@nimbus-sh/fabric 0.7.1 → 0.9.0

package/src/process-host.ts

@@ -65,7 +65,7 @@
  */
 
 import { disposeRpcResource } from '@nimbus-sh/platform/rpc-dispose.js';
-import { isTransientDoReset } from '@nimbus-sh/platform/oom-classify.js';
+import { classifyDoCall, isRetryableDoCall } from '@nimbus-sh/platform/oom-classify.js';
 import { PEER_RETRY_BACKOFF_MS, PEER_TRANSIENT_RESET_RETRIES } from './fanout.js';
 import { hostNamespaceBinding, hostOpDispatch, type HostNamespaceBinding } from './host-dispatch.js';
 import { z } from 'zod/v4';
@@ -85,7 +85,8 @@ import {
   processes,
   type ResidentFacetEnv,
 } from './workerd-facet-host.js';
-import { hostRoute, type HostRoute } from './composition.js';
+import type { HostRoute } from './composition.js';
+import { supervisorBindingProps } from './supervisor-props.js';
 
 /** The substrates this deployment can be configured for. */
 export type ProcessHostMode = 'facet' | 'peer';
@@ -138,19 +139,14 @@ class FacetProcessHost implements ProcessHost {
 
   runOnce<T>(params: OneShotParams, consume: (response: Response) => Promise<T>): Promise<T> {
     return processes(this.ctx, this.env).run(
-      { doId: this.coordDoId, pid: params.pid, writerId: params.writerId, route: hostRoute() ?? undefined },
+      { ...supervisorBindingProps(this.ctx, params.pid), writerId: params.writerId },
       params,
       consume,
     );
   }
 
   async open(params: ProcessHostParams): Promise<HostedProcess> {
-    const supervisor: ResidentSupervisorProps = {
-      doId: this.coordDoId,
-      pid: params.pid,
-      writerId: params.writerId,
-      route: hostRoute() ?? undefined,
-    };
+    const supervisor: ResidentSupervisorProps = { ...supervisorBindingProps(this.ctx, params.pid), writerId: params.writerId };
     const { name, ...facet } = processes(this.ctx, this.env).spawn(this.disk, supervisor, params);
     return {
       ...facet,
@@ -198,6 +194,8 @@ export interface HostProcessOpts {
   route?: HostRoute;
   pid: number;
   writerId: string;
+  /** The coordinator instance's delivery incarnation, minted into the SUPERVISOR binding (ResidentSupervisorProps). */
+  hostIncarnation?: string;
   workerKey: string;
   /** Unforgeable capability for the fetch-semantic WebSocket hop. */
   webSocketCapability: string;
@@ -358,7 +356,7 @@ class PeerProcessHost implements ProcessHost {
    */
   runOnce<T>(params: OneShotParams, consume: (response: Response) => Promise<T>): Promise<T> {
     return processes(this.ctx, this.env).run(
-      { doId: this.coordDoId, pid: params.pid, writerId: params.writerId, route: hostRoute() ?? undefined },
+      { ...supervisorBindingProps(this.ctx, params.pid), writerId: params.writerId },
       params,
       consume,
     );
@@ -383,11 +381,15 @@ class PeerProcessHost implements ProcessHost {
     // also what keeps the hosting DO resident. It settles when a `lifetime`
     // runner exits or when a `boot` runner's host is cancelled, and rejects if
     // the peer dies under either.
+    // The peer mints the process's binding from these, for THIS object: the
+    // coordinator's doId, route and delivery instance.
+    const supervisor = supervisorBindingProps(this.ctx, params.pid);
     const hostLeg = placement.stub._rpcHostProcess(params.boot, {
-      coordinatorDoId: this.coordDoId,
-      route: hostRoute() ?? undefined,
-      pid: params.pid,
+      coordinatorDoId: supervisor.doId,
+      route: supervisor.route,
+      pid: supervisor.pid,
       writerId: params.writerId,
+      hostIncarnation: supervisor.hostIncarnation,
       workerKey: params.workerKey,
       webSocketCapability,
       startArgs: params.startArgs,
@@ -496,7 +498,7 @@ class PeerProcessHost implements ProcessHost {
         }
         return probe;
       } catch (err) {
-        if (attempt < PEER_TRANSIENT_RESET_RETRIES && isTransientDoReset(err)) {
+        if (attempt < PEER_TRANSIENT_RESET_RETRIES && isRetryableDoCall(classifyDoCall(err))) {
           await new Promise((r) => setTimeout(
             r, PEER_RETRY_BACKOFF_MS[Math.min(attempt, PEER_RETRY_BACKOFF_MS.length - 1)],
           ));

package/src/supervisor-props.ts

@@ -0,0 +1,56 @@
+/**
+ * supervisor-props.ts — what every SUPERVISOR binding a Durable Object mints
+ * for a process carries, and the one rule for naming the instance in it.
+ *
+ * A binding names its host INSTANCE (`hostIncarnation`) exactly when a
+ * mutation sent through it can be delivered once
+ * (@nimbus-sh/core/workspace/supervisor-delivery.js): the host opened a
+ * delivery store, the binding acts as a real process (SupervisorRPC refuses
+ * every filesystem mutation of pid 0), and it routes back to this very
+ * object rather than another (a fanout pool writes to its coordinator).
+ * Minting every binding here is what keeps a new mint site from forgetting
+ * that, which would fail silently: its mutations would simply never be
+ * re-sent.
+ */
+
+import { supervisorDeliveryProps } from '@nimbus-sh/core/workspace/supervisor-delivery.js';
+import { hostRoute, type HostRoute } from './composition.js';
+
+/** The props every SUPERVISOR binding for a process carries. */
+export interface SupervisorBindingProps {
+  /** The Durable Object the binding's calls reach. */
+  doId: string;
+  /** The process the calls act as; 0 is none, and can mutate nothing. */
+  pid: number;
+  /** The way back, minted with the binding in the host's isolate. */
+  route?: HostRoute;
+  /** The host instance that applies this binding's mutations once, when there is one. */
+  hostIncarnation?: string;
+}
+
+/**
+ * The props of a SUPERVISOR binding minted in the Durable Object whose state
+ * is `ctx`, for process `pid`, reaching `options.doId` (this object by
+ * default) by `options.route` (this isolate's composition by default).
+ */
+export function supervisorBindingProps(
+  ctx: { readonly id: { toString(): string } },
+  pid: number,
+  options: { doId?: string; route?: HostRoute } = {},
+): SupervisorBindingProps {
+  const own = ctx.id.toString();
+  const doId = options.doId ?? own;
+  const route = options.route ?? hostRoute() ?? undefined;
+  const delivery = pid > 0 && doId === own ? supervisorDeliveryProps(ctx) : {};
+  return { doId, pid, route, ...delivery };
+}
+
+/**
+ * `key`, for a loader cache entry whose worker holds a binding with `props`:
+ * made specific to the host instance the binding names, since the loader
+ * outlives that instance and the next one refuses every mutation the binding
+ * would deliver. A binding that names none keeps `key`, and its warm worker.
+ */
+export function supervisorLoaderKey(key: string, props: Pick<SupervisorBindingProps, 'hostIncarnation'>): string {
+  return props.hostIncarnation === undefined ? key : `${key}:${props.hostIncarnation}`;
+}

package/src/timers.ts

@@ -58,9 +58,12 @@ export const TIMER_REASONS_KEY = 'w1_next_alarm_reasons';
  * The host instance carrying the per-instance timer chain. The field lives on
  * the embedder's DO instance so one chain serializes every timer-map
  * read-modify-write for that instance (see {@link Timers.schedule}).
+ * `_timerEpoch` counts {@link Timers.reset}s: a schedule or dispatch writes
+ * only while the epoch it was requested in is still current.
  */
 export interface TimerHost {
   _timerChain?: Promise<unknown>;
+  _timerEpoch?: number;
 }
 
 /**
@@ -159,6 +162,7 @@ export class Timers {
       arms.push({ reason, whenMs });
       return Promise.resolve(true);
     }
+    const epoch = host._timerEpoch ?? 0;
     // Serialize every read-modify-write of the reasons map through one
     // per-instance chain: two schedulers firing back-to-back from one activity
     // hook would otherwise interleave their get→put cycles and silently drop
@@ -170,15 +174,20 @@ export class Timers {
         const existing = (await ctx.storage.get(TIMER_REASONS_KEY)) as
           | Record<string, number>
           | undefined;
+        // Requested before a reset: it belongs to the timers the reset voided.
+        if ((host._timerEpoch ?? 0) !== epoch) return false;
         const map: Record<string, number> = { ...(existing || {}) };
         // Earliest-deadline-first: only update if new request is sooner or
         // this reason has no pending entry.
+        let written: Promise<unknown> | undefined;
         if (!(reason in map) || whenMs < map[reason]) {
           map[reason] = whenMs;
-          await ctx.storage.put(TIMER_REASONS_KEY, map);
+          written = ctx.storage.put(TIMER_REASONS_KEY, map);
         }
-        const earliest = Math.min(...Object.values(map));
-        setAlarmFn.call(ctx.storage, earliest);
+        // Issued in the turn the epoch was checked in: a reset after this
+        // point wipes and disarms after these, never before.
+        setAlarmFn.call(ctx.storage, Math.min(...Object.values(map)));
+        await written;
         return true;
       } catch (e) {
         console.warn('[nimbus/W1] timers.schedule threw:', errorText(e));
@@ -190,6 +199,18 @@ export class Timers {
     return chained;
   }
 
+  /**
+   * Void every timer of this instance: a schedule or dispatch already
+   * requested — still queued on the chain, or a dispatch whose handlers are
+   * running — writes no reason and arms no alarm from here on. For a
+   * deliberate end of the actor's state (a session destroy): call it before
+   * wiping storage and deleting the alarm, so nothing in flight writes the
+   * map back or re-arms after the wipe. Requests made after it proceed.
+   */
+  reset(): void {
+    this.host._timerEpoch = (this.host._timerEpoch ?? 0) + 1;
+  }
+
   /**
    * Multi-reason timer dispatcher. Called from the DO's `alarm()` handler
    * with the embedder's handler map.
@@ -216,19 +237,28 @@ export class Timers {
     alarmInfo?: TimerAlarmInfo,
   ): Promise<void> {
     const { host, ctx } = this;
+    const epoch = host._timerEpoch ?? 0;
+    const current = (): boolean => (host._timerEpoch ?? 0) === epoch;
     // Same serialization as schedule: the dispatcher's read→handlers→write
     // cycle must not interleave with an activity-hook schedule.
     const chained = (host._timerChain ?? Promise.resolve()).then(
-      () => dispatchBody(ctx, handlers, onLegacyAlarm, alarmInfo),
-      () => dispatchBody(ctx, handlers, onLegacyAlarm, alarmInfo),
+      () => dispatchBody(ctx, current, handlers, onLegacyAlarm, alarmInfo),
+      () => dispatchBody(ctx, current, handlers, onLegacyAlarm, alarmInfo),
     );
     host._timerChain = chained;
     return chained;
   }
 }
 
+/**
+ * One dispatch. `current` answers whether the epoch it was requested in still
+ * stands: once a reset voids it, no further handler runs and nothing is
+ * written or armed — the reset's caller is wiping this state, and a write
+ * after the wipe would outlive it.
+ */
 async function dispatchBody(
   ctx: TimerContext,
+  current: () => boolean,
   handlers: TimerHandlers,
   onLegacyAlarm?: () => void,
   alarmInfo?: TimerAlarmInfo,
@@ -242,6 +272,7 @@ async function dispatchBody(
     const existing = (await ctx?.storage?.get?.(TIMER_REASONS_KEY)) as
       | Record<string, number>
       | undefined;
+    if (!current()) return;
     const map: Record<string, number> = { ...(existing || {}) };
     const hadMap = Object.keys(map).length > 0;
     if (!hadMap) {
@@ -255,6 +286,7 @@ async function dispatchBody(
         if (when <= now) fired.push(reason);
       }
       for (const reason of fired) {
+        if (!current()) return;
         delete map[reason];
         const handler = handlers[reason];
         // Unknown reasons silently dropped (forward-compat).
@@ -269,20 +301,24 @@ async function dispatchBody(
         }
       }
     }
+    // A reset while the handlers ran: the map read above is gone, and
+    // writing it back — or arming for it — would revive what was ended.
+    if (!current()) return;
     // Fold the in-dispatch arms, earliest-deadline-first per reason.
     for (const arm of arms) {
       if (!(arm.reason in map) || arm.whenMs < map[arm.reason]) {
         map[arm.reason] = arm.whenMs;
       }
     }
-    // Re-arm or clear.
+    // Re-arm or clear, issued in the turn the epoch was checked in: a reset
+    // after this point wipes and disarms after these, never before.
     const setAlarmFn = ctx?.storage?.setAlarm;
     if (Object.keys(map).length > 0) {
-      await ctx.storage.put(TIMER_REASONS_KEY, map);
-      const earliest = Math.min(...Object.values(map));
+      const written = ctx.storage.put(TIMER_REASONS_KEY, map);
       if (typeof setAlarmFn === 'function') {
-        setAlarmFn.call(ctx.storage, earliest);
+        setAlarmFn.call(ctx.storage, Math.min(...Object.values(map)));
       }
+      await written;
     } else if (hadMap) {
       try { await ctx.storage.delete(TIMER_REASONS_KEY); } catch {}
       // No remaining reasons → no setAlarm call → DO becomes

package/src/vendor/types.ts

@@ -9,12 +9,18 @@ export interface TextModule { text: string }
 export interface DataModule { data: ArrayBuffer }
 export interface JsonModule { json: unknown }
 /**
- * A compiled WebAssembly module, importable from a facet by module name.
- * Nimbus ships these on every path — sql.js for node:sqlite, the interpreter
- * images for python and ruby — so the omission here was the type lagging the
- * API, not a kind the loader lacks.
+ * A WebAssembly module, importable from a facet by module name. Nimbus ships
+ * these on every path — sql.js for node:sqlite, the interpreter images for
+ * python and ruby — so the omission here was the type lagging the API, not a
+ * kind the loader lacks. The loader takes either the bytes, which it
+ * compiles, or a module the caller holds compiled already, whose compiled
+ * code the dynamic worker then shares (workerd src/workerd/api/
+ * worker-loader.c++, extractWasmModuleContent). A module handed over this
+ * way should be described with describeHostWasm (host-wasm.ts): the
+ * code-size budget and the loader cache key cannot read a Module's size or
+ * identity from JS.
  */
-export interface WasmModule { wasm: ArrayBuffer }
+export interface WasmModule { wasm: ArrayBuffer | WebAssembly.Module }
 
 /** Plain string = type inferred from file extension (.js or .py). */
 export type ModuleContent =

package/src/workerd-facet-host.ts

@@ -14,6 +14,8 @@
  */
 
 import { disposeRpcResource } from '@nimbus-sh/platform/rpc-dispose.js';
+import { StorageLedger, forgetFacetStorage } from '@nimbus-sh/core/runtime/storage-ledger.js';
+import type { SqlDatabase } from '@nimbus-sh/core/runtime/os-contracts.js';
 import {
   getCtxExports,
   stagedBootAssembler,
@@ -26,7 +28,6 @@ import {
   facetNameCount,
   facetNameCountDurable,
   recordFacetNameMinted,
-  recordLoaderId,
   withDynamicWorkerCapNamed,
   withFacetBudgetNamed,
 } from './budgets.js';
@@ -41,6 +42,7 @@ import {
   type ResidentDiskReader,
   type ResidentSupervisorProps,
 } from './process-fabric.js';
+import { supervisorLoaderKey } from './supervisor-props.js';
 
 // ── Loaded-worker entrypoint plumbing ───────────────────────────────────────
 
@@ -56,7 +58,7 @@ export interface NimbusCtxExports {
       key: string;
       name: string | null;
       depth: number;
-      supervisor: { doId: string; pid: number; writerId: string };
+      supervisor: ResidentSupervisorProps;
       stage?: unknown;
     };
   }) => LoadedWorkerEntrypointStub;
@@ -78,7 +80,7 @@ export function getNimbusCtxExports(): NimbusCtxExports {
  */
 export async function createLoadedWorkerEntrypoint(
   ctxExports: NimbusCtxExports,
-  supervisor: { doId: string; pid: number; writerId: string },
+  supervisor: ResidentSupervisorProps,
   stage: unknown,
   name: string | null = null,
 ): Promise<LoadedWorkerEntrypointStub> {
@@ -87,7 +89,9 @@ export async function createLoadedWorkerEntrypoint(
   }
   return await ctxExports.NimbusLoadedEntrypoint({
     props: {
-      key: `nimbus-process:${supervisor.doId}:${supervisor.pid}`,
+      // The entrypoint's loader outlives this instance, and a warm worker keeps
+      // the SUPERVISOR binding it was built with.
+      key: supervisorLoaderKey(`nimbus-process:${supervisor.doId}:${supervisor.pid}`, supervisor),
       name,
       depth: 0,
       supervisor,
@@ -116,9 +120,10 @@ interface FacetContainer {
   abort(name: string, reason?: unknown): void;
   delete(name: string): void;
   /**
-   * Present on deployed Cloudflare workerd, absent from the pinned
-   * `@cloudflare/workers-types` and from local workerd ≤ 1.20260603.1 — see
-   * {@link cloneStorage}, the one way the fabric calls it.
+   * Declared by `@cloudflare/workers-types` 5 and present in workerd
+   * ≥ 1.20260926.1 and in production; an embedder's older local workerd
+   * (≤ 1.20260603.1) lacks it — see {@link cloneStorage}, the one way the
+   * fabric calls it.
    */
   clone?(src: string, dst: string): void;
 }
@@ -207,7 +212,7 @@ export async function cloneStorage(
   if (typeof facets.clone !== 'function') {
     throw new Error(
       'Nimbus: ctx.facets.clone is unavailable in this runtime; the reflink image '
-        + 'path needs deployed Cloudflare workerd (local workerd <= 1.20260603.1 lacks it)',
+        + 'path needs workerd 1.20260926.1 or later, or deployed Cloudflare workerd',
     );
   }
   const { src, dst } = clone;
@@ -262,26 +267,25 @@ interface SlotBook {
   next: number;
   /** Slot held by each live pid, so release can find it. */
   held: Map<number, number>;
+  /** Explicit (`app-slot-`) names this incarnation started a process under and has not released. */
+  live: Set<string>;
 }
 
 /**
  * Slot books, per hosting actor, because the facet index is per Durable
  * Object.
  *
- * Keyed weakly off `ctx`, and that is sound rather than lossy: a facet cannot
- * outlive the Durable Object hosting it, so a book that goes away with its
- * host describes nothing that still exists. A fresh incarnation restarts at
- * slot 0 and re-attaches to the SQLite a previous incarnation left there —
- * which is safe for the reason the store is sealed until it has reconciled.
- * Its persisted cursor is either datable against the current authority, in
- * which case the ACQUIRE delta brings it current, or it carries a different
- * VFS epoch, in which case `invalidatedSince` can only answer poison and the
- * whole store is dropped. A process therefore cannot boot onto a previous
- * tenant's filesystem even when release never ran.
+ * Keyed weakly off `ctx`, so a book describes one incarnation. A facet that
+ * is still running when that incarnation ends outlives it (measured: a timer
+ * or an outgoing call keeps it going), and a `get` of its name with a new
+ * class then resets the whole object. So a fresh incarnation's first get of
+ * each name ends whatever runs there first: a minted `proc-slot-` name is
+ * deleted, which also wipes the storage a previous incarnation left, and an
+ * explicit name is aborted, which keeps it.
  *
- * The book names only the `proc-slot-` space. Durable `app-slot-` names are
- * allocated against DO storage instead (their owner survives a reset), so a
- * fresh incarnation's `next` starting at 0 can never collide with them even
+ * The book allocates only the `proc-slot-` space. Durable `app-slot-` names
+ * are allocated against DO storage instead (their owner survives a reset), so
+ * a fresh incarnation's `next` starting at 0 can never collide with them even
  * before the durable ledger is adopted.
  */
 const slotBooks = new WeakMap<DurableObjectState, SlotBook>();
@@ -289,24 +293,28 @@ const slotBooks = new WeakMap<DurableObjectState, SlotBook>();
 function slotBook(ctx: DurableObjectState): SlotBook {
   let book = slotBooks.get(ctx);
   if (!book) {
-    book = { free: [], next: 0, held: new Map() };
+    book = { free: [], next: 0, held: new Map(), live: new Set() };
     slotBooks.set(ctx, book);
   }
   return book;
 }
 
-/** Take a slot for `pid`, reusing a returned one before minting a new name. */
-function acquireSlot(ctx: DurableObjectState, pid: number): number {
+/**
+ * Take a slot for `pid`, reusing a returned one before minting a new name.
+ * `minted` names may still hold storage a previous incarnation of this actor
+ * left there, so the caller deletes it before the first get.
+ */
+function acquireSlot(ctx: DurableObjectState, pid: number): { slot: number; minted: boolean } {
   const book = slotBook(ctx);
   const existing = book.held.get(pid);
-  if (existing !== undefined) return existing;
+  if (existing !== undefined) return { slot: existing, minted: false };
   const reused = book.free.length > 0;
   const slot = reused ? book.free.shift()! : book.next++;
   book.held.set(pid, slot);
   // A fresh name is a permanently consumed facet ID; the durable count lives
   // in the budgets ledger (see budgets.ts).
   if (!reused) recordFacetNameMinted(ctx, book.next);
-  return slot;
+  return { slot, minted: !reused };
 }
 
 /** Return `pid`'s slot to the free list. */
@@ -320,14 +328,36 @@ function releaseSlot(ctx: DurableObjectState, pid: number): void {
 }
 
 /**
- * Drop one facet's SQLite by name — the ONLY call site that may delete facet
- * storage. `spawnResident` releases ephemeral processes with abort+delete
- * (storage is slot-reuse hygiene) and durable ones with abort alone (the
- * storage IS the durable application's state); explicit removal arrives here
- * through the coordinator's durable-slot book, owner-checked.
+ * Drop one facet's SQLite by name, and its row in the session's storage
+ * ledger (N18) in the same step: the only way a facet database is deleted.
+ * `spawnResident` releases ephemeral processes with abort+delete (storage is
+ * slot-reuse hygiene) and durable ones with abort alone (the storage IS the
+ * durable application's state); explicit removal arrives here through the
+ * coordinator's durable-slot book, owner-checked.
  */
+/** The session's storage ledger (N18), over this actor's SQL; null where it has none. */
+function sessionLedger(ctx: DurableObjectState): StorageLedger | null {
+  const sql = (ctx as { storage?: { sql?: SqlDatabase } }).storage?.sql;
+  return sql ? new StorageLedger(sql) : null;
+}
+
+const facetNames = new WeakMap<object, Map<number, string>>();
+
+function facetOfPid(ctx: DurableObjectState): Map<number, string> {
+  let names = facetNames.get(ctx);
+  if (!names) facetNames.set(ctx, names = new Map());
+  return names;
+}
+
+/** The facet a running resident process `pid` lives in on this actor, for its storage ledger row. */
+export function residentFacetOf(ctx: DurableObjectState, pid: number): string | undefined {
+  return facetNames.get(ctx)?.get(pid);
+}
+
 export function deleteFacetStorage(ctx: DurableObjectState, name: string): void {
   facetContainer(ctx).delete(name);
+  const sql = (ctx as { storage?: { sql?: SqlDatabase } }).storage?.sql;
+  if (sql) forgetFacetStorage(sql, name);
 }
 
 
@@ -416,8 +446,12 @@ function spawnResident(
         + `prefix, got '${explicit.name}'`,
     );
   }
-  const slot = explicit ? undefined : acquireSlot(ctx, params.pid);
+  const grant = explicit ? undefined : acquireSlot(ctx, params.pid);
+  const slot = grant?.slot;
   const name = explicit ? explicit.name : residentFacetName(slot!);
+  if (grant?.minted) {
+    try { deleteFacetStorage(ctx, name); } catch { /* nothing stored under this name */ }
+  }
   // The start callback is the ONLY way this facet is ever created, and it
   // fires AT MOST ONCE. Every later use goes through the stub below, so the
   // callback running a second time means the facet was released or died —
@@ -437,29 +471,52 @@ function spawnResident(
       );
     }
     evaluated = true;
-    return { class: residentProcessClass(ctx, env, disk, supervisor, params) };
+    return { class: residentProcessClass(env, disk, supervisor, params, loaderKey) };
   };
+  const book = slotBook(ctx);
+  const ledger = sessionLedger(ctx);
+  // A warm worker keeps the SUPERVISOR binding it was built with, and the
+  // loader outlives this instance.
+  const loaderKey = supervisorLoaderKey(params.workerKey, supervisor);
   let facet: ResidentFacetStub;
   try {
+    // N18: the fill is admitted, and recorded under the facet's name, before
+    // the facet exists; a refusal leaves no facet.
+    if (ledger !== null && params.storageBytes !== undefined) ledger.fill(name, params.storageBytes);
+    // get() with a new class on a facet an earlier incarnation left running resets this object.
+    if (explicit && !book.live.has(name)) {
+      facets.abort(name, new Error('Nimbus: a new incarnation takes this facet name'));
+    }
     facet = facets.get(name, start);
   } catch (error) {
     if (slot !== undefined) releaseSlot(ctx, params.pid);
     throw withFacetBudgetNamed(facetNameCount(ctx), error);
   }
+  if (explicit) book.live.add(name);
+  // The facet's worker is one Dynamic Worker in flight for as long as the
+  // process is resident, not only while a call is open: its WebSockets and
+  // streamed responses outlive the calls the ledger could bracket, and a
+  // request can reach it at any moment. Held from here to `release`, so no
+  // fan-out spends the slot a running process needs.
+  const endResidency = beginLoaderFetch(ctx, loaderKey);
+  facetOfPid(ctx).set(params.pid, name);
 
   let disposed = false;
   const release = async () => {
     if (disposed) return;
     disposed = true;
     released = true;
+    facetOfPid(ctx).delete(params.pid);
+    endResidency();
     try { facets.abort(name, new Error('Nimbus: resident process released')); } catch { /* already gone */ }
+    if (explicit) book.live.delete(name);
     // The two release classes: an ephemeral facet's SQLite is slot-reuse
     // hygiene — the name is handed out again, so the store must not be — and
     // a durable one's is the application itself: abort ends the process, the
     // data stays for the next boot, and only removeDurableApp's explicit
     // deleteFacetStorage call ever drops it.
     if (!explicit?.durable) {
-      try { facets.delete(name); } catch { /* already gone */ }
+      try { deleteFacetStorage(ctx, name); } catch { /* already gone */ }
     }
     // Only after the facet is gone. A slot handed out while its previous
     // tenant were still being torn down would have two processes on one name.
@@ -468,7 +525,11 @@ function spawnResident(
 
   let started: Promise<unknown>;
   try {
-    started = facet.startProcess(params.startArgs);
+    // The allowance the ledger admitted, for the facet's store to keep under.
+    const startArgs = ledger !== null && params.storageBytes !== undefined && params.startArgs !== null && typeof params.startArgs === 'object'
+      ? { ...(params.startArgs as Record<string, unknown>), storage: { facet: name, grant: params.storageBytes } }
+      : params.startArgs;
+    started = facet.startProcess(startArgs);
   } catch (error) {
     void release();
     throw withFacetBudgetNamed(facetNameCount(ctx), error);
@@ -477,7 +538,17 @@ function spawnResident(
   // this one, and it is annotated AFTER awaiting the ledger — the first
   // failure of a fresh incarnation must compare against the persisted count,
   // not the zero its adoption read has not yet replaced.
-  started = started.catch(async (error) => {
+  started = started.then((payload) => {
+    // Once the facet is up (N18) its row is the cap its store keeps under
+    // (what it measures plus what it may still grow into), or what it
+    // measures if that is more (overshoot).
+    const { databaseSize: size, storageCap: cap } = (payload ?? {}) as { databaseSize?: unknown; storageCap?: unknown };
+    const measured = typeof size === 'number' && Number.isFinite(size) ? size : null;
+    const capped = typeof cap === 'number' && Number.isFinite(cap) ? cap : null;
+    const row = capped !== null ? Math.max(capped, measured ?? 0) : measured;
+    if (ledger !== null && row !== null) ledger.reportSize(name, row);
+    return payload;
+  }, async (error) => {
     throw withFacetBudgetNamed(await facetNameCountDurable(ctx), error);
   });
   // A caller reads whichever of `started` and the lifecycle it needs, so keep
@@ -503,11 +574,11 @@ function spawnResident(
  * the hosting DO's heap.
  */
 function residentProcessClass(
-  ctx: DurableObjectState,
   env: ResidentFacetEnv,
   disk: () => ResidentDiskReader,
   supervisor: ResidentSupervisorProps,
   params: ProcessHostParams,
+  loaderKey: string,
 ): unknown {
   const loader = env.LOADER;
   if (!loader || typeof loader.get !== 'function') {
@@ -516,15 +587,9 @@ function residentProcessClass(
         + 'the Worker Loader binding; add it via worker_loaders in wrangler.jsonc.',
     );
   }
-  try {
-    const worker = loader
-      .get(params.workerKey, () => residentWorkerConfig(env, disk, supervisor, params.boot))
-      .getDurableObjectClass(RESIDENT_PROCESS_CLASS);
-    recordLoaderId(ctx, params.workerKey);
-    return worker;
-  } catch (error) {
-    throw withDynamicWorkerCapNamed(ctx, error);
-  }
+  return loader
+    .get(loaderKey, () => residentWorkerConfig(env, disk, supervisor, params.boot))
+    .getDurableObjectClass(RESIDENT_PROCESS_CLASS);
 }
 
 async function runOneShot<T>(
@@ -574,22 +639,22 @@ async function runOneShot<T>(
       throw new Error('Nimbus: one-shot runtime entrypoint has no fetch method');
     }
     params.onLoaded?.();
-    // The unkeyed worker is a live dynamic worker for exactly this call, so
-    // the run is a Loader fetch on the hosting actor's ledger — bracketed,
-    // never wrapped: see beginLoaderFetch for the measured DO-poisoning
-    // hazard, and the pipelined-`fetch.call` note above for its sibling.
-    const endFetch = beginLoaderFetch(ctx);
-    let response: Response;
+    // The unkeyed worker is one distinct dynamic worker in flight until its
+    // response is consumed (the body streams from it), keyed by this run's
+    // writer id — bracketed, never wrapped: see beginLoaderFetch for the
+    // measured DO-poisoning hazard, and the pipelined-`fetch.call` note above
+    // for its sibling.
+    const endFetch = beginLoaderFetch(ctx, `one-shot:${params.writerId}`);
     try {
-      response = await ep.fetch(params.request);
+      const response = await ep.fetch(params.request);
+      try {
+        return await consume(response);
+      } finally {
+        disposeRpcResource(response);
+      }
     } finally {
       endFetch();
     }
-    try {
-      return await consume(response);
-    } finally {
-      disposeRpcResource(response);
-    }
   } catch (error) {
     throw withDynamicWorkerCapNamed(ctx, error);
   } finally {