[Security] A wrapper around an internal seam is published without any gate noticing #1630

tests/unit/ExportSurface.test.ts pins the internal seams no barrel re-exports — the node:zlib kill switch setNativeZstdDecompressCandidatesOverride (#580) among them — and since the repair in this wave it sees through aliases and through any depth of export * as. It compares bindings. It cannot see a seam published as an effect, and both shapes were measured on the root barrel of the current tree:

// a function wrapper
export function forceZstdCandidates(candidates: readonly string[]): void {
  setNativeZstdDecompressCandidatesOverride(candidates);
}

// an object wrapper — worse, because spreading a namespace copies references,
// so what ships is the identical binding under a different property
export const compressionInternals = { ...compression };

Both leave ExportSurface.test.ts at 30 pass / 0 fail.

This is not a live defect — no such wrapper exists — but the guard's own documentation claims the seams are unreachable, and that claim is what a reviewer relies on when a new export is added. A guard that compares reachability of values rather than of names would close it; so would a narrower rule that refuses any export whose body mentions a pinned seam.