diff --git a/packages/cli/test/serve-node-env-production-default.e2e.test.ts b/packages/cli/test/serve-node-env-production-default.e2e.test.ts
index 65cb7ea3d9..14ea4d52ca 100644
--- a/packages/cli/test/serve-node-env-production-default.e2e.test.ts
+++ b/packages/cli/test/serve-node-env-production-default.e2e.test.ts
@@ -244,13 +244,24 @@ async function probeOriginCheck(env: Record<string, string | undefined>): Promis
       // file measures, so the key is supplied explicitly.
       //
       // ⚠️ It was NOT needed before #11267 — and that is the finding, not an
-      // inconvenience. `local-crypto-provider.ts:133` reads
+      // inconvenience. What follows is quoted in the PAST TENSE on purpose:
+      // the code it quotes is GONE. `detectMode` used to read
       // `if (env.VITEST || env.NODE_ENV === 'test') return 'test'`, so while
       // this fixture still inherited the vitest worker's `VITEST=true`, its
       // crypto layer sat in TEST mode (ephemeral key, no disk, no refusal)
       // while the rest of the boot was in production posture. The production
       // posture this file exists to pin was genuine for auth and fake for
-      // crypto. Supplying the key is what makes it genuine for both.
+      // crypto.
+      //
+      // #11448 (`a58eac3e`, merged 2026-08-23) deleted that arm. The live
+      // `detectMode` (`local-crypto-provider.ts:185`) reads `NODE_ENV` and
+      // nothing else, so the key requirement no longer depends on `childEnv()`
+      // stripping anything: the unset-`NODE_ENV` leg selects production
+      // posture from `NODE_ENV` alone, and production refuses without a stable
+      // key whether or not a `VITEST` leaks in. The strip stays anyway, now as
+      // defence-in-depth over a class `pnpm check:runner-env-posture` holds
+      // shut in product source. Supplying the key is what makes the posture
+      // genuine for both halves.
       OS_SECRET_KEY: E2E_SECRET_KEY,
       // The base default for every call: truly unset, unless overridden by
       // `env` below. Node's spawn omits an `undefined`-valued entry rather
diff --git a/packages/cli/test/serve-process-child-env.e2e.test.ts b/packages/cli/test/serve-process-child-env.e2e.test.ts
index 4b3b63ec29..f874146432 100644
--- a/packages/cli/test/serve-process-child-env.e2e.test.ts
+++ b/packages/cli/test/serve-process-child-env.e2e.test.ts
@@ -36,11 +36,26 @@
  * `VITEST_WORKER_ID`, `VITEST_POOL_ID`, `VITEST_MODE` in place) also answers
  * `403 INVALID_ORIGIN`, so `TEST` alone is what better-auth reads.
  *
- * ⚠️ `VITEST` is not merely hygiene either, though this file said so in its
- * first revision and was wrong: `local-crypto-provider.ts:133` reads it
- * (`if (env.VITEST || env.NODE_ENV === 'test') return 'test'`) and an
- * inherited one silently put a spawned child's crypto layer in test mode. Same
- * class, different gate. `helpers/serve-process.ts` carries the measurement.
+ * ⚠️ `VITEST` was not merely hygiene either, though this file said so in its
+ * first revision and was wrong. What follows is quoted in the PAST TENSE on
+ * purpose — the code it quotes is GONE. `detectMode` in
+ * `local-crypto-provider.ts` used to read
+ * `if (env.VITEST || env.NODE_ENV === 'test') return 'test'`, so an inherited
+ * `VITEST=true` silently put a spawned child's crypto layer in test mode.
+ * #11448 (`a58eac3e`, merged 2026-08-23) deleted that arm; the live
+ * `detectMode` (`local-crypto-provider.ts:185`) reads `NODE_ENV` and nothing
+ * else.
+ *
+ * ⛔ So do not read the strip as still moving crypto posture: children
+ * spawned through this helper run `bin/run-dev.js`, which pins
+ * `process.env.NODE_ENV = 'development'` before argv is parsed, and `NODE_ENV`
+ * is deliberately outside `childEnv()`'s strip family — their posture is
+ * `development` with or without a leaked `VITEST`. The old wording predicted a
+ * `test` → `development` flip that cannot happen, and that prediction has
+ * already cost one dispatch (#11596) its scoping assumption. The strip stays
+ * anyway, now as defence-in-depth over a class `pnpm check:runner-env-posture`
+ * holds shut in product source. Same class, different gate;
+ * `helpers/serve-process.ts` carries the measurement.
  *
  * ## ⚠️ The first boot deliberately builds the env the WRONG way
  *