@nimbus-sh/fabric 0.8.0 → 0.9.0

package/src/fanout.ts

@@ -1,22 +1,27 @@
 /**
  * Two-tier fan-out primitive for work that must execute in Worker Loader
- * facets without tripping workerd's per-DO dynamic-worker ceiling.
+ * isolates within the Durable Object's Dynamic Worker budget.
  *
- * A single Durable Object method can drive at most four concurrent
- * Worker Loader fetches before extra dispatches serialize or fail. Small
- * batches therefore run in the coordinator DO through IsolatePool.
- * Wider batches are sharded across sibling NimbusSession DOs, each of
- * which owns its own four-loader budget.
+ * A Durable Object may have `DO_DYNAMIC_WORKER_LIMIT` distinct Dynamic
+ * Workers with in-flight requests, shared across every concurrent request to
+ * it (budgets.ts). A batch the coordinator's remaining headroom can hold —
+ * the limit less the workers it already has in flight (resident processes,
+ * the esbuild facet, a git network op) and other fan-outs' claims — runs in
+ * the coordinator through IsolatePool, one Dynamic Worker per task. Only a
+ * batch wider than that headroom is sharded across sibling NimbusSession
+ * DOs, each of which spends its own budget.
  *
- * Routing is deterministic: each task has a stable key, and the key maps
- * to a sibling DO shard. There is no silent fallback to width-1 execution;
- * missing LOADER or NIMBUS_SESSION bindings fail loudly so install and
- * runtime operations do not appear successful after partial dispatch.
+ * Routing is deterministic for a given headroom: each task has a stable key,
+ * and the key maps to a sibling DO shard. There is no silent fallback to
+ * width-1 execution; missing LOADER or NIMBUS_SESSION bindings fail loudly so
+ * install and runtime operations do not appear successful after partial
+ * dispatch.
  */
 
 import { serializeFunction } from './vendor/serialize.js';
 import { BindingError } from './vendor/errors.js';
 import { IsolatePool, type FacetTaskFn } from './isolate-pool.js';
+import { claimDynamicWorkers, dynamicWorkerHeadroom } from './budgets.js';
 import { hostRoute } from './composition.js';
 import { disposeRpcResource } from '@nimbus-sh/platform/rpc-dispose.js';
 import { classifyDoCall, describeError, isRetryableDoCall } from '@nimbus-sh/platform/oom-classify.js';
@@ -35,14 +40,17 @@ export interface FanoutEnv {
   NIMBUS_SESSION?: unknown;
 }
 
-/**
- * Threshold at which routing switches from coordinator-local loaders to
- * sibling Durable Objects.
- *
- * Set to **5** so the in-DO path stays below the V8 4-loaders-per-method
- * cap by construction. width < 5 stays local; width >= 5 uses sibling DOs.
- */
-export const IN_DO_THRESHOLD = 5;
+/** Where one `submitMany` ran. */
+export type FanoutTopology = 'in-do' | 'peer-do';
+
+/** The routing decision for one `submitMany`, as its caller may log it. */
+export interface FanoutRoute {
+  topology: FanoutTopology;
+  /** Tasks in the batch — the Dynamic Workers an in-DO run spends. */
+  tasks: number;
+  /** The coordinator's Dynamic Worker headroom when the batch was routed. */
+  headroom: number;
+}
 
 /**
  * Hard cap on concurrent peer DOs per single submitMany call. Throughput stays
@@ -153,12 +161,14 @@ export interface FanoutOptions {
    * Not called on the in-DO path, which has no phases.
    */
   onDispatchPhase?: (width: number, elapsedMs: number) => void;
+  /** Called once per non-empty submitMany with the route it took. */
+  onRoute?: (route: FanoutRoute) => void;
   /**
    * Cap on peer DOs this pool will spread one submitMany across. Defaults to
    * MAX_PEER_FANOUT. Tasks beyond the cap bucket into the peers that exist and
    * run through their in-peer pool, so lowering it trades peers for barriers
-   * without lowering total concurrency: each peer runs its bucket at
-   * concurrency 4, so N peers still resolve 4N tasks at once.
+   * without lowering total concurrency: each peer runs its bucket as wide as
+   * its own Dynamic Worker headroom allows.
    *
    * A caller sets this when its per-task work is small enough that a peer per
    * task buys nothing but round-trips — one task per peer costs ⌈tasks/
@@ -178,7 +188,7 @@ function isPeerResult<R>(value: Awaited<ReturnType<HostOpDispatch>>): value is F
 
 /**
  * Two-tier fan-out pool. Constructed by the supervisor DO; routes
- * each `submitMany` call automatically based on width.
+ * each `submitMany` call on the coordinator's live Dynamic Worker headroom.
  *
  * Lifetime: cheap to construct (no async init). Multiple submitMany
  * calls share NO state — each is dispatched fresh. The class
@@ -216,16 +226,16 @@ export class Fanout {
    * Dispatch `tasks` across the appropriate topology and return
    * results in input order.
    *
-   * Routing:
-   *   tasks.length < 5   -> coordinator-local IsolatePool
-   *   tasks.length >= 5  -> sibling NimbusSession DOs
+   * Routing, against the coordinator's Dynamic Worker headroom at call time:
+   *   tasks.length <= headroom -> coordinator-local IsolatePool, one Dynamic
+   *                               Worker per task, the width claimed on the
+   *                               ledger until the batch settles
+   *   tasks.length >  headroom -> sibling NimbusSession DOs
    *
-   * Backpressure: if `tasks.length > MAX_PEER_FANOUT (32)`, tasks
-   * are sharded modulo `MAX_PEER_FANOUT` and each shard's bucket
-   * runs serially inside its assigned peer DO via the in-peer
-   * IsolatePool's concurrency (capped at 4 there too). A
-   * single submitMany call returns when ALL tasks complete (or any
-   * throws).
+   * Peer shards: tasks hash onto min(tasks, maxPeers ?? MAX_PEER_FANOUT)
+   * peers and each peer runs its bucket through its own IsolatePool, as
+   * wide as that peer's headroom allows. A single submitMany call returns
+   * when ALL tasks complete (or any throws).
    *
    * `fn` is the user function executed per task. It runs INSIDE a
    * Worker Loader isolate (in the in-DO path) or inside a peer DO's
@@ -239,16 +249,21 @@ export class Fanout {
   ): Promise<R[]> {
     if (tasks.length === 0) return [];
 
-    if (tasks.length < IN_DO_THRESHOLD) {
-      return this._dispatchInDo<A, R>(tasks, fn);
+    const headroom = dynamicWorkerHeadroom(this.ctx);
+    const claim = claimDynamicWorkers(this.ctx, tasks.length);
+    this.opts.onRoute?.({ topology: claim ? 'in-do' : 'peer-do', tasks: tasks.length, headroom });
+    if (!claim) return this._dispatchPeerDo<A, R>(tasks, fn);
+    try {
+      return await this._dispatchInDo<A, R>(tasks, fn);
+    } finally {
+      claim.release();
     }
-    return this._dispatchPeerDo<A, R>(tasks, fn);
   }
 
-  /** Report which topology a task count uses without dispatching. */
-  topologyFor(taskCount: number): 'in-do' | 'peer-do' | 'empty' {
+  /** The topology a task count would take against the headroom right now. */
+  topologyFor(taskCount: number): FanoutTopology | 'empty' {
     if (taskCount === 0) return 'empty';
-    return taskCount < IN_DO_THRESHOLD ? 'in-do' : 'peer-do';
+    return taskCount <= dynamicWorkerHeadroom(this.ctx) ? 'in-do' : 'peer-do';
   }
 
   /**
@@ -269,13 +284,10 @@ export class Fanout {
     tasks: FanoutTask<A>[],
     fn: FacetTaskFn<A, R>,
   ): Promise<R[]> {
-    // Use the existing IsolatePool. Concurrency = task count
-    // (capped at 4 by constructor — tasks.length is already < 5
-    // here, so the cap won't bite). Each task = one pool.submit;
-    // pool.map runs them with stable-slot reuse.
-    const concurrency = Math.min(tasks.length, IN_DO_THRESHOLD - 1);
+    // One slot — one Dynamic Worker — per task; submitMany has claimed
+    // that width on the ledger.
     const pool = new IsolatePool(this.env, this.ctx, {
-      concurrency,
+      concurrency: tasks.length,
       timeoutMs: this.opts.timeoutMs,
       tag: this.opts.tag,
       preamble: this.opts.preamble,
@@ -285,9 +297,6 @@ export class Fanout {
       supervisorPid: this.opts.supervisorPid,
     });
     try {
-      // pool.map runs the function over `items` with concurrency-bounded
-      // slot reuse. Each slot is one warm loader isolate; we get exactly
-      // `concurrency` loader isolates total — well under the 4-cap.
       const items = tasks.map((t) => t.args);
       const results = await pool.map<A, R>(fn, items);
       // pool.map returns Array<R | null> (null on per-item failure with
@@ -316,10 +325,9 @@ export class Fanout {
     // identical fns.
     const fnSource = serializeFunction(fn);
 
-    // Cap peer count at MAX_PEER_FANOUT. Tasks beyond N=32 are
-    // bucketed into existing shards — each shard's peer DO then
-    // runs its bucket through its in-DO IsolatePool.map
-    // (concurrency capped at 4 there).
+    // Cap peer count at maxPeers (default MAX_PEER_FANOUT). Tasks beyond
+    // it bucket into existing shards; each peer runs its bucket through
+    // its own IsolatePool, as wide as its own headroom allows.
     const peerCount = Math.min(tasks.length, this.opts.maxPeers ?? MAX_PEER_FANOUT);
     // Group tasks by deterministic shard. Same key → same shard, so
     // tests can predict which peer handles which task.
@@ -360,10 +368,9 @@ export class Fanout {
           const peerStub = ns.get(id);
           try {
             const dispatch = hostOpDispatch(peerStub, `Fanout peer ${siblingName}`);
-            // Each peer DO RPC call uses ONE LOADER worker on its side.
-            // Supervisor → peer DO is a stub.fetch / RPC method call,
-            // NOT an env.LOADER.get(); that's the cap-sidestep that
-            // makes peer-DO fanout work.
+            // A peer DO call is a Durable Object RPC, not a Dynamic Worker:
+            // it spends none of this coordinator's budget, and the peer
+            // spends its own.
             const rpcResp = await dispatch({
               op: 'fanoutExecute',
               args: [

package/src/host-wasm.ts

@@ -0,0 +1,41 @@
+/**
+ * host-wasm.ts — what the fabric knows about a WebAssembly.Module a host
+ * hands a dynamic worker already compiled.
+ *
+ * workerd accepts a compiled module in a Worker Loader module map and lets
+ * the dynamic worker share its compiled code (src/workerd/api/
+ * worker-loader.c++, extractWasmModuleContent), so a host that bundles a
+ * fixed wasm (esbuild's, say) hands that module over instead of fetching a
+ * second copy of the bytes and having the guest compile them again. Two
+ * things the fabric needs about a member are unreadable from JS for a
+ * Module:
+ *   - its size: the module's wire bytes still count toward the 64 MiB
+ *     dynamic-worker code limit (worker-loader.c++ sums every member), and
+ *     assertModuleMapWithinCodeLimit must count them;
+ *   - its identity: a pool folds its wasm into the loader cache key, and a
+ *     Module has no bytes to fingerprint.
+ * The host that owns the module states both once, here.
+ */
+
+export interface HostWasmIdentity {
+  /** A stable name for the module's content, e.g. `esbuild@0.24.2`. */
+  readonly id: string;
+  /** The module's wire bytes: what it costs the dynamic-worker code budget. */
+  readonly bytes: number;
+}
+
+const described = new WeakMap<WebAssembly.Module, HostWasmIdentity>();
+
+/** Record what `module` is, and return it. */
+export function describeHostWasm(module: WebAssembly.Module, identity: HostWasmIdentity): WebAssembly.Module {
+  if (!Number.isSafeInteger(identity.bytes) || identity.bytes <= 0) {
+    throw new RangeError(`describeHostWasm: '${identity.id}' needs its wire size in bytes, got ${identity.bytes}`);
+  }
+  described.set(module, identity);
+  return module;
+}
+
+/** What a host said `module` is, or undefined for a module nobody described. */
+export function hostWasmIdentity(module: WebAssembly.Module): HostWasmIdentity | undefined {
+  return described.get(module);
+}

package/src/image-store.ts

@@ -122,7 +122,7 @@ export class ImageStore {
    */
   async materialize(
     pid: number,
-    images: AsyncIterable<readonly [string, string]> | Iterable<readonly [string, string]>,
+    images: AsyncIterable<readonly [string, string | readonly string[]]> | Iterable<readonly [string, string | readonly string[]]>,
     pacer: TurnBudget,
   ): Promise<Record<string, string>> {
     const fs = this.blobs();
@@ -138,7 +138,7 @@ export class ImageStore {
     fs.mkdirp(FACET_IMAGE_DIR);
     let count = 0;
     for await (const [moduleName, source] of images) {
-      const bytes = new TextEncoder().encode(source);
+      const bytes = typeof source === 'string' ? new TextEncoder().encode(source) : encodeParts(source);
       const path = facetImagePath(await facetImageDigest(bytes));
       paths[moduleName] = path;
       rooted.push(path);
@@ -207,3 +207,30 @@ export class ImageStore {
     }
   }
 }
+
+/**
+ * UTF-8 bytes of an image given as ordered parts, encoded into one buffer a
+ * part at a time: joining the parts first would hold the whole image twice as
+ * text.
+ */
+function encodeParts(parts: readonly string[]): Uint8Array {
+  let length = 0;
+  for (const part of parts) {
+    for (let i = 0; i < part.length; i++) {
+      const code = part.charCodeAt(i);
+      if (code < 0x80) length += 1;
+      else if (code < 0x800) length += 2;
+      else if (code >= 0xd800 && code <= 0xdbff && (part.charCodeAt(i + 1) & 0xfc00) === 0xdc00) { length += 4; i++; }
+      else length += 3;
+    }
+  }
+  const bytes = new Uint8Array(length);
+  const encoder = new TextEncoder();
+  let offset = 0;
+  for (const part of parts) {
+    const encoded = encoder.encode(part);
+    bytes.set(encoded, offset);
+    offset += encoded.byteLength;
+  }
+  return bytes;
+}

package/src/isolate-pool.ts

@@ -7,9 +7,9 @@
  *      running 67 npm tarball extractions (cold-start dominates). We pin
  *      each job to `slot = cursor % concurrency` and use stable loader
  *      IDs `nfp:${fnHash}:slot-${i}:g${generation}`, so a pool of
- *      concurrency=4 keeps at most 4 warm isolates rather than N fresh ones.
+ *      concurrency=N keeps at most N warm isolates rather than one per job.
  *   2. **Nimbus defaults**: compatibilityDate = CF_COMPAT_DATE (matches
- *      the supervisor worker), compatibilityFlags = ['nodejs_compat'],
+ *      the supervisor worker), compatibilityFlags = GUEST_COMPAT_FLAGS,
  *      globalOutbound = undefined (inherit parent network so the facet can
  *      reach https://registry.npmjs.org without a proxy binding).
  *   3. **Supervisor autoinjection**. The pool grabs the embedder's
@@ -24,12 +24,12 @@
  * and binding types used by this implementation.
  */
 
-import { CF_COMPAT_DATE } from '@nimbus-sh/core/constants.js';
+import { CF_COMPAT_DATE, GUEST_COMPAT_FLAGS } from '@nimbus-sh/core/constants.js';
 import { supervisorEntrypoint, type HostRoute } from './composition.js';
 import { supervisorBindingProps, supervisorLoaderKey } from './supervisor-props.js';
 import { disposeRpcResource } from '@nimbus-sh/platform/rpc-dispose.js';
 import { serializeFunction, hashSource } from './vendor/serialize.js';
-import { beginLoaderFetch, recordLoaderId, withDynamicWorkerCapNamed } from './budgets.js';
+import { beginLoaderFetch, withDynamicWorkerCapNamed } from './budgets.js';
 import { assertModuleMapWithinCodeLimit } from './budgets.js';
 import { recordFailure, setLastFacetId, getLastRpcFrame } from '@nimbus-sh/platform/oom-discriminator.js';
 import { classifyError } from '@nimbus-sh/platform/oom-classify.js';
@@ -41,6 +41,7 @@ import {
 } from './vendor/errors.js';
 import type { FacetBindings } from '@nimbus-sh/core/runtime/facet-host.js';
 import type { ModuleContent, WorkerLoader } from './vendor/types.js';
+import { hostWasmIdentity } from './host-wasm.js';
 
 /**
  * A function dispatched into a facet isolate, with the bindings that facet was
@@ -62,7 +63,11 @@ export interface IsolatePoolEnv {
 
 /** Options handed to IsolatePool's constructor. */
 export interface IsolatePoolOptions {
-  /** Maximum concurrent in-flight facets. Default 4. */
+  /**
+   * Maximum concurrent in-flight facets, each a distinct Dynamic Worker
+   * spent from the hosting DO's `DO_DYNAMIC_WORKER_LIMIT`. Default 1; a
+   * caller that wants more sizes it against that budget (Fanout does).
+   */
   concurrency?: number;
   /** Per-task timeout in ms. Default 60_000. */
   timeoutMs?: number;
@@ -157,15 +162,19 @@ export interface IsolatePoolOptions {
   /**
    * WebAssembly modules to ship into the facet via the LOADER's
    * `modules` map. Map keys are module specifier paths (e.g.
-   * `'esbuild.wasm'`); values are the raw bytes.
+   * `'esbuild.wasm'`); values are the raw bytes, or a module the host
+   * already holds compiled.
    *
-   * Workerd registers each entry as `{ wasm: ArrayBuffer }` in the
-   * worker's modules map. The pool prepends a static
+   * Workerd registers each entry as `{ wasm }` in the worker's modules
+   * map. The pool prepends a static
    * `import __NIMBUS_WASM_<id> from './<key>';` to the generated
-   * worker.js so workerd compiles each at module-load (startup phase,
-   * where wasm code generation is permitted). The compiled Modules
-   * are exposed via `globalThis.__NIMBUS_WASM[<key>]` for the user
-   * function to read at request time.
+   * worker.js; bytes are compiled at the facet's module-load (startup
+   * phase, where wasm code generation is permitted), and a compiled
+   * module is shared with the facet as is, its compiled code included
+   * (workerd src/workerd/api/worker-loader.c++,
+   * extractWasmModuleContent). The Modules are exposed via
+   * `globalThis.__NIMBUS_WASM[<key>]` for the user function to read at
+   * request time.
    *
    * Why this works when other paths don't:
    *   - request-time `WebAssembly.compile()` — disallowed by workerd
@@ -174,15 +183,15 @@ export interface IsolatePoolOptions {
    *     structured-clone refuses ("Unable to deserialize cloned data").
    *   - inlining bytes in the preamble — 16 MiB string per dispatch
    *     OOMs the supervisor at module-source allocation time.
-   *   - LOADER modules-map (this) — bytes ride INSIDE the worker code
-   *     blob; workerd compiles wasm during its own startup pipeline,
-   *     never crossing structured-clone, never executing JS eval.
+   *   - LOADER modules-map (this) — the module rides INSIDE the worker
+   *     code blob, never crossing structured-clone, never executing JS
+   *     eval.
    *
-   * The bytes ARE part of the loader-cache key (workerd hashes the
-   * whole WorkerCode), so changing the wasm bytes invalidates warm
-   * slots — desirable when the bundled wasm version changes.
+   * A compiled module must be described (host-wasm.ts describeHostWasm):
+   * its identity keys warm slots, as the bytes' fingerprint does, and its
+   * size counts toward the dynamic-worker code limit.
    */
-  wasmModules?: Record<string, ArrayBuffer>;
+  wasmModules?: Record<string, ArrayBuffer | WebAssembly.Module>;
 }
 
 /** Per-call override (merged with pool defaults). */
@@ -240,6 +249,14 @@ interface ResolvedResilience {
   retries: number;
 }
 
+/**
+ * How long one call waits, in all, for the platform to admit it after
+ * "Dynamic worker concurrency limit exceeded" (doubling from 50 ms, at most
+ * 2 s a wait). A deployed Durable Object admitted the refused batch after a
+ * 6 s pause; 15 s bounds a call that would never be admitted.
+ */
+const CAP_REFUSAL_WAIT_MS = 15_000;
+
 /**
  * esbuild runtime helpers re-declared at the top of every generated facet
  * module. esbuild emits `__name(fn, "fn")` wrappers around every named
@@ -367,7 +384,7 @@ export function assembleLoaderWorkerModuleSource(
  * Typical use:
  *
  *   const pool = new IsolatePool(env, ctx, {
- *     concurrency: 4,
+ *     concurrency: 2,
  *     tag: 'npm-install',
  *   });
  *   const results = await pool.map(
@@ -412,13 +429,13 @@ export class IsolatePool {
     /** Identifier used inside the generated worker for both the static
      *  import binding and the globalThis exposure. Sanitised from `name`. */
     id: string;
-    bytes: ArrayBuffer;
+    wasm: ArrayBuffer | WebAssembly.Module;
   }>;
-  /** Hash of (name + byte length + first/last bytes) of every wasm
-   *  module, folded into the loader cache key so changes invalidate
-   *  warm slots. Hashing the FULL bytes would be O(20+ MiB) per dispatch
-   *  and is unnecessary — wasm bytes are pinned at deploy time, the
-   *  length+endpoints are a strong-enough fingerprint. */
+  /** Hash of every constructor-time wasm module, folded into the loader
+   *  cache key so changes invalidate warm slots: a compiled module by the
+   *  identity its host described, bytes by name + length + first/last
+   *  byte. Hashing the FULL bytes would be O(20+ MiB) per dispatch and is
+   *  unnecessary — they are pinned at deploy time. */
   private readonly wasmHash: string;
   /**
    * Short prefix of the owning DO's id, baked into the loader.get()
@@ -457,7 +474,7 @@ export class IsolatePool {
     }
     this.loader = loader;
     this.ctx = ctx;
-    this.concurrency = Math.max(1, opts?.concurrency ?? 4);
+    this.concurrency = Math.max(1, opts?.concurrency ?? 1);
     this.defaultTimeoutMs = opts?.timeoutMs ?? 60_000;
     this.defaultRetries = Math.max(0, opts?.retries ?? 0);
     this.tag = opts?.tag ?? 'facet';
@@ -475,17 +492,36 @@ export class IsolatePool {
     // (e.g. 'esbuild.wasm' and 'esbuild_wasm' both sanitise to
     // 'esbuild_wasm') are rejected loudly because the generated worker
     // would otherwise have duplicate imports. Order is preserved.
-    const wasmEntries: Array<{ name: string; id: string; bytes: ArrayBuffer }> = [];
+    const wasmEntries: Array<{ name: string; id: string; wasm: ArrayBuffer | WebAssembly.Module }> = [];
+    const fingerprints: string[] = [];
     const seenIds = new Set<string>();
     if (opts?.wasmModules) {
-      for (const [name, bytes] of Object.entries(opts.wasmModules)) {
-        if (!(bytes instanceof ArrayBuffer)) {
+      for (const [name, wasm] of Object.entries(opts.wasmModules)) {
+        let fingerprint: string;
+        if (wasm instanceof ArrayBuffer) {
+          // Name + length + first/last byte: hashing 20+ MiB of wasm per
+          // dispatch would be wasteful, and these bytes change only with
+          // the deployed bundle.
+          const u = new Uint8Array(wasm);
+          const len = u.byteLength;
+          fingerprint = `${name}:${len}:${len > 0 ? u[0] : 0}:${len > 0 ? u[len - 1] : 0}`;
+        } else if (wasm instanceof WebAssembly.Module) {
+          const identity = hostWasmIdentity(wasm);
+          if (!identity) {
+            throw new BindingError(
+              `IsolatePool: wasmModules['${name}'] is a WebAssembly.Module nobody described; ` +
+              'pass it through describeHostWasm (@nimbus-sh/fabric/host-wasm.js) so warm slots ' +
+              'can be keyed by it and the code limit can count it.',
+            );
+          }
+          fingerprint = `${name}:host:${identity.id}:${identity.bytes}`;
+        } else {
           // Reached only when a caller broke the declared option type, so the
-          // value is whatever it really was rather than the ArrayBuffer here.
-          const got = (bytes as { constructor?: { name?: string } } | null | undefined)?.constructor?.name;
+          // value is whatever it really was rather than the union here.
+          const got = (wasm as { constructor?: { name?: string } } | null | undefined)?.constructor?.name;
           throw new BindingError(
-            `IsolatePool: wasmModules['${name}'] must be ArrayBuffer ` +
-            `(got ${got || typeof bytes}).`,
+            `IsolatePool: wasmModules['${name}'] must be an ArrayBuffer or a WebAssembly.Module ` +
+            `(got ${got || typeof wasm}).`,
           );
         }
         const id = name.replace(/[^A-Za-z0-9_]/g, '_').replace(/^[^A-Za-z_]/, '_');
@@ -496,28 +532,12 @@ export class IsolatePool {
           );
         }
         seenIds.add(id);
-        wasmEntries.push({ name, id, bytes });
+        wasmEntries.push({ name, id, wasm });
+        fingerprints.push(fingerprint);
       }
     }
     this.wasmModules = wasmEntries;
-    // Fingerprint: name + length + first/last byte of each module.
-    // Hashing 20+ MiB of wasm per dispatch would be wasteful; this
-    // fingerprint is bytes-stable for a given deployed bundle and only
-    // changes when the wasm itself changes (deploy-time event).
-    if (wasmEntries.length === 0) {
-      this.wasmHash = '0';
-    } else {
-      const fp = wasmEntries
-        .map((w) => {
-          const u = new Uint8Array(w.bytes);
-          const len = u.byteLength;
-          const first = len > 0 ? u[0] : 0;
-          const last  = len > 0 ? u[len - 1] : 0;
-          return `${w.name}:${len}:${first}:${last}`;
-        })
-        .join('|');
-      this.wasmHash = hashSource(fp);
-    }
+    this.wasmHash = fingerprints.length === 0 ? '0' : hashSource(fingerprints.join('|'));
 
     const bindings: Record<string, unknown> = { ...(opts?.extraBindings ?? {}) };
     this.supervisorKey = 's-none';
@@ -579,9 +599,9 @@ export class IsolatePool {
    */
   #materialisePerCallWasm(
     perCall: Record<string, ArrayBuffer> | undefined,
-  ): Array<{ name: string; id: string; bytes: ArrayBuffer }> {
+  ): Array<{ name: string; id: string; wasm: ArrayBuffer }> {
     if (!perCall) return [];
-    const out: Array<{ name: string; id: string; bytes: ArrayBuffer }> = [];
+    const out: Array<{ name: string; id: string; wasm: ArrayBuffer }> = [];
     const ctorIds = new Set(this.wasmModules.map((w) => w.id));
     const seen = new Set<string>();
     for (const [name, bytes] of Object.entries(perCall)) {
@@ -607,7 +627,7 @@ export class IsolatePool {
         );
       }
       seen.add(id);
-      out.push({ name, id, bytes });
+      out.push({ name, id, wasm: bytes });
     }
     return out;
   }
@@ -640,12 +660,12 @@ export class IsolatePool {
    * hashing the wasm were marginal; the correctness cost was severe.
    */
   #fingerprintWasm(
-    entries: Array<{ name: string; bytes: ArrayBuffer }>,
+    entries: Array<{ name: string; wasm: ArrayBuffer }>,
   ): string {
     if (entries.length === 0) return '0';
     const parts: string[] = [];
     for (const w of entries) {
-      const u = new Uint8Array(w.bytes);
+      const u = new Uint8Array(w.wasm);
       const len = u.byteLength;
       // djb2 over the bytes. Faster than crypto.subtle.digest at small
       // sizes, deterministic, and good enough for cache-key
@@ -672,11 +692,11 @@ export class IsolatePool {
    */
   #buildCode(
     fnSource: string,
-    perCallWasmEntries?: Array<{ name: string; id: string; bytes: ArrayBuffer }>,
+    perCallWasmEntries?: Array<{ name: string; id: string; wasm: ArrayBuffer }>,
   ) {
     const workerOpts = {
       compatibilityDate: CF_COMPAT_DATE,
-      compatibilityFlags: ['nodejs_compat'],
+      compatibilityFlags: [...GUEST_COMPAT_FLAGS],
       // Inherit parent network so the facet can reach registry.npmjs.org.
       globalOutbound: undefined,
       env: this.bindings,
@@ -722,7 +742,7 @@ export class IsolatePool {
     // (matters only for human-readable diffs; workerd doesn't care).
     const modules: Record<string, ModuleContent> = { 'worker.js': moduleSource };
     for (const w of allWasmEntries) {
-      modules[w.name] = { wasm: w.bytes };
+      modules[w.name] = { wasm: w.wasm };
     }
     assertModuleMapWithinCodeLimit(modules);
 
@@ -843,11 +863,10 @@ export class IsolatePool {
       // binding stub once the whole pool is done, which does NOT
       // invalidate any in-flight slot's entrypoint reference.
       const stub = this.loader.get(id, async () => code);
-      recordLoaderId(this.ctx, id);
       const entrypoint = stub.getEntrypoint();
       // Direct property call, awaited by this frame — bracketed, never
       // wrapped. See beginLoaderFetch for the measured DO-poisoning hazard.
-      const endFetch = beginLoaderFetch(this.ctx);
+      const endFetch = beginLoaderFetch(this.ctx, id);
       try {
         return await invoke(entrypoint, attempt);
       } catch (err) {
@@ -863,6 +882,8 @@ export class IsolatePool {
     const maxAttempts = 1 + resilience.retries;
     let lastError: Error | undefined;
     let retriedCloneRefusal = false;
+    let capRefusals = 0;
+    let capWaitedMs = 0;
     let attempt = 0;
     while (attempt < maxAttempts) {
       try {
@@ -944,6 +965,17 @@ export class IsolatePool {
           // reverse direction. This refresh targets the stale-loader case.
           continue;
         }
+        if (cause === 'dynamic_worker_cap' && capWaitedMs < CAP_REFUSAL_WAIT_MS) {
+          // The platform refused to start this call: it still counts a
+          // worker this Durable Object's ledger has already given back (a
+          // fan-out's workers stay counted for a moment after their calls
+          // return). Nothing ran, so the call waits, as the platform asks,
+          // and is sent again; it does not spend an attempt.
+          const delay = Math.min(CAP_REFUSAL_WAIT_MS - capWaitedMs, 50 * 2 ** capRefusals++, 2000);
+          capWaitedMs += delay;
+          await new Promise<void>((resolve) => setTimeout(resolve, delay));
+          continue;
+        }
         if (attempt < maxAttempts - 1) {
           // 100 * 2^attempt, capped at 2s so retries don't compound waiting.
           const delay = Math.min(2000, 100 * Math.pow(2, attempt));
@@ -952,9 +984,9 @@ export class IsolatePool {
         attempt++;
       }
     }
-    // On the way out only, so retries do not stack the annotation: a cap hit
-    // carries the ledger — which ids hold slots, and that a keyed id never
-    // gives one back — instead of the platform's bare message.
+    // On the way out only, so retries do not stack the annotation: a limit
+    // hit carries the ledger — which workers were in flight — instead of the
+    // platform's bare message.
     const named = withDynamicWorkerCapNamed(this.ctx, lastError!);
     if (maxAttempts > 1) {
       throw new RetryExhaustedError(maxAttempts, named);