the snippet already uses retain on failure so that part's fine, the real trap is people copy it into a CI config with retries and end up on on first retry by default which just means you're looking at the trace from the run that passed. for bigger suites retain on first failure is honestly the better move since you keep attempt zero without tracing every single retry. page.clock catches a timer firing in the page but it does nothing for cookie expiry or the IdP's own session record, so don't go shortening a production TTL just to make that testable, use a fixture or the IdP for invalidation instead. I'd also add a storagestate file thats gone stale across a long shard and an account getting hammered by parallel workers while refresh tokens rotate under it, though honestly those catch setup reuse bugs not the actual open form migration the article's talking about. when you diff attempt zero against the retry just log token version and a hashed credential fingerprint as their own fields and keep the session id down to a redacted correlation key
the snippet already uses retain on failure so that part's fine, the real trap is people copy it into a CI config with retries and end up on on first retry by default which just means you're looking at the trace from the run that passed. for bigger suites retain on first failure is honestly the better move since you keep attempt zero without tracing every single retry. page.clock catches a timer firing in the page but it does nothing for cookie expiry or the IdP's own session record, so don't go shortening a production TTL just to make that testable, use a fixture or the IdP for invalidation instead. I'd also add a storagestate file thats gone stale across a long shard and an account getting hammered by parallel workers while refresh tokens rotate under it, though honestly those catch setup reuse bugs not the actual open form migration the article's talking about. when you diff attempt zero against the retry just log token version and a hashed credential fingerprint as their own fields and keep the session id down to a redacted correlation key