@daugasauron/dolly 0.1.4 → 0.1.5-rc.0

package/host/packages/service.mjs

@@ -1,5 +1,5 @@
-import { DOLLY_IMAGES } from "../../src/images.mjs";
-import { loadPackagedSnapshotMetadata, loadPackagedSystemSnapshot } from "../../src/packaged-snapshot.mjs";
+import { DOLLY_IMAGES, imageBase } from "../../src/images.mjs";
+import { loadPackagedSnapshotMetadata } from "../../src/packaged-snapshot.mjs";
 import { MAX_SNAPSHOT_BYTES } from "../../src/snapshot-records.mjs";
 
 const PACKAGES_ORIGIN = "https://packages.dolly.invalid";
@@ -16,8 +16,9 @@ function reply(body, status, type = "text/plain; charset=utf-8") {
 }
 
 // GET /v1/packages/SHA256 is the exact snapshot of the package whose recipe
-// has that pin, verified from the published packs. One snapshot is held at a
-// time, until the guest has read it or the broker's deadline cancels it.
+// has that pin, verified from the published packs and merged as the guest
+// reads it. One snapshot is served at a time, until the guest has read it or
+// the broker's timeout cancels it.
 export class PackageService {
   constructor() {
     this.active = false;
@@ -35,25 +36,44 @@ export class PackageService {
     if (this.served >= PACKAGE_LIMITS.maxSnapshots) return reply("Package snapshot quota exceeded\n", 429);
     this.active = true;
     this.served += 1;
-    let bytes;
+    // The Worker (worker.mjs) answers each message in turn: the first with the
+    // packs checked, every later one with the snapshot's next chunk.
+    const worker = new Worker(new URL("./worker.mjs", import.meta.url), { type: "module", name: "dolly-packages" });
+    let released = false, refuse;
+    const release = () => {
+      if (released) return;
+      released = true;
+      worker.terminate();
+      refuse?.(new Error("the package transfer ended"));
+      this.active = false;
+    };
+    init.signal?.addEventListener("abort", release, { once: true });
+    const ask = message => new Promise((resolve, reject) => {
+      refuse = reject;
+      worker.onmessage = ({ data }) => data.error === undefined ? resolve(data) : reject(new Error(data.error));
+      worker.onerror = event => { event.preventDefault(); reject(new Error(event.message || "package Worker failed")); };
+      if (released) reject(new Error("the package transfer ended"));
+      else worker.postMessage(message);
+    });
     try {
       const metadata = await loadPackagedSnapshotMetadata(definition.image);
-      bytes = await loadPackagedSystemSnapshot(definition.image, metadata, init.signal);
+      await ask({ base: imageBase.href, metadata });
     } catch (error) {
-      this.active = false;
+      release();
       return reply(`${definition.image}: ${error.message}\n`, 502);
     }
-    const release = () => { this.active = false; };
-    let offset = 0;
     const body = new ReadableStream({
-      pull: controller => {
-        const end = Math.min(offset + 1024 * 1024, bytes.byteLength);
-        controller.enqueue(new Uint8Array(bytes, offset, end - offset));
-        offset = end;
-        if (offset === bytes.byteLength) { controller.close(); release(); }
+      async pull(controller) {
+        try {
+          const { done, value } = await ask({});
+          if (done) { release(); controller.close(); } else controller.enqueue(value);
+        } catch (error) {
+          release();
+          throw error;
+        }
       },
       cancel: release,
-    }, { highWaterMark: 0 });
+    }, { highWaterMark: 4 });
     return reply(body, 200, "application/octet-stream");
   }
 }

package/host/packages/worker.mjs

@@ -0,0 +1,21 @@
+// The packages@0 Worker merges one package's packs into its snapshot, a chunk
+// per request, off the page's thread: the page must answer the guest's reads
+// at once, since a guest that finds no record waits 10 ms.
+import { loadImages } from "../../src/images.mjs";
+import { packagedSystemSnapshot } from "../../src/packaged-snapshot.mjs";
+
+let chunks;
+onmessage = async ({ data }) => {
+  try {
+    if (data.metadata) {
+      await loadImages(data.base);
+      chunks = await packagedSystemSnapshot(data.metadata);
+      postMessage({ done: false });
+    } else {
+      const { done, value } = await chunks.next();
+      postMessage({ done, value }, done ? [] : [value.buffer]);
+    }
+  } catch (error) {
+    postMessage({ error: error.message });
+  }
+};

package/host/runtime/abi.mjs

@@ -5,4 +5,5 @@ export const DOLLY_TERMINAL_WORD_FOREGROUND_PID = 2;
 export const DOLLY_TERMINAL_WORD_FOREGROUND_INTERRUPTIBLE = 3;
 export const DOLLY_TERMINAL_WORD_INTERRUPT_SEQUENCE = 4;
 export const DOLLY_TERMINAL_WORD_INTERRUPT_TARGET_PID = 5;
+export const DOLLY_FS_BLOCK_SIZE = 1048576;
 export const DOLLY_ERRNO = Object.freeze({ E2BIG: 1, EACCES: 2, EADDRINUSE: 3, EADDRNOTAVAIL: 4, EAFNOSUPPORT: 5, EAGAIN: 6, EALREADY: 7, EBADF: 8, EBADMSG: 9, EBUSY: 10, ECANCELED: 11, ECHILD: 12, ECONNABORTED: 13, ECONNREFUSED: 14, ECONNRESET: 15, EDEADLK: 16, EDESTADDRREQ: 17, EDOM: 18, EDQUOT: 19, EEXIST: 20, EFAULT: 21, EFBIG: 22, EHOSTUNREACH: 23, EIDRM: 24, EILSEQ: 25, EINPROGRESS: 26, EINTR: 27, EINVAL: 28, EIO: 29, EISCONN: 30, EISDIR: 31, ELOOP: 32, EMFILE: 33, EMLINK: 34, EMSGSIZE: 35, EMULTIHOP: 36, ENAMETOOLONG: 37, ENETDOWN: 38, ENETRESET: 39, ENETUNREACH: 40, ENFILE: 41, ENOBUFS: 42, ENODEV: 43, ENOENT: 44, ENOEXEC: 45, ENOLCK: 46, ENOLINK: 47, ENOMEM: 48, ENOMSG: 49, ENOPROTOOPT: 50, ENOSPC: 51, ENOSYS: 52, ENOTCONN: 53, ENOTDIR: 54, ENOTEMPTY: 55, ENOTRECOVERABLE: 56, ENOTSOCK: 57, ENOTTY: 59, ENXIO: 60, EOVERFLOW: 61, EOWNERDEAD: 62, EPERM: 63, EPIPE: 64, EPROTO: 65, EPROTONOSUPPORT: 66, EPROTOTYPE: 67, ERANGE: 68, EROFS: 69, ESPIPE: 70, ESRCH: 71, ESTALE: 72, ETIMEDOUT: 73, ETXTBSY: 74, EXDEV: 75, ENODATA: 116, ENOTSUP: 138 });

package/host/runtime/boot-files.mjs

@@ -2,8 +2,9 @@ import { DOLLY_ERRNO } from "./abi.mjs";
 
 const encoder = new TextEncoder();
 
-// Boot files cross between the Worker and the in-Wasm filesystem through three
-// kernel exports, which take paths and bytes copied into kernel memory.
+// Boot files cross between the Worker and the in-Wasm filesystem through four
+// kernel exports, which take paths and bytes copied into kernel memory; one
+// makes a build's input image a file whose bytes stay in the Worker.
 export function bootFiles(kernel, memory) {
   const allocate = size => {
     const address = Number(kernel.malloc(BigInt(Math.max(1, size))));
@@ -26,6 +27,11 @@ export function bootFiles(kernel, memory) {
         kernel.dolly_write_file(pathAddress, address, BigInt(bytes.length))));
       if (status !== 0) throw new Error(`Dolly could not write ${path}: status ${status}`);
     },
+    // The build's input INPUT (the runtime's setBuildInputs), SIZE bytes, as PATH.
+    input(path, input, size) {
+      const status = withPath(path, pathAddress => kernel.dolly_build_input(pathAddress, input, BigInt(size)));
+      if (status !== 0) throw new Error(`Dolly could not place ${path}: status ${status}`);
+    },
     // Guest-writable files are bounded before trusted code copies them.
     read(path, limit) {
       const address = allocate(limit);

package/host/runtime/grower.mjs

@@ -1,14 +1,17 @@
-// Grows the kernel's memory for the runtime Worker, which waits meanwhile
-// (runtime.mjs): word 0 is 1 while a growth by values[1] pages is asked, and
-// the old size in pages, or -1, replaces that count.
+// Grows the kernel's memory for the runtime Worker (runtime.mjs), which hands
+// it the memory and a control once. A growth is asked while the control's third word is 1: its
+// first value, the pages asked, becomes the old size in pages or -1, and the
+// word 0. Requests pass through the word, not messages: the kernel's growth
+// waits in Atomics.wait, and Chrome keeps a message posted then to a Worker
+// that started moments before until its sender's next task.
 onmessage = ({ data: { memory, control } }) => {
   const values = new BigInt64Array(control), word = new Int32Array(control);
   postMessage("waiting");
   for (;;) {
-    // A notify can be the runtime Worker's for a growth done already.
-    while (Atomics.load(word, 0) === 0) Atomics.wait(word, 0, 0);
-    try { values[1] = BigInt(memory.grow(values[1])); } catch { values[1] = -1n; }
-    Atomics.store(word, 0, 0);
-    Atomics.notify(word, 0);
+    // A notify can be the asker's for a growth done already.
+    while (Atomics.load(word, 2) === 0) Atomics.wait(word, 2, 0);
+    try { values[0] = BigInt(memory.grow(values[0])); } catch { values[0] = -1n; }
+    Atomics.store(word, 2, 0);
+    Atomics.notify(word, 2);
   }
 };

package/host/runtime/lease-bridge.mjs

@@ -1,10 +1,12 @@
 import { DOLLY_ERRNO as E } from "./abi.mjs";
 
 // The Worker side of a device leased per process (src/device-lease.c). Each
-// packet a process submits goes to the page as `TYPE-request`; the page's
+// packet a process submits (dolly_device_header, runtime.h, then the
+// operation's body) is checked whole here and goes to the page as
+// `TYPE-request` with its operation, scope, sequence and body; the page's
 // `TYPE-complete` is published in the lease's reply slot, a 64-byte header and
-// `replyBytes`. `open` and `close` are the device's operation numbers.
-export function createLeaseBridge({ type, slots: count, packetBytes, replyBytes, open, close }, memory, mailbox, send, complete) {
+// `replyBytes`. `version`, `open` and `close` are the device's.
+export function createLeaseBridge({ type, version, slots: count, packetBytes, replyBytes, open, close }, memory, mailbox, send, complete) {
   const slots = new Array(count), stride = 64 + replyBytes;
   if (!Number.isSafeInteger(mailbox) || mailbox <= 0 || mailbox % 4 ||
       mailbox > memory.buffer.byteLength - count * stride) throw new Error(`Invalid ${type} mailbox`);
@@ -50,7 +52,8 @@ export function createLeaseBridge({ type, slots: count, packetBytes, replyBytes,
     const packet = new Uint8Array(memory.buffer, address, size).slice();
     const view = new DataView(packet.buffer), scope = view.getUint32(8, true), sequence = view.getUint32(16, true);
     const operation = view.getUint32(4, true);
-    if (!scope || !sequence || view.getUint32(12, true) || view.getUint32(20, true)) return -E.EINVAL;
+    if (view.getUint32(0, true) !== version || !scope || !sequence || view.getUint32(12, true) || view.getUint32(20, true) ||
+        view.getUint32(24, true) !== size - 32 || view.getUint32(28, true)) return -E.EINVAL;
     const slot = (scope - 1) % count, entry = slots[slot];
     if (entry?.pending || entry?.released) return -E.EBUSY;
     if (entry && operation === open) return -E.EBUSY;
@@ -58,7 +61,7 @@ export function createLeaseBridge({ type, slots: count, packetBytes, replyBytes,
     if (!entry && operation !== open) return -E.EBADF;
     if (entry && sequence <= entry.sequence) return -E.ESTALE;
     slots[slot] = {scope, sequence, operation, pending: true, released: false};
-    send({type: `${type}-request`, scope, sequence, packet}, [packet.buffer]);
+    send({type: `${type}-request`, operation, scope, sequence, body: packet.subarray(32)}, [packet.buffer]);
     return 0;
   }
   return {dispatch, acknowledge, dispose};

package/host/runtime/module.json

@@ -6,7 +6,7 @@
   "provides": "kernel",
   "dependencies": [],
   "phase": "kernel",
-  "imports": ["env.memory", "env.dolly_bootstrap_write_bytes", "env.dolly_clock_realtime", "env.dolly_clock_monotonic", "env.dolly_entropy", "env.dolly_memory_grow"],
+  "imports": ["env.memory", "env.dolly_bootstrap_write_bytes", "env.dolly_clock_realtime", "env.dolly_clock_monotonic", "env.dolly_entropy", "env.dolly_memory_grow", "env.dolly_build_input_read"],
   "host": "runtime.mjs",
   "contracts": ["../../abi/dolly-supervisor-0.wat", "../../abi/dolly-image-0.wat"],
   "process": ["../../abi/dolly-process-0.wat", "../../abi/dolly-process-gate-0.wat"],

package/host/runtime/runtime.mjs

@@ -17,6 +17,8 @@ export function check() {
 const maxBootstrapMessage = 1024 * 1024;
 // What crypto.getRandomValues fills in one call.
 const maxEntropy = 65536;
+// What the kernel reads of a build's input in one call: its window.
+const maxBuildInputRead = 8 * 1024 * 1024;
 
 // The terminal mailbox (abi/dolly-supervisor-0.wat), the Worker's end: the
 // foreground command, shell results and the page's interrupt request, with or
@@ -100,14 +102,35 @@ export function worker({ send, runtimeBase, abi, service }) {
   // one waits. Chrome counts a shared memory as external memory of the isolate
   // that grows it; past twice its heap limit it then collects between every
   // message of this one, and every system call takes fifteen times as long.
-  const growth = new BigInt64Array(new SharedArrayBuffer(16)), growthWord = new Int32Array(growth.buffer);
-  const grower = new Worker(new URL("./grower.mjs", import.meta.url), { type: "module", name: "dolly-memory" });
+  // A process's memory never reaches this Worker (process-supervisor.mjs).
+  const growerUrl = new URL("./grower.mjs", import.meta.url);
+  const grower = new Worker(growerUrl, { type: "module", name: "dolly-memory" });
+  const control = new SharedArrayBuffer(16), values = new BigInt64Array(control), word = new Int32Array(control);
+  // Once the grower holds the memory and waits on the word.
   const growing = new Promise((resolve, reject) => {
     grower.onmessage = resolve;
-    grower.onerror = event => reject(new Error(event.message || "the kernel memory Worker failed"));
+    grower.onerror = event => reject(new Error(event.message || "the memory Worker failed"));
   });
-  grower.postMessage({ memory, control: growth.buffer });
+  grower.postMessage({ memory, control });
+  // The old size in pages, or -1: this thread sees the new size when it returns.
+  const grow = pages => {
+    values[0] = pages;
+    Atomics.store(word, 2, 1);
+    Atomics.notify(word, 2);
+    // A notify can be the grower's for the last growth, whose wait found it
+    // done already: this one is done when the word says so.
+    while (Atomics.load(word, 2) === 1) Atomics.wait(word, 2, 1);
+    const old = values[0];
+    // This thread learns of the growth by an interrupt, which a wait that
+    // found it done already does not take: take it before the kernel touches
+    // the new pages, as a loop does at each turn.
+    if (old >= 0n) while (BigInt(memory.buffer.byteLength) < (old + pages) * 65536n);
+    return old;
+  };
   let supervisor, threadProvider, terminal, reported = "";
+  // The Blobs of a build's input images, which the build Worker sets: the
+  // kernel reads them as files (dolly_build_input), never anything else.
+  let buildInputs = [];
   // The foreground program, sent to the page when it changes.
   function reportForeground() {
     if (!terminal) return;
@@ -149,20 +172,7 @@ export function worker({ send, runtimeBase, abi, service }) {
       },
       "env.dolly_clock_realtime": () => Date.now(),
       "env.dolly_clock_monotonic": () => performance.now(),
-      "env.dolly_memory_grow": pages => {
-        growth[1] = pages;
-        Atomics.store(growthWord, 0, 1);
-        Atomics.notify(growthWord, 0);
-        // A notify can be the grower's for the last growth, whose wait found
-        // it done already: this one is done when the word says so.
-        while (Atomics.load(growthWord, 0) === 1) Atomics.wait(growthWord, 0, 1);
-        const old = growth[1];
-        // This thread learns of the growth by an interrupt, which a wait that
-        // found it done already does not take: take it before the kernel
-        // touches the new pages, as a loop does at each turn.
-        if (old >= 0n) while (BigInt(memory.buffer.byteLength) < (old + pages) * 65536n);
-        return old;
-      },
+      "env.dolly_memory_grow": grow,
       // Web Crypto rejects views of shared memory: fill a private buffer, then copy.
       "env.dolly_entropy": (address, length) => {
         const bytes = span(address, length, maxEntropy);
@@ -170,7 +180,16 @@ export function worker({ send, runtimeBase, abi, service }) {
         bytes.set(crypto.getRandomValues(new Uint8Array(bytes.length)));
         return 0;
       },
+      // Synchronous: the kernel reads inside a system call.
+      "env.dolly_build_input_read": (input, offset, address, length) => {
+        const blob = buildInputs[input], bytes = span(address, length, maxBuildInputRead), start = Number(offset);
+        if (!blob || !bytes || start < 0 || start > blob.size - bytes.length) return -E.EINVAL;
+        try { bytes.set(new Uint8Array(new FileReaderSync().readAsArrayBuffer(blob.slice(start, start + bytes.length)))); }
+        catch { return -E.EIO; }
+        return 0;
+      },
     },
+    setBuildInputs(blobs) { buildInputs = blobs; },
     // Both follow their modules, which nena@0 may enable or disable while the
     // supervisor runs: undefined takes the provider or the module away.
     setThreadProvider(provider) {

package/host/snapshot/abi.mjs

@@ -1,16 +1,14 @@
 // Generated from host/snapshot/dolly-snapshot-0.wat, include/dolly/process.h.
 export const DOLLY_SESSION_HEADER_SIZE = 64;
-export const DOLLY_SESSION_NAME_CAPACITY = 128;
 export const DOLLY_SESSION_TRANSFER_CAPACITY = 1048576;
 export const DOLLY_SESSION_WORD_REQUEST_SEQUENCE = 0;
 export const DOLLY_SESSION_WORD_COMPLETED_SEQUENCE = 1;
 export const DOLLY_SESSION_WORD_STATUS = 2;
-export const DOLLY_SESSION_WORD_NAME_LENGTH = 3;
-export const DOLLY_SESSION_WORD_CHUNK_SEQUENCE = 4;
-export const DOLLY_SESSION_WORD_CHUNK_CONSUMED_SEQUENCE = 5;
-export const DOLLY_SESSION_WORD_CHUNK_LENGTH = 6;
-export const DOLLY_SESSION_WORD_CHUNK_EOF = 7;
-export const DOLLY_SESSION_WORD_TOTAL_SIZE_LOW = 8;
-export const DOLLY_SESSION_WORD_TOTAL_SIZE_HIGH = 9;
-export const DOLLY_SESSION_WORD_CANCELLED_SEQUENCE = 10;
+export const DOLLY_SESSION_WORD_CHUNK_SEQUENCE = 3;
+export const DOLLY_SESSION_WORD_CHUNK_CONSUMED_SEQUENCE = 4;
+export const DOLLY_SESSION_WORD_CHUNK_LENGTH = 5;
+export const DOLLY_SESSION_WORD_CHUNK_EOF = 6;
+export const DOLLY_SESSION_WORD_TOTAL_SIZE_LOW = 7;
+export const DOLLY_SESSION_WORD_TOTAL_SIZE_HIGH = 8;
+export const DOLLY_SESSION_WORD_CANCELLED_SEQUENCE = 9;
 export const DOLLY_ERRNO = Object.freeze({ E2BIG: 1, EACCES: 2, EADDRINUSE: 3, EADDRNOTAVAIL: 4, EAFNOSUPPORT: 5, EAGAIN: 6, EALREADY: 7, EBADF: 8, EBADMSG: 9, EBUSY: 10, ECANCELED: 11, ECHILD: 12, ECONNABORTED: 13, ECONNREFUSED: 14, ECONNRESET: 15, EDEADLK: 16, EDESTADDRREQ: 17, EDOM: 18, EDQUOT: 19, EEXIST: 20, EFAULT: 21, EFBIG: 22, EHOSTUNREACH: 23, EIDRM: 24, EILSEQ: 25, EINPROGRESS: 26, EINTR: 27, EINVAL: 28, EIO: 29, EISCONN: 30, EISDIR: 31, ELOOP: 32, EMFILE: 33, EMLINK: 34, EMSGSIZE: 35, EMULTIHOP: 36, ENAMETOOLONG: 37, ENETDOWN: 38, ENETRESET: 39, ENETUNREACH: 40, ENFILE: 41, ENOBUFS: 42, ENODEV: 43, ENOENT: 44, ENOEXEC: 45, ENOLCK: 46, ENOLINK: 47, ENOMEM: 48, ENOMSG: 49, ENOPROTOOPT: 50, ENOSPC: 51, ENOSYS: 52, ENOTCONN: 53, ENOTDIR: 54, ENOTEMPTY: 55, ENOTRECOVERABLE: 56, ENOTSOCK: 57, ENOTTY: 59, ENXIO: 60, EOVERFLOW: 61, EOWNERDEAD: 62, EPERM: 63, EPIPE: 64, EPROTO: 65, EPROTONOSUPPORT: 66, EPROTOTYPE: 67, ERANGE: 68, EROFS: 69, ESPIPE: 70, ESRCH: 71, ESTALE: 72, ETIMEDOUT: 73, ETXTBSY: 74, EXDEV: 75, ENODATA: 116, ENOTSUP: 138 });

package/host/snapshot/snapshot.mjs

@@ -6,17 +6,19 @@ import { DOLLY_IMAGES } from "../../src/images.mjs";
 import { DOLLY_SESSION_FORMAT_VERSION, decodeSessionSnapshot, loadStoredSession, sessionCompatible,
   sessionLoadUrl, validSessionName, DOLLY_SESSION_MAX_BYTES } from "../../src/session-store.mjs";
 
-// A session route (/session/?name=NAME) boots the saved session's image and
-// restores its delta; with recover=1 it unpacks the files into a fresh system
-// image instead.
+// A session route (/session/?name=NAME), or boot()'s session option on a page
+// of one's own, boots the saved session's image and restores its delta; with
+// recover=1 the site's route unpacks the files into a fresh system image instead.
 export async function boot(route) {
   if (!route.loadSession) return undefined;
   if (route.mode !== "snapshot") throw new Error("invalid Dolly route configuration");
   const query = new URL(location.href).searchParams;
-  const name = query.get("name"), recovering = query.get("recover") === "1";
-  if (!validSessionName(name)) throw new Error("The Dolly session URL has an invalid name. Open /sessions to see saved sessions.");
+  const name = route.session ?? query.get("name"), recovering = route.session === undefined && query.get("recover") === "1";
+  // The site lists its saves; a page of one's own has no such page.
+  const listed = route.session === undefined ? " Open /sessions to see saved sessions." : "";
+  if (!validSessionName(name)) throw new Error(`The Dolly session name is invalid.${listed}`);
   const record = await loadStoredSession(name);
-  if (record === null) throw new Error(`Session '${name}' was not found in this browser. Open /sessions to see saved sessions.`);
+  if (record === null) throw new Error(`Session '${name}' was not found in this browser.${listed}`);
   if (record.name !== name) throw new Error("Stored session name does not match its key");
   let image = record.image;
   if (recovering) {
@@ -24,7 +26,7 @@ export async function boot(route) {
     if (!DOLLY_IMAGES.some(definition => definition.image === "system")) throw new Error("File recovery needs the system image in this distribution");
     image = "system";
   } else if (!sessionCompatible(record, DOLLY_IMAGES, DOLLY_BUILD_ID, DOLLY_IMAGE_BUILD_ID)) {
-    throw new Error("This save belongs to an older runtime or image recipe. It has not been deleted or overwritten. Open /sessions to see saved sessions.");
+    throw new Error(`This save belongs to an older runtime or image recipe. It has not been deleted or overwritten.${listed}`);
   }
   const bytes = await decodeSessionSnapshot(record);
   record.bytes.transfer(0);
@@ -38,13 +40,13 @@ export async function boot(route) {
 function sessionCapture({ send, ask }) {
   let consume = null;
   return {
-    async capture(name, { signal, onChunk }) {
+    async capture({ signal, onChunk }) {
       signal?.throwIfAborted();
       if (consume) throw new Error("A Dolly session save is already active");
       const cancel = () => send({ type: "snapshot-cancel" });
       consume = onChunk;
       signal?.addEventListener("abort", cancel, { once: true });
-      try { return await ask({ type: "snapshot-capture", name }); }
+      try { return await ask({ type: "snapshot-capture" }); }
       finally {
         consume = null;
         signal?.removeEventListener("abort", cancel);
@@ -118,9 +120,9 @@ export function worker({ get, ask, configuration: { bytes, recover } }) {
     },
     service() { kernel?.dolly_session_service(); },
     messages: {
-      "snapshot-capture"({ name }) {
+      "snapshot-capture"() {
         const controller = cancelled = new AbortController();
-        return transport.capture(name, { signal: controller.signal,
+        return transport.capture({ signal: controller.signal,
           onChunk: chunk => ask({ type: "snapshot-chunk", bytes: chunk }, [chunk.buffer]) });
       },
       "snapshot-cancel"() { cancelled?.abort(); },
@@ -130,7 +132,7 @@ export function worker({ get, ask, configuration: { bytes, recover } }) {
       // The kernel serves the mailbox on a request, after each consumed chunk
       // and on cancellation, in a task of its own.
       transport = new SessionTransport(memory.buffer, Number(kernel.dolly_session_mailbox_address()),
-        Number(kernel.dolly_session_name_address()), Number(kernel.dolly_session_transfer_address()),
+        Number(kernel.dolly_session_transfer_address()),
         () => setTimeout(() => kernel?.dolly_session_service()));
     },
     dispose() { transport?.close(); },

package/host/snapshot/transport.mjs

@@ -1,4 +1,4 @@
-import { DOLLY_SESSION_MAX_BYTES, validSessionName } from "../../src/session-store.mjs";
+import { DOLLY_SESSION_MAX_BYTES } from "../../src/session-store.mjs";
 import { DOLLY_ERRNO } from "./abi.mjs";
 import * as A from "./abi.mjs";
 
@@ -10,7 +10,6 @@ export class SessionTransport {
   static requestSequence = A.DOLLY_SESSION_WORD_REQUEST_SEQUENCE;
   static completedSequence = A.DOLLY_SESSION_WORD_COMPLETED_SEQUENCE;
   static status = A.DOLLY_SESSION_WORD_STATUS;
-  static nameLength = A.DOLLY_SESSION_WORD_NAME_LENGTH;
   static chunkSequence = A.DOLLY_SESSION_WORD_CHUNK_SEQUENCE;
   static chunkConsumedSequence = A.DOLLY_SESSION_WORD_CHUNK_CONSUMED_SEQUENCE;
   static chunkLength = A.DOLLY_SESSION_WORD_CHUNK_LENGTH;
@@ -19,16 +18,14 @@ export class SessionTransport {
   static totalSizeHigh = A.DOLLY_SESSION_WORD_TOTAL_SIZE_HIGH;
   static cancelledSequence = A.DOLLY_SESSION_WORD_CANCELLED_SEQUENCE;
 
-  constructor(buffer, address, nameAddress, transferAddress, wake) {
+  constructor(buffer, address, transferAddress, wake) {
     const range = (start, size) => Number.isSafeInteger(start) && start > 0 && start <= buffer.byteLength - size;
     if (!(buffer instanceof SharedArrayBuffer) || !range(address, A.DOLLY_SESSION_HEADER_SIZE) || address % 4 ||
-        !range(nameAddress, A.DOLLY_SESSION_NAME_CAPACITY) || !range(transferAddress, A.DOLLY_SESSION_TRANSFER_CAPACITY)) {
+        !range(transferAddress, A.DOLLY_SESSION_TRANSFER_CAPACITY)) {
       throw new Error("Dolly supplied an invalid session mailbox");
     }
     this.bytes = new Uint8Array(buffer);
     this.words = new Int32Array(buffer, address, A.DOLLY_SESSION_HEADER_SIZE / 4);
-    this.nameAddress = nameAddress;
-    this.nameCapacity = A.DOLLY_SESSION_NAME_CAPACITY;
     this.transferAddress = transferAddress;
     this.transferCapacity = A.DOLLY_SESSION_TRANSFER_CAPACITY;
     this.wake = wake;
@@ -36,8 +33,7 @@ export class SessionTransport {
     this.cancel = null;
   }
 
-  async capture(name, { signal, timeoutMilliseconds = 30000, onChunk } = {}) {
-    if (!validSessionName(name)) throw new TypeError("invalid Dolly session name");
+  async capture({ signal, timeoutMilliseconds = 30000, onChunk } = {}) {
     if (onChunk !== undefined && typeof onChunk !== "function") throw new TypeError("invalid session consumer");
     signal?.throwIfAborted();
     if (this.closed) throw new Error("Snapshot provider closed");
@@ -77,10 +73,6 @@ export class SessionTransport {
     signal?.addEventListener("abort", cancel, { once: true });
     let complete = false;
     try {
-      const nameBytes = new TextEncoder().encode(name);
-      this.bytes.fill(0, this.nameAddress, this.nameAddress + this.nameCapacity);
-      this.bytes.set(nameBytes, this.nameAddress);
-      Atomics.store(words, SessionTransport.nameLength, nameBytes.length);
       Atomics.store(words, SessionTransport.requestSequence, requested);
       this.wake();
       let snapshot;

package/host/snapshot/ui.mjs

@@ -12,7 +12,7 @@ import {
 } from "../../src/session-store.mjs";
 
 const markup = `<style>
-  #session-open { position: fixed; right: 0.5rem; bottom: 0.35rem; z-index: 6;
+  #session-open { position: absolute; right: 0.5rem; bottom: 0.35rem; z-index: 6;
     padding: 0.15rem 0.45rem; color: inherit; background: #262626;
     border: 1px solid #77736c; font: inherit; font-size: 13px; cursor: pointer; }
   #session-open[data-failed] { border-color: #e98773; }
@@ -51,10 +51,11 @@ const markup = `<style>
 // The Save button, its dialog and Ctrl+Shift+S. A save captures the session
 // delta through the snapshot mailbox and keeps it in this browser. The page
 // describes the running image once its ENTRY starts; restored names the
-// session this page booted from, if any. On a page with a site, a save names
-// itself in the tab's URL and the dialog links the site's list of saves.
-export function mountSessionSave({ keyboard, showStatus, site, indicators }, transport, restored) {
-  document.body.insertAdjacentHTML("beforeend", markup);
+// session this page booted from, if any. A save names itself in the tab's URL
+// (the site's session route, or ?session= on a page of one's own), and on a
+// page with a site the dialog links the site's list of saves.
+export function mountSessionSave({ mount, keyboard, showStatus, site, indicators }, transport, restored) {
+  mount.insertAdjacentHTML("beforeend", markup);
   const button = document.querySelector("#session-open");
   const dialog = document.querySelector("#session-dialog");
   const nameField = document.querySelector("#session-name");
@@ -101,6 +102,10 @@ export function mountSessionSave({ keyboard, showStatus, site, indicators }, tra
 
   async function save(requestedName) {
     if (saving) return saving;
+    // A save asks the browser to keep the origin's storage: the saves and the
+    // packs their images start from (src/pack-store.mjs). Chrome answers from
+    // the site's engagement, Firefox asks the user; the save does not wait.
+    navigator.storage.persist().catch(() => {});
     saving = (async () => {
       if (!base) throw new Error("Dolly is not ready to save a session");
       await base.verifyBase?.();
@@ -122,7 +127,7 @@ export function mountSessionSave({ keyboard, showStatus, site, indicators }, tra
       button.disabled = nameField.disabled = saveButton.disabled = true;
       controller = new AbortController();
       const capture = async onChunk => {
-        const result = await transport().capture(name, { signal: controller.signal, onChunk });
+        const result = await transport().capture({ signal: controller.signal, onChunk });
         dataset.sessionUncompressedBytes = String(onChunk ? result : result.byteLength);
         dataset.sessionStatus = "compressing";
         return result;
@@ -148,7 +153,11 @@ export function mountSessionSave({ keyboard, showStatus, site, indicators }, tra
       dataset.session = name;
       dataset.sessionBytes = String(encodedSize);
       dataset.sessionStatus = "saved";
-      if (site) history.replaceState(null, "", sessionLoadUrl(name, site));
+      // A reload opens the save again: the site's session route, or on a page of
+      // one's own the address's ?session=, which the page gives boot().
+      const address = new URL(location.href);
+      address.searchParams.set("session", name);
+      history.replaceState(null, "", site ? sessionLoadUrl(name, site) : address);
       showStatus(`Saved ${name} locally${site ? " · /sessions lists your saves" : ""}`);
       indicators.hold("session", false);
       update();
@@ -175,6 +184,7 @@ export function mountSessionSave({ keyboard, showStatus, site, indicators }, tra
     // first time through the dialog.
     claimsKey(event) {
       if (dialog.open || button.contains(event.target)) return true;
+      if (event.target !== document.body && !mount.contains(event.target)) return false;
       if (!base || !event.ctrlKey || !event.shiftKey || event.altKey || event.metaKey || event.code !== "KeyS") return false;
       event.preventDefault();
       event.stopImmediatePropagation();

package/host/stack/stack.mjs

@@ -10,9 +10,8 @@ export function worker({ get, runtimeBase }) {
         cache: "no-store", credentials: "same-origin", redirect: "error",
       });
       if (!response.ok) throw new Error(`Dolly dolly-process-stack.mjs returned HTTP ${response.status}`);
-      // threads: it serves each thread's Worker of a program using threads@0.
       get("runtime").serveInProcess("stack@0", {
-        bundle: new Blob([await response.arrayBuffer()], { type: "text/javascript" }), configuration: {}, threads: true });
+        bundle: new Blob([await response.arrayBuffer()], { type: "text/javascript" }), configuration: {} });
     },
     disabled() { get("runtime").serveInProcess("stack@0"); },
   };

package/host/threads/abi.mjs

@@ -5,4 +5,4 @@ export const DOLLY_THREAD_EXIT = 146;
 export const DOLLY_THREAD_WAIT = 147;
 export const DOLLY_THREAD_WAIT_NONBLOCK = 1;
 export const DOLLY_ERRNO = Object.freeze({ E2BIG: 1, EACCES: 2, EADDRINUSE: 3, EADDRNOTAVAIL: 4, EAFNOSUPPORT: 5, EAGAIN: 6, EALREADY: 7, EBADF: 8, EBADMSG: 9, EBUSY: 10, ECANCELED: 11, ECHILD: 12, ECONNABORTED: 13, ECONNREFUSED: 14, ECONNRESET: 15, EDEADLK: 16, EDESTADDRREQ: 17, EDOM: 18, EDQUOT: 19, EEXIST: 20, EFAULT: 21, EFBIG: 22, EHOSTUNREACH: 23, EIDRM: 24, EILSEQ: 25, EINPROGRESS: 26, EINTR: 27, EINVAL: 28, EIO: 29, EISCONN: 30, EISDIR: 31, ELOOP: 32, EMFILE: 33, EMLINK: 34, EMSGSIZE: 35, EMULTIHOP: 36, ENAMETOOLONG: 37, ENETDOWN: 38, ENETRESET: 39, ENETUNREACH: 40, ENFILE: 41, ENOBUFS: 42, ENODEV: 43, ENOENT: 44, ENOEXEC: 45, ENOLCK: 46, ENOLINK: 47, ENOMEM: 48, ENOMSG: 49, ENOPROTOOPT: 50, ENOSPC: 51, ENOSYS: 52, ENOTCONN: 53, ENOTDIR: 54, ENOTEMPTY: 55, ENOTRECOVERABLE: 56, ENOTSOCK: 57, ENOTTY: 59, ENXIO: 60, EOVERFLOW: 61, EOWNERDEAD: 62, EPERM: 63, EPIPE: 64, EPROTO: 65, EPROTONOSUPPORT: 66, EPROTOTYPE: 67, ERANGE: 68, EROFS: 69, ESPIPE: 70, ESRCH: 71, ESTALE: 72, ETIMEDOUT: 73, ETXTBSY: 74, EXDEV: 75, ENODATA: 116, ENOTSUP: 138 });
-export const DOLLY_THREADS_ABI_DIGEST = "fcbd4fc02150731c9a351445157d854916d5c3fd84faf9933bbcdcc16bf146af";
+export const DOLLY_THREADS_ABI_DIGEST = "23550e119f668b3a52a3e688699cf34880ee3dc2050c06c92c5311d6d347fe95";

package/host/threads/threads.mjs

@@ -26,7 +26,8 @@ export function worker({ get }) {
       workers.set(worker, pid);
       return worker;
     },
-    release(worker) { worker.terminate(); workers.delete(worker); },
+    // A Worker the supervisor leaves to end itself is not terminated.
+    release(worker, terminate = true) { if (terminate) worker.terminate(); workers.delete(worker); },
     dispose() { for (const worker of workers.keys()) worker.terminate(); workers.clear(); },
     // The runtime goes on without the module: the programs on its Workers end.
     disabled() { get("runtime").setThreadProvider(undefined); },

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.4",
+  "version": "0.1.5-rc.0",
   "type": "module",
   "name": "@daugasauron/dolly",
   "license": "MIT",