Test the escape hatch,
not just the happy path.

Start with an observable rule.

I wanted thumbnails to be smaller, but file size was not the whole requirement. A public image response must not expose the original photo’s location metadata, even when someone requests an old URL without resize parameters.

That is a better acceptance criterion than “optimize Photos.” It describes what must remain true when the UI is bypassed.

Put the boundary on the server.

The gallery now requests resized images, but the Drive proxy also re-encodes image bytes on the server. It applies orientation, limits input size and pixel count, and produces WebP without copying EXIF, GPS, XMP, or IPTC metadata.

An unversioned image URL still takes that path. An image Range request must not become an escape hatch to the original bytes.

Keep the neighboring behavior working.

Video is different. The same proxy supports partial-content video streaming, so a broad “ignore all Range headers” fix would break a legitimate feature. The route tests separate image privacy from video range handling.

The route regression tests ↗ cover the boundary. The image tests ↗ inspect the transformed output rather than only checking that a resize function was called.

Write down what the tests do not prove.

A safe proxy response does not delete an original in Google Drive, rewrite an R2 object, or purge a CDN cache. Those are separate operational tasks requiring access and verification. I do not treat a local passing test as proof that those copies are gone.

This note describes a real source change and its regression checks. It does not invent a pull request, a customer result, a timed red/green run, or a new model benchmark.

The loop I want to keep.

1. Write a rule that can be observed from outside the implementation.
2. Make the agent’s scope and constraints explicit.
3. Check bypasses and neighboring behavior, not only the new UI.
4. Review the diff, run the checks, and distinguish code fixes from operational follow-up.