fix(ci): give the scripts test suite the shared-ECS timeout ceiling (#10853)

scripts/tests/install-script.test.js

@@ -60,8 +60,6 @@ if (process.env.CI && process.platform !== 'win32' && !zipAvailable) {
 const itWithZip = zipAvailable ? it : it.skip;
 const itOnUnixWithZip = zipAvailable ? itOnUnix : it.skip;
 
-vi.setConfig({ testTimeout: 30_000 });
-
 describe('installation scripts', () => {
   it('keeps the Linux/macOS installer lightweight', () => {
     const script = readScript(

scripts/tests/qwen-autofix-workflow.test.js

@@ -2064,7 +2064,7 @@ describe('qwen-autofix workflow', () => {
         head: H,
       }).stale,
     ).toBe(false);
-  }, 30000);
+  });
 
   it('behaviorally replays the eligibility recheck across lifecycle and label states', () => {
     // Extract the recheck VERBATIM (drift fails the test) and run it with a
@@ -12643,7 +12643,7 @@ exit 1
       /then\n\s+echo "📊 milestone digest posted/,
     );
     expect(pushAndReportStep).toContain('milestone digest failed to post');
-  }, 30000);
+  });
 
   it('salvages a race-lost push by merging the moved head instead of discarding the run', () => {
     // A one-shot push dies `fetch first` whenever anything pushes to the PR
@@ -13674,7 +13674,7 @@ exit 1
     const fuzz = run(crossWorkspace, { enforce: 'terminate' });
     expect(fuzz.out).toContain('SURVIVED');
     expect(fuzz.advisory).toContain('outside the PR footprint');
-  }, 30000);
+  });
 
   it('upserts deferred findings into a per-PR issue that survives the merge', () => {
     // Wiring: the upsert runs after both shared resolve/reply call sites
@@ -17513,7 +17513,7 @@ exit 1
     expect(ciWorkflow).toContain(
       '.github/scripts/autofix-status-heartbeat.test.mjs',
     );
-  }, 30000);
+  });
 
   it('renders the whole managed fleet into the run summary', () => {
     // Diagnosing a stall used to mean listing bot PRs, regexing each one's eval
@@ -21277,7 +21277,7 @@ exit 0
       expect(runAddressReview(dir, stub).status).not.toBe(0);
       expect(existsSync(join(dir, 'agent-api-error'))).toBe(false);
     });
-  }, 30000);
+  });
 
   it('classifies permanent API failures terminal and records the cause class', () => {
     // A permanent 400 whose text happens to carry a 3-digit number in 500-599
@@ -23960,10 +23960,10 @@ describe('review verification gate: baseline A/B on deterministic rejection', ()
     expect(neutralized.stdout).toContain(';;error;;forged');
     expect(neutralized.stdout).not.toContain('::error::forged');
     // Eight runGate arms, each a fixture repo plus a full gate-script
-    // replay under bash — this outgrows the 5s default on slow runners
-    // (it timed out at ~6.4s on the PR head); the suite's convention is
-    // an explicit per-test budget for tests that spawn subprocesses.
-  }, 30000);
+    // replay under bash — this outgrows vitest's 5s default on slow
+    // runners (it timed out at ~6.4s on the PR head), so it runs on the
+    // suite ceiling in scripts/tests/vitest.config.ts.
+  });
 
   it('rejects a handoff written over a dirty workspace, non-retryably', () => {
     // A handoff claims the round deliberately changed NOTHING; dirt beside

scripts/tests/unit-vitest-configs.test.ts

@@ -4,7 +4,8 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { readFileSync } from 'node:fs';
+import { readdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { describe, expect, it, vi } from 'vitest';
 
@@ -227,8 +228,9 @@ describe('scripts suite timeout', () => {
     // 30s was the quiet-host figure. Release run 33725742855 lost its Quality
     // Checks (Scripts) job to two files at once — qwen-autofix-workflow, whose
     // heaviest case measures ~14s idle, and acp-serve-boundary-guard — neither
-    // slow, both past 30s under contention. A per-file `vi.setConfig` cannot
-    // fix it: these cases register their timeout at collection.
+    // slow, both past 30s under contention. A per-file `vi.setConfig` does
+    // outrank this config, but not the per-test budget the cases that timed out
+    // carry: that is registered at collection and beats both.
     for (const [stub, expected] of [
       [undefined, 90_000],
       ['5000', 5_000],
@@ -245,4 +247,30 @@ describe('scripts suite timeout', () => {
       vi.unstubAllEnvs();
     }
   });
+
+  it('leaves no file-level runtime override shadowing that ceiling', () => {
+    // The pin above re-imports the config module, so it cannot see an override
+    // a suite applies to itself: a runtime `setConfig` in a test file outranks
+    // the project config and holds that suite at its own number while this file
+    // reads green — install-script.test.js sat at 30s under the raised ceiling
+    // that way. Every argument shape does that, so the call itself is the
+    // violation; matching `testTimeout` inside the arguments let a parenthesized
+    // value ahead of it slip past. The walk takes every file here, not the
+    // include glob's extension list, so widening that list cannot leave the scan
+    // behind. Deliberate per-test budgets (`it(name, fn, ms)`) are out of scope:
+    // they are visible at the test they clamp, unlike a file-wide override.
+    const here = fileURLToPath(new URL('.', import.meta.url));
+    const shadowing = readdirSync(here, {
+      recursive: true,
+      withFileTypes: true,
+    })
+      .filter((entry) => entry.isFile())
+      .filter((entry) =>
+        /vi\.setConfig\(/.test(
+          readFileSync(join(entry.parentPath, entry.name), 'utf8'),
+        ),
+      )
+      .map((entry) => entry.name);
+    expect(shadowing).toEqual([]);
+  });
 });

scripts/tests/vitest.config.ts

@@ -39,8 +39,9 @@ export default defineConfig({
     // Quality Checks (Scripts) job to two files at once —
     // qwen-autofix-workflow.test.js, whose heaviest case measures ~14s idle,
     // and acp-serve-boundary-guard.test.js — neither of them slow, both past
-    // 30s under contention. Per-test `vi.setConfig` does not help: these
-    // cases register their timeout at collection, before it runs.
+    // 30s under contention. A per-file `vi.setConfig` does outrank this
+    // config, but not the per-test budget the cases that timed out carry: that
+    // is registered at collection and beats both.
     testTimeout: Number(process.env['QWEN_SCRIPTS_TEST_TIMEOUT_MS'] ?? 90_000),
     coverage: {
       provider: 'v8',