docs: re-scope the pin claims the 17.3.0 bump left asserting 17.2.0

[claude]

Closes #1676
Closes #1669

Description

PR #1577 moved all twelve @objectstack/* dependencies to 17.3.0 and did not re-scope the comments that name the previous pin. This re-scopes every comment that still asserted, in the present tense, that 17.2.0 is what this repo pins.

⛔ Not a find-and-replace to 17.3.0. The ruled treatment — recorded in the changeset pin-claims-rescoped-to-measurement-version.md and quoted on the card — is re-scope, not renumber: a measurement that has not been re-taken cannot be relabelled with a version it was never taken on, because that converts a stale claim into a fabricated one, which is strictly worse. Each occurrence took one of two routes:

• (a) Re-measured on 17.3.0, then written as a current reading — 15 occurrences.
• (b) Re-scoped to date itself honestly, naming the pin it was taken on and saying plainly it has not been re-taken since — 18 occurrences.

⭐ The cross-check the dispatch asked for, and its difference set

Zone 2 item 1 asked for a second, wider search of my own design, because #1467 exists precisely because #1460's own grep was narrower than the defect. The reading is not empty — it is the biggest finding on this card.

The card's grep, re-run in this worktree: 19 hits. Confirmed exactly, though its inline file list totals 18 and undercounts src/views/task.view.ts as x3 where the grep returns x4.

Three searches were run, each wider than the last:

1. The card's grep, verbatim.
2. A multi-line, whole-tree scan: comment leaders stripped so wrapped prose reads as one stream, pin-phrases matched within a 120-character window that crosses line breaks.
3. A manual classification of all 89 lines naming 17.2.0 under src/ test/ docs/, read one by one.

Difference set: 14 more occurrences, in 10 more files — all inside the card's own declared src/ test/ docs/ scope. Search 2 was a strict superset of search 1 (nothing the card found was missed), and search 3 found two more that search 2 also missed.

The structural reason, which is what #1681 needs: the card's grep is single-line, and this repo hard-wraps prose at about 78 columns. Any claim whose pin-phrase and version number straddle a wrap is invisible to it. Ten of the fourteen are the identical clause

... not the current pin (#1416: this repo has pinned
17.2.0 since PR #1442, ...)

which the regex would match perfectly if grep did not stop at the newline. The remaining four escaped for a second reason: they use phrasings the pattern does not list at all — the pin this repo runs, pinned to ... today, the version package.json now pins.

⚠️ The fourteenth is the one that matters most. test/i18n-references.test.ts asserted this repo pins 17.1.0 — a version the card's grep never searched for, because it anchored on the literal 17.2.0. A pin claim naming an even older version is structurally invisible to the whole family of greps used on all three cards. That is a fourth recurrence waiting to happen, and no amount of widening the phrase list would have caught it.

⇒ Recommendation for #1681: do not enshrine the card's grep. It under-reported this card's own defect by 42%. A step-5 grep needs to be multi-line, version-agnostic, and treated as a candidate generator whose hits are classified by hand — not as the answer.

The occurrences that are correctly left alone

Of the 89 lines under src/ test/ docs/ naming 17.2.0, 33 carried a present-tense pin claim and are re-scoped here. The other 56 say only "measured on 17.2.0" — historically true, and untouched, exactly as ruled.

Also deliberately untouched:

• .changeset/*.md — several carry present-tense pin language, but a changeset is a record of what a past change did. Rewriting one falsifies history.
• docs/architecture/module-split-inventory.json — its platform_pin field is inside a generated block stamped with the commit it was generated at, and the file says "Regenerate from the artifact; never hand-edit."
• AGENTS.md — carries the same false claim (the twin of the _hook-api.ts:50 sentence) and is fenced out of this card as a governed surface. Filed separately as AGENTS.md still says the pinned @objectstack packages are 17.2.0 — the same claim #1676 re-scoped everywhere else, in the file agents read first #1688; AGENTS.md → Platform Upgrades has no step for re-scoping the claims that name the old pin — which is why #1460, #1467 and #1676 are the same card three times #1681 does not cover it, since that card is the prevention half only and edits a different section.

Related Issues

Closes #1676
Closes #1669

Refs #1460 - #1467 - #1528 - #1577 - #1681 - #1688 - #1639

Changes Made

• 33 occurrences across 23 files re-scoped: 19 from the card's list, plus the 14 the cross-check surfaced.
• ⭐ src/objects/_hook-api.ts:50 — the one occurrence already re-measured on 17.3.0 by HookQuery declares fields and top for all three read methods, but count throws on both #1528. Label moved forward with a note that it was re-checked, per Zone 1 item 4. Read against its current state, after PR fix(hooks): give count its own query type, measured against the engine #1675 changed the file.
• ⭐ test/readonly-write-semantics.test.ts — the absorbed [finding] readonly-write-semantics.test.ts says its measurement is "against the PINNED 17.2.0 in package.json" — package.json now pins 17.3.0 #1669. Its method was inherited, not skipped: the measurement was re-confirmed first, then the label moved. Both engine internals it quotes verbatim were re-read in the installed 17.3.0 tree and still read as quoted.
• One re-measurement came back changed and is re-stated, not carried over: the @objectstack/objectql runtime export list is 147 names on 17.3.0 where the 17.2.0 taking counted 103. It is a control for "the list does not carry installFlatInput", not a fact the harness depends on; the load-bearing half is unchanged.
• A second falsehood corrected: test/i18n-references.test.ts also read "the KPI labels are not authorable" as a current fact and pointed at Upgrade @objectstack/spec to the next published release carrying the #12497 retirement (post-release hygiene) #1376, a card that is no longer open. It now cites the probe on Four KPI tile labels stay English on an otherwise Chinese landing page — the upstream precondition for translating nested properties.children is met at 17.3.0 #1639, which verified against the installed 17.3.0 that translatePage does descend properties.children, and says the outstanding half is this repo's own walk.
• One changeset.

Testing

• pnpm verify fully green — validate, typecheck, lint, lint:i18n-gate, hygiene, hygiene:tokens, build, test. 161 test files, 3402 passed, 1 skipped, exit 0.
• Zero assertion changes, proven mechanically rather than by eye. Using the repo's own stripComments() from scripts/check-source-token-ratchet.mjs, the comment-stripped text of all 22 changed .ts files is byte-identical to their state at the branch point. No expect(...) weakened, deleted, rewritten or added; no new gate, no new test.
• Re-measurement evidence: the 9 measurement-pinning test files run green on 17.3.0 (275 tests) — hook-query-predicate, forecast-current-quarter-view, readonly-write-semantics, view-references, undeclared-key-probe, case-create-form-narrowing, harness-lookup-shape, flow-filter-today-token, freeze-guard-reference-cleanup.
• Engine internals re-read in the installed tree, not inferred: the readonly strip is still guarded by if (!opCtx.context?.isSystem) in @objectstack/objectql; resolveRunDataContext in @objectstack/service-automation still returns isSystem: true for runAs: 'system' and only for it; installFlatInput is still absent from the export list and both .d.* files while wrapDeclarativeHook is still exported.
• Pin verified independently: 12 @objectstack/* dependencies in package.json, one distinct version, 17.3.0; all 12 resolve to 17.3.0 in node_modules.
• The card's grep now returns 0 hits.

⚠️ Declared deviations, for review

1. Scope is wider than the card states: 33 occurrences / 23 files, not 19 / 13. The extra 14 are the difference set above — the same defect class, the same ruled treatment, all within the card's own declared scope. Leaving them would reproduce, inside the PR that fixes the recurrence, the exact pattern that turned The 17.2.0 upgrade left 16 comments asserting that 17.1.0 is "the version this repo pins" — every one is now false, in the place a maintainer reads before acting #1460 into Nine comments assert 17.0.0-rc.2 is "the pinned" version — same defect as #1460, two pins further out of date, and missed by that card's grep #1467. ⛔ If the PM disagrees, the 14 are individually identified above and in the report and can be dropped.
2. Fence re-checked for the 4 new test/ files the widening added. The dispatch cleared only the card's six by reading F1 to F6 directly. I read the tables the same way for the new ones: test/helpers/action-sandbox.ts is named in F6 Retire the local hook / action / flow write-shape tests the platform's *-body-write-* and flow-node-write rules already enforce (epic #1579, step 3, family F6) #1587 as staying in this repo ("⛔ do not delete or move them here"), test/i18n-references.test.ts is F5 Retire the local i18n reference test and the severity-promoting i18n gate, once strict covers the i18n/missing-* and translation-target rules (epic #1579, step 3, family F4) #1585 group-A-only, and freeze-guard-reference-cleanup / sharing-posture-declaration are named in none of the six. Prose-only with zero assertion changes ⇒ HOLDING, on the same basis the dispatch used.
3. Changeset frontmatter is empty, not 'hotcrm': patch. Zone 3 item 2 suggested patch, and Zone 3 is explicitly overridable by measurement: both prior cards in this exact chain shipped empty frontmatter (pin-claims-rescoped-to-measurement-version.md, rc2-pin-claims-rescoped-and-remeasured.md), and this change releases nothing. One line to flip if the PM prefers otherwise.
4. Channel note: REST /search/* returns 403 for this session, so the mandatory duplicate search ran on MCP search_issues — two targeted calls, one of them a known-hit control to validate the empty result. 3 MCP calls total for the run.

Checklist

• I have added a changeset
• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• My changes generate no new warnings
• New and existing unit tests pass locally with my changes

⛔ Draft. Not for auto-merge while the scope deviation in item 1 is unreviewed.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
hotcrm	Ignored		Sep 6, 2026 10:47am UTC