feat(quality): 6A.1+6A.2 — test-discovery gate, 135 orphan tests re-wired, 2 production bug fixes, vitest in CI (#3536)

check-test-discovery gate (TDD; 195 orphans found, 135 re-wired into the node runner, 60 frozen+annotated). Triage fixed 2 real production bugs: missing BYPASS_PREFIX_NOT_ALLOWED zod refine (spawn-capable prefixes accepted into the bypass list, Hard Rules #15/#17) and resetDbInstance not firing stateReset resetters (stale schema memo → 503 instead of 403; also hit backup-restore). New test-vitest CI job: test:vitest blocking (146/146), test:vitest:ui informational (14 pre-existing fails, triage 2026-06-16).

src/lib/db/core.ts

@@ -16,6 +16,7 @@ import fs from "fs";
 import { resolveDataDir, getLegacyDotDataDir } from "../dataPaths";
 import { runMigrations } from "./migrationRunner";
 import { runDbHealthCheck } from "./healthCheck";
+import { resetAllDbModuleState } from "./stateReset";
 import { parseStoredPayload } from "../logPayloads";
 import {
   buildArtifactRelativePath,
@@ -1463,6 +1464,12 @@ export function closeDbInstance(options?: { checkpointMode?: CheckpointMode | nu
       if (db.open) db.close();
     } finally {
       setDb(null);
+      // Module-level caches (prepared statements, schema-check memos — e.g.
+      // apiKeys.ts) are bound to the closed connection. Without this, a recreated
+      // DB (tests, backup restore of an older snapshot) hits "no such column"
+      // on the stale re-prepare path. backup.ts already does this on restore;
+      // close/reset must too (found by the 6A.1 orphan-test re-wire, 2026-06-09).
+      resetAllDbModuleState();
     }
   }
 

src/shared/validation/settingsSchemas.ts

@@ -11,6 +11,7 @@ import { MAX_REQUEST_BODY_LIMIT_MB, MIN_REQUEST_BODY_LIMIT_MB } from "@/shared/c
 import { HIDEABLE_SIDEBAR_ITEM_IDS, SIDEBAR_SECTIONS } from "@/shared/constants/sidebarVisibility";
 import { ACCOUNT_FALLBACK_STRATEGY_VALUES } from "@/shared/constants/routingStrategies";
 import { RESPONSES_PREVIOUS_RESPONSE_ID_MODES } from "@/shared/constants/responsesPreviousResponseId";
+import { SPAWN_CAPABLE_PREFIXES } from "@/server/authz/routeGuard";
 
 const signatureCacheModeValues = ["enabled", "bypass", "bypass-strict"] as const;
 
@@ -42,7 +43,30 @@ export const updateSettingsSchema = z.object({
   showProviderTopologyOnHome: z.boolean().optional(),
   showTokenSaverOnEndpoint: z.boolean().optional(),
   localOnlyManageScopeBypassEnabled: z.boolean().optional(),
-  localOnlyManageScopeBypassPrefixes: z.array(z.string().max(200)).optional(),
+  // Layer 1 of the spawn-capable guard (Hard Rules #15/#17): reject any bypass
+  // prefix that reaches a SPAWN_CAPABLE_PREFIXES path at PATCH time, with the
+  // BYPASS_PREFIX_NOT_ALLOWED code the settings route handler translates.
+  // Layer 2 (isLocalOnlyBypassableByManageScope) still refuses spawn paths at
+  // runtime even if a malformed DB row claims otherwise. This refine was in the
+  // routeGuard.ts contract docs but missing from the live schema — restored by
+  // the 6A.1 orphan-test re-wire (AC-8 / AC-10c, 2026-06-09).
+  localOnlyManageScopeBypassPrefixes: z
+    .array(
+      z
+        .string()
+        .max(200)
+        .refine(
+          (prefix) => {
+            const normalized = prefix.endsWith("/") ? prefix : `${prefix}/`;
+            return !SPAWN_CAPABLE_PREFIXES.some((sp) => normalized.startsWith(sp));
+          },
+          {
+            message:
+              "BYPASS_PREFIX_NOT_ALLOWED: spawn-capable prefixes cannot be added to the manage-scope bypass list",
+          }
+        )
+    )
+    .optional(),
   customBannedSignals: z.array(z.string().max(200)).optional(),
   debugMode: z.boolean().optional(),
   hiddenSidebarItems: z.array(z.enum(HIDEABLE_SIDEBAR_ITEM_IDS)).optional(),