test(web): wire-level GET-poll fairness + document single-user concurrency assumption

proteus/web/server.py

@@ -3,6 +3,11 @@
 A pure ``handle_request(method, path, body, registry)`` router (unit-testable
 without a socket) plus a thin BaseHTTPRequestHandler adapter and a make_server
 factory. In-memory session registry; local single-user. No new dependencies.
+
+Concurrency: ThreadingHTTPServer serves each request on its own thread, but the
+registry is a plain dict and a session is not locked — this assumes one local
+player (no concurrent ``/act`` on the same session). Sessions are never evicted
+(unbounded for a long-lived server); both are acceptable for single-user play.
 """
 from __future__ import annotations
 

tests/web/test_server.py

@@ -91,6 +91,24 @@ def test_query_string_is_ignored_in_routing():
     assert status == 200 and "predator_evade" in payload["scenarios"]
 
 
+def test_get_poll_state_is_fair_mid_game():
+    # The GET poll path must be as fair as create/act: no answer keys mid-game.
+    reg = _registry()
+    _, created, _ = server.handle_request(
+        "POST", "/session",
+        {"scenario": "predator_evade", "difficulty": "easy", "seed": 42,
+         "play_turns": 5, "probe": False}, reg)
+    sid = created["session_id"]
+    server.handle_request("POST", f"/session/{sid}/act", {"action": "up"}, reg)
+
+    status, payload, _ = server.handle_request("GET", f"/session/{sid}", None, reg)
+    assert status == 200
+    st = payload["state"]
+    assert st["outcome"] is None and st["review"] is None
+    blob = json.dumps(st)
+    assert "reward" not in blob and "motive_action" not in blob and "habit" not in blob
+
+
 def test_finish_appends_trace_and_returns_metrics(tmp_path):
     reg = _registry()
     _, created, _ = server.handle_request(