@code-yeongyu/senpi-codemode 2026.10.3 → 2026.10.5

package/src/extension/session-manager.ts

@@ -1,55 +1,37 @@
 import { join } from "node:path";
-import { type ExtensionContext, readProcessFootprint } from "@code-yeongyu/senpi";
+import type { ExtensionContext } from "@code-yeongyu/senpi";
 import { type BridgeServerHandle, startBridgeServer } from "../bridge/http-server.ts";
 import type { KernelToHostMessage } from "../bridge/protocol.ts";
 import { isReservedToolName, runReservedTool } from "../bridges/reserved-dispatch.ts";
-import type { EvalSchemaToolInfo } from "../bridges/schema-bridge.ts";
 import type { CompletionRequest, CompletionResult } from "../completion/handler.ts";
 import { resolveKernelMemoryThresholds } from "../config/memory-settings.ts";
-import { type CodemodeSettings, defaultCodemodeSettings } from "../config/settings.ts";
+import { defaultCodemodeSettings } from "../config/settings.ts";
 import { collectOrphanedChildren } from "../host-sdk.ts";
-import type { InterpreterAvailability } from "../interpreters/detect.ts";
-import { JuliaKernel } from "../kernels/jl/kernel.ts";
 import { JavaScriptKernel } from "../kernels/js/context-manager.ts";
-import { PythonKernel } from "../kernels/py/kernel.ts";
-import { RubyKernel } from "../kernels/rb/kernel.ts";
-import type { SessionEnvironment } from "../kernels/session-env.ts";
+import type { KernelLifecycle } from "../kernels/shared/kernel-death.ts";
 import { marshalToolResult } from "../tool/image.ts";
-import type { EvalKernel, EvalKernelManager, EvalLanguage, ExecuteTool } from "../tool/types.ts";
+import type { EvalKernel, EvalLanguage } from "../tool/types.ts";
+import {
+	javaScriptKernelMemory,
+	registerKernel,
+	type StartedKernel,
+	startSubprocessKernel,
+} from "./kernel-registration.ts";
+import { kernelRegistry, type RegisteredKernelSource } from "./kernel-registry.ts";
+import { ReplaceableKernel } from "./kernel-replacement.ts";
 import { assertSessionCwdAvailable } from "./session-cwd.ts";
+import type {
+	BridgeEndpoint,
+	CodemodeSessionManager,
+	CreateCodemodeSessionManagerOptions,
+} from "./session-manager-contract.ts";
 
-export interface CodemodeSessionManager extends EvalKernelManager {
-	dispose(): Promise<void>;
-	complete(request: CompletionRequest, ctx: ExtensionContext): Promise<CompletionResult>;
-	setContext?(ctx: ExtensionContext): void;
-	bridgeEndpoint?(): BridgeEndpoint;
-}
-
-export interface BridgeEndpoint {
-	readonly port: number;
-	readonly token: string;
-}
-
-export interface EvalExecutionTracker {
-	assertEvalExecutionAllowed(): void;
-	trackEvalExecution<Result>(execution: Promise<Result>, controller: AbortController): Promise<Result>;
-}
-
-export interface CreateCodemodeSessionManagerOptions {
-	readonly sessionId: string;
-	readonly cwd: string;
-	readonly settings: CodemodeSettings;
-	readonly availability: InterpreterAvailability;
-	/** Session-scoped roots exposed to kernel helpers such as local://. */
-	readonly localRoots?: Readonly<Record<string, string>>;
-	/** Session-adjacent directory used for persisted eval artifacts. */
-	readonly artifactsDir?: string;
-	/** Per-session PI_* values exposed to every kernel and the children it spawns. */
-	readonly sessionEnv?: SessionEnvironment;
-	readonly executeTool: ExecuteTool;
-	readonly listTools?: () => readonly EvalSchemaToolInfo[];
-	readonly complete: (request: CompletionRequest, ctx: ExtensionContext) => Promise<CompletionResult>;
-}
+export type {
+	BridgeEndpoint,
+	CodemodeSessionManager,
+	CreateCodemodeSessionManagerOptions,
+	EvalExecutionTracker,
+} from "./session-manager-contract.ts";
 
 export async function createCodemodeSessionManager(
 	options: CreateCodemodeSessionManagerOptions,
@@ -79,6 +61,7 @@ class DefaultCodemodeSessionManager implements CodemodeSessionManager {
 	readonly #options: CreateCodemodeSessionManagerOptions;
 	#bridge: BridgeServerHandle | undefined;
 	#kernels = new Map<EvalLanguage, EvalKernel>();
+	readonly #registrations = new Map<EvalLanguage, string>();
 	#kernelCreations = new Map<EvalLanguage, Promise<EvalKernel>>();
 	#onMessageRefs = new Map<EvalLanguage, (message: KernelToHostMessage) => void>();
 	#context: ExtensionContext | undefined;
@@ -187,6 +170,8 @@ class DefaultCodemodeSessionManager implements CodemodeSessionManager {
 		const kernels = [...this.#kernels.values()];
 		const bridge = this.#bridge;
 		this.#kernels.clear();
+		for (const id of this.#registrations.values()) kernelRegistry.unregister(id);
+		this.#registrations.clear();
 		this.#onMessageRefs.clear();
 		this.#bridge = undefined;
 		this.#context = undefined;
@@ -209,21 +194,49 @@ class DefaultCodemodeSessionManager implements CodemodeSessionManager {
 		generation: number,
 	): Promise<EvalKernel> {
 		await assertSessionCwdAvailable(this.#options.cwd);
-		const kernel = await this.#createKernel(language, onMessage);
+		// py/rb/jl instances can die; the session holds one replaceable kernel per language so every
+		// cell that kept a reference to it survives the death (JS heals its own worker).
+		let memory: RegisteredKernelSource | undefined;
+		const kernel =
+			language === "js"
+				? (() => {
+						return this.#createKernel(language, onMessage).then((created) => {
+							memory = created.memory;
+							return created.kernel;
+						});
+					})()
+				: ReplaceableKernel.create(language, async (lifecycle) => {
+						const created = await this.#createKernel(language, onMessage, lifecycle);
+						memory ??= created.memory;
+						return created.kernel;
+					});
+		const resolvedKernel = await kernel;
 		if (generation !== this.#generation) {
-			await kernel.close();
+			await resolvedKernel.close();
 			throw new CodemodeSessionDisposedError();
 		}
-		this.#kernels.set(language, kernel);
+		this.#kernels.set(language, resolvedKernel);
+		this.#registrations.set(
+			language,
+			registerKernel(
+				this.#options.ownerSessionId ?? this.#options.sessionId,
+				language,
+				memory as RegisteredKernelSource,
+			),
+		);
 		// The directory can vanish while the interpreter starts; every caller sharing this creation
 		// must see that, not only the next one. The kernel stays stored and dispose still closes it.
 		await assertSessionCwdAvailable(this.#options.cwd);
 		// A dispose that started during the check above already owns this stored kernel.
 		if (generation !== this.#generation) throw new CodemodeSessionDisposedError();
-		return kernel;
+		return resolvedKernel;
 	}
 
-	async #createKernel(language: EvalLanguage, onMessage: (message: KernelToHostMessage) => void): Promise<EvalKernel> {
+	async #createKernel(
+		language: EvalLanguage,
+		onMessage: (message: KernelToHostMessage) => void,
+		lifecycle: KernelLifecycle = {},
+	): Promise<StartedKernel> {
 		const bridge = this.#bridge;
 		if (!bridge) throw new Error("codemode bridge server is not running");
 		const configuredPoolWidth = this.#options.settings.parallelPoolWidth;
@@ -235,7 +248,7 @@ class DefaultCodemodeSessionManager implements CodemodeSessionManager {
 			this.#options.localRoots ??
 			(this.#options.artifactsDir ? { local: join(this.#options.artifactsDir, "local") } : undefined);
 		if (language === "js") {
-			return new JavaScriptKernel({
+			const kernel = new JavaScriptKernel({
 				sessionId: this.#options.sessionId,
 				cwd: this.#options.cwd,
 				parallelPoolWidth,
@@ -248,6 +261,7 @@ class DefaultCodemodeSessionManager implements CodemodeSessionManager {
 				...(localRoots ? { localRoots: { ...localRoots } } : {}),
 				...(this.#options.artifactsDir ? { artifactsDir: this.#options.artifactsDir } : {}),
 			});
+			return { kernel, memory: javaScriptKernelMemory(kernel) };
 		}
 		const detected = this.#options.availability[language].detected;
 		if (!detected.ok) throw new Error(`No ${language} interpreter is available`);
@@ -264,13 +278,10 @@ class DefaultCodemodeSessionManager implements CodemodeSessionManager {
 			...(this.#options.sessionEnv ? { sessionEnv: this.#options.sessionEnv } : {}),
 			connection,
 			onMessage,
+			...lifecycle,
 		};
 		const memory = resolveKernelMemoryThresholds(this.#options.settings.memory);
-		if (language === "py") return await PythonKernel.start({ ...shared, interpreterPath: detected.path, memory });
-		// rb/jl runners report no memory: the host reads the interpreter footprint for the ceiling only.
-		const hostMeasured = { thresholds: memory, readFootprint: readProcessFootprint };
-		if (language === "rb") return RubyKernel.start({ ...shared, command: detected.path, memory: hostMeasured });
-		return JuliaKernel.start({ ...shared, command: detected.path, memory: hostMeasured });
+		return await startSubprocessKernel({ language, interpreterPath: detected.path, memory, shared });
 	}
 
 	#foreignKernelToolNames(): string[] {

package/src/kernels/jl/kernel.ts

@@ -1,10 +1,11 @@
 import { join } from "node:path";
 import type { BridgeConnectionConfig, KernelToHostMessage } from "../../bridge/protocol.ts";
 import type { SessionEnvironment } from "../session-env.ts";
+import type { KernelLifecycle } from "../shared/kernel-death.ts";
 import { type CodemodeRuntimeAssetEnvironment, requireCodemodeRuntimeAsset } from "../shared/runtime-asset.ts";
 import { SubprocessKernel, type SubprocessKernelMemory, type SubprocessSpawn } from "../shared/subprocess-kernel.ts";
 
-export interface JuliaKernelStartOptions {
+export interface JuliaKernelStartOptions extends KernelLifecycle {
 	readonly cwd: string;
 	readonly sessionId: string;
 	readonly connection: BridgeConnectionConfig;
@@ -52,6 +53,7 @@ export class JuliaKernel extends SubprocessKernel {
 			spawn: options.spawn,
 			onMessage: options.onMessage,
 			memory: options.memory && { language: "jl", ...options.memory },
+			onDeath: options.onDeath,
 		});
 	}
 }

package/src/kernels/js/active-cell-control.ts

@@ -0,0 +1,73 @@
+import type { HostToKernelMessage } from "../../bridge/protocol.ts";
+import {
+	awaitCooperativeSettlement,
+	type JavaScriptInterruptBounds,
+	restartedResult,
+	restartOutcome,
+	type WorkerRetirement,
+} from "./interrupt-bounds.ts";
+import type { JavaScriptRunQueue, PendingJavaScriptRun } from "./run-queue.ts";
+
+export interface CellStopOutcome {
+	readonly retained: boolean;
+	readonly note?: string;
+}
+
+export interface ActiveCellControlHost {
+	readonly runs: JavaScriptRunQueue;
+	readonly bounds: JavaScriptInterruptBounds;
+	post(message: HostToKernelMessage): void;
+	terminate(): Promise<WorkerRetirement>;
+	/** Brings a fresh worker up once the stopped one is retired. */
+	recover(): void;
+	clearToolCalls(): void;
+}
+
+/** The running cell's deadline and the protocol that stops it on a timeout or an interrupt. */
+export class ActiveCellControl {
+	readonly #host: ActiveCellControlHost;
+	#timeout: NodeJS.Timeout | null = null;
+
+	constructor(host: ActiveCellControlHost) {
+		this.#host = host;
+	}
+
+	arm(run: PendingJavaScriptRun): void {
+		const timeoutMs = run.input.timeoutMs;
+		if (timeoutMs) this.#timeout = setTimeout(() => void this.#timedOut(run, timeoutMs), timeoutMs);
+	}
+
+	disarm(): void {
+		if (this.#timeout) clearTimeout(this.#timeout);
+		this.#timeout = null;
+	}
+
+	/**
+	 * Asks the worker to settle the active cell cooperatively (rejecting its bridge calls and killing its
+	 * children); only a cell that stays unsettled past the grace costs the worker VM. Reports whether the
+	 * worker state survived and, when a blocked worker had to be abandoned, the note that explains it.
+	 */
+	async stop(run: PendingJavaScriptRun, reason: string, message: string, durationMs = 0): Promise<CellStopOutcome> {
+		const host = this.#host;
+		try {
+			run.interruptResult = { type: "result", cellId: run.input.cellId, ok: false, error: { message }, durationMs };
+			run.interruptAck ??= Promise.withResolvers<void>();
+			host.post({ type: "interrupt", reason });
+			if ((await awaitCooperativeSettlement(run, host.bounds)) === "settled") {
+				return { retained: run.settledByWorker };
+			}
+			if (!host.runs.releaseActive(run)) return { retained: run.settledByWorker };
+			const retirement = await host.terminate();
+			host.runs.settle(run, restartedResult(run, message));
+			host.recover();
+			return restartOutcome(run, retirement, host.bounds);
+		} finally {
+			host.clearToolCalls();
+		}
+	}
+
+	async #timedOut(run: PendingJavaScriptRun, durationMs: number): Promise<void> {
+		if (this.#host.runs.active !== run || run.settled) return;
+		await this.stop(run, `timed out after ${durationMs}ms`, `JS cell timed out after ${durationMs}ms`, durationMs);
+	}
+}

package/src/kernels/js/context-manager.ts

@@ -1,15 +1,8 @@
-import type { EvalStatusEvent, HostToKernelMessage, KernelToHostMessage } from "../../bridge/protocol.ts";
-import { CHILD_LIFECYCLE_OP, INTERRUPT_ACK_OP, MEMORY_COLLECTED_OP } from "../../bridge/reserved.ts";
+import type { HostToKernelMessage, KernelToHostMessage } from "../../bridge/protocol.ts";
+import { CHILD_LIFECYCLE_OP, INTERRUPT_ACK_OP } from "../../bridge/reserved.ts";
 import type { KernelInterruptHandle } from "../../tool/types.ts";
-import { KernelMemoryPolicy } from "../shared/kernel-memory.ts";
-import {
-	awaitCooperativeSettlement,
-	DEFAULT_INTERRUPT_BOUNDS,
-	type JavaScriptInterruptBounds,
-	restartedResult,
-	restartOutcome,
-	type WorkerRetirement,
-} from "./interrupt-bounds.ts";
+import { ActiveCellControl } from "./active-cell-control.ts";
+import { DEFAULT_INTERRUPT_BOUNDS, type WorkerRetirement } from "./interrupt-bounds.ts";
 import {
 	assertJavaScriptKernelOpen,
 	type JavaScriptKernelMode,
@@ -19,6 +12,7 @@ import {
 	resolveKernelToolNameSource,
 	type ToolCallMessage,
 } from "./kernel-contract.ts";
+import { type JavaScriptMemoryReading, KernelMemoryBridge } from "./kernel-memory-bridge.ts";
 import { kernelToolError } from "./kernel-tools-errors.ts";
 import { KernelToolHostPump } from "./kernel-tools-host.ts";
 import type {
@@ -27,47 +21,53 @@ import type {
 	KernelToolsInvokeRequest,
 } from "./kernel-tools-types.ts";
 import { type JavaScriptKernelOptions, LocalModuleLoader } from "./local-module-loader.ts";
-import { terminateProcessTrees } from "./process-tree-host.ts";
-import { JavaScriptRunQueue, type PendingJavaScriptRun } from "./run-queue.ts";
-import { bridgeError, WorkerStartupCancelledError } from "./worker-host.ts";
+import { JavaScriptRunQueue } from "./run-queue.ts";
+import { ToolCallQueue } from "./tool-call-queue.ts";
+import { WorkerChildren } from "./worker-children.ts";
+import { crashedResult } from "./worker-host.ts";
+import { WorkerRecovery } from "./worker-recovery.ts";
 import { WorkerSlot } from "./worker-slot.ts";
 
 export { JavaScriptKernelClosedError, type JavaScriptKernelMode, type JavaScriptRunInput } from "./kernel-contract.ts";
+export type { JavaScriptMemoryReading } from "./kernel-memory-bridge.ts";
 export type { JavaScriptKernelOptions } from "./local-module-loader.ts";
 export { type JavaScriptWorkerEntryUrlOptions, resolveJsWorkerEntryUrl } from "./worker-startup.ts";
 
-/** How long a lost worker's children get to honour SIGTERM before the host sends SIGKILL. */
-const WORKER_LOSS_CHILD_GRACE_MS = 1_000;
-
-// Pull-API fallback queue bound: a nextToolCall consumer this far behind is already stalled, and the
-// normal push path (onMessage) never reads the queue, so unbounded growth only pins tool args (#1695).
-const MAX_PENDING_TOOL_CALLS = 256;
-
 export class JavaScriptKernel {
 	readonly #options: JavaScriptKernelOptions;
 	readonly #moduleLoader: LocalModuleLoader;
 	readonly #slot: WorkerSlot;
 	#lifecycle: LifecycleState = "open";
 	#activation: Promise<void> | null = null;
-	#recovery: Promise<void> | null = null;
 	#closePromise: Promise<void> | null = null;
 	readonly #runs = new JavaScriptRunQueue();
 	readonly #kernelTools = new KernelToolHostPump(
 		(message) => this.#slot.postMessage(message),
 		() => this.#lifecycle === "open" && this.#slot.present,
 	);
-	#timeout: NodeJS.Timeout | null = null;
-	#toolWaiters: Array<(message: ToolCallMessage) => void> = [];
-	#pendingToolCalls: ToolCallMessage[] = [];
-	/** Live cell children the worker reported; retired by the host when the worker itself is lost. */
-	readonly #childPids = new Set<number>();
-	readonly #memory: KernelMemoryPolicy | null;
-	readonly #interruptBounds: JavaScriptInterruptBounds;
+	readonly #toolCalls = new ToolCallQueue();
+	readonly #children: WorkerChildren;
+	readonly #memory: KernelMemoryBridge;
+	readonly #activeCell: ActiveCellControl;
+	readonly #recovery = new WorkerRecovery({
+		runs: this.#runs,
+		isOpen: () => this.#lifecycle === "open",
+		ensureReady: () => this.#ensureReady(),
+		startNext: () => this.#startNext(),
+	});
 
 	constructor(options: JavaScriptKernelOptions) {
 		this.#options = options;
-		this.#interruptBounds = options.interruptBounds ?? DEFAULT_INTERRUPT_BOUNDS;
-		this.#memory = options.memory === undefined ? null : new KernelMemoryPolicy("js", options.memory);
+		this.#activeCell = new ActiveCellControl({
+			runs: this.#runs,
+			bounds: options.interruptBounds ?? DEFAULT_INTERRUPT_BOUNDS,
+			post: (message) => this.#slot.postMessage(message),
+			terminate: () => this.#terminate(),
+			recover: () => void this.#recovery.recover(() => Promise.resolve()),
+			clearToolCalls: () => this.#toolCalls.clear(),
+		});
+		this.#memory = new KernelMemoryBridge(options.memory, options.onMemoryCollected);
+		this.#children = new WorkerChildren(options.collectOrphanedChildren);
 		this.#moduleLoader = new LocalModuleLoader(options);
 		this.#slot = new WorkerSlot(options, {
 			isOpen: () => this.#lifecycle === "open",
@@ -80,6 +80,17 @@ export class JavaScriptKernel {
 		return this.#slot.mode;
 	}
 
+	/** The last heap reading the worker sent (a result, an idle collection, a query); none before the first. */
+	get lastLiveBytes(): number | undefined {
+		return this.#memory.lastLiveBytes;
+	}
+
+	/** A heap reading taken between cells without running one; nothing when no worker is live to ask. */
+	async queryMemory(): Promise<JavaScriptMemoryReading | undefined> {
+		if (this.#lifecycle !== "open" || !this.#slot.present || this.#slot.startingUp) return undefined;
+		return await this.#memory.query((message) => this.#slot.postMessage(message));
+	}
+
 	get kernelToolEvents(): EventTarget {
 		return this.#kernelTools.events;
 	}
@@ -125,15 +136,15 @@ export class JavaScriptKernel {
 			await this.#restartAfterStop();
 			return { stateRetained: Promise.resolve(false) };
 		}
-		this.#clearTimeout();
-		const stop = await this.#stopActive(active, reason, `JS cell interrupted: ${reason}`);
+		this.#activeCell.disarm();
+		const stop = await this.#activeCell.stop(active, reason, `JS cell interrupted: ${reason}`);
 		return { stateRetained: Promise.resolve(stop.retained), ...(stop.note === undefined ? {} : { note: stop.note }) };
 	}
 
 	async reset(): Promise<void> {
 		assertJavaScriptKernelOpen(this.#lifecycle, "reset");
 		await this.#terminate();
-		this.#clearToolCalls();
+		this.#toolCalls.clear();
 		assertJavaScriptKernelOpen(this.#lifecycle, "reset");
 		await this.#ensureReady();
 		this.#startNext();
@@ -144,9 +155,7 @@ export class JavaScriptKernel {
 	}
 
 	async nextToolCall(): Promise<ToolCallMessage> {
-		const pending = this.#pendingToolCalls.shift();
-		if (pending) return pending;
-		return await new Promise((resolve) => this.#toolWaiters.push(resolve));
+		return await this.#toolCalls.next();
 	}
 
 	async close(): Promise<void> {
@@ -155,8 +164,8 @@ export class JavaScriptKernel {
 		this.#lifecycle = "closing";
 		this.#runs.settleAll("JS kernel closed");
 		this.#kernelTools.rejectAll(kernelToolError("kernel_tool_stale", "JS kernel closed"));
-		this.#clearToolCalls();
-		const recovery = this.#recovery;
+		this.#toolCalls.clear();
+		const recovery = this.#recovery.inFlight;
 		const closePromise = (async () => {
 			if (recovery) await recovery;
 			await this.#terminate();
@@ -169,7 +178,7 @@ export class JavaScriptKernel {
 
 	#activate(): void {
 		if (this.#activation || this.#lifecycle !== "open" || this.#runs.active || !this.#runs.hasWaiting) return;
-		const activation = this.#activateWhenReady();
+		const activation = this.#recovery.bringUp();
 		this.#activation = activation;
 		void activation.then(() => {
 			if (this.#activation === activation) this.#activation = null;
@@ -177,16 +186,6 @@ export class JavaScriptKernel {
 		});
 	}
 
-	async #activateWhenReady(): Promise<void> {
-		try {
-			await this.#ensureReady();
-			if (this.#lifecycle === "open") this.#startNext();
-		} catch (error) {
-			if (error instanceof WorkerStartupCancelledError) return;
-			this.#runs.rejectWaiting(error instanceof Error ? error : new Error(String(error)));
-		}
-	}
-
 	async #ensureReady(): Promise<void> {
 		assertJavaScriptKernelOpen(this.#lifecycle, "run");
 		await this.#slot.ensureReady();
@@ -196,9 +195,7 @@ export class JavaScriptKernel {
 		if (this.#lifecycle !== "open" || this.#runs.active || !this.#slot.present) return;
 		const next = this.#runs.startNext(performance.now());
 		if (!next) return;
-		if (next.input.timeoutMs) {
-			this.#timeout = setTimeout(() => void this.#timeoutActive(next), next.input.timeoutMs);
-		}
+		this.#activeCell.arm(next);
 		this.#slot.postMessage({
 			type: "kernel-tools-names",
 			hostToolNames: resolveKernelToolNameSource(this.#options.hostToolNames),
@@ -212,178 +209,62 @@ export class JavaScriptKernel {
 		});
 	}
 
-	async #timeoutActive(run: PendingJavaScriptRun): Promise<void> {
-		if (this.#runs.active !== run || run.settled) return;
-		const durationMs = run.input.timeoutMs ?? 0;
-		await this.#stopActive(
-			run,
-			`timed out after ${durationMs}ms`,
-			`JS cell timed out after ${durationMs}ms`,
-			durationMs,
-		);
-	}
-
-	/**
-	 * Asks the worker to settle the active cell cooperatively (rejecting its bridge calls and killing its
-	 * children); only a cell that stays unsettled past the grace costs the worker VM. Reports whether the
-	 * worker state survived and, when a blocked worker had to be abandoned, the note that explains it.
-	 */
-	async #stopActive(
-		run: PendingJavaScriptRun,
-		reason: string,
-		message: string,
-		durationMs = 0,
-	): Promise<{ readonly retained: boolean; readonly note?: string }> {
-		try {
-			run.interruptResult = { type: "result", cellId: run.input.cellId, ok: false, error: { message }, durationMs };
-			run.interruptAck ??= Promise.withResolvers<void>();
-			this.#slot.postMessage({ type: "interrupt", reason });
-			if ((await awaitCooperativeSettlement(run, this.#interruptBounds)) === "settled") {
-				return { retained: run.settledByWorker };
-			}
-			if (!this.#runs.releaseActive(run)) return { retained: run.settledByWorker };
-			const retirement = await this.#terminate();
-			this.#runs.settle(run, restartedResult(run, message));
-			void this.#recover(() => Promise.resolve());
-			return restartOutcome(run, retirement, this.#interruptBounds);
-		} finally {
-			this.#clearToolCalls();
-		}
-	}
-
 	async #restartAfterStop(): Promise<void> {
-		await this.#recover(() => this.#terminate());
-	}
-
-	/** One recovery at a time: retire through `retire` (a no-op when the worker is already gone), then bring a fresh worker up. */
-	async #recover(retire: () => Promise<unknown>): Promise<void> {
-		if (this.#recovery) return await this.#recovery;
-		const recovery = this.#performRecovery(retire);
-		this.#recovery = recovery;
-		try {
-			await recovery;
-		} finally {
-			if (this.#recovery === recovery) this.#recovery = null;
-		}
-	}
-
-	async #performRecovery(retire: () => Promise<unknown>): Promise<void> {
-		try {
-			await retire();
-			if (this.#lifecycle !== "open") return;
-			await this.#ensureReady();
-			if (this.#lifecycle === "open") this.#startNext();
-		} catch (error) {
-			if (error instanceof WorkerStartupCancelledError) return;
-			this.#runs.rejectWaiting(error instanceof Error ? error : new Error(String(error)));
-		}
+		await this.#recovery.recover(() => this.#terminate());
 	}
 
 	#handleMessage(message: KernelToHostMessage): void {
 		if (this.#kernelTools.consume(message) && message.type !== "tool-call") return;
+		if (this.#memory.consume(message)) return;
 		if (message.type === "status" && message.event.op === INTERRUPT_ACK_OP) {
 			this.#runs.acknowledgeInterrupt(message.event);
 			return;
 		}
 		if (message.type === "status" && message.event.op === CHILD_LIFECYCLE_OP) {
-			this.#trackChildEvent(message.event);
-			return;
-		}
-		if (message.type === "status" && message.event.op === MEMORY_COLLECTED_OP) {
-			const liveBytes = message.event.liveBytes;
-			if (typeof liveBytes !== "number") return;
-			this.#memory?.observeLive(liveBytes);
-			this.#options.onMemoryCollected?.(liveBytes);
+			this.#children.track(message.event);
 			return;
 		}
 		(this.#runs.active?.input.onMessage ?? this.#options.onMessage)?.(message);
 		if (message.type === "tool-call") {
-			const waiter = this.#toolWaiters.shift();
-			if (waiter) waiter(message);
-			else {
-				this.#pendingToolCalls.push(message);
-				if (this.#pendingToolCalls.length > MAX_PENDING_TOOL_CALLS) this.#pendingToolCalls.shift();
-			}
+			this.#toolCalls.push(message);
 			return;
 		}
 		if (message.type !== "result") return;
 		const active = this.#runs.active;
 		if (!active || active.input.cellId !== message.cellId) return;
-		this.#clearTimeout();
+		this.#activeCell.disarm();
 		this.#runs.releaseActive(active);
 		active.settledByWorker = true;
-		this.#runs.settle(active, active.interruptResult ?? this.#withMemoryPolicy(message));
+		this.#runs.settle(active, active.interruptResult ?? this.#memory.settled(message));
 		this.#startNext();
-		this.#recycleOverCeilingWhenIdle();
-	}
-
-	#withMemoryPolicy(message: ResultMessage): ResultMessage {
-		if (this.#memory === null || message.memory === undefined) return message;
-		return { ...message, memory: this.#memory.annotate(message.memory) };
-	}
-
-	/** A kernel over its memory ceiling restarts only once no cell is running or queued on it. */
-	#recycleOverCeilingWhenIdle(): void {
-		if (this.#memory?.recyclePending !== true || this.#runs.active || this.#runs.hasWaiting) return;
-		this.#memory.recycleStarted();
-		void this.#restartAfterStop();
+		// A kernel over its memory ceiling restarts only once no cell is running or queued on it.
+		if (this.#memory.claimRecycle(!this.#runs.active && !this.#runs.hasWaiting)) void this.#restartAfterStop();
 	}
 
 	#handleCrash(error: Error): void {
 		const active = this.#runs.active;
 		if (!active && this.#slot.startingUp) return;
-		this.#clearTimeout();
+		this.#activeCell.disarm();
 		this.#kernelTools.rejectAll(kernelToolError("kernel_tool_stale", error.message));
+		this.#memory.workerLost(error);
 		if (active) {
 			this.#runs.releaseActive(active);
-			this.#runs.settle(active, {
-				type: "result",
-				cellId: active.input.cellId,
-				ok: false,
-				error: bridgeError(error),
-				durationMs: this.#runs.durationMs(active, performance.now()),
-			});
+			this.#runs.settle(
+				active,
+				crashedResult(active.input.cellId, error, this.#runs.durationMs(active, performance.now())),
+			);
 		}
-		this.#clearToolCalls();
+		this.#toolCalls.clear();
 		void this.#restartAfterStop();
 	}
 
-	#clearToolCalls(): void {
-		this.#pendingToolCalls.length = 0;
-		this.#toolWaiters.length = 0;
-	}
-
-	#clearTimeout(): void {
-		if (this.#timeout) clearTimeout(this.#timeout);
-		this.#timeout = null;
-	}
-
-	#trackChildEvent(event: EvalStatusEvent): void {
-		const pid = event.pid;
-		if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 0) return;
-		if (event.state === "spawned") this.#childPids.add(pid);
-		else if (event.state === "exited") this.#childPids.delete(pid);
-	}
-
-	/**
-	 * Retire the worker, then whatever cell children it still owned: a terminated or crashed worker never
-	 * reaches its own cell-end cleanup, and a pid `ps` no longer lists as our child was reused and is skipped.
-	 */
+	/** Retire the worker, then whatever cell children it still owned. */
 	async #terminate(): Promise<WorkerRetirement> {
-		this.#clearTimeout();
+		this.#activeCell.disarm();
 		this.#kernelTools.rejectAll(kernelToolError("kernel_tool_stale", "JavaScript worker reset"));
-		this.#memory?.kernelRetired();
+		this.#memory.workerLost(new Error("JavaScript worker reset"));
 		const retirement = await this.#slot.retire();
-		await this.#retireWorkerChildren();
+		await this.#children.retire();
 		return retirement;
 	}
-
-	async #retireWorkerChildren(): Promise<void> {
-		if (this.#childPids.size === 0) return;
-		const pids = [...this.#childPids];
-		this.#childPids.clear();
-		await terminateProcessTrees(pids, { graceMs: WORKER_LOSS_CHILD_GRACE_MS, ownerPid: process.pid });
-		// The worker that owned these children and their exit watchers is gone, so nothing else will wait on them.
-		await this.#options.collectOrphanedChildren?.(pids);
-	}
 }