Co-located readiness follows an all-started receipt

Status: Accepted. Date: 2026-09-30. Card t_94bcd252, task t_a330be32. Supersedes ADR 0011's unconditional multi-port settle.

The owner asks that World startup retain only true serial dependencies. A listening port and its boot identity do not prove that the co-located host has finished starting every factory. The previous runtime therefore waited 300 ms even when every twin had already started. A timer is a guess about that state.

The runtime names a private readiness file unique to its boot. After every factory has returned and each actual port has been validated against its requested port, the host CLI registers shutdown handlers and publishes an atomic receipt containing the boot identity and complete port map. Publication failure stops the host. The receipt never substitutes for TCP or identity probes.

The runtime awaits that exact receipt with a wall-clock deadline, boot cancellation and host-exit observation. Its boot and complete port set must match. Only then do TCP and per-port identity checks complete admission. A matching identity can end its own settle early because no factory startup is still pending. A foreign identity is still refused. ADR 0014 removes the shared host guard for twins without an identity: the matching receipt already proves the host bound every port.

This changes a lifecycle dependency rather than a vendor's behavior. Process services retain their existing port confirmation. The bounded parallel starts and rollback from ADR 0011 remain. World boot remains above the native app reference; no latency is claimed before the independent published-build review. The coding lane runs no tests or walks by the owner's rule. Runtime publication follows main-push CI (CONTRIBUTING.md, ADR 0013).