Run at most 4 tests of a package at once in the test phase (closes #224)

On a busy host, TestService_Get_ReturnsByItsDeadline failed because its
request returned over a second after its 200 ms deadline. The request
does not ignore its deadline: with as many tests running at once in the
package's test process as the host has CPUs, it waited to be scheduled,
or for SQLite calls queued on a lock inside the SQLite library that
every database in the process shares. The test phase now passes
-parallel 4 to go test. -p is unchanged: capping it also caps
compiling, which made the step much slower.

Model: opus-5-5

Dockerfile

@@ -32,10 +32,14 @@ RUN script/bootstrap --cgo
 COPY . .
 
 # Without -v first; on a failure, again with -v for the details, and
-# the step fails even if the second run passes.
-RUN go test -count=1 -timeout 90s -race -cover ./... || \
+# the step fails even if the second run passes. -parallel 4: by default
+# a package runs as many of its tests at once as the host has CPUs. On
+# a busy host they then wait to be scheduled, and their SQLite calls
+# queue on one lock that every database in the test process shares, so
+# a test that times a request can see it return a second late.
+RUN go test -count=1 -timeout 90s -race -parallel 4 -cover ./... || \
     { echo "--- Rerunning with -v for details ---"; \
-      go test -count=1 -timeout 90s -race -v ./...; exit 1; }
+      go test -count=1 -timeout 90s -race -parallel 4 -v ./...; exit 1; }
 
 # Build stage. Nothing is wanted from the two phases above: these copies
 # make BuildKit build them first, so this stage runs only when lint and

TODO.md

@@ -30,6 +30,14 @@ P2: security: per-IP rate limiting on the image routes
 
 # Completed Steps
 
+- 2026-10-08 the test phase of the `Dockerfile` runs at most 4 tests of a
+  package at once (`go test -parallel 4`, closes #224), where it ran as many as
+  the host has CPUs. On a busy host, `TestService_Get_ReturnsByItsDeadline`
+  failed because its request returned over a second after its deadline: the
+  request was waiting to be scheduled, or for SQLite calls queued on a lock
+  inside the SQLite library that every database in the test process shares.
+  `-p`, how many packages are tested at once, is unchanged, as capping it also
+  slows compiling.
 - 2026-10-08 every output format is saved with settings pixa sets on purpose
   (closes #232): each format has its own govips export, as JPEG XL does, in
   place of govips' generic `Export`, which sent libvips a zero for some settings