release(ui-merge): one release lane for both scopes — 39 @object-ui packages join the @objectstack fixed group, packages/console builds from ui/apps/console, both repos' pin scripts and sha files are deleted (parent #25677, 4a/6) #25711

Filing gate ④: sub-issue 4a/6 of the epic #25677 (pm:epic; epic PM session_01RSDL3SFtJaKzcymvCD8RsU). Part of #25677. ⛔ Not a claim. Item 4 of the parent is split in two at filing: 4a (this card) = release and publish; 4b = #25712, governance in-repo (liveness evidence, spec tests, sdui-parser, AGENTS.md, pm scripts, the 18 governance workflows of the #25697 roster).

Blocked-by: #25685 (merging now — the ui tree must carry uiRoot() and the workspace: tolerant floor scripts before any of this is testable) and, for the landing, the cutover window of sub-issue 5: nothing here is correct on main before ui/ exists, so the PR is drafted and verified on the DO NOT MERGE verification branch of #25697 and merges right after the subtree PR.

Who does it, where it lands: the epic PM dispatches it (os-dev, objectstack checkout). One PR to objectstack-ai/objectstack main, Tier H (release.yml, cut-rc.yml, .changeset/config.json): draft until green on the verification branch, the maintainer approves, the dispatch seat lands it in the cutover window.

维护者速读

今天 @object-ui 39 个包从 objectui 仓发,@objectstack 从本仓发,两边各有一套 changeset 车道、各自一个 Version PR,中间靠 .objectui-sha / .objectstack-sha 两个钉文件和约 1.8 万行脚本(build-console.sh 把 objectui 克隆到钉上再把 spec 注进去编 Console;bump-objectui.sh 搬钉并抄 changeset;objectui 那边 objectstack-pin.mjs 反向钉本仓)把两次发版对齐。你 10-24 裁了「同一个版本号组」:合并后这 39 个包进本仓 .changeset/config.json 的同一个 fixed 组,一次 Version PR 两个 scope 同号、一次 release.yml 从本仓发两个 scope;packages/console(@objectstack/console)改为直接从 workspace 里的 ui/apps/console 构建,不再克隆;两边所有钉脚本和两个钉文件删除。改的是 release.yml、cut-rc.yml、.changeset/config.json,都是受管面,按 Tier H 由你批准;只在切换窗口合,因为 ui/ 不在时这些改动没有一条是对的。

Scope

1. One fixed group. .changeset/config.json: the 39 publishable @object-ui/* packages (ui/packages/* and ui/apps/* with private unset; 7 members stay private) join the existing @objectstack/* fixed group. The dev proves it with pnpm changeset version on the verification branch: one bump, both scopes, the same version string in every manifest; the generated CHANGELOGs keep objectui's changelog entries (objectui's .changeset/*.md files travel with the subtree). objectui's own .changeset/config.json under ui/ is deleted — changesets reads one config per repo.
2. @objectstack/console builds in-workspace. packages/console stops being the output of scripts/build-console.sh (clone objectui at the pin, inject spec, build). It becomes a thin publish wrapper whose build copies ui/apps/console/dist (built by turbo through the ordinary @object-ui/console#build dependency), keeping its published files and prepublishOnly. The spec version the Console carries is then the workspace version by construction, which is what assert-console-spec-injection.mjs / check-console-injection.mjs / check-console-sha.mjs / console-spec-probes.mjs exist to prove today: they are deleted with the script, and the dev states for each which test or build step now proves the same thing (or that the thing can no longer be false).
3. Delete the objectstack-side pin. .objectui-sha, scripts/bump-objectui.sh (+ bump-objectui.selftest.sh), scripts/objectui-changeset-digest.mjs, scripts/objectui-range.mjs, scripts/check-prerelease-pin-watch.mjs; the console filter entries and pin reads in cut-rc.yml (the "THE objectui PIN IS AN INPUT HERE" block and Read the committed objectui pin step), release.yml and any root package.json script that calls them; the RELEASE_GATE_WORKFLOWS entry PR B of tooling(ui-wiring): objectstack-side inert wiring for the ui/ workspace — workspace globs, root turbo tasks, path-filtered ui test/typecheck/lint/E2E jobs, spec change compiles the Console; pin gates retire at cutover (parent #25677, 3/6) #25697 leaves behind, if any. scripts/check-console-intercept-disarm.mjs is NOT pin plumbing and stays.
4. Delete the objectui-side pin, inside ui/. ui/.objectstack-sha, ui/scripts/bump-objectstack.sh, ui/scripts/objectstack-pin.mjs, ui/scripts/objectstack-floor.mjs, ui/scripts/check-spec-range-floors.mjs, ui/scripts/check-installed-spec-pin-claims.mjs, the .objectstack-pin preinstall gate in ui/package.json / ui/.npmrc, and the dist-pin Vite probes vite-objectstack-spec-dist.ts / vite-objectstack-client-dist.ts (the workspace arm of vite-objectstack-workspace.ts from tooling(objectui-readiness): make the objectui tree merge-ready in its own repo before cutover — one react line, one zod range, uiRoot() helper, tsc heap, workspace-aware Console chunk tests, typecheck alias (parent #25677, 2/6) #25685 is what remains). Every @objectstack/* dependency of a ui/ package is workspace:^ (the tooling(monorepo): 在试验分支上把 objectui 并入 ui/ workspace（subtree add、单 lockfile、turbo 构建图），交冲突清单、必改脚本清单与各类 PR 的 CI 时长读数 — 不落 main（父单 1/6） #25678 spike's rewrite); the dev proves pnpm publish --dry-run (or pnpm pack) on one @object-ui/* package renders it as a caret range on the workspace version.
5. One release lane. objectui's changeset-release.yml (Decide lane · Changeset Release) is retired; release.yml publishes both scopes from one run (pnpm -r publish already walks the whole workspace — the dev confirms the files/publishConfig of the 39 packages publish from ui/ unchanged, and that the npm token in use has publish rights on the @object-ui scope, which is the maintainer's to confirm, not the dev's). The GitHub Release / tag step (release-github-releases.mjs on the objectui side, this repo's counterpart) produces one release per version naming both scopes. Docs-site deploy (docs-deploy.yml, objectui's site as a second Vercel project) is 4b's.

Verification (the dev's, before the PR leaves draft)

• On the DO NOT MERGE verification branch of tooling(ui-wiring): objectstack-side inert wiring for the ui/ workspace — workspace globs, root turbo tasks, path-filtered ui test/typecheck/lint/E2E jobs, spec change compiles the Console; pin gates retire at cutover (parent #25677, 3/6) #25697 (PR A head + subtree import + this PR): pnpm install --frozen-lockfile clean; pnpm changeset version in a scratch copy yields one version for both scopes and no package outside the group moves; turbo run build --filter=@objectstack/console produces the same dist/ entry set as today's build-console.sh output (compare file lists, not bytes); pnpm -r publish --dry-run lists exactly 39 @object-ui/* + today's @objectstack/* packages.
• cut-rc.yml and release.yml pass actionlint and check:required-contexts / check:workflow-* gates; no step reads a pin file.
• Nothing green today goes red on main as it is: this PR is never pushed against main without ui/; it is verified on the verification branch only.

Done when

• The PR is green on the verification branch, approved by GOVERNED_APPROVERS, and handed to sub-issue 5 with Blocked-by: sub-issue 5 in its body; it merges in the cutover window right after the subtree PR and PR B of tooling(ui-wiring): objectstack-side inert wiring for the ui/ workspace — workspace globs, root turbo tasks, path-filtered ui test/typecheck/lint/E2E jobs, spec change compiles the Console; pin gates retire at cutover (parent #25677, 3/6) #25697.
• After the merge: no *-sha pin file in the tree, none of the scripts in items 3–4 exists, .changeset/config.json has one fixed group containing both scopes.
• Sub-issue 6 proves the publish: one 18.x release from the merged repo ships both scopes at the same version.

Size: L. Clause-②: no. Metadata-protocol: none.

风险

• npm scope rights: the release token must publish @object-ui/*; if it does not, the first merged-repo release fails at publish time. The maintainer confirms the token's scopes before cutover (sub-issue 5 checklist).
• Version jump: joining the fixed group makes the next release bump all 39 @object-ui packages to the @objectstack version (both are 18.1.0 today, so the first joint release is 18.1.x or 18.2.0 for both). A changeset in either scope bumps both — the ruled behaviour.
• @objectstack/console consumers who pinned on the injected-spec build: the in-workspace build changes no runtime surface, but the dev diffs dist/ entry lists and the Console perf-budget numbers against the last standalone build.

Dedupe

Open issues list 2026-10-24 23:05Z (REST, state=open 100 most recent) filtered on changeset / fixed group / release / objectui: #25581 (dist-tags after a stable publish, unrelated lane), #25638 (18.1.0 changelog attribution, unrelated), #25556 (lockstep rule card, superseded by this epic at sub-issue 6), the epic's own #25677 / #25678 / #25685 / #25697. No card merges the release lanes. New.