@@ -35,4 +35,12 @@ curl -sf -b /tmp/oa.jar -X POST http://127.0.0.1:3000/api/channel/ -H 'content-t
 # (manifest.rs's loader), so the retry has to be a single line - `;` joined, not real newlines. The
 # retry covers the channel rows this file just inserted not yet being visible to the router. No -f on
 # the curl: the 401 body is exactly what this loop inspects, and -f discards it on any non-2xx.
-curl -s -m 10 -X POST http://127.0.0.1:3000/v1/chat/completions -H 'content-type: application/json' -H 'Authorization: Bearer dummy' -d '{"model":"gpt-4o-mini","messages":[{"role":"user","content":"hi"}],"max_tokens":1}' -o /tmp/oa-auth-check; i=1; while [ $i -le 10 ] && ! grep -q chat.completion /tmp/oa-auth-check; do sleep 0.5; i=$((i+1)); curl -s -m 10 -X POST http://127.0.0.1:3000/v1/chat/completions -H 'content-type: application/json' -H 'Authorization: Bearer dummy' -d '{"model":"gpt-4o-mini","messages":[{"role":"user","content":"hi"}],"max_tokens":1}' -o /tmp/oa-auth-check; done; grep -q chat.completion /tmp/oa-auth-check || { echo "one-api: the declared auth never relayed after 10 checks - INITIAL_ROOT_TOKEN may no longer be honoured by this image: $(cat /tmp/oa-auth-check)" >&2; exit 1; }
+#
+# EVERY MODEL, NOT JUST THE FIRST. This checked gpt-4o-mini alone while creating three channels, so a
+# channel that inserted but never became routable was invisible here and surfaced later as the
+# GATEWAY failing: one-api published "no available channel for model gemini-1.5-pro" as two red cells
+# in all eight runs of 2026-07-27/28, including the oldest engine. A setup this harness got wrong must
+# stop the run and say so, not become a verdict about the gateway. The channel POSTs above already
+# abort on a non-zero exit (bin/otb.rs runs each line and stops the run on failure); this closes the
+# gap where the POST succeeds and the routing still does not work.
+for m in gpt-4o-mini claude-3-5-sonnet-20240620 gemini-1.5-pro; do i=1; ok=0; while [ $i -le 20 ]; do curl -s -m 10 -X POST http://127.0.0.1:3000/v1/chat/completions -H 'content-type: application/json' -H 'Authorization: Bearer dummy' -d "{\"model\":\"$m\",\"messages\":[{\"role\":\"user\",\"content\":\"hi\"}],\"max_tokens\":1}" -o /tmp/oa-auth-check; if grep -q chat.completion /tmp/oa-auth-check; then ok=1; break; fi; sleep 0.5; i=$((i+1)); done; [ "$ok" = 1 ] || { echo "one-api: model $m never relayed after 20 checks - its channel is registered but not routable, so every cell for that egress would publish a red this harness caused: $(cat /tmp/oa-auth-check)" >&2; exit 1; }; done
@@ -616,6 +616,22 @@ const MAX_BOARD_AGE_DAYS = 180;    // wholesale-stale floor (soft anchor): the w
 // guard the rewrite KEPT) never fires and a wholesale-stale matrix board publishes generated_at=now.
 // The floor now ages exactly what the board shows (same basis as MED-1's footer + the per-row badge).
 const boardNewest = Math.max(...gateways.map(displayedMeasuredMs), 0);
+// A BOARD WHOSE AGE CANNOT BE ESTABLISHED IS NOT A FRESH BOARD.
+//
+// This guard only ran `if (boardNewest > 0)`, so the one situation it could not judge - no gateway
+// carrying a resolvable displayed stamp - was the one it let straight through. That is the same
+// shape as every other guard that turned out to be doing nothing today: the retry budget nothing
+// called, the box qualification that always seeded, the history appender scanning directories the
+// engine stopped writing. Each was silent rather than wrong, which is why none of them were noticed.
+//
+// Publishing generated_at=now over a board we cannot date is exactly what the 180-day floor exists
+// to refuse, so an unresolvable board is a hard failure with its own reason rather than a pass.
+if (boardNewest <= 0 && gateways.length > 0) {
+  throw new Error(
+    `gen-data: FRESHNESS FAILURE (undatable board): ${gateways.length} gateway(s) but not one carries a resolvable ` +
+    `displayed measured_at, so the board's age cannot be established at all. Refusing to publish ` +
+    `generated_at=${generatedAt} over data that cannot be dated.`);
+}
 if (boardNewest > 0) {
   const boardAgeDays = (Date.parse(generatedAt) - boardNewest) / 86400000;
   if (boardAgeDays > MAX_BOARD_AGE_DAYS) {
 
@@ -3170,3 +3170,23 @@ test("C8: the repo's own instrument-equivalence.json meets the evidence rule it
     }
   }
 });
+// ---- a board whose age cannot be established is not a fresh board -------------------------------
+// The 180-day floor ran only `if (boardNewest > 0)`, so the one case it could not judge was the one
+// it waved through. That is the shape of every guard that turned out to be inert today: the retry
+// budget nothing called, the box qualification that always seeded, the history appender scanning
+// directories nothing writes. Silent, not wrong, which is why none were noticed.
+test("freshness guard REFUSES a board it cannot date, rather than passing it", () => {
+  // Gateways present, but no resolvable displayed stamp anywhere.
+  const root = mkdtempSync(join(tmpdir(), "site-undatable-"));
+  mkdirSync(join(root, "gateways", "alpha"), { recursive: true });
+  writeFileSync(join(root, "gateways", "alpha", "definition.json"), JSON.stringify({
+    name: "alpha", display: "alpha", lang: "Rust", class: "Gateway", model: "m", port: 1,
+    path: "/v1/chat/completions", auth: "dummy", egress: ["openai"],
+    matrix: ["100000", "000000", "000000", "000000", "000000", "000000"],
+  }));
+  mkdirSync(join(root, "results", "snapshots"), { recursive: true });
+  const msg = genThrows(root);
+  assert.ok(msg, "expected gen-data to THROW on a board with no datable measurement, but it succeeded");
+  assert.match(msg, /FRESHNESS FAILURE \(undatable board\)/, `expected the undatable-board failure, got: ${msg}`);
+});
+