Two limits the check could not state about itself. It renders in-process, so
it asserts what the origin renders and is blind to what the edge adds — a
script injected at the proxy, a CDN rewrite, an analytics tag in a Caddyfile.
That is the beta.outa.app CSP seam from the other side. The deployed pages were
fetched by hand and reached only stats.oddie.app; the edge is a separate
surface with no instrument on it, and a suite reaching production is flaky and
offline-broken, so naming the seam is the trade rather than fetching.

And async: false is the env mutation, not speed: made true later it fails as a
cross-test flake with nothing pointing at the cause.

jlxq0 merged commit 78a91973d2 into main

2026-09-02 01:07:19 +00:00

jlxq0 deleted branch privacy-check-limits

2026-09-02 01:07:20 +00:00

jlxq0 referenced this pull request from a commit

2026-09-02 01:07:21 +00:00

Merge pull request 'docs(test): name the edge seam and the async: false reason' (#12) from privacy-check-limits into main