From 4e3208430ae719009339c639f4ea1a894980baf7 Mon Sep 17 00:00:00 2001
From: Roberto Aranda <roberto.aranda@automattic.com>
Date: Tue, 15 Sep 2026 17:14:52 +0200
Subject: [PATCH] Lazy scripts: replay a bundle's declared dependencies on live
 activation

A bundle the shell fetches lazily never went through WordPress's own
dependency resolution, and the payload resolver dropped any handle
without a src. A plugin whose config rides a src-less alias handle
declared as its bundle's dependency (AllTerrain Forms) therefore opened,
after a live activation, with the config undefined.

Every lazy payload builder now ships the handle's dependency closure;
native windows carry it as `deps` inside the handle-keyed script-data
map. The loader replays an alias's inline data in print order, once per
document, and recognises Core's printed tag ids so a dependency the page
already has is never run twice.
---
 docs/architecture.md                          |   2 +-
 docs/hooks-reference.md                       |   2 +-
 docs/javascript-reference.md                  |   2 +-
 docs/migration-wp-package-globals.md          |  40 ++++--
 includes/commands.php                         |   6 +
 includes/core/payload.php                     | 118 +++++++++++++-----
 includes/desktop-files/openers.php            |   3 +
 includes/desktop-files/registry.php           |   3 +
 includes/dock-rail-renderer.php               |   3 +
 includes/games/registry.php                   |   3 +
 includes/registries/wallpapers.php            |   3 +
 includes/settings-tabs.php                    |   6 +
 includes/title-bar-buttons.php                |   3 +
 includes/unfocus-effects.php                  |   3 +
 includes/window-actions.php                   |   3 +
 includes/window-chrome.php                    |  24 ++++
 includes/window-links.php                     |   3 +
 src/commands/server-sync.ts                   |   3 +
 src/dock-rail/server-sync.ts                  |   3 +
 src/effects/server-sync.ts                    |   3 +
 src/games/launch.ts                           |   6 +-
 src/games/server-sync.ts                      |   1 +
 src/games/types.ts                            |   4 +
 src/native-windows.ts                         |  39 ++++++
 src/script-presence.ts                        |  53 +++++++-
 src/settings/server-sync.ts                   |   3 +
 src/title-bar-buttons/server-sync.ts          |   3 +
 src/types.ts                                  | 113 ++++++++++++++---
 src/wallpapers/lazy.ts                        |   3 +
 src/wallpapers/vendor-loader.ts               |  53 +++++++-
 src/window-actions/server-sync.ts             |   3 +
 src/window-chrome/chrome/server-sync.ts       |   3 +
 src/window-chrome/controls/server-sync.ts     |   3 +
 src/window-chrome/slots/server-sync.ts        |   3 +
 src/window-chrome/themes/server-sync.ts       |   3 +
 src/window-links/server-sync.ts               |   3 +
 tests/phpunit/tests/commands.php              |  36 ++++++
 .../phpunit/tests/nativeWindowLazyScript.php  |  78 ++++++++++++
 .../tests/resolveScriptDependencies.php       |  63 ++++++++++
 tests/vitest/commands-server-sync.test.ts     |  20 +++
 .../vitest/native-windows-lazy-script.test.ts |  93 ++++++++++++++
 tests/vitest/script-presence.test.ts          |  55 ++++++++
 tests/vitest/vendor-loader.test.ts            | 104 +++++++++++++++
 43 files changed, 914 insertions(+), 67 deletions(-)

diff --git a/docs/architecture.md b/docs/architecture.md
index 071d5c8f8..996b0997a 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -241,7 +241,7 @@ Three related knobs:
 Shell surfaces that render on demand but are **not** native windows — the AI assistant, the bug-report window — get the same deferral through a different pipe: `openstation_build_deferred_styles()` resolves their handles into `openStationConfig.deferredStyles` (handle → `{ url, inline }`), and the surface's open path calls `ensureDeferredStyle( handle )` (`src/deferred-styles.ts`) to inject the sheet once, in parallel with whatever bundle the open is already fetching. Internal plumbing rather than public API — a plugin's own on-demand surface should be a native window and use `styles`.
 - **`wp.os.loadWindowScript( id )`** — load a window's bundle without opening the window, for the case where another bundle needs an API that one publishes. See [`javascript-reference.md`](./javascript-reference.md).
 
-The payload builders harvest each registered handle's `extra['data']` (localize), `extra['before']` / `extra['after']` (inline), and `wp_set_script_translations()` snippet into a **handle-keyed map** — `nativeWindowScriptData[handle] = { url, before, after, l10n, translations }` — while the `nativeWindows[]` entries carry only handle NAMES (`scriptHandle`, `companionScripts` as an ordered handle list, `tabs[].scriptHandle`). The shell joins the two on receipt (`hydrateServerEntries()` in `src/native-windows.ts`, tolerant of the old inline-entry format for cross-version bridge payloads) and injects the data as inline `<script>` tags around the `<script src>` in `wp_print_scripts` order — translations → l10n → before → src → after. So `wp_localize_script` / `wp_add_inline_script` / `wp_set_script_translations` work transparently on both paths. This is why the enqueue hook runs at priority **5**: `openstation_enqueue_assets()` builds the payload at 10, and data attached after that would ship a bundle with no config.
+The payload builders harvest each registered handle's `extra['data']` (localize), `extra['before']` / `extra['after']` (inline), and `wp_set_script_translations()` snippet into a **handle-keyed map** — `nativeWindowScriptData[handle] = { url, before, after, l10n, translations }` — while the `nativeWindows[]` entries carry only handle NAMES (`scriptHandle`, `companionScripts` as an ordered handle list, `tabs[].scriptHandle`). The shell joins the two on receipt (`hydrateServerEntries()` in `src/native-windows.ts`, tolerant of the old inline-entry format for cross-version bridge payloads) and injects the data as inline `<script>` tags around the `<script src>` in `wp_print_scripts` order — translations → l10n → before → src → after. Each loadable handle's map entry also names its dependency closure in `deps` — ordered handles, every one a key of the same map, so a package shared by several bundles is serialized once — and the loader brings those into the tab before the bundle (`ScriptExtras.deps` in `src/wallpapers/vendor-loader.ts`); a src-less alias handle lands with an empty `url` and its inline data replayed in print order. So `wp_localize_script` / `wp_add_inline_script` / `wp_set_script_translations` — and a declared dependency — work transparently on both paths. This is why the enqueue hook runs at priority **5**: `openstation_enqueue_assets()` builds the payload at 10, and data attached after that would ship a bundle with no config.
 
 Two further pieces the boot config deliberately does NOT carry, because the boot page delivers them another way: `nativeWindows[].templateHtml` is stripped (`''`) — every registered window's template is server-printed as a real `<template>` tag at `admin_footer` @ 20, before footer scripts, and `ensureTemplate()` adopts it by id; the payload copy exists for mid-session activations, so bridge and probe payloads keep theirs. And `serverDesktopThemes[]` entries ship without `cssText` / `tokens` (`cssDeferred: true`) — see [desktop-themes.md](./desktop-themes.md) for the on-demand fetch that fills them. The command-palette manifest plays the same trick on Core's `initializeCommandPalette` inline: the embedded ~20 KB menu-command list is stripped and the call synthesized against `window.__openStationMenuCommands`, the copy the boot page already ships for the shell harvester's classification lookup.
 
diff --git a/docs/hooks-reference.md b/docs/hooks-reference.md
index cb22771a2..ebc85a601 100644
--- a/docs/hooks-reference.md
+++ b/docs/hooks-reference.md
@@ -2728,7 +2728,7 @@ if ( is_wp_error( $result ) ) {
 
 > **`style`.** Optional `wp_register_style()` handle. The shell resolves it to a `styleUrl` (and any `wp_add_inline_style()` blobs) and lazy-injects a `<link rel="stylesheet">` when the window's plugin is activated mid-session. Without `style`, a peer plugin activated from inside an open shell renders its window with **no CSS** until the user reloads — the parent shell already finished `wp_print_styles` before the plugin existed. If the handle isn't registered, the field is silently dropped (no error, no link); plugins active at boot continue to print through the normal `wp_print_styles` pipeline as before.
 
-> **`script` loads on first open.** The shell reads your render callback off `window.openStationNativeWindows[ <id> ]` *after* fetching the bundle, so nothing is required of you: register the handle, publish the callback, and the window works. What changes is *when* — a bundle is no longer printed on every admin page for a window the user may never open. `wp_localize_script` / `wp_add_inline_script` / `wp_set_script_translations` data is harvested off the registered handle into the payload and replayed around the injected `<script>` tag, so it arrives either way.
+> **`script` loads on first open.** The shell reads your render callback off `window.openStationNativeWindows[ <id> ]` *after* fetching the bundle, so nothing is required of you: register the handle, publish the callback, and the window works. What changes is *when* — a bundle is no longer printed on every admin page for a window the user may never open. `wp_localize_script` / `wp_add_inline_script` / `wp_set_script_translations` data is harvested off the registered handle into the payload and replayed around the injected `<script>` tag, so it arrives either way. So are the handle's **declared dependencies**: the closure WordPress would have resolved had it printed the handle is shipped with the window and loaded, in order, before the bundle — `wp-*` packages and your own handles alike, skipping anything the document already ran. A src-less alias (`wp_register_script( 'acme-config', false )` carrying your config through `wp_add_inline_script()`, declared as the bundle's dependency) has its inline data replayed in print order with nothing fetched. Declare what you use and it works on a live activation exactly as it does after a reload; see [`docs/migration-wp-package-globals.md`](./migration-wp-package-globals.md).
 >
 > **`scripts`** *(optional, `string[]`)* — companion handles loaded in order immediately **before** `script`. For a bundle that extends the window from outside it — subscribing to actions the window's own bundle fires, contributing a section — and therefore has to be listening before that bundle is parsed. Declaring it here is what keeps it off the boot critical path: it travels with the window it extends. Handles that were never registered are dropped silently, the same way `style` is.
 >
diff --git a/docs/javascript-reference.md b/docs/javascript-reference.md
index 98bb2dd7a..723ec1e3e 100644
--- a/docs/javascript-reference.md
+++ b/docs/javascript-reference.md
@@ -5701,7 +5701,7 @@ The built-in Snow wallpaper (`src/plugins/snow-wallpaper/`) is the canonical in-
 | `registerWallpaper( def )` | Stable | Add a wallpaper to the registry + re-apply |
 | `registerWidget( def )` | Stable | Add a widget to the registry |
 | `registerSystemTile( item )` | Stable | Add a JS-owned launcher tile to the bottom dock rail, alongside plugin admin menus. Returns nothing; fires `os.dock.item-appended`. See "System tiles" below. |
-| `loadVendorScript( url, extras? )` | Stable | Memoized `<script>` injector. Low-level; most plugins use `needs` instead. Never re-executes something the document already ran — pass `extras.handle` whenever you know the WP script handle, since a Core package delivered inside a `load-scripts.php` concat blob has no `<script src>` of its own to match on. |
+| `loadVendorScript( url, extras? )` | Stable | Memoized `<script>` injector. Low-level; most plugins use `needs` instead. Never re-executes something the document already ran — pass `extras.handle` whenever you know the WP script handle, since a Core package delivered inside a `load-scripts.php` concat blob has no `<script src>` of its own to match on. `extras.deps` is an ordered dependency list loaded first; an entry with an empty `url` is a src-less alias whose inline data is replayed in print order, once per document. |
 | `getWallpaperSurfaces()` | Stable | Live `WallpaperSurface[]` for collision-aware wallpapers. See "Wallpaper surfaces" below. |
 | `registerModule( def )` | Stable | Register a shared vendor library under a stable id. |
 | `loadModules( ids )` | Stable | Imperatively load registered modules. Usually unnecessary — canvas wallpapers declare `needs[]` and the shell resolves. |
diff --git a/docs/migration-wp-package-globals.md b/docs/migration-wp-package-globals.md
index b7bb8df99..2f8688290 100644
--- a/docs/migration-wp-package-globals.md
+++ b/docs/migration-wp-package-globals.md
@@ -86,7 +86,9 @@ subscribed before that point goes deaf; re-running `wp-data` wipes
 every registered store.
 
 "Already in the document" is answered by handle as well as by URL,
-because on a stock wp-admin the URL alone cannot answer it. Core
+because on a stock wp-admin the URL alone cannot answer it. A tag Core
+printed under the handle's own id (`<handle>-js`, or
+`<handle>-js-before` and its siblings for inline data) counts. Core
 concatenates every script below `wp-includes/js/` and `wp-admin/js/`
 into a single `load-scripts.php` response — the wp-admin default, off
 under `SCRIPT_DEBUG` or `CONCATENATE_SCRIPTS = false` — so those
@@ -96,12 +98,36 @@ the shell reads them back (`src/script-presence.ts`). Nothing is
 asked of you: the handles ride along in the payload OpenStation
 builds from your registration.
 
-**No other lazy path does this yet.** Native-window scripts, command
-scripts, settings-tab scripts, wallpapers, games and desktop-file
-openers all travel the same loader, but their payload builders do not
-resolve a closure. If one of those needs a `@wordpress/*` package,
-either enqueue the handle normally so WordPress resolves it, or load
-the package yourself before use — do not rely on load order.
+**Native-window bundles close it the same way.** The handle a window
+registers as its `script` — and each companion in `scripts`, and each
+tab script — ships its closure in the window payload, and the loader
+replays it before the bundle on first open. A window activated
+mid-session therefore boots with the same packages it would have had
+from a cold reload.
+
+**A src-less alias handle is replayed too.** `wp_register_script( $h,
+false )` plus `wp_add_inline_script()` is WordPress's supported way to
+ship inline-only JavaScript, and a common home for a plugin's config
+blob — declared as a dependency of every bundle so the config always
+runs first, whatever the enqueue order. The alias has nothing to fetch,
+so its inline data is replayed in print order (localized data, then
+`before`, then `after`) with no `<script src>` in between, once per
+document, and not at all when Core already printed it — the
+`<script id="<handle>-js-before">` Core leaves behind is the evidence.
+That is the case that surfaced this: a window whose builder read its
+config off exactly such an alias opened, after a live activation, with
+the config undefined.
+
+**Every other lazy path ships its closure the same way** — command
+scripts, settings-tab scripts, dock-rail renderers, title-bar buttons,
+window actions, unfocus effects, window-link renderers, window themes,
+controls, slots and chromes, wallpapers, games and desktop-file
+openers. That uniformity is load-bearing rather than tidy: the loader
+memoizes by URL, so whichever path fetches a bundle *first* decides
+what ran before it. A plugin that registers one bundle as both a
+window's `script` and a command script had the command sync win that
+race on a live activation, and the bundle ran without the config alias
+it declared. Declare what you use, on every handle, and it works.
 
 The loader side of the mechanism is generic, so extending the
 remaining builders is a payload change rather than a new mechanism.
diff --git a/includes/commands.php b/includes/commands.php
index 1e19e1221..4d7ecfcac 100644
--- a/includes/commands.php
+++ b/includes/commands.php
@@ -260,6 +260,9 @@ function openstation_build_desktop_command_scripts_payload() {
 			'scriptAfter'        => $payload['after'],
 			'scriptL10n'         => $payload['l10n'],
 			'scriptTranslations' => $payload['translations'],
+			// The handle's dependency closure, replayed before the bundle
+			// on its lazy load — see `openstation_resolve_script_dependencies()`.
+			'scriptDeps'         => openstation_resolve_script_dependencies( $handle ),
 		);
 		$seen[ $handle ] = true;
 	}
@@ -305,6 +308,9 @@ function openstation_build_desktop_commands_payload() {
 			'scriptAfter'        => $payload['after'],
 			'scriptL10n'         => $payload['l10n'],
 			'scriptTranslations' => $payload['translations'],
+			// The handle's dependency closure, replayed before the bundle
+			// on its lazy load — see `openstation_resolve_script_dependencies()`.
+			'scriptDeps'         => openstation_resolve_script_dependencies( $handle ),
 		);
 	}
 	return $out;
diff --git a/includes/core/payload.php b/includes/core/payload.php
index d53eb407d..e24e7cc3e 100644
--- a/includes/core/payload.php
+++ b/includes/core/payload.php
@@ -1874,6 +1874,10 @@ function openstation_resolve_script_dependencies( $handle ) {
 			continue;
 		}
 		$payload = openstation_resolve_script_payload( $dep_handle );
+		// An alias (no `src`) stays in the list when it carries inline
+		// data — that data is the whole reason it was declared, and a
+		// plugin's config blob commonly rides one. Nothing to fetch
+		// AND nothing to run is the only thing dropped.
 		if ( '' === $payload['url']
 			&& empty( $payload['before'] )
 			&& empty( $payload['after'] )
@@ -1921,8 +1925,12 @@ function openstation_resolve_script_dependencies( $handle ) {
  * `WP_Scripts::do_item()` would have used.
  *
  * Returns an empty payload (`array( 'url' => '' )`) when the handle
- * is unregistered or has no source — callers treat that as "no
- * script to load."
+ * is unregistered. A registered handle with no source — an alias
+ * carrying only inline data — also comes back with an empty `url`,
+ * but its `before` / `after` / `l10n` are kept: callers that load a
+ * bundle treat an empty `url` as "nothing to fetch", and the
+ * dependency walk ({@see openstation_resolve_script_dependencies()})
+ * still replays what the alias would have printed.
  *
  * Shared between `openstation_register_window()` and
  * `openstation_register_widget()` (and every other registration that
@@ -1952,17 +1960,28 @@ function openstation_resolve_script_payload( $handle ) {
 	}
 	$registered = $wp_scripts->registered[ $handle ];
 	$src        = is_string( $registered->src ) ? $registered->src : '';
-	if ( '' === $src ) {
-		return $empty;
-	}
 
-	// Normalize relative paths + attach cache-bust ver.
-	$resolved = $src;
-	if ( 0 === strpos( $resolved, '/' ) && 0 !== strpos( $resolved, '//' ) ) {
-		$resolved = site_url( $resolved );
-	}
-	if ( ! empty( $registered->ver ) ) {
-		$resolved = add_query_arg( 'ver', $registered->ver, $resolved );
+	// A handle with no `src` is an ALIAS — WordPress's supported way
+	// to ship inline-only JavaScript (`wp_register_script( $h, false )`
+	// plus `wp_add_inline_script()`), and a common home for a plugin's
+	// config blob: registering it as a *dependency* of every bundle is
+	// what guarantees the config runs first, whatever the enqueue
+	// order. `WP_Scripts::do_item()` prints an alias's localized data
+	// and its before/after snippets and returns before the `<script
+	// src>` it does not have. The payload mirrors that: `url` stays
+	// empty (there is nothing to fetch) and the inline data is kept,
+	// so a dependency walk can replay it. Translations are not: Core
+	// only prints those for a handle it printed a tag for.
+	$resolved = '';
+	if ( '' !== $src ) {
+		// Normalize relative paths + attach cache-bust ver.
+		$resolved = $src;
+		if ( 0 === strpos( $resolved, '/' ) && 0 !== strpos( $resolved, '//' ) ) {
+			$resolved = site_url( $resolved );
+		}
+		if ( ! empty( $registered->ver ) ) {
+			$resolved = add_query_arg( 'ver', $registered->ver, $resolved );
+		}
 	}
 
 	// Harvest `extra` data the lazy-load path would otherwise drop.
@@ -2000,7 +2019,7 @@ function openstation_resolve_script_payload( $handle ) {
 	// pipeline emits before the script body. `print_translations(
 	// $handle, false )` returns the snippet without echoing.
 	$translations = '';
-	if ( method_exists( $wp_scripts, 'print_translations' ) ) {
+	if ( '' !== $resolved && method_exists( $wp_scripts, 'print_translations' ) ) {
 		$captured = $wp_scripts->print_translations( $handle, false );
 		if ( is_string( $captured ) ) {
 			$translations = $captured;
@@ -2176,22 +2195,14 @@ function openstation_build_command_palette_assets_payload() {
 	$script_probe->all_deps( $script_roots );
 	foreach ( $script_probe->to_do as $handle ) {
 		$payload = openstation_resolve_script_payload( $handle );
-		if ( '' === $payload['url'] ) {
-			// Src-less aggregator — keep it only for its inline data.
-			$registered = isset( $scripts->registered[ $handle ] ) ? $scripts->registered[ $handle ] : null;
-			if ( $registered ) {
-				foreach ( array( 'before', 'after' ) as $position ) {
-					if ( isset( $registered->extra[ $position ] ) && is_array( $registered->extra[ $position ] ) ) {
-						$payload[ $position ] = array_values( array_filter( array_map( 'strval', $registered->extra[ $position ] ) ) );
-					}
-				}
-				if ( ! empty( $registered->extra['data'] ) && is_string( $registered->extra['data'] ) ) {
-					$payload['l10n'][] = $registered->extra['data'];
-				}
-			}
-			if ( empty( $payload['before'] ) && empty( $payload['after'] ) && empty( $payload['l10n'] ) ) {
-				continue;
-			}
+		// A src-less aggregator is kept only for its inline data — the
+		// resolver harvests that for an alias — and dropped when it
+		// carries none.
+		if ( '' === $payload['url']
+			&& empty( $payload['before'] )
+			&& empty( $payload['after'] )
+			&& empty( $payload['l10n'] ) ) {
+			continue;
 		}
 		// Core's `initializeCommandPalette( {…} )` inline embeds the
 		// serialized admin-menu command list — ~20 KB that the boot
@@ -2367,6 +2378,10 @@ function openstation_flush_script_handle_registries() {
  * translations, see `openstation_resolve_script_payload()` — lives
  * ONCE per handle in `scriptData`, and the shell joins the two on
  * receipt (`hydrateServerEntries()` in `src/native-windows.ts`).
+ * Each loadable handle's entry also names its dependency closure in
+ * `deps` (ordered handles, every one of them a key of the same map)
+ * so the lazy loader can bring a bundle's declared packages — and
+ * a src-less alias carrying its config — into the tab before it.
  *
  * The split exists because script data is a property of the HANDLE,
  * not of the window: every App Framework window rides
@@ -2385,7 +2400,7 @@ function openstation_flush_script_handle_registries() {
  * duplication problem worth a second map ( companion styles across
  * the whole registry total ~2 KB ).
  *
- * @return array{windows:array[],scriptData:array<string,array{url:string,before:string[],after:string[],l10n:string[],translations:string}>}
+ * @return array{windows:array[],scriptData:array<string,array{url:string,before:string[],after:string[],l10n:string[],translations:string,deps:string[]}>}
  */
 function openstation_collect_native_windows_payload() {
 	$empty = array(
@@ -2419,22 +2434,57 @@ function openstation_collect_native_windows_payload() {
 
 	$script_data = array();
 
+	// Handles resolved as a bundle to LOAD (a window's script, a
+	// companion, a tab) and what that visit answered — the handle, or
+	// '' for nothing to load — as opposed to reached only as
+	// somebody's dependency. A handle can be both — resolved as a
+	// dependency first, then named as a window's own script — and
+	// only the bundle visit computes its own closure.
+	$resolved_as_bundle = array();
+
 	// Resolve a handle into the map, once. Returns the handle when it
 	// resolved to something loadable, '' when it did not (never
 	// registered, no src) — the same silent drop the inline shape
 	// applied to companions and tab scripts.
-	$collect_handle = static function ( $handle ) use ( &$script_data ) {
+	//
+	// The handle's dependency closure rides along as `deps`: an
+	// ordered handle list, each of which lands in the same map. A
+	// bundle delivered lazily never goes through WordPress's own
+	// dependency resolution — the loader injects one URL — so a
+	// window declaring `wp-api-fetch` found `wp.apiFetch` undefined,
+	// and one whose config rides a src-less alias handle (a common
+	// shape: `wp_register_script( $h, false )` plus
+	// `wp_add_inline_script()`, declared as the bundle's dependency
+	// so it always runs first) booted with no config at all. Anything
+	// the document already ran is skipped on the client, so a page
+	// that carried the packages anyway pays nothing.
+	$collect_handle = static function ( $handle ) use ( &$script_data, &$resolved_as_bundle ) {
 		$handle = (string) $handle;
 		if ( '' === $handle ) {
 			return '';
 		}
-		if ( isset( $script_data[ $handle ] ) ) {
-			return $handle;
+		if ( isset( $resolved_as_bundle[ $handle ] ) ) {
+			return $resolved_as_bundle[ $handle ];
 		}
-		$payload = openstation_resolve_script_payload( $handle );
+		$payload = isset( $script_data[ $handle ] )
+			? $script_data[ $handle ]
+			: openstation_resolve_script_payload( $handle );
 		if ( '' === $payload['url'] ) {
+			$resolved_as_bundle[ $handle ] = '';
 			return '';
 		}
+		$resolved_as_bundle[ $handle ] = $handle;
+		$deps                          = array();
+		foreach ( openstation_resolve_script_dependencies( $handle ) as $dep ) {
+			$dep_handle = (string) $dep['handle'];
+			unset( $dep['handle'] );
+			if ( ! isset( $script_data[ $dep_handle ] ) ) {
+				$dep['deps']                = array();
+				$script_data[ $dep_handle ] = $dep;
+			}
+			$deps[] = $dep_handle;
+		}
+		$payload['deps']        = $deps;
 		$script_data[ $handle ] = $payload;
 		return $handle;
 	};
diff --git a/includes/desktop-files/openers.php b/includes/desktop-files/openers.php
index a6995be1d..fe9ef46b8 100644
--- a/includes/desktop-files/openers.php
+++ b/includes/desktop-files/openers.php
@@ -314,6 +314,9 @@ function openstation_build_file_openers_payload() {
 			'scriptAfter'        => $payload['after'],
 			'scriptL10n'         => $payload['l10n'],
 			'scriptTranslations' => $payload['translations'],
+			// The handle's dependency closure, replayed before the bundle
+			// on its lazy load — see `openstation_resolve_script_dependencies()`.
+			'scriptDeps'         => openstation_resolve_script_dependencies( $handle ),
 		);
 	}
 	return $out;
diff --git a/includes/desktop-files/registry.php b/includes/desktop-files/registry.php
index eb548c07e..6b3cca704 100644
--- a/includes/desktop-files/registry.php
+++ b/includes/desktop-files/registry.php
@@ -246,6 +246,9 @@ function openstation_build_file_types_payload() {
 			'scriptAfter'        => $payload['after'],
 			'scriptL10n'         => $payload['l10n'],
 			'scriptTranslations' => $payload['translations'],
+			// The handle's dependency closure, replayed before the bundle
+			// on its lazy load — see `openstation_resolve_script_dependencies()`.
+			'scriptDeps'         => openstation_resolve_script_dependencies( $handle ),
 		);
 	}
 	return $out;
diff --git a/includes/dock-rail-renderer.php b/includes/dock-rail-renderer.php
index 69b760d96..8940d3ea1 100644
--- a/includes/dock-rail-renderer.php
+++ b/includes/dock-rail-renderer.php
@@ -138,6 +138,9 @@ function openstation_build_dock_rail_renderer_scripts_payload() {
 			'scriptAfter'        => $payload['after'],
 			'scriptL10n'         => $payload['l10n'],
 			'scriptTranslations' => $payload['translations'],
+			// The handle's dependency closure, replayed before the bundle
+			// on its lazy load — see `openstation_resolve_script_dependencies()`.
+			'scriptDeps'         => openstation_resolve_script_dependencies( $handle ),
 		);
 		$seen[ $handle ] = true;
 	}
diff --git a/includes/games/registry.php b/includes/games/registry.php
index f7939a7f7..d2d62a042 100644
--- a/includes/games/registry.php
+++ b/includes/games/registry.php
@@ -426,6 +426,9 @@ static function ( $column ) {
 			'scriptAfter'        => $payload['after'],
 			'scriptL10n'         => $payload['l10n'],
 			'scriptTranslations' => $payload['translations'],
+			// The handle's dependency closure, replayed before the bundle
+			// on its lazy load — see `openstation_resolve_script_dependencies()`.
+			'scriptDeps'         => openstation_resolve_script_dependencies( $handle ),
 		);
 	}
 	return $out;
diff --git a/includes/registries/wallpapers.php b/includes/registries/wallpapers.php
index 75b1b3719..9327acd2a 100644
--- a/includes/registries/wallpapers.php
+++ b/includes/registries/wallpapers.php
@@ -251,6 +251,9 @@ function openstation_build_desktop_wallpapers_payload() {
 			'scriptAfter'        => $payload['after'],
 			'scriptL10n'         => $payload['l10n'],
 			'scriptTranslations' => $payload['translations'],
+			// The handle's dependency closure, replayed before the bundle
+			// on its lazy load — see `openstation_resolve_script_dependencies()`.
+			'scriptDeps'         => openstation_resolve_script_dependencies( $handle ),
 		);
 	}
 	return $out;
diff --git a/includes/settings-tabs.php b/includes/settings-tabs.php
index 725c8b408..82e4f008f 100644
--- a/includes/settings-tabs.php
+++ b/includes/settings-tabs.php
@@ -251,6 +251,9 @@ function openstation_build_desktop_settings_tab_scripts_payload() {
 			'scriptAfter'        => $payload['after'],
 			'scriptL10n'         => $payload['l10n'],
 			'scriptTranslations' => $payload['translations'],
+			// The handle's dependency closure, replayed before the bundle
+			// on its lazy load — see `openstation_resolve_script_dependencies()`.
+			'scriptDeps'         => openstation_resolve_script_dependencies( $handle ),
 		);
 		$seen[ $handle ] = true;
 	}
@@ -295,6 +298,9 @@ function openstation_build_desktop_settings_tabs_payload() {
 			'scriptAfter'        => $payload['after'],
 			'scriptL10n'         => $payload['l10n'],
 			'scriptTranslations' => $payload['translations'],
+			// The handle's dependency closure, replayed before the bundle
+			// on its lazy load — see `openstation_resolve_script_dependencies()`.
+			'scriptDeps'         => openstation_resolve_script_dependencies( $handle ),
 		);
 	}
 	return $out;
diff --git a/includes/title-bar-buttons.php b/includes/title-bar-buttons.php
index a4e927779..9e633fc8c 100644
--- a/includes/title-bar-buttons.php
+++ b/includes/title-bar-buttons.php
@@ -141,6 +141,9 @@ function openstation_build_desktop_titlebar_button_scripts_payload() {
 			'scriptAfter'        => $payload['after'],
 			'scriptL10n'         => $payload['l10n'],
 			'scriptTranslations' => $payload['translations'],
+			// The handle's dependency closure, replayed before the bundle
+			// on its lazy load — see `openstation_resolve_script_dependencies()`.
+			'scriptDeps'         => openstation_resolve_script_dependencies( $handle ),
 		);
 		$seen[ $handle ] = true;
 	}
diff --git a/includes/unfocus-effects.php b/includes/unfocus-effects.php
index 7c1e70a83..9019e33f1 100644
--- a/includes/unfocus-effects.php
+++ b/includes/unfocus-effects.php
@@ -139,6 +139,9 @@ function openstation_build_desktop_unfocus_effect_scripts_payload() {
 			'scriptAfter'        => $payload['after'],
 			'scriptL10n'         => $payload['l10n'],
 			'scriptTranslations' => $payload['translations'],
+			// The handle's dependency closure, replayed before the bundle
+			// on its lazy load — see `openstation_resolve_script_dependencies()`.
+			'scriptDeps'         => openstation_resolve_script_dependencies( $handle ),
 		);
 		$seen[ $handle ] = true;
 	}
diff --git a/includes/window-actions.php b/includes/window-actions.php
index a5fc31501..9f952821e 100644
--- a/includes/window-actions.php
+++ b/includes/window-actions.php
@@ -148,6 +148,9 @@ function openstation_build_desktop_window_action_scripts_payload() {
 			'scriptAfter'        => $payload['after'],
 			'scriptL10n'         => $payload['l10n'],
 			'scriptTranslations' => $payload['translations'],
+			// The handle's dependency closure, replayed before the bundle
+			// on its lazy load — see `openstation_resolve_script_dependencies()`.
+			'scriptDeps'         => openstation_resolve_script_dependencies( $handle ),
 		);
 		$seen[ $handle ] = true;
 	}
diff --git a/includes/window-chrome.php b/includes/window-chrome.php
index e745b4fc0..d48d20717 100644
--- a/includes/window-chrome.php
+++ b/includes/window-chrome.php
@@ -243,6 +243,9 @@ function openstation_build_window_theme_scripts_payload() {
 			'scriptAfter'        => $payload['after'],
 			'scriptL10n'         => $payload['l10n'],
 			'scriptTranslations' => $payload['translations'],
+			// The handle's dependency closure, replayed before the bundle
+			// on its lazy load — see `openstation_resolve_script_dependencies()`.
+			'scriptDeps'         => openstation_resolve_script_dependencies( $handle ),
 		);
 		$seen[ $handle ] = true;
 	}
@@ -284,6 +287,9 @@ function openstation_build_window_themes_payload() {
 			'scriptAfter'        => $payload['after'],
 			'scriptL10n'         => $payload['l10n'],
 			'scriptTranslations' => $payload['translations'],
+			// The handle's dependency closure, replayed before the bundle
+			// on its lazy load — see `openstation_resolve_script_dependencies()`.
+			'scriptDeps'         => openstation_resolve_script_dependencies( $handle ),
 		);
 	}
 	return $out;
@@ -473,6 +479,9 @@ function openstation_build_window_control_scripts_payload() {
 			'scriptAfter'        => $payload['after'],
 			'scriptL10n'         => $payload['l10n'],
 			'scriptTranslations' => $payload['translations'],
+			// The handle's dependency closure, replayed before the bundle
+			// on its lazy load — see `openstation_resolve_script_dependencies()`.
+			'scriptDeps'         => openstation_resolve_script_dependencies( $handle ),
 		);
 		$seen[ $handle ] = true;
 	}
@@ -512,6 +521,9 @@ function openstation_build_window_controls_payload() {
 			'scriptAfter'        => $payload['after'],
 			'scriptL10n'         => $payload['l10n'],
 			'scriptTranslations' => $payload['translations'],
+			// The handle's dependency closure, replayed before the bundle
+			// on its lazy load — see `openstation_resolve_script_dependencies()`.
+			'scriptDeps'         => openstation_resolve_script_dependencies( $handle ),
 		);
 	}
 	return $out;
@@ -703,6 +715,9 @@ function openstation_build_window_slot_scripts_payload() {
 			'scriptAfter'        => $payload['after'],
 			'scriptL10n'         => $payload['l10n'],
 			'scriptTranslations' => $payload['translations'],
+			// The handle's dependency closure, replayed before the bundle
+			// on its lazy load — see `openstation_resolve_script_dependencies()`.
+			'scriptDeps'         => openstation_resolve_script_dependencies( $handle ),
 		);
 		$seen[ $handle ] = true;
 	}
@@ -740,6 +755,9 @@ function openstation_build_window_slots_payload() {
 			'scriptAfter'        => $payload['after'],
 			'scriptL10n'         => $payload['l10n'],
 			'scriptTranslations' => $payload['translations'],
+			// The handle's dependency closure, replayed before the bundle
+			// on its lazy load — see `openstation_resolve_script_dependencies()`.
+			'scriptDeps'         => openstation_resolve_script_dependencies( $handle ),
 		);
 	}
 	return $out;
@@ -904,6 +922,9 @@ function openstation_build_window_chrome_scripts_payload() {
 			'scriptAfter'        => $payload['after'],
 			'scriptL10n'         => $payload['l10n'],
 			'scriptTranslations' => $payload['translations'],
+			// The handle's dependency closure, replayed before the bundle
+			// on its lazy load — see `openstation_resolve_script_dependencies()`.
+			'scriptDeps'         => openstation_resolve_script_dependencies( $handle ),
 		);
 		$seen[ $handle ] = true;
 	}
@@ -940,6 +961,9 @@ function openstation_build_window_chromes_payload() {
 			'scriptAfter'        => $payload['after'],
 			'scriptL10n'         => $payload['l10n'],
 			'scriptTranslations' => $payload['translations'],
+			// The handle's dependency closure, replayed before the bundle
+			// on its lazy load — see `openstation_resolve_script_dependencies()`.
+			'scriptDeps'         => openstation_resolve_script_dependencies( $handle ),
 		);
 	}
 	return $out;
diff --git a/includes/window-links.php b/includes/window-links.php
index 46b963cbc..0d809d070 100644
--- a/includes/window-links.php
+++ b/includes/window-links.php
@@ -1087,6 +1087,9 @@ function openstation_build_window_link_renderer_scripts_payload() {
 			'scriptAfter'        => $payload['after'],
 			'scriptL10n'         => $payload['l10n'],
 			'scriptTranslations' => $payload['translations'],
+			// The handle's dependency closure, replayed before the bundle
+			// on its lazy load — see `openstation_resolve_script_dependencies()`.
+			'scriptDeps'         => openstation_resolve_script_dependencies( $handle ),
 		);
 		$seen[ $handle ] = true;
 	}
diff --git a/src/commands/server-sync.ts b/src/commands/server-sync.ts
index 9b8043f94..7bdd6b3ea 100644
--- a/src/commands/server-sync.ts
+++ b/src/commands/server-sync.ts
@@ -62,6 +62,9 @@ export function createCommandRegistrySync(): (
 		try {
 			await loadVendorScript( entry.scriptUrl, {
 				translations: entry.scriptTranslations,
+				// The packages the bundle declares, brought in first; the
+				// document skips what it already ran.
+				deps: entry.scriptDeps,
 				l10n: entry.scriptL10n,
 				before: entry.scriptBefore,
 				after: entry.scriptAfter,
diff --git a/src/dock-rail/server-sync.ts b/src/dock-rail/server-sync.ts
index 05fdd597e..4d5f1e81c 100644
--- a/src/dock-rail/server-sync.ts
+++ b/src/dock-rail/server-sync.ts
@@ -48,6 +48,9 @@ export function createDockRailRendererSync(): (
 		try {
 			await loadVendorScript( entry.scriptUrl, {
 				translations: entry.scriptTranslations,
+				// The packages the bundle declares, brought in first; the
+				// document skips what it already ran.
+				deps: entry.scriptDeps,
 				l10n: entry.scriptL10n,
 				before: entry.scriptBefore,
 				after: entry.scriptAfter,
diff --git a/src/effects/server-sync.ts b/src/effects/server-sync.ts
index ec49d6673..cf7af462d 100644
--- a/src/effects/server-sync.ts
+++ b/src/effects/server-sync.ts
@@ -34,6 +34,9 @@ export function createUnfocusEffectRegistrySync(): (
 		try {
 			await loadVendorScript( entry.scriptUrl, {
 				translations: entry.scriptTranslations,
+				// The packages the bundle declares, brought in first; the
+				// document skips what it already ran.
+				deps: entry.scriptDeps,
 				l10n: entry.scriptL10n,
 				before: entry.scriptBefore,
 				after: entry.scriptAfter,
diff --git a/src/games/launch.ts b/src/games/launch.ts
index 8a1c6ae41..f4b53ff50 100644
--- a/src/games/launch.ts
+++ b/src/games/launch.ts
@@ -30,7 +30,7 @@
 
 import * as registry from './registry';
 import { ensureDeferredStyle } from '../deferred-styles';
-import type { DesktopConfig } from '../types';
+import type { DesktopConfig, LazyScriptDependency } from '../types';
 import { startPlaytimeTracker } from './playtime';
 import type { PlaytimeTracker } from './playtime';
 import { ingestChallenges } from './challenges-store';
@@ -85,6 +85,7 @@ interface DesktopGlobal {
 			l10n?: string[];
 			before?: string[];
 			after?: string[];
+			deps?: LazyScriptDependency[];
 		},
 	) => Promise< void >;
 	windowManager?: {
@@ -163,6 +164,9 @@ export async function ensureGameRender(
 	}
 	await loadVendorScript( entry.scriptUrl, {
 		translations: entry.scriptTranslations,
+		// The packages the bundle declares, brought in first; the
+		// document skips what it already ran.
+		deps: entry.scriptDeps,
 		l10n: entry.scriptL10n,
 		before: entry.scriptBefore,
 		after: entry.scriptAfter,
diff --git a/src/games/server-sync.ts b/src/games/server-sync.ts
index 4bf56deb2..ed292e09c 100644
--- a/src/games/server-sync.ts
+++ b/src/games/server-sync.ts
@@ -49,6 +49,7 @@ export function stubFromServerEntry(
 		scriptL10n: entry.scriptL10n,
 		scriptBefore: entry.scriptBefore,
 		scriptAfter: entry.scriptAfter,
+		scriptDeps: entry.scriptDeps,
 	};
 }
 
diff --git a/src/games/types.ts b/src/games/types.ts
index 68fcad281..6555d0c1f 100644
--- a/src/games/types.ts
+++ b/src/games/types.ts
@@ -17,6 +17,8 @@
  *
  * @public
  */
+import type { LazyScriptDependency } from '../types';
+
 export interface GameScoreColumn {
 	/** Slug key into the score row's `meta` map (or `score`). */
 	key: string;
@@ -139,6 +141,8 @@ export interface GameRegistryEntry {
 	scriptL10n?: string[];
 	scriptBefore?: string[];
 	scriptAfter?: string[];
+	/** The bundle's declared packages, replayed before it on first launch. */
+	scriptDeps?: LazyScriptDependency[];
 }
 
 /**
diff --git a/src/native-windows.ts b/src/native-windows.ts
index f94c9c58c..b8c940feb 100644
--- a/src/native-windows.ts
+++ b/src/native-windows.ts
@@ -38,6 +38,7 @@ import {
 import type { SystemDockItem } from './dock';
 import type {
 	NativeRenderContext,
+	LazyScriptDependency,
 	NativeWindowCompanionScript,
 	NativeWindowDef,
 	NativeWindowIframeContent,
@@ -1074,6 +1075,33 @@ export function hydrateServerEntries(
 	scriptData?: NativeWindowScriptData,
 ): NativeWindowServerEntry[] {
 	const data = scriptData ?? {};
+	// A handle's dependency closure is an ordered handle list whose
+	// members live in the same map; resolve it into the shape the
+	// loader replays. A member missing from the map (a payload from
+	// an older server, or a dep that resolved to nothing) is skipped
+	// — the loader would have had nothing to do with it anyway.
+	const depsOf = ( handle: string | undefined ): LazyScriptDependency[] | undefined => {
+		const own = handle ? data[ handle ] : undefined;
+		if ( ! own?.deps || own.deps.length === 0 ) {
+			return undefined;
+		}
+		const deps: LazyScriptDependency[] = [];
+		for ( const depHandle of own.deps ) {
+			const dep = data[ depHandle ];
+			if ( ! dep ) {
+				continue;
+			}
+			deps.push( {
+				handle: depHandle,
+				url: dep.url ?? '',
+				before: dep.before,
+				after: dep.after,
+				l10n: dep.l10n,
+				translations: dep.translations,
+			} );
+		}
+		return deps.length > 0 ? deps : undefined;
+	};
 	return entries.map( ( entry ) => {
 		const own = entry.scriptHandle ? data[ entry.scriptHandle ] : undefined;
 
@@ -1094,6 +1122,7 @@ export function hydrateServerEntries(
 				scriptAfter: resolved.after,
 				scriptL10n: resolved.l10n,
 				scriptTranslations: resolved.translations,
+				scriptDeps: depsOf( companion ),
 			} );
 		}
 
@@ -1112,6 +1141,7 @@ export function hydrateServerEntries(
 					scriptAfter: resolved?.after,
 					scriptL10n: resolved?.l10n,
 					scriptTranslations: resolved?.translations,
+					scriptDeps: depsOf( tab.scriptHandle ),
 				};
 			},
 		);
@@ -1123,6 +1153,7 @@ export function hydrateServerEntries(
 			scriptAfter: entry.scriptAfter ?? own?.after,
 			scriptL10n: entry.scriptL10n ?? own?.l10n,
 			scriptTranslations: entry.scriptTranslations ?? own?.translations,
+			scriptDeps: entry.scriptDeps ?? depsOf( entry.scriptHandle ),
 			companionScripts: companions,
 			tabs,
 		};
@@ -1342,6 +1373,7 @@ export function createNativeWindowSync(
 			scriptL10n?: string[];
 			scriptBefore?: string[];
 			scriptAfter?: string[];
+			scriptDeps?: LazyScriptDependency[];
 		},
 	): Promise< void > => {
 		const url = script.scriptUrl;
@@ -1366,6 +1398,13 @@ export function createNativeWindowSync(
 			l10n: script.scriptL10n,
 			before: script.scriptBefore,
 			after: script.scriptAfter,
+			// The packages the bundle declares — the loader brings
+			// them into the tab first, in order, skipping anything
+			// the document already ran. A window's bundle never goes
+			// through WordPress's own dependency resolution when it
+			// is fetched lazily, and a plugin's config commonly rides
+			// a src-less alias declared as exactly such a dependency.
+			deps: script.scriptDeps,
 		} )
 			.catch( ( err ) => {
 				// Load failed — surface via SHELL_ERROR. The window
diff --git a/src/script-presence.ts b/src/script-presence.ts
index 371d7c0ba..328c73f15 100644
--- a/src/script-presence.ts
+++ b/src/script-presence.ts
@@ -30,12 +30,18 @@
  * round-trip, and nothing to keep in sync with a boot-time snapshot
  * that a later print would invalidate.
  *
- * A script is therefore in the document when EITHER holds:
+ * A script is therefore in the document when ANY of these holds:
  *
  *   - some `<script src>` serves the same origin + path, or
- *   - its handle is listed in a `load-scripts.php` blob.
- *
- * The second test needs the caller to know the handle. Every
+ *   - its handle is listed in a `load-scripts.php` blob, or
+ *   - Core printed a tag under the handle's own id — `<handle>-js`
+ *     for the file, `<handle>-js-before` / `-after` / `-extra` /
+ *     `-translations` for its inline data. That last signal is the
+ *     only one a src-less ALIAS handle can give: it has no file to
+ *     find and no blob to be listed in, and yet Core printed its
+ *     inline data (a plugin's config blob, typically) exactly once.
+ *
+ * The handle tests need the caller to know the handle. Every
  * server-built payload carries one — `openstation_resolve_script_-`
  * `dependencies()` stamps `handle` on every dependency it resolves —
  * while a plugin calling `wp.os.loadVendorScript( url )` with a bare
@@ -192,6 +198,37 @@ export function concatenatedScriptHandles(): Set< string > {
 	return handles;
 }
 
+/**
+ * The id suffixes `WP_Scripts::do_item()` stamps on what it prints
+ * for one handle: the `<script src>` itself and each inline chunk.
+ */
+const PRINTED_ID_SUFFIXES = [
+	'-js',
+	'-js-before',
+	'-js-after',
+	'-js-extra',
+	'-js-translations',
+];
+
+/**
+ * Whether Core printed anything for the handle — a tag carrying one
+ * of the ids `do_item()` assigns. Answers for an alias handle, which
+ * leaves no other trace: no file to match, nothing in a concat blob,
+ * only the inline `<script id="<handle>-js-before">` it printed.
+ *
+ * @param handle WordPress script handle.
+ * @return `true` when a Core-printed tag for the handle is present.
+ */
+export function printedScriptHandleInDocument( handle: string ): boolean {
+	if ( ! handle ) {
+		return false;
+	}
+	return PRINTED_ID_SUFFIXES.some( ( suffix ) => {
+		const tag = document.getElementById( handle + suffix );
+		return !! tag && tag.tagName === 'SCRIPT';
+	} );
+}
+
 /**
  * Whether this document has already been given the script.
  *
@@ -206,5 +243,11 @@ export function isScriptInDocument( ref: ScriptRef ): boolean {
 	if ( ref.url && findScriptByPath( ref.url ) ) {
 		return true;
 	}
-	return !! ref.handle && concatenatedScriptHandles().has( ref.handle );
+	if ( ! ref.handle ) {
+		return false;
+	}
+	return (
+		concatenatedScriptHandles().has( ref.handle ) ||
+		printedScriptHandleInDocument( ref.handle )
+	);
 }
diff --git a/src/settings/server-sync.ts b/src/settings/server-sync.ts
index c3937a172..006e2b334 100644
--- a/src/settings/server-sync.ts
+++ b/src/settings/server-sync.ts
@@ -56,6 +56,9 @@ export function createSettingsTabRegistrySync(): (
 		try {
 			await loadVendorScript( entry.scriptUrl, {
 				translations: entry.scriptTranslations,
+				// The packages the bundle declares, brought in first; the
+				// document skips what it already ran.
+				deps: entry.scriptDeps,
 				l10n: entry.scriptL10n,
 				before: entry.scriptBefore,
 				after: entry.scriptAfter,
diff --git a/src/title-bar-buttons/server-sync.ts b/src/title-bar-buttons/server-sync.ts
index 73965f2c3..51808e225 100644
--- a/src/title-bar-buttons/server-sync.ts
+++ b/src/title-bar-buttons/server-sync.ts
@@ -36,6 +36,9 @@ export function createTitleBarButtonRegistrySync(): (
 		try {
 			await loadVendorScript( entry.scriptUrl, {
 				translations: entry.scriptTranslations,
+				// The packages the bundle declares, brought in first; the
+				// document skips what it already ran.
+				deps: entry.scriptDeps,
 				l10n: entry.scriptL10n,
 				before: entry.scriptBefore,
 				after: entry.scriptAfter,
diff --git a/src/types.ts b/src/types.ts
index 9e0dbfe1b..2c4307333 100644
--- a/src/types.ts
+++ b/src/types.ts
@@ -865,6 +865,44 @@ export interface MonitorEntry {
  * travels in, so the shell's loader replays `wp_localize_script` /
  * `wp_add_inline_script` / translation data identically.
  */
+/**
+ * One entry of a lazily-delivered bundle's dependency closure, in the
+ * shape the loader replays it: the package's resolved URL plus the
+ * inline data WordPress would have printed around it.
+ *
+ * WordPress resolves a script's dependencies when it ENQUEUES it, so
+ * a normally-printed bundle finds its packages already there. A
+ * bundle delivered lazily never goes through that: one declaring
+ * `wp-api-fetch` found `wp.apiFetch` undefined at mount, and one
+ * whose config rides a src-less alias handle booted with no config.
+ * Anything already in the document is skipped. See
+ * `docs/migration-wp-package-globals.md`.
+ *
+ * @public
+ */
+export interface LazyScriptDependency {
+	/**
+	 * The package's WP script handle. Load-bearing, not
+	 * informational: on a stock wp-admin these packages arrive
+	 * concatenated into one `load-scripts.php` blob and have no
+	 * `<script src>` of their own, so the handle is the only way
+	 * the shell can tell they are already here. See
+	 * `src/script-presence.ts`.
+	 */
+	handle?: string;
+	/**
+	 * Resolved URL to fetch. Empty for a src-less ALIAS handle —
+	 * `wp_register_script( $h, false )` plus `wp_add_inline_script()`
+	 * — whose inline data is replayed in print order with nothing
+	 * fetched in between.
+	 */
+	url: string;
+	before?: string[];
+	after?: string[];
+	l10n?: string[];
+	translations?: string;
+}
+
 export interface NativeWindowCompanionScript {
 	scriptUrl: string;
 	scriptHandle: string;
@@ -872,6 +910,8 @@ export interface NativeWindowCompanionScript {
 	scriptAfter?: string[];
 	scriptL10n?: string[];
 	scriptTranslations?: string;
+	/** The companion's declared packages, replayed before it loads. */
+	scriptDeps?: LazyScriptDependency[];
 }
 
 /**
@@ -890,6 +930,14 @@ export type NativeWindowScriptData = Record<
 		after?: string[];
 		l10n?: string[];
 		translations?: string;
+		/**
+		 * The handle's dependency closure in load order — every one a
+		 * key of this same map, so a package shared by several bundles
+		 * is serialized once. Present on handles the server resolved
+		 * as a bundle to load; absent on one reached only as a
+		 * dependency. An alias dependency has an empty `url` here.
+		 */
+		deps?: string[];
 	}
 >;
 
@@ -994,6 +1042,14 @@ export interface NativeWindowServerEntry {
 	scriptL10n?: string[];
 	/** `wp.i18n.setLocaleData(…)` snippet from `wp_set_script_translations()`. Injected before everything. */
 	scriptTranslations?: string;
+	/**
+	 * The packages `script` declares, in load order, replayed before
+	 * the bundle on its lazy load. The same closure WordPress would
+	 * have resolved had it printed the handle itself — `wp-*`
+	 * packages and a plugin's own src-less config alias alike.
+	 * Anything already in the document is skipped.
+	 */
+	scriptDeps?: LazyScriptDependency[];
 	/**
 	 * Companion bundles (`scripts` arg) loaded in order immediately
 	 * before `scriptUrl`. For code that extends the window from
@@ -1082,6 +1138,8 @@ export interface NativeWindowTabEntry {
 	scriptAfter?: string[];
 	scriptL10n?: string[];
 	scriptTranslations?: string;
+	/** The tab script's declared packages, replayed before it loads. */
+	scriptDeps?: LazyScriptDependency[];
 }
 
 /**
@@ -1134,22 +1192,7 @@ export interface DesktopWidgetServerEntry {
 	 * deferred. Anything already in the document is skipped. See
 	 * `docs/migration-wp-package-globals.md`.
 	 */
-	scriptDeps?: Array< {
-		/**
-		 * The package's WP script handle. Load-bearing, not
-		 * informational: on a stock wp-admin these packages arrive
-		 * concatenated into one `load-scripts.php` blob and have no
-		 * `<script src>` of their own, so the handle is the only way
-		 * the shell can tell they are already here. See
-		 * `src/script-presence.ts`.
-		 */
-		handle?: string;
-		url: string;
-		before?: string[];
-		after?: string[];
-		l10n?: string[];
-		translations?: string;
-	} >;
+	scriptDeps?: LazyScriptDependency[];
 }
 
 /**
@@ -1193,6 +1236,8 @@ export interface DesktopWallpaperServerEntry {
 	scriptAfter?: string[];
 	scriptL10n?: string[];
 	scriptTranslations?: string;
+	/** The handle's declared packages, replayed before the bundle on its lazy load. */
+	scriptDeps?: LazyScriptDependency[];
 }
 
 /**
@@ -1283,6 +1328,8 @@ export interface DesktopGameServerEntry {
 	scriptAfter?: string[];
 	scriptL10n?: string[];
 	scriptTranslations?: string;
+	/** The handle's declared packages, replayed before the bundle on its lazy load. */
+	scriptDeps?: LazyScriptDependency[];
 }
 
 /**
@@ -1308,6 +1355,8 @@ export interface DesktopCommandScriptServerEntry {
 	scriptAfter?: string[];
 	scriptL10n?: string[];
 	scriptTranslations?: string;
+	/** The handle's declared packages, replayed before the bundle on its lazy load. */
+	scriptDeps?: LazyScriptDependency[];
 }
 
 /**
@@ -1326,6 +1375,8 @@ export interface DesktopDockRailRendererScriptServerEntry {
 	scriptAfter?: string[];
 	scriptL10n?: string[];
 	scriptTranslations?: string;
+	/** The handle's declared packages, replayed before the bundle on its lazy load. */
+	scriptDeps?: LazyScriptDependency[];
 }
 
 /**
@@ -1360,6 +1411,8 @@ export interface DesktopCommandServerEntry {
 	scriptAfter?: string[];
 	scriptL10n?: string[];
 	scriptTranslations?: string;
+	/** The handle's declared packages, replayed before the bundle on its lazy load. */
+	scriptDeps?: LazyScriptDependency[];
 }
 
 /**
@@ -1383,6 +1436,8 @@ export interface DesktopSettingsTabScriptServerEntry {
 	scriptAfter?: string[];
 	scriptL10n?: string[];
 	scriptTranslations?: string;
+	/** The handle's declared packages, replayed before the bundle on its lazy load. */
+	scriptDeps?: LazyScriptDependency[];
 }
 
 /**
@@ -1403,6 +1458,8 @@ export interface DesktopTitleBarButtonScriptServerEntry {
 	scriptAfter?: string[];
 	scriptL10n?: string[];
 	scriptTranslations?: string;
+	/** The handle's declared packages, replayed before the bundle on its lazy load. */
+	scriptDeps?: LazyScriptDependency[];
 }
 
 /**
@@ -1424,6 +1481,8 @@ export interface DesktopWindowActionScriptServerEntry {
 	scriptAfter?: string[];
 	scriptL10n?: string[];
 	scriptTranslations?: string;
+	/** The handle's declared packages, replayed before the bundle on its lazy load. */
+	scriptDeps?: LazyScriptDependency[];
 }
 
 /**
@@ -1445,6 +1504,8 @@ export interface DesktopUnfocusEffectScriptServerEntry {
 	scriptAfter?: string[];
 	scriptL10n?: string[];
 	scriptTranslations?: string;
+	/** The handle's declared packages, replayed before the bundle on its lazy load. */
+	scriptDeps?: LazyScriptDependency[];
 }
 
 /**
@@ -1466,6 +1527,8 @@ export interface DesktopWindowLinkRendererScriptServerEntry {
 	scriptAfter?: string[];
 	scriptL10n?: string[];
 	scriptTranslations?: string;
+	/** The handle's declared packages, replayed before the bundle on its lazy load. */
+	scriptDeps?: LazyScriptDependency[];
 }
 
 /**
@@ -1486,6 +1549,8 @@ export interface DesktopWindowThemeScriptServerEntry {
 	scriptAfter?: string[];
 	scriptL10n?: string[];
 	scriptTranslations?: string;
+	/** The handle's declared packages, replayed before the bundle on its lazy load. */
+	scriptDeps?: LazyScriptDependency[];
 }
 
 /**
@@ -1511,6 +1576,8 @@ export interface DesktopWindowThemeServerEntry {
 	scriptAfter?: string[];
 	scriptL10n?: string[];
 	scriptTranslations?: string;
+	/** The handle's declared packages, replayed before the bundle on its lazy load. */
+	scriptDeps?: LazyScriptDependency[];
 }
 
 /**
@@ -1526,6 +1593,8 @@ export interface DesktopWindowControlScriptServerEntry {
 	scriptAfter?: string[];
 	scriptL10n?: string[];
 	scriptTranslations?: string;
+	/** The handle's declared packages, replayed before the bundle on its lazy load. */
+	scriptDeps?: LazyScriptDependency[];
 }
 
 /**
@@ -1546,6 +1615,8 @@ export interface DesktopWindowControlServerEntry {
 	scriptAfter?: string[];
 	scriptL10n?: string[];
 	scriptTranslations?: string;
+	/** The handle's declared packages, replayed before the bundle on its lazy load. */
+	scriptDeps?: LazyScriptDependency[];
 }
 
 /**
@@ -1561,6 +1632,8 @@ export interface DesktopWindowSlotScriptServerEntry {
 	scriptAfter?: string[];
 	scriptL10n?: string[];
 	scriptTranslations?: string;
+	/** The handle's declared packages, replayed before the bundle on its lazy load. */
+	scriptDeps?: LazyScriptDependency[];
 }
 
 /**
@@ -1582,6 +1655,8 @@ export interface DesktopWindowSlotServerEntry {
 	scriptAfter?: string[];
 	scriptL10n?: string[];
 	scriptTranslations?: string;
+	/** The handle's declared packages, replayed before the bundle on its lazy load. */
+	scriptDeps?: LazyScriptDependency[];
 }
 
 /**
@@ -1632,6 +1707,8 @@ export interface DesktopWindowChromeScriptServerEntry {
 	scriptAfter?: string[];
 	scriptL10n?: string[];
 	scriptTranslations?: string;
+	/** The handle's declared packages, replayed before the bundle on its lazy load. */
+	scriptDeps?: LazyScriptDependency[];
 }
 
 /**
@@ -1649,6 +1726,8 @@ export interface DesktopWindowChromeServerEntry {
 	scriptAfter?: string[];
 	scriptL10n?: string[];
 	scriptTranslations?: string;
+	/** The handle's declared packages, replayed before the bundle on its lazy load. */
+	scriptDeps?: LazyScriptDependency[];
 }
 
 /**
@@ -1680,6 +1759,8 @@ export interface DesktopSettingsTabServerEntry {
 	scriptAfter?: string[];
 	scriptL10n?: string[];
 	scriptTranslations?: string;
+	/** The handle's declared packages, replayed before the bundle on its lazy load. */
+	scriptDeps?: LazyScriptDependency[];
 }
 
 /**
diff --git a/src/wallpapers/lazy.ts b/src/wallpapers/lazy.ts
index 86f2eb3c9..bf09c737c 100644
--- a/src/wallpapers/lazy.ts
+++ b/src/wallpapers/lazy.ts
@@ -111,6 +111,9 @@ export function hydrate( id: string ): Promise< WallpaperDef | null > {
 		try {
 			await loadVendorScript( entry.scriptUrl, {
 				translations: entry.scriptTranslations,
+				// The packages the bundle declares, brought in first; the
+				// document skips what it already ran.
+				deps: entry.scriptDeps,
 				l10n: entry.scriptL10n,
 				before: entry.scriptBefore,
 				after: entry.scriptAfter,
diff --git a/src/wallpapers/vendor-loader.ts b/src/wallpapers/vendor-loader.ts
index 589ca59f3..16094ecdb 100644
--- a/src/wallpapers/vendor-loader.ts
+++ b/src/wallpapers/vendor-loader.ts
@@ -21,6 +21,14 @@ import { findScriptByPath, isScriptInDocument } from '../script-presence';
  */
 const pending = new Map<string, Promise<void>>();
 
+/**
+ * Handles of src-less ALIAS dependencies whose inline data this
+ * loader has already replayed. An alias has no URL for the memo above
+ * to key on, and its data — a plugin's config blob, typically — must
+ * run once per document, not once per bundle that declares it.
+ */
+const replayedAliases = new Set< string >();
+
 /**
  * Inline `extra` data harvested from a registered WP script handle by
  * {@link openstation_resolve_script_payload} on the server. Without
@@ -79,6 +87,14 @@ export interface ScriptExtras {
 	 *
 	 * Anything already in the document is skipped, so this costs
 	 * nothing on a page that had the packages anyway.
+	 *
+	 * An entry with an empty `url` is a src-less ALIAS handle —
+	 * `wp_register_script( $h, false )` plus `wp_add_inline_script()`,
+	 * WordPress's supported way to ship inline-only JavaScript, and a
+	 * common home for a plugin's config blob (declared as the bundle's
+	 * dependency so it always runs first). There is nothing to fetch;
+	 * its inline data is replayed in print order instead, once per
+	 * document, and not at all when Core already printed it.
 	 */
 	deps?: Array< { url: string } & ScriptExtras >;
 }
@@ -121,7 +137,11 @@ export function loadVendorScript(
 	const deps = extras?.deps;
 	if ( deps && deps.length > 0 ) {
 		const loadDep = ( dep: { url: string } & ScriptExtras ) => {
-			if ( ! dep.url || isScriptInDocument( dep ) ) {
+			if ( isScriptInDocument( dep ) ) {
+				return Promise.resolve();
+			}
+			if ( ! dep.url ) {
+				replayAlias( dep );
 				return Promise.resolve();
 			}
 			return loadVendorScript( dep.url, { ...dep, deps: undefined } );
@@ -145,6 +165,37 @@ export function loadVendorScript(
 	return promise;
 }
 
+/**
+ * Replay a src-less alias dependency's inline data, once.
+ *
+ * What `WP_Scripts::do_item()` prints for a handle with no `src`:
+ * localized data, then the `before` snippets, then the `after` ones,
+ * and no `<script src>` in between. Synchronous — an inline
+ * `<script>` runs during `appendChild()` — so the bundle that
+ * declared the alias finds its globals set by the time its own tag
+ * is appended. Keyed by handle: an alias without one cannot be told
+ * apart from its next occurrence and is replayed each time it is
+ * asked for, which is still the print pipeline's own behaviour for
+ * an anonymous snippet.
+ */
+function replayAlias( dep: ScriptExtras ): void {
+	if ( dep.handle ) {
+		if ( replayedAliases.has( dep.handle ) ) {
+			return;
+		}
+		replayedAliases.add( dep.handle );
+	}
+	for ( const code of dep.l10n ?? [] ) {
+		injectInline( code );
+	}
+	for ( const code of dep.before ?? [] ) {
+		injectInline( code );
+	}
+	for ( const code of dep.after ?? [] ) {
+		injectInline( code );
+	}
+}
+
 /**
  * Inject one `<script>` tag and its inline data, resolving on `load`.
  *
diff --git a/src/window-actions/server-sync.ts b/src/window-actions/server-sync.ts
index 4736f6c09..43cb301f5 100644
--- a/src/window-actions/server-sync.ts
+++ b/src/window-actions/server-sync.ts
@@ -39,6 +39,9 @@ export function createWindowActionRegistrySync(): (
 		try {
 			await loadVendorScript( entry.scriptUrl, {
 				translations: entry.scriptTranslations,
+				// The packages the bundle declares, brought in first; the
+				// document skips what it already ran.
+				deps: entry.scriptDeps,
 				l10n: entry.scriptL10n,
 				before: entry.scriptBefore,
 				after: entry.scriptAfter,
diff --git a/src/window-chrome/chrome/server-sync.ts b/src/window-chrome/chrome/server-sync.ts
index 1a5138cb9..b4a791b9f 100644
--- a/src/window-chrome/chrome/server-sync.ts
+++ b/src/window-chrome/chrome/server-sync.ts
@@ -35,6 +35,9 @@ export function createWindowChromeRegistrySync(): (
 		try {
 			await loadVendorScript( entry.scriptUrl, {
 				translations: entry.scriptTranslations,
+				// The packages the bundle declares, brought in first; the
+				// document skips what it already ran.
+				deps: entry.scriptDeps,
 				l10n: entry.scriptL10n,
 				before: entry.scriptBefore,
 				after: entry.scriptAfter,
diff --git a/src/window-chrome/controls/server-sync.ts b/src/window-chrome/controls/server-sync.ts
index f3140b024..5346e4d9c 100644
--- a/src/window-chrome/controls/server-sync.ts
+++ b/src/window-chrome/controls/server-sync.ts
@@ -41,6 +41,9 @@ export function createWindowControlRegistrySync(): (
 		try {
 			await loadVendorScript( entry.scriptUrl, {
 				translations: entry.scriptTranslations,
+				// The packages the bundle declares, brought in first; the
+				// document skips what it already ran.
+				deps: entry.scriptDeps,
 				l10n: entry.scriptL10n,
 				before: entry.scriptBefore,
 				after: entry.scriptAfter,
diff --git a/src/window-chrome/slots/server-sync.ts b/src/window-chrome/slots/server-sync.ts
index 4f37099d5..c5a630c6c 100644
--- a/src/window-chrome/slots/server-sync.ts
+++ b/src/window-chrome/slots/server-sync.ts
@@ -34,6 +34,9 @@ export function createWindowSlotRegistrySync(): (
 		try {
 			await loadVendorScript( entry.scriptUrl, {
 				translations: entry.scriptTranslations,
+				// The packages the bundle declares, brought in first; the
+				// document skips what it already ran.
+				deps: entry.scriptDeps,
 				l10n: entry.scriptL10n,
 				before: entry.scriptBefore,
 				after: entry.scriptAfter,
diff --git a/src/window-chrome/themes/server-sync.ts b/src/window-chrome/themes/server-sync.ts
index e0407cd15..c5de7d338 100644
--- a/src/window-chrome/themes/server-sync.ts
+++ b/src/window-chrome/themes/server-sync.ts
@@ -67,6 +67,9 @@ export function createWindowThemeRegistrySync(): (
 		try {
 			await loadVendorScript( entry.scriptUrl, {
 				translations: entry.scriptTranslations,
+				// The packages the bundle declares, brought in first; the
+				// document skips what it already ran.
+				deps: entry.scriptDeps,
 				l10n: entry.scriptL10n,
 				before: entry.scriptBefore,
 				after: entry.scriptAfter,
diff --git a/src/window-links/server-sync.ts b/src/window-links/server-sync.ts
index 8d74afb92..54633fe4f 100644
--- a/src/window-links/server-sync.ts
+++ b/src/window-links/server-sync.ts
@@ -35,6 +35,9 @@ export function createWindowLinkRendererRegistrySync(): (
 		try {
 			await loadVendorScript( entry.scriptUrl, {
 				translations: entry.scriptTranslations,
+				// The packages the bundle declares, brought in first; the
+				// document skips what it already ran.
+				deps: entry.scriptDeps,
 				l10n: entry.scriptL10n,
 				before: entry.scriptBefore,
 				after: entry.scriptAfter,
diff --git a/tests/phpunit/tests/commands.php b/tests/phpunit/tests/commands.php
index d90bc154f..f45bb48ff 100644
--- a/tests/phpunit/tests/commands.php
+++ b/tests/phpunit/tests/commands.php
@@ -75,6 +75,42 @@ public function test_payload_resolves_registered_handle_to_absolute_url() {
 		$this->assertStringContainsString( 'cmd.js', $entry['scriptUrl'] );
 	}
 
+	/**
+	 * The handle's dependency closure ships with it.
+	 *
+	 * A command script is fetched lazily on activation and never goes
+	 * through WordPress's own dependency resolution; and because the
+	 * loader memoizes by URL, whichever path fetches a bundle FIRST
+	 * decides what ran before it. AllTerrain Forms registers its
+	 * builder bundle as a command script too, so the command sync won
+	 * that race on a live activation and the bundle ran without the
+	 * src-less config alias it declares. Every lazy payload ships the
+	 * closure for exactly that reason.
+	 *
+	 * @covers ::openstation_build_desktop_command_scripts_payload
+	 */
+	public function test_payload_ships_the_dependency_closure() {
+		$alias  = 'cmd-test-config-' . uniqid();
+		$handle = 'cmd-test-d-' . uniqid();
+		wp_register_script( $alias, false, array(), '1.0.0', true );
+		wp_add_inline_script( $alias, 'window.cmdTestConfig={};', 'before' );
+		wp_register_script( $handle, 'https://example.test/cmd.js', array( $alias ), '1.0.0', true );
+		openstation_register_command_script( $handle );
+
+		$entry = null;
+		foreach ( openstation_build_desktop_command_scripts_payload() as $p ) {
+			if ( $p['handle'] === $handle ) {
+				$entry = $p;
+				break;
+			}
+		}
+		$this->assertNotNull( $entry );
+		$this->assertCount( 1, $entry['scriptDeps'] );
+		$this->assertSame( $alias, $entry['scriptDeps'][0]['handle'] );
+		$this->assertSame( '', $entry['scriptDeps'][0]['url'] );
+		$this->assertSame( array( 'window.cmdTestConfig={};' ), $entry['scriptDeps'][0]['before'] );
+	}
+
 	/**
 	 * @covers ::openstation_build_desktop_command_scripts_payload
 	 */
diff --git a/tests/phpunit/tests/nativeWindowLazyScript.php b/tests/phpunit/tests/nativeWindowLazyScript.php
index a85a3f93c..085b8b42c 100644
--- a/tests/phpunit/tests/nativeWindowLazyScript.php
+++ b/tests/phpunit/tests/nativeWindowLazyScript.php
@@ -584,4 +584,82 @@ static function () {
 			$payload['nativeWindowScriptData']['demo-extra']['before']
 		);
 	}
+
+	// --------------------------------------------------------------
+	// Dependency closure
+	// --------------------------------------------------------------
+
+	/**
+	 * A window's bundle ships the packages it declares.
+	 *
+	 * WordPress resolves a script's dependencies when it enqueues it;
+	 * a bundle the shell fetches lazily never goes through that, so
+	 * whatever the handle declared — a `wp-*` package, or a plugin's
+	 * own src-less config alias — was simply absent when it ran. The
+	 * closure rides the handle's map entry as an ordered handle list,
+	 * and every member lands in the same map so a shared package is
+	 * serialized once.
+	 *
+	 * @covers ::openstation_collect_native_windows_payload
+	 */
+	public function test_script_ships_its_dependency_closure() {
+		$this->register_demo_script( 'demo-base', 'https://example.test/base.js' );
+		wp_register_script( 'demo-config', false, array( 'demo-base' ), '1.0.0', true );
+		wp_add_inline_script( 'demo-config', 'window.demoConfig={c:3};', 'before' );
+		$this->register_demo_script( 'demo-main', 'https://example.test/main.js' );
+		wp_scripts()->registered['demo-main']->deps = array( 'demo-config' );
+
+		$this->register_demo_window( 'demo-deps-window', array( 'script' => 'demo-main' ) );
+
+		$data = $this->script_data();
+		$this->assertSame( array( 'demo-base', 'demo-config' ), $data['demo-main']['deps'] );
+
+		$this->assertArrayHasKey( 'demo-base', $data );
+		$this->assertStringContainsString( 'base.js', $data['demo-base']['url'] );
+
+		// The alias: nothing to fetch, its inline data intact.
+		$this->assertArrayHasKey( 'demo-config', $data );
+		$this->assertSame( '', $data['demo-config']['url'] );
+		$this->assertSame( array( 'window.demoConfig={c:3};' ), $data['demo-config']['before'] );
+	}
+
+	/**
+	 * A handle that is somebody's dependency AND a window's own script
+	 * gets its own closure computed when it is named as a script — the
+	 * dependency visit alone does not settle it.
+	 *
+	 * @covers ::openstation_collect_native_windows_payload
+	 */
+	public function test_a_dependency_named_as_a_script_resolves_its_own_closure() {
+		$this->register_demo_script( 'demo-base', 'https://example.test/base.js' );
+		$this->register_demo_script( 'demo-shared', 'https://example.test/shared.js' );
+		wp_scripts()->registered['demo-shared']->deps = array( 'demo-base' );
+		$this->register_demo_script( 'demo-main', 'https://example.test/main.js' );
+		wp_scripts()->registered['demo-main']->deps = array( 'demo-shared' );
+
+		// Registration order puts the dependency visit first.
+		$this->register_demo_window( 'demo-first', array( 'script' => 'demo-main' ) );
+		$this->register_demo_window( 'demo-second', array( 'script' => 'demo-shared' ) );
+
+		$data = $this->script_data();
+		$this->assertSame( array( 'demo-base', 'demo-shared' ), $data['demo-main']['deps'] );
+		$this->assertSame( array( 'demo-base' ), $data['demo-shared']['deps'] );
+	}
+
+	/**
+	 * A window whose `script` is itself an alias still has no bundle
+	 * to load: `scriptHandle` stays empty, as it always did.
+	 *
+	 * @covers ::openstation_collect_native_windows_payload
+	 */
+	public function test_alias_as_a_window_script_is_still_nothing_to_load() {
+		wp_register_script( 'demo-alias-only', false, array(), '1.0.0', true );
+		wp_add_inline_script( 'demo-alias-only', 'window.demoAlias=1;', 'before' );
+
+		$this->register_demo_window( 'demo-alias-window', array( 'script' => 'demo-alias-only' ) );
+
+		$entry = $this->payload_entry( 'demo-alias-window' );
+		$this->assertSame( '', $entry['scriptHandle'] );
+		$this->assertSame( 'demo-alias-only', $entry['ownerHandle'] );
+	}
 }
diff --git a/tests/phpunit/tests/resolveScriptDependencies.php b/tests/phpunit/tests/resolveScriptDependencies.php
index 8d7d285df..980cf7a9f 100644
--- a/tests/phpunit/tests/resolveScriptDependencies.php
+++ b/tests/phpunit/tests/resolveScriptDependencies.php
@@ -227,4 +227,67 @@ public function test_returns_empty_for_unregistered_or_dependency_free_handles()
 		$this->assertSame( array(), openstation_resolve_script_dependencies( 'os-test-nope' ) );
 		$this->assertSame( array(), openstation_resolve_script_dependencies( '' ) );
 	}
+
+	/**
+	 * A src-less ALIAS dependency is kept for its inline data.
+	 *
+	 * `wp_register_script( $h, false )` plus `wp_add_inline_script()`
+	 * is WordPress's supported way to ship inline-only JavaScript,
+	 * and a common home for a plugin's config blob — declared as a
+	 * dependency of every bundle so the config always runs first,
+	 * whatever the enqueue order. AllTerrain Forms ships exactly
+	 * that, and its builder window opened after a live activation
+	 * with no `window.allTerrainForms` because the alias resolved to
+	 * an empty payload and was dropped from the closure.
+	 *
+	 * @covers ::openstation_resolve_script_dependencies
+	 * @covers ::openstation_resolve_script_payload
+	 */
+	public function test_alias_dependency_keeps_its_inline_data() {
+		wp_register_script( 'os-test-config', false, array(), '1.0.0', true );
+		wp_add_inline_script( 'os-test-config', 'window.osTestConfig={a:1};', 'before' );
+		wp_add_inline_script( 'os-test-config', 'window.osTestConfigReady=true;', 'after' );
+		wp_localize_script( 'os-test-config', 'osTestL10n', array( 'b' => '2' ) );
+		$this->register( 'os-test-bundle', array( 'os-test-config' ) );
+
+		$resolved = openstation_resolve_script_dependencies( 'os-test-bundle' );
+
+		$this->assertCount( 1, $resolved );
+		$this->assertSame( 'os-test-config', $resolved[0]['handle'] );
+		// Nothing to fetch — the client replays the inline data and
+		// appends no `<script src>`.
+		$this->assertSame( '', $resolved[0]['url'] );
+		$this->assertSame( array( 'window.osTestConfig={a:1};' ), $resolved[0]['before'] );
+		$this->assertSame( array( 'window.osTestConfigReady=true;' ), $resolved[0]['after'] );
+		$this->assertCount( 1, $resolved[0]['l10n'] );
+		$this->assertStringContainsString( 'osTestL10n', $resolved[0]['l10n'][0] );
+	}
+
+	/**
+	 * An alias carrying nothing is the one thing still dropped: there
+	 * is neither a file to fetch nor a snippet to run.
+	 *
+	 * @covers ::openstation_resolve_script_dependencies
+	 */
+	public function test_empty_alias_dependency_is_dropped() {
+		wp_register_script( 'os-test-empty-alias', false, array(), '1.0.0', true );
+		$this->register( 'os-test-bundle', array( 'os-test-empty-alias' ) );
+
+		$this->assertSame( array(), openstation_resolve_script_dependencies( 'os-test-bundle' ) );
+	}
+
+	/**
+	 * An alias that aggregates real packages contributes them to the
+	 * closure, in order, whether or not it carries inline data of
+	 * its own.
+	 *
+	 * @covers ::openstation_resolve_script_dependencies
+	 */
+	public function test_alias_dependency_still_walks_through_to_its_own_deps() {
+		$this->register( 'os-test-base' );
+		wp_register_script( 'os-test-group', false, array( 'os-test-base' ), '1.0.0', true );
+		$this->register( 'os-test-bundle', array( 'os-test-group' ) );
+
+		$this->assertSame( array( 'os-test-base' ), $this->resolved_handles( 'os-test-bundle' ) );
+	}
 }
diff --git a/tests/vitest/commands-server-sync.test.ts b/tests/vitest/commands-server-sync.test.ts
index 6c7d6f2e3..c2015aeba 100644
--- a/tests/vitest/commands-server-sync.test.ts
+++ b/tests/vitest/commands-server-sync.test.ts
@@ -63,6 +63,26 @@ describe( 'commands/server-sync.ts', () => {
 		);
 	} );
 
+	test( 'hands the loader the dependency closure with the bundle', async () => {
+		const { sync, loader } = await loadModules();
+		const spy = vi
+			.spyOn( loader, 'loadVendorScript' )
+			.mockResolvedValue( undefined );
+		const deps = [
+			{ handle: 'plugin-a-config', url: '', before: [ 'window.pluginA={};' ] },
+		];
+
+		const run = sync.createCommandRegistrySync();
+		await run( [
+			{ handle: 'plugin-a', scriptUrl: 'https://example.test/a.js', scriptDeps: deps },
+		] );
+
+		expect( spy ).toHaveBeenCalledWith(
+			'https://example.test/a.js',
+			expect.objectContaining( { deps } ),
+		);
+	} );
+
 	test( 'is idempotent — a second sync with the same handles is a no-op', async () => {
 		const { sync, loader } = await loadModules();
 		const spy = vi
diff --git a/tests/vitest/native-windows-lazy-script.test.ts b/tests/vitest/native-windows-lazy-script.test.ts
index 2cf022017..764ff7251 100644
--- a/tests/vitest/native-windows-lazy-script.test.ts
+++ b/tests/vitest/native-windows-lazy-script.test.ts
@@ -396,6 +396,99 @@ describe( 'native-windows — deferred bundle loading', () => {
 		);
 	} );
 
+	test( 'hydration resolves a handle\'s dependency closure out of the same map', async () => {
+		const wire = {
+			...entry( 'forms' ),
+			scriptUrl: undefined,
+			scriptHandle: 'forms-builder',
+			companionScripts: [ 'forms-extra' ],
+			tabs: [
+				{ value: 'entries', label: 'Entries', isMain: false, scriptHandle: 'forms-entries' },
+			],
+		} as unknown as Parameters< typeof hydrateServerEntries >[ 0 ][ 0 ];
+
+		const [ hydrated ] = hydrateServerEntries( [ wire ], {
+			'forms-builder': {
+				url: 'https://example.test/builder.js',
+				deps: [ 'wp-hooks', 'forms-config', 'never-in-map' ],
+			},
+			'forms-extra': {
+				url: 'https://example.test/extra.js',
+				deps: [ 'forms-config' ],
+			},
+			'forms-entries': {
+				url: 'https://example.test/entries.js',
+				deps: [ 'forms-config' ],
+			},
+			'wp-hooks': { url: 'https://example.test/hooks.js' },
+			// The alias: nothing to fetch, its config to replay.
+			'forms-config': { url: '', before: [ 'window.allTerrainForms={};' ] },
+		} );
+
+		expect( hydrated.scriptDeps ).toEqual( [
+			{
+				handle: 'wp-hooks',
+				url: 'https://example.test/hooks.js',
+				before: undefined,
+				after: undefined,
+				l10n: undefined,
+				translations: undefined,
+			},
+			{
+				handle: 'forms-config',
+				url: '',
+				before: [ 'window.allTerrainForms={};' ],
+				after: undefined,
+				l10n: undefined,
+				translations: undefined,
+			},
+		] );
+		expect( hydrated.companionScripts?.[ 0 ].scriptDeps?.map( ( d ) => d.handle ) ).toEqual( [
+			'forms-config',
+		] );
+		expect( hydrated.tabs?.[ 0 ].scriptDeps?.map( ( d ) => d.handle ) ).toEqual( [
+			'forms-config',
+		] );
+	} );
+
+	test( 'a handle without a closure hydrates with no deps at all', async () => {
+		const wire = {
+			...entry( 'plain' ),
+			scriptUrl: undefined,
+			scriptHandle: 'plain-bundle',
+		} as unknown as Parameters< typeof hydrateServerEntries >[ 0 ][ 0 ];
+
+		const [ hydrated ] = hydrateServerEntries( [ wire ], {
+			'plain-bundle': { url: 'https://example.test/plain.js', deps: [] },
+		} );
+
+		expect( hydrated.scriptDeps ).toBeUndefined();
+	} );
+
+	test( 'the loader is handed the closure with the bundle', async () => {
+		const h = setupHarness();
+		const deps = [
+			{ handle: 'forms-config', url: '', before: [ 'window.allTerrainForms={};' ] },
+		];
+		const e = entry( 'deps-window', { scriptDeps: deps } );
+		installTemplate( e );
+		const { sync, openById } = createNativeWindowSync( depsFromHarness( h ) );
+		await sync( [ e ] );
+
+		let extras: unknown;
+		vi.mocked( vendorLoader.loadVendorScript ).mockImplementation(
+			async ( url: string, x?: unknown ) => {
+				loaded.push( url );
+				extras = x;
+			},
+		);
+		openById( 'deps-window' );
+		await runRender( h.managerOpen );
+
+		expect( loaded ).toEqual( [ 'https://example.test/deps-window.js' ] );
+		expect( ( extras as { deps?: unknown } ).deps ).toEqual( deps );
+	} );
+
 	test( 'hydration passes old-format inline entries through untouched', async () => {
 		const inline = entry( 'legacy', {
 			scriptL10n: [ 'window.legacy=1;' ],
diff --git a/tests/vitest/script-presence.test.ts b/tests/vitest/script-presence.test.ts
index db8fb320c..6723aba44 100644
--- a/tests/vitest/script-presence.test.ts
+++ b/tests/vitest/script-presence.test.ts
@@ -19,6 +19,7 @@ import {
 	concatenatedScriptHandles,
 	findScriptByPath,
 	isScriptInDocument,
+	printedScriptHandleInDocument,
 } from '../../src/script-presence';
 
 /** Append a `<script src>` exactly as the document would carry it. */
@@ -175,3 +176,57 @@ describe( 'isScriptInDocument', () => {
 		expect( isScriptInDocument( { handle: 'wp-hooks' } ) ).toBe( true );
 	} );
 } );
+
+describe( 'printedScriptHandleInDocument', () => {
+	/** An inline tag exactly as `WP_Scripts::print_inline_script()` prints it. */
+	function printInline( id: string, code: string ): void {
+		const tag = document.createElement( 'script' );
+		tag.id = id;
+		tag.textContent = code;
+		document.head.append( tag );
+	}
+
+	it( 'sees an alias handle through the inline tag Core printed for it', () => {
+		// `wp_register_script( $h, false )` + `wp_add_inline_script()`:
+		// no file, no concat blob, only this.
+		printInline( 'acme-config-js-before', 'window.acmeConfig={};' );
+
+		expect( printedScriptHandleInDocument( 'acme-config' ) ).toBe( true );
+		expect( isScriptInDocument( { handle: 'acme-config', url: '' } ) ).toBe(
+			true,
+		);
+	} );
+
+	it( 'sees a file handle through the id on its own tag', () => {
+		const tag = document.createElement( 'script' );
+		tag.id = 'acme-widget-js';
+		tag.src = 'https://site.test/wp-content/plugins/acme/widget.js?ver=1';
+		document.head.append( tag );
+
+		expect( printedScriptHandleInDocument( 'acme-widget' ) ).toBe( true );
+	} );
+
+	it( 'accepts every inline position Core stamps', () => {
+		for ( const suffix of [ '-js-after', '-js-extra', '-js-translations' ] ) {
+			document.head.innerHTML = '';
+			printInline( `acme${ suffix }`, '1;' );
+			expect( printedScriptHandleInDocument( 'acme' ) ).toBe( true );
+		}
+	} );
+
+	it( 'says no for a handle nothing was printed under', () => {
+		printInline( 'other-js-before', '1;' );
+
+		expect( printedScriptHandleInDocument( 'acme-config' ) ).toBe( false );
+		expect( isScriptInDocument( { handle: 'acme-config' } ) ).toBe( false );
+	} );
+
+	it( 'ignores a non-script element that happens to carry the id', () => {
+		const div = document.createElement( 'div' );
+		div.id = 'acme-js';
+		document.body.append( div );
+
+		expect( printedScriptHandleInDocument( 'acme' ) ).toBe( false );
+		div.remove();
+	} );
+} );
diff --git a/tests/vitest/vendor-loader.test.ts b/tests/vitest/vendor-loader.test.ts
index f2f080dcf..b4c05ef71 100644
--- a/tests/vitest/vendor-loader.test.ts
+++ b/tests/vitest/vendor-loader.test.ts
@@ -123,3 +123,107 @@ describe( 'loadVendorScript — no double injection', () => {
 		expect( enqueued.dataset.loaded ).toBe( '1' );
 	} );
 } );
+
+/**
+ * A src-less alias dependency — `wp_register_script( $h, false )` plus
+ * `wp_add_inline_script()`, the shape a plugin's config blob commonly
+ * takes — has nothing to fetch. Its inline data is what the bundle
+ * declaring it needs, and it must run once: not never (the AllTerrain
+ * Forms builder opened after a live activation with no
+ * `window.allTerrainForms`), and not once per bundle that declares it.
+ */
+describe( 'loadVendorScript — alias dependencies', () => {
+	beforeEach( () => {
+		document.head.innerHTML = '';
+		document.body.innerHTML = '';
+	} );
+
+	afterEach( () => {
+		document.head.innerHTML = '';
+		document.body.innerHTML = '';
+	} );
+
+	/**
+	 * The dependency walk is a promise chain — each dependency waits
+	 * for the one before it — so even an alias's synchronous replay
+	 * lands a task later. Nothing fires `load` in jsdom for an
+	 * injected src, so the returned promise itself never settles here.
+	 */
+	const flush = () => new Promise( ( r ) => setTimeout( r, 0 ) );
+
+	function inlineTags(): string[] {
+		return Array.from(
+			document.querySelectorAll< HTMLScriptElement >(
+				'script[data-os-vendor-inline]',
+			),
+		).map( ( tag ) => tag.textContent ?? '' );
+	}
+
+	test( 'replays an alias dependency in print order, with nothing fetched', async () => {
+		const url = 'http://example.test/wp-content/plugins/x/assets/js/alias-a.js';
+		void loadVendorScript( url, {
+			deps: [
+				{
+					handle: 'x-config',
+					url: '',
+					l10n: [ 'var xL10n={};' ],
+					before: [ 'window.xConfig={a:1};' ],
+					after: [ 'window.xConfigReady=true;' ],
+				},
+			],
+		} );
+		await flush();
+
+		// The alias's data precedes the bundle tag, in print order.
+		expect( inlineTags() ).toEqual( [
+			'var xL10n={};',
+			'window.xConfig={a:1};',
+			'window.xConfigReady=true;',
+		] );
+		expect( scriptCount( '/alias-a.js' ) ).toBe( 1 );
+		// No `<script src>` was appended for the alias itself.
+		expect( scriptCount( 'x-config' ) ).toBe( 0 );
+	} );
+
+	test( 'an alias is replayed once however many bundles declare it', async () => {
+		const alias = {
+			handle: 'x-shared-config',
+			url: '',
+			before: [ 'window.xShared=1;' ],
+		};
+		void loadVendorScript(
+			'http://example.test/wp-content/plugins/x/assets/js/alias-b.js',
+			{ deps: [ alias ] },
+		);
+		void loadVendorScript(
+			'http://example.test/wp-content/plugins/x/assets/js/alias-c.js',
+			{ deps: [ alias ] },
+		);
+		await flush();
+
+		expect( inlineTags().filter( ( c ) => c === 'window.xShared=1;' ) ).toHaveLength(
+			1,
+		);
+	} );
+
+	test( 'an alias Core already printed is not replayed', async () => {
+		// What `wp_print_scripts()` left behind for the alias at boot.
+		const printed = document.createElement( 'script' );
+		printed.id = 'x-boot-config-js-before';
+		printed.textContent = 'window.xBoot={};';
+		document.head.appendChild( printed );
+
+		void loadVendorScript(
+			'http://example.test/wp-content/plugins/x/assets/js/alias-d.js',
+			{
+				deps: [
+					{ handle: 'x-boot-config', url: '', before: [ 'window.xBoot={};' ] },
+				],
+			},
+		);
+		await flush();
+
+		expect( inlineTags() ).toEqual( [] );
+		expect( scriptCount( '/alias-d.js' ) ).toBe( 1 );
+	} );
+} );