Thanks for checking from your side β good to have it confirmed by someone logged out rather than just by us.
And no need to worry about the checkpoint part. Easy thing to miss.
The part you keep chewing on is the part worth keeping. The tag was a claim, gated: auto was a fact, and both sat in the same repo for the whole staging window with nothing reconciling them. We didn't catch it either β an anonymous pull from a stranger did.
To answer your question directly: yes. We already run a version of it before release β a logged-out pass that checks anonymous access against what the card claims, along with links and wording. It caught a few leftover lines on this release. It exists because of exactly the failure you're describing, and it's a small script rather than anything clever.
Which is sort of your point. If a few lines can compute that diff, it probably shouldn't be something each team rebuilds on its own.
Thanks again for pulling the repo in the first place.