release: keep the hotcrm downstream smoke advisory and point it at hotcrm's latest release tag instead of v2.1.0 (maintainer ruling D10 = A) #25770

Filing-gate category: ③ maintainer-directed. Tesla ruled the whole-project assessment's D10 on 2026-10-25 09:23Z in the director thread, answering "A = keep advisory, the ref follows hotcrm's latest tag (data fix only); B = re-arm as a blocking gate": 「D4 · 固定发版日 没必要；其他同意 ，npm dist-tag 手工清理 应该立一张管理者维护的卡」 — "其他同意" = A. ⛔ Not a claim; for triage to grade and route.

Governing text: .github/workflows/release.yml step "Downstream backward-compat smoke (live hotcrm)" (lines ~1941–1996 on 5874d25); SKILL.md four axes, "新增门禁默认否" (why it stays advisory).

What is wrong today

• HOTCRM_REF: v2.1.0 (hotcrm on ObjectStack 14.7) with BLOCKING: '0'. hotcrm's latest release is v6.0.0 (2026-10-23, on 18.0.0), so every objectstack publish runs the only real-downstream check against a four-majors-old app and emits a warning that is certain to appear and means nothing.
  Re-check: grep -n "HOTCRM_REF:\|BLOCKING:" .github/workflows/release.yml and curl -s https://api.github.com/repos/objectstack-ai/hotcrm/releases/latest | grep tag_name
• Line ~1664's comment ties the job's Node floor to "hotcrm@v1.2.0, whose manifest pins engines.node >=22" — stale reasoning to recheck with the new ref.

The change

• Resolve the ref at run time to hotcrm's latest published release tag (fail-soft: unresolvable ⇒ a notice and skip, still advisory). ⛔ No hard-coded tag to bump by hand again.
• BLOCKING stays '0'; rewrite the step's "TO RE-ARM" comment so it no longer reads as a pending to-do.
• ⛔ No new gate, no workflow_dispatch lane.

Business rationale

A release that breaks the reference app is the cheapest real-consumer signal the publish lane has; today it is spent on a 14.7-era checkout, so a real 18.x break would surface only when hotcrm next upgrades. Warnings that always fire also train everyone to ignore the release log.

Serial constraint: the objectui-merge release-lane PR #25745 (child 4a, held for the cutover window) edits release.yml (+/-118); land this outside the cutover freeze and rebase on whichever lands second. Workflow file = governed surface (Tier H), human merge.

Reader: the devx/release seat after triage. Effort S.

Duplicate check: semantic searches "hotcrm downstream smoke release.yml HOTCRM_REF v2.1.0 latest tag" (objectstack, 5 hits, none about the ref) and "retire cut-rc prerelease-pin-watch hotcrm smoke ref" (4 hits, all closed, unrelated). No duplicate. (The assessment's Q10 also retires cut-rc.yml and prerelease-pin-watch; prerelease-pin-watch is already retired by the objectui-merge PR B #25697, and cut-rc was not part of these rulings — not in scope here.)

Evidence: https://claude.ai/artifact/8qxoYjsE4jQC4DJBCF3wm5#D10

Generated by Claude Code