You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Live E2E: a cold live-backend install crashes in npm (Cannot read properties of null (reading 'edgesOut')) on next.1 and next.2 alike; the lane is green only from its cache #12649
Filing gate ①: a measured CI defect. Filed by the domain:ui seat 4 (session_01SJn1GEkrbbBQkhGC26wEDw), which found it while landing #12648 (objectui#12626, the @objectstack/*next.2 bump). ⛔ Not a claim; for triage to grade and route.
reach: every PR that changes e2e/live/ci/backend.env or otherwise misses the live-backend-* cache key. The Live E2E (informational) lane is informational, so it blocks no merge, but on a cache miss it tests nothing.
The cache misses (live-backend-Linux-3e640c78…, new pins), so e2e/live/ci/start-backend.sh runs a fresh npm install --no-audit --no-fund --loglevel=error in the rewritten showcase app.
It dies after 12 s with npm error Cannot read properties of null (reading 'edgesOut').
No spec ran, and no artifact was uploaded.
Reproduced locally, with npm 10.9.4 on node 22.22.0, using the same rewrite as start-backend.sh (every @objectstack/* dependency set to the pin, and devDependencies set to @objectstack/cli only):
18.0.0-next.2 with the showcase at e5136ff10f (the @objectstack/cli@18.0.0-next.2 tag): exit 1, the same error.
CONTROL, 18.0.0-next.1 with the showcase at 0c52e43 (the @objectstack/cli@18.0.0-next.1 tag, the pin main carries today): exit 1, the same error.
The stack:TypeError: Cannot read properties of null (reading 'edgesOut') at #loadPeerSet (@npmcli/arborist/lib/arborist/build-ideal-tree.js:1289), under idealTree:node_modules/@objectstack/cli. The last packument fetched before it was canvas. That is npm's peer-set resolution failing on the published @objectstack/cli dependency graph as the registry resolves it today.
A probe, not a fix: the same next.2 install with --legacy-peer-deps exits 0 (506 packages, node_modules/.bin/objectstack present). Whether the backend then boots and the allowlist passes was not measured.
Ask
Make the cold install succeed and pin it, rather than rely on the cache: --legacy-peer-deps in start-backend.sh, or the peer fix upstream in @objectstack/cli's manifest. Choose by measuring the backend boot and the allowlist run.
Until then, a green Live E2E on a PR that moves backend.env means nothing, and a red one there is this card, not the PR.
Reach reading for this anchor · domain:ui seat 3 · session_01Vk15bz8xHtKGUfXfCm16h4 · 2026-10-16T11:34Z
The same failure now hits PRs that do NOT touch e2e/live/ci/backend.env. From the last 60 objectui workflow runs (GET /actions/runs), every Live E2Epull_request run since 2026-10-16T11:24Z failed. Each failed job's failed step (read from /actions/runs/{id}/jobs) is Start ObjectStack backend (published packages):
Control: PR #12652's previous head 1b4e67f passed Live E2E (informational) at 2026-10-16T11:07:30Z. Its new head fe2aebaf is only a merge of origin/main. So the trigger is no longer a PR's own pins: either the live-backend-* cache is now missed by every PR, or it was evicted. The job log is not downloadable from this seat's container (blob host), so the npm error line itself is not re-read here; the failed step is.
This reading widens the card's reach line from "PRs that move backend.env" to "every PR since about 11:24Z". The lane is informational, and the queue's required set does not include it, but every seat's queue-entry rule reads all checks. So until this is fixed, the lane's PRs carry one red that is this card's, not theirs.
Cause of the widened reach (follows 6214595927) · domain:ui seat 3 · session_01Vk15bz8xHtKGUfXfCm16h4 · 2026-10-16T11:44Z
e2e/live/ci/backend.env changed on main at f62b6ff (2026-10-16T11:12:50Z, objectui#12626's 18.0.0-next.2 bump). That is its first change since 1f23d5b (git log origin/main -- e2e/live/ci/backend.env).
A pull_request run builds the PR merged with main. So since f62b6ff, every PR's Live E2E run misses the live-backend-* cache key, cold-installs, and crashes as this card measured.
⇒ The lane is now red for every objectui PR until this card's fix lands (--legacy-peer-deps in start-backend.sh, or the upstream peer fix), or until main's cache key is warmed by a successful cold install.
The lane is informational, so the merge queue still takes PRs. But a seat that reads "every check green" before queueing cannot clear its PRs on this rule. Grading this card is triage's; this reading is the input.
Why p1: seat 3's readings 6214595927 and 6214779884 widen the reach.
main's e2e/live/ci/backend.env moved at f62b6ff (the next.2 bump), so every PR's Live E2E run now misses the live-backend-* cache, cold-installs, and dies before any spec runs.
The lane is informational, so the queue still merges. But it is red on every objectui PR, and a red there now tells a reviewer nothing.
The precedent is objectui#12272 (Type Check red on every PR): p1.
The publish-side fixes are df2c5519ee (PR #23834: metadata-core drops its optional vitest peer) and a31ff2eb5d (PR #23850: scaffolds emit overrides.vitest).
Both landed after 18.0.0-next.2 (e5136ff10f), so no published next carries them yet.
The documented remedies are npm 11, or overrides.vitest (objectstack 7a6ba03109, PR #23864).
For the claimant:
Choose among overrides.vitest in the rewritten showcase manifest, npm 11, and --legacy-peer-deps by measuring the backend boot and the allowlist run, as the card asks.
Pin the cold install so a cache hit cannot hide it again.
When a next release carrying #23834 is installable, the claimant re-measures whether the workaround is still needed.
Waiting on this card · domain:ui seat 3 · session_01Vk15bz8xHtKGUfXfCm16h4 · 2026-10-16T12:34Z: objectui#12615 (PR #12652, ACCEPT 6215579744) is pm:blocked with Blocked-by: #12649. PR #12646 (objectui#12613) will join it once its merge round is accepted. Each is green apart from this lane's backend-start red.
Claim: PM loop round 2 · domain:devx @ objectui seat 1 · 2026-10-16T12:46Z · triage first grade 6214986613 (p1, domain:devx, pm:queue)
Session: session_016PVjjuVPte5XEJvaQx1E4t
Account: os-sales (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-12649-live-backend-cold-install
Worktree: objectui-issue-12649
Domain: domain:devx
Seat: domain:devx#1
File surface: e2e/live/ci/start-backend.sh (the rewritten showcase manifest and its npm install step); e2e/live/ci/backend.env, only if the measured fix needs a pinned value there; content/docs/guide/ci-cd-pipeline.md, only where it describes this step; one empty-frontmatter .changeset/*.md if the changeset gate asks. Stop on breach and explain it in the report. ⛔ No .github/workflows/** (governed; live-e2e.yml needs no change if the fix stays in the script). ⛔ No --legacy-peer-deps unless measured as the only working route; the objectstack family's documented remedies are overrides.vitest and npm 11 (objectstack 7a6ba03109).
Container & model: M, mode:subagent, model: TIER_DEFAULT (dispatch-gates --tier --repo objectstack-ai/objectui: "no path-derived mandate")
Clause-②: no
Responsibility: npm 10's arborist crash on vitest@4.1.12's incoherent optional-peer set, reached through the published @objectstack/cli graph (objectstack #23801 family) | none: start-backend.sh writes no overrides block (its :111 comment) and the cache hid the cold path until f62b6ff moved backend.env | every objectui PR's Live E2E run since 11:24Z (seat 3's readings 6214595927 / 6214779884), with two PRs pm:blocked on it (6215604860)
Thread-read: 6215604860
Serial constraints cleared:
None of the 11 open objectui PRs touches e2e/live/ci/** or .github/workflows/live-e2e.yml. Their file lists were read at this act, and no other pm:dispatched card names this step.
Ruling recorded: the maintainer chose A, fix it in objectui now · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-16T13:02Z
⛔ Not a claim. The labels are unchanged (priority:p1, domain:devx, pm:queue).
The question, put by this seat in its R441 report to the maintainer:
A: fix the cold install in objectui now;
B: wait for an @objectstack/*next release that carries objectstack PRs #23834 / #23850.
The answer, verbatim, in this seat's session: 「A(我倾向):现在就在 objectui 里修」.
What it binds: this card is dispatched now. It does not wait for next.3. The scope is as graded in 6214986613: choose the remedy by measuring the backend boot and the allowlist run, and pin the cold install so a cache hit cannot hide it again.
{
"issue": 12649,
"status": "done",
"branch": "claude/issue-12649-live-backend-cold-install",
"pr": "https://github.com/objectstack-ai/objectui/pull/12674",
"session": "session_016PVjjuVPte5XEJvaQx1E4t (mode:subagent, the PM seat id; identity = the branch named by claim 6215807690)",
"premise_still_valid": true,
"summary": "Remedy (a), the simplest one measured correct: e2e/live/ci/start-backend.sh writes a root overrides entry vitest ~4.0.0 (VITEST_OVERRIDE) into the rewritten showcase manifest, and the stamp gains it as a third component, so a fixture prepared under another recipe (what a restored Actions cache carries) is rebuilt, never reused. The comment at VITEST_OVERRIDE states the cause, objectstack's documented remedy, the removal condition (the published @objectstack/cli at OBJECTSTACK_VERSION installs on npm 10 with no override) and the re-measure recipe, including a measured trap: rerunning npm install in a prepared dir with the override deleted answers 'up to date', exit 0, from the lockfile. content/docs/guide/ci-cd-pipeline.md's 'No transitive dependency is overridden' paragraph now names the one override and states the cache's remaining blind spot. backend.env is untouched (no pinned value there was needed), so the cache key stays live-backend-Linux-3e640c78...; PM mechanism assumptions 1-4 all held as written (runner npm read from job 116927385035: Node 22.23.3, npm 10.9.9). #23834 is still not in a published next (next.2 is the newest next), so the triage's re-measure trigger has not fired.",
"tests": "Every run: the real script end to end, a fresh LIVE_BACKEND_DIR and a fresh npm cache, npm fetched into a temp prefix. | BASELINE (origin/main script at f78efdd1e, npm 10.9.9, the runner's npm): EXIT=1, 'npm error Cannot read properties of null (reading 'edgesOut')', with the stack at #loadPeerSet under idealTree:node_modules/@objectstack/cli. That is the CI failure reproduced. | (a) CHOSEN, the changed script under npm 10.9.9: EXIT=0 in 110s, 'added 528 packages', '[live-backend] ready: seeded sign-in answered on :4710'. GET /api/v1/health answered 200 {status: ok, version: 18.0.0-next.2}, and GET /api/v1/ready answered 200 {status: ready}. | (a) allowlist: the console was built with 'VITE_BASE_PATH=/ vite build' (lock VERDICT command-exit 0) and served by vite preview on :5790 with DEV_PROXY_TARGET at the backend. The four test:e2e:live:ci specs ran: '5 passed (29.6s)', lock VERDICT command-exit 0. | (b) npm 11.21.0, origin/main script, no override: EXIT=0, 528 packages, health 200, ready 200, allowlist '5 passed (28.2s)'. | (c) npm 10.9.9 with npm_config_legacy_peer_deps=true: EXIT=0, 506 packages, health 200, ready 200, allowlist '5 passed (25.5s)'. | Trees, by lockfile packages maps: (a) equals (b) path for path and version for version (554 entries each; only the optional/peer flag annotations differ). (c) lacks plugin-auth's better-sqlite3@12.11.1 peer and 21 build deps, and hoists better-auth to the root. | The installed graph has no vitest. Two optional vitest peers reach it: better-auth@1.7.3 (under plugin-auth) and @objectstack/metadata-core@18.0.0-next.2. | Stamp, both directions: the changed script on its own prepared fixture printed 'prepare: pins unchanged (... vitest@~4.0.0), reusing' (13s, no install). The changed script on a fixture the origin/main script prepared printed 'prepare: showcase@e5136ff10f1a' and installed cold again, EXIT=0, 528 packages. | Cache key: recomputed hashFiles(backend.env) = 3e640c78135ae9fa649cc6e11719dbab6f90ac3d819cc915b2259f3ce14490d0, equal to the key the failing CI job printed (the positive control). Unchanged by this diff. | Vitest over the 17 test files that name ci-cd-pipeline.md or start-backend.sh (git grep -l): Test Files 17 passed (17), Tests 737 passed (737), lock VERDICT command-exit 0, at eed841f45. | No ablation: the diff changes a CI script and a doc, not a tested behaviour. The before/after pair is the BASELINE (EXIT=1) against (a) (EXIT=0) under the same npm and the same fresh-cache conditions. | NOT MEASURED: the GitHub runner itself (only its Node and npm versions were reproduced), the nightly schedule path, and video recording in the allowlist run (off; see deviations).",
"gates": "All local, at eed841f45, with each exit captured before any pipe. | node scripts/check-governed-queue-guard.mjs --test e2e/live/ci/start-backend.sh content/docs/guide/ci-cd-pipeline.md: EXIT=0, 'NOT GOVERNED'. | node scripts/check-changeset-presence.mjs: EXIT=0, 'no changeset is owed', so no .changeset file was added. | These exit 0: check-bash32-floor, check-doc-links ('Links are valid across 17 scan roots'), check-control-bytes, check-new-cross-file-line-citations ('0 new citation(s)'), check-doc-fence-languages and check-shell-escape-residue. | check-doc-json-fences: EXIT=2 at first, a prerequisite and not a verdict (@object-ui/types dist not built). After pnpm --filter @object-ui/types build (VERDICT command-exit 0) it gave EXIT=0. | bash -n on the script is clean. A grep -P control-byte self-scan of both files: no match. | objectui has no dispatch-gates.mjs. The local set was derived from package.json check:* scripts, plus the tests and workflows that read the two changed files. There is no --ran reconciliation in this repo. | PR check-runs at head eed841f45, read once at report time and not re-run locally: | completed success: Build Docs, Changeset Claim Re-read, Changeset Declaration, Changeset Fixed Group Check, Governed Surface Queue Guard, Line Citation Gate, label. | skipped: Test (coverage), Test (coverage shard), dependabot. | in_progress at the read (13:14Z): Build & E2E, Lint, Repo Gates, Type Check, Test (dist pins), Test (shard 1-16/16). Their verdicts are the seat's to read. | LIVE E2E: 'Live E2E (informational)' on this PR (job 116990202266, head eed841f45) completed with conclusion success, and it was a COLD install. Read from step outcomes and the job log: 'Restore live backend fixture' took 1s. 'Start ObjectStack backend (published packages)' succeeded in 71s (13:13:55Z to 13:15:06Z), against 23s to the edgesOut crash in the card's job and 13s for a warm reuse locally. 'Save live backend fixture' RAN, and it is gated on cache-hit != 'true', so the restore missed; it logged 'Cache saved with key: live-backend-Linux-3e640c78135ae9fa649cc6e11719dbab6f90ac3d819cc915b2259f3ce14490d0'. 'Run live E2E allowlist' gave '5 passed (18.6s)'. The job's orphan cleanup also listed 'Terminate orphan process: pid (2542) (bash)' and then '(2543) (node)', the subshell-wrapper shape behind the stop-backend finding. NOT read: the start step's own 'Cache not found' and 'added N packages' lines, which fall outside the log tail fetched.",
"mcp_calls": "2 — both mcp__github__get_job_logs (read-only). The REST log download redirects to the blob host, which the proxy blocks. (1) job 116927385035, the card's failing run: runner node v22.23.3 and npm 10.9.9, the cache miss on live-backend-Linux-3e640c78..., and the edgesOut error 23s into the step. (2) job 116990202266, this PR's Live E2E: 'Cache saved with key: live-backend-Linux-3e640c78...' and '5 passed (18.6s)'. No MCP write tool was called.",
"api_writes": "2 relay strokes, both via objectstack scripts/pm tools, each a POST /repos/objectstack-ai/objectstack/dispatches. (1) fleet-write/dispatch.mjs pr_create: POST /repos/objectstack-ai/objectui/pulls (draft) plus POST /repos/objectstack-ai/objectui/issues/12674/assignees [os-sales]. The read-back said '8504 byte(s) sent, 8504 stored — identical' with assignee os-sales. (2) post-stamped.mjs --comment=12649 --repo=objectstack-ai/objectui: POST /repos/objectstack-ai/objectui/issues/12649/comments, which is this report. git push ran twice (the empty branch probe, then eed841f45); it is not a REST write. Zero label writes and zero PR body PATCHes.",
"open_questions": [],
"out_of_scope_findings": [
"class: a · reach: the script's own documented local entry, measured with the origin/main scripts. stop-backend.sh (whose header says it 'kills only the PID this script recorded') printed '[live-backend] stopped pid 30766' and exited 0, while GET :4710/api/v1/health still answered 200. The server, pid 30767, was reparented to pid 1. CI never calls it (ephemeral runner), so the lane is unaffected. · evidence: start() records $! of the backgrounded 'cd \"$APP_DIR\" && OS_CLOUD_URL=off nohup ./node_modules/.bin/objectstack dev ...' list, which is the forked subshell (pid file 30766, server 30767 its child). The same pid-file/server pair shape was read on three boots: 29265/29266, 30766/30767 and 31363/31364. · dedupe words: stop-backend.sh, backend.pid, subshell, nohup, live-backend leak",
"carrier: 承接者:无 · noted, not filed. The fixture cache key hashes backend.env alone, so registry drift under unchanged pins (this card's own break: the next.1 control fails the same way) stays hidden until OBJECTSTACK_VERSION moves. The stamp covers recipe changes only. Closing the gap would mean the nightly skips the fixture restore, a governed .github/workflows/live-e2e.yml edit outside this claim, about 1-2 min per nightly; a time component in the stamp is ruled out, because the save is skipped on a key hit, so every run would go cold. It is in the PR Acceptance notes and the docs page. It is a choice for the seat, not a blocker: open_questions is empty."
],
"files_changed": [
"e2e/live/ci/start-backend.sh",
"content/docs/guide/ci-cd-pipeline.md"
],
"changed_lines": "e2e/live/ci/start-backend.sh +43 -12; content/docs/guide/ci-cd-pipeline.md +18 -3; total +61 -15 (git show --numstat eed841f45).",
"deviations": [
"The local allowlist used a scratch Playwright config. It was untracked, spread playwright.live.config.ts unchanged, and was deleted afterwards. It set launchOptions.executablePath to /opt/pw-browsers/chromium (the preinstalled Chromium) and video to 'off' (no ffmpeg for this Playwright revision). It is container-only and not in the diff.",
"A built-in safety check refused one cleanup command, verbatim: 'Dangerous rm operation detected in `rm -rf $S/$r/backend ...`. The target '$S/$r/backend' is a shell variable expansion'. It was re-issued in the guarded form the refusal itself names, with ${S:?}/${r:?}. The scratch install trees (about 4.2G) were then deleted.",
"The proxy refused one read: GET /repos/objectstack-ai/objectui/actions/caches answered 'Access to this GitHub Actions path is not permitted through this proxy. (HTTP 403)'. That no main-scope cache exists under the key was therefore inferred from the workflow's run list (only pull_request runs since 11:00Z). Either way the stamp makes a hit irrelevant.",
"The commit carries the model-free trailer pair (Claude-Session plus 'Co-authored-by: Claude'), per objectui AGENTS.md and os-dev.md, instead of the harness reminder's model-named Co-Authored-By. The harness rule yields to the repo rule.",
"backend.env was not edited. Its cache-key role was measured: the key stays unchanged, the PR run cannot read a cache under it, and the stamp is the guard.",
"Cleanup: every backend and preview process this run started was stopped by its own PID; ports 4710 and 5790 are free. The scratch install trees and npm caches were deleted, the worktree node_modules was removed, and git worktree remove ran without --force (exit 0)."
]
}
start-backend.sh writes one root overrides.vitest: "~4.0.0" into the rewritten showcase manifest, which is objectstack's documented remedy.
The fixture stamp carries that value, so a fixture prepared under another recipe is rebuilt cold and never reused.
The note at VITEST_OVERRIDE states when to remove it: once the published @objectstack/cli at OBJECTSTACK_VERSION installs on npm 10 with no override. Re-measure that at every pin bump, from a fresh dir and a fresh cache.
Activity
objectstack-fleet commentedon Oct 16, 2026
Reach reading for this anchor ·
domain:uiseat 3 ·session_01Vk15bz8xHtKGUfXfCm16h4· 2026-10-16T11:34ZThe same failure now hits PRs that do NOT touch
e2e/live/ci/backend.env. From the last 60 objectui workflow runs (GET /actions/runs), everyLive E2Epull_requestrun since 2026-10-16T11:24Z failed. Each failed job's failed step (read from/actions/runs/{id}/jobs) isStart ObjectStack backend (published packages):claude/issue-12602-home-my-workdependabot/npm_and_yarn/next-16.3.8claude/issue-12608-approvals-namesdependabot/npm_and_yarn/next-16.3.8claude/issue-12615-edit-app-pencil-posture(PR #12652)Control: PR #12652's previous head
1b4e67fpassedLive E2E (informational)at 2026-10-16T11:07:30Z. Its new headfe2aebafis only a merge oforigin/main. So the trigger is no longer a PR's own pins: either thelive-backend-*cache is now missed by every PR, or it was evicted. The job log is not downloadable from this seat's container (blob host), so the npm error line itself is not re-read here; the failed step is.This reading widens the card's reach line from "PRs that move
backend.env" to "every PR since about 11:24Z". The lane is informational, and the queue's required set does not include it, but every seat's queue-entry rule reads all checks. So until this is fixed, the lane's PRs carry one red that is this card's, not theirs.Generated by Claude Code
objectstack-fleet commentedon Oct 16, 2026
Cause of the widened reach (follows
6214595927) ·domain:uiseat 3 ·session_01Vk15bz8xHtKGUfXfCm16h4· 2026-10-16T11:44Ze2e/live/ci/backend.envchanged onmainatf62b6ff(2026-10-16T11:12:50Z, objectui#12626's18.0.0-next.2bump). That is its first change since1f23d5b(git log origin/main -- e2e/live/ci/backend.env).pull_requestrun builds the PR merged withmain. So sincef62b6ff, every PR'sLive E2Erun misses thelive-backend-*cache key, cold-installs, and crashes as this card measured.f62b6ff).--legacy-peer-depsinstart-backend.sh, or the upstream peer fix), or untilmain's cache key is warmed by a successful cold install.Generated by Claude Code
objectstack-fleet commentedon Oct 16, 2026
Triage: first grade,
bug·priority:p1·domain:devx·area:devpath·pm:queue· triage seat ·session_01AavokzJ5DndAwitDXvKy4U· 2026-10-16T11:57ZTriage seat (objectstack-wide, seat post objectstack-ai/objectstack#6015). ⛔ Not a claim, ⛔ not a dispatch.
6214595927and6214779884widen the reach.main'se2e/live/ci/backend.envmoved atf62b6ff(the next.2 bump), so every PR'sLive E2Erun now misses thelive-backend-*cache, cold-installs, and dies before any spec runs.Type Checkred on every PR): p1.domain:devx:e2e/live/ci/start-backend.shis CI tooling. That is this repo'sdomain:devxlane, seat 1 ([PM seat] domain:devx @ objectui — 🟢 os-sales · session_016PVjjuVPte5XEJvaQx1E4t · serial (maintainer) #5748).origin/mainnow: this is the npm 10edgesOutfamily, release: the Docker image job fails at "Build and push" since Release #11838 (npm 18.0.0-next.2 published fine):npm install -g @objectstack/clicrashes in npm's peer resolution ("Cannot read properties of null (reading 'edgesOut')") objectstack#23801 / #23805 / #23806 / #23849, all closed.df2c5519ee(PR #23834:metadata-coredrops its optionalvitestpeer) anda31ff2eb5d(PR #23850: scaffolds emitoverrides.vitest).18.0.0-next.2(e5136ff10f), so no publishednextcarries them yet.overrides.vitest(objectstack7a6ba03109, PR #23864).overrides.vitestin the rewritten showcase manifest, npm 11, and--legacy-peer-depsby measuring the backend boot and the allowlist run, as the card asks.nextrelease carrying #23834 is installable, the claimant re-measures whether the workaround is still needed.objectstack-fleet commentedon Oct 16, 2026
Waiting on this card ·
domain:uiseat 3 ·session_01Vk15bz8xHtKGUfXfCm16h4· 2026-10-16T12:34Z: objectui#12615 (PR #12652, ACCEPT6215579744) ispm:blockedwithBlocked-by: #12649. PR #12646 (objectui#12613) will join it once its merge round is accepted. Each is green apart from this lane's backend-start red.Generated by Claude Code
objectstack-fleet commentedon Oct 16, 2026
Claim: PM loop round 2 ·
domain:devx@ objectui seat 1 · 2026-10-16T12:46Z · triage first grade6214986613(p1,domain:devx,pm:queue)Session:
session_016PVjjuVPte5XEJvaQx1E4tAccount:
os-sales(the seat's linked user asGET /useranswers it; the card's assignee)Branch:
claude/issue-12649-live-backend-cold-installWorktree:
objectui-issue-12649Domain:
domain:devxSeat:
domain:devx#1File surface:
e2e/live/ci/start-backend.sh(the rewritten showcase manifest and itsnpm installstep);e2e/live/ci/backend.env, only if the measured fix needs a pinned value there;content/docs/guide/ci-cd-pipeline.md, only where it describes this step; one empty-frontmatter.changeset/*.mdif the changeset gate asks. Stop on breach and explain it in the report. ⛔ No.github/workflows/**(governed;live-e2e.ymlneeds no change if the fix stays in the script). ⛔ No--legacy-peer-depsunless measured as the only working route; the objectstack family's documented remedies areoverrides.vitestand npm 11 (objectstack7a6ba03109).Container & model:
M,mode:subagent,model: TIER_DEFAULT(dispatch-gates --tier --repo objectstack-ai/objectui: "no path-derived mandate")Clause-②: no
Responsibility:
npm 10's arborist crash on vitest@4.1.12's incoherent optional-peer set, reached through the published @objectstack/cli graph (objectstack #23801 family) | none: start-backend.sh writes no overrides block (its :111 comment) and the cache hid the cold path until f62b6ff moved backend.env | every objectui PR's Live E2E run since 11:24Z (seat 3's readings 6214595927 / 6214779884), with two PRs pm:blocked on it (6215604860)Thread-read: 6215604860
Serial constraints cleared:
0744f94366(record6215765973), and nothing else is in flight in either seat this session holds. 「串行派发」 runs across both seats this session holds.e2e/live/ci/**or.github/workflows/live-e2e.yml. Their file lists were read at this act, and no otherpm:dispatchedcard names this step.Generated by Claude Code
objectstack-fleet commentedon Oct 16, 2026
Ruling recorded: the maintainer chose A, fix it in objectui now · triage seat ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-10-16T13:02Z⛔ Not a claim. The labels are unchanged (
priority:p1,domain:devx,pm:queue).@objectstack/*nextrelease that carries objectstack PRs #23834 / #23850.6214986613: choose the remedy by measuring the backend boot and the allowlist run, and pin the cold install so a cache hit cannot hide it again.objectstack-fleet commentedon Oct 16, 2026
os-dev-report
{ "issue": 12649, "status": "done", "branch": "claude/issue-12649-live-backend-cold-install", "pr": "https://github.com/objectstack-ai/objectui/pull/12674", "session": "session_016PVjjuVPte5XEJvaQx1E4t (mode:subagent, the PM seat id; identity = the branch named by claim 6215807690)", "premise_still_valid": true, "summary": "Remedy (a), the simplest one measured correct: e2e/live/ci/start-backend.sh writes a root overrides entry vitest ~4.0.0 (VITEST_OVERRIDE) into the rewritten showcase manifest, and the stamp gains it as a third component, so a fixture prepared under another recipe (what a restored Actions cache carries) is rebuilt, never reused. The comment at VITEST_OVERRIDE states the cause, objectstack's documented remedy, the removal condition (the published @objectstack/cli at OBJECTSTACK_VERSION installs on npm 10 with no override) and the re-measure recipe, including a measured trap: rerunning npm install in a prepared dir with the override deleted answers 'up to date', exit 0, from the lockfile. content/docs/guide/ci-cd-pipeline.md's 'No transitive dependency is overridden' paragraph now names the one override and states the cache's remaining blind spot. backend.env is untouched (no pinned value there was needed), so the cache key stays live-backend-Linux-3e640c78...; PM mechanism assumptions 1-4 all held as written (runner npm read from job 116927385035: Node 22.23.3, npm 10.9.9). #23834 is still not in a published next (next.2 is the newest next), so the triage's re-measure trigger has not fired.", "tests": "Every run: the real script end to end, a fresh LIVE_BACKEND_DIR and a fresh npm cache, npm fetched into a temp prefix. | BASELINE (origin/main script at f78efdd1e, npm 10.9.9, the runner's npm): EXIT=1, 'npm error Cannot read properties of null (reading 'edgesOut')', with the stack at #loadPeerSet under idealTree:node_modules/@objectstack/cli. That is the CI failure reproduced. | (a) CHOSEN, the changed script under npm 10.9.9: EXIT=0 in 110s, 'added 528 packages', '[live-backend] ready: seeded sign-in answered on :4710'. GET /api/v1/health answered 200 {status: ok, version: 18.0.0-next.2}, and GET /api/v1/ready answered 200 {status: ready}. | (a) allowlist: the console was built with 'VITE_BASE_PATH=/ vite build' (lock VERDICT command-exit 0) and served by vite preview on :5790 with DEV_PROXY_TARGET at the backend. The four test:e2e:live:ci specs ran: '5 passed (29.6s)', lock VERDICT command-exit 0. | (b) npm 11.21.0, origin/main script, no override: EXIT=0, 528 packages, health 200, ready 200, allowlist '5 passed (28.2s)'. | (c) npm 10.9.9 with npm_config_legacy_peer_deps=true: EXIT=0, 506 packages, health 200, ready 200, allowlist '5 passed (25.5s)'. | Trees, by lockfile packages maps: (a) equals (b) path for path and version for version (554 entries each; only the optional/peer flag annotations differ). (c) lacks plugin-auth's better-sqlite3@12.11.1 peer and 21 build deps, and hoists better-auth to the root. | The installed graph has no vitest. Two optional vitest peers reach it: better-auth@1.7.3 (under plugin-auth) and @objectstack/metadata-core@18.0.0-next.2. | Stamp, both directions: the changed script on its own prepared fixture printed 'prepare: pins unchanged (... vitest@~4.0.0), reusing' (13s, no install). The changed script on a fixture the origin/main script prepared printed 'prepare: showcase@e5136ff10f1a' and installed cold again, EXIT=0, 528 packages. | Cache key: recomputed hashFiles(backend.env) = 3e640c78135ae9fa649cc6e11719dbab6f90ac3d819cc915b2259f3ce14490d0, equal to the key the failing CI job printed (the positive control). Unchanged by this diff. | Vitest over the 17 test files that name ci-cd-pipeline.md or start-backend.sh (git grep -l): Test Files 17 passed (17), Tests 737 passed (737), lock VERDICT command-exit 0, at eed841f45. | No ablation: the diff changes a CI script and a doc, not a tested behaviour. The before/after pair is the BASELINE (EXIT=1) against (a) (EXIT=0) under the same npm and the same fresh-cache conditions. | NOT MEASURED: the GitHub runner itself (only its Node and npm versions were reproduced), the nightly schedule path, and video recording in the allowlist run (off; see deviations).", "gates": "All local, at eed841f45, with each exit captured before any pipe. | node scripts/check-governed-queue-guard.mjs --test e2e/live/ci/start-backend.sh content/docs/guide/ci-cd-pipeline.md: EXIT=0, 'NOT GOVERNED'. | node scripts/check-changeset-presence.mjs: EXIT=0, 'no changeset is owed', so no .changeset file was added. | These exit 0: check-bash32-floor, check-doc-links ('Links are valid across 17 scan roots'), check-control-bytes, check-new-cross-file-line-citations ('0 new citation(s)'), check-doc-fence-languages and check-shell-escape-residue. | check-doc-json-fences: EXIT=2 at first, a prerequisite and not a verdict (@object-ui/types dist not built). After pnpm --filter @object-ui/types build (VERDICT command-exit 0) it gave EXIT=0. | bash -n on the script is clean. A grep -P control-byte self-scan of both files: no match. | objectui has no dispatch-gates.mjs. The local set was derived from package.json check:* scripts, plus the tests and workflows that read the two changed files. There is no --ran reconciliation in this repo. | PR check-runs at head eed841f45, read once at report time and not re-run locally: | completed success: Build Docs, Changeset Claim Re-read, Changeset Declaration, Changeset Fixed Group Check, Governed Surface Queue Guard, Line Citation Gate, label. | skipped: Test (coverage), Test (coverage shard), dependabot. | in_progress at the read (13:14Z): Build & E2E, Lint, Repo Gates, Type Check, Test (dist pins), Test (shard 1-16/16). Their verdicts are the seat's to read. | LIVE E2E: 'Live E2E (informational)' on this PR (job 116990202266, head eed841f45) completed with conclusion success, and it was a COLD install. Read from step outcomes and the job log: 'Restore live backend fixture' took 1s. 'Start ObjectStack backend (published packages)' succeeded in 71s (13:13:55Z to 13:15:06Z), against 23s to the edgesOut crash in the card's job and 13s for a warm reuse locally. 'Save live backend fixture' RAN, and it is gated on cache-hit != 'true', so the restore missed; it logged 'Cache saved with key: live-backend-Linux-3e640c78135ae9fa649cc6e11719dbab6f90ac3d819cc915b2259f3ce14490d0'. 'Run live E2E allowlist' gave '5 passed (18.6s)'. The job's orphan cleanup also listed 'Terminate orphan process: pid (2542) (bash)' and then '(2543) (node)', the subshell-wrapper shape behind the stop-backend finding. NOT read: the start step's own 'Cache not found' and 'added N packages' lines, which fall outside the log tail fetched.", "mcp_calls": "2 — both mcp__github__get_job_logs (read-only). The REST log download redirects to the blob host, which the proxy blocks. (1) job 116927385035, the card's failing run: runner node v22.23.3 and npm 10.9.9, the cache miss on live-backend-Linux-3e640c78..., and the edgesOut error 23s into the step. (2) job 116990202266, this PR's Live E2E: 'Cache saved with key: live-backend-Linux-3e640c78...' and '5 passed (18.6s)'. No MCP write tool was called.", "api_writes": "2 relay strokes, both via objectstack scripts/pm tools, each a POST /repos/objectstack-ai/objectstack/dispatches. (1) fleet-write/dispatch.mjs pr_create: POST /repos/objectstack-ai/objectui/pulls (draft) plus POST /repos/objectstack-ai/objectui/issues/12674/assignees [os-sales]. The read-back said '8504 byte(s) sent, 8504 stored — identical' with assignee os-sales. (2) post-stamped.mjs --comment=12649 --repo=objectstack-ai/objectui: POST /repos/objectstack-ai/objectui/issues/12649/comments, which is this report. git push ran twice (the empty branch probe, then eed841f45); it is not a REST write. Zero label writes and zero PR body PATCHes.", "open_questions": [], "out_of_scope_findings": [ "class: a · reach: the script's own documented local entry, measured with the origin/main scripts. stop-backend.sh (whose header says it 'kills only the PID this script recorded') printed '[live-backend] stopped pid 30766' and exited 0, while GET :4710/api/v1/health still answered 200. The server, pid 30767, was reparented to pid 1. CI never calls it (ephemeral runner), so the lane is unaffected. · evidence: start() records $! of the backgrounded 'cd \"$APP_DIR\" && OS_CLOUD_URL=off nohup ./node_modules/.bin/objectstack dev ...' list, which is the forked subshell (pid file 30766, server 30767 its child). The same pid-file/server pair shape was read on three boots: 29265/29266, 30766/30767 and 31363/31364. · dedupe words: stop-backend.sh, backend.pid, subshell, nohup, live-backend leak", "carrier: 承接者:无 · noted, not filed. The fixture cache key hashes backend.env alone, so registry drift under unchanged pins (this card's own break: the next.1 control fails the same way) stays hidden until OBJECTSTACK_VERSION moves. The stamp covers recipe changes only. Closing the gap would mean the nightly skips the fixture restore, a governed .github/workflows/live-e2e.yml edit outside this claim, about 1-2 min per nightly; a time component in the stamp is ruled out, because the save is skipped on a key hit, so every run would go cold. It is in the PR Acceptance notes and the docs page. It is a choice for the seat, not a blocker: open_questions is empty." ], "files_changed": [ "e2e/live/ci/start-backend.sh", "content/docs/guide/ci-cd-pipeline.md" ], "changed_lines": "e2e/live/ci/start-backend.sh +43 -12; content/docs/guide/ci-cd-pipeline.md +18 -3; total +61 -15 (git show --numstat eed841f45).", "deviations": [ "The local allowlist used a scratch Playwright config. It was untracked, spread playwright.live.config.ts unchanged, and was deleted afterwards. It set launchOptions.executablePath to /opt/pw-browsers/chromium (the preinstalled Chromium) and video to 'off' (no ffmpeg for this Playwright revision). It is container-only and not in the diff.", "A built-in safety check refused one cleanup command, verbatim: 'Dangerous rm operation detected in `rm -rf $S/$r/backend ...`. The target '$S/$r/backend' is a shell variable expansion'. It was re-issued in the guarded form the refusal itself names, with ${S:?}/${r:?}. The scratch install trees (about 4.2G) were then deleted.", "The proxy refused one read: GET /repos/objectstack-ai/objectui/actions/caches answered 'Access to this GitHub Actions path is not permitted through this proxy. (HTTP 403)'. That no main-scope cache exists under the key was therefore inferred from the workflow's run list (only pull_request runs since 11:00Z). Either way the stamp makes a hit irrelevant.", "The commit carries the model-free trailer pair (Claude-Session plus 'Co-authored-by: Claude'), per objectui AGENTS.md and os-dev.md, instead of the harness reminder's model-named Co-Authored-By. The harness rule yields to the repo rule.", "backend.env was not edited. Its cache-key role was measured: the key stays unchanged, the PR run cannot read a cache under it, and the stamp is the guard.", "Cleanup: every backend and preview process this run started was stopped by its own PID; ports 4710 and 5790 are free. The scratch install trees and npm caches were deleted, the worktree node_modules was removed, and git worktree remove ran without --force (exit 0)." ] }Generated by Claude Code
objectstack-fleet commentedon Oct 16, 2026
Landed: Live E2E's cold backend install succeeds on npm 10 again ·
domain:devx@ objectui seat 1 ·session_016PVjjuVPte5XEJvaQx1E4t· 2026-10-16T13:36Zd66ceea5a9on objectuiorigin/main, merged 2026-10-16T13:36:12Z from the merge queuee2e/live/ci/start-backend.sh547ec18abfandcontent/docs/guide/ci-cd-pipeline.md5c1ff015f6onorigin/mainequal the PR headeed841f45Live E2E (informational)run (job 116990202266) missed the restore, installed cold in 71 s, saved the fixture, and reported "5 passed"Fixesclosed this card ascompleted.pm:dispatchedis removed in this act.start-backend.shwrites one rootoverrides.vitest: "~4.0.0"into the rewritten showcase manifest, which is objectstack's documented remedy.VITEST_OVERRIDEstates when to remove it: once the published@objectstack/cliatOBJECTSTACK_VERSIONinstalls on npm 10 with no override. Re-measure that at every pin bump, from a fresh dir and a fresh cache.6215604860: fix(app-shell): the app bar's Edit app pencil hides for system apps and read-only packages (objectui#12615) #12652, and feat(fields,plugin-grid): a declared object-ref / recipient-picker widget names what the value references in every list (objectui#12613) #12646 next): from now, theirLive E2Eruns install cold against this script once they mergemain.stop-backend.shkilling the subshell instead of the server (local only), filed for triage.Generated by Claude Code