Keeps a real, redacted error message instead of "Error: Error", surfaces Python tracebacks in Sentry as a vetted context, and adds an opt-in SNAPOTTER_SENTRY_DIAGNOSTIC verbose mode plus SNAPOTTER_SENTRY_DSN_OVERRIDE. The default fleet path ships nothing on the never-collect list; raw detail is reachable only via the opt-in flag. Also classifies Redis OOM/READONLY replies as operational and removes a ReDoS in stack-frame extraction.
The preview lets a cell be dragged to +/-200% but the schema rejected
anything past +/-100, failing half the draggable range with a 400. The
schema now mirrors the drag clamp; cover-mode values past 100 saturate
at the image edge, contain-mode values keep panning like the preview.
Cover cells and the cornerRadius mask re-encode kept the input format,
so JPEG inputs lost the masked alpha and corners flattened to black.
Both now encode PNG explicitly.
Unreadable image dimensions used to silently substitute the cell's own
size, fill-stretching the image; they now throw and surface as a 422
naming the file.
Fixes#718
The published archives are intact (manifest hash, HF LFS hash, and CDN
bytes all agree), but the accelerated hf_xet client assembles files with
parallel offset writes, which some storage backends (network mounts,
FUSE bind mounts) corrupt silently. The old retry re-ran that same
client with force_download, so an install on such storage failed the
checksum forever with no way out.
The mismatch retry now goes through the plain sequential downloader,
and discards stale .partial/.meta resume sidecars first so a previously
killed run cannot weld old bytes onto the fresh attempt. Checksum errors
report the actual digest next to the expected one plus the Offline
Import workaround, IO errors during verification surface as parseable
error frames instead of tracebacks, and a retry-download failure keeps
the mismatch that started it in the message.
Fixes#714
The contain branch chained a zoom resize into the contain resize on one Sharp pipeline; Sharp keeps a single set of resize options, so per-cell zoom was silently discarded and pan was equally dead. Splitting the chain would not have fixed it: the contain step scales the zoomed image straight back down.
The backend now implements the preview's semantics exactly: contain-fit, scale about the cell centre by zoom, offset by pan as a fraction of the cell, clip, background behind. Defaults keep the old single contain resize (now PNG-encoded so JPEG inputs no longer flatten cornerRadius masks to black corners), and the general path centres with floor to match Sharp's contain placement.
Nine marker-geometry tests, seven mutants each killed by the test built for them, window math fuzzed over 2.59M combinations.
Fixes#711
resolveOutputFormat handed every route a default quality of 95, and Sharp reads quality on PNG as palette quantisation, so every PNG through the factory-route family came back dithered and often bigger. quality is now optional and stays undefined for PNG unless a caller passes an explicit override; smart-crop's user-chosen quality still quantises on request.
Two branches bypassed the resolver and carried their own copy of the bug, both fixed: image-pad hardcoded quality 95 for transparent padding, replace-color hardcoded quality 100 when forcing PNG for transparency. pixelate drops the local special case #709 added for the same bug.
Four new integration oracles on >256-colour inputs, each watched failing against the old code.
Fixes#710
.env.example shipped this as 1 while the code defaults to 0 (offline_guard.py and
bridge.ts both fail closed) and the security guide states that runtime model
downloads are disabled by default. Every other reference in the repo uses 0.
No runtime behaviour changes: no compose file or Dockerfile sets the variable, so
the code default already governed real deployments.
Sharp keeps one set of resize options per pipeline, so the chained shrink-then-grow collapsed into a single resize back to the original size and both the full-image and region paths returned the input untouched.
Run the two resizes as separate pipelines, pinned to fit: "fill" so a skewed block grid cannot crop the picture.
Also in this change:
- stop passing quality to the PNG encoder, which Sharp reads as "quantise to a palette" and which dithered the flat blocks and inflated the file
- replace the region instead of blending into it, so a part-transparent image no longer shows the original through the mosaic
- throw on unreadable dimensions rather than falling back to a 1x1 image
Five new integration tests on content-bearing fixtures, each verified against a deliberate mutant.
Fixes#678
qpdf expands argument files before parsing options, so a bare positional password
beginning with @ was resolved as a path and the file's contents became the
encryption key: exit 0, and the user's own password no longer opened the PDF.
Drive the encrypt through a job-JSON file so neither password reaches argv. The
=-joined flag form needs qpdf 11.7+, and the released image carries 11.3.0 which
rejects it; job JSON works on both (verified 11.3.0 and 12.1.0, R = 6 each).
POST /api/v1/upload, POST /api/v1/preview and POST /api/v1/preview/generate
authenticated but never authorized, sitting between requireFileAccess (which
guards /api/v1/files) and toolAccessMiddleware (scoped to /api/v1/tools/). A key
scoped to settings:read alone could still stage bytes behind the unauthenticated
download URL and drive Sharp, libheif, LibRaw and FFmpeg.
Upload now takes requireFileAccess; both preview routes take tools:use.
requireFileAccess moves to permissions.ts so the modules share one definition.
The subject-access export selected the whole users row and subtracted only
passwordHash, so profile.json carried totpSecret and recoveryCodesHash. On a
default install DATA_ENCRYPTION_KEY is empty and the TOTP seed is stored as
cleartext base32; recovery codes are 32-bit values behind an unsalted SHA-256.
Name the profile columns instead, add the canManageTargetRole gate the sibling
purge routes already apply, and scope the export status lookup to the user in
the path plus the gdpr-export tool id.
The canonical lane classified .srt/.vtt/.ass artifacts served as
application/octet-stream as binary and passed them on a 16-byte floor, so
auto-subtitles and extract-subtitles only proved their output was
non-trivial, not that it was a real subtitle. classify() already keys
several formats off the filename extension; extend the text branch the same
way so these decode as text and the oracle asserts real content.
Verified on a live v2.2.0 container: auto-subtitles now reports
'text 180chars 8lines' and extract-subtitles 'text 101chars 9lines' (both
were binary no-signature), still passing, and an empty subtitle would now
fail as whitespace-only instead of sliding through.
On a bundles-installed container the canonical lane reported six false
failures, all harness gaps rather than product bugs:
- remove-gif-background got a still GIF and correctly refused it; pin the
animated fixture it actually needs.
- erase-object got no mask part, so the route's 400 was correct; wire the
mask through SECONDARY_INPUTS the way the other multi-input tools are.
- passport-photo's base route refuses by design (use /analyze or /generate);
record that in EXPECTED_SELF_REJECT.
- ocr, transcribe-audio and auto-subtitles ran on fixtures carrying none of
the text or speech they extract, so they emitted empty but valid artifacts
the oracle read as zero-byte failures. Pin fixtures that carry real content.
Verified red to green against a live v2.2.0 container with every bundle
installed: the six went from 6 fail to 5 pass plus 1 expected-reject, the
multi lane stayed clean (0 fail across 20 tools), and a direct probe showed
the download path was never at fault (ocr on a text-free image returns a
correct 0-byte result; on ocr-clean.png it returns the real text).
Fixes#690
The nightly Docker Container E2E job writes every fork's image and video
scratch under /tmp, which docker-compose.test.yml mounted as a 2g tmpfs.
On the 7GB runner that scratch either exhausted RAM (the runner was killed
mid-run, exit 137) or, once the tmpfs was sized to cap RAM in an earlier
attempt, hit ENOSPC and failed ~1100 tests. Drop the test-unit tmpfs mounts
so scratch lands on the container's disk-backed layer, which the job already
frees to ~110G. Keep VITEST_MAX_FORKS=1 for the memory ceiling; Postgres and
Redis keep their small tmpfs data mounts.
test-unit mounts /tmp as tmpfs, so vitest fork scratch counts against the 7GB runner alongside the app/Postgres/Redis, correlating with mid-run exit-137 kills. Run one fork and size-cap the scratch mounts so temp files cannot exhaust runner RAM. Disk (#700) and timeout (#698) already ruled out.
The job builds a ~15GB image on three containers and has been terminated mid-run (exit 137, tests passing) on standard runners. Reclaim preinstalled toolchains before building to reduce the resource pressure correlated with the terminations.
A from-scratch image build plus the full in-container suite runs ~65 minutes, so the 60-minute budget cancelled the job right before it finished while every test passed. Raise it to 90 minutes.
The nightly E2E Full (4/4) intermittently failed pin-tools at its opening no-Pinned-section assertion: the spec mutates the shared pinnedTools preference, and with CI retries:1 an attempt that failed after pinning left a server-side pin the retry saw. Reset pinnedTools via the preferences API at the start so the test is idempotent. Confirmed intermittent (the same job passed on rerun of unchanged code) and PR CI green.
Follow-up to #695, greening the last nightly jobs it exposed. split gains a 400-tile product cap (a 100x100 split was a 10,000-file ZIP and ~20s of work). The settings-fuzz bounds its image inputs to 640px and gives the tools whose cost is output-driven (border, gif-tools, split) or codec-driven (heic/webp-to-avif) honest per-case budgets, since #649's settle-job wiring made every case wait for the real encode. The delete-team serial spec waits with toHaveCount(0) so the success toast can't trip strict mode, and type-to-search allows a route announcer's programmatic reading focus so it works on WebKit. Confirmed on a nightly dispatch: Extended Matrix (all 4 shards), Serial Bucket, Cross-Browser, and Coverage all green; Docker Container E2E's failures were GitHub runner reclamation (exit 137, tests passing throughout), which cleared on the #695 dispatch and is unaffected by this change.
Nightly has been red since 07-28; per-PR CI and main are green. Two investigations traced all five failing classes to #649: extended-matrix required AI bundles it never installs (removed), nightly SYSTEM_DEPS drifted from ci.yml (added libreoffice + a doc-binaries composite for pandoc/pdfcpu), the generated-case classifier only skipped ffmpeg (widened to pdfcpu/soffice/pandoc + excluded repo-audit specs from the lean docker image), a settings spec capped loginAttemptLimit and 429-cascaded the serial bucket (restore via API), and type-to-search refused keystrokes under a route announcer's programmatic focus (guard added). A nightly dispatch on the branch confirmed all five classes green.
The published amd64-gpu set carried huggingface_hub at four versions, the tokenizers 0.23.1 breaker, background-removal's scipy strand, and a live #490 flavor mix from transcription's CPU onnxruntime. Six bundles rebuilt at r2 paths under the constrained closure; gpu pins move to 1.20.2 (PyPI dropped 1.20.1); verify-bundle-compatibility.sh gains the any-package multi-version scan. Fixes#692.
The worst-order install test caught tokenizers 0.23.1 against transformers' <0.21 requirement, and the r2 rebuilds drifted onnxruntime. Both are constrained now; the obsolete protobuf<5 arm64 pins are gone (arm64 resolves mediapipe 1.0.0, no python protobuf dependency); transcription and object-eraser-colorize point at r3 archives. Full worst-order install plus the 18-tool installed AI matrix passed against this manifest. Completes #669.
The published arm64 set disagreed on huggingface_hub (four bundles baked 1.22.0), scipy, and scikit-image. All six affected bundles are rebuilt under the constrained closure and published at new -r2 paths so baked manifests keep working; no rebuilt bundle carries hub and the layered compatibility check passes. verify-bundle.sh drops its stale onnxruntime expectation for upscale-enhance. Completes #669.
The ocr oracle demanded six pangram words when ocr-clean.png prints five; the ocr-pdf oracle expected a searchable PDF when the tool's contract is text extraction; media-30s.mp4 was eight seconds long. Fix all three, regenerate tool-contract.json from current schemas, record the new fixture in the manifest, and add a QA_OUT_DIR override so parallel machines stop clobbering each other's lane output. Fixes#677.
Docker-in-WSL2 stacks can be reachable from every other device while localhost times out on the Windows host itself, even with mirrored networking. Tell Windows users what to expect and how to reach the app. Fixes#676.
A retried compose up after a failed first start can leave the app container detached from the compose network; the resulting Postgres EAI_AGAIN crash-loop reads as a database problem and never self-heals. New Troubleshooting section with the force-recreate fix. Fixes#675.
SD1.5 inpainting is OOM-killed at the stock 6g compose limit on CPU hosts and completes at 8g. Read the cgroup limit and refuse hq up front with an actionable message; GPU hosts and unlimited containers are untouched. Fixes#670.
The generated v2.2.0 changelog entry had no explicit heading ids, so its auto new-features slug collided with v2.0.0's explicit anchor and vitepress refused to build. Version-scoped ids for every v2.2.0 section; the release commit's [skip ci] had kept the breakage dormant.
The frame loop spent 2-19s per frame in CPU pymatting while the CUDA session sat idle; a 30-frame GIF took 353s on a 4070. Animations skip alpha matting now (stills keep it), the session device is logged, and the CUDA-to-CPU session fallback says why. Same fixture finishes in 46s with every frame on the GPU. Fixes#668.
The arm64 transcription bundle baked huggingface_hub 1.22.0 while inpaint-hq's transformers needs hub <1.0; last-writer-wins in the shared venv made the hq install fail on arm64. Constrain hub at build time, pin it in transcription's package list, and lock both invariants with manifest unit tests. The arm64 transcription bundle still needs a rebuild and republish to ship the fix. Fixes#669.
A fresh GPU deployment has working passthrough but no torch/ONNX runtime until a bundle installs, so the dispatcher reports gpu=false and the boot banner said no GPU was detected. Add the hardware-present state, driven by the same /dev/nvidia0 check the instance census uses. Fixes#673.
app_version was attached only to feedback events; every other allowlist stripped it, so the install base could not be segmented by release. One property on the once-per-boot census event covers it. Fixes#674.
caire's -width/-height/-blur/-sobel flags are integer-only; a schema-valid float crashed the binary and surfaced as a corrupt-file 422. Reject fractional values at validation time with a settings-shaped 400. Fixes#672.
trim-audio stream-copies, and a window below one frame ships a container with zero audio frames as a 200 success. Floor the window at 0.1s in the schema, and refuse after endS clamps to the real duration if the window drops under the floor. Fixes#671.
Second failed dispatch (verify-ocr, now fixed in #666) again left a
chore(release): 2.2.0 commit. Undo its artifacts so the re-dispatch regenerates
them once: restore .release-notes.md to root, drop the 2.2.0 entries from
CHANGELOG.md and the docs changelog. Tag and draft deleted, so the fresh run
re-tags on this commit, which includes the #666 fix the previous tag lacked.
Non-releasable type so the re-run stays 2.2.0.
Fourth latent bug in the OCR publish chain (#649/#519 added it, never ran).
verify-ocr's trust-identity step read OCR_RUNTIME_INDEX_KEY_ID from the image env,
which the official image leaves unset by design (operator-override path;
runtime-index.ts reads the baked file when env is unset). It compared "" to
snapotter-ocr-2026-07 and failed a correct image. Now verifies the baked
/app/docker/ocr-runtime-trust.json, proven against the built release image.
A full audit of the remaining chain (verify, sign, verify-signed, publish)
reproduced the sign+verify path end-to-end inside the image and confirmed nothing
else breaks for v2.2.0. One latent non-ASCII canonicalization mismatch filed as
#667 (cannot fire on v2.2.0). Non-releasable type so the re-dispatch re-runs 2.2.0.
The first v2.2.0 dispatch failed at archive-security after semantic-release had
already committed its release artifacts (chore(release): 2.2.0). Undo those so
the re-dispatch regenerates them once instead of duplicating the CHANGELOG
section: restore .release-notes.md to the root, and drop the 2.2.0 entries from
CHANGELOG.md and the docs changelog. The tag and draft release were deleted, so
the fresh run re-tags on this commit, which includes the #665 fixes the previous
tag lacked. Non-releasable type so the re-run stays 2.2.0.
Two latent bugs the v2.2.0 release run surfaced, both added by #649 and never run
in a real release (v2.1.0 had no archive-security job).
archive-security asserted tsx at the workspace root, but tsx is a prod dependency
of apps/api, so pnpm places its bin at apps/api/node_modules/.bin/tsx, where the
Docker CMD runs it. The root path never existed and failed the extract step on
both arches. Fixed to the apps/api path, proven against the real prebuilt-amd64
artifact.
The blocking Trivy scans would then have failed on CVE-2026-56852,
golang.org/x/text v0.38.0 -> v0.39.0, the only fixed CRITICAL/HIGH in the image,
compiled into caire and pdfcpu. Pinned to v0.39.0 in both go-tools modules,
verified building in the golang:1.25.12 toolchain with -mod=readonly and linking
v0.39.0, with a clean Trivy rescan.
Guards added for both the tsx path and the x/text pin. Non-releasable type so a
re-dispatch re-runs 2.2.0.
Two release-pipeline defects found while pre-flighting 2.2.0, plus the image
hardening that the second one exposed.
The release job would have died immediately after pushing the v2.2.0 tag.
draftRelease was turned on in #649 and never executed, and GitHub's
/releases/tags/{tag} endpoint does not return draft releases, so all nine tag
lookups in release.yml would have 404'd against the draft semantic-release had
just created. Verified against this repo with a throwaway draft: the tag
endpoint 404s while gh release view reads it and /releases/{id} returns the same
REST shape. Every site now resolves the numeric id first, so existing jq
expressions are untouched.
The unfixed-vulnerability gate was measuring almost nothing. The blocking Trivy
steps run ignore-unfixed, and trivy-unfixed-gate.mjs was meant to cover the
remainder but defaults to CRITICAL with neither call site passing --severity. An
unfixed HIGH was gated by nothing, and the arm64 image carried 79 of them while
the summary read clean.
Rather than document 79 findings, the image lost what it did not need:
libde265 1.1.1 and libheif 1.23.1 are now built from source (the old libheif pin
was itself affected by CVE-2026-3950, and Debian's libde265 1.0.11 was the
decoder every .heic upload actually reached), and xvfb, wget and openssh-client
are purged. 15 CVEs left the image outright and the HIGH gap fell to 65, each
now carrying a rationale verified against the running container.
curl gets its own section: bookworm-backports has a fixed 8.14.1, so claiming no
fix was available would have been false. It is recorded as a declined fix.
Verified on both architectures: gate exits 0, the source-built libde265 is the
one libheif links, and HEIC, RAW, ImageMagick, Sharp AVIF and headless chromium
all still work after the purge.
The 83 X-to-Y converter pages were generated from one template with the
format names substituted in. Three of the four features and two of the
three FAQs were byte-identical across all 82 non-override presets, every
page came out at exactly 144 words, and pages within a family sat at
roughly 61% similarity with identical shingle counts. That is the
mass-produced fingerprint, and the same shape that got the docs tool
pages deduped in #662. All 83 are indexed today, so this is prevention
rather than repair.
Copy is now derived from what actually differs between the two formats:
alpha, animation, colour depth, lossy re-encode behaviour, container
reach, and where each format is genuinely accepted. png-to-jpg explains
that transparency gets flattened; gif-to-jpg warns you keep frame one
only; psd-to-svg says to export Photoshop's real vector layers instead of
tracing them.
Mean similarity across all 3,403 pairs drops from 34.8% to 6.7%, and the
uniform 144-word length is gone (206-256 words, varying). Within-family
max is roughly flat: on the built pages, image goes 62.8% to 66.1%, video
61.3% to 66.4%, audio 60.7% to 60.6%. Generated copy has a similarity
floor, and beating it inside a family would take hand-written pages. What
has gone is the identical shingle count per family, which was the
strongest tell.
Also drops the one-off eps-to-svg override: all five vectorize presets
now get honest tracing copy, not just that one.
Verified: landing builds 798 pages, zero verbatim repeats between a
page's blurb and its own features or FAQs, biome clean.
Search Console flagged four reasons on 2026-07-28: soft 404, both
duplicate-canonical variants, and noindex. All four sat on
docs.snapotter.com; the landing site was clean.
The cause was boilerplate dominance rather than a broken tag.
/tools/video/crop-video carries 1.3 KB of unique body against 3.5 KB of
identical chrome (nav, sidebar, 21-language switcher), so unrelated tool
docs measured 52-60% full-page similarity. Across 20 locales that was
3,640 of 3,822 submitted URLs. Google read the lot as one duplicate
cluster and began electing arbitrary representatives: /changelog became
the canonical for /tools/image/favicon, and /uk/guide/getting-started for
/nl/tools/image/resize. English tool docs indexed 2 of 10 and localized 4
of 10, while the landing page for those same five tools indexed 5 of 5.
Translated pages now emit `noindex, follow` with a self-canonical, and
sitemap.transformItems drops them from the sitemap. Self-canonical rather
than pointing at English, since noindex paired with a cross-canonical
sends two conflicting instructions. hreflang is removed outright: the
annotation only means something between pages that can all be indexed.
Readers see no change. The language switcher and every in-page link
behave exactly as before.
Verified against a real build: sitemap 3,822 to 182 URLs with zero
translated entries, all 3,640 translated files carrying the noindex and
no English file doing so, docs e2e 100 passed.
Bumps every version surface to 2.2.0, fixes a latent version-coupling bug in the
OCR runtime tests, and stops an absent GPU runner from silently stalling a
release.
Version surfaces: scripts/sync-version.sh covers the 11 workspaces, APP_VERSION,
and the docs release commands across all locales. Root package.json plus the
three surfaces the script never reaches are done by hand: the DOCKERHUB.md banner
and tag table, the docker-tags.md pinning table in 21 locales, and the example
runtimeVersion in tools/image/ocr.md in 21 locales. The release-notes archive step
is deliberately not pre-run, so the notes text stays editable until the release.
Latent bug: runtime-state rejects any runtime whose compatibility.snapotterVersion
is not exactly APP_VERSION, and five fixtures pinned the literal 2.1.0. Since
semantic-release rewrites APP_VERSION on every release, the first PR after any
bump would have gone red for a reason nobody would trace to the release. The
fixtures now derive from APP_VERSION.
GPU runner: sign-ocr-index needs verify-ocr-nvidia on self-hosted hardware, and
the gated manifest job needs ai-bundles, so a missing runner queued instead of
failing and produced no image tags. preflight-gpu-runner claims the same labels
with no dependencies, so it is scheduled first and validates the GPU before the
90-minute build. An API preflight is impossible because listing self-hosted
runners needs Administration:read, which GITHUB_TOKEN cannot hold, so RELEASE.md
carries the maintainer-side check.
A release-readiness QA pass over the whole product. The commits split into
defects a user would hit and gates that were reporting green while measuring
nothing.
## Fixes that change behaviour
Rate limiting was bypassable on every install: TRUST_PROXY defaulted to true, so
request.ip came from a client-set header and a forged X-Forwarded-For got past
the login limiter. The default is now a private-network trust list.
A transient Postgres outage stranded in-flight jobs, leaving finished output on
disk with no row pointing at it. A reconciler now resolves those rows and adopts
the bytes rather than dropping the work.
A Redis connection that moved to a new address wedged every read-blocked
consumer, so completions stopped signalling while health still answered 200.
Socket timeouts plus subscriber pings recover it.
Installing more than one AI bundle left the shared venv multi-versioned and
silently broke three tools. The installer now reconciles distributions to one
version each.
Converting an image to JXL at quality 1 through 4 returned a 500, because
libjxl 0.7 rejects the distance those values compute. The quality is floored at
what the encoder honours. A missing ffmpeg was also reported to the user as a
corrupt upload; it now says the engine is unavailable.
RAW uploads reached an unpatched LibRaw on arm64, so it is built from source at
0.22.2, and the release scan was split so it can fail on an unfixed critical
instead of hiding it behind ignore-unfixed.
## Gates that could not fail
Two mutation lanes ran zero mutants because Stryker crawled the gitignored docs
build; coverage discarded its whole report on any failing test; the lint gate
skipped root tests, scripts, and two workspaces; and several generated matrices
counted a host missing ffmpeg as a passing tool. Each now measures what it
claims.
Full evidence and the outstanding release items are tracked locally and are not
part of this branch.
The comment added in #652 was wrong. It said SYNC_WAIT_MS=0 drives every tool through its 202 path; it does the opposite. BullMQ arms its timer under `if (ttl)`, so 0 is falsy, waitUntilFinished waits forever and every route answers 200, matching the repo-wide convention that 0 means unlimited. A small positive value such as 1 is what forces the async path.
That error mattered: the local validation claimed for #652 exercised the synchronous path throughout and never reached settleAsyncFallback. Redone with SYNC_WAIT_MS=1, it surfaced six specs whose status gate accepts 202 but whose else branch then demands an error body a 202 never carries, a latent flake on a slow runner.
Each now settles the job first. Under a forced 1ms window the 'expected undefined to be defined' failures drop from 55 to 0, and all 1183 tests still pass on the normal 30s window. Per-shard totals unchanged at 9903 tests, 9435 passed, 468 skipped.
Specs asserting a bare 200 without listing 202 are deliberately untouched: they own the synchronous contract.
A 202 means the sync window expired while the job was still running. Tests treated it as a terminal pass: `if (isAsyncFallback(res)) return;` checked the envelope and returned, asserting nothing about the outcome and leaving the job running into the next test, which is the leak cancelAcceptedJobAndWait exists to prevent.
Because the window only expires under load, coverage tracked runner load. On CI 44 tests took this path and verified nothing; the same tests on a dev machine asserted in full (one measured 6.4s locally against 31s on CI).
settleAsyncFallback waits for a terminal state and asserts the job finished, and that a failure carries a message rather than being a crash. A clean failure stays valid, since the exotic-format fixtures are meant to be rejected. All 82 call sites moved over.
per-fork-env no longer floors SYNC_WAIT_MS, so forcing it to 0 drives every request through its 202 path. 570 tests were validated that way and matched their normal-window results exactly.
The 29-34s band dropped from 44 tests (23.4% of test time) to 6 (3.0%). Total test time rose 5.8% and CI wall went 12.8 to 13.1 min: the forks were doing real work during that wait, so this buys determinism, not speed. Per-shard totals unchanged at 9903 tests, 9435 passed, 468 skipped.
Vitest shards by file and runs a file's tests serially in one fork, so a single spec set the floor for the whole Integration job no matter how many shards or forks it got. Cost-aware sharding (#650) balanced the shards but could not get under that floor.
Split the three specs that exceeded it: format-matrix-comprehensive (1365s) into 4 by describe, format-matrix (1130s) into 4 with Cross-format matrix striped over FORMAT_SAMPLES, and format-matrix-generated (779s) into 3 striped over TOOLS. Largest spec is now 370s. Each preamble moved verbatim into a sibling .shared.ts exposing setupMatrixApp().
Integration shards went from 20m59s/17m55s/16m33s/9m19s to 11m44s/12m31s/10m37s/11m1s.
Coverage checked, not assumed: the set of test names collected by vitest list is byte-identical across the split, 2151 before and 2151 after. Per-shard totals matched the baseline exactly at 9903 tests, 9435 passed, 468 skipped.
Vitest's BaseSequencer sorts specs by SHA1 of their path and slices an equal number of files per shard, which is blind to how long each one takes. That dropped the four costliest generated matrix specs into a single shard: 24m47s against shard 1's 3m47s.
Partition by measured cost instead, greedy longest-processing-time-first. CI wall goes 25 min to 21.3 min. The remaining ceiling is that `format-matrix-comprehensive` and `format-matrix` are each one indivisible file, and tests within a file run sequentially in a single fork.
Coverage is unchanged by construction. The partition is total and disjoint, guarded over the real spec list for shard counts 1 through 8. Per-shard totals on the PR run matched the baseline exactly: 297 files, 9903 tests, 9435 passed, 468 skipped.
