From dba0e98bda430c098708036bf30c71bbf0065496 Mon Sep 17 00:00:00 2001
From: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
Date: Fri, 28 Aug 2026 06:59:57 -0700
Subject: [PATCH] docs(bench): record why the status-record filter depends on
 the pathspec

The index-2 space test is sound only because git refuses to pair a rename whose
source is outside the pathspec and downgrades it to A, so every bare source
record reaching the filter starts with a watched prefix. Without the pathspec a
source like 'zz a/f.ts' reads as a status record. Fail-closed, but non-obvious
enough that dropping the pathspec later would look safe.
---
 tests/tools/benchmarks/daemon-build-provenance-gate.mjs | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/tests/tools/benchmarks/daemon-build-provenance-gate.mjs b/tests/tools/benchmarks/daemon-build-provenance-gate.mjs
index f801238b9fe..450c1031c5a 100644
--- a/tests/tools/benchmarks/daemon-build-provenance-gate.mjs
+++ b/tests/tools/benchmarks/daemon-build-provenance-gate.mjs
@@ -49,8 +49,13 @@ export function assertDaemonBuildProvenance(repoRoot) {
     encoding: 'utf8'
   })
     .split('\0')
-    // -z emits a bare `new\0old\0` pair for R/C; the status record is the one with
-    // the two-column prefix, and the trailing source path carries none.
+    // -z emits a bare `new\0old\0` pair for R/C, so drop the trailing source path:
+    // only the status record has the two-column prefix. This test depends on the
+    // pathspec above -- git refuses to pair a rename whose source is outside it and
+    // downgrades to `A`, so every bare source record still reaching here starts with
+    // a watched prefix and never has a space at index 2. Drop the pathspec and a
+    // source like `zz a/f.ts` would be misread as a status record (fail-closed: it
+    // adds a spurious dirty entry rather than hiding one).
     .filter((record) => record.length > 3 && record[2] === ' ')
     .map((record) => record.slice(3))
   if (dirty.length > 0) {