@ai-ecoverse/slicc-kernel 1.102.1 → 1.102.2

package/README.md

@@ -261,7 +261,7 @@ An empty path is `ENOENT` in every path call (`path_open`, `path_filestat_get`,
 On top of preview1 a WASI program gets:
 
 - **Threads**: `wasi.thread-spawn` (wasm32-wasip1-threads) and WASIX `thread_spawn_v2` start a worker per thread on the process's shared memory, sized from the module's own import (a 2 GiB maximum when the engine cannot reserve more). The threads share one descriptor table, and a file written, created, renamed or removed in one thread shows its new size and metadata to `stat` in every other thread at once, under any of its names (a symlink, a hard link, a new name after a rename in the same process), also when another thread renames a file over that name meanwhile, since the kernel reports which file an open or a change reached; this holds among the kernel's own processes, not against other tabs, `hostfs` writers or programs that aren't WASI; another process's changes show at close and after a `spawn` or `wait`, as with close-to-open caching, so a file another process renames while this one holds it open may show its old size under the new name until then; `exit` or a trap in any thread ends the process. At most 64 threads per process; `SLICC_WASM_THREADS` sets another cap, up to 256.
-- **WASIX** (a module importing `wasix_32v1`): fork and setjmp/longjmp through Asyncify (the module is built with `wasm-opt --asyncify`), with the unwound frames kept in the unused part of the program's stack, below its stack pointer (for a position-independent program, the stack the kernel's linker gives it), so a fork from deep in the stack leaves the program's data alone, and a forked child's thread-locals (`errno` included) where the parent left them: the kernel reruns the module's `__wasm_init_tls` at the parent's TLS base (and puts back the block it overwrites), which also sets the internal globals that hold thread-local addresses (a position-independent program's, a side module's, and those of a variable in the `global-dynamic` TLS model), exec, `posix_spawn`, `waitpid` (with `WNOHANG`, and `WUNTRACED` for a child that stops; WASIX has no `WCONTINUED`), pipes, `dup2`, signal handlers and interval timers, terminal modes, and dynamic linking: a position-independent main module loads side modules with `dlopen` from `LD_LIBRARY_PATH`, its runtime path, `/lib`, `/usr/lib` and `/usr/local/lib`. Each thread has its own copy of the function table, so the kernel hands out its slots (a side module's range, a `dlsym`'d function, a closure): threads loading or looking up at the same time never get the same slot. As in glibc, one `dlopen` at a time runs in a process, constructors included: a `dlopen` from a library's constructor goes ahead in its own thread, and another thread's `dlopen` waits, then finds the library loaded and gets the same handle. A thread waiting there still ends or stops with its process, but a signal handler it has runs once that `dlopen` returns. The lock is let go when a `dlopen` fails (an exception, a trap or `pthread_exit` out of a constructor included) and when its thread ends; a forked child starts with it free. A forked child also gets the side modules its parent had loaded, at the same addresses and table slots, with the slot and closure counters and the parent's thread-local blocks: they are linked again in the child before it resumes, without running their constructors again, since their data is already in the copied memory. A side-module function on the stack when `fork` is called (a callback into the main module that forks) is not instrumented by Asyncify, so it runs again when the stack is rewound, in the parent and in the child, and libffi frames there can trap; side modules would need building with Asyncify for that, which the toolchain does not do yet. In such a program, `dlopen(NULL)`, and `dlopen` of the program's own file (also by a path that resolves to it through symlinks), give a handle for the program that is already running (no second copy is loaded); a program that isn't position-independent gets an error from `dlopen(NULL)`, as from any `dlopen`; `dlsym` on it searches the program, then the loaded libraries, and `dlclose` of it does nothing. A function already in the table (the program's own, or a library's) keeps its slot, so `dlsym(handle, "strlen") == strlen`. Each WASIX thread has its own Asyncify driver too, so a thread can `longjmp` through Asyncify and `fork` (#710). The unwound frames go at the bottom of the thread's own stack (the `stack` and `stack_size` its libc passes to `wasi_thread_start`), never on the main thread's. A thread whose start args don't look like wasix-libc's (a `stack_size` under 4096 or over the memory, a stack top that isn't 16-aligned or not right above the args) gets no driver, so `fork` there is `ENOSYS` as before, rather than an unwind buffer at a bad address. A child forked from a thread runs as that thread: it's rewound through `wasi_thread_start`, can fork again, and ends when the thread's function returns. A program built with exceptions (every position-independent one) does `setjmp` with exceptions rather than Asyncify, so there only `fork` uses the driver.
+- **WASIX** (a module importing `wasix_32v1`): fork and setjmp/longjmp through Asyncify (the module is built with `wasm-opt --asyncify`), with the unwound frames kept in the unused part of the program's stack, below its stack pointer (for a position-independent program, the stack the kernel's linker gives it), so a fork from deep in the stack leaves the program's data alone, and a forked child's thread-locals (`errno` included) where the parent left them: the kernel reruns the module's `__wasm_init_tls` at the parent's TLS base (and puts back the block it overwrites), which also sets the internal globals that hold thread-local addresses (a position-independent program's, a side module's, and those of a variable in the `global-dynamic` TLS model), exec, `posix_spawn`, `waitpid` (with `WNOHANG`, and `WUNTRACED` for a child that stops; WASIX has no `WCONTINUED`), pipes, `dup2`, signal handlers and interval timers, terminal modes, and dynamic linking: a position-independent main module loads side modules with `dlopen` from `LD_LIBRARY_PATH`, its runtime path, `/lib`, `/usr/lib` and `/usr/local/lib`. Each thread has its own copy of the function table, so the kernel hands out its slots (a side module's range, a `dlsym`'d function, a closure): threads loading or looking up at the same time never get the same slot. As in glibc, one `dlopen` at a time runs in a process, constructors included: a `dlopen` from a library's constructor goes ahead in its own thread, and another thread's `dlopen` waits, then finds the library loaded and gets the same handle. A thread waiting there still ends or stops with its process, but a signal handler it has runs once that `dlopen` returns. The lock is let go when a `dlopen` fails (an exception, a trap or `pthread_exit` out of a constructor included) and when its thread ends; a forked child starts with it free. A forked child also gets the side modules its parent had loaded, at the same addresses and table slots, with the slot and closure counters and the parent's thread-local blocks: they are linked again in the child before it resumes, without running their constructors again, since their data is already in the copied memory. A side-module function on the stack when `fork` is called (a callback into the main module that forks) is not instrumented by Asyncify, so it runs again when the stack is rewound, in the parent and in the child, and libffi frames there can trap; side modules would need building with Asyncify for that, which the toolchain does not do yet. In such a program, `dlopen(NULL)`, and `dlopen` of the program's own file (also by a path that resolves to it through symlinks), give a handle for the program that is already running (no second copy is loaded); a program that isn't position-independent gets an error from `dlopen(NULL)`, as from any `dlopen`; `dlsym` on it searches the program, then the loaded libraries, and `dlclose` of it does nothing. A function already in the table (the program's own, or a library's) keeps its slot, so `dlsym(handle, "strlen") == strlen`. Each WASIX thread has its own Asyncify driver too, so a thread can `longjmp` through Asyncify and `fork` (#710). The unwound frames go at the bottom of the thread's own stack (the `stack` and `stack_size` its libc passes to `wasi_thread_start`), never on the main thread's. A thread whose start args don't look like wasix-libc's (a `stack_size` under 4096 or over the memory, a stack top that isn't 16-aligned or not right above the args) gets no driver, so `fork` there is `ENOSYS` as before, rather than an unwind buffer at a bad address. A child forked from a thread runs as that thread: it's rewound through `wasi_thread_start`, can fork again, and ends when the thread's function returns. A program built with exceptions (every position-independent one) does `setjmp` with exceptions rather than Asyncify, so there only `fork` uses the driver. A kernel timer can be longer than `setTimeout`'s 2^31-1 ms (about 24.8 days): an `alarm`, an interval timer, or a `select`, `poll_oneoff` or `epoll_wait` timeout waits its whole time, re-armed in steps of at most 2^31-1 ms, instead of firing at once or spinning (#767).
 - **epoll and eventfd** (WASIX `epoll_create`, `epoll_ctl`, `epoll_wait` and `fd_event`, which tokio's reactor uses through the WASIX mio fork):
   - **Where they live:** an epoll instance and an eventfd are kernel descriptors, so they survive `dup`, `fork` and `exec` (unless close-on-exec) and are shared by a process's threads.
   - **What epoll watches:** sockets (listening, connecting, connected, loopback and uplink), pipes, terminals, `kernel.run`'s stdin, eventfds and other epoll instances (a cycle of instances is `ELOOP`).
@@ -307,7 +307,7 @@ On top of preview1 a WASI program gets:
     - Nothing is undone when a process exits.
   - **Limits:**
     - Semaphores exist only within one kernel (not across tabs), and they don't appear in `/dev/shm`.
-    - A kernel holds at most 4,096 named ones (`ENOSPC`), and a process at most 256 open handles (`EMFILE`; a refused `O_CREAT` leaves no name behind).
+    - A kernel holds at most 65,536 named ones (`ENOSPC`), and a process at most 65,536 open handles (`EMFILE`; a refused `O_CREAT` leaves no name behind). Those are memory bounds (a semaphore is about 100 bytes), not musl's 256 (`SEM_NSEMS_MAX`), which wasix-sysroot -31 drops: python's multiprocessing opens one per `Lock` (#770).
     - `MAP_SHARED` mappings aren't shared between processes, so unnamed semaphores (`sem_init` with `pshared`) work only between a process's threads, and `multiprocessing.shared_memory` doesn't work.
 - **Foreign calls** (libffi's WASIX backend, so Python's `ctypes`): `call_dynamic` calls a function through the program's indirect function table (a static module's exported `__indirect_function_table`, or the dynamic linker's), its arguments and results packed in memory one after another (`i32`/`f32` 4 bytes, `i64`/`f64` 8). With `strict` set, the buffers must fit the function exactly (else `EINVAL`, before the function is called); without it, missing arguments are zero (one cut short keeps the bytes given, with zeros above them) and results that do not fit are left out. A trap or exception of the callee goes through to the caller. JS cannot ask a function for its type, so the kernel reads the types from the module files (the program's and each side module's, once, when a program first calls through `call_dynamic`): a table slot that is empty, past the end, holds a function of no module the kernel knows of, or takes or returns a `v128`, gives `EINVAL`. For closures (callbacks such as `CFUNCTYPE`), a dynamically linked program gets table slots from `closure_allocate`, and `closure_free` gives them back for reuse and empties the slot in every thread; a static program gets `ENOTSUP`. `closure_prepare` puts a trampoline with the requested signature (any of `i32`, `i64`, `f32`, `f64`, `v128`) into such a slot, in every thread: each call stores its arguments below the stack pointer and calls the backing function as `backing(values, results, user_data)`, then returns what it wrote to `results`. The trampolines are small wasm modules made and compiled at run time, once per signature in each thread (an instance per closure), so a page whose Content Security Policy forbids compiling WebAssembly (no `'wasm-unsafe-eval'`) cannot run them; it cannot run the program either. A `fork` or a `longjmp` (both through Asyncify) inside a function reached through `call_dynamic` cannot unwind through it.
 - **Job control:** `^Z`, `SIGTSTP`, `SIGTTIN` and `SIGTTOU` stop a WASIX program at once, unless it has a handler for them. A stopped program that is busy computing is stopped for job control (`jobs` shows it, `fg`, `bg` and `SIGCONT` work), but its worker keeps a core busy until its next system call, since a worker's running code cannot be frozen from outside. Agents should `kill` such a job rather than leave it stopped. An Emscripten program stops at its next kernel call as well, and at its next write, read or sleep that its glue answers without the kernel (a write to its own `/dev/null`, as in `yes > /dev/null`), so a stopped one keeps no core busy unless it computes without any of these calls. A stopped program doesn't move on while stopped: a `sleep` (or a blocked read) that would end meanwhile ends after `SIGCONT`. A call that the stop interrupted runs again after `SIGCONT`, as on Linux. One with a timeout (`select`, `poll`, `ppoll`, `pselect`, `nanosleep`, a timed semaphore wait) waits only for the time that's left, counted from when the kernel first got the call, so it still ends at its deadline. `epoll_wait` and `epoll_pwait` aren't run again: they fail with `EINTR`, even without a handler (signal(7)). A signal for such a program is also delivered at those glue-answered calls, so a handler runs in a loop that only writes to `/dev/null`. For the same reason, a signal with a handler or a terminating default (`^C`, `SIGTERM`) reaches a program that is busy computing only at its next system call, so a CPU-bound loop may not end on `^C`; `kill -9` always ends it. A pending signal is delivered at the program's next WASI or WASIX call, including the calls its worker answers without the kernel (`random_get`, `args_get`, …), except the exempt ones: `clock_time_get` (a tight loop of it measured up to 30% slower), `proc_exit`, `proc_exit2`, `thread_exit`, `thread_spawn_v2` and `wasi.thread-spawn` (wasi-threads), the calls that install handlers (`callback_signal`, `slicc.sigaction_set`), and calls made while Asyncify unwinds or rewinds the stack for `fork` or `longjmp`. A signal that arrives while a thread computes is thus delivered at its next call; when that call is a wait (`poll_oneoff` with a timeout or a descriptor, so `nanosleep` and `poll`/`select` too, `sigmask_poll`, or a futex wait), the handler has run during the call, so the wait ends at once: `EINTR` for a libc of -22 or later (an older one sees its clocks fire, as for any interruption), and a futex wait returns woken. A thread blocked in the kernel or waiting on a lock (`pthread_cond_wait`, a futex) is woken by a signal for it (a futex wait checks for signals every 50 ms, so each waiting thread wakes briefly that often), and `pthread_kill` runs the handler on the thread it names. A sleep, or a clock in `poll_oneoff`, never ends before the time asked (it can end later, never earlier). A signal that ends a sleep or a `poll`/`select` with a timeout makes the call fail with `EINTR` in a program whose libc says it is wasix-sysroot 2025.9.30-22 or later (its `slicc.libc` custom section). Older libcs turn that answer into `ENOTSUP` from `nanosleep` (up to -18), so for a program without the section the wait ends as if it had timed out, unless it imports `fd_fdflags_set` (then `EINTR`, as before).
@@ -1028,20 +1028,28 @@ A threaded WASIX C program for `test/integration/thread-asyncify.test.mjs` (#710
 
 ### `stopwait`
 
-A WASIX C program for `test/integration/stop-restart.test.mjs` (#738). `stopwait CALL` forks a child that waits 300 ms in `CALL` (`epoll`, `poll`, `ppoll`, `select`, `pselect`, `nanosleep` or `clock_nanosleep`) on a pipe that never gets data. The parent stops the child 50 ms after it's ready and continues it 200 ms later. The child prints the result, the error and whether the wait ended before the deadline, at it (300–450 ms) or late.
+A WASIX C program for `test/integration/stop-restart.test.mjs` (#738). `stopwait CALL` forks a child that waits 300 ms in `CALL` (`epoll`, `poll`, `ppoll`, `select`, `pselect`, `nanosleep` or `clock_nanosleep`) on a pipe that never gets data. The parent stops the child once `/proc/<pid>/task/1/stat` shows it blocked (`S`), or 100 ms after it's ready on a kernel without that state, continues it 200 ms later, and reports whether the stop found it blocked. The child prints the result, the error and whether the wait ended before the deadline, at it (300–450 ms) or late.
 
-**Build:** `WASIX_SYSROOT_28=/path/to/wasix-sysroot ./build.sh`, with `wasixcc` 0.4.7 (legacy exceptions) and binaryen's `wasm-opt` (`--asyncify` for `proc_fork`) on `PATH`. `bin/stopwait.wasm` is 50,567 bytes, sha256 `570cb3e29cfdc083bbdc0d20707f2c07b087fe23cef13a8861a4a42b02d20f5f`.
+**Build:** `WASIX_SYSROOT_28=/path/to/wasix-sysroot ./build.sh`, with `wasixcc` 0.4.7 (legacy exceptions) and binaryen's `wasm-opt` (`--asyncify` for `proc_fork`) on `PATH`. `bin/stopwait.wasm` is 59,958 bytes, sha256 `ce49e04baed13b7ccf04d8231da4a29567fde0dac19d5cc81f36c185e0eb4555`.
+
+### `longwait`
+
+A WASIX C program for `test/integration/long-timers.test.mjs` (#767).
+- `longwait alarm` sets `alarm(3000000)` (about 35 days), sleeps 0.5 s, and prints how many alarms came and how many seconds were left.
+- `longwait select|ppoll|nanosleep` waits 3,000,000 s on a pipe that never gets data, until a 300 ms interval timer interrupts the wait.
+
+**Build:** `WASIX_SYSROOT_28=/path/to/wasix-sysroot ./build.sh`, with `wasixcc` 0.4.7 and binaryen's `wasm-opt` on `PATH`. `bin/longwait.wasm` is 44,010 bytes, sha256 `70ae2adfb46864fad3af0241fe26f401a62a5176ccd25ab82fe6588178cfb5c8`.
 
 ### `semtest`
 
 A WASIX C program for `test/integration/semaphore.test.mjs` (#717). It calls the `slicc.sem_*` imports directly (`import_module("slicc")`), so the rows don't wait for the libc side. `semtest MODE` runs one of:
 - `handoff`, `inherit`, `spawn` (a spawned and an exec'd image open the semaphore by name; exec drops the handles);
-- `try`, `timed`, `eintr`, `stopped` (a forked child's 300 ms timed wait is stopped for 200 ms and continued, and reports whether it ended at the deadline);
+- `try`, `timed`, `eintr`, `stopped` (a forked child's 300 ms timed wait is stopped for 200 ms and continued, and reports whether it ended at the deadline; the parent stops it only once `/proc/<pid>/task/1/stat` shows it blocked, `S`, or after 100 ms on a kernel without that state, and reports which);
 - `threads` (FIFO, one thread blocked at a time);
 - `errors`, `unlink`, `owners setup|user`;
-- `killed` (a waiter killed before posts loses no unit), `exited`, `cap`, `handles`.
+- `killed` (a waiter killed before posts loses no unit), `exited`, `cap [N]` (creates up to N names, 10,000 by default), `handles [N]` (opens up to N, 300 by default).
 
-**Build:** `WASIX_SYSROOT_28=/path/to/wasix-sysroot ./build.sh`, with `wasixcc` 0.4.7 (legacy exceptions, `-pthread`) and binaryen's `wasm-opt` (version 132, `--asyncify` for `proc_fork`) on `PATH`. `bin/semtest.wasm` is 68,438 bytes, sha256 `af3d38d87b63fa219bae90b1225376882ba20ace423c5ce24ef57935e80e2fde`.
+**Build:** `WASIX_SYSROOT_28=/path/to/wasix-sysroot ./build.sh`, with `wasixcc` 0.4.7 (legacy exceptions, `-pthread`) and binaryen's `wasm-opt` (version 132, `--asyncify` for `proc_fork`) on `PATH`. `bin/semtest.wasm` is 69,366 bytes, sha256 `b3202708f57acad5f51e5be1b06e3b5a0ad02dd84b3791e052787117b828da4e`.
 
 ### `wlocktest`
 

package/dist/kernel-worker.js

@@ -12136,7 +12136,7 @@ var PATH_OPS = new Set(SYNC_FS_OPS);
 var EARLY_WHOLE_FILE = 64 * 1024;
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.102.1" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.102.2" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -12650,6 +12650,41 @@ var EventFd = class _EventFd {
   }
 };
 
+// src/kernel/timer.ts
+var TIMER_MAX_MS = 2147483647;
+function timerAt(deadline, fire) {
+  let timer;
+  const arm = () => {
+    const left = deadline - performance.now();
+    if (left > 0) {
+      timer = setTimeout(arm, Math.min(left, TIMER_MAX_MS));
+      return;
+    }
+    timer = void 0;
+    fire();
+  };
+  timer = setTimeout(arm, Math.min(Math.max(0, deadline - performance.now()), TIMER_MAX_MS));
+  return () => clearTimeout(timer);
+}
+function timerAfter(ms, fire) {
+  return timerAt(performance.now() + ms, fire);
+}
+function repeating(first, every, fire) {
+  let next2 = performance.now() + first;
+  let cancel = () => {
+  };
+  const tick = () => {
+    fire();
+    if (every <= 0) return;
+    next2 += every;
+    const now = performance.now();
+    if (next2 <= now) next2 += (Math.floor((now - next2) / every) + 1) * every;
+    cancel = timerAt(next2, tick);
+  };
+  cancel = timerAt(next2, tick);
+  return () => cancel();
+}
+
 // src/kernel/epoll.ts
 var EPOLL = {
   IN: 1,
@@ -12701,11 +12736,11 @@ function lookup(fds, fd) {
 }
 function pause(ms, signal) {
   return new Promise((resolve2) => {
-    const timer = setTimeout(resolve2, ms);
+    const cancel = timerAfter(ms, resolve2);
     signal.addEventListener(
       "abort",
       () => {
-        clearTimeout(timer);
+        cancel();
         resolve2();
       },
       { once: true }
@@ -12771,17 +12806,14 @@ var EpollFile = class _EpollFile {
       const round = new AbortController();
       const woken = this.changes.wait(AbortSignal.any([round.signal, signal]));
       woken.catch(() => void 0);
-      let timer;
-      const expiry = deadline === Number.POSITIVE_INFINITY ? [] : [
-        new Promise(
-          (resolve2) => timer = setTimeout(resolve2, deadline - performance.now())
-        )
-      ];
+      let cancel = () => {
+      };
+      const expiry = deadline === Number.POSITIVE_INFINITY ? [] : [new Promise((resolve2) => cancel = timerAt(deadline, resolve2))];
       try {
         await Promise.race([woken, ...expiry]);
       } finally {
         round.abort();
-        clearTimeout(timer);
+        cancel();
       }
     }
   }
@@ -13126,9 +13158,10 @@ var AsyncOps = class {
   }
   sleep(timeoutMs, signal) {
     return new Promise((resolve2, reject) => {
-      let timer;
+      let cancel = () => {
+      };
       const cleanup = () => {
-        clearTimeout(timer);
+        cancel();
         this.waiters.delete(wake);
         signal.removeEventListener("abort", abort);
       };
@@ -13143,10 +13176,10 @@ var AsyncOps = class {
       this.waiters.add(wake);
       signal.addEventListener("abort", abort, { once: true });
       if (timeoutMs !== void 0) {
-        timer = setTimeout(() => {
+        cancel = timerAfter(timeoutMs, () => {
           cleanup();
           resolve2(false);
-        }, timeoutMs);
+        });
       }
     });
   }
@@ -14533,14 +14566,14 @@ async function runChild(req, deps) {
     return frame2(outcome2, new Uint8Array(0), new Uint8Array(0));
   }
   if (failure2 !== void 0) kill();
-  const timer = req.timeoutMs !== void 0 && req.timeoutMs > 0 ? setTimeout(() => stop("ETIMEDOUT"), req.timeoutMs) : void 0;
+  const cancel = req.timeoutMs !== void 0 && req.timeoutMs > 0 ? timerAfter(req.timeoutMs, () => stop("ETIMEDOUT")) : void 0;
   let status;
   try {
     status = await reaped(deps, pid);
     const open = controls.filter((c) => c.opened);
     await Promise.race([Promise.all(open.map((c) => c.eof)), decided.promise]);
   } finally {
-    clearTimeout(timer);
+    cancel?.();
     for (const control of controls) control.shut = true;
   }
   const out = deps.children.captured(pid, 1);
@@ -14596,27 +14629,23 @@ async function waitReady(fds, read, write, deadline, interrupted3) {
       const file = fds.get(fd).file;
       return file.changed === void 0 ? [] : [file.changed(round.signal).catch(() => void 0)];
     });
-    let timer;
-    const expiry = deadline === Number.POSITIVE_INFINITY ? [] : [
-      new Promise(
-        (resolve2) => timer = setTimeout(resolve2, deadline - performance.now())
-      )
-    ];
+    let cancel = () => {
+    };
+    const expiry = deadline === Number.POSITIVE_INFINITY ? [] : [new Promise((resolve2) => cancel = timerAt(deadline, resolve2))];
     try {
       await Promise.race([...changes, ...expiry, interrupted3]);
     } finally {
       round.abort();
-      clearTimeout(timer);
+      cancel();
     }
   }
 }
 
 // src/kernel/sem.ts
 var SEM_VALUE_MAX = 2147483647;
-var SEM_NAMES_MAX = 4096;
-var SEM_HANDLES_MAX = 256;
+var SEM_NAMES_MAX = 65536;
+var SEM_HANDLES_MAX = 65536;
 var NAME_MAX = 251;
-var TIMER_MAX_MS = 2147483647;
 var SEM_OPS = [
   "sem-open",
   "sem-close",
@@ -14653,11 +14682,12 @@ var Semaphore = class {
     if (signal.aborted) return Promise.reject(new KernelError("EINTR"));
     return new Promise((resolve2, reject) => {
       const deadline = timeoutMs < 0 ? Number.POSITIVE_INFINITY : performance.now() + timeoutMs;
-      let timer;
+      let cancel = () => {
+      };
       const leave = () => {
         const at = this.waiters.indexOf(waiter);
         if (at >= 0) this.waiters.splice(at, 1);
-        clearTimeout(timer);
+        cancel();
         signal.removeEventListener("abort", abort);
       };
       const waiter = {
@@ -14671,18 +14701,13 @@ var Semaphore = class {
         reject(new KernelError("EINTR"));
       };
       const expire = () => {
-        const left = deadline - performance.now();
-        if (left > 0) {
-          timer = setTimeout(expire, Math.min(left, TIMER_MAX_MS));
-          return;
-        }
         leave();
         resolve2(false);
       };
       this.waiters.push(waiter);
       signal.addEventListener("abort", abort, { once: true });
       if (deadline !== Number.POSITIVE_INFINITY) {
-        timer = setTimeout(expire, Math.min(timeoutMs, TIMER_MAX_MS));
+        cancel = timerAt(deadline, expire);
       }
     });
   }
@@ -14717,6 +14742,10 @@ var SemTable = class {
 var SemHandles = class _SemHandles {
   byHandle = /* @__PURE__ */ new Map();
   next = 1;
+  limit;
+  constructor(limit = SEM_HANDLES_MAX) {
+    this.limit = limit;
+  }
   add(sem) {
     for (const [handle2, entry] of this.byHandle) {
       if (entry.sem === sem) {
@@ -14724,7 +14753,7 @@ var SemHandles = class _SemHandles {
         return handle2;
       }
     }
-    if (this.byHandle.size >= SEM_HANDLES_MAX) throw new KernelError("EMFILE");
+    if (this.byHandle.size >= this.limit) throw new KernelError("EMFILE");
     const handle = this.next++;
     this.byHandle.set(handle, { sem, opens: 1 });
     return handle;
@@ -14740,7 +14769,7 @@ var SemHandles = class _SemHandles {
     if (--entry.opens === 0) this.byHandle.delete(handle);
   }
   fork() {
-    const child = new _SemHandles();
+    const child = new _SemHandles(this.limit);
     child.next = this.next;
     for (const [handle, entry] of this.byHandle) child.byHandle.set(handle, { ...entry });
     return child;
@@ -17027,17 +17056,12 @@ var WasmProcess = class {
     (req, cancelled) => this.syscall(req, cancelled),
     () => this.options.onAsync?.()
   );
-  alarmEvery;
   setAlarm(sig, first, every, timer) {
     if (!isSignal(sig)) throw new KernelError("EINVAL");
     this.clearAlarm();
     if (first <= 0) return;
     const fire = timer === void 0 ? () => this.options.raise?.(sig) : () => this.timerExpired(timer);
-    this.alarm = setTimeout(() => {
-      this.alarm = void 0;
-      fire();
-      if (every > 0) this.alarmEvery = setInterval(fire, every);
-    }, first);
+    this.alarm = repeating(first, every, fire);
   }
   timerExpired(which) {
     this.options.onTimer?.(which);
@@ -17046,10 +17070,8 @@ var WasmProcess = class {
     blocked2.abort();
   }
   clearAlarm() {
-    clearTimeout(this.alarm);
-    clearInterval(this.alarmEvery);
+    this.alarm?.();
     this.alarm = void 0;
-    this.alarmEvery = void 0;
   }
   async exit() {
     if (this.exited) return;