@nimbus-sh/fabric 0.9.0 → 0.10.0

package/dist/isolate-pool.d.ts

@@ -24,6 +24,7 @@
  * and binding types used by this implementation.
  */
 import { type HostRoute } from './composition.js';
+import { type DynamicWorkerClaim } from './budgets.js';
 import type { FacetBindings } from '@nimbus-sh/core/runtime/facet-host.js';
 import type { WorkerLoader } from './vendor/types.js';
 /**
@@ -50,6 +51,12 @@ export interface IsolatePoolOptions {
      * caller that wants more sizes it against that budget (Fanout does).
      */
     concurrency?: number;
+    /**
+     * The width the caller claimed for this pool's dispatches
+     * (`claimDynamicWorkers`): they are held inside it rather than on top of
+     * it, and a refused one waits for a slot of the claim.
+     */
+    claim?: DynamicWorkerClaim;
     /** Per-task timeout in ms. Default 60_000. */
     timeoutMs?: number;
     /**
@@ -254,6 +261,8 @@ export declare class IsolatePool {
     private readonly loader;
     /** The hosting actor, as the loader budget ledger's per-DO key. */
     private readonly ctx;
+    /** The width this pool's dispatches are held inside (IsolatePoolOptions.claim). */
+    private readonly claim;
     private readonly concurrency;
     private readonly defaultTimeoutMs;
     private readonly defaultRetries;

package/dist/isolate-pool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"isolate-pool.d.ts","sourceRoot":"","sources":["../src/isolate-pool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,EAAwB,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAcxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,KAAK,EAAiB,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGrE;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,CAAC,CAAC,EAAE,CAAC,IAAI;IAC9B,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,aAAa,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACnD,CAAC,MAAM,CAAC,CAAC;AAEV,wEAAwE;AACxE,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,mDAAmD;AACnD,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAC;IAClC;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;;;;OAgBG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,eAAe,CAAC,EAAE,SAAS,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;CAChE;AAED,qDAAqD;AACrD,MAAM,WAAW,kBAAkB;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CAC3C;AAED,oEAAoE;AACpE,MAAM,WAAW,iBAAkB,SAAQ,kBAAkB;IAC3D,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;CACrC;AA0CD,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1D,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,8EAA8E;AAC9E,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,+BAA+B,GACvC,MAAM,CAgFR;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,WAAW;;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAqB;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA6B;IAC7D;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAC9D,sEAAsE;IACtE,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,QAAQ,CAAsC;IAEtD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAC9C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,WAAW,CAOzB;IACH;;;;wDAIoD;IACpD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC;;;;;;;;;OASG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IAEvC,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAE7B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,kBAAkB,EACvB,IAAI,CAAC,EAAE,kBAAkB;IAmH3B,wEAAwE;IACxE,IAAI,kBAAkB,IAAI,MAAM,CAE/B;IAqaD;;;OAGG;IACG,MAAM,CAAC,CAAC,EAAE,CAAC,EACf,EAAE,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,EACrB,GAAG,EAAE,CAAC,EACN,IAAI,CAAC,EAAE,kBAAkB,GACxB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAatB;;;;;;;;OAQG;IACG,aAAa,CACjB,EAAE,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,EAC1E,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE,kBAAkB,GACxB,OAAO,CAAC,QAAQ,CAAC;IAwBpB;;;;;OAKG;IACG,GAAG,CAAC,CAAC,EAAE,CAAC,EACZ,EAAE,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,EACrB,KAAK,EAAE,CAAC,EAAE,EACV,IAAI,CAAC,EAAE,iBAAiB,GACvB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAOpC;;;;;;;;;;;;;;;;OAgBG;IACG,SAAS,CAAC,CAAC,EAAE,CAAC,EAClB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,CAAC,EAAE,EACV,IAAI,CAAC,EAAE,iBAAiB,GACvB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IA+DpC;;;;;;;;;;;;;;OAcG;IACH,OAAO,IAAI,IAAI;CAShB"}
+{"version":3,"file":"isolate-pool.d.ts","sourceRoot":"","sources":["../src/isolate-pool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,EAAwB,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAIxE,OAAO,EAIL,KAAK,kBAAkB,EAExB,MAAM,cAAc,CAAC;AAUtB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,KAAK,EAAiB,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGrE;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,CAAC,CAAC,EAAE,CAAC,IAAI;IAC9B,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,aAAa,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACnD,CAAC,MAAM,CAAC,CAAC;AAEV,wEAAwE;AACxE,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,mDAAmD;AACnD,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAC;IAClC;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;;;;OAgBG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,eAAe,CAAC,EAAE,SAAS,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;CAChE;AAED,qDAAqD;AACrD,MAAM,WAAW,kBAAkB;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CAC3C;AAED,oEAAoE;AACpE,MAAM,WAAW,iBAAkB,SAAQ,kBAAkB;IAC3D,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;CACrC;AA2CD,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1D,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,8EAA8E;AAC9E,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,+BAA+B,GACvC,MAAM,CAgFR;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,WAAW;;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAqB;IACzC,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;IACvD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA6B;IAC7D;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAC9D,sEAAsE;IACtE,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,QAAQ,CAAsC;IAEtD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAC9C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,WAAW,CAOzB;IACH;;;;wDAIoD;IACpD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC;;;;;;;;;OASG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IAEvC,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAE7B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,kBAAkB,EACvB,IAAI,CAAC,EAAE,kBAAkB;IAoH3B,wEAAwE;IACxE,IAAI,kBAAkB,IAAI,MAAM,CAE/B;IA2bD;;;OAGG;IACG,MAAM,CAAC,CAAC,EAAE,CAAC,EACf,EAAE,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,EACrB,GAAG,EAAE,CAAC,EACN,IAAI,CAAC,EAAE,kBAAkB,GACxB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAatB;;;;;;;;OAQG;IACG,aAAa,CACjB,EAAE,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,EAC1E,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE,kBAAkB,GACxB,OAAO,CAAC,QAAQ,CAAC;IAwBpB;;;;;OAKG;IACG,GAAG,CAAC,CAAC,EAAE,CAAC,EACZ,EAAE,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,EACrB,KAAK,EAAE,CAAC,EAAE,EACV,IAAI,CAAC,EAAE,iBAAiB,GACvB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAOpC;;;;;;;;;;;;;;;;OAgBG;IACG,SAAS,CAAC,CAAC,EAAE,CAAC,EAClB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,CAAC,EAAE,EACV,IAAI,CAAC,EAAE,iBAAiB,GACvB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IA+DpC;;;;;;;;;;;;;;OAcG;IACH,OAAO,IAAI,IAAI;CAShB"}

package/dist/isolate-pool.js

@@ -28,17 +28,18 @@ import { supervisorEntrypoint } from './composition.js';
 import { supervisorBindingProps, supervisorLoaderKey } from './supervisor-props.js';
 import { disposeRpcResource } from '@nimbus-sh/platform/rpc-dispose.js';
 import { serializeFunction, hashSource } from './vendor/serialize.js';
-import { beginLoaderFetch, withDynamicWorkerCapNamed } from './budgets.js';
+import { beginLoaderFetch, beginLoaderFetchWhenFree, withDynamicWorkerCapNamed, } from './budgets.js';
 import { assertModuleMapWithinCodeLimit } from './budgets.js';
 import { recordFailure, setLastFacetId, getLastRpcFrame } from '@nimbus-sh/platform/oom-discriminator.js';
 import { classifyError } from '@nimbus-sh/platform/oom-classify.js';
 import { BindingError, ExecutionError, RetryExhaustedError, TimeoutError, } from './vendor/errors.js';
 import { hostWasmIdentity } from './host-wasm.js';
 /**
- * How long one call waits, in all, for the platform to admit it after
- * "Dynamic worker concurrency limit exceeded" (doubling from 50 ms, at most
- * 2 s a wait). A deployed Durable Object admitted the refused batch after a
- * 6 s pause; 15 s bounds a call that would never be admitted.
+ * How long one call waits, in all, on the Dynamic Worker ledger after
+ * "Dynamic worker concurrency limit exceeded" before the refusal surfaces
+ * (beginLoaderFetchWhenFree: let in when a hold ends or the refusal's pause
+ * passes). A deployed Durable Object admitted the refused batch after a 6 s
+ * pause; 15 s bounds a call that would never be admitted.
  */
 const CAP_REFUSAL_WAIT_MS = 15_000;
 /**
@@ -120,6 +121,8 @@ export class IsolatePool {
     loader;
     /** The hosting actor, as the loader budget ledger's per-DO key. */
     ctx;
+    /** The width this pool's dispatches are held inside (IsolatePoolOptions.claim). */
+    claim;
     concurrency;
     defaultTimeoutMs;
     defaultRetries;
@@ -183,6 +186,7 @@ export class IsolatePool {
         }
         this.loader = loader;
         this.ctx = ctx;
+        this.claim = opts?.claim;
         this.concurrency = Math.max(1, opts?.concurrency ?? 1);
         this.defaultTimeoutMs = opts?.timeoutMs ?? 60_000;
         this.defaultRetries = Math.max(0, opts?.retries ?? 0);
@@ -455,7 +459,7 @@ export class IsolatePool {
      * the attempt index lets a fetch invoke mint a fresh clone for retries,
      * since a Request's body is consumed once.
      */
-    async #dispatchSlot(fnSource, fnHash, slotIndex, invoke, resilience, perCallWasm, wasAborted) {
+    async #dispatchSlot(fnSource, fnHash, slotIndex, invoke, resilience, perCallWasm, signal) {
         // A warm slot executes one dispatch at a time: queue behind the
         // previous owner, then record this dispatch as the new tail. The
         // tail outlives the caller's outcome: a timeout rejects the
@@ -472,7 +476,7 @@ export class IsolatePool {
         }
         const inFlight = [];
         try {
-            return await this.#dispatchSlotOwned(fnSource, fnHash, slotIndex, invoke, resilience, perCallWasm, inFlight, wasAborted);
+            return await this.#dispatchSlotOwned(fnSource, fnHash, slotIndex, invoke, resilience, perCallWasm, inFlight, signal);
         }
         finally {
             // Do not delay the caller's own outcome — the tail releases when
@@ -480,7 +484,7 @@ export class IsolatePool {
             void Promise.allSettled(inFlight).then(() => release());
         }
     }
-    async #dispatchSlotOwned(fnSource, fnHash, slotIndex, invoke, resilience, perCallWasm, inFlight, wasAborted) {
+    async #dispatchSlotOwned(fnSource, fnHash, slotIndex, invoke, resilience, perCallWasm, inFlight, signal) {
         // Per-call wasm fingerprint. Mixed into the cache key so two calls
         // with different bytes hit different slots (no cache poisoning).
         // For the common case (no per-call wasm) the fingerprint is '0',
@@ -502,6 +506,9 @@ export class IsolatePool {
             setLastFacetId(id, slotIndex);
         }
         catch { /* best-effort */ }
+        // A hold the ledger already took for the next attempt, when a refused
+        // call waited on it for room; otherwise the attempt begins its own.
+        let admitted;
         const runOnce = async () => {
             // loader.get() is synchronous from the caller's POV; the callback
             // is only invoked on cache miss. We wrap the callback tightly so a
@@ -527,15 +534,21 @@ export class IsolatePool {
             // fine and stays — it only tears down the long-lived SUPERVISOR
             // binding stub once the whole pool is done, which does NOT
             // invalidate any in-flight slot's entrypoint reference.
-            const stub = this.loader.get(id, async () => code);
-            const entrypoint = stub.getEntrypoint();
-            // Direct property call, awaited by this frame — bracketed, never
-            // wrapped. See beginLoaderFetch for the measured DO-poisoning hazard.
-            const endFetch = beginLoaderFetch(this.ctx, id);
+            //
+            // The hold comes first, so it ends whatever setup throws: a retry's
+            // was taken when the ledger let it in.
+            const endFetch = admitted ?? beginLoaderFetch(this.ctx, id, this.claim);
+            admitted = undefined;
             try {
+                const stub = this.loader.get(id, async () => code);
+                const entrypoint = stub.getEntrypoint();
+                // Direct property call, awaited by this frame — bracketed, never
+                // wrapped. See beginLoaderFetch for the measured DO-poisoning hazard.
                 return await invoke(entrypoint, attempt);
             }
             catch (err) {
+                // The ledger learns a limit refusal from the hold it ends.
+                endFetch(err);
                 if (err instanceof Error) {
                     throw new ExecutionError(err.message, err.stack);
                 }
@@ -548,8 +561,8 @@ export class IsolatePool {
         const maxAttempts = 1 + resilience.retries;
         let lastError;
         let retriedCloneRefusal = false;
-        let capRefusals = 0;
-        let capWaitedMs = 0;
+        // When this call's waits for room after a limit refusal run out.
+        let capDeadline;
         let attempt = 0;
         while (attempt < maxAttempts) {
             try {
@@ -609,7 +622,7 @@ export class IsolatePool {
                     });
                 }
                 catch { /* fail-soft */ }
-                if (wasAborted?.()) {
+                if (signal?.aborted) {
                     // The caller aborted this dispatch's Request. workerd cancelled
                     // the isolate's execution context wherever it was suspended —
                     // mid-syscall, mid-stream — so the interpreter's heap may hold
@@ -635,16 +648,31 @@ export class IsolatePool {
                     // reverse direction. This refresh targets the stale-loader case.
                     continue;
                 }
-                if (cause === 'dynamic_worker_cap' && capWaitedMs < CAP_REFUSAL_WAIT_MS) {
-                    // The platform refused to start this call: it still counts a
-                    // worker this Durable Object's ledger has already given back (a
-                    // fan-out's workers stay counted for a moment after their calls
-                    // return). Nothing ran, so the call waits, as the platform asks,
-                    // and is sent again; it does not spend an attempt.
-                    const delay = Math.min(CAP_REFUSAL_WAIT_MS - capWaitedMs, 50 * 2 ** capRefusals++, 2000);
-                    capWaitedMs += delay;
-                    await new Promise((resolve) => setTimeout(resolve, delay));
-                    continue;
+                if (cause === 'dynamic_worker_cap') {
+                    // The platform refused to start this call. Nothing ran, so the
+                    // call waits, as the platform asks, and is sent again without
+                    // spending an attempt: on the ledger, which lets it in when a
+                    // hold ends, or when the pause this refusal started has passed
+                    // (the platform still counts a worker the ledger has given back:
+                    // a fan-out's workers stay counted for a moment after their
+                    // calls return).
+                    capDeadline ??= Date.now() + CAP_REFUSAL_WAIT_MS;
+                    const remainingMs = capDeadline - Date.now();
+                    if (remainingMs > 0) {
+                        // The deadline's timer is cleared once the wait settles: a
+                        // pending timer keeps the hosting object from hibernating.
+                        const deadline = new AbortController();
+                        const timer = setTimeout(() => deadline.abort(), remainingMs);
+                        const waitFor = signal ? AbortSignal.any([deadline.signal, signal]) : deadline.signal;
+                        admitted = await beginLoaderFetchWhenFree(this.ctx, id, { claim: this.claim, signal: waitFor })
+                            .catch(() => undefined)
+                            .finally(() => clearTimeout(timer));
+                        if (admitted)
+                            continue;
+                        // The caller aborted while waiting: surface its abort as above.
+                        if (signal?.aborted)
+                            throw lastError;
+                    }
                 }
                 if (attempt < maxAttempts - 1) {
                     // 100 * 2^attempt, capped at 2s so retries don't compound waiting.
@@ -696,7 +724,7 @@ export class IsolatePool {
         // Every attempt fetches a clone: a Request's body is consumed once,
         // so the caller's original stays unspent and retries get a fresh
         // body that follows the same signal.
-        return this.#dispatchSlot(fnSource, fnHash, 0, (entrypoint) => entrypoint.fetch(request.clone()), resilience, opts?.wasmModules, () => request.signal.aborted);
+        return this.#dispatchSlot(fnSource, fnHash, 0, (entrypoint) => entrypoint.fetch(request.clone()), resilience, opts?.wasmModules, request.signal);
     }
     /**
      * Run `fn` on every item in `items`, at most `concurrency` at a time,

package/dist/workerd-facet-host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workerd-facet-host.d.ts","sourceRoot":"","sources":["../src/workerd-facet-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAoBH,OAAO,EAGL,KAAK,aAAa,EAElB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC7B,MAAM,qBAAqB,CAAC;AAK7B,+DAA+D;AAC/D,MAAM,WAAW,0BAA0B;IACzC,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5D,KAAK,CAAC,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,gBAAgB;IAC/B,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE;QACjC,KAAK,EAAE;YACL,GAAG,EAAE,MAAM,CAAC;YACZ,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;YACpB,KAAK,EAAE,MAAM,CAAC;YACd,UAAU,EAAE,uBAAuB,CAAC;YACpC,KAAK,CAAC,EAAE,OAAO,CAAC;SACjB,CAAC;KACH,KAAK,0BAA0B,CAAC;CAClC;AAED,wBAAgB,mBAAmB,IAAI,gBAAgB,CAMtD;AAED;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAChD,UAAU,EAAE,gBAAgB,EAC5B,UAAU,EAAE,uBAAuB,EACnC,KAAK,EAAE,OAAO,EACd,IAAI,GAAE,MAAM,GAAG,IAAW,GACzB,OAAO,CAAC,0BAA0B,CAAC,CAerC;AA8BD,gDAAgD;AAChD,UAAU,gBAAgB;IACxB,aAAa,IAAI,0BAA0B,CAAC;CAC7C;AAED;;;;;;;;;;;;;GAaG;AACH,UAAU,mBAAmB;IAC3B,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,OAAO,GAAG;QAAE,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC9F,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,gBAAgB,CAAC;CACvC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC9B;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,kBAAkB,EACvB,KAAK,EAAE;IACL,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACrD,GACA,OAAO,CAAC,IAAI,CAAC,CAuBf;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,iEAAiE;AACjE,eAAO,MAAM,yBAAyB,cAAc,CAAC;AA4FrD,qGAAqG;AACrG,wBAAgB,eAAe,CAAC,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAExF;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAI9E;AAID;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9F;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,GAAG,SAAS,CAEnF;AAED,qBAAa,SAAS;IAElB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBADH,GAAG,EAAE,kBAAkB,EACvB,GAAG,EAAE,gBAAgB;IAGxC,8EAA8E;IAC9E,KAAK,CACH,IAAI,EAAE,MAAM,kBAAkB,EAC9B,UAAU,EAAE,uBAAuB,EACnC,MAAM,EAAE,iBAAiB,GACxB,aAAa;IAIhB;;;;;;;;;;;;OAYG;IACH,GAAG,CAAC,CAAC,EACH,UAAU,EAAE,uBAAuB,EACnC,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAC1C,OAAO,CAAC,CAAC,CAAC;CAGd;AAiPD;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,gBAAgB,EACrB,IAAI,EAAE,MAAM,kBAAkB,EAC9B,UAAU,EAAE,uBAAuB,EACnC,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAelC"}
+{"version":3,"file":"workerd-facet-host.d.ts","sourceRoot":"","sources":["../src/workerd-facet-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAoBH,OAAO,EAGL,KAAK,aAAa,EAElB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC7B,MAAM,qBAAqB,CAAC;AAK7B,+DAA+D;AAC/D,MAAM,WAAW,0BAA0B;IACzC,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5D,KAAK,CAAC,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,gBAAgB;IAC/B,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE;QACjC,KAAK,EAAE;YACL,GAAG,EAAE,MAAM,CAAC;YACZ,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;YACpB,KAAK,EAAE,MAAM,CAAC;YACd,UAAU,EAAE,uBAAuB,CAAC;YACpC,KAAK,CAAC,EAAE,OAAO,CAAC;SACjB,CAAC;KACH,KAAK,0BAA0B,CAAC;CAClC;AAED,wBAAgB,mBAAmB,IAAI,gBAAgB,CAMtD;AAED;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAChD,UAAU,EAAE,gBAAgB,EAC5B,UAAU,EAAE,uBAAuB,EACnC,KAAK,EAAE,OAAO,EACd,IAAI,GAAE,MAAM,GAAG,IAAW,GACzB,OAAO,CAAC,0BAA0B,CAAC,CAerC;AA8BD,gDAAgD;AAChD,UAAU,gBAAgB;IACxB,aAAa,IAAI,0BAA0B,CAAC;CAC7C;AAED;;;;;;;;;;;;;GAaG;AACH,UAAU,mBAAmB;IAC3B,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,OAAO,GAAG;QAAE,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC9F,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,gBAAgB,CAAC;CACvC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC9B;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,kBAAkB,EACvB,KAAK,EAAE;IACL,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACrD,GACA,OAAO,CAAC,IAAI,CAAC,CAuBf;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,iEAAiE;AACjE,eAAO,MAAM,yBAAyB,cAAc,CAAC;AA4FrD,qGAAqG;AACrG,wBAAgB,eAAe,CAAC,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAExF;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAI9E;AAID;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9F;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,GAAG,SAAS,CAEnF;AAED,qBAAa,SAAS;IAElB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBADH,GAAG,EAAE,kBAAkB,EACvB,GAAG,EAAE,gBAAgB;IAGxC,8EAA8E;IAC9E,KAAK,CACH,IAAI,EAAE,MAAM,kBAAkB,EAC9B,UAAU,EAAE,uBAAuB,EACnC,MAAM,EAAE,iBAAiB,GACxB,aAAa;IAIhB;;;;;;;;;;;;OAYG;IACH,GAAG,CAAC,CAAC,EACH,UAAU,EAAE,uBAAuB,EACnC,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAC1C,OAAO,CAAC,CAAC,CAAC;CAGd;AAqPD;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,gBAAgB,EACrB,IAAI,EAAE,MAAM,kBAAkB,EAC9B,UAAU,EAAE,uBAAuB,EACnC,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAelC"}

package/dist/workerd-facet-host.js

@@ -470,6 +470,11 @@ async function runOneShot(ctx, env, supervisor, params, consume) {
                 disposeRpcResource(response);
             }
         }
+        catch (error) {
+            // A limit refusal pauses the ledger's admissions (beginLoaderFetchWhenFree).
+            endFetch(error);
+            throw error;
+        }
         finally {
             endFetch();
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nimbus-sh/fabric",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "The Cloudflare half of Nimbus \u2014 Durable Object facet hosting, dynamic-worker loader pools, the resident-process fabric, and DO alarm/hibernation machinery.",
   "keywords": [
     "cloudflare",
@@ -50,7 +50,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@nimbus-sh/core": "^0.14.0",
+    "@nimbus-sh/core": "^0.15.0",
     "@nimbus-sh/platform": "^0.7.0",
     "zod": "^4.4.3"
   },

package/src/bindings.ts

@@ -29,6 +29,7 @@ import { disposeRpcResource, useRpcResource } from '@nimbus-sh/platform/rpc-disp
 import { hostNamespace, supervisorEntrypoint, supervisorEntrypointName, stagedBootAssembler } from './composition.js';
 import type { HostRoute } from './composition.js';
 import { hostNamespaceBinding, hostOpDispatch, type HostOpDispatch } from './host-dispatch.js';
+import { innerDoIdFromName } from './inner-do-env.js';
 import { assertModuleMapWithinCodeLimit } from './budgets.js';
 import type { EntrypointLoopbackFactory } from './composition.js';
 import type { WorkerCode } from './vendor/types.js';
@@ -708,46 +709,23 @@ interface NimbusDoNamespaceProps {
 }
 
 /**
- * `env.MY_DO` shim — a DurableObjectNamespace-like WorkerEntrypoint.
+ * The binding the loader passes for `env.MY_DO` (a WorkerEntrypoint of the
+ * session's isolate). The inner Worker does not use it as its namespace: a
+ * DurableObjectNamespace's API is synchronous, and this one's answers are
+ * RpcPromises, which cannot travel as arguments. The inner Worker replaces it
+ * with a local namespace (inner-do-env.ts, innerWorkerModules) that makes ids
+ * and stubs itself, and relays each member a stub's caller reaches, its
+ * fetch included, to `callOn` or `getOn`.
  *
- * Usage from inner Worker:
- *   const id   = await env.MY_DO.idFromName('x');   // AWAIT required
- *   const stub = env.MY_DO.get(id);
- *   await stub.fetch(request);
- *
- * IMPORTANT: unlike the real DurableObjectNamespace, idFromName /
- * newUniqueId / idFromString here return **Promises**, because they're
- * RPC-backed WorkerEntrypoint methods. The inner caller MUST `await`
- * them before passing the result to `.get()`. Workers RPC pipelining
- * does not currently allow passing an RpcPromise as a method argument
- * — the no-await form fails with:
- *     "Could not serialize object of type \"RpcPromise\"."
- *
- * Typical real-Worker code written for Cloudflare's synchronous
- * DurableObjectNamespace needs a one-word change (add `await`).
- *
- * idFromName produces prefix `name:` (deterministic FNV-style hash);
- * newUniqueId uses `uniq:` (random). The prefixes keep the two id
- * spaces distinct so a name-derived id can't collide with a random
- * one.
+ * `idFromName`, `newUniqueId`, `idFromString` and `get` answer as before, for
+ * a caller that awaits them. idFromName produces prefix `name:` (a
+ * deterministic hash, innerDoIdFromName); newUniqueId uses `uniq:`; the
+ * prefixes keep the two id spaces distinct.
  */
-export class NimbusDurableObjectNamespace extends WorkerEntrypoint<unknown, NimbusDoNamespaceProps> {
+export class NimbusDurableObjectNamespace extends WorkerEntrypoint<object, NimbusDoNamespaceProps> {
   /** Stable string id derived from a name. Hash is deterministic. */
   idFromName(name: string): string {
-    // Simple 64-bit-ish FNV-style hash → hex. Stable across runs;
-    // distinct names → distinct strings; same name → same string.
-    let h1 = 0xdeadbeef ^ name.length;
-    let h2 = 0x41c6ce57 ^ name.length;
-    for (let i = 0; i < name.length; i++) {
-      const ch = name.charCodeAt(i);
-      h1 = Math.imul(h1 ^ ch, 2654435761);
-      h2 = Math.imul(h2 ^ ch, 1597334677);
-    }
-    h1 = Math.imul(h1 ^ (h1 >>> 16), 2246822507) ^ Math.imul(h2 ^ (h2 >>> 13), 3266489909);
-    h2 = Math.imul(h2 ^ (h2 >>> 16), 2246822507) ^ Math.imul(h1 ^ (h1 >>> 13), 3266489909);
-    const high = (h1 >>> 0).toString(16).padStart(8, '0');
-    const low = (h2 >>> 0).toString(16).padStart(8, '0');
-    return 'name:' + high + low;
+    return innerDoIdFromName(name);
   }
 
   /** Fresh random id (matches DurableObjectNamespace.newUniqueId()). */
@@ -774,6 +752,19 @@ export class NimbusDurableObjectNamespace extends WorkerEntrypoint<unknown, Nimb
       },
     });
   }
+
+  /**
+   * The member of object `id` at `path` (names from the object down), called
+   * with `args`: its answer, or what it throws, as the object gave it.
+   */
+  callOn(id: string, path: string[], args: unknown[]): Promise<unknown> {
+    return innerDoMember(this.env, { ...(this.ctx.props || {}), id: String(id) }, path, args);
+  }
+
+  /** The member of object `id` at `path`, read. */
+  getOn(id: string, path: string[]): Promise<unknown> {
+    return innerDoMember(this.env, { ...(this.ctx.props || {}), id: String(id) }, path, null);
+  }
 }
 
 /** Props the DO stub carries: which binding, which supervisor, which id. */
@@ -782,70 +773,102 @@ interface NimbusDoStubProps extends NimbusDoNamespaceProps {
 }
 
 /**
- * A Durable-Object-namespace-stub for a specific id. Exposes fetch()
- * and will, if we later need it, forward RPC method calls through a
- * dispatch helper. The important invariant: EVERY call resolves the
- * inner DO class via getInnerDoClass() (./inner-do-registry.js) and
- * spins up / attaches to a facet via the supervisor's ctx.facets in
- * the SAME outer request context — never reusing stubs across requests.
+ * The session Durable Object, through the composed host namespace, and its
+ * one supervisorOp entrypoint: a host forwards envelopes, not private _rpc*
+ * methods. Throws when the binding cannot reach it; `release` drops the stub.
  */
-export class NimbusDOStub extends WorkerEntrypoint<object, NimbusDoStubProps> {
-  /**
-   * Resolve the supervisor DO through the composed host namespace and
-   * dispatch the innerDoFetch op through its one supervisorOp entrypoint —
-   * a host forwards envelopes, not private _rpc* methods.
-   */
-  async fetch(request: Request): Promise<Response> {
-    const props: NimbusDoStubProps = this.ctx.props || {};
-    const supervisorDoId = String(props.supervisorDoId || '');
-    if (!supervisorDoId) return new Response('Nimbus: supervisorDoId missing', { status: 500 });
-    const bindingName = String(props.bindingName || '');
-    const id = String(props.id || '');
-    let stub: DurableObjectStub | null = null;
-    let dispatch: HostOpDispatch;
-    try {
-      const ns = hostNamespaceBinding(this.env ?? {}, 'NimbusDOStub', props.route);
-      stub = ns.get(ns.idFromString(supervisorDoId));
-      dispatch = hostOpDispatch(stub, 'NimbusDOStub', props.route);
-    } catch (e) {
-      disposeRpcResource(stub);
-      return new Response(`Nimbus: ${e instanceof Error ? e.message : String(e)}`, { status: 500 });
-    }
-    // Forward the full request (method, body, headers preserved) by
-    // serializing what's needed and reconstructing on the other side.
-    // The supervisor reconstitutes the Request from these fields and
-    // invokes the facet.
-    const body = request.method !== 'GET' && request.method !== 'HEAD'
-      ? await request.arrayBuffer()
-      : null;
+function supervisorOf(env: object | undefined, props: NimbusDoStubProps): { dispatch: HostOpDispatch; release(): void } {
+  const supervisorDoId = String(props.supervisorDoId || '');
+  if (!supervisorDoId) throw new Error('supervisorDoId missing');
+  let stub: DurableObjectStub | null = null;
+  try {
+    const ns = hostNamespaceBinding(env ?? {}, 'NimbusDOStub', props.route);
+    stub = ns.get(ns.idFromString(supervisorDoId));
+    const held = stub;
+    return { dispatch: hostOpDispatch(stub, 'NimbusDOStub', props.route), release: () => disposeRpcResource(held) };
+  } catch (e) {
+    disposeRpcResource(stub);
+    throw e;
+  }
+}
+
+/** What the session's innerDoFetch answers: the object's response, as fields. */
+export interface InnerDoFetchAnswer {
+  status: number;
+  statusText: string;
+  headers: [string, string][];
+  body: ArrayBuffer | null;
+}
+
+function isInnerDoFetchAnswer(value: unknown): value is InnerDoFetchAnswer {
+  return value !== null && typeof value === 'object'
+    && 'status' in value && typeof value.status === 'number'
+    && 'statusText' in value && typeof value.statusText === 'string'
+    && 'headers' in value && Array.isArray(value.headers)
+    && 'body' in value && (value.body === null || value.body instanceof ArrayBuffer);
+}
+
+/**
+ * The inner object's fetch: the request forwarded whole (method, body,
+ * headers) as fields the session reconstructs, and its response rebuilt here
+ * from the fields the session answers. A binding that cannot reach the
+ * session answers 500.
+ */
+async function innerDoFetch(env: object | undefined, props: NimbusDoStubProps, request: Request): Promise<Response> {
+  let supervisor: ReturnType<typeof supervisorOf>;
+  try {
+    supervisor = supervisorOf(env, props);
+  } catch (e) {
+    return new Response(`Nimbus: ${e instanceof Error ? e.message : String(e)}`, { status: 500 });
+  }
+  try {
+    const body = request.method !== 'GET' && request.method !== 'HEAD' ? await request.arrayBuffer() : null;
     const headerList: [string, string][] = [];
     request.headers.forEach((v, k) => { headerList.push([k, v]); });
-    try {
-      return await useRpcResource(
-        dispatch({
-          op: 'innerDoFetch',
-          args: [{
-            bindingName,
-            id,
-            method: request.method,
-            url: request.url,
-            headers: headerList,
-            body,
-          }],
-        }),
-        (res) => {
-          if (!(res instanceof Response)) {
-            return new Response('Nimbus: innerDoFetch returned an invalid result', { status: 502 });
-          }
-          return new Response(res.body, {
-            status: res.status,
-            statusText: res.statusText,
-            headers: res.headers,
-          });
-        },
-      );
-    } finally {
-      disposeRpcResource(stub);
-    }
+    return await useRpcResource(
+      supervisor.dispatch({
+        op: 'innerDoFetch',
+        args: [{ bindingName: String(props.bindingName || ''), id: String(props.id || ''), method: request.method, url: request.url, headers: headerList, body }],
+      }),
+      (res) => {
+        if (!isInnerDoFetchAnswer(res)) {
+          return new Response('Nimbus: innerDoFetch returned an invalid result', { status: 502 });
+        }
+        return new Response(res.body, { status: res.status, statusText: res.statusText, headers: res.headers });
+      },
+    );
+  } finally {
+    supervisor.release();
+  }
+}
+
+/**
+ * A member of the inner object, called with `args` or read (`args` null): the
+ * session reaches it on the object's facet and answers what it answered (a
+ * stub, function or stream travels as one) or rejects with what it threw,
+ * type and message kept.
+ */
+async function innerDoMember(env: object | undefined, props: NimbusDoStubProps, path: string[], args: unknown[] | null): Promise<unknown> {
+  const supervisor = supervisorOf(env, props);
+  try {
+    return await supervisor.dispatch({
+      op: 'innerDoCall',
+      args: [{ bindingName: String(props.bindingName || ''), id: String(props.id || ''), path, args }],
+    });
+  } finally {
+    supervisor.release();
+  }
+}
+
+/**
+ * A Durable-Object-namespace-stub for a specific id, for a caller of the
+ * binding's own `get`: its fetch. The important invariant: EVERY call
+ * resolves the inner DO class via getInnerDoClass() (./inner-do-registry.js)
+ * and spins up / attaches to a facet via the supervisor's ctx.facets in the
+ * SAME outer request context — never reusing stubs across requests.
+ */
+export class NimbusDOStub extends WorkerEntrypoint<object, NimbusDoStubProps> {
+  async fetch(request: Request): Promise<Response> {
+    return innerDoFetch(this.env, this.ctx.props || {}, request);
   }
 }