The every-GET-route floor test is two tests, signed out and signed in, each well inside its own 9 s budget #8116

In test/security-floor-routes.test.ts, the test "every GET route, and an unknown path, carries the floor signed out and signed in" is now two tests: "… carries the floor signed out" and "… carries the floor signed in". Both go through missingFloor(headers), which requests every path from getPatterns().map(pathFor) plus /no/such/path/at/all and /api/v1/no-such-route, whatever status each one answers. The signed-out test sends no cookie and the signed-in test sends the session cookie. Both use the one beforeAll server and seed, so the setup still runs once. Each test keeps its own 9_000 ms budget.

The assertion is unchanged: every response must carry Content-Security-Policy, X-Content-Type-Options and Referrer-Policy, and floor() still returns string[]. Requests now send accept-encoding: identity. This is safe because src/http/server.ts:2321 applies the floor after compression (compress(request, response).then(securityFloor)), so turning gzip off doesn't change which headers are checked. A comment above floor() says so. No BATCH or concurrency setting was added.

Times: in this sandbox, bun test test/security-floor-routes.test.ts printed only the file total, not a line per test, so I took each test's time from --reporter=junit over three runs:

The file total printed 3.6–4.5 s across runs, and both tests are well under 6 s. The four posix_spawn 'git' ENOENT log lines during the run are unrelated: they show up on main too, and the tests pass.

Checks: bun scripts/gate.ts and bun x tsc --noEmit both pass, as do the 13 files scripts/fast.ts named (177 pass, 0 fail).

To try it: bun test test/security-floor-routes.test.ts, or add --reporter=junit --reporter-outfile=out.xml to get each test's time.

🤖 Generated with Claude Code

Closes #8114

In test/security-floor-routes.test.ts, the test "every GET route, and an unknown path, carries the floor signed out and signed in" is now two tests: "… carries the floor signed out" and "… carries the floor signed in". Both go through missingFloor(headers), which requests every path from getPatterns().map(pathFor) plus /no/such/path/at/all and /api/v1/no-such-route, whatever status each one answers. The signed-out test sends no cookie and the signed-in test sends the session cookie. Both use the one beforeAll server and seed, so the setup still runs once. Each test keeps its own 9_000 ms budget.

The assertion is unchanged: every response must carry Content-Security-Policy, X-Content-Type-Options and Referrer-Policy, and floor() still returns string[]. Requests now send accept-encoding: identity. This is safe because src/http/server.ts:2321 applies the floor after compression (compress(request, response).then(securityFloor)), so turning gzip off doesn't change which headers are checked. A comment above floor() says so. No BATCH or concurrency setting was added.

Times: in this sandbox, bun test test/security-floor-routes.test.ts printed only the file total, not a line per test, so I took each test's time from --reporter=junit over three runs:

The file total printed 3.6–4.5 s across runs, and both tests are well under 6 s. The four posix_spawn 'git' ENOENT log lines during the run are unrelated: they show up on main too, and the tests pass.

Checks: bun scripts/gate.ts and bun x tsc --noEmit both pass, as do the 13 files scripts/fast.ts named (177 pass, 0 fail).

To try it: bun test test/security-floor-routes.test.ts, or add --reporter=junit --reporter-outfile=out.xml to get each test's time.

🤖 Generated with Claude Code

The full-suite proof of this head is waiting: no check slot is spare. It starts when one frees.