[pacocartones]

Summary

• POST /api/gamification/rotate, /servers and /federation/score call request.json() outside any try, so a body that is not valid JSON makes the handler throw an unhandled SyntaxError. The other POST routes of the module (invite, invite/redeem, transfer) already answer 400 with { error: "Invalid JSON body" } in that case; these three now do the same, with the same CORS headers.

Related Issues

• None found: no open or closed pull request or issue covers this (checked by touched path over the 392 open pull requests, and by symbol over merged, closed and issues, 15 October).

Target Branch

• Base is the active release/v3.8.x branch (release/v3.8.52, built on 7f1be3bbf0), not main
• Not a feature: a fix.

Validation

• Change type: other (gamification module, routes)
• Focused test: the new file below fails on the base and passes with the change.
• The module suite (tests/unit/gamification/*.test.ts and the *gamification*.test.ts files of tests/unit/) passes with the change.
• eslint and prettier --check on the changed files are clean; check:ai-attribution and check:changelog-integrity pass.
• Full CI: runs on this PR.
• Production-code change includes a new automated test in this PR.

Tests Added Or Updated

• tests/unit/gamification/malformed-json-400.test.ts (new): one case per route posts not-json and expects 400. On the base 7f1be3bbf0 the three cases fail with SyntaxError: Unexpected token 'o', "not-json" is not valid JSON (3 fail); with the change they pass.

Coverage Notes

• The change is in src/; the new test calls the changed code directly. I measured that the handler throws; I did not measure which status the framework turns the throw into.

Reviewer Notes

• Changelog fragment: changelog.d/fixes/PENDING-<slug>.md, one line, left for you to rename.