Summary

This PR retunes the next batch of CodeGuard precision false positives from TypeScript/JavaScript API and integration code. The goal is to keep the production-readiness checks useful while avoiding noisy findings for patterns that are already bounded, typed, or intentionally surfaced to callers.

What changed

• Retuned defensive.integer-overflow.

  • Stops treating count + 1 external ID allocation as numeric overflow.
  • Skips seed/script paths and date/count formatting arithmetic.
  • Keeps actual unsafe size arithmetic covered.

• Refined defensive.sequence-collision-risk.

  • count + 1 external ID allocation is now reported under sequence-collision risk instead of integer overflow.
  • Bounded Prisma P2002 / unique-collision retry is treated as mitigation, not full resolution.
  • Retry-mitigated cases emit a lower-confidence architectural-debt warning recommending a database sequence, UUID, or transactional allocator.

• Retuned defensive.bounds-assumption.

  • Narrows the rule to sequence-like indexing.
  • Avoids dictionary/object/env access such as fieldMap[name] and process.env[name].

• Retuned defensive.missing-resource-limit.

  • Credits Prisma take.
  • Credits bounded constants and pre-formData() content-length helper guards.
  • Keeps truly unbounded request/form reads covered.

• Retuned function.inconsistent-return-contract.

  • Allows parser, lookup, read, resolve, and extraction helpers with explicit nullable contracts such as T | null.
  • Allows exists() true/false contracts.
  • Corrects return false so it is no longer treated as an empty return.

• Retuned error.partial-failure-hidden.

  • Allows digest/fetch loops that append diagnostics/errors/failures and return those diagnostics to callers.
  • Keeps silent catch/continue paths covered.

• Updated user-facing metadata.

  • Updated rule catalog, fix-template guidance, and docs/checks.md for the retry-mitigated sequence-debt behavior.

Tests

• Added regression coverage for retry-wrapped external ID allocation.
• Added regression coverage for seed/script and date bucket arithmetic.
• Added regression coverage for dictionary/env indexing vs array indexing.
• Added regression coverage for Prisma take and pre-formData() content-length helper guards.
• Added regression coverage for nullable parser/lookup/exists return contracts.
• Added regression coverage for surfaced diagnostics vs hidden partial failures.

Validation

• Focused regression tests
• go test ./tests/checks -count=1
• go test ./...
• golangci-lint run
• make codeguard-ci