@@ -1,4 +1,5 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+// test-budget: 40 — spawns the real producer once per single-cause fixture: a real SecurityPlugin over a real ObjectQL engine and SQL driver, booted per posture and per fixture (a read-only stack each, plus one per case whose write lands or that brings its own sharing service), every admission probe asked on that stack; slowest CI reading 28.95 s (scheduled full-battery run 41183072927, Test Core suite-ceiling report) x 1.25, rounded up
 
 /**
  * [#25063 · ADR-0090 D10] A delegated operation runs only in an organization
@@ -279,6 +280,38 @@ async function boot(posture: Posture, options: { sharing?: Record<string, unknow
   return { engine, plugin, stored, security };
 }
 
+// [#23181] The first boot's first loads (the driver's and the plugin's cold
+// paths) are paid here, at module scope, outside every case's clock: clocked
+// windows measure behaviour, never loading. Nothing this stack does is read.
+await (await boot('group', { lifetime: 'describe' })).engine.destroy();
+
+/**
+ * [#23181] One stack per posture (and per `seedForReads` or not), booted by
+ * its first case and shared by every case that only READS or is REFUSED: a
+ * refused write stores nothing, and each such case still asserts that
+ * (`stored`), so a shared stack is the stack it would have booted. A case
+ * whose write lands, that hands `boot` its own sharing service, or that pins
+ * another rule's refusal by what is stored, still boots its own. Booting one stack per case was most of this file's wall.
+ */
+const sharedStacks = new Map<string, Promise<Awaited<ReturnType<typeof boot>>>>();
+function shared(posture: Posture, seeded = false) {
+  const key = `${posture}:${seeded ? 'seeded' : 'boot'}`;
+  let stack = sharedStacks.get(key);
+  if (!stack) {
+    stack = boot(posture, { lifetime: 'describe' }).then(async (b) => {
+      if (seeded) await seedForReads(b.engine);
+      return b;
+    });
+    sharedStacks.set(key, stack);
+  }
+  return stack;
+}
+afterAll(async () => {
+  for (const stack of sharedStacks.values()) {
+    try { await (await stack).engine.destroy(); } catch { /* noop */ }
+  }
+});
+
 interface Outcome { ok: boolean; value?: unknown; code?: string; status?: number; message?: string; developerMessage?: string }
 const attempt = async (run: () => Promise<unknown>): Promise<Outcome> => {
   try {
@@ -306,25 +339,25 @@ describe('[#25063 · ADR-0090 D10] a delegated operation in an organization the
     describe(`\`${posture}\``, () => {
       for (const object of ['qa_account', 'qa_vault']) {
         it(`${object}: a single insert is refused, and nothing is stored`, async () => {
-          const b = await boot(posture);
+          const b = await shared(posture);
           expectMembershipRefusal(await attempt(() => b.engine.insert(object, { id: 'r1', name: 'one' }, { context: operator(ORG_D) } as never)));
           expect(await b.stored(object)).toEqual(SEEDED(object));
         });
 
         it(`${object}: an array insert is refused whole, and nothing is stored`, async () => {
-          const b = await boot(posture);
+          const b = await shared(posture);
           const rows = [{ id: 'r1', name: 'one' }, { id: 'r2', name: 'two' }];
           expectMembershipRefusal(await attempt(() => b.engine.insert(object, rows, { context: operator(ORG_D) } as never)));
           expect(await b.stored(object)).toEqual(SEEDED(object));
         });
 
         it(`${object}: a read is refused`, async () => {
-          const b = await boot(posture);
+          const b = await shared(posture);
           expectMembershipRefusal(await attempt(() => b.engine.find(object, { context: operator(ORG_D) } as never)));
         });
 
         it(`${object}: an update and a delete are refused, and the stored row is unchanged`, async () => {
-          const b = await boot(posture);
+          const b = await shared(posture);
           expectMembershipRefusal(await attempt(() => b.engine.update(object, { id: `${object}_in_d`, name: 'renamed' }, { context: operator(ORG_D) } as never)));
           expectMembershipRefusal(await attempt(() => b.engine.delete(object, { where: { id: `${object}_in_d` }, context: operator(ORG_D) } as never)));
           expect(await b.stored(object)).toEqual(SEEDED(object));
@@ -356,6 +389,9 @@ describe('[#25063] what the rule leaves alone', () => {
     });
 
     it(`\`${posture}\`: a delegated context with NO active organization keeps ADR-0123 D2's refusal`, async () => {
+      // Its own stack, not the shared one: the refusal cells above share it, so
+      // a regression of THIS file's rule would land rows there and red this
+      // case too, for a rule (ADR-0123 D2) that did not move.
       const b = await boot(posture);
       const outcome = await attempt(() => b.engine.insert('qa_account', { id: 'r1', name: 'one' }, { context: operator(undefined) } as never));
       expect(outcome.ok).toBe(false);
@@ -411,8 +447,7 @@ describe('[#25106 · ADR-0021 D-C] getReadFilter answers the deny sentinel where
   for (const posture of ['group', 'isolated'] as const) {
     for (const object of PROVIDER_OBJECTS) {
       it(`\`${posture}\` · ${object}: a delegated context in an organization the delegator is not a member of answers RLS_DENY_FILTER itself`, async () => {
-        const b = await boot(posture);
-        await seedForReads(b.engine);
+        const b = await shared(posture, true);
         expect(await b.plugin.getReadFilter(object, operator(ORG_D))).toBe(RLS_DENY_FILTER);
       });
     }
@@ -438,16 +473,14 @@ describe('[#25106] what the rule leaves alone in the read scope', () => {
 
   for (const posture of ['group', 'isolated'] as const) {
     it(`\`${posture}\`: a delegated context in an organization the delegator belongs to keeps its scope`, async () => {
-      const b = await boot(posture);
-      await seedForReads(b.engine);
+      const b = await shared(posture, true);
       for (const object of PROVIDER_OBJECTS) {
         expect(await scopeRows(b, object, operator(ORG_A)), object).toEqual(IN_SET[posture][object]);
       }
     });
 
     it(`\`${posture}\`: the same caller in \`org_d\` WITHOUT the delegation link keeps its scope`, async () => {
-      const b = await boot(posture);
-      await seedForReads(b.engine);
+      const b = await shared(posture, true);
       expect(await scopeRows(b, 'qa_account', operator(ORG_D, false))).toEqual(['qa_account_in_d']);
       expect(await scopeRows(b, 'qa_vault', operator(ORG_D, false))).toEqual(['qa_vault_in_a', 'qa_vault_in_c', 'qa_vault_in_d']);
       expect(await scopeRows(b, 'qa_catalog', operator(ORG_D, false))).toEqual(['qa_catalog_1', 'qa_catalog_2']);
@@ -458,23 +491,21 @@ describe('[#25106] what the rule leaves alone in the read scope', () => {
       // organization-less object keeps its rows. The private object is left
       // out: the delegator holds its grant only inside an organization, so
       // object admission refuses it (`canReadObject`'s half), not this rule.
-      const b = await boot(posture);
-      await seedForReads(b.engine);
+      const b = await shared(posture, true);
       expect(await scopeRows(b, 'qa_account', operator(undefined))).toEqual([]);
       expect(await scopeRows(b, 'qa_catalog', operator(undefined))).toEqual(['qa_catalog_1', 'qa_catalog_2']);
     });
 
     it(`\`${posture}\`: a system context is unscoped`, async () => {
-      const b = await boot(posture);
+      const b = await shared(posture);
       for (const object of PROVIDER_OBJECTS) {
         expect(await b.plugin.getReadFilter(object, { ...SYS_CTX, onBehalfOf: { userId: DELEGATOR } }), object).toBeUndefined();
       }
     });
   }
 
   it('`single`: there is no wall, so a delegated context in `org_d` keeps its scope', async () => {
-    const b = await boot('single');
-    await seedForReads(b.engine);
+    const b = await shared('single', true);
     expect(await scopeRows(b, 'qa_account', operator(ORG_D))).toEqual(['qa_account_in_a', 'qa_account_in_c', 'qa_account_in_d']);
     expect(await scopeRows(b, 'qa_vault', operator(ORG_D))).toEqual(['qa_vault_in_a', 'qa_vault_in_c', 'qa_vault_in_d']);
     expect(await scopeRows(b, 'qa_catalog', operator(ORG_D))).toEqual(['qa_catalog_1', 'qa_catalog_2']);
@@ -484,8 +515,7 @@ describe('[#25106] what the rule leaves alone in the read scope', () => {
 describe('[#25106 · ADR-0021 D-C] parity: the read scope agrees with the engine find on the same contexts', () => {
   for (const posture of ['group', 'isolated'] as const) {
     it(`\`${posture}\`: refused by find ⇔ the deny sentinel; admitted ⇒ the scope admits exactly the rows find returns`, async () => {
-      const b = await boot(posture);
-      await seedForReads(b.engine);
+      const b = await shared(posture, true);
       const contexts: Record<string, Record<string, unknown>> = {
         'delegated in org_d': operator(ORG_D),
         'delegated in org_a': operator(ORG_A),
@@ -546,7 +576,7 @@ describe('[#25107 · ADR-0090 D10] the probes answer the refusal where the prolo
   for (const posture of ['group', 'isolated'] as const) {
     for (const object of PROVIDER_OBJECTS) {
       it(`\`${posture}\` · ${object}: every admission probe is false, every field projection is empty, and the explanation denies`, async () => {
-        const b = await boot(posture);
+        const b = await shared(posture);
         const answers = await probeAnswers(b, object, operator(ORG_D));
         expect(answers.canReadObject, 'canReadObject').toBe(false);
         expect(answers.canWriteInsert, 'canWriteObject insert').toBe(false);
@@ -565,7 +595,7 @@ describe('[#25107 · ADR-0090 D10] the probes answer the refusal where the prolo
     }
 
     it(`\`${posture}\`: the narrowing diagnostic reports nothing for a delegated read the prologue refuses`, async () => {
-      const b = await boot(posture);
+      const b = await shared(posture);
       expect(await b.security().describeDelegationNarrowing('qa_ledger', agent(ORG_D))).toEqual({ narrowed: false });
     });
 
@@ -598,28 +628,28 @@ describe('[#25107] what the rule leaves alone in the probes', () => {
 
   for (const posture of ['group', 'isolated'] as const) {
     it(`\`${posture}\`: a delegated context in an organization the delegator belongs to is admitted by every probe`, async () => {
-      const b = await boot(posture);
+      const b = await shared(posture);
       for (const object of PROVIDER_OBJECTS) expectAdmitted(await probeAnswers(b, object, operator(ORG_A)), object);
     });
 
     it(`\`${posture}\`: the same caller in \`org_d\` WITHOUT the delegation link is admitted by every probe`, async () => {
-      const b = await boot(posture);
+      const b = await shared(posture);
       for (const object of PROVIDER_OBJECTS) expectAdmitted(await probeAnswers(b, object, operator(ORG_D, false)), object);
     });
 
     it(`\`${posture}\`: a delegated context with NO active organization is not this rule's — the read probes keep their answer`, async () => {
       // Its writes are ADR-0123 D2's, and the private object's grant lives
       // only inside an organization, so the public objects' reads are the
       // cells this rule could have moved and did not.
-      const b = await boot(posture);
+      const b = await shared(posture);
       for (const object of ['qa_account', 'qa_catalog']) {
         expect(await b.plugin.canReadObject(object, operator(undefined)), object).toBe(true);
         expect(await b.plugin.getReadableFields(object, operator(undefined)), object).toEqual(expect.arrayContaining(ALL_FIELDS));
       }
     });
 
     it(`\`${posture}\`: the narrowing diagnostic still reports a narrowed delegated read in an organization the delegator belongs to`, async () => {
-      const b = await boot(posture);
+      const b = await shared(posture);
       const verdict = await b.security().describeDelegationNarrowing('qa_ledger', agent(ORG_A));
       expect(verdict.narrowed).toBe(true);
       expect(verdict.effectiveScope).toBe('own');
@@ -641,7 +671,7 @@ describe('[#25107] what the rule leaves alone in the probes', () => {
   }
 
   it('`single`: there is no wall, so a delegated context in `org_d` is admitted by every probe and its narrowing is reported', async () => {
-    const b = await boot('single');
+    const b = await shared('single');
     for (const object of PROVIDER_OBJECTS) expectAdmitted(await probeAnswers(b, object, operator(ORG_D)), object);
     expect((await b.security().describeDelegationNarrowing('qa_ledger', agent(ORG_D))).narrowed).toBe(true);
   });
 
@@ -1,4 +1,5 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+// test-budget: 30 — spawns the real producer once per single-cause fixture: each row asks explain and the real enforcement path of a real SecurityPlugin over a real ObjectQL engine and SQL driver, a row that can write on its own rig and the read-only and on-behalf-of rows on one shared rig per posture; slowest CI reading 16.46 s (scheduled full-battery run 41183072927, Test Core suite-ceiling report) x 1.25, rounded up
 
 /**
  * `security.explain` answers what enforcement does — every verdict position,
@@ -1422,6 +1423,20 @@ const TABLE: Row[] = [
   }),
 ];
 
+// [#23181] The first rig's first loads (the driver's, the plugin's and the
+// explain engine's cold paths) are paid here, at module scope, outside every
+// row's clock: clocked windows measure behaviour, never loading. A throwaway
+// RLS rig answers one explain and one find; nothing it answers is read.
+{
+  const warm = await bootRls(SAME_CLASS);
+  try {
+    await warm.explain('read', 'r1');
+    await warm.find();
+  } finally {
+    await warm.teardown();
+  }
+}
+
 describe('security.explain answers what enforcement does — the enumeration', () => {
   for (const row of TABLE) {
     const title = `${row.card} · ${row.shape} · ${row.position}` +
 
@@ -1,4 +1,5 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+// test-budget: 30 — spawns the real producer once per single-cause fixture: a real SecurityPlugin over a real ObjectQL engine and SQL driver, one stack per (posture shape, set list), each persona's secured read of every touched identity object made once on it; slowest CI reading 17.95 s (scheduled full-battery run 41183072927, Test Core suite-ceiling report) x 1.25, rounded up
 
 /**
  * [ruling of record 6250748677 on #24164, letter E′ item 3 — the follow-up it
@@ -313,7 +314,7 @@ async function boot(shape: Shape, sets: PermissionSet[]) {
     { id: 'ups:p_admin', user_id: 'p_admin', permission_set: 'admin_full_access', organization_id: null },
   ]);
 
-  const served = async (object: string, persona: Persona): Promise<string[] | string> => {
+  const read = async (object: string, persona: Persona): Promise<string[] | string> => {
     try {
       const rows = (await engine.find(object, { context: { ...persona } } as never)) as Array<{ id: string }>;
       return rows.map((r) => r.id).sort();
@@ -322,6 +323,21 @@ async function boot(shape: Shape, sets: PermissionSet[]) {
       return `refused ${err.code} ${err.status}`;
     }
   };
+  // [#23181] Each (object, persona) read once per stack. No case writes after
+  // the seeding above, so a second read of the same pair answers what the first
+  // did; the pins that read a pair twice (the per-object sweep and the
+  // restored-copies comparison) read the same verdict, read once.
+  const reads = new Map<string, Promise<string[] | string>>();
+  const served = async (object: string, persona: Persona): Promise<string[] | string> => {
+    const key = `${object} :: ${JSON.stringify(persona)}`;
+    let answer = reads.get(key);
+    if (!answer) {
+      answer = read(object, persona);
+      reads.set(key, answer);
+    }
+    const value = await answer;
+    return Array.isArray(value) ? [...value] : value;
+  };
   /** The (object, operation) pairs at which `persona`'s collection is an object default. */
   const census = async (persona: Persona, objectNames: readonly string[], operations: readonly string[]): Promise<string[]> => {
     const held = await (plugin as any).resolvePermissionSetsForContext({ ...persona });
@@ -343,6 +359,32 @@ async function boot(shape: Shape, sets: PermissionSet[]) {
   return { engine, security, served, census, collectedNames };
 }
 
+// [#23181] The first boot's first loads (the driver's and the plugin's cold
+// paths, the first secured read) are paid here, at module scope, outside every
+// case's clock: clocked windows measure behaviour, never loading. Nothing this
+// stack answers is read; the file's `afterAll` destroys it with the rest.
+await (await boot(SHAPES[0], defaultPermissionSets)).served(TOUCHED[0], PERSONAS.member_default);
+
+/**
+ * [#23181] One stack per (shape, set list), booted by the first describe that
+ * asks for it and shared by the rest. Every case here only reads (`served`,
+ * `explain`, the collections), so a describe reads the stack it would have
+ * booted; the explain and must-keep describes ask the first shape's two stacks
+ * the per-shape sweep already booted.
+ */
+const stacks = new Map<string, Promise<Awaited<ReturnType<typeof boot>>>>();
+function stackFor(shape: Shape, sets: 'shipped' | 'restored') {
+  const key = `${shape.label} :: ${sets}`;
+  let stack = stacks.get(key);
+  if (!stack) {
+    stack = sets === 'shipped'
+      ? boot(shape, defaultPermissionSets)
+      : registeredObjects().then((objects) => boot(shape, withCopiesRestored(objects)));
+    stacks.set(key, stack);
+  }
+  return stack;
+}
+
 /** The user whose rows a persona reads as its own: the delegator, for an agent. */
 const selfOf = (persona: Persona): string =>
   String((persona.onBehalfOf as { userId?: string } | undefined)?.userId ?? persona.userId);
@@ -376,8 +418,8 @@ describe.each(SHAPES)('the shipped sets serve the identity objects as before —
   let shipped: Awaited<ReturnType<typeof boot>>;
   let restored: Awaited<ReturnType<typeof boot>>;
   beforeAll(async () => {
-    shipped = await boot(shape, defaultPermissionSets);
-    restored = await boot(shape, withCopiesRestored(await registeredObjects()));
+    shipped = await stackFor(shape, 'shipped');
+    restored = await stackFor(shape, 'restored');
   });
 
   // One case per object, not one sweep over all of them: the restored-copies
@@ -418,8 +460,8 @@ describe('explain names the object default where a dropped copy used to be the r
   let shipped: Awaited<ReturnType<typeof boot>>;
   let restored: Awaited<ReturnType<typeof boot>>;
   beforeAll(async () => {
-    shipped = await boot(shape, defaultPermissionSets);
-    restored = await boot(shape, withCopiesRestored(await registeredObjects()));
+    shipped = await stackFor(shape, 'shipped');
+    restored = await stackFor(shape, 'restored');
   });
   type RlsLayer = { layer: string; verdict: string; detail: string; record?: { rules: Array<Record<string, unknown>> } };
   const rlsLayer = (decision: { layers: RlsLayer[] }): RlsLayer => {
@@ -472,7 +514,7 @@ describe('explain names the object default where a dropped copy used to be the r
 describe('what the sets keep (pointer 6280763190, must-keep; the ledger, measured)', () => {
   let walled: Awaited<ReturnType<typeof boot>>;
   beforeAll(async () => {
-    walled = await boot(SHAPES[0], defaultPermissionSets);
+    walled = await stackFor(SHAPES[0], 'shipped');
   });
 
   it('a member\'s write collection on each kept `all` object carries the set\'s self scope beside the ownership floor, never the default', async () => {