next-leak 0.10.1 → 0.11.1

package/README.md

@@ -29,13 +29,15 @@ next-leak found the growth, the retaining object and the chain that holds it —
 without being told what to look for. Next.js 16.3.0 has since fixed it.
 
 **Verified against real Next.js issues**, not synthetic fixtures. Issue states
-checked 2026-08-27:
+checked 2026-09-05:
 
 | Issue | What it is | Measured | State today |
 |---|---|---|---|
-| [#97938](https://github.com/vercel/next.js/issues/97938) | `cacheComponents`: composite abort signal never released | +705 KB per request on 16.3.3, flat on 16.2.6 | **open** |
+| [#97776](https://github.com/vercel/next.js/issues/97776) | `use cache`: `AbortSignal.any` composites never released (canonical issue; #97938 and #97464 are duplicates) | +705 KB per request on 16.3.3, flat on 16.2.6 (the #97938 run) | **open** — fix [#97476](https://github.com/vercel/next.js/pull/97476) merged Aug 19, in no stable release as of 16.3.4 |
+| [#97938](https://github.com/vercel/next.js/issues/97938) | `cacheComponents`: composite abort signal never released | +705 KB per request on 16.3.3, flat on 16.2.6 | closed Aug 31 as a duplicate of #97776; fix in no stable release |
 | [#96533](https://github.com/vercel/next.js/issues/96533) | ISR revalidation holds RSC buffers between collections | 4–5 MB of `arrayBuffers` held vs 0.32 MB retained | **open** |
-| [#97464](https://github.com/vercel/next.js/issues/97464) | Static-gen worker retains per prerendered page | OOM after 1617 and 1525 of 2504 pages on 16.3.3; 16.2.12 finishes at 0.05 MB/page | **open** |
+| [#97464](https://github.com/vercel/next.js/issues/97464) | Static-gen worker retains per prerendered page | OOM after 1617 and 1525 of 2504 pages on 16.3.3; 16.2.12 finishes at 0.05 MB/page | closed Aug 31 as a duplicate of #97776; fix in no stable release |
+| [#97802](https://github.com/vercel/next.js/issues/97802) | Turbopack compilation saturates the container before rendering anything | Reporter's reproduction in a 2 CPU / 4 GB container: 16.2.12 peaks ~2 GB and finishes; 16.3.0 pins 4 GB and stalls | **open** — bisected to 16.3.0; no fix known |
 | [#92287](https://github.com/vercel/next.js/issues/92287) | Cache Components: unbounded `arrayBuffers` under load | 37.5 MB of arrayBuffers held between collections, 37x what it retains (16.3.1) | **open** |
 | [#84884](https://github.com/vercel/next.js/issues/84884) | axios + `AbortSignal` in middleware | 32.8 → 369.9 MB | **open** |
 | [#89091](https://github.com/vercel/next.js/issues/89091) | zlib retention on mid-stream aborts | +42.5 MB/1000 aborted req on 16.1.5; **+0.03 on 16.3.1** | closed |
@@ -115,11 +117,13 @@ Every report prints the gate it used.
 |---|---|---|
 | `--routes <list>` | all | Only measure these routes (comma-separated templates or prefixes) |
 | `--cycles <n>` | 4 | Load cycles per route (min 3). The first is dropped as warm-up, so the verdict sees `n − 1` deltas — at 3 it sees two |
+| `--repeat <n>` | 1 | Measure each route `n` times, each from a fresh server, and judge it on all of them (max 10). The run takes `n` times as long. Routes whose repetitions disagree are reported `inconclusive`, and the spread of growth rates is printed either way. More cycles watch one process for longer; repetitions watch different ones, which is where the variance lives — three runs of one Next build measured 602, 826 and 875 MB retained, and a fourth measured 39 MB |
 | `--requests <n>` | 5000 | Requests per cycle. Raises sensitivity as well as duration: the growth gate scales with it, down to a noise floor around 5000 |
 | `--connections <n>` | 100 | Concurrent connections |
 | `--idle <seconds>` | 30 | **Maximum** wait before each sample; the run continues as soon as the heap settles |
 | `--warmup <n>` | 200 | Requests before the baseline snapshot. Lower it on apps that cache per request: warm-up fills those caches and the baseline then measures the warm-up, not the app. The run says so when it happens |
 | `--max-old-space <mb>` | 512 | Heap cap of each measured process. Raise it for apps whose legitimate working set is larger, or they die under measurement |
+| `--ready-timeout <seconds>` | 60 | How long each measured process gets to start listening. Raise it for apps that boot slowly. A process that never listens reports whatever it wrote to stderr while trying |
 | `--quick` | off | Fast preset (2000 requests × 4 cycles, 8s idle) — the exact profile the real-app validation ran with. Same cycle count as the default; what it trades away is traffic per cycle, so it sits on the noise floor and is less sensitive to slow leaks. Explicit flags override it |
 | `--no-resolve` | off | Skip the second pass on inconclusive routes |
 | `--self-check` | off | Measure a planted leak first to prove the harness works here. Costs one route's worth of time; a run that cannot detect 8 KB per request produces verdicts worth nothing |
@@ -406,6 +410,17 @@ through the build's source maps.
 
 
 - **Supported (default command):** App Router · `output: "standalone"` · Node ≥ 22 · Linux/macOS. Pages Router, non-standalone, and Windows are rejected with a clear message.
+- **Monorepos work unchanged.** A workspace build does not put `server.js` at
+  the root of `.next/standalone`: Next keeps the app's path relative to the
+  workspace root, so an app in `client/` ships its server at
+  `.next/standalone/client/server.js` with `node_modules` hoisted above it.
+  Point the tool at the app directory as usual — it looks there too. Do not
+  flatten that tree by hand: on a pnpm workspace the moved `server.js` cannot
+  resolve `next` any more, because what sits in `standalone/<app>/node_modules`
+  are relative symlinks into `../../node_modules/.pnpm/`, and a level up they
+  point outside the tree. An npm workspace survives the move — it puts no
+  `node_modules` beside the app at all — which is why the same build can serve
+  by hand and still be unmeasurable.
 - **Sample values can vary per request.** `"slug": "post-{n}"` gives every
   request its own URL — the shape of bot traffic and of a cache that never
   repeats a key. `"slug": "post-{n%200}"` cycles through exactly 200 distinct

package/dist/{chunk-5ZBIS5WM.js → chunk-4FYSLLSX.js}

@@ -31,23 +31,32 @@ function isStepwiseGrowth(samples, deltas, growingCycles, mean, minGrowth) {
   }
   return maxDrawdown(samples) <= netGrowth * STEPWISE_MAX_DRAWDOWN_RATIO;
 }
-function isSaturating(deltas) {
+function isSaturating(deltas, minGrowth) {
   if (deltas.length < SATURATION_MIN_CYCLES) {
     return false;
   }
   const first = deltas[0];
   const last = deltas[deltas.length - 1];
-  if (first === void 0 || last === void 0 || first <= 0) {
+  if (first === void 0 || last === void 0 || first < minGrowth) {
     return false;
   }
-  for (let i = 1; i < deltas.length; i += 1) {
-    const current = deltas[i];
-    const previous = deltas[i - 1];
-    if (current === void 0 || previous === void 0 || current >= previous) {
-      return false;
-    }
+  if (!deltas.every((delta) => delta > 0)) {
+    return false;
   }
-  return last <= first * SATURATION_MAX_FINAL_RATIO;
+  if (last > first * SATURATION_MAX_FINAL_RATIO) {
+    return false;
+  }
+  return isHeadingDown(deltas);
+}
+function isHeadingDown(deltas) {
+  const midpoint = Math.floor(deltas.length / 2);
+  const head = deltas.slice(0, midpoint);
+  const tail = deltas.slice(midpoint);
+  if (head.length === 0 || tail.length === 0) {
+    return false;
+  }
+  const mean = (values) => values.reduce((sum, value) => sum + value, 0) / values.length;
+  return mean(tail) < mean(head);
 }
 function isTooLargeToAcquit(deltas, mean, minGrowth) {
   const netGrowth = deltas.reduce((sum, delta) => sum + delta, 0);
@@ -71,10 +80,10 @@ function classifyShape(samples, options) {
   const allGrow = deltas.every((d) => d >= minGrowth);
   const anyFlatOrDown = deltas.some((d) => d <= 0);
   const growingCycles = deltas.filter((d) => d >= minGrowth).length;
+  if (isSaturating(deltas, minGrowth)) {
+    return { verdict: "saturating", growthPerCycle: mean, deltas, source: "heap" };
+  }
   if (allGrow) {
-    if (isSaturating(deltas)) {
-      return { verdict: "saturating", growthPerCycle: mean, deltas, source: "heap" };
-    }
     return { verdict: "leak", growthPerCycle: mean, deltas, source: "heap" };
   }
   if (isStepwiseGrowth(samples, deltas, growingCycles, mean, minGrowth)) {
@@ -115,7 +124,8 @@ function effectiveVerdict(report) {
 var VERDICT_WEAKENING = /* @__PURE__ */ new Set([
   "near-threshold",
   "spiky-growth",
-  "thin-evidence"
+  "thin-evidence",
+  "repetitions-disagree"
 ]);
 function warrantsIssueDraft(report) {
   return effectiveVerdict(report) === "leak" && !report.confidence.warnings.some((warning) => VERDICT_WEAKENING.has(warning.code));

package/dist/{chunk-OIJE43WX.js → chunk-672J2BQO.js}

@@ -7,7 +7,7 @@ import {
   minGrowthFor,
   resolveCycles,
   warrantsIssueDraft
-} from "./chunk-5ZBIS5WM.js";
+} from "./chunk-4FYSLLSX.js";
 import {
   assessPeakPressure,
   describePeakPressure
@@ -92698,6 +92698,26 @@ async function readManifest(file, parse2) {
     );
   }
 }
+async function findStandaloneServer(appDir, standaloneDir) {
+  const atRoot = path2.join(standaloneDir, "server.js");
+  if (await exists(atRoot)) {
+    return atRoot;
+  }
+  let current = path2.resolve(appDir);
+  let suffix = "";
+  for (; ; ) {
+    const parent = path2.dirname(current);
+    if (parent === current) {
+      return void 0;
+    }
+    suffix = suffix === "" ? path2.basename(current) : path2.join(path2.basename(current), suffix);
+    const candidate = path2.join(standaloneDir, suffix, "server.js");
+    if (await exists(candidate)) {
+      return candidate;
+    }
+    current = parent;
+  }
+}
 async function validateTarget(appDir) {
   const nextDir = path2.resolve(appDir, ".next");
   if (!await exists(nextDir)) {
@@ -92706,11 +92726,11 @@ async function validateTarget(appDir) {
       `No .next directory in ${appDir}. Run "next build" first.`
     );
   }
-  const standaloneServer = path2.join(nextDir, "standalone", "server.js");
-  if (!await exists(standaloneServer)) {
+  const standaloneServer = await findStandaloneServer(appDir, path2.join(nextDir, "standalone"));
+  if (standaloneServer === void 0) {
     throw new TargetError(
       "NO_STANDALONE",
-      `No ${standaloneServer}.
+      `No ${path2.join(nextDir, "standalone", "server.js")}.
 next-leak measures the standalone server bundle. Enable it once in next.config:
 
     const nextConfig = {
@@ -92754,6 +92774,7 @@ import { pathToFileURL } from "url";
 import { z as z3 } from "zod";
 var controlFileSchema = z3.object({ port: z3.number(), pid: z3.number() });
 var DEFAULT_MAX_OLD_SPACE_MB = 512;
+var DEFAULT_READY_TIMEOUT_MS = 6e4;
 var LaunchError = class extends Error {
   constructor(message) {
     super(message);
@@ -92794,8 +92815,16 @@ function explainRuntimeFailure(stderr, maxOldSpaceMb) {
   }
   return `the measured process exited mid-run. ${explainStartupFailure(stderr)}`;
 }
+function appNeverListened(hostname, port, budgetMs, stderr) {
+  const head = `app on ${hostname}:${port} \u2014 the process started and answered on its control channel, but never listened within ${Math.round(budgetMs / 1e3)}s`;
+  if (stderr.trim() !== "") {
+    return `${head}. It wrote this while starting:
+${stderr.trim()}`;
+  }
+  return `${head}, and wrote nothing to stderr. An app that boots slower than that needs a larger budget: --ready-timeout <seconds>. Otherwise it is hanging during startup \u2014 starting the same server.js by hand, with PORT set, hangs the same way and can be interrupted to see where`;
+}
 var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-async function pollUntil(deadline, what, probe, failed) {
+async function pollUntil(deadline, describe, probe, failed) {
   for (; ; ) {
     const failure = failed();
     if (failure !== void 0) {
@@ -92806,14 +92835,14 @@ async function pollUntil(deadline, what, probe, failed) {
       return result;
     }
     if (Date.now() > deadline) {
-      throw new LaunchError(`timed out waiting for ${what}`);
+      throw new LaunchError(`timed out waiting for ${describe()}`);
     }
     await sleep(100);
   }
 }
 async function launchInstrumented(options) {
   const hostname = options.hostname ?? "127.0.0.1";
-  const deadline = Date.now() + (options.readyTimeoutMs ?? 15e3);
+  const readyTimeoutMs = options.readyTimeoutMs ?? DEFAULT_READY_TIMEOUT_MS;
   const child = spawn(
     process.execPath,
     [
@@ -92857,8 +92886,8 @@ ${stderrTailBuffer}`;
   const failed = () => exited ? `server exited before becoming ready. ${explainStartupFailure(stderrWindow())}` : void 0;
   try {
     const controlPort = await pollUntil(
-      deadline,
-      `control channel in ${options.workDir}`,
+      Date.now() + readyTimeoutMs,
+      () => `control channel in ${options.workDir}`,
       // Several processes may announce a channel (clustered servers); accept
       // the first one that actually answers instead of trusting a filename.
       async () => {
@@ -92888,8 +92917,8 @@ ${stderrTailBuffer}`;
       failed
     );
     await pollUntil(
-      deadline,
-      `app on ${hostname}:${options.appPort}`,
+      Date.now() + readyTimeoutMs,
+      () => appNeverListened(hostname, options.appPort, readyTimeoutMs, stderrWindow()),
       async () => {
         try {
           await fetch(`http://${hostname}:${options.appPort}/`, { method: "HEAD" });
@@ -92939,11 +92968,13 @@ var BUILD_COMMAND = "build";
 var RUN_ONLY_FLAGS = [
   ["routes", "--routes"],
   ["cycles", "--cycles"],
+  ["repeat", "--repeat"],
   ["requests", "--requests"],
   ["connections", "--connections"],
   ["idleSeconds", "--idle"],
   ["warmupRequests", "--warmup"],
   ["maxOldSpaceMb", "--max-old-space"],
+  ["readyTimeoutSeconds", "--ready-timeout"],
   ["quick", "--quick"],
   ["noResolve", "--no-resolve"],
   ["selfCheck", "--self-check"],
@@ -92967,6 +92998,12 @@ var FLAGS = [
     help: "Only measure these routes \u2014 comma-separated templates or prefixes (e.g. /api,/dashboard)"
   },
   { flag: "--cycles", value: "int", argName: "<n>", help: "Load cycles per route (default 4, minimum 3)" },
+  {
+    flag: "--repeat",
+    value: "int",
+    argName: "<n>",
+    help: "Measure each route n times from a fresh server (default 1) \u2014 the run takes n times as long, and routes whose repetitions disagree are reported inconclusive"
+  },
   { flag: "--requests", value: "int", argName: "<n>", help: "Requests per cycle (default 5000)" },
   { flag: "--connections", value: "int", argName: "<n>", help: "Concurrent connections (default 100)" },
   { flag: "--idle", value: "int", argName: "<seconds>", help: "Idle seconds before each sample (default 30)" },
@@ -92982,6 +93019,12 @@ var FLAGS = [
     argName: "<mb>",
     help: "Heap cap of each measured process (default 512) \u2014 raise it for apps whose working set is larger"
   },
+  {
+    flag: "--ready-timeout",
+    value: "int",
+    argName: "<seconds>",
+    help: "Seconds each measured process gets to start listening (default 60) \u2014 raise it for slow-booting apps"
+  },
   {
     flag: "--quick",
     value: "none",
@@ -93048,11 +93091,13 @@ interrupted, 1 on errors.
 }
 var LIMITS = {
   "--cycles": 100,
+  "--repeat": 10,
   "--requests": 1e6,
   "--connections": 1e4,
   "--idle": 3600,
   "--warmup": 1e6,
-  "--max-old-space": 65536
+  "--max-old-space": 65536,
+  "--ready-timeout": 600
 };
 var MIN_MAX_OLD_SPACE_MB = 128;
 function findSpec(argument) {
@@ -93088,11 +93133,13 @@ function applyNumericFlag(flag, value, options) {
     );
   }
   if (flag === "--cycles") options.cycles = parsed;
+  if (flag === "--repeat") options.repeat = parsed;
   if (flag === "--requests") options.requests = parsed;
   if (flag === "--connections") options.connections = parsed;
   if (flag === "--idle") options.idleSeconds = parsed;
   if (flag === "--warmup") options.warmupRequests = parsed;
   if (flag === "--max-old-space") options.maxOldSpaceMb = parsed;
+  if (flag === "--ready-timeout") options.readyTimeoutSeconds = parsed;
   return FLAG_OK;
 }
 function applyFlag(spec, value, options) {
@@ -93100,11 +93147,13 @@ function applyFlag(spec, value, options) {
     case "--routes":
       return applyRoutesFlag(value, options);
     case "--cycles":
+    case "--repeat":
     case "--requests":
     case "--connections":
     case "--idle":
     case "--warmup":
     case "--max-old-space":
+    case "--ready-timeout":
       return applyNumericFlag(spec.flag, value, options);
     case "--quick":
       options.quick = true;
@@ -93171,11 +93220,13 @@ function parseCliArgs(argv) {
     appDir: "",
     routes: null,
     cycles: null,
+    repeat: null,
     requests: null,
     connections: null,
     idleSeconds: null,
     warmupRequests: null,
     maxOldSpaceMb: null,
+    readyTimeoutSeconds: null,
     quick: false,
     noResolve: false,
     selfCheck: false,
@@ -93858,7 +93909,8 @@ async function runRitual(options, deps = defaultDeps) {
     serverPath: options.serverPath,
     workDir: options.workDir,
     bootstrapPath: options.bootstrapPath,
-    ...options.maxOldSpaceMb !== void 0 && { maxOldSpaceMb: options.maxOldSpaceMb }
+    ...options.maxOldSpaceMb !== void 0 && { maxOldSpaceMb: options.maxOldSpaceMb },
+    ...options.readyTimeoutMs !== void 0 && { readyTimeoutMs: options.readyTimeoutMs }
   };
   let app;
   try {
@@ -94242,6 +94294,19 @@ function revalidationLines(route) {
     `      driven through ISR revalidation (revalidates every ${route.revalidatedEverySeconds}s; without it the load would serve the cache)`
   ];
 }
+function repetitionLines(route) {
+  const repetitions = route.repetitions;
+  if (repetitions === void 0 || repetitions.length < 2) {
+    return [];
+  }
+  const rates = repetitions.map((entry) => entry.growthPer1000Requests);
+  const low = Math.min(...rates);
+  const high = Math.max(...rates);
+  const verdicts = [...new Set(repetitions.map((entry) => entry.verdict))];
+  const agreement = verdicts.length === 1 ? `all ${repetitions.length} agreed on ${verdicts[0]}` : `they disagreed (${verdicts.join(", ")}), so no single verdict is reported`;
+  const range = `${low >= 0 ? "+" : ""}${(low / MB2).toFixed(2)} to ${formatGrowth(high)}`;
+  return [`      across ${repetitions.length} repetitions: ${range} \u2014 ${agreement}`];
+}
 function cacheLines(route) {
   const lines = [];
   if (route.trend.verdict === "saturating") {
@@ -94363,6 +94428,7 @@ function routeLines(route, parameters) {
     `  ${VERDICT_ICON[verdict]} ${route.route}  ${verdict}  (${formatGrowth(
       route.growthPer1000Requests
     )})  heap ${curve}${resolved}`,
+    ...repetitionLines(route),
     ...revalidationLines(route),
     ...cacheLines(route),
     ...abandonLines(route),
@@ -94752,9 +94818,10 @@ async function measureRoute(context, route, requestPath, index, pass = void 0) {
     ...options.warmupRequests !== void 0 && { warmupRequests: options.warmupRequests },
     ...options.loadRequests !== void 0 && { loadRequests: options.loadRequests },
     ...options.connections !== void 0 && { connections: options.connections },
-    ...pass !== void 0 ? { cycles: pass.cycles } : options.cycles !== void 0 && { cycles: options.cycles },
+    ...pass?.cycles !== void 0 ? { cycles: pass.cycles } : options.cycles !== void 0 && { cycles: options.cycles },
     ...options.idleMs !== void 0 && { idleMs: options.idleMs },
     ...options.maxOldSpaceMb !== void 0 && { maxOldSpaceMb: options.maxOldSpaceMb },
+    ...options.readyTimeoutMs !== void 0 && { readyTimeoutMs: options.readyTimeoutMs },
     ...headers !== void 0 && { headers },
     ...routeConfig.abandonAfterMs !== void 0 && {
       abandonAfterMs: routeConfig.abandonAfterMs
@@ -94810,7 +94877,7 @@ async function measureRoute(context, route, requestPath, index, pass = void 0) {
     route: route.path,
     status: "measured",
     requestPath,
-    ...pass !== void 0 && { resolvedWithCycles: pass.cycles },
+    ...pass?.cycles !== void 0 && { resolvedWithCycles: pass.cycles },
     samples: result.samples,
     memorySamples: result.memorySamples,
     peaks: result.peaks,
@@ -94841,7 +94908,7 @@ async function measureRoute(context, route, requestPath, index, pass = void 0) {
   };
 }
 async function writeEvidenceBundle(report, workDir) {
-  const { renderHtmlReport } = await import("./html-report-YWIK5EDQ.js");
+  const { renderHtmlReport } = await import("./html-report-O7ILFOF5.js");
   const { renderIssueMarkdown } = await import("./issue-report-FPVOZ6HU.js");
   for (const route of report.routes) {
     if (route.status === "measured" && warrantsIssueDraft(route)) {
@@ -94879,7 +94946,7 @@ async function routeReportFor(context, route, index, total) {
     progress(`not measuring ${label}: ${plan.reason}`);
     return { route: route.path, status: "not-exercised", reason: plan.reason };
   }
-  return measureWithResolution(context, route, requestPath, index, label);
+  return measureRepeatedly(context, route, requestPath, index, label);
 }
 function reasonToResolve(verdict) {
   switch (verdict) {
@@ -94892,12 +94959,74 @@ function reasonToResolve(verdict) {
       return null;
   }
 }
-async function measureWithResolution(context, route, requestPath, index, label) {
+async function measureRepeatedly(context, route, requestPath, index, label) {
+  const repeat = context.options.repeat ?? 1;
+  if (repeat <= 1) {
+    return measureWithResolution(context, route, requestPath, index, label);
+  }
+  const passes = [];
+  for (let attempt = 1; attempt <= repeat; attempt += 1) {
+    context.progress(`repetition ${attempt}/${repeat} of ${label}`);
+    passes.push(
+      await measureWithResolution(context, route, requestPath, index, label, `-rep${attempt}`)
+    );
+    if (context.options.signal?.aborted === true) {
+      break;
+    }
+  }
+  return aggregateRepetitions(passes);
+}
+function aggregateRepetitions(passes) {
+  const first = passes[0];
+  if (first === void 0) {
+    return { route: "", status: "failed", reason: "no repetition produced a result" };
+  }
+  const measured = passes.filter((pass) => pass.status === "measured");
+  if (measured.length !== passes.length || measured.length === 0) {
+    return passes.find((pass) => pass.status !== "measured") ?? first;
+  }
+  const repetitions = measured.map((pass) => ({
+    verdict: pass.trend.verdict,
+    growthPer1000Requests: pass.trend.growthPerCycle / pass.requestsPerCycle * 1e3
+  }));
+  const verdicts = [...new Set(repetitions.map((entry) => entry.verdict))];
+  const winner = measured[0];
+  if (winner === void 0) {
+    return first;
+  }
+  if (verdicts.length === 1) {
+    return { ...winner, repetitions };
+  }
+  const observed = verdicts.join(", ");
+  return {
+    ...winner,
+    repetitions,
+    confidence: {
+      ...winner.confidence,
+      level: "low",
+      warnings: [
+        ...winner.confidence.warnings,
+        {
+          code: "repetitions-disagree",
+          detail: `${repetitions.length} repetitions of this route disagreed (${observed}) \u2014 the measurement did not settle, so no single verdict is reported`
+        }
+      ],
+      supersededVerdict: "inconclusive"
+    }
+  };
+}
+async function measureWithResolution(context, route, requestPath, index, label, repetitionSuffix = "") {
   const { progress } = context;
   try {
     const asPath = requestPath === route.path ? "" : ` as ${requestPath}`;
     progress(`measuring ${label}${asPath}`);
-    const first = await measureRoute(context, route, requestPath, index);
+    const first = await measureRoute(
+      context,
+      route,
+      requestPath,
+      index,
+      repetitionSuffix === "" ? void 0 : { dirSuffix: repetitionSuffix }
+    );
     const reason = first.status === "measured" ? reasonToResolve(effectiveVerdict(first)) : null;
     if (first.status !== "measured" || context.options.resolveInconclusive === false || reason === null) {
       return first;
@@ -94910,7 +95039,7 @@ async function measureWithResolution(context, route, requestPath, index, label)
     try {
       return await measureRoute(context, route, requestPath, index, {
         cycles,
-        dirSuffix: "-resolve"
+        dirSuffix: `${repetitionSuffix}-resolve`
       });
     } catch (cause) {
       progress(

package/dist/{chunk-SV47LIER.js → chunk-YLHE4N5G.js}

@@ -1,7 +1,7 @@
 import { createRequire as __nextLeakCreateRequire } from 'node:module';import { fileURLToPath as __nextLeakFileURLToPath } from 'node:url';import { dirname as __nextLeakDirname } from 'node:path';const require = __nextLeakCreateRequire(import.meta.url);const __filename = __nextLeakFileURLToPath(import.meta.url);const __dirname = __nextLeakDirname(__filename);
 import {
   effectiveVerdict
-} from "./chunk-5ZBIS5WM.js";
+} from "./chunk-4FYSLLSX.js";
 import {
   assessPeakPressure,
   describePeakPressure

package/dist/cli-args.d.ts

@@ -2,11 +2,22 @@ export type CliRunOptions = {
     appDir: string;
     routes: string[] | null;
     cycles: number | null;
+    /**
+     * How many times to measure each route, from a fresh server each time.
+     *
+     * More cycles watch one process for longer; repetitions watch different
+     * processes. The spreads that make a verdict unpublishable live between
+     * processes: vercel/next.js#84648 gave 602, 826 and 875 MB on three runs of
+     * one build and 39 MB on a fourth.
+     */
+    repeat: number | null;
     requests: number | null;
     connections: number | null;
     idleSeconds: number | null;
     warmupRequests: number | null;
     maxOldSpaceMb: number | null;
+    /** Seconds each measured process gets to boot before the route is failed. */
+    readyTimeoutSeconds: number | null;
     quick: boolean;
     noResolve: boolean;
     selfCheck: boolean;

package/dist/cli.js

@@ -22,10 +22,10 @@ import {
   runSelfCheck,
   unregisterChild,
   validateTarget
-} from "./chunk-OIJE43WX.js";
+} from "./chunk-672J2BQO.js";
 import {
   classifyTrend
-} from "./chunk-5ZBIS5WM.js";
+} from "./chunk-4FYSLLSX.js";
 import "./chunk-XHPUAMJG.js";
 import "./chunk-6XYFBOL2.js";
 
@@ -927,11 +927,15 @@ async function main() {
     ...quickPreset,
     ...options.routes !== null && { routeFilter: options.routes },
     ...options.cycles !== null && { cycles: options.cycles },
+    ...options.repeat !== null && { repeat: options.repeat },
     ...options.requests !== null && { loadRequests: options.requests },
     ...options.connections !== null && { connections: options.connections },
     ...options.idleSeconds !== null && { idleMs: options.idleSeconds * 1e3 },
     ...options.warmupRequests !== null && { warmupRequests: options.warmupRequests },
     ...options.maxOldSpaceMb !== null && { maxOldSpaceMb: options.maxOldSpaceMb },
+    ...options.readyTimeoutSeconds !== null && {
+      readyTimeoutMs: options.readyTimeoutSeconds * 1e3
+    },
     ...options.diffAll && { diffAll: true },
     ...options.noResolve && { resolveInconclusive: false },
     ...options.output !== null && { outputDir: options.output },

package/dist/confidence.d.ts

@@ -20,7 +20,16 @@ import { type TrendResult, type TrendVerdict } from "./trend.js";
  *   settled at, so it carries warm-up's own retention rather than the app's
  *   resting size
  */
-export type WarningCode = "unsettled" | "settle-unverified" | "load-incomplete" | "abandon-ineffective" | "abandon-before-response" | "spiky-growth" | "near-threshold" | "thin-evidence" | "near-heap-ceiling" | "warm-up-baseline";
+export type WarningCode = "unsettled" | "settle-unverified" | "load-incomplete" | "abandon-ineffective" | "abandon-before-response" | "spiky-growth" | "near-threshold" | "thin-evidence" | "near-heap-ceiling" | "warm-up-baseline"
+/**
+ * Repeated measurements of the same route did not agree.
+ *
+ * More cycles watch one process for longer; repetitions watch different
+ * ones, and that is where the spread lives — vercel/next.js#84648 gave 602,
+ * 826 and 875 MB on three runs of one build and 39 MB on a fourth. A verdict
+ * a second run contradicts is not a verdict.
+ */
+ | "repetitions-disagree";
 export type MeasurementWarning = {
     code: WarningCode;
     detail: string;

package/dist/{html-report-YWIK5EDQ.js → html-report-O7ILFOF5.js}

@@ -1,8 +1,8 @@
 import { createRequire as __nextLeakCreateRequire } from 'node:module';import { fileURLToPath as __nextLeakFileURLToPath } from 'node:url';import { dirname as __nextLeakDirname } from 'node:path';const require = __nextLeakCreateRequire(import.meta.url);const __filename = __nextLeakFileURLToPath(import.meta.url);const __dirname = __nextLeakDirname(__filename);
 import {
   renderHtmlReport
-} from "./chunk-SV47LIER.js";
-import "./chunk-5ZBIS5WM.js";
+} from "./chunk-YLHE4N5G.js";
+import "./chunk-4FYSLLSX.js";
 import "./chunk-XHPUAMJG.js";
 import "./chunk-6XYFBOL2.js";
 export {

package/dist/index.js

@@ -41,13 +41,13 @@ import {
   sourceIndexAt,
   summarizeBaseline,
   validateTarget
-} from "./chunk-OIJE43WX.js";
+} from "./chunk-672J2BQO.js";
 import {
   renderHtmlReport
-} from "./chunk-SV47LIER.js";
+} from "./chunk-YLHE4N5G.js";
 import {
   classifyTrend
-} from "./chunk-5ZBIS5WM.js";
+} from "./chunk-4FYSLLSX.js";
 import {
   renderIssueMarkdown
 } from "./chunk-AUUMRTZZ.js";

package/dist/launcher.d.ts

@@ -8,6 +8,18 @@ import { type ChildProcess } from "node:child_process";
  * so `--max-old-space` exists and the chosen value is recorded in `run.json`.
  */
 export declare const DEFAULT_MAX_OLD_SPACE_MB = 512;
+/**
+ * How long each startup wait gets before the route is called failed.
+ *
+ * It was 15 s, shared between waiting for the control channel and waiting for
+ * the app to listen — so a slow channel spent the app's budget too. Both
+ * numbers were also invisible: a real app that needs longer to boot than the
+ * tool was willing to wait had no way to say so, and got
+ * `timed out waiting for app` on every route (#71). 60 s is what a cold
+ * standalone bundle of a couple of thousand modules takes on a laptop with
+ * a busy disk, with room to spare; `--ready-timeout` moves it.
+ */
+export declare const DEFAULT_READY_TIMEOUT_MS = 60000;
 export type LaunchOptions = {
     /** Absolute path to the standalone `server.js` (or any PORT/HOSTNAME-honoring server). */
     serverPath: string;
@@ -19,6 +31,10 @@ export type LaunchOptions = {
     bootstrapPath: string;
     hostname?: string;
     maxOldSpaceMb?: number;
+    /**
+     * Budget for each of the two waits below, not for the pair. Default:
+     * `DEFAULT_READY_TIMEOUT_MS`.
+     */
     readyTimeoutMs?: number;
     env?: Record<string, string>;
 };
@@ -81,6 +97,13 @@ export declare function explainStartupFailure(stderr: string): string;
  */
 export declare function stderrShowsHeapExhaustion(stderr: string): boolean;
 export declare function explainRuntimeFailure(stderr: string, maxOldSpaceMb: number): string;
+/**
+ * What to say when the process is alive and answering on its control channel,
+ * but never opened the app port. The old message named the port and stopped
+ * there, which reads like the tool failed to connect to something that was
+ * running. The process is up: what did not happen is the listen.
+ */
+export declare function appNeverListened(hostname: string, port: number, budgetMs: number, stderr: string): string;
 /**
  * Spawns the measured server in a fresh child process with GC exposed and the
  * control-channel bootstrap preloaded, and waits until both the app port and

package/dist/ritual.d.ts

@@ -20,6 +20,8 @@ export type RitualOptions = {
     idleMs?: number;
     /** Old-space cap for the measured process (MB). Default: 512. */
     maxOldSpaceMb?: number;
+    /** How long the process gets to start listening (ms). Default: 60_000. */
+    readyTimeoutMs?: number;
     /** Headers sent with every request during warm-up and load. */
     headers?: Record<string, string>;
     /**

package/dist/runner.d.ts

@@ -8,7 +8,13 @@ import { type PrerenderManifest } from "./manifests.js";
 import { extractModuleRegistry } from "./module-registry.js";
 import { runRitual, type LoadOutcome, type PeakSample, type PhaseTiming, type SettleOutcome } from "./ritual.js";
 import { readNextVersion, type MatchedSignature } from "./signatures.js";
-import { type TrendResult } from "./trend.js";
+import { type TrendResult, type TrendVerdict } from "./trend.js";
+/** What one repetition of a route concluded, for disclosing the spread. */
+export type RepetitionSummary = {
+    verdict: TrendVerdict;
+    /** Growth normalized by traffic, so repetitions stay comparable. */
+    growthPer1000Requests: number;
+};
 export type RouteReport = {
     route: string;
     status: "skipped";
@@ -79,6 +85,12 @@ export type RouteReport = {
     unreclaimedTrend: TrendResult;
     /** Requests each cycle served — what the growth rates normalize by. */
     requestsPerCycle: number;
+    /**
+     * One entry per repetition when `repeat` was greater than 1, in the
+     * order they ran. Absent for a single measurement, so `run.json` keeps
+     * its existing shape unless repetition was asked for.
+     */
+    repetitions?: RepetitionSummary[];
     /**
      * The early-disconnect regime, when the route asked for one. Recorded
      * because a curve measured with cuts landing mid-stream and one measured
@@ -218,6 +230,11 @@ export type RunOptions = {
     idleMs?: number;
     /** Old-space cap for each measured process (MB). Default 512. */
     maxOldSpaceMb?: number;
+    /**
+     * How long each measured process gets to start listening, in milliseconds.
+     * Default: `DEFAULT_READY_TIMEOUT_MS`.
+     */
+    readyTimeoutMs?: number;
     /** Also diff routes with a stable verdict. Default false: diffs are slow. */
     diffAll?: boolean;
     /** Only measure routes matching these templates or prefixes. */
@@ -227,6 +244,13 @@ export type RunOptions = {
      * call it. Default true: the run should answer the question it was asked.
      */
     resolveInconclusive?: boolean;
+    /**
+     * How many times to measure each route, each from a fresh server. Default 1.
+     *
+     * Distinct from `cycles`, which watches a single process for longer. The
+     * variance that makes a number unpublishable is between processes.
+     */
+    repeat?: number;
     /**
      * Growth the self-check measured on its planted leak, when one ran before
      * this measurement. Its presence is what lets the report say a `stable`
@@ -265,6 +289,17 @@ export type RunnerDeps = {
 };
 export declare function freePort(): Promise<number>;
 export declare function routeSlug(route: string): string;
+/**
+ * Combines repeated measurements of one route into the verdict it earned.
+ *
+ * Unanimity or nothing. Taking the most severe would let one noisy repetition
+ * in five accuse a healthy route, and a false accusation is the expensive
+ * error; taking the majority would discard exactly the disagreement the
+ * repetitions were run to find. When they disagree the honest report is that
+ * the measurement did not settle, which is what `inconclusive` means and what
+ * already routes to re-measurement and away from issue drafts.
+ */
+export declare function aggregateRepetitions(passes: readonly RouteReport[]): RouteReport;
 /**
  * Full measurement run: validate the target, discover routes, run the ritual
  * per route in a fresh process, diff snapshots for non-stable verdicts, and

package/dist/target.d.ts

@@ -6,7 +6,11 @@ export declare class TargetError extends Error {
 }
 export type ValidatedTarget = {
     appDir: string;
-    /** Absolute path to `.next/standalone/server.js`. */
+    /**
+     * Absolute path to the standalone `server.js`. At the root of
+     * `.next/standalone` for a single-package app; under the app's path relative
+     * to the workspace root for a monorepo.
+     */
     standaloneServer: string;
     appPaths: AppPathsManifest;
     pages: PagesManifest;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "next-leak",
-  "version": "0.10.1",
+  "version": "0.11.1",
   "description": "Find out whether your Next.js app actually leaks memory — how much, on which route, and whose fault it is.",
   "keywords": [
     "nextjs",