add notes/remark and refactor round-trip

app-modules/identity/tests/Feature/AgentAbilityAuditTest.php

@@ -6,6 +6,7 @@ use Modules\Booking\Models\Booking;
 use Modules\Identity\Enums\TokenAbility;
 use Modules\Payment\Enums\PaymentMethod;
 use Modules\Payment\Models\Payment;
+use Modules\Routing\Models\EvRoute;
 
 /**
  * T6.4 — full policy + agent-ability audit (domain.md §8). The FastAPI
@@ -63,14 +64,30 @@ test('catalog writes have no customer-facing route at all', function () {
 });
 
 test('routing/pricing writes have no customer-facing route at all', function () {
+    // Only a read-only search endpoint exists for EvRoute — no create/update/
+    // delete route was ever registered, and the search endpoint itself
+    // never creates records regardless of payload (it's POST because
+    // round_trip returns two result sets, not because it writes anything).
+    // {route} only has a GET (show) handler registered, so PUT/DELETE hit
+    // that same URI pattern and are rejected as 405 (method not allowed).
     $this->withHeader('Authorization', "Bearer {$this->agentToken}")
-        ->postJson('/api/v1/routes', ['ev_company_id' => 1])
+        ->putJson('/api/v1/routes/1', ['ev_company_id' => 1])
         ->assertStatus(405);
+
+    $this->withHeader('Authorization', "Bearer {$this->agentToken}")
+        ->deleteJson('/api/v1/routes/1')
+        ->assertStatus(405);
+
+    $this->withHeader('Authorization', "Bearer {$this->agentToken}")
+        ->postJson('/api/v1/routes/search', ['ev_company_id' => 1])
+        ->assertSuccessful();
+
+    expect(EvRoute::count())->toBe(0);
 });
 
 test('the agent token can still read routes and create/read bookings', function () {
     $this->withHeader('Authorization', "Bearer {$this->agentToken}")
-        ->getJson('/api/v1/routes')
+        ->postJson('/api/v1/routes/search')
         ->assertSuccessful();
 
     $booking = Booking::factory()->create(['user_id' => $this->agent->id]);