The room's two doors are tested where they are opened: POST /api/room and the socket upgrade answer to src/server.test.ts #335

rg "api/room|SOCKET_PATH|upgrade" src/server.test.ts finds nothing. The room API and the WebSocket upgrade are the app's only endpoints that hold a connection open, and the only ones a stranger can reach without a match to post — and not one of their refusals is tested at the door. src/rooms/rooms.test.ts is 23 tests of the hub and the codec through plain objects; it never sees a request.

So today, nothing fails if the same-origin check on POST /api/room is deleted, if the upgrade stops refusing an unknown code, if the cookie stops being set on the 101, or if a plain GET /ws starts answering something other than the app's own 404.

src/server.test.ts already boots the real server on port 0 and fetches it — this is a test-only pull.

Done looks like

• [ ] POST /api/room: answers a code with content-type: application/json, cache-control: no-store, the whole security floor and a session cookie; a cross-origin POST is 403; a caller past ROOM_LIMIT gets 429 with retry-after; a map that is not a map falls back to de_forge and length is short unless it is exactly long.
• [ ] Past ROOM_CAP the answer is 503 and the sentence names the cap.
• [ ] The upgrade: no room is 400 "not a room code"; a well-formed code for no room is 404 with its sentence; a cross-origin upgrade is 403; a plain GET /ws with no upgrade header is the app's own 404 page, not an error.
• [ ] A real upgrade against a real room delivers hello and at least one snapshot to a real WebSocket client, and the 101 carried the session cookie and the security headers.
• [ ] A name longer than 24 characters is cut at the boundary; a text frame on the socket is dropped; a binary frame over MESSAGE_MAX closes the connection (Bun refuses it before this process holds the bytes — assert the close, not a parse).
• [ ] Every test closes its sockets and gives back its room; the suite's wall time before and after is stated in the pull.
• [ ] bun test green.

Files

src/server.test.ts — or a sibling named for the concept if that 1,238-line file is already at its limit, in which case say which and why in the new file's docstring. At most, one constant exported from src/server.ts; no behaviour changes.

Risks

• A leaked socket hangs the suite. Close every one, and do not lean on the hub's idle sweep to clean up after a test.
• The rate-limit test poisons its neighbours if it shares a caller: ROOM_LIMIT is keyed by address and session, so use a distinct caller or run it last, and say which was chosen.
• The 503 test wants ROOM_CAP rooms, which is twenty worlds. Measure it; if it costs more than a second, open the first nineteen through the hub directly and only the last through the route, and say so.

Suggested: Torque — these are boundaries, status codes and headers, and the proof is exact.