From 98f6552e219b32125e27b9c7683c049340693c69 Mon Sep 17 00:00:00 2001
From: imccyu <276526105+imccyu@users.noreply.github.com>
Date: Thu, 30 Jul 2026 20:24:58 +0800
Subject: [PATCH 01/11] Revert "ci: reduce coverage cocurrency"

This reverts commit ab30aca5cb859aea4bd0fffc88414270d1761f7d.
---
 .github/workflows/ci.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6d6a94d11f..d1440bd88b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -110,8 +110,8 @@ jobs:
       # across six always-on runner instances, and the timing-sensitive
       # process suites have documented aggregate-contention failures.
       # 8 × 6 instances = 48 workers worst case on 64 cores.
-      DSH_COVERAGE_MAX_WORKERS: ${{ vars.DSH_CI_FAILOVER == 'selfhosted' && github.event.pull_request.user.login != 'dependabot[bot]' && '8' || '8' }}
-      DSH_GATE_CONCURRENCY: '3'
+      DSH_COVERAGE_MAX_WORKERS: ${{ vars.DSH_CI_FAILOVER == 'selfhosted' && github.event.pull_request.user.login != 'dependabot[bot]' && '8' || '24' }}
+      DSH_GATE_CONCURRENCY: '8'
       NODE_OPTIONS: '--max-old-space-size=8192'
     steps:
       - uses: actions/checkout@v6

From e35e2a9f3ead2cc3b9e3aa2fcd1a15e8c668dad2 Mon Sep 17 00:00:00 2001
From: imccyu <276526105+imccyu@users.noreply.github.com>
Date: Thu, 30 Jul 2026 21:07:22 +0800
Subject: [PATCH 02/11] perf: tsc

---
 packages/typert/generator/src/analyzer.ts | 27 +++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/packages/typert/generator/src/analyzer.ts b/packages/typert/generator/src/analyzer.ts
index 1f545d9673..e0e04a4fa1 100644
--- a/packages/typert/generator/src/analyzer.ts
+++ b/packages/typert/generator/src/analyzer.ts
@@ -131,6 +131,26 @@ interface FaceProgramHost {
   readonly files: Map<string, ts.SourceFile | undefined>
 }
 
+/**
+ * Process-wide parse cache for the bundled TypeScript default libraries.
+ * `typescript/lib/lib.*.d.ts` content is immutable for the process lifetime,
+ * so parses are shared across every {@link WorkspaceCaches} instance; the key
+ * carries the parse-affecting settings, keeping reuse exact.
+ */
+const defaultLibraryParses = new Map<string, ts.SourceFile | undefined>()
+
+function defaultLibraryKey(fileName: string, languageVersionOrOptions: ts.ScriptTarget | ts.CreateSourceFileOptions): string {
+  const options = typeof languageVersionOrOptions === 'object'
+    ? languageVersionOrOptions
+    : { languageVersion: languageVersionOrOptions }
+  return [
+    fileName,
+    String(options.languageVersion),
+    String(options.impliedNodeFormat ?? ''),
+    String(options.jsDocParsingMode ?? ''),
+  ].join('\0')
+}
+
 /**
  * Shared memo over one immutable workspace snapshot. Passing one instance to
  * several analyzers (the batched and write-mode children reuse their parent's
@@ -185,6 +205,13 @@ export class WorkspaceCaches {
       // only fires under oldProgram reuse, which these fresh programs never
       // request, and invalidate() is the one supported re-read path.
       host.getSourceFile = (fileName, languageVersionOrOptions, onError) => {
+        if (isStandardLibraryFile(fileName)) {
+          const key = defaultLibraryKey(fileName, languageVersionOrOptions)
+          if (!defaultLibraryParses.has(key)) {
+            defaultLibraryParses.set(key, base(fileName, languageVersionOrOptions, onError))
+          }
+          return defaultLibraryParses.get(key)
+        }
         if (!files.has(fileName)) files.set(fileName, base(fileName, languageVersionOrOptions, onError))
         return files.get(fileName)
       }

From be0216102a145729543b872e6da91c5bbfab7d69 Mon Sep 17 00:00:00 2001
From: imccyu <276526105+imccyu@users.noreply.github.com>
Date: Thu, 30 Jul 2026 21:17:11 +0800
Subject: [PATCH 03/11] Reapply "ci: reduce coverage cocurrency"

This reverts commit a471ba79e30e6148e8c433b83fe0d7ee14a8312b.
---
 .github/workflows/ci.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d1440bd88b..6d6a94d11f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -110,8 +110,8 @@ jobs:
       # across six always-on runner instances, and the timing-sensitive
       # process suites have documented aggregate-contention failures.
       # 8 × 6 instances = 48 workers worst case on 64 cores.
-      DSH_COVERAGE_MAX_WORKERS: ${{ vars.DSH_CI_FAILOVER == 'selfhosted' && github.event.pull_request.user.login != 'dependabot[bot]' && '8' || '24' }}
-      DSH_GATE_CONCURRENCY: '8'
+      DSH_COVERAGE_MAX_WORKERS: ${{ vars.DSH_CI_FAILOVER == 'selfhosted' && github.event.pull_request.user.login != 'dependabot[bot]' && '8' || '8' }}
+      DSH_GATE_CONCURRENCY: '3'
       NODE_OPTIONS: '--max-old-space-size=8192'
     steps:
       - uses: actions/checkout@v6

From 56a8db2777ce002ead70f6f35d80cde9ccdbe60a Mon Sep 17 00:00:00 2001
From: imccyu <276526105+imccyu@users.noreply.github.com>
Date: Thu, 30 Jul 2026 21:31:27 +0800
Subject: [PATCH 04/11] ci: use 16c

16c
---
 .github/workflows/ci.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6d6a94d11f..1e999becdc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -50,7 +50,7 @@ jobs:
       ${{ vars.DSH_CI_FAILOVER == 'selfhosted'
           && github.event.pull_request.user.login != 'dependabot[bot]'
           && fromJSON('["self-hosted", "linux", "x64", "vm-backup"]')
-          || 'dsh-enterprise-ubuntu-latest-32core-test' }}
+          || 'dsh-ubuntu-24-04-16core' }}
     name: node 24 / static
     env:
       DSH_GATE_CONCURRENCY: '8'
@@ -102,7 +102,7 @@ jobs:
       ${{ vars.DSH_CI_FAILOVER == 'selfhosted'
           && github.event.pull_request.user.login != 'dependabot[bot]'
           && fromJSON('["self-hosted", "linux", "x64", "vm-backup"]')
-          || 'dsh-enterprise-ubuntu-24-04-32core-test' }}
+          || 'dsh-ubuntu-24-04-16core' }}
     name: node 24 / coverage
     env:
       # Failover shrinks the worker bound: the hosted 32-core runner is
@@ -167,7 +167,7 @@ jobs:
       ${{ vars.DSH_CI_FAILOVER == 'selfhosted'
           && github.event.pull_request.user.login != 'dependabot[bot]'
           && fromJSON('["self-hosted", "linux", "x64", "vm-backup"]')
-          || 'dsh-enterprise-ubuntu-latest-32core-test' }}
+          || 'dsh-ubuntu-24-04-16core' }}
     name: node 24 / snapshots and artifacts
     env:
       DSH_GATE_CONCURRENCY: '8'

From 9e2f6859f7c40b1be7014d7ae881e38d4d81fe9b Mon Sep 17 00:00:00 2001
From: imccyu <276526105+imccyu@users.noreply.github.com>
Date: Thu, 30 Jul 2026 21:36:46 +0800
Subject: [PATCH 05/11] ci: reduce invariant import

---
 scripts/test-invariants.spec.ts |  3 +-
 scripts/test-invariants.ts      | 66 ++++++++++++++++++---------------
 2 files changed, 38 insertions(+), 31 deletions(-)

diff --git a/scripts/test-invariants.spec.ts b/scripts/test-invariants.spec.ts
index 7a4f678be8..0fb6aeb201 100644
--- a/scripts/test-invariants.spec.ts
+++ b/scripts/test-invariants.spec.ts
@@ -61,7 +61,8 @@ describe('global test invariant host', () => {
       return () => {}
     })
     const fakeContext = { invariants: { register } } as unknown as Context
-    for (const [rawPath, companion] of Object.entries(testInvariantCompanions)) {
+    for (const [rawPath, load] of Object.entries(testInvariantCompanions)) {
+      const companion = await load()
       const path = rawPath.replace(/^\.\.\//, '')
       expect(companion.default, path).toBeUndefined()
       const unwrapped = loader.unwrapExports(companion) as typeof companion
diff --git a/scripts/test-invariants.ts b/scripts/test-invariants.ts
index ce9ede2dff..62c0102588 100644
--- a/scripts/test-invariants.ts
+++ b/scripts/test-invariants.ts
@@ -12,8 +12,8 @@ import InvariantService from '@deepseek-ai/dsh-invariants'
 
 declare global {
   interface ImportMeta {
-    /** Eager Vite module-glob expansion used by the Vitest setup file. */
-    glob<TModule>(pattern: string, options: { eager: true }): Record<string, TModule>
+    /** Lazy Vite module-glob expansion used by the Vitest setup file. */
+    glob<TModule>(pattern: string): Record<string, () => Promise<TModule>>
   }
 }
 
@@ -25,9 +25,15 @@ export interface TestInvariantCompanion {
   apply(ctx: Context): Promise<() => void>
 }
 
-/** Every package companion, discovered eagerly so coverage observes each registration. */
-export const testInvariantCompanions: Readonly<Record<string, TestInvariantCompanion>> =
-  import.meta.glob<TestInvariantCompanion>('../packages/*/*/src/invariant.ts', { eager: true })
+/**
+ * Every package companion as a lazy loader keyed by glob path. Ordinary tests
+ * load only their owner's module; the exhaustive topology test loads and
+ * executes all of them, so aggregated coverage still observes every
+ * registration while per-file setup stops importing 168 companions and their
+ * transitive package sources.
+ */
+export const testInvariantCompanions: Readonly<Record<string, () => Promise<TestInvariantCompanion>>> =
+  import.meta.glob<TestInvariantCompanion>('../packages/*/*/src/invariant.ts')
 
 /** Manual-topology suites whose names cannot follow the focused invariant convention. */
 const MANUAL_INVARIANT_TEST_EXCEPTIONS = [
@@ -36,7 +42,6 @@ const MANUAL_INVARIANT_TEST_EXCEPTIONS = [
 ] as const
 
 interface InvariantHost {
-  readonly fibers: readonly PluginFiber[]
   readonly byCallback: ReadonlyMap<unknown, PluginFiber>
   readonly ready: Promise<void>
 }
@@ -102,39 +107,40 @@ export function testInvariantCompanionPaths(testPath: string): string[] {
 }
 
 function startInvariantHost(root: Context): InvariantHost {
-  const fibers: PluginFiber[] = []
   const byCallback = new Map<unknown, PluginFiber>()
-  const mount = (plugin: Plugin, config?: unknown): void => {
+  const mount = (plugin: Plugin, config?: unknown): PluginFiber => {
     const fiber = originalPlugin.call(root.registry, plugin, config)
     const callback = root.registry.resolve(plugin)
     if (callback === undefined) throw new Error('test invariants: companion is not a valid Cordis plugin')
-    fibers.push(fiber)
     byCallback.set(callback, fiber)
+    return fiber
   }
 
-  mount(InvariantService, { enabled: true })
+  // The service mounts synchronously so the intercepted registration that
+  // started this host immediately finds its own fiber in byCallback.
+  // Companions load and mount inside the ready chain (after the service is
+  // active, so their startup is directly joinable); every joined root plugin
+  // awaits ready, so none starts ahead of its package checks. Tests plugging
+  // a companion directly must await an earlier root plugin first — the
+  // duplicate-mount failure otherwise is loud (owner name already reserved).
+  const serviceFiber = mount(InvariantService, { enabled: true })
   const testPath = expect.getState().testPath ?? ''
   const companionPaths = testInvariantCompanionPaths(testPath)
-  for (const path of companionPaths) {
-    const companion = testInvariantCompanions[path]
-    if (companion === undefined) {
-      throw new Error(`test invariants: selected companion vanished at ${path}`)
-    }
-    if (!companion.inject.includes('invariants')) {
-      throw new Error(`test invariants: ${path} must inject the invariant service`)
-    }
-    mount(companion)
-  }
-
-  const [serviceFiber, ...companionFibers] = fibers
-  if (serviceFiber === undefined) throw new Error('test invariants: service fiber was not mounted')
-  // A companion is initially PENDING on the invariant service, and Cordis
-  // Fiber.await() only joins work already in flight. Wait for the service to
-  // activate its dependants before joining their startup and failures.
-  const ready = serviceFiber.await()
-    .then(() => Promise.all(companionFibers.map(fiber => fiber.await())))
-    .then(() => undefined)
-  const host = { fibers, byCallback, ready }
+  const ready = serviceFiber.await().then(async () => {
+    const companionFibers = await Promise.all(companionPaths.map(async (path) => {
+      const load = testInvariantCompanions[path]
+      if (load === undefined) {
+        throw new Error(`test invariants: selected companion vanished at ${path}`)
+      }
+      const companion = await load()
+      if (!companion.inject.includes('invariants')) {
+        throw new Error(`test invariants: ${path} must inject the invariant service`)
+      }
+      return mount(companion)
+    }))
+    await Promise.all(companionFibers.map(fiber => fiber.await()))
+  })
+  const host = { byCallback, ready }
   hosts.set(root, host)
   return host
 }

From 1a75d60174e474e613baf2fcb49715262518cf1f Mon Sep 17 00:00:00 2001
From: imccyu <276526105+imccyu@users.noreply.github.com>
Date: Thu, 30 Jul 2026 21:59:07 +0800
Subject: [PATCH 06/11] ci: vitest forks

---
 vitest.config.ts | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/vitest.config.ts b/vitest.config.ts
index 750bb6ddf2..a0d8b6d58a 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -62,10 +62,12 @@ export default defineConfig({
         plugins: [pathsPlugin()],
         test: {
           name: 'thread-safe',
-          // Node 24 has aborted in its CJS lexer from a macOS arm64 worker
-          // thread. A fork contains that external runtime failure to the test
-          // process; other hosts retain the lower-overhead thread pool.
-          pool: process.platform === 'darwin' ? 'forks' : 'threads',
+          // Node 24 has aborted in its CJS lexer (v8::ToLocalChecked Empty
+          // MaybeLocal in cjs_lexer::Parse) from worker threads on macOS
+          // arm64 and later on Linux. A fork contains that external runtime
+          // failure to the test process; Windows keeps the thread pool, where
+          // the abort has not reproduced and process spawn is costlier.
+          pool: process.platform === 'win32' ? 'threads' : 'forks',
           setupFiles: ['./scripts/test-invariants.ts'],
           include: testIncludes,
           exclude: [

From 8cc31127c4c7989e1954b33b7c7433e8fd717d62 Mon Sep 17 00:00:00 2001
From: imccyu <276526105+imccyu@users.noreply.github.com>
Date: Thu, 30 Jul 2026 22:10:43 +0800
Subject: [PATCH 07/11] ci: concurrency 3/6

---
 .github/workflows/ci.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1e999becdc..1f6ec52f0a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -110,9 +110,8 @@ jobs:
       # across six always-on runner instances, and the timing-sensitive
       # process suites have documented aggregate-contention failures.
       # 8 × 6 instances = 48 workers worst case on 64 cores.
-      DSH_COVERAGE_MAX_WORKERS: ${{ vars.DSH_CI_FAILOVER == 'selfhosted' && github.event.pull_request.user.login != 'dependabot[bot]' && '8' || '8' }}
+      DSH_COVERAGE_MAX_WORKERS: ${{ vars.DSH_CI_FAILOVER == 'selfhosted' && github.event.pull_request.user.login != 'dependabot[bot]' && '8' || '6' }}
       DSH_GATE_CONCURRENCY: '3'
-      NODE_OPTIONS: '--max-old-space-size=8192'
     steps:
       - uses: actions/checkout@v6
         with:

From 78adace0314528f16def3fd4346d89ecb364ded2 Mon Sep 17 00:00:00 2001
From: imccyu <276526105+imccyu@users.noreply.github.com>
Date: Thu, 30 Jul 2026 22:34:37 +0800
Subject: [PATCH 08/11] ci: exclude typert generator from coverage thresholds
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Generator correctness stays pinned by its fixture suites and the
byte-for-byte catalog reproduction test; per-file coverage put
whole-workspace compiler analysis under v8 instrumentation — the
coverage lane's longest tail. Widen the existing three-file exclude to
the package's src.
---
 vitest.config.ts | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/vitest.config.ts b/vitest.config.ts
index a0d8b6d58a..aa3e2b441b 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -156,9 +156,11 @@ export default defineConfig({
         'packages/client/ui-sidebar/src/client/index.ts',
         'packages/client/ui-skill/src/client/index.ts',
         'packages/client/ui-workspace/src/client/index.ts',
-        'packages/typert/generator/src/analyzer.ts',
-        'packages/typert/generator/src/renderer.ts',
-        'packages/typert/generator/src/cordis-catalog.ts',
+        // Typert generator: correctness is pinned by its fixture suites and
+        // the byte-for-byte catalog reproduction test; per-file coverage
+        // would put whole-workspace compiler analysis under v8
+        // instrumentation — the coverage lane's longest tail.
+        'packages/typert/generator/src/*.ts',
         'packages/host/apiproxy/src/index.ts',
         'packages/host/apiproxy/src/invariant.ts',
         'packages/host/apiproxy/src/api-proxy.ts',

From cc9172415758fe7efdc752b46019fafce88119b9 Mon Sep 17 00:00:00 2001
From: Hypatia May <hypatiamay@outlook.com>
Date: Thu, 30 Jul 2026 23:43:53 +0800
Subject: [PATCH 09/11] Fix invariant startup gate after CI sync

---
 .github/workflows/ci.yml                      |   9 +-
 .../client/connection/tests/node-half.spec.ts |  20 +--
 .../runtime/tests/slots-service.spec.ts       |   4 +-
 scripts/test-invariants.spec.ts               | 166 +++++++++++++++++-
 scripts/test-invariants.ts                    |  61 +++++--
 vitest.config.ts                              |  23 +--
 6 files changed, 235 insertions(+), 48 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1f6ec52f0a..e607d83bdc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -105,11 +105,10 @@ jobs:
           || 'dsh-ubuntu-24-04-16core' }}
     name: node 24 / coverage
     env:
-      # Failover shrinks the worker bound: the hosted 32-core runner is
-      # exclusive to one job, but the failover pool shares one 64-core VM
-      # across six always-on runner instances, and the timing-sensitive
-      # process suites have documented aggregate-contention failures.
-      # 8 × 6 instances = 48 workers worst case on 64 cores.
+      # The hosted 16-core runner uses six coverage workers. The failover pool
+      # shares one 64-core VM across six always-on runner instances, so each
+      # instance may use eight while keeping the worst case at 8 × 6 = 48
+      # workers; process-bound suites remain isolated in forks.
       DSH_COVERAGE_MAX_WORKERS: ${{ vars.DSH_CI_FAILOVER == 'selfhosted' && github.event.pull_request.user.login != 'dependabot[bot]' && '8' || '6' }}
       DSH_GATE_CONCURRENCY: '3'
     steps:
diff --git a/packages/client/connection/tests/node-half.spec.ts b/packages/client/connection/tests/node-half.spec.ts
index 2c7fd0b281..9efa9cbd51 100644
--- a/packages/client/connection/tests/node-half.spec.ts
+++ b/packages/client/connection/tests/node-half.spec.ts
@@ -59,23 +59,9 @@ describe('connection node half', () => {
     const ctx = new Context()
     ctx.provide('httpServer', fakeHttpServer(routes) as HttpServerService)
     ctx.provide('apiProxy', {} as unknown as ApiProxy)
-    // The apply throw also escapes cordis as a late rejection — the shape the
-    // boot's installFailLoud is contracted to catch. Capture it so the run
-    // stays clean, same pattern as the webserver bind-failure test.
-    const rejections: unknown[] = []
-    const onUnhandled = (err: unknown): void => { rejections.push(err) }
-    process.on('unhandledRejection', onUnhandled)
-    try {
-      const fiber = ctx.plugin({ inject: [...inject], apply }, { trustedHosts: ['harness.internal/path'] })
-      await expect(fiber.await()).rejects.toThrow(/not a bare host\[:port\] authority/)
-      expect(routes).toHaveLength(0)
-      for (let i = 0; i < 100 && rejections.length === 0; i++) {
-        await new Promise(resolve => setTimeout(resolve, 10))
-      }
-      expect(rejections.map(String).join('\n')).toContain('not a bare host[:port] authority')
-    } finally {
-      process.off('unhandledRejection', onUnhandled)
-    }
+    const fiber = ctx.plugin({ inject: [...inject], apply }, { trustedHosts: ['harness.internal/path'] })
+    await expect(fiber).rejects.toThrow(/not a bare host\[:port\] authority/)
+    expect(routes).toHaveLength(0)
   })
 
   it('registers the /api prefix route and removes it with the fiber', async () => {
diff --git a/packages/client/runtime/tests/slots-service.spec.ts b/packages/client/runtime/tests/slots-service.spec.ts
index 07e03b6e9d..b2e510a26f 100644
--- a/packages/client/runtime/tests/slots-service.spec.ts
+++ b/packages/client/runtime/tests/slots-service.spec.ts
@@ -41,8 +41,8 @@ interface Bench {
 
 async function boot(): Promise<Bench> {
   const ctx = new Context()
-  ctx.plugin(SlotsService)
-  await ctx.fiber.await()
+  const fiber = ctx.plugin(SlotsService)
+  await fiber
   // Service accessor (ctx.get reads the reflect store, which Service-class
   // plugins do not write; the accessor is the product path).
   const svc = ctx.slots
diff --git a/scripts/test-invariants.spec.ts b/scripts/test-invariants.spec.ts
index 0fb6aeb201..e2406837ca 100644
--- a/scripts/test-invariants.spec.ts
+++ b/scripts/test-invariants.spec.ts
@@ -1,11 +1,14 @@
 import { describe, expect, it, vi } from 'vitest'
-import { Context, Service } from 'cordis'
+import { Context, FiberState, Service } from 'cordis'
 import Loader from '@cordisjs/plugin-loader'
+import InvariantService from '@deepseek-ai/dsh-invariants'
 import type { InvariantInstaller } from '@deepseek-ai/dsh-invariants'
 import { packageInvariantOwners } from './package-invariants.ts'
 import {
+  TEST_INVARIANT_READY_SERVICE,
   testInvariantCompanionPaths,
   testInvariantCompanions,
+  type TestInvariantCompanion,
   usesManualInvariantTree,
 } from './test-invariants.ts'
 
@@ -21,6 +24,32 @@ class TestInvariantProbe extends Service {
   }
 }
 
+function deferred(): { readonly promise: Promise<void>; readonly resolve: () => void } {
+  let resolve!: () => void
+  const promise = new Promise<void>((done) => {
+    resolve = done
+  })
+  return { promise, resolve }
+}
+
+async function withFakeCompanions(
+  create: (path: string, index: number) => () => Promise<TestInvariantCompanion>,
+  run: () => Promise<void>,
+): Promise<void> {
+  const mutable = testInvariantCompanions as Record<string, () => Promise<TestInvariantCompanion>>
+  const originals = Object.entries(mutable)
+  for (const [index, [path]] of originals.entries()) {
+    mutable[path] = create(path, index)
+  }
+  try {
+    await run()
+  } finally {
+    for (const [path, load] of originals) {
+      mutable[path] = load
+    }
+  }
+}
+
 describe('global test invariant host', () => {
   it('uses one exhaustive topology to reserve every package name with enabled checks', async () => {
     const ctx = new Context()
@@ -85,4 +114,139 @@ describe('global test invariant host', () => {
     expect(usesManualInvariantTree('/repo/packages/examples/agent-spine-demo/tests/agent-core.spec.ts')).toBe(true)
     expect(usesManualInvariantTree('/repo/packages/core/session/tests/session.spec.ts')).toBe(false)
   })
+
+  it('holds a root plugin until every lazy companion is active, then permits nested startup', async () => {
+    const delayedStarted = deferred()
+    const releaseDelayed = deferred()
+    const order: string[] = []
+    let delayedCompanion: TestInvariantCompanion | undefined
+
+    await withFakeCompanions(
+      (path, index) => async () => {
+        const companion: TestInvariantCompanion = {
+          name: `test-invariant-${index}`,
+          inject: ['invariants'],
+          async apply() {
+            order.push(`companion-start:${path}`)
+            if (index === 0) {
+              delayedStarted.resolve()
+              await releaseDelayed.promise
+            }
+            order.push(`companion-active:${path}`)
+            return () => {}
+          },
+        }
+        if (index === 0) delayedCompanion = companion
+        return companion
+      },
+      async () => {
+        const ctx = new Context()
+        ctx.provide('testInvariantTargetDependency', true)
+        let nestedFiber: ReturnType<Context['plugin']> | undefined
+        const nestedApply = vi.fn(function nestedApply() {
+          order.push('nested')
+        })
+        const targetApply = Object.assign(vi.fn(function targetApply(targetCtx: Context) {
+          order.push('target')
+          nestedFiber = targetCtx.plugin(nestedApply)
+        }), {
+          inject: ['testInvariantTargetDependency'],
+        })
+
+        const targetFiber = ctx.plugin(targetApply)
+        expect(ctx.registry.get(targetApply)?.callback).toBe(targetApply)
+        expect(targetFiber.inject).toEqual({
+          testInvariantTargetDependency: null,
+          [TEST_INVARIANT_READY_SERVICE]: null,
+        })
+
+        await delayedStarted.promise
+        await Promise.resolve()
+        await Promise.resolve()
+        expect(targetApply).not.toHaveBeenCalled()
+
+        releaseDelayed.resolve()
+        await targetFiber
+        if (nestedFiber === undefined) throw new Error('target did not register its nested plugin')
+        await nestedFiber
+
+        expect(targetFiber.state).toBe(FiberState.ACTIVE)
+        expect(targetApply).toHaveBeenCalledOnce()
+        expect(nestedApply).toHaveBeenCalledOnce()
+        const targetIndex = order.indexOf('target')
+        expect(targetIndex).toBeGreaterThan(-1)
+        expect(order.slice(0, targetIndex)).toHaveLength(Object.keys(testInvariantCompanions).length * 2)
+        expect(order.at(-1)).toBe('nested')
+
+        if (delayedCompanion === undefined) throw new Error('delayed companion did not load')
+        await ctx.plugin(InvariantService, { enabled: true })
+        await ctx.plugin(delayedCompanion)
+        expect(ctx.registry.get(InvariantService)?.fibers).toHaveLength(1)
+        expect(ctx.registry.get(delayedCompanion)?.fibers).toHaveLength(1)
+      },
+    )
+  })
+
+  it.each(['load', 'startup'] as const)(
+    'rejects a target when a lazy companion fails during %s without starting the target',
+    async (phase) => {
+      const failure = new Error(`test invariant companion ${phase} failed`)
+      await withFakeCompanions(
+        (_path, index) => phase === 'load' && index === 0
+          ? async () => { throw failure }
+          : async () => ({
+            name: `test-invariant-${index}`,
+            inject: ['invariants'],
+            async apply() {
+              if (phase === 'startup' && index === 0) throw failure
+              return () => {}
+            },
+          }),
+        async () => {
+          const ctx = new Context()
+          const targetApply = vi.fn(function targetApply() {})
+          const targetFiber = ctx.plugin(targetApply)
+
+          await expect(targetFiber).rejects.toBe(failure)
+          expect(targetApply).not.toHaveBeenCalled()
+          expect(targetFiber.state).toBe(FiberState.PENDING)
+          await expect(targetFiber.dispose()).resolves.toBeUndefined()
+          expect(targetFiber.state).toBe(FiberState.DISPOSED)
+        },
+      )
+    },
+  )
+
+  it('disposes a pending target without waiting for companion readiness', async () => {
+    const delayedStarted = deferred()
+    const releaseDelayed = deferred()
+
+    await withFakeCompanions(
+      (_path, index) => async () => ({
+        name: `test-invariant-${index}`,
+        inject: ['invariants'],
+        async apply() {
+          if (index === 0) {
+            delayedStarted.resolve()
+            await releaseDelayed.promise
+          }
+          return () => {}
+        },
+      }),
+      async () => {
+        const ctx = new Context()
+        const targetApply = vi.fn(function targetApply() {})
+        const targetFiber = ctx.plugin(targetApply)
+
+        await delayedStarted.promise
+        await expect(targetFiber.dispose()).resolves.toBeUndefined()
+        expect(targetFiber.state).toBe(FiberState.DISPOSED)
+        expect(targetApply).not.toHaveBeenCalled()
+
+        releaseDelayed.resolve()
+        await targetFiber
+        expect(targetApply).not.toHaveBeenCalled()
+      },
+    )
+  })
 })
diff --git a/scripts/test-invariants.ts b/scripts/test-invariants.ts
index 62c0102588..00f24e6d2f 100644
--- a/scripts/test-invariants.ts
+++ b/scripts/test-invariants.ts
@@ -6,7 +6,7 @@
  */
 
 import { expect } from 'vitest'
-import { RegistryService } from 'cordis'
+import { FiberState, Inject, RegistryService } from 'cordis'
 import type { Context, Plugin } from 'cordis'
 import InvariantService from '@deepseek-ai/dsh-invariants'
 
@@ -25,6 +25,9 @@ export interface TestInvariantCompanion {
   apply(ctx: Context): Promise<() => void>
 }
 
+/** Private service dependency that holds ordinary root plugins until invariant startup completes. */
+export const TEST_INVARIANT_READY_SERVICE = 'testInvariantReady'
+
 /**
  * Every package companion as a lazy loader keyed by glob path. Ordinary tests
  * load only their owner's module; the exhaustive topology test loads and
@@ -47,6 +50,7 @@ interface InvariantHost {
 }
 
 type PluginFiber = ReturnType<RegistryService['plugin']>
+type PluginCallback = Plugin.Function | Plugin.Constructor
 
 const hosts = new WeakMap<Context, InvariantHost>()
 // oxlint-disable-next-line typescript/unbound-method -- every call below supplies its RegistryService receiver explicitly.
@@ -64,10 +68,18 @@ RegistryService.prototype.plugin = function(plugin: Plugin, config?: unknown, ge
     return this.ctx === root ? joinInvariantStartup(existing, host.ready) : existing
   }
 
-  const fiber = originalPlugin.call(this, plugin, config, getOuterStack)
-  // A root-level await is the test's composition boundary. Nested plugin
-  // fibers must not await their own companion parent through the global host.
-  if (this.ctx !== root) return fiber
+  // Nested plugins run inside a target that already crossed the root barrier.
+  // Adding the same root-owned dependency there would make child lifecycle
+  // depend on an unrelated isolation scope and can deadlock companion startup.
+  if (this.ctx !== root) return originalPlugin.call(this, plugin, config, getOuterStack)
+  if (callback === undefined) return originalPlugin.call(this, plugin, config, getOuterStack)
+
+  const fiber = originalPlugin.call(
+    this,
+    withInvariantReadiness(plugin, callback as PluginCallback),
+    config,
+    getOuterStack,
+  )
   return joinInvariantStartup(fiber, host.ready)
 }
 
@@ -126,8 +138,8 @@ function startInvariantHost(root: Context): InvariantHost {
   const serviceFiber = mount(InvariantService, { enabled: true })
   const testPath = expect.getState().testPath ?? ''
   const companionPaths = testInvariantCompanionPaths(testPath)
-  const ready = serviceFiber.await().then(async () => {
-    const companionFibers = await Promise.all(companionPaths.map(async (path) => {
+  const ready = requireActive(serviceFiber, 'invariant service').then(async () => {
+    const companions = await Promise.all(companionPaths.map(async (path) => {
       const load = testInvariantCompanions[path]
       if (load === undefined) {
         throw new Error(`test invariants: selected companion vanished at ${path}`)
@@ -136,20 +148,43 @@ function startInvariantHost(root: Context): InvariantHost {
       if (!companion.inject.includes('invariants')) {
         throw new Error(`test invariants: ${path} must inject the invariant service`)
       }
-      return mount(companion)
+      return { companion, path }
     }))
-    await Promise.all(companionFibers.map(fiber => fiber.await()))
+    const companionFibers = companions.map(({ companion, path }) => ({
+      fiber: mount(companion),
+      path,
+    }))
+    await Promise.all(companionFibers.map(({ fiber, path }) => requireActive(fiber, path)))
+    root.provide(TEST_INVARIANT_READY_SERVICE, true)
   })
   const host = { byCallback, ready }
   hosts.set(root, host)
   return host
 }
 
+async function requireActive(fiber: PluginFiber, label: string): Promise<void> {
+  await fiber.await()
+  if (fiber.state !== FiberState.ACTIVE) {
+    throw new Error(`test invariants: ${label} settled without becoming active`)
+  }
+}
+
+function withInvariantReadiness(plugin: Plugin, callback: PluginCallback): Plugin.Object {
+  return {
+    apply: callback as Plugin.Function,
+    inject: {
+      ...Inject.resolve(plugin.inject),
+      [TEST_INVARIANT_READY_SERVICE]: null,
+    },
+    ...(plugin.name === undefined ? {} : { name: plugin.name }),
+    ...(plugin.Config === undefined ? {} : { Config: plugin.Config }),
+    ...(plugin.provide === undefined ? {} : { provide: plugin.provide }),
+    ...(plugin.intercept === undefined ? {} : { intercept: plugin.intercept }),
+  }
+}
+
 function joinInvariantStartup(fiber: PluginFiber, invariantReady: Promise<void>): PluginFiber {
-  const readiness = fiber.await().then(async (loaded) => {
-    await invariantReady
-    return loaded
-  })
+  const readiness = invariantReady.then(() => fiber.await())
   const joined = Object.create(fiber) as PluginFiber
   joined.then = readiness.then.bind(readiness)
   return joined
diff --git a/vitest.config.ts b/vitest.config.ts
index aa3e2b441b..0f4aac1e31 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -37,9 +37,9 @@ const testIncludes = [
   'scripts/**/*.spec.ts',
 ]
 
-// These suites exercise process-global state, process APIs, or timing-sensitive process I/O
-// that worker threads cannot isolate reliably under aggregate gate contention.
-// Keep the narrow exception in forks while the rest of the inventory avoids per-file processes.
+// These suites exercise process-global state, process APIs, or timing-sensitive process I/O.
+// Keep them in a separate project so Windows, whose main pool uses threads,
+// still contains them in forks; POSIX uses forks for both projects.
 const processBoundTests = [
   'packages/subprocess/subprocess-local/tests/spawn.spec.ts',
   'packages/context/time-context/tests/time-context.spec.ts',
@@ -55,8 +55,9 @@ export default defineConfig({
     // .tsx: client component specs (jsdom via per-file @vitest-environment pragma).
     include: testIncludes,
     exclude: windowsUnsupportedPackages.map(path => `${path}/tests/**/*.spec.ts`),
-    // One coverage invocation aggregates both projects. Most suites use threads
-    // for lower startup/IPC overhead; only explicit process-bound suites fork.
+    // One coverage invocation aggregates both projects. POSIX uses forks to
+    // contain the Node CJS-lexer abort; Windows keeps threads for the main
+    // inventory and forks only the explicit process-bound project.
     projects: [
       {
         plugins: [pathsPlugin()],
@@ -156,11 +157,13 @@ export default defineConfig({
         'packages/client/ui-sidebar/src/client/index.ts',
         'packages/client/ui-skill/src/client/index.ts',
         'packages/client/ui-workspace/src/client/index.ts',
-        // Typert generator: correctness is pinned by its fixture suites and
-        // the byte-for-byte catalog reproduction test; per-file coverage
-        // would put whole-workspace compiler analysis under v8
-        // instrumentation — the coverage lane's longest tail.
-        'packages/typert/generator/src/*.ts',
+        // These three whole-workspace Typert passes are pinned by fixture and
+        // byte-for-byte catalog tests; v8 instrumentation makes them the
+        // coverage lane's longest tail. The generator's lighter modules and
+        // future source files retain the 100% per-file threshold.
+        'packages/typert/generator/src/analyzer.ts',
+        'packages/typert/generator/src/renderer.ts',
+        'packages/typert/generator/src/cordis-catalog.ts',
         'packages/host/apiproxy/src/index.ts',
         'packages/host/apiproxy/src/invariant.ts',
         'packages/host/apiproxy/src/api-proxy.ts',

From 573a062afd85569f8fa892e78de543750f41a6bd Mon Sep 17 00:00:00 2001
From: Hypatia May <hypatiamay@outlook.com>
Date: Thu, 30 Jul 2026 23:54:21 +0800
Subject: [PATCH 10/11] Gate derived test contexts on invariant readiness

---
 scripts/test-invariants.spec.ts | 51 ++++++++++++++++++++++++++++++++-
 scripts/test-invariants.ts      | 28 ++++++++++++++----
 2 files changed, 72 insertions(+), 7 deletions(-)

diff --git a/scripts/test-invariants.spec.ts b/scripts/test-invariants.spec.ts
index e2406837ca..40c93fe9ad 100644
--- a/scripts/test-invariants.spec.ts
+++ b/scripts/test-invariants.spec.ts
@@ -120,18 +120,20 @@ describe('global test invariant host', () => {
     const releaseDelayed = deferred()
     const order: string[] = []
     let delayedCompanion: TestInvariantCompanion | undefined
+    const companionNestedApply = vi.fn(function companionNestedApply() {})
 
     await withFakeCompanions(
       (path, index) => async () => {
         const companion: TestInvariantCompanion = {
           name: `test-invariant-${index}`,
           inject: ['invariants'],
-          async apply() {
+          async apply(companionCtx) {
             order.push(`companion-start:${path}`)
             if (index === 0) {
               delayedStarted.resolve()
               await releaseDelayed.promise
             }
+            if (index === 1) await companionCtx.plugin(companionNestedApply)
             order.push(`companion-active:${path}`)
             return () => {}
           },
@@ -173,6 +175,7 @@ describe('global test invariant host', () => {
         expect(targetFiber.state).toBe(FiberState.ACTIVE)
         expect(targetApply).toHaveBeenCalledOnce()
         expect(nestedApply).toHaveBeenCalledOnce()
+        expect(companionNestedApply).toHaveBeenCalledOnce()
         const targetIndex = order.indexOf('target')
         expect(targetIndex).toBeGreaterThan(-1)
         expect(order.slice(0, targetIndex)).toHaveLength(Object.keys(testInvariantCompanions).length * 2)
@@ -187,6 +190,52 @@ describe('global test invariant host', () => {
     )
   })
 
+  it('holds plugins registered on a root-derived context until companion readiness', async () => {
+    const delayedStarted = deferred()
+    const releaseDelayed = deferred()
+
+    await withFakeCompanions(
+      (_path, index) => async () => ({
+        name: `test-invariant-${index}`,
+        inject: ['invariants'],
+        async apply() {
+          if (index === 0) {
+            delayedStarted.resolve()
+            await releaseDelayed.promise
+          }
+          return () => {}
+        },
+      }),
+      async () => {
+        const ctx = new Context()
+        const rootApply = vi.fn(function rootApply() {})
+        const derivedApply = vi.fn(function derivedApply() {})
+        const derived = ctx.extend()
+          .isolate('testInvariantDerived')
+          .intercept('testInvariantDerived', {})
+
+        const rootFiber = ctx.plugin(rootApply)
+        const derivedFiber = derived.plugin(derivedApply)
+
+        await delayedStarted.promise
+        await Promise.resolve()
+        await Promise.resolve()
+        expect(rootApply).not.toHaveBeenCalled()
+        expect(derivedApply).not.toHaveBeenCalled()
+        expect(derivedFiber.inject).toEqual({
+          [TEST_INVARIANT_READY_SERVICE]: null,
+        })
+
+        releaseDelayed.resolve()
+        await Promise.all([rootFiber, derivedFiber])
+        expect(rootFiber.state).toBe(FiberState.ACTIVE)
+        expect(derivedFiber.state).toBe(FiberState.ACTIVE)
+        expect(rootApply).toHaveBeenCalledOnce()
+        expect(derivedApply).toHaveBeenCalledOnce()
+      },
+    )
+  })
+
   it.each(['load', 'startup'] as const)(
     'rejects a target when a lazy companion fails during %s without starting the target',
     async (phase) => {
diff --git a/scripts/test-invariants.ts b/scripts/test-invariants.ts
index 00f24e6d2f..2ba460a9da 100644
--- a/scripts/test-invariants.ts
+++ b/scripts/test-invariants.ts
@@ -46,6 +46,7 @@ const MANUAL_INVARIANT_TEST_EXCEPTIONS = [
 
 interface InvariantHost {
   readonly byCallback: ReadonlyMap<unknown, PluginFiber>
+  readonly barrierOwners: WeakSet<Context['fiber']>
   readonly ready: Promise<void>
 }
 
@@ -65,13 +66,15 @@ RegistryService.prototype.plugin = function(plugin: Plugin, config?: unknown, ge
   const callback = this.resolve(plugin)
   const existing = callback === undefined ? undefined : host.byCallback.get(callback)
   if (existing !== undefined) {
-    return this.ctx === root ? joinInvariantStartup(existing, host.ready) : existing
+    return hasBarrierOwner(host, this.ctx) ? existing : joinInvariantStartup(existing, host.ready)
   }
 
-  // Nested plugins run inside a target that already crossed the root barrier.
-  // Adding the same root-owned dependency there would make child lifecycle
-  // depend on an unrelated isolation scope and can deadlock companion startup.
-  if (this.ctx !== root) return originalPlugin.call(this, plugin, config, getOuterStack)
+  // Causal descendants of a gated target have already crossed the barrier.
+  // Host service and companion descendants also bypass it so their own startup
+  // cannot depend on the readiness they are responsible for providing.
+  if (hasBarrierOwner(host, this.ctx)) {
+    return originalPlugin.call(this, plugin, config, getOuterStack)
+  }
   if (callback === undefined) return originalPlugin.call(this, plugin, config, getOuterStack)
 
   const fiber = originalPlugin.call(
@@ -80,6 +83,7 @@ RegistryService.prototype.plugin = function(plugin: Plugin, config?: unknown, ge
     config,
     getOuterStack,
   )
+  host.barrierOwners.add(fiber.ctx.fiber)
   return joinInvariantStartup(fiber, host.ready)
 }
 
@@ -120,11 +124,13 @@ export function testInvariantCompanionPaths(testPath: string): string[] {
 
 function startInvariantHost(root: Context): InvariantHost {
   const byCallback = new Map<unknown, PluginFiber>()
+  const barrierOwners = new WeakSet<Context['fiber']>()
   const mount = (plugin: Plugin, config?: unknown): PluginFiber => {
     const fiber = originalPlugin.call(root.registry, plugin, config)
     const callback = root.registry.resolve(plugin)
     if (callback === undefined) throw new Error('test invariants: companion is not a valid Cordis plugin')
     byCallback.set(callback, fiber)
+    barrierOwners.add(fiber.ctx.fiber)
     return fiber
   }
 
@@ -157,11 +163,21 @@ function startInvariantHost(root: Context): InvariantHost {
     await Promise.all(companionFibers.map(({ fiber, path }) => requireActive(fiber, path)))
     root.provide(TEST_INVARIANT_READY_SERVICE, true)
   })
-  const host = { byCallback, ready }
+  const host = { byCallback, barrierOwners, ready }
   hosts.set(root, host)
   return host
 }
 
+function hasBarrierOwner(host: InvariantHost, ctx: Context): boolean {
+  let fiber = ctx.fiber
+  while (true) {
+    if (host.barrierOwners.has(fiber)) return true
+    const parent = fiber.parent.fiber
+    if (parent === fiber) return false
+    fiber = parent
+  }
+}
+
 async function requireActive(fiber: PluginFiber, label: string): Promise<void> {
   await fiber.await()
   if (fiber.state !== FiberState.ACTIVE) {

From ed41269e04e706cba15ae463f451a8c657b9bbaf Mon Sep 17 00:00:00 2001
From: Hypatia May <hypatiamay@outlook.com>
Date: Thu, 30 Jul 2026 23:57:58 +0800
Subject: [PATCH 11/11] Keep pending invariant children behind readiness

---
 scripts/test-invariants.spec.ts | 45 +++++++++++++++++++++++++++++++++
 scripts/test-invariants.ts      |  7 ++++-
 2 files changed, 51 insertions(+), 1 deletion(-)

diff --git a/scripts/test-invariants.spec.ts b/scripts/test-invariants.spec.ts
index 40c93fe9ad..18c3a7f860 100644
--- a/scripts/test-invariants.spec.ts
+++ b/scripts/test-invariants.spec.ts
@@ -236,6 +236,51 @@ describe('global test invariant host', () => {
     )
   })
 
+  it('holds a child registered externally on a pending target context', async () => {
+    const delayedStarted = deferred()
+    const releaseDelayed = deferred()
+
+    await withFakeCompanions(
+      (_path, index) => async () => ({
+        name: `test-invariant-${index}`,
+        inject: ['invariants'],
+        async apply() {
+          if (index === 0) {
+            delayedStarted.resolve()
+            await releaseDelayed.promise
+          }
+          return () => {}
+        },
+      }),
+      async () => {
+        const ctx = new Context()
+        const targetApply = vi.fn(function targetApply() {})
+        const childApply = vi.fn(function childApply() {})
+
+        const targetFiber = ctx.plugin(targetApply)
+        const childFiber = targetFiber.ctx.plugin(childApply)
+
+        await delayedStarted.promise
+        await Promise.resolve()
+        await Promise.resolve()
+        expect(targetFiber.state).toBe(FiberState.PENDING)
+        expect(childFiber.state).toBe(FiberState.PENDING)
+        expect(targetApply).not.toHaveBeenCalled()
+        expect(childApply).not.toHaveBeenCalled()
+        expect(childFiber.inject).toEqual({
+          [TEST_INVARIANT_READY_SERVICE]: null,
+        })
+
+        releaseDelayed.resolve()
+        await Promise.all([targetFiber, childFiber])
+        expect(targetFiber.state).toBe(FiberState.ACTIVE)
+        expect(childFiber.state).toBe(FiberState.ACTIVE)
+        expect(targetApply).toHaveBeenCalledOnce()
+        expect(childApply).toHaveBeenCalledOnce()
+      },
+    )
+  })
+
   it.each(['load', 'startup'] as const)(
     'rejects a target when a lazy companion fails during %s without starting the target',
     async (phase) => {
diff --git a/scripts/test-invariants.ts b/scripts/test-invariants.ts
index 2ba460a9da..8ebf7a6243 100644
--- a/scripts/test-invariants.ts
+++ b/scripts/test-invariants.ts
@@ -171,7 +171,12 @@ function startInvariantHost(root: Context): InvariantHost {
 function hasBarrierOwner(host: InvariantHost, ctx: Context): boolean {
   let fiber = ctx.fiber
   while (true) {
-    if (host.barrierOwners.has(fiber)) return true
+    if (
+      host.barrierOwners.has(fiber)
+      && (fiber.state === FiberState.LOADING || fiber.state === FiberState.ACTIVE)
+    ) {
+      return true
+    }
     const parent = fiber.parent.fiber
     if (parent === fiber) return false
     fiber = parent