The positional classification detail is the interesting part: one early splat silently demotes every later rule into the 100-slot dynamic budget. A suggestion for the CI check: besides counting rules, also assert that every static rule precedes the first dynamic one, so reordering is enforced rather than remembered. A related question is whether a silent skip could be surfaced at build time, for example by diffing the parsed rule count against the line count in the deploy log. For the post-deploy curl check, it may also be worth asserting the Location header and status, since a rule that falls through to a catch-all 200 SPA fallback would not look like a 404 but would still be wrong.