Filed by the spec seat on the maintainer's instruction (2026-08-20 live chat, verbatim: 「立卡」, accepting layers ①+④ of the queue-incident remediation menu). Provenance thread: #10115 (root cause) · PR #10120 (the instance fix) · #10112 (the mis-diagnosis record, re-scoped).
The incident this closes the class of
dev-plugin-security-enforcement-warning.test.ts (merged 01:53Z via PR #10092) deliberately boots the real, unmocked @objectstack/plugin-security chain and paid its cold vite transform inside a clocked window (first it() body → later a beforeAll). Measured: 3.1–3.6s idle on 4 vCPU (~70% of vitest's 5000ms default), ballooning to 20.26s on a starved core — past every clock, including a hypothetical 30s. The result was Test timed out in 5000ms only under merge-queue full-suite load: 30 failed queue builds in 24h, main frozen 2h+, three innocent PRs ejected (#10105, #10003, #10008), and even the first fix PR (beforeAll warm-up — hooks are clocked too, hookTimeout 10s) was ejected twice by the very test it fixed. The landed fix (PR #10120 head 7ef8159b7) is a module-top static import — the cost moved OUT of every clocked window, verified immune at --hookTimeout=1 --testTimeout=1000.
The mechanical rule
For every entry in KNOWN_UNALIASED_TEST_IMPORTS (the registry scripts/check-test-source-alias.mjs already keeps — workspace deps that test files resolve through dist): any test file importing that dependency must reference it in a top-level static import, so the first paid load is at module scope, never inside it()/beforeAll/dynamic-import-in-body. A violation is exactly tonight's shape, caught at the offending PR's own CI instead of in the queue.
Implementation shape (lead, not spec): one new check limb + self-test in the existing gate, matching its registry-plus-gate idiom. Detection: for each unaliased specifier, scan the package's test files — a dynamic import()/require of that specifier inside a function body with no top-level static import of the same specifier is a finding, reported against the test file with the incident-derived remedy ("add a module-top import '<specifier>' so the transform is unclocked").
Rider (layer ④, one prose line)
Add the convention sentence to the testing-conventions doc the gate's header points at: clocked windows measure behaviour, never loading — a test that boots a real plugin chain pays its first load at module top.
Dedup: #10112's re-scoped surviving half (shrink the unaliased registry by source-aliasing) is the adjacent, complementary card — aliasing removes entries from this gate's input; this gate covers whatever remains. Cross-linked, not duplicated. No other card names this rule (searched: test-source-alias / static import / clocked window).
Suggested size/model: S–M, opus.
Filed by the spec seat on the maintainer's instruction (2026-08-20 live chat, verbatim: 「立卡」, accepting layers ①+④ of the queue-incident remediation menu). Provenance thread: #10115 (root cause) · PR #10120 (the instance fix) · #10112 (the mis-diagnosis record, re-scoped).
The incident this closes the class of
dev-plugin-security-enforcement-warning.test.ts(merged 01:53Z via PR #10092) deliberately boots the real, unmocked@objectstack/plugin-securitychain and paid its cold vite transform inside a clocked window (firstit()body → later abeforeAll). Measured: 3.1–3.6s idle on 4 vCPU (~70% of vitest's 5000ms default), ballooning to 20.26s on a starved core — past every clock, including a hypothetical 30s. The result wasTest timed out in 5000msonly under merge-queue full-suite load: 30 failed queue builds in 24h, main frozen 2h+, three innocent PRs ejected (#10105, #10003, #10008), and even the first fix PR (beforeAll warm-up — hooks are clocked too,hookTimeout10s) was ejected twice by the very test it fixed. The landed fix (PR #10120 head7ef8159b7) is a module-top static import — the cost moved OUT of every clocked window, verified immune at--hookTimeout=1 --testTimeout=1000.The mechanical rule
For every entry in
KNOWN_UNALIASED_TEST_IMPORTS(the registryscripts/check-test-source-alias.mjsalready keeps — workspace deps that test files resolve throughdist): any test file importing that dependency must reference it in a top-level static import, so the first paid load is at module scope, never insideit()/beforeAll/dynamic-import-in-body. A violation is exactly tonight's shape, caught at the offending PR's own CI instead of in the queue.Implementation shape (lead, not spec): one new check limb + self-test in the existing gate, matching its registry-plus-gate idiom. Detection: for each unaliased specifier, scan the package's test files — a dynamic
import()/requireof that specifier inside a function body with no top-level static import of the same specifier is a finding, reported against the test file with the incident-derived remedy ("add a module-topimport '<specifier>'so the transform is unclocked").Rider (layer ④, one prose line)
Add the convention sentence to the testing-conventions doc the gate's header points at: clocked windows measure behaviour, never loading — a test that boots a real plugin chain pays its first load at module top.
Dedup: #10112's re-scoped surviving half (shrink the unaliased registry by source-aliasing) is the adjacent, complementary card — aliasing removes entries from this gate's input; this gate covers whatever remains. Cross-linked, not duplicated. No other card names this rule (searched: test-source-alias / static import / clocked window).
Suggested size/model: S–M,
opus.