diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 176449cd03..3b80b2cd9b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -3,21 +3,46 @@ name: CI
 
 on:
   push:
-    paths-ignore:
-      - '**/*.md'
     branches: [next]
   pull_request:
-    types: [opened, synchronize]
-    paths-ignore:
-      - '**/*.md'
+    types: [opened, synchronize, reopened]
     branches: [next]
   merge_group:
+  workflow_dispatch:
 
 permissions:
+  contents: read
+  pull-requests: read
   id-token: write
   actions: write
 
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
+  plan:
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.plan.outputs.matrix }}
+      tests: ${{ steps.plan.outputs.tests }}
+      profile: ${{ steps.plan.outputs.profile }}
+      coverage-node: ${{ steps.node.outputs.node-version }}
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+        id: node
+        with:
+          node-version: '24'
+          check-latest: true
+      - name: Check CI planning and coverage guards
+        run: node --test scripts/test/ci.test.js
+      - name: Plan tests
+        id: plan
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node scripts/ci-plan.js
+
   typecheck:
     runs-on: ubuntu-latest
 
@@ -65,29 +90,20 @@ jobs:
         run: ut run site:build
 
   test:
+    needs: plan
+    if: needs.plan.outputs.tests == 'true'
     strategy:
       fail-fast: false
-      matrix:
-        os: ['ubuntu-latest', 'macos-latest', 'windows-latest']
-        node: ['22', '24', '26']
-        coverage: [false]
-        # Replace (not duplicate) the ubuntu/24 leg with a coverage-enabled one.
-        # `include` cannot overwrite an existing matrix dimension, so the base
-        # coverage:false combo must be excluded first or ubuntu/24 would run twice.
-        exclude:
-          - os: 'ubuntu-latest'
-            node: '24'
-            coverage: false
-        include:
-          - os: 'ubuntu-latest'
-            node: '24'
-            coverage: true
+      matrix: ${{ fromJSON(needs.plan.outputs.matrix) }}
 
-    name: Test (${{ matrix.os }}, ${{ matrix.node }})
+    name: Test (${{ matrix.os }}, ${{ matrix.node }}, ${{ matrix.shardIndex }}/${{ matrix.shardTotal }})
     runs-on: ${{ matrix.os }}
+    env:
+      CI_TEST_REPORT: '1'
+      CI_COVERAGE_REPORT: ${{ matrix.coverage && '1' || '0' }}
 
     concurrency:
-      group: test-${{ github.workflow }}-#${{ github.event.pull_request.number || github.head_ref || github.ref }}-(${{ matrix.os }}, ${{ matrix.node }})
+      group: test-${{ github.workflow }}-#${{ github.event.pull_request.number || github.head_ref || github.ref }}-${{ matrix.os }}-${{ matrix.node }}-${{ matrix.shardIndex }}
       cancel-in-progress: true
 
     steps:
@@ -190,7 +206,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
         with:
-          node-version: ${{ matrix.node }}
+          node-version: ${{ matrix.coverage && needs.plan.outputs.coverage-node || matrix.node }}
 
       - name: Cache Node compile cache
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
@@ -199,7 +215,6 @@ jobs:
           key: node-compile-cache-${{ runner.os }}-node${{ matrix.node }}-${{ hashFiles('pnpm-workspace.yaml', '**/package.json') }}
           restore-keys: |
             node-compile-cache-${{ runner.os }}-node${{ matrix.node }}-
-            node-compile-cache-${{ runner.os }}-
 
       - name: Enable Node compile cache
         # runner.* is not available in job-level env, so export NODE_COMPILE_CACHE
@@ -222,36 +237,60 @@ jobs:
 
       - name: Run tests (with coverage)
         if: ${{ matrix.coverage }}
-        run: ut run ci
+        run: ut run ci -- --shard=${{ matrix.shardIndex }}/${{ matrix.shardTotal }}
 
       - name: Run tests
         if: ${{ !matrix.coverage }}
-        run: ut run test
-
-      # Summarize how parallel the full-isolate-off suite actually ran. The gating
-      # test run above (`ut run ci` on the coverage leg, `ut run test` on the rest)
-      # emits Vitest JSON (vitest.config.ts, CI only); this step turns it into
-      # avg/peak concurrency + efficiency metrics in the job summary. It is
-      # informational only (always() so failures still surface metrics) and never
-      # changes the gate — the test run above already set the job's pass/fail.
+        run: ut run test -- --shard=${{ matrix.shardIndex }}/${{ matrix.shardTotal }}
+
       - name: Report parallelism metrics
         if: always()
         # Call node directly: `ut run <script> -- ...` re-serializes forwarded args into
         # a shell string without re-quoting, so the parentheses in --name break it.
-        run: node scripts/ci-test-benchmark.js --report-only --vitest-json benchmark/ci-test/ci-run/vitest-results.json --output-dir benchmark/ci-test/ci-run --name "Parallel test metrics (${{ matrix.os }}, Node ${{ matrix.node }}, isolate=off)"
+        run: node scripts/ci-test-benchmark.js --report-only --vitest-json benchmark/ci-test/ci-run/vitest-results.json --output-dir benchmark/ci-test/ci-run --name "Parallel test metrics (${{ matrix.os }}, Node ${{ matrix.node }}, shard ${{ matrix.shardIndex }}/${{ matrix.shardTotal }})"
+
+      - name: Upload test results
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: ci-results-${{ matrix.os }}-node${{ matrix.node }}-${{ matrix.shardIndex }}-of-${{ matrix.shardTotal }}
+          path: benchmark/ci-test/ci-run/
+          overwrite: true
+          if-no-files-found: error
+          retention-days: 7
 
       - name: Run example tests
-        if: ${{ matrix.os != 'windows-latest' }}
-        run: |
-          ut run example:test:all
+        if: ${{ matrix.os != 'windows-latest' && matrix.shardIndex == 1 }}
+        run: ut run example:test:all
 
+  coverage:
+    needs: [plan, test]
+    if: needs.plan.outputs.tests == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: utooland/setup-utoo@e7aa4d726a17f79f68aed736476ea5bd68f8ba52 # main
+      - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+        with:
+          node-version: ${{ needs.plan.outputs.coverage-node }}
+      - run: ut install --from pnpm
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          pattern: ci-results-ubuntu-latest-node24-*
+          path: benchmark/ci-test/shards
+      - name: Check coverage inventory
+        run: node scripts/ci-coverage.js benchmark/ci-test/shards benchmark/ci-test/blobs
+      - name: Merge coverage
+        run: node node_modules/vitest/vitest.mjs --merge-reports=benchmark/ci-test/blobs --coverage
       - name: Code Coverage
-        if: ${{ matrix.coverage }}
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
         with:
           use_oidc: true
+          fail_ci_if_error: true
 
   test-egg-bin:
+    needs: plan
+    if: needs.plan.outputs.tests == 'true'
     strategy:
       fail-fast: false
       matrix:
@@ -293,7 +332,6 @@ jobs:
           key: node-compile-cache-${{ runner.os }}-node${{ matrix.node }}-${{ hashFiles('pnpm-workspace.yaml', '**/package.json') }}
           restore-keys: |
             node-compile-cache-${{ runner.os }}-node${{ matrix.node }}-
-            node-compile-cache-${{ runner.os }}-
 
       - name: Enable Node compile cache
         # runner.* is not available in job-level env, so export NODE_COMPILE_CACHE
@@ -328,11 +366,13 @@ jobs:
 
       - name: Code Coverage
         if: ${{ matrix.coverage }}
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
         with:
           use_oidc: true
 
   test-egg-scripts:
+    needs: plan
+    if: needs.plan.outputs.tests == 'true'
     strategy:
       fail-fast: false
       matrix:
@@ -374,7 +414,6 @@ jobs:
           key: node-compile-cache-${{ runner.os }}-node${{ matrix.node }}-${{ hashFiles('pnpm-workspace.yaml', '**/package.json') }}
           restore-keys: |
             node-compile-cache-${{ runner.os }}-node${{ matrix.node }}-
-            node-compile-cache-${{ runner.os }}-
 
       - name: Enable Node compile cache
         # runner.* is not available in job-level env, so export NODE_COMPILE_CACHE
@@ -411,11 +450,13 @@ jobs:
 
       - name: Code Coverage
         if: ${{ matrix.coverage }}
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
         with:
           use_oidc: true
 
   test-tegg-vitest:
+    needs: plan
+    if: needs.plan.outputs.tests == 'true'
     name: Test tegg-vitest (Node ${{ matrix.node }})
     runs-on: ubuntu-latest
     strategy:
@@ -452,13 +493,19 @@ jobs:
         run: node node_modules/vitest/vitest.mjs run --root tegg/core/vitest --config vitest.config.ts --pool threads --no-isolate --maxWorkers 1
 
   done:
+    if: always()
     runs-on: ubuntu-latest
     needs:
+      - plan
+      - coverage
       - test
       - test-egg-bin
       - test-egg-scripts
       - test-tegg-vitest
       - typecheck
     steps:
-      - run: exit 1
-        if: ${{ always() && (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')) }}
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - name: Require all planned checks
+        env:
+          CI_NEEDS: ${{ toJSON(needs) }}
+        run: node scripts/ci-plan.js check
diff --git a/plugins/schedule/test/customTypeError.test.ts b/plugins/schedule/test/customTypeError.test.ts
index 9adee88674..bbd8d6c86c 100644
--- a/plugins/schedule/test/customTypeError.test.ts
+++ b/plugins/schedule/test/customTypeError.test.ts
@@ -1,7 +1,5 @@
-import { setTimeout as sleep } from 'node:timers/promises';
-
 import { mm, type MockApplication } from '@eggjs/mock';
-import { describe, it, afterAll, beforeAll, expect } from 'vitest';
+import { describe, it, afterAll, beforeAll, expect, vi } from 'vitest';
 
 import { getFixtures, getLogContent, contains } from './utils.ts';
 
@@ -16,9 +14,11 @@ describe.skipIf(process.platform === 'win32')('test/customTypeError.test.ts', ()
   afterAll(() => app.close());
 
   it('should work', async () => {
-    await sleep(process.env.CI ? 10000 : 5000);
-    const log = getLogContent('customTypeError');
-    // console.log(log);
-    expect(contains(log, 'cluster_log')).toBeGreaterThanOrEqual(1);
+    await vi.waitFor(
+      () => {
+        expect(contains(getLogContent('customTypeError'), 'cluster_log')).toBeGreaterThanOrEqual(1);
+      },
+      { timeout: 10000, interval: 100 },
+    );
   });
 });
diff --git a/plugins/schedule/test/immediate.test.ts b/plugins/schedule/test/immediate.test.ts
index 0843b5fde9..93b5c40dfb 100644
--- a/plugins/schedule/test/immediate.test.ts
+++ b/plugins/schedule/test/immediate.test.ts
@@ -1,7 +1,7 @@
 import { setTimeout as sleep } from 'node:timers/promises';
 
 import { mm, type MockApplication } from '@eggjs/mock';
-import { describe, it, afterAll, beforeAll, expect } from 'vitest';
+import { describe, it, afterAll, beforeAll, expect, vi } from 'vitest';
 
 import { contains, getFixtures, getLogContent } from './utils.ts';
 
@@ -16,12 +16,14 @@ describe.skipIf(process.platform === 'win32')('cluster - immediate', () => {
   afterAll(() => app.close());
 
   it('should work', async () => {
-    await sleep(5000);
-
-    const log = getLogContent('immediate');
-    // console.log(log);
-    expect(contains(log, 'immediate-interval')).toBeGreaterThanOrEqual(2);
-    expect(contains(log, 'immediate-cron')).toBeGreaterThanOrEqual(2);
+    await vi.waitFor(
+      () => {
+        const log = getLogContent('immediate');
+        expect(contains(log, 'immediate-interval')).toBeGreaterThanOrEqual(2);
+        expect(contains(log, 'immediate-cron')).toBeGreaterThanOrEqual(2);
+      },
+      { timeout: 5000, interval: 100 },
+    );
   });
 });
 
diff --git a/plugins/schedule/test/scheduleError.test.ts b/plugins/schedule/test/scheduleError.test.ts
index b307f681be..ceb60f47af 100644
--- a/plugins/schedule/test/scheduleError.test.ts
+++ b/plugins/schedule/test/scheduleError.test.ts
@@ -1,7 +1,5 @@
-import { setTimeout as sleep } from 'node:timers/promises';
-
 import { mm, type MockApplication } from '@eggjs/mock';
-import { describe, it, afterAll, beforeAll } from 'vitest';
+import { describe, it, afterAll, beforeAll, expect, vi } from 'vitest';
 
 import { getFixtures } from './utils.ts';
 
@@ -16,7 +14,11 @@ describe.skipIf(process.platform === 'win32')('test/scheduleError.test.ts', () =
   afterAll(() => app.close());
 
   it('should thrown', async () => {
-    await sleep(5000);
-    app.expect('stderr', /`schedule\.interval` or `schedule\.cron` or `schedule\.immediate` must be present/);
+    await vi.waitFor(
+      () => {
+        expect(app.stderr).toMatch(/`schedule\.interval` or `schedule\.cron` or `schedule\.immediate` must be present/);
+      },
+      { timeout: 5000, interval: 100 },
+    );
   });
 });
diff --git a/plugins/schedule/test/subscription.test.ts b/plugins/schedule/test/subscription.test.ts
index 1909e2f67a..0895aa4074 100644
--- a/plugins/schedule/test/subscription.test.ts
+++ b/plugins/schedule/test/subscription.test.ts
@@ -1,7 +1,7 @@
 import { setTimeout as sleep } from 'node:timers/promises';
 
 import { mm, type MockApplication } from '@eggjs/mock';
-import { describe, it, afterAll, beforeAll, expect } from 'vitest';
+import { describe, it, afterAll, beforeAll, expect, vi } from 'vitest';
 
 import { contains, getFixtures, getLogContent } from './utils.ts';
 
@@ -15,14 +15,15 @@ describe('cluster - subscription', () => {
   afterAll(() => app.close());
 
   it('should support interval and cron', async () => {
-    // interval is 4000ms; give the forked agent/worker boot + IPC + log flush
-    // enough slack on busy CI runners so the task fires at least once.
-    await sleep(process.env.CI ? 10000 : 5000);
-
-    const log = getLogContent('subscription');
-    // console.log(log);
-    expect(contains(log, 'interval')).toBeGreaterThanOrEqual(1);
-    expect(contains(log, 'cron')).toBeGreaterThanOrEqual(1);
+    // Keep the real 4-second interval and wait for both schedules to run.
+    await vi.waitFor(
+      () => {
+        const log = getLogContent('subscription');
+        expect(contains(log, 'interval')).toBeGreaterThanOrEqual(1);
+        expect(contains(log, 'cron')).toBeGreaterThanOrEqual(1);
+      },
+      { timeout: 10000, interval: 100 },
+    );
   });
 });
 
@@ -39,9 +40,12 @@ describe('cluster - subscription-generator', () => {
   afterAll(() => app.close());
 
   it('should throw error on generator function', async () => {
-    await sleep(3000);
-
-    app.expect('stderr', /"schedule" generator function is not support, should use async function instead/);
+    await vi.waitFor(
+      () => {
+        expect(app.stderr).toMatch(/"schedule" generator function is not support, should use async function instead/);
+      },
+      { timeout: 5000, interval: 100 },
+    );
   });
 });
 
diff --git a/scripts/ci-coverage.js b/scripts/ci-coverage.js
new file mode 100644
index 0000000000..b06c02da1a
--- /dev/null
+++ b/scripts/ci-coverage.js
@@ -0,0 +1,47 @@
+import assert from 'node:assert/strict';
+import { copyFileSync, mkdirSync, readdirSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+export function validateShards(reports) {
+  assert.ok(reports.length > 0, 'Coverage reports are missing');
+  const first = reports[0];
+  assert.equal(reports.length, first.shard.count, 'A coverage shard is missing');
+  const indices = new Set();
+  const files = new Set();
+  for (const report of reports) {
+    assert.equal(report.success, true, 'A coverage shard failed');
+    assert.ok(report.coveredFiles > 0, 'A shard has no coverage');
+    for (const key of ['commit', 'node', 'os', 'arch', 'vitest']) {
+      assert.equal(report[key], first[key], `Coverage shards have different ${key}`);
+    }
+    assert.equal(report.shard.count, first.shard.count, 'Inconsistent shard count');
+    assert.ok(report.shard.index >= 1 && report.shard.index <= first.shard.count, 'Invalid shard index');
+    assert.ok(!indices.has(report.shard.index), 'Duplicate coverage shard');
+    indices.add(report.shard.index);
+    assert.deepEqual(report.expected, first.expected, 'Coverage inventories differ');
+    for (const file of report.files) {
+      assert.ok(['passed', 'skipped'].includes(file.state), `Incomplete test file: ${file.key}`);
+      assert.ok(!files.has(file.key), `Test file ran in multiple shards: ${file.key}`);
+      files.add(file.key);
+    }
+  }
+  assert.deepEqual([...files].sort(), first.expected, 'Coverage shards must run every discovered test file');
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const [source, destination] = process.argv.slice(2);
+  const directories = readdirSync(source).map((entry) => path.join(source, entry));
+  const reports = directories.map((directory) =>
+    JSON.parse(readFileSync(path.join(directory, 'execution.json'), 'utf8')),
+  );
+  validateShards(reports);
+  mkdirSync(destination, { recursive: true });
+  for (let index = 0; index < directories.length; index++) {
+    copyFileSync(
+      path.join(directories[index], 'blob.json'),
+      path.join(destination, `shard-${reports[index].shard.index}.json`),
+    );
+  }
+  console.log(`Verified ${reports.length} coverage shards and ${reports[0].expected.length} test files`);
+}
diff --git a/scripts/ci-plan.js b/scripts/ci-plan.js
new file mode 100644
index 0000000000..df5a6b89ec
--- /dev/null
+++ b/scripts/ci-plan.js
@@ -0,0 +1,71 @@
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { appendFileSync, readFileSync } from 'node:fs';
+import { pathToFileURL } from 'node:url';
+
+export function createPlan(eventName, event, files = []) {
+  const profile =
+    eventName === 'pull_request' && !event.pull_request.labels.some((label) => label.name === 'ci:full')
+      ? 'pr'
+      : 'full';
+  const docsOnly =
+    profile === 'pr' &&
+    files.length > 0 &&
+    files.length < 3000 &&
+    files.every((file) => file.endsWith('.md') || file.startsWith('site/docs/') || file.startsWith('site/public/'));
+  const include = [];
+  for (const os of ['ubuntu-latest', 'macos-latest', 'windows-latest']) {
+    for (const node of ['22', '24', '26']) {
+      if (profile === 'pr' && os !== 'ubuntu-latest' && node !== '24') continue;
+      const shardTotal = profile === 'pr' && !(os === 'ubuntu-latest' && node === '26') ? 2 : 1;
+      for (let shardIndex = 1; shardIndex <= shardTotal; shardIndex++) {
+        include.push({ os, node, coverage: os === 'ubuntu-latest' && node === '24', shardIndex, shardTotal });
+      }
+    }
+  }
+  return { profile, tests: !docsOnly, matrix: { include } };
+}
+
+export function checkResults(needs) {
+  assert.equal(needs.plan?.result, 'success', 'CI planning must succeed');
+  assert.equal(needs.typecheck?.result, 'success', 'Static checks must succeed');
+  const tests = needs.plan.outputs.tests;
+  assert.ok(tests === 'true' || tests === 'false', 'The test plan must be explicit');
+  for (const name of ['test', 'coverage', 'test-egg-bin', 'test-egg-scripts', 'test-tegg-vitest']) {
+    assert.equal(needs[name]?.result, tests === 'true' ? 'success' : 'skipped', `Unexpected result for ${name}`);
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  if (process.argv[2] === 'check') {
+    checkResults(JSON.parse(process.env.CI_NEEDS));
+  } else {
+    const event = JSON.parse(readFileSync(process.env.GITHUB_EVENT_PATH, 'utf8'));
+    let files = [];
+    if (process.env.GITHUB_EVENT_NAME === 'pull_request') {
+      // The API returns PR changes against the merge base, including renames and deletions.
+      // Failure stops planning; incomplete or empty results select the full test workload.
+      const output = execFileSync(
+        'gh',
+        [
+          'api',
+          '--paginate',
+          '--slurp',
+          `repos/${process.env.GITHUB_REPOSITORY}/pulls/${event.number}/files?per_page=100`,
+        ],
+        { encoding: 'utf8' },
+      );
+      files = JSON.parse(output)
+        .flat()
+        .flatMap((file) => (file.previous_filename ? [file.filename, file.previous_filename] : [file.filename]));
+    }
+    const plan = createPlan(process.env.GITHUB_EVENT_NAME, event, files);
+    for (const [key, value] of Object.entries(plan)) {
+      appendFileSync(
+        process.env.GITHUB_OUTPUT,
+        `${key}=${typeof value === 'object' ? JSON.stringify(value) : value}\n`,
+      );
+    }
+    console.log(JSON.stringify(plan, null, 2));
+  }
+}
diff --git a/scripts/ci-reporter.ts b/scripts/ci-reporter.ts
new file mode 100644
index 0000000000..5775290b4b
--- /dev/null
+++ b/scripts/ci-reporter.ts
@@ -0,0 +1,80 @@
+import { mkdir, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+import type { Reporter, TestModule, Vitest } from 'vitest/node';
+
+// Public Vitest diagnostics include imports and suite hooks, unlike JSON test intervals.
+export default class CiReporter implements Reporter {
+  private ctx!: Vitest;
+  private expected: string[] = [];
+  private startedAt = 0;
+  private coveredFiles = 0;
+
+  onInit(ctx: Vitest): void {
+    this.ctx = ctx;
+  }
+
+  async onTestRunStart(): Promise<void> {
+    this.startedAt = Date.now();
+    const specs = await this.ctx.globTestSpecifications();
+    this.expected = specs.map((spec) => this.key(spec.project.name, spec.moduleId)).sort();
+  }
+
+  onCoverage(coverage: unknown): void {
+    // Vitest passes an Istanbul CoverageMap, not its serialized file map.
+    if (coverage && typeof coverage === 'object' && 'files' in coverage && typeof coverage.files === 'function') {
+      const files: unknown = coverage.files();
+      this.coveredFiles = Array.isArray(files) ? files.length : 0;
+    }
+  }
+
+  async onTestRunEnd(
+    modules: ReadonlyArray<TestModule>,
+    errors: ReadonlyArray<unknown>,
+    reason: string,
+  ): Promise<void> {
+    const cpus = os.availableParallelism();
+    const projects = this.ctx.projects.map(({ name, config }) => ({
+      name,
+      pool: config.pool,
+      isolate: config.isolate,
+      maxWorkers:
+        typeof config.maxWorkers === 'string'
+          ? Math.max(1, Math.min(cpus, Math.round((Number.parseInt(config.maxWorkers) / 100) * cpus)))
+          : (config.maxWorkers ?? Math.max(cpus - 1, 1)),
+      fsModuleCache: config.fsModuleCache,
+    }));
+    const report = {
+      commit: process.env.GITHUB_SHA,
+      node: process.version,
+      os: process.platform,
+      arch: process.arch,
+      cpus,
+      workerCeiling: Math.max(...projects.map((project) => project.maxWorkers)),
+      vitest: this.ctx.version,
+      shard: this.ctx.config.shard ?? { index: 1, count: 1 },
+      durationMs: Date.now() - this.startedAt,
+      success: reason === 'passed' && errors.length === 0,
+      coveredFiles: this.coveredFiles,
+      expected: this.expected,
+      projects,
+      files: modules.map((module) => ({
+        key: this.key(module.project.name, module.moduleId),
+        state: module.state(),
+        ...module.diagnostic(),
+        retries: [...module.children.allTests()].reduce(
+          (total, test) => total + (test.diagnostic()?.retryCount ?? 0),
+          0,
+        ),
+      })),
+    };
+    const directory = path.join(this.ctx.config.root, 'benchmark/ci-test/ci-run');
+    await mkdir(directory, { recursive: true });
+    await writeFile(path.join(directory, 'execution.json'), `${JSON.stringify(report, null, 2)}\n`);
+  }
+
+  private key(project: string, file: string): string {
+    return `${project}:${path.relative(this.ctx.config.root, file).split(path.sep).join('/')}`;
+  }
+}
diff --git a/scripts/ci-test-benchmark/environment.js b/scripts/ci-test-benchmark/environment.js
index 6c50b23f13..72b6e14086 100644
--- a/scripts/ci-test-benchmark/environment.js
+++ b/scripts/ci-test-benchmark/environment.js
@@ -5,19 +5,21 @@ import { extractCommandParameters } from './command.js';
 import { readJsonIfExists, readTextIfExists } from './fs.js';
 
 export async function collectEnvironment(command) {
-  const [packageJson, vitestConfig] = await Promise.all([
+  const [packageJson, vitestConfig, execution] = await Promise.all([
     readJsonIfExists(path.resolve(process.cwd(), 'package.json')),
     readVitestConfigDefaults(path.resolve(process.cwd(), 'vitest.config.ts')),
+    process.env.CI_TEST_REPORT === '1'
+      ? readJsonIfExists(path.resolve(process.cwd(), 'benchmark/ci-test/ci-run/execution.json'))
+      : null,
   ]);
   const cpus = os.cpus();
   const availableParallelism = typeof os.availableParallelism === 'function' ? os.availableParallelism() : cpus.length;
-  // Effective concurrency ceiling for the threads pool. vitest.config.ts caps
-  // maxWorkers on Windows CI; everywhere else the pool defaults to the machine's
-  // available parallelism. Mirror that condition so efficiency divides by the number
-  // of workers vitest could actually use, not the raw core count.
+  // Prefer resolved project settings from the gating run. Retain the historical
+  // root-config estimate for local benchmark runs without an execution report.
   const isWindowsCI = Boolean(process.env.CI) && os.platform() === 'win32';
   const workerCeiling =
-    isWindowsCI && typeof vitestConfig?.maxWorkers === 'number' ? vitestConfig.maxWorkers : availableParallelism;
+    execution?.workerCeiling ??
+    (isWindowsCI && typeof vitestConfig?.maxWorkers === 'number' ? vitestConfig.maxWorkers : availableParallelism);
 
   return {
     arch: os.arch(),
@@ -47,6 +49,7 @@ export async function collectEnvironment(command) {
     node: process.version,
     packageManager: packageJson?.packageManager ?? null,
     platform: os.platform(),
+    resolvedProjects: execution?.projects ?? null,
     release: os.release(),
     totalMemoryBytes: os.totalmem(),
     vitestConfig,
diff --git a/scripts/test/ci.test.js b/scripts/test/ci.test.js
new file mode 100644
index 0000000000..1674f99dbb
--- /dev/null
+++ b/scripts/test/ci.test.js
@@ -0,0 +1,100 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+
+import { validateShards } from '../ci-coverage.js';
+import { checkResults, createPlan } from '../ci-plan.js';
+
+const pr = { pull_request: { labels: [] } };
+
+await test('PR shards preserve all Node versions and operating systems', () => {
+  const plan = createPlan('pull_request', pr, ['packages/egg/src/index.ts']);
+  assert.equal(plan.tests, true);
+  assert.equal(plan.matrix.include.length, 9);
+  assert.deepEqual(
+    [...new Set(plan.matrix.include.map(({ os, node }) => `${os}/${node}`))],
+    ['ubuntu-latest/22', 'ubuntu-latest/24', 'ubuntu-latest/26', 'macos-latest/24', 'windows-latest/24'],
+  );
+  assert.equal(plan.matrix.include.filter((entry) => entry.coverage).length, 2);
+});
+
+await test('merge queue, branch pushes, manual runs and full PRs retain the complete matrix', () => {
+  for (const [eventName, event] of [
+    ['merge_group', {}],
+    ['push', {}],
+    ['workflow_dispatch', {}],
+    ['pull_request', { pull_request: { labels: [{ name: 'ci:full' }] } }],
+  ]) {
+    const plan = createPlan(eventName, event, ['README.md', 'package.json']);
+    assert.equal(plan.tests, true);
+    assert.equal(plan.matrix.include.length, 9);
+    assert.ok(plan.matrix.include.every((entry) => entry.shardTotal === 1));
+    assert.equal(new Set(plan.matrix.include.map(({ os, node }) => `${os}/${node}`)).size, 9);
+  }
+});
+
+await test('only known documentation changes can skip tests', () => {
+  assert.equal(createPlan('pull_request', pr, ['README.md', 'site/docs/index.md']).tests, false);
+  assert.equal(
+    createPlan(
+      'pull_request',
+      {
+        pull_request: { labels: [{ name: 'ci:full' }] },
+      },
+      ['README.md'],
+    ).tests,
+    true,
+  );
+  for (const files of [
+    [],
+    ['site/package.json'],
+    ['unknown'],
+    ['README.md', 'vitest.config.ts'],
+    Array(3000).fill('README.md'),
+  ]) {
+    assert.equal(createPlan('pull_request', pr, files).tests, true);
+  }
+});
+
+await test('the final gate rejects failed, cancelled, missing and unexpectedly skipped work', () => {
+  const names = ['test', 'coverage', 'test-egg-bin', 'test-egg-scripts', 'test-tegg-vitest', 'typecheck'];
+  const needs = Object.fromEntries(names.map((name) => [name, { result: 'success' }]));
+  needs.plan = { result: 'success', outputs: { tests: 'true' } };
+  checkResults(needs);
+  for (const result of ['failure', 'cancelled', 'skipped', undefined]) {
+    assert.throws(() => checkResults({ ...needs, test: { result } }));
+  }
+  assert.throws(() => checkResults({ ...needs, plan: { result: 'failure' } }));
+  for (const name of names.filter((name) => name !== 'typecheck')) needs[name].result = 'skipped';
+  needs.plan.outputs.tests = 'false';
+  checkResults(needs);
+});
+
+await test('coverage requires a complete, disjoint inventory from successful matching shards', () => {
+  const base = {
+    success: true,
+    coveredFiles: 1,
+    commit: 'sha',
+    node: 'v24',
+    os: 'linux',
+    arch: 'x64',
+    vitest: '5',
+    expected: ['a', 'b'],
+  };
+  const reports = [
+    { ...base, shard: { index: 1, count: 2 }, files: [{ key: 'a', state: 'passed' }] },
+    { ...base, shard: { index: 2, count: 2 }, files: [{ key: 'b', state: 'skipped' }] },
+  ];
+  validateShards(reports);
+  assert.throws(() => validateShards([]));
+  assert.throws(() => validateShards(reports.slice(0, 1)));
+  for (const override of [
+    { success: false },
+    { coveredFiles: 0 },
+    { commit: 'different' },
+    { shard: { index: 1, count: 2 } },
+    { files: [] },
+    { files: [{ key: 'a', state: 'passed' }] },
+    { files: [{ key: 'b', state: 'pending' }] },
+  ])
+    assert.throws(() => validateShards([reports[0], { ...reports[1], ...override }]));
+});
diff --git a/tools/egg-bin/src/baseCommand.ts b/tools/egg-bin/src/baseCommand.ts
index 98709ddba7..c06c25efaf 100644
--- a/tools/egg-bin/src/baseCommand.ts
+++ b/tools/egg-bin/src/baseCommand.ts
@@ -377,7 +377,10 @@ export abstract class BaseCommand<T extends typeof Command> extends Command {
 
   protected addNodeOptions(options: string) {
     if (this.env.NODE_OPTIONS) {
-      if (!this.env.NODE_OPTIONS.includes(options)) {
+      // Match an option boundary: --inspect-port must not suppress --inspect.
+      // An existing value, such as --inspect=127.0.0.1:0, already enables the flag.
+      const escaped = options.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+      if (!new RegExp(`(?:^|\\s)${escaped}(?=$|\\s|=)`).test(this.env.NODE_OPTIONS)) {
         this.env.NODE_OPTIONS = `${this.env.NODE_OPTIONS} ${options}`;
       }
     } else {
diff --git a/tools/egg-bin/test/commands/debug.test.ts b/tools/egg-bin/test/commands/debug.test.ts
index 3ecc95effb..cf92e110d8 100644
--- a/tools/egg-bin/test/commands/debug.test.ts
+++ b/tools/egg-bin/test/commands/debug.test.ts
@@ -12,7 +12,7 @@ describe('test/commands/debug.test.ts', () => {
   it('should startCluster success', () => {
     return (
       coffee
-        .fork(eggBin, ['dev', '--inspect'], { cwd })
+        .fork(eggBin, ['dev', '--inspect'], { cwd, env: { NODE_OPTIONS: '--inspect-port=0' } })
         // .debug()
         .expect('stdout', /"workers":1/)
         .expect('stdout', /"baseDir":".*?demo-app-debug"/)
diff --git a/tools/egg-bin/test/commands/dev.test.ts b/tools/egg-bin/test/commands/dev.test.ts
index 787856e526..b4d69dae31 100644
--- a/tools/egg-bin/test/commands/dev.test.ts
+++ b/tools/egg-bin/test/commands/dev.test.ts
@@ -127,7 +127,7 @@ describe('test/commands/dev.test.ts', () => {
   it('should startCluster with execArgv --inspect', () => {
     return (
       coffee
-        .fork(eggBin, ['dev', '--inspect'], { cwd })
+        .fork(eggBin, ['dev', '--inspect'], { cwd, env: { NODE_OPTIONS: '--inspect-port=0' } })
         // .debug()
         .expect('stderr', /Debugger listening on ws:\/\/127.0.0.1:\d+/)
         .expect('code', 0)
diff --git a/vitest.config.ts b/vitest.config.ts
index 773c8bef34..4f5888ef0c 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -4,8 +4,9 @@ const isCI = Boolean(process.env.CI);
 const isWindowsCI = isCI && process.platform === 'win32';
 
 // In CI, emit a Vitest JSON report next to the benchmark harness so the
-// "Report parallelism metrics" step can summarize the real gating run (isolate is
-// off, so tests run fully in parallel). Keep this path in sync with the metrics step
+// "Report parallelism metrics" step can summarize the real gating run.
+// execution.json records effective project options: file-based projects do not
+// inherit the root pool/isolate options. Keep this path in sync with the metrics step
 // in .github/workflows/ci.yml. Locally we keep the default reporter only.
 const CI_VITEST_JSON = 'benchmark/ci-test/ci-run/vitest-results.json';
 
@@ -13,7 +14,14 @@ const config: UserWorkspaceConfig = defineConfig({
   test: {
     pool: 'threads',
     isolate: false,
-    reporters: isCI ? ['default', ['json', { outputFile: CI_VITEST_JSON }]] : ['default'],
+    reporters: [
+      'default',
+      ...(isCI ? [['json', { outputFile: CI_VITEST_JSON }] as ['json', { outputFile: string }]] : []),
+      ...(process.env.CI_TEST_REPORT === '1' ? ['./scripts/ci-reporter.ts'] : []),
+      ...(process.env.CI_COVERAGE_REPORT === '1'
+        ? [['blob', { outputFile: 'benchmark/ci-test/ci-run/blob.json' }] as ['blob', { outputFile: string }]]
+        : []),
+    ],
     // Windows CI is more contention-sensitive than posix, so we cap the thread
     // pool. Use the full standard `windows-latest` runner (4 vCPU) instead of the
     // previous hard cap of 2; the suite already retries flaky tests (--retry 2).
diff --git a/wiki/concepts/vitest-isolate-false-state-leaks.md b/wiki/concepts/vitest-isolate-false-state-leaks.md
index bcfed2f5c0..4c4a3e22c8 100644
--- a/wiki/concepts/vitest-isolate-false-state-leaks.md
+++ b/wiki/concepts/vitest-isolate-false-state-leaks.md
@@ -15,14 +15,19 @@ source_files:
   - packages/core/src/lifecycle.ts
   - packages/egg/src/lib/egg.ts
   - tegg/plugin/tegg/test/MultiAppParallel.test.ts
-updated_at: 2026-09-23
+updated_at: 2026-09-24
 status: active
 ---
 
 ## Context
 
-The root `vitest.config.ts` runs the whole monorepo with `pool: 'threads'` and
-`isolate: false`. Under this mode every test **file** in a worker shares one
+The root `vitest.config.ts` declares `pool: 'threads'` and `isolate: false`.
+A September 24 inspection found that Vitest 5.0.1 file-based projects resolve
+to isolated `forks` because they do not inherit those root options. The findings
+below describe explicitly selected shared-worker runs, not the current default
+resolved project mode.
+
+Under shared-worker mode every test **file** in a worker shares one
 Node realm: the module registry, `globalThis`, module-level `let` bindings, the
 undici global dispatcher, `process` env/listeners and timers are all shared
 across files (and across `projects`, since projects share the worker pool).
@@ -161,6 +166,5 @@ pre-existing load flake independent of isolation.
 
 ## Related
 
-Now that the suite runs `isolate:false` safely, CI surfaces _how parallel it
-actually ran_ (avg/peak concurrency, parallel efficiency, critical path) in the
+CI surfaces _how parallel the selected configuration actually ran_ (avg/peak concurrency, parallel efficiency, critical path) in the
 test job summary — see [CI parallel test metrics](../workflows/ci-parallel-test-metrics.md).
diff --git a/wiki/index.md b/wiki/index.md
index 87d0aeb473..f8db12f661 100644
--- a/wiki/index.md
+++ b/wiki/index.md
@@ -13,7 +13,8 @@ Read this file before exploring raw sources.
 
 ## Workflows
 
-- [CI parallel test metrics](./workflows/ci-parallel-test-metrics.md) - How the CI test gate surfaces avg/peak concurrency + parallel-efficiency metrics for the isolate:false suite, and how to read or reproduce them.
+- [GitHub Actions performance plan](./workflows/ci-performance-plan.md) - PR/full matrix, sharding, test-runtime improvements, and acceptance criteria based on measured CI bottlenecks.
+- [CI parallel test metrics](./workflows/ci-parallel-test-metrics.md) - Test concurrency, resolved worker settings, retries, and shard inventories in CI artifacts.
 - [Docs and API Updates](./workflows/docs-and-api-updates.md) - How to handle changes that affect user-facing docs or durable project understanding.
 - [Local CI](./workflows/local-ci.md) - Local validation should run tests from clean sources and avoid stale artifacts (`dist/` duplicate-proto; fixture `.egg` scan-manifest caches) before tegg tests.
 - [PR preview packages](./workflows/pr-preview-packages.md) - Publish workspace previews through a pull request label and install them in consumer applications, including from stacked PRs.
@@ -36,4 +37,4 @@ Read this file before exploring raw sources.
 
 ## Sources
 
-- No standalone source summary pages seeded yet.
+- [CI performance baseline, September 2026](./sources/ci-performance-baseline.md) - Job and step timings from ten CI runs and three E2E runs, including runner delays and an inspector-port failure.
diff --git a/wiki/log.md b/wiki/log.md
index 666a717f9f..542ffe14be 100644
--- a/wiki/log.md
+++ b/wiki/log.md
@@ -480,3 +480,27 @@ Full **isolate:false suite validated GREEN** under CI-faithful parallelism (`--m
 - sources touched: `.github/workflows/pkg-pr-new.yml`, `scripts/publish-preview.js`, `scripts/utils.js`, `CONTRIBUTING.md`, `CONTRIBUTING.zh-CN.md`, `site/docs/{community/index,releases/pr-preview-packages}.md`, `site/docs/zh-CN/{community/index,releases/pr-preview-packages}.md`, `site/.vitepress/config.mts`, `https://github.com/stackblitz-labs/pkg.pr.new`, `https://blog.stackblitz.com/posts/cloudflare-backing-pkg-pr-new-data-infrastructure/`
 - pages updated: `wiki/workflows/pr-preview-packages.md`, `wiki/index.md`, `wiki/log.md`
 - note: The `pkg.pr.new` label enables public workspace previews, including stacked PRs; new commits and reopened PRs publish while labeled. The utoo build and shared release helpers feed `pkg-pr-new@latest`, preserve internal preview links, and restore manifests afterward. Publication uses read-only workflow permissions and the pkg.pr.new GitHub App. English and Chinese `/releases/` guides cover installation, rollback, and upstream retention: more than one month without downloads or more than six months old. The version menu, Community landing pages, and contribution guides link to them; only the version menu is active.
+
+## [2026-09-24] analysis | measure CI latency and propose a performance rollout
+
+- sources inspected: `.github/workflows/{ci,e2e-test}.yml`, `vitest.config.ts`, benchmark scripts, schedule and inspector tests, ten GitHub CI runs and three E2E runs from September 23
+- pages added: `wiki/sources/ci-performance-baseline.md`, `wiki/workflows/ci-performance-plan.md`; index and log updated
+- note: Main-suite execution and delayed runner starts dominate latency; dependency installation has a 4-second median in the inspected sample. The proposal combines a smaller PR matrix with full pre-merge compatibility, conservative sharding, complete coverage aggregation, and targeted test fixes. The latest CLI failure exposed an inspector-port collision candidate; the final `done` job was skipped after failure. The plan is not implemented, and its targets remain unmeasured.
+
+## [2026-09-24] workflow | implement PR shards and reliable CI aggregation
+
+- sources touched: `.github/workflows/ci.yml`, `scripts/ci-{plan,coverage,reporter}.*`, `scripts/test/ci.test.js`, `vitest.config.ts`, schedule tests, egg-bin inspector tests and option matching
+- pages updated: CI performance plan, local CI, parallel test metrics, shared-worker state-leak context, index and log
+- note: PRs use five platform/version combinations across nine jobs; merge groups retain all nine combinations. Coverage aggregation rejects missing or overlapping shards. The final gate rejects unexpected skips. Resolved Vitest 5 settings exposed a conflict with prior wiki claims: file-based projects currently use isolated forks. Hosted-run performance verification is pending.
+
+## [2026-09-24] workflow | resolve one Node version for coverage shards
+
+- sources inspected: [first draft-PR CI run](https://github.com/eggjs/egg/actions/runs/35947286821), `.github/workflows/ci.yml`, `scripts/ci-plan.js`, `scripts/ci-coverage.js`
+- pages updated: CI performance plan, parallel test metrics, index and log
+- note: All platform tests passed, but coverage shards resolved Node.js 24 to different cached patch releases. The coverage guard rejected the mismatch. The planner now supplies one exact version to all coverage producers and the merge job. Full-profile overrides also apply to documentation-only changes, and change detection retains previous paths for renamed files. A separate shared-worker experiment failed; isolated workers remain in use.
+
+## [2026-09-24] workflow | restore Codecov signature-key retrieval
+
+- sources inspected: [second hosted attempt](https://github.com/eggjs/egg/actions/runs/35948525958), [Codecov v5.5.5](https://github.com/codecov/codecov-action/releases/tag/v5.5.5), `.github/workflows/ci.yml`
+- pages updated: CI performance plan and log
+- note: All tests and the coverage inventory/merge passed in 14m 52s with 89.35 runner-minutes. The required upload exposed the old Codecov action's obsolete Keybase endpoint. CI now pins the upstream patch release that updates that endpoint, while retaining signature verification and upload failure propagation. Failed-run timings remain separate from successful performance evidence.
diff --git a/wiki/sources/ci-performance-baseline.md b/wiki/sources/ci-performance-baseline.md
new file mode 100644
index 0000000000..ddd887863f
--- /dev/null
+++ b/wiki/sources/ci-performance-baseline.md
@@ -0,0 +1,123 @@
+---
+title: CI performance baseline, September 2026
+type: source
+summary: GitHub job timings show that main-suite execution and delayed runner starts dominate CI latency.
+source_files:
+  - .github/workflows/ci.yml
+  - .github/workflows/e2e-test.yml
+  - vitest.config.ts
+  - scripts/ci-test-benchmark/vitest-summary.js
+  - plugins/schedule/test/subscription.test.ts
+  - tools/egg-bin/test/commands/debug.test.ts
+  - tools/egg-bin/test/commands/dev.test.ts
+  - https://github.com/eggjs/egg/actions/runs/35879900054
+  - https://github.com/eggjs/egg/actions/runs/35861608073
+  - https://github.com/eggjs/egg/actions/runs/35879899540
+  - https://github.com/eggjs/egg/actions/runs/35861720800
+updated_at: 2026-09-24
+status: active
+---
+
+## Scope and measurement
+
+Inspected ten completed, non-cancelled CI runs and three E2E runs from September
+23 using `gh run view --json jobs,createdAt,updatedAt,conclusion,event,headSha`,
+plus selected job logs. The local workflow inspected was at `0d0b36c88`; the
+latest measured run was at `c92333429`.
+
+Elapsed time below is workflow `updatedAt - createdAt`. Job execution time is
+`completedAt - startedAt`. Start delay is job `startedAt - workflow.createdAt`.
+For the independent test jobs, start delay approximates scheduling and runner
+provisioning delay; it does not establish the exact cause of the wait. The `done`
+job is excluded from the maximum start-delay calculation because it has dependencies.
+
+This is a diagnostic sample across different commits, including a matrix
+expansion and test changes. It is not a controlled before/after benchmark or a
+long-term percentile baseline. Failed runs are retained to expose wasted work.
+
+| CI run                                                               | Result  | Elapsed, minutes | Maximum independent-job start delay, minutes |
+| -------------------------------------------------------------------- | ------- | ---------------: | -------------------------------------------: |
+| [35849722187](https://github.com/eggjs/egg/actions/runs/35849722187) | success |            21.93 |                                         3.65 |
+| [35850384973](https://github.com/eggjs/egg/actions/runs/35850384973) | success |            22.20 |                                         2.82 |
+| [35858052982](https://github.com/eggjs/egg/actions/runs/35858052982) | success |            19.97 |                                         2.08 |
+| [35858054582](https://github.com/eggjs/egg/actions/runs/35858054582) | success |            32.23 |                                        15.72 |
+| [35861438070](https://github.com/eggjs/egg/actions/runs/35861438070) | success |            34.83 |                                        18.60 |
+| [35861608073](https://github.com/eggjs/egg/actions/runs/35861608073) | success |            46.07 |                                        27.68 |
+| [35861720590](https://github.com/eggjs/egg/actions/runs/35861720590) | failure |            47.08 |                                        30.15 |
+| [35862054578](https://github.com/eggjs/egg/actions/runs/35862054578) | failure |            51.15 |                                        35.40 |
+| [35875439635](https://github.com/eggjs/egg/actions/runs/35875439635) | failure |            32.25 |                                        12.97 |
+| [35879900054](https://github.com/eggjs/egg/actions/runs/35879900054) | failure |            20.82 |                                         1.72 |
+
+The sample median elapsed time is 32.24 minutes. Summed job execution time has a
+median of 146.89 runner-minutes per CI run. These are unweighted execution
+minutes, not billed minutes, and exclude E2E and CodeQL.
+
+## Latest run: execution bottlenecks
+
+These timings come from [run 35879900054](https://github.com/eggjs/egg/actions/runs/35879900054).
+
+| Job                                                    | Start delay | Job execution | Main test step |
+| ------------------------------------------------------ | ----------: | ------------: | -------------: |
+| Linux / Node 22                                        |        40 s |         828 s |          747 s |
+| Linux / Node 24, coverage                              |         4 s |         733 s |          671 s |
+| Linux / Node 26                                        |         4 s |         437 s |          372 s |
+| macOS / Node 22                                        |        93 s |        1154 s |         1033 s |
+| macOS / Node 24                                        |        86 s |        1031 s |          901 s |
+| macOS / Node 26                                        |       103 s |         850 s |          718 s |
+| Windows / Node 22                                      |        69 s |        1120 s |          922 s |
+| Windows / Node 24                                      |        86 s |        1024 s |          807 s |
+| Windows / Node 26                                      |        56 s |         946 s |          714 s |
+| Lint, typecheck, formatting, package build, site build |         4 s |         114 s |            n/a |
+
+Across all 13 inspected runs, 191 successful `Install dependencies` steps took
+1–16 seconds, with a median of 4 seconds. This excludes cache transfers and tool
+setup. In the latest run, Windows MySQL setup took 95–102 seconds. Cache restore
+and post-job steps also cost tens of seconds on some runners.
+
+Inference: installation and the static-check job are secondary optimization
+targets. Even removing them entirely would leave the main test jobs dominant.
+
+The macOS / Node 24 job in the successful 46-minute run waited 1661 seconds
+before starting and executed for 1096 seconds. The latest E2E run completed in
+4.97 minutes; an earlier E2E run took 20.58 minutes although its longest job
+executed for only 345 seconds. Runner demand must be measured alongside test speed.
+
+## Test and failure evidence
+
+The latest main suite reported 584 test files, including skipped files. Its
+macOS / Node 22 Vitest summary was 1026.34 seconds, with tracked phases of
+70% tests, 19% import, and 11% transform. Phase percentages aggregate tracked
+work; they are not percentages of wall-clock time saved by removing a phase.
+
+Examples of file durations in that run:
+
+- `plugins/mock/test/cluster.test.ts`: 56.7 seconds on macOS / Node 22.
+- `plugins/development/test/development-ts.test.ts`: 51.6 seconds on macOS / Node 22.
+- `plugins/schedule/test/subscription.test.ts`: 38.5 seconds on macOS / Node 22.
+- `packages/egg/test/lib/core/logger.test.ts`: 75.9 seconds on Windows / Node 22.
+- `packages/cluster/test/app_worker.test.ts`: 93.5 seconds on Linux / Node 22.
+
+`plugins/schedule/test/subscription.test.ts` contains fixed waits of 10 seconds
+in CI, 3 seconds, and 5 seconds. Its interval fixture has a real 4-second
+interval, so a replacement must still verify the intended scheduling behavior.
+
+The latest Linux / Node 26 egg-bin job failed in
+`test/commands/debug.test.ts`: inspector port `127.0.0.1:9229` was already in use.
+Both that file and `test/commands/dev.test.ts` start `dev --inspect`.
+Inference: concurrent use of the default inspector port is a candidate cause;
+identify the port owner and verify cleanup before calling it the complete diagnosis.
+
+The `done` job was skipped in that failed run. Its failure check currently uses
+`always()` only on a step, while the job itself depends on failed jobs. A revised
+conditional CI plan needs an explicit job-level final gate.
+
+The existing JSON parallelism report excludes suite-level hooks and import time.
+Use its concurrency estimates with the caveat in
+[CI parallel test metrics](../workflows/ci-parallel-test-metrics.md).
+
+## Refresh
+
+Collect job timestamps and logs again after a workflow, Vitest, runner image, or
+matrix change. Compare the same commit and test inventory when evaluating an
+optimization. Keep failed, retried, cancelled, warm-cache, and cold-cache samples
+separate in acceptance measurements.
diff --git a/wiki/workflows/ci-parallel-test-metrics.md b/wiki/workflows/ci-parallel-test-metrics.md
index f7b77ec400..a10a49aa31 100644
--- a/wiki/workflows/ci-parallel-test-metrics.md
+++ b/wiki/workflows/ci-parallel-test-metrics.md
@@ -1,25 +1,33 @@
 ---
 title: CI parallel test metrics
 type: workflow
-summary: How the CI test gate surfaces single-run parallelism efficiency metrics (avg/peak concurrency, efficiency, critical path) for the isolate:false suite, and how to read or reproduce them.
+summary: How CI reports test concurrency, resolved worker settings, retries, and shard inventories.
 source_files:
   - vitest.config.ts
   - .github/workflows/ci.yml
+  - scripts/ci-reporter.ts
+  - scripts/ci-test-benchmark/environment.js
   - scripts/ci-test-benchmark/index.js
   - scripts/ci-test-benchmark/vitest-summary.js
   - scripts/ci-test-benchmark/report.js
   - scripts/ci-test-benchmark/cli.js
   - benchmark/ci-test/README.md
-updated_at: 2026-09-23
+updated_at: 2026-09-24
 status: active
 ---
 
 ## Why
 
-The whole monorepo runs vitest with `pool: 'threads'` + `isolate: false` for full
-parallelism (the tegg `TeggScope` per-app isolation makes concurrent multi-app
-boots safe; see [[vitest-isolate-false-state-leaks]]). This workflow makes the
-_effect_ of that parallelism visible in CI without changing the gate.
+The root configuration declares `pool: 'threads'` and `isolate: false`, but a
+September 24 inspection of Vitest 5.0.1's resolved projects showed isolated
+`forks`. File-based projects do not inherit these root options. The historical
+shared-worker findings remain relevant when that mode is explicitly selected.
+
+CI now uploads `execution.json` alongside the existing reports. Its public
+Vitest module diagnostics include imports and suite hooks, retry counts, the
+full test inventory, shard identity, and resolved project settings. The
+benchmark helper uses its worker ceiling when available instead of estimating
+it from root configuration text.
 
 ## How it is wired (test gating job only)
 
@@ -37,8 +45,9 @@ _effect_ of that parallelism visible in CI without changing the gate.
    `GITHUB_STEP_SUMMARY` is set, **appends the report to the job summary** so the
    metrics show on the run page, per OS/Node matrix entry.
 
-Gating is unchanged: pass/fail comes solely from `ut run ci`. The metrics step is
-informational and exits `0` even when the JSON is missing.
+The metrics summary is informational and exits `0` when its JSON is missing.
+Test execution, artifact upload, coverage inventory checks, and coverage merging
+are required checks. Rerunning a test job replaces only its own artifact.
 
 ## The metrics (and how to read them honestly)
 
@@ -51,8 +60,9 @@ from each file's Vitest interval (`startTime`/`endTime`):
 - **Peak concurrency** = max overlapping intervals (sweep line; ends processed
   before starts at equal timestamps, so a hand-off is not counted as overlap). The
   robust headline signal.
-- **Parallel efficiency** = avg ÷ worker ceiling (the ceiling mirrors
-  `vitest.config.ts`: Windows CI caps workers, otherwise `os.availableParallelism()`).
+- **Parallel efficiency** = avg ÷ worker ceiling. CI uses the resolved project
+  settings from `execution.json`; local runs without this report retain the
+  older estimate from root configuration text.
 - **Critical path** = longest single-file span (wall-clock floor).
 
 **Honesty caveat (verified against Vitest 5 source):** the JSON reporter derives a
diff --git a/wiki/workflows/ci-performance-plan.md b/wiki/workflows/ci-performance-plan.md
new file mode 100644
index 0000000000..d4663484ee
--- /dev/null
+++ b/wiki/workflows/ci-performance-plan.md
@@ -0,0 +1,271 @@
+---
+title: GitHub Actions performance plan
+type: workflow
+summary: PR test sharding, full pre-merge compatibility, and measurements for reducing CI runtime and runner demand.
+source_files:
+  - .github/workflows/ci.yml
+  - .github/workflows/e2e-test.yml
+  - .github/workflows/cleanup-cache.yml
+  - package.json
+  - .gitignore
+  - vitest.config.ts
+  - packages/logger/vitest.config.ts
+  - tools/egg-bin/vitest.config.ts
+  - tools/egg-bin/test/commands/debug.test.ts
+  - tools/egg-bin/test/commands/dev.test.ts
+  - plugins/schedule/test/subscription.test.ts
+  - tegg/plugin/orm/test/fixtures/prepare.js
+  - scripts/ci-test-benchmark/environment.js
+  - scripts/ci-test-benchmark/vitest-summary.js
+  - scripts/ci-plan.js
+  - scripts/ci-coverage.js
+  - scripts/ci-reporter.ts
+  - codecov.yml
+  - https://github.com/eggjs/egg/actions/runs/35879900054
+  - https://github.com/eggjs/egg/actions/runs/35861608073
+  - https://github.com/eggjs/egg/actions/runs/35947286821
+  - https://github.com/eggjs/egg/actions/runs/35948525958
+  - https://github.com/codecov/codecov-action/releases/tag/v5.5.5
+  - https://github.com/eggjs/egg/pull/6056
+  - https://vitest.dev/guide/improving-performance
+  - https://docs.github.com/en/actions/reference/limits
+  - https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching
+  - https://docs.github.com/en/actions/how-tos/manage-workflow-runs/skip-workflow-runs
+updated_at: 2026-09-24
+status: active
+---
+
+## Recommendation and scope
+
+Implemented in [draft PR #6056](https://github.com/eggjs/egg/pull/6056). The workflow uses
+this PR/full matrix, merges verified coverage shards, uploads timing artifacts,
+and requires all planned checks in `done`. Documentation-only PRs keep static
+checks. The `ci:full` label selects the full profile on the next PR run; manual
+runs and merge groups always use the full profile.
+
+Schedule readiness checks now poll the asserted conditions. Inspector tests use
+an OS-assigned port, and CLI option matching distinguishes `--inspect-port` from
+`--inspect`.
+
+The first hosted run passed all platform tests and E2E. Its coverage guard
+correctly rejected a version mismatch: two Linux runners resolved `node-version: 24`
+to `24.21.0` and `24.20.0` from their local caches. The planner now resolves one
+exact Node.js 24 version and supplies it to both coverage shards and their merge
+job. The failed attempt is diagnostic evidence, not a successful speed benchmark;
+the PR checks provide the subsequent verification runs.
+
+The next attempt passed all tests, the complete 584-file inventory check, and
+native coverage merging. It finished in 14m 52s with 89.35 unweighted
+runner-minutes, but failed the required upload because the existing Codecov
+action used an obsolete signing-key endpoint. All three CI upload steps now pin
+`codecov/codecov-action@v5.5.5`, which contains the upstream endpoint correction.
+Signature verification and the required main-suite upload remain enabled.
+These failed-attempt timings are diagnostic; use a successful run before claiming
+an end-to-end improvement.
+
+A resolved-configuration inspection found that Vitest 5 file-based projects do
+not inherit root `pool`, `isolate`, or `fsModuleCache` settings. The new reporter
+records actual project settings and worker ceilings. A local explicit
+shared-worker trial failed a mock cluster test and stalled on synchronous RPC
+requests. The implementation preserves isolated workers; changing worker mode
+requires separate state-isolation work.
+
+Prioritize reliable test execution, fewer repeated platform combinations on PR
+updates, and two-way sharding of the remaining long jobs. Keep the full Node.js
+22/24/26 × Linux/macOS/Windows matrix on merge groups and `next` pushes.
+
+The [measured baseline](../sources/ci-performance-baseline.md) separates the two
+problems: execution takes roughly 20 minutes on the critical jobs, and independent
+job starts can be delayed by more than 30 minutes. The latest static-check job
+took 114 seconds; dependency installation had a 4-second sample median.
+
+Inference: a reasonable initial target for ordinary code PRs is 8–12 minutes of
+execution after runners become available. This is an engineering target, not a
+measured speedup. End-to-end latency also depends on available runner capacity.
+Full compatibility checks before merge remain a separate, longer stage until
+test improvements or measured capacity changes shorten it.
+
+## 1. Establish measurements and reliable gates
+
+Extend the current benchmark reporting instead of adding a second test run:
+
+- Upload the existing JSON and Markdown reports with OS, exact Node version,
+  job purpose, shard, and run attempt in their artifact names. Use short retention.
+- Record job start delay, setup, tests, coverage, cache transfers, and total
+  runner-minutes separately. Report PR feedback latency and merge-group latency
+  separately. Inspect organization concurrency and macOS availability before
+  choosing shard counts; the observed delay alone does not prove a quota limit.
+- Add file lifecycle/import/hook timing and retry counts. The current JSON
+  intervals omit `beforeAll`/`afterAll` and imports. Record the effective worker
+  count rather than relying on the benchmark helper's config-text estimate when
+  worker overrides are introduced.
+- Fix the inspector-port collision candidate in egg-bin. Prefer an OS-assigned
+  port if the CLI and child propagation support it; otherwise isolate the
+  conflicting tests. Verify child termination and the existing debug assertions.
+- Make `done` execute with job-level `if: always()`. Fail for a failed or
+  cancelled prerequisite, a failed planner, missing required coverage, or an
+  unexpectedly skipped required job. Only accept skips explicitly selected by
+  a successful plan. Preserve the required-check name and verify branch rules.
+
+GitHub documents concurrency limits by plan and runner type. Check the actual
+organization allocation before adding parallel jobs; `max-parallel` within one
+matrix does not reserve organization-wide capacity.
+See [Actions limits](https://docs.github.com/en/actions/reference/limits).
+
+## 2. Separate PR feedback from full compatibility
+
+Introduce a small planning job that emits the test matrix and expected jobs.
+Keep every eligible test file in each selected OS/Node combination. Do not use
+import-graph-based affected testing in the first rollout: Egg loads plugins,
+fixtures, and configuration dynamically.
+
+| Main-suite combination        | Ordinary code PR, shards | Full compatibility profile, initial shards |
+| ----------------------------- | -----------------------: | -----------------------------------------: |
+| Linux / Node 22               |                        2 |                                          1 |
+| Linux / Node 24 with coverage |                        2 |                                          1 |
+| Linux / Node 26               |                        1 |                                          1 |
+| macOS / Node 24               |                        2 |                                          1 |
+| Windows / Node 24             |                        2 |                                          1 |
+| macOS / Node 22 and 26        |    defer to full profile |                                     1 each |
+| Windows / Node 22 and 26      |    defer to full profile |                                     1 each |
+
+The ordinary PR profile executes five copies of the suite across nine jobs;
+the previous workflow executed nine copies across nine jobs. This cuts the repeated main-suite
+combinations by 44%, but does not imply a 44% reduction in all CI time. The PR
+profile uses two macOS jobs instead of three, which also reduces platform demand.
+
+Inference: the latest Windows / Node 24 job provides a rough execution model:
+`217 seconds setup/other work + 807 seconds tests / 2 = 620.5 seconds`, or about
+10.3 minutes with perfectly balanced shards starting together. Extra imports,
+shard imbalance, artifact handling, and runner waits can increase that result.
+
+Keep the existing egg-bin, egg-scripts, tegg adapter, example, static-check, and
+E2E coverage initially. The added planner and coverage aggregation also consume
+runner slots and must be included in the comparison.
+
+Use the full profile for `merge_group`, `push` to `next`, and an explicit full
+validation/manual mode. Keep the full profile unsharded initially to avoid
+doubling runner demand. Reconsider its long jobs after the PR rollout and test
+improvements have produced capacity measurements.
+
+The active default-branch ruleset requires the merge queue and the `done` check.
+
+Tradeoff: a defect specific to Node 22 or 26 on macOS/Windows may first appear in
+the merge queue. This is acceptable only if full checks are enforced before
+merge. If the repository also permits merges without that queue, retain the
+full PR profile. If every PR update must validate all nine combinations, apply
+the test improvements first and benchmark limited sharding under that policy;
+the 8–12 minute PR target does not apply automatically.
+
+For docs-only changes, run the relevant formatting and site checks and complete
+the final gate. Implement selection inside the workflow, including `reopened`
+PRs; a required workflow skipped by `paths-ignore` can leave a pending check.
+Unknown paths or failed change detection must select full validation or fail,
+never silently skip it. See [GitHub's skip behavior](https://docs.github.com/en/actions/how-tos/manage-workflow-runs/skip-workflow-runs).
+
+Keep cancellation scoped to superseded runs of the same PR or branch. Include
+the shard index in any job-level concurrency key, so sibling shards cannot
+cancel each other. Preserve separate merge-group runs and `fail-fast: false`
+during evaluation.
+
+## 3. Shard tests without losing coverage or preparation
+
+Start with native Vitest `--shard=1/2` and `--shard=2/2`, passed through the
+existing `ut run test -- ...` or `ut run ci -- ...` command. Retain lifecycle
+scripts, retries, timeouts, and existing console/JSON reporters. Add the blob
+reporter explicitly where reports must be merged.
+
+Vitest shards files rather than individual test cases. Measure each shard and
+its slowest files. If the longest shard exceeds the mean by more than 20%, use
+historical full-file timings to balance a deterministic partition by
+project-plus-path, with a stable fallback for new files. Do not immediately
+increase the shard count. See [Vitest sharding](https://vitest.dev/guide/improving-performance).
+
+Each shard gets its own runner, checkout, MySQL, and Redis. The root `pretest`
+executes workspace hooks, including the ORM database reset, so all initial
+main-suite shards still need those services. Removing service setup requires
+scoping preparation as well as test selection. Keep `packages/logger` file
+serialization and the egg-bin Windows worker cap until separate evidence
+supports changing them.
+
+For the Linux / Node 24 coverage pair, collect coverage in both shards. Preserve
+the Vitest blob and raw coverage inputs needed by the installed Vitest 5.0.1
+merge path, use unique artifact names, and validate their union against an
+unsharded run of the same commit. Merge once, then upload the resulting main-suite
+report to Codecov; retain the bin/scripts contributions and existing thresholds.
+Missing shard reports must fail the gate. A partial shard's coverage must never
+stand in for the complete main suite.
+
+Do not build the monorepo before these tests or restore generated `dist/` and
+fixture `.egg` directories. Preserve the dedicated CLI jobs' required builds.
+Compare discovered file sets per OS/Node: shard sets must be disjoint and their
+union must match the unsharded baseline, including recorded skips.
+
+## 4. Reduce the work inside tests
+
+Use the measured slow files to order changes: `plugins/schedule`,
+`plugins/development`, `plugins/mock` cluster tests, `packages/cluster`, and
+the Egg logger tests.
+
+Replace fixed readiness sleeps with bounded waits for the exact event, IPC
+message, log record, file condition, or HTTP readiness condition being asserted.
+Keep diagnostic output on timeout. Scheduling and timeout behavior still need
+real integration coverage: do not replace real 4-second intervals with zero-time
+assertions or assume fake timers control child processes.
+
+Share fixture startup only where test state and lifecycle semantics permit it.
+Audit process cleanup, temporary directories, ports, Redis keys, and database
+state before increasing concurrency. Continue using per-app `TeggScope` state.
+Move pure logic assertions to smaller unit tests only when existing end-to-end
+behavior remains covered.
+
+Retain current retries while fixing identified failures, but report every retry.
+Do not use larger timeouts, extra retries, additional skips, or removal of the
+logger serialization as a speed optimization. Benchmark worker counts per OS;
+more workers can increase child-process contention.
+
+## 5. Secondary experiments
+
+| Experiment                                  | Rationale and acceptance condition                                                                                                                                                                                                                                                                                 |
+| ------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| Persist Vitest's filesystem transform cache | Root `fsModuleCache: true` does not reach the file-based projects. First validate an explicit per-project setting, then trial a cache scoped by OS, architecture, exact Node/Vitest/tool versions and relevant inputs. Keep it only if cold/warm runs show a net benefit after transfers and correct invalidation. |
+| Tighten Node compile-cache restore keys     | A sampled Node 24 job restored a Node 26 cache via the OS-only fallback. Remove cross-version fallback and measure net benefit. Keep coverage correctness independent of compile-cache reuse.                                                                                                                      |
+| Reduce redundant cache writes               | Measure restore/install/save as a unit. Coordinate writers for a shared key while retaining useful PR-local caches. Dependencies install quickly already, so a new cache is not automatically beneficial.                                                                                                          |
+| Optimize Windows service setup              | MySQL setup cost about 95–102 seconds in the latest run. Consider pinned/preinstalled binaries only after checking runner-image stability. Do not assume Linux service containers work on Windows runners.                                                                                                         |
+| Build and pack E2E tarballs once            | Three E2E jobs each build and pack the workspace. A producer artifact could reduce aggregate work, but its new dependency and transfer time can increase feedback latency. Benchmark before adoption; keep fresh per-consumer installs and current snapshot checks.                                                |
+| Larger hosted runners                       | Compare test duration, start delay, flake rate, and actual cost on the slow jobs. Consider only if measured capacity or CPU limits justify them.                                                                                                                                                                   |
+
+The repository ignores lockfiles, so do not introduce a cache key that hashes
+only an absent tracked lockfile. Use the current catalogs/manifests and record
+resolved tool/dependency versions for experiments. A committed-lockfile policy
+is a separate reproducibility decision.
+
+GitHub caches are immutable and scoped to refs; cache writers and fallback keys
+need to account for that behavior. See [dependency caching](https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching).
+
+## Rollout and acceptance
+
+| Stage                                   | Main files or area                                             | Exit condition                                                                                     |
+| --------------------------------------- | -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- |
+| A: measurements and reliability         | CI workflow, benchmark scripts, inspector tests                | Durable timing artifacts; explicit final-gate behavior; collision regression coverage              |
+| B: PR profile and two-way shards        | CI workflow, planner/shard configuration, coverage aggregation | Same test inventory per retained combination; complete coverage; full matrix enforced before merge |
+| C: test runtime reductions              | Schedule, development, mock, cluster, logger tests             | Same assertions and lifecycle coverage, lower measured duration, no new state leaks                |
+| D: optional setup/cache/E2E experiments | Cache steps and E2E workflow                                   | Net reduction in end-to-end latency or runner cost, with no correctness loss                       |
+
+For each stage, benchmark the same commit and resolved dependencies with warm
+and cold caches; alternate baseline/candidate runs to reduce load bias. Start
+with at least five paired runs for direction, then observe at least 30 completed
+code-PR runs before evaluating p50/p95 and flake-rate trends. Classify expected
+platform skips separately from missing tests.
+
+Acceptance targets for ordinary PRs are p50 end-to-end feedback at or below
+12 minutes and p95 at or below 20 minutes when measured runner waits permit it,
+with execution targeted at 8–12 minutes and at least 25% fewer unweighted
+runner-minutes. These targets are provisional. Track full-profile latency and
+total PR-to-merge latency separately so faster PR checks cannot hide a slower
+merge queue.
+
+Reject or roll back a change if tests disappear, coverage inputs are incomplete,
+flake/retry rates rise, shard imbalance exceeds the agreed threshold, or runner
+waits erase the execution benefit. Keep a full-profile override and independently
+revertible changes for matrix selection, sharding, and caches.
diff --git a/wiki/workflows/local-ci.md b/wiki/workflows/local-ci.md
index dfb3fb5bdd..e1551d97de 100644
--- a/wiki/workflows/local-ci.md
+++ b/wiki/workflows/local-ci.md
@@ -18,21 +18,26 @@ source_files:
   - tegg/core/loader/src/impl/ModuleLoader.ts
   - tegg/core/metadata/src/model/graph/GlobalGraph.ts
   - tegg/plugin/controller/test/fixtures/apps
-updated_at: 2026-09-23
+updated_at: 2026-09-24
 status: active
 ---
 
 # Local CI
 
 The repository's GitHub CI test job installs dependencies with
-`ut install --from pnpm`. The main test matrix runs Node.js 22, 24, and 26 on
-Linux, macOS, and Windows. It uses `ut run test`, or `ut run ci` for the
+`ut install --from pnpm`. Ordinary PRs run Node.js 22, 24, and 26 on Linux, plus Node.js 24 on macOS
+and Windows. Four slower combinations use two shards; Linux Node.js 26 uses one.
+Merge groups, `next` pushes, manual runs, and PR runs with the `ci:full` label use
+the complete Node.js 22/24/26 × Linux/macOS/Windows matrix without sharding. It uses `ut run test`, or `ut run ci` for the
 coverage job, without building packages before tests.
 
 The egg-bin matrix runs Node.js 24 and 26 on Linux and Windows. The egg-scripts
 matrix runs Node.js 22, 24, and 26 on Linux. The tegg Vitest adapter runs both
 isolated and shared workers on Node.js 24 and 26 on Linux. Coverage reports
-come from the Linux Node.js 24 jobs.
+come from the Linux Node.js 24 jobs. The main-suite coverage job checks the
+complete, disjoint shard inventory before merging Vitest blob coverage reports.
+The final `done` check fails if required jobs fail, are cancelled, or are skipped
+unexpectedly.
 
 Ecosystem CI patches external applications with workspace tarballs. Both cnpmcore
 jobs use the upstream commit pinned in `ecosystem-ci/repo.json`, which declares