fix(transfer): an abort left N-1 unhandled rejections behind

Second flake in the same hunt, and a real bug rather than a test artifact.

`runRoundRobinUpload` and its resumed twin ended with `await Promise.all(workers)`.
`Promise.all` rejects the moment one worker throws and leaves the rest running
with nobody holding their rejections — so an abort, which fails every lane at
once, produces one propagated error and N-1 unhandled ones.

Bun counts an unhandled rejection as a test failure, which is how

    (fail) Resume protocol — kill-restart-verify
           → sender crash mid-transfer → resumeUpload completes the same stream
    TransferAbortError: Aborted during attempt

failed about one run in fourteen, with an error the test had already caught
properly through `handle1.done()`. The test was right; the engine was dropping
rejections on the floor beside it.

`settleWorkers` waits for every lane, then reports the first real failure —
preferring a genuine error over `TransferAbortError` when both happened, since
an abort is not the interesting one when something actually broke. Four call
sites.

This is not only a test problem. In production the same shape means a
cancelled or failed multi-lane transfer emits unhandled rejections into
whatever process is running the engine, and on a strict runtime that is a
crash rather than a log line.

Verified: 1198 pass / 0 fail.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014489bKUtUEY1Zgs9xN9mt7

packages/shade-sdk/tests/broadcast.test.ts

@@ -14,8 +14,12 @@ async function startPrekeyServer(): Promise<{ url: string; stop: () => void }> {
     store: new MemoryPrekeyStore(),
     disableRateLimit: true,
   });
-  const port = 19500 + Math.floor(Math.random() * 500);
+  // Port 0 lets the OS hand out a free one. This guessed inside a 500-wide
-  const handle = Bun.serve({ port, fetch: server.fetch });
+  // range and hoped — and several files here guessed inside the SAME range,
+  // so with test files serving in parallel the collision arrived about a
+  // quarter of the time as EADDRINUSE.
+  const handle = Bun.serve({ port: 0, fetch: server.fetch });
+  const port = handle.port;
   return { url: `http://localhost:${port}`, stop: () => handle.stop() };
 }
 

packages/shade-sdk/tests/gates.test.ts

@@ -12,8 +12,12 @@ async function startPrekeyServer(): Promise<{ url: string; stop: () => void }> {
     store: new MemoryPrekeyStore(),
     disableRateLimit: true,
   });
-  const port = 19500 + Math.floor(Math.random() * 500);
+  // Port 0 lets the OS hand out a free one. This guessed inside a 500-wide
-  const handle = Bun.serve({ port, fetch: server.fetch });
+  // range and hoped — and several files here guessed inside the SAME range,
+  // so with test files serving in parallel the collision arrived about a
+  // quarter of the time as EADDRINUSE.
+  const handle = Bun.serve({ port: 0, fetch: server.fetch });
+  const port = handle.port;
   return { url: `http://localhost:${port}`, stop: () => handle.stop() };
 }
 

packages/shade-sdk/tests/profile.test.ts

@@ -36,8 +36,12 @@ async function startServer(): Promise<ServerHandle> {
     blobStore: new MemoryBlobStore(),
     disableRateLimit: true,
   });
-  const port = 19000 + Math.floor(Math.random() * 500);
+  // Port 0 lets the OS hand out a free one. This guessed inside a 500-wide
-  const handle = Bun.serve({ port, fetch: app.fetch });
+  // range and hoped — and several files here guessed inside the SAME range,
+  // so with test files serving in parallel the collision arrived about a
+  // quarter of the time as EADDRINUSE.
+  const handle = Bun.serve({ port: 0, fetch: app.fetch });
+  const port = handle.port;
   return {
     url: `http://localhost:${port}`,
     stop: () => handle.stop(true),

packages/shade-sdk/tests/sdk.test.ts

@@ -25,8 +25,12 @@ async function startPrekeyServer(): Promise<{
     disableRateLimit: true,
     events,
   });
-  const port = 19500 + Math.floor(Math.random() * 500);
+  // Port 0 lets the OS hand out a free one. This guessed inside a 500-wide
-  const handle = Bun.serve({ port, fetch: server.fetch });
+  // range and hoped — and several files here guessed inside the SAME range,
+  // so with test files serving in parallel the collision arrived about a
+  // quarter of the time as EADDRINUSE.
+  const handle = Bun.serve({ port: 0, fetch: server.fetch });
+  const port = handle.port;
   return {
     url: `http://localhost:${port}`,
     stop: () => handle.stop(),

packages/shade-sdk/tests/streams-integration.test.ts

@@ -26,8 +26,12 @@ async function startPrekeyServer(): Promise<{ url: string; stop: () => void }> {
     disableRateLimit: true,
     events,
   });
-  const port = 21000 + Math.floor(Math.random() * 500);
+  // Port 0 lets the OS hand out a free one. This guessed inside a 500-wide
-  const handle = Bun.serve({ port, fetch: server.fetch });
+  // range and hoped — and several files here guessed inside the SAME range,
+  // so with test files serving in parallel the collision arrived about a
+  // quarter of the time as EADDRINUSE.
+  const handle = Bun.serve({ port: 0, fetch: server.fetch });
+  const port = handle.port;
   return { url: `http://localhost:${port}`, stop: () => handle.stop() };
 }
 
@@ -46,8 +50,12 @@ async function setupRig(): Promise<TestRig> {
 
   // Spin up Bob's HTTP transfer endpoint.
   const bobApp = await bob.transferRoute();
-  const port = 21500 + Math.floor(Math.random() * 500);
+  // Port 0 lets the OS hand out a free one. This guessed inside a 500-wide
-  const bobServer = Bun.serve({ port, fetch: bobApp.fetch });
+  // range and hoped — and several files here guessed inside the SAME range,
+  // so with test files serving in parallel the collision arrived about a
+  // quarter of the time as EADDRINUSE.
+  const bobServer = Bun.serve({ port: 0, fetch: bobApp.fetch });
+  const port = bobServer.port;
   const bobBaseUrl = `http://localhost:${port}`;
 
   // Wire up Alice's outgoing transfer routing.

packages/shade-sdk/tests/thumbnail.test.ts

@@ -33,8 +33,12 @@ async function startPrekeyServer(): Promise<{ url: string; stop: () => void }> {
     disableRateLimit: true,
     events,
   });
-  const port = 22000 + Math.floor(Math.random() * 500);
+  // Port 0 lets the OS hand out a free one. This guessed inside a 500-wide
-  const handle = Bun.serve({ port, fetch: server.fetch });
+  // range and hoped — and several files here guessed inside the SAME range,
+  // so with test files serving in parallel the collision arrived about a
+  // quarter of the time as EADDRINUSE.
+  const handle = Bun.serve({ port: 0, fetch: server.fetch });
+  const port = handle.port;
   return { url: `http://localhost:${port}`, stop: () => handle.stop() };
 }
 
@@ -49,8 +53,12 @@ async function setupRig(): Promise<TestRig> {
     },
   });
   const bobApp = await bob.transferRoute();
-  const port = 22500 + Math.floor(Math.random() * 500);
+  // Port 0 lets the OS hand out a free one. This guessed inside a 500-wide
-  const bobServer = Bun.serve({ port, fetch: bobApp.fetch });
+  // range and hoped — and several files here guessed inside the SAME range,
+  // so with test files serving in parallel the collision arrived about a
+  // quarter of the time as EADDRINUSE.
+  const bobServer = Bun.serve({ port: 0, fetch: bobApp.fetch });
+  const port = bobServer.port;
   const bobBaseUrl = `http://localhost:${port}`;
 
   alice.configureTransfers({

packages/shade-sdk/tests/webrtc-failover.test.ts

@@ -103,8 +103,12 @@ async function startPrekeyServer(): Promise<{ url: string; stop: () => void }> {
     disableRateLimit: true,
     events,
   });
-  const port = 23000 + Math.floor(Math.random() * 500);
+  // Port 0 lets the OS hand out a free one. This guessed inside a 500-wide
-  const handle = Bun.serve({ port, fetch: server.fetch });
+  // range and hoped — and several files here guessed inside the SAME range,
+  // so with test files serving in parallel the collision arrived about a
+  // quarter of the time as EADDRINUSE.
+  const handle = Bun.serve({ port: 0, fetch: server.fetch });
+  const port = handle.port;
   return { url: `http://localhost:${port}`, stop: () => handle.stop() };
 }
 
@@ -127,13 +131,21 @@ async function setupRig(connectTimeoutMs: number): Promise<Rig> {
   bob.configureWebRTC({ factory: broken, connectTimeoutMs });
 
   const bobApp = await bob.transferRoute();
-  const bobPort = 23500 + Math.floor(Math.random() * 500);
+  // Port 0 lets the OS hand out a free one. This guessed inside a 500-wide
-  const bobServer = Bun.serve({ port: bobPort, fetch: bobApp.fetch });
+  // range and hoped — and several files here guessed inside the SAME range,
+  // so with test files serving in parallel the collision arrived about a
+  // quarter of the time as EADDRINUSE.
+  const bobServer = Bun.serve({ port: 0, fetch: bobApp.fetch });
+  const bobPort = bobServer.port;
   baseUrls.set('bob', `http://localhost:${bobPort}`);
 
   const aliceApp = await alice.transferRoute();
-  const alicePort = 24000 + Math.floor(Math.random() * 500);
+  // Port 0 lets the OS hand out a free one. This guessed inside a 500-wide
-  const aliceServer = Bun.serve({ port: alicePort, fetch: aliceApp.fetch });
+  // range and hoped — and several files here guessed inside the SAME range,
+  // so with test files serving in parallel the collision arrived about a
+  // quarter of the time as EADDRINUSE.
+  const aliceServer = Bun.serve({ port: 0, fetch: aliceApp.fetch });
+  const alicePort = aliceServer.port;
   baseUrls.set('alice', `http://localhost:${alicePort}`);
 
   return {
@@ -145,12 +157,18 @@ async function setupRig(connectTimeoutMs: number): Promise<Rig> {
   };
 }
 
-async function teardownRig(rig: Rig): Promise<void> {
+async function teardownRig(rig: Rig | undefined): Promise<void> {
-  await rig.alice.shutdown();
+  // Tolerates a rig that never finished being built. When setupRig threw —
-  await rig.bob.shutdown();
+  // EADDRINUSE, before ports stopped being guessed — this ran anyway and died
-  rig.bobServerStop();
+  // on `rig.alice`, so one failure became two and the second one, a TypeError
-  rig.aliceServerStop();
+  // in teardown, is what you saw first. Cleanup must never be the loudest
-  rig.prekeyStop();
+  // thing in a failing test.
+  if (!rig) return;
+  await rig.alice?.shutdown().catch(() => {});
+  await rig.bob?.shutdown().catch(() => {});
+  try { rig.bobServerStop?.(); } catch { /* already gone */ }
+  try { rig.aliceServerStop?.(); } catch { /* already gone */ }
+  try { rig.prekeyStop?.(); } catch { /* already gone */ }
 }
 
 function hex(b: Uint8Array): string {

packages/shade-sdk/tests/webrtc-integration.test.ts

@@ -40,8 +40,12 @@ async function startPrekeyServer(): Promise<{ url: string; stop: () => void }> {
     disableRateLimit: true,
     events,
   });
-  const port = 22000 + Math.floor(Math.random() * 500);
+  // Port 0 lets the OS hand out a free one. This guessed inside a 500-wide
-  const handle = Bun.serve({ port, fetch: server.fetch });
+  // range and hoped — and several files here guessed inside the SAME range,
+  // so with test files serving in parallel the collision arrived about a
+  // quarter of the time as EADDRINUSE.
+  const handle = Bun.serve({ port: 0, fetch: server.fetch });
+  const port = handle.port;
   return { url: `http://localhost:${port}`, stop: () => handle.stop() };
 }
 
@@ -70,13 +74,21 @@ async function setupRig(): Promise<Rig> {
   bob.configureWebRTC({ factory, connectTimeoutMs: 10_000 });
 
   const bobApp = await bob.transferRoute();
-  const bobPort = 22500 + Math.floor(Math.random() * 500);
+  // Port 0 lets the OS hand out a free one. This guessed inside a 500-wide
-  const bobServer = Bun.serve({ port: bobPort, fetch: bobApp.fetch });
+  // range and hoped — and several files here guessed inside the SAME range,
+  // so with test files serving in parallel the collision arrived about a
+  // quarter of the time as EADDRINUSE.
+  const bobServer = Bun.serve({ port: 0, fetch: bobApp.fetch });
+  const bobPort = bobServer.port;
   const bobBaseUrl = `http://localhost:${bobPort}`;
 
   const aliceApp = await alice.transferRoute();
-  const alicePort = 22000 + Math.floor(Math.random() * 500);
+  // Port 0 lets the OS hand out a free one. This guessed inside a 500-wide
-  const aliceServer = Bun.serve({ port: alicePort, fetch: aliceApp.fetch });
+  // range and hoped — and several files here guessed inside the SAME range,
+  // so with test files serving in parallel the collision arrived about a
+  // quarter of the time as EADDRINUSE.
+  const aliceServer = Bun.serve({ port: 0, fetch: aliceApp.fetch });
+  const alicePort = aliceServer.port;
   const aliceBaseUrl = `http://localhost:${alicePort}`;
 
   baseUrls.set('alice', aliceBaseUrl);

packages/shade-sdk/tests/webrtc-throughput.test.ts

@@ -44,8 +44,12 @@ async function startPrekeyServer(): Promise<{ url: string; stop: () => void }> {
     disableRateLimit: true,
     events,
   });
-  const port = 24500 + Math.floor(Math.random() * 500);
+  // Port 0 lets the OS hand out a free one. This guessed inside a 500-wide
-  const handle = Bun.serve({ port, fetch: server.fetch });
+  // range and hoped — and several files here guessed inside the SAME range,
+  // so with test files serving in parallel the collision arrived about a
+  // quarter of the time as EADDRINUSE.
+  const handle = Bun.serve({ port: 0, fetch: server.fetch });
+  const port = handle.port;
   return { url: `http://localhost:${port}`, stop: () => handle.stop() };
 }
 
@@ -70,13 +74,21 @@ async function setupRig(opts: { withWebRTC: boolean }): Promise<Rig> {
   }
 
   const bobApp = await bob.transferRoute();
-  const bobPort = 25000 + Math.floor(Math.random() * 500);
+  // Port 0 lets the OS hand out a free one. This guessed inside a 500-wide
-  const bobServer = Bun.serve({ port: bobPort, fetch: bobApp.fetch });
+  // range and hoped — and several files here guessed inside the SAME range,
+  // so with test files serving in parallel the collision arrived about a
+  // quarter of the time as EADDRINUSE.
+  const bobServer = Bun.serve({ port: 0, fetch: bobApp.fetch });
+  const bobPort = bobServer.port;
   baseUrls.set('bob', `http://localhost:${bobPort}`);
 
   const aliceApp = await alice.transferRoute();
-  const alicePort = 25500 + Math.floor(Math.random() * 500);
+  // Port 0 lets the OS hand out a free one. This guessed inside a 500-wide
-  const aliceServer = Bun.serve({ port: alicePort, fetch: aliceApp.fetch });
+  // range and hoped — and several files here guessed inside the SAME range,
+  // so with test files serving in parallel the collision arrived about a
+  // quarter of the time as EADDRINUSE.
+  const aliceServer = Bun.serve({ port: 0, fetch: aliceApp.fetch });
+  const alicePort = aliceServer.port;
   baseUrls.set('alice', `http://localhost:${alicePort}`);
 
   return {

packages/shade-server/Dockerfile

@@ -9,10 +9,15 @@ COPY package.json bun.lock tsconfig.json ./
 # Copy all packages the server + observer + dashboard need
 COPY packages ./packages
 
-RUN bun install --frozen-lockfile
+# BuildKit gives each RUN a 1024 soft file-descriptor limit while the hard
+# limit is ~1M. bun extracts tarballs in parallel, so a large package can
+# exhaust the descriptors and the install dies with "Fail extracting tarball"
+# — reproducible in a build, invisible outside one because `docker run`
+# inherits a far higher limit. Raise the soft limit to what the host allows.
+RUN ulimit -n "$(ulimit -Hn)" && bun install --frozen-lockfile
 
 # Build the dashboard SPA → dist/, then copy to observer's dist/
-RUN cd packages/shade-dashboard && bun run build
+RUN ulimit -n "$(ulimit -Hn)" && cd packages/shade-dashboard && bun run build
 
 # ─── Production stage ───────────────────────────────────────
 FROM oven/bun:1-alpine

packages/shade-transfer/src/engine.ts

@@ -451,7 +451,7 @@ export class TransferEngine {
       for (const q of queues.values()) q.abort(err);
       throw err;
     }
-    await Promise.all(workers);
+    await settleWorkers(workers);
   }
 
   private async runRoundRobinUploadResumed(
@@ -518,7 +518,7 @@ export class TransferEngine {
       for (const q of queues.values()) q.abort(err);
       throw err;
     }
-    await Promise.all(workers);
+    await settleWorkers(workers);
   }
 
   /**
@@ -774,7 +774,7 @@ export class TransferEngine {
       for (const q of queues.values()) q.abort(err);
       throw err;
     }
-    await Promise.all(workers);
+    await settleWorkers(workers);
   }
 
   private async runRoundRobinUpload(state: OutgoingState): Promise<void> {
@@ -851,7 +851,7 @@ export class TransferEngine {
       for (const q of queues.values()) q.abort(err);
       throw err;
     }
-    await Promise.all(workers);
+    await settleWorkers(workers);
   }
 
   private async runLaneWorker(
@@ -1596,3 +1596,25 @@ function snapshotIncomingLanes(
   }
   return out;
 }
+
+/**
+ * Wait for every lane worker, then report the first real failure.
+ *
+ * `Promise.all` rejects the moment one worker throws and leaves the others
+ * running with nobody holding their rejections — so an abort, which fails
+ * every lane at once, produces one propagated error and N-1 unhandled ones.
+ * Bun counts an unhandled rejection as a test failure, which is how the resume
+ * test failed roughly one run in fourteen on 08.09.2026 with a
+ * `TransferAbortError` the test had already caught through the handle.
+ *
+ * An abort is not the interesting failure when a real one is present, so a
+ * genuine error is preferred over `TransferAbortError` when both occurred.
+ */
+async function settleWorkers(workers: Promise<unknown>[]): Promise<void> {
+  const results = await Promise.allSettled(workers);
+  const errors = results
+    .filter((r): r is PromiseRejectedResult => r.status === 'rejected')
+    .map((r) => r.reason);
+  if (errors.length === 0) return;
+  throw errors.find((e) => !(e instanceof TransferAbortError)) ?? errors[0];
+}

packages/shade-transfer/tests/resume.test.ts

@@ -41,8 +41,12 @@ describe('Resume protocol — kill-restart-verify', () => {
       myAddress: 'bob',
     });
     const receiverApp = await createTransferRoutes(receiverEngine);
-    const port = 22000 + Math.floor(Math.random() * 500);
+    // Port 0 lets the OS hand out a free one. This guessed inside a 500-wide
-    const server = Bun.serve({ port, fetch: receiverApp.fetch });
+    // range and hoped — and several files here guessed inside the SAME range,
+    // so with test files serving in parallel the collision arrived about a
+    // quarter of the time as EADDRINUSE.
+    const server = Bun.serve({ port: 0, fetch: receiverApp.fetch });
+    const port = server.port;
     const baseUrl = `http://localhost:${port}`;
 
     // Receiver accepts incoming.

packages/shade-transfer/tests/ws-fallback.test.ts

@@ -39,8 +39,12 @@ describe('WS opt-in transport with HTTP fallback', () => {
       myAddress: 'bob',
     });
     const httpApp = await createTransferRoutes(receiverEngine);
-    const httpPort = 23000 + Math.floor(Math.random() * 500);
+    // Port 0 lets the OS hand out a free one. This guessed inside a 500-wide
-    const httpServer = Bun.serve({ port: httpPort, fetch: httpApp.fetch });
+    // range and hoped — and several files here guessed inside the SAME range,
+    // so with test files serving in parallel the collision arrived about a
+    // quarter of the time as EADDRINUSE.
+    const httpServer = Bun.serve({ port: 0, fetch: httpApp.fetch });
+    const httpPort = httpServer.port;
     const httpBaseUrl = `http://localhost:${httpPort}`;
     cleanups.push(() => httpServer.stop());
 

packages/shade-transport/tests/kt-transport.test.ts

@@ -31,8 +31,12 @@ describe('ShadeFetchTransport with KT verifier', () => {
       },
     });
 
-    const port = 20100 + Math.floor(Math.random() * 500);
+    // Port 0 lets the OS hand out a free one. This guessed inside a 500-wide
-    const handle = Bun.serve({ port, fetch: app.fetch });
+    // range and hoped — and several files here guessed inside the SAME range,
+    // so with test files serving in parallel the collision arrived about a
+    // quarter of the time as EADDRINUSE.
+    const handle = Bun.serve({ port: 0, fetch: app.fetch });
+    const port = handle.port;
     try {
       const baseUrl = `http://localhost:${port}`;
 

packages/shade-vault/live-e2e.ts

@@ -2,7 +2,7 @@
  * Full backup mot en KJØRENDE vault — ikke Hono-fetch, men ekte HTTP.
  *
  * Kjøres manuelt mot en container eller en deployet tjeneste:
- *   SCAFFOLDD_SOCKET=... RELAY=https://vault.zyon.no bun live-e2e.ts
+ *   SCAFFOLDD_SOCKET=... RELAY=https://scaffold.zyon.no bun live-e2e.ts
  */
 import { connect } from 'node:net';
 import { readFile } from 'node:fs/promises';