@aztec/simulator 6.0.0-nightly.20260809 → 6.0.0-nightly.20260812

package/dest/public/avm_simulator_pool.d.ts

@@ -8,13 +8,47 @@ export interface AvmSimulatorPoolOptions {
     wsdbIpcPath: string;
     /** Optional logger function for AVM process output. */
     logger?: (msg: string) => void;
+    /**
+     * Flat delay between environmental spawn failures (default 1s). No backoff: sequencers live on
+     * ~6s slots, so sleeping longer than this after a failure costs whole blocks while the machine may
+     * have recovered — and a spawn attempt is cheap. Spawning never gives up on its own; the caller's
+     * deadline (abort signal) is the bound.
+     */
+    spawnRetryIntervalMs?: number;
+    /** Process spawner override. Test hook; defaults to spawning a real bb-avm-sim via the generated AvmService. */
+    spawnProcess?: (options: AvmProcessSpawnOptions) => Promise<AvmProcessHandle>;
+}
+/** Options handed to the process spawner for each new pool slot. */
+export interface AvmProcessSpawnOptions {
+    binaryPath?: string;
+    wsdbIpcPath: string;
+    cdbIpcPath: string;
+    logger?: (msg: string) => void;
+}
+/**
+ * A handle to a single bb-avm-sim service: it runs serialized simulations and connects back to the
+ * shared CDB/WSDB servers for state, but is unaware of which fork's contract data it is reading — that is
+ * routed by the fork id baked into the input buffer. The underlying service owns its process lifecycle
+ * (including respawn-on-death), so a handle stays usable for the life of the pool.
+ */
+export interface AvmProcessHandle {
+    simulate(inputBuffer: Uint8Array, signal?: AbortSignal): Promise<Uint8Array>;
+    simulateWithHints(inputBuffer: Uint8Array): Promise<Uint8Array>;
+    destroy(): Promise<void>;
 }
 /**
- * The public-execution AVM backend: a lazily-grown pool of bb-avm-sim processes plus the CDB server that
+ * The public-execution AVM backend: a lazily-grown pool of bb-avm-sim services plus the CDB server that
  * answers those processes' contract-data callbacks. Callers hold this as an {@link AvmSimulator}; the pool,
  * the CDB server, its IPC path, and fork-id routing are all hidden behind that interface. Each `simulate`
  * registers the call's contracts DB on the CDB server for the duration of the simulation (keyed by fork id
  * so concurrent simulations on different forks don't collide) and unregisters it once the call returns.
+ *
+ * Process lifecycle is invisible to callers, exactly as when the simulator ran in-process: a simulation
+ * either produces a result, fails on its own merits, or runs until the caller's deadline aborts it.
+ * Environmental trouble is absorbed here — spawn failures retry indefinitely on a backoff ladder (bounded
+ * only by the caller's abort signal), and a simulation whose process dies is re-issued on the respawned
+ * process. The one deliberate exception: an input that kills the process twice is treated as a failing
+ * transaction, so a simulator-crashing tx gets evicted instead of burning a process per block forever.
  */
 export declare class AvmSimulatorPool implements AvmSimulator {
     private options;
@@ -22,24 +56,29 @@ export declare class AvmSimulatorPool implements AvmSimulator {
     private available;
     private waiters;
     private createdCount;
+    private destroyed;
     private log;
     private maxSize;
     private cdbServer;
+    private readonly spawnRetryIntervalMs;
+    private readonly spawnProcess;
     constructor(options: AvmSimulatorPoolOptions);
     static spawn(options: AvmSimulatorPoolOptions): Promise<AvmSimulatorPool>;
     [Symbol.asyncDispose](): Promise<void>;
     simulate(inputBuffer: Uint8Array, context: AvmContractsDBContext, signal?: AbortSignal): Promise<Uint8Array>;
     simulateWithHints(inputBuffer: Uint8Array): Promise<Uint8Array>;
-    /** Destroy all AVM processes in the pool and close the CDB server. */
+    /** Destroy all AVM services in the pool and close the CDB server. */
     destroy(): Promise<void>;
     /**
      * Eagerly spawn up to `count` AVM processes (capped at maxSize) and leave them available, so the
      * first simulate() doesn't pay process spawn/connect cost. Idempotent.
      */
     prewarm(count?: number): Promise<void>;
+    private runOnPool;
     private checkout;
-    /** Return an AVM process to the pool after use. */
+    /** Return an AVM service to the pool after use. */
     private return;
     private createSlot;
+    private spawnUntilUp;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXZtX3NpbXVsYXRvcl9wb29sLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvcHVibGljL2F2bV9zaW11bGF0b3JfcG9vbC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFHQSxPQUFPLEtBQUssRUFBRSxxQkFBcUIsRUFBRSxZQUFZLEVBQUUsTUFBTSxvQkFBb0IsQ0FBQztBQUc5RSxNQUFNLFdBQVcsdUJBQXVCO0lBQ3RDLHVIQUF1SDtJQUN2SCxPQUFPLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDakIsb0ZBQW9GO0lBQ3BGLGFBQWEsQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUN2QiwyQ0FBMkM7SUFDM0MsV0FBVyxFQUFFLE1BQU0sQ0FBQztJQUNwQix1REFBdUQ7SUFDdkQsTUFBTSxDQUFDLEVBQUUsQ0FBQyxHQUFHLEVBQUUsTUFBTSxLQUFLLElBQUksQ0FBQztDQUNoQztBQWFEOzs7Ozs7R0FNRztBQUNILHFCQUFhLGdCQUFpQixZQUFXLFlBQVk7SUFTdkMsT0FBTyxDQUFDLE9BQU87SUFSM0IsT0FBTyxDQUFDLEtBQUssQ0FBc0M7SUFDbkQsT0FBTyxDQUFDLFNBQVMsQ0FBZ0I7SUFDakMsT0FBTyxDQUFDLE9BQU8sQ0FBaUc7SUFDaEgsT0FBTyxDQUFDLFlBQVksQ0FBSztJQUN6QixPQUFPLENBQUMsR0FBRyxDQUFTO0lBQ3BCLE9BQU8sQ0FBQyxPQUFPLENBQVM7SUFDeEIsT0FBTyxDQUFDLFNBQVMsQ0FBZTtJQUVoQyxZQUFvQixPQUFPLEVBQUUsdUJBQXVCLEVBSW5EO0lBRUQsT0FBYSxLQUFLLENBQUMsT0FBTyxFQUFFLHVCQUF1QixHQUFHLE9BQU8sQ0FBQyxnQkFBZ0IsQ0FBQyxDQUs5RTtJQUVLLENBQUMsTUFBTSxDQUFDLFlBQVksQ0FBQyxJQUFJLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FFM0M7SUFFSyxRQUFRLENBQUMsV0FBVyxFQUFFLFVBQVUsRUFBRSxPQUFPLEVBQUUscUJBQXFCLEVBQUUsTUFBTSxDQUFDLEVBQUUsV0FBVyxHQUFHLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0Fjakg7SUFFSyxpQkFBaUIsQ0FBQyxXQUFXLEVBQUUsVUFBVSxHQUFHLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FRcEU7SUFFRCxzRUFBc0U7SUFDaEUsT0FBTyxJQUFJLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FtQjdCO0lBRUQ7OztPQUdHO0lBQ0csT0FBTyxDQUFDLEtBQUssU0FBSSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FVdEM7WUFHYSxRQUFRO0lBZXRCLG1EQUFtRDtJQUNuRCxPQUFPLENBQUMsTUFBTTtZQVlBLFVBQVU7Q0E4QnpCIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXZtX3NpbXVsYXRvcl9wb29sLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvcHVibGljL2F2bV9zaW11bGF0b3JfcG9vbC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFLQSxPQUFPLEtBQUssRUFBRSxxQkFBcUIsRUFBRSxZQUFZLEVBQUUsTUFBTSxvQkFBb0IsQ0FBQztBQUc5RSxNQUFNLFdBQVcsdUJBQXVCO0lBQ3RDLHVIQUF1SDtJQUN2SCxPQUFPLENBQUMsRUFBRSxNQUFNLENBQUM7SUFDakIsb0ZBQW9GO0lBQ3BGLGFBQWEsQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUN2QiwyQ0FBMkM7SUFDM0MsV0FBVyxFQUFFLE1BQU0sQ0FBQztJQUNwQix1REFBdUQ7SUFDdkQsTUFBTSxDQUFDLEVBQUUsQ0FBQyxHQUFHLEVBQUUsTUFBTSxLQUFLLElBQUksQ0FBQztJQUMvQjs7Ozs7T0FLRztJQUNILG9CQUFvQixDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQzlCLGdIQUFnSDtJQUNoSCxZQUFZLENBQUMsRUFBRSxDQUFDLE9BQU8sRUFBRSxzQkFBc0IsS0FBSyxPQUFPLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztDQUMvRTtBQUVELG9FQUFvRTtBQUNwRSxNQUFNLFdBQVcsc0JBQXNCO0lBQ3JDLFVBQVUsQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUNwQixXQUFXLEVBQUUsTUFBTSxDQUFDO0lBQ3BCLFVBQVUsRUFBRSxNQUFNLENBQUM7SUFDbkIsTUFBTSxDQUFDLEVBQUUsQ0FBQyxHQUFHLEVBQUUsTUFBTSxLQUFLLElBQUksQ0FBQztDQUNoQztBQUVEOzs7OztHQUtHO0FBQ0gsTUFBTSxXQUFXLGdCQUFnQjtJQUMvQixRQUFRLENBQUMsV0FBVyxFQUFFLFVBQVUsRUFBRSxNQUFNLENBQUMsRUFBRSxXQUFXLEdBQUcsT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzdFLGlCQUFpQixDQUFDLFdBQVcsRUFBRSxVQUFVLEdBQUcsT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ2hFLE9BQU8sSUFBSSxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUM7Q0FDMUI7QUFpQ0Q7Ozs7Ozs7Ozs7Ozs7R0FhRztBQUNILHFCQUFhLGdCQUFpQixZQUFXLFlBQVk7SUFZdkMsT0FBTyxDQUFDLE9BQU87SUFYM0IsT0FBTyxDQUFDLEtBQUssQ0FBMEI7SUFDdkMsT0FBTyxDQUFDLFNBQVMsQ0FBZ0I7SUFDakMsT0FBTyxDQUFDLE9BQU8sQ0FBaUc7SUFDaEgsT0FBTyxDQUFDLFlBQVksQ0FBSztJQUN6QixPQUFPLENBQUMsU0FBUyxDQUFTO0lBQzFCLE9BQU8sQ0FBQyxHQUFHLENBQVM7SUFDcEIsT0FBTyxDQUFDLE9BQU8sQ0FBUztJQUN4QixPQUFPLENBQUMsU0FBUyxDQUFlO0lBQ2hDLE9BQU8sQ0FBQyxRQUFRLENBQUMsb0JBQW9CLENBQVM7SUFDOUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQWlFO0lBRTlGLFlBQW9CLE9BQU8sRUFBRSx1QkFBdUIsRUFNbkQ7SUFFRCxPQUFhLEtBQUssQ0FBQyxPQUFPLEVBQUUsdUJBQXVCLEdBQUcsT0FBTyxDQUFDLGdCQUFnQixDQUFDLENBTTlFO0lBRUssQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUFDLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxDQUUzQztJQUVLLFFBQVEsQ0FBQyxXQUFXLEVBQUUsVUFBVSxFQUFFLE9BQU8sRUFBRSxxQkFBcUIsRUFBRSxNQUFNLENBQUMsRUFBRSxXQUFXLEdBQUcsT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQVNqSDtJQUVLLGlCQUFpQixDQUFDLFdBQVcsRUFBRSxVQUFVLEdBQUcsT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQUdwRTtJQUVELHFFQUFxRTtJQUMvRCxPQUFPLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxDQWE3QjtJQUVEOzs7T0FHRztJQUNHLE9BQU8sQ0FBQyxLQUFLLFNBQUksR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLENBVXRDO1lBUWEsU0FBUztZQXdCVCxRQUFRO0lBcUN0QixtREFBbUQ7SUFDbkQsT0FBTyxDQUFDLE1BQU07WUFZQSxVQUFVO1lBeUJWLFlBQVk7Q0EyQjNCIn0=

package/dest/public/avm_simulator_pool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"avm_simulator_pool.d.ts","sourceRoot":"","sources":["../../src/public/avm_simulator_pool.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG9E,MAAM,WAAW,uBAAuB;IACtC,uHAAuH;IACvH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oFAAoF;IACpF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2CAA2C;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAaD;;;;;;GAMG;AACH,qBAAa,gBAAiB,YAAW,YAAY;IASvC,OAAO,CAAC,OAAO;IAR3B,OAAO,CAAC,KAAK,CAAsC;IACnD,OAAO,CAAC,SAAS,CAAgB;IACjC,OAAO,CAAC,OAAO,CAAiG;IAChH,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,GAAG,CAAS;IACpB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,SAAS,CAAe;IAEhC,YAAoB,OAAO,EAAE,uBAAuB,EAInD;IAED,OAAa,KAAK,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAK9E;IAEK,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAE3C;IAEK,QAAQ,CAAC,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAcjH;IAEK,iBAAiB,CAAC,WAAW,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAQpE;IAED,sEAAsE;IAChE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAmB7B;IAED;;;OAGG;IACG,OAAO,CAAC,KAAK,SAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAUtC;YAGa,QAAQ;IAetB,mDAAmD;IACnD,OAAO,CAAC,MAAM;YAYA,UAAU;CA8BzB"}
+{"version":3,"file":"avm_simulator_pool.d.ts","sourceRoot":"","sources":["../../src/public/avm_simulator_pool.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG9E,MAAM,WAAW,uBAAuB;IACtC,uHAAuH;IACvH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oFAAoF;IACpF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2CAA2C;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,gHAAgH;IAChH,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,sBAAsB,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAC/E;AAED,oEAAoE;AACpE,MAAM,WAAW,sBAAsB;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC7E,iBAAiB,CAAC,WAAW,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAChE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAiCD;;;;;;;;;;;;;GAaG;AACH,qBAAa,gBAAiB,YAAW,YAAY;IAYvC,OAAO,CAAC,OAAO;IAX3B,OAAO,CAAC,KAAK,CAA0B;IACvC,OAAO,CAAC,SAAS,CAAgB;IACjC,OAAO,CAAC,OAAO,CAAiG;IAChH,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,GAAG,CAAS;IACpB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,SAAS,CAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IAC9C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiE;IAE9F,YAAoB,OAAO,EAAE,uBAAuB,EAMnD;IAED,OAAa,KAAK,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAM9E;IAEK,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAE3C;IAEK,QAAQ,CAAC,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CASjH;IAEK,iBAAiB,CAAC,WAAW,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAGpE;IAED,qEAAqE;IAC/D,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAa7B;IAED;;;OAGG;IACG,OAAO,CAAC,KAAK,SAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAUtC;YAQa,SAAS;YAwBT,QAAQ;IAqCtB,mDAAmD;IACnD,OAAO,CAAC,MAAM;YAYA,UAAU;YAyBV,YAAY;CA2B3B"}

package/dest/public/avm_simulator_pool.js

@@ -1,36 +1,83 @@
 var _computedKey;
 import { AvmService } from '@aztec/bb-avm-sim';
+import { AbortError } from '@aztec/foundation/error';
 import { createLogger } from '@aztec/foundation/log';
+import { sleep } from '@aztec/foundation/sleep';
 import { CdbIpcServer } from './cdb_ipc_server.js';
+/**
+ * The generated service flags errors caused by the death of the underlying process (rather than by the
+ * request itself) with `retry: true`. That distinction is interpreted here and goes no further: process
+ * lifecycle is invisible to the pool's callers.
+ */ function isProcessFailure(err) {
+    return err instanceof Error && err.retry === true;
+}
+/** Sleep that wakes early (without throwing) when the signal aborts; callers re-check the signal. */ async function abortableSleep(ms, signal) {
+    if (!signal) {
+        return sleep(ms);
+    }
+    let onAbort;
+    const aborted = new Promise((resolve)=>{
+        onAbort = resolve;
+        signal.addEventListener('abort', onAbort, {
+            once: true
+        });
+    });
+    try {
+        await Promise.race([
+            sleep(ms),
+            aborted
+        ]);
+    } finally{
+        signal.removeEventListener('abort', onAbort);
+    }
+}
+// After a cancellation is requested, how long the C++ process gets to cancel cooperatively (SIGUSR1
+// checkpoint) before it is SIGKILLed. Killing is safe: the service respawns its process lazily, so the
+// pool slot recovers instead of being leaked to a wedged simulation.
+const CANCEL_KILL_GRACE_MS = 5_000;
 _computedKey = Symbol.asyncDispose;
 /**
- * The public-execution AVM backend: a lazily-grown pool of bb-avm-sim processes plus the CDB server that
+ * The public-execution AVM backend: a lazily-grown pool of bb-avm-sim services plus the CDB server that
  * answers those processes' contract-data callbacks. Callers hold this as an {@link AvmSimulator}; the pool,
  * the CDB server, its IPC path, and fork-id routing are all hidden behind that interface. Each `simulate`
  * registers the call's contracts DB on the CDB server for the duration of the simulation (keyed by fork id
  * so concurrent simulations on different forks don't collide) and unregisters it once the call returns.
+ *
+ * Process lifecycle is invisible to callers, exactly as when the simulator ran in-process: a simulation
+ * either produces a result, fails on its own merits, or runs until the caller's deadline aborts it.
+ * Environmental trouble is absorbed here — spawn failures retry indefinitely on a backoff ladder (bounded
+ * only by the caller's abort signal), and a simulation whose process dies is re-issued on the respawned
+ * process. The one deliberate exception: an input that kills the process twice is treated as a failing
+ * transaction, so a simulator-crashing tx gets evicted instead of burning a process per block forever.
  */ export class AvmSimulatorPool {
     options;
     slots;
     available;
     waiters;
     createdCount;
+    destroyed;
     log;
     maxSize;
     cdbServer;
+    spawnRetryIntervalMs;
+    spawnProcess;
     constructor(options){
         this.options = options;
         this.slots = [];
         this.available = [];
         this.waiters = [];
         this.createdCount = 0;
+        this.destroyed = false;
         this.log = createLogger('simulator:avm-pool');
         this.maxSize = options.maxSize ?? parseInt(process.env.AVM_MAX_CONCURRENT_SIMULATIONS ?? '4', 10);
         this.cdbServer = new CdbIpcServer();
+        this.spawnRetryIntervalMs = options.spawnRetryIntervalMs ?? 1_000;
+        this.spawnProcess = options.spawnProcess ?? ((spawnOptions)=>AvmSimulatorProcess.spawn(spawnOptions));
     }
     static async spawn(options) {
         const pool = new AvmSimulatorPool(options);
         // Always start one process up front so the first simulate() doesn't pay process spawn/connect cost.
+        // This is also where configuration errors (missing binary) surface, fast and fatally.
         await pool.prewarm();
         return pool;
     }
@@ -42,37 +89,21 @@ _computedKey = Symbol.asyncDispose;
         // and unregister once the simulation returns — registration is only needed while the call is running.
         this.cdbServer.registerFork(context.forkId, context.contractsDB, context.timestamp);
         try {
-            const simulator = await this.checkout();
-            try {
-                return await simulator.simulate(inputBuffer, signal);
-            } finally{
-                this.return(simulator);
-            }
+            return await this.runOnPool((simulator)=>simulator.simulate(inputBuffer, signal), signal);
         } finally{
             this.cdbServer.unregisterFork(context.forkId);
         }
     }
     async simulateWithHints(inputBuffer) {
         // The hinted path makes no contract-data callbacks, so no CDB registration is needed.
-        const simulator = await this.checkout();
-        try {
-            return await simulator.simulateWithHints(inputBuffer);
-        } finally{
-            this.return(simulator);
-        }
+        return await this.runOnPool((simulator)=>simulator.simulateWithHints(inputBuffer));
     }
-    /** Destroy all AVM processes in the pool and close the CDB server. */ async destroy() {
-        for (const waiter of this.waiters){
+    /** Destroy all AVM services in the pool and close the CDB server. */ async destroy() {
+        this.destroyed = true;
+        for (const waiter of this.waiters.splice(0)){
             waiter.reject(new Error('AVM simulator pool destroyed'));
         }
-        this.waiters = [];
-        const destroyPromises = [];
-        for (const slot of this.slots){
-            if (slot) {
-                destroyPromises.push(slot.destroy());
-            }
-        }
-        await Promise.all(destroyPromises);
+        await Promise.all(this.slots.map((slot)=>slot.destroy()));
         this.slots = [];
         this.available = [];
         this.createdCount = 0;
@@ -86,29 +117,81 @@ _computedKey = Symbol.asyncDispose;
         const target = Math.min(count, this.maxSize);
         const created = [];
         while(this.createdCount < target){
-            created.push(await this.createSlot());
+            created.push(await this.checkout());
         }
-        // Hand the freshly-spawned processes back to the pool so checkout() reuses them.
+        // Hand the checked-out processes back to the pool so checkout() reuses them.
         for (const simulator of created){
             this.return(simulator);
         }
     }
-    /** Check out an AVM process from the pool, blocking until one is free. Caller must return() it when done. */ async checkout() {
+    /**
+   * Run a call on a pooled service. A call that fails because its process died is re-issued on the
+   * respawned process; a second death for the same input is attributed to the input and surfaces as an
+   * ordinary error (the pre-IPC equivalent — a native crash — took down the whole node, so a failed tx
+   * is strictly gentler). Non-process failures surface as-is: they are the simulation's own verdict.
+   */ async runOnPool(fn, signal) {
+        for(let attempt = 0;; attempt++){
+            const simulator = await this.checkout(signal);
+            try {
+                return await fn(simulator);
+            } catch (err) {
+                if (!isProcessFailure(err) || signal?.aborted) {
+                    throw err;
+                }
+                if (attempt > 0) {
+                    const message = err instanceof Error ? err.message : String(err);
+                    throw new Error(`AVM simulator process died twice running this simulation; attributing the failure to the input: ${message}`, {
+                        cause: err
+                    });
+                }
+                this.log.warn(`AVM process died during simulation; re-issuing once on the respawned process`, {
+                    err
+                });
+            } finally{
+                this.return(simulator);
+            }
+        }
+    }
+    /** Check out an AVM service from the pool, blocking until one is free. Caller must return() it when done. */ async checkout(signal) {
+        if (this.destroyed) {
+            throw new Error('AVM simulator pool destroyed');
+        }
         const idx = this.available.pop();
-        if (idx !== undefined && this.slots[idx]) {
+        if (idx !== undefined) {
             return this.slots[idx];
         }
-        if (this.createdCount < this.maxSize || idx !== undefined && !this.slots[idx]) {
-            return await this.createSlot(idx);
+        if (this.createdCount < this.maxSize) {
+            return await this.createSlot(signal);
         }
         return new Promise((resolve, reject)=>{
-            this.waiters.push({
+            const waiter = {
                 resolve,
                 reject
-            });
+            };
+            if (signal) {
+                const onAbort = ()=>{
+                    const at = this.waiters.indexOf(waiter);
+                    if (at >= 0) {
+                        this.waiters.splice(at, 1);
+                        reject(new AbortError('AVM checkout aborted'));
+                    }
+                };
+                signal.addEventListener('abort', onAbort, {
+                    once: true
+                });
+                waiter.resolve = (simulator)=>{
+                    signal.removeEventListener('abort', onAbort);
+                    resolve(simulator);
+                };
+                waiter.reject = (err)=>{
+                    signal.removeEventListener('abort', onAbort);
+                    reject(err);
+                };
+            }
+            this.waiters.push(waiter);
         });
     }
-    /** Return an AVM process to the pool after use. */ return(simulator) {
+    /** Return an AVM service to the pool after use. */ return(simulator) {
         const waiter = this.waiters.shift();
         if (waiter) {
             waiter.resolve(simulator);
@@ -119,35 +202,54 @@ _computedKey = Symbol.asyncDispose;
             }
         }
     }
-    async createSlot(reuseIdx) {
-        const reuse = reuseIdx !== undefined && reuseIdx < this.slots.length;
+    async createSlot(signal) {
         // Reserve the slot count synchronously, before the async spawn, so concurrent checkouts can't all
         // observe `createdCount < maxSize` and overshoot the pool (the count is only bumped once control has
-        // yielded on the await). Roll back the reservation if the spawn itself fails.
-        if (!reuse) {
-            this.createdCount++;
-        }
-        let simulator;
+        // yielded on the await). Roll back the reservation if the spawn is abandoned.
+        this.createdCount++;
         try {
-            simulator = await AvmSimulatorProcess.spawn({
-                binaryPath: this.options.avmBinaryPath,
-                wsdbIpcPath: this.options.wsdbIpcPath,
-                cdbIpcPath: this.cdbServer.ipcPath,
-                logger: this.options.logger
-            });
+            const simulator = await this.spawnUntilUp(signal);
+            this.slots.push(simulator);
+            this.log.debug(`Created AVM pool slot (${this.createdCount}/${this.maxSize})`);
+            return simulator;
         } catch (err) {
-            if (!reuse) {
-                this.createdCount--;
-            }
+            this.createdCount--;
             throw err;
         }
-        if (reuse) {
-            this.slots[reuseIdx] = simulator;
-        } else {
-            this.slots.push(simulator);
+    }
+    /**
+   * Spawn a service, retrying environmental failures on a flat cadence indefinitely — the bound is
+   * the caller's own deadline (abort signal), matching the pre-IPC contract where a simulation either
+   * completed or was deadlined out. The cadence is deliberately fast and constant: an attempt is cheap,
+   * a slow one self-paces inside the backend's connect backstop, and backing off would cost a
+   * ~6s-slot sequencer whole blocks after the machine has already recovered. Configuration errors
+   * (missing binary, flagged non-retryable by the generated service) throw immediately; the boot-time
+   * prewarm is where those are meant to surface.
+   */ async spawnUntilUp(signal) {
+        for(let failures = 0;; failures++){
+            if (this.destroyed) {
+                throw new Error('AVM simulator pool destroyed');
+            }
+            if (signal?.aborted) {
+                throw new AbortError('AVM process spawn aborted');
+            }
+            try {
+                return await this.spawnProcess({
+                    binaryPath: this.options.avmBinaryPath,
+                    wsdbIpcPath: this.options.wsdbIpcPath,
+                    cdbIpcPath: this.cdbServer.ipcPath,
+                    logger: this.options.logger
+                });
+            } catch (err) {
+                if (!isProcessFailure(err)) {
+                    throw err;
+                }
+                this.log.warn(`Failed to spawn AVM process (attempt ${failures + 1}); retrying in ${this.spawnRetryIntervalMs}ms`, {
+                    err
+                });
+                await abortableSleep(this.spawnRetryIntervalMs, signal);
+            }
         }
-        this.log.debug(`Created AVM pool slot (${this.createdCount}/${this.maxSize})`);
-        return simulator;
     }
 }
 class AvmSimulatorProcess {
@@ -165,13 +267,22 @@ class AvmSimulatorProcess {
                 options.wsdbIpcPath,
                 '--cdb',
                 options.cdbIpcPath
-            ]
+            ],
+            // Each simulation is self-contained (state comes from the WSDB/CDB servers, routed by fork id),
+            // so a fresh process can safely serve the next call after a death.
+            respawn: true
         });
         return new AvmSimulatorProcess(service);
     }
     async simulate(inputBuffer, signal) {
-        // Signal the C++ process to stop at its next cancellation checkpoint when the caller aborts.
-        const onAbort = ()=>this.service.sendProcessSignal('SIGUSR1');
+        let killTimer;
+        // Cooperative cancellation first: SIGUSR1 makes the C++ process stop at its next cancellation
+        // checkpoint. If it doesn't respond within the grace (wedged in a slow op), SIGKILL it — the
+        // service respawns lazily, so this reclaims the pool slot rather than leaking it.
+        const onAbort = ()=>{
+            this.service.sendProcessSignal('SIGUSR1');
+            killTimer = setTimeout(()=>this.service.sendProcessSignal('SIGKILL'), CANCEL_KILL_GRACE_MS);
+        };
         if (signal?.aborted) {
             onAbort();
         }
@@ -184,6 +295,9 @@ class AvmSimulatorProcess {
             })).result;
         } finally{
             signal?.removeEventListener('abort', onAbort);
+            if (killTimer !== undefined) {
+                clearTimeout(killTimer);
+            }
         }
     }
     async simulateWithHints(inputBuffer) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aztec/simulator",
-  "version": "6.0.0-nightly.20260809",
+  "version": "6.0.0-nightly.20260812",
   "type": "module",
   "exports": {
     "./server": "./dest/server.js",
@@ -63,29 +63,29 @@
     ]
   },
   "dependencies": {
-    "@aztec/bb-avm-sim": "6.0.0-nightly.20260809",
-    "@aztec/cdb": "6.0.0-nightly.20260809",
-    "@aztec/constants": "6.0.0-nightly.20260809",
-    "@aztec/foundation": "6.0.0-nightly.20260809",
-    "@aztec/ipc-runtime": "6.0.0-nightly.20260809",
-    "@aztec/native": "6.0.0-nightly.20260809",
-    "@aztec/noir-acvm_js": "6.0.0-nightly.20260809",
-    "@aztec/noir-noirc_abi": "6.0.0-nightly.20260809",
-    "@aztec/noir-types": "6.0.0-nightly.20260809",
-    "@aztec/protocol-contracts": "6.0.0-nightly.20260809",
-    "@aztec/standard-contracts": "6.0.0-nightly.20260809",
-    "@aztec/stdlib": "6.0.0-nightly.20260809",
-    "@aztec/telemetry-client": "6.0.0-nightly.20260809",
-    "@aztec/world-state": "6.0.0-nightly.20260809",
+    "@aztec/bb-avm-sim": "6.0.0-nightly.20260812",
+    "@aztec/cdb": "6.0.0-nightly.20260812",
+    "@aztec/constants": "6.0.0-nightly.20260812",
+    "@aztec/foundation": "6.0.0-nightly.20260812",
+    "@aztec/ipc-runtime": "6.0.0-nightly.20260812",
+    "@aztec/native": "6.0.0-nightly.20260812",
+    "@aztec/noir-acvm_js": "6.0.0-nightly.20260812",
+    "@aztec/noir-noirc_abi": "6.0.0-nightly.20260812",
+    "@aztec/noir-types": "6.0.0-nightly.20260812",
+    "@aztec/protocol-contracts": "6.0.0-nightly.20260812",
+    "@aztec/standard-contracts": "6.0.0-nightly.20260812",
+    "@aztec/stdlib": "6.0.0-nightly.20260812",
+    "@aztec/telemetry-client": "6.0.0-nightly.20260812",
+    "@aztec/world-state": "6.0.0-nightly.20260812",
     "lodash.clonedeep": "^4.5.0",
     "lodash.merge": "^4.6.2",
     "msgpackr": "^1.11.2",
     "tslib": "^2.4.0"
   },
   "devDependencies": {
-    "@aztec/kv-store": "6.0.0-nightly.20260809",
-    "@aztec/noir-contracts.js": "6.0.0-nightly.20260809",
-    "@aztec/noir-test-contracts.js": "6.0.0-nightly.20260809",
+    "@aztec/kv-store": "6.0.0-nightly.20260812",
+    "@aztec/noir-contracts.js": "6.0.0-nightly.20260812",
+    "@aztec/noir-test-contracts.js": "6.0.0-nightly.20260812",
     "@jest/globals": "^30.0.0",
     "@types/jest": "^30.0.0",
     "@types/lodash.clonedeep": "^4.5.7",

package/src/public/avm_simulator_pool.ts

@@ -1,5 +1,7 @@
 import { AvmService } from '@aztec/bb-avm-sim';
+import { AbortError } from '@aztec/foundation/error';
 import { type Logger, createLogger } from '@aztec/foundation/log';
+import { sleep } from '@aztec/foundation/sleep';
 
 import type { AvmContractsDBContext, AvmSimulator } from './avm_simulator.js';
 import { CdbIpcServer } from './cdb_ipc_server.js';
@@ -13,44 +15,106 @@ export interface AvmSimulatorPoolOptions {
   wsdbIpcPath: string;
   /** Optional logger function for AVM process output. */
   logger?: (msg: string) => void;
+  /**
+   * Flat delay between environmental spawn failures (default 1s). No backoff: sequencers live on
+   * ~6s slots, so sleeping longer than this after a failure costs whole blocks while the machine may
+   * have recovered — and a spawn attempt is cheap. Spawning never gives up on its own; the caller's
+   * deadline (abort signal) is the bound.
+   */
+  spawnRetryIntervalMs?: number;
+  /** Process spawner override. Test hook; defaults to spawning a real bb-avm-sim via the generated AvmService. */
+  spawnProcess?: (options: AvmProcessSpawnOptions) => Promise<AvmProcessHandle>;
+}
+
+/** Options handed to the process spawner for each new pool slot. */
+export interface AvmProcessSpawnOptions {
+  binaryPath?: string;
+  wsdbIpcPath: string;
+  cdbIpcPath: string;
+  logger?: (msg: string) => void;
 }
 
 /**
- * A raw handle to a single bb-avm-sim process: it runs a serialized simulation and connects back to the
+ * A handle to a single bb-avm-sim service: it runs serialized simulations and connects back to the
  * shared CDB/WSDB servers for state, but is unaware of which fork's contract data it is reading — that is
- * routed by the fork id baked into the input buffer.
+ * routed by the fork id baked into the input buffer. The underlying service owns its process lifecycle
+ * (including respawn-on-death), so a handle stays usable for the life of the pool.
  */
-interface AvmProcessHandle {
+export interface AvmProcessHandle {
   simulate(inputBuffer: Uint8Array, signal?: AbortSignal): Promise<Uint8Array>;
   simulateWithHints(inputBuffer: Uint8Array): Promise<Uint8Array>;
   destroy(): Promise<void>;
 }
 
 /**
- * The public-execution AVM backend: a lazily-grown pool of bb-avm-sim processes plus the CDB server that
+ * The generated service flags errors caused by the death of the underlying process (rather than by the
+ * request itself) with `retry: true`. That distinction is interpreted here and goes no further: process
+ * lifecycle is invisible to the pool's callers.
+ */
+function isProcessFailure(err: unknown): boolean {
+  return err instanceof Error && (err as Error & { retry?: unknown }).retry === true;
+}
+
+/** Sleep that wakes early (without throwing) when the signal aborts; callers re-check the signal. */
+async function abortableSleep(ms: number, signal?: AbortSignal): Promise<void> {
+  if (!signal) {
+    return sleep(ms);
+  }
+  let onAbort: () => void;
+  const aborted = new Promise<void>(resolve => {
+    onAbort = resolve;
+    signal.addEventListener('abort', onAbort, { once: true });
+  });
+  try {
+    await Promise.race([sleep(ms), aborted]);
+  } finally {
+    signal.removeEventListener('abort', onAbort!);
+  }
+}
+
+// After a cancellation is requested, how long the C++ process gets to cancel cooperatively (SIGUSR1
+// checkpoint) before it is SIGKILLed. Killing is safe: the service respawns its process lazily, so the
+// pool slot recovers instead of being leaked to a wedged simulation.
+const CANCEL_KILL_GRACE_MS = 5_000;
+
+/**
+ * The public-execution AVM backend: a lazily-grown pool of bb-avm-sim services plus the CDB server that
  * answers those processes' contract-data callbacks. Callers hold this as an {@link AvmSimulator}; the pool,
  * the CDB server, its IPC path, and fork-id routing are all hidden behind that interface. Each `simulate`
  * registers the call's contracts DB on the CDB server for the duration of the simulation (keyed by fork id
  * so concurrent simulations on different forks don't collide) and unregisters it once the call returns.
+ *
+ * Process lifecycle is invisible to callers, exactly as when the simulator ran in-process: a simulation
+ * either produces a result, fails on its own merits, or runs until the caller's deadline aborts it.
+ * Environmental trouble is absorbed here — spawn failures retry indefinitely on a backoff ladder (bounded
+ * only by the caller's abort signal), and a simulation whose process dies is re-issued on the respawned
+ * process. The one deliberate exception: an input that kills the process twice is treated as a failing
+ * transaction, so a simulator-crashing tx gets evicted instead of burning a process per block forever.
  */
 export class AvmSimulatorPool implements AvmSimulator {
-  private slots: Array<AvmProcessHandle | null> = [];
+  private slots: AvmProcessHandle[] = [];
   private available: number[] = [];
   private waiters: Array<{ resolve: (simulator: AvmProcessHandle) => void; reject: (error: Error) => void }> = [];
   private createdCount = 0;
+  private destroyed = false;
   private log: Logger;
   private maxSize: number;
   private cdbServer: CdbIpcServer;
+  private readonly spawnRetryIntervalMs: number;
+  private readonly spawnProcess: (options: AvmProcessSpawnOptions) => Promise<AvmProcessHandle>;
 
   constructor(private options: AvmSimulatorPoolOptions) {
     this.log = createLogger('simulator:avm-pool');
     this.maxSize = options.maxSize ?? parseInt(process.env.AVM_MAX_CONCURRENT_SIMULATIONS ?? '4', 10);
     this.cdbServer = new CdbIpcServer();
+    this.spawnRetryIntervalMs = options.spawnRetryIntervalMs ?? 1_000;
+    this.spawnProcess = options.spawnProcess ?? (spawnOptions => AvmSimulatorProcess.spawn(spawnOptions));
   }
 
   static async spawn(options: AvmSimulatorPoolOptions): Promise<AvmSimulatorPool> {
     const pool = new AvmSimulatorPool(options);
     // Always start one process up front so the first simulate() doesn't pay process spawn/connect cost.
+    // This is also where configuration errors (missing binary) surface, fast and fatally.
     await pool.prewarm();
     return pool;
   }
@@ -64,12 +128,7 @@ export class AvmSimulatorPool implements AvmSimulator {
     // and unregister once the simulation returns — registration is only needed while the call is running.
     this.cdbServer.registerFork(context.forkId, context.contractsDB, context.timestamp);
     try {
-      const simulator = await this.checkout();
-      try {
-        return await simulator.simulate(inputBuffer, signal);
-      } finally {
-        this.return(simulator);
-      }
+      return await this.runOnPool(simulator => simulator.simulate(inputBuffer, signal), signal);
     } finally {
       this.cdbServer.unregisterFork(context.forkId);
     }
@@ -77,28 +136,17 @@ export class AvmSimulatorPool implements AvmSimulator {
 
   async simulateWithHints(inputBuffer: Uint8Array): Promise<Uint8Array> {
     // The hinted path makes no contract-data callbacks, so no CDB registration is needed.
-    const simulator = await this.checkout();
-    try {
-      return await simulator.simulateWithHints(inputBuffer);
-    } finally {
-      this.return(simulator);
-    }
+    return await this.runOnPool(simulator => simulator.simulateWithHints(inputBuffer));
   }
 
-  /** Destroy all AVM processes in the pool and close the CDB server. */
+  /** Destroy all AVM services in the pool and close the CDB server. */
   async destroy(): Promise<void> {
-    for (const waiter of this.waiters) {
+    this.destroyed = true;
+    for (const waiter of this.waiters.splice(0)) {
       waiter.reject(new Error('AVM simulator pool destroyed'));
     }
-    this.waiters = [];
 
-    const destroyPromises: Promise<void>[] = [];
-    for (const slot of this.slots) {
-      if (slot) {
-        destroyPromises.push(slot.destroy());
-      }
-    }
-    await Promise.all(destroyPromises);
+    await Promise.all(this.slots.map(slot => slot.destroy()));
 
     this.slots = [];
     this.available = [];
@@ -115,31 +163,82 @@ export class AvmSimulatorPool implements AvmSimulator {
     const target = Math.min(count, this.maxSize);
     const created: AvmProcessHandle[] = [];
     while (this.createdCount < target) {
-      created.push(await this.createSlot());
+      created.push(await this.checkout());
     }
-    // Hand the freshly-spawned processes back to the pool so checkout() reuses them.
+    // Hand the checked-out processes back to the pool so checkout() reuses them.
     for (const simulator of created) {
       this.return(simulator);
     }
   }
 
-  /** Check out an AVM process from the pool, blocking until one is free. Caller must return() it when done. */
-  private async checkout(): Promise<AvmProcessHandle> {
+  /**
+   * Run a call on a pooled service. A call that fails because its process died is re-issued on the
+   * respawned process; a second death for the same input is attributed to the input and surfaces as an
+   * ordinary error (the pre-IPC equivalent — a native crash — took down the whole node, so a failed tx
+   * is strictly gentler). Non-process failures surface as-is: they are the simulation's own verdict.
+   */
+  private async runOnPool<T>(fn: (simulator: AvmProcessHandle) => Promise<T>, signal?: AbortSignal): Promise<T> {
+    for (let attempt = 0; ; attempt++) {
+      const simulator = await this.checkout(signal);
+      try {
+        return await fn(simulator);
+      } catch (err) {
+        if (!isProcessFailure(err) || signal?.aborted) {
+          throw err;
+        }
+        if (attempt > 0) {
+          const message = err instanceof Error ? err.message : String(err);
+          throw new Error(
+            `AVM simulator process died twice running this simulation; attributing the failure to the input: ${message}`,
+            { cause: err },
+          );
+        }
+        this.log.warn(`AVM process died during simulation; re-issuing once on the respawned process`, { err });
+      } finally {
+        this.return(simulator);
+      }
+    }
+  }
+
+  /** Check out an AVM service from the pool, blocking until one is free. Caller must return() it when done. */
+  private async checkout(signal?: AbortSignal): Promise<AvmProcessHandle> {
+    if (this.destroyed) {
+      throw new Error('AVM simulator pool destroyed');
+    }
     const idx = this.available.pop();
-    if (idx !== undefined && this.slots[idx]) {
-      return this.slots[idx]!;
+    if (idx !== undefined) {
+      return this.slots[idx];
     }
 
-    if (this.createdCount < this.maxSize || (idx !== undefined && !this.slots[idx])) {
-      return await this.createSlot(idx);
+    if (this.createdCount < this.maxSize) {
+      return await this.createSlot(signal);
     }
 
     return new Promise<AvmProcessHandle>((resolve, reject) => {
-      this.waiters.push({ resolve, reject });
+      const waiter = { resolve, reject };
+      if (signal) {
+        const onAbort = () => {
+          const at = this.waiters.indexOf(waiter);
+          if (at >= 0) {
+            this.waiters.splice(at, 1);
+            reject(new AbortError('AVM checkout aborted'));
+          }
+        };
+        signal.addEventListener('abort', onAbort, { once: true });
+        waiter.resolve = simulator => {
+          signal.removeEventListener('abort', onAbort);
+          resolve(simulator);
+        };
+        waiter.reject = err => {
+          signal.removeEventListener('abort', onAbort);
+          reject(err);
+        };
+      }
+      this.waiters.push(waiter);
     });
   }
 
-  /** Return an AVM process to the pool after use. */
+  /** Return an AVM service to the pool after use. */
   private return(simulator: AvmProcessHandle): void {
     const waiter = this.waiters.shift();
     if (waiter) {
@@ -152,59 +251,85 @@ export class AvmSimulatorPool implements AvmSimulator {
     }
   }
 
-  private async createSlot(reuseIdx?: number): Promise<AvmProcessHandle> {
-    const reuse = reuseIdx !== undefined && reuseIdx < this.slots.length;
+  private async createSlot(signal?: AbortSignal): Promise<AvmProcessHandle> {
     // Reserve the slot count synchronously, before the async spawn, so concurrent checkouts can't all
     // observe `createdCount < maxSize` and overshoot the pool (the count is only bumped once control has
-    // yielded on the await). Roll back the reservation if the spawn itself fails.
-    if (!reuse) {
-      this.createdCount++;
-    }
-    let simulator: AvmProcessHandle;
+    // yielded on the await). Roll back the reservation if the spawn is abandoned.
+    this.createdCount++;
     try {
-      simulator = await AvmSimulatorProcess.spawn({
-        binaryPath: this.options.avmBinaryPath,
-        wsdbIpcPath: this.options.wsdbIpcPath,
-        cdbIpcPath: this.cdbServer.ipcPath,
-        logger: this.options.logger,
-      });
+      const simulator = await this.spawnUntilUp(signal);
+      this.slots.push(simulator);
+      this.log.debug(`Created AVM pool slot (${this.createdCount}/${this.maxSize})`);
+      return simulator;
     } catch (err) {
-      if (!reuse) {
-        this.createdCount--;
-      }
+      this.createdCount--;
       throw err;
     }
-    if (reuse) {
-      this.slots[reuseIdx!] = simulator;
-    } else {
-      this.slots.push(simulator);
+  }
+
+  /**
+   * Spawn a service, retrying environmental failures on a flat cadence indefinitely — the bound is
+   * the caller's own deadline (abort signal), matching the pre-IPC contract where a simulation either
+   * completed or was deadlined out. The cadence is deliberately fast and constant: an attempt is cheap,
+   * a slow one self-paces inside the backend's connect backstop, and backing off would cost a
+   * ~6s-slot sequencer whole blocks after the machine has already recovered. Configuration errors
+   * (missing binary, flagged non-retryable by the generated service) throw immediately; the boot-time
+   * prewarm is where those are meant to surface.
+   */
+  private async spawnUntilUp(signal?: AbortSignal): Promise<AvmProcessHandle> {
+    for (let failures = 0; ; failures++) {
+      if (this.destroyed) {
+        throw new Error('AVM simulator pool destroyed');
+      }
+      if (signal?.aborted) {
+        throw new AbortError('AVM process spawn aborted');
+      }
+      try {
+        return await this.spawnProcess({
+          binaryPath: this.options.avmBinaryPath,
+          wsdbIpcPath: this.options.wsdbIpcPath,
+          cdbIpcPath: this.cdbServer.ipcPath,
+          logger: this.options.logger,
+        });
+      } catch (err) {
+        if (!isProcessFailure(err)) {
+          throw err;
+        }
+        this.log.warn(
+          `Failed to spawn AVM process (attempt ${failures + 1}); retrying in ${this.spawnRetryIntervalMs}ms`,
+          { err },
+        );
+        await abortableSleep(this.spawnRetryIntervalMs, signal);
+      }
     }
-    this.log.debug(`Created AVM pool slot (${this.createdCount}/${this.maxSize})`);
-    return simulator;
   }
 }
 
 class AvmSimulatorProcess implements AvmProcessHandle {
   private constructor(private service: AvmService) {}
 
-  static async spawn(options: {
-    binaryPath?: string;
-    wsdbIpcPath: string;
-    cdbIpcPath: string;
-    logger?: (msg: string) => void;
-  }): Promise<AvmSimulatorProcess> {
+  static async spawn(options: AvmProcessSpawnOptions): Promise<AvmSimulatorProcess> {
     const service = await AvmService.spawn({
       binaryPath: options.binaryPath,
       transport: 'uds',
       logger: options.logger,
       extraArgs: ['--wsdb', options.wsdbIpcPath, '--cdb', options.cdbIpcPath],
+      // Each simulation is self-contained (state comes from the WSDB/CDB servers, routed by fork id),
+      // so a fresh process can safely serve the next call after a death.
+      respawn: true,
     });
     return new AvmSimulatorProcess(service);
   }
 
   public async simulate(inputBuffer: Uint8Array, signal?: AbortSignal): Promise<Uint8Array> {
-    // Signal the C++ process to stop at its next cancellation checkpoint when the caller aborts.
-    const onAbort = () => this.service.sendProcessSignal('SIGUSR1');
+    let killTimer: NodeJS.Timeout | undefined;
+    // Cooperative cancellation first: SIGUSR1 makes the C++ process stop at its next cancellation
+    // checkpoint. If it doesn't respond within the grace (wedged in a slow op), SIGKILL it — the
+    // service respawns lazily, so this reclaims the pool slot rather than leaking it.
+    const onAbort = () => {
+      this.service.sendProcessSignal('SIGUSR1');
+      killTimer = setTimeout(() => this.service.sendProcessSignal('SIGKILL'), CANCEL_KILL_GRACE_MS);
+    };
     if (signal?.aborted) {
       onAbort();
     }
@@ -213,6 +338,9 @@ class AvmSimulatorProcess implements AvmProcessHandle {
       return (await this.service.simulate({ inputs: inputBuffer })).result;
     } finally {
       signal?.removeEventListener('abort', onAbort);
+      if (killTimer !== undefined) {
+        clearTimeout(killTimer);
+      }
     }
   }