The consent endpoint shipped in eb7713a485 and deployed, but REGARDE_GATEWAY_URL and REGARDE_SUBJECT_SALT were never provisioned, so every ask fail-closes at 503. Existing coverage stopped at readScope -- how a player's answer is read -- and said nothing about the hop across the gateway, which is where the wall either holds or quietly stops being one. Two files: oskiewar-consent-gateway.test.mjs, 16 offline tests against a local stub desk. Auth is mocked so the branches past the door are reachable without a network. Every refusal is asserted rather than assumed: unset gateway, unset salt, desk 500, desk unreachable, an answer with no outcome. The three that matter most are that no raw Auth0 subject crosses the wire, that the pseudonym changes with the salt so grants cannot be correlated, and that allow still returns capability: null -- the wall is proven, the worker behind it is not built. oskiewar-consent-e2e.test.mjs, 8 tests over real HTTP with a real bearer token from ~/.ac-token. It deliberately does not assert 503: that is only true while the desk is unset, and the wall has to be safe either way. What it asserts is the promise that holds in every configuration -- no request comes back holding a capability, no response echoes the subject -- and it prints which state it found, so a run doubles as a status check on whether the desk is reachable yet. Both pass: 26 offline, 8 live against production. npm run test:consent supplies --experimental-test-module-mocks so the flag is not something to remember. The offline file is run directly rather than under --test on purpose: the endpoint's console.log of a gateway status corrupts the test runner's serialized IPC channel and the run dies with "Unable to deserialize cloned data". Committed through a private GIT_INDEX_FILE because a concurrent session held .git/index.lock throughout. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>