docs(tests): correct four stale claims about what check:cross-package-test-inputs recognises

packages/cli/src/commands/serve-multi-node-cap-advisory.pin.test.ts

@@ -49,12 +49,27 @@ const SERVE_SOURCE = readFileSync(resolve(HERE, 'serve.ts'), 'utf8');
  * reading `src` also means the pin does not depend on anything being built.
  *
  * ⚠️ Addressed as a repo-relative literal off an escaping `REPO_ROOT` binding
- * on purpose — that is the shape the repo's `check:cross-package-test-inputs`
- * gate can follow. (Its script is named without a repo-relative path here: that
- * gate collects path literals out of a test's source, comments included, and
- * would then require a glob for a file this test never reads.) Spellings it cannot follow (a `new URL('…', import.meta.url)`
- * seed, or a `resolve()` nested straight into the `readFileSync` call) read
- * identically at runtime but produce no binding and therefore no flag, which
+ * on purpose — that is the shape BOTH halves of the repo's
+ * `check:cross-package-test-inputs` gate see. (Its script is named without a
+ * repo-relative path here: that gate collects path literals out of a test's
+ * source, comments included, and would then require a glob for a file this test
+ * never reads.)
+ *
+ * This note used to say the gate could not follow a `new URL('…',
+ * import.meta.url)` seed or a `resolve()` nested straight into the
+ * `readFileSync` call. It follows both, and has since #9763 — both are on its
+ * published `RECOGNISED_PATH_SPELLINGS` list, printed in its failure text, and
+ * each is pinned by a `--self-test` case; measured on ceb33a9f12, both produce
+ * the escape flag. What they miss is the FLAT literal collector, which sees a
+ * path only when the whole repo-relative string sits inside ONE quoted literal
+ * starting at a top-level directory: written ascent-relative, this read's name
+ * would reach the radius roster only through the resolver's reconstruction,
+ * where the spelling below reaches it through both. So keep the whole path in
+ * one literal — but for that reason, not because the alternatives are invisible.
+ *
+ * The spellings that genuinely produce no flag are the ones the detector cannot
+ * resolve at all: a template-literal path, a `findUp` walk from `process.cwd()`,
+ * segments arriving out of a variable or an array. Reaching for one of those
  * would leave this read **undeclared**: `@objectstack/cli` would then be absent
  * from `turbo ls --affected` for a cluster-only change and its `test` cache
  * would not hash this file, so the pin below would sit green through exactly

packages/platform-objects/src/managed-api-method-affordance-sweep.test.ts

@@ -101,14 +101,23 @@ import { MANAGED_API_METHOD_UNAFFORDABLE, validateManagedApiMethods } from '@obj
  * in front of tsc, `import.meta` becomes an error in a ledger that may only
  * shrink. `__dirname` type-checks under the package's own config and is
  * defined at runtime by vitest's transform (verified, not assumed).
- * - `check:cross-package-test-inputs` recognises exactly two seeds —
- * `dirname(fileURLToPath(import.meta.url))` and `__dirname` — when it detects
- * statically that a test escapes its package. Deriving the root any other way
- * (walking up to `pnpm-workspace.yaml`, resolving from `process.cwd()`) makes
- * this file's real radius INVISIBLE to that gate, which then reports the
- * declaration below as stale and asks for its removal. Losing it would put
- * the sweep back in #7802's blind spot: turbo would cache a green for a diff
- * that changed another package's object file. Measured both ways.
+ * - `check:cross-package-test-inputs` detects an escaping read STATICALLY, by
+ * resolving the seed expression, and `__dirname` is one of the spellings it
+ * resolves. Which spellings those are is published rather than restated
+ * here: `RECOGNISED_PATH_SPELLINGS` in the detector, printed verbatim in its
+ * failure text and mirrored in AGENTS.md. Read it there — the set has been
+ * widened twice (#8995, #9763) since this note was first written, and a
+ * count copied into a comment goes stale silently while the published list
+ * cannot. Deriving the root a way the detector does NOT resolve (walking up
+ * to `pnpm-workspace.yaml`, resolving from `process.cwd()`) makes this
+ * file's real radius INVISIBLE to that gate, which then reports the
+ * declaration below as stale and asks for its removal — this file is
+ * platform-objects' only escaping test, so hiding it empties the package.
+ * Measured on ceb33a9f12 by reseeding from `process.cwd()`: the gate exits 1
+ * with "@objectstack/platform-objects declares a cross-package input radius,
+ * but no test in it reads outside the package any more". Acting on that and
+ * deleting the entry would put the sweep back in #7802's blind spot: turbo
+ * would cache a green for a diff that changed another package's object file.
  */
 const HERE = __dirname;
 /** …/packages/platform-objects/src → repo root */

packages/plugins/plugin-auth/src/managed-extension-fields.test.ts

@@ -305,19 +305,29 @@ const COVERED_OBJECTS: readonly string[] = [
  * only shrink.
  * `__dirname` type-checks under the package's own config and is defined at
  * runtime by vitest's transform (verified, not assumed).
- * - `check:cross-package-test-inputs` recognises exactly two seeds —
- * `dirname(fileURLToPath(import.meta.url))` and `__dirname` — when it
- * detects statically that a test escapes its package. This file's walk of
- * `PACKAGES_DIR` below is the ONLY escaping read the gate can see in
- * plugin-auth, so it is what holds the package's declared radius
- * (`packages/**\/*.object.ts`) and the matching `turbo.json` inputs.
- * Deriving the root any other way — the `findUp` walk from `process.cwd()`
- * that `rate-limit-storage-isolation.test.ts` and
- * `member-role-canonical.test.ts` use — makes this radius INVISIBLE to that
- * gate, which then reports the declaration as stale and asks for its
- * removal. Losing it would put this sweep back in #7802's blind spot:
- * turbo would replay a cached green for a diff that changed another
- * package's object file. Measured both ways.
+ * - `check:cross-package-test-inputs` detects an escaping read STATICALLY, by
+ * resolving the seed expression, and `__dirname` is one of the spellings it
+ * resolves. Which spellings those are is published rather than restated
+ * here: `RECOGNISED_PATH_SPELLINGS` in the detector, printed in its failure
+ * text and mirrored in AGENTS.md. Read it there — the set has been widened
+ * twice (#8995, #9763) since this note was first written, and a count
+ * copied into a comment goes stale silently while the published list cannot.
+ * This file's walk of `PACKAGES_DIR` below is what holds the
+ * `packages/**\/*.object.ts` half of plugin-auth's declared radius and the
+ * matching `turbo.json` inputs: it is the only escaping read in this package
+ * that reaches an object file anywhere in the tree. Deriving the root any
+ * other way — the `findUp` walk from `process.cwd()` that
+ * `member-role-canonical.test.ts` uses — makes this radius INVISIBLE to
+ * that gate, and note what that does NOT do any more: since #10161 gave
+ * plugin-auth a second visible escaping test
+ * (`rate-limit-storage-isolation.test.ts`, whose roster is the two consumer
+ * directories, not this glob), the package no longer goes stale-empty, so
+ * the gate stays GREEN and this glob is simply held by nothing. Measured on
+ * ceb33a9f12 by reseeding this file from `process.cwd()`: `--list-escapes`
+ * dropped this file and `--verify` still exited 0. Losing the seed would put
+ * this sweep back in #7802's blind spot with no gate reporting it: turbo
+ * would replay a cached green for a diff that changed another package's
+ * object file.
  */
 const HERE = __dirname;
 /** …/packages/plugins/plugin-auth/src → repo root */

scripts/check-type-check-coverage.mjs

@@ -752,7 +752,10 @@ const TEST_DEBT = {
  + '110 -> 109 here (#9694): src/managed-extension-fields.test.ts held the package\'s only '
  + 'TS1470 -- an `import.meta.url` seed in a package that is CJS-typed and therefore forbids '
  + 'the meta-property under module: NodeNext -- and now seeds from `__dirname`, which '
- + 'type-checks here AND is one of the two seeds check:cross-package-test-inputs recognises, so '
+ + 'type-checks here AND is a seed spelling check:cross-package-test-inputs resolves -- the '
+ + 'current set is that gate\'s published RECOGNISED_PATH_SPELLINGS, printed verbatim in its '
+ + 'failure text, and is deliberately not restated as a count here because a count drifts '
+ + 'silently (it has been widened twice, #8995 and #9763) -- so '
  + 'that file\'s repo-wide *.object.ts walk stays visible to the gate holding plugin-auth\'s '
  + 'declared input radius. It contributes nothing to this pile any more.',
  },