@hydranium/core 1.0.0-next.14 → 1.0.0-next.148

package/src/node/node-file-system-provider.ts

@@ -8,16 +8,18 @@
  ********************************************************************************/
 
 import { type Tracer } from '@hydranium/protocol';
-import { URI, UriUtils } from '@hydranium/langium';
+import { type FileSystemNode, URI, UriUtils } from '@hydranium/langium';
 import { NodeFileSystemProvider } from '@hydranium/langium/node';
 import { randomUUID } from 'node:crypto';
 import { realpathSync } from 'node:fs';
 import * as fsp from 'node:fs/promises';
 import { type WritableFileSystemProvider } from '../documents/ast-document-manager.js';
 import { type SelfSaveRegistry } from '../documents/self-save-registry.js';
+import { renameOverOpenReaders } from './rename-over-open-readers.js';
 import { type LogNameOptions } from '../langium/diagnostics/logger.js';
 import { serverSharedFactory, type ServerSharedServicesMinimal } from '../langium/shared-services.js';
-import { serveVirtualDocument } from '../langium/workspace/virtual-document.js';
+import { NO_SUCH_FILE, NO_SUCH_PATH, UNSUPPORTED_WRITE } from '../langium/workspace/in-memory-file-system-provider.js';
+import { serveVirtualDocument, serveVirtualNode } from '../langium/workspace/virtual-document.js';
 
 /**
  * Node-based default {@link WritableFileSystemProvider}. Extends Langium's
@@ -27,6 +29,13 @@ import { serveVirtualDocument } from '../langium/workspace/virtual-document.js';
  * {@link SelfSaveRegistry} bound at `services.workspace.SelfSaveRegistry` — so
  * consumers can suppress the `didChangeWatchedFiles` echo for their own writes.
  *
+ * Its read surface answers for registered virtual documents and refuses to
+ * derive a disk path from a URI that names no disk location — see
+ * {@link servesFromDisk}, which is the one place that judgement is made. Every
+ * method that derives an OS path is held to it, writes most of all: a read that
+ * skipped it would only mis-report, while a write would CREATE a file at a path
+ * the URI never named.
+ *
  * Server-only (`@hydranium/core/node`): pulls `node:fs`. The portable `.`
  * entry binds `DefaultEmptyFileSystemProvider` by default, so a Node host
  * must rebind this slot — through `context.fileSystemProvider` or directly — to
@@ -45,15 +54,114 @@ export class DefaultFileSystemProvider extends NodeFileSystemProvider implements
       this.tracer = services.Tracer.for(options.logName ?? this.constructor.name).trace('instantiated');
    }
 
-   // Serve virtual documents from the registered document before touching disk
-   // (a virtual URI has no `fsPath` backing); delegate everything else to Node.
+   /**
+    * Whether `uri` names something this provider can reach on disk.
+    *
+    * Only a `file:` URI does. `URI.fsPath` yields a path for ANY scheme — for a
+    * hierarchical one it is the path component, which for a schemed URI with no
+    * authority comes out RELATIVE — so delegating an unrecognised scheme to Node
+    * does not fail, it probes `<cwd>/<path>` and answers about whatever
+    * unrelated file happens to sit there. A server whose working directory is
+    * the workspace root makes that collision ordinary rather than exotic.
+    *
+    * Note the deliberate disagreement with {@link realpath}, which treats a
+    * non-`file:` URI as PRESENT. The two degrade in opposite directions because
+    * they answer different questions: identity has to hand back a usable URI, so
+    * its safe answer is the one it was given, while occupancy and content must
+    * not be invented from an unrelated path, so their safe answer is "nothing
+    * here". A subclass adding a second on-disk scheme widens this and nothing
+    * else.
+    */
+   protected servesFromDisk(uri: URI): boolean {
+      return uri.scheme === 'file';
+   }
+
+   // Each read resolves in the same order: a registered virtual document first
+   // (it has no `fsPath` backing), then disk for a path this provider can
+   // reach, then the filesystem's own "nothing here" answer — never a probe
+   // against a path derived from a URI that names no disk location.
    override readFile(uri: URI): Promise<string> {
       const served = serveVirtualDocument(this.services, uri);
-      return served !== undefined ? Promise.resolve(served) : super.readFile(uri);
+      if (served !== undefined) {
+         return Promise.resolve(served);
+      }
+      return this.servesFromDisk(uri) ? super.readFile(uri) : Promise.reject(noSuchFile(uri));
    }
 
    override readFileSync(uri: URI): string {
-      return serveVirtualDocument(this.services, uri) ?? super.readFileSync(uri);
+      const served = serveVirtualDocument(this.services, uri);
+      if (served !== undefined) {
+         return served;
+      }
+      if (!this.servesFromDisk(uri)) {
+         throw noSuchFile(uri);
+      }
+      return super.readFileSync(uri);
+   }
+
+   override readBinary(uri: URI): Promise<Uint8Array> {
+      const served = serveVirtualDocument(this.services, uri);
+      if (served !== undefined) {
+         return Promise.resolve(encode(served));
+      }
+      return this.servesFromDisk(uri) ? super.readBinary(uri) : Promise.reject(noSuchFile(uri));
+   }
+
+   override readBinarySync(uri: URI): Uint8Array {
+      const served = serveVirtualDocument(this.services, uri);
+      if (served !== undefined) {
+         return encode(served);
+      }
+      if (!this.servesFromDisk(uri)) {
+         throw noSuchFile(uri);
+      }
+      return super.readBinarySync(uri);
+   }
+
+   override stat(uri: URI): Promise<FileSystemNode> {
+      const served = serveVirtualNode(this.services, uri);
+      if (served !== undefined) {
+         return Promise.resolve(served);
+      }
+      return this.servesFromDisk(uri) ? super.stat(uri) : Promise.reject(noSuchPath(uri));
+   }
+
+   override statSync(uri: URI): FileSystemNode {
+      const served = serveVirtualNode(this.services, uri);
+      if (served !== undefined) {
+         return served;
+      }
+      if (!this.servesFromDisk(uri)) {
+         throw noSuchPath(uri);
+      }
+      return super.statSync(uri);
+   }
+
+   // Delegating to `existsSync` would be shorter and would put a blocking stat
+   // on the async path.
+   override async exists(uri: URI): Promise<boolean> {
+      if (serveVirtualDocument(this.services, uri) !== undefined) {
+         return true;
+      }
+      return this.servesFromDisk(uri) ? super.exists(uri) : false;
+   }
+
+   override existsSync(uri: URI): boolean {
+      if (serveVirtualDocument(this.services, uri) !== undefined) {
+         return true;
+      }
+      return this.servesFromDisk(uri) ? super.existsSync(uri) : false;
+   }
+
+   // A URI this provider cannot reach on disk has no children rather than an
+   // error: a workspace walk enumerates folders it was handed, and failing one
+   // aborts the walk where an empty listing simply contributes nothing.
+   override readDirectory(uri: URI): Promise<FileSystemNode[]> {
+      return this.servesFromDisk(uri) ? super.readDirectory(uri) : Promise.resolve([]);
+   }
+
+   override readDirectorySync(uri: URI): FileSystemNode[] {
+      return this.servesFromDisk(uri) ? super.readDirectorySync(uri) : [];
    }
 
    /**
@@ -103,6 +211,17 @@ export class DefaultFileSystemProvider extends NodeFileSystemProvider implements
     * only possible, which is what settles the trade.
     */
    async writeFile(uri: URI, content: string): Promise<void> {
+      // BEFORE the `mkdir`, and before any other OS path is derived. The read
+      // surface degrades to "nothing here" for a URI naming no disk location;
+      // a write has no such harmless degradation — `fsPath` would hand it a
+      // real path regardless of scheme, so an unguarded write does not fail,
+      // it CREATES a file (and the directories above it) somewhere unrelated.
+      // Rejecting is the only safe answer: a caller holding a `memory:` or
+      // `untitled:` document has nowhere for it to go, and inventing a
+      // destination from the path component is never what it meant.
+      if (!this.servesFromDisk(uri)) {
+         throw unsupportedWrite(uri);
+      }
       await fsp.mkdir(UriUtils.dirname(uri).fsPath, { recursive: true });
       const destination = this.realpath(uri)?.fsPath ?? uri.fsPath;
       const replaced = await replacedFile(destination);
@@ -135,6 +254,15 @@ export class DefaultFileSystemProvider extends NodeFileSystemProvider implements
    }
 
    async mtimeMs(uri: URI): Promise<number | undefined> {
+      // Same rule as the read surface, and "unknown" is already the answer the
+      // caller handles — so a URI naming no disk location reports no mtime
+      // rather than the modification time of whatever occupies its `fsPath`.
+      // A stamp borrowed from an unrelated file is worse than none: the
+      // self-save registry keys on it to suppress a watcher echo, so a
+      // coincidental match would drop a real external change.
+      if (!this.servesFromDisk(uri)) {
+         return undefined;
+      }
       try {
          const stat = await fsp.stat(uri.fsPath);
          return stat.mtimeMs;
@@ -168,6 +296,26 @@ export class DefaultFileSystemProvider extends NodeFileSystemProvider implements
    }
 }
 
+/** The "no content here" rejection, for a URI naming no readable file. */
+function noSuchFile(uri: URI): Error {
+   return new Error(NO_SUCH_FILE.format({ uri: uri.toString() }));
+}
+
+/** The "nothing occupies this" rejection, for a URI naming no filesystem node. */
+function noSuchPath(uri: URI): Error {
+   return new Error(NO_SUCH_PATH.format({ uri: uri.toString() }));
+}
+
+/** The "nowhere to put this" rejection, for a write to a URI with no disk backing. */
+function unsupportedWrite(uri: URI): Error {
+   return new Error(UNSUPPORTED_WRITE.format({ uri: uri.toString() }));
+}
+
+/** A virtual document's text as the bytes a binary read returns. */
+function encode(text: string): Uint8Array {
+   return new TextEncoder().encode(text);
+}
+
 /**
  * What a write has to know about the regular file at `path` before replacing
  * it: the permission bits to carry over, and how many names share its inode.
@@ -195,47 +343,6 @@ async function replacedFile(path: string): Promise<ReplacedFile | undefined> {
    }
 }
 
-/**
- * Errno values a rename reports on Windows when another handle holds the
- * destination open. POSIX renames are unaffected by open handles, so this
- * cannot fire there and the retry below costs nothing.
- */
-const RENAME_CONTENTION_CODES = new Set(['EPERM', 'EACCES', 'EBUSY']);
-
-/**
- * `rename` the staged content over `destination`, retrying while Windows
- * reports the destination as held open.
- *
- * The staging file exists so a reader never sees a half-written file, and on
- * Windows the very presence of that reader is what makes the replacing rename
- * fail — so the indivisible write breaks under exactly the contention it was
- * built for, and it breaks intermittently, which is worse than never working.
- * A reader's handle is released in milliseconds, so waiting turns a spurious
- * failure into a slightly later success.
- *
- * BOUNDED, not open-ended: a genuine permission fault raises the same errno and
- * is distinguishable from contention only by never clearing, so an unbounded
- * wait would convert a hard error into a hang. Exhausting the budget rethrows
- * the last failure, leaving the caller's cleanup and error contract unchanged.
- */
-async function renameOverOpenReaders(staging: string, destination: string): Promise<void> {
-   const deadline = Date.now() + 2_000;
-   for (let attempt = 0; ; attempt++) {
-      try {
-         await fsp.rename(staging, destination);
-         return;
-      } catch (err: unknown) {
-         const code = err instanceof Error && 'code' in err ? String((err as NodeJS.ErrnoException).code) : undefined;
-         if (code === undefined || !RENAME_CONTENTION_CODES.has(code) || Date.now() >= deadline) {
-            throw err;
-         }
-         // Backs off to keep a long contention window from spinning, capped so
-         // a late attempt still lands promptly once the handle is released.
-         await new Promise(resolve => setTimeout(resolve, Math.min(2 ** attempt, 50)));
-      }
-   }
-}
-
 /**
  * Module fragment that binds the writable Node {@link DefaultFileSystemProvider},
  * spread into the services context on a Node host.

package/src/node/profile-capture.ts

@@ -147,8 +147,14 @@ export function formatProfileReport(report: ProfileReport, label = 'Profile repo
    return lines.join('\n');
 }
 
-/** Minimal structural view of a `node:inspector` `Session` — its typed per-method overloads can't be called generically. */
-interface InspectorSessionLike {
+/**
+ * Minimal structural view of a `node:inspector` `Session` — its typed per-method
+ * overloads can't be called generically.
+ *
+ * Held by the `protected` {@link ProfileCapture.session}, so a subclass reaching
+ * the inspector names this rather than `Session`.
+ */
+export interface InspectorSessionLike {
    connect(): void;
    disconnect(): void;
    post(method: string, params: Record<string, unknown>, callback: (error: Error | null, result?: unknown) => void): void;

package/src/node/profiling-run.ts

@@ -55,8 +55,8 @@ export interface ProfilingRunOptions {
    /**
     * Optional latency collector. When present, {@link ProfilingRun.finish} writes
     * its report to `server-latency.json` and records a `server-latency` manifest artefact. A
-    * head feeds it via the RPC binding / `instrumentLspConnection`; a pure
-    * headless build with no request traffic leaves it empty.
+    * head feeds it via the RPC binding / `lspLatencyOptions`; a pure headless
+    * build with no request traffic leaves it empty.
     */
    latency?: LatencyCollector;
 }
@@ -97,7 +97,7 @@ export class ProfilingRun {
       // `HYDRANIUM_LOG_FILE` env, which every `@hydranium/core` copy reads when
       // its logger is CONSTRUCTED — so `ProfilingRun.start` must run before the
       // head's services are created (as `measureModelMemory` does). This is the
-      // only mechanism that crosses a yalc'd adopter's separate core copy; a
+      // only mechanism that crosses an adopter's separate core copy; a
       // process-local `setLogFilePath` would only reach this module's own copy.
       this.previousLogFileEnv = process.env[DEFAULT_LOG_FILE_ENV];
       process.env[DEFAULT_LOG_FILE_ENV] = this.serverLogPath;

package/src/node/rename-over-open-readers.ts

@@ -0,0 +1,78 @@
+/********************************************************************************
+ * Copyright (c) 2026 CrossBreeze, EclipseSource and others.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the MIT License which is available in the project root.
+ *
+ * SPDX-License-Identifier: MIT
+ ********************************************************************************/
+
+import * as fsp from 'node:fs/promises';
+
+/**
+ * Errnos Windows raises when a replacing `rename` meets a handle already on the
+ * destination open. POSIX renames are unaffected by open handles, so these
+ * cannot fire there and the retry below costs nothing.
+ */
+export const RENAME_CONTENTION_CODES = new Set(['EPERM', 'EACCES', 'EBUSY']);
+
+/**
+ * How long a replacing rename may keep retrying before it gives up.
+ *
+ * BOUNDED, not open-ended: a genuine permission fault raises the same errno as
+ * contention and is distinguishable from it only by never clearing, so an
+ * unbounded wait would convert a hard error into a hang.
+ *
+ * The figure is a judgement, not a measurement, and the honest bound on it is
+ * that the previous 2s was observed EXHAUSTED on a loaded Windows CI runner
+ * while no upper bound has been established. What would settle it is recording
+ * how long a real contended rename takes to clear. graceful-fs tolerates 60s
+ * for Windows rename contention, but that is weaker support than it looks: it
+ * retries only where the destination has GONE, which is the opposite of
+ * replacing one a reader holds open.
+ */
+export const RENAME_BUDGET_MS = 10_000;
+
+/** Seams for the test, which cannot make a real rename fail on demand. */
+export interface RenameOverOpenReadersOptions {
+   readonly rename?: (from: string, to: string) => Promise<void>;
+   readonly budgetMs?: number;
+}
+
+/**
+ * `rename` the staged content over `destination`, retrying while Windows
+ * reports the destination as held open.
+ *
+ * The staging file exists so a reader never sees a half-written file, and on
+ * Windows the very presence of that reader is what makes the replacing rename
+ * fail — so the indivisible write breaks under exactly the contention it was
+ * built for, and it breaks intermittently, which is worse than never working.
+ * A reader's handle is released in milliseconds, so waiting turns a spurious
+ * failure into a slightly later success.
+ *
+ * Exhausting the budget rethrows the last failure, leaving the caller's cleanup
+ * and error contract unchanged. An errno OUTSIDE the contention set is rethrown
+ * without waiting at all: retrying a fault that will not clear only delays it.
+ */
+export async function renameOverOpenReaders(
+   staging: string,
+   destination: string,
+   options: RenameOverOpenReadersOptions = {}
+): Promise<void> {
+   const rename = options.rename ?? fsp.rename;
+   const deadline = Date.now() + (options.budgetMs ?? RENAME_BUDGET_MS);
+   for (let attempt = 0; ; attempt++) {
+      try {
+         await rename(staging, destination);
+         return;
+      } catch (err: unknown) {
+         const code = err instanceof Error && 'code' in err ? String((err as NodeJS.ErrnoException).code) : undefined;
+         if (code === undefined || !RENAME_CONTENTION_CODES.has(code) || Date.now() >= deadline) {
+            throw err;
+         }
+         // Backs off to keep a long contention window from spinning, capped so
+         // a late attempt still lands promptly once the handle is released.
+         await new Promise(resolve => setTimeout(resolve, Math.min(2 ** attempt, 50)));
+      }
+   }
+}

package/src/node/socket-launcher.ts

@@ -7,9 +7,8 @@
  * SPDX-License-Identifier: MIT
  ********************************************************************************/
 
-import { Deferred } from '@hydranium/langium';
 import * as net from 'node:net';
-import type { Disposable, Logger } from '@hydranium/protocol';
+import { Deferred, type Disposable, type Logger } from '@hydranium/protocol';
 import { createMessageConnection, SocketMessageReader, SocketMessageWriter } from 'vscode-jsonrpc/node';
 import type { MessageConnection } from 'vscode-jsonrpc';
 import type { IntegratedServer } from '../launcher/integrated-server.js';
@@ -24,6 +23,21 @@ export interface SocketServerOptions {
     * resolves (only then is the address info available).
     */
    readonly port?: number;
+   /**
+    * Interface to bind. Default `'127.0.0.1'` (LOCAL ONLY) — a head whose
+    * port is OS-assigned and announced over the LSP connection is
+    * reachable only by a client on the same machine anyway, so a wider
+    * binding exposes a port nothing off-box can address. Matches
+    * `startGlspServer`'s default, so the two socket heads agree.
+    *
+    * Pass `'::'` for every interface: that is the dual-stack any-address,
+    * so both IPv4 and IPv6 clients connect. `'0.0.0.0'` is NOT the same —
+    * it takes IPv4 only and refuses `::1`.
+    *
+    * An address no local interface holds fails the bind, so `started`
+    * rejects with `EADDRNOTAVAIL` rather than falling back to a wider one.
+    */
+   readonly host?: string;
    /**
     * Optional logger. If omitted, the launcher runs silently — the
     * adopter is expected to surface lifecycle events through their own
@@ -88,6 +102,7 @@ export interface StartedSocketServer extends IntegratedServer {
  */
 export function startSocketServer(options: SocketServerOptions, onClientConnection: OnClientConnection): StartedSocketServer {
    const port = options.port ?? 0;
+   const host = options.host ?? '127.0.0.1';
    const logger = options.logger;
    const tag = options.logTag ?? 'SocketServer';
    const started = new Deferred<void>();
@@ -128,7 +143,7 @@ export function startSocketServer(options: SocketServerOptions, onClientConnecti
       connection.listen();
    });
 
-   netServer.listen(port);
+   netServer.listen(port, host);
    netServer.on('listening', () => {
       const addressInfo = netServer.address();
       if (!addressInfo) {
@@ -144,7 +159,7 @@ export function startSocketServer(options: SocketServerOptions, onClientConnecti
          return;
       }
       handle.port = addressInfo.port;
-      logger?.info(`[${tag}] Ready to accept new client requests on port: ${addressInfo.port}`);
+      logger?.info(`[${tag}] Ready to accept new client requests on ${addressInfo.address} port: ${addressInfo.port}`);
       started.resolve();
    });
    netServer.on('error', err => {

package/src/node/stdio-launcher.ts

@@ -7,8 +7,7 @@
  * SPDX-License-Identifier: MIT
  ********************************************************************************/
 
-import { Deferred } from '@hydranium/langium';
-import type { Disposable, Logger } from '@hydranium/protocol';
+import { Deferred, type Disposable, type Logger } from '@hydranium/protocol';
 import type { MessageConnection } from 'vscode-jsonrpc';
 import { createMessageConnection, StreamMessageReader, StreamMessageWriter } from 'vscode-jsonrpc/node';
 import type { IntegratedServer } from '../launcher/integrated-server.js';

package/src/testing/fake-document.ts

@@ -7,7 +7,9 @@
  * SPDX-License-Identifier: MIT
  ********************************************************************************/
 
-import { DocumentState, type AstNode, type LangiumDocument, UriUtils, type URI } from '@hydranium/langium';
+import { DocumentState, type AstNode, type AstReflection, type LangiumDocument, UriUtils, type URI } from '@hydranium/langium';
+import { buildAstNode } from '../langium/ast-extension/ast-node-builder.js';
+import { type AstDiagnostic } from '../langium/validation/document-validator.js';
 
 /**
  * Build a typed AST-node fixture for unit tests.
@@ -23,12 +25,29 @@ import { DocumentState, type AstNode, type LangiumDocument, UriUtils, type URI }
  * framework synthetic node, and marking it would change scope/index behaviour.
  * A test that wants a genuine synthetic node calls `markSynthetic` explicitly.
  *
+ * **Without a `reflection`, the fixture carries only what the test spells out**,
+ * which is a shape production never produces: a parsed or built node always has
+ * its grammar-declared containment arrays, so a fixture that omits one lets a
+ * test pass against an impossible node, and lets code that walks a list crash
+ * only under test. Pass the grammar's reflection whenever the type is a real
+ * one and the code under test reads a collection off it. Fixtures typed against
+ * ad-hoc names have no reflection to pass and keep the plain form.
+ *
  * @param node the node shape — `$type` is required; every other property is a
  *   value the test cares about (`$container`, cross-reference values, internal
- *   `_id` fields, …). The object is returned by reference, not copied.
+ *   `_id` fields, …).
+ * @param reflection when given, pre-fills the grammar's declared defaults the
+ *   same way {@link buildAstNode} does, and the result is a fresh object rather
+ *   than `node` itself. Omitted, `node` is returned by reference.
  */
-export function makeFakeAstNode<TAst extends AstNode = AstNode>(node: { $type: string } & Record<string, unknown>): TAst {
-   return node as unknown as TAst;
+export function makeFakeAstNode<TAst extends AstNode = AstNode>(
+   node: { $type: string } & Record<string, unknown>,
+   reflection?: AstReflection
+): TAst {
+   if (!reflection) {
+      return node as unknown as TAst;
+   }
+   return buildAstNode<TAst>(reflection, node.$type, node);
 }
 
 /**
@@ -86,7 +105,7 @@ function stringifyFakeRoot(root: unknown): string {
  * staging. Override via `options.state` for tests that gate on earlier
  * phases.
  */
-export function makeFakeDocument<TAst extends AstNode = AstNode, TDiagnostic = unknown>(
+export function makeFakeDocument<TAst extends AstNode = AstNode, TDiagnostic extends AstDiagnostic = AstDiagnostic>(
    uri: string | URI,
    root: TAst,
    options: FakeDocumentOptions<TAst, TDiagnostic> = {}

package/src/testing/make-noop-shared-services.ts

@@ -9,6 +9,8 @@
 
 import { type Clock, DefaultTracer, type Logger, NoopLogger, SystemClock, type Tracer } from '@hydranium/protocol';
 import type { ServerSharedServicesMinimal } from '../langium/shared-services.js';
+import { DefaultServerLocale, type ServerLocale } from '../locale/server-locale.js';
+import { DefaultMessageRenderer, type MessageRenderer } from '../messages/renderer.js';
 
 /**
  * Overrides for {@link makeNoopSharedServices}. The three observability slots
@@ -29,6 +31,18 @@ export interface NoopSharedServicesOverrides {
    Logger?: Logger;
    /** Bound on the top-level `Tracer` slot. Default: a `DefaultTracer` over `Logger` + `Clock`. */
    Tracer?: Tracer;
+   /** Factory for the `ServerLocale` slot. Default: a real one, reporting no locale. */
+   ServerLocale?: (services: ServerSharedServicesMinimal) => ServerLocale;
+   /**
+    * Factory for the `MessageRenderer` slot. Default: the real
+    * {@link DefaultMessageRenderer}, whose no-catalogue behaviour is a
+    * pass-through — so the default is the framework's own behaviour, not a stub.
+    *
+    * A factory rather than an instance, because a renderer reads the tree it is
+    * bound into. Both slots are resolved lazily, so an override is honoured
+    * however late the caller reads them.
+    */
+   MessageRenderer?: (services: ServerSharedServicesMinimal) => MessageRenderer;
    /** Per-slot `workspace` overrides. Slots left out resolve to `undefined`. */
    workspace?: Record<string, unknown>;
    /** Any other minimal slot (`ServiceRegistry`, `AstReflection`, `additionalDocuments`, …). */
@@ -63,11 +77,21 @@ export interface NoopSharedServicesOverrides {
 export function makeNoopSharedServices<T extends ServerSharedServicesMinimal = ServerSharedServicesMinimal>(
    overrides: NoopSharedServicesOverrides = {}
 ): T {
-   const { Clock: clock, Logger: logger, Tracer: tracer, workspace, additionalDocuments, ...restTop } = overrides;
+   const {
+      Clock: clock,
+      Logger: logger,
+      Tracer: tracer,
+      ServerLocale: serverLocale,
+      MessageRenderer: messageRenderer,
+      workspace,
+      additionalDocuments,
+      ...restTop
+   } = overrides;
    const resolvedClock = clock ?? new SystemClock();
    const resolvedLogger = logger ?? new NoopLogger();
    const resolvedTracer = tracer ?? new DefaultTracer(resolvedLogger, resolvedClock);
-   return {
+   // Assembled in two steps, because both defaults read the tree they belong to.
+   const services = {
       Clock: resolvedClock,
       Logger: resolvedLogger,
       Tracer: resolvedTracer,
@@ -75,4 +99,28 @@ export function makeNoopSharedServices<T extends ServerSharedServicesMinimal = S
       ...restTop,
       workspace: { ...(workspace ?? {}) }
    } as unknown as T;
+   // Lazy, like Langium's own per-slot construction — and load-bearing here:
+   // both services emit an `instantiated` trace, so building them eagerly puts
+   // two lines into the capture of every test that passes a capturing logger
+   // and asserts on emptiness.
+   defineLazySlot(services, 'ServerLocale', () => serverLocale?.(services) ?? new DefaultServerLocale(services));
+   defineLazySlot(services, 'MessageRenderer', () => messageRenderer?.(services) ?? new DefaultMessageRenderer(services));
+   return services;
+}
+
+/** Install `name` as a memoized getter, so nothing is constructed until it is read. */
+function defineLazySlot(target: object, name: string, create: () => unknown): void {
+   let resolved: unknown;
+   let built = false;
+   Object.defineProperty(target, name, {
+      configurable: true,
+      enumerable: true,
+      get: () => {
+         if (!built) {
+            resolved = create();
+            built = true;
+         }
+         return resolved;
+      }
+   });
 }