[objectstack-fleet]

Requested by Steve · project thread
Fixes #29603

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：只改测试。meta-write-org-scope.test.ts 在文件顶部预先加载 @objectstack/lint，runtime 的 vitest 配置把这个包根指到源码。
• 为什么改：那个 ⭐ D6 用例里的视图读取会第一次懒加载 lint 包，vitest 下冷编译要 1.2 秒（最慢 1.7 秒），全算进用例的 5 秒超时里，分片负载一高就超时变红。现在这笔开销在收集阶段付掉，用例本身降到约 20 毫秒。
• 风险与回滚：不动产品代码，不加超时，不重试，断言一条没改。回滚即还原本 PR。
• 先看：packages/runtime/src/meta-write-org-scope.test.ts（顶部那条 import 和注释），packages/runtime/vitest.config.ts（新的 @objectstack/lint 别名）。
• 两分钟验证：pnpm --filter @objectstack/runtime exec vitest run --project local src/meta-write-org-scope.test.ts --reporter=verbose，预期 20 个用例全绿，⭐ D6 用例几十毫秒（main 上约 1.2 秒）。
• 需要你做的：无，席位落地。

What changes

• packages/runtime/src/meta-write-org-scope.test.ts: a module-top import '@objectstack/lint', with a comment naming the cost it moves. No case, assertion or timeout changes.
• packages/runtime/vitest.config.ts: one anchored alias, ^@objectstack/lint$ → ../lint/src/index.ts, beside the existing /runtime entry. check:test-source-alias requires it for the new import (its remedy text, verbatim shape), and it is the same entry metadata-protocol's lazy import resolves through, so the view read now judges the lint rule in the checkout rather than dist/.

Why

The failure on 1a95c746 (run 41514567522, Test Core 3/8, job 125515971369) was a timeout, not an assertion: Error: Test timed out in 5000ms. at meta-write-org-scope.test.ts:419:5; the file ran 5978 ms that run.

Where the time goes, measured by timing the case's steps in a scratch copy (deleted): makeStack 0 ms, the PUT /view/… 19 ms, the first GET /view/… 1500 ms, a second identical GET 2 ms. The first GET is the first view read in the file. A served view read decorates _diagnostics with the lint's form-layout warnings (withFormLayoutWarnings, called from getMetaItem's serveFormLayout), and that helper imports the lint package root lazily on first use: loadFormLayoutLint, packages/metadata-protocol/src/metadata-diagnostics.ts:481. Under vitest that first import is a cold transform of the lint module graph, inside the clocked case. The sibling plural-spelling case does the same PUT but no GET, which is why it runs in 3 ms.

The lazy import is deliberate product design (the kernel boot path reaches @objectstack/lint only through /runtime), so the product code stays as it is. The fix is the repo's clocked-window rule (AGENTS.md § Build & Test; scripts/check-test-source-alias.mjs): pay the first load at module top, during collection, which no timeout clocks. The protocol's later import() gets the same module instance back (measured: the first GET drops from 1500 ms to 7 ms). check:test-source-alias cannot see this load on its own, because it happens in another package's code.

Tests

Duration of the ⭐ case and the file (sum of its 20 case durations), --maxWorkers=1, one vitest process per run, under os-verify-lock.sh (shared-box seconds):

	⭐ case p50 / max	file total p50 / max	slowest sibling (max)
before, 2da42e74, 20 runs	1202 / 1740 ms	1433 / 1939 ms	130 ms
before, 4 concurrent copies on 4 cores	1463 / 1654 ms	1695 / 1862 ms	62 ms
after, 867f4777, 20 runs	20 / 32 ms	218 / 268 ms	72 ms
after, 4 concurrent copies on 4 cores	20 / 30 ms	283 / 329 ms	95 ms

The case now runs at sibling speed. The load moved into collection (the run's import phase), which testTimeout does not clock.

Forced test edits: none. No assertion, timeout or case moved; the case still proves the overlay-enabled view lands env-wide and the read serves it.

Runtime suite on the final head

pnpm --filter @objectstack/runtime test (vitest project local) on 867f4777, under the lock: Test Files 528 passed (528), Tests 8506 passed | 19 skipped (8525), VERDICT command-exit 0. The same suite on the first head da6bf162 (preload only): 528/528, 8506 passed.

Verification

Head 867f4777 (branch merged with origin/main 81cd9eb0e before the PR).

• node scripts/pm/dispatch-gates.mjs --commands on 867f4777: 50 commands (2 paths, 19 changed lines). All 50 ran on this head, each exit 0. --ran reconciliation: 50 derived, 50 run, 0 NOT-MEASURED, 0 UNRUN.
• On the first head, check:test-source-alias was red (NEW unaliased artifact import(s) … @objectstack/lint); the alias in vitest.config.ts is its remedy, green on this head (120 packages with tests scanned).
• pnpm --filter @objectstack/runtime typecheck: exit 0 (check:test-typecheck: OK, debt ledger held).
• Lint: root eslint over packages/runtime with --no-inline-config (the package has no lint script): exit 0.
• No ablation: the diff changes no tested behaviour. The before/after table above is the reverse reading: without the preload the case pays the 1.2 s load, with it 20 ms.
• Dogfood: n/a (no !, no (narrowing) arm).
• CI check-runs: not read yet; the seat reads them at ACCEPT.

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic. (not touched)
• 2. Every name I added uses the casing for its kind. (no new names)
• 3. No formatter ran; pnpm lint passes. (eslint on packages/runtime, exit 0)
• 4. One issue, one branch off an up-to-date main, one pull request.
• 5. A change that publishes carries a changeset. (test-only: skip-changeset)
• 6. packages/spec touched: n/a.
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English (the 维护者速读 section is Chinese by repo rule).

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

⚠️ 1 changed file(s) yielded no anchor (packages/runtime/vitest.config.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 1 changed file(s) yielded no anchor (packages/runtime/vitest.config.ts) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 28 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 5bd615effe96ea05b4d9744a48a345ec804de208 → packageMentionDocs.

[objectstack-fleet]

domain:server#2 · os-steve · session_01ADHkmQxwoGb5fSnrFkpxmt

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Reviewed-by: session_01ADHkmQxwoGb5fSnrFkpxmt
Implemented-by: session_01ADHkmRczGnhouFCUs9DfQ2
Head-sha: 867f477774a5239467d5213259c234fc9fea391e
Local-runs: none
Scope: packages/runtime/src/meta-write-org-scope.test.ts (the module-top import, the ⭐ D6 case now at L433), packages/runtime/vitest.config.ts (the ^@objectstack/lint$ alias) + packages/metadata-protocol/src/metadata-diagnostics.ts (loadFormLayoutLint, withFormLayoutWarnings), packages/metadata-protocol/src/protocol.ts (getMetaItem's serveFormLayout and its three served exits, read only), packages/lint/package.json (exports, dependencies), packages/lint/src/index.ts (the alias target, its import surface), packages/runtime/package.json (files), scripts/check-test-source-alias.mjs (the runtime and metadata-protocol ledger rows, the boundary-crossing rule, the clocked-window rule), the Test Core (3/8) log of run 41514567522 (job 125515971369), the card body of #29603, the claim 6588496082, the dev report 6589946407, and the seat delta for #29603.

Face: none of the four (no packages/spec/src/** path, no governed path, Clause-②: no, Metadata-protocol: none line-initial on the PR body; check-governed-merges --pr 29622 answers 0 of 2 paths hit, 13 surfaces governing). Merge-base 81cd9eb0e9f2fb32a9ae01ef60dc4da45f892ef2; net diff 2 files, 19 insertions, 0 deletions. The PR file list equals the dev report's files_changed: the claim's declared surface (the test file) plus the one deviation the report declares (the vitest config). Nothing under packages/metadata-protocol/** (protocol.ts is frozen for #25467 E2 and is untouched), packages/spec/** or ui/** moves. main has moved 12 commits since the merge-base; none touches the two diff files, metadata-diagnostics.ts, packages/lint/src, lint's package.json or the alias gate. The one same-package commit on protocol.ts (#29456, 7b293c40c7) is a connector save-path change, not the view read. No re-merge is owed (discipline §10). PR author objectstack-fleet[bot], branch claude/project-thread-2g17eb, the one the claim names; no relay author to name. The PR carries no review and no competing Contract-review-claim:; the card carries the claim and the dev report only.

① Derived judgments

1. The failure was a timeout, not an assertion, and the card's diagnosis is right. The job log of run 41514567522 (Test Core 3/8, head 1a95c746) reads Error: Test timed out in 5000ms. at src/meta-write-org-scope.test.ts:419:5, the ⭐ case at 5210 ms, the file at 5978 ms, 20 tests, 1 failed. The case is a PUT /view/overdue_grid then a GET of the same name through the real HttpDispatcher → ObjectStackProtocolImplementation.getMetaItem. On the served face, getMetaItem wraps every served exit in serveFormLayout (protocol.ts L11465-11467, exits at L11475, L11766 and L12045), which calls withFormLayoutWarnings(request.type, served, getObject); for a view that resolved to a record that function awaits loadFormLayoutLint() BEFORE it resolves any object name, and loadFormLayoutLint is formLayoutLint ??= import('@objectstack/lint') (metadata-diagnostics.ts L469-475), a lazy import of the lint package ROOT. In the runtime suite @objectstack/metadata-protocol resolves to dist/ (it is in runtime's KNOWN_UNALIASED_TEST_IMPORTS row), and a pnpm-linked dist/ is inlined and transformed by Vite (the gate's own header, the finding: under vitest a linked workspace package's import() is re-anchored at the vitest root, so an in-process test cannot measure which package a bare specifier resolves from — and its anti-vacuity control is vacuous too #11412 note), so that import() is a cold Vite transform of the lint graph on the first served view read of the process, inside whichever case makes it. The sibling plural-spelling case does the same PUT with no GET, which is why it runs in single-digit milliseconds. Right; the cost is where the dev says it is, and it is not a boot, a poll or a driver path.
2. The warm-up keeps the case's proof intact. The diff adds 14 lines above the imports and nothing else in the file: no it, expect, timeout or helper moves (the only effect on the case is its line number, 419 → 433). The case still writes through the real dispatcher, asserts 200, asserts 'organization_id' in row is false on the stored row the real SysMetadataRepository wrote (the env-wide pin), reads the same name back through the same dispatcher and asserts 200 (the read serves it). The read path is unchanged: serveFormLayout still runs, loadFormLayoutLint still fires its import(), the lint rule still judges the served body; what the module-top import '@objectstack/lint' changes is only WHEN Vite transforms that graph (during collection, which testTimeout does not clock), since the protocol's later import() is served from the same module graph. The dev's measurement (first GET 1500 ms → 7 ms, second GET 2 ms both before and after) is the reading that the same instance comes back; I did not re-run it. The delta's three prohibitions hold: no timeout raised, no retry/skip/quarantine, no assertion weakened. Right.
3. The alias is anchored, correct, and forced. { find: /^@objectstack\/lint$/, replacement: path.resolve(__dirname, '../lint/src/index.ts') }; the target exists at this head; the entry sits beside the pre-existing anchored /runtime entry, and lint's third published subpath (/rule-explanations) is imported by no file under packages/runtime (src or tests), and would in any case fall through to exports, not through a file: no rule-5 (ENOTDIR) shape. It is forced: @objectstack/lint is absent from runtime's shrink-only ledger row (no runtime test imported the root before), so a module-top value import of a specifier resolving to dist/ reds check:test-source-alias with the alias as its printed remedy; the dev measured exactly that on the first head da6bf162, green on this head, and Lint · repo & tooling gates (which carries the gate) is success on 867f4777. Right.
4. What the alias changes for other tests, honestly stated. Every runtime test (both vitest projects, extends: true) whose first served view read reaches loadFormLayoutLint now gets lint's SOURCE graph instead of dist/index.js; no runtime source file imports the lint root (only /runtime, in domains/new-similar-target.ts), so that lazy import is the only other reader. The dev declares this in deviation 1 and ran the runtime suite on it: 528/528 files, 8506 passed, 19 skipped. The gate's boundary crossing now walks lint's source against runtime's alias table for rule 5 only: lint imports @objectstack/spec/NAMESPACE (runtime's anchored namespace rule covers it), @objectstack/formula (anchored entry), @objectstack/sdui-parser (no alias, resolves to dist/ through exports, not reported by design), and only type-imports of typescript, sucrase and ajv at module scope. This is the direction the gate exists to push (source over dist/), and it is the same shape the fix(cli)!: os validate and os build refuse a flow with an undeclared top-level cycle, as the engine refuses it at registration #29595 record accepted for the CLI. Right, within the declared deviation.
5. Files outside the declared surface. One: packages/runtime/vitest.config.ts, declared as deviation 1 with the forcing gate named. Nothing else. The frozen protocol.ts is read, not touched. Right.
6. No product cost masked that a user would feel, on this evidence. In production the same lazy import is a one-time Node load of lint's BUILT root entry per process on the first served view read; the 1.2 s is the Vite transform under vitest, not that load. I did not measure the built load (no lint dist/ in this checkout; Local-runs: none). The lazy shape is a documented design choice in the source (metadata-diagnostics.ts: the kernel boot path reaches @objectstack/lint only through /runtime, loaded "as build-probes.ts loads its lint rule"), the test never asserted on the warnings it adds (the dedicated pin is metadata-protocol's protocol.form-layout-diagnostics.test.ts, which already preloads the root), and the delta's product-code clause covers "a needless wait", which a one-time module load by design is not. Nothing to file under Prime Directive chore: version packages #10 (no defect, no contract violation, no measured latency). If the seat wants the number, it is one measurement on a built server (time the first GET /view of a process) before any card; carrier: none · noted, not filed.
7. Trailers and body declarations. Both authored commits end with Claude-Session: and the model-free Co-authored-by: Claude pair; the PR body carries Fixes #29603, line-initial Clause-②: no and Metadata-protocol: none (matching the claim), the six-line 维护者速读, a ## Verification naming the head, and "Forced test edits: none" (true: the diff forces none). Right.

② Semver level

• No changeset; label skip-changeset; Check Changeset is success on this head. @objectstack/runtime publishes files: ["dist", "README.md", "CHANGELOG.md"], so neither src/meta-write-org-scope.test.ts nor vitest.config.ts ships in any tarball, and no other package moves. AGENTS.md's rule ("that label is for a diff that publishes nothing from any released package") is met exactly, and the delta expected it ("Use skip-changeset … if only tests change"). Right.
• Declarations Clause-②: no, Metadata-protocol: none are the measured values for a diff that changes no accept set and no authorable surface. Right.

③ Boundary flags

• Dev open_questions, one: the same cold load may sit inside clocked cases of other runtime test files; A leave it (dev's recommendation) or B file a devx card to measure the population and preload at module top where it lands in a clocked case. My view: A for this PR, and B as a card the seat files now, p3 devx, rather than waiting for a second red. Reasons. (1) The cost is measured, not hypothetical: 1202 ms p50 / 1740 ms max idle, 1463 / 1654 ms under four concurrent copies, against a 5000 ms budget, in whichever case makes a file's first served view read; the red run paid 5210 ms, so the margin a loaded shard needs is the one this card just spent a triage round on. (2) The gate's own header says it cannot follow a load inside another package's code and that "widening the population is a different card": the repo already names B as the right carrier. (3) The runtime population is small and enumerable from this head. A coarse grep over test files that construct the real ObjectStackProtocolImplementation and read a view by name, minus files that import the lint root at module top, names in runtime: src/package-revert-stored-members.integration.test.ts (servedLabel → protocol.getMetaItem({ type: 'view', … }) on a published view, first reached at the end of case (a), default budget, after a per-case kernel boot) and src/domains/meta-save-preconditions-parity.test.ts (door.read through the real REST route and catch-all in the metadata-protocol: the draft save records draftChanges (per-key provenance: which surface, actor and time last changed each key path) and serves it on the strict draft read; the save request declares its surface — the writer of #24298's key #24395 cases at the default budget; the finding(runtime): through the @objectstack/hono catch-all, PUT /meta/:type/:name ignores If-Match, If-None-Match and ?mode=draft — a stale token writes (200, not 409) and a draft save lands ACTIVE #22141 cases carry 60 s). src/domains/packages-seed-apply-org-scope.test.ts reads view / anything, a miss; I did not trace whether the miss exit precedes the decoration, so it is at most a candidate. Outside runtime the same grep names 13 metadata-protocol test files and 6 objectql test files, where the lint root is dist/ too; the grep does not tell whether each read resolves or sits in a clocked window, so those counts are a starting list for the card, not findings. (4) Nothing of this belongs in this PR: the delta's surface is one file, and a sweep is the shape the gate's header and the seat's standing order both refuse. The out-of-scope line in the dev report (carrier: none · noted, not filed) is answered by this: file it.
• Deviation 1 (vitest.config.ts): accepted, ①.3-①.4. Deviation 2 (not re-merged after main moved): no overlap, nothing owed.
• Check-runs on head 867f4777 at 2026-11-02T22:31Z: 25 completed/success, 18 completed/skipped, 8 in_progress, 0 failed or cancelled. Of the ten required contexts, Lint & Repo Gates, Build Core, Governed Surface Queue Guard, Test UI and Live E2E UI are success; Lint UI, Type Check UI and Build & E2E UI are skipped by their ui/** path filter, as expected for a diff with no ui/** path; TypeScript Type Check (workspace and consumer gates still running; source gates and debt ledger are success) and Test Core (shards 1/8 and 6/8 success; 2, 3, 4, 5, 7 and 8 still running) are in_progress. Every completed run is success or skipped. Test Core (3/8) is the shard that went red on main and the one whose completion is the direct reading for this fix; this record judges the tree and the completed conclusions, and the all-green landing precondition is the seat's to read again before queueing. The Docs Drift Check comment on the PR (vitest.config.ts yields no doc anchor) is advisory and asks for nothing.
• Governed surface: none; size 19 changed lines; skip-changeset, tests, size/s labels; draft, as the standing order requires until ACCEPT.

④ Design judgment

Not owed on this face (no schema, governed or narrowing path). The one design question the card raises, whether the lazy load is product cost to fix at the source, is answered in ①.6: the lazy root import is the declared design, the delta's product-code clause does not reach it, and no measured user-side latency is on record.

VERDICT: PASS

Must-fix: none.
Should-fix (no landing blocker):

1. For the seat's ACCEPT, not the dev: read the check-runs again once Test Core (shard 3/8 in particular) and TypeScript Type Check complete; and take the file's wall time for meta-write-org-scope.test.ts from that shard's log on this head as the after-reading on the suite-weight axis (the PR's table reports the file as the sum of case durations, 218 / 268 ms, which is the right measure for the clocked window and not the wall the 10 s rule is stated in; the red run's wall was 5978 ms with the load inside, and the move can only lower it).
2. Open question: file B as a p3 devx card seeded with the population in ③ (two runtime files, the coarse metadata-protocol and objectql lists), the gate's "widening the population is a different card" sentence as its reference, and the one-line-per-file preload as its expected fix; nothing in this PR changes.

---

Generated by Claude Code

[objectstack-fleet]

domain:server#2 · os-steve · session_01ADHkmQxwoGb5fSnrFkpxmt

席位核对

ACCEPT · domain:server seat 2 · os-steve · session_01ADHkmQxwoGb5fSnrFkpxmt · 2026-11-02T22:34Z · head 867f4777 · claimed by seat 2 on #29603 (claim 6588496082)

1. Shape: a draft PR against main with Fixes #29603. It is test-only, so skip-changeset applies: runtime ships dist only, and Check Changeset is green. check-governed-merges --pr 29622: NOT governed. No protocol.ts, no packages/spec, no ui/**.
2. The flake's cause: run 41514567522 timed out at 5000 ms at meta-write-org-scope.test.ts:419. The first served view read awaits loadFormLayoutLint(), which cold-transforms the lint package root inside the clocked case.
3. The fix: a module-top preload of the lint root, plus the anchored source alias that check:test-source-alias demands (packages/runtime/vitest.config.ts). That file is outside the declared surface, but the gate forces it and it is declared as deviation 1. No timeout was raised, nothing is retried or skipped, and no assertion moved. The case still PUTs through the real dispatcher and GETs the served view.
4. Contract review: PASS (6590167086) on this head, no must-fix.
5. Measured: the star case's p50/max went from 1202/1740 ms to 20/32 ms, and under 4-way contention from 1463/1654 ms to 20/30 ms. The runtime suite passes 528/528 files. Gates: 50/50 exit 0.
6. Open question ruled: B. The candidate population is enumerable now, so the seat filed it as test(devx): a clocked test whose first served view read cold-loads the lint package root can time out under shard load; find and warm the rest of the population #29627 (domain:devx, p3). Nothing changes in this PR. Product code stays out: the lazy import keeps the lint root off the boot path by design.
7. Should-fix 1: auto-merge waits for every required check, including Test Core shard 3. The seat reads that shard's wall time for the file in the landing record.
8. Landing: pr_ready + automerge_enable through the relay.

---

Generated by Claude Code