The floor is on every response, including /events #23

GET /events builds its own Response in src/live.ts with three headers and none of the floor — production answers the stream with no content-security-policy, no x-content-type-options, no referrer-policy and no strict-transport-security. Fetch it: curl -sI -N https://quorum--forge-trevato-apps.open-platform.sh/events.

What done looks like

• [ ] The event stream carries SECURITY from src/http.ts alongside its own content-type, cache-control: no-store and x-accel-buffering: no, and keeps streaming exactly as it does now.
• [ ] src/http.ts gains one small helper for a response built outside its own constructors (stream(body, headers) or equivalent), so the floor is applied in one place rather than copied; html, json, text, back and staticFile keep working through it unchanged.
• [ ] A test walks the whole route table and asserts that every route, for a guest and for a signed-in person, answers with all four floor headers — including /events, /static/:file, /mcp (both methods), the 404 from an unmatched path and the 500 from the error handler. It fails today for /events, which is the point.
• [ ] The floor test is written so a new route added later is covered without editing it: it iterates routes, not a hand-written list.
• [ ] Nothing about the stream's behaviour changes: the same retry: line first, the same replay from since, the same heartbeat, the same trim after a response.
• [ ] bun test is green, and the pull quotes the headers fetched from the preview's /events showing the floor present.

Files I expect to change: src/live.ts, src/http.ts, src/server.test.ts, possibly src/routes.ts (only if a route needs the helper).

Risks: SECURITY includes strict-transport-security only when the public origin is https — the test must assert the three unconditional headers always and that one conditionally, or it will fail locally and pass in production, which is worse than no test. Do not add content-length or buffering to the stream while touching its headers. A route that streams must still flush its first bytes immediately; check that the helper does not wrap the body in anything.

Fit: Hearth — the floor under everything the app serves, proved by a test that cannot drift. A person assigns; I do not.

API Error: Can't reach the API server — check your internet or DNS (EAI_AGAIN)

Interrupted, not the work (outage; strike cleared 2026-10-02) — was: Parked by the crew: the run ended without a pull: no changes pushed: API Error: Can't reach the API server — check your internet or DNS (EAI_AGAIN) (api_error)

API Error: Can't reach the API server — check your internet or DNS (EAI_AGAIN)

Interrupted, not the work (outage; strike cleared 2026-10-02) — was: Parked by the crew: the run ended without a pull: no changes pushed: API Error: Can't reach the API server — check your internet or DNS (EAI_AGAIN) (api_error)

Amendment from the planner: reproducing, and worse than the issue says. Fetched just now:

$ curl -sI https://quorum--forge-trevato-apps.open-platform.sh/events HTTP/2 200 content-type: text/event-stream content-length: 0 cache-control: no-store

No content-security-policy, no x-content-type-options, no referrer-policy, no strict-transport-security — and note content-length: 0, which is the CDN's answer to a HEAD, not evidence about the stream. Do not chase it.

Added criterion: the route-table test asserts the floor for /api/health and /api/proposals as well, and is written over routes so a route added tomorrow is covered without editing the test — that is the part of this issue with a long life. The three unconditional headers are asserted always; strict-transport-security only where the public origin is https, or the test passes in production and fails on a laptop.

The parks here were a DNS failure twice over, not a problem with the work.