diff --git a/tests/http-state.test.mjs b/tests/http-state.test.mjs
index dc06ad4..6d8627b 100644
--- a/tests/http-state.test.mjs
+++ b/tests/http-state.test.mjs
@@ -26,7 +26,10 @@ before(async()=>{
 });
 after(async()=>{if(child){child.kill();await new Promise(r=>child.once('exit',r));}rmSync(dir,{recursive:true,force:true});});
 test('HTTP preparation requires auth, persists draft and rejects stale revisions',async()=>{
- const unauthorized=await request('/api/me/tender-state','GET',null,null);
+ const preflight=await fetch(base+'/api/me/plan',{method:'OPTIONS',headers:{Origin:'https://client.example', 'Access-Control-Request-Method':'GET', 'Access-Control-Request-Headers':'authorization,content-type'}});
+ assert.equal(preflight.status,204);
+ assert.equal(preflight.headers.get('access-control-allow-headers'),'Authorization,Content-Type');
+  const unauthorized=await request('/api/me/tender-state','GET',null,null);
  assert.equal(unauthorized.status,401);
  assert.equal(unauthorized.headers.get('x-content-type-options'),'nosniff');
  assert.equal(unauthorized.headers.get('referrer-policy'),'no-referrer');