architecture.mdx describes the runtime with the hosted multi-environment model, on a page about the single-environment self-hosted product

[os-zhuang]

Observed while rewriting the retired env-var contract (#60). Filed rather than fixed — rewriting a performance model was outside that card's scope, and doing it in passing would have meant inventing numbers.

What is there

architecture.mdx describes runtime behaviour in terms that belong to the hosted, many-environments-per-instance product:

• "per-kernel warmup (first request to a project)"
• "~10–30MB per active project kernel"
• concurrent kernels per instance

But the page's subject is the single-environment, self-hosted runtime a customer deploys from the release bundle. On that shape there is one kernel, and "first request to a project" is not a thing the reader has.

Why it is worth recording

⚠️ These are plausible, specific-sounding numbers. A reader sizing a deployment will use them, and they describe a different product's memory profile. That is worse than a vague statement — a range with a unit reads as measured.

⛔ It is not urgent in the way #60 was: nothing here contradicts another shipped page, and no instruction fails if followed. It is an accuracy problem, not a live contradiction.

What #60 did and did not do

#60 removed the one variable name on this page that made the claim unverifiable, and removed the cache-tuning variables from the performance table because none of them appear in any shipped artifact. The prose model itself was deliberately left alone — correcting it needs numbers from the shipped runtime, which the doc site is not the authority for.

What the fix needs

Whoever picks this up should get the memory and warmup characteristics of the self-hosted single-environment image from a measurable source, and ⛔ not adapt the hosted figures by reasoning about them. If no such measurement exists, the honest fix is to describe the shape without numbers rather than to carry numbers that describe something else.

Related: #60, #59.

[os-zhuang]

Claim: PM loop round 3
Session: session_01CJPxtTxoxTUnjNdTbiEaRa
Branch: claude/issue-64-architecture-runtime-model
Worktree: objectos-issue-64
Domain: n/a — objectos has no lane or seat (objectstack-ai/objectstack#9551 still open). Dispatch authorized by the maintainer under the standing 维护者直派通道, 原话: 「现在允许你派 objectos 的活」.
File surface: content/docs/architecture.mdx (English only — locale siblings are generated artifacts now and must not be hand-edited; they will report as stale and that is correct)
Container & model: M, mode:subagent, model: opus
Clause-②: no
Serial constraints cleared: #61 (apps/docs/**) and #67 (.github/scripts/, docs/TRANSLATION.md) — disjoint.

First-touch grading

Graded finding → queue. Promoted because the defect is published wrong information with a unit attached: a reader sizing a deployment will use "~10-30MB per active project kernel", and it describes a different product shape. As the card says, a range with a unit reads as measured, which makes it worse than vagueness.

Premise re-verified on origin/main before dispatch

Still present, unchanged by #63 (the last commit to touch this file):

• line 126 — | Per-kernel warmup (first request to a project) | 50-300ms depending on capabilities |
• line 128 — | Memory footprint | ~150MB base; ~10-30MB per active project kernel |
• line 116 — A self-hosted runtime authenticates to a control plane

So the page still carries hosted multi-tenant figures while describing the self-managed shape. The premise holds.

One thing checked and worth recording, because it could have inverted this card

The repository was repositioned to commercial-only, and ObjectOS is now delivered as Cloud and Self-Managed. It was worth asking whether the hosted framing had become the correct one and the card's premise inverted. It has not: Business Self-Managed (single-node) and Enterprise are shipped shapes, the page addresses them at line 116, and on a single-node deployment "first request to a project" is not something the reader has. The card stands as written.

Constraint carried into the dispatch verbatim

The card's own instruction is the binding one: get the figures from a measurable source, or describe the shape without numbers. ⛔ Adapting the hosted numbers by reasoning about them is forbidden — this repository is not the authority for runtime measurements, and inventing plausible figures is the exact defect being fixed.

---

Generated by Claude Code

[os-zhuang]

{
 "issue": 64,
 "status": "done",
 "branch": "claude/issue-64-architecture-runtime-model",
 "pr": "https://github.com/objectstack-ai/objectos/pull/69",
 "premise_still_valid": true,
 "summary": "Premise re-verified in the worktree at a132376: lines 126, 128 and 116 are exactly as the dispatch described, and the deploy pages plus reference/environment-variables confirm the page addresses the self-managed shape rather than having been inverted by the July repositioning — that reference calls it a 'single-environment runtime' and gives a deployment one OS_ARTIFACT_URL ('the one variable that selects the app') and one OS_DATABASE_URL, with metadata 'scoped to the deployment, not to an organization'. No measurable source for the shipped image exists here (no benchmark, no runtime source, image behind licensed registry credentials; git log -S shows the figures arrived in 393f3d3, the pre-July import, and were never sourced), so all runtime figures were removed and the Performance section is now a table of where each cost comes from and what to measure it as — including cold start ~1s, warm latency sub-10ms and the '5ms once warm' line, because keeping those while deleting the two named ones would have made the survivors read as verified. The hosted model was load-bearing beyond the table, so the diagram box, the request-path steps 3-4, and the 'Per-project kernel, LRU cached' rationale moved with it. Two bounded in-place corrections are named with evidence in the PR body (the 'Lambda-like environment' claim, contradicted by faq.mdx; the 'many tenants and apps' marketplace framing) plus a pre-existing one-character diagram misalignment. Two deviations to flag: the PR body uses the session-URL signature form required by the dev contract rather than the bare form the dispatch specified, because a bare footer is stripped on every subsequent body edit (comments keep the bare form, and this one does); and the dispatch's expectation that six architecture.* siblings move into the stale column is false on origin/main — they were deleted in #63, so the freshness table is byte-identical before and after.",
 "tests": "All on final commit 6711c94. `pnpm turbo run type-check --continue --concurrency=2 --force` -> 'Tasks: 1 successful, 1 total / Cached: 0 cached'. `pnpm turbo run build --concurrency=2 --force` -> 'Compiled successfully in 30.6s', 'Generating static pages (740/740)', 'Tasks: 1 successful, 1 total / Cached: 0 cached' (the first, unforced build replayed a cache hit — content/ is outside apps/docs so turbo's hash does not cover it; forced thereafter). `pnpm turbo run test` -> 'WARNING No tasks were executed as part of this run. Tasks: 0 successful, 0 total' — no package in this repo defines a test script, so CI's test job runs nothing; reported as observed, not as a pass. `node .github/scripts/check-translations.mjs` -> 'translations gate passed', exit 0, table: zh-Hans 1 stale/17 missing, ja 3/40, de 3/41, es 3/40, fr 3/40, ko 3/40, guide-stale 0 for all. Identical table from a second detached worktree at origin/main (a132376), removed afterwards — this change moves nothing into the stale column because architecture has no locale siblings. `check-translation-ownership.mjs --files` -> '0 translation artifact(s) and 1 other file(s)', exit 0 (still inert without TRANSLATION_BOT_LOGIN, already filed as #68). Rendered page read out of .next/server/app/en/docs/architecture.html: both code blocks, the four-row table, and every link/anchor (#boot-modes, /docs/deploy/docker, /docs/deploy/air-gapped, /docs/operate/production, /docs/reference/environment-variables) present; 'Per-project', 'LRU', '150MB', '10-30MB', '50-300ms', 'first request to a project', 'Concurrent app kernels' all absent from the rendered HTML. That render read caught a real defect before the commit: a scripted re-pad of the diagram matched 'HTTP dispatcher' twice and had replaced step 2 of the request path with a box-drawing line; fixed, rebuilt, re-read. Diagram rows are all 55 characters (main had one at 56). Control-byte scan on the edited file and on the PR body: no matches.",
 "open_questions": [],
 "out_of_scope_findings": [
 "filed as #70: six pages outside Deploy still teach the multi-Environment model (faq, glossary, why, observability, troubleshooting, ai-builder); faq.mdx line 44 promises each Environment its own database, contradicting the shipped one-OS_DATABASE_URL contract, and observability.mdx line 80 names OS_KERNEL_CACHE_SIZE, which is in no section of the environment contract — a missed instance of the #60 class. Unassigned, unlabeled for triage",
 "filed as #71 (finding): architecture.mdx calls the first boot shape 'Config-authored' while deploy/index.mdx calls it 'Shipped runtime', with rows 2 and 3 agreeing — left alone in this PR because choosing the canonical name is a decision, not a transcription. Unassigned"
 ]
}

---

Generated by Claude Code

[os-zhuang]

ACCEPT — #69.

Reviewed against GitHub and origin/main, not against the report's own account of itself.

Checks run

Item	Reading
PR form	draft, base main, first line Fixes #64 — correct, this card is fully discharged by the merge
Scope	1 file, content/docs/architecture.mdx, +42/−25. Matches the declared file surface exactly; no locale sibling touched
CI	build and Ownership & freshness both green on 6711c94
Diagram alignment	Re-counted by code point, not bytes (box-drawing characters are 3 bytes each, so a byte count would have said "misaligned" and been wrong): all 14 rows are 55 columns. The claim holds
faq.mdx pins the Lambda correction	Confirmed at lines 49–51: "The runtime is a long-lived Node process — designed for containers or VMs, not stateless functions." The correction is pinned by a shipped page, not by taste
marketplace.mdx tenant framing	Zero occurrences of "tenant" — consistent with the account given
Locale siblings	git ls-tree origin/main returns only architecture.mdx; the six siblings were deleted in 7eaf3a9 (#63). Verified independently before the report arrived

The PM instruction was wrong, and the dev caught it

My dispatch stated that the six architecture.* siblings would move into the stale column and told the dev to expect that in the gate output. They do not exist — #63 deleted them. The dev checked instead of complying, ran the gate in a second worktree at origin/main to show the table is byte-identical either way, and reported the discrepancy. That is the behaviour the dispatch asked for and it is recorded here rather than quietly dropped.

Same for the signature form: the dispatch specified the bare footer, the dev used the session-URL form because the bare one is stripped on every subsequent body edit. That is empirically true — the footer on #65 was stripped exactly that way when I edited its body. The deviation is correct and the instruction was not.

Scope extension, accepted with the reasoning named

The card named two figures. The PR removed five, including Cold start ~1 second, Warm request latency < 10ms and the Steps 4-8 … < 5ms line, which the card did not name. The argument given — that deleting two rows while keeping three would make the survivors read as the verified ones — is right, and it is the same defect the card exists to fix. Accepting the wider cut deliberately, not by omission.

The provenance check is what makes it safe: git log -S puts all of these in 393f3d3, the pre-July free-runtime import, with no later commit sourcing them. Nothing was removed that someone had measured.

Out-of-scope findings, as a group

Both filed unassigned with reproductions, both verified to exist:

• Six pages outside Deploy still describe the retired multi-Environment runtime #70 — six pages outside Deploy still teach the multi-Environment model. Spot-checked the two load-bearing claims: faq.mdx line 44 does promise "each Environment has its own database", which contradicts the single OS_DATABASE_URL the shipped contract gives a deployment; and OS_KERNEL_CACHE_SIZE appears in observability.mdx and nowhere in reference/environment-variables. That zero-hit was confirmed with a reverse control in the same file (OS_ARTIFACT_URL, 4 hits), so it is a real absence rather than a bad grep. This is a live contradiction with a shipped page, not stale framing — it is the most valuable thing this run produced.
• The three boot shapes are named differently on architecture.mdx and deploy/index.mdx #71 (finding) — the three boot shapes are named differently on architecture.mdx and deploy/index.mdx. Correctly left undone: picking the canonical name is a decision.

One reading recorded for elsewhere

pnpm turbo run test executes 0 tasks — the root package.json defines "test": "turbo run test" but no package defines a test script, so the CI test job runs nothing and cannot go red. The dev reported this as observed rather than as a pass, which is the right call. Not this card's problem; noted for triage.

Landing

Flipping to ready. Not merging: the path surface is clean (no AGENTS.md, no .claude/**, no skills/**), so this is not the governed-face hold — but objectos has no merge queue, and merging outside a queue is not a path this protocol grants a PM seat. Left for a human merge, and added to the constraints on objectstack-ai/objectstack#9551, which is where that gap belongs.

---

Generated by Claude Code