@norskvideo/ctl-dev-kit 0.2.21 → 0.2.23

package/conventions/build-docs.yml

@@ -244,3 +244,21 @@ jobs:
             "
             docker image rm -f "$IMAGE_TAG" >/dev/null
           '
+      - name: Reap the containers this job launched
+        # Whatever the tests did. A teardown cut short by a test timeout leaves
+        # its instance running on the shared Docker daemon (see JOB_REAP_STEP in
+        # conventions/workflow-shell.ts); everything this job launched mounts its
+        # own test-temp, so that is what goes.
+        if: always()
+        run: |
+          base="${NORSK_CTL_TEST_TMP:-}"
+          tt="$GITHUB_WORKSPACE/test-temp"
+          s=""
+          for c in $(docker ps -aq); do
+            src="$(docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null)" || continue
+            if { [ -n "$base" ] && grep -q "^$base/" <<<"$src"; } || grep -q "^$tt/" <<<"$src"; then s="$s $c"; fi
+          done
+          if [ -n "$s" ]; then
+            echo "::warning::removing containers this job left running:$s"
+            docker rm -f $s
+          fi

package/conventions/build-image.yml

@@ -134,6 +134,24 @@ jobs:
           echo "channel=${channel}" >> "$GITHUB_OUTPUT"
           echo "publish=${publish}" >> "$GITHUB_OUTPUT"
           echo "label=${label} channel=${channel} publish=${publish}"
+      - name: Reap the containers this job launched
+        # Whatever the tests did. A teardown cut short by a test timeout leaves
+        # its instance running on the shared Docker daemon (see JOB_REAP_STEP in
+        # conventions/workflow-shell.ts); everything this job launched mounts its
+        # own test-temp, so that is what goes.
+        if: always()
+        run: |
+          base="${NORSK_CTL_TEST_TMP:-}"
+          tt="$GITHUB_WORKSPACE/test-temp"
+          s=""
+          for c in $(docker ps -aq); do
+            src="$(docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null)" || continue
+            if { [ -n "$base" ] && grep -q "^$base/" <<<"$src"; } || grep -q "^$tt/" <<<"$src"; then s="$s $c"; fi
+          done
+          if [ -n "$s" ]; then
+            echo "::warning::removing containers this job left running:$s"
+            docker rm -f $s
+          fi
 
   build:
     needs: label
@@ -232,6 +250,24 @@ jobs:
       - name: Push the per-arch image to Docker Hub
         if: ${{ env.PUBLISH_IMAGE != '' }}
         run: docker push "$IMAGE_TAG"
+      - name: Reap the containers this job launched
+        # Whatever the tests did. A teardown cut short by a test timeout leaves
+        # its instance running on the shared Docker daemon (see JOB_REAP_STEP in
+        # conventions/workflow-shell.ts); everything this job launched mounts its
+        # own test-temp, so that is what goes.
+        if: always()
+        run: |
+          base="${NORSK_CTL_TEST_TMP:-}"
+          tt="$GITHUB_WORKSPACE/test-temp"
+          s=""
+          for c in $(docker ps -aq); do
+            src="$(docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null)" || continue
+            if { [ -n "$base" ] && grep -q "^$base/" <<<"$src"; } || grep -q "^$tt/" <<<"$src"; then s="$s $c"; fi
+          done
+          if [ -n "$s" ]; then
+            echo "::warning::removing containers this job left running:$s"
+            docker rm -f $s
+          fi
 
   # Combine the per-arch images into a multi-arch manifest and write the two
   # published tags. Skipped for a build-only product (empty PUBLISH_IMAGE) and on
@@ -320,6 +356,24 @@ jobs:
             -t "${PUBLISH_IMAGE}:${channel}" \
             "${PUBLISH_IMAGE}:${label}-amd64" \
             "${PUBLISH_IMAGE}:${label}-arm64"
+      - name: Reap the containers this job launched
+        # Whatever the tests did. A teardown cut short by a test timeout leaves
+        # its instance running on the shared Docker daemon (see JOB_REAP_STEP in
+        # conventions/workflow-shell.ts); everything this job launched mounts its
+        # own test-temp, so that is what goes.
+        if: always()
+        run: |
+          base="${NORSK_CTL_TEST_TMP:-}"
+          tt="$GITHUB_WORKSPACE/test-temp"
+          s=""
+          for c in $(docker ps -aq); do
+            src="$(docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null)" || continue
+            if { [ -n "$base" ] && grep -q "^$base/" <<<"$src"; } || grep -q "^$tt/" <<<"$src"; then s="$s $c"; fi
+          done
+          if [ -n "$s" ]; then
+            echo "::warning::removing containers this job left running:$s"
+            docker rm -f $s
+          fi
 
   # Report this pipeline's result to the aggregated product CI dashboard
   # (id3as/ci-workflows) instead of posting its own pony -- the dashboard renders
@@ -402,3 +456,21 @@ jobs:
           product: __PRODUCT__
           pipeline: build-image
           status: ${{ steps.meta.outputs.state }}
+      - name: Reap the containers this job launched
+        # Whatever the tests did. A teardown cut short by a test timeout leaves
+        # its instance running on the shared Docker daemon (see JOB_REAP_STEP in
+        # conventions/workflow-shell.ts); everything this job launched mounts its
+        # own test-temp, so that is what goes.
+        if: always()
+        run: |
+          base="${NORSK_CTL_TEST_TMP:-}"
+          tt="$GITHUB_WORKSPACE/test-temp"
+          s=""
+          for c in $(docker ps -aq); do
+            src="$(docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null)" || continue
+            if { [ -n "$base" ] && grep -q "^$base/" <<<"$src"; } || grep -q "^$tt/" <<<"$src"; then s="$s $c"; fi
+          done
+          if [ -n "$s" ]; then
+            echo "::warning::removing containers this job left running:$s"
+            docker rm -f $s
+          fi

package/conventions/checks.sdk-app.yml

@@ -106,6 +106,24 @@ jobs:
             bun install --frozen-lockfile
             bun run check:drift
           '
+      - name: Reap the containers this job launched
+        # Whatever the tests did. A teardown cut short by a test timeout leaves
+        # its instance running on the shared Docker daemon (see JOB_REAP_STEP in
+        # conventions/workflow-shell.ts); everything this job launched mounts its
+        # own test-temp, so that is what goes.
+        if: always()
+        run: |
+          base="${NORSK_CTL_TEST_TMP:-}"
+          tt="$GITHUB_WORKSPACE/test-temp"
+          s=""
+          for c in $(docker ps -aq); do
+            src="$(docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null)" || continue
+            if { [ -n "$base" ] && grep -q "^$base/" <<<"$src"; } || grep -q "^$tt/" <<<"$src"; then s="$s $c"; fi
+          done
+          if [ -n "$s" ]; then
+            echo "::warning::removing containers this job left running:$s"
+            docker rm -f $s
+          fi
 
   quality:
     runs-on: x64
@@ -190,6 +208,24 @@ jobs:
             # in here and breaks a schema handed across the instance boundary.
             bun node_modules/@norskvideo/ctl-dev-kit/conventions/zod-singleton.ts
           '
+      - name: Reap the containers this job launched
+        # Whatever the tests did. A teardown cut short by a test timeout leaves
+        # its instance running on the shared Docker daemon (see JOB_REAP_STEP in
+        # conventions/workflow-shell.ts); everything this job launched mounts its
+        # own test-temp, so that is what goes.
+        if: always()
+        run: |
+          base="${NORSK_CTL_TEST_TMP:-}"
+          tt="$GITHUB_WORKSPACE/test-temp"
+          s=""
+          for c in $(docker ps -aq); do
+            src="$(docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null)" || continue
+            if { [ -n "$base" ] && grep -q "^$base/" <<<"$src"; } || grep -q "^$tt/" <<<"$src"; then s="$s $c"; fi
+          done
+          if [ -n "$s" ]; then
+            echo "::warning::removing containers this job left running:$s"
+            docker rm -f $s
+          fi
 
   # Report this pipeline's result to the aggregated product CI dashboard
   # (id3as/ci-workflows) instead of posting its own pony — the dashboard renders
@@ -274,3 +310,21 @@ jobs:
           product: __PRODUCT__
           pipeline: checks
           status: ${{ steps.meta.outputs.state }}
+      - name: Reap the containers this job launched
+        # Whatever the tests did. A teardown cut short by a test timeout leaves
+        # its instance running on the shared Docker daemon (see JOB_REAP_STEP in
+        # conventions/workflow-shell.ts); everything this job launched mounts its
+        # own test-temp, so that is what goes.
+        if: always()
+        run: |
+          base="${NORSK_CTL_TEST_TMP:-}"
+          tt="$GITHUB_WORKSPACE/test-temp"
+          s=""
+          for c in $(docker ps -aq); do
+            src="$(docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null)" || continue
+            if { [ -n "$base" ] && grep -q "^$base/" <<<"$src"; } || grep -q "^$tt/" <<<"$src"; then s="$s $c"; fi
+          done
+          if [ -n "$s" ]; then
+            echo "::warning::removing containers this job left running:$s"
+            docker rm -f $s
+          fi

package/conventions/checks.yml

@@ -102,6 +102,24 @@ jobs:
             bun install --frozen-lockfile
             bun run check:drift
           '
+      - name: Reap the containers this job launched
+        # Whatever the tests did. A teardown cut short by a test timeout leaves
+        # its instance running on the shared Docker daemon (see JOB_REAP_STEP in
+        # conventions/workflow-shell.ts); everything this job launched mounts its
+        # own test-temp, so that is what goes.
+        if: always()
+        run: |
+          base="${NORSK_CTL_TEST_TMP:-}"
+          tt="$GITHUB_WORKSPACE/test-temp"
+          s=""
+          for c in $(docker ps -aq); do
+            src="$(docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null)" || continue
+            if { [ -n "$base" ] && grep -q "^$base/" <<<"$src"; } || grep -q "^$tt/" <<<"$src"; then s="$s $c"; fi
+          done
+          if [ -n "$s" ]; then
+            echo "::warning::removing containers this job left running:$s"
+            docker rm -f $s
+          fi
 
   quality:
     runs-on: x64
@@ -229,6 +247,24 @@ jobs:
           nix develop .#build --command bun \
             node_modules/@norskvideo/ctl-dev-kit/licence/check-product-name.ts \
             shared/src/product-template.ts "$product"
+      - name: Reap the containers this job launched
+        # Whatever the tests did. A teardown cut short by a test timeout leaves
+        # its instance running on the shared Docker daemon (see JOB_REAP_STEP in
+        # conventions/workflow-shell.ts); everything this job launched mounts its
+        # own test-temp, so that is what goes.
+        if: always()
+        run: |
+          base="${NORSK_CTL_TEST_TMP:-}"
+          tt="$GITHUB_WORKSPACE/test-temp"
+          s=""
+          for c in $(docker ps -aq); do
+            src="$(docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null)" || continue
+            if { [ -n "$base" ] && grep -q "^$base/" <<<"$src"; } || grep -q "^$tt/" <<<"$src"; then s="$s $c"; fi
+          done
+          if [ -n "$s" ]; then
+            echo "::warning::removing containers this job left running:$s"
+            docker rm -f $s
+          fi
 
   # Report this pipeline's result to the aggregated product CI dashboard
   # (id3as/ci-workflows) instead of posting its own pony — the dashboard renders
@@ -313,3 +349,21 @@ jobs:
           product: __PRODUCT__
           pipeline: checks
           status: ${{ steps.meta.outputs.state }}
+      - name: Reap the containers this job launched
+        # Whatever the tests did. A teardown cut short by a test timeout leaves
+        # its instance running on the shared Docker daemon (see JOB_REAP_STEP in
+        # conventions/workflow-shell.ts); everything this job launched mounts its
+        # own test-temp, so that is what goes.
+        if: always()
+        run: |
+          base="${NORSK_CTL_TEST_TMP:-}"
+          tt="$GITHUB_WORKSPACE/test-temp"
+          s=""
+          for c in $(docker ps -aq); do
+            src="$(docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null)" || continue
+            if { [ -n "$base" ] && grep -q "^$base/" <<<"$src"; } || grep -q "^$tt/" <<<"$src"; then s="$s $c"; fi
+          done
+          if [ -n "$s" ]; then
+            echo "::warning::removing containers this job left running:$s"
+            docker rm -f $s
+          fi

package/conventions/integration-testing.md

@@ -76,9 +76,25 @@ On 2026-10-02 a reuters tier and a commentary tier each `compose up`ed
   older text here and in the reap steps that names a fixed 14321 is stale. Two
   concurrent runs of the SAME product that both `product add --image` still
   collide on the name.
-- Still banded, and still able to collide: the daemon's nginx proxy host port
-  (`daemon+3`), which is published on the host. Docker-assigned proxy ports are
-  in progress.
+- The daemon's port and its nginx proxy's host port are assigned by the system
+  when the ctl under test advertises the `ephemeral-ports` daemon capability
+  (`norsk-ctl capabilities`, or `daemonCapabilities` in `/api/health`). The
+  harness then starts the daemon with `NORSK_CTL_PORT=0` and `init --proxy-port
+  0`: the kernel picks the daemon's port, docker picks the proxy's host port
+  (nginx listens on 443 inside the container), and the daemon publishes both as
+  `<store>/daemon.port` and `<store>/proxy.port` (also `/api/proxy/status`).
+  Neither can collide. `runProductSmoke`, `runDemo`, `demo check --export-only`
+  and the dev-loop do this on their own. A `ProductHarness` you construct does
+  it only with `ephemeralPorts: true`, because your harness most likely keeps
+  its own `demoPorts(slug)` copy: switch every daemon/proxy port you read to
+  `harness.ports` (or `session.proxyBase`) first, then turn it on.
+- Against a ctl without the capability (the released `latest` until it catches
+  up) both stay on the slug's band (`daemon`, `daemon+3`), exactly as before,
+  and can still collide.
+- Still banded either way: the studio host port a launch publishes
+  (`daemon+2`, and `daemon+3+n` for further launches), and the dev backend's
+  port (bound inside the runner container, so not shared). In `direct` reach
+  mode with `--internal-only` the studio port is not published at all.
 
 ## Reaching an image product's control plane
 

package/conventions/integration.yml

@@ -387,6 +387,24 @@ jobs:
             fi
           done
           rm -f "$m" || true
+      - name: Reap the containers this job launched
+        # Whatever the tests did. A teardown cut short by a test timeout leaves
+        # its instance running on the shared Docker daemon (see JOB_REAP_STEP in
+        # conventions/workflow-shell.ts); everything this job launched mounts its
+        # own test-temp, so that is what goes.
+        if: always()
+        run: |
+          base="${NORSK_CTL_TEST_TMP:-}"
+          tt="$GITHUB_WORKSPACE/test-temp"
+          s=""
+          for c in $(docker ps -aq); do
+            src="$(docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null)" || continue
+            if { [ -n "$base" ] && grep -q "^$base/" <<<"$src"; } || grep -q "^$tt/" <<<"$src"; then s="$s $c"; fi
+          done
+          if [ -n "$s" ]; then
+            echo "::warning::removing containers this job left running:$s"
+            docker rm -f $s
+          fi
 
   # Report this pipeline's result to the aggregated product CI dashboard
   # (id3as/ci-workflows). !cancelled() so a real pass/fail reports, but a
@@ -469,6 +487,24 @@ jobs:
           product: __PRODUCT__
           pipeline: integration
           status: ${{ steps.meta.outputs.state }}
+      - name: Reap the containers this job launched
+        # Whatever the tests did. A teardown cut short by a test timeout leaves
+        # its instance running on the shared Docker daemon (see JOB_REAP_STEP in
+        # conventions/workflow-shell.ts); everything this job launched mounts its
+        # own test-temp, so that is what goes.
+        if: always()
+        run: |
+          base="${NORSK_CTL_TEST_TMP:-}"
+          tt="$GITHUB_WORKSPACE/test-temp"
+          s=""
+          for c in $(docker ps -aq); do
+            src="$(docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null)" || continue
+            if { [ -n "$base" ] && grep -q "^$base/" <<<"$src"; } || grep -q "^$tt/" <<<"$src"; then s="$s $c"; fi
+          done
+          if [ -n "$s" ]; then
+            echo "::warning::removing containers this job left running:$s"
+            docker rm -f $s
+          fi
 
   # Report the rc-candidate validation result to the norsk-ctl release gate. Only
   # on a ctl-candidate dispatch; release-collect tallies these and promotes

package/conventions/publish-docs.yml

@@ -319,3 +319,21 @@ jobs:
             "https://api.github.com/repos/id3as/norsk-ctl/dispatches" -d "$body")"
           [ "$code" = "204" ] || { echo "::error::docs-published dispatch to norsk-ctl failed (HTTP $code)"; exit 1; }
           echo "dispatched product-docs-published -> id3as/norsk-ctl"
+      - name: Reap the containers this job launched
+        # Whatever the tests did. A teardown cut short by a test timeout leaves
+        # its instance running on the shared Docker daemon (see JOB_REAP_STEP in
+        # conventions/workflow-shell.ts); everything this job launched mounts its
+        # own test-temp, so that is what goes.
+        if: always()
+        run: |
+          base="${NORSK_CTL_TEST_TMP:-}"
+          tt="$GITHUB_WORKSPACE/test-temp"
+          s=""
+          for c in $(docker ps -aq); do
+            src="$(docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null)" || continue
+            if { [ -n "$base" ] && grep -q "^$base/" <<<"$src"; } || grep -q "^$tt/" <<<"$src"; then s="$s $c"; fi
+          done
+          if [ -n "$s" ]; then
+            echo "::warning::removing containers this job left running:$s"
+            docker rm -f $s
+          fi

package/conventions/smoke.yml

@@ -326,6 +326,24 @@ jobs:
           path: ${{ runner.temp }}/norsk-logs-${{ github.run_id }}-${{ github.run_attempt }}
           retention-days: 7
           if-no-files-found: ignore
+      - name: Reap the containers this job launched
+        # Whatever the tests did. A teardown cut short by a test timeout leaves
+        # its instance running on the shared Docker daemon (see JOB_REAP_STEP in
+        # conventions/workflow-shell.ts); everything this job launched mounts its
+        # own test-temp, so that is what goes.
+        if: always()
+        run: |
+          base="${NORSK_CTL_TEST_TMP:-}"
+          tt="$GITHUB_WORKSPACE/test-temp"
+          s=""
+          for c in $(docker ps -aq); do
+            src="$(docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null)" || continue
+            if { [ -n "$base" ] && grep -q "^$base/" <<<"$src"; } || grep -q "^$tt/" <<<"$src"; then s="$s $c"; fi
+          done
+          if [ -n "$s" ]; then
+            echo "::warning::removing containers this job left running:$s"
+            docker rm -f $s
+          fi
 
   # Report this pipeline's result to the aggregated product CI dashboard
   # (id3as/ci-workflows). !cancelled() so a real pass/fail reports, but a
@@ -408,6 +426,24 @@ jobs:
           product: __PRODUCT__
           pipeline: smoke
           status: ${{ steps.meta.outputs.state }}
+      - name: Reap the containers this job launched
+        # Whatever the tests did. A teardown cut short by a test timeout leaves
+        # its instance running on the shared Docker daemon (see JOB_REAP_STEP in
+        # conventions/workflow-shell.ts); everything this job launched mounts its
+        # own test-temp, so that is what goes.
+        if: always()
+        run: |
+          base="${NORSK_CTL_TEST_TMP:-}"
+          tt="$GITHUB_WORKSPACE/test-temp"
+          s=""
+          for c in $(docker ps -aq); do
+            src="$(docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null)" || continue
+            if { [ -n "$base" ] && grep -q "^$base/" <<<"$src"; } || grep -q "^$tt/" <<<"$src"; then s="$s $c"; fi
+          done
+          if [ -n "$s" ]; then
+            echo "::warning::removing containers this job left running:$s"
+            docker rm -f $s
+          fi
 
   # Report the rc-candidate validation result to the norsk-ctl release gate. Only
   # on a ctl-candidate dispatch; release-collect tallies these and promotes

package/conventions/sync-ctl-packages.yml

@@ -160,10 +160,13 @@ jobs:
             { echo "moved<<PINS"; printf '%s' "$moved"; echo "PINS"; } >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Reinstall and run the product gate
-        id: gate
+      - name: Refresh the lockfiles against the new pins
         if: steps.bump.outputs.changed == '1'
-        continue-on-error: true
+        # NOT continue-on-error, unlike the gate below. A refresh that dies
+        # part-way (the runner OOM-killed it on 2026-10-03) leaves bumped
+        # manifests beside the old lockfiles; carrying on then committed exactly
+        # that, and every frozen install on the PR failed. Fail here instead,
+        # before anything is committed.
         run: |
           nix develop .#build --command bash -c '
             set -euo pipefail
@@ -198,6 +201,15 @@ jobs:
                 (cd "$(dirname "$lock")" && bun update "@norskvideo/$pkg") || true
               done
             done
+          '
+
+      - name: Run the product gate
+        id: gate
+        if: steps.bump.outputs.changed == '1'
+        continue-on-error: true
+        run: |
+          nix develop .#build --command bash -c '
+            set -euo pipefail
             bun run check:drift
             bun run lint
             bun run typecheck
@@ -276,3 +288,21 @@ jobs:
             curl "${curl_api[@]}" -X POST "$api" \
               --data "$(jq -nc --arg t "$title" --arg b "$body" --arg h "$branch" --argjson d "$draft" '{title:$t, body:$b, head:$h, base:"main", draft:$d}')" >/dev/null
           fi
+      - name: Reap the containers this job launched
+        # Whatever the tests did. A teardown cut short by a test timeout leaves
+        # its instance running on the shared Docker daemon (see JOB_REAP_STEP in
+        # conventions/workflow-shell.ts); everything this job launched mounts its
+        # own test-temp, so that is what goes.
+        if: always()
+        run: |
+          base="${NORSK_CTL_TEST_TMP:-}"
+          tt="$GITHUB_WORKSPACE/test-temp"
+          s=""
+          for c in $(docker ps -aq); do
+            src="$(docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null)" || continue
+            if { [ -n "$base" ] && grep -q "^$base/" <<<"$src"; } || grep -q "^$tt/" <<<"$src"; then s="$s $c"; fi
+          done
+          if [ -n "$s" ]; then
+            echo "::warning::removing containers this job left running:$s"
+            docker rm -f $s
+          fi

package/conventions/sync-dev-kit.yml

@@ -139,14 +139,25 @@ jobs:
           echo "old=$old_bare" >> "$GITHUB_OUTPUT"
           echo "new=$new" >> "$GITHUB_OUTPUT"
 
-      - name: Reinstall, re-sync the copies from canonical, run the product gate
+      - name: Reinstall against the new pin
+        if: steps.sync.outputs.changed == '1'
+        # NOT continue-on-error, unlike the gate below. An install that dies
+        # part-way (the runner OOM-killed sync-ctl-packages' one on 2026-10-03)
+        # would otherwise read as a red gate and open a reconciliation PR around
+        # a stale lockfile. Fail here instead, before anything is committed.
+        run: |
+          nix develop .#build --command bash -c '
+            set -euo pipefail
+            bun install
+          '
+
+      - name: Re-sync the copies from canonical and run the product gate
         id: gate
         if: steps.sync.outputs.changed == '1'
         continue-on-error: true
         run: |
           nix develop .#build --command bash -c '
             set -euo pipefail
-            bun install
             bun run node_modules/@norskvideo/ctl-dev-kit/conventions/sync-drift.ts
             bun run check:drift
             bun run lint
@@ -228,6 +239,24 @@ jobs:
       - name: Report "already fresh"
         if: steps.sync.outputs.changed != '1'
         run: echo "dev-kit pin already current -- nothing to sync."
+      - name: Reap the containers this job launched
+        # Whatever the tests did. A teardown cut short by a test timeout leaves
+        # its instance running on the shared Docker daemon (see JOB_REAP_STEP in
+        # conventions/workflow-shell.ts); everything this job launched mounts its
+        # own test-temp, so that is what goes.
+        if: always()
+        run: |
+          base="${NORSK_CTL_TEST_TMP:-}"
+          tt="$GITHUB_WORKSPACE/test-temp"
+          s=""
+          for c in $(docker ps -aq); do
+            src="$(docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null)" || continue
+            if { [ -n "$base" ] && grep -q "^$base/" <<<"$src"; } || grep -q "^$tt/" <<<"$src"; then s="$s $c"; fi
+          done
+          if [ -n "$s" ]; then
+            echo "::warning::removing containers this job left running:$s"
+            docker rm -f $s
+          fi
 
   # Report the sync result to the aggregated product CI dashboard
   # (id3as/ci-workflows). !cancelled() so a failed sync shows a sad pony but a
@@ -311,3 +340,21 @@ jobs:
           product: __PRODUCT__
           pipeline: dev-kit
           status: ${{ steps.meta.outputs.state }}
+      - name: Reap the containers this job launched
+        # Whatever the tests did. A teardown cut short by a test timeout leaves
+        # its instance running on the shared Docker daemon (see JOB_REAP_STEP in
+        # conventions/workflow-shell.ts); everything this job launched mounts its
+        # own test-temp, so that is what goes.
+        if: always()
+        run: |
+          base="${NORSK_CTL_TEST_TMP:-}"
+          tt="$GITHUB_WORKSPACE/test-temp"
+          s=""
+          for c in $(docker ps -aq); do
+            src="$(docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null)" || continue
+            if { [ -n "$base" ] && grep -q "^$base/" <<<"$src"; } || grep -q "^$tt/" <<<"$src"; then s="$s $c"; fi
+          done
+          if [ -n "$s" ]; then
+            echo "::warning::removing containers this job left running:$s"
+            docker rm -f $s
+          fi

package/conventions/upgrade-latest.yml

@@ -375,6 +375,24 @@ jobs:
       - name: Report "already fresh"
         if: steps.bump.outputs.changed != '1'
         run: echo "Nightly pins already current — nothing to bump."
+      - name: Reap the containers this job launched
+        # Whatever the tests did. A teardown cut short by a test timeout leaves
+        # its instance running on the shared Docker daemon (see JOB_REAP_STEP in
+        # conventions/workflow-shell.ts); everything this job launched mounts its
+        # own test-temp, so that is what goes.
+        if: always()
+        run: |
+          base="${NORSK_CTL_TEST_TMP:-}"
+          tt="$GITHUB_WORKSPACE/test-temp"
+          s=""
+          for c in $(docker ps -aq); do
+            src="$(docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null)" || continue
+            if { [ -n "$base" ] && grep -q "^$base/" <<<"$src"; } || grep -q "^$tt/" <<<"$src"; then s="$s $c"; fi
+          done
+          if [ -n "$s" ]; then
+            echo "::warning::removing containers this job left running:$s"
+            docker rm -f $s
+          fi
 
   # Report the nightly bump result to the aggregated product CI dashboard
   # (id3as/ci-workflows). !cancelled() so a failed bump shows a sad pony (a
@@ -458,3 +476,21 @@ jobs:
           pipeline: nightly
           status: ${{ steps.meta.outputs.state }}
           detail: ${{ needs.bump.outputs.summary }}
+      - name: Reap the containers this job launched
+        # Whatever the tests did. A teardown cut short by a test timeout leaves
+        # its instance running on the shared Docker daemon (see JOB_REAP_STEP in
+        # conventions/workflow-shell.ts); everything this job launched mounts its
+        # own test-temp, so that is what goes.
+        if: always()
+        run: |
+          base="${NORSK_CTL_TEST_TMP:-}"
+          tt="$GITHUB_WORKSPACE/test-temp"
+          s=""
+          for c in $(docker ps -aq); do
+            src="$(docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null)" || continue
+            if { [ -n "$base" ] && grep -q "^$base/" <<<"$src"; } || grep -q "^$tt/" <<<"$src"; then s="$s $c"; fi
+          done
+          if [ -n "$s" ]; then
+            echo "::warning::removing containers this job left running:$s"
+            docker rm -f $s
+          fi

package/conventions/workflow-shell.ts

@@ -171,6 +171,100 @@ export function jobsMissingTestTempStep(yaml: string): string[] {
   return bad;
 }
 
+/** The step every job that routes test-temp ends with, named so the guards
+ *  below can find it. */
+export const JOB_REAP_STEP = "Reap the containers this job launched";
+
+// Why a job needs a reap of its own at the END, when the pre-checkout step
+// already reaps. The pre-checkout reap only protects the NEXT job's checkout,
+// and only from containers mounting the legacy in-workspace test-temp. A
+// harness teardown that never finishes leaves the instance running on the
+// shared Docker daemon until something else removes it: bun times a test out,
+// kills the daemon with the test's other dangling processes, and the afterAll
+// that should delete the instance has nothing left to ask, then times out
+// itself. commentary's publish-docs left a composition guide's engine running
+// that way for 2.6 hours on 2026-10-03, where it grew to 28 GB and the host
+// OOM-killed the next morning's product CI. The job knows exactly what it
+// launched -- everything mounting its own $NORSK_CTL_TEST_TMP -- so the job
+// removes it, whatever happened before.
+const JOB_REAP_REQUIREMENTS: { name: string; ok: (body: string) => boolean }[] = [
+  { name: "scope", ok: (b) => /\$\{?NORSK_CTL_TEST_TMP/.test(b) && /\.Mounts\b/.test(b) },
+  { name: "remove", ok: (b) => /docker rm -f/.test(b) },
+];
+
+/** {@link JOB_REAP_STEP}s that would not reap, each reported at its `- name:`
+ *  line with what it is missing: the `always()` guard (without it a failed test
+ *  skips the step, which is exactly when it is needed) or a requirement above. */
+export function jobReapStepProblems(yaml: string): { line: number; missing: string[] }[] {
+  const lines = yaml.split("\n");
+  const out: { line: number; missing: string[] }[] = [];
+  lines.forEach((text, i) => {
+    if (!text.includes(`- name: ${JOB_REAP_STEP}`)) return;
+    const missing: string[] = [];
+    const runAt = lines.findIndex((l, j) => j > i && /^\s*run: \|\s*$/.test(l));
+    const header = lines.slice(i + 1, runAt < 0 ? i + 4 : runAt);
+    if (!header.some((l) => /^\s*if: always\(\)\s*$/.test(l))) missing.push("always");
+    const body = stepBody(lines, i);
+    missing.push(...JOB_REAP_REQUIREMENTS.filter((r) => !r.ok(body)).map((r) => r.name));
+    if (missing.length > 0) out.push({ line: i + 1, missing });
+  });
+  return out;
+}
+
+/** Jobs that route test-temp (so may launch instances) but have no
+ *  {@link JOB_REAP_STEP}. The presence half, per job for the same reason as
+ *  {@link jobsMissingTestTempStep}. */
+export function jobsMissingReapStep(yaml: string): string[] {
+  const lines = yaml.split("\n");
+  const bad: string[] = [];
+  let job: string | undefined;
+  let routes = 0;
+  let reaps = 0;
+  const settle = () => {
+    if (job !== undefined && routes > 0 && reaps === 0) bad.push(job);
+  };
+  for (const line of lines) {
+    const head = line.match(/^ {2}([A-Za-z_][\w-]*):\s*$/);
+    if (head) {
+      settle();
+      job = head[1];
+      routes = 0;
+      reaps = 0;
+      continue;
+    }
+    if (line.includes(`- name: ${TEST_TEMP_STEP}`)) routes++;
+    if (line.includes(`- name: ${JOB_REAP_STEP}`)) reaps++;
+  }
+  settle();
+  return bad;
+}
+
+/** Steps that rewrite a lockfile -- an unfrozen `bun install`, or a
+ *  `bun update` -- yet are `continue-on-error`, by their `- name:` line.
+ *
+ *  A gate may be allowed to fail: a red gate is information, and the sync
+ *  workflows turn it into a draft or reconciliation PR. A lockfile refresh may
+ *  not. One that dies part-way leaves bumped manifests beside the old
+ *  lockfiles, and a later step commits that pair: on 2026-10-03 the runner
+ *  OOM-killed sync-ctl-packages mid-install and its PR then failed every
+ *  frozen install. Keep the refresh in a step of its own that must succeed. */
+export function lockfileRefreshCanFail(yaml: string): number[] {
+  const lines = yaml.split("\n");
+  const starts = lines.flatMap((l, i) => (/^\s{6}- (name|uses|run)\b/.test(l) ? [i] : []));
+  const out: number[] = [];
+  starts.forEach((a, k) => {
+    const block = lines.slice(a, starts[k + 1] ?? lines.length);
+    const tolerated = block.some((l) => /^\s+continue-on-error:\s*true\b/.test(l));
+    const rewrites = block.some((l) => {
+      const t = l.trim();
+      if (t.startsWith("#") || t.startsWith('"')) return false;
+      return /\bbun (install|update)\b/.test(t) && !/--frozen-lockfile/.test(t);
+    });
+    if (tolerated && rewrites) out.push(a + 1);
+  });
+  return out;
+}
+
 /** A `ctl-candidate` validation that another candidate, or its own retry, can
  *  cancel.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-dev-kit",
-  "version": "0.2.21",
+  "version": "0.2.23",
   "type": "module",
   "exports": {
     "./create-product": "./create-product/create-product.ts",