@ai-ecoverse/slicc-kernel 1.122.3 → 1.123.1

package/README.md

@@ -918,13 +918,22 @@ Every process of the kernel has `/proc/<pid>/` with `cmdline`, `comm`, `stat`, `
 
 The kernel writes `/etc/passwd` and `/etc/group` when it starts (see [Users](#users)). While the root has none of them, or no `/etc/mtab`, reading them gets per-process ones: root is uid 0 and the realm user, uid 1000, is named after `USER`, or `web_user` (Emscripten's default) without one, so it matches `$USER`, with `HOME` as its home, so `id`, `whoami`, `ls -l` and `ps` show names. Nothing is written to OPFS, and a real file there wins.
 
+### How many processes at once
+
+In a browser every process worker of the page shares one renderer. V8 reserves about 8 GiB of address space for each 32-bit wasm memory, whatever its declared maximum, and its sandbox holds about 1 TiB. So a page runs about 125 wasm processes (or programs that own a wasm memory) at once, counting everything in the renderer (#970). Node has no such ceiling, and neither does Linux. The kernel keeps processes inside that ceiling:
+- **The ceiling:** 112 by default in a browser and none in Node. It's the kernel's count of live wasm processes, with the kernel's other wasm memories in the page left outside it. When an instantiation runs out of memory anyway, the kernel learns the real ceiling at that moment (the live count minus one), and that learned value wins over the default.
+- **Admission:** a spawn, fork, exec or `kernel.run` at the ceiling waits for another process to exit. It keeps waiting as long as processes exit or are admitted, and fails with `EAGAIN` only after 10 s with neither. A long `make -j` or `xargs -P` therefore queues, and a pipeline that needs more live processes than the ceiling fails cleanly. bash's own retry on a fork's `EAGAIN` (`fork: retry: Resource temporarily unavailable`) handles the rest.
+- **Close to the ceiling** (within 16 of it), the kernel waits for each new process to finish instantiating before the spawn returns. If it ran out of memory, the kernel starts it again, quietly, once there's room, so the caller sees no failure.
+- **The rare residual case:** a process that fails to instantiate with nobody waiting on it, which happens only when something outside the count fills the renderer. It ends with status 126 and `<program>: cannot allocate memory for a new process (too many processes at once)` on its stderr, never a JS `RangeError`.
+- **`/proc/sys/kernel/slicc_wasm_memories`** reads `<live> <ceiling>` (the ceiling 0 for none).
+
 ### Metadata
 
 OPFS stores names, bytes, sizes and modification times, nothing else. Everything POSIX needs on top of that lives in an IndexedDB sidecar, so it survives reloads and new kernels:
 
 - mode bits (`chmod`; a `chmod` to the mode a file or directory already has writes nothing and leaves its ctime as it was, which saves a sidecar write for every installer that sets the mode a file was made with);
 - access and change times, and a modification time set explicitly with `utime` (it holds until the file is written again: any write or truncate moves it to the time of the write, also in Chrome, whose OPFS doesn't move a file's `lastModified` for writes through a sync access handle, so the kernel records the write's time itself, and it reaches the metadata store up to 100 ms after the write, so a tab closed inside that window keeps the old mtime on disk; the time follows a rename and is dropped with the file); a directory's times move whenever an entry is created, removed or renamed in it, as POSIX asks, and a time set explicitly after such a change keeps winning, also when the change was made in another kernel and its write lands later; an Emscripten program reads a directory's times again after any call that can wait on another process (a pipe or socket read, `wait`, `poll`, a sleep), so a program that waits for a child or a peer to fill a directory sees the new times (rsync's final directory times rely on it), while a walk without waits reads each directory once; `chown`/`fchown` leave the times alone (Emscripten stamps the setattr of a chown with the current time, which isn't taken as an mtime);
-- inode numbers that stay stable across renames;
+- inode numbers that stay stable across renames. A file with no record has an inode derived from its path, and a rename keeps it on the file; the rename leaves a small record at the name it vacated with a fresh inode, so a file, symlink or directory made there later doesn't share the renamed one's ([#954](https://github.com/ai-ecoverse/slicc-kernel/issues/954)). An exclusive create doesn't count that record as a taken name, and the boot reconcile keeps it only while a live record still carries the inode it guards;
 - symbolic links (`symlink`, `readlink`, `lstat`, and following them in paths), which exist only in the sidecar, with their own times: `touch -h`, `lutimes` and `utimensat` with `AT_SYMLINK_NOFOLLOW` set the link's, never the target's. A link's own mode can't be changed, as on Linux: `chmod -h`, `lchmod` and `fchmodat` with `AT_SYMLINK_NOFOLLOW` fail with `EOPNOTSUPP` (which `chmod -h` and `tar` ignore for links) and never follow it, and `open` with `O_PATH | O_NOFOLLOW` gives a descriptor for the link itself.
 
 OPFS stays authoritative: an entry is consulted only for a path that exists in OPFS (symlinks only for paths that don't), so files written straight to OPFS, for example by the BIOS installer or a page, get the defaults: directories `0755`, files `0644`, and files under `node_modules/*/bin/` `0755`. A file deleted through the OPFS API disappears at once; its leftover entry is ignored and removed when the next kernel starts. Changes go to OPFS first and then to the sidecar, so a crash in between at worst loses the metadata of that one change. Each change is a read-modify-write inside one IndexedDB transaction, so two kernels (two tabs) on the same origin don't lose each other's updates.
@@ -1022,6 +1031,7 @@ The tools in `tools/cert-review/`:
 `.github/workflows/cert-review-pr.yml` certifies a pull request before it merges, so `main`, and with it npm's `latest`, only gets certified changes. It reports as the `cert-review` commit status, a required check of `main`'s merge queue. Every same-repo pull request gets one (`not behaviour`, `waits for merge-ok`, the review's verdict, or the self-guard's hold). **A pull request from a fork gets none**, because fork code never reaches the pools or the key, so it can't enter the queue: only Lars merges one, after reading it.
 
 - **Which pull requests:** those that change shipped behaviour, by a conservative path filter (`behaviourFiles` in `lib.mjs`): `src/`, `build.mjs`, `package.json` and its lock, `tsconfig*.json`, `.releaserc*`, `tools/release-recover.mjs`, the workflows that build or publish (`release.yml`, `ci.yml`), and the reviewer's own code (`tools/cert-review/`, `cert-review*.yml`, `.github/runner.mjs`). **Main's code decides:** every job checks out the pull request's base and fetches only the trees under test, so the path filter, pack, suite, findings, the instructions and record all run from `main`. The merge group's lookup loads its tools from the protected branch itself (`merge_group.base_ref`), not from the group's `base_sha`, which can be the speculative commit of the group ahead and carry the reviewer changes of the pull requests queued before it; `base_sha` is only the lookup's input. A pull request that changes the reviewer is reviewed by `main`'s reviewer. The workflow file of a `pull_request` run still comes from the pull request, so a change to the reviewer is held by the **certification self-guard**, the shared composite action `slicc-shared-web/.github/actions/cert-self-guard` at a pinned sha. Its light `self-guard` job runs on every pull request event and every merge group. When the diff touches the reviewer (`.github/workflows/cert*.yml`, `tools/cert-review/**`, `.github/runner.mjs` and the guard's own paths), `cert-review` is red with `reviewer change: needs coordinator review (cert-review-approved on this head)` and no review runs. The label is the Kernel Coordinator's alone: they add `cert-review-approved` after reading the change, and the review then starts with `merge-ok`. The approval is bound to the head's arrival on GitHub, and a push removes the label. A merge group that holds an unapproved reviewer change is red too. If the guard doesn't finish, the status is an error that asks to re-run the failed jobs. **The residual:** the pull request's YAML still decides what runs, so the guard catches an accidental edit, not a deliberate rewrite of this workflow. The pull request that adds this workflow can't pass its own check, because its base has no tools yet. Any other pull request gets a green status that says `not behaviour: <files>`, so the skip is recorded.
+- **A gate's silence never reads as a pass:** every tool a workflow gates on (`pr.mjs plan`, `same` and `lookup`, `same.mjs`, `pack.mjs`, `delta.mjs`, `suite.mjs`, `compat.mjs`, `findings.mjs`, `record.mjs`, `verify.mjs`) ends with one verdict line, `<tool>: PASS <what>` or `<tool>: FAIL <why>`, from the shared `verdict()` in `lib.mjs`. `tools/cert-review/gate.sh [--either|--evidence] <tool> <command>` runs a tool, passes its output through, and exits 70 with an error when the tool's last line starting `<tool>: ` isn't a PASS or FAIL verdict, so a tool replaced by `true`, an early exit 0 or an empty run fails its step. By default the step passes only on PASS with exit 0; a PASS with a non-zero exit, or a FAIL with exit 0, fails it. `--either` keeps the tool's own exit, for tools whose FAIL is evidence that record judges later (suite, compat). `--evidence` needs only the verdict, for the NEGATIVE run on main's tree, which is expected to fail. `suite: PASS` means exit 0, no failures and every expected file has results; `compat: PASS` means a run turned up with no regressions. `prompt.mjs` writes the review prompt to stdout, which goes into a step output, so it prints no verdict; a missing prompt leaves the review without `verdict.json`, and record marks that INCOMPLETE. Because the workflow of a pull request runs main's tools, the tools gain their verdicts first, and the workflows call them through `gate.sh` in the pull request after that.
 - **Decide by what ships:** when a pull request's behaviour files are only `package.json` and/or `package-lock.json` (a Renovate devDependency bump, say), both sides are packed as usual, and then the `same dist` job (`same.mjs`, in code) compares the two tarballs before anything else runs. It checks the same paths, entry types (a symlink isn't a file) and modes. `package.json` must be equal once `devDependencies`, `version` and `gitHead` are removed, so `scripts` (they ship, a consumer's install runs `postinstall`, and `prepack`/`prepublishOnly` can make the published build differ from the packed one), runtime dependencies, `exports`, `bin`, `files` and `engines` must all match. Every other file must be byte-identical once each side's **exact** version string (build.mjs bakes it into `dist`) is replaced by one placeholder. A version string in one more place, or any looser match, is a difference. Source maps are compared as JSON without their `mappings`, whose columns the longer or shorter version string shifts; the code itself is compared byte for byte. If all of that matches, `cert-review` is green with `not behaviour (identical dist): <candidate sha256> = <base sha256> after normalising <v1>/<v2>`, and the suites, kernel-compat, the review and the record are skipped. `same.json` (uploaded as an artifact) names the rule and both tarballs' full sha256. Any difference, or a `same dist` job that doesn't finish, means the full review. The kernel has no runtime `dependencies`, since esbuild bundles everything into `dist`, so a devDependency that changes the product shows up as a byte difference. A test-only devDependency is checked by `ci / test`, on the pull request and on the merge group.
 - **When:** only for a same-repo pull request with `merge-ok`, when the label is added and on every push while it is set. Each pull request has its own concurrency group, and a newer push cancels the older review. A behaviour change without `merge-ok` gets a red status, `waits for merge-ok to be reviewed`. Other labels don't start or cancel anything. Fork code never reaches the pools or the key.
 - **What:** the checkout is the event's default `refs/pull/N/merge`, the pull request merged onto `main` at review time, so a review is of what would land, without pushing to the branch. Both sides are packed in the same run, on a GitHub-hosted runner, with no secrets: the candidate (the merge ref, `x.y.z-pr.N.<run>`) and the base (its first parent, `main`). Then:

package/dist/kernel-worker.js

@@ -107,7 +107,7 @@ var MemoryMeta = class {
     if (entry) this.entries.set(path, entry);
     else this.entries.delete(path);
   }
-  async move(from, to, root) {
+  async move(from, to, root, left) {
     await this.remove([to]);
     const carried = this.entries.subtree(from).map((path) => this.entries.get(path));
     for (const entry of carried) this.entries.delete(entry.path);
@@ -116,6 +116,7 @@ var MemoryMeta = class {
       if (path !== to) this.entries.set(path, moved(entry, path));
     }
     this.entries.set(to, moved(root(carried.find((entry) => entry.path === from)), to));
+    if (left) this.entries.set(from, left);
   }
   async remove(paths) {
     for (const path of paths) this.entries.deleteTree(path);
@@ -240,7 +241,7 @@ var IndexedDbMeta = class {
     this.channel.close();
     this.db.close();
   }
-  async move(from, to, root) {
+  async move(from, to, root, left) {
     this.settleRemoves();
     const [transaction, store] = this.transaction("readwrite");
     store.delete(to);
@@ -254,6 +255,7 @@ var IndexedDbMeta = class {
         store.put(moved(entry, to + entry.path.slice(from.length)));
       }
       store.put(moved(root(source.result), to));
+      if (left) store.put(left);
     };
     await settle(transaction, () => void 0);
     this.changed({ trees: [from, to] });
@@ -1104,6 +1106,14 @@ function sidecar(meta) {
     });
   return ops;
 }
+function occupied(entry) {
+  if (!entry?.vacated) return entry ?? {};
+  const { vacated: _, ...kept } = entry;
+  return kept;
+}
+function vacatedAt(path) {
+  return { path, ino: inodeOf(`${path}\0${crypto.randomUUID()}`), vacated: true };
+}
 function missing2(err) {
   const code = err?.code;
   return code === "ENOENT" || code === "ENOTDIR";
@@ -1338,7 +1348,7 @@ var OpfsFs = class {
     const kind = directory ? void 0 : owner?.socket ? "socket" : owner?.fifo ? "fifo" : void 0;
     const unique = kind === "fifo" ? { ino: inodeOf(`${path}\0${crypto.randomUUID()}`) } : {};
     const fields = kind ? { ...owned4, ...unique, [kind]: true } : owned4;
-    if (fields) await this.meta.update(path, (entry) => ({ ...entry, path, ...fields }));
+    if (fields) await this.meta.update(path, (entry) => ({ ...occupied(entry), path, ...fields }));
   }
   guarded = [];
   protect(prefixes2, versions = false) {
@@ -2050,8 +2060,9 @@ var OpfsFs = class {
     await this.locked(physical, async () => {
       if (await this.handleExists(dir, name2)) throw fsError("EEXIST", path);
       const freshMeta = this.meta.fresh ? await this.meta.fresh([path]) : await this.meta.get([path]);
-      if (freshMeta[0]?.link !== void 0) throw fsError("EEXIST", path);
-      if (freshMeta[0] !== void 0) await this.meta.remove([path]);
+      const found = freshMeta[0];
+      if (found?.link !== void 0) throw fsError("EEXIST", path);
+      if (found !== void 0 && !found.vacated) await this.meta.remove([path]);
       this.forget(physical);
       this.refuse(physical);
       await dir.getDirectoryHandle(name2, { create: true });
@@ -2071,8 +2082,9 @@ var OpfsFs = class {
     await this.locked(physical, async () => {
       if (await this.handleExists(dir, name2)) throw fsError("EEXIST", path);
       const freshMeta = this.meta.fresh ? await this.meta.fresh([path]) : await this.meta.get([path]);
-      if (freshMeta[0]?.link !== void 0) throw fsError("EEXIST", path);
-      if (freshMeta[0] !== void 0) await this.meta.remove([path]);
+      const found = freshMeta[0];
+      if (found?.link !== void 0) throw fsError("EEXIST", path);
+      if (found !== void 0 && !found.vacated) await this.meta.remove([path]);
       this.forget(physical);
       this.refuse(physical);
       await dir.getFileHandle(name2, { create: true });
@@ -2176,14 +2188,15 @@ var OpfsFs = class {
     const moving = await this.movedOwner(source);
     const carry = (entry) => ({
       ino: inodeOf(source.path),
-      ...entry,
+      ...occupied(entry),
       ...moving,
       path: destination,
       ctimeMs: now
     });
+    const left = vacatedAt(source.path);
     if (source.link) {
       if (target?.handle) await this.rm(destination);
-      await this.meta.move(source.path, destination, carry);
+      await this.meta.move(source.path, destination, carry, left);
       this.touch(Date.now(), parentOf3(source.path), parent.path);
       return;
     }
@@ -2198,9 +2211,12 @@ var OpfsFs = class {
       () => this.place(source.handle, dir, staging)
     );
     if (swap) await this.rm(destination, { recursive: true });
-    await this.meta.move(source.path, destination, carry);
+    await this.meta.move(source.path, destination, carry, left);
     this.movePending(source.path, destination);
-    if (!moved2) await this.rm(source.path, { recursive: true });
+    if (!moved2) {
+      await this.rm(source.path, { recursive: true });
+      await this.meta.update(source.path, () => left);
+    }
     let copied = !moved2;
     if (swap) {
       const staged = await dir.getDirectoryHandle(staging);
@@ -2285,11 +2301,11 @@ var OpfsFs = class {
     const fields = await this.newFields(at, owner && { uid: owner.uid, gid: owner.gid }, false);
     await this.entering(
       at,
-      () => this.meta.update(at, () => ({
+      () => this.meta.update(at, (entry) => ({
         path: at,
         link: target,
         dir: parent.path,
-        ino: inodeOf(at),
+        ino: entry?.vacated && entry.ino !== void 0 ? entry.ino : inodeOf(at),
         mtimeMs: now,
         ctimeMs: now,
         ...fields
@@ -2357,7 +2373,10 @@ var OpfsFs = class {
   }
   async reconcile() {
     let removed = 0;
-    for (const entry of await this.meta.all()) {
+    const entries = await this.meta.all();
+    const carried = new Set(entries.filter((e) => !e.vacated).map((e) => e.ino));
+    for (const entry of entries) {
+      if (entry.vacated && carried.has(inodeOf(entry.path))) continue;
       const real = await this.real(entry.path);
       const stale = entry.link === void 0 ? !real : real || !await this.real(parentOf3(entry.path));
       if (!stale) continue;
@@ -6408,7 +6427,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.122.3" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.123.1" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -12551,17 +12570,28 @@ var FALLBACK_MEMORY = 4 * KIB * KIB * KIB;
 var PID_FILES = ["cmdline", "comm", "stat", "statm", "status"];
 var SYSTEM_FILES = ["loadavg", "meminfo", "stat", "uptime", "version"];
 var SYS_TREE = {
-  kernel: { osrelease: `${OS_RELEASE}
-`, ostype: "Linux\n" }
+  kernel: {
+    osrelease: `${OS_RELEASE}
+`,
+    ostype: "Linux\n",
+    slicc_wasm_memories: (listing) => `${listing.wasm?.live ?? 0} ${listing.wasm?.ceiling ?? 0}
+`
+  }
 };
+function isSysFile(at) {
+  return typeof at === "string" || typeof at === "function";
+}
 function sysEntry(parts2) {
   let at = SYS_TREE;
   for (const part of parts2) {
-    if (typeof at !== "object" || !Object.hasOwn(at, part)) return void 0;
+    if (isSysFile(at) || !Object.hasOwn(at, part)) return void 0;
     at = at[part];
   }
   return at;
 }
+function sysText(file, listing) {
+  return typeof file === "string" ? file : file(listing());
+}
 function commOf(info) {
   const name2 = info.argv[0] ?? "";
   return name2.slice(name2.lastIndexOf("/") + 1).slice(0, 15);
@@ -12797,7 +12827,9 @@ var ProcTree = class {
     }
     if (top === "sys") {
       const entry = sysEntry(parts2.slice(1));
-      if (typeof entry === "string") return { kind: "file", content: () => entry };
+      if (typeof entry === "string" || typeof entry === "function") {
+        return { kind: "file", content: () => sysText(entry, () => this.listing()) };
+      }
       return entry && { kind: "dir", names: () => Object.keys(entry) };
     }
     if (top === "self") {
@@ -19254,6 +19286,7 @@ var WasmProcess = class {
 var WASM_PROCESS_INIT = "wasm-process-init";
 var WASM_PROCESS_EXIT = "wasm-process-exit";
 var WASM_PROCESS_ERROR = "wasm-process-error";
+var WASM_PROCESS_READY = "wasm-process-ready";
 var WASM_THREAD_SPAWN = "wasm-thread-spawn";
 var WASM_THREAD_INIT = "wasm-thread-init";
 var WASM_THREAD_EXIT = "wasm-thread-exit";
@@ -19261,6 +19294,8 @@ var WASM_MAX_THREADS = 256;
 
 // src/kernel/host.ts
 var CRASHED = 70;
+var NO_MEMORY = 126;
+var WASM_OOM = /Cannot allocate Wasm memory|WebAssembly\.Memory\(\): could not allocate memory/;
 var KILL_GRACE_MS = 2e3;
 var KILL_HARD_MS = 5e3;
 var descIds = /* @__PURE__ */ new WeakMap();
@@ -19526,7 +19561,22 @@ function threadInit(opts, program, sab, cred, thread, main) {
 function settleExit(exit, settle3, code) {
   void exit.catch(() => void 0).then(() => settle3(code & 255));
 }
+function readiness(abi) {
+  const ready2 = Promise.withResolvers();
+  if (abi === "js") ready2.resolve(true);
+  return ready2;
+}
+function outOfMemory(opts, data) {
+  if (data?.type !== WASM_PROCESS_ERROR || !WASM_OOM.test(String(data.message))) return false;
+  if (!opts.onOom?.()) {
+    opts.onError?.(
+      `${opts.argv0}: cannot allocate memory for a new process (too many processes at once)`
+    );
+  }
+  return true;
+}
 function spawnWasmProcess(opts) {
+  const { promise: ready2, resolve: started } = readiness(opts.program.abi);
   const sab = new SharedArrayBuffer(SAB_HEADER_BYTES + SAB_DEFAULT_WINDOW_BYTES);
   const header3 = new Int32Array(sab, 0, SAB_HEADER_I32);
   const blocked2 = opts.fork?.wasi?.blocked ?? opts.blocked;
@@ -19579,6 +19629,7 @@ function spawnWasmProcess(opts) {
   const finish = (code, sig) => {
     if (done4) return;
     done4 = true;
+    started(true);
     clocks.freeze();
     dying.clear();
     endedBy = sig ?? process.execTermsig;
@@ -19596,7 +19647,12 @@ function spawnWasmProcess(opts) {
     queueMicrotask(() => finish(...dying.status(code)));
   };
   const handle = (data) => {
-    if (data?.type === WASM_PROCESS_EXIT) {
+    if (data?.type === WASM_PROCESS_READY) {
+      started(true);
+    } else if (outOfMemory(opts, data)) {
+      started(false);
+      finish(NO_MEMORY);
+    } else if (data?.type === WASM_PROCESS_EXIT) {
       finish(...dying.status(data.code));
     } else if (data?.type === WASM_PROCESS_ERROR) {
       if (!dying.ending) opts.onError?.(String(data.message));
@@ -19670,6 +19726,7 @@ function spawnWasmProcess(opts) {
   return {
     pid: opts.pid,
     exited,
+    ready: ready2,
     kill,
     signal,
     termsig: () => endedBy,
@@ -21264,6 +21321,63 @@ var SettlingChildren = class {
   }
 };
 
+// src/kernel/wasm-memories.ts
+var DEFAULT_CEILING = 112;
+var IDLE_MS = 1e4;
+var MARGIN = 16;
+var WasmMemories = class {
+  live = 0;
+  ceiling;
+  waiters = /* @__PURE__ */ new Set();
+  idleMs;
+  constructor(ceiling, idleMs = IDLE_MS) {
+    this.ceiling = ceiling;
+    this.idleMs = idleMs;
+  }
+  count() {
+    return { live: this.live, ceiling: this.ceiling ?? 0 };
+  }
+  ended() {
+    this.live = Math.max(0, this.live - 1);
+    this.progress();
+  }
+  learn() {
+    this.ceiling = Math.max(1, this.live - 1);
+  }
+  near() {
+    return this.ceiling !== void 0 && this.live + MARGIN >= this.ceiling;
+  }
+  async admit() {
+    while (this.ceiling !== void 0 && this.live >= this.ceiling) {
+      if (!await this.changed()) throw new SpawnError("EAGAIN");
+    }
+    this.live += 1;
+    this.progress();
+  }
+  progress() {
+    const waiters = [...this.waiters];
+    this.waiters.clear();
+    for (const wake of waiters) wake();
+  }
+  changed() {
+    return new Promise((resolve2) => {
+      const wake = () => {
+        clearTimeout(timer);
+        resolve2(true);
+      };
+      const timer = setTimeout(() => {
+        this.waiters.delete(wake);
+        resolve2(false);
+      }, this.idleMs);
+      this.waiters.add(wake);
+    });
+  }
+};
+function defaultCeiling() {
+  const node = globalThis.process?.versions?.node;
+  return node === void 0 ? DEFAULT_CEILING : void 0;
+}
+
 // src/mount/driver.ts
 function ownerOf2(req) {
   const owner = {
@@ -23461,6 +23575,9 @@ function withScriptEnv(target, command) {
     ]
   };
 }
+function memoriesOf(given) {
+  return new WasmMemories(given?.ceiling ?? defaultCeiling(), given?.idleMs);
+}
 function childHandle(handle) {
   return {
     pid: handle.pid,
@@ -23532,6 +23649,7 @@ var Launcher = class {
   jobs = new JobTable();
   locks;
   fifos = new FifoTable();
+  memories;
   sems = new SemTable();
   settling = new SettlingChildren((pid) => this.jobs.pgidOf(pid));
   ptys = new PtyTable(
@@ -23585,6 +23703,7 @@ var Launcher = class {
   terminals = 0;
   constructor(options) {
     this.usersMode = usersMode(options.users);
+    this.memories = memoriesOf(options.wasmMemories);
     this.rootFs = options.fs;
     const peers = options.fs.peers?.();
     this.locks = kernelLocks(options.fs.rootName, peers);
@@ -24415,7 +24534,11 @@ var Launcher = class {
     }
     const done4 = this.heldUrl(program);
     try {
-      const handle = this.start({ ...req, cwd, program, argv0: target.argv0, args, env });
+      const handle = await this.admitted(
+        program.abi !== "js",
+        req.fds,
+        (fds, quietOom) => this.start({ ...req, fds, quietOom, cwd, program, argv0: target.argv0, args, env })
+      );
       void handle.exited.finally(done4);
       return handle;
     } catch (err) {
@@ -24459,6 +24582,39 @@ var Launcher = class {
     if (req.tag !== void 0) this.tags.set(pid, req.tag);
     if (req.links !== void 0) this.links.set(pid, req.links);
   }
+  async admitted(wasm, fds, start2) {
+    if (!wasm) return start2(fds);
+    for (; ; ) {
+      await this.memories.admit().catch(async (err) => {
+        await fds.closeAll();
+        throw err;
+      });
+      const counted2 = (handle2) => {
+        void handle2.exited.finally(() => this.memories.ended());
+        return handle2;
+      };
+      if (!this.memories.near()) {
+        try {
+          return counted2(start2(fds));
+        } catch (err) {
+          this.memories.ended();
+          throw err;
+        }
+      }
+      const forked = fds.fork();
+      const handle = await Promise.resolve().then(() => counted2(start2(forked, true))).catch(async (err) => {
+        this.memories.ended();
+        await forked.closeAll();
+        throw err;
+      });
+      const fit = await (handle.ready ?? true);
+      if (fit) {
+        await fds.closeAll();
+        return handle;
+      }
+      await handle.exited;
+    }
+  }
   start(req) {
     this.sampling();
     if (req.pgid !== void 0 && this.jobs.sessionOf(req.pgid) === void 0) {
@@ -24509,6 +24665,10 @@ var Launcher = class {
       ...this.prefixes.length > 0 && !stack.writer ? { readonlyAt: (path) => isProtected(this.prefixes, path) } : {},
       createWorker: this.createWorker,
       onError: req.report,
+      onOom: () => {
+        this.memories.learn();
+        return req.quietOom === true;
+      },
       spawner: this.spawner(pid, req.report),
       forker: this.forker(pid, req),
       kill: (target, sig, info) => this.kill(target, sig, this.credOf(pid), pid, info),
@@ -24517,7 +24677,8 @@ var Launcher = class {
         boot: this.boot,
         processes: this.list(this.credOf(pid)),
         load: this.loadAverage(),
-        cpu: this.cpuTotal()
+        cpu: this.cpuTotal(),
+        wasm: this.memories.count()
       }),
       sudo: (call, signal) => this.sudo(pid, call, signal),
       crontab: (call) => this.crontab(pid, call),
@@ -24854,9 +25015,10 @@ var Launcher = class {
   }
   forker(ppid, parent) {
     const { exec: _exec, pgid: _pgid, group: _group, pid: _pid, scrub: _scrub, ...image } = parent;
-    return async (state, fds) => childHandle(
-      this.start({
+    return async (state, given) => {
+      const fresh2 = (fds, quietOom) => this.start({
         ...image,
+        quietOom,
         cwd: state.cwd ?? parent.cwd,
         fds,
         ppid,
@@ -24867,8 +25029,9 @@ var Launcher = class {
         cred: this.credOf(ppid),
         tag: this.tagOf(ppid),
         links: this.links.get(ppid)
-      })
-    );
+      });
+      return childHandle(await this.admitted(parent.program.abi !== "js", given, fresh2));
+    };
   }
   keySignal(tty, fallback, sig, send) {
     const pgid = this.jobs.tcgetpgrp(tty, fallback);