@nimbus-sh/fabric 0.1.0 → 0.2.0

package/dist/{launch-pacer.js → turn-budget.js}

@@ -1,5 +1,5 @@
 /**
- * launch-pacer.ts — spreading a resident launch across Durable Object turns.
+ * turn-budget.ts — spreading a resident launch across Durable Object turns.
  *
  * Building a resident process is the largest single span of computation this
  * session performs: for pi it walks a 17 MB source tree through eight
@@ -32,6 +32,7 @@
  * `git/network-facet.ts` bounds its checkout chunks by entries and decoded
  * bytes and treats its wall guard as coarse.
  */
+import { runColdStart } from './generation.js';
 /**
  * Bytes of launch work one turn may perform before it must yield.
  *
@@ -40,7 +41,7 @@
  * each an alarm round trip — small enough not to dominate a launch. pi's
  * 22.9 MB map crosses this about a dozen times per phase that handles it.
  */
-export const LAUNCH_CHUNK_MAX_BYTES = 2_000_000;
+export const TURN_CHUNK_MAX_BYTES = 2_000_000;
 /**
  * Accounts launch progress and ends the turn when a chunk's worth has been
  * spent.
@@ -51,7 +52,7 @@ export const LAUNCH_CHUNK_MAX_BYTES = 2_000_000;
  * behaviour and cost. Nothing here decides WHAT the launch does, only where it
  * is allowed to stop.
  */
-export class LaunchPacer {
+export class TurnBudget {
     scheduler;
     maxChunkBytes;
     stillWanted;
@@ -69,7 +70,7 @@ export class LaunchPacer {
      *   place a launch can be interrupted, rather than at whichever phases
      *   remembered to ask.
      */
-    constructor(scheduler, maxChunkBytes = LAUNCH_CHUNK_MAX_BYTES, stillWanted) {
+    constructor(scheduler, maxChunkBytes = TURN_CHUNK_MAX_BYTES, stillWanted) {
         this.scheduler = scheduler;
         this.maxChunkBytes = maxChunkBytes;
         this.stillWanted = stillWanted;
@@ -111,10 +112,11 @@ function withResolvers() {
     return { promise, resolve };
 }
 /**
- * The granting side of {@link LaunchTurnScheduler}: parks suspended launches
+ * The granting side of {@link TurnScheduler}: parks suspended launches
  * and resumes every one of them when the host grants a fresh turn.
  */
-export class LaunchTurnPump {
+export class PacedWork {
+    ctx;
     host;
     /**
      * Launches suspended between chunks, waiting for a turn of their own.
@@ -127,7 +129,12 @@ export class LaunchTurnPump {
      * from its inputs is the same idempotent work again.
      */
     waiters = [];
-    constructor(host) {
+    /**
+     * `ctx` keys the cold-start queue the pump drains first on every turn it
+     * grants — see {@link pump}.
+     */
+    constructor(ctx, host) {
+        this.ctx = ctx;
         this.host = host;
     }
     /**
@@ -159,7 +166,11 @@ export class LaunchTurnPump {
      * the runtime may tear the context down mid-chunk.
      */
     async pump() {
-        await this.host.recover?.();
+        // Deferred reconciliation runs first, before any waiter resumes. Where
+        // the resident-launch journal's recovery sits (`onColdStart`): the pump
+        // is what an alarm calls, and the first turn after a reset is the
+        // re-delivered alarm of a launch the reset interrupted.
+        await runColdStart(this.ctx);
         const waiting = this.waiters;
         if (waiting.length === 0)
             return;
@@ -183,11 +194,11 @@ export class LaunchTurnPump {
  * `git/commands.ts` carries `NIMBUS_GIT_CHECKOUT_CHUNK_ENTRIES`. Unset in
  * production, where the default applies.
  */
-export function launchChunkMaxBytes(env) {
+export function turnChunkMaxBytes(env) {
     const raw = env
         ?.NIMBUS_LAUNCH_CHUNK_BYTES;
     if (!raw)
-        return LAUNCH_CHUNK_MAX_BYTES;
+        return TURN_CHUNK_MAX_BYTES;
     const parsed = Number(raw);
-    return Number.isFinite(parsed) && parsed > 0 ? parsed : LAUNCH_CHUNK_MAX_BYTES;
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : TURN_CHUNK_MAX_BYTES;
 }

package/dist/workerd-facet-host.d.ts

@@ -45,30 +45,6 @@ export declare function createLoadedWorkerEntrypoint(ctxExports: NimbusCtxExport
     pid: number;
     writerId: string;
 }, stage: unknown, name?: string | null): Promise<LoadedWorkerEntrypointStub>;
-/**
- * Total bytes a dynamic Worker's module map may carry, across every member of
- * it. A hard platform limit, not a policy knob: 62 MiB lands and 64 MiB is
- * refused with "Dynamic Worker code size (N bytes) exceeds the maximum allowed
- * size of 67108864 bytes", confirmed at five sizes with two trials each. The
- * budget is shared, so a ruby process is already 34.3 MiB down before its disk
- * is counted.
- */
-export declare const DYNAMIC_WORKER_CODE_LIMIT_BYTES = 67108864;
-/**
- * Refuse a module map over {@link DYNAMIC_WORKER_CODE_LIMIT_BYTES}, naming
- * the largest members. The platform's own refusal reports one number for a
- * budget shared across every member of the map, which tells the operator
- * nothing about WHAT to shrink — so every fabric seam that assembles a map
- * runs this before the loader sees it.
- *
- * Costed to its two paths. Under the ceiling: one length read per member —
- * UTF-16 code units for text, which equal UTF-8 bytes for the ASCII module
- * text the generators emit and undercount otherwise; the platform's own
- * refusal still backstops the exotic case, because this check exists to name
- * members, not to be the ceiling. Over it: exact UTF-8 sizes, computed only
- * then, sorted so the biggest lever is first.
- */
-export declare function assertModuleMapWithinCodeLimit(modules: Record<string, unknown>): void;
 /** What an unkeyed `LOADER.load` hands back. */
 interface LoadedWorkerStub {
     getEntrypoint(): LoadedWorkerEntrypointStub;
@@ -89,7 +65,7 @@ interface WorkerLoaderBinding {
     load(code: unknown): LoadedWorkerStub;
 }
 /**
- * The bindings `openResidentFacet` needs off whichever DO is hosting. A
+ * The bindings `processes` needs off whichever DO is hosting. A
  * staged boot's assembler may read more off the same env (Nimbus's reads
  * ASSETS); the env travels to it whole, so nothing further is named here.
  */
@@ -124,7 +100,7 @@ export interface ResidentFacetEnv {
  * storage budget grants no copy-on-write credit — crossing it resets the
  * object rather than raising an error.
  */
-export declare function cloneFacetStorage(ctx: DurableObjectState, clone: {
+export declare function cloneStorage(ctx: DurableObjectState, clone: {
     src: string;
     dst: string;
     populated(name: string): boolean | Promise<boolean>;
@@ -145,29 +121,7 @@ export declare function cloneFacetStorage(ctx: DurableObjectState, clone: {
  */
 export declare function residentFacetName(slot: number): string;
 /**
- * Facet IDs a Durable Object is granted over its LIFETIME. Append-only and
- * never reclaimed, so crossing it is unrecoverable for the object — which is
- * why the ledger below counts consumption durably instead of leaving the
- * bound as prose the slot book merely respects.
- */
-export declare const FACET_ID_LIFETIME_BUDGET = 65536;
-/** Where the ledger persists the count of facet names ever minted. */
-export declare const FACET_NAME_HIGH_WATER_KEY = "fabric_facet_name_high_water";
-/**
- * The lifetime facet-ID ledger: how many facet names this fabric has ever
- * minted on the Durable Object, against the 65,536 the platform will ever
- * grant it. `consumed` only ever counts FIRST uses — a reused name, in this
- * incarnation or any earlier one, cost no new ID, which is the slot book's
- * whole reason to exist. Surfaced so an operator can see proximity to a wall
- * whose crossing is unrecoverable, instead of discovering it from the
- * platform's opaque failure.
- */
-export declare function facetIdBudget(ctx: DurableObjectState): Promise<{
-    consumed: number;
-    budget: number;
-}>;
-/**
- * What `openResidentFacet` hands back: a running process, minus its placement.
+ * What `processes(ctx, env).spawn` hands back: a running process, minus its placement.
  *
  * `slot` rides along because the caller's `describe` needs the facet's real
  * name and the slot is not derivable from the pid — that indirection is the
@@ -178,30 +132,37 @@ export type ResidentFacet = Omit<HostedProcess, 'describe'> & {
     slot: number;
 };
 /**
- * Open a resident process as a facet of the actor whose `ctx` and `env` are
- * given, and start its runner.
+ * The process surface of one hosting actor: how a resident process comes
+ * into existence on workerd, and how a one-shot program runs to completion.
  *
- * This is the ONE way a resident process comes into existence, and every
+ * `spawn` is the ONE way a resident process comes into existence, and every
  * substrate goes through it: the facet host calls it with the coordinator's
  * own `ctx`, the peer host calls it — over one RPC — with a sibling session
  * DO's. Everything a substrate could plausibly want to special-case is a
  * PARAMETER here rather than a branch: which actor hosts the child, and how
  * the boot spec's by-path members are read.
  */
-export declare function openResidentFacet(ctx: DurableObjectState, env: ResidentFacetEnv, disk: () => ResidentDiskReader, supervisor: ResidentSupervisorProps, params: ProcessHostParams): ResidentFacet;
-/**
- * Run one program to completion as an UNKEYED dynamic worker.
- *
- * Unkeyed is the whole difference from `openResidentFacet`: nothing can
- * re-resolve this worker into a later request's context, so it can never be a
- * routeable target and never has to be released by name. It exists for the
- * duration of one call and its stubs are dropped as that call unwinds.
- *
- * Shared by both substrates on purpose. `peer` places processes that have a
- * residency to place; a one-shot has none, and shipping its fully-inline map
- * across a sibling hop would meet the 32 MiB RPC ceiling that by-path boot
- * specs exist to avoid — for a run that gains nothing by moving.
- */
-export declare function runOneShotWorker<T>(ctx: DurableObjectState, env: ResidentFacetEnv, supervisor: ResidentSupervisorProps, params: OneShotParams, consume: (response: Response) => Promise<T>): Promise<T>;
+export declare function processes(ctx: DurableObjectState, env: ResidentFacetEnv): Processes;
+export declare class Processes {
+    private readonly ctx;
+    private readonly env;
+    constructor(ctx: DurableObjectState, env: ResidentFacetEnv);
+    /** Open a resident process as a facet of this actor, and start its runner. */
+    spawn(disk: () => ResidentDiskReader, supervisor: ResidentSupervisorProps, params: ProcessHostParams): ResidentFacet;
+    /**
+     * Run one program to completion as an UNKEYED dynamic worker.
+     *
+     * Unkeyed is the whole difference from `spawn`: nothing can re-resolve this
+     * worker into a later request's context, so it can never be a routeable
+     * target and never has to be released by name. It exists for the duration
+     * of one call and its stubs are dropped as that call unwinds.
+     *
+     * Shared by both substrates on purpose. `peer` places processes that have a
+     * residency to place; a one-shot has none, and shipping its fully-inline
+     * map across a sibling hop would meet the 32 MiB RPC ceiling that by-path
+     * boot specs exist to avoid — for a run that gains nothing by moving.
+     */
+    run<T>(supervisor: ResidentSupervisorProps, params: OneShotParams, consume: (response: Response) => Promise<T>): Promise<T>;
+}
 export {};
 //# sourceMappingURL=workerd-facet-host.d.ts.map

package/dist/workerd-facet-host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workerd-facet-host.d.ts","sourceRoot":"","sources":["../src/workerd-facet-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAaH,OAAO,EAIL,KAAK,aAAa,EAElB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EAEtB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC7B,MAAM,qBAAqB,CAAC;AAI7B,+DAA+D;AAC/D,MAAM,WAAW,0BAA0B;IACzC,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5D,KAAK,CAAC,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,gBAAgB;IAC/B,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE;QACjC,KAAK,EAAE;YACL,GAAG,EAAE,MAAM,CAAC;YACZ,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;YACpB,KAAK,EAAE,MAAM,CAAC;YACd,UAAU,EAAE;gBAAE,IAAI,EAAE,MAAM,CAAC;gBAAC,GAAG,EAAE,MAAM,CAAC;gBAAC,QAAQ,EAAE,MAAM,CAAA;aAAE,CAAC;YAC5D,KAAK,CAAC,EAAE,OAAO,CAAC;SACjB,CAAC;KACH,KAAK,0BAA0B,CAAC;CAClC;AAED,wBAAgB,mBAAmB,IAAI,gBAAgB,CAMtD;AAED;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAChD,UAAU,EAAE,gBAAgB,EAC5B,UAAU,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EAC3D,KAAK,EAAE,OAAO,EACd,IAAI,GAAE,MAAM,GAAG,IAAW,GACzB,OAAO,CAAC,0BAA0B,CAAC,CAarC;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,WAAa,CAAC;AAE1D;;;;;;;;;;;;;GAaG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAoBrF;AAgDD,gDAAgD;AAChD,UAAU,gBAAgB;IACxB,aAAa,IAAI,0BAA0B,CAAC;CAC7C;AAED;;;;;;;;GAQG;AACH,UAAU,mBAAmB;IAC3B,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG;QAAE,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAChG,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,gBAAgB,CAAC;CACvC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC9B;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,kBAAkB,EACvB,KAAK,EAAE;IACL,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACrD,GACA,OAAO,CAAC,IAAI,CAAC,CAuBf;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C,sEAAsE;AACtE,eAAO,MAAM,yBAAyB,iCAAiC,CAAC;AA8DxE;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,kBAAkB,GACtB,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAO/C;AAgED;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,kBAAkB,EACvB,GAAG,EAAE,gBAAgB,EACrB,IAAI,EAAE,MAAM,kBAAkB,EAC9B,UAAU,EAAE,uBAAuB,EACnC,MAAM,EAAE,iBAAiB,GACxB,aAAa,CA0Ef;AAiCD;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,GAAG,EAAE,kBAAkB,EACvB,GAAG,EAAE,gBAAgB,EACrB,UAAU,EAAE,uBAAuB,EACnC,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAC1C,OAAO,CAAC,CAAC,CAAC,CAgEZ"}
+{"version":3,"file":"workerd-facet-host.d.ts","sourceRoot":"","sources":["../src/workerd-facet-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAmBH,OAAO,EAGL,KAAK,aAAa,EAElB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EAEtB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC7B,MAAM,qBAAqB,CAAC;AAI7B,+DAA+D;AAC/D,MAAM,WAAW,0BAA0B;IACzC,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5D,KAAK,CAAC,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,gBAAgB;IAC/B,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE;QACjC,KAAK,EAAE;YACL,GAAG,EAAE,MAAM,CAAC;YACZ,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;YACpB,KAAK,EAAE,MAAM,CAAC;YACd,UAAU,EAAE;gBAAE,IAAI,EAAE,MAAM,CAAC;gBAAC,GAAG,EAAE,MAAM,CAAC;gBAAC,QAAQ,EAAE,MAAM,CAAA;aAAE,CAAC;YAC5D,KAAK,CAAC,EAAE,OAAO,CAAC;SACjB,CAAC;KACH,KAAK,0BAA0B,CAAC;CAClC;AAED,wBAAgB,mBAAmB,IAAI,gBAAgB,CAMtD;AAED;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAChD,UAAU,EAAE,gBAAgB,EAC5B,UAAU,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EAC3D,KAAK,EAAE,OAAO,EACd,IAAI,GAAE,MAAM,GAAG,IAAW,GACzB,OAAO,CAAC,0BAA0B,CAAC,CAarC;AA6BD,gDAAgD;AAChD,UAAU,gBAAgB;IACxB,aAAa,IAAI,0BAA0B,CAAC;CAC7C;AAED;;;;;;;;GAQG;AACH,UAAU,mBAAmB;IAC3B,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG;QAAE,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAChG,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,gBAAgB,CAAC;CACvC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC9B;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,kBAAkB,EACvB,KAAK,EAAE;IACL,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACrD,GACA,OAAO,CAAC,IAAI,CAAC,CAuBf;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AA+DD;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,GAAG,SAAS,CAEnF;AAED,qBAAa,SAAS;IAElB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBADH,GAAG,EAAE,kBAAkB,EACvB,GAAG,EAAE,gBAAgB;IAGxC,8EAA8E;IAC9E,KAAK,CACH,IAAI,EAAE,MAAM,kBAAkB,EAC9B,UAAU,EAAE,uBAAuB,EACnC,MAAM,EAAE,iBAAiB,GACxB,aAAa;IAIhB;;;;;;;;;;;;OAYG;IACH,GAAG,CAAC,CAAC,EACH,UAAU,EAAE,uBAAuB,EACnC,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAC1C,OAAO,CAAC,CAAC,CAAC;CAGd"}

package/dist/workerd-facet-host.js

@@ -12,10 +12,10 @@
  * that is not a Durable Object implements `ProcessHost` against the same
  * `HostedProcess` and never imports this file.
  */
-import { disposeRpcResource } from '@nimbus-sh/core/_shared/rpc-dispose.js';
-import { getCtxExports, supervisorEntrypoint, supervisorEntrypointName, } from './ctx-exports.js';
-import { beginLoaderFetch, recordLoaderId, withDynamicWorkerCapNamed, } from './loader-ledger.js';
-import { RESIDENT_PROCESS_CLASS, requireStagedBootAssembler, residentLoaderConfig, } from './process-fabric.js';
+import { disposeRpcResource } from '@nimbus-sh/platform/rpc-dispose.js';
+import { getCtxExports, stagedBootAssembler, supervisorEntrypoint, supervisorEntrypointName, } from './composition.js';
+import { assertModuleMapWithinCodeLimit, beginLoaderFetch, facetNameCount, facetNameCountDurable, recordFacetNameMinted, recordLoaderId, withDynamicWorkerCapNamed, withFacetBudgetNamed, } from './budgets.js';
+import { RESIDENT_PROCESS_CLASS, residentLoaderConfig, } from './process-fabric.js';
 export function getNimbusCtxExports() {
     const ctxExports = getCtxExports();
     if (!ctxExports || typeof ctxExports !== 'object') {
@@ -43,69 +43,6 @@ export async function createLoadedWorkerEntrypoint(ctxExports, supervisor, stage
         },
     });
 }
-/**
- * Total bytes a dynamic Worker's module map may carry, across every member of
- * it. A hard platform limit, not a policy knob: 62 MiB lands and 64 MiB is
- * refused with "Dynamic Worker code size (N bytes) exceeds the maximum allowed
- * size of 67108864 bytes", confirmed at five sizes with two trials each. The
- * budget is shared, so a ruby process is already 34.3 MiB down before its disk
- * is counted.
- */
-export const DYNAMIC_WORKER_CODE_LIMIT_BYTES = 67_108_864;
-/**
- * Refuse a module map over {@link DYNAMIC_WORKER_CODE_LIMIT_BYTES}, naming
- * the largest members. The platform's own refusal reports one number for a
- * budget shared across every member of the map, which tells the operator
- * nothing about WHAT to shrink — so every fabric seam that assembles a map
- * runs this before the loader sees it.
- *
- * Costed to its two paths. Under the ceiling: one length read per member —
- * UTF-16 code units for text, which equal UTF-8 bytes for the ASCII module
- * text the generators emit and undercount otherwise; the platform's own
- * refusal still backstops the exotic case, because this check exists to name
- * members, not to be the ceiling. Over it: exact UTF-8 sizes, computed only
- * then, sorted so the biggest lever is first.
- */
-export function assertModuleMapWithinCodeLimit(modules) {
-    let estimate = 0;
-    for (const content of Object.values(modules)) {
-        estimate += memberBytes(content, null);
-    }
-    if (estimate <= DYNAMIC_WORKER_CODE_LIMIT_BYTES)
-        return;
-    const encoder = new TextEncoder();
-    const sized = Object.entries(modules)
-        .map(([name, content]) => ({ name, bytes: memberBytes(content, encoder) }))
-        .sort((a, b) => b.bytes - a.bytes);
-    const total = sized.reduce((sum, member) => sum + member.bytes, 0);
-    const top = sized.slice(0, 5)
-        .map(({ name, bytes }) => `'${name}' (${bytes.toLocaleString('en-US')} bytes)`)
-        .join(', ');
-    throw new Error(`Nimbus: dynamic-worker module map is ${total.toLocaleString('en-US')} bytes, over the `
-        + `${DYNAMIC_WORKER_CODE_LIMIT_BYTES.toLocaleString('en-US')}-byte platform ceiling shared by `
-        + `every member. Largest members: ${top}`);
-}
-/**
- * Bytes one module-map member carries, across the loader's content kinds
- * (plain string, `{ js | cjs | py | text }`, `{ wasm | data }`). With an
- * encoder, text is measured exactly; without one, by code-unit length.
- */
-function memberBytes(content, encoder) {
-    const textBytes = (text) => encoder ? encoder.encode(text).byteLength : text.length;
-    if (typeof content === 'string')
-        return textBytes(content);
-    if (content !== null && typeof content === 'object') {
-        for (const value of Object.values(content)) {
-            if (typeof value === 'string')
-                return textBytes(value);
-            if (value instanceof ArrayBuffer)
-                return value.byteLength;
-            if (ArrayBuffer.isView(value))
-                return value.byteLength;
-        }
-    }
-    return 0;
-}
 function facetContainer(ctx) {
     const facets = ctx.facets;
     if (!facets || typeof facets.get !== 'function') {
@@ -142,7 +79,7 @@ function facetContainer(ctx) {
  * storage budget grants no copy-on-write credit — crossing it resets the
  * object rather than raising an error.
  */
-export async function cloneFacetStorage(ctx, clone) {
+export async function cloneStorage(ctx, clone) {
     const facets = facetContainer(ctx);
     if (typeof facets.clone !== 'function') {
         throw new Error('Nimbus: ctx.facets.clone is unavailable in this runtime; the reflink image '
@@ -177,15 +114,6 @@ export async function cloneFacetStorage(ctx, clone) {
 export function residentFacetName(slot) {
     return `proc-slot-${slot}`;
 }
-/**
- * Facet IDs a Durable Object is granted over its LIFETIME. Append-only and
- * never reclaimed, so crossing it is unrecoverable for the object — which is
- * why the ledger below counts consumption durably instead of leaving the
- * bound as prose the slot book merely respects.
- */
-export const FACET_ID_LIFETIME_BUDGET = 65_536;
-/** Where the ledger persists the count of facet names ever minted. */
-export const FACET_NAME_HIGH_WATER_KEY = 'fabric_facet_name_high_water';
 /**
  * Slot books, per hosting actor, because the facet index is per Durable
  * Object.
@@ -205,42 +133,11 @@ const slotBooks = new WeakMap();
 function slotBook(ctx) {
     let book = slotBooks.get(ctx);
     if (!book) {
-        const created = {
-            free: [],
-            next: 0,
-            held: new Map(),
-            ledger: Promise.resolve(0),
-            ledgerKnown: 0,
-        };
-        created.ledger = Promise.resolve(ctx.storage.get(FACET_NAME_HIGH_WATER_KEY))
-            .then((value) => (typeof value === 'number' ? value : 0))
-            .catch(() => 0)
-            .then((adopted) => {
-            created.ledgerKnown = Math.max(created.ledgerKnown, adopted);
-            return adopted;
-        });
-        book = created;
+        book = { free: [], next: 0, held: new Map() };
         slotBooks.set(ctx, book);
     }
     return book;
 }
-/**
- * The lifetime facet-ID ledger: how many facet names this fabric has ever
- * minted on the Durable Object, against the 65,536 the platform will ever
- * grant it. `consumed` only ever counts FIRST uses — a reused name, in this
- * incarnation or any earlier one, cost no new ID, which is the slot book's
- * whole reason to exist. Surfaced so an operator can see proximity to a wall
- * whose crossing is unrecoverable, instead of discovering it from the
- * platform's opaque failure.
- */
-export async function facetIdBudget(ctx) {
-    const book = slotBook(ctx);
-    const durable = await book.ledger;
-    return {
-        consumed: Math.max(durable, book.next),
-        budget: FACET_ID_LIFETIME_BUDGET,
-    };
-}
 /** Take a slot for `pid`, reusing a returned one before minting a new name. */
 function acquireSlot(ctx, pid) {
     const book = slotBook(ctx);
@@ -250,47 +147,12 @@ function acquireSlot(ctx, pid) {
     const reused = book.free.length > 0;
     const slot = reused ? book.free.shift() : book.next++;
     book.held.set(pid, slot);
+    // A fresh name is a permanently consumed facet ID; the durable count lives
+    // in the budgets ledger (see budgets.ts).
     if (!reused)
-        recordNameMinted(ctx, book);
+        recordFacetNameMinted(ctx, book.next);
     return slot;
 }
-/**
- * Advance the durable ledger to this incarnation's name count, if it is a new
- * lifetime high. Chained behind adoption so the comparison is always against
- * the real persisted value; a failed write leaves the old link's count and the
- * next mint tries again — the ledger may transiently undercount, never over.
- */
-function recordNameMinted(ctx, book) {
-    const count = book.next;
-    book.ledger = book.ledger.then(async (durable) => {
-        if (count <= durable)
-            return durable;
-        try {
-            await ctx.storage.put(FACET_NAME_HIGH_WATER_KEY, count);
-        }
-        catch {
-            return durable;
-        }
-        book.ledgerKnown = Math.max(book.ledgerKnown, count);
-        return count;
-    });
-}
-/**
- * Name the facet-ID budget on a creation failure at the wall; below it, hand
- * the error back untouched. Exhaustion is the one failure here the platform
- * reports opaquely AND that no teardown, retry or reset can undo, so the
- * ledger — the only witness to the real cause — does the naming. Not a
- * threshold: the comparison is against the budget itself.
- */
-function withFacetBudgetNamed(consumed, error) {
-    if (consumed < FACET_ID_LIFETIME_BUDGET)
-        return error;
-    const platform = error instanceof Error ? error.message : String(error);
-    return new Error(`Nimbus: facet creation failed with this Durable Object's `
-        + `${FACET_ID_LIFETIME_BUDGET.toLocaleString('en-US')} facet-ID lifetime budget consumed `
-        + `(${consumed} facet names ever created). Facet IDs are append-only and never reclaimed, `
-        + `so this failure is permanent for the object: ${platform}`, { cause: error });
-}
 /** Return `pid`'s slot to the free list. */
 function releaseSlot(ctx, pid) {
     const book = slotBook(ctx);
@@ -302,19 +164,49 @@ function releaseSlot(ctx, pid) {
     book.free.sort((a, b) => a - b);
 }
 /**
- * Open a resident process as a facet of the actor whose `ctx` and `env` are
- * given, and start its runner.
+ * The process surface of one hosting actor: how a resident process comes
+ * into existence on workerd, and how a one-shot program runs to completion.
  *
- * This is the ONE way a resident process comes into existence, and every
+ * `spawn` is the ONE way a resident process comes into existence, and every
  * substrate goes through it: the facet host calls it with the coordinator's
  * own `ctx`, the peer host calls it — over one RPC — with a sibling session
  * DO's. Everything a substrate could plausibly want to special-case is a
  * PARAMETER here rather than a branch: which actor hosts the child, and how
  * the boot spec's by-path members are read.
  */
-export function openResidentFacet(ctx, env, disk, supervisor, params) {
+export function processes(ctx, env) {
+    return new Processes(ctx, env);
+}
+export class Processes {
+    ctx;
+    env;
+    constructor(ctx, env) {
+        this.ctx = ctx;
+        this.env = env;
+    }
+    /** Open a resident process as a facet of this actor, and start its runner. */
+    spawn(disk, supervisor, params) {
+        return spawnResident(this.ctx, this.env, disk, supervisor, params);
+    }
+    /**
+     * Run one program to completion as an UNKEYED dynamic worker.
+     *
+     * Unkeyed is the whole difference from `spawn`: nothing can re-resolve this
+     * worker into a later request's context, so it can never be a routeable
+     * target and never has to be released by name. It exists for the duration
+     * of one call and its stubs are dropped as that call unwinds.
+     *
+     * Shared by both substrates on purpose. `peer` places processes that have a
+     * residency to place; a one-shot has none, and shipping its fully-inline
+     * map across a sibling hop would meet the 32 MiB RPC ceiling that by-path
+     * boot specs exist to avoid — for a run that gains nothing by moving.
+     */
+    run(supervisor, params, consume) {
+        return runOneShot(this.ctx, this.env, supervisor, params, consume);
+    }
+}
+function spawnResident(ctx, env, disk, supervisor, params) {
     const facets = facetContainer(ctx);
-    const book = slotBook(ctx);
     const slot = acquireSlot(ctx, params.pid);
     const name = residentFacetName(slot);
     // The start callback is the ONLY way this facet is ever created, and it
@@ -342,7 +234,7 @@ export function openResidentFacet(ctx, env, disk, supervisor, params) {
     }
     catch (error) {
         releaseSlot(ctx, params.pid);
-        throw withFacetBudgetNamed(Math.max(book.ledgerKnown, book.next), error);
+        throw withFacetBudgetNamed(facetNameCount(ctx), error);
     }
     let disposed = false;
     const release = async () => {
@@ -368,15 +260,14 @@ export function openResidentFacet(ctx, env, disk, supervisor, params) {
     }
     catch (error) {
         void release();
-        throw withFacetBudgetNamed(Math.max(book.ledgerKnown, book.next), error);
+        throw withFacetBudgetNamed(facetNameCount(ctx), error);
     }
     // The rejection that carries the platform's failure at ID exhaustion is
     // this one, and it is annotated AFTER awaiting the ledger — the first
     // failure of a fresh incarnation must compare against the persisted count,
     // not the zero its adoption read has not yet replaced.
     started = started.catch(async (error) => {
-        const durable = await book.ledger;
-        throw withFacetBudgetNamed(Math.max(durable, book.next), error);
+        throw withFacetBudgetNamed(await facetNameCountDurable(ctx), error);
     });
     // A caller reads whichever of `started` and the lifecycle it needs, so keep
     // the runtime from reporting the other as an unhandled rejection.
@@ -415,20 +306,7 @@ function residentProcessClass(ctx, env, disk, supervisor, params) {
         throw withDynamicWorkerCapNamed(ctx, error);
     }
 }
-/**
- * Run one program to completion as an UNKEYED dynamic worker.
- *
- * Unkeyed is the whole difference from `openResidentFacet`: nothing can
- * re-resolve this worker into a later request's context, so it can never be a
- * routeable target and never has to be released by name. It exists for the
- * duration of one call and its stubs are dropped as that call unwinds.
- *
- * Shared by both substrates on purpose. `peer` places processes that have a
- * residency to place; a one-shot has none, and shipping its fully-inline map
- * across a sibling hop would meet the 32 MiB RPC ceiling that by-path boot
- * specs exist to avoid — for a run that gains nothing by moving.
- */
-export async function runOneShotWorker(ctx, env, supervisor, params, consume) {
+async function runOneShot(ctx, env, supervisor, params, consume) {
     const loader = env.LOADER;
     if (!loader || typeof loader.load !== 'function') {
         throw new Error('Nimbus: env.LOADER binding missing or invalid. Running a program requires '
@@ -497,7 +375,7 @@ export async function runOneShotWorker(ctx, env, supervisor, params, consume) {
 }
 async function residentWorkerConfig(env, disk, supervisor, boot) {
     const config = boot.kind === 'staged'
-        ? await requireStagedBootAssembler()(env, boot.stage)
+        ? await stagedBootAssembler()(env, boot.stage)
         : await residentLoaderConfig(boot.code, disk());
     assertModuleMapWithinCodeLimit(config.modules ?? {});
     const supervisorRpc = supervisorEntrypoint();