# Co-located World startup is bounded and parallel

Status: Accepted. Date: 2026-09-30. Card t_94bcd252, task t_eecd4a9d.

Dub's accepted browser trace charges 3.71 s cold and 3.38 s repeat to World
startup. The pinned runtime imports and starts co-located factories in sequence,
then waits for TCP listeners and boot-identity answers in sequence. These twins
have preallocated distinct ports, separate roots and fixed configuration. Their
factories do not consume an earlier twin's discovered environment.

Run up to eight independent startup operations at once. On any failure, stop
beginning new operations and join every operation already begun. Shared-mode
startup records each returned server before checking its bound port, then stops
all started servers if startup fails. Every stop has the existing three-second
budget; rollback errors accompany the original failure. Worker-mode startup
also terminates all owned workers on failure, and exit before readiness rejects
even when its exit code is zero. No crashed worker is restarted.

The runtime allocates ports and checks package pins before starting its host,
then checks TCP listeners concurrently and verifies boot identities concurrently.
These phases preserve their dependency order. ADR 0012 replaces the unconditional
multi-port settle with a boot-bound all-started receipt and per-port identity;
the matching receipt vouches for every co-located port (ADR 0014), and a foreign identity remains a refusal. Other process
and external service declarations retain their ordered environment dependencies; ADR 0015
lets a later twin declaration start once the host's addresses are allocated.
Returned services and environment merging retain declaration order.

The owner prohibits automated tests and walks in this coding lane. This source
decision does not claim a timing improvement. Main-push CI publishes the runtime
under the procedure in CONTRIBUTING.md (ADR 0013); the card's independent review
checks the published package in the unchanged application recipe.