@@ -27,6 +27,9 @@ jobs:
 
   tests-and-type-check:
     runs-on: ubuntu-latest
+    # A wedged runner must fail in bounded time: with every kernel start
+    # timing out, the session tests alone would otherwise grind for hours.
+    timeout-minutes: 45
     name: tests-and-type-check (${{ matrix.python-version }}, shard ${{ matrix.shard }})
     strategy:
       matrix:
@@ -56,10 +59,12 @@ jobs:
         env:
           # A kernel start on this runner (2 vCPUs, two xdist workers each
           # spawning kernels, coverage tracing on 3.11) can take well over the
-          # 30 s library default. A start that needs more than this is a broken
-          # runner and should fail loudly — the error explains which phase
-          # timed out — rather than be retried.
-          DOCX_SESSION_START_TIMEOUT: "120"
+          # 30 s library default. Doubling covers that; going higher only
+          # multiplies the wall time of a broken runner, where every start in
+          # the module times out in sequence. A start that needs more than
+          # this should fail loudly — the error explains which phase timed
+          # out — rather than be retried.
+          DOCX_EDITOR_SESSION_START_TIMEOUT: "60"
         run: >-
           uv run python -m pytest tests -n auto
           --splits 2 --group ${{ matrix.shard }}
 
@@ -12,6 +12,7 @@
 import argparse
 import ast
 import json
+import math
 import os
 import re
 import signal
@@ -36,7 +37,7 @@
 # loaded machine (a 2-vCPU CI runner with parallel test workers, coverage
 # tracing on) that import alone can take longer than the unloaded 30 s default.
 DEFAULT_START_TIMEOUT = 30.0
-START_TIMEOUT_ENV = "DOCX_SESSION_START_TIMEOUT"
+START_TIMEOUT_ENV = "DOCX_EDITOR_SESSION_START_TIMEOUT"
 
 # How the kernel is launched. Tests substitute a stand-in kernel here to
 # exercise the start-failure paths deterministically; the "-f <file>" argument
@@ -147,7 +148,7 @@ def _read_pid(connection_file: Path) -> int | None:
 
 
 def _start_timeout() -> float:
-    """start_session's budget: DOCX_SESSION_START_TIMEOUT, else the 30 s default.
+    """start_session's budget: DOCX_EDITOR_SESSION_START_TIMEOUT, else the 30 s default.
 
     Raises:
         SessionError: If the variable is set to anything but a positive number.
@@ -157,16 +158,21 @@ def _start_timeout() -> float:
         return DEFAULT_START_TIMEOUT
     try:
         value = float(raw)
-        if not value > 0:  # also rejects nan
+        if not (math.isfinite(value) and value > 0):  # rejects nan and inf too
             raise ValueError
     except ValueError:
         raise SessionError(f"{START_TIMEOUT_ENV} must be a positive number of seconds, got {raw!r}") from None
     return value
 
 
-def _drain_stderr(proc: "subprocess.Popen[bytes]") -> str:
+def _drain_stderr(proc: subprocess.Popen[bytes]) -> str:
     """Tail of what a (killed and reaped) kernel wrote to stderr, without blocking.
 
+    Invariant: nothing may read ``proc.stderr`` before this runs — the raw-fd
+    read below bypasses the ``BufferedReader``, so any bytes already buffered
+    there would be silently dropped. (Today the only other reader, the
+    exited-during-startup path, always raises without reaching ``_abort``.)
+
     The pipe is switched to non-blocking first: every writer is dead, so the
     read hits EOF at once — but if a grandchild ever inherited the write end,
     EAGAIN ends the loop instead of hanging a diagnostic that exists to explain
@@ -221,7 +227,7 @@ def start_session(connection_file: Path = DEFAULT_CONNECTION_FILE, timeout: floa
     Args:
         connection_file: Where to write the kernel connection file
         timeout: Seconds to wait for the kernel to become ready. ``None`` (the
-            default) reads ``DOCX_SESSION_START_TIMEOUT`` and falls back to
+            default) reads ``DOCX_EDITOR_SESSION_START_TIMEOUT`` and falls back to
             30 s when it is unset or blank; an explicit argument always wins.
             The variable exists for loaded machines — CI runners, parallel
             test workers — where a fresh interpreter importing IPython takes
@@ -234,7 +240,7 @@ def start_session(connection_file: Path = DEFAULT_CONNECTION_FILE, timeout: floa
     Raises:
         SessionError: If a session is already running, the kernel fails to
             start, the connection file it wrote is unreadable, or
-            ``DOCX_SESSION_START_TIMEOUT`` is not a positive number.
+            ``DOCX_EDITOR_SESSION_START_TIMEOUT`` is not a positive number.
             A start that runs out of budget explains itself: which phase
             timed out (connection file vs. control-channel reply), whether
             the kernel was still alive, the load average, what it wrote to
@@ -298,7 +304,6 @@ def _abort(summary: str) -> SessionError:
             )
         time.sleep(0.1)
     t_file = time.monotonic() - t0
-    remaining = max(1.0, deadline - time.monotonic())
 
     kc = None
     try:
@@ -309,6 +314,7 @@ def _abort(summary: str) -> SessionError:
             kc = _client(connection_file)
         except (ValueError, OSError) as e:
             raise SessionError(f"Kernel wrote an unreadable connection file ({connection_file}): {e}") from e
+        remaining = max(1.0, deadline - time.monotonic())
         if not _kernel_alive(kc, timeout=remaining):
             raise _abort(
                 f"Kernel did not become ready within {timeout}s: kernel.json appeared after {t_file:.1f}s, "
 
@@ -1176,7 +1176,7 @@ scripts. The document (and all your variables) stays open between commands:
 ```bash
 # Requires: pip install "docx-editor[session]"
 docx-session start
-# On a loaded machine (CI, parallel workers) set DOCX_SESSION_START_TIMEOUT=120
+# On a loaded machine (CI, parallel workers) set DOCX_EDITOR_SESSION_START_TIMEOUT=60
 # to raise the 30 s budget `start` gives the kernel to answer.
 
 # Use ABSOLUTE paths: the kernel keeps the cwd it was started in, which is not
 
@@ -180,10 +180,12 @@ def counting(root, tags, **kwargs):
 def _connection_file_from_argv(args) -> Path | None:
     """Return the ``-f <path>`` of an ipykernel_launcher command line, else None.
 
-    ``start_session`` always spawns the kernel as
+    ``start_session`` spawns the kernel as
     ``[python, "-m", "ipykernel_launcher", "-f", <connection file>]``, so the
     connection file can be recovered from the argv alone — no cooperation from
-    the code under test required.
+    the code under test required. Tests that substitute a stand-in kernel (via
+    ``session_mod._KERNEL_COMMAND`` or a fake ``subprocess``) are invisible to
+    this reaper and must reap their own processes.
 
     The path is resolved eagerly: cwd is correct now, but two tests chdir
     (``test_workspace.py``, ``test_document.py``), so a relative path stored
 
@@ -42,8 +42,11 @@
 )
 from docx_editor.workspace import _pid_alive  # noqa: E402
 
-# Every wait in this module is bounded by the kernel start budget, so a loaded
-# machine raises them all through DOCX_SESSION_START_TIMEOUT (CI sets 120).
+# Start waits and busy-kernel handshakes in this module are bounded by the
+# kernel start budget, so a loaded machine raises them all through
+# DOCX_EDITOR_SESSION_START_TIMEOUT (CI sets 60). A few fixed windows remain
+# where the tested behaviour is itself wall-clock (the 10 s silence probe in
+# TestKernelDeath, the stdin and silent-exec bounds).
 START_BUDGET = _start_timeout()
 # For the one behaviour that is inherently wall-clock — "my own code overran":
 # an idle kernel must dequeue a request within this long. 2 s locally, 12 s on CI.
@@ -395,7 +398,11 @@ def test_request_discarded_behind_a_raising_command(tmp_path):
             assert res.started is False  # the tell: never dequeued
             assert res.stdout == ""
 
-            _wait_for_reply(hog)  # the failing command is done; the kernel is idle
+            # The reply lands just before ipykernel's post-error abort turn
+            # (_abort_queues, one event-loop turn at the default
+            # stop_on_error_timeout of 0); the eval below builds a fresh
+            # client first, which comfortably outlasts it.
+            _wait_for_reply(hog)  # the failing command is done
         assert eval_code("globals().get('discarded')", connection_file=conn).value is None
     finally:
         stop_session(conn)
@@ -970,7 +977,9 @@ def test_stop_session_honours_the_shutdown_ack(tmp_path, monkeypatch):
     real_kill = os.kill
 
     def spying_kill(target: int, sig: int) -> None:
-        if sig != 0:  # _pid_alive probes with signal 0; only real signals count
+        # _pid_alive probes with signal 0, and unrelated components may signal
+        # other pids; only real signals aimed at this kernel count.
+        if sig != 0 and target == pid:
             signalled.append((target, sig))
         real_kill(target, sig)
 
@@ -1053,6 +1062,14 @@ def test_module_entrypoint_runs():
 """
 
 
+def _assert_reported_kernel_dead(report: str) -> None:
+    """The stand-in kernel's argv has no ``ipykernel_launcher``, so conftest's
+    reaper cannot see it: every test must prove ``_abort`` killed it."""
+    pid_match = re.search(r"Kernel pid (\d+)", report)
+    assert pid_match is not None, report
+    assert not _pid_alive(int(pid_match.group(1)), reap=True)
+
+
 class TestStartFailureDiagnosis:
     """A start that exhausts its budget must say why, and the budget must be
     tunable for loaded machines (ROADMAP.md #72).
@@ -1083,21 +1100,21 @@ def test_start_timeout_explains_itself(self, tmp_path, fake_kernel):
         # Nothing left behind: no state files, and the fake is dead.
         assert not conn.exists()
         assert not conn.with_suffix(".pid").exists()
-        pid_match = re.search(r"Kernel pid (\d+)", message)
-        assert pid_match is not None, message
-        assert not _pid_alive(int(pid_match.group(1)), reap=True)
+        _assert_reported_kernel_dead(message)
 
     def test_start_budget_comes_from_env(self, tmp_path, fake_kernel, monkeypatch):
         monkeypatch.setenv(START_TIMEOUT_ENV, "2")
-        with pytest.raises(SessionError, match="did not become ready within 2.0s"):
+        with pytest.raises(SessionError, match="did not become ready within 2.0s") as excinfo:
             start_session(tmp_path / "kernel.json")
+        _assert_reported_kernel_dead(str(excinfo.value))
 
     def test_explicit_timeout_beats_env(self, tmp_path, fake_kernel, monkeypatch):
         monkeypatch.setenv(START_TIMEOUT_ENV, "2")
-        with pytest.raises(SessionError, match="did not become ready within 1.0s"):
+        with pytest.raises(SessionError, match="did not become ready within 1.0s") as excinfo:
             start_session(tmp_path / "kernel.json", timeout=1.0)
+        _assert_reported_kernel_dead(str(excinfo.value))
 
-    @pytest.mark.parametrize("value", ["soon", "0", "-5", "nan"])
+    @pytest.mark.parametrize("value", ["soon", "0", "-5", "nan", "inf"])
     def test_invalid_start_budget_raises(self, tmp_path, monkeypatch, value):
         monkeypatch.setenv(START_TIMEOUT_ENV, value)
         # Were a kernel spawned anyway, this exits at once with a distinct error.
@@ -1123,6 +1140,7 @@ def test_main_start_prints_the_diagnosis(self, tmp_path, fake_kernel, monkeypatc
         assert "did not become ready within 2.0s" in err
         assert "fake kernel: sockets bound, never served" in err
         assert START_TIMEOUT_ENV in err
+        _assert_reported_kernel_dead(err)
 
 
 class TestKernelReaping: