@volter/world-runtime 2.0.23 → 2.0.25

package/dist/src/host.js

@@ -23,6 +23,7 @@ import { Worker } from 'node:worker_threads';
 import { siblingScript } from "./sibling.js";
 import { importModule } from "./import-module.js";
 import { pathToFileURL } from 'node:url';
+import { parallelStartup } from "./startup.js";
 async function loadFactory(spec) {
     const mod = await importModule(spec.module);
     const factory = mod[spec.export];
@@ -60,26 +61,50 @@ export async function startColocatedHost(specs, options = {}) {
         process.on('unhandledRejection', onRejection);
         process.on('uncaughtException', onUncaught);
         const servers = [];
-        for (const spec of specs) {
-            const factory = await loadFactory(spec);
-            servers.push(await factory({ port: spec.port, root: spec.root, readOnly: spec.readOnly, ...(spec.scenarioPath !== undefined ? { scenarioPath: spec.scenarioPath } : {}), ...(spec.database !== undefined ? { database: spec.database } : {}) }));
+        const stop = async () => {
+            process.off('unhandledRejection', onRejection);
+            process.off('uncaughtException', onUncaught);
+            const stopped = await Promise.allSettled(servers.map(async (server) => {
+                let timeout;
+                try {
+                    await Promise.race([
+                        Promise.resolve().then(() => server.stop()),
+                        new Promise((_, reject) => { timeout = setTimeout(() => reject(new Error(`Twin on port ${server.port} did not stop within ${STOP_TIMEOUT_MS} ms.`)), STOP_TIMEOUT_MS); }),
+                    ]);
+                }
+                finally {
+                    if (timeout !== undefined)
+                        clearTimeout(timeout);
+                }
+            }));
+            return stopped.filter((result) => result.status === 'rejected').map((result) => result.reason);
+        };
+        try {
+            await parallelStartup(specs, async (spec) => {
+                const factory = await loadFactory(spec);
+                const server = await factory({ port: spec.port, root: spec.root, readOnly: spec.readOnly, ...(spec.scenarioPath !== undefined ? { scenarioPath: spec.scenarioPath } : {}), ...(spec.database !== undefined ? { database: spec.database } : {}) });
+                // Record the handle before validating it, so rollback also owns a bad factory result.
+                servers.push(server);
+                if (!Number.isInteger(server.port) || server.port < 1 || server.port > 65535 || (spec.port !== 0 && server.port !== spec.port)) {
+                    throw new Error(`Twin "${spec.id}" bound port ${server.port}, requested ${spec.port}.`);
+                }
+                ports[spec.id] = server.port;
+            });
+        }
+        catch (error) {
+            const cleanup = await stop();
+            if (cleanup.length)
+                throw new AggregateError([error, ...cleanup], 'Co-located host startup and rollback failed.');
+            throw error;
         }
         return {
             isolation,
             ports,
             stop: async () => {
-                process.off('unhandledRejection', onRejection);
-                process.off('uncaughtException', onUncaught);
-                // EVERY stop is invoked, IN PARALLEL, each under its own timeout, and no outcome —
-                // rejection, hang, or slowness — can prevent the others or wedge host.stop() itself.
-                // The awaited-sequential first cut re-created the SIGKILL escalation it was fixing
-                // through a new door (§9 round two H2, 2026-08-31: one pending/throwing stop — fly's
-                // cleanup throws on a failed container removal — left siblings unstopped and the host
-                // ignoring SIGTERM forever). The bound stays under downWorld's 5s SIGKILL grace.
-                await Promise.allSettled(servers.map((s) => Promise.race([
-                    Promise.resolve().then(() => s.stop()),
-                    new Promise((resolveTimeout) => setTimeout(resolveTimeout, STOP_TIMEOUT_MS).unref?.()),
-                ])));
+                // Every stop runs, even when a sibling hangs or throws. Host shutdown
+                // still resolves within its budget so the owning runtime can retire it.
+                for (const error of await stop())
+                    onEvent({ twin: '(host)', kind: 'stop-failed', detail: String(error) });
             },
         };
     }
@@ -96,6 +121,11 @@ export async function startColocatedHost(specs, options = {}) {
         let ready = false;
         worker.on('message', (msg) => {
             if (msg?.type === 'ready') {
+                if (typeof msg.port !== 'number' || !Number.isInteger(msg.port) || msg.port < 1 || msg.port > 65535 || (spec.port !== 0 && msg.port !== spec.port)) {
+                    rejectReady(new Error(`Twin "${spec.id}" bound port ${msg.port}, requested ${spec.port}.`));
+                    return;
+                }
+                ports[spec.id] = msg.port;
                 ready = true;
                 resolveReady();
             }
@@ -107,6 +137,8 @@ export async function startColocatedHost(specs, options = {}) {
         });
         worker.on('exit', (code) => {
             workers.delete(spec.id);
+            if (!ready)
+                rejectReady(new Error(`Twin "${spec.id}" exited before readiness (code ${code}).`));
             if (stopping.value || code === 0)
                 return;
             // Minimal-primitive doctrine: no keep-alive supervisor. A crashed worker is NOT
@@ -115,8 +147,17 @@ export async function startColocatedHost(specs, options = {}) {
         });
         workers.set(spec.id, worker);
     });
-    for (const spec of specs)
-        await spawnWorker(spec);
+    try {
+        await parallelStartup(specs, async (spec) => spawnWorker(spec));
+    }
+    catch (error) {
+        stopping.value = true;
+        const stopped = await Promise.allSettled([...workers.values()].map((worker) => worker.terminate()));
+        const cleanup = stopped.filter((result) => result.status === 'rejected').map((result) => result.reason);
+        if (cleanup.length)
+            throw new AggregateError([error, ...cleanup], 'Co-located worker startup and rollback failed.');
+        throw error;
+    }
     return {
         isolation,
         ports,

package/dist/src/runtime.js

@@ -1,5 +1,6 @@
 import { claimEnvOutput, publishEnvOutput } from "./env-output.js";
 import { offSignal } from "./signals.js";
+import { parallelStartup } from "./startup.js";
 import { assertWorldStateRemovable, removeWorldState } from "./ancestry.js";
 import { packCli, packEntry } from "./catalog.js";
 import { spawn, spawnSync } from 'node:child_process';
@@ -114,11 +115,13 @@ async function untilReadyOrEnded(wait, ended, boot, what, log) {
  *  always runs in full: one port's answer says nothing of the others'. Programs that are not twins are never asked. */
 async function confirmOwnPort(port, boot, ended, twin, what, log, early = false) {
     // A twin is asked at once, raced with the settle: a server slow to answer costs no more than the settle did.
-    const answer = twin ? worldBootOf(port) : Promise.resolve(null);
+    boot.signal.throwIfAborted();
+    const answer = twin ? worldBootOf(port, boot.signal) : Promise.resolve(null);
     const own = early && twin ? answer.then((a) => (a && a.boot === boot.bootId ? 'own' : new Promise(() => undefined))) : new Promise(() => undefined);
     // `ended` absent: the process was already settled (a co-located host settles once for all its twins).
     if (ended) {
         const settled = await Promise.race([own, ended.then(() => 'ended'), new Promise((resolveAlive) => setTimeout(() => resolveAlive('alive'), 300))]);
+        boot.signal.throwIfAborted();
         if (settled === 'own')
             return;
         if (settled === 'ended')
@@ -127,28 +130,65 @@ async function confirmOwnPort(port, boot, ended, twin, what, log, early = false)
     if (!twin)
         return;
     const answered = await answer;
+    boot.signal.throwIfAborted();
     if (answered && typeof answered.boot === 'string' && answered.boot !== boot.bootId) {
         throw new Error(`${what}: its port is answered by a twin of another World boot (${answered.boot}), not this one; a leftover World holds the port. Stop it (\`volter-world list\`, then \`down\`) and retry.\nLog: ${log}`);
     }
 }
 /** What the server on a loopback port says its World boot is (WORLD_BOOT_PATH), or null. A direct loopback request:
  *  never through a proxy an activated shell's environment names. */
-function worldBootOf(port) {
+function worldBootOf(port, abort) {
     return new Promise((resolveBoot) => {
-        const request = httpGet({ host: '127.0.0.1', port, path: WORLD_BOOT_PATH, timeout: 1000, agent: false }, (response) => {
-            let body = '';
-            response.setEncoding('utf8');
-            response.on('data', (chunk) => { body += chunk; if (body.length > 4096)
-                request.destroy(); });
-            response.on('end', () => { try {
-                resolveBoot(response.statusCode === 200 ? JSON.parse(body) : null);
-            }
-            catch {
-                resolveBoot(null);
-            } });
-        });
-        request.on('timeout', () => request.destroy());
-        request.on('error', () => resolveBoot(null));
+        let request;
+        let deadline;
+        let settled = false;
+        let responseStarted = false;
+        const finish = (value) => {
+            if (settled)
+                return;
+            settled = true;
+            if (deadline !== undefined)
+                clearTimeout(deadline);
+            abort.removeEventListener('abort', cancel);
+            resolveBoot(value);
+        };
+        const cancel = () => { finish(null); request?.destroy(); };
+        if (abort.aborted) {
+            finish(null);
+            return;
+        }
+        abort.addEventListener('abort', cancel, { once: true });
+        // A socket timeout alone is insufficient: destroying a request after
+        // headers can close/abort its response without emitting request 'error'.
+        // Bound the whole probe, including a peer that dribbles bytes forever.
+        deadline = setTimeout(cancel, 1000);
+        try {
+            request = httpGet({ host: '127.0.0.1', port, path: WORLD_BOOT_PATH, timeout: 1000, agent: false }, (response) => {
+                responseStarted = true;
+                let body = '';
+                response.on('error', cancel);
+                response.on('aborted', cancel);
+                response.on('close', () => finish(null));
+                response.setEncoding('utf8');
+                response.on('data', (chunk) => { body += chunk; if (body.length > 4096)
+                    cancel(); });
+                response.on('end', () => {
+                    try {
+                        finish(response.statusCode === 200 ? JSON.parse(body) : null);
+                    }
+                    catch {
+                        finish(null);
+                    }
+                });
+            });
+            request.on('timeout', cancel);
+            request.on('error', () => finish(null));
+            request.on('close', () => { if (!responseStarted)
+                finish(null); });
+        }
+        catch {
+            cancel();
+        }
     });
 }
 /** A stopped service's own account from its log: how it ended and the last lines it wrote. */
@@ -1265,6 +1305,8 @@ function versionSatisfies(actual, pin) {
  * all share the host child's pid — so pids/instance.json/downWorld need no special casing.
  */
 async function startColocatedServices(config, colocated, isolation, worldEnv, paths, allocatedPorts, boot) {
+    if (colocated.length === 0)
+        return [];
     const hostCli = siblingScript(import.meta.url, 'host-cli');
     const args = [hostCli, '--isolation', isolation === 'colocated' ? 'shared' : 'worker'];
     const allocated = [];
@@ -1302,7 +1344,7 @@ async function startColocatedServices(config, colocated, isolation, worldEnv, pa
         exitState.value = { code, signal };
     });
     const command = [process.execPath, ...args];
-    for (const { service, port } of allocated) {
+    await parallelStartup(allocated, async ({ service, port }) => {
         const bindTimeoutMs = typeof service.ready === 'object' && service.ready.timeoutMs !== undefined ? Math.max(service.ready.timeoutMs, 15_000) : 15_000;
         await untilReadyOrEnded((abort) => waitForTcp(port, bindTimeoutMs, abort), ended, boot, 'the co-located host', log).catch((error) => {
             if (undeadPids([child.pid]).length)
@@ -1313,8 +1355,8 @@ async function startColocatedServices(config, colocated, isolation, worldEnv, pa
             catch { /* best effort cleanup */ }
             throw new Error(`Co-located twin "${service.id}" failed to start (host isolation=${isolation}): ${error instanceof Error ? error.message : String(error)}\nLog: ${log}`);
         });
-    }
-    for (const [index, { service, port }] of allocated.entries()) {
+    });
+    await parallelStartup(allocated, async ({ service, port }, index) => {
         // A host holding one twin settles for that one port, so its twin may be confirmed early like a lone service's.
         await confirmOwnPort(port, boot, index === 0 ? ended : undefined, true, `Co-located twin "${service.id}"`, log, allocated.length === 1).catch((error) => {
             if (undeadPids([child.pid]).length)
@@ -1325,7 +1367,7 @@ async function startColocatedServices(config, colocated, isolation, worldEnv, pa
             catch { /* best effort cleanup */ }
             throw error;
         });
-    }
+    });
     if (exitState.value !== null) {
         throw new Error(`The co-located host ended during startup even though its ports answer, so other/stale processes probably hold them: the host ${endedAccount(log)}\n`
             + `Stop leftover services (e.g. \`volter-world down\`) and retry.\nLog: ${log}`);

package/dist/src/startup.d.ts

@@ -0,0 +1,2 @@
+/** Finite independent boot operations. Stop scheduling on failure and join every operation already begun. */
+export declare function parallelStartup<T>(items: readonly T[], start: (item: T, index: number) => Promise<void>): Promise<void>;

package/dist/src/startup.js

@@ -0,0 +1,24 @@
+/** Finite independent boot operations. Stop scheduling on failure and join every operation already begun. */
+export async function parallelStartup(items, start) {
+    let next = 0;
+    let failed = false;
+    const errors = [];
+    await Promise.all(Array.from({ length: Math.min(8, items.length) }, async () => {
+        while (!failed) {
+            const index = next++;
+            if (index >= items.length)
+                return;
+            try {
+                await start(items[index], index);
+            }
+            catch (error) {
+                failed = true;
+                errors.push(error);
+            }
+        }
+    }));
+    if (errors.length === 1)
+        throw errors[0];
+    if (errors.length > 1)
+        throw new AggregateError(errors, 'Independent World startup operations failed.');
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-runtime",
-  "version": "2.0.23",
+  "version": "2.0.25",
   "description": "World configs for twins: boot named local runtimes, allocate ports, generate world.env/instance.json, and run apps against fake-key twin worlds.",
   "keywords": [
     "twin",

package/src/host.ts

@@ -23,6 +23,7 @@ import { Worker } from 'node:worker_threads';
 import { siblingScript } from './sibling.ts';
 import { importModule } from './import-module.ts';
 import { pathToFileURL } from 'node:url';
+import { parallelStartup } from './startup.ts';
 
 /** One twin to mount in the host. `module`/`export` name a `({port,root,readOnly}) => {port,stop}`
  *  factory (every pack ships one, e.g. `createStripeTwinServer`). `module` is anything import()
@@ -104,28 +105,43 @@ export async function startColocatedHost(
     process.on('uncaughtException', onUncaught);
 
     const servers: TwinServer[] = [];
-    for (const spec of specs) {
-      const factory = await loadFactory(spec);
-      servers.push(await factory({ port: spec.port, root: spec.root, readOnly: spec.readOnly, ...(spec.scenarioPath !== undefined ? { scenarioPath: spec.scenarioPath } : {}), ...(spec.database !== undefined ? { database: spec.database } : {}) }));
+    const stop = async (): Promise<unknown[]> => {
+      process.off('unhandledRejection', onRejection);
+      process.off('uncaughtException', onUncaught);
+      const stopped = await Promise.allSettled(servers.map(async (server) => {
+        let timeout: ReturnType<typeof setTimeout> | undefined;
+        try {
+          await Promise.race([
+            Promise.resolve().then(() => server.stop()),
+            new Promise<never>((_, reject) => { timeout = setTimeout(() => reject(new Error(`Twin on port ${server.port} did not stop within ${STOP_TIMEOUT_MS} ms.`)), STOP_TIMEOUT_MS); }),
+          ]);
+        } finally { if (timeout !== undefined) clearTimeout(timeout); }
+      }));
+      return stopped.filter((result): result is PromiseRejectedResult => result.status === 'rejected').map((result) => result.reason);
+    };
+    try {
+      await parallelStartup(specs, async (spec) => {
+        const factory = await loadFactory(spec);
+        const server = await factory({ port: spec.port, root: spec.root, readOnly: spec.readOnly, ...(spec.scenarioPath !== undefined ? { scenarioPath: spec.scenarioPath } : {}), ...(spec.database !== undefined ? { database: spec.database } : {}) });
+        // Record the handle before validating it, so rollback also owns a bad factory result.
+        servers.push(server);
+        if (!Number.isInteger(server.port) || server.port < 1 || server.port > 65535 || (spec.port !== 0 && server.port !== spec.port)) {
+          throw new Error(`Twin "${spec.id}" bound port ${server.port}, requested ${spec.port}.`);
+        }
+        ports[spec.id] = server.port;
+      });
+    } catch (error) {
+      const cleanup = await stop();
+      if (cleanup.length) throw new AggregateError([error, ...cleanup], 'Co-located host startup and rollback failed.');
+      throw error;
     }
     return {
       isolation,
       ports,
       stop: async () => {
-        process.off('unhandledRejection', onRejection);
-        process.off('uncaughtException', onUncaught);
-        // EVERY stop is invoked, IN PARALLEL, each under its own timeout, and no outcome —
-        // rejection, hang, or slowness — can prevent the others or wedge host.stop() itself.
-        // The awaited-sequential first cut re-created the SIGKILL escalation it was fixing
-        // through a new door (§9 round two H2, 2026-08-31: one pending/throwing stop — fly's
-        // cleanup throws on a failed container removal — left siblings unstopped and the host
-        // ignoring SIGTERM forever). The bound stays under downWorld's 5s SIGKILL grace.
-        await Promise.allSettled(servers.map((s) =>
-          Promise.race([
-            Promise.resolve().then(() => s.stop()),
-            new Promise((resolveTimeout) => setTimeout(resolveTimeout, STOP_TIMEOUT_MS).unref?.()),
-          ]),
-        ));
+        // Every stop runs, even when a sibling hangs or throws. Host shutdown
+        // still resolves within its budget so the owning runtime can retire it.
+        for (const error of await stop()) onEvent({ twin: '(host)', kind: 'stop-failed', detail: String(error) });
       },
     };
   }
@@ -143,8 +159,14 @@ export async function startColocatedHost(
       // below would emit a 2nd `spawn` for the same twin, which the isolation test asserts against.
       onEvent({ twin: spec.id, kind: 'spawn', detail: 'worker started' });
       let ready = false;
-      worker.on('message', (msg: { type?: string }) => {
-        if (msg?.type === 'ready') { ready = true; resolveReady(); }
+      worker.on('message', (msg: { type?: string; port?: number }) => {
+        if (msg?.type === 'ready') {
+          if (typeof msg.port !== 'number' || !Number.isInteger(msg.port) || msg.port < 1 || msg.port > 65535 || (spec.port !== 0 && msg.port !== spec.port)) {
+            rejectReady(new Error(`Twin "${spec.id}" bound port ${msg.port}, requested ${spec.port}.`)); return;
+          }
+          ports[spec.id] = msg.port;
+          ready = true; resolveReady();
+        }
       });
       worker.on('error', (err) => {
         onEvent({ twin: spec.id, kind: 'error', detail: String(err) });
@@ -152,6 +174,7 @@ export async function startColocatedHost(
       });
       worker.on('exit', (code) => {
         workers.delete(spec.id);
+        if (!ready) rejectReady(new Error(`Twin "${spec.id}" exited before readiness (code ${code}).`));
         if (stopping.value || code === 0) return;
         // Minimal-primitive doctrine: no keep-alive supervisor. A crashed worker is NOT
         // respawned — record the give-up (host-cli persists it → doctor red) and stay dead.
@@ -160,7 +183,14 @@ export async function startColocatedHost(
       workers.set(spec.id, worker);
     });
 
-  for (const spec of specs) await spawnWorker(spec);
+  try { await parallelStartup(specs, async (spec) => spawnWorker(spec)); }
+  catch (error) {
+    stopping.value = true;
+    const stopped = await Promise.allSettled([...workers.values()].map((worker) => worker.terminate()));
+    const cleanup = stopped.filter((result): result is PromiseRejectedResult => result.status === 'rejected').map((result) => result.reason);
+    if (cleanup.length) throw new AggregateError([error, ...cleanup], 'Co-located worker startup and rollback failed.');
+    throw error;
+  }
 
   return {
     isolation,

package/src/runtime.ts

@@ -1,9 +1,10 @@
 import { claimEnvOutput, publishEnvOutput } from './env-output.ts';
 import { offSignal } from './signals.ts';
+import { parallelStartup } from './startup.ts';
 import { assertWorldStateRemovable, removeWorldState } from './ancestry.ts';
 import { packCli, packEntry } from './catalog.ts';
 import { spawn, spawnSync } from 'node:child_process';
-import { get as httpGet } from 'node:http';
+import { get as httpGet, type ClientRequest } from 'node:http';
 import { siblingScript } from './sibling.ts';
 import { commandLifetime, commandProcessGroup, CommandRetirementError } from './command-lifetime.ts';
 import { superviseWorldRun } from './run-task.ts';
@@ -108,16 +109,19 @@ async function untilReadyOrEnded<T>(wait: (abort: AbortSignal) => Promise<T>, en
  *  always runs in full: one port's answer says nothing of the others'. Programs that are not twins are never asked. */
 async function confirmOwnPort(port: number, boot: BootContext, ended: Promise<void> | undefined, twin: boolean, what: string, log: string, early = false): Promise<void> {
   // A twin is asked at once, raced with the settle: a server slow to answer costs no more than the settle did.
-  const answer = twin ? worldBootOf(port) : Promise.resolve(null);
+  boot.signal.throwIfAborted();
+  const answer = twin ? worldBootOf(port, boot.signal) : Promise.resolve(null);
   const own = early && twin ? answer.then((a) => (a && a.boot === boot.bootId ? 'own' as const : new Promise<never>(() => undefined))) : new Promise<never>(() => undefined);
   // `ended` absent: the process was already settled (a co-located host settles once for all its twins).
   if (ended) {
     const settled = await Promise.race([own, ended.then(() => 'ended' as const), new Promise<'alive'>((resolveAlive) => setTimeout(() => resolveAlive('alive'), 300))]);
+    boot.signal.throwIfAborted();
     if (settled === 'own') return;
     if (settled === 'ended') throw new Error(`${what} ended right after its port first answered, so another process probably holds the port: the service ${endedAccount(log)}\nLog: ${log}`);
   }
   if (!twin) return;
   const answered = await answer;
+  boot.signal.throwIfAborted();
   if (answered && typeof answered.boot === 'string' && answered.boot !== boot.bootId) {
     throw new Error(`${what}: its port is answered by a twin of another World boot (${answered.boot}), not this one; a leftover World holds the port. Stop it (\`volter-world list\`, then \`down\`) and retry.\nLog: ${log}`);
   }
@@ -125,16 +129,44 @@ async function confirmOwnPort(port: number, boot: BootContext, ended: Promise<vo
 
 /** What the server on a loopback port says its World boot is (WORLD_BOOT_PATH), or null. A direct loopback request:
  *  never through a proxy an activated shell's environment names. */
-function worldBootOf(port: number): Promise<{ boot?: unknown } | null> {
+function worldBootOf(port: number, abort: AbortSignal): Promise<{ boot?: unknown } | null> {
   return new Promise((resolveBoot) => {
-    const request = httpGet({ host: '127.0.0.1', port, path: WORLD_BOOT_PATH, timeout: 1000, agent: false }, (response) => {
-      let body = '';
-      response.setEncoding('utf8');
-      response.on('data', (chunk: string) => { body += chunk; if (body.length > 4096) request.destroy(); });
-      response.on('end', () => { try { resolveBoot(response.statusCode === 200 ? JSON.parse(body) as { boot?: unknown } : null); } catch { resolveBoot(null); } });
-    });
-    request.on('timeout', () => request.destroy());
-    request.on('error', () => resolveBoot(null));
+    let request: ClientRequest | undefined;
+    let deadline: ReturnType<typeof setTimeout> | undefined;
+    let settled = false;
+    let responseStarted = false;
+    const finish = (value: { boot?: unknown } | null): void => {
+      if (settled) return;
+      settled = true;
+      if (deadline !== undefined) clearTimeout(deadline);
+      abort.removeEventListener('abort', cancel);
+      resolveBoot(value);
+    };
+    const cancel = (): void => { finish(null); request?.destroy(); };
+    if (abort.aborted) { finish(null); return; }
+    abort.addEventListener('abort', cancel, { once: true });
+    // A socket timeout alone is insufficient: destroying a request after
+    // headers can close/abort its response without emitting request 'error'.
+    // Bound the whole probe, including a peer that dribbles bytes forever.
+    deadline = setTimeout(cancel, 1000);
+    try {
+      request = httpGet({ host: '127.0.0.1', port, path: WORLD_BOOT_PATH, timeout: 1000, agent: false }, (response) => {
+        responseStarted = true;
+        let body = '';
+        response.on('error', cancel);
+        response.on('aborted', cancel);
+        response.on('close', () => finish(null));
+        response.setEncoding('utf8');
+        response.on('data', (chunk: string) => { body += chunk; if (body.length > 4096) cancel(); });
+        response.on('end', () => {
+          try { finish(response.statusCode === 200 ? JSON.parse(body) as { boot?: unknown } : null); }
+          catch { finish(null); }
+        });
+      });
+      request.on('timeout', cancel);
+      request.on('error', () => finish(null));
+      request.on('close', () => { if (!responseStarted) finish(null); });
+    } catch { cancel(); }
   });
 }
 
@@ -1290,6 +1322,7 @@ async function startColocatedServices(
   allocatedPorts: Set<number>,
   boot: BootContext,
 ): Promise<WorldServiceInstance[]> {
+  if (colocated.length === 0) return [];
   const hostCli = siblingScript(import.meta.url, 'host-cli');
   const args: string[] = [hostCli, '--isolation', isolation === 'colocated' ? 'shared' : 'worker'];
   const allocated: Array<{ service: WorldServiceConfig; port: number; mounted: MountedPackage }> = [];
@@ -1329,22 +1362,22 @@ async function startColocatedServices(
   });
 
   const command = [process.execPath, ...args];
-  for (const { service, port } of allocated) {
+  await parallelStartup(allocated, async ({ service, port }) => {
     const bindTimeoutMs = typeof service.ready === 'object' && service.ready.timeoutMs !== undefined ? Math.max(service.ready.timeoutMs, 15_000) : 15_000;
     await untilReadyOrEnded((abort) => waitForTcp(port, bindTimeoutMs, abort), ended, boot, 'the co-located host', log).catch((error) => {
       if (undeadPids([child.pid!]).length) recordWorldStop([log], 'world.service.stop', 'up (startup failed)', 'SIGTERM');
       try { process.kill(-child.pid!, 'SIGTERM'); } catch { /* best effort cleanup */ }
       throw new Error(`Co-located twin "${service.id}" failed to start (host isolation=${isolation}): ${error instanceof Error ? error.message : String(error)}\nLog: ${log}`);
     });
-  }
-  for (const [index, { service, port }] of allocated.entries()) {
+  });
+  await parallelStartup(allocated, async ({ service, port }, index) => {
     // A host holding one twin settles for that one port, so its twin may be confirmed early like a lone service's.
     await confirmOwnPort(port, boot, index === 0 ? ended : undefined, true, `Co-located twin "${service.id}"`, log, allocated.length === 1).catch((error) => {
       if (undeadPids([child.pid!]).length) recordWorldStop([log], 'world.service.stop', 'up (port not its own)', 'SIGTERM');
       try { process.kill(-child.pid!, 'SIGTERM'); } catch { /* best effort cleanup */ }
       throw error;
     });
-  }
+  });
   if (exitState.value !== null) {
     throw new Error(
       `The co-located host ended during startup even though its ports answer, so other/stale processes probably hold them: the host ${endedAccount(log)}\n`

package/src/startup.ts

@@ -0,0 +1,16 @@
+/** Finite independent boot operations. Stop scheduling on failure and join every operation already begun. */
+export async function parallelStartup<T>(items: readonly T[], start: (item: T, index: number) => Promise<void>): Promise<void> {
+  let next = 0;
+  let failed = false;
+  const errors: unknown[] = [];
+  await Promise.all(Array.from({ length: Math.min(8, items.length) }, async () => {
+    while (!failed) {
+      const index = next++;
+      if (index >= items.length) return;
+      try { await start(items[index]!, index); }
+      catch (error) { failed = true; errors.push(error); }
+    }
+  }));
+  if (errors.length === 1) throw errors[0];
+  if (errors.length > 1) throw new AggregateError(errors, 'Independent World startup operations failed.');
+}