feat: harden self-managed reconciliation

tests/server/materialize.test.ts

@@ -26,6 +26,44 @@ function digest(data: Uint8Array | string): Sha256Digest {
 }
 
 describe("source materialization", () => {
+  test("bounds concurrent CAS reads while materializing many files", async () => {
+    const root = await mkdtemp(join(tmpdir(), "kuber-materialize-"));
+    roots.push(root);
+    const data = Buffer.from("x");
+    const blobDigest = digest(data);
+    const manifest: WorkspaceManifest = {
+      version: BUILD_PROTOCOL_VERSION,
+      files: Array.from({ length: 40 }, (_, index) => ({
+        path: `file-${String(index).padStart(2, "0")}`,
+        type: "file" as const,
+        digest: blobDigest,
+        size: data.byteLength,
+        mode: 0o644 as const,
+      })),
+    };
+    const manifestBytes = Buffer.from(JSON.stringify(manifest));
+    const workspace = digest(manifestBytes);
+    let inflight = 0;
+    let maxInflight = 0;
+    const read = async <T>(result: T): Promise<T> => {
+      inflight += 1;
+      maxInflight = Math.max(maxInflight, inflight);
+      await Bun.sleep(2);
+      inflight -= 1;
+      return result;
+    };
+    const cas = {
+      has: async () => read(true),
+      get: async (requested: Sha256Digest) =>
+        requested === workspace ? manifestBytes : read(data),
+    };
+
+    await materializeWorkspace(cas, workspace, join(root, "workspace"));
+
+    expect(maxInflight).toBeGreaterThan(1);
+    expect(maxInflight).toBeLessThanOrEqual(20);
+  });
+
   test("materializes files and safe symlinks with declared modes", async () => {
     const root = await mkdtemp(join(tmpdir(), "kuber-materialize-"));
     roots.push(root);