TestPNGChunkCountBombIsBounded (internal/adapter/scanner/container_test.go) still fails on machine load although iss-2609091215552981 was resolved: the resolution moved the proof to the refusal but kept a plain-run wall-clock runaway guard of 10s against a run of about 1.5s, and at a 1-minute load of about 20 to 40 the plain run took 10.63s and failed while its own result carried the chunk bound's refusal (png: more than 1024 compressed chunks). The resolved record's grounds name exactly this as what would show it wrong: a red on a slow machine where the bound held. Observed in make preflight on the merged tip 7469213f of feat/guard-per-call-workdir. Fix: size the guard as a hang detector far above any plausible loaded run (or route it through the hang-budget helper the wall-clock sweep introduces), so only a runaway reds it; detector: with the chunk bound removed the test must still fail on the missing refusal.

Frontmatter

.abcd/work/issues/resolved/iss-2609232048579579-testpngchunkcountbombisbounded-internal.md
open on GitHub ↗ · commit history ↗

mentions1

• iss-2609091215552981TestPNGChunkCountBombIsBounded proves the payload scan refuses a decompression bomb, and it proves it by timing the run: it measures elapsed wall clock and fails past ten seconds. Under the race detector the same run takes fifteen times as long, so the test reports the chunk loop as unbounded at about twenty-three seconds where it takes about one and a half seconds plain, and the failure message asserts the opposite of what the result it prints shows, because the very same result carries the refusal the bound produced, naming more than the permitted number of compressed chunks. The lane this breaks is not an optional one: make preflight runs the race-enabled internal tests and CI runs them on macOS and Linux both, so the branch that added the test cannot pass its own gate on any machine, and the redness says the security control failed when the control worked. A wall-clock assertion also cannot distinguish a slow machine from a broken bound, which is the distinction the test exists to make. Fix: assert the bound rather than the duration, since the scan already reports why it refused, and keep a duration assertion only if it is scaled for the race detector or skipped under it, so the test measures the property it names. Detector: with the chunk bound removed the test must fail on the missing refusal, and with the bound in place it must pass both plain and under -race on a machine where the plain run takes one second and the instrumented run takes twenty.