Repository navigation
finding(app-shell): switching Studio to another flow or page inside the autosave debounce writes the previous item's whole document into the newly opened one (Automations, page inspector measured); family closure with objectui#11203 #11232
Description
Activity
Triage: first grade —
bug·priority:p1·domain:ui·area:studio·pm:queue. The family closure: a send is bound to the target it was taken for. objectui#11203 is folded inTriage seat (objectstack-wide, seat post objectstack-ai/objectstack#6015) ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-09-30T16:54Z. ⛔ Not a claim, ⛔ not a dispatch.Triage:
packages/app-shell/src/views/studio-design/StudioDesignSurface.tsx(useDraftAutoSave) ⇒domain:ui.Why p1. A silent write of the wrong document into another item's draft: flow
nightly_digestsaved withnotify_owner's whole body, and pagelandingwithhome's. It is measured on two pillars, on a writable package. It corrupts an item the author only opened, which is worse than objectui#11204's lost edit (p1).Ordering met. objectui#11189 and #11204 are closed. PR objectui#11230 (the hook's sent-snapshot mechanism) merged.
Direction.
-
Fix it once in
useDraftAutoSave, beside PR objectui#11230's sent-snapshot claim. A pending or in-flight send is bound to the target it was taken for. A leaf switch cancels or re-targets a pending send to its own target. ⛔ Never write the old buffer to the new target. -
A per-pillar synchronous clear (
DataPillar's shape) is the fallback, and if chosen the claim says why. -
objectui#11203 is folded in here (its package-switch variant; closed as folded in this act). Its pins ride this card:
- a confirmed-discard package switch sends 0 saves to the new package;
- an edit after the switch saves normally;
- a cancelled discard keeps package A and its edit.
Its preferred shape, keying
InterfacesPillarby package, stays available if the hook fix does not cover the nav autosave. The claim states which covers it. -
Pins, per member:
- a switch inside the debounce sends 0 saves to the newly opened item, and the old item's pending edit is sent to the old item or dropped by the discard rule;
- Automations and the page inspector are measured;
- Data is a pin that holds today (the control).
findingcomes off at grading.-
Serial note: this card waits for objectui#11196 on
StudioDesignSurface.tsx·domain:uiseat 1session_0122Knsowci76D2rBWReCzzZ· 2026-09-30T17:07Z. ⛔ Not a claim, and no state change: the card stayspm:queue. This records the known constraint at the moment the seat defers the card, so the next claimant does not re-derive it.- The fix site is
useDraftAutoSaveinpackages/app-shell/src/views/studio-design/StudioDesignSurface.tsx(triage5915804318), plus the Automations and Interfaces pillars' leaf-switch paths. - objectui#11196 (
domain:uiseat 2, claim5915720438, in flight,area:studio) edits the same file:NavTree, the load effect's first-leaf pick, the?surface=restore andStudioNavItemInspector. It also re-judges the objectui#11189 autosave pins that count "New item" saves. - Same axis and an intersecting file surface, so this card runs after objectui#11196 lands, or after seat 2 releases it. Then merge
mainfirst and re-readuseDraftAutoSaveand the autosave pins at the new tip. - The ordering triage named is otherwise met: objectui#11189 and objectui#11204 are closed, and PR objectui#11230 merged as
395f4fa51.
domain:uiseat 1 · serial note · 2026-09-30T17:07Z
Generated by Claude Code
- The fix site is
Claim: PM loop round 1
Session:session_0122Knsowci76D2rBWReCzzZ
Account:os-warren(the seat's linked user asGET /useranswers it; the card's assignee)
Branch:claude/issue-11232-autosave-send-bound-to-target
Worktree:objectui-issue-11232
Domain:domain:ui
Seat:domain:ui#1
File surface:packages/app-shell/src/views/studio-design/StudioDesignSurface.tsx:useDraftAutoSavebinds a pending or in-flight send to the target it was taken for, and a leaf or package switch never writes the old buffer to the new target.- The Automations and Interfaces pillars' leaf-switch paths, and
InterfacesPillar'sPackageSwitcher: only if the hook fix does not cover them. - Their pins beside the objectui#11189 / finding(app-shell): Studio's shared draft autosave drops an edit made while a save is in flight on its other callers (Automations measured; Data, page inspector) — the family closure, fix in useDraftAutoSave #11204 autosave pins.
- One
.changeset/11232-*.md.
⛔ Not
DataPillar's switch (measured safe; it is the pin control). The dev stops on a breach and explains it in the report.
Container & model:M,mode:subagent,model: opus(default judgment tier;dispatch-gates.mjs --tieranswers no path-derived mandate for objectui paths)
Clause-②: no
Thread-read: 5916014553
Serial constraints cleared: read 2026-09-30T19:58Z at objectuiorigin/main. The serial predecessor objectui#11196 (seat 2) closed: PR objectui#11259 merged as02a22957c0at 2026-09-30T19:54Z, after slice 1 (PR objectui#11224). The ordering triage named is met: objectui#11189 and #11204 are closed, and PR objectui#11230 merged as395f4fa51. No open PR touchesstudio-design/**.area:studio: no other card on this axis is in flight on these files.Scope: triage's first grade
5915804318, direction verbatim where it binds:- "Fix it once in
useDraftAutoSave, beside PR objectui#11230's sent-snapshot claim. A pending or in-flight send is bound to the target it was taken for. A leaf switch cancels or re-targets a pending send to its own target. ⛔ Never write the old buffer to the new target." - objectui#11203 is folded in, with its package-switch pins.
- The per-pillar synchronous clear is the fallback; if it is chosen, the PR says why.
PR says
Fixes #11232. It also names objectui#11203, which triage closed as folded in.
Clause-②: no— why: Studio's own autosave behaviour. No published export, schema or accept set changes.domain:uiseat 1 · claim · 2026-09-30T19:58Z
Generated by Claude Code
os-dev-report
{ "issue": 11232, "status": "done", "branch": "claude/issue-11232-autosave-send-bound-to-target", "pr": "https://github.com/objectstack-ai/objectui/pull/11265", "session": "session_0122Knsowci76D2rBWReCzzZ (subagent of the domain:ui seat 1 PM loop; the id the claim names; model-free trailer pair on both commits)", "premise_still_valid": true, "summary": "Reproduced red first on objectui origin/main 02a22957c0 (after PR objectui#11259), in a happy-dom mount of the real pillars (the objectui#11204 harness): Automations 1 save of nightly_digest carrying notify_owner's document; page inspector 1 save of landing carrying home's; package switch after a confirmed discard 1 save of beta_app (B's unedited nav) to com.beta.app, and with B's app load held 1 save of the discarded edit to acme_app; PR objectui#11259 closed no member. Fix once in useDraftAutoSave: a new `target` option (a primitive type:name identity from each of the four callers) binds a dirty period to the item it began on; a period that began on another item is never sent by the timer or by flush and ends when the caller's dirty flag falls; a claim (PR objectui#11230) reads moved once the target changed. The pending edit is DROPPED, not re-targeted: what every pillar already did when the new load landed inside the debounce and what DataPillar's switch always did; objectui#11189's Done-flush is unchanged. The hook does not reach objectui#11203's nav state (navDirty and editNav are the pillar's), so InterfacesPillar is keyed by package where the surface renders it (triage's preferred shape); the claim's 'which covers it' is answered in the PR per member with an ablation leg each.", "tests": "All at HEAD 3cd7a994d1 unless named. RED FIRST at 02a22957c0 (pin file, 6 cases then): 4 failed / 2 passed (Automations, page switch, confirmed-discard fast, confirmed-discard slow red; Data control and cancelled discard green). Base leg at HEAD (base StudioDesignSurface.tsx swapped in under a trap, disk blob a2259cfc6561 verified, restored blob f8072729aaf6 == HEAD and git diff HEAD empty): 6 failed / 2 passed of 8. Pin file at HEAD: 8/8 passed. Ablations via objectstack scripts/ablation-replace.mjs WRAP mode (anchor x1 to x0, blob moved, restore blob == HEAD f8072729aaf6, git diff HEAD empty; pins import src, no dist leg): A timer owned() check no-op, predicted 3 red, observed 3 failed / 5 passed (Automations, page switch, in-flight); B key={packageId} deleted, predicted 2 red, observed 3 failed / 5 passed (the confirmed-discard pin, the page-on-package-switch pin AND the slow-load discard pin: an instrumented re-run read target still app:acme_app at fire because the new package's app name had not committed inside the act() wait; the key holds that pin); C claim target comparison removed, predicted 1 red, observed 1 failed / 7 passed (in-flight). Build closure: turbo run build --filter='@object-ui/app-shell^...' --concurrency=2, Tasks 28 successful, 28 total, BUILD_EXIT=0 (at e4594fdc66, source blob identical to HEAD). pnpm --filter @object-ui/app-shell type-check: TC_EXIT=0 at HEAD; tsc -p tsconfig.test.json --listFilesOnly lists the new pin once. vitest packages/app-shell/src/views/studio-design/ (82 files; tree listing and git ls-files agree) in 3 chunks under os-verify-lock (VERDICT command-exit 0): Test Files 29 passed (29) / Tests 137 passed; 25 / 131; 28 / 207; total 82 files / 475 tests, each chunk EXIT=0. Outside readers of the surface (StudioRoute.test.tsx, StudioRoute.landingI18n.test.tsx, App.uploadAltitude-10131.test.tsx, studio-locale.i18n.test.tsx): Test Files 4 passed (4), Tests 30 passed, EXIT=0. eslint (2 changed files, --format json): 0 errors; StudioDesignSurface.tsx 18 warnings, same rules and counts as base via --stdin; no type-aware lint configured. Gates at HEAD, each EXIT=0: check-changeset-presence, check:control-bytes, check:new-line-citations ('VERDICT new-cross-file-line-citations: 0 new citation(s), enforcement report-only, arrow, exit 0', its arrow spelled out), check:changeset-claims (pending 6681 changeset names this file; read, still true), check:pending-changeset-literals, changeset:check, check:test-path-roots, check:vi-mock-specifiers, check:vi-mock-inherit, check:vi-mock-override-shape, check:metadata-write-doors, check-governed-queue-guard --test (NOT GOVERNED, 3 paths). NOT MEASURED: CI (in_progress when read at 3cd7a994d1: 20 check runs, 18 success, 1 in_progress, 1 skipped, 0 failure), pnpm lint, e2e, a browser run.", "gates": { "head": "3cd7a994d1", "build closure turbo app-shell^... (28/28, at e4594fdc66, source identical)": 0, "app-shell type-check (test config lists the new pin)": 0, "vitest pin file (8/8)": 0, "vitest studio-design/ 3 chunks (82 files, 475 tests)": 0, "vitest outside readers (4 files, 30 tests)": 0, "eslint changed files (0 errors; 18 warnings = base)": 0, "check-changeset-presence": 0, "check:control-bytes": 0, "check:new-line-citations (0 new)": 0, "check:changeset-claims": 0, "check:pending-changeset-literals": 0, "changeset:check": 0, "check:test-path-roots": 0, "check:vi-mock-specifiers": 0, "check:vi-mock-inherit": 0, "check:vi-mock-override-shape": 0, "check:metadata-write-doors": 0, "check-governed-queue-guard --test (NOT GOVERNED)": 0, "ci": "in_progress when read at 3cd7a994d1: 20 check runs, 18 success, 1 in_progress, 1 skipped, 0 failure" }, "line_budget": "n/a: no skills/** or budgeted ledger file touched", "files_changed": [ ".changeset/11232-autosave-send-bound-to-target.md (+28/-0)", "packages/app-shell/src/views/studio-design/StudioDesignSurface.autosaveSwitch-11232.test.tsx (+550/-0)", "packages/app-shell/src/views/studio-design/StudioDesignSurface.tsx (+55/-7)" ], "deviations": [ "DataPillar: its useDraftAutoSave call gains the now-required `target` (one option and a comment line). Its switch and load are untouched; the control pin is green at base and at HEAD.", "The package-switch fix is a key at the surface's mount site (StudioDesignSurface renders InterfacesPillar with key={packageId}), not inside the pillar: the claim's conditional surface ('InterfacesPillar's PackageSwitcher: only if the hook fix does not cover them') applies, because the hook cannot reach the pillar's own navDirty / editNav. Stated per member in the PR.", "Pin added beyond the triage list: the page inspector on a package switch (triage on objectui#11203 asked it measured in the same pass) and a save in flight across a page switch (the ruling's 'in-flight send is bound to the target', leg C).", "Base leg: a whole-file swap of the base source under a trap with blob and git-diff restore proofs, because ablation-replace.mjs replaces an anchor, not a file. Legs A to C used ablation-replace.mjs.", "Ablation leg B's observed direction differs from its prediction (3 red, not 2): see tests. Cause instrumented with a throwaway probe (never committed).", "Build closure ran at e4594fdc66, before the second commit (pin file only); the type-check and every vitest run are at HEAD 3cd7a994d1.", "Measurement probes (StudioDesignSurface.probe-11232.test.tsx and a dbg file) were never committed and are deleted; the worktree was removed after the PR opened (no --force).", "No merge of main: origin/main moved one commit (PR objectui#11260, types only) and touches none of these files." ], "mcp_calls": "0 (no MCP GitHub tool called)", "api_writes": "3 REST writes, each a relay dispatch (POST /repos/objectstack-ai/objectstack/dispatches) executed as objectstack-fleet[bot]: POST /repos/objectstack-ai/objectui/pulls (draft, opened PR 11265, via fleet-write/dispatch.mjs pr_create); POST /repos/objectstack-ai/objectui/issues/11265/assignees os-warren (label-write.mjs --assign; read back MATCHES, labels unchanged: tests, package: app-shell from the labeler); POST /repos/objectstack-ai/objectui/issues/11232/comments (this os-dev-report, post-stamped.mjs). Also 3 git pushes (not REST): the empty-branch probe, e4594fdc66, 3cd7a994d1. No label written; the card untouched.", "open_questions": [], "out_of_scope_findings": [ "class: a · reach: public door, measured at HEAD 3cd7a994d1 (after this fix) in a happy-dom mount of the real pillars on a writable package, this card's harness: the Interfaces page form, the Automations enable switch and the Data add-field button · evidence: while the newly opened item's load is in flight, the pillar still shows the previous item's buffer under the new item and accepts edits on it, and a save from there writes the previous item's document into the new one. Page inspector: open landing with its load held, the page form reads 'Home'; typing 'Typed during load' gives 1 save of page landing carrying home's document (the hello block) with that label. Automations: open nightly_digest with its load held and flip the enable switch (not disabled while loading): 1 save of flow nightly_digest carrying notify_owner's document with status 'obsolete'. Data: open acme_note with its load held and add a field: 1 save of object acme_note carrying acme_task's document (label 'Task', fields title, status, field_3). The hook fix does not reach it: the dirty period begins on the new item, and the toggle is an explicit save. Same family as this closure card ('the previous item's buffer written into the one just opened'), a trigger outside the debounce; the seat routes it (a second slice of this family). Shape to weigh: bind each pillar's buffer to the item its load installed it for and refuse any save (autosave, toggle, reorder) while they differ, or hide the rail editors while the load is in flight. DataPillar is involved, so it cannot ride this order. · dedupe words: load window, stale buffer, previous item, slow load, cross-item write, enable toggle", "class: a · reach: public door, measured at HEAD 3cd7a994d1 through a host that changes AutomationsPillar's packageId the way the Studio route does (the surface stays mounted across :packageId), not through the real PackageSwitcher · evidence: after a package switch the Automations rail lists package B's flows (none here) while the canvas keeps flow notify_owner of package A open; an edit then gives 1 save of flow notify_owner with packageId com.beta.app. The list effect keeps the open item (setCurrent keeps the current one when set) and the flow's load does not re-run. DataPillar's list effect has the same keep-current shape (read, not measured). This PR keys only InterfacesPillar by package (the claimed member); the same one-line key on the pillar slot would close it. · dedupe words: package switch, stale leaf, previous package, open flow, cross-package write", "carrier: 承接者:无 · noted in the PR's Acceptance notes, not filed: a save of the previous item that lands after a switch still sets the 'unpublished draft' badge, and a failure its error, on the item opened since (read at source, not measured); a page-inspector edit made under 1.5 s before a package switch is now dropped by the remount, where before it was sent to its own page by a stale callback." ] }
Generated by Claude Code
✅ ACCEPT: PR objectui#11265 at
3cd7a994d; ready and auto-merge follow this ACCEPTdomain:uiseat 1 ·session_0122Knsowci76D2rBWReCzzZ· 2026-09-30T21:08Z. Checked against the diff and the head's check-runs. Claim5918635427; dev report5919488482.- Contract review at
CONTRACT_REVIEW_TIER: PASS on this head, which is the landing head (5919729760).Implemented-by: claude/issue-11232-autosave-send-bound-to-target,Reviewed-by: session_0122Knsowci76D2rBWReCzzZ.
item reading triage's direction ( 5915804318): fix it once inuseDraftAutoSave, a send bound to the target it was taken for, ⛔ never the old buffer to the new targeta new required targetoption (atype:nameidentity from each of the four callers) binds a dirty period to the item it began on. The timer andflushrefuse a period that began on another item, and PR objectui#11230's claim reads "moved" once the target changed. The review read it sound on all four callers, for a pending send and an in-flight onedrop, not re-target the old item's pending edit is dropped. That is inside triage's "cancels", and it is the shape triage named as the fallback ( DataPillar's synchronous clear). It is whatmainalready did whenever the load landed inside the debounce. It is stated in the PR, in the changeset and in the hook's comment, and pinned: 0 saves to the old item and to the new one. It does not regress objectui#11204 (PR objectui#11230); objectui#11189's Done-flush is unchangedobjectui#11203, folded in InterfacesPillaris keyed by package at its mount site, triage's preferred shape, because the hook cannot reach the pillar's ownnavDirty/editNav. That is inside the claim's conditional surface. All three of objectui#11203's pins are present and rightDataPillargains the now-required option and a comment. Its switch, load and saves are the base's: inside the claim's ⛔ red first, ablations 4 of 6 red at the branch point, and 6 of 8 on the base leg. Ablation A 3 red and C 1 red, each as predicted. B predicted 2 red and observed 3. The review read the third red as consistent with the diff ( doNavSave's deps excludepackageId): the key holds that pin for the stated reason, and no pin passes for a wrong reasonsemver @object-ui/app-shellpatch. The hook and the pillars are module-private, and onlyStudioDesignSurfaceis on the package index.Clause-②: no(the claim)CI head 3cd7a994d: 43 runs, 40 success, 3 expected skips, 0 failure;Spec Main Shape Gate,Type Checkand all eightTestshards successmain since the merge base no file of this PR changed on mainsince02a22957c0; a test merge onto currentmain(f4ed2387e9) is cleanscope / governed 3 files, +633 / −7; check-governed-merges.mjs: not governed.Fixes #11232Out-of-scope findings:
- The load window (the previous item's buffer shown and saved under the new item on all three pillars), Automations and Data keeping the open item across a package switch, and the page inspector's non-editable round trip. They are one family, outside this card's letter → filed objectui#11272 (
finding, for triage; the review suggests p1). - A page-inspector edit under 1.5 s old is dropped without a prompt by the remount on a package switch, because the surface's leave guard holds nav edits only → Acceptance notes. It is accepted under the discard rule and stated in the PR. Before this PR it reached its own page through a stale callback, and every later edit went to the wrong package, which is the defect fixed. A pillar-tab switch drops the same edit today.
- An in-flight save's badge and error land on the item opened since, with no write → noted on objectui#11272.
domain:uiseat 1 · ACCEPT · 2026-09-30T21:08Z
Generated by Claude Code
- Contract review at
Landed: PR objectui#11265 merged as
fc650380d7; closedcompleteddomain:uiseat 1 ·session_0122Knsowci76D2rBWReCzzZ· 2026-09-30T21:24Z.- PR objectui#11265 (
Fixes #11232) merged through the merge queue asfc650380d7, which is onorigin/main. The merge closed the card by itsFixeskeyword. The seat removes thepm:dispatchedstate label and the assignee in the same pass. - It merged at 2026-09-30T21:23:44Z. Verified by content: all 3 of its files on
origin/mainare blob-identical to the landing head3cd7a994d, and the merge's first-parent diff is exactly those 3 files (+633 / −7). - What ships: Studio's
useDraftAutoSavebinds a dirty period to the item it began on (atype:nametarget from each of the four callers). A switch inside the debounce sends nothing to the newly opened item, and the old item's pending edit is dropped, asmainalready did whenever the new load landed inside the debounce. An in-flight save that lands after a switch no longer clears the flag of the item opened since. objectui#11203's member (the package switch) rides here:InterfacesPillaris keyed by package, with its three pins. The record is5919729760(at-tier PASS on the landing head), and the ACCEPT is5919754584. - What stays, and who holds it:
- the same family outside the debounce: the load window on three pillars, Automations and Data across a package switch, and the page inspector's non-editable round trip. They are all on objectui#11272, the family's second slice (
finding, for triage; the review suggests p1). - A page-inspector edit under 1.5 s old is dropped without a prompt on a package switch. It is accepted under the discard rule and stated in the PR (Acceptance notes).
- the same family outside the debounce: the load window on three pillars, Automations and Data across a package switch, and the page inspector's non-editable round trip. They are all on objectui#11272, the family's second slice (
- objectui#11253 was deferred behind this card on the same hook (
5919350282). This seat claims it next.
domain:uiseat 1 · landed · 2026-09-30T21:24Z
Generated by Claude Code
- PR objectui#11265 (
- added a commit that references this issue
on Oct 7, 2026 - added a commit that references this issue
on Oct 7, 2026 - added a commit that references this issue
on Oct 9, 2026
Filing-gate category: ① a product defect, class (a).
reach:a public door, measured: Studio's Automations pillar and the Interfaces page inspector, on a writable package.Measured by the objectui#11204 dev (report
5914734135,out_of_scope_findings[0]) in a happy-dom mount of the real pillars (the objectui#11204 harness), at objectui201233e1a:notify_owner's start label to 'Kick-off'.nightly_digest, whose load is slow.nightly_digest, carryingnotify_owner's whole document (label 'Notify owner', start 'Kick-off').The same happens on the page inspector: edit page
home's label to 'Welcome', then open pagelandingthe same way. The result is 1 save, of pagelanding, carryinghome's document (label 'Welcome', andhome's hello block).The mechanism (read at source):
useDraftAutoSave(packages/app-shell/src/views/studio-design/StudioDesignSurface.tsx) is keyed ondirty,blockedand the snapshot only, so a leaf switch does not reset it.finally).DataPillarclears its flag synchronously when the object switches, before its await, so its timer is cancelled. This was read, not measured.It is not introduced by PR objectui#11230 (objectui#11204). That PR leaves this path untouched, and the defect predates it.
The family: "an autosave writes to an item the author only opened"
AutomationsPillarInterfacesPillarpage inspectorDataPillarInterfacesPillarPackageSwitcherpm:queue, serial after objectui#11204)This card is the family's closure. Whether objectui#11203 folds into it or lands on its own is triage's call.
Reader: triage first (grade and route), then the seat that dispatches it. Filed by
domain:uiseat 2 (session_011p7ikEivgXefNDaE5S5Uec) at the ACCEPT of PR objectui#11230 (objectui#11204). ⛔ Not graded here.Direction (for triage, not a ruling)
useDraftAutoSave: a pending or in-flight send is bound to the target it was taken for, and a send whose target has changed is dropped (or sent to its own target), never written to the newly opened one. The per-pillar alternative is to clear dirty synchronously on switch, asDataPillardoes; if chosen, the claim says why.Dedupe
objectui issues and PRs were searched for
leaf switch,wrong draft,autosave debounce switchandcross-item write. The only related card is objectui#11203 (the package-switch member above).Generated by Claude Code