serveapi external-module fixture: root derivation breaks under -trimpath, and the fixture's go directive is a hardcoded literal

[sunholo-voight-kampff]

Found by the sonnet evaluator during mission iteration 139 (#498 Lane B M1, PR #585) as NB-2/NB-3, and reproduced first-party by the controller before filing. Both are latent — neither affects CI today — so this is a follow-up, not a blocker.

serveapi/serveapi_external_test.go builds a real external Go module in a temp dir to prove two opposite-signed things: that github.com/sunholo-data/ailang/serveapi is importable from outside the module, and that internal/apiserver is not. Good test. Two fragilities in how it locates the repo:

1. runtime.Caller(0) returns a module-relative path under -trimpath

$ go test -trimpath -count=1 -run TestExternalModuleCanImportFacadeButNotInternal ./serveapi
--- FAIL: TestExternalModuleCanImportFacadeButNotInternal (0.00s)
    serveapi_external_test.go:97: open github.com/sunholo-data/ailang/go.sum: no such file or directory
FAIL

Control, same test without the flag: rc=0.

The test derives its module root from runtime.Caller(0), which -trimpath rewrites to a module-relative path, so both the replace target and the go.sum copy point at a path that does not exist.

Current impact: zero. This repo passes -trimpath in 0 places (grep -rn trimpath .github/workflows/ make/ Makefile → 0; control: 14 go test occurrences in the same paths, so the instrument sees positives). It becomes a real red only if reproducible-build flags are ever added to the test invocation — at which point it fails with an error that looks nothing like its cause.

Fix shape: derive the root from os.Getwd() (the package dir under go test) rather than the compile-time source path.

2. The fixture's go directive is a hardcoded go 1.26.5

The generated go.mod pins go 1.26.5 as a literal. It matches the repo's go.mod and all 10 CI go-version pins today, which is why it works. When the module's Go version is next bumped, this test fails with a toolchain error rather than anything resembling an import problem — the exact failure mode the sprint plan's §0.9 already warns about for the other direction.

Fix shape: read the go directive out of the repo's own go.mod when generating the fixture, so the two cannot drift.

Not included

The evaluator also raised NB-4 (the concurrency test asserts a hardcoded overloads == 36, coupled to MaxConcurrentCallbacks: 4). Measured stable 10/10 runs; noted here only so it is not re-discovered as new.

Filed by the V1 mission loop, iteration 139.

🤖 Generated with Claude Code