chore(deps): upgrade ObjectStack 9.4 → 9.11 + metadata migrations (1.2.0)

Bumps all @objectstack/* to ^9.11.0 (manifest specVersion ^9.11.0, app 1.2.0).
9.5→9.11 is mostly additive; four breaking changes required metadata fixes,
plus one runtime behavior change. Full pipeline green (validate + typecheck +
build + 17 tests) and browser-verified end-to-end.

Breaking-change migrations:
- Permissions: cross-ref validator no longer auto-prefixes object refs with the
  namespace — all 6 profiles now use crm_-prefixed object/field keys (44 errors).
- Fields: removed display props dropped from the schema (addressFormat,
  displayMap, allowGeocoding, colorFormat, presetColors, allowHalf,
  writeRequiresMasterRead) from account/lead/contact/quote/contract.
- CEL: monthsBetween() removed — crm_contract.valid_contract_term rewritten as
  addMonths(start_date, contract_term_months) != end_date.
- Seed: object validations now run on defineSeed() inserts (9.4 bypassed them);
  closed cases now carry resolution, escalated cases escalation_reason.

Runtime behavior:
- 9.x re-stamps owner_id/timestamps post-seed via beforeUpdate; the
  opportunity/quote "freeze closed record" hooks now exempt framework-managed
  columns so system writes pass while business-field edits stay blocked
  (verified: amount write on closed-won → 400, next_step → 200).

53 advisory liveness-dead-property warnings (enable.* flags, lookup
referenceFilters) left in place — no typed working replacement; documented in
CHANGELOG.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: os-zhuang

CHANGELOG.md

@@ -2,6 +2,26 @@
 
 All notable changes to HotCRM are documented in this file. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); HotCRM follows [Semantic Versioning](https://semver.org/).
 
+## [1.2.0] — 2026-06-20
+
+Platform upgrade to ObjectStack 9.11. Built, validated, type-checked, unit-tested (17/17) and browser-verified against `@objectstack/* ^9.11.0`; the manifest `specVersion` now declares `^9.11.0` (was `^9.4.0`). The 9.5→9.11 deltas surfaced four breaking changes that required metadata fixes:
+
+### Changed
+
+- **ObjectStack platform 9.4 → 9.11** across all `@objectstack/*` packages. Additive on the runtime surface except for the breaks below.
+
+### Fixed (breaking-change migrations)
+
+- **Permission object references must be fully-qualified.** The cross-reference validator no longer auto-prefixes a permission's `objects`/`fields` keys with the stack namespace. All six profiles now reference `crm_lead`/`crm_account`/… (and field overrides like `crm_account.annual_revenue`) instead of the bare `lead`/`account` names — matching views, sharing rules, and actions. Previously `objectstack validate` failed with 44 "object not defined in objects" errors.
+- **Removed dropped field-display config props.** `Field` no longer types `addressFormat`, `displayMap`, `allowGeocoding`, `colorFormat`, `presetColors` (address/location/color fields), `allowHalf` (rating), or `writeRequiresMasterRead` (master-detail). These display-only hints were stripped from the field schema; they have no typed replacement and were removed from `account`/`lead`/`contact`/`quote`/`contract` objects.
+- **`monthsBetween()` CEL builtin removed.** `crm_contract`'s `valid_contract_term` validation now expresses the same invariant with the surviving `addMonths()` builtin: `addMonths(start_date, contract_term_months) != end_date`.
+- **Object validations now run on seed inserts.** 9.x enforces object validation rules during `defineSeed()` loading (9.4 bypassed them). The case seed data shipped `closed` cases with no `resolution` and `escalated` cases with no `escalation_reason`, which violate the object's own rules — ~14 records silently failed to insert. The generator and the two explicit closed cases now supply both fields, so all 38 cases load.
+- **Lifecycle "freeze closed record" hooks no longer block framework writes.** `opportunity_lifecycle` and the quote freeze hook now exempt framework-managed columns (`owner_id`, `updated_at`, `created_by`, …) from their field-freeze guard. 9.x re-stamps ownership on records post-seed via `beforeUpdate`; the old guard rejected those system writes (`Attempted: owner_id, updated_at`). User edits to business fields on closed records are still blocked (verified: `amount` write on a closed-won opp → 400, narrative `next_step` write → 200).
+
+### Notes
+
+- 53 advisory `liveness-dead-property` build warnings remain (object `enable.{trackHistory,files,feeds,activities}` flags; lookup `referenceFilters`). These are non-fatal nudges with no typed working replacement — the console now reads `lookup_filters` (not exposed by the spec builder) and per-field `Field.trackHistory` supersedes the object flag. Left in place pending a framework-supported migration path.
+
 ## [1.1.0] — 2026-06-14
 
 Platform upgrade to ObjectStack 9.4 and in-product documentation. Built and validated against `@objectstack/* ^9.4.0`; the manifest `specVersion` now declares `^9.4.0` (was `^7.7.0`).

objectstack.config.ts

@@ -31,7 +31,7 @@ export default defineStack({
   manifest: {
     id: 'app.objectstack.hotcrm',
     namespace: 'crm',
-    version: '1.1.0',
+    version: '1.2.0',
     type: 'app',
     name: 'HotCRM',
     description: 'AI-Native CRM for the ObjectStack marketplace — Accounts, Contacts, Leads, Opportunities, Cases, Knowledge, Forecasts, Campaigns, Contracts.',

objectstack.manifest.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schemas.objectstack.dev/template-manifest.json",
   "name": "hotcrm",
-  "specVersion": "^9.4.0",
+  "specVersion": "^9.11.0",
   "manifestId": "app.objectstack.hotcrm",
   "displayName": "HotCRM",
   "description": "AI-Native CRM for the ObjectStack marketplace — Accounts, Contacts, Leads, Opportunities, Cases, Knowledge, Forecasts, Campaigns, and Contracts in one production-grade workspace.",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "hotcrm",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "HotCRM - Production CRM built on ObjectStack",
   "private": true,
   "main": "./objectstack.config.ts",
@@ -26,17 +26,17 @@
   },
   "packageManager": "pnpm@10.33.0",
   "dependencies": {
-    "@objectstack/account": "^9.4.0",
-    "@objectstack/cli": "^9.4.0",
-    "@objectstack/driver-memory": "^9.4.0",
-    "@objectstack/driver-sql": "^9.4.0",
-    "@objectstack/driver-sqlite-wasm": "^9.4.0",
-    "@objectstack/metadata": "^9.4.0",
-    "@objectstack/objectql": "^9.4.0",
-    "@objectstack/runtime": "^9.4.0",
-    "@objectstack/service-analytics": "^9.4.0",
-    "@objectstack/service-automation": "^9.4.0",
-    "@objectstack/spec": "^9.4.0"
+    "@objectstack/account": "^9.11.0",
+    "@objectstack/cli": "^9.11.0",
+    "@objectstack/driver-memory": "^9.11.0",
+    "@objectstack/driver-sql": "^9.11.0",
+    "@objectstack/driver-sqlite-wasm": "^9.11.0",
+    "@objectstack/metadata": "^9.11.0",
+    "@objectstack/objectql": "^9.11.0",
+    "@objectstack/runtime": "^9.11.0",
+    "@objectstack/service-analytics": "^9.11.0",
+    "@objectstack/service-automation": "^9.11.0",
+    "@objectstack/spec": "^9.11.0"
   },
   "optionalDependencies": {
     "better-sqlite3": "^12.10.0"