@nimbus-sh/fabric 0.4.0 → 0.6.0

package/dist/isolate-pool.d.ts

@@ -75,6 +75,15 @@ export interface IsolatePoolOptions {
      * not receive a Supervisor binding and do not retain user state.
      */
     cacheScope?: 'session' | 'global';
+    /**
+     * Baked into the loader id. Two pools sharing tag, preamble, wasm and
+     * supervisor but differing in `scope` never reuse each other's warm
+     * workers: an interpreter scope that ENDS (REPL close, Ctrl-C reset)
+     * must not resurrect the loader-cached heap for the next owner.
+     * Default '' preserves the existing id bytes — only scoped pools get
+     * the extra segment.
+     */
+    scope?: string;
     /**
      * Override the `doId` baked into the auto-injected SUPERVISOR binding.
      * Default: `ctx.id.toString()` (the DO that constructs the pool).
@@ -235,6 +244,18 @@ export declare class IsolatePool {
     private readonly defaultRetries;
     private readonly tag;
     private readonly slotGenerations;
+    /**
+     * Per-slot execution ownership: the tail of each slot's in-flight
+     * dispatch chain. Two dispatches on the same warm isolate at once
+     * interleave on its QueueState — map() callers used to trust the
+     * caller's slot round-robin, which could not prevent submit() (slot
+     * 0) or a second map() landing on a slot a task still occupied. Every
+     * dispatch now waits for the slot's previous execution to settle
+     * before touching it.
+     */
+    private readonly slotTails;
+    /** Set by dispose() — queued dispatches reject instead of running. */
+    private disposed;
     private bindings;
     private readonly preamble;
     private readonly preambleHash;
@@ -262,6 +283,15 @@ export declare class IsolatePool {
      * 12 chars is enough entropy for DO ids to collide-free per process.
      */
     private readonly doIdShort;
+    /**
+     * The supervisor identity the minted worker's env.SUPERVISOR binding
+     * bakes (doId short-form + pid), folded into the loader cache key. 's-none'
+     * when no SUPERVISOR binding was minted, so a supervisor-less pool keeps
+     * the old key shape and its warm slots stay shared.
+     */
+    private readonly supervisorKey;
+    /** Extra loader-id segment from options.scope — see IsolatePoolOptions. */
+    private readonly scope;
     constructor(env: unknown, ctx: DurableObjectState, opts?: IsolatePoolOptions);
     /** Effective concurrency used when no per-call override is supplied. */
     get defaultConcurrency(): number;
@@ -270,6 +300,16 @@ export declare class IsolatePool {
      * throws TimeoutError / RetryExhaustedError / ExecutionError.
      */
     submit<T, R>(fn: FacetTaskFn<T, R>, arg: T, opts?: IsolateCallOptions): Promise<Awaited<R>>;
+    /**
+     * Dispatch `fn` through the fetch transport — the pool's only
+     * cancellable path: aborting `request.signal` cancels the inner
+     * execution context at its next I/O suspension (a synchronous CPU
+     * section cannot be preempted — the platform's honest limit), the
+     * call rejects, and the slot generation bumps so the next dispatch
+     * gets a fresh interpreter. `fn` is request-shaped: it encodes and
+     * decodes its own payload.
+     */
+    submitRequest(fn: (request: Request, env: FacetBindings) => Response | Promise<Response>, request: Request, opts?: IsolateCallOptions): Promise<Response>;
     /**
      * Run `fn` on every item in `items`, at most `concurrency` at a time,
      * pinned to stable slots so warm isolates are reused.

package/dist/isolate-pool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"isolate-pool.d.ts","sourceRoot":"","sources":["../src/isolate-pool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAgBH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,KAAK,EAAiB,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAErE;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,CAAC,CAAC,EAAE,CAAC,IAAI;IAC9B,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,aAAa,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACnD,CAAC,MAAM,CAAC,CAAC;AAEV,wEAAwE;AACxE,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,mDAAmD;AACnD,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAC;IAClC;;;;;;;;;;;;;;;;OAgBG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CAC3C;AAED,qDAAqD;AACrD,MAAM,WAAW,kBAAkB;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CAC3C;AAED,oEAAoE;AACpE,MAAM,WAAW,iBAAkB,SAAQ,kBAAkB;IAC3D,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;CACrC;AAkCD,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1D,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,8EAA8E;AAC9E,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,+BAA+B,GACvC,MAAM,CAyDR;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,WAAW;;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAqB;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA6B;IAC7D,OAAO,CAAC,QAAQ,CAAsC;IAEtD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAC9C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,WAAW,CAOzB;IACH;;;;4DAIwD;IACxD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC;;;;;;;;;OASG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAGjC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,kBAAkB,EACvB,IAAI,CAAC,EAAE,kBAAkB;IAmG3B,wEAAwE;IACxE,IAAI,kBAAkB,IAAI,MAAM,CAE/B;IA8VD;;;OAGG;IACG,MAAM,CAAC,CAAC,EAAE,CAAC,EACf,EAAE,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,EACrB,GAAG,EAAE,CAAC,EACN,IAAI,CAAC,EAAE,kBAAkB,GACxB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAatB;;;;;OAKG;IACG,GAAG,CAAC,CAAC,EAAE,CAAC,EACZ,EAAE,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,EACrB,KAAK,EAAE,CAAC,EAAE,EACV,IAAI,CAAC,EAAE,iBAAiB,GACvB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAOpC;;;;;;;;;;;;;;;;OAgBG;IACG,SAAS,CAAC,CAAC,EAAE,CAAC,EAClB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,CAAC,EAAE,EACV,IAAI,CAAC,EAAE,iBAAiB,GACvB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IA+DpC;;;;;;;;;;;;;;OAcG;IACH,OAAO,IAAI,IAAI;CAQhB"}
+{"version":3,"file":"isolate-pool.d.ts","sourceRoot":"","sources":["../src/isolate-pool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAgBH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,KAAK,EAAiB,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAErE;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,CAAC,CAAC,EAAE,CAAC,IAAI;IAC9B,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,aAAa,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACnD,CAAC,MAAM,CAAC,CAAC;AAEV,wEAAwE;AACxE,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,mDAAmD;AACnD,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAC;IAClC;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;;;;OAgBG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CAC3C;AAED,qDAAqD;AACrD,MAAM,WAAW,kBAAkB;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CAC3C;AAED,oEAAoE;AACpE,MAAM,WAAW,iBAAkB,SAAQ,kBAAkB;IAC3D,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;CACrC;AAkCD,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1D,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,8EAA8E;AAC9E,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,+BAA+B,GACvC,MAAM,CAgFR;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,WAAW;;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAqB;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA6B;IAC7D;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAC9D,sEAAsE;IACtE,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,QAAQ,CAAsC;IAEtD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAC9C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,WAAW,CAOzB;IACH;;;;4DAIwD;IACxD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC;;;;;;;;;OASG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IAEvC,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAE7B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,kBAAkB,EACvB,IAAI,CAAC,EAAE,kBAAkB;IA+G3B,wEAAwE;IACxE,IAAI,kBAAkB,IAAI,MAAM,CAE/B;IAyZD;;;OAGG;IACG,MAAM,CAAC,CAAC,EAAE,CAAC,EACf,EAAE,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,EACrB,GAAG,EAAE,CAAC,EACN,IAAI,CAAC,EAAE,kBAAkB,GACxB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAatB;;;;;;;;OAQG;IACG,aAAa,CACjB,EAAE,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,EAC1E,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE,kBAAkB,GACxB,OAAO,CAAC,QAAQ,CAAC;IAwBpB;;;;;OAKG;IACG,GAAG,CAAC,CAAC,EAAE,CAAC,EACZ,EAAE,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,EACrB,KAAK,EAAE,CAAC,EAAE,EACV,IAAI,CAAC,EAAE,iBAAiB,GACvB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAOpC;;;;;;;;;;;;;;;;OAgBG;IACG,SAAS,CAAC,CAAC,EAAE,CAAC,EAClB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,CAAC,EAAE,EACV,IAAI,CAAC,EAAE,iBAAiB,GACvB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IA+DpC;;;;;;;;;;;;;;OAcG;IACH,OAAO,IAAI,IAAI;CAShB"}

package/dist/isolate-pool.js

@@ -85,7 +85,10 @@ export function assembleLoaderWorkerModuleSource(options) {
     const callExpr = options.hasBindings
         ? '__fn__(...args, this.env)'
         : '__fn__(...args)';
-    lines.push('export default class extends WorkerEntrypoint {', '  execute(...args) {', `    const result = ${callExpr};`, '    if (result instanceof Promise) return result;', '    return result;', '  }', '}');
+    const requestCallExpr = options.hasBindings
+        ? '__fn__(request, this.env)'
+        : '__fn__(request)';
+    lines.push('export default class extends WorkerEntrypoint {', '  execute(...args) {', `    const result = ${callExpr};`, '    if (result instanceof Promise) return result;', '    return result;', '  }', '', '  // Request/Response transport: the ONE dispatch path whose abort is', '  // real. workerd cancels the inner execution context when the request', '  // signal aborts while the fn is suspended on I/O; RPC execute() above', '  // has no equivalent (measured: Symbol.dispose on a pending RPC does', '  // not cancel). The fn is request-shaped — it encodes and decodes its', '  // own payload; nothing generic is serialized here.', '  async fetch(request) {', '    try {', `      const result = await ${requestCallExpr};`, '      if (result instanceof Response) return result;', '      return Response.json(result ?? null);', '    } catch (err) {', '      // Fail loud inside the response so an abort of the transport is', '      // not conflated with a guest exception: the caller sees 500 only', '      // for a real fn failure, and aborts arrive as fetch rejections.', '      const message = err instanceof Error && err.message ? err.message : String(err);', '      return Response.json({ __nimbusFacetError: message }, { status: 500 });', '    }', '  }', '}');
     return lines.join('\n');
 }
 /**
@@ -113,6 +116,18 @@ export class IsolatePool {
     defaultRetries;
     tag;
     slotGenerations = new Map();
+    /**
+     * Per-slot execution ownership: the tail of each slot's in-flight
+     * dispatch chain. Two dispatches on the same warm isolate at once
+     * interleave on its QueueState — map() callers used to trust the
+     * caller's slot round-robin, which could not prevent submit() (slot
+     * 0) or a second map() landing on a slot a task still occupied. Every
+     * dispatch now waits for the slot's previous execution to settle
+     * before touching it.
+     */
+    slotTails = new Map();
+    /** Set by dispose() — queued dispatches reject instead of running. */
+    disposed = false;
     bindings;
     preamble;
     preambleHash;
@@ -140,6 +155,15 @@ export class IsolatePool {
      * 12 chars is enough entropy for DO ids to collide-free per process.
      */
     doIdShort;
+    /**
+     * The supervisor identity the minted worker's env.SUPERVISOR binding
+     * bakes (doId short-form + pid), folded into the loader cache key. 's-none'
+     * when no SUPERVISOR binding was minted, so a supervisor-less pool keeps
+     * the old key shape and its warm slots stay shared.
+     */
+    supervisorKey;
+    /** Extra loader-id segment from options.scope — see IsolatePoolOptions. */
+    scope;
     constructor(env, ctx, opts) {
         // A host hands its whole env over; the binding is claimed here and the
         // claim is checked on the next line.
@@ -161,6 +185,7 @@ export class IsolatePool {
         this.doIdShort = opts?.cacheScope === 'global'
             ? 'global'
             : ctx.id.toString().slice(0, 12);
+        this.scope = opts?.scope ?? '';
         // Materialise the wasm-modules table. Sanitise each name into a
         // valid JS identifier for the static import binding; key collisions
         // (e.g. 'esbuild.wasm' and 'esbuild_wasm' both sanitise to
@@ -207,6 +232,7 @@ export class IsolatePool {
             this.wasmHash = hashSource(fp);
         }
         const bindings = { ...(opts?.extraBindings ?? {}) };
+        this.supervisorKey = 's-none';
         if (!opts?.omitSupervisor) {
             const supervisorRpc = supervisorEntrypoint();
             if (supervisorRpc) {
@@ -215,9 +241,19 @@ export class IsolatePool {
                 // to the user's session DO, not the peer DO. Default to the
                 // local ctx.id (single-DO callers and the in-DO in-DO fanout path).
                 const supDoId = opts?.supervisorDoIdOverride ?? ctx.id.toString();
+                const supPid = opts?.supervisorPid ?? 0;
                 bindings.SUPERVISOR = supervisorRpc({
-                    props: { doId: supDoId, pid: opts?.supervisorPid ?? 0 },
+                    props: { doId: supDoId, pid: supPid },
                 });
+                // Whatever the minted worker's env carries must be in its loader
+                // cache key — workerd's loader cache survives a DO hibernation
+                // wake while generation-strided pids (1000001 → 2000001) do not:
+                // a warm slot keyed without the supervisor identity returns in
+                // the new generation still credentialed to the dead pid, and
+                // every pid-authorized RPC from it fails "process pid … does
+                // not exist". doIdShort alone cannot cover this — it changes
+                // across sessions, not across wakes of the same session.
+                this.supervisorKey = `s${supDoId.slice(0, 12)}-${supPid}`;
             }
             else {
                 // Supervisor entrypoint unavailable — running without ctx.exports
@@ -398,8 +434,41 @@ export class IsolatePool {
     /**
      * Dispatch a single task to the slot isolate. `slotIndex` picks which
      * warm isolate services the call; callers round-robin slots themselves.
+     * Serialized per slot: this call waits for the slot's previous
+     * execution to settle before touching the warm isolate.
+     *
+     * `invoke` is the single-attempt call against the slot's entrypoint
+     * stub. `execute` dispatches call `entrypoint.execute(...args)`;
+     * `fetch` dispatches call `entrypoint.fetch(<per-attempt Request>)` —
+     * the attempt index lets a fetch invoke mint a fresh clone for retries,
+     * since a Request's body is consumed once.
      */
-    async #dispatchSlot(fnSource, fnHash, slotIndex, args, resilience, perCallWasm) {
+    async #dispatchSlot(fnSource, fnHash, slotIndex, invoke, resilience, perCallWasm, wasAborted) {
+        // A warm slot executes one dispatch at a time: queue behind the
+        // previous owner, then record this dispatch as the new tail. The
+        // tail outlives the caller's outcome: a timeout rejects the
+        // Promise.race while runOnce's RPC is still live on the Worker, so
+        // release waits for every execution the owned body started to
+        // settle — never the caller's settle alone.
+        const previous = this.slotTails.get(slotIndex) ?? Promise.resolve();
+        let release;
+        this.slotTails.set(slotIndex, new Promise((resolve) => { release = resolve; }));
+        await previous;
+        if (this.disposed) {
+            release();
+            throw new BindingError(`IsolatePool(${this.tag}) is disposed`);
+        }
+        const inFlight = [];
+        try {
+            return await this.#dispatchSlotOwned(fnSource, fnHash, slotIndex, invoke, resilience, perCallWasm, inFlight, wasAborted);
+        }
+        finally {
+            // Do not delay the caller's own outcome — the tail releases when
+            // the RPCs the body launched have actually settled.
+            void Promise.allSettled(inFlight).then(() => release());
+        }
+    }
+    async #dispatchSlotOwned(fnSource, fnHash, slotIndex, invoke, resilience, perCallWasm, inFlight, wasAborted) {
         // Per-call wasm fingerprint. Mixed into the cache key so two calls
         // with different bytes hit different slots (no cache poisoning).
         // For the common case (no per-call wasm) the fingerprint is '0',
@@ -407,11 +476,11 @@ export class IsolatePool {
         const perCallWasmEntries = this.#materialisePerCallWasm(perCallWasm);
         const perCallWasmHash = this.#fingerprintWasm(perCallWasmEntries);
         // Cache key includes the short DO id so warm isolates are scoped to
-        // ONE session. See the doIdShort field comment for why — without it,
-        // a later session's pool reuses the warm worker from a previous
-        // session (which still carries the old session's env.SUPERVISOR
-        // binding), and writeBatch RPCs land in the wrong DO's VFS.
-        const buildId = (generation) => `nfp:${this.tag}:${this.doIdShort}:${fnHash}:${this.preambleHash}:${this.wasmHash}:${perCallWasmHash}:slot-${slotIndex}:g${generation}`;
+        // ONE session (see the doIdShort field comment), and the supervisor
+        // identity so a wake of that same session can never reuse a warm
+        // worker whose SUPERVISOR binding still names the dead generation's
+        // pid. See the supervisorKey field comment for the failure mode.
+        const buildId = (generation) => `nfp:${this.tag}:${this.doIdShort}:${fnHash}:${this.preambleHash}:${this.wasmHash}:${perCallWasmHash}:${this.supervisorKey}:slot-${slotIndex}:g${generation}${this.scope ? `:${this.scope}` : ''}`;
         let id = buildId(this.slotGenerations.get(slotIndex) ?? 0);
         const code = this.#buildCode(fnSource, perCallWasmEntries);
         // W5 Lever 5: record the dispatch so /api/_diag/memory shows the
@@ -453,8 +522,7 @@ export class IsolatePool {
             // wrapped. See beginLoaderFetch for the measured DO-poisoning hazard.
             const endFetch = beginLoaderFetch(this.ctx);
             try {
-                const out = await entrypoint.execute(...args);
-                return out;
+                return await invoke(entrypoint, attempt);
             }
             catch (err) {
                 if (err instanceof Error) {
@@ -489,8 +557,10 @@ export class IsolatePool {
                     // See plan in close-plan-2026-04-28.
                     let timerId;
                     try {
+                        const attemptPromise = runOnce();
+                        inFlight.push(attemptPromise);
                         return await Promise.race([
-                            runOnce(),
+                            attemptPromise,
                             new Promise((_, reject) => {
                                 timerId = setTimeout(() => reject(new TimeoutError(resilience.timeoutMs)), resilience.timeoutMs);
                             }),
@@ -501,7 +571,9 @@ export class IsolatePool {
                             clearTimeout(timerId);
                     }
                 }
-                return await runOnce();
+                const attemptPromise = runOnce();
+                inFlight.push(attemptPromise);
+                return await attemptPromise;
             }
             catch (err) {
                 lastError = err instanceof Error ? err : new Error(String(err));
@@ -524,6 +596,18 @@ export class IsolatePool {
                     });
                 }
                 catch { /* fail-soft */ }
+                if (wasAborted?.()) {
+                    // The caller aborted this dispatch's Request. workerd cancelled
+                    // the isolate's execution context wherever it was suspended —
+                    // mid-syscall, mid-stream — so the interpreter's heap may hold
+                    // half-applied state. Bump the slot generation: the next
+                    // dispatch lands on a FRESH worker under a new id rather than
+                    // reusing the abandoned one. Retrying is wrong — the user
+                    // interrupted; surface the abort.
+                    const generation = (this.slotGenerations.get(slotIndex) ?? 0) + 1;
+                    this.slotGenerations.set(slotIndex, generation);
+                    throw lastError;
+                }
                 if (cause === 'clone_refused' && !retriedCloneRefusal) {
                     retriedCloneRefusal = true;
                     const generation = (this.slotGenerations.get(slotIndex) ?? 0) + 1;
@@ -567,7 +651,28 @@ export class IsolatePool {
     async submit(fn, arg, opts) {
         const { fnSource, fnHash } = this.#prepare(fn);
         const resilience = this.#resolve(opts);
-        return (await this.#dispatchSlot(fnSource, fnHash, 0, [arg], resilience, opts?.wasmModules));
+        return (await this.#dispatchSlot(fnSource, fnHash, 0, (entrypoint) => entrypoint.execute(arg), resilience, opts?.wasmModules));
+    }
+    /**
+     * Dispatch `fn` through the fetch transport — the pool's only
+     * cancellable path: aborting `request.signal` cancels the inner
+     * execution context at its next I/O suspension (a synchronous CPU
+     * section cannot be preempted — the platform's honest limit), the
+     * call rejects, and the slot generation bumps so the next dispatch
+     * gets a fresh interpreter. `fn` is request-shaped: it encodes and
+     * decodes its own payload.
+     */
+    async submitRequest(fn, request, opts) {
+        if (request.bodyUsed) {
+            throw new BindingError('IsolatePool.submitRequest: request body is already consumed — ' +
+                'pass an unconsumed Request so retries can re-issue it.');
+        }
+        const { fnSource, fnHash } = this.#prepare(fn);
+        const resilience = this.#resolve(opts);
+        // Every attempt fetches a clone: a Request's body is consumed once,
+        // so the caller's original stays unspent and retries get a fresh
+        // body that follows the same signal.
+        return this.#dispatchSlot(fnSource, fnHash, 0, (entrypoint) => entrypoint.fetch(request.clone()), resilience, opts?.wasmModules, () => request.signal.aborted);
     }
     /**
      * Run `fn` on every item in `items`, at most `concurrency` at a time,
@@ -616,7 +721,7 @@ export class IsolatePool {
                 if (idx >= items.length)
                     return;
                 try {
-                    const value = (await this.#dispatchSlot(fnSource, fnHash, slotIndex, [items[idx]], resilience, opts?.wasmModules));
+                    const value = (await this.#dispatchSlot(fnSource, fnHash, slotIndex, (entrypoint) => entrypoint.execute(items[idx]), resilience, opts?.wasmModules));
                     settled[idx] = { ok: true, value };
                 }
                 catch (err) {
@@ -655,6 +760,7 @@ export class IsolatePool {
      * Safe to call more than once; idempotent.
      */
     dispose() {
+        this.disposed = true;
         if (!this.bindings)
             return;
         for (const key of Object.keys(this.bindings)) {

package/dist/process-host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process-host.d.ts","sourceRoot":"","sources":["../src/process-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AAKH,OAAO,EAGL,KAAK,WAAW,EAIhB,KAAK,kBAAkB,EAExB,MAAM,qBAAqB,CAAC;AAQ7B,4DAA4D;AAC5D,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,MAAM,CAAC;AAE/C;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,eAAe,EACrB,GAAG,EAAE,kBAAkB,EACvB,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,MAAM,kBAAkB,GAC7B,WAAW,CAIb;AA8ED,wBAAgB,YAAY,IAAI,MAAM,CAGrC;AAED,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,mBAAmB,EAAE,MAAM,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;IAC5B,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;IAC5B,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;CAC7B;AA2BD;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,8BAA8B,CAAC;AACvE,eAAO,MAAM,kCAAkC,yCAAyC,CAAC;AAgSzF;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAWhE"}
+{"version":3,"file":"process-host.d.ts","sourceRoot":"","sources":["../src/process-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AAOH,OAAO,EAGL,KAAK,WAAW,EAIhB,KAAK,kBAAkB,EAExB,MAAM,qBAAqB,CAAC;AAQ7B,4DAA4D;AAC5D,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,MAAM,CAAC;AAE/C;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,eAAe,EACrB,GAAG,EAAE,kBAAkB,EACvB,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,MAAM,kBAAkB,GAC7B,WAAW,CAIb;AA8ED,wBAAgB,YAAY,IAAI,MAAM,CAGrC;AAED,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,mBAAmB,EAAE,MAAM,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;IAC5B,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;IAC5B,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;CAC7B;AAaD;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,8BAA8B,CAAC;AACvE,eAAO,MAAM,kCAAkC,yCAAyC,CAAC;AAgUzF;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAWhE"}

package/dist/process-host.js

@@ -66,6 +66,8 @@
 import { disposeRpcResource } from '@nimbus-sh/platform/rpc-dispose.js';
 import { isTransientDoReset } from '@nimbus-sh/platform/oom-classify.js';
 import { PEER_RETRY_BACKOFF_MS, PEER_TRANSIENT_RESET_RETRIES } from './fanout.js';
+import { hostNamespaceBinding, hostOpDispatch } from './host-dispatch.js';
+import { z } from 'zod/v4';
 import { DYNAMIC_WORKER_CODE_LIMIT_BYTES } from './budgets.js';
 import { BindingError } from './vendor/errors.js';
 import { processes, } from './workerd-facet-host.js';
@@ -149,19 +151,6 @@ export function isolateToken() {
         _isolateToken = crypto.randomUUID();
     return _isolateToken;
 }
-/**
- * Every method a hosting sibling must answer. Checked as a set at first
- * contact: a stub that has the probe but not the router is a deployment skew,
- * and finding that out mid-process is finding it out too late.
- */
-const PROCESS_PEER_METHODS = [
-    '_rpcProcessHostProbe',
-    '_rpcHostProcess',
-    '_rpcAwaitHostedOpen',
-    '_rpcAwaitHostedBoot',
-    '_rpcRouteHostedHttp',
-    '_rpcCancelHostProcess',
-];
 /**
  * Which hosted process a fetched upgrade is for. An upgrade cannot travel as
  * RPC arguments, so the two values `_rpcRouteHostedHttp` would have taken ride
@@ -174,31 +163,66 @@ const PROCESS_PEER_METHODS = [
  */
 export const HOSTED_WEBSOCKET_KEY_HEADER = 'x-nimbus-hosted-websocket';
 export const HOSTED_WEBSOCKET_CAPABILITY_HEADER = 'x-nimbus-hosted-websocket-capability';
+/**
+ * Peer stubs forward one supervisorOp entrypoint: every method the host-
+ * process surface needs is an envelope op, not a private _rpc* method.
+ */
 function peerNamespace(env) {
-    const ns = (typeof env === 'object' || typeof env === 'function') && env !== null
-        ? Reflect.get(env, 'NIMBUS_SESSION')
-        : undefined;
-    if ((typeof ns !== 'object' && typeof ns !== 'function') || ns === null
-        || typeof Reflect.get(ns, 'idFromName') !== 'function'
-        || typeof Reflect.get(ns, 'get') !== 'function') {
-        throw new BindingError('ProcessFabric: env.NIMBUS_SESSION binding missing or invalid. '
-            + "NIMBUS_PROCESS_HOST='peer' hosts every resident process on a sibling "
-            + 'Durable Object; add the binding via durable_objects.bindings in wrangler.jsonc.');
+    try {
+        return hostNamespaceBinding(env, 'ProcessFabric');
+    }
+    catch (e) {
+        if (e instanceof BindingError) {
+            throw new BindingError(e.message
+                + " NIMBUS_PROCESS_HOST='peer' hosts every resident process on a sibling "
+                + "Durable Object; name the host's own binding with composeFabric({ hostNamespace }).");
+        }
+        throw e;
     }
-    return ns;
 }
+const PeerProbeResult = z.object({ isolateToken: z.string() });
+const PeerOpenResult = z.object({ ok: z.boolean() });
+const PeerBootResult = z.object({ payload: z.unknown() });
+const PeerCancelResult = z.object({ cancelled: z.boolean() });
+const PeerHttpResult = z.object({
+    status: z.number().int(),
+    statusText: z.string(),
+    headers: z.array(z.tuple([z.string(), z.string()])),
+    body: z.instanceof(ReadableStream).nullable(),
+});
 function processPeerStub(value, peerName) {
-    if ((typeof value !== 'object' && typeof value !== 'function') || value === null) {
-        throw new BindingError(`ProcessFabric: NIMBUS_SESSION.get() returned no stub for peer '${peerName}'.`);
+    const dispatch = hostOpDispatch(value, `ProcessFabric peer '${peerName}'`);
+    const fetchFn = (typeof value === 'object' || typeof value === 'function') && value !== null
+        ? Reflect.get(value, 'fetch')
+        : undefined;
+    if (typeof fetchFn !== 'function') {
+        throw new BindingError(`ProcessFabric: peer '${peerName}' exposes no fetch() — the hosted-websocket `
+            + 'upgrade leg still travels as a service-binding fetch.');
     }
-    for (const method of PROCESS_PEER_METHODS) {
-        if (typeof Reflect.get(value, method) !== 'function') {
-            throw new BindingError(`ProcessFabric: peer '${peerName}' does not expose ${method}(). `
-                + 'A sibling that answers some of the host-process surface and not the rest '
-                + 'would fail somewhere inside a running process instead of here.');
-        }
+    const adapter = {
+        _rpcProcessHostProbe: async () => PeerProbeResult.parse(await dispatch({ op: 'processHostProbe', args: [] })),
+        _rpcHostProcess: async (boot, opts) => PeerOpenResult.parse(await dispatch({ op: 'hostProcess', args: [boot, opts] })),
+        _rpcAwaitHostedOpen: async (key) => PeerOpenResult.parse(await dispatch({ op: 'awaitHostedOpen', args: [key] })),
+        _rpcAwaitHostedBoot: async (key) => {
+            const result = PeerBootResult.parse(await dispatch({ op: 'awaitHostedBoot', args: [key] }));
+            return { payload: result.payload };
+        },
+        _rpcRouteHostedHttp: async (key, request) => PeerHttpResult.parse(await dispatch({ op: 'routeHostedHttp', args: [key, request] })),
+        _rpcCancelHostProcess: async (key) => PeerCancelResult.parse(await dispatch({ op: 'cancelHostProcess', args: [key] })),
+        fetch: async (request) => {
+            const response = await Reflect.apply(fetchFn, value, [request]);
+            if (!(response instanceof Response))
+                throw new BindingError(`ProcessFabric: peer '${peerName}' returned no Response`);
+            return response;
+        },
+    };
+    // The adapter wraps the raw stub; releasing the adapter must release it —
+    // a held RPC stub pins the peer DO for the session's life.
+    const disposerKey = Reflect.get(Symbol, 'dispose');
+    if (typeof disposerKey === 'symbol') {
+        Object.defineProperty(adapter, disposerKey, { value: () => disposeRpcResource(value) });
     }
-    return value;
+    return adapter;
 }
 class PeerProcessHost {
     ctx;
@@ -219,6 +243,9 @@ class PeerProcessHost {
     tokensInUse = new Map();
     constructor(ctx, env) {
         this.ctx = ctx;
+        if (env === null || (typeof env !== 'object' && typeof env !== 'function')) {
+            throw new BindingError('ProcessFabric: a peer host requires environment bindings');
+        }
         this.ns = peerNamespace(env);
         this.env = (env ?? {});
         this.coordDoId = ctx.id.toString();
@@ -339,7 +366,7 @@ class PeerProcessHost {
     /** One sibling name, resolved and probed. Leaks nothing on failure. */
     async _probePlacement(pid, attempt) {
         const peerName = `${this.coordDoId}:proc:${pid}:${attempt}`;
-        let resource;
+        let resource = null;
         try {
             resource = this.ns.get(this.ns.idFromName(peerName));
             const stub = processPeerStub(resource, peerName);

package/dist/turn-budget.d.ts

@@ -58,10 +58,10 @@ export declare const TURN_CHUNK_MAX_BYTES = 2000000;
  * spent.
  *
  * Callers report the work they are about to do or have just done and await
- * the result; a pacer that is not yielding returns without suspending, so the
- * one-shot exec path — which passes no pacer at all — keeps its exact
- * behaviour and cost. Nothing here decides WHAT the launch does, only where it
- * is allowed to stop.
+ * the result; a pacer that is not yielding returns without suspending, so a
+ * build small enough to fit in one chunk — most one-shot execs, every cache
+ * hit — keeps its exact behaviour and cost. Nothing here decides WHAT the
+ * launch does, only where it is allowed to stop.
  */
 export declare class TurnBudget {
     private readonly scheduler;

package/dist/turn-budget.js

@@ -47,10 +47,10 @@ export const TURN_CHUNK_MAX_BYTES = 2_000_000;
  * spent.
  *
  * Callers report the work they are about to do or have just done and await
- * the result; a pacer that is not yielding returns without suspending, so the
- * one-shot exec path — which passes no pacer at all — keeps its exact
- * behaviour and cost. Nothing here decides WHAT the launch does, only where it
- * is allowed to stop.
+ * the result; a pacer that is not yielding returns without suspending, so a
+ * build small enough to fit in one chunk — most one-shot execs, every cache
+ * hit — keeps its exact behaviour and cost. Nothing here decides WHAT the
+ * launch does, only where it is allowed to stop.
  */
 export class TurnBudget {
     scheduler;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nimbus-sh/fabric",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "The Cloudflare half of Nimbus — Durable Object facet hosting, dynamic-worker loader pools, the resident-process fabric, and DO alarm/hibernation machinery.",
   "keywords": [
     "cloudflare",
@@ -46,12 +46,12 @@
   ],
   "scripts": {
     "build": "tsc -p tsconfig.json --noCheck --noEmit false --declaration true --declarationMap true --outDir dist --rootDir src",
-    "prepack": "npm run build",
+    "prepack": "bun run build",
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@nimbus-sh/core": "^0.8.0",
-    "@nimbus-sh/platform": "^0.3.0",
+    "@nimbus-sh/core": "^0.10.0",
+    "@nimbus-sh/platform": "^0.4.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {