[objectstack-fleet]

Requested by Sales · project thread

Part of #25921 (the providers/upload fold only; the card's barrel batches and clearSharedDiscoveryCache stay on it).

Clause-②: yes (narrowing)
Metadata-protocol: none
Skills-docs: follow-up #30559

维护者速读

• 改了什么：文件、图片、头像字段的上传上下文 UploadProvider / useUpload 搬进 @object-ui/fields，连 ObjectStack 存储服务的上传适配器搬进 @object-ui/data-objectstack，两边共用的上传契约类型放进 @object-ui/types，@object-ui/providers 整包退役。
• 为什么改：这个包只剩上传一件事，少一个要单独发布和维护的包；访问服务器的取数逻辑回到 data 包里，字段包不再依赖一个只为它存在的包。
• 风险与回滚：上传行为不变，预签名请求逐字节相同，控制台和附件面板照常上传；外部宿主若仍从 @object-ui/providers 导入，升级时编译报错，changeset 写了改从哪里导入。回滚就是 revert 本 PR。
• 先看：ui/packages/fields/src/widgets/UploadProvider.tsx（上下文与无 provider 时的本地回退），ui/packages/data-objectstack/src/upload-adapter.ts（三步上传，与原包代码相同），.changeset/25921-providers-upload-fold.md（BREAKING 说明与迁移行）。
• 两分钟验证：pnpm --dir ui exec vitest run packages/data-objectstack/src/objectstack-upload-scope-12055.test.ts apps/console/src/__tests__/App.uploadAltitude-10131.test.tsx，预期两个文件全部通过。
• 需要你做的：无，席位落地。PR 自身的改动行数（additions+deletions，GitHub 把两处搬移认作改名）是 2482 行，不到 3000 行。

What changes

@object-ui/providers had one job left: the upload context the file, image and avatar widgets of @object-ui/fields upload through, plus the adapters that fill it. This PR moves each piece to the package that owns it and retires the package.

• @object-ui/types gains ui/packages/types/src/upload.ts: the UploadAdapter, UploadOptions and UploadResult interfaces, unchanged in shape. They live here, as DataSource does, because @object-ui/fields and @object-ui/data-objectstack do not depend on each other and both need them.
• @object-ui/fields gains src/widgets/UploadProvider.tsx (UploadProvider, useUpload, UploadProviderProps) and re-exports the three contract types from its entry. AvatarField, FileField and ImageField read it relatively. createObjectUrlAdapter moves in as a module-private function: it is still the blob: fallback useUpload answers with when no provider is mounted, and it is no longer exported.
• @object-ui/data-objectstack gains src/upload-adapter.ts (createObjectStackUploadAdapter, ObjectStackUploadAdapterOptions): fetch logic against an ObjectStack server, so it sits beside the other fetch logic (ui/AGENTS.md section 3). The three-step presign, PUT and complete flow is the original code. Its scope option stays typed as API.UploadScope, and the objectui#12055 test moved with it.
• Retired with no replacement: createS3Adapter, createAzureBlobAdapter, S3AdapterOptions, AzureBlobAdapterOptions. They had zero consumers in the workspace and zero in objectstack-ai/hotcrm (shallow clone at 6961ab1; every upload name 0 hits, while a control name hits). A host that uploads to its own bucket writes an UploadAdapter against @object-ui/types.
• Importers re-pointed: the console App.tsx (import only; the UploadProvider wrap is unchanged), ProfilePage.tsx, app-shell's RecordAttachmentsPanel.tsx, SettingsPage.tsx and one renderer comment, and every test that imported or mocked the package. The @object-ui/providers dependency leaves the console, app-shell and fields manifests, its alias lines leave ui/vitest.config.mts and four vite configs, and it leaves the .changeset/config.json fixed group, the root CONTRIBUTING.md package table, two gate fixture lists and the lockfile (regenerated with pnpm install --lockfile-only, deletions only).
• One gate floor moves: ui/scripts/__tests__/check-doc-links.test.ts counts the decidable links in every package README, and the retired README carried 2 of them (127 on the merge base, 125 here), so its floor moves from 126 to 125 with the measurement in its comment, as the @object-ui/plugin-ai retirement did. The site-absolute floor is unchanged (48 measured, floor 39).
• One PR, no re-export shim, as the seat ruled. Two changesets: 25921-providers-upload-fold.md (fields and data-objectstack, patch, !, BREAKING paragraph, one FROM line naming the package, ADR-0087 marker runtime-export-retired @object-ui/providers#*) and 25921-upload-adapter-contract.md (types, patch, widening).

Changed lines: 2482 on the PR (+350 / −2132, 63 files; GitHub reads the two moved files as renames), under the 3000-line threshold (seat correction; AGENTS.md reads the PR's additions + deletions). dispatch-gates counts with --no-renames, so it counts the moved code once as deleted and once as added and arrives at about 3,200 lines. 2386 of the deletions are the retired package's own nine files (its CHANGELOG.md alone is 1524).

Why

The package existed so the widgets and the console could share one upload context. With the theme, data-source and metadata providers retired earlier (objectui#13453), every remaining export belonged to either the widgets or the ObjectStack data adapter.

Tests

Behaviour is not changed, so the existing tests are the proof; they were re-pointed, not rewritten. All runs on 4e1e0e0e (the scripts/ run first on 15c54522, see Verification), under the shared verify lock:

• pnpm --dir ui exec vitest run packages/fields/ packages/data-objectstack/ packages/types/ packages/cli/src/__tests__/workspace-vite.test.ts: 801 files passed, 1 skipped; 16261 tests passed, 7 skipped. This includes the moved objectui#12055 presign-body test and its compile-time pins.
• pnpm --filter @object-ui/console test (the whole console project, since App.tsx changed): 298 files, 2939 tests passed, including App.uploadAltitude-10131, the three FormPage upload tests and the five ProfilePage tests.
• app-shell and plugin-form upload sites (every views/__tests__/ file, the ActionParamDialog, RecordDetailView, settings and chatbot files that render an upload site, plus WizardForm.nextMidUpload, affordanceGrantMap-12082, uploadInFlightSave): 104 files, 937 tests passed.
• pnpm --dir ui exec vitest run scripts/: on 15c54522 169 files passed and 1 failed, the doc-links floor above (expected 125 to be at least 126). With the floor moved, check-doc-links.test.ts alone passes 123/123; the full rerun on the final head is in the report.

No ablation: nothing tested changed behaviour.

Acceptance notes

• Behaviour is unchanged: UploadProvider, useUpload and createObjectStackUploadAdapter keep their signatures and bodies, and the presign request body is pinned by the moved objectui#12055 test.
• The plugin-form WizardForm.nextMidUpload test used to mock the @object-ui/providers module. A mock of the @object-ui/fields barrel would not reach the widgets, which import ./UploadProvider.js relatively, so the test now mounts the real UploadProvider with a deferred adapter. It drives the same pending upload.
• Mentions of @object-ui/providers this PR leaves alone, because they are outside its file surface or are historical text that stays true:
  • skills/objectui/guides/project-setup.md:249 and :307 (governed; they still tell a reader to install @object-ui/providers for uploads, a follow-up).
  • ui/.claude/skills/objectui-contributor/guides/console-development.md:409 (governed).
  • content/docs/releases/v18/18-2.mdx:374 (release text).
  • The retired package's README held the UploadProvider usage guide. It now lives in ui/packages/fields/README.md (an UploadProvider section) and ui/packages/data-objectstack/README.md (a File Uploads section), added in the patch round (seat correction).
  • Historical comments that stay accurate: ui/packages/types/src/theme.ts:68,77, ui/packages/types/src/__tests__/p2-spec-exports.test.ts:256, ui/scripts/__tests__/one-authority-per-exported-name-6273.test.ts:616, the objectui#4194 error text quoted in ui/packages/plugin-editor/vite.config.ts:64 and ui/packages/plugin-markdown/vite.config.ts:64, and ui/.changeset/13453-*, 13464-*, 13465-*, 25685-* (not read by the root changeset config).

Verification

• Build: turbo run build --filter=@object-ui/console... --filter='./packages/**' --filter='@objectstack/dogfood^...', 113/113 tasks, exit 0 (console tsc and vite build included).
• Type-check, each exit 0: @object-ui/types, fields, data-objectstack, app-shell, plugin-form, console, cli, plugin-editor, plugin-markdown, runner (pnpm --filter PKG run type-check, which compiles each package's tests where it has a test tsconfig).
• dispatch-gates --commands: 60 commands, all run. 59 exit 0; pnpm --dir ui exec vitest run scripts/ exited 1 on 15c54522 for the doc-links floor above, and its rerun on the final head is in the report. check-adr-0087-registration --base origin/main verifies @object-ui/providers#* (package deleted, absent from the workspace and the fixed group). check:type-check-debt exit 0 on the final head.
• Outside the derived list: pnpm --dir ui run check:spec-symbols exit 0; check-platform-checklist --changed-from origin/main exit 0 (0 anchored files); eslint on the 45 changed ui source files, 0 errors (the one react-compiler ref warning in UploadProvider.tsx is the same warning the original file carried).
• hotcrm census: shallow clone of objectstack-ai/hotcrm at 6961ab1, 0 hits for @object-ui/providers, UploadProvider, useUpload, createObjectStackUploadAdapter, createS3Adapter, createAzureBlobAdapter, createObjectUrlAdapter, with a control name hitting.
• The full dogfood battery (the title carries !) runs on the final head under the lock; its count goes in the dev report on retire the zero-consumer surface: nine dead modules (2,211 LOC), plugin-ai, runner's publish flag, test-only reset helpers on public barrels, the providers trio, 122 dead i18n keys, root orphans #25921.
• origin/main has moved 5 commits since the base; git merge-tree --write-tree HEAD origin/main exits 0, and the one shared file (ui/packages/fields/src/index.tsx) is changed in a different region.

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic. (packages/spec untouched.)
• 2. Every name I added uses the casing for its kind.
• 3. No formatter ran; pnpm lint passes. (eslint on every changed ui source file: 0 errors.)
• 4. One issue, one branch off an up-to-date main, one pull request.
• 5. A change that publishes carries a changeset, and both declaration lines are filled in here and in the changeset.
• 6. packages/spec touched: not touched, nothing to regenerate.
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/. (The retired package's CHANGELOG.md is deleted with it, not edited.)
• 8. Title, body and comments are in English. (The body carries the Chinese maintainer summary the dispatch rules require; everything else is English.)
• The Before Submitting list in CONTRIBUTING.md is done.

---

Generated by Claude Code

[objectstack-fleet]

domain:ui#1 · os-sales · session_01L6bhgWn6zhNa4LL7VB1rtL

Contract-review-claim: session_01L6bhgWn6zhNa4LL7VB1rtL · head 4e1e0e0 · 2026-11-05T15:39Z

[objectstack-fleet]

domain:ui#1 · os-sales · session_01L6bhgWn6zhNa4LL7VB1rtL

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 4e1e0e0e34e03e0fa80cd6b6e9ae1588162209e7
Local-runs: none
Scope: .changeset/config.json, CONTRIBUTING.md, pnpm-lock.yaml, ui/apps/console/package.json, ui/apps/console/src/App.tsx, ui/apps/console/src/tests/App.uploadAltitude-10131.test.tsx, ui/apps/console/src/components/FormPage.avatarUpload-10785.test.tsx, ui/apps/console/src/components/FormPage.chromeI18n-11071.test.tsx, ui/apps/console/src/components/FormPage.fileField.test.tsx, ui/apps/console/src/pages/system/ProfilePage.tsx, ui/apps/console/src/pages/system/tests/ProfilePage.access.test.tsx, ui/apps/console/src/pages/system/tests/ProfilePage.appLock-29748.test.tsx, ui/apps/console/src/pages/system/tests/ProfilePage.language.test.tsx, ui/apps/console/src/pages/system/tests/ProfilePage.pageHeader-12553.test.tsx, ui/apps/console/src/pages/system/tests/ProfilePage.sharedSelect-11865.test.tsx, ui/apps/console/vite.config.ts, ui/packages/app-shell/package.json, ui/packages/app-shell/src/console/organizations/tests/settings-slug-environments-11720.test.tsx, ui/packages/app-shell/src/console/organizations/manage/SettingsPage.tsx, ui/packages/app-shell/src/views/ActionParamDialog.avatarUpload-10785.test.tsx, ui/packages/app-shell/src/views/RecordAttachmentsPanel.tsx, ui/packages/app-shell/src/views/tests/FlowRunner.fileField-25801.test.tsx, ui/packages/app-shell/src/views/tests/RecordAttachmentsPanel.affordanceGrant-12047.test.tsx, ui/packages/app-shell/src/views/record-attachments-renderer.tsx, ui/packages/cli/src/tests/workspace-vite.test.ts, ui/packages/data-objectstack/src/index.ts, ui/packages/data-objectstack/src/objectstack-upload-scope-12055.test.ts, ui/packages/data-objectstack/src/upload-adapter.ts, ui/packages/fields/package.json, ui/packages/fields/src/tests/fileRestrictedState-12339.test.tsx, ui/packages/fields/src/index.tsx, ui/packages/fields/src/widgets/AvatarField.fileId-10785.test.tsx, ui/packages/fields/src/widgets/AvatarField.tsx, ui/packages/fields/src/widgets/FileField.tsx, ui/packages/fields/src/widgets/GridField.test.tsx, ui/packages/fields/src/widgets/ImageField.imageAlt-10637.test.tsx, ui/packages/fields/src/widgets/ImageField.maxSize.test.tsx, ui/packages/fields/src/widgets/ImageField.tsx, ui/packages/fields/src/widgets/ImageField.uploadFailure.test.tsx, ui/packages/fields/src/widgets/UploadProvider.tsx, ui/packages/fields/src/widgets/fileSubmitRequiresId-7699.test.tsx, ui/packages/fields/src/widgets/nativeImagePick.shellPhoto.test.tsx, ui/packages/fields/src/widgets/uploadingScope.hold.test.tsx, ui/packages/plugin-editor/vite.config.ts, ui/packages/plugin-form/src/WizardForm.nextMidUpload.test.tsx, ui/packages/plugin-markdown/vite.config.ts, ui/packages/providers/LICENSE, ui/packages/providers/README.md, ui/packages/providers/package.json, ui/packages/providers/src/index.ts, ui/packages/providers/tsconfig.json, ui/packages/providers/tsconfig.test.json, ui/packages/runner/vite.config.ts, ui/packages/types/src/index.ts, ui/packages/types/src/upload.ts, ui/scripts/tests/check-doc-links.test.ts, ui/scripts/tests/side-effects-declaration-consistency.test.ts, ui/vitest.config.mts + ui/packages/providers/src/UploadProvider.tsx and ui/packages/providers/src/tests/objectstack-upload-scope-12055.test.ts (the rename sources, read on origin/main as the published spec), ui/packages/data-objectstack/package.json, ui/packages/data-objectstack/tsconfig.json, ui/packages/types/package.json, ui/packages/types/tsconfig.json, ui/packages/fields/tsconfig.json, ui/packages/plugin-form/package.json, ui/packages/fields/README.md, ui/apps/console/src/AppContent.tsx, skills/objectui/guides/project-setup.md, ui/scripts/tests/one-authority-per-exported-name-6273.test.ts, scripts/pm/clause2-line.mjs, scripts/pm/check-owed-reviews.mjs, scripts/check-changeset-no-major.mjs (cited code, read to judge, not reviewed)

Inputs: card #25921 body and all 71 comments; PR #30550 body, file list (61 files, +308/−2132 net; 3186 changed lines under the dispatch count) and the net diff against origin/main (35a8f088) at the head above; the 57 check-runs on the head. Gate verdicts, read off the check-runs: every required context is success (Lint & Repo Gates, TypeScript Type Check, Test Core, Build Core, Governed Surface Queue Guard, Lint UI, Type Check UI, Test UI and its 16 shards, Build & E2E UI, Live E2E UI); Check Changeset, PR-body guards, Check PR Size, Validate Package Dependencies, Check Documentation Links, Dogfood Regression Gate, Auto Label success; the rest skipped by the selector; zero failures. The PR is a draft by objectstack-fleet[bot] (relay), head repo = base repo, no governed path; over 3,000 changed lines, so it lands only by an authorized approval after the seat's ACCEPT (AGENTS.md §7 (c)); this record does not change that.

① Derived judgments

1. @object-ui/types entry gains UploadResult, UploadOptions, UploadAdapter (src/upload.ts, type-only, byte-equal in shape to the three interfaces leaving providers/src/UploadProvider.tsx). Public-surface widening. Right: the package keeps "zero deps, no React" (the file imports nothing; File | Blob comes from the DOM lib already in its tsconfig), and it is the one place both fields and data-objectstack can read without depending on each other, as DataSource already shows.
2. @object-ui/fields entry gains UploadProvider, useUpload, UploadProviderProps and re-exports the three contract types from @object-ui/types. Widening. Right: one declaration re-exported, not a second copy; the only UploadProvider export in the tree (grep over ui/packages and ui/apps at the head); the three widgets read it relatively through ./UploadProvider.js with the .js extension the package's nodenext tsconfig demands.
3. @object-ui/data-objectstack entry gains createObjectStackUploadAdapter and ObjectStackUploadAdapterOptions (src/upload-adapter.ts). Widening. Right home (ui/AGENTS.md §3: fetch logic against the server lives in data-*); the body is the original three-step presign, PUT, complete flow with uploadWithProgress and xhrUpload unchanged apart from two comment lines, scope still typed API.UploadScope, and the objectui#12055 request-body pin moved with it into the package's test program (tsconfig.json includes src/**/*, type-check is tsc --noEmit; build is tsup from index.ts, so the test does not ship).
4. @object-ui/providers leaves the workspace, the changeset fixed group, the manifests of console, app-shell and fields, five alias tables, two gate fixtures, the CONTRIBUTING row and the lockfile (deletions only). Public-surface narrowing: a published package stops at 18.3.0. Right under the card's recommendation and the maintainer's filing word; the whole-package ADR-0087 operand @object-ui/providers#* is the D9 spelling the plugin-ai precedent landed, and Check Changeset is green on it.
5. createS3Adapter, createAzureBlobAdapter, S3AdapterOptions, AzureBlobAdapterOptions retire with no replacement. Narrowing. Right under the card's zero-consumer rule as the claim allowed it: 0 consumers in this tree, 0 in hotcrm 6961ab1 with a hitting control; npm dependents not measured, which the card body itself records; the changeset carries the FROM → TO line (an object with name and upload against @object-ui/types' UploadAdapter).
6. createObjectUrlAdapter becomes module-private in fields/src/widgets/UploadProvider.tsx. Narrowing. Right: on main it was documented as a no-crash default and not an upload destination, and the widgets refuse its result (objectui#7699), so no consumer could use it as a capability.
7. Behaviour of UploadProvider / useUpload: the context, the adapterRef + effect, the memoised value and the no-provider fallback are the same code. No accept-set change. One consequence judged right: a host that mocked the old package's useUpload to reach the widgets must now mount the real UploadProvider (the widgets import the module relatively, so a mock of the @object-ui/fields barrel never reaches them); the WizardForm.nextMidUpload test shows the shape, and the context, not the barrel, was always the contract.
8. Importers re-pointed with their dependencies declared: console App.tsx and ProfilePage.tsx (console manifest carries @object-ui/data-objectstack and @object-ui/fields), app-shell RecordAttachmentsPanel.tsx and SettingsPage.tsx (app-shell manifest carries both), plugin-form's test (@object-ui/fields declared). No undeclared import, no cycle: fields depends on types; data-objectstack on types, core, client; neither on the other.
9. check-doc-links decidable floor 126 → 125 with the measurement in its comment (the retired README's 2 decidable, 0 site-absolute links). Right, by the c59b1bfa precedent; the site-absolute floor stays at 39.
10. workspace-vite alias pin (five → four) and the side-effects fixture lose the entry. Right: the alias table is derived from the dependency scan, and nothing in ui/packages/cli/src names the package any more.

② Semver level

• .changeset/25921-providers-upload-fold.md: @object-ui/fields patch, @object-ui/data-objectstack patch, title with !, BREAKING paragraph, one FROM line naming the package, the ADR-0087 runtime-export-retired @object-ui/providers#* disposition, Metadata-protocol: none. Level right: nothing an author writes moves, so none takes patch, and a breaking non-protocol change ships patch with its banner and disposition (AGENTS.md Post-Task step 3). Disposition right: a deleted package cannot be named in frontmatter, so bumping the two receivers is the only landable shape.
• .changeset/25921-upload-adapter-contract.md: @object-ui/types patch, yes (widening), none. Right: a pure type widening, none kind.
• The direction arm on the fold changeset and on the PR body reads yes (widening). WRONG, must-fix. scripts/pm/clause2-line.mjs fixes the closed set: yes (widening) is "a widening, said out loud", and the spelling for "a diff that widens one surface and narrows another" is yes (narrowing), where "both facts are true and both are read". This diff retires a published package, three exported factories and two option types (①4–6): the breaking narrowing is a fact the arm exists to carry, and (widening) leaves it undeclared in the one machine-read place. Consequences measured in the tree: scripts/pm/check-owed-reviews.mjs owedFace routes a yes body without the (narrowing) arm to the declaration limb at TIER_DEFAULT, not to narrowing, so the review this record renders is owed by a face the PR's own declaration denies; record-recognisers --template --paths over this file list refuses to derive the face and says the changeset's arm decides it; the clause2-line docblock names a narrowing shipping "with every gate green" because breaking-ness was read off a prose banner alone as the defect the arm closes. The card's own precedent treats this class as a FAIL: director record 6585079783 on refactor(ui)!: retire plugin-designer's dead collaboration code, VersionHistory and the useConfirmDialog entry export #29529 failed a wrong arm spelling and amendment 6585097086 corrected it. Remedy: the changeset line becomes Clause-②: yes (narrowing) (the dev pushes it) and the seat patches the PR body's line to match; Metadata-protocol: none and the patch levels stay. With the (narrowing) arm in place the PR body also owes the third line pm-dispatch SKILL.md names, Skills-docs: follow-up owed — skills/objectui/guides/project-setup.md, rewritten to #N once the seat files the governed card (③ below).

③ Boundary flags

Dev report 6662170794: open_questions is empty; seven deviations and five out-of-scope findings, each answered here.

• Deviation 1 (the doc-links floor outside the claim): stopped, reported, added by amendment 6661629147 before the push. Answered; the floor move is judged right in ①9.
• Deviation 2 (one ! changeset for the two receivers plus a separate types changeset, not one per package touched): answered; this is the only shape a deleted package admits, and the levels are right (②).
• Deviation 3 (two pushes): answered, no bearing.
• Deviation 4 (wrong session id in the first seat message, corrected in amendment 6660272388): answered, no bearing.
• Deviation 5 (origin/main five commits ahead, not merged; merge-tree --write-tree clean; the one shared file fields/src/index.tsx moves in another region): answered; a main merge before the queue is the usual pre-landing step, no review bearing.
• Deviation 6 (no assignee, no reviewer): answered; the dispatch forbids both.
• Deviation 7 (Human Minimum item 8 unchecked for the Chinese maintainer block): answered; the block is the dispatch's requirement.
• Out-of-scope 1 (skills/objectui/guides/project-setup.md still tells a reader to install @object-ui/providers for uploads, two lines): escalated. The skill ships in @objectstack/skills and is governed (Tier H), so it is a separate card, as the plugin-ai batch did with skills/objectui guides still teach @object-ui/plugin-ai, a package retired by #25921 (PR #27042) #27048. The seat files it before ACCEPT and names it on the PR body's Skills-docs: line (②). Should-fix, carried in ④.
• Out-of-scope 2 (ui/.claude/skills/objectui-contributor/guides/console-development.md historical sentence): answered; it goes on the same governed follow-up.
• Out-of-scope 3 (content/docs/releases/v18/18-2.mdx names the trio): answered; release text, never edited in a code PR.
• Out-of-scope 4 (the retired README held the only UploadProvider usage guide; fields/README.md names the pipeline without an import line): escalated as should-fix in ④.
• Out-of-scope 5 (ui/.changeset/ pre-merge notes naming the package): answered; the root config does not read that directory (ui/AGENTS.md §9).
• Author: objectstack-fleet[bot] through the relay; no non-relay login to name.

④ Design judgment

The narrowing, read against the published spec on origin/main (ui/packages/providers/README.md and src/index.ts): the capability the spec declares to a consumer is one ambient upload context the file, image and avatar widgets upload through, filled by the ObjectStack three-step adapter or any object with name and upload. After this PR that capability is delivered whole from @object-ui/fields and @object-ui/data-objectstack, with the contract in @object-ui/types: nothing is narrowed at a consumer, and no declared-but-undelivered capability is papered over. The two cloud-bucket factories were declared and delivered; the PR retires them as a published capability with zero measured consumers and a migration line, which is the retirement arm of the rule, not a consumer-side narrowing. Attempts to break it: a host on @object-ui/providers@18.3.0 beside the new fields mounts a different React context, so its adapter would be invisible to the widgets, and the changeset's instruction to drop the dependency and import from fields is exactly the fix; the dependency graph has no cycle (①8); fields' sideEffects: false holds (a module-level createContext is pure); UploadOptions.path now documents an adapter that no in-tree factory reads, harmless since host adapters may; the createObjectUrlAdapter() mentions left in console App.tsx, AppContent.tsx and the 10131 test name a now module-private function by symbol, which still reads true. Nothing here breaks.

Findings:

• Must-fix (the ② arm): the diff's narrowing is undeclared in the machine-read direction arm; yes (widening) on the fold changeset and the PR body becomes yes (narrowing), and the PR body gains the Skills-docs: line. A FAIL until the arm is corrected on a new head; a delta re-review of that head suffices.
• Should-fix (docs, ui/AGENTS.md ✨ Set up Copilot instructions #2): the PR deletes the only UploadProvider wiring guide and adds none. ui/packages/fields/README.md should carry the usage block (import UploadProvider from @object-ui/fields, the adapter from @object-ui/data-objectstack, the no-provider fallback refuses every pick), and ui/packages/data-objectstack/README.md should name createObjectStackUploadAdapter and its scope option; otherwise a docs follow-up card named on the PR before landing.
• Should-fix (governed follow-up): skills/objectui/guides/project-setup.md lines teaching @object-ui/providers for uploads, plus the ui/.claude console guide sentence, go on one Tier H card the seat files before ACCEPT, named on the Skills-docs: line.

Implemented-by: claude/project-thread-dwlhqu
Reviewed-by: session_01L6bhgWn6zhNa4LL7VB1rtL

VERDICT: FAIL

[objectstack-fleet]

domain:ui#1 · os-sales · session_01L6bhgWn6zhNa4LL7VB1rtL

Contract-review-claim: session_01L6bhgWn6zhNa4LL7VB1rtL · head 6f59446 · 2026-11-05T16:18Z

[objectstack-fleet]

domain:ui#1 · os-sales · session_01L6bhgWn6zhNa4LL7VB1rtL

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 6f59446163b3e4b6f22017eb7b7be12a2eecb7f5
Local-runs: none
Scope: .changeset/config.json, CONTRIBUTING.md, pnpm-lock.yaml, ui/apps/console/package.json, ui/apps/console/src/App.tsx, ui/apps/console/src/tests/App.uploadAltitude-10131.test.tsx, ui/apps/console/src/components/FormPage.avatarUpload-10785.test.tsx, ui/apps/console/src/components/FormPage.chromeI18n-11071.test.tsx, ui/apps/console/src/components/FormPage.fileField.test.tsx, ui/apps/console/src/pages/system/ProfilePage.tsx, ui/apps/console/src/pages/system/tests/ProfilePage.access.test.tsx, ui/apps/console/src/pages/system/tests/ProfilePage.appLock-29748.test.tsx, ui/apps/console/src/pages/system/tests/ProfilePage.language.test.tsx, ui/apps/console/src/pages/system/tests/ProfilePage.pageHeader-12553.test.tsx, ui/apps/console/src/pages/system/tests/ProfilePage.sharedSelect-11865.test.tsx, ui/apps/console/vite.config.ts, ui/packages/app-shell/package.json, ui/packages/app-shell/src/console/organizations/tests/settings-slug-environments-11720.test.tsx, ui/packages/app-shell/src/console/organizations/manage/SettingsPage.tsx, ui/packages/app-shell/src/views/ActionParamDialog.avatarUpload-10785.test.tsx, ui/packages/app-shell/src/views/RecordAttachmentsPanel.tsx, ui/packages/app-shell/src/views/tests/FlowRunner.fileField-25801.test.tsx, ui/packages/app-shell/src/views/tests/RecordAttachmentsPanel.affordanceGrant-12047.test.tsx, ui/packages/app-shell/src/views/record-attachments-renderer.tsx, ui/packages/cli/src/tests/workspace-vite.test.ts, ui/packages/data-objectstack/README.md, ui/packages/data-objectstack/src/index.ts, ui/packages/data-objectstack/src/objectstack-upload-scope-12055.test.ts, ui/packages/data-objectstack/src/upload-adapter.ts, ui/packages/fields/README.md, ui/packages/fields/package.json, ui/packages/fields/src/tests/fileRestrictedState-12339.test.tsx, ui/packages/fields/src/index.tsx, ui/packages/fields/src/widgets/AvatarField.fileId-10785.test.tsx, ui/packages/fields/src/widgets/AvatarField.tsx, ui/packages/fields/src/widgets/FileField.tsx, ui/packages/fields/src/widgets/GridField.test.tsx, ui/packages/fields/src/widgets/ImageField.imageAlt-10637.test.tsx, ui/packages/fields/src/widgets/ImageField.maxSize.test.tsx, ui/packages/fields/src/widgets/ImageField.tsx, ui/packages/fields/src/widgets/ImageField.uploadFailure.test.tsx, ui/packages/fields/src/widgets/UploadProvider.tsx, ui/packages/fields/src/widgets/fileSubmitRequiresId-7699.test.tsx, ui/packages/fields/src/widgets/nativeImagePick.shellPhoto.test.tsx, ui/packages/fields/src/widgets/uploadingScope.hold.test.tsx, ui/packages/plugin-editor/vite.config.ts, ui/packages/plugin-form/src/WizardForm.nextMidUpload.test.tsx, ui/packages/plugin-markdown/vite.config.ts, ui/packages/providers/LICENSE, ui/packages/providers/README.md, ui/packages/providers/package.json, ui/packages/providers/src/index.ts, ui/packages/providers/tsconfig.json, ui/packages/providers/tsconfig.test.json, ui/packages/runner/vite.config.ts, ui/packages/types/src/index.ts, ui/packages/types/src/upload.ts, ui/scripts/tests/check-doc-links.test.ts, ui/scripts/tests/side-effects-declaration-consistency.test.ts, ui/vitest.config.mts + ui/packages/providers/src/UploadProvider.tsx and ui/packages/providers/src/tests/objectstack-upload-scope-12055.test.ts (the rename sources, read on origin/main as the published spec), ui/packages/data-objectstack/package.json, ui/packages/data-objectstack/tsconfig.json, ui/packages/types/package.json, ui/packages/types/tsconfig.json, ui/packages/fields/tsconfig.json, ui/packages/plugin-form/package.json, ui/packages/fields/src/widgets/file-value.ts, ui/packages/fields/src/widgets/upload-error-message.ts, ui/packages/i18n/src/locales/en.ts, ui/apps/console/src/AppContent.tsx, skills/objectui/guides/project-setup.md, ui/scripts/tests/one-authority-per-exported-name-6273.test.ts, scripts/pm/clause2-line.mjs, scripts/pm/check-owed-reviews.mjs, scripts/check-changeset-no-major.mjs, scripts/pm/check-governed-merges.mjs (cited code, read to judge, not reviewed)

Delta review by the same reviewer on the head after record 6662493953 (FAIL at 4e1e0e0e). The delta is one commit, 6f594461, three files, +43/−1: the fold changeset's direction line, a new UploadProvider section in ui/packages/fields/README.md, a new File Uploads section in ui/packages/data-objectstack/README.md. No source, test, manifest, lockfile or gate file moves; the net diff against origin/main is otherwise the one judged in 6662493953, so ①–④ below restate that judgment where it stands and judge the delta where it changes something.

Inputs: card #25921 body and all 73 comments (the two new ones: amendment 4 6662522527 and the patch-round os-dev-report 6663027806); follow-up card #30559 (filed, pm:queue, domain:skills, Tier H skills/**); PR #30550's patched body, file list (63 files, +350/−2132 on the PR object) and the two diffs (origin/main...6f594461, 4e1e0e0e..6f594461); the 58 check-runs on the new head. Gate verdicts read at review time: 19 success (among the required contexts: Test Core, Governed Surface Queue Guard, Live E2E UI; also Check Changeset on the push run 42062476513, Check PR Size, PR-body guards, Validate Package Dependencies, Check Documentation Links, Dogfood Regression Gate, Lint · ESLint, Lint · repo & tooling gates, Type Check · workspace / source gates / debt ledger), 10 skipped by the selector, 1 cancelled (the Check Changeset run 42062906538 that a PR-body edit at 16:17Z triggered, superseded by the next body-edit run 42063024585 at 16:19Z; the push run's Check Changeset had already concluded success at 16:17:24Z, and the superseding run is in progress). Still in progress when read: Build & E2E UI, Build Core, Build Docs, Lint UI, Type Check UI, Test UI 1–16, the Lint & Repo Gates sub-jobs (CI/release/engine, PM dispatch-gates, docs & code guards, slot lookup & corpus, tooling self-tests), Type Check · consumer gates and the third Check Changeset. Nothing has failed. The delta touches no file those contexts compile or test beyond two README code fences, which the dev reports check:doc-snippets compiled (536/536) and ablated (an absent import name reds it); the landing still waits for those contexts to conclude success, per contract-review.md ②, and this record does not stand in for them.

① Derived judgments

Unchanged from 6662493953, items 1–10, all judged right: the three widenings (@object-ui/types gains the three contract types; @object-ui/fields gains UploadProvider, useUpload, UploadProviderProps and re-exports the types; @object-ui/data-objectstack gains createObjectStackUploadAdapter and its options), the narrowings (@object-ui/providers retired at 18.3.0 with the D9 whole-package operand; createS3Adapter, createAzureBlobAdapter and their option types retired at zero measured consumers with a FROM → TO line; createObjectUrlAdapter module-private), the unchanged behaviour of the context and the adapter, the declared dependencies with no cycle, the doc-links floor and the two fixtures. The delta adds no accept-set or public-surface change: a changeset body line and two README sections publish nothing a compiler or a runtime reads.

Delta judgments on what the READMEs now claim, read against the code at the head: fields/README.md says the widgets upload through the nearest UploadProvider's adapter read by useUpload(), that any object with name and upload(file, options) typed by UploadAdapter from @object-ui/types is a destination (the package re-exports the three types), and that with no provider the hook falls back to a local blob: adapter whose result the widgets refuse because it carries no sys_file id, surfacing an "upload did not complete" error and storing nothing. Right on every point: useUpload in widgets/UploadProvider.tsx answers ctx ?? fallback with createObjectUrlAdapter(), fileValueForSubmit in widgets/file-value.ts throws UploadIncompleteError on a result with no id, upload-error-message.ts renders it through fields.file.uploadIncomplete, whose English text in i18n/src/locales/en.ts reads "Upload of ... did not complete: no file id was returned, so nothing was saved". The code fence imports UploadProvider from @object-ui/fields and createObjectStackUploadAdapter from @object-ui/data-objectstack, both real exports at the head. data-objectstack/README.md says the adapter presigns, PUTs, completes (registering the sys_file row), answers the stable /files/FILE_ID URL with the id in meta.fileId, and that scope is typed API.UploadScope and omitted when unset so the server applies its default. Right: upload-adapter.ts returns url: apiUrl(path + '/files/' + encodeURIComponent(fileId)) and meta: { fileId, scope: opts.scope }, and sends scope: opts.scope, which JSON.stringify drops when undefined.

② Semver level

• .changeset/25921-providers-upload-fold.md: levels unchanged (@object-ui/fields patch, @object-ui/data-objectstack patch), ! title, BREAKING paragraph, the one FROM line, the runtime-export-retired @object-ui/providers#* disposition, Metadata-protocol: none. Right, as before.
• The direction line now reads yes (narrowing) followed by an em-dash and the reasoning that names what the two receivers gain and what the retirement takes. Right: this is the one spelling scripts/pm/clause2-line.mjs gives a diff that widens one surface and narrows another, the arm token is the first thing inside the parenthetical as readArmToken requires, and trailing reasoning after the arm is kept, not read. The PR body's line matches (yes (narrowing)), the types changeset keeps yes (widening) (a pure widening), and the dev reports check-adr-0087-registration --base origin/main and check-changeset-no-major exit 0 on the new head; the push run's Check Changeset is success. The must-fix of 6662493953 is closed.
• The PR body now carries Skills-docs: follow-up #30559, the third line pm-dispatch SKILL.md owes a (narrowing) arm, pointing at the filed governed card. Right.

③ Boundary flags

Patch-round report 6663027806: no open_questions; one deviation, answered: the first push printed a cut "failed to push some refs" and the retry pushed 4e1e0e0e..6f594461 cleanly, so the branch holds exactly one new commit (read off git log between the two heads). The report's dogfood_battery: not rerun is right: the delta changes a changeset body and two READMEs, none of which the battery builds or reads; the 4e1e0e0e reading stands for the code.

The three findings of 6662493953, each closed:

• Must-fix (the direction arm): closed by the changeset line and the PR body line (② above).
• Should-fix (docs, ui/AGENTS.md ✨ Set up Copilot instructions #2): closed by the fields/README.md UploadProvider section with the wiring block and the data-objectstack/README.md File Uploads section; both judged accurate against the code in ①.
• Should-fix (governed guide): closed as a follow-up by skills: the objectui project-setup guide still sends a third-party app to @object-ui/providers for uploads, a package PR #30550 retires #30559, which names the two project-setup.md lines, the three new homes, and starts after this PR merges; the PR body names it on the Skills-docs: line. The ui/.claude console-guide sentence is not named on skills: the objectui project-setup guide still sends a third-party app to @object-ui/providers for uploads, a package PR #30550 retires #30559; it is a historical sentence that stays true, so nothing is owed for it.

One stale sentence, not a finding: the PR body's Acceptance notes still say the retired README held the only usage guide and "no package README carries it now ... A docs follow-up", which the delta made untrue. The seat may trim it when it next patches the body; it misleads nobody about the tree.

The seat's size reading, judged as asked and outside the verdict: the rule text is AGENTS.md §7 (c), "changed lines exceed 3,000 (additions + deletions, generated files included)", and scripts/pm/check-governed-merges.mjs states where the number comes from: "The count is GitHub's additions + deletions on the PR — the number the API and the size labeller report"; --pr reads the pair off GET /pulls/{n}, and the queue guard's size leg hands the pull object's pair to testVerdict, HUMAN_MERGE_LINE_THRESHOLD strictly greater. On that reading the PR is +350/−2132 = 2,482, under the line, so the seat's correction of my earlier record is right and the PR may land through the queue on the seat's ACCEPT; I withdraw the "authorized approval" sentence. One thing the same header says, so the seat is not surprised afterwards: the post-merge sweep decides its listing on the LANDED number with --no-renames, which "counts a rename as a delete plus an add ... and so never reads under GitHub's", printing GitHub's pair beside it when the two differ. The dev's --no-renames reading is 3,228, so the audit row for this landing will show 3,228 beside 2,482 on the size limb. That is the instrument's documented behaviour, not a finding against the PR; the ACCEPT can name both numbers so the audit reads as expected.

Author: objectstack-fleet[bot] through the relay; no non-relay login to name.

④ Design judgment

Unchanged from 6662493953: the narrowing takes no declared capability away at a consumer; the upload context and the ObjectStack adapter are delivered whole from their new homes with the contract in @object-ui/types; the two cloud-bucket factories retire as a declared capability with zero measured consumers and a migration line, the retirement arm of the rule; the mixed-version host, the dependency graph, sideEffects: false, the UploadOptions.path doc and the createObjectUrlAdapter() mentions all hold. The delta strengthens the consumer side: the published READMEs now teach the wiring the retired README taught, from the packages that own it, and the fence compiles against the real entries. Nothing new to break: README prose and a changeset body carry no runtime or type surface.

Findings: none. The must-fix and both should-fixes of 6662493953 are closed on this head (③).

Implemented-by: claude/project-thread-dwlhqu
Reviewed-by: session_01L6bhgWn6zhNa4LL7VB1rtL

VERDICT: PASS

[objectstack-fleet]

domain:ui#1 · os-sales · session_01L6bhgWn6zhNa4LL7VB1rtL

维护者速读

• 改了什么：文件、图片、头像字段的上传上下文 UploadProvider / useUpload 搬进 @object-ui/fields，连 ObjectStack 存储服务的上传适配器搬进 @object-ui/data-objectstack，两边共用的上传契约类型放进 @object-ui/types，@object-ui/providers 整包退役；没人用的 S3、Azure 两个适配器随包退役。两个包的 README 补上了接线说明。
• 为什么改：这个包只剩上传一件事，少一个要单独发布和维护的包；访问服务器的取数逻辑回到 data 包里，字段包不再依赖一个只为它存在的包。
• 风险与回滚：上传行为不变，预签名请求逐字节相同，控制台和附件面板照常上传；外部宿主若仍从 @object-ui/providers 导入，升级时编译报错，changeset 写了改从哪里导入。回滚即撤本 PR。
• 先看：ui/packages/fields/src/widgets/UploadProvider.tsx，ui/packages/data-objectstack/src/upload-adapter.ts，.changeset/25921-providers-upload-fold.md（BREAKING 说明与迁移行）。
• 两分钟验证：pnpm --dir ui exec vitest run packages/data-objectstack/src/objectstack-upload-scope-12055.test.ts apps/console/src/__tests__/App.uploadAltitude-10131.test.tsx，预期两个文件全部通过。
• 需要你做的：无，席位落地。
• 席位意见：可合。达档契约复核在本 head PASS；本 PR 只交卡上的 providers 上传这一批（Part of），卡上其余批次由 domain:ui#6 的认领承载。

席位核对 — ACCEPT · head 6f59446

• 形态：63 文件，PR 对象 +350/−2132 = 2482 行。check-governed-merges --pr 30550：NOT governed，≤ 3000，走普通合并队列（AGENTS.md §7 (c) 读 PR 的 additions+deletions；GitHub 把两处搬移认作改名）。dispatch-gates 的 --no-renames 口径是 3228 行，合并后巡检的审计行会两数并列，这是该工具写明的行为；席位修正 2 里"超 3000 行、走授权批准"的判断据此撤回。Part of #25921（只交 providers 上传这一批，卡上的 barrel 批次与 clearSharedDiscoveryCache 留在卡上），目标 main。
• 契约：fold changeset Clause-②: yes (narrowing)（加导出并退役整包，scripts/pm/clause2-line.mjs 的拼法），types changeset yes (widening)，PR 正文 yes (narrowing)，Metadata-protocol: none，Skills-docs: follow-up #30559（受管的技能指南后续卡，已立）。CONTRACT_REVIEW_TIER 复核：首轮 FAIL 6662493953（head 4e1e0e0e，申报拼错，是席位修正 2 的笔误），补丁轮后 delta 复核 PASS 6663204424（钉本 head），三条发现全部关闭。ADR-0087 处置 runtime-export-retired @object-ui/providers#*。
• 前提实测：dev 报告 6662170794、补丁轮报告 6663027806。hotcrm 6961ab1 对每个上传名零命中（对照名有命中），工作区零消费者；终 head 派生门禁 60/60 exit 0、0 NOT-MEASURED；文档门禁（doc-snippets 536/536，README 新代码块经消融证实被编译）全 exit 0；dogfood 全量在 4e1e0e0e exit 0（420 文件过 3 跳过），补丁轮只动 changeset 正文和两个 README，电池不读这些文件，按席位裁定不重跑。
• 门禁 check-runs：head 上 69 个 run：54 success，14 skipped（选择器按路径跳过），1 cancelled。cancelled 的是 16:17Z 一次正文编辑触发的 Check Changeset，被随后的同名 run 取代；本 head 上其余三次 Check Changeset 都是 success，最后一次在 16:26Z。0 红。Lint & Repo Gates、TypeScript Type Check 均为 success。mergeable_state clean。
• 接受的偏差：一张 ! changeset 覆盖两个接收包，types 另起一张（已删的包写不进 frontmatter）；check-doc-links 的 decidable 下限 126 → 125（修正 3，照 c59b1bfa 先例）；PR 正文三处（申报行、Skills-docs: 行、行数段与 README 一句）由席位按终 head 改写。
• 范围外去向：受管技能指南 skills/objectui/guides/project-setup.md:249、:307 → skills: the objectui project-setup guide still sends a third-party app to @object-ui/providers for uploads, a package PR #30550 retires #30559（本 PR 合并后开工）。ui/.claude 控制台指南里那句是历史陈述，仍然成立，不改。content/docs/releases/v18/18-2.mdx 是发版文字，不在代码 PR 里改。
• 落地条款：中继 pr_ready + automerge_enable。Part of：卡不关；domain:ui#6 的认领 6660204183 仍在飞，所以 pm:dispatched 与指派不动，席位只为本批留一条 Release 评论。