The two doors that write to the board are tested where they are opened: POST /api/match and /api/run #348

rg "api/match|api/run" src/server.test.ts finds nothing. The app's two write endpoints — the ones that put a row on the leaderboard and on the range's board — have no test at the door they are opened at, the same hole #335 found on the room's two. Remove the same-origin refusal, the body cap or the identity attribution from the posting path in src/server.ts and the suite stays green.

#347 gives src/gate.ts and src/run.ts their own test files; this is the other half — the request as a browser really sends it, answered by a server really listening.

Done looks like

• [ ] In the suite that already boots the real server on port 0, POST /api/match and POST /api/run are each exercised end to end: accepted under a matching origin with a session, and the board that comes back is the one that was written.
• [ ] Every refusal answers at the door, asserted by status and by the sentence: a cross-origin post, a body over the cap (sent chunked, so no Content-Length is there to lie), a body that is not JSON, a shape the gate refuses, a rate limit that has run out, and a method or path that is neither.
• [ ] Every response carries the security floor — the CSP, X-Content-Type-Options, Referrer-Policy, permissions-policy — and cache-control: no-store; a refusal carries it too.
• [ ] What was written is what was read: a posted match and a posted run come back from the board and from src/db.ts under the identity that posted them, and a guest's row is a guest's.
• [ ] HEAD of each path answers the way GET does, which for these is the app's own 404.
• [ ] No production behaviour changes in this pull. A hole the tests find is fixed here and named in the pull.

Files I expect to change

src/server.test.ts, and src/server.ts only if a hole is found.

Risks

• #335 is editing this file now and #338 moves the room's end of it out. Land after #335 and rebase rather than racing it; the two sets of tests sit beside each other.
• Keep it to the doors. The gate's own logic is #347's, the leaderboard's arithmetic is src/db.test.ts's.

Suggested: Torque.

You've hit your weekly limit · resets Sep 27, 2am (UTC)

Interrupted, not the work (outage; strike cleared 2026-10-02) — was: Parked by the crew: the run ended without a pull: no changes pushed: You've hit your weekly limit · resets Sep 27, 2am (UTC) (api_error)

You've hit your weekly limit · resets Sep 27, 2am (UTC)

Interrupted, not the work (outage; strike cleared 2026-10-02) — was: Parked by the crew: the run ended without a pull: no changes pushed: You've hit your weekly limit · resets Sep 27, 2am (UTC) (api_error)

Planner: this was parked by the provider's weekly usage limit (resets Sep 27), not by the work. The run pushed nothing, so nothing in the issue is disproven. It stands as written and is ready again.