[objectstack-fleet]

Requested by Leehom · project thread

Part of #23181 (slice 33). The card stays open for later slices: plugin-auth/src/invitation-delivery-outcome.test.ts (10.5 s) is left to slice 30's effect, and slices 29–32 hold other files.

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：17 个非 cli 的服务端测试文件（verify ×6、runtime ×4、rest ×2、plugin-security ×3、plugin-auth ×2、service-automation ×1）。其中 4 个文件把多个用例重复执行的相同启动合并成一次（served-composition 3→1、sys-user-default-row-scope 10→2、meta-history-diff 20→1、meta-draft-read-builder-gate 21→1）；17 个文件都在第 2 行加 // test-budget: 20 头。
• 为什么改：卡 test budget (domain:cli): 119 test file(s) over 10 s of wall in the hourly full battery (Part of #23151) #23181 的测试提速职责：CI 里超过 10 s 的测试文件要么提速，要么按裁决 6181973363 B 声明预算。这 17 个文件本地只跑 1.6–6.2 s，CI 读数 10–13 s 来自分片并发负载，剩下的地板是互不相同的真实工作。
• 风险与回滚：只改测试文件，六个包的 files[] 都只发 dist、README、CHANGELOG，不发布任何东西；用例名和断言一条没删、没放宽（4 个改动文件 base/head 用例名逐条一致，且在 3 个随机顺序种子下全过）；回滚即 revert。
• 先看：packages/rest/src/meta-history-diff-authoring-door.test.ts（共享启动 + 每例前清空 spy）；packages/services/service-automation/src/sys-user-default-row-scope.integration.test.ts（两个 beforeAll）；packages/verify/src/harness.served-composition.test.ts（共享的 plain 启动）。
• 两分钟验证：pnpm --filter @objectstack/rest exec vitest run --maxWorkers=2 src/meta-history-diff-authoring-door.test.ts → 20/20 通过，文件行约 0.5 s（base 约 2.3 s）。
• 需要你做的：无，席位落地。

What changes

The 17 files the order lists from slice 23's offender table (pm-orders/server/evidence/23181-s23/offenders-after-s23.md), read from the default reporter's per-file module line in the Test Core shard logs of the scheduled ci.yml runs 41199450735, 41217827347, 41237094739, 41255489006 and 41271604267. "local" is the same file line from one run on this box (--maxWorkers=1, base d94dd3a65d).

file	0735	7347	4739	9006	4267	local	tests	boots, base → head	cause	fix
plugin-security/src/rls-check-stored-form.test.ts	12.8	4.2	6.9	7.4	8.0	1.60	104	one engine + SecurityPlugin per (driver, policy), already shared per key	each policy is its cells' subject, on two driver families	header 20
runtime/src/plugin-driver-external-object.spike.test.ts	12.0	6.2	10.3	12.4	9.1	2.89	12	1 real-kernel boot in beforeAll	the boot (cases 0.24 s of 2.89)	header 20
rest/src/meta-history-diff-authoring-door.test.ts	9.3	10.0	11.3	12.2	11.2	2.32	20	20 → 1 seeded real-stack boots	the same boot() (six saves) per case; every case only reads	one boot in beforeAll, spies cleared before each case; header 20
plugin-auth/src/walled-owner-operator-stamp.test.ts	3.4	10.9	11.9	10.6	3.4	3.29	28	13 fresh engines + AuthManager	each case's sign-ups (production scrypt) and stamp	header 20
plugin-security/src/rls-stored-list-ordering-fails-closed.test.ts	11.3	4.2	11.9	11.3	9.8	4.39	94	120 fresh engines	every case asserts on its boot's whole stored table, so none can share	header 20
verify/src/harness.required-providers.test.ts	11.4	7.8	9.2	6.7	11.1	5.87	7	6 bootStack	six configurations, no two the same	header 20
verify/src/harness.served-composition.test.ts	10.9	6.7	8.8	10.3	9.8	5.60	7	7 → 5 bootStack	the plain one-package boot, booted by three read-only cases	one plain boot in beforeAll; header 20
plugin-security/src/org-admin-assignment-boundary.posture.test.ts	10.9	4.2	9.2	10.5	7.9	4.33	60	60 fresh engines	every case writes and reads back the same holder's rows, so none can share	header 20
service-automation/src/sys-user-default-row-scope.integration.test.ts	2.0	7.5	9.9	10.6	7.1	2.79	10	10 → 2 real-kernel boots	the same boot() per case in each describe; the only case writes are hook_probe rows no case reads	one boot per describe in beforeAll; header 20
runtime/src/installed-plugin-loader.test.ts	10.4	9.2	9.9	10.1	9.3	2.48	59	2 real Node children	each child's own module resolution is the subject (about 1 s each)	header 20
verify/src/held-session-impersonation-target.pin.test.ts	9.7	7.1	8.5	10.4	9.7	6.19	8	1 bootStack in beforeAll	the boot (about 4.3 s of 6.19) plus a session per case	header 20
plugin-auth/src/scim-deactivation-reconcile-user.test.ts	5.0	7.6	10.3	6.8	4.6	1.84	13	pooled engine, fresh AuthManager per case	each case's SCIM sequence	header 20
rest/src/meta-draft-read-builder-gate.test.ts	5.8	6.8	7.9	10.3	5.5	2.70	21	21 → 1 seeded real-stack boots	the same boot() (seven saves) per case; every case only reads	one boot in beforeAll, queryDataset cleared before each case; header 20
verify/src/held-session-platform-admin.pin.test.ts	10.3	6.1	7.2	9.8	8.6	5.34	13	1 bootStack in beforeAll	the boot plus a hold per posture state	header 20
runtime/src/app-automation-identity-write-refusal.integration.test.ts	10.0	4.9	9.3	10.2	7.3	3.45	100	100 fresh engines	each case's refused write is read back as unmoved, so none can share	header 20
runtime/src/sandbox/quickjs-runner.test.ts	8.6	7.6	10.1	9.3	8.0	4.83	63	none	real waits that are the cases' subject (600 / 500 ms host awaits, 250 ms CPU budgets, wall ceilings)	header 20
verify/src/handle.test.ts	10.0	5.1	6.7	8.6	7.3	3.71	24	1 shared + 2 subject boots	the two extra boots are their cases' subjects	header 20

Cause across the set. Every file reads 1.6–6.2 s locally, and its CI readings spread two to four times across runs of the same code (walled-owner-operator-stamp 3.4 s and 11.9 s): the overrun is the Test Core shard's concurrent load on in-process work. No file spawns a CLI; none repeats a boot beyond the four fixed here.

Headers (ruling 6181973363 letter B, class spawns the real producer once per single-cause fixture, the class slice 26 used for in-process boots): N = the slowest of the five CI readings × 1.25, rounded up to 10 s; 20 for all 17. Where the file also changed, the header keeps its pre-change CI reading and says so. All 17 parse with readTestBudget (scripts/measure-test-shard-timings.mjs): 20 s, line 2.

The shares. Only where no case writes what another reads, as the order allows:

• harness.served-composition: the slate case and the cube control only read the kernel; the mail control's send leaves a sys_email row only it counts. Its own anti-vacuity line (onePackage().requires is undefined) stays.
• sys-user-default-row-scope: each case reads through its own producer, and asserts on the last readContexts entry its own read pushed and on the hook firing it counts from its own before. In the extend describe the second case's contribution is refused and the case itself pins that the registry is unchanged.
• The two rest files: after the seeding every case only reads (GET doors, draftVersion's system read; the dataset door hands its query to the queryDataset spy, which stores nothing). The protocol spies (history-diff) and queryDataset (builder-gate) are cleared in beforeEach, as a fresh boot left them.

Not changed: no case name, assertion, timeout, tier or project; no source file; no shared helper or testkit (verify/src/harness.ts, boot-warm-up.testkit.ts, default-organization.testkit.ts, audience-gate-test-support untouched).

Tests

• A/B (one box, one lock hold, base copied beside head as zzbase.*, each side in its own vitest invocation, order alternated per round, N=3, --maxWorkers=1, default reporter file line; copies deleted after):

  file	base (s)	head (s)	change (mean)
  meta-history-diff-authoring-door	2.39, 2.29, 2.12	0.48, 0.45, 0.51	−78.7% (2.27 → 0.48)
  meta-draft-read-builder-gate	2.51, 2.35, 2.56	0.52, 0.56, 0.59	−77.5% (2.47 → 0.56)
  sys-user-default-row-scope.integration	2.75, 2.83, 2.45	0.87, 0.92, 0.73	−68.5% (2.67 → 0.84)
  harness.served-composition	4.83, 5.43, 5.35	3.41, 3.95, 3.51	−30.4% (5.20 → 3.62)

  Every run exit 0, the same test counts both sides (20, 21, 10, 7). vitest list on base and head gives the same case names for all four files.

• Order independence of the shares: each changed file run plain and with --sequence.shuffle --sequence.seed=11, =22, =33: 16 runs, all exit 0 (7/7, 10/10, 20/20, 21/21).

• Header-only files: all 13 run on base with the full count passing (local readings in the table); the header is a comment line.

• No ablation: no tested behaviour changed (test-only).

Acceptance notes

• Headers on files that read well under 10 s locally. The 17 headers follow slice 26's precedent (PR test(server): share repeated setup in four slow non-cli test files, budget five distinct floors #28599), which declared the same class on in-process files from their CI readings. The local readings are in the table so the seat can weigh it: on the four changed files the header carries the pre-change CI reading, and the next refresh reads the new shape.
• skip-changeset. Test-only. All six packages ship files: ["dist", "README.md", "CHANGELOG.md"]; after the full build, a source symbol from each package is in its dist/ (positive control: bootStack, AutomationServicePlugin, RestServer, QuickJSScriptRunner, SecurityPlugin, AuthManager) and a fixture string from each package's changed tests is not (svc_note_cube, qa_star_reader, nav_atlas_launch_plan, spike_tree, qa_due_stored_, operator@corp.example), nor is test-budget:. No files[] content changes.
• Open lever, not taken here: rls-stored-list-ordering-fails-closed (120 boots) and org-admin-assignment-boundary.posture (60) could share a boot per key only if their cases stopped reading the whole table, which would change what those assertions say; left as is.

Verification

All readings on head 9f399f58 (one commit, then one merge of origin/main after slices 24, 25, 26 and 28 landed: #28610, #28601, #28599, #28616), after a full pnpm exec turbo run build --concurrency=2 (118/118).

• Derived gate families: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack on the final head → 54 families, each run with its exit code captured before any pipe, all exit 0 (with git fetch --depth=1 of the commit the teardown-shape self-test names). --ran reconciliation: ✓ dispatch-gates --ran: 54 derived famil(ies) accounted for — 54 run, 0 NOT-MEASURED. List: pm-orders/server/evidence/23181-s33-gates-ran-9f399f58.txt in the project files.
• The 17 files on the final head: 104/104, 12/12, 20/20, 28/28, 94/94, 7/7, 7/7, 60/60, 10/10, 59/59, 8/8, 13/13, 21/21, 13/13, 100/100, 63/63, 24/24 (table order), every run exit 0.
• Typecheck: pnpm --filter the six packages run typecheck (tsc + check:test-typecheck) exit 0.
• Hand gates: pnpm exec eslint --no-inline-config over the 17 files exit 0 (none of the six packages has a lint script; the repo-wide pnpm lint is CI's); node scripts/check-commit-card-trailers.mjs --range origin/main..HEAD exit 0.
• CI families (Test Core, lint farm, type-check lanes) are read off this PR's check-runs by the seat.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FEkQ5mAySGuLppSnAtNXaa

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json d77dc07a5e5a4b5478763fb3a2126913c92f8c01 → packageMentionDocs.

[objectstack-fleet]

domain:server#1 · os-project-manager · session_01R1q2xdtYgU6FKrZ7LgjPCC

席位核对 · ACCEPT · domain:server seat 1 · os-project-manager · session_01R1q2xdtYgU6FKrZ7LgjPCC · 2026-11-01T09:44Z

Head 9f399f58, report 6556107399 (on #23181), claim 6555841491 (slice 33). No contract review is owed: test-only, no packages/spec/** path, no governed path, no narrowing and no Clause-②: yes.

item	reading
Shape	Draft, base main, Part of #23181. Exactly slice 33's 17 non-cli files, labels tests + skip-changeset. Clause-②: no, Metadata-protocol: none.
Diff check (seat)	Four files share one boot in a hook, each with its reason written beside it, and the seat read the case bodies against it: meta-draft-read-builder-gate and meta-history-diff-authoring-door only read after seeding, and their spies are cleared before each case as a fresh boot left them; sys-user-default-row-scope cases each assert on their own read context, and the only rows written (hook_probe) are read by no case; harness.served-composition shares the plain one-package boot across the slate, cube and mail controls, and only the mail control sends (its sys_email count is its own). Teardown moves from afterEach to afterAll to match. Line-2 // test-budget: 20 on all 17. No assertion changes, no shared helper touched, no timeout raised.
Evidence	CI green on head 9f399f58 (35 success, 18 skipped, 0 failed; the CI and Lint & Type Check workflow runs both success). Governed check: NOT governed, 156 changed lines. The report gives 54 of 54 derived gates exit 0 on the merged head and A/B N=3 of −30 % (served-composition), −69 % (sys-user-default-row-scope), −79 % (meta-history-diff), −78 % (meta-draft-read-builder-gate).
Landing	「按照 pm-dispatch 规则复核过的都授权」 (Leehom, 2026-10-25T11:35Z): ready and auto-merge through the relay, once every check on this head is green or an expected skip.

---

Generated by Claude Code