test(cli): classify makeDirectorySync in the build/validate parity ledger; the credentials test mocks the bounded walk

Claude-Session: https://claude.ai/code/session_018t6a5rvqPRvEDMCVVW9kYT
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/cli/test/remote-api-utils.test.ts

@@ -3,9 +3,13 @@ import { createApiClient, requireAuth } from '../src/utils/api-client';
 import { readAuthConfig, writeAuthConfig, deleteAuthConfig, getCredentialsPath } from '../src/utils/auth-config';
 import { formatOutput } from '../src/utils/output-formatter';
 import * as fs from 'node:fs/promises';
+import { makeDirectorySync } from '../src/utils/make-directory';
 
 // Mock fs module
 vi.mock('node:fs/promises');
+// The credentials directory is made through the CLI's bounded walk (#23858),
+// which is synchronous `node:fs`: mocked too, so this file writes nothing real.
+vi.mock('../src/utils/make-directory');
 
 describe('API Client Utilities', () => {
   describe('createApiClient', () => {
@@ -75,7 +79,7 @@ describe('Auth Config Utilities', () => {
 
   describe('writeAuthConfig', () => {
     it('should write credentials to file with correct permissions', async () => {
-      const mockMkdir = vi.mocked(fs.mkdir);
+      const mockMakeDirectory = vi.mocked(makeDirectorySync);
       const mockWriteFile = vi.mocked(fs.writeFile);
 
       const config = {
@@ -87,10 +91,7 @@ describe('Auth Config Utilities', () => {
 
       await writeAuthConfig(config);
 
-      expect(mockMkdir).toHaveBeenCalledWith(
-        expect.stringContaining('.objectstack'),
-        { recursive: true }
-      );
+      expect(mockMakeDirectory).toHaveBeenCalledWith(expect.stringContaining('.objectstack'));
 
       expect(mockWriteFile).toHaveBeenCalledWith(
         expect.stringContaining('credentials.json'),

packages/cli/test/validate-build-gate-parity.test.ts

@@ -347,6 +347,12 @@ const NOT_A_GATE: Readonly<Record<string, readonly string[]>> = {
     // build's warning count. It reads no stack and refuses nothing: every row
     // it selects is one `lowerCallables` produced.
     'isExtractionRefusal',
+    // [#23858] Makes the `--output` directory `os build` writes the artifact
+    // into — the bounded stand-in for the `fs.mkdirSync(…, { recursive: true })`
+    // that stood there (`fs` is classified below). It reads no stack and
+    // judges nothing; what it can refuse is a path the operating system
+    // refuses, with that system's own code.
+    'makeDirectorySync',
   ],
   // [commit 8b4890343] Reads a fact about the TOOLCHAIN, not about the input. The
   // ADR-0087 D4 `release` section is computed at publish time from the two