fix(formula): spy the WARN sink through globalThis, and correct the flip docblock (#6132)

Two follow-ups from running the gate list:

  - `check:type-check-debt` went red: `@objectstack/formula`'s TEST_DEBT ledger
    records 17 raw tsc errors and the new suite made it 18. The added error was
    `TS2584: Cannot find name 'console'` — this package compiles with neither the
    DOM lib nor `@types/node`, which is why the compiler itself reaches the sink
    through `globalThis`. The test now spies on the same object the compiler
    writes to, rather than a differently-obtained one, which is also the only
    version of this spy that cannot go green over a silent sink. Back to 17.
  - The switch docblock named three test files that do not exist (the suites were
    consolidated into one). It now names the real file and states the flip's
    measured blast radius: 10 tests, all in that file, and nothing else.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Bx3H8DJhBsmgDoMp8Tz87T

Author: claude

packages/formula/src/cel-pushdown-limits.ts

@@ -42,12 +42,15 @@
  * export const CEL_PUSHDOWN_LIMITS_MODE: CelPushdownLimitsMode = 'fail-closed';
  * ```
  *
- * Two tests are written to go red on that line so the flip cannot be a silent
- * one: `cel-pushdown-limits.test.ts` pins the shipped default, and
- * `cel-to-filter-limits.rc-grace.test.ts` pins the grace-window behaviour. Both
- * name this file in their failure text; flipping the const means updating them
- * to the GA expectation, which is already written out in
- * `cel-to-filter-limits.ga.test.ts` and exercised there today.
+ * `cel-to-filter-limits.test.ts` is written to go red on that line so the flip
+ * cannot be a silent one, and its blast radius is known: flipping the const
+ * fails exactly that file's "the shipped default is the rc grace window"
+ * assertion and its `switch = rc-grace` block — 10 tests, measured — and
+ * nothing else in the repo. The GA expectation they become is already written
+ * out and passing in the same file's `switch = fail-closed` block, and on the
+ * RLS path in `plugin-security`'s `rls-pushdown-limits.test.ts`. So the flip is:
+ * this one const, that one default assertion, and deleting the grace block
+ * whose behaviour has ended.
  *
  * Nothing else needs to move at GA. In particular `@objectstack/lint`'s two
  * enforceability gates need no edit: `validateRlsPredicateEnforceability` reads

packages/formula/src/cel-to-filter-limits.test.ts

@@ -59,11 +59,22 @@ const AT_LIMIT = [
   },
 ];
 
+/**
+ * The WARN's sink, reached the same way the compiler reaches it: through
+ * `globalThis`. `@objectstack/formula` compiles with neither the DOM lib nor
+ * `@types/node`, so the bare `console` global has no type in this package — and
+ * spying on a differently-obtained object than the one under test would be a
+ * green test over a silent sink.
+ */
+const maybeConsole = (globalThis as { console?: { warn: (message: string) => void } }).console;
+if (!maybeConsole) throw new Error('this suite spies on the WARN sink and needs a host console');
+const hostConsole = maybeConsole;
+
 let warn: ReturnType<typeof vi.spyOn>;
 
 beforeEach(() => {
   __resetPushdownLimitWarnings();
-  warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+  warn = vi.spyOn(hostConsole, 'warn').mockImplementation(() => {});
 });
 
 afterEach(() => {