steveandClaude Opus 4.8
8552f1d152
Every other handler file had a sibling API test; this group had none, which is the state PATCH/DELETE /journal/:id shipped in — implemented, unit-tested through the service, and completely unreachable. Service tests cannot see a route that was never registered or one registered with the wrong :param. Four tests, covering what a broken route would silently take with it: - Full CRUD over HTTP, including GET/PATCH/DELETE by id, the ?plantId= filter, a rejected non-numeric plantId, and a stale-version 409 carrying the current row so the client can rebase. - `remaining` is derived through the HTTP surface, not just in the service. DESIGN.md makes derivation load-bearing, and the number is the whole reason anyone opens the seed shelf. - Lots are private to the buyer: another user gets 404 (not 403 — existence is masked per the project convention) on get/patch/delete, sees none in their listing, and the owner still has access afterwards. - The group is behind requireAuth: unauthenticated calls 401 rather than returning an empty list. Verified the tests actually catch the failure they exist for by unregistering GET /seed-lots/:id — all four fail with "404 page not found", the journal signature. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01H3zbym8Doka2d7D48maSgZ