test(objectql): load the package entry with hook-run-as.test.ts, not inside its case (#26132)

<!-- claude-projects-attribution: {"github_login":"os-project-manager"}
-->
_Requested by **Leehom** · [project
thread](https://claude.ai/code/project/chan_01TenzsRopZj4jMbvjX8uz1X?thread=cmsg_01TenzsRopZj4jMbvjX8uz1XMJzDxfCB4ZBgkGR2dr7BYV)_

Fixes #26049

Clause-②: no
Metadata-protocol: none

## What timed out, read from the logs

Both merge-queue ejections (build 40300684735 for #26012, Test Core 8/8;
build 40302541664 for #26007, Test Core 8/8) fail at
`src/hook-run-as.test.ts:389:5`, the case **"the seed is no nameable
member of the published face: keyed on a symbol the package entry does
not export"**. The triage comments truncate the FAIL line after the
describe title, which made it read as the block's first case; the full
title and the line number are in the job logs' `::error` annotation.

That case did `const entry = await import('./index.js')` inside the test
body. The package entry pulls the rest of `@objectstack/objectql`'s
module graph, which nothing else in this file loads, so the case paid a
cold transform and import of the package inside its 5000 ms budget. The
resolver path the card suspected is not the cost:
`resolveUserAuthzGrants` is a static import in `engine.ts`, and the
block's first case runs in 1 ms.

## The fix (test-only)

`import * as entry from './index.js'` at the top of the file, the same
idiom the package's `*-code-constant.test.ts` files use for the barrel.
The load now happens at file collection, outside any per-case window.
The case becomes synchronous and keeps all five assertions unchanged
(`SEED_USER_GRANTS` and `APP_AUTHORED_HOOK_API` absent from the entry,
`withUserGrantsSeeded` absent from the prototype, two symbol-keyed
members). No quarantine, skip, retry or timeout change. No product code
touched.

## Evidence

Run: `pnpm --filter @objectstack/objectql exec vitest run --maxWorkers=2
--reporter=verbose src/hook-run-as.test.ts`, under
`scripts/pm/os-verify-lock.sh`, with 8 `node -e 'for(;;){}'` busy loops
alongside on a 4-core container (2x oversubscribed, standing in for the
ui lanes running beside Test Core). Shared-box seconds.

| | case time | file result | `tests` phase |
|---|---|---|---|
| quiet box, `origin/main` 9753d16 | 2513 ms | 29/29 | 2.61 s |
| under load, `origin/main`, 5 runs | 5016, 5021, 5366, 5413, 5070 ms
(all `Test timed out in 5000ms.`) | 5 of 5 red, 1 failed / 28 passed |
5.27–5.73 s |
| under load, this branch, 5 runs | 1, 0, 0, 0, 1 ms | 5 of 5 green,
29/29 | 0.20–0.37 s |

The load did not disappear; it moved. Under load the file's `import`
phase went from 12.8–17.9 s (before) to 20.3–26.3 s (after), and
whole-file wall time stayed in the same 18–27 s band. That phase is not
bounded by `testTimeout`.

Local verification at the final head: `pnpm --filter
@objectstack/objectql typecheck` exit 0 (`check:test-typecheck` OK,
test-layer debt held); `eslint packages/objectql --no-inline-config`
exit 0; `pnpm --filter @objectstack/objectql test` exit 0 (470 files /
8748 tests passed); the derived gate list (`dispatch-gates.mjs
--commands`) 58 derived, 57 run with exit 0, 1 NOT MEASURED
(`check:dual-build-cjs-loads`, exit 3: needs a full build); `--ran`
reconciles 58/58 at `d8e4f756c`.

## Changeset

`skip-changeset`: the diff is one `*.test.ts` file, and
`@objectstack/objectql`'s `files[]` is `dist`, `README.md`,
`CHANGELOG.md`, so nothing published changes.

## Acceptance notes

- `packages/objectql/src/bound-action-collision-report.test.ts:111` has
the same shape (`await import('./index.js')` inside a "no nameable
member of the published face" case). It has not ejected a queue build,
and it is outside this claim's file surface, so it is untouched here;
reported to the seat.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01AN1CuLrAYkcsfrh1N5ffLT

---
_Generated by [Claude
Code](https://claude.ai/code/session_01AN1CuLrAYkcsfrh1N5ffLT)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

packages/objectql/src/hook-run-as.test.ts

@@ -47,6 +47,12 @@ import {
 } from './hook-run-as.js';
 import { assertEngineDeleteDispatch } from './engine-delete-dispatch.js';
 import { assertEngineUpdateDispatch } from './engine-update-dispatch.js';
+// [#26049] The published face, loaded with the file rather than inside the
+// case that reads it: the entry pulls the rest of the package's module graph,
+// which cost ~2.5 s inside that case on a quiet box and crossed its 5 s budget
+// under merge-queue load. Same module, same assertions; only where the load
+// is paid moved.
+import * as entry from './index.js';
 import type { Hook, HookContext } from '@objectstack/spec/data';
 import type { ExecutionContext } from '@objectstack/spec/kernel';
 
@@ -386,8 +392,7 @@ describe('#14010 Hook.runAs — the identity a hook\'s ctx.api presents', () =>
       expect(userless.seen).toEqual([]);
     });
 
-    it('the seed is no nameable member of the published face: keyed on a symbol the package entry does not export', async () => {
-      const entry = await import('./index.js');
+    it('the seed is no nameable member of the published face: keyed on a symbol the package entry does not export', () => {
       expect('SEED_USER_GRANTS' in entry).toBe(false);
       expect(Object.getOwnPropertyNames(ScopedContext.prototype)).not.toContain('withUserGrantsSeeded');
       // [#25653] The app-authored hook api's derivation is the other symbol-keyed member, unexported too.