feat(discovery): Phase 2 — reporter, /api/discovery/* routes (strict loopback-only) + dashboard UI (#5939)

* feat(discovery): Phase 2 reporter — discoveryResults DB module + service wiring

Adds src/lib/db/discoveryResults.ts (CRUD over the discovery_results table
from migration 074) and wires the opt-in discovery service to persist and read
findings through it: persistDiscoveryResult / getDiscoveryResults /
getDiscoveryResultById / markVerified / deleteDiscoveryResult, with
(provider, method, endpoint) upsert de-duplication. Re-exported from localDb.

The service stays opt-in / default-off. The /api/discovery/* routes and the
dashboard UI tab are intentionally deferred to Phase 2b — they need the
local-only enforcement model (Hard Rules #15/#17 territory) decided first.

TDD: tests/unit/db/discovery-results.test.ts (8 cases, DB + service delegation),
isolated DATA_DIR with resetDbInstance cleanup.

* feat(discovery): Phase 2b — /api/discovery/* routes (strict loopback-only)

Adds the discovery HTTP surface on top of the reporter DB module:
  GET    /api/discovery/results            list findings (optional ?providerId)
  GET    /api/discovery/results/:id        one finding (404 if absent)
  DELETE /api/discovery/results/:id        delete a finding
  POST   /api/discovery/scan               scan a provider + persist findings
  POST   /api/discovery/verify/:id         mark a finding verified

Authorization: strict loopback-only. "/api/discovery/" is added to
LOCAL_ONLY_API_PREFIXES so the central authz pipeline (proxy.ts →
runAuthzPipeline → managementPolicy) rejects non-loopback callers with a 403
LOCAL_ONLY before any handler runs. It is deliberately NOT in
LOCAL_ONLY_MANAGE_SCOPE_BYPASS_PREFIXES — no remote manage-scope bypass —
because POST /scan issues outbound probes to provider endpoints (SSRF-adjacent)
and must never be tunnel-reachable. Handlers also call requireManagementAuth
(defense in depth) and return sanitized errors via createErrorResponse.

Tests:
- tests/unit/authz/discovery-routes-local-only.test.ts (8) — security guard:
  isLocalOnlyPath true + not manage-scope-bypassable for all four paths.
- tests/unit/api/discovery-routes.test.ts (6) — handler integration over an
  isolated DATA_DIR: list/filter, by-id 200/404/400, scan persist + 400 on
  empty/malformed body, verify 200/404, delete 200/404, no stack-trace leak.

* feat(discovery): Phase 2c — dashboard UI tab (Tools → Discovery)

Adds the /dashboard/discovery page (DiscoveryPageClient) that consumes the
Phase 2b /api/discovery/* routes: scan a provider, list findings, verify or
delete them. Registered in the sidebar under the Tools group (icon
travel_explore) and given a "discovery" i18n namespace + sidebar keys in
en.json (other locales fall back to en via next-intl until synced — the
locale files are in a pre-existing coverage deficit unrelated to this change).

Registers the UI test path in vitest.config.ts (advisory ui suite).

Tests: src/app/(dashboard)/dashboard/discovery/__tests__/DiscoveryPageClient.test.tsx
(3 cases: loads+renders results, empty state, fetches /api/discovery/results on
mount; stable useTranslations mock to avoid the fetch-loop). NOTE: the ui vitest
suite cannot run in this workspace — @testing-library/dom (a @testing-library/
react peer dep) is absent from node_modules, which fails ALL existing ui tests
equally; the test runs in CI. Component verified locally via typecheck + lint.

* test(discovery): register discovery-routes-local-only in stryker tap.testFiles

The mutation-test-coverage gate (--strict) flags any unit test covering a
mutated module that isn't listed in stryker.conf.json tap.testFiles. This PR's
tests/unit/authz/discovery-routes-local-only.test.ts covers src/server/authz/
routeGuard.ts (a mutated module, which this PR edits by adding the
/api/discovery/ local-only prefix), so it must be registered for its mutant
kills to count. No behavior change.

* refactor(discovery): split DiscoveryPageClient to satisfy max-lines-per-function

The complexity ratchet (max-lines-per-function: 80) flagged the single
184-line DiscoveryPageClient function (+1 over baseline). Extract the data
layer into two hooks (useDiscoveryResults for list/loading/feedback,
useDiscoveryActions for scan/verify/delete), a shared callApi helper, and two
presentational sub-components (DiscoveryScanForm, DiscoveryResultCard). Every
function is now under the 80-line ceiling; complexity gate back to baseline
1995. No behavior change — same exported component, same endpoints, same props.

* test(sidebar): include discovery in omni-proxy item-order snapshot

Adding the Discovery item to the Tools group (this PR's sidebar entry) extends
the ordered omni-proxy section list. Update the exact-match deepEqual snapshot
in sidebar-visibility.test.ts to include "discovery" in its position (after
traffic-inspector). The assertion stays exact — this reflects the intentional
new item, it does not weaken the check.

* docs(changelog): restore release bullets eaten by merge auto-resolve; re-add discovery bullet additively

* chore(quality): bump testFrozen for translator-openai-responses-req.test.ts (1097 -> 1172)

Base-red inherited from #5933, which grew the test file to 1171 lines
(Hard Rule #18 regression tests) without adjusting the frozen cap. The
release tip itself fails check:file-size; this unblocks every PR into
release/v3.8.44. File untouched by this PR.

* chore(quality): restore stryker tap.testFiles entries eaten by merge auto-resolve

The merge of origin/release/v3.8.44 silently dropped the 3 entries added
on the release side (#5903, clinepass, #5923). Took the release version
verbatim and re-added only this PR's entry (discovery-routes-local-only)
in alphabetical order. check:mutation-test-coverage green locally.

* chore(quality): reconcile inherited v3.8.44 merge-burst drift + include discovery in tools-group order test

- complexity 1995->2003 and cognitive 856->859: both measure IDENTICAL on
  the pristine release tip (3a3d618fe) and this PR's merged HEAD — the PR
  is complexity-net-zero; drift is from the 2026-07-02 merge burst
  (notes added to both baselines, same family as prior reconciliations).
- sidebar-tools-group.test.ts: append 'discovery' to the expected
  TOOLS_GROUP order — the intentional new sidebar item this PR adds
  (same expected-value update already made in sidebar-visibility.test.ts).

src/app/(dashboard)/dashboard/discovery/DiscoveryPageClient.tsx

@@ -0,0 +1,329 @@
+"use client";
+
+import { useCallback, useEffect, useState } from "react";
+import { useTranslations } from "next-intl";
+import { Card, Button, Input, Badge, EmptyState, Spinner, ConfirmModal } from "@/shared/components";
+
+interface DiscoveryResult {
+  id: number;
+  providerId: string;
+  method: string;
+  endpoint?: string | null;
+  authType: string;
+  models?: string[];
+  rateLimit?: string | null;
+  feasibility: number;
+  riskLevel: string;
+  status: string;
+  notes?: string | null;
+  discoveredAt?: string;
+  verifiedAt?: string | null;
+}
+
+type Feedback = { type: "success" | "error"; message: string } | null;
+type Translate = ReturnType<typeof useTranslations>;
+
+type BadgeVariant = "default" | "success" | "warning" | "error";
+
+const RISK_VARIANT: Record<string, BadgeVariant> = {
+  none: "success",
+  low: "success",
+  medium: "warning",
+  high: "error",
+  critical: "error",
+};
+
+const STATUS_VARIANT: Record<string, BadgeVariant> = {
+  verified: "success",
+  testing: "warning",
+  pending: "default",
+  rejected: "error",
+};
+
+/** Run a fetch, surface a localized error via `setFeedback`, and report success. */
+async function callApi(
+  fn: () => Promise<Response>,
+  t: Translate,
+  failKey: string,
+  setFeedback: (f: Feedback) => void
+): Promise<boolean> {
+  setFeedback(null);
+  try {
+    const res = await fn();
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok) throw new Error(data?.error?.message || t(failKey));
+    return true;
+  } catch (err) {
+    setFeedback({ type: "error", message: err instanceof Error ? err.message : t(failKey) });
+    return false;
+  }
+}
+
+/** Results list + loading + feedback state, plus the reload function. */
+function useDiscoveryResults(t: Translate) {
+  const [results, setResults] = useState<DiscoveryResult[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [feedback, setFeedback] = useState<Feedback>(null);
+
+  const load = useCallback(async () => {
+    setLoading(true);
+    try {
+      const res = await fetch("/api/discovery/results");
+      const data = await res.json().catch(() => ({}));
+      if (!res.ok) throw new Error(data?.error?.message || t("loadFailed"));
+      setResults(Array.isArray(data.results) ? data.results : []);
+    } catch (err) {
+      setFeedback({ type: "error", message: err instanceof Error ? err.message : t("loadFailed") });
+    } finally {
+      setLoading(false);
+    }
+  }, [t]);
+
+  useEffect(() => {
+    void load();
+  }, [load]);
+
+  return { results, loading, feedback, setFeedback, load };
+}
+
+/** Scan / verify / delete actions and their transient state. */
+function useDiscoveryActions(
+  t: Translate,
+  load: () => Promise<void>,
+  setFeedback: (f: Feedback) => void
+) {
+  const [scanTarget, setScanTarget] = useState("");
+  const [scanning, setScanning] = useState(false);
+  const [busyId, setBusyId] = useState<number | null>(null);
+  const [deleteTarget, setDeleteTarget] = useState<DiscoveryResult | null>(null);
+
+  const scan = useCallback(async () => {
+    const providerId = scanTarget.trim();
+    if (!providerId) return;
+    setScanning(true);
+    const ok = await callApi(
+      () =>
+        fetch("/api/discovery/scan", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ providerId }),
+        }),
+      t,
+      "scanFailed",
+      setFeedback
+    );
+    setScanning(false);
+    if (ok) {
+      setScanTarget("");
+      setFeedback({ type: "success", message: t("scanQueued", { provider: providerId }) });
+      await load();
+    }
+  }, [scanTarget, t, load, setFeedback]);
+
+  const verify = useCallback(
+    async (row: DiscoveryResult) => {
+      setBusyId(row.id);
+      const ok = await callApi(
+        () => fetch(`/api/discovery/verify/${row.id}`, { method: "POST" }),
+        t,
+        "verifyFailed",
+        setFeedback
+      );
+      setBusyId(null);
+      if (ok) await load();
+    },
+    [t, load, setFeedback]
+  );
+
+  const remove = useCallback(async () => {
+    if (!deleteTarget) return;
+    setBusyId(deleteTarget.id);
+    const ok = await callApi(
+      () => fetch(`/api/discovery/results/${deleteTarget.id}`, { method: "DELETE" }),
+      t,
+      "deleteFailed",
+      setFeedback
+    );
+    setBusyId(null);
+    if (ok) {
+      setDeleteTarget(null);
+      await load();
+    }
+  }, [deleteTarget, t, load, setFeedback]);
+
+  return {
+    scanTarget,
+    setScanTarget,
+    scanning,
+    busyId,
+    deleteTarget,
+    setDeleteTarget,
+    scan,
+    verify,
+    remove,
+  };
+}
+
+/** State + data orchestration for the discovery page, kept out of the view. */
+function useDiscovery() {
+  const t = useTranslations("discovery");
+  const { results, loading, feedback, setFeedback, load } = useDiscoveryResults(t);
+  const actions = useDiscoveryActions(t, load, setFeedback);
+  return { t, results, loading, feedback, ...actions };
+}
+
+function DiscoveryScanForm({
+  t,
+  value,
+  onChange,
+  onScan,
+  scanning,
+}: {
+  t: Translate;
+  value: string;
+  onChange: (v: string) => void;
+  onScan: () => void;
+  scanning: boolean;
+}) {
+  return (
+    <Card className="p-4">
+      <div className="flex flex-col gap-3 sm:flex-row sm:items-end">
+        <div className="flex-1">
+          <label className="mb-1 block text-sm font-medium" htmlFor="discovery-scan-target">
+            {t("scanLabel")}
+          </label>
+          <Input
+            id="discovery-scan-target"
+            value={value}
+            placeholder={t("scanPlaceholder")}
+            onChange={(e) => onChange(e.target.value)}
+            onKeyDown={(e) => {
+              if (e.key === "Enter") onScan();
+            }}
+          />
+        </div>
+        <Button onClick={onScan} disabled={scanning || !value.trim()}>
+          {scanning ? t("scanning") : t("scan")}
+        </Button>
+      </div>
+      <p className="mt-2 text-xs text-muted-foreground">{t("localOnlyNote")}</p>
+    </Card>
+  );
+}
+
+function DiscoveryResultCard({
+  t,
+  row,
+  busy,
+  onVerify,
+  onDelete,
+}: {
+  t: Translate;
+  row: DiscoveryResult;
+  busy: boolean;
+  onVerify: () => void;
+  onDelete: () => void;
+}) {
+  return (
+    <Card className="p-4">
+      <div className="flex flex-wrap items-start justify-between gap-3">
+        <div className="space-y-1">
+          <div className="flex items-center gap-2">
+            <span className="font-medium">{row.providerId}</span>
+            <Badge variant={STATUS_VARIANT[row.status] ?? "default"}>{row.status}</Badge>
+            <Badge variant={RISK_VARIANT[row.riskLevel] ?? "default"}>
+              {t("risk")}: {row.riskLevel}
+            </Badge>
+          </div>
+          <div className="text-xs text-muted-foreground">
+            {t("method")}: {row.method} · {t("auth")}: {row.authType} · {t("feasibility")}:{" "}
+            {row.feasibility}/5
+          </div>
+          {row.endpoint && (
+            <div className="text-xs text-muted-foreground break-all">{row.endpoint}</div>
+          )}
+          {row.models && row.models.length > 0 && (
+            <div className="text-xs text-muted-foreground">
+              {t("models")}: {row.models.join(", ")}
+            </div>
+          )}
+        </div>
+        <div className="flex gap-2">
+          {row.status !== "verified" && (
+            <Button variant="secondary" onClick={onVerify} disabled={busy}>
+              {t("verify")}
+            </Button>
+          )}
+          <Button variant="danger" onClick={onDelete} disabled={busy}>
+            {t("delete")}
+          </Button>
+        </div>
+      </div>
+    </Card>
+  );
+}
+
+export function DiscoveryPageClient() {
+  const d = useDiscovery();
+
+  return (
+    <div className="space-y-6">
+      <header className="space-y-1">
+        <h1 className="text-2xl font-semibold">{d.t("title")}</h1>
+        <p className="text-sm text-muted-foreground">{d.t("subtitle")}</p>
+      </header>
+
+      <DiscoveryScanForm
+        t={d.t}
+        value={d.scanTarget}
+        onChange={d.setScanTarget}
+        onScan={() => void d.scan()}
+        scanning={d.scanning}
+      />
+
+      {d.feedback && (
+        <div
+          role="status"
+          className={
+            d.feedback.type === "error"
+              ? "rounded-md border border-red-300 bg-red-50 px-3 py-2 text-sm text-red-700"
+              : "rounded-md border border-green-300 bg-green-50 px-3 py-2 text-sm text-green-700"
+          }
+        >
+          {d.feedback.message}
+        </div>
+      )}
+
+      {d.loading ? (
+        <div className="flex justify-center py-10">
+          <Spinner />
+        </div>
+      ) : d.results.length === 0 ? (
+        <EmptyState title={d.t("emptyTitle")} description={d.t("emptyDescription")} />
+      ) : (
+        <ul className="space-y-3">
+          {d.results.map((row) => (
+            <li key={row.id}>
+              <DiscoveryResultCard
+                t={d.t}
+                row={row}
+                busy={d.busyId === row.id}
+                onVerify={() => void d.verify(row)}
+                onDelete={() => d.setDeleteTarget(row)}
+              />
+            </li>
+          ))}
+        </ul>
+      )}
+
+      <ConfirmModal
+        isOpen={d.deleteTarget !== null}
+        title={d.t("deleteTitle")}
+        message={d.t("deleteConfirm", { provider: d.deleteTarget?.providerId ?? "" })}
+        confirmText={d.t("delete")}
+        onConfirm={() => void d.remove()}
+        onClose={() => d.setDeleteTarget(null)}
+      />
+    </div>
+  );
+}

src/app/(dashboard)/dashboard/discovery/__tests__/DiscoveryPageClient.test.tsx

@@ -0,0 +1,76 @@
+// @vitest-environment jsdom
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { render, screen, waitFor } from "@testing-library/react";
+import React from "react";
+import { DiscoveryPageClient } from "../DiscoveryPageClient";
+
+// Stable `t` reference: useTranslations must return the SAME function across
+// renders, otherwise the `load` useCallback (dep [t]) changes every render and
+// the fetch-on-mount useEffect loops forever.
+const t = (key: string, vars?: Record<string, unknown>) =>
+  vars ? `${key}:${JSON.stringify(vars)}` : key;
+
+vi.mock("next-intl", () => ({
+  useTranslations: () => t,
+}));
+
+function mockFetchOnce(results: unknown[]) {
+  const fetchMock = vi.fn(async () =>
+    new Response(JSON.stringify({ results }), {
+      status: 200,
+      headers: { "content-type": "application/json" },
+    })
+  );
+  vi.stubGlobal("fetch", fetchMock);
+  return fetchMock;
+}
+
+describe("DiscoveryPageClient", () => {
+  beforeEach(() => {
+    vi.restoreAllMocks();
+  });
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  it("loads and renders discovery results from the API", async () => {
+    mockFetchOnce([
+      {
+        id: 1,
+        providerId: "huggingchat",
+        method: "free_tier",
+        authType: "none",
+        feasibility: 5,
+        riskLevel: "none",
+        status: "verified",
+        models: ["mixtral"],
+      },
+    ]);
+
+    render(<DiscoveryPageClient />);
+
+    await waitFor(() => {
+      expect(screen.getByText("huggingchat")).toBeInTheDocument();
+    });
+    // status + risk badges render (mocked t returns the key)
+    expect(screen.getByText("verified")).toBeInTheDocument();
+  });
+
+  it("shows the empty state when there are no results", async () => {
+    mockFetchOnce([]);
+
+    render(<DiscoveryPageClient />);
+
+    await waitFor(() => {
+      expect(screen.getByText("emptyTitle")).toBeInTheDocument();
+    });
+  });
+
+  it("calls the discovery results endpoint on mount", async () => {
+    const fetchMock = mockFetchOnce([]);
+    render(<DiscoveryPageClient />);
+    await waitFor(() => {
+      expect(fetchMock).toHaveBeenCalledWith("/api/discovery/results");
+    });
+  });
+});

src/app/(dashboard)/dashboard/discovery/page.tsx

@@ -0,0 +1,5 @@
+import { DiscoveryPageClient } from "./DiscoveryPageClient";
+
+export default function DiscoveryPage() {
+  return <DiscoveryPageClient />;
+}

src/app/api/discovery/results/[id]/route.ts

@@ -0,0 +1,62 @@
+/**
+ * Discovery result by id — GET / DELETE /api/discovery/results/:id
+ *
+ * Auth: Tier 3 MANAGEMENT + strict local-only (see ../route.ts for the model).
+ */
+
+import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
+import { createErrorResponse, createErrorResponseFromUnknown } from "@/lib/api/errorResponse";
+import { getDiscoveryResultById, deleteDiscoveryResult } from "@/lib/db/discoveryResults";
+
+function parseId(raw: string): number | null {
+  const id = Number(raw);
+  return Number.isInteger(id) && id > 0 ? id : null;
+}
+
+export async function GET(
+  request: Request,
+  { params }: { params: Promise<{ id: string }> }
+): Promise<Response> {
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
+  const { id: rawId } = await params;
+  const id = parseId(rawId);
+  if (id === null) {
+    return createErrorResponse({ status: 400, message: "Invalid discovery result id" });
+  }
+
+  try {
+    const result = getDiscoveryResultById(id);
+    if (!result) {
+      return createErrorResponse({ status: 404, message: "Discovery result not found" });
+    }
+    return Response.json({ result });
+  } catch (error) {
+    return createErrorResponseFromUnknown(error, "Failed to read discovery result");
+  }
+}
+
+export async function DELETE(
+  request: Request,
+  { params }: { params: Promise<{ id: string }> }
+): Promise<Response> {
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
+  const { id: rawId } = await params;
+  const id = parseId(rawId);
+  if (id === null) {
+    return createErrorResponse({ status: 400, message: "Invalid discovery result id" });
+  }
+
+  try {
+    const removed = deleteDiscoveryResult(id);
+    if (!removed) {
+      return createErrorResponse({ status: 404, message: "Discovery result not found" });
+    }
+    return Response.json({ deleted: true, id });
+  } catch (error) {
+    return createErrorResponseFromUnknown(error, "Failed to delete discovery result");
+  }
+}

src/app/api/discovery/results/route.ts

@@ -0,0 +1,29 @@
+/**
+ * Discovery results — GET /api/discovery/results
+ *
+ * Lists persisted discovery findings, optionally filtered by `?providerId=`.
+ *
+ * Auth: Tier 3 MANAGEMENT (requireManagementAuth) + strict local-only. The
+ * `/api/discovery/` prefix is in `LOCAL_ONLY_API_PREFIXES` (routeGuard.ts), so
+ * the central authz pipeline (src/proxy.ts → runAuthzPipeline → managementPolicy)
+ * blocks non-loopback callers with a 403 LOCAL_ONLY before this handler runs.
+ * It is NOT in the manage-scope bypass list — strict loopback, no remote bypass.
+ */
+
+import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
+import { createErrorResponseFromUnknown } from "@/lib/api/errorResponse";
+import { getDiscoveryResults } from "@/lib/db/discoveryResults";
+
+export async function GET(request: Request): Promise<Response> {
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
+  try {
+    const url = new URL(request.url);
+    const providerId = url.searchParams.get("providerId") || undefined;
+    const results = getDiscoveryResults(providerId);
+    return Response.json({ results });
+  } catch (error) {
+    return createErrorResponseFromUnknown(error, "Failed to list discovery results");
+  }
+}

src/app/api/discovery/scan/route.ts

@@ -0,0 +1,54 @@
+/**
+ * Discovery scan — POST /api/discovery/scan
+ *
+ * Triggers a scan for one provider and persists the findings. Body:
+ * `{ "providerId": "<id>" }`.
+ *
+ * Auth: Tier 3 MANAGEMENT + strict local-only (see ../results/route.ts). The
+ * strict-loopback classification matters here specifically: `scanProvider` may
+ * probe outbound provider endpoints (SSRF-adjacent), so the surface must never
+ * be reachable from a tunnel/remote origin.
+ */
+
+import { z } from "zod";
+import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
+import { createErrorResponse, createErrorResponseFromUnknown } from "@/lib/api/errorResponse";
+import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
+import { scanProvider, persistDiscoveryResult } from "@/lib/discovery/index";
+
+const scanRequestSchema = z.object({
+  providerId: z.string().min(1).max(200),
+});
+
+export async function POST(request: Request): Promise<Response> {
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
+  let raw: unknown;
+  try {
+    raw = await request.json();
+  } catch {
+    return createErrorResponse({
+      status: 400,
+      message: "Invalid request",
+      details: [{ field: "body", message: "Invalid JSON body" }],
+    });
+  }
+
+  const validation = validateBody(scanRequestSchema, raw);
+  if (isValidationFailure(validation)) {
+    return createErrorResponse({
+      status: 400,
+      message: validation.error.message,
+      details: validation.error.details,
+    });
+  }
+
+  try {
+    const found = await scanProvider(validation.data.providerId);
+    const persisted = found.map((result) => persistDiscoveryResult(result));
+    return Response.json({ results: persisted });
+  } catch (error) {
+    return createErrorResponseFromUnknown(error, "Failed to scan provider");
+  }
+}

src/app/api/discovery/verify/[id]/route.ts

@@ -0,0 +1,35 @@
+/**
+ * Discovery verify — POST /api/discovery/verify/:id
+ *
+ * Marks a discovery finding as verified (status='verified', stamps verified_at).
+ *
+ * Auth: Tier 3 MANAGEMENT + strict local-only (see ../../results/route.ts).
+ */
+
+import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
+import { createErrorResponse, createErrorResponseFromUnknown } from "@/lib/api/errorResponse";
+import { markVerified } from "@/lib/db/discoveryResults";
+
+export async function POST(
+  request: Request,
+  { params }: { params: Promise<{ id: string }> }
+): Promise<Response> {
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
+  const { id: rawId } = await params;
+  const id = Number(rawId);
+  if (!Number.isInteger(id) || id <= 0) {
+    return createErrorResponse({ status: 400, message: "Invalid discovery result id" });
+  }
+
+  try {
+    const result = markVerified(id);
+    if (!result) {
+      return createErrorResponse({ status: 404, message: "Discovery result not found" });
+    }
+    return Response.json({ result });
+  } catch (error) {
+    return createErrorResponseFromUnknown(error, "Failed to verify discovery result");
+  }
+}