fix(review): resolve findings from /review-reviews battery (v3.8.21 hardening)

[diegosouzapw]

Pre-release hardening from the /review-reviews multi-reviewer battery (7 Opus reviewers at max effort) over release/v3.8.21 vs main. Zero blocker / zero high — these are the confirmed medium/low/nit findings, each fixed under the Hard Rule #18 validation gate (TDD or live verification).

Resolved (LEDGER ids)

id	Sev	Fix
L1	med	npm tarball no longer ships co-located test files — files[] negations (!**/__tests__/**, !**/*.test.*, !**/*.spec.*; 1615→1573 files, 42 test files dropped) + reconciled .npmignore; the #3578 closure gate now asserts the real npm pack --dry-run output in both directions (closure present + zero test files).
L2	med	getSanitizedCachedProviderLimitsMap scopes its connection scan to antigravity/agy (skips it for an empty cache) instead of decrypting every active connection on each dashboard poll. Output proven identical.
L3	med	DB-seeded regression pinning the Antigravity usage_history fallback model-id join (quotaSource flips to localUsageHistory).
L4	low	gemini→openai: a signed native functionCall arriving while a textual <thinking> wrapper is still buffered now flushes that reasoning to reasoning_content before the tool call instead of dropping it (+ convergence follow-up: clear the partial open-tag fragment too).
L5	low	toClientAntigravityQuotaModelId centralized in antigravityModelAliases.ts (was an inline if-ladder in usage.ts), documenting the dual meaning of gemini-3.5-flash-low in the upstream quota namespace.
L6	low	checkIdempotencyCache returns { hit, idempotencyKey } so the Phase 9.2 save site reuses a single key derivation; new tests pin sanitizeChatRequestBody + the idempotency check at the chatCore extraction seam.
L7	low	test: the unclosed-reasoning-tag heuristic preserves a real visible prefix and does not capture <thoughtful>-style non-tags.
L8	low	/v1/completions SSE branch drops a stale upstream content-length after rewrite (the JSON branch already did).
L9	low	test: the Antigravity SSE markdown extraction branch (exported processAntigravitySSEPayload @internal).
L10	low	dropped 4 vacuous *ConfigId asserts (fields the executor never sets) for a real request.contents assert.
L11	nit	upstream-ca/test "no-persist" test now asserts the persisted CA-path file is never written (was tautological).
L12/L13	nit	trailing newline in semanticCache.ts; stray blank line in usageHistory.ts.
L15	low	test: a partial textual tool call survives a reasoning-only chunk interruption.

Acknowledged / WONTFIX

• L14 (agy live-verify): probed retrieveUserQuota with a real agy consumer token — the non-daily cloudcode-pa host accepts it (429 RESOURCE_EXHAUSTED = authenticated rate-limit, identical on daily-*), so fix(usage): normalize Antigravity and agy provider quotas #3604 is not agy-host-limited. No code change. (Confirmed by the convergence reviewer: retrieveUserQuota also fails-open to the catalog/local fallback on any non-2xx.)
• L16–L20: seed-on-GET (intentional [Bug] Gamification badges unlock repeatedly on every request instead of once #3472), parameterized service-layer SQL (Rule fix(oauth): prevent duplicate connections on re-authentication #5 targets routes), upstream-ca/test arbitrary path (loopback LOCAL_ONLY-gated), fetcher.ts dual-stack (pre-existing), guardrails/test Zod verbosity (cosmetic) — justified in the review ledger.

Validation

• lint 0 errors · typecheck:core clean · test:vitest 146/146 · build ✓ (525 pages)
• test:unit: the pre-existing cycle drift (3× chatcore-translation-paths [BUG] Valid max_tokens-truncated response misclassified as "empty content" → fake 502 #3572 + 6 others) is identical at baseline 797de433f — this work adds zero new failures; all new/changed suites green.
• Convergence re-review (3 Opus reviewers over the fix diff): 0 masking tests, L2/L5/L6 equivalences proven, RISK1 (files[] negation) & RISK2 (idempotency scope) safe, L14 WONTFIX justified; 1 low finding (partial open-tag buffer) fixed in commit 3.

🤖 Generated with Claude Code

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (14 files)

• .npmignore — reconciled with package.json files[] negations
• CHANGELOG.md — updated release notes
• open-sse/config/antigravityModelAliases.ts — centralized quota-bucket remap
• open-sse/executors/antigravity.ts — exported for unit tests
• open-sse/handlers/chatCore.ts — removed redundant idempotency key derivation
• open-sse/handlers/chatCore/idempotency.ts — returns idempotencyKey alongside hit
• open-sse/handlers/chatCore/semanticCache.ts — trailing newline fix
• open-sse/services/usage.ts — removed duplicated quota remap
• open-sse/translator/response/gemini-to-openai.ts — flush buffered reasoning before tool calls
• package.json — added test-file exclusion negations
• src/app/api/v1/completions/contentCompletionTransform.ts — drops stale content-length
• src/lib/usage/providerLimits.ts — scope connection scan to antigravity/agy only
• tests/unit/antigravity-local-usage-fallback-3821.test.ts — new
• tests/unit/antigravity-model-aliases.test.ts — new test for quota remap
• tests/unit/chatcore-extracted-modules-3821.test.ts — new
• tests/unit/completions-text-format-3571.test.ts — new content-length tests
• tests/unit/executor-agy.test.ts — new markdown-extraction tests
• tests/unit/mcp-published-files-closure-3578.test.ts — new dual-direction npm pack gate
• tests/unit/provider-limits-sanitize-scope-3821.test.ts — new
• tests/unit/response-sanitizer.test.ts — new reasoning-prefix tests
• tests/unit/translator-resp-gemini-to-openai.test.ts — new flush-before-toolcall tests

---

_{Reviewed by step-3.7-flash-20260528 · 1,105,670 tokens}