docs(cli): past-tense the deleted detectMode VITEST arm in two serve e2e headers

packages/cli/test/serve-node-env-production-default.e2e.test.ts

@@ -244,13 +244,24 @@ async function probeOriginCheck(env: Record<string, string | undefined>): Promis
  // file measures, so the key is supplied explicitly.
  //
  // ⚠️ It was NOT needed before #11267 — and that is the finding, not an
- // inconvenience. `local-crypto-provider.ts:133` reads
+ // inconvenience. What follows is quoted in the PAST TENSE on purpose:
+ // the code it quotes is GONE. `detectMode` used to read
  // `if (env.VITEST || env.NODE_ENV === 'test') return 'test'`, so while
  // this fixture still inherited the vitest worker's `VITEST=true`, its
  // crypto layer sat in TEST mode (ephemeral key, no disk, no refusal)
  // while the rest of the boot was in production posture. The production
  // posture this file exists to pin was genuine for auth and fake for
- // crypto. Supplying the key is what makes it genuine for both.
+ // crypto.
+ //
+ // #11448 (`a58eac3e`, merged 2026-08-23) deleted that arm. The live
+ // `detectMode` (`local-crypto-provider.ts:185`) reads `NODE_ENV` and
+ // nothing else, so the key requirement no longer depends on `childEnv()`
+ // stripping anything: the unset-`NODE_ENV` leg selects production
+ // posture from `NODE_ENV` alone, and production refuses without a stable
+ // key whether or not a `VITEST` leaks in. The strip stays anyway, now as
+ // defence-in-depth over a class `pnpm check:runner-env-posture` holds
+ // shut in product source. Supplying the key is what makes the posture
+ // genuine for both halves.
  OS_SECRET_KEY: E2E_SECRET_KEY,
  // The base default for every call: truly unset, unless overridden by
  // `env` below. Node's spawn omits an `undefined`-valued entry rather

packages/cli/test/serve-process-child-env.e2e.test.ts

@@ -36,11 +36,26 @@
  * `VITEST_WORKER_ID`, `VITEST_POOL_ID`, `VITEST_MODE` in place) also answers
  * `403 INVALID_ORIGIN`, so `TEST` alone is what better-auth reads.
  *
- * ⚠️ `VITEST` is not merely hygiene either, though this file said so in its
- * first revision and was wrong: `local-crypto-provider.ts:133` reads it
- * (`if (env.VITEST || env.NODE_ENV === 'test') return 'test'`) and an
- * inherited one silently put a spawned child's crypto layer in test mode. Same
- * class, different gate. `helpers/serve-process.ts` carries the measurement.
+ * ⚠️ `VITEST` was not merely hygiene either, though this file said so in its
+ * first revision and was wrong. What follows is quoted in the PAST TENSE on
+ * purpose — the code it quotes is GONE. `detectMode` in
+ * `local-crypto-provider.ts` used to read
+ * `if (env.VITEST || env.NODE_ENV === 'test') return 'test'`, so an inherited
+ * `VITEST=true` silently put a spawned child's crypto layer in test mode.
+ * #11448 (`a58eac3e`, merged 2026-08-23) deleted that arm; the live
+ * `detectMode` (`local-crypto-provider.ts:185`) reads `NODE_ENV` and nothing
+ * else.
+ *
+ * ⛔ So do not read the strip as still moving crypto posture: children
+ * spawned through this helper run `bin/run-dev.js`, which pins
+ * `process.env.NODE_ENV = 'development'` before argv is parsed, and `NODE_ENV`
+ * is deliberately outside `childEnv()`'s strip family — their posture is
+ * `development` with or without a leaked `VITEST`. The old wording predicted a
+ * `test` → `development` flip that cannot happen, and that prediction has
+ * already cost one dispatch (#11596) its scoping assumption. The strip stays
+ * anyway, now as defence-in-depth over a class `pnpm check:runner-env-posture`
+ * holds shut in product source. Same class, different gate;
+ * `helpers/serve-process.ts` carries the measurement.
  *
  * ## ⚠️ The first boot deliberately builds the env the WRONG way
  *