fix: preserve route limits and harden restore marker

scripts/release-gate-smoke.ts

@@ -87,6 +87,8 @@ try {
   });
   await waitForServer(liveBase, liveRelease);
   const cookie = { cookie: 'eve_session=synthetic-session' };
+  const liveRoot = await fetch(liveBase, { headers: cookie });
+  await assertStatus(liveRoot, 200, 'authenticated fully-disabled root');
   const liveChat = await fetch(`${liveBase}/api/chat`, { method: 'POST', headers: { ...headers, origin: liveBase, ...cookie }, body: JSON.stringify({ message: '/value', requestId: crypto.randomUUID() }) });
   await assertStatus(liveChat, 503, 'authenticated chat gate');
   const liveSync = await fetch(`${liveBase}/api/sync`, { method: 'POST', headers: { origin: liveBase, ...cookie } });

scripts/smoke-restore-marker.ts

@@ -1,14 +1,24 @@
 import assert from 'node:assert/strict';
 import { ConvexStore } from '../src/lib/server/store';
 import { hashSecret } from '../src/lib/server/security';
+import {
+  parseRestoreMarkerPhase,
+  validateRestoreMarkerTarget,
+  validateRestoreMarkerWrite,
+} from '../src/lib/server/restore-marker';
 
-if (process.env.SMOKE_ALLOW_WRITE !== '1') throw new Error('Set SMOKE_ALLOW_WRITE=1 only for a disposable backend');
 const marker = process.env.RESTORE_MARKER;
-const phase = process.env.RESTORE_MARKER_PHASE ?? 'write';
+const phase = parseRestoreMarkerPhase(process.env.RESTORE_MARKER_PHASE);
+const target = validateRestoreMarkerTarget(process.env.CONVEX_SELF_HOSTED_URL);
+validateRestoreMarkerWrite({
+  phase,
+  allowWrite: process.env.SMOKE_ALLOW_WRITE,
+  confirmation: process.env.RESTORE_MARKER_CONFIRMATION,
+});
 const characterId = Number(process.env.RESTORE_MARKER_CHARACTER_ID ?? '998000001');
 if (!marker || !/^[A-Za-z0-9._-]{8,100}$/.test(marker)) throw new Error('RESTORE_MARKER must be a synthetic 8–100 character identifier');
 if (!Number.isSafeInteger(characterId) || characterId < 90_000_000) throw new Error('RESTORE_MARKER_CHARACTER_ID must be a synthetic safe integer');
-const store = new ConvexStore(process.env.CONVEX_SELF_HOSTED_URL!, process.env.CONVEX_BRIDGE_SECRET!);
+const store = new ConvexStore(target.toString(), process.env.CONVEX_BRIDGE_SECRET!);
 const sessionHash = hashSecret(`restore-marker-session:${marker}`);
 const ownerHash = hashSecret(`restore-marker-owner:${marker}`);