objectstack-fleet · Oct 25, 2026 · Oct 25, 2026 · Oct 25, 2026
diff --git a/.changeset/25727-round2-dependency-pins.md b/.changeset/25727-round2-dependency-pins.md
@@ -0,0 +1,9 @@
+---
+"@object-ui/plugin-chatbot": patch
+"@object-ui/auth": patch
+---
+
+Clause-②: no
+Metadata-protocol: none
+
+Dependency pins the merged objectstack tree resolves to one copy: `@object-ui/plugin-chatbot` pins `@ai-sdk/react` to `4.0.121` and `ai` to `7.0.118` (the `ai` that `@ai-sdk/react` 4.0.121 itself pins, so the chat transport's types come from one `ai`), and `@object-ui/auth` pins `better-auth` to `1.7.12`.
diff --git a/.objectstack-sha b/.objectstack-sha
@@ -1 +1 @@
-43edf90b56db8b47ad17684c145fb7fa8bf08583
+5874d25302cbb80db675eddf1b69198073fbe2a9
diff --git a/apps/console/src/components/RootLandingRedirect.test.ts b/apps/console/src/components/RootLandingRedirect.test.ts
@@ -70,7 +70,7 @@ describe('resolveLandingPath', () => {
   // platform administration console shipped by @objectstack/platform-objects
   // into every deployment, so "the only app I can see is Setup" means "this
   // environment has no product apps yet", not "Setup is the product". Under
-  // ADR-0075 the environment layer's home is the environment's own
+  // ObjectUI ADR-0075 the environment layer's home is the environment's own
   // responsibility, and `/home` — build-with-AI, start-from-a-template, Your
   // apps — is that home.
   describe('objectui#4048 — a Setup-only deployment lands on the env home', () => {
@@ -93,7 +93,7 @@ describe('resolveLandingPath', () => {
       expect(resolveLandingPath([{ name: 'setup' }])).toBe('/home');
     });
 
-    it('still lands in Setup when the deployment DECLARES it (ADR-0075 wins over the default)', () => {
+    it('still lands in Setup when the deployment DECLARES it (ObjectUI ADR-0075 wins over the default)', () => {
       // The declared landing is the escape hatch: an admin-console deployment
       // that genuinely wants Setup as its first screen says so with
       // `isDefault`, and rule 1 is deliberately untouched by this fix.

diff --git a/apps/console/src/components/RootLandingRedirect.tsx b/apps/console/src/components/RootLandingRedirect.tsx
@@ -100,7 +100,7 @@ export function resolveLandingPath(apps: readonly LandingApp[] | null | undefine
   //    .resolveLandingRoute`), which for Setup is `dashboard/system_overview`.
   //
   //    "The only app I can see is Setup" means the environment has no product
-  //    apps yet — and under ADR-0075 the environment layer's home is the
+  //    apps yet — and under ObjectUI ADR-0075 the environment layer's home is the
   //    environment's own responsibility, which is `/home` (build with AI, start
   //    from a template, Your apps). Rule 1 is deliberately left alone: a
   //    deployment that genuinely wants Setup as its first screen DECLARES it

diff --git a/packages/app-shell/src/__tests__/homeAffordancesFollowDeclaration-7256.test.ts b/packages/app-shell/src/__tests__/homeAffordancesFollowDeclaration-7256.test.ts
@@ -10,7 +10,7 @@
  * cloud's control plane lands a signed-in customer on the app declared with
  * `isDefault` (`cloud_control` → its Welcome page). The chrome did not follow:
  * the top-bar logo, both sidebar Home rows and the app-switcher Home entry each
- * hard-coded `/home`, the ENVIRONMENT layer's launcher (ADR-0075). One click on
+ * hard-coded `/home`, the ENVIRONMENT layer's launcher (ObjectUI ADR-0075). One click on
  * the logo therefore left the control plane's guided welcome for a screen whose
  * "Build an app" / "Start from a template" cards act on an environment the
  * control plane does not have, and whose "Your apps" tiles are the control

diff --git a/packages/app-shell/src/__tests__/homeRecoveryRedirectsFollowDeclaration-7373.test.ts b/packages/app-shell/src/__tests__/homeRecoveryRedirectsFollowDeclaration-7373.test.ts
@@ -16,7 +16,7 @@
  *
  * What was left behind: a control-plane customer refused an app, or landed on a
  * surface their runtime does not serve, was dropped on the ENVIRONMENT launcher
- * (ADR-0075) — "Build an app" / "Start from a template" cards acting on an
+ * (ObjectUI ADR-0075) — "Build an app" / "Start from a template" cards acting on an
  * environment the control plane does not have, and "Your apps" tiles that are
  * the control plane's own internal management apps. The declaration was already
  * read by `/` and by the chrome; only the error paths still disagreed.
@@ -67,7 +67,7 @@
  *   - `utils/homePath.ts` — `HOME_LAUNCHER_PATH` IS the launcher, and the `??`
  *     fallback every site above resolves through. Making it anything else is
  *     option C (redirecting `/home` itself), which the card's ruling excluded:
- *     it would strip the environment layer of its real launcher (ADR-0075).
+ *     it would strip the environment layer of its real launcher (ObjectUI ADR-0075).
  *
  * `console/ConsoleShell.tsx`'s `RootRedirect` was a second such site — the `/`
  * LANDING rather than a recovery exit, held out of the launcher scan by a
@@ -175,7 +175,7 @@ describe('objectui#7373 — recovery redirects follow the declared landing', ()
   it('⛔ the launcher constant itself is untouched — option C stays excluded', () => {
     // `HOME_LAUNCHER_PATH` is the fallback every site above resolves through.
     // A card that "fixed" this line would redirect `/home` itself and strip the
-    // environment layer of its launcher (ADR-0075) — excluded by the ruling.
+    // environment layer of its launcher (ObjectUI ADR-0075) — excluded by the ruling.
     const src = stripComments(read('packages/app-shell/src/utils/homePath.ts'));
     expect(src).toMatch(/export const HOME_LAUNCHER_PATH = '\/home';/);
   });

diff --git a/packages/app-shell/src/preview/__tests__/DraftChangesPanel.securityProblems.test.tsx b/packages/app-shell/src/preview/__tests__/DraftChangesPanel.securityProblems.test.tsx
@@ -36,6 +36,11 @@ vi.mock('@object-ui/i18n', async (importOriginal) => {
 });
 
 import { DraftChangesPanel } from '../DraftChangesPanel';
+// Warm the lint package at module scope: `securityPostureLint` loads it with a
+// function-body `import('@objectstack/lint')`, and that first transform must not
+// be paid inside a 1000 ms `findBy` window (AGENTS.md, test discipline). Same
+// specifier, so the component's own dynamic import resolves from the cache.
+import '@objectstack/lint';
 
 afterEach(() => {
   vi.restoreAllMocks();

diff --git a/packages/app-shell/src/utils/homePath.ts b/packages/app-shell/src/utils/homePath.ts
@@ -6,7 +6,7 @@
  * Two different screens have both called themselves the console's home:
  *
  *   - `/home`, the multi-app workspace launcher ("Build an app", "Start from a
- *     template", "Your apps"). Under ADR-0075 that is the ENVIRONMENT layer's
+ *     template", "Your apps"). Under ObjectUI ADR-0075 that is the ENVIRONMENT layer's
  *     home: its cards act on the environment the SPA is attached to.
  *   - `/apps/<app>`, the landing an App DECLARES with `isDefault: true`. The
  *     landing page WITHIN that app is its first navigation item (spec 17.0.0
@@ -46,7 +46,7 @@
 
 /**
  * The multi-app workspace launcher — the environment layer's own home
- * (ADR-0075). The fallback whenever no App declares a landing, which is every
+ * (ObjectUI ADR-0075). The fallback whenever no App declares a landing, which is every
  * ordinary environment and therefore the unchanged status quo.
  */
 export const HOME_LAUNCHER_PATH = '/home';

diff --git a/packages/auth/package.json b/packages/auth/package.json
@@ -39,7 +39,7 @@
   },
   "dependencies": {
     "@objectstack/spec": "^18.0.0-next.1",
-    "better-auth": "^1.7.2"
+    "better-auth": "1.7.12"
   },
   "devDependencies": {
     "@types/react": "19.3.0",

diff --git a/packages/plugin-chatbot/package.json b/packages/plugin-chatbot/package.json
@@ -36,7 +36,7 @@
     "lint": "eslint ."
   },
   "dependencies": {
-    "@ai-sdk/react": "^4.0.68",
+    "@ai-sdk/react": "4.0.121",
     "@object-ui/components": "workspace:*",
     "@object-ui/core": "workspace:*",
     "@object-ui/i18n": "workspace:*",
@@ -45,7 +45,7 @@
     "@radix-ui/react-slot": "^1.3.3",
     "@objectstack/spec": "^18.0.0-next.1",
     "@radix-ui/react-use-controllable-state": "^1.2.6",
-    "ai": "^7.0.65",
+    "ai": "7.0.118",
     "class-variance-authority": "^0.7.1",
     "lucide-react": "^1.43.0",
     "motion": "^13.2.0",

diff --git a/packages/plugin-dashboard/SKILL.md b/packages/plugin-dashboard/SKILL.md
@@ -1,3 +1,12 @@
+---
+name: plugin-dashboard
+description: Skill notes for @object-ui/plugin-dashboard, the server-driven dashboard renderer — repo-internal package notes, not part of the published skills catalog.
+metadata:
+  # Hides this file from `npx skills add` discovery: every SKILL.md outside the
+  # published `skills/` catalog carries this marker.
+  internal: true
+---
+
 # @object-ui/plugin-dashboard — Skill notes
 
 Server-driven dashboard renderer. Consumes `DashboardSchema` (from
Original file line number	Diff line number	Diff line change
		@@ -1 +1 @@
		43edf90b56db8b47ad17684c145fb7fa8bf08583
		5874d25302cbb80db675eddf1b69198073fbe2a9