@@ -25,7 +25,7 @@ DATABASE_URL=postgresql://gitlawb:changeme@localhost:5432/gitlawb
 # Maximum connections in the PostgreSQL pool. A cap, not a floor —
 # connections open lazily. Size against the DB server's max_connections,
 # remembering admin tooling opens its own pool.
-GITLAWB_DB_MAX_CONNECTIONS=20
+GITLAWB_DB_MAX_CONNECTIONS=48
 # Maximum connections in the DEDICATED advisory-lock pool, separate from the
 # pool above. Every in-flight repo write pins one connection here for its whole
 # duration, so this is a hard ceiling on simultaneous writes node-wide: size it
 
@@ -3149,8 +3149,8 @@ pub async fn fork_repo(
     // archive already sits under this key (a failed create_repo or another
     // writer), and proceeding would create a DB record whose archive is shadowed
     // by bytes that are not this fork. Refuse rather than accept a fork other
-    // nodes would fetch as unrelated content. The local clone is cleaned up on
-    // this path by the caller's error return dropping the handler state.
+    // nodes would fetch as unrelated content. Remove the local mirror clone so
+    // a refused fork does not leave a bare repo on disk.
     state
         .repo_store
         .release_after_write(&forker_did, &fork_name)
@@ -3163,6 +3163,13 @@ pub async fn fork_repo(
                     status,
                     "fork refused: an archive already exists under the fork's key"
                 );
+                if let Err(clean) = std::fs::remove_dir_all(&disk_path) {
+                    tracing::warn!(
+                        path = %disk_path.display(),
+                        err = %clean,
+                        "failed to remove fork clone after precondition loss"
+                    );
+                }
                 AppError::RepoExists(fork_name.clone())
             }
             other => AppError::Git(format!("fork upload failed: {other}")),
@@ -6402,7 +6409,7 @@ mod tests {
                     State(state.clone()),
                     Path((owner.to_string(), name.to_string())),
                     Extension(crate::auth::AuthenticatedDid(
-                        "did:key:z6MkDisconnectWriteLockProofDidAAAAAAAA".to_string(),
+                        "did:key:z6disc".to_string(),
                     )),
                     crate::rate_limit::PeerAddr(Some(
                         "203.0.113.81:5000".parse::<SocketAddr>().unwrap(),
@@ -6554,7 +6561,7 @@ mod tests {
                     State(state.clone()),
                     Path((owner.to_string(), name.to_string())),
                     Extension(crate::auth::AuthenticatedDid(
-                        "did:key:z6MkPushSuccessReleaseProofDidAAAAAAAA".to_string(),
+                        "did:key:z6succ".to_string(),
                     )),
                     crate::rate_limit::PeerAddr(Some(
                         "203.0.113.83:5000".parse::<SocketAddr>().unwrap(),
@@ -6630,7 +6637,7 @@ mod tests {
             .await
             .unwrap();
 
-        let did = "did:key:z6MkLockPoolShedProofDidAAAAAAAAAAAAAAAAAA";
+        let did = "did:key:z6lockpool";
         let peer: SocketAddr = "203.0.113.71:5000".parse().unwrap();
 
         // Occupy the only lock-pool connection with a write on an UNRELATED repo.
@@ -6657,7 +6664,7 @@ mod tests {
 
         // MUST-NOT: with the pool free again, the push is not shed as capacity (it fails
         // later on the nonexistent on-disk repo, which is a git error, not Overloaded).
-        held.release(false).await;
+        let _ = held.release(false).await;
         let admitted = git_receive_pack(
             State(state.clone()),
             Path((owner.to_string(), name.to_string())),
 
@@ -47,6 +47,10 @@ pub struct RepoStore {
     /// `RepoWriteGuard::test_pre_unlock_gate`. Never set outside tests.
     #[cfg(test)]
     pre_unlock_gate: Option<Arc<tokio::sync::Notify>>,
+    /// Per store rather than a process global, so parallel tests do not see each
+    /// other's uploads. See [`RepoStore::tigris_upload_site_reached`].
+    #[cfg(test)]
+    upload_site_reached: Arc<std::sync::atomic::AtomicUsize>,
 }
 
 impl RepoStore {
@@ -60,6 +64,7 @@ impl RepoStore {
             lock_acquire_deadline: LOCK_ACQUIRE_DEADLINE,
             migrated: Arc::new(tokio::sync::Mutex::new(std::collections::HashSet::new())),
             pre_unlock_gate: None,
+            upload_site_reached: Arc::new(std::sync::atomic::AtomicUsize::new(0)),
         }
     }
 
@@ -91,6 +96,14 @@ impl RepoStore {
         self
     }
 
+    /// Test-only: how many write guards from this store have reached the Tigris upload
+    /// site. See [`RepoWriteGuard::release`].
+    #[cfg(test)]
+    pub fn tigris_upload_site_reached(&self) -> usize {
+        self.upload_site_reached
+            .load(std::sync::atomic::Ordering::SeqCst)
+    }
+
     pub fn new(
         repos_dir: PathBuf,
         tigris: Option<TigrisClient>,
@@ -106,6 +119,8 @@ impl RepoStore {
             migrated: Arc::new(Mutex::new(HashSet::new())),
             #[cfg(test)]
             pre_unlock_gate: None,
+            #[cfg(test)]
+            upload_site_reached: Arc::new(std::sync::atomic::AtomicUsize::new(0)),
         }
     }
 
@@ -448,6 +463,8 @@ impl RepoStore {
             publish_fence: UploadPrecondition::Unconditional,
             #[cfg(test)]
             test_pre_unlock_gate: self.pre_unlock_gate.clone(),
+            #[cfg(test)]
+            upload_site_reached: Arc::clone(&self.upload_site_reached),
         };
 
         // Always download the latest from Tigris before writing. Local disk may be
@@ -1040,6 +1057,8 @@ pub struct RepoWriteGuard {
     /// frees the session lock. Never set outside tests.
     #[cfg(test)]
     test_pre_unlock_gate: Option<Arc<tokio::sync::Notify>>,
+    #[cfg(test)]
+    upload_site_reached: Arc<std::sync::atomic::AtomicUsize>,
 }
 
 impl RepoWriteGuard {
@@ -1150,6 +1169,9 @@ impl RepoWriteGuard {
         let mut outcome = ReleaseOutcome::Released;
         // Upload to Tigris only on success.
         if success {
+            #[cfg(test)]
+            self.upload_site_reached
+                .fetch_add(1, std::sync::atomic::Ordering::SeqCst);
             if let Some(tigris) = self.tigris.clone() {
                 // ONE budget for the whole publish, covering both attempts and
                 // the HEAD between them, for the same reason the acquire-side
@@ -2489,6 +2511,8 @@ mod tests {
             publish_fence: UploadPrecondition::Unconditional,
             #[cfg(test)]
             test_pre_unlock_gate: None,
+            #[cfg(test)]
+            upload_site_reached: Arc::new(std::sync::atomic::AtomicUsize::new(0)),
         };
         // Must complete without panic and issue no unlock.
         let _ = guard.release(false).await;
@@ -2851,6 +2875,8 @@ mod tests {
             publish_fence: UploadPrecondition::Unconditional,
             #[cfg(test)]
             test_pre_unlock_gate: None,
+            #[cfg(test)]
+            upload_site_reached: Arc::new(std::sync::atomic::AtomicUsize::new(0)),
         };
         let _ = guard.release(true).await;
 
 
@@ -271,10 +271,8 @@ impl TigrisClient {
             .into_bytes();
 
         // The snapshot temp dir is decided HERE, in the async layer, before the
-        // extraction runs. The extraction itself is uncancellable spawn_blocking,
-        // so the dir is created no matter what happens to this future; an
-        // async-layer guard that owns the path removes it when this future is
-        // dropped mid-await (client disconnect, a bounded-transfer timeout).
+        // extraction runs. Cleanup ownership moves into the blocking task so a
+        // cancelled async future cannot drop it while extraction is still running.
         let snapshot_tmp = if publish {
             None
         } else {
@@ -289,48 +287,48 @@ impl TigrisClient {
                 uuid::Uuid::new_v4()
             )))
         };
-        // Armed before the extraction await; disarmed on the success return via
-        // `mem::forget`, leaving the dir to the caller (RepoSnapshot::drop). On
-        // any other exit, including a cancelled future, the guard removes the
-        // dir. This is what closes the leak where a dropped read_snapshot future
-        // abandons a completed extraction.
-        let _cleanup = snapshot_tmp.as_ref().map(|p| SnapshotCleanup(p.clone()));
 
         // Extract tar.zst to a directory.
         let extracted = tokio::task::spawn_blocking({
             let target = target.to_path_buf();
             let snapshot_tmp = snapshot_tmp.clone();
             move || -> Result<PathBuf> {
-                if publish {
-                    decompress_repo(&data, &target)?;
-                    return Ok(target);
-                }
-                // Non-mutating snapshot: unpack into the temp dir decided above.
-                // The live repo path is never touched.
-                let tmp_dir = snapshot_tmp.expect("snapshot path was decided above");
-                std::fs::create_dir_all(&tmp_dir).context("creating temp extract dir")?;
-                let unpack = (|| -> Result<()> {
-                    let decoder = zstd::stream::Decoder::new(&data[..])?;
-                    let mut archive = tar::Archive::new(decoder);
-                    archive.unpack(&tmp_dir).context("unpacking tar.zst")?;
-                    Ok(())
+                // Armed for the whole blocking extraction; disarmed on success via
+                // `mem::forget`, leaving the dir to the caller (RepoSnapshot::drop).
+                let cleanup = snapshot_tmp.as_ref().map(|p| SnapshotCleanup(p.clone()));
+                let result = (|| -> Result<PathBuf> {
+                    if publish {
+                        decompress_repo(&data, &target)?;
+                        return Ok(target);
+                    }
+                    // Non-mutating snapshot: unpack into the temp dir decided above.
+                    // The live repo path is never touched.
+                    let tmp_dir = snapshot_tmp.expect("snapshot path was decided above");
+                    std::fs::create_dir_all(&tmp_dir).context("creating temp extract dir")?;
+                    let unpack = (|| -> Result<()> {
+                        let decoder = zstd::stream::Decoder::new(&data[..])?;
+                        let mut archive = tar::Archive::new(decoder);
+                        archive.unpack(&tmp_dir).context("unpacking tar.zst")?;
+                        Ok(())
+                    })();
+                    if let Err(e) = unpack {
+                        let _ = std::fs::remove_dir_all(&tmp_dir);
+                        return Err(e);
+                    }
+                    Ok(tmp_dir)
                 })();
-                if let Err(e) = unpack {
-                    let _ = std::fs::remove_dir_all(&tmp_dir);
-                    return Err(e);
+                if result.is_ok() {
+                    if let Some(guard) = cleanup {
+                        std::mem::forget(guard);
+                    }
                 }
-                Ok(tmp_dir)
+                result
             }
         })
         .await
         .context("extract task panicked")?
         .context("extracting repo")?;
 
-        // The dir is now the caller's to own: drop the cleanup guard without
-        // removing anything. On a future drop before this point, `_cleanup` runs
-        // and removes the dir even though the extraction completed.
-        std::mem::forget(_cleanup);
-
         info!(key = %key, path = %target.display(), "downloaded repo from tigris");
         Ok(extracted)
     }