@impz/testing 6.1.0 → 6.1.1

package/dist/index.js

@@ -18989,7 +18989,7 @@ function readBusyPorts() {
 // packages/daemon/testing/start-test-impd.ts
 import { createORPCClient as createORPCClient2 } from "@orpc/client";
 import { RPCLink } from "@orpc/client/fetch";
-import invariant6 from "tiny-invariant";
+import invariant7 from "tiny-invariant";
 
 // packages/daemon/src/config.ts
 import { join as join4 } from "path";
@@ -21955,7 +21955,7 @@ import { join as join47 } from "path";
 // packages/daemon/package.json
 var package_default = {
   name: "@impz/daemon",
-  version: "6.1.0",
+  version: "6.1.1",
   private: true,
   description: "impd: the imp host daemon",
   type: "module",
@@ -22314,6 +22314,7 @@ function toImpRecord(row) {
     id: row.id,
     name: row.name,
     imageId: row.image_id,
+    imageDigest: row.image_digest,
     state: row.state,
     kind: row.kind,
     vcpus: row.vcpus,
@@ -22377,6 +22378,7 @@ async function writeImpRow(db, imp) {
     id: imp.id ?? Bun.randomUUIDv7(),
     name: imp.name,
     image_id: imp.imageId,
+    image_digest: imp.imageDigest,
     state: "creating",
     vcpus: imp.vcpus,
     memory_mib: imp.memoryMib,
@@ -24963,7 +24965,8 @@ function formatCaller(caller) {
 class RamBudgetError extends ImpdError {
   name = "RamBudgetError";
   protectedImps;
-  constructor(message, shortfall) {
+  budget;
+  constructor(message, shortfall, budget) {
     super("RAM_BUDGET_EXCEEDED", {
       status: 503,
       message,
@@ -24977,16 +24980,27 @@ class RamBudgetError extends ImpdError {
       }
     });
     this.protectedImps = shortfall.protected;
+    this.budget = budget;
   }
 }
-function buildImpOverBudgetError(budgetMib, usedMib, memoryMib) {
-  return new RamBudgetError(`the imp's memory, at its max (${String(memoryMib)} MiB), is larger than the whole RAM budget (${String(budgetMib)} MiB)`, { budgetMib, usedMib, requestedMib: memoryMib, protected: [] });
+var BUDGET_TITLES = {
+  ram: "the whole RAM budget",
+  ordinary: "the RAM budget outside the huge page pool"
+};
+function buildImpOverBudgetError(budget, shortfall) {
+  return new RamBudgetError(`the imp's memory, at its max (${String(shortfall.requestedMib)} MiB), is larger than ${BUDGET_TITLES[budget]} (${String(shortfall.budgetMib)} MiB)`, { ...shortfall, protected: [] }, budget);
 }
 function buildRamBudgetError(shortfall) {
   const used = String(shortfall.usedMib);
   const budget = String(shortfall.budgetMib);
   const requested = String(shortfall.requestedMib);
-  return new RamBudgetError(`not enough RAM: ${used} of ${budget} MiB in use, ${requested} MiB requested, and no idle imp left to sleep`, shortfall);
+  return new RamBudgetError(`not enough RAM: ${used} of ${budget} MiB in use, ${requested} MiB requested, and no idle imp left to sleep`, shortfall, "ram");
+}
+function buildOrdinaryBudgetError(shortfall) {
+  const used = String(shortfall.usedMib);
+  const budget = String(shortfall.budgetMib);
+  const requested = String(shortfall.requestedMib);
+  return new RamBudgetError(`not enough RAM outside the huge page pool: ${used} of ${budget} MiB in use, ${requested} MiB requested on 4 KiB pages, and no idle imp left to sleep`, shortfall, "ordinary");
 }
 function buildHugePoolError(shortfall) {
   const committed = String(shortfall.committedMib);
@@ -24997,7 +25011,7 @@ function buildHugePoolError(shortfall) {
     usedMib: shortfall.committedMib,
     requestedMib: shortfall.requestedMib,
     protected: []
-  });
+  }, "pool");
 }
 function buildNeededMib(usedMib, requestedMib, budgetMib) {
   return Math.max(0, usedMib + requestedMib - budgetMib);
@@ -25005,6 +25019,9 @@ function buildNeededMib(usedMib, requestedMib, budgetMib) {
 function isRamBudgetError(error) {
   return isImpdError(error, "RAM_BUDGET_EXCEEDED");
 }
+function isOrdinaryBudgetError(error) {
+  return error instanceof RamBudgetError && error.budget === "ordinary";
+}
 
 // packages/daemon/src/identity/auth/caller-view.ts
 function canSeeEveryOwner(caller) {
@@ -26450,6 +26467,7 @@ var CopyImpSchema = z62.object({
   id: z62.string(),
   name: z62.string(),
   imageId: z62.string(),
+  imageDigest: z62.string(),
   state: z62.string(),
   vcpus: z62.int(),
   memoryMib: z62.int(),
@@ -26489,7 +26507,8 @@ async function readDatabaseCopy(db, path) {
   await writeConsistentCopy(db, path);
   const copy = new Database2(path, { readonly: true });
   try {
-    const imps = copy.query(`SELECT id, name, image_id AS imageId, state, vcpus, memory_mib AS memoryMib,
+    const imps = copy.query(`SELECT id, name, image_id AS imageId, image_digest AS imageDigest, state, vcpus,
+           memory_mib AS memoryMib,
            max_memory_mib AS maxMemoryMib, http_port AS httpPort, egress_policy AS egressPolicy,
            egress_allow AS egressAllow, disk_bytes AS diskBytes,
            identity_reset_pending AS identityResetPending, backup
@@ -27078,17 +27097,26 @@ async function updateImpState(db, id, change, expected) {
   if (change.firecrackerVersion !== undefined) {
     values.firecracker_version = change.firecrackerVersion;
   }
-  let query = db.updateTable("imps").set({ ...values, ...buildAwakeValues(change), ...buildBootCauseValues(change) }).where("id", "=", id);
-  if (expected !== undefined) {
-    if (change.state !== expected.state) {
-      requireTransition(expected.state, change.state, `move to ${change.state}`);
+  const row = await db.transaction().execute(async (trx) => {
+    const current = await trx.selectFrom("imps").select(["state", "pid"]).where("id", "=", id).executeTakeFirst();
+    if (current === undefined) {
+      return null;
+    }
+    if (expected !== undefined && (current.state !== expected.state || current.pid !== expected.pid)) {
+      return null;
+    }
+    if (change.state !== current.state) {
+      requireTransition(current.state, change.state, `move to ${change.state}`);
     }
-    const pidOperator = expected.pid === null ? "is" : "=";
-    query = query.where("state", "=", expected.state).where("pid", pidOperator, expected.pid);
+    return trx.updateTable("imps").set({ ...values, ...buildAwakeValues(change), ...buildBootCauseValues(change) }).where("id", "=", id).returningAll().executeTakeFirstOrThrow();
+  });
+  if (row !== null) {
+    return emitChange(db, toImpRecord(row), change);
   }
-  const returning = query.returningAll();
-  const row = expected === undefined ? await returning.executeTakeFirstOrThrow() : await returning.executeTakeFirst();
-  return row === undefined ? undefined : emitChange(db, toImpRecord(row), change);
+  if (expected === undefined) {
+    throw buildNotFoundError("imp", id);
+  }
+  return;
 }
 function buildAwakeValues(change) {
   const now = Date.now();
@@ -27686,9 +27714,6 @@ async function updateLockedImpState(db, imp, change) {
   if (!isLockedImp(record)) {
     throw new Error(`imp ${record.id}: a state write needs the imp's lock`);
   }
-  if (change.state !== imp.state) {
-    requireTransition(imp.state, change.state, `move to ${change.state}`);
-  }
   const updated = await updateImpState(db, imp.id, change);
   return toLockedImp(imp, updated);
 }
@@ -27876,12 +27901,7 @@ function createCheckpointService(deps) {
           throw buildInvalidStateError(imp.state, ["running", "sleeping", "stopped", "error"], "fork");
         }
         const api = await deps.imps.toApi(imp);
-        return {
-          imp: api,
-          policy,
-          isIdentityResetPending: imp.isIdentityResetPending,
-          isBackedUp: imp.isBackedUp
-        };
+        return { imp: api, policy, isBackedUp: imp.isBackedUp, imageDigest: imp.imageDigest };
       });
       const made = { forkId: null, isSourceChanged: false };
       const requireSameSource = (imp) => {
@@ -27917,6 +27937,7 @@ function createCheckpointService(deps) {
         const fork = await deps.imps.createImp({
           name: input.name,
           image: source.imp.image,
+          imageDigest: source.imageDigest,
           vcpus: source.imp.vcpus,
           memoryMib: source.imp.memoryMib,
           maxMemoryMib: source.imp.maxMemoryMib,
@@ -27925,7 +27946,7 @@ function createCheckpointService(deps) {
             cpuLimit: source.imp.cpu.limit,
             cpuWeight: source.imp.cpu.weight
           },
-          isIdentityResetPending: source.isIdentityResetPending,
+          isIdentityResetPending: true,
           isBackedUp: source.isBackedUp,
           prepareDisk: createForkDisk
         });
@@ -28030,6 +28051,7 @@ var ManifestImpSchema = z64.object({
   id: z64.string(),
   name: z64.string(),
   imageDigest: z64.string(),
+  clonedDigest: z64.string().optional(),
   vcpus: z64.int(),
   memoryMib: z64.int(),
   maxMemoryMib: z64.int().nullable().optional(),
@@ -28112,7 +28134,7 @@ function createEventBus() {
 }
 
 // packages/daemon/src/platform/db/run-migrations.ts
-import { sql as sql12 } from "kysely";
+import { sql as sql13 } from "kysely";
 import { Migrator } from "kysely/migration";
 
 // packages/daemon/src/platform/db/migrations/migration-001-create-initial-schema.ts
@@ -28764,6 +28786,17 @@ var MIGRATION_043_MERGE_SECRET_KINDS = {
   }
 };
 
+// packages/daemon/src/platform/db/migrations/migration-044-add-imp-image-digests.ts
+import { sql as sql12 } from "kysely";
+var MIGRATION_044_ADD_IMP_IMAGE_DIGESTS = {
+  async up(db) {
+    await db.schema.alterTable("imps").addColumn("image_digest", "text", (column) => column.notNull().defaultTo("")).execute();
+    await sql12`UPDATE imps SET image_digest = (
+      SELECT images.digest FROM images WHERE images.id = imps.image_id
+    )`.execute(db);
+  }
+};
+
 // packages/daemon/src/platform/db/run-migrations.ts
 var MIGRATIONS = {
   "001_create_initial_schema": MIGRATION_001_CREATE_INITIAL_SCHEMA,
@@ -28808,7 +28841,8 @@ var MIGRATIONS = {
   "040_add_image_received_digests": MIGRATION_040_ADD_IMAGE_RECEIVED_DIGESTS,
   "041_add_move_send_steps": MIGRATION_041_ADD_MOVE_SEND_STEPS,
   "042_add_secret_env": MIGRATION_042_ADD_SECRET_ENV,
-  "043_merge_secret_kinds": MIGRATION_043_MERGE_SECRET_KINDS
+  "043_merge_secret_kinds": MIGRATION_043_MERGE_SECRET_KINDS,
+  "044_add_imp_image_digests": MIGRATION_044_ADD_IMP_IMAGE_DIGESTS
 };
 var PROVIDER = {
   getMigrations: () => Promise.resolve(MIGRATIONS)
@@ -28820,13 +28854,13 @@ async function runMigrations(db) {
   requireMigrated(result);
 }
 async function requireKnownMigrations(db) {
-  const table = await sql12`
+  const table = await sql13`
     SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'kysely_migration'
   `.execute(db);
   if (table.rows.length === 0) {
     return;
   }
-  const executed = await sql12`SELECT name FROM kysely_migration`.execute(db);
+  const executed = await sql13`SELECT name FROM kysely_migration`.execute(db);
   const unknown = executed.rows.map((row) => row.name).filter((name) => !Object.hasOwn(MIGRATIONS, name));
   if (unknown.length === 0) {
     return;
@@ -29068,8 +29102,11 @@ async function createRestoredImp(deps, options) {
     await writeRestoredFile(imp.disk, disk, imp);
   };
   const networks = await deps.networks.writeMissingNetworks(imp.networks);
+  const idHolder = await readImpById(deps.db, imp.id);
   try {
     return await deps.imps.createImp({
+      ...idHolder === undefined && { id: imp.id },
+      ...imp.clonedDigest !== undefined && { imageDigest: imp.clonedDigest },
       name: target.name,
       networkIds: networks.ids,
       image: target.image,
@@ -29113,6 +29150,7 @@ var CHECK_EVERY_MS = 7 * DAY_MS;
 var CHECK_SUBSET = "5%";
 var PRUNE_LOCK_TRIES = 6;
 var RETRY_FIRST_MS = 5 * 60 * 1000;
+var BUSY_REASON = "busy with another job";
 var BackupStateSchema = z65.object({
   lastRunAt: z65.coerce.date().nullable().default(null),
   lastPruneAt: z65.coerce.date().nullable().default(null),
@@ -29194,6 +29232,7 @@ function createBackupService(deps) {
         id: imp.id,
         name: imp.name,
         imageDigest: digests.get(imp.imageId) ?? "",
+        clonedDigest: imp.imageDigest,
         vcpus: imp.vcpus,
         memoryMib: imp.memoryMib,
         maxMemoryMib: imp.maxMemoryMib,
@@ -29255,8 +29294,15 @@ function createBackupService(deps) {
         continue;
       }
       try {
-        const made = await deps.imps.lockImp(imp.name, (locked) => locked.id === imp.id ? createCopy(locked, runId) : Promise.reject(new Error("replaced since the database copy")));
-        copies.set(imp.id, made);
+        const made = await deps.imps.tryLockImpId(imp.id, (locked) => locked === undefined ? Promise.reject(new Error("removed since the database copy")) : createCopy(locked, runId));
+        if (!made.ran) {
+          skipped.push({ name: imp.name, reason: BUSY_REASON });
+          getImpdLogger("backup").with({ imp: imp.name }).info("left out: {reason}", {
+            reason: BUSY_REASON
+          });
+          continue;
+        }
+        copies.set(imp.id, made.value);
       } catch (error) {
         skipped.push({ name: imp.name, reason: getErrorMessage(error) });
         getImpdLogger("backup").with({ imp: imp.name }).warning("left out: {error}", { error: getErrorMessage(error) });
@@ -37501,6 +37547,31 @@ function readTapOwner(tap) {
   }
 }
 
+// packages/daemon/src/imp-ops/governor/build-deferred-admission.ts
+import invariant4 from "tiny-invariant";
+function buildDeferredAdmission() {
+  const holder = { governor: null };
+  const requireGovernor = () => {
+    invariant4(holder.governor, "RAM admission ran before the RAM governor was attached");
+    return holder.governor;
+  };
+  return {
+    admission: {
+      admit: (request) => requireGovernor().admit(request),
+      release: (id) => {
+        requireGovernor().release(id);
+      }
+    },
+    admitGrow: (request) => requireGovernor().admitGrow(request),
+    releaseGrow: (id) => {
+      requireGovernor().releaseGrow(id);
+    },
+    attach: (governor) => {
+      holder.governor = governor;
+    }
+  };
+}
+
 // packages/daemon/src/platform/process/semaphore.ts
 function createSemaphore(limit) {
   const waiters = [];
@@ -37528,6 +37599,14 @@ function createSemaphore(limit) {
   };
 }
 
+// packages/daemon/src/imp-ops/governor/build-budgets.ts
+function buildBudgets(budgetMib, pool) {
+  return {
+    ramMib: budgetMib,
+    ordinaryMib: pool === null || pool.totalMib === 0 ? null : Math.max(0, budgetMib - pool.totalMib)
+  };
+}
+
 // packages/daemon/src/imp-ops/governor/build-huge-pool-admission.ts
 function buildHugePoolAdmission(input) {
   const growthMib = input.awake.reduce((sum, guest) => sum + Math.max(0, guest.hugePagesMib - guest.heldMib), 0);
@@ -37546,6 +37625,66 @@ function buildHugePoolAdmission(input) {
   };
 }
 
+// packages/daemon/src/imp-ops/governor/make-check-huge-pool.ts
+function makeCheckHugePool(deps) {
+  const pendingHugePages = deps.pendingHugePages;
+  return async (request, hugePagesMib) => {
+    const listed = await deps.listAwake();
+    const awake = listed.filter((imp) => imp.id !== request.id);
+    for (const imp of awake) {
+      pendingHugePages.delete(imp.id);
+    }
+    const onPages = awake.filter((imp) => imp.hugePagesMib > 0);
+    const held = await Promise.all(onPages.map((imp) => deps.readHugetlbMib?.(imp.pid, imp.apiSocket) ?? Promise.resolve(0)));
+    const pool = deps.readHugePool?.() ?? null;
+    const poolAdmission = buildHugePoolAdmission({
+      pool,
+      awake: onPages.map((imp, index) => ({
+        hugePagesMib: imp.hugePagesMib,
+        heldMib: held[index] ?? 0
+      })),
+      pendingMib: [...pendingHugePages].filter(([id]) => id !== request.id).map(([, mib]) => mib),
+      requestedMib: hugePagesMib
+    });
+    if (poolAdmission.admitted) {
+      return;
+    }
+    if (request.name !== null) {
+      deps.onRefused({
+        name: request.name,
+        usedMib: poolAdmission.committedMib,
+        reserveMib: hugePagesMib,
+        neededMib: poolAdmission.neededMib
+      });
+    }
+    throw buildHugePoolError({
+      totalMib: poolAdmission.totalMib,
+      committedMib: poolAdmission.committedMib,
+      requestedMib: hugePagesMib
+    });
+  };
+}
+
+// packages/daemon/src/imp-ops/governor/pick-shortfall.ts
+function pickShortfall(used, budgets, requestedMib) {
+  const ram = {
+    budget: "ram",
+    budgetMib: budgets.ramMib,
+    usedMib: used.ramMib,
+    missingMib: used.ramMib + requestedMib - budgets.ramMib
+  };
+  if (budgets.ordinaryMib === null) {
+    return ram;
+  }
+  const ordinaryMissingMib = used.ordinaryMib + requestedMib - budgets.ordinaryMib;
+  return ordinaryMissingMib > ram.missingMib ? {
+    budget: "ordinary",
+    budgetMib: budgets.ordinaryMib,
+    usedMib: used.ordinaryMib,
+    missingMib: ordinaryMissingMib
+  } : ram;
+}
+
 // packages/daemon/src/imp-ops/governor/pick-sleep-victims.ts
 function pickSleepVictims(candidates, needMib) {
   if (needMib <= 0) {
@@ -37568,6 +37707,7 @@ function pickSleepVictims(candidates, needMib) {
 var RESERVATION_TTL_MS = 20000;
 var ENFORCE_INTERVAL_MS = 5000;
 var ENFORCE_TRIGGER = "RAM over budget";
+var ORDINARY_TRIGGER = "RAM outside the huge page pool";
 function createRamGovernor(deps) {
   const admission = createSemaphore(1);
   const reservations = new Map;
@@ -37595,6 +37735,7 @@ function createRamGovernor(deps) {
       });
     }
   };
+  const readBudgets = () => buildBudgets(deps.budgetMib, deps.readHugePool?.() ?? null);
   const recordAdmission = (request, usedMib) => {
     reservations.set(request.id, {
       mib: request.reserveMib,
@@ -37616,72 +37757,66 @@ function createRamGovernor(deps) {
     }
     return reservation.mib;
   };
-  const checkHugePool = async (request, hugePagesMib) => {
-    const listed = await deps.listAwake();
-    const awake = listed.filter((imp) => imp.id !== request.id);
-    for (const imp of awake) {
-      pendingHugePages.delete(imp.id);
-    }
-    const onPages = awake.filter((imp) => imp.hugePagesMib > 0);
-    const held = await Promise.all(onPages.map((imp) => deps.readHugetlbMib?.(imp.pid, imp.apiSocket) ?? Promise.resolve(0)));
-    const pool = deps.readHugePool?.() ?? null;
-    const poolAdmission = buildHugePoolAdmission({
-      pool,
-      awake: onPages.map((imp, index) => ({
-        hugePagesMib: imp.hugePagesMib,
-        heldMib: held[index] ?? 0
-      })),
-      pendingMib: [...pendingHugePages].filter(([id]) => id !== request.id).map(([, mib]) => mib),
-      requestedMib: hugePagesMib
-    });
-    if (poolAdmission.admitted) {
-      return;
-    }
-    if (request.name !== null) {
+  const checkHugePool = makeCheckHugePool({
+    listAwake: deps.listAwake,
+    ...deps.readHugePool !== undefined && { readHugePool: deps.readHugePool },
+    ...deps.readHugetlbMib !== undefined && { readHugetlbMib: deps.readHugetlbMib },
+    pendingHugePages,
+    onRefused: (refusal) => {
       emitDecision({
         decision: "refused",
-        name: request.name,
         trigger: "huge page pool",
-        usedMib: poolAdmission.committedMib,
-        reserveMib: hugePagesMib,
-        neededMib: poolAdmission.neededMib,
-        protectedCount: 0
+        protectedCount: 0,
+        ...refusal
       });
     }
-    throw buildHugePoolError({
-      totalMib: poolAdmission.totalMib,
-      committedMib: poolAdmission.committedMib,
-      requestedMib: hugePagesMib
-    });
-  };
-  const readEffectiveUsage = async (excludeId, readVmMib = deps.readRamMib) => {
+  });
+  const readEffectiveUsage = async (excludeId, readVm = deps.readVmRam) => {
     const listed = await deps.listAwake();
     const awake = listed.filter((imp) => imp.id !== excludeId);
     const byImp = new Map;
     const lockedMib = deps.readLockedMib?.() ?? 0;
     let usedMib = lockedMib;
     let effectiveMib = lockedMib;
-    const readings = await Promise.all(awake.map((imp) => readVmMib(imp.pid, imp.apiSocket)));
+    let ordinaryUsedMib = lockedMib;
+    let ordinaryEffectiveMib = lockedMib;
+    const readings = await Promise.all(awake.map((imp) => readVm(imp.pid, imp.apiSocket)));
     for (const [index, imp] of awake.entries()) {
-      const measured = readings[index] ?? 0;
+      const reading = readings[index] ?? null;
+      const measured = reading?.ramMib ?? 0;
       const effective = Math.max(measured, readReservation(imp.id));
+      const ordinary = imp.hugePagesMib > 0 ? Math.max(0, measured - (reading?.hugetlbMib ?? 0)) : effective;
       byImp.set(imp.id, effective);
       usedMib += measured;
       effectiveMib += effective;
+      ordinaryUsedMib += imp.hugePagesMib > 0 ? ordinary : measured;
+      ordinaryEffectiveMib += ordinary;
     }
     for (const id of reservations.keys()) {
       if (id !== excludeId && !byImp.has(id)) {
         effectiveMib += readReservation(id);
+        if (!pendingHugePages.has(id)) {
+          ordinaryEffectiveMib += readReservation(id);
+        }
       }
     }
     const headroom = deps.readHeadroomMib?.(awake.map((imp) => imp.pid)) ?? Promise.resolve(0);
     const headroomMib = await headroom;
     effectiveMib += headroomMib;
-    return { awake, byImp, usedMib, effectiveMib, headroomMib };
+    ordinaryEffectiveMib += headroomMib;
+    return {
+      awake,
+      byImp,
+      usedMib,
+      effectiveMib,
+      ordinaryUsedMib,
+      ordinaryEffectiveMib,
+      headroomMib
+    };
   };
-  const readFreeRoom = async (excludeId, findMissing) => {
+  const readFreeRoom = async (excludeId, findShortfall) => {
     const usage = await readEffectiveUsage(excludeId);
-    const missingMib = findMissing(usage);
+    const missingMib = findShortfall(usage).missingMib;
     return {
       fits: missingMib <= 0,
       slept: 0,
@@ -37702,7 +37837,10 @@ function createRamGovernor(deps) {
     let diskFull = false;
     for (;; ) {
       const usage = await readEffectiveUsage(excludeId);
-      const missingMib = options.findMissing(usage);
+      const shortfall = options.findShortfall(usage);
+      const missingMib = shortfall.missingMib;
+      const isOrdinary = shortfall.budget === "ordinary";
+      const sleepable = usage.awake.filter((imp) => !isOrdinary || imp.hugePagesMib === 0);
       if (missingMib <= 0) {
         return {
           fits: true,
@@ -37725,7 +37863,7 @@ function createRamGovernor(deps) {
         continue;
       }
       const time = now();
-      const candidates = usage.awake.map((imp) => ({
+      const candidates = sleepable.map((imp) => ({
         id: imp.id,
         name: imp.name,
         ramMib: usage.byImp.get(imp.id) ?? 0,
@@ -37768,29 +37906,39 @@ function createRamGovernor(deps) {
   };
   return {
     admit: (request) => admission.run(async () => {
-      if (request.memoryMib > deps.budgetMib) {
+      const hugePagesMib = request.hugePagesMib ?? 0;
+      const hostBudgets = readBudgets();
+      const budgets = hugePagesMib > 0 ? { ...hostBudgets, ordinaryMib: null } : hostBudgets;
+      const whole = pickShortfall({ ramMib: 0, ordinaryMib: 0 }, budgets, request.memoryMib);
+      if (whole.missingMib > 0) {
         const usage = await readEffectiveUsage(request.id);
-        emitAdmission(request, "refused", usage.effectiveMib, {
-          neededMib: buildNeededMib(usage.effectiveMib, request.memoryMib, deps.budgetMib),
-          protectedCount: 0
+        const isOrdinary = whole.budget === "ordinary";
+        const usedMib = isOrdinary ? usage.ordinaryEffectiveMib : usage.effectiveMib;
+        emitAdmission(request, "refused", usedMib, {
+          neededMib: buildNeededMib(usedMib, request.memoryMib, whole.budgetMib),
+          protectedCount: 0,
+          ...isOrdinary && { trigger: ORDINARY_TRIGGER }
+        });
+        throw buildImpOverBudgetError(whole.budget, {
+          budgetMib: whole.budgetMib,
+          usedMib,
+          requestedMib: request.memoryMib
         });
-        throw buildImpOverBudgetError(deps.budgetMib, usage.effectiveMib, request.memoryMib);
       }
-      const hugePagesMib = request.hugePagesMib ?? 0;
       if (hugePagesMib > 0) {
         await checkHugePool(request, hugePagesMib);
       }
-      const bound = await readEffectiveUsage(request.id, deps.readResidentMib);
-      if (bound.effectiveMib + request.reserveMib <= deps.budgetMib) {
+      const bound = await readEffectiveUsage(request.id, deps.readResidentRam);
+      if (pickEffectiveShortfall(bound, budgets, request.reserveMib).missingMib <= 0) {
         recordAdmission(request, bound.effectiveMib);
         return;
       }
-      const findMissing = (usage) => usage.effectiveMib + request.reserveMib - deps.budgetMib;
-      const room = request.maySleepImps === false ? await readFreeRoom(request.id, findMissing) : await makeRoom({
+      const findReserveShortfall = (usage) => pickEffectiveShortfall(usage, budgets, request.reserveMib);
+      const room = request.maySleepImps === false ? await readFreeRoom(request.id, findReserveShortfall) : await makeRoom({
         excludeId: request.id,
         reason: `to make room for ${request.name ?? request.id}`,
         whenShort: "giveUp",
-        findMissing
+        findShortfall: findReserveShortfall
       });
       const diskFull = room.diskFull ? deps.readDiskFullError?.() ?? null : null;
       if (!room.fits && diskFull !== null) {
@@ -37798,16 +37946,20 @@ function createRamGovernor(deps) {
       }
       if (!room.fits) {
         const usage = await readEffectiveUsage(request.id);
-        emitAdmission(request, "refused", usage.effectiveMib, {
-          neededMib: buildNeededMib(usage.effectiveMib, request.reserveMib, deps.budgetMib),
-          protectedCount: room.protected.length
+        const shortfall = findReserveShortfall(usage);
+        const isOrdinary = shortfall.budget === "ordinary";
+        emitAdmission(request, "refused", shortfall.usedMib, {
+          neededMib: buildNeededMib(shortfall.usedMib, request.reserveMib, shortfall.budgetMib),
+          protectedCount: room.protected.length,
+          ...isOrdinary && { trigger: ORDINARY_TRIGGER }
         });
-        throw buildRamBudgetError({
-          budgetMib: deps.budgetMib,
-          usedMib: usage.effectiveMib,
+        const refusal = {
+          budgetMib: shortfall.budgetMib,
+          usedMib: shortfall.usedMib,
           requestedMib: request.reserveMib,
           protected: room.protected
-        });
+        };
+        throw isOrdinary ? buildOrdinaryBudgetError(refusal) : buildRamBudgetError(refusal);
       }
       recordAdmission(request, room.effectiveMib);
     }),
@@ -37820,23 +37972,25 @@ function createRamGovernor(deps) {
       if (!listed.some((imp) => imp.id === request.id)) {
         return false;
       }
+      const budgets = readBudgets();
       const room = await makeRoom({
         excludeId: null,
         reason: `to grow ${request.name}`,
         whenShort: "giveUp",
-        findMissing: (usage) => usage.effectiveMib + request.mib - deps.budgetMib,
+        findShortfall: (usage) => pickEffectiveShortfall(usage, budgets, request.mib),
         protectedId: request.id
       });
       const usage = await readEffectiveUsage(null);
+      const shortfall = pickEffectiveShortfall(usage, budgets, request.mib);
       const fits = room.fits && usage.awake.some((imp) => imp.id === request.id);
       emitDecision({
         decision: fits ? "admitted" : "refused",
         name: request.name,
         trigger: "grow",
-        usedMib: usage.effectiveMib,
+        usedMib: shortfall.usedMib,
         reserveMib: request.mib,
         ...!fits && {
-          neededMib: buildNeededMib(usage.effectiveMib, request.mib, deps.budgetMib),
+          neededMib: Math.max(0, shortfall.missingMib),
           protectedCount: room.protected.length
         }
       });
@@ -37871,11 +38025,12 @@ function createRamGovernor(deps) {
       };
     },
     enforce: () => admission.run(async () => {
+      const budgets = readBudgets();
       const room = await makeRoom({
         excludeId: null,
         reason: ENFORCE_TRIGGER,
         whenShort: "sleepAll",
-        findMissing: (usage) => usage.usedMib - deps.budgetMib
+        findShortfall: (usage) => pickShortfall({ ramMib: usage.usedMib, ordinaryMib: usage.ordinaryUsedMib }, budgets, 0)
       });
       const over = `over budget by ${String(room.missingMib)} MiB`;
       if (room.fits) {
@@ -37893,6 +38048,9 @@ function createRamGovernor(deps) {
     })
   };
 }
+function pickEffectiveShortfall(usage, budgets, requestedMib) {
+  return pickShortfall({ ramMib: usage.effectiveMib, ordinaryMib: usage.ordinaryEffectiveMib }, budgets, requestedMib);
+}
 
 // packages/daemon/src/vm/watchdog/agent-watchdog.ts
 var HOUR_MS = 3600000;
@@ -38249,6 +38407,7 @@ async function createImpRecord(context, id, input, image) {
     id,
     name,
     imageId: image.id,
+    imageDigest: input.imageDigest ?? image.digest,
     vcpus: input.vcpus ?? context.config.defaultVcpus,
     memoryMib: input.memoryMib ?? context.config.defaultMemoryMib,
     ...input.maxMemoryMib !== undefined && { maxMemoryMib: input.maxMemoryMib },
@@ -38316,7 +38475,7 @@ function createImpCommands(parts) {
     await context.egress.releaseSlot(imp.slot);
     const checkpoints = await listCheckpoints(context.db, imp.id);
     await removeImpFiles(context, imp.id, checkpoints.map((checkpoint) => checkpoint.id));
-    context.admission?.release(imp.id);
+    context.admission.release(imp.id);
     await removeImp(context.db, imp.id);
   };
   return {
@@ -39097,7 +39256,7 @@ function createBootTemplates(deps) {
       return writeTemplate(shape, key, work, buildId);
     };
     try {
-      await deps.admission?.admit({
+      await deps.admission.admit({
         id,
         name: null,
         reserveMib: Math.ceil(shape.memoryMib * deps.bootReservePercent / 100),
@@ -39112,7 +39271,7 @@ function createBootTemplates(deps) {
       }
       throw new BuildRefusedError(getErrorMessage(error), { cause: error });
     } finally {
-      deps.admission?.release(id);
+      deps.admission.release(id);
       rmSync15(work, { recursive: true, force: true });
     }
   };
@@ -39331,7 +39490,7 @@ function readOwnedRamMib(pid, apiSocket, procRoot = "/proc") {
   const fields = readVmSmaps(pid, apiSocket, procRoot);
   return fields === null ? null : countOwnedMib(fields);
 }
-async function readOwnedRamMibAsync(pid, apiSocket, procRoot = "/proc") {
+async function readOwnedRamAsync(pid, apiSocket, procRoot = "/proc") {
   if (!probeProcessAlive(pid, apiSocket, procRoot)) {
     return null;
   }
@@ -39340,19 +39499,27 @@ async function readOwnedRamMibAsync(pid, apiSocket, procRoot = "/proc") {
       readFile3(`${procRoot}/${String(pid)}/smaps_rollup`, "utf8"),
       readFile3(`${procRoot}/${String(pid)}/status`, "utf8")
     ]);
-    return countOwnedMib(addHugetlbPages(parseProcFields(rollup), status));
+    const fields = addHugetlbPages(parseProcFields(rollup), status);
+    return {
+      ramMib: countOwnedMib(fields),
+      hugetlbMib: Math.round((fields.get("HugetlbPages") ?? 0) / KIB_PER_MIB)
+    };
   } catch {
     return null;
   }
 }
-async function readResidentMibAsync(pid, apiSocket, procRoot = "/proc") {
+async function readResidentRamAsync(pid, apiSocket, procRoot = "/proc") {
   if (!probeProcessAlive(pid, apiSocket, procRoot)) {
     return null;
   }
   try {
     const text = await readFile3(`${procRoot}/${String(pid)}/status`, "utf8");
     const fields = parseProcFields(text);
-    return Math.round(((fields.get("RssAnon") ?? 0) + (fields.get("RssShmem") ?? 0) + (fields.get("HugetlbPages") ?? 0)) / KIB_PER_MIB);
+    const hugetlbKb = fields.get("HugetlbPages") ?? 0;
+    return {
+      ramMib: Math.round(((fields.get("RssAnon") ?? 0) + (fields.get("RssShmem") ?? 0) + hugetlbKb) / KIB_PER_MIB),
+      hugetlbMib: Math.round(hugetlbKb / KIB_PER_MIB)
+    };
   } catch {
     return null;
   }
@@ -41224,7 +41391,7 @@ function createVmReconciler(context, ops) {
       if (state === "Paused") {
         await context.vms.resumeVm(pid, paths);
       }
-      await context.admission?.admit({
+      await context.admission.admit({
         id: imp.id,
         name: imp.name,
         reserveMib: Math.max(meta?.ramMib ?? 0, context.config.wakeReserveMib),
@@ -41253,7 +41420,7 @@ function createVmReconciler(context, ops) {
       getImpdLogger("imps").with({ imp: imp.name }).warning("cannot adopt the VM a wake left: {error}; it boots cold next", {
         error: getErrorMessage(error)
       });
-      context.admission?.release(imp.id);
+      context.admission.release(imp.id);
       removeSnapshot(paths);
       if (!await stopOrphan(imp.name, pid, paths)) {
         return ops.updateState(imp, {
@@ -42203,7 +42370,7 @@ function makeSleepImpVm(deps) {
       const failure = isOomKill ? `${OOM_KILL_TRIGGER} (${message})` : message;
       getImpdLogger("imps").with({ imp: imp.name }).warning("sleep failed after firecracker stopped: {failure}", { failure });
       removeSnapshot(paths);
-      context.admission?.release(imp.id);
+      context.admission.release(imp.id);
       await updateState(imp, {
         reason: "stopped",
         detail: { trigger: isOomKill ? OOM_KILL_TRIGGER : reason },
@@ -42213,7 +42380,7 @@ function makeSleepImpVm(deps) {
       });
       throw isOomKill ? new Error(`sleep failed: ${OOM_KILL_TRIGGER}`, { cause: error }) : error;
     }
-    context.admission?.release(imp.id);
+    context.admission.release(imp.id);
     return updateState(imp, {
       reason: "slept",
       detail: slept.detail,
@@ -42260,6 +42427,11 @@ function readDiskMib(path) {
   }
 }
 
+// packages/daemon/src/imps/imps/pick-huge-pages.ts
+function pickHugePages(isOn, imp) {
+  return isOn && imp.maxMemoryMib <= imp.memoryMib && imp.memoryMib % 2 === 0 ? "2M" : "None";
+}
+
 // packages/daemon/src/imps/imps/pick-wake-huge-pages.ts
 function pickWakeHugePages(recorded, isOn) {
   if (recorded !== "2M") {
@@ -42301,13 +42473,22 @@ function makeWakeImpVm(deps) {
       throw buildUffdDeviceError();
     }
     const cgroup = setupVmCgroup(imp);
-    await context.admission?.admit({
-      id: imp.id,
-      name: imp.name,
-      reserveMib: Math.max(meta.ramMib, context.config.wakeReserveMib),
-      memoryMib: imp.maxMemoryMib,
-      hugePagesMib: hugePages === "2M" ? imp.memoryMib : 0
-    });
+    try {
+      await context.admission.admit({
+        id: imp.id,
+        name: imp.name,
+        reserveMib: Math.max(meta.ramMib, context.config.wakeReserveMib),
+        memoryMib: imp.maxMemoryMib,
+        hugePagesMib: hugePages === "2M" ? imp.memoryMib : 0
+      });
+    } catch (error) {
+      if (!isOrdinaryBudgetError(error) || !canBootOnPool(imp)) {
+        throw error;
+      }
+      const reason = `${getErrorMessage(error)}, so it boots on the huge page pool`;
+      getImpdLogger("imps").with({ imp: imp.name }).info("cold boot instead of a wake: {reason}", { reason });
+      return startColdImpVm(imp, "wake_fallback", reason);
+    }
     context.memoryLimit.setGuestMib(imp.id, imp.memoryMib + (meta.pluggedMib ?? 0));
     if (meta.pluggedMib !== undefined) {
       context.pluggedSizes.write(imp.id, meta.pluggedMib);
@@ -42368,6 +42549,7 @@ function makeWakeImpVm(deps) {
     }
     return toLockedImp(imp, { ...imp, isTrustPending: false });
   };
+  const canBootOnPool = (imp) => pickHugePages(context.config.hugePages !== null, imp) === "2M";
   const writeHostPagesIdentity = (imp, paths) => {
     const booted = readVmIdentity(paths);
     if (booted !== null) {
@@ -42400,7 +42582,7 @@ ${failure.message}`, { cause: failure }) : failure;
     } catch (error) {
       const message = getErrorMessage(error);
       getImpdLogger("imps").with({ imp: imp.name }).warning("could not stop the woken VM: {message}", { message });
-      context.admission?.release(imp.id);
+      context.admission.release(imp.id);
       removeSnapshot(paths);
       await updateState(imp, {
         reason: "failed",
@@ -42415,7 +42597,7 @@ ${failure.message}`, { cause: failure }) : failure;
     const failure = error.message.split(`
 `)[0] ?? "";
     getImpdLogger("imps").with({ imp: imp.name }).warning("{failure}; booting cold", { failure });
-    context.admission?.release(imp.id);
+    context.admission.release(imp.id);
     removeSnapshot(paths);
     const stopped = await updateState(imp, {
       reason: "stopped",
@@ -42428,11 +42610,6 @@ ${failure.message}`, { cause: failure }) : failure;
   return wakeImpVm;
 }
 
-// packages/daemon/src/imps/imps/pick-huge-pages.ts
-function pickHugePages(isOn, imp) {
-  return isOn && imp.maxMemoryMib <= imp.memoryMib && imp.memoryMib % 2 === 0 ? "2M" : "None";
-}
-
 // packages/daemon/src/imps/imps/start-cold-vm.ts
 import { randomBytes as randomBytes9 } from "crypto";
 import { statSync as statSync10 } from "fs";
@@ -43352,7 +43529,7 @@ function createImpVmOps(context) {
     if (hugePages === "2M" && !context.probeUffdDevice()) {
       throw buildUffdDeviceError();
     }
-    await context.admission?.admit({
+    await context.admission.admit({
       id: imp.id,
       name: imp.name,
       reserveMib: Math.ceil(imp.memoryMib * context.config.bootReservePercent / 100),
@@ -43411,7 +43588,7 @@ function createImpVmOps(context) {
       }
       return reset.isDiskGrowPending ? await setGrowPending(reset, false) : reset;
     } catch (error) {
-      context.admission?.release(imp.id);
+      context.admission.release(imp.id);
       await writeFailure(imp, error);
       throw error;
     }
@@ -43425,7 +43602,7 @@ function createImpVmOps(context) {
     }
     await context.cgroups.remove(imp.id);
     removeSnapshot(paths);
-    context.admission?.release(imp.id);
+    context.admission.release(imp.id);
     return imp.state === "stopped" ? imp : updateState(imp, { reason: "stopped", state: "stopped", pid: null });
   };
   const sleepImpVm = makeSleepImpVm({
@@ -43489,7 +43666,7 @@ function createImpVmOps(context) {
     if (imp.pid !== null) {
       await context.vms.stopVm(imp.pid, context.findPaths(imp.id), false);
     }
-    context.admission?.release(imp.id);
+    context.admission.release(imp.id);
     const stopped = await updateState(imp, {
       reason: "stopped",
       detail: { trigger: reason },
@@ -44053,6 +44230,7 @@ function createImpService(deps, createWatchdog) {
     isUnmergeable: (id) => context.mergeFlags.isLost(id),
     lockImp: lock.withImp,
     lockImpId: (id, action) => lock.withImpId(id, action, { isMove: true }),
+    tryLockImpId: lock.tryWithImpId,
     haltImp: ops.stopImpVm,
     bootImp: (imp) => ops.startImpVm(imp, "restore"),
     requireRunningImp: ops.requireRunningImp,
@@ -45109,20 +45287,14 @@ function createImpdImps(config, deps, parts) {
     uffdHandlerBin: config.hugePages?.handlerBin ?? null
   });
   const {
-    readRamMibAsync,
-    readResidentMib,
+    readVmRam,
+    readResidentRam,
     readKsmProfitMib: readProfitMib,
     readHugePagePool: readHugePool,
     readHugetlbMib,
     ...host
   } = resolveImpBoundaries(deps.imps ?? {});
-  const holder = { governor: null };
-  const admission = {
-    admit: (request) => holder.governor?.admit(request) ?? Promise.resolve(),
-    release: (id) => {
-      holder.governor?.release(id);
-    }
-  };
+  const deferred = buildDeferredAdmission();
   const pluggedSizes = createPluggedSizes();
   const memoryLimit = deps.imps?.memoryLimit ?? cgroups;
   const serviceDeps = {
@@ -45148,7 +45320,7 @@ function createImpdImps(config, deps, parts) {
     },
     ...deps.now !== undefined && { now: deps.now },
     ...host,
-    admission,
+    admission: deferred.admission,
     pluggedSizes
   };
   const imps = createImpService(serviceDeps, createImpWatchdog);
@@ -45187,10 +45359,8 @@ function createImpdImps(config, deps, parts) {
     isLocked: (id) => imps.isImpBusy(id),
     isBusy,
     tryWhileRunning: imps.tryWhileRunning,
-    admitGrow: (request) => holder.governor?.admitGrow(request) ?? Promise.resolve(true),
-    releaseGrow: (id) => {
-      holder.governor?.releaseGrow(id);
-    },
+    admitGrow: deferred.admitGrow,
+    releaseGrow: deferred.releaseGrow,
     limit: memoryLimit,
     readRamMib: (imp) => host.readRamMib(imp.pid, imp.paths.apiSocket),
     setPluggedMib: pluggedSizes.write,
@@ -45220,8 +45390,8 @@ function createImpdImps(config, deps, parts) {
         ];
       });
     },
-    readRamMib: readRamMibAsync,
-    readResidentMib,
+    readVmRam,
+    readResidentRam,
     readHugePool,
     readHugetlbMib,
     readHeadroomMib,
@@ -45233,7 +45403,7 @@ function createImpdImps(config, deps, parts) {
     events: imps.events,
     ...deps.now !== undefined && { now: deps.now }
   });
-  holder.governor = governor;
+  deferred.attach(governor);
   startImpTelemetry({
     bus: imps.events,
     subscribeResources: imps.subscribeResources,
@@ -45258,8 +45428,8 @@ function resolveImpBoundaries(boundaries) {
       ramMib: readRamMib(pid, apiSocket),
       rssMib: (readRss ?? readRssMib)(pid, apiSocket)
     }),
-    readRamMibAsync: readRam === undefined ? readOwnedRamMibAsync : (pid, apiSocket) => Promise.resolve(readRam(pid, apiSocket)),
-    readResidentMib: readRam === undefined ? readResidentMibAsync : (pid, apiSocket) => Promise.resolve(readRam(pid, apiSocket)),
+    readVmRam: readRam === undefined ? readOwnedRamAsync : makeStandInVmRam(readRam),
+    readResidentRam: readRam === undefined ? readResidentRamAsync : makeStandInVmRam(readRam),
     readUnsharedRamMib: boundaries.readUnsharedRamMib ?? readUnsharedRamMib,
     checkGuestMerge: boundaries.checkGuestMerge ?? checkGuestMemoryMergeable,
     probeUffdDevice: boundaries.probeUffdDevice ?? (() => probeUffdDevice()),
@@ -45277,6 +45447,13 @@ function resolveImpBoundaries(boundaries) {
     ...boundaries.now !== undefined && { now: boundaries.now }
   };
 }
+function makeStandInVmRam(readRam) {
+  return (pid, apiSocket) => {
+    const ramMib = readRam(pid, apiSocket);
+    const reading = ramMib === null ? null : { ramMib, hugetlbMib: 0 };
+    return Promise.resolve(reading);
+  };
+}
 
 // packages/daemon/src/imp-ops/moves/move-receiver.ts
 import { existsSync as existsSync16, rmSync as rmSync24 } from "fs";
@@ -45355,6 +45532,7 @@ var FilteredGrantSchema2 = z79.object({ secret: z79.string(), filter: GrantFilte
 var ImpSchema2 = z79.object({
   id: z79.uuid(),
   name: z79.string(),
+  clonedDigest: z79.string().optional(),
   vcpus: z79.int().positive(),
   memoryMib: z79.int().positive(),
   maxMemoryMib: z79.int().positive().optional(),
@@ -45605,7 +45783,7 @@ function readReceipt(receipt, secret) {
 import { mkdirSync as mkdirSync19, rmSync as rmSync23 } from "fs";
 import { open as open7 } from "fs/promises";
 import { join as join24 } from "path";
-import invariant4 from "tiny-invariant";
+import invariant5 from "tiny-invariant";
 
 // packages/daemon/src/imp-ops/moves/build-received-digest.ts
 import { createHash as createHash5 } from "crypto";
@@ -46266,6 +46444,7 @@ async function readMoveStream(deps, options) {
         id: header.imp.id,
         name: header.imp.name,
         image: image.name,
+        ...header.imp.clonedDigest !== undefined && { imageDigest: header.imp.clonedDigest },
         vcpus: header.imp.vcpus,
         memoryMib: header.imp.memoryMib,
         maxMemoryMib: header.imp.maxMemoryMib,
@@ -46395,7 +46574,7 @@ async function requireImage(deps, options) {
       { kind: "image-rootfs", sha256: rootfs.sha256, bytes: rootfs.bytes },
       { kind: "image-config", sha256: config.sha256, bytes: config.bytes }
     ];
-    invariant4(rootfs.contentSha256 !== null && config.contentSha256 !== null);
+    invariant5(rootfs.contentSha256 !== null && config.contentSha256 !== null);
     const digest = buildReceivedDigest(rootfs.contentSha256, config.contentSha256);
     const known = await readImageInUse(deps.db, [digest], deps.now());
     if (known !== undefined) {
@@ -46704,7 +46883,7 @@ function readSettled2(row, imp) {
 }
 
 // packages/daemon/src/imp-ops/moves/move-sender.ts
-import invariant5 from "tiny-invariant";
+import invariant6 from "tiny-invariant";
 import { match as match10 } from "ts-pattern";
 
 // packages/daemon/src/platform/db/move-send-steps.ts
@@ -47000,6 +47179,7 @@ async function readHeader(deps, options) {
     imp: {
       id: imp.id,
       name: imp.name,
+      clonedDigest: imp.imageDigest,
       vcpus: imp.vcpus,
       memoryMib: imp.memoryMib,
       maxMemoryMib: imp.maxMemoryMib,
@@ -47275,7 +47455,7 @@ function createMoveSender(deps) {
         log.info("a send cut short by a restart was undone");
       }
     }).with("commit", async () => {
-      invariant5(row !== undefined && row.peer_url !== null && row.ticket !== null);
+      invariant6(row !== undefined && row.peer_url !== null && row.ticket !== null);
       const moved = imp.moveState === "moved" ? imp : await updateImpMove(deps.db, imp.id, "moved");
       await runCommitAfterRestart(moved, row.peer_url, row.ticket);
     }).with("none", () => {}).exhaustive();
@@ -52935,7 +53115,7 @@ function wireTailnetNames(options) {
     api: createServicesApi({ readCredential: () => readOAuthCredential(names.oauthFile) }),
     serve: createServiceServe((argv) => runChecked(argv, {}, options.runCommand ?? runCommand)),
     findPort: (slot) => deriveSlotAddress(slot, options.config).tailnetPort,
-    isImpPresent: createPresenceCheck(options.imps, options.db),
+    isImpPresent: makePresenceCheck(options.imps, options.db),
     readSuffix: async () => {
       const status = await options.readTailscale();
       const suffix = status.dnsName?.split(".").slice(1).join(".") ?? "";
@@ -52943,20 +53123,17 @@ function wireTailnetNames(options) {
     }
   });
 }
-function createPresenceCheck(imps, db) {
+function makePresenceCheck(imps, db) {
   return async (name) => {
-    try {
-      return await imps.lockImp(name, () => Promise.resolve(true));
-    } catch (error) {
-      if (isImpdError(error, "NOT_FOUND")) {
-        return false;
-      }
-      if (isImpdError(error, "MOVING")) {
-        const imp = await readImpByName(db, name);
-        return imp !== undefined && imp.moveState !== "moved";
-      }
-      throw error;
+    const imp = await readImpByName(db, name);
+    if (imp === undefined) {
+      return false;
+    }
+    if (imp.moveState !== null) {
+      return imp.moveState !== "moved";
     }
+    const result = await imps.tryLockImpId(imp.id, (locked) => Promise.resolve(locked !== undefined));
+    return !result.ran || result.value;
   };
 }
 
@@ -58833,7 +59010,7 @@ async function startTestImpd(stack, options = {}) {
       clock.offsetMs += durationMs;
     },
     setClock: (nowMs) => {
-      invariant6(options.frozenClockMs !== undefined, "setClock needs a frozen clock");
+      invariant7(options.frozenClockMs !== undefined, "setClock needs a frozen clock");
       clock.frozenAt = nowMs;
       clock.offsetMs = 0;
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@impz/testing",
-  "version": "6.1.0",
+  "version": "6.1.1",
   "description": "A real impd on stand-ins, for Bun tests of code that drives impd through @impz/client",
   "license": "MIT",
   "repository": {
@@ -43,7 +43,7 @@
     "ts-pattern": "^5.9.2",
     "xstate": "^5.33.3",
     "zod": "^4.6.7",
-    "@impz/client": "6.1.0"
+    "@impz/client": "6.1.1"
   },
   "engines": {
     "bun": ">=1.4.3"