docs(cli): past-tense the deleted detectMode VITEST arm in two serve e2e headers (#12495)

Two `packages/cli/test` headers quoted `detectMode`'s `env.VITEST ||` arm in
the PRESENT tense and cited `local-crypto-provider.ts:133`. That arm was
deleted by a58eac3 (2026-08-23) and the live `detectMode` sits at
`local-crypto-provider.ts:185`, reading `NODE_ENV` and nothing else.

The conclusion each header draws survives; the mechanism it predicts does not:

- `serve-process-child-env.e2e.test.ts` implied the strip still moves crypto
  posture. Children spawned through `helpers/serve-process.ts` run
  `bin/run-dev.js`, which pins `NODE_ENV = 'development'` before argv is
  parsed, and `NODE_ENV` sits outside `childEnv()`'s strip family — their
  posture is `development` with or without a leaked `VITEST`, so the
  `test` -> `development` flip the old wording predicted cannot happen.
- `serve-node-env-production-default.e2e.test.ts` tied its explicit
  `OS_SECRET_KEY` to `childEnv()` stripping `VITEST`. The unset-`NODE_ENV`
  leg selects production posture from `NODE_ENV` alone; production refuses
  without a stable key whether or not a `VITEST` leaks in.

Both restatements quote the removed line in the PAST TENSE and say so, which
is the discriminator this class needs: `local-crypto-provider.ts` and four
other sites quote the same string CORRECTLY, as retired code, and a
string-level sweep would corrupt them. Comment prose only, no behaviour change.


Claude-Session: https://claude.ai/code/session_01UjujZN219uFzBhSYfMykCd

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-litant

packages/cli/test/serve-node-env-production-default.e2e.test.ts

@@ -244,13 +244,24 @@ async function probeOriginCheck(env: Record<string, string | undefined>): Promis
       // file measures, so the key is supplied explicitly.
       //
       // ⚠️ It was NOT needed before #11267 — and that is the finding, not an
-      // inconvenience. `local-crypto-provider.ts:133` reads
+      // inconvenience. What follows is quoted in the PAST TENSE on purpose:
+      // the code it quotes is GONE. `detectMode` used to read
       // `if (env.VITEST || env.NODE_ENV === 'test') return 'test'`, so while
       // this fixture still inherited the vitest worker's `VITEST=true`, its
       // crypto layer sat in TEST mode (ephemeral key, no disk, no refusal)
       // while the rest of the boot was in production posture. The production
       // posture this file exists to pin was genuine for auth and fake for
-      // crypto. Supplying the key is what makes it genuine for both.
+      // crypto.
+      //
+      // #11448 (`a58eac3e`, merged 2026-08-23) deleted that arm. The live
+      // `detectMode` (`local-crypto-provider.ts:185`) reads `NODE_ENV` and
+      // nothing else, so the key requirement no longer depends on `childEnv()`
+      // stripping anything: the unset-`NODE_ENV` leg selects production
+      // posture from `NODE_ENV` alone, and production refuses without a stable
+      // key whether or not a `VITEST` leaks in. The strip stays anyway, now as
+      // defence-in-depth over a class `pnpm check:runner-env-posture` holds
+      // shut in product source. Supplying the key is what makes the posture
+      // genuine for both halves.
       OS_SECRET_KEY: E2E_SECRET_KEY,
       // The base default for every call: truly unset, unless overridden by
       // `env` below. Node's spawn omits an `undefined`-valued entry rather

packages/cli/test/serve-process-child-env.e2e.test.ts

@@ -36,11 +36,26 @@
  * `VITEST_WORKER_ID`, `VITEST_POOL_ID`, `VITEST_MODE` in place) also answers
  * `403 INVALID_ORIGIN`, so `TEST` alone is what better-auth reads.
  *
- * ⚠️ `VITEST` is not merely hygiene either, though this file said so in its
- * first revision and was wrong: `local-crypto-provider.ts:133` reads it
- * (`if (env.VITEST || env.NODE_ENV === 'test') return 'test'`) and an
- * inherited one silently put a spawned child's crypto layer in test mode. Same
- * class, different gate. `helpers/serve-process.ts` carries the measurement.
+ * ⚠️ `VITEST` was not merely hygiene either, though this file said so in its
+ * first revision and was wrong. What follows is quoted in the PAST TENSE on
+ * purpose — the code it quotes is GONE. `detectMode` in
+ * `local-crypto-provider.ts` used to read
+ * `if (env.VITEST || env.NODE_ENV === 'test') return 'test'`, so an inherited
+ * `VITEST=true` silently put a spawned child's crypto layer in test mode.
+ * #11448 (`a58eac3e`, merged 2026-08-23) deleted that arm; the live
+ * `detectMode` (`local-crypto-provider.ts:185`) reads `NODE_ENV` and nothing
+ * else.
+ *
+ * ⛔ So do not read the strip as still moving crypto posture: children
+ * spawned through this helper run `bin/run-dev.js`, which pins
+ * `process.env.NODE_ENV = 'development'` before argv is parsed, and `NODE_ENV`
+ * is deliberately outside `childEnv()`'s strip family — their posture is
+ * `development` with or without a leaked `VITEST`. The old wording predicted a
+ * `test` → `development` flip that cannot happen, and that prediction has
+ * already cost one dispatch (#11596) its scoping assumption. The strip stays
+ * anyway, now as defence-in-depth over a class `pnpm check:runner-env-posture`
+ * holds shut in product source. Same class, different gate;
+ * `helpers/serve-process.ts` carries the measurement.
  *
  * ## ⚠️ The first boot deliberately builds the env the WRONG way
  *