- serve.mjs: only GET and HEAD /api/board stay the Board read; every
other method goes to the pack route, so DELETE and PUT answer its 405
again. The owner-only check moves inside packsHTTP after the method
check, so OPTIONS on a root Console stays 405 as before SP4.
- runtime.mjs: a --as rename cannot target the definition name human,
and a human step role never follows a rename. A step whose mapped
roles collide refuses invalid-request at preview, not only at apply.
- The no-op apply skip also needs the same pack sha256, so a changed
pack with nothing to add still records its entry.
- Tests: the --as refusals for human, a step role collision, a pack
defining human, a changed saved pack recording its entry, board by
PUT, a granted session refused owner-only on every pack route, and a
Console without sign-in refused owner-only.
jason.woltje
9a649abf85