[finding] create-objectstack: non-blank remote templates fail first `npm run build` on published 16.1.0 — fix is at HEAD, needs 17.0.0 release + canary verification

[huangyiirene]

Symptom

create-objectstack@16.1.0 (current npm latest) scaffolds a project from any non-blank published remote template, and its very first npm run build exits 2 with a namespace-prefix validation error. Reproduced on 4 independent templates in the QA run — todo / compliance / content / contracts (2 / 4 / 5 / 3 issues respectively); procurement was blocked(environment) (codeload 503/403 in the sandbox). The blank template is clean end to end. This triggers for any project name whose sanitized namespace differs from the template's own — i.e. every real user, and CI's own canary-app.

Root cause

Located, and already fixed at repo HEAD — the residual action is a release, not a repair.

• Published 16.1.0 rewrites namespace: in objectstack.config.ts to the sanitized project name but not the object-name literals, because it reads the template's original namespace from objectstack.manifest.json only. A remote template's manifest is the template-registry document, which has no namespace key, so the guard falls through and the literal rewrite is silently skipped (config says namespace tpl_todo while the object literal still says name: 'todo_task').
• The fix is present on origin/main (confirmed at filing time): packages/create-objectstack/src/rewrite-identity.ts makes objectstack.config.ts the authority and self-verifies via findStaleNamespacePrefixes, wired in at packages/create-objectstack/src/index.ts:311. The file's own comment names the prior incident fix(devx): init-service 门禁认全部服务访问器,不只 getService (#4835) #4902 ("all five published remote templates failed this way, and the nightly registry canary had been red on every one of them for weeks with nobody watching"). Pin packages/create-objectstack/src/rewrite-identity.test.ts is present (10/10 pass per the run).
• Related prior code-bug issue: P0:5 个已发布模板对真实新用户是坏的 —— 脚手架的对象名前缀改写对所有远程模板静默跳过,夜间金丝雀连红 20 次无人察觉 #4926 (closed).

Reproduction

npx -y create-objectstack@latest canary-app -t todo --skip-skills --skip-install
cd canary-app && npm install && npm run build

Expected exit 0. Actual (with published 16.1.0) exit 2:

defineStack namespace-prefix validation failed (2 issues):
Object todo_label is missing the package namespace prefix.
Rename it to canary_app_todo_label (namespace = canary_app)

Residual asks (release-verification, not code repair)

1. Confirm the rewrite-identity.ts fix ships in the create-objectstack@17.0.0 release — npm latest is still 16.1.0, so every new user picking a non-blank template today gets a project that fails first build.
2. Confirm the nightly registry canary goes green once 17.0.0 is published.

Source

Extracted from the QA run #7628 (framework 92f26f7, console 6314e87f).

[os-zhuang]

Triage — dual-state resolution: finding + domain:cli + target:v17 kept; pm:queue removed (queue+finding is an illegal pair; one had to go).

• Why finding, not queue: the code repair is already merged — verified on origin/main @ 5823d59: packages/create-objectstack/src/rewrite-identity.ts exists with the fix(devx): init-service 门禁认全部服务访问器,不只 getService (#4835) #4902 account in its header, wired at index.ts:311 (findStaleNamespacePrefixes). The residual asks (confirm the fix ships in create-objectstack@17.0.0, confirm the nightly canary goes green) are release-time verification steps — nothing is dispatchable to a dev today. Restart condition: the 17.0.0 cut; this card is the checklist entry for it.
• target:v17 ratified by this seat (the label arrived at filing from the QA seat; target:* production for this backlog is the triage seat's — ratifying rather than stripping because the judgment is correct on the merits): published latest failing first build on every non-blank template is blocking class ④ (first-hour, follow-the-docs failure). The release-verification framing is exactly what the board's cut-time sweep consumes.
• Routing: packages/create-objectstack ⇒ domain:cli per the domain table.
• Dedup: P0:5 个已发布模板对真实新用户是坏的 —— 脚手架的对象名前缀改写对所有远程模板静默跳过,夜间金丝雀连红 20 次无人察觉 #4926/fix(devx): init-service 门禁认全部服务访问器,不只 getService (#4835) #4902 are the closed code-bug predecessors; no open card tracks the release-verification residual besides this one.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[os-zhuang]

Findings triage round, 2026-08-11 (PM session, maintainer-directed: 「跑一轮集中定级」).

Graded: promote. First-npm run build failure on every non-blank template for every real project name is release-blocker class ④ (first-hour experience), and the card already carries target:v17. Scope note: the fix is at HEAD, so the queued work is the canary verification once 17.0.0 ships — the release act itself is the maintainer's, per the human-release guardrail; this card must not be read as authorizing any publish.

finding → pm:queue (domain:cli, stays on the v17 board).

---

Generated by Claude Code