[magnum8237]

npm run build fails on the release/v3.8.53 tip. A clean checkout of the branch
cannot produce a production build, which also makes tests/unit/client-bundle-no-server-only-10692.test.ts
fail — one of the unit-shard failures reported on the base.

1. A client bundle reaches src/lib/db/core.ts (5 webpack errors, one root cause)

ProviderDetailPageClient.tsx
  → src/lib/providers/mergeProviderModelListing.ts
  → src/lib/providerModels/cursorAutoCatalog.ts
  → open-sse/utils/cursorAgentProtobuf/grok47MaxEffort.ts   ← the broken edge
  → src/shared/utils/featureFlags.ts
  → src/lib/db/featureFlags.ts
  → src/lib/db/core.ts

The browser chunk then has to resolve fs, child_process and module:

./open-sse/config/credentialLoader.ts          Module not found: Can't resolve 'fs'
./open-sse/services/qoderCli.ts                Module not found: Can't resolve 'fs'
./node_modules/detect-libc/lib/filesystem.js   Module not found: Can't resolve 'fs'
./open-sse/executors/codex.ts                  Module not found: Can't resolve 'module'
./node_modules/detect-libc/lib/detect-libc.js  Module not found: Can't resolve 'child_process'

grok47MaxEffort.ts (added in #17386) statically imports @/shared/utils/featureFlags.
That is exactly what the #10692 bridge exists to prevent — featureFlagResolverBridge.ts
states the invariant in its own header: client-reachable modules "must never statically
import @/shared/utils/featureFlags — that module reads the SQLite override table through
@/lib/db/core".

The fix routes the flag through that bridge, the same way open-sse/config/imageRegistry.ts
already does. Behavior is unchanged on the server: featureFlags.ts registers
isFeatureFlagEnabled as the resolver (and @/lib/db/core loads it), so DB override > env >
default still applies. In a client bundle the bridge falls back to the env var alone, which
yields this flag's documented false default — the same value its previous catch returned.

2. Two docs pages have no frontmatter

docs/providers/GITHUB-COPILOT.md (#12833) and docs/providers/grok-cli-media.md (#15305)
ship without a title, so the fumadocs-mdx collection rejects them and the build stops before
reaching the errors above:

Error: [MDX] invalid frontmatter in docs/providers/GITHUB-COPILOT.md:
- title: Invalid input: expected string, received undefined

A scan of docs/**/*.md confirms these two are the only ones.

3. The guard's SERVER_ONLY pin never matched on Windows

resolveSpecifier() and walk() returned path.relative() output, which uses \ on Windows,
while every literal in the file (SERVER_ONLY, EXTRA_ENTRIES, the resolver assertions) is
written with /. So SERVER_ONLY.has(file) silently never matched there and the pinned #10692
chain was unguarded — and the dynamic import specifiers test failed on Windows for the same
reason. Both paths now normalize through one helper.

4. The build dirties 67 tracked files on Windows

npm run build regenerates src/i18n/global-error-messages/*.json through
scripts/i18n/generate-global-error-messages.mjs, which writes plain \n. With
core.autocrlf=true git expects CRLF in the working tree, so all 67 files show as modified
after every build with zero lines changed (blobs are byte-identical). The .gitattributes
entry follows the *.sh text eol=lf precedent already in that file.

Validation

Hard Rule #18 — failing-then-passing test. tests/unit/client-bundle-no-server-only-10692.test.ts
on the base tip, before any change:

✖ no client entry point statically reaches server-only code
    ProviderDetailPageClient.tsx → mergeProviderModelListing.ts → cursorAutoCatalog.ts
      → grok47MaxEffort.ts → featureFlags.ts → db/featureFlags.ts → db/core.ts
  (also CompatibleModelsSection.tsx, PassthroughModelsSection.tsx, ProviderModelsSection.tsx)

After the change: 4/4 pass. The flag's own coverage is also green —
cursor-grok-47-context-17386.test.ts, cursor-grok-effort-aliases.test.ts and
feature-flag-resolver-bridge.test.ts: 12/12, including "loading featureFlags registers the
DB-aware resolver (DB override wins over env)".

Also verified end to end outside CI: npm run build completes on this branch and the resulting
production server answers /api/monitoring/health with {"status":"healthy","setupComplete":true}.

⚠️ base-red inherited: #17219