Fix invariant startup gate after CI sync

.github/workflows/ci.yml

@@ -105,11 +105,10 @@ jobs:
           || 'dsh-ubuntu-24-04-16core' }}
     name: node 24 / coverage
     env:
-      # Failover shrinks the worker bound: the hosted 32-core runner is
+      # The hosted 16-core runner uses six coverage workers. The failover pool
-      # exclusive to one job, but the failover pool shares one 64-core VM
+      # shares one 64-core VM across six always-on runner instances, so each
-      # across six always-on runner instances, and the timing-sensitive
+      # instance may use eight while keeping the worst case at 8 × 6 = 48
-      # process suites have documented aggregate-contention failures.
+      # workers; process-bound suites remain isolated in forks.
-      # 8 × 6 instances = 48 workers worst case on 64 cores.
       DSH_COVERAGE_MAX_WORKERS: ${{ vars.DSH_CI_FAILOVER == 'selfhosted' && github.event.pull_request.user.login != 'dependabot[bot]' && '8' || '6' }}
       DSH_GATE_CONCURRENCY: '3'
     steps:

packages/client/connection/tests/node-half.spec.ts

@@ -59,23 +59,9 @@ describe('connection node half', () => {
     const ctx = new Context()
     ctx.provide('httpServer', fakeHttpServer(routes) as HttpServerService)
     ctx.provide('apiProxy', {} as unknown as ApiProxy)
-    // The apply throw also escapes cordis as a late rejection — the shape the
+    const fiber = ctx.plugin({ inject: [...inject], apply }, { trustedHosts: ['harness.internal/path'] })
-    // boot's installFailLoud is contracted to catch. Capture it so the run
+    await expect(fiber).rejects.toThrow(/not a bare host\[:port\] authority/)
-    // stays clean, same pattern as the webserver bind-failure test.
+    expect(routes).toHaveLength(0)
-    const rejections: unknown[] = []
-    const onUnhandled = (err: unknown): void => { rejections.push(err) }
-    process.on('unhandledRejection', onUnhandled)
-    try {
-      const fiber = ctx.plugin({ inject: [...inject], apply }, { trustedHosts: ['harness.internal/path'] })
-      await expect(fiber.await()).rejects.toThrow(/not a bare host\[:port\] authority/)
-      expect(routes).toHaveLength(0)
-      for (let i = 0; i < 100 && rejections.length === 0; i++) {
-        await new Promise(resolve => setTimeout(resolve, 10))
-      }
-      expect(rejections.map(String).join('\n')).toContain('not a bare host[:port] authority')
-    } finally {
-      process.off('unhandledRejection', onUnhandled)
-    }
   })
 
   it('registers the /api prefix route and removes it with the fiber', async () => {

packages/client/runtime/tests/slots-service.spec.ts

@@ -41,8 +41,8 @@ interface Bench {
 
 async function boot(): Promise<Bench> {
   const ctx = new Context()
-  ctx.plugin(SlotsService)
+  const fiber = ctx.plugin(SlotsService)
-  await ctx.fiber.await()
+  await fiber
   // Service accessor (ctx.get reads the reflect store, which Service-class
   // plugins do not write; the accessor is the product path).
   const svc = ctx.slots

scripts/test-invariants.spec.ts

@@ -1,11 +1,14 @@
 import { describe, expect, it, vi } from 'vitest'
-import { Context, Service } from 'cordis'
+import { Context, FiberState, Service } from 'cordis'
 import Loader from '@cordisjs/plugin-loader'
+import InvariantService from '@deepseek-ai/dsh-invariants'
 import type { InvariantInstaller } from '@deepseek-ai/dsh-invariants'
 import { packageInvariantOwners } from './package-invariants.ts'
 import {
+  TEST_INVARIANT_READY_SERVICE,
   testInvariantCompanionPaths,
   testInvariantCompanions,
+  type TestInvariantCompanion,
   usesManualInvariantTree,
 } from './test-invariants.ts'
 
@@ -21,6 +24,32 @@ class TestInvariantProbe extends Service {
   }
 }
 
+function deferred(): { readonly promise: Promise<void>; readonly resolve: () => void } {
+  let resolve!: () => void
+  const promise = new Promise<void>((done) => {
+    resolve = done
+  })
+  return { promise, resolve }
+}
+
+async function withFakeCompanions(
+  create: (path: string, index: number) => () => Promise<TestInvariantCompanion>,
+  run: () => Promise<void>,
+): Promise<void> {
+  const mutable = testInvariantCompanions as Record<string, () => Promise<TestInvariantCompanion>>
+  const originals = Object.entries(mutable)
+  for (const [index, [path]] of originals.entries()) {
+    mutable[path] = create(path, index)
+  }
+  try {
+    await run()
+  } finally {
+    for (const [path, load] of originals) {
+      mutable[path] = load
+    }
+  }
+}
+
 describe('global test invariant host', () => {
   it('uses one exhaustive topology to reserve every package name with enabled checks', async () => {
     const ctx = new Context()
@@ -85,4 +114,139 @@ describe('global test invariant host', () => {
     expect(usesManualInvariantTree('/repo/packages/examples/agent-spine-demo/tests/agent-core.spec.ts')).toBe(true)
     expect(usesManualInvariantTree('/repo/packages/core/session/tests/session.spec.ts')).toBe(false)
   })
+
+  it('holds a root plugin until every lazy companion is active, then permits nested startup', async () => {
+    const delayedStarted = deferred()
+    const releaseDelayed = deferred()
+    const order: string[] = []
+    let delayedCompanion: TestInvariantCompanion | undefined
+
+    await withFakeCompanions(
+      (path, index) => async () => {
+        const companion: TestInvariantCompanion = {
+          name: `test-invariant-${index}`,
+          inject: ['invariants'],
+          async apply() {
+            order.push(`companion-start:${path}`)
+            if (index === 0) {
+              delayedStarted.resolve()
+              await releaseDelayed.promise
+            }
+            order.push(`companion-active:${path}`)
+            return () => {}
+          },
+        }
+        if (index === 0) delayedCompanion = companion
+        return companion
+      },
+      async () => {
+        const ctx = new Context()
+        ctx.provide('testInvariantTargetDependency', true)
+        let nestedFiber: ReturnType<Context['plugin']> | undefined
+        const nestedApply = vi.fn(function nestedApply() {
+          order.push('nested')
+        })
+        const targetApply = Object.assign(vi.fn(function targetApply(targetCtx: Context) {
+          order.push('target')
+          nestedFiber = targetCtx.plugin(nestedApply)
+        }), {
+          inject: ['testInvariantTargetDependency'],
+        })
+
+        const targetFiber = ctx.plugin(targetApply)
+        expect(ctx.registry.get(targetApply)?.callback).toBe(targetApply)
+        expect(targetFiber.inject).toEqual({
+          testInvariantTargetDependency: null,
+          [TEST_INVARIANT_READY_SERVICE]: null,
+        })
+
+        await delayedStarted.promise
+        await Promise.resolve()
+        await Promise.resolve()
+        expect(targetApply).not.toHaveBeenCalled()
+
+        releaseDelayed.resolve()
+        await targetFiber
+        if (nestedFiber === undefined) throw new Error('target did not register its nested plugin')
+        await nestedFiber
+
+        expect(targetFiber.state).toBe(FiberState.ACTIVE)
+        expect(targetApply).toHaveBeenCalledOnce()
+        expect(nestedApply).toHaveBeenCalledOnce()
+        const targetIndex = order.indexOf('target')
+        expect(targetIndex).toBeGreaterThan(-1)
+        expect(order.slice(0, targetIndex)).toHaveLength(Object.keys(testInvariantCompanions).length * 2)
+        expect(order.at(-1)).toBe('nested')
+
+        if (delayedCompanion === undefined) throw new Error('delayed companion did not load')
+        await ctx.plugin(InvariantService, { enabled: true })
+        await ctx.plugin(delayedCompanion)
+        expect(ctx.registry.get(InvariantService)?.fibers).toHaveLength(1)
+        expect(ctx.registry.get(delayedCompanion)?.fibers).toHaveLength(1)
+      },
+    )
+  })
+
+  it.each(['load', 'startup'] as const)(
+    'rejects a target when a lazy companion fails during %s without starting the target',
+    async (phase) => {
+      const failure = new Error(`test invariant companion ${phase} failed`)
+      await withFakeCompanions(
+        (_path, index) => phase === 'load' && index === 0
+          ? async () => { throw failure }
+          : async () => ({
+            name: `test-invariant-${index}`,
+            inject: ['invariants'],
+            async apply() {
+              if (phase === 'startup' && index === 0) throw failure
+              return () => {}
+            },
+          }),
+        async () => {
+          const ctx = new Context()
+          const targetApply = vi.fn(function targetApply() {})
+          const targetFiber = ctx.plugin(targetApply)
+
+          await expect(targetFiber).rejects.toBe(failure)
+          expect(targetApply).not.toHaveBeenCalled()
+          expect(targetFiber.state).toBe(FiberState.PENDING)
+          await expect(targetFiber.dispose()).resolves.toBeUndefined()
+          expect(targetFiber.state).toBe(FiberState.DISPOSED)
+        },
+      )
+    },
+  )
+
+  it('disposes a pending target without waiting for companion readiness', async () => {
+    const delayedStarted = deferred()
+    const releaseDelayed = deferred()
+
+    await withFakeCompanions(
+      (_path, index) => async () => ({
+        name: `test-invariant-${index}`,
+        inject: ['invariants'],
+        async apply() {
+          if (index === 0) {
+            delayedStarted.resolve()
+            await releaseDelayed.promise
+          }
+          return () => {}
+        },
+      }),
+      async () => {
+        const ctx = new Context()
+        const targetApply = vi.fn(function targetApply() {})
+        const targetFiber = ctx.plugin(targetApply)
+
+        await delayedStarted.promise
+        await expect(targetFiber.dispose()).resolves.toBeUndefined()
+        expect(targetFiber.state).toBe(FiberState.DISPOSED)
+        expect(targetApply).not.toHaveBeenCalled()
+
+        releaseDelayed.resolve()
+        await targetFiber
+        expect(targetApply).not.toHaveBeenCalled()
+      },
+    )
+  })
 })

scripts/test-invariants.ts

@@ -6,7 +6,7 @@
  */
 
 import { expect } from 'vitest'
-import { RegistryService } from 'cordis'
+import { FiberState, Inject, RegistryService } from 'cordis'
 import type { Context, Plugin } from 'cordis'
 import InvariantService from '@deepseek-ai/dsh-invariants'
 
@@ -25,6 +25,9 @@ export interface TestInvariantCompanion {
   apply(ctx: Context): Promise<() => void>
 }
 
+/** Private service dependency that holds ordinary root plugins until invariant startup completes. */
+export const TEST_INVARIANT_READY_SERVICE = 'testInvariantReady'
+
 /**
  * Every package companion as a lazy loader keyed by glob path. Ordinary tests
  * load only their owner's module; the exhaustive topology test loads and
@@ -47,6 +50,7 @@ interface InvariantHost {
 }
 
 type PluginFiber = ReturnType<RegistryService['plugin']>
+type PluginCallback = Plugin.Function | Plugin.Constructor
 
 const hosts = new WeakMap<Context, InvariantHost>()
 // oxlint-disable-next-line typescript/unbound-method -- every call below supplies its RegistryService receiver explicitly.
@@ -64,10 +68,18 @@ RegistryService.prototype.plugin = function(plugin: Plugin, config?: unknown, ge
     return this.ctx === root ? joinInvariantStartup(existing, host.ready) : existing
   }
 
-  const fiber = originalPlugin.call(this, plugin, config, getOuterStack)
+  // Nested plugins run inside a target that already crossed the root barrier.
-  // A root-level await is the test's composition boundary. Nested plugin
+  // Adding the same root-owned dependency there would make child lifecycle
-  // fibers must not await their own companion parent through the global host.
+  // depend on an unrelated isolation scope and can deadlock companion startup.
-  if (this.ctx !== root) return fiber
+  if (this.ctx !== root) return originalPlugin.call(this, plugin, config, getOuterStack)
+  if (callback === undefined) return originalPlugin.call(this, plugin, config, getOuterStack)
+
+  const fiber = originalPlugin.call(
+    this,
+    withInvariantReadiness(plugin, callback as PluginCallback),
+    config,
+    getOuterStack,
+  )
   return joinInvariantStartup(fiber, host.ready)
 }
 
@@ -126,8 +138,8 @@ function startInvariantHost(root: Context): InvariantHost {
   const serviceFiber = mount(InvariantService, { enabled: true })
   const testPath = expect.getState().testPath ?? ''
   const companionPaths = testInvariantCompanionPaths(testPath)
-  const ready = serviceFiber.await().then(async () => {
+  const ready = requireActive(serviceFiber, 'invariant service').then(async () => {
-    const companionFibers = await Promise.all(companionPaths.map(async (path) => {
+    const companions = await Promise.all(companionPaths.map(async (path) => {
       const load = testInvariantCompanions[path]
       if (load === undefined) {
         throw new Error(`test invariants: selected companion vanished at ${path}`)
@@ -136,20 +148,43 @@ function startInvariantHost(root: Context): InvariantHost {
       if (!companion.inject.includes('invariants')) {
         throw new Error(`test invariants: ${path} must inject the invariant service`)
       }
-      return mount(companion)
+      return { companion, path }
     }))
-    await Promise.all(companionFibers.map(fiber => fiber.await()))
+    const companionFibers = companions.map(({ companion, path }) => ({
+      fiber: mount(companion),
+      path,
+    }))
+    await Promise.all(companionFibers.map(({ fiber, path }) => requireActive(fiber, path)))
+    root.provide(TEST_INVARIANT_READY_SERVICE, true)
   })
   const host = { byCallback, ready }
   hosts.set(root, host)
   return host
 }
 
+async function requireActive(fiber: PluginFiber, label: string): Promise<void> {
+  await fiber.await()
+  if (fiber.state !== FiberState.ACTIVE) {
+    throw new Error(`test invariants: ${label} settled without becoming active`)
+  }
+}
+
+function withInvariantReadiness(plugin: Plugin, callback: PluginCallback): Plugin.Object {
+  return {
+    apply: callback as Plugin.Function,
+    inject: {
+      ...Inject.resolve(plugin.inject),
+      [TEST_INVARIANT_READY_SERVICE]: null,
+    },
+    ...(plugin.name === undefined ? {} : { name: plugin.name }),
+    ...(plugin.Config === undefined ? {} : { Config: plugin.Config }),
+    ...(plugin.provide === undefined ? {} : { provide: plugin.provide }),
+    ...(plugin.intercept === undefined ? {} : { intercept: plugin.intercept }),
+  }
+}
+
 function joinInvariantStartup(fiber: PluginFiber, invariantReady: Promise<void>): PluginFiber {
-  const readiness = fiber.await().then(async (loaded) => {
+  const readiness = invariantReady.then(() => fiber.await())
-    await invariantReady
-    return loaded
-  })
   const joined = Object.create(fiber) as PluginFiber
   joined.then = readiness.then.bind(readiness)
   return joined

vitest.config.ts

@@ -37,9 +37,9 @@ const testIncludes = [
   'scripts/**/*.spec.ts',
 ]
 
-// These suites exercise process-global state, process APIs, or timing-sensitive process I/O
+// These suites exercise process-global state, process APIs, or timing-sensitive process I/O.
-// that worker threads cannot isolate reliably under aggregate gate contention.
+// Keep them in a separate project so Windows, whose main pool uses threads,
-// Keep the narrow exception in forks while the rest of the inventory avoids per-file processes.
+// still contains them in forks; POSIX uses forks for both projects.
 const processBoundTests = [
   'packages/subprocess/subprocess-local/tests/spawn.spec.ts',
   'packages/context/time-context/tests/time-context.spec.ts',
@@ -55,8 +55,9 @@ export default defineConfig({
     // .tsx: client component specs (jsdom via per-file @vitest-environment pragma).
     include: testIncludes,
     exclude: windowsUnsupportedPackages.map(path => `${path}/tests/**/*.spec.ts`),
-    // One coverage invocation aggregates both projects. Most suites use threads
+    // One coverage invocation aggregates both projects. POSIX uses forks to
-    // for lower startup/IPC overhead; only explicit process-bound suites fork.
+    // contain the Node CJS-lexer abort; Windows keeps threads for the main
+    // inventory and forks only the explicit process-bound project.
     projects: [
       {
         plugins: [pathsPlugin()],
@@ -156,11 +157,13 @@ export default defineConfig({
         'packages/client/ui-sidebar/src/client/index.ts',
         'packages/client/ui-skill/src/client/index.ts',
         'packages/client/ui-workspace/src/client/index.ts',
-        // Typert generator: correctness is pinned by its fixture suites and
+        // These three whole-workspace Typert passes are pinned by fixture and
-        // the byte-for-byte catalog reproduction test; per-file coverage
+        // byte-for-byte catalog tests; v8 instrumentation makes them the
-        // would put whole-workspace compiler analysis under v8
+        // coverage lane's longest tail. The generator's lighter modules and
-        // instrumentation — the coverage lane's longest tail.
+        // future source files retain the 100% per-file threshold.
-        'packages/typert/generator/src/*.ts',
+        'packages/typert/generator/src/analyzer.ts',
+        'packages/typert/generator/src/renderer.ts',
+        'packages/typert/generator/src/cordis-catalog.ts',
         'packages/host/apiproxy/src/index.ts',
         'packages/host/apiproxy/src/invariant.ts',
         'packages/host/apiproxy/src/api-proxy.ts',