From 4eb29b974132760ba7cd924c804896a093773c40 Mon Sep 17 00:00:00 2001
From: 0xdhx <darkhawkx@gmail.com>
Date: Thu, 6 Aug 2026 16:33:44 -0500
Subject: [PATCH] test(#2665): pin the MAX_DEPTH boundary on both sides, not
 just above it

RULESET.TESTS.boundary-coverage asks for {limit-1, limit, limit+1}. The depth
bound was exercised only at limit+2, which pins neither side of the edge: an
off-by-one that truncated a tree sitting exactly AT MAX_DEPTH would have passed,
and a truncation is not a cosmetic miss here -- it reports `unverified`, which
in strict mode fails the run.

Negative-controlled by weakening the guard to `depth >= MAX_DEPTH`: the new
limit case fails, where the previous single limit+2 assertion did not.

Addresses review finding: Minor 8.
---
 tests/live-config-guard.test.cjs | 48 +++++++++++++++++++++++++++-----
 1 file changed, 41 insertions(+), 7 deletions(-)

diff --git a/tests/live-config-guard.test.cjs b/tests/live-config-guard.test.cjs
index 2efed27c0..40cb9d0a9 100644
--- a/tests/live-config-guard.test.cjs
+++ b/tests/live-config-guard.test.cjs
@@ -485,15 +485,49 @@ describe('#2665: scan-budget truncation', () => {
     }
   });
 
-  test('exceeding MAX_DEPTH truncates', () => {
+  // RULESET.TESTS.boundary-coverage asks for {limit-1, limit, limit+1}. This was
+  // exercised only at limit+2, which pins neither side of the edge: an off-by-one
+  // that truncated a legal depth would have passed. `nestedDepth(n)` builds a tree
+  // whose deepest entry sits at walk-depth n below the scanned root, and
+  // newestMtime truncates iff that depth EXCEEDS MAX_DEPTH.
+  const nestedDepth = (n) => {
     const dir = tmpRoot();
-    try {
-      let deep = dir;
-      for (let i = 0; i <= MAX_DEPTH + 1; i++) deep = path.join(deep, `d${i}`);
-      fs.mkdirSync(deep, { recursive: true });
+    let deep = dir;
+    for (let i = 0; i < n; i++) deep = path.join(deep, `d${i}`);
+    fs.mkdirSync(deep, { recursive: true });
+    return dir;
+  };
 
-      const res = newestMtime(dir, { remaining: 1e6 });
-      assert.strictEqual(res.truncated, true, 'a tree deeper than MAX_DEPTH must truncate');
+  test(`MAX_DEPTH boundary: depth ${MAX_DEPTH - 1} (limit-1) does NOT truncate`, () => {
+    const dir = nestedDepth(MAX_DEPTH - 1);
+    try {
+      assert.strictEqual(newestMtime(dir, { remaining: 1e6 }).truncated, false);
+    } finally {
+      cleanup(dir);
+    }
+  });
+
+  test(`MAX_DEPTH boundary: depth ${MAX_DEPTH} (limit) does NOT truncate`, () => {
+    const dir = nestedDepth(MAX_DEPTH);
+    try {
+      assert.strictEqual(
+        newestMtime(dir, { remaining: 1e6 }).truncated,
+        false,
+        'a tree exactly at MAX_DEPTH is within bounds and must be attested',
+      );
+    } finally {
+      cleanup(dir);
+    }
+  });
+
+  test(`MAX_DEPTH boundary: depth ${MAX_DEPTH + 1} (limit+1) truncates`, () => {
+    const dir = nestedDepth(MAX_DEPTH + 1);
+    try {
+      assert.strictEqual(
+        newestMtime(dir, { remaining: 1e6 }).truncated,
+        true,
+        'a tree deeper than MAX_DEPTH must truncate',
+      );
     } finally {
       cleanup(dir);
     }