docs: clarify glob() exclude resolves like pattern

plugins/heph-expert/skills/heph/references/authoring.md

@@ -69,6 +69,11 @@ Both resolve to filesystem (`//@heph/fs:…`) addresses, so their results drop
 straight into a dependency field. Paths are relative to the BUILD file's
 package by default; pass `abs=True` to resolve from the workspace root.
 
+For `glob()`, `exclude` resolves exactly like `pattern` — package-relative by
+default, workspace-root-relative under `abs=True`. A package-relative
+`exclude=["vendor/**"]` in `//pkg` excludes `pkg/vendor/**`, not a root-level
+`vendor/**`; add `abs=True` to exclude from the workspace root instead.
+
 ```python title="BUILD"
 target(
     name = "lib",

website/docs/plugins/buildfile.md

@@ -156,6 +156,12 @@ normalized — `./` prefixes and empty segments are collapsed, `..` components
 resolve against the package path, and a path whose `..` segments escape the
 workspace root is an error.
 
+For `glob()`, `exclude` resolves exactly like `pattern` — package-relative by
+default, workspace-root-relative under `abs = True`. A package-relative
+`exclude = ["vendor/**"]` in `//pkg` excludes `pkg/vendor/**`, not a
+root-level `vendor/**`; write `exclude = ["vendor/**"], abs = True` to exclude
+from the workspace root instead.
+
 ### `target()` — what buildfile reads, and what it forwards
 
 `target()` interprets only the fields that describe the target to the engine —