@nimbus-sh/worker 0.1.2 → 0.1.4

package/dist/runtime/wasm-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wasm-runner.d.ts","sourceRoot":"","sources":["../../src/runtime/wasm-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAqD9E,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAE3C,eAAO,MAAM,gBAAgB,QA+BwC,CAAC;AAEtE;;;;;;;;;GASG;AACH,UAAU,OAAO;IACf,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC;IACnC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5D,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACxD,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAC1D,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AA2CD;;;;;GAKG;AACH,UAAU,gBAAgB;IACxB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACrE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AAED,UAAU,mBAAmB;IAC3B,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACrE,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C;AA2ID;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,GAAG,CAAC;IACT,GAAG,EAAE,kBAAkB,CAAC;IACxB,YAAY,EAAE,gBAAgB,CAAC;IAC/B,WAAW,EAAE,mBAAmB,CAAC;CAClC,IAEG,WAAW,OAAO,EAClB,OAAO,MAAM,EACb,MAAM,cAAc,KACnB,OAAO,CAAC,gBAAgB,CAAC,CAgd7B"}
+{"version":3,"file":"wasm-runner.d.ts","sourceRoot":"","sources":["../../src/runtime/wasm-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAqD9E,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAE3C,eAAO,MAAM,gBAAgB,QA+BwC,CAAC;AAEtE;;;;;;;;;GASG;AACH,UAAU,OAAO;IACf,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC;IACnC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5D,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACxD,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAC1D,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AA2CD;;;;;GAKG;AACH,UAAU,gBAAgB;IACxB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACrE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AAED,UAAU,mBAAmB;IAC3B,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACrE,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C;AA2ID;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,GAAG,CAAC;IACT,GAAG,EAAE,kBAAkB,CAAC;IACxB,YAAY,EAAE,gBAAgB,CAAC;IAC/B,WAAW,EAAE,mBAAmB,CAAC;CAClC,IAEG,WAAW,OAAO,EAClB,OAAO,MAAM,EACb,MAAM,cAAc,KACnB,OAAO,CAAC,gBAAgB,CAAC,CAgd7B"}

package/dist/runtime/wasm-runner.js

@@ -1,21 +1,15 @@
 /**
  * wasm-runner.ts — native-WASM runner via the LOADER-modules transport.
  *
- * Re-introduced after the multi-runtime wave's revert. The previous
- * version relied on direct `WebAssembly.instantiate(bytes)` at request
- * time — workerd's CSP blocks that path inside both the supervisor
- * and facet isolates (verified in the multi-runtime feasibility
- * memo). The new version routes through the LOADER's modules map:
+ * Direct `WebAssembly.instantiate(bytes)` is blocked by workerd CSP at
+ * request time in both the supervisor and facet isolates. This runner routes
+ * through the LOADER modules map:
  * bytes ride INSIDE the worker code blob, workerd compiles them
  * during the inner worker's MODULE-LOAD phase (the one phase where
  * wasm code generation IS allowed), and the resulting
  * WebAssembly.Module is exposed to the user fn via the
  * NimbusLoaderPool's `globalThis.__NIMBUS_WASM[<name>]` table.
  *
- * The validation that this works on the deployed Cloudflare fleet
- * lives at /workspace/.seal-internal/2026-05-10-wasm-csp/findings.md
- * (`add(3,4) === 7` returned in 11ms warm, 113ms cold).
- *
  * Shell command shape
  * ───────────────────
  *
@@ -45,16 +39,16 @@
  *   - WASI imports are NOT provided. Modules expecting wasi_snapshot
  *     won't instantiate (fail at the in-facet instantiate step).
  *
- * Anti-requirements
- * ─────────────────
- *   - NO setTimeout / NO retry / NO defensive-catch in the dispatch
- *     path. The pool's resilience options handle retries.
+ * Dispatch constraints
+ * ────────────────────
+ *   - No sleeps, caller-side retries, or catch-and-continue around loader
+ *     failures. The pool's resilience options own retry behavior.
  *   - The try/catch around vfs.readFile is a legitimate I/O boundary;
  *     the diagnostic propagates as exitCode 1 + stderr line.
  *   - NO direct WebAssembly.instantiate(bytes) at request time —
- *     that's the architectural mistake from the prior wave.
+ *     workerd CSP rejects that path.
  */
-import { WASI_INSTANCE_PREAMBLE_SRC, WASI_WAVE1_FNS } from './wasi-instance.js';
+import { WASI_INSTANCE_PREAMBLE_SRC, WASI_IMPLEMENTED_FNS } from './wasi-instance.js';
 export const WASM_RUNNER_VERSION = '0.3.0';
 export const WASM_RUNNER_HELP = 'Usage: wasm-runner [options] <file.wasm> [exportName] [int args...]\n' +
     '       wasm-runner --version\n' +
@@ -64,7 +58,7 @@ export const WASM_RUNNER_HELP = 'Usage: wasm-runner [options] <file.wasm> [expor
     'module\'s imports:\n' +
     '\n' +
     '  WASI mode  (imports wasi_snapshot_preview1): invokes _start with a\n' +
-    '             Wave-1 WASI shim. stdout/stderr stream to the Process tab.\n' +
+    '             core WASI WASI shim. stdout/stderr stream to the Process tab.\n' +
     '             exportName argument is optional; defaults to _start.\n' +
     '  Direct mode (no WASI imports): calls the named export with integer\n' +
     '             args and prints the return value.\n' +
@@ -80,10 +74,10 @@ export const WASM_RUNNER_HELP = 'Usage: wasm-runner [options] <file.wasm> [expor
     '    multi-arg-shapes need a wrapper module.\n' +
     '  - Only integer return values are surfaced.\n' +
     '\n' +
-    'Limitations (WASI mode, Wave-1):\n' +
-    '  - 16 fns implemented: ' + WASI_WAVE1_FNS.join(', ') + '.\n' +
+    'Limitations (WASI mode, core WASI):\n' +
+    '  - implemented imports: ' + WASI_IMPLEMENTED_FNS.join(', ') + '.\n' +
     '  - path_*, fd_readdir, fd_filestat_*, fd_pread, fd_pwrite, poll_oneoff,\n' +
-    '    sock_* return ENOSYS (Wave-2 will add SqliteFS-backed paths).\n' +
+    '    sock_* return ENOSYS (filesystem WASI will add SqliteFS-backed paths).\n' +
     '  - fd 0 (stdin) returns EOF immediately.\n' +
     '  - Transport: bytes ship via the LOADER modules map, NOT\n' +
     '    WebAssembly.instantiate(bytes) at request time (CSP-blocked).';
@@ -155,8 +149,8 @@ function b64ToBytes(b64) {
  * filesystem into the facet isolate.
  *
  * Bounded by:
- *   - 32 MiB total bytes (hard cap — bigger sessions need a per-call
- *     RPC dispatch architecture; defer to Wave-3).
+ *   - 32 MiB total bytes. Bigger sessions need a streaming or incremental
+ *     filesystem transport instead of a single snapshot.
  *   - 5000 file count.
  *
  * Returns null + a diagnostic if bounds are exceeded so the caller
@@ -271,7 +265,7 @@ function flushVfsDiff(vfs, diff) {
         }
         catch { }
     }
-    // Stream-B B1+B3: count timesChanged / symlinks for diagnostics. The
+    // WASI socket and polling support B1+B3: count timesChanged / symlinks for diagnostics. The
     // current SqliteVFS doesn't expose utime() or symlink() on its public
     // surface, so we don't persist these across calls — they live only
     // within the call (mtimes are read back correctly via stat→filestat_get
@@ -411,7 +405,7 @@ export function makeWasmRunner(deps) {
             if (args.mode === 'wasi') {
                 const mk = __wasiMakeImports;
                 const runStart = __wasiRunStart;
-                // Stream-B P3 / prod-verify-fix: bare lexical reference, matching
+                // WASI socket and polling support P3 / production compatibility fix: bare lexical reference, matching
                 // the runStart pattern above. The earlier `(globalThis as any)
                 // .__wasiRunStartAsync` lookup returned undefined at runtime
                 // because top-level `function` declarations in the preamble's
@@ -419,12 +413,12 @@ export function makeWasmRunner(deps) {
                 // was that sock_*/poll_oneoff (wrapped in WebAssembly.Suspending)
                 // were invoked from a sync `_start` call stack → V8 trapped with
                 // "trying to suspend without WebAssembly.promising". The 11
-                // sync-only Stream-B probes worked because they never hit a
+                // sync-only WASI socket and polling support probes worked because they never hit a
                 // Suspending import; the 7 async probes failed because they did.
                 // The preamble is statically prepended to this same module body
                 // (loader-pool.ts:523-530), so the symbol is guaranteed in
                 // scope. typeof guard handles the impossible case of a preamble
-                // pre-dating Stream-B (defensive only).
+                // pre-dating WASI socket and polling support (defensive only).
                 const runStartAsync = typeof __wasiRunStartAsync === 'function'
                     ? __wasiRunStartAsync
                     : null;
@@ -490,11 +484,11 @@ export function makeWasmRunner(deps) {
                         error: 'wasm module did not export a `memory` — WASI requires one.',
                     };
                 }
-                // Stream-B P3: use async runStart when available so any
+                // WASI socket and polling support P3: use async runStart when available so any
                 // suspending socket imports can complete via JSPI. The async
                 // wrapper falls back to sync invocation internally when
                 // WebAssembly.promising isn't available, so this is safe for
-                // non-suspending programs too. Legacy preambles (pre-Stream-B)
+                // non-suspending programs too. Legacy preambles (pre-WASI socket and polling support)
                 // that ship without __wasiRunStartAsync still work via the
                 // sync runStart path.
                 const r = runStartAsync
@@ -572,7 +566,7 @@ export function makeWasmRunner(deps) {
         // runtime-registry's RuntimeRunOpts carries env on the way in; we
         // forward to the WASI shim. Direct mode doesn't use env.
         const wasiEnv = isWasi ? (opts.env || {}) : {};
-        // ── Wave-2: snapshot user's session VFS for WASI mode ──
+        // ── filesystem WASI: snapshot user's session VFS for WASI mode ──
         //
         // The user's cwd at invocation time is our session-root preopen
         // anchor. WASI programs see this as fd 3 mapped to '/'. We
@@ -623,7 +617,7 @@ export function makeWasmRunner(deps) {
         catch (e) {
             outcome = { ok: false, error: `dispatch failed: ${e?.message || e}` };
         }
-        // ── Wave-2: flush mutated FS state back into SqliteFS ──
+        // ── filesystem WASI: flush mutated FS state back into SqliteFS ──
         if (outcome.mode === 'wasi' && outcome.ok && outcome.fsDiff) {
             try {
                 flushVfsDiff(deps.vfs, outcome.fsDiff);

package/dist/session/bindings.d.ts

@@ -13,17 +13,12 @@
  * The shims have NO interaction with NimbusSession internals except
  * through that RPC stub. Co-located here for grep-ability.
  *
- * Originally lines 4934-5341 of pre-Phase-1 src/nimbus-session.ts (before
- * any refactor commits); lines 4513-4957 in the post-S1 source.
- * Per audit/sections/SESSION-REFACTOR-PLAN.md §B.3.9 + S2.
- *
  * Exports re-shipped from nimbus-session.ts so existing import paths work:
  *   NimbusAssetsRPC, NimbusLoaderRPC, NimbusLoadedWorker,
  *   NimbusLoadedEntrypoint, NimbusDurableObjectNamespace, NimbusDOStub.
  *
- * **Bundle-graph note** (per plan §B.4 + §VI.9): these classes MUST remain
- * reachable from `src/index.ts`'s entry graph for wrangler to bundle them.
- * The re-export hub in nimbus-session.ts preserves that linkage.
+ * Bundle-graph note: these classes must remain reachable from `src/index.ts`
+ * for Wrangler to bundle the WorkerEntrypoint exports.
  */
 import { WorkerEntrypoint } from 'cloudflare:workers';
 /**

package/dist/session/bindings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bindings.d.ts","sourceRoot":"","sources":["../../src/session/bindings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAiBtD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,eAAgB,SAAQ,gBAAgB;IACnD;;;;OAIG;IACG,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;CAmDjD;AA0HD;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAMhG;AAiBD,kEAAkE;AAClE,qBAAa,eAAgB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,aAAa;IAKrB,OAAO,CAAC,SAAS;IAMjB,OAAO,CAAC,cAAc;IAWtB;;;;;OAKG;IACH,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,GAAG;IAmBpB;;;;OAIG;IACG,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;CAiBzD;AAED,mEAAmE;AACnE,qBAAa,kBAAmB,SAAQ,gBAAgB;IACtD;;;;;;OAMG;IACH,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,GAAG;IAWjC;;;;;;;;OAQG;IACH,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG;CAQzC;AAED,8DAA8D;AAC9D,qBAAa,sBAAuB,SAAQ,gBAAgB;IAC1D;;;;;OAKG;IACG,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;CASjD;AAqBD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAAa,4BAA6B,SAAQ,gBAAgB;IAChE,mEAAmE;IACnE,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAiBhC,sEAAsE;IACtE,WAAW,IAAI,MAAM;IAIrB,kDAAkD;IAClD,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM;IAI/B,2CAA2C;IAC3C,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,GAAG;CAYrB;AAED;;;;;;;GAOG;AACH,qBAAa,YAAa,SAAQ,gBAAgB;IAChD;;;;OAIG;IACG,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;CAgCjD"}
+{"version":3,"file":"bindings.d.ts","sourceRoot":"","sources":["../../src/session/bindings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAiBtD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,eAAgB,SAAQ,gBAAgB;IACnD;;;;OAIG;IACG,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;CAmDjD;AA0HD;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAMhG;AAiBD,kEAAkE;AAClE,qBAAa,eAAgB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,aAAa;IAKrB,OAAO,CAAC,SAAS;IAMjB,OAAO,CAAC,cAAc;IAWtB;;;;;OAKG;IACH,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,GAAG;IAmBpB;;;;OAIG;IACG,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;CAiBzD;AAED,mEAAmE;AACnE,qBAAa,kBAAmB,SAAQ,gBAAgB;IACtD;;;;;;OAMG;IACH,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,GAAG;IAWjC;;;;;;;;OAQG;IACH,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG;CAQzC;AAED,8DAA8D;AAC9D,qBAAa,sBAAuB,SAAQ,gBAAgB;IAC1D;;;;;OAKG;IACG,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;CASjD;AAqBD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAAa,4BAA6B,SAAQ,gBAAgB;IAChE,mEAAmE;IACnE,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAiBhC,sEAAsE;IACtE,WAAW,IAAI,MAAM;IAIrB,kDAAkD;IAClD,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM;IAI/B,2CAA2C;IAC3C,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,GAAG;CAYrB;AAED;;;;;;;GAOG;AACH,qBAAa,YAAa,SAAQ,gBAAgB;IAChD;;;;OAIG;IACG,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;CAgCjD"}

package/dist/session/bindings.js

@@ -13,17 +13,12 @@
  * The shims have NO interaction with NimbusSession internals except
  * through that RPC stub. Co-located here for grep-ability.
  *
- * Originally lines 4934-5341 of pre-Phase-1 src/nimbus-session.ts (before
- * any refactor commits); lines 4513-4957 in the post-S1 source.
- * Per audit/sections/SESSION-REFACTOR-PLAN.md §B.3.9 + S2.
- *
  * Exports re-shipped from nimbus-session.ts so existing import paths work:
  *   NimbusAssetsRPC, NimbusLoaderRPC, NimbusLoadedWorker,
  *   NimbusLoadedEntrypoint, NimbusDurableObjectNamespace, NimbusDOStub.
  *
- * **Bundle-graph note** (per plan §B.4 + §VI.9): these classes MUST remain
- * reachable from `src/index.ts`'s entry graph for wrangler to bundle them.
- * The re-export hub in nimbus-session.ts preserves that linkage.
+ * Bundle-graph note: these classes must remain reachable from `src/index.ts`
+ * for Wrangler to bundle the WorkerEntrypoint exports.
  */
 import { WorkerEntrypoint } from 'cloudflare:workers';
 // ── Inner-Worker loopback bindings ────────────────────────────────────
@@ -183,7 +178,7 @@ function mimeTypeForPath(path) {
  * request re-load the worker in its own context via env.LOADER.get(id)
  * — workerd caches by id so repeated loads are essentially free.
  *
- * H7 (heap-correctness wave). The pre-fix comment said "GC isn't
+ * H7 (memory accounting cleanup). The pre-fix comment said "GC isn't
  * needed" because "inner stubs that reference them die with the DO."
  * That was true for STUBS but FALSE for these CODE entries: nothing
  * deletes them. `wrangler dev`'s rebuild-on-save loop calls load()

package/dist/session/helpers.d.ts

@@ -1,14 +1,8 @@
 /**
  * session/helpers.ts — pure helpers used by the supervisor.
  *
- * All functions here are pure (no class state, no
- * `cloudflare:workers` import), so they can be unit-tested with bun
- * test without a workerd harness. The cleanup-and-readme reorg moved
- * them here from src/nimbus-session.ts (originally lines 96-523).
- *
- * audit/sections/SESSION-REFACTOR-PLAN.md §B.3.2 + S1.
- *
- * Re-exported by nimbus-session.ts so existing imports keep working.
+ * All functions here are pure: no class state and no `cloudflare:workers`
+ * import. NimbusSession re-exports the public helpers that callers need.
  */
 import type { SqliteVFS } from '../vfs/sqlite-vfs.js';
 /**
@@ -105,7 +99,6 @@ export declare function detectUnsupportedWranglerConfig(vfs: SqliteVFS, root: st
 /**
  * W8: classify a child_process spawn target by execution kind. Used by
  * the FacetProcessManager to decide between inline pure-builtin vs
- * facet-direct dispatch. See audit/sections/W8-plan.md §8.5 BLOCKER-2.
  *
  *   pure-builtin  — sync, no facet recursion. echo, cat, true, false,
  *                   ls, cd, env, sleep, mkdir, rm, … (all the unix

package/dist/session/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../src/session/helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEtD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;CAC9B,GAAG,MAAM,CAiHT;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,UAehC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAI5F,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,aAQjC,CAAC;AACH,eAAO,MAAM,iCAAiC,aAG5C,CAAC;AAEH;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG;IAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAoBzF;AAED;;;;;;;;;;;GAWG;AAiBH,eAAO,MAAM,kCAAkC,UAQ9C,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAwCtF;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,aAU3B,CAAC;AACH,eAAO,MAAM,gBAAgB,aAS3B,CAAC;AAEH;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,cAAc,GAAG,cAAc,GAAG,SAAS,CAAA;CAAE,GAAG,IAAI,CAU3G;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiB9D;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,SAAS,EACd,WAAW,EAAE,MAAM,GAClB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAiBxC"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../src/session/helpers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEtD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;CAC9B,GAAG,MAAM,CAiHT;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,UAehC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAI5F,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,aAQjC,CAAC;AACH,eAAO,MAAM,iCAAiC,aAG5C,CAAC;AAEH;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG;IAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAoBzF;AAED;;;;;;;;;;;GAWG;AAiBH,eAAO,MAAM,kCAAkC,UAQ9C,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAwCtF;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,aAS3B,CAAC;AACH,eAAO,MAAM,gBAAgB,aAS3B,CAAC;AAEH;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,cAAc,GAAG,cAAc,GAAG,SAAS,CAAA;CAAE,GAAG,IAAI,CAU3G;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiB9D;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,SAAS,EACd,WAAW,EAAE,MAAM,GAClB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAiBxC"}

package/dist/session/helpers.js

@@ -1,14 +1,8 @@
 /**
  * session/helpers.ts — pure helpers used by the supervisor.
  *
- * All functions here are pure (no class state, no
- * `cloudflare:workers` import), so they can be unit-tested with bun
- * test without a workerd harness. The cleanup-and-readme reorg moved
- * them here from src/nimbus-session.ts (originally lines 96-523).
- *
- * audit/sections/SESSION-REFACTOR-PLAN.md §B.3.2 + S1.
- *
- * Re-exported by nimbus-session.ts so existing imports keep working.
+ * All functions here are pure: no class state and no `cloudflare:workers`
+ * import. NimbusSession re-exports the public helpers that callers need.
  */
 /**
  * Render a polished "no dev server" placeholder HTML page for the /preview/
@@ -352,7 +346,6 @@ export function detectUnsupportedWranglerConfig(vfs, root) {
 /**
  * W8: classify a child_process spawn target by execution kind. Used by
  * the FacetProcessManager to decide between inline pure-builtin vs
- * facet-direct dispatch. See audit/sections/W8-plan.md §8.5 BLOCKER-2.
  *
  *   pure-builtin  — sync, no facet recursion. echo, cat, true, false,
  *                   ls, cd, env, sleep, mkdir, rm, … (all the unix
@@ -369,7 +362,6 @@ export const _CP_FACET_DIRECT = new Set([
     'vite', 'tsc', 'esbuild', 'rollup', 'webpack',
     // W11: framework CLIs — bare-name dispatch must reach a Node isolate
     // for npm-run-dev / direct-shell invocations to work. See
-    // audit/sections/W11-plan.md §5 + reviewer comment 2.
     'astro', 'nuxt', 'nuxi', 'remix', 'svelte-kit', 'next',
 ]);
 export const _CP_PURE_BUILTIN = new Set([

package/dist/session/init.d.ts

@@ -16,11 +16,9 @@
  *   3. setPhase('online')   if (cold)
  *   4. self._b4Phase = 'hydrated'
  *
- * Extracted from src/nimbus-session.ts during the SESSION-REFACTOR
- * (audit/sections/SESSION-REFACTOR-PLAN.md §B.3.8 + S6) so the DO
- * class itself stays small. Imports `self: InitHost` (a narrow view
- * of SessionInternal + readonly ctx/env) which gives the compiler
- * enough type info without the surface area of the full DO class.
+ * `self` is typed as InitHost, a narrow view of SessionInternal plus readonly
+ * ctx/env, so this module can use the session internals it owns without
+ * depending on the full Durable Object class surface.
  *
  * Imports and class delegators on NimbusSession preserve back-compat:
  *   - acceptShellWebSocket → self.initSession(ws)  (S7 will extract).
@@ -30,7 +28,6 @@ import type { SessionInternal } from './internal.js';
 /**
  * `initSession` reads `this.ctx` and `this.env` extensively (~14 sites).
  * Both are `protected` on the parent `CloudflareDurableObject` class
- * (DEFECT-D1, see audit/sessions/session-refactor-build-progress.md).
  * The pragmatic shape for THIS module: extend SessionInternal with
  * `ctx`/`env` as `any` and have the class delegator cast `this as
  * unknown as InitHost`. Other sibling modules (-rpc, -ws, -hib,

package/dist/session/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/session/init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AA8DH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD;;;;;;;;;GASG;AACH,KAAK,QAAQ,GAAG,eAAe,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAA;CAAE,CAAC;AAG3E,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,GAAG,IAAI,CAk8G/D"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/session/init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AA8DH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD;;;;;;;;GAQG;AACH,KAAK,QAAQ,GAAG,eAAe,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAA;CAAE,CAAC;AAG3E,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,GAAG,IAAI,CA+7G/D"}

package/dist/session/init.js

@@ -16,11 +16,9 @@
  *   3. setPhase('online')   if (cold)
  *   4. self._b4Phase = 'hydrated'
  *
- * Extracted from src/nimbus-session.ts during the SESSION-REFACTOR
- * (audit/sections/SESSION-REFACTOR-PLAN.md §B.3.8 + S6) so the DO
- * class itself stays small. Imports `self: InitHost` (a narrow view
- * of SessionInternal + readonly ctx/env) which gives the compiler
- * enough type info without the surface area of the full DO class.
+ * `self` is typed as InitHost, a narrow view of SessionInternal plus readonly
+ * ctx/env, so this module can use the session internals it owns without
+ * depending on the full Durable Object class surface.
  *
  * Imports and class delegators on NimbusSession preserve back-compat:
  *   - acceptShellWebSocket → self.initSession(ws)  (S7 will extract).
@@ -152,7 +150,7 @@ export function initSession(self, ws) {
         persistKernelMounts(self.ctx, mountPoints);
     }
     catch { /* fail-soft */ }
-    // BUG-SWEEP-R3-1 (2026-05-11): mount a virtual /dev provider.
+    // shell compatibility (2026-05-11): mount a virtual /dev provider.
     // Pre-fix `cmd > /dev/null` and `cmd 2>/dev/null` errored with
     // `ENOENT: '/dev': no such file or directory`. This provider
     // synthesizes /dev/null, /dev/zero, /dev/random, /dev/urandom,
@@ -192,7 +190,7 @@ export function initSession(self, ws) {
     const kernel = self.kernel;
     const sqliteFs = self.sqliteFs;
     const facetMgr = self.facetManager;
-    // ── monaco-wave-a (2026-05-13): editor-pane fs bridge ──
+    // ── editor/monaco (2026-05-13): editor-pane fs bridge ──
     //
     // The terminal hosts the WS that the editor pane reuses for
     // fs-read / fs-write / fs-list messages. We install the handler
@@ -325,14 +323,14 @@ export function initSession(self, ws) {
             });
         }
     });
-    // ── True-OS Wave-3 v1.1: ./<wasm-binary> shell-side dispatch ──
+    // ── runtime package manager v1.1: ./<wasm-binary> shell-side dispatch ──
     // When the user invokes `./hello` (or any `./X` / `/abs/X`)
     // shell-form path and the file:
     //   (a) exists in SqliteFS at that relative-to-cwd path, AND
     //   (b) starts with the wasm magic bytes `\0asm\1\0\0\0`
     // we route the invocation to the wasm-runner command with the
     // user's args. This is how `clang t.c -o hello && ./hello`
-    // closes the True-OS demo: the linker emits a wasm executable,
+    // closes the runtime substrate demo: the linker emits a wasm executable,
     // and the shell knows to run it via the WASI shim.
     //
     // Implementation: monkey-patch registry.resolve. If the standard
@@ -434,7 +432,7 @@ export function initSession(self, ws) {
     // ctx + env are passed for clone/fetch/pull which run in a facet to avoid
     // exhausting the supervisor DO's CPU budget on large repos.
     registerGitCommands(registry, sqliteFs, self.ctx, self.env);
-    // ── True-OS Wave-3: `nimbus install` package manager + runner registry.
+    // ── runtime package manager: `nimbus install` package manager + runner registry.
     //
     // 1. Register the clang-runner factory FIRST so the rehydration step
     //    below can re-bind `clang` / `wasm-ld` from an already-installed
@@ -490,7 +488,6 @@ export function initSession(self, ws) {
     // bootstrap runs at child-facet module-init time, per-call
     // __rubyRun drives rb-eval-string-protect with a wrapper that
     // catches SystemExit. See src/runtime/ruby-runner.ts +
-    // /workspace/.seal-internal/2026-05-11-ruby-v1/audit.md.
     //
     // REPL Stream A: wrap the one-shot factory so `ruby` with NO args
     // drops into an interactive REPL. The wrap is purely additive —
@@ -553,7 +550,7 @@ export function initSession(self, ws) {
     // Parses args, reads script from VFS, delegates to FacetManager.
     // The facet creates a dynamic worker where new Function() is allowed
     // during module startup.
-    // ── node command (multi-runtime wave: refactored to use runtime-registry) ──
+    // ── node command (runtime registry refactor: refactored to use runtime-registry) ──
     //
     // Behaviour preserved exactly:
     //   - primitive #1 nodeFlagSpan (--version/-v/-h scan only flags
@@ -606,7 +603,7 @@ export function initSession(self, ws) {
             return await oneShotNode(ctx);
         });
     }
-    // ── bun command (multi-runtime wave: refactored to use runtime-registry) ──
+    // ── bun command (runtime registry refactor: refactored to use runtime-registry) ──
     //
     // Behaviour preserved exactly:
     //   - --version / --help
@@ -721,12 +718,11 @@ export function initSession(self, ws) {
     }
     // ── wasm-runner: native WebAssembly runtime via LOADER-modules transport ──
     //
-    // Re-introduced after the multi-runtime wave's revert. Bytes
+    // Re-introduced after the runtime registry refactor's revert. Bytes
     // ride INSIDE the worker code blob (LOADER's modules map, the
     // one phase where wasm code generation IS allowed); request-time
     // WebAssembly.instantiate(bytes) is CSP-blocked and avoided.
     //
-    // Validated transport: /workspace/.seal-internal/2026-05-10-
     // wasm-csp/findings.md — add(3,4)===7 in 11ms warm against the
     // deployed Cloudflare fleet.
     //
@@ -738,7 +734,7 @@ export function initSession(self, ws) {
         version: WASM_RUNNER_VERSION,
         helpText: WASM_RUNNER_HELP,
         run: makeWasmRunner({
-            // Wave-2: extended VFS surface for WASI file-IO. The wasm-runner
+            // filesystem WASI: extended VFS surface for WASI file-IO. The wasm-runner
             // snapshots a session subtree into the facet, flushes the diff
             // back via this surface after _start returns.
             vfs: {
@@ -1153,7 +1149,7 @@ export function initSession(self, ws) {
             if (self.viteDevServer?.isRunning)
                 self.viteDevServer.stop();
             const previewBasePath = self.viteBasePath;
-            // Primitives wave (P5/P8): same long-running treatment as the
+            // process metadata support: same long-running treatment as the
             // dev path, just on the dist/ directory.
             const previewPort = viteConfig.port || 4173; // vite preview default
             const previewProcEntry = self.processTable.spawn('vite preview (' + distRoot + ')', [], distRoot);
@@ -1529,7 +1525,7 @@ export function initSession(self, ws) {
             basePath: previewBasePath,
             env: self.env,
             ctx: self.ctx,
-            // Primitives wave (P8): wire dev-server diagnostics into the
+            // process diagnostics support: wire dev-server diagnostics into the
             // supervisor's per-PID log store so the Process tab is no
             // longer silent after the banner.
             pid: viteProcEntry.pid,
@@ -1708,7 +1704,7 @@ export function initSession(self, ws) {
             return 1;
         }
         const cfg = self.nimbusWrangler.stats;
-        // Primitives wave (P5): banner advertises the canonical
+        // runtime primitive support (P5): banner advertises the canonical
         // `/__nimbus/worker/` route. The legacy `/worker/` URL is still
         // accepted for one release (Sunset 2027-01-01) but new sessions
         // are pointed at the namespaced form.
@@ -1778,7 +1774,7 @@ export function initSession(self, ws) {
     // never sets explicitly), persisted overlays whatever the user
     // did set (NIMBUS_TEST=cool, etc.).
     //
-    // Primitive #7 (primitives-extension wave): PORT/HOST and
+    // Primitive #7 (runtime primitive support): PORT/HOST and
     // NIMBUS_SESSION_ID are part of the standard contract.
     //
     //   PORT=3000  — the same default Markflow's `${PORT:-3000}` shell
@@ -2204,23 +2200,23 @@ export function initSession(self, ws) {
     //    `<&0` etc before lifo-sh's parser chokes on them. Stdout and
     //    stderr share the terminal sink so these are no-ops anyway. ──
     FdRedirectNormalizer.install(self.shell);
-    // ── Brace expansion (BUG-SWEEP-R3-3) — `ls *.{js,ts}` etc.
+    // ── Brace expansion (shell compatibility) — `ls *.{js,ts}` etc.
     //    Runs BEFORE subshell / dollar / fd-redirect so token expansion
     //    happens before downstream parsing. lifo-sh's executeLine chain
     //    invokes wrappers most-recently-installed-first; since we install
     //    BraceExpander AFTER FdRedirectNormalizer, it wraps FdRedirect
     //    and runs first. Same pattern for the others below.
     BraceExpander.install(self.shell);
-    // ── $$ / $0 expansion (BUG-SWEEP-R3-4) — lifo-sh doesn't expand
+    // ── $$ / $0 expansion (shell compatibility) — lifo-sh doesn't expand
     //    these special vars. We rewrite before lifo-sh's parser sees
     //    the line.
     DollarVarShim.install(self.shell);
-    // ── Subshell `(...)` (BUG-SWEEP-R3-2) — lifo-sh's parser rejects.
+    // ── Subshell `(...)` (shell compatibility) — lifo-sh's parser rejects.
     //    Strip outer parens for bare subshells and run inner commands
     //    with cwd/env save-restore. Chained / piped cases fall through
     //    to orig (still errors but with clearer surface).
     SubshellNormalizer.install(self.shell);
-    // ── Backtick `\`cmd\`` (BUG-SWEEP-R4-4) — rewrite to $(cmd) so
+    // ── Backtick `\`cmd\`` (shell compatibility) — rewrite to $(cmd) so
     //    lifo-sh's existing $(...) machinery handles it. Quote-aware.
     BacktickNormalizer.install(self.shell);
     // ── BUG-SWEEP-4: echo -n / -e flag override ─────────────────────
@@ -2296,7 +2292,7 @@ export function initSession(self, ws) {
                 t.write(suppressNewline ? out : out + '\n');
                 return 0;
             });
-            // BUG-SWEEP-R4-1 (2026-05-11): `unset VAR` doesn't actually
+            // shell compatibility (2026-05-11): `unset VAR` doesn't actually
             // unset on prod. lifo-sh's executeSimpleCommand passes a
             // COPY of shell.env (env: {...this.config.env}); our
             // registered mkUnset only mutates the copy. Override the
@@ -2313,7 +2309,7 @@ export function initSession(self, ws) {
                 }
                 return 0;
             });
-            // BUG-SWEEP-R4-1b: `export VAR=val` similarly needs to mutate
+            // shell compatibilityb: `export VAR=val` similarly needs to mutate
             // shell.env (not just ctx.env). lifo-sh has its own builtinExport
             // (node_modules/@lifo-sh/core/dist/index-Djm2onjx.js:builtinExport)
             // that DOES mutate this.env correctly. Verify by re-checking
@@ -2419,7 +2415,7 @@ export function initSession(self, ws) {
         }
         return exitCode;
     };
-    // ── Primitive #2 (primitives-extension wave): generic .bin handler ──
+    // ── Primitive #2 (runtime primitive support): generic .bin handler ──
     //
     // Direct terminal invocation of `<bincmd> [args]` (e.g. `tsc --version`,
     // `prettier --check .`, `eslint .`) used to fall through to "command
@@ -2761,7 +2757,7 @@ export function initSession(self, ws) {
                 ctx.stdout.write(`> ${script}\n\n`);
                 // ── Next.js loud-block (was W11 per-framework substrate) ──────
                 //
-                // Primitives wave (P12): the previous wave shipped this as a
+                // runtime primitive support (P12): the previous wave shipped this as a
                 // 45-line standalone module at src/frameworks/next.ts that
                 // exported nothing but the strings used here. Per the
                 // "no per-framework substrate" rule, the message is inlined
@@ -3392,7 +3388,7 @@ export function initSession(self, ws) {
             ctx.stderr.write('kill: invalid pid\n');
             return 1;
         }
-        // Primitives wave (P11): if the target is the vite shim PID
+        // runtime primitive support (P11): if the target is the vite shim PID
         // (registered by P5's long-running spawn), tear down the
         // in-process viteDevServer / cirrusReal too — facetManager.kill
         // only handles real Worker-Loader facets, and would leave the
@@ -3526,7 +3522,6 @@ export function initSession(self, ws) {
     //
     // C'.2 recovery_event ring entry — every initSession call records
     // either a cold→hydrated (first connect) or drained→hydrated
-    // (silent re-init) transition. The probe at audit/probes/
     // interactive-liveness/error-recovery/ asserts both states show
     // dataLoss=false. Track B' guarantees this for in-isolate transitions;
     // a true cold-isolate boot reads no SQL row and shows

package/dist/session/nimbus-session.d.ts

@@ -52,7 +52,7 @@ export declare class NimbusSession extends CloudflareDurableObject {
     esbuildService: EsbuildService | null;
     viteDevServer: ViteDevServer | null;
     /**
-     * Primitives wave (P5): PID + port the default-Cirrus vite shim is
+     * runtime primitive support (P5): PID + port the default-Cirrus vite shim is
      * registered under. Cleared on `vite stop`. See
      * `runtime/long-running-handle.ts` and the vite handler in
      * `session/init.ts`.

package/dist/session/nimbus-session.js

@@ -131,7 +131,7 @@ export class NimbusSession extends CloudflareDurableObject {
     esbuildService = null;
     viteDevServer = null;
     /**
-     * Primitives wave (P5): PID + port the default-Cirrus vite shim is
+     * runtime primitive support (P5): PID + port the default-Cirrus vite shim is
      * registered under. Cleared on `vite stop`. See
      * `runtime/long-running-handle.ts` and the vite handler in
      * `session/init.ts`.
@@ -432,7 +432,7 @@ export class NimbusSession extends CloudflareDurableObject {
     async _rpcRegisterPort(pid, port) { return _rpc._rpcRegisterPort(this, pid, port); }
     async _rpcUnregisterPort(port) { return _rpc._rpcUnregisterPort(this, port); }
     async _rpcTransform(code, loader) { return _rpc._rpcTransform(this, code, loader); }
-    // two-tier-fanout: peer-DO execute leg of NimbusFanoutPool's POC B topology.
+    // two-tier-fanout: peer-DO execute leg of NimbusFanoutPool's peer-DO fanout topology.
     async _rpcFanoutExecute(fnSource, args, poolOpts) {
         return _rpc._rpcFanoutExecute(this, fnSource, args, poolOpts);
     }
@@ -444,7 +444,7 @@ export class NimbusSession extends CloudflareDurableObject {
     async _rpcCpDrainOutput(childPid) { return _rpc._rpcCpDrainOutput(this, childPid); }
     async _rpcCpKill(childPid, signal) { return _rpc._rpcCpKill(this, childPid, signal); }
     async _rpcCpWait(childPid, waitMs) { return _rpc._rpcCpWait(this, childPid, waitMs); }
-    // arch-gaps gap #1: per-spawn fresh-isolate dispatch.
+    // child-process isolation gap #1: per-spawn fresh-isolate dispatch.
     async _rpcCpDispatchInline(req, kind) { return _rpc._rpcCpDispatchInline(this, req, kind); }
     // Programmatic sandbox SDK RPC
     async _rpcReady(options) { return _programmatic.ensureProgrammaticReady(this, options); }
@@ -746,8 +746,8 @@ export class NimbusSession extends CloudflareDurableObject {
                 }
             },
         };
-        // arch-gaps gap #1: per-spawn fresh-isolate envelope. The pool wraps
-        // NimbusFanoutPool — auto-routes <5 → POC C in-DO, ≥5 → POC B
+        // child-process isolation gap #1: per-spawn fresh-isolate envelope. The pool wraps
+        // NimbusFanoutPool — auto-routes <5 → in-DO fanout in-DO, ≥5 → peer-DO fanout
         // peer-DO. Hard-fails at construction if env.LOADER missing (no
         // fallback). The pool is constructed lazily on the same path that
         // builds FacetProcessManager so unit tests that don't supply

package/dist/session/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/session/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AA+BH,KAAK,UAAU,GAAG,GAAG,CAAC;AAEtB,wBAAsB,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAi/BvF"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/session/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AA+BH,KAAK,UAAU,GAAG,GAAG,CAAC;AAEtB,wBAAsB,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CA0+BvF"}