@hew-lang/sandbox-vm 0.6.0-rc7 → 0.6.1

package/dist/interpreter/v1/exec.js

@@ -5,6 +5,7 @@
 /// where the package says `copy_value`, releases where it says `destroy_value`,
 /// follows the `unwind` edge the package names, and takes the failure edge a
 /// `checked.binary` names rather than trapping on its own.
+import { executeCodec } from "./codecs.js";
 import { TraceBuilder, runtimeFailure } from "../trace.js";
 import { UNIT, cloneValue, toJsonValue } from "../values.js";
 import { runtimeTag } from "./package.js";
@@ -69,7 +70,7 @@ export function runPackageV1(pkg, options = {}) {
         trace.reject(rejection);
         return trace.finish();
     }
-    const vm = new ExecutorV1(pkg, trace, StdinReader.fromReplay(replay.inputs), options.schedulerPolicy ?? "round_robin");
+    const vm = new ExecutorV1(pkg, trace, StdinReader.fromReplay(replay.inputs), options.schedulerPolicy ?? "round_robin", options);
     try {
         vm.run();
     }
@@ -85,6 +86,7 @@ class ExecutorV1 {
     pkg;
     trace;
     stdin;
+    options;
     current;
     host;
     scheduler;
@@ -96,6 +98,7 @@ class ExecutorV1 {
     generators = new Map();
     tasks = new Map();
     completedTasks = 0;
+    actorIdentity = 0n;
     faultDebts = new Set();
     nextFaultDebt = 0;
     closingResources = new WeakSet();
@@ -103,10 +106,11 @@ class ExecutorV1 {
     running = false;
     rootComplete = false;
     rootFault = null;
-    constructor(pkg, trace, stdin, policy) {
+    constructor(pkg, trace, stdin, policy, options) {
         this.pkg = pkg;
         this.trace = trace;
         this.stdin = stdin;
+        this.options = options;
         this.scheduler = new FrameScheduler(trace, policy);
         this.ids = new DeterministicIds(trace.replay.seed);
         this.host = {
@@ -171,7 +175,8 @@ class ExecutorV1 {
             const act = this.current;
             while (act.opIndex < act.block.ops.length) {
                 const op = act.block.ops[act.opIndex++];
-                this.commitStep();
+                if (op.op !== "coverage.hit")
+                    this.commitStep();
                 try {
                     this.execute(act, op);
                 }
@@ -350,6 +355,11 @@ class ExecutorV1 {
     // ── instructions ─────────────────────────────────────────────────────────
     execute(act, op) {
         switch (op.op) {
+            case "coverage.hit": {
+                const key = String(op.counter);
+                this.trace.coverage[key] = (this.trace.coverage[key] ?? 0) + 1;
+                return;
+            }
             case "const.int":
                 this.define(act, op.dst, {
                     kind: "i64",
@@ -404,9 +414,19 @@ class ExecutorV1 {
                 act.places.set(op.place, { value: UNIT, valid: false });
                 return;
             case "store.init":
-            case "store.assign":
                 writeRef(this.placeRef(act, op.place), this.read(act, op.value));
                 return;
+            case "store.assign": {
+                const ref = this.placeRef(act, op.place);
+                const replacement = this.read(act, op.value);
+                const previous = liveRef(ref) ? readRef(ref) : UNIT;
+                // Retire the old owner before invoking user close code. Publish the
+                // replacement after cleanup, including when close records a fault;
+                // the following cleanup.dispatch then drains the new owner once.
+                invalidateRef(ref);
+                this.releaseOperation(act, previous, () => writeRef(ref, replacement));
+                return;
+            }
             case "load.copy":
                 this.define(act, op.dst, cloneValue(readRef(this.placeRef(act, op.place))));
                 return;
@@ -531,7 +551,8 @@ class ExecutorV1 {
                 const shape = this.closureAt(op.closure);
                 this.define(act, op.dst, {
                     kind: "closure",
-                    body: shape.body,
+                    entries: shape.entries,
+                    specialization: null,
                     environment: {
                         kind: "record",
                         typeId: "",
@@ -540,12 +561,23 @@ class ExecutorV1 {
                 });
                 return;
             }
-            case "callable.coerce":
-                // A coercion only weakens the callable's proved capabilities; SIR
-                // refuses one that changes an argument, a result or a capture shape,
-                // so the value itself is unchanged.
-                this.define(act, op.dst, this.read(act, op.source));
+            case "callable.coerce": {
+                const callable = this.read(act, op.source);
+                if (op.specialization === null) {
+                    this.define(act, op.dst, callable);
+                }
+                else {
+                    if (callable.kind !== "closure" ||
+                        !callable.entries.some((entry) => entry.specialization === op.specialization)) {
+                        throw new Error("callable specialization has no checked invocation entry");
+                    }
+                    this.define(act, op.dst, {
+                        ...callable,
+                        specialization: op.specialization,
+                    });
+                }
                 return;
+            }
             case "dyn.make":
                 this.define(act, op.dst, {
                     kind: "dyn",
@@ -576,6 +608,9 @@ class ExecutorV1 {
                     const duration = this.read(act, op.duration);
                     if (duration.kind !== "i64")
                         throw new Error("scope duration is not a duration");
+                    group.expiresAt =
+                        this.trace.virtualTimeMs +
+                            Math.max(0, Number(duration.value) / 1_000_000);
                     group.cancelTimer = this.scheduler.after(duration.value, () => {
                         group.deadline = {
                             kind: "panic",
@@ -617,6 +652,7 @@ class ExecutorV1 {
                 const context = {
                     id,
                     actor: act.context.actor,
+                    requestDeadline: this.requestDeadline(act),
                     returned: (value) => this.closeValueAsync(value, null, (fault) => this.finishGenerator(generator, fault)),
                     failed: (fault) => this.finishGenerator(generator, fault),
                 };
@@ -634,6 +670,106 @@ class ExecutorV1 {
                 this.define(act, op.dst, { kind: "generator", id });
                 return;
             }
+            case "task.race": {
+                const scope = act.scopes.get(op.scope);
+                if (!scope)
+                    throw new Error("race has no task scope");
+                const members = op.members.map((operand) => {
+                    const member = this.taskFor(this.read(act, operand));
+                    this.invalidate(act, operand);
+                    if (member.grouped)
+                        throw new Error("race reuses a task handle");
+                    member.grouped = true;
+                    return member;
+                });
+                if (!members.length)
+                    throw new Error("race requires members");
+                const task = this.newTask();
+                scope.tasks.push(task);
+                let selected = false;
+                let winner = null;
+                let value = UNIT;
+                let failure = null;
+                let cancelled = false;
+                const losersCancelled = new Set();
+                const ready = () => {
+                    if (task.done || task.finishing)
+                        return;
+                    if (!selected) {
+                        const first = members
+                            .filter((member) => member.done)
+                            .sort((a, b) => a.completedAt - b.completedAt)[0];
+                        if (!first)
+                            return;
+                        selected = true;
+                        if (!first.fault) {
+                            winner = first;
+                            value = first.value;
+                            first.value = UNIT;
+                        }
+                    }
+                    if (!cancelled) {
+                        cancelled = true;
+                        for (const member of members)
+                            if (!member.done) {
+                                losersCancelled.add(member);
+                                member.cancel();
+                            }
+                    }
+                    if (members.some((member) => !member.done))
+                        return;
+                    task.finishing = true;
+                    for (const member of members) {
+                        const index = member.changed.indexOf(ready);
+                        if (index >= 0)
+                            member.changed.splice(index, 1);
+                    }
+                    for (const member of [...members].sort((a, b) => a.completedAt - b.completedAt)) {
+                        if (member.fault &&
+                            !(member.fault.kind === "panic" &&
+                                member.fault.cancelled &&
+                                losersCancelled.has(member)))
+                            failure = combineFaults(failure, member.fault);
+                        member.fault = null;
+                    }
+                    const losers = members
+                        .filter((member) => member !== winner)
+                        .map((member) => {
+                        const result = member.value;
+                        member.value = UNIT;
+                        return result;
+                    });
+                    this.closeValueAsync({ kind: "vector", elementType: "race result", items: losers }, this.faultText(failure), (closeFault) => {
+                        failure = combineFaults(failure, closeFault);
+                        const finish = (releaseFault = null) => {
+                            failure = combineFaults(failure, releaseFault);
+                            this.settleTask(task, failure ? UNIT : value, failure);
+                            for (const changed of [...scope.changed])
+                                changed();
+                        };
+                        if (failure && winner)
+                            this.closeValueAsync(value, this.faultText(failure), finish, act.context.actor);
+                        else
+                            finish();
+                    }, act.context.actor);
+                };
+                task.cancel = () => {
+                    if (task.done || task.finishing)
+                        return;
+                    failure ??= {
+                        kind: "panic",
+                        message: "task cancelled",
+                        cancelled: true,
+                    };
+                    selected = true;
+                    ready();
+                };
+                for (const member of members)
+                    member.changed.push(ready);
+                this.define(act, op.dst, { kind: "task", id: task.id });
+                ready();
+                return;
+            }
             case "task.spawn": {
                 const group = act.scopes.get(op.scope);
                 if (!group)
@@ -656,7 +792,9 @@ class ExecutorV1 {
                         if (!fault || (fault.kind === "panic" && fault.cancelled))
                             fault = closeFault ?? fault;
                         this.settleTask(task, value, fault);
-                        if (fault && !(fault.kind === "panic" && fault.cancelled)) {
+                        if (!task.grouped &&
+                            fault &&
+                            !(fault.kind === "panic" && fault.cancelled)) {
                             for (const sibling of group.tasks)
                                 if (!sibling.done)
                                     sibling.cancel();
@@ -670,6 +808,7 @@ class ExecutorV1 {
                 const context = {
                     id: task.id,
                     actor: act.context.actor,
+                    requestDeadline: this.requestDeadline(act),
                     returned: (value) => settle(value, null),
                     failed: (fault) => settle(UNIT, fault),
                 };
@@ -783,6 +922,8 @@ class ExecutorV1 {
                     ...term.args.map((operand) => this.boundary(act, operand)),
                 ];
                 this.current = this.activate(this.functionAt(entry.callee), args, act, term.result, term.normal, term.unwind);
+                if (entry.receiver_handback)
+                    this.current.erasedHandback = receiver;
                 return;
             }
             case "call": {
@@ -797,7 +938,7 @@ class ExecutorV1 {
                 // `self`. A plain function value carries none.
                 const callee = this.boundary(act, term.callee);
                 const args = term.args.map((operand) => this.boundary(act, operand));
-                this.current = this.activate(this.functionAt(calleeFunction(callee)), callee.kind === "closure" ? [callee.environment, ...args] : args, act, term.result, term.normal, term.unwind);
+                this.current = this.activate(this.functionAt(calleeFunction(callee, term.specialization)), callee.kind === "closure" ? [callee.environment, ...args] : args, act, term.result, term.normal, term.unwind);
                 return;
             }
             case "actor.call":
@@ -805,6 +946,38 @@ class ExecutorV1 {
                 return;
             case "runtime.call": {
                 const entry = this.pkg.runtime_families[term.family];
+                if (entry?.family === "ActorCaller") {
+                    const caller = act.context.caller ?? { kind: "Task" };
+                    const payload = [];
+                    if (caller.kind === "Actor") {
+                        const shape = this.pkg.variants[term.result_shape];
+                        const tag = runtimeTag(shape, "CallerActor");
+                        payload.push({
+                            kind: "record",
+                            typeId: shape.cases[tag].fields[0],
+                            fields: [{ kind: "i64", value: caller.identity }],
+                        });
+                    }
+                    this.completeShim(act, term, this.variant(term.result_shape, caller.kind === "Actor"
+                        ? "CallerActor"
+                        : caller.kind === "Timer"
+                            ? "CallerTimer"
+                            : "CallerTask", payload));
+                    return;
+                }
+                if (entry?.family === "ActorRefusalLog") {
+                    const [message, handler, reason] = term.args.map((argument) => this.boundary(act, argument));
+                    this.trace.snapshot("actor.delivery_refused", {
+                        actor_id: act.context.actor?.id ?? null,
+                        handler: toJsonValue(handler),
+                        message: toJsonValue(message),
+                        reason: toJsonValue(reason),
+                    });
+                    if (!act.context.reply)
+                        this.trace.writeStderr(`WARN actor.delivery_refused actor=${act.context.actor?.identity ?? 0n} handler=${asString(handler)} reason=${JSON.stringify(asString(reason))}\n`, null);
+                    this.completeShim(act, term, UNIT);
+                    return;
+                }
                 if (entry &&
                     (entry.family === "Map" ||
                         entry.family === "Set" ||
@@ -866,6 +1039,11 @@ class ExecutorV1 {
                 this.callShim(act, term, shim);
                 return;
             }
+            case "wire.codec": {
+                const args = term.args.map((operand) => this.boundary(act, operand));
+                this.runValueProgram(act, term, args, executeCodec(this.pkg, term, args[0], this.options.codecBridge, this.options.propertyInput ?? []));
+                return;
+            }
             case "value.call": {
                 const args = term.args.map((operand) => this.boundary(act, operand));
                 this.runValueProgram(act, term, args, selectedValue(this.pkg, term.plan, args));
@@ -960,8 +1138,10 @@ class ExecutorV1 {
                 return;
             case "unreachable":
                 throw new Error(`${act.fn.name}: reached an unreachable endpoint`);
-            default:
-                throw new Error(`terminator ${term.op} has no sequential executor`);
+            default: {
+                const exhaustive = term;
+                throw new Error(`unhandled terminator: ${String(exhaustive)}`);
+            }
         }
     }
     takeEdge(act, edge) {
@@ -992,6 +1172,7 @@ class ExecutorV1 {
         }
         catch (error) {
             if (error instanceof ShimFault) {
+                this.keepInputs(act, term, args);
                 this.raiseFault(act, { kind: "trap", trap: error.trap, message: error.message }, term.unwind);
                 return;
             }
@@ -999,6 +1180,20 @@ class ExecutorV1 {
         }
         this.completeShim(act, term, value);
     }
+    /// A runtime call whose contract keeps its inputs on failure fails before
+    /// taking them, so each moved argument stays with the caller, whose unwind
+    /// edge stores it back.
+    keepsInputs(term) {
+        return term.op === "runtime.call" && term.keeps_inputs_on_failure === true;
+    }
+    keepInputs(act, term, args) {
+        if (!this.keepsInputs(term))
+            return;
+        term.args.forEach((operand, index) => {
+            if (operand.decision === "move")
+                this.define(act, operand.value, args[index]);
+        });
+    }
     runValueProgram(act, term, args, iterator) {
         this.running = false;
         let initial = true;
@@ -1010,10 +1205,16 @@ class ExecutorV1 {
                 this.scheduler.enqueue(act.context.id, () => this.runFrame(act));
         };
         const fail = (fault, extra = UNIT) => {
-            const owned = args.filter((_arg, index) => ["move", "copy", "snapshot"].includes(term.args[index].decision));
+            const kept = this.keepsInputs(term) ? ["move"] : [];
+            const owned = args.filter((_arg, index) => {
+                const decision = term.args[index].decision;
+                return (["move", "copy", "snapshot"].includes(decision) &&
+                    !kept.includes(decision));
+            });
             this.closeValueAsync({ kind: "vector", elementType: "", items: [...owned, extra] }, this.faultText(fault), (closeFault) => {
                 if (fault.kind === "panic" && fault.cancelled && closeFault)
                     fault = closeFault;
+                this.keepInputs(act, term, args);
                 this.raiseFault(act, fault, term.unwind);
                 resume();
             });
@@ -1116,6 +1317,13 @@ class ExecutorV1 {
         if (!act.normal) {
             throw new Error(`${act.fn.name}: returned from a call with a "never" result`);
         }
+        if (act.erasedHandback) {
+            if (value.kind !== "record" || value.fields.length !== 2) {
+                throw new Error(`${act.fn.name}: invalid erased receiver dual return`);
+            }
+            act.erasedHandback.value = value.fields[1];
+            value = value.fields[0];
+        }
         // The result is defined on the normal edge, like a block parameter, so it
         // is in scope for that edge's arguments.
         if (act.result && act.result !== "never") {
@@ -1166,12 +1374,15 @@ class ExecutorV1 {
         }
         // A failing `var self` method hands its receiver back, defined on the
         // unwind edge like a result on the normal edge.
-        if ((handback === null) !== !act.handback) {
+        if ((handback === null) !== !(act.handback || act.erasedHandback)) {
             throw new Error(`${act.fn.name}: receiver handback disagrees with its call`);
         }
         if (handback !== null && act.handback) {
             this.define(caller, act.handback.value, handback);
         }
+        if (handback !== null && act.erasedHandback) {
+            act.erasedHandback.value = handback;
+        }
         caller.fault = fault;
         this.current = caller;
         this.takeEdge(caller, act.unwind);
@@ -1305,11 +1516,10 @@ class ExecutorV1 {
                         return;
                     }
                     const failure = group.deadline ??
-                        group.tasks.find((task) => task.fault &&
+                        group.tasks.find((task) => !task.grouped &&
+                            task.fault &&
                             !(task.fault.kind === "panic" && task.fault.cancelled))?.fault;
-                    wake(UNIT, mode === "propagate_fault" || mode === "cancel_losers_after_fault"
-                        ? null
-                        : (failure ?? null));
+                    wake(UNIT, mode === "propagate_fault" ? null : (failure ?? null));
                 };
                 // Cancellation requests descendant cleanup; it cannot bypass the
                 // join barrier and let the parent retire their captured resources.
@@ -1380,7 +1590,12 @@ class ExecutorV1 {
                 return;
             }
             case "NativeIo": {
-                // Admission passed only `StdinReadLine`. The record is the raw line,
+                if (term.detail?.operation === "SinkFinish") {
+                    this.host.pipes.close(this.boundary(act, term.inputs[0]));
+                    this.park(act, term)(UNIT);
+                    return;
+                }
+                // Admission passed `StdinReadLine`. The record is the raw line,
                 // so the records concatenate to the stdin the program consumed.
                 const line = this.stdin.readLine() ?? new Uint8Array();
                 this.trace.recordReplayInput({ kind: "stdin", data: new TextDecoder().decode(line) }, false);
@@ -1608,6 +1823,7 @@ class ExecutorV1 {
     newTask() {
         const task = {
             id: this.ids.task(),
+            grouped: false,
             done: false,
             finishing: false,
             value: UNIT,
@@ -1700,6 +1916,9 @@ class ExecutorV1 {
     actorCall(act, term) {
         const args = term.args.map((arg) => this.boundary(act, arg));
         const operation = term.operation;
+        const caller = act.context.actor
+            ? { kind: "Actor", identity: act.context.actor.identity }
+            : { kind: "Task" };
         switch (operation.op) {
             case "spawn": {
                 const layout = this.pkg.actors?.find((actor) => actor.id === operation.actor);
@@ -1707,6 +1926,7 @@ class ExecutorV1 {
                     throw new Error(`actor layout ${operation.actor} is missing`);
                 let supplied = 0;
                 const actor = {
+                    identity: ++this.actorIdentity,
                     id: this.ids.actor(),
                     layout,
                     state: {
@@ -1715,6 +1935,7 @@ class ExecutorV1 {
                         fields: layout.state_fields.map((field) => field.deferred ? UNIT : (args[supplied++] ?? UNIT)),
                     },
                     mailbox: [],
+                    disposals: [],
                     admission: [],
                     busy: true,
                     alive: true,
@@ -1789,9 +2010,11 @@ class ExecutorV1 {
                         if (!handler)
                             throw new Error("stream request has no producer handler");
                         actor.mailbox.push({
+                            caller,
                             handler,
                             payload: fields,
                             reply: false,
+                            obligated: true,
                             complete: (_value, error, drained) => {
                                 if (error)
                                     this.closeValue(payload, error);
@@ -1871,13 +2094,13 @@ class ExecutorV1 {
                     }
                     const full = actor.layout.mailbox_capacity !== undefined &&
                         actor.mailbox.length >= actor.layout.mailbox_capacity;
-                    // The destination's declaration answers a full queue before the
-                    // sender's policy: a coalescing mailbox supersedes the queued
-                    // message with the same key, then its fallback or a declared
-                    // `drop_new` / `drop_old` resolves the rest. Either loss reports a
-                    // discard; only a declaration that refuses reaches the sender.
-                    // A discard completes in this turn unless an authored close
-                    // suspends: the sender keeps its turn, as it does natively.
+                    // Declared loss transfers cleanup to the receiver. Sender-selected
+                    // loss still closes the sender's unadmitted request in its own frame.
+                    const discardAtReceiver = (value, report) => {
+                        actor.disposals.push(value);
+                        this.dispatchActor(actor);
+                        finish(report);
+                    };
                     const discard = (value, report) => {
                         let settled = false;
                         let waiting = false;
@@ -1900,7 +2123,7 @@ class ExecutorV1 {
                     if (declared === "coalesce" && coalesce) {
                         const key = coalesce.keys.find((key) => key.message === handler.message_id);
                         const queued = key
-                            ? actor.mailbox.findIndex((message) => !message.reply &&
+                            ? actor.mailbox.findIndex((message) => !message.obligated &&
                                 message.handler.message_id === handler.message_id &&
                                 equals(message.payload[key.param], payload.fields[key.param]))
                             : -1;
@@ -1908,32 +2131,35 @@ class ExecutorV1 {
                             const superseded = actor.mailbox[queued];
                             actor.mailbox[queued] = {
                                 ...superseded,
+                                caller,
                                 payload: payload.fields,
                             };
-                            discard({ kind: "record", typeId: "", fields: superseded.payload }, accepted(true));
+                            discardAtReceiver({ kind: "record", typeId: "", fields: superseded.payload }, accepted(false));
                             return;
                         }
                         declared = coalesce.fallback;
                     }
                     if (declared === "drop_new") {
-                        discard(payload, accepted(true));
+                        discardAtReceiver(payload, accepted(true));
                         return;
                     }
                     // A queued completion call owes its caller a reply, so `drop_old`
                     // evicts only a one-way message and refuses when there is none.
                     const oldest = declared === "drop_old"
-                        ? actor.mailbox.findIndex((message) => !message.reply)
+                        ? actor.mailbox.findIndex((message) => !message.obligated)
                         : -1;
                     if (oldest >= 0) {
                         const [evicted] = actor.mailbox.splice(oldest, 1);
                         actor.mailbox.push({
+                            caller,
                             handler,
                             payload: payload.fields,
                             reply: false,
+                            obligated: false,
                             complete: (_value, _error, drained) => drained?.(null),
                         });
                         this.dispatchActor(actor);
-                        discard({ kind: "record", typeId: "", fields: evicted.payload }, accepted(false));
+                        discardAtReceiver({ kind: "record", typeId: "", fields: evicted.payload }, accepted(false));
                         return;
                     }
                     if (full) {
@@ -1955,9 +2181,11 @@ class ExecutorV1 {
                         return;
                     }
                     actor.mailbox.push({
+                        caller,
                         handler,
                         payload: payload.fields,
                         reply: false,
+                        obligated: false,
                         complete: (_value, _error, drained) => drained?.(null),
                     });
                     this.trace.snapshot("actor.send", {
@@ -2142,15 +2370,32 @@ class ExecutorV1 {
                 throw new Error(`actor operation ${operation.op} has no executor`);
         }
     }
+    requestDeadline(act) {
+        let deadline = act.context.requestDeadline;
+        for (let frame = act; frame; frame = frame.caller) {
+            for (const group of frame.scopes.values()) {
+                if (group.expiresAt !== undefined)
+                    deadline = Math.min(deadline ?? Infinity, group.expiresAt);
+            }
+        }
+        return deadline;
+    }
     ask(protocol, inputs, complete, shapes) {
         let settled = false;
         let admitted = false;
         let closing = false;
         const owner = this.current.context.actor;
+        const deadline = this.requestDeadline(this.current);
+        let cancelTimer;
+        let message;
+        const caller = owner
+            ? { kind: "Actor", identity: owner.identity }
+            : { kind: "Task" };
         let receiver = null;
         const finish = (value, error, drained) => {
             const alreadySettled = settled;
             settled = true;
+            cancelTimer?.();
             if (alreadySettled || complete(value, error) === false) {
                 // The finishing receiver still owns a reply that its caller no
                 // longer accepts. Its next turn must wait for this release.
@@ -2194,12 +2439,17 @@ class ExecutorV1 {
                 if (settled)
                     return;
                 settled = true;
+                cancelTimer?.();
                 complete(null, reason, fault);
             });
         };
         const attempt = () => {
             if (settled || closing)
                 return;
+            if (deadline !== undefined && deadline <= this.trace.virtualTimeMs) {
+                reject("TimedOut");
+                return;
+            }
             const role = "id" in target ? this.roles.get(target.id) : undefined;
             if (role && this.rolePending(role)) {
                 role.waiting.push(attempt);
@@ -2252,17 +2502,50 @@ class ExecutorV1 {
             }
             admitted = true;
             receiver = actor;
-            actor.mailbox.push({ handler, payload, complete: finish, reply: true });
+            message = {
+                caller,
+                handler,
+                payload,
+                complete: finish,
+                reply: true,
+                obligated: true,
+                requestDeadline: deadline,
+            };
+            actor.mailbox.push(message);
             this.trace.snapshot("actor.ask", {
                 actor_id: actor.id,
                 handler: handler.name,
             });
             this.dispatchActor(actor);
         };
+        const withdrawQueued = () => {
+            if (!message || !receiver)
+                return;
+            const index = receiver.mailbox.indexOf(message);
+            if (index < 0)
+                return;
+            receiver.mailbox.splice(index, 1);
+            admitted = false;
+            for (const admit of receiver.admission.splice(0))
+                admit();
+        };
+        if (deadline !== undefined) {
+            cancelTimer = this.scheduler.after(BigInt(Math.max(0, Math.round((deadline - this.trace.virtualTimeMs) * 1_000_000))), () => {
+                if (settled || closing)
+                    return;
+                withdrawQueued();
+                if (admitted)
+                    finish(null, "TimedOut");
+                else
+                    reject("TimedOut");
+            });
+        }
         attempt();
         return (done) => {
             const wasSettled = settled;
             settled = true;
+            cancelTimer?.();
+            withdrawQueued();
             if (admitted || (wasSettled && !closing))
                 done(null);
             else
@@ -2272,6 +2555,18 @@ class ExecutorV1 {
     dispatchActor(actor) {
         if (actor.busy || !actor.alive || actor.drainingMailbox)
             return;
+        if (actor.disposals.length > 0) {
+            actor.busy = true;
+            const values = actor.disposals.splice(0);
+            this.closeValueAsync({ kind: "vector", elementType: "message", items: values }, this.faultText(actor.crashing), (fault) => {
+                actor.busy = false;
+                if (fault)
+                    this.crashActor(actor, fault);
+                else
+                    this.dispatchActor(actor);
+            }, actor);
+            return;
+        }
         if (actor.terminating && actor.mailbox.length > 0) {
             this.drainMailbox(actor, this.faultText(actor.closingFault), (fault) => {
                 actor.closingFault = combineFaults(actor.closingFault, fault);
@@ -2301,6 +2596,18 @@ class ExecutorV1 {
             }
             for (const admit of actor.admission.splice(0))
                 admit();
+            if (message.requestDeadline !== undefined &&
+                message.requestDeadline <= this.trace.virtualTimeMs) {
+                this.closeValueAsync({ kind: "record", typeId: "", fields: message.payload }, null, (fault) => {
+                    message.complete(null, "TimedOut");
+                    actor.busy = false;
+                    if (fault)
+                        this.crashActor(actor, fault);
+                    else
+                        this.dispatchActor(actor);
+                }, actor);
+                return;
+            }
             this.trace.snapshot("actor.receive", {
                 actor_id: actor.id,
                 handler: message.handler.name,
@@ -2308,6 +2615,9 @@ class ExecutorV1 {
             const frame = this.activate(this.functionAt(message.handler.callable), [actor.state, ...message.payload], null, null, undefined, null, {
                 id: actor.id,
                 actor,
+                caller: message.caller,
+                requestDeadline: message.requestDeadline,
+                reply: message.reply,
                 returned: (value) => {
                     actor.active = null;
                     const drained = (fault) => {
@@ -2345,7 +2655,14 @@ class ExecutorV1 {
                 failed: (fault) => {
                     actor.active = null;
                     actor.busy = false;
-                    if (fault.kind === "panic" && fault.cancelled) {
+                    if (fault.kind === "trap" &&
+                        fault.trap === "actor_refused" &&
+                        !fault.secondary?.length) {
+                        actor.crashing = null;
+                        message.complete(null, "Refused");
+                        this.dispatchActor(actor);
+                    }
+                    else if (fault.kind === "panic" && fault.cancelled) {
                         message.complete(null, "Dead");
                         this.dispatchActor(actor);
                     }
@@ -2649,11 +2966,14 @@ class ExecutorV1 {
         this.closeValueAsync({
             kind: "vector",
             elementType: "message",
-            items: messages.map((message) => ({
-                kind: "record",
-                typeId: "",
-                fields: message.payload,
-            })),
+            items: [
+                ...actor.disposals.splice(0),
+                ...messages.map((message) => ({
+                    kind: "record",
+                    typeId: "",
+                    fields: message.payload,
+                })),
+            ],
         }, fault, (closeFault) => {
             actor.drainingMailbox = false;
             for (const message of messages)
@@ -2784,8 +3104,10 @@ function combineFaults(primary, secondary) {
     // Reports own an immutable ordered view of original diagnostics. Faults can
     // be shared by a parked unwind, actor completion and multiple observers;
     // combining those views must neither duplicate nor mutate their graph.
-    const retained = primary.kind === "panic" && primary.cancelled
-        ? diagnostics.filter((fault) => !(fault.kind === "panic" && fault.cancelled))
+    const control = (fault) => (fault.kind === "panic" && fault.cancelled) ||
+        (fault.kind === "trap" && fault.trap === "actor_refused");
+    const retained = control(primary)
+        ? diagnostics.filter((fault) => !control(fault))
         : diagnostics;
     const [first, ...rest] = retained.length ? retained : diagnostics;
     return { ...first, primary: first, secondary: rest };
@@ -2803,6 +3125,7 @@ function faultInfo(fault) {
         divide_by_zero: [202, "DivideByZero"],
         shift_out_of_range: [204, "ShiftOutOfRange"],
         vector_bounds: [205, "IndexOutOfBounds"],
+        actor_refused: [-4, "Refused"],
     }[fault.trap];
 }
 function faultReport(fault, secondary = false) {
@@ -2872,6 +3195,8 @@ function actorErrorRole(reason) {
             return "ActorErrorFailed";
         case "Trapped":
             return "ActorErrorTrapped";
+        case "Refused":
+            return "ActorErrorRefused";
         case "Dead":
             return "ActorErrorDead";
         case "TimedOut":
@@ -2906,8 +3231,6 @@ function sendErrorRole(reason) {
             return "SendErrorCancelled";
         case "VersionMismatch":
             return "SendErrorVersionMismatch";
-        case "Unauthorized":
-            return "SendErrorUnauthorized";
         case "Backpressure":
             return "SendErrorBackpressure";
         case "Dead":
@@ -2916,12 +3239,17 @@ function sendErrorRole(reason) {
             throw new Error(`unknown send error reason ${reason}`);
     }
 }
-function calleeFunction(value) {
+function calleeFunction(value, specialization = null) {
     switch (value.kind) {
         case "function":
             return Number(value.id);
-        case "closure":
-            return value.body;
+        case "closure": {
+            const selected = specialization ?? value.specialization;
+            const entry = value.entries.find((candidate) => candidate.specialization === selected);
+            if (!entry)
+                throw new Error("callable has no selected concrete invocation entry");
+            return entry.body;
+        }
         default:
             throw new TypeError(`indirect.call expected a callable value, got ${value.kind}`);
     }
@@ -2998,6 +3326,8 @@ function trapMessage(trap) {
             return "shift amount out of range";
         case "vector_bounds":
             return "index out of bounds";
+        case "actor_refused":
+            return "delivery refused by interceptor";
     }
 }
 /// The operand type the package records. `isize` and `usize` are 64-bit in the
@@ -3104,6 +3434,21 @@ function applyBinary(op, lhs, rhs, ty) {
             return { kind: "bool", value: truth(lhs) && truth(rhs) };
         case "Or":
             return { kind: "bool", value: truth(lhs) || truth(rhs) };
+        case "BitAnd":
+        case "BitOr":
+        case "BitXor":
+            // Both operands were already evaluated; bool operands stay bool.
+            if (lhs.kind === "bool" && rhs.kind === "bool") {
+                return {
+                    kind: "bool",
+                    value: op === "BitAnd"
+                        ? lhs.value && rhs.value
+                        : op === "BitOr"
+                            ? lhs.value || rhs.value
+                            : lhs.value !== rhs.value,
+                };
+            }
+            break;
         default:
             break;
     }