`packages/console/package.json`'s npm `description` still names the fabricated `@objectstack/framework`

[os-zhuang]

Found while fixing #10921, which measured @objectstack/framework as 404 on the public npm registry and as fabricated: unlike @objectstack/security-enterprise and @objectstack/organizations (real, deliberately private), nothing in this tree describes @objectstack/framework as enterprise, cloud, or closed-source — it is presented as the default public install, and no such package exists.

#10921's PR removes the name from packages/console/README.md and packages/cli/src/utils/console.ts. One site is left, and it was outside that card's declared file surface:

packages/console/package.json:4
 "description": "Prebuilt Console SPA pinned to this @objectstack/framework release. Source of truth: @object-ui/console (…)",

This one is arguably the most visible of the three: a package description is what renders on the npm package page for @objectstack/console, so every visitor reads a fabricated package name.

The correction is the same one the README took: the mechanism is real but misnamed — @objectstack/cli declares @objectstack/console as a dependency and both ship at one version from the Changesets fixed group. Something like:

"description": "Prebuilt Console SPA pinned to this framework release, installed as a dependency of @objectstack/cli. Source of truth: @object-ui/console (…)"

Deliberately not folded into #10921's PR: packages/console/package.json is not in that card's declared surface, and editing a published manifest widens the gate surface (check:published-files) beyond what that card measured. It is a one-line change for whoever picks it up.

Refs: #10921 and its PR.

[os-zhuang]

Triage: one-line correction to a published manifest's description (packages/console/package.json:4) ⇒ domain:devx (documentation/text quality, same lane as parent card #10921), type Task, → pm:queue.

The replacement text on the card is already evidence-pinned by #10921's measurement (@objectstack/framework is 404/fabricated; the real mechanism is @objectstack/cli depending on @objectstack/console at a fixed version). Deliberately kept out of #10921's PR because editing a published manifest widens the check:published-files gate surface — whoever takes this runs that gate as the acceptance check.

Serial note: #10921 in-flight touches packages/console/README.md, not package.json — surfaces disjoint; still same package, so land after #10921 to keep the npm-page prose consistent in one release. Fold note (five-gate check): same defect family as #11262 (stale console-resolution prose, same package, both S doc-only, both already ruled by #10921's evidence) — foldable into one dispatch by the devx seat except #11262 is graded domain:cli; fold only if one seat takes both halves via the cross-lane simple-blocker path, otherwise serialize behind #10921 independently. Size/model suggestion: XS, sonnet.

---

Generated by Claude Code

[os-steve]

Claim: devx@objectstack PM seat (#6023), session session_015ahemw8RcTgqtxrj15PEZx, round R6.
Branch: claude/issue-11261-console-description-framework
Model tier: opus — derived live: node scripts/pm/dispatch-gates.mjs --tier packages/console/package.json prints "no path-derived mandate". Clause ② judged from content and not reached: a description string is not public API and widens no surface.

This is a one-line change. It is dispatched at opus anyway because the edit is trivial and the judgment around it is not — see Zone 2.

Zone 1 — rulings (binding)

1. Fix the description in packages/console/package.json and nothing else. [finding] Four @objectstack/ packages this repo does not build are named in published docs with no declared roster — including one the CLI tells users to pnpm add #10921 already removed the other two sites; this is the third and last.
2. The correction must not invent a different fiction. The mechanism is real and only the name is wrong: @objectstack/cli declares @objectstack/console as a dependency, and both ship at one version from the Changesets fixed group. Say the true thing; the card's suggested wording is a starting point, not a mandate.
3. ⛔ Do not re-open [finding] Four @objectstack/ packages this repo does not build are named in published docs with no declared roster — including one the CLI tells users to pnpm add #10921's two sites. They are landed.

Zone 2 — mechanism assumptions to falsify before you rely on them

• ⚠️ This is a PUBLISHED manifest, which is why the card deliberately did not fold it into [finding] Four @objectstack/ packages this repo does not build are named in published docs with no declared roster — including one the CLI tells users to pnpm add #10921. Two things follow, and both need deciding rather than assuming:
  • check:published-files — the card names this as the reason the edit was left out. Run it and read its verdict line; do not assume a description is outside its interest.
  • A changeset is probably REQUIRED here, unlike most of this lane's recent work. The npm description is what renders on the package page, so this diff does change a published artifact — which is exactly the test skip-changeset fails. ⛔ Do not reach for skip-changeset by habit; decide it on the rule and state which way you decided and why.
• Verify the fabricated name is really absent everywhere else before claiming this closes the class. @objectstack/framework was measured 404 on npm; a repo-wide grep with a positive control tells you whether [finding] Four @objectstack/ packages this repo does not build are named in published docs with no declared roster — including one the CLI tells users to pnpm add #10921 plus this really leaves zero sites, or whether a fourth exists. If a fourth exists, report it — do not silently widen this PR to cover it.
• Check what @objectstack/console's description is supposed to say about @object-ui/console. The existing string names it as the source of truth; keep that half accurate rather than rewriting the whole sentence around the one broken word.

Zone 3 — suggested routes (not binding)

• [finding] Four @objectstack/ packages this repo does not build are named in published docs with no declared roster — including one the CLI tells users to pnpm add #10921's README wording is the precedent for how this repo phrases the same relationship; matching it is cheaper and more consistent than composing new prose.
• If the changeset decision is genuinely ambiguous, a patch-level changeset is the cheap safe side — a needless changeset costs one file, a missing one costs a silent publish.

---

Generated by Claude Code

[os-steve]

{
 "issue": 11261,
 "status": "done",
 "branch": "claude/issue-11261-console-description-framework",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/11505",
 "premise_still_valid": true,
 "summary": "packages/console/package.json:4 now reads 'Prebuilt Console SPA pinned to this framework release, installed as a dependency of @objectstack/cli. Source of truth: @object-ui/console (...)' — the @objectstack/ scope that turned the true common noun 'framework release' into a fabricated package name is dropped, and the real mechanism is named instead. Both halves of that mechanism were re-verified against origin/main before writing: packages/cli/package.json declares '@objectstack/console': 'workspace:*', and .changeset/config.json's fixed group lists both packages. The @object-ui/console source-of-truth half was accurate and is untouched. Positive control run: git grep over origin/main for @objectstack/framework, widened to case-insensitive objectstack[/-]framework, returns three non-CHANGELOG hits — this manifest (fixed here) plus two legitimate-by-construction mentions (the earlier pass's own changeset, which names the package in order to record that it is fabricated, and a header comment in scripts/check-published-readme-exports.mjs:857 enumerating out-of-repo @objectstack/ names measured under the wider fence). Nine CHANGELOG.md hits are immutable generated release history. No fourth live site exists, so the PR was not widened. CHANGESET DECISION: REQUIRED, decided on the rule — scripts/pr-labels.mjs states the exemption's own test, 'skip-changeset is the exemption for a PR that publishes nothing'; the manifest description is packed into the npm tarball and is what renders on the package page, so this diff publishes something and fails that test. A patch changeset for @objectstack/console was added and NO skip-changeset label was applied.",
 "tests": "Gate set derived, not recalled: `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack` (no paths passed; script took its own change set from the merge base). Derived 15 families; re-derived after the commit and the set was identical. All 15 plus check:nul-bytes run at head `c7d37014` (`git rev-parse --short HEAD` from that run), all green, exit codes captured by redirect-then-capture (never through a pipe). The card's named acceptance check, quoting its own verdict lines: '✓ check:published-files --self-test — 21 pattern case(s), 12 classification case(s) and 4 population-declaration case(s) over 11 live workspace glob(s).' and '✓ check:published-files — 69 publishable package(s) of 78 workspace member(s) declare a `files` whitelist that covers every entry point plus CHANGELOG.md and admits no test, test-harness config or build script; 1 publish more than dist/ + README.md + CHANGELOG.md, each with a registered reason.' Zone 2's warning not to assume a description is outside that gate's interest was tested rather than assumed: the gate was run, and its five invariants (DECLARED/COMPLETE/SUFFICIENT/MINIMAL/REGISTERED) are all about the `files` whitelist, so a description edit moves none of them. Other verdict lines: '✓ .changeset/config.json \"fixed\" group is in sync with 69 public workspace packages.' · '✓ This diff introduces no `major` bump.' · '✓ No empty-frontmatter changeset introduced by this diff (0 declaring changeset(s) added).' · '✓ check-adr-0087-registration: this PR adds no declared-breaking changeset (0 non-breaking changeset(s) seen).' · '✓ 8 published-manifest declaration(s) covered by pnpm-workspace.yaml overrides all resolve to their override targets.' · '✓ slot-lookup ratchet holds: 107 unswept site(s) in 25 file(s), none new.' · '✓ check:plugin-teardown-shape: 63 Plugin implementation(s) across 4564 source(s) under packages/**; 0 known-unreached, baseline fully burned down.' · 'check-nul-bytes: OK (scanned 6456 text file(s); no raw ASCII control bytes).' NOTE on a false red worth recording: four gates (override-consistency, slot-lookup, ci-filter-parity, plugin-teardown-shape) first exited 1 with ERR_MODULE_NOT_FOUND for semver/eslint/yaml/typescript — the fresh worktree had no node_modules, not a defect in the diff. `pnpm install --prefer-offline` under `scripts/pm/os-verify-lock.sh` (VERDICT command-exit 0, held 6s, waited 0s) then turned all four green. (`--workspace-concurrency` is rejected by pnpm 10.31 on `install`; dropped.) NO pnpm test / typecheck for the affected package: packages/console declares neither script — it is a prebuilt-dist package whose only script is prepublishOnly, and the diff contains no code. DECLARED NARROWING of `pnpm lint`, with all three required pieces of evidence: (1) population read from eslint's own config, not guessed — `npx eslint --no-inline-config --format json` on both changed paths returns 'File ignored because no matching configuration was supplied.' for each; (2) counts from that --format json output: errorCount 0 on both; (3) invariance for untouched files — eslint.config.mjs never enables type-aware linting for ANY file (no parserOptions.project, no typed rules; the config documents this at line 328, where it was measured with a positive control), and every files glob is restricted to {ts,tsx,mts,cts,js,jsx,mjs,cjs} while this diff touches one .json and one .md. The diff's intersection with eslint's population is empty, so this is a measurement, not a skipped run. No ablation was applicable (no code, no guard, nothing to mutate). Closing-keyword scan run over both the commit message and the PR body before pushing: exactly one match, the intended 'Fixes #11261' in the PR body; the commit message carries no card-relation trailer (squash discipline). Control-byte self-scan clean on both changed files and both prose artifacts.",
 "open_questions": [],
 "out_of_scope_findings": []
}

Notes for the PM, outside the JSON:

• Draft PR is open at fix(console): npm description no longer names the fabricated @objectstack/framework (#11261) #11505 (draft: true, 2 files, +34/-1, head c7d37014). Per the dispatch contract the report is delivered at draft-PR time; CI convergence is the PM's to read. No gate was polled or waited on.
• No skip-changeset label was applied, deliberately — that is the decision, not an omission. If a later reviewer disagrees, the argument to overturn is that a manifest description does not reach npm, which the tarball contents contradict.
• Serial constraint confirmed satisfied: the earlier pass landed 2026-08-23, and its two sites are present on origin/main in corrected form — re-checked, not assumed.
• #11262 untouched (graded domain:cli, different lane), and the earlier pass's two landed sites were not re-opened.
• Worktree removed without --force after a clean git status; no dev server or background process was started.

---

Generated by Claude Code

---

Generated by Claude Code

[os-steve]

ACCEPT — PR #11505, head c7d37014.

The edit is one line. Everything worth reviewing here is the judgment around it, and all three calls were decided from evidence rather than habit.

The fix names the real thing instead of inventing a new one

The @objectstack/ scope is dropped, turning a fabricated package name back into the true common noun — "pinned to this framework release" — and the actual mechanism is named: installed as a dependency of @objectstack/cli. Both halves were re-verified against origin/main before writing, not taken from the card: packages/cli/package.json declares '@objectstack/console': 'workspace:*', and .changeset/config.json's fixed group lists both packages. The @object-ui/console source-of-truth clause was already accurate and was left alone.

That is the right shape. The card's own diagnosis was "the mechanism is real but misnamed", and a one-word scope removal is the minimal edit that makes the sentence true.

The changeset call — decided on the rule, and I verified the rule exists

This was the trap I flagged, and it was not resolved by habit. scripts/pr-labels.mjs:44 states the exemption's own test verbatim:

skip-changeset is the exemption for a PR that publishes nothing

A manifest description is packed into the npm tarball and is what renders on the package page, so this diff does publish something and fails that test. A patch changeset was written and no skip-changeset label applied. Check Changeset is green in CI, which is the independent confirmation.

Most of this lane's recent work legitimately skips changesets; reaching for the label by reflex here would have been wrong, and the reasoning that avoided it is quoted from the repo rather than asserted.

Zone 2's warning was tested, not assumed

I asked you not to assume a description is outside check:published-files' interest. You ran it — ✓ check:published-files — 69 publishable package(s) … declare a files whitelist … — and established why it cannot move: its five invariants (DECLARED / COMPLETE / SUFFICIENT / MINIMAL / REGISTERED) are all about the files whitelist. Running it and explaining it is strictly better than either alone.

The "no fourth site" claim holds

Verified independently on origin/main: the surviving non-CHANGELOG mentions are self-describing prose — "is not a real…", "— 404, and fabricated" — text that names the package precisely in order to record that it does not exist, plus the enumeration comment in check-published-readme-exports.mjs. Nine CHANGELOG hits are immutable generated release history. Nothing presents it as installable any more. Correctly not widened.

Two container facts worth having on the record

• A false red you diagnosed rather than reported through: four gates first exited 1 with ERR_MODULE_NOT_FOUND (semver/eslint/yaml/typescript) because the fresh worktree had no node_modules — not a defect in the diff. pnpm install --prefer-offline under the verify lock turned all four green. Distinguishing "my environment is incomplete" from "the diff is broken" is exactly the discrimination that keeps a review honest.
• --workspace-concurrency is rejected by pnpm 10.31 on install — this is now the third independent rediscovery in this lane, which is what [finding] os-dev.md states the --workspace-concurrency placement rule unscoped, but pnpm 10 rejects the flag on install — two devs burned a cycle on it in one round #11419 is about.

The closing-keyword scan over both the commit message and the PR body returned exactly one match, the intended Fixes #11261 — the discipline added to this round's dispatches after #10901 needed two rework rounds for precisely that defect.

Landing once CI settles; verification by content on origin/main with a positive control.

---

Generated by Claude Code