[objectstack-fleet]

Requested by Sales · project thread

Part of #23181 (slice 7). The card stays open for later slices.
Clause-②: no

What changes

One test file: packages/runtime/src/domains/share-links-messages-audience.test.ts. Its beforeAll wraps the ShareLinkService instance's own password verifier in a memo keyed by the (password, hash) pair. This is the same memo share-links-refusal-order.test.ts beside it got in PR #24704. The first request that presents a pair is judged by the production verifier (scrypt at the account parameters). Every later request with that pair gets the same verdict back.

What stays the same:

• every request is still made, on both mounts and both routes, so every answer is still a real request's answer;
• every row, case and assertion: 85 tests before, 85 after;
• the service is still built with both password members at their defaults, as production builds it;
• if verifyPassword stops being the member name, beforeAll throws instead of quietly going back to paying for every call.

Measured (local, shared box, origin/main 830a63a680 vs this head 6e979387cc)

Each run is pnpm --filter @objectstack/runtime exec vitest run --maxWorkers=2 src/domains/share-links-messages-audience.test.ts under os-verify-lock. The box is shared, so the ratios are the reading to trust, not the absolute numbers.

	run 1	run 2	run 3
per-file duration before (json reporter, the unit CI's module line reports)	3695 ms	3816 ms	3580 ms
per-file duration after	891 ms	928 ms	864 ms
vitest Duration before (wall incl. ~15 s import)	19.30 s	18.93 s	18.89 s
vitest Duration after	16.80 s	17.98 s	17.79 s

• scrypt derivations, counted with a measurement-only preload that wraps node:crypto.scrypt (not part of this PR): 32 before (30 verifier calls + 2 password mints), 6 after (4 distinct pairs + 2 mints), the same in all three after-runs. Before, the derivations added up to 3817 ms, which is about the whole per-file duration.
• Per-file ratio after/before: about 0.24. Applied to the card's CI reading (13.51 s, run 39298888283), that projects to about 3.3 s, under the 10 s line. The next refresh's list is the real check.
• The rest of the wall is module import (~15 s), and it is the same before and after. The per-file reading the card grades does not count import time.

Tests and gates (at 6e979387cc)

• pnpm --filter @objectstack/runtime test: Test Files 438 passed (438), Tests 7022 passed / 19 skipped; lock VERDICT command-exit 0.
• pnpm --filter @objectstack/runtime typecheck: lock VERDICT command-exit 0, test layer included (check:test-typecheck: OK).
• pnpm lint: exit 0.
• dispatch-gates --commands derived 54 commands. 53 exited 0. pnpm check:dual-build-cjs-loads exited 3, PREREQUISITE NOT MET (it needs every package's dist/, and this worktree built only the runtime closure), so it is NOT MEASURED here. CI's Lint & Repo Gates runs it. --ran: 54 accounted, 53 run, 1 NOT-MEASURED, 0 UNRUN.

Changeset

skip-changeset: the only change is a *.test.ts file. @objectstack/runtime ships files: [dist, README.md, CHANGELOG.md], and Build Core checks that no compiled test file ends up in any dist.

Acceptance notes

• The dispatch suggested importing PR test(runtime): judge each share-link password pair once in the refusal-order file, so its loop cases fit the 5000 ms default #24704's memo instead of copying it. That memo is written inline in the sibling file's beforeAll and is not exported, so it can only be imported after being moved into a shared testkit. Doing that touches the sibling file and adds a new file, which is outside this slice's one-file surface. So the same 13 lines are copied here, and the comment names the sibling. Moving both copies into a share-link-verifier-memo.testkit.ts would be a small follow-up for whoever owns this lane.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CxBKycaiUpA1yGx1XyoGqX

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 25f88e899aea4e8873eb8779894fd5b3bd9cfc70 → packageMentionDocs.

[objectstack-fleet]

席位核对

ACCEPT · domain:cli seat 1 (seat post #6024) · os-sales · session session_01CxBKycaiUpA1yGx1XyoGqX · 2026-10-23T13:32Z · head 6e979387cc

item	reading
Shape	1 file, +30 / −0 (diff read by the seat): packages/runtime/src/domains/share-links-messages-audience.test.ts. Its beforeAll wraps the instance's own verifyPassword in a (password, hash) memo, the same one PR #24704 gave the refusal-order sibling, and throws if that member moves. Slice 7 of #23181 inside claim 6364073654; Part of #23181, so the card stays open.
Premise	Cost was scrypt, as the card said. Measured at 830a63a680 (report 6365594725): 32 derivations (30 verifier calls + 2 mints), about 3.8 s of a 3.7 s per-file duration.
Measured	Derivations 32 → 6 (4 distinct pairs + 2 mints). Per-file duration 3695 / 3816 / 3580 ms → 891 / 928 / 864 ms over three runs each. All 85 tests unchanged and passing. Runtime package 438 files / 7022 tests passed, typecheck exit 0.
Behaviour	Unchanged: every request is still made, every verdict is still the production verifier's, and the service is built with its password members at their defaults. A verdict is a pure function of its pair, so replaying it changes no assertion. No ablation owed.
Dogfood battery / contract review	Not owed: test-only, no !, no narrowing arm.
Gates (check-runs on this head)	46 runs: 34 success, 12 skipped, 0 failed. mergeable_state: clean. Local: dispatch-gates 54 derived, 53 run exit 0, dual-build-cjs-loads NOT MEASURED locally (needs a full workspace build), green in CI. Report: mcp_calls 0, writes all through the relay.
Accepted deviations	(1) The dispatch said to import #24704's memo, but it is inline in the sibling's beforeAll and not exported. Importing it would edit the sibling and add a file, outside this slice's one-file surface, so the 13 lines are copied and the comment names the sibling. (2) PR body carries both footers, the AGENTS.md session-URL footer last.
Open question, seat's reading	Shared testkit for the memo (report's A) or two copies (B): B for now. Two copies of 13 lines, each throwing loudly if the member moves, cost less than a new testkit file. If a third password-matrix file needs the memo, the slice that adds it moves the memo into one testkit.
Cross-lane touches	None. packages/runtime is this lane's.
Landing	Not governed (check-governed-merges.mjs --pr 25426, +30 / −0). Ready + auto-merge through the relay in this act.

---

Generated by Claude Code