@bevel-software/platform-core-backend 0.29.0 → 0.30.0

package/src/modules/workflow/git/git.service.ts

@@ -25,6 +25,7 @@ import { WorkspaceMutex } from '../../kb-fs/mutex.js';
 import { isAbsence } from '../../../shared/fs.contract.js';
 import { assertInsideRepo } from '../../kb-fs/repo-path.js';
 import { cloneTrackingConfigArgs, SAFE_IMPLICIT_FETCH_ARGS } from '../../kb-fs/clone-config.js';
+import { readRefSha } from '../../kb-fs/index.js';
 import {
   assertValidBranchName,
   assertValidRelativePath,
@@ -294,6 +295,25 @@ export class GitService implements IGitService {
   // counts, calm under large branch lists.
   private static readonly MAX_AHEAD_BEHIND_CONCURRENCY = 8;
 
+  /**
+   * A change request's changed entries, keyed by the two commits its diff
+   * was read between. Two commits never change, and neither does the
+   * merge-base between them, so the three-dot diff of a pair is a fact: a
+   * push moves a tip, the pair changes, the old entry is simply never asked
+   * for again. No TTL, no invalidation.
+   *
+   * This is what a change-request listing was paying git for on every read:
+   * one `diff` per open request, polled every minute and refetched on every
+   * event, where nothing had moved. Now git is asked once per pair, which is
+   * once per push. Keyed by commits alone, not by workspace: every clone of
+   * the knowledge base holds the same objects, so the answer is the same in
+   * all of them. Bounded FIFO; the bound only caps memory.
+   */
+  private readonly changedEntriesByCommits = new Map<string, NameStatusEntry[]>();
+  /** Diffs being read right now, so concurrent misses on one pair share one `git diff`. */
+  private readonly changedEntriesInFlight = new Map<string, Promise<NameStatusEntry[]>>();
+  private static readonly CHANGED_ENTRIES_MAX = 4096;
+
   constructor(
     private readonly workspaceService: WorkspaceService,
     /**
@@ -378,7 +398,9 @@ export class GitService implements IGitService {
    * above rather than kept separately, so it cannot disagree with it.
    */
   lastRemoteContact(): { at: number; ok: boolean } | null {
-    let latest: { at: number; ok: boolean } | null = null;
+    // The repository's fetches are every worktree's; the per-workspace record
+    // is a full clone's.
+    let latest: { at: number; ok: boolean } | null = this.workspaceService.repository?.lastContact() ?? null;
     for (const [workspaceId, at] of this.lastImplicitFetchAt) {
       if (latest === null || at > latest.at) {
         latest = { at, ok: this.lastImplicitFetchOk.get(workspaceId) ?? false };
@@ -495,12 +517,27 @@ export class GitService implements IGitService {
       // Union local heads with origin's remote-tracking refs: a fresh per-user
       // clone only has one local head (HEAD's default), so without this we'd hide
       // target-company-state and every draft pushed by another user.
+      //
+      // The workspace is a worktree of the one repository, which holds every
+      // OTHER worktree's local branch too. Those are not this workspace's: a
+      // clone never had them. A local head checked out in another worktree
+      // is read as that branch's remote-tracking ref alone (and not at all
+      // once origin no longer has it), so a branch deleted on origin is not
+      // kept alive by its own worktree's local ref — the orphan sweep reads
+      // this list. A branch is checked out in at most one worktree, so "not
+      // this one's HEAD" is "another's".
       const { stdout } = await this.git(cwd, [
         'for-each-ref',
-        '--format=%(refname:short)%09%(refname)',
+        '--format=%(refname:short)%09%(refname)%09%(worktreepath)',
         'refs/heads',
         'refs/remotes/origin',
       ]);
+      const ownBranch = (
+        await this.git(cwd, ['symbolic-ref', '--quiet', '--short', 'HEAD']).then(
+          (r) => r.stdout,
+          () => '',
+        )
+      ).trim();
 
       type Row = { shortName: string; ref: string; hasLocal: boolean; hasRemote: boolean };
       const buckets = new Map<string, Row>();
@@ -510,7 +547,7 @@ export class GitService implements IGitService {
         const tab = trimmed.indexOf('\t');
         if (tab < 0) continue;
         const rawShort = trimmed.slice(0, tab);
-        const ref = trimmed.slice(tab + 1);
+        const [ref = '', worktreePath = ''] = trimmed.slice(tab + 1).split('\t');
         if (!rawShort || !ref) continue;
         // Skip symbolic refs up-front. Different git versions report
         // `refs/remotes/origin/HEAD` as either `origin` (older) or `origin/HEAD`
@@ -521,6 +558,7 @@ export class GitService implements IGitService {
         const isLocal = ref.startsWith('refs/heads/');
         const shortName = isLocal ? rawShort : rawShort.replace(/^origin\//, '');
         if (!shortName) continue;
+        if (isLocal && worktreePath !== '' && shortName !== ownBranch) continue;
         // Final guard: the strip above turns `origin/HEAD` into `HEAD`. Even
         // if a future git version lands us here, don't bucket it as a branch.
         if (shortName === 'HEAD') continue;
@@ -614,6 +652,20 @@ export class GitService implements IGitService {
     workspaceId: string,
     force = false,
   ): Promise<boolean> {
+    // A worktree's remote-tracking refs are the repository's: ONE fetch for
+    // every workspace, throttled, joined and reserved there. The per-workspace
+    // record below is for a full clone from an earlier release, which fetches
+    // on its own until the boot phase converts it.
+    const repository = (await this.workspaceService.repositoryOfCheckout?.(cwd)) ?? null;
+    if (repository) {
+      return repository.fetch({
+        maxAgeMs: GitService.IMPLICIT_FETCH_TTL_MS,
+        // A host that is down is not asked again by every poll inside the
+        // window, as the per-workspace record below stamps a failure too.
+        failureBackoffMs: GitService.IMPLICIT_FETCH_TTL_MS,
+        force,
+      });
+    }
     const last = this.lastImplicitFetchAt.get(workspaceId) ?? 0;
     if (!force && Date.now() - last < GitService.IMPLICIT_FETCH_TTL_MS) {
       return this.lastImplicitFetchOk.get(workspaceId) ?? true;
@@ -692,8 +744,9 @@ export class GitService implements IGitService {
       // navigation to the new draft's URL fails with
       // "Remote branch <name> not found in upstream origin". Roll the local
       // ref back on failure so a retry isn't blocked by "branch already exists".
+      // No `-u`: the local head is dropped right below, and its upstream with it.
       try {
-        await this.git(cwd, ['push', '-u', 'origin', name]);
+        await this.git(cwd, ['push', 'origin', name]);
       } catch (err) {
         await this.git(cwd, ['branch', '-D', name]).catch(() => undefined);
         throw err;
@@ -829,7 +882,14 @@ export class GitService implements IGitService {
       let localTip: string | null = null;
       if (await this.refExists(cwd, `refs/heads/${name}`)) {
         localTip = await this.revParseOrNull(cwd, `refs/heads/${name}`);
-        await this.git(cwd, ['branch', '-D', name]);
+        await this.git(cwd, ['branch', '-D', name]).catch((err: unknown) => {
+          // In a repository of worktrees the branch's local ref is shared, and
+          // git keeps it while the branch's own workspace has it checked out.
+          // Removing that workspace — which the caller does next — takes the
+          // worktree and the ref with it.
+          if (/checked out at|used by worktree/i.test(err instanceof Error ? err.message : String(err))) return;
+          throw err;
+        });
       }
       return { lastCommit: remoteTip ?? localTip };
     });
@@ -1409,7 +1469,14 @@ export class GitService implements IGitService {
         );
       }
 
-      await this.git(cwd, ['push', '-u', 'origin', branch]);
+      // No `-u`: it writes the upstream into the config during the push, and
+      // a worktree's config is the repository's, shared by every workspace —
+      // git refuses a second writer of it rather than waiting. The upstream is
+      // stamped after the push instead, as one short write made as the
+      // repository's administrator (see `git`).
+      await this.git(cwd, ['push', 'origin', branch]);
+      await this.git(cwd, ['config', '--replace-all', `branch.${branch}.remote`, 'origin']);
+      await this.git(cwd, ['config', '--replace-all', `branch.${branch}.merge`, `refs/heads/${branch}`]);
     }
   }
 
@@ -3166,9 +3233,8 @@ export class GitService implements IGitService {
       await this.fetchPrRefs(cwd, baseBranch, headBranch);
     }
     return this.mutex.run(workspaceId, async () => {
-      const baseRef = pinned ? pinned.base : await this.resolvePublishedBranchRef(cwd, baseBranch);
-      const headRef = pinned ? pinned.head : await this.resolvePublishedBranchRef(cwd, headBranch);
-      return this.prChangedPathsAt(cwd, baseRef, headRef, opts);
+      const at = pinned ?? (await this.publishedPrEnds(cwd, baseBranch, headBranch));
+      return flattenChangedPaths(await this.prChangedEntriesBetweenCommits(cwd, at.base, at.head), opts);
     });
   }
 
@@ -3243,13 +3309,51 @@ export class GitService implements IGitService {
       await this.fetchPrRefs(cwd, baseBranch, headBranch);
     }
     return this.mutex.run(workspaceId, async () => {
-      const baseRef = pinned ? pinned.base : await this.resolvePublishedBranchRef(cwd, baseBranch);
-      const headRef = pinned ? pinned.head : await this.resolvePublishedBranchRef(cwd, headBranch);
-      const entries = await this.prChangedEntriesAt(cwd, baseRef, headRef);
+      const at = pinned ?? (await this.publishedPrEnds(cwd, baseBranch, headBranch));
+      const entries = await this.prChangedEntriesBetweenCommits(cwd, at.base, at.head);
       return { paths: flattenChangedPaths(entries, {}), pairs: changedPathPairs(entries) };
     });
   }
 
+  /**
+   * {@link prChangedEntriesAt} for a pair of COMMITS, read once per pair
+   * (see `changedEntriesByCommits`). The caller holds the reservation, as for
+   * `prChangedEntriesAt`; a memo hit holds it for nothing, which is cheaper
+   * than a second code path around the lock.
+   */
+  private async prChangedEntriesBetweenCommits(
+    cwd: string,
+    baseSha: string,
+    headSha: string,
+  ): Promise<NameStatusEntry[]> {
+    const key = `${baseSha}\0${headSha}`;
+    const known = this.changedEntriesByCommits.get(key);
+    if (known) return known;
+    let pending = this.changedEntriesInFlight.get(key);
+    if (!pending) {
+      pending = this.prChangedEntriesAt(cwd, baseSha, headSha)
+        .then((entries) => {
+          if (this.changedEntriesByCommits.size >= GitService.CHANGED_ENTRIES_MAX) {
+            const oldest = this.changedEntriesByCommits.keys().next().value;
+            if (oldest !== undefined) this.changedEntriesByCommits.delete(oldest);
+          }
+          this.changedEntriesByCommits.set(key, entries);
+          return entries;
+        })
+        .finally(() => {
+          if (this.changedEntriesInFlight.get(key) === pending) this.changedEntriesInFlight.delete(key);
+        });
+      // Same bound as the memo: evicting an in-flight entry costs at most one
+      // redundant diff for that pair, never a lost answer.
+      if (this.changedEntriesInFlight.size >= GitService.CHANGED_ENTRIES_MAX) {
+        const oldest = this.changedEntriesInFlight.keys().next().value;
+        if (oldest !== undefined) this.changedEntriesInFlight.delete(oldest);
+      }
+      this.changedEntriesInFlight.set(key, pending);
+    }
+    return pending;
+  }
+
   /**
    * The merge-base commit of a change request's two branches (their origin
    * refs), or null when they share no history. This is the "before" the CR's
@@ -3590,16 +3694,23 @@ export class GitService implements IGitService {
     baseBranch: string,
     headBranch: string,
   ): Promise<{ base: string; head: string } | null> {
-    const shas: string[] = [];
-    for (const branch of [baseBranch, headBranch]) {
-      try {
-        shas.push((await this.resolvePublishedBranch(cwd, branch)).sha);
-      } catch (err) {
-        if (err instanceof WorkflowValidationError) return null;
-        throw err;
-      }
+    try {
+      return await this.publishedPrEnds(cwd, baseBranch, headBranch);
+    } catch (err) {
+      if (err instanceof WorkflowValidationError) return null;
+      throw err;
     }
-    return { base: shas[0], head: shas[1] };
+  }
+
+  /** The two commits a change request is read between, each resolved as {@link resolvePublishedBranch} does. */
+  private async publishedPrEnds(
+    cwd: string,
+    baseBranch: string,
+    headBranch: string,
+  ): Promise<{ base: string; head: string }> {
+    const base = (await this.resolvePublishedBranch(cwd, baseBranch)).sha;
+    const head = (await this.resolvePublishedBranch(cwd, headBranch)).sha;
+    return { base, head };
   }
 
   /**
@@ -3625,6 +3736,13 @@ export class GitService implements IGitService {
     branch: string,
   ): Promise<{ ref: string; sha: string }> {
     for (const ref of [`refs/remotes/origin/${branch}`, `refs/heads/${branch}`]) {
+      // The ref file first (`readRefSha`): no process, same answer, same
+      // freshness. Git is asked only for what the files cannot decide — a
+      // missing ref is decided by the files and the loop moves on; an
+      // unreadable one is git's to answer, as the authority.
+      const fromFiles = await readRefSha(cwd, ref);
+      if (fromFiles === 'missing') continue;
+      if (fromFiles !== 'unreadable') return { ref, sha: fromFiles.sha };
       try {
         const { stdout } = await this.git(cwd, ['rev-parse', '--verify', '--quiet', ref]);
         return { ref, sha: stdout.trim() };
@@ -4097,7 +4215,7 @@ export class GitService implements IGitService {
    * from a real failure are unaffected.
    */
   private git(cwd: string, args: string[], opts?: Omit<GitRunOptions, 'encoding'>): Promise<GitRunResult> {
-    return this.gitRunner.run(cwd, args, {
+    const run = () => this.gitRunner.run(cwd, args, {
       ...opts,
       // `GIT_LITERAL_PATHSPECS=1` makes git treat every pathspec literally
       // instead of interpreting `[`, `]`, `*`, `?`, `!`, or `:(magic)` as glob
@@ -4112,6 +4230,18 @@ export class GitService implements IGitService {
       // a search for a file literally named that.
       env: { GIT_LITERAL_PATHSPECS: '1', ...opts?.env },
     });
+    // A write to the git config is a write to the ONE file every worktree of
+    // the repository shares, which git refuses a second writer of rather than
+    // waiting: it runs as the repository's administrator. Everything else —
+    // a fetch, a commit, a branch delete — git serializes with its own locks,
+    // as it does for any two worktrees of one repository.
+    return writesSharedConfig(args) ? this.asRepositoryAdministrator(cwd, run) : run();
+  }
+
+  /** `run` as the repository's administrator when `cwd` is a worktree of it; as itself for a full clone. */
+  private async asRepositoryAdministrator<T>(cwd: string, run: () => Promise<T>): Promise<T> {
+    const repository = (await this.workspaceService.repositoryOfCheckout?.(cwd)) ?? null;
+    return repository ? repository.exclusive(run) : run();
   }
 
   /**
@@ -4299,3 +4429,35 @@ export function parseNumstatZ(out: string): NumstatEntry[] {
   }
   return entries;
 }
+
+/**
+ * Whether a git command WRITES the config — the one file every worktree of
+ * the knowledge base's repository shares, which git refuses a second writer
+ * of rather than waiting — and so must run as the repository's administrator
+ * (`IKbRepository.exclusive`): a `config` that sets or unsets, a `remote`
+ * change, a branch rename, delete or upstream change (its config section is
+ * written, or removed with the branch), a push that sets the upstream. Reads
+ * of the config are not writes. Nothing else is: the refs, `packed-refs` and
+ * the object store are locked by git itself, and the worktree list is the
+ * repository's own to serialize (`KbRepository`).
+ *
+ * Leading `-c key=value` / `-C dir` options are skipped to find the subcommand.
+ */
+function writesSharedConfig(args: readonly string[]): boolean {
+  let i = 0;
+  while (i < args.length && (args[i] === '-c' || args[i] === '-C')) i += 2;
+  const sub = args[i];
+  const rest = args.slice(i + 1);
+  switch (sub) {
+    case 'remote':
+      return true;
+    case 'config':
+      return !rest.some((a) => /^(--get|--get-all|--get-regexp|--list|-l|--show-origin)$/.test(a));
+    case 'branch':
+      return rest.some((a) => /^(-d|-D|--delete|-m|-M|--move|-u|--set-upstream-to=.*|--unset-upstream)$/.test(a));
+    case 'push':
+      return rest.some((a) => a === '-u' || a === '--set-upstream');
+    default:
+      return false;
+  }
+}

package/src/modules/workflow/workflow-hooks.ts

@@ -65,7 +65,7 @@ export interface AgentOperationContext {
   sessionId?: string;
   /**
    * The workspace-relative path the operation targets. Absent for a
-   * write-capable operation with no resolvable target (`execute_command`).
+   * write-capable operation with no resolvable target.
    */
   wsPath?: string;
   /** The branch (draft) whose workspace the operation acts on. */

package/src/modules/workspace/__tests__/agent-downloads.test.ts

@@ -22,7 +22,6 @@ import { WorkflowHooks } from '../../workflow/workflow-hooks.js';
 import { ToolDescriptionNotes } from '../agent-access.gate.js';
 import { SpillStore } from '../spill-store.js';
 import { DocExtractService } from '../file-readers/doc-extract.service.js';
-import { WorkspaceService } from '../workspace.service.js';
 import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
 import { AgentDownloadStore, DOWNLOAD_TOKEN_REFUSAL } from '../agent-download.store.js';
 import { attachmentDisposition, createAgentDownloadRoutes, createDownloadFetcherIdentifier } from '../agent-download.routes.js';
@@ -31,6 +30,7 @@ import jwt from 'jsonwebtoken';
 import { buildDownload, DOWNLOAD_PERMISSION_REQUIRED, NOT_FOUND } from '../agent-download.builder.js';
 import { READ_ONLY_CODE, type IWriteAccess } from '../../write-access/write-access.js';
 import { sharedFileRules } from '../../agent-instructions/shared-file-rules.js';
+import { newWorkspaceService } from '../../../__tests__/workspace-service.js';
 
 /**
  * `request_file_download` end to end, over the REAL access resolver on a
@@ -136,7 +136,7 @@ async function start(options: StartOptions = {}): Promise<Started> {
     await mkdir(dirname(abs), { recursive: true });
     await writeFile(abs, contents);
   }
-  const workspaceService = new WorkspaceService(
+  const workspaceService = newWorkspaceService(
     root,
     'https://example.invalid/kb.git',
     testKbContext({ kbDirName: KB }),

package/src/modules/workspace/__tests__/bounded-matcher.test.ts

@@ -0,0 +1,213 @@
+import { Worker } from 'node:worker_threads';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { WorkerPatternMatcher, type WorkerPatternMatcherOptions } from '../bounded-matcher.js';
+import { PatternTooExpensiveError } from '../pattern-matcher.contract.js';
+
+/** The QA finding's pattern, and a 40-character line it backtracks on for ever. */
+const CATASTROPHIC = '^(a+)+$';
+const LONG_LINE = `${'a'.repeat(39)}!`;
+/** The ticket's per-search budget (Razvan, 2026-10-15). */
+const FIVE_SECONDS = 5_000;
+
+let matchers: WorkerPatternMatcher[] = [];
+/** A matcher of the test's own, closed after it — the defaults unless a test says otherwise. */
+function matcher(opts?: WorkerPatternMatcherOptions): WorkerPatternMatcher {
+  const m = new WorkerPatternMatcher(opts);
+  matchers.push(m);
+  return m;
+}
+afterEach(async () => {
+  await Promise.all(matchers.map((m) => m.close()));
+  matchers = [];
+});
+
+/**
+ * The longest the event loop went without running a timer while `work` ran.
+ * A pattern run on the loop would show the whole match time here.
+ */
+async function longestStall(work: () => Promise<unknown>): Promise<number> {
+  let last = Date.now();
+  let worst = 0;
+  const tick = setInterval(() => {
+    const now = Date.now();
+    worst = Math.max(worst, now - last);
+    last = now;
+  }, 10);
+  try {
+    await work().catch(() => {});
+  } finally {
+    clearInterval(tick);
+  }
+  return Math.max(worst, Date.now() - last);
+}
+
+describe('WorkerPatternMatcher', () => {
+  it('stops a catastrophic pattern over a 40-character line with the worded 400 in its 5 s budget, and never stalls the loop', async () => {
+    expect(LONG_LINE).toHaveLength(40);
+    const started = Date.now();
+    let caught: unknown;
+    const stall = await longestStall(async () => {
+      try {
+        await matcher().search(CATASTROPHIC, '').matchingLines([LONG_LINE], 200);
+      } catch (err) {
+        caught = err;
+      }
+    });
+    const took = Date.now() - started;
+    expect(caught).toBeInstanceOf(PatternTooExpensiveError);
+    expect((caught as PatternTooExpensiveError).status).toBe(400);
+    expect((caught as Error).message).toMatch(/^Pattern too expensive: /);
+    expect((caught as Error).message).toContain('simpler pattern');
+    expect((caught as Error).message).toContain("this search's 5 s budget");
+    expect(took).toBeGreaterThanOrEqual(FIVE_SECONDS - 100);
+    expect(took).toBeLessThan(FIVE_SECONDS + 2_000);
+    expect(stall).toBeLessThan(500);
+  });
+
+  it('answers ordinary patterns with exactly the lines RegExp#test matches', async () => {
+    const m = matcher();
+    const lines = ['hello world', 'Getting started', 'aaa', 'line 42', '', 'foo|bar', 'bar baz', LONG_LINE];
+    for (const [source, flags] of [
+      ['world', ''],
+      ['^aaa$', ''],
+      ['getting started', 'i'],
+      ['[0-9]+', ''],
+      ['foo|baz', ''],
+      ['^$', ''],
+      ['a+!$', ''],
+    ] as const) {
+      const re = new RegExp(source, flags);
+      const expected = lines.flatMap((l, i) => (re.test(l) ? [i] : []));
+      expect(await m.search(source, flags).matchingLines(lines, 1000), `/${source}/${flags}`).toEqual(expected);
+    }
+  });
+
+  it('returns only the first `limit` matches', async () => {
+    expect(await matcher().search('x', '').matchingLines(['x', 'y', 'x', 'x'], 2)).toEqual([0, 2]);
+  });
+
+  it('refuses a sizing that could never serve a search when it is built, not when a search hangs on it', () => {
+    expect(() => new WorkerPatternMatcher({ poolMax: 0 })).toThrow(/poolMax must be an integer from 1 /);
+    // Past the longest delay setTimeout honours, the timer would fire after 1 ms and stop every search.
+    expect(() => new WorkerPatternMatcher({ budgetMs: 2_147_483_647 })).toThrow(/budgetMs must be an integer from 1 to 2147483397/);
+    expect(() => new WorkerPatternMatcher({ poolMax: 1.5 })).toThrow(RangeError);
+    expect(() => new WorkerPatternMatcher({ budgetMs: 0 })).toThrow(/budgetMs/);
+    expect(() => new WorkerPatternMatcher({ maxWaiting: -1 })).toThrow(/maxWaiting/);
+    expect(() => new WorkerPatternMatcher({ batchChars: Number.NaN })).toThrow(/batchChars/);
+    expect(() => new WorkerPatternMatcher({ batchLines: 0 })).toThrow(/batchLines/);
+    expect(() => matcher({ maxWaiting: 0 })).not.toThrow();
+  });
+
+  it('serves an ordinary search under the largest budget the timer can hold', async () => {
+    expect(await matcher({ budgetMs: 2_147_483_647 - 250 }).search('b', '').matchingLines(['a', 'b'], 10)).toEqual([1]);
+  });
+
+  it('refuses invalid syntax with the 400 grep always gave', () => {
+    expect(() => matcher().search('(', '')).toThrow(/^Invalid regex: /);
+  });
+
+  it('refuses a pattern too long to compile on the request thread, and accepts one at the limit', () => {
+    const m = matcher({ maxPatternLength: 10 });
+    expect(() => m.search('a'.repeat(11), '')).toThrow(/^Pattern too long: /);
+    expect(() => m.search('a'.repeat(10), '')).not.toThrow();
+  });
+
+  it('hands a large file over in batches and answers the same line numbers, up to `limit`', async () => {
+    const m = matcher({ batchChars: 100 });
+    const filler = 'x'.repeat(9);
+    const lines = Array.from({ length: 250 }, (_, i) => (i % 7 === 0 ? `hit ${i}` : filler));
+    const expected = lines.flatMap((l, i) => (l.startsWith('hit') ? [i] : []));
+    expect(expected.at(-1)! * filler.length).toBeGreaterThan(200);
+    expect(await m.search('^hit', '').matchingLines(lines, 10_000)).toEqual(expected);
+    expect(await m.search('^hit', '').matchingLines(lines, 3)).toEqual(expected.slice(0, 3));
+  });
+
+  it('caps a batch by its line count too, so a file of empty lines never goes over in one message', async () => {
+    const m = matcher({ batchLines: 100 });
+    const lines = Array.from({ length: 1_050 }, (_, i) => (i % 97 === 0 ? 'hit' : ''));
+    const expected = lines.flatMap((l, i) => (l === 'hit' ? [i] : []));
+    const posted = vi.spyOn(Worker.prototype, 'postMessage');
+    try {
+      expect(await m.search('^hit$', '').matchingLines(lines, 10_000)).toEqual(expected);
+      expect(await m.search('^$', '').matchingLines(lines, 10_000)).toHaveLength(lines.length - expected.length);
+      const postedLines = posted.mock.calls.map(([msg]) => ((msg as { lines?: string[] }).lines ?? []).length);
+      expect(postedLines.filter((n) => n > 0)).toHaveLength(2 * 11);
+      expect(Math.max(...postedLines)).toBeLessThanOrEqual(100);
+    } finally {
+      posted.mockRestore();
+    }
+  });
+
+  it('hands a line longer than one batch over in shared memory, never in a message, and matches it exactly', async () => {
+    const m = matcher({ batchChars: 100 });
+    // A lone surrogate included: the line must reach the worker code unit for code unit.
+    const long = `${'x'.repeat(1_000)}\uD800 tail ${'y'.repeat(500)}`;
+    const lines = ['short', long, 'z'.repeat(400), 'end tail'];
+    const posted = vi.spyOn(Worker.prototype, 'postMessage');
+    try {
+      for (const pattern of ['tail', '\\uD800 tail', '^x+\\uD800', 'y{500}$', '^z+$', 'nowhere']) {
+        const re = new RegExp(pattern);
+        const expected = lines.flatMap((l, i) => (re.test(l) ? [i] : []));
+        expect(await m.search(pattern, '').matchingLines(lines, 10_000)).toEqual(expected);
+      }
+      const postedChars = posted.mock.calls.map(([msg]) =>
+        ((msg as { lines?: string[] }).lines ?? []).reduce((n, l) => n + l.length, 0),
+      );
+      expect(postedChars.length).toBeGreaterThan(0);
+      expect(Math.max(...postedChars)).toBeLessThanOrEqual(100);
+    } finally {
+      posted.mockRestore();
+    }
+  });
+
+  it('refuses a search with 503 once the queue for a worker is full, rather than holding its lines', async () => {
+    const m = matcher({ budgetMs: 500, poolMax: 2, maxWaiting: 2 });
+    // Every worker held by a pattern that runs out its budget, the queue filled behind them.
+    const holding = Promise.allSettled(Array.from({ length: 2 }, () => m.search(CATASTROPHIC, '').matchingLines([LONG_LINE], 1)));
+    await new Promise((r) => setTimeout(r, 100));
+    const queued = Array.from({ length: 2 }, () => m.search('b', '').matchingLines(['b'], 1));
+    await expect(m.search('b', '').matchingLines(['b'], 1)).rejects.toMatchObject({
+      status: 503,
+      details: { code: 'search_busy' },
+    });
+    // The queued searches are served once the workers come free.
+    expect(await Promise.all(queued)).toEqual(queued.map(() => [0]));
+    expect((await holding).every((r) => r.status === 'rejected')).toBe(true);
+  });
+
+  it('stops two expensive searches at once, and a search started meanwhile still answers', async () => {
+    const m = matcher({ budgetMs: 500 });
+    const results = await Promise.allSettled([
+      m.search(CATASTROPHIC, '').matchingLines([LONG_LINE], 10),
+      m.search('(a|aa)+$', '').matchingLines([`${'a'.repeat(60)}!`], 10),
+      m.search('aaa', '').matchingLines(['xaaay'], 10),
+    ]);
+    expect(results[0]).toMatchObject({ status: 'rejected', reason: expect.any(PatternTooExpensiveError) });
+    expect(results[1]).toMatchObject({ status: 'rejected', reason: expect.any(PatternTooExpensiveError) });
+    expect(results[2]).toEqual({ status: 'fulfilled', value: [0] });
+    // The terminated workers were replaced: the pool still serves.
+    expect(await m.search('b', '').matchingLines(['a', 'b'], 10)).toEqual([1]);
+  });
+
+  it('ends its workers on close: a search running then, and one after, is answered busy', async () => {
+    const m = matcher();
+    const running = m.search(CATASTROPHIC, '').matchingLines([LONG_LINE], 1);
+    await new Promise((r) => setTimeout(r, 100));
+    const started = Date.now();
+    await m.close();
+    await expect(running).rejects.toMatchObject({ status: 503, details: { code: 'search_busy' } });
+    expect(Date.now() - started).toBeLessThan(1_000);
+    await expect(m.search('b', '').matchingLines(['b'], 1)).rejects.toMatchObject({ status: 503 });
+  });
+
+  it('answers busy at once when closed while a long line is still being written to shared memory', async () => {
+    // A line of a million characters written ten at a time: many turns of the loop to close in.
+    const m = matcher({ budgetMs: 3_000, batchChars: 10 });
+    const running = m.search('nowhere', '').matchingLines(['a'.repeat(1_000_000)], 1);
+    await new Promise((r) => setTimeout(r, 20));
+    const started = Date.now();
+    await m.close();
+    await expect(running).rejects.toMatchObject({ status: 503, details: { code: 'search_busy' } });
+    expect(Date.now() - started).toBeLessThan(1_000);
+  });
+});