docs(bench): record the object door's cost on both sides of #4716, on both stack shapes (#9859)

[os-elon]

Fixes#9859

A measurement, not a fix. Nothing is broken, no tenant is affected, and nothing about the shipped gate changes here: the only diff is a docblock section in scripts/bench/runtime-publish-gate.bench.mts recording a row of the cost record that was missing.

What was missing

#9851 established that runtime publish-gate cost tracks the tenant's authored object surface, not object count, and that PR #9825's cost table for the object-door widening (#4716) was measured against a stub-shaped seed. The real-shape BEFORE row — the 2-rule object door against a realistic stack — had never been measured, so the widening's delta on realistic object shapes was unknown.

It is now measured. Both legs, one machine, one session, median of 30 with warmup 5, base 17854cba0:

object write, N=420	BEFORE (2-rule door)	AFTER (7-rule door)	delta
stub shape	3.62 / 4.42 ms	8.50 / 8.62 ms	~ +4.6 ms
real shape (shipped showcase declarations)	25.50 / 29.23 ms	286.75 / 304.38 ms	**~ +265 ms**

object write, N=21	BEFORE (2-rule door)	AFTER (7-rule door)	delta
stub shape	0.19 / 0.21 ms	0.41 / 0.45 ms	~ +0.23 ms
real shape	1.20 / 1.32 ms	16.66 / 18.92 ms	**~ +16.5 ms**

Two independent replications per leg are quoted rather than averaged, so the run-to-run spread is visible instead of hidden in a single figure.

How the BEFORE leg was built, and how it was proved live

• Registry: git restore --source=1408ae337^ -- packages/lint/src/authoring-rules.ts — the pre-widening file, not a hand-reverted grep hit list. An anchored probe confirms 7 object-door declarations on today's tree and 2 on the pre-widening one; the naive probe returns 8 and 3 respectively, the extra hit being a comment that quotes a declaration.
• scripts/ablation-dist-preflight.mjs, both directions: the pre-widening marker P2 (#4463): judges an object/field declaration is PRESENT in packages/lint/dist on the BEFORE leg and ABSENT again on the restore leg, with the post-widening marker mirroring it. The restore leg was rebuilt and re-proved before any AFTER number was re-read.
• Door count read from the run, never assumed: the bench prints rules dispatched (2): validatePresetComparands, validateSecurityPosture on the BEFORE leg and rules dispatched (7): ... on the AFTER leg. A property read of the built artifact (runtimeAuthoringRulesFor('object')) agrees with both.

The number was not manufactured — and the measurement shows why it could not have been

Scaling the published stub delta by the totals ratio would have predicted +3.25 ms x ~34 = ~+110 ms at N=420. The measured real-shape delta is ~+265 ms, off by a factor of ~2.4. The mechanism is visible in --mode per-rule: on the real shape at N=420 validateRuleCompilability alone is ~233 ms (82% of the whole gate), while on the stub shape it is ~0.04 ms (0.5%) because the stub carries no validation rules for it to judge. The two rules that were already at the door cost the same on both legs (~23-25 ms real at N=420), as they must.

Also recorded

~285 ms per object publish at 420 real-shaped objects is a live figure for the product's hottest metadata write path. It is a sibling of #9613's flow-publish finding at the same size. #9612 and #9613 are parked pending re-scope and are not addressed here; this PR only records numbers.

Scope and tone

Priority is low and this is not latency anyone is feeling — the maintainer's standing position on this area, verbatim and untranslated: 「目前也没有相关的真实用户」, alongside 「objectstack cloud 还没有正式上线,简化开发」. No tenant exists whose Studio saves this affects. This keeps the cost record of a landed change honest.

No changeset: the diff is a comment in a bench script that ships to nobody, so it changes no user-visible behaviour. An empty changeset would claim a release-note input that does not exist.

Checks run (at 76d2690bc, after the final commit)

• node scripts/pm/dispatch-gates.mjs (no paths, derived from the merge base) — derived exactly two local gates for this diff.
• pnpm check:nul-bytes — check-nul-bytes: OK (scanned 6340 text file(s) ...; no raw ASCII control bytes).
• pnpm check:cross-package-test-inputs — OK: 12 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
• Bench smoke run after the edit — the file still parses and dispatches 7 rules.

CI convergence is the PM's to read; the gate state at report time is recorded honestly in the dev report.

---

Generated by Claude Code

[os-elon]

PM review — ACCEPT, enqueue held only on CI convergence

domain:engine seat, PM session session_019yDEhPBC3tcGkW9bkce1HM. Head 76d2690bc (matches the dev's reported final commit).

The result

The gap #9859 was filed about is closed. #4716's object-door delta on real shapes:

N=420, object write	BEFORE (2 rules)	AFTER (7 rules)	delta
stub	3.6–4.4 ms	8.5–8.6 ms	~ +4.6 ms
real	25.5–29.2 ms	282.8–304.4 ms	**~ +265 ms**

against the +0.31 / +3.25 ms the widening was adjudicated on.

⭐ The card's ⛔ "do not manufacture the number" was upgraded from a prohibition to a measurement. I wrote that ban into the dispatch order as an assertion; the dev came back with the arithmetic that proves it. Scaling the stub delta by the 34× totals ratio predicts **+110 ms** where the measurement gives ~+265 ms — and the delta ratio is not even stable across replications (53× and 66×) while the totals ratio is stable at ~34×. An unstable ratio cannot be a conversion factor. That is a much stronger record than "we believe this inference is invalid."

--mode per-rule names the mechanism rather than leaving it inferred: on the real shape at N=420 validateRuleCompilability alone is 232.96 ms (82.4% of the gate) versus 0.04 ms (0.5%) on the stub — the stub carries no validation rules for it to judge. The five newly-crossed rules sum to 244.99 ms, independently corroborating the ~+265 ms whole-gate figure from a different mode. And the two rules that were already at the door cost the same on both legs (23.24 ms AFTER / 25.49 ms BEFORE, real, N=420), as they must — that invariant is the run's own internal check and it holds.

What I verified, independently of the report

Divergence — measured on the SOURCES OF THE DERIVATION, not the edited file. This diff records numbers derived from other files, so checking only scripts/bench/… would pass green while the numbers described a superseded registry:

derivation input	commits on main since base 17854cba0
packages/lint/src/authoring-rules.ts (the registry the numbers describe)	0
scripts/bench/runtime-publish-gate.bench.mts (the instrument)	0
examples/app-showcase (the "real shape" corpus)	0
positive control — any path	18

The control fires at 18, so the probe can return non-zero; the three zeros are real.

⚠️One thing I checked rather than assumed, and am recording as checked: PR #10006 is in the merge queue and edits examples/app-showcase/src/ui/actions/predicate-matrix.action.ts — inside derivation input 3. It is a prose-only change to a UI action's predicate comment, not an object/field/validation-rule declaration, so it does not enter the corpus the bench seeds from and the numbers stand if it lands first. Responded, checked, cleared.

Merge-tree conflicts vs origin/main: 0. File surface: exactly one file. Changeset: 0, deliberate and stated rather than an empty one written to satisfy a gate — Check Changeset passes via skip-changeset.

Method notes worth keeping

• ✅ Door count read from the run, both legs — rules dispatched (7) / rules dispatched (2) — and corroborated independently by a property read of the same built artifact (runtimeAuthoringRulesFor('object') → 7 / 2). Two independent reads where the order asked for one.
• ✅ ablation-dist-preflight run in both directions on both legs, each leg rebuilt first. The control is correctly constructed: the marker string is content of 1408ae337^ — it pre-exists the change under test and survives it — and its --absent probe is proved capable of failing because the same pattern returns 4 hits on the mutated build. That is the anti-vacuity rule satisfied properly, not recited.
• ⭐ A hole in my own dispatch order, closed by the dev. I ordered the BEFORE leg built from 1408ae337^instead of hand-reverting the five additions, and left the equivalence of those two routes unstated. The dev proved it: the only commits touching authoring-rules.ts since 1408ae337 (71ac21ce5, 818c27ce4) change CLI_ONLY rules and surfaceReason prose only, so both routes yield the identical 2-rule object door. Without that, "restore the old file" silently imports every unrelated drift in it.
• ⭐ My line numbers were stale and the dev did not inherit them. I passed validateRuleCompilability :1382 and validateRuleSchemaFormats :1408; on the measured tree they are :1397 and :1423. Symbol names identical. The anchored probe returns 7 and the naive one returns 8, the extra being the comment at :1276 — as stated. This is the seat's standing rule (locate by symbol, never by line) doing its job against the PM's own brief.
• ✅ Heavy steps serialized under flock; wrapper exit 0 every time, never 99 — so no lock queue-timeout was misreported as a verdict.
• ✅ The AFTER leg reproduces Two published measurements of the same runtime publish gate disagree by 16–25× — reconcile them and leave a repo-resident benchmark behind #9851's published real-shape figures (16.48 / 285.08 ms) on different hardware. That is the harness cross-checking itself, and it also pre-empts the obvious objection to the ⛔ paragraph below.

Two observations, neither a rework

1. The ⛔ paragraph's arithmetic quotes feat(lint): the five gating object rules cross the runtime publish gate (#4716) #9825's published stub delta (+3.25 ms), measured on other hardware, against this run's real-shape delta. The same-machine form is available in the very data this PR reports — this run's own stub delta is ~+4.6 ms, and 4.6 × 34 ≈ 156 ms still falls far short of 265 — and would be immune to a "that gap is just hardware" reading. The cross-hardware objection is already pre-empted by the Two published measurements of the same runtime publish gate disagree by 16–25× — reconcile them and leave a repo-resident benchmark behind #9851 reproduction above, so the paragraph is sound as written; noting the stronger form exists.
2. unattributed −0.86 ms (−3.4%) on the BEFORE real leg is negative — separately-timed medians summing marginally above the total. Noise, it does not touch the headline delta (which comes from total mode), and the docblock already flags that line as the attribution's own sanity check. Recorded so the next reader does not re-derive it as a defect.

Hold

⛔ Not enqueued yet. Per this seat's standing rule I gate on each load-bearing job's own conclusion, never the aggregate: Lint & Repo Gates, TypeScript Type Check and Test Core (1/3) are still in_progress. Everything else is success or skipped. Enqueue follows convergence.

---

Generated by Claude Code