Problem
Rate limits key by mintable anon session (rateLimit(\attempt:${sessionId}`)`) and the leaderboard groups by session: exhausting one session's budget, minting a fresh session bypasses the limit, and two sessions cracking level-1 bank as separate rows.
Where
app/api/attempt/route.ts + lib/http.ts (anon mint) + lib/db.ts (GROUP BY session_id).
Acceptance
Add a failing test first minting a second session after exhausting the first, expecting allowed: false (or leaderboard dedup). Then fix.
Problem
Rate limits key by mintable anon session (
rateLimit(\attempt:${sessionId}`)`) and the leaderboard groups by session: exhausting one session's budget, minting a fresh session bypasses the limit, and two sessions cracking level-1 bank as separate rows.Where
app/api/attempt/route.ts+lib/http.ts(anon mint) +lib/db.ts(GROUP BY session_id).Acceptance
Add a failing test first minting a second session after exhausting the first, expecting
allowed: false(or leaderboard dedup). Then fix.