@volter/world-runtime 3.0.98 → 3.0.100

package/dist/src/infra.js

@@ -7,13 +7,29 @@
 // that owns the World's lifetime, as every other service's recorder is, and not of a tool that exits once they
 // serve. A process layer where a child does not outlive its parent (a browser tab's) otherwise ended the PGlite host
 // the moment `volter-world-infra up` returned, and the World's readiness probe never saw it.
-import { existsSync, readFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
+import { accessSync, constants, existsSync, readFileSync, statSync } from 'node:fs';
+import { delimiter, dirname, join } from 'node:path';
 import { signalChild } from './process-signal.mjs';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { infraConnections, parseInfraDefinition } from "./pglite-backing.js";
 import { errorMessage } from "./error-message.js";
+/** Whether a program is on PATH, read from the file system without starting a process: where a missing program
+ *  still costs a process round trip (a browser tab's kernel), the container probe is not spawned at all. */
+function onPath(name, env) {
+    return (env.PATH ?? '').split(delimiter).some((dir) => {
+        if (!dir)
+            return false;
+        try {
+            const path = join(dir, name);
+            accessSync(path, constants.X_OK);
+            return statSync(path).isFile();
+        }
+        catch {
+            return false;
+        }
+    });
+}
 /** A command run to its end without blocking this process: in the World's own `up` the phase shares the event loop
  *  with the boot's signal handling, where the tool's spawnSync blocked only the tool. Ended by `timeout` (SIGTERM,
  *  as spawnSync's timeout) or by the boot's abort. */
@@ -75,10 +91,35 @@ function runCommand(command, args, options) {
 /** One phase of the World-managed infrastructure. `env` is the infrastructure service's environment, which the
  *  services this starts run in; `signal` is the boot's abort (the World's own up passes it; the tool has none). */
 export async function runInfrastructure(phase, env, io, signal) {
-    if (phase !== 'up' && phase !== 'status' && phase !== 'down') {
-        io.err('managed infrastructure: expected up, status, or down\n');
+    if (phase !== 'up' && phase !== 'status' && phase !== 'down' && phase !== 'prepare') {
+        io.err('managed infrastructure: expected up, status, down, or prepare\n');
         return 2;
     }
+    // prepare: the image build's step that makes the World's PGlite cluster once, on its host, so the World's first up
+    // opens it instead of running initdb (pglite-backing.ts, pglitePrepare; ADR 0018). It needs the World's
+    // definition, not an instance.
+    if (phase === 'prepare') {
+        const config = env.VOLTER_WORLD_CONFIG;
+        const declaredDefinition = config ? join(dirname(config), 'world.infrastructure.yml') : undefined;
+        if (!config || !declaredDefinition || !existsSync(declaredDefinition)) {
+            io.err('managed infrastructure prepare: VOLTER_WORLD_CONFIG must name a world.json beside its world.infrastructure.yml\n');
+            return 2;
+        }
+        const postgres = parseInfraDefinition(readFileSync(declaredDefinition, 'utf8')).filter((s) => s.kind === 'postgres');
+        if (postgres.length !== 1) {
+            io.out('managed infrastructure prepare: no single declared PostgreSQL; nothing to prepare\n');
+            return 0;
+        }
+        const { pglitePrepare } = await import("./pglite-backing.js");
+        try {
+            io.out(`managed infrastructure prepared ${await pglitePrepare(postgres[0], config, { env, ...(signal ? { signal } : {}) })}\n`);
+            return 0;
+        }
+        catch (error) {
+            io.err(`managed infrastructure prepare failed: ${errorMessage(error)}\n`);
+            return 1;
+        }
+    }
     const worldConfig = env.VOLTER_WORLD_CONFIG;
     const worldData = env.VOLTER_WORLD_DATA;
     if (!worldConfig || !worldData) {
@@ -96,7 +137,7 @@ export async function runInfrastructure(phase, env, io, signal) {
         signal?.throwIfAborted();
         return ran;
     };
-    const launch = { env, ...(signal ? { signal } : {}) };
+    const launch = { env, ...(signal ? { signal } : {}), note: (what) => io.out(`managed infrastructure: ${what}\n`) };
     const classify = (raw) => /no space left on device|enospc/iu.test(raw)
         ? 'insufficient writable storage'
         : /out of memory|cannot allocate memory|killed/iu.test(raw)
@@ -139,6 +180,9 @@ export async function runInfrastructure(phase, env, io, signal) {
             io.err(`managed infrastructure: VOLTER_WORLD_INFRA_BACKING must be docker, pglite or native (got ${JSON.stringify(forced)})\n`);
             return 2;
         }
+        // No docker on PATH is the same absence the probe's ENOENT reports, read without a process.
+        if (process.platform !== 'win32' && !onPath('docker', env))
+            return 'pglite';
         const probe = await runCommand('docker', ['info', '--format', '{{.ServerVersion}}'], { env, timeout: 10_000, ...(signal ? { signal } : {}) });
         signal?.throwIfAborted();
         if (probe.status === 0 && probe.stdout.trim())

package/dist/src/pglite-backing.d.ts

@@ -23,9 +23,27 @@ export declare function containerlessDataDirectory(kind: string): string | undef
 export interface HostLaunch {
     env?: NodeJS.ProcessEnv;
     signal?: AbortSignal;
+    note?: (what: string) => void;
 }
 /** The kinds this backing cannot serve, or [] when it can serve the world. */
 export declare function unsupportedKinds(services: InfraService[]): string[];
+/**
+ * A World's PostgreSQL cluster prepared before its first boot (architecture, managed infrastructure; ADR 0018).
+ * PGlite's first start in an empty data directory runs initdb in wasm, writes the whole cluster through the file
+ * system, then the host creates the declared database and role; in a browser tab that is the World's slowest boot
+ * step. `volter-world-infra prepare` runs the host's own open path (`pglite-host.mjs --prepare`) once, on the image
+ * build's host, into `<World dir>/.volter-prepared/pglite-postgres-data`, with a stamp naming the PGlite pin and the
+ * declared identity. At `up`, an empty service data directory takes that cluster by rename, and PGlite finds
+ * PG_VERSION and resumes it (its own existing-dataDir path). Only an exact stamp is taken; anything else boots as before.
+ */
+export declare const PREPARED_DIRECTORY = ".volter-prepared";
+/** Where a World's prepared PostgreSQL cluster lives, beside its world.json, and its stamp. */
+export declare function preparedCluster(worldConfig: string): {
+    directory: string;
+    stamp: string;
+};
+/** Run the host's open path once into the World's prepared directory; replaces an earlier preparation. */
+export declare function pglitePrepare(service: InfraService, worldConfig: string, launch?: HostLaunch): Promise<string>;
 export declare function pgliteUp(services: InfraService[], dataDir: string, launch?: HostLaunch): Promise<void>;
 export declare function pgliteStatus(services: InfraService[], dataDir: string): Promise<{
     ok: boolean;

package/dist/src/pglite-backing.js

@@ -12,7 +12,7 @@
 // services only. A definition declaring mysql without a container runtime is
 // refused with the kinds named, never half-booted. Redis never reaches it: every
 // redis service is the redis twin's (redis-backing.ts).
-import { closeSync, existsSync, mkdirSync, openSync, readFileSync, rmSync, statSync } from 'node:fs';
+import { appendFileSync, closeSync, cpSync, existsSync, mkdirSync, openSync, readdirSync, readFileSync, renameSync, rmdirSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { connect } from 'node:net';
 import { dirname, join } from 'node:path';
 import { spawn } from 'node:child_process';
@@ -157,6 +157,88 @@ function readyLine(port) {
 function logSince(log, offset) {
     return readFileSync(log).subarray(offset).toString('utf8');
 }
+/**
+ * A World's PostgreSQL cluster prepared before its first boot (architecture, managed infrastructure; ADR 0018).
+ * PGlite's first start in an empty data directory runs initdb in wasm, writes the whole cluster through the file
+ * system, then the host creates the declared database and role; in a browser tab that is the World's slowest boot
+ * step. `volter-world-infra prepare` runs the host's own open path (`pglite-host.mjs --prepare`) once, on the image
+ * build's host, into `<World dir>/.volter-prepared/pglite-postgres-data`, with a stamp naming the PGlite pin and the
+ * declared identity. At `up`, an empty service data directory takes that cluster by rename, and PGlite finds
+ * PG_VERSION and resumes it (its own existing-dataDir path). Only an exact stamp is taken; anything else boots as before.
+ */
+export const PREPARED_DIRECTORY = '.volter-prepared';
+/** Where a World's prepared PostgreSQL cluster lives, beside its world.json, and its stamp. */
+export function preparedCluster(worldConfig) {
+    const directory = join(dirname(worldConfig), PREPARED_DIRECTORY, containerlessDataDirectory('postgres'));
+    return { directory, stamp: `${directory}.json` };
+}
+/**
+ * What a prepared cluster must have been made with: this runtime (whose pglite-host.mjs is the open path that made
+ * it), its exact PGlite pin (initdb's encoding and locale are PGlite's defaults: the host passes no initdb
+ * parameters), and the declared user and database. The password is not in the cluster: the role is created without
+ * one (LOGIN SUPERUSER) and the host's gateway checks the declared password on each connection, so a World with
+ * another password takes the same cluster and authenticates against its own. Extensions are loaded into the module
+ * at each open, never created in the cluster by the open path.
+ */
+function preparedStamp(service) {
+    const manifest = JSON.parse(readFileSync(join(here(), '..', 'package.json'), 'utf8'));
+    const pglite = manifest.dependencies?.['@electric-sql/pglite'];
+    if (!pglite || !/^\d+\.\d+\.\d+$/.test(pglite))
+        throw new Error('world-runtime pins no exact @electric-sql/pglite version');
+    return `${JSON.stringify({ runtime: manifest.version ?? 'unversioned', pglite, user: service.postgres.user, database: service.postgres.database })}\n`;
+}
+/** Run the host's open path once into the World's prepared directory; replaces an earlier preparation. */
+export async function pglitePrepare(service, worldConfig, launch = {}) {
+    if (service.kind !== 'postgres' || !service.postgres?.password)
+        throw new Error('only a declared PostgreSQL with a literal POSTGRES_PASSWORD is prepared');
+    const { directory, stamp } = preparedCluster(worldConfig);
+    rmSync(directory, { recursive: true, force: true });
+    rmSync(stamp, { force: true });
+    mkdirSync(directory, { recursive: true });
+    const child = spawn('node', [hostScript(), '--prepare', '--data', directory], {
+        windowsHide: true,
+        env: { ...(launch.env ?? process.env), VOLTER_WORLD_PGLITE_USER: service.postgres.user,
+            VOLTER_WORLD_PGLITE_DATABASE: service.postgres.database, VOLTER_WORLD_PGLITE_PASSWORD: service.postgres.password },
+        stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    const lifetime = commandLifetime(child, launch.signal);
+    let output = '';
+    child.stdout.on('data', (chunk) => { output += chunk.toString('utf8'); });
+    child.stderr.on('data', (chunk) => { output += chunk.toString('utf8'); });
+    const { code } = await lifetime.finish();
+    if (code !== 0 || !existsSync(join(directory, 'PG_VERSION'))) {
+        rmSync(directory, { recursive: true, force: true });
+        throw new Error(`pglite prepare exited ${code ?? 'null'} without a cluster\n${output.trim().split('\n').slice(-40).join('\n')}`);
+    }
+    writeFileSync(stamp, preparedStamp(service));
+    return directory;
+}
+/** Give an empty service data directory the World's prepared cluster when its stamp matches; says what it did. */
+function placePreparedCluster(service, serviceData, worldConfig) {
+    if (service.kind !== 'postgres' || !worldConfig || existsSync(join(serviceData, 'PG_VERSION')))
+        return { placed: false };
+    const { directory, stamp } = preparedCluster(worldConfig);
+    if (!existsSync(join(directory, 'PG_VERSION')) || !existsSync(stamp))
+        return { placed: false };
+    if (readFileSync(stamp, 'utf8') !== preparedStamp(service))
+        return { placed: false, note: `prepared cluster ${directory} not taken: its stamp names another PGlite pin or identity` };
+    if (existsSync(serviceData)) {
+        if (readdirSync(serviceData).length)
+            return { placed: false };
+        rmdirSync(serviceData);
+    }
+    mkdirSync(dirname(serviceData), { recursive: true });
+    // A rename moves the cluster without writing its files; across file systems it is copied.
+    try {
+        renameSync(directory, serviceData);
+    }
+    catch (error) {
+        if (error.code !== 'EXDEV')
+            throw error;
+        cpSync(directory, serviceData, { recursive: true });
+    }
+    return { placed: true, note: `prepared cluster ${directory} placed at ${serviceData}` };
+}
 export async function pgliteUp(services, dataDir, launch = {}) {
     const env = launch.env ?? process.env;
     // Every check before any start: a refused up starts nothing, so it never leaves the World half-booted.
@@ -185,10 +267,15 @@ export async function pgliteUp(services, dataDir, launch = {}) {
     const started = [];
     try {
         for (const { service, name, serviceData, log, pidFile, argv } of plan) {
+            const placed = placePreparedCluster(service, serviceData, env.VOLTER_WORLD_CONFIG);
             mkdirSync(serviceData, { recursive: true });
             mkdirSync(dirname(log), { recursive: true });
+            if (placed.note) {
+                appendFileSync(log, `${placed.note}\n`);
+                launch.note?.(placed.note);
+            }
             const offset = existsSync(log) ? statSync(log).size : 0;
-            const [command, ...args] = argv;
+            const [command, ...args] = placed.placed ? [...argv, '--prepared'] : argv;
             // a real fd, not a pipe: the host must outlive this process untethered
             const logFd = openSync(log, 'a');
             const child = spawn(command, args, {
@@ -216,6 +303,7 @@ export async function pgliteUp(services, dataDir, launch = {}) {
                 throw new Error('Managed host birth capture failed; retiring held child');
             publishProcessReceipt(spawnReceiptPath(pidFile), JSON.stringify(host.identity) + '\n');
             publishProcessReceipt(pidFile, `${child.pid}\n`);
+            launch.note?.(`${name} spawned`);
             const deadline = Date.now() + READY_TIMEOUT_MS;
             const line = readyLine(service.hostPort);
             // ready when OUR child says its listener is bound (a squatter that took the port after the check
@@ -229,8 +317,10 @@ export async function pgliteUp(services, dataDir, launch = {}) {
                     throw new Error(`${name} did not serve port ${service.hostPort} within ${READY_TIMEOUT_MS / 1000}s — see ${log}`);
                 // an aborted boot (Ctrl-C during up) stops waiting; the catch below ends what this up started
                 launch.signal?.throwIfAborted();
-                await sleep(200);
+                // the ready line is a small log read, and the port is asked only once it is there
+                await sleep(25);
             }
+            launch.note?.(`${name} serving on 127.0.0.1:${service.hostPort}`);
             if (service.kind === 'mongodb')
                 await mongodbReady(service, launch, deadline);
             child.unref();

package/dist/src/pglite-host.mjs

@@ -100,8 +100,10 @@ const CONTRIB = [
 const { PGlite } = await import('@electric-sql/pglite');
 const { vector } = await import('@electric-sql/pglite-pgvector');
 const extensions = { vector };
-for (const name of CONTRIB) {
-  const extension = (await import(`@electric-sql/pglite/contrib/${name}`))[name];
+// Imported together: in a browser tab each import is a module load through the kernel, and one after another
+// they were a fixed wait on every boot.
+for (const [name, module] of await Promise.all(CONTRIB.map(async name => [name, await import(`@electric-sql/pglite/contrib/${name}`)]))) {
+  const extension = module[name];
   if (!extension) throw new Error(`pglite-host: @electric-sql/pglite/contrib/${name} exports no ${name}`);
   extensions[name] = extension;
 }
@@ -116,7 +118,14 @@ function arg(name) {
   return value;
 }
 
-const port = Number(arg('--port'));
+// --prepare: create the declared cluster in --data (initdb, the declared database and role) through the same open
+// path a serving host takes, close it cleanly and exit without listening. The World's image build runs it on the
+// host so the tab opens an existing cluster (pglite-backing.ts, pglitePrepare).
+const preparing = process.argv.includes('--prepare');
+// --prepared: the data directory is a cluster `--prepare` made for this declared identity (pglite-backing.ts checks
+// its stamp before passing this), so the declared database and role exist and the maintenance open is skipped.
+const prepared = process.argv.includes('--prepared');
+const port = preparing ? 0 : Number(arg('--port'));
 const dataDir = arg('--data');
 const databaseUser = process.env.VOLTER_WORLD_PGLITE_USER;
 const databaseName = process.env.VOLTER_WORLD_PGLITE_DATABASE;
@@ -125,7 +134,7 @@ if (![databaseUser, databaseName, databasePassword].every(value => typeof value
   process.stderr.write('pglite-host: declared database identity and throwaway password are required\n');
   process.exit(2);
 }
-if (!Number.isInteger(port) || port < 1 || port > 65535) {
+if (!preparing && (!Number.isInteger(port) || port < 1 || port > 65535)) {
   process.stderr.write('pglite-host: --port must be 1-65535\n');
   process.exit(2);
 }
@@ -139,6 +148,11 @@ process.stderr.on('error', () => {});
 const initKeepAlive = setInterval(() => {}, 500);
 const quoteIdentifier = value => `"${value.replaceAll('"', '""')}"`;
 async function openDeclaredDatabase() {
+  if (prepared) {
+    const db = await PGlite.create({ dataDir, extensions, database: databaseName });
+    await db.exec(`SET SESSION AUTHORIZATION ${quoteIdentifier(databaseUser)}`);
+    return db;
+  }
   // PostgreSQL cannot rename its current database. Use its maintenance database
   // before opening the declared one; old Worlds' rows in postgres stay intact.
   const maintenance = await PGlite.create({ dataDir, extensions, database: 'template1' });
@@ -626,7 +640,13 @@ const server = net.createServer((socket) => {
   });
 });
 
-void dbReady.then(() => {
+if (preparing) void dbReady.then(async (db) => {
+  await db.close();
+  clearInterval(initKeepAlive);
+  process.stdout.write(`pglite-host prepared ${dataDir}\n`);
+  process.exit(0);
+});
+else void dbReady.then(() => {
   clearInterval(initKeepAlive);
   server.listen(port, '127.0.0.1', () => {
     process.stdout.write(`pglite-host serving postgres wire protocol on 127.0.0.1:${port}\n`);

package/dist/src/runtime.js

@@ -1068,6 +1068,8 @@ function getByJsonPath(value, jsonPath) {
 class ExternalCommandUnavailableError extends Error {
 }
 async function runExternalCommand(command, cwd, serviceId, phase, env = process.env, abort, timeoutMs = 60_000) {
+    if (ownInfrastructureStatus(command))
+        return runOwnInfrastructureStatus(serviceId, phase, env, abort, timeoutMs);
     const [bin, ...args] = ownCommand(command);
     if (!bin)
         throw new Error(`External service "${serviceId}": ${phase} command is empty`);
@@ -1113,9 +1115,9 @@ async function runExternalCommand(command, cwd, serviceId, phase, env = process.
 /** Run an external service's `up` command, STREAMING its stdout+stderr to the service log as it runs
  * (instead of buffering through spawnSync's 1MB cap, which a large DB restore would overflow). Returns
  * the combined output so `discover` can read it. Throws with a bounded tail on nonzero exit. */
-async function runExternalUp(command, cwd, serviceId, env, logPath, abort) {
+async function runExternalUp(command, cwd, serviceId, env, logPath, abort, progress) {
     if (ownInfrastructureUp(command))
-        return runOwnInfrastructureUp(command, serviceId, env, logPath, abort);
+        return runOwnInfrastructureUp(command, serviceId, env, logPath, abort, progress);
     const [bin, ...args] = ownCommand(command);
     if (!bin)
         throw new Error(`External service "${serviceId}": up command is empty`);
@@ -1172,7 +1174,40 @@ async function runExternalUp(command, cwd, serviceId, env, logPath, abort) {
 function ownInfrastructureUp(command) {
     return command[0] === 'volter-world-infra' && command[1] === 'up' && ownCommand(command)[0] === process.execPath;
 }
-async function runOwnInfrastructureUp(command, serviceId, env, logPath, abort) {
+/** Whether a declaration is the runtime's own managed infrastructure: an external service whose `up` is
+ *  `volter-world-infra up` run in this process. It reads only the World's own configuration and calls no declared
+ *  service while it starts, so it starts beside the co-located host (ADR 0017). */
+function ownInfrastructureService(service) {
+    return service.type === 'external' && service.external !== undefined && ownInfrastructureUp(service.external.up);
+}
+/** Whether a command is this runtime's own `volter-world-infra status`: the managed infrastructure's readiness probe
+ *  and its status read (init declares both). It runs in this process, as `up` does: a separate process would load the
+ *  runtime again to read a pid and connect to a port, which in a browser tab costs a whole Node start per call. */
+function ownInfrastructureStatus(command) {
+    return command.length === 2 && command[0] === 'volter-world-infra' && command[1] === 'status' && ownCommand(command)[0] === process.execPath;
+}
+async function runOwnInfrastructureStatus(serviceId, phase, env, abort, timeoutMs) {
+    abort?.throwIfAborted();
+    const bounded = new AbortController();
+    const onAbort = () => bounded.abort(abort.reason);
+    abort?.addEventListener('abort', onAbort, { once: true });
+    const timer = setTimeout(() => bounded.abort(new Error(`External service "${serviceId}": ${phase} command timed out after ${timeoutMs}ms`)), timeoutMs);
+    let stdout = '';
+    let stderr = '';
+    try {
+        const { runInfrastructure } = await import("./infra.js");
+        const code = await runInfrastructure('status', env, { out: (text) => { stdout += text; }, err: (text) => { stderr += text; } }, bounded.signal);
+        bounded.signal.throwIfAborted();
+        if (code !== 0)
+            throw new Error(`External service "${serviceId}": ${phase} command exited ${code}\n${stdout}${stderr}`);
+        return { stdout, stderr };
+    }
+    finally {
+        clearTimeout(timer);
+        abort?.removeEventListener('abort', onAbort);
+    }
+}
+async function runOwnInfrastructureUp(command, serviceId, env, logPath, abort, progress) {
     writeFileSync(logPath, `$ ${command.join(' ')}\n`, { mode: 0o600 });
     chmodSync(logPath, 0o600);
     const out = openPrivateLog(logPath, 'a');
@@ -1180,7 +1215,14 @@ async function runOwnInfrastructureUp(command, serviceId, env, logPath, abort) {
     try {
         abort?.throwIfAborted();
         const { runInfrastructure } = await import("./infra.js");
-        const write = (text) => { chunks.push(text); writeSync(out, text); };
+        // Its phase lines (backing chosen, host spawned, serving) are the boot's progress too.
+        const write = (text) => {
+            chunks.push(text);
+            writeSync(out, text);
+            for (const line of text.split('\n'))
+                if (line.startsWith('managed infrastructure'))
+                    progress?.(`${serviceId}: ${line}`);
+        };
         const code = await runInfrastructure(command[1], env, { out: write, err: write }, abort);
         abort?.throwIfAborted();
         if (code !== 0) {
@@ -1207,11 +1249,13 @@ function resolveReadyProbe(ready, svc) {
 }
 async function awaitReadiness(ready, logPath, cwd, serviceId, env = process.env, abort) {
     if (!ready)
-        return;
+        return 'no readiness declared';
     const timeoutMs = ready.timeoutMs ?? 60_000;
     const intervalMs = ready.intervalMs ?? 500;
     const started = Date.now();
     let lastError = '';
+    let attempt = 0;
+    const passed = (check) => `${check} after ${attempt + 1} ${attempt ? 'checks' : 'check'}`;
     while (Date.now() - started < timeoutMs) {
         abort?.throwIfAborted();
         if (ready.command !== undefined) {
@@ -1220,7 +1264,7 @@ async function awaitReadiness(ready, logPath, cwd, serviceId, env = process.env,
             }
             try {
                 await runExternalCommand([ready.command, ...(ready.args ?? [])], cwd, serviceId, 'readiness', env, abort, Math.max(1, timeoutMs - (Date.now() - started)));
-                return;
+                return passed(`\`${[ready.command, ...(ready.args ?? [])].join(' ')}\` exited 0`);
             }
             catch (error) {
                 if (error instanceof CommandRetirementError)
@@ -1232,7 +1276,7 @@ async function awaitReadiness(ready, logPath, cwd, serviceId, env = process.env,
             try {
                 const response = await fetch(ready.httpUrl, { signal: AbortSignal.any([AbortSignal.timeout(Math.max(1, timeoutMs - (Date.now() - started))), ...(abort ? [abort] : [])]) });
                 if (response.status >= 200 && response.status < 400)
-                    return;
+                    return passed(`GET ${ready.httpUrl} answered ${response.status}`);
                 lastError = `HTTP ${response.status}`;
             }
             catch (error) {
@@ -1242,10 +1286,12 @@ async function awaitReadiness(ready, logPath, cwd, serviceId, env = process.env,
         else if (ready.stdoutMatch !== undefined) {
             const text = serviceOutput(readServiceText(logPath));
             if (new RegExp(ready.stdoutMatch).test(text))
-                return;
+                return passed(`the log matched /${ready.stdoutMatch}/`);
             lastError = `pattern /${ready.stdoutMatch}/ not yet in service log`;
         }
-        await sleep(intervalMs);
+        // A service that is nearly ready is seen at once; one that is slow is asked at most every intervalMs.
+        await sleep(Math.min(intervalMs, 25 * 2 ** attempt));
+        attempt += 1;
     }
     throw new Error(`Service "${serviceId}": readiness probe timed out after ${timeoutMs}ms (${lastError || 'no probe matched'})`);
 }
@@ -1280,15 +1326,18 @@ async function startExternalService(service, paths, worldEnv, stripEnv, boot) {
     // Publish the declared teardown before an external command can create state.
     boot?.external({ id: service.id, type: 'external', command: [...external.up], pid: 0, log, env: {},
         external: { down: [...external.down], cwd, discoveredEnv: { ...(service.env ?? {}) } } });
-    const upOutput = await runExternalUp(external.up, cwd, service.id, env, log, boot?.signal);
+    const upOutput = await runExternalUp(external.up, cwd, service.id, env, log, boot?.signal, boot?.progress);
+    boot?.progress(`${service.id}: up returned`);
     // 2. readiness — Docker-backed externals take seconds to boot.
-    await awaitReadiness(external.readyWhen, log, cwd, service.id, env, boot?.signal);
+    const readiness = await awaitReadiness(external.readyWhen, log, cwd, service.id, env, boot?.signal);
+    boot?.progress(`${service.id}: ready (${readiness})`);
     // 3. status — discover connection info (optional; may reuse up output instead).
     let statusOutput = '';
     if (external.status) {
         const statusResult = await runExternalCommand(external.status, cwd, service.id, 'status', env, boot?.signal);
         statusOutput = statusResult.stdout || statusResult.stderr;
         appendFileSync(log, `\n$ ${external.status.join(' ')}\n${statusOutput}`);
+        boot?.progress(`${service.id}: status read`);
     }
     // 4. discover — apply declarative mappings → injected env vars.
     const injected = {};
@@ -1389,6 +1438,7 @@ async function startService(config, service, worldEnv, paths, allocatedPorts, bo
     child.once('error', error => boot.fail(error));
     child.unref();
     await trackBootingChild(child, boot, identity);
+    boot.progress(`${service.id}: spawned`);
     // Track an early exit. allocatePort() is TOCTOU (it closes its probe listener before the
     // child binds), so if another/stale process already holds `port`, the child gets EADDRINUSE
     // and dies — but waitForTcp would then see the OTHER process answering and the world would
@@ -1414,6 +1464,7 @@ async function startService(config, service, worldEnv, paths, allocatedPorts, bo
         }
         throw new Error(`Service "${service.id}" failed to start: ${errorMessage(error)}\nLog: ${log}`);
     });
+    boot.progress(`${service.id}: port ${port} answers`);
     await confirmOwnPort(port, boot, ended, (service.type ?? 'twin') === 'twin', `Service "${service.id}"`, log, true).catch(async (error) => {
         if (undeadPids([child.pid]).length)
             recordWorldStop([log], 'world.service.stop', 'up (port not its own)', 'SIGTERM');
@@ -1429,10 +1480,11 @@ async function startService(config, service, worldEnv, paths, allocatedPorts, bo
     }
     const host = '127.0.0.1';
     const url = `http://${host}:${port}`;
+    boot.progress(`${service.id}: port ${port} is its own`);
     // Optional readiness probe beyond TCP (httpUrl/command/stdoutMatch): a process can bind its port
     // before it is actually serving, so this makes `up` wait until the service truly responds.
     if (service.ready && service.ready !== 'tcp') {
-        await untilReadyOrEnded((abort) => awaitReadiness(resolveReadyProbe(service.ready, { host, port, url }), log, cwd, service.id, env, abort), ended, boot, 'the service', log).catch(async (error) => {
+        const readiness = await untilReadyOrEnded((abort) => awaitReadiness(resolveReadyProbe(service.ready, { host, port, url }), log, cwd, service.id, env, abort), ended, boot, 'the service', log).catch(async (error) => {
             if (undeadPids([child.pid]).length)
                 recordWorldStop([log], 'world.service.stop', 'up (startup failed)', 'SIGTERM');
             try {
@@ -1441,6 +1493,7 @@ async function startService(config, service, worldEnv, paths, allocatedPorts, bo
             catch { /* best effort cleanup */ }
             throw new Error(`Service "${service.id}" failed its readiness probe: ${errorMessage(error)}\nLog: ${log}`);
         });
+        boot.progress(`${service.id}: ready (${readiness})`);
     }
     return {
         id: service.id,
@@ -1891,6 +1944,7 @@ async function startColocatedServices(config, colocated, isolation, worldEnv, pa
             catch { /* best effort cleanup */ }
             throw new Error(`Co-located host failed to complete startup (isolation=${isolation}): ${errorMessage(error)}\nLog: ${log}`);
         });
+        boot.progress('co-located host: its all-started receipt is read');
         await parallelStartup(allocated, async ({ service, port }) => {
             const bindTimeoutMs = typeof service.ready === 'object' && service.ready.timeoutMs !== undefined ? Math.max(service.ready.timeoutMs, 15_000) : 15_000;
             await untilReadyOrEnded((abort) => waitForTcp(port, bindTimeoutMs, abort), ended, boot, 'the co-located host', log).catch(async (error) => {
@@ -1932,6 +1986,7 @@ async function startColocatedServices(config, colocated, isolation, worldEnv, pa
 }
 export async function upWorld(configId, options = {}, abort) {
     abort?.throwIfAborted();
+    const upStarted = Date.now();
     const root = resolve(options.root ?? process.cwd());
     const found = loadWorldConfig(configId, root);
     // the facts of the World's installed packs, over the kernel's, for this process and (through the instance file) its own
@@ -2228,10 +2283,17 @@ export async function upWorld(configId, options = {}, abort) {
         };
         const boot = {
             bootId: instanceToken, signal: cancelled.signal, fail: error => cancelled.abort(error), pids: new Set(), identities: {}, handles: new Map(),
+            // The product's own progress, one line per phase, so a caller that streams stderr sees where up's time goes.
+            progress: what => { try {
+                process.stderr.write(`volter-world up ${name}: +${((Date.now() - upStarted) / 1000).toFixed(2)} s ${what}\n`);
+            }
+            catch { /* a closed stderr never fails a boot */ } },
             external: service => { recordService(service); saveWorldInstance(worldInstance); },
             recordPids: () => writeOwnedPids(root, name, [...boot.pids], [...boot.pids], boot.identities),
         };
         const recordPidsSoFar = boot.recordPids;
+        // The runtime's own infrastructure, started before its declared position (ADR 0017), by service id.
+        const early = new Map();
         try {
             // Ownership survives caller/process loss without an inert capacity-holder process.
             retainWorldLifecycleForCleanup(root, name);
@@ -2242,28 +2304,46 @@ export async function upWorld(configId, options = {}, abort) {
             // The co-located host's twins are known by address once their ports are
             // allocated. A twin serves and calls no other service while it starts,
             // so a later twin declaration starts beside the host's startup; any other
-            // service waits until every earlier one is ready, as declared (ADR 0015).
+            // service waits until every earlier one is ready, as declared (ADR 0015), except the runtime's own
+            // infrastructure, which starts beside the host (ADR 0017).
             // A co-located twin's issued credentials are asked of it once the host is ready: it answers no request before.
             let colocatedReady;
             if (isolation !== 'process') {
                 const colocated = loaded.config.services.filter((service) => service.colocate && service.type !== 'external');
                 const host = await startColocatedServices(loaded.config, colocated, isolation, env, { root, instance, logs, data }, allocatedPorts, boot);
+                if (colocated.length)
+                    boot.progress(`co-located host spawned: ${colocated.length} twins`);
                 for (const started of host.services) {
                     recordService(started);
                     Object.assign(env, started.env);
                 }
                 colocatedReady = async () => {
                     await host.ready;
+                    if (colocated.length)
+                        boot.progress('co-located host ready: receipt read, every port admitted as its own');
                     for (const started of host.services) {
                         const declared = colocated.find((s) => s.id === started.id);
                         if (declared)
                             await issueCredentials(declared, started, env, issuing, unissued);
                     }
                     writeProxyEnv(root, name, env);
+                    if (colocated.length)
+                        boot.progress('co-located twins: credentials issued, proxy environment written');
                 };
                 recordPidsSoFar();
                 writeProxyEnv(root, name, env);
             }
+            // The runtime's own infrastructure starts now, beside the host, with the environment as it stands: it reads
+            // only the World's configuration and calls no service while it starts. Its result is taken at its declared
+            // position, so records, environment and `up`'s return keep declaration order; its failure fails the boot (ADR 0017).
+            for (const service of loaded.config.services) {
+                if (services[service.id] || !ownInfrastructureService(service))
+                    continue;
+                boot.progress(`${service.id}: starting beside the host (the runtime's own infrastructure)`);
+                const starting = startService(loaded.config, service, { ...env }, { root, instance, logs, data }, allocatedPorts, boot);
+                starting.catch((error) => boot.fail(error instanceof Error ? error : new Error(errorMessage(error))));
+                early.set(service.id, starting);
+            }
             let proxyForServices = null;
             // TWIN-64: attempt the ambient proxy once activeVendorMap(env) has at least one twin — tried
             // again after each service in case ITS start is what makes the map non-empty. A sealed world
@@ -2294,20 +2374,29 @@ export async function upWorld(configId, options = {}, abort) {
                 }
             };
             for (const service of loaded.config.services) {
-                if (services[service.id])
+                const starting = early.get(service.id);
+                if (!starting && services[service.id])
                     continue; // already up co-located
+                // At its position an early start still takes the host's readiness first, so credentials and environment merge in
+                // declared order; its own `up` has been running beside the host all along.
                 if (colocatedReady && (service.type ?? 'twin') !== 'twin') {
                     await colocatedReady();
                     colocatedReady = undefined;
                 }
                 attemptProxy();
                 boot.signal.throwIfAborted();
-                const started = await startService(loaded.config, service, env, { root, instance, logs, data }, allocatedPorts, boot);
+                if (!starting)
+                    boot.progress(`${service.id}: starting (${service.type ?? 'twin'})`);
+                const started = await (starting ?? startService(loaded.config, service, env, { root, instance, logs, data }, allocatedPorts, boot));
+                // An early start published its teardown when it began; its record moves to its declared position.
+                if (starting)
+                    delete services[service.id];
                 recordService(started);
                 recordPidsSoFar();
                 Object.assign(env, started.env);
                 await issueCredentials(service, started, env, issuing, unissued);
                 writeProxyEnv(root, name, env);
+                boot.progress(`${service.id}: started, its environment merged`);
             }
             if (colocatedReady)
                 await colocatedReady();
@@ -2337,11 +2426,13 @@ export async function upWorld(configId, options = {}, abort) {
             // Config env and discovered credentials: a file this writes is owner-only; a file the caller already made keeps
             // the mode the caller chose (a shared env file may be read under another uid).
             publishEnvOutput(envOutputClaim, envFileContents(env));
+            boot.progress(`environment written: ${envFile}`);
             materializeBrowserFiles(data, root, name, loaded.config.id);
             writePidsFromInstance(worldInstance, Object.values(worldInstance.services).map((service) => service.pid).filter((pid) => pid > 0));
             saveWorldInstance(worldInstance);
             const servicePids = [...new Set(Object.values(services).map((service) => service.pid).filter((pid) => pid > 0))];
             handoffWorldLifecycle(root, name, servicePids);
+            boot.progress('returning: the World is up');
             if (mode === 'share') {
                 try {
                     return await shareWorldServices(name, { root, ...(options.share ?? {}) });
@@ -2356,6 +2447,12 @@ export async function upWorld(configId, options = {}, abort) {
         catch (error) {
             cleanupUncertain = true;
             detachBootSignals();
+            // An infrastructure `up` started early may still be running: end it and let it settle before its teardown runs.
+            if (early.size) {
+                cancelled.abort(error);
+                await Promise.allSettled(early.values());
+                saveWorldInstance(worldInstance);
+            }
             // Rollback never lets its own failure replace the boot's: each step's error is added to the original.
             const rollbackErrors = [];
             try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-runtime",
-  "version": "3.0.98",
+  "version": "3.0.100",
   "description": "World configs for twins: boot named local runtimes, allocate ports, generate world.env/instance.json, and run apps against fake-key twin worlds.",
   "keywords": [
     "twin",
@@ -69,14 +69,14 @@
     "node": ">=22.3"
   },
   "peerDependencies": {
-    "@volter/world-core": "3.0.98",
-    "@volter/world-console": "3.0.93"
+    "@volter/world-core": "3.0.100",
+    "@volter/world-console": "3.0.95"
   },
   "dependencies": {
     "@electric-sql/pglite": "0.5.8",
     "@electric-sql/pglite-pgvector": "0.0.9",
     "@volter/world-access": "3.0.1",
-    "@volter/world-core": "3.0.98",
+    "@volter/world-core": "3.0.100",
     "mongodb": "~6.20.0",
     "pg-gateway": "0.3.0-beta.4",
     "smol-toml": "^1.8.0",

package/src/infra.ts

@@ -7,14 +7,23 @@
 // that owns the World's lifetime, as every other service's recorder is, and not of a tool that exits once they
 // serve. A process layer where a child does not outlive its parent (a browser tab's) otherwise ended the PGlite host
 // the moment `volter-world-infra up` returned, and the World's readiness probe never saw it.
-import { existsSync, readFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
+import { accessSync, constants, existsSync, readFileSync, statSync } from 'node:fs';
+import { delimiter, dirname, join } from 'node:path';
 import { signalChild } from './process-signal.mjs';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { infraConnections, parseInfraDefinition } from './pglite-backing.ts';
 import { errorMessage } from './error-message.ts';
 
+/** Whether a program is on PATH, read from the file system without starting a process: where a missing program
+ *  still costs a process round trip (a browser tab's kernel), the container probe is not spawned at all. */
+function onPath(name: string, env: NodeJS.ProcessEnv): boolean {
+  return (env.PATH ?? '').split(delimiter).some((dir) => {
+    if (!dir) return false;
+    try { const path = join(dir, name); accessSync(path, constants.X_OK); return statSync(path).isFile(); } catch { return false; }
+  });
+}
+
 export interface InfrastructureIo { out: (text: string) => void; err: (text: string) => void }
 
 interface Ran { status: number | null; stdout: string; stderr: string; error?: Error }
@@ -61,10 +70,34 @@ function runCommand(command: string, args: string[], options: { env: NodeJS.Proc
 /** One phase of the World-managed infrastructure. `env` is the infrastructure service's environment, which the
  *  services this starts run in; `signal` is the boot's abort (the World's own up passes it; the tool has none). */
 export async function runInfrastructure(phase: string, env: NodeJS.ProcessEnv, io: InfrastructureIo, signal?: AbortSignal): Promise<number> {
-  if (phase !== 'up' && phase !== 'status' && phase !== 'down') {
-    io.err('managed infrastructure: expected up, status, or down\n');
+  if (phase !== 'up' && phase !== 'status' && phase !== 'down' && phase !== 'prepare') {
+    io.err('managed infrastructure: expected up, status, down, or prepare\n');
     return 2;
   }
+  // prepare: the image build's step that makes the World's PGlite cluster once, on its host, so the World's first up
+  // opens it instead of running initdb (pglite-backing.ts, pglitePrepare; ADR 0018). It needs the World's
+  // definition, not an instance.
+  if (phase === 'prepare') {
+    const config = env.VOLTER_WORLD_CONFIG;
+    const declaredDefinition = config ? join(dirname(config), 'world.infrastructure.yml') : undefined;
+    if (!config || !declaredDefinition || !existsSync(declaredDefinition)) {
+      io.err('managed infrastructure prepare: VOLTER_WORLD_CONFIG must name a world.json beside its world.infrastructure.yml\n');
+      return 2;
+    }
+    const postgres = parseInfraDefinition(readFileSync(declaredDefinition, 'utf8')).filter((s) => s.kind === 'postgres');
+    if (postgres.length !== 1) {
+      io.out('managed infrastructure prepare: no single declared PostgreSQL; nothing to prepare\n');
+      return 0;
+    }
+    const { pglitePrepare } = await import('./pglite-backing.ts');
+    try {
+      io.out(`managed infrastructure prepared ${await pglitePrepare(postgres[0]!, config, { env, ...(signal ? { signal } : {}) })}\n`);
+      return 0;
+    } catch (error) {
+      io.err(`managed infrastructure prepare failed: ${errorMessage(error)}\n`);
+      return 1;
+    }
+  }
 
   const worldConfig = env.VOLTER_WORLD_CONFIG;
   const worldData = env.VOLTER_WORLD_DATA;
@@ -84,7 +117,7 @@ export async function runInfrastructure(phase: string, env: NodeJS.ProcessEnv, i
     signal?.throwIfAborted();
     return ran;
   };
-  const launch = { env, ...(signal ? { signal } : {}) };
+  const launch = { env, ...(signal ? { signal } : {}), note: (what: string) => io.out(`managed infrastructure: ${what}\n`) };
   const classify = (raw: string): string => /no space left on device|enospc/iu.test(raw)
     ? 'insufficient writable storage'
     : /out of memory|cannot allocate memory|killed/iu.test(raw)
@@ -125,6 +158,8 @@ export async function runInfrastructure(phase: string, env: NodeJS.ProcessEnv, i
       io.err(`managed infrastructure: VOLTER_WORLD_INFRA_BACKING must be docker, pglite or native (got ${JSON.stringify(forced)})\n`);
       return 2;
     }
+    // No docker on PATH is the same absence the probe's ENOENT reports, read without a process.
+    if (process.platform !== 'win32' && !onPath('docker', env)) return 'pglite';
     const probe = await runCommand('docker', ['info', '--format', '{{.ServerVersion}}'], { env, timeout: 10_000, ...(signal ? { signal } : {}) });
     signal?.throwIfAborted();
     if (probe.status === 0 && probe.stdout.trim()) return 'docker';

package/src/pglite-backing.ts

@@ -12,7 +12,7 @@
 // services only. A definition declaring mysql without a container runtime is
 // refused with the kinds named, never half-booted. Redis never reaches it: every
 // redis service is the redis twin's (redis-backing.ts).
-import { closeSync, existsSync, mkdirSync, openSync, readFileSync, rmSync, statSync } from 'node:fs';
+import { appendFileSync, closeSync, cpSync, existsSync, mkdirSync, openSync, readdirSync, readFileSync, renameSync, rmdirSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { connect } from 'node:net';
 import { dirname, join } from 'node:path';
 import { spawn, type ChildProcess } from 'node:child_process';
@@ -123,7 +123,7 @@ function hostOwnership(pidFile: string) {
  *  the control plane's NODE_OPTIONS and proxies), and the boot's abort. The `volter-world-infra` process passes
  *  nothing and its hosts inherit its own environment, which is that same service environment. The World's `up`,
  *  running the up phase in its own process, passes it: its own process.env is the operator's, not the service's. */
-export interface HostLaunch { env?: NodeJS.ProcessEnv; signal?: AbortSignal }
+export interface HostLaunch { env?: NodeJS.ProcessEnv; signal?: AbortSignal; note?: (what: string) => void }
 
 /** The argv that serves one service on its declared loopback port, with its bytes in `serviceData`. */
 function hostArgv(service: InfraService, serviceData: string): string[] {
@@ -164,6 +164,84 @@ function logSince(log: string, offset: number): string {
   return readFileSync(log).subarray(offset).toString('utf8');
 }
 
+/**
+ * A World's PostgreSQL cluster prepared before its first boot (architecture, managed infrastructure; ADR 0018).
+ * PGlite's first start in an empty data directory runs initdb in wasm, writes the whole cluster through the file
+ * system, then the host creates the declared database and role; in a browser tab that is the World's slowest boot
+ * step. `volter-world-infra prepare` runs the host's own open path (`pglite-host.mjs --prepare`) once, on the image
+ * build's host, into `<World dir>/.volter-prepared/pglite-postgres-data`, with a stamp naming the PGlite pin and the
+ * declared identity. At `up`, an empty service data directory takes that cluster by rename, and PGlite finds
+ * PG_VERSION and resumes it (its own existing-dataDir path). Only an exact stamp is taken; anything else boots as before.
+ */
+export const PREPARED_DIRECTORY = '.volter-prepared';
+
+/** Where a World's prepared PostgreSQL cluster lives, beside its world.json, and its stamp. */
+export function preparedCluster(worldConfig: string): { directory: string; stamp: string } {
+  const directory = join(dirname(worldConfig), PREPARED_DIRECTORY, containerlessDataDirectory('postgres')!);
+  return { directory, stamp: `${directory}.json` };
+}
+
+/**
+ * What a prepared cluster must have been made with: this runtime (whose pglite-host.mjs is the open path that made
+ * it), its exact PGlite pin (initdb's encoding and locale are PGlite's defaults: the host passes no initdb
+ * parameters), and the declared user and database. The password is not in the cluster: the role is created without
+ * one (LOGIN SUPERUSER) and the host's gateway checks the declared password on each connection, so a World with
+ * another password takes the same cluster and authenticates against its own. Extensions are loaded into the module
+ * at each open, never created in the cluster by the open path.
+ */
+function preparedStamp(service: InfraService): string {
+  const manifest = JSON.parse(readFileSync(join(here(), '..', 'package.json'), 'utf8')) as { version?: string; dependencies?: Record<string, string> };
+  const pglite = manifest.dependencies?.['@electric-sql/pglite'];
+  if (!pglite || !/^\d+\.\d+\.\d+$/.test(pglite)) throw new Error('world-runtime pins no exact @electric-sql/pglite version');
+  return `${JSON.stringify({ runtime: manifest.version ?? 'unversioned', pglite, user: service.postgres!.user, database: service.postgres!.database })}\n`;
+}
+
+/** Run the host's open path once into the World's prepared directory; replaces an earlier preparation. */
+export async function pglitePrepare(service: InfraService, worldConfig: string, launch: HostLaunch = {}): Promise<string> {
+  if (service.kind !== 'postgres' || !service.postgres?.password) throw new Error('only a declared PostgreSQL with a literal POSTGRES_PASSWORD is prepared');
+  const { directory, stamp } = preparedCluster(worldConfig);
+  rmSync(directory, { recursive: true, force: true });
+  rmSync(stamp, { force: true });
+  mkdirSync(directory, { recursive: true });
+  const child = spawn('node', [hostScript(), '--prepare', '--data', directory], {
+    windowsHide: true,
+    env: { ...(launch.env ?? process.env), VOLTER_WORLD_PGLITE_USER: service.postgres.user,
+      VOLTER_WORLD_PGLITE_DATABASE: service.postgres.database, VOLTER_WORLD_PGLITE_PASSWORD: service.postgres.password },
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  const lifetime = commandLifetime(child, launch.signal);
+  let output = '';
+  child.stdout!.on('data', (chunk: Buffer) => { output += chunk.toString('utf8'); });
+  child.stderr!.on('data', (chunk: Buffer) => { output += chunk.toString('utf8'); });
+  const { code } = await lifetime.finish();
+  if (code !== 0 || !existsSync(join(directory, 'PG_VERSION'))) {
+    rmSync(directory, { recursive: true, force: true });
+    throw new Error(`pglite prepare exited ${code ?? 'null'} without a cluster\n${output.trim().split('\n').slice(-40).join('\n')}`);
+  }
+  writeFileSync(stamp, preparedStamp(service));
+  return directory;
+}
+
+/** Give an empty service data directory the World's prepared cluster when its stamp matches; says what it did. */
+function placePreparedCluster(service: InfraService, serviceData: string, worldConfig: string | undefined): { placed: boolean; note?: string } {
+  if (service.kind !== 'postgres' || !worldConfig || existsSync(join(serviceData, 'PG_VERSION'))) return { placed: false };
+  const { directory, stamp } = preparedCluster(worldConfig);
+  if (!existsSync(join(directory, 'PG_VERSION')) || !existsSync(stamp)) return { placed: false };
+  if (readFileSync(stamp, 'utf8') !== preparedStamp(service)) return { placed: false, note: `prepared cluster ${directory} not taken: its stamp names another PGlite pin or identity` };
+  if (existsSync(serviceData)) {
+    if (readdirSync(serviceData).length) return { placed: false };
+    rmdirSync(serviceData);
+  }
+  mkdirSync(dirname(serviceData), { recursive: true });
+  // A rename moves the cluster without writing its files; across file systems it is copied.
+  try { renameSync(directory, serviceData); }
+  catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== 'EXDEV') throw error;
+    cpSync(directory, serviceData, { recursive: true });
+  }
+  return { placed: true, note: `prepared cluster ${directory} placed at ${serviceData}` };
+}
+
 export async function pgliteUp(services: InfraService[], dataDir: string, launch: HostLaunch = {}): Promise<void> {
   const env = launch.env ?? process.env;
   // Every check before any start: a refused up starts nothing, so it never leaves the World half-booted.
@@ -190,10 +268,12 @@ export async function pgliteUp(services: InfraService[], dataDir: string, launch
   const started: string[] = [];
   try {
     for (const { service, name, serviceData, log, pidFile, argv } of plan) {
+      const placed = placePreparedCluster(service, serviceData, env.VOLTER_WORLD_CONFIG);
       mkdirSync(serviceData, { recursive: true });
       mkdirSync(dirname(log), { recursive: true });
+      if (placed.note) { appendFileSync(log, `${placed.note}\n`); launch.note?.(placed.note); }
       const offset = existsSync(log) ? statSync(log).size : 0;
-      const [command, ...args] = argv;
+      const [command, ...args] = placed.placed ? [...argv, '--prepared'] : argv;
       // a real fd, not a pipe: the host must outlive this process untethered
       const logFd = openSync(log, 'a');
       const child = spawn(command!, args, {
@@ -218,6 +298,7 @@ export async function pgliteUp(services: InfraService[], dataDir: string, launch
       if (!host.identity?.start) throw new Error('Managed host birth capture failed; retiring held child');
       publishProcessReceipt(spawnReceiptPath(pidFile), JSON.stringify(host.identity) + '\n');
       publishProcessReceipt(pidFile, `${child.pid}\n`);
+      launch.note?.(`${name} spawned`);
       const deadline = Date.now() + READY_TIMEOUT_MS;
       const line = readyLine(service.hostPort);
       // ready when OUR child says its listener is bound (a squatter that took the port after the check
@@ -228,8 +309,10 @@ export async function pgliteUp(services: InfraService[], dataDir: string, launch
         if (Date.now() > deadline) throw new Error(`${name} did not serve port ${service.hostPort} within ${READY_TIMEOUT_MS / 1000}s — see ${log}`);
         // an aborted boot (Ctrl-C during up) stops waiting; the catch below ends what this up started
         launch.signal?.throwIfAborted();
-        await sleep(200);
+        // the ready line is a small log read, and the port is asked only once it is there
+        await sleep(25);
       }
+      launch.note?.(`${name} serving on 127.0.0.1:${service.hostPort}`);
       if (service.kind === 'mongodb') await mongodbReady(service, launch, deadline);
       child.unref();
     }

package/src/pglite-host.mjs

@@ -100,8 +100,10 @@ const CONTRIB = [
 const { PGlite } = await import('@electric-sql/pglite');
 const { vector } = await import('@electric-sql/pglite-pgvector');
 const extensions = { vector };
-for (const name of CONTRIB) {
-  const extension = (await import(`@electric-sql/pglite/contrib/${name}`))[name];
+// Imported together: in a browser tab each import is a module load through the kernel, and one after another
+// they were a fixed wait on every boot.
+for (const [name, module] of await Promise.all(CONTRIB.map(async name => [name, await import(`@electric-sql/pglite/contrib/${name}`)]))) {
+  const extension = module[name];
   if (!extension) throw new Error(`pglite-host: @electric-sql/pglite/contrib/${name} exports no ${name}`);
   extensions[name] = extension;
 }
@@ -116,7 +118,14 @@ function arg(name) {
   return value;
 }
 
-const port = Number(arg('--port'));
+// --prepare: create the declared cluster in --data (initdb, the declared database and role) through the same open
+// path a serving host takes, close it cleanly and exit without listening. The World's image build runs it on the
+// host so the tab opens an existing cluster (pglite-backing.ts, pglitePrepare).
+const preparing = process.argv.includes('--prepare');
+// --prepared: the data directory is a cluster `--prepare` made for this declared identity (pglite-backing.ts checks
+// its stamp before passing this), so the declared database and role exist and the maintenance open is skipped.
+const prepared = process.argv.includes('--prepared');
+const port = preparing ? 0 : Number(arg('--port'));
 const dataDir = arg('--data');
 const databaseUser = process.env.VOLTER_WORLD_PGLITE_USER;
 const databaseName = process.env.VOLTER_WORLD_PGLITE_DATABASE;
@@ -125,7 +134,7 @@ if (![databaseUser, databaseName, databasePassword].every(value => typeof value
   process.stderr.write('pglite-host: declared database identity and throwaway password are required\n');
   process.exit(2);
 }
-if (!Number.isInteger(port) || port < 1 || port > 65535) {
+if (!preparing && (!Number.isInteger(port) || port < 1 || port > 65535)) {
   process.stderr.write('pglite-host: --port must be 1-65535\n');
   process.exit(2);
 }
@@ -139,6 +148,11 @@ process.stderr.on('error', () => {});
 const initKeepAlive = setInterval(() => {}, 500);
 const quoteIdentifier = value => `"${value.replaceAll('"', '""')}"`;
 async function openDeclaredDatabase() {
+  if (prepared) {
+    const db = await PGlite.create({ dataDir, extensions, database: databaseName });
+    await db.exec(`SET SESSION AUTHORIZATION ${quoteIdentifier(databaseUser)}`);
+    return db;
+  }
   // PostgreSQL cannot rename its current database. Use its maintenance database
   // before opening the declared one; old Worlds' rows in postgres stay intact.
   const maintenance = await PGlite.create({ dataDir, extensions, database: 'template1' });
@@ -626,7 +640,13 @@ const server = net.createServer((socket) => {
   });
 });
 
-void dbReady.then(() => {
+if (preparing) void dbReady.then(async (db) => {
+  await db.close();
+  clearInterval(initKeepAlive);
+  process.stdout.write(`pglite-host prepared ${dataDir}\n`);
+  process.exit(0);
+});
+else void dbReady.then(() => {
   clearInterval(initKeepAlive);
   server.listen(port, '127.0.0.1', () => {
     process.stdout.write(`pglite-host serving postgres wire protocol on 127.0.0.1:${port}\n`);

package/src/runtime.ts

@@ -1053,6 +1053,7 @@ async function runExternalCommand(
   command: string[], cwd: string, serviceId: string, phase: string,
   env: NodeJS.ProcessEnv = process.env, abort?: AbortSignal, timeoutMs = 60_000,
 ): Promise<{ stdout: string; stderr: string }> {
+  if (ownInfrastructureStatus(command)) return runOwnInfrastructureStatus(serviceId, phase, env, abort, timeoutMs);
   const [bin, ...args] = ownCommand(command);
   if (!bin) throw new Error(`External service "${serviceId}": ${phase} command is empty`);
   if (!commandExists(bin)) throw new ExternalCommandUnavailableError(`External service "${serviceId}": \`${bin}\` not found on PATH (the ${phase} command's tool is not installed)`);
@@ -1093,8 +1094,9 @@ async function runExternalUp(
   env: NodeJS.ProcessEnv,
   logPath: string,
   abort?: AbortSignal,
+  progress?: (what: string) => void,
 ): Promise<string> {
-  if (ownInfrastructureUp(command)) return runOwnInfrastructureUp(command, serviceId, env, logPath, abort);
+  if (ownInfrastructureUp(command)) return runOwnInfrastructureUp(command, serviceId, env, logPath, abort, progress);
   const [bin, ...args] = ownCommand(command);
   if (!bin) throw new Error(`External service "${serviceId}": up command is empty`);
   if (!commandExists(bin)) {
@@ -1144,7 +1146,37 @@ function ownInfrastructureUp(command: string[]): boolean {
   return command[0] === 'volter-world-infra' && command[1] === 'up' && ownCommand(command)[0] === process.execPath;
 }
 
-async function runOwnInfrastructureUp(command: string[], serviceId: string, env: NodeJS.ProcessEnv, logPath: string, abort?: AbortSignal): Promise<string> {
+/** Whether a declaration is the runtime's own managed infrastructure: an external service whose `up` is
+ *  `volter-world-infra up` run in this process. It reads only the World's own configuration and calls no declared
+ *  service while it starts, so it starts beside the co-located host (ADR 0017). */
+function ownInfrastructureService(service: WorldServiceConfig): boolean {
+  return service.type === 'external' && service.external !== undefined && ownInfrastructureUp(service.external.up);
+}
+
+/** Whether a command is this runtime's own `volter-world-infra status`: the managed infrastructure's readiness probe
+ *  and its status read (init declares both). It runs in this process, as `up` does: a separate process would load the
+ *  runtime again to read a pid and connect to a port, which in a browser tab costs a whole Node start per call. */
+function ownInfrastructureStatus(command: string[]): boolean {
+  return command.length === 2 && command[0] === 'volter-world-infra' && command[1] === 'status' && ownCommand(command)[0] === process.execPath;
+}
+
+async function runOwnInfrastructureStatus(serviceId: string, phase: string, env: NodeJS.ProcessEnv, abort: AbortSignal | undefined, timeoutMs: number): Promise<{ stdout: string; stderr: string }> {
+  abort?.throwIfAborted();
+  const bounded = new AbortController();
+  const onAbort = () => bounded.abort(abort!.reason);
+  abort?.addEventListener('abort', onAbort, { once: true });
+  const timer = setTimeout(() => bounded.abort(new Error(`External service "${serviceId}": ${phase} command timed out after ${timeoutMs}ms`)), timeoutMs);
+  let stdout = ''; let stderr = '';
+  try {
+    const { runInfrastructure } = await import('./infra.ts');
+    const code = await runInfrastructure('status', env, { out: (text) => { stdout += text; }, err: (text) => { stderr += text; } }, bounded.signal);
+    bounded.signal.throwIfAborted();
+    if (code !== 0) throw new Error(`External service "${serviceId}": ${phase} command exited ${code}\n${stdout}${stderr}`);
+    return { stdout, stderr };
+  } finally { clearTimeout(timer); abort?.removeEventListener('abort', onAbort); }
+}
+
+async function runOwnInfrastructureUp(command: string[], serviceId: string, env: NodeJS.ProcessEnv, logPath: string, abort?: AbortSignal, progress?: (what: string) => void): Promise<string> {
   writeFileSync(logPath, `$ ${command.join(' ')}\n`, { mode: 0o600 });
   chmodSync(logPath, 0o600);
   const out = openPrivateLog(logPath, 'a');
@@ -1152,7 +1184,11 @@ async function runOwnInfrastructureUp(command: string[], serviceId: string, env:
   try {
     abort?.throwIfAborted();
     const { runInfrastructure } = await import('./infra.ts');
-    const write = (text: string) => { chunks.push(text); writeSync(out, text); };
+    // Its phase lines (backing chosen, host spawned, serving) are the boot's progress too.
+    const write = (text: string) => {
+      chunks.push(text); writeSync(out, text);
+      for (const line of text.split('\n')) if (line.startsWith('managed infrastructure')) progress?.(`${serviceId}: ${line}`);
+    };
     const code = await runInfrastructure(command[1]!, env, { out: write, err: write }, abort);
     abort?.throwIfAborted();
     if (code !== 0) {
@@ -1184,34 +1220,38 @@ async function awaitReadiness(
   serviceId: string,
   env: NodeJS.ProcessEnv = process.env,
   abort?: AbortSignal,
-): Promise<void> {
-  if (!ready) return;
+): Promise<string> {
+  if (!ready) return 'no readiness declared';
   const timeoutMs = ready.timeoutMs ?? 60_000;
   const intervalMs = ready.intervalMs ?? 500;
   const started = Date.now();
   let lastError = '';
+  let attempt = 0;
+  const passed = (check: string) => `${check} after ${attempt + 1} ${attempt ? 'checks' : 'check'}`;
   while (Date.now() - started < timeoutMs) {
     abort?.throwIfAborted();
     if (ready.command !== undefined) {
       if (!commandExists(ready.command)) {
         throw new Error(`Service "${serviceId}": readiness command \`${ready.command}\` not found on PATH`);
       }
-      try { await runExternalCommand([ready.command, ...(ready.args ?? [])], cwd, serviceId, 'readiness', env, abort, Math.max(1, timeoutMs - (Date.now() - started))); return; }
+      try { await runExternalCommand([ready.command, ...(ready.args ?? [])], cwd, serviceId, 'readiness', env, abort, Math.max(1, timeoutMs - (Date.now() - started))); return passed(`\`${[ready.command, ...(ready.args ?? [])].join(' ')}\` exited 0`); }
       catch (error) { if (error instanceof CommandRetirementError) throw error; lastError = errorMessage(error); }
     } else if (ready.httpUrl !== undefined) {
       try {
         const response = await fetch(ready.httpUrl, { signal: AbortSignal.any([AbortSignal.timeout(Math.max(1, timeoutMs - (Date.now() - started))), ...(abort ? [abort] : [])]) });
-        if (response.status >= 200 && response.status < 400) return;
+        if (response.status >= 200 && response.status < 400) return passed(`GET ${ready.httpUrl} answered ${response.status}`);
         lastError = `HTTP ${response.status}`;
       } catch (error) {
         lastError = errorMessage(error);
       }
     } else if (ready.stdoutMatch !== undefined) {
       const text = serviceOutput(readServiceText(logPath));
-      if (new RegExp(ready.stdoutMatch).test(text)) return;
+      if (new RegExp(ready.stdoutMatch).test(text)) return passed(`the log matched /${ready.stdoutMatch}/`);
       lastError = `pattern /${ready.stdoutMatch}/ not yet in service log`;
     }
-    await sleep(intervalMs);
+    // A service that is nearly ready is seen at once; one that is slow is asked at most every intervalMs.
+    await sleep(Math.min(intervalMs, 25 * 2 ** attempt));
+    attempt += 1;
   }
   throw new Error(`Service "${serviceId}": readiness probe timed out after ${timeoutMs}ms (${lastError || 'no probe matched'})`);
 }
@@ -1258,10 +1298,12 @@ async function startExternalService(
   // Publish the declared teardown before an external command can create state.
   boot?.external({ id: service.id, type: 'external', command: [...external.up], pid: 0, log, env: {},
     external: { down: [...external.down], cwd, discoveredEnv: { ...(service.env ?? {}) } } });
-  const upOutput = await runExternalUp(external.up, cwd, service.id, env, log, boot?.signal);
+  const upOutput = await runExternalUp(external.up, cwd, service.id, env, log, boot?.signal, boot?.progress);
+  boot?.progress(`${service.id}: up returned`);
 
   // 2. readiness — Docker-backed externals take seconds to boot.
-  await awaitReadiness(external.readyWhen, log, cwd, service.id, env, boot?.signal);
+  const readiness = await awaitReadiness(external.readyWhen, log, cwd, service.id, env, boot?.signal);
+  boot?.progress(`${service.id}: ready (${readiness})`);
 
   // 3. status — discover connection info (optional; may reuse up output instead).
   let statusOutput = '';
@@ -1269,6 +1311,7 @@ async function startExternalService(
     const statusResult = await runExternalCommand(external.status, cwd, service.id, 'status', env, boot?.signal);
     statusOutput = statusResult.stdout || statusResult.stderr;
     appendFileSync(log, `\n$ ${external.status.join(' ')}\n${statusOutput}`);
+    boot?.progress(`${service.id}: status read`);
   }
 
   // 4. discover — apply declarative mappings → injected env vars.
@@ -1324,6 +1367,8 @@ type BootContext = {
   handles: Map<number, ReturnType<typeof spawn>>;
   external: (service: WorldServiceInstance) => void;
   recordPids: () => void;
+  /** One progress line of this `up` on stderr, stamped with the time since it began (architecture, co-located startup). */
+  progress: (what: string) => void;
 };
 async function trackBootingChild(child: ReturnType<typeof spawn>, boot: BootContext, birth: Promise<SpawnIdentity | undefined>): Promise<void> {
   if (!child.pid) return;
@@ -1382,6 +1427,7 @@ async function startService(
   child.once('error', error => boot.fail(error));
   child.unref();
   await trackBootingChild(child, boot, identity);
+  boot.progress(`${service.id}: spawned`);
 
   // Track an early exit. allocatePort() is TOCTOU (it closes its probe listener before the
   // child binds), so if another/stale process already holds `port`, the child gets EADDRINUSE
@@ -1407,6 +1453,7 @@ async function startService(
     }
     throw new Error(`Service "${service.id}" failed to start: ${errorMessage(error)}\nLog: ${log}`);
   });
+  boot.progress(`${service.id}: port ${port} answers`);
 
   await confirmOwnPort(port, boot, ended, (service.type ?? 'twin') === 'twin', `Service "${service.id}"`, log, true).catch(async (error) => {
     if (undeadPids([child.pid!]).length) recordWorldStop([log], 'world.service.stop', 'up (port not its own)', 'SIGTERM');
@@ -1422,15 +1469,17 @@ async function startService(
 
   const host = '127.0.0.1';
   const url = `http://${host}:${port}`;
+  boot.progress(`${service.id}: port ${port} is its own`);
 
   // Optional readiness probe beyond TCP (httpUrl/command/stdoutMatch): a process can bind its port
   // before it is actually serving, so this makes `up` wait until the service truly responds.
   if (service.ready && service.ready !== 'tcp') {
-    await untilReadyOrEnded((abort) => awaitReadiness(resolveReadyProbe(service.ready as Exclude<typeof service.ready, 'tcp' | undefined>, { host, port, url }), log, cwd, service.id, env, abort), ended, boot, 'the service', log).catch(async (error) => {
+    const readiness = await untilReadyOrEnded((abort) => awaitReadiness(resolveReadyProbe(service.ready as Exclude<typeof service.ready, 'tcp' | undefined>, { host, port, url }), log, cwd, service.id, env, abort), ended, boot, 'the service', log).catch(async (error) => {
       if (undeadPids([child.pid!]).length) recordWorldStop([log], 'world.service.stop', 'up (startup failed)', 'SIGTERM');
       try { await signalHeldChild(child, 'SIGTERM', true, identity); } catch { /* best effort cleanup */ }
       throw new Error(`Service "${service.id}" failed its readiness probe: ${errorMessage(error)}\nLog: ${log}`);
     });
+    boot.progress(`${service.id}: ready (${readiness})`);
   }
 
   return {
@@ -1821,6 +1870,7 @@ async function startColocatedServices(
       try { await signalHeldChild(child, 'SIGTERM', true, identity); } catch { /* best effort cleanup */ }
       throw new Error(`Co-located host failed to complete startup (isolation=${isolation}): ${errorMessage(error)}\nLog: ${log}`);
     });
+    boot.progress('co-located host: its all-started receipt is read');
     await parallelStartup(allocated, async ({ service, port }) => {
       const bindTimeoutMs = typeof service.ready === 'object' && service.ready.timeoutMs !== undefined ? Math.max(service.ready.timeoutMs, 15_000) : 15_000;
       await untilReadyOrEnded((abort) => waitForTcp(port, bindTimeoutMs, abort), ended, boot, 'the co-located host', log).catch(async (error) => {
@@ -1857,6 +1907,7 @@ async function startColocatedServices(
 
 export async function upWorld(configId: string, options: UpWorldOptions = {}, abort?: AbortSignal): Promise<WorldInstance> {
   abort?.throwIfAborted();
+  const upStarted = Date.now();
   const root = resolve(options.root ?? process.cwd());
   const found = loadWorldConfig(configId, root);
   // the facts of the World's installed packs, over the kernel's, for this process and (through the instance file) its own
@@ -2110,10 +2161,14 @@ export async function upWorld(configId: string, options: UpWorldOptions = {}, ab
     };
     const boot: BootContext = {
       bootId: instanceToken, signal: cancelled.signal, fail: error => cancelled.abort(error), pids: new Set(), identities: {}, handles: new Map(),
+      // The product's own progress, one line per phase, so a caller that streams stderr sees where up's time goes.
+      progress: what => { try { process.stderr.write(`volter-world up ${name}: +${((Date.now() - upStarted) / 1000).toFixed(2)} s ${what}\n`); } catch { /* a closed stderr never fails a boot */ } },
       external: service => { recordService(service); saveWorldInstance(worldInstance); },
       recordPids: () => writeOwnedPids(root, name, [...boot.pids], [...boot.pids], boot.identities),
     };
     const recordPidsSoFar = boot.recordPids;
+    // The runtime's own infrastructure, started before its declared position (ADR 0017), by service id.
+    const early = new Map<string, Promise<WorldServiceInstance>>();
     try {
       // Ownership survives caller/process loss without an inert capacity-holder process.
       retainWorldLifecycleForCleanup(root, name);
@@ -2124,27 +2179,41 @@ export async function upWorld(configId: string, options: UpWorldOptions = {}, ab
       // The co-located host's twins are known by address once their ports are
       // allocated. A twin serves and calls no other service while it starts,
       // so a later twin declaration starts beside the host's startup; any other
-      // service waits until every earlier one is ready, as declared (ADR 0015).
+      // service waits until every earlier one is ready, as declared (ADR 0015), except the runtime's own
+      // infrastructure, which starts beside the host (ADR 0017).
       // A co-located twin's issued credentials are asked of it once the host is ready: it answers no request before.
       let colocatedReady: (() => Promise<void>) | undefined;
       if (isolation !== 'process') {
         const colocated = loaded.config.services.filter((service) => service.colocate && service.type !== 'external');
         const host = await startColocatedServices(loaded.config, colocated, isolation, env, { root, instance, logs, data }, allocatedPorts, boot);
+        if (colocated.length) boot.progress(`co-located host spawned: ${colocated.length} twins`);
         for (const started of host.services) {
           recordService(started);
           Object.assign(env, started.env);
         }
         colocatedReady = async () => {
           await host.ready;
+          if (colocated.length) boot.progress('co-located host ready: receipt read, every port admitted as its own');
           for (const started of host.services) {
             const declared = colocated.find((s) => s.id === started.id);
             if (declared) await issueCredentials(declared, started, env, issuing, unissued);
           }
           writeProxyEnv(root, name, env);
+          if (colocated.length) boot.progress('co-located twins: credentials issued, proxy environment written');
         };
         recordPidsSoFar();
         writeProxyEnv(root, name, env);
       }
+      // The runtime's own infrastructure starts now, beside the host, with the environment as it stands: it reads
+      // only the World's configuration and calls no service while it starts. Its result is taken at its declared
+      // position, so records, environment and `up`'s return keep declaration order; its failure fails the boot (ADR 0017).
+      for (const service of loaded.config.services) {
+        if (services[service.id] || !ownInfrastructureService(service)) continue;
+        boot.progress(`${service.id}: starting beside the host (the runtime's own infrastructure)`);
+        const starting = startService(loaded.config, service, { ...env }, { root, instance, logs, data }, allocatedPorts, boot);
+        starting.catch((error: unknown) => boot.fail(error instanceof Error ? error : new Error(errorMessage(error))));
+        early.set(service.id, starting);
+      }
       let proxyForServices: ReturnType<typeof ensureWorldProxyFromEnv> | null = null;
       // TWIN-64: attempt the ambient proxy once activeVendorMap(env) has at least one twin — tried
       // again after each service in case ITS start is what makes the map non-empty. A sealed world
@@ -2174,16 +2243,23 @@ export async function upWorld(configId: string, options: UpWorldOptions = {}, ab
         }
       };
       for (const service of loaded.config.services) {
-        if (services[service.id]) continue; // already up co-located
+        const starting = early.get(service.id);
+        if (!starting && services[service.id]) continue; // already up co-located
+        // At its position an early start still takes the host's readiness first, so credentials and environment merge in
+        // declared order; its own `up` has been running beside the host all along.
         if (colocatedReady && (service.type ?? 'twin') !== 'twin') { await colocatedReady(); colocatedReady = undefined; }
         attemptProxy();
         boot.signal.throwIfAborted();
-        const started = await startService(loaded.config, service, env, { root, instance, logs, data }, allocatedPorts, boot);
+        if (!starting) boot.progress(`${service.id}: starting (${service.type ?? 'twin'})`);
+        const started = await (starting ?? startService(loaded.config, service, env, { root, instance, logs, data }, allocatedPorts, boot));
+        // An early start published its teardown when it began; its record moves to its declared position.
+        if (starting) delete services[service.id];
         recordService(started);
         recordPidsSoFar();
         Object.assign(env, started.env);
         await issueCredentials(service, started, env, issuing, unissued);
         writeProxyEnv(root, name, env);
+        boot.progress(`${service.id}: started, its environment merged`);
       }
       if (colocatedReady) await colocatedReady();
       detachBootSignals();
@@ -2208,11 +2284,13 @@ export async function upWorld(configId: string, options: UpWorldOptions = {}, ab
       // Config env and discovered credentials: a file this writes is owner-only; a file the caller already made keeps
       // the mode the caller chose (a shared env file may be read under another uid).
       publishEnvOutput(envOutputClaim, envFileContents(env));
+      boot.progress(`environment written: ${envFile}`);
       materializeBrowserFiles(data, root, name, loaded.config.id);
       writePidsFromInstance(worldInstance, Object.values(worldInstance.services).map((service) => service.pid).filter((pid) => pid > 0));
       saveWorldInstance(worldInstance);
       const servicePids = [...new Set(Object.values(services).map((service) => service.pid).filter((pid) => pid > 0))];
       handoffWorldLifecycle(root, name, servicePids);
+      boot.progress('returning: the World is up');
       if (mode === 'share') {
         try {
           return await shareWorldServices(name, { root, ...(options.share ?? {}) });
@@ -2225,6 +2303,8 @@ export async function upWorld(configId: string, options: UpWorldOptions = {}, ab
     } catch (error) {
       cleanupUncertain = true;
       detachBootSignals();
+      // An infrastructure `up` started early may still be running: end it and let it settle before its teardown runs.
+      if (early.size) { cancelled.abort(error); await Promise.allSettled(early.values()); saveWorldInstance(worldInstance); }
       // Rollback never lets its own failure replace the boot's: each step's error is added to the original.
       const rollbackErrors: string[] = [];
       try { await stopWorldProxy(root, name, boot.handles); } catch (proxyError) { rollbackErrors.push(`proxy stop failed: ${errorMessage(proxyError)}`); }