[objectstack-fleet]

Requested by Steve · project thread

Fixes #31663

The card's preferred fix: the one it that looped every subject state through every door is split into one it per state, the same way in all three postures. Claim 6727396721 (domain:server#1, card-thread session_01ADHkmSaqpcZzCHVZRYpzpW).

Clause-②: no — measured: test-only diff; no source file, request shape or answer changes, so nothing accepted on base is refused on head and nothing refused is accepted.
Metadata-protocol: none

skip-changeset: the diff is one test file under src/ that the package does not ship (plugin-security's files[] publishes dist, README.md, CHANGELOG.md; the built dist/ holds zero hits for this test's title text, against a positive control, DelegationScopeViolationError, in 2 built files), so nothing any released package publishes changes.

维护者速读

• 改了什么：plugin-security 的一个权限测试原来把 4 种"目标用户状态"放在同一个用例里依次跑完，现在每种状态是自己的用例；参照答案（"不存在的用户 id"的答案）在 beforeAll 里只算一次，其余 3 种状态逐一与它比相等。三种租户姿态都同样改。
• 为什么改：4 次完整启动共用默认 5 秒超时，main 上 529e535 那次 CI 分片负载高时超时了一次。拆开后每个用例只启动一次，有自己的 5 秒预算，失败时也能直接看出是哪种状态。
• 风险与回滚：只改测试文件，不改任何产品代码；断言一条没减，跨状态相等仍然保留。回滚即 revert 本 PR。
• 先看：packages/plugins/plugin-security/src/delegated-admin-own-name-set.posture.test.ts 第 878 行起的新 describe。
• 两分钟验证：pnpm --filter @objectstack/plugin-security exec vitest run src/delegated-admin-own-name-set.posture.test.ts —— 预期 202 passed(main 上 193)。
• 需要你做的：无，席位落地。

What changes

• packages/plugins/plugin-security/src/delegated-admin-own-name-set.posture.test.ts — in the describe "a delegated answer about a user the caller cannot read does not depend on that user's existence or memberships", the it "the 4 states get, at every door, the answer the id naming no user gets" becomes a describe of that same title, per posture:
  • beforeAll asks every door once for the reference state, an id naming no user (one rig).
  • it "an id naming no user: the write gate's scope violation, and each explain door's refusal …" holds the reference answer's assertions, unchanged: 403 DELEGATION_SCOPE_VIOLATION at the four write shapes, 403 PERMISSION_DENIED at both explain doors, and the two details pins.
  • it.each over the other three states: each boots its own rig and asserts toEqual(reference). That is the cross-state equality, kept as its own assertion per state, with the state as the failure label.
  • beforeAll joins the vitest import.
• Nothing else. No global testTimeout, no per-test timeout, no skip, no assertion removed or loosened. The forced test edit is this restructuring itself; no other test moved.

Tests

Test count of the file: 106 → 115 on the first head (+3 per posture = 4 states − 1). After merging origin/main (b126c1306, which brought #31634's two describes into this file): 193 on main → 202 on head 8c1ef9f0, the same +9. The whole plugin-security suite on 8c1ef9f0: 1280 files, 6079 tests: 6034 passed, 45 skipped, 0 failed.

Slowest case, 20 consecutive runs of the file each side (vitest run --maxWorkers=3 --sequence.concurrent=false; 3 is CI's VITEST_MAX_WORKERS on the 4-core runner, read from scripts/vitest-worker-cap.mjs), under os-verify-lock, on a 4-core shared container:

Posture	Base 5d1382a5: the one it (p50 / p99 / max)	Head c2516ef6: slowest state it (p50 / p99 / max)
single	761 / 847 / 847 ms	209 / 271 / 271 ms
group	783 / 918 / 918 ms	212 / 298 / 298 ms
isolated	789 / 904 / 904 ms	222 / 281 / 281 ms

On the merged head 8c1ef9f0, 20/20 more runs green, 202/202 each; the slowest split state's p99 is 252 / 268 / 254 ms (group / isolated / single), and the slowest test in the file is the untouched ground truth it at 685 ms.

Slowest case on c2516ef6: 298 ms, posture group, state "a user whose business unit is outside the scope". The reference it itself takes 2–4 ms (the boot is in the beforeAll). In the full-suite run under the package's own load, the slowest split case was 242 ms. 20/20 runs green on base and 20/20 on head.

Reading: on this box the old it used about a fifth of its 5 s budget; CI's timeout came from shard load (Test Core 8/8 runs several packages at once), which this box does not reproduce. After the split each it carries one rig, about a quarter of the old work, against the same 5 s budget.

Acceptance notes

• The ground truth: the delegate reads the subject exactly in the states where it is a user the delegate may read it in the same describe also loops (five rigs, read door only): p99 705–782 ms on base, 737–760 ms on head over the same 20 runs. It is lighter than the split loop was (one read per state, not six doors) and outside this card's Fix; noted, not changed.

Verification

Merge of origin/main (8c1ef9f0). main moved 19 commits; #31634 (18cdcb20) edited this file. The only conflict was the vitest import line (both sides added beforeAll); it resolves to main's line, describe, it, expect, afterEach, beforeAll, afterAll, vi. #31634's tests are kept byte-for-byte: git diff origin/main on the file is exactly this PR's split (+28 / -15). Its describes do not carry the card's shape (their per-state refusals already share one beforeAll rig per state), so nothing of theirs was split. On 8c1ef9f0: 20 × the file under the lock, VERDICT command-exit 0; whole suite as above; typecheck VERDICT command-exit 0; eslint exit 0; dispatch-gates --commands the same 53, all exit 0, --ran 53 derived, 53 run, 0 NOT-MEASURED, 0 UNRUN. CI on 8c1ef9f0: every check suite completed with no failure.

Round 1, all on head c2516ef6, after its last commit:

Commands and verdicts

• pnpm exec turbo run build --concurrency=2 --filter='@objectstack/plugin-security^...' then --filter='./packages/**' under os-verify-lock: VERDICT command-exit 0 both.
• 20 × vitest run --maxWorkers=3 --sequence.concurrent=false src/delegated-admin-own-name-set.posture.test.ts on base and on head, one lock hold each: VERDICT command-exit 0, every run exit 0.
• vitest run --maxWorkers=3 (whole plugin-security) under the lock: VERDICT command-exit 0, 5933 passed / 45 skipped / 0 failed.
• pnpm --filter @objectstack/plugin-security typecheck under the lock: VERDICT command-exit 0 (check:test-typecheck: OK, 0 errors).
• eslint --no-inline-config packages/plugins/plugin-security: exit 0.
• node scripts/pm/dispatch-gates.mjs --commands: 53 commands, all run, all exit 0. Three first answered exit 3 (prerequisite not met) and were re-run green after their prerequisite: check-plugin-teardown-shape --self-test (after fetching its pinned fixture commit), check:dual-build-cjs-loads and check:i18n (after the full package build). --ran reconciliation: 53 derived, 53 run, 0 NOT-MEASURED, 0 UNRUN.
• Ablation: n/a. The diff changes no behaviour a test pins; it regroups the same assertions.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json b126c13065db29c80996efc7e0527a40f651c923 → packageMentionDocs.

[objectstack-fleet]

domain:server#1 · os-steve · session_01ADHkmPF1skfu2kx89BEXZi

席位核对 · round 1 · head c2516ef6 · 2026-11-08T22:14Z

Verdict: ACCEPT.

• The card's preferred fix, applied the same way in all three postures. The one looping it becomes a describe with the same title.
  • beforeAll asks every door once for the reference state, STATES[0]: the same answers[0] / none the old body compared against.
  • One it keeps the reference's envelope assertions verbatim: the two 403 families, plus the details checks.
  • it.each(STATES.slice(1)) asserts each other state toEqual(reference). The cross-state equality is kept and nothing is weakened.
• No timeout raise, no skip. Every state now runs in its own it, with its own budget and failure line.
• Measured. The test count goes 106 → 115 (+3 per posture). 20/20 runs were green on both base and head, under --sequence.concurrent=false at 3 workers.
  • Base p99 of the old it: 847 / 918 / 904 ms.
  • Head p99 of the slowest state: 271 / 298 / 281 ms.
  • The full plugin-security suite is green.
• File surface. Only the one test file is touched. skip-changeset is right: the change is test-only and nothing publishes.
• Noted, no change asked. The sibling "ground truth" it also loops (p99 about 0.76 s, well under budget). A follow-up is only warranted if it ever reds.

Landing: after CI is green on c2516ef6.

[objectstack-fleet]

domain:server#1 · os-steve · session_01ADHkmPF1skfu2kx89BEXZi

席位 ACCEPT · 冲突轮 · head 8c1ef9f0dbe471ab0e94bfcd04aa4f8d72fc2da2

• 合 main(b126c13)，无 rebase/force。冲突只在 vitest import 行，取 main 的 describe, it, expect, afterEach, beforeAll, afterAll, vi。git diff origin/main...head 仍只有本卡的拆分(+28/-15，1 个文件)，fix(plugin-security)!: a delegate can neither capture nor evict a direct grant beyond its scope #31634 新加的用例逐字保留。
• 复读本 head 的拆分：参照态 STATES[0] 在 beforeAll 里只问一次，断言与原 it 相同；其余各态各自一个 it.each，与参照态 toEqual。覆盖面不减，每态各有 5 s 预算和自己的失败行。
• check-runs：34 success / 16 skipped / 0 其他。check-governed-merges → NOT governed。距 main K=4。
• 卡片线程本 head 门禁对账：53 派生 / 53 已跑 / 0 NOT-MEASURED。
• 现场证据：refactor(objectql): ScopedContext's two bodies that hand the instance on move into its facet (#30020 S1) #31665 的队列运行 42530245440 正是被本文件 L878 的 5 s 超时踢出。

落地：relay pr_ready + automerge_enable。