supercov 4.17.2 → 4.19.0

package/docs/agent-loop.md

@@ -122,9 +122,12 @@ The file query explained the gap:
 ```text
  LINE  STATUS        SOURCE
     2  PARTIAL       signedIn && !expired
-       Unobserved: `!expired` was never false; needs `signedIn` true, `!expired` false, decision false
+       Unobserved: no witness pair shows `!expired` independently changing the decision result
 ```
 
+Current releases name the missing value in that line: `` `!expired` was never
+false; needs `signedIn` true, `!expired` false, decision false ``.
+
 Both return paths had run, but neither test checked an expired session. MC/DC
 checks whether each condition has been shown to affect the decision
 independently. Here, `signedIn` had; `!expired` had not.

package/docs/cli.md

@@ -28,6 +28,7 @@ npx supercov --help
 | Open an interactive report | `npx supercov report` |
 | Find the tests a change affects | `npx supercov runs latest tests affected` |
 | Combine shards | `npx supercov merge <id> <id> [...]` |
+| Add coverage measured elsewhere, by line | `npx supercov import lcov.info --test <name>` |
 | Remove stored runs | `npx supercov runs clean` |
 | Assess code quality with Jev | `npx supercov quality` |
 | See only files with findings | `npx supercov quality gaps` |
@@ -204,6 +205,11 @@ In `--json`, every file of `files` and `gaps` carries `totals` and `covered`
 for each metric beside what is missing, so a percentage can be worked out for
 any file or set of files.
 
+A page holds at most what fits in one reply, so a `--limit` larger than that
+returns fewer entries. Such a page says so: `pageCut` in `--json` gives
+`asked`, `returned` and `nextOffset`, and stderr names the `--offset` the rest
+start at.
+
 `line` reads the run once for every location it is given, so asking for
 twenty lines in one call costs about what one does. `--from-file` takes the
 locations from a file, one per line, skipping blank lines and `#` comments.
@@ -214,6 +220,14 @@ entry per location in order, each location once. Locations that do not fit one
 reply are listed in `remaining`, and `pagination.nextOffset` says where the next
 reply starts: ask again with `--offset`, as for any page.
 
+A location naming no file of the run, or more than one, is listed under **Not
+answered** (`failed` in `--json`, each with its `location`, `code` and
+`message`) and the others are still answered; the call fails only when none
+is. A line whose file changed since the run is answered from the working tree
+with a warning naming that file; a change elsewhere, a test's included, does
+not make the answer stale. A line holding no statement, branch or function
+start is **NOT MEASURED** and says so.
+
 ```sh supercov
 npx supercov runs latest line app/routes/checkout.ts:42 app/routes/checkout.ts:57
 npx supercov runs latest line --from-file lines.txt --json
@@ -321,6 +335,11 @@ changed file that looks like product source but is absent from the run is named
 separately, because treating it as zero uncovered lines would report success for
 code nothing ran.
 
+A run whose suite failed still shows the change's coverage, but `patch` exits 2
+and `--json` gives `result: "error"` with the reasons: a gate over a failed
+suite cannot pass. A run whose source has changed since is refused, because
+its lines no longer map onto the checkout.
+
 `--kind`, `--runner`, `--tag`, `--title` and `--test-file` ask whether some of
 the tests reach the change: the E2E tests, or the tests of one file.
 
@@ -819,6 +838,43 @@ reusing the answers saved when its parts were assessed. `tests affected` of a
 merged run is answered from the runs it was merged from, which hold the record
 of what each test ran; a test in several of them is affected where any says so.
 
+## Add coverage measured elsewhere
+
+Some code runs where Supercov cannot measure it: a deployed worker, a
+production container, a binary another tool built. If that environment can
+write an LCOV tracefile, add its lines to a run:
+
+```sh
+npx supercov import lcov.info --test "edge in production"
+npx supercov import lcov.info --background --run <run-id>
+```
+
+The import publishes a new run made from the latest one (or the one `--run`
+names), and leaves that run as it was. The lines are credited to a test of
+their own, of kind `imported` with runner `lines`, or to the run's background.
+
+This evidence is line-only. A line that ran credits every statement on it, and
+a function that was entered credits the function. Branches, decisions and MC/DC
+come only from Supercov's own measurement. A file the run did not measure joins
+it with one statement per recorded line, and is marked as measured only by the
+import.
+
+Paths are matched to the project: an absolute path under the project, or the
+one measured file a path ends with, such as `/app/src/lib.rs` for
+`src/lib.rs`. Files outside the project are left out and listed. If evidence
+names a line past the end of a file, it was recorded from other source, and
+the import refuses it.
+
+Supercov runs no other coverage tool. A profile another tool recorded is
+exported as LCOV by that tool first. For an LLVM profile from a binary built
+with `-C instrument-coverage`, with `rustup component add llvm-tools`:
+
+```sh
+llvm-profdata merge -sparse default.profraw -o edge.profdata
+llvm-cov export -format=lcov -instr-profile edge.profdata target/debug/edge > edge.info
+npx supercov import edge.info --test "edge binary"
+```
+
 ## Clean local data
 
 ```sh supercov

package/docs/supported-suites.md

@@ -144,6 +144,12 @@ signal exactly as it would unmeasured, and one with its own handler keeps
 it. `SIGKILL` cannot be caught by anything and is the one stop that loses
 whatever was still buffered.
 
+A program that hands its process over to another with `exec` keeps what it
+ran: a cache front end that restores a key and then `process.execve`s the
+runner's Node, or a Ruby script that calls `exec`, writes its evidence before
+the new program starts. Python and Rust write as they run, so an `exec`
+loses nothing there either.
+
 ## Rust
 
 | Runner | Attribution | Current requirement |
@@ -169,11 +175,14 @@ files under a `tests`, `examples` or `benches` directory, files named
 `#[bench]`. Its assertions still mark which evidence a passing assertion
 witnessed.
 
-Neither is code the compiler never builds for the target: a `#[cfg(windows)]`
-function on Linux, or one behind `#[cfg(not(target_os = "macos"))]` on a Mac,
-is not counted. Only predicates the target settles (`unix`, `windows`,
-`target_*`) are decided; an item behind a feature or a custom cfg is counted
-either way.
+Neither is code the compiler never builds: a `#[cfg(windows)]` function on
+Linux, an item or statement behind a feature the build leaves off, or one
+behind a build script's `--cfg` that is not set. The target settles `unix`,
+`windows` and `target_*` before the run; every other predicate is settled by
+the build itself, as each crate's probes record what `cfg!` says of its gated
+code. Code no build of the run compiled is left out and the run names it
+(`N item(s) behind a #[cfg] no build compiled are outside the denominator`);
+code of a crate no test reached stays counted, and the run says that too.
 
 Use the repository's normal flags after the wrapped command:
 
@@ -186,6 +195,127 @@ npx supercov -- cargo nextest run --workspace
 explanation instead of silently falling back to plausible but inaccurate
 attribution.
 
+### Rust compiled to wasm in JavaScript tests
+
+A crate wasm-bindgen exposes to JavaScript (a `cdylib` that depends on
+`wasm-bindgen`) is measured when JavaScript tests load it: a Node suite
+(Vitest, Jest, node:test, Mocha) through the `nodejs` or bundler glue, or a
+Playwright suite whose page loads the `web` glue. Build the wasm in the test
+command, as the suite already does when it tests the crate it ships
+(`wasm-pack build && vitest`, or `cargo build --target wasm32-unknown-unknown`
+and `wasm-bindgen`), so the module the tests load is built from Supercov's
+copy:
+
+```sh
+npx supercov -- npm test
+npx supercov -- npx playwright test
+```
+
+The JavaScript runtime remembers each wasm instance, in the test process and
+in each page, and reads what the module ran at every test's end, so each test
+is credited exactly with its own lines and decisions. The crate's coverage is
+a Rust run beside the JavaScript run. What the copy built (`target/`, and the
+generated `pkg/` with its instrumented wasm) stays in the copy.
+
+### A Rust Worker under browser tests
+
+A Playwright suite that starts a Cloudflare Worker written in Rust with
+`wrangler dev`, built by `worker-build`, measures the Worker:
+
+```sh
+npx supercov -- npx playwright test
+```
+
+The crate is rewritten with probes in the copy the suite runs in, and
+`wrangler dev` builds it there as usual. The copy's wrangler configuration
+(`wrangler.toml`, `wrangler.json` or `wrangler.jsonc`) points `main` at a
+small entry of Supercov's that remembers the Worker's wasm instances and then
+is your entry, and gives `[dev]` an inspector port unless you set one; your
+own configuration and command are not changed. While the suite runs,
+Supercov reads what the Worker ran through that inspector every 5 ms, and
+each read is credited to the browser test that was running then, if only one
+was, as for a [Go server](#a-go-server-under-browser-tests). The Worker's
+coverage is a Rust run of its own, published as the run or beside the browser
+run. Requests made before the first test, such as the readiness check
+`webServer` waits on, are the run's and no test's.
+
+The build runs with `--cap-lints=warn`, so a crate that denies warnings still
+builds with the probes in it.
+
+### A Rust Worker that `cargo test` starts
+
+Integration tests that start `wrangler dev` themselves -- to test a Worker in
+Cloudflare's own runtime -- measure the Worker too:
+
+```sh
+npx supercov -- cargo test
+npx supercov -- cargo nextest run
+```
+
+The Worker crate is instrumented with the rest of the workspace, and `wrangler
+dev` builds it in the copy as usual. The tests find a `wrangler` of
+Supercov's first on `PATH`: for `wrangler dev` it picks an inspector port,
+starts a reader of the Worker through it, and then runs your `wrangler` with
+the test's own arguments, process and signals. What the Worker ran is
+credited to the test that started it, exactly, as its own coverage. The
+Worker crate counts though `cargo test` never compiles it, once a test has
+run it. This needs a `wrangler` on `PATH` when the run starts; without one,
+nothing is put in front of it. A run whose tests start no Worker still compiles the crate under
+`cargo test --workspace`; its files then say they are a Rust Worker no test
+started, in `gaps` and the file view, rather than reading as code the tests
+missed.
+
+`wrangler dev --remote` runs the Worker on Cloudflare's edge, and wrangler
+opens no inspector into it there, so nothing can read what it ran. A test
+that starts it that way runs as usual; the Worker's files then say they ran
+remotely and could not be read. Start the Worker with `wrangler dev` to
+measure it.
+
+The Worker built with probes stays in the copy: its `build/` output is never
+returned to the project, and neither is the copy's configuration, which
+points `main` at Supercov's entry. wrangler's `.wrangler/` state is not a
+build input, so writing it does not make the run stale.
+
+### Rust tests compiled to wasm
+
+`cargo test --target <wasm target>` runs each test through the target runner
+Cargo is configured with, and so does Supercov, one test per process:
+
+```sh
+npx supercov -- cargo test --target wasm32-unknown-unknown
+npx supercov -- cargo test --target wasm32-wasip1
+```
+
+- `wasm32-unknown-unknown` with `wasm-bindgen-test-runner` (what
+  `wasm-pack test --node` sets up) runs each test module in Node. Supercov
+  gives Node a hook that writes what the module ran, which lives in its
+  memory, to the run as the test's process ends.
+- `wasm32-wasip1` with `wasmtime` or `wasmer` as the runner: Supercov opens
+  the test's evidence directory to the module (`--dir`) and names it in the
+  module's environment (`--env`), and the module writes what it runs to a
+  file there as it runs.
+
+Each test is credited exactly, assertions included, as for a native test.
+
+`wasm-pack test` works the same way. Supercov runs wasm-pack once to learn
+the `cargo test` it would run (the runner, the browser driver), then runs
+that command test by test:
+
+```sh
+npx supercov -- wasm-pack test --node
+npx supercov -- wasm-pack test --headless --chrome
+```
+
+- In headless Chrome, Supercov stands between the runner and `chromedriver`,
+  and reads what each test's module ran from the page before the runner
+  closes it.
+- Tests run in Firefox, Safari or Edge are run and reported, but not
+  measured yet; the run says so.
+- `wasm-pack test` is measured on Linux and macOS. On Windows, run the
+  `cargo test --target wasm32-unknown-unknown` it runs.
+- Deno is not supported. `wasm-bindgen-test-runner`'s Deno mode
+  (`WASM_BINDGEN_USE_DENO=1`) does not run on Deno 2.
+
 ## Python
 
 | Runner | Attribution | Current requirement |
@@ -452,28 +582,40 @@ is not the one Supercov instruments.
 npx supercov -- npx playwright test
 ```
 
-### A server Docker Compose builds
-
-A Playwright suite whose server `docker compose up` builds (`build:` in the
-compose file) measures it in any of these languages: Node, Python, Ruby, Go,
-Java or Kotlin. The image is built from Supercov's copy, so it holds the
-copy's code. Supercov's `docker` on the suite's PATH gives each service
-built from the copy the run's settings, and mounts the project's `.supercov`
-into it at the same path, so the server writes its coverage where the run
-reads it. Each request or window is credited to its test as for a server
-started directly. Supercov builds those services before starting them, so
-an image left over from an earlier run is never used. When the command ends
-it stops the containers it started; it never removes them.
-
-- Services that pull an image (`image:` with no `build:`) run code nobody
-  instrumented, and are left as they are.
+### A server in a container
+
+A Playwright suite whose server runs in a container it builds measures it in
+any of these languages: Node, Python, Ruby, Go, Java or Kotlin, whichever
+client starts it: `docker compose up` with `build:` in the compose file,
+`docker build` and `docker run` in `webServer`, testcontainers building from
+a Dockerfile in a test, or a Docker SDK. The suite's `DOCKER_HOST` points at
+a relay of Supercov's that passes every request to your Docker daemon and
+gives each container whose image holds the copy's code the run's settings,
+with the project's `.supercov` mounted at the same path, so the server
+writes its coverage where the run reads it. Each request or window is
+credited to its test as for a server started directly. When the command
+ends, the run stops the containers it measured and the rest of their compose
+projects; it never removes them.
+
+An image holds the copy's code when it was built during the run, when an
+earlier run recorded it as built from the same source (a build that finds
+every layer cached returns it unchanged), or when it is a compose service
+whose build context is in the copy: Supercov builds that service from the
+copy before its container starts, so an image left over from an earlier run
+is never used. An image built from an earlier copy, by a command outside the
+run, is left as it is, and the run says to build it in the test command.
+
+- Images pulled from a registry (`image:` with no `build:`, `postgres:16`)
+  run code nobody instrumented, and are left as they are.
+- testcontainers' reaper, Ryuk, is pointed at the daemon's own socket
+  (`TESTCONTAINERS_DOCKER_SOCKET_OVERRIDE`) unless you set one.
 - A Python or Ruby image may keep the code at a path of its own
   (`COPY backend/ /srv/`): the runtime matches the image's files to the
   copy's by their paths' common ending, and only when several of them match.
 - A Go image needs Supercov's runtime package, `_supercov_runtime/` at the
   module root: copy the whole module (`COPY . .`), not chosen directories.
-- `docker run` and a `docker build` the command makes itself are not
-  covered; neither is Windows.
+- A daemon reached over TCP or SSH (`DOCKER_HOST=tcp://...`), and Windows,
+  are not covered: there the containers run as written.
 
 ```sh
 npx supercov -- npx playwright test

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "supercov",
-  "version": "4.17.2",
+  "version": "4.19.0",
   "description": "Coverage, security and code quality for coding agents",
   "keywords": [
     "coverage",
@@ -82,7 +82,7 @@
     "eval:skill": "claude plugin eval plugins/supercov --scaffold --trust-plugin --no-publish --model claude-sonnet-5 --judge-model claude-haiku-4-5 --threshold 0.66 --tag behavior trigger --allow-tools Bash Edit Write --max-cost-usd 15",
     "eval:skill-triggers": "claude plugin eval plugins/supercov --scaffold --trust-plugin --no-publish --model claude-sonnet-5 --judge-model claude-haiku-4-5 --threshold 0.66 --tag trigger --ablation none --max-cost-usd 5",
     "test:engine": "cargo fmt --all -- --check && cargo clippy --workspace --all-targets -- -D warnings && cargo test --workspace && npm run test:runtime && npm run test:rust-assets && npm run test:engine-integrations",
-    "test:engine-integrations": "cargo build -p supercov && node scripts/html-report-integration.mjs && node scripts/rust-process-supervision.mjs && node scripts/rust-direct-node-integration.mjs && node scripts/rust-public-run-integration.mjs && node scripts/rust-embedded-runtime-integration.mjs && node scripts/rust-direct-vitest-integration.mjs && node scripts/rust-direct-jest-integration.mjs && node scripts/mocha-failure-output.mjs && node scripts/failure-output.mjs node ava tap && node scripts/side-by-side.mjs node && node scripts/merge-across.mjs && node scripts/mock-reach.mjs && node scripts/rust-direct-playwright-integration.mjs && node scripts/rust-custom-browser-playwright-integration.mjs && node scripts/cross-origin-requests.mjs && node scripts/leaving-page.mjs && node scripts/shared-page.mjs && node scripts/context-headers.mjs && node scripts/context-cookies.mjs && node scripts/hidden-request-emit.mjs && node scripts/js-syntax-zoo.mjs && node scripts/ruby-syntax-zoo.mjs && node scripts/rust-syntax-zoo.mjs && node scripts/python-syntax-zoo.mjs && node scripts/go-syntax-zoo.mjs && node scripts/java-syntax-zoo.mjs && node scripts/background-by-time.mjs && node scripts/python-server-playwright.mjs && node scripts/ruby-server-playwright.mjs && node scripts/go-server-playwright.mjs && node scripts/jvm-server-playwright.mjs && node scripts/docker-server-playwright.mjs && node scripts/rust-classic-browser-integration.mjs && node scripts/rust-top-packages-integration.mjs && node scripts/rust-generic-esbuild-integration.mjs && node scripts/rust-generic-tsc-integration.mjs && node scripts/rust-generic-build-matrix.mjs && node scripts/rust-vite-playwright-integration.mjs",
+    "test:engine-integrations": "cargo build -p supercov && node scripts/html-report-integration.mjs && node scripts/rust-process-supervision.mjs && node scripts/rust-direct-node-integration.mjs && node scripts/rust-public-run-integration.mjs && node scripts/rust-embedded-runtime-integration.mjs && node scripts/rust-direct-vitest-integration.mjs && node scripts/rust-direct-jest-integration.mjs && node scripts/mocha-failure-output.mjs && node scripts/failure-output.mjs node ava tap && node scripts/side-by-side.mjs node && node scripts/merge-across.mjs && node scripts/import-line-evidence.mjs && node scripts/mock-reach.mjs && node scripts/rust-direct-playwright-integration.mjs && node scripts/rust-custom-browser-playwright-integration.mjs && node scripts/cross-origin-requests.mjs && node scripts/leaving-page.mjs && node scripts/shared-page.mjs && node scripts/context-headers.mjs && node scripts/context-cookies.mjs && node scripts/hidden-request-emit.mjs && node scripts/js-syntax-zoo.mjs && node scripts/ruby-syntax-zoo.mjs && node scripts/rust-syntax-zoo.mjs && node scripts/python-syntax-zoo.mjs && node scripts/go-syntax-zoo.mjs && node scripts/java-syntax-zoo.mjs && node scripts/background-by-time.mjs && node scripts/python-server-playwright.mjs && node scripts/ruby-server-playwright.mjs && node scripts/go-server-playwright.mjs && node scripts/jvm-server-playwright.mjs && node scripts/docker-server-playwright.mjs && node scripts/docker-clients-playwright.mjs && node scripts/rust-classic-browser-integration.mjs && node scripts/exec-handover.mjs && node scripts/rust-region-container.mjs && node scripts/rust-top-packages-integration.mjs && node scripts/rust-generic-esbuild-integration.mjs && node scripts/rust-generic-tsc-integration.mjs && node scripts/rust-generic-build-matrix.mjs && node scripts/rust-vite-playwright-integration.mjs && node scripts/workspace-crash-integration.mjs",
     "test:platform": "cargo test --workspace && cargo build -p supercov && node scripts/rust-process-supervision.mjs && node scripts/workspace-crash-integration.mjs",
     "test:native-package": "cargo build --release -p supercov && node scripts/native-package-integration.mjs && node scripts/native-release-set-integration.mjs",
     "test:pypi-wheel": "node scripts/pypi-wheel-integration.mjs",
@@ -119,14 +119,14 @@
     "test:windows-tls": "node scripts/windows-tls-test.mjs"
   },
   "optionalDependencies": {
-    "@supercov/cli-darwin-arm64": "4.17.2",
-    "@supercov/cli-darwin-x64": "4.17.2",
-    "@supercov/cli-linux-arm64-gnu": "4.17.2",
-    "@supercov/cli-linux-arm64-musl": "4.17.2",
-    "@supercov/cli-linux-x64-gnu": "4.17.2",
-    "@supercov/cli-linux-x64-musl": "4.17.2",
-    "@supercov/cli-win32-arm64": "4.17.2",
-    "@supercov/cli-win32-x64": "4.17.2"
+    "@supercov/cli-darwin-arm64": "4.19.0",
+    "@supercov/cli-darwin-x64": "4.19.0",
+    "@supercov/cli-linux-arm64-gnu": "4.19.0",
+    "@supercov/cli-linux-arm64-musl": "4.19.0",
+    "@supercov/cli-linux-x64-gnu": "4.19.0",
+    "@supercov/cli-linux-x64-musl": "4.19.0",
+    "@supercov/cli-win32-arm64": "4.19.0",
+    "@supercov/cli-win32-x64": "4.19.0"
   },
   "peerDependencies": {
     "@playwright/test": ">=1.55.0",

package/runtime/javascript/jest.cjs

@@ -21,6 +21,9 @@ const runtime =
     globalThis.__SUPERCOV_DIRECT_RUNTIME__ ??
     (typeof process !== "undefined" ? process.__SUPERCOV_DIRECT_RUNTIME__ : undefined);
 const evidenceDirectory = process.env.SUPERCOV_EVIDENCE_DIR;
+// This file's context has a `WebAssembly` of its own: the instances a Rust
+// crate compiled to wasm creates here are remembered with the runtime's.
+runtime?.registerWasmRealm?.(globalThis);
 
 function digest(value) {
     return createHash("sha256").update(value).digest("hex").slice(0, 24);

package/runtime/javascript/playwright.mjs

@@ -355,6 +355,13 @@ class CoveragePhaseController {
                 hits: [],
                 events: [],
             })));
+            if (process.env.SUPERCOV_WASM_REGIONS === "1") {
+                // What the frame's wasm ran since the last take is this test's.
+                const regions = await frame
+                    .evaluate(() => globalThis.__SUPERCOV_DIRECT_RUNTIME__?.takeWasmRegions?.() ?? [])
+                    .catch(() => []);
+                directRuntime()?.appendWasmRecord?.(this.scope.attemptId, regions);
+            }
         }
         return snapshots;
     }
@@ -496,6 +503,10 @@ class CoveragePhaseController {
         patchContextPrototype(context);
         if (adopted)
             this.adoptedContexts.add(context);
+        // A Rust crate compiled to wasm the run measures: pages remember
+        // their wasm instances, so each test's work can be taken from them.
+        if (process.env.SUPERCOV_WASM_REGIONS === "1")
+            await context.addInitScript({ content: "globalThis.__SUPERCOV_WASM_REGIONS__ = true;" }).catch(() => undefined);
         await context.addInitScript({ content: browserRuntimePrelude }).catch(() => undefined);
         // A context that outlives its test (a worker-scoped browser fixture)
         // is registered again by every later test, so this script accumulates
@@ -1588,10 +1599,15 @@ const instrumentedFixtures = {
             const serverOutput = serverEvidencePath(scope);
             mkdirSync(serverEvidenceDirectory(scope), { recursive: true });
             rmSync(serverOutput, { force: true });
+            // The attempt's first and last moment: a server's work that names
+            // no test is credited by time to the one test running then, and a
+            // test is running for all of this, not only during its actions.
+            const startedAtMs = Date.now();
             try {
                 await use();
             }
             finally {
+                const endedAtMs = Date.now();
                 try {
                     const browser = await controller.collectRuntimeSnapshots();
                     const server = readServerRecords(scope);
@@ -1621,6 +1637,7 @@ const instrumentedFixtures = {
                         ...(controller.workerEvidenceMissing ? { attribution: "partial" } : {}),
                         browser,
                         server,
+                        span: [startedAtMs, endedAtMs],
                     };
                     appendEvidenceLine(`${JSON.stringify(payload)}\n`);
                 }

package/runtime/javascript/runtime.mjs

@@ -504,6 +504,7 @@ function nextUnscopedRequest() {
 function beginBufferedServerEvidence(scope) {
   if (isBrowser)
     return;
+  switchWasmOwner(scope);
   const key = attemptKey(scope);
   state.bufferedAttempts.add(key);
   if (!state.serverBuffers.has(key))
@@ -517,6 +518,7 @@ function beginBufferedServerEvidence(scope) {
 function flushBufferedServerEvidence(scope) {
   if (isBrowser)
     return void 0;
+  switchWasmOwner(void 0);
   const key = attemptKey(scope);
   state.bufferedAttempts.delete(key);
   const buffered = state.serverBuffers.get(key);
@@ -727,6 +729,19 @@ function flushOnTermination(flush) {
     process.on("exit", drain);
   } catch (e) {
   }
+  // `process.execve` replaces the process with another program: no "exit"
+  // runs, and what this one buffered would go with it. A cache front end
+  // that hands itself over to the runner's Node lost every line it ran.
+  try {
+    const execve = process.execve;
+    if (typeof execve === "function") {
+      process.execve = function supercovExecve() {
+        drain();
+        return execve.apply(this, arguments);
+      };
+    }
+  } catch (e) {
+  }
   for (const signal of ["SIGTERM", "SIGINT", "SIGHUP", "SIGBREAK"]) {
     try {
       process.on(signal, () => {
@@ -740,10 +755,153 @@ function flushOnTermination(flush) {
     }
   }
 }
+// Rust compiled to wasm and measured by the Rust frontend keeps what it ran
+// in the module's memory, behind `__supercov_region_<crate>`. When the run
+// measures such a crate (SUPERCOV_WASM_REGIONS, or the page flag the
+// Playwright fixture sets), every instance the process or page creates is
+// remembered, and its regions are taken -- copied and cleared -- at each
+// test's edges: what was taken belongs to the test that just ended, or to no
+// test. The Rust run reads the takes and credits each to its test.
+var WASM_REGION_PREFIX = "__supercov_region_";
+function wasmRegionsWanted() {
+  if (runtimeGlobal.__SUPERCOV_WASM_REGIONS__ === true)
+    return true;
+  return typeof process !== "undefined" && process.env != null && process.env.SUPERCOV_WASM_REGIONS === "1";
+}
+function installWasmRegistry() {
+  if (runtimeGlobal.__SUPERCOV_WASM_REGISTRY__ || typeof WebAssembly === "undefined" || !wasmRegionsWanted())
+    return;
+  runtimeGlobal.__SUPERCOV_WASM_REGISTRY__ = true;
+  if (!runtimeGlobal.__supercovWasm)
+    runtimeGlobal.__supercovWasm = [];
+  registerWasmRealm(runtimeGlobal);
+}
+/** Remember the instances another realm creates too: Jest runs each test file in a context with a `WebAssembly` of its own. */
+function registerWasmRealm(realm) {
+  if (!runtimeGlobal.__SUPERCOV_WASM_REGISTRY__ || !realm || !realm.WebAssembly)
+    return;
+  // By the `WebAssembly` itself: a flag on the realm's global would show
+  // through in a context that exposes the outer globals, as Jest's does.
+  if (!runtimeGlobal.__supercovWasmRealms)
+    runtimeGlobal.__supercovWasmRealms = new WeakSet();
+  const wasm = realm.WebAssembly;
+  if (runtimeGlobal.__supercovWasmRealms.has(wasm))
+    return;
+  runtimeGlobal.__supercovWasmRealms.add(wasm);
+  const instances = runtimeGlobal.__supercovWasm;
+  const Instance = wasm.Instance;
+  function Recorded(module, imports) {
+    const instance = new Instance(module, imports);
+    instances.push(instance);
+    return instance;
+  }
+  Recorded.prototype = Instance.prototype;
+  try {
+    wasm.Instance = Recorded;
+  } catch (e) {
+  }
+  ["instantiate", "instantiateStreaming"].forEach(function(name) {
+    const original = wasm[name];
+    if (typeof original !== "function")
+      return;
+    try {
+      wasm[name] = function() {
+        return original.apply(wasm, arguments).then(function(result) {
+          instances.push(result instanceof Instance ? result : result.instance);
+          return result;
+        });
+      };
+    } catch (e) {
+    }
+  });
+}
+installWasmRegistry();
+function wasmBase64(bytes) {
+  if (typeof Buffer !== "undefined")
+    return Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength).toString("base64");
+  let text = "";
+  for (let index = 0; index < bytes.length; index += 32768)
+    text += String.fromCharCode.apply(null, bytes.subarray(index, Math.min(bytes.length, index + 32768)));
+  return btoa(text);
+}
+/** Each instrumented crate's region: its header and the pages a probe touched since the last take, then cleared. A region with nothing new is left out, but for the first take, which carries what `cfg!` said of the crate's gates. */
+function takeWasmRegions() {
+  const out = [];
+  const instances = runtimeGlobal.__supercovWasm;
+  if (!instances)
+    return out;
+  if (!runtimeGlobal.__supercovWasmTaken)
+    runtimeGlobal.__supercovWasmTaken = new WeakSet();
+  const seen = runtimeGlobal.__supercovWasmTaken;
+  for (const instance of instances) {
+    const exports = instance && instance.exports;
+    if (!exports || !exports.memory)
+      continue;
+    for (const name of Object.keys(exports)) {
+      if (name.indexOf(WASM_REGION_PREFIX) !== 0)
+        continue;
+      try {
+        const crate = name.slice(WASM_REGION_PREFIX.length);
+        const packed = BigInt.asUintN(64, BigInt(exports[name]()));
+        const at = Number(packed >> BigInt(32));
+        const length = Number(packed & BigInt(4294967295));
+        if (!length)
+          continue;
+        const view = new DataView(exports.memory.buffer, at, length);
+        const first = !seen.has(exports);
+        if (!first && view.getUint32(40, true) === 0 && view.getUint32(44, true) === 0)
+          continue;
+        seen.add(exports);
+        const bytes = new Uint8Array(exports.memory.buffer, at, length);
+        const bodyAt = view.getUint32(32, true);
+        const segments = [[0, wasmBase64(bytes.subarray(0, bodyAt))]];
+        for (let page = 0; bodyAt + page * 4096 < length; page++) {
+          if (bytes[128 + (page >> 3)] & 1 << (page & 7)) {
+            const from = bodyAt + page * 4096;
+            segments.push([from, wasmBase64(bytes.subarray(from, Math.min(length, from + 4096)))]);
+          }
+        }
+        out.push([crate, length, segments]);
+        const clear = exports["__supercov_clear_" + crate];
+        if (typeof clear === "function")
+          clear();
+      } catch (e) {
+      }
+    }
+  }
+  return out;
+}
+/** Write a take, owned by an attempt or by no test, where the Rust run reads it. */
+function appendWasmRecord(attemptId, regions) {
+  if (isBrowser || !regions || regions.length === 0)
+    return;
+  const fs = getFs();
+  if (!fs)
+    return;
+  try {
+    const directory = configuredServerEvidenceRoot() + "/wasm";
+    makeEvidenceDirectory(fs, directory);
+    if (!state.wasmFile)
+      state.wasmFile = directory + "/" + process.pid + "-" + Math.random().toString(36).slice(2) + ".jsonl";
+    fs.appendFileSync(state.wasmFile, JSON.stringify({ owner: attemptId || null, regions }) + "\n");
+  } catch (e) {
+  }
+}
+/** The test whose wasm work is being recorded changes: what was recorded until now is the previous owner's. */
+function switchWasmOwner(scope) {
+  if (!runtimeGlobal.__SUPERCOV_WASM_REGISTRY__ || isBrowser)
+    return;
+  const owner = state.wasmOwner || null;
+  state.wasmOwner = scope && scope.attemptId ? scope.attemptId : null;
+  appendWasmRecord(owner, takeWasmRegions());
+}
 if (!isBrowser) {
   const flushers = (_a7 = runtimeGlobal.__SUPERCOV_BUFFER_FLUSHERS__) != null ? _a7 : /* @__PURE__ */ new Set();
   runtimeGlobal.__SUPERCOV_BUFFER_FLUSHERS__ = flushers;
   flushers.add(flushAllBufferedServerEvidence);
+  flushers.add(function() {
+    switchWasmOwner(void 0);
+  });
   if (!runtimeGlobal.__SUPERCOV_BUFFER_EXIT_INSTALLED__) {
     flushOnTermination(() => {
       var _a8;
@@ -913,6 +1071,7 @@ function currentRequestContext() {
   return runtimeGlobal.__SUPERCOV_ACTIVE_SCOPE__ ? { scope: runtimeGlobal.__SUPERCOV_ACTIVE_SCOPE__ } : {};
 }
 function activateCoverageScope(scope) {
+  switchWasmOwner(scope);
   if (scope)
     runtimeGlobal.__SUPERCOV_ACTIVE_SCOPE__ = scope;
   else
@@ -2155,6 +2314,9 @@ const directRuntimeApi = {
   selectEndV2,
   selectNextV2,
   takeNodeAssertionPhases,
+  takeWasmRegions,
+  appendWasmRecord,
+  registerWasmRealm,
   tryBegin,
   tryCatch,
   tryEnd,
@@ -2221,6 +2383,9 @@ export {
   selectEndV2,
   selectNextV2,
   takeNodeAssertionPhases,
+  takeWasmRegions,
+  appendWasmRecord,
+  registerWasmRealm,
   tryBegin,
   tryCatch,
   tryEnd,