test(verify): five slow test files pay the boot's first load at module scope, and handle builds its second fixture without a registry reset

[objectstack-fleet]

Part of #23181
Clause-②: no

Slice 3 of the test-budget card: the @objectstack/verify row, 24 files. This PR measures all 24 and changes five of them, adds one new shared test helper, and classifies that helper in one repo gate script. Nothing published changes: skip-changeset applies by its criterion, because nothing in the package's files[] moves and scripts/ ships in no package.

What changed

• New packages/verify/src/boot-warm-up.testkit.ts. warmUpBoot(opts, { requires }) boots a throwaway app (no objects, its own in-memory database), signs the seeded admin in, signs one member up, and stops. A test file calls it once at module scope (await warmUpBoot(...)), so the boot's first load is paid during collection instead of inside the first clocked beforeAll or it. That is the repo's clocked-window convention (AGENTS.md, Build & Test: "clocked windows measure behaviour, never loading"). The helper shares nothing a case asserts on.
• Five row files call it, each with the options (and requires) of its own first boot: handle.test.ts (automation: true), automation-trigger-elevated-door.test.ts and action-flow-elevated-door.test.ts (automation: true, requires: ['automation', 'triggers']), harness.served-composition.test.ts and delete-behavior.test.ts (defaults).
• handle.test.ts also drops one redundant arrangement. freshHandleFixtureStack() built its "configuration of its own" with vi.resetModules() and a re-import. That drops the whole module registry, so each call re-evaluated the fixture's entire graph and every lazy load of the boot after it. It now imports the fixture module alone under a specifier of its own (./handle.fixture.js?instance=N). The fixture's builder still runs once more, every nested definition is still new, and its imports resolve to the instances the file already holds. The two cases that use it went from 2045 to 2469 ms to 769 to 1010 ms.
• scripts/check-verify-stand-in-erasure.mjs classifies the helper (patch round 1). The stand-in erasure guard discovers every exported function in a non-test packages/verify/src file whose first parameter is a type the package declares and publishes, and warmUpBoot(opts: BootOptions) is one. It is added to NOT_A_STAND_IN with its reason: it takes the same BootOptions that bootStack takes, index.ts does not re-export it, it is absent from dist, and it checks nothing. The guard's discovery is unchanged. Unclassified, pnpm check:verify-stand-in exited 1 (reproduced at 121ac4d71); classified, the guard and its --self-test exit 0 (2 guarded, 18 exempt, 10 call sites reached).

Unchanged: every it/describe title line (sha256 identical at 1a9d48813 and the head for all five files) and every expect( (77, 10, 13, 12 and 39, before and after). No timeout value moved. No test was removed or moved to another project.

The row, measured before changing anything (H1)

Box: 4 vCPU, shared with sibling agents. Every run went through os-verify-lock. "Clocked" is the file line's duration in vitest's default reporter (hooks plus tests, collection excluded), the number CI's report-test-timings.mjs reads. Runs had AI_AGENT and CLAUDECODE unset, so vitest picks that reporter. "Isolated" means vitest run --maxWorkers=2 on the file alone, at 1a9d48813. The whole-package run is pnpm --filter @objectstack/verify test (41 files, 362 tests, 157.4 s). The warm-up probe column is an untracked copy of each file with a plain module-scope warm-up (boot plus sign-in, default options), one run each, deleted before any commit.

#	file	tests	card (CI, s)	isolated before (ms)	card ÷ isolated	whole package before (ms)	warm-up probe (ms)	probe Δ (ms)
1	unique-scope.test.ts	13	84.2	22284 / 19326 / 18307 (median 19326)	4.4×	24211	18120	−1206
2	parent-write-reach.test.ts	10	64.0	18035 / 15857 / 15402 (median 15857)	4.0×	21285	14519	−1338
3	delete-behavior.test.ts	8	46.4	11271 / 9378 / 10351 (median 10351)	4.5×	11287	8122	−2229
4	handle.test.ts	24	38.3	11513	3.3×	10263	7723	−3790
5	harness.one-composition.test.ts	10	31.9	9999	3.2×	10795	8405	−1594
6	reference-shape.test.ts	5	31.8	7514	4.2×	7018	5272	−2242
7	harness.key-custody.test.ts	7	28.1	6347	4.4×	6808	4796	−1551
8	delete-behavior-referenceless-tree.test.ts	8	26.4	8308	3.2×	9573	6766	−1542
9	harness.required-providers.test.ts	7	24.9	7565	3.3×	7793	5920	−1645
10	harness.org-context.test.ts	5	23.2	5803	4.0×	5374	3591	−2212
11	harness.served-composition.test.ts	7	23.2	7487	3.1×	6972	4958	−2529
12	harness.app-default-profile.test.ts	6	22.4	5730	3.9×	6003	3876	−1854
13	harness.posture-only.test.ts	5	20.0	5697	3.5×	6260	3912	−1785
14	handle.observe-writes.test.ts	11	18.5	3699	5.0×	3677	1882	−1817
15	handle.update-doors.test.ts	9	17.4	4152	4.2×	3839	2393	−1759
16	handle.system-insert-delete.test.ts	7	15.5	3983	3.9×	3537	2185	−1798
17	automation-trigger-elevated-door.test.ts	16	15.0	4681	3.2×	3833	2042	−2639
18	harness.host-resolution.test.ts	11	14.6	2891	5.1×	2360	797	−2094
19	handle.public-form-door.test.ts	7	14.0	3690	3.8×	3172	2158	−1532
20	action-flow-elevated-door.test.ts	16	13.6	4802	2.8×	3614	2500	−2302
21	harness.artifact-door.test.ts	6	13.1	3784	3.5×	3753	1721	−2063
22	handle.exemplar-deal-lifecycle.test.ts	12	12.6	3835	3.3×	4135	2149	−1686
23	erasure-transaction-authorization.test.ts	4	12.5	4426	2.8×	3885	2229	−2197
24	handle.automation-door.test.ts	6	11.4	4591	2.5×	3937	2456	−2135

The card's readings are 2.5× to 5.1× the isolated ones (median about 3.8×), so H1 holds. Three files are over 10 s even isolated: unique-scope (19.3 s), parent-write-reach (15.9 s) and delete-behavior (10.4 s).

Where the wall goes

A timing probe (untracked copies that time bootStack, signIn, signUp, seed, each family's run…Proofs, and every node:crypto.scrypt call; deleted before any commit) read the top three files:

file	boots (ms)	proof runs (ms)	scrypt	the cases themselves	clocked
unique-scope	8 boots, 10007 (first 3007; the rest 755 to 1251)	7 runs, 9228	19 derivations, 2819 ms	179 ms	20599 ms
parent-write-reach	3 boots, 4295 (first 2686; then 842, 767)	3 runs, 11334, incl. 16 sign-ups and 13 sign-ins	32 derivations, 3313 ms	28 ms	15674 ms
delete-behavior	2 boots, 5270 (first 4218; then 1052)	2 runs, 6285	4 derivations, 967 ms	14 ms	12083 ms

• H2 is falsified as stated. The top three files already share one boot and one proof run per describe, and every case only reads that run. Each describe boots a different app, posture or database: the walled leg, the controls that seed a duplicate before the declaration arrives, and the attribution apps. A merged boot would change the reports whose summaries the cases assert. So there is no per-case redundant arrangement to share there.
• H3 is falsified. No row file has a module-level warm-up. In every file the first boot is 2 to 3 s slower than the later ones. That is first use, not the boot: the default datasource's drivers and better-auth's entries are imported lazily from inside the boot, sql.js compiles its WASM, and every path runs cold. It lands in the first clocked window. The warm-up probe removed 1.2 to 3.8 s from every one of the 24 files.
• One redundant arrangement: handle.test.ts's registry reset, described above.
• H4: what remains in the top three files is the per-boot steady cost (about 0.75 to 1.25 s per bootStack, isolated) and the families' proof runs. That is source in the published package (harness.ts, the kernel boot, the runners), so it is reported, not edited (Acceptance notes).

Which five files. They were ranked by measured removable test-side cost: handle (3.8 s plus the registry reset), automation-trigger-elevated-door (2.6 s), harness.served-composition (2.5 s) and action-flow-elevated-door (2.3 s). Four files tie for fifth within 50 ms: reference-shape 2242, delete-behavior 2229, harness.org-context 2212 and erasure 2197 ms. The tie goes to the largest card reading, delete-behavior at 46.4 s.

Before and after, per changed file

Interleaved A/B, three rounds: base bytes from an untracked copy of each file at 1a9d48813 (blob df66cfeb96ee for handle.test.ts), then the changed file, alternating, all through the lock.

file	card (CI)	isolated before (ms)	isolated after (ms)	median	whole package (ms), one run each	projected CI at the file's own ratio
handle.test.ts	38.3 s	10735 / 9524 / 9520	4474 / 4336 / 4290	9524 → 4336 (−54%)	10263 → 5052	about 17 s: row not claimed
automation-trigger-elevated-door.test.ts	15.0 s	4715 / 4328 / 4206	1564 / 1789 / 1616	4328 → 1616 (−63%)	3833 → 2444	about 5.6 s: row claimed
action-flow-elevated-door.test.ts	13.6 s	3966 / 4316 / 4223	1581 / 1562 / 1488	4223 → 1562 (−63%)	3614 → 2400	about 5.0 s: row claimed
harness.served-composition.test.ts	23.2 s	7308 / 7093 / 7660	5006 / 4844 / 5201	7308 → 5006 (−31%)	6972 → 6173	about 16 s: row not claimed
delete-behavior.test.ts	46.4 s	9817 / 9889 / 10021	8023 / 7673 / 8300	9889 → 8023 (−19%)	11287 → 9756	about 38 s: row not claimed

The projections multiply the median after by the file's own card ÷ isolated-before ratio. They are estimates; the card's own pin, the next refresh list, decides.

What the move costs. The warm-up runs during collection, so each changed file's collection (vitest import) grew by 2.6 to 6.6 s isolated (median per file). Each file's whole isolated vitest Duration (collection plus clocked) moved by −1.6 s (handle.test.ts, whose registry reset was real work and is gone) to +3.9 s (the trigger door), by median of the three rounds: the warm-up's own boot, sign-in and sign-up are new work, so for four of the five files the total wall rose while the graded clocked time fell. The whole-package run went 157.4 s → 167.9 s, one run each on a shared box. The 36 unchanged files' summed file lines moved 185.6 s → 188.0 s in the same pair of runs, so the box load was similar, and most of the rise is the five warm-up boots in collection.

Proof the changed files still fail when their subject breaks

There was one ablation per changed file, with the prediction written down before each run. The verify-source ablations ([A], [D], [E]) went through scripts/ablation-replace.mjs in wrap mode. Every restore was proven: blob equals HEAD, git diff HEAD empty, git status --porcelain clean.

• [A] handle.test.ts. Mutation: the handle's tenancy reader (packages/verify/src/handle.ts) answers a constant single posture. Predicted: 1 red. Observed: 1 failed / 23 passed. The red case was reports the walled posture a multi-tenant boot runs under — same reader, other stack, the case that boots the query-imported fresh fixture.
• [B] automation-trigger-elevated-door.test.ts. Mutation: runtime's refusesElevatedSelfTriggeredStart (packages/runtime/src/flow-start-admission.ts) always answers false. This suite reads runtime through dist/, so the run was: --hold, rebuild runtime, ablation-dist-preflight (marker present in 2 built files), test, restore by git checkout HEAD --, rebuild, preflight --absent (marker absent from all 6 built files, tree clean). Predicted: 7 red. Observed: 7 failed / 9 passed (the six REFUSED rows and the wire envelope).
• [C] action-flow-elevated-door.test.ts. Same mutation and build legs as [B]: the action door asks the same predicate. Predicted: 7 red. Observed: 7 failed / 9 passed.
• [D] harness.served-composition.test.ts. Mutation: harness.ts builds the analytics service without resolveCapabilityArgument('analytics', …). Predicted: 2 red. Observed: 2 failed / 5 passed (the two declared-cube cases; the no-cube control stayed green).
• [E] delete-behavior.test.ts. Mutation: the family's judge() reads the cascade branch inverted (packages/verify/src/delete-behavior.ts). Predicted: 4 red. Observed: 4 failed / 4 passed (positive proof and summary; NEGATIVE control and its count; the derive cases, the observation case and the ATTRIBUTION control stayed green).

Tests and gates

The test and typecheck readings below are at 121ac4d71, a merge of origin/main 8d05456cb into the branch. The gate readings are at 1d178dcfc, the patch head, which changes one repo gate script and nothing a @objectstack/verify test reads.

• pnpm --filter @objectstack/verify test: 41 files and 362 tests passed, exit 0. In that run the five changed files read 5052, 2444, 2400, 6173 and 9756 ms (handle, the two elevated doors, served-composition, delete-behavior).
• pnpm --filter @objectstack/verify typecheck: exit 0. tsc --noEmit is clean, and check:test-typecheck is OK, with 0 entries in the debt ledger. All six changed files are in the tsconfig.test.json program (tsc --listFilesOnly: 1 hit each). The helper is also in the build config's program, and it is in no tsup entry.
• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at 1d178dcfc derived 70 commands for the 7 changed paths (the gate script brings 20 families more than the 50 the six test paths derived at 121ac4d71). After a full turbo run build (76/76 tasks, all cached) in the recreated worktree, all 70 exited 0. --ran: "70 derived, 70 run, 0 NOT-MEASURED, 0 UNRUN." At 121ac4d71 the 50-command derivation had also reconciled 50 of 50 (pnpm check:dual-build-cjs-loads answered exit 3, PREREQUISITE NOT MET, until a full build, then exit 0).
• origin/main has since moved eight commits. One of them makes dispatch-gates name check:durability-log-level for some files; pnpm check:durability-log-level exits 0 at 1d178dcfc.
• Lint, which dispatch-gates does not name: pnpm exec eslint packages/verify scripts/check-verify-stand-in-erasure.mjs --no-inline-config exits 0. The repo-wide pnpm lint is left to CI.
• skip-changeset: the package's files[] is dist, README.md and CHANGELOG.md. Strings unique to this change (warmUpBoot, boot-warm-up, freshInstances) have 0 hits there (grep exit 1). The control from source (bootStackOnce) hits dist/index.js, index.cjs, both .d.ts files, README.md and CHANGELOG.md (grep exit 0).
• Every family CI runs is read from this PR's own check runs.

Acceptance notes

• Rows claimed: automation-trigger-elevated-door.test.ts and action-flow-elevated-door.test.ts. Shrunk, not claimed: handle.test.ts, harness.served-composition.test.ts and delete-behavior.test.ts. The other 19 rows are untouched here, and their numbers are in the table above.
• The same one-line fix fits the other 19 files. By the probe column and each file's own ratio, eight of them project under 10 s with a warm-up alone: handle.observe-writes (9.4 s, borderline), handle.system-insert-delete, harness.host-resolution, handle.public-form-door, harness.artifact-door, handle.exemplar-deal-lifecycle, erasure-transaction-authorization and handle.automation-door. A ninth, handle.update-doors, projects at 10.0 s. These are one-run probes; a later slice measures them properly. Not filed; the report carries the choice for the seat.
• What a test change cannot reach in the top files. unique-scope is 8 boots plus 7 proof runs, and parent-write-reach is 3 boots plus 3 proof runs that sign up 16 personas and sign in 13. That is the per-boot steady cost and the families' own behaviour, in harness.ts and the kernel boot. Observation only, not filed; the report's open question carries it.
• Scrypt. parent-write-reach pays 32 production-parameter derivations (3.3 s of 15.7 s) and unique-scope pays 19 (2.8 s of 20.6 s). Each sign-in right after its own sign-up or the admin seed re-derives the same password and salt. plugin-auth's scrypt-memo testkit answers exactly those, but it is package-private, and the seat's standing answer is one shared home, never a copy. Observation, not filed.
• The AGENTS.md sentence on the 10 s line gained "unless the file declares a measured budget with its class" today (merged into this branch from main). This PR declares no budget. Whether a stack boot per single-cause control fixture reads as that ruling's first class is a reading for the seat, not for this slice.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

2 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 9f8126048793e9b5760f87130cb83645f4c185ce → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 2657ad59816f2cfe19f5449528335d49f67ee082 — the merge of head 1d178dcfcb54760c22c6c01d99bbdb90bd8965d9 into base 9f8126048793e9b5760f87130cb83645f4c185ce, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 2657ad59816f2cfe19f5449528335d49f67ee082 && git checkout 2657ad59816f2cfe19f5449528335d49f67ee082
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 9f8126048793e9b5760f87130cb83645f4c185ce 1d178dcfcb54760c22c6c01d99bbdb90bd8965d9 && git checkout -B drift-repro 9f8126048793e9b5760f87130cb83645f4c185ce && git merge --no-ff 1d178dcfcb54760c22c6c01d99bbdb90bd8965d9

node scripts/docs-audit/affected-docs.mjs --json 9f8126048793e9b5760f87130cb83645f4c185ce

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[objectstack-fleet]

✅ ACCEPT, with a patch round owed: PR #23620 at 121ac4d711 (#23181 slice 3). It lands once the patch head is green and the changeset question below is settled

domain:cli seat 1 (#6024) · os-bill · session session_01FLwgbTSmGMrqsXkBDsiwfG · 2026-10-15T05:51Z · holder of claim 6183385368. Report: os-dev-report 6185382987. Thread-read: 6185352169.

席位核对

1. Shape, read on GitHub:
   • The PR is a draft against main, head 121ac4d711. Line 1 is Part of #23181, and the body carries no closing keyword. Line 2 is a bare, line-initial Clause-②: no. Assignee os-bill.
   • Files: 6, +122 / −3. Five row test files and the new packages/verify/src/boot-warm-up.testkit.ts, all inside the claim's surface (at most five row files, plus one shared helper there).
   • check-governed-merges --pr 23620: NOT governed. No content/docs/releases/ change.
2. The hunks:
   • Each of the five files adds one module-scope await warmUpBoot(...) with the options its own first boot uses.
   • handle.test.ts replaces vi.resetModules() with a query-suffixed import of ./handle.fixture.js. That gives a fresh instance of the fixture alone, so the whole graph is no longer re-evaluated.
   • The helper boots its own empty app on its own database, signs in, signs up, and stops before the file's first hook. Nothing a case asserts on is shared.
   • Titles are unchanged (sha256 of the title lines) and the expect( counts are unchanged (77, 10, 13, 12, 39). No timeout moved.
3. Measurement:
   • All 24 row files were measured isolated, and the whole package before and after.
   • Interleaved A/B, three rounds per changed file. Isolated medians:
     • handle 9524 → 4336 ms;
     • the trigger door 4328 → 1616 ms;
     • the action door 4223 → 1562 ms;
     • served-composition 7308 → 5006 ms;
     • delete-behavior 9889 → 8023 ms.
   • Five ablations went red exactly as predicted, each restore proven by blob.
   • H2 and H3 are falsified with measurements and accepted as such. The top three files already share their boots, and no row file had a warm-up.
4. Gates:
   • Local: 50 derived, 50 run. Package: 41 files and 362 tests pass; typecheck exit 0.
   • CI on 121ac4d711, read in this act: 39 check-runs, 24 success, 6 skipped, 6 in_progress, 3 failures.
     • Check Changeset: no label (see 5).
     • Lint · repo & tooling gates, and Lint & Repo Gates with it: a real red, owned by this PR. Its failing step is @objectstack/verify stand-in erasure guard (pnpm check:verify-stand-in). scripts/check-verify-stand-in-erasure.mjs scans every exported function in a non-test packages/verify/src file whose first parameter is typed with an interface the package declares and index.ts exports as a type. warmUpBoot(opts: BootOptions = {}) is one: BootOptions is declared at harness.ts:181 and exported at index.ts:16. Unclassified, it fails the run by design. The guard's own remedy is a human classification: NOT_A_STAND_IN with its reason, or the guarded set. A patch round goes to the same dev.
5. Changeset:
   • The seat checked the criterion for itself. @objectstack/verify publishes dist, README.md and CHANGELOG.md. The diff adds only test files and one *.testkit.ts that index.ts does not export, and the dev measured 0 hits for its names in a rebuilt dist/. So the PR is tests-only, and skip-changeset is the right form by its criterion.
   • ⚠️ The label is not applied by this seat. The dev's own write of it was refused by the session's permission classifier. The seat does not re-issue a write that was refused, so the label goes to the maintainer.
6. The report's open questions, answered:
   • (1) The next slice for the other 19 files: option A. The next hourly refresh first reads whether the two claimed rows left the list. Then a slice of up to five of the eight files that project under 10 s, re-measured with interleaved A/B.
   • (2) The top three (unique-scope, parent-write-reach, delete-behavior): they stay on test budget (domain:cli): 119 test file(s) over 10 s of wall in the hourly full battery (Part of #23151) #23181.
     • Their remedy is a measured source slice of this same card, on the harness boot cost (the card's "what it waits on"), opened with a boot profile.
     • Option B (a declared budget under ruling 6181973363) is not taken without an explicit reading of that ruling.
     • Option C (a shared scrypt memo) is an add-on once a shared home exists.
   • (3) The trade: option A, keep the whole-boot warm-up. It follows the AGENTS.md clocked-window convention, and the extra cost is bounded at about one boot per file.
7. Deviations:
   • Accepted: the ablations mutated four source files outside the surface, one run each, each restore proven; one 106 ms probe ran outside the lock; the merge commit carries git's default message.
   • The PR body sentence the report corrects ("stayed within ±2 s across the rounds", in "What the move costs") is wrong for two files. The seat writes the dev's replacement into the body when the patch round lands, per the role file: the dev never PATCHes the body.
8. Out of scope: the three observations are carried by this card, as the answers in 6 say. They are in Acceptance notes, and no card is owed.

Landing:

• No contract review is owed: test files only, Clause-②: no, not governed.
• Once the patch head is true-green, skip-changeset is on, and the body correction is written, the seat flips the PR ready and arms auto-merge.
• At the merge, test budget (domain:cli): 119 test file(s) over 10 s of wall in the hourly full battery (Part of #23151) #23181 goes back to pm:queue, unassigned, with a Release: line naming the remaining rows.

---

Generated by Claude Code

[objectstack-fleet]

Seat note: skip-changeset is applied, on the maintainer's go-ahead and the seat's own check · domain:cli seat 1 (#6024) · os-bill · session session_01FLwgbTSmGMrqsXkBDsiwfG · 2026-10-15T06:23Z · holder of claim 6183385368.

• Basis: the seat's own check. The check is recorded in ACCEPT item 5 on this PR.
  • @objectstack/verify publishes dist, README.md and CHANGELOG.md.
  • This diff adds five test-file edits and one *.testkit.ts. index.ts does not export the testkit, and none of its names appear in a rebuilt dist/.
  • So the PR is tests-only, which is the label's criterion.
• Why it went on now: the dev's own write of the label had been refused. The maintainer approved applying it in the seat's chat on 2026-10-15 (「PR test(verify): five slow test files pay the boot's first load at module scope, and handle builds its second fixture without a registry reset #23620 的 skip-changeset 标签，同意」), and the seat applied it then.
• Still owed before the queue:
  • the stand-in guard's patch round, which is in progress;
  • a true-green head;
  • the PR-body correction the report names.

---

Generated by Claude Code

[objectstack-fleet]

✅ ACCEPT, round 2: PR #23620 at 1d178dcfcb (#23181 slice 3, patch round 1). True-green; it goes to the queue now

domain:cli seat 1 (#6024) · os-bill · session session_01FLwgbTSmGMrqsXkBDsiwfG · 2026-10-15T06:36Z · holder of claim 6183385368. Report: os-dev-report 6186032985. Round 1: ACCEPT 6185460988.

席位核对

1. The patch:
   • One commit on top of 121ac4d711, +6 lines, adding the one NOT_A_STAND_IN entry warmUpBoot in scripts/check-verify-stand-in-erasure.mjs. The reason given is the guard's own classification text: it takes the same BootOptions as bootStack, the index does not re-export it, it is absent from dist, and it checks nothing.
   • The helper's signature and the guard's discovery are unchanged. That file is inside the claim surface as revised in round 1 (6185467308).
2. Red, then green:
   • The dev reproduced pnpm check:verify-stand-in exiting 1 at 121ac4d711 on the one CLASSIFIED problem. At 1d178dcfcb it exits 0 (2 guarded, 18 exempt, 10 call sites), and its --self-test exits 0.
   • Local union: 70 derived, 70 run.
3. Shape:
   • Line 1 is still Part of #23181. The full body has no closing keyword (scanned after the body write).
   • 7 files, +128 / −3. check-governed-merges --pr 23620: NOT governed. No content/docs/releases/ change.
4. Body: the seat wrote the report's seven pr_body_changes pairs in one read-modify-write. Each old text occurred exactly once, and the read-back was identical (17305 bytes). The pairs cover:
   • the "What the move costs" correction from round 0;
   • the line naming the guard edit;
   • the scope sentence and the gate section moved to the patch head.
5. Changeset: skip-changeset is on (6185906925, on the maintainer's go-ahead). The labeled run of Check Changeset on this head was skipped by the label exemption, and it supersedes the pre-label failure on the same head.
6. CI on 1d178dcfcb, read in this act:
   • Latest run per check: every check is success or an expected skip. The skips are Build Docs, Console Pin Gate, Dogfood ×2, Temporal Conformance, Packed-tarball smoke, Auto Label, Check PR Size and Check Changeset (label).
   • Lint & Repo Gates and TypeScript Type Check both succeeded.

Landing: the seat flips the PR ready and arms auto-merge through the relay. At the merge, #23181 goes back to pm:queue, unassigned, with a Release: line naming its remaining rows.

---

Generated by Claude Code