@specific.dev/spectest 0.127.0 → 0.128.0

package/dist/coverage.d.ts

@@ -2,12 +2,14 @@ import type { ServiceConfig } from "./index.js";
 import { COVERAGE_CONTAINER_DIR, type CoverageReportsMode } from "./harness/coverage.js";
 export { COVERAGE_CONTAINER_DIR, type CoverageReportsMode };
 export { next, type NextCoverageOptions } from "./coverage-next.js";
+export { bun, type BunCoverageOptions } from "./coverage-bun.js";
+export { rust, rustHelperSource, type RustCoverageOptions } from "./coverage-rust.js";
 /** Where `node()` mounts its hook inside the container. */
 export declare const NODE_COVERAGE_HOOK_PATH = "/spectest/coverage-hook.cjs";
 /** The report `node()` writes when nothing has run yet on a branch. */
 export declare const NODE_COVERAGE_EMPTY_REPORT = "coverage-spectest-empty.json";
 /** Prefix of the per-process sockets the node hook answers on, relative
- *  to the coverage dir: `.ctl-<pid>`. */
+ *  to the coverage dir: `.ctl-<pid>-<nonce>`. */
 export declare const NODE_COVERAGE_SOCKET_PREFIX = ".ctl-";
 /** What `configure` learns about the service it rewrites. */
 export interface CoverageConfigureInfo {
@@ -111,6 +113,10 @@ export interface CoverageAdapter {
     load?(ctx: CoverageLoadContext): void | Promise<void>;
     /** Make the report appear in the directory. A throw fails the test. */
     capture?(ctx: CoverageCaptureContext): void | Promise<void>;
+    /** Component-owned containers (for example k3s pods). Their reports retain
+     * their own source roots and counter baselines, rather than the outer
+     * service's filesystem identity. Internal: ordinary adapters use capture. */
+    collect?(ctx: CoverageInventoryContext & CoverageCaptureContext, baseline: boolean): Promise<import("./harness/coverage.js").ServiceCoverageCapture[]>;
     /**
      * Project paths (gitignore-style patterns, project-relative) whose
      * changes this adapter's **inventory** accounts for — a package
@@ -218,7 +224,7 @@ export declare const NODE_COVERAGE_DUMP_PREFIX = "node-";
  *   without `--enable-source-maps`. For a bundled CLI that was 12 MB per
  *   invocation, inside the test's own time, parsed again at capture.
  * - **Takes** on request — the main thread binds a Unix socket
- *   `.ctl-<pid>` in the coverage directory and takes on `dump\n`; every
+ *   `.ctl-<pid>-<nonce>` in the coverage directory and takes on `dump\n`; every
  *   process binds its own (the first node process is often a wrapper,
  *   `pnpm exec`, `tsx`, `npm run`) — and in every thread's `exit`
  *   handler, which is how a short-lived CLI and a worker thread report.
@@ -307,9 +313,9 @@ export interface NodeCoverageOptions extends CoverageSourceOptions {
 export declare function node(options?: NodeCoverageOptions): CoverageAdapter;
 /**
  * Ask every node process that holds a hook socket in `dir` for a dump.
- * A socket nobody answers (its process died without unlinking — SIGKILL,
- * OOM) is removed. Returns how many processes answered; a process that
- * answered with an error throws.
+ * An unanswered socket with a live marker means the process died without
+ * a final report and fails collection. Stale sockets without live markers
+ * are removed. Returns how many processes answered; error replies throw.
  */
 export declare function dumpAllNodeProcesses(dir: string, signal: AbortSignal): Promise<number>;
 /** Forget the branch memory (tests). */

package/dist/coverage.js

@@ -32,12 +32,14 @@ import { harvestAllBrowserCoverage, takeBrowserCoverageReport } from "./browser-
 import { COVERAGE_CONTAINER_DIR } from "./harness/coverage.js";
 export { COVERAGE_CONTAINER_DIR };
 export { next } from "./coverage-next.js";
+export { bun } from "./coverage-bun.js";
+export { rust, rustHelperSource } from "./coverage-rust.js";
 /** Where `node()` mounts its hook inside the container. */
 export const NODE_COVERAGE_HOOK_PATH = "/spectest/coverage-hook.cjs";
 /** The report `node()` writes when nothing has run yet on a branch. */
 export const NODE_COVERAGE_EMPTY_REPORT = "coverage-spectest-empty.json";
 /** Prefix of the per-process sockets the node hook answers on, relative
- *  to the coverage dir: `.ctl-<pid>`. */
+ *  to the coverage dir: `.ctl-<pid>-<nonce>`. */
 export const NODE_COVERAGE_SOCKET_PREFIX = ".ctl-";
 /** The report name the harness writes an adapter's inventory to, in the
  *  bring-up capture only. */
@@ -87,7 +89,7 @@ export function validateCoverage(service, cov) {
                 (a.explains === undefined ||
                     (Array.isArray(a.explains) &&
                         a.explains.every((e) => typeof e === "string"))) &&
-                ["configure", "load", "capture", "inventory", "ownsReport"].every((k) => a[k] === undefined ||
+                ["configure", "load", "capture", "collect", "inventory", "ownsReport"].every((k) => a[k] === undefined ||
                     typeof a[k] === "function");
             const sourceOptions = a?.sourceOptions;
             const defaults = a?.defaultExcludeSources;
@@ -224,7 +226,7 @@ export const NODE_COVERAGE_DUMP_PREFIX = "node-";
  *   without `--enable-source-maps`. For a bundled CLI that was 12 MB per
  *   invocation, inside the test's own time, parsed again at capture.
  * - **Takes** on request — the main thread binds a Unix socket
- *   `.ctl-<pid>` in the coverage directory and takes on `dump\n`; every
+ *   `.ctl-<pid>-<nonce>` in the coverage directory and takes on `dump\n`; every
  *   process binds its own (the first node process is often a wrapper,
  *   `pnpm exec`, `tsx`, `npm run`) — and in every thread's `exit`
  *   handler, which is how a short-lived CLI and a worker thread report.
@@ -274,6 +276,7 @@ export const NODE_COVERAGE_HOOK = `"use strict";
 (function () {
   const dir = process.env[${JSON.stringify(NODE_COVERAGE_DIR_ENV)}];
   if (!dir) return;
+  const bunRuntime = !!process.versions.bun && process.env.SPECTEST_COVERAGE_RUNTIME === "bun";
   let inspector, fs, path, crypto, url, wt, net;
   try {
     inspector = require("node:inspector");
@@ -294,19 +297,46 @@ export const NODE_COVERAGE_HOOK = `"use strict";
   }
   // An in-process session answers before post() returns.
   function post(method, params) {
+    // Bun's callback API queues a microtask, including during process exit.
+    // Its synchronous return API is necessary for short-lived commands.
+    if (bunRuntime) return session.post(method, params || {});
     let out = null;
     session.post(method, params || {}, function (err, res) {
       out = err ? null : res;
     });
     return out;
   }
-  if (post("Profiler.enable") === null) return;
-  post("Profiler.startPreciseCoverage", { callCount: true, detailed: true });
+  fs.mkdirSync(dir, { recursive: true });
+  function fail(error) {
+    fs.writeFileSync(path.join(dir, "coverage-error-" + process.pid + ".txt"), String(error));
+  }
+  try {
+    if (post("Profiler.enable") === null) throw new Error("coverage profiler unavailable");
+    if (!post("Profiler.startPreciseCoverage", { callCount: true, detailed: true })) throw new Error("precise coverage unavailable");
+    if (bunRuntime && (!process.versions.bun || !wt.isMainThread)) throw new Error("Bun coverage requires a supported main-thread runtime");
+  } catch (error) { fail(error); throw error; }
+  let bunRangeAdjustment = 0;
+  if (bunRuntime) {
+    // Bun releases have exposed both JSC-inclusive and V8-exclusive range
+    // ends. Probe the actual runtime before app code loads: interpreting an
+    // inclusive closing brace as exclusive attributes its source-map token
+    // to startup, making untouched function bodies appear boot-executed.
+    const probe = "let x=0;\\nfunction spectestCoverageProbe(){return 1;}\\nspectestCoverageProbe();\\n//# sourceURL=spectest-coverage-probe";
+    eval(probe);
+    const measured = post("Profiler.takePreciseCoverage");
+    const script = measured && measured.result.find(s => s.url === "spectest-coverage-probe");
+    const fn = script && script.functions.find(f => f.ranges[0].startOffset === probe.indexOf("function"));
+    if (!fn) { const error = new Error("Bun precise coverage capability probe failed"); fail(error); throw error; }
+    bunRangeAdjustment = probe.indexOf("}") + 1 - fn.ranges[0].endOffset;
+    if (bunRangeAdjustment !== 0 && bunRangeAdjustment !== 1) {
+      const error = new Error("unsupported Bun coverage range semantics"); fail(error); throw error;
+    }
+  }
 
   // Attach before app scripts execute. Enabling only at capture loses the
   // source of collected vm contexts (e.g. Temporal workflow bundles).
   // Bound V8's collected-script cache; live sources remain owned by V8.
-  post("Debugger.enable", { maxScriptsCacheSize: 16 * 1024 * 1024 });
+  if (!bunRuntime) post("Debugger.enable", { maxScriptsCacheSize: 16 * 1024 * 1024 });
 
   const GENERATED = new Map();
   try {
@@ -325,6 +355,10 @@ export const NODE_COVERAGE_HOOK = `"use strict";
   // can be reused by another process, vm context, or compilation.
   const known = new Map();
   let seq = 0;
+  const processToken = process.pid + "-" + crypto.randomBytes(6).toString("hex");
+  const liveMarker = path.join(dir, ".live-" + processToken + "-" + wt.threadId);
+  fs.writeFileSync(liveMarker, "");
+  fs.writeFileSync(path.join(dir, ".attached-" + (bunRuntime ? "bun" : "node")), "");
 
   function isApp(u) {
     return typeof u === "string" && u.startsWith("file://") && u.indexOf("/node_modules/") < 0 && u.indexOf("/.cache/") < 0 && u !== SELF;
@@ -500,6 +534,12 @@ export const NODE_COVERAGE_HOOK = `"use strict";
     const kept = [];
     const units = new Set();
     for (const s of res.result) {
+      if (bunRuntime && bunRangeAdjustment && Array.isArray(s.functions)) {
+        const length = Math.max(...s.functions.flatMap(f => f.ranges.map(r => r.endOffset)));
+        for (const f of s.functions) for (const range of f.ranges) {
+          if (range.endOffset < length) range.endOffset += bunRangeAdjustment;
+        }
+      }
       if (!Array.isArray(s.functions) || !s.functions.some(ran)) continue;
       if (isApp(s.url)) kept.push(s);
       else if (isDep(s.url)) {
@@ -521,7 +561,18 @@ export const NODE_COVERAGE_HOOK = `"use strict";
         fs.mkdirSync(MARKERS, { recursive: true });
       } catch (e) {}
       for (const s of fresh) {
-        const r = post("Debugger.getScriptSource", { scriptId: s.scriptId });
+        let r;
+        if (bunRuntime) {
+          // Bun does not expose getScriptSource through the in-process API.
+          // Accept only precompiled, untranspiled bundles, never guess that
+          // disk TypeScript offsets describe executed JavaScript.
+          const source = fs.readFileSync(url.fileURLToPath(s.url), "utf8");
+          const extent = Math.max(...s.functions.flatMap(f => f.ranges.map(r => r.endOffset)));
+          if (!source.startsWith("// @bun\\n") || source.length !== extent) {
+            throw new Error("Bun coverage needs an unchanged bun build --target=bun bundle with source maps: " + s.url);
+          }
+          r = { scriptSource: source };
+        } else r = post("Debugger.getScriptSource", { scriptId: s.scriptId });
         try {
           const source = r && r.scriptSource;
           if (GENERATED.has(s.url) && typeof source === "string") {
@@ -563,12 +614,12 @@ export const NODE_COVERAGE_HOOK = `"use strict";
         };
       }),
     };
-    const name = ${JSON.stringify(NODE_COVERAGE_DUMP_PREFIX)} + process.pid + "-" + wt.threadId + "-" + Date.now() + "-" + seq++ + ".json";
+    const name = ${JSON.stringify(NODE_COVERAGE_DUMP_PREFIX)} + processToken + "-" + wt.threadId + "-" + Date.now() + "-" + seq++ + ".json";
     writeAtomic(path.join(dir, name), JSON.stringify(doc));
   }
 
   if (wt.isMainThread) {
-    const SOCK = path.join(dir, ${JSON.stringify(NODE_COVERAGE_SOCKET_PREFIX)} + process.pid);
+    const SOCK = path.join(dir, ${JSON.stringify(NODE_COVERAGE_SOCKET_PREFIX)} + processToken);
     const server = net.createServer(function (conn) {
       let buf = "";
       conn.on("data", function (chunk) {
@@ -580,6 +631,7 @@ export const NODE_COVERAGE_HOOK = `"use strict";
           take();
           reply = "ok\\n";
         } catch (err) {
+          fail(err);
           reply = "error " + (err && err.message ? err.message : String(err)) + "\\n";
         }
         conn.end(reply);
@@ -600,7 +652,8 @@ export const NODE_COVERAGE_HOOK = `"use strict";
   process.on("exit", function () {
     try {
       take();
-    } catch (e) {}
+      fs.unlinkSync(liveMarker);
+    } catch (e) { fail(e); }
   });
 })();
 `;
@@ -809,9 +862,9 @@ export function node(options = {}) {
 }
 /**
  * Ask every node process that holds a hook socket in `dir` for a dump.
- * A socket nobody answers (its process died without unlinking — SIGKILL,
- * OOM) is removed. Returns how many processes answered; a process that
- * answered with an error throws.
+ * An unanswered socket with a live marker means the process died without
+ * a final report and fails collection. Stale sockets without live markers
+ * are removed. Returns how many processes answered; error replies throw.
  */
 export async function dumpAllNodeProcesses(dir, signal) {
     const fs = await import("node:fs/promises");
@@ -850,6 +903,10 @@ export async function dumpAllNodeProcesses(dir, signal) {
             });
         });
         if (reply === null) {
+            const pid = name.slice(NODE_COVERAGE_SOCKET_PREFIX.length);
+            if ((await fs.readdir(dir)).some(marker => marker.startsWith(".live-" + pid + "-"))) {
+                throw new Error(`coverage process ${name} exited without a final report`);
+            }
             // Nobody home: the process is gone. Clean up so the next capture
             // does not knock again.
             await fs.unlink(sock).catch(() => { });

package/dist/daemon.js

@@ -3277,7 +3277,11 @@ async function captureServiceCoverage(baseline = false) {
     for (const [name, s] of RUNTIME_SERVICES)
         byName.set(name, s);
     const all = [...byName.values()];
-    const services = all.filter((s) => s.coverage !== undefined);
+    const covered = all.filter((s) => s.coverage !== undefined);
+    const services = covered.filter(s => {
+        const adapters = coverageAdapters(s.coverage);
+        return !adapters.some(a => a.collect) || adapters.some(a => !a.collect);
+    });
     // The environment's own capture is unconditional (see above); the
     // services' come from the ones that opted in, none included.
     const environment = captureEnvironmentCoverage(all, baseline);
@@ -3336,7 +3340,28 @@ async function captureServiceCoverage(baseline = false) {
         // files and V8 JSON pass through.
         return applyCoverageDelta(read, coverageReportsMode(svc.coverage), deltaReports);
     }));
-    return [...captures, await environment];
+    const components = await Promise.all(covered.flatMap(svc => coverageAdapters(svc.coverage)
+        .filter(a => a.collect).map(async (adapter) => {
+        const signal = AbortSignal.timeout(COVERAGE_CAPTURE_TIMEOUT_MS);
+        try {
+            return await adapter.collect({
+                ...coverageCaptureContext(svc, signal, new Set()),
+                projectFiles: () => walkProjectFiles(WORKSPACE),
+                async readProjectFile(p) {
+                    try {
+                        return await fs.readFile(resolveProjectPath(p, { record: false }), "utf8");
+                    }
+                    catch {
+                        return null;
+                    }
+                },
+            }, baseline);
+        }
+        catch (error) {
+            return [{ service: `${svc.name}/${adapter.name}`, reports: [], error: String(error) }];
+        }
+    })));
+    return [...captures, ...components.flat(), await environment];
 }
 /**
  * Mint a session id. `idScope` (the running test's case id; `"eval"`

package/dist/harness/component-images.d.ts

@@ -1,6 +1,7 @@
 import type { BuildImage, ComponentImageBuild, ServiceConfig } from "../index.js";
 export type KubernetesImage = string | (BuildImage & {
     reference: string;
+    coverage?: import("../coverage.js").ServiceCoverage;
 });
 /** containerd/CRI use fully qualified names, including the default tag. */
 export declare function canonicalImageReference(reference: string): string;

package/dist/harness/component-images.js

@@ -47,8 +47,10 @@ export function kubernetesImages(images) {
         seen.set(reference, identity);
         if (typeof image === "string")
             pulls.push(image);
-        else
-            builds.push({ reference, image });
+        else {
+            const { coverage: _coverage, ...build } = image;
+            builds.push({ reference, image: image.coverage === undefined ? image : build });
+        }
     }
     return { pulls, builds };
 }

package/dist/harness/coverage-target.d.ts

@@ -0,0 +1,10 @@
+import { type CoverageCaptureContext, type CoverageInventoryContext, type ServiceCoverage } from "../coverage.js";
+import { type ServiceCoverageCapture } from "./coverage.js";
+export declare function captureCoverageTarget(options: {
+    context: CoverageCaptureContext & CoverageInventoryContext;
+    coverage: ServiceCoverage;
+    root: string;
+    baseline: boolean;
+    inventoryAvailable?: boolean;
+    counterKey?: string;
+}): Promise<ServiceCoverageCapture>;

package/dist/harness/coverage-target.js

@@ -0,0 +1,54 @@
+// Runtime adapters operate on this same context in Docker and nested runtimes.
+// Counter baselines belong to an instance; source identity belongs to its image.
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { attachCoverageSourceOptions, coverageAdapters, coverageReportsMode, resolveCoverageSourceOptions } from "../coverage.js";
+import { applyCoverageDelta, readCoverageDir } from "./coverage.js";
+export async function captureCoverageTarget(options) {
+    const { context: ctx, coverage, root, baseline } = options;
+    const adapters = coverageAdapters(coverage);
+    const written = new Set();
+    const delta = new Set();
+    const context = { ...ctx, async writeReport(name, content) {
+            const resolved = path.resolve(ctx.reportDir, name);
+            if (!resolved.startsWith(path.resolve(ctx.reportDir) + path.sep))
+                throw new Error("coverage report escapes directory");
+            await fs.mkdir(path.dirname(resolved), { recursive: true });
+            await fs.writeFile(resolved + ".tmp", content);
+            await fs.rename(resolved + ".tmp", resolved);
+            written.add(name);
+        } };
+    try {
+        ctx.signal.throwIfAborted();
+        const policies = await resolveCoverageSourceOptions(adapters, ctx, typeof coverage === "object" ? {
+            sourceRoot: coverage.sourceRoot, excludeSources: coverage.excludeSources,
+        } : undefined);
+        for (const adapter of adapters) {
+            if (adapter.collect || adapter.load)
+                throw new Error(`adapter ${adapter.name} cannot run inside a container; attach browser coverage to the cluster service`);
+            written.clear();
+            await adapter.capture?.(context);
+            if (adapter.reports === "delta")
+                for (const name of written)
+                    delta.add(name);
+        }
+        if (baseline && options.inventoryAvailable !== false) {
+            const units = new Set();
+            for (const adapter of adapters)
+                for (const unit of await adapter.inventory?.(context) ?? [])
+                    units.add(unit);
+            await context.writeReport("inventory.units", [...units].sort().join("\n"));
+        }
+        ctx.signal.throwIfAborted();
+        const capture = await readCoverageDir(ctx.service, ctx.reportDir);
+        if (baseline)
+            await fs.rm(path.join(ctx.reportDir, "inventory.units"), { force: true });
+        capture.root = root;
+        attachCoverageSourceOptions(capture, policies);
+        const result = applyCoverageDelta({ ...capture, service: options.counterKey ?? capture.service }, coverageReportsMode(coverage), delta);
+        return { ...result, service: capture.service };
+    }
+    catch (error) {
+        return { service: ctx.service, reports: [], error: String(error) };
+    }
+}

package/dist/index.js

@@ -41,7 +41,7 @@ export { McpHttpError, McpRpcError, McpAuthDeniedError, } from "./mcp.js";
 import { isLocator, getLocatorProbe, isBrowserSession, getBrowserProbe, } from "./locator.js";
 import { escapeInvisible, textDifferenceNote, } from "./text-match.js";
 import { describeUrlPattern } from "./url-match.js";
-import { applyCoverageAdapters, validateCoverage } from "./coverage.js";
+import { applyCoverageAdapters, coverageAdapters, validateCoverage } from "./coverage.js";
 import { resolveExistingProjectPath } from "./project-files.js";
 export { ca } from "./environment-ca.js";
 // Low-level ingress primitives + the framework lowering that the friendly
@@ -185,6 +185,15 @@ function expandServiceGroups(input) {
             // Rewrite relative dependsOn to final keys; a spread keeps function
             // fields (helpers/setup) and the enumerable-symbol ingress decls.
             const final = { ...svc, ...(part === entry.primary ? primaryOverrides : {}) };
+            // Component-owned nested containers keep their collection when callers
+            // add ordinary service coverage (for example browser coverage on k3s).
+            const collectors = coverageAdapters(svc.coverage).filter(adapter => adapter.collect);
+            if (part === entry.primary && collectors.length && primaryOverrides.coverage !== undefined) {
+                const extra = primaryOverrides.coverage;
+                final.coverage = { ...(typeof extra === "object" ? extra : {}), adapters: [
+                        ...collectors, ...coverageAdapters(extra).filter(adapter => !collectors.includes(adapter)),
+                    ] };
+            }
             if (final.dependsOn?.length) {
                 final.dependsOn = final.dependsOn.map((d) => partKeys.has(d) ? naming.key(d) : d);
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@specific.dev/spectest",
-  "version": "0.127.0",
+  "version": "0.128.0",
   "description": "Spectest SDK for defining test environments in TypeScript.",
   "type": "module",
   "main": "./dist/index.js",

package/src/components/k3s-coverage.test.ts

@@ -0,0 +1,160 @@
+import { expect, test } from "bun:test";
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import { k3sCoverage } from "./k3s-coverage";
+import { k3s } from "./k3s";
+import { node, browser, rust, type CoverageAdapter } from "../coverage";
+import { defineEnvironment } from "../index";
+import type { Pod, Patch } from "./k3s-trust";
+import { podTrustPatch } from "./k3s-trust";
+
+function apply(pod: any, patches: Patch[]): any {
+  const out = structuredClone(pod);
+  for (const operation of patches) {
+    const keys = operation.path.slice(1).split("/");
+    const key = keys.pop()!;
+    const parent = keys.reduce((value, key) => value[key], out);
+    if (key === "-") parent.push(operation.value); else parent[key] = operation.value;
+  }
+  return out;
+}
+const digest = `images.test/api@sha256:${"a".repeat(64)}`;
+const image = { reference: "images.test/api:test", content: "FROM node:24", coverage: { adapters: [node({ sourceRoot: "packages" })] } };
+const dependencies = {
+  image: async () => ({ aliases: [digest], root: "/app", env: { NODE_OPTIONS: "--max-old-space-size=512" } }),
+  files: async () => {},
+};
+
+test("admission recognizes prepared digest, preserves trust/user settings, covers init containers, and is idempotent", async () => {
+  const coverage = k3sCoverage([image]);
+  const pod = { metadata: { name: "api", annotations: { other: "value" } }, spec: {
+    containers: [{ name: "api", image: digest, env: [{ name: "FOO", value: "bar" }], securityContext: { runAsUser: 1000, readOnlyRootFilesystem: true } },
+      { name: "db", image: "postgres:17" }], initContainers: [{ name: "migrate", image: image.reference }],
+  } };
+  const trusted = apply(pod, podTrustPatch(pod, "ca-bundle"));
+  const patches = await coverage.mutate("k8s", trusted, "app", true, false, "admission", dependencies);
+  const result = apply(trusted, patches);
+  expect(result.spec.containers[0].image).toBe(digest);
+  expect(result.spec.containers[0].securityContext).toEqual(pod.spec.containers[0].securityContext);
+  expect(result.spec.containers[0].env).toContainEqual({ name: "NODE_OPTIONS", value: "--max-old-space-size=512 --require /spectest/coverage-hook.cjs" });
+  expect(result.spec.containers[0].env).toContainEqual({ name: "FOO", value: "bar" });
+  expect(result.spec.containers[0].volumeMounts.some((m: any) => m.mountPath === "/spectest/ca-bundle.crt")).toBe(true);
+  expect(result.spec.containers[1]).toEqual(trusted.spec.containers[1]);
+  const ids = JSON.parse(result.metadata.annotations["spectest.dev/coverage"]).instances;
+  expect(new Set(ids).size).toBe(2);
+  expect(await coverage.mutate("k8s", result, "app", true, false, "admission", dependencies)).toEqual([]);
+  await expect(coverage.mutate("k8s", result, "app", true, false, "another-pod", dependencies)).rejects.toThrow("inherited");
+  expect(await coverage.mutate("k8s", trusted, "app", true, true, "ephemeral", dependencies)).toEqual([]);
+  const other = structuredClone(pod);
+  other.spec.containers[0].image = `images.test/api@sha256:${"b".repeat(64)}`;
+  other.spec.initContainers = [];
+  expect(await coverage.mutate("k8s", other, "app", true, false, "other", dependencies)).toEqual([]);
+});
+
+test("coverage refuses colliding mounts and dynamic NODE_OPTIONS", async () => {
+  const coverage = k3sCoverage([image]);
+  for (const extra of [{ volumeMounts: [{ name: "user", mountPath: "/spectest" }] }, { env: [{ name: "NODE_OPTIONS", valueFrom: { secretKeyRef: { name: "options", key: "flags" } } }] }]) {
+    const pod = { metadata: {}, spec: { containers: [{ name: "api", image: digest, ...extra }] } };
+    await expect(coverage.mutate("k8s", pod as Pod, "app", true, false, "id", dependencies)).rejects.toThrow();
+  }
+});
+
+test("k3s mounts fork-local storage on every node and preserves image collectors when browser coverage is added", () => {
+  const environment = defineEnvironment({ name: "coverage", services: { k8s: {
+    ...k3s({ nodes: 3, images: [image], ingressDomains: ["app.test"] }),
+    coverage: { adapters: [browser()] },
+  } } });
+  const services = environment.config.services;
+  for (const service of Object.values(services)) {
+    const volume = service.volumes?.find(v => v.target === "/spectest/pod-coverage");
+    expect(volume?.source).toEndWith("/.spectest/coverage/k8s");
+    expect(volume?.reachExempt).toBe(true);
+  }
+  const wire = JSON.parse(JSON.stringify(services.k8s));
+  expect(wire.coverage.adapters.map((a: any) => a.adapter)).toEqual(["k3s-containers", "browser"]);
+  expect(wire.coverage.adapters[0].images[0].config.env.NODE_OPTIONS).toContain("--require");
+  expect(wire.imageBuilds[0].image.coverage).toBeUndefined();
+  const changed = defineEnvironment({ name: "coverage", services: { k8s: k3s({ images: [{ ...image, coverage: { adapters: [rust()] } }] }) } });
+  expect(JSON.stringify(changed.config)).not.toBe(JSON.stringify(environment.config));
+});
+
+test("replica counters are independent, reports survive pod deletion, and capture errors remain visible", async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "k3s-cov-"));
+  try {
+    const adapter: CoverageAdapter = { name: "lcov", reports: "cumulative", sourceOptions: { sourceRoot: "packages" }, ownsReport: n => n.endsWith(".lcov"),
+      async inventory(ctx) { await ctx.exec("inventory-probe"); return ["npm:api@1.0.0", "npm:unused@2.0.0"]; },
+    };
+    const coverage = k3sCoverage([{ ...image, coverage: { adapters: [adapter] } }]);
+    const ids = ["a".repeat(16), "b".repeat(16)];
+    for (const id of ids) {
+      const dir = path.join(root, ".pods", id);
+      await fs.mkdir(dir, { recursive: true });
+      await fs.writeFile(path.join(dir, ".instance.json"), JSON.stringify({ id, image: image.reference, container: "api", namespace: "app", root: "/app" }));
+      await fs.writeFile(path.join(dir, "app.lcov"), "TN:\nSF:/app/src/api.ts\nDA:1,2\nend_of_record\n");
+    }
+    let pods = ids.map(id => ({ metadata: { name: `api-${id}`, annotations: { "spectest.dev/coverage": JSON.stringify({ instances: [id] }) } },
+      status: { containerStatuses: [{ name: "api", state: { running: {} } }] } }));
+    const commands: string[] = [];
+    const ctx = { service: "k8s", reportDir: root, signal: AbortSignal.timeout(5000), exec: async (command: string) => {
+      commands.push(command); return { stdout: command.startsWith("kubectl get") ? JSON.stringify({ items: pods }) : "", stderr: "" };
+    },
+      projectFiles: async () => [], readProjectFile: async () => null, writeReport: async () => {} };
+    const first = await coverage.adapter().collect!(ctx, true);
+    expect(first).toHaveLength(1);
+    expect(first[0].error).toBeUndefined();
+    expect(first[0].reports).toHaveLength(3);
+    expect(first[0].reports.filter(r => r.name.endsWith(".lcov")).every(r => r.sourceOptions?.sourceRoot === "packages")).toBe(true);
+    // The consumer recognizes this exact name; per-replica prefixes would hide it.
+    expect(first[0].reports.find(r => r.name === "inventory.units")?.content).toBe("npm:api@1.0.0\nnpm:unused@2.0.0");
+    expect(commands.filter(command => command.includes("inventory-probe")).sort()).toEqual(ids.map(id => `kubectl exec -n 'app' 'api-${id}' -c 'api' -- sh -c 'inventory-probe'`));
+    expect(commands.filter(command => command.startsWith("kubectl get"))).toHaveLength(1);
+    // No pod exists any longer. Reports remain on fork-local node storage.
+    pods = [];
+    commands.length = 0;
+    await fs.writeFile(path.join(root, ".pods", ids[1], "app.lcov"), "TN:\nSF:/app/src/api.ts\nDA:1,3\nend_of_record\n");
+    const next = await coverage.adapter().collect!(ctx, false);
+    expect(next[0].reports[0].content).toBe("TN:\n");
+    expect(next[0].reports[1].content).toContain("DA:1,1");
+    expect(commands).toEqual([]); // Native collection needs neither API discovery nor exec.
+    await fs.writeFile(path.join(root, ".pods", ids[0], "failed.txt"), "lost report");
+    expect((await coverage.adapter().collect!(ctx, false))[0].error).toContain("neither");
+  } finally { await fs.rm(root, { recursive: true, force: true }); }
+});
+
+test("collection bounds parallel targets and shares lazy discovery for command adapters", async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "k3s-cov-parallel-"));
+  try {
+    let active = 0;
+    let peak = 0;
+    let release!: () => void;
+    const gate = new Promise<void>(resolve => { release = resolve; });
+    const adapter: CoverageAdapter = { name: "command", async capture(ctx) {
+      peak = Math.max(peak, ++active);
+      if (active === 8) release();
+      await gate;
+      await ctx.exec("capture-probe");
+      await ctx.writeReport("app.lcov", "TN:\nSF:/app/main.rs\nDA:1,1\nend_of_record\n");
+      active--;
+    } };
+    const ids = Array.from({ length: 11 }, (_, index) => index.toString(16).padStart(16, "0"));
+    for (const id of ids) {
+      const dir = path.join(root, ".pods", id);
+      await fs.mkdir(dir, { recursive: true });
+      await fs.writeFile(path.join(dir, ".instance.json"), JSON.stringify({ id, image: image.reference, container: "api", namespace: "app", root: "/app" }));
+    }
+    const pods = ids.map(id => ({ metadata: { name: `api-${id}`, annotations: { "spectest.dev/coverage": JSON.stringify({ instances: [id] }) } },
+      status: { containerStatuses: [{ name: "api", state: { running: {} } }] } }));
+    const commands: string[] = [];
+    const ctx = { service: "k8s", reportDir: root, signal: AbortSignal.timeout(5000), exec: async (command: string) => {
+      commands.push(command); return { stdout: command.startsWith("kubectl get") ? JSON.stringify({ items: pods }) : "", stderr: "" };
+    }, projectFiles: async () => [], readProjectFile: async () => null, writeReport: async () => {} };
+    const capture = (await k3sCoverage([{ ...image, coverage: { adapters: [adapter] } }]).adapter().collect!(ctx, false))[0];
+    expect(capture.error).toBeUndefined();
+    expect(capture.reports.map(report => report.name)).toEqual(ids.map(id => `${id}/app.lcov`));
+    expect(active).toBe(0);
+    expect(peak).toBe(8);
+    expect(commands.filter(command => command.startsWith("kubectl get"))).toHaveLength(1);
+    expect(commands.filter(command => command.includes("capture-probe"))).toHaveLength(11);
+  } finally { await fs.rm(root, { recursive: true, force: true }); }
+}, 10000);