docs(tests): repair three stale claims that the input-radius detector cannot resolve a findUp walk

packages/cli/src/commands/serve-multi-node-cap-advisory.pin.test.ts

@@ -86,14 +86,27 @@ const MASKED_SERVE_SOURCE = maskComments(SERVE_SOURCE);
  * one literal — but for that reason, not because the alternatives are invisible.
  *
  * The spellings that genuinely produce no flag are the ones the detector cannot
- * resolve at all: a template-literal path, a `findUp` walk from `process.cwd()`,
- * segments arriving out of a variable or an array. Reaching for one of those
- * would leave this read **undeclared**: `@objectstack/cli` would then be absent
+ * resolve at all: a template-literal path, a BARE `process.cwd()` walk, segments
+ * arriving out of a variable or an array. Reaching for one of those would leave
+ * this read **undeclared**: `@objectstack/cli` would then be absent
  * from `turbo ls --affected` for a cluster-only change and its `test` cache
  * would not hash this file, so the pin below would sit green through exactly
  * the drift it exists to catch. The declaration it needs lives in that script's
  * `CROSS_PACKAGE_TEST_INPUTS` and in `turbo.json`'s `@objectstack/cli#test`
  * inputs; removing either turns this file's own gate red.
+ *
+ * ⚠️ BARE is load-bearing. This sentence used to name `a findUp walk from
+ * process.cwd()` without it, and that clause went stale under the file while the
+ * file stayed still. Since #10852 that detector resolves two ANCHOR predicates on
+ * such a walk: one keyed on the scanned package's own manifest `name`, which
+ * resolves to that package's root, and one keyed on a workspace-root marker file
+ * (`pnpm-workspace.yaml` today), which resolves to the repo root. Both are on the
+ * published `RECOGNISED_PATH_SPELLINGS` list printed in its failure text, and
+ * each is pinned by a `--self-test` case — so re-derive from those two sources
+ * rather than from this paragraph, which is prose and can rot again. What still
+ * resolves to nothing is the unadorned `process.cwd()` expression with no
+ * recognised predicate on it, and a `findUp` keyed on any other marker
+ * (`turbo.json`, `.git`); both are pinned unresolved by their own cases.
  */
 const GATE_SOURCE = readFileSync(
  join(REPO_ROOT, 'packages/services/service-cluster/src/multi-node-gate.ts'),

packages/plugins/plugin-auth/src/managed-extension-fields.test.ts

@@ -315,19 +315,50 @@ const COVERED_OBJECTS: readonly string[] = [
  * This file's walk of `PACKAGES_DIR` below is what holds the
  * `packages/**\/*.object.ts` half of plugin-auth's declared radius and the
  * matching `turbo.json` inputs: it is the only escaping read in this package
- * that reaches an object file anywhere in the tree. Deriving the root any
- * other way — the `findUp` walk from `process.cwd()` that
- * `member-role-canonical.test.ts` uses — makes this radius INVISIBLE to
- * that gate, and note what that does NOT do any more: since #10161 gave
- * plugin-auth a second visible escaping test
- * (`rate-limit-storage-isolation.test.ts`, whose roster is the two consumer
- * directories, not this glob), the package no longer goes stale-empty, so
- * the gate stays GREEN and this glob is simply held by nothing. Measured on
- * ceb33a9f12 by reseeding this file from `process.cwd()`: `--list-escapes`
- * dropped this file and `--verify` still exited 0. Losing the seed would put
- * this sweep back in #7802's blind spot with no gate reporting it: turbo
- * would replay a cached green for a diff that changed another package's
- * object file.
+ * that reaches an object file anywhere in the tree.
+ *
+ * ⛔ So this file keeps its `__dirname` seed. The reason that prohibition
+ * used to give has been RESTATED rather than repeated, because the gate moved
+ * under it twice and the sentence did not — re-derive from the three
+ * measurements below rather than trusting any prose version of them. Each was
+ * taken on b706af987 by reseeding this file and re-running the gate:
+ *
+ * · WHAT HOLDS THE GLOB is a declaration, not the roster. The walk below
+ * descends on a loop variable, so no `*.object.ts` path is ever NAMED;
+ * the holder is the `heldBy` witness in that gate's plugin-auth entry,
+ * which names this file and is satisfied only while this file is still
+ * one of the package's ESCAPING tests. `packages/core/src/security/**`
+ * rides on the same condition — its only holder is the api-key path
+ * quoted in this file's prose above, and a quoted path enters the roster
+ * only from a file that escapes.
+ * · A SEED THE DETECTOR CANNOT RESOLVE — a bare `process.cwd()`, or a
+ * `findUp` keyed on `turbo.json` — drops this file out of
+ * `--list-escapes`, and `--verify` then exits 1 naming both globs, the
+ * first annotated `witness no longer escaping`. That is the other half of
+ * this note that had rotted: it used to say the gate "stays GREEN and
+ * this glob is simply held by nothing", which was true before #10566 gave
+ * the gate its unheld-glob limb and is false now. The remaining route
+ * back into #7802's blind spot is one step further on — reading that red
+ * as the gate's disposition 3 and DELETING the glob, which its own
+ * failure text lists LAST for exactly this reason.
+ * · A `findUp` WALK NO LONGER ABLATES THIS. Reseeded through the
+ * workspace-root anchor (`pnpm-workspace.yaml`), this file stays in
+ * `--list-escapes` and `--verify` exits 0: the radius stays visible and
+ * named. So the clause this note used to carry — that deriving the root
+ * via the `findUp` walk `member-role-canonical.test.ts` uses makes the
+ * radius INVISIBLE — is false since #10852, which taught the detector
+ * two ANCHOR predicates (this package's own manifest `name`; a
+ * `WORKSPACE_ROOT_MARKERS` file). ⛔ Do not re-derive the seed choice
+ * from that clause: it now argues for nothing.
+ *
+ * What the prohibition rests on instead is the part that did not move.
+ * `import.meta` is a TS1470 here (above), and of what is left `__dirname` is
+ * the only spelling that both type-checks under this package's own config and
+ * resolves from the FILE alone — no `findUp` helper to carry, no repo context,
+ * no predicate the detector has to special-case. A reseed buys this file
+ * nothing and narrows its correctness to the two predicates that gate
+ * recognises today; the near miss is measured above, one marker filename
+ * apart.
  */
 const HERE = __dirname;
 /** …/packages/plugins/plugin-auth/src → repo root */

packages/plugins/plugin-auth/src/rate-limit-storage-isolation.test.ts

@@ -58,17 +58,38 @@ import { dirname, join, relative, resolve } from 'node:path';
  * `__dirname` type-checks under the package's own config and is defined at
  * runtime by vitest's transform.
  * - `check:cross-package-test-inputs` detects an escaping read STATICALLY, by
- * resolving the seed expression. A `findUp` walk from `process.cwd()` is not a
- * spelling it resolves — `process.cwd()` appears nowhere in that detector — so
- * the two cross-package directory reads at the bottom of this file yielded no
- * flag and therefore no declaration, SILENTLY. Measured before this change:
- * `--list-escapes` named only `managed-extension-fields.test.ts` for
- * plugin-auth, and `@objectstack/plugin-auth#test`'s turbo input hash
- * (`1bf3935543ab055b`) did not move when `packages/runtime/src` changed — so a
- * runtime-only diff that reinstated the package-root import replayed a cached
- * green over the very scan that catches it (#7802's shape, #10029).
+ * resolving the seed expression, and `__dirname` is one of the spellings it
+ * resolves. When this file was reseeded (#10161) a `findUp` walk of
+ * `process.cwd()` was not one, so the two cross-package directory reads at the
+ * bottom of this file yielded no flag and therefore no declaration, SILENTLY.
+ * Measured before that change: `--list-escapes` named only
+ * `managed-extension-fields.test.ts` for plugin-auth, and
+ * `@objectstack/plugin-auth#test`'s turbo input hash (`1bf3935543ab055b`) did
+ * not move when `packages/runtime/src` changed — so a runtime-only diff that
+ * reinstated the package-root import replayed a cached green over the very
+ * scan that catches it (#7802's shape, #10029).
  *
- * Deriving the roots any other way puts this file back in that blind spot.
+ * ⚠️ Read that in the PAST tense — the sentence above used to be written in
+ * the present, with a second clause ("`process.cwd()` appears nowhere in that
+ * detector") that was already wrong when it was written. Since #10852 the
+ * detector DOES resolve a `findUp` walk, for two anchor predicates: one keyed
+ * on the scanned package's own manifest `name` (which resolves to that
+ * package's root) and one keyed on a `WORKSPACE_ROOT_MARKERS` file,
+ * `pnpm-workspace.yaml` today (which resolves to the repo root). It reads
+ * those predicates as TEXT and executes nothing, which is why the second
+ * clause never followed from the first: grep `process.cwd` in
+ * `scripts/check-cross-package-test-inputs.mjs` and every hit is a comment or
+ * a `--self-test` fixture — the detector names the call it recognises without
+ * ever making it. What still resolves to nothing is the unadorned
+ * `process.cwd()` expression, and a `findUp` keyed on any other marker
+ * (`turbo.json`, `.git`).
+ *
+ * So the constraint on the seed is not a spelling but a LIST: it must be one the
+ * gate publishes in `RECOGNISED_PATH_SPELLINGS` (printed in its failure text,
+ * each entry pinned by a `--self-test` case). `__dirname` is kept here because of
+ * the TS1470 above, not because the alternatives are invisible. Deriving the
+ * roots by a spelling that is NOT on that list puts this file back in the blind
+ * spot the measurement above describes.
  */
 const HERE = __dirname;
 /** …/packages/plugins/plugin-auth/src → the package root, then the repo root. */