01 · Before and afterThe pattern
// before: passes forever: nothing to exclude, key omitted when empty
const pkg = await promote(project);
expect(pkg.manifest.agents).toBeUndefined();
// after: seed the thing that must stay out, then look at what was actually written
await agents.save({ id: 'a1', projectId: project.id, ... });
const pkg = await promote(project);
expect(await readEntities(pkg.dir, 'agent.json')).toEqual([]);02 · Run it on your appThe check
For each “must never include / never leak” test in your suite, does the test first create the thing that must not appear?
If the honest answer is no or not sure, this is worth a look before it reaches production.