chore(deps): upgrade the ObjectStack platform to 18.0.0-next.1

Filing gate ③: a task the maintainer directed, verbatim, in the repo:hotcrm seat's chat (session_01P8mZuzuyZAHSrgQKmv6ASv): 「18.0.0-next.1 已发布，升级试试」.
Reader: the repo:hotcrm seat dispatches it in this act (claim follows). ⛔ Not a claim by itself.
Dedupe: the seat's scan of the newest 300 hotcrm issues and PRs (#1791–#2104, all states) on titles matching next.1 / 18.0.0 / upgrade … objectstack → 9 hits, all closed (the earlier bumps #2091 / #2031 / #2008 / #1982 / #1970 / #1807, plus #2093 / #2092 / #2048); none is this bump.

What is published (read from the npm registry when this card was filed)

@objectstack/* dist-tag next = 18.0.0-next.1 (published 2026-10-14T11:59:57Z); latest is still 17.7.0. main f2b679af pins 18.0.0-next.0 across 23 @objectstack/* entries in package.json, with specVersion: "^18.0.0-next.0" in objectstack.manifest.json.

The work (AGENTS.md "Platform Upgrades", in order)

Read the release notes for 18.0.0-next.1 first (the per-major page and each package's CHANGELOG.md entry); list every breaking or behaviour change that touches this app.
Bump every @objectstack/* entry together to 18.0.0-next.1, align specVersion, regenerate the lockfile with pnpm.
pnpm verify green; then browser-verify the main journeys (leads → convert, opportunities, quotes, cases, web forms, dashboards) on the new pin.
Re-scope the claims that name the old pin (18.0.0-next.0) by shape, never renumber blindly (AGENTS.md step 5).
A changeset records the upgrade (not CHANGELOG.md).
For the seat's unlock scan, a per-row table: which upstream fixes this lane waits on are present in 18.0.0-next.1 (by fix commit or CHANGELOG line). The rows: objectstack#23221 (Refuse a hand delete of a settled quote's or a closed deal's line item, once the platform declares the cascade-delete hook signal (#2078 ruling C, step 2) #2088), objectui#12357 (The lead's Name column and FULL NAME render in a monospace code font: text formulas (full_name, …) declare no returnType, and the console draws an untyped formula as code #2095), objectstack#23279, objectstack#23284, objectui#12330–#12333, objectstack#23255, objectstack#23256, objectui#12220, objectui#12228, objectstack#23032, objectstack#22722, objectui#12358, objectui#12359.

Acceptance

main pins 18.0.0-next.1 everywhere; pnpm verify and CI are green; the journeys walked on the new pin show no regression, or each regression is a card (upstream when the platform is the producer, AGENTS.md §2); the unlock table is in the PR body.

Generated by Claude Code

Claim: PM loop round R86 (maintainer direct dispatch)
Session: session_01P8mZuzuyZAHSrgQKmv6ASv
Account: sunhaolin (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-2105-objectstack-18-next-1
Worktree: hotcrm-issue-2105
Domain: repo:hotcrm (single-lane repo, no domain:* taxonomy)
Seat: repo:hotcrm#1
File surface: package.json (the 23 @objectstack/* entries) and pnpm-lock.yaml (regenerated by pnpm), objectstack.manifest.json (specVersion), the claims that name the old pin (AGENTS.md "Platform Upgrades" step 5), whatever src/** / test/** / content/docs/** change a documented breaking change in 18.0.0-next.1 requires (each named in the PR against its release-note line), one .changeset/2105-*.md. A regression whose producer is the platform goes upstream and is not routed around (AGENTS.md §2) (stop on breach; explain in the report)
Container & model: L (an upgrade; journeys browser-walked), mode:subagent, model: default (dispatch-gates --tier --repo objectstack-ai/hotcrm package.json: "no path-derived mandate"; the tier stays the PM's per-card call)
Clause-②: no
Responsibility: n/a — not a defect card
Thread-read: none
Serial constraints cleared: package.json / pnpm-lock.yaml: dependabot #2063 and #2064 are open on them (not this seat's). PR #2102 (#2016, landing now) touches src/sales/flows/**, README.md, docs/STATUS.md and tests; the later lander merges main. Nothing else is in flight in this lane.

Generated by Claude Code

docs(profiles): record that the service_agent name binding resolves o…

os-dev-report

{
  "issue": 2105,
  "status": "done",
  "branch": "claude/issue-2105-objectstack-18-next-1",
  "pr": "https://github.com/objectstack-ai/hotcrm/pull/2106",
  "session": "session_01P8mZuzuyZAHSrgQKmv6ASv — the PM seat's session (this dev ran as its subagent)",
  "premise_still_valid": true,
  "summary": "All 23 @objectstack/* pins move 18.0.0-next.0 -> 18.0.0-next.1 (H1 confirmed: every one is on npm, dist-tag next). specVersion and engines.protocol in objectstack.manifest.json and both package manifests move to ^18.0.0-next.1 (H4; the repo's own docs-declared-versions guard requires all four). Then four next.1 release-note changes are adopted, each with its own FROM -> TO. (1) The three controlled_by_parent objects with a required-lookup parent (campaign_member, event_attendee, article_feedback) become master_detail: restrict, restrict, cascade (spec 76815b9, which names these three objects). (2) The five schedule-run notify nodes carry sourceObject + sourceId (24e064f / objectstack#23284; without it a multi-organization install refuses the emit and the sweep abandons the record). (3) Four reduced test kits stop inserting their own Default Organization (917b1a0). (4) hierarchy-read-depth saves its throwaway sets through PUT /meta/permission (66949b7). H3: no platform regression found; every red was an app-side adaptation a release note prescribes. The pin-claim sweep re-scoped STATUS.md, the three What's new pages and four comments. The unlock table, the per-change list and the measured not-applicable list are in the PR body; main (#2102) was merged before opening.",
  "tests": "pnpm verify, every link under os-verify-lock.sh at HEAD 19a5418f (clean tree, main 850f75c2 merged): validate exit 0 '✓ Validation passed' (18 Objects, 357 Fields, 33 Flows); typecheck exit 0 (tsc --noEmit, test/** included); lint exit 0 '18 suggestion(s)'; lint:i18n-gate exit 0 '0 i18n/missing-* issues'; hygiene exit 0 '✓ source hygiene clean'; hygiene:tokens exit 0 '✓ source token ratchet clean'; build exit 0 '✓ Build complete', 8 author-time warnings; test exit 0 'Test Files 179 passed (179) · Tests 3660 passed | 1 skipped (3661)' (VERDICT command-exit 0, 508 s). Before/after: on the bump alone (a972317b), validate exit 1 refusing crm_article_feedback (cbp rule), and test 'Test Files 9 failed | 170 passed · Tests 6 failed | 3561 passed | 87 skipped' — every failure traced to items 1-4 or the two docs guards. Notify cause measured with a control leg: a throwaway probe (never committed) ran opportunity_stagnation on the boot's single organization (notify success, task written), then after seeding a second organization (notify failure; emit rejected with code ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED on sys_notification, read off the messaging service); with sourceObject/sourceId the two-org run writes the task and flow-scheduled-org-partition is 19/19. Baseline: main 850f75c2 on next.0 in a throwaway worktree gives the same 8 build warnings and 18 lint suggestions, line for line. Browser pass (Chromium /opt/pw-browsers/chromium, own dev server on 4108, fresh DB, pnpm demo:staff): 5 dashboards draw (4-5 chart wrappers, 13-21 marks each; 67 dataset queries all 200; 0 console errors); na.rep creates 2 leads in the New form and converts one into a new account and one into the existing Acme Corporation (same id), both is_converted true; opportunity, quote, account, case, article, campaign and event list and record pages render with no failed API call; Enroll Members 4 -> 7 and the Related tab lists them with the relatedListColumns-only Added Date column; DELETE of a campaign or event with child rows answers 409 DELETE_RESTRICTED and the parent survives; Helpful as service.agent writes feedback she reads back; /forms/contact-us and /forms/support submit 201 and land a web lead and case CASE-00039 (auto-assigned to the agent); security/explain for service.agent (position only) answers permissionSets [service_agent, member_default]. No ablation: no gate was added or edited.",
  "mcp_calls": "0 — no MCP GitHub tool was called",
  "api_writes": "2 — (1) POST /repos/objectstack-ai/objectstack/dispatches (fleet-write relay, request fw-20261014T134345Z-2d07fa, run 38574245058 success) carrying one pr_create, which created hotcrm#2106 as draft with assignee sunhaolin, body read back byte-identical; (2) this os-dev-report comment on hotcrm#2105 via scripts/pm/post-stamped.mjs. Zero label writes. Every other GitHub call was a GET.",
  "gates": {
    "local_at_head": "19a5418f",
    "pnpm validate": "0",
    "pnpm typecheck": "0",
    "pnpm lint": "0",
    "pnpm lint:i18n-gate": "0",
    "pnpm hygiene": "0",
    "pnpm hygiene:tokens": "0",
    "pnpm build": "0",
    "pnpm test": "0",
    "ci_check_runs_at_report": "read once at PR open: Vercel Preview Comments success, Label Pull Request success, link-check success; Build and Test (22.x), Typecheck and Build, Quality Checks, Analyze Code (javascript), Playwright, Check Changeset in_progress (not waited on)"
  },
  "line_budget": "29 files, 1,313 changed lines including pnpm-lock.yaml (291 without it); under the 3,000-line maintainer-routing threshold",
  "files_changed": [
    ".changeset/2105-objectstack-18-next-1.md",
    "content/docs/whats-new.mdx",
    "content/docs/whats-new.zh-Hans.mdx",
    "content/docs/whats-new.zh-Hant.mdx",
    "docs/STATUS.md",
    "objectstack.manifest.json",
    "package.json",
    "pnpm-lock.yaml",
    "src/marketing/flows/campaign-enrollment.flow.ts",
    "src/marketing/objects/campaign_member.object.ts",
    "src/revenue/flows/contract-expiration.flow.ts",
    "src/revenue/flows/contract-renewal.flow.ts",
    "src/revenue/objects/opportunity_line_item.object.ts",
    "src/revenue/objects/quote_line_item.object.ts",
    "src/sales/flows/opportunity-stagnation.flow.ts",
    "src/sales/flows/task-due-reminder.flow.ts",
    "src/sales/index.ts",
    "src/sales/objects/event_attendee.object.ts",
    "src/sales/profiles/service-agent.profile.ts",
    "src/service/flows/case-sla-monitor.flow.ts",
    "src/service/index.ts",
    "src/service/objects/article_feedback.object.ts",
    "test/campaign-member-cascade.test.ts",
    "test/cascade-guard-messages.test.ts",
    "test/case-creation-date.test.ts",
    "test/event-attendee-cascade.test.ts",
    "test/freeze-guard-reference-cleanup.test.ts",
    "test/hierarchy-read-depth.test.ts",
    "test/lead-duplicate-link-cleanup.test.ts"
  ],
  "deviations": [
    "docs.objectstack.ai is refused at this container's egress proxy (CONNECT 403), so the v18 release page and the Upgrading page were read from objectstack's source at the 18.0.0-next.1 release commit 0c52e430 (and diffed against next.0's d889448b). Every installed CHANGELOG 18.0.0-next.1 section was read too.",
    "File surface: beyond package.json, the lockfile and specVersion, the PR moves engines.protocol in src/sales/index.ts and src/service/index.ts, held to the installed spec by test/docs-declared-versions.test.ts. It also corrects three comments next.1 made false without a version token (two line-item objects, service-agent.profile.ts). Both fall under the claim's 'claims that name the old pin' and 'documented breaking change' clauses, and are named in the PR.",
    "Each full pnpm test run takes ~8.5 min, close to the ~10-min foreground cap. It ran under the lock via nohup, with a foreground tail --pid wait. A throwaway test/zz-probe-2105.test.ts and two one-off tsx probes were created to measure, then deleted, and never committed.",
    "A throwaway detached worktree /home/user/hotcrm-2105-baseline at origin/main (next.0) measured the warning baseline, and was removed (node_modules first, no --force).",
    "The harness attribution reminder asked for model-named commit trailers and a different PR footer. Commits carry the model-free pair (Claude-Session + Co-authored-by: Claude), and the PR ends with the session-URL footer, per the os-dev definition. The harness wrote no trailer itself.",
    "Editing service-agent.profile.ts while the dev server watched src restarted it once mid-walk; the walk resumed after the restart."
  ],
  "open_questions": [
    {
      "question": "next.1's v18 release page and Upgrading step 4 tell an app to take its coding-agent skills from the @objectstack/skills dev dependency and commit the synced copy. HotCRM has no such dependency and no installed skills (no skills lock, no .claude/skills). Should it adopt the catalog?",
      "options": [
        "A: leave it. Nothing is installed, so the 17-to-18 step has nothing to move, and this PR is complete without it.",
        "B: a separate card adds @objectstack/skills as a devDependency, version-locked with the train, and commits the npx skills experimental_sync copy under .claude/skills. That is a governed path, so the PR is the maintainer's own draft merge."
      ],
      "recommendation": "A for this card. Adopting a skills catalog is a new dependency and a governed-path change, outside a pin bump. If the maintainer wants it, B is its own card."
    }
  ],
  "out_of_scope_findings": [
    "class: none (observation, not filed) · reach: not measured at a public door — only in-process in the @objectstack/verify kernel · on a single-posture install holding two organizations, the engine logs 'run-history persist failed … Insert on sys_automation_run was REFUSED' (system write, organization not derivable) for each scheduled sweep run, before and after this PR's notify change; it is a platform write, not app metadata · dedupe words: run-history persist failed, sys_automation_run, single posture two organizations, scheduled run organization",
    "carrier: 承接者:无 · noted, not filed (PR Acceptance notes)",
    "class: none (observation, not filed) · reach: not measured · src/sales/reports/churn.report.ts 'Recently Lost Opportunities' filters close_date { $gte: '{30_days_ago}' } with no upper bound, the open rolling-window shape next.1's b4d573a advises closing with $lte '{today}'; its evaluation is unchanged by the bump · dedupe words: churn report recently lost, 30_days_ago open window, rolling preset today",
    "carrier: 承接者:无 · noted, not filed (PR Acceptance notes)"
  ],
  "cleanup": "dev server process group 17278 (port 4108) stopped and empty; probe files deleted; baseline worktree removed; /home/user/hotcrm-issue-2105 node_modules, .objectstack and dist removed and the worktree removed after confirming local = remote 19a5418f and a clean status."
}

Generated by Claude Code

ACCEPT → PR #2106 comment 6170107613 · 2026-10-14T13:59Z

落地 · 2026-10-14T14:01Z

读数	探针	结果
队列分支	`git ls-remote origin 'refs/heads/gh-readonly-queue/*'`	空（已出队；timeline：14:00:04 入队 → 14:00:22 merged，`objectstack-fleet[bot]`）
`origin/main`	`git merge-base --is-ancestor f4ac253f origin/main`	是；`origin/main` = `f4ac253f` `chore(deps): upgrade the ObjectStack platform to 18.0.0-next.1 (#2106)`，`package.json` 读到 `18.0.0-next.1`

状态变更：Fixes #2105 已代关（completed）；摘 pm:dispatched、unassign，收口。

docs: re-scope the claims that named 18.0.0-next.1 as the pin

Navigation Menu

Repository navigation

chore(deps): upgrade the ObjectStack platform to 18.0.0-next.1 #2105

What is published (read from the npm registry when this card was filed)

The work (AGENTS.md "Platform Upgrades", in order)

Acceptance

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

chore(deps): upgrade the ObjectStack platform to 18.0.0-next.1 #2105

Description

What is published (read from the npm registry when this card was filed)

The work (AGENTS.md "Platform Upgrades", in order)

Acceptance

Activity

objectstack-fleet commented on Oct 14, 2026

objectstack-fleet commented on Oct 14, 2026

objectstack-fleet commented on Oct 14, 2026

objectstack-fleet commented on Oct 14, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions