From bc01caea10953148a3ecf1a1f3d6bd9764b2035a Mon Sep 17 00:00:00 2001
From: morluto <76467478+morluto@users.noreply.github.com>
Date: Wed, 11 Nov 2026 05:30:34 -0500
Subject: [PATCH] fix(ci): remove stale temporary limit exceptions

---
 scripts/verify/rea-numeric-limits.d.mts    |  6 +++++
 scripts/verify/rea-numeric-limits.mjs      | 26 ++++++++++++++++---
 tests/evaluation/numericLimitCheck.test.ts | 30 ++++++++++++++++++++++
 3 files changed, 58 insertions(+), 4 deletions(-)

diff --git a/scripts/verify/rea-numeric-limits.d.mts b/scripts/verify/rea-numeric-limits.d.mts
index 8febeb10d1..2d1ddf3696 100644
--- a/scripts/verify/rea-numeric-limits.d.mts
+++ b/scripts/verify/rea-numeric-limits.d.mts
@@ -11,6 +11,12 @@ export const REQUIRED_RUNTIME_LIMITS: readonly [
 /** True for a numeric `REA_` limit, including the documented endpoint-candidate count. */
 export function isNumericLimit(name: string): boolean;
 
+/** Detect stale or newly introduced temporary per-call exceptions. */
+export function perCallLimitFailures(
+  listed: ReadonlyMap<string, string>,
+  temporary: ReadonlySet<string>,
+): string[];
+
 /** Producer paths for numeric limits. Registry text, comments, and allowlists are omitted. */
 export function discoverNumericLimitUses(
   files: readonly { readonly path: string; readonly source: string }[],
diff --git a/scripts/verify/rea-numeric-limits.mjs b/scripts/verify/rea-numeric-limits.mjs
index f189bd0602..9b355c50d6 100644
--- a/scripts/verify/rea-numeric-limits.mjs
+++ b/scripts/verify/rea-numeric-limits.mjs
@@ -377,6 +377,22 @@ const TEMPORARY_PER_CALL_LIMITS = new Set([
   "REA_WINDOWS_CHANGE_TIME_SETTLE_POLL_MS",
 ]);
 
+/** Temporary exceptions must be removed from both the registry and allowlist. */
+export const perCallLimitFailures = (listed, temporary) => {
+  const failures = [];
+  for (const [name, policy] of listed)
+    if (policy === "per-call" && !temporary.has(name))
+      failures.push(
+        `${name} is a new per-call exception. Move it into ANALYSIS_SETTINGS instead of extending the temporary list.`,
+      );
+  for (const name of temporary)
+    if (listed.get(name) !== "per-call")
+      failures.push(
+        `${name} is no longer a temporary per-call exception; remove it from the allowlist`,
+      );
+  return failures;
+};
+
 const direct =
   process.argv[1] !== undefined &&
   import.meta.url === pathToFileURL(resolve(process.argv[1])).href;
@@ -401,10 +417,6 @@ if (direct) {
       failures.push(
         `${name} is both a runtime setting and on the exception list`,
       );
-    if (policy === "per-call" && !TEMPORARY_PER_CALL_LIMITS.has(name))
-      failures.push(
-        `${name} is a new per-call exception. Move it into ANALYSIS_SETTINGS instead of extending the temporary list.`,
-      );
     if (policy === "restart-only" && read === "per-call")
       failures.push(
         `${name} is restart-only but is recorded as a per-call read`,
@@ -416,6 +428,12 @@ if (direct) {
     )
       failures.push(`${name} is restart-only but is not read at startup`);
   }
+  failures.push(
+    ...perCallLimitFailures(
+      new Map([...listed].map(([name, entry]) => [name, entry.policy])),
+      TEMPORARY_PER_CALL_LIMITS,
+    ),
+  );
 
   const discovered = discoverNumericLimitUses(
     await Promise.all(
diff --git a/tests/evaluation/numericLimitCheck.test.ts b/tests/evaluation/numericLimitCheck.test.ts
index be43f5a408..1ba71c2518 100644
--- a/tests/evaluation/numericLimitCheck.test.ts
+++ b/tests/evaluation/numericLimitCheck.test.ts
@@ -3,11 +3,41 @@ import {
   NUMERIC_LIMIT_DECLARATION,
   discoverNumericLimitUses,
   isNumericLimit,
+  perCallLimitFailures,
   requiredRuntimeLimitFailure,
 } from "../../scripts/verify/rea-numeric-limits.mjs";
 
 const ENDPOINT_CANDIDATES = "REA_WEB_BUNDLE_ENDPOINT_LITERAL_CANDIDATES";
 
+it("requires the temporary per-call allowlist to match the registry", () => {
+  const temporary = new Set(["REA_OLD_TIMEOUT_MS"]);
+  expect(
+    perCallLimitFailures(
+      new Map([["REA_OLD_TIMEOUT_MS", "per-call"]]),
+      temporary,
+    ),
+  ).toEqual([]);
+  expect(perCallLimitFailures(new Map(), temporary)).toEqual([
+    expect.stringContaining(
+      "REA_OLD_TIMEOUT_MS is no longer a temporary per-call exception",
+    ),
+  ]);
+  expect(
+    perCallLimitFailures(
+      new Map([["REA_OLD_TIMEOUT_MS", "restart-only"]]),
+      temporary,
+    ),
+  ).toHaveLength(1);
+  expect(
+    perCallLimitFailures(
+      new Map([["REA_NEW_TIMEOUT_MS", "per-call"]]),
+      new Set(),
+    ),
+  ).toEqual([
+    expect.stringContaining("REA_NEW_TIMEOUT_MS is a new per-call exception"),
+  ]);
+});
+
 it("recognizes the documented endpoint-candidate limit as numeric", () => {
   expect(isNumericLimit(ENDPOINT_CANDIDATES)).toBe(true);
   const discovered = discoverNumericLimitUses([