@hydranium/core 1.0.0-next.5 → 1.0.0-next.50

package/src/messages/renderer.ts

@@ -0,0 +1,204 @@
+/********************************************************************************
+ * Copyright (c) 2026 CrossBreeze, EclipseSource and others.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the MIT License which is available in the project root.
+ *
+ * SPDX-License-Identifier: MIT
+ ********************************************************************************/
+
+import {
+   describeError,
+   renderFrameworkMessage,
+   resolve,
+   resolvedFromResponseError,
+   type MessageDefinition,
+   type ParamsArg,
+   type ResolvedMessage,
+   type Tracer
+} from '@hydranium/protocol';
+import { SimpleCache } from '@hydranium/langium';
+import type { ResponseError } from 'vscode-jsonrpc';
+import { Diagnostic } from 'vscode-languageserver-protocol';
+import { type LogNameOptions } from '../langium/diagnostics/logger.js';
+import type { ServerSharedServicesMinimal } from '../langium/shared-services.js';
+import type { ServerLocale } from '../locale/server-locale.js';
+import { resolvedFromDiagnostic } from './carriers.js';
+
+/** Construction options for {@link DefaultMessageRenderer}. */
+export type MessageRendererOptions = LogNameOptions;
+
+/**
+ * The render contract the `MessageRenderer` slot holds, implemented by
+ * {@link DefaultMessageRenderer}.
+ *
+ * An interface rather than the class, so the slot is compared STRUCTURALLY. A
+ * class-typed slot carries its `protected` members into every assignability
+ * check and TypeScript compares those nominally — which makes the slot
+ * unsatisfiable by a subclass declared against a second physical copy of this
+ * package, which any duplicated install produces. It also
+ * lets an adopter REPLACE this declaration rather than intersect with it, so
+ * slot resolution does not depend on the order a services type is written in.
+ *
+ * Every method carries a no-throw contract; see the implementation.
+ */
+export interface MessageRenderer {
+   renderDiagnostic(diagnostic: Diagnostic): string;
+   renderError(error: ResponseError<unknown>): string;
+   renderMessage<S extends string>(message: MessageDefinition<S>, ...params: ParamsArg<S>): string;
+}
+
+/**
+ * Renders every user-facing message the server sends, in the locale the server
+ * was handed at init. The framework ships no catalogue, so its own behaviour is
+ * a pass-through.
+ *
+ * Adopters override {@link translationsFor}: the public render methods carry
+ * the no-throw contract, and the catalogue lookup they wrap is what can fail.
+ *
+ * Two render methods rather than one, because what is useful to an adopter is
+ * the carrier's structured fields and the two carriers have different ones. A
+ * single `render(text)` would force an adopter to match English prose, which
+ * breaks on the first Langium reword.
+ */
+export class DefaultMessageRenderer implements MessageRenderer {
+   protected readonly tracer: Tracer;
+   protected readonly serverLocale: ServerLocale;
+   /**
+    * {@link translationsFor}'s answer per locale, `undefined` answers included —
+    * a `SimpleCache` distinguishes "absent" from "cached as none", which matters
+    * because shipping no catalogue is the framework's own hot path.
+    *
+    * `SimpleCache` rather than Langium's `WorkspaceCache`: the eviction axis
+    * there is document change, and a catalogue does not depend on documents, so
+    * it would evict on every build AND put a `DocumentBuilder` dependency on a
+    * service the shared tier declares free of one. Nothing evicts this: the
+    * locale arrives once per process. A subclass whose catalogue can change
+    * clears it.
+    */
+   protected readonly catalogues = new SimpleCache<string | undefined, Record<string, string> | undefined>();
+
+   constructor(services: ServerSharedServicesMinimal, options: MessageRendererOptions = {}) {
+      this.serverLocale = services.ServerLocale;
+      this.tracer = services.Tracer.for(options.logName ?? 'MessageRenderer').trace('instantiated');
+   }
+
+   /**
+    * The sentence to publish for `diagnostic`, replacing its current `message`.
+    * Sees lexer and parser errors too, which Langium pushes onto the document
+    * without routing them through `toDiagnostic`.
+    *
+    * **Must not throw**, which is why the guard is here and not at the call
+    * site: this runs inside the `Validated` phase, and Langium's
+    * `notifyDocumentPhase` rethrows anything that is not a cancellation — so an
+    * escaping error leaves the document AT `Validated` with the phase's
+    * listeners never run, and the client receives no diagnostics for that file.
+    * A subclass overriding this method takes that contract on itself.
+    */
+   renderDiagnostic(diagnostic: Diagnostic): string {
+      try {
+         const resolved = resolvedFromDiagnostic(diagnostic);
+         return resolved ? this.render(resolved) : Diagnostic.getMessageString(diagnostic);
+      } catch (err: unknown) {
+         this.reportFailure(err, 'a diagnostic');
+         return Diagnostic.getMessageString(diagnostic);
+      }
+   }
+
+   /**
+    * The sentence to send for `error`, replacing its current `message`. Same
+    * no-throw contract as {@link renderDiagnostic}: an escaping error replaces a
+    * typed rejection the caller can handle with one it cannot.
+    */
+   renderError(error: ResponseError<unknown>): string {
+      try {
+         const resolved = resolvedFromResponseError(error);
+         return resolved ? this.render(resolved) : error.message;
+      } catch (err: unknown) {
+         this.reportFailure(err, 'an RPC error');
+         return error.message;
+      }
+   }
+
+   /**
+    * The sentence for a declaration the caller holds directly, for a carrier
+    * with no slot to put an identity in.
+    *
+    * GLSP's action protocol is the case: every member of its message, status
+    * and reject actions is prose or an enum, so a code cannot travel and the
+    * raise site is the last place that still knows which message this is.
+    * Prefer {@link renderDiagnostic} / {@link renderError} wherever a carrier
+    * does hold the identity — they keep the render off the raise site, so an
+    * adopter's own messages ride the same one binding.
+    *
+    * Same no-throw contract as the carrier methods.
+    */
+   renderMessage<S extends string>(message: MessageDefinition<S>, ...params: ParamsArg<S>): string {
+      // `resolve` is inside the guard with the render, not before it: it calls
+      // the declaration's own `format`, which for an adopter declaration is
+      // arbitrary code, and a throw there would escape a method whose contract
+      // says it cannot.
+      let resolved: ResolvedMessage | undefined;
+      try {
+         resolved = resolve(message, ...params);
+         return this.render(resolved);
+      } catch (err: unknown) {
+         this.reportFailure(err, `the message '${message.code}'`);
+         // Unset only when `format` ITSELF threw, which leaves the
+         // uninterpolated template as the only text there is. A failed render
+         // still has the resolved English.
+         return resolved?.text ?? message.text;
+      }
+   }
+
+   /**
+    * The catalogue for the current locale, or `undefined` for none — the
+    * framework's answer, shipping none. Overriding this leaves every identity
+    * decision, every pass-through and the no-throw guard in place.
+    *
+    * **Called once per locale, not once per message**, so an override may load
+    * a file or build a map without that cost landing per diagnostic. The
+    * corollary is that a catalogue mutated in place afterwards is not seen;
+    * clear {@link catalogues} to invalidate.
+    *
+    * An adopter wanting Langium's own uncoded sentences instead matches
+    * `Diagnostic.data.code` from an overridden {@link renderDiagnostic}, never
+    * the sentence.
+    */
+   protected translationsFor(_locale: string | undefined): Record<string, string> | undefined {
+      return undefined;
+   }
+
+   /**
+    * Resolve one identity against the current locale's catalogue.
+    *
+    * Reads the locale per call. Copying it into a field at construction pins
+    * whatever was there before init ran, which is always `undefined` — services
+    * compose first.
+    *
+    * The catalogue behind it is memoized, because a workspace-wide validation
+    * renders once per diagnostic and the naive override — parse a JSON file,
+    * build a map — then pays that per diagnostic rather than per locale.
+    */
+   protected render(message: ResolvedMessage): string {
+      const locale = this.serverLocale.value;
+      return renderFrameworkMessage(
+         message,
+         this.catalogues.get(locale, () => this.translationsFor(locale))
+      );
+   }
+
+   /**
+    * Emit a failed render. Logged rather than swallowed: the fallback output is
+    * byte-identical to a correctly-configured default, so a throwing catalogue
+    * is otherwise invisible.
+    */
+   protected reportFailure(err: unknown, carrier: string): void {
+      this.tracer.error(this.formatRenderFailure(err, carrier));
+   }
+
+   /** Format the failed-render line. Override to name the adopter's catalogue entry. */
+   protected formatRenderFailure(err: unknown, carrier: string): string {
+      return `rendering ${carrier} failed; falling back to the server's own text. ${describeError(err)}`;
+   }
+}

package/src/node/node-file-system-provider.ts

@@ -15,6 +15,7 @@ import { realpathSync } from 'node:fs';
 import * as fsp from 'node:fs/promises';
 import { type WritableFileSystemProvider } from '../documents/ast-document-manager.js';
 import { type SelfSaveRegistry } from '../documents/self-save-registry.js';
+import { renameOverOpenReaders } from './rename-over-open-readers.js';
 import { type LogNameOptions } from '../langium/diagnostics/logger.js';
 import { serverSharedFactory, type ServerSharedServicesMinimal } from '../langium/shared-services.js';
 import { serveVirtualDocument } from '../langium/workspace/virtual-document.js';
@@ -195,47 +196,6 @@ async function replacedFile(path: string): Promise<ReplacedFile | undefined> {
    }
 }
 
-/**
- * Errno values a rename reports on Windows when another handle holds the
- * destination open. POSIX renames are unaffected by open handles, so this
- * cannot fire there and the retry below costs nothing.
- */
-const RENAME_CONTENTION_CODES = new Set(['EPERM', 'EACCES', 'EBUSY']);
-
-/**
- * `rename` the staged content over `destination`, retrying while Windows
- * reports the destination as held open.
- *
- * The staging file exists so a reader never sees a half-written file, and on
- * Windows the very presence of that reader is what makes the replacing rename
- * fail — so the indivisible write breaks under exactly the contention it was
- * built for, and it breaks intermittently, which is worse than never working.
- * A reader's handle is released in milliseconds, so waiting turns a spurious
- * failure into a slightly later success.
- *
- * BOUNDED, not open-ended: a genuine permission fault raises the same errno and
- * is distinguishable from contention only by never clearing, so an unbounded
- * wait would convert a hard error into a hang. Exhausting the budget rethrows
- * the last failure, leaving the caller's cleanup and error contract unchanged.
- */
-async function renameOverOpenReaders(staging: string, destination: string): Promise<void> {
-   const deadline = Date.now() + 2_000;
-   for (let attempt = 0; ; attempt++) {
-      try {
-         await fsp.rename(staging, destination);
-         return;
-      } catch (err: unknown) {
-         const code = err instanceof Error && 'code' in err ? String((err as NodeJS.ErrnoException).code) : undefined;
-         if (code === undefined || !RENAME_CONTENTION_CODES.has(code) || Date.now() >= deadline) {
-            throw err;
-         }
-         // Backs off to keep a long contention window from spinning, capped so
-         // a late attempt still lands promptly once the handle is released.
-         await new Promise(resolve => setTimeout(resolve, Math.min(2 ** attempt, 50)));
-      }
-   }
-}
-
 /**
  * Module fragment that binds the writable Node {@link DefaultFileSystemProvider},
  * spread into the services context on a Node host.

package/src/node/profiling-run.ts

@@ -97,7 +97,7 @@ export class ProfilingRun {
       // `HYDRANIUM_LOG_FILE` env, which every `@hydranium/core` copy reads when
       // its logger is CONSTRUCTED — so `ProfilingRun.start` must run before the
       // head's services are created (as `measureModelMemory` does). This is the
-      // only mechanism that crosses a yalc'd adopter's separate core copy; a
+      // only mechanism that crosses an adopter's separate core copy; a
       // process-local `setLogFilePath` would only reach this module's own copy.
       this.previousLogFileEnv = process.env[DEFAULT_LOG_FILE_ENV];
       process.env[DEFAULT_LOG_FILE_ENV] = this.serverLogPath;

package/src/node/rename-over-open-readers.ts

@@ -0,0 +1,78 @@
+/********************************************************************************
+ * Copyright (c) 2026 CrossBreeze, EclipseSource and others.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the MIT License which is available in the project root.
+ *
+ * SPDX-License-Identifier: MIT
+ ********************************************************************************/
+
+import * as fsp from 'node:fs/promises';
+
+/**
+ * Errnos Windows raises when a replacing `rename` meets a handle already on the
+ * destination open. POSIX renames are unaffected by open handles, so these
+ * cannot fire there and the retry below costs nothing.
+ */
+export const RENAME_CONTENTION_CODES = new Set(['EPERM', 'EACCES', 'EBUSY']);
+
+/**
+ * How long a replacing rename may keep retrying before it gives up.
+ *
+ * BOUNDED, not open-ended: a genuine permission fault raises the same errno as
+ * contention and is distinguishable from it only by never clearing, so an
+ * unbounded wait would convert a hard error into a hang.
+ *
+ * The figure is a judgement, not a measurement, and the honest bound on it is
+ * that the previous 2s was observed EXHAUSTED on a loaded Windows CI runner
+ * while no upper bound has been established. What would settle it is recording
+ * how long a real contended rename takes to clear. graceful-fs tolerates 60s
+ * for Windows rename contention, but that is weaker support than it looks: it
+ * retries only where the destination has GONE, which is the opposite of
+ * replacing one a reader holds open.
+ */
+export const RENAME_BUDGET_MS = 10_000;
+
+/** Seams for the test, which cannot make a real rename fail on demand. */
+export interface RenameOverOpenReadersOptions {
+   readonly rename?: (from: string, to: string) => Promise<void>;
+   readonly budgetMs?: number;
+}
+
+/**
+ * `rename` the staged content over `destination`, retrying while Windows
+ * reports the destination as held open.
+ *
+ * The staging file exists so a reader never sees a half-written file, and on
+ * Windows the very presence of that reader is what makes the replacing rename
+ * fail — so the indivisible write breaks under exactly the contention it was
+ * built for, and it breaks intermittently, which is worse than never working.
+ * A reader's handle is released in milliseconds, so waiting turns a spurious
+ * failure into a slightly later success.
+ *
+ * Exhausting the budget rethrows the last failure, leaving the caller's cleanup
+ * and error contract unchanged. An errno OUTSIDE the contention set is rethrown
+ * without waiting at all: retrying a fault that will not clear only delays it.
+ */
+export async function renameOverOpenReaders(
+   staging: string,
+   destination: string,
+   options: RenameOverOpenReadersOptions = {}
+): Promise<void> {
+   const rename = options.rename ?? fsp.rename;
+   const deadline = Date.now() + (options.budgetMs ?? RENAME_BUDGET_MS);
+   for (let attempt = 0; ; attempt++) {
+      try {
+         await rename(staging, destination);
+         return;
+      } catch (err: unknown) {
+         const code = err instanceof Error && 'code' in err ? String((err as NodeJS.ErrnoException).code) : undefined;
+         if (code === undefined || !RENAME_CONTENTION_CODES.has(code) || Date.now() >= deadline) {
+            throw err;
+         }
+         // Backs off to keep a long contention window from spinning, capped so
+         // a late attempt still lands promptly once the handle is released.
+         await new Promise(resolve => setTimeout(resolve, Math.min(2 ** attempt, 50)));
+      }
+   }
+}

package/src/testing/fake-document.ts

@@ -7,7 +7,8 @@
  * SPDX-License-Identifier: MIT
  ********************************************************************************/
 
-import { DocumentState, type AstNode, type LangiumDocument, UriUtils, type URI } from '@hydranium/langium';
+import { DocumentState, type AstNode, type AstReflection, type LangiumDocument, UriUtils, type URI } from '@hydranium/langium';
+import { buildAstNode } from '../langium/ast-extension/ast-node-builder.js';
 
 /**
  * Build a typed AST-node fixture for unit tests.
@@ -23,12 +24,29 @@ import { DocumentState, type AstNode, type LangiumDocument, UriUtils, type URI }
  * framework synthetic node, and marking it would change scope/index behaviour.
  * A test that wants a genuine synthetic node calls `markSynthetic` explicitly.
  *
+ * **Without a `reflection`, the fixture carries only what the test spells out**,
+ * which is a shape production never produces: a parsed or built node always has
+ * its grammar-declared containment arrays, so a fixture that omits one lets a
+ * test pass against an impossible node, and lets code that walks a list crash
+ * only under test. Pass the grammar's reflection whenever the type is a real
+ * one and the code under test reads a collection off it. Fixtures typed against
+ * ad-hoc names have no reflection to pass and keep the plain form.
+ *
  * @param node the node shape — `$type` is required; every other property is a
  *   value the test cares about (`$container`, cross-reference values, internal
- *   `_id` fields, …). The object is returned by reference, not copied.
+ *   `_id` fields, …).
+ * @param reflection when given, pre-fills the grammar's declared defaults the
+ *   same way {@link buildAstNode} does, and the result is a fresh object rather
+ *   than `node` itself. Omitted, `node` is returned by reference.
  */
-export function makeFakeAstNode<TAst extends AstNode = AstNode>(node: { $type: string } & Record<string, unknown>): TAst {
-   return node as unknown as TAst;
+export function makeFakeAstNode<TAst extends AstNode = AstNode>(
+   node: { $type: string } & Record<string, unknown>,
+   reflection?: AstReflection
+): TAst {
+   if (!reflection) {
+      return node as unknown as TAst;
+   }
+   return buildAstNode<TAst>(reflection, node.$type, node);
 }
 
 /**

package/src/testing/make-noop-shared-services.ts

@@ -9,6 +9,8 @@
 
 import { type Clock, DefaultTracer, type Logger, NoopLogger, SystemClock, type Tracer } from '@hydranium/protocol';
 import type { ServerSharedServicesMinimal } from '../langium/shared-services.js';
+import { DefaultServerLocale, type ServerLocale } from '../locale/server-locale.js';
+import { DefaultMessageRenderer, type MessageRenderer } from '../messages/renderer.js';
 
 /**
  * Overrides for {@link makeNoopSharedServices}. The three observability slots
@@ -29,6 +31,18 @@ export interface NoopSharedServicesOverrides {
    Logger?: Logger;
    /** Bound on the top-level `Tracer` slot. Default: a `DefaultTracer` over `Logger` + `Clock`. */
    Tracer?: Tracer;
+   /** Factory for the `ServerLocale` slot. Default: a real one, reporting no locale. */
+   ServerLocale?: (services: ServerSharedServicesMinimal) => ServerLocale;
+   /**
+    * Factory for the `MessageRenderer` slot. Default: the real
+    * {@link DefaultMessageRenderer}, whose no-catalogue behaviour is a
+    * pass-through — so the default is the framework's own behaviour, not a stub.
+    *
+    * A factory rather than an instance, because a renderer reads the tree it is
+    * bound into. Both slots are resolved lazily, so an override is honoured
+    * however late the caller reads them.
+    */
+   MessageRenderer?: (services: ServerSharedServicesMinimal) => MessageRenderer;
    /** Per-slot `workspace` overrides. Slots left out resolve to `undefined`. */
    workspace?: Record<string, unknown>;
    /** Any other minimal slot (`ServiceRegistry`, `AstReflection`, `additionalDocuments`, …). */
@@ -63,11 +77,21 @@ export interface NoopSharedServicesOverrides {
 export function makeNoopSharedServices<T extends ServerSharedServicesMinimal = ServerSharedServicesMinimal>(
    overrides: NoopSharedServicesOverrides = {}
 ): T {
-   const { Clock: clock, Logger: logger, Tracer: tracer, workspace, additionalDocuments, ...restTop } = overrides;
+   const {
+      Clock: clock,
+      Logger: logger,
+      Tracer: tracer,
+      ServerLocale: serverLocale,
+      MessageRenderer: messageRenderer,
+      workspace,
+      additionalDocuments,
+      ...restTop
+   } = overrides;
    const resolvedClock = clock ?? new SystemClock();
    const resolvedLogger = logger ?? new NoopLogger();
    const resolvedTracer = tracer ?? new DefaultTracer(resolvedLogger, resolvedClock);
-   return {
+   // Assembled in two steps, because both defaults read the tree they belong to.
+   const services = {
       Clock: resolvedClock,
       Logger: resolvedLogger,
       Tracer: resolvedTracer,
@@ -75,4 +99,28 @@ export function makeNoopSharedServices<T extends ServerSharedServicesMinimal = S
       ...restTop,
       workspace: { ...(workspace ?? {}) }
    } as unknown as T;
+   // Lazy, like Langium's own per-slot construction — and load-bearing here:
+   // both services emit an `instantiated` trace, so building them eagerly puts
+   // two lines into the capture of every test that passes a capturing logger
+   // and asserts on emptiness.
+   defineLazySlot(services, 'ServerLocale', () => serverLocale?.(services) ?? new DefaultServerLocale(services));
+   defineLazySlot(services, 'MessageRenderer', () => messageRenderer?.(services) ?? new DefaultMessageRenderer(services));
+   return services;
+}
+
+/** Install `name` as a memoized getter, so nothing is constructed until it is read. */
+function defineLazySlot(target: object, name: string, create: () => unknown): void {
+   let resolved: unknown;
+   let built = false;
+   Object.defineProperty(target, name, {
+      configurable: true,
+      enumerable: true,
+      get: () => {
+         if (!built) {
+            resolved = create();
+            built = true;
+         }
+         return resolved;
+      }
+   });
 }

package/src/testing/make-test-services.ts

@@ -18,11 +18,13 @@ import {
    type TransferDiagnostic,
    type TransferElement
 } from '@hydranium/protocol';
+import { DefaultServerLocale, type ServerLocale } from '../locale/server-locale.js';
+import { DefaultMessageRenderer, type MessageRenderer } from '../messages/renderer.js';
 import type { Harness } from '@hydranium/protocol/testing';
 import { type AstNode, type AstNodeDescription, type WorkspaceLock } from '@hydranium/langium';
 import type { ModelService, ModelServiceOptions } from '../langium/model-service/model-service.js';
 import type { ServerSharedServices } from '../langium/module.js';
-import { TransferEncoder } from '../langium/transfer/transfer-encoder.js';
+import { DefaultTransferEncoder, type TransferEncoder } from '../langium/transfer/transfer-encoder.js';
 import { DefaultDocumentUriPolicy, type DocumentUriPolicy } from '../langium/workspace/document-uri-policy.js';
 import { HydraniumWorkspaceLock } from '../langium/workspace/hydranium-workspace-lock.js';
 import type { FakeDocumentOptions } from './fake-document.js';
@@ -90,9 +92,18 @@ export interface TestSharedServices<
       WorkspaceLock: WorkspaceLock;
    };
    readonly model: {
-      TransferEncoder: TransferEncoder<unknown, TDiagnostic>;
+      TransferEncoder: TransferEncoder<TDiagnostic>;
       ModelService: ModelService<TAst, TDiagnostic, TTransfer>;
    };
+   /**
+    * The REAL services, not stubs — the framework renderer's no-catalogue
+    * behaviour is a pass-through, so the stub tree agrees with a production one
+    * unless a test installs a catalogue. Bound rather than omitted because
+    * `HydraniumDocumentBuilder` renders through the renderer on every
+    * `Validated` phase, where an omitted slot is a `TypeError`.
+    */
+   readonly ServerLocale: ServerLocale;
+   readonly MessageRenderer: MessageRenderer;
 }
 
 /** Optional configuration for {@link makeTestServices}. */
@@ -112,6 +123,14 @@ export interface MakeTestServicesOptions<
     * for tests that don't assert on the produced text.
     */
    serialize?: (uri: string, root: TTransfer) => string;
+   /**
+    * Renderer bound on `MessageRenderer`. Default: the framework's own, which
+    * passes every sentence through unchanged. Supply one to install a catalogue
+    * or to drive the throwing path.
+    */
+   messageRenderer?: (services: ServerSharedServices<TProject>) => MessageRenderer;
+   /** Locale handed to the bundle's {@link ServerLocale}. Default: none, i.e. the framework's English. */
+   locale?: string;
    /**
     * Languages to register on a {@link StubServiceRegistry} bound on the
     * `ServiceRegistry` slot. This is how a test gets multi-language routing:
@@ -187,7 +206,7 @@ export interface MakeTestServicesOptions<
     * Override the {@link TransferEncoder} factory. Default: framework
     * {@link TransferEncoder} with no overrides.
     */
-   transferEncoder?: (services: ServerSharedServices<TProject>) => TransferEncoder<unknown, TDiagnostic>;
+   transferEncoder?: (services: ServerSharedServices<TProject>) => TransferEncoder<TDiagnostic>;
 }
 
 /**
@@ -229,10 +248,18 @@ export interface TestServicesBundle<
     */
    readonly indexManager: StubIndexManager | undefined;
    readonly modelService: ModelService<TAst, TDiagnostic, TTransfer>;
-   readonly transferEncoder: TransferEncoder<unknown, TDiagnostic>;
+   readonly transferEncoder: TransferEncoder<TDiagnostic>;
    readonly logger: Logger;
    /** The clock bound on the `Clock` slot — a `makeFakeClock()` if one was passed. */
    readonly clock: Clock;
+   /**
+    * The service bound on `ServerLocale`, so a test can hand over a locale
+    * mid-run — which is also how it verifies the renderer reads the locale per
+    * render rather than caching it at construction.
+    */
+   readonly serverLocale: ServerLocale;
+   /** The renderer bound on `MessageRenderer` — the framework's own unless one was supplied. */
+   readonly messageRenderer: MessageRenderer;
 }
 
 /**
@@ -311,20 +338,33 @@ export function makeTestServices<
          ...(indexManager ? { IndexManager: indexManager } : {}),
          WorkspaceLock: new HydraniumWorkspaceLock()
       },
-      model: {} as TestSharedServices<TAst, TDiagnostic, TTransfer, TProject>['model']
+      model: {} as TestSharedServices<TAst, TDiagnostic, TTransfer, TProject>['model'],
+      ServerLocale: {} as ServerLocale,
+      MessageRenderer: {} as DefaultMessageRenderer
    };
    const sharedServices = services as unknown as ServerSharedServices<TProject>;
 
+   // Patched in after the literal, like `model` below: both read the tree they
+   // belong to, and the renderer reads the locale service.
+   const mutableMessages = services as { ServerLocale: ServerLocale; MessageRenderer: MessageRenderer };
+   const serverLocale = new DefaultServerLocale(sharedServices);
+   if (options.locale) {
+      serverLocale.accept(options.locale);
+   }
+   mutableMessages.ServerLocale = serverLocale;
+   const messageRenderer = options.messageRenderer?.(sharedServices) ?? new DefaultMessageRenderer(sharedServices);
+   mutableMessages.MessageRenderer = messageRenderer;
+
    const serialize = options.serialize ?? ((_uri: string, root: TTransfer) => JSON.stringify(root));
    const transferEncoder = options.transferEncoder
       ? options.transferEncoder(sharedServices)
-      : new TransferEncoder<unknown, TDiagnostic>(sharedServices);
+      : new DefaultTransferEncoder<unknown, TDiagnostic>(sharedServices);
    const modelService = options.modelService
       ? options.modelService(sharedServices)
       : makeStubModelService<TAst, TDiagnostic, TTransfer>(sharedServices, serialize, options.modelServiceOptions);
 
    const mutableModel = services.model as {
-      TransferEncoder: TransferEncoder<unknown, TDiagnostic>;
+      TransferEncoder: TransferEncoder<TDiagnostic>;
       ModelService: ModelService<TAst, TDiagnostic, TTransfer>;
    };
    mutableModel.TransferEncoder = transferEncoder;
@@ -346,6 +386,8 @@ export function makeTestServices<
       transferEncoder,
       logger,
       clock,
+      serverLocale,
+      messageRenderer,
       dispose: () => {
          // No-op: the bundled stubs hold only in-memory state (maps, arrays),
          // released with the bundle when it goes out of scope. The hook exists

package/src/testing/node/spawned-server.ts

@@ -203,6 +203,37 @@ export interface SpawnedServer extends Harness {
    dispose(): Promise<number | null>;
 }
 
+/**
+ * Every server started and not yet disposed, so {@link disposeSpawnedServers}
+ * can reach one a test forgot.
+ *
+ * Holds the server — and through it the `ChildProcess` — rather than a pid. A
+ * pid identifies a process only while that process is alive: once it exits the
+ * OS may reissue the number, and Windows does so within seconds. A teardown
+ * that signalled a recorded pid would therefore reach whatever holds it now,
+ * which on a concurrent build is another task's compiler or test runner.
+ */
+const liveServers = new Set<SpawnedServer>();
+
+/**
+ * Terminate every server this module started that has not been disposed, and
+ * forget them.
+ *
+ * Safe to call when none are outstanding, and safe to call twice. Nothing here
+ * can reach a process this module did not spawn, because every kill goes
+ * through the `ChildProcess` handle libuv holds and libuv will not signal a
+ * child it has already reaped.
+ *
+ * A suite that disposes each server as it finishes needs this only as a net; a
+ * suite that does not needs it, because an orphan holding a port or a pipe
+ * makes the NEXT run's verdict meaningless.
+ */
+export async function disposeSpawnedServers(): Promise<void> {
+   const outstanding = [...liveServers];
+   liveServers.clear();
+   await Promise.all(outstanding.map(server => server.dispose()));
+}
+
 /** The captured streams, quoted into a boot-failure message. */
 function bootDiagnosis(stdoutPrefix: string, stderr: string): string {
    return (
@@ -390,7 +421,7 @@ export async function startSpawnedServer(options: SpawnedServerOptions): Promise
       return exitCode;
    }
 
-   return {
+   const server: SpawnedServer = {
       connection,
       pid: child.pid,
       initializeResult,
@@ -440,8 +471,11 @@ export async function startSpawnedServer(options: SpawnedServerOptions): Promise
          });
       },
       dispose(): Promise<number | null> {
+         liveServers.delete(server);
          disposal ??= terminate();
          return disposal;
       }
    };
+   liveServers.add(server);
+   return server;
 }