[objectstack-fleet]

Requested by Steve · project thread

Fixes #26199

Clause-②: no (one test file)
Metadata-protocol: none

What it was

Neither a lost block nor a fixture that predates #26056. The security block in DraftChangesPanel renders only after securityPostureLint resolves its function-body import('@objectstack/lint'). DraftChangesPanel.securityLink.test.tsx never warmed that module, so when the file ran alone the first transform was paid inside the first case's 1000 ms findByTestId window. The second case passed because the module was cached by then. The sibling DraftChangesPanel.securityProblems.test.tsx already warms the same specifier at module scope for exactly this reason (ui/AGENTS.md, test discipline: an unbounded module load counted inside a bounded window).

All readings below are the one file run alone, from ui/, vitest run --maxWorkers=2 packages/app-shell/src/preview/__tests__/DraftChangesPanel.securityLink.test.tsx, under the shared verify lock.

Tree	Result	When the case gave up / the block appeared
main 7111e14, unchanged	3/3 red	gave up at ~1089 ms
7111e14 with #26056's panel hunk reverse-applied	1/3 red, 2/3 green	gave up at 1097 ms on the red run
7111e14, throwaway probe with a 10 s window (not committed)	3/3 green	block at 980 / 936 / 1175 ms
7111e14 plus the module-scope import	5/5 green	block at 27 / 20 / 22 ms (probe)
this branch, head 0f7f928 on base f143cd8	3/3 green
same, with the import line deleted (scripts/ablation-replace.mjs, restored, blob equals HEAD)	2/3 red	gave up at 1085 / 1109 ms

So the panel renders the block every time; #26056 only moved the margin. The block arriving at about one second is the whole defect.

The change

One module-scope import '@objectstack/lint'; with a comment, in ui/packages/app-shell/src/preview/__tests__/DraftChangesPanel.securityLink.test.tsx. Same specifier as the component, so its dynamic import resolves from the ESM cache. The cost moves into the file's import phase, which no test or hook timeout bounds, so the result no longer depends on what ran before it in the shard. Assertions and timeouts are untouched; nothing is skipped or quarantined.

Tests

• The file alone: 3/3 green at 0f7f928 (table above).
• Every DraftChangesPanel file in preview/__tests__: vitest run --maxWorkers=2 packages/app-shell/src/preview/__tests__/DraftChangesPanel gave 18 files and 96 tests passed. The full app-shell package is left to CI Test Core, a declared narrowing.
• The merge of origin/main (head 99fa874) touched nothing under ui/packages/app-shell, packages/lint, packages/spec or pnpm-lock.yaml, so the readings carry over.

Gates

node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 24 commands at 0f7f928. All 24 exited 0. --ran reconciliation: 24 derived, 24 run, 0 NOT-MEASURED, all with recorded exit codes. Type-check lanes are left to CI.

Changeset

None, with skip-changeset: the diff is one file under __tests__/, which the app-shell build excludes from dist, and files ships only dist, src/styles.css, README, CHANGELOG and LICENSE. An empty-frontmatter changeset is refused here by scripts/check-empty-changeset.mjs.

Acceptance notes

• Off the sdui record: app-shell is not a registry package and no source changed.

🤖 Generated with Claude Code

https://claude.ai/code/session_014sjSLK4TBwwZM9jfTM2nEN

---

Generated by Claude Code

[objectstack-fleet]

席位核对 · ACCEPT · seat domain:ui#1 · 2026-10-26T17:25Z

Head 411ebbde (read from the PR object). It is the dev's 99fa8744 plus a seat-side "update branch" merge of main past a1477dec (#26231), with no content change.

• Shape. Draft on main, with Fixes #26199. Label skip-changeset: the diff publishes nothing, and check-empty-changeset refuses an empty changeset. One file: ui/packages/app-shell/src/preview/__tests__/DraftChangesPanel.securityLink.test.tsx.
• Checks pinned to the head. All check runs completed: 0 failing, 0 pending. The seat's landing script checked this before posting.
• Governed surface. check-governed-merges.mjs --pr 26241: not governed.
• Diff read. A single module-scope import '@objectstack/lint' with its comment. securityPostureLint loads the package through a function-body dynamic import, and run alone, that first transform landed inside the first case's 1000 ms findBy window. Same specifier, so the component's import resolves from the module cache. No assertion or timeout changed.
• Evidence. Report 6421714572: the file alone is 3/3 green with the warm-up and 2/3 red with the import line removed (ablation). All 18 DraftChangesPanel* files pass (96 tests). 24/24 derived gates exit 0, and the Console build at 99fa8744 is 71/71 green.
• Serial constraints. Test-only, in app-shell, which is outside the sdui registry closure. The ⛔ paths are untouched.

Landing: ready + auto-merge through the relay.