Repository navigation
finding(app-shell): three more client call sites fire POST /packages/:id/publish-drafts outside the reporting seam and still drop every advisory — objectui#6965's completion scope #10039
Description
Path: P2 | 服务端逐草稿告警被三处静默丢弃 | 北极星「优先级」4
Filed by the domain:ui#2 execution seat (PM session session_018HrVaotisyhgmot9o2MLRq) while reviewing PR objectui#10038, which closes objectui#6965. ⛔ Not graded here — an execution seat does not grade or route.
What objectui#6965 fixed, and what it did not
objectui#6965 named two client call sites that fire POST /api/v1/packages/:id/publish-drafts outside the reporting seam, and PR objectui#10038 routes both through MetadataClient.publishPackageDrafts, so the server's per-draft advisories now reach the author there.
⭐ There are three more, and they still drop every advisory the server sends. Enumerated by the reviewing seat on objectui origin/main 030a675b0 at 2026-09-19T19:14Z — the full list, reconciled against its own row count, ⛔ not a truncated one:
| call site | state |
|---|---|
packages/app-shell/src/preview/usePublishAllDrafts.ts |
✅ routed by PR objectui#10038 |
packages/app-shell/src/views/metadata-admin/PackagesPage.tsx |
✅ routed by PR objectui#10038 |
packages/app-shell/src/console/ai/PendingDraftsBar.tsx |
⛔ still a bare fetch |
packages/app-shell/src/views/studio-design/StudioDesignSurface.tsx |
⛔ still a bare fetch |
packages/app-shell/src/console/ai/AiChatPage.tsx |
⛔ still a bare fetch |
Enumeration control: 9 non-test rows matched the route in packages/app-shell/src + apps/console/src, over 11 files including tests — the instrument sees more than the five rows above, so the five are a reading rather than a ceiling.
Same defect, same fix shape
Each of the three is the identical shape objectui#6965 documented: a bare fetch to the batch route, so the published[].advisories the server now sends (declared in the installed @objectstack/spec@17.4.0 as PublishPackageDraftsResponseSchema.published[].advisories) are parsed by nobody and the author sees nothing. The fix is the one PR objectui#10038 already built: call client.publishPackageDrafts(...).
⛔ They were left out of PR objectui#10038 deliberately: the dispatch declared a four-file face and said not to widen it. ⇒ This is objectui#6965's completion scope, not a new discovery about the mechanism.
⚠️ Serial constraint — read this before dispatching
Two of the three files are in flight right now. objectui#7373 (claude/issue-7373-home-redirect-declared-landing, claimed by the same seat at 2026-09-19T19:14Z) declares a file face that includes StudioDesignSurface.tsx and AiChatPage.tsx. ⇒ This card must be serialized after objectui#7373 lands, or it will collide in two of its three files. PendingDraftsBar.tsx is free.
查重词
batch publish-drafts bare fetch · StudioDesignSurface · PendingDraftsBar · AiChatPage · advisory seam
Generated by Claude Code
Activity
os-tesla commentedon Sep 20, 2026
Claim: PM loop — 2026-09-20 shift, batch slot 4/5⚠️
Session:
session_018HrVaotisyhgmot9o2MLRqBranch:
claude/issue-10039-publish-drafts-advisoriesWorktree:
objectui-issue-10039Domain:
domain:ui(triage's; ⛔ not re-routed here)Seat:
domain:ui#2File surface:
packages/app-shell/src/console/ai/PendingDraftsBar.tsx,packages/app-shell/src/views/studio-design/StudioDesignSurface.tsx,packages/app-shell/src/console/ai/AiChatPage.tsx, and their tests. ⛔ Nothing else — the two already-routed sites are the LANDED precedent to read (PR objectui#10038), ⛔ not files to edit.Container & model: M,
mode:subagent,model: opus. ⛔ No tier output is quoted:scripts/pm/dispatch-gates.mjsREFUSES for this repo.Clause-②: no — three call sites move onto an existing client method. No exported symbol and no key on a published payload moves.
Hot-file serial queue:
StudioDesignSurface.tsxis touched by PR #10091, in the merge queue (comments only, objectui#10043). The dev re-fetches before its final gate run and merges base in if #10091 has landed. ⛔ It does not touch the comment repair.Claimed at 2026-09-20T13:09Z.
Generated by Claude Code
os-tesla commentedon Sep 20, 2026
Release:— this seat retracts its own claim on this card, ⛔ never started.Cause: the maintainer lowered this seat's concurrency ceiling, verbatim: 「后续并发降到2」, 2026-09-20T13:11Z. The claim above was written for batch slot 3/5 or 4/5 under the previous ceiling of 5; at a ceiling of 2 those slots do not exist.
⭐ Nothing was dispatched and nothing was written: ⛔ no
os-devwas launched, ⛔ no branch was pushed, ⛔ no PR exists. The card is exactly as it was before the claim —pm:queue, unassigned, ungraded by this act.Release:line is what takes it out of the claim pool (the protocol's own retraction channel — aRelease:directive retracts its own author's older claims and needs no comment id). ⇒ a reader of this thread sees the claim AND its retraction, ⛔ not a gap.⭐ The claim's own readings are left standing for whoever takes this next — the file surface, the hot-file intersections and the clause-② declaration were all derived before the ceiling changed and none of them depends on it.
Generated by Claude Code
os-tesla commentedon Sep 20, 2026
Claim: PM loop — 2026-09-20 shift, batch slot 2/2 (ceiling now 2, per 「后续并发降到2」)
Session:
session_018HrVaotisyhgmot9o2MLRqBranch:
claude/issue-10039-publish-drafts-advisoriesWorktree:
objectui-issue-10039Domain:
domain:ui(triage's; ⛔ not re-routed here)Seat:
domain:ui#2File surface:
packages/app-shell/src/console/ai/PendingDraftsBar.tsx,packages/app-shell/src/views/studio-design/StudioDesignSurface.tsx,packages/app-shell/src/console/ai/AiChatPage.tsx, and their tests. ⛔ Nothing else — the two already-routed sites are the LANDED precedent to read (PR objectui#10038), ⛔ not files to edit.Container & model: M,
mode:subagent,model: opus. ⛔ No tier output is quoted:scripts/pm/dispatch-gates.mjsREFUSES for this repo.Clause-②: no — three call sites move onto an existing client method. No exported symbol and no key on a published payload moves.
⭐ Re-claimed. This seat claimed this card at 2026-09-20T13:09Z for slot 4/5, then released it un-started when the ceiling dropped to 2 (
Release:comment above). A slot has since freed and the card is taken again — ⛔ nothing about the release was a judgement on the card.Hot-file serial queue:⚠️
StudioDesignSurface.tsxwas touched by PR #10091, which has now LANDED (origin/main3ac2de829), so that intersection is closed rather than pending. The only other card in flight is #10096 (packages/plugin-detail), disjoint.Claimed at 2026-09-20T13:36Z.
Generated by Claude Code
os-tesla commentedon Sep 20, 2026
os-dev-report
{⚠️ THE CARD'S OWN ENUMERATION CONTROL DOES NOT REPRODUCE: the card states 9 non-test rows over 11 files at 030a675; the same instrument (git grep -n 'publish-drafts' over packages/app-shell/src + apps/console/src, uncapped, counted before any row was read) gives 15 non-test rows over 11 files AT THAT SAME SHA, and 14 over 11 at today's origin/main f760064. The file count reproduces exactly; the row count does not, at any sha, and three narrower spellings were tried without producing the card's pair. The finding itself is unaffected. Also measured and worth carrying: a same-line
"issue": 10039,
"status": "done",
"branch": "claude/issue-10039-publish-drafts-advisories",
"pr": "#10147",
"session": "session_018HrVaotisyhgmot9o2MLRq",
"premise_still_valid": true,
"summary": "All three call sites the card names were still bare
fetchcalls to POST /packages/:id/publish-drafts on today's origin/main (re-verified at f760064, not inherited), so the premise holds and all three are now routed through MetadataClient.publishPackageDrafts via useMetadataClient — the same move PR objectui#10038 made for the two sibling sites. Advisories present identically on all three because the presentation belongs to the client (one MetadataSaveAdvisoryEvent per advised published[] element -> emitSaveAdvisories -> one warning toast titled 'Published — the authoring check raised N advisory finding(s)'); no surface was found that cannot present them, so nothing was dropped and no blocker arises on that count.await fetch(sweep of this route sees 2 of the 3, because AiChatPage wraps its call arguments — which is a live mechanism for why enumerations of this route keep coming up short. The assignee field arrived already set by the PM's dispatch atom (os-tesla, the shared identity) and was not touched.","tests": "RED-before/GREEN-after, file state proved in the SAME command as each run by printing
git hash-object FILEbesidegit rev-parse HEAD:FILE(never an exit code). RED: three new pins run with all three implementation files byte-identical to origin/main 3ac2de8 — PendingDraftsBar.advisoryReachesAuthor (1 failed | 1 passed), StudioDesignSurface.publishAdvisoryReachesAuthor (1 failed | 1 passed), AiChatPage.publishAdvisoryReachesAuthor (1 failed | 1 passed); every failure is 'AssertionError: expected "vi.fn()" to be called at least once' on expect(toast.warning).toHaveBeenCalled() — i.e. no advisory toast at all — while the CONTROL case in each file (clean batch body) passed, so the drive really ran. GREEN: same three files after the repair, all pass. Each pin asserts the SERVER'S finding reaches the author (toast title matches /^Published/ AND the description contains the finding's own message, rule and hint), not that a client method was called; the fixture carries all six keys readSaveAdvisories requires. None of the three mocks useMetadataClient — that is the documented way this class of hole stays invisible (useMetadataClient.advisorySink.test.tsx: 51 suites mock the module, zero used the real hook). Scope runs, all exit 0 with the verdict line read from os-verify-lock's VERDICT, never a bare $?: (a)pnpm exec vitest run packages/app-shell/src/console/ai/ packages/app-shell/src/views/studio-design/-> 85 files / 488 tests passed; (b)pnpm exec vitest run packages/app-shell/ --shard=1/2-> 371 files / 3545 passed + 1 skipped, and--shard=2/2-> 370 files / 3782 passed; (c)pnpm --filter @object-ui/app-shell run type-check-> exit 0, echoingtsc --noEmit && tsc -p tsconfig.test.json, so the new test files are type-checked; it requiredpnpm --workspace-concurrency=2 --filter '@object-ui/app-shell^...' buildfirst; (d)pnpm --filter @object-ui/app-shell run lint-> exit 0 (3048 pre-existing warnings, 0 errors); eslint over exactly the 8 touched paths reports 0 errors / 49 warnings and 0 of those 49 fall inside a hunk this branch adds (computed againstgit diff -U0new-side ranges), with the control that all 49 fall outside. Narrowing is safe: eslint.config.js declares no type-aware linting (0 hits for projectService|project:, control 13 hits for 'rules' in the same file). NOT A VERDICT, re-run properly: the first closure build passed--concurrency=2AFTER the filter, which pnpm forwards verbatim into tsup (Unknown option); recorded and re-run with the flag in its only working position. Gates re-run as the LAST action before the push withgit write-treeprinted equal toHEAD^{tree}andgit status --porcelainempty in the same command: check-changeset-presence (exit 0, and it NAMES the selection — '4 source file(s) of 1 released package(s) changed, 1 changeset(s)'), check-changeset-no-major, check-changeset-overwrite, check:control-bytes (8120 files scanned), check:i18n-keys (2756 call sites / 3005 en keys), check:i18n-drift, check:i18n-dead-keys, check:vi-mock-specifiers / -inherit / -override-shape (3372 test-named files, so the three new suites are inside the population), check:test-path-roots, check:metadata-write-doors, check:unreferenced-sources, check:phantom-deps, check:unused-deps — all exit 0. REPORT-ONLY, recorded as readings and not verdicts: check:new-line-citations (0 new cross-file line citations) and check:changeset-claims (its own output says two of its three sub-readings measured nothing on this event; its one actionable finding, two pending changesets naming files this change touches, was answered in the PR body). NOT MEASURED: check:eager-closure — it needs a built console dist and is CI's run. What was checked cheaply instead: both newly imported modules are ALREADY in the eager closure (views/metadata-admin/useMetadata.js via StudioDesignSurface's own existing import, utils/apiErrorEnvelope.js via the app-shell barrel's re-export of readEnvelopeFailureText), so no new module enters it; chunk assignment stays CI's to weigh. NOT MEASURED: the repo-widepnpm lint/turbo run lintfarm and the remaining ~75check:*gates — CI's run, not this branch's. No ablation was needed or run: the RED leg IS the ablation, taken against the unmutated origin/main bytes with the hashes printed in the same command, so nothing was mutated and nothing needed restoring.","mcp_calls": "0 — no MCP GitHub tool was called, read or write. All GitHub access went through the REST proxy with curl.",
"api_writes": "2 — POST /repos/objectstack-ai/objectui/pulls (the draft PR, written once and never PATCHed) and POST /repos//issues/10039/comments (this report). ⛔ No label write: the dispatch forbade applying any label, which overrides the standard label step. ⛔ No ready flip and no auto-merge arm. Two
git pushcalls (the empty-branch routing probe and the commit) are git, not REST. Reads (issue, comments, precedent PR, PR read-back) are not counted as writes.","open_questions": [],
"out_of_scope_findings": [
"noted, not filed: the triage seat's question — how a FOURTH call site is prevented — has a precedented answer one route over. scripts/check-object-metadata-write-doors.mjs enumerates DOORS rather than writers (its own header: 'a ruling that enumerates writers is only as good as the enumeration'), built after this exact pattern on PUT /meta (objectui#7714 named two writers, objectui#8057 hit a third, objectui#8676's sweep found nine more). A sibling door census for POST /packages/:id/publish-drafts — every in-repo call of that route must reach MetadataClient.publishPackageDrafts — would close the class by construction. It lives in scripts/, outside this card's declared file surface, so it was not taken. Successor: the routing seat reading this report and the PR body section that states it. Dedupe words:
publish-drafts door census·check-object-metadata-write-doors·enumerates doors not writers·batch publish seam gate·fourth call site.","noted, not filed: the PENDING changeset .changeset/6965-batch-publish-advisories.md publishes verbatim into the CHANGELOG and says "both client call sites bypassed the data-layer seam", naming usePublishAllDrafts and PackagesPage — under a heading about Studio's 'publish whole app'. Five call sites existed at that moment, and one of the three it omits IS the Studio workbench's own publish-whole-app button (StudioDesignSurface.doPublish). The definite article reads as exhaustive when it was not. This is prose in a release record rather than a reproducible defect, so it is not one of the three filing classes; check:changeset-claims did not flag it here because that body names neither of the files this change touches. Successor: whichever seat next edits that changeset, or the docs(changeset) correction precedent the claims gate's own output points at. Dedupe words:
6965 changeset both call sites·changeset cardinal born false·publish-drafts advisories changeset·exhaustive both·docs(changeset) correction.","noted, not filed (it IS this run's report, carried here so it is not lost between the PR body and the card): the card's stated enumeration control (9 non-test rows over 11 files at 030a675) is not reproducible — the same instrument gives 15 over 11 at that sha and 14 over 11 at today's origin/main f760064, and no narrower spelling tried produces the card's pair. Successor: this PR's body, which carries the table and the instrument."
]
}
Generated by Claude Code
fix(app-shell): route three more publish-drafts call sites through th…