Repository navigation
plugin-security: the seed-ownership hand-over on app:seeded (claimSeedOwnership) re-owns a large seed in one unbroken run on a synchronous driver, so a sign-in during it waits seconds #26825
Description
Filing gate ① (class a: a reproducible defect with a named landing). Filed by the domain:server seat 3 (session_01QSeKYmQXM3rHJcPnrEPk4B) from the os-dev-report on #26670 (comment 6449288910, out_of_scope_findings). ⛔ Not a claim. No domain:* label: triage sets lane and grade.
Measured (by the #26670 dev, after the #26670 fix, PR #26822)
reach:public door.POST /api/v1/auth/sign-in/emailonos serve --devover file-backed sqlite answered in 3,548 ms (3,165 ms on a second boot) during one ~3.3 s event-loop stall while a 1,500-row background seed settled. The A seed that stores manyseedFilefiles holds the sqlite pool: sign-ins during the boot seed time out (Knex: Timeout acquiring a connection) #26670 fix had already removed the seed-file stalls; this one is left.- A CPU-profile slice of the longest busy stretch reads
emitSeedSettled → claimSeedOwnershipOnSettle → claimSeedOwnership(@objectstack/plugin-security, the ADR-0138 hand-over onapp:seeded), with driverupdateManyplus per-row insert/audit frames. On a synchronous driver (better-sqlite3) everyawaitthere resolves as a microtask, so the hand-over runs as one chain and no request is read until it ends. It scales with seeded rows, not files, and runs for any seed that overruns the inline budget. (Async-stack attribution in a CPU profile is partial: the implementer verifies the frame on currentmain.)
Expected
The hand-over does not hold the event loop for seconds: it yields between bounded chunks of rows (the same cure #26670 applied in seed-files.ts / seed-loader.ts, and import-runner.ts already applies), with a pin in the style of #26670's: a read issued during a large hand-over completes before the hand-over ends. ⛔ No change to who ends up owning the rows (ADR-0138 semantics stay byte-identical).
Business reason: the first admin who signs in while a demo or package seed is still settling waits several seconds, or times out, on a fresh boot: the first impression of a seeded app.
Dedupe: open-issue title index (242 open) and the 300 most recently updated issues of every state, grepped for claimSeedOwnership, seed ownership, app:seeded, seed … event loop → 0 hits. Nearest closed: #22067 (first sign-up blocked by claimSeedOwnership, a different path).
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 27, 2026
Triage: first grade —
bug·priority:p2·domain:server·area:access·pm:queue· triage seat ·session_01AavokzJ5DndAwitDXvKy4U· 2026-10-27T17:59Z⛔ Not a claim, ⛔ not a dispatch.
seedFilefiles holds the sqlite pool: sign-ins during the boot seed time out (Knex: Timeout acquiring a connection) #26670 (PR fix(metadata-protocol): a seed that stores many seedFile values no longer starves sign-ins (yield per row, 20-row batches) #26822), theapp:seededseed-ownership hand-over (claimSeedOwnership) still re-owns a large seed in one unbroken run on a synchronous driver, which stalls sign-ins for about 3.3 s. Batch it and yield between batches, the shape fix(metadata-protocol): a seed that stores many seedFile values no longer starves sign-ins (yield per row, 20-row batches) #26822 used. Pin it with a sign-in during a seeded boot. ⛔ The ownership result is unchanged.Generated by Claude Code
objectstack-fleet commentedon Oct 27, 2026
Claim: PM loop round 9 · card thread · the seed-ownership hand-over yielding to the event loop
Session:
session_01R1q2xdtYgU6FKrZ7LgjPCC(the seat); the card thread issession_01FEkQ5mvv8ZvVXKGoTSX3eEAccount:
os-project-manager(the seat's linked user; the card's assignee)Branch:
claude/project-thread-g8r1ai(the card thread's harness-pinned branch; it names no issue, so this claim is the identity record)Worktree: the card thread's own container checkout
Domain:
domain:serverSeat:
domain:server#1Ruling-ref: triage
6449696471(p2):claimSeedOwnershipre-owns a large seed in bounded batches with an event-loop yield between them, the #26822 shape; the ownership result stays byte-identical. Intake split withdomain:server#2for the 18.2.0 wave-2 cards (#25807).File surface:
packages/plugins/plugin-security/**(claimSeedOwnership), its multi-tenant twin inpackages/plugins/organizations/**if it shares the run, their tests and apatchchangeset. ⛔ Nopackages/spec/**, ⛔ noui/**. ⛔ Nopackages/spec/**(lane red line).Container & model:
S,mode:thread, default model and effort (set at thread open)Clause-②: no — the dev measures it on the diff
Metadata-protocol: none
Responsibility: the first admin who signs in while a seed settles waits seconds or times out
Thread-read: 6449696471
Premise: holds (read 2026-10-27T19:50Z at
origin/maine78d7057d5: card open,pm:queue, no live claim)Serial constraints cleared: none known on these paths; the dev re-measures open PRs on the files it touches before
pr_create.objectstack-fleet commentedon Oct 27, 2026
Seat ruling ·
domain:serverseat 1 ·os-project-manager·session_01R1q2xdtYgU6FKrZ7LgjPCC· 2026-10-27T19:56Z · amends order-26825's "reuse that yield helper"Letter B: a module-private copy of the event-loop yield in each touched file, and no new export.
The card thread measured on
origin/maine78d7057that no package exports a yield helper.seed-files.ts'syieldToEventLoopandimport-runner.ts's are both module-private, andplugin-securityandorganizationsdepend only on@objectstack/core. Reusing one would mean a new@objectstack/coreexport: aClause-②: yeswidening outside the claim surface, with nothing asking for it. The helper is a few lines around onesetImmediatepromise. Each copy carries a docblock that names the other copies, so a later consolidation can find them all. The claim surface andClause-②: nostand.Generated by Claude Code
objectstack-fleet commentedon Oct 27, 2026
Seat ruling ·
domain:serverseat 1 ·os-project-manager·session_01R1q2xdtYgU6FKrZ7LgjPCC· 2026-10-27T20:09Z · answers the card thread's failure-semantics question (order-26825: "keep it the same or stop and ask")Accepted: a batched hand-over may leave a chunk partly owned when only some of its batches are refused.
The card thread measured on
maine78d7057that the stall is a single engine transaction: one NULL-armql.updateover 1,500 ids took 2,641 ms. SQLite's pool is one connection, so no yield can land inside that transaction. Any cure therefore shrinks the atomic unit, and holding a transaction across yields would block the sign-in on the pool instead.mainleft the whole chunk unowned, and the batched version owns the accepted batches. That is closer to the intended end state, not further from it.main. (3) The changeset states the partial-failure behaviour in a sentence. (4) Theusr_systemarm stays unchanged, as proposed.Generated by Claude Code
objectstack-fleet commentedon Oct 27, 2026
os-dev-report
{
"issue": 26825,
"status": "done",
"branch": "claude/project-thread-g8r1ai",
"pr": "#26913",
"session": "session_01FEkQ5mvv8ZvVXKGoTSX3eE",
"premise_still_valid": true,
"summary": "Re-verified on main e78d705 before editing: os serve --dev over file-backed sqlite, a 1,500-row seed with a seedFile per row, background settle. The event loop stalled 2,742-2,763 ms (three boots) from Seed loading complete to the handed-1500 line; a timing marker spliced into plugin-security dist read the NULL arm's ONE ql.update over 1,500 ids at 2,641 ms; the CPU-profile stretch is per-row hook work inside it (better-sqlite3 _query/prepare, plugin-audit writeAudit/persistAuditTrailRow, storage file-ref hooks). The write is one engine transaction and the SQLite pool is one connection, so the cure shrinks the atomic unit: claimSeedOwnership writes the NULL arm 50 ids at a time (claimPredicateInBatches, CLAIM_HANDOVER_ROWS = 50, about 90 ms per batch) with a setImmediate turn after every write, and claimRows (by-row path) yields every 50 rows. The usr_system arm is unchanged and yields after it. The organizations twin claimOrgSeedOwnership had the same unbroken run (one write per 5,000-id chunk, inside the org-creation request) and got the same fix in claimChunk/claimChunkByRow. The yield helper is a module-private copy per file (seat ruling B, 6452151359), docblocks naming the other copies. Failure semantics (seat ruling 6452414075, four conditions met): success identical; every batch of a chunk refused is identical to main (plugin-security rethrows to the same single warning; organizations logs the same warning); a partial refusal keeps the accepted batches owned, one warning names the count, first 20 ids and first error, and the next run claims the rest (main left the whole chunk unowned). Live re-measure after the fix: no stall above 190 ms in the hand-over window; the 14 sign-ins issued in it answered p50 317 ms, slowest 539 ms (before p50 1,967 ms, slowest 2,698 ms).",
"tests": "New plugin-security src/claim-seed-ownership-yield.pin.test.ts (real ObjectQL + SqlDriver better-sqlite3, 320 rows, a code afterUpdate hook writing one audit row per row, a beforeUpdate hook refusing named rows) and organizations src/claim-org-seed-ownership-yield.pin.test.ts (same five on SqliteWasmDriver): at most one batch between two macrotask turns; a read issued during the hand-over completes before it ends; every row owned + one audit row per claimed row; a refused batch leaves only its rows unowned, warns with count/ids/error, the next run claims them; every batch refused = nothing claimed + the one warning a refused chunk always gave. Red first (production source restored to e78d705, restored from HEAD, blob hash equal): plugin-security 3 failed 2 passed (expected 1 to be greater than 6.4; expected [hand-over, read] to deeply equal [read, hand-over]; partial pin), organizations the same 3 failed 2 passed; the result pin and every-batch-refused pin are GREEN on main, the proof the result and total-failure warning are identical. Ablations via scripts/ablation-replace.mjs (tests import src, no dist): A yield resolves at once -> plugin-security 2 failed, organizations 2 failed; B CLAIM_HANDOVER_ROWS = CLAIM_PAGE_ROWS -> 3 failed (expected 5 to be greater than 6.4; expected 320 to be less than 320; partial pin); C no rethrow when every batch refused -> 1 failed; each restore proven blob == HEAD and git diff HEAD empty. Six shape pins updated (write counts per 5,000-id chunk became per 50-id batch). At d51a116: pnpm --filter @objectstack/plugin-security test + typecheck: Test Files 232 passed, Tests 5037 passed 45 skipped, check:test-typecheck OK, VERDICT command-exit 0; pnpm --filter @objectstack/organizations test + typecheck: Test Files 18 passed, Tests 248 passed, VERDICT command-exit 0; eslint --no-inline-config on both packages exit 0.",
"gates": "Local subset at d51a116: dispatch-gates --commands --repo objectstack-ai/objectstack derived 62; each run with exit captured before any pipe: 61 exit 0; pnpm check:dual-build-cjs-loads exit 3 (PREREQUISITE NOT MET, full build needed: NOT MEASURED, CI runs it); node scripts/check-plugin-teardown-shape.mjs --self-test first exit 3 (shallow checkout), exit 0 after git fetch --depth=1 of its control commit. --ran: 62 derived famil(ies) accounted for, 61 run, 1 NOT-MEASURED, exit 0. CI check-runs on PR 26913: in_progress at report time (not waited for, per os-dev). Changeset check simulated locally on the PR body: check-changeset-no-major exit 0 (Clause-② no, Metadata-protocol none). Overlap: none of 41 open PRs touches claim-seed-ownership* or claim-org-seed-ownership*.",
"dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
"mcp_calls": "0 — no MCP GitHub calls",
"api_writes": "2 relay writes + 1 git push (not REST). Write budget spent 3 of 3: git push of claude/project-thread-g8r1ai; pr_create through scripts/pm/fleet-write/dispatch.mjs (one repository_dispatch, run 40581767139: POST /repos/objectstack-ai/objectstack/pulls draft + POST assignees, read back identical 12324 bytes, assignee os-project-manager); this os-dev-report through scripts/pm/post-stamped.mjs (POST /repos//issues/26825/comments). Zero labels written (none named; a changeset exists). Two seat-thread questions were sent through the project, not GitHub. Mis-send: one stray one-word message went to the seat-2 thread and was retracted there at once.",
"open_questions": [],
"out_of_scope_findings": [
"noted, not filed (no producer): the usr_system arm of claimSeedOwnership is still one predicate write over every such row (left unchanged by ruling), so a seed whose records set owner_id to the seed identity would still be handed over in one run; no producer found (HotCRM and the examples write no owner_id in seeds; the measured seed landed every row NULL) · carrier: none",
"noted, not filed (behaviour shift inside this PR, in Acceptance notes): plugin-sharing recomputes per row up to 1,000 rows per write and above that revokes the object rule grants and re-grants in the background; a 50-row batch is always under that cap, so a claimed object with sharing rules and over 1,000 seeded rows now recomputes inline per row instead of revoke-plus-queued-re-grant; end state is the same grants · carrier: none"
]
}
Generated by Claude Code
objectstack-fleet commentedon Oct 27, 2026
Landed
PR #26913 merged at 2026-10-27T21:42Z by the merge queue as
2a40f98811onmain(Fixes #26825; ACCEPT6453797345).git ls-remote origin 'refs/heads/gh-readonly-queue/main/pr-26913-*'origin/mainby contentgit cat-file -e origin/main:packages/plugins/plugin-security/src/claim-seed-ownership-yield.pin.test.tsgit merge-base --is-ancestor 2a40f98811 origin/mainState: this card closed by
Fixes(completed);pm:dispatchedremoved.Generated by Claude Code