@daugasauron/dolly 0.1.5-rc.0 → 0.1.6

package/{src → page}/process-supervisor.mjs

@@ -1,22 +1,23 @@
-import { DOLLY_PROCESS_ABI_DIGEST } from "../dist/dolly-process-abi.mjs";
+import { DOLLY_PROCESS_ABI_DIGEST } from "./generated.mjs";
 import { DOLLY_ERRNO } from "./process-constants.mjs";
 import { parseWasmInterface } from "./wasm-interface.mjs";
 import { validateProcessInterface } from "./process-abi.mjs";
-import { validateThreadProfile } from "../host/threads/threads.mjs";
-import { DOLLY_THREAD_SPAWN } from "../host/threads/abi.mjs";
 import { executableHostRequirements, checkHostAbi } from "../host/requirements.mjs";
 import {
-  DOLLY_PROCESS_EXEC, DOLLY_PROCESS_EXIT, DOLLY_PROCESS_PACKET_LIMIT as packetLimit, DOLLY_PROCESS_SIGALRM, DOLLY_PROCESS_SIGINT,
-  DOLLY_PROCESS_SIGKILL, DOLLY_PROCESS_SIGNAL, DOLLY_PROCESS_SIGNAL_ACKNOWLEDGE,
-  DOLLY_PROCESS_SIGWINCH, DOLLY_PROCESS_SIZEOF, DOLLY_PROCESS_SPAWN,
+  DOLLY_PROCESS_EXEC, DOLLY_PROCESS_EXIT, DOLLY_PROCESS_PACKET_LIMIT as packetLimit,
+  DOLLY_PROCESS_SIGWINCH, DOLLY_PROCESS_OFFSETOF, DOLLY_PROCESS_SIZEOF, DOLLY_PROCESS_SPAWN,
   DOLLY_PROCESS_SPAWN_FOREGROUND, DOLLY_PROCESS_SPAWN_INHERIT_ENVIRONMENT,
   DOLLY_PROCESS_SPAWN_INTERACTIVE,
 } from "./process-constants.mjs";
 import { hex } from "./static-asset.mjs";
-import { DOLLY_FS_BLOCK_SIZE } from "../host/runtime/abi.mjs";
+import { DOLLY_FS_BLOCK_SIZE, DOLLY_PROCESS_EVENT_KIND_SHIFT, DOLLY_PROCESS_EVENT_VALUE_SHIFT, DOLLY_PROCESS_EVENT_LAUNCH, DOLLY_PROCESS_EVENT_INTERRUPT,
+  DOLLY_PROCESS_EVENT_TERMINATE, DOLLY_PROCESS_EVENT_WAKE } from "../host/runtime/abi.mjs";
 
 const encoder = new TextEncoder();
 const spawnHeaderSize = DOLLY_PROCESS_SIZEOF.dolly_process_spawn_request;
+const spawnField = DOLLY_PROCESS_OFFSETOF.dolly_process_spawn_request;
+const mappingField = DOLLY_PROCESS_OFFSETOF.dolly_process_fd_mapping;
+const mappingSize = DOLLY_PROCESS_SIZEOF.dolly_process_fd_mapping;
 // The kernel's deferred-call result; processes never observe it.
 const deferredResult = -(1n << 63n);
 const interruptedSystemCall = -BigInt(DOLLY_ERRNO.EINTR);
@@ -28,7 +29,7 @@ const interruptedSystemCall = -BigInt(DOLLY_ERRNO.EINTR);
 const processWorkerLimit = 56;
 const processMemoryBudgetBytes = 4 * 1024 * 1024 * 1024;
 // A spawn the count refuses waits as long as a Worker asks again for a memory
-// Chromium cannot reserve yet (src/process-worker.mjs), like any blocking
+// Chromium cannot reserve yet (page/process-worker.mjs), like any blocking
 // call, asked again whenever a process ends and at each service tick; then it
 // fails EAGAIN, a full process table's answer. A spawn the budget refuses
 // waits until a process ends, however long: make and Cargo end a build at a
@@ -39,7 +40,6 @@ const reservationPatienceMilliseconds = 5000;
 // A Worker ended mid-copy into its mailbox finishes the copy within
 // microseconds; one that holds the mailbox this long keeps it.
 const mailboxSealMilliseconds = 1000;
-const interruptGraceMilliseconds = 500;
 const compiledModuleCacheEntries = 64;
 const compiledModuleCacheBytes = 256 * 1024 * 1024;
 // File versions known to hold a cached module's bytes (dolly_process_image_version).
@@ -131,7 +131,9 @@ function encodeStrings(strings, label) {
 
 // Root processes run argv[0], inherit the kernel environment and map
 // descriptors 0-2 onto themselves.
-function encodeSpawn(arguments_, flags) {
+// With `standard`, the child's descriptors 0, 1 and 2 are the kernel's own:
+// the display's terminal, or the bootstrap log without one.
+function encodeSpawn(arguments_, flags, standard = true) {
   if (!Array.isArray(arguments_) || arguments_.length === 0) {
     throw new TypeError("a process needs argv[0]");
   }
@@ -141,23 +143,25 @@ function encodeSpawn(arguments_, flags) {
   }
   const pathBytes = encoder.encode(path);
   const argumentBytes = encodeStrings(arguments_, "process arguments");
-  const size = spawnHeaderSize + pathBytes.length + argumentBytes.length + 3 * 8;
+  const mappings = standard ? 3 : 0;
+  const size = spawnHeaderSize + pathBytes.length + argumentBytes.length + mappings * mappingSize;
   if (pathBytes.length > 4096 || size > packetLimit) {
     throw new RangeError("process spawn packet is too large");
   }
   const packet = new Uint8Array(size);
   const view = new DataView(packet.buffer);
-  view.setUint32(0, flags | DOLLY_PROCESS_SPAWN_INHERIT_ENVIRONMENT, true);
-  view.setUint32(4, arguments_.length, true);
-  view.setUint32(16, 3, true);
-  view.setUint32(28, pathBytes.length, true);
-  view.setBigUint64(32, BigInt(argumentBytes.length), true);
-  view.setBigUint64(48, 0xffffffffffffffffn, true);
+  view.setUint32(spawnField.flags, flags | DOLLY_PROCESS_SPAWN_INHERIT_ENVIRONMENT, true);
+  view.setUint32(spawnField.argument_count, arguments_.length, true);
+  view.setUint32(spawnField.mapping_count, mappings, true);
+  view.setUint32(spawnField.path_size, pathBytes.length, true);
+  view.setBigUint64(spawnField.argument_bytes, BigInt(argumentBytes.length), true);
+  view.setBigUint64(spawnField.deadline_nanoseconds, 0xffffffffffffffffn, true);
   packet.set(pathBytes, spawnHeaderSize);
   packet.set(argumentBytes, spawnHeaderSize + pathBytes.length);
-  for (let descriptor = 0; descriptor < 3; ++descriptor) {
-    view.setUint32(size - 24 + descriptor * 8, descriptor, true);
-    view.setUint32(size - 20 + descriptor * 8, descriptor, true);
+  for (let descriptor = 0; descriptor < mappings; ++descriptor) {
+    const mapping = size - mappings * mappingSize + descriptor * mappingSize;
+    view.setUint32(mapping + mappingField.source_descriptor, descriptor, true);
+    view.setUint32(mapping + mappingField.target_descriptor, descriptor, true);
   }
   return packet;
 }
@@ -165,12 +169,12 @@ function encodeSpawn(arguments_, flags) {
 // A process's memory lives in its own Workers alone, never in this one: a
 // shared memory's pages go when the last agent holding it drops it, and a
 // living Worker drops one only when it collects garbage, which a small heap
-// rarely needs (tasks/20261101-102515-retained-process-memory). So each
+// rarely needs. So each
 // Worker makes or receives the memory, holds the gate and copies its requests
 // into a mailbox of its own in kernel memory, and the memory goes with the
 // Worker. This Worker only names that mailbox to the kernel.
 export class DollyProcessSupervisor {
-  constructor(kernel, kernelMemory, gateModule, workerUrl, processContract, hostAbi, serviceHost, threadContract, threadHost, processModules) {
+  constructor(kernel, kernelMemory, gateModule, workerUrl, processContract, hostAbi, serviceHost, threadHost, processModules) {
     if (!(kernelMemory instanceof WebAssembly.Memory) ||
         !(gateModule instanceof WebAssembly.Module) || !(workerUrl instanceof URL)) {
       throw new TypeError("invalid Dolly process supervisor configuration");
@@ -182,7 +186,6 @@ export class DollyProcessSupervisor {
     this.processContract = processContract;
     this.hostAbi = hostAbi;
     this.serviceHost = serviceHost;
-    this.threadContract = threadContract;
     this.threadHost = threadHost;
     this.processModules = processModules;
     this.processes = new Map();
@@ -191,6 +194,8 @@ export class DollyProcessSupervisor {
     this.compiledModuleBytes = 0;
     this.compiledVersions = new Map();
     this.launchChain = Promise.resolve();
+    // The processes the kernel announced for launch, in order.
+    this.launches = [];
     this.mailboxAddress = Number(kernel.dolly_process_mailbox_address());
     this.mailboxCapacity = packetLimit;
     if (!Number.isSafeInteger(this.mailboxAddress) || this.mailboxAddress <= 0 ||
@@ -201,12 +206,11 @@ export class DollyProcessSupervisor {
   }
 
   static async create(kernel, kernelMemory, runtimeBase, hostAbi, serviceHost, threadHost, processModules) {
-    const [gateBytes, contractBytes, threadBytes, workerBytes] = await Promise.all([
-      "dolly-process-gate-0.wasm", "dolly-process-0.wasm", "dolly-threads-0.wasm",
-      "dolly-process-worker.mjs",
+    const [gateBytes, contractBytes, workerBytes] = await Promise.all([
+      "dolly-process-gate-0.wasm", "dolly-process-0.wasm", "dolly-process-worker.mjs",
     ].map(async name => {
       const response = await fetch(new URL(`dist/${name}`, runtimeBase), {
-        cache: "no-store", credentials: "same-origin", redirect: "error",
+        credentials: "same-origin", redirect: "error",
       });
       if (!response.ok) throw new Error(`Dolly ${name} returned HTTP ${response.status}`);
       return response.arrayBuffer();
@@ -218,16 +222,16 @@ export class DollyProcessSupervisor {
       const supervisor = new DollyProcessSupervisor(
         kernel, kernelMemory, gateModule, workerUrl,
         parseWasmInterface(contractBytes, "dolly-process-0"),
-        hostAbi, serviceHost, parseWasmInterface(threadBytes, "dolly-threads-0"), threadHost, processModules,
+        hostAbi, serviceHost, threadHost, processModules,
       );
       supervisor.releaseWorkerSource = () => URL.revokeObjectURL(workerUrl.href);
       // Entered through JSPI (WebAssembly.promising), a process runs on a
       // stack of its own. Chrome's holds about 950 KB where a Worker's holds
       // 500 KB, which Clang needs: an executable asks for it with a
       // dolly.process.stack section, and only the compiler carries one
-      // (src/process/compiler-main.c). Every other program is entered
-      // directly: a Codex build crashed Chrome's tab twice on that stack
-      // (tasks/20260930-232236-llvm-in-dolly), and Firefox 155 reports every
+      // (programs/compiler-main.c). Every other program is entered
+      // directly: a Codex build crashed Chrome's tab twice on that stack,
+      // and Firefox 155 reports every
       // Worker terminated inside such a call as an uncaught exception that no
       // listener receives. Firefox's holds no more, so the entry is also taken
       // only where it is measured half again as deep (Chrome 151: 1.90
@@ -243,12 +247,13 @@ export class DollyProcessSupervisor {
     }
   }
 
-  // threads@0 was disabled and its Workers are terminated: the programs that
-  // ran on them end here, each told why on its own stderr.
+  // The module that provides threads was disabled and its Workers are
+  // terminated: the programs that ran on them end here, each told why on its
+  // own stderr.
   withdrawThreads() {
     this.threadHost = undefined;
     for (const process of [...this.processes.values()]) {
-      if (process.threaded) this.#fail(process, new Error("threads@0 was disabled"));
+      if (process.threaded) this.#fail(process, new Error("its threads' module was disabled"));
     }
   }
 
@@ -267,15 +272,18 @@ export class DollyProcessSupervisor {
     return committed < processMemoryBudgetBytes || !fanning ? null : "budget";
   }
 
-  spawn(arguments_, { foreground = false } = {}) {
+  // A root process on the standard streams of the boot, or, with `start`, on
+  // those a module gives it: start(size) spawns the packet of that size in the
+  // supervisor's mailbox, which maps no stream, and returns the PID or -errno.
+  spawn(arguments_, { foreground = false, start } = {}) {
     if (this.#spawnWait(0)) throw new Error("Dolly process limit reached");
-    const packet = encodeSpawn(arguments_, foreground ? DOLLY_PROCESS_SPAWN_FOREGROUND : 0);
+    const packet = encodeSpawn(arguments_, foreground ? DOLLY_PROCESS_SPAWN_FOREGROUND : 0, start === undefined);
     new Uint8Array(
       this.kernelMemory.buffer,
       this.mailboxAddress,
       packet.length,
     ).set(packet);
-    const pid = this.kernel.dolly_process_spawn_serialized(BigInt(packet.length));
+    const pid = (start ?? (size => this.kernel.dolly_process_spawn_serialized(size)))(BigInt(packet.length));
     if (pid < 0) {
       const errno = Object.keys(DOLLY_ERRNO).find(name => DOLLY_ERRNO[name] === -pid) ?? `errno ${-pid}`;
       throw new Error(`cannot start ${arguments_[0]}: ${errno}`);
@@ -283,7 +291,7 @@ export class DollyProcessSupervisor {
     const completion = new Promise((resolve, reject) => {
       this.#registerProcess(pid, 0, resolve, reject);
     });
-    this.#scheduleLaunches();
+    this.#serviceEvents();
     return completion;
   }
 
@@ -298,71 +306,58 @@ export class DollyProcessSupervisor {
       memoryBytes: 0, messageHandler: null, errorHandler: null,
       messageErrorHandler: null, started: false,
       failure: null, interactive: (flags & DOLLY_PROCESS_SPAWN_INTERACTIVE) !== 0, retiring: false,
-      interruptTimer: null, deadlineTimer: null, retirementTimer: null, lastSignal: 0,
-      reclamationDeadline: 0, tid: 0, threads: new Map(), threaded: false,
-      execution: null, signalAtStart: 0,
+      retirementTimer: null, reclamationDeadline: 0, tid: 0, threads: new Map(), threaded: false,
+      execution: null,
     };
     this.processes.set(pid, process);
-    this.#armDeadline(process);
-  }
-
-  #descendantDepth(process, ancestorPid) {
-    let candidate = process;
-    for (let depth = 0; depth < this.processes.size; ++depth) {
-      if (candidate.parent === ancestorPid) return depth + 1;
-      if (candidate.parent === 0) return 0;
-      candidate = this.processes.get(candidate.parent);
-      if (!candidate) return 0;
-    }
-    return 0;
   }
 
   #serviceTick() {
     this.serviceHost();
-    const interrupted = this.kernel.dolly_process_take_interrupt();
-    if (interrupted > 0) this.#interruptForeground(interrupted);
-    for (let pid; (pid = this.kernel.dolly_process_take_alarm()) > 0;) {
-      this.#deliverSignal(this.processes.get(pid), DOLLY_PROCESS_SIGALRM);
-    }
-    this.#deliverRaised();
+    this.#serviceEvents();
     this.serviceDeferred();
   }
 
-  // What a pseudo-terminal raised for the programs on its slave
-  // (host/pty/dolly-pty-supervisor-0.wat): its interrupt key, resize or hang-up.
-  #deliverRaised() {
-    for (let pid; (pid = this.kernel.dolly_pty_take_signal()) > 0;) {
-      this.#deliverSignal(this.processes.get(pid), this.kernel.dolly_pty_taken_signal());
-    }
+  // The kernel decides what happens to processes and the supervisor carries
+  // it out (dolly_process_next_event), asked after each dispatch and each
+  // ending, at each tick and when what the kernel has due comes due.
+  #serviceEvents() {
+    for (let event; (event = this.kernel.dolly_process_next_event()) !== 0n;) {
+      const kind = Number(event >> BigInt(DOLLY_PROCESS_EVENT_KIND_SHIFT)),
+        value = Number((event >> BigInt(DOLLY_PROCESS_EVENT_VALUE_SHIFT)) & 0xffffn), pid = Number(event & 0xffffffffn);
+      if (kind === DOLLY_PROCESS_EVENT_LAUNCH) this.#announced(pid);
+      else if (kind === DOLLY_PROCESS_EVENT_INTERRUPT) this.#interrupt(this.processes.get(pid), value);
+      else if (kind === DOLLY_PROCESS_EVENT_TERMINATE) this.#terminated(pid);
+      else if (kind === DOLLY_PROCESS_EVENT_WAKE) this.serviceDeferred();
+      else throw new Error(`kernel supplied unknown event ${kind}`);
+    }
+    const due = this.kernel.dolly_process_service_milliseconds();
+    clearTimeout(this.serviceDue);
+    this.serviceDue = due >= 0 ? setTimeout(() => this.#serviceEvents(), Math.ceil(due)) : undefined;
+  }
+
+  // A spawned process to prepare: one the page spawned is known already.
+  #announced(pid) {
+    if (!this.processes.has(pid)) this.#registerProcess(pid, this.kernel.dolly_process_parent(pid));
+    this.launches.push(pid);
+    this.#scheduleLaunches();
   }
 
-  #interruptForeground(pid) {
+  // The kernel ended the process: its Workers stop, and it retires. One never
+  // announced has none.
+  #terminated(pid) {
     const process = this.processes.get(pid);
-    if (!process || process.retiring) return;
-    const descendants = [...this.processes.values()].filter(
-      (candidate) => !candidate.retiring && candidate.pid !== pid &&
-        this.#descendantDepth(candidate, pid) !== 0,
-    );
-    // Like a job-control shell, an interactive owner's running commands take
-    // SIGINT in its place; without any it takes SIGINT itself.
-    for (const target of process.interactive && descendants.length ? descendants : [process, ...descendants]) {
-      this.#deliverSignal(target);
+    if (process) {
+      if (!process.retiring) this.#retire(process);
+    } else if (this.kernel.dolly_process_worker_retired(pid) !== 0) {
+      throw new Error(`kernel rejected the retirement of process ${pid}`);
     }
   }
 
-  #deliverSignal(process, signalNumber = DOLLY_PROCESS_SIGINT) {
-    if (!process || process.retiring || this.processes.get(process.pid) !== process) return;
-    const result = this.kernel.dolly_process_signal(process.pid, signalNumber);
-    process.lastSignal = signalNumber;
-    // The kernel decides what the signal does: it may have ended the process.
-    if (this.kernel.dolly_process_exited(process.pid) !== 0) {
-      this.#retire(process);
-      return;
-    }
-    // A program not yet entered has no call to interrupt; what the kernel
-    // keeps for it, it takes when it starts. One that ignores the signal
-    // (result 1) has nothing to answer.
-    if (result !== 0 || !process.started) return;
+  // A signal reached a running process: its blocked call returns EINTR, and
+  // an EXEC in progress is refused unless the signal is a resize.
+  #interrupt(process, signalNumber) {
+    if (!process || process.retiring || !process.started) return;
     const receiver = process.threaded
       ? [...process.threads.values()].sort((a, b) => a.tid - b.tid)[0] : process;
     const deferred = this.deferred.get(receiver);
@@ -378,16 +373,6 @@ export class DollyProcessSupervisor {
       this.kernel.dolly_process_exec_refused(process.pid, 0n);
       this.#signal(receiver, message.sequence, interruptedSystemCall);
     }
-    if (signalNumber !== DOLLY_PROCESS_SIGWINCH) this.#armInterrupt(process, signalNumber);
-  }
-
-  // A program that does not finish a delivered signal in time is ended by it.
-  #armInterrupt(process, signalNumber) {
-    if (process.interruptTimer !== null) return;
-    process.interruptTimer = setTimeout(() => {
-      process.interruptTimer = null;
-      this.#forceExit(process.pid, 128 + signalNumber, signalNumber);
-    }, interruptGraceMilliseconds);
   }
 
   #scheduleLaunches() {
@@ -411,7 +396,7 @@ export class DollyProcessSupervisor {
       }
       return this.#cachedModule(key);
     }
-    const compiled = await this.#compileProcess(this.#takeImage(pid));
+    const compiled = await this.#compileProcess(this.#takeImage(pid), pid);
     if (version !== 0n) {
       this.compiledVersions.delete(version);
       this.compiledVersions.set(version, compiled.key);
@@ -430,7 +415,8 @@ export class DollyProcessSupervisor {
     return cached;
   }
 
-  async #compileProcess(bytes) {
+  // The notices of a slow compile go to process `pid`, whose launch started it.
+  async #compileProcess(bytes, pid) {
     const byteLength = bytes.byteLength;
     const digest = hex(await crypto.subtle.digest("SHA-256", bytes));
     const key = `${byteLength}:${digest}`;
@@ -443,8 +429,8 @@ export class DollyProcessSupervisor {
     const notice = setTimeout(() => {
       noticeShown = true;
       const mebibytes = (byteLength / (1024 * 1024)).toFixed(1);
-      this.#writeTerminal(
-        `\r\ndolly: preparing ${mebibytes} MiB WebAssembly executable for this session...\r\n`,
+      this.#writeTerminal(pid,
+        `\ndolly: preparing ${mebibytes} MiB WebAssembly executable for this session...\n`,
       );
     }, compilationNoticeMilliseconds);
     let module;
@@ -459,7 +445,7 @@ export class DollyProcessSupervisor {
       memoryRequirements = validateProcessInterface(this.processContract, parsed, DOLLY_PROCESS_ABI_DIGEST);
       requirements = executableHostRequirements(parsed);
       checkHostAbi(requirements, this.hostAbi);
-      threaded = validateThreadProfile(parsed, requirements, this.threadContract);
+      threaded = this.threadHost?.threaded(parsed, requirements) ?? false;
       largeStack = parsed.customSections.includes("dolly.process.stack");
       module = byteLength >= heldModuleBytes ? await compileHeld(bytes) : await WebAssembly.compile(bytes);
       processInterface = { imports: parsed.imports, exports: parsed.exports,
@@ -468,10 +454,10 @@ export class DollyProcessSupervisor {
     } finally {
       clearTimeout(notice);
       if (noticeShown) {
-        this.#writeTerminal(
+        this.#writeTerminal(pid,
           prepared
-            ? `dolly: executable ready in ${((performance.now() - started) / 1000).toFixed(1)}s\r\n`
-            : "dolly: executable preparation failed\r\n",
+            ? `dolly: executable ready in ${((performance.now() - started) / 1000).toFixed(1)}s\n`
+            : "dolly: executable preparation failed\n",
         );
       }
     }
@@ -504,7 +490,7 @@ export class DollyProcessSupervisor {
     compiled.module.terminate();
   }
 
-  #writeTerminal(text) {
+  #writeTerminal(pid, text) {
     const bytes = encoder.encode(text);
     const address = this.kernel.malloc(BigInt(Math.max(1, bytes.byteLength)));
     if (address === 0 || address === 0n) return;
@@ -513,7 +499,7 @@ export class DollyProcessSupervisor {
         this.kernelMemory.buffer, Number(address), bytes.byteLength,
       ).set(bytes);
       this.kernel.dolly_terminal_write_bytes(
-        BigInt(address), BigInt(bytes.byteLength),
+        pid, BigInt(address), BigInt(bytes.byteLength),
       );
     } finally {
       this.kernel.free(BigInt(address));
@@ -521,18 +507,17 @@ export class DollyProcessSupervisor {
   }
 
   async #launchPending() {
-    for (let pid; (pid = this.kernel.dolly_process_next_launch()) !== 0;) {
+    for (let pid; (pid = this.launches.shift()) !== undefined;) {
       const process = this.processes.get(pid);
+      // Ended before its turn: retired already.
+      if (!process || process.retiring) continue;
       let compiled;
       try {
-        if (!process) throw new Error(`kernel supplied unregistered process ${pid}`);
         compiled = await this.#compiledImage(pid);
         if (this.#canLaunch(process)) this.#start(process, compiled, this.#admit(compiled));
       } catch (error) {
-        // A failed launch ends only its own process; exiting it in the kernel
-        // also stops next_launch from naming it again.
-        if (process) this.#fail(process, error);
-        else this.kernel.dolly_process_worker_exited(pid, 126, 0);
+        // A failed launch ends only its own process.
+        this.#fail(process, error);
       } finally {
         if (compiled) this.#release(compiled);
       }
@@ -567,7 +552,7 @@ export class DollyProcessSupervisor {
   #admit({ requirements, threaded }) {
     checkHostAbi(requirements, this.hostAbi);
     const local = [...requirements.keys()].filter(requirement => this.processModules.has(requirement));
-    if (threaded && !this.threadHost) throw new Error("threads@0 is unavailable");
+    if (threaded && !this.threadHost) throw new Error("no module provides its threads");
     return local;
   }
 
@@ -576,7 +561,7 @@ export class DollyProcessSupervisor {
     Object.assign(process, { memoryRequirements, memoryBytes: Number(memoryRequirements.initial) * 65536,
       maximumBytes: Number(memoryRequirements.maximum) * 65536, compiled, processInterface, threaded, largeStack, local });
     if (threaded) {
-      const tid = this.kernel.dolly_threads_attach(process.pid);
+      const tid = this.threadHost.attach(process.pid);
       if (tid <= 0) throw new Error(`kernel could not reserve main thread: ${tid}`);
       process.tid = tid;
       process.threads.set(tid, process);
@@ -610,23 +595,20 @@ export class DollyProcessSupervisor {
     }
     if (process.execution !== execution) return unused();
     process.execution = null;
-    const signalAtStart = this.kernel.dolly_process_exec_commit(process.pid);
-    if (signalAtStart < 0) {
+    const committed = this.kernel.dolly_process_exec_commit(process.pid);
+    if (committed < 0) {
       unused();
-      this.#fail(process, new Error(`kernel rejected process ${process.pid} exec: ${signalAtStart}`));
+      this.#fail(process, new Error(`kernel rejected process ${process.pid} exec: ${committed}`));
       return;
     }
     // The old program's memory goes with its Workers. Termination has no
     // completion event: a large interactive one gets the time it gets before
     // a parent may start its replacement (#reclamationDeadline).
     const delay = this.#reclamationDeadline(process) - performance.now();
-    if (process.interruptTimer !== null) clearTimeout(process.interruptTimer);
-    process.interruptTimer = null;
     this.#disposeWorker(process, compiled);
-    Object.assign(process, { started: false, threaded: false, tid: 0, threads: new Map(), signalAtStart });
+    Object.assign(process, { started: false, threaded: false, tid: 0, threads: new Map() });
     // Its descriptors with CLOEXEC are closed: a reader of their pipes goes on now.
-    this.#deliverRaised();
-    if (this.kernel.dolly_process_take_wakeup()) this.serviceDeferred();
+    this.#serviceEvents();
     const start = () => {
       try {
         if (this.#canLaunch(process)) this.#start(process, compiled, local);
@@ -644,7 +626,7 @@ export class DollyProcessSupervisor {
       : new Worker(this.workerUrl, { type: "module", name });
     if (!worker) throw new Error("thread Worker capacity exhausted");
     // Words: the call sequence, the answered sequence, the result's two
-    // halves, the copy word (src/process-worker.mjs copyRequest) and a
+    // halves, the copy word (page/process-worker.mjs copyRequest) and a
     // thread's start word (#disposeThread).
     const control = new SharedArrayBuffer(32);
     thread.mailbox = Number(this.kernel.malloc(BigInt(packetLimit)));
@@ -659,7 +641,7 @@ export class DollyProcessSupervisor {
     thread.control = new Int32Array(control);
     thread.messageHandler = event => this.#message(process, event.data, thread);
     // Cancelled, or the browser reports the Worker's uncaught error again in
-    // this Worker, whose end it would be (src/browser.mjs).
+    // this Worker, whose end it would be (page/browser.mjs).
     thread.errorHandler = event => { event.preventDefault(); this.#fail(process, new Error(event.message || `${name} failed`)); };
     thread.messageErrorHandler = () => this.#fail(process, new Error(`${name} message could not be decoded`));
     worker.addEventListener("message", thread.messageHandler);
@@ -671,6 +653,7 @@ export class DollyProcessSupervisor {
     const channel = module instanceof Worker ? new MessageChannel() : null;
     channel && module.postMessage({ port: channel.port1 }, [channel.port1]);
     worker.postMessage({ type: "configure", pid, tid: thread.tid, argument, threaded, control,
+      threadOperations: threaded ? this.threadHost.operations : undefined,
       module: channel ? channel.port2 : module,
       memory: memoryRequirements, port, mailbox: thread.mailbox, kernelMemory: this.kernelMemory, gateModule: this.gateModule,
       promisingEntry: this.promisingEntry && process.largeStack, stackDepths: this.stackDepths,
@@ -696,19 +679,8 @@ export class DollyProcessSupervisor {
     Atomics.notify(process.control, 1);
   }
 
-  #armDeadline(process) {
-    const remaining = this.kernel.dolly_process_deadline_remaining(process.pid);
-    if (remaining >= 0) {
-      process.deadlineTimer = setTimeout(() => this.#endTree(process.pid, 124), Math.ceil(remaining));
-    }
-  }
-
   #clearTimers(process) {
-    if (process.interruptTimer !== null) clearTimeout(process.interruptTimer);
-    if (process.deadlineTimer !== null) clearTimeout(process.deadlineTimer);
     if (process.retirementTimer !== null) clearTimeout(process.retirementTimer);
-    process.interruptTimer = null;
-    process.deadlineTimer = null;
     process.retirementTimer = null;
   }
 
@@ -734,7 +706,7 @@ export class DollyProcessSupervisor {
       message.responseCapacity,
       message.memoryBytes,
     ];
-    const spawnsThread = process.threaded && message.operation === DOLLY_THREAD_SPAWN;
+    const spawnsThread = process.threaded && message.operation === this.threadHost?.operations.spawn;
     if (message.pid !== process.pid || message.tid !== thread.tid ||
         values.some((value) => !Number.isSafeInteger(value) || value < 0) ||
         message.requestSize > packetLimit || message.responseCapacity > packetLimit ||
@@ -745,17 +717,16 @@ export class DollyProcessSupervisor {
       return;
     }
     // The size the budget counts: a threaded process keeps the one it reported
-    // before its memory took its maximum (src/process-worker.mjs).
+    // before its memory took its maximum (page/process-worker.mjs).
     if (!(process.threaded && message.memoryBytes >= process.maximumBytes)) process.memoryBytes = message.memoryBytes;
     let result;
-    let signalDelivery;
     let threadArgument;
     let portTaken = false;
     try {
       // A deferred call is retried against the request still in the mailbox:
-      // a handler that defers has written nothing (src/process-kernel.h).
+      // a handler that defers has written nothing (kernel/process-kernel.h).
       const mailbox = () => new DataView(this.kernelMemory.buffer, thread.mailbox, 8);
-      if (message.operation === DOLLY_THREAD_SPAWN && message.requestSize === 8)
+      if (spawnsThread && message.requestSize === 8)
         threadArgument = mailbox().getBigUint64(0, true);
       const args = [process.pid, message.operation, BigInt(message.requestSize), BigInt(message.responseCapacity)];
       if (process.threaded) args.splice(1, 0, thread.tid);
@@ -769,8 +740,7 @@ export class DollyProcessSupervisor {
       // Firefox can enter a direct Wasm call twice. Use the generic call path
       // so a completed syscall is never replayed against its response packet.
       result = exhausted ? -BigInt(DOLLY_ERRNO.EAGAIN)
-        : Reflect.apply(process.threaded ? this.kernel.dolly_threads_dispatch : this.kernel.dolly_process_dispatch,
-          this.kernel, args);
+        : process.threaded ? this.threadHost.dispatch(args) : Reflect.apply(this.kernel.dolly_process_dispatch, this.kernel, args);
       if (result === deferredResult) {
         const deferred = { process, thread, message, timer: null };
         this.deferred.set(thread, deferred);
@@ -796,7 +766,7 @@ export class DollyProcessSupervisor {
         if (result > BigInt(message.responseCapacity)) {
           throw new Error(`kernel overfilled process ${process.pid} response`);
         }
-        if (message.operation === DOLLY_THREAD_SPAWN) {
+        if (spawnsThread) {
           if (result !== 8n || threadArgument === undefined) throw new Error("invalid kernel thread response");
           const tid = mailbox().getUint32(0, true);
           if (!tid || tid > 0x7fffffff || mailbox().getUint32(4, true) || process.threads.has(tid))
@@ -806,30 +776,10 @@ export class DollyProcessSupervisor {
           try { this.#launchWorker(process, child, threadArgument, message.port); portTaken = true; }
           catch (error) {
             this.#disposeThread(process, child);
-            this.kernel.dolly_threads_unstarted(process.pid, tid);
+            this.threadHost.unstarted(process.pid, tid);
             result = -BigInt(DOLLY_ERRNO.EAGAIN);
           }
         }
-        if (message.operation === DOLLY_PROCESS_SPAWN) {
-          if (result !== 8n) throw new Error("invalid kernel spawn response");
-          const pid = mailbox().getUint32(0, true);
-          if (pid === 0 || pid > 0x7fffffff || mailbox().getUint32(4, true) !== 0) {
-            throw new Error("invalid kernel spawn identity");
-          }
-          this.#registerProcess(pid, process.pid);
-        }
-        if (message.operation === DOLLY_PROCESS_SIGNAL) {
-          if (result !== 8n) throw new Error("invalid kernel signal response");
-          signalDelivery = { pid: mailbox().getUint32(0, true), signal: mailbox().getUint32(4, true) };
-          if (signalDelivery.pid === 0 || signalDelivery.pid > 0x7fffffff) {
-            throw new Error("invalid kernel signal target");
-          }
-        }
-        if (message.operation === DOLLY_PROCESS_SIGNAL_ACKNOWLEDGE && result === 4n &&
-            mailbox().getInt32(0, true) === 0 && process.interruptTimer !== null) {
-          clearTimeout(process.interruptTimer);
-          process.interruptTimer = null;
-        }
       }
     } catch (error) {
       message.port?.close();
@@ -838,16 +788,10 @@ export class DollyProcessSupervisor {
     }
     if (!portTaken) message.port?.close();
     this.#signal(thread, message.sequence, result);
-    if (signalDelivery?.signal) {
-      this.#deliverSignal(this.processes.get(signalDelivery.pid), signalDelivery.signal);
-    }
-    this.#deliverRaised();
-    // A spawn that waited for admission is launched like any other.
-    if (!retry || message.operation === DOLLY_PROCESS_SPAWN) this.#scheduleLaunches();
-    if (retry) return;
-    // A pipe write or close can complete another thread's blocked read or poll,
-    // such as an async runtime's waker: retry now, not at the next tick.
-    if (this.kernel.dolly_process_take_wakeup()) this.serviceDeferred();
+    // What the call set in motion: a spawn's launch, a signal's delivery, and
+    // a pipe write or close that completes another thread's blocked read or
+    // poll, such as an async runtime's waker, retried now, not at the next tick.
+    this.#serviceEvents();
   }
 
   #message(process, message, thread = process) {
@@ -861,9 +805,6 @@ export class DollyProcessSupervisor {
         this.#fail(process, new Error(`kernel rejected process ${process.pid} start`));
       } else {
         process.started = true;
-        // A signal pending across EXEC is the new program's to answer.
-        if (process.signalAtStart) this.#armInterrupt(process, process.signalAtStart);
-        process.signalAtStart = 0;
       }
     } else if (message.type === "syscall") {
       this.#syscall(process, message, false, thread);
@@ -874,13 +815,14 @@ export class DollyProcessSupervisor {
       // The trusted Worker wrapper has unwound Wasm and will never re-enter it.
       // Remove its event handlers/resources before making its stack joinable.
       this.#disposeThread(process, thread);
-      const last = this.kernel.dolly_threads_retired(process.pid, thread.tid, message.result);
+      // Withdrawn since, the module has ended the process already.
+      const last = this.threadHost?.retired(process.pid, thread.tid, message.result) ?? -1;
       if (last < 0) this.#fail(process, new Error("kernel rejected thread retirement"));
       else if (last) this.#forceExit(process.pid, 0);
       else this.serviceDeferred();
     } else if (message.type === "finished") {
       // _start returned (status zero), or EXIT has already recorded the status.
-      this.kernel.dolly_process_worker_exited(process.pid, 0, 0);
+      this.#recordExit(process.pid, 0, 0);
       this.#retire(process);
     } else if (message.type === "failed") {
       const detail = message.stack ? `${message.message}\n${message.stack}` : message.message;
@@ -898,38 +840,20 @@ export class DollyProcessSupervisor {
 
   #retire(process) {
     process.retiring = true;
-    // A process a signal ends passes it to its descendants, as a signal to its
-    // process group would: Dolly has no groups, so the command of slop -c is
-    // the shell's child unless it is exec'd. Each answers it as it handles it.
-    // A descendant that has it already, as Ctrl-C gives it to the whole
-    // foreground tree, is not given it twice.
-    const signal = this.kernel.dolly_process_exit_signal(process.pid);
-    if (signal !== 0) {
-      for (const descendant of [...this.processes.values()]) {
-        if (descendant.lastSignal !== signal && this.#descendantDepth(descendant, process.pid) !== 0) {
-          this.#deliverSignal(descendant, signal);
-        }
-      }
-    }
     // Its children live on: the kernel has given them parent 0.
     for (const child of this.processes.values()) if (child.parent === process.pid) child.parent = 0;
     process.reclamationDeadline = this.#reclamationDeadline(process);
     this.#stop(process);
     // The kernel has closed the process's descriptors: a reader of its pipe or
-    // a waiter for its lock proceeds now, not at the next tick.
-    this.#deliverRaised();
-    if (this.kernel.dolly_process_take_wakeup()) this.serviceDeferred();
+    // a waiter for its lock proceeds now, not at the next tick; a signal that
+    // ended it has reached its descendants.
+    this.#serviceEvents();
     const retired = () => {
       process.retirementTimer = null;
       if (this.processes.get(process.pid) !== process) return;
       this.#acknowledgeRetirement(process);
       if (process.resolve) this.#finish(process);
-      else {
-        // An orphan, whose parent may have ended after this one did: nobody
-        // waits for it, so it is reaped, as init would.
-        if (this.kernel.dolly_process_parent(process.pid) === 0) this.kernel.dolly_process_collect(process.pid);
-        this.serviceDeferred();
-      }
+      else this.serviceDeferred();
     };
     // Worker.terminate() has no completion event. Drop all references, then allow
     // one bounded reclamation window for large interactive memories before WAIT
@@ -975,7 +899,8 @@ export class DollyProcessSupervisor {
     const line = encoder.encode(`dolly: process ${process.pid} ` +
       `${process.started ? "failed" : "was refused"}: ${reason}\n`);
     new Uint8Array(this.kernelMemory.buffer, this.mailboxAddress, line.length).set(line);
-    this.kernel.dolly_process_worker_failed(process.pid, BigInt(line.length));
+    const recorded = this.kernel.dolly_process_worker_failed(process.pid, BigInt(line.length));
+    if (recorded !== 0) throw new Error(`kernel refused the failure of process ${process.pid} (${recorded})`);
     detail.message = `Dolly process ${process.pid} failed: ${detail.message}`;
     process.failure = Object.assign(detail, { reason });
     if (!process.reject) console.error(detail.stack ?? detail.message);
@@ -986,23 +911,15 @@ export class DollyProcessSupervisor {
     const process = this.processes.get(pid);
     if (!process) return false;
     if (process.retiring) return true;
-    this.kernel.dolly_process_worker_exited(pid, status, signalNumber);
+    this.#recordExit(pid, status, signalNumber);
     this.#retire(process);
     return true;
   }
 
-  // A timed command's deadline ends its tree, deepest first, as timeout(1)
-  // signals the command's process group.
-  #endTree(pid, status) {
-    const descendants = [...this.processes.values()]
-      .map((process) => ({ process, depth: this.#descendantDepth(process, pid) }))
-      .filter(({ depth }) => depth !== 0)
-      .sort((left, right) => right.depth - left.depth)
-      .map(({ process }) => process);
-    for (const descendant of descendants) {
-      this.#forceExit(descendant.pid, 128 + DOLLY_PROCESS_SIGKILL, DOLLY_PROCESS_SIGKILL);
-    }
-    this.#forceExit(pid, status);
+  // The kernel refuses only a process it never had or an impossible status.
+  #recordExit(pid, status, signalNumber) {
+    const result = this.kernel.dolly_process_worker_exited(pid, status, signalNumber);
+    if (result !== 0) throw new Error(`kernel refused the exit of process ${pid} (${result})`);
   }
 
   #disposeThread(process, thread) {
@@ -1018,7 +935,7 @@ export class DollyProcessSupervisor {
       // Chrome keeps what was posted to a Worker terminated before it runs, the
       // memory a thread's Worker is sent among it, until this Worker collects
       // garbage. One that has not started (control word 5 still 0) is told so
-      // and ends itself (src/process-worker.mjs processMemory).
+      // and ends itself (page/process-worker.mjs processMemory).
       const unstarted = thread !== process && Atomics.compareExchange(thread.control, 5, 0, 2) === 0;
       if (unstarted) Atomics.notify(thread.control, 5);
       // threads@0 disabled since has already terminated its Workers.
@@ -1026,7 +943,7 @@ export class DollyProcessSupervisor {
       else thread.worker.terminate();
     }
     // The Worker copies a request into its mailbox under control word 4
-    // (src/process-worker.mjs copyRequest); sealed, it copies no more, and the
+    // (page/process-worker.mjs copyRequest); sealed, it copies no more, and the
     // mailbox goes back to the kernel. Termination has no completion event: a
     // Worker ended inside a copy finishes it first.
     if (thread.mailbox) {
@@ -1060,19 +977,30 @@ export class DollyProcessSupervisor {
   }
 
   serviceDeferred() {
-    for (const deferred of [...this.deferred.values()]) {
-      const { process, thread, message } = deferred;
-      // An earlier retry in this pass may have ended this thread: a completed
-      // EXIT stops the other threads of its process.
-      if (this.deferred.get(thread) !== deferred) continue;
-      if (this.processes.get(process.pid) === process && !process.retiring) {
-        this.#syscall(process, message, true, thread);
-      } else this.#clearDeferred(thread);
+    // A retry that wakes others asks for one more pass, after this one.
+    if (this.servicingDeferred) { this.deferredAgain = true; return; }
+    this.servicingDeferred = true;
+    try {
+      do {
+        this.deferredAgain = false;
+        for (const deferred of [...this.deferred.values()]) {
+          const { process, thread, message } = deferred;
+          // An earlier retry in this pass may have ended this thread: a completed
+          // EXIT stops the other threads of its process.
+          if (this.deferred.get(thread) !== deferred) continue;
+          if (this.processes.get(process.pid) === process && !process.retiring) {
+            this.#syscall(process, message, true, thread);
+          } else this.#clearDeferred(thread);
+        }
+      } while (this.deferredAgain);
+    } finally {
+      this.servicingDeferred = false;
     }
   }
 
   dispose() {
     clearInterval(this.serviceTimer);
+    clearTimeout(this.serviceDue);
     for (const process of this.processes.values()) {
       this.#stop(process);
       process.reject?.(new Error("Dolly runtime closed"));