[objectstack-fleet]

Requested by Tesla · project thread

Supersedes #26556 (Dependabot's development-dependencies group, red on Test UI).

维护者速读

• 改了什么: 把 Dependabot chore(deps)(deps-dev): bump the development-dependencies group across 1 directory with 22 updates #26556 里的开发依赖升级在当前 main 上重做一遍（eslint、typescript-eslint、turbo、@types/node、vite-plugin-dts、react-router-dom 等），只动 devDependencies 和 lockfile。另外改了两处脚手架模板的版本号，并在 dependabot.yml 加了 ignore。
• 为什么改: 常规工具链保鲜。chore(deps)(deps-dev): bump the development-dependencies group across 1 directory with 22 updates #26556 原样合会出两个问题：一是让「弹窗里的查找下拉框无法搜索」那个补丁失效（focus-scope 补丁只认 1.1.16）；二是 lockfile 里出现两份 react-router 和两份 playwright-core。所以这两个包这次不升。
• 风险与回滚: 不改任何运行时代码，生产依赖一个没动。最大的风险是开发工具小版本的行为变化，CI 全量 65 项已经覆盖。回滚就是 revert 本 PR。
• 先看: .github/dependabot.yml 新增的 ignore 和注释；ui/packages/cli/src/utils/app-generator.ts、ui/packages/create-plugin/src/templates.ts 各改一个版本号。
• 两分钟验证: 在仓根跑 pnpm install --frozen-lockfile，再跑 pnpm --dir ui run check:lockfile-integrity --base-ref origin/main，应输出 VERDICT clean。
• 需要你做的: 无。席位复核通过后经合并队列落地。
• 席位意见: ACCEPT。focus-scope 和 playwright 留待手动升级，dependabot 不会再自动提出这两个包。

What changes

Re-applies #26556's dev-dependency bumps on current main, minus two packages, with the repairs its red shards asked for:

taken	@types/node 26.6.5, @typescript-eslint/parser / typescript-eslint 8.72, eslint 10.13, svelte range ^5.57.2 (the root override keeps it on 5.57.1), turbo 2.11.10, mysql2 3.24.6, pg 8.23.1, @testing-library/dom 10.4.2, @testing-library/user-event 14.6.8, axe-core 4.14, concurrently 10.0.6, eslint-plugin-react-refresh 0.5.7, globals 17.13, react-router-dom 7.18 (resolves 7.18.5), typedoc-plugin-markdown 4.14, vite-plugin-dts 5.1, react-grid-layout 2.3, @types/vscode 1.140
held	@radix-ui/react-focus-scope (stays 1.1.16), playwright / @playwright/test (stay on their ranges, resolving 1.63.0)

• focus-scope held. pnpm-workspace.yaml patches @radix-ui/react-focus-scope@1.1.16 exactly: the focus-trap race fix that keeps a lookup popover's search input focusable inside a Dialog. chore(deps)(deps-dev): bump the development-dependencies group across 1 directory with 22 updates #26556's 1.3.1 ships unpatched, and ui/packages/components/src/__tests__/dialog-popover-focus-scope.test.tsx fails on it (Test UI 4/16 there).
• playwright held. service-print and dogfood pin playwright-core 1.63.0 exactly, matched to the container's chromium build. Bumping the two ranges alone forks playwright-core into two copies, which check:lockfile-integrity (now in Type Check UI) refuses.
• Lockfile deduped. The peer-resolved copies of react-router-dom (plugin-detail, plugin-designer), mysql2 and pg stayed on the old versions after the relock. The second react-router copy is what nulled the router context in RecordDetailView.recordOpenWaves-13010.test.tsx (Test UI 15/16 there). pnpm dedupe removed only those old copies.
• Scaffold ranges follow the workspace (Test UI 10/16 and 14/16 there): @object-ui/cli's routed app declares react-router-dom ^7.18.4, and @object-ui/create-plugin's plugin declares vite-plugin-dts ^5.1.2. Changeset 26556-scaffold-dev-ranges.md, patch.
• .github/dependabot.yml ignores focus-scope and the playwright trio, each with the reason and the by-hand route, so the next group PR does not bring them back. (dependabot.yml is not a governed surface; .github/workflows/** is untouched.)

Why

Routine dev-toolchain freshness, without the two bumps that would regress a patched production fix and fork the browser driver.

Verification

At head bb513d428e, on main 3230bdb:

• pnpm install --frozen-lockfile: exit 0.
• pnpm --dir ui run check:lockfile-integrity --base-ref origin/main: VERDICT clean — no package gained a copy.
• The four tests that were red on chore(deps)(deps-dev): bump the development-dependencies group across 1 directory with 22 updates #26556, run together from ui/: 4 files, 88 tests passed (dialog-popover-focus-scope, RecordDetailView.recordOpenWaves-13010, create-plugin templates, cli app-generator). Before the dedupe, RecordDetailView.recordOpenWaves-13010 reproduced chore(deps)(deps-dev): bump the development-dependencies group across 1 directory with 22 updates #26556's failure locally (Cannot destructure property 'basename', two react-router copies).
• The full suites run in CI on this PR.

Clause-②: no
Metadata-protocol: none

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic. (no schema change)
• 2. Every name I added uses the casing for its kind.
• 3. No formatter ran; pnpm lint passes. (CI)
• 4. One issue, one branch off an up-to-date main, one pull request.
• 5. A change that publishes carries a changeset, and both declaration lines are filled in here and in the changeset.
• 6. packages/spec touched: its generated artifacts are regenerated and committed. (only its @types/node devDependency moved)
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English.

🤖 Generated with Claude Code

https://claude.ai/code/session_01L9qibwmEPoSR8apWBvbyFj

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json f708cf224a9c70447fd2030ad10596b28cc0edec → packageMentionDocs.

[objectstack-fleet]

席位核对

Seat review record, 2026-10-28T04:24Z, head bb513d428e62663a5803724677c4fd4a4a3f3108, base f708cf224a. Verdict: ACCEPT.

Reviewed under pm-dispatch at the maintainer's instruction in the project thread: 「pr 你应该使用 pm-dispatch 技能审核并落地」. The same session wrote this takeover (the maintainer chose "接管:剔除 focus-scope 后升级" on #26556), so this record is checked against GitHub and the diff, not against the author's narrative.

item	reading
Shape	Draft, base main, 1 commit, 107 files, +933 / -990 = 1923 changed lines (≤ 3000). No closing keyword in the body: Supersedes #26556 closes nothing, and there is no card. check-governed-merges.mjs --branch claude/project-thread-7umiqt: 0 of 107 paths hit the register, NOT governed. Paths are **/package.json, pnpm-lock.yaml, .github/dependabot.yml, two ui/ scaffold sources and one changeset. No packages/spec/src/**, no .github/workflows/**.
Premise measured	#26556 at b5723e46 was red on Test UI 4/10/14/15 and Check Changeset. Read from its job logs: focus-scope regression, two scaffold range pins, and a RecordDetailView router-context failure. Reproduced locally before the dedupe (two react-router copies). The four files pass locally on this head (4 files, 88 tests). check:lockfile-integrity --base-ref origin/main: VERDICT clean.
Gates (check-runs pinned to head bb513d42)	65 runs, every conclusion success or skipped (skips are opt-in or push-only jobs). Required set: Lint & Repo Gates success, TypeScript Type Check success, Test Core success, Build Core success, Governed Surface Queue Guard success, Lint UI success, Type Check UI success, Test UI success (16/16 shards), Build & E2E UI success. Advisory: Check Changeset success. mergeable_state = clean.
Accepted deviations	(1) playwright / @playwright/test held back as well as focus-scope, because of the playwright-core 1.63.0 exact pin (service-print runtime dependency and dogfood) and the container's chromium build. (2) pnpm dedupe removed old peer-resolved copies only: react-router-dom/react-router 7.18.2, mysql2 3.24.4, pg 8.23.0, pg-connection-string 2.14.0, pg-protocol 1.16.0, pg-cloudflare 1.4.0. (3) Many published packages' manifests move only in devDependencies. That changes nothing a consumer installs, so only the two packages whose shipped source moves (@object-ui/cli, @object-ui/create-plugin) carry the changeset. (4) svelte's root range reads ^5.57.2 while the workspace override keeps it at 5.57.1, the same shape as before.
Out of scope	The focus-scope bump needs the patch re-keyed and re-verified against the newer release. The playwright trio has to move together with the browser build. dependabot.yml comments carry both by-hand routes. No card filed: both are optional upgrades with no current defect. Skills-docs: n/a (kind none, no narrowing).
Landing	Non-governed, ≤ 3000 lines, green, clean. Lands through the merge queue: relay pr_ready, then automerge_enable.

Changeset sentences checked against the diff: "A routed app scaffolded by @object-ui/cli now declares react-router-dom ^7.18.4" matches ui/packages/cli/src/utils/app-generator.ts:208. "a plugin scaffolded by @object-ui/create-plugin now declares vite-plugin-dts ^5.1.2" matches ui/packages/create-plugin/src/templates.ts DEV_DEPENDENCIES.

---

Generated by Claude Code

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 40637655035 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

分类：failure —— 按下面的日志分诊。

失败的 job（日志抽取，best effort）：

• Test UI (3/16) — 失败步骤: Run the ui tests (shard 3/16)

  × the package door draws the `*` entry too, and its save keeps the stored `*` entry 1032ms
  FAIL   dom  packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.objectGrantInherited-27010.test.tsx > every object-row control writes only what the admin sees change (objectstack#27010)
    ↳ 失败原因: (这条 FAIL 之后 12 行内没有可识别的原因行 —— 点进 job 看)
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️ 断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.objectGrantInherited-27010.test.tsx — 24h 内已弹出 3 个 PR（fix(app-shell): list a package's draft objects in the Access matrix, badged as drafts #27064、chore(deps): take #26556's dev-dependency bumps, minus focus-scope and playwright #27072、fix(app-shell): a package-door permission save keeps the pending draft's values #27080），但它们同属 1 条投机栈 ⇒ 1 次独立命中。汇总 issue：Queue-flake anchor: packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.objectGrantInherited-27010.test.tsx #27097（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 21 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)