@hew-lang/sandbox-vm 0.6.1 → 0.6.3

package/dist/interpreter/v1/exec.js

@@ -1,3 +1,4 @@
+import { BrowserDirectories, } from "./browser-directory.js";
 /// The `hew.sandbox.bytecode.v1` executor.
 ///
 /// The package is a projection of verified ownership SIR, so this executor
@@ -6,18 +7,22 @@
 /// follows the `unwind` edge the package names, and takes the failure edge a
 /// `checked.binary` names rather than trapping on its own.
 import { executeCodec } from "./codecs.js";
+import { actorIdentical } from "./actor-identity.js";
+import { ActorWaits } from "./actor-waits.js";
 import { TraceBuilder, runtimeFailure } from "../trace.js";
-import { UNIT, cloneValue, toJsonValue } from "../values.js";
+import { UNIT, cloneValue, stringValue, toJsonValue, } from "../values.js";
 import { runtimeTag } from "./package.js";
 import { StructuralRenderer } from "./structural.js";
+import { timestampBinary } from "./timestamp.js";
 import { selectedValue, collectionOperation, sharedOperation, } from "./value-operations.js";
 import { Pipes } from "./pipes.js";
 import { FrameScheduler } from "./scheduler.js";
 import { DeterministicIds } from "../../scheduler/ids.js";
 import { Mt19937 } from "./mt19937.js";
-import { ShimFault, resolveExternShim, resolveRuntimeShim, } from "./shims.js";
-import { admitPackage } from "./validate.js";
+import { ShimFault, CODEC_REGISTRATION, decodeUtf8Checked, resolveExtern, resolveRuntime, resolveSuspension, } from "./shims.js";
+import { AdmittedPackage } from "./validate.js";
 const DEFAULT_STEP_BUDGET = 1_000_000;
+const DEFAULT_ACTOR_STOP_NS = 5_000_000_000;
 /// Ends the run. The status is already recorded on the trace.
 class Halt extends Error {
     status;
@@ -52,7 +57,7 @@ class StdinReader {
         return this.bytes.slice(start, this.offset);
     }
 }
-export function runPackageV1(pkg, options = {}) {
+export async function runPackageV1(pkg, options = {}) {
     const fixtureId = options.fixtureId ?? "package";
     const replay = {
         seed: options.replay?.seed ?? 0,
@@ -65,14 +70,25 @@ export function runPackageV1(pkg, options = {}) {
     const trace = new TraceBuilder(pkg, fixtureId, options.traceId ?? `trace:${fixtureId}`, replay, options.sandboxVersion ?? "0.0.0-spec");
     // Admission is a load-time decision: nothing runs when the package names a
     // capability the VM has no shim for.
-    const rejection = admitPackage(pkg);
-    if (rejection) {
-        trace.reject(rejection);
+    const admission = AdmittedPackage.load(pkg, options);
+    if (!(admission instanceof AdmittedPackage)) {
+        trace.reject(admission);
         return trace.finish();
     }
-    const vm = new ExecutorV1(pkg, trace, StdinReader.fromReplay(replay.inputs), options.schedulerPolicy ?? "round_robin", options);
+    const directoryRefusal = await BrowserDirectories.admission(options.directoryRoots);
+    if (directoryRefusal) {
+        trace.reject({
+            category: "not_implemented",
+            code: "sandbox.host.directory",
+            capability: "directoryRoots",
+            message: directoryRefusal,
+            span: null,
+        });
+        return trace.finish();
+    }
+    const vm = new ExecutorV1(admission, trace, StdinReader.fromReplay(replay.inputs), options.schedulerPolicy ?? "round_robin", options);
     try {
-        vm.run();
+        await vm.run();
     }
     catch (error) {
         if (!(error instanceof Halt)) {
@@ -83,7 +99,6 @@ export function runPackageV1(pkg, options = {}) {
     return trace.finish();
 }
 class ExecutorV1 {
-    pkg;
     trace;
     stdin;
     options;
@@ -92,10 +107,13 @@ class ExecutorV1 {
     scheduler;
     ids;
     actors = new Map();
+    actorWaits = new ActorWaits();
     supervisors = new Map();
     roles = new Map();
     pipes = new Pipes();
     generators = new Map();
+    generatorStreams = new Map();
+    senderEndpoints = new Map();
     tasks = new Map();
     completedTasks = 0;
     actorIdentity = 0n;
@@ -105,18 +123,68 @@ class ExecutorV1 {
     consumedResources = new WeakSet();
     running = false;
     rootComplete = false;
+    terminating = false;
     rootFault = null;
-    constructor(pkg, trace, stdin, policy, options) {
-        this.pkg = pkg;
+    pkg;
+    directories;
+    constructor(admission, trace, stdin, policy, options) {
         this.trace = trace;
         this.stdin = stdin;
         this.options = options;
+        const pkg = admission.bytecode;
+        this.pkg = pkg;
+        this.directories = new BrowserDirectories(options.directoryRoots);
         this.scheduler = new FrameScheduler(trace, policy);
         this.ids = new DeterministicIds(trace.replay.seed);
         this.host = {
+            argv: [...(options.argv ?? ["main.hew"])],
+            unixTimeMillis: () => this.trace.virtualTimeMs,
+            calendarBridge: options.calendarBridge,
+            fileError: (operation) => {
+                const error = this.current.context.fileError;
+                switch (operation) {
+                    case "HasError":
+                        return { kind: "bool", value: error != null };
+                    case "LastErrorKind":
+                        return { kind: "i64", value: BigInt(error?.kind ?? 0) };
+                    case "LastErrno":
+                        if (error)
+                            error.kind = 0;
+                        return { kind: "i64", value: 0n };
+                    case "LastError":
+                        this.current.context.fileError = null;
+                        return stringValue(error?.message ?? "");
+                }
+            },
             pipes: this.pipes,
+            generatorStream: (value) => {
+                const id = this.ids.channel();
+                this.generatorStreams.set(id, {
+                    generator: this.generatorFor(value),
+                    closed: false,
+                    pending: null,
+                    fault: null,
+                    receiving: false,
+                });
+                return { kind: "stream", channelId: id };
+            },
+            encoderSink: (sink, encoder) => this.senderEndpoint({
+                sink,
+                encoder,
+                references: 0,
+                endpoints: 0,
+                busy: false,
+                waiting: new Set(),
+            }, !this.sinkClosed(sink)),
+            cloneSink: (value) => {
+                const endpoint = value.kind === "sink"
+                    ? this.senderEndpoints.get(value.channelId)
+                    : undefined;
+                return endpoint
+                    ? this.senderEndpoint(endpoint.owner, endpoint.open)
+                    : this.pipes.cloneSink(value);
+            },
             newPipe: (capacity) => this.newPipe(capacity),
-            closePipe: (value) => this.pipes.close(value, this.pipeFault(this.current)),
             releaseValue: (value) => this.closeValue(value, this.pipeFault(this.current)),
             writeStdout: (text) => this.trace.writeStdout(text, null),
             writeStderr: (text) => this.trace.writeStderr(text, null),
@@ -135,7 +203,7 @@ class ExecutorV1 {
             id: "actor:root",
             actor: null,
             returned: (value) => {
-                this.rootComplete = true;
+                this.completeRoot();
                 this.trace.exitCode =
                     pkg.entry?.exit === "status" && value.kind === "i64"
                         ? Number(value.value)
@@ -143,36 +211,63 @@ class ExecutorV1 {
             },
             failed: (fault) => {
                 this.rootFault = fault;
-                this.rootComplete = true;
+                this.completeRoot();
             },
         });
     }
     /// One instruction or terminator executed is one step, ownership ops
     /// included: the package's ops are what the program does.
-    run() {
-        this.runFrame(this.current);
-        this.scheduler.run();
-        if (!this.rootComplete) {
-            throw new Error("the root frame is waiting with no runnable work");
-        }
-        // Native main return drains accepted work before closing idle actors.
-        for (const owner of this.supervisors.values())
-            if (!owner.supervisor)
-                this.stopSupervisor(owner);
-        for (const actor of this.actors.values())
-            if (!actor.supervisor && actor.alive)
-                this.requestActorStop(actor);
-        this.scheduler.run();
-        if (this.rootFault)
-            this.haltWithFault(this.rootFault);
-        if (this.trace.exitCode === 0 && this.faultDebts.size)
-            this.trace.exitCode = 1;
+    async run() {
+        const root = this.current.context;
+        const cancel = () => {
+            const fault = {
+                kind: "panic",
+                message: "execution cancelled",
+                cancelled: true,
+            };
+            if (root.cancel)
+                root.cancel(fault);
+            else
+                root.pendingCancellation ??= fault;
+        };
+        this.options.signal?.addEventListener("abort", cancel, { once: true });
+        if (this.options.signal?.aborted)
+            cancel();
+        try {
+            this.runFrame(this.current);
+            await this.scheduler.run();
+            if (!this.rootComplete) {
+                throw new Error("the root frame is waiting with no runnable work");
+            }
+            // Native main return drains accepted work before closing idle actors.
+            for (const owner of this.supervisors.values())
+                if (!owner.supervisor)
+                    this.stopSupervisor(owner);
+            for (const actor of this.actors.values())
+                if (!actor.supervisor && actor.alive)
+                    this.requestActorStop(actor);
+            await this.scheduler.run();
+            if (this.rootFault)
+                this.haltWithFault(this.rootFault);
+            if (this.trace.exitCode === 0 && this.faultDebts.size)
+                this.trace.exitCode = 1;
+        }
+        finally {
+            this.terminating = true;
+            await this.scheduler.retireHost();
+            this.directories.retire((value) => this.closeHostResource(value));
+            this.options.signal?.removeEventListener("abort", cancel);
+        }
     }
     runFrame(frame) {
         this.current = frame;
         this.running = true;
         while (this.running) {
             const act = this.current;
+            act.context.cancel = (fault = { kind: "panic", message: "task cancelled", cancelled: true }) => {
+                if (this.scopeDeadline(act, fault) !== fault)
+                    act.context.pendingCancellation ??= fault;
+            };
             while (act.opIndex < act.block.ops.length) {
                 const op = act.block.ops[act.opIndex++];
                 if (op.op !== "coverage.hit")
@@ -203,9 +298,19 @@ class ExecutorV1 {
     }
     // ── frames ───────────────────────────────────────────────────────────────
     activate(fn, args, caller, result, normal, unwind, context) {
-        if ((this.pkg.resources ?? []).some((resource) => resource.close === fn.id) &&
-            args[0])
+        const mandatoryClose = (this.pkg.resources ?? []).some((resource) => "close" in resource && resource.close === fn.id);
+        const parentContext = caller?.context ?? context;
+        parentContext.pollBudget ??= { remaining: 0 };
+        if (mandatoryClose && args[0])
             this.closingResources.add(args[0]);
+        const executionContext = mandatoryClose
+            ? {
+                ...parentContext,
+                cancel: undefined,
+                pendingCancellation: undefined,
+                requestDeadline: undefined,
+            }
+            : parentContext;
         const env = new Map();
         for (const [at, param] of fn.params.entries()) {
             env.set(param.value, ownedRef(args[at] ?? UNIT));
@@ -220,7 +325,7 @@ class ExecutorV1 {
         for (const block of fn.blocks) {
             block.params.forEach(record);
             for (const op of block.ops) {
-                if (op.dst != null && op.own === "none")
+                if ("dst" in op && op.dst != null && op.own === "none")
                     trivial.add(op.dst);
             }
             const term = block.term;
@@ -231,7 +336,13 @@ class ExecutorV1 {
                     arm.fields.forEach(record);
         }
         return {
-            context: caller?.context ?? context,
+            rcOwner: fn.actor_construction
+                ? { blocks: new Set(), closed: false }
+                : (caller?.rcOwner ??
+                    executionContext.rcOwner ??
+                    executionContext.actor?.rcOwner ??
+                    null),
+            context: executionContext,
             fn,
             block: this.blockAt(fn, fn.entry),
             opIndex: 0,
@@ -243,7 +354,7 @@ class ExecutorV1 {
             parked: [],
             caller,
             result,
-            normal,
+            normal: normal ?? undefined,
             unwind,
         };
     }
@@ -373,7 +484,7 @@ class ExecutorV1 {
                 this.define(act, op.dst, { kind: "f64", value: floatConst(op) });
                 return;
             case "const.char":
-                this.define(act, op.dst, { kind: "string", value: op.value });
+                this.define(act, op.dst, stringValue(op.value));
                 return;
             case "const.unit":
                 this.define(act, op.dst, UNIT);
@@ -382,10 +493,7 @@ class ExecutorV1 {
                 this.define(act, op.dst, { kind: "i64", value: BigInt(op.nanos) });
                 return;
             case "const.str":
-                this.define(act, op.dst, {
-                    kind: "string",
-                    value: this.pkg.strings[op.str] ?? "",
-                });
+                this.define(act, op.dst, stringValue(this.pkg.strings[op.str] ?? ""));
                 return;
             case "const.bytes":
                 this.define(act, op.dst, bytesValue(this.pkg.bytes[op.bytes] ?? []));
@@ -459,7 +567,7 @@ class ExecutorV1 {
             case "aggregate.make":
                 this.define(act, op.dst, {
                     kind: "record",
-                    typeId: this.aggregateName(op.shape),
+                    typeId: op.shape === null ? "" : this.aggregateName(op.shape),
                     shape: op.shape ?? undefined,
                     fields: op.fields.map((id) => this.read(act, id)),
                 });
@@ -652,8 +760,9 @@ class ExecutorV1 {
                 const context = {
                     id,
                     actor: act.context.actor,
+                    rcOwner: act.rcOwner,
                     requestDeadline: this.requestDeadline(act),
-                    returned: (value) => this.closeValueAsync(value, null, (fault) => this.finishGenerator(generator, fault)),
+                    returned: (value) => this.closeValueAsync(value, null, (fault) => this.finishGenerator(generator, fault), act.context.actor, act.rcOwner),
                     failed: (fault) => this.finishGenerator(generator, fault),
                 };
                 const generator = {
@@ -748,10 +857,10 @@ class ExecutorV1 {
                                 changed();
                         };
                         if (failure && winner)
-                            this.closeValueAsync(value, this.faultText(failure), finish, act.context.actor);
+                            this.closeValueAsync(value, this.faultText(failure), finish, act.context.actor, act.rcOwner);
                         else
                             finish();
-                    }, act.context.actor);
+                    }, act.context.actor, act.rcOwner);
                 };
                 task.cancel = () => {
                     if (task.done || task.finishing)
@@ -770,12 +879,44 @@ class ExecutorV1 {
                 ready();
                 return;
             }
-            case "task.spawn": {
+            case "task.spawn":
+            case "task.invoke": {
                 const group = act.scopes.get(op.scope);
                 if (!group)
                     throw new Error(`task scope ${op.scope} is missing`);
-                const callable = this.read(act, op.callable);
-                this.invalidate(act, op.callable);
+                const consuming = op.op === "task.spawn" ||
+                    ("receiver" in op.callee && op.callee.receiver.decision === "move");
+                const dynamic = op.op === "task.invoke" && "dyn" in op.callee ? op.callee : null;
+                const dynamicReceiver = dynamic
+                    ? this.boundary(act, dynamic.receiver)
+                    : null;
+                if (dynamicReceiver && dynamicReceiver.kind !== "dyn")
+                    throw new TypeError("prepared dynamic receiver is not a trait object");
+                const dynamicEntry = dynamicReceiver?.kind === "dyn" && dynamic
+                    ? this.dynamicEntry(dynamicReceiver, dynamic.dyn)
+                    : null;
+                if (dynamic && dynamicEntry?.method !== dynamic.method)
+                    throw new Error("prepared dynamic slot differs from its checked method");
+                const callable = op.op === "task.spawn"
+                    ? this.read(act, op.callable)
+                    : "direct" in op.callee
+                        ? { kind: "function", id: String(op.callee.direct) }
+                        : "mutable" in op.callee
+                            ? { kind: "function", id: String(op.callee.mutable) }
+                            : "dyn" in op.callee
+                                ? {
+                                    kind: "function",
+                                    id: String(dynamicEntry.callee),
+                                }
+                                : this.boundary(act, op.callee.receiver);
+                if (op.op === "task.spawn")
+                    this.invalidate(act, op.callable);
+                const args = op.op === "task.invoke"
+                    ? op.args.map((arg) => this.boundary(act, arg))
+                    : [];
+                const specialization = op.op === "task.invoke" && "specialization" in op.callee
+                    ? op.callee.specialization
+                    : null;
                 const task = this.newTask();
                 group.tasks.push(task);
                 const settle = (value, fault) => {
@@ -786,9 +927,7 @@ class ExecutorV1 {
                         !(fault.kind === "panic" && (fault.cancelled || fault.deadline)) &&
                         act.context.actor)
                         act.context.actor.crashing ??= fault;
-                    this.closeValueAsync(callable, act.context.actor
-                        ? this.faultText(act.context.actor.crashing)
-                        : null, (closeFault) => {
+                    const complete = (closeFault) => {
                         if (!fault || (fault.kind === "panic" && fault.cancelled))
                             fault = closeFault ?? fault;
                         this.settleTask(task, value, fault);
@@ -803,41 +942,104 @@ class ExecutorV1 {
                         }
                         for (const changed of [...group.changed])
                             changed();
-                    });
+                    };
+                    if (!consuming) {
+                        complete(null);
+                        return;
+                    }
+                    this.closeValueAsync(callable, act.context.actor
+                        ? this.faultText(act.context.actor.crashing)
+                        : null, complete, act.context.actor, act.rcOwner);
+                };
+                const mutable = op.op === "task.invoke" && "mutable" in op.callee ? op.callee : null;
+                const receiverRef = mutable
+                    ? this.refOf(act, mutable.receiver.value)
+                    : null;
+                if (dynamicReceiver?.kind === "dyn" && dynamicEntry && dynamic)
+                    args.unshift(this.erasedReceiver(act, dynamic.receiver, dynamicReceiver.value, dynamicEntry.receiver));
+                if (receiverRef)
+                    args.unshift(mutable.staged
+                        ? cloneValue(readRef(receiverRef))
+                        : readRef(receiverRef));
+                const handback = (value, fault, result) => {
+                    if (!receiverRef || !mutable || value === null)
+                        throw new Error("prepared mutable method omitted its receiver handback");
+                    if (mutable.staged && fault) {
+                        this.closeValueAsync(value, this.faultText(fault), (closeFault) => settle(UNIT, combineFaults(fault, closeFault)), act.context.actor, act.rcOwner);
+                    }
+                    else {
+                        const previous = readRef(receiverRef);
+                        writeRef(receiverRef, value);
+                        if (mutable.staged)
+                            this.closeValueAsync(previous, null, (closeFault) => {
+                                if (closeFault)
+                                    this.closeValueAsync(result, this.faultText(closeFault), (resultFault) => settle(UNIT, combineFaults(closeFault, resultFault)), act.context.actor, act.rcOwner);
+                                else
+                                    settle(result, null);
+                            }, act.context.actor, act.rcOwner);
+                        else
+                            settle(result, fault);
+                    }
                 };
                 const context = {
                     id: task.id,
                     actor: act.context.actor,
+                    rcOwner: act.rcOwner,
                     requestDeadline: this.requestDeadline(act),
-                    returned: (value) => settle(value, null),
-                    failed: (fault) => settle(UNIT, fault),
+                    returned: (value) => {
+                        if (dynamicEntry?.receiver_handback &&
+                            dynamicReceiver?.kind === "dyn") {
+                            if (value.kind !== "record" || value.fields.length !== 2)
+                                throw new Error("prepared dynamic method omitted its dual result");
+                            dynamicReceiver.value = value.fields[1];
+                            settle(value.fields[0], null);
+                        }
+                        else if (!mutable)
+                            settle(value, null);
+                        else if (value.kind === "record" && value.fields.length === 2)
+                            handback(value.fields[1], null, value.fields[0]);
+                        else
+                            throw new Error("prepared mutable method returned no dual result");
+                    },
+                    failed: (fault, value) => {
+                        if (dynamicEntry?.receiver_handback &&
+                            dynamicReceiver?.kind === "dyn") {
+                            if (!value)
+                                throw new Error("prepared dynamic method omitted its fault handback");
+                            dynamicReceiver.value = value;
+                        }
+                        if (mutable)
+                            handback(value ?? null, fault, UNIT);
+                        else
+                            settle(UNIT, fault);
+                    },
                 };
-                const frame = this.activate(this.functionAt(calleeFunction(callable)), callable.kind === "closure" ? [callable.environment] : [], null, null, undefined, null, context);
-                let started = false;
+                const frame = this.activate(this.functionAt(calleeFunction(callable, specialization)), callable.kind === "closure" ? [callable.environment, ...args] : args, null, null, undefined, null, context);
                 task.cancel = () => {
                     if (task.done || task.finishing)
                         return;
-                    if (started)
-                        context.cancel?.();
-                    else
-                        settle(UNIT, {
-                            kind: "panic",
-                            message: "task cancelled",
-                            cancelled: true,
-                        });
+                    context.pendingCancellation ??= {
+                        kind: "panic",
+                        message: "task cancelled",
+                        cancelled: true,
+                    };
+                    context.cancel?.(context.pendingCancellation);
                 };
                 this.scheduler.enqueue(task.id, () => {
                     if (task.done || task.finishing)
                         return;
-                    started = true;
                     this.runFrame(frame);
                 });
                 this.trace.allocateId("task", task.id, act.context.id);
                 this.define(act, op.dst, { kind: "task", id: task.id });
                 return;
             }
-            default:
-                throw new Error(`opcode ${op.op} has no sequential executor`);
+            case "actor.ingress_adapter":
+                throw new Error("actor ingress adapters are not admitted in the VM");
+            default: {
+                const exhaustive = op;
+                throw new Error("unhandled instruction: " + String(exhaustive));
+            }
         }
     }
     /// Hand each field of a consumed container, or each payload of a matched
@@ -887,6 +1089,20 @@ class ExecutorV1 {
             case "return":
                 this.returnFrom(act, term.value ? this.boundary(act, term.value) : UNIT);
                 return;
+            case "timestamp.binary": {
+                const outcome = timestampBinary(this.pkg, term, this.read(act, term.lhs), this.read(act, term.rhs));
+                if (outcome === null) {
+                    const failure = term.failures.find((edge) => edge.trap === "integer_overflow");
+                    if (!failure)
+                        throw new Error("timestamp arithmetic lacks its overflow edge");
+                    this.takeEdge(act, failure.edge);
+                }
+                else {
+                    this.define(act, term.result.value, outcome);
+                    this.takeEdge(act, term.normal);
+                }
+                return;
+            }
             case "checked.binary": {
                 const failure = checkedFailure(term.binary_op, this.read(act, term.lhs), this.read(act, term.rhs), term.ty);
                 if (failure) {
@@ -906,14 +1122,7 @@ class ExecutorV1 {
                 if (receiver.kind !== "dyn") {
                     throw new TypeError(`dyn.call expected a trait object, got ${receiver.kind}`);
                 }
-                const vtable = this.pkg.vtables[receiver.vtable] ??
-                    this.pkg.vtables.find((candidate) => candidate.id === receiver.vtable);
-                // The slot number is the checker's own index, so it is matched rather
-                // than used as a position in the slot array.
-                const entry = vtable?.slots.find((candidate) => candidate.slot === term.slot);
-                if (!entry) {
-                    throw new Error(`vtable ${receiver.vtable} has no slot ${term.slot}`);
-                }
+                const entry = this.dynamicEntry(receiver, term.slot);
                 // The wrapped value is the method's receiver, ahead of the call's own
                 // arguments, passed under the decision the slot records: the erasure
                 // the concrete type was made under, not something read off the method.
@@ -946,102 +1155,128 @@ class ExecutorV1 {
                 return;
             case "runtime.call": {
                 const entry = this.pkg.runtime_families[term.family];
-                if (entry?.family === "ActorCaller") {
-                    const caller = act.context.caller ?? { kind: "Task" };
-                    const payload = [];
-                    if (caller.kind === "Actor") {
-                        const shape = this.pkg.variants[term.result_shape];
-                        const tag = runtimeTag(shape, "CallerActor");
-                        payload.push({
-                            kind: "record",
-                            typeId: shape.cases[tag].fields[0],
-                            fields: [{ kind: "i64", value: caller.identity }],
-                        });
-                    }
-                    this.completeShim(act, term, this.variant(term.result_shape, caller.kind === "Actor"
-                        ? "CallerActor"
-                        : caller.kind === "Timer"
-                            ? "CallerTimer"
-                            : "CallerTask", payload));
-                    return;
-                }
-                if (entry?.family === "ActorRefusalLog") {
-                    const [message, handler, reason] = term.args.map((argument) => this.boundary(act, argument));
-                    this.trace.snapshot("actor.delivery_refused", {
-                        actor_id: act.context.actor?.id ?? null,
-                        handler: toJsonValue(handler),
-                        message: toJsonValue(message),
-                        reason: toJsonValue(reason),
-                    });
-                    if (!act.context.reply)
-                        this.trace.writeStderr(`WARN actor.delivery_refused actor=${act.context.actor?.identity ?? 0n} handler=${asString(handler)} reason=${JSON.stringify(asString(reason))}\n`, null);
-                    this.completeShim(act, term, UNIT);
-                    return;
-                }
-                if (entry &&
-                    (entry.family === "Map" ||
-                        entry.family === "Set" ||
-                        (entry.family === "Array" && entry.detail === "Set") ||
-                        (entry.family === "Vector" &&
-                            ["Contains", "Clear", "Set"].includes(String(entry.detail))))) {
-                    const args = term.args.map((operand) => this.boundary(act, operand));
-                    const iterator = collectionOperation(this.pkg, entry.family === "Array" ? "Vector" : entry.family, String(entry.detail), args, term.callbacks ?? [], term.result_member_shapes?.[1] ?? term.result_shape);
-                    this.runValueProgram(act, term, args, iterator);
-                    return;
-                }
-                if (entry &&
-                    [
-                        "RcNew",
-                        "RcClone",
-                        "RcGet",
-                        "RcIsUnique",
-                        "RcSet",
-                        "RcStrongCount",
-                        "RcWeakCount",
-                    ].includes(entry.family)) {
-                    const args = term.args.map((operand) => this.boundary(act, operand));
-                    this.runValueProgram(act, term, args, sharedOperation(entry.family, args));
-                    return;
-                }
-                if (entry?.family === "SupervisorPool") {
-                    this.supervisorPool(act, term, String(entry.detail));
-                    return;
-                }
-                if (entry && ["SinkClose", "StreamClose"].includes(entry.family)) {
-                    const value = this.boundary(act, term.args[0]);
-                    this.running = false;
-                    this.closeValueAsync(value, this.pipeFault(act), (fault) => {
-                        if (fault)
-                            this.raiseFault(act, fault, term.unwind);
-                        else
-                            this.completeShim(act, term, UNIT);
-                        this.scheduler.enqueue(act.context.id, () => this.runFrame(act));
-                    });
-                    return;
-                }
-                if (entry?.family === "StructuralFormat") {
-                    this.structuralFormat(act, term);
+                if (!entry)
+                    throw new Error("runtime family is absent after admission");
+                const registration = resolveRuntime(entry);
+                if (registration.kind === "ordinary") {
+                    this.callShim(act, term, registration.shim);
                     return;
                 }
-                const shim = entry ? resolveRuntimeShim(entry) : undefined;
-                if (!entry || !shim) {
-                    throw new Error(`runtime family ${term.family} resolved no shim after admission`);
+                if (registration.kind === "refused")
+                    throw new Error(`runtime family ${registration.capability} was refused after admission`);
+                switch (registration.handler) {
+                    case "actor_caller": {
+                        const caller = act.context.caller ?? { kind: "Task" };
+                        const payload = [];
+                        if (caller.kind === "Actor") {
+                            const shape = this.pkg.variants[term.result_shape];
+                            const tag = runtimeTag(shape, "CallerActor");
+                            payload.push({
+                                kind: "record",
+                                typeId: shape.cases[tag].fields[0],
+                                fields: [{ kind: "i64", value: caller.identity }],
+                            });
+                        }
+                        this.completeShim(act, term, this.variant(term.result_shape, caller.kind === "Actor"
+                            ? "CallerActor"
+                            : caller.kind === "Timer"
+                                ? "CallerTimer"
+                                : "CallerTask", payload));
+                        return;
+                    }
+                    case "actor_refusal_log": {
+                        const [message, handler, reason] = term.args.map((argument) => this.boundary(act, argument));
+                        this.trace.snapshot("actor.delivery_refused", {
+                            actor_id: act.context.actor?.id ?? null,
+                            handler: toJsonValue(handler),
+                            message: toJsonValue(message),
+                            reason: toJsonValue(reason),
+                        });
+                        if (!act.context.reply)
+                            this.trace.writeStderr(`WARN actor.delivery_refused actor=${act.context.actor?.identity ?? 0n} handler=${asString(handler)} reason=${JSON.stringify(asString(reason))}\n`, null);
+                        this.completeShim(act, term, UNIT);
+                        return;
+                    }
+                    case "collection": {
+                        const args = term.args.map((operand) => this.boundary(act, operand));
+                        const iterator = collectionOperation(this.pkg, registration, args, term.callbacks ?? [], term.result_member_shapes?.[1] ?? term.result_shape);
+                        this.runValueProgram(act, term, args, iterator);
+                        return;
+                    }
+                    case "shared": {
+                        const args = term.args.map((operand) => this.boundary(act, operand));
+                        this.runValueProgram(act, term, args, sharedOperation(registration.operation, args, act.rcOwner, term.shared_payload_type ?? "", (value) => this.variant(term.result_shape, value ? "OptionSome" : "OptionNone", value ? [value] : [])));
+                        return;
+                    }
+                    case "supervisor_pool": {
+                        this.supervisorPool(act, term, registration.operation);
+                        return;
+                    }
+                    case "close": {
+                        const value = this.boundary(act, term.args[0]);
+                        this.running = false;
+                        this.closeValueAsync(value, this.pipeFault(act), (fault) => {
+                            if (fault)
+                                this.raiseFault(act, fault, term.unwind);
+                            else
+                                this.completeShim(act, term, UNIT);
+                            this.scheduler.enqueue(act.context.id, () => this.runFrame(act));
+                        }, act.context.actor, act.rcOwner);
+                        return;
+                    }
+                    case "structural_format": {
+                        this.structuralFormat(act, term);
+                        return;
+                    }
+                    case "utf8_decode": {
+                        const value = decodeUtf8Checked(this.boundary(act, term.args[0]));
+                        let result;
+                        if ("value" in value)
+                            result = this.variant(term.result_shape, "ResultOk", [
+                                stringValue(value.value),
+                            ]);
+                        else {
+                            const shapes = term.variant_result_shapes;
+                            const error = this.pkg.aggregates[shapes.error];
+                            result = this.variant(term.result_shape, "ResultErr", [
+                                {
+                                    kind: "record",
+                                    typeId: error.name,
+                                    shape: error.id,
+                                    fields: [
+                                        { kind: "i64", value: BigInt(value.validUpTo) },
+                                        this.variant(shapes.error_len, value.errorLen === null ? "OptionNone" : "OptionSome", value.errorLen === null
+                                            ? []
+                                            : [{ kind: "i64", value: BigInt(value.errorLen) }]),
+                                    ],
+                                },
+                            ]);
+                        }
+                        this.completeShim(act, term, result);
+                        return;
+                    }
+                    default: {
+                        const exhaustive = registration;
+                        throw new Error(`unknown runtime continuation ${String(exhaustive)}`);
+                    }
                 }
-                this.callShim(act, term, shim);
-                return;
             }
             case "extern.call": {
                 const entry = this.pkg.externs[term.extern];
-                const shim = entry ? resolveExternShim(entry.symbol) : undefined;
-                if (!entry || !shim) {
-                    throw new Error(`extern ${term.extern} resolved no shim after admission`);
-                }
-                this.callShim(act, term, shim);
+                if (!entry)
+                    throw new Error("external operation is absent after admission");
+                const registration = resolveExtern(entry);
+                if (registration.kind === "refused")
+                    throw new Error(`external operation ${registration.capability} was refused after admission`);
+                if (registration.kind === "directory")
+                    this.callDirectory(act, term, registration.operation);
+                else
+                    this.callShim(act, term, registration.shim);
                 return;
             }
             case "wire.codec": {
                 const args = term.args.map((operand) => this.boundary(act, operand));
-                this.runValueProgram(act, term, args, executeCodec(this.pkg, term, args[0], this.options.codecBridge, this.options.propertyInput ?? []));
+                this.runValueProgram(act, term, args, executeCodec(this.pkg, term, args[0], this.options[CODEC_REGISTRATION.bridge], this.options.propertyInput ?? []));
                 return;
             }
             case "value.call": {
@@ -1081,6 +1316,7 @@ class ExecutorV1 {
                 this.takeEdge(act, act.fault ? term.fault : term.normal);
                 return;
             case "enter_defer":
+                act.context.pollSuppression = (act.context.pollSuppression ?? 0) + 1;
                 // The deferred body runs on its own fault state: a body reached while
                 // unwinding must not read the fault it is cleaning up after.
                 act.parked.push(act.fault);
@@ -1088,6 +1324,7 @@ class ExecutorV1 {
                 this.takeEdge(act, term.body);
                 return;
             case "finish_defer": {
+                act.context.pollSuppression = (act.context.pollSuppression ?? 0) - 1;
                 // Combine the parked fault with whatever the body left, keeping the
                 // first: a join must never forget the fault the boundary carried in.
                 const parked = act.parked.pop();
@@ -1117,12 +1354,7 @@ class ExecutorV1 {
                     typeId: shape.name,
                     shape: shape.id,
                     tag: deadline ? term.deadline_variant : term.fault_variant,
-                    payload: [
-                        {
-                            kind: "string",
-                            value: faultReport(fault),
-                        },
-                    ],
+                    payload: [stringValue(faultReport(fault))],
                 };
                 act.fault = null;
                 if (act.context.actor)
@@ -1155,6 +1387,29 @@ class ExecutorV1 {
         act.block = target;
         act.opIndex = 0;
     }
+    callDirectory(act, term, operation) {
+        const args = term.args.map((operand) => this.boundary(act, operand));
+        const result = this.directories.call(operation, args, term.result_resource);
+        if (!(result instanceof Promise)) {
+            this.completeShim(act, term, result);
+            return;
+        }
+        // Acquisitions are synchronous in the language. Retain borrowed inputs and
+        // publish the new owner before the next authored cancellation safepoint.
+        this.running = false;
+        act.context.parked = true;
+        act.context.cancel = (fault = { kind: "panic", message: "task cancelled", cancelled: true }) => {
+            act.context.pendingCancellation ??= fault;
+        };
+        this.scheduler.submitHost(act.context.id, result, (outcome) => {
+            act.context.parked = false;
+            act.context.fileError = outcome.error;
+            this.completeShim(act, term, outcome.value);
+            this.runFrame(act);
+        }, (error) => {
+            throw error;
+        });
+    }
     /// Run a runtime or extern shim. A fault it raises takes the call's `unwind`
     /// edge so the cleanup the package names runs before the program ends.
     callShim(act, term, shim) {
@@ -1168,7 +1423,9 @@ class ExecutorV1 {
             : (this.pkg.variants[shapeId] ?? null);
         let value;
         try {
-            value = shim(this.host, args, shape);
+            const aggregateId = term.aggregate_result_shape;
+            const aggregate = aggregateId == null ? null : (this.pkg.aggregates[aggregateId] ?? null);
+            value = shim(this.host, args, shape, aggregate);
         }
         catch (error) {
             if (error instanceof ShimFault) {
@@ -1217,7 +1474,7 @@ class ExecutorV1 {
                 this.keepInputs(act, term, args);
                 this.raiseFault(act, fault, term.unwind);
                 resume();
-            });
+            }, act.context.actor, act.rcOwner);
         };
         const next = (value = UNIT) => {
             let step;
@@ -1235,6 +1492,9 @@ class ExecutorV1 {
                 this.completeShim(act, term, step.value);
                 resume();
             }
+            else if (step.value.kind === "fault") {
+                fail({ kind: "panic", message: step.value.message });
+            }
             else if (step.value.kind === "release") {
                 const request = step.value;
                 this.closeValueAsync(request.value, this.pipeFault(act), (fault) => {
@@ -1248,11 +1508,11 @@ class ExecutorV1 {
                         act.fault ??= fault;
                     }
                     next();
-                });
+                }, act.context.actor, act.rcOwner);
             }
             else {
                 const request = step.value;
-                const child = this.invokeFrame(act.context.actor, request.callee, request.args, next, fail);
+                const child = this.invokeFrame(act.context.actor, request.callee, request.args, next, fail, act.rcOwner);
                 act.context.cancel = (fault) => child.cancel?.(fault);
             }
         };
@@ -1261,18 +1521,35 @@ class ExecutorV1 {
     }
     supervisorPool(act, term, operation) {
         const [view, index] = term.args.map((arg) => this.boundary(act, arg));
-        if (view?.kind !== "vector" || index?.kind !== "i64")
-            throw new Error("pool operation has no view and index");
+        if (view?.kind !== "vector")
+            throw new Error("pool operation has no view");
+        if (operation === "Len") {
+            this.completeShim(act, term, {
+                kind: "i64",
+                value: BigInt(view.items.length),
+            });
+            return;
+        }
+        if (index?.kind !== "i64")
+            throw new Error("pool operation has no index");
         const value = view.items[Number(index.value)];
         if (operation === "Get") {
             this.completeShim(act, term, this.variant(term.result_shape, value ? "OptionSome" : "OptionNone", value ? [value] : []));
             return;
         }
-        if (!value) {
-            this.raiseFault(act, { kind: "trap", trap: "vector_bounds" }, term.unwind);
-            return;
+        switch (operation) {
+            case "Member":
+                if (!value) {
+                    this.raiseFault(act, { kind: "trap", trap: "vector_bounds" }, term.unwind);
+                    return;
+                }
+                this.completeShim(act, term, value);
+                return;
+            default: {
+                const exhaustive = operation;
+                throw new Error(`unknown supervisor pool operation ${String(exhaustive)}`);
+            }
         }
-        this.completeShim(act, term, value);
     }
     structuralFormat(act, term) {
         if (term.structural == null)
@@ -1282,7 +1559,7 @@ class ExecutorV1 {
         const continueRendering = () => {
             const next = renderer.next();
             if (typeof next === "string") {
-                this.completeShim(act, term, { kind: "string", value: next });
+                this.completeShim(act, term, stringValue(next));
                 this.scheduler.enqueue(act.context.id, () => this.runFrame(act));
                 return;
             }
@@ -1307,7 +1584,92 @@ class ExecutorV1 {
         }
         this.takeEdge(act, term.normal);
     }
+    sweepRcOwner(owner, actor, done) {
+        let firstFault = null;
+        let count = 0;
+        const byType = new Map();
+        const schedule = (work) => this.scheduler.enqueue(actor?.id ?? "actor:root", work);
+        const next = () => {
+            const blocks = owner.blocks;
+            owner.blocks = new Set();
+            if (!blocks.size) {
+                owner.closed = true;
+                if (actor && count)
+                    this.trace.snapshot("actor.rc_sweep", {
+                        actor_id: actor.id,
+                        rc_sweep: {
+                            count: String(count),
+                            by_type: [...byType]
+                                .sort(([a], [b]) => a.localeCompare(b))
+                                .map(([type_name, amount]) => ({
+                                type_name,
+                                count: String(amount),
+                            })),
+                        },
+                    });
+                done(firstFault);
+                return;
+            }
+            const marking = blocks.values();
+            const payloads = blocks.values();
+            let remaining = 64;
+            const release = () => {
+                if (!remaining--) {
+                    remaining = 64;
+                    schedule(release);
+                    return;
+                }
+                const item = payloads.next();
+                if (item.done) {
+                    schedule(next);
+                    return;
+                }
+                const cell = item.value;
+                const payload = cell.value;
+                cell.value = UNIT;
+                blocks.delete(cell);
+                this.closeValueAsync(payload, this.faultText(firstFault), (fault) => {
+                    firstFault = combineFaults(firstFault, fault);
+                    release();
+                }, actor, owner);
+            };
+            const mark = () => {
+                for (let i = 0; i < 64; i++) {
+                    const item = marking.next();
+                    if (item.done) {
+                        release();
+                        return;
+                    }
+                    const cell = item.value;
+                    cell.dying = true;
+                    cell.refs = 0;
+                    cell.owner = null;
+                    count += 1;
+                    byType.set(cell.typeName, (byType.get(cell.typeName) ?? 0) + 1);
+                }
+                schedule(mark);
+            };
+            mark();
+        };
+        next();
+    }
+    finishConstruction(act, done) {
+        if (!act.fn.actor_construction || !act.rcOwner)
+            return false;
+        const owner = act.rcOwner;
+        act.rcOwner = null;
+        this.running = false;
+        this.sweepRcOwner(owner, act.context.actor, (fault) => {
+            act.fault = combineFaults(act.fault, fault);
+            done();
+            const current = this.current;
+            this.scheduler.enqueue(current.context.id, () => this.runFrame(current));
+        });
+        return true;
+    }
     returnFrom(act, value) {
+        if (this.finishConstruction(act, () => this.returnFrom(act, value)))
+            return;
         const caller = act.caller;
         if (!caller) {
             this.running = false;
@@ -1332,6 +1694,14 @@ class ExecutorV1 {
         this.current = caller;
         this.takeEdge(caller, act.normal);
     }
+    dynamicEntry(receiver, slot) {
+        const table = this.pkg.vtables[receiver.vtable] ??
+            this.pkg.vtables.find((table) => table.id === receiver.vtable);
+        const entry = table?.slots.find((entry) => entry.slot === slot);
+        if (!entry)
+            throw new Error(`vtable ${receiver.vtable} has no slot ${slot}`);
+        return entry;
+    }
     /// The wrapped value on its way to a trait method's `self`. A `copy` receiver
     /// deep-clones, a `move` invalidates the trait object it came out of, and a
     /// borrow passes the live value.
@@ -1359,6 +1729,8 @@ class ExecutorV1 {
         this.takeEdge(act, unwind);
     }
     resumeUnwind(act, handback) {
+        if (this.finishConstruction(act, () => this.resumeUnwind(act, handback)))
+            return;
         const fault = act.fault;
         if (!fault) {
             throw new Error(`${act.fn.name}: resume_unwind with no pending fault`);
@@ -1366,7 +1738,7 @@ class ExecutorV1 {
         const caller = act.caller;
         if (!caller) {
             this.running = false;
-            act.context.failed(fault);
+            act.context.failed(fault, handback);
             return;
         }
         if (!act.unwind) {
@@ -1387,7 +1759,11 @@ class ExecutorV1 {
         this.current = caller;
         this.takeEdge(caller, act.unwind);
     }
-    suspend(act, term) {
+    suspend(act, input) {
+        const registration = resolveSuspension(input);
+        if (registration.kind === "refused")
+            throw new Error(`suspension ${registration.capability} was refused after admission`);
+        const term = registration.term;
         switch (term.kind) {
             case "Yield": {
                 const generator = act.context.generator;
@@ -1436,37 +1812,27 @@ class ExecutorV1 {
                 return;
             }
             case "StreamSend": {
-                const [sink, value] = term.inputs.map((input) => this.boundary(act, input));
-                let cancelWait = () => { };
-                let owned = true;
-                let closing = false;
-                let cancelled = null;
-                const wake = this.park(act, term, () => cancelWait());
+                const sink = this.boundary(act, term.inputs[0]);
+                const value = this.boundary(act, term.inputs[1]);
+                const wake = this.park(act, term);
                 const cancel = act.context.cancel;
+                const stop = this.sendStream(sink, value, term.detail.park, act.context.actor, (status, fault) => {
+                    wake(UNIT, fault, status);
+                }, act.rcOwner);
                 act.context.cancel = (fault = { kind: "panic", message: "task cancelled", cancelled: true }) => {
-                    cancelled ??= fault;
-                    cancelWait();
-                    if (owned) {
-                        owned = false;
-                        closing = true;
-                        this.closeValueAsync(value, this.faultText(fault), (closeFault) => cancel(closeFault ?? fault));
-                    }
-                    else if (!closing)
-                        cancel(fault);
+                    stop(fault, (closeFault) => cancel?.(closeFault ?? fault));
                 };
-                cancelWait = this.pipes.send(sink, value, term.detail.park, (status) => {
-                    owned = false;
-                    if (status === 0)
-                        wake(UNIT);
-                    else {
-                        closing = true;
-                        this.closeValueAsync(value, this.pipeFault(act), (fault) => wake(UNIT, fault ?? cancelled, status));
-                    }
-                });
                 return;
             }
             case "StreamNext": {
                 const stream = this.boundary(act, term.inputs[0]);
+                const adapter = stream.kind === "stream"
+                    ? this.generatorStreams.get(stream.channelId)
+                    : undefined;
+                if (adapter) {
+                    this.receiveGeneratorStream(act, term, adapter);
+                    return;
+                }
                 let cancelWait = () => { };
                 const wake = this.park(act, term, () => cancelWait());
                 cancelWait = this.pipes.receive(stream, term.detail.park, (value, fault) => {
@@ -1479,10 +1845,13 @@ class ExecutorV1 {
             }
             case "Await": {
                 const task = this.taskFor(this.boundary(act, term.inputs[0]));
-                const wake = this.park(act, term);
+                let unwatch = () => { };
+                const wake = this.park(act, term, () => unwatch());
                 const ready = () => {
-                    if (!task.done)
+                    if (!task.done) {
+                        this.pendingActorWait(act, [task.actorTarget], false, "ask", (fault) => wake(UNIT, fault));
                         return;
+                    }
                     if (task.fault)
                         wake(UNIT, task.fault);
                     else {
@@ -1492,6 +1861,11 @@ class ExecutorV1 {
                     }
                 };
                 task.changed.push(ready);
+                unwatch = () => {
+                    const index = task.changed.indexOf(ready);
+                    if (index >= 0)
+                        task.changed.splice(index, 1);
+                };
                 ready();
                 return;
             }
@@ -1554,6 +1928,11 @@ class ExecutorV1 {
                         cancelTimer?.();
                         wake({ kind: "i64", value: BigInt(ready[0].index) });
                     }
+                    else {
+                        this.pendingActorWait(act, sources.map((value) => value.kind === "stream"
+                            ? undefined
+                            : this.taskFor(value).actorTarget), hasTimeout, "select", (fault) => wake(UNIT, fault));
+                    }
                 };
                 if (hasTimeout) {
                     const duration = values[values.length - 1];
@@ -1581,27 +1960,115 @@ class ExecutorV1 {
                 const protocol = term.detail;
                 const inputs = term.inputs.map((input) => this.boundary(act, input));
                 const wake = this.park(act, term);
+                let target;
+                let checkWait;
                 const cancelRequest = this.ask(protocol, inputs, (value, error, closeFault) => {
                     act.fault ??= closeFault ?? null;
                     return wake(this.completion(term.result_shape, term.error_shape, value, error));
-                }, term.request_shapes);
+                }, term.request_shapes, (actor) => {
+                    target = actor;
+                    checkWait?.();
+                });
                 const cancel = act.context.cancel;
                 act.context.cancel = (fault) => cancelRequest((closeFault) => cancel(closeFault ?? fault));
+                checkWait = () => this.pendingActorWait(act, [target], false, "ask", (fault) => cancelRequest((closeFault) => wake(UNIT, closeFault ?? fault)));
+                checkWait();
                 return;
             }
             case "NativeIo": {
+                if (term.detail.operation === "FileRead" ||
+                    term.detail.operation === "FileWrite") {
+                    const args = term.inputs.map((operand) => this.boundary(act, operand));
+                    const wake = this.park(act, term);
+                    const cancel = act.context.cancel;
+                    let stopped = act.context.pendingCancellation ?? this.scopeDeadline(act) ?? null;
+                    act.context.cancel = (fault = {
+                        kind: "panic",
+                        message: "task cancelled",
+                        cancelled: true,
+                    }) => {
+                        stopped ??= fault;
+                    };
+                    this.scheduler.submitHost(act.context.id, this.directories.io(term.detail.operation, args, () => stopped !== null || this.terminating), (outcome) => {
+                        // The producer is quiescent. Restore park's latch so cancellation
+                        // between readiness and frame resumption still retires the result.
+                        act.context.cancel = cancel;
+                        act.context.fileError = outcome.error;
+                        if (stopped) {
+                            this.closeValue(outcome.value, null);
+                            cancel(stopped);
+                        }
+                        else
+                            wake(outcome.value);
+                    }, (error) => {
+                        throw error;
+                    });
+                    return;
+                }
                 if (term.detail?.operation === "SinkFinish") {
-                    this.host.pipes.close(this.boundary(act, term.inputs[0]));
-                    this.park(act, term)(UNIT);
+                    const wake = this.park(act, term);
+                    const cancel = act.context.cancel;
+                    let stopped = null;
+                    act.context.cancel = (fault = {
+                        kind: "panic",
+                        message: "task cancelled",
+                        cancelled: true,
+                    }) => {
+                        stopped ??= fault;
+                    };
+                    this.finishSink(this.boundary(act, term.inputs[0]), null, () => {
+                        if (stopped)
+                            cancel(stopped);
+                        else
+                            wake(UNIT);
+                    });
                     return;
                 }
-                // Admission passed `StdinReadLine`. The record is the raw line,
+                if (term.detail.operation !== "StdinReadLine") {
+                    const exhaustive = term.detail.operation;
+                    throw new Error(`unknown native I/O handler ${String(exhaustive)}`);
+                }
+                // The record is the raw line,
                 // so the records concatenate to the stdin the program consumed.
                 const line = this.stdin.readLine() ?? new Uint8Array();
                 this.trace.recordReplayInput({ kind: "stdin", data: new TextDecoder().decode(line) }, false);
                 this.park(act, term)(bytesValue([...line]));
                 return;
             }
+            case "Safepoint": {
+                if (act.context.pollSuppression) {
+                    this.takeEdge(act, term.resumes[0]);
+                    return;
+                }
+                if (act.context.pendingCancellation && term.cancel) {
+                    act.fault = act.context.pendingCancellation;
+                    this.takeEdge(act, term.cancel);
+                    return;
+                }
+                const budget = term.detail?.budget;
+                if (!Number.isInteger(budget) || budget <= 0)
+                    throw new Error("safepoint requires a positive compiler-authored budget");
+                const countdown = act.context.pollBudget;
+                countdown.remaining = (countdown.remaining || budget) - 1;
+                if (countdown.remaining > 0) {
+                    this.takeEdge(act, term.resumes[0]);
+                    return;
+                }
+                countdown.remaining = budget;
+                this.scheduler.advanceSlice();
+                const fault = act.context.pendingCancellation ?? this.scopeDeadline(act);
+                if (fault && term.cancel) {
+                    act.fault = fault;
+                    this.takeEdge(act, term.cancel);
+                }
+                else if (this.scheduler.hasRunnableWork()) {
+                    this.park(act, term)(UNIT);
+                }
+                else {
+                    this.takeEdge(act, term.resumes[0]);
+                }
+                return;
+            }
             case "Sleep": {
                 const duration = term.inputs[0]
                     ? this.boundary(act, term.inputs[0])
@@ -1612,17 +2079,40 @@ class ExecutorV1 {
                 cancelTimer = this.scheduler.after(nanos, () => wake(UNIT));
                 return;
             }
-            default:
-                throw new Error(`suspension kind ${term.kind} resolved no handler after admission`);
+            default: {
+                const exhaustive = term;
+                throw new Error(`unknown suspension handler ${String(exhaustive)}`);
+            }
         }
     }
+    pendingActorWait(act, targets, externalProgress, operation, fail) {
+        const owner = act.context.actor;
+        // Independent tasks carry actor ownership for cleanup, but do not hold its turn.
+        if (!owner || owner.active !== act.context || !act.context.parked)
+            return;
+        this.actorWaits.ready(owner);
+        if (externalProgress ||
+            this.requestDeadline(act) !== undefined ||
+            targets.some((target) => !target))
+            return;
+        const path = this.actorWaits.pending(owner, targets);
+        if (path)
+            fail({
+                kind: "panic",
+                message: `local actor wait cycle at ${operation}: ${path.map((actor) => actor.identity).join(" -> ")}`,
+            });
+    }
     park(act, term, cleanup = () => { }) {
         this.running = false;
+        act.context.parked = true;
         let pending = null;
         const resume = (value, fault = null, edge = 0) => {
             if (pending)
                 return false;
             pending = { value, fault, edge };
+            act.context.parked = false;
+            if (act.context.actor?.active === act.context)
+                this.actorWaits.ready(act.context.actor);
             cleanup();
             this.scheduler.enqueue(act.context.id, () => {
                 const outcome = pending;
@@ -1631,7 +2121,8 @@ class ExecutorV1 {
                     const fault = closeFault ?? (outcome.fault ? (act.fault ?? outcome.fault) : null);
                     if (fault) {
                         act.fault = fault;
-                        this.takeEdge(act, fault.kind === "panic" && fault.cancelled
+                        this.takeEdge(act, term.kind === "Safepoint" ||
+                            (fault.kind === "panic" && fault.cancelled)
                             ? term.cancel
                             : term.unwind);
                     }
@@ -1649,13 +2140,15 @@ class ExecutorV1 {
                 // the cancellation latch live through that window and retire a result
                 // whose normal edge the consumer never entered.
                 if (outcome.fault)
-                    this.closeValueAsync(outcome.value, this.faultText(act.fault ?? outcome.fault), finish, act.context.actor);
+                    this.closeValueAsync(outcome.value, this.faultText(act.fault ?? outcome.fault), finish, act.context.actor, act.rcOwner);
                 else
                     finish();
             });
             return true;
         };
         act.context.cancel = (fault = { kind: "panic", message: "task cancelled", cancelled: true }) => {
+            if (term.cancel == null)
+                return;
             if (pending)
                 pending.fault ??= fault;
             else
@@ -1663,32 +2156,248 @@ class ExecutorV1 {
         };
         return resume;
     }
-    newPipe(capacity) {
-        const id = this.ids.channel();
-        this.trace.allocateId("channel", id, this.current?.context.id ?? "actor:root");
-        return this.pipes.create(id, capacity);
-    }
-    faultText(fault) {
-        return !fault ||
-            (fault.kind === "panic" && (fault.cancelled || fault.deadline))
-            ? null
-            : fault.kind === "panic"
-                ? fault.message
-                : (fault.message ?? trapMessage(fault.trap));
+    sinkClosed(value) {
+        const endpoint = value.kind === "sink"
+            ? this.senderEndpoints.get(value.channelId)
+            : undefined;
+        return endpoint ? !endpoint.open : this.pipes.isClosed(value);
     }
-    pipeFault(act) {
-        return this.faultText(act.context.actor?.crashing ?? act.fault);
+    senderEndpoint(owner, open = true) {
+        const id = this.ids.channel();
+        owner.references++;
+        if (open)
+            owner.endpoints++;
+        this.senderEndpoints.set(id, { owner, open });
+        return { kind: "sink", channelId: id };
     }
-    releaseOperation(act, value, finish) {
-        let synchronous = true;
-        let completed = false;
-        this.closeValueAsync(value, this.pipeFault(act), (fault) => {
-            completed = true;
-            finish?.();
-            act.fault = combineFaults(act.fault, fault);
-            if (!synchronous)
+    finishSink(value, fault, done) {
+        const endpoint = value.kind === "sink"
+            ? this.senderEndpoints.get(value.channelId)
+            : undefined;
+        if (!endpoint) {
+            this.pipes.close(value, fault);
+            done();
+            return;
+        }
+        if (!endpoint.open) {
+            done();
+            return;
+        }
+        endpoint.open = false;
+        endpoint.owner.endpoints--;
+        if (fault || endpoint.owner.endpoints === 0) {
+            const finish = () => {
+                if (endpoint.owner.busy) {
+                    endpoint.owner.waiting.add(finish);
+                    return;
+                }
+                this.finishSink(endpoint.owner.sink, fault, done);
+            };
+            finish();
+        }
+        else
+            done();
+    }
+    sendStream(sink, value, park, actor, complete, rcOwner) {
+        const endpoint = sink.kind === "sink"
+            ? this.senderEndpoints.get(sink.channelId)
+            : undefined;
+        let owned = true;
+        let finished = false;
+        let closing = false;
+        let claimed = false;
+        let stopped = null;
+        let encoder = null;
+        let child = null;
+        let withdraw = () => { };
+        const drained = [];
+        const release = () => {
+            if (!claimed || !endpoint)
+                return;
+            claimed = false;
+            endpoint.owner.busy = false;
+            for (const wake of endpoint.owner.waiting)
+                this.scheduler.enqueue(actor?.id ?? "actor:root", wake);
+            endpoint.owner.waiting.clear();
+        };
+        const finish = (status, fault = null) => {
+            if (finished || closing)
+                return;
+            closing = true;
+            release();
+            const done = (closeFault = null) => {
+                finished = true;
+                const failure = combineFaults(fault, closeFault);
+                if (stopped)
+                    for (const wake of drained.splice(0))
+                        wake(failure);
+                else
+                    complete(status, failure);
+            };
+            if (owned) {
+                owned = false;
+                this.closeValueAsync(value, this.faultText(fault ?? stopped), done, actor, rcOwner);
+            }
+            else
+                done();
+        };
+        const start = () => {
+            if (stopped || finished || closing)
+                return;
+            if (!endpoint) {
+                withdraw = this.pipes.send(sink, value, park, (status) => {
+                    if (status === 0)
+                        owned = false;
+                    finish(status);
+                });
+                return;
+            }
+            if (!endpoint.open) {
+                finish(1);
+                return;
+            }
+            const owner = endpoint.owner;
+            if (owner.busy) {
+                if (!park) {
+                    finish(2);
+                    return;
+                }
+                owner.waiting.add(start);
+                withdraw = () => {
+                    owner.waiting.delete(start);
+                };
+                return;
+            }
+            owner.busy = true;
+            claimed = true;
+            const callable = owner.encoder;
+            encoder = this.invokeFrame(actor, calleeFunction(callable, null), callable.kind === "closure" ? [callable.environment, value] : [value], (encoded) => {
+                encoder = null;
+                if (stopped) {
+                    this.closeValueAsync(encoded, this.faultText(stopped), (fault) => finish(0, fault), actor, rcOwner);
+                }
+                else {
+                    child = this.sendStream(owner.sink, encoded, park, actor, (status, fault) => {
+                        child = null;
+                        finish(status, fault);
+                    }, rcOwner);
+                }
+            }, (fault) => {
+                encoder = null;
+                finish(3, fault);
+            }, rcOwner);
+        };
+        start();
+        return (fault, done) => {
+            if (finished) {
+                done(null);
+                return;
+            }
+            stopped ??= fault;
+            drained.push(done);
+            withdraw();
+            if (closing)
+                return;
+            if (encoder)
+                encoder.cancel?.(fault);
+            else if (child)
+                child(fault, (failure) => {
+                    child = null;
+                    finish(0, failure);
+                });
+            else
+                finish(0);
+        };
+    }
+    receiveGeneratorStream(act, term, adapter) {
+        const wake = this.park(act, term);
+        const receive = (value, fault) => {
+            if (fault)
+                wake(UNIT, fault);
+            else
+                wake(this.variant(term.result_shape, value === null ? "OptionNone" : "OptionSome", value === null ? [] : [value]));
+        };
+        if (adapter.pending !== null) {
+            const value = adapter.pending;
+            adapter.pending = null;
+            receive(value, null);
+            return;
+        }
+        const generator = adapter.generator;
+        if (generator.done) {
+            receive(null, adapter.fault ?? generator.fault);
+            return;
+        }
+        if (term.detail.park)
+            adapter.waiting = receive;
+        else
+            receive(null, null);
+        const cancel = act.context.cancel;
+        if (term.detail.park)
+            act.context.cancel = (fault) => {
+                adapter.waiting = undefined;
+                this.closeGenerator(generator, (closeFault) => cancel?.(closeFault ?? fault));
+            };
+        if (adapter.receiving)
+            return;
+        adapter.receiving = true;
+        generator.receive = (value, fault) => {
+            adapter.receiving = false;
+            if (adapter.closed) {
+                if (value !== null)
+                    this.closeValueAsync(value, null, () => { });
+                return;
+            }
+            adapter.fault = fault;
+            const waiting = adapter.waiting;
+            adapter.waiting = undefined;
+            if (waiting)
+                waiting(value, fault);
+            else
+                adapter.pending = value;
+        };
+        if (generator.started) {
+            const resume = generator.resume;
+            generator.resume = undefined;
+            if (!resume)
+                throw new Error("generator stream lost its suspended yield");
+            resume();
+        }
+        else {
+            this.scheduler.enqueue(generator.id, () => {
+                if (generator.done)
+                    return;
+                generator.started = true;
+                this.runFrame(generator.frame);
+            });
+        }
+    }
+    newPipe(capacity) {
+        const id = this.ids.channel();
+        this.trace.allocateId("channel", id, this.current?.context.id ?? "actor:root");
+        return this.pipes.create(id, capacity);
+    }
+    faultText(fault) {
+        return !fault ||
+            (fault.kind === "panic" && (fault.cancelled || fault.deadline))
+            ? null
+            : fault.kind === "panic"
+                ? fault.message
+                : (fault.message ?? trapMessage(fault.trap));
+    }
+    pipeFault(act) {
+        return this.faultText(act.context.actor?.crashing ?? act.fault);
+    }
+    releaseOperation(act, value, finish) {
+        let synchronous = true;
+        let completed = false;
+        this.closeValueAsync(value, this.pipeFault(act), (fault) => {
+            completed = true;
+            finish?.();
+            act.fault = combineFaults(act.fault, fault);
+            if (!synchronous)
                 this.scheduler.enqueue(act.context.id, () => this.runFrame(act));
-        });
+        }, act.context.actor, act.rcOwner);
         synchronous = false;
         if (!completed)
             this.running = false;
@@ -1713,7 +2422,7 @@ class ExecutorV1 {
             receive?.(null, generator.fault);
             for (const closed of generator.closed.splice(0))
                 closed(generator.fault);
-        });
+        }, generator.frame.context.actor, generator.frame.rcOwner);
     }
     closeGenerator(generator, done) {
         if (generator.done) {
@@ -1726,7 +2435,7 @@ class ExecutorV1 {
         else
             generator.frame.context.cancel?.();
     }
-    closeValueAsync(value, fault, done, actor = this.current.context.actor) {
+    closeValueAsync(value, fault, done, actor = this.current.context.actor, rcOwner = actor?.rcOwner ?? this.current.rcOwner) {
         const pending = [value];
         let firstFault = null;
         const next = (failure = null) => {
@@ -1737,15 +2446,41 @@ class ExecutorV1 {
             while (pending.length) {
                 const value = pending.pop();
                 switch (value.kind) {
+                    case "string":
+                        value.release();
+                        break;
                     case "rc":
                         if (!value.closed) {
                             value.closed = true;
-                            if (--value.cell.refs === 0) {
+                            if (value.cell && !value.cell.dying && --value.cell.refs === 0) {
+                                value.cell.owner?.blocks.delete(value.cell);
+                                value.cell.owner = null;
                                 pending.push(value.cell.value);
                                 value.cell.value = UNIT;
                             }
                         }
                         break;
+                    case "weak":
+                        if (!value.closed) {
+                            value.closed = true;
+                            value.cell.weak -= 1;
+                        }
+                        break;
+                    case "host_resource": {
+                        if (value.owner.closed)
+                            break;
+                        this.closeHostResource(value);
+                        break;
+                    }
+                    case "timer": {
+                        if (value.closed)
+                            break;
+                        const resource = this.pkg.resources?.[value.resource];
+                        if (resource?.kind !== "opaque")
+                            throw new Error("opaque owner lost its selected close");
+                        this.invokeFrame(actor, resource.close, [value], () => next(), next, rcOwner);
+                        return;
+                    }
                     case "task": {
                         // Dropping a handle does not cancel scoped work. Join drains the
                         // task, and scope close releases any result that was never taken.
@@ -1753,7 +2488,7 @@ class ExecutorV1 {
                         if (task?.done) {
                             const result = task.value;
                             task.value = UNIT;
-                            this.closeValueAsync(result, currentFault, (fault) => next(fault ?? (task.close ? task.fault : null)), actor);
+                            this.closeValueAsync(result, currentFault, (fault) => next(fault ?? (task.close ? task.fault : null)), actor, rcOwner);
                             return;
                         }
                         if (task?.close) {
@@ -1777,11 +2512,11 @@ class ExecutorV1 {
                         break;
                     case "record": {
                         const resource = (this.pkg.resources ?? []).find((resource) => resource.kind === "record" && resource.shape === value.shape);
-                        if (resource?.close !== undefined) {
+                        if (resource?.kind === "record") {
                             if (this.consumedResources.has(value))
                                 break;
                             if (!this.closingResources.has(value)) {
-                                this.invokeFrame(actor, resource.close, [value], () => next(), next);
+                                this.invokeFrame(actor, resource.close, [value], () => next(), next, rcOwner);
                                 return;
                             }
                             this.consumedResources.add(value);
@@ -1795,17 +2530,58 @@ class ExecutorV1 {
                     case "vector":
                         pending.push(...[...value.items].reverse());
                         break;
-                    case "sink":
-                    case "stream":
+                    case "stream": {
+                        const adapter = this.generatorStreams.get(value.channelId);
+                        if (adapter) {
+                            this.generatorStreams.delete(value.channelId);
+                            adapter.closed = true;
+                            if (adapter.pending !== null)
+                                pending.push(adapter.pending);
+                            adapter.pending = null;
+                            adapter.waiting = undefined;
+                            this.closeGenerator(adapter.generator, next);
+                            return;
+                        }
                         pending.push(...this.pipes.close(value, currentFault).reverse());
                         break;
+                    }
+                    case "sink": {
+                        const endpoint = this.senderEndpoints.get(value.channelId);
+                        if (endpoint) {
+                            this.finishSink(value, currentFault, () => {
+                                this.senderEndpoints.delete(value.channelId);
+                                if (--endpoint.owner.references === 0)
+                                    pending.push(endpoint.owner.sink, endpoint.owner.encoder);
+                                next();
+                            });
+                            return;
+                        }
+                        else
+                            pending.push(...this.pipes.close(value, currentFault).reverse());
+                        break;
+                    }
                 }
             }
             done(firstFault);
         };
         next();
     }
+    closeHostResource(value) {
+        if (value.owner.closed)
+            return;
+        const resource = this.pkg.resources?.[value.resource];
+        const release = resource?.kind === "nominal"
+            ? resolveExtern({ symbol: resource.release })
+            : null;
+        if (release?.kind !== "directory" || release.operation.action !== "close")
+            throw new Error("filesystem owner lost its selected release");
+        this.directories.call(release.operation, [value]);
+    }
     closeValue(value, fault) {
+        if (value.kind === "host_resource")
+            this.closeHostResource(value);
+        if (value.kind === "string")
+            value.release();
         if (value.kind === "closure")
             this.closeValue(value.environment, fault);
         else if (value.kind === "sink" || value.kind === "stream")
@@ -1854,25 +2630,33 @@ class ExecutorV1 {
         for (const changed of [...task.changed])
             changed();
     }
-    invokeFrame(actor, callable, args, returned, failed) {
-        const frame = this.activate(this.functionAt(callable), args, null, null, undefined, null, {
+    invokeFrame(actor, callable, args, returned, failed, rcOwner = actor?.rcOwner ?? null, inline = false) {
+        const context = {
             id: actor?.id ?? "actor:root",
             actor,
+            rcOwner,
             returned,
-            failed,
-        });
+            failed: (fault) => failed(fault),
+        };
+        const frame = this.activate(this.functionAt(callable), args, null, null, undefined, null, context);
         let cancelled = null;
-        frame.context.cancel = (fault = { kind: "panic", message: "task cancelled", cancelled: true }) => {
+        context.cancel = (fault = { kind: "panic", message: "task cancelled", cancelled: true }) => {
             cancelled = fault;
         };
-        this.scheduler.enqueue(frame.context.id, () => {
-            frame.context.cancel = undefined;
-            if (cancelled)
-                frame.context.failed(cancelled);
-            else
-                this.runFrame(frame);
-        });
-        return frame.context;
+        if (inline) {
+            this.current = frame;
+            this.running = true;
+        }
+        else {
+            this.scheduler.enqueue(frame.context.id, () => {
+                context.cancel = undefined;
+                if (cancelled && frame.context === context)
+                    context.failed(cancelled);
+                else
+                    this.runFrame(frame);
+            });
+        }
+        return context;
     }
     variant(shapeId, role, payload = []) {
         const shape = shapeId == null ? undefined : this.pkg.variants[shapeId];
@@ -1920,12 +2704,21 @@ class ExecutorV1 {
             ? { kind: "Actor", identity: act.context.actor.identity }
             : { kind: "Task" };
         switch (operation.op) {
+            case "identity": {
+                const [left, right] = args;
+                this.completeShim(act, term, {
+                    kind: "bool",
+                    value: actorIdentical(left, right),
+                });
+                return;
+            }
             case "spawn": {
                 const layout = this.pkg.actors?.find((actor) => actor.id === operation.actor);
                 if (!layout)
                     throw new Error(`actor layout ${operation.actor} is missing`);
                 let supplied = 0;
                 const actor = {
+                    rcOwner: act.rcOwner ?? { blocks: new Set(), closed: false },
                     identity: ++this.actorIdentity,
                     id: this.ids.actor(),
                     layout,
@@ -1935,9 +2728,11 @@ class ExecutorV1 {
                         fields: layout.state_fields.map((field) => field.deferred ? UNIT : (args[supplied++] ?? UNIT)),
                     },
                     mailbox: [],
+                    timers: new Set(),
                     disposals: [],
                     admission: [],
                     busy: true,
+                    constructing: true,
                     alive: true,
                     completed: false,
                     closing: false,
@@ -1947,44 +2742,194 @@ class ExecutorV1 {
                     closingFault: null,
                     crashing: null,
                     active: null,
-                    stopHook: null,
+                    terminalHook: null,
                     closed: [],
                 };
                 this.actors.set(actor.id, actor);
                 this.trace.allocateId("actor", actor.id, act.context.id);
                 this.trace.snapshot("actor.spawn", { actor_id: actor.id });
                 const handle = { kind: "actor", id: actor.id };
-                this.running = false;
+                act.context.cancel = (fault = {
+                    kind: "panic",
+                    message: "actor construction cancelled",
+                    cancelled: true,
+                }) => {
+                    actor.closing = true;
+                    if (actor.active) {
+                        actor.active.pendingCancellation ??= fault;
+                        actor.active.cancel?.(actor.active.pendingCancellation);
+                    }
+                };
                 const failed = (fault) => {
+                    act.context.cancel = undefined;
+                    actor.active = null;
                     actor.alive = false;
-                    this.closeValueAsync(actor.state, this.faultText(fault), () => {
-                        actor.completed = true;
-                        for (const message of actor.mailbox.splice(0))
-                            message.complete(null, "Dead");
-                        for (const closed of actor.closed.splice(0))
-                            closed();
-                        this.raiseFault(act, fault, term.unwind);
-                        this.scheduler.enqueue(act.context.id, () => this.runFrame(act));
+                    actor.constructing = false;
+                    act.rcOwner = null;
+                    this.cancelActorTimers(actor);
+                    this.drainMailbox(actor, this.faultText(fault), (payloadFault) => {
+                        const primary = combineFaults(fault, payloadFault);
+                        this.closeValueAsync(actor.state, this.faultText(primary), (stateFault) => {
+                            const retained = combineFaults(primary, stateFault);
+                            this.sweepRcOwner(actor.rcOwner, actor, (sweepFault) => {
+                                actor.completed = true;
+                                for (const closed of actor.closed.splice(0))
+                                    closed();
+                                this.raiseFault(act, combineFaults(retained, sweepFault), term.unwind);
+                                this.scheduler.enqueue(act.context.id, () => this.runFrame(act));
+                            });
+                        }, actor, actor.rcOwner);
                     });
                 };
                 const started = () => {
+                    if (actor.closing) {
+                        failed(actor.active?.pendingCancellation ?? {
+                            kind: "panic",
+                            message: "actor construction cancelled",
+                            cancelled: true,
+                        });
+                        return;
+                    }
+                    actor.constructing = false;
+                    actor.active = null;
+                    act.context.cancel = undefined;
+                    act.rcOwner = null;
                     actor.busy = false;
+                    this.startPeriodicTimers(actor);
                     this.dispatchActor(actor);
                     this.completeShim(act, term, handle);
-                    this.scheduler.enqueue(act.context.id, () => this.runFrame(act));
+                    this.current = act;
+                    this.running = true;
                 };
+                // Construction enters the same interpreter loop as its caller. Only
+                // a real suspension queues work and advances deterministic scheduling.
                 const start = () => {
-                    if (layout.start !== undefined)
-                        this.invokeFrame(actor, layout.start, [actor.state], started, failed);
+                    if (layout.start != null)
+                        actor.active = this.invokeFrame(actor, layout.start, [actor.state], started, failed, actor.rcOwner, true);
                     else
                         started();
                 };
-                if (layout.init !== undefined)
-                    this.invokeFrame(actor, layout.init, [actor.state, ...args.slice(supplied)], start, failed);
+                if (layout.init != null)
+                    actor.active = this.invokeFrame(actor, layout.init, [actor.state, ...args.slice(supplied)], start, failed, actor.rcOwner, true);
                 else
                     start();
                 return;
             }
+            case "timer_schedule": {
+                const [target, after, overdue, hasOverdue, payload] = args;
+                const actor = this.actorFor(target);
+                if (actor !== act.context.actor ||
+                    after?.kind !== "i64" ||
+                    overdue?.kind !== "i64" ||
+                    hasOverdue?.kind !== "bool" ||
+                    payload?.kind !== "record")
+                    throw new Error("timer schedule lost its checked owner or timing");
+                const handler = actor.layout.handlers.find((handler) => handler.message_id === operation.message);
+                if (!handler)
+                    throw new Error("timer schedule lost its handler");
+                if (this.rootComplete || actor.closing) {
+                    this.running = false;
+                    const refused = {
+                        kind: "panic",
+                        actorSendFailed: true,
+                        message: "actor timer admission is closed",
+                    };
+                    this.closeValueAsync(payload, faultReport(refused), (fault) => {
+                        this.raiseFault(act, combineFaults(refused, fault), term.unwind);
+                        this.scheduler.enqueue(act.context.id, () => this.runFrame(act));
+                    }, actor, act.rcOwner);
+                    return;
+                }
+                let phase = "scheduled";
+                let pending = payload;
+                let overdueAt = null;
+                let disarm = null;
+                const forget = () => {
+                    disarm?.();
+                    disarm = null;
+                    actor.timers.delete(timer);
+                };
+                const miss = (discarded) => {
+                    if (phase !== "fired")
+                        return;
+                    phase = hasOverdue.value ? "overdue" : "cancelled";
+                    forget();
+                    if (discarded && !hasOverdue.value)
+                        this.trace.writeStderr("actor.timer_discarded: the one-shot handler did not start\n", null);
+                    if (!hasOverdue.value || !actor.alive)
+                        return;
+                    const fault = {
+                        kind: "panic",
+                        timerOverdue: true,
+                        message: "actor timer did not start before its overdue deadline",
+                    };
+                    if (actor.active) {
+                        actor.active.pendingCancellation ??= fault;
+                        actor.active.cancel?.(actor.active.pendingCancellation);
+                    }
+                    else
+                        this.crashActor(actor, fault, handler);
+                };
+                const timer = {
+                    cancel: () => {
+                        if (phase !== "overdue")
+                            phase = "cancelled";
+                        forget();
+                        if (pending) {
+                            actor.disposals.push(pending);
+                            pending = null;
+                            this.dispatchActor(actor);
+                        }
+                    },
+                    started: () => {
+                        if (phase === "fired" &&
+                            overdueAt !== null &&
+                            this.trace.virtualTimeMs >= overdueAt)
+                            miss(false);
+                        const allowed = phase !== "overdue";
+                        if (phase === "fired")
+                            phase = "started";
+                        forget();
+                        return allowed;
+                    },
+                    discarded: () => miss(true),
+                };
+                actor.timers.add(timer);
+                disarm = this.scheduler.after(after.value, () => {
+                    disarm = null;
+                    if (phase !== "scheduled")
+                        return;
+                    phase = "fired";
+                    pending = null;
+                    if (hasOverdue.value) {
+                        overdueAt =
+                            this.trace.virtualTimeMs + Number(overdue.value) / 1_000_000;
+                        disarm = this.scheduler.after(overdue.value, () => miss(false));
+                    }
+                    const message = {
+                        timer,
+                        caller: { kind: "Timer" },
+                        handler,
+                        payload: payload.fields,
+                        reply: false,
+                        obligated: false,
+                        complete: (_value, _error, drained) => drained?.(null),
+                    };
+                    const status = this.admitActorMessage(actor, message);
+                    if (status === "full" || status === "closed") {
+                        actor.disposals.push(payload);
+                        timer.discarded();
+                        this.dispatchActor(actor);
+                    }
+                });
+                this.completeShim(act, term, {
+                    kind: "timer",
+                    resource: operation.resource,
+                    cancel: () => timer.cancel(),
+                    closed: false,
+                });
+                return;
+            }
             case "stream_start": {
                 const [target, payload] = args;
                 const fields = fieldsOf(payload);
@@ -2001,7 +2946,7 @@ class ExecutorV1 {
                         this.raiseFault(act, { kind: "panic", message: "stream producer is closed" }, term.unwind);
                     }
                     else {
-                        if (actor.layout.mailbox_capacity !== undefined &&
+                        if (actor.layout.mailbox_capacity != null &&
                             actor.mailbox.length >= actor.layout.mailbox_capacity) {
                             actor.admission.push(admit);
                             return;
@@ -2035,6 +2980,10 @@ class ExecutorV1 {
                     task.actorError = error;
                     this.settleTask(task, value ?? UNIT, closeFault ?? null);
                     return true;
+                }, undefined, (actor) => {
+                    task.actorTarget = actor;
+                    for (const changed of [...task.changed])
+                        changed();
                 });
                 task.close = (done) => cancelRequest((fault) => {
                     this.settleTask(task, UNIT, fault);
@@ -2071,15 +3020,17 @@ class ExecutorV1 {
                     this.variant(shapes.success, discarded ? "DeliveryDiscarded" : "DeliveryAccepted"),
                 ]);
                 const rejected = (reason) => this.variant(term.result_shape, "ResultErr", [
-                    {
-                        kind: "record",
-                        typeId: this.aggregateName(shapes.failure),
-                        shape: shapes.failure,
-                        fields: [
-                            this.variant(shapes.reason, sendErrorRole(reason)),
-                            request,
-                        ],
-                    },
+                    this.variant(term.error_shape, "ActorErrorRejected", [
+                        {
+                            kind: "record",
+                            typeId: this.aggregateName(shapes.failure),
+                            shape: shapes.failure,
+                            fields: [
+                                this.variant(shapes.reason, sendErrorRole(reason)),
+                                request,
+                            ],
+                        },
+                    ]),
                 ]);
                 let parked = false;
                 const finish = (value) => {
@@ -2092,87 +3043,38 @@ class ExecutorV1 {
                         finish(rejected("Dead"));
                         return;
                     }
-                    const full = actor.layout.mailbox_capacity !== undefined &&
-                        actor.mailbox.length >= actor.layout.mailbox_capacity;
-                    // Declared loss transfers cleanup to the receiver. Sender-selected
-                    // loss still closes the sender's unadmitted request in its own frame.
-                    const discardAtReceiver = (value, report) => {
-                        actor.disposals.push(value);
-                        this.dispatchActor(actor);
-                        finish(report);
-                    };
-                    const discard = (value, report) => {
-                        let settled = false;
-                        let waiting = false;
-                        this.closeValueAsync(value, this.pipeFault(act), (fault) => {
-                            act.fault ??= fault;
-                            settled = true;
-                            if (waiting)
-                                finish(report);
-                            else
-                                this.completeShim(act, term, report);
-                        }, act.context.actor);
-                        if (!settled) {
-                            waiting = true;
-                            parked = true;
-                            this.running = false;
-                        }
+                    const message = {
+                        caller,
+                        handler,
+                        payload: payload.fields,
+                        reply: false,
+                        obligated: false,
+                        complete: (_value, _error, drained) => drained?.(null),
                     };
-                    let declared = full ? actor.layout.overflow : null;
-                    const coalesce = actor.layout.coalesce;
-                    if (declared === "coalesce" && coalesce) {
-                        const key = coalesce.keys.find((key) => key.message === handler.message_id);
-                        const queued = key
-                            ? actor.mailbox.findIndex((message) => !message.obligated &&
-                                message.handler.message_id === handler.message_id &&
-                                equals(message.payload[key.param], payload.fields[key.param]))
-                            : -1;
-                        if (queued >= 0) {
-                            const superseded = actor.mailbox[queued];
-                            actor.mailbox[queued] = {
-                                ...superseded,
-                                caller,
-                                payload: payload.fields,
-                            };
-                            discardAtReceiver({ kind: "record", typeId: "", fields: superseded.payload }, accepted(false));
-                            return;
-                        }
-                        declared = coalesce.fallback;
-                    }
-                    if (declared === "drop_new") {
-                        discardAtReceiver(payload, accepted(true));
-                        return;
-                    }
-                    // A queued completion call owes its caller a reply, so `drop_old`
-                    // evicts only a one-way message and refuses when there is none.
-                    const oldest = declared === "drop_old"
-                        ? actor.mailbox.findIndex((message) => !message.obligated)
-                        : -1;
-                    if (oldest >= 0) {
-                        const [evicted] = actor.mailbox.splice(oldest, 1);
-                        actor.mailbox.push({
-                            caller,
-                            handler,
-                            payload: payload.fields,
-                            reply: false,
-                            obligated: false,
-                            complete: (_value, _error, drained) => drained?.(null),
-                        });
-                        this.dispatchActor(actor);
-                        discardAtReceiver({ kind: "record", typeId: "", fields: evicted.payload }, accepted(false));
-                        return;
-                    }
-                    if (full) {
+                    const status = this.admitActorMessage(actor, message);
+                    if (status === "full") {
                         if (operation.policy === "drop_newest") {
-                            discard(payload, accepted(true));
+                            let settled = false;
+                            let waiting = false;
+                            this.closeValueAsync(payload, this.pipeFault(act), (fault) => {
+                                act.fault ??= fault;
+                                settled = true;
+                                if (waiting)
+                                    finish(accepted(true));
+                                else
+                                    this.completeShim(act, term, accepted(true));
+                            }, act.context.actor, act.rcOwner);
+                            if (!settled) {
+                                waiting = true;
+                                parked = true;
+                                this.running = false;
+                            }
                             return;
                         }
                         if (operation.policy === "reject") {
                             finish(rejected("Full"));
                             return;
                         }
-                        // The checker already resolved declaration defaults and explicit
-                        // overrides; the declaration's own resolution happened above.
                         if (operation.policy !== "wait")
                             throw new Error("submission has no admitted policy");
                         parked = true;
@@ -2180,20 +3082,10 @@ class ExecutorV1 {
                         actor.admission.push(submit);
                         return;
                     }
-                    actor.mailbox.push({
-                        caller,
-                        handler,
-                        payload: payload.fields,
-                        reply: false,
-                        obligated: false,
-                        complete: (_value, _error, drained) => drained?.(null),
-                    });
-                    this.trace.snapshot("actor.send", {
-                        actor_id: actor.id,
-                        handler: handler.name,
-                    });
-                    this.dispatchActor(actor);
-                    finish(accepted(false));
+                    if (status === "closed")
+                        finish(rejected("Dead"));
+                    else
+                        finish(accepted(status === "discarded"));
                 };
                 submit();
                 return;
@@ -2202,17 +3094,35 @@ class ExecutorV1 {
                 const layout = this.pkg.supervisors?.find((layout) => layout.id === operation.supervisor);
                 if (!layout)
                     throw new Error("supervisor descriptor is missing");
+                const isPool = layout.children.some((child) => child.is_pool);
+                const count = isPool ? args[args.length - 1] : undefined;
+                if (isPool && count?.kind !== "i64")
+                    throw new Error("pool construction has no count");
+                const config = isPool ? args.slice(0, -1) : args;
+                if (count?.kind === "i64" &&
+                    (count.value <= 0n || count.value > 2147483647n)) {
+                    const fault = {
+                        kind: "panic",
+                        message: "supervisor pool count must be between 1 and 2147483647",
+                    };
+                    this.running = false;
+                    this.closeValueAsync({ kind: "record", typeId: "", fields: config }, fault.message, (closeFault) => {
+                        this.raiseFault(act, combineFaults(fault, closeFault), term.unwind);
+                        this.scheduler.enqueue(act.context.id, () => this.runFrame(act));
+                    }, act.context.actor, act.rcOwner);
+                    return;
+                }
+                const members = count?.kind === "i64" ? Number(count.value) : 1;
                 const owner = {
                     id: this.ids.supervisor(),
                     layout,
-                    config: args,
-                    children: layout.children.flatMap((child) => Array.from({ length: child.pool_count ?? 1 }, () => null)),
-                    specs: layout.children.flatMap((child) => Array.from({ length: child.pool_count ?? 1 }, () => child)),
-                    offsets: layout.children.map((_child, index) => layout.children
-                        .slice(0, index)
-                        .reduce((sum, child) => sum + (child.pool_count ?? 1), 0)),
+                    config,
+                    children: layout.children.flatMap(() => Array.from({ length: members }, () => null)),
+                    specs: layout.children.flatMap((child) => Array.from({ length: members }, () => child)),
+                    offsets: layout.children.map((_child, index) => index),
                     recovering: new Set(),
-                    restartBusy: false,
+                    restartBusy: true,
+                    constructor: null,
                     pendingRestarts: [],
                     spent: new Set(),
                     completed: false,
@@ -2227,20 +3137,39 @@ class ExecutorV1 {
                 this.trace.allocateId("supervisor", owner.id, act.context.id);
                 this.trace.snapshot("supervisor.spawn", { supervisor_id: owner.id });
                 this.running = false;
-                let child = 0;
+                const order = this.supervisorStartupOrder(owner);
+                let fault = null;
+                const fail = (cause) => {
+                    if (fault)
+                        return;
+                    fault = cause;
+                    owner.closed.push(() => {
+                        act.context.cancel = undefined;
+                        this.raiseFault(act, fault, term.unwind);
+                        this.scheduler.enqueue(act.context.id, () => this.runFrame(act));
+                    });
+                    if (owner.constructor)
+                        owner.constructor.pendingCancellation ??= cause;
+                    this.stopSupervisor(owner);
+                };
+                act.context.cancel = (cause = {
+                    kind: "panic",
+                    message: "construction cancelled",
+                    cancelled: true,
+                }) => fail(cause);
                 const next = () => {
-                    if (child < owner.children.length) {
-                        this.startChild(owner, child++, next, (fault) => {
-                            owner.closed.push(() => {
-                                this.raiseFault(act, fault, term.unwind);
-                                this.scheduler.enqueue(act.context.id, () => this.runFrame(act));
-                            });
-                            this.stopSupervisor(owner);
-                        });
+                    const child = order.shift();
+                    if (child !== undefined) {
+                        this.startChild(owner, child, next, fail);
                     }
                     else {
+                        act.context.cancel = undefined;
+                        owner.restartBusy = false;
                         this.completeShim(act, term, { kind: "supervisor", id: owner.id });
                         this.scheduler.enqueue(act.context.id, () => this.runFrame(act));
+                        const pending = owner.pendingRestarts.shift();
+                        if (pending)
+                            this.restartChild(owner, pending.child, pending.debts);
                     }
                 };
                 next();
@@ -2269,7 +3198,7 @@ class ExecutorV1 {
                     this.completeShim(act, term, {
                         kind: "vector",
                         elementType: "role",
-                        items: Array.from({ length: spec.pool_count ?? 1 }, (_, index) => makeRole(offset + index)),
+                        items: Array.from({ length: owner.children.length }, (_, index) => makeRole(offset + index)),
                     });
                     return;
                 }
@@ -2279,12 +3208,16 @@ class ExecutorV1 {
             case "await_restarted": {
                 const target = args[0];
                 const role = "id" in target ? this.roles.get(target.id) : undefined;
-                if (!role)
-                    throw new Error("restarted requires a supervised role");
-                if (this.rolePending(role)) {
+                if (!role) {
+                    if (target.kind !== "actor" && target.kind !== "supervisor")
+                        throw new Error("restarted requires an actor or supervisor handle");
+                    this.completeShim(act, term, UNIT);
+                    return;
+                }
+                if (this.roleRestartPending(role)) {
                     this.running = false;
                     const settled = () => {
-                        if (this.rolePending(role)) {
+                        if (this.roleRestartPending(role)) {
                             role.waiting.push(settled);
                             return;
                         }
@@ -2324,7 +3257,10 @@ class ExecutorV1 {
                 if (target.kind === "actor") {
                     const actor = this.actorFor(target);
                     const complete = () => {
-                        const fault = actor.crashing ?? actor.closingFault;
+                        // A crash was reported when it happened and already counts toward
+                        // the exit status; only a fault raised while the actor was being
+                        // stopped passes to the caller that waits for it.
+                        const fault = actor.closingFault;
                         if (actor.closeFaultDebt !== undefined)
                             this.faultDebts.delete(actor.closeFaultDebt);
                         if (fault)
@@ -2366,9 +3302,21 @@ class ExecutorV1 {
                     id: act.context.actor.id,
                 });
                 return;
-            default:
-                throw new Error(`actor operation ${operation.op} has no executor`);
+            case "local_observation":
+                throw new Error("actor observations are not admitted in the VM");
+            default: {
+                const exhaustive = operation;
+                throw new Error("unhandled actor operation: " + String(exhaustive));
+            }
+        }
+    }
+    scopeDeadline(act, expected) {
+        for (let frame = act; frame?.context === act.context; frame = frame.caller) {
+            for (const group of frame.scopes.values())
+                if (group.deadline && (!expected || group.deadline === expected))
+                    return group.deadline;
         }
+        return undefined;
     }
     requestDeadline(act) {
         let deadline = act.context.requestDeadline;
@@ -2380,11 +3328,12 @@ class ExecutorV1 {
         }
         return deadline;
     }
-    ask(protocol, inputs, complete, shapes) {
+    ask(protocol, inputs, complete, shapes, selectedTarget) {
         let settled = false;
         let admitted = false;
         let closing = false;
         const owner = this.current.context.actor;
+        const rcOwner = this.current.rcOwner;
         const deadline = this.requestDeadline(this.current);
         let cancelTimer;
         let message;
@@ -2406,7 +3355,7 @@ class ExecutorV1 {
                         this.crashActor(owner, fault);
                     else if (fault)
                         this.rootFault ??= fault;
-                }, admitted ? receiver : owner);
+                }, admitted ? receiver : owner, admitted ? (receiver?.rcOwner ?? null) : rcOwner);
             }
             else
                 drained?.(null);
@@ -2430,7 +3379,7 @@ class ExecutorV1 {
                 closeFault = fault;
                 for (const waiter of closeWaiters.splice(0))
                     waiter(fault);
-            }, owner);
+            }, owner, rcOwner);
         };
         const reject = (reason) => {
             if (settled || closing)
@@ -2463,7 +3412,10 @@ class ExecutorV1 {
             const handler = actor.layout.handlers.find((handler) => handler.message_id === protocol.message);
             if (!handler)
                 throw new Error(`actor ${actor.id} has no message ${protocol.message}`);
-            const full = actor.layout.mailbox_capacity !== undefined &&
+            selectedTarget?.(actor);
+            if (settled || closing)
+                return;
+            const full = actor.layout.mailbox_capacity != null &&
                 actor.mailbox.length >= actor.layout.mailbox_capacity;
             if (full) {
                 if (protocol.policy === "reject") {
@@ -2552,6 +3504,114 @@ class ExecutorV1 {
                 closeRequest(done);
         };
     }
+    admitActorMessage(actor, message) {
+        if (!actor.alive || actor.closing)
+            return "closed";
+        const full = actor.layout.mailbox_capacity != null &&
+            actor.mailbox.length >= actor.layout.mailbox_capacity;
+        let declared = full ? actor.layout.overflow : null;
+        const discard = (lost) => {
+            actor.disposals.push({
+                kind: "record",
+                typeId: "",
+                fields: lost.payload,
+            });
+            lost.timer?.discarded();
+            this.dispatchActor(actor);
+        };
+        const coalesce = actor.layout.coalesce;
+        if (declared === "coalesce" && coalesce) {
+            const key = coalesce.keys.find((key) => key.message === message.handler.message_id);
+            const queued = key
+                ? actor.mailbox.findIndex((queued) => !queued.obligated &&
+                    queued.handler.message_id === message.handler.message_id &&
+                    equals(queued.payload[key.param], message.payload[key.param]))
+                : -1;
+            if (queued >= 0) {
+                const superseded = actor.mailbox[queued];
+                actor.mailbox[queued] = message;
+                discard(superseded);
+                return "accepted";
+            }
+            declared = coalesce.fallback;
+        }
+        if (declared === "drop_new") {
+            discard(message);
+            return "discarded";
+        }
+        const oldest = declared === "drop_old"
+            ? actor.mailbox.findIndex((queued) => !queued.obligated)
+            : -1;
+        if (oldest >= 0) {
+            const [evicted] = actor.mailbox.splice(oldest, 1);
+            actor.mailbox.push(message);
+            discard(evicted);
+            return "accepted";
+        }
+        if (full)
+            return "full";
+        actor.mailbox.push(message);
+        this.trace.snapshot("actor.send", {
+            actor_id: actor.id,
+            handler: message.handler.name,
+        });
+        this.dispatchActor(actor);
+        return "accepted";
+    }
+    completeRoot() {
+        this.rootComplete = true;
+        // Quiesce actor timers before draining accepted work; sleeps still wake.
+        for (const actor of this.actors.values())
+            this.cancelActorTimers(actor);
+    }
+    startPeriodicTimers(actor) {
+        if (this.rootComplete || actor.closing)
+            return;
+        for (const handler of actor.layout.handlers) {
+            if (handler.every_ns == null)
+                continue;
+            const interval = Math.floor(handler.every_ns / 1_000_000);
+            let next = this.trace.virtualTimeMs + interval;
+            let disarm = null;
+            const timer = {
+                cancel: () => {
+                    disarm?.();
+                    disarm = null;
+                    actor.timers.delete(timer);
+                },
+            };
+            const fire = () => {
+                disarm = null;
+                if (!actor.timers.has(timer))
+                    return;
+                this.admitActorMessage(actor, {
+                    caller: { kind: "Timer" },
+                    handler,
+                    payload: [],
+                    reply: false,
+                    obligated: false,
+                    complete: (_value, _error, drained) => drained?.(null),
+                });
+                if (!actor.timers.has(timer))
+                    return;
+                next += interval;
+                if (next <= this.trace.virtualTimeMs)
+                    next +=
+                        (Math.floor((this.trace.virtualTimeMs - next) / interval) + 1) *
+                            interval;
+                arm();
+            };
+            const arm = () => {
+                disarm = this.scheduler.after(BigInt(Math.round((next - this.trace.virtualTimeMs) * 1_000_000)), fire);
+            };
+            actor.timers.add(timer);
+            arm();
+        }
+    }
+    cancelActorTimers(actor) {
+        for (const timer of [...actor.timers])
+            timer.cancel();
+    }
     dispatchActor(actor) {
         if (actor.busy || !actor.alive || actor.drainingMailbox)
             return;
@@ -2587,13 +3647,21 @@ class ExecutorV1 {
                 this.dispatchActor(actor);
                 return;
             }
-            const message = actor.mailbox.shift();
+            const message = actor.mailbox[0];
             if (!message || !actor.alive) {
                 actor.busy = false;
                 if (actor.closing && actor.alive)
                     this.dispatchActor(actor);
                 return;
             }
+            // An overdue claim can synchronously begin terminal cleanup. Keep the
+            // payload in its mailbox until that claim succeeds.
+            if (message.timer && !message.timer.started()) {
+                actor.busy = false;
+                this.dispatchActor(actor);
+                return;
+            }
+            actor.mailbox.shift();
             for (const admit of actor.admission.splice(0))
                 admit();
             if (message.requestDeadline !== undefined &&
@@ -2623,7 +3691,7 @@ class ExecutorV1 {
                     const drained = (fault) => {
                         actor.busy = false;
                         if (fault)
-                            this.crashActor(actor, fault);
+                            this.crashActor(actor, fault, message.handler);
                         else
                             this.dispatchActor(actor);
                     };
@@ -2639,8 +3707,9 @@ class ExecutorV1 {
                             else {
                                 this.crashActor(actor, {
                                     kind: "panic",
+                                    handlerFailed: true,
                                     message: "unhandled declared handler failure",
-                                });
+                                }, message.handler);
                                 return;
                             }
                         }
@@ -2667,7 +3736,7 @@ class ExecutorV1 {
                         this.dispatchActor(actor);
                     }
                     else {
-                        this.crashActor(actor, fault);
+                        this.crashActor(actor, fault, message.handler);
                         message.complete(null, "Trapped");
                     }
                 },
@@ -2676,7 +3745,12 @@ class ExecutorV1 {
             this.runFrame(frame);
         });
     }
-    crashActor(actor, fault) {
+    crashActor(actor, fault, handler) {
+        this.reportFault(fault);
+        if (handler) {
+            const context = `${actor.layout.name}.${handler.name}`;
+            this.trace.writeStderr(`hew: actor crash in ${context} (actor ${actor.identity}): ${faultInfo(fault)[1]}\n`, null);
+        }
         const debt = ++this.nextFaultDebt;
         this.faultDebts.add(debt);
         if (actor.supervisor)
@@ -2684,6 +3758,7 @@ class ExecutorV1 {
         actor.crashing ??= fault;
         actor.alive = false;
         actor.busy = false;
+        this.cancelActorTimers(actor);
         this.trace.snapshot("actor.crash", {
             actor_id: actor.id,
             message: this.faultText(fault),
@@ -2693,47 +3768,114 @@ class ExecutorV1 {
                 actor.mailboxDrained.push(() => finished(action));
                 return;
             }
-            this.closeValueAsync(actor.state, this.faultText(fault), () => this.drainMailbox(actor, this.faultText(fault), () => {
-                actor.completed = true;
-                for (const wake of actor.closed.splice(0))
-                    wake();
-                for (const admit of actor.admission.splice(0))
-                    admit();
-                if (actor.supervisor) {
-                    const { owner, child } = actor.supervisor;
-                    if (action === "Restart")
-                        this.restartChild(owner, child, [debt]);
-                    else if (action === "Escalate")
-                        this.escalateSupervisor(owner, [debt]);
-                    else {
-                        owner.spent.add(child);
-                        owner.recovering.delete(child);
-                        this.wakeRoles();
-                    }
-                }
-            }), actor);
+            this.closeValueAsync(actor.state, this.faultText(fault), (stateFault) => {
+                actor.closingFault = combineFaults(actor.closingFault, stateFault);
+                fault = combineFaults(fault, stateFault);
+                actor.crashing = fault;
+                this.reportFault(fault);
+                this.drainMailbox(actor, this.faultText(fault), (payloadFault) => {
+                    actor.closingFault = combineFaults(actor.closingFault, payloadFault);
+                    fault = combineFaults(fault, payloadFault);
+                    actor.crashing = fault;
+                    this.reportFault(fault);
+                    this.sweepRcOwner(actor.rcOwner, actor, (sweepFault) => {
+                        actor.closingFault = combineFaults(actor.closingFault, sweepFault);
+                        actor.crashing = combineFaults(actor.crashing, sweepFault);
+                        this.reportFault(actor.crashing);
+                        if (actor.closingFault) {
+                            this.reportFault(actor.closingFault);
+                        }
+                        actor.completed = true;
+                        for (const wake of actor.closed.splice(0))
+                            wake();
+                        for (const admit of actor.admission.splice(0))
+                            admit();
+                        if (actor.supervisor) {
+                            const { owner, child } = actor.supervisor;
+                            if (action === "Restart")
+                                this.restartChild(owner, child, [debt]);
+                            else if (action === "Escalate")
+                                this.escalateSupervisor(owner, [debt]);
+                            else {
+                                owner.spent.add(child);
+                                owner.recovering.delete(child);
+                                this.wakeRoles();
+                            }
+                        }
+                    });
+                });
+            }, actor);
         };
-        if (actor.layout.crash !== undefined) {
-            const [code, message] = faultInfo(fault);
-            const info = {
-                kind: "record",
-                typeId: this.aggregateName(actor.layout.crash_info),
-                shape: actor.layout.crash_info,
-                fields: [
-                    { kind: "i64", value: BigInt(code) },
-                    { kind: "string", value: String(message) },
-                ],
-            };
-            this.invokeFrame(actor, actor.layout.crash, [actor.state, info], (value) => {
-                const shape = this.pkg.variants[actor.layout.crash_action];
-                const action = value.kind === "enum" ? shape?.cases[value.tag]?.name : undefined;
-                if (!action)
-                    throw new Error("crash hook returned no declared action");
-                finished(action);
-            }, () => finished("Kill"));
-        }
-        else
-            finished("Restart");
+        const runHook = () => {
+            if (actor.layout.crash != null) {
+                const [code, message] = faultInfo(fault);
+                const info = {
+                    kind: "record",
+                    typeId: this.aggregateName(actor.layout.crash_info),
+                    shape: actor.layout.crash_info,
+                    fields: [
+                        {
+                            kind: "enum",
+                            typeId: this.variantName(actor.layout.crash_kind),
+                            shape: actor.layout.crash_kind,
+                            tag: runtimeTag(this.pkg.variants[actor.layout.crash_kind], code === 214
+                                ? "CrashKindTimerOverdue"
+                                : code === 213
+                                    ? "CrashKindHandlerFailed"
+                                    : "CrashKindFault"),
+                            payload: [],
+                        },
+                        stringValue(String(message)),
+                    ],
+                };
+                let cancelTimer;
+                const complete = (action) => {
+                    cancelTimer?.();
+                    actor.terminalHook = null;
+                    finished(action);
+                };
+                const hook = this.invokeFrame(actor, actor.layout.crash, [actor.state, info], (value) => {
+                    const shape = this.pkg.variants[actor.layout.crash_action];
+                    const action = value.kind === "enum" ? shape?.cases[value.tag]?.name : undefined;
+                    if (!action)
+                        throw new Error("crash hook returned no declared action");
+                    complete(action);
+                }, (hookFault) => {
+                    actor.closingFault = combineFaults(actor.closingFault, hookFault);
+                    fault = combineFaults(fault, hookFault);
+                    actor.crashing = fault;
+                    this.reportFault(fault);
+                    complete("Restart");
+                });
+                actor.terminalHook = hook;
+                const parent = actor.supervisor;
+                const stopNs = parent
+                    ? this.childStopBudget(parent.owner, parent.child)
+                    : DEFAULT_ACTOR_STOP_NS;
+                hook.requestDeadline = this.trace.virtualTimeMs + stopNs / 1_000_000;
+                const expire = () => {
+                    hook.pendingCancellation ??= {
+                        kind: "panic",
+                        message: "crash hook deadline elapsed",
+                        deadline: true,
+                    };
+                    hook.cancel?.(hook.pendingCancellation);
+                };
+                if (stopNs <= 0)
+                    expire();
+                else
+                    cancelTimer = this.scheduler.after(BigInt(stopNs), expire);
+            }
+            else
+                finished("Restart");
+        };
+        this.drainMailbox(actor, this.faultText(fault), (cleanupFault) => {
+            actor.closingFault = combineFaults(actor.closingFault, cleanupFault);
+            fault = combineFaults(fault, cleanupFault);
+            actor.crashing = fault;
+            this.reportFault(fault);
+            runHook();
+        });
     }
     supervisorFor(value) {
         if (value.kind !== "supervisor")
@@ -2746,9 +3888,42 @@ class ExecutorV1 {
             throw new Error("supervisor does not exist");
         return owner;
     }
+    supervisorStartupOrder(owner) {
+        const declarations = owner.layout.startup_order ??
+            owner.layout.children.map((_child, index) => index);
+        return declarations.flatMap((declaration) => {
+            const offset = owner.offsets[declaration];
+            const end = owner.offsets[declaration + 1] ?? owner.children.length;
+            return Array.from({ length: end - offset }, (_value, index) => offset + index);
+        });
+    }
     startChild(owner, child, done, failed) {
         const spec = owner.specs[child];
-        this.invokeFrame(null, spec.spawn, owner.config, (value) => {
+        const arity = this.functionAt(spec.spawn).params.length;
+        // Packages predating sibling wiring have config-only constructors. Their
+        // actual callable signature, rather than a source name, selects that ABI.
+        const args = arity === owner.config.length + 1
+            ? [{ kind: "supervisor", id: owner.id }, ...owner.config]
+            : arity === owner.config.length
+                ? owner.config
+                : null;
+        if (!args)
+            throw new Error("supervisor constructor signature does not match its config");
+        owner.constructor = this.invokeFrame(null, spec.spawn, args, (value) => {
+            const cancellation = owner.constructor?.pendingCancellation;
+            owner.constructor = null;
+            if (!owner.alive) {
+                // The result is still owned here. Its declaration slot hands it to
+                // canonical reverse-order teardown, including the configured budget.
+                owner.children[child] = value;
+                failed(cancellation ?? {
+                    kind: "panic",
+                    message: "supervisor construction cancelled",
+                    cancelled: true,
+                });
+                this.finishSupervisorStop(owner);
+                return;
+            }
             owner.children[child] = value;
             if (value.kind === "actor")
                 this.actorFor(value).supervisor = { owner, child };
@@ -2761,7 +3936,15 @@ class ExecutorV1 {
                 child,
             });
             done();
-        }, failed);
+        }, (fault) => {
+            const stopped = !owner.alive;
+            owner.constructor = null;
+            // The initial caller still needs one terminal notification if the
+            // supervisor was stopped directly rather than through caller cancel.
+            failed(fault);
+            if (stopped)
+                this.finishSupervisorStop(owner);
+        });
     }
     roleOwner(role) {
         const parentRole = this.roles.get(role.ownerId);
@@ -2786,6 +3969,23 @@ class ExecutorV1 {
         return (!!owner?.alive &&
             (owner.recovering.has(role.child) || owner.children[role.child] === null));
     }
+    roleRestartPending(role) {
+        const parent = this.roles.get(role.ownerId);
+        if (parent && this.roleRestartPending(parent))
+            return true;
+        if (this.rolePending(role))
+            return true;
+        const value = this.roleValue(role) ?? role.latest;
+        if (value?.kind === "actor") {
+            const actor = this.actorFor(value);
+            return !actor.completed && (actor.closing || !actor.alive);
+        }
+        if (value?.kind === "supervisor") {
+            const owner = this.supervisorFor(value);
+            return !owner.completed && !owner.alive;
+        }
+        return false;
+    }
     wakeRoles() {
         for (const role of this.roles.values()) {
             this.roleValue(role);
@@ -2839,7 +4039,7 @@ class ExecutorV1 {
                 stop();
             });
         };
-        const starting = [...affected];
+        const starting = this.supervisorStartupOrder(owner).filter((index) => affected.includes(index));
         const start = () => {
             if (!owner.alive) {
                 owner.restartBusy = false;
@@ -2918,6 +4118,16 @@ class ExecutorV1 {
         else if (value.kind === "supervisor")
             this.stopSupervisor(this.supervisorFor(value), true);
     }
+    childStopBudget(owner, child) {
+        const spec = owner.specs[child];
+        if (spec.stop_config != null) {
+            const duration = owner.config[spec.stop_config];
+            if (duration?.kind !== "i64" || duration.value < 0n)
+                throw new Error("child stop budget is not a non-negative duration");
+            return Number(duration.value);
+        }
+        return (spec.stop_ns ?? ("actor" in spec.role ? DEFAULT_ACTOR_STOP_NS : null));
+    }
     stopSupervisor(owner, force = false) {
         if (force) {
             owner.terminating = true;
@@ -2928,6 +4138,18 @@ class ExecutorV1 {
         if (!owner.alive)
             return;
         owner.alive = false;
+        if (owner.constructor) {
+            owner.constructor.pendingCancellation ??= {
+                kind: "panic",
+                message: "supervisor construction cancelled",
+                cancelled: true,
+            };
+            owner.constructor.cancel?.(owner.constructor.pendingCancellation);
+            return;
+        }
+        this.finishSupervisorStop(owner);
+    }
+    finishSupervisorStop(owner) {
         let childIndex = owner.children.length - 1;
         const next = () => {
             owner.teardownCancelTimer?.();
@@ -2937,12 +4159,7 @@ class ExecutorV1 {
                 const index = childIndex--;
                 const child = owner.children[index];
                 owner.teardownChild = child;
-                const spec = owner.specs[index];
-                const stopNs = spec.stop_ns === undefined
-                    ? "actor" in spec.role
-                        ? 5_000_000_000
-                        : null
-                    : spec.stop_ns;
+                const stopNs = this.childStopBudget(owner, index);
                 if (!owner.terminating && stopNs !== null && stopNs > 0) {
                     owner.teardownCancelTimer = this.scheduler.after(BigInt(stopNs), () => this.terminateChild(child));
                 }
@@ -2950,9 +4167,11 @@ class ExecutorV1 {
                 return;
             }
             this.closeValueAsync({ kind: "record", typeId: "", fields: owner.config }, null, (fault) => {
-                if (fault)
-                    this.faultDebts.add(++this.nextFaultDebt);
+                const debt = fault ? ++this.nextFaultDebt : undefined;
+                if (debt !== undefined)
+                    this.faultDebts.add(debt);
                 owner.completed = true;
+                this.settleSupervisedEnd(owner, fault ? "Crashed" : owner.terminating ? "Terminated" : "Stopped", debt === undefined ? [] : [debt]);
                 for (const wake of owner.closed.splice(0))
                     wake();
                 this.wakeRoles();
@@ -2987,6 +4206,15 @@ class ExecutorV1 {
         if (actor.closing || actor.completed)
             return;
         actor.closing = true;
+        this.cancelActorTimers(actor);
+        if (actor.constructing && actor.active) {
+            actor.active.pendingCancellation ??= {
+                kind: "panic",
+                message: "actor construction stopped",
+                cancelled: true,
+            };
+            actor.active.cancel?.(actor.active.pendingCancellation);
+        }
         // Admission closes immediately. The active turn and every accepted queued
         // turn finish before stop hooks and state release.
         this.dispatchActor(actor);
@@ -2998,8 +4226,17 @@ class ExecutorV1 {
             return;
         actor.closing = true;
         actor.terminating = true;
-        actor.active?.cancel?.();
-        actor.stopHook?.cancel?.();
+        this.cancelActorTimers(actor);
+        for (const context of [actor.active, actor.terminalHook]) {
+            if (!context)
+                continue;
+            context.pendingCancellation ??= {
+                kind: "panic",
+                message: "actor terminated",
+                cancelled: true,
+            };
+            context.cancel?.(context.pendingCancellation);
+        }
         this.dispatchActor(actor);
         for (const admit of actor.admission.splice(0))
             admit();
@@ -3010,11 +4247,11 @@ class ExecutorV1 {
         const next = () => {
             const hook = actor.terminating ? undefined : hooks.shift();
             if (hook !== undefined) {
-                actor.stopHook = this.invokeFrame(actor, hook, [actor.state], () => {
-                    actor.stopHook = null;
+                actor.terminalHook = this.invokeFrame(actor, hook, [actor.state], () => {
+                    actor.terminalHook = null;
                     next();
                 }, (fault) => {
-                    actor.stopHook = null;
+                    actor.terminalHook = null;
                     if (!(actor.terminating && fault.kind === "panic" && fault.cancelled))
                         actor.closingFault = combineFaults(actor.closingFault, fault);
                     hooks.length = 0;
@@ -3024,31 +4261,37 @@ class ExecutorV1 {
             else {
                 this.closeValueAsync(actor.state, this.faultText(actor.closingFault), (fault) => {
                     actor.closingFault = combineFaults(actor.closingFault, fault);
-                    // Stopped cleanup belongs to the completion barrier, independently
-                    // of handler-crash debt and supervisor restart decisions.
-                    actor.crashing = null;
-                    if (actor.closingFault) {
-                        actor.closeFaultDebt = ++this.nextFaultDebt;
-                        this.faultDebts.add(actor.closeFaultDebt);
-                    }
-                    actor.completed = true;
-                    actor.alive = false;
-                    actor.busy = false;
-                    this.trace.snapshot(actor.terminating ? "actor.terminate" : "actor.stop", { actor_id: actor.id });
-                    this.settleSupervisedEnd(actor, actor.closingFault
-                        ? "Crashed"
-                        : actor.terminating
-                            ? "Terminated"
-                            : "Stopped");
-                    for (const wake of actor.closed.splice(0))
-                        wake();
+                    this.sweepRcOwner(actor.rcOwner, actor, (sweepFault) => {
+                        actor.closingFault = combineFaults(actor.closingFault, sweepFault);
+                        // Stopped cleanup belongs to the completion barrier, independently
+                        // of handler-crash debt and supervisor restart decisions.
+                        actor.crashing = null;
+                        if (actor.closingFault) {
+                            this.reportFault(actor.closingFault);
+                            actor.closeFaultDebt = ++this.nextFaultDebt;
+                            this.faultDebts.add(actor.closeFaultDebt);
+                        }
+                        actor.completed = true;
+                        actor.alive = false;
+                        actor.busy = false;
+                        this.trace.snapshot(actor.terminating ? "actor.terminate" : "actor.stop", { actor_id: actor.id });
+                        this.settleSupervisedEnd(actor, actor.closingFault
+                            ? "Crashed"
+                            : actor.terminating
+                                ? "Terminated"
+                                : "Stopped", actor.closeFaultDebt === undefined
+                            ? []
+                            : [actor.closeFaultDebt]);
+                        for (const wake of actor.closed.splice(0))
+                            wake();
+                    });
                 }, actor);
             }
         };
         next();
     }
-    settleSupervisedEnd(actor, reason) {
-        const parent = actor.supervisor;
+    settleSupervisedEnd(subject, reason, debts) {
+        const parent = subject.supervisor;
         if (!parent ||
             !parent.owner.alive ||
             parent.owner.recovering.has(parent.child))
@@ -3057,7 +4300,7 @@ class ExecutorV1 {
         const policy = owner.specs[child].restart;
         if (policy === "permanent" ||
             (policy === "transient" && reason !== "Stopped")) {
-            this.restartChild(owner, child, actor.closeFaultDebt === undefined ? [] : [actor.closeFaultDebt]);
+            this.restartChild(owner, child, debts);
         }
         else {
             owner.spent.add(child);
@@ -3065,6 +4308,16 @@ class ExecutorV1 {
         }
     }
     // ── exit and faults ──────────────────────────────────────────────────────
+    reportFault(fault) {
+        const diagnostics = [fault.primary ?? fault, ...(fault.secondary ?? [])];
+        diagnostics.forEach((diagnostic, index) => {
+            const origin = diagnostic.primary ?? diagnostic;
+            if (origin.reported)
+                return;
+            this.trace.writeStderr(faultDiagnostic(origin, index !== 0), null);
+            origin.reported = true;
+        });
+    }
     haltWithFault(fault) {
         const isPanic = fault.kind === "panic";
         const status = isPanic ? "panic" : "trap";
@@ -3074,7 +4327,7 @@ class ExecutorV1 {
             : (fault.message ?? trapMessage(fault.trap));
         const [code, kind] = faultInfo(fault);
         // Native writes the failure line to stderr before it exits; so does this.
-        this.trace.writeStderr(faultReport(fault), null);
+        this.reportFault(fault);
         // A failing run reports no exit code: native exits 1 for every fault and
         // names the kind in its message, so the kind is what travels, in
         // `runtime_failures`. The page turns it into an exit code of its own.
@@ -3114,6 +4367,12 @@ function combineFaults(primary, secondary) {
 }
 function faultInfo(fault) {
     if (fault.kind === "panic") {
+        if (fault.handlerFailed)
+            return [213, "ActorUnhandledFailure"];
+        if (fault.timerOverdue)
+            return [214, "ActorTimerOverdue"];
+        if (fault.actorSendFailed)
+            return [206, "ActorSendFailed"];
         if (fault.cancelled)
             return [-1, "Cancelled"];
         if (fault.deadline)
@@ -3128,11 +4387,18 @@ function faultInfo(fault) {
         actor_refused: [-4, "Refused"],
     }[fault.trap];
 }
-function faultReport(fault, secondary = false) {
+function faultDiagnostic(fault, secondary = false) {
     const [code, reason] = faultInfo(fault);
     const label = secondary ? "secondary failure" : "failure";
-    const message = fault.message === undefined ? "" : `: ${fault.message}`;
-    return (`hew: ${label}: ${reason} (${code})${message}\n` +
+    const message = fault.message === undefined ||
+        (fault.kind === "panic" &&
+            (fault.cancelled || fault.deadline || fault.timerOverdue))
+        ? ""
+        : `: ${fault.message}`;
+    return `hew: ${label}: ${reason} (${code})${message}\n`;
+}
+function faultReport(fault, secondary = false) {
+    return (faultDiagnostic(fault, secondary) +
         (fault.secondary ?? []).map((next) => faultReport(next, true)).join(""));
 }
 // ── refs ────────────────────────────────────────────────────────────────────
@@ -3207,6 +4473,8 @@ function actorErrorRole(reason) {
             return "ActorErrorRoutingFailed";
         case "EncodeFailed":
             return "ActorErrorEncodeFailed";
+        case "MessageTooLarge":
+            return "ActorErrorMessageTooLarge";
         case "ConnectionDropped":
             return "ActorErrorConnectionDropped";
         case "Partition":
@@ -3217,6 +4485,8 @@ function actorErrorRole(reason) {
 }
 function sendErrorRole(reason) {
     switch (reason) {
+        case "MessageTooLarge":
+            return "SendErrorMessageTooLarge";
         case "Full":
             return "SendErrorFull";
         case "Closed":
@@ -3286,7 +4556,9 @@ function toComparable(value) {
         case "vector":
             return value.items.map(toComparable);
         case "rc":
-            return toComparable(value.cell.value);
+            return "Rc";
+        case "weak":
+            return "Weak";
         case "map":
             return [...value.entries.values()].map((entry) => [
                 toComparable(entry.key),
@@ -3459,7 +4731,7 @@ function applyBinary(op, lhs, rhs, ty) {
         };
     }
     if (lhs.kind === "string") {
-        return { kind: "string", value: lhs.value + asString(rhs) };
+        return stringValue(lhs.value + asString(rhs));
     }
     return {
         kind: "i64",
@@ -3525,7 +4797,7 @@ function applyCast(value, to) {
             return { kind: "bool", value: truth(value) };
         case "char":
         case "string":
-            return { kind: "string", value: asString(value) };
+            return stringValue(asString(value));
         default:
             break;
     }