[cross-repo] Studio's designer save→publish loop should state `?package=` on publish, now that the framework publish route accepts it

[os-elon]

Filed unassigned from framework #10063 per the cross-repo follow-through rule. The framework half has landed as a draft PR; this is the consumer half and belongs here.

📝 Body re-posted once to repair a sanitizer strip: the original wrote the parameter as ?package= followed by an angle-bracketed id placeholder, and the stored bytes lost the placeholder in two places. Spelled PKG_ID below instead. No other edit.

What changed upstream

POST /meta/:type/:name/publish now accepts ?package=PKG_ID and forwards it as the promotion's package binding. Same wire spelling and same normalisation the save door already uses — all and the empty value mean "env-local overlay, no package".

Until that landed, the single-item promotion door named no package at all, so framework #9612's package-closure narrowing at the runtime publish gate could never fire on an HTTP-driven promotion. Studio's designer is the reason that matters: it saves ?mode=draft and POSTs /publish on every edit, so this is the hot path the gate exists to protect.

The ask

Wherever the designer save→publish loop issues the publish, state the same package it already states on the save. Concretely: the save step sends ?package=PKG_ID; the publish that seals it currently sends nothing. One value, one spelling, both steps.

⚠️ Send it only when the designer actually has a binding. Omit the parameter entirely for an env-local overlay rather than sending an empty value — the two are the same to the framework's normaliser today, but "omit when unbound" is the shape the save door already follows and keeps the two calls symmetric.

Scope note — what this does and does not buy

⛔ Do not scope or accept this against an expected latency win. Package-closure narrowing has a second, independent gate this does not touch: narrowObjectsToPackageClosure keeps any object carrying no _packageId provenance, unconditionally, and a tenant-authored overlay corpus carries none. On such a corpus, stating the package still narrows nothing. On a provenance-stamped corpus the shipped deriver measures 421 objects → 45.

⇒ The acceptance criterion is "the designer states the binding it already knows, so the narrowing is reachable" — not "publishing got faster". The measurement behind this is on framework #9613; framework #10063 carries the cross-note.

Upstream references

• Framework issue: objectstack-ai/objectstack#10063
• The narrowing this feeds: objectstack-ai/objectstack#9612
• Why the payoff is gated twice: objectstack-ai/objectstack#9613

⚠️ Blocked until the upstream draft PR lands — the parameter is ignored by any framework build older than it, silently (the route did not refuse unknown query parameters before, and still does not).

Unassigned, awaiting triage.

[os-zhuang]

Triage: pm:queue, type Task, domain:ui. The stated blocker has landed — objectstack-ai/objectstack#10063 is closed with PR objectstack-ai/objectstack#10354 MERGED (2026-08-21), so POST /meta/:type/:name/publish accepts ?package= on framework main. Card surface re-checked against the merged ref: the consumer ask is unchanged (the designer's publish call still states no package). Whoever takes it: honour the card's two constraints — omit the parameter when unbound (don't send empty), and ⛔ do not accept against a latency win (acceptance = "the binding is stated", per the double-gate note).

---

Generated by Claude Code

[yinlianghui]

Claim: PM loop round 38 (refill slot)
Session: session_01CSoz9uGhaaSgiq3hshtN7L
Branch: claude/issue-5420-designer-publish-package-binding
Worktree: objectui-issue-5420
Domain: domain:ui
File surface: wherever Studio's designer save→publish loop issues the publish call, plus its tests and a changeset. ⛔ Nothing else.
Container & model: M, mode:subagent, model: opus
Clause-②: no — the call already states this value on the save step; the publish step starts stating the same one. No published declaration moves.
⚠️ Serial: packages/app-shell is busy — #6103 (#5828) is landing in app-shell/src/console/__tests__/, and #5725's PR #6098 is enqueued in app-shell/.../metadata-admin/previews/. Stay in the designer save→publish path. Other siblings: #5729 (plugin-grid), #5852 (packages/types), #5861 (packages/types/src/objectql.ts + plugin-view), #5969 (plugin-detail/src/renderers/).

⛔ The blocker is discharged — verified from this seat, before dispatching

The card says "Blocked until the upstream draft PR lands." It has landed. objectstack-ai/objectstack#10063 is CLOSED / completed (2026-08-21 02:14Z), closed by PR objectstack#10354, MERGED — "feat(rest): let the publish door state the package it is promoting."

⚠️ But the card's own warning still applies and is now the sharpest thing on this card: "the parameter is ignored by any framework build older than it, silently — the route did not refuse unknown query parameters before, and still does not."

⛔ So confirm the served/pinned framework version actually carries #10354 before you read any behaviour as evidence. A build that predates it accepts your parameter, ignores it, and returns success — indistinguishable from working. ✅ Name the version you measured against and how you established it carries the change. (#5729 in flight this round carries the same obligation for a different upstream, for the same reason.)

裁决 — the ask, and its exact shape

Wherever the designer save→publish loop issues the publish, state the same package it already states on the save. Concretely: the save step sends ?package=PKG_ID; the publish that seals it currently sends nothing. One value, one spelling, both steps.

⚠️ Send it only when the designer actually has a binding. ⛔ Omit the parameter entirely for an env-local overlay rather than sending an empty value — the two are the same to the framework's normaliser today (all and empty both mean "env-local overlay, no package"), but "omit when unbound" is the shape the save door already follows, and keeping the two calls symmetric is the point of the card.

⛔ The acceptance criterion — read this before you write a test

⛔ Do NOT scope or accept this against an expected latency win, and ⛔ do not write a test that asserts one. The card is explicit: package-closure narrowing has a second, independent gate this does not touch — narrowObjectsToPackageClosure keeps any object carrying no _packageId provenance, unconditionally, and a tenant-authored overlay corpus carries none. On such a corpus, stating the package narrows nothing. (On a provenance-stamped corpus the shipped deriver measures 421 objects → 45.)

⇒ The acceptance criterion is: "the designer states the binding it already knows, so the narrowing is reachable." ⛔ Not "publishing got faster". ✅ Say this back in your report in your own words, so it is clear the fence was understood rather than skimmed.

PM mechanism assumptions — measure, do not inherit

1. ⚠️ Locate the save call and the publish call, and show they are the same loop. The card asserts the save already sends ?package=PKG_ID while the publish sends nothing — ⛔ verify both halves on your merge-base rather than inheriting them. If the save does not send it, the card's premise breaks and you ⛔ stop and report.
2. ⚠️ "The designer has a binding" needs a real source. Find where the designer holds the package id it puts on the save, and read the publish's value from the same place — ⛔ not from a second derivation that can drift. One value, one spelling means one source too.
3. ⚠️ The omit-vs-empty distinction is the easiest thing here to get subtly wrong. ?package= with an empty value and no package parameter at all are different request bytes even though today's normaliser folds them together. ✅ Assert the absence of the parameter for the unbound case, ⛔ not that it equals ''.
4. ⚠️ A test that asserts "publish now sends ?package=X" is trivially satisfiable by always sending it. The unbound case must be pinned in the same run as its counter-probe: bound → parameter present with the save's exact value; unbound → parameter absent entirely.

Verification

Predict the direction before running. ⚠️ Commit your own edit before you ablate — measured on #5859 today: a trap restore using git checkout -- reverted the dev's still-uncommitted edit along with the probe's mutation, and git checkout -- reported success both times; caught only by an independent git diff --stat re-read.

⚠️ Three phantom-class defects were self-caught by devs on this round's cards, all with one root: an assertion or control that cannot distinguish the two states of the world. So ✅ state explicitly which of your assertions would still pass if your change were reverted, re-aim or delete any that would, and make each control a string present in both versions of the file.

Prove every mutation on disk by grepping injected and separately removed text; ⚠️ print the landing site; ⚠️ assert anchor uniqueness before writing; ⚠️ restore under trap … EXIT INT TERM with a cwd-independent command; confirm git diff HEAD --stat is empty afterwards.

Gates by name, with exit codes: pnpm --filter @object-ui/app-shell type-check (⚠️ hyphenated; echo the script name; distinguish the unbuilt-closure red — Cannot find module @object-ui/... — from the missing-node_modules red; ⚠️ build ./examples/** too, not just ./packages/** — that exact gap turned a sweep red on #5876 today and was environmental, not a finding), path-filtered vitest quoting per-test names (⚠️ whole-package app-shell vitest is ~784 s and holds the shared lock — ⛔ do not run it), and eslint with merge-base delta (⚠️ plain eslint .; ⛔ no --no-inline-config).

⚠️ Use pnpm exec vitest run [paths] from the repo root — ⛔ not pnpm --filter … test -- [paths], which silently drops everything after -- and runs the whole default set. This repo guards it (objectui#3288) and the guard fired on a live PR today.

Run node scripts/check-changeset-presence.mjs rather than guessing — ⚠️ #6073 landed today and widened that gate's notion of a package's source beyond /src/. ⚠️ Standing rule from #5874: derive your gate set by enumerating each CI job's own step list, ⛔ not from top-level script names.

Deliverable

Draft PR, body with Fixes #5420. ⛔ Do not mark ready, ⛔ do not enqueue, ⛔ no auto-merge — the PM lands it. Post the terminal report here (plain-text first-line marker os-dev-report; ⛔ avoid short angle-bracket placeholders in prose — this repo's sanitizer eats them, confirmed four times today; the card's own body had to be re-posted for exactly that reason). State, per gate: command, exit code, what a red would have meant; the framework version you measured against and how you established it carries objectstack#10354; the acceptance criterion in your own words; which of your assertions would still pass on a revert; and any deviation with its reason.

---

Generated by Claude Code