test(13-06): cover the Phase 13 framework edges in surf, conga, lagoon and tide

- surf: a transitive three-route family, HEAD and sorted Allow on family
  paths, a family across two plugins with per-member middleware, refused
  trailing-slash and multi-segment shapes
- conga: refusal messages name kind and queue, a configured queue counts
  as served, a delayed unregistered dispatch waits scheduled
- lagoon: prohibited under a wildcard, on a dotted path and after bail
- tide: quoted, RFC 5987 and multi-date download names; a captured id
  beside a masked notification id

modules/tide/normalize_phase13_test.go

@@ -122,3 +122,50 @@ func TestNormalizeNotificationPublication(t *testing.T) {
 		t.Fatalf("album publication\n got %s\nwant %s", got[0].Body, want)
 	}
 }
+
+// TestNormalizePhase13Edges: the download-date mask also holds for a
+// quoted filename, an RFC 5987 filename* and three dates in one name,
+// while a changed count of dates diffs; a notification publication keeps
+// a captured id beside its masked own id.
+func TestNormalizePhase13Edges(t *testing.T) {
+	for _, c := range []struct {
+		name, recorded, got string
+		diff                bool
+	}{
+		{"quoted", `attachment; filename="export-2026-09-17.csv"`, `attachment; filename="export-2026-10-03.csv"`, false},
+		{"quoted stem change", `attachment; filename="export-2026-09-17.csv"`, `attachment; filename="backup-2026-10-03.csv"`, true},
+		{"rfc5987", `attachment; filename*=UTF-8''p%C5%82yty-2026-09-17.csv`, `attachment; filename*=UTF-8''p%C5%82yty-2026-10-03.csv`, false},
+		{"three dates", "attachment; filename=a-2026-01-01-2026-02-01-2026-03-01.csv", "attachment; filename=a-2027-01-01-2027-02-01-2027-03-01.csv", false},
+		{"one date fewer", "attachment; filename=a-2026-01-01-2026-02-01.csv", "attachment; filename=a-2026-01-01.csv", true},
+		{"leap day", "attachment; filename=a-2028-02-29.csv", "attachment; filename=a-2026-10-03.csv", false},
+		{"not a leap year", "attachment; filename=a-2026-02-29.csv", "attachment; filename=a-2026-10-03.csv", true},
+	} {
+		diffs := compareHeaders(map[string]string{"Content-Disposition": c.recorded}, map[string]string{"Content-Disposition": c.got}, nil)
+		if (len(diffs) > 0) != c.diff {
+			t.Errorf("%s: diffs = %+v, want diff=%v", c.name, diffs, c.diff)
+		}
+	}
+
+	store := mustMemoryStore()
+	store.Set("id:album", "5")
+	pub := func(id, albumID string) []Publication {
+		return []Publication{{Method: "POST", Path: "/api/publish", Body: json.RawMessage(
+			`{"channel":"acme#9","data":{"event":"notification:new","payload":{"id":` + id +
+				`,"type":"item_added","payload":{"album_id":` + albumID + `},"read_at":null,"created_at":"2026-10-03T08:00:00+00:00"}}}`)}}
+	}
+	got, err := NormalizePublications(pub("31", "5"), store)
+	if err != nil {
+		t.Fatal(err)
+	}
+	body := string(got[0].Body)
+	if !strings.Contains(body, `"payload":{"id":{{id}},`) || !strings.Contains(body, `"album_id":{{id:album}}`) {
+		t.Fatalf("masks beside a captured id: %s", body)
+	}
+	other, err := NormalizePublications(pub("32", "6"), store)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if diffs := DiffPublications(got, other); len(diffs) == 0 {
+		t.Fatal("a different album id must still diff")
+	}
+}