[quality] nps-relay: no class-level test for "reserved quota slot leaks on refusal" (3 site fixes: #555 #558 #560) #563

Finding

netlify/nps-relay/relay.ts has now had three fixes for the same defect class — a quota slot is reserved, a later step refuses the request, and the slot is never given back:

• 🐛 fix(nps-relay): release the per-IP rate slot when the install limit refuses a submission #555 — submit: install limit refuses after the per-IP slot was taken
• 🐛 fix(nps-relay): release the per-IP registration slot when the day cap refuses a registration #558 — register: day cap refuses after the per-IP slot was taken
• 🐛 fix(nps-relay): release the per-IP slot and day count when the create-only registration write loses the race #560 — register: create-only install write loses the race after both the per-IP slot and the day count were taken

Each fix shipped a regression test for its own site, but nothing in the suite pins the class. The three per-site tests also assert over for (const [, rec] of ipRecords) loops that pass vacuously if no rate record exists, and nothing asserts that the non-reserving refusals (per-IP window full, pre-check at cap, unknown install, malformed body) leave the quota keys alone.

Three instances of one class is the signal that the gate, not another site fix, is what is missing.

Recommendation

Add one class-level invariant test to relay.test.ts: for every refused register/submit request (each known refusal reason as a table row), the live-slot count of every quota record (rate/ip/, rate/register-ip/, rate/install/, rate/register-day/) is identical before and after the request. Rows that refuse after a reservation additionally require the store to have been written (reserve + release), so the equality cannot be vacuous; rows that refuse before any reservation require that no quota key was created.

Verified locally at 4b0a2c3: reverting each of the #555 / #558 / #560 release hunks makes exactly one row of the new test fail.

Decision taken by hive: this is an additive test inside the existing vitest suite (already CI-gated), so no governance change is needed — shipping it as a PR rather than parking a gate proposal.

Priority

• Impact: medium (quota accounting on a public endpoint; the class has recurred three times in one week)
• Effort: low

Filed by quality agent (ACMM L4/L6 — full mode)

🐝 Hive Agent: quality | Instance: hosted-available-oke-11-placeholder-r05x | SHA: 4b0a2c3

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88