Sync all six SDK-version lockfiles on bump; record the upload-versions canary

Makefile

@@ -238,6 +238,13 @@ endif
 		{ echo "ERROR: python/uv.lock is stale. Run 'make bump VERSION=$(VERSION)' first."; exit 1; }
 	@test "$$(jq -r '.packages["../../../typescript"].version' conformance/runner/typescript/package-lock.json)" = "$(VERSION)" || \
 		{ echo "ERROR: conformance/runner/typescript/package-lock.json records a stale SDK version. Run 'make bump VERSION=$(VERSION)' first."; exit 1; }
+	@# The conformance Ruby/Python runner lockfiles are gitignored and absent on a
+	@# fresh clone — check them only where they exist (a machine that has run
+	@# conformance), which is exactly where a stale one breaks `make check` (#671).
+	@test ! -f conformance/runner/ruby/Gemfile.lock || grep -qF 'basecamp-sdk ($(VERSION))' conformance/runner/ruby/Gemfile.lock || \
+		{ echo "ERROR: conformance/runner/ruby/Gemfile.lock records a stale SDK version. Run 'make bump VERSION=$(VERSION)' first."; exit 1; }
+	@test ! -f conformance/runner/python/uv.lock || (cd conformance/runner/python && uv lock --check) || \
+		{ echo "ERROR: conformance/runner/python/uv.lock is stale. Run 'make bump VERSION=$(VERSION)' first."; exit 1; }
 	@git diff --quiet && git diff --cached --quiet || \
 		{ echo "ERROR: Working tree has uncommitted changes. Commit first."; exit 1; }
 	@# Verify we're on main — release tags must be on the default branch

scripts/bump-version.sh

@@ -76,4 +76,14 @@ echo "Syncing Python lockfile..."
 echo "Syncing conformance TypeScript runner lockfile..."
 (cd conformance/runner/typescript && npm install --package-lock-only --ignore-scripts --silent)
 
-echo "Done. Bumped 10 files to $VERSION."
+# Sync conformance Ruby and Python runner lockfiles (they record the SDK's
+# version via their path deps on ../../../ruby and ../../../python). Both are
+# gitignored: left stale, the conformance targets' installs re-resolve and
+# WRITE them mid-check, so assert-lockfiles-unchanged fails (#671).
+echo "Syncing conformance Ruby runner lockfile..."
+(cd conformance/runner/ruby && bundle install --quiet)
+
+echo "Syncing conformance Python runner lockfile..."
+(cd conformance/runner/python && uv lock --quiet)
+
+echo "Done. Bumped 10 version files and synced 6 lockfiles to $VERSION."

spec/api-gaps/upload-new-version.md

@@ -135,5 +135,13 @@ documented and tested, and `visible_to_clients` was removed from the endpoint's
 reachable surface (it never set visibility — it only widened the notification
 audience, and could announce a client-invisible file to a project's clients).
 
-Still open: the live-account canary, and basecamp-cli#404's "upload new version"
-command.
+The live-account canary ran 2026-08-11 against production (account 2914079,
+Coworker QA Sandbox vault) via a throwaway Go program built on this repo's
+`go/` module: `CreateVersion` kept the upload's id and URL while reflecting the
+replacement's filename/byte_size/content_type; `ListVersions` decoded as typed
+`[]UploadVersion` with exactly one `Current` entry and `blob_changed` as the
+newest action; the older version's `download_url` served the original bytes and
+`Download` served the replacement's (both byte-compared); a `nil` description
+carried the create-time description forward. All assertions passed.
+
+Still open: basecamp-cli#404's "upload new version" command.