Two base-reds on release/v3.8.51 (#12581), both drained at the source.
1) check:openapi-security-tiers reported six CORRECTLY annotated routes as
unprotected and demanded the removal of their x-loopback-only annotation —
pushing the fix in the unsafe direction. The gate re-reads routeGuard.ts as
text (it cannot import the module: routeGuard pulls the server runtime and
the gate runs on plain node), but it only read the FIRST half of
isLocalOnlyPath():
LOCAL_ONLY_API_PREFIXES.some(...) || LOCAL_ONLY_API_PATTERNS.some(...)
so every route gated by a regex (/api/providers/volcengine-plan/connect/*)
or by an imported constant (VNC_ROUTE_PREFIX, which the text parse turned
into the literal string "VNC_ROUTE_PREFIX") looked open. Proven with
isLocalOnlyPath() at runtime: all six return true; the control
/api/providers/{id}/refresh stays false.
New scripts/check/routeGuardConstants.mjs reads BOTH arrays, resolves
imported identifiers by following the import, and THROWS on an unresolvable
token instead of silently degrading it into a literal. Its array scanner is
hand-rolled because regex literals carry the brackets and commas a
\[([^\]]+)\] capture plus a naive comma split break on ([^/] and {1,3}).
The reverse pass (missing-annotation warnings) now uses the same predicate.
2) check:file-size: four frozen files grew past their cap through merged PRs —
chat.ts +10 (#12427/#12503 video-transcript redaction, derived from the
post-guardrail payload at the single dispatch point) and stream.ts /
accountFallback.ts / codex.ts +17 total (#12179 hot-path regex hoisting,
bounded caches, quadratic-buffering fix). All cohesive at existing
chokepoints; rebaselined with the rationale recorded in the baseline file.
Refs #12581
c622709e46