rules                 | description
        EachBeanViaDirectRule | "direct rule"
        EachBeanViaRuleSource | "rule source"
    }

    def "#description is not applied to descendants accessible only via references"() {
        def mmType = ModelTypes.modelMap(Bean)

        registry.registerInstance("bean1", new Bean(name: "bean1 unmodified"))
        registry.registerInstance("beans", new Bean(name: "beans"))

	//
	// For a non-interface type T or *T, the returned Method's Type and Func
	// fields describe a function whose first argument is the receiver,
	// and only exported methods are accessible.
	//
	// For an interface type, the returned Method's Type field gives the
	// method signature, without a receiver, and the Func field is nil.
	//
	// Methods are sorted in lexicographic order.
	Method(int) Method

//
// PolicyTracker expects FakePolicyDefinition and FakePolicyBinding types
// !TODO: refactor this test/framework to remove startInformers argument and
// clean up the return args, and in general make it more accessible.
func setupTestCommon(
	t *testing.T,
	compiler *fakeCompiler,
	matcher generic.PolicyMatcher,
	shouldStartInformers bool,

This means, all dependencies, including Jars with module information, are put on the classpath.
The advantage is that all internal classes of your (or other) modules are then accessible directly in tests.
This may be a totally valid setup for unit testing, where we do not care about the larger module structure, but only about testing single functions.

[NOTE]
====

// This NetworkPolicyIngressRule matches traffic if and only if the traffic matches both ports AND from.
type NetworkPolicyIngressRule struct {
	// List of ports which should be made accessible on the pods selected for this rule.
	// Each item in this list is combined using a logical OR.
	// If this field is empty or missing, this rule matches all ports (traffic not restricted by port).

	// These tests check that, assuming the byte type also has valid decoding methods,
	// either the old base64 string encoding or the new per-element encoding can be
	// successfully unmarshaled. The custom unmarshalers were accessible in earlier
	// versions of Go, even though the custom marshaler was not.
	{
		CaseName: Name(""),
		in:       `"AQID"`,
		ptr:      new([]byteWithMarshalJSON),
		out:      []byteWithMarshalJSON{1, 2, 3},
	},

 * In previous Gradle versions, the `source` field in `SourceTask` was accessible from subclasses. This is not the case anymore as the `source` field is now declared as `private`.
 * In the Worker API, <<#rel5.0:worker_api, the working directory of a worker can no longer be set>>.

	// span has malloc headers.
	minSizeForMallocHeader = goarch.PtrSize * ptrBits
)

// heapBitsInSpan returns true if the size of an object implies its ptr/scalar
// data is stored at the end of the span, and is accessible via span.heapBits.
//
// Note: this works for both rounded-up sizes (span.elemsize) and unrounded
// type sizes because minSizeForMallocHeader is guaranteed to be at a size
// class boundary.
//
//go:nosplit

	serviceNoLocalEndpointsExternal sets.Set[string]
	// lbNoNodeAccessIPPortProtocolEntries represents the set of loadBalancers IP + Port + Protocol that should not be accessible from K8s nodes
	// We cannot directly restrict LB access from node using LoadBalancerSourceRanges, we need to install
	// additional iptables rules.
	// (ref: https://github.com/kubernetes/kubernetes/issues/119656)

	s.deletePod(t, "pod4")
	s.assertAddresses(t, "", "pod1", "pod2", "pod3", "svc1")
	s.assertAddresses(t, s.addrXdsName("10.0.0.1"), "pod1", "pod2", "svc1")
	s.assertAddresses(t, s.addrXdsName("127.0.0.4")) // Should not be accessible anymore
	s.assertAddresses(t, s.podXdsName("pod4"))
	s.assertEvent(t, s.podXdsName("pod4"))
	s.clearEvents()

	// Update Service to have a more restrictive label selector
	s.addService(t, "svc1",