[objectstack-fleet]

Requested by Leehom · project thread

Part of #23181 (slice 26). The card stays open: other domain:server files still read over 10 s (slices 24, 25, 27 and 28 hold the cli ones), and one cause found here needs a shared helper this slice may not edit (Acceptance notes).

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：6 个非 cli 的服务端测试文件（plugin-auth、plugin-pinyin-search、rest、verify ×2、plugin-security）。4 个文件把重复执行的相同准备工作合并成一次（cloud-managed 只注册一次三个用户再给每个用例复制数据；posture-only 三次相同启动合成一次；pinyin 三个用例共用第一次 2,500 行遍历的数据库副本；promotion-selection 每种排序只跑一遍）；5 个文件加第 2 行 // test-budget: 20 头，因为剩下的地板是互不相同的真实工作。
• 为什么改：卡 test budget (domain:cli): 119 test file(s) over 10 s of wall in the hourly full battery (Part of #23151) #23181 的测试提速职责：CI 里超过 10 s 的测试文件要么提速，要么按裁决 6181973363 B 声明预算。
• 风险与回滚：只改测试文件，五个包的 files[] 都只发 dist、README、CHANGELOG，不发布任何东西；用例名和断言一条没删、没放宽（四个改动文件 base/head 用例名逐条一致）；回滚即 revert。
• 先看：packages/plugins/plugin-auth/src/cloud-managed.test.ts（produceStagedRows + 每例 structuredClone 复制）；packages/plugins/plugin-pinyin-search/src/boot-reconcile.integration.test.ts（beforeAll 的首次遍历与 fromWalked）；packages/verify/src/harness.posture-only.test.ts（合并的启动）。
• 两分钟验证：pnpm --filter @objectstack/plugin-auth exec vitest run --maxWorkers=2 src/cloud-managed.test.ts → 32/32 通过，文件行约 2 s（base 约 6.5 s）。
• 需要你做的：无，席位落地。

What changes

The six files slice 23's offender table (pm-orders/server/evidence/23181-s23/offenders-after-s23.md) lists outside packages/cli, read from the default reporter's per-file module line in the Test Core shard logs of the scheduled ci.yml runs 41199450735, 41217827347, 41237094739, 41255489006 and 41271604267:

file	0735	7347	4739	9006	4267	tests	boots / staged units, base → head	distinct	cause	fix
plugin-auth/src/cloud-managed.test.ts	6.9	19.9	23.6	15.3	6.8	32	14 stagings → 1 (3 fresh-salt production-scrypt sign-ups each, about 0.1 s apiece)	1	the same staging per case, plus 10 #8243 cases re-run by importing impersonation-bearer-rotation.test	stage once in beforeAll; each case builds a fresh engine, AuthManager and mount over a structuredClone of the staged rows. No header (see Acceptance notes)
plugin-pinyin-search/src/boot-reconcile.integration.test.ts	12.1	14.1	10.6	11.8	15.2	8	11 kernel boots → 10; 2,500-row seeds 7 → 5; full walks 9 → 7	first walk ×3	the first boot over the seeded history, walked with the ledger on, repeated by three cases	that walk runs once in the describe's beforeAll (readings taken while it is up); the three cases boot over a copy of the database it left (fromWalked). Header 20
rest/src/meta-draft-head-package-inheritance.test.ts	10.6	11.3	13.7	13.4	15.0	25	39 real-stack boots at about 12 ms (0.5 s of the file)	25	each case's own save/read/publish/discard sequence on the real /meta routes	header 20
verify/src/harness.key-custody.test.ts	14.2	7.0	9.1	13.6	10.3	7	5 bootStack boots, all in hooks	5	each boot is its cases' subject (empty home, key file, OS_SECRET_KEY, restart pair)	header 20
verify/src/harness.posture-only.test.ts	13.8	7.7	9.8	6.4	8.7	5	5 bootStack boots → 3	3	three cases booted the same app with the same options and no posture set	one boot in a beforeAll takes all three cases' readings (tenancy fields and org-scoping while up, the posture before, during and after stop()). Header 20
plugin-security/src/bootstrap-platform-admin-promotion-selection.test.ts	9.5	7.1	10.9	13.5	7.3	25	27 engine boots → 24; card-population seeds 8 → 5	per order ×2	the per-order cases and the same-answer case each ran the same boot + seed + promotion per natural order	one pass per order in the describe's beforeAll; both sets of cases read it. Header 20

Headers (ruling 6181973363 letter B, class spawns the real producer once per single-cause fixture): N = the slowest of the five CI readings × 1.25, rounded up to 10 s; 20 for all five. Where the file also changed, the header keeps its pre-change CI reading. All five parse with readTestBudget (scripts/measure-test-shard-timings.mjs); cloud-managed reads null (no header).

Not changed: no case name, assertion, timeout, tier or project; no source file; no test helper (the shared createMemoryEngine double, audience-gate-test-support, the verify harness and the security testkits are untouched).

Tests

• A/B (one box, one lock hold, base copied beside head as zzbase.*, interleaved, N=3, --maxWorkers=1, default reporter file line; copies deleted before the gate run):

  file	base (s)	head (s)	change (mean)
  cloud-managed	7.08, 6.51, 6.03	2.21, 2.40, 2.15	−65.9% (6.54 → 2.25)
  harness.posture-only	6.58, 6.27, 4.94	4.55, 3.76, 4.11	−29.0% (5.93 → 4.14)
  promotion-selection	2.18, 2.10, 1.99	1.76, 1.78, 1.75	−16.3% (2.09 → 1.76)
  boot-reconcile.integration	3.89, 3.55, 3.38	3.05, 3.12, 3.05	−13.6% (3.61 → 3.07)

  Every run exit 0, same test counts both sides (32, 5, 25, 8). vitest list on base and head gives the same case names for all four files (posture-only's three cases sit one describe deeper).

• Header-only files, run on head: meta-draft-head-package-inheritance 25/25, harness.key-custody 7/7.

• pnpm --filter PKG typecheck (tsc + check:test-typecheck) exit 0 for @objectstack/plugin-auth, plugin-pinyin-search, rest, verify, plugin-security.

• No ablation: no tested behaviour changed (test-only).

Acceptance notes

• cloud-managed re-runs another file's ten cases. It imports createMemoryEngine from impersonation-bearer-rotation.test.ts, and importing that file registers its ten #8243 cases in the importer. On head they are about 2.3 s of the file's per-case time, against 0.85 s for its own 22 cases. 32 test files in plugin-auth import that double the same way, so each re-runs the same ten cases. The fix is a registration guard in that file (the shape metadata-protocol/src/protocol.lock-one-resolution.kit.test.ts already uses: register its suites only when it is the file under test), which is a helper shared beyond this slice's files, so it is not in this PR. That is why cloud-managed takes no header: its remainder is not distinct work. Carrier: test budget (domain:cli): 119 test file(s) over 10 s of wall in the hourly full battery (Part of #23151) #23181.
• skip-changeset. Test-only. All five packages ship files: ["dist", "README.md", "CHANGELOG.md"]; after build, a source symbol from each package is in its dist/ (positive control) and a fixture string from each changed test is not, so no files[] content changes.

Verification

All readings on head 978d4163 (two commits, then one merge of origin/main after slice 23, #28581, landed).

• Derived gate families: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack on the final head → 54 families, each run with its exit code captured before any pipe, all exit 0, after a full pnpm exec turbo run build --concurrency=2 (the check:dual-build-cjs-loads and check:i18n prerequisites) and git fetch --depth=1 of the commit the teardown-shape self-test names. --ran reconciliation: ✓ dispatch-gates --ran: 54 derived famil(ies) accounted for — 54 run, 0 NOT-MEASURED. List: pm-orders/server/evidence/23181-s26-gates-ran-978d4163.txt in the project files.
• The six files on the final head: 32/32, 8/8, 25/25, 7/7, 5/5, 25/25, every run exit 0.
• Hand gates: pnpm exec eslint --no-inline-config over the six files exit 0 (none of the five packages has a lint script; the repo-wide pnpm lint is CI's); node scripts/check-commit-card-trailers.mjs --range origin/main..HEAD exit 0.
• CI families (Test Core, lint farm, type-check lanes) are read off this PR's check-runs by the seat.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FEkQ5kTs9zGs8tcMtB1Kys

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json cd065d3698db13969a28f46bf26f3e47e9ecc09c → packageMentionDocs.

[objectstack-fleet]

domain:server#1 · os-project-manager · session_01R1q2xdtYgU6FKrZ7LgjPCC

席位核对 · ACCEPT · domain:server seat 1 · os-project-manager · session_01R1q2xdtYgU6FKrZ7LgjPCC · 2026-11-01T07:57Z

Head 978d4163, report 6555057156 (on #23181), claim 6555115448 (slice 26). No contract review is owed: test-only, no packages/spec/** path, no governed path, no narrowing and no Clause-②: yes.

item	reading
Shape	Draft, base main, Part of #23181. Exactly slice 26's six non-cli files, labels tests + skip-changeset. Clause-②: no, Metadata-protocol: none.
Diff check (seat)	cloud-managed: the three production-scrypt sign-ups stage once in beforeAll (env saved and restored, managed mode off); each case still gets a fresh engine, AuthManager and mount over a structuredClone of the staged rows, so no case sees another's writes. boot-reconcile: the first walked boot runs once in the describe's hook with its readings taken while up; the three cases that repeated it boot over a file copy of that database, and the forced-rebuild control still walks every row. promotion-selection: one pass per natural order feeds both the per-order cases and the same-answer case, assertions unchanged. posture-only: the three identical posture-only boots fold into one hook boot; the env reading before, while up and after stop() is still asserted, and the two other boots keep their own setup. Every assertion and its explanatory comment is kept. Line-2 // test-budget: 20 on five files; cloud-managed takes none (its remainder is the shared helper, now slice 30). No helper outside the six files is touched; no timeout is raised.
Evidence	CI green on head 978d4163 (35 success, 18 skipped, 0 failed). Mergeable state clean. Governed check: NOT governed, 276 changed lines. The report gives 54 of 54 derived gates exit 0, --ran reconciled, and A/B N=3 of −66 % (cloud-managed), −29 % (posture-only), −16 % (promotion-selection), −14 % (boot-reconcile).
Landing	「按照 pm-dispatch 规则复核过的都授权」 (Leehom, 2026-10-25T11:35Z): ready and auto-merge through the relay, once every check on this head is green or an expected skip.

---

Generated by Claude Code