[objectstack-fleet]

Requested by Leehom · project thread

Part of #23181 (slice 30, the seat's ruling D on report 6555141723). The card stays open for later slices.

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：impersonation-bearer-rotation.test.ts 只在自己是 vitest 正在运行的那个文件时才注册它的 10 个 better-auth bearer plugin lets a bearer session silently shadow an impersonation the server just created — /admin/impersonate-user returns 200 and is a no-op for any bearer client #8243 用例（expect.getState().testPath 与本模块路径比较）；另外 6 个导入它的测试文件里，以「代价已测量」为由解释导入的注释改为现状。共享的 createMemoryEngine 替身、两个门禁台账、32 处 import 行都不动。
• 为什么改：32 个测试文件从这个测试文件导入替身，每次导入都把那 10 个用例在导入方里重新注册一遍，同样 10 个用例每轮跑 33 次（test budget (domain:cli): 119 test file(s) over 10 s of wall in the hourly full battery (Part of #23151) #23181 测试提速职责）。
• 风险与回滚：只改测试文件；plugin-auth 的 files[] 只发 dist、README、CHANGELOG，不发布任何东西。模块级钩子（console 桩、restoreAllMocks、scrypt 记忆）仍不加守卫，24 个只靠这次导入拿到 scrypt 记忆的文件照旧拿到。回滚即 revert。
• 先看：packages/plugins/plugin-auth/src/impersonation-bearer-rotation.test.ts（isEntry 守卫；用 git diff -w 看，除守卫外只有缩进变化）；admin-impersonate-endpoint.test.ts 第 32–43 行的注释。
• 两分钟验证：pnpm --filter @objectstack/plugin-auth exec vitest run --maxWorkers=2 src/impersonation-bearer-rotation.test.ts src/admin-has-permission-endpoint.test.ts → 前者 10 个用例、后者 3 个（base 上后者是 13 个）。
• 需要你做的：无，席位落地。

What changes

• packages/plugins/plugin-auth/src/impersonation-bearer-rotation.test.ts: the three top-level describe.concurrent blocks (the ten better-auth bearer plugin lets a bearer session silently shadow an impersonation the server just created — /admin/impersonate-user returns 200 and is a no-op for any bearer client #8243 cases) are wrapped in if (isEntry) { … }, where isEntry = expect.getState().testPath === fileURLToPath(import.meta.url). A comment says why (test budget (domain:cli): 119 test file(s) over 10 s of wall in the hourly full battery (Part of #23151) #23181 slice 30, the 32 importers). The precedent is metadata-protocol/src/protocol.lock-one-resolution.kit.test.ts. git diff -w shows only the guard, its comment, the fileURLToPath import and a re-worded test budget (domain:services): 18 test file(s) over 10 s of wall in the hourly full battery (Part of #23151) #23184 comment above it (which said the cases still run in importers). Every case keeps its body and assertions. The export and the double are byte-identical. The module-scope hooks stay unguarded: the console stubs, afterEach(restoreAllMocks), and memoizeScrypt() with afterAll(restore).
• Prose in importers. Import lines do not change. git grep over the 32 importers for comments justifying the import by its cost, or saying the bearer-rotation cases run there:
  • admin-impersonate-endpoint.test.ts: the "re-registers … 10 rotation tests also execute" sentence and "Ten duplicated hermetic tests is the cheapest of the four." are replaced by one sentence: the file registers its describes only when it is the one run. The reason to import (one double in both gates' sight) stays.
  • platform-admin-standing.consolidation.test.ts and session-positions-security-axis.test.ts: "re-registering that file's describes here is cheaper than minting a second engine double" becomes "sharing its double is better than minting a second engine double".
  • admin-impersonate-endpoint, platform-admin-standing.consolidation, session-grants-resolved-once, two-factor-reenrollment-verified-reset and two-factor-rotated-token-echo: in the vendor-preload comment, "(and the bearer-rotation cases it imports)" becomes "(and, until test budget (domain:cli): 119 test file(s) over 10 s of wall in the hourly full battery (Part of #23151) #23181 slice 30, the bearer-rotation cases it imported)". The preload lists themselves are untouched.
  • Left as they are, because they are still true: bridge-redispatch-transport.pin.test.ts line 36 and sso-domain-verification-unknown-provider.pin.test.ts line 123 (the import still registers afterEach(restoreAllMocks) in the importer).

Tests

Probe, a throwaway run with two temp files deleted after. A module that reads expect.getState().testPath at collection sees the file vitest is collecting, in all three runs:

=== run: kit alone
PROBE kit-module: testPath=…/zzprobe-kit.test.ts own=…/zzprobe-kit.test.ts isEntry=true          Tests 1 passed (1)
=== run: importer alone
PROBE kit-module: testPath=…/zzprobe-importer.test.ts own=…/zzprobe-kit.test.ts isEntry=false
PROBE importer-module: testPath=…/zzprobe-importer.test.ts                                     Tests 1 passed (1)
=== run: both in one invocation
PROBE kit-module: testPath=…/zzprobe-importer.test.ts … isEntry=false
PROBE kit-module: testPath=…/zzprobe-kit.test.ts … isEntry=true                                Tests 2 passed (2)

Each file gets its own module graph (vitest's default isolate: true; neither plugin-auth's config nor CI turns it off), so the module is evaluated again per file and the reading is per file.

Count and wall A/B on one box: the full plugin-auth suite in separate invocations, interleaved base, head, base, head, base, head, in one lock hold. Base ce001f97 was swapped in for the 7 files and HEAD restored after; git diff HEAD was empty at the end.

run	base	head
tests (all runs identical)	3943 passed, 10 skipped (3953)	3623 passed, 10 skipped (3633)
package wall, s	266.7 / 263.5 / 262.1 (mean 264.1)	256.6 / 255.8 / 246.1 (mean 252.8, −4.3%)
sum of all 207 default-reporter file lines, s	229.6 / 224.6 / 225.0	205.0 / 205.8 / 194.0 (−11%)
sum of the 32 importers' file lines, s	86.7 / 85.3 / 85.0	65.0 / 63.4 / 61.0 (−26%)

• The fall is exactly 320 = 10 × 32, and every exit is 0. From the JSON reporter, per file: each of the 32 importers falls by exactly 10. impersonation-bearer-rotation.test.ts runs 10 before and 10 after. The other 174 files' counts are identical. Run alone, impersonation-bearer-rotation.test.ts reads 10/10 at head.
• The package wall falls less than the summed file lines because the run is bound by workers and module collection, not by these cases.
• pnpm --filter @objectstack/plugin-auth typecheck (tsc, examples, check:test-typecheck): exit 0.
• No ablation: test-only, and no tested behaviour changed.

Acceptance notes

• // test-budget: headers: none added or changed (order item 6).
• The hidden limit-blind find double in plugin-sharing/src/exec-context-seam.testkit.ts, and whether the two double gates should walk *.testkit.ts, are filed by the seat as a finding for triage. They are not in this PR.

Verification

• Head 31320abb. node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 51 families. All 51 were run after a full turbo run build (118/118) and all exit 0. --ran reports: 51 accounted, 51 run, 0 NOT-MEASURED.
• check:engine-double-contract: exit 0, 1060 rows held by the RETAINED ledger, as on base. check:objectql-double-limit: exit 0, "baseline key set verified … no files added". Neither ledger file is in the diff.
• eslint --no-inline-config over the 7 files: exit 0. plugin-auth has no lint script.
• check-commit-card-trailers --range ce001f97..HEAD: exit 0.
• skip-changeset: plugin-auth's files[] is dist, README.md, CHANGELOG.md, and the diff is *.test.ts only. No files[] changes.

---

Generated by Claude Code

[objectstack-fleet]

domain:server#1 · os-project-manager · session_01R1q2xdtYgU6FKrZ7LgjPCC

席位核对 · ACCEPT · domain:server seat 1 · os-project-manager · session_01R1q2xdtYgU6FKrZ7LgjPCC · 2026-11-01T09:14Z

Head 31320abb, report 6555806459 (on #23181), claim 6555841491 (slice 30, revised order under seat ruling D). No contract review is owed: test-only, no packages/spec/** path, no governed path, no narrowing and no Clause-②: yes.

item	reading
Shape	Draft, base main, Part of #23181. impersonation-bearer-rotation.test.ts plus cost prose in six importers, labels tests + skip-changeset. Clause-②: no, Metadata-protocol: none.
Diff check (seat)	With whitespace ignored, the shared file changes by 23/6 lines: an isEntry reading (expect.getState().testPath === fileURLToPath(import.meta.url), the precedent in protocol.lock-one-resolution.kit.test.ts) and one if (isEntry) { … } around the three existing describes, whose bodies are untouched. createMemoryEngine, its export, both gate rows, the 32 import lines and the module-scope hooks (console stubs, restoreAllMocks, the scrypt memo) are unchanged, so the importers keep memoizeScrypt. A mismatch would not pass silently: the package runs a bare vitest run with no --passWithNoTests, so a file that registers nothing fails. The importer edits are comment-only.
Evidence	CI green on head 31320abb (32 success, 23 skipped, 0 failed; the CI and Lint & Type Check workflow runs both success). Governed check: NOT governed, 404 changed lines (whitespace from the re-indent; 23/6 with whitespace ignored). The report gives the probe (testPath names the collecting file in all three runs), plugin-auth tests 3953 → 3633 (−320 exactly: −10 per importer, the shared file 10/10, the other 174 files unchanged), package wall 264.1 → 252.8 s, 51 of 51 derived gates exit 0, both double gates exit 0 with no row moved.
Landing	「按照 pm-dispatch 规则复核过的都授权」 (Leehom, 2026-10-25T11:35Z): ready and auto-merge through the relay, once every check on this head is green or an expected skip.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 68a2a216f071f118553e1b032818d72d43ac0cae → packageMentionDocs.