fix(ci): re-green release/v3.8.43 fast-gates — db-rules stale allowlist + 4 more base-reds (#5798)

[diegosouzapw]

Clears the actionable HARD failures tracked in #5798 (does NOT close the tracker — the ar/CHANGELOG i18n body-size drift stays captain-owned at release). As of 2026-07-02 every quality.yml fast-gates run on PR→release was failing on inherited base-reds; this PR re-greens the queue.

Base-reds cleared (all verified base-red on the pristine tip 0d3875a98 first)

1. check:db-rules — stale allowlist entry. fix(db): allowlist modelContextOverrides as intentionally-internal (#5798 release-green) #5827 allowlisted modelContextOverrides as intentionally-internal while the Release v3.8.43 #5609 fix (66c5b718c) re-exported it from localDb.ts; with the re-export in place the entry suppressed nothing and the stale-enforcement (Fase 6A.3) failed the gate. The re-export stays (documented convention, CLAUDE.md "Adding a New DB Module" step 4); the obsolete entry is removed and tests/unit/check-db-rules-classification.test.ts re-pinned to 33 modules (TDD: test updated first → failed → gate fixed → 5/5 + exit 0).
2. check:docs-all (env/docs contract). LIVE_WS_ALLOWED_HOSTS + NEXT_PUBLIC_LIVE_WS_PUBLIC_URL (from feat: add NEXT_PUBLIC_LIVE_WS_PUBLIC_URL for custom domain WebSocket support #5877/feat: add NEXT_PUBLIC_LIVE_WS_PUBLIC_URL for custom domain WebSocket support #5878) were in .env.example but missing from docs/reference/ENVIRONMENT.md — documented both.
3. check:fabricated-docs --strict. The Router Backends ADR (docs(architecture): Router Backends & Embedded Services ADR (#5603) #5891) references src/domain/routing/routerBackends.ts and ROUTER_BACKENDS, which land with the still-open PR [codex] Add router backend registry #5868 — the doc now marks them as landing-with-[codex] Add router backend registry #5868 and the registry constant is allowlisted with justification (established JS-identifier pattern).
4. check:mutation-test-coverage. antigravity-429-quota-tdd.test.ts + middleware-header-strip-5849.test.ts added to stryker tap.testFiles (+2 lines).
5. Ratchets (file-size / complexity / cognitive-complexity). Rebaselined with dated justification notes, the documented last-resort path: every raised value was measured identical on the pristine release tip and this PR's HEAD (this PR touches no production logic — gate scripts, docs, baselines, one test file). file-size: 13 prod + 4 test files frozen at current sizes; complexity 1982→1995; cognitive 845→856.

Validation

• All fast-gates steps re-run locally in this worktree: check:docs-all, check:db-rules, check:file-size, check:mutation-test-coverage, check:complexity, check:cognitive-complexity, check:deps, check:fetch-targets, check:docs-symbols, check:openapi-routes, check:known-symbols, check:build-scope, check:pack-policy, check:any-budget:t11, check:error-helper, check:migration-numbering, check:public-creds, check:route-guard-membership, check:test-discovery, check:test-runner-api → all exit 0.
• tests/unit/check-db-rules-classification.test.ts → 5/5.
• Nightly-cited failures re-verified green on the tip: tests/unit/access-token-scopes.test.ts (6/6), tests/integration/all-statuses-route.test.ts (8/8).

Update — 6th base-red unmasked and fixed

6. typecheck:core. Two TS2322 errors in open-sse/executors/base.ts (from the refactor(executors): deduplicate shared utilities and add comprehensive tests #5720 dedup refactor), masked until now because the fast-gates chain failed earlier: resolveBaseUrl returned unknown-typed providerSpecificData.baseUrl (now typeof === "string" coercion, same pattern as DefaultExecutor), and resolveEffectiveKey could return undefined when credentials.apiKey was absent (now ?? "" — behavior-safe: both consumers gate on truthiness). Verified base-red: identical errors on the pristine tip. Validation: typecheck:core exit 0; tests/unit/executor-base-utils.test.ts + executor-default-base.test.ts → 71/71.

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[diegosouzapw]

Merge note — remaining unit-shard reds are pre-existing base-reds, not from this PR.

All 20+ Fast Quality Gates steps + typecheck + dast-smoke (full next build) now pass on this PR — the only failing step is the unit-test one, and every failure reproduces identically on the pristine release tip (verified locally file-by-file):

File	tip result
tests/unit/opencode-executor.test.ts	44 pass / 9 fail (User-Agent/x-opencode-client leakage)
tests/unit/active-request-stream-chunks-lifecycle.test.ts	8/1
tests/unit/catalog-updates-v3x.test.ts	8/1 (Kiro pricing row)
tests/unit/chatcore-sanitization.test.ts	14/1
tests/unit/claude-code-rendering-fixes.test.ts	5/1
tests/unit/cli/setup-claude.test.ts	5/1 (opencode-plugin dist not built)

These came in via yesterday's admin-merged burst while the fast-gates queue was base-red (each earlier red masked the next — this PR unmasked and fixed 7 layers: db-rules, env-docs, fabricated-docs, mutation-cov, ratchets, typecheck:core, MDX frontmatter/build). The 6 unit base-reds are queued for a dedicated follow-up sweep (they need per-file root-cause diagnosis — a red test can be a masked production bug, not a stale test).

Merging with admin to unblock the whole PR→release queue; #5798 stays open tracking the unit sweep.