Packaging: sales becomes the type: app package and service a type: module — composeStacks(…, { manifest: 'preserve' }), navigation contributions, two-entry packages[]

Part of #1904 (step 2 of the sequence).

~~Blocked-by: objectstack-ai/objectstack#18202~~ — ✅ CLOSED 2026-09-15, merged as b8ec127b4. Was the real blocker. defineStack's cross-reference validation is unfixed on origin/main (packages/spec/src/stack.zod.ts:2021, if (objectNames.size === 0) return errors;, identical to the published dist). Fix PR objectstack-ai/objectstack#18212 is delivered and ACCEPTed (2026-09-14, head b0072379): DefineStackOptions.artifactObjects makes the two artifact-scoped reference classes resolve against the artifact, plus a new ARTIFACT pass in composeStacks — measured necessary, since composeStacks ran no cross-reference validation at all before it. It stays draft under needs:contract-review (clause ②: the changeset is minor on @objectstack/spec), so the remaining gate is the spec seat's contract review, then the merge, then a publish.
~~Blocked-by: objectstack-ai/objectstack#18204~~ — ✅ CLOSED 2026-09-15, merged as fb3c6b4f6. Never a code blocker; reclassified to a pin-bump item on 2026-09-14. Measured on origin/main: artifactProvidedObjectNames is present in packages/lint/src/validate-object-references.ts (defined line 162, called line 209) and absent from the published @objectstack/lint@17.4.0 this repository pins. It landed in f89dd33cc … (#17066) and is simply unreleased. Nothing upstream has to change for it.
Unlock: a released @objectstack/* line that carries both the already-merged #17066 lint/cli change and the #18202 spec fix, AND the pin bumped in this repository (merged upstream is not available in the pin — AGENTS.md, Platform Upgrades); then re-run pnpm validate on branch claude/issue-1907-sales-app-service-module (be11c07, rebased onto main) — zero cross-reference issues is the criterion.

Status (2026-09-14T15:05Z, epic PM)

The packaging is built and pushed on claude/issue-1907-sales-app-service-module (be11c07, off 36b27dd) and proven at runtime on a source boot: GET /api/v1/packages lists both packages (writable: false, scope: project, 15 objects app + 3 objects service), GET /api/v1/meta/app?id=crm_enterprise returns the 33-node tree, the admin browser walk matches main on every reading (13 list row counts, 5 record pages, 5 dashboards, approvals inbox, 0 page errors). It cannot land on the 17.4.0 pin: defineStack validates cross-references per stack, so the app package's seven permission sets — which the ADR-0130 addendum of 2026-09-02 requires to stay whole in the app package — are refused for their 18 grants on service-owned objects (reproduced by the seat: pnpm validate exit 1, "defineStack cross-reference validation failed (18 issues)", every line Permission '<set>' grants on object '<crm_case | crm_knowledge_article | crm_article_feedback>' which is not defined in objects). A second per-package rule refuses the service actions' attendee_contacts picker reference to crm_contact (objectstack#18204); a third emits 15 false-positive translation-target-unknown warnings for the contributed navigation items (objectstack#18203, warnings only, not blocking). Per AGENTS.md chapter 2 the card WAITS for the platform fix; no PR is opened, the branch keeps the work.

Decisions recorded on the dev's report: (1) route A — file upstream and wait — is AGENTS.md's default and is applied; re-ruling the addendum so modules ship their own permission sets (route B) is the maintainer's call and is presented in the round report; (2) nav_my_cases lands last inside My Work because contributions append after the app's own children (priority orders contributions against each other only) — accepted, to be stated in the landing PR's release note; (3) seed rows registered by the owning package (route (b)) — measured safe; (4) requires declared per stack, union at composition — measured harmless; (5) src/sales/interfaces/index.ts is dropped in the landing PR together with its ten doc/labeler references.

When resumed, the landing PR still owes: the docs half (AGENTS.md Project Architecture "one composeStacks over N package stacks", docs/README.md, docs/ARCHITECTURE.md, docs/STATUS.md, content/docs/getting-started/for-developers*.mdx), the six pins the report names (i18n-references, docs-quick-tour-navigation, docs-setup-navigation-names, docs-analytics-vocabulary, docs-service-index-analytics, saas-composition — taught the contribution channel and the per-package seed split, never lowered), the changeset, the interfaces/ drop, and a fresh browser walk against main. Governed PR (touches AGENTS.md): draft, ## 维护者速读(草稿), the maintainer merges.

Spec of record: docs/architecture/module-split-plan.md, Decisions recorded (2026-09-14), items 4–9, and the measured rules R1–R4 above them — now on main (PR #1906 merged). Read it in full before the first edit; this card is the pointer, not a second copy. This card moves no files.

Ruling (verbatim, untranslated)

「所以应该先分拆基础的crm, 比如 sales 和 support， token 门禁：放到 sales」 / 「为什么需要app ，我觉得是另外一种混乱」

The tree as #1910 left it (premises — verify on `origin/main` before acting)

src/sales/, src/service/, src/revenue/, src/marketing/ are the package directories; src/docs/ stays at the top of src/ (the platform reads package docs from that path only — plan item 6, objectstack#18170).
objectstack.config.ts is ONE defineStack with the app manifest (id: 'app.objectstack.hotcrm', namespace: 'crm', version: '3.1.0', type: 'app', engines: { protocol: '^17.4.0' }, requires: [...], i18n), and it may carry no named export (objectstack#18171).
objectstack.composition.ts (root, sibling of the config) collects the four packages' barrels into the ordered arrays defineStack takes; about a dozen suites read the authored collections there (test/saas-composition.test.ts says why).
Each package has per-type barrels (<pkg>/<type>/index.ts) and a hook barrel <pkg>/objects/hooks.ts.
The five service navigation nodes sit in the app's navigation in src/sales/apps/crm.app.ts (nav_case, nav_knowledge, nav_service_dashboard in group_service; nav_my_cases in group_work; nav_report_sla in group_insights); the app's name is crm_enterprise.
Measured by the blocked branch, superseding the card's earlier assumptions: no sales-owned dashboard binds case_dataset and no sales-owned page lists crm_case (those two "measurements" had nothing to measure); the real cross-package authoring edges and their verdicts are in the dev's report on this card.

What this PR does

Two package identities inside one artifact (ADR-0130 D1/D4), no rename, no move — the shape on branch be11c07:

src/sales/index.ts — the app package (createHotCrmAppStack factory: revenue and marketing collections are handed in by the root because a file under src/sales/ may not import a module directory), registering the sales, revenue and marketing collections, the profiles, positions, translations, docs and the HOTCRM_COMPOSITION filtering exactly as today.
src/service/index.ts — defineStack with { id: 'app.objectstack.hotcrm.service', name: 'HotCRM Service', namespace: 'crm', type: 'module', version: '3.1.0', engines: { protocol: '^17.4.0' }, dependencies: { 'app.objectstack.hotcrm': '^3.1.0' }, requires: ['automation','triggers','analytics','sharing'], navigationContributions: [...] }, registering the service collections and the service seed rows.
Navigation — the five service nodes leave the app's navigation and come back as the module's navigationContributions into group_service, group_work, group_insights. app is the app's bare name (crm_enterprise). A group that names no group the app declares is relocated with a warning, not refused — read the boot log.
Root objectstack.config.ts — export default composeStacks([serviceStack, salesStack], { manifest: 'preserve' }) with the app LAST (the singular manifest is picked by the 'last' rule), and nothing else exported.
Permission sets stay whole in the app package (ADR-0130 addendum) — the item the pin refuses today; see Status.
Docs follow (owed by the landing PR, see Status).

Acceptance

pnpm build emits dist/objectstack.json with packages[] of exactly two entries; every existing object keeps its FQN; crm_case, crm_knowledge_article, crm_article_feedback and their items are owned by app.objectstack.hotcrm.service, everything else by app.objectstack.hotcrm. Prove ownership from the artifact or GET /api/v1/packages.
pnpm dev boots from source; GET /api/v1/packages lists both rows with writable: false; the boot log carries no nav_contribution_group_missing and no ownership diagnostic.
Browser walk, from source, on a fresh database with --seed-admin, against a main instance booted the same way: the same 33 navigation nodes (with the one accepted difference: nav_my_cases last inside My Work); every list page opens with the same row counts; a case, a knowledge article, an account and an opportunity record page open with the same tabs; all five dashboards draw; the approvals inbox mounts; 0 page errors. Readings for both sides in the PR body as a table.
pnpm verify green; the navigation and docs pins keep their floors (contributed items count as reachable — teach the pin the contribution channel rather than lowering the floor); the token gate reading for src/sales/ is unchanged.
Changeset: the marketplace listing gains a package row, so a patch changeset describing the two packages, or empty frontmatter if the consumer surface is judged unchanged — say which and why.
The cross-package measurements recorded in the PR body (the dev's report on this card already carries them; re-verify on the landing pin).
Governed PR: stays draft, body carries ## 维护者速读(草稿); the maintainer merges.

Out of scope

Packaging revenue/ or marketing/ (later cards, when the maintainer says so). Splitting translations or permission sets. Any object, field or behaviour change. PSA.

Blocker re-reading (2026-09-14T16:40Z, epic PM)

The upstream dispatch on objectstack#18204 came back premise_still_valid: false, and the PM verified the falsification independently rather than taking the report's word (objectstack-ai/objectstack#18204, ACCEPT verdict). What this changes for this card:

Upstream item	Before	Now	Evidence
objectstack#18202 (`defineStack` per-stack cross-reference refusal, 18 permission-set grants)	blocker	✅ closed, merged `b8ec127b4`	`stack.zod.ts:2021` early return present on `origin/main`, same shape as published dist; no dependency awareness in that validator
objectstack#18204 (per-package action-param reference to `crm_contact`)	blocker	✅ closed, merged `fb3c6b4f6` — pin bump only	fixed on `origin/main` by `#17066`; absent from published `@objectstack/lint@17.4.0`; nothing to fix upstream
objectstack#18203 (15 `translation-target-unknown` warnings)	not blocking	unchanged	warnings only

So the unlock condition narrows to one upstream code fix (#18202) plus a release carrying it alongside the already-merged #17066. The upstream half now has its own carrier: objectstack-ai/objectstack#18215 tracks the six upstream cards and the release that gates this one. The work on claude/issue-1907-sales-app-service-module (be11c07) stands unchanged and still waits; no PR is opened.

✅ 上游代码门禁已全部清零（2026-09-15）

两张阻塞卡都已合入 origin/main：

卡	合入	形态
objectstack#18204	`fb3c6b4f6`	回归钉，前提被证伪，从来不是代码门禁
objectstack#18202	`b8ec127b4`	真修复，四轮达档契约复核（两次 FAIL 后 PASS）

⚠️ 但 #1907 仍 pm:blocked，且这是对的 —— 解锁判据是 PIN 不是
merge。npm 上 @objectstack/spec 的 latest 仍为 17.4.0，不带这两笔。

剩下的唯一一步是发版，而发版按设计只能人工触发（cut-rc.yml 为 workflow_dispatch-only，environment: release 门控，2026-08-07 裁决「版本发布必须是人工的」）。上游承载卡：objectstack-ai/objectstack#18215。

Generated by Claude Code

Claim: PM loop round 2 (epic #1904)
Session: session_01T3YsvpK1PvYf9n1YUhYP6W
Branch: claude/issue-1907-sales-app-service-module
Worktree: hotcrm-issue-1907
Domain: repo:hotcrm (single-lane repo; epic #1904 subtree, no domain:*)
File surface: src/sales/index.ts (new), src/service/index.ts (new), objectstack.config.ts, objectstack.composition.ts, src/sales/apps/crm.app.ts (the five service navigation nodes leave), src/sales/interfaces/index.ts (keep-or-drop decision), test/** (suites that read the composed stack or the navigation: saas-composition, app-navigation-shape, view-references, metadata-references, docs-* guards), AGENTS.md, docs/README.md, docs/ARCHITECTURE.md, docs/STATUS.md, content/docs/getting-started/**, .changeset/*.md (stop on breach; explain in the report)
Container & model: L (two package manifests, the composition root, five navigation contributions, three platform measurements and a source-boot browser walk against main; correctness judged by the artifact's packages[] ownership and the identical 33-node navigation tree), mode:subagent (same reason as round 1: the os-dev role file, both checkouts, Chromium and the seat's walk script all live in this session's container), model: default judgment tier (the os-dev floor). hotcrm carries no scripts/pm/dispatch-gates.mjs, so there is no --tier output to cite; AGENTS.md is governed but not a protocol-semantics surface — construction at the default tier, the governed hunk reviewed at the contract-review tier by the seat.
Clause-②: no
Thread-read: none (no comments on the card at the moment this claim is written; 2026-09-14T14:12Z)
Serial constraints cleared: #1910 (the layout, the Blocked-by of this card) is MERGED — origin/main 36b27dd, 2026-09-14T14:07Z; premise re-read on that tip: src/ has the four package directories plus src/docs, objectstack.config.ts is one defineStack with the app manifest at version 3.1.0, objectstack.composition.ts holds the ordered collections, the five service nav nodes sit in src/sales/apps/crm.app.ts, no package has an index.ts — the premises hold. #1893 (draft, claude[bot], head claude/issue-1185-notify-template-conversion) is still open and now touches files under src/*/flows and src/sales/translations — no intersection with this card's surface; it needs its own rebase onto the moved tree, not this card's concern. #1906 (docs, this session, draft) touches docs/README.md and docs/architecture/* — a possible textual overlap on docs/README.md only; disposition: serial at landing, the later one merges main. The five dependabot PRs do not intersect. Pinned-spec readings taken this round: ManifestSchema (spec/kernel) accepts the planned module manifest with navigationContributions { app: 'crm_enterprise', group, priority, items } and rejects a dotted app id ('Identifier must be lowercase snake_case…'); composeStacks([module, app], { manifest: 'preserve' }) yields manifest.id = the app's and packages = [module, app] with objects merged — the composition API exists on 17.4.0.

Generated by Claude Code

os-dev-report

{
  "issue": 1907,
  "status": "blocked",
  "branch": "claude/issue-1907-sales-app-service-module",
  "pr": null,
  "premise_still_valid": false,
  "summary": "The packaging is built and PROVEN AT RUNTIME, and it cannot land on the 17.4.0 pin: three per-package AUTHOR-TIME checks refuse shapes this epic's own rulings require. Branch be11c07 carries the whole thing (src/sales/index.ts = the App package identity, src/service/index.ts = app.objectstack.hotcrm.service with dependencies + three navigationContributions, objectstack.config.ts = composeStacks([service, app], {manifest:'preserve'}) with the app LAST, objectstack.composition.ts re-cut per package, the five service nav entries out of src/sales/apps/crm.app.ts). Measured working on a dev boot from source with a fresh DB: GET /api/v1/packages lists both rows writable:false, scope:project, ownership 15 objects app + 3 objects service; GET /api/v1/meta/app?id=crm_enterprise returns 33 nav nodes; the admin browser walk matches main on every reading (13 list row counts, 5 record pages, 5 dashboards' Recharts mark and tile counts, approvals inbox, 0 page errors); seeded cases resolve their account and contact lookups even though the service package replays FIRST; no nav_contribution_group_missing. BLOCKER (only the PM/maintainer can resolve): defineStack's per-stack cross-reference validation refuses a permission set granting on an object the stack does not define - 18 grants across 7 sets, so pnpm validate / lint / lint:i18n-gate are all red at the same refusal. ADR-0130's 2026-09-02 addendum requires those sets to stay WHOLE in the app package; it was measured (hotcrm#1449) against a shape where the type:app package declared NO OBJECTS AT ALL, which is exactly when that check early-returns. The 2026-09-14 ruling makes sales the app package and it owns fifteen objects, so the check now fires and the two records cannot both hold. No object can leave the app package while any app-owned permission set grants on it, and every one of the 18 objects is granted by at least one, so there is no landable subset. The only local escapes are strict:false on the app stack (disables ALL schema validation for the app package - routing around a platform defect) or splitting the permission sets (explicitly out of this card's scope, contradicts the addendum, and per-package grant composition is objectstack#14488: filed, not decided). AGENTS.md chapter 2 says WAIT for the platform fix, so no PR is opened and pnpm verify is red by the platform's refusal, not by an unfinished edit. PM patrol note received 14:51Z: PR #1906 merged and origin/main is now 9f13c77; no merge was made into this branch because no PR is opened - the branch stays at be11c07 off 36b27dd, and whoever resumes it merges main then.",
  "premise_falsified": "Issue item 5 ('Permission sets stay whole in the app package (ADR-0130 addendum, 2026-09-02): the service grants remain rows of the sales-owned sets') is refused by the pin. Two of the card's three named measurements also rest on premises that are false on origin/main 36b27dd: (i) no sales-owned dashboard binds case_dataset - the sales dashboards bind opportunity_metrics / account_metrics / contact_metrics / lead_metrics / event_metrics / task_metrics / product_metrics only (grep 'case_dataset' over src/ outside src/service: zero hits); (ii) no sales-owned page lists crm_case - account_detail.page.ts has no related list of cases (grep 'crm_case' over src/sales/pages: only comments referring to case_detail.page.ts). The real cross-package authoring edges this tree has were measured instead, and are listed in 'tests'.",
  "gates": "Each step run separately, exit code captured to a file before any output was read. ON THE COMMITTED STATE (be11c07, no probes): 1 pnpm validate - 'defineStack cross-reference validation failed (18 issues)', every one a permission grant on crm_case / crm_knowledge_article / crm_article_feedback; 0 pnpm typecheck; 1 pnpm lint - same refusal (it loads the config); 1 pnpm lint:i18n-gate - same refusal; 0 pnpm hygiene; 0 pnpm hygiene:tokens. TOKEN GATE READING (acceptance 4): src/sales business semantics 49,978 UNCHANGED from main (nothing moved); interaction layer 29,344 to 29,173 (the five nav entries left crm.app.ts); authored total 91,910 to 91,982 (the new src/sales/index.ts); all three ceilings clean, 'source token ratchet clean'. WITH PROBE A ONLY (strict:false on the app stack, applied and reverted, sha256 verified): 1 pnpm build - 'Author-time rules failed inside the artifact's packages (6 issues)', all six object-reference-unknown on the crm_case activity triple's attendee_contacts picker. WITH PROBES A+B: pnpm build 0, pnpm dev boots, pnpm test = 'Test Files 8 failed | 158 passed (166) / Tests 22 failed | 3436 passed | 1 skipped (3459)'. Two of the eight (action-references, global-actions) are PROBE B artifacts, not real. The six real ones are the pins the card said would need teaching the contribution channel: app-navigation-shape-adjacent i18n-references ('no locale carries an apps.*.navigation entry the app does not declare'), docs-quick-tour-navigation, docs-setup-navigation-names, docs-analytics-vocabulary, docs-service-index-analytics, and saas-composition ('registers the FULL seed union'). pnpm build and pnpm test were run through scripts/pm/os-verify-lock.sh (slot hotcrm-1907); VERDICT lines read 'command-exit 1 / held the lock 5s' and 'command-exit 1 / held the lock 147s', waited 0s both times.",
  "tests": "MEASUREMENT 1 - a sales-owned item binding a service-owned one. The card's example (executive/crm dashboards over case_dataset) does not exist; the real cross-package edges from the app package into service are: the sales-owned customer-360 skill naming crm_case and crm_knowledge_article (ACCEPTED, no diagnostic); the four locale packs labelling service objects (ACCEPTED as object labels); lookups from crm_task / crm_event / crm_lead / crm_account into crm_case (ACCEPTED - this is ADR-0130 R1 and it holds); demo_bootstrap's system sweep naming crm_case (ACCEPTED); the seven permission sets (REFUSED - the blocker); the seed families cases + knowledgeArticles (REFUSED with 'Seed data references object crm_case which is not defined in objects', resolved by registering them with the owning package). MEASUREMENT 2 - the mirror edge, a service-owned page listing a sales-owned object: src/service/pages/case_detail.page.ts binds objectName crm_task in a related list and is ACCEPTED by defineStack, by composeStacks, by os build's composed pass and at boot; the case record page opened in the browser walk with the same tabs as main. But the service package's own actions ARE refused: os build's per-package pass reports six object-reference-unknown issues for the attendee_contacts record-picker on log_call / log_meeting / schedule_meeting (reference: 'crm_contact', hard-coded in the shared sales factory), while the COMPOSED pass immediately before it accepts the identical reference - so the platform gives a field-level cross-package lookup (R1) and an action-param-level one opposite verdicts. MEASUREMENT 3 - contribution ordering. priority does NOT interleave contributed items with the app's own children: the runtime fold is group.children.push(...c.items) (objectql core, applyNavContributions), so a contributed item always lands AFTER everything the app declares in that group; priority only orders contributions against each other. Reading: GET /api/v1/meta/app?id=crm_enterprise returns 33 nodes, and diff against main's flattened tree is exactly two lines - nav_my_cases moves from 4th to last inside My Work (after the Inbox). The three group_service items and nav_report_sla keep their exact positions, because the app declares nothing after them. Contributed items ARE translated correctly at runtime (nav_case=..., nav_knowledge=..., nav_service_dashboard=..., nav_my_cases=..., nav_report_sla=... all resolve from the app's zh-CN pack), although os build and os validate emit 15 translation-target-unknown warnings for them. SEED REPLAY ORDER (PM assumption 3): FALSIFIED in the safe direction - with the service package composed FIRST its 38 case rows replay before the accounts and contacts they reference and every crm_account / crm_contact lookup still resolves to a real id; 2 events also resolve related_to_case in the other direction. Route (b) is therefore safe and route (a) is not available. BROWSER WALK (head 4187 from source, fresh DB, --seed-admin, Chromium at /opt/pw-browsers/chromium; main side = the seat's dogfood baseline taken the same way on 36b27dd): identical on every reading - nav 33/33, objects 98/98, crm_lead 21, crm_account 9, crm_contact 0, crm_opportunity 10, crm_quote 6, crm_contract 4, crm_product 13, crm_task 7, crm_event 27, crm_campaign 7, crm_case 38, crm_knowledge_article 4, crm_forecast 7; executive 9 marks / 9 tiles, sales 13/17, service 14/14, crm_overview 13/9, activity 13/13; approvals inbox mounts; 0 page errors both sides; the single 400 (POST /api/v1/analytics/dataset/query) is the seat's walk script naming a dataset that does not exist and is identical on main. No ablation was run: nothing was landed to ablate.",
  "deviations": [
    "Seed families are registered by the package that OWNS their object (the PM's route (b)), not kept whole in the app package (route (a)): route (a) is refused by defineStack, and the replay order it was meant to protect was measured harmless.",
    "src/service/index.ts declares requires: ['automation','triggers','analytics','sharing']. The first draft declared none and defineStack refused its own flows ('flow case_escalation declares a record_change trigger but requires does not include triggers'); trigger capability is validated PER STACK. requires composes by concatenation, so the artifact's slate is the union and two tokens appear twice - measured harmless at boot.",
    "src/sales/index.ts exports a factory (createHotCrmAppStack) rather than a default-exported stack, because src/revenue/ and src/marketing/ are still directories of the app package and AGENTS.md forbids a file under src/sales/ importing from a module directory. The root assembles those collections and hands them in; when revenue and marketing are packaged the argument disappears.",
    "src/service/index.ts is likewise a small factory taking only `data`, for the same reason on the seed side.",
    "Two measurement probes were applied to the worktree and reverted, each restored from a saved copy and verified by sha256 (probe A: { strict: false } on the app stack; probe B: stripping the attendee_contacts param from the three crm_case activity actions). Zero PROBE markers remain in the tree; the committed state is the un-probed one.",
    "No PR opened. AGENTS.md requires pnpm verify green before a PR, and it cannot be green while the platform refuses. The branch is pushed so the work is not lost.",
    "NOT DONE, and deliberately - they belong with the landing PR once the platform fix lands, because the final shape may move: the docs half of the card (AGENTS.md Project Architecture, docs/README.md, ARCHITECTURE.md, STATUS.md, content/docs/getting-started/for-developers*.mdx), the six pins listed under gates, the changeset, and dropping src/sales/interfaces/.",
    "src/sales/interfaces/index.ts - the answer the card asked for: NOTHING needs it. It exports nothing and is registered by nothing. Dropping it is right, and it is not free: .github/labeler.yml's src/*/interfaces/** glob would match nothing (its guard fails on that), AGENTS.md's tree, docs/ARCHITECTURE.md and six content/docs tree drawings name it, and test/docs-src-tree-paths.test.ts guards them. It is a ten-file mechanical follow-through that belongs in the landing PR, not a separate card."
  ],
  "line_budget": "n/a - no skills/** file is touched by this branch.",
  "files_changed": [
    "objectstack.composition.ts (modified)",
    "objectstack.config.ts (modified)",
    "src/sales/apps/crm.app.ts (modified - the five service nav entries leave; group_service stays as an empty container)",
    "src/sales/index.ts (new)",
    "src/service/index.ts (new)"
  ],
  "mcp_calls": "0 - no MCP GitHub tool was called.",
  "api_writes": "1 REST proxy write: POST /repos/objectstack-ai/hotcrm/issues/1907/comments (this report). Plus 2 git pushes on claude/issue-1907-sales-app-service-module (the empty write-route probe, then be11c07). No labels written and no PR created, because no PR was opened.",
  "open_questions": [
    {
      "question": "Permission sets whole in the app package is refused by the pin the moment the app package owns objects. Which way does this go?",
      "options": [
        "A - File the platform gap upstream and WAIT (AGENTS.md chapter 2's default). The fix shape: defineStack's cross-reference validation should treat an object owned by a DECLARED DEPENDENCY as defined, or defer the check to composition/registration time, where the composed pass already accepts everything. Cost: this card and every later packaging card (revenue, marketing, PSA) wait on an objectstack release. Nothing lands here meanwhile.",
        "B - Maintainer re-rules the 2026-09-02 addendum so a module ships its own permission sets (ADR-0086 D4's Shape B). Cost: it amends a recorded ruling; it needs objectstack#14488 (per-package grant composition, currently filed-not-decided) or seven sets duplicated by name across two packages with union/refuse semantics nobody has measured; and this card's Out of scope says exactly 'splitting permission sets'.",
        "C - Abandon the split for now and keep one package. Cost: the 2026-09-14 ruling's sequence stops at PR 0."
      ],
      "recommendation": "A. The runtime half is already proven correct on this pin - two packages, correct ownership, identical navigation and identical browser readings - so the only thing missing is an author-time check that knows what a dependency is. That is a small, well-localised upstream change, and it also clears blocker 2 (the per-package action-param rule) and blocker 3 (the navigationContributions translation false positive), which have the same root: per-package author-time rules reading a package of a co-owned artifact as a closed world. B spends a maintainer ruling and an undecided platform mechanism to buy the same outcome later."
    },
    {
      "question": "The four-axis escalation framework this role file requires for a needs_decision report was not carried in the dispatch word, so this is reported as blocked with the options above stated plainly rather than analysed on axes I would have had to invent. If the PM wants the decision framed on those axes, send them and I will redo the analysis.",
      "options": [
        "Send the four axes and re-analyse",
        "Treat the plain options above as sufficient"
      ],
      "recommendation": "Send the axes only if the maintainer is being asked to choose B over A; A needs no framework, it is AGENTS.md chapter 2 applied."
    },
    {
      "question": "nav_my_cases moves from 4th to last inside My Work, because contributions append and priority cannot interleave them with the app's own children. Accept, or reshape?",
      "options": [
        "Accept the move and say so in the release note (the other 32 nodes are identical).",
        "Reorder the app's own My Work children so the appended item reads naturally (a navigation change beyond this card).",
        "Author an `order` on every item of that group so the renderer sorts them (compensating for a platform merge rule inside the app - what AGENTS.md forbids, and it moves only the rendered order, not the API array)."
      ],
      "recommendation": "Accept. It is one row inside one group, the group's own comment already puts the Inbox last as the odd one out, and the alternatives either widen the card or pay a per-item tax to dodge a platform rule."
    }
  ],
  "out_of_scope_findings": [
    "to file (class b - violates a declared contract; dedupe words: permission set, cross-package, defineStack, cross-reference, ADR-0130 dependencies): objectstack - defineStack's per-stack cross-reference validation refuses `permissions[].objects` and `data[].object` naming an object owned by a DECLARED DEPENDENCY of the same artifact, so ADR-0130 D4's co-owned artifact and the 2026-09-02 addendum ('permission sets stay whole in the type:app package') cannot both hold once the app package owns objects. Evidence: 18 issues on objectstack-ai/hotcrm@be11c07 `pnpm validate`; the addendum's own measurement (hotcrm#1449) assumed an app package 'declaring no objects at all', which is the case the check early-returns on (stack.zod.ts validateCrossReferences: `if (objectNames.size === 0) return errors;`).",
    "to file (class b - violates a declared contract; dedupe words: object-reference-unknown, per-package, action param reference, module dependency, R1): objectstack - `os build` / `os dev` run author-time rules per package and refuse an action param's record-picker `reference` pointing at a dependency's object, while the COMPOSED pass immediately before accepts the same reference and ADR-0130 R1 accepts the field-level equivalent. The diagnostic's claim ('the reference is inert at runtime') is false for a co-owned artifact. Evidence: 6 issues, `crm_case` log_call / log_meeting / schedule_meeting attendee_contacts to crm_contact.",
    "to file (class c - a trap that makes an author delete metadata the runtime honours; dedupe words: translation-target-unknown, navigationContributions, nav item translation, false positive): objectstack - the `translation-target-unknown` rule reads `apps[].navigation` only, so every locale key for a CONTRIBUTED navigation item is reported as naming an item 'which app X does not declare' with the advice 'Match the key to the navigation item's id, or drop it'. Measured: the runtime resolves those five labels correctly from the app's pack (nav_case, nav_knowledge, nav_service_dashboard, nav_my_cases, nav_report_sla all return their zh-CN wording from GET /api/v1/meta/app), so following the advice deletes working translations. 15 warnings in this app (5 items x 3 non-default locales).",
    "noted, not filed: the spec docblock for NavigationContributionSchema says contributions are merged 'by target group id + priority', which an author reads as ordering against the app's own children; the fold appends and priority only orders contributions against each other. Carrier: whoever writes the next module's contributions - the same sentence is in ADR-0029 D7 and in examples/app-multi-package. Not filed because the words do not actually promise interleaving; it is a precision item, and this card's own src/service/index.ts states the behaviour in a comment for the next reader.",
    "noted, not filed: the seat's dogfood walk script posts { dataset: 'opportunity_dataset' } to /api/v1/analytics/dataset/query and gets a 400 on both main and head - the dataset is named opportunity_metrics. It is a scratchpad script, not repo content. Carrier: none."
  ]
}

Generated by Claude Code

Verdict on the report: ACCEPT as a re-triage input (status: blocked, premise_still_valid: false), no PR. Reviewed by the epic PM, session session_01T3YsvpK1PvYf9n1YUhYP6W, 2026-09-14T15:05Z.

Verified, not taken from the report: a fresh worktree at be11c07 + pnpm install + pnpm validate → exit 1, defineStack cross-reference validation failed (18 issues), every line Permission '<set>' grants on object '<service object>' which is not defined in objects; the pinned @objectstack/spec dist carries the early return the report cites (objectNames.size === 0) return errors). The blocker is real, it is the platform's, and the composed pass accepts what the per-stack pass refuses.

Disposition, per AGENTS.md chapter 2 (a platform defect means WAIT): the card moves to pm:blocked with Blocked-by: objectstack-ai/objectstack#18202 (permission-set / seed cross-references vs declared dependencies) and #18204 (per-package action-param reference); #18203 (the translation-target-unknown false positive on contributed navigation) is filed too but only warns. Unlock = a released @objectstack/* line carrying the fixes AND the pin bumped here. Route B (re-rule the 2026-09-02 addendum so modules ship their own permission sets) is the maintainer's to take and is put to them in the round report; route A is applied meanwhile.

The three open questions in the report are answered in the card body's Status block: A applied; nav_my_cases appended last inside My Work accepted; the four-axis framing is not needed for A (it is the standing rule, not a choice).

Release: session session_01T3YsvpK1PvYf9n1YUhYP6W · reason: blocked on the platform fix (objectstack#18202, #18204) · destination: pm:blocked, re-queued by the unlock scan when the fix is released and the pin bumped; the pushed branch claude/issue-1907-sales-app-service-module (be11c07) is the resume point — whoever resumes merges origin/main first (it moved to 9f13c77 with PR #1906 after this branch was cut) and then owes the landing list in the card's Status.

Implemented-by: os-dev subagent, this session (branch be11c07)
Reviewed-by: epic PM, this session

Generated by Claude Code

巡检读数（2026-09-15 15:50Z）—— 本卡维持 pm:blocked，另新增一条恢复前要知道的事。

一、解锁判据仍未触发

判据是 PIN 不是合并。刚量的 npm registry：

包	`latest`
`@objectstack/spec`	`17.4.0`
`@objectstack/cli`	`17.4.0`
`@objectstack/core`	`17.4.0`
`@objectstack/runtime`	`17.4.0`

两张上游阻塞卡 objectstack#18202 / #18204 都已关闭完成，但它们的修复是在 17.4.0 切版之后才落到 main 的，四条线都没有 > 17.4.0 的版本。本仓 package.json 也仍钉在 17.4.0。

⇒ 维持 pm:blocked。RC 切版是维护者的动作（objectstack#18215），⛔ PM 不整席等它。

二、⚠️ 恢复本卡前先看 objectstack#18203

本卡落地计划第 3 条要把五个服务导航节点改成模块的 navigationContributions。而 objectstack#18203 记录：translation-target-unknown 这条 lint 规则只读 apps[].navigation，读不到贡献进来的节点。

⇒ 本卡一落地，5 个节点 × 4 个语言 = 至多 20 条误报，且每条的建议都是删掉一条运行时确实认的翻译。

今天不疼（grep -rn "navigationContributions" src/ objectstack.config.ts 命中 0），本卡落地才疼。

PM 已把 #18203 从「零标签、无人可见」补成 pm:queue · domain:spec · priority:p2，并在那边记了这条下游读数。它有一个自然的时间窗：在下一次发版之前修完就永远不会咬到人，而本卡正好在等那次发版 —— 两件事时间上是对齐的，不需要谁等谁。

Generated by Claude Code

Claim: PM loop round R74
Session: session_012zh91QzFgePbkmuHnugLN3
Account: os-zhuang (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-1907-app-and-service-packages
Worktree: hotcrm-issue-1907
Domain: repo:hotcrm (single-lane repo, no domain:* taxonomy)
Seat: repo:hotcrm#1
File surface: src/sales/index.ts (new), src/service/index.ts (new), objectstack.config.ts, objectstack.composition.ts, src/sales/apps/crm.app.ts (the five service navigation nodes leave), src/sales/interfaces/index.ts (keep-or-drop, with .github/labeler.yml if dropped), the test/** suites that read the composed stack, the navigation or the docs trees (saas-composition, i18n-references, docs-quick-tour-navigation, docs-setup-navigation-names, docs-analytics-vocabulary, docs-service-index-analytics, docs-src-tree-paths and the like), AGENTS.md, docs/README.md, docs/ARCHITECTURE.md, docs/STATUS.md, content/docs/getting-started/**, one .changeset/1907-*.md (stop on breach; explain in the report)
Container & model: L, mode:subagent (the os-dev definition and the scripts/pm write tools live in this container's objectstack checkout, and the browser walk needs this container's Chromium; a hotcrm-only cloud session carries none of them), model: default (dispatch-gates --tier --repo objectstack-ai/hotcrm answers "no path-derived mandate … the tier stays the PM's per-card judgment call")
Clause-②: no
Responsibility: n/a — not a defect card
Thread-read: 6051385946
Serial constraints cleared: no open PR in the repo. hotcrm#2000 is pm:blocked on objectstack#22178, and its branch c8f331cf also edits objectstack.composition.ts / objectstack.config.ts (picklist registration). Whichever lands second merges main, and in practice that is #2000, which waits on a platform release. #1595 and #1919 stay queued, not dispatched. The old branch claude/issue-1907-sales-app-service-module (be11c07, 50 commits behind) is a reference only, ⛔ not reused. Governed (AGENTS.md): the PR stays draft with ## 维护者速读(草稿), and the maintainer merges it. Ruling-ref: 6051385946 (re-read this act).

Generated by Claude Code

docs(agents): src/docs note states the per-package docs rule; changes…

os-dev-report

{
  "issue": 1907,
  "status": "blocked",
  "branch": "claude/issue-1907-app-and-service-packages",
  "pr": "https://github.com/objectstack-ai/hotcrm/pull/2011",
  "session": "session_012zh91QzFgePbkmuHnugLN3 — the dispatching seat session (subagent run)",
  "premise_still_valid": true,
  "summary": "Packaging step 2 is built on main c529de2b (17.7.0) and delivered as draft PR #2011 (governed, maintainer merges); final head f294875d, pnpm verify green on it. src/service/index.ts is app.objectstack.hotcrm.service (type module, dependencies on the app, own requires, three navigationContributions carrying nav_case/nav_knowledge/nav_service_dashboard/nav_my_cases/nav_report_sla); src/sales/index.ts is the app-package factory whose permission sets stay whole and grant on service objects through DefineStackOptions.artifactObjects; objectstack.composition.ts builds both stacks (and now holds the HOTCRM_COMPOSITION knob); objectstack.config.ts is composeStacks([serviceStack, appStack], { manifest: preserve }). BLOCKED ON ONE READING ONLY: acceptance 2 says no ownership diagnostic at boot, and a boot logs one [MetadataPlugin] WARN that the 4 flat src/docs pages sit at the artifact top level claimed by no package body. os build puts flat src/docs there by its own rule, the reported owner is the app package (same as main), all docs are served, and no directory in the ruled layout can carry them into the app body (a per-package docs dir must be named after the package id or its last segment, hotcrm; measured src/sales/docs -> docs/uncollected-directory, src/service/docs -> collected onto the service body). Only the PM (file upstream) and the maintainer (accept the WARN or wait) can resolve it; nothing in hotcrm needs to change when the platform fixes it. Everything else measured green: packages[] = [service module 3 objects, app 15 objects], artifact top-level keys manifest/packages/i18n/docs only (assumption 2: the 2026-09-22 addendum strips the flattened copy, so suites read test/helpers/composed-stack.ts = platform composeStacks without preserve over the same two stacks, and test/package-ownership.test.ts holds that view equal to the bodies); GET /api/v1/packages lists both writable:false; 0 nav_contribution_group_missing; browser walk equal to main on every reading but the accepted nav_my_cases move (last in My Work). Assumption readings: (1) holds but ONLY via artifactObjects, the #18202 fix is opt-in (artifactObjects: [] reproduces the 18 be11c07 refusals); the attendee_contacts action-param refusal is gone; no new refusal. (2) confirmed, acceptance 1 re-read in the PR body. (3) lint --strict 0 warnings. (4) seeds by owning package kept (now the only reason, since artifactObjects also widens data[]: the platform accepts a misfiled family and the new ownership pin catches it); requires per stack required (3 trigger refusals without); factories kept; src/sales/interfaces/index.ts KEPT (header-only, imported by nothing; dropping it touches content/docs/customization/index*.mdx x3 and module-split-inventory.json, outside the file surface). (5) AGENTS.md:44 rewritten true for sales + service, revenue/marketing named as app-package directories. FILES CHANGED (121, +1338/-527 vs c529de2b): new src/sales/index.ts, src/service/index.ts, test/helpers/composed-stack.ts, test/package-ownership.test.ts, .changeset/1907-sales-app-service-module.md (patch); modified objectstack.config.ts, objectstack.composition.ts, src/sales/apps/crm.app.ts, AGENTS.md, docs/README.md, docs/ARCHITECTURE.md, docs/STATUS.md, content/docs/getting-started/for-developers{,.zh-Hans,.zh-Hant}.mdx, content/docs/getting-started/quick-tour{,.zh-Hans,.zh-Hant}.mdx (My Cases moved last), test/helpers/metadata-fixtures.ts, test/helpers/flow-harness.ts, and 101 existing test files: 81 one-line import rewires to the composed view; 12 suites taught (action-references, i18n-references, view-references, authorization-coverage, docs-quick-tour-navigation, docs-setup-navigation-names, docs-analytics-vocabulary, docs-service-index-analytics, docs-declared-versions, saas-composition, registration-list-completeness, flow-registration-completeness); 8 kernel suites split into the real artifact for AppPlugin plus the composed view for reads (case-creation-date, case-guest-branch-leftovers, contract-write-depth, freeze-guard-reference-cleanup, guest-submission-sanitisation, hierarchy-read-depth, parent-derived-reach, unassigned-case-triage-reach). DEVIATIONS: (a) role-file rule (fix text this change makes false) vs the claim surface (stop on breach): stale objectstack.config.ts mentions outside the surface were listed in the PR Acceptance notes, not edited (RELEASE_STRATEGY.md:30,50, CONTRIBUTING.md:180, MAINTENANCE.md, DEPLOYMENT.md, code_examples.md, feature-inventory.md, README.md:137, .github/tasks/new-package.md, scripts/wow1-live-schema.sh, content/docs fork-hotcrm/integrations/ai-skills/extending-objects in 3 locales) — PM call: rework round with an amended surface, or a follow-up docs card. (b) PR body is stale on two points the seat may correct: the Gates heading cites 4e3d9410 (final head f294875d, verify re-run green there) and item 7 does not mention the AGENTS.md sentence added in f294875d (the docs residual WARN is not an instruction to move src/docs). (c) The walk ran on 9b3b6571; later commits change comments, tests and AGENTS.md only (no non-comment line in src/ or the two root files). (d) Boots used objectstack dev --fresh --seed-admin --no-watch --compile on ports 4870/4880 rather than pnpm dev (pinned to 4001); --compile guarantees from-source. (e) The harness attribution reminder named a model for commit trailers; commits carry the model-free pair instead. (f) A detached comparison worktree /home/user/hotcrm-main-1907 was created for the main boot and removed with the issue worktree.",
  "tests": "All on head f294875d unless noted. `pnpm verify` via os-verify-lock (slot hotcrm-1907): VERDICT command-exit 0 · held 208s; inside it: objectstack validate \"✓ Validation passed\"; tsc --noEmit 0 errors; objectstack lint --strict \"18 suggestion(s)\", 0 errors, 0 warnings; lint:i18n-gate \"✓ i18n lint gate: 0 i18n/missing-* issues\"; hygiene \"✓ source hygiene clean\"; hygiene:tokens \"✓ source token ratchet clean\" (src/sales business 56,388 unchanged, interaction 28,136 -> 27,966, total 100,067 -> 100,165; src/service total 20,478 -> 21,493, headroom 507; no ceiling moved); build \"✓ Build complete\"; vitest \"Test Files 179 passed (179) / Tests 3829 passed | 1 skipped (3830)\". Browser walk (head 9b3b6571 port 4870 vs main c529de2b port 4880, both objectstack dev --fresh --seed-admin --compile, Chromium /opt/pw-browsers/chromium): packages API head 2 rows writable:false (app 15 objects, module 3) vs main 1 row 18; served nav 33 = 33, same set, only diff nav_my_cases 4th -> last in My Work; 17 list row counts identical; case/knowledge/account/opportunity record tabs identical; 5 dashboards Recharts marks/charts identical (13/4, 21/5, 12/4, 14/4, 17/4); approvals inbox mounts both; docs API 5 = 5; pageErrors 0/0; failed /api/ 0/0; boot WARN lines 22 vs 23 (the +1 is the docs residual). Ablations via objectstack scripts/ablation-replace.mjs (anchor hit, blob changed, restored blob == HEAD, git diff HEAD empty, each from a committed state): (1) config order [appStack, serviceStack] -> package-ownership 2 failed | 22 passed, predicted red; (2) contributions app crm_nowhere (x3) -> 19 failed in 6 files (action-references 2, docs-analytics-vocabulary 4, docs-quick-tour-navigation 10, docs-service-index-analytics 1, docs-setup-navigation-names 2, i18n-references 1), view-references/authorization-coverage green as predicted; (3) ServiceSeedData=[cases] -> pnpm validate exit 0 (platform accepts), package-ownership + saas-composition 2 failed. Probes (restored the same way): artifactObjects: [] -> validate exit 1 \"defineStack cross-reference validation failed (18 issues)\"; crm_ghost in artifactObjects + a guest_portal grant on it -> exit 1 \"composeStacks artifact cross-reference validation failed (1 issue)\"; service requires line deleted -> exit 1, 3 trigger-capability refusals; requires + ai in the service module -> validate exit 0 / build exit 0, control (ai in main single-package requires) -> validate exit 1 / build exit 1 \"Capability provider check failed\"; src/service/docs probe collected onto the service body, src/sales/docs probe -> docs/uncollected-directory.",
  "mcp_calls": "0 — no MCP GitHub tool called (issue, comments and PR read through gh api REST reads).",
  "api_writes": "3 relayed REST writes as objectstack-fleet[bot]: (1) with-fleet.sh --via dispatch pr_create -> POST /repos/objectstack-ai/hotcrm/pulls (draft #2011, read-back 19787 bytes identical); (2) label-write.mjs --assign os-zhuang -> POST /repos/objectstack-ai/hotcrm/issues/2011/assignees (read-back matches; labels left as labeler set them); (3) post-stamped.mjs --comment=1907 -> POST /repos/objectstack-ai/hotcrm/issues/1907/comments (this report). Each relay write is one repository_dispatch to objectstack-ai/objectstack. Plus 5 git pushes on claude/issue-1907-app-and-service-packages (the empty write-route probe, f077b985, 9b3b6571, 4e3d9410, f294875d).",
  "open_questions": [
    {
      "question": "Acceptance 2 (no ownership diagnostic at boot) is not met by one platform WARN about the four flat src/docs pages. Does it hold the merge of #2011?",
      "options": [
        "A — Keep #2011 draft and wait for the platform fix (AGENTS.md chapter 2 default). Cost: packaging waits on a release again; hotcrm needs no change when the fix lands.",
        "B — Accept the WARN and let the maintainer merge: behaviour equals main (owner app.objectstack.hotcrm, all docs served), the walk is identical, and AGENTS.md now tells agents not to act on the WARN. Cost: one misleading WARN line per boot until the platform fix."
      ],
      "recommendation": "B, because nothing is routed around (no layout deviation, no tolerance code), the WARN changes no behaviour and no hotcrm file, and the AGENTS.md sentence closes the AI-trap it would otherwise be (an agent following its remedy would invent a src/hotcrm directory). File the gap upstream either way."
    }
  ],
  "out_of_scope_findings": [
    "class: b · reach: pnpm dev boot log, every boot of this artifact (the [MetadataPlugin] residual WARN quoted in PR #2011) · evidence: os build writes flat src/docs pages to the top-level docs[] of a multi-package artifact by its own rule (cli collect-docs: the flat directory docs keep attaching to the top level), and MetadataPlugin then warns that top-level items are claimed by no package body and tells the author to rebuild, which an app package whose directory is not named after its id cannot do · Seam: spec:docs (package-owned collection) → runtime:cli compile flat-docs collection + metadata MetadataPlugin residual registration · dedupe words: flat src/docs, top-level metadata item, package bodies, residual, ADR-0046, ADR-0130 D4",
    "class: b · reach: os validate and os build answer exit 0 where the single-package shape answers exit 1 — requires: [..., ai] in the service module passes both, the same token in main's config fails both with \"Capability provider check failed\"; also drops the hierarchy-security advisory · evidence: cli validate/compile call preflightRequiredCapabilities({ requires: config.requires }) on the artifact top level, which a multi-package preserve artifact no longer carries (requires is package-owned, inside packages[] bodies) — a reader the 2026-09-22 addendum program did not enumerate · Seam: spec:requires (package-owned) → runtime:cli commands/validate + commands/compile preflightRequiredCapabilities · dedupe words: preflightRequiredCapabilities, requires, packages[], missed reader, capability provider check",
    "carrier: the next packaging card (revenue/marketing) or a follow-up docs card · noted, not filed: module-split-plan item 6 / the card body premise that the platform reads package docs from src/docs only no longer holds for a module whose directory is its id's last segment (src/service/docs is collected onto the service body on 17.7.0); crm_service.md could live there once the app-side docs gap is solved upstream.",
    "carrier: 承接者:无 · noted, not filed: the walk's tbody-row probe reads 0 rows on the Contacts list page on BOTH main and head (9 contacts are seeded and claimed); not investigated, recorded only as a measurement caveat in the PR walk table."
  ]
}

Generated by Claude Code

Claim amendment (file surface) · claim 6052101923 · repo:hotcrm seat, session_012zh91QzFgePbkmuHnugLN3, 2026-10-08T05:27Z

Review of the os-dev report 6052979399 (PR #2011): REWORK, patch round 1, same claim and branch. One item: the published text that this change makes false has to be corrected in this PR. The dev's role file says so ("本轮改动令其变假或触碰的已发布缺陷必修"). The dev listed these files and correctly stopped at the claim's surface.

The surface grows by exactly this: every file in which a sentence asserts the PRE-#1907 shape as current. That is one defineStack in objectstack.config.ts, or the collections being handed to it as the registration path. On the PR head f294875d that includes:

content/docs/customization/extending-objects{,.zh-Hans,.zh-Hant}.mdx (~line 98: "what objectstack.config.ts hands to defineStack({ flows })");
the fork-hotcrm, integrations and ai-skills pages in their three locales;
README.md (~line 137: "manifest + defineStack() — single source of truth"), CONTRIBUTING.md, .github/tasks/new-package.md (~line 29: "the single defineStack()");
RELEASE_STRATEGY.md, MAINTENANCE.md, DEPLOYMENT.md, code_examples.md, feature-inventory.md, scripts/wow1-live-schema.sh.

Each hit is classified by hand. A dated record ("measured on X", requirement records, audits) stays, per AGENTS.md Platform Upgrades rule 5. Only a present-tense claim about the current shape is rewritten.

Not part of the rework: the boot WARN about the four flat src/docs pages (report open question 1). That is the maintainer's call at merge time, and the seat files it upstream. No hotcrm code changes for it.

Generated by Claude Code

docs(packaging): every sentence that still states the one-defineStack…

os-dev-report

{
  "issue": 1907,
  "status": "blocked",
  "branch": "claude/issue-1907-app-and-service-packages",
  "pr": "https://github.com/objectstack-ai/hotcrm/pull/2011",
  "session": "session_012zh91QzFgePbkmuHnugLN3 — the dispatching seat session (subagent run), rework patch round 1",
  "premise_still_valid": true,
  "summary": "REWORK PATCH ROUND 1 DONE: same claim, branch and PR. The worktree was re-created from f294875d. origin/main is still c529de2b (ls-remote), so nothing was merged. The new head is 5157d610, pushed, and pnpm verify is green on it. Deviation (a) is resolved under the amended surface. The hit list was re-taken version-agnostically on f294875d: objectstack.config, defineStack, composition.ts, the registration-list names, single/one defineStack, four packages in English and Chinese, and every export name the packaging removed (allDatasets etc.). Every hit was classified by hand. REWRITTEN, present-tense claims of the pre-#1907 shape, 57 files: (1) Product docs, three locales each: customization/extending-objects (hooks/flows register through appHooks/appFlows or serviceHooks/serviceFlows), customization/ai-skills (appSkills/serviceSkills), marketplace/fork-hotcrm (step 2 edits the two package manifests; step 4 drops the service stack), guides/integrations (no package lists webhooks; the hand-copied requires roster is removed per documentation discipline), analytics/cubes (allDatasets no longer exists), customization/index, administration/sandbox-and-releases, reference/security-and-compliance. (2) Maintainer docs: RELEASE_STRATEGY.md (the release unit carries two packages; the manifest versions to match by hand are in src/sales/index.ts and src/service/index.ts), CONTRIBUTING.md, MAINTENANCE.md, DEPLOYMENT.md, developers/code_examples.md, feature-inventory.md, README.md (badge link and tree), .github/tasks/new-package.md (step 4 now scaffolds a package stack like src/service/index.ts). (3) Tooling comments: scripts/wow1-live-schema.sh, scripts/lib/source-hygiene-surface.mjs. (4) Source comments only, no code line: src/*/data/index.ts, src/*/flows/index.ts, src/sales/objects/hooks.ts, src/sales/objects/index.ts, tenant-admin.profile.ts, plus activity.seed.ts and service.seed.ts. Those two seed modules said the root config replays the rows in lookup order, which is now false. That sentence is replaced by a NEW MEASUREMENT on a fresh boot of the branch: 38/38 seeded cases resolve crm_account, and 2/2 seeded events that name a case resolve related_to_case. (5) Test docblocks and failure messages that named the old registration path: flow-registration-completeness, registration-list-completeness, helpers/registration-lists, docs-metadata-counts, docs-role-hierarchy, docs-src-tree-paths, import-mappings, persona-copy, demo-staffing, e2e/opportunity-win-loss-capture.spec.ts. No assertion or floor changed. LEFT AS DATED RECORDS OR STILL TRUE: the audit notes in sandbox-and-releases and security-and-compliance (measured against spec 17.0.0-rc.6); _case-assignment.ts (measured against the shipped stack); docs-declared-versions #728 history; sharing-coverage table history; module-split-plan and psa-module-plan (recorded decisions); README.legacy.md, CHANGELOG, .changeset, docs/archive. Also left because still true: no server block, no auth block, registered by/through objectstack.config.ts (api-reference, cubes opening), demo-staff and demo-staffing never-imported/not-registered, the kernel suites booting the real artifact, the package.json/tsconfig/labeler entries, and the four layout packages. marketplace/manifest-and-versioning and publishing-your-first-app are generic single-package guidance (app.acme.crm), not HotCRM's shape. The docs-residual WARN is untouched as instructed: no layout move, no tolerance code. The status stays blocked only on that WARN (open question 1, the maintainer's call at merge; the seat files it upstream). Everything else in the card is done. CORRECTED PR BODY, for the seat to post: /tmp/claude-0/-home-user/ddab6cfd-cf50-59b8-bff8-60ca43226796/scratchpad/issue-1907/pr-body-round1.md (23852 bytes). Its changes: the Gates heading is 5157d610 with the new test counts; item 7 names the AGENTS.md sentence that the WARN is not an instruction to move src/docs; a new section, \"Round 1 — the pre-#1907 shape, swept\", lists every rewritten file vs every hit left as a dated record or still-true text; the stale-mentions acceptance note is removed; the seed lookup measurement is added; ## 维护者速读(草稿) is kept, its 风险与代价 updated, 席位意见 still empty. FILES CHANGED this round: the 57 files above, +225/-169, all docs, comments, test docblocks and messages; no non-comment line in src/ or the two root files since the walk commit 9b3b6571. The worktree was removed: node_modules first, then git worktree remove without --force. Deviations this round: none beyond the amended surface. The harness attribution reminder still names a model; commits keep the model-free trailer pair.",
  "tests": "Head 5157d610 (`git rev-parse --short HEAD` = 5157d610): `pnpm verify` via os-verify-lock (slot hotcrm-1907): VERDICT command-exit 0 · held 211s · waited 3s; inside it: objectstack validate \"✓ Validation passed\"; tsc --noEmit 0 errors; objectstack lint --strict \"18 suggestion(s)\", 0 errors, 0 warnings; lint:i18n-gate \"✓ i18n lint gate: 0 i18n/missing-* issues\"; hygiene \"✓ source hygiene clean\"; hygiene:tokens \"✓ source token ratchet clean\"; build \"✓ Build complete\"; vitest \"Test Files 179 passed (179) / Tests 3832 passed | 1 skipped (3833)\". Seed lookup probe (os-verify-lock VERDICT command-exit 0 · held 50s; fresh objectstack dev --fresh --seed-admin --compile boot of the branch, metadata identical to 5157d610, GET /api/v1/data/{crm_case,crm_event,crm_account}?top=500 as the seeded admin): cases 38, events 29, accounts 9; casesAccountResolved 38/38; eventsCaseResolved 2/2. Round-0 readings stand for the unchanged metadata: browser walk at 9b3b6571 identical to main except nav_my_cases; ablations 1-3 and the artifactObjects / requires / ai / docs-directory probes as reported in comment 6052979399. scripts/wow1-live-schema.sh: bash -n syntax ok.",
  "mcp_calls": "0 — no MCP GitHub tool called (issue comments read through gh api REST reads).",
  "api_writes": "This round: 1 relayed REST write as objectstack-fleet[bot] — post-stamped.mjs --comment=1907 -> POST /repos/objectstack-ai/hotcrm/issues/1907/comments (this report, via one repository_dispatch to objectstack-ai/objectstack) — plus 1 git push (f294875d..5157d610). No PR PATCH: the corrected body is the file named in summary, for the seat to post. Round 0 writes (pr_create #2011, label-write assign, report comment 6052979399, 5 pushes) unchanged.",
  "open_questions": [
    {
      "question": "Unchanged from round 0: acceptance 2 (no ownership diagnostic at boot) is not met by one platform WARN about the four flat src/docs pages. Does it hold the merge of #2011?",
      "options": [
        "A — Keep #2011 draft and wait for the platform fix (AGENTS.md chapter 2 default). Cost: packaging waits on a release again; hotcrm needs no change when the fix lands.",
        "B — Accept the WARN and let the maintainer merge: behaviour equals main (owner app.objectstack.hotcrm, all docs served), the walk is identical, and AGENTS.md tells agents not to act on the WARN. Cost: one misleading WARN line per boot until the platform fix."
      ],
      "recommendation": "B, because nothing is routed around, the WARN changes no behaviour and no hotcrm file, and the AGENTS.md sentence closes the AI-trap. The seat files the gap upstream either way."
    }
  ],
  "out_of_scope_findings": [
    "Unchanged from round 0 (comment 6052979399): class b — the flat src/docs residual WARN (os build top-level docs vs MetadataPlugin residual); class b — os validate/os build installable-provider preflight reads requires from the artifact top level only (a module requires: [..., ai] passes, the single-package control fails). Same evidence, seams and dedupe words as reported there.",
    "carrier: 承接者:无 · noted, not filed: the round-0 walk caveat (Contacts list tbody probe reads 0 on main and head) is unchanged; not investigated."
  ]
}

Generated by Claude Code

Verdict: os-dev reports 6052979399 (round 0) and 6053208554 (round 1), PR #2011 — ACCEPT, governed (Tier H): the PR stays draft for the maintainer. repo:hotcrm seat, session_012zh91QzFgePbkmuHnugLN3, 2026-10-08T05:55Z.

Checked on GitHub, not taken from the reports:

Head 5157d610, 172 files, +1563/−696. check-governed-merges --branch finds 1 governed path (AGENTS.md), which governs the whole PR; 2,259 changed lines, under 5000.
CI: 10 of 10 check runs completed success on the head (Build and Test (22.x), Typecheck and Build, Quality Checks, Playwright, Check Changeset, link-check, CodeQL ×2, Label, Vercel).
Contract review, at tier: PASS. Record 6053366434 on PR feat(packaging): one artifact, two packages — sales is the app package, service a module #2011 (Served-tier: CONTRACT_REVIEW_TIER, Head-sha: 5157d610…, Local-runs: none). It was rendered by an isolated reviewer that saw only the card, the PR and the check runs, and the seat adopted it verbatim.
Seat spot-checks on the head:
- objectstack.manifest.json is byte-unchanged, and objectstack.config.ts is a single composeStacks([serviceStack, appStack], { manifest: 'preserve' }).
- All six commits carry the model-free trailer pair.
- extending-objects.mdx now teaches the per-package registration lists.
- No present-tense "single defineStack" claim is left under content, README.md, CONTRIBUTING.md, .github or docs/*.md.
Round 1 (REWORK patch, surface amended in 6053009952): 57 files rewritten from the pre-Packaging: sales becomes the type: app package and service a type: module — composeStacks(…, { manifest: 'preserve' }), navigation contributions, two-entry packages[] #1907 shape, dated records left as they are. The PR body was replaced by the seat with the dev's corrected body, which now names the upstream cards.

Upstream, filed by the seat from this card's findings (this answers the review's precision flag, because AGENTS.md now points readers to "reported upstream from #1907"):

metadata: every boot of a multi-package artifact built by os build warns that its flat src/docs pages are "claimed by no package body" — the CLI puts them at the top level by its own rule, and the warning`s remedy cannot be followed objectstack#22190: the flat src/docs residual [MetadataPlugin] WARN on every boot.
cli: os validate / os build capability preflight reads only the artifact top-level requires — in a multi-package artifact requires is package-owned, so an unprovidable capability passes with exit 0 objectstack#22189: the os validate / os build capability preflight reads only the artifact top-level requires. Until it is fixed, a module's unprovidable capability passes those gates.

Non-blocking flags carried to the maintainer:

"Package" now has two senses in AGENTS.md (a layout directory and an artifact package), both defined.
Two older pending changesets (flows-register-in-allflows.md, guard-the-remaining-registration-lists.md) describe allFlows and will appear in the same release notes.
At release, the two manifest version fields and the module's dependencies range must be matched by hand; docs-declared-versions reds until they are.

Governed landing, four parts:

This record.
PR feat(packaging): one artifact, two packages — sales is the app package, service a module #2011 stays draft, labelled needs-user-decision, with the final 「维护者速读」 posted as a PR comment.
Review requested from os-zhuang and hotlong.
Listed in the round report as awaiting a human merge.

The one open decision is the maintainer's: whether the boot WARN holds the merge. On an authorized approval, the seat lands the PR through the merge queue; a direct merge by the maintainer is its own record. This card stays pm:dispatched until MERGED.

Implemented-by: os-dev subagent of this session (branch claude/issue-1907-app-and-service-packages) · Reviewed-by: repo:hotcrm seat (contract review: isolated at-tier reviewer, adopted)

Generated by Claude Code

Landing record: PR #2011 is approved, and the seat's landing write was refused by this session's auto-mode classifier. repo:hotcrm seat, session_012zh91QzFgePbkmuHnugLN3, 2026-10-08T06:46Z.

Approval on file: review 5452688749 by os-zhuang (in GOVERNED_APPROVERS), APPROVED on head 5157d610. The seat submitted no review; this is the maintainer's approval.
Pre-landing checks passed on that head:
- the contract review is a PASS (6053366434);
- 11 of 11 check runs are success;
- mergeable_state: clean;
- base main is unchanged at c529de2b.
The refused command was ONE shell act, and nothing in it ran. The PR still reads draft, auto_merge: null, and needs-user-decision is still on it. The act would have done two things:
1. removed needs-user-decision (scripts/pm/label-write.mjs --repo objectstack-ai/hotcrm --issue 2011 --remove needs-user-decision);
2. sent the relay actions pr_ready and automerge_enable for pull 2011 (scripts/pm/fleet-write/dispatch.mjs --repo objectstack-ai/hotcrm --actions-file …).
Refusal reason, verbatim: "Permission for this action was denied by the Claude Code auto mode classifier. Reason: [Merge Without Review]."
Per the landing rules, the seat stops here. It does not re-spell the command or route around the refusal. The maintainer chooses: merge PR feat(packaging): one artifact, two packages — sales is the app package, service a module #2011 by hand (it is approved), or grant the seat this landing action in the session's permissions and the seat lands it through the merge queue.

Generated by Claude Code

Landed: PR #2011 MERGED as b54380cf on main (squash, a single parent), through the merge queue (added_to_merge_queue 06:58:55Z → merged 06:59:13Z). The maintainer made it ready and queued it by hand after approving (review 5452688749); that direct act is its own record and supersedes the seat's refused landing write above. repo:hotcrm seat, session_012zh91QzFgePbkmuHnugLN3, 2026-10-08T06:59Z.

Two readings:

the PR object reads merged: true;
origin/main is b54380cf feat(packaging): one artifact, two packages ….

Closed as it should be: Fixes #1907 closed this card. The most recently closed cards were read back, and no other card was closed by a keyword.

This act: removes pm:dispatched and the assignee here, and needs-user-decision from PR #2011.

Follow-ups now unblocked, in order:

Release follow-up: at the next release, both package manifests' version fields and the module's dependencies range must be matched by hand.

Generated by Claude Code

revert(release): undo the 3.2.0 cut, keeping the changeset text edits

Navigation Menu

Repository navigation

Packaging: sales becomes the `type: app` package and service a `type: module` — `composeStacks(…, { manifest: 'preserve' })`, navigation contributions, two-entry `packages[]` #1907

Status (2026-09-14T15:05Z, epic PM)

Ruling (verbatim, untranslated)

The tree as #1910 left it (premises — verify on `origin/main` before acting)

What this PR does

Acceptance

Out of scope

Blocker re-reading (2026-09-14T16:40Z, epic PM)

✅ 上游代码门禁已全部清零（2026-09-15）

一、解锁判据仍未触发

二、⚠️ 恢复本卡前先看 objectstack#18203

2 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Packaging: sales becomes the type: app package and service a type: module — composeStacks(…, { manifest: 'preserve' }), navigation contributions, two-entry packages[] #1907

Description

Status (2026-09-14T15:05Z, epic PM)

Ruling (verbatim, untranslated)

The tree as #1910 left it (premises — verify on origin/main before acting)

What this PR does

Acceptance

Out of scope

Blocker re-reading (2026-09-14T16:40Z, epic PM)

✅ 上游代码门禁已全部清零（2026-09-15）

Activity

os-elon-musk commented on Sep 14, 2026

os-elon-musk commented on Sep 14, 2026

os-elon-musk commented on Sep 14, 2026

os-elon-musk commented on Sep 15, 2026

一、解锁判据仍未触发

二、⚠️ 恢复本卡前先看 objectstack#18203

2 remaining items

objectstack-fleet commented on Oct 8, 2026

objectstack-fleet commented on Oct 8, 2026

objectstack-fleet commented on Oct 8, 2026

objectstack-fleet commented on Oct 8, 2026

objectstack-fleet commented on Oct 8, 2026

objectstack-fleet commented on Oct 8, 2026

objectstack-fleet commented on Oct 8, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Packaging: sales becomes the `type: app` package and service a `type: module` — `composeStacks(…, { manifest: 'preserve' })`, navigation contributions, two-entry `packages[]` #1907

The tree as #1910 left it (premises — verify on `origin/main` before acting)