fix: enforce VIP content boundary and PATCH updates

web/tests/agent-update-method.test.ts

@@ -0,0 +1,15 @@
+import assert from 'node:assert/strict'
+import { readFileSync } from 'node:fs'
+import { describe, it } from 'node:test'
+
+const routeSource = readFileSync(
+  new URL('../src/app/api/agent/posts/[slug]/route.ts', import.meta.url),
+  'utf8',
+)
+
+describe('agent post update HTTP contract', () => {
+  it('exports PATCH and does not export PUT', () => {
+    assert.match(routeSource, /export async function PATCH\(/)
+    assert.doesNotMatch(routeSource, /export async function PUT\(/)
+  })
+})