@hew-lang/sandbox-vm 0.6.2 → 0.6.4

package/dist/interpreter/v1/exec.js

@@ -1,3 +1,4 @@
+import { BrowserDirectories, } from "./browser-directory.js";
 /// The `hew.sandbox.bytecode.v1` executor.
 ///
 /// The package is a projection of verified ownership SIR, so this executor
@@ -12,13 +13,14 @@ import { TraceBuilder, runtimeFailure } from "../trace.js";
 import { UNIT, cloneValue, stringValue, toJsonValue, } from "../values.js";
 import { runtimeTag } from "./package.js";
 import { StructuralRenderer } from "./structural.js";
+import { timestampBinary } from "./timestamp.js";
 import { selectedValue, collectionOperation, sharedOperation, } from "./value-operations.js";
 import { Pipes } from "./pipes.js";
 import { FrameScheduler } from "./scheduler.js";
 import { DeterministicIds } from "../../scheduler/ids.js";
 import { Mt19937 } from "./mt19937.js";
-import { ShimFault, decodeUtf8Checked, resolveExternShim, resolveRuntimeShim, } from "./shims.js";
-import { admitPackage } from "./validate.js";
+import { ShimFault, CODEC_REGISTRATION, decodeUtf8Checked, resolveExtern, resolveRuntime, resolveSuspension, } from "./shims.js";
+import { AdmittedPackage } from "./validate.js";
 const DEFAULT_STEP_BUDGET = 1_000_000;
 const DEFAULT_ACTOR_STOP_NS = 5_000_000_000;
 /// Ends the run. The status is already recorded on the trace.
@@ -55,7 +57,7 @@ class StdinReader {
         return this.bytes.slice(start, this.offset);
     }
 }
-export function runPackageV1(pkg, options = {}) {
+export async function runPackageV1(pkg, options = {}) {
     const fixtureId = options.fixtureId ?? "package";
     const replay = {
         seed: options.replay?.seed ?? 0,
@@ -68,14 +70,25 @@ export function runPackageV1(pkg, options = {}) {
     const trace = new TraceBuilder(pkg, fixtureId, options.traceId ?? `trace:${fixtureId}`, replay, options.sandboxVersion ?? "0.0.0-spec");
     // Admission is a load-time decision: nothing runs when the package names a
     // capability the VM has no shim for.
-    const rejection = admitPackage(pkg);
-    if (rejection) {
-        trace.reject(rejection);
+    const admission = AdmittedPackage.load(pkg, options);
+    if (!(admission instanceof AdmittedPackage)) {
+        trace.reject(admission);
         return trace.finish();
     }
-    const vm = new ExecutorV1(pkg, trace, StdinReader.fromReplay(replay.inputs), options.schedulerPolicy ?? "round_robin", options);
+    const directoryRefusal = await BrowserDirectories.admission(options.directoryRoots);
+    if (directoryRefusal) {
+        trace.reject({
+            category: "not_implemented",
+            code: "sandbox.host.directory",
+            capability: "directoryRoots",
+            message: directoryRefusal,
+            span: null,
+        });
+        return trace.finish();
+    }
+    const vm = new ExecutorV1(admission, trace, StdinReader.fromReplay(replay.inputs), options.schedulerPolicy ?? "round_robin", options);
     try {
-        vm.run();
+        await vm.run();
     }
     catch (error) {
         if (!(error instanceof Halt)) {
@@ -86,7 +99,6 @@ export function runPackageV1(pkg, options = {}) {
     return trace.finish();
 }
 class ExecutorV1 {
-    pkg;
     trace;
     stdin;
     options;
@@ -111,16 +123,39 @@ class ExecutorV1 {
     consumedResources = new WeakSet();
     running = false;
     rootComplete = false;
+    terminating = false;
     rootFault = null;
-    constructor(pkg, trace, stdin, policy, options) {
-        this.pkg = pkg;
+    pkg;
+    directories;
+    constructor(admission, trace, stdin, policy, options) {
         this.trace = trace;
         this.stdin = stdin;
         this.options = options;
+        const pkg = admission.bytecode;
+        this.pkg = pkg;
+        this.directories = new BrowserDirectories(options.directoryRoots);
         this.scheduler = new FrameScheduler(trace, policy);
         this.ids = new DeterministicIds(trace.replay.seed);
         this.host = {
             argv: [...(options.argv ?? ["main.hew"])],
+            unixTimeMillis: () => this.trace.virtualTimeMs,
+            calendarBridge: options.calendarBridge,
+            fileError: (operation) => {
+                const error = this.current.context.fileError;
+                switch (operation) {
+                    case "HasError":
+                        return { kind: "bool", value: error != null };
+                    case "LastErrorKind":
+                        return { kind: "i64", value: BigInt(error?.kind ?? 0) };
+                    case "LastErrno":
+                        if (error)
+                            error.kind = 0;
+                        return { kind: "i64", value: 0n };
+                    case "LastError":
+                        this.current.context.fileError = null;
+                        return stringValue(error?.message ?? "");
+                }
+            },
             pipes: this.pipes,
             generatorStream: (value) => {
                 const id = this.ids.channel();
@@ -150,7 +185,6 @@ class ExecutorV1 {
                     : this.pipes.cloneSink(value);
             },
             newPipe: (capacity) => this.newPipe(capacity),
-            closePipe: (value) => this.pipes.close(value, this.pipeFault(this.current)),
             releaseValue: (value) => this.closeValue(value, this.pipeFault(this.current)),
             writeStdout: (text) => this.trace.writeStdout(text, null),
             writeStderr: (text) => this.trace.writeStderr(text, null),
@@ -183,24 +217,47 @@ class ExecutorV1 {
     }
     /// One instruction or terminator executed is one step, ownership ops
     /// included: the package's ops are what the program does.
-    run() {
-        this.runFrame(this.current);
-        this.scheduler.run();
-        if (!this.rootComplete) {
-            throw new Error("the root frame is waiting with no runnable work");
+    async run() {
+        const root = this.current.context;
+        const cancel = () => {
+            const fault = {
+                kind: "panic",
+                message: "execution cancelled",
+                cancelled: true,
+            };
+            if (root.cancel)
+                root.cancel(fault);
+            else
+                root.pendingCancellation ??= fault;
+        };
+        this.options.signal?.addEventListener("abort", cancel, { once: true });
+        if (this.options.signal?.aborted)
+            cancel();
+        try {
+            this.runFrame(this.current);
+            await this.scheduler.run();
+            if (!this.rootComplete) {
+                throw new Error("the root frame is waiting with no runnable work");
+            }
+            // Native main return drains accepted work before closing idle actors.
+            for (const owner of this.supervisors.values())
+                if (!owner.supervisor)
+                    this.stopSupervisor(owner);
+            for (const actor of this.actors.values())
+                if (!actor.supervisor && actor.alive)
+                    this.requestActorStop(actor);
+            await this.scheduler.run();
+            if (this.rootFault)
+                this.haltWithFault(this.rootFault);
+            if (this.trace.exitCode === 0 && this.faultDebts.size)
+                this.trace.exitCode = 1;
+        }
+        finally {
+            this.terminating = true;
+            await this.scheduler.retireHost();
+            this.directories.retire((value) => this.closeHostResource(value));
+            this.options.signal?.removeEventListener("abort", cancel);
         }
-        // Native main return drains accepted work before closing idle actors.
-        for (const owner of this.supervisors.values())
-            if (!owner.supervisor)
-                this.stopSupervisor(owner);
-        for (const actor of this.actors.values())
-            if (!actor.supervisor && actor.alive)
-                this.requestActorStop(actor);
-        this.scheduler.run();
-        if (this.rootFault)
-            this.haltWithFault(this.rootFault);
-        if (this.trace.exitCode === 0 && this.faultDebts.size)
-            this.trace.exitCode = 1;
     }
     runFrame(frame) {
         this.current = frame;
@@ -241,7 +298,7 @@ class ExecutorV1 {
     }
     // ── frames ───────────────────────────────────────────────────────────────
     activate(fn, args, caller, result, normal, unwind, context) {
-        const mandatoryClose = (this.pkg.resources ?? []).some((resource) => resource.close === fn.id);
+        const mandatoryClose = (this.pkg.resources ?? []).some((resource) => "close" in resource && resource.close === fn.id);
         const parentContext = caller?.context ?? context;
         parentContext.pollBudget ??= { remaining: 0 };
         if (mandatoryClose && args[0])
@@ -268,7 +325,7 @@ class ExecutorV1 {
         for (const block of fn.blocks) {
             block.params.forEach(record);
             for (const op of block.ops) {
-                if (op.dst != null && op.own === "none")
+                if ("dst" in op && op.dst != null && op.own === "none")
                     trivial.add(op.dst);
             }
             const term = block.term;
@@ -297,7 +354,7 @@ class ExecutorV1 {
             parked: [],
             caller,
             result,
-            normal,
+            normal: normal ?? undefined,
             unwind,
         };
     }
@@ -510,7 +567,7 @@ class ExecutorV1 {
             case "aggregate.make":
                 this.define(act, op.dst, {
                     kind: "record",
-                    typeId: this.aggregateName(op.shape),
+                    typeId: op.shape === null ? "" : this.aggregateName(op.shape),
                     shape: op.shape ?? undefined,
                     fields: op.fields.map((id) => this.read(act, id)),
                 });
@@ -977,8 +1034,12 @@ class ExecutorV1 {
                 this.define(act, op.dst, { kind: "task", id: task.id });
                 return;
             }
-            default:
-                throw new Error(`opcode ${op.op} has no sequential executor`);
+            case "actor.ingress_adapter":
+                throw new Error("actor ingress adapters are not admitted in the VM");
+            default: {
+                const exhaustive = op;
+                throw new Error("unhandled instruction: " + String(exhaustive));
+            }
         }
     }
     /// Hand each field of a consumed container, or each payload of a matched
@@ -1028,6 +1089,20 @@ class ExecutorV1 {
             case "return":
                 this.returnFrom(act, term.value ? this.boundary(act, term.value) : UNIT);
                 return;
+            case "timestamp.binary": {
+                const outcome = timestampBinary(this.pkg, term, this.read(act, term.lhs), this.read(act, term.rhs));
+                if (outcome === null) {
+                    const failure = term.failures.find((edge) => edge.trap === "integer_overflow");
+                    if (!failure)
+                        throw new Error("timestamp arithmetic lacks its overflow edge");
+                    this.takeEdge(act, failure.edge);
+                }
+                else {
+                    this.define(act, term.result.value, outcome);
+                    this.takeEdge(act, term.normal);
+                }
+                return;
+            }
             case "checked.binary": {
                 const failure = checkedFailure(term.binary_op, this.read(act, term.lhs), this.read(act, term.rhs), term.ty);
                 if (failure) {
@@ -1080,132 +1155,128 @@ class ExecutorV1 {
                 return;
             case "runtime.call": {
                 const entry = this.pkg.runtime_families[term.family];
-                if (entry?.family === "ActorCaller") {
-                    const caller = act.context.caller ?? { kind: "Task" };
-                    const payload = [];
-                    if (caller.kind === "Actor") {
-                        const shape = this.pkg.variants[term.result_shape];
-                        const tag = runtimeTag(shape, "CallerActor");
-                        payload.push({
-                            kind: "record",
-                            typeId: shape.cases[tag].fields[0],
-                            fields: [{ kind: "i64", value: caller.identity }],
-                        });
-                    }
-                    this.completeShim(act, term, this.variant(term.result_shape, caller.kind === "Actor"
-                        ? "CallerActor"
-                        : caller.kind === "Timer"
-                            ? "CallerTimer"
-                            : "CallerTask", payload));
-                    return;
-                }
-                if (entry?.family === "ActorRefusalLog") {
-                    const [message, handler, reason] = term.args.map((argument) => this.boundary(act, argument));
-                    this.trace.snapshot("actor.delivery_refused", {
-                        actor_id: act.context.actor?.id ?? null,
-                        handler: toJsonValue(handler),
-                        message: toJsonValue(message),
-                        reason: toJsonValue(reason),
-                    });
-                    if (!act.context.reply)
-                        this.trace.writeStderr(`WARN actor.delivery_refused actor=${act.context.actor?.identity ?? 0n} handler=${asString(handler)} reason=${JSON.stringify(asString(reason))}\n`, null);
-                    this.completeShim(act, term, UNIT);
-                    return;
-                }
-                if (entry &&
-                    (entry.family === "Map" ||
-                        entry.family === "Set" ||
-                        (entry.family === "Array" && entry.detail === "Set") ||
-                        (entry.family === "Vector" &&
-                            ["Contains", "Clear", "Set"].includes(String(entry.detail))))) {
-                    const args = term.args.map((operand) => this.boundary(act, operand));
-                    const iterator = collectionOperation(this.pkg, entry.family === "Array" ? "Vector" : entry.family, String(entry.detail), args, term.callbacks ?? [], term.result_member_shapes?.[1] ?? term.result_shape);
-                    this.runValueProgram(act, term, args, iterator);
-                    return;
-                }
-                if (entry &&
-                    [
-                        "RcNew",
-                        "RcClone",
-                        "RcDowngrade",
-                        "WeakCloneRc",
-                        "WeakUpgradeRc",
-                        "RcGet",
-                        "RcIsUnique",
-                        "RcSet",
-                        "RcStrongCount",
-                        "RcWeakCount",
-                    ].includes(entry.family)) {
-                    const args = term.args.map((operand) => this.boundary(act, operand));
-                    this.runValueProgram(act, term, args, sharedOperation(entry.family, args, act.rcOwner, term.shared_payload_type ?? "", (value) => this.variant(term.result_shape, value ? "OptionSome" : "OptionNone", value ? [value] : [])));
-                    return;
-                }
-                if (entry?.family === "SupervisorPool") {
-                    this.supervisorPool(act, term, String(entry.detail));
-                    return;
-                }
-                if (entry && ["SinkClose", "StreamClose"].includes(entry.family)) {
-                    const value = this.boundary(act, term.args[0]);
-                    this.running = false;
-                    this.closeValueAsync(value, this.pipeFault(act), (fault) => {
-                        if (fault)
-                            this.raiseFault(act, fault, term.unwind);
-                        else
-                            this.completeShim(act, term, UNIT);
-                        this.scheduler.enqueue(act.context.id, () => this.runFrame(act));
-                    }, act.context.actor, act.rcOwner);
+                if (!entry)
+                    throw new Error("runtime family is absent after admission");
+                const registration = resolveRuntime(entry);
+                if (registration.kind === "ordinary") {
+                    this.callShim(act, term, registration.shim);
                     return;
                 }
-                if (entry?.family === "StructuralFormat") {
-                    this.structuralFormat(act, term);
-                    return;
-                }
-                if (entry?.family === "BytesDecodeUtf8") {
-                    const value = decodeUtf8Checked(this.boundary(act, term.args[0]));
-                    let result;
-                    if ("value" in value)
-                        result = this.variant(term.result_shape, "ResultOk", [
-                            stringValue(value.value),
-                        ]);
-                    else {
-                        const shapes = term.variant_result_shapes;
-                        const error = this.pkg.aggregates[shapes.error];
-                        result = this.variant(term.result_shape, "ResultErr", [
-                            {
+                if (registration.kind === "refused")
+                    throw new Error(`runtime family ${registration.capability} was refused after admission`);
+                switch (registration.handler) {
+                    case "actor_caller": {
+                        const caller = act.context.caller ?? { kind: "Task" };
+                        const payload = [];
+                        if (caller.kind === "Actor") {
+                            const shape = this.pkg.variants[term.result_shape];
+                            const tag = runtimeTag(shape, "CallerActor");
+                            payload.push({
                                 kind: "record",
-                                typeId: error.name,
-                                shape: error.id,
-                                fields: [
-                                    { kind: "i64", value: BigInt(value.validUpTo) },
-                                    this.variant(shapes.error_len, value.errorLen === null ? "OptionNone" : "OptionSome", value.errorLen === null
-                                        ? []
-                                        : [{ kind: "i64", value: BigInt(value.errorLen) }]),
-                                ],
-                            },
-                        ]);
+                                typeId: shape.cases[tag].fields[0],
+                                fields: [{ kind: "i64", value: caller.identity }],
+                            });
+                        }
+                        this.completeShim(act, term, this.variant(term.result_shape, caller.kind === "Actor"
+                            ? "CallerActor"
+                            : caller.kind === "Timer"
+                                ? "CallerTimer"
+                                : "CallerTask", payload));
+                        return;
+                    }
+                    case "actor_refusal_log": {
+                        const [message, handler, reason] = term.args.map((argument) => this.boundary(act, argument));
+                        this.trace.snapshot("actor.delivery_refused", {
+                            actor_id: act.context.actor?.id ?? null,
+                            handler: toJsonValue(handler),
+                            message: toJsonValue(message),
+                            reason: toJsonValue(reason),
+                        });
+                        if (!act.context.reply)
+                            this.trace.writeStderr(`WARN actor.delivery_refused actor=${act.context.actor?.identity ?? 0n} handler=${asString(handler)} reason=${JSON.stringify(asString(reason))}\n`, null);
+                        this.completeShim(act, term, UNIT);
+                        return;
+                    }
+                    case "collection": {
+                        const args = term.args.map((operand) => this.boundary(act, operand));
+                        const iterator = collectionOperation(this.pkg, registration, args, term.callbacks ?? [], term.result_member_shapes?.[1] ?? term.result_shape);
+                        this.runValueProgram(act, term, args, iterator);
+                        return;
+                    }
+                    case "shared": {
+                        const args = term.args.map((operand) => this.boundary(act, operand));
+                        this.runValueProgram(act, term, args, sharedOperation(registration.operation, args, act.rcOwner, term.shared_payload_type ?? "", (value) => this.variant(term.result_shape, value ? "OptionSome" : "OptionNone", value ? [value] : [])));
+                        return;
+                    }
+                    case "supervisor_pool": {
+                        this.supervisorPool(act, term, registration.operation);
+                        return;
+                    }
+                    case "close": {
+                        const value = this.boundary(act, term.args[0]);
+                        this.running = false;
+                        this.closeValueAsync(value, this.pipeFault(act), (fault) => {
+                            if (fault)
+                                this.raiseFault(act, fault, term.unwind);
+                            else
+                                this.completeShim(act, term, UNIT);
+                            this.scheduler.enqueue(act.context.id, () => this.runFrame(act));
+                        }, act.context.actor, act.rcOwner);
+                        return;
+                    }
+                    case "structural_format": {
+                        this.structuralFormat(act, term);
+                        return;
+                    }
+                    case "utf8_decode": {
+                        const value = decodeUtf8Checked(this.boundary(act, term.args[0]));
+                        let result;
+                        if ("value" in value)
+                            result = this.variant(term.result_shape, "ResultOk", [
+                                stringValue(value.value),
+                            ]);
+                        else {
+                            const shapes = term.variant_result_shapes;
+                            const error = this.pkg.aggregates[shapes.error];
+                            result = this.variant(term.result_shape, "ResultErr", [
+                                {
+                                    kind: "record",
+                                    typeId: error.name,
+                                    shape: error.id,
+                                    fields: [
+                                        { kind: "i64", value: BigInt(value.validUpTo) },
+                                        this.variant(shapes.error_len, value.errorLen === null ? "OptionNone" : "OptionSome", value.errorLen === null
+                                            ? []
+                                            : [{ kind: "i64", value: BigInt(value.errorLen) }]),
+                                    ],
+                                },
+                            ]);
+                        }
+                        this.completeShim(act, term, result);
+                        return;
+                    }
+                    default: {
+                        const exhaustive = registration;
+                        throw new Error(`unknown runtime continuation ${String(exhaustive)}`);
                     }
-                    this.completeShim(act, term, result);
-                    return;
-                }
-                const shim = entry ? resolveRuntimeShim(entry) : undefined;
-                if (!entry || !shim) {
-                    throw new Error(`runtime family ${term.family} resolved no shim after admission`);
                 }
-                this.callShim(act, term, shim);
-                return;
             }
             case "extern.call": {
                 const entry = this.pkg.externs[term.extern];
-                const shim = entry ? resolveExternShim(entry.symbol) : undefined;
-                if (!entry || !shim) {
-                    throw new Error(`extern ${term.extern} resolved no shim after admission`);
-                }
-                this.callShim(act, term, shim);
+                if (!entry)
+                    throw new Error("external operation is absent after admission");
+                const registration = resolveExtern(entry);
+                if (registration.kind === "refused")
+                    throw new Error(`external operation ${registration.capability} was refused after admission`);
+                if (registration.kind === "directory")
+                    this.callDirectory(act, term, registration.operation);
+                else
+                    this.callShim(act, term, registration.shim);
                 return;
             }
             case "wire.codec": {
                 const args = term.args.map((operand) => this.boundary(act, operand));
-                this.runValueProgram(act, term, args, executeCodec(this.pkg, term, args[0], this.options.codecBridge, this.options.propertyInput ?? []));
+                this.runValueProgram(act, term, args, executeCodec(this.pkg, term, args[0], this.options[CODEC_REGISTRATION.bridge], this.options.propertyInput ?? []));
                 return;
             }
             case "value.call": {
@@ -1316,6 +1387,29 @@ class ExecutorV1 {
         act.block = target;
         act.opIndex = 0;
     }
+    callDirectory(act, term, operation) {
+        const args = term.args.map((operand) => this.boundary(act, operand));
+        const result = this.directories.call(operation, args, term.result_resource);
+        if (!(result instanceof Promise)) {
+            this.completeShim(act, term, result);
+            return;
+        }
+        // Acquisitions are synchronous in the language. Retain borrowed inputs and
+        // publish the new owner before the next authored cancellation safepoint.
+        this.running = false;
+        act.context.parked = true;
+        act.context.cancel = (fault = { kind: "panic", message: "task cancelled", cancelled: true }) => {
+            act.context.pendingCancellation ??= fault;
+        };
+        this.scheduler.submitHost(act.context.id, result, (outcome) => {
+            act.context.parked = false;
+            act.context.fileError = outcome.error;
+            this.completeShim(act, term, outcome.value);
+            this.runFrame(act);
+        }, (error) => {
+            throw error;
+        });
+    }
     /// Run a runtime or extern shim. A fault it raises takes the call's `unwind`
     /// edge so the cleanup the package names runs before the program ends.
     callShim(act, term, shim) {
@@ -1329,7 +1423,9 @@ class ExecutorV1 {
             : (this.pkg.variants[shapeId] ?? null);
         let value;
         try {
-            value = shim(this.host, args, shape);
+            const aggregateId = term.aggregate_result_shape;
+            const aggregate = aggregateId == null ? null : (this.pkg.aggregates[aggregateId] ?? null);
+            value = shim(this.host, args, shape, aggregate);
         }
         catch (error) {
             if (error instanceof ShimFault) {
@@ -1441,11 +1537,19 @@ class ExecutorV1 {
             this.completeShim(act, term, this.variant(term.result_shape, value ? "OptionSome" : "OptionNone", value ? [value] : []));
             return;
         }
-        if (!value) {
-            this.raiseFault(act, { kind: "trap", trap: "vector_bounds" }, term.unwind);
-            return;
+        switch (operation) {
+            case "Member":
+                if (!value) {
+                    this.raiseFault(act, { kind: "trap", trap: "vector_bounds" }, term.unwind);
+                    return;
+                }
+                this.completeShim(act, term, value);
+                return;
+            default: {
+                const exhaustive = operation;
+                throw new Error(`unknown supervisor pool operation ${String(exhaustive)}`);
+            }
         }
-        this.completeShim(act, term, value);
     }
     structuralFormat(act, term) {
         if (term.structural == null)
@@ -1655,7 +1759,11 @@ class ExecutorV1 {
         this.current = caller;
         this.takeEdge(caller, act.unwind);
     }
-    suspend(act, term) {
+    suspend(act, input) {
+        const registration = resolveSuspension(input);
+        if (registration.kind === "refused")
+            throw new Error(`suspension ${registration.capability} was refused after admission`);
+        const term = registration.term;
         switch (term.kind) {
             case "Yield": {
                 const generator = act.context.generator;
@@ -1868,6 +1976,35 @@ class ExecutorV1 {
                 return;
             }
             case "NativeIo": {
+                if (term.detail.operation === "FileRead" ||
+                    term.detail.operation === "FileWrite") {
+                    const args = term.inputs.map((operand) => this.boundary(act, operand));
+                    const wake = this.park(act, term);
+                    const cancel = act.context.cancel;
+                    let stopped = act.context.pendingCancellation ?? this.scopeDeadline(act) ?? null;
+                    act.context.cancel = (fault = {
+                        kind: "panic",
+                        message: "task cancelled",
+                        cancelled: true,
+                    }) => {
+                        stopped ??= fault;
+                    };
+                    this.scheduler.submitHost(act.context.id, this.directories.io(term.detail.operation, args, () => stopped !== null || this.terminating), (outcome) => {
+                        // The producer is quiescent. Restore park's latch so cancellation
+                        // between readiness and frame resumption still retires the result.
+                        act.context.cancel = cancel;
+                        act.context.fileError = outcome.error;
+                        if (stopped) {
+                            this.closeValue(outcome.value, null);
+                            cancel(stopped);
+                        }
+                        else
+                            wake(outcome.value);
+                    }, (error) => {
+                        throw error;
+                    });
+                    return;
+                }
                 if (term.detail?.operation === "SinkFinish") {
                     const wake = this.park(act, term);
                     const cancel = act.context.cancel;
@@ -1887,7 +2024,11 @@ class ExecutorV1 {
                     });
                     return;
                 }
-                // Admission passed `StdinReadLine`. The record is the raw line,
+                if (term.detail.operation !== "StdinReadLine") {
+                    const exhaustive = term.detail.operation;
+                    throw new Error(`unknown native I/O handler ${String(exhaustive)}`);
+                }
+                // The record is the raw line,
                 // so the records concatenate to the stdin the program consumed.
                 const line = this.stdin.readLine() ?? new Uint8Array();
                 this.trace.recordReplayInput({ kind: "stdin", data: new TextDecoder().decode(line) }, false);
@@ -1938,8 +2079,10 @@ class ExecutorV1 {
                 cancelTimer = this.scheduler.after(nanos, () => wake(UNIT));
                 return;
             }
-            default:
-                throw new Error(`suspension kind ${term.kind} resolved no handler after admission`);
+            default: {
+                const exhaustive = term;
+                throw new Error(`unknown suspension handler ${String(exhaustive)}`);
+            }
         }
     }
     pendingActorWait(act, targets, externalProgress, operation, fail) {
@@ -2323,12 +2466,18 @@ class ExecutorV1 {
                             value.cell.weak -= 1;
                         }
                         break;
+                    case "host_resource": {
+                        if (value.owner.closed)
+                            break;
+                        this.closeHostResource(value);
+                        break;
+                    }
                     case "timer": {
                         if (value.closed)
                             break;
                         const resource = this.pkg.resources?.[value.resource];
-                        if (resource?.close === undefined)
-                            throw new Error("timer lost its selected close");
+                        if (resource?.kind !== "opaque")
+                            throw new Error("opaque owner lost its selected close");
                         this.invokeFrame(actor, resource.close, [value], () => next(), next, rcOwner);
                         return;
                     }
@@ -2363,7 +2512,7 @@ class ExecutorV1 {
                         break;
                     case "record": {
                         const resource = (this.pkg.resources ?? []).find((resource) => resource.kind === "record" && resource.shape === value.shape);
-                        if (resource?.close !== undefined) {
+                        if (resource?.kind === "record") {
                             if (this.consumedResources.has(value))
                                 break;
                             if (!this.closingResources.has(value)) {
@@ -2417,7 +2566,20 @@ class ExecutorV1 {
         };
         next();
     }
+    closeHostResource(value) {
+        if (value.owner.closed)
+            return;
+        const resource = this.pkg.resources?.[value.resource];
+        const release = resource?.kind === "nominal"
+            ? resolveExtern({ symbol: resource.release })
+            : null;
+        if (release?.kind !== "directory" || release.operation.action !== "close")
+            throw new Error("filesystem owner lost its selected release");
+        this.directories.call(release.operation, [value]);
+    }
     closeValue(value, fault) {
+        if (value.kind === "host_resource")
+            this.closeHostResource(value);
         if (value.kind === "string")
             value.release();
         if (value.kind === "closure")
@@ -2587,7 +2749,19 @@ class ExecutorV1 {
                 this.trace.allocateId("actor", actor.id, act.context.id);
                 this.trace.snapshot("actor.spawn", { actor_id: actor.id });
                 const handle = { kind: "actor", id: actor.id };
+                act.context.cancel = (fault = {
+                    kind: "panic",
+                    message: "actor construction cancelled",
+                    cancelled: true,
+                }) => {
+                    actor.closing = true;
+                    if (actor.active) {
+                        actor.active.pendingCancellation ??= fault;
+                        actor.active.cancel?.(actor.active.pendingCancellation);
+                    }
+                };
                 const failed = (fault) => {
+                    act.context.cancel = undefined;
                     actor.active = null;
                     actor.alive = false;
                     actor.constructing = false;
@@ -2618,6 +2792,7 @@ class ExecutorV1 {
                     }
                     actor.constructing = false;
                     actor.active = null;
+                    act.context.cancel = undefined;
                     act.rcOwner = null;
                     actor.busy = false;
                     this.startPeriodicTimers(actor);
@@ -2629,12 +2804,12 @@ class ExecutorV1 {
                 // Construction enters the same interpreter loop as its caller. Only
                 // a real suspension queues work and advances deterministic scheduling.
                 const start = () => {
-                    if (layout.start !== undefined)
+                    if (layout.start != null)
                         actor.active = this.invokeFrame(actor, layout.start, [actor.state], started, failed, actor.rcOwner, true);
                     else
                         started();
                 };
-                if (layout.init !== undefined)
+                if (layout.init != null)
                     actor.active = this.invokeFrame(actor, layout.init, [actor.state, ...args.slice(supplied)], start, failed, actor.rcOwner, true);
                 else
                     start();
@@ -2771,7 +2946,7 @@ class ExecutorV1 {
                         this.raiseFault(act, { kind: "panic", message: "stream producer is closed" }, term.unwind);
                     }
                     else {
-                        if (actor.layout.mailbox_capacity !== undefined &&
+                        if (actor.layout.mailbox_capacity != null &&
                             actor.mailbox.length >= actor.layout.mailbox_capacity) {
                             actor.admission.push(admit);
                             return;
@@ -2946,7 +3121,8 @@ class ExecutorV1 {
                     specs: layout.children.flatMap((child) => Array.from({ length: members }, () => child)),
                     offsets: layout.children.map((_child, index) => index),
                     recovering: new Set(),
-                    restartBusy: false,
+                    restartBusy: true,
+                    constructor: null,
                     pendingRestarts: [],
                     spent: new Set(),
                     completed: false,
@@ -2961,20 +3137,39 @@ class ExecutorV1 {
                 this.trace.allocateId("supervisor", owner.id, act.context.id);
                 this.trace.snapshot("supervisor.spawn", { supervisor_id: owner.id });
                 this.running = false;
-                let child = 0;
+                const order = this.supervisorStartupOrder(owner);
+                let fault = null;
+                const fail = (cause) => {
+                    if (fault)
+                        return;
+                    fault = cause;
+                    owner.closed.push(() => {
+                        act.context.cancel = undefined;
+                        this.raiseFault(act, fault, term.unwind);
+                        this.scheduler.enqueue(act.context.id, () => this.runFrame(act));
+                    });
+                    if (owner.constructor)
+                        owner.constructor.pendingCancellation ??= cause;
+                    this.stopSupervisor(owner);
+                };
+                act.context.cancel = (cause = {
+                    kind: "panic",
+                    message: "construction cancelled",
+                    cancelled: true,
+                }) => fail(cause);
                 const next = () => {
-                    if (child < owner.children.length) {
-                        this.startChild(owner, child++, next, (fault) => {
-                            owner.closed.push(() => {
-                                this.raiseFault(act, fault, term.unwind);
-                                this.scheduler.enqueue(act.context.id, () => this.runFrame(act));
-                            });
-                            this.stopSupervisor(owner);
-                        });
+                    const child = order.shift();
+                    if (child !== undefined) {
+                        this.startChild(owner, child, next, fail);
                     }
                     else {
+                        act.context.cancel = undefined;
+                        owner.restartBusy = false;
                         this.completeShim(act, term, { kind: "supervisor", id: owner.id });
                         this.scheduler.enqueue(act.context.id, () => this.runFrame(act));
+                        const pending = owner.pendingRestarts.shift();
+                        if (pending)
+                            this.restartChild(owner, pending.child, pending.debts);
                     }
                 };
                 next();
@@ -3107,8 +3302,12 @@ class ExecutorV1 {
                     id: act.context.actor.id,
                 });
                 return;
-            default:
-                throw new Error(`actor operation ${operation.op} has no executor`);
+            case "local_observation":
+                throw new Error("actor observations are not admitted in the VM");
+            default: {
+                const exhaustive = operation;
+                throw new Error("unhandled actor operation: " + String(exhaustive));
+            }
         }
     }
     scopeDeadline(act, expected) {
@@ -3216,7 +3415,7 @@ class ExecutorV1 {
             selectedTarget?.(actor);
             if (settled || closing)
                 return;
-            const full = actor.layout.mailbox_capacity !== undefined &&
+            const full = actor.layout.mailbox_capacity != null &&
                 actor.mailbox.length >= actor.layout.mailbox_capacity;
             if (full) {
                 if (protocol.policy === "reject") {
@@ -3308,7 +3507,7 @@ class ExecutorV1 {
     admitActorMessage(actor, message) {
         if (!actor.alive || actor.closing)
             return "closed";
-        const full = actor.layout.mailbox_capacity !== undefined &&
+        const full = actor.layout.mailbox_capacity != null &&
             actor.mailbox.length >= actor.layout.mailbox_capacity;
         let declared = full ? actor.layout.overflow : null;
         const discard = (lost) => {
@@ -3608,7 +3807,7 @@ class ExecutorV1 {
             }, actor);
         };
         const runHook = () => {
-            if (actor.layout.crash !== undefined) {
+            if (actor.layout.crash != null) {
                 const [code, message] = faultInfo(fault);
                 const info = {
                     kind: "record",
@@ -3689,9 +3888,42 @@ class ExecutorV1 {
             throw new Error("supervisor does not exist");
         return owner;
     }
+    supervisorStartupOrder(owner) {
+        const declarations = owner.layout.startup_order ??
+            owner.layout.children.map((_child, index) => index);
+        return declarations.flatMap((declaration) => {
+            const offset = owner.offsets[declaration];
+            const end = owner.offsets[declaration + 1] ?? owner.children.length;
+            return Array.from({ length: end - offset }, (_value, index) => offset + index);
+        });
+    }
     startChild(owner, child, done, failed) {
         const spec = owner.specs[child];
-        this.invokeFrame(null, spec.spawn, owner.config, (value) => {
+        const arity = this.functionAt(spec.spawn).params.length;
+        // Packages predating sibling wiring have config-only constructors. Their
+        // actual callable signature, rather than a source name, selects that ABI.
+        const args = arity === owner.config.length + 1
+            ? [{ kind: "supervisor", id: owner.id }, ...owner.config]
+            : arity === owner.config.length
+                ? owner.config
+                : null;
+        if (!args)
+            throw new Error("supervisor constructor signature does not match its config");
+        owner.constructor = this.invokeFrame(null, spec.spawn, args, (value) => {
+            const cancellation = owner.constructor?.pendingCancellation;
+            owner.constructor = null;
+            if (!owner.alive) {
+                // The result is still owned here. Its declaration slot hands it to
+                // canonical reverse-order teardown, including the configured budget.
+                owner.children[child] = value;
+                failed(cancellation ?? {
+                    kind: "panic",
+                    message: "supervisor construction cancelled",
+                    cancelled: true,
+                });
+                this.finishSupervisorStop(owner);
+                return;
+            }
             owner.children[child] = value;
             if (value.kind === "actor")
                 this.actorFor(value).supervisor = { owner, child };
@@ -3704,7 +3936,15 @@ class ExecutorV1 {
                 child,
             });
             done();
-        }, failed);
+        }, (fault) => {
+            const stopped = !owner.alive;
+            owner.constructor = null;
+            // The initial caller still needs one terminal notification if the
+            // supervisor was stopped directly rather than through caller cancel.
+            failed(fault);
+            if (stopped)
+                this.finishSupervisorStop(owner);
+        });
     }
     roleOwner(role) {
         const parentRole = this.roles.get(role.ownerId);
@@ -3799,7 +4039,7 @@ class ExecutorV1 {
                 stop();
             });
         };
-        const starting = [...affected];
+        const starting = this.supervisorStartupOrder(owner).filter((index) => affected.includes(index));
         const start = () => {
             if (!owner.alive) {
                 owner.restartBusy = false;
@@ -3880,7 +4120,7 @@ class ExecutorV1 {
     }
     childStopBudget(owner, child) {
         const spec = owner.specs[child];
-        if (spec.stop_config !== undefined) {
+        if (spec.stop_config != null) {
             const duration = owner.config[spec.stop_config];
             if (duration?.kind !== "i64" || duration.value < 0n)
                 throw new Error("child stop budget is not a non-negative duration");
@@ -3898,6 +4138,18 @@ class ExecutorV1 {
         if (!owner.alive)
             return;
         owner.alive = false;
+        if (owner.constructor) {
+            owner.constructor.pendingCancellation ??= {
+                kind: "panic",
+                message: "supervisor construction cancelled",
+                cancelled: true,
+            };
+            owner.constructor.cancel?.(owner.constructor.pendingCancellation);
+            return;
+        }
+        this.finishSupervisorStop(owner);
+    }
+    finishSupervisorStop(owner) {
         let childIndex = owner.children.length - 1;
         const next = () => {
             owner.teardownCancelTimer?.();
@@ -4221,6 +4473,8 @@ function actorErrorRole(reason) {
             return "ActorErrorRoutingFailed";
         case "EncodeFailed":
             return "ActorErrorEncodeFailed";
+        case "MessageTooLarge":
+            return "ActorErrorMessageTooLarge";
         case "ConnectionDropped":
             return "ActorErrorConnectionDropped";
         case "Partition":
@@ -4231,6 +4485,8 @@ function actorErrorRole(reason) {
 }
 function sendErrorRole(reason) {
     switch (reason) {
+        case "MessageTooLarge":
+            return "SendErrorMessageTooLarge";
         case "Full":
             return "SendErrorFull";
         case "Closed":