@nimbus-sh/platform 0.6.0 → 0.7.1

package/dist/composition.d.ts

@@ -66,7 +66,8 @@ export declare const DEFAULT_HOST_DISPATCH_METHOD = "supervisorOp";
  * Compose once per isolate. A second call with the same values is a no-op;
  * a second call with different values throws, naming both, so an embedder
  * whose composition lost to an earlier import learns it at startup rather
- * than from a facet that reached the wrong host.
+ * than from a facet that reached the wrong host. A host without
+ * `enhanced_error_serialization` is refused.
  */
 export declare function composeFabric(value: FabricComposition): void;
 export declare function adoptCtxExports(value: CtxExports): void;

package/dist/composition.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"composition.d.ts","sourceRoot":"","sources":["../src/composition.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,IAAI,GAAG,OAAO,EAAE,OAAO,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,KAAK,IAAI,CAAC;AAC7F,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,yBAAyB,GAAG,SAAS,CAAC,CAAC;AAC/E,MAAM,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAEpF,MAAM,WAAW,iBAAiB;IAChC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,sBAAsB,mBAAmB,CAAC;AACvD,eAAO,MAAM,4BAA4B,iBAAiB,CAAC;AAI3D;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAmB5D;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAEvD;AAED,wBAAgB,aAAa,IAAI,UAAU,GAAG,IAAI,CAEjD;AAED,wBAAgB,oBAAoB,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,qBAAoC,GAAG,yBAAyB,GAAG,IAAI,CAMrI;AAED,wBAAgB,wBAAwB,IAAI,MAAM,GAAG,IAAI,CAExD;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,IAAI,SAAS,GAAG,IAAI,CAO5C;AAED,wBAAgB,mBAAmB,IAAI,mBAAmB,CASzD"}
+{"version":3,"file":"composition.d.ts","sourceRoot":"","sources":["../src/composition.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,IAAI,GAAG,OAAO,EAAE,OAAO,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,KAAK,IAAI,CAAC;AAC7F,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,yBAAyB,GAAG,SAAS,CAAC,CAAC;AAC/E,MAAM,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAEpF,MAAM,WAAW,iBAAiB;IAChC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,sBAAsB,mBAAmB,CAAC;AACvD,eAAO,MAAM,4BAA4B,iBAAiB,CAAC;AAmC3D;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAoB5D;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAEvD;AAED,wBAAgB,aAAa,IAAI,UAAU,GAAG,IAAI,CAEjD;AAED,wBAAgB,oBAAoB,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,qBAAoC,GAAG,yBAAyB,GAAG,IAAI,CAMrI;AAED,wBAAgB,wBAAwB,IAAI,MAAM,GAAG,IAAI,CAExD;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,IAAI,SAAS,GAAG,IAAI,CAO5C;AAED,wBAAgB,mBAAmB,IAAI,mBAAmB,CASzD"}

package/dist/composition.js

@@ -2,13 +2,45 @@ export const DEFAULT_HOST_NAMESPACE = 'NIMBUS_SESSION';
 export const DEFAULT_HOST_DISPATCH_METHOD = 'supervisorOp';
 let composition = null;
 let ctxExports = null;
+/**
+ * A program's filesystem errors reach it across workerd RPC, from the host
+ * that answers its supervisor binding, and the program branches on the POSIX
+ * `code` each one carries. workerd carries an error's own properties across
+ * RPC only when the sending AND the receiving isolate have
+ * `enhanced_error_serialization`, on by compatibility date from 2026-04-21:
+ * the serializer writes a native error as a host object with its own
+ * properties only under the flag (src/workerd/jsg/ser.c++,
+ * Serializer::IsHostObject), and the receiver reads that detail back only
+ * under it (src/workerd/jsg/util.c++, decodeTunneledException); see
+ * https://developers.cloudflare.com/workers/runtime-apis/rpc/error-handling/.
+ * Programs load at CF_COMPAT_DATE, past it. The host runs at its embedder's
+ * date, and below it every ENOENT would reach every program as a bare message
+ * it maps to EIO. So composing refuses such a host, wherever it composes
+ * (module scope: the Worker fails at startup; NimbusWorkspace.create: that
+ * call throws), and names both fixes: the flag alone keeps
+ * every other behavior of the embedder's date. Off workerd (bun, node) there
+ * is no RPC hop and no `Cloudflare` global to read.
+ */
+function requireEnhancedErrorSerialization() {
+    // `typeof` of an undeclared global is 'undefined', not a ReferenceError.
+    if (typeof Cloudflare === 'undefined')
+        return;
+    if (Cloudflare.compatibilityFlags.enhanced_error_serialization === true)
+        return;
+    throw new Error('fabric: this Worker runs without the enhanced_error_serialization compatibility flag, so the '
+        + "code on a program's filesystem error (ENOENT, EEXIST, ...) would not survive the RPC back "
+        + 'to it. Add "enhanced_error_serialization" to compatibility_flags in your wrangler config, '
+        + 'or set compatibility_date to 2026-04-21 or later.');
+}
 /**
  * Compose once per isolate. A second call with the same values is a no-op;
  * a second call with different values throws, naming both, so an embedder
  * whose composition lost to an earlier import learns it at startup rather
- * than from a facet that reached the wrong host.
+ * than from a facet that reached the wrong host. A host without
+ * `enhanced_error_serialization` is refused.
  */
 export function composeFabric(value) {
+    requireEnhancedErrorSerialization();
     if (!composition) {
         composition = value;
         return;

package/dist/diag-counters.d.ts

@@ -75,12 +75,6 @@ export interface DiagCounters {
      * Surfaced as `breakdown.prefetchCacheBytes`. A gauge, not a delta.
      */
     prefetchCacheBytes: number;
-    /**
-     * Bytes retained by the FacetManager's ESM→CJS transform cache, bounded by
-     * ESM_TRANSFORM_CACHE_MAX_BYTES. Surfaced as `breakdown.transformCacheBytes`.
-     * A gauge, not a delta.
-     */
-    transformCacheBytes: number;
     /** Install-facet counters. Populated by npm-installer after a
      *  successful batch-facet dispatch returns. Confirms the install ran
      *  in the facet (tarballsCompleted > 0) and surfaces the
@@ -119,6 +113,15 @@ export interface DiagCounters {
          *  Empty when the most recent batch had zero errors. */
         errorsByModule: Record<string, string>;
     };
+    /**
+     * File contents and stdin the session has handed its processes, cumulative
+     * since isolate start: the bytes of each supervisor envelope's answer as it
+     * leaves the session (worker session/supervisor-op.ts answerSupervisorOp)
+     * from readFile, readFileBytes, fsRead, fsReadRange, fsReadBatch, the read
+     * an fsAcquired carries, and cpReadStdin (a pipe's read ahead). A run's
+     * delta is what it was handed, which bounds what it can hold.
+     */
+    supervisorAnsweredBytes: number;
     /** Pipelined R2 race outcomes. All counts are cumulative since
      *  DO-isolate start. Per-tier cache statistics live in cache-stats. */
     r2: {
@@ -136,6 +139,8 @@ export interface DiagCounters {
 }
 /** Read a snapshot — caller-side mutations don't affect the singleton. */
 export declare function readDiagCounters(): DiagCounters;
+/** Count `bytes` the session answered a process's supervisor call with. */
+export declare function recordSupervisorAnswer(bytes: number): void;
 /** Set the install phase. */
 export declare function setInstallPhase(p: InstallPhase): void;
 /**
@@ -181,8 +186,6 @@ export declare function prefetchBundleEnd(bytes: number): void;
  * owns the number and reports it whenever it admits or evicts an entry.
  */
 export declare function setPrefetchCacheBytes(bytes: number): void;
-/** Publish the transform cache's live retained total; same contract as above. */
-export declare function setTransformCacheBytes(bytes: number): void;
 /** Fold facet-returned counters into the supervisor's diag state.
  *  Called by npm-installer after the batch-facet returns; aggregates
  *  rather than replaces so multiple install runs in the same DO

package/dist/diag-counters.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"diag-counters.d.ts","sourceRoot":"","sources":["../src/diag-counters.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;;;GAOG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,WAAW,YAAY;IAC3B,+BAA+B;IAC/B,YAAY,EAAE,YAAY,CAAC;IAC3B;;;;;;;;;;;;;;;;;OAiBG;IACH,uBAAuB,EAAE,MAAM,CAAC;IAChC;;;;;;;;;;;OAWG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;;;OAWG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;qCAGiC;IACjC,YAAY,EAAE;QACZ,wEAAwE;QACxE,iBAAiB,EAAE,MAAM,CAAC;QAC1B,sEAAsE;QACtE,sBAAsB,EAAE,MAAM,CAAC;QAC/B,2EAA2E;QAC3E,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IACF;yEACqE;IACrE,cAAc,EAAE;QACd,4DAA4D;QAC5D,SAAS,EAAE,MAAM,CAAC;QAClB,8DAA8D;QAC9D,gBAAgB,EAAE,MAAM,CAAC;QACzB,8DAA8D;QAC9D,MAAM,EAAE,MAAM,CAAC;QACf,uEAAuE;QACvE,OAAO,EAAE,MAAM,CAAC;QAChB;;;wBAGgB;QAChB,aAAa,EAAE,MAAM,CAAC;QACtB;;;;;;;gEAOwD;QACxD,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACxC,CAAC;IACF;2EACuE;IACvE,EAAE,EAAE;QACF;8BACsB;QACtB,wBAAwB,EAAE,MAAM,CAAC;QACjC;6CACqC;QACrC,0BAA0B,EAAE,MAAM,CAAC;QACnC,8CAA8C;QAC9C,0BAA0B,EAAE,MAAM,CAAC;QACnC,gDAAgD;QAChD,4BAA4B,EAAE,MAAM,CAAC;KACtC,CAAC;CACH;AA6BD,0EAA0E;AAC1E,wBAAgB,gBAAgB,IAAI,YAAY,CAE/C;AAED,6BAA6B;AAC7B,wBAAgB,eAAe,CAAC,CAAC,EAAE,YAAY,GAAG,IAAI,CAErD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAInD;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAOjD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAIvD;AAED,qEAAqE;AACrE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAKrD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAGzD;AAED,iFAAiF;AACjF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAG1D;AAED;;;qDAGqD;AACrD,wBAAgB,0BAA0B,CAAC,CAAC,EAAE;IAC5C,iBAAiB,EAAE,MAAM,CAAC;IAC1B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,IAAI,CAMP;AAED;;;;;aAKa;AACb,wBAAgB,sBAAsB,CAAC,CAAC,EAAE;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC,GAAG,IAAI,CAiBP;AAED;;sCAEsC;AACtC,wBAAgB,oBAAoB,CAAC,CAAC,EAAE;IACtC,wBAAwB,EAAE,MAAM,CAAC;IACjC,0BAA0B,EAAE,MAAM,CAAC;IACnC,0BAA0B,EAAE,MAAM,CAAC;IACnC,4BAA4B,EAAE,MAAM,CAAC;CACtC,GAAG,IAAI,CAKP"}
+{"version":3,"file":"diag-counters.d.ts","sourceRoot":"","sources":["../src/diag-counters.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;;;GAOG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,WAAW,YAAY;IAC3B,+BAA+B;IAC/B,YAAY,EAAE,YAAY,CAAC;IAC3B;;;;;;;;;;;;;;;;;OAiBG;IACH,uBAAuB,EAAE,MAAM,CAAC;IAChC;;;;;;;;;;;OAWG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;;;OAWG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;qCAGiC;IACjC,YAAY,EAAE;QACZ,wEAAwE;QACxE,iBAAiB,EAAE,MAAM,CAAC;QAC1B,sEAAsE;QACtE,sBAAsB,EAAE,MAAM,CAAC;QAC/B,2EAA2E;QAC3E,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IACF;yEACqE;IACrE,cAAc,EAAE;QACd,4DAA4D;QAC5D,SAAS,EAAE,MAAM,CAAC;QAClB,8DAA8D;QAC9D,gBAAgB,EAAE,MAAM,CAAC;QACzB,8DAA8D;QAC9D,MAAM,EAAE,MAAM,CAAC;QACf,uEAAuE;QACvE,OAAO,EAAE,MAAM,CAAC;QAChB;;;wBAGgB;QAChB,aAAa,EAAE,MAAM,CAAC;QACtB;;;;;;;gEAOwD;QACxD,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACxC,CAAC;IACF;;;;;;;OAOG;IACH,uBAAuB,EAAE,MAAM,CAAC;IAChC;2EACuE;IACvE,EAAE,EAAE;QACF;8BACsB;QACtB,wBAAwB,EAAE,MAAM,CAAC;QACjC;6CACqC;QACrC,0BAA0B,EAAE,MAAM,CAAC;QACnC,8CAA8C;QAC9C,0BAA0B,EAAE,MAAM,CAAC;QACnC,gDAAgD;QAChD,4BAA4B,EAAE,MAAM,CAAC;KACtC,CAAC;CACH;AA6BD,0EAA0E;AAC1E,wBAAgB,gBAAgB,IAAI,YAAY,CAE/C;AAED,2EAA2E;AAC3E,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAE1D;AAED,6BAA6B;AAC7B,wBAAgB,eAAe,CAAC,CAAC,EAAE,YAAY,GAAG,IAAI,CAErD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAInD;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAOjD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAIvD;AAED,qEAAqE;AACrE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAKrD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAGzD;AAED;;;qDAGqD;AACrD,wBAAgB,0BAA0B,CAAC,CAAC,EAAE;IAC5C,iBAAiB,EAAE,MAAM,CAAC;IAC1B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,IAAI,CAMP;AAED;;;;;aAKa;AACb,wBAAgB,sBAAsB,CAAC,CAAC,EAAE;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC,GAAG,IAAI,CAiBP;AAED;;sCAEsC;AACtC,wBAAgB,oBAAoB,CAAC,CAAC,EAAE;IACtC,wBAAwB,EAAE,MAAM,CAAC;IACjC,0BAA0B,EAAE,MAAM,CAAC;IACnC,0BAA0B,EAAE,MAAM,CAAC;IACnC,4BAA4B,EAAE,MAAM,CAAC;CACtC,GAAG,IAAI,CAKP"}

package/dist/diag-counters.js

@@ -23,7 +23,7 @@ const _counters = {
     inFlightRpcPayloadBytes: 0,
     prefetchBundleBytes: 0,
     prefetchCacheBytes: 0,
-    transformCacheBytes: 0,
+    supervisorAnsweredBytes: 0,
     installFacet: {
         tarballsCompleted: 0,
         cumulativeBytesDecoded: 0,
@@ -48,6 +48,10 @@ const _counters = {
 export function readDiagCounters() {
     return { ..._counters };
 }
+/** Count `bytes` the session answered a process's supervisor call with. */
+export function recordSupervisorAnswer(bytes) {
+    _counters.supervisorAnsweredBytes += bytes;
+}
 /** Set the install phase. */
 export function setInstallPhase(p) {
     _counters.installPhase = p;
@@ -123,11 +127,6 @@ export function setPrefetchCacheBytes(bytes) {
     const n = Number(bytes);
     _counters.prefetchCacheBytes = Number.isFinite(n) && n > 0 ? n : 0;
 }
-/** Publish the transform cache's live retained total; same contract as above. */
-export function setTransformCacheBytes(bytes) {
-    const n = Number(bytes);
-    _counters.transformCacheBytes = Number.isFinite(n) && n > 0 ? n : 0;
-}
 /** Fold facet-returned counters into the supervisor's diag state.
  *  Called by npm-installer after the batch-facet returns; aggregates
  *  rather than replaces so multiple install runs in the same DO

package/dist/heap-estimate.d.ts

@@ -180,12 +180,6 @@ export interface HeapBreakdown {
      * the cache holds rather than a reservation it might use.
      */
     prefetchCacheBytes: number;
-    /**
-     * Bytes retained by the FacetManager's ESM→CJS transform cache
-     * (diag-counters `transformCacheBytes`), the other cache that persists
-     * across execs. Bounded by ESM_TRANSFORM_CACHE_MAX_BYTES.
-     */
-    transformCacheBytes: number;
     /**
      * Shared-budget occupancy not already represented by the named transient
      * counters. This covers full-budget owners and keeps cross-DO module-local

package/dist/heap-estimate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"heap-estimate.d.ts","sourceRoot":"","sources":["../src/heap-estimate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AAOH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAEL,KAAK,+BAA+B,EACrC,MAAM,wBAAwB,CAAC;AAEhC;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,sFAM1B,CAAC;AAEX;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,aAAa,EAAO,CAAC;AAE7D;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB,gEAAgE;IAChE,SAAS,EAAE,aAAa,CAAC;IACzB;;;OAGG;IACH,UAAU,EAAE,SAAS,aAAa,EAAE,CAAC;IACrC;;;;OAIG;IACH,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC;;;;OAIG;IACH,gBAAgB,EAAE,+BAA+B,CAAC;CACnD;AAED,MAAM,WAAW,aAAa;IAC5B,mEAAmE;IACnE,uBAAuB,EAAE,MAAM,CAAC;IAChC,yEAAyE;IACzE,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,gBAAgB,EAAE,MAAM,CAAC;IACzB;;sEAEkE;IAClE,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;;;;OAYG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,4BAA4B,EAAE,MAAM,CAAC;CACtC;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,aAAa,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAyBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,CAQnE;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,CAAC,EAAE,YAAY,EACf,GAAG,EAAE,aAAa,GACjB,YAAY,CAoDd"}
+{"version":3,"file":"heap-estimate.d.ts","sourceRoot":"","sources":["../src/heap-estimate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AAOH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAEL,KAAK,+BAA+B,EACrC,MAAM,wBAAwB,CAAC;AAEhC;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,sFAM1B,CAAC;AAEX;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,aAAa,EAAO,CAAC;AAE7D;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB,gEAAgE;IAChE,SAAS,EAAE,aAAa,CAAC;IACzB;;;OAGG;IACH,UAAU,EAAE,SAAS,aAAa,EAAE,CAAC;IACrC;;;;OAIG;IACH,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC;;;;OAIG;IACH,gBAAgB,EAAE,+BAA+B,CAAC;CACnD;AAED,MAAM,WAAW,aAAa;IAC5B,mEAAmE;IACnE,uBAAuB,EAAE,MAAM,CAAC;IAChC,yEAAyE;IACzE,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,gBAAgB,EAAE,MAAM,CAAC;IACzB;;sEAEkE;IAClE,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;;;;OAYG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,4BAA4B,EAAE,MAAM,CAAC;CACtC;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,aAAa,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAyBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,CAQnE;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,CAAC,EAAE,YAAY,EACf,GAAG,EAAE,aAAa,GACjB,YAAY,CAkDd"}

package/dist/heap-estimate.js

@@ -160,7 +160,6 @@ export function estimateSupervisorHeap(c, vfs) {
         streamingBuffersBytes: c.inFlightRpcPayloadBytes,
         prefetchBundleBytes: c.prefetchBundleBytes,
         prefetchCacheBytes: c.prefetchCacheBytes,
-        transformCacheBytes: c.transformCacheBytes,
         unattributedReservationBytes: Math.max(0, allocationBudget.current - transientAttributedBytes),
     };
     const estimatedBytes = breakdown.supervisorBaselineBytes +
@@ -170,7 +169,6 @@ export function estimateSupervisorHeap(c, vfs) {
         breakdown.streamingBuffersBytes +
         breakdown.prefetchBundleBytes +
         breakdown.prefetchCacheBytes +
-        breakdown.transformCacheBytes +
         breakdown.unattributedReservationBytes;
     const percentOfCeiling = Math.round((estimatedBytes / SUPERVISOR_HEAP_CEILING_BYTES) * 1000) / 10;
     return {

package/dist/heavy-alloc-coord.d.ts

@@ -13,8 +13,6 @@ export interface SupervisorAllocationBudgetStats {
     readonly current: number;
     readonly peak: number;
     readonly queued: number;
-    /** Credit held for an owner's whole lifetime; see `acquireResident`. */
-    readonly resident: number;
 }
 interface AllocationBudgetLifecycle {
     onActive?: () => void;
@@ -53,12 +51,6 @@ export declare class SupervisorAllocationBudget {
      * stops a large read overlapping a large write.
      */
     acquireWithoutLifecycle(bytes: number, signal?: AbortSignal): Promise<ResizableCreditLease>;
-    /**
-     * Reserve bytes an owner holds for its whole lifetime, not for one
-     * operation. Recorded as a floor: a later claim larger than what remains
-     * around it is refused with both numbers rather than parked forever.
-     */
-    acquireResidentBytes(bytes: number, signal?: AbortSignal): Promise<ResizableCreditLease>;
     private _acquire;
 }
 /**
@@ -91,11 +83,6 @@ export declare function acquireSupervisorAllocation(bytes: number, signal?: Abor
  * there to fill.
  */
 export declare function acquireSupervisorReadAllocation(bytes: number, signal?: AbortSignal): Promise<ResizableCreditLease>;
-/**
- * Reserve bytes for the whole life of the owner that takes them — an image
- * a pool keeps until it is disposed. See `acquireResidentBytes`.
- */
-export declare function acquireResidentSupervisorAllocation(bytes: number, signal?: AbortSignal): Promise<ResizableCreditLease>;
 /**
  * Reserve the full budget for an allocation whose retained size is not known
  * accurately enough to overlap safely with other heavy work.

package/dist/heavy-alloc-coord.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"heavy-alloc-coord.d.ts","sourceRoot":"","sources":["../src/heavy-alloc-coord.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAOH,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC/B,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,UAAU,yBAAyB;IACjC,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,IAAI,CAAC;CACrB;AAED;;;GAGG;AACH,qBAAa,0BAA0B;IAWnC,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAX5B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,MAAM,CAAS;IACvB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB,CAAK;gBAGlB,QAAQ,EAAE,MAAM,EACR,SAAS,GAAE,yBAA8B,EAC1D,OAAO,GAAE,yBAA8B;IAKzC,IAAI,KAAK,IAAI,+BAA+B,CAK3C;IAED;;;;OAIG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAI3E;;;;;;;;OAQG;IACH,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAI3F;;;;OAIG;IACH,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;YAI1E,QAAQ;CAsCvB;AAED;;;GAGG;AACH,UAAU,aAAa;IACrB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;CACxB;AAiBD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,aAAa,GAAG,MAAM,IAAI,CAWlE;AAqCD;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,oBAAoB,CAAC,CAE/B;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,oBAAoB,CAAC,CAE/B;AAED;;;GAGG;AACH,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,oBAAoB,CAAC,CAE/B;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAMjF;AAED,wBAAgB,8BAA8B,IAAI,+BAA+B,CAEhF"}
+{"version":3,"file":"heavy-alloc-coord.d.ts","sourceRoot":"","sources":["../src/heavy-alloc-coord.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAOH,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC/B,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,UAAU,yBAAyB;IACjC,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,IAAI,CAAC;CACrB;AAED;;;GAGG;AACH,qBAAa,0BAA0B;IAWnC,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAX5B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,MAAM,CAAS;IACvB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB,CAAK;gBAGlB,QAAQ,EAAE,MAAM,EACR,SAAS,GAAE,yBAA8B,EAC1D,OAAO,GAAE,yBAA8B;IAKzC,IAAI,KAAK,IAAI,+BAA+B,CAK3C;IAED;;;;OAIG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAI3E;;;;;;;;OAQG;IACH,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;YAI7E,QAAQ;CAmCvB;AAED;;;GAGG;AACH,UAAU,aAAa;IACrB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;CACxB;AAiBD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,aAAa,GAAG,MAAM,IAAI,CAWlE;AAqCD;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,oBAAoB,CAAC,CAE/B;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,oBAAoB,CAAC,CAE/B;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAMjF;AAED,wBAAgB,8BAA8B,IAAI,+BAA+B,CAEhF"}

package/dist/heavy-alloc-coord.js

@@ -55,18 +55,8 @@ export class SupervisorAllocationBudget {
     acquireWithoutLifecycle(bytes, signal) {
         return this._acquire(bytes, signal, false);
     }
-    /**
-     * Reserve bytes an owner holds for its whole lifetime, not for one
-     * operation. Recorded as a floor: a later claim larger than what remains
-     * around it is refused with both numbers rather than parked forever.
-     */
-    acquireResidentBytes(bytes, signal) {
-        return this._acquire(bytes, signal, true, true);
-    }
-    async _acquire(bytes, signal, drivesLifecycle, resident = false) {
-        const credit = resident
-            ? await this.credits.acquireResident(bytes, signal)
-            : await this.credits.acquire(bytes, signal);
+    async _acquire(bytes, signal, drivesLifecycle) {
+        const credit = await this.credits.acquire(bytes, signal);
         if (drivesLifecycle) {
             this.lifecycleHolders++;
             if (!this.active) {
@@ -178,13 +168,6 @@ export function acquireSupervisorAllocation(bytes, signal) {
 export function acquireSupervisorReadAllocation(bytes, signal) {
     return supervisorAllocationBudget.acquireWithoutLifecycle(bytes, signal);
 }
-/**
- * Reserve bytes for the whole life of the owner that takes them — an image
- * a pool keeps until it is disposed. See `acquireResidentBytes`.
- */
-export function acquireResidentSupervisorAllocation(bytes, signal) {
-    return supervisorAllocationBudget.acquireResidentBytes(bytes, signal);
-}
 /**
  * Reserve the full budget for an allocation whose retained size is not known
  * accurately enough to overlap safely with other heavy work.

package/dist/limits.d.ts

@@ -94,7 +94,7 @@ export declare const RESIDENT_KEEPALIVE_MS = 5000;
 export declare const RESIDENT_KEEPALIVE_DETACHED_MS = 60000;
 /**
  * Bytes one hibernatable WebSocket attachment may serialize to. Verified in
- * workerd source at the pinned version (v1.20260603.1,
+ * workerd source at the pinned version (v1.20260926.1,
  * src/workerd/api/web-socket.h: `MAX_ATTACHMENT_SIZE = 1024 * 16`). The
  * bound is on the SERIALIZED bytes — workerd re-serializes on every
  * `serializeAttachment` call to check it — not on UTF-8 JSON text, so a

package/dist/limits.js

@@ -108,7 +108,7 @@ export const RESIDENT_KEEPALIVE_DETACHED_MS = 60_000;
 // ── WebSocket attachment bound ──────────────────────────────────────────
 /**
  * Bytes one hibernatable WebSocket attachment may serialize to. Verified in
- * workerd source at the pinned version (v1.20260603.1,
+ * workerd source at the pinned version (v1.20260926.1,
  * src/workerd/api/web-socket.h: `MAX_ATTACHMENT_SIZE = 1024 * 16`). The
  * bound is on the SERIALIZED bytes — workerd re-serializes on every
  * `serializeAttachment` call to check it — not on UTF-8 JSON text, so a

package/dist/oom-classify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oom-classify.d.ts","sourceRoot":"","sources":["../src/oom-classify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAEH,QAAA,MAAM,UAAU,kLAYN,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;AAEjD,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ,CAE5D;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ,CAItD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,CAkErD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAO1D;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEtD;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW;AACrB,8CAA8C;AAC5C,oBAAoB;AACtB,8CAA8C;GAC5C,iBAAiB;AACnB,uEAAuE;GACrE,eAAe;AACjB,wDAAwD;GACtD,gBAAgB;AAClB;kDACkD;GAChD,YAAY;AACd,kEAAkE;GAChE,WAAW,CAAC;AAEhB;2DAC2D;AAC3D,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAK7D;AAmBD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,CAsB1D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAiBpD"}
+{"version":3,"file":"oom-classify.d.ts","sourceRoot":"","sources":["../src/oom-classify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAEH,QAAA,MAAM,UAAU,kLAYN,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;AAEjD,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ,CAE5D;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ,CAItD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,CAmErD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAO1D;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEtD;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW;AACrB,8CAA8C;AAC5C,oBAAoB;AACtB,8CAA8C;GAC5C,iBAAiB;AACnB,uEAAuE;GACrE,eAAe;AACjB,wDAAwD;GACtD,gBAAgB;AAClB;kDACkD;GAChD,YAAY;AACd,kEAAkE;GAChE,WAAW,CAAC;AAEhB;2DAC2D;AAC3D,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAK7D;AAmBD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,CAsB1D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAiBpD"}

package/dist/oom-classify.js

@@ -125,11 +125,12 @@ export function classifyMessage(msg) {
     // Subrequest cap (Cloudflare platform)
     if (m.includes('too many subrequests'))
         return 'subrequest_cap';
-    // Worker Loader concurrency cap (Cloudflare platform): a Durable Object
-    // admits ~5-6 concurrent dynamic workers, and loader-cache entries are
-    // never released — every distinct loader.get(id) permanently consumes a
-    // slot, so this cap recurs until the DO itself is replaced.
-    if (m.includes('too many concurrent dynamic workers'))
+    // Dynamic Worker concurrency limit (Cloudflare platform): a Durable Object
+    // may have a fixed number of distinct Dynamic Workers with in-flight
+    // requests at once (fabric budgets.ts, DO_DYNAMIC_WORKER_LIMIT). Production
+    // words it "Dynamic worker concurrency limit exceeded: each request may
+    // have up to 10 concurrent dynamic worker invocations. …".
+    if (m.includes('dynamic worker concurrency limit exceeded'))
         return 'dynamic_worker_cap';
     // Memory exhaustion. workerd trace outcome `exceededMemory`; in-band it
     // arrives as a `broken.exceededMemory` actor break, a "…exceeded [its]

package/dist/tracing.d.ts

@@ -0,0 +1,65 @@
+/**
+ * tracing.ts — Workers custom spans, for modules that cannot import
+ * `cloudflare:workers`, as best-effort telemetry that never changes an
+ * outcome.
+ *
+ * The span API is `tracing` from `cloudflare:workers`
+ * (https://developers.cloudflare.com/workers/observability/traces/custom-spans/):
+ * `enterSpan(name, callback)` runs the callback in a span that is the active
+ * parent of every span and platform call made inside it — automatic RPC
+ * spans included — and ends it when the callback returns or its promise
+ * settles. A span records nothing unless the invocation was head-sampled
+ * (`observability.traces.head_sampling_rate`).
+ *
+ * `setAttributes` and `recordException` shipped on 2026-09-25
+ * (https://developers.cloudflare.com/changelog/post/2026-09-25-custom-span-apis/);
+ * a runtime from before then has `isTraced` and `setAttribute` only. So the
+ * code being traced never touches the runtime's span. It gets a
+ * {@link SpanRecorder}, which records only while the span is traced, uses
+ * whichever methods the runtime has, and swallows anything a span method
+ * throws.
+ *
+ * Core and fabric stay importable outside workerd, so they reach the API
+ * through this leaf: the Worker's composition root hands it over once, at
+ * module scope, with {@link adoptTracing}, exactly as it does `ctx.exports`
+ * (./composition.ts). With nothing adopted — unit tests, an embedder that
+ * never adopts — {@link traced} runs its callback with {@link untraced}.
+ */
+/** Attribute values a span holds; `undefined` entries are ignored. */
+export type SpanAttributes = Record<string, string | number | boolean | undefined>;
+/** The runtime's `Span`, as any Workers runtime with `tracing` may have it. */
+export interface RuntimeSpan {
+    readonly isTraced: boolean;
+    setAttribute?(key: string, value?: string | number | boolean): unknown;
+    setAttributes?(attributes: SpanAttributes): unknown;
+    recordException?(exception: string | {
+        code?: string | number;
+        name?: string;
+        message?: string;
+        stack?: string;
+    }): void;
+}
+/** The part of `cloudflare:workers`'s `tracing` Nimbus uses. */
+export interface Tracer {
+    enterSpan<T>(name: string, callback: (span: RuntimeSpan) => T): T;
+}
+/** What traced code records on its span. Never throws; records nothing unless the span is traced. */
+export interface SpanRecorder {
+    set(attributes: SpanAttributes): void;
+    /**
+     * Record `error` as an exception event. `code`, when given, replaces the
+     * error's own; `context` is prefixed to its message.
+     */
+    exception(error: unknown, code?: string, context?: string): void;
+}
+/** The recorder of a span that is not traced, or of no span at all. */
+export declare const untraced: SpanRecorder;
+/** Hand this isolate's `tracing` over. The first adoption stands, like `adoptCtxExports`. */
+export declare function adoptTracing(value: Tracer): void;
+/**
+ * Run `fn` in a span named `name` carrying `attributes`, and record on it the
+ * exception `fn` throws or its promise rejects with. What `fn` returns or
+ * throws reaches the caller unchanged, whatever the span does.
+ */
+export declare function traced<T>(name: string, attributes: SpanAttributes, fn: (span: SpanRecorder) => T): T;
+//# sourceMappingURL=tracing.d.ts.map

package/dist/tracing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracing.d.ts","sourceRoot":"","sources":["../src/tracing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,sEAAsE;AACtE,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;AAEnF,+EAA+E;AAC/E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,YAAY,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;IACvE,aAAa,CAAC,CAAC,UAAU,EAAE,cAAc,GAAG,OAAO,CAAC;IACpD,eAAe,CAAC,CACd,SAAS,EAAE,MAAM,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9F,IAAI,CAAC;CACT;AAED,gEAAgE;AAChE,MAAM,WAAW,MAAM;IACrB,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,CAAC,GAAG,CAAC,CAAC;CACnE;AAED,qGAAqG;AACrG,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,UAAU,EAAE,cAAc,GAAG,IAAI,CAAC;IACtC;;;OAGG;IACH,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClE;AAED,uEAAuE;AACvE,eAAO,MAAM,QAAQ,EAAE,YAA0D,CAAC;AAIlF,6FAA6F;AAC7F,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAEhD;AAyCD;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,CAAC,GAAG,CAAC,CAkBpG"}

package/dist/tracing.js

@@ -0,0 +1,107 @@
+/**
+ * tracing.ts — Workers custom spans, for modules that cannot import
+ * `cloudflare:workers`, as best-effort telemetry that never changes an
+ * outcome.
+ *
+ * The span API is `tracing` from `cloudflare:workers`
+ * (https://developers.cloudflare.com/workers/observability/traces/custom-spans/):
+ * `enterSpan(name, callback)` runs the callback in a span that is the active
+ * parent of every span and platform call made inside it — automatic RPC
+ * spans included — and ends it when the callback returns or its promise
+ * settles. A span records nothing unless the invocation was head-sampled
+ * (`observability.traces.head_sampling_rate`).
+ *
+ * `setAttributes` and `recordException` shipped on 2026-09-25
+ * (https://developers.cloudflare.com/changelog/post/2026-09-25-custom-span-apis/);
+ * a runtime from before then has `isTraced` and `setAttribute` only. So the
+ * code being traced never touches the runtime's span. It gets a
+ * {@link SpanRecorder}, which records only while the span is traced, uses
+ * whichever methods the runtime has, and swallows anything a span method
+ * throws.
+ *
+ * Core and fabric stay importable outside workerd, so they reach the API
+ * through this leaf: the Worker's composition root hands it over once, at
+ * module scope, with {@link adoptTracing}, exactly as it does `ctx.exports`
+ * (./composition.ts). With nothing adopted — unit tests, an embedder that
+ * never adopts — {@link traced} runs its callback with {@link untraced}.
+ */
+/** The recorder of a span that is not traced, or of no span at all. */
+export const untraced = Object.freeze({ set() { }, exception() { } });
+let tracer = null;
+/** Hand this isolate's `tracing` over. The first adoption stands, like `adoptCtxExports`. */
+export function adoptTracing(value) {
+    tracer ??= value;
+}
+function recorderFor(span) {
+    try {
+        if (!span.isTraced)
+            return untraced;
+    }
+    catch {
+        return untraced;
+    }
+    return {
+        set(attributes) {
+            try {
+                if (typeof span.setAttributes === 'function') {
+                    span.setAttributes(attributes);
+                }
+                else if (typeof span.setAttribute === 'function') {
+                    for (const [key, value] of Object.entries(attributes)) {
+                        if (value !== undefined)
+                            span.setAttribute(key, value);
+                    }
+                }
+            }
+            catch { /* telemetry is best-effort */ }
+        },
+        exception(error, code, context = '') {
+            try {
+                if (typeof span.recordException !== 'function')
+                    return;
+                if (error instanceof Error) {
+                    const own = 'code' in error ? error.code : undefined;
+                    span.recordException({
+                        code: code ?? (typeof own === 'string' || typeof own === 'number' ? own : undefined),
+                        name: error.name,
+                        message: context + error.message,
+                        stack: error.stack,
+                    });
+                }
+                else {
+                    span.recordException(code === undefined && !context
+                        ? String(error)
+                        : { code, message: context + String(error) });
+                }
+            }
+            catch { /* telemetry is best-effort */ }
+        },
+    };
+}
+/**
+ * Run `fn` in a span named `name` carrying `attributes`, and record on it the
+ * exception `fn` throws or its promise rejects with. What `fn` returns or
+ * throws reaches the caller unchanged, whatever the span does.
+ */
+export function traced(name, attributes, fn) {
+    if (!tracer)
+        return fn(untraced);
+    return tracer.enterSpan(name, (runtimeSpan) => {
+        const span = recorderFor(runtimeSpan);
+        span.set(attributes);
+        let result;
+        try {
+            result = fn(span);
+        }
+        catch (error) {
+            span.exception(error);
+            throw error;
+        }
+        if (!(result instanceof Promise))
+            return result;
+        return result.catch((error) => {
+            span.exception(error);
+            throw error;
+        });
+    });
+}

package/dist/weighted-credit-pool.d.ts

@@ -9,11 +9,6 @@ export interface WeightedCreditPoolStats {
     readonly current: number;
     readonly peak: number;
     readonly queued: number;
-    /**
-     * Credit held by owners that keep it for their whole lifetime rather than
-     * for one operation — the floor no waiter can ever expect to get back.
-     */
-    readonly resident: number;
 }
 export interface WeightedCreditPoolOptions {
     /**
@@ -61,14 +56,6 @@ export declare class WeightedCreditPool {
     private isSmall;
     tryAcquire(bytes: number): ResizableCreditLease | null;
     acquire(bytes: number, signal?: AbortSignal): Promise<ResizableCreditLease>;
-    /**
-     * Take credit that will be held for the owner's whole lifetime rather than
-     * for one operation — the esbuild pool's wasm image is the case.
-     *
-     * Recorded as a floor so a later claim that could never fit around it is
-     * refused with both numbers instead of parking in the FIFO forever.
-     */
-    acquireResident(bytes: number, signal?: AbortSignal): Promise<ResizableCreditLease>;
     private validateRequest;
 }
 //# sourceMappingURL=weighted-credit-pool.d.ts.map

package/dist/weighted-credit-pool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"weighted-credit-pool.d.ts","sourceRoot":"","sources":["../src/weighted-credit-pool.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,oBAAqB,SAAQ,WAAW;IACvD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,yBAAyB;IACxC;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAmJD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,kBAAkB;IAKjB,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAJrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAa;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoB;IAC1C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;gBAEtB,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,yBAA8B;IAoB9E,IAAI,KAAK,IAAI,uBAAuB,CAUnC;IAED,OAAO,CAAC,OAAO;IAIf,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI;IAOtD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAiB3E;;;;;;OAMG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;IASnF,OAAO,CAAC,eAAe;CAOxB"}
+{"version":3,"file":"weighted-credit-pool.d.ts","sourceRoot":"","sources":["../src/weighted-credit-pool.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,oBAAqB,SAAQ,WAAW;IACvD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,yBAAyB;IACxC;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAkHD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,kBAAkB;IAKjB,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAJrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAa;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoB;IAC1C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;gBAEtB,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,yBAA8B;IAoB9E,IAAI,KAAK,IAAI,uBAAuB,CASnC;IAED,OAAO,CAAC,OAAO;IAIf,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI;IAOtD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAiB3E,OAAO,CAAC,eAAe;CAOxB"}

package/dist/weighted-credit-pool.js

@@ -3,52 +3,27 @@ class CreditLane {
     capacity;
     current = 0;
     peak = 0;
-    resident = 0;
     waiters = [];
     constructor(capacity) {
         this.capacity = capacity;
     }
     get stats() {
-        return {
-            current: this.current, peak: this.peak, queued: this.waiters.length, resident: this.resident,
-        };
+        return { current: this.current, peak: this.peak, queued: this.waiters.length };
     }
     tryAcquire(bytes) {
         if (this.waiters.length > 0 || this.current + bytes > this.capacity)
             return null;
-        return this.grant(bytes, false);
+        return this.grant(bytes);
     }
-    /**
-     * The largest claim this lane can ever grant: capacity less what resident
-     * owners hold for their whole lifetime. A claim above it cannot be
-     * satisfied by waiting, because nothing it is waiting for will be
-     * released.
-     */
-    get grantableCeiling() {
-        return this.capacity - this.resident;
-    }
-    acquire(bytes, signal, resident = false) {
+    acquire(bytes, signal) {
         if (signal?.aborted)
             return Promise.reject(abortError(signal));
-        // Refuse a claim no amount of waiting can satisfy, rather than parking it
-        // in the FIFO forever. A parked claim is indistinguishable from a caller
-        // that stopped: no error, no timeout, and — because the queue refuses
-        // everyone behind it — no further progress anywhere in the isolate. That
-        // is what a real-vite launch looked like for four rounds of debugging.
-        if (bytes > this.grantableCeiling) {
-            return Promise.reject(new RangeError(`weighted credit claim of ${bytes} bytes can never be granted: capacity is ${this.capacity} `
-                + `and ${this.resident} bytes are held by resident owners, leaving ${this.grantableCeiling}`));
-        }
-        const immediate = resident ? null : this.tryAcquire(bytes);
+        const immediate = this.tryAcquire(bytes);
         if (immediate)
             return Promise.resolve(immediate);
-        if (resident && this.waiters.length === 0 && this.current + bytes <= this.capacity) {
-            return Promise.resolve(this.grant(bytes, true));
-        }
         return new Promise((resolve, reject) => {
             const waiter = {
                 bytes,
-                resident,
                 resolve,
                 reject,
                 signal,
@@ -73,10 +48,8 @@ class CreditLane {
             this.drain();
         });
     }
-    grant(bytes, resident) {
+    grant(bytes) {
         this.current += bytes;
-        if (resident)
-            this.resident += bytes;
         this.peak = Math.max(this.peak, this.current);
         let leasedBytes = bytes;
         let released = false;
@@ -94,8 +67,6 @@ class CreditLane {
                     throw new RangeError(`weighted credit lease can only shrink to a positive safe integer no larger than ${leasedBytes}: ${nextBytes}`);
                 }
                 this.current -= leasedBytes - nextBytes;
-                if (resident)
-                    this.resident -= leasedBytes - nextBytes;
                 leasedBytes = nextBytes;
                 this.drain();
             },
@@ -104,8 +75,6 @@ class CreditLane {
                     return;
                 released = true;
                 this.current -= leasedBytes;
-                if (resident)
-                    this.resident -= leasedBytes;
                 if (this.current < 0) {
                     throw new Error('weighted credit accounting underflow');
                 }
@@ -126,7 +95,7 @@ class CreditLane {
                 return;
             this.waiters.shift();
             waiter.signal?.removeEventListener('abort', waiter.onAbort);
-            waiter.resolve(this.grant(waiter.bytes, waiter.resident));
+            waiter.resolve(this.grant(waiter.bytes));
         }
     }
 }
@@ -185,7 +154,6 @@ export class WeightedCreditPool {
             current: general.current + small.current,
             peak: general.peak + small.peak,
             queued: general.queued + small.queued,
-            resident: general.resident + small.resident,
         };
     }
     isSmall(bytes) {
@@ -216,22 +184,6 @@ export class WeightedCreditPool {
         }
         return this.general.acquire(bytes, signal);
     }
-    /**
-     * Take credit that will be held for the owner's whole lifetime rather than
-     * for one operation — the esbuild pool's wasm image is the case.
-     *
-     * Recorded as a floor so a later claim that could never fit around it is
-     * refused with both numbers instead of parking in the FIFO forever.
-     */
-    acquireResident(bytes, signal) {
-        try {
-            this.validateRequest(bytes);
-        }
-        catch (error) {
-            return Promise.reject(error);
-        }
-        return this.general.acquire(bytes, signal, true);
-    }
     validateRequest(bytes) {
         if (!Number.isSafeInteger(bytes) || bytes <= 0 || bytes > this.capacity) {
             throw new RangeError(`weighted credit request must be a positive safe integer no larger than ${this.capacity}: ${bytes}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nimbus-sh/platform",
-  "version": "0.6.0",
+  "version": "0.7.1",
   "description": "The measured Cloudflare platform truths Nimbus is built on \u2014 error taxonomy, limits tables, budget coordination, and wire-format primitives, with zero runtime dependencies.",
   "keywords": [
     "cloudflare",
@@ -48,7 +48,7 @@
     "typecheck": "tsc --noEmit"
   },
   "devDependencies": {
-    "@cloudflare/workers-types": "^4.20250327.0",
+    "@cloudflare/workers-types": "^5.20260928.1",
     "typescript": "^5.7.0"
   },
   "publishConfig": {

package/src/composition.ts

@@ -66,13 +66,46 @@ export const DEFAULT_HOST_DISPATCH_METHOD = 'supervisorOp';
 let composition: FabricComposition | null = null;
 let ctxExports: CtxExports | null = null;
 
+/**
+ * A program's filesystem errors reach it across workerd RPC, from the host
+ * that answers its supervisor binding, and the program branches on the POSIX
+ * `code` each one carries. workerd carries an error's own properties across
+ * RPC only when the sending AND the receiving isolate have
+ * `enhanced_error_serialization`, on by compatibility date from 2026-04-21:
+ * the serializer writes a native error as a host object with its own
+ * properties only under the flag (src/workerd/jsg/ser.c++,
+ * Serializer::IsHostObject), and the receiver reads that detail back only
+ * under it (src/workerd/jsg/util.c++, decodeTunneledException); see
+ * https://developers.cloudflare.com/workers/runtime-apis/rpc/error-handling/.
+ * Programs load at CF_COMPAT_DATE, past it. The host runs at its embedder's
+ * date, and below it every ENOENT would reach every program as a bare message
+ * it maps to EIO. So composing refuses such a host, wherever it composes
+ * (module scope: the Worker fails at startup; NimbusWorkspace.create: that
+ * call throws), and names both fixes: the flag alone keeps
+ * every other behavior of the embedder's date. Off workerd (bun, node) there
+ * is no RPC hop and no `Cloudflare` global to read.
+ */
+function requireEnhancedErrorSerialization(): void {
+  // `typeof` of an undeclared global is 'undefined', not a ReferenceError.
+  if (typeof Cloudflare === 'undefined') return;
+  if (Cloudflare.compatibilityFlags.enhanced_error_serialization === true) return;
+  throw new Error(
+    'fabric: this Worker runs without the enhanced_error_serialization compatibility flag, so the '
+      + "code on a program's filesystem error (ENOENT, EEXIST, ...) would not survive the RPC back "
+      + 'to it. Add "enhanced_error_serialization" to compatibility_flags in your wrangler config, '
+      + 'or set compatibility_date to 2026-04-21 or later.',
+  );
+}
+
 /**
  * Compose once per isolate. A second call with the same values is a no-op;
  * a second call with different values throws, naming both, so an embedder
  * whose composition lost to an earlier import learns it at startup rather
- * than from a facet that reached the wrong host.
+ * than from a facet that reached the wrong host. A host without
+ * `enhanced_error_serialization` is refused.
  */
 export function composeFabric(value: FabricComposition): void {
+  requireEnhancedErrorSerialization();
   if (!composition) {
     composition = value;
     return;

package/src/diag-counters.ts

@@ -82,12 +82,6 @@ export interface DiagCounters {
    * Surfaced as `breakdown.prefetchCacheBytes`. A gauge, not a delta.
    */
   prefetchCacheBytes: number;
-  /**
-   * Bytes retained by the FacetManager's ESM→CJS transform cache, bounded by
-   * ESM_TRANSFORM_CACHE_MAX_BYTES. Surfaced as `breakdown.transformCacheBytes`.
-   * A gauge, not a delta.
-   */
-  transformCacheBytes: number;
   /** Install-facet counters. Populated by npm-installer after a
    *  successful batch-facet dispatch returns. Confirms the install ran
    *  in the facet (tarballsCompleted > 0) and surfaces the
@@ -126,6 +120,15 @@ export interface DiagCounters {
      *  Empty when the most recent batch had zero errors. */
     errorsByModule: Record<string, string>;
   };
+  /**
+   * File contents and stdin the session has handed its processes, cumulative
+   * since isolate start: the bytes of each supervisor envelope's answer as it
+   * leaves the session (worker session/supervisor-op.ts answerSupervisorOp)
+   * from readFile, readFileBytes, fsRead, fsReadRange, fsReadBatch, the read
+   * an fsAcquired carries, and cpReadStdin (a pipe's read ahead). A run's
+   * delta is what it was handed, which bounds what it can hold.
+   */
+  supervisorAnsweredBytes: number;
   /** Pipelined R2 race outcomes. All counts are cumulative since
    *  DO-isolate start. Per-tier cache statistics live in cache-stats. */
   r2: {
@@ -147,7 +150,7 @@ const _counters: DiagCounters = {
   inFlightRpcPayloadBytes: 0,
   prefetchBundleBytes: 0,
   prefetchCacheBytes: 0,
-  transformCacheBytes: 0,
+  supervisorAnsweredBytes: 0,
   installFacet: {
     tarballsCompleted: 0,
     cumulativeBytesDecoded: 0,
@@ -174,6 +177,11 @@ export function readDiagCounters(): DiagCounters {
   return { ..._counters };
 }
 
+/** Count `bytes` the session answered a process's supervisor call with. */
+export function recordSupervisorAnswer(bytes: number): void {
+  _counters.supervisorAnsweredBytes += bytes;
+}
+
 /** Set the install phase. */
 export function setInstallPhase(p: InstallPhase): void {
   _counters.installPhase = p;
@@ -250,12 +258,6 @@ export function setPrefetchCacheBytes(bytes: number): void {
   _counters.prefetchCacheBytes = Number.isFinite(n) && n > 0 ? n : 0;
 }
 
-/** Publish the transform cache's live retained total; same contract as above. */
-export function setTransformCacheBytes(bytes: number): void {
-  const n = Number(bytes);
-  _counters.transformCacheBytes = Number.isFinite(n) && n > 0 ? n : 0;
-}
-
 /** Fold facet-returned counters into the supervisor's diag state.
  *  Called by npm-installer after the batch-facet returns; aggregates
  *  rather than replaces so multiple install runs in the same DO

package/src/heap-estimate.ts

@@ -200,12 +200,6 @@ export interface HeapBreakdown {
    * the cache holds rather than a reservation it might use.
    */
   prefetchCacheBytes: number;
-  /**
-   * Bytes retained by the FacetManager's ESM→CJS transform cache
-   * (diag-counters `transformCacheBytes`), the other cache that persists
-   * across execs. Bounded by ESM_TRANSFORM_CACHE_MAX_BYTES.
-   */
-  transformCacheBytes: number;
   /**
    * Shared-budget occupancy not already represented by the named transient
    * counters. This covers full-budget owners and keeps cross-DO module-local
@@ -303,7 +297,6 @@ export function estimateSupervisorHeap(
     streamingBuffersBytes: c.inFlightRpcPayloadBytes,
     prefetchBundleBytes: c.prefetchBundleBytes,
     prefetchCacheBytes: c.prefetchCacheBytes,
-    transformCacheBytes: c.transformCacheBytes,
     unattributedReservationBytes: Math.max(
       0,
       allocationBudget.current - transientAttributedBytes,
@@ -318,7 +311,6 @@ export function estimateSupervisorHeap(
     breakdown.streamingBuffersBytes +
     breakdown.prefetchBundleBytes +
     breakdown.prefetchCacheBytes +
-    breakdown.transformCacheBytes +
     breakdown.unattributedReservationBytes;
 
   const percentOfCeiling = Math.round(

package/src/heavy-alloc-coord.ts

@@ -24,8 +24,6 @@ export interface SupervisorAllocationBudgetStats {
   readonly current: number;
   readonly peak: number;
   readonly queued: number;
-  /** Credit held for an owner's whole lifetime; see `acquireResident`. */
-  readonly resident: number;
 }
 
 interface AllocationBudgetLifecycle {
@@ -84,24 +82,12 @@ export class SupervisorAllocationBudget {
     return this._acquire(bytes, signal, false);
   }
 
-  /**
-   * Reserve bytes an owner holds for its whole lifetime, not for one
-   * operation. Recorded as a floor: a later claim larger than what remains
-   * around it is refused with both numbers rather than parked forever.
-   */
-  acquireResidentBytes(bytes: number, signal?: AbortSignal): Promise<ResizableCreditLease> {
-    return this._acquire(bytes, signal, true, true);
-  }
-
   private async _acquire(
     bytes: number,
     signal: AbortSignal | undefined,
     drivesLifecycle: boolean,
-    resident = false,
   ): Promise<ResizableCreditLease> {
-    const credit = resident
-      ? await this.credits.acquireResident(bytes, signal)
-      : await this.credits.acquire(bytes, signal);
+    const credit = await this.credits.acquire(bytes, signal);
     if (drivesLifecycle) {
       this.lifecycleHolders++;
       if (!this.active) {
@@ -238,17 +224,6 @@ export function acquireSupervisorReadAllocation(
   return supervisorAllocationBudget.acquireWithoutLifecycle(bytes, signal);
 }
 
-/**
- * Reserve bytes for the whole life of the owner that takes them — an image
- * a pool keeps until it is disposed. See `acquireResidentBytes`.
- */
-export function acquireResidentSupervisorAllocation(
-  bytes: number,
-  signal?: AbortSignal,
-): Promise<ResizableCreditLease> {
-  return supervisorAllocationBudget.acquireResidentBytes(bytes, signal);
-}
-
 /**
  * Reserve the full budget for an allocation whose retained size is not known
  * accurately enough to overlap safely with other heavy work.

package/src/limits.ts

@@ -125,7 +125,7 @@ export const RESIDENT_KEEPALIVE_DETACHED_MS = 60_000;
 
 /**
  * Bytes one hibernatable WebSocket attachment may serialize to. Verified in
- * workerd source at the pinned version (v1.20260603.1,
+ * workerd source at the pinned version (v1.20260926.1,
  * src/workerd/api/web-socket.h: `MAX_ATTACHMENT_SIZE = 1024 * 16`). The
  * bound is on the SERIALIZED bytes — workerd re-serializes on every
  * `serializeAttachment` call to check it — not on UTF-8 JSON text, so a

package/src/oom-classify.ts

@@ -127,11 +127,12 @@ export function classifyMessage(msg: string): OomCause {
   // Subrequest cap (Cloudflare platform)
   if (m.includes('too many subrequests')) return 'subrequest_cap';
 
-  // Worker Loader concurrency cap (Cloudflare platform): a Durable Object
-  // admits ~5-6 concurrent dynamic workers, and loader-cache entries are
-  // never released — every distinct loader.get(id) permanently consumes a
-  // slot, so this cap recurs until the DO itself is replaced.
-  if (m.includes('too many concurrent dynamic workers')) return 'dynamic_worker_cap';
+  // Dynamic Worker concurrency limit (Cloudflare platform): a Durable Object
+  // may have a fixed number of distinct Dynamic Workers with in-flight
+  // requests at once (fabric budgets.ts, DO_DYNAMIC_WORKER_LIMIT). Production
+  // words it "Dynamic worker concurrency limit exceeded: each request may
+  // have up to 10 concurrent dynamic worker invocations. …".
+  if (m.includes('dynamic worker concurrency limit exceeded')) return 'dynamic_worker_cap';
 
   // Memory exhaustion. workerd trace outcome `exceededMemory`; in-band it
   // arrives as a `broken.exceededMemory` actor break, a "…exceeded [its]

package/src/tracing.ts

@@ -0,0 +1,129 @@
+/**
+ * tracing.ts — Workers custom spans, for modules that cannot import
+ * `cloudflare:workers`, as best-effort telemetry that never changes an
+ * outcome.
+ *
+ * The span API is `tracing` from `cloudflare:workers`
+ * (https://developers.cloudflare.com/workers/observability/traces/custom-spans/):
+ * `enterSpan(name, callback)` runs the callback in a span that is the active
+ * parent of every span and platform call made inside it — automatic RPC
+ * spans included — and ends it when the callback returns or its promise
+ * settles. A span records nothing unless the invocation was head-sampled
+ * (`observability.traces.head_sampling_rate`).
+ *
+ * `setAttributes` and `recordException` shipped on 2026-09-25
+ * (https://developers.cloudflare.com/changelog/post/2026-09-25-custom-span-apis/);
+ * a runtime from before then has `isTraced` and `setAttribute` only. So the
+ * code being traced never touches the runtime's span. It gets a
+ * {@link SpanRecorder}, which records only while the span is traced, uses
+ * whichever methods the runtime has, and swallows anything a span method
+ * throws.
+ *
+ * Core and fabric stay importable outside workerd, so they reach the API
+ * through this leaf: the Worker's composition root hands it over once, at
+ * module scope, with {@link adoptTracing}, exactly as it does `ctx.exports`
+ * (./composition.ts). With nothing adopted — unit tests, an embedder that
+ * never adopts — {@link traced} runs its callback with {@link untraced}.
+ */
+
+/** Attribute values a span holds; `undefined` entries are ignored. */
+export type SpanAttributes = Record<string, string | number | boolean | undefined>;
+
+/** The runtime's `Span`, as any Workers runtime with `tracing` may have it. */
+export interface RuntimeSpan {
+  readonly isTraced: boolean;
+  setAttribute?(key: string, value?: string | number | boolean): unknown;
+  setAttributes?(attributes: SpanAttributes): unknown;
+  recordException?(
+    exception: string | { code?: string | number; name?: string; message?: string; stack?: string },
+  ): void;
+}
+
+/** The part of `cloudflare:workers`'s `tracing` Nimbus uses. */
+export interface Tracer {
+  enterSpan<T>(name: string, callback: (span: RuntimeSpan) => T): T;
+}
+
+/** What traced code records on its span. Never throws; records nothing unless the span is traced. */
+export interface SpanRecorder {
+  set(attributes: SpanAttributes): void;
+  /**
+   * Record `error` as an exception event. `code`, when given, replaces the
+   * error's own; `context` is prefixed to its message.
+   */
+  exception(error: unknown, code?: string, context?: string): void;
+}
+
+/** The recorder of a span that is not traced, or of no span at all. */
+export const untraced: SpanRecorder = Object.freeze({ set() {}, exception() {} });
+
+let tracer: Tracer | null = null;
+
+/** Hand this isolate's `tracing` over. The first adoption stands, like `adoptCtxExports`. */
+export function adoptTracing(value: Tracer): void {
+  tracer ??= value;
+}
+
+function recorderFor(span: RuntimeSpan): SpanRecorder {
+  try {
+    if (!span.isTraced) return untraced;
+  } catch {
+    return untraced;
+  }
+  return {
+    set(attributes) {
+      try {
+        if (typeof span.setAttributes === 'function') {
+          span.setAttributes(attributes);
+        } else if (typeof span.setAttribute === 'function') {
+          for (const [key, value] of Object.entries(attributes)) {
+            if (value !== undefined) span.setAttribute(key, value);
+          }
+        }
+      } catch { /* telemetry is best-effort */ }
+    },
+    exception(error, code, context = '') {
+      try {
+        if (typeof span.recordException !== 'function') return;
+        if (error instanceof Error) {
+          const own = 'code' in error ? error.code : undefined;
+          span.recordException({
+            code: code ?? (typeof own === 'string' || typeof own === 'number' ? own : undefined),
+            name: error.name,
+            message: context + error.message,
+            stack: error.stack,
+          });
+        } else {
+          span.recordException(code === undefined && !context
+            ? String(error)
+            : { code, message: context + String(error) });
+        }
+      } catch { /* telemetry is best-effort */ }
+    },
+  };
+}
+
+/**
+ * Run `fn` in a span named `name` carrying `attributes`, and record on it the
+ * exception `fn` throws or its promise rejects with. What `fn` returns or
+ * throws reaches the caller unchanged, whatever the span does.
+ */
+export function traced<T>(name: string, attributes: SpanAttributes, fn: (span: SpanRecorder) => T): T {
+  if (!tracer) return fn(untraced);
+  return tracer.enterSpan(name, (runtimeSpan) => {
+    const span = recorderFor(runtimeSpan);
+    span.set(attributes);
+    let result: T;
+    try {
+      result = fn(span);
+    } catch (error) {
+      span.exception(error);
+      throw error;
+    }
+    if (!(result instanceof Promise)) return result;
+    return result.catch((error: unknown) => {
+      span.exception(error);
+      throw error;
+    }) as T;
+  });
+}

package/src/weighted-credit-pool.ts

@@ -11,11 +11,6 @@ export interface WeightedCreditPoolStats {
   readonly current: number;
   readonly peak: number;
   readonly queued: number;
-  /**
-   * Credit held by owners that keep it for their whole lifetime rather than
-   * for one operation — the floor no waiter can ever expect to get back.
-   */
-  readonly resident: number;
 }
 
 export interface WeightedCreditPoolOptions {
@@ -34,8 +29,6 @@ export interface WeightedCreditPoolOptions {
 
 interface CreditWaiter {
   readonly bytes: number;
-  /** Whether the granted lease counts toward the resident floor. */
-  readonly resident: boolean;
   readonly resolve: (lease: ResizableCreditLease) => void;
   readonly reject: (error: Error) => void;
   readonly signal?: AbortSignal;
@@ -46,55 +39,27 @@ interface CreditWaiter {
 class CreditLane {
   private current = 0;
   private peak = 0;
-  private resident = 0;
   private readonly waiters: CreditWaiter[] = [];
 
   constructor(readonly capacity: number) {}
 
   get stats(): WeightedCreditPoolStats {
-    return {
-      current: this.current, peak: this.peak, queued: this.waiters.length, resident: this.resident,
-    };
+    return { current: this.current, peak: this.peak, queued: this.waiters.length };
   }
 
   tryAcquire(bytes: number): ResizableCreditLease | null {
     if (this.waiters.length > 0 || this.current + bytes > this.capacity) return null;
-    return this.grant(bytes, false);
-  }
-
-  /**
-   * The largest claim this lane can ever grant: capacity less what resident
-   * owners hold for their whole lifetime. A claim above it cannot be
-   * satisfied by waiting, because nothing it is waiting for will be
-   * released.
-   */
-  get grantableCeiling(): number {
-    return this.capacity - this.resident;
+    return this.grant(bytes);
   }
 
-  acquire(bytes: number, signal?: AbortSignal, resident = false): Promise<ResizableCreditLease> {
+  acquire(bytes: number, signal?: AbortSignal): Promise<ResizableCreditLease> {
     if (signal?.aborted) return Promise.reject(abortError(signal));
-    // Refuse a claim no amount of waiting can satisfy, rather than parking it
-    // in the FIFO forever. A parked claim is indistinguishable from a caller
-    // that stopped: no error, no timeout, and — because the queue refuses
-    // everyone behind it — no further progress anywhere in the isolate. That
-    // is what a real-vite launch looked like for four rounds of debugging.
-    if (bytes > this.grantableCeiling) {
-      return Promise.reject(new RangeError(
-        `weighted credit claim of ${bytes} bytes can never be granted: capacity is ${this.capacity} `
-        + `and ${this.resident} bytes are held by resident owners, leaving ${this.grantableCeiling}`,
-      ));
-    }
-    const immediate = resident ? null : this.tryAcquire(bytes);
+    const immediate = this.tryAcquire(bytes);
     if (immediate) return Promise.resolve(immediate);
-    if (resident && this.waiters.length === 0 && this.current + bytes <= this.capacity) {
-      return Promise.resolve(this.grant(bytes, true));
-    }
 
     return new Promise<ResizableCreditLease>((resolve, reject) => {
       const waiter: CreditWaiter = {
         bytes,
-        resident,
         resolve,
         reject,
         signal,
@@ -119,9 +84,8 @@ class CreditLane {
     });
   }
 
-  private grant(bytes: number, resident: boolean): ResizableCreditLease {
+  private grant(bytes: number): ResizableCreditLease {
     this.current += bytes;
-    if (resident) this.resident += bytes;
     this.peak = Math.max(this.peak, this.current);
     let leasedBytes = bytes;
     let released = false;
@@ -143,7 +107,6 @@ class CreditLane {
           );
         }
         this.current -= leasedBytes - nextBytes;
-        if (resident) this.resident -= leasedBytes - nextBytes;
         leasedBytes = nextBytes;
         this.drain();
       },
@@ -151,7 +114,6 @@ class CreditLane {
         if (released) return;
         released = true;
         this.current -= leasedBytes;
-        if (resident) this.resident -= leasedBytes;
         if (this.current < 0) {
           throw new Error('weighted credit accounting underflow');
         }
@@ -172,7 +134,7 @@ class CreditLane {
       if (this.current + waiter.bytes > this.capacity) return;
       this.waiters.shift();
       waiter.signal?.removeEventListener('abort', waiter.onAbort!);
-      waiter.resolve(this.grant(waiter.bytes, waiter.resident));
+      waiter.resolve(this.grant(waiter.bytes));
     }
   }
 }
@@ -233,7 +195,6 @@ export class WeightedCreditPool {
       current: general.current + small.current,
       peak: general.peak + small.peak,
       queued: general.queued + small.queued,
-      resident: general.resident + small.resident,
     };
   }
 
@@ -265,22 +226,6 @@ export class WeightedCreditPool {
     return this.general.acquire(bytes, signal);
   }
 
-  /**
-   * Take credit that will be held for the owner's whole lifetime rather than
-   * for one operation — the esbuild pool's wasm image is the case.
-   *
-   * Recorded as a floor so a later claim that could never fit around it is
-   * refused with both numbers instead of parking in the FIFO forever.
-   */
-  acquireResident(bytes: number, signal?: AbortSignal): Promise<ResizableCreditLease> {
-    try {
-      this.validateRequest(bytes);
-    } catch (error) {
-      return Promise.reject(error as Error);
-    }
-    return this.general.acquire(bytes, signal, true);
-  }
-
   private validateRequest(bytes: number): void {
     if (!Number.isSafeInteger(bytes) || bytes <= 0 || bytes > this.capacity) {
       throw new RangeError(