@impz/testing 6.6.1 → 6.7.1

package/dist/index.js

@@ -18923,12 +18923,12 @@ var BACKUP_TREE = {
   buildImageDir: (digest) => join("images", toDigestHex(digest))
 };
 
-// packages/daemon/testing/start-test-impd.ts
+// packages/daemon/src/test-utils/start-test-impd.ts
 import { copyFileSync as copyFileSync5, mkdirSync as mkdirSync31, mkdtempSync, writeFileSync as writeFileSync16 } from "fs";
 import { rm as rm2 } from "fs/promises";
 import { tmpdir } from "os";
 
-// packages/test-utils/src/claim-free-ports.ts
+// packages/shared/src/test-utils/claim-free-ports.ts
 import { onTestFinished } from "bun:test";
 import { randomInt } from "crypto";
 import { existsSync, readFileSync } from "fs";
@@ -18991,449 +18991,13 @@ function readBusyPorts() {
   return busy;
 }
 
-// packages/daemon/testing/start-test-impd.ts
+// packages/daemon/src/test-utils/start-test-impd.ts
 import { createORPCClient as createORPCClient2 } from "@orpc/client";
 import { RPCLink } from "@orpc/client/fetch";
 import invariant7 from "tiny-invariant";
 
 // packages/daemon/src/config.ts
 import { join as join4 } from "path";
-import * as z53 from "zod";
-// packages/shared/src/format-bytes.ts
-var UNITS = ["B", "KiB", "MiB", "GiB", "TiB"];
-function formatBytes(bytes) {
-  let value = bytes;
-  let unit = 0;
-  while (value >= 1024 && unit < UNITS.length - 1) {
-    value /= 1024;
-    unit += 1;
-  }
-  const digits = unit === 0 || value >= 100 ? 0 : 1;
-  return `${value.toFixed(digits)} ${UNITS[unit] ?? "B"}`;
-}
-// packages/shared/src/merge-bytes.ts
-function mergeBytes(chunks) {
-  const merged = new Uint8Array(chunks.reduce((sum, chunk) => sum + chunk.byteLength, 0));
-  let offset = 0;
-  for (const chunk of chunks) {
-    merged.set(chunk, offset);
-    offset += chunk.byteLength;
-  }
-  return merged;
-}
-// packages/shared/src/to-plain-octets.ts
-var DOTTED_ENTRY = /^(?<octets>\d{1,3}(?:\.\d{1,3}){3})(?<prefix>\/\d{1,2})?$/u;
-function toPlainOctets(entry) {
-  const groups = DOTTED_ENTRY.exec(entry)?.groups;
-  if (groups === undefined) {
-    return entry;
-  }
-  const octets = (groups["octets"] ?? "").split(".").map((octet) => String(Number(octet)));
-  return `${octets.join(".")}${groups["prefix"] ?? ""}`;
-}
-// packages/daemon/src/host-net/net/addressing.ts
-import { IPv4 as IPv43 } from "ipaddr.js";
-
-// packages/daemon/src/host-net/net/addressing6.ts
-import { IPv6 as IPv62 } from "ipaddr.js";
-
-// packages/daemon/src/host-net/net/parse-address.ts
-import { IPv4, IPv6 } from "ipaddr.js";
-function parseAddress(text) {
-  if (IPv4.isValidFourPartDecimal(text)) {
-    return IPv4.parse(text);
-  }
-  if (text.includes("%")) {
-    return null;
-  }
-  const hex = toHexGroups(text);
-  return hex !== null && IPv6.isValid(hex) ? IPv6.parse(hex) : null;
-}
-function toHexGroups(text) {
-  const split = text.lastIndexOf(":");
-  const tail = text.slice(split + 1);
-  if (!tail.includes(".")) {
-    return text;
-  }
-  if (!IPv4.isValidFourPartDecimal(tail)) {
-    return null;
-  }
-  const [first = 0, second = 0, third = 0, fourth = 0] = IPv4.parse(tail).octets;
-  return `${text.slice(0, split + 1)}${toGroup(first, second)}:${toGroup(third, fourth)}`;
-}
-function toGroup(high, low) {
-  return (high * 256 + low).toString(16);
-}
-
-// packages/daemon/src/host-net/net/parse-cidr.ts
-import { IPv4 as IPv42 } from "ipaddr.js";
-function parseCidr(text) {
-  const [addressText = "", prefix, ...rest] = text.split("/");
-  const address = parseAddress(addressText);
-  if (address === null || rest.length > 0 || prefix !== undefined && !/^\d{1,3}$/v.test(prefix)) {
-    return null;
-  }
-  const maxBits = address instanceof IPv42 ? 32 : 128;
-  const bits = prefix === undefined ? maxBits : Number(prefix);
-  return bits > maxBits ? null : { address, bits };
-}
-
-// packages/daemon/src/host-net/net/addressing6.ts
-var GROUPS = 8;
-var GROUP_BITS = 16n;
-var PREFIX_LENGTH = 64;
-var GATEWAY_IP6 = "fe80::1";
-function parseIpv6(text) {
-  const address = parseAddress(text);
-  return address instanceof IPv62 ? toBigint(address) : null;
-}
-function formatIpv6(address) {
-  const groups = Array.from({ length: GROUPS }, (_, index) => Number(address >> GROUP_BITS * BigInt(GROUPS - 1 - index) & 0xffffn));
-  return new IPv62(groups).toRFC5952String();
-}
-function formatCidr6(text) {
-  const parsed = parseCidr(text);
-  if (parsed === null || !(parsed.address instanceof IPv62)) {
-    return null;
-  }
-  const hostBits = BigInt(128 - parsed.bits);
-  const network = toBigint(parsed.address) >> hostBits << hostBits;
-  return `${formatIpv6(network)}/${String(parsed.bits)}`;
-}
-function parsePrefix64(cidr) {
-  const parsed = parseCidr(cidr);
-  const network = parsed?.address instanceof IPv62 ? toBigint(parsed.address) : null;
-  if (network === null || !cidr.endsWith(`/${String(PREFIX_LENGTH)}`) || network % 2n ** 64n !== 0n) {
-    return null;
-  }
-  return { network, text: `${formatIpv6(network)}/${String(PREFIX_LENGTH)}` };
-}
-function buildUlaPrefix(random) {
-  if (random.length < 5) {
-    throw new Error("a ULA global ID needs 5 random bytes");
-  }
-  const globalId = [...random.subarray(0, 5)].reduce((acc, byte) => (acc << 8n) + BigInt(byte), 0n);
-  const network = (0xfdn << 40n) + globalId << 80n;
-  return { network, text: `${formatIpv6(network)}/${String(PREFIX_LENGTH)}` };
-}
-function findMappedIpv4(address) {
-  const parsed = parseAddress(address);
-  return parsed instanceof IPv62 && parsed.isIPv4MappedAddress() ? parsed.toIPv4Address().toString() : null;
-}
-function deriveGuestIp6(prefix, guestIpv4) {
-  return formatIpv6(prefix.network + BigInt(guestIpv4));
-}
-function toBigint(address) {
-  return address.parts.reduce((acc, group) => (acc << GROUP_BITS) + BigInt(group), 0n);
-}
-
-// packages/daemon/src/host-net/net/addressing.ts
-var SLOT_SIZE = 4;
-var SLOT_PREFIX_LENGTH = 30;
-function parseSubnet(cidr) {
-  const parsed = cidr.includes("/") ? parseCidr(cidr) : null;
-  if (parsed === null || !(parsed.address instanceof IPv43)) {
-    throw new Error(`subnet is not an IPv4 CIDR: ${cidr}`);
-  }
-  if (parsed.bits < 8 || parsed.bits > SLOT_PREFIX_LENGTH) {
-    throw new Error(`subnet prefix must be between /8 and /30: ${cidr}`);
-  }
-  const network = toNumber(parsed.address);
-  if (network % 2 ** (32 - parsed.bits) !== 0) {
-    throw new Error(`subnet has host bits set: ${cidr}`);
-  }
-  return { network, prefixLength: parsed.bits };
-}
-var TAILNET_NETWORK = 100 * 2 ** 24 + 64 * 2 ** 16;
-var TAILNET_SIZE = 2 ** 22;
-function isTailnetOverlap(subnet) {
-  const start = subnet.network;
-  const end = start + 2 ** (32 - subnet.prefixLength);
-  return start < TAILNET_NETWORK + TAILNET_SIZE && TAILNET_NETWORK < end;
-}
-function countSlots(subnet) {
-  return 2 ** (32 - subnet.prefixLength) / SLOT_SIZE;
-}
-function deriveSlotAddress(slot, plan) {
-  if (!Number.isInteger(slot) || slot < 0 || slot >= countSlots(plan.subnet)) {
-    throw new RangeError(`slot ${String(slot)} is outside the subnet`);
-  }
-  const base = plan.subnet.network + slot * SLOT_SIZE;
-  const guest = base + 2;
-  return {
-    slot,
-    tap: `imp${String(slot)}`,
-    hostIp: formatIpv4(base + 1),
-    guestIp: formatIpv4(guest),
-    prefixLength: SLOT_PREFIX_LENGTH,
-    netmask: "255.255.255.252",
-    guestMac: ["06", "00", ...splitOctets(guest).map((octet) => toHexByte(octet))].join(":"),
-    hostMac: ["06", "01", ...splitOctets(base + 1).map((octet) => toHexByte(octet))].join(":"),
-    guestIp6: plan.prefix6 === undefined || plan.prefix6 === null ? null : deriveGuestIp6(plan.prefix6, guest),
-    tailnetPort: plan.portBase + slot
-  };
-}
-function parseIpv4(text, allowMapped = false) {
-  const address = parseAddress(text);
-  if (address instanceof IPv43) {
-    return toNumber(address);
-  }
-  return allowMapped && address?.isIPv4MappedAddress() === true ? toNumber(address.toIPv4Address()) : null;
-}
-function findPeerSlot(peer, local, subnet) {
-  const peerIp = parseIpv4(peer, true);
-  const localIp = parseIpv4(local, true);
-  if (peerIp === null || localIp === null) {
-    return null;
-  }
-  const offset = peerIp - subnet.network;
-  if (offset < 0 || offset >= 2 ** (32 - subnet.prefixLength) || offset % SLOT_SIZE !== 2) {
-    return null;
-  }
-  return localIp === peerIp - 1 ? (offset - 2) / SLOT_SIZE : null;
-}
-function findGuestSlot(address, subnet) {
-  const ip = parseIpv4(address, true);
-  const offset = ip === null ? -1 : ip - subnet.network;
-  if (offset < 0 || offset >= 2 ** (32 - subnet.prefixLength) || offset % SLOT_SIZE !== 2) {
-    return null;
-  }
-  return (offset - 2) / SLOT_SIZE;
-}
-function formatSubnet(subnet) {
-  return `${formatIpv4(subnet.network)}/${String(subnet.prefixLength)}`;
-}
-function formatCidr4(text) {
-  const parsed = parseCidr(toPlainOctets(text));
-  if (parsed === null || !(parsed.address instanceof IPv43)) {
-    return null;
-  }
-  const ip = toNumber(parsed.address);
-  return formatSubnet({ network: ip - ip % 2 ** (32 - parsed.bits), prefixLength: parsed.bits });
-}
-function toNumber(address) {
-  return address.octets.reduce((acc, octet) => acc * 256 + octet, 0);
-}
-function formatIpv4(address) {
-  return splitOctets(address).join(".");
-}
-function splitOctets(address) {
-  return [
-    Math.floor(address / 2 ** 24) % 256,
-    Math.floor(address / 2 ** 16) % 256,
-    Math.floor(address / 2 ** 8) % 256,
-    address % 256
-  ];
-}
-function toHexByte(octet) {
-  return octet.toString(16).padStart(2, "0");
-}
-
-// packages/daemon/src/host-net/net/ipv6-plan.ts
-import { randomBytes } from "crypto";
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync } from "fs";
-import { dirname, join as join2 } from "path";
-
-// packages/daemon/src/platform/process/get-error-message.ts
-function getErrorMessage(error) {
-  return error instanceof Error ? error.message : String(error);
-}
-
-// packages/daemon/src/platform/process/get-impd-logger.ts
-import { getLogger } from "@logtape/logtape";
-function getImpdLogger(area) {
-  return getLogger(["impd", area]);
-}
-
-// packages/daemon/src/platform/process/run-command.ts
-async function runCommand(argv, options = {}) {
-  const child = Bun.spawn([...argv], {
-    stdin: "ignore",
-    stdout: "pipe",
-    stderr: "pipe",
-    env: options.env === undefined ? process.env : { ...options.env },
-    ...options.signal !== undefined && { signal: options.signal }
-  });
-  const [stdout, stderr, exitCode] = await Promise.all([
-    new Response(child.stdout).text(),
-    new Response(child.stderr).text(),
-    child.exited
-  ]);
-  return { exitCode, stdout, stderr };
-}
-async function runChecked(argv, options = {}, run = runCommand) {
-  const result = await run(argv, options);
-  if (result.exitCode !== 0) {
-    throw buildExitError(argv, result);
-  }
-  return result.stdout;
-}
-function buildExitError(argv, result) {
-  const output = result.stderr.trim() || (result.stdout ?? "").trim();
-  return new Error(`${argv.join(" ")} exited ${String(result.exitCode)}: ${output}`);
-}
-
-// packages/daemon/src/host-net/net/nat66-ruleset.ts
-var NAT66_TABLE = "ip6 imp_nat66";
-function buildNat66Ruleset(prefix, uplink) {
-  return [
-    `table ${NAT66_TABLE} {}`,
-    `delete table ${NAT66_TABLE}`,
-    `table ${NAT66_TABLE} {`,
-    "  chain postrouting {",
-    "    type nat hook postrouting priority srcnat; policy accept;",
-    `    oifname "${uplink}" ip6 saddr ${prefix} masquerade`,
-    "  }",
-    "}",
-    ""
-  ].join(`
-`);
-}
-function buildNat66Removal() {
-  return `table ${NAT66_TABLE} {}
-delete table ${NAT66_TABLE}
-`;
-}
-
-// packages/daemon/src/host-net/net/ipv6-plan.ts
-function parseIpv6Setting(text) {
-  if (text === "auto" || text === "off") {
-    return { kind: text };
-  }
-  const prefix = parsePrefix64(text);
-  if (prefix === null) {
-    throw new Error(`IMP_SUBNET6 must be auto, off or an IPv6 /64, got ${text}`);
-  }
-  return { kind: "routed", prefix };
-}
-async function resolveIpv6Plan(setting, deps) {
-  const stopIpv6 = async (reason) => {
-    await removeNat66(deps);
-    getImpdLogger("ipv6").info("off ({reason})", { reason });
-    return null;
-  };
-  if (setting.kind === "off") {
-    return stopIpv6("IMP_SUBNET6=off");
-  }
-  const uplink = await deps.readDefaultRoute();
-  if (setting.kind === "auto" && uplink === null) {
-    return stopIpv6("IMP_SUBNET6=auto, and the container has no IPv6 default route");
-  }
-  const missing = await deps.checkHostRules();
-  if (missing !== null) {
-    return stopIpv6(`the host's IPv6 rules are not in place: ${missing}`);
-  }
-  if (setting.kind === "routed") {
-    await removeNat66(deps);
-    getImpdLogger("ipv6").info("{text}, routed{route}", {
-      text: setting.prefix.text,
-      route: uplink === null ? "; the container has no IPv6 default route" : ` via ${uplink}`
-    });
-    return { prefix: setting.prefix, nat66: false, uplink };
-  }
-  const prefix = deps.readUlaPrefix();
-  try {
-    await deps.runNft(buildNat66Ruleset(prefix.text, uplink ?? ""));
-  } catch (error) {
-    return stopIpv6(`NAT66: ${getErrorMessage(error)}`);
-  }
-  getImpdLogger("ipv6").info("{text}, NAT66 out of {uplink}", {
-    text: prefix.text,
-    uplink: uplink ?? ""
-  });
-  return { prefix, nat66: true, uplink };
-}
-async function removeNat66(deps) {
-  try {
-    await deps.runNft(buildNat66Removal());
-  } catch {}
-}
-var HOST_RULES6 = [
-  ["filter", "-A INPUT -i imp+ -j DROP"],
-  ["filter", "-A FORWARD -i imp+ -o imp+ -j DROP"],
-  ["filter", "-A FORWARD -o imp+ -j DROP"],
-  ["filter", "-A FORWARD -i imp+ -j DROP"],
-  ["raw", "-A PREROUTING -i imp+ -m rpfilter --invert -j DROP"]
-];
-var HOST_SYSCTLS6 = [
-  ["default/accept_ra", "0"],
-  ["default/accept_redirects", "0"],
-  ["all/forwarding", "1"]
-];
-async function checkHostRules6(procSys = "/proc/sys/net/ipv6/conf", run = runCommand) {
-  for (const table of ["filter", "raw"]) {
-    const result = await run(["ip6tables", "-w", "-t", table, "-S"]);
-    const rules = new Set(result.stdout.split(`
-`).map((line) => line.trim()));
-    const missing = HOST_RULES6.find(([inTable, rule]) => inTable === table && !rules.has(rule));
-    if (result.exitCode !== 0) {
-      return `ip6tables -t ${table}: ${result.stderr.trim()}`;
-    }
-    if (missing !== undefined) {
-      return `no ip6tables -t ${table} ${missing[1]}`;
-    }
-  }
-  for (const [key, wanted] of HOST_SYSCTLS6) {
-    const value = readSysctl(join2(procSys, key));
-    if (value !== wanted) {
-      return `net.ipv6.conf.${key.replace("/", ".")} is ${value ?? "missing"}, not ${wanted}`;
-    }
-  }
-  return null;
-}
-function readSysctl(path) {
-  try {
-    return readFileSync2(path, "utf8").trim();
-  } catch {
-    return null;
-  }
-}
-function readOrCreateUlaPrefix(path) {
-  if (existsSync2(path)) {
-    const prefix = parsePrefix64(readFileSync2(path, "utf8").trim());
-    if (prefix !== null) {
-      return prefix;
-    }
-  }
-  const prefix = buildUlaPrefix(randomBytes(5));
-  mkdirSync2(dirname(path), { recursive: true });
-  writeFileSync(path, `${prefix.text}
-`);
-  return prefix;
-}
-
-// packages/daemon/src/host-net/net/range-matcher.ts
-import { IPv4 as IPv44 } from "ipaddr.js";
-function buildRangeMatcher(ranges) {
-  const ranges4 = [];
-  const ranges6 = [];
-  for (const range of ranges) {
-    const cidr = parseCidr(range);
-    if (cidr === null) {
-      throw new Error(`not an address range: ${range}`);
-    }
-    if (cidr.address instanceof IPv44) {
-      ranges4.push([cidr.address, cidr.bits]);
-    } else {
-      ranges6.push([cidr.address, cidr.bits]);
-    }
-  }
-  const isIn4 = (ip) => ranges4.some(([network, bits]) => ip.match(network, bits));
-  const isIn6 = (ip) => ranges6.some(([network, bits]) => ip.match(network, bits));
-  return (address) => {
-    const ip = parseAddress(address);
-    if (ip === null) {
-      return false;
-    }
-    if (ip instanceof IPv44) {
-      return isIn4(ip);
-    }
-    return isIn6(ip) || ip.isIPv4MappedAddress() && isIn4(ip.toIPv4Address());
-  };
-}
-
-// packages/daemon/src/identity/auth/parse-tailnet-rules.ts
-import * as z48 from "zod";
 // packages/api/src/schemas/lease-schema.ts
 import * as z2 from "zod";
 
@@ -21266,6 +20830,443 @@ function hasScope(granted, needed) {
   const neededRank = ScopeSchema.options.indexOf(needed);
   return grantedRank !== -1 && neededRank !== -1 && grantedRank >= neededRank;
 }
+// packages/daemon/src/config.ts
+import * as z53 from "zod";
+// packages/shared/src/format-bytes.ts
+var UNITS = ["B", "KiB", "MiB", "GiB", "TiB"];
+function formatBytes(bytes) {
+  let value = bytes;
+  let unit = 0;
+  while (value >= 1024 && unit < UNITS.length - 1) {
+    value /= 1024;
+    unit += 1;
+  }
+  const digits = unit === 0 || value >= 100 ? 0 : 1;
+  return `${value.toFixed(digits)} ${UNITS[unit] ?? "B"}`;
+}
+// packages/shared/src/get-error-message.ts
+function getErrorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+// packages/shared/src/merge-bytes.ts
+function mergeBytes(chunks) {
+  const merged = new Uint8Array(chunks.reduce((sum, chunk) => sum + chunk.byteLength, 0));
+  let offset = 0;
+  for (const chunk of chunks) {
+    merged.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return merged;
+}
+// packages/shared/src/to-plain-octets.ts
+var DOTTED_ENTRY = /^(?<octets>\d{1,3}(?:\.\d{1,3}){3})(?<prefix>\/\d{1,2})?$/u;
+function toPlainOctets(entry) {
+  const groups = DOTTED_ENTRY.exec(entry)?.groups;
+  if (groups === undefined) {
+    return entry;
+  }
+  const octets = (groups["octets"] ?? "").split(".").map((octet) => String(Number(octet)));
+  return `${octets.join(".")}${groups["prefix"] ?? ""}`;
+}
+// packages/daemon/src/host-net/net/addressing.ts
+import { IPv4 as IPv43 } from "ipaddr.js";
+
+// packages/daemon/src/host-net/net/addressing6.ts
+import { IPv6 as IPv62 } from "ipaddr.js";
+
+// packages/daemon/src/host-net/net/parse-address.ts
+import { IPv4, IPv6 } from "ipaddr.js";
+function parseAddress(text) {
+  if (IPv4.isValidFourPartDecimal(text)) {
+    return IPv4.parse(text);
+  }
+  if (text.includes("%")) {
+    return null;
+  }
+  const hex = toHexGroups(text);
+  return hex !== null && IPv6.isValid(hex) ? IPv6.parse(hex) : null;
+}
+function toHexGroups(text) {
+  const split = text.lastIndexOf(":");
+  const tail = text.slice(split + 1);
+  if (!tail.includes(".")) {
+    return text;
+  }
+  if (!IPv4.isValidFourPartDecimal(tail)) {
+    return null;
+  }
+  const [first = 0, second = 0, third = 0, fourth = 0] = IPv4.parse(tail).octets;
+  return `${text.slice(0, split + 1)}${toGroup(first, second)}:${toGroup(third, fourth)}`;
+}
+function toGroup(high, low) {
+  return (high * 256 + low).toString(16);
+}
+
+// packages/daemon/src/host-net/net/parse-cidr.ts
+import { IPv4 as IPv42 } from "ipaddr.js";
+function parseCidr(text) {
+  const [addressText = "", prefix, ...rest] = text.split("/");
+  const address = parseAddress(addressText);
+  if (address === null || rest.length > 0 || prefix !== undefined && !/^\d{1,3}$/v.test(prefix)) {
+    return null;
+  }
+  const maxBits = address instanceof IPv42 ? 32 : 128;
+  const bits = prefix === undefined ? maxBits : Number(prefix);
+  return bits > maxBits ? null : { address, bits };
+}
+
+// packages/daemon/src/host-net/net/addressing6.ts
+var GROUPS = 8;
+var GROUP_BITS = 16n;
+var PREFIX_LENGTH = 64;
+var GATEWAY_IP6 = "fe80::1";
+function parseIpv6(text) {
+  const address = parseAddress(text);
+  return address instanceof IPv62 ? toBigint(address) : null;
+}
+function formatIpv6(address) {
+  const groups = Array.from({ length: GROUPS }, (_, index) => Number(address >> GROUP_BITS * BigInt(GROUPS - 1 - index) & 0xffffn));
+  return new IPv62(groups).toRFC5952String();
+}
+function formatCidr6(text) {
+  const parsed = parseCidr(text);
+  if (parsed === null || !(parsed.address instanceof IPv62)) {
+    return null;
+  }
+  const hostBits = BigInt(128 - parsed.bits);
+  const network = toBigint(parsed.address) >> hostBits << hostBits;
+  return `${formatIpv6(network)}/${String(parsed.bits)}`;
+}
+function parsePrefix64(cidr) {
+  const parsed = parseCidr(cidr);
+  const network = parsed?.address instanceof IPv62 ? toBigint(parsed.address) : null;
+  if (network === null || !cidr.endsWith(`/${String(PREFIX_LENGTH)}`) || network % 2n ** 64n !== 0n) {
+    return null;
+  }
+  return { network, text: `${formatIpv6(network)}/${String(PREFIX_LENGTH)}` };
+}
+function buildUlaPrefix(random) {
+  if (random.length < 5) {
+    throw new Error("a ULA global ID needs 5 random bytes");
+  }
+  const globalId = [...random.subarray(0, 5)].reduce((acc, byte) => (acc << 8n) + BigInt(byte), 0n);
+  const network = (0xfdn << 40n) + globalId << 80n;
+  return { network, text: `${formatIpv6(network)}/${String(PREFIX_LENGTH)}` };
+}
+function findMappedIpv4(address) {
+  const parsed = parseAddress(address);
+  return parsed instanceof IPv62 && parsed.isIPv4MappedAddress() ? parsed.toIPv4Address().toString() : null;
+}
+function deriveGuestIp6(prefix, guestIpv4) {
+  return formatIpv6(prefix.network + BigInt(guestIpv4));
+}
+function toBigint(address) {
+  return address.parts.reduce((acc, group) => (acc << GROUP_BITS) + BigInt(group), 0n);
+}
+
+// packages/daemon/src/host-net/net/addressing.ts
+var SLOT_SIZE = 4;
+var SLOT_PREFIX_LENGTH = 30;
+function parseSubnet(cidr) {
+  const parsed = cidr.includes("/") ? parseCidr(cidr) : null;
+  if (parsed === null || !(parsed.address instanceof IPv43)) {
+    throw new Error(`subnet is not an IPv4 CIDR: ${cidr}`);
+  }
+  if (parsed.bits < 8 || parsed.bits > SLOT_PREFIX_LENGTH) {
+    throw new Error(`subnet prefix must be between /8 and /30: ${cidr}`);
+  }
+  const network = toNumber(parsed.address);
+  if (network % 2 ** (32 - parsed.bits) !== 0) {
+    throw new Error(`subnet has host bits set: ${cidr}`);
+  }
+  return { network, prefixLength: parsed.bits };
+}
+var TAILNET_NETWORK = 100 * 2 ** 24 + 64 * 2 ** 16;
+var TAILNET_SIZE = 2 ** 22;
+function isTailnetOverlap(subnet) {
+  const start = subnet.network;
+  const end = start + 2 ** (32 - subnet.prefixLength);
+  return start < TAILNET_NETWORK + TAILNET_SIZE && TAILNET_NETWORK < end;
+}
+function countSlots(subnet) {
+  return 2 ** (32 - subnet.prefixLength) / SLOT_SIZE;
+}
+function deriveSlotAddress(slot, plan) {
+  if (!Number.isInteger(slot) || slot < 0 || slot >= countSlots(plan.subnet)) {
+    throw new RangeError(`slot ${String(slot)} is outside the subnet`);
+  }
+  const base = plan.subnet.network + slot * SLOT_SIZE;
+  const guest = base + 2;
+  return {
+    slot,
+    tap: `imp${String(slot)}`,
+    hostIp: formatIpv4(base + 1),
+    guestIp: formatIpv4(guest),
+    prefixLength: SLOT_PREFIX_LENGTH,
+    netmask: "255.255.255.252",
+    guestMac: ["06", "00", ...splitOctets(guest).map((octet) => toHexByte(octet))].join(":"),
+    hostMac: ["06", "01", ...splitOctets(base + 1).map((octet) => toHexByte(octet))].join(":"),
+    guestIp6: plan.prefix6 === undefined || plan.prefix6 === null ? null : deriveGuestIp6(plan.prefix6, guest),
+    tailnetPort: plan.portBase + slot
+  };
+}
+function parseIpv4(text, allowMapped = false) {
+  const address = parseAddress(text);
+  if (address instanceof IPv43) {
+    return toNumber(address);
+  }
+  return allowMapped && address?.isIPv4MappedAddress() === true ? toNumber(address.toIPv4Address()) : null;
+}
+function findPeerSlot(peer, local, subnet) {
+  const peerIp = parseIpv4(peer, true);
+  const localIp = parseIpv4(local, true);
+  if (peerIp === null || localIp === null) {
+    return null;
+  }
+  const offset = peerIp - subnet.network;
+  if (offset < 0 || offset >= 2 ** (32 - subnet.prefixLength) || offset % SLOT_SIZE !== 2) {
+    return null;
+  }
+  return localIp === peerIp - 1 ? (offset - 2) / SLOT_SIZE : null;
+}
+function findGuestSlot(address, subnet) {
+  const ip = parseIpv4(address, true);
+  const offset = ip === null ? -1 : ip - subnet.network;
+  if (offset < 0 || offset >= 2 ** (32 - subnet.prefixLength) || offset % SLOT_SIZE !== 2) {
+    return null;
+  }
+  return (offset - 2) / SLOT_SIZE;
+}
+function formatSubnet(subnet) {
+  return `${formatIpv4(subnet.network)}/${String(subnet.prefixLength)}`;
+}
+function formatCidr4(text) {
+  const parsed = parseCidr(toPlainOctets(text));
+  if (parsed === null || !(parsed.address instanceof IPv43)) {
+    return null;
+  }
+  const ip = toNumber(parsed.address);
+  return formatSubnet({ network: ip - ip % 2 ** (32 - parsed.bits), prefixLength: parsed.bits });
+}
+function toNumber(address) {
+  return address.octets.reduce((acc, octet) => acc * 256 + octet, 0);
+}
+function formatIpv4(address) {
+  return splitOctets(address).join(".");
+}
+function splitOctets(address) {
+  return [
+    Math.floor(address / 2 ** 24) % 256,
+    Math.floor(address / 2 ** 16) % 256,
+    Math.floor(address / 2 ** 8) % 256,
+    address % 256
+  ];
+}
+function toHexByte(octet) {
+  return octet.toString(16).padStart(2, "0");
+}
+
+// packages/daemon/src/host-net/net/ipv6-plan.ts
+import { randomBytes } from "crypto";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { dirname, join as join2 } from "path";
+
+// packages/daemon/src/platform/process/get-impd-logger.ts
+import { getLogger } from "@logtape/logtape";
+function getImpdLogger(area) {
+  return getLogger(["impd", area]);
+}
+
+// packages/daemon/src/platform/process/run-command.ts
+async function runCommand(argv, options = {}) {
+  const child = Bun.spawn([...argv], {
+    stdin: "ignore",
+    stdout: "pipe",
+    stderr: "pipe",
+    env: options.env === undefined ? process.env : { ...options.env },
+    ...options.signal !== undefined && { signal: options.signal }
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited
+  ]);
+  return { exitCode, stdout, stderr };
+}
+async function runChecked(argv, options = {}, run = runCommand) {
+  const result = await run(argv, options);
+  if (result.exitCode !== 0) {
+    throw buildExitError(argv, result);
+  }
+  return result.stdout;
+}
+function buildExitError(argv, result) {
+  const output = result.stderr.trim() || (result.stdout ?? "").trim();
+  return new Error(`${argv.join(" ")} exited ${String(result.exitCode)}: ${output}`);
+}
+
+// packages/daemon/src/host-net/net/nat66-ruleset.ts
+var NAT66_TABLE = "ip6 imp_nat66";
+function buildNat66Ruleset(prefix, uplink) {
+  return [
+    `table ${NAT66_TABLE} {}`,
+    `delete table ${NAT66_TABLE}`,
+    `table ${NAT66_TABLE} {`,
+    "  chain postrouting {",
+    "    type nat hook postrouting priority srcnat; policy accept;",
+    `    oifname "${uplink}" ip6 saddr ${prefix} masquerade`,
+    "  }",
+    "}",
+    ""
+  ].join(`
+`);
+}
+function buildNat66Removal() {
+  return `table ${NAT66_TABLE} {}
+delete table ${NAT66_TABLE}
+`;
+}
+
+// packages/daemon/src/host-net/net/ipv6-plan.ts
+function parseIpv6Setting(text) {
+  if (text === "auto" || text === "off") {
+    return { kind: text };
+  }
+  const prefix = parsePrefix64(text);
+  if (prefix === null) {
+    throw new Error(`IMP_SUBNET6 must be auto, off or an IPv6 /64, got ${text}`);
+  }
+  return { kind: "routed", prefix };
+}
+async function resolveIpv6Plan(setting, deps) {
+  const stopIpv6 = async (reason) => {
+    await removeNat66(deps);
+    getImpdLogger("ipv6").info("off ({reason})", { reason });
+    return null;
+  };
+  if (setting.kind === "off") {
+    return stopIpv6("IMP_SUBNET6=off");
+  }
+  const uplink = await deps.readDefaultRoute();
+  if (setting.kind === "auto" && uplink === null) {
+    return stopIpv6("IMP_SUBNET6=auto, and the container has no IPv6 default route");
+  }
+  const missing = await deps.checkHostRules();
+  if (missing !== null) {
+    return stopIpv6(`the host's IPv6 rules are not in place: ${missing}`);
+  }
+  if (setting.kind === "routed") {
+    await removeNat66(deps);
+    getImpdLogger("ipv6").info("{text}, routed{route}", {
+      text: setting.prefix.text,
+      route: uplink === null ? "; the container has no IPv6 default route" : ` via ${uplink}`
+    });
+    return { prefix: setting.prefix, nat66: false, uplink };
+  }
+  const prefix = deps.readUlaPrefix();
+  try {
+    await deps.runNft(buildNat66Ruleset(prefix.text, uplink ?? ""));
+  } catch (error) {
+    return stopIpv6(`NAT66: ${getErrorMessage(error)}`);
+  }
+  getImpdLogger("ipv6").info("{text}, NAT66 out of {uplink}", {
+    text: prefix.text,
+    uplink: uplink ?? ""
+  });
+  return { prefix, nat66: true, uplink };
+}
+async function removeNat66(deps) {
+  try {
+    await deps.runNft(buildNat66Removal());
+  } catch {}
+}
+var HOST_RULES6 = [
+  ["filter", "-A INPUT -i imp+ -j DROP"],
+  ["filter", "-A FORWARD -i imp+ -o imp+ -j DROP"],
+  ["filter", "-A FORWARD -o imp+ -j DROP"],
+  ["filter", "-A FORWARD -i imp+ -j DROP"],
+  ["raw", "-A PREROUTING -i imp+ -m rpfilter --invert -j DROP"]
+];
+var HOST_SYSCTLS6 = [
+  ["default/accept_ra", "0"],
+  ["default/accept_redirects", "0"],
+  ["all/forwarding", "1"]
+];
+async function checkHostRules6(procSys = "/proc/sys/net/ipv6/conf", run = runCommand) {
+  for (const table of ["filter", "raw"]) {
+    const result = await run(["ip6tables", "-w", "-t", table, "-S"]);
+    const rules = new Set(result.stdout.split(`
+`).map((line) => line.trim()));
+    const missing = HOST_RULES6.find(([inTable, rule]) => inTable === table && !rules.has(rule));
+    if (result.exitCode !== 0) {
+      return `ip6tables -t ${table}: ${result.stderr.trim()}`;
+    }
+    if (missing !== undefined) {
+      return `no ip6tables -t ${table} ${missing[1]}`;
+    }
+  }
+  for (const [key, wanted] of HOST_SYSCTLS6) {
+    const value = readSysctl(join2(procSys, key));
+    if (value !== wanted) {
+      return `net.ipv6.conf.${key.replace("/", ".")} is ${value ?? "missing"}, not ${wanted}`;
+    }
+  }
+  return null;
+}
+function readSysctl(path) {
+  try {
+    return readFileSync2(path, "utf8").trim();
+  } catch {
+    return null;
+  }
+}
+function readOrCreateUlaPrefix(path) {
+  if (existsSync2(path)) {
+    const prefix = parsePrefix64(readFileSync2(path, "utf8").trim());
+    if (prefix !== null) {
+      return prefix;
+    }
+  }
+  const prefix = buildUlaPrefix(randomBytes(5));
+  mkdirSync2(dirname(path), { recursive: true });
+  writeFileSync(path, `${prefix.text}
+`);
+  return prefix;
+}
+
+// packages/daemon/src/host-net/net/range-matcher.ts
+import { IPv4 as IPv44 } from "ipaddr.js";
+function buildRangeMatcher(ranges) {
+  const ranges4 = [];
+  const ranges6 = [];
+  for (const range of ranges) {
+    const cidr = parseCidr(range);
+    if (cidr === null) {
+      throw new Error(`not an address range: ${range}`);
+    }
+    if (cidr.address instanceof IPv44) {
+      ranges4.push([cidr.address, cidr.bits]);
+    } else {
+      ranges6.push([cidr.address, cidr.bits]);
+    }
+  }
+  const isIn4 = (ip) => ranges4.some(([network, bits]) => ip.match(network, bits));
+  const isIn6 = (ip) => ranges6.some(([network, bits]) => ip.match(network, bits));
+  return (address) => {
+    const ip = parseAddress(address);
+    if (ip === null) {
+      return false;
+    }
+    if (ip instanceof IPv44) {
+      return isIn4(ip);
+    }
+    return isIn6(ip) || ip.isIPv4MappedAddress() && isIn4(ip.toIPv4Address());
+  };
+}
+
+// packages/daemon/src/identity/auth/parse-tailnet-rules.ts
+import * as z48 from "zod";
+
 // packages/daemon/src/identity/auth/tailnet-identity.ts
 import * as z47 from "zod";
 
@@ -21703,6 +21704,8 @@ var EnvSchema = z53.object({
   IMP_EGRESS_DENY: z53.string().default(""),
   IMP_HOST_ADDRESSES: z53.string().default(""),
   IMP_RAM_BUDGET_MIB: CountSchema3.default(16384),
+  IMP_PRIORITY_RAM_MIB: CountSchema3.optional(),
+  IMP_PRIORITY_IMPS: z53.string().transform(splitList).pipe(z53.array(ImpPatternSchema)).optional(),
   IMP_IDLE_TIMEOUT_S: CountSchema3.default(60),
   IMP_IDLE_CPU_PERCENT: z53.coerce.number().nonnegative().default(10),
   IMP_MEMORY_SHRINK_AFTER_S: CountSchema3.default(60),
@@ -21867,6 +21870,7 @@ function loadConfig(env) {
     hostAddresses,
     brokerTestUpstreams: parsed.IMP_BROKER_TEST_UPSTREAMS ?? null,
     ramBudgetMib: parsed.IMP_RAM_BUDGET_MIB,
+    priorityRam: parsePriorityRam(parsed),
     idleTimeoutS: parsed.IMP_IDLE_TIMEOUT_S,
     idleCpuPercent: parsed.IMP_IDLE_CPU_PERCENT,
     memoryShrinkAfterMs: parsed.IMP_MEMORY_SHRINK_AFTER_S * 1000,
@@ -21923,6 +21927,20 @@ function loadConfig(env) {
     warnings: listHttpsWarnings(parsed)
   };
 }
+function parsePriorityRam(parsed) {
+  const mib = parsed.IMP_PRIORITY_RAM_MIB;
+  const patterns = parsed.IMP_PRIORITY_IMPS;
+  if (mib === undefined && patterns === undefined) {
+    return null;
+  }
+  if (mib === undefined || patterns === undefined) {
+    throw new Error("IMP_PRIORITY_RAM_MIB and IMP_PRIORITY_IMPS go together; set both or neither");
+  }
+  if (mib >= parsed.IMP_RAM_BUDGET_MIB) {
+    throw new Error(`IMP_PRIORITY_RAM_MIB ${String(mib)} leaves no room for other imps in the ${String(parsed.IMP_RAM_BUDGET_MIB)} MiB IMP_RAM_BUDGET_MIB`);
+  }
+  return { mib, patterns };
+}
 function parseTestRegistry(parsed) {
   const registry = parsed.IMP_BUILD_TEST_REGISTRY;
   const caPath = parsed.IMP_BUILD_TEST_REGISTRY_CA;
@@ -21972,7 +21990,7 @@ import { join as join48 } from "path";
 // packages/daemon/package.json
 var package_default = {
   name: "@impz/daemon",
-  version: "6.6.1",
+  version: "6.7.1",
   private: true,
   description: "impd: the imp host daemon",
   type: "module",
@@ -21980,13 +21998,9 @@ var package_default = {
     ".": "./src/index.ts",
     "./read-text": "./src/platform/process/read-text.ts",
     "./real-clock": "./src/platform/process/real-clock.ts",
-    "./testing": "./testing/index.ts",
-    "./testing/build-stub-clock": "./testing/platform/build-stub-clock.ts",
-    "./testing/data-layout": "./src/vm/storage/data-layout.ts",
-    "./testing/pebble-images": "./testing/network/pebble-images.ts",
-    "./testing/start-stub-agent": "./testing/vm/start-stub-agent.ts",
-    "./testing/start-test-impd": "./testing/start-test-impd.ts",
-    "./testing/test-token": "./testing/test-token.ts",
+    "./test-utils": "./src/test-utils/index.ts",
+    "./test-utils/data-layout": "./src/vm/storage/data-layout.ts",
+    "./test-utils/*": "./src/test-utils/*.ts",
     "./package.json": "./package.json"
   },
   dependencies: {
@@ -22029,7 +22043,8 @@ var package_default = {
   },
   devDependencies: {
     "@faker-js/faker": "catalog:",
-    "@impz/test-utils": "workspace:*",
+    "@impz/cli": "workspace:*",
+    "@impz/e2e-harness": "workspace:*",
     "@modelcontextprotocol/client": "catalog:",
     "@msw/data": "catalog:",
     "@types/dns-packet": "catalog:",
@@ -25007,7 +25022,7 @@ class RamBudgetError extends ImpdError {
         budgetMib: shortfall.budgetMib,
         usedMib: shortfall.usedMib,
         requestedMib: shortfall.requestedMib,
-        neededMib: buildNeededMib(shortfall.usedMib, shortfall.requestedMib, shortfall.budgetMib),
+        neededMib: buildNeededMib(shortfall.usedMib + (shortfall.kept?.mib ?? 0), shortfall.requestedMib, shortfall.budgetMib),
         protected: [],
         protectedHidden: shortfall.protected.length
       }
@@ -25027,25 +25042,35 @@ function buildRamBudgetError(shortfall) {
   const used = String(shortfall.usedMib);
   const budget = String(shortfall.budgetMib);
   const requested = String(shortfall.requestedMib);
-  return new RamBudgetError(`not enough RAM: ${used} of ${budget} MiB in use, ${requested} MiB requested, and no idle imp left to sleep`, shortfall, "ram");
+  const kept = formatKept(shortfall.kept);
+  return new RamBudgetError(`not enough RAM: ${used} of ${budget} MiB in use${kept}, ${requested} MiB requested, and no idle imp left to sleep`, shortfall, "ram");
 }
 function buildOrdinaryBudgetError(shortfall) {
   const used = String(shortfall.usedMib);
   const budget = String(shortfall.budgetMib);
   const requested = String(shortfall.requestedMib);
-  return new RamBudgetError(`not enough RAM outside the huge page pool: ${used} of ${budget} MiB in use, ${requested} MiB requested on 4 KiB pages, and no idle imp left to sleep`, shortfall, "ordinary");
+  const kept = formatKept(shortfall.kept);
+  return new RamBudgetError(`not enough RAM outside the huge page pool: ${used} of ${budget} MiB in use${kept}, ${requested} MiB requested on 4 KiB pages, and no idle imp left to sleep`, shortfall, "ordinary");
 }
 function buildHugePoolError(shortfall) {
   const committed = String(shortfall.committedMib);
   const total = String(shortfall.totalMib);
   const requested = String(shortfall.requestedMib);
-  return new RamBudgetError(`not enough 2 MiB pages: ${committed} of the host's ${total} MiB pool in use or promised to awake imps, ${requested} MiB requested`, {
+  const kept = formatKept(shortfall.kept);
+  return new RamBudgetError(`not enough 2 MiB pages: ${committed} of the host's ${total} MiB pool in use or promised to awake imps${kept}, ${requested} MiB requested`, {
     budgetMib: shortfall.totalMib,
     usedMib: shortfall.committedMib,
     requestedMib: shortfall.requestedMib,
-    protected: []
+    protected: [],
+    ...shortfall.kept !== undefined && { kept: shortfall.kept }
   }, "pool");
 }
+function formatKept(kept) {
+  if (kept === undefined || kept.mib === 0) {
+    return "";
+  }
+  return ` and ${String(kept.mib)} MiB kept for priority imps (${kept.patterns.join(", ")})`;
+}
 function buildNeededMib(usedMib, requestedMib, budgetMib) {
   return Math.max(0, usedMib + requestedMib - budgetMib);
 }
@@ -26317,7 +26342,11 @@ async function sendAgentRequest(vsockPath, request, timeoutMs = 5000) {
   const connection = await openAgentConnection(vsockPath, timeoutMs);
   try {
     sendRequestFrame(connection, request);
-    const frame = await readFrameWithin(connection, timeoutMs);
+    const frame = await readFrameWithin(connection, {
+      call: `${request.op} response`,
+      vsockPath,
+      timeoutMs
+    });
     if (frame?.type !== FRAME_TYPES.response) {
       throw new Error(`agent ${request.op}: no response`);
     }
@@ -26379,8 +26408,8 @@ async function sendThaw(vsockPath) {
   const response = await sendAgentRequest(vsockPath, { op: "thaw" });
   decodeAgentMessage(OKSchema, response);
 }
-function readFrameWithin(connection, timeoutMs) {
-  return requireWithin(connection.next(), timeoutMs, () => new Error(`agent did not answer within ${String(timeoutMs)} ms`));
+function readFrameWithin(connection, wait) {
+  return requireWithin(connection.next(), wait.timeoutMs, () => new Error(`agent at ${wait.vsockPath} sent no ${wait.call} within ${String(wait.timeoutMs)} ms`));
 }
 
 // packages/daemon/src/imps/imps/consistent-disk.ts
@@ -33480,7 +33509,11 @@ async function openStream(vsockPath, request, startTimeoutMs) {
   let output;
   try {
     sendRequestFrame(connection, request);
-    const first = await readFrameWithin(connection, startTimeoutMs);
+    const first = await readFrameWithin(connection, {
+      call: `${request.op} start`,
+      vsockPath,
+      timeoutMs: startTimeoutMs
+    });
     if (first === null) {
       throw new Error("agent closed the exec connection before the process started");
     }
@@ -37693,6 +37726,61 @@ function buildBudgets(budgetMib, pool) {
   };
 }
 
+// packages/daemon/src/imp-ops/governor/build-usage-totals.ts
+function buildUsageTotals(input) {
+  const reserved = new Map(input.reservations.map((reservation) => [reservation.id, reservation]));
+  const byImp = new Map;
+  let usedMib = input.lockedMib;
+  let effectiveMib = input.lockedMib + input.headroomMib;
+  let ordinaryUsedMib = input.lockedMib;
+  let ordinaryEffectiveMib = input.lockedMib + input.headroomMib;
+  const priority = { ramMib: 0, ordinaryMib: 0, poolMib: 0 };
+  for (const [index, imp] of input.awake.entries()) {
+    const reading = input.readings[index] ?? null;
+    const measured = reading?.ramMib ?? 0;
+    const effective = Math.max(measured, reserved.get(imp.id)?.mib ?? 0);
+    const ordinary = imp.hugePagesMib > 0 ? Math.max(0, measured - (reading?.hugetlbMib ?? 0)) : effective;
+    byImp.set(imp.id, effective);
+    usedMib += measured;
+    effectiveMib += effective;
+    ordinaryUsedMib += imp.hugePagesMib > 0 ? ordinary : measured;
+    ordinaryEffectiveMib += ordinary;
+    if (imp.isPriority) {
+      priority.ramMib += effective;
+      priority.ordinaryMib += ordinary;
+      priority.poolMib += imp.hugePagesMib;
+    }
+  }
+  for (const reservation of input.reservations) {
+    if (!byImp.has(reservation.id)) {
+      const ordinary = reservation.isOnPool ? 0 : reservation.mib;
+      effectiveMib += reservation.mib;
+      ordinaryEffectiveMib += ordinary;
+      if (reservation.isPriority) {
+        priority.ramMib += reservation.mib;
+        priority.ordinaryMib += ordinary;
+      }
+    }
+  }
+  for (const pending of input.pendingPool) {
+    if (pending.isPriority && !byImp.has(pending.id)) {
+      priority.poolMib += pending.mib;
+    }
+  }
+  return {
+    byImp,
+    usedMib,
+    effectiveMib,
+    ordinaryUsedMib,
+    ordinaryEffectiveMib,
+    kept: {
+      ramMib: Math.max(0, input.priorityMib - priority.ramMib),
+      ordinaryMib: Math.max(0, input.priorityMib - priority.ordinaryMib),
+      poolMib: Math.max(0, input.priorityMib - priority.poolMib)
+    }
+  };
+}
+
 // packages/daemon/src/imp-ops/governor/build-huge-pool-admission.ts
 function buildHugePoolAdmission(input) {
   const growthMib = input.awake.reduce((sum, guest) => sum + Math.max(0, guest.hugePagesMib - guest.heldMib), 0);
@@ -37700,21 +37788,22 @@ function buildHugePoolAdmission(input) {
   const totalMib = input.pool?.totalMib ?? 0;
   const freeMib = input.pool?.freeMib ?? 0;
   const promisedMib = growthMib + pendingMib;
-  if (promisedMib + input.requestedMib <= freeMib) {
+  const wantedMib = promisedMib + input.keptMib + input.requestedMib;
+  if (wantedMib <= freeMib) {
     return { admitted: true };
   }
   return {
     admitted: false,
     totalMib,
     committedMib: totalMib - freeMib + promisedMib,
-    neededMib: promisedMib + input.requestedMib - freeMib
+    neededMib: wantedMib - freeMib
   };
 }
 
 // packages/daemon/src/imp-ops/governor/make-check-huge-pool.ts
 function makeCheckHugePool(deps) {
   const pendingHugePages = deps.pendingHugePages;
-  return async (request, hugePagesMib) => {
+  return async (request, hugePagesMib, kept) => {
     const listed = await deps.listAwake();
     const awake = listed.filter((imp) => imp.id !== request.id);
     for (const imp of awake) {
@@ -37730,7 +37819,8 @@ function makeCheckHugePool(deps) {
         heldMib: held[index] ?? 0
       })),
       pendingMib: [...pendingHugePages].filter(([id]) => id !== request.id).map(([, mib]) => mib),
-      requestedMib: hugePagesMib
+      requestedMib: hugePagesMib,
+      keptMib: kept?.mib ?? 0
     });
     if (poolAdmission.admitted) {
       return;
@@ -37746,7 +37836,8 @@ function makeCheckHugePool(deps) {
     throw buildHugePoolError({
       totalMib: poolAdmission.totalMib,
       committedMib: poolAdmission.committedMib,
-      requestedMib: hugePagesMib
+      requestedMib: hugePagesMib,
+      ...kept !== null && { kept }
     });
   };
 }
@@ -37771,6 +37862,17 @@ function pickShortfall(used, budgets, requestedMib) {
   } : ram;
 }
 
+// packages/daemon/src/imp-ops/governor/pick-effective-shortfall.ts
+function pickEffectiveShortfall(usage, budgets, requestedMib, isPriority) {
+  const kept = isPriority ? { ramMib: 0, ordinaryMib: 0 } : usage.kept;
+  const shortfall = pickShortfall({
+    ramMib: usage.effectiveMib + kept.ramMib,
+    ordinaryMib: usage.ordinaryEffectiveMib + kept.ordinaryMib
+  }, budgets, requestedMib);
+  const keptMib = shortfall.budget === "ordinary" ? kept.ordinaryMib : kept.ramMib;
+  return { ...shortfall, usedMib: shortfall.usedMib - keptMib, keptMib };
+}
+
 // packages/daemon/src/imp-ops/governor/pick-sleep-victims.ts
 function pickSleepVictims(candidates, needMib) {
   if (needMib <= 0) {
@@ -37798,8 +37900,12 @@ function createRamGovernor(deps) {
   const admission = createPrioritySemaphore(1);
   const reservations = new Map;
   const now = deps.now ?? Date.now;
+  const priority = deps.priority ?? null;
+  const isPriority = (name) => priority !== null && name !== null && isImpAllowed(priority.patterns, name);
+  const buildKept = (mib) => priority === null || mib === 0 ? null : { mib, patterns: priority.patterns };
   let stuckOver = false;
   const pendingHugePages = new Map;
+  const admittedPriority = new Set;
   const emitDecision = (decision) => {
     deps.events?.publish({
       v: EVENT_VERSION,
@@ -37830,6 +37936,11 @@ function createRamGovernor(deps) {
     if ((request.hugePagesMib ?? 0) > 0) {
       pendingHugePages.set(request.id, request.hugePagesMib ?? 0);
     }
+    if (isPriority(request.name)) {
+      admittedPriority.add(request.id);
+    } else {
+      admittedPriority.delete(request.id);
+    }
     emitAdmission(request, "admitted", usedMib);
   };
   const readReservation = (id) => {
@@ -37860,45 +37971,27 @@ function createRamGovernor(deps) {
   const readEffectiveUsage = async (excludeId, readVm = deps.readVmRam) => {
     const listed = await deps.listAwake();
     const awake = listed.filter((imp) => imp.id !== excludeId);
-    const byImp = new Map;
     const lockedMib = deps.readLockedMib?.() ?? 0;
-    let usedMib = lockedMib;
-    let effectiveMib = lockedMib;
-    let ordinaryUsedMib = lockedMib;
-    let ordinaryEffectiveMib = lockedMib;
     const readings = await Promise.all(awake.map((imp) => readVm(imp.pid, imp.apiSocket)));
-    for (const [index, imp] of awake.entries()) {
-      const reading = readings[index] ?? null;
-      const measured = reading?.ramMib ?? 0;
-      const effective = Math.max(measured, readReservation(imp.id));
-      const ordinary = imp.hugePagesMib > 0 ? Math.max(0, measured - (reading?.hugetlbMib ?? 0)) : effective;
-      byImp.set(imp.id, effective);
-      usedMib += measured;
-      effectiveMib += effective;
-      ordinaryUsedMib += imp.hugePagesMib > 0 ? ordinary : measured;
-      ordinaryEffectiveMib += ordinary;
-    }
-    for (const id of reservations.keys()) {
-      if (id !== excludeId && !byImp.has(id)) {
-        effectiveMib += readReservation(id);
-        if (!pendingHugePages.has(id)) {
-          ordinaryEffectiveMib += readReservation(id);
-        }
-      }
-    }
+    const live = [...reservations.keys()].filter((id) => id !== excludeId).map((id) => ({
+      id,
+      mib: readReservation(id),
+      isPriority: admittedPriority.has(id),
+      isOnPool: pendingHugePages.has(id)
+    }));
+    const pendingPool = [...pendingHugePages].filter(([id]) => id !== excludeId).map(([id, mib]) => ({ id, mib, isPriority: admittedPriority.has(id) }));
     const headroom = deps.readHeadroomMib?.(awake.map((imp) => imp.pid)) ?? Promise.resolve(0);
     const headroomMib = await headroom;
-    effectiveMib += headroomMib;
-    ordinaryEffectiveMib += headroomMib;
-    return {
-      awake,
-      byImp,
-      usedMib,
-      effectiveMib,
-      ordinaryUsedMib,
-      ordinaryEffectiveMib,
-      headroomMib
-    };
+    const totals = buildUsageTotals({
+      awake: awake.map((imp) => ({ ...imp, isPriority: isPriority(imp.name) })),
+      readings,
+      reservations: live,
+      pendingPool,
+      lockedMib,
+      headroomMib,
+      priorityMib: priority?.mib ?? 0
+    });
+    return { awake, headroomMib, ...totals };
   };
   const readFreeRoom = async (excludeId, findShortfall) => {
     const usage = await readEffectiveUsage(excludeId);
@@ -37926,7 +38019,7 @@ function createRamGovernor(deps) {
       const shortfall = options.findShortfall(usage);
       const missingMib = shortfall.missingMib;
       const isOrdinary = shortfall.budget === "ordinary";
-      const sleepable = usage.awake.filter((imp) => !isOrdinary || imp.hugePagesMib === 0);
+      const sleepable = usage.awake.filter((imp) => !isOrdinary || imp.hugePagesMib === 0).filter((imp) => !options.sparesPriority || !isPriority(imp.name));
       if (missingMib <= 0) {
         return {
           fits: true,
@@ -38011,20 +38104,23 @@ function createRamGovernor(deps) {
           requestedMib: request.memoryMib
         });
       }
+      const bound = await readEffectiveUsage(request.id, deps.readResidentRam);
+      const isPriorityRequest = isPriority(request.name);
       if (hugePagesMib > 0) {
-        await checkHugePool(request, hugePagesMib);
+        const kept = isPriorityRequest ? null : buildKept(bound.kept.poolMib);
+        await checkHugePool(request, hugePagesMib, kept);
       }
-      const bound = await readEffectiveUsage(request.id, deps.readResidentRam);
-      if (pickEffectiveShortfall(bound, budgets, request.reserveMib).missingMib <= 0) {
+      const findReserveShortfall = (usage) => pickEffectiveShortfall(usage, budgets, request.reserveMib, isPriorityRequest);
+      if (findReserveShortfall(bound).missingMib <= 0) {
         recordAdmission(request, bound.effectiveMib);
         return;
       }
-      const findReserveShortfall = (usage) => pickEffectiveShortfall(usage, budgets, request.reserveMib);
       const room = request.maySleepImps === false ? await readFreeRoom(request.id, findReserveShortfall) : await makeRoom({
         excludeId: request.id,
         reason: `to make room for ${request.name ?? request.id}`,
         whenShort: "giveUp",
-        findShortfall: findReserveShortfall
+        findShortfall: findReserveShortfall,
+        sparesPriority: !isPriorityRequest
       });
       const diskFull = room.diskFull ? deps.readDiskFullError?.() ?? null : null;
       if (!room.fits && diskFull !== null) {
@@ -38034,8 +38130,9 @@ function createRamGovernor(deps) {
         const usage = await readEffectiveUsage(request.id);
         const shortfall = findReserveShortfall(usage);
         const isOrdinary = shortfall.budget === "ordinary";
+        const kept = buildKept(shortfall.keptMib);
         emitAdmission(request, "refused", shortfall.usedMib, {
-          neededMib: buildNeededMib(shortfall.usedMib, request.reserveMib, shortfall.budgetMib),
+          neededMib: Math.max(0, shortfall.missingMib),
           protectedCount: room.protected.length,
           ...isOrdinary && { trigger: ORDINARY_TRIGGER }
         });
@@ -38043,7 +38140,8 @@ function createRamGovernor(deps) {
           budgetMib: shortfall.budgetMib,
           usedMib: shortfall.usedMib,
           requestedMib: request.reserveMib,
-          protected: room.protected
+          protected: room.protected,
+          ...kept !== null && { kept }
         };
         throw isOrdinary ? buildOrdinaryBudgetError(refusal) : buildRamBudgetError(refusal);
       }
@@ -38052,6 +38150,7 @@ function createRamGovernor(deps) {
     release: (id) => {
       reservations.delete(id);
       pendingHugePages.delete(id);
+      admittedPriority.delete(id);
     },
     admitGrow: (request) => admission.run("background", async () => {
       const listed = await deps.listAwake();
@@ -38059,15 +38158,17 @@ function createRamGovernor(deps) {
         return false;
       }
       const budgets = readBudgets();
+      const findGrowShortfall = (usage) => pickEffectiveShortfall(usage, budgets, request.mib, isPriority(request.name));
       const room = await makeRoom({
         excludeId: null,
         reason: `to grow ${request.name}`,
         whenShort: "giveUp",
-        findShortfall: (usage) => pickEffectiveShortfall(usage, budgets, request.mib),
-        protectedId: request.id
+        findShortfall: findGrowShortfall,
+        protectedId: request.id,
+        sparesPriority: !isPriority(request.name)
       });
       const usage = await readEffectiveUsage(null);
-      const shortfall = pickEffectiveShortfall(usage, budgets, request.mib);
+      const shortfall = findGrowShortfall(usage);
       const fits = room.fits && usage.awake.some((imp) => imp.id === request.id);
       emitDecision({
         decision: fits ? "admitted" : "refused",
@@ -38116,7 +38217,8 @@ function createRamGovernor(deps) {
         excludeId: null,
         reason: ENFORCE_TRIGGER,
         whenShort: "sleepAll",
-        findShortfall: (usage) => pickShortfall({ ramMib: usage.usedMib, ordinaryMib: usage.ordinaryUsedMib }, budgets, 0)
+        findShortfall: (usage) => pickShortfall({ ramMib: usage.usedMib, ordinaryMib: usage.ordinaryUsedMib }, budgets, 0),
+        sparesPriority: false
       });
       const over = `over budget by ${String(room.missingMib)} MiB`;
       if (room.fits) {
@@ -38134,9 +38236,6 @@ function createRamGovernor(deps) {
     })
   };
 }
-function pickEffectiveShortfall(usage, budgets, requestedMib) {
-  return pickShortfall({ ramMib: usage.effectiveMib, ordinaryMib: usage.ordinaryEffectiveMib }, budgets, requestedMib);
-}
 function toTaskPriority(request) {
   return request.isBackground === true ? "background" : "foreground";
 }
@@ -41333,7 +41432,11 @@ async function openRelayStream(vsockPath, request, feature, answerTimeoutMs) {
   const connection = await openAgentConnection(vsockPath);
   try {
     sendRequestFrame(connection, request);
-    const answer = await readFrameWithin(connection, answerTimeoutMs);
+    const answer = await readFrameWithin(connection, {
+      call: `${request.op} answer`,
+      vsockPath,
+      timeoutMs: answerTimeoutMs
+    });
     if (answer?.type !== FRAME_TYPES.response) {
       throw new Error(`agent closed the ${request.op} connection before it answered`);
     }
@@ -41379,12 +41482,16 @@ function buildListenRequest(spec) {
   }
   return { op: "listen", network: "tcp", address: `127.0.0.1:${String(spec.port)}` };
 }
-async function openListener(vsockPath, spec) {
+async function openListener(vsockPath, spec, answerTimeoutMs = ANSWER_TIMEOUT_MS) {
   const feature = spec.network === "ssh-agent" ? "agent-forwarding" : "reverse-forward";
   const connection = await openAgentConnection(vsockPath);
   try {
     sendRequestFrame(connection, buildListenRequest(spec));
-    const answer = await readFrameWithin(connection, ANSWER_TIMEOUT_MS);
+    const answer = await readFrameWithin(connection, {
+      call: "listener answer",
+      vsockPath,
+      timeoutMs: answerTimeoutMs
+    });
     if (answer?.type !== FRAME_TYPES.response) {
       throw new Error("agent closed the listen connection before it answered");
     }
@@ -42286,7 +42393,7 @@ async function sendServicesRestart(vsockPath, service) {
   const response = await sendAgentRequest(vsockPath, { op: "services.restart", service }, STOP_TIMEOUT_MS).catch(handleUnknownOp("services"));
   decodeAgentMessage(OKSchema, response);
 }
-async function openServiceLogStream(vsockPath, request) {
+async function openServiceLogStream(vsockPath, request, startTimeoutMs = LOGS_START_TIMEOUT_MS) {
   const connection = await openAgentConnection(vsockPath);
   try {
     sendRequestFrame(connection, {
@@ -42296,7 +42403,11 @@ async function openServiceLogStream(vsockPath, request) {
       follow: request.follow,
       ...request.cursor !== undefined && { cursor: request.cursor }
     });
-    const first = await readFrameWithin(connection, LOGS_START_TIMEOUT_MS);
+    const first = await readFrameWithin(connection, {
+      call: "services.logs start",
+      vsockPath,
+      timeoutMs: startTimeoutMs
+    });
     if (first === null) {
       throw new Error("agent closed the log connection before it answered");
     }
@@ -45622,6 +45733,7 @@ function createImpdImps(config, deps, parts) {
   });
   const governor = createRamGovernor({
     budgetMib: config.ramBudgetMib,
+    priority: config.priorityRam,
     listAwake: async () => {
       const listed = await listImps(deps.db);
       return listed.flatMap((imp) => {
@@ -58516,12 +58628,12 @@ async function setupDefaultImage(config, images) {
   }
 }
 
-// packages/daemon/testing/network/read-no-tailscale.ts
+// packages/daemon/src/test-utils/network/read-no-tailscale.ts
 function readNoTailscale() {
   return Promise.resolve({ state: null, hostname: null, dnsName: null, ip: null, ips: [] });
 }
 
-// packages/daemon/testing/platform/build-stub-ticker-timer.ts
+// packages/daemon/src/test-utils/platform/build-stub-ticker-timer.ts
 function buildStubTickerTimer() {
   const pending = new Map;
   const holdRun = (label, run, durationMs) => {
@@ -58547,12 +58659,12 @@ function buildStubTickerTimer() {
   };
 }
 
-// packages/daemon/testing/platform/format-run-prefix.ts
+// packages/daemon/src/test-utils/platform/format-run-prefix.ts
 function formatRunPrefix(owner) {
   return `pid${String(owner.pid)}-ns${owner.namespace}-`;
 }
 
-// packages/daemon/testing/platform/open-migrated-copy.ts
+// packages/daemon/src/test-utils/platform/open-migrated-copy.ts
 import { Database as Database4 } from "bun:sqlite";
 var TEMPLATE = {};
 function openMigratedCopy() {
@@ -58567,14 +58679,14 @@ async function serializeMigratedDatabase() {
   return bytes;
 }
 
-// packages/daemon/testing/platform/pick-impd-port.ts
+// packages/daemon/src/test-utils/platform/pick-impd-port.ts
 var FIRST_PORT = 10100;
 var PORT_SPAN = 9900;
 function pickImpdPort(draw) {
   return FIRST_PORT + Math.floor(draw * PORT_SPAN);
 }
 
-// packages/daemon/testing/platform/read-run-owner.ts
+// packages/daemon/src/test-utils/platform/read-run-owner.ts
 import { readlinkSync as readlinkSync2 } from "fs";
 function readRunOwner() {
   return {
@@ -58583,7 +58695,7 @@ function readRunOwner() {
   };
 }
 
-// packages/daemon/testing/platform/start-impd-log-capture.ts
+// packages/daemon/src/test-utils/platform/start-impd-log-capture.ts
 import { resetSync } from "@logtape/logtape";
 
 // packages/daemon/src/platform/process/setup-logging.ts
@@ -58616,7 +58728,7 @@ function renderLogLine(record) {
 `;
 }
 
-// packages/daemon/testing/platform/start-impd-log-capture.ts
+// packages/daemon/src/test-utils/platform/start-impd-log-capture.ts
 var listeners = new Set;
 function startImpdLogCapture(onLine) {
   if (listeners.size === 0) {
@@ -58634,10 +58746,10 @@ function startImpdLogCapture(onLine) {
   };
 }
 
-// packages/daemon/testing/test-token.ts
+// packages/daemon/src/test-utils/test-token.ts
 var TEST_TOKEN = "test-token";
 
-// packages/daemon/testing/vm/build-stub-vmm.ts
+// packages/daemon/src/test-utils/vm/build-stub-vmm.ts
 import { existsSync as existsSync33, mkdirSync as mkdirSync30, renameSync as renameSync8, writeFileSync as writeFileSync15 } from "fs";
 var STUB_AGENT_VERSION = "0.1.0";
 var IMPD_OWNER = { uid: process.getuid?.() ?? 0, cgroup: null };
@@ -59041,7 +59153,7 @@ log tail`);
   };
 }
 
-// packages/daemon/testing/start-test-impd.ts
+// packages/daemon/src/test-utils/start-test-impd.ts
 var FAKE_VM_RAM_MIB = 300;
 var FAKE_VM_RSS_MIB = 340;
 var TEST_DRIVE = "d1".repeat(32);
@@ -59384,7 +59496,7 @@ function buildTestIdentity(dataDir, drive) {
 import { randomBytes as randomBytes12 } from "crypto";
 import { Duplex } from "stream";
 
-// packages/daemon/testing/vm/start-stub-agent.ts
+// packages/daemon/src/test-utils/vm/start-stub-agent.ts
 import { onTestFinished as onTestFinished2 } from "bun:test";
 import { mkdirSync as mkdirSync32 } from "fs";
 import { createServer as createServer3 } from "net";