@nimbus-sh/worker 0.4.0 → 0.6.0

package/dist/facets/manager.js

@@ -22,22 +22,29 @@ import { FACET_RESIDENT_STORE_SOURCE } from '../vfs/facet-resident-store.js';
 import { VFS_CURSOR_SEED_SOURCE, serializeFacetVfsCursor, } from '@nimbus-sh/core/_shared/facet-vfs-cursor.js';
 import { VFS_WRITE_LEDGER_SOURCE } from '@nimbus-sh/core/_shared/vfs-write-ledger.js';
 import { vfsPathExtension } from '@nimbus-sh/core/vfs/path.js';
-import { clearPortCapability } from '../session/port-capability.js';
+import { clearPortCapability, listPortReservations, readPortReservation, readPortReservationByOwner, releasePortReservation, restoreReservedPortCapability, } from '../session/port-capability.js';
+import { deriveResidentOwner } from './resident-identity.js';
+import { z } from 'zod/v4';
+import { RESIDENT_OWNER_KEY_PREFIX, DURABLE_IMAGES_KEY_PREFIX } from '../session/keys.js';
+import { PORT_CAPABILITY_KEY_PREFIX } from '../session/keys.js';
+import { unbindPublicPortCapability } from '../router/public-directory.js';
 import { prefetchForRequire } from '@nimbus-sh/core/runtime/require-resolver.js';
 import { hasTopLevelModuleSyntax } from '@nimbus-sh/core/runtime/javascript-ast.js';
 import { bindImportMetaResolve, importMetaDefines } from '@nimbus-sh/core/runtime/import-meta-transform.js';
 import { recordFailure, getLastRpcFrame, getLastFacetId } from '@nimbus-sh/platform/oom-discriminator.js';
 import { classifyError } from '@nimbus-sh/platform/oom-classify.js';
-import { TurnBudget, PacedWork, turnChunkMaxBytes } from '@nimbus-sh/fabric/turn-budget.js';
+import { TurnBudget, PacedWork, turnChunkMaxBytes, withResolvers } from '@nimbus-sh/fabric/turn-budget.js';
 import { onColdStart } from '@nimbus-sh/fabric/generation.js';
-import { FencedWork, } from '@nimbus-sh/fabric/fenced-work.js';
-import { EsbuildService } from '@nimbus-sh/core/runtime/esbuild-service.js';
+import { FencedWork, FENCED_WORK_KEY_PREFIX, } from '@nimbus-sh/fabric/fenced-work.js';
+import { EsbuildService, rewriteBundledEsmToCjs, } from '@nimbus-sh/core/runtime/esbuild-service.js';
 import { isExecDiagEnabled, recordExecTelemetry } from './exec-telemetry.js';
 import { disposeRpcResource, disposeRpcResources } from '@nimbus-sh/platform/rpc-dispose.js';
 import { sqliteWasmModuleEntry } from './opencode-staging.js';
 import { ImageStore, } from '@nimbus-sh/fabric/image-store.js';
 import { ProcessFabric, } from '@nimbus-sh/fabric/process-fabric.js';
-import { createLoadedWorkerEntrypoint, getNimbusCtxExports, } from '@nimbus-sh/fabric/workerd-facet-host.js';
+import { createLoadedWorkerEntrypoint, getNimbusCtxExports, deleteFacetStorage, } from '@nimbus-sh/fabric/workerd-facet-host.js';
+import { acquireDurableFacetSlot, freeDurableFacetSlot, } from './durable-slots.js';
+import { persistDurableWorkerImage, purgeDurableWorkerImages, } from './durable-images.js';
 import { SQLITE_WASM_MODULE_NAME, } from '../runtime/opencode-facet-runner.js';
 import { parsePortFromArgv, resolveLongRunningPort } from '@nimbus-sh/core/runtime/long-running-handle.js';
 import { DEFAULT_FACET_BUNDLE_PROFILE, } from '@nimbus-sh/core/runtime/bundle-profile.js';
@@ -46,6 +53,7 @@ import { MAX_RPC_SAFE_PAYLOAD_BYTES } from '@nimbus-sh/platform/limits.js';
 import { CRED_KERNEL } from '@nimbus-sh/core/runtime/os-contracts.js';
 import { acquireSupervisorAllocation } from '@nimbus-sh/platform/heavy-alloc-coord.js';
 import { prefetchBundleStart, prefetchBundleEnd, setPrefetchCacheBytes, } from '@nimbus-sh/platform/diag-counters.js';
+const ISOLATED_ESM_TRANSFORM_MIN_BYTES = 512 * 1024;
 /**
  * Detect & restore a Uint8Array that's been JSON-mangled to a
  * {"0":n,"1":n,...} object during the result-envelope round-trip.
@@ -120,6 +128,7 @@ function parseFacetManagerEnv(env) {
         LOADER: loader,
         ASSETS: assets,
         NIMBUS_LAUNCH_CHUNK_BYTES: typeof chunkBytes === 'string' ? chunkBytes : undefined,
+        rawEnv: env,
     };
 }
 /**
@@ -408,11 +417,11 @@ function __mkCompiledFn(code) {
     code = __nl >= 0 ? code.slice(__nl + 1) : "";
   }
   function renameIfDeclared(name) {
-    const re = new RegExp("(?:^|\\\\n|;)\\\\s*(?:const|let|var|function|class)\\\\s+" + name + "\\\\b", "m");
+    const re = new RegExp("(?:^|\\\\n|;)\\\\s*(?:const|let|var|function|class)\\\\s+" + name + "(?![$\\\\w])", "m");
     return re.test(code) ? name + "__nimbus_unused" : name;
   }
   const baseParams = [
-    "exports", "require", "module",
+    "exports", renameIfDeclared("require"), "module",
     renameIfDeclared("__filename"),
     renameIfDeclared("__dirname"),
   ];
@@ -433,23 +442,10 @@ const __MODULE_VFS_MANIFEST = ${safeManifest};
 const __MODULE_VFS_METADATA = ${safeMetadata};
 const __compiledModules = new Map();
 const __compileFailures = new Map();
-for (const [__p, __c] of Object.entries(__MODULE_VFS_BUNDLE)) {
-  // Precompile JS modules AND extensionless CJS entries (bin scripts and
-  // shims). workerd forbids new Function at request time, so anything not
-  // precompiled here surfaces the misleading "file was not pre-bundled".
-  // .json is data; skip it (it loads via JSON.parse, not as a function).
-  const __base = __p.slice(__p.lastIndexOf("/") + 1);
-  const __dot = __base.lastIndexOf(".");
-  const __ext = __dot > 0 ? __base.slice(__dot) : "";
-  if (__ext === ".js" || __ext === ".mjs" || __ext === ".cjs" || __ext === "") {
-    if (typeof __c !== "string") continue;
-    try {
-      __compiledModules.set(__p, __mkCompiledFn(__c));
-    } catch (__e) {
-      __compileFailures.set(__p, __e && __e.message ? __e.message : String(__e));
-    }
-  }
-}
+// Precompile JS modules AND extensionless CJS entries (bin scripts and
+// shims). workerd forbids new Function at request time, so anything not
+// precompiled here surfaces the misleading "file was not pre-bundled".
+${BUNDLE_PRECOMPILE_LOOP}
 
 class __ProcessExit extends Error {
   constructor(code) { super("process.exit(" + code + ")"); this.code = code; }
@@ -687,11 +683,11 @@ const __NimbusHostResponse = globalThis.Response;
 
 function __mkCompiledFn(code) {
   function renameIfDeclared(name) {
-    const re = new RegExp("(?:^|\\\\n|;)\\\\s*(?:const|let|var|function|class)\\\\s+" + name + "\\\\b", "m");
+    const re = new RegExp("(?:^|\\\\n|;)\\\\s*(?:const|let|var|function|class)\\\\s+" + name + "(?![$\\\\w])", "m");
     return re.test(code) ? name + "__nimbus_unused" : name;
   }
   const baseParams = [
-    "exports", "require", "module",
+    "exports", renameIfDeclared("require"), "module",
     renameIfDeclared("__filename"),
     renameIfDeclared("__dirname"),
   ];
@@ -719,15 +715,7 @@ const __compileFailures = new Map();
 // \`new Function\` throws "Code generation from strings disallowed" in the DO
 // constructor and at request time — so the require closure must be compiled
 // here, off the module map. That is why code cannot come from the store.
-for (const [__p, __c] of Object.entries(__MODULE_VFS_BUNDLE)) {
-  if (__p.endsWith(".js") || __p.endsWith(".mjs") || __p.endsWith(".cjs")) {
-    try {
-      __compiledModules.set(__p, __mkCompiledFn(__c));
-    } catch (__e) {
-      __compileFailures.set(__p, __e && __e.message ? __e.message : String(__e));
-    }
-  }
-}
+${BUNDLE_PRECOMPILE_LOOP}
 
 ${FACET_RESIDENT_STORE_SOURCE}
 
@@ -1342,8 +1330,10 @@ export function encodedBundleSize(bundle, manifest) {
 function describeBundleCells(cells, limit = 8) {
     const shown = [...cells].sort((a, b) => b[1] - a[1]).slice(0, limit);
     const rest = cells.length - shown.length;
-    return shown.map(([path, bytes]) => `${path} (${bytes} bytes)`).join(', ')
-        + (rest > 0 ? `, +${rest} more` : '');
+    return shown.map(([path, bytes]) => {
+        const source = compiledCellPath(path);
+        return source === null ? `${path} (${bytes} bytes)` : `${source} [compiled] (${bytes} bytes)`;
+    }).join(', ') + (rest > 0 ? `, +${rest} more` : '');
 }
 /**
  * hardening-r5: emit a JS expression that revives binary cells from base64
@@ -1729,7 +1719,7 @@ function buildManifest(vfs, cwd, scriptPath) {
     return manifest;
 }
 function buildVfsMetadata(vfs, manifest, bundle) {
-    const paths = new Set(Object.keys(bundle));
+    const paths = new Set(Object.keys(bundle).filter((path) => compiledCellPath(path) === null));
     for (const [directory, children] of Object.entries(manifest)) {
         paths.add(directory);
         for (const child of children) {
@@ -1803,6 +1793,16 @@ export function greedyAddMainEntries(vfs, cwd, bundle, budgetState) {
         try {
             if (!vfs.exists(stripped) || vfs.isDirectory(stripped))
                 return false;
+            // This is a guess at what a program might require, and the same
+            // per-file ceiling the entry-package walk applies bounds it: a
+            // multi-MiB main entry is an alternative bundle (typescript's 8.69 MiB
+            // `lib/typescript.js` beside the `lib/tsc.js` that actually runs), and
+            // one guess must not spend a third of the budget — and a third of the
+            // supervisor's headroom — on every invocation that never reads it.
+            // Anything the program really requires arrives through the closure,
+            // which is uncapped.
+            if (vfs.lstat(stripped).size > BIN_PACKAGE_SPECULATIVE_MAX_FILE_BYTES)
+                return false;
             // hardening-r5: preserve binary content as Uint8Array.
             const content = _readBundleCell(vfs, stripped);
             const cellLen = _bundleCellLength(content);
@@ -2530,18 +2530,22 @@ const RUNTIME_PACKAGE_EXCLUDED_FILE_SUFFIXES = [
     '.webm',
 ];
 /**
- * Per-file ceiling for the speculative entry-package walk.
+ * Per-file ceiling for the speculative passes over installed packages: the
+ * entry-package walk (`addBinTargetSiblings`) and the main-entry oversample
+ * (`greedyAddMainEntries`).
  *
  * Everything the entry package needs in order to *run* arrives through the
- * require closure, which is uncapped and never evicted. This walk exists only
- * to catch data files the static walker cannot see, and data files are small.
- * Multi-MiB cells in a package tree are overwhelmingly alternative bundles —
- * typescript ships an 8.69 MiB `lib/typescript.js` that is never read — rather
- * than data.
+ * require closure, which is uncapped and never evicted. These passes exist
+ * only to catch what the static walker cannot see — data files, and modules
+ * reached by a computed require — and those are small. Multi-MiB cells in a
+ * package tree are overwhelmingly alternative bundles — typescript ships an
+ * 8.69 MiB `lib/typescript.js` that `tsc` never reads — rather than data.
  *
  * So one speculative guess must not spend the budget every later invocation
  * then carries: the same reasoning as `CWD_SNAPSHOT_MAX_FILE_BYTES`, applied
- * to the package tree.
+ * to the package tree. A miss this causes is loud and self-repairing: the
+ * facet reports the unstaged read and the next build stages it from the
+ * residency ledger, which has no per-file rule.
  */
 const BIN_PACKAGE_SPECULATIVE_MAX_FILE_BYTES = 4 * 1024 * 1024;
 function shouldIncludeBinPackageFile(pkgRoot, path, bundleProfile) {
@@ -2771,15 +2775,20 @@ function __cacheKey(src) {
  */
 function _markBundleEsmAsFailed(bundle, reason) {
     for (const path of Object.keys(bundle)) {
+        if (compiledCellPath(path) !== null)
+            continue;
         if (!isBundleModuleCandidate(path))
             continue;
         const src = bundle[path];
         if (typeof src !== 'string')
             continue;
-        if (!looksLikeEsm(src))
+        // A TypeScript source is never runnable as staged, so it always needs
+        // the emit it cannot get; a JavaScript file only if it is ESM.
+        const typescript = bundleTypescriptLoader(path) !== null;
+        if (!typescript && !looksLikeEsm(src))
             continue;
         const escapedReason = JSON.stringify(`esbuild transform failed for ${path}: ${reason}`);
-        bundle[path] =
+        bundle[typescript ? compiledCellKey(path) : path] =
             '// framework-fixes-F4 diagnostic shim — esbuild rejected the ESM transform\n' +
                 '(function () { throw new Error(' + escapedReason + '); })();\n';
     }
@@ -2810,13 +2819,89 @@ export function isBundleModuleCandidate(path) {
  * EXTENSION, where `.js` files transform on their content — `looksLikeEsm` is
  * the right question for a file that is already valid JS either way, and the
  * wrong one for a file that is never valid JS.
+ *
+ * A declaration file (`.d.ts`, `.d.mts`, `.d.cts`) is not a source: it has
+ * no runtime form, nothing `require()`s one, and esbuild's output for it is
+ * empty by definition. It is DATA — read by the program that ships it, which
+ * is exactly typescript: `tsc` reads its own `lib/lib.*.d.ts` with
+ * `readFileSync`, and every declaration it type-checks against comes from
+ * those bytes. Transforming them handed the compiler an 811-byte license
+ * comment where `lib.es5.d.ts` (217 KB) had been, and every global type was
+ * gone. So a declaration file is left exactly as it was staged.
  */
 export function bundleTypescriptLoader(path) {
+    if (isTypescriptDeclarationFile(path))
+        return null;
     const ext = vfsPathExtension(path);
     if (ext === '.tsx')
         return 'tsx';
     return ext === '.ts' || ext === '.mts' || ext === '.cts' ? 'ts' : null;
 }
+/** `name.d.ts` / `name.d.mts` / `name.d.cts`, by TypeScript's own rule. */
+export function isTypescriptDeclarationFile(path) {
+    const base = path.slice(path.lastIndexOf('/') + 1);
+    return /\.d\.[mc]?ts$/.test(base);
+}
+/**
+ * Where a bundle carries the EXECUTABLE form of a cell whose staged bytes are
+ * not JavaScript — a TypeScript source.
+ *
+ * A bundle cell is two things to the facet: what `readFileSync` returns for
+ * the path, and what the startup pre-compile loop turns into the function
+ * `require` runs. For a JavaScript file those are the same bytes, so the
+ * ESM→CJS pass rewrites the cell in place and both readers see JavaScript.
+ * For a TypeScript source they are NOT the same: the bytes a program reads
+ * are the source (tsc compiling its project, a test runner, a linter), and
+ * the bytes `require` needs are esbuild's emit. Rewriting the cell in place
+ * handed tsc esbuild's CommonJS rendering of its own `src/index.ts` — it
+ * compiled that, and reported errors on lines the file never had.
+ *
+ * So the source cell stays exactly as staged, and the compiled form travels
+ * under this key: a NUL-framed prefix no filesystem path can contain, in the
+ * same map, so it is sized, split, cached, released and shipped by every
+ * mechanism the bundle already has. The facet's pre-compile loop takes these
+ * cells OFF the map as it compiles them, keyed by the real path, before any
+ * read can see them.
+ */
+const COMPILED_CELL_KEY_PREFIX = '\0compiled\0';
+export function compiledCellKey(path) {
+    return COMPILED_CELL_KEY_PREFIX + path;
+}
+/** The source path a compiled-cell key stands for, or null for a plain path. */
+export function compiledCellPath(key) {
+    return key.startsWith(COMPILED_CELL_KEY_PREFIX) ? key.slice(COMPILED_CELL_KEY_PREFIX.length) : null;
+}
+/**
+ * The pre-compile loop both generated facets run at module evaluation, the
+ * only moment workerd lets a string become code. One definition so the two
+ * facets cannot drift on what they compile: every JavaScript-shaped cell
+ * (`.js`, `.mjs`, `.cjs` and the extensionless bin scripts) from its own
+ * bytes, and every TypeScript source from its compiled cell — which is
+ * removed from the bundle here, so a `readFileSync` of the source path
+ * returns the source and a directory listing never shows the key.
+ */
+export const BUNDLE_PRECOMPILE_LOOP = `
+const __NIMBUS_COMPILED_PREFIX = ${JSON.stringify(COMPILED_CELL_KEY_PREFIX)};
+for (const [__p, __c] of Object.entries(__MODULE_VFS_BUNDLE)) {
+  let __modulePath = __p;
+  if (__p.startsWith(__NIMBUS_COMPILED_PREFIX)) {
+    __modulePath = __p.slice(__NIMBUS_COMPILED_PREFIX.length);
+    delete __MODULE_VFS_BUNDLE[__p];
+  } else {
+    // .json is data; skip it (it loads via JSON.parse, not as a function).
+    const __base = __p.slice(__p.lastIndexOf("/") + 1);
+    const __dot = __base.lastIndexOf(".");
+    const __ext = __dot > 0 ? __base.slice(__dot) : "";
+    if (__ext !== ".js" && __ext !== ".mjs" && __ext !== ".cjs" && __ext !== "") continue;
+  }
+  if (typeof __c !== "string") continue;
+  try {
+    __compiledModules.set(__modulePath, __mkCompiledFn(__c));
+  } catch (__e) {
+    __compileFailures.set(__modulePath, __e && __e.message ? __e.message : String(__e));
+  }
+}
+`;
 /**
  * Transform every ESM-shaped file in the bundle to CJS via esbuild.
  * Mutates `bundle` in place. Errors are swallowed (the file is left as
@@ -2826,14 +2911,19 @@ export function bundleTypescriptLoader(path) {
  * Candidate set is `isBundleModuleCandidate`; within it, files with no
  * top-level import/export are already CJS-shaped and left alone.
  *
+ * A JavaScript cell is rewritten in place. A TypeScript source keeps its
+ * bytes and gets a compiled cell beside it — see `compiledCellKey`.
+ *
  * Returns the count of files transformed (for diagnostics).
  */
-async function transformEsmInBundle(bundle, esbuild, pacer) {
+async function transformEsmInBundle(bundle, esbuild, pacer, isolatedTransform) {
     let transformed = 0;
     let failed = 0;
     // Snapshot the keys first — esbuild calls await; never iterate-and-mutate.
     const candidates = [];
     for (const path of Object.keys(bundle)) {
+        if (compiledCellPath(path) !== null)
+            continue;
         if (!isBundleModuleCandidate(path))
             continue;
         const src = bundle[path];
@@ -2841,14 +2931,19 @@ async function transformEsmInBundle(bundle, esbuild, pacer) {
         // esbuild.transform expect strings.
         if (typeof src !== 'string')
             continue;
-        if (bundleTypescriptLoader(path) === null && !looksLikeEsm(src))
-            continue;
+        if (bundleTypescriptLoader(path) === null) {
+            const esm = looksLikeEsm(src);
+            if (!esm)
+                continue;
+        }
         candidates.push(path);
     }
     for (const path of candidates) {
         const src = bundle[path];
         if (typeof src !== 'string')
             continue;
+        // A TypeScript source keeps its bytes; its emit lands beside it.
+        const target = bundleTypescriptLoader(path) === null ? path : compiledCellKey(path);
         // esbuild-wasm runs inside this isolate, so a transform is computation
         // like any other pass — the await above it yields nothing on its own.
         if (pacer)
@@ -2871,19 +2966,25 @@ async function transformEsmInBundle(bundle, esbuild, pacer) {
         const key = __cacheKey(src + '\0' + absUrl);
         const cached = __esmTransformCache.get(key);
         if (cached) {
-            bundle[path] = cached;
+            bundle[target] = cached;
             transformed++;
             continue;
         }
         try {
-            const t = await esbuild.transform(src, {
+            const transformOptions = {
                 loader: bundleTypescriptLoader(path) ?? 'js',
                 format: 'cjs',
                 target: 'esnext',
                 define: importMetaDefines(absUrl),
-            });
+            };
+            const bounded = transformOptions.loader === 'js' && src.length >= ISOLATED_ESM_TRANSFORM_MIN_BYTES
+                ? rewriteBundledEsmToCjs(src, absUrl)
+                : null;
+            const t = bounded ?? (isolatedTransform && src.length >= ISOLATED_ESM_TRANSFORM_MIN_BYTES
+                ? await isolatedTransform(src, transformOptions)
+                : await esbuild.transform(src, transformOptions));
             const code = bindImportMetaResolve(t.code, absUrl);
-            bundle[path] = code;
+            bundle[target] = code;
             __esmTransformCache.set(key, code);
             transformed++;
         }
@@ -2905,7 +3006,6 @@ async function transformEsmInBundle(bundle, esbuild, pacer) {
             // __compiledModules, and the failure surfaces at require time
             // with FULL diagnostic context. Net effect for users: the same
             // upstream tool still fails, but they now see WHY.
-            //
             // Probe: tests/behavioral/npm-create/new/create-astro-diagnostic.mjs
             // asserts the user-visible error contains "esbuild transform" so
             // future diagnostic regressions are caught.
@@ -2916,7 +3016,7 @@ async function transformEsmInBundle(bundle, esbuild, pacer) {
             // this so repeated submits don't re-run the same transform.
             const diagnosticSrc = '// framework-fixes-F4 diagnostic shim — esbuild rejected the ESM transform\n' +
                 '(function () { throw new Error(' + escapedReason + '); })();\n';
-            bundle[path] = diagnosticSrc;
+            bundle[target] = diagnosticSrc;
             __esmTransformCache.set(key, diagnosticSrc);
             failed++;
         }
@@ -2939,7 +3039,7 @@ async function transformEsmInBundle(bundle, esbuild, pacer) {
  * behaviour for code paths that don't have esbuild handy).
  *
  */
-export async function buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bundleProfile = DEFAULT_FACET_BUNDLE_PROFILE, observedReads, pacer) {
+export async function buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bundleProfile = DEFAULT_FACET_BUNDLE_PROFILE, observedReads, pacer, isolatedTransform) {
     // This build accumulates raw VFS contents in the supervisor heap, and did it
     // with nothing watching: the estimator read 9.4 MiB while these bytes were
     // resetting the DO three times. Take the budget the enrichment passes are
@@ -2949,14 +3049,14 @@ export async function buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbui
     const lease = await acquireSupervisorAllocation(VFS_BUNDLE_MAX_BYTES);
     prefetchBundleStart(VFS_BUNDLE_MAX_BYTES);
     try {
-        return await _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bundleProfile, observedReads, pacer);
+        return await _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bundleProfile, observedReads, pacer, isolatedTransform);
     }
     finally {
         prefetchBundleEnd(VFS_BUNDLE_MAX_BYTES);
         lease.release();
     }
 }
-async function _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bundleProfile = DEFAULT_FACET_BUNDLE_PROFILE, observedReads, pacer) {
+async function _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bundleProfile = DEFAULT_FACET_BUNDLE_PROFILE, observedReads, pacer, isolatedTransform) {
     // Read the cursor BEFORE the walk: a mutation that lands while the bundle
     // is being assembled must be reported as invalidated, not silently missed.
     const cursor = { epoch: vfs.epoch, rev: vfs.revision() };
@@ -3071,7 +3171,7 @@ async function _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bu
     //     "file was not pre-bundled" at request time.
     if (esbuild) {
         try {
-            await transformEsmInBundle(bundle, esbuild, pacer);
+            await transformEsmInBundle(bundle, esbuild, pacer, isolatedTransform);
             // Recount bytes after the transform — CJS rebuilds can be larger
             // OR smaller than the ESM source. We don't try to thread totalBytes
             // through the transform because the eviction loop below recomputes
@@ -3110,8 +3210,9 @@ async function _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bu
     //    went are named rather than silently dropped.
     const size = encodedBundleSize(bundle, manifest);
     if (size.bytes > BUNDLE_MAX_ENCODED_BYTES) {
+        // A compiled cell goes with its source: required when the source is.
         const evictable = Object.keys(bundle)
-            .filter((path) => !requiredPaths.has(path))
+            .filter((path) => !requiredPaths.has(compiledCellPath(path) ?? path))
             .sort((a, b) => _bundleCellLength(bundle[b]) - _bundleCellLength(bundle[a]));
         const evicted = [];
         for (const k of evictable) {
@@ -3151,6 +3252,23 @@ async function _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bu
     };
 }
 const ROUTEABLE_PORT_ATTACH_TIMEOUT_MS = 1_000;
+/** A port request may wait this long for a durable app's re-drive to boot. */
+const DURABLE_ENSURE_BOOT_BUDGET_MS = 12_000;
+/** The env var a launch reads its restart policy from — set by startProcess({ restart }) and `nimbus start --restart`. */
+export const RESTART_POLICY_ENV = 'NIMBUS_RESTART';
+/** Backoff per spent FencedWork attempt; a healthy boot resets that existing budget. */
+const RESTART_BACKOFF_BASE_MS = 1_000;
+function residentRestartPolicy(env) {
+    return env?.[RESTART_POLICY_ENV] === 'on-failure' ? 'on-failure' : 'never';
+}
+/**
+ * The durable owner a journal row serves: the row's stamped field for
+ * reservation-claimed residents, falling back to the worker recipe's own
+ * owner for rows written before the stamping rule landed.
+ */
+function residentOwner(record) {
+    return record.owner ?? (record.recipe.kind === 'worker' ? record.recipe.owner : undefined);
+}
 /** 'running' is the measured common case: the platform's reset strikes
  *  seconds after a launch settles, while the resident runs. */
 function residentLaunchDoing(record) {
@@ -3189,7 +3307,7 @@ export class FacetManager {
      * The resident-launch journal (fabric's fenced-work.ts): the durable
      * record of every resident this session owes the user, and its recovery
      * after an instance reset. This manager supplies what a launch IS — the
-     * inputs `_spawnResident` re-drives from — and how its loss is reported.
+     * recipe `_redrive` re-drives from — and how its loss is reported.
      */
     launchJournal;
     /**
@@ -3236,12 +3354,22 @@ export class FacetManager {
      * prefetch cache above so a profile can only ever seed the bundle it was
      * measured against.
      *
-     * Lifetime is the supervisor incarnation's, same as the cache — a restart
      * costs one more loud failure and then relearns. Persisting it would be a
      * schema and a migration bought with nothing the in-memory form does not
      * already deliver for the case that matters: running the command again.
      */
     residencyProfiles = new Map();
+    /** In-flight request-driven durable-app ensures, single-flight per port. */
+    ensureInflight = new Map();
+    /** Per-pid chain of journal-row amendments; see `_amendRow`. */
+    rowAmendments = new Map();
+    /**
+     * pid → the derived owner it duplicates: the second live instance of an
+     * identity. Not journalled (nothing re-drives it), so this is the only
+     * record of why `expose(pid)` refuses it.
+     */
+    ephemeralPids = new Map();
+    residentClaims = new Map();
     static RESIDENCY_PROFILE_MAX_ENTRIES = 16;
     /**
      * A program that reads a directory of data files misses once per file, so
@@ -3271,7 +3399,7 @@ export class FacetManager {
         this.launchJournal = new FencedWork(ctx.storage, {
             generationBase: () => this.processes.pidBase,
             waitUntil: (promise) => this.ctx.waitUntil(promise),
-            redrive: (record, attempt) => this._spawnResident(record.code, record.opts, attempt),
+            redrive: (record, attempt) => this._redrive(record, attempt),
             onRedrive: (record) => this.hooks.notify?.('\x1b[2m[nimbus: the session restarted while '
                 + `"${record.command}" was ${residentLaunchDoing(record)} — restarting it]\x1b[0m\r\n`),
             onAbandoned: (record) => this.hooks.notify?.('\x1b[2m[nimbus: the session restarted again while '
@@ -3292,9 +3420,100 @@ export class FacetManager {
         // Rooted on waitUntil: the hook fires synchronously inside whatever turn
         // ended the process, and the delete must not be a floating promise there.
         this.processes.setOnTerminal((pid) => {
-            this.ctx.waitUntil(this.launchJournal.release(pid));
+            this.ctx.waitUntil(this._onResidentTerminal(pid));
         });
     }
+    /**
+     * The process is over. Every end-of-life passes through here: a clean
+     * exit, a kill, a timeout, a crash. Only one of them owes anything more
+     * than the journal row's release — a crash under 'on-failure' is re-driven
+     * from the row, after a backoff, while the row is still in storage so a
+     * reset inside the backoff window recovers it like any other resident.
+     */
+    async _onResidentTerminal(pid) {
+        await this.rowAmendments.get(pid);
+        this.ephemeralPids.delete(pid);
+        await this._releaseResidentClaim(pid);
+        if (!this.launchJournal.has(pid))
+            return;
+        const entry = this.processes.get(pid);
+        const key = `${FENCED_WORK_KEY_PREFIX}${pid}`;
+        const row = (await this.launchJournal.rows()).get(key);
+        const crashed = entry?.state === 'exited' && (entry.exitCode ?? 0) !== 0;
+        if (row === undefined || row.restart !== 'on-failure' || !crashed) {
+            await this.launchJournal.release(pid);
+            return;
+        }
+        const delayMs = RESTART_BACKOFF_BASE_MS * 2 ** row.attempt;
+        this.hooks.notify?.(`\x1b[2m[nimbus: "${row.command}" exited with code ${entry.exitCode} — `
+            + `restarting in ${delayMs / 1000}s (FencedWork attempt ${row.attempt + 1})]\x1b[0m\r\n`);
+        await this.launchPump.nextTurn(Promise.resolve(), Date.now() + delayMs);
+        // The process may have been removed or the session destroyed during the
+        // backoff; a row that is gone is owed nothing.
+        if (!(await this.launchJournal.rows()).has(key))
+            return;
+        await this.launchJournal.drive(key, row);
+    }
+    /** Claim identity AND write its recovery row in one serializable storage transaction. */
+    async _claimResident(record) {
+        const owner = residentOwner(record);
+        if (owner === undefined)
+            throw new Error('resident launch has no owner');
+        const duplicate = await this.ctx.storage.transaction(async (txn) => {
+            const key = `${RESIDENT_OWNER_KEY_PREFIX}${owner}`;
+            const held = await txn.get(key);
+            if (held !== undefined && held !== record.pid && held > this.processes.pidBase
+                && this.processes.get(held)?.state === 'running')
+                return held;
+            await txn.put(key, record.pid);
+            await txn.put(`${FENCED_WORK_KEY_PREFIX}${record.pid}`, record);
+            return null;
+        });
+        if (duplicate === null) {
+            this.residentClaims.set(record.pid, owner);
+            // Adopt into FencedWork's per-instance lifetime bookkeeping and cross
+            // its sync barrier before booting. The winning row already exists.
+            await this.launchJournal.journal(record);
+        }
+        return duplicate;
+    }
+    async _releaseResidentClaim(pid) {
+        const owner = this.residentClaims.get(pid);
+        if (owner === undefined)
+            return;
+        this.residentClaims.delete(pid);
+        await this.ctx.storage.transaction(async (txn) => {
+            const key = `${RESIDENT_OWNER_KEY_PREFIX}${owner}`;
+            if (await txn.get(key) === pid)
+                await txn.delete(key);
+        });
+        await this.ctx.storage.sync();
+    }
+    /**
+     * Amend one journal row in place — port stamp, owner adoption, settle —
+     * serialized per pid so two amendments in flight on the same row cannot
+     * interleave their read and write and lose one another's fields.
+     */
+    _amendRow(pid, amend) {
+        const key = `${FENCED_WORK_KEY_PREFIX}${pid}`;
+        const previous = this.rowAmendments.get(pid) ?? Promise.resolve(undefined);
+        const next = previous.then(async () => {
+            const row = (await this.launchJournal.rows()).get(key);
+            if (row === undefined)
+                return undefined;
+            const amended = amend(row);
+            if (amended !== row)
+                await this.launchJournal.journal(amended);
+            return amended;
+        });
+        const settled = next.then(() => undefined, () => undefined);
+        this.rowAmendments.set(pid, settled);
+        void settled.then(() => {
+            if (this.rowAmendments.get(pid) === settled)
+                this.rowAmendments.delete(pid);
+        });
+        return next;
+    }
     setVfs(vfs) { this.vfs = vfs; }
     /**
      * The env/ctx pair every loader-backed runtime builds its facet pools
@@ -3327,6 +3546,17 @@ export class FacetManager {
             unlink: (path) => fs.unlink(path),
         };
     }
+    /**
+     * The kernel-scoped VFS the durable image store reads and writes through —
+     * `.nimbus/images/<sha256>` is session kernel data, not user content.
+     */
+    _imageVfs() {
+        const vfs = this.vfs;
+        if (!vfs) {
+            throw new Error('Nimbus: a durable spawn needs a session filesystem to persist its launch image');
+        }
+        return vfs;
+    }
     /**
      * W3.5 Fix B: hand the FacetManager a pre-warmed EsbuildService for
      * the ESM→CJS bundle pre-pass. NimbusSession already lazy-creates one
@@ -3413,7 +3643,7 @@ export class FacetManager {
             this.prefetchBundleCache.set(key, cached);
             return { ...cached.vfsState, cacheHit: true, cacheRetained: true };
         }
-        const vfsState = await buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, this.esbuild || undefined, bundleProfile, this.residencyProfiles.get(key));
+        const vfsState = await buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, this.esbuild || undefined, bundleProfile, this.residencyProfiles.get(key), undefined, this.hooks.transformLargeEsm);
         vfsState.bundleKey = key;
         vfsState.bundleSource = await buildFacetVfsBundleSource(vfsState.bundle, vfsState.bundleSideModulesRequired);
         vfsState.serializedManifest = JSON.stringify(vfsState.manifest);
@@ -3624,12 +3854,7 @@ export class FacetManager {
         // CJS before they hit the facet's `new Function` pre-compile loop.
         // Lazy-create one if NimbusSession didn't share its own.
         if (this.vfs && !this.esbuild) {
-            try {
-                this.esbuild = new EsbuildService(this.vfs);
-            }
-            catch {
-                this.esbuild = null;
-            }
+            this.esbuild = new EsbuildService(this.vfs.as(CRED_KERNEL));
         }
         const diagOn = isExecDiagEnabled();
         const __bundleStart = diagOn ? Date.now() : 0;
@@ -3947,7 +4172,7 @@ export class FacetManager {
             this.imageStore.ensureDir();
         const processVfs = this.vfs?.as(entry.cred);
         const vfsState = processVfs
-            ? await buildPrefetchBundle(processVfs, undefined, opts.cwd, '', this.esbuild || undefined)
+            ? await buildPrefetchBundle(processVfs, undefined, opts.cwd, '', this.esbuild || undefined, DEFAULT_FACET_BUNDLE_PROFILE, undefined, undefined, this.hooks.transformLargeEsm)
             : { bundle: {}, manifest: {}, metadata: {}, reachableCount: 0, truncated: false };
         const vfsBundle = _serializeBundleForFacet(vfsState.bundle);
         assertStagedBundleFitsRpcPayload(vfsBundle, vfsState.bundle);
@@ -4371,6 +4596,21 @@ export class FacetManager {
             return '(no output captured)';
         }
     }
+    /**
+     * A launch that fails before its process is running reports the same way
+     * regardless of which phase failed: the pid is exited, the terminal event
+     * recorded, and the session notified. Callers do their phase-specific
+     * cleanup (ports, tracked RPC resources) first and pass a reason that names
+     * the phase.
+     */
+    _failLaunch(pid, reason) {
+        this.processes.exit(pid, 1);
+        this._w5RecordTermination(pid, 1, 'facet', reason);
+        try {
+            this.hooks.onExternalExit?.(pid, 1, reason);
+        }
+        catch { }
+    }
     /** Flush files written by the script back to the supervisor's VFS. */
     _flushVfsWrites(result, pid) {
         if (!this.vfs || !result.vfsWrites)
@@ -4418,6 +4658,42 @@ export class FacetManager {
                 clearTimeout(timer);
         }
     }
+    /**
+     * Re-drive a journalled launch after an instance reset. What the journal
+     * row carries is the recipe and nothing else: env and credentials are never
+     * written to storage, so a worker launch's are re-resolved by the embedder
+     * through `hooks.resolveWorkerLaunch`.
+     */
+    async _redrive(record, attempt) {
+        const { recipe } = record;
+        switch (recipe.kind) {
+            case 'node': return this._spawnResident(recipe.code, recipe.opts, attempt);
+            case 'worker': {
+                // The embedder's resolver decides everything; only a self-owned
+                // launch — nobody composed an embedder hook — falls through to the
+                // session's image-store default.
+                const resolve = recipe.resident
+                    ? this.hooks.resolveWorkerLaunchFallback
+                    : this.hooks.resolveWorkerLaunch ?? this.hooks.resolveWorkerLaunchFallback;
+                if (!resolve)
+                    throw new Error('resident launch journal holds a worker launch but no resolveWorkerLaunch hook is composed');
+                const resolved = await resolve(recipe);
+                if (resolved === null)
+                    return undefined;
+                const { 'worker.js': workerCode, ...modules } = resolved.modules;
+                if (workerCode === undefined)
+                    throw new Error('resolved worker launch carries no worker.js module');
+                return this._spawnWorker(workerCode, record.command, recipe.cwd, {
+                    port: recipe.resident ? record.port : recipe.port > 0 ? recipe.port : undefined, modules, compatibilityDate: recipe.compatibilityDate,
+                    compatibilityFlags: recipe.compatibilityFlags, startArgs: resolved.startArgs ?? recipe.startArgs,
+                    resident: recipe.resident, restart: record.restart,
+                    env: resolved.env ?? undefined, globalOutbound: resolved.globalOutbound,
+                    vfsWasmModules: resolved.vfsWasmModules,
+                    durable: { owner: residentOwner(record) ?? recipe.owner, image: recipe.image },
+                }, attempt);
+            }
+        }
+    }
     /**
      * Spawn a long-running Node process with the same shimmed require/fs/http
      * environment used by foreground `node <script>` execution.
@@ -4503,17 +4779,89 @@ export class FacetManager {
         // sessions kept dying. The row is finally released by the supervisor's
         // terminal hook when the process ends. A re-drive owns its own process,
         // so the caller's pid goes with the instance that had it.
+        //
+        // Every resident has an identity from the moment it is spawned: derived
+        // from the working directory and argv (never the env), so the same
+        // `node server.js` from the same directory is the same application
+        // across restarts and resets. A resident that declares a port at spawn
+        // which an EXPLICIT reservation holds (an embedder's ensureDurableApp)
+        // adopts that reservation's owner instead — the landed contract: the
+        // embedder declared the port, so whatever binds it is the application.
+        //
+        // A second live instance of the same derived identity is ephemeral: it
+        // runs, but it is not the durable one — it takes no slot (the slot is
+        // the identity's, and a live facet already holds it), claims no
+        // reservation, and is not journalled, so nothing re-drives it and a
+        // port it binds retires the previous occupant's capability like any
+        // unrelated process would.
+        const derivedOwner = await deriveResidentOwner(cwd, opts.argv ?? []);
+        let owner = derivedOwner;
+        if (opts.port !== undefined && opts.port > 0 && opts.port < 65536) {
+            const declared = await readPortReservation(this.ctx, opts.port);
+            if (declared !== null && declared.owner !== null && declared.kind === 'explicit') {
+                owner = declared.owner;
+            }
+        }
+        const initial = {
+            pid: entry.pid, command, attempt, phase: 'starting', owner,
+            recipe: { kind: 'node', code, opts: { ...opts, skipSpawn: undefined, callerPid: undefined } },
+            restart: residentRestartPolicy(opts.env),
+        };
+        let duplicateOf;
+        try {
+            duplicateOf = await this._claimResident(initial);
+            this._assertLaunchStillOwned(entry.pid);
+        }
+        catch (e) {
+            pacer.settle();
+            await this._releaseResidentClaim(entry.pid);
+            await this.launchJournal.release(entry.pid);
+            this._failLaunch(entry.pid, 'long-running node launch failed: ' + errorMessage(e));
+            throw e;
+        }
+        const ephemeral = duplicateOf !== null;
+        // The reservation the identity holds, if any: its port is what `$PORT`
+        // is set to and what the facet's durable slot is bound for, so the
+        // resident's `ctx.storage` persists across resets the way a durable
+        // worker's does.
+        const held = ephemeral ? null : await readPortReservationByOwner(this.ctx, owner);
+        let durableFacetName;
+        let launchEnv;
+        if (held !== null) {
+            durableFacetName = await acquireDurableFacetSlot(this.ctx, owner);
+            launchEnv = {
+                PORT: String(held.port),
+                NIMBUS_APP: held.reservation.name ?? owner,
+            };
+        }
+        if (ephemeral) {
+            this.ephemeralPids.set(entry.pid, owner);
+            this.hooks.notify?.(`\x1b[2m[nimbus: second instance of "${(opts.argv ?? []).join(' ') || command}" `
+                + `is not the durable one — pid ${duplicateOf} keeps the identity]\x1b[0m\r\n`);
+        }
         const record = {
             pid: entry.pid,
             command,
-            code,
-            opts: { ...opts, skipSpawn: undefined, callerPid: undefined },
             attempt,
             phase: 'starting',
+            recipe: { kind: 'node', code, opts: { ...opts, skipSpawn: undefined, callerPid: undefined } },
+            owner,
+            ...(held !== null ? { port: held.port, injectedPort: held.port } : {}),
+            restart: residentRestartPolicy(opts.env),
         };
-        await this.launchJournal.journal(record);
         try {
-            await this._residentLaunchBody(entry, code, command, cwd, opts, pacer);
+            if (!ephemeral)
+                await this.launchJournal.journal(record);
+        }
+        catch (e) {
+            // A resident that cannot be journalled does not start; the failure is
+            // reported the way a boot failure is.
+            pacer.settle();
+            this._failLaunch(entry.pid, 'long-running node launch failed: ' + errorMessage(e));
+            throw e;
+        }
+        try {
+            await this._residentLaunchBody(entry, code, command, cwd, opts, pacer, durableFacetName, launchEnv);
         }
         catch (e) {
             await this.launchJournal.release(entry.pid);
@@ -4525,19 +4873,16 @@ export class FacetManager {
         // Booted and running: the launch proved itself, so the resident starts
         // its running life with a fresh re-drive budget. If the process already
         // ended inside the launch body's own settlement, the terminal hook has
-        // released the row — do not write it back.
+        // released the row — do not write it back. Amended, not rewritten from
+        // `record`: a port the program bound during its boot has already been
+        // stamped onto the row, and the settle must not lose it.
         if (this.launchJournal.has(entry.pid)) {
-            await this.launchJournal.journal({ ...record, attempt: 0, phase: 'running' });
+            await this._amendRow(entry.pid, (row) => ({ ...row, attempt: 0, phase: 'running' }));
         }
     }
-    async _residentLaunchBody(entry, code, command, cwd, opts, pacer) {
+    async _residentLaunchBody(entry, code, command, cwd, opts, pacer, durableFacetName, launchEnv) {
         if (this.vfs && !this.esbuild) {
-            try {
-                this.esbuild = new EsbuildService(this.vfs);
-            }
-            catch {
-                this.esbuild = null;
-            }
+            this.esbuild = new EsbuildService(this.vfs.as(CRED_KERNEL));
         }
         if (this.vfs)
             this.imageStore.ensureDir();
@@ -4545,12 +4890,17 @@ export class FacetManager {
         const __bundleStart = diagOn ? Date.now() : 0;
         const processVfs = this.vfs?.as(entry.cred);
         const vfsState = processVfs
-            ? await buildPrefetchBundle(processVfs, opts.filename, cwd, code, this.esbuild || undefined, opts.bundleProfile, undefined, pacer)
+            ? await buildPrefetchBundle(processVfs, opts.filename, cwd, code, this.esbuild || undefined, opts.bundleProfile, undefined, pacer, this.hooks.transformLargeEsm)
             : { bundle: {}, manifest: {}, metadata: {}, reachableCount: 0, truncated: false };
         const bundleMs = diagOn ? Date.now() - __bundleStart : 0;
+        // The launch-time overlay (`$PORT`, `$NIMBUS_APP` under a reservation)
+        // rides on top of the recipe's env and is never journalled: it is
+        // re-derived from the reservation on every launch, so a port the
+        // application was given follows the reservation, not the recipe.
+        const spawnEnv = launchEnv === undefined ? opts.env : { ...(opts.env || {}), ...launchEnv };
         const processEnv = opts.attachedTty
             ? {
-                ...(opts.env || {}),
+                ...(spawnEnv || {}),
                 NIMBUS_ATTACHED_TTY: '1',
                 NIMBUS_CP_CHILD_PID: String(entry.pid),
                 TERM: opts.env?.TERM || 'xterm-256color',
@@ -4559,7 +4909,7 @@ export class FacetManager {
                 LINES: opts.env?.LINES || '24',
                 FORCE_COLOR: opts.env?.FORCE_COLOR || '1',
             }
-            : opts.env;
+            : spawnEnv;
         const usesSqlite = bundleUsesNodeSqlite(code, vfsState.bundle);
         const [sqliteModules, shims] = await Promise.all([
             this.sqliteModuleEntry(usesSqlite),
@@ -4602,6 +4952,12 @@ export class FacetManager {
                 // life; the server/watch runner returns once it is up.
                 startContract: opts.attachedTty ? 'lifetime' : 'boot',
                 startArgs: { vfsCursor },
+                // A resident whose declared port is reserved binds the owner's
+                // durable slot — the same store a durable worker spawn takes — so the
+                // reservation's durability reaches this process's storage too.
+                ...(durableFacetName !== undefined
+                    ? { facet: { name: durableFacetName, durable: true } }
+                    : {}),
                 boot: {
                     kind: 'code',
                     code: {
@@ -4675,10 +5031,7 @@ export class FacetManager {
                 await handle.booted();
             }
             if (opts.port && opts.port > 0 && opts.port < 65536) {
-                // A new process on a port retires the previous occupant's preview
-                // capability, so a URL handed out for that one cannot reach this one.
-                await clearPortCapability({ ctx: this.ctx, portRegistry: this.portRegistry }, opts.port);
-                this.portRegistry.register(opts.port, entry.pid);
+                await this._registerResidentPort(entry.pid, opts.port);
             }
         }
         catch (e) {
@@ -4687,13 +5040,7 @@ export class FacetManager {
                 this.releaseProcessRpcResources(entry.pid);
             else
                 handle?.kill();
-            this.processes.exit(entry.pid, 1);
-            const reason = 'long-running node boot failed: ' + errorMessage(e);
-            this._w5RecordTermination(entry.pid, 1, 'facet', reason);
-            try {
-                this.hooks.onExternalExit?.(entry.pid, 1, reason);
-            }
-            catch { }
+            this._failLaunch(entry.pid, 'long-running node boot failed: ' + errorMessage(e));
             throw e;
         }
     }
@@ -4711,6 +5058,13 @@ export class FacetManager {
      * promise, so nothing polls the port to decide the process is up.
      */
     async spawnWorker(workerCode, command, cwd, opts = {}) {
+        return this._spawnWorker(workerCode, command, cwd, opts, 0);
+    }
+    /** `attempt` is the journal's re-drive budget, as `_spawnResident` carries it. */
+    async _spawnWorker(workerCode, command, cwd, opts, attempt) {
+        if (opts.resident && !opts.durable) {
+            opts = { ...opts, durable: { owner: await deriveResidentOwner(cwd, opts.resident.argv) } };
+        }
         this.processes.reap();
         const entry = this.processes.spawn(command, [], cwd);
         // Stamp the process-table entry so /api/processes exposes this as a
@@ -4722,35 +5076,149 @@ export class FacetManager {
             this.hooks.onSpawn?.(entry.pid, command, true);
         }
         catch { }
+        const compatibilityDate = opts.compatibilityDate ?? CF_COMPAT_DATE;
+        const compatibilityFlags = opts.compatibilityFlags || ['nodejs_compat'];
         let handle;
         let resourcesTracked = false;
+        let record;
+        let durableFacetName;
+        let launchEnv;
         try {
+            if (opts.durable) {
+                // A durable spawn on a declared port starts only when a reservation the
+                // owner already holds is persisted. Validated before the journal row is
+                // written and before the process boots, so a foreign or absent
+                // reservation refuses the launch rather than stealing the exposure.
+                if (!opts.resident && opts.port && opts.port > 0 && opts.port < 65536) {
+                    const preFlight = await readPortReservation(this.ctx, opts.port);
+                    if (preFlight === null || preFlight.owner !== opts.durable.owner) {
+                        throw new Error('port reservation conflict: durable worker does not own port ' + opts.port);
+                    }
+                }
+                // A live outbound binding cannot be journalled — a reset would re-drive
+                // the recipe with nothing to stand in for it. Only the EMBEDDER's
+                // resolveWorkerLaunch can re-mint one: the session's fallback reads
+                // the image store, which never carries a binding, so a durable spawn
+                // carrying globalOutbound is refused where no embedder hook exists.
+                if (opts.globalOutbound !== undefined && opts.globalOutbound !== null
+                    && this.hooks.resolveWorkerLaunch === undefined) {
+                    throw new Error('Nimbus: a durable spawn carrying a live globalOutbound binding '
+                        + 'cannot be journalled without an embedder resolveWorkerLaunch hook');
+                }
+                // Self-owned applications persist their launch inputs as image blobs —
+                // a runner blob for worker.js, an application blob for modules + env —
+                // under .nimbus/images/<sha256>, and the journal row names the digests
+                // of what was written, never placeholder strings. An embedder-owned
+                // spawn is given digests by its own bookkeeping instead.
+                const image = opts.durable.image
+                    ?? await persistDurableWorkerImage(this._imageVfs(), workerCode, {
+                        modules: opts.modules ?? {},
+                        ...(opts.env !== undefined ? { env: opts.env } : {}),
+                        vfsWasmModules: opts.vfsWasmModules,
+                        startArgs: opts.startArgs,
+                    });
+                await this.ctx.storage.transaction(async (txn) => {
+                    const key = `${DURABLE_IMAGES_KEY_PREFIX}${opts.durable.owner}`;
+                    const images = await txn.get(key) ?? [];
+                    if (!images.some((held) => held.runner === image.runner && held.application === image.application)) {
+                        await txn.put(key, [...images, image]);
+                    }
+                });
+                // Journalled before the launch's first byte of work, so a row a
+                // later instance reads proves this process never ended.
+                record = {
+                    pid: entry.pid,
+                    command,
+                    attempt,
+                    phase: 'starting',
+                    recipe: {
+                        kind: 'worker',
+                        owner: opts.durable.owner,
+                        image,
+                        port: opts.port ?? 0,
+                        cwd,
+                        compatibilityDate,
+                        compatibilityFlags,
+                        ...(opts.durable.image && !opts.resident ? { startArgs: opts.startArgs } : {}),
+                        ...(opts.resident ? { resident: opts.resident } : {}),
+                    },
+                    // The row-level fields `ensureDurableAppOnPort` reads — same values
+                    // the recipe carries, stamped so port/owner lookup never depends on
+                    // the recipe's kind.
+                    owner: opts.durable.owner,
+                    restart: opts.restart ?? 'never',
+                    ...(opts.port !== undefined && opts.port > 0 ? { port: opts.port } : {}),
+                };
+                // The durable facet name is claimed once, ever, from DO storage — a
+                // re-drive after a reset, an eviction's re-attach and a relaunch all
+                // land on the same `app-slot-<n>`, which is the only thing that keeps
+                // the retained SQLite bound to this application.
+                const duplicate = await this._claimResident(record);
+                if (duplicate !== null) {
+                    this.ephemeralPids.set(entry.pid, opts.durable.owner);
+                    this.hooks.notify?.(`\x1b[2m[nimbus: second instance of "${command}" is not the durable one — pid ${duplicate} keeps the identity]\x1b[0m\r\n`);
+                }
+                else if (!opts.resident || await readPortReservationByOwner(this.ctx, opts.durable.owner)) {
+                    durableFacetName = await acquireDurableFacetSlot(this.ctx, opts.durable.owner);
+                }
+                if (duplicate === null) {
+                    const held = await readPortReservationByOwner(this.ctx, opts.durable.owner);
+                    if (held) {
+                        launchEnv = { PORT: String(held.port), NIMBUS_APP: held.reservation.name ?? opts.durable.owner };
+                        await this._amendRow(entry.pid, (row) => ({ ...row, port: held.port, injectedPort: held.port }));
+                    }
+                }
+            }
             handle = await this._startResidentProcess(entry.pid, {
                 // These runners answer startProcess with a boot payload (listening
                 // port, or a completed non-server run) and stay resident after it.
                 startContract: 'boot',
-                startArgs: opts.startArgs,
+                startArgs: opts.resident && opts.startArgs && typeof opts.startArgs === 'object'
+                    ? { ...opts.startArgs, supervisorPid: entry.pid,
+                        ...(launchEnv ? { userEnv: { ...z.record(z.string(), z.unknown()).parse(Reflect.get(opts.startArgs, 'userEnv') ?? {}), ...launchEnv } } : {}) }
+                    : opts.startArgs,
+                ...(durableFacetName !== undefined
+                    ? { facet: { name: durableFacetName, durable: true } }
+                    : {}),
                 boot: {
                     kind: 'code',
                     code: {
-                        compatibilityDate: CF_COMPAT_DATE,
-                        compatibilityFlags: opts.compatibilityFlags || ['nodejs_compat'],
+                        compatibilityDate,
+                        compatibilityFlags,
                         mainModule: 'worker.js',
                         modules: { 'worker.js': workerCode, ...(opts.modules || {}) },
                         vfsWasmModules: opts.vfsWasmModules,
+                        ...(opts.env !== undefined || launchEnv !== undefined ? { env: { ...opts.env, ...launchEnv } } : {}),
+                        ...(opts.globalOutbound !== undefined ? { globalOutbound: opts.globalOutbound } : {}),
                     },
                 },
             });
             this.trackProcessRpcResources(entry.pid, [handle]);
             resourcesTracked = true;
             this.portRegistry.bindFacetStub(entry.pid, handle.routeTarget);
+            const boot = await handle.booted();
+            if (record && this.launchJournal.has(entry.pid)) {
+                // Booted and running: the launch proved itself, so the resident
+                // starts its running life with a fresh re-drive budget.
+                await this._amendRow(entry.pid, (row) => ({ ...row, attempt: 0, phase: 'running' }));
+            }
             if (opts.port && opts.port > 0 && opts.port < 65536) {
-                // A new process on a port retires the previous occupant's preview
-                // capability, so a URL handed out for that one cannot reach this one.
-                await clearPortCapability({ ctx: this.ctx, portRegistry: this.portRegistry }, opts.port);
-                this.portRegistry.register(opts.port, entry.pid);
+                if (opts.durable && !opts.resident) {
+                    // Re-read after the boot: a release or reassignment during it wins.
+                    // The durable launch registers only under a reservation it still
+                    // owns; it never clears or takes a foreign exposure.
+                    const reservation = await readPortReservation(this.ctx, opts.port);
+                    if (reservation === null || reservation.owner !== opts.durable.owner) {
+                        throw new Error('port reservation conflict: durable worker does not own port ' + opts.port);
+                    }
+                    // The owner's hold on the port survives the instance reset that
+                    // re-drove this launch, and preview URLs minted against it stay
+                    // valid: the durable capability is re-adopted through the
+                    // reservation's own path, gated on the stored owner.
+                }
+                await this._registerResidentPort(entry.pid, opts.port);
             }
-            return { pid: entry.pid, boot: await handle.booted() };
+            return { pid: entry.pid, boot };
         }
         catch (e) {
             this.portRegistry.unregisterByPid(entry.pid);
@@ -4758,20 +5226,183 @@ export class FacetManager {
                 this.releaseProcessRpcResources(entry.pid);
             else
                 handle?.kill();
-            this.processes.exit(entry.pid, 1);
-            const reason = 'long-running worker boot failed: ' + errorMessage(e);
-            this._w5RecordTermination(entry.pid, 1, 'facet', reason);
-            try {
-                this.hooks.onExternalExit?.(entry.pid, 1, reason);
-            }
-            catch { }
+            this._failLaunch(entry.pid, 'long-running worker boot failed: ' + errorMessage(e));
             throw e;
         }
     }
+    /**
+     * A resident process announcing it bound `port`.
+     *
+     * The stamp is unconditional: the pid's journal row gets `{ port }`
+     * whether or not anything reserved it, which is what lets
+     * `ensureDurableAppOnPort` re-drive ANY resident a reset killed — the
+     * scoped URLs need no capability, so this alone makes every server's
+     * preview survive a reset on demand.
+     *
+     * The capability is bound to identity, not to the port. The stored
+     * capability is re-adopted only when the row's owner IS the reservation's
+     * owner; any other occupant — an unrelated server, a pid outside the
+     * resident lifecycle, the ephemeral second instance of an identity —
+     * retires it and mints fresh, so a shared link 404s rather than reaching
+     * a program it was never handed out for. An EXPLICIT reservation (an
+     * embedder's `ensureDurableApp`) is the one exception, and it is the
+     * landed contract: the embedder declared the port, so the row adopts the
+     * reservation's owner and the capability with it.
+     *
+     * Under an injected `$PORT`, a resident that binds a different port is
+     * registered anyway — the server must not break — but the row records
+     * the mismatch, so `apps.list` reports it as failed and the user is told.
+     */
+    async _registerResidentPort(pid, port) {
+        const reservation = await readPortReservation(this.ctx, port);
+        let claimedBy;
+        if (reservation?.owner && reservation.kind === 'explicit' && !this.ephemeralPids.has(pid)) {
+            const owner = reservation.owner;
+            const anotherLive = [...(await this.launchJournal.rows()).values()].some((row) => row.pid !== pid && residentOwner(row) === owner
+                && row.pid > this.processes.pidBase && this.processes.get(row.pid)?.state === 'running');
+            if (!anotherLive)
+                claimedBy = owner;
+        }
+        let newlyMismatched = false;
+        const row = await this._amendRow(pid, (current) => {
+            const owner = claimedBy ?? residentOwner(current);
+            const injected = current.injectedPort;
+            // Under an injected $PORT, the reserved port is the row's port for as
+            // long as this pid holds it; a second, different binding is recorded
+            // as the mismatch rather than displacing it.
+            const holdsInjected = injected !== undefined && injected !== port
+                && this.portRegistry.get(injected)?.pid === pid;
+            const stampedPort = holdsInjected ? injected : port;
+            const portMismatch = injected !== undefined && injected !== port && !holdsInjected
+                ? { listened: port, reserved: injected }
+                : undefined;
+            const same = current.port === stampedPort && residentOwner(current) === owner
+                && (current.portMismatch?.listened === portMismatch?.listened)
+                && (current.portMismatch?.reserved === portMismatch?.reserved);
+            if (same)
+                return current;
+            newlyMismatched = portMismatch !== undefined && current.portMismatch === undefined;
+            const { portMismatch: _dropped, ...rest } = current;
+            return {
+                ...rest,
+                port: stampedPort,
+                ...(owner !== undefined ? { owner } : {}),
+                ...(portMismatch !== undefined ? { portMismatch } : {}),
+            };
+        });
+        if (newlyMismatched && row?.portMismatch !== undefined) {
+            this.hooks.notify?.(`\x1b[2m[nimbus: "${row.command}" listened on ${port} but its reservation owns `
+                + `${row.portMismatch.reserved} ($PORT) — the app's URL will not reach it]\x1b[0m\r\n`);
+        }
+        const owner = row === undefined ? undefined : residentOwner(row);
+        if (claimedBy !== undefined && row !== undefined && this.residentClaims.get(pid) !== claimedBy) {
+            const previousOwner = this.residentClaims.get(pid);
+            await this._releaseResidentClaim(pid);
+            const duplicate = await this._claimResident(row);
+            if (duplicate !== null) {
+                this.ephemeralPids.set(pid, claimedBy);
+                await this.launchJournal.release(pid);
+            }
+            else if (previousOwner && row.recipe.kind === 'worker') {
+                // Adoption moves retained images with the identity, including the
+                // index that survives a clean exit after the journal row is released.
+                await this.ctx.storage.transaction(async (txn) => {
+                    const previousKey = `${DURABLE_IMAGES_KEY_PREFIX}${previousOwner}`;
+                    const nextKey = `${DURABLE_IMAGES_KEY_PREFIX}${claimedBy}`;
+                    const previous = await txn.get(previousKey) ?? [];
+                    const next = await txn.get(nextKey) ?? [];
+                    const combined = [...next];
+                    for (const image of previous) {
+                        if (!combined.some((held) => held.runner === image.runner && held.application === image.application))
+                            combined.push(image);
+                    }
+                    await txn.put(nextKey, combined);
+                    await txn.delete(previousKey);
+                });
+            }
+        }
+        if (reservation !== null && reservation.owner !== null && owner === reservation.owner && !this.ephemeralPids.has(pid)) {
+            this.portRegistry.register(port, pid);
+            await restoreReservedPortCapability({ ctx: this.ctx, portRegistry: this.portRegistry }, port, reservation.owner);
+            return;
+        }
+        // Any other occupant retires the previous one's capability — and its
+        // directory row, so a public link goes dead rather than dangling — and
+        // registers with a fresh one. The owner's reservation survives it.
+        if (reservation?.owner) {
+            this.hooks.notify?.(`\x1b[2m[nimbus: port ${port} belongs to ${reservation.owner}; pid ${pid} registers ephemeral (owner ${owner ?? 'none'})]\x1b[0m\r\n`);
+        }
+        if (reservation?.visibility === 'public' && reservation.capability !== null) {
+            await unbindPublicPortCapability(this._publicDirectoryHost(), reservation.capability);
+        }
+        await clearPortCapability({ ctx: this.ctx, portRegistry: this.portRegistry }, port);
+        this.portRegistry.register(port, pid);
+    }
+    /** What a pid's journal row says about who it is; null for a pid without one. */
+    async residentIdentity(pid) {
+        const duplicated = this.ephemeralPids.get(pid);
+        if (duplicated !== undefined)
+            return { owner: duplicated, ephemeral: true, port: undefined };
+        const row = (await this.launchJournal.rows()).get(`${FENCED_WORK_KEY_PREFIX}${pid}`);
+        if (row === undefined)
+            return null;
+        return { owner: residentOwner(row), ephemeral: false, port: row.port };
+    }
+    /**
+     * Every stamped identity — the reservations, and the journal rows that
+     * carry an owner — folded one row per owner. A live pid in THIS instance
+     * makes it running (or starting, until its launch settles and its port
+     * is registered); a mismatch diagnostic makes it failed; everything else
+     * is stopped, which for a row a reset left behind means re-drivable on
+     * request.
+     */
+    async listResidentApps() {
+        const apps = new Map();
+        for (const [port, reservation] of await listPortReservations(this.ctx)) {
+            if (reservation.owner === null)
+                continue;
+            apps.set(reservation.owner, {
+                owner: reservation.owner,
+                name: reservation.name ?? null,
+                port,
+                pid: null,
+                status: 'stopped',
+                visibility: reservation.visibility,
+                capability: reservation.capability,
+                restart: 'never',
+                diagnostic: null,
+            });
+        }
+        for (const [, row] of await this.launchJournal.rows()) {
+            const owner = residentOwner(row);
+            if (owner === undefined)
+                continue;
+            const app = apps.get(owner) ?? {
+                owner, name: null, port: null, pid: null, status: 'stopped',
+                visibility: 'scoped', capability: null, restart: 'never', diagnostic: null,
+            };
+            if (app.port === null && row.port !== undefined && row.port > 0)
+                app.port = row.port;
+            if (row.restart !== undefined)
+                app.restart = row.restart;
+            const entry = this.processes.get(row.pid);
+            const live = row.pid > this.processes.pidBase && entry?.state === 'running';
+            if (live) {
+                app.pid = row.pid;
+                const bound = app.port !== null && this.portRegistry.get(app.port)?.pid === row.pid;
+                app.status = row.phase === 'running' && bound ? 'running' : 'starting';
+            }
+            if (row.portMismatch !== undefined) {
+                app.status = 'failed';
+                app.diagnostic = `listened on ${row.portMismatch.listened}, owns ${row.portMismatch.reserved}`;
+            }
+            apps.set(owner, app);
+        }
+        return [...apps.values()];
+    }
     async registerPort(pid, port) {
         if (port > 0 && port < 65536) {
-            await clearPortCapability({ ctx: this.ctx, portRegistry: this.portRegistry }, port);
-            this.portRegistry.register(port, pid);
+            await this._registerResidentPort(pid, port);
         }
     }
     waitForRouteablePorts(pid, timeoutMs = ROUTEABLE_PORT_ATTACH_TIMEOUT_MS) {
@@ -4809,5 +5440,158 @@ export class FacetManager {
         this._teardownPairedServeFacet(pid);
         return result;
     }
+    /**
+     * Remove a durable application: the ONLY path that deletes durable facet
+     * storage. Owner-checked by construction — `freeDurableFacetSlot` answers
+     * only a slot the owner actually holds, and the reservation release refuses
+     * a foreign owner's record — so another owner's name cannot be reached.
+     *
+     * One ordered teardown: the live process is killed first (a released
+     * durable facet only aborts, so nothing else ends it), the port reservation
+     * is released, the journal rows for the owner are purged (nothing is owed a
+     * removed application), the facet's SQLite is deleted, and the slot row is
+     * freed last — so a crash mid-removal leaves a name still claimed rather
+     * than a store nobody can re-drive.
+     */
+    async removeDurableApp(owner) {
+        // Kill any live process this owner still has — a durable release aborts
+        // without deleting, so the store outlives the process unless removal
+        // ends it here.
+        const journalRows = await this.ctx.storage.list({ prefix: 'resident-launch:' });
+        const ownedPids = [];
+        const ownedPorts = new Set();
+        for (const [, record] of journalRows) {
+            // Owner-stamped rows cover every kind the reservation claims — a node
+            // resident that bound the port is as much the application as a durable
+            // worker spawn is.
+            if (residentOwner(record) !== owner)
+                continue;
+            ownedPids.push(record.pid);
+        }
+        for (const pid of ownedPids)
+            this.kill(pid);
+        // The reservation may outlive every journal row (spawn never finished
+        // writing one), so scan the port records for the owner too.
+        const portRows = await this.ctx.storage.list({ prefix: PORT_CAPABILITY_KEY_PREFIX });
+        for (const [key, record] of portRows) {
+            if (record?.owner === owner)
+                ownedPorts.add(Number(key.slice(PORT_CAPABILITY_KEY_PREFIX.length)));
+            // A public capability leaves the routing directory with the row —
+            // before the reservation is released so a mid-removal crash leaves a
+            // dead URL rather than a dangling route to this session.
+            if (record?.owner === owner && record.visibility === 'public' && typeof record.capability === 'string') {
+                await unbindPublicPortCapability(this._publicDirectoryHost(), record.capability);
+            }
+        }
+        for (const port of ownedPorts) {
+            // A port stamp is not ownership. Release only a reservation that still
+            // belongs to this owner, and never unregister somebody else's listener.
+            if ((await readPortReservation(this.ctx, port))?.owner !== owner)
+                continue;
+            await releasePortReservation(this.ctx, { owner, port });
+            const live = this.portRegistry.get(port);
+            if (live && ownedPids.includes(live.pid))
+                this.portRegistry.unregister(port);
+        }
+        const imageRows = await this.ctx.storage.list({ prefix: DURABLE_IMAGES_KEY_PREFIX });
+        const ownedImages = [...(imageRows.get(`${DURABLE_IMAGES_KEY_PREFIX}${owner}`) ?? [])];
+        const retainedImages = [...imageRows].filter(([key]) => key !== `${DURABLE_IMAGES_KEY_PREFIX}${owner}`).flatMap(([, images]) => images);
+        for (const row of journalRows.values()) {
+            if (row.recipe.kind !== 'worker')
+                continue;
+            (residentOwner(row) === owner ? ownedImages : retainedImages).push(row.recipe.image);
+        }
+        const imagesPurged = this.vfs ? purgeDurableWorkerImages(this.vfs, ownedImages, retainedImages) : 0;
+        await this.ctx.storage.delete(`${DURABLE_IMAGES_KEY_PREFIX}${owner}`);
+        await this.ctx.storage.delete(`${RESIDENT_OWNER_KEY_PREFIX}${owner}`);
+        const purged = await this.launchJournal.purgeWhere((record) => residentOwner(record) === owner);
+        const name = await freeDurableFacetSlot(this.ctx, owner, (slot) => deleteFacetStorage(this.ctx, slot));
+        return name !== null || purged > 0 || ownedPorts.size > 0 || imagesPurged > 0;
+    }
+    /** The session-shaped view the public-directory helpers read env from. */
+    _publicDirectoryHost() {
+        return { env: this.env.rawEnv, ctx: this.ctx };
+    }
+    /**
+     * Whether a request addressed to `port` can reach a durable application —
+     * and, when the application is journaled but dead, drive its re-drive and
+     * wait for the boot, bounded.
+     *
+     * The port request is the one surface a reset leaves dark: the alarm pump
+     * re-drives journaled launches eventually, but a URL a user is holding
+     * cannot wait for an alarm that may never fire. 'started' means a live
+     * process owns the port now; 'absent' means nothing durable claims it
+     * (the caller answers 502 as it always has); 'failed' means a re-drive
+     * ran and lost, or outlived its bound — the caller answers 503 and lets
+     * the page re-ask.
+     *
+     * Single-flight per port: parallel requests on a woken page share one
+     * ensure, which shares the journal's per-row drive with recovery — a
+     * request that lands mid-recovery waits on that boot, it never boots a
+     * second process.
+     */
+    ensureDurableAppOnPort(port) {
+        let inflight = this.ensureInflight.get(port);
+        if (inflight === undefined) {
+            inflight = this._ensureDurableAppOnPort(port);
+            this.ensureInflight.set(port, inflight);
+            inflight.finally(() => {
+                if (this.ensureInflight.get(port) === inflight)
+                    this.ensureInflight.delete(port);
+            });
+        }
+        return inflight;
+    }
+    async _ensureDurableAppOnPort(port) {
+        if (this.portRegistry.has(port))
+            return 'started';
+        // The journal row is what makes a port a launch this instance owes —
+        // reservation or not: every resident's row is stamped with the port it
+        // bound, so any of them re-drives on request. A port with no stamped
+        // row (nothing ever bound it, or the app was removed and its rows
+        // purged) answers absent — nothing here can bring back an application
+        // with no recipe. When more than one row names the port, the
+        // reservation's owner wins; otherwise the newest launch does.
+        const reservation = await readPortReservation(this.ctx, port);
+        const rows = await this.launchJournal.rows();
+        const candidates = [...rows].filter(([, record]) => record.port === port);
+        const ownerRow = reservation !== null && reservation.owner !== null
+            ? candidates.find(([, record]) => residentOwner(record) === reservation.owner)
+            : undefined;
+        const entry = ownerRow ?? candidates.sort(([, a], [, b]) => b.pid - a.pid)[0];
+        if (entry === undefined)
+            return 'absent';
+        const [rowKey, record] = entry;
+        if (record.pid > this.processes.pidBase) {
+            // This instance's own row: the launch is already building — waiting
+            // for its port registration is the entire ask, and driving the row
+            // again would boot a second copy.
+            return (await this._waitForPort(port, DURABLE_ENSURE_BOOT_BUDGET_MS))
+                ? 'started' : 'failed';
+        }
+        const { promise: boundHit, resolve: markBound } = withResolvers();
+        setTimeout(() => markBound(true), DURABLE_ENSURE_BOOT_BUDGET_MS);
+        const failed = await Promise.race([
+            this.launchJournal.drive(rowKey, record),
+            boundHit,
+        ]);
+        if (failed)
+            return 'failed';
+        // A settled drive either owns the port or deliberately answered 'gone':
+        // a resolver's null superseded the row, which is absent, not failed.
+        return this.portRegistry.has(port) ? 'started' : 'absent';
+    }
+    /** Poll for a port registration the in-flight launch has not made yet. */
+    async _waitForPort(port, budgetMs) {
+        const deadline = Date.now() + budgetMs;
+        while (Date.now() < deadline) {
+            if (this.portRegistry.has(port))
+                return true;
+            const { promise: tick, resolve: tickDone } = withResolvers();
+            setTimeout(tickDone, 50);
+            await tick;
+        }
+        return this.portRegistry.has(port);
+    }
     get stats() { return this.processes.stats; }
 }