~1800 lines across api-responses/data-aggregation/date-time/validation/user-agent tests assert on LOCAL copies of functions; the flagship analytics-api.test.ts exercises src/api.ts which is marked LEGACY — NOT the live request path. collect.ts/stats.ts imported by no test; no regression tests for the recent CORS/vitals/errors/IP fixes. Fix: rewire self-testing suites to import src/utils/*; DynamoDB Local integration harness + golden-path specs (collect->rows->stats, concurrency #161, settle #162, rollup boundary #146, GDPR round-trip, CORS preflight).
From the production-readiness audit (docs/research/production-readiness.md, eacf996). Verified with live probes where stated.