Repository navigation
release: after a stable publish, the next and rc npm dist-tags still point below latest (npx create-objectstack@next installs 18.0.0-next.5, older than 18.0.0) #25581
Description
Filing gate ①: a measured, user-visible defect on a public entry (the npm registry). Maintainer-directed (Tesla, 2026-10-24, director thread: assessment item D9, "should the release CI handle this?"). ⛔ Not a claim.
Reader who acts: the release / devx lane, in one ordinary PR to .github/workflows/release.yml (or scripts/release-publish.sh), plus a one-time cleanup. ⛔ It is not a release PR.
What a user sees
Measured on the registry at filing time, for @objectstack/spec, @objectstack/core, @objectstack/cli, @objectstack/plugin-security and create-objectstack (every package of the fixed group is published with the same tags):
{"rc":"17.0.0-rc.6","latest":"18.0.0","next":"18.0.0-next.5"}
Someone who follows the common convention of npx create-objectstack@next, or npm i @objectstack/cli@next, to get "the newest" receives 18.0.0-next.5, a pre-release of the version already out as latest. They are missing every fix that went into 18.0.0, and nothing tells them so. @rc is a whole major behind.
Business check
- Who hits it: an evaluator or an AI agent who picks
@next, which is a common habit when a project moves fast. No in-repo doc tells anyone to use@nextor@rc(a grep of*.md/*.mdxoutside changelogs finds none), so the reach is habit, not our docs. - Cost if not fixed: a stale scaffold with already-fixed bugs, reported as current bugs. Low frequency, but confusing, and it recurs after every pre-release cycle that ends in a stable release.
Wanted
- The step. After a stable (non-prerelease) publish succeeds, a non-blocking step in the
publishjob does this for every package of the fixed group: any pre-release dist-tag (next,rc, and others) whose version is below the newlatestis moved tolatest, or removed. Moved is preferable, so@nextnever resolves to something older than@latest. A pre-release cycle in progress (a tag ahead oflatest) is left alone. The step logs what it changed, and a failure warns without failing the release. - The cleanup. A one-time
npm dist-tagcleanup of the current state, by whoever holds the publish token. The step from item 1 run once byworkflow_dispatchwill do.
Duplicate search: repo:objectstack-ai/objectstack dist-tag → 0 hits.
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 24, 2026
Claim: PM loop · 2026-10-24T15:49Z
Session:
session_01MLah35mAfaKp7EoEM542Js(card thread, dispatched by seat sessionsession_01LKHDniRQSWjRJyDtacwpEd)Account:
os-elon-muskBranch:
claude/project-thread-c3epik(the harness-pinned branch for the card thread; it names no issue, so this claim is the identity record)Worktree:
objectstack-issue-25581Domain:
domain:devxSeat:
domain:devx#1(seat post #6023)File surface:
.github/workflows/release.yml(publishjob, one non-blocking step after 'Publish to npm + push version tags'; Tier H), a new dist-tag script underscripts/with its--self-test, and the lint/CI wiring the gates require (stop on breach; explain in the report)Container & model:
M,mode:thread,model: default tier,effort: highClause-②: no
Metadata-protocol: none
Responsibility: n/a — maintainer-directed filing (D9 assessment).
Thread-read: none
Serial constraints cleared: no open PR touches
release.yml; #25638's CHANGELOG amendment touches onlyCHANGELOG.mdfiles.Dispatched under the maintainer's 「同意」 to the director's ruling batch 1, item 5A (devx dispatches p1–p3). Dispatch order:
/mnt/project-files/pm-devx-seat/dispatch-25581.md.objectstack-fleet commentedon Oct 24, 2026
os-dev-report
{ "issue": 25581, "status": "done", "branch": "claude/project-thread-c3epik", "pr": "https://github.com/objectstack-ai/objectstack/pull/25691", "session": "session_01MLah35mAfaKp7EoEM542Js", "premise_still_valid": true, "summary": "Premise re-measured 2026-10-24: @objectstack/cli, spec, console and create-objectstack all read {rc: 17.0.0-rc.6, next: 18.0.0-next.5, latest: 18.1.0}. New scripts/release-dist-tags.mjs moves every pre-release dist-tag below the released version up to it (kept: tags ahead of latest, stable-version tags, latest); default read-only plan, --apply writes via `npm dist-tag add`; a pre-release RELEASE_VERSION is a no-op; with RELEASE_VERSION a package whose registry latest disagrees is re-read for 65 s then skipped with a ::warning::. release.yml: one step, last in `publish`, gated on steps.publish.outputs.published == 'true', continue-on-error, timeout 15 min, no secret (uses the publish step's .npmrc); publish gating untouched. lint.yml runs its --self-test in lint-ci-engine. One-time cleanup: maintainer runs `node scripts/release-dist-tags.mjs` then `--apply` from main with their npm login (plan from this branch: 73 packages, 141 tags); no dispatch input added. Card assignee was set by the seat; PR assignee os-elon-musk.", "tests": "node scripts/release-dist-tags.mjs --self-test at 336c844c: 'OK release-dist-tags self-test: 45 cases pass across 6 batteries'. Seen red first (battery 5, 6 cases: a spawnSync blocked the in-process stub registry), green after an async spawn. Live read-only plan: '141 tag(s) would move, 0 kept ahead of latest, 0 package(s) skipped, 0 failure(s).' No ablation: script/workflow change.", "gates": "Local at 336c844c (on main b2909fd4): dispatch-gates --commands derived 59 families, all exit 0; --ran: 59 derived, 59 run, 0 NOT-MEASURED (derived zero, exit codes recorded). eslint --no-inline-config scripts/release-dist-tags.mjs exit 0. CI check-runs: in_progress at report time.", "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm", "mcp_calls": "5 — read-only: issue_read x2, pull_request_read x1, subscribe_pr_activity x1 (session tool), get_session x1; no MCP write", "api_writes": "2 — fleet-write relay: pr_create (POST /pulls + assignees + labels skip-changeset, run 40112135977), this comment", "open_questions": [], "out_of_scope_findings": [] }Generated by Claude Code