get-session 要等主 bundle 求值后才发：应从 index.html 的内联脚本与 runtime/config 并行发出，preflight 共享同一答案（cloud#2914 子卡 OU-2）

coordinator#1 · hotlong · session_6eb9ec2e0e3f410b91239dab7a337b9e

立卡门类别：①（父单 cloud#2914 是 ④；round 10 已测、未立的杠杆 OU-2）

Reader: domain:ui 车道。ui/apps/console/index.html:44-103（已有的 runtime/config 内联预取）、ui/apps/console/src/lib/auth-preflight.ts:114、ui/apps/console/src/main.tsx:79-83。不需要新组件或 spec 契约变化。建议档 p2，由分诊定。

Dedupe: repo:objectstack-ai/objectstack is:issue get-session preflight bundle index.html total=4（无同题）；"get-session" index.html inline total=3（无同题）；"cloud#2914" total=12，没有 OU 卡。

业务理由：每个打开控制台的用户。会话检查只需要 cookie，却要等主 JS bundle 下载并求值后才发，白等一个往返；会话是整条启动链的第一环，晚一点后面每层都晚一点（staging 约 0.15 s，差链路约 0.33 s）。

来源

2026-11-02 staging 页面性能评估（cloud main cd4e2e1f，objectstack pin 6cbdef1e；控制面 cloud.objectos.app，租户 os-2ph4c1.objectos.app / HotCRM 6.0.0；内置浏览器面板 zh-CN，读 resource timing 与 v2.7.0 起的 Server-Timing: runtime/placement/origin，辅以 Workers Observability）。维护者在会话里说「评估一下核心页面新版的性能有改进吗，还能继续优化吗」「相关性能优化使用 fable 评估后立卡」；本卡经第二个审核会话按 origin/main 核对落点与查重。
⚠️ 本机链路当天很差（CF 边缘静态文件 65 KB/s），卡里的秒数只引用 Server-Timing 或请求的先后关系，不引用页面总耗时。

已实测

控制面首页：runtime/config 1552 ms 发出（内联脚本），auth/get-session 1659 ms 发出；租户客户列表页 569 vs 623。round 10 在 staging 量到 517 vs 671。
index.html 的内联脚本只发 runtime/config（:98），get-session 在主 bundle 里的 preflight 才发。

验收

auth/get-session 的 startTime 与 runtime/config 相差 ≤ 50 ms，且在 DOMContentLoaded 之前。
preflight 复用这次答案，不再发第二次 get-session（无重复 URL）。
请求计数测试 + 消融。

Triage: p2 (priority added) · 2026-11-02T08:18Z

⛔ Not a claim.

Read fresh. get-session is sent only after the main bundle evaluates. It needs only the cookie, so it can start from index.html's inline script beside the existing runtime/config prefetch, with the preflight sharing the answer (cloud#2914 OU-2). A first-link latency defect on every Console open: p2. Routing and the pm state the filer set are unchanged.

Generated by Claude Code

domain:ui#3 · zhuangjianguo · session_01QsR2jV4dWohojjbTJTQq5m

Claim: PM loop round 2 · 2026-11-02T08:32Z
Session: session_01QsR2jSnFx895cTQzM4QL45 (card thread, os-dev); dispatched by seat session session_01QsR2jV4dWohojjbTJTQq5m
Account: zhuangjianguo
Branch: claude/project-thread-9cdi3p (platform-assigned to the card thread; it can push only this branch)
Worktree: objectstack-issue-29118
Domain: domain:ui
Seat: domain:ui#3
File surface: ui/apps/console/index.html, ui/apps/console/src/lib/auth-preflight.ts, ui/apps/console/src/main.tsx only if the wiring needs it, their tests under ui/apps/console/src/__tests__/, and a changeset (stop on breach; explain in the report)
Container & model: S–M, mode:thread, model: default tier (dispatch-gates --tier: no path-derived mandate), effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: console boot code: preflightAuth sends get-session only after the main bundle evaluates | index.html already prefetches runtime/config and hands the answer to app-shell; get-session has no such handoff | every user who opens the Console
Thread-read: 6572399463
Premise: holds (at origin/main fea2dbb7: the inline script in index.html fetches only runtime/config; preflightAuth in auth-preflight.ts sends GET …/get-session from the bundle, under main.tsx's Promise.all)
Serial constraints cleared: seat 2's #29114 and #29105 and seat 1's #29080 are in the console auth area; the dev checks their claimed file surfaces and merges main before pr_create. No in-flight claim names index.html or auth-preflight.ts at the seat's reading.

domain:ui#3 · zhuangjianguo · session_01QsR2jSnFx895cTQzM4QL45
os-dev-report

{
  "issue": 29118,
  "status": "done",
  "branch": "claude/project-thread-9cdi3p",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/29207",
  "session": "session_01QsR2jSnFx895cTQzM4QL45",
  "premise_still_valid": true,
  "summary": "Premise held at origin/main 0d6d4061: index.html's inline script fetched only runtime/config; preflightAuth sent GET AUTH_URL/get-session (Bearer + credentials include) only after the bundle evaluated. index.html now carries a second parse-time classic script, startEarlySessionCheck, directly after the runtime/config prefetch: it sends the preflight's exact request (same URL spelled as main.tsx AUTH_URL through Vite HTML env substitution, same Bearer from localStorage auth-session-token, credentials include, same Accept) and leaves authUrl/token/body under Symbol.for('objectui.earlySessionCheck'). preflightAuth takes it once when URL and token match and reads it; otherwise (no slot, mismatch, second call, failed or non-OK early request) it fetches as before. No token or blocked storage sends nothing; stale-token purge and the AuthProvider handoff are unchanged. Claim 6572644370; declarations copied verbatim (Clause-② no, Metadata-protocol none).",
  "tests": "New ui/apps/console/src/__tests__/sessionCheckBootDedup.test.tsx, 18 cases: executes the shipped inline scripts against the real preflightAuth and a StrictMode AuthProvider over one stubbed fetch. From ui/, locked, --maxWorkers=2, 8 boot files (sessionCheckBootDedup, sessionBootDedup, authPreflightCredentials-12892, runtimeConfigBootDedup, insecure-origin-crypto.placement, insecure-origin-crypto, bootSplash, zod-jitless-13511): 8/8 files, 75/75 tests on 2920a780 and again on merged head 9de49630. Ablation (preflight ignores the early answer) via scripts/ablation-replace.mjs: 7 failed / 11 passed, every failure the get-session count (2 for 1, 3 for 2); tool restore: blob == HEAD, git diff HEAD empty. First ablation attempt was a no-op refused by the tool (replacement was a substring of the anchor, count did not rise), restored, re-run with a unique marker. turbo type-check @object-ui/console: 71/71. eslint on auth-preflight.ts + new test: exit 0. Measurement on built Console (vite build of branch and of base index.html + auth-preflight.ts, Node stub server, Playwright Chromium, resource timing, 5 loads each): throttled 150 ms RTT / 1.6 Mbps gap runtime/config to get-session median 38774 ms before, 14 ms after; unthrottled 447 ms before, 1 ms after; get-session before DOMContentLoaded in all runs (after: ~450 ms ahead unthrottled); 1 get-session per load both builds. Not objectstack dev --ui (stub server; declared in PR body).",
  "gates": "dispatch-gates --commands --repo objectstack-ai/objectstack derived 33; all 33 exit 0 on 2920a780 (incl. check-sdui-manifest + --self-test, check-changeset-no-major, check-adr-0087-registration, check-empty-changeset, check:nul-bytes, check:test-source-alias; pnpm --dir ui exec vitest run scripts/ locked: 169 passed, 2 skipped, 4900 tests). Extra: pnpm check:changeset-fixed (roster under .changeset) exit 0. dispatch-gates --ran: 33 derived, 33 run, 0 NOT-MEASURED, 0 UNRUN. PR-body gates on the final body: check-changeset-no-major 0, check-adr-0087-registration 0, check-closing-keyword-parity 0, check-partof-closing-keyword 0. Merge of origin/main 0d15f895 (9de49630) brought nothing under ui/apps/console or ui/packages/auth; boot suites re-ran green there, gate loop not re-run (no overlap). CI check-runs on #29207: not yet reported at report time; re-runs and landing are the seat's.",
  "line_budget": "501 changed lines (+488 / -13), 4 files, under the 3000 human-merge threshold; no skills/** or governed surface.",
  "files_changed": [".changeset/29118-early-session-check.md", "ui/apps/console/index.html", "ui/apps/console/src/lib/auth-preflight.ts", "ui/apps/console/src/__tests__/sessionCheckBootDedup.test.tsx"],
  "deviations": ["main.tsx untouched (inside the claimed surface as optional); the new test pins main.tsx's AUTH_URL spelling through a raw import instead of a comment there.", "Measured against a Node stub server serving the vite build, not pnpm console:build + objectstack dev --ui; numbers in the PR body say so.", "Commit trailers are the model-free pair per AGENTS.md; the harness reminder's model-named trailer was not used."],
  "dogfood_battery": "n/a: no ! in the PR title and no (narrowing) arm",
  "mcp_calls": "1: claude-code-remote get_session (own session id). No GitHub MCP calls; the harness asks for assignee/reviewer via MCP issue_write/update_pull_request were skipped per common rules (no assignees, no reviewers on a dev PR).",
  "api_writes": "3: git push to claude/project-thread-9cdi3p (dc7c1dad, 2920a780, 9de49630); fleet-write relay pr_create (dispatch run 41420371037, PR #29207, body read back identical 9869 bytes, assignees none, labels none); this os-dev-report comment via post-stamped.",
  "open_questions": [],
  "out_of_scope_findings": ["carrier: none · noted, not filed. A boot with no stored Bearer (cookie-only) still asks get-session only from AuthProvider after mount; the claim scoped the early request to the preflight's request. Recorded in the PR's Acceptance notes.", "carrier: none · noted, not filed. A non-OK early answer (e.g. a transient 5xx) now gets one more ask by the preflight before its stale verdict, where before the single 5xx purged the token; recorded in Acceptance notes as a behaviour of the claim's safety rule."]
}

domain:ui#3 · zhuangjianguo · session_01QsR2jV4dWohojjbTJTQq5m

Landed: PR #29207 merged at 2026-11-02T10:40Z as 67ee171a. Fixes #29118 closed this card; pm:dispatched removed. Delivered: the boot's get-session starts from index.html at parse time beside runtime/config, and the preflight reuses its answer (one request per load). Nothing left on this card.

Navigation Menu

Repository navigation

get-session 要等主 bundle 求值后才发：应从 index.html 的内联脚本与 runtime/config 并行发出，preflight 共享同一答案（cloud#2914 子卡 OU-2） #29118

来源

已实测

验收

相关

Triage: p2 (priority added) · 2026-11-02T08:18Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

get-session 要等主 bundle 求值后才发：应从 index.html 的内联脚本与 runtime/config 并行发出，preflight 共享同一答案（cloud#2914 子卡 OU-2） #29118

Description

来源

已实测

验收

相关

Activity

objectstack-fleet commented on Nov 2, 2026

Triage: p2 (priority added) · 2026-11-02T08:18Z

objectstack-fleet commented on Nov 2, 2026

objectstack-fleet commented on Nov 2, 2026

objectstack-fleet commented on Nov 2, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions