A test pins Server-Timing: a phase name never carries text from the request, and the header stays one valid line #6919

I added five tests to test/route-timing.test.ts that pin Server-Timing, and the tests found two holes in src/core/route_timing.ts, which I fixed. bun x tsc --noEmit is clean and the file's 10 tests pass. The settings-timing, server-timing-sweep and route-timing-coverage tests also pass. I did not run the whole suite.

Tests

• Phase order: two phases timed on one request (one sync, one async) appear after app in order, each with dur.
• Throw: a throw inside timePhase or timePhaseAsync still records the phase and rethrows the original error.
• Bad names: a phase name with a comma, semicolon, quote, CR, LF, space, capital or nothing at all is refused. That holds for both notePhase and timePhase, and the resulting header (including the desc="hit" form) stays on one line.
• Frames: nameFrame and namesFrame name route and flag the request, with no leak to other requests.
• Once, then nothing: takeDbTime and takeSessionTime give their value once and then nothing, and one request's time never shows up on another.

Holes fixed

• Throw in a timed phase: if the work threw, timePhase and timePhaseAsync recorded nothing. They now record the phase and rethrow the original error.
• takeSessionTime: it never cleared its value, so it could be read twice. It now clears it, like takeDbTime. The page callers that take it (commits, edit, settings and others) take it once. Where nameFrame is also used, it runs before the take, so route still subtracts the session time.

Not done: the name check itself was already sound, since notePhase only accepts ^[a-z][a-z0-9-]{0,15}$, so I changed nothing there.

I extended the existing test/route-timing.test.ts instead of making a new file, as the issue asked.

Closes #6910

I added five tests to test/route-timing.test.ts that pin Server-Timing, and the tests found two holes in src/core/route_timing.ts, which I fixed. bun x tsc --noEmit is clean and the file's 10 tests pass. The settings-timing, server-timing-sweep and route-timing-coverage tests also pass. I did not run the whole suite.

Tests

• Phase order: two phases timed on one request (one sync, one async) appear after app in order, each with dur.
• Throw: a throw inside timePhase or timePhaseAsync still records the phase and rethrows the original error.
• Bad names: a phase name with a comma, semicolon, quote, CR, LF, space, capital or nothing at all is refused. That holds for both notePhase and timePhase, and the resulting header (including the desc="hit" form) stays on one line.
• Frames: nameFrame and namesFrame name route and flag the request, with no leak to other requests.
• Once, then nothing: takeDbTime and takeSessionTime give their value once and then nothing, and one request's time never shows up on another.

Holes fixed

• Throw in a timed phase: if the work threw, timePhase and timePhaseAsync recorded nothing. They now record the phase and rethrow the original error.
• takeSessionTime: it never cleared its value, so it could be read twice. It now clears it, like takeDbTime. The page callers that take it (commits, edit, settings and others) take it once. Where nameFrame is also used, it runs before the take, so route still subtracts the session time.

Not done: the name check itself was already sound, since notePhase only accepts ^[a-z][a-z0-9-]{0,15}$, so I changed nothing there.

I extended the existing test/route-timing.test.ts instead of making a new file, as the issue asked.