test(scripts): challenge suite fixes from running validation

- 03: assert tags via `.tags` (the retrieve API field) not `.runTags`.
- 04, 13: pre-warm the gate so the same-key burst all reaches the
  buffer. Without the pre-warm, the first 1-2 same-key triggers land
  in PG during gate-transition and create a second race-winner
  (separate concern from B6's buffer-side dedup, surfaced for
  follow-up).

Author: d-cs

scripts/mollifier-challenge/03-mutations-on-buffered.sh

@@ -23,16 +23,16 @@ else
   fail "POST /tags status=$(cat "$WORK/last.status")"
 fi
 api GET "/api/v3/runs/$BUFFERED_ID"
-if body_matches '.runTags // [] | (any(. == "challenge-tag-a") and any(. == "challenge-tag-b"))'; then
+if body_matches '.tags // [] | (any(. == "challenge-tag-a") and any(. == "challenge-tag-b"))'; then
   pass "retrieve shows both new tags on the snapshot"
 else
-  fail "retrieve runTags=$(last_body | jq -c '.runTags // []')"
+  fail "retrieve tags=$(last_body | jq -c '.tags // []')"
 fi
 
 # Idempotent dedup
 api POST "/api/v1/runs/$BUFFERED_ID/tags" '{"tags":["challenge-tag-a"]}'
 api GET "/api/v3/runs/$BUFFERED_ID"
-tag_count=$(last_body | jq '.runTags // [] | map(select(. == "challenge-tag-a")) | length')
+tag_count=$(last_body | jq '.tags // [] | map(select(. == "challenge-tag-a")) | length')
 if [[ "$tag_count" == "1" ]]; then
   pass "duplicate tag deduplicated by mutateSnapshot Lua"
 else

scripts/mollifier-challenge/04-idempotency-collision.sh

@@ -11,9 +11,28 @@ header "Idempotency collision in burst"
 KEY="challenge-idem-$(date +%s)-$RANDOM"
 info "idempotencyKey=$KEY"
 
-# Fire BURST_SIZE triggers simultaneously, all using the same key. With
-# the gate tripped, some will mollify and SETNX the lookup. Subsequent
-# triggers with the same key should return the SETNX winner's runId
+# Pre-warm the gate FIRST. The Q5 design assumes the same-key burst all
+# reaches the buffer — that's where SETNX is the race-winner. If the
+# gate is still cold, the first 1-2 triggers go to PG and the buffer
+# SETNX never sees them, producing two distinct race-winners (one PG,
+# one buffer). That PG+buffer race exists architecturally but it's a
+# separate concern from B6's buffer-side dedup, which is what this
+# script exercises.
+info "pre-warming the gate with $((BURST_SIZE / 2)) no-key triggers"
+warm_dir=$WORK/warm
+mkdir -p "$warm_dir"
+for i in $(seq 1 $((BURST_SIZE / 2))); do
+  curl -s -o "$warm_dir/$i.json" -X POST \
+    -H "Authorization: Bearer $API_KEY" \
+    -H "Content-Type: application/json" \
+    -d "{\"payload\":{\"warm\":$i}}" \
+    "$API_BASE/api/v1/tasks/$TASK_ID/trigger" &
+done
+wait
+
+# Fire BURST_SIZE same-key triggers simultaneously. The gate is now
+# tripped, so all should mollify. SETNX serialises them — one wins, the
+# rest receive duplicate_idempotency with the winner's runId
 # (kind: duplicate_idempotency → isCached:true).
 burst_dir=$WORK/burst
 mkdir -p "$burst_dir"

scripts/mollifier-challenge/13-resume-parent-guard.sh

@@ -21,7 +21,23 @@ fi
 PARENT_ID=$(last_body | jq -r '.id')
 info "PG parent runId=$PARENT_ID"
 
-# Step 2: burst children with a shared idempotency key → some mollified.
+# Pre-warm the gate. If the gate is cold, the first same-key triggers
+# would pass through to PG and the IdempotencyKeyConcern's PG-first
+# check would find a PG-cached row on the triggerAndWait — defeating
+# the test of the resumeParentOnCompletion guard. Pre-warming ensures
+# the same-key burst all reaches the buffer.
+warm_dir=$WORK/warm
+mkdir -p "$warm_dir"
+for i in $(seq 1 $((BURST_SIZE / 2))); do
+  curl -s -o "$warm_dir/$i.json" -X POST \
+    -H "Authorization: Bearer $API_KEY" \
+    -H "Content-Type: application/json" \
+    -d "{\"payload\":{\"warm\":$i}}" \
+    "$API_BASE/api/v1/tasks/$TASK_ID/trigger" &
+done
+wait
+
+# Step 2: burst children with a shared idempotency key → all mollified.
 KEY="challenge-andwait-$(date +%s)-$RANDOM"
 BURST_DIR=$WORK/burst
 mkdir -p "$BURST_DIR"