Re-pin the fluttersdk stack to the 2026-09-27 batch

[anilcancakir]

Re-pins the boilerplate to the 2026-09-27 batch and proves the stack runs together on the graph a fork resolves.

Pins

Package	From	To
magic	^0.0.16	^0.0.22
magic_starter	^0.0.35	^0.0.37
magic_notifications	^0.3.4	^0.3.5
magic_deeplink	^0.1.3	^0.1.4
magic_social_auth	^0.0.5	^0.0.6
magic_devtools	^0.0.6	^0.0.7
fluttersdk_dusk	^0.0.15	^0.0.16
fluttersdk_telescope, fluttersdk_artisan	^0.0.7, ^0.0.16	unchanged, newest
backend fluttersdk/magic-starter-laravel	^0.0.10	^0.0.12

magic_payments (0.0.5) and fluttersdk_wind (1.7.0) arrive transitively. The Composer pin lagged two releases because Composer's caret on 0.0.x pins the patch; composer update fluttersdk/magic-starter-laravel (not -W) moved that package and nothing else. pubspec.lock carries no /Users/ path.

A code change the re-pin needed

magic_starter 0.0.37 removed SessionScopedController and SessionScopeSync; magic 0.0.22 owns session scoping now. On the new graph flutter analyze failed with implements_non_class in dashboard_controller.dart and undefined_identifier for SessionScopeSync in app_service_provider.dart. DashboardController implements magic's SessionScoped (same single resetForSession() member), the provider calls SessionScope.attach() (same call-it-last contract), and .claude/rules/flutter-app.md says the same. magic_starter still sets the <userId>:<teamId> identity, so a team switch still counts.

Backend config

config/magic-starter.php republished from 0.0.12 with only the app's own lines reapplied: the Features import, use_uuids => false, and the five enabled features. The diff against vendor shows exactly those. The stale ui_avatars_url block, which 0.0.11 removed, is gone. The notifications rekey migration this app already carries matches 0.0.12's apart from Pint's concatenation spacing.

Skill mirrors

.github/skills/magic-framework (skill 0.1.51) and .github/skills/wind-ui (2.20.0), synced in a scratch workspace with magic and wind checked out at the 0.0.22 and 1.7.0 tags; bin/sync-skills --check is clean there.

Gates

On the hosted graph (no pubspec_overrides.yaml): flutter analyze --no-pub no issues, flutter test 30 passed, bin/design-tokens clean, bin/sync-registry --check current, bin/parse-overrides-test.py 31/31. Backend: pint --test passed, php artisan test 9 passed, migrate --pretend nothing to run. CHECK_ALLOW_HOSTED=1 bin/check --fast is not the evidence here: from a worktree it copies the main checkout's pubspec_overrides.yaml, which points at sibling working trees on older commits, so it analyzed a different graph.

Live check

Backend on :8000, app via ./bin/fsa start --device=chrome, no overrides:

• Boot log clean apart from the known web-only OneSignal must be initialized before login. A guest landed on /auth/login, so every route middleware alias resolved at Magic.init.
• Registered Sweep Tester through the UI (Sign up, four fields, Create Account). Auth.check() answered true, location /.
• The dashboard greets "Welcome back, Sweep Tester" under a created "Sweep's Team", sidebar and account footer in place: the SessionScoped dashboard controller reloaded for the new session.
• /settings renders every section; dusk:exceptions 0.
• The backend served /api/v1/auth/register and /api/v1/notifications.

[kodizm]

Note

Kodizm (AI-generated). May contain mistakes; verify before acting.

Blocked by a stale generated mirror; the re-pin itself is sound.

Major

.github/instructions/flutter-app.instructions.md: this is generated from .claude/rules/flutter-app.md by bin/sync-instructions, but the PR edited the source rule (dropping SessionScopedController/SessionScopeSync for magic's SessionScoped/SessionScope) without regenerating the mirror. The mirror still names the removed classes. AGENTS.md is explicit that this mirror is checked by CI, not bin/check, and that's exactly what's failing: the "Instruction mirrors" check reports conclusion: failure (annotation at .github:18, exit code 1). Run bin/sync-instructions and commit the regenerated file.

No other findings: dashboard_controller.dart and app_service_provider.dart correctly follow the updated rule (implement SessionScoped, call SessionScope.attach() last in boot()), no leftover references to the removed SessionScopedController/SessionScopeSync remain anywhere in lib/, the magic-starter.php config diff only removes the ui_avatars_url block the PR description says 0.0.11 dropped, and the version pins in pubspec.yaml/composer.json match the description's table.

Tests

flutter test and the backend PHP suite both passed per CI; the description also reports a manual dusk-driven session-switch/dashboard check, though I can't independently verify that live run.

CI

• Instruction mirrors: failure (exit code 1 on .github, stale flutter-app.instructions.md)
• Published graph (hosted resolution): success
• Flutter (analyze + test): success
• Design tokens: success
• Backend (pint + tests): success
• Auto-merge low-risk Dependabot PRs: skipped (not applicable)

[anilcancakir]

Round 1 fix:

• Major, .github/instructions/flutter-app.instructions.md (stale generated mirror): fixed in 7ca4b09. Ran bin/sync-instructions; it rewrote only that mirror, which now names magic's SessionScoped / SessionScope.attach() like its source .claude/rules/flutter-app.md. bin/sync-instructions --check prints "mirrors are up to date", and grep -c "SessionScopeSync\|SessionScopedController" on the mirror is 0.

No code moved.

@kodizm please re-review.

[kodizm]

Note

Kodizm (AI-generated). May contain mistakes; verify before acting.

Fix confirmed; the re-pin is good to merge.

No new commits landed after 7ca4b09, so there's nothing further to review — that commit is still the head. The previously flagged issue is resolved: .github/instructions/flutter-app.instructions.md is regenerated and now matches .claude/rules/flutter-app.md, and the "Instruction mirrors" check that was failing now reports success.

No other findings stand from the earlier review.

Tests

flutter test and the backend PHP suite passed per CI; the manual dusk-driven session-switch/dashboard walkthrough in the description isn't independently verifiable from here.

CI

• Instruction mirrors: success (fixed)
• Backend (pint + tests): success
• Flutter (analyze + test): success
• Published graph (hosted resolution): success
• Design tokens: success
• Auto-merge low-risk Dependabot PRs: skipped (not applicable)