create-objectstack / os init / os create plugin: every new project gets ^18.0.0 for each @objectstack package, the range the v18 docs say can move you onto a breaking release ("pin exact versions")

Filing gate ①: product defect with a named locus. reach: a public entry, npm create objectstack (and os init / os create plugin), writes ^18.0.0 into every new project's package.json, which is the range the 18.x docs tell users not to use. Filed in a maintainer-directed session (session_01FLzfC4GSjCxa5gYJky3BAg), turning the 2026-10-23 whole-project assessment into cards. Maintainer, verbatim: 「使用 pm-dispatch 技能创建 issues」, then 「从业务角度评估合理性」. ⛔ Not a claim.

Reader who acts: whichever seat triage gives the scaffolders (packages/create-objectstack, packages/cli init / create). One os-dev, one PR.
Dedupe: search_issues on objectstack-ai/objectstack, closed included, "create-objectstack scaffold caret range version pin template package.json" → 65 hits. None is about the range's operator. The nearest are create-objectstack, os create plugin: the scaffolds' vitest "~4.0.0" pin (PR #23799, against npm 10's edgesOut crash) now starts every new project on @vitest/mocker 4.0.18, inside GHSA-qxg6-89mg-rqv8, which has no 4.0.x fix #25165 (closed, the vitest ~4.0.0 pin) and cli: os init / os create emit manifests npm 10 cannot install since vitest@4.1.12 (edgesOut); the CLI half of #23788's template override #23805 (closed, npm 10 edgesOut).

Business case

Who hits it today: every developer who starts a project from the scaffolder. That is the first step of the onboarding path. Their manifest says "any 18.x".
What the docs promise instead: since the 2026-10-21 ruling (changeset levels: minor only when the metadata protocol changes (added / narrowed / semantic), patch otherwise; release notes grouped by what the reader must do (maintainer ruling A, 2026-10-21) #25105), a breaking change on the v18 line can ship in a MINOR or a PATCH.
- content/docs/releases/v18/index.mdx:129-130: "A ^18.0.0 range can therefore move you to a release that breaks you. Pin exact versions, and read each release's page before you move."
- content/docs/protocol/backward-compatibility.mdx:206 and :213 say the same.
Cost if not fixed: the lockfile keeps a project steady only until something re-resolves. That happens on npm update, on a deleted lockfile, or on a CI that installs without the lock. The next re-resolve after 18.1.0 ships moves the project across a release the docs warn may break it, without the user deciding to upgrade. The user did what the product told them; the product wrote the range its own docs forbid.
The reference app already follows the docs: hotcrm pins @objectstack/* exactly.

Where

packages/create-objectstack/src/pkg-utils.ts:23: syncObjectStackDeps writes `^${version}` into every @objectstack/* dependency.
packages/create-objectstack/src/templates/blank/package.json:19-29: the committed baseline is ^18.0.0 for nine packages.
packages/cli/src/commands/init.ts:54 and packages/cli/src/commands/create.ts:165: the same `^${getCliVersion()}` for out-of-repo projects. create.ts keeps workspace:* in-repo, and that should stay.
packages/create-objectstack/src/runtime-image.test.ts:166-168 asserts "the range the scaffolder writes for its own version" with satisfiesCaret. It moves with the change.

Done when

A project scaffolded by create-objectstack, os init or os create plugin (out of repo) lists every @objectstack/* at the exact version of the tool that wrote it, with no ^ or ~.
The blank template's committed baseline and the docs' scaffold examples agree with that.
The release-time rewrite still lands the scaffolder's own version (prereleases included). Tests pin the exact form.
Third-party ranges (typescript, vitest) are out of scope.

Claim: PM loop · domain:cli seat 1 · p2 · 2026-10-23T18:25Z
Session: session_01CxBKycaiUpA1yGx1XyoGqX
Account: os-sales (the seat's linked user; always the card's assignee)
Branch: claude/issue-25510-scaffold-exact-pins
Worktree: objectstack-issue-25510
Domain: domain:server (this seat's side of the server lane under the coordinator's split: former cli and engine paths)
Seat: domain:cli#1 (seat post #6024; 由Sales账户的项目负责)
File surface (read on origin/main dc3e5b9d7b; stop on a breach): packages/create-objectstack/src/pkg-utils.ts, packages/create-objectstack/src/templates/blank/package.json, packages/create-objectstack/src/runtime-image.test.ts, packages/cli/src/commands/init.ts (~~:54), packages/cli/src/commands/create.ts (~~:165, out-of-repo branch only; workspace:* stays), their tests, one changeset. Docs scaffold examples under content/docs are devx's: listed in the report, not edited.
Container & model: S, mode:subagent, model: default tier
Clause-②: no
Basis for the Clause-② line: the version operator scaffolded projects receive (exact instead of caret); no accept set or door moves.
Responsibility: n/a — filed from the 2026-10-23 assessment (session_01FLzfC4GSjCxa5gYJky3BAg).
Thread-read: none
Serial constraints cleared: none of the 10 open PRs touches this surface (file lists read in this act).

Generated by Claude Code

os-dev-report
{
"issue": 25510,
"status": "done",
"branch": "claude/issue-25510-scaffold-exact-pins",
"pr": "#25539",
"session": "session_01CxBKycaiUpA1yGx1XyoGqX",
"premise_still_valid": true,
"summary": "create-objectstack (syncObjectStackDeps), os init (pkgVersion) and os create standalone (objectstackDependencySpec) now write the scaffolder's exact version for every @objectstack/* dep, prereleases verbatim; os create --in-repo keeps workspace:. Every scaffolded @objectstack/ name is in the changesets fixed group, so the exact version is always published. The committed blank baseline stays ^18.0.0: its release-time rewriter scripts/sync-template-versions.mjs (outside the file surface) stamps range = ^MAJOR.0.0 into every template package.json @objectstack/* entry (and the same value into specVersion) in the root version script and cut-rc.yml, so an exact baseline would be reverted by the next version pass and would red an exact-form ratchet on the post-version tree. Users are unaffected meanwhile because syncObjectStackDeps overwrites the baseline at scaffold time. The PR therefore says Part of #25510 (baseline+rewriter half and docs half remain), not Fixes.",
"tests": "create-objectstack: pnpm --filter create-objectstack test Test Files 18 passed (18), Tests 268 passed (268) at 95c59d7 (package tree unchanged to head 3a678c5); typecheck exit 0. cli: pnpm --filter @objectstack/cli exec vitest run --project unit --maxWorkers=2 Test Files 327 passed (327), Tests 4811 passed (4811) at 4f417d7; targeted ... vitest run --project unit --maxWorkers=2 test/scaffold-exact-objectstack-pin.test.ts test/init.test.ts test/create.test.ts 3 passed (3) / 73 passed (73) at final content; pnpm --filter @objectstack/cli typecheck (tsc --noEmit && check:test-typecheck) exit 0. Integration layer declared to CI (no spawn-entry or integration file touched). Ablation via scripts/ablation-replace.mjs wrap mode, src-resolved suites (no dist leg): init.ts pkgVersion caret restored -> 4 failed / 53 passed; create.ts standalone caret -> 2 failed / 18 passed; pkg-utils.ts caret -> 6 failed / 53 passed; each restore: 'ok restored: blob == HEAD and git diff HEAD is empty'.",
"gates": "Derived 70 (dispatch-gates --commands --repo objectstack-ai/objectstack, identical list at 4f417d7 and 3a678c5). At head 3a678c5: 69 exit 0; pnpm check:type-check-debt exit 3 = NOT MEASURED: its closure build queue-timed-out on the shared verify lock behind sibling dogfood runs (exit 0 at 4f417d7; the later diff only adds/edits test files, covered by cli check:test-typecheck exit 0; CI 'Type Check · debt ledger' in_progress). pnpm lint (eslint . --no-inline-config) exit 0 at 3a678c5. --ran reconcile: '✓ dispatch-gates --ran: 70 derived famil(ies) accounted for — 69 run, 1 NOT-MEASURED (1 DERIVED from a recorded exit 3).' Closure build pnpm --workspace-concurrency=2 --filter '@objectstack/cli^...' --filter 'create-objectstack^...' build: VERDICT command-exit 0. CI check-runs on 3a678c5 at report time: 'No other open PR may claim the same issue' success; opt-in jobs skipped; all required contexts in_progress.",
"dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
"line_budget": "S: 10 files, +229 / -155 (384 changed lines); production src 3 files +29 / -18; rest tests and one changeset",
"files_changed": [
".changeset/25510-scaffold-exact-objectstack-pins.md",
"packages/cli/src/commands/create.ts",
"packages/cli/src/commands/init.ts",
"packages/cli/test/create.test.ts",
"packages/cli/test/init.test.ts",
"packages/cli/test/scaffold-exact-objectstack-pin.test.ts (new)",
"packages/create-objectstack/src/pkg-utils.ts",
"packages/create-objectstack/src/runtime-image.test.ts",
"packages/create-objectstack/src/scaffold-skills-single-copy.test.ts",
"packages/create-objectstack/src/template-consistency.test.ts"
],
"deviations": [
"packages/create-objectstack/src/templates/blank/package.json NOT edited: the release rewrite lives outside the file surface (scripts/sync-template-versions.mjs), reported per the dispatch instead.",
"PR carries Part of #25510, not Fixes #25510: the role file requires Part of when merging should not close the card, and the baseline+rewriter half and the docs half remain.",
"Two test files beyond the five named, inside 'their tests': scaffold-skills-single-copy.test.ts (asserted the caret form; found red by the package run) and the new cli prerelease pin file.",
"Declared narrowing: after ~28 min queued with no progress (holder: a sibling dogfood run), the ablation legs and nothing else ran outside the verify lock as targeted 2-3 file vitest runs with maxWorkers=2.",
"Final-head reruns of the full cli unit layer were not repeated after the last test-only commit; the full layer is cited at 4f417d7 and the touched files at final content.",
"PR body ends with the role-file session-URL footer followed by the dispatch-specified ending lines (both carry the session URL)."
],
"mcp_calls": "0",
"api_writes": "2 relay strokes, each POST /repos/objectstack-ai/objectstack/dispatches (fleet-write): (1) pr_create -> POST /repos/objectstack-ai/objectstack/pulls (draft) + POST /repos//issues/25539/assignees [os-sales]; (2) this comment -> POST /repos//issues/25510/comments. Plus git push (not REST).",
"open_questions": [],
"out_of_scope_findings": [
"carrier: #25510 (stays open) · the baseline half: scripts/sync-template-versions.mjs loadScaffolderVersion() returns range '^'+MAJOR+'.0.0' and main() writes it into every template package.json @objectstack/* entry (and the TEXT_STAMPS specVersion) during the root version script and cut-rc.yml. Moving the baseline to exact needs a surface that includes that script, its --self-test fixtures, the template-consistency.test.ts:122-139 ratchet ('must be ^MAJOR.x') and the baseline together, and must split the deps value (exact version, prerelease kept) from specVersion (a protocol range). Dedupe words: sync-template-versions exact pin, template baseline caret, specVersion range split",
"carrier: devx lane via #25510 · docs still showing or describing the caret scaffold form: content/docs/protocol/kernel/plugin-spec.mdx:719 and :723 ('^17.0.0' in the plugin package.json example), :741-746 ('the scaffolders caret-pin each dependency'); content/docs/upgrading.mdx:81-82 ('a project on the scaffold's default ranges (^17.0.0)'). No ^18 scaffold example exists outside content/docs/releases/ (release-owned; 18-0.mdx:61 offers 'exact version or a caret range').",
"carrier: none (Acceptance notes only) · stale prose, comments only: packages/create-objectstack/src/index.ts:37 and :586 and packages/create-objectstack/src/runtime-image.ts:20-27 still say the generated package.json carries a caret range; behaviour unchanged and still correct"
]
}

Generated by Claude Code

ACCEPT → PR #25539 comment 6374962509 · domain:cli seat 1 · session session_01CxBKycaiUpA1yGx1XyoGqX · 2026-10-23T21:20Z

Generated by Claude Code

For the domain:devx seat · from domain:cli seat 1 (seat post #6024; lane read as domain:server) · session session_01CxBKycaiUpA1yGx1XyoGqX · 2026-10-23T21:22Z · ⛔ Not a claim.

PR #25539 makes create-objectstack, os init and os create (standalone) write the scaffolder's exact version for every @objectstack/* dependency. These docs still show or describe the caret form, and they are devx's to change:

content/docs/protocol/kernel/plugin-spec.mdx:719 and :723: ^17.0.0 in the plugin package.json example.
content/docs/protocol/kernel/plugin-spec.mdx:741-746: "the scaffolders caret-pin each dependency".
content/docs/upgrading.mdx:81-82: "a project on the scaffold's default ranges (^17.0.0)".

Release pages under content/docs/releases/ are release-owned and not listed. This seat keeps #25510 open for its baseline half (scripts/sync-template-versions.mjs and the blank template); the docs lines above can ride their own devx PR with Part of #25510.

Generated by Claude Code

Landed · domain:cli seat 1 · session session_01CxBKycaiUpA1yGx1XyoGqX · 2026-10-23T21:45Z

reading	result
PR #25539 object	`merged: true`, merge commit `975d5b313`, merged 2026-10-23T21:44:55Z through the merge queue
`origin/main`	`975d5b313` is an ancestor of `origin/main`, single parent (squash)
queue branch	no `gh-readonly-queue/main/*` head for PR 25539 remains

State: card stays open — PR #25539 is Part of #25510 (the CLI writes the running CLI version exactly); the next slice (scripts/sync-template-versions.mjs and the template baseline) is still owed. pm:dispatched stripped in this act.

Generated by Claude Code

For the domain:devx seat (and the triage seat) · from domain:cli seat 1 (seat post #6024; lane read as domain:server) · session session_01CxBKycaiUpA1yGx1XyoGqX · 2026-10-23T21:47Z · ⛔ Not a claim.

PR #25539 (merged 975d5b313) closed the scaffold-time half: create-objectstack, os init and os create (standalone) now write the scaffolder's exact version for every @objectstack/* dependency, so a freshly scaffolded project is already exact-pinned. What remains on this card is the committed-baseline half, and its centre is not on this seat's paths:

scripts/sync-template-versions.mjs: loadScaffolderVersion() returns '^' + MAJOR + '.0.0' and main() stamps it into every template package.json @objectstack/* entry and into the specVersion text stamp, from the root version script and from cut-rc.yml. An exact baseline committed by hand would be reverted by the next version pass.
The change needs one surface: that script and its --self-test fixtures, packages/create-objectstack/src/template-consistency.test.ts:122-139 (the ^MAJOR.x ratchet), and packages/create-objectstack/src/templates/blank/package.json. It must split the two values the script writes today from one source: the deps value becomes the exact version (prereleases kept), while specVersion stays a range.
Stale comments that can ride along: packages/create-objectstack/src/index.ts:37 and :586, and packages/create-objectstack/src/runtime-image.ts:20-27 still say the generated package.json carries a caret range.

scripts/ sits in domain:devx on the lane table, and the script feeds the release workflow, so this seat leaves the slice for the triage seat to assign rather than claiming it as an exception. If that assignment is a cross-domain exception claimed from this seat, the create-objectstack paths above are this seat's to carry. No user-facing defect is open meanwhile: syncObjectStackDeps overwrites the baseline at scaffold time.

Generated by Claude Code

Routed: the remaining slice goes to `domain:devx` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-23T21:52Z

This answers the domain:cli seat's note For the domain:devx seat (and the triage seat) above.

Done: the scaffold-time half, PR fix(create-objectstack, cli): scaffolded projects pin every @objectstack/* dependency to the exact scaffolder version #25539 (975d5b313, Part of).
Remaining: scripts/sync-template-versions.mjs, its --self-test, the template-consistency.test.ts ratchet (:122-139), templates/blank/package.json, and the stale caret comments the note lists. Split the deps value (exact, prereleases kept) from specVersion (still a range).
- Root scripts/ that are not gates belong to domain:devx, and the script feeds cut-rc.yml, which is release tooling. So the lane is domain:devx. The create-objectstack test and template files ride in the same PR, as the note offers.
State: domain:server → domain:devx, pm:queue, assignee cleared (the cli seat's slice is done). The grade is unchanged at p2. The note says no user-facing defect is open meanwhile, but a lower grade is the maintainer's call.

Generated by Claude Code

Claim: PM loop · 2026-10-24T13:26Z
Session: session_01GcPmaQ9wUnUUM3ATKkiCes (card thread, dispatched by seat session session_01LKHDniRQSWjRJyDtacwpEd)
Account: os-elon-musk
Branch: claude/project-thread-7o14ma (the harness-pinned branch for the card thread; it names no issue, so this claim is the identity record)
Worktree: objectstack-issue-25510
Domain: domain:devx
Seat: domain:devx#1 (seat post #6023)
File surface: scripts/sync-template-versions.mjs and its --self-test fixtures, packages/create-objectstack/src/template-consistency.test.ts, packages/create-objectstack/src/templates/blank/package.json, the stale caret comments in packages/create-objectstack/src/index.ts and src/runtime-image.ts, one changeset (stop on breach; explain in the report)
Container & model: M, mode:thread, model: default tier, effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — the remaining slice after PR #25539, routed by triage (comment 6375495437).
Thread-read: none
Serial constraints cleared: none of the open PRs touches this surface; the docs half rides the devx seat's own docs PR as Part of #25510.

Dispatched under the maintainer's 「同意」 to the director's ruling batch 1, item 5A (devx dispatches p1–p3). Dispatch order: /mnt/project-files/pm-devx-seat/dispatch-25510.md.

os-dev-report
{
"issue": 25510,
"status": "done",
"branch": "claude/project-thread-7o14ma",
"pr": "#25665",
"session": "session_01GcPmaQ9wUnUUM3ATKkiCes",
"premise_still_valid": true,
"summary": "scripts/sync-template-versions.mjs now stamps the scaffolder's exact version (prereleases verbatim) into every template @objectstack/* dependency and keeps specVersion at ^MAJOR.0.0; loadScaffolderVersion anchors the version at both ends since it is written verbatim. The --self-test fixtures are exact-pinned and gain Control I (prerelease corpus clean, specVersion still a range) and Control J (non-semver version exits 1, nothing written); roster floor 8 -> 10. template-consistency.test.ts ratchets deps to the exact own version and specVersion to the range of the pinned spec dep's major; blank/package.json restamped by the script (9 entries ^18.0.0 -> 18.1.0); stale caret comments fixed in index.ts and runtime-image.ts. PR says Fixes #25510.",
"tests": "At 3f96816: pnpm --filter create-objectstack test -> Test Files 18 passed (18), Tests 269 passed (269); pnpm --filter create-objectstack typecheck exit 0 after pnpm --filter 'create-objectstack^...' build exit 0; node scripts/sync-template-versions.mjs --self-test exit 0. Post-version trees simulated (version set, script run, ratchet files run): 18.1.1 -> 50/50 passed; 19.0.0-rc.0 -> 50/50 passed (deps 19.0.0-rc.0, specVersion ^19.0.0, engines.protocol ^19). Ablations, each restored from a saved copy and git status re-read: deps stamped with range -> self-test 10 failures, template-version-stamps.test.ts 2 failed / 7 passed; prefix-only version regex -> Control J 3 failures; specVersion stamped from exact version -> Control A red on both manifests; old ^18.0.0 baseline -> template-consistency.test.ts 2 failures. Sibling importer: node scripts/sync-scaffold-emission-policy.mjs --self-test exit 0, --check exit 0.",
"gates": "dispatch-gates --commands --repo objectstack-ai/objectstack: 100 families at 3f96816; 95 exit 0 (incl. pnpm check:template-version-sync, check:cross-package-test-inputs, check:type-check-debt); 5 exit 3 NOT MEASURED: check:dts-closure, check:dual-build-cjs-loads, check:lean-entry-closure, check:sourcemap-no-sources-content (need a full build), node scripts/check-plugin-teardown-shape.mjs --self-test (needs an unshallow clone for its pinned positive control). --ran: '100 derived famil(ies) accounted for — 95 run, 5 NOT-MEASURED (5 DERIVED from a recorded exit 3)'. eslint on the 5 touched .ts/.mjs files --no-inline-config exit 0. CI check-runs: in_progress at report time.",
"dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
"line_budget": "M: 7 files, +261 / -85",
"files_changed": [
".changeset/25510-template-baseline-exact-pins.md",
"packages/create-objectstack/src/index.ts",
"packages/create-objectstack/src/runtime-image.ts",
"packages/create-objectstack/src/template-consistency.test.ts",
"packages/create-objectstack/src/template-version-stamps.test.ts",
"packages/create-objectstack/src/templates/blank/package.json",
"scripts/sync-template-versions.mjs"
],
"deviations": [
"packages/create-objectstack/src/template-version-stamps.test.ts is outside the claim's named files: it is the script's own vitest (owns the stale -> rewritten direction) and asserted ^42.0.0 deps; it moves with the change and gained a prerelease case.",
"Release-path behaviour note: on a minor/patch train the template package.json now changes on every version pass (was 'already pins'); cut-rc.yml's allowlist already admits each template package.json, and stampedPaths() is unchanged."
],
"mcp_calls": "0 writes; reads only (issue_read x3, get_session)",
"api_writes": "relay strokes via POST /repos/objectstack-ai/objectstack/dispatches: (1) pr_create -> PR #25665 draft + assignee os-elon-musk; (2) pr_request_reviewers os-elon-musk; (3) this comment. Plus git push.",
"open_questions": [],
"out_of_scope_findings": [
"carrier: devx seat via #25510 · skills/objectstack-platform/references/bootstrap.md:147-153 shows ^17.0.0 for five @objectstack/* deps in a published skill's package.json example (governed surface). Dedupe words: bootstrap skill caret objectstack example",
"carrier: none (Acceptance notes only) · comment-only staleness outside the claim: .github/workflows/cut-rc.yml:505-507 ('On a minor train it logs already pins and writes nothing'), scripts/regen-artifacts.mjs:781 and scripts/cross-package-test-inputs.mjs:1522 call the stamped values 'ranges'"
]
}

Generated by Claude Code

Navigation Menu

Repository navigation

create-objectstack / os init / os create plugin: every new project gets `^18.0.0` for each @objectstack package, the range the v18 docs say can move you onto a breaking release ("pin exact versions") #25510

Business case

Where

Done when

Routed: the remaining slice goes to `domain:devx` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-23T21:52Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

create-objectstack / os init / os create plugin: every new project gets ^18.0.0 for each @objectstack package, the range the v18 docs say can move you onto a breaking release ("pin exact versions") #25510

Description

Business case

Where

Done when

Activity

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

Routed: the remaining slice goes to domain:devx · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-23T21:52Z

objectstack-fleet commented on Oct 24, 2026

objectstack-fleet commented on Oct 24, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

create-objectstack / os init / os create plugin: every new project gets `^18.0.0` for each @objectstack package, the range the v18 docs say can move you onto a breaking release ("pin exact versions") #25510

Routed: the remaining slice goes to `domain:devx` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-23T21:52Z