@specific.dev/spectest 0.91.0 → 0.91.2

package/dist/android-step.js

@@ -15,7 +15,7 @@ export function androidTargetLabel(target) {
         case "id":
             return `id ${quoted}`;
         case "accessibility":
-            return `accessibility label ${quoted}`;
+            return `label ${quoted}`;
         case "xpath":
             return `XPath ${quoted}`;
         case "custom":
@@ -74,5 +74,5 @@ export function androidStepTitle(step) {
             label = `run command ${JSON.stringify(step.command)}`;
             break;
     }
-    return `${step.device}: ${label}`;
+    return label;
 }

package/dist/components/k3s.d.ts

@@ -328,6 +328,8 @@ export interface K3sHelpers {
         limit?: number;
     }): Promise<Wrapped<KubernetesListObject<T>>>;
 }
+/** @internal Exported for regression tests; not part of the components API. */
+export declare function isTransientApplyError(err: unknown): boolean;
 export declare function k3s(opts?: K3sOptions): {
     image: {
         type: "registry";

package/dist/components/k3s.js

@@ -1,5 +1,6 @@
 import { isIP } from "node:net";
 import { installPodTrust } from "./k3s-trust.js";
+import { waitForAll } from "../harness/concurrency.js";
 import { loadK3sBuildImages } from "../harness/k3s-image-loader.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { spawn as nodeSpawn } from "node:child_process";
@@ -909,8 +910,33 @@ const TRANSIENT_APPLY_PATTERNS = [
 function errorText(err) {
     return err?.message ?? String(err);
 }
-function isTransientApplyError(err) {
-    const msg = errorText(err);
+/** ApiException formats its body with JSON.stringify, escaping Status.message.
+ * Read the actual response instead of matching that presentation string. */
+function applyErrorStatus(err) {
+    let body = err?.body;
+    if (typeof body === "string") {
+        try {
+            body = JSON.parse(body);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return body && typeof body === "object" && !Array.isArray(body) ? body : undefined;
+}
+/** @internal Exported for regression tests; not part of the components API. */
+export function isTransientApplyError(err) {
+    const status = applyErrorStatus(err);
+    const code = status?.code ?? err?.code;
+    if ([429, 500, 503, 504].includes(code))
+        return true;
+    // A missing namespace can converge while another apply creates it. An
+    // arbitrary resource 404 cannot: don't classify by HTTP status alone.
+    if (code === 404 && status?.reason === "NotFound" &&
+        status.details?.kind === "namespaces" && !status.details.group &&
+        typeof status.details.name === "string" && status.details.name.length > 0)
+        return true;
+    const msg = typeof status?.message === "string" ? status.message : errorText(err);
     return TRANSIENT_APPLY_PATTERNS.some((re) => re.test(msg));
 }
 function describeDoc(doc) {
@@ -1243,48 +1269,51 @@ async function waitForJob(deps, name, opts) {
  * reachable over HTTPS with a cert the test framework already trusts.
  */
 async function setupK3sCluster(name, helpers, opts) {
-    const tlsEnabled = opts.traefik && opts.ingressDomains.length > 0 && caPresent();
-    if (tlsEnabled) {
-        const { cert, key } = await issueIngressCert(opts.ingressDomains.map((d) => `*.${d}`));
-        // Apply the cert Secret + dynamic-config ConfigMap before the
-        // Deployment that mounts them. `stringData` lets us hand over plain
-        // PEM; the API server base64-encodes it.
-        await helpers.client.core.createNamespacedSecret({
-            namespace: "kube-system",
-            body: {
-                metadata: { name: TRAEFIK_TLS_SECRET, namespace: "kube-system" },
-                type: "kubernetes.io/tls",
-                stringData: { "tls.crt": cert, "tls.key": key },
-            },
-        });
-        await helpers.client.core.createNamespacedConfigMap({
-            namespace: "kube-system",
-            body: {
-                metadata: {
-                    name: TRAEFIK_DYNAMIC_CONFIGMAP,
-                    namespace: "kube-system",
-                },
-                data: { "tls.yaml": TRAEFIK_DYNAMIC_TLS },
-            },
-        });
-    }
-    if (opts.traefik)
-        await helpers.apply(buildTraefikManifest(tlsEnabled));
-    if (opts.registry)
-        await helpers.apply(REGISTRY_MANIFEST);
-    // Both rollouts proceed independently inside the cluster — wait on them
-    // concurrently (they used to serialize, wasting up to a rollout's tail).
-    // 250ms polling: these two sit on the cold start's critical path, where
-    // the default 500ms interval wastes real time.
+    // The registry can start while Traefik's certificates are being prepared.
     const wait = (deployment) => helpers.waitForRollout(deployment, {
         namespace: "kube-system",
         timeoutMs: 120_000,
         intervalMs: 250,
     });
-    const waits = opts.traefik ? [wait("traefik")] : [];
-    if (opts.registry)
-        waits.push(wait("spectest-registry"));
-    await Promise.all(waits);
+    await waitForAll([
+        (async () => {
+            if (!opts.traefik)
+                return;
+            const tlsEnabled = opts.ingressDomains.length > 0 && caPresent();
+            if (tlsEnabled) {
+                const { cert, key } = await issueIngressCert(opts.ingressDomains.map((d) => `*.${d}`));
+                // Apply the cert Secret + dynamic-config ConfigMap before the
+                // Deployment that mounts them. `stringData` lets us hand over plain
+                // PEM; the API server base64-encodes it.
+                await helpers.client.core.createNamespacedSecret({
+                    namespace: "kube-system",
+                    body: {
+                        metadata: { name: TRAEFIK_TLS_SECRET, namespace: "kube-system" },
+                        type: "kubernetes.io/tls",
+                        stringData: { "tls.crt": cert, "tls.key": key },
+                    },
+                });
+                await helpers.client.core.createNamespacedConfigMap({
+                    namespace: "kube-system",
+                    body: {
+                        metadata: {
+                            name: TRAEFIK_DYNAMIC_CONFIGMAP,
+                            namespace: "kube-system",
+                        },
+                        data: { "tls.yaml": TRAEFIK_DYNAMIC_TLS },
+                    },
+                });
+            }
+            await helpers.apply(buildTraefikManifest(tlsEnabled));
+            await wait("traefik");
+        })(),
+        (async () => {
+            if (!opts.registry)
+                return;
+            await helpers.apply(REGISTRY_MANIFEST);
+            await wait("spectest-registry");
+        })(),
+    ]);
 }
 /**
  * Snapshot of a namespace's state, dumped whenever a wait times out: pod
@@ -1571,54 +1600,57 @@ export function k3s(opts = {}) {
             const runtime = componentRuntime(ctx);
             if (images.builds.length && !runtime)
                 throw new Error(`k3s(${name}): prepared image inputs are missing`);
-            if (runtime?.caBundle && caPresent()) {
-                const { cert, key } = await issueIngressCert([runtime.gateway]);
-                await installPodTrust({ name, gateway: runtime.gateway, cert, key,
-                    ca: await readFile(CA_PATH, "utf8"), bundle: await readFile(runtime.caBundle, "utf8"),
-                }, {
-                    apply: async (configuration) => { await helpers.apply(JSON.stringify(configuration)); },
-                    ensureBundle: async (namespace, configMap, bundle) => {
-                        try {
-                            await helpers.client.core.createNamespacedConfigMap({ namespace, body: {
-                                    metadata: { name: configMap, namespace }, immutable: true, data: { "ca-bundle.crt": bundle },
-                                } });
-                        }
-                        catch (err) {
-                            // A simultaneous Pod may have created the same namespace's bundle.
-                            const existing = (await helpers.client.core.readNamespacedConfigMap({ namespace, name: configMap })).unwrap();
-                            if (existing.data?.["ca-bundle.crt"] !== bundle || existing.immutable !== true)
-                                throw err;
+            await waitForAll([
+                runtime ? loadK3sBuildImages(name, runtime.images, runtime.gateway, exec) : Promise.resolve(),
+                prePullK3sImages(name, images.pulls, exec),
+                (async () => {
+                    if (runtime?.caBundle && caPresent()) {
+                        const { cert, key } = await issueIngressCert([runtime.gateway]);
+                        await installPodTrust({ name, gateway: runtime.gateway, cert, key,
+                            ca: await readFile(CA_PATH, "utf8"), bundle: await readFile(runtime.caBundle, "utf8"),
+                        }, {
+                            apply: async (configuration) => { await helpers.apply(JSON.stringify(configuration)); },
+                            ensureBundle: async (namespace, configMap, bundle) => {
+                                try {
+                                    await helpers.client.core.createNamespacedConfigMap({ namespace, body: {
+                                            metadata: { name: configMap, namespace }, immutable: true, data: { "ca-bundle.crt": bundle },
+                                        } });
+                                }
+                                catch (err) {
+                                    // A simultaneous Pod may have created the same namespace's bundle.
+                                    const existing = (await helpers.client.core.readNamespacedConfigMap({ namespace, name: configMap })).unwrap();
+                                    if (existing.data?.["ca-bundle.crt"] !== bundle || existing.immutable !== true)
+                                        throw err;
+                                }
+                            },
+                        });
+                        // The API server observes webhook registration asynchronously. A dry-run
+                        // Pod proves TLS reachability and admission before any project workload.
+                        const deadline = Date.now() + 30_000;
+                        for (;;) {
+                            try {
+                                const pod = (await helpers.client.core.createNamespacedPod({ namespace: "default", dryRun: "All", body: {
+                                        metadata: { generateName: "spectest-trust-probe-" }, spec: { containers: [{ name: "probe", image: "registry.k8s.io/pause:3.10" }] },
+                                    } })).unwrap();
+                                if (pod.spec?.containers[0].env?.some(e => e.name === "SSL_CERT_FILE" && e.value === "/spectest/ca-bundle.crt"))
+                                    break;
+                                if (Date.now() >= deadline)
+                                    throw new Error(`k3s(${name}): Pod CA mounts did not become ready`);
+                            }
+                            catch (err) {
+                                if (Date.now() >= deadline)
+                                    throw err;
+                            }
+                            await new Promise(resolve => setTimeout(resolve, 100));
                         }
-                    },
-                });
-                // The API server observes webhook registration asynchronously. A dry-run
-                // Pod proves TLS reachability and admission before any project workload.
-                const deadline = Date.now() + 30_000;
-                for (;;) {
-                    try {
-                        const pod = (await helpers.client.core.createNamespacedPod({ namespace: "default", dryRun: "All", body: {
-                                metadata: { generateName: "spectest-trust-probe-" }, spec: { containers: [{ name: "probe", image: "registry.k8s.io/pause:3.10" }] },
-                            } })).unwrap();
-                        if (pod.spec?.containers[0].env?.some(e => e.name === "SSL_CERT_FILE" && e.value === "/spectest/ca-bundle.crt"))
-                            break;
-                        if (Date.now() >= deadline)
-                            throw new Error(`k3s(${name}): Pod CA mounts did not become ready`);
-                    }
-                    catch (err) {
-                        if (Date.now() >= deadline)
-                            throw err;
                     }
-                    await new Promise(resolve => setTimeout(resolve, 100));
-                }
-            }
-            if (runtime)
-                await loadK3sBuildImages(name, runtime.images, runtime.gateway, exec);
-            await setupK3sCluster(name, helpers, {
-                registry: registryEnabled,
-                ingressDomains,
-                traefik: traefikEnabled,
-            });
-            await prePullK3sImages(name, images.pulls, exec);
+                    await setupK3sCluster(name, helpers, {
+                        registry: registryEnabled,
+                        ingressDomains,
+                        traefik: traefikEnabled,
+                    });
+                })(),
+            ]);
             if (sticky)
                 await registerStickyKubernetesStore(name, version);
         },

package/dist/daemon.js

@@ -1,4 +1,5 @@
 import { componentBuildTasks, COMPONENT_RUNTIME } from "./harness/component-images.js";
+import { waitForAll } from "./harness/concurrency.js";
 import { androidScope, androidRecordingChunk, releaseAndroidRecording, isAndroidApp } from "./android.js";
 // Long-running HTTP daemon. Runs as a systemd unit on the VM host (not in
 // a container). Owns:
@@ -3103,26 +3104,29 @@ async function bootstrapInner(prepared, identity) {
         await waitForReady(svc);
         const tSetup = Date.now();
         const builds = componentTasks.filter(task => task.owner === svc.name);
-        await Promise.all(builds.map(task => prep.get(task.name)));
-        if (svc.setup) {
-            progressService(svc.name, { status: "probing", detail: "running setup" });
-            const helpers = await ensureHelpers(svc.name, svc);
-            try {
-                await svc.setup({
-                    name: svc.name,
-                    helpers,
-                    ...(await spectestContext({ service: svc.name, includeSelf: true })),
-                    ...{ [COMPONENT_RUNTIME]: {
-                            images: builds.map(task => ({ source: tags.get(task.name), reference: task.reference })),
-                            gateway: await bridgeGatewayIp(),
-                            caBundle: await ensureCaBundle(),
-                        } },
-                });
-            }
-            catch (err) {
-                throw await withContainerPostMortem(svc.name, err);
-            }
-        }
+        // Setup can overlap pulls/infrastructure with builds, and consume each
+        // image as it becomes ready. Still drain every build if setup fails.
+        await waitForAll([...builds.map(task => prep.get(task.name)), (async () => {
+                if (svc.setup) {
+                    progressService(svc.name, { status: "probing", detail: "running setup" });
+                    const helpers = await ensureHelpers(svc.name, svc);
+                    try {
+                        await svc.setup({
+                            name: svc.name,
+                            helpers,
+                            ...(await spectestContext({ service: svc.name, includeSelf: true })),
+                            ...{ [COMPONENT_RUNTIME]: {
+                                    images: builds.map(task => ({ source: imageTag(task.name), reference: task.reference, ready: prep.get(task.name) })),
+                                    gateway: await bridgeGatewayIp(),
+                                    caBundle: await ensureCaBundle(),
+                                } },
+                        });
+                    }
+                    catch (err) {
+                        throw await withContainerPostMortem(svc.name, err);
+                    }
+                }
+            })()]);
         for (const task of builds)
             progressService(task.name, { status: "ready", detail: `loaded ${task.reference}` });
         progressService(svc.name, { status: "ready", detail: undefined });

package/dist/harness/component-images.d.ts

@@ -20,11 +20,14 @@ export declare function componentBuildTasks<T extends ServiceConfig & {
 /** Private handoff to a component's setup hook. Builds stay generic; the
  * component decides how its runtime consumes them and establishes trust. */
 export declare const COMPONENT_RUNTIME: unique symbol;
+export interface PreparedComponentImage {
+    source: string;
+    reference: string;
+    /** A component can load each result as soon as its own build finishes. */
+    ready?: Promise<void>;
+}
 export interface ComponentRuntime {
-    images: readonly {
-        source: string;
-        reference: string;
-    }[];
+    images: readonly PreparedComponentImage[];
     gateway: string;
     caBundle: string | null;
 }

package/dist/harness/concurrency.d.ts

@@ -0,0 +1,2 @@
+/** Wait for every writer to stop before reporting a failure to setup/cleanup. */
+export declare function waitForAll(work: readonly Promise<unknown>[]): Promise<void>;

package/dist/harness/concurrency.js

@@ -0,0 +1,9 @@
+/** Wait for every writer to stop before reporting a failure to setup/cleanup. */
+export async function waitForAll(work) {
+    const results = await Promise.allSettled(work);
+    const failures = results.flatMap(result => result.status === "rejected" ? [result.reason] : []);
+    if (failures.length === 1)
+        throw failures[0];
+    if (failures.length > 1)
+        throw new AggregateError(failures, `Concurrent environment preparation failed: ${failures.map(error => error instanceof Error ? error.message : String(error)).join("; ")}`);
+}

package/dist/harness/k3s-image-loader.d.ts

@@ -1,5 +1,3 @@
 import type { SpectestContext } from "../index.js";
-export declare function loadK3sBuildImages(service: string, images: readonly {
-    source: string;
-    reference: string;
-}[], gateway: string, exec: SpectestContext["exec"]): Promise<void>;
+import { type PreparedComponentImage } from "./component-images.js";
+export declare function loadK3sBuildImages(service: string, images: readonly PreparedComponentImage[], gateway: string, exec: SpectestContext["exec"]): Promise<void>;

package/dist/harness/k3s-image-loader.js

@@ -7,6 +7,7 @@ import { createServer } from "node:http";
 import { promisify } from "node:util";
 import { canonicalImageReference } from "./component-images.js";
 import { waitForK3sRuntime } from "./k3s-prepull.js";
+import { waitForAll } from "./concurrency.js";
 const digest = (bytes) => `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
 const descriptor = (bytes, mediaType) => ({ digest: digest(bytes), size: bytes.length, mediaType });
 const run = promisify(execFile);
@@ -76,7 +77,8 @@ export async function loadK3sBuildImages(service, images, gateway, exec) {
     const ctr = ["ctr", "--address", "/run/k3s/containerd/containerd.sock", "--namespace", "k8s.io"];
     const help = await checked([...ctr, "images", "pull", "--help"]);
     const local = help.includes("--local") ? ["--local"] : [];
-    for (const image of images) {
+    await waitForAll(images.map(async (image) => {
+        await image.ready;
         const reference = canonicalImageReference(image.reference);
         const { target, metadata: blobs, allowed, configDigest } = await hostImage(image.source);
         const streams = new Set();
@@ -146,5 +148,5 @@ export async function loadK3sBuildImages(service, images, gateway, exec) {
             await new Promise(resolve => server.close(() => resolve()));
             await exec(service, ["rm", "-rf", directory], { timeoutMs: 5_000 }).catch(() => undefined);
         }
-    }
+    }));
 }

package/dist/harness/k3s-prepull.d.ts

@@ -1,7 +1,8 @@
 import type { SpectestContext } from "../index.js";
 /** CRI PullImage waits for unpacking and uses k3s's registry configuration.
  * Always resolve tags on a fresh setup. Immutable digests can be used offline.
- * Drain both workers on failure so no pulls outlive the setup hook.
+ * Submit every image concurrently; containerd manages downloads and unpacking.
+ * Drain all pulls on failure so none outlive the setup hook.
  */
 export declare function prePullK3sImages(name: string, images: readonly string[], exec: SpectestContext["exec"]): Promise<void>;
 export declare function waitForK3sRuntime(name: string, exec: SpectestContext["exec"]): Promise<void>;

package/dist/harness/k3s-prepull.js

@@ -1,28 +1,24 @@
+import { waitForAll } from "./concurrency.js";
 /** CRI PullImage waits for unpacking and uses k3s's registry configuration.
  * Always resolve tags on a fresh setup. Immutable digests can be used offline.
- * Drain both workers on failure so no pulls outlive the setup hook.
+ * Submit every image concurrently; containerd manages downloads and unpacking.
+ * Drain all pulls on failure so none outlive the setup hook.
  */
 export async function prePullK3sImages(name, images, exec) {
     if (!images.length)
         return;
     await waitForK3sRuntime(name, exec);
     const cri = ["crictl", "--runtime-endpoint", "unix:///run/k3s/containerd/containerd.sock"];
-    const queue = [...images];
-    const results = await Promise.allSettled(Array.from({ length: Math.min(2, queue.length) }, async () => {
-        for (let image = queue.shift(); image !== undefined; image = queue.shift()) {
-            if (/@sha256:[a-f0-9]{64}$/.test(image)) {
-                const existing = await exec(name, [...cri, "inspecti", image], { timeoutMs: 30_000 });
-                if (existing.exitCode === 0)
-                    continue;
-            }
-            const result = await exec(name, [...cri, "pull", image], { timeoutMs: 600_000 });
-            if (result.exitCode !== 0)
-                throw new Error(`k3s(${name}): pre-pull failed for ${image}: ${result.stderr || result.stdout}`);
+    await waitForAll(images.map(async (image) => {
+        if (/@sha256:[a-f0-9]{64}$/.test(image)) {
+            const existing = await exec(name, [...cri, "inspecti", image], { timeoutMs: 30_000 });
+            if (existing.exitCode === 0)
+                return;
         }
+        const result = await exec(name, [...cri, "pull", image], { timeoutMs: 600_000 });
+        if (result.exitCode !== 0)
+            throw new Error(`k3s(${name}): pre-pull failed for ${image}: ${result.stderr || result.stdout}`);
     }));
-    const failed = results.find(result => result.status === "rejected");
-    if (failed?.status === "rejected")
-        throw failed.reason;
 }
 export async function waitForK3sRuntime(name, exec) {
     const cri = ["crictl", "--runtime-endpoint", "unix:///run/k3s/containerd/containerd.sock"];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@specific.dev/spectest",
-  "version": "0.91.0",
+  "version": "0.91.2",
   "description": "Spectest SDK for defining test environments in TypeScript.",
   "type": "module",
   "main": "./dist/index.js",

package/src/android-step.test.ts

@@ -41,7 +41,7 @@ const cases: [Omit<AndroidStepDetails, "device">, string][] = [
       target: { kind: "accessibility", value: "Save" },
       state: "hidden",
     },
-    'wait for accessibility label "Save" to be hidden',
+    'wait for label "Save" to be hidden',
   ],
   [
     {
@@ -86,7 +86,7 @@ const cases: [Omit<AndroidStepDetails, "device">, string][] = [
 for (const [action, title] of cases) {
   test(title, () =>
     expect(androidStepTitle({ device: "phone", ...action })).toBe(
-      `phone: ${title}`,
+      title,
     ),
   );
 }
@@ -100,7 +100,7 @@ test("custom selector expressions remain opaque structured data", () => {
     value: expression,
   });
   expect(androidStepTitle({ device: "phone", action: "tap", target })).toBe(
-    "phone: tap custom selector",
+    "tap custom selector",
   );
   for (const [using, kind] of [
     ["id", "id"],

package/src/android-step.ts

@@ -43,7 +43,7 @@ export function androidTargetLabel(target: AndroidTarget): string {
     case "id":
       return `id ${quoted}`;
     case "accessibility":
-      return `accessibility label ${quoted}`;
+      return `label ${quoted}`;
     case "xpath":
       return `XPath ${quoted}`;
     case "custom":
@@ -103,5 +103,5 @@ export function androidStepTitle(step: AndroidStepDetails): string {
       label = `run command ${JSON.stringify(step.command)}`;
       break;
   }
-  return `${step.device}: ${label}`;
+  return label;
 }

package/src/android.test.ts

@@ -156,12 +156,12 @@ describe("Android case lifecycle", () => {
       const steps = events.filter((e) => e.kind === "android");
       expect(steps.length).toBe(7);
       expect(steps[0]).toMatchObject({
-        title: String.raw`phone: fill text "a \"quoted\" label"`,
+        title: String.raw`fill text "a \"quoted\" label"`,
         android: { device: "phone", action: "fill", target: { kind: "text", value: 'a "quoted" label' } },
       });
       expect(steps[1]).toMatchObject({ android: { device: "phone", action: "text", target: { kind: "id", value: "com.example.app:id/draft" } } });
-      expect(steps[2]).toMatchObject({ title: "phone: take screenshot", android: { device: "phone", action: "screenshot" } });
-      expect(steps[3]).toMatchObject({ title: 'phone: tap text "Save"', android: { device: "phone", action: "tap", target: { kind: "text", value: "Save" } } });
+      expect(steps[2]).toMatchObject({ title: "take screenshot", android: { device: "phone", action: "screenshot" } });
+      expect(steps[3]).toMatchObject({ title: 'tap text "Save"', android: { device: "phone", action: "tap", target: { kind: "text", value: "Save" } } });
       expect(steps[4]).toMatchObject({ android: { device: "phone", action: "tap", point: { x: 270, y: 1800 } } });
       expect(steps[5]).toMatchObject({ status: "failed", android: { device: "phone", action: "tap", target: { kind: "text", value: "Gone" } } });
       expect(JSON.stringify(steps)).not.toContain("private draft");

package/src/components/k3s-apply.test.ts

@@ -0,0 +1,90 @@
+import { expect, spyOn, test } from "bun:test";
+import { KubernetesObjectApi } from "@kubernetes/client-node";
+import { ApiException } from "@kubernetes/client-node/dist/gen/apis/exception.js";
+import { isTransientApplyError, k3s } from "./k3s";
+
+const missingNamespace = {
+  apiVersion: "v1", kind: "Status", status: "Failure", code: 404, reason: "NotFound",
+  message: 'namespaces "agent-sandbox-system" not found',
+  details: { name: "agent-sandbox-system", kind: "namespaces" },
+};
+const exception = (code: number, body: unknown) => new ApiException(code, "Unknown API Status Code!", body, {});
+
+for (const format of ["object", "JSON string"] as const) {
+  const encode = (body: unknown) => format === "object" ? body : JSON.stringify(body);
+  test(`missing-namespace ApiException with ${format} body is transient`, () => {
+    const error = exception(404, encode(missingNamespace));
+    // This is the production client's escaped representation, not a hand-made Error.
+    expect(/namespaces? "[^"]+" not found/i.test(error.message)).toBe(false);
+    expect(isTransientApplyError(error)).toBe(true);
+    expect(isTransientApplyError(exception(404, encode({ ...missingNamespace, message: "Not Found" })))).toBe(true);
+    // The Status message also works when structured details are absent.
+    expect(isTransientApplyError(exception(404, encode({ ...missingNamespace, details: undefined })))).toBe(true);
+  });
+
+  test(`apply converges after a missing namespace with ${format} response body`, async () => {
+    const error = exception(404, encode(missingNamespace));
+    let attempts = 0;
+    const patch = spyOn(KubernetesObjectApi.prototype, "patch").mockImplementation(async doc => {
+      if (++attempts === 1) throw error;
+      return doc as never;
+    });
+    try {
+      const helpers = await makeHelpers();
+      const applied = await helpers.apply(JSON.stringify(policy), { timeoutMs: 2000 });
+      expect(attempts).toBe(2);
+      expect(applied[0].unwrap()).toEqual(policy);
+    } finally { patch.mockRestore(); }
+  });
+
+  test(`unrelated 404, forbidden and invalid Status bodies remain terminal (${format})`, () => {
+    for (const body of [
+      { ...missingNamespace, message: 'deployments.apps "controller" not found', details: { name: "controller", kind: "deployments", group: "apps" } },
+      { ...missingNamespace, message: 'namespaces.example.dev "widget" not found', details: { name: "widget", kind: "namespaces", group: "example.dev" } },
+      { code: 404, reason: "NotFound", message: "Not Found" },
+      { code: 403, reason: "Forbidden", message: 'namespaces "agent-sandbox-system" is forbidden', details: missingNamespace.details },
+      { code: 422, reason: "Invalid", message: 'NetworkPolicy "policy" is invalid', details: { causes: [{ message: missingNamespace.message }] } },
+    ]) expect(isTransientApplyError(exception(body.code, encode(body)))).toBe(false);
+  });
+}
+
+test("plain client errors and transient HTTP statuses retain their retry behavior", () => {
+  for (const code of [429, 500, 503, 504]) {
+    expect(isTransientApplyError(exception(code, { message: "Try again" }))).toBe(true);
+  }
+  for (const message of [missingNamespace.message, 'no matches for kind "Widget"', "Failed to fetch resource metadata", "failed calling webhook", "HTTP-Code: 503\nMessage: unavailable"]) {
+    expect(isTransientApplyError(new Error(message))).toBe(true);
+  }
+  for (const body of ["not JSON", "{", null, [], 42]) {
+    expect(isTransientApplyError(exception(404, body))).toBe(false);
+  }
+  expect(isTransientApplyError(null)).toBe(false);
+});
+
+const policy = {
+  apiVersion: "networking.k8s.io/v1", kind: "NetworkPolicy",
+  metadata: { name: "policy", namespace: "agent-sandbox-system" },
+  spec: { podSelector: {}, policyTypes: ["Ingress"] },
+};
+
+async function makeHelpers() {
+  return k3s().helpers({ name: "cluster", exec: async () => ({ exitCode: 0, stderr: "", stdout: JSON.stringify({
+    apiVersion: "v1", kind: "Config", clusters: [{ name: "test", cluster: { server: "https://cluster.internal:6443" } }],
+    users: [{ name: "test", user: {} }], contexts: [{ name: "test", context: { cluster: "test", user: "test" } }],
+    "current-context": "test",
+  }) }) } as never);
+}
+
+test("apply fails immediately on an unrelated 404 and still times out on a missing namespace", async () => {
+  const helpers = await makeHelpers();
+  const patch = spyOn(KubernetesObjectApi.prototype, "patch");
+  try {
+    patch.mockRejectedValue(exception(404, { reason: "NotFound", message: 'deployments.apps "controller" not found' }));
+    await expect(helpers.apply(JSON.stringify(policy))).rejects.toThrow("applying NetworkPolicy/policy");
+    expect(patch).toHaveBeenCalledTimes(1);
+    patch.mockClear();
+    patch.mockRejectedValue(exception(404, missingNamespace));
+    await expect(helpers.apply(JSON.stringify(policy), { timeoutMs: 0 })).rejects.toThrow("apply did not converge");
+    expect(patch).toHaveBeenCalledTimes(1);
+  } finally { patch.mockRestore(); }
+});

package/src/components/k3s-concurrency.test.ts

@@ -0,0 +1,60 @@
+import { expect, test } from "bun:test";
+import { k3s } from "./k3s";
+
+function deferred() {
+  let resolve!: () => void;
+  const promise = new Promise<void>(r => { resolve = r; });
+  return { promise, resolve };
+}
+
+test("registry, Traefik, and every declared pull start without waiting for one another", async () => {
+  const started = new Set<string>();
+  const allStarted = deferred(), release = deferred();
+  const enter = async (name: string) => {
+    started.add(name);
+    if (started.size === 5) allStarted.resolve();
+    await release.promise;
+  };
+  const cluster = k3s({ images: ["app:1", "app:2", "app:3"] });
+  let finished = false;
+  const work = cluster.setup({ name: "cluster", helpers: {
+    apply: async (manifest: string) => { await enter(manifest.includes("spectest-registry") ? "registry" : "traefik"); },
+    waitForRollout: async () => {},
+  }, exec: async (_name: string, args: string[]) => {
+    if (args[3] === "pull") await enter(args.at(-1)!);
+    return { exitCode: 0, stdout: "", stderr: "" };
+  } } as never).then(() => { finished = true; });
+  try {
+    await Promise.race([allStarted.promise, Bun.sleep(1000).then(() => { throw new Error(`serialized setup: ${[...started]}`); })]);
+    expect(finished).toBe(false);
+    expect(started.size).toBe(5);
+  } finally { release.resolve(); await work; }
+});
+
+test("a failed infrastructure rollout waits for other rollouts and image pulls to stop", async () => {
+  const started = deferred(), release = deferred();
+  let active = 0, finished = false;
+  const hold = async () => {
+    if (++active === 2) started.resolve();
+    await release.promise;
+    --active;
+  };
+  const failure = new Error("Traefik failed");
+  const cluster = k3s({ images: ["app:1"] });
+  const work = cluster.setup({ name: "cluster", helpers: {
+    apply: async () => {},
+    waitForRollout: async (deployment: string) => {
+      if (deployment === "traefik") throw failure;
+      await hold();
+    },
+  }, exec: async (_name: string, args: string[]) => {
+    if (args[3] === "pull") await hold();
+    return { exitCode: 0, stdout: "", stderr: "" };
+  } } as never).then(() => { finished = true; }, error => { finished = true; return error; });
+  try {
+    await started.promise;
+    expect(finished).toBe(false);
+  } finally { release.resolve(); }
+  expect(await work).toBe(failure);
+  expect(active).toBe(0);
+});

package/src/components/k3s.ts

@@ -1,5 +1,6 @@
 import { isIP } from "node:net";
 import { installPodTrust } from "./k3s-trust.js";
+import { waitForAll } from "../harness/concurrency.js";
 import { loadK3sBuildImages } from "../harness/k3s-image-loader.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { spawn as nodeSpawn } from "node:child_process";
@@ -1420,8 +1421,27 @@ function errorText(err: unknown): string {
   return (err as Error)?.message ?? String(err);
 }
 
-function isTransientApplyError(err: unknown): boolean {
-  const msg = errorText(err);
+/** ApiException formats its body with JSON.stringify, escaping Status.message.
+ * Read the actual response instead of matching that presentation string. */
+function applyErrorStatus(err: unknown): V1Status | undefined {
+  let body = (err as { body?: unknown } | null)?.body;
+  if (typeof body === "string") {
+    try { body = JSON.parse(body); } catch { return undefined; }
+  }
+  return body && typeof body === "object" && !Array.isArray(body) ? body as V1Status : undefined;
+}
+
+/** @internal Exported for regression tests; not part of the components API. */
+export function isTransientApplyError(err: unknown): boolean {
+  const status = applyErrorStatus(err);
+  const code = status?.code ?? (err as { code?: unknown } | null)?.code;
+  if ([429, 500, 503, 504].includes(code as number)) return true;
+  // A missing namespace can converge while another apply creates it. An
+  // arbitrary resource 404 cannot: don't classify by HTTP status alone.
+  if (code === 404 && status?.reason === "NotFound" &&
+      status.details?.kind === "namespaces" && !status.details.group &&
+      typeof status.details.name === "string" && status.details.name.length > 0) return true;
+  const msg = typeof status?.message === "string" ? status.message : errorText(err);
   return TRANSIENT_APPLY_PATTERNS.some((re) => re.test(msg));
 }
 
@@ -1865,48 +1885,52 @@ async function setupK3sCluster(
   helpers: K3sHelpers,
   opts: { registry: boolean; ingressDomains: string[]; traefik: boolean },
 ): Promise<void> {
-  const tlsEnabled = opts.traefik && opts.ingressDomains.length > 0 && caPresent();
-  if (tlsEnabled) {
-    const { cert, key } = await issueIngressCert(
-      opts.ingressDomains.map((d) => `*.${d}`),
-    );
-    // Apply the cert Secret + dynamic-config ConfigMap before the
-    // Deployment that mounts them. `stringData` lets us hand over plain
-    // PEM; the API server base64-encodes it.
-    await helpers.client.core.createNamespacedSecret({
-      namespace: "kube-system",
-      body: {
-        metadata: { name: TRAEFIK_TLS_SECRET, namespace: "kube-system" },
-        type: "kubernetes.io/tls",
-        stringData: { "tls.crt": cert, "tls.key": key },
-      },
-    });
-    await helpers.client.core.createNamespacedConfigMap({
-      namespace: "kube-system",
-      body: {
-        metadata: {
-          name: TRAEFIK_DYNAMIC_CONFIGMAP,
-          namespace: "kube-system",
-        },
-        data: { "tls.yaml": TRAEFIK_DYNAMIC_TLS },
-      },
-    });
-  }
-  if (opts.traefik) await helpers.apply(buildTraefikManifest(tlsEnabled));
-  if (opts.registry) await helpers.apply(REGISTRY_MANIFEST);
-  // Both rollouts proceed independently inside the cluster — wait on them
-  // concurrently (they used to serialize, wasting up to a rollout's tail).
-  // 250ms polling: these two sit on the cold start's critical path, where
-  // the default 500ms interval wastes real time.
+  // The registry can start while Traefik's certificates are being prepared.
   const wait = (deployment: string): Promise<void> =>
     helpers.waitForRollout(deployment, {
       namespace: "kube-system",
       timeoutMs: 120_000,
       intervalMs: 250,
     });
-  const waits = opts.traefik ? [wait("traefik")] : [];
-  if (opts.registry) waits.push(wait("spectest-registry"));
-  await Promise.all(waits);
+  await waitForAll([
+    (async () => {
+      if (!opts.traefik) return;
+      const tlsEnabled = opts.ingressDomains.length > 0 && caPresent();
+      if (tlsEnabled) {
+        const { cert, key } = await issueIngressCert(
+          opts.ingressDomains.map((d) => `*.${d}`),
+        );
+        // Apply the cert Secret + dynamic-config ConfigMap before the
+        // Deployment that mounts them. `stringData` lets us hand over plain
+        // PEM; the API server base64-encodes it.
+        await helpers.client.core.createNamespacedSecret({
+          namespace: "kube-system",
+          body: {
+            metadata: { name: TRAEFIK_TLS_SECRET, namespace: "kube-system" },
+            type: "kubernetes.io/tls",
+            stringData: { "tls.crt": cert, "tls.key": key },
+          },
+        });
+        await helpers.client.core.createNamespacedConfigMap({
+          namespace: "kube-system",
+          body: {
+            metadata: {
+              name: TRAEFIK_DYNAMIC_CONFIGMAP,
+              namespace: "kube-system",
+            },
+            data: { "tls.yaml": TRAEFIK_DYNAMIC_TLS },
+          },
+        });
+      }
+      await helpers.apply(buildTraefikManifest(tlsEnabled));
+      await wait("traefik");
+    })(),
+    (async () => {
+      if (!opts.registry) return;
+      await helpers.apply(REGISTRY_MANIFEST);
+      await wait("spectest-registry");
+    })(),
+  ]);
 }
 
 /**
@@ -2199,47 +2223,51 @@ export function k3s(opts: K3sOptions = {}) {
       const { name, helpers, exec } = ctx;
       const runtime = componentRuntime(ctx);
       if (images.builds.length && !runtime) throw new Error(`k3s(${name}): prepared image inputs are missing`);
-      if (runtime?.caBundle && caPresent()) {
-        const { cert, key } = await issueIngressCert([runtime.gateway]);
-        await installPodTrust({ name, gateway: runtime.gateway, cert, key,
-          ca: await readFile(CA_PATH, "utf8"), bundle: await readFile(runtime.caBundle, "utf8"),
-        }, {
-          apply: async configuration => { await helpers.apply(JSON.stringify(configuration)); },
-          ensureBundle: async (namespace, configMap, bundle) => {
-            try {
-              await helpers.client.core.createNamespacedConfigMap({ namespace, body: {
-                metadata: { name: configMap, namespace }, immutable: true, data: { "ca-bundle.crt": bundle },
-              } });
-            } catch (err) {
-              // A simultaneous Pod may have created the same namespace's bundle.
-              const existing = (await helpers.client.core.readNamespacedConfigMap({ namespace, name: configMap })).unwrap();
-              if (existing.data?.["ca-bundle.crt"] !== bundle || existing.immutable !== true) throw err;
+      await waitForAll([
+        runtime ? loadK3sBuildImages(name, runtime.images, runtime.gateway, exec) : Promise.resolve(),
+        prePullK3sImages(name, images.pulls, exec),
+        (async () => {
+          if (runtime?.caBundle && caPresent()) {
+            const { cert, key } = await issueIngressCert([runtime.gateway]);
+            await installPodTrust({ name, gateway: runtime.gateway, cert, key,
+              ca: await readFile(CA_PATH, "utf8"), bundle: await readFile(runtime.caBundle, "utf8"),
+            }, {
+              apply: async configuration => { await helpers.apply(JSON.stringify(configuration)); },
+              ensureBundle: async (namespace, configMap, bundle) => {
+                try {
+                  await helpers.client.core.createNamespacedConfigMap({ namespace, body: {
+                    metadata: { name: configMap, namespace }, immutable: true, data: { "ca-bundle.crt": bundle },
+                  } });
+                } catch (err) {
+                  // A simultaneous Pod may have created the same namespace's bundle.
+                  const existing = (await helpers.client.core.readNamespacedConfigMap({ namespace, name: configMap })).unwrap();
+                  if (existing.data?.["ca-bundle.crt"] !== bundle || existing.immutable !== true) throw err;
+                }
+              },
+            });
+            // The API server observes webhook registration asynchronously. A dry-run
+            // Pod proves TLS reachability and admission before any project workload.
+            const deadline = Date.now() + 30_000;
+            for (;;) {
+              try {
+                const pod = (await helpers.client.core.createNamespacedPod({ namespace: "default", dryRun: "All", body: {
+                  metadata: { generateName: "spectest-trust-probe-" }, spec: { containers: [{ name: "probe", image: "registry.k8s.io/pause:3.10" }] },
+                } })).unwrap();
+                if (pod.spec?.containers[0].env?.some(e => e.name === "SSL_CERT_FILE" && e.value === "/spectest/ca-bundle.crt")) break;
+                if (Date.now() >= deadline) throw new Error(`k3s(${name}): Pod CA mounts did not become ready`);
+              } catch (err) {
+                if (Date.now() >= deadline) throw err;
+              }
+              await new Promise(resolve => setTimeout(resolve, 100));
             }
-          },
-        });
-        // The API server observes webhook registration asynchronously. A dry-run
-        // Pod proves TLS reachability and admission before any project workload.
-        const deadline = Date.now() + 30_000;
-        for (;;) {
-          try {
-            const pod = (await helpers.client.core.createNamespacedPod({ namespace: "default", dryRun: "All", body: {
-              metadata: { generateName: "spectest-trust-probe-" }, spec: { containers: [{ name: "probe", image: "registry.k8s.io/pause:3.10" }] },
-            } })).unwrap();
-            if (pod.spec?.containers[0].env?.some(e => e.name === "SSL_CERT_FILE" && e.value === "/spectest/ca-bundle.crt")) break;
-            if (Date.now() >= deadline) throw new Error(`k3s(${name}): Pod CA mounts did not become ready`);
-          } catch (err) {
-            if (Date.now() >= deadline) throw err;
           }
-          await new Promise(resolve => setTimeout(resolve, 100));
-        }
-      }
-      if (runtime) await loadK3sBuildImages(name, runtime.images, runtime.gateway, exec);
-      await setupK3sCluster(name, helpers, {
-        registry: registryEnabled,
-        ingressDomains,
-        traefik: traefikEnabled,
-      });
-      await prePullK3sImages(name, images.pulls, exec);
+          await setupK3sCluster(name, helpers, {
+            registry: registryEnabled,
+            ingressDomains,
+            traefik: traefikEnabled,
+          });
+        })(),
+      ]);
       if (sticky) await registerStickyKubernetesStore(name, version);
     },
     helpers: async ({ name, exec, poll }: ServiceHelpersContext): Promise<K3sHelpers> => {

package/src/daemon.ts

@@ -1,4 +1,5 @@
 import { componentBuildTasks, COMPONENT_RUNTIME } from "./harness/component-images.js";
+import { waitForAll } from "./harness/concurrency.js";
 import { androidScope, androidRecordingChunk, releaseAndroidRecording, isAndroidApp, type AndroidRecording } from "./android.js";
 // Long-running HTTP daemon. Runs as a systemd unit on the VM host (not in
 // a container). Owns:
@@ -3687,25 +3688,28 @@ async function bootstrapInner(prepared?: PreparedImages, identity?: string): Pro
     await waitForReady(svc);
     const tSetup = Date.now();
     const builds = componentTasks.filter(task => task.owner === svc.name);
-    await Promise.all(builds.map(task => prep.get(task.name)!));
-    if (svc.setup) {
-      progressService(svc.name, { status: "probing", detail: "running setup" });
-      const helpers = await ensureHelpers(svc.name, svc);
-      try {
-        await svc.setup({
-          name: svc.name,
-          helpers,
-          ...(await spectestContext({ service: svc.name, includeSelf: true })),
-          ...{ [COMPONENT_RUNTIME]: {
-            images: builds.map(task => ({ source: tags.get(task.name)!, reference: task.reference })),
-            gateway: await bridgeGatewayIp(),
-            caBundle: await ensureCaBundle(),
-          } },
-        });
-      } catch (err) {
-        throw await withContainerPostMortem(svc.name, err);
+    // Setup can overlap pulls/infrastructure with builds, and consume each
+    // image as it becomes ready. Still drain every build if setup fails.
+    await waitForAll([...builds.map(task => prep.get(task.name)!), (async () => {
+      if (svc.setup) {
+        progressService(svc.name, { status: "probing", detail: "running setup" });
+        const helpers = await ensureHelpers(svc.name, svc);
+        try {
+          await svc.setup({
+            name: svc.name,
+            helpers,
+            ...(await spectestContext({ service: svc.name, includeSelf: true })),
+            ...{ [COMPONENT_RUNTIME]: {
+              images: builds.map(task => ({ source: imageTag(task.name), reference: task.reference, ready: prep.get(task.name)! })),
+              gateway: await bridgeGatewayIp(),
+              caBundle: await ensureCaBundle(),
+            } },
+          });
+        } catch (err) {
+          throw await withContainerPostMortem(svc.name, err);
+        }
       }
-    }
+    })()]);
     for (const task of builds) progressService(task.name, { status: "ready", detail: `loaded ${task.reference}` });
     progressService(svc.name, { status: "ready", detail: undefined });
     const ti = timings.get(svc.name);

package/src/harness/component-images.ts

@@ -63,8 +63,14 @@ export function componentBuildTasks<T extends ServiceConfig & { name: string }>(
 /** Private handoff to a component's setup hook. Builds stay generic; the
  * component decides how its runtime consumes them and establishes trust. */
 export const COMPONENT_RUNTIME = Symbol.for("spectest.component-runtime");
+export interface PreparedComponentImage {
+  source: string;
+  reference: string;
+  /** A component can load each result as soon as its own build finishes. */
+  ready?: Promise<void>;
+}
 export interface ComponentRuntime {
-  images: readonly { source: string; reference: string }[];
+  images: readonly PreparedComponentImage[];
   gateway: string;
   caBundle: string | null;
 }

package/src/harness/concurrency.ts

@@ -0,0 +1,8 @@
+/** Wait for every writer to stop before reporting a failure to setup/cleanup. */
+export async function waitForAll(work: readonly Promise<unknown>[]): Promise<void> {
+  const results = await Promise.allSettled(work);
+  const failures = results.flatMap(result => result.status === "rejected" ? [result.reason] : []);
+  if (failures.length === 1) throw failures[0];
+  if (failures.length > 1) throw new AggregateError(failures,
+    `Concurrent environment preparation failed: ${failures.map(error => error instanceof Error ? error.message : String(error)).join("; ")}`);
+}

package/src/harness/k3s-image-loader.ts

@@ -6,8 +6,9 @@ import { createHash } from "node:crypto";
 import { createServer } from "node:http";
 import { promisify } from "node:util";
 import type { SpectestContext } from "../index.js";
-import { canonicalImageReference } from "./component-images.js";
+import { canonicalImageReference, type PreparedComponentImage } from "./component-images.js";
 import { waitForK3sRuntime } from "./k3s-prepull.js";
+import { waitForAll } from "./concurrency.js";
 
 interface Descriptor { digest: string; size: number; mediaType: string; platform?: { os: string; architecture: string } }
 interface Manifest { schemaVersion: number; mediaType: string; config: Descriptor; layers: Descriptor[]; annotations?: Record<string, string> }
@@ -57,7 +58,7 @@ async function hostImage(source: string) {
 }
 
 export async function loadK3sBuildImages(
-  service: string, images: readonly { source: string; reference: string }[],
+  service: string, images: readonly PreparedComponentImage[],
   gateway: string, exec: SpectestContext["exec"],
 ): Promise<void> {
   if (!images.length) return;
@@ -73,7 +74,8 @@ export async function loadK3sBuildImages(
   const ctr = ["ctr", "--address", "/run/k3s/containerd/containerd.sock", "--namespace", "k8s.io"];
   const help = await checked([...ctr, "images", "pull", "--help"]);
   const local = help.includes("--local") ? ["--local"] : [];
-  for (const image of images) {
+  await waitForAll(images.map(async image => {
+    await image.ready;
     const reference = canonicalImageReference(image.reference);
     const { target, metadata: blobs, allowed, configDigest } = await hostImage(image.source);
     const streams = new Set<ReturnType<typeof spawn>>();
@@ -125,5 +127,5 @@ export async function loadK3sBuildImages(
       await new Promise<void>(resolve => server.close(() => resolve()));
       await exec(service, ["rm", "-rf", directory], { timeoutMs: 5_000 }).catch(() => undefined);
     }
-  }
+  }));
 }

package/src/harness/k3s-prepull.test.ts

@@ -20,7 +20,7 @@ test("pre-pulls reuse immutable cached images, but resolve tags on every fresh s
   expect(calls.at(-1)).toEqual([...cri, "pull", digest]);
 });
 
-test("failed pre-pulls fail setup after outstanding pulls finish, with bounded concurrency", async () => {
+test("failed pre-pulls fail setup after all concurrent pulls finish", async () => {
   let active = 0, peak = 0, finished = 0;
   const work = prePullK3sImages("cluster", ["a:1", "b:1", "c:1"], mockExec(async args => {
     if (args.at(-1) === "info") return { exitCode: 0 };
@@ -31,7 +31,7 @@ test("failed pre-pulls fail setup after outstanding pulls finish, with bounded c
   }));
   await expect(work).rejects.toThrow("pre-pull failed for a:1: registry unavailable");
   expect(active).toBe(0);
-  expect(peak).toBe(2);
+  expect(peak).toBe(3);
   expect(finished).toBe(3);
 });
 
@@ -45,3 +45,13 @@ test("pre-pulls wait for the runtime even when the API server is already ready",
   }));
   expect(calls).toEqual(["info", "info", "pull"]);
 });
+
+test("simultaneous pull failures retain every failing image in the setup error", async () => {
+  const error = await prePullK3sImages("cluster", ["a:1", "b:1"], mockExec(async args => ({
+    exitCode: args[3] === "pull" ? 1 : 0, stderr: "unavailable",
+  }))).catch(error => error);
+  expect(error).toBeInstanceOf(AggregateError);
+  expect(error.errors).toHaveLength(2);
+  expect(error.message).toContain("pre-pull failed for a:1");
+  expect(error.message).toContain("pre-pull failed for b:1");
+});

package/src/harness/k3s-prepull.ts

@@ -1,26 +1,23 @@
 import type { SpectestContext } from "../index.js";
+import { waitForAll } from "./concurrency.js";
 
 /** CRI PullImage waits for unpacking and uses k3s's registry configuration.
  * Always resolve tags on a fresh setup. Immutable digests can be used offline.
- * Drain both workers on failure so no pulls outlive the setup hook.
+ * Submit every image concurrently; containerd manages downloads and unpacking.
+ * Drain all pulls on failure so none outlive the setup hook.
  */
 export async function prePullK3sImages(name: string, images: readonly string[], exec: SpectestContext["exec"]): Promise<void> {
   if (!images.length) return;
   await waitForK3sRuntime(name, exec);
   const cri = ["crictl", "--runtime-endpoint", "unix:///run/k3s/containerd/containerd.sock"];
-  const queue = [...images];
-  const results = await Promise.allSettled(Array.from({ length: Math.min(2, queue.length) }, async () => {
-    for (let image = queue.shift(); image !== undefined; image = queue.shift()) {
-      if (/@sha256:[a-f0-9]{64}$/.test(image)) {
-        const existing = await exec(name, [...cri, "inspecti", image], { timeoutMs: 30_000 });
-        if (existing.exitCode === 0) continue;
-      }
-      const result = await exec(name, [...cri, "pull", image], { timeoutMs: 600_000 });
-      if (result.exitCode !== 0) throw new Error(`k3s(${name}): pre-pull failed for ${image}: ${result.stderr || result.stdout}`);
+  await waitForAll(images.map(async image => {
+    if (/@sha256:[a-f0-9]{64}$/.test(image)) {
+      const existing = await exec(name, [...cri, "inspecti", image], { timeoutMs: 30_000 });
+      if (existing.exitCode === 0) return;
     }
+    const result = await exec(name, [...cri, "pull", image], { timeoutMs: 600_000 });
+    if (result.exitCode !== 0) throw new Error(`k3s(${name}): pre-pull failed for ${image}: ${result.stderr || result.stdout}`);
   }));
-  const failed = results.find(result => result.status === "rejected");
-  if (failed?.status === "rejected") throw failed.reason;
 }
 
 export async function waitForK3sRuntime(name: string, exec: SpectestContext["exec"]): Promise<void> {