Very nice and crystal clear answer, thank!
For invalidation I would say it would be nice to have a “black list” about the packages from the registry or even on other packages. I know this isn’t 100% sure blacklistable but some kind of warn on the invalidations. I also created my own counter for this some days ago: Invalidation checker [Code Snippet]
For now I am not sure if there is a real limit. I understand each of the point you mentioned. To write performant code we can assume that the person will look after how to make it type stable. The instable version of the code is for scripting, which is totally good for testing.
My idea is to create a package that is as you mentioned is like a precompilation environment, that is just keeping all the precompilations generated from @snoopi_deep.
Ok… I just realised I can’t push every precompile directive into a package because precompile directives isn’t able to continue the ownership chain. The function should be called from the package… damn! 
I just wasted like 10 hours…
So:
module Y
prec() = Base.precompile(Tuple{typeof(DemoPkg.f),Core.Int64})
precompile(prec,())
end
Module Y can’t chain the ownership of DemoPkg.f.