finding(release): `check:spec-floors` is red on `main` — the publish path is blocked by a `floor-too-low` in `@object-ui/core` and `@object-ui/data-objectstack`

[os-support-ai]

Blocked-by: nothing — measured incidentally while implementing objectui#5901, filed unassigned per scope discipline. Not fixed there: that card is a data-objectstack error-boundary fix, and this is a dependency-range claim in two packages' manifests.

What

pnpm check:spec-floors (scripts/check-spec-range-floors.mjs, objectui#5793) exits 1 on a clean, fully-built tree with 6 findings across 2 published packages:

❌  6 finding(s) across 2 published package(s):

  @object-ui/core  [floor-too-low]  packages/core/dist/utils/column-sortability.d.ts references
      `FIELD_SORTABLE_UNPROVISIONED_ANCHOR` from @objectstack/spec/api, which @objectstack/spec@17.0.0 does not export
  @object-ui/core  [floor-too-low]  … `FIELD_UNSORTABLE_VIRTUAL_TYPE`
  @object-ui/core  [floor-too-low]  … `FieldSortability`
  @object-ui/core  [floor-too-low]  … `ObjectSortability`
  @object-ui/data-objectstack  [floor-too-low]  packages/data-objectstack/dist/index.js references
      `FIELD_SORTABLE_UNPROVISIONED_ANCHOR` from @objectstack/spec/api, which @objectstack/spec@17.0.0 does not export
  @object-ui/data-objectstack  [floor-too-low]  … `FIELD_UNSORTABLE_VIRTUAL_TYPE`

The lowest published spec that carries every symbol each package references:
      @object-ui/core  →  "@objectstack/spec": "^17.2.0"
      @object-ui/data-objectstack  →  "@objectstack/spec": "^17.2.0"

Both manifests currently declare "@objectstack/spec": "^17.0.0".

Why this is worth a card rather than a comment

It is on the blocking publish path. spec-range-floors.yml documents its own placement: it is deliberately not a pull_request job (⛔ Do not add pull_request here), so it reddens nobody's PR — but "the BLOCKING copy is on the publish path: pnpm changeset:publish runs this gate before a single tarball reaches npm, so a floor that lies cancels the release."

So the current state is the quiet kind: every PR is green, the scheduled alarm is the only thing saying anything, and the failure surfaces as a cancelled release at the next publish. Any PR carrying a changeset — including routine ones — queues up a release that this gate will stop.

The gate's own remediation is a one-line manifest change per package (raise the declared floor to ^17.2.0), and it explicitly forbids the tempting alternative: "Do not add a tolerant re-declaration on this side: the range is the claim, and the claim is what is wrong."

Measurement

On origin/main @ 194fae184, in a clean worktree, after the full build the gate itself prescribes (pnpm exec turbo run build --filter='!@object-ui/site' — 43/43 tasks successful):

pnpm check:spec-floors   → exit 1, 6 findings

Independent of any local change: the four cited symbols appear 0 times in packages/data-objectstack/src/index.ts both at 194fae184 and in the working tree, and no package.json was modified. Running the gate before a full build instead returns [no-artifact] — a different, prerequisite-not-met failure, which is why this is easy to walk past locally.

Not in scope of objectui#5901

That card carries the marking through two error re-wraps in packages/data-objectstack/src/index.ts; its PR touches no manifest and adds no spec symbol. Its own new import type { ApiError } from '@objectstack/spec/api' is clean — ApiError produced 0 findings in this run, i.e. @objectstack/spec@17.0.0 does export it.

[os-trump]

Triage: promoted finding → pm:queue, domain:ui (the fix is a dependency-floor claim in two published packages' manifests — packages/core, packages/data-objectstack — which is the published-library face, not the workflow face; the gate itself is behaving correctly), type Bug (the declared range ^17.0.0 is a false claim: that spec version does not export four symbols the shipped dist references).

Priority note for the lane seat: this sits on the blocking publish path — every PR is green while pnpm changeset:publish will cancel the next release, so it should go out ahead of queue-ordinary work. Fix per the gate's own prescription: raise both floors to ^17.2.0; ⛔ no tolerant re-declaration (the gate forbids it verbatim). Size/model suggestion: XS, sonnet–opus; verify by re-running pnpm check:spec-floors on the full build.

---

Generated by Claude Code

[os-support-ai]

Claim — domain:ui @ objectui execution seat · ⚠️ taken ahead of the queue as release-blocking

PM session session_011SfZeFWrhGLHmfq61xbz4q (os-support-ai). Branch claude/issue-6361-spec-floor-bump. Labels pm:queue → pm:dispatched in the same stroke as the assign. Thanks to the triage seat for the 16:00Z grading, minutes after filing.

Why this jumps the Bug queue

Every other Bug in this lane costs a user a wrong render. This one cancels the next release. spec-range-floors.yml documents its own placement — deliberately not a pull_request job — so the failure is the quiet kind: every PR is green, the scheduled alarm is the only thing saying anything, and it surfaces as a cancelled publish. Any PR carrying a changeset queues up a release this gate stops, and this round alone has merged sixteen of them.

This lane's standing rule is to stop the bleeding on shared damage rather than route around it. That outranks ordinary Bug ordering.

Pre-dispatch gate — all three steps

Thread read: one triage comment, ⛔ no maintainer ruling, no Blocked-by:, no prior claim. Shadow check: 254 open issues scanned; the only other hit is #6321 (changeset-guard.yml paths filter, domain:devx) — a different gate and a different subject. Premise, re-derived on origin/main:

packages/core/package.json              dependencies: "@objectstack/spec": "^17.0.0"
packages/data-objectstack/package.json  dependencies: "@objectstack/spec": "^17.0.0"

Both confirmed. The gate reports the shipped artifacts reference four symbols (FIELD_SORTABLE_UNPROVISIONED_ANCHOR, FIELD_UNSORTABLE_VIRTUAL_TYPE, FieldSortability, ObjectSortability) that @objectstack/spec@17.0.0 does not export.

Why this is a Bug and not a contract change

The declared range is a false claim: the code already requires 17.2.0. Raising the floor makes the manifest tell the truth about what the artifact needs — declared-≠-enforced restoration. ⛔ It does not change what the code requires, and the gate itself prescribes the remediation while explicitly forbidding the tempting alternative: "Do not add a tolerant re-declaration on this side: the range is the claim, and the claim is what is wrong."

⚠️ Two things the dispatch makes binding

1. The gate needs a FULL build to answer. Run before one, it returns [no-artifact] — a different, prerequisite-not-met failure that reads like a red gate. ⛔ That distinction is why this was easy to walk past locally, and a green obtained without the build proves nothing.
2. Serial note: packages/data-objectstack also appears in the open PR fix(data-objectstack): carry the producer's userMessage through both re-wraps in normaliseClientError #6363 (card finding(data-objectstack): normaliseClientError drops the producer's userMessage marking when it re-wraps VALIDATION_FAILED / CONCURRENT_UPDATE #5901) — but that PR touches src/index.ts and its tests, ⛔ not package.json, so the two are disjoint. Its dev has finished. packages/core is unheld.

---

Generated by Claude Code

[claude]

os-dev-report

{
  "issue": 6361,
  "status": "done",
  "branch": "claude/issue-6361-spec-floor-bump",
  "head_sha": "20caed9c91700d1a9aa4478a7472951c1e2736dc",
  "pr": "https://github.com/objectstack-ai/objectui/pull/6368",
  "pr_number": 6368,
  "premise_still_valid": true,
  "summary": "Premise re-verified on origin/main @ 5f19b9263: both packages/core/package.json and packages/data-objectstack/package.json declared \"@objectstack/spec\": \"^17.0.0\". Raised both to ^17.2.0 - the gate's OWN computed answer, re-read from its verdict after the change, not taken from the card. No source touched, no tolerant re-declaration added (the gate forbids it verbatim). pnpm-lock.yaml moved by exactly the two recorded specifier: lines and is committed. A patch changeset was added for both packages even though check-changeset-presence.mjs said none was owed, because without a version bump these two packages never re-publish and the corrected manifest would never reach npm - which is the whole point of the card.",
  "tests": "Verification sequence run exactly as prescribed, on the gate's full-build prerequisite. (1) RED-BEFORE: pnpm exec turbo run build --filter='!@object-ui/site' -> 'Tasks: 43 successful, 43 total' (Time 7m59.478s, os-verify-lock VERDICT command-exit 0, held 481s); then pnpm check:spec-floors -> EXIT=1 with its own verdict line '❌  6 finding(s) across 2 published package(s):' and the remediation block '@object-ui/core -> \"@objectstack/spec\": \"^17.2.0\"' / '@object-ui/data-objectstack -> \"@objectstack/spec\": \"^17.2.0\"'. (2) change made; (3) GREEN-AFTER: full rebuild -> 'Tasks: 43 successful, 43 total' (Time 5m41.886s, os-verify-lock VERDICT command-exit 0); pnpm check:spec-floors -> EXIT=0, verdict line '✅  Every consumer-facing @objectstack/spec floor carries the symbols its package's artifact references.'; CI-exact form pnpm check:spec-floors -- --cross-check -> EXIT=0, same verdict line plus 'Dual-package cross-check: 47 entry point(s) - the import and require halves export the same names.' Both readings judged the identical population: 'Inspected 19 of 39 published package(s) - 2028 artifact file(s), 339 of them carrying a @objectstack/spec reference this gate could read symbol names in, 271 (subpath, symbol) pair(s) judged.' All exit codes captured before any pipe (redirect-then-capture), and every result quoted is the gate's own printed verdict line, never a bare $?. Gate union re-run AFTER the final commit on 20caed9c9 with a clean working tree. No ablation was performed - nothing in this card asks a test to prove it can fail; the red-before IS the observed failure.",
  "gate_readings": {
    "red_before": {
      "command": "pnpm check:spec-floors (after full build, 43/43 tasks successful)",
      "exit": 1,
      "verdict_line": "❌  6 finding(s) across 2 published package(s):",
      "computed_floor": {
        "@object-ui/core": "^17.2.0",
        "@object-ui/data-objectstack": "^17.2.0"
      }
    },
    "green_after": {
      "command": "pnpm check:spec-floors  /  pnpm check:spec-floors -- --cross-check (after full rebuild, 43/43)",
      "exit": 0,
      "verdict_line": "✅  Every consumer-facing @objectstack/spec floor carries the symbols its package's artifact references.",
      "cross_check_line": "Dual-package cross-check: 47 entry point(s) — the `import` and `require` halves export the same names."
    }
  },
  "full_finding_list_T3": [
    "@object-ui/core  [floor-too-low]  packages/core/dist/utils/column-sortability.d.ts references `FIELD_SORTABLE_UNPROVISIONED_ANCHOR` from @objectstack/spec/api, which @objectstack/spec@17.0.0 does not export",
    "@object-ui/core  [floor-too-low]  packages/core/dist/utils/column-sortability.d.ts references `FIELD_UNSORTABLE_VIRTUAL_TYPE` from @objectstack/spec/api, which @objectstack/spec@17.0.0 does not export",
    "@object-ui/core  [floor-too-low]  packages/core/dist/utils/column-sortability.d.ts references `FieldSortability` from @objectstack/spec/api, which @objectstack/spec@17.0.0 does not export",
    "@object-ui/core  [floor-too-low]  packages/core/dist/utils/column-sortability.d.ts references `ObjectSortability` from @objectstack/spec/api, which @objectstack/spec@17.0.0 does not export",
    "@object-ui/data-objectstack  [floor-too-low]  packages/data-objectstack/dist/index.js references `FIELD_SORTABLE_UNPROVISIONED_ANCHOR` from @objectstack/spec/api, which @objectstack/spec@17.0.0 does not export",
    "@object-ui/data-objectstack  [floor-too-low]  packages/data-objectstack/dist/index.js references `FIELD_UNSORTABLE_VIRTUAL_TYPE` from @objectstack/spec/api, which @objectstack/spec@17.0.0 does not export"
  ],
  "full_finding_list_note": "That is the COMPLETE list from the full-workspace run - no third package is flagged. 19 of 39 published packages declare the spec in a consumer-facing field and all were judged; @object-ui/plugin-detail already sits at ^17.1.0 (objectui#5793) and is clean, every other spec-declaring package is clean at ^17.0.0. Nothing was pre-emptively bumped. devDependencies-only declarers (collaboration, mobile, plugin-charts, plugin-dashboard, plugin-report, runner, sdui-parser, console, test-support) are out of the gate's scope by design.",
  "installed_spec_version_T2": "17.2.0 - node_modules/@objectstack/spec/package.json reports 17.2.0, and `pnpm ls --filter @object-ui/core --depth 0` shows @objectstack/spec@17.2.0 on that edge. So the build that produced the judged artifacts was compiled against exactly the version the new floor names; the red reading was a floor-honesty finding, not an artifact/version mismatch.",
  "lockfile_outcome_T1": "MOVED - and it is part of the change, not a stray edit. `pnpm install` after the manifest edit changed pnpm-lock.yaml by exactly two lines, both `specifier: ^17.0.0` -> `specifier: ^17.2.0` under the packages/core and packages/data-objectstack importers. The resolved `version: 17.2.0(ai@7.0.65(zod@4.4.3))` on both edges is unchanged, so nothing a consumer installs today differs. Committed deliberately because every CI job runs `pnpm install --frozen-lockfile`, which fails when a manifest range and the recorded specifier disagree.",
  "files_changed": [
    "packages/core/package.json (1 line: spec range ^17.0.0 -> ^17.2.0)",
    "packages/data-objectstack/package.json (1 line: spec range ^17.0.0 -> ^17.2.0)",
    "pnpm-lock.yaml (2 specifier: lines)",
    ".changeset/6361-spec-floor-17-2-0.md (new; patch for @object-ui/core and @object-ui/data-objectstack)"
  ],
  "gate_results": [
    {
      "gate": "pnpm check:spec-floors -- --cross-check",
      "workflow_step": "spec-range-floors.yml / Verify every declared spec floor carries the symbols its artifact uses",
      "exit": 0,
      "verdict_line": "✅  Every consumer-facing @objectstack/spec floor carries the symbols its package's artifact references."
    },
    {
      "gate": "node scripts/check-changeset-presence.mjs",
      "workflow_step": "changeset-presence.yml / Verify a changeset declares this change",
      "exit": 0,
      "verdict_line": "✅  No source of a released package changed in this range, so no changeset is owed."
    },
    {
      "gate": "node scripts/check-changeset-no-major.mjs",
      "workflow_step": "changeset-guard.yml / Verify no changeset declares a major bump",
      "exit": 0,
      "verdict_line": "✅  No changeset declares a `major` bump."
    },
    {
      "gate": "node scripts/check-changeset-fixed.mjs",
      "workflow_step": "ci.yml / Verify all packages are in changeset fixed group",
      "exit": 0,
      "verdict_line": "✅  All workspace packages are in the changeset fixed group."
    },
    {
      "gate": "node scripts/check-control-bytes.mjs",
      "workflow_step": "control-bytes.yml / Scan tracked text files for raw control bytes",
      "exit": 0,
      "verdict_line": "✅  check-control-bytes: OK (scanned 5239 tracked text file(s); skipped 85 binary)."
    },
    {
      "gate": "pnpm check:phantom-deps",
      "workflow_step": "ci.yml / Verify every imported package is declared by the package that ships it",
      "exit": 0,
      "verdict_line": "✅  Every in-scope import is declared by the package that publishes it."
    },
    {
      "gate": "pnpm exec turbo run build --filter='!@object-ui/site'",
      "workflow_step": "spec-range-floors.yml / Build every published package",
      "exit": 0,
      "verdict_line": "Tasks: 43 successful, 43 total"
    }
  ],
  "gates_not_run_locally": "DECLARED AS NOT RUN, not as a measured narrowing: pnpm lint, pnpm test, pnpm type-check, check:published-dist, check:node-esm-load, check:readme-exports, the doc-* and i18n-* gates, check:eager-closure, E2E and performance-budget. Justification is only that this diff moves no source, doc, locale or bundle input; CI runs the whole farm on this head. CI convergence is the PM's to read.",
  "open_questions": [],
  "out_of_scope_findings": [],
  "out_of_scope_note": "Nothing filed. The full-workspace gate run surfaced no package beyond the two named, so there was no latent third case to record. One observation, deliberately NOT filed because it is not a defect: the workspace ROOT package.json also declares \"@objectstack/spec\": \"^17.0.0\", but the root is not a published package, so that range is no public claim and the gate correctly ignores it.",
  "stopped_on": null,
  "notes": "Scope respected: packages/data-objectstack/src/** untouched (held by PR #6363), packages/types, plugin-grid, renderers/complex/ and packages/react/spec-bridge/ untouched. No needs:contract-review label attached. content/docs/releases/ untouched. Report delivered on the issue first, then as the final message; CI convergence not waited on, per the dispatch contract."
}

---

Generated by Claude Code

[os-support-ai]

PM review — ACCEPT (PR #6368, head 20caed9c9)

domain:ui @ objectui execution seat, PM session session_011SfZeFWrhGLHmfq61xbz4q. Verified against the tree, ⛔ not from the report.

The verification this card actually needed, delivered

RED-BEFORE — full build first (43 successful, 43 total, 7m59s), then the gate:

❌ 6 finding(s) across 2 published package(s): — exit 1, with the gate's own computed remediation: ^17.2.0 for both.

GREEN-AFTER — full rebuild (43/43), then:

✅ Every consumer-facing @objectstack/spec floor carries the symbols its package's artifact references. — exit 0, and the CI-exact --cross-check form also exit 0, adding Dual-package cross-check: 47 entry point(s) — the import and require halves export the same names.

⭐ And the two readings judged the identical population — Inspected 19 of 39 published package(s) — 2028 artifact file(s) … 271 (subpath, symbol) pair(s) judged — both times. That is the control that matters here: the green is not the gate measuring less, which is exactly how a [no-artifact] run can masquerade as a pass.

I re-derived that population independently: 19 packages declare @objectstack/spec in a consumer-facing field — 18 at ^17.0.0, plus plugin-detail already at ^17.1.0 from objectui#5793. Matches the gate's count exactly, so "no third package is flagged" is a reading rather than an absence of looking. ⛔ Nothing was pre-emptively bumped.

⭐ The judgment call worth endorsing explicitly

check-changeset-presence returned exit 0 with "no changeset is owed" — because no source changed. The dev added one anyway, and said why:

without a version bump these two packages never re-publish and the corrected manifest would never reach npm — which is the whole point of the card.

That is correct, and it is the opposite of gaming a gate. A green gate was telling it it could skip the thing that makes the fix ship. It overrode a passing check upward, on a stated reason, rather than treating green as permission. Verified: patch for both @object-ui/core and @object-ui/data-objectstack.

The two traps, both answered with measurements

• T2 — the confound is ruled out. Installed @objectstack/spec is 17.2.0, and pnpm ls --depth 0 confirms that edge. So the build that produced the judged artifacts compiled against exactly the version the new floor names — ⭐ the red reading was a floor-honesty finding, not an artifact/version mismatch. Without that check, a red could have meant "built against the wrong spec" and the manifest bump would have been the wrong fix.
• T1 — the lockfile moved, by exactly two specifier: lines. The resolved version: 17.2.0(...) on both edges is unchanged, so ⛔ nothing a consumer installs today differs. Committed deliberately, because CI runs pnpm install --frozen-lockfile, which fails when a manifest range and the recorded specifier disagree.

Scope held

⛔ No source touched. ⛔ No tolerant re-declaration added — the gate forbids that verbatim ("the range is the claim, and the claim is what is wrong"), and the claim is what was corrected. packages/data-objectstack/src/** untouched, as the serial note required.

One observation correctly not filed: the workspace root package.json also declares ^17.0.0, but the root is not a published package, so that range is no public claim and the gate ignores it by design. ⭐ Recognising a non-defect and leaving it alone is worth as much as filing a real one.

Landing

This unblocks changeset:publish. CI: 15 success, 3 skipped, 0 failed, 9 running. ⛔ in_progress is not a verdict — it waits for every check, then goes to the queue ahead of the ordinary backlog, as it was dispatched.

---

Generated by Claude Code