fix(merge): survive a lapsed Anthropic bill — the outage's three dominoes #5615

Root cause of today's merge outage, located in the server log (owner-authorised SSH) after five guarded seams were each verified not to be the cause.

The three dominoes

1. A PR's diff contained the security scanner's own test fixtures — an eval call on user input as a rule input, credential-shaped strings proving detectors fire — marked with gluecron:allow-secret, the route the push gate's own rejection message instructs.

2. The push gate honoured the pragma; the merge-time gate did not. scanForSecrets carried a drifted copy of the placeholder list missing exactly that alternation, and staticSecurityScan honoured no marker at all. The gate marked the checks failed. Both lists are now one module (secret-placeholders.ts) — a comment asserting single-sourcing is not single-sourcing; the GateTest engine found its own placeholder list duplicated under exactly such a comment the same day, diverged on the i flag.

   staticSecurityScan honours only the explicit pragma, not the broad placeholder words: these are injection rules, and "example"/"fake" appear in real code — skipping on them would quietly blind the gate.

3. Failed checks armed auto-repair, and all three repair tiers were try { …messages.create(…) } finally { cleanup } — no catch. The Anthropic 400 cleaned up the worktree and rethrew through runAllGateChecks → performGatedMerge → top-level handler: REST 500, MCP raw "credit balance too low", every merge on the platform blocked. All three now catch and return a failed RepairResult — the check stays failed and the merge is refused with a reason, the same honest state as repair disabled. Never a green check the repair didn't earn; never a 500.

Why the by-hand audit couldn't find it

The throwing call only runs when the gate has already found something to repair, and the audit was performed on the model of a clean PR. Every sibling AI seam degraded correctly — verified one by one during the outage.

Pre-flighted against the deployed gate

The regression suite's fixtures are assembled at runtime, and the whole diff was run through main's own scanners before pushing. The first draft's comments — prose describing the eval fixture — tripped the old gate's code-execution rule in two places. A fix for this outage whose own diff re-armed it would be the outage with better documentation. After rewording: 0 findings from both old scanners, which is what should make this PR mergeable with the balance still at zero.

Verification

• 6 regression tests pinning all three dominoes, with a positive control (removing one catch fails the structural test; restoring passes).
• Full CI-safe suite: 5,377 pass, 11 fail — identical to baseline.
• The merge of this PR is itself the live test: if it lands with the balance at zero, the invariant — "we shouldn't need credit balance to ship a product" — holds again.