deps(v18): move objectui's @objectstack/* from 18.0.0-next.1 to 18.0.0-next.2 and follow its contract changes

Filing gate ③ a task the maintainer directed, by standing practice: the maintainer's rule 「发版本优先的都p1」 gives every next.N publish one consumer bump card, "so the held follow-ups have one carrier instead of several PRs racing on the lockfile" (objectui#12370, the next.1 card). @objectstack/* 18.0.0-next.2 was published to next at 2026-10-16T03:11Z, built from objectstack e5136ff10f.

Filed by the domain:ui seat 4 (seat post objectui#10243, session_01SJn1GEkrbbBQkhGC26wEDw) as an unowned blocker of cards in this lane's queue. A dedupe in this act, over objectui and objectstack issues since 2026-10-16T03:00Z for next.2, found no bump card (the one hit, objectstack-ai/objectstack#23801, is the Docker image job). This seat claims it at filing (execution-duties: 「阻塞项无主 ⇒ 被挡席认领做掉」).

Reader (who acts): the objectui domain:ui execution seat. One PR. The publish itself is not objectui's.

What changes

objectui main (33fbc861d) resolves @objectstack/spec@18.0.0-next.1 in pnpm-lock.yaml, with ranges at ^18.0.0-next.1 across the workspace packages. The range already admits next.2. The lockfile does not, and CI installs from the lockfile. The bump moves every @objectstack/* entry in the lockfile to 18.0.0-next.2, regenerated with pnpm, and raises a range's floor only where a held card needs it.
The upstream range: objectstack 0c52e43075..e5136ff10f (the two chore: version packages (next) commits). It holds 187 commits, 39 of them !: (breaking), and 42 that touch packages/spec/src. The dev measures which of them reach objectui, against the next.2 tarball, with next.1 as the negative control.

The held cards this bump releases

The triage seat moved these to pm:queue at 04:03–04:07Z, reading objectui's range. Each card's own criterion is what objectui installs, which this PR delivers.

card	grade	how it rides
#12592	p2	items 1 and 2 in this PR. Its exit pin `AppContent.recordDialogInterimBound-12521.test.tsx` turns red once next.2 is installed, and the card says so. `recordSurface.test.ts` follows the spec's new answer. Item 3 (the page hosts' undeclared section density) stays on the card, after the bump.
#12406	p1 · `target:v18`	after the bump, unless the installed `AdminScope` turns its anchor pin or the type-check red. Then the two switch rows, their strings and the pin retire in this PR, and `Fixes #12406` rides it.
#12486	p2 · `target:v18`	after the bump, unless the app-shell server double that mirrors next.1's `COMPILED_PAGE_KINDS` goes red. Then the smallest change that follows the spec rides here, and the card keeps the rest.
#12476	p3	after the bump (objectstack-ai/objectstack#23610 is in `e5136ff10f`).
#12285	p3	after the bump (objectstack `87d061922f` is in `e5136ff10f`).

Acceptance notes

The bump PR's CI runs against the installed 18.0.0-next.2. Every red it raises is either fixed here (contract-following, as objectui#12370 did) or named as a held card's.
The objectui changeset policy follows the repo's pre mode. A lockfile-only bump with no user-facing change carries an empty changeset if the presence gate asks for one.
The objectstack console pin (.objectui-sha) is not this card's: it is a domain:devx hop in objectstack after this lands.

Claim: PM loop round 2 (an unowned blocker of this lane's queue, filed and claimed by this seat at filing; priority:p1 + target:v18 under the maintainer's rule 「发版本优先的都p1」)
Session: session_01SJn1GEkrbbBQkhGC26wEDw
Account: os-sales (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-12626-objectstack-next-2
Worktree: objectui-issue-12626 (in the cloud session's own container)
Domain: domain:ui
Seat: domain:ui#4
File surface: every workspace package.json that names @objectstack/* (a range's floor only where a held card needs it), pnpm-lock.yaml (regenerated by pnpm, never by hand), the files a next.2 red points to (contract-following), objectui#12592's items 1–2 (packages/app-shell/src/console/AppContent.tsx interimBoundedTaskFlowSurface, its exit pin AppContent.recordDialogInterimBound-12521.test.tsx, packages/plugin-view/src/recordSurface.test.ts), objectui#12406's and objectui#12486's named files only if their reds are forced, and one .changeset/12626-*.md (stop on breach; explain in the report)
Container & model: L, mode:cloud, model: opus (cloud on the maintainer's stance 「可以的话，ui 后续开发尽量用云 session，并且要求截图给我看」; lane scope on 「你也可以接ui车道的卡」; batch 5 on 「上限提到 5，提速」, this session's chat, 2026-10-15)
Clause-②: yes
Clause-② reason: @object-ui/types and @object-ui/app-shell re-export @objectstack/spec types, and a release with 39 breaking commits can move objectui's published surface in either direction («拿不准 ⇒ 按 yes»). The seat's TIER_DEFAULT review comes before ready.
Responsibility: n/a — a dependency bump, not a defect card
Thread-read: none
Serial constraints cleared: no open objectui PR touches pnpm-lock.yaml or a workspace package.json (open PRs read in this act: dependabot objectui#11845 and #11844 on next, and the release PR objectui#11600). Held cards objectui#12406, #12486, #12476 and #12285 serialise behind this PR unless a forced red folds them in, as the card's table says.

os-dev-report

{
  "issue": 12626,
  "status": "done",
  "branch": "claude/issue-12626-objectstack-next-2",
  "pr": 12648,
  "session": "session_01HcrgxQPr9VQSBrMMCtVswb",
  "premise_still_valid": true,
  "summary": "The lockfile now resolves all seven `@objectstack/*` packages at 18.0.0-next.2. It was regenerated by pnpm (`up --no-save` then `dedupe`; the dedupe also moves eight transitive patch versions, which are listed). `@object-ui/types` follows next.2's two new PageSchema checks: region placement is attached on both page nodes, and isDefault placement on the page-kind node only. objectui#12592 items 1-2 ride here: the interim is deleted, the 12521 exit pin is rewritten into a pin of the bounded derivation, and recordSurface.test.ts follows the spec. Two floors moved to ^18.0.0-next.2: types (forced, because it imports the new checks) and app-shell (#12592). The other reds after the bump are mechanical: the backend.env pin, the lockfile-integrity samples, the import-boundary census, and 31 stamped claims that were re-measured before the stamp moved. The PM's three mechanism assumptions held, with one count off: 32 package.json files name @objectstack/*, not 31; 2 spec entries; 187/39/42 commits; the cli tag peels to e5136ff10f. No PR was opened and no comment posted, per the degraded channel. The PM opens the draft from pr_body_draft with assignee os-sales.",
  "tests": "Full suite on next.2 at 56da05c, 16 shards, maxWorkers=3: reds = spec-object-refinements-7715 (2), AppContent.recordDialogInterimBound-12521 (1), recordSurface (2), ci-cd-pipeline-doc (1), check-lockfile-integrity (suite), check-installed-spec-pin-claims (2); every other shard was green (shard 2 first died on exit 137 at 4 workers and was re-run at 3). Baseline on next.1 at 33fbc861d: the 4 named pins, 31/31. After the fixes, at 9ab905b: packages/types 383/383; components 388 + 1 skipped (3 shards); cli + plugin-view 107/107; apps/console + examples 253/253 (2 shards); app-shell 1432 + 1 skipped (6 shards); scripts 185 + 2 skipped, with date-only-zone-pins-10183 red in 2 of 7 runs under load (green 5 of 7, and green 3/3 on BASE), recorded as not a contract red. At 371c3a2 (after merging main): the 42 test files main brought, 42/42; the PR's pins and ratchets, 10 files, 728/728. Negative control: the branch with next.1 installed, recordSurface 2 red, the 12521 pin 8 red, 7715 and 8317 red. Ablations (on-disk anchor checked, trap restore, HEAD hash compared, git diff HEAD empty): AppContent `=== 'full'` flipped, 4 red; region check removed from PageNodeSchema, 3 red; isDefault check removed from the kind node, 1 red; isDefault check added to PageNodeSchema, 1 red. Ablations ran against src through relative imports, so no dist rebuild was involved. Browser: HotCRM on next.2 (scratch copy) Leads -> New, 1024 px at 1440, and the 390x844 sheet at 390.",
  "gates": "Build turbo 43/43 exit 0 (56da05c); changed packages rebuilt 29/29 exit 0. type-check turbo 81/81 exit 0 (56da05c); types+app-shell+plugin-view+components closure 33/33 exit 0 (final code). Exit 0 on the final tree: check:installed-pin-claims, check:lockfile-integrity, check:lockfile-dedupe, check:spec-floors (control: types floor back at next.1 gives exit 1 with floor-too-low on both new symbols), check:spec-symbols, check:phantom-deps, check:self-import, check:control-bytes, check:new-line-citations, check:doc-json, check:doc-examples, check:doc-snippets, check:doc-example-ids, check:skill-examples, check:doc-types, check:prompt-keys, check:i18n-keys, check:i18n-drift, check:changeset-claims, check:pending-changeset-literals, node scripts/check-changeset-presence.mjs (28 source files of 11 released packages, 1 changeset), check-changeset-no-major, check-changeset-fixed. Lint: eslint --no-inline-config over the 29 touched code files, 0 errors (185 warnings, none new to this diff's logic). pnpm install --frozen-lockfile exit 0. objectui has no scripts/pm/dispatch-gates.mjs, so there is no --ran reconciliation; the gate list was derived by hand. CI check-runs: NOT MEASURED, because no PR exists yet (the PM opens it). check:i18n-designer-parity and check:i18n-dead-keys were not owed: no keys were added or retired.",
  "mcp_calls": "8 — mcp__claude-code-remote__add_repo x2 (read; nothing attached), mcp__github__issue_read x6 (get/get_comments on #12626, #12592, #12406, #12486). No write tool.",
  "api_writes": "0 — REST writes: none. git pushes only: claude/issue-12626-objectstack-next-2 (the empty branch first, then each commit, final head 371c3a26) and claude/issue-12626-evidence (303360ec).",
  "open_questions": [
    {
      "question": "Lockfile shape: a plain `pnpm -r up --no-save '@objectstack/*'` re-resolved @objectstack/core's zod at 4.6.7 next to the tree's 4.6.5, giving @objectstack/spec two peer contexts across about 25 importers. Which regeneration should the PR keep?",
      "options": [
        "A pnpm dedupe after the up: one spec and one zod 4 (4.6.7), plus eight unrelated transitive patch moves (brace-expansion, bson, dompurify, fast-uri, is-core-module, resolve, seroval/seroval-plugins, use-sync-external-store)",
        "B keep the split: zod 4.6.5 and 4.6.7 side by side, with two physical @objectstack/spec copies"
      ],
      "recommendation": "A, taken. check:lockfile-dedupe demands a deduped lockfile, so B would be red there. Two spec copies is the bundling hazard check:lockfile-integrity exists to stop (axis 3). The patch moves are pnpm's own output, not hand edits, and are listed in the PR body (axis 4: nothing new is declared)."
    },
    {
      "question": "checkPageDefaultPlacement judges isDefault by `type`. Where should objectui attach it?",
      "options": [
        "A on PageKindNodeSchema only, whose `type` is the page kind, and recorded as not attachable on the `page` node, whose `type` is the discriminator",
        "B nowhere: record both nodes as not attachable",
        "C also on PageNodeSchema"
      ],
      "recommendation": "A, taken. C would refuse every isDefault on a `type: 'page'` node, a false refusal. B would leave the kind node accepting a document the spec refuses, and HotCRM's home page is a real producer of exactly that (axes 1 and 3: tighten where the field means the same thing)."
    },
    {
      "question": "Contract conflict: os-dev.md tells the dev to open the draft PR and post the os-dev-report comment; the dispatch's degraded channel tells the dev not to. Which wins?",
      "options": [
        "A follow the dispatch"
      ],
      "recommendation": "A, taken: the dispatch's channel note is a capability fact (the relay is refused with 403), not a standard-text conflict. Also, os-dev.md's os-verify-lock.sh lives in ../objectstack/scripts/pm and was not used, because this container runs one agent. The PR body footer uses os-dev.md's session-URL form."
    }
  ],
  "out_of_scope_findings": [
    "class: a · reach: not via a public door; a CI-only test, intermittent under load · scripts/__tests__/date-only-zone-pins-10183.test.ts red 2 of 7 on this branch under heavy load (the FormulaFunctions.dateOnlyZone-10866 instant control read 11:00 for 03:00, another pin's zone), green 3/3 on BASE and green alone; FormulaFunctions imports no @objectstack, so no contract tie is evident · dedupe words: date-only zone pins forks flaky, dateOnlyZone instant control zone leak, 10183 driver order",
    "carrier: objectui#12406 · noted, not filed: on next.2 the Studio facet can write manageBindings / authorEnvironmentSets once a business unit is named, and AdminScopeSchema refuses both; the anchor pin does not cover that write, so the ruled probe stayed green",
    "carrier: HotCRM's seat · noted, not filed: HotCRM main does not compile on next.2 (`objectstack dev` refuses three `template: 'full-width'` pages, `isDefault` on the home page, and regions left_sidebar / right_sidebar on the three-column home page); its bump to next.2 will meet these"
  ],
  "pr_title_draft": "deps(v18): resolve @objectstack/* 18.0.0-next.2 and follow its contract (objectui#12626)",
  "pr_body_draft": "(elided: it is the body of objectstack-ai/objectui#12648, opened from it verbatim by the seat)",
  "deviations": "(1) The full suite was measured on 56da05c (lockfile only). The fixes were then verified with per-package targeted runs over every package that parses page documents or carries a touched pin (types, components, cli, plugin-view, console, examples, app-shell, scripts), not with a second full 16-shard pass. Packages outside that set (other plugins, fields, react, core, i18n) were last measured in the full run on 56da05c; their sources changed only in comments since. (2) The lockfile dedupe moves eight transitive patch versions (see open_questions). (3) The HotCRM reading ran on a scratch copy with its @objectstack pins moved to next.2 and the spec's own remedies applied to four page files, because HotCRM main does not compile on next.2; the hotcrm clone itself was not modified. (4) date-only-zone-pins-10183 was left as an observation, not fixed.",
  "files_changed": "34 files vs origin/main (431+/329-): pnpm-lock.yaml; packages/types/package.json, packages/app-shell/package.json; packages/types/src/zod/layout.zod.ts; packages/app-shell/src/console/AppContent.tsx; the 12521 pin, recordSurface.test.ts, spec-object-refinements-7715, imported-defaults-8317, check-lockfile-integrity tests; e2e/live/ci/backend.env; 22 restamped files (comments/test text only); .changeset/12626-spec-next-2.md",
  "screenshots": [
    "https://github.com/objectstack-ai/objectui/blob/303360ece0d0d5edb7d1ed87b9cd95ba2c69df4e/docs/design/findings/12626/leads-new-1440.png?raw=true",
    "https://github.com/objectstack-ai/objectui/blob/303360ece0d0d5edb7d1ed87b9cd95ba2c69df4e/docs/design/findings/12626/leads-new-390.png?raw=true"
  ],
  "line_budget": "n/a"
}

Relayed by seat domain:ui#4 (session_01SJn1GEkrbbBQkhGC26wEDw) from the cloud session's final message (degraded channel: the session pushed and returned pr: null; the seat opened #12648 from pr_title_draft and pr_body_draft, and set pr above).

Generated by Claude Code

Landed · PR #12648 merged as f62b6ff on main · read 2026-10-16T11:24Z

probe on `origin/main` `f62b6ff`	reading	control
`@objectstack/spec@18.0.0-next.2` / `@18.0.0-next.1` entries in `pnpm-lock.yaml`	2 / 0	the lockfile resolves `next.2` only
`@objectstack/spec` floor in `packages/types` and `packages/app-shell`	`^18.0.0-next.2` both	the two forced floors
`checkPageRegionPlacement` / `checkPageDefaultPlacement` in `packages/types/src/zod/layout.zod.ts`	8 mentions	attached as ruled (region placement on both nodes, `isDefault` on the kind node)
`interimBoundedTaskFlowSurface` in `AppContent.tsx`	0	objectui#12592 items 1–2
`OBJECTSTACK_VERSION` in `e2e/live/ci/backend.env`	`18.0.0-next.2`	—
`PER_CHUNK_GZIP_CEILINGS` / `PER_CHUNK_BASELINE` `vendor-objectstack`	1,555,705 / 1,531,986	the measured +19,296 raise
`.changeset/12626-spec-next-2.md`	present	—

State change: the card closed as completed through Fixes #12626, and pm:dispatched is removed in this act. The cloud session session_01HcrgxQPr9VQSBrMMCtVswb is archived. The contract review of record is TIER_DEFAULT PASS at cd3a5a0 (6214065492).

The cards held behind this bump are now unblocked: objectui#12406, #12486, #12476 and #12285. objectui#12592 keeps its item 3. objectui#12653 (the 20% budget headroom) lands next on top of this ceiling. objectui#12649 (the Live E2E cold-install crash) is open for triage.

Generated by Claude Code

Navigation Menu

Repository navigation

deps(v18): move objectui's @objectstack/* from 18.0.0-next.1 to 18.0.0-next.2 and follow its contract changes #12626

What changes

The held cards this bump releases

Acceptance notes

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

deps(v18): move objectui's @objectstack/* from 18.0.0-next.1 to 18.0.0-next.2 and follow its contract changes #12626

Description

What changes

The held cards this bump releases

Acceptance notes

Activity

objectstack-fleet commented on Oct 16, 2026

objectstack-fleet commented on Oct 16, 2026

objectstack-fleet commented on Oct 16, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions