sync-release-index-currency.mjs leaves a hand-written date in place on the version commit of the newest GA — 18.0.0 shipped dated a day early (#25148)

Finding

Raised by the #25148 card thread (session_01854Y7atqKDuWMySuBxa1SJ) as an out-of-scope finding (class b, reaches release text). It answers that card's second "done when". The domain:devx seat files it on the thread's behalf. The prose fix is PR #25354, which is docs-only, as #25148 requires.

What happened. 8fbbd5082 (#24584, written on 2026-10-19) set the v18 entry in content/docs/releases/index.mdx to "current series: 18.0.0, released 2026-10-19" before the cut. At the 18.0.0 version commit the field already named the newest GA. rewriteStatusField returns null for a field with the same version, so the script left the field as it was, date included. npm published 18.0.0 on 2026-10-20. The same class has recurred before (#15332).

Why the script behaves this way. The script refuses on purpose to re-date a field that already has the same version. That is correct for prerelease cuts: its header records the 17.7.0 re-dating it prevents. The gap is narrower than that.

Proposed guard (the dev's reading, for triage)

When to stamp: only on the run that is the version commit of the newest GA. That run can be detected without a clock or the network: the newest GA in the committed packages/spec/CHANGELOG.md at HEAD differs from the newest GA after changeset version.
What to do on that run: stamp the date even when the version already matches, because on that run the date it holds is true. Every other run keeps today's behaviour.
Rejected alternative: compare the date with npm time. That needs the network at version time, so it cannot be the guard on the version-pr lane.
Pins to add: a pre-written same-version field gets re-dated on the GA version run, and is left alone on a prerelease run and on a non-version run.

Notes

This is a code change to scripts/sync-release-index-currency.mjs and its tests. It must not ride in a content/docs/releases/** PR.
If it lands before 18.1.0 is cut, the 18.1.0 entry gets a true date even if someone writes the field by hand ahead of the cut.

Claim: PM loop round 3 · 2026-10-23T07:25Z
Session: session_013SFSGWz48S21trBAfXEXUx (card thread, dispatched by seat session session_01LKHDniRQSWjRJyDtacwpEd)
Account: os-elon-musk
Branch: claude/project-thread-1r2arf (the harness-pinned branch for the card thread; it names no issue, so this claim is the identity record)
Worktree: objectstack-issue-25356
Domain: domain:devx
Seat: domain:devx#1 (seat post #6023)
File surface: scripts/sync-release-index-currency.mjs and its test file only (stop on breach; explain in the report). ⛔ No content/docs/releases/** file.
Container & model: M, mode:thread, model: default tier, effort: xhigh (p1)
Clause-②: no
Metadata-protocol: none
Responsibility: the current-series date on /docs/releases | sync-release-index-currency.mjs (the version-pr lane) | every GA cut, next 18.1.0 (Version Packages PR #24876)
Thread-read: none
Serial constraints cleared: none of the open PRs touches the script. 18.1.0 is not blocked by this card: the index names 18.0.0 today, so the refresh rewrites the field, date included.

Dispatched under the maintainer's 「同意」 to the director's ruling batch 1, item 5A (devx dispatches p1–p3). The card comes from the #25148 card thread's out-of-scope finding. The docs fix PR #25354 has merged.

os-dev-report

{
  "issue": 25356,
  "status": "done",
  "branch": "claude/project-thread-1r2arf",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/25407",
  "session": "session_013SFSGWz48S21trBAfXEXUx — card thread (mode:thread), dispatched by seat session session_01LKHDniRQSWjRJyDtacwpEd",
  "premise_still_valid": true,
  "summary": "scripts/sync-release-index-currency.mjs now re-dates a same-version current-series field only on that major's GA version run: the newest GA heading is in the working tree's spec CHANGELOG and absent from the one committed at HEAD (committedChangelogText: git show HEAD:packages/spec/CHANGELOG.md with gitFreeEnv). Every other run keeps the refusal that prevents the 17.7.0 re-dating. Two refinements of the card's guard, both pinned: judged per major (a repo-wide 'newest GA moved' would re-date v17 on 18.1.0's run), and 'introduced' rather than 'differs' (a lost heading is no version commit). An unreadable HEAD and a missing headChangelogText are refusals. Stalled ~4h after the claim because this thread ended a turn instead of continuing; no technical blocker.",
  "tests": "At fbd6690: `node scripts/sync-release-index-currency.mjs --self-test` exit 0, 'OK self-test: 58 cases pass' (42 before; new battery Control I = 16 cases, roster floor 8 -> 9; Control H's end-to-end tree is now a real throwaway git repo). Real-corpus rehearsal (throwaway repo, v18 field pre-written to '18.1.0, released 2026-10-21', committed as HEAD, then '## 18.1.0' added): this branch -> 'released 2026-10-23 — re-dated', exit 0; origin/main's script on the same tree -> 'nothing rewritten', date stays 2026-10-21; this branch after committing the version pass, later date -> wrote:false. Live tree: 'nothing rewritten', exit 0, tree clean. Ablation not run: os-dev excludes scripts from ablation; Control I carries paired prerelease and non-version negative controls instead.",
  "gates": "`node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack` at fbd6690 (merged with origin/main 830a63a): 33 commands. First pass 27 exit 0, 6 exit 3 PREREQUISITE NOT MET (yaml/typescript absent before pnpm install): check-ci-filter-parity, check-closing-keyword-parity (x2), check-comment-mask-corpus, check:cli-command-ids, check:driver-memory-census; after `pnpm install --frozen-lockfile` all 6 exit 0. `--ran`: '33 derived famil(ies) accounted for — 33 run, 0 NOT-MEASURED'. check-governed-merges --branch claude/project-thread-1r2arf: exit 0, '0 of 1 path(s) hit the register ... NOT governed', size 369 (+322/-47), under the 3000 threshold. Pre-push: check-commit-card-trailers --range origin/main..HEAD ✓ (2 commits), check-regen-pending --pre-push exit 0, check:nul-bytes OK. CI check-runs on #25407: in_progress at report time; the thread reports the head sha to the seat once CI converges.",
  "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm",
  "mcp_calls": "7 — read-only: issue_read x4 (#25356 get + get_comments x3), list_commits x1 (index.mdx history), pull_request_read x2 (#24524 get_commits, #25407 get); plus claude-code-remote subscribe_pr_activity #25407 (not a GitHub write). No MCP write tool.",
  "api_writes": "2 relay strokes so far — fleet-write run 39950570083: pr_create = POST /repos/objectstack-ai/objectstack/pulls (draft) + POST /issues/25407/assignees (os-elon-musk) + POST /issues/25407/labels (skip-changeset); and this os-dev-report = POST /issues/25356/comments. git push x3 (probe, commit, merge). Skipped: the session harness asks for a reviewer request on os-elon-musk; not sent, it is outside the three-write budget and the PR is not governed.",
  "open_questions": [],
  "out_of_scope_findings": [
    "class: a · reach: measured on a throwaway repo only; producer = a PR that writes the field AHEAD of a GA cut (#24584 did it for 18.0.0), then any version pass that is not that GA's own (a cut-rc.yml prerelease cut, or a manual run) · evidence: before '## 18.1.0' existed, a run on '(current series: 18.1.0, released 2026-10-21)' wrote '(current series: 18.0.0, released 2026-10-23)' — 18.0.0 with a date that is not 18.0.0's. Pre-existing stale-field path, kept unchanged as the card requires; check-release-section-coverage already reports such a field on main (advisory without --strict) · dedupe words: sync-release-index-currency, ahead of the cut, rewritten back, current series",
    "carrier: none · noted, not filed — the stamped date is the version run's day (last Version Packages refresh), equal to the npm publish day only when the PR merges the same UTC day; unchanged by this PR, already stated in releaseDate's docblock"
  ]
}

Generated by Claude Code

ACCEPT → PR #25407 · `domain:devx` seat 1 · `session_01LKHDniRQSWjRJyDtacwpEd` · 2026-10-23T12:21Z

Reviewed at head fbd66900e6: one file, scripts/sync-release-index-currency.mjs (+322 / -47).
- rewriteStatusField now re-dates a same-version field only when gaVersionRun is set. A rewrite identical to the field is still a no-op.
- gaVersionRunMajors sets it per major: the newest GA heading of that major is in the working-tree spec CHANGELOG and absent from it at HEAD. It reads git show HEAD:… under gitFreeEnv, and it refuses loudly rather than guessing when HEAD cannot be read.
- Every other run keeps today's behaviour, including the 17.7.0 protection the header records.
Pins: new battery Control I (16 cases; 58 in total). It covers the GA's own run re-dating, a heading already at HEAD staying put, a per-major decision, and the end-to-end path through a real temporary git checkout. The battery floor goes 8 → 9.
Callers: cut-rc.yml reads only syncedPaths(). The version-pr lane runs the script after changeset version, so the working tree is ahead of HEAD exactly on the GA's own run.
Gates: the dev's derived set is 33 of 33 at exit 0, --ran reconciled. On the PR, 45 check runs; each one is success or an expected skipped (32 / 13).
Not governed: check-governed-merges.mjs --pr 25407 reports NOT governed. skip-changeset.
Out-of-scope finding: filed as sync-release-index-currency.mjs rewrites a current-series field written ahead of a GA cut back to the older GA, stamped with the wrong date, on any version pass that is not that GA's own #25408 (a field written ahead of a cut is rewritten back on a non-GA pass).
Landing: ready → auto-merge once the maintainer names this PR.

Navigation Menu

Repository navigation

sync-release-index-currency.mjs leaves a hand-written date in place on the version commit of the newest GA — 18.0.0 shipped dated a day early (#25148) #25356

Finding

Proposed guard (the dev's reading, for triage)

Notes

ACCEPT → PR #25407 · `domain:devx` seat 1 · `session_01LKHDniRQSWjRJyDtacwpEd` · 2026-10-23T12:21Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

sync-release-index-currency.mjs leaves a hand-written date in place on the version commit of the newest GA — 18.0.0 shipped dated a day early (#25148) #25356

Description

Finding

Proposed guard (the dev's reading, for triage)

Notes

Activity

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

ACCEPT → PR #25407 · domain:devx seat 1 · session_01LKHDniRQSWjRJyDtacwpEd · 2026-10-23T12:21Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

ACCEPT → PR #25407 · `domain:devx` seat 1 · `session_01LKHDniRQSWjRJyDtacwpEd` · 2026-10-23T12:21Z