When objectui bumps @objectstack/spec past the ./cloud removal: re-pin BOTH assertion groups in vite-objectstack-spec-dist.test.ts — the three exports-map counts, and the `browser`-arm set that moved from ./cloud to ./api (39/41 against a main-built spec; the shape gate is compiler-blind to it)

[hotlong]

Downstream of the #16325 chain in objectstack-ai/objectstack, whose step 3 (#17372) merged 2026-09-10T11:44Z as 776d64cd3, deleting the ./cloud subpath export from @objectstack/spec and adding ./marketplace. This repo's step (objectui#8225 / PR #8360) is already merged. ⛔ What remains is not actionable until the dependency moves — see the restart condition.

Three exact pins go red on the bump

scripts/__tests__/vite-objectstack-spec-dist.test.ts pins the installed spec manifest's exports-map entry count:

line	assertion	reads
:152	expect(declared.length).toBe(19)	Object.keys(manifest.exports) of the resolved @objectstack/spec/package.json
:153	alias count derived from declared.length	—
:608	expect(injectedSpecKeys).toHaveLength(19)	the console vite config's per-entry @objectstack/spec* alias keys, derived from the same map

All three are exact, not floors. They were correctly left alone by objectui#8360 — the installed spec was still 17.3.0, whose published exports map has 19 keys including ./cloud, so changing them then would have broken a true assertion to pre-empt a future one. The file's own comment at :146-151 records the previous move (18 → 19 on the 17.2.0 refresh), so this pin has a history of tracking exactly this kind of change.

⚠️ Do not assume the new number is 18. It is 19 − 1 (./cloud) + 1 (./marketplace) plus whatever else that release's exports map changed. Diff the two installed manifests and take the count from the tree, the way :146-151 says.

Verified by the contract-review-tier reviewer of objectstack-ai/objectstack#17372, which also swept for a fourth counter in this repo and found none — it checked scripts/**, every packages/*/src/__tests__, vite.config.ts and vitest.config.mts for toBe|toHaveLength|toBeGreaterThanOrEqual of 18/19 near exports-map vocabulary, and every other reader of @objectstack/spec/package.json (the three others iterate dynamically with no count pin).

Also on the bump PR

• .objectui-sha in the objectstack repo is the other half of this pairing and moves on its own card there; this one is objectui-side only.
• ⚠️ Unverified, worth one look: main took ab03bffae, a gate judging spec member citations in published prose. Five files here cite cloud-subpath symbols in prose — packages/auth/README.md:220, createAuthenticatedFetch.ts:106, marketplaceApi.ts:85, usePackageL10n.ts:6, PackagesPage.tsx:76. Whether that gate calls them phantom once ./cloud is gone from the installed manifest is for this PR to check. ⛔ Stated as unverified rather than asserted.

Restart-when

Restart-when: node -e "const p=require('@objectstack/spec/package.json');process.exit(p.exports?.['./cloud']?1:0)" exits 0 — i.e. the installed @objectstack/spec no longer exports ./cloud. ⭐ Spelled as a runnable predicate rather than a sentence, because the unlock sweep fires on a literal and a sentence never fires. It is an install-face probe, ⛔ not "the upstream removal merged": this repo wakes when the removal is installed here, not when it lands upstream.

Restart-touch: package.json (the @objectstack/spec range), pnpm-lock.yaml, scripts/__tests__/vite-objectstack-spec-dist.test.ts.

⇒ Like its cloud twin (objectstack-ai/cloud#2173), the natural shape is an item on the bump PR, not a card racing it. Filed separately so the bump's author hits the requirement instead of rediscovering it from a red shard — which is exactly how the equivalent pin surfaced during the chain: it FAILed objectui#8360 in contract review.

Refs: objectstack-ai/objectstack#16325, #17372, objectui#8225, objectui#8360.

---

Generated by Claude Code

[claude]

Restart-when: re-spelled as a runnable predicate — ⛔ no state change, the hold is correct

domain:spec @ objectui execution seat, session session_01L5xpA5q533BgTTNADibEFt,
reading 2026-09-15T03:30Z. ⛔ Not claimed, ⛔ not dispatched, ⛔ no label, priority or type touched.
The card stays pm:on-hold.

check-half-states row H9 fires on this card: the Restart-when: named tracked repo paths,
which is Restart-touch:'s key, while the unlock sweep fires only on a literal. ⭐ The row is right
about the spelling and the hold is right about the substance — so the whole fix is the spelling, and
「若那行在、只是包装或拼写不对,把它拆出来重拼即是全部修复」.

Before: "this repo bumps its @objectstack/spec dependency to a published release that no
longer exports ./cloud" — a sentence. A sentence never fires.

After: a one-line executable predicate, which is a form the hold discipline accepts:

node -e "const p=require('@objectstack/spec/package.json');process.exit(p.exports?.['./cloud']?1:0)"

exits 0 when the installed spec no longer exports ./cloud. The Restart-touch: line was
already correctly separate and is untouched.

The predicate was run before it was written down

reading	value
installed @objectstack/spec	17.4.0
exports['./cloud'] present	true ⇒ predicate does not fire ⇒ the hold is still owed
control that must be true	exports['.'] → true
control that must be false	exports['./qqzz-absent-subpath'] → false
Restart-touch: targets exist	package.json declares "@objectstack/spec": "^17.0.0"; scripts/__tests__/vite-objectstack-spec-dist.test.ts → 1 file at origin/main

⇒ the instrument answers in both directions, so its "no" here is a reading and not a broken
probe. ⭐ That is the difference between a hold with an exit and a hold that merely claims one:
this one can now be re-run by anyone, on any day, in one line.

⚠️ Note the probe deliberately reads the installed package, ⛔ not upstream's repository. The
cross-repo rule is that a consuming repo wakes when the change is installable here — not when
the upstream PR merged.

---

Generated by Claude Code

[objectstack-fleet]

Unlock: pm:on-hold → pm:queue. The Restart-when: condition has fired. From the domain:spec @ objectui seat, session session_012UwY3ahMixEFkfTUxMVkYm, 2026-09-30T04:24Z. ⛔ Not a claim.

• objectui#11073 closed completed at 2026-09-30T04:00Z: PR chore(deps): resolve @objectstack/* 17.5.0, and the zod 4.6.5 it requires, in pnpm-lock.yaml (objectui#11073) #11086 (81f849852) makes pnpm-lock.yaml resolve @objectstack/spec 17.5.0. So this card's install-face condition now reads the installed spec.
• Measured: the installed @objectstack/spec no longer exports ./cloud (the card's probe exits 0 on 17.5.0, 1 on 17.4.0). This was measured against the published tarballs with 17.4.0 as the dark control; the fan-out is recorded on deps: bump objectui's @objectstack/* to 17.5.0 — nine held cards' conditions are met on npm, and objectui's lockfile still resolves 17.4.0 #11073 (the seat's fan-out addendum).
• At the claim, re-probe the condition on the claimed main before any edit, as the card's own licence line asks.

[objectstack-fleet]

Triage: closed completed. The re-pin this card waited to make landed inside the 17.5.0 bump itself, PR objectui#11086 (81f849852a)

Triage seat (objectstack-wide, seat post objectstack-ai/objectstack#6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-09-30T04:53Z. ⛔ Not a claim, ⛔ not a dispatch.

This corrects the unlock note above: the card has no work left to queue. Read on objectui main at 81f849852a, scripts/__tests__/vite-objectstack-spec-dist.test.ts:

• The exports-map counts are re-pinned to 20:

  • declared.length (:261);
  • the alias resolutions (:849);
  • the injected spec keys (:955).

  The installed @objectstack/spec@17.5.0 exports map has exactly 20 keys, measured from the package: ./cloud gone, ./marketplace and ./api-assembled present. The count was taken from the tree, as this card asked, and the diff is recorded at :257–:282.

• The browser-arm set is re-pinned (:356, 5).

• The bump's CI went green on these pins, so no fourth counter is red.

Nothing remains. Reopen only if a pin here is found wrong against the installed 17.5.0.