audit-metadata-bodies 0 rows; 17.7 pnpm dev boot ready, 820 rows intact. || BROWSER (Chromium 1194, Playwright 1.56.1 global, no playwright install): BR1 Launched by Me 43 rows; contract detail 7 tabs; inbox '9 total · 9 notifications · 0 pending approvals' after one manual run of each job; 3 dashboards, 19 analytics calls all 200; approval: LC2 Send for Approval refused by the app's own gates twice (open deviation; no approved review), then 200; GM Waiting on Me -> Approve -> Confirm: POST /api/v1/approvals/requests/ID/approve 200, contract approved + approved_at, BR1 notified; zh-CN pass incl. the intake wizard now Chinese and the header still interpolating. Requester analytics = /data (43/43; counsel 120/120; admin 120/120). || SCHEDULED WORK: os doctor 'OFF (the default)' / 'ON' with the var; manual POST /api/v1/automation/NAME/trigger 200 x6 with the switch off, 45 inbox rows; with the var set, 9 of 12 bound and boot diagnostics 9 -> 2. || #31 PROBE on 17.7.0: author time validate 1 / build 1 (measure-aggregate-field-type-refused x2), typecheck 0; PUT /api/v1/meta/dataset/probe31_cycle 422 INVALID_METADATA (nothing stored); POST /api/v1/analytics/query avg(submitted_at) 400 INVALID_FIELD 'query was NOT run'. Outcome: errors. First author-time run was a non-measurement (refused on a newly required dataset `label`), re-run with only label added. Restore proved by state twice: git status --porcelain empty, git diff HEAD 0 bytes, hash-object src/datasets/index.ts = HEAD blob 14ce0601805306c73537a3b724ece7451ea7b67f, probe file absent. || PRE-EXISTING CHECKS against 17.4 (detached main checkout over the same DB): non-admin 403 on sys_activity/sys_comment/sys_attachment/sys_approval_request identical; clm_admin 403 editing an in_review contract identical.",
  "mcp_calls": "0 — no MCP GitHub tool was called; every GitHub read was REST (gh api) and every write went through scripts/pm tools",
  "api_writes": "3 — each via the fleet-write relay (POST /repos/objectstack-ai/objectstack/dispatches, executed as objectstack-fleet[bot]): (1) pr_create -> POST /repos/objectstack-ai/hotclm/pulls, draft, #85, read-back 36907/36907 bytes identical; (2) label-write.mjs --assign -> POST /repos/objectstack-ai/hotclm/issues/85/assignees, read-back matches; (3) this report -> POST /repos/objectstack-ai/hotclm/issues/82/comments. Plus git push of the branch (5 commits). No label writes, no ready flip, no merge.",
  "deviations": [
    "PR body opens `Part of #82`, not `Fixes #82` as the dispatch asked: this report is needs_decision, and the os-dev definition forbids Fixes on a card that may enter the decision box (merge would close it silently). The seat can rewrite the line once the decision lands.",
    "GitHub writes went through the fleet-write relay (dispatch to objectstack-ai/objectstack, executed on hotclm as objectstack-fleet[bot]) rather than direct repo-scoped REST, per the os-dev definition's cloud-container rule; the executed requests are exactly the budgeted ones.",
    "Browser pass ran on `pnpm demo` plus the README operator setup (and a re-run to hand rows over), not on `pnpm dev --seed-admin`, which is an empty app with nothing for 我的合同, dashboards or the inbox; precedent PR #37. A plain `pnpm dev` boot was used for the zh-CN wizard check and the in-place path.",
    "Approval step setup used two API writes on the local dev server: Business Requester 1's manager via POST /api/v1/auth/admin/set-user-manager, and the pending legal review recorded as approved by its legal counsel via PATCH /api/v1/data/clm_review/ID. The approval step itself (Send for Approval, Approve, Confirm) was driven in the browser.",
    "Source edits beyond the bump, all inside the claim's file surface and each forced: 36 zh-CN keys (lint:i18n-gate exit 1) with an en mirror; comments and pnpm demo's printed note that the bump made false; dated 'superseded' notes on the dashboards/page inline-translation rationale. README not touched.",
    "Scheduled work was not changed for pnpm dev / pnpm demo: per the dispatch's own example this is a product choice; returned as needs_decision with options.",
    "Zone 2 assumption 1 holds only in part: scheduled work being off disarms the clock, but the reminder layer still runs when triggered (manual triggers 200 with the switch off). Assumption 2 confirmed (keeping the fixture breaks sign-in). Assumption 3 confirmed (errors). Assumption 4 confirmed for row counts and per-column values, with one difference: platform owner_id is now claimed for the dev admin. Assumption 5: the re-grep found two exposures the card's list did not name (`scale` on currency fields, the i18n flow/page coverage) and showed the 3 `subCaption` hits are comments.",
    "A second detached checkout of main (hotclm-issue-82-baseline) was created to measure 17.4 behaviour against the same database, used read-only, and removed; both worktrees are removed after the push.",
    "#31 author-time probe needed two runs: the first was refused on a newly required dataset `label` before reaching the aggregate check, recorded as a non-measurement, not as a result."
  ],
  "open_questions": [
    {
      "question": "17.5 turns package-authored scheduled work OFF by default. Should the shipped local commands turn it back on? Measured on 17.7: the six daily jobs register but do not arm (`bound=False — disabled by deployment policy`); triggered by hand they still run and write the inbox; with OS_AUTOMATION_SCHEDULED_WORK_ENABLED=true 9 of 12 flows bind (17.4's count) and boot diagnostics fall from 9 warnings to 2. `os dev` reads .env.development* but .gitignore excludes .env.*; `os start` does not read the development files. The jobs mutate data at 06:00/07:00 UTC.",
      "options": [
        "A — ON for both pnpm dev and pnpm demo (committed .env.development plus a .gitignore exception, or a wrapper script for dev). Restores 17.4 locally; adds a committed config surface where secrets usually live.",
        "B — keep the platform default everywhere and document it: README says a deployment that wants M3's reminders sets the variable; locally a job runs via POST /api/v1/automation/NAME/trigger. Smallest; every boot keeps six notices that AGENTS.md's boot-warning rule reads as non-passing.",
        "C — ON for pnpm demo only (scripts/demo.mjs passes the variable to the demo boot) plus the README deployment sentence; pnpm dev, the empty app with nothing to sweep, stays on the platform default."
      ],
      "recommendation": "C. Business need: M3's 「到期、逾期提醒在收件箱可见」 depends on the deployer's environment in every option, so the README sentence is needed regardless; the showcase is where an evaluator expects the jobs armed, and pnpm dev has nothing to sweep. Long-term: C keeps repo-level policy to one command and out of git; B matches the platform contract exactly. AI-error: 'verified locally, silently off in production' is loud in every option (production boots print the notices), but normalising six warnings on every verification boot (B) erodes the repo's own boot rule, and a committed .env.development (A) is where an agent later drops a secret. Startup focus: B smallest, C one env entry plus a README sentence, A a file plus a .gitignore exception. B is coherent if the maintainer prefers zero repo policy."
    }
  ],
  "out_of_scope_findings": [
    "class: b · reach: public door `os migrate account-issuer` and the 17.7 boot's `[schema-drift] sys_account.issuer … orphaned` line both prescribe `os migrate apply --allow-destructive`; run on a 17.4-created SQLite DB with requires:['auth'] it answers `0 destructive` and the column stays, and the pre-flight repeats the same prescription (17.7.0) · Seam: spec:sys_account.issuer retirement (better-auth 1.7.3) → runtime: os migrate plan/apply composes 0 plugins and examines 20 tables, sys_account only listed as an undeclared platform table · harmless here (nullable, NULL passes the unique index) but the 17.5 checklist's 'expecting zero' never arrives · platform defect: report, the seat files upstream · dedupe words: account-issuer, sys_account.issuer, migrate apply allow-destructive, schema-drift orphaned",
    "class: a · reach: browser, zh-CN console on 17.7.0: the intake wizard's heading, labels and placeholders translate, but the screen body text and select options (`Head office`, `USD — US Dollar`) render English, and the `flows` translation face has no key for either (the schema's guidance excludes screen `description`) · platform limitation: report, the seat routes upstream · dedupe words: flows translation face, screen field options, screen description, i18n flow screen, zh-CN wizard",
    "class: a · reach: PATCH /api/v1/data/clm_contract/ID as the dev admin in the clm_admin position answers 403 for a contract past `submitted` (and its child review edit is refused 'master not editable … row-level security'), identical on 17.4.0 and 17.7.0, while README says clm_admin 'holds full reach over every CLM object'; cause: every position also binds clm_requester, whose using-only `contract_requester_edit_window` is the only applicable update policy · pre-existing app behaviour, not this bump · dedupe words: clm_admin edit, contract_requester_edit_window, modifyAllRecords RLS, position binds clm_requester",
    "class: a · reach: browser as Business Requester 1 / Legal Counsel: the contract page's Discussion tab reads 'You don't have permission to view activity/comments on this record' and the Approvals tab is blank; network 403 PERMISSION_DENIED on sys_activity, sys_comment, sys_attachment, sys_approval_request; identical on 17.4.0 (same calls replayed) · pre-existing · dedupe words: discussion tab permission, sys_comment 403, sys_approval_request requester, approvals tab empty",
    "carrier: 承接者:无 · noted, not filed: 17.5's `pages.NAME.components.ID.*` on slotted pages and `dashboards.NAME.globalFilters.*` make the 22 inline {en,'zh-CN'} labels on contract_detail and the inline filter copy on the 3 dashboards an obsolete workaround (dated notes added in 56c7501); the card says report, not adopt — the seat decides whether it becomes a card",
    "carrier: 承接者:无 · noted, not filed: pure interpolation templates (`pages.NAME.title` = `{contract_number}`, `.subtitle` = `{title}`) count as missing translation keys until a bundle repeats them verbatim (17.5 slots.header walk)",
    "carrier: maintainer (governed prose; PR #81 holds AGENTS.md) · noted: AGENTS.md:62 cites the removed fixture; AGENTS.md:97 and DESIGN.md §03 line 98 require declared decimals on every number while 17.5 refuses `scale` on currency; AGENTS.md's boot-warning rule meets six by-design scheduled-work notices; docs/backlog/02 and 03 say 'currency, scale 2'",
    "carrier: 承接者:无 · noted: scripts/check-lint-i18n-gate.mjs REACH has no `flow` class, so a regression that stops walking flows would not fail REACH (COVERAGE still counts flow keys); also the 14 named list views omit pageSize and now page at 50 instead of 25 (ruled platform default, no edit)"
  ]
}

Generated by Claude Code

ACCEPT — PR #85, head `56c7501` · partial landing (`Part of #82`) · 2026-10-09T16:02Z

Reviewed by the repo:hotclm seat (session_01HihZ11bQSqjCgjzHbpv4M1) against GitHub, not against the report.

check	reading
CI on the head	`CI` (pull_request) and `CI` (push) `completed: success`; both `Validate` check-runs `success`, `head_sha` = `56c7501` = PR `head.sha`
governed surface	none — 19 files: `package.json`, `pnpm-lock.yaml`, `pnpm-workspace.yaml`, `scripts/demo.mjs`, `src/**` only
closing keywords	none; first line `Part of #82` — the merge leaves this card open, as it must
pins	`package.json`: all four `@objectstack/` at `^17.7.0`; lockfile: 106 `@objectstack/@17.7.0` entries, 0 at 17.4.0; `better-auth` + 10 `@better-auth/*` at 1.7.3
fixture	`pnpm-workspace.yaml` `overrides:` block removed (−37) — the report measures sign-in 401 with it kept and 200 without, on both DB paths
`scale` removals	6 × `scale: 2` on `Field.currency` — 17.5 refuses `scale` on currency (`content/docs/releases/v17/17-5.mdx`: "Currency takes its decimals from the currency")
per-release checklists	17.5 / 17.6 / 17.7 tables present in the PR body, each row marked with its reading and its DB
#31 probe	on 17.7.0 the wrong path errors at author time, at the save door (`422`) and at the query door (`400`); tree restored, proved by state

Deviations accepted: Part of instead of Fixes (correct for a card with an open decision); the browser pass ran on pnpm demo rather than pnpm dev --seed-admin (the empty app has nothing to verify on; PR #37 precedent); two setup writes on the local dev server to reach the approval step (local only).

Open item — the one this card keeps: whether pnpm dev / pnpm demo turn 17.5's scheduled work back on. A product choice by the dispatch's own definition; it goes to the maintainer on this card.

Out-of-scope findings

os migrate apply --allow-destructive cannot drop sys_account.issuer → filed os migrate apply --allow-destructive cannot drop sys_account.issuer on a 17.4.0-created SQLite database, while os migrate account-issuer and the boot's schema-drift line keep prescribing it (17.7.0) objectstack#22506
zh-CN wizard options / screen description untranslatable → filed A screen flow's select options and screen description have no key in the flows translation face — the zh-CN intake wizard translates its labels and placeholders and keeps its options and body text in English (17.7.0) objectstack#22507
requester / legal counsel 403 on Discussion and Approvals tabs → filed A business requester and a legal counsel get "You don't have permission" on the contract's Discussion tab and a blank Approvals tab — sys_activity / sys_comment / sys_attachment / sys_approval_request answer 403 #86 (pm:queue)
clm_admin cannot edit past submitted → evidence on [Decision] DESIGN.md §04 makes clm_requester every employee's default, but a set that grants clm_requester.access cannot bind to everyone #11 (its cause is [Decision] DESIGN.md §04 makes clm_requester every employee's default, but a set that grants clm_requester.access cannot bind to everyone #11's open question), not a separate card
governed prose made stale (AGENTS.md fixture mention; "numbers declare decimals" vs currency; the boot-warning rule vs the scheduled-work notices) → Acceptance notes; PR The two surfaces that merely restate the gate set should name pnpm verify instead of enumerating it — a restatement of a definition cannot be allowed to drift #81 holds AGENTS.md, and the boot-warning sentence depends on this card's decision
docs/backlog/02, 03 say currency, scale 2 → Acceptance notes (backlog cards already delivered)
inline-translation workarounds made obsolete by 17.5 → Acceptance notes; no card (no user-visible change)
i18n gate REACH has no flow class → Acceptance notes
pure interpolation templates demanded as keys → Acceptance notes

Merging under AGENTS.md's delegated merge policy: CI green on the head · this ACCEPT · no governed surface · first review round.

Generated by Claude Code

决策：17.5 起平台默认关闭「包内定时任务」——本仓的 `pnpm dev` / `pnpm demo` 要不要重新打开？ · 2026-10-09T16:04Z

Governing text: DESIGN.md §11 M3 验收「到期、逾期提醒在收件箱可见」· AGENTS.md「A boot that logs warnings is not a passing boot」与「Capability expansion: Tight」· 平台 17.5 发布说明 Scheduled work is off until a deployment turns it on（content/docs/releases/v17/17-5.mdx）

维护者速读

事情：升级到 17.7 的 PR #85 已完成并通过复核（四道 gate 全绿、浏览器实测通过），只留下这一个产品选择没做。17.5 起，平台把应用自带的定时任务（本仓 M3 的到期/逾期/续签等 6 个日任务）默认关掉，由部署方用 OS_AUTOMATION_SCHEDULED_WORK_ENABLED=true 打开。

实测（17.7.0，dev 报告）：开关关闭时 6 个日任务注册但不上弦（bound=False — disabled by deployment policy），每次启动多 6 条提示；手动 POST /api/v1/automation/NAME/trigger 仍能跑，写出 45 条收件箱提醒。打开开关后 12 个流程中 9 个上弦（与 17.4 相同），启动诊断从 9 条降到 2 条。os dev 读 .env.development*，但 .gitignore 排除了 .env.*；os start 不读开发环境文件。任务在 UTC 06:00/07:00 改数据。

你要做的：回一个字母。

	做法	代价 / 收益
A	`pnpm dev` 和 `pnpm demo` 都打开：提交一个 `.env.development` 并在 `.gitignore` 开例外	本地完全恢复 17.4 行为；但在通常放密钥的地方新增一个入库的配置文件，日后 agent 容易往里放密钥
B	全部沿用平台默认（关），只在 README 写明：部署要提醒就设这个变量；本地手动触发	改动最小、与平台契约完全一致；但每次启动都带 6 条提示，和 `AGENTS.md`「带告警的启动不算通过」相冲
C（推荐）	只在 `pnpm demo` 打开（`scripts/demo.mjs` 给演示启动传这个变量），再加 README 一句部署说明；`pnpm dev`（空库，无可扫描数据）保持平台默认	展品演示开箱即见提醒；策略只落在一个命令上、不入 git 配置；`pnpm dev` 仍有提示

四棱分析

实际业务需求：M3 验收明文要求提醒在收件箱可见。评估者跑 pnpm demo 时期待提醒自己出现，不会去手动触发；而 pnpm dev 是空库，没有可扫描的数据。拉动只落在 demo 上 ⇒ C 正好覆盖，A 多覆盖了一个没有需求的入口。
项目长远合理性：平台契约是「定时任务由部署方决定」。A 把部署策略写进仓库配置文件，与契约方向相反；B 与契约完全一致；C 把「演示部署」本身当作一个部署方，只在演示命令上做决定，与契约同向。三者都需要 README 那句部署说明。
防 AI 写错：A 的入库 .env.development 是日后 agent 塞密钥的温床；B 让每次验证启动都带 6 条按设计出现的提示，会腐蚀「带告警的启动不算通过」这条规则（agent 会学会忽略提示）；C 的演示启动干净，但 pnpm dev 仍有提示——这句规则（受管文本，你来改）在 B、C 下都需要补一句豁免说明。
创业阶段不扩散：B 最小；C 是一个环境变量 + 一句 README；A 是一个文件 + 一条 .gitignore 例外。

推荐 C：拉动只在演示，策略只放在演示命令上，不新增配置文件。若你更倾向「仓库里零部署策略」，B 自洽。

与 #41 的耦合（请一并知悉）

#41（决策箱内）：日任务跑过一次之后，再跑 pnpm demo 会有行写入失败（种子数据重设了状态机不允许回退的状态）。A、C 让演示库里的任务每天自动跑，#41 的情形会随库龄自然出现（17.4 时代就是这样）；B 下只在手动触发后出现。

状态

PR #85（Part of #82）的复核结论是 ACCEPT，待合并；它不依赖本决策。本卡转入决策箱，答复后由席位派发剩下这一项（预计 scripts/demo.mjs + README 各一处）。

Generated by Claude Code

Upgrade the `@objectstack/*` dependencies from 17.4.0 to 17.7.0, walk…

Release: PR #85 merged at c31c7e2 · 2026-10-10T00:16Z

Merged with the maintainer's explicit approval, verbatim, 2026-10-10: 「#85 同意合并，然后使用浏览器完整的测试。」

Landed: everything this card asks for except one item — @objectstack/* at 17.7.0 on main, the better-auth fixture retired, the 17.5 / 17.6 / 17.7 checklists walked (tables in PR Upgrade the @objectstack/* dependencies from 17.4.0 to 17.7.0, walking the official upgrade checklists of 17.5, 17.6 and 17.7 #85), [Decision] §09 要「各段时长」和「超 SLA」，但语义层算不出时间差——两问共用一个补法 #31's probe re-run.
Remaining: the scheduled-work choice for pnpm demo / pnpm dev — the decision above (seat recommends C). After the ruling, the seat dispatches it as a small card (scripts/demo.mjs + README.md).
The assignee is released with this comment; the card stays in the decision box until it is answered.

Generated by Claude Code

Ruling: batch #1 item 5 · letter C · maintainer 「同意」 2026-10-25T05:02Z

裁决 C：只在 pnpm demo 打开平台的定时任务 —— scripts/demo.mjs 给演示启动传 OS_AUTOMATION_SCHEDULED_WORK_ENABLED=true，README 加一句部署说明（部署要 M3 的提醒就设这个变量）；pnpm dev（空库）保持平台默认关闭。A（提交 .env.development）与 B（全部沿用默认）不采纳。

工作量（卡面读数）：hotclm · 1 个 PR（scripts/demo.mjs + README 各一处）· 量级同 PR #60（scripts/demo.mjs 约四行）。

Governing text（录裁前重读）：DESIGN.md §11 M3「到期、逾期提醒在收件箱可见」· AGENTS.md「A boot that logs warnings is not a passing boot」· 平台 17.5 发布说明 Scheduled work is off until a deployment turns it on。18.0 / 18.1 发布说明未改这个默认值；另一线程的 18.1 升级实测也要手动设该变量才让 6 个日任务跑完，前提成立。

随裁知会：pnpm dev 在 C 下仍带 6 条按设计出现的提示，AGENTS.md 那句启动告警规则（受管文本）需要维护者补一句豁免；#41（任务跑过后重跑 demo 会写回任务改过的行）与本裁耦合，在第 2 批呈。

裁后执行：18.1 升级 PR 合入后串行派 1 张小卡；合入后本卡关闭（17.7 升级本身已由 PR #85 落地）。

鲜度门：正文最后编辑 2026-10-09T14:36Z；最后评论 2026-10-10T00:16Z（PR #85 合入记录）；今日无新评论。决裁文档：https://claude.ai/artifact/WpsJbszPncNgj1cDt2Ucw9

Generated by Claude Code

Out of the decision box — Ruling-ref: comment 6393739591 (batch #1 item 5 · letter C · maintainer 「同意」).

State: needs-user-decision → pm:blocked, Blocked-by: the 18.1 upgrade PR (body line 3), as the ruling prescribes.
One small card after the upgrade (serial): OS_AUTOMATION_SCHEDULED_WORK_ENABLED=true for pnpm demo only, plus one README sentence; this card closes when it lands.

Generated by Claude Code

Unblocked: PR #110 (the 18.1 upgrade) merged as 7b736a0. State pm:blocked → pm:queue; dispatch follows its ruling.

Generated by Claude Code

Claim: PM loop round 14
Session: session_017nzWFRUo2U7evMkPdVniAn
Account: zhuangjianguo (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-82-demo-scheduled-work
Worktree: hotclm-issue-82
Domain: repo:hotclm (single-lane sister repo — no domain:*)
Seat: repo:hotclm#1
File surface: scripts/demo.mjs (the demo boot's environment) · README.md (one deployment sentence) — stop on breach; explain in the report
Container & model: S, mode:subagent, model: opus (TIER_DEFAULT; hand-derived for a sister repo), effort: medium
Clause-②: no
Metadata-protocol: none
Responsibility: this app's demo script (it boots with the platform default, scheduled work off) | none known | anyone who runs pnpm demo and expects M3's inbox reminders
Ruling-ref: 6393739591 (batch #1 item 5 · letter C)
Premise: re-measured by the dev on origin/main 7b736a0 (18.1.0)
Serial constraints cleared: PR #110 (18.1 upgrade, Part of #82) merged 7b736a0; PR #106 (scripts/demo.mjs) merged 134707e. No other branch in flight on these files. Scope: ruling C only — pnpm dev keeps the platform default. On landing, this card closes.

Generated by Claude Code

os-dev-report

{
  "issue": 82,
  "status": "done",
  "branch": "claude/issue-82-demo-scheduled-work",
  "pr": "https://github.com/objectstack-ai/hotclm/pull/111",
  "session": "session_017nzWFRUo2U7evMkPdVniAn",
  "premise_still_valid": true,
  "summary": "Ruling C implemented in one commit (e405e7b, +12/-0, two files). scripts/demo.mjs: the demo boot's child env (startDemo's spawn of `objectstack dev --compile --ui --seed-admin`, built from {...process.env}) now carries OS_AUTOMATION_SCHEDULED_WORK_ENABLED = process.env value ?? 'true' — set only when unset, so an exported value (false, 0, empty) is the operator's and wins (platform reads only 1/true/on/yes as on); the quiet priming boot and `pnpm dev` are untouched and keep the platform default. README.md: one paragraph after the pnpm dev/demo paragraph — pnpm demo turns the platform's scheduled work on; a deployment that wants the reminders in the inbox sets the variable. The PR #108 re-run paragraph stays true and was left unchanged. Premise re-measured on 18.1.0: main's pnpm demo boots with 3 of 12 flows bound and the six daily sweeps NOT bound 'disabled by deployment policy'.",
  "tests": "Boot measurements on 18.1.0, clean .objectstack/data each, same port. BEFORE (pnpm demo @ 7b736a0): 'Flows: 12 flow(s) 3 bound to triggers' + 'ℹ 6 flows declare a schedule trigger but are NOT bound — disabled by deployment policy …: legal_review_sla, turn_stalled, obligation_due, payment_overdue, renewal_notice, expiration_sweep'; 'Boot diagnostics — 2 informational (6 more already listed above)'. AFTER (pnpm demo @ e405e7b): 'Flows: 12 flow(s) 9 bound to triggers', no not-bound notice, 'Boot diagnostics — 2 informational:'; GET /api/v1/automation/_status → all six schedule flows bound=true; GET /api/v1/data/sys_job → 7 rows active=true: flow-schedule:{legal_review_sla,turn_stalled,obligation_due,payment_overdue,renewal_notice} cron '0 6 * * *', flow-schedule:expiration_sweep cron '0 7 * * *', plus platform approvals-sla-escalation; seed at quiescence inserted 820 / errored 404 (same as PR #85's 17.4/17.7 readings); Tenancy single, 44 plugins, no degraded-capabilities line, no plugin failed. Normalised before/after log diff: only the runtime bundle hash, the Flows line + notice, the diagnostics header (plus shutdown lines in the before log, read after stop). EXPLICIT FALSE (OS_AUTOMATION_SCHEDULED_WORK_ENABLED=false pnpm demo @ e405e7b): 3 bound, notice present, six bound=false, sys_job 1 row (approvals-sla-escalation only). PNPM DEV @ e405e7b: 'Flows: 12 flow(s) 3 bound', notice present (platform default, off). os doctor: unset → 'OFF (the default)'; =true → 'ON — packaged time-triggered flows … are armed'; exit 0 both. NOT MEASURED: a sweep firing on its own clock (cron 06:00/07:00, session ran ~11:45 UTC); armed state is what the switch controls, and PR #85 measured the sweeps writing the inbox when run. No ablation: script/docs change, no tested behaviour.",
  "gates": "Local, head e405e7b, one batch under os-verify-lock (slot hotclm-issue-82-gates, held 15s), each exit code written to its own file before any pipe: pnpm validate 0 ('✓ Validation passed (825ms)'), pnpm lint 0 ('6 suggestion(s)'), pnpm typecheck 0 (tsc --noEmit, no output), pnpm lint:i18n-gate 0 ('COVERAGE : 0 missing keys across 2 locale(s)', REACH 12 classes). dispatch-gates.mjs not run: objectstack-only tool, hotclm's gate list is its AGENTS.md four. CI on the PR head e405e7b: 'Validate' (push, run 40190521004) completed success; 'Validate' (pull_request, run 40190649016) in_progress at report time — not waited on, per the os-dev contract.",
  "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm; hotclm has no dogfood package",
  "mcp_calls": "0 — no MCP GitHub tool called; reads via gh api (REST)",
  "api_writes": "2 — via the fleet-write relay (POST /repos/objectstack-ai/objectstack/dispatches, executed as objectstack-fleet[bot]): (1) pr_create → POST /repos/objectstack-ai/hotclm/pulls (draft, #111) + POST /repos/objectstack-ai/hotclm/issues/111/assignees [zhuangjianguo]; read-back 6772/6772 bytes identical, assignees listed zhuangjianguo; (2) this report → POST /repos/objectstack-ai/hotclm/issues/82/comments via post-stamped. Plus git push of the branch (1 commit). No label writes, no ready flip, no merge.",
  "deviations": [
    "PR title is not the card's title (the card still names the 17.4 → 17.7 upgrade, landed in PR #85 / #110); title says what this PR does. PR body line 1 is the dispatched Fixes line verbatim; Clause-② and Metadata-protocol lines copied from the claim at lines 2-3.",
    "No browser pass: the diff changes a boot script's environment and one README paragraph, no surface a person clicks; evidence is the boot banner, /api/v1/automation/_status and sys_job.",
    "Worktree /home/claude/hotclm-issue-82 removed after the PR per os-dev cleanup (node_modules, .objectstack/data and dist were ignored build/run output)."
  ],
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: maintainer (governed AGENTS.md) · noted, not filed: AGENTS.md's 'A boot that logs warnings is not a passing boot' meets six by-design 'NOT bound — disabled by deployment policy' notices on every pnpm dev boot; the ruling assigns the exemption sentence to the maintainer; listed in the PR's Acceptance notes",
    "carrier: 承接者:无 · noted, not filed: a value kept only in a .env* file cannot opt pnpm demo out — os dev loads .env* through dotenv-flow 4.1.0, whose load() never overwrites a variable already in process.env, and the demo child now always has the variable; an exported false works (measured). Said in the code comment and Acceptance notes."
  ]
}

Landed — PR #111 · 2026-10-25T11:55Z

reading	value
PR #111	`MERGED`, squash `a7239e8` on `main`, merged at its ACCEPT head `e405e7b`
`origin/main`	contains `a7239e8`
authority	maintainer, project thread, verbatim: 「你可以自己审核的就自己合并」

Release: ruling C (6393739591) is delivered — pnpm demo arms the six daily sweeps; pnpm dev keeps the platform default. The 17.7 upgrade landed as PR #85 and the 18.1 upgrade as PR #110, so the card closes. Still with the maintainer: the AGENTS.md boot-warning exemption for the six by-design "NOT bound" notices on pnpm dev (governed surface).

Generated by Claude Code

Sync the governed design text with the rulings landed on 2026-10-25

Navigation Menu

Repository navigation

Upgrade the `@objectstack/*` dependencies from 17.4.0 to 17.7.0, walking the official upgrade checklists of 17.5, 17.6 and 17.7 #82

Where the repo is (readings, 2026-10-09)

"The official docs" — what to follow, exactly

Exposure the PM measured — leads, not answers

Declared increment — #31's unlock probe, report only

Acceptance

ACCEPT — PR #85, head `56c7501` · partial landing (`Part of #82`) · 2026-10-09T16:02Z

Out-of-scope findings

决策：17.5 起平台默认关闭「包内定时任务」——本仓的 `pnpm dev` / `pnpm demo` 要不要重新打开？ · 2026-10-09T16:04Z

维护者速读

四棱分析

与 #41 的耦合（请一并知悉）

状态

2 remaining items

Landed — PR #111 · 2026-10-25T11:55Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Upgrade the @objectstack/* dependencies from 17.4.0 to 17.7.0, walking the official upgrade checklists of 17.5, 17.6 and 17.7 #82

Description

Where the repo is (readings, 2026-10-09)

"The official docs" — what to follow, exactly

Exposure the PM measured — leads, not answers

Declared increment — #31's unlock probe, report only

Acceptance

Activity

objectstack-fleet commented on Oct 9, 2026

objectstack-fleet commented on Oct 9, 2026

objectstack-fleet commented on Oct 9, 2026

ACCEPT — PR #85, head 56c7501 · partial landing (Part of #82) · 2026-10-09T16:02Z

Out-of-scope findings

objectstack-fleet commented on Oct 9, 2026

决策：17.5 起平台默认关闭「包内定时任务」——本仓的 pnpm dev / pnpm demo 要不要重新打开？ · 2026-10-09T16:04Z

维护者速读

四棱分析

与 #41 的耦合（请一并知悉）

状态

objectstack-fleet commented on Oct 10, 2026

zhuangjianguo commented on Oct 25, 2026

objectstack-fleet commented on Oct 25, 2026

2 remaining items

objectstack-fleet commented on Oct 25, 2026

objectstack-fleet commented on Oct 25, 2026

objectstack-fleet commented on Oct 25, 2026

objectstack-fleet commented on Oct 25, 2026

Landed — PR #111 · 2026-10-25T11:55Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Upgrade the `@objectstack/*` dependencies from 17.4.0 to 17.7.0, walking the official upgrade checklists of 17.5, 17.6 and 17.7 #82

ACCEPT — PR #85, head `56c7501` · partial landing (`Part of #82`) · 2026-10-09T16:02Z

决策：17.5 起平台默认关闭「包内定时任务」——本仓的 `pnpm dev` / `pnpm demo` 要不要重新打开？ · 2026-10-09T16:04Z