deps(v18): move objectui's @objectstack/* from 18.0.0-next.2 to 18.0.0-next.3 and follow its contract changes

Filing gate ③ a task the maintainer directed, by standing practice: the maintainer's rule 「发版本优先的都p1」 gives every next.N publish one consumer bump card, so the held follow-ups have one carrier instead of several PRs racing on the lockfile (precedents objectui#12370 for next.1 and objectui#12626 for next.2). Filed by the triage seat (objectstack-ai/objectstack#6015, session_01AavokzJ5DndAwitDXvKy4U). ⛔ Not a claim.

Reader (who acts): the objectui domain:ui execution seat. One PR. The publish itself is not objectui's.

What is published (read from the npm registry when this card was filed)

@objectstack/* dist-tag next = 18.0.0-next.3, published 2026-10-17 at about 09:18–09:21 UTC by release.yml run 39015917065.
It is built from objectstack release commit 2c9bf9430a, the merge of chore: version packages (next) objectstack#23825. @objectstack/cli, spec, console, service-print and create-objectstack all read 18.0.0-next.3.
The upstream range: objectstack e5136ff10f..2c9bf9430a (the two chore: version packages (next) commits), 158 commits. Read each package's CHANGELOG.md 18.0.0-next.3 section for the breaking and behaviour changes that touch objectui.

What changes

objectui main resolves @objectstack/spec@18.0.0-next.2 in pnpm-lock.yaml, with ranges at ^18.0.0-next.1. The range already admits next.3, but the lockfile does not, and CI installs from the lockfile.
The bump moves every @objectstack/* entry in the lockfile to 18.0.0-next.3, regenerated with pnpm. It raises a range's floor only where a held card needs it, and follows the contract changes the range makes.

Held follow-ups this card carries

objectui#12490 no longer waits on this card. The maintainer dropped approvals face 4 (record:json) after this card was filed (pointer 6232139151 on approvals face 4 of 5 (ruling C on objectui#12438): the served sys_approval_request page carries the raw-payload panel as a generic block gated on studio.access declared in the page metadata, as the inbox side sheet gates it #12490), and spec(ui): retire record:json (#23745, 97b8e7a51d): its only consumer, the approval request page panel, was dropped by the maintainer; main already versions it into 18.0.0-next.3, which is not yet published objectstack#24162 retires the type. Its close or re-point is its domain:ui owner's call. (Amended by the triage seat after filing.)
objectui#12333 (the public-form regression). Its Restart-when: names @objectstack/spec@next built from 1eac7ad751 or a descendant, which next.3 now meets. It moves to pm:queue in the same act and lands after this card if its fix reads the new spec.

Done when

pnpm-lock.yaml resolves every @objectstack/* package at 18.0.0-next.3, and the workspace builds and tests green on it.
Each contract change in the range that touches objectui is followed in this PR or named in its body as a follow-up card.

Dedupe: the 40 newest objectui issues, grepped for next.3, 18.0.0-next and @objectstack bump: 0 hits (2026-10-17, after the publish).

Generated by Claude Code

Claim: PM loop round 3 (priority:p1 + target:v18, the consumer bump for 18.0.0-next.3 under the maintainer's rule 「发版本优先的都p1」; filed by the triage seat; this seat carried next.2 as objectui#12626 / PR #12648)
Session: session_01SJn1GEkrbbBQkhGC26wEDw
Account: os-sales (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-12873-objectstack-next-3
Worktree: objectui-issue-12873 (in the cloud session's own container)
Domain: domain:ui
Seat: domain:ui#4
File surface:

every workspace package.json that names @objectstack/* (a range's floor raised only where a held card needs next.3);
pnpm-lock.yaml (regenerated by pnpm, never by hand);
the files a next.3 red points to (contract-following, the smallest change), each named in the PR's red table;
one .changeset/12873-*.md.

The held cards objectui#12490 and objectui#12333 keep their own items and land after this PR.

Stop on breach; explain in the report.
Container & model: L, mode:cloud, model: opus (cloud on the maintainer's stance 「可以的话，ui 后续开发尽量用云 session，并且要求截图给我看」; lane scope on 「你也可以接ui车道的卡」; batch 3 on 「当前任务处理完，后续并发降到3」, this session's chat, 2026-10-16)
Clause-②: yes
Clause-② reason: @object-ui/types and @object-ui/app-shell re-export @objectstack/spec types, and a 158-commit release range can move objectui's published surface in either direction («拿不准 ⇒ 按 yes»). The seat's TIER_DEFAULT review comes before ready.
Responsibility: n/a — a dependency bump, not a defect card
Thread-read: none
Serial constraints cleared:

No open objectui PR touches pnpm-lock.yaml or a workspace package.json except dependabot objectui#11845 / build(deps): Bump next from 16.3.6 to 16.3.8 in /apps/site in the npm_and_yarn group across 1 directory #11844 on apps/site (read at dispatch).
This seat's in-flight fix(fields,core,grid,detail): overdue is declared-only, and a settled deadline paints nothing (objectui#11815) #12874 (objectui#11815) touches fields, core, types and the plugin hosts, not the lockfile. Whichever lands second merges main.

os-dev-report

{
  "issue": 12873,
  "status": "done",
  "branch": "claude/issue-12873-objectstack-next-3",
  "pr": 12887,
  "session": "session_01GqyWzkUEkq5N5ne2ieHxVv",
  "premise_still_valid": true,
  "summary": "objectui's lockfile now resolves all seven @objectstack/* packages (client, core, formula, lint, sdui-parser, spec, types) at 18.0.0-next.3, regenerated by pnpm. No range floor moved. next.3 raised 9 red files (36 tests), measured on the lockfile-only commit 2e80918. All 9 are followed here at the smallest contract-following change, so nothing is left to a follow-up card. Six reds come from upstream commits: PageComponentSchema is no longer a .pipe() (objectstack 105902f), page:header showStar is tombstoned (ae0ca66), record:json is added (97b8e7a51d), and select option kind is added (adad73f). Three come from the bump itself: the lockfile-integrity samples, backend.env, and 26 restamped installed-spec claim sites, each re-measured on next.3 against next.2. Held cards: next.3 carries 97b8e7a51d (objectui#12490, whose face the maintainer has since dropped, so record:json is recorded as deliberately unregistered and nothing is built) and descends from 1eac7ad751 (objectui#12333). A smoke read against HotCRM on next.3 is on the evidence branch. HotCRM's own lead.view.ts fails next.3's compile on 44 visibleOn keys, a producer-side item.",
  "tests": "All runs below are on next.3 unless noted. (1) Full suite: 16 shards, 5,424 files, held the lock 2h17m (VERDICT command-exit 0). Red shards: 2 (registry-inputs-spec-parity, 27 tests), 3 (recordRelatedListInputs, 2), 6 (select-option-spec-extension-7014, 1) and 8 (block-config, 1). The other 12 were fully green. The worktree changed during the run (comment restamps and test follows), so the red set was re-measured on a clean 2e80918 checkout: the 20 test files this PR touches plus block-config, ci-cd-pipeline-doc and check-installed-spec-pin-claims gave 9 failed files and 36 failed tests. That adds recordDetailsInputs, recordHighlightsInputs, check-lockfile-integrity, ci-cd-pipeline-doc and installed-pin-claims to the four above. (2) On bc4712a, after merging main: 61 files (this PR's 29 plus the 32 main brought) gave 60 passed and 1 skipped, 1405 tests passed. scripts/__tests__ in full gave 186 passed and 2 skipped, 5620 tests. (3) Negative control, this branch's pins with the BASE lockfile (next.2) installed: registry-inputs 26 red, the record-block parity pins 4 red, select-option-7014 1 red, block-config 1 red, and lockfile-integrity, ci-cd-pipeline-doc and installed-pin-claims red. All of them are green on next.3. (4) Ablations: each was mutated through an anchored python replacement with an exact count check and a trap restore, and afterwards the file hash matched HEAD and git diff HEAD was empty. The results were: _def.in put back in registry-inputs, 22 red; the record:json ledger key renamed, 2 red; _def.in put back in recordRelatedListInputs, 2 red; kind dropped from the key list, 1 red. (5) Probes, not committed: a parse probe over the next.2 and next.3 spec builds and lint builds for every restamped fact. The outputs were identical except for the checkPageComponentViewData export and the slotted api binding. A temporary @object-ui/types face probe, run in both trees and then deleted, showed page:header showStar ACCEPT on next.2 and REJECT on next.3.",
  "gates": "Local, exit codes captured before any pipe. Build: turbo build --filter=!@object-ui/site --concurrency=2, 43/43, exit 0 (2e80918). Type-check: turbo type-check --concurrency=2, 81/81, exit 0 on 2e80918 and again on 1dc6351. type-check:scripts, type-check:e2e and type-check:vitest-setup exit 0. These exited 0 on bc4712a: check:installed-pin-claims (OK), check:lockfile-integrity (VERDICT clean), check:lockfile-dedupe (VERDICT deduped), check:spec-floors, check:spec-symbols, check:phantom-deps, check:i18n-keys, check:i18n-drift, node scripts/check-changeset-presence.mjs (31 source files of 10 released packages, 1 changeset), check-changeset-fixed, check-changeset-no-major, check:changeset-claims, check:pending-changeset-literals, check:new-line-citations (0 new), check:control-bytes and check:doc-json. On the 2e80918 console build, check:sdui-registration-pins and check-eager-closure-budget exited 0 (3149.3 of 3744.1 KB). eslint --no-inline-config over the 26 touched code files: 0 errors, exit 0. node scripts/check-nul-bytes.mjs is MODULE_NOT_FOUND because objectui has no such script; that is not a measurement, and check:control-bytes is objectui's equivalent. objectui has no scripts/pm/dispatch-gates.mjs, so the local list was derived by hand from package.json and the dispatch. CI families: NOT MEASURED, because no PR exists yet and the PM opens it.",
  "mcp_calls": "7 GitHub MCP calls, all reads: issue_read x6 (12873, 12490 and 12333, each get and get_comments) and pull_request_read x1 (12648 get). Also ToolSearch x1, and claude-code-remote add_repo x2 with access read (objectstack and hotcrm, both answered read_available, nothing attached). No MCP write tool.",
  "api_writes": "0 REST writes. git push only: the feature branch claude/issue-12873-objectstack-next-3 (the empty branch first, then each commit, head bc4712a) and the evidence branch claude/issue-12873-evidence (0a6fc21). No PR, no card comment and no label write, per the degraded channel.",
  "open_questions": [
    {
      "question": "record:json: next.3 forced a decision in two places (the registry-inputs parity ledger and the Studio palette coverage). Should it be recorded as deliberately unregistered, or should a renderer be built?",
      "options": [
        "A: ledger as NOT REGISTERED, DELIBERATELY plus a PALETTE_EXCLUSIONS entry, citing the drop of the face on objectui#12490 and the retirement filed as objectstack#24162 (taken)",
        "B: build the record:json renderer that objectui#12490 step 4 had specified"
      ],
      "recommendation": "A, decided under ruling 2 and the four axes. Business need: the maintainer said no approver needs JSON, and the face is dropped (pointer 6232139151), so B serves no measured consumer. Long term: both entries go red when the spec retires the type, so the record cannot outlive the decision. AI-proofing: an unregistered type renders a loud unknown-component panel, not a silent half-feature. Startup focus: B would build a surface already slated for retirement."
    },
    {
      "question": "Conflict between the dispatch and os-dev.md: the contract says to deliver the report as a card comment first and to pr_create the draft PR through scripts/pm writes; the dispatch says not to, because the fleet-write relay is refused in this container.",
      "options": [
        "A: follow the dispatch: report and pr_body_draft in the final message only, and the PM opens the PR and posts the report (taken)",
        "B: follow os-dev.md's channel"
      ],
      "recommendation": "A. The dispatch says the file wins on a disagreement, but the file's write channel does not exist in this container (fleet-write repository_dispatch answers 403). The file's own fallback, 'the seat writes it for you', is exactly what the dispatch arranges."
    }
  ],
  "out_of_scope_findings": [
    "class: c · reach: public door: objectstack dev compile on @objectstack/* 18.0.0-next.3 stops with \"Compile failed\", measured on objectstack-ai/hotcrm 4f82b81 with a local override to next.3 · evidence: src/sales/views/lead.view.ts carries 44 view form field visibleOn keys, which next.3 refuses (\"view.form.sections[].fields[].visibleOn was removed in @objectstack/spec 18 (ADR-0089 D2)\", objectstack 105902f). Renaming them to visibleWhen in a scratch copy boots clean. Seam: spec:FormFieldSchema.visibleOn (tombstone) -> producer: hotcrm lead.view.ts · carrier: HotCRM's own 18.0.0-next.3 bump (repo:hotcrm seat) · dedupe words: hotcrm next.3 visibleOn, lead.view visibleWhen rename, view form field visibleOn removed",
    "carrier: none (承接者:无) · noted, not filed (an observation, with no producer measured): objectui's SDUI form option type inherits the spec's new select option kind through SelectOptionBase, while the spec's form view option list (FormSelectOptionSchema) does not take it · dedupe words: form select option kind, SelectOptionBase kind form face"
  ],
  "deviations": [
    "Worktree creation: the shared checkout /home/user/objectui was sitting on a local claude/issue-12873-objectstack-next-3 with zero commits of its own. The auto-mode classifier refused git branch -D, so the shared checkout was detached at origin/main (0c511f7; it stays detached), the worktree was added detached, and the existing branch, already at origin/main, was checked out inside it. The result is the same branch at the same base as the prescribed recipe.",
    "The full 16-shard suite ran on a worktree that changed during the run (comment-only restamps and the test follows). The red set is therefore quoted from a clean 2e80918 re-run.",
    "Targeted vitest runs during the 2h17m shard run went outside the verify lock with --maxWorkers=1, because this run itself held the lock. The final runs on bc4712a went through the lock.",
    "type-check was last run on 1dc6351, before the merge of main; build was run on 2e80918. Later commits are comments, tests, one string entry in block-types.ts, and main's own CI-green commits.",
    "The verify lock is at /home/user/objectstack-ai/objectstack/scripts/pm/os-verify-lock.sh, the read clone's path, not the /home/user/objectstack path AGENTS.md names. No other agent shares this container.",
    "HotCRM smoke: a scratch worktree of hotcrm with package.json pins moved to next.3 and the spec's visibleOn-to-visibleWhen remedy applied to lead.view.ts. It was never committed or pushed, and was restored and removed afterwards.",
    "start-backend.sh's vitest override was re-measured on next.3, as its own text asks at every pin bump. It is still needed (npm 10.9.4: edgesOut crash without it, exit 0 with it), so it was left unchanged.",
    "Main moved by 8 commits during the work and was merged once with no conflict (bc4712a). Its 32 test files were run on next.3 together with this PR's."
  ],
  "files_changed": [
    "pnpm-lock.yaml",
    "e2e/live/ci/backend.env",
    "content/docs/guide/ci-cd-pipeline.md",
    ".changeset/12873-spec-next-3.md",
    "apps/console/src/__tests__/registry-inputs-spec-parity.test.ts",
    "packages/app-shell/src/views/metadata-admin/previews/block-types.ts",
    "packages/plugin-detail/src/__tests__/recordDetailsInputs.spec-parity.test.ts",
    "packages/plugin-detail/src/__tests__/recordHighlightsInputs.spec-parity.test.ts",
    "packages/plugin-detail/src/__tests__/recordRelatedListInputs.spec-parity.test.ts",
    "packages/types/src/__tests__/select-option-spec-extension-7014.test.ts",
    "packages/types/src/select-option.ts",
    "scripts/__tests__/check-lockfile-integrity.test.ts",
    "restamps (installed-spec claims, comment text only): packages/app-shell/src/views/metadata-admin/celAuthoring.ts; packages/app-shell/src/views/metadata-admin/inspectors/FlowNodeInspector.declaredDefault.test.tsx; packages/app-shell/src/views/metadata-admin/inspectors/flow-node-config.startGates-12780.test.ts; packages/app-shell/src/views/metadata-admin/inspectors/flowSingleBrace-12329.test.tsx; packages/app-shell/src/views/metadata-admin/previews/flow-canvas-seeds.saveErrors-10948.test.tsx; packages/core/src/evaluator/optionRules.ts; packages/plugin-calendar/src/ObjectCalendar.tsx; packages/plugin-calendar/src/__tests__/calendarUnionReads-8651.test.tsx; packages/plugin-designer/src/MetadataFieldsPage.tsx; packages/plugin-detail/src/index.tsx; packages/plugin-form/src/__tests__/formSectionGroupReference-7051.test.tsx; packages/plugin-form/src/__tests__/masterDetailDetailsMembers-8071.test.tsx; packages/plugin-gantt/src/readme-navigation-example.test.ts; packages/plugin-kanban/src/index.tsx; packages/types/src/__tests__/chartconfig-aria-retired-4044.test.ts; packages/types/src/__tests__/dashboard-aria-retired-contract-twins.test.ts; packages/types/src/__tests__/object-view-unmirrored-keys-7779.test.ts; packages/types/src/__tests__/page-component-view-data-12666.test.ts; packages/types/src/__tests__/record-details-top-level-9040.test.ts; packages/types/src/__tests__/spec-object-refinements-7715.test.ts; packages/types/src/field-types.ts; packages/types/src/objectql.ts; packages/types/src/record-components.ts; packages/types/src/zod/objectql.zod.ts"
  ],
  "screenshots": [
    "https://github.com/objectstack-ai/objectui/blob/0a6fc21b6e1145bcb05385bf6ad785f7e4c42a31/docs/design/findings/12873/leads-list-1440.png?raw=true",
    "https://github.com/objectstack-ai/objectui/blob/0a6fc21b6e1145bcb05385bf6ad785f7e4c42a31/docs/design/findings/12873/lead-record-1440.png?raw=true",
    "https://github.com/objectstack-ai/objectui/blob/0a6fc21b6e1145bcb05385bf6ad785f7e4c42a31/docs/design/findings/12873/studio-object-designer-lead-1440.png?raw=true"
  ],
  "line_budget": "n/a (no skills/** surface)",
  "mechanism_assumptions": {
    "1": "HOLDS: pnpm-lock.yaml on 0c511f7 resolved the seven packages at 18.0.0-next.2, two entries each.",
    "2": "HOLDS: 32 package.json files name @objectstack/*; 38 ranges read ^18.0.0-next.1 and 2 read ^18.0.0-next.2.",
    "3": "HOLDS: npm dist-tag next is 18.0.0-next.3 for all seven, and the spec and cli tags peel to 2c9bf9430a.",
    "4": "HOLDS: git rev-list --count e5136ff10f..2c9bf9430a is 158, with 17 breaking (!:) commits read against objectui imports.",
    "5": "HOLDS: CI installs from the lockfile, and main ran next.2."
  },
  "pr_title_draft": "deps(v18): resolve @objectstack/* 18.0.0-next.3 and follow its contract (objectui#12873)",
  "pr_body_draft": "(elided here: it is the body of objectstack-ai/objectui#12887, the dev's draft verbatim)",
  "head": "bc4712a"
}

Relayed by seat domain:ui#4 (session_01SJn1GEkrbbBQkhGC26wEDw) from the cloud session's final report. This is the degraded channel: the session pushed and returned pr: null. The seat opened #12887 from claude/issue-12873-objectstack-next-3 at bc4712a and set pr and head above. The title is the dev's draft and names the card. The seat's rulings are in the ACCEPT on the PR.

Generated by Claude Code

Landed · PR #12887 merged as 26323c4 on main · read 2026-10-17T13:57Z

probe on `origin/main` `26323c4`	reading	control
`pnpm-lock.yaml`: `@objectstack/spec@18.0.0-next.3`	resolved (2 entries)	the only `18.0.0-next.2` left in the lockfile is in two range specifiers (`^18.0.0-next.2`), the floors this PR kept on purpose
`e2e/live/ci/backend.env`	`OBJECTSTACK_VERSION=18.0.0-next.3` (:17)	—
`record:json` in `PALETTE_EXCLUSIONS`	present (`block-types.ts` :248), citing objectui#12490 and objectstack#24162	the parity ledger carries the matching NOT REGISTERED, DELIBERATELY entry
merge size	36 files, +185 / −157	as reviewed
a model name in the merge commit's message	0	—
PNG files in the merge's diff	0	the smoke-read screenshots stay on `claude/issue-12873-evidence`

State change: the card closed as completed through Fixes #12873. This act removes pm:dispatched. The cloud session session_01GqyWzkUEkq5N5ne2ieHxVv is archived. The held cards move on: objectui#12333 is dispatchable now, with its installed spec descending from 1eac7ad751, and objectui#12490 is for its owner to re-point to the side sheet's raw-panel deletion.

Records of this card:

the claim: 6232477691;
the report relayed: 6234434737;
the ACCEPT: 6234437731;
the contract review, TIER_DEFAULT PASS: 6234440983;
the landing note: 6234562678.

Generated by Claude Code

Navigation Menu

Repository navigation

deps(v18): move objectui's @objectstack/* from 18.0.0-next.2 to 18.0.0-next.3 and follow its contract changes #12873

What is published (read from the npm registry when this card was filed)

What changes

Held follow-ups this card carries

Done when

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

deps(v18): move objectui's @objectstack/* from 18.0.0-next.2 to 18.0.0-next.3 and follow its contract changes #12873

Description

What is published (read from the npm registry when this card was filed)

What changes

Held follow-ups this card carries

Done when

Activity

objectstack-fleet commented on Oct 17, 2026

objectstack-fleet commented on Oct 17, 2026

objectstack-fleet commented on Oct 17, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions