@jterrazz/test 18.0.3 → 18.1.0

package/dist/config.js

@@ -19,10 +19,16 @@ var standard_default = defineStandard({ test: {
 		"mobile",
 		"website"
 	],
-	projects: { unit: {
-		isolate: false,
-		reason: "a module test leaves no state behind in a module, so a worker runs its files in one module graph"
-	} }
+	projects: {
+		lint: {
+			isolate: false,
+			reason: "a lint spec lays its own fixture tree and runs the linters as processes of their own, so a worker runs its files in one module graph"
+		},
+		unit: {
+			isolate: false,
+			reason: "a module test leaves no state behind in a module, so a worker runs its files in one module graph"
+		}
+	}
 } });
 //#endregion
 //#region lint/kit/project/loaded-packages.ts

package/dist/in-place.global-setup.js

@@ -1,5 +1,5 @@
 import { i as writePendingRewrites } from "./shared-in-place.js";
-import { u as VITEST_ARTIFACTS_DIR } from "./shared-artifacts.js";
+import { d as VITEST_ARTIFACTS_DIR } from "./shared-artifacts.js";
 import { t as setupEntry } from "./shared-setup-entry.js";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";

package/dist/index.d.ts

@@ -227,7 +227,7 @@ declare class CliResult extends BaseResult {
   get filesystem(): FilesystemAccessor;
   /** The requests the binary sent the declared backend during the run, in order, each `{ body, headers, method, url }`, the body parsed when JSON; empty without a backend. */
   get requests(): SentRequest[];
-  /** A container the command spawned, by its name-label; `.exists` is `false` when none carries it. */
+  /** A container the command spawned, by its name-label; `.exists` is `false` when none carries it, and two carrying it are refused. */
   container(name: string): ContainerAccessor;
   /** All captured container IDs. Triggers the same lazy query as `container()`. */
   get containerIds(): string[];

package/dist/index.js

@@ -572,19 +572,25 @@ var CliResult = class extends BaseResult {
 			headers: { ...request.headers }
 		}));
 	}
-	/** A container the command spawned, by its name-label; `.exists` is `false` when none carries it. */
+	/** A container the command spawned, by its name-label; `.exists` is `false` when none carries it, and two carrying it are refused. */
 	container(name) {
-		const captured = this.capturedContainers("container").get(name);
+		const [captured, ...others] = this.capturedContainers("container").get(name) ?? [];
 		if (!captured) return containerAt(null, null, this.testDir, this.transform);
+		if (others.length > 0) throw new Error(refusal$1({
+			fix: "give each container of the run its own name-label value, or read them by id: `result.containerIds`, then `docker(id)`",
+			found: `CliResult.container('${name}'), which ${String(others.length + 1)} containers of the run carry: ${[captured, ...others].map(described).join(", ")}`,
+			read: "docs/guides/cli-specs.md#docker-aware-mode",
+			why: "A name reads one container, and two carrying it leave which one unsaid."
+		}));
 		return containerAt(captured.id, captured.inspect, this.testDir, this.transform);
 	}
 	/** All captured container IDs. Triggers the same lazy query as `container()`. */
 	get containerIds() {
-		return [...this.capturedContainers("containerIds").values()].map((c) => c.id);
+		return [...this.capturedContainers("containerIds").values()].flat().map((c) => c.id);
 	}
 	async [Symbol.asyncDispose]() {
 		if (!this.dockerConfig || this.testRunId === void 0) return;
-		const ids = this.containersCache === null ? this.containers.labelled(this.dockerConfig.testRunLabel, this.testRunId) : [...this.containersCache.values()].map((c) => c.id);
+		const ids = this.containersCache === null ? this.containers.labelled(this.dockerConfig.testRunLabel, this.testRunId) : [...this.containersCache.values()].flat().map((c) => c.id);
 		this.containers.remove(ids);
 	}
 	capturedContainers(member) {
@@ -606,15 +612,19 @@ var CliResult = class extends BaseResult {
 			}
 			const nameValue = labelsOf(inspect)[nameLabel];
 			const key = typeof nameValue === "string" && nameValue.length > 0 ? nameValue : id;
-			map.set(key, {
+			map.set(key, [...map.get(key) ?? [], {
 				id,
 				inspect
-			});
+			}]);
 		}
 		this.containersCache = map;
 		return map;
 	}
 };
+function described({ id, inspect }) {
+	const name = fieldOf(inspect, "Name");
+	return typeof name === "string" ? `${id} (${name.slice(1)})` : id;
+}
 function labelsOf(inspect) {
 	const labels = fieldOf(fieldOf(inspect, "Config", "config"), "Labels", "labels");
 	return isRecord(labels) ? labels : {};

package/dist/services.js

@@ -3,7 +3,7 @@ import { n as refusal, t as invariant } from "./shared-refusal.js";
 import { t as pause } from "./shared-pause.js";
 import { n as processService, t as ProcessHandle } from "./shared-process.adapter.js";
 import { n as requireBuiltPeer, t as loadPeer } from "./shared-peer.js";
-import { l as SQLITE_TEMPLATE_DIR } from "./shared-artifacts.js";
+import { u as SQLITE_TEMPLATE_DIR } from "./shared-artifacts.js";
 import { t as SERVICE_IMAGES } from "./shared-service-images.js";
 import { closeSync, copyFileSync, existsSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, writeSync } from "node:fs";
 import { join, resolve } from "node:path";

package/dist/shared-appium.adapter.js

@@ -1,6 +1,6 @@
 import { n as refusal } from "./shared-refusal.js";
 import { n as untilDeadline } from "./shared-pause.js";
-import { d as evidenceFile } from "./shared-artifacts.js";
+import { f as evidenceFile } from "./shared-artifacts.js";
 import { n as SERVER_CALL_TIMEOUT_MS } from "./shared-session-ledger.js";
 import { c as scopeChain } from "./shared-landmarks.js";
 import { a as ambiguityError, c as asWrittenUnscoped, i as shortened, s as asWritten, t as scenarioFailure } from "./shared-scenario-failure.js";

package/dist/shared-artifacts.js

@@ -6,6 +6,8 @@ import { tmpdir } from "node:os";
 const ARTIFACTS_DIR = ".artifacts";
 const VITEST_ARTIFACTS_DIR = `${ARTIFACTS_DIR}/vitest`;
 const COVERAGE_DIR = `${VITEST_ARTIFACTS_DIR}/coverage`;
+/** Vitest's transformed-module cache, which it would share at the workspace root's `node_modules/.vitest-cache` between the members of a monorepo running side by side. */
+const MODULE_CACHE_DIR = `${VITEST_ARTIFACTS_DIR}/modules`;
 const SQLITE_TEMPLATE_DIR = `${VITEST_ARTIFACTS_DIR}/sqlite`;
 /** Attachments and Browser Mode failure screenshots, which Vitest 5 would put in `.vitest/`. */
 const ATTACHMENTS_DIR = `${VITEST_ARTIFACTS_DIR}/attachments`;
@@ -29,6 +31,6 @@ const REPORTER_OUTPUT_FILES = {
 	junit: `${VITEST_ARTIFACTS_DIR}/junit/output.xml`
 };
 //#endregion
-export { EVIDENCE_DIR as a, SCREENSHOTS_DIR as c, evidenceFile as d, COVERAGE_DIR as i, SQLITE_TEMPLATE_DIR as l, ATTACHMENTS_DIR as n, NODE_COMPILE_CACHE_DIR as o, BLOB_DIR as r, REPORTER_OUTPUT_FILES as s, ARTIFACTS_DIR as t, VITEST_ARTIFACTS_DIR as u };
+export { EVIDENCE_DIR as a, REPORTER_OUTPUT_FILES as c, VITEST_ARTIFACTS_DIR as d, evidenceFile as f, COVERAGE_DIR as i, SCREENSHOTS_DIR as l, ATTACHMENTS_DIR as n, MODULE_CACHE_DIR as o, BLOB_DIR as r, NODE_COMPILE_CACHE_DIR as s, ARTIFACTS_DIR as t, SQLITE_TEMPLATE_DIR as u };
 
 //# sourceMappingURL=shared-artifacts.js.map

package/dist/shared-index.services.d.ts

@@ -290,7 +290,7 @@ type ProcessOptions = {
   }>) => Record<string, string>) | Record<string, string>;
   /** Fixed port. Default: an OS-assigned free port, injected as `PORT`. */
   port?: number;
-  /** Readiness: a path polled until any HTTP status answers (`PORT` injected), or a regex over the output whose one group captures the port. */
+  /** Readiness: a path polled until any HTTP status answers from the command's own process group (`PORT` injected), or a regex over the output whose one group captures the port. */
   ready?: RegExp | string;
   /** Readiness budget in milliseconds. Default 30 000. */
   timeout?: number;

package/dist/shared-ledger.js

@@ -1,5 +1,5 @@
 import { t as isRecord } from "./shared-json-shape.js";
-import { u as VITEST_ARTIFACTS_DIR } from "./shared-artifacts.js";
+import { d as VITEST_ARTIFACTS_DIR } from "./shared-artifacts.js";
 import { mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";

package/dist/shared-playwright.adapter.js

@@ -1,6 +1,6 @@
 import { n as refusal } from "./shared-refusal.js";
 import { n as untilDeadline } from "./shared-pause.js";
-import { d as evidenceFile } from "./shared-artifacts.js";
+import { f as evidenceFile } from "./shared-artifacts.js";
 import { c as scopeChain } from "./shared-landmarks.js";
 import { n as CANDIDATE_LIMITS, o as ambiguousTargetError, r as candidatesOf, s as asWritten, t as scenarioFailure } from "./shared-scenario-failure.js";
 //#region src/specifications/website/browser/page-scripts.ts

package/dist/shared-serve.js

@@ -3,7 +3,8 @@ import { n as untilDeadline } from "./shared-pause.js";
 import "./shared-listened-port.js";
 import "node:module";
 import { resolve } from "node:path";
-import { execSync, spawn, spawnSync } from "node:child_process";
+import { execFile, execSync, spawn, spawnSync } from "node:child_process";
+import { readFile, readdir, readlink } from "node:fs/promises";
 import { randomInt } from "node:crypto";
 import { Socket, connect } from "node:net";
 import { once } from "node:events";
@@ -20,6 +21,169 @@ var __exportAll = (all, no_symbols) => {
 	return target;
 };
 //#endregion
+//#region src/services/process/process-group.ts
+const KILL_GRACE_MS = 2e3;
+/** outside: Windows has no process groups to signal through a negative pid. */
+const SIGNALS_GROUPS = process.platform !== "win32";
+const GROUP_POLL_MS = 1e3;
+const GROUP_SETTLE_MS = 50;
+const STRAYS_SOURCE = `
+const { execFileSync } = require('node:child_process');
+const strays = JSON.parse(process.argv[1] ?? '[]');
+const listed = (column) => {
+    let listing = '';
+    try { listing = execFileSync('ps', ['-A', '-o', 'pid=,' + column + '='], { encoding: 'utf8', maxBuffer: 67108864 }); } catch {}
+    return new Map(listing.split('\\n').flatMap((line) => {
+        const found = /^\\s*(\\d+)\\s(.*)$/u.exec(line);
+        return found === null ? [] : [[Number(found[1]), found[2]]];
+    }));
+};
+const names = (path, program) => path === program || path.endsWith('/' + program);
+const strayPids = () => {
+    const commands = listed('command');
+    return [...listed('comm')]
+        .filter(([pid, executable]) => {
+            const command = commands.get(pid) ?? '';
+            return pid !== process.pid && strays.some((stray) =>
+                (names(executable, stray.program) || names(command.split(' ')[0], stray.program)) && stray.holds.every((word) => command.includes(word)));
+        })
+        .map(([pid]) => pid);
+};
+const signalStrays = (signal) => {
+    for (const pid of strays.length === 0 ? [] : strayPids()) {
+        try { process.kill(-pid, signal); } catch {}
+        try { process.kill(pid, signal); } catch {}
+    }
+};
+`;
+/** Its arguments are the strays, then the group. With strays to reap, it outlives the group: a stray outlives the group that spawned it. */
+const WATCHDOG = `${STRAYS_SOURCE}
+const group = -Number(process.argv[2]);
+const gone = () => { try { process.kill(group, 0); return false; } catch { return true; } };
+const end = () => {
+    try { process.kill(group, 'SIGTERM'); } catch { if (strays.length === 0) process.exit(0); }
+    signalStrays('SIGTERM');
+    setTimeout(() => { try { process.kill(group, 'SIGKILL'); } catch {} signalStrays('SIGKILL'); process.exit(0); }, ${KILL_GRACE_MS});
+};
+process.stdin.on('end', end);
+process.stdin.on('error', end);
+process.stdin.resume();
+setInterval(() => { if (strays.length === 0 && gone()) process.exit(0); }, ${GROUP_POLL_MS});
+`;
+/** Its argument is the strays: each gets SIGTERM, and SIGKILL when it outlives the grace. */
+const REAPER = `${STRAYS_SOURCE}
+signalStrays('SIGTERM');
+const deadline = Date.now() + ${KILL_GRACE_MS};
+const settle = () => {
+    if (strayPids().length === 0) return;
+    if (Date.now() >= deadline) { signalStrays('SIGKILL'); return; }
+    setTimeout(settle, ${GROUP_SETTLE_MS});
+};
+settle();
+`;
+function groupRunning(group) {
+	try {
+		process.kill(group, 0);
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function groupEnded(group, withinMs) {
+	return await untilDeadline(() => !groupRunning(group) || void 0, {
+		interval: GROUP_SETTLE_MS,
+		timeout: withinMs
+	}) === true;
+}
+/** Resolves once the child is reaped, at once for one reaped already. */
+async function reaped(child) {
+	if (child.exitCode !== null || child.signalCode !== null) return;
+	await once(child, "exit");
+}
+/** The child's whole group where groups are signalled, the child alone where they are not or the group is gone; nothing for a child that never started. */
+function signalGroup(child, signal = "SIGTERM") {
+	if (child.pid === void 0) return false;
+	if (SIGNALS_GROUPS) try {
+		process.kill(-child.pid, signal);
+		return true;
+	} catch {}
+	return child.kill(signal);
+}
+async function endGroup(child) {
+	if (child.pid === void 0) return;
+	const leaderReaped = reaped(child);
+	signalGroup(child, "SIGTERM");
+	if (!await groupEnded(-child.pid, 2e3)) signalGroup(child, "SIGKILL");
+	await leaderReaped;
+}
+//#endregion
+//#region src/services/process/listener-owner.ts
+function ownsFromLsof(output, group) {
+	return owns(output.split("\n").filter((line) => line.startsWith("g")).map((line) => line.slice(1)), /* @__PURE__ */ new Set([String(group)]));
+}
+/** Owned when a listener is the group's and none it can see is outside it. */
+function owns(listeners, owned) {
+	return listeners.length > 0 && listeners.every((listener) => owned.has(listener));
+}
+const LISTEN_STATE = "0A";
+function listeningInodes(table, port) {
+	return table.split("\n").map((row) => row.trim().split(/\s+/u)).filter(([, local, , state]) => {
+		const [, hex] = String(local).split(":");
+		return state === LISTEN_STATE && Number.parseInt(String(hex), 16) === port;
+	}).map((fields) => String(fields[9]));
+}
+function processGroupOf(stat) {
+	return Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[2]);
+}
+function socketInode(link) {
+	return /^socket:\[(?<inode>\d+)\]$/u.exec(link)?.groups?.inode;
+}
+const NODE_PROC = {
+	entries: async (path) => await readdir(path).catch(() => []),
+	link: async (path) => await readlink(path).catch(() => ""),
+	text: async (path) => await readFile(path, "utf8").catch(() => "")
+};
+async function groupInodes(group, proc) {
+	const pids = await proc.entries("/proc");
+	const owned = /* @__PURE__ */ new Set();
+	for (const pid of pids) {
+		if (processGroupOf(await proc.text(`/proc/${pid}/stat`)) !== group) continue;
+		for (const fd of await proc.entries(`/proc/${pid}/fd`)) {
+			const inode = socketInode(await proc.link(`/proc/${pid}/fd/${fd}`));
+			if (inode !== void 0) owned.add(inode);
+		}
+	}
+	return owned;
+}
+/** Linux: the listening sockets of `/proc/net/tcp` and `tcp6` on the port, against the sockets the group's processes hold open. */
+async function ownsOnLinux(port, group, proc = NODE_PROC) {
+	return owns((await Promise.all(["/proc/net/tcp", "/proc/net/tcp6"].map(proc.text))).flatMap((table) => listeningInodes(table, port)), await groupInodes(group, proc));
+}
+/** macOS: the groups `lsof` names for the port's listeners; undefined where `program` cannot run. */
+async function ownsOnDarwin(port, group, program = "lsof") {
+	const listed = await new Promise((resolve) => {
+		execFile(program, [
+			"-nP",
+			"-a",
+			`-iTCP:${String(port)}`,
+			"-sTCP:LISTEN",
+			"-Fpg"
+		], (error, stdout) => {
+			resolve(error === null || error.code === 1 ? stdout : void 0);
+		});
+	});
+	return listed === void 0 ? void 0 : ownsFromLsof(listed, group);
+}
+/** Whether `port` is listened on by the process group `group` alone, as far as this process can see; undefined where the platform cannot tell. */
+async function groupOwnsPort(port, group, platform = process.platform) {
+	if (platform === "linux") return await ownsOnLinux(port, group);
+	if (platform === "darwin") return await ownsOnDarwin(port, group);
+}
+async function childOwnsPort(port, child) {
+	const group = SIGNALS_GROUPS ? child?.pid : void 0;
+	return group === void 0 ? void 0 : await groupOwnsPort(port, group);
+}
+//#endregion
 //#region src/services/process/listening.ts
 async function firstAnswering(urls) {
 	return (await Promise.all(urls.map(async (url) => await answers(url) ? url : void 0))).find((url) => url !== void 0);
@@ -81,6 +245,13 @@ function lessonOf(reason, output, port) {
 		why: "A process is handed a free port unless `port` pins one, and a port another process holds is not free."
 	};
 }
+function foreignAnswer(port) {
+	return {
+		fix: "stop the process holding that port, or announce the port with a `ready` pattern if the server runs outside the command (a container, a daemon)",
+		found: `port ${String(port)} answered, and a process the command did not start listens on it`,
+		why: "A process is ready once its own server answers, and an answer from another process on its port is not one."
+	};
+}
 async function refuseHeldPort(port, specification, command) {
 	if (port === void 0) return;
 	const host = await holdingHost(port);
@@ -156,102 +327,6 @@ async function reservePort(pinned, pick = draw) {
 	};
 }
 //#endregion
-//#region src/services/process/process-group.ts
-const KILL_GRACE_MS = 2e3;
-/** outside: Windows has no process groups to signal through a negative pid. */
-const SIGNALS_GROUPS = process.platform !== "win32";
-const GROUP_POLL_MS = 1e3;
-const GROUP_SETTLE_MS = 50;
-const STRAYS_SOURCE = `
-const { execFileSync } = require('node:child_process');
-const strays = JSON.parse(process.argv[1] ?? '[]');
-const listed = (column) => {
-    let listing = '';
-    try { listing = execFileSync('ps', ['-A', '-o', 'pid=,' + column + '='], { encoding: 'utf8', maxBuffer: 67108864 }); } catch {}
-    return new Map(listing.split('\\n').flatMap((line) => {
-        const found = /^\\s*(\\d+)\\s(.*)$/u.exec(line);
-        return found === null ? [] : [[Number(found[1]), found[2]]];
-    }));
-};
-const names = (path, program) => path === program || path.endsWith('/' + program);
-const strayPids = () => {
-    const commands = listed('command');
-    return [...listed('comm')]
-        .filter(([pid, executable]) => {
-            const command = commands.get(pid) ?? '';
-            return pid !== process.pid && strays.some((stray) =>
-                (names(executable, stray.program) || names(command.split(' ')[0], stray.program)) && stray.holds.every((word) => command.includes(word)));
-        })
-        .map(([pid]) => pid);
-};
-const signalStrays = (signal) => {
-    for (const pid of strays.length === 0 ? [] : strayPids()) {
-        try { process.kill(-pid, signal); } catch {}
-        try { process.kill(pid, signal); } catch {}
-    }
-};
-`;
-/** Its arguments are the strays, then the group. With strays to reap, it outlives the group: a stray outlives the group that spawned it. */
-const WATCHDOG = `${STRAYS_SOURCE}
-const group = -Number(process.argv[2]);
-const gone = () => { try { process.kill(group, 0); return false; } catch { return true; } };
-const end = () => {
-    try { process.kill(group, 'SIGTERM'); } catch { if (strays.length === 0) process.exit(0); }
-    signalStrays('SIGTERM');
-    setTimeout(() => { try { process.kill(group, 'SIGKILL'); } catch {} signalStrays('SIGKILL'); process.exit(0); }, ${KILL_GRACE_MS});
-};
-process.stdin.on('end', end);
-process.stdin.on('error', end);
-process.stdin.resume();
-setInterval(() => { if (strays.length === 0 && gone()) process.exit(0); }, ${GROUP_POLL_MS});
-`;
-/** Its argument is the strays: each gets SIGTERM, and SIGKILL when it outlives the grace. */
-const REAPER = `${STRAYS_SOURCE}
-signalStrays('SIGTERM');
-const deadline = Date.now() + ${KILL_GRACE_MS};
-const settle = () => {
-    if (strayPids().length === 0) return;
-    if (Date.now() >= deadline) { signalStrays('SIGKILL'); return; }
-    setTimeout(settle, ${GROUP_SETTLE_MS});
-};
-settle();
-`;
-function groupRunning(group) {
-	try {
-		process.kill(group, 0);
-		return true;
-	} catch {
-		return false;
-	}
-}
-async function groupEnded(group, withinMs) {
-	return await untilDeadline(() => !groupRunning(group) || void 0, {
-		interval: GROUP_SETTLE_MS,
-		timeout: withinMs
-	}) === true;
-}
-/** Resolves once the child is reaped, at once for one reaped already. */
-async function reaped(child) {
-	if (child.exitCode !== null || child.signalCode !== null) return;
-	await once(child, "exit");
-}
-/** The child's whole group where groups are signalled, the child alone where they are not or the group is gone; nothing for a child that never started. */
-function signalGroup(child, signal = "SIGTERM") {
-	if (child.pid === void 0) return false;
-	if (SIGNALS_GROUPS) try {
-		process.kill(-child.pid, signal);
-		return true;
-	} catch {}
-	return child.kill(signal);
-}
-async function endGroup(child) {
-	if (child.pid === void 0) return;
-	const leaderReaped = reaped(child);
-	signalGroup(child, "SIGTERM");
-	if (!await groupEnded(-child.pid, 2e3)) signalGroup(child, "SIGKILL");
-	await leaderReaped;
-}
-//#endregion
 //#region src/services/process/serve.ts
 var serve_exports = /* @__PURE__ */ __exportAll({
 	ServedProcess: () => ServedProcess,
@@ -299,7 +374,7 @@ function runToCompletion(command, env) {
 		stdio: "pipe"
 	});
 }
-/** Any HTTP status counts as ready, since the port it is handed is reserved for it until `stop()`: no other served process is handed it, and no socket is handed it by chance. The child runs in its own process group so `stop()` kills a `next start` grandchild too, and a watchdog kills that group when the run dies before `stop()`; both reap the strays it declares, the processes it spawns outside its group. */
+/** Any HTTP status counts as ready once a process of the child's own group listens on the port, and none outside it: the port it is handed is reserved for it until `stop()`, so no other served process is handed it, and an unrelated server that took it meanwhile is refused rather than read as ready. The child runs in its own process group so `stop()` kills a `next start` grandchild too, and a watchdog kills that group when the run dies before `stop()`; both reap the strays it declares, the processes it spawns outside its group. */
 var ServedProcess = class {
 	port = null;
 	child = null;
@@ -411,11 +486,16 @@ var ServedProcess = class {
 	async awaitAnswer(port) {
 		const baseUrls = [`http://127.0.0.1:${port}`, `http://[::1]:${port}`];
 		const path = typeof this.options.ready === "string" ? this.options.ready : "/";
-		const seen = await untilDeadline(async () => this.exited ? "exited" : await firstAnswering(baseUrls.map((baseUrl) => `${baseUrl}${path}`)), {
+		const seen = await untilDeadline(async () => {
+			if (this.exited) return "exited";
+			const answered = await firstAnswering(baseUrls.map((baseUrl) => `${baseUrl}${path}`));
+			return (answered === void 0 || await childOwnsPort(port, this.child)) === false ? "foreign" : answered;
+		}, {
 			interval: READY_POLL_INTERVAL_MS,
 			timeout: this.timeout()
 		});
 		if (seen === "exited") return null;
+		if (seen === "foreign") return await this.refuse(foreignAnswer(port));
 		if (seen === void 0) return await this.refuse({
 			fix: "correct `ready` to a path the server answers, have it listen on `PORT`, or raise `timeout`",
 			found: `the server did not answer on ${baseUrls.map((baseUrl) => `${baseUrl}${path}`).join(" or ")} within ${this.timeout()}ms, whatever address it printed above`,

package/dist/shared-session-ledger.js

@@ -1,7 +1,7 @@
 import { t as ServedProcess } from "./shared-serve.js";
 import { t as isRecord } from "./shared-json-shape.js";
 import { n as refusal } from "./shared-refusal.js";
-import { u as VITEST_ARTIFACTS_DIR } from "./shared-artifacts.js";
+import { d as VITEST_ARTIFACTS_DIR } from "./shared-artifacts.js";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { execFile } from "node:child_process";

package/dist/vitest.d.ts

@@ -98,7 +98,10 @@ export declare function job(options?: JobProjectOptions): TestProjectInlineConfi
 //#endregion
 //#region src/specifications/lint/lint.project.d.ts
 /** `lint()`: the rules a project ships, run by the real linters over fixture trees. */
-type LintProjectOptions = SpecificationProjectOptions;
+type LintProjectOptions = SpecificationProjectOptions & {
+  /** `false` shares one module graph per worker (`isolate: false`); for specs that keep no state in a module. */
+  isolate?: boolean;
+};
 export declare function lint(options?: LintProjectOptions): TestProjectInlineConfiguration;
 //#endregion
 //#region src/specifications/mobile/mobile.project.d.ts

package/dist/vitest.js

@@ -3,7 +3,7 @@ import { t as isRecord } from "./shared-json-shape.js";
 import { n as refusal$1, t as invariant } from "./shared-refusal.js";
 import { i as renderText, n as literate, o as resolveSpecPath } from "./shared-literate-plugin.js";
 import { u as shouldUpdateSnapshots } from "./shared-ledger.js";
-import { c as SCREENSHOTS_DIR, i as COVERAGE_DIR, n as ATTACHMENTS_DIR, o as NODE_COMPILE_CACHE_DIR, r as BLOB_DIR, s as REPORTER_OUTPUT_FILES, t as ARTIFACTS_DIR, u as VITEST_ARTIFACTS_DIR } from "./shared-artifacts.js";
+import { c as REPORTER_OUTPUT_FILES, d as VITEST_ARTIFACTS_DIR, i as COVERAGE_DIR, l as SCREENSHOTS_DIR, n as ATTACHMENTS_DIR, o as MODULE_CACHE_DIR, r as BLOB_DIR, s as NODE_COMPILE_CACHE_DIR, t as ARTIFACTS_DIR } from "./shared-artifacts.js";
 import { t as derivedProjects } from "./shared-derived-projects.js";
 import { t as TEST_SECTION } from "./shared-test-section.js";
 import { n as servicesSetup } from "./shared-services.global-setup.js";
@@ -378,7 +378,14 @@ function job(options = {}) {
 //#endregion
 //#region src/specifications/lint/lint.project.ts
 function lint(options = {}) {
-	return specificationProject("lint", options);
+	const project = specificationProject("lint", options);
+	return options.isolate === void 0 ? project : {
+		...project,
+		test: {
+			...project.test,
+			isolate: options.isolate
+		}
+	};
 }
 //#endregion
 //#region src/specifications/mobile/mobile.project.ts
@@ -442,6 +449,7 @@ function rootDefaults() {
 	return mergeConfig(projectDefaults(), { test: {
 		coverage: COVERAGE,
 		env: { NODE_COMPILE_CACHE: resolve(NODE_COMPILE_CACHE_DIR) },
+		fsModuleCachePath: MODULE_CACHE_DIR,
 		maxWorkers: slotsFor(resolve("."), "vitest"),
 		outputFile: reporterOutputFiles(process.argv)
 	} });

package/docs/guides/cli-specs.md

@@ -536,7 +536,7 @@ test('destroy removes the container created in an earlier run', async () => {
 });
 ```
 
-Container accessor surface: `exists`, `running`/`toBeRunning`, `status`, `id`, `file(path)` (content read inside the container), `exec(cmd)` (returns stdout/stderr), `stdout`/`stderr` (container logs). Looking up an absent container returns `exists: false` instead of throwing. `result.containerIds` lists every container captured for the run.
+Container accessor surface: `exists`, `running`/`toBeRunning`, `status`, `id`, `file(path)` (content read inside the container), `exec(cmd)` (returns stdout/stderr), `stdout`/`stderr` (container logs). Looking up an absent container returns `exists: false` instead of throwing, and a name two containers of the run carry is refused ([Assertions § Container subjects](../reference/assertions.md#container-subjects-docker-aware-cli)). `result.containerIds` lists every container captured for the run.
 
 The runner handle also destructures to `{ cli, cleanup, docker }`. The `docker(containerId)` reader is the escape hatch for reading an **arbitrary** container by raw id (e.g. one a follow-up command referenced): it lazily runs `docker inspect` and returns the same `ContainerAccessor` type, so `await expect(docker(id)).toBeRunning()` and the sync reads work identically. Unlike `result.container(name)` it does not need `nameLabel`: it looks up by id directly; an unknown id yields `exists: false`.
 

package/docs/guides/lint-specs.md

@@ -134,6 +134,10 @@ A preset's own `oxlint` (its plugin, its rulebook) is not run by `presets`: the
 
 A linter that fails and reports no diagnostic is refused in four parts rather than read as a clean tree: a plugin that does not load, a config oxlint cannot build, a checker that cannot start.
 
+### One module graph per worker
+
+The lint project runs a worker's files in one module graph (`isolate: false`), as the standard hands it: each spec lays its own fixture tree and runs the linters as processes of their own, so a file leaves nothing in a module for the next one, and the worker, the framework and the kit load once per worker instead of once per file. A project whose lint specs keep state in a module (a cache, a counter, a stub set at load) states `isolate: true` for its `lint` project in `jterrazz.config.ts`, with its reason.
+
 ### A rule pack: a nested Vitest and a reporter fixture
 
 A package that ships lint rules for other projects proves them by running the real binary on a tree: the spec starts a nested `vitest` over a fixture project (`.fixture(directory(...))`) with a reporter fixture that prints one line per finding, and compares that output whole. A rule alone is `ruleTester()`.

package/docs/reference/assertions.md

@@ -224,7 +224,7 @@ Same semantics as `result.directory(...)`, rooted at the cwd itself. `.files()`
 
 ## Container subjects (docker-aware cli)
 
-Available when the runner declares `docker: { envVar, nameLabel, testRunLabel }`; results must be bound with `await using` (rule `docker-exec-bound-with-await-using`). `result.container(name)` looks a container up by its `nameLabel` value, lazily: no Docker call happens until you touch it. Absent containers return `exists: false` instead of throwing.
+Available when the runner declares `docker: { envVar, nameLabel, testRunLabel }`; results must be bound with `await using` (rule `docker-exec-bound-with-await-using`). `result.container(name)` looks a container up by its `nameLabel` value, lazily: no Docker call happens until you touch it. Absent containers return `exists: false` instead of throwing; a name two containers of the run carry is refused, naming each candidate by id and docker name, since reading either would be a guess.
 
 The runner handle itself also exposes a `docker(containerId)` reader (returned by `specification.api()` and `specification.cli()`, not `specification.job()`): given a raw container id, it lazily runs `docker inspect` and returns the **same** `ContainerAccessor` type, so it works with `await expect(spec.docker(id)).toBeRunning()` and every read accessor below. An unknown id yields an accessor with `exists: false` rather than throwing. The app of an api spec runs in the test process, but it can still start containers through the Docker daemon, as an API that deploys or provisions something does: the response hands back an id, and `docker(id)` reads the container the request left behind.
 

package/docs/reference/services.md

@@ -84,7 +84,7 @@ export const { cleanup, website } = await specification.website({
 
 **A port is one process's at a time.** The port handed as `PORT` is drawn between 10000 and 32767, below the range every OS hands unasked ports from (a `listen(0)`, a stub's port, an outgoing connection), so no other socket is handed it by chance while the command starts. It is reserved from the draw until the process stops, against every served process of the machine whatever run started it, so files running in parallel never share one; a draw that finds no free port in 64 tries is refused. A `port` two processes pin at once is held by the first, and the second is refused before its command runs.
 
-**Any status the `ready` path answers is the server's.** Nothing else can answer on a port reserved that way: the one process that could is one started by hand on that very number while the command starts.
+**Any status the `ready` path answers is the server's, once the server is proved to be the one answering.** On Linux and macOS an answer counts only while every listener of the port this run can see is in the command's process group: a process outside it (one started by hand on that very number while the command starts, a server the command detached, a container's port forward) is refused at once, naming the port, never read as ready. A server that rightly runs outside the group announces its port instead, with a `ready` pattern. Elsewhere the answer is taken as the server's.
 
 **Its URL is known once it is ready.** `url` read at declaration time is refused: a process started beside others reads theirs from the started services record: `env: (services) => ...`, `server: (services) => ...`.
 

package/docs/start/set-up-a-project.md

@@ -108,7 +108,7 @@ There is one helper per kind (`unit`, `integration`, `component`, `website`, `mo
 | `timeout`             | Raise or lower the 30 s default for this project alone: each test's and each hook's, so the `afterAll` that stops what a slow test started has the same budget |
 | `serial`              | Run the project's files one at a time (`fileParallelism: false`), when they share one server, one file, one app                                                |
 
-`unit()` and `component()` are a pair: `unit()` collects `**/*.test.ts` outside `specs/` and leaves out `**/*.test.tsx`, which `component()` collects. So the suffix beside a file decides which project runs it. `unit()` also takes `roots` when the modules are not at the repository root, and `isolate: false` to run a worker's files in one module graph, only for a project whose tests leave no state behind in a module, and the default `vitestConfig` hands it. `component()` takes the options of the app it renders (`vite`, `wrap`, `viewport`, `clock`, `timezone`, `locale`, `root`), described in [Component specs](../guides/component-specs.md#the-constructor-there-is-none); `mobile()` takes the simulator the run shares ([Mobile specs](../guides/mobile-specs.md#one-session-per-run)).
+`unit()` and `component()` are a pair: `unit()` collects `**/*.test.ts` outside `specs/` and leaves out `**/*.test.tsx`, which `component()` collects. So the suffix beside a file decides which project runs it. `unit()` also takes `roots` when the modules are not at the repository root, and `isolate: false` to run a worker's files in one module graph, only for a project whose tests leave no state behind in a module, and the default `vitestConfig` hands it. `lint()` takes `isolate` too, and the default `vitestConfig` hands it `false` as well, since a lint spec lays its own tree and runs the linters as processes of their own ([Lint specs § One module graph per worker](../guides/lint-specs.md#one-module-graph-per-worker)); `mobile()` keeps every file isolated. `component()` takes the options of the app it renders (`vite`, `wrap`, `viewport`, `clock`, `timezone`, `locale`, `root`), described in [Component specs](../guides/component-specs.md#the-constructor-there-is-none); `mobile()` takes the simulator the run shares ([Mobile specs](../guides/mobile-specs.md#one-session-per-run)).
 
 Every project runs in one group, on the workers the preset sizes ([below](#what-the-preset-sets)): a `website` file takes a worker as a node file does, and the `component` pages run beside them in their one Chromium, as many at once as the run has workers. A project whose files run one at a time (`serial`, and `mobile()` unless it states `serial: false`) runs after that group, in a group of its own, so a simulator never shares its machine.
 
@@ -172,13 +172,14 @@ export default await oxlintConfig(import.meta.url);
 
 **In the project, only under `.artifacts/`**, one folder per tool, one line in `.gitignore`, one `rm -rf .artifacts` for a clean slate:
 
-| Path                                             | Written by                                                 | Lifetime                        |
-| ------------------------------------------------ | ---------------------------------------------------------- | ------------------------------- |
-| `.artifacts/vitest/`                             | vite's transform cache, vitest's reports                   | Reused across runs              |
-| `.artifacts/vitest/coverage/`                    | the coverage provider                                      | Rewritten per coverage run      |
-| `.artifacts/vitest/sqlite/template-<key>.sqlite` | `sqlite()`'s schema template                               | Reused until the schema changes |
-| `.artifacts/vitest/evidence/<pid>-.../`          | the screenshot of a website or mobile scenario that failed | Kept until the next run starts  |
-| `.artifacts/node-compile-cache/`                 | Node, for the workers and every process they spawn         | Reused across runs              |
+| Path                                             | Written by                                                      | Lifetime                        |
+| ------------------------------------------------ | --------------------------------------------------------------- | ------------------------------- |
+| `.artifacts/vitest/`                             | vite's transform cache, vitest's reports                        | Reused across runs              |
+| `.artifacts/vitest/coverage/`                    | the coverage provider                                           | Rewritten per coverage run      |
+| `.artifacts/vitest/modules/`                     | vitest's transformed-module cache, one per member of a monorepo | Reused across runs              |
+| `.artifacts/vitest/sqlite/template-<key>.sqlite` | `sqlite()`'s schema template                                    | Reused until the schema changes |
+| `.artifacts/vitest/evidence/<pid>-.../`          | the screenshot of a website or mobile scenario that failed      | Kept until the next run starts  |
+| `.artifacts/node-compile-cache/`                 | Node, for the workers and every process they spawn              | Reused across runs              |
 
 **Everything else is scratch, in one temp folder per run.** Before the first worker starts, the preset creates `jterrazz-test-runs-<uid>/<pid>-...` in the OS temp directory and points `TMPDIR`, `TMP` and `TEMP` at it, so every temp folder a worker, a spawned child or a tool it runs makes lands inside. That holds each CLI spec's working directory, the per-worker database copies and a browser's profile. The run removes the folder when it ends, and the next run removes the folder of any run that died first. A CLI spec's working directory goes sooner, once its test has finished, except under `test.concurrent`, where it waits for the run.
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@jterrazz/test",
-    "version": "18.0.3",
+    "version": "18.1.0",
     "description": "Declarative testing framework for HTTP APIs, CLIs, background jobs, websites, mobile apps, rendered components and the rules a project ships: one entry point, real infrastructure and a real browser, golden-file assertions, plus an oxlint convention plugin.",
     "keywords": [
         "api-testing",
@@ -92,7 +92,7 @@
     },
     "devDependencies": {
         "@hono/node-server": "^2.1.1",
-        "@jterrazz/typescript": "^11.1.0",
+        "@jterrazz/typescript": "^11.2.0",
         "@types/better-sqlite3": "^9.6.0",
         "@types/node": "^26.6.2",
         "@types/pg": "^8.23.1",