@nimbus-sh/worker 0.3.0 → 0.5.0

package/dist/facets/manager.js

@@ -22,28 +22,35 @@ import { FACET_RESIDENT_STORE_SOURCE } from '../vfs/facet-resident-store.js';
 import { VFS_CURSOR_SEED_SOURCE, serializeFacetVfsCursor, } from '@nimbus-sh/core/_shared/facet-vfs-cursor.js';
 import { VFS_WRITE_LEDGER_SOURCE } from '@nimbus-sh/core/_shared/vfs-write-ledger.js';
 import { vfsPathExtension } from '@nimbus-sh/core/vfs/path.js';
-import { clearPortCapability } from '../session/port-capability.js';
+import { clearPortCapability, readPortReservation, releasePortReservation, restoreReservedPortCapability } from '../session/port-capability.js';
+import { PORT_CAPABILITY_KEY_PREFIX } from '../session/keys.js';
+import { unbindPublicPortCapability } from '../router/public-directory.js';
 import { prefetchForRequire } from '@nimbus-sh/core/runtime/require-resolver.js';
 import { hasTopLevelModuleSyntax } from '@nimbus-sh/core/runtime/javascript-ast.js';
 import { bindImportMetaResolve, importMetaDefines } from '@nimbus-sh/core/runtime/import-meta-transform.js';
-import { recordFailure, getLastRpcFrame, getLastFacetId } from '@nimbus-sh/core/observability/oom-discriminator.js';
-import { classifyError } from '@nimbus-sh/core/observability/oom-classify.js';
-import { LaunchPacer, LaunchTurnPump, launchChunkMaxBytes } from '@nimbus-sh/fabric/launch-pacer.js';
-import { ResidentLaunchJournal, } from '@nimbus-sh/fabric/launch-journal.js';
-import { EsbuildService } from '@nimbus-sh/core/runtime/esbuild-service.js';
+import { recordFailure, getLastRpcFrame, getLastFacetId } from '@nimbus-sh/platform/oom-discriminator.js';
+import { classifyError } from '@nimbus-sh/platform/oom-classify.js';
+import { TurnBudget, PacedWork, turnChunkMaxBytes, withResolvers } from '@nimbus-sh/fabric/turn-budget.js';
+import { onColdStart } from '@nimbus-sh/fabric/generation.js';
+import { FencedWork, FENCED_WORK_KEY_PREFIX, } from '@nimbus-sh/fabric/fenced-work.js';
+import { EsbuildService, rewriteBundledEsmToCjs, } from '@nimbus-sh/core/runtime/esbuild-service.js';
 import { isExecDiagEnabled, recordExecTelemetry } from './exec-telemetry.js';
-import { disposeRpcResource, disposeRpcResources } from '@nimbus-sh/core/_shared/rpc-dispose.js';
+import { disposeRpcResource, disposeRpcResources } from '@nimbus-sh/platform/rpc-dispose.js';
 import { sqliteWasmModuleEntry } from './opencode-staging.js';
-import { FacetImageStore, } from '@nimbus-sh/fabric/facet-image-store.js';
+import { ImageStore, } from '@nimbus-sh/fabric/image-store.js';
 import { ProcessFabric, } from '@nimbus-sh/fabric/process-fabric.js';
-import { createLoadedWorkerEntrypoint, getNimbusCtxExports, } from '@nimbus-sh/fabric/workerd-facet-host.js';
+import { createLoadedWorkerEntrypoint, getNimbusCtxExports, deleteFacetStorage, } from '@nimbus-sh/fabric/workerd-facet-host.js';
+import { acquireDurableFacetSlot, freeDurableFacetSlot, } from './durable-slots.js';
+import { persistDurableWorkerImage, } from './durable-images.js';
 import { SQLITE_WASM_MODULE_NAME, } from '../runtime/opencode-facet-runner.js';
 import { parsePortFromArgv, resolveLongRunningPort } from '@nimbus-sh/core/runtime/long-running-handle.js';
 import { DEFAULT_FACET_BUNDLE_PROFILE, } from '@nimbus-sh/core/runtime/bundle-profile.js';
-import { BUNDLE_BUILD_DEADLINE_MS, CF_COMPAT_DATE, FACET_TIMEOUT_MS, VFS_BUNDLE_MAX_FILES, VFS_BUNDLE_MAX_BYTES, CWD_SNAPSHOT_MAX_FILE_BYTES, BUNDLE_MAX_ENCODED_BYTES, MAX_RPC_SAFE_PAYLOAD_BYTES, PREFETCH_CACHE_MAX_BYTES, } from '@nimbus-sh/core/constants.js';
+import { BUNDLE_BUILD_DEADLINE_MS, CF_COMPAT_DATE, FACET_TIMEOUT_MS, VFS_BUNDLE_MAX_FILES, VFS_BUNDLE_MAX_BYTES, CWD_SNAPSHOT_MAX_FILE_BYTES, BUNDLE_MAX_ENCODED_BYTES, PREFETCH_CACHE_MAX_BYTES, } from '@nimbus-sh/core/constants.js';
+import { MAX_RPC_SAFE_PAYLOAD_BYTES } from '@nimbus-sh/platform/limits.js';
 import { CRED_KERNEL } from '@nimbus-sh/core/runtime/os-contracts.js';
-import { acquireSupervisorAllocation } from '@nimbus-sh/core/observability/heavy-alloc-coord.js';
-import { prefetchBundleStart, prefetchBundleEnd, setPrefetchCacheBytes, } from '@nimbus-sh/core/observability/diag-counters.js';
+import { acquireSupervisorAllocation } from '@nimbus-sh/platform/heavy-alloc-coord.js';
+import { prefetchBundleStart, prefetchBundleEnd, setPrefetchCacheBytes, } from '@nimbus-sh/platform/diag-counters.js';
+const ISOLATED_ESM_TRANSFORM_MIN_BYTES = 512 * 1024;
 /**
  * Detect & restore a Uint8Array that's been JSON-mangled to a
  * {"0":n,"1":n,...} object during the result-envelope round-trip.
@@ -118,6 +125,7 @@ function parseFacetManagerEnv(env) {
         LOADER: loader,
         ASSETS: assets,
         NIMBUS_LAUNCH_CHUNK_BYTES: typeof chunkBytes === 'string' ? chunkBytes : undefined,
+        rawEnv: env,
     };
 }
 /**
@@ -406,11 +414,11 @@ function __mkCompiledFn(code) {
     code = __nl >= 0 ? code.slice(__nl + 1) : "";
   }
   function renameIfDeclared(name) {
-    const re = new RegExp("(?:^|\\\\n|;)\\\\s*(?:const|let|var|function|class)\\\\s+" + name + "\\\\b", "m");
+    const re = new RegExp("(?:^|\\\\n|;)\\\\s*(?:const|let|var|function|class)\\\\s+" + name + "(?![$\\\\w])", "m");
     return re.test(code) ? name + "__nimbus_unused" : name;
   }
   const baseParams = [
-    "exports", "require", "module",
+    "exports", renameIfDeclared("require"), "module",
     renameIfDeclared("__filename"),
     renameIfDeclared("__dirname"),
   ];
@@ -431,23 +439,10 @@ const __MODULE_VFS_MANIFEST = ${safeManifest};
 const __MODULE_VFS_METADATA = ${safeMetadata};
 const __compiledModules = new Map();
 const __compileFailures = new Map();
-for (const [__p, __c] of Object.entries(__MODULE_VFS_BUNDLE)) {
-  // Precompile JS modules AND extensionless CJS entries (bin scripts and
-  // shims). workerd forbids new Function at request time, so anything not
-  // precompiled here surfaces the misleading "file was not pre-bundled".
-  // .json is data; skip it (it loads via JSON.parse, not as a function).
-  const __base = __p.slice(__p.lastIndexOf("/") + 1);
-  const __dot = __base.lastIndexOf(".");
-  const __ext = __dot > 0 ? __base.slice(__dot) : "";
-  if (__ext === ".js" || __ext === ".mjs" || __ext === ".cjs" || __ext === "") {
-    if (typeof __c !== "string") continue;
-    try {
-      __compiledModules.set(__p, __mkCompiledFn(__c));
-    } catch (__e) {
-      __compileFailures.set(__p, __e && __e.message ? __e.message : String(__e));
-    }
-  }
-}
+// Precompile JS modules AND extensionless CJS entries (bin scripts and
+// shims). workerd forbids new Function at request time, so anything not
+// precompiled here surfaces the misleading "file was not pre-bundled".
+${BUNDLE_PRECOMPILE_LOOP}
 
 class __ProcessExit extends Error {
   constructor(code) { super("process.exit(" + code + ")"); this.code = code; }
@@ -685,11 +680,11 @@ const __NimbusHostResponse = globalThis.Response;
 
 function __mkCompiledFn(code) {
   function renameIfDeclared(name) {
-    const re = new RegExp("(?:^|\\\\n|;)\\\\s*(?:const|let|var|function|class)\\\\s+" + name + "\\\\b", "m");
+    const re = new RegExp("(?:^|\\\\n|;)\\\\s*(?:const|let|var|function|class)\\\\s+" + name + "(?![$\\\\w])", "m");
     return re.test(code) ? name + "__nimbus_unused" : name;
   }
   const baseParams = [
-    "exports", "require", "module",
+    "exports", renameIfDeclared("require"), "module",
     renameIfDeclared("__filename"),
     renameIfDeclared("__dirname"),
   ];
@@ -717,15 +712,7 @@ const __compileFailures = new Map();
 // \`new Function\` throws "Code generation from strings disallowed" in the DO
 // constructor and at request time — so the require closure must be compiled
 // here, off the module map. That is why code cannot come from the store.
-for (const [__p, __c] of Object.entries(__MODULE_VFS_BUNDLE)) {
-  if (__p.endsWith(".js") || __p.endsWith(".mjs") || __p.endsWith(".cjs")) {
-    try {
-      __compiledModules.set(__p, __mkCompiledFn(__c));
-    } catch (__e) {
-      __compileFailures.set(__p, __e && __e.message ? __e.message : String(__e));
-    }
-  }
-}
+${BUNDLE_PRECOMPILE_LOOP}
 
 ${FACET_RESIDENT_STORE_SOURCE}
 
@@ -1340,8 +1327,10 @@ export function encodedBundleSize(bundle, manifest) {
 function describeBundleCells(cells, limit = 8) {
     const shown = [...cells].sort((a, b) => b[1] - a[1]).slice(0, limit);
     const rest = cells.length - shown.length;
-    return shown.map(([path, bytes]) => `${path} (${bytes} bytes)`).join(', ')
-        + (rest > 0 ? `, +${rest} more` : '');
+    return shown.map(([path, bytes]) => {
+        const source = compiledCellPath(path);
+        return source === null ? `${path} (${bytes} bytes)` : `${source} [compiled] (${bytes} bytes)`;
+    }).join(', ') + (rest > 0 ? `, +${rest} more` : '');
 }
 /**
  * hardening-r5: emit a JS expression that revives binary cells from base64
@@ -1727,7 +1716,7 @@ function buildManifest(vfs, cwd, scriptPath) {
     return manifest;
 }
 function buildVfsMetadata(vfs, manifest, bundle) {
-    const paths = new Set(Object.keys(bundle));
+    const paths = new Set(Object.keys(bundle).filter((path) => compiledCellPath(path) === null));
     for (const [directory, children] of Object.entries(manifest)) {
         paths.add(directory);
         for (const child of children) {
@@ -1801,6 +1790,16 @@ export function greedyAddMainEntries(vfs, cwd, bundle, budgetState) {
         try {
             if (!vfs.exists(stripped) || vfs.isDirectory(stripped))
                 return false;
+            // This is a guess at what a program might require, and the same
+            // per-file ceiling the entry-package walk applies bounds it: a
+            // multi-MiB main entry is an alternative bundle (typescript's 8.69 MiB
+            // `lib/typescript.js` beside the `lib/tsc.js` that actually runs), and
+            // one guess must not spend a third of the budget — and a third of the
+            // supervisor's headroom — on every invocation that never reads it.
+            // Anything the program really requires arrives through the closure,
+            // which is uncapped.
+            if (vfs.lstat(stripped).size > BIN_PACKAGE_SPECULATIVE_MAX_FILE_BYTES)
+                return false;
             // hardening-r5: preserve binary content as Uint8Array.
             const content = _readBundleCell(vfs, stripped);
             const cellLen = _bundleCellLength(content);
@@ -2528,18 +2527,22 @@ const RUNTIME_PACKAGE_EXCLUDED_FILE_SUFFIXES = [
     '.webm',
 ];
 /**
- * Per-file ceiling for the speculative entry-package walk.
+ * Per-file ceiling for the speculative passes over installed packages: the
+ * entry-package walk (`addBinTargetSiblings`) and the main-entry oversample
+ * (`greedyAddMainEntries`).
  *
  * Everything the entry package needs in order to *run* arrives through the
- * require closure, which is uncapped and never evicted. This walk exists only
- * to catch data files the static walker cannot see, and data files are small.
- * Multi-MiB cells in a package tree are overwhelmingly alternative bundles —
- * typescript ships an 8.69 MiB `lib/typescript.js` that is never read — rather
- * than data.
+ * require closure, which is uncapped and never evicted. These passes exist
+ * only to catch what the static walker cannot see — data files, and modules
+ * reached by a computed require — and those are small. Multi-MiB cells in a
+ * package tree are overwhelmingly alternative bundles — typescript ships an
+ * 8.69 MiB `lib/typescript.js` that `tsc` never reads — rather than data.
  *
  * So one speculative guess must not spend the budget every later invocation
  * then carries: the same reasoning as `CWD_SNAPSHOT_MAX_FILE_BYTES`, applied
- * to the package tree.
+ * to the package tree. A miss this causes is loud and self-repairing: the
+ * facet reports the unstaged read and the next build stages it from the
+ * residency ledger, which has no per-file rule.
  */
 const BIN_PACKAGE_SPECULATIVE_MAX_FILE_BYTES = 4 * 1024 * 1024;
 function shouldIncludeBinPackageFile(pkgRoot, path, bundleProfile) {
@@ -2769,15 +2772,20 @@ function __cacheKey(src) {
  */
 function _markBundleEsmAsFailed(bundle, reason) {
     for (const path of Object.keys(bundle)) {
+        if (compiledCellPath(path) !== null)
+            continue;
         if (!isBundleModuleCandidate(path))
             continue;
         const src = bundle[path];
         if (typeof src !== 'string')
             continue;
-        if (!looksLikeEsm(src))
+        // A TypeScript source is never runnable as staged, so it always needs
+        // the emit it cannot get; a JavaScript file only if it is ESM.
+        const typescript = bundleTypescriptLoader(path) !== null;
+        if (!typescript && !looksLikeEsm(src))
             continue;
         const escapedReason = JSON.stringify(`esbuild transform failed for ${path}: ${reason}`);
-        bundle[path] =
+        bundle[typescript ? compiledCellKey(path) : path] =
             '// framework-fixes-F4 diagnostic shim — esbuild rejected the ESM transform\n' +
                 '(function () { throw new Error(' + escapedReason + '); })();\n';
     }
@@ -2808,13 +2816,89 @@ export function isBundleModuleCandidate(path) {
  * EXTENSION, where `.js` files transform on their content — `looksLikeEsm` is
  * the right question for a file that is already valid JS either way, and the
  * wrong one for a file that is never valid JS.
+ *
+ * A declaration file (`.d.ts`, `.d.mts`, `.d.cts`) is not a source: it has
+ * no runtime form, nothing `require()`s one, and esbuild's output for it is
+ * empty by definition. It is DATA — read by the program that ships it, which
+ * is exactly typescript: `tsc` reads its own `lib/lib.*.d.ts` with
+ * `readFileSync`, and every declaration it type-checks against comes from
+ * those bytes. Transforming them handed the compiler an 811-byte license
+ * comment where `lib.es5.d.ts` (217 KB) had been, and every global type was
+ * gone. So a declaration file is left exactly as it was staged.
  */
 export function bundleTypescriptLoader(path) {
+    if (isTypescriptDeclarationFile(path))
+        return null;
     const ext = vfsPathExtension(path);
     if (ext === '.tsx')
         return 'tsx';
     return ext === '.ts' || ext === '.mts' || ext === '.cts' ? 'ts' : null;
 }
+/** `name.d.ts` / `name.d.mts` / `name.d.cts`, by TypeScript's own rule. */
+export function isTypescriptDeclarationFile(path) {
+    const base = path.slice(path.lastIndexOf('/') + 1);
+    return /\.d\.[mc]?ts$/.test(base);
+}
+/**
+ * Where a bundle carries the EXECUTABLE form of a cell whose staged bytes are
+ * not JavaScript — a TypeScript source.
+ *
+ * A bundle cell is two things to the facet: what `readFileSync` returns for
+ * the path, and what the startup pre-compile loop turns into the function
+ * `require` runs. For a JavaScript file those are the same bytes, so the
+ * ESM→CJS pass rewrites the cell in place and both readers see JavaScript.
+ * For a TypeScript source they are NOT the same: the bytes a program reads
+ * are the source (tsc compiling its project, a test runner, a linter), and
+ * the bytes `require` needs are esbuild's emit. Rewriting the cell in place
+ * handed tsc esbuild's CommonJS rendering of its own `src/index.ts` — it
+ * compiled that, and reported errors on lines the file never had.
+ *
+ * So the source cell stays exactly as staged, and the compiled form travels
+ * under this key: a NUL-framed prefix no filesystem path can contain, in the
+ * same map, so it is sized, split, cached, released and shipped by every
+ * mechanism the bundle already has. The facet's pre-compile loop takes these
+ * cells OFF the map as it compiles them, keyed by the real path, before any
+ * read can see them.
+ */
+const COMPILED_CELL_KEY_PREFIX = '\0compiled\0';
+export function compiledCellKey(path) {
+    return COMPILED_CELL_KEY_PREFIX + path;
+}
+/** The source path a compiled-cell key stands for, or null for a plain path. */
+export function compiledCellPath(key) {
+    return key.startsWith(COMPILED_CELL_KEY_PREFIX) ? key.slice(COMPILED_CELL_KEY_PREFIX.length) : null;
+}
+/**
+ * The pre-compile loop both generated facets run at module evaluation, the
+ * only moment workerd lets a string become code. One definition so the two
+ * facets cannot drift on what they compile: every JavaScript-shaped cell
+ * (`.js`, `.mjs`, `.cjs` and the extensionless bin scripts) from its own
+ * bytes, and every TypeScript source from its compiled cell — which is
+ * removed from the bundle here, so a `readFileSync` of the source path
+ * returns the source and a directory listing never shows the key.
+ */
+export const BUNDLE_PRECOMPILE_LOOP = `
+const __NIMBUS_COMPILED_PREFIX = ${JSON.stringify(COMPILED_CELL_KEY_PREFIX)};
+for (const [__p, __c] of Object.entries(__MODULE_VFS_BUNDLE)) {
+  let __modulePath = __p;
+  if (__p.startsWith(__NIMBUS_COMPILED_PREFIX)) {
+    __modulePath = __p.slice(__NIMBUS_COMPILED_PREFIX.length);
+    delete __MODULE_VFS_BUNDLE[__p];
+  } else {
+    // .json is data; skip it (it loads via JSON.parse, not as a function).
+    const __base = __p.slice(__p.lastIndexOf("/") + 1);
+    const __dot = __base.lastIndexOf(".");
+    const __ext = __dot > 0 ? __base.slice(__dot) : "";
+    if (__ext !== ".js" && __ext !== ".mjs" && __ext !== ".cjs" && __ext !== "") continue;
+  }
+  if (typeof __c !== "string") continue;
+  try {
+    __compiledModules.set(__modulePath, __mkCompiledFn(__c));
+  } catch (__e) {
+    __compileFailures.set(__modulePath, __e && __e.message ? __e.message : String(__e));
+  }
+}
+`;
 /**
  * Transform every ESM-shaped file in the bundle to CJS via esbuild.
  * Mutates `bundle` in place. Errors are swallowed (the file is left as
@@ -2824,14 +2908,19 @@ export function bundleTypescriptLoader(path) {
  * Candidate set is `isBundleModuleCandidate`; within it, files with no
  * top-level import/export are already CJS-shaped and left alone.
  *
+ * A JavaScript cell is rewritten in place. A TypeScript source keeps its
+ * bytes and gets a compiled cell beside it — see `compiledCellKey`.
+ *
  * Returns the count of files transformed (for diagnostics).
  */
-async function transformEsmInBundle(bundle, esbuild, pacer) {
+async function transformEsmInBundle(bundle, esbuild, pacer, isolatedTransform) {
     let transformed = 0;
     let failed = 0;
     // Snapshot the keys first — esbuild calls await; never iterate-and-mutate.
     const candidates = [];
     for (const path of Object.keys(bundle)) {
+        if (compiledCellPath(path) !== null)
+            continue;
         if (!isBundleModuleCandidate(path))
             continue;
         const src = bundle[path];
@@ -2839,14 +2928,19 @@ async function transformEsmInBundle(bundle, esbuild, pacer) {
         // esbuild.transform expect strings.
         if (typeof src !== 'string')
             continue;
-        if (bundleTypescriptLoader(path) === null && !looksLikeEsm(src))
-            continue;
+        if (bundleTypescriptLoader(path) === null) {
+            const esm = looksLikeEsm(src);
+            if (!esm)
+                continue;
+        }
         candidates.push(path);
     }
     for (const path of candidates) {
         const src = bundle[path];
         if (typeof src !== 'string')
             continue;
+        // A TypeScript source keeps its bytes; its emit lands beside it.
+        const target = bundleTypescriptLoader(path) === null ? path : compiledCellKey(path);
         // esbuild-wasm runs inside this isolate, so a transform is computation
         // like any other pass — the await above it yields nothing on its own.
         if (pacer)
@@ -2869,19 +2963,25 @@ async function transformEsmInBundle(bundle, esbuild, pacer) {
         const key = __cacheKey(src + '\0' + absUrl);
         const cached = __esmTransformCache.get(key);
         if (cached) {
-            bundle[path] = cached;
+            bundle[target] = cached;
             transformed++;
             continue;
         }
         try {
-            const t = await esbuild.transform(src, {
+            const transformOptions = {
                 loader: bundleTypescriptLoader(path) ?? 'js',
                 format: 'cjs',
                 target: 'esnext',
                 define: importMetaDefines(absUrl),
-            });
+            };
+            const bounded = transformOptions.loader === 'js' && src.length >= ISOLATED_ESM_TRANSFORM_MIN_BYTES
+                ? rewriteBundledEsmToCjs(src, absUrl)
+                : null;
+            const t = bounded ?? (isolatedTransform && src.length >= ISOLATED_ESM_TRANSFORM_MIN_BYTES
+                ? await isolatedTransform(src, transformOptions)
+                : await esbuild.transform(src, transformOptions));
             const code = bindImportMetaResolve(t.code, absUrl);
-            bundle[path] = code;
+            bundle[target] = code;
             __esmTransformCache.set(key, code);
             transformed++;
         }
@@ -2903,7 +3003,6 @@ async function transformEsmInBundle(bundle, esbuild, pacer) {
             // __compiledModules, and the failure surfaces at require time
             // with FULL diagnostic context. Net effect for users: the same
             // upstream tool still fails, but they now see WHY.
-            //
             // Probe: tests/behavioral/npm-create/new/create-astro-diagnostic.mjs
             // asserts the user-visible error contains "esbuild transform" so
             // future diagnostic regressions are caught.
@@ -2914,7 +3013,7 @@ async function transformEsmInBundle(bundle, esbuild, pacer) {
             // this so repeated submits don't re-run the same transform.
             const diagnosticSrc = '// framework-fixes-F4 diagnostic shim — esbuild rejected the ESM transform\n' +
                 '(function () { throw new Error(' + escapedReason + '); })();\n';
-            bundle[path] = diagnosticSrc;
+            bundle[target] = diagnosticSrc;
             __esmTransformCache.set(key, diagnosticSrc);
             failed++;
         }
@@ -2937,7 +3036,7 @@ async function transformEsmInBundle(bundle, esbuild, pacer) {
  * behaviour for code paths that don't have esbuild handy).
  *
  */
-export async function buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bundleProfile = DEFAULT_FACET_BUNDLE_PROFILE, observedReads, pacer) {
+export async function buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bundleProfile = DEFAULT_FACET_BUNDLE_PROFILE, observedReads, pacer, isolatedTransform) {
     // This build accumulates raw VFS contents in the supervisor heap, and did it
     // with nothing watching: the estimator read 9.4 MiB while these bytes were
     // resetting the DO three times. Take the budget the enrichment passes are
@@ -2947,14 +3046,14 @@ export async function buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbui
     const lease = await acquireSupervisorAllocation(VFS_BUNDLE_MAX_BYTES);
     prefetchBundleStart(VFS_BUNDLE_MAX_BYTES);
     try {
-        return await _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bundleProfile, observedReads, pacer);
+        return await _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bundleProfile, observedReads, pacer, isolatedTransform);
     }
     finally {
         prefetchBundleEnd(VFS_BUNDLE_MAX_BYTES);
         lease.release();
     }
 }
-async function _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bundleProfile = DEFAULT_FACET_BUNDLE_PROFILE, observedReads, pacer) {
+async function _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bundleProfile = DEFAULT_FACET_BUNDLE_PROFILE, observedReads, pacer, isolatedTransform) {
     // Read the cursor BEFORE the walk: a mutation that lands while the bundle
     // is being assembled must be reported as invalidated, not silently missed.
     const cursor = { epoch: vfs.epoch, rev: vfs.revision() };
@@ -3069,7 +3168,7 @@ async function _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bu
     //     "file was not pre-bundled" at request time.
     if (esbuild) {
         try {
-            await transformEsmInBundle(bundle, esbuild, pacer);
+            await transformEsmInBundle(bundle, esbuild, pacer, isolatedTransform);
             // Recount bytes after the transform — CJS rebuilds can be larger
             // OR smaller than the ESM source. We don't try to thread totalBytes
             // through the transform because the eviction loop below recomputes
@@ -3108,8 +3207,9 @@ async function _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bu
     //    went are named rather than silently dropped.
     const size = encodedBundleSize(bundle, manifest);
     if (size.bytes > BUNDLE_MAX_ENCODED_BYTES) {
+        // A compiled cell goes with its source: required when the source is.
         const evictable = Object.keys(bundle)
-            .filter((path) => !requiredPaths.has(path))
+            .filter((path) => !requiredPaths.has(compiledCellPath(path) ?? path))
             .sort((a, b) => _bundleCellLength(bundle[b]) - _bundleCellLength(bundle[a]));
         const evicted = [];
         for (const k of evictable) {
@@ -3149,6 +3249,16 @@ async function _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bu
     };
 }
 const ROUTEABLE_PORT_ATTACH_TIMEOUT_MS = 1_000;
+/** A port request may wait this long for a durable app's re-drive to boot. */
+const DURABLE_ENSURE_BOOT_BUDGET_MS = 12_000;
+/**
+ * The durable owner a journal row serves: the row's stamped field for
+ * reservation-claimed residents, falling back to the worker recipe's own
+ * owner for rows written before the stamping rule landed.
+ */
+function residentOwner(record) {
+    return record.owner ?? (record.recipe.kind === 'worker' ? record.recipe.owner : undefined);
+}
 /** 'running' is the measured common case: the platform's reset strikes
  *  seconds after a launch settles, while the resident runs. */
 function residentLaunchDoing(record) {
@@ -3178,20 +3288,20 @@ export class FacetManager {
     debugEnabled = false;
     processRpcResources = new Map();
     /**
-     * The content-addressed boot-image store (fabric's facet-image-store.ts),
+     * The content-addressed boot-image store (fabric's image-store.ts),
      * writing through this session's kernel-credentialed VFS and rooted off the
      * live process table.
      */
-    imageStore = new FacetImageStore(() => this._imageBlobs(), (pid) => this.processes.get(pid)?.state === 'running');
+    imageStore = new ImageStore(() => this._imageBlobs(), (pid) => this.processes.get(pid)?.state === 'running');
     /**
-     * The resident-launch journal (fabric's launch-journal.ts): the durable
+     * The resident-launch journal (fabric's fenced-work.ts): the durable
      * record of every resident this session owes the user, and its recovery
      * after an instance reset. This manager supplies what a launch IS — the
-     * inputs `_spawnResident` re-drives from — and how its loss is reported.
+     * recipe `_redrive` re-drives from — and how its loss is reported.
      */
     launchJournal;
     /**
-     * The granting side of the launch pacer (fabric's launch-pacer.ts). The
+     * The granting side of the launch budget (fabric's turn-budget.ts). The
      * session's alarm re-enters the object through `pumpResidentLaunches`;
      * journal recovery rides the first pump.
      */
@@ -3234,12 +3344,13 @@ export class FacetManager {
      * prefetch cache above so a profile can only ever seed the bundle it was
      * measured against.
      *
-     * Lifetime is the supervisor incarnation's, same as the cache — a restart
      * costs one more loud failure and then relearns. Persisting it would be a
      * schema and a migration bought with nothing the in-memory form does not
      * already deliver for the case that matters: running the command again.
      */
     residencyProfiles = new Map();
+    /** In-flight request-driven durable-app ensures, single-flight per port. */
+    ensureInflight = new Map();
     static RESIDENCY_PROFILE_MAX_ENTRIES = 16;
     /**
      * A program that reads a directory of data files misses once per file, so
@@ -3266,10 +3377,10 @@ export class FacetManager {
             ? Reflect.get(env, 'NIMBUS_DEBUG')
             : undefined;
         this.debugEnabled = debugVar === '1' || debugVar === 'true';
-        this.launchJournal = new ResidentLaunchJournal(ctx.storage, {
+        this.launchJournal = new FencedWork(ctx.storage, {
             generationBase: () => this.processes.pidBase,
             waitUntil: (promise) => this.ctx.waitUntil(promise),
-            redrive: (record, attempt) => this._spawnResident(record.code, record.opts, attempt),
+            redrive: (record, attempt) => this._redrive(record, attempt),
             onRedrive: (record) => this.hooks.notify?.('\x1b[2m[nimbus: the session restarted while '
                 + `"${record.command}" was ${residentLaunchDoing(record)} — restarting it]\x1b[0m\r\n`),
             onAbandoned: (record) => this.hooks.notify?.('\x1b[2m[nimbus: the session restarted again while '
@@ -3277,10 +3388,13 @@ export class FacetManager {
             onRedriveFailed: (record, e) => this.hooks.notify?.(`\x1b[2m[nimbus: "${record.command}" could not be restarted: `
                 + `${errorMessage(e)}]\x1b[0m\r\n`),
         });
-        this.launchPump = new LaunchTurnPump({
+        this.launchPump = new PacedWork(ctx, {
             requestTurn: hooks.requestLaunchTurn?.bind(hooks),
-            recover: () => this.launchJournal.recoverInterrupted(),
         });
+        // A reset that killed a resident launch left journal rows behind; the
+        // first pump after the reset drains this reconciliation before any
+        // waiter resumes, OFF the constructor's init gate.
+        onColdStart(ctx, () => this.launchJournal.recoverInterrupted());
         // The journal row of a resident lives for the PROCESS's lifetime, so its
         // release belongs on the one seam every end-of-life passes through —
         // exit, kill, self-reported exit and timeout abort all mark the table.
@@ -3322,6 +3436,17 @@ export class FacetManager {
             unlink: (path) => fs.unlink(path),
         };
     }
+    /**
+     * The kernel-scoped VFS the durable image store reads and writes through —
+     * `.nimbus/images/<sha256>` is session kernel data, not user content.
+     */
+    _imageVfs() {
+        const vfs = this.vfs;
+        if (!vfs) {
+            throw new Error('Nimbus: a durable spawn needs a session filesystem to persist its launch image');
+        }
+        return vfs;
+    }
     /**
      * W3.5 Fix B: hand the FacetManager a pre-warmed EsbuildService for
      * the ESM→CJS bundle pre-pass. NimbusSession already lazy-creates one
@@ -3408,7 +3533,7 @@ export class FacetManager {
             this.prefetchBundleCache.set(key, cached);
             return { ...cached.vfsState, cacheHit: true, cacheRetained: true };
         }
-        const vfsState = await buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, this.esbuild || undefined, bundleProfile, this.residencyProfiles.get(key));
+        const vfsState = await buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, this.esbuild || undefined, bundleProfile, this.residencyProfiles.get(key), undefined, this.hooks.transformLargeEsm);
         vfsState.bundleKey = key;
         vfsState.bundleSource = await buildFacetVfsBundleSource(vfsState.bundle, vfsState.bundleSideModulesRequired);
         vfsState.serializedManifest = JSON.stringify(vfsState.manifest);
@@ -3619,12 +3744,7 @@ export class FacetManager {
         // CJS before they hit the facet's `new Function` pre-compile loop.
         // Lazy-create one if NimbusSession didn't share its own.
         if (this.vfs && !this.esbuild) {
-            try {
-                this.esbuild = new EsbuildService(this.vfs);
-            }
-            catch {
-                this.esbuild = null;
-            }
+            this.esbuild = new EsbuildService(this.vfs.as(CRED_KERNEL));
         }
         const diagOn = isExecDiagEnabled();
         const __bundleStart = diagOn ? Date.now() : 0;
@@ -3942,7 +4062,7 @@ export class FacetManager {
             this.imageStore.ensureDir();
         const processVfs = this.vfs?.as(entry.cred);
         const vfsState = processVfs
-            ? await buildPrefetchBundle(processVfs, undefined, opts.cwd, '', this.esbuild || undefined)
+            ? await buildPrefetchBundle(processVfs, undefined, opts.cwd, '', this.esbuild || undefined, DEFAULT_FACET_BUNDLE_PROFILE, undefined, undefined, this.hooks.transformLargeEsm)
             : { bundle: {}, manifest: {}, metadata: {}, reachableCount: 0, truncated: false };
         const vfsBundle = _serializeBundleForFacet(vfsState.bundle);
         assertStagedBundleFitsRpcPayload(vfsBundle, vfsState.bundle);
@@ -4244,7 +4364,7 @@ export class FacetManager {
     /**
      * Grant every suspended launch a chunk of this turn — the session's alarm
      * calls this, and journal recovery rides the first pump. See fabric's
-     * `LaunchTurnPump.pump` for the ownership argument.
+     * `PacedWork.pump` for the ownership argument.
      */
     pumpResidentLaunches() {
         return this.launchPump.pump();
@@ -4413,6 +4533,39 @@ export class FacetManager {
                 clearTimeout(timer);
         }
     }
+    /**
+     * Re-drive a journalled launch after an instance reset. What the journal
+     * row carries is the recipe and nothing else: env and credentials are never
+     * written to storage, so a worker launch's are re-resolved by the embedder
+     * through `hooks.resolveWorkerLaunch`.
+     */
+    async _redrive(record, attempt) {
+        const { recipe } = record;
+        switch (recipe.kind) {
+            case 'node': return this._spawnResident(recipe.code, recipe.opts, attempt);
+            case 'worker': {
+                // The embedder's resolver decides everything; only a self-owned
+                // launch — nobody composed an embedder hook — falls through to the
+                // session's image-store default.
+                const resolve = this.hooks.resolveWorkerLaunch ?? this.hooks.resolveWorkerLaunchFallback;
+                if (!resolve)
+                    throw new Error('resident launch journal holds a worker launch but no resolveWorkerLaunch hook is composed');
+                const resolved = await resolve(recipe);
+                if (resolved === null)
+                    return undefined;
+                const { 'worker.js': workerCode, ...modules } = resolved.modules;
+                if (workerCode === undefined)
+                    throw new Error('resolved worker launch carries no worker.js module');
+                return this._spawnWorker(workerCode, record.command, recipe.cwd, {
+                    port: recipe.port > 0 ? recipe.port : undefined, modules, compatibilityDate: recipe.compatibilityDate,
+                    compatibilityFlags: recipe.compatibilityFlags, startArgs: recipe.startArgs,
+                    env: resolved.env ?? undefined, globalOutbound: resolved.globalOutbound,
+                    vfsWasmModules: resolved.vfsWasmModules,
+                    durable: { owner: recipe.owner, image: recipe.image },
+                }, attempt);
+            }
+        }
+    }
     /**
      * Spawn a long-running Node process with the same shimmed require/fs/http
      * environment used by foreground `node <script>` execution.
@@ -4488,7 +4641,7 @@ export class FacetManager {
      */
     async _runResidentLaunch(entry, code, command, opts, attempt) {
         const cwd = opts.cwd || '/home/user';
-        const pacer = new LaunchPacer(this.launchPump, launchChunkMaxBytes(this.env), () => this._assertLaunchStillOwned(entry.pid));
+        const pacer = new TurnBudget(this.launchPump, turnChunkMaxBytes(this.env), () => this._assertLaunchStillOwned(entry.pid));
         // Journalled before the first byte of work. A launch that FAILS deletes
         // its row on the way out — its process has already been exited and the
         // user notified, so there is nothing left to owe. A launch that SETTLES
@@ -4498,17 +4651,51 @@ export class FacetManager {
         // sessions kept dying. The row is finally released by the supervisor's
         // terminal hook when the process ends. A re-drive owns its own process,
         // so the caller's pid goes with the instance that had it.
+        //
+        // Durability is a property of the RESERVATION, not the recipe: a resident
+        // that declares a port at spawn claims the durable contract the port's
+        // reservation declares — the owner's durable slot for a store and the
+        // row's port/owner for `ensureDurableAppOnPort`. A resident whose port is
+        // only learned at listen() gets the same journal+capability durability at
+        // registration (see `registerPort`), but keeps its ephemeral facet name —
+        // the store cannot be re-rooted under a running facet.
+        let durableFacetName;
+        let durablePort;
+        let durableOwner;
+        if (opts.port !== undefined && opts.port > 0 && opts.port < 65536) {
+            const reservation = await readPortReservation(this.ctx, opts.port);
+            if (reservation !== null && reservation.owner !== null) {
+                durableOwner = reservation.owner;
+                durablePort = opts.port;
+                durableFacetName = await acquireDurableFacetSlot(this.ctx, durableOwner);
+            }
+        }
         const record = {
             pid: entry.pid,
             command,
-            code,
-            opts: { ...opts, skipSpawn: undefined, callerPid: undefined },
             attempt,
             phase: 'starting',
+            recipe: { kind: 'node', code, opts: { ...opts, skipSpawn: undefined, callerPid: undefined } },
+            ...(durablePort !== undefined ? { port: durablePort, owner: durableOwner } : {}),
         };
-        await this.launchJournal.journal(record);
         try {
-            await this._residentLaunchBody(entry, code, command, cwd, opts, pacer);
+            await this.launchJournal.journal(record);
+        }
+        catch (e) {
+            // A resident that cannot be journalled does not start; the failure is
+            // reported the way a boot failure is.
+            pacer.settle();
+            this.processes.exit(entry.pid, 1);
+            const reason = 'long-running node launch failed: ' + errorMessage(e);
+            this._w5RecordTermination(entry.pid, 1, 'facet', reason);
+            try {
+                this.hooks.onExternalExit?.(entry.pid, 1, reason);
+            }
+            catch { }
+            throw e;
+        }
+        try {
+            await this._residentLaunchBody(entry, code, command, cwd, opts, pacer, durableFacetName);
         }
         catch (e) {
             await this.launchJournal.release(entry.pid);
@@ -4525,14 +4712,9 @@ export class FacetManager {
             await this.launchJournal.journal({ ...record, attempt: 0, phase: 'running' });
         }
     }
-    async _residentLaunchBody(entry, code, command, cwd, opts, pacer) {
+    async _residentLaunchBody(entry, code, command, cwd, opts, pacer, durableFacetName) {
         if (this.vfs && !this.esbuild) {
-            try {
-                this.esbuild = new EsbuildService(this.vfs);
-            }
-            catch {
-                this.esbuild = null;
-            }
+            this.esbuild = new EsbuildService(this.vfs.as(CRED_KERNEL));
         }
         if (this.vfs)
             this.imageStore.ensureDir();
@@ -4540,7 +4722,7 @@ export class FacetManager {
         const __bundleStart = diagOn ? Date.now() : 0;
         const processVfs = this.vfs?.as(entry.cred);
         const vfsState = processVfs
-            ? await buildPrefetchBundle(processVfs, opts.filename, cwd, code, this.esbuild || undefined, opts.bundleProfile, undefined, pacer)
+            ? await buildPrefetchBundle(processVfs, opts.filename, cwd, code, this.esbuild || undefined, opts.bundleProfile, undefined, pacer, this.hooks.transformLargeEsm)
             : { bundle: {}, manifest: {}, metadata: {}, reachableCount: 0, truncated: false };
         const bundleMs = diagOn ? Date.now() - __bundleStart : 0;
         const processEnv = opts.attachedTty
@@ -4597,6 +4779,12 @@ export class FacetManager {
                 // life; the server/watch runner returns once it is up.
                 startContract: opts.attachedTty ? 'lifetime' : 'boot',
                 startArgs: { vfsCursor },
+                // A resident whose declared port is reserved binds the owner's
+                // durable slot — the same store a durable worker spawn takes — so the
+                // reservation's durability reaches this process's storage too.
+                ...(durableFacetName !== undefined
+                    ? { facet: { name: durableFacetName, durable: true } }
+                    : {}),
                 boot: {
                     kind: 'code',
                     code: {
@@ -4670,10 +4858,7 @@ export class FacetManager {
                 await handle.booted();
             }
             if (opts.port && opts.port > 0 && opts.port < 65536) {
-                // A new process on a port retires the previous occupant's preview
-                // capability, so a URL handed out for that one cannot reach this one.
-                await clearPortCapability({ ctx: this.ctx, portRegistry: this.portRegistry }, opts.port);
-                this.portRegistry.register(opts.port, entry.pid);
+                await this._registerResidentPort(entry.pid, opts.port);
             }
         }
         catch (e) {
@@ -4706,6 +4891,10 @@ export class FacetManager {
      * promise, so nothing polls the port to decide the process is up.
      */
     async spawnWorker(workerCode, command, cwd, opts = {}) {
+        return this._spawnWorker(workerCode, command, cwd, opts, 0);
+    }
+    /** `attempt` is the journal's re-drive budget, as `_spawnResident` carries it. */
+    async _spawnWorker(workerCode, command, cwd, opts, attempt) {
         this.processes.reap();
         const entry = this.processes.spawn(command, [], cwd);
         // Stamp the process-table entry so /api/processes exposes this as a
@@ -4717,35 +4906,130 @@ export class FacetManager {
             this.hooks.onSpawn?.(entry.pid, command, true);
         }
         catch { }
+        const compatibilityDate = opts.compatibilityDate ?? CF_COMPAT_DATE;
+        const compatibilityFlags = opts.compatibilityFlags || ['nodejs_compat'];
         let handle;
         let resourcesTracked = false;
+        let record;
+        let durableFacetName;
         try {
+            if (opts.durable) {
+                // A durable spawn on a declared port starts only when a reservation the
+                // owner already holds is persisted. Validated before the journal row is
+                // written and before the process boots, so a foreign or absent
+                // reservation refuses the launch rather than stealing the exposure.
+                if (opts.port && opts.port > 0 && opts.port < 65536) {
+                    const preFlight = await readPortReservation(this.ctx, opts.port);
+                    if (preFlight === null || preFlight.owner !== opts.durable.owner) {
+                        throw new Error('port reservation conflict: durable worker does not own port ' + opts.port);
+                    }
+                }
+                // A live outbound binding cannot be journalled — a reset would re-drive
+                // the recipe with nothing to stand in for it. Only the EMBEDDER's
+                // resolveWorkerLaunch can re-mint one: the session's fallback reads
+                // the image store, which never carries a binding, so a durable spawn
+                // carrying globalOutbound is refused where no embedder hook exists.
+                if (opts.globalOutbound !== undefined && opts.globalOutbound !== null
+                    && this.hooks.resolveWorkerLaunch === undefined) {
+                    throw new Error('Nimbus: a durable spawn carrying a live globalOutbound binding '
+                        + 'cannot be journalled without an embedder resolveWorkerLaunch hook');
+                }
+                // Self-owned applications persist their launch inputs as image blobs —
+                // a runner blob for worker.js, an application blob for modules + env —
+                // under .nimbus/images/<sha256>, and the journal row names the digests
+                // of what was written, never placeholder strings. An embedder-owned
+                // spawn is given digests by its own bookkeeping instead.
+                const image = opts.durable.image
+                    ?? await persistDurableWorkerImage(this._imageVfs(), workerCode, {
+                        modules: opts.modules ?? {},
+                        ...(opts.env !== undefined ? { env: opts.env } : {}),
+                        vfsWasmModules: opts.vfsWasmModules,
+                    });
+                // Journalled before the launch's first byte of work, so a row a
+                // later instance reads proves this process never ended.
+                record = {
+                    pid: entry.pid,
+                    command,
+                    attempt,
+                    phase: 'starting',
+                    recipe: {
+                        kind: 'worker',
+                        owner: opts.durable.owner,
+                        image,
+                        port: opts.port ?? 0,
+                        cwd,
+                        compatibilityDate,
+                        compatibilityFlags,
+                        startArgs: opts.startArgs,
+                    },
+                    // The row-level fields `ensureDurableAppOnPort` reads — same values
+                    // the recipe carries, stamped so port/owner lookup never depends on
+                    // the recipe's kind.
+                    ...(opts.port !== undefined && opts.port > 0
+                        ? { port: opts.port, owner: opts.durable.owner }
+                        : {}),
+                };
+                // The durable facet name is claimed once, ever, from DO storage — a
+                // re-drive after a reset, an eviction's re-attach and a relaunch all
+                // land on the same `app-slot-<n>`, which is the only thing that keeps
+                // the retained SQLite bound to this application.
+                durableFacetName = await acquireDurableFacetSlot(this.ctx, opts.durable.owner);
+                await this.launchJournal.journal(record);
+            }
             handle = await this._startResidentProcess(entry.pid, {
                 // These runners answer startProcess with a boot payload (listening
                 // port, or a completed non-server run) and stay resident after it.
                 startContract: 'boot',
                 startArgs: opts.startArgs,
+                ...(durableFacetName !== undefined
+                    ? { facet: { name: durableFacetName, durable: true } }
+                    : {}),
                 boot: {
                     kind: 'code',
                     code: {
-                        compatibilityDate: CF_COMPAT_DATE,
-                        compatibilityFlags: opts.compatibilityFlags || ['nodejs_compat'],
+                        compatibilityDate,
+                        compatibilityFlags,
                         mainModule: 'worker.js',
                         modules: { 'worker.js': workerCode, ...(opts.modules || {}) },
                         vfsWasmModules: opts.vfsWasmModules,
+                        ...(opts.env !== undefined ? { env: opts.env } : {}),
+                        ...(opts.globalOutbound !== undefined ? { globalOutbound: opts.globalOutbound } : {}),
                     },
                 },
             });
             this.trackProcessRpcResources(entry.pid, [handle]);
             resourcesTracked = true;
             this.portRegistry.bindFacetStub(entry.pid, handle.routeTarget);
+            const boot = await handle.booted();
+            if (opts.durable && this.launchJournal.has(entry.pid) && record) {
+                // Booted and running: the launch proved itself, so the resident
+                // starts its running life with a fresh re-drive budget.
+                await this.launchJournal.journal({ ...record, attempt: 0, phase: 'running' });
+            }
             if (opts.port && opts.port > 0 && opts.port < 65536) {
-                // A new process on a port retires the previous occupant's preview
-                // capability, so a URL handed out for that one cannot reach this one.
-                await clearPortCapability({ ctx: this.ctx, portRegistry: this.portRegistry }, opts.port);
-                this.portRegistry.register(opts.port, entry.pid);
+                if (opts.durable) {
+                    // Re-read after the boot: a release or reassignment during it wins.
+                    // The durable launch registers only under a reservation it still
+                    // owns; it never clears or takes a foreign exposure.
+                    const reservation = await readPortReservation(this.ctx, opts.port);
+                    if (reservation === null || reservation.owner !== opts.durable.owner) {
+                        throw new Error('port reservation conflict: durable worker does not own port ' + opts.port);
+                    }
+                    // The owner's hold on the port survives the instance reset that
+                    // re-drove this launch, and preview URLs minted against it stay
+                    // valid: the durable capability is re-adopted through the
+                    // reservation's own path, gated on the stored owner.
+                    this.portRegistry.register(opts.port, entry.pid);
+                    await restoreReservedPortCapability({ ctx: this.ctx, portRegistry: this.portRegistry }, opts.port, opts.durable.owner);
+                }
+                else {
+                    // A new process on a port retires the previous occupant's preview
+                    // capability, so a URL handed out for that one cannot reach this one.
+                    await clearPortCapability({ ctx: this.ctx, portRegistry: this.portRegistry }, opts.port);
+                    this.portRegistry.register(opts.port, entry.pid);
+                }
             }
-            return { pid: entry.pid, boot: await handle.booted() };
+            return { pid: entry.pid, boot };
         }
         catch (e) {
             this.portRegistry.unregisterByPid(entry.pid);
@@ -4763,10 +5047,44 @@ export class FacetManager {
             throw e;
         }
     }
+    /**
+     * A resident process announcing it bound `port`. When the port is reserved,
+     * the reservation's owner is stamped onto this pid's journal row — the
+     * reservation is what declares which application the port serves, and a
+     * resident that binds it inherits the whole durable contract: the row names
+     * the port `ensureDurableAppOnPort` looks up, the minted capability is
+     * re-adopted rather than retired, and `removeDurableApp` can find the launch
+     * by owner.
+     *
+     * A pid with no journal row — a process outside the resident lifecycle —
+     * registering on a reserved port takes it as today: the stored capability
+     * is retired and a fresh one is minted, the reservation stays with the
+     * owner. An accidental port reuse inside one session therefore cannot
+     * inherit the public capability; same-session processes are one trust
+     * domain, so this is hygiene, not a security boundary.
+     */
+    async _registerResidentPort(pid, port) {
+        const reservation = await readPortReservation(this.ctx, port);
+        const rowKey = `${FENCED_WORK_KEY_PREFIX}${pid}`;
+        const rows = await this.launchJournal.rows();
+        const row = rows.get(rowKey);
+        if (reservation !== null && reservation.owner !== null && row !== undefined) {
+            if (row.port !== port || residentOwner(row) !== reservation.owner) {
+                await this.launchJournal.journal({ ...row, port, owner: reservation.owner });
+            }
+            this.portRegistry.register(port, pid);
+            await restoreReservedPortCapability({ ctx: this.ctx, portRegistry: this.portRegistry }, port, reservation.owner);
+            return;
+        }
+        // A new process on an unreserved port — or one the journal does not know —
+        // retires the previous occupant's preview capability, so a URL handed out
+        // for that one cannot reach this one.
+        await clearPortCapability({ ctx: this.ctx, portRegistry: this.portRegistry }, port);
+        this.portRegistry.register(port, pid);
+    }
     async registerPort(pid, port) {
         if (port > 0 && port < 65536) {
-            await clearPortCapability({ ctx: this.ctx, portRegistry: this.portRegistry }, port);
-            this.portRegistry.register(port, pid);
+            await this._registerResidentPort(pid, port);
         }
     }
     waitForRouteablePorts(pid, timeoutMs = ROUTEABLE_PORT_ATTACH_TIMEOUT_MS) {
@@ -4804,5 +5122,149 @@ export class FacetManager {
         this._teardownPairedServeFacet(pid);
         return result;
     }
+    /**
+     * Remove a durable application: the ONLY path that deletes durable facet
+     * storage. Owner-checked by construction — `freeDurableFacetSlot` answers
+     * only a slot the owner actually holds, and the reservation release refuses
+     * a foreign owner's record — so another owner's name cannot be reached.
+     *
+     * One ordered teardown: the live process is killed first (a released
+     * durable facet only aborts, so nothing else ends it), the port reservation
+     * is released, the journal rows for the owner are purged (nothing is owed a
+     * removed application), the facet's SQLite is deleted, and the slot row is
+     * freed last — so a crash mid-removal leaves a name still claimed rather
+     * than a store nobody can re-drive.
+     */
+    async removeDurableApp(owner) {
+        // Kill any live process this owner still has — a durable release aborts
+        // without deleting, so the store outlives the process unless removal
+        // ends it here.
+        const journalRows = await this.ctx.storage.list({ prefix: 'resident-launch:' });
+        const ownedPids = [];
+        const ownedPorts = new Set();
+        for (const [, record] of journalRows) {
+            // Owner-stamped rows cover every kind the reservation claims — a node
+            // resident that bound the port is as much the application as a durable
+            // worker spawn is.
+            if (residentOwner(record) !== owner)
+                continue;
+            ownedPids.push(record.pid);
+            const rowPort = record.port ?? (record.recipe.kind === 'worker' ? record.recipe.port : 0);
+            if (rowPort > 0)
+                ownedPorts.add(rowPort);
+        }
+        for (const pid of ownedPids)
+            this.kill(pid);
+        // The reservation may outlive every journal row (spawn never finished
+        // writing one), so scan the port records for the owner too.
+        const portRows = await this.ctx.storage.list({ prefix: PORT_CAPABILITY_KEY_PREFIX });
+        for (const [key, record] of portRows) {
+            if (record?.owner === owner)
+                ownedPorts.add(Number(key.slice(PORT_CAPABILITY_KEY_PREFIX.length)));
+            // A public capability leaves the routing directory with the row —
+            // before the reservation is released so a mid-removal crash leaves a
+            // dead URL rather than a dangling route to this session.
+            if (record?.owner === owner && record.visibility === 'public' && typeof record.capability === 'string') {
+                await unbindPublicPortCapability(this._publicDirectoryHost(), record.capability);
+            }
+        }
+        for (const port of ownedPorts) {
+            await releasePortReservation(this.ctx, { owner, port });
+            this.portRegistry.unregister(port);
+        }
+        const purged = await this.launchJournal.purgeWhere((record) => residentOwner(record) === owner);
+        const name = await freeDurableFacetSlot(this.ctx, owner);
+        if (name !== null) {
+            try {
+                deleteFacetStorage(this.ctx, name);
+            }
+            catch { /* already gone */ }
+        }
+        return name !== null || purged > 0 || ownedPorts.size > 0;
+    }
+    /** The session-shaped view the public-directory helpers read env from. */
+    _publicDirectoryHost() {
+        return { env: this.env.rawEnv, ctx: this.ctx };
+    }
+    /**
+     * Whether a request addressed to `port` can reach a durable application —
+     * and, when the application is journaled but dead, drive its re-drive and
+     * wait for the boot, bounded.
+     *
+     * The port request is the one surface a reset leaves dark: the alarm pump
+     * re-drives journaled launches eventually, but a URL a user is holding
+     * cannot wait for an alarm that may never fire. 'started' means a live
+     * process owns the port now; 'absent' means nothing durable claims it
+     * (the caller answers 502 as it always has); 'failed' means a re-drive
+     * ran and lost, or outlived its bound — the caller answers 503 and lets
+     * the page re-ask.
+     *
+     * Single-flight per port: parallel requests on a woken page share one
+     * ensure, which shares the journal's per-row drive with recovery — a
+     * request that lands mid-recovery waits on that boot, it never boots a
+     * second process.
+     */
+    ensureDurableAppOnPort(port) {
+        let inflight = this.ensureInflight.get(port);
+        if (inflight === undefined) {
+            inflight = this._ensureDurableAppOnPort(port);
+            this.ensureInflight.set(port, inflight);
+            inflight.finally(() => {
+                if (this.ensureInflight.get(port) === inflight)
+                    this.ensureInflight.delete(port);
+            });
+        }
+        return inflight;
+    }
+    async _ensureDurableAppOnPort(port) {
+        if (this.portRegistry.has(port))
+            return 'started';
+        // The reservation says the port means something to someone; the journal
+        // row is what makes it a launch this instance owes. A reservation with
+        // no row (the spawn died before journalling, or the app was removed and
+        // the release already ran) answers absent — nothing here can bring back
+        // an application with no recipe.
+        const reservation = await readPortReservation(this.ctx, port);
+        if (reservation === null || reservation.owner === null)
+            return 'absent';
+        const rows = await this.launchJournal.rows();
+        // The reservation names the owner; the row's stamped port names which
+        // resident serves it — kind-agnostic, so a node resident that bound the
+        // port re-drives the same way a durable worker launch does.
+        const entry = [...rows].find(([, record]) => record.port === port && residentOwner(record) === reservation.owner);
+        if (entry === undefined)
+            return 'absent';
+        const [rowKey, record] = entry;
+        if (record.pid > this.processes.pidBase) {
+            // This instance's own row: the launch is already building — waiting
+            // for its port registration is the entire ask, and driving the row
+            // again would boot a second copy.
+            return (await this._waitForPort(port, DURABLE_ENSURE_BOOT_BUDGET_MS))
+                ? 'started' : 'failed';
+        }
+        const { promise: boundHit, resolve: markBound } = withResolvers();
+        setTimeout(() => markBound(true), DURABLE_ENSURE_BOOT_BUDGET_MS);
+        const failed = await Promise.race([
+            this.launchJournal.drive(rowKey, record),
+            boundHit,
+        ]);
+        if (failed)
+            return 'failed';
+        // A settled drive either owns the port or deliberately answered 'gone':
+        // a resolver's null superseded the row, which is absent, not failed.
+        return this.portRegistry.has(port) ? 'started' : 'absent';
+    }
+    /** Poll for a port registration the in-flight launch has not made yet. */
+    async _waitForPort(port, budgetMs) {
+        const deadline = Date.now() + budgetMs;
+        while (Date.now() < deadline) {
+            if (this.portRegistry.has(port))
+                return true;
+            const { promise: tick, resolve: tickDone } = withResolvers();
+            setTimeout(tickDone, 50);
+            await tick;
+        }
+        return this.portRegistry.has(port);
+    }
     get stats() { return this.processes.stats; }
 }