[diegosouzapw]

Summary

Restore-green for a #4023 regression that turned the whole release CI red on every TIA full-suite run (it blocked every PR whose impact analysis touched provider validation — including the in-flight port PRs).

Root cause

#4023 (web-cookie + no-auth provider validation with AUTH_007) added ~22 providers to WEB_COOKIE_PROVIDERS and placed the generic validateWebCookieProvider routing at the top of validateProviderApiKey. That intercepted providers that already have dedicated, stricter validators and downgraded them to a generic 200 → valid session probe:

• qwen-web — the fix(qwen-web): cookie validation false-positive - check response body for user object #3958 user-object check (Qwen returns HTTP 200 even for invalid tokens)
• grok-web — the [BUG] Grok Web (Subscription) validation still fails on v3.8.16 (fill sso/sso-rw) #3474 IP-reputation / Cloudflare / anti-bot guidance
• chatgpt-web — accessToken / cf-mitigated detection
• … and the rest of the *-web family

41 tests in provider-validation-specialty.test.ts + qwen-web-cookie-validation-3958.test.ts failed as a result.

Fix

Move the generic web-cookie fallback below the SPECIALTY_VALIDATORS dispatch. A provider with a dedicated validator keeps its specific checks; the generic probe is the fallback only for web-cookie providers without one. This restores the pre-#4023 flow — and is provably safe because web-cookie providers already reached SPECIALTY_VALIDATORS (without openai/anthropic interception) before #4023 inserted the top-level generic block.

No test rewrites — all 41 specialty + 4 qwen-web-3958 tests pass unchanged. A focused guard (validation-web-cookie-prefer-specific-4023.test.ts) documents the dispatch preference.

Test plan

• provider-validation-specialty (112), qwen-web-cookie-validation-3958 (4), provider-validation-web-cookie-auth007 (generic), and the new guard — 122 pass / 0 fail (41 were failing before)
• npx eslint 0 errors · typecheck:core clean · check:any-budget:t11 PASS · check:route-validation:t06 PASS · check:file-size OK

Note

Also reconciles two pre-existing release/v3.8.32 file-size baselines whose frozen bumps did not ride along with their squash merges (pricing.ts OpenAI rows; executors/base.ts) — base drift, not changed by this PR, bumped so the merge clears check:file-size.

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[diegosouzapw]

Closing as a duplicate of #4460, which lands the same fix (move the generic web-cookie validation below the SPECIALTY_VALIDATORS dispatch so providers with a dedicated validator keep their specific checks) and is already green (Fast-QG pass, MERGEABLE/CLEAN). #4460 also reconciles the #4440/#4443 baselines. Deferring to it to avoid a conflicting parallel fix.