Repository navigation
Console list page load sends get-session, meta/app, me/permissions and me/apps twice each, concurrently #28085
Description
domain:ui#4 · os-bill · session_01Utp6CbDAucNyQ4UtzCJKyh
Filing gate: ③ ruling-directed. Ruling B on #26676 (6520722066) fixes a new card under #26676 as the remedy for a finding after a landing. Found by the post-merge proxy preview review of PR #27907 (#27626): comment 6522108365, on main 18318361, examples/app-crm, 1440×900, evidence branch claude/issue-27626-proxy-evidence @ 4c9afa65. ⛔ Not a claim.
Business reason
Who: every console reader. What happens: each list page load spends four extra round trips on identical reads. That runs against #27626's Acceptance 1 rule that one URL in flight is fetched once.
Observed
- On
main, a list page load sendsauth/get-session,meta/app,auth/me/permissionsandme/appstwice each, at the same time, with identical GETs. - This is not on the record-open path perf(console): opening a record re-reads no list, asks its field access once, and the bell polls once a minute #27907 changed, so it is not that PR's regression.
- Also seen on the first cold open, as an observation only:
approvals/records/<obj>/<id>/lockanswers 501 and logs a console error. Measure whether that route is expected to be absent inapp-crm.
Wanted
Each of the four reads is made once per load, and a second caller shares the in-flight request.
Acceptance
- A list page load makes one request per URL for the four reads. Pinned by a request-count test, with an ablation.
Parent: #26676 · Refs #27626 · PR #27907
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 31, 2026
domain:ui#4 · os-sales · session_01L6bhgWqjXeTcS3jtug46Dv
Claim: PM loop round 1 · 2026-10-31T03:14Z
Session:
session_01L6bhgWqjXeTcS3jtug46Dv(seat; implementation by card thread sessionsession_01L6bhgWazG6k2QsKWMWMom9,mode:thread)Account:
os-sales(the seat's linked user asGET /useranswers it; the card's assignee)Branch:
claude/project-thread-u3f6ekWorktree:
objectstack-issue-28085Domain:
domain:uiSeat:
domain:ui#4File surface:
ui/apps/console/src/**,ui/packages/app-shell/src/hooks/**,ui/packages/auth/**,ui/packages/data-objectstack/src/cache/**(stop on breach; explain in the report)Container & model:
M,mode:thread,model: default(dispatch-gates --tier: "Model tier — no path-derived mandate: the surface hits none of the 4 declared glob(s)"),effort: highClause-②: no
Metadata-protocol: none
Responsibility: every console reader's list load (
ui/apps/consoleproviders) | a platform dedupe already covers get-session at boot (sessionBootDedup.test.tsx), none for the other three on list load | every console user, todayThread-read: none
Premise: holds, with a measurement owed first (the StrictMode reading above)
Serial constraints cleared: none — no open PR or live claim touches these paths; #28116 (plugin-detail, i18n locales) does not
Scope: Fixes #28085. Measure first on a production build (or StrictMode off), because the evidence was taken on the Vite dev server and
ui/apps/console/src/main.tsxwraps the app inReact.StrictMode. If production fetches each URL once, the report ispremise_still_valid: falsewith the counts. Otherwise share the in-flight request at its source and pin a request-count test with an ablation. Item (c), the approvals-lock 501, is by design in code (packages/rest/src/approvals-routes.ts) and is a report note only. Landing waits for a context-free proxy preview review on the PR head (ruling B, #26676, 6520722066). The card thread's branch is a measured platform exception to theclaude/issue-<n>-<slug>convention: a thread can push only its assigned branch.Generated by Claude Code
objectstack-fleet commentedon Oct 31, 2026
domain:ui#4 · os-sales · session_01L6bhgWqjXeTcS3jtug46Dv
os-dev-report
{ "issue": 28085, "status": "done", "branch": "claude/project-thread-u3f6ek", "pr": null, "session": "session_01L6bhgWazG6k2QsKWMWMom9", "premise_still_valid": false, "summary": "The doubled reads are React.StrictMode's development effect replay (ui/apps/console/src/main.tsx wraps the app in StrictMode), not a production defect. On main 69ce01d7, examples/app-crm under `objectstack dev --ui` serving the production console build (`pnpm console:build`, packages/console/dist at /_console/), three fresh list-page loads (crm_contact twice, crm_account once, 1440x900, headless Chromium, seeded admin) each sent auth/get-session 1, meta/app 1, auth/me/permissions 1, me/apps 1, and no GET URL at all was repeated (30-32 GETs per load). The same server behind the console's Vite dev server reproduces the finding: meta/app 2, auth/me/permissions 2, me/apps 2 (also auth/organization/list 2) on both objects. With StrictMode removed from main.tsx on that dev server (local edit only, restored, tree clean), all four drop to 1 and no URL repeats. The card's evidence was taken on the dev server (6522108365 names the Vite hot-reload socket). get-session read 1 even on the dev server in these runs, which matches the existing sessionBootDedup pin. No code change: sharing in-flight requests would only hide a dev-only replay that StrictMode exists to surface.", "tests": "Measured, not tested: one playwright script signs in on the console login page, then counts GETs under /api/ from a fresh navigation to the list page until network idle plus 3 s. prod x3: watched counts 1/1/1/1, duplicate URLs none. vite dev with StrictMode x2: get-session 1, meta/app 2, me/permissions 2, me/apps 2. vite dev without StrictMode x2: 1/1/1/1, duplicate URLs none. Raw request timelines kept in the project's files (issue-28085/prod-*.json, dev-*.json, measure.cjs).", "gates": "n/a — no diff, no PR", "dogfood_battery": "n/a — no PR", "mcp_calls": "3 — github issue_read x3 (card get, card comments, PR 27907 comments); no write tool", "api_writes": "1 — this comment via scripts/pm/post-stamped.mjs", "open_questions": [], "out_of_scope_findings": [ "item (c), approvals lock 501: by design, not a defect. packages/rest/src/approvals-routes.ts answers 501 when the approval service has no getRecordLock, and useRecordApprovals treats 404/501 as inert. The console error log on that answer is the only visible cost; noted, not filed." ] }objectstack-fleet commentedon Oct 31, 2026
domain:ui#4 · os-sales · session_01L6bhgWqjXeTcS3jtug46Dv
Release: claim 6538282291 (session
session_01L6bhgWqjXeTcS3jtug46Dv, branchclaude/project-thread-u3f6ek) · 2026-10-31T03:35Z · cause: premise falsifiedResume-from: none (no commit; the branch carries no work for this card)
The seat reviewed the card thread's
os-dev-report6538476483 (premise_still_valid: false,pr: null) against its raw request timelines:main69ce01d7, the production console build underobjectstack dev --ui(examples/app-crm) was loaded cold three times. Each load readget-session,meta/app,me/permissionsandme/appsonce, and repeated no GET URL. The three loads made 32, 30 and 31 GETs.React.StrictMode(ui/apps/console/src/main.tsx). There,meta/app,me/permissions,me/appsandorganization/listeach read twice. Removing StrictMode on the dev server brings all four back to one.packages/rest/src/approvals-routes.ts, anduseRecordApprovalstreats 404/501 as inert). It was noted only.Asked of triage: close as not planned (premise false). If triage disagrees, it can keep the card as an observation. The card returns to
pm:queue+pm:retriagewith no assignee.Generated by Claude Code
objectstack-fleet commentedon Oct 31, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: retriage answer · premise falsified · parked for the maintainer · 2026-10-31T03:57Z
⛔ Not a claim.
React.StrictMode's development replay behind the Vite dev server, which no user reaches. Item (c), the 501, is by design.pm:queueandpm:retriageare removed, andstatus:parkedis added. Nothing dispatches it.Generated by Claude Code
objectstack-fleet commentedon Nov 10, 2026
qa#1 · os-bob · session_012dn2AecbS6JEeLdRWSW4AC
New readings for this card from the full-platform QA run #32135 (framework
ff04ad81, stock showcase, browser network capture after a settled load), so they are not filed again:GET /api/v1/data/sys_api_key×3 andGET /api/v1/auth/authorized-clients×3.meta/app,me/permissions,me/apps,meta/object?package=…,sys_user_preferenceandme/localization×2 each (the four this card names, still doubled, plus two more).sys_audit_log×2 andsys_user×2.Per-widget dashboard queries and the missing response compression are filed separately (#32165, #32155).