@crowdedkingdoms/crowdyjs 8.21.1 → 9.0.0

package/dist/player-runtime/player-code-broker.js

@@ -1,4 +1,4 @@
-import { wrapGlueSab, writeGlueResult } from './glue-sab.js';
+import { GLUE_HOST_CALL_TIMEOUT_MS, SAB_HEADER_BYTES, wrapGlueSab, writeGlueResult, } from './glue-sab.js';
 /**
  * Deny-by-default host-call allowlist, grouped by capability (04 §4). Only
  * owner-lawful reads and effects cross the bridge; auth, admin, authoring,
@@ -57,6 +57,22 @@ for (const [group, fns] of Object.entries(ALLOWED_HOST_CALLS)) {
 }
 const RATE_WINDOW_MS = 1000;
 const CIRCUIT_TRIP_THRESHOLD = 5;
+const GLOBAL_HOST_CALL_CAP = 1000;
+const MAX_HOST_CALL_FN_BYTES = 128;
+const MAX_HOST_CALL_ARGS_BYTES = 256 * 1024;
+const HOST_CALL_ENVELOPE_KEYS = new Set([
+    'type',
+    'id',
+    'fn',
+    'args',
+    'reply',
+]);
+const FORBIDDEN_BINDING_KEYS = new Set([
+    'authority',
+    'bindingKind',
+    'binding_kind',
+]);
+const utf8Encoder = new TextEncoder();
 /**
  * Page-side security broker for browser-target player WASM (production shape,
  * player compute P3).
@@ -81,44 +97,52 @@ export class PlayerCodeBroker {
     constructor(options) {
         this.options = options;
         this.worker = null;
+        this.workerListener = null;
+        this.artifact = null;
         this.circuitOpen = false;
         this.consecutiveTraps = 0;
+        this.hardTimeouts = 0;
         this.rateBuckets = new Map();
-        this.onMessage = (event) => {
-            void this.handleMessage(event.data);
-        };
+        this.globalCallBucket = [];
+        this.generation = 0;
+        this.lifecycleVersion = 0;
+        this.starting = false;
+        this.workerReady = false;
+        this.startupTimer = null;
+        this.dispatchTimer = null;
+        this.activeDispatch = null;
     }
     /**
      * Start the worker on a platform-fetched artifact. Verifies the artifact
-     * hash (side-load refusal, T7) before handing bytes to the worker, and
-     * forwards the fuel budget so the glue can trap a runaway dispatch.
+     * hash (side-load refusal, T7) before handing bytes to the worker. A retained
+     * copy allows the page-side hard watchdog to replace a wedged worker.
      */
     async start(artifact) {
-        if (this.worker)
+        if (this.worker || this.starting) {
             throw new Error('PlayerCodeBroker is already started');
+        }
         if (this.circuitOpen) {
             throw new Error('player code circuit is open; reset before starting');
         }
-        if (this.options.artifactHash) {
-            const actual = await this.hash(artifact);
-            if (actual !== this.options.artifactHash) {
-                throw new Error('refusing to run an artifact that was not fetched from the platform');
+        const lifecycleVersion = ++this.lifecycleVersion;
+        this.starting = true;
+        try {
+            if (this.options.artifactHash) {
+                const actual = await this.hash(artifact);
+                if (actual !== this.options.artifactHash) {
+                    throw new Error('refusing to run an artifact that was not fetched from the platform');
+                }
+            }
+            if (lifecycleVersion !== this.lifecycleVersion) {
+                throw new Error('PlayerCodeBroker start was cancelled');
             }
+            this.artifact = artifact.slice(0);
+            this.spawnWorker();
+        }
+        finally {
+            if (lifecycleVersion === this.lifecycleVersion)
+                this.starting = false;
         }
-        const factory = this.options.workerFactory ??
-            ((url) => new Worker(url, { type: 'module' }));
-        this.worker = factory(this.options.workerUrl);
-        this.worker.addEventListener('message', this.onMessage);
-        this.worker.postMessage({
-            type: 'init',
-            artifact,
-            authority: 'player',
-            fuelPerDispatch: this.options.fuelPerDispatch != null
-                ? this.options.fuelPerDispatch.toString()
-                : undefined,
-            watchdogMs: this.options.dispatchWatchdogMs ?? 250,
-            tickIntervalMs: this.options.tickIntervalMs ?? 0,
-        }, [artifact]);
     }
     /** Terminate + respawn on a fresh artifact — the client hot-reload path. */
     async restart(artifact) {
@@ -126,47 +150,119 @@ export class PlayerCodeBroker {
         await this.start(artifact);
     }
     stop() {
-        if (!this.worker)
-            return;
-        this.worker.removeEventListener('message', this.onMessage);
-        this.worker.terminate();
-        this.worker = null;
+        this.lifecycleVersion += 1;
+        this.starting = false;
+        this.stopWorker();
+        this.artifact = null;
     }
     /** Clear a tripped circuit so the caller can start again after a fix. */
     resetCircuit() {
         this.circuitOpen = false;
         this.consecutiveTraps = 0;
+        this.hardTimeouts = 0;
         this.rateBuckets.clear();
+        this.globalCallBucket = [];
     }
-    async handleMessage(raw) {
-        if (!this.worker || !isRecord(raw))
+    async handleMessage(raw, generation, sourceWorker) {
+        if (this.worker !== sourceWorker ||
+            generation !== this.generation ||
+            !isRecord(raw)) {
             return;
+        }
+        if (raw.type === 'ready') {
+            this.workerReady = true;
+            this.clearStartupTimer();
+            return;
+        }
+        if (raw.type === 'dispatch-start') {
+            if (!Number.isSafeInteger(raw.id) || raw.id <= 0) {
+                this.recycleWorker('invalid dispatch-start id');
+                return;
+            }
+            if (this.activeDispatch) {
+                this.recycleWorker('overlapping guest dispatches');
+                return;
+            }
+            this.activeDispatch = {
+                generation,
+                id: raw.id,
+                kind: typeof raw.kind === 'string' ? raw.kind : 'unknown',
+            };
+            this.armDispatchTimer(generation, raw.id);
+            return;
+        }
         if (raw.type === 'trap') {
-            this.recordTrap(typeof raw.reason === 'string' ? raw.reason : 'trap');
+            this.finishDispatch(generation, raw.id);
+            const reason = typeof raw.reason === 'string' ? raw.reason : 'trap';
+            const detail = typeof raw.detail === 'string' ? raw.detail : '';
+            const trapKind = typeof raw.kind === 'string' ? raw.kind : '';
+            if (reason === 'watchdog' || /host call timed out/i.test(detail)) {
+                this.recycleWorker(/host call timed out/i.test(detail) ? 'hostcall-timeout' : reason);
+            }
+            else if (trapKind === 'startup' || trapKind === 'init') {
+                this.stopWorker();
+                this.recordTrap(reason);
+            }
+            else {
+                this.recordTrap(reason);
+            }
             return;
         }
         if (raw.type === 'dispatch-ok') {
-            this.consecutiveTraps = 0;
+            const kind = this.activeDispatch?.kind;
+            this.finishDispatch(generation, raw.id);
+            if (kind && kind !== 'init') {
+                this.consecutiveTraps = 0;
+                this.hardTimeouts = 0;
+            }
             return;
         }
         if (raw.type !== 'hostcall')
             return;
+        this.armHostCallTimer(generation);
+        if (!this.enforceGlobalRate())
+            return;
         const id = raw.id;
         try {
-            if (typeof id !== 'number')
+            if (!Number.isSafeInteger(id) || id < 0) {
                 throw new Error('invalid hostcall id');
+            }
+            for (const key of Object.keys(raw)) {
+                if (!HOST_CALL_ENVELOPE_KEYS.has(key)) {
+                    throw new Error(`unexpected hostcall envelope field '${key}'`);
+                }
+            }
             if (typeof raw.fn !== 'string')
                 throw new Error('missing host call fn');
+            if (raw.fn.length === 0 ||
+                utf8Encoder.encode(raw.fn).length > MAX_HOST_CALL_FN_BYTES) {
+                throw new Error('invalid host call fn');
+            }
             const group = FN_TO_GROUP.get(raw.fn);
             if (!group) {
                 throw new Error('host call is not allowed in the player browser sandbox');
             }
-            if (!isRecord(raw.args)) {
+            if (!isPlainRecord(raw.args)) {
                 // Confused-deputy guard: reject malformed payloads outright rather
                 // than coercing them (09 T7).
-                throw new Error('host call args must be an object');
+                throw new Error('host call args must be a plain object');
             }
             const args = raw.args;
+            for (const key of FORBIDDEN_BINDING_KEYS) {
+                if (Object.prototype.hasOwnProperty.call(args, key)) {
+                    throw new Error(`host call cannot override '${key}'`);
+                }
+            }
+            let encodedArgs;
+            try {
+                encodedArgs = utf8Encoder.encode(JSON.stringify(args));
+            }
+            catch {
+                throw new Error('host call args must be JSON-serializable');
+            }
+            if (encodedArgs.length > MAX_HOST_CALL_ARGS_BYTES) {
+                throw new Error('host call args exceed the browser sandbox limit');
+            }
             this.enforceRate(group, raw.fn);
             this.assertGridScope(raw.fn, args);
             let data;
@@ -179,7 +275,12 @@ export class PlayerCodeBroker {
                     low: { x: low.x.toString(), y: low.y.toString(), z: low.z.toString() },
                     high: { x: high.x.toString(), y: high.y.toString(), z: high.z.toString() },
                 };
-                this.reply(raw.reply, id, { type: 'hostcall-result', id, ok: true, data });
+                this.reply(sourceWorker, generation, raw.reply, id, {
+                    type: 'hostcall-result',
+                    id,
+                    ok: true,
+                    data,
+                });
                 return;
             }
             if (PRESENTATION_FUNCTIONS.has(raw.fn)) {
@@ -194,10 +295,15 @@ export class PlayerCodeBroker {
             else {
                 data = await this.options.onHostCall({ fn: raw.fn, args });
             }
-            this.reply(raw.reply, id, { type: 'hostcall-result', id, ok: true, data });
+            this.reply(sourceWorker, generation, raw.reply, id, {
+                type: 'hostcall-result',
+                id,
+                ok: true,
+                data,
+            });
         }
         catch (error) {
-            this.reply(raw.reply, id, {
+            this.reply(sourceWorker, generation, raw.reply, id, {
                 type: 'hostcall-result',
                 id,
                 ok: false,
@@ -214,15 +320,173 @@ export class PlayerCodeBroker {
      * runs its message handler), so the SAB write is the load-bearing path in
      * the browser; the postMessage is harmless there.
      */
-    reply(replyBuffer, _id, message) {
-        this.worker?.postMessage(message);
-        if (typeof SharedArrayBuffer !== 'undefined' && replyBuffer instanceof SharedArrayBuffer) {
-            const view = wrapGlueSab(replyBuffer);
-            const envelope = message.ok
-                ? { ok: true, data: message.data }
-                : { ok: false, error: message.error };
-            writeGlueResult(view, envelope);
+    reply(sourceWorker, generation, replyBuffer, id, message) {
+        if (this.worker !== sourceWorker || generation !== this.generation)
+            return;
+        let sabAttempted = false;
+        let delivered = false;
+        if (typeof SharedArrayBuffer !== 'undefined' &&
+            replyBuffer instanceof SharedArrayBuffer &&
+            replyBuffer.byteLength >= SAB_HEADER_BYTES) {
+            sabAttempted = true;
+            try {
+                const view = wrapGlueSab(replyBuffer);
+                const envelope = message.ok
+                    ? { ok: true, data: message.data }
+                    : { ok: false, error: message.error };
+                delivered = writeGlueResult(view, envelope, id);
+            }
+            catch {
+                // The async postMessage result above is still delivered. A forged or
+                // undersized SAB must not turn a denied worker request into an
+                // unhandled page-side rejection.
+            }
+        }
+        if (!sabAttempted || delivered) {
+            try {
+                sourceWorker.postMessage(message);
+            }
+            catch {
+                // The SAB is authoritative in production. An async mirror that cannot
+                // be cloned must not strand a successfully delivered synchronous reply.
+            }
         }
+        if (delivered)
+            this.resumeDispatchWatchdog(generation);
+    }
+    spawnWorker() {
+        if (!this.artifact || this.circuitOpen)
+            return;
+        const factory = this.options.workerFactory ??
+            ((url) => new Worker(url, { type: 'module' }));
+        const worker = factory(this.options.workerUrl);
+        const generation = ++this.generation;
+        const listener = (event) => {
+            void this.handleMessage(event.data, generation, worker);
+        };
+        this.worker = worker;
+        this.workerListener = listener;
+        this.workerReady = false;
+        worker.addEventListener('message', listener);
+        const workerArtifact = this.artifact.slice(0);
+        try {
+            worker.postMessage({
+                type: 'init',
+                artifact: workerArtifact,
+                authority: 'player',
+                fuelPerDispatch: this.options.fuelPerDispatch?.toString(),
+                hostCallTimeoutMs: this.options.hostCallTimeoutMs ?? GLUE_HOST_CALL_TIMEOUT_MS,
+                tickIntervalMs: this.options.tickIntervalMs ?? 0,
+            }, [workerArtifact]);
+            this.armStartupTimer(generation);
+        }
+        catch (error) {
+            this.stopWorker();
+            throw error;
+        }
+    }
+    stopWorker() {
+        this.clearStartupTimer();
+        this.clearDispatchTimer();
+        this.activeDispatch = null;
+        this.workerReady = false;
+        const worker = this.worker;
+        const listener = this.workerListener;
+        this.worker = null;
+        this.workerListener = null;
+        if (!worker)
+            return;
+        if (listener)
+            worker.removeEventListener('message', listener);
+        worker.terminate();
+    }
+    armStartupTimer(generation) {
+        this.clearStartupTimer();
+        const timeoutMs = this.options.startupWatchdogMs ??
+            Math.max(5000, (this.options.dispatchWatchdogMs ?? 250) * 4);
+        this.startupTimer = setTimeout(() => {
+            if (generation === this.generation &&
+                this.worker &&
+                !this.workerReady) {
+                this.recycleWorker('startup-watchdog');
+            }
+        }, timeoutMs);
+    }
+    clearStartupTimer() {
+        if (this.startupTimer)
+            clearTimeout(this.startupTimer);
+        this.startupTimer = null;
+    }
+    armDispatchTimer(generation, id) {
+        this.clearDispatchTimer();
+        this.dispatchTimer = setTimeout(() => {
+            if (this.activeDispatch?.generation === generation &&
+                this.activeDispatch.id === id) {
+                this.recycleWorker('dispatch-watchdog');
+            }
+        }, this.options.dispatchWatchdogMs ?? 250);
+    }
+    armHostCallTimer(generation) {
+        if (this.activeDispatch?.generation !== generation ||
+            !this.worker) {
+            return;
+        }
+        const id = this.activeDispatch.id;
+        this.clearDispatchTimer();
+        this.dispatchTimer = setTimeout(() => {
+            if (this.activeDispatch?.generation === generation &&
+                this.activeDispatch.id === id) {
+                this.recycleWorker('hostcall-timeout');
+            }
+        }, this.options.hostCallTimeoutMs ?? GLUE_HOST_CALL_TIMEOUT_MS);
+    }
+    resumeDispatchWatchdog(generation) {
+        if (this.activeDispatch?.generation !== generation)
+            return;
+        this.armDispatchTimer(generation, this.activeDispatch.id);
+    }
+    finishDispatch(generation, id) {
+        if (!Number.isSafeInteger(id) ||
+            this.activeDispatch?.generation !== generation ||
+            this.activeDispatch.id !== id) {
+            return;
+        }
+        this.clearDispatchTimer();
+        this.activeDispatch = null;
+    }
+    clearDispatchTimer() {
+        if (this.dispatchTimer)
+            clearTimeout(this.dispatchTimer);
+        this.dispatchTimer = null;
+    }
+    recycleWorker(reason) {
+        if (!this.worker || this.circuitOpen)
+            return;
+        this.hardTimeouts += 1;
+        this.consecutiveTraps += 1;
+        this.stopWorker();
+        if (this.hardTimeouts >= CIRCUIT_TRIP_THRESHOLD) {
+            this.openCircuit(reason);
+            return;
+        }
+        this.spawnWorker();
+    }
+    openCircuit(reason) {
+        if (this.circuitOpen)
+            return;
+        this.circuitOpen = true;
+        this.stopWorker();
+        this.options.onCircuitOpen?.(reason);
+    }
+    enforceGlobalRate() {
+        const now = Date.now();
+        this.globalCallBucket = this.globalCallBucket.filter((timestamp) => now - timestamp < RATE_WINDOW_MS);
+        if (this.globalCallBucket.length >= GLOBAL_HOST_CALL_CAP) {
+            this.openCircuit('global host-call rate exceeded');
+            return false;
+        }
+        this.globalCallBucket.push(now);
+        return true;
     }
     enforceRate(group, fn) {
         const cap = RATE_CAPS[group] ?? 60;
@@ -237,9 +501,7 @@ export class PlayerCodeBroker {
     recordTrap(reason) {
         this.consecutiveTraps += 1;
         if (this.consecutiveTraps >= CIRCUIT_TRIP_THRESHOLD && !this.circuitOpen) {
-            this.circuitOpen = true;
-            this.stop();
-            this.options.onCircuitOpen?.(reason);
+            this.openCircuit(reason);
         }
     }
     assertGridScope(fn, args) {
@@ -276,7 +538,26 @@ export class PlayerCodeBroker {
 function isRecord(value) {
     return value !== null && typeof value === 'object' && !Array.isArray(value);
 }
+function isPlainRecord(value) {
+    if (!isRecord(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
 function toBigInt(value) {
+    if (typeof value === 'string' &&
+        !/^-?(0|[1-9][0-9]*)$/.test(value)) {
+        throw new Error('chunk coordinates must be decimal integer strings');
+    }
+    if (typeof value === 'number' &&
+        (!Number.isSafeInteger(value) || !Number.isFinite(value))) {
+        throw new Error('chunk coordinates must be safe integers or decimal strings');
+    }
+    if (typeof value !== 'string' &&
+        typeof value !== 'number' &&
+        typeof value !== 'bigint') {
+        throw new Error('chunk coordinates must be integers');
+    }
     try {
         return BigInt(value);
     }

package/dist/player-runtime/player-glue-worker.d.ts

@@ -13,8 +13,9 @@
  *  - `ck.host_call` blocks the worker on a SharedArrayBuffer while the
  *    page-side broker services the (async) server-authorized call and writes
  *    the reply back, so the guest sees a synchronous gateway,
- *  - it enforces a per-dispatch wall-clock watchdog and reports traps to the
- *    broker, which owns the local circuit breaker.
+ *  - it announces each dispatch before entering WASM; the page-side broker
+ *    owns the hard watchdog and can terminate this worker if WASM never
+ *    returns. The local elapsed-time helper only classifies completed calls.
  *
  * Re-exports the pure helpers + the runtime so tests and bundlers can use
  * them without touching worker globals.

package/dist/player-runtime/player-glue-worker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"player-glue-worker.d.ts","sourceRoot":"","sources":["../../src/player-runtime/player-glue-worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,KAAK,eAAe,EACpB,KAAK,kBAAkB,GACxB,CAAC;AAOF;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,gBAAgB,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,YAAY,KAAK,IAAI,KAAK,IAAI,CAAC;IACrE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,KAAK,IAAI,CAAC;IACrD,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;CACzC,GAAG,IAAI,CAuGP"}
+{"version":3,"file":"player-glue-worker.d.ts","sourceRoot":"","sources":["../../src/player-runtime/player-glue-worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAS3B,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,KAAK,eAAe,EACpB,KAAK,kBAAkB,GACxB,CAAC;AAOF;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,gBAAgB,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,YAAY,KAAK,IAAI,KAAK,IAAI,CAAC;IACrE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,KAAK,IAAI,CAAC;IACrD,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;CACzC,GAAG,IAAI,CAkJP"}

package/dist/player-runtime/player-glue-worker.js

@@ -13,14 +13,15 @@
  *  - `ck.host_call` blocks the worker on a SharedArrayBuffer while the
  *    page-side broker services the (async) server-authorized call and writes
  *    the reply back, so the guest sees a synchronous gateway,
- *  - it enforces a per-dispatch wall-clock watchdog and reports traps to the
- *    broker, which owns the local circuit breaker.
+ *  - it announces each dispatch before entering WASM; the page-side broker
+ *    owns the hard watchdog and can terminate this worker if WASM never
+ *    returns. The local elapsed-time helper only classifies completed calls.
  *
  * Re-exports the pure helpers + the runtime so tests and bundlers can use
  * them without touching worker globals.
  */
 import { GlueRuntime, GLUE_HOST_FUNCTIONS, parseFuelBudget, runWithWatchdog, } from './glue-runtime.js';
-import { createGlueSab, armGlueRequest, waitAndReadGlueReply, } from './glue-sab.js';
+import { createGlueSab, armGlueRequest, GLUE_HOST_CALL_TIMEOUT_MS, waitAndReadGlueReply, } from './glue-sab.js';
 export { GlueRuntime, GLUE_HOST_FUNCTIONS, parseFuelBudget, runWithWatchdog, };
 /**
  * Wire the glue runtime to a worker-like message port. Exported (not just
@@ -31,7 +32,8 @@ export function startGlueWorker(port) {
     let runtime = null;
     let sab = null;
     let hostCallId = 0;
-    let watchdogMs = 250;
+    let dispatchId = 0;
+    let hostCallTimeoutMs = GLUE_HOST_CALL_TIMEOUT_MS;
     let ticking = false;
     const post = (message) => port.postMessage(message);
     // Synchronous gateway: post the request (so the page can see it), then
@@ -46,8 +48,9 @@ export function startGlueWorker(port) {
         catch {
             throw new Error('host_call request was not valid JSON');
         }
-        const id = ++hostCallId;
-        armGlueRequest(sab);
+        hostCallId = (hostCallId % 0x7ffffffe) + 1;
+        const id = hostCallId;
+        armGlueRequest(sab, id);
         post({
             type: 'hostcall',
             id,
@@ -55,34 +58,59 @@ export function startGlueWorker(port) {
             args: parsed.args ?? {},
             reply: sab.sab,
         });
-        return waitAndReadGlueReply(sab);
+        return waitAndReadGlueReply(sab, id, hostCallTimeoutMs);
     };
+    const beginDispatch = (kind) => {
+        dispatchId = (dispatchId % 0x7ffffffe) + 1;
+        post({ type: 'dispatch-start', id: dispatchId, kind });
+        return dispatchId;
+    };
+    const report = (id, kind, result) => {
+        if (result.ok)
+            post({ type: 'dispatch-ok', id, kind });
+        else {
+            post({
+                type: 'trap',
+                id,
+                kind,
+                reason: result.reason,
+                detail: result.detail,
+            });
+        }
+    };
+    // Trap classification remains local, but wall-clock enforcement is entirely
+    // page-side so time blocked on an authorized async host call is excluded.
+    const runDispatch = (dispatch) => runWithWatchdog(dispatch, Number.POSITIVE_INFINITY);
     const onInit = async (init) => {
-        watchdogMs = init.watchdogMs ?? 250;
-        void parseFuelBudget(init.fuelPerDispatch);
+        hostCallTimeoutMs =
+            init.hostCallTimeoutMs ?? GLUE_HOST_CALL_TIMEOUT_MS;
         sab = createGlueSab();
+        const fuelPerDispatch = parseFuelBudget(init.fuelPerDispatch);
         runtime = new GlueRuntime({
             hostCallSync,
             onLog: (level, message) => post({ type: 'log', level, message }),
+            fuelPerDispatch,
         });
         try {
             await runtime.instantiate(init.artifact);
-            const initResult = await runWithWatchdog(() => runtime.init(), watchdogMs);
-            report(initResult);
+            const id = beginDispatch('init');
+            const initResult = await runDispatch(() => runtime.init());
+            report(id, 'init', initResult);
+            if (!initResult.ok)
+                return;
             if ((init.tickIntervalMs ?? 0) > 0)
                 startTicking(init.tickIntervalMs);
             post({ type: 'ready' });
         }
         catch (err) {
-            post({ type: 'trap', reason: 'trap', detail: err.message });
+            post({
+                type: 'trap',
+                kind: 'startup',
+                reason: 'trap',
+                detail: err.message,
+            });
         }
     };
-    const report = (result) => {
-        if (result.ok)
-            post({ type: 'dispatch-ok' });
-        else
-            post({ type: 'trap', reason: result.reason, detail: result.detail });
-    };
     const startTicking = (intervalMs) => {
         if (ticking)
             return;
@@ -94,7 +122,8 @@ export function startGlueWorker(port) {
             const nowT = Date.now();
             const dt = nowT - last;
             last = nowT;
-            void runWithWatchdog(() => runtime.tick(dt), watchdogMs).then(report);
+            const id = beginDispatch('tick');
+            void runDispatch(() => runtime.tick(dt)).then((result) => report(id, 'tick', result));
             setTimeout(loop, intervalMs);
         };
         setTimeout(loop, intervalMs);
@@ -106,22 +135,29 @@ export function startGlueWorker(port) {
         if (msg.type === 'init')
             void onInit(msg);
         else if (msg.type === 'tick' && runtime) {
-            void runWithWatchdog(() => runtime.tick(typeof msg.dtMs === 'number' ? msg.dtMs : 0), watchdogMs).then(report);
+            const id = beginDispatch('tick');
+            void runDispatch(() => runtime.tick(typeof msg.dtMs === 'number' ? msg.dtMs : 0)).then((result) => report(id, 'tick', result));
         }
         else if (msg.type === 'invoke' && runtime) {
             const payload = msg.payload instanceof Uint8Array ? msg.payload : new Uint8Array(0);
-            try {
-                const out = runtime.invoke(payload);
-                post({ type: 'invoke-result', id: msg.id, ok: true, payload: out });
-            }
-            catch (err) {
-                post({
-                    type: 'invoke-result',
-                    id: msg.id,
-                    ok: false,
-                    error: err.message,
-                });
-            }
+            const id = beginDispatch('invoke');
+            let out = new Uint8Array(0);
+            void runDispatch(() => {
+                out = runtime.invoke(payload);
+            }).then((result) => {
+                report(id, 'invoke', result);
+                if (result.ok) {
+                    post({ type: 'invoke-result', id: msg.id, ok: true, payload: out });
+                }
+                else {
+                    post({
+                        type: 'invoke-result',
+                        id: msg.id,
+                        ok: false,
+                        error: result.detail ?? result.reason,
+                    });
+                }
+            });
         }
         else if (msg.type === 'stop') {
             ticking = false;