Attempt Browser Smoke

The attempt browser smoke proves the user-facing attempt route against the non-default attempt-native route table.

Self-test:

ATTEMPT_BROWSER_SELF_TEST=1 bash scripts/test/attempt-browser-smoke.sh

Required route-table proof:

make test-attempt-routes
GATEWAY_ROUTE_TABLE=deploy/gateway/routes.attempt-native-localhost-example.json

Confirmed browser run:

GATEWAY_ROUTE_TABLE=deploy/gateway/routes.attempt-native-localhost-example.json \
ATTEMPT_BROWSER_CONFIRM=attempt-native \
ATTEMPT_BROWSER_EXAM_ID=<published-exam-id> \
ATTEMPT_BROWSER_AUTHORIZATION='Bearer <student-token>' \
ATTEMPT_BROWSER_ORGANIZATION_ID=<org-id> \
make test-attempt-browser

Default /api/exams/*/start and /api/attempts* promotion remains blocked until route, live, browser, and rollback evidence are all present.

Rollback is switching the gateway back to deploy/gateway/routes.json and rerunning make test-attempt-routes to confirm the default table stays legacy-safe.

Local Browser Evidence (2026-07-13)

• output/playwright/attempt-public-idempotency-proof-20260713/summary.json records Chromium 200 responses and native_read headers for student list, attempt detail, events, and result against the non-default Gateway table.
• The runner imports the workspace-pinned @playwright/test package rather than an unresolved playwright package.
• page.png is a screenshot of Gateway /healthz, used only as a same-origin shell for the browser fetches. It is not student exam-room visual or UX parity evidence.

Default attempt route promotion remains blocked.