@nimbus-sh/worker 0.5.0 → 0.7.0

package/dist/facets/manager.js

@@ -21,11 +21,14 @@ import { getRealNodeImportsCode } from '@nimbus-sh/core/_shared/real-node-import
 import { FACET_RESIDENT_STORE_SOURCE } from '../vfs/facet-resident-store.js';
 import { VFS_CURSOR_SEED_SOURCE, serializeFacetVfsCursor, } from '@nimbus-sh/core/_shared/facet-vfs-cursor.js';
 import { VFS_WRITE_LEDGER_SOURCE } from '@nimbus-sh/core/_shared/vfs-write-ledger.js';
-import { vfsPathExtension } from '@nimbus-sh/core/vfs/path.js';
-import { clearPortCapability, readPortReservation, releasePortReservation, restoreReservedPortCapability } from '../session/port-capability.js';
+import { stripLeadingSlashes, vfsPathExtension } from '@nimbus-sh/core/vfs/path.js';
+import { clearPortCapability, listPortReservations, readPortReservation, readPortReservationByOwner, releasePortReservation, restoreReservedPortCapability, } from '../session/port-capability.js';
+import { deriveResidentOwner } from './resident-identity.js';
+import { z } from 'zod/v4';
+import { RESIDENT_OWNER_KEY_PREFIX, DURABLE_IMAGES_KEY_PREFIX } from '../session/keys.js';
 import { PORT_CAPABILITY_KEY_PREFIX } from '../session/keys.js';
 import { unbindPublicPortCapability } from '../router/public-directory.js';
-import { prefetchForRequire } from '@nimbus-sh/core/runtime/require-resolver.js';
+import { prefetchForRequire, ClosureBoundExceededError } from '@nimbus-sh/core/runtime/require-resolver.js';
 import { hasTopLevelModuleSyntax } from '@nimbus-sh/core/runtime/javascript-ast.js';
 import { bindImportMetaResolve, importMetaDefines } from '@nimbus-sh/core/runtime/import-meta-transform.js';
 import { recordFailure, getLastRpcFrame, getLastFacetId } from '@nimbus-sh/platform/oom-discriminator.js';
@@ -41,14 +44,15 @@ import { ImageStore, } from '@nimbus-sh/fabric/image-store.js';
 import { ProcessFabric, } from '@nimbus-sh/fabric/process-fabric.js';
 import { createLoadedWorkerEntrypoint, getNimbusCtxExports, deleteFacetStorage, } from '@nimbus-sh/fabric/workerd-facet-host.js';
 import { acquireDurableFacetSlot, freeDurableFacetSlot, } from './durable-slots.js';
-import { persistDurableWorkerImage, } from './durable-images.js';
+import { persistDurableWorkerImage, purgeDurableWorkerImages, } from './durable-images.js';
 import { SQLITE_WASM_MODULE_NAME, } from '../runtime/opencode-facet-runner.js';
 import { parsePortFromArgv, resolveLongRunningPort } from '@nimbus-sh/core/runtime/long-running-handle.js';
 import { DEFAULT_FACET_BUNDLE_PROFILE, } from '@nimbus-sh/core/runtime/bundle-profile.js';
-import { BUNDLE_BUILD_DEADLINE_MS, CF_COMPAT_DATE, FACET_TIMEOUT_MS, VFS_BUNDLE_MAX_FILES, VFS_BUNDLE_MAX_BYTES, CWD_SNAPSHOT_MAX_FILE_BYTES, BUNDLE_MAX_ENCODED_BYTES, PREFETCH_CACHE_MAX_BYTES, } from '@nimbus-sh/core/constants.js';
+import { CF_COMPAT_DATE, VFS_BUNDLE_MAX_FILES, VFS_BUNDLE_MAX_BYTES, CWD_SNAPSHOT_MAX_FILE_BYTES, BUNDLE_MAX_ENCODED_BYTES, PREFETCH_CACHE_MAX_BYTES, } from '@nimbus-sh/core/constants.js';
 import { MAX_RPC_SAFE_PAYLOAD_BYTES } from '@nimbus-sh/platform/limits.js';
 import { CRED_KERNEL } from '@nimbus-sh/core/runtime/os-contracts.js';
 import { acquireSupervisorAllocation } from '@nimbus-sh/platform/heavy-alloc-coord.js';
+import { wasmImageDigest } from './wasm-image-digest.js';
 import { prefetchBundleStart, prefetchBundleEnd, setPrefetchCacheBytes, } from '@nimbus-sh/platform/diag-counters.js';
 const ISOLATED_ESM_TRANSFORM_MIN_BYTES = 512 * 1024;
 /**
@@ -128,34 +132,6 @@ function parseFacetManagerEnv(env) {
         rawEnv: env,
     };
 }
-/**
- * Reserve held back from a one-shot facet's lifetime so a program that runs
- * out of time is still alive to say so.
- *
- * A one-shot exec is ALREADY bounded: `_execWithTimeout` kills it at
- * FACET_TIMEOUT_MS with exit 124 and "[process killed: timeout after 30s]".
- * The entry drain must therefore not be a second, tighter, independent
- * timeout. Measured against a deployed Worker, floating async work of 5s /
- * 15s / 25s completes and 40s is killed by that outer bound at exactly 30s —
- * so the fixed 8s budget this used to carry was abandoning programs 22
- * seconds before anything actually required it.
- *
- * The drain therefore runs to the outer bound MINUS this reserve, which is
- * what buys the facet time to flush and report the honest "still in flight"
- * reason instead of the supervisor's generic kill. The reserve has to cover
- * the longest tail a facet can have after the drain: settling pending RPC,
- * writing back __vfsWrites (bounded by MAX_RPC_SAFE_PAYLOAD_BYTES; a 20 MiB
- * write-back measures ~1.5s), draining children, then reportExit.
- */
-export const ONE_SHOT_EXIT_RESERVE_MS = 3_000;
-/**
- * Budget used when the supervisor did not stamp an absolute deadline on the
- * payload. The deadline is the real bound — see `entryDeadlineAt` — because
- * it is measured from the supervisor's own timer rather than restarted when
- * the drain begins, so a slow module init cannot push the drain past the kill
- * and lose the honest message.
- */
-export const ONE_SHOT_ENTRY_DEADLINE_MS = FACET_TIMEOUT_MS - ONE_SHOT_EXIT_RESERVE_MS;
 /**
  * How long a RESIDENT facet settles its startup before answering its boot
  * call. It keeps running afterwards, so this is not a lifetime decision: the
@@ -171,8 +147,11 @@ export const RESIDENT_BOOT_SETTLE_MS = 1000;
  * servers, requests in flight. A promise is not a handle: a program whose
  * last act leaves `new Promise(() => {})` unsettled prints its output and
  * exits 0. Counting unsettled promises as work was a real divergence from
- * that — such a program burned the whole facet lifetime and was then
- * reported as having not finished.
+ * that — such a program's drain used to end early and it was
+ * reported as having not finished. A user-invoked program runs this loop
+ * with NO deadline — Node itself has no wall-clock kill; the only endings
+ * are the program's exit and a signal. Callers that still pass a finite
+ * deadline (the resident boot settle) arm the expiry timer.
  *
  * Three kinds of handle, each owned by the shim that creates them:
  *
@@ -185,13 +164,6 @@ export const RESIDENT_BOOT_SETTLE_MS = 1000;
  *   - listening SERVERS (`__portRegistry`), open until the program closes
  *     them.
  *
- * The bound is a REAL wall-clock deadline, armed as a timer rather than
- * compared against `Date.now()`: a `setTimeout(0)` turn in workerd costs
- * ~5µs, so the pass budget this loop used to carry (50k) expired after
- * ~150ms and silently overrode every longer deadline the callers declared —
- * anything slower than that, including an ordinary network fetch, was
- * abandoned mid-flight and reported as a clean exit.
- *
  * The loop subscribes to the exit promise ONCE — a per-pass
  * `exitPromise.then()` allocates a promise every iteration — and yields
  * through the raw setTimeout so its own ticks don't inflate the timer count
@@ -228,16 +200,21 @@ async function __nimbusRunEventLoop(__countHandles, __exitPromise, __deadlineMs,
     ? globalThis.__nimbusRawClearTimeout
     : globalThis.clearTimeout;
   let __expired = false;
-  const __deadline = __rawSetTimeout(() => { __expired = true; }, __deadlineMs);
   let __pass = 0;
+  // A user-invoked program runs until it exits or is killed — there is no
+  // wall-clock deadline, so no expiry timer is armed at all. (Callers that
+  // still pass a finite deadline get the timer for compatibility.)
+  const __deadline = Number.isFinite(__deadlineMs)
+    ? __rawSetTimeout(() => { __expired = true; }, __deadlineMs)
+    : null;
   while (!__exited && !__expired && (__pass < __minPasses || __countHandles() > 0)) {
     // The warm-up passes give a settling microtask chain its turns and cost
     // ~5µs each; past them the loop is waiting on wall-clock work, where
-    // spinning at 0ms would burn the isolate's CPU for the whole deadline.
+    // spinning at 0ms would burn the isolate's CPU indefinitely.
     await new Promise((resolve) => __rawSetTimeout(resolve, __pass < __minPasses ? 0 : 1));
     __pass++;
   }
-  try { __rawClearTimeout(__deadline); } catch {}
+  if (__deadline !== null) { try { __rawClearTimeout(__deadline); } catch {} }
   // \`pending\` is what the caller reports when it gives up: a one-shot program
   // still holding a handle did NOT finish, and exiting 0 would claim it did.
   return { passes: __pass, pending: __exited ? 0 : __countHandles() };
@@ -392,7 +369,7 @@ const SQLITE_FACET_IMPORT = `import __nimbusSqliteWasmModule from "${SQLITE_WASM
 /**
  * Generate one-shot runtime code with a plain fetch handler.
  */
-export async function generateEntrypointCode(userCode, vfsState, usesSqlite, shims) {
+export async function generateEntrypointCode(userCode, vfsState, usesSqlite, shims, wasmImports = []) {
     const safeCode = JSON.stringify(userCode);
     const bundleSource = await facetVfsBundleSourceFor(vfsState);
     const safeManifest = vfsState.serializedManifest ?? JSON.stringify(vfsState.manifest);
@@ -402,6 +379,7 @@ export async function generateEntrypointCode(userCode, vfsState, usesSqlite, shi
 ${bundleSource.imports}
 ${REAL_NODE_IMPORTS}
 ${usesSqlite ? SQLITE_FACET_IMPORT : ''}
+${facetWasmImportsSource(wasmImports)}
 const USER_CODE = ${safeCode};
 const __NimbusHostResponse = globalThis.Response;
 
@@ -451,20 +429,16 @@ class __ProcessExit extends Error {
 export default {
   async fetch(request, workerEnv) {
     const args = await request.json();
-    const { argv, env, cwd: _cwd, filename, dirname, stdin, captureOutput, cred, diag: __diag, entryDeadlineAt, vfsCursor } = args;
+    const { argv, env, cwd: _cwd, filename, dirname, stdin, captureOutput, cred, diag: __diag, vfsCursor } = args;
     // Per invocation, not per module: this body is cached on
     // hash(code + bundle + manifest) and reused by any session whose snapshot
     // hashes the same, and epochs are per supervisor incarnation.
     const __MODULE_VFS_CURSOR = vfsCursor || null;
 ${VFS_CURSOR_SEED_SOURCE}
-    // What is left of this facet's lifetime, measured from the supervisor's
-    // own timeout timer rather than from whenever the drain happens to start
-    // — a slow module init must not be able to push the drain past the kill
-    // and lose the honest reason. Same shape as the git network facet's
-    // phaseDeadline.
-    const __entryBudgetMs = Number.isFinite(entryDeadlineAt)
-      ? Math.max(0, Number(entryDeadlineAt) - Date.now())
-      : ${ONE_SHOT_ENTRY_DEADLINE_MS};
+    // A user-invoked program has no wall-clock lifetime: the drain runs the
+    // entrypoint's event loop until Node would exit, and only a kill (Ctrl-C)
+    // ends it early.
+    const __entryBudgetMs = Infinity;
     let __drainPasses = 0;
     const __vfsBundle = __MODULE_VFS_BUNDLE;
     const __vfsManifest = __MODULE_VFS_MANIFEST;
@@ -483,11 +457,12 @@ ${VFS_CURSOR_SEED_SOURCE}
     };
     let __rpcWriteChain = Promise.resolve();
     let __rpcWriteCount = 0;
-    const __queueRpcWrite = (method, s) => {
+    // The relay carries bytes (see "Process output is bytes" in the shims).
+    const __queueRpcWrite = (method, bytes) => {
       __rpcWriteCount++;
       const __task = __rpcWriteChain
-        .then(() => __supervisor[method](s))
-        .catch((e) => __onRpcDrop(s.length, e));
+        .then(() => __supervisor[method](bytes))
+        .catch((e) => __onRpcDrop(bytes.byteLength, e));
       __rpcWriteChain = __task.then(() => {}, () => {});
       __pendingIO.push(__task);
     };
@@ -506,13 +481,13 @@ ${RESIDENCY_MISS_REPORT}
 
     // Override console AND process.stdout/stderr for live SUPERVISOR streaming
     if (__supervisor && !captureOutput) {
-      __consoleMod.log = (...a) => { const s = __utilMod.format(...a) + "\\n"; stdout += s; __queueRpcWrite("stdout", s); };
-      __consoleMod.error = (...a) => { const s = __utilMod.format(...a) + "\\n"; stderr += s; __queueRpcWrite("stderr", s); };
+      __consoleMod.log = (...a) => { const s = __utilMod.format(...a) + "\\n"; stdout += s; __queueRpcWrite("stdout", __nimbusOutEnc.encode(s)); };
+      __consoleMod.error = (...a) => { const s = __utilMod.format(...a) + "\\n"; stderr += s; __queueRpcWrite("stderr", __nimbusOutEnc.encode(s)); };
       __consoleMod.warn = __consoleMod.error;
       __consoleMod.info = __consoleMod.log;
       __consoleMod.debug = __consoleMod.log;
-      __processMod.stdout.write = (d, enc, cb) => { if (typeof enc === "function") cb = enc; const s = String(d); stdout += s; __queueRpcWrite("stdout", s); if (typeof cb === "function") queueMicrotask(cb); return true; };
-      __processMod.stderr.write = (d, enc, cb) => { if (typeof enc === "function") cb = enc; const s = String(d); stderr += s; __queueRpcWrite("stderr", s); if (typeof cb === "function") queueMicrotask(cb); return true; };
+      __processMod.stdout.write = (d, enc, cb) => { if (typeof enc === "function") cb = enc; const b = __nimbusOutBytes(d, enc); stdout += __nimbusOutText("stdout", b); __queueRpcWrite("stdout", b); if (typeof cb === "function") queueMicrotask(cb); return true; };
+      __processMod.stderr.write = (d, enc, cb) => { if (typeof enc === "function") cb = enc; const b = __nimbusOutBytes(d, enc); stderr += __nimbusOutText("stderr", b); __queueRpcWrite("stderr", b); if (typeof cb === "function") queueMicrotask(cb); return true; };
     }
 
     try { globalThis.console = __consoleMod; } catch {}
@@ -543,18 +518,7 @@ ${RESIDENCY_MISS_REPORT}
       const __drain = await __nimbusRunEntrypointToExit(__entryResult, __entryBudgetMs);
       __drainPasses = __drain.passes;
       if (__nimbusProcessExitCode !== null) exitCode = __nimbusProcessExitCode;
-      // This facet's lifetime IS the event loop, so a handle still open when
-      // the deadline passes is work that will never run. Reporting exit 0
-      // there is the silent-truncation failure: name the limit and fail.
-      else if (__drain.pending > 0) {
-        const __why = "node: reached the ${FACET_TIMEOUT_MS / 1000}s facet lifetime limit with " +
-          __drain.pending + " operation(s) still in flight; the rest of the program did not run. " +
-          "A program that needs longer than ${FACET_TIMEOUT_MS / 1000}s has to run as a " +
-          "long-running process (node --watch, or a server), which is not bound by it.\\n";
-        stderr += __why;
-        exitCode = 1;
-        if (__supervisor && !captureOutput) __queueRpcWrite("stderr", __why);
-      }
+
       if (__nimbusLiveStdinPump && !__nimbusAttachedTty) await __nimbusLiveStdinPump;
     } catch (e) {
       if (e instanceof __ProcessExit) { exitCode = e.code; }
@@ -563,7 +527,7 @@ ${RESIDENCY_MISS_REPORT}
         stderr += trace + "\\n";
         exitCode = 1;
         if (__supervisor && !captureOutput) {
-          try { __pendingIO.push(__supervisor.stderr(trace + "\\n").catch((e2) => __onRpcDrop((trace || "").length + 1, e2))); } catch {}
+          try { const __traceBytes = __nimbusOutEnc.encode(trace + "\\n"); __pendingIO.push(__supervisor.stderr(__traceBytes).catch((e2) => __onRpcDrop(__traceBytes.byteLength, e2))); } catch {}
         }
       }
     }
@@ -589,7 +553,7 @@ ${RESIDENCY_MISS_REPORT}
     if (__residencyReport) {
       stderr += __residencyReport;
       if (exitCode === 0) exitCode = 1;
-      if (__supervisor && !captureOutput) __queueRpcWrite("stderr", __residencyReport);
+      if (__supervisor && !captureOutput) __queueRpcWrite("stderr", __nimbusOutEnc.encode(__residencyReport));
     }
 
     await __drainPendingIO();
@@ -603,7 +567,7 @@ ${RESIDENCY_MISS_REPORT}
         exitCode = 1;
         if (!captureOutput) {
           try {
-            await __supervisor.stderr(trace + "\\n");
+            await __supervisor.stderr(__nimbusOutEnc.encode(trace + "\\n"));
           } catch {}
         }
       }
@@ -653,6 +617,61 @@ ${RESIDENCY_MISS_REPORT}
  * compiled user entry is booted once and the exported entrypoint keeps
  * serving HTTP requests from the shimmed http.Server registry.
  */
+/**
+ * Hand a record's entries to a consumer one at a time, releasing each as it
+ * goes, so the record stops being a second holder of the whole set.
+ *
+ * The image store takes its images as a sequence for exactly this: a launch's
+ * module text is the largest thing the coordinator assembles, and holding it
+ * in two places at once is what the 128 MiB isolate could not survive.
+ */
+function* drainSources(sources) {
+    for (const name of Object.keys(sources)) {
+        const source = sources[name];
+        delete sources[name];
+        yield [name, source];
+    }
+}
+/** The module-map name a precompiled wasm image travels under. */
+export function facetWasmModuleName(index) {
+    return `__nimbus_wasm_${index}.wasm`;
+}
+/**
+ * The wasm imports one launch stages: the images its options name, then
+ * every image the closure walk recorded (FacetVfsState.wasmImages) that the
+ * options did not already name by path. One member per path; the closure's
+ * record supplies the digest an option without one lacks.
+ */
+export function facetWasmImports(named, closure) {
+    const byPath = new Map();
+    for (const image of named)
+        byPath.set(image.vfsPath, image);
+    for (const image of closure) {
+        const seen = byPath.get(image.vfsPath);
+        if (seen === undefined)
+            byPath.set(image.vfsPath, image);
+        else if (seen.digest === undefined)
+            byPath.set(image.vfsPath, { ...seen, digest: image.digest });
+    }
+    return [...byPath.values()].map((image, index) => ({ ...image, moduleName: facetWasmModuleName(index) }));
+}
+/**
+ * The static imports that compile a launch's wasm images at module eval and
+ * park them by VFS path for the node-shims WebAssembly seam.
+ */
+function facetWasmImportsSource(wasmImports) {
+    if (wasmImports.length === 0)
+        return '';
+    const lines = wasmImports.map((entry, index) => `import __nimbusWasm${index} from ${JSON.stringify(entry.moduleName)};`);
+    const entries = wasmImports.map((entry, index) => `[${JSON.stringify(stripLeadingSlashes(entry.vfsPath))}, __nimbusWasm${index}]`);
+    const byDigest = wasmImports
+        .map((entry, index) => (entry.digest === undefined
+        ? null
+        : `[${JSON.stringify(entry.digest)}, __nimbusWasm${index}]`))
+        .filter((line) => line !== null);
+    return `${lines.join('\n')}\nglobalThis.__nimbusPrecompiledWasm = new Map([${entries.join(', ')}]);`
+        + `\nglobalThis.__nimbusPrecompiledWasmByDigest = new Map([${byDigest.join(', ')}]);`;
+}
 export async function generateLongRunningNodeCode(userCode, vfsState, opts, usesSqlite, shims, pacer) {
     const safeCode = JSON.stringify(userCode);
     const safeArgs = JSON.stringify({
@@ -666,14 +685,15 @@ export async function generateLongRunningNodeCode(userCode, vfsState, opts, uses
         cred: opts.cred,
     });
     const bundleSource = await facetVfsBundleSourceFor(vfsState, pacer);
-    const safeManifest = JSON.stringify(vfsState.manifest);
-    const safeMetadata = JSON.stringify(vfsState.metadata);
+    const safeManifest = vfsState.serializedManifest ?? JSON.stringify(vfsState.manifest);
+    const safeMetadata = vfsState.serializedMetadata ?? JSON.stringify(vfsState.metadata);
     return {
         code: `
 ${bundleSource.imports}
 import { DurableObject } from "cloudflare:workers";
 ${REAL_NODE_IMPORTS}
 ${usesSqlite ? SQLITE_FACET_IMPORT : ''}
+${facetWasmImportsSource(opts.wasmImports ?? [])}
 const USER_CODE = ${safeCode};
 const __NIMBUS_ARGS = ${safeArgs};
 const __NimbusHostResponse = globalThis.Response;
@@ -829,11 +849,12 @@ ${VFS_CURSOR_SEED_SOURCE}
     };
     let __rpcWriteChain = Promise.resolve();
     let __rpcWriteCount = 0;
-    const __queueRpcWrite = (method, s) => {
+    // The relay carries bytes (see "Process output is bytes" in the shims).
+    const __queueRpcWrite = (method, bytes) => {
       __rpcWriteCount++;
       const __task = __rpcWriteChain
-        .then(() => __supervisor[method](s))
-        .catch((e) => __onRpcDrop(s.length, e));
+        .then(() => __supervisor[method](bytes))
+        .catch((e) => __onRpcDrop(bytes.byteLength, e));
       __rpcWriteChain = __task.then(() => {}, () => {});
       __pendingIO.push(__task);
     };
@@ -851,13 +872,13 @@ ${ENTRYPOINT_EVENT_LOOP}
 ${RESIDENCY_MISS_REPORT}
 
     if (__supervisor && !captureOutput) {
-      __consoleMod.log = (...a) => { const s = __utilMod.format(...a) + "\\n"; stdout += s; __queueRpcWrite("stdout", s); };
-      __consoleMod.error = (...a) => { const s = __utilMod.format(...a) + "\\n"; stderr += s; __queueRpcWrite("stderr", s); };
+      __consoleMod.log = (...a) => { const s = __utilMod.format(...a) + "\\n"; stdout += s; __queueRpcWrite("stdout", __nimbusOutEnc.encode(s)); };
+      __consoleMod.error = (...a) => { const s = __utilMod.format(...a) + "\\n"; stderr += s; __queueRpcWrite("stderr", __nimbusOutEnc.encode(s)); };
       __consoleMod.warn = __consoleMod.error;
       __consoleMod.info = __consoleMod.log;
       __consoleMod.debug = __consoleMod.log;
-      __processMod.stdout.write = (d, enc, cb) => { if (typeof enc === "function") cb = enc; const s = String(d); stdout += s; __queueRpcWrite("stdout", s); if (typeof cb === "function") queueMicrotask(cb); return true; };
-      __processMod.stderr.write = (d, enc, cb) => { if (typeof enc === "function") cb = enc; const s = String(d); stderr += s; __queueRpcWrite("stderr", s); if (typeof cb === "function") queueMicrotask(cb); return true; };
+      __processMod.stdout.write = (d, enc, cb) => { if (typeof enc === "function") cb = enc; const b = __nimbusOutBytes(d, enc); stdout += __nimbusOutText("stdout", b); __queueRpcWrite("stdout", b); if (typeof cb === "function") queueMicrotask(cb); return true; };
+      __processMod.stderr.write = (d, enc, cb) => { if (typeof enc === "function") cb = enc; const b = __nimbusOutBytes(d, enc); stderr += __nimbusOutText("stderr", b); __queueRpcWrite("stderr", b); if (typeof cb === "function") queueMicrotask(cb); return true; };
     }
 
     try { globalThis.console = __consoleMod; } catch {}
@@ -911,7 +932,7 @@ ${RESIDENCY_MISS_REPORT}
         stderr += trace + "\\n";
         exitCode = 1;
         if (__supervisor && !captureOutput) {
-          try { __pendingIO.push(__supervisor.stderr(trace + "\\n").catch((e2) => __onRpcDrop((trace || "").length + 1, e2))); } catch {}
+          try { const __traceBytes = __nimbusOutEnc.encode(trace + "\\n"); __pendingIO.push(__supervisor.stderr(__traceBytes).catch((e2) => __onRpcDrop(__traceBytes.byteLength, e2))); } catch {}
         }
       }
     }
@@ -940,7 +961,7 @@ ${RESIDENCY_MISS_REPORT}
       if (__residencyReport) {
         stderr += __residencyReport;
         if (Number(code ?? 0) === 0) code = 1;
-        try { await __supervisor.stderr(__residencyReport); } catch {}
+        try { await __supervisor.stderr(__nimbusOutEnc.encode(__residencyReport)); } catch {}
       }
       await __supervisor.reportExit(code, reason || "");
       __nimbusProcessExitReported = true;
@@ -949,7 +970,7 @@ ${RESIDENCY_MISS_REPORT}
       const trace = (e && e.stack) || (e && e.message) || String(e);
       stderr += trace + "\\n";
       if (__supervisor) {
-        try { await __supervisor.stderr(trace + "\\n"); } catch {}
+        try { await __supervisor.stderr(__nimbusOutEnc.encode(trace + "\\n")); } catch {}
         await __nimbusReportFinalExit(1, trace + "\\n");
       }
     };
@@ -998,7 +1019,7 @@ ${RESIDENCY_MISS_REPORT}
       const tail = "[orphan output: " + __rpcDrops + " dropped RPC write(s), ~" +
         __rpcDropBytes + " bytes lost" +
         (__rpcLastError ? "; last error: " + __rpcLastError : "") + "]\\n";
-      try { await __supervisor.stderr(tail); } catch {}
+      try { await __supervisor.stderr(__nimbusOutEnc.encode(tail)); } catch {}
     }
     if (exitCode !== 0) {
       if (__supervisor && !__nimbusProcessExitReported) {
@@ -1054,16 +1075,15 @@ export class NimbusProcess extends DurableObject {
  * `bundleSource`, `serializedManifest` and `serializedMetadata` are total
  * encodings of `bundle`, `manifest` and `metadata` — no caller can distinguish
  * a state carrying both from one carrying only the serialized halves, because
- * `generateEntrypointCode` reads the serialized halves and nothing else does.
+ * both facet generators read the serialized halves and nothing else does.
  * Holding both doubles the cost of a cached entry for its whole lifetime, and
  * that lifetime spans execs.
  *
- * Only for states on the one-shot cached path, and applied there whether or
- * not the entry turns out small enough to retain: the invocation being served
- * reads the serialized forms too. `spawnNode` and `_stageOpencodeFacet` build
- * their own uncached states and genuinely re-read the raw cells
- * (`_serializeBundleForFacet`, `assertStagedBundleFitsRpcPayload`); neither
- * goes through here.
+ * Applied by `_buildProcessBundle` to every state it builds, whether or not
+ * the entry turns out small enough to retain: the launch being served reads
+ * the serialized forms too. `_stageOpencodeFacet` builds its own uncached
+ * state and genuinely re-reads the raw cells
+ * (`assertStagedBundleFitsRpcPayload`); it does not go through here.
  */
 export function releaseSerializedSources(vfsState) {
     if (vfsState.bundleSource)
@@ -1073,31 +1093,6 @@ export function releaseSerializedSources(vfsState) {
     if (vfsState.serializedMetadata !== undefined)
         vfsState.metadata = {};
 }
-/**
- * Drop everything a resident launch has finished reading, in place.
- *
- * The one-shot path releases its map at LOADER.load; this is the same policy
- * for the path `spawnNode` takes, which is the path every attached-TTY npm bin
- * takes — how a real agentic CLI starts. The generated source is a total
- * encoding of the cells, the manifest and the metadata, and the only thing the
- * rest of a launch reads off the state is `cursor`. Everything else is a second
- * copy of the largest thing this DO builds — 22.9 MB for pi — held for exactly
- * as long as the facet takes to boot on it.
- *
- * Holding it reset the session isolate with exceededMemory, and an isolate
- * reset tears the terminal WebSocket down with no exit frame: the dead screen
- * reading "[process terminal closed]".
- *
- * An emptied state can still generate a map — it would just generate one with
- * no program in it — so this marks the state instead of trusting callers to
- * stop.
- */
-export function releaseResidentLaunchSources(vfsState) {
-    vfsState.bundle = {};
-    vfsState.manifest = {};
-    vfsState.metadata = {};
-    vfsState.generatedSourcesReleased = true;
-}
 /**
  * Drop the serialized forms once a module map has been generated from them.
  *
@@ -1105,12 +1100,19 @@ export function releaseResidentLaunchSources(vfsState) {
  * bundle expression, the manifest and the metadata is inside it. Holding them
  * afterwards keeps a second copy of the largest thing this DO builds alive for
  * as long as the facet runs — for pi, 22.7 MB across the ~20 s window in which
- * the isolate was being reset.
+ * the isolate was being reset. For the one-shot path that window is the run;
+ * for a resident launch — the path every attached-TTY npm bin takes, how a
+ * real agentic CLI starts — it is the boot, and holding the copy across it
+ * reset the session isolate with exceededMemory, which tears the terminal
+ * WebSocket down with no exit frame: the dead screen reading "[process
+ * terminal closed]".
  *
  * Only for a state the prefetch cache refused. A retained entry's serialized
- * forms ARE the entry, and a later exec is served from them.
+ * forms ARE the entry, and a later launch is served from them. An emptied
+ * state could still generate a map — one with no program in it — so this
+ * marks the state instead of trusting callers to stop.
  */
-function releaseGeneratedSources(vfsState) {
+export function releaseGeneratedSources(vfsState) {
     vfsState.bundleSource = undefined;
     vfsState.serializedManifest = undefined;
     vfsState.serializedMetadata = undefined;
@@ -1163,6 +1165,29 @@ function _readBundleCell(vfs, path) {
 function _bundleCellLength(cell) {
     return typeof cell === 'string' ? cell.length : cell.byteLength;
 }
+/**
+ * Pre-read admission check for a bundle candidate: refuse BEFORE reading
+ * when the file's on-disk size already exceeds the remaining bundle budget
+ * or the caller's per-file ceiling. Without this every helper read a file
+ * in full, then discarded it when the post-read `cellLen` check tripped —
+ * on trees with several 5–10 MiB artifacts that read alone was the memory
+ * pressure that reset the isolate.
+ *
+ * `perFileCeiling` is the pass's own cap (e.g. CWD_SNAPSHOT_MAX_FILE_BYTES,
+ * BIN_PACKAGE_SPECULATIVE_MAX_FILE_BYTES); omit it for budget-only checks.
+ */
+function _bundleAdmits(vfs, path, budgetState, perFileCeiling) {
+    let size;
+    try {
+        size = vfs.lstat(path).size;
+    }
+    catch {
+        return false;
+    }
+    if (perFileCeiling !== undefined && size > perFileCeiling)
+        return false;
+    return budgetState.totalBytes + size <= VFS_BUNDLE_MAX_BYTES;
+}
 /** What a bundle currently weighs, and so what one more pass over it costs. */
 function _bundleWeight(bundle) {
     let weight = 0;
@@ -1767,12 +1792,16 @@ function addUnreadableDenialCells(vfs, bundle, metadata) {
  * computed-path requires). Bounded to package.json + 1 main-entry file
  * per package — sub-agent §Q3 quantified the worst-case cumulative
  * budget impact (~322 KiB for fastify, ~1.7 MiB for ts-jest).
+ *
+ * `requiredPaths` is the static require closure. A package the closure
+ * already reached — but reached only through a SUBPATH — has its main entry
+ * skipped; see `mainIsSpeculative`.
  */
 // can verify the hash-chunk + shared/ oversample directly. Pre-X.5-C this
 // was a file-local helper. Adding the named export is a pure surface
 // addition — no callers other than buildPrefetchBundle (same file) and
 // the new probe.
-export function greedyAddMainEntries(vfs, cwd, bundle, budgetState) {
+export function greedyAddMainEntries(vfs, cwd, bundle, budgetState, requiredPaths = new Set()) {
     let added = 0;
     const cwdStripped = cwd.replace(/^\/+/, '');
     const nmDir = cwdStripped + '/node_modules';
@@ -1798,7 +1827,16 @@ export function greedyAddMainEntries(vfs, cwd, bundle, budgetState) {
             // supervisor's headroom — on every invocation that never reads it.
             // Anything the program really requires arrives through the closure,
             // which is uncapped.
-            if (vfs.lstat(stripped).size > BIN_PACKAGE_SPECULATIVE_MAX_FILE_BYTES)
+            if (!_bundleAdmits(vfs, stripped, budgetState, BIN_PACKAGE_SPECULATIVE_MAX_FILE_BYTES))
+                return false;
+            // A guess must not be a native binary. Nothing in a Workers isolate can
+            // load a `.node` addon or a `.exe` — the ABI policy classifies them
+            // native-unsupported and the installer says so at install time — so
+            // admitting one spends the budget on bytes no code path can reach.
+            // Measured: freeing 1.3 MiB of rollup let `@napi-rs/lzma-linux-x64-gnu`'s
+            // 1,445,448-byte `.node` in, which the size guard had been evicting.
+            // Only the guess is filtered; a path the closure requires is untouched.
+            if (stripped.endsWith('.node') || stripped.endsWith('.exe'))
                 return false;
             // hardening-r5: preserve binary content as Uint8Array.
             const content = _readBundleCell(vfs, stripped);
@@ -1835,8 +1873,42 @@ export function greedyAddMainEntries(vfs, cwd, bundle, budgetState) {
                 collectExportLeaves(node[k], out);
         }
     }
+    /**
+     * Whether guessing at `pkgDir`'s main entry is still a guess.
+     *
+     * It is, for a package nothing required: that is what this pass exists for,
+     * and a dynamic `require(variable)` leaves no edge to follow. It is NOT for
+     * a package the closure reached only through a subpath export — there the
+     * program has told us exactly which corner of the package it uses, and the
+     * main entry is a different graph that no require reaches. Adding it anyway
+     * is how `rollup/parseAst` (7.9 KB of binding) dragged in rollup's whole
+     * bundler: `dist/shared/rollup.js` at 941 KB and, through the `module`
+     * candidate, `dist/es/shared/node-entry.js` at 951 KB — measured together
+     * as 46.5% of a real-vite snapshot, reached by no require in it.
+     *
+     * A package that loads its own main from a subpath at runtime does so
+     * through a static edge, so it is in the closure and unaffected.
+     */
+    function mainIsSpeculative(pkgDir) {
+        const prefix = pkgDir.replace(/^\/+/, '') + '/';
+        let reached = false;
+        for (const path of requiredPaths) {
+            if (!path.startsWith(prefix))
+                continue;
+            // package.json alone is resolution metadata, not a use of the package.
+            if (path === prefix + 'package.json')
+                continue;
+            reached = true;
+            break;
+        }
+        return !reached;
+    }
     function addPkgEntry(pkgDir) {
         addOne(pkgDir + '/package.json');
+        // A package the closure reached keeps exactly what it reached; only an
+        // unreached one gets the guess below.
+        if (!mainIsSpeculative(pkgDir))
+            return;
         let meta;
         try {
             meta = JSON.parse(vfs.readFileString(pkgDir + '/package.json'));
@@ -1936,27 +2008,87 @@ export function greedyAddMainEntries(vfs, cwd, bundle, budgetState) {
             }
         }
     }
-    try {
-        for (const pkg of vfs.readdir(nmDir)) {
-            if (pkg.type !== 'directory')
-                continue;
-            const pkgDir = nmDir + '/' + pkg.name;
-            if (pkg.name.startsWith('@')) {
-                try {
-                    for (const sub of vfs.readdir(pkgDir)) {
-                        if (sub.type === 'directory')
-                            addPkgEntry(pkgDir + '/' + sub.name);
-                    }
-                }
-                catch { /* ignore */ }
-            }
-            else {
-                addPkgEntry(pkgDir);
+    for (const pkgDir of speculativePackageDirs(vfs, cwdStripped, bundle))
+        addPkgEntry(pkgDir);
+    return { added };
+}
+/**
+ * The packages a computed `require(name)` inside the program can plausibly
+ * name: the project root's own runtime `dependencies`, plus every package
+ * ONE `dependencies` hop from a package that already owns a file in the
+ * static closure. Never devDependencies, never a second hop.
+ *
+ * Unbounded, the greedy oversample read every installed package's main:
+ * for `node -e "import('got')"` in got's repo — a one-file static closure —
+ * that was 1,526 files / 10.9 MB from 706 packages, which every later pass
+ * re-scanned and esbuild-wasm transformed, and the exec path's 20 s bundle
+ * deadline fired on a program that reads none of it. A bound that followed
+ * dependency edges from the project's devDependencies reached all 772 of
+ * them (measured), because a library repo's dev toolchain reaches the whole
+ * tree. Computed requires almost always target a declared runtime
+ * dependency of the package doing the requiring, so the bound is one hop
+ * over `dependencies` only. Directories, sorted for a stable bundle.
+ */
+export function speculativePackageDirs(vfs, cwdStripped, bundle) {
+    const runtimeDeps = (pkgJsonPath) => {
+        try {
+            const meta = JSON.parse(vfs.readFileString(pkgJsonPath));
+            const names = new Set();
+            for (const field of ['dependencies', 'optionalDependencies']) {
+                const deps = meta?.[field];
+                if (deps && typeof deps === 'object')
+                    for (const name of Object.keys(deps))
+                        names.add(name);
             }
+            return [...names];
+        }
+        catch {
+            return [];
+        }
+    };
+    // The package that owns a bundle file: the last node_modules segment.
+    const ownerOf = (path) => {
+        const idx = path.lastIndexOf('/node_modules/');
+        if (idx === -1)
+            return null;
+        const segs = path.slice(idx + '/node_modules/'.length).split('/');
+        const name = segs[0]?.startsWith('@') ? segs.slice(0, 2).join('/') : segs[0];
+        return name ? path.slice(0, idx + '/node_modules/'.length) + name : null;
+    };
+    // Resolve a bare name the way require does from `fromDir`: the nearest
+    // node_modules up the tree that has it.
+    const resolveDir = (name, fromDir) => {
+        let dir = fromDir;
+        for (;;) {
+            const candidate = dir + '/node_modules/' + name;
+            if (vfs.exists(candidate + '/package.json'))
+                return candidate;
+            const idx = dir.lastIndexOf('/');
+            if (idx <= 0)
+                return null;
+            dir = dir.slice(0, idx);
+        }
+    };
+    const reached = new Set();
+    const hop = (fromDir) => {
+        for (const name of runtimeDeps(fromDir + '/package.json')) {
+            const dir = resolveDir(name, fromDir);
+            if (dir !== null)
+                reached.add(dir);
         }
+    };
+    hop(cwdStripped);
+    const owners = new Set();
+    for (const path of Object.keys(bundle)) {
+        const owner = ownerOf(path);
+        if (owner !== null)
+            owners.add(owner);
     }
-    catch { /* ignore */ }
-    return { added };
+    for (const owner of owners) {
+        reached.add(owner);
+        hop(owner);
+    }
+    return [...reached].sort();
 }
 /**
  * X.5-Z3: scan every JS source already in `bundle` for static
@@ -2026,6 +2158,8 @@ export function addStaticReadFileAssets(vfs, cwd, bundle, budgetState) {
         try {
             if (!vfs.exists(stripped) || vfs.isDirectory(stripped))
                 return false;
+            if (!_bundleAdmits(vfs, stripped, budgetState))
+                return false;
             // hardening-r5: preserve binary content as Uint8Array.
             const content = _readBundleCell(vfs, stripped);
             const cellLen = _bundleCellLength(content);
@@ -2199,6 +2333,8 @@ export function addStaticReadFileDotfilesAndCompiled(vfs, cwd, bundle, budgetSta
         try {
             if (!vfs.exists(stripped) || vfs.isDirectory(stripped))
                 return false;
+            if (!_bundleAdmits(vfs, stripped, budgetState))
+                return false;
             // hardening-r5: preserve binary content as Uint8Array.
             const content = _readBundleCell(vfs, stripped);
             const cellLen = _bundleCellLength(content);
@@ -2304,7 +2440,7 @@ export function addStaticReadFileDotfilesAndCompiled(vfs, cwd, bundle, budgetSta
  */
 export function addBinTargetSiblings(vfs, scriptPath, bundle, budgetState, bundleProfile) {
     if (!scriptPath)
-        return { added: 0 };
+        return { added: 0, wasmPaths: [] };
     const stripped = scriptPath.replace(/^\/+/, '');
     // Find the *innermost* node_modules/<pkg> root. Handles scoped
     // packages (`@org/name`) too.
@@ -2317,11 +2453,11 @@ export function addBinTargetSiblings(vfs, scriptPath, bundle, budgetState, bundl
         }
     }
     if (nmIdx < 0)
-        return { added: 0 };
+        return { added: 0, wasmPaths: [] };
     const isScoped = segs[nmIdx + 1]?.startsWith('@');
     const pkgEnd = isScoped ? nmIdx + 3 : nmIdx + 2;
     if (pkgEnd > segs.length)
-        return { added: 0 };
+        return { added: 0, wasmPaths: [] };
     const pkgRoot = segs.slice(0, pkgEnd).join('/');
     // npm-create-fix wave (2026-05-12): scaffold profile needs this cap
     // high enough to cover
@@ -2347,6 +2483,10 @@ export function addBinTargetSiblings(vfs, scriptPath, bundle, budgetState, bundl
     // an unread multi-MiB cell costs a stat rather than a transfer.
     let visited = 0;
     const candidates = [];
+    // Every wasm image under the package, whatever its size: an image rides in
+    // the module map by path and is compiled by the loader, so the bundle's
+    // per-file cap does not apply to it (see FacetVfsState.wasmImages).
+    const wasmPaths = [];
     const queue = [pkgRoot];
     while (queue.length > 0 && visited < MAX_PKG_FILES) {
         const dir = queue.shift();
@@ -2376,6 +2516,8 @@ export function addBinTargetSiblings(vfs, scriptPath, bundle, budgetState, bundl
             // to it) or outside this profile's package-data policy.
             if (!shouldIncludeBinPackageFile(pkgRoot, child, bundleProfile))
                 continue;
+            if (child.endsWith('.wasm'))
+                wasmPaths.push(child);
             if (bundle[child] !== undefined)
                 continue;
             let size;
@@ -2406,6 +2548,8 @@ export function addBinTargetSiblings(vfs, scriptPath, bundle, budgetState, bundl
             break;
         if (budgetState.totalBytes >= VFS_BUNDLE_MAX_BYTES)
             break;
+        if (candidate.size > VFS_BUNDLE_MAX_BYTES - budgetState.totalBytes)
+            continue;
         // hardening-r5: preserve binary content as Uint8Array.
         let content;
         try {
@@ -2424,7 +2568,40 @@ export function addBinTargetSiblings(vfs, scriptPath, bundle, budgetState, bundl
         budgetState.fileCount++;
         added++;
     }
-    return { added };
+    return { added, wasmPaths };
+}
+/**
+ * The wasm images a program's closure holds, by path and content digest.
+ *
+ * Two sources, one record: a `.wasm` cell the walk already staged (digested
+ * from the cell, no second read), and a `.wasm` file the bin-package pass
+ * saw but did not stage because it is over the bundle's per-file cap —
+ * esbuild-wasm's 11.9 MiB image is the motivating one. A launch stages each
+ * as a module-map member the loader compiles, registered under both keys,
+ * so the program's own `new WebAssembly.Module(bytes)` is answered from the
+ * map whether it read the bytes by path or carried them inline. A file that
+ * cannot be read is left out; the seam's refusal names the module later.
+ */
+export function collectClosureWasmImages(vfs, bundle, unstagedPaths) {
+    const byPath = new Map();
+    for (const [path, cell] of Object.entries(bundle)) {
+        if (!path.endsWith('.wasm') || !(cell instanceof Uint8Array))
+            continue;
+        byPath.set(path, { vfsPath: '/' + stripLeadingSlashes(path), digest: wasmImageDigest(cell) });
+    }
+    for (const path of unstagedPaths) {
+        if (byPath.has(path))
+            continue;
+        let bytes;
+        try {
+            bytes = vfs.readFile(path);
+        }
+        catch {
+            continue;
+        }
+        byPath.set(path, { vfsPath: '/' + stripLeadingSlashes(path), digest: wasmImageDigest(bytes) });
+    }
+    return [...byPath.values()];
 }
 /**
  * Stage the paths an earlier run of the same entry read synchronously and did
@@ -2608,13 +2785,8 @@ function addCwdProjectFiles(vfs, cwd, bundle, budgetState) {
             // Skip an oversized file before reading it: this walk guesses at what
             // the program might read, and one guess must not spend the budget (or
             // the supervisor's headroom) that every later invocation then carries.
-            try {
-                if (vfs.lstat(child).size > CWD_SNAPSHOT_MAX_FILE_BYTES)
-                    continue;
-            }
-            catch {
+            if (!_bundleAdmits(vfs, child, budgetState, CWD_SNAPSHOT_MAX_FILE_BYTES))
                 continue;
-            }
             let content;
             try {
                 content = _readBundleCell(vfs, child);
@@ -2684,6 +2856,8 @@ function addEntryAbsPathReads(vfs, entryCode, bundle, budgetState) {
         try {
             if (!vfs.exists(stripped) || vfs.isDirectory(stripped))
                 return;
+            if (!_bundleAdmits(vfs, stripped, budgetState))
+                return;
             // hardening-r5: preserve binary content as Uint8Array.
             const content = _readBundleCell(vfs, stripped);
             const cellLen = _bundleCellLength(content);
@@ -3036,7 +3210,7 @@ async function transformEsmInBundle(bundle, esbuild, pacer, isolatedTransform) {
  * behaviour for code paths that don't have esbuild handy).
  *
  */
-export async function buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bundleProfile = DEFAULT_FACET_BUNDLE_PROFILE, observedReads, pacer, isolatedTransform) {
+export async function buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bundleProfile = DEFAULT_FACET_BUNDLE_PROFILE, observedReads, pacer, isolatedTransform, maxBundleBytes) {
     // This build accumulates raw VFS contents in the supervisor heap, and did it
     // with nothing watching: the estimator read 9.4 MiB while these bytes were
     // resetting the DO three times. Take the budget the enrichment passes are
@@ -3046,19 +3220,25 @@ export async function buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbui
     const lease = await acquireSupervisorAllocation(VFS_BUNDLE_MAX_BYTES);
     prefetchBundleStart(VFS_BUNDLE_MAX_BYTES);
     try {
-        return await _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bundleProfile, observedReads, pacer, isolatedTransform);
+        return await _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bundleProfile, observedReads, pacer, isolatedTransform, maxBundleBytes);
     }
     finally {
         prefetchBundleEnd(VFS_BUNDLE_MAX_BYTES);
         lease.release();
     }
 }
-async function _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bundleProfile = DEFAULT_FACET_BUNDLE_PROFILE, observedReads, pacer, isolatedTransform) {
+async function _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bundleProfile = DEFAULT_FACET_BUNDLE_PROFILE, observedReads, pacer, isolatedTransform, maxBundleBytes = VFS_BUNDLE_MAX_BYTES) {
     // Read the cursor BEFORE the walk: a mutation that lands while the bundle
     // is being assembled must be reported as invalidated, not silently missed.
     const cursor = { epoch: vfs.epoch, rev: vfs.revision() };
     // 1. Static reachable-set walk from entry.
-    const prefetch = prefetchForRequire(vfs, entryCode || '', cwd, scriptPath);
+    const prefetch = prefetchForRequire(vfs, entryCode || '', cwd, scriptPath, maxBundleBytes);
+    if ('kind' in prefetch) {
+        // A required closure larger than the bound can never launch as a
+        // snapshot. Surface it as the process's own failure rather than a
+        // build error: the caller maps it to exit 1 + stderr.
+        throw new ClosureBoundExceededError(prefetch);
+    }
     const bundle = { ...prefetch.bundle };
     const requiredPaths = new Set(Object.keys(prefetch.bundle));
     let truncated = false;
@@ -3089,7 +3269,7 @@ async function _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bu
     //    Catches dynamic-require / `bindings()` / plugin-loader cases the
     //    regex prefetch misses. Its budget is independent from the complete
     //    static require closure, which is correctness-critical.
-    const greedy = greedyAddMainEntries(vfs, cwd, bundle, budgetState);
+    const greedy = greedyAddMainEntries(vfs, cwd, bundle, budgetState, requiredPaths);
     await paceAfterPass();
     // 2.25 X.5-Z3: static-readFileSync asset prefetch. Scans every
     //      bundle .js/.mjs/.cjs source for the canonical jsdom shape:
@@ -3122,7 +3302,6 @@ async function _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bu
     //      as data, etc.) without needing a per-pkg whitelist.
     //      No-op when entry isn't inside node_modules.
     const binSiblingAdd = addBinTargetSiblings(vfs, scriptPath, bundle, budgetState, bundleProfile);
-    void binSiblingAdd;
     await paceAfterPass();
     // 2.34 project-data snapshot: sync Node fs cannot await the
     // supervisor. Include a bounded snapshot of the current working tree
@@ -3238,6 +3417,7 @@ async function _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bu
     const bundleSideModulesRequired = size.bytes > BUNDLE_MAX_ENCODED_BYTES;
     // Suppress lint: `greedy.added` is observed only via diagnostics.
     void greedy;
+    const wasmImages = collectClosureWasmImages(vfs, bundle, binSiblingAdd.wasmPaths);
     return {
         bundle,
         manifest,
@@ -3246,11 +3426,21 @@ async function _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bu
         reachableCount: fileCount,
         truncated,
         bundleSideModulesRequired,
+        ...(wasmImages.length > 0 ? { wasmImages } : {}),
     };
 }
+/** The main module name a worker launch boots from unless told otherwise. */
+export const DEFAULT_WORKER_MAIN_MODULE = 'worker.js';
 const ROUTEABLE_PORT_ATTACH_TIMEOUT_MS = 1_000;
 /** A port request may wait this long for a durable app's re-drive to boot. */
 const DURABLE_ENSURE_BOOT_BUDGET_MS = 12_000;
+/** The env var a launch reads its restart policy from — set by startProcess({ restart }) and `nimbus start --restart`. */
+export const RESTART_POLICY_ENV = 'NIMBUS_RESTART';
+/** Backoff per spent FencedWork attempt; a healthy boot resets that existing budget. */
+const RESTART_BACKOFF_BASE_MS = 1_000;
+function residentRestartPolicy(env) {
+    return env?.[RESTART_POLICY_ENV] === 'on-failure' ? 'on-failure' : 'never';
+}
 /**
  * The durable owner a journal row serves: the row's stamped field for
  * reservation-claimed residents, falling back to the worker recipe's own
@@ -3306,7 +3496,6 @@ export class FacetManager {
      * journal recovery rides the first pump.
      */
     launchPump;
-    timedOutProcessIds = new Set();
     // attach-pid → serve-pid: the resident serve facet a bare-`opencode` dual
     // spawn created as an OS-child of the attach TUI. When the attach process
     // exits (reported / killed), its serve facet is torn down with it.
@@ -3351,6 +3540,15 @@ export class FacetManager {
     residencyProfiles = new Map();
     /** In-flight request-driven durable-app ensures, single-flight per port. */
     ensureInflight = new Map();
+    /** Per-pid chain of journal-row amendments; see `_amendRow`. */
+    rowAmendments = new Map();
+    /**
+     * pid → the derived owner it duplicates: the second live instance of an
+     * identity. Not journalled (nothing re-drives it), so this is the only
+     * record of why `expose(pid)` refuses it.
+     */
+    ephemeralPids = new Map();
+    residentClaims = new Map();
     static RESIDENCY_PROFILE_MAX_ENTRIES = 16;
     /**
      * A program that reads a directory of data files misses once per file, so
@@ -3401,9 +3599,100 @@ export class FacetManager {
         // Rooted on waitUntil: the hook fires synchronously inside whatever turn
         // ended the process, and the delete must not be a floating promise there.
         this.processes.setOnTerminal((pid) => {
-            this.ctx.waitUntil(this.launchJournal.release(pid));
+            this.ctx.waitUntil(this._onResidentTerminal(pid));
         });
     }
+    /**
+     * The process is over. Every end-of-life passes through here: a clean
+     * exit, a kill, a timeout, a crash. Only one of them owes anything more
+     * than the journal row's release — a crash under 'on-failure' is re-driven
+     * from the row, after a backoff, while the row is still in storage so a
+     * reset inside the backoff window recovers it like any other resident.
+     */
+    async _onResidentTerminal(pid) {
+        await this.rowAmendments.get(pid);
+        this.ephemeralPids.delete(pid);
+        await this._releaseResidentClaim(pid);
+        if (!this.launchJournal.has(pid))
+            return;
+        const entry = this.processes.get(pid);
+        const key = `${FENCED_WORK_KEY_PREFIX}${pid}`;
+        const row = (await this.launchJournal.rows()).get(key);
+        const crashed = entry?.state === 'exited' && (entry.exitCode ?? 0) !== 0;
+        if (row === undefined || row.restart !== 'on-failure' || !crashed) {
+            await this.launchJournal.release(pid);
+            return;
+        }
+        const delayMs = RESTART_BACKOFF_BASE_MS * 2 ** row.attempt;
+        this.hooks.notify?.(`\x1b[2m[nimbus: "${row.command}" exited with code ${entry.exitCode} — `
+            + `restarting in ${delayMs / 1000}s (FencedWork attempt ${row.attempt + 1})]\x1b[0m\r\n`);
+        await this.launchPump.nextTurn(Promise.resolve(), Date.now() + delayMs);
+        // The process may have been removed or the session destroyed during the
+        // backoff; a row that is gone is owed nothing.
+        if (!(await this.launchJournal.rows()).has(key))
+            return;
+        await this.launchJournal.drive(key, row);
+    }
+    /** Claim identity AND write its recovery row in one serializable storage transaction. */
+    async _claimResident(record) {
+        const owner = residentOwner(record);
+        if (owner === undefined)
+            throw new Error('resident launch has no owner');
+        const duplicate = await this.ctx.storage.transaction(async (txn) => {
+            const key = `${RESIDENT_OWNER_KEY_PREFIX}${owner}`;
+            const held = await txn.get(key);
+            if (held !== undefined && held !== record.pid && held > this.processes.pidBase
+                && this.processes.get(held)?.state === 'running')
+                return held;
+            await txn.put(key, record.pid);
+            await txn.put(`${FENCED_WORK_KEY_PREFIX}${record.pid}`, record);
+            return null;
+        });
+        if (duplicate === null) {
+            this.residentClaims.set(record.pid, owner);
+            // Adopt into FencedWork's per-instance lifetime bookkeeping and cross
+            // its sync barrier before booting. The winning row already exists.
+            await this.launchJournal.journal(record);
+        }
+        return duplicate;
+    }
+    async _releaseResidentClaim(pid) {
+        const owner = this.residentClaims.get(pid);
+        if (owner === undefined)
+            return;
+        this.residentClaims.delete(pid);
+        await this.ctx.storage.transaction(async (txn) => {
+            const key = `${RESIDENT_OWNER_KEY_PREFIX}${owner}`;
+            if (await txn.get(key) === pid)
+                await txn.delete(key);
+        });
+        await this.ctx.storage.sync();
+    }
+    /**
+     * Amend one journal row in place — port stamp, owner adoption, settle —
+     * serialized per pid so two amendments in flight on the same row cannot
+     * interleave their read and write and lose one another's fields.
+     */
+    _amendRow(pid, amend) {
+        const key = `${FENCED_WORK_KEY_PREFIX}${pid}`;
+        const previous = this.rowAmendments.get(pid) ?? Promise.resolve(undefined);
+        const next = previous.then(async () => {
+            const row = (await this.launchJournal.rows()).get(key);
+            if (row === undefined)
+                return undefined;
+            const amended = amend(row);
+            if (amended !== row)
+                await this.launchJournal.journal(amended);
+            return amended;
+        });
+        const settled = next.then(() => undefined, () => undefined);
+        this.rowAmendments.set(pid, settled);
+        void settled.then(() => {
+            if (this.rowAmendments.get(pid) === settled)
+                this.rowAmendments.delete(pid);
+        });
+        return next;
+    }
     setVfs(vfs) { this.vfs = vfs; }
     /**
      * The env/ctx pair every loader-backed runtime builds its facet pools
@@ -3454,61 +3743,92 @@ export class FacetManager {
      */
     setEsbuildService(esbuild) { this.esbuild = esbuild; }
     /**
-     * buildPrefetchBundle wrapped in a global-revision-keyed cache. On a hit
-     * (same key AND the VFS hasn't been mutated since) it returns the memoized
-     * bundle + pre-built facet source, skipping the full VFS walk + esbuild
-     * pass + source construction. See `prefetchBundleCache` for the
-     * correctness argument behind the conservative global-revision watermark.
-     *
-     * The bundle source and manifest are computed once on the miss path and
-     * stored so subsequent hits skip rebuilding them too.
+     * The pacer every launch is built under: the session's alarm-driven turn
+     * pump, the deployment's chunk bound, and the one check a suspended launch
+     * makes when it resumes — that the process it is building for still exists.
      */
+    _launchPacer(pid) {
+        return new TurnBudget(this.launchPump, turnChunkMaxBytes(this.env), () => this._assertLaunchStillOwned(pid));
+    }
     /**
-     * Bound the prefetch build, so a cache miss cannot be a silent hang.
+     * Assemble the filesystem bundle a process boots on, across as many
+     * Durable Object turns as it takes.
+     *
+     * The one builder for every Node process this manager starts. A one-shot
+     * exec and a resident launch used to own two copies of this: exec's was
+     * memoized behind the prefetch cache and raced a wall-clock deadline in a
+     * single turn; the resident's was paged with a TurnBudget and never cached.
+     * Two paths, one job — and a tree large enough to page on one path hit the
+     * deadline on the other, failing every `node -e` in it with "assembling the
+     * filesystem bundle … exceeded". What the two callers genuinely differ in is
+     * the entry, the working directory and the process they build for; that is
+     * all they supply. Everything else — the revision-keyed cache and its stale
+     * eviction, the residency profile a previous miss learned, the reachable-set
+     * walk and its enrichment passes, the ESM→CJS transform, the manifest and
+     * metadata, the module-map serialization with its side-module split, the
+     * `node:sqlite` answer, and the release of the raw cells once they are
+     * serialized — happens here, once, and yields the turn whenever a chunk's
+     * worth of it has been done.
+     *
+     * There is no deadline. A launch that spans turns costs turns, not a held
+     * thread, so a large tree is not a defect to be reported at N seconds; the
+     * pacer's `stillWanted` check is what ends a build nothing will use — a
+     * process killed while its build was suspended throws from the next resume,
+     * and the caller reports that as it reports any other launch failure.
      *
-     * The build was awaited entirely OUTSIDE `_execWithTimeout`, which wraps
-     * only `_execViaLoader`. So every timeout in the system — the 30 s facet
-     * bound, the 60 s bin-dispatch bound — sat downstream of a step that could
-     * take arbitrarily long, and a heavy build wedged the Durable Object with
-     * nothing able to report it. Observed as a terminal that goes quiet and
-     * never returns, with no exit record for the process.
+     * The returned state carries its serialized forms (`bundleSource`,
+     * `serializedManifest`, `serializedMetadata`) and has already released the
+     * raw ones: `generateEntrypointCode` and `generateLongRunningNodeCode` read
+     * the serialized forms and nothing else. A state the cache retained belongs
+     * to the cache — a caller must not release its serialized forms either
+     * (`cacheRetained` says which); one the cache refused belongs to the caller
+     * alone, and `releaseGeneratedSources` drops it once a map is generated.
      *
-     * WHAT THIS CAN AND CANNOT CATCH, stated plainly because the difference
-     * decides whether a given hang is fixed by it. The build is asynchronous —
-     * it awaits the VFS walk and the esbuild ESM→CJS pass — so a stall at any
-     * of those points is caught and reported here. A stall inside ONE
-     * synchronous stretch is not: a JS stack that never yields cannot be raced
-     * by anything in the same isolate, so serializing a multi-megabyte bundle
-     * in a single pass still wedges, and the deadline fires only once the stack
-     * finally unwinds. That class needs the work bounded at its INPUT rather
-     * than timed at its edge, which is a separate change; this one converts
-     * every interruptible stall from a silent wedge into a loud failure, and
-     * makes the remaining class the only one left to explain.
+     * A session without a filesystem gets an empty state: there is nothing to
+     * stage and nothing to yield for.
      */
-    async _withBundleBuildDeadline(build, command) {
-        let timer;
-        try {
-            return await Promise.race([
-                build,
-                new Promise((_resolve, reject) => {
-                    timer = setTimeout(() => reject(new Error(`Nimbus: assembling the filesystem bundle for \`${command}\` exceeded `
-                        + `${BUNDLE_BUILD_DEADLINE_MS}ms. The process was not started. This is the `
-                        + 'bundle build, not the program: it runs in the session Durable Object, so '
-                        + 'it is reported rather than allowed to wedge the session.')), BUNDLE_BUILD_DEADLINE_MS);
-                }),
-            ]);
-        }
-        finally {
-            if (timer !== undefined)
-                clearTimeout(timer);
-            // The build keeps running after a timeout — nothing here can interrupt
-            // it — so its rejection must not surface later as an unhandled one.
-            build.catch(() => { });
+    /**
+     * The closure's wasm images as module-map members for a one-shot facet,
+     * read by path under the process's own credential. An image that cannot
+     * be read is left out; the program's compile then meets the seam's own
+     * refusal, which names the module.
+     */
+    _wasmModulesByValue(entry, wasmImports) {
+        const modules = {};
+        if (!this.vfs || wasmImports.length === 0)
+            return modules;
+        const vfs = this.vfs.as(entry.cred);
+        for (const image of wasmImports) {
+            let bytes;
+            try {
+                bytes = vfs.readFile(stripLeadingSlashes(image.vfsPath));
+            }
+            catch {
+                continue;
+            }
+            modules[image.moduleName] = {
+                wasm: bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength),
+            };
         }
+        return modules;
     }
-    async _buildPrefetchBundleCached(vfs, scriptPath, cwd, entryCode, credKey, bundleProfile) {
-        const profile = bundleProfile ?? DEFAULT_FACET_BUNDLE_PROFILE;
-        const key = `${profile}\x00${credKey}\x00${cwd}\x00${scriptPath ?? ''}\x00${_fnv1a(entryCode)}`;
+    async _buildProcessBundle(entry, spec, pacer) {
+        if (!this.vfs) {
+            return { bundle: {}, manifest: {}, metadata: {}, reachableCount: 0, truncated: false };
+        }
+        // W3.5 Fix B: thread an EsbuildService into buildPrefetchBundle so ESM
+        // source files (e.g. tldts/dist/es6/index.js, @remix-run/react,
+        // @tailwindcss/vite, react-remove-scroll, astro) get transformed to CJS
+        // before they hit the facet's `new Function` pre-compile loop. Lazy-create
+        // one if NimbusSession didn't share its own.
+        if (!this.esbuild)
+            this.esbuild = new EsbuildService(this.vfs.as(CRED_KERNEL));
+        this.imageStore.ensureDir();
+        const vfs = this.vfs.as(entry.cred);
+        const { cred } = entry;
+        const profile = spec.bundleProfile ?? DEFAULT_FACET_BUNDLE_PROFILE;
+        const credKey = `${cred.uid}:${cred.gid}:${cred.groups.join(',')}`;
+        const key = `${profile}\x00${credKey}\x00${spec.cwd}\x00${spec.scriptPath ?? ''}\x00${_fnv1a(spec.entryCode)}`;
         const revision = vfs.revision();
         // An entry built at an older revision can never be SERVED again — the
         // lookup below requires an exact match — so from the first write after it
@@ -3517,11 +3837,11 @@ export class FacetManager {
         // replaces it allocates, so the stale filesystem graph and the new one
         // never co-reside.
         let evictedStale = false;
-        for (const [staleKey, entry] of this.prefetchBundleCache) {
-            if (entry.revision === revision)
+        for (const [staleKey, stale] of this.prefetchBundleCache) {
+            if (stale.revision === revision)
                 continue;
             this.prefetchBundleCache.delete(staleKey);
-            this.prefetchCacheBytes -= entry.bytes;
+            this.prefetchCacheBytes -= stale.bytes;
             evictedStale = true;
         }
         if (evictedStale)
@@ -3533,24 +3853,26 @@ export class FacetManager {
             this.prefetchBundleCache.set(key, cached);
             return { ...cached.vfsState, cacheHit: true, cacheRetained: true };
         }
-        const vfsState = await buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, this.esbuild || undefined, bundleProfile, this.residencyProfiles.get(key), undefined, this.hooks.transformLargeEsm);
+        const vfsState = await buildPrefetchBundle(vfs, spec.scriptPath, spec.cwd, spec.entryCode, this.esbuild, profile, this.residencyProfiles.get(key), pacer, this.hooks.transformLargeEsm);
         vfsState.bundleKey = key;
-        vfsState.bundleSource = await buildFacetVfsBundleSource(vfsState.bundle, vfsState.bundleSideModulesRequired);
+        vfsState.bundleSource = await buildFacetVfsBundleSource(vfsState.bundle, vfsState.bundleSideModulesRequired, pacer);
         vfsState.serializedManifest = JSON.stringify(vfsState.manifest);
         vfsState.serializedMetadata = JSON.stringify(vfsState.metadata);
+        // Two more serializations of the same weight as the passes before them.
+        await pacer.spend(vfsState.serializedManifest.length + vfsState.serializedMetadata.length);
         // The only consumer of the raw cells past this point is a single boolean,
         // so answer it now rather than hold ~17 MB (pi) to answer it later.
-        vfsState.usesNodeSqlite = bundleUsesNodeSqlite(entryCode, vfsState.bundle);
+        vfsState.usesNodeSqlite = bundleUsesNodeSqlite(spec.entryCode, vfsState.bundle);
         vfsState.cacheHit = false;
         // Serialization is total: bundleSource/serializedManifest/serializedMetadata
-        // carry every byte the raw cells and objects do, and generateEntrypointCode
-        // reads only the serialized forms. Retaining both doubled what an entry
-        // costs for its whole lifetime — measured for pi at 502af77, per entry:
-        // raw 17,253,610 + source 18,262,324 + manifest 600,060 + metadata
-        // 3,841,244 = 39,957,238 B, of which the raw halves are 21,694,914 B held
-        // to answer `usesNodeSqlite`. Dropping them is a pure release: nothing
-        // downstream of this method reads them, and a cache MISS rebuilds from the
-        // VFS rather than from anything discarded here.
+        // carry every byte the raw cells and objects do, and both generators read
+        // only the serialized forms. Retaining both doubled what an entry costs
+        // for its whole lifetime — measured for pi at 502af77, per entry: raw
+        // 17,253,610 + source 18,262,324 + manifest 600,060 + metadata 3,841,244
+        // = 39,957,238 B, of which the raw halves are 21,694,914 B held to answer
+        // `usesNodeSqlite`. Dropping them is a pure release: nothing downstream of
+        // this method reads them, and a cache MISS rebuilds from the VFS rather
+        // than from anything discarded here.
         //
         // Released BEFORE admission so the byte bound prices what the entry costs
         // from here on, not the peak it passed through on the way in.
@@ -3713,7 +4035,7 @@ export class FacetManager {
         if (opts.skipSpawn && opts.callerPid != null) {
             // The caller already allocated the PID via the supervisor
             // (with their own user-facing label). Look up the full entry
-            // from the table — _execWithTimeout etc. need the canonical
+            // from the table — the exec path needs the canonical
             // ProcessEntry shape. Do NOT reap() either: reaping would
             // clear the caller's just-spawned entry because its startTime
             // is recent (< 60s) but reap() ALSO drops 'running' entries
@@ -3738,30 +4060,62 @@ export class FacetManager {
                 catch { }
             }
         }
-        // W3.5 Fix B: thread an EsbuildService into buildPrefetchBundle so
-        // ESM source files (e.g. tldts/dist/es6/index.js, @remix-run/react,
-        // @tailwindcss/vite, react-remove-scroll, astro) get transformed to
-        // CJS before they hit the facet's `new Function` pre-compile loop.
-        // Lazy-create one if NimbusSession didn't share its own.
-        if (this.vfs && !this.esbuild) {
-            this.esbuild = new EsbuildService(this.vfs.as(CRED_KERNEL));
-        }
         const diagOn = isExecDiagEnabled();
         const __bundleStart = diagOn ? Date.now() : 0;
-        if (this.vfs)
-            this.imageStore.ensureDir();
-        const processVfs = this.vfs?.as(entry.cred);
-        const credKey = `${entry.cred.uid}:${entry.cred.gid}:${entry.cred.groups.join(',')}`;
-        const vfsState = processVfs
-            ? await this._withBundleBuildDeadline(this._buildPrefetchBundleCached(processVfs, opts.filename, opts.cwd || '/home/user', code, credKey, opts.bundleProfile), command)
-            : { bundle: {}, manifest: {}, metadata: {}, reachableCount: 0, truncated: false };
+        // Paced like a resident launch: a tree too large for one turn costs
+        // turns, and the pacer's stillWanted check ends a build whose process was
+        // killed while it was suspended. The pacer is settled in the finally
+        // below and not before, because the invocation that granted the last
+        // chunk awaits `chunkEnded` (PacedWork.pump) and has to stay the one
+        // that owns the run: settling at the end of the build would release that
+        // turn with the facet still to load and run on it.
+        const pacer = this._launchPacer(entry.pid);
+        let vfsState;
+        try {
+            vfsState = await this._buildProcessBundle(entry, { scriptPath: opts.filename, cwd: opts.cwd || '/home/user', entryCode: code, bundleProfile: opts.bundleProfile }, pacer);
+        }
+        catch (err) {
+            // The require closure that cannot fit the snapshot bound is the
+            // process's own answer, not a build failure: exit 1 with a stderr
+            // that names the entry, the staged bytes at the stop, the bound,
+            // and the remedy — the same shape the got/next guards print.
+            pacer.settle();
+            if (err instanceof ClosureBoundExceededError) {
+                const o = err.outcome;
+                const mib = (n) => `${(n / 1048576).toFixed(1)} MiB`;
+                const stderr = `require closure for ${o.entry} exceeds the snapshot bound: ` +
+                    `${mib(o.bytesSeen)} staged when ${o.lastPath} crossed the ` +
+                    `${mib(o.bound)} bound; the process was not started.\n` +
+                    `Run it as a server or split the entry; there is no flag to bypass.`;
+                if (this.processes.get(entry.pid)?.state === 'running') {
+                    this._failLaunch(entry.pid, stderr);
+                }
+                return { exitCode: 1, stdout: '', stderr };
+            }
+            // A failed build is thrown to the caller exactly as before. What must
+            // not be left behind is the process entry: it was spawned above and
+            // would otherwise sit 'running' forever for a process that never
+            // started. A build ended by a kill finds its entry already exited and
+            // reports nothing twice.
+            if (this.processes.get(entry.pid)?.state === 'running') {
+                this._failLaunch(entry.pid, `assembling the filesystem bundle for \`${command}\` failed: ${errorMessage(err)}`);
+            }
+            throw err;
+        }
         const bundleMs = diagOn ? Date.now() - __bundleStart : 0;
         const diagSink = diagOn
             ? { loadMs: 0, runMs: 0, moduleMapBytes: 0, bundleBytes: 0, manifestBytes: 0, metadataBytes: 0 }
             : undefined;
         const abortController = new AbortController();
+        // Ctrl-C / kill on a user program has to end the in-flight run, not just
+        // mark the table row: the runOnce request carries this signal.
+        this.processes.setTerminator(entry.pid, () => abortController.abort());
+        // A shell Ctrl+C arrives as an abort on the command's signal — it is the
+        // same kill, forwarded onto the controller the runOnce request carries.
+        const onShellAbort = () => abortController.abort();
+        opts.signal?.addEventListener('abort', onShellAbort, { once: true });
         try {
-            const result = await this._execWithTimeout(this._execViaLoader(code, opts, entry, vfsState, abortController.signal, diagSink), entry, () => abortController.abort());
+            const result = await this._execViaLoader(code, opts, entry, vfsState, abortController.signal, diagSink);
             this._flushVfsWrites(result, entry.pid);
             this._recordResidencyMisses(vfsState.bundleKey, result.residencyMisses);
             this.processes.exit(entry.pid, result.exitCode);
@@ -3782,6 +4136,7 @@ export class FacetManager {
                     rpcWrites: result.diag?.rpcWrites ?? 0,
                     fsRpcReads: result.diag?.fsRpcReads ?? 0,
                     cacheHit: vfsState.cacheHit ?? false,
+                    turns: pacer.chunks,
                     exitCode: result.exitCode,
                     at: Date.now(),
                 });
@@ -3789,31 +4144,27 @@ export class FacetManager {
             return result;
         }
         catch (err) {
-            // If the timeout already fired, it already called onExternalExit
-            // with code 124 and reason "timeout…". Don't clobber that with a
-            // generic exit code 1. (_reportExternalExit's guard separately
-            // prevents double-dump; this stops ProcessTable from showing a
-            // different exit code than the ring buffer's footer.)
-            const timedOut = this.timedOutProcessIds.has(entry.pid);
-            const exitCode = timedOut ? 124 : 1;
-            const reason = timedOut ? 'timeout' : `runtime worker error: ${errorMessage(err)}`;
+            // The abort controller firing means this run ended BY a kill — the
+            // shell's Ctrl+C or `kill <pid>`. The process was not a crash and the
+            // abort text is not its stderr: mark it killed and hand back 130 (the
+            // shell's signalled status) with nothing for the terminal to print.
+            if (abortController.signal.aborted) {
+                this.processes.kill(entry.pid);
+                return { exitCode: 130, stdout: '', stderr: '' };
+            }
+            const exitCode = 1;
+            const reason = `runtime worker error: ${errorMessage(err)}`;
             this.processes.exit(entry.pid, exitCode);
-            // W5 Lever 5: ring entry on every catch-path exit.
-            this._w5RecordTermination(entry.pid, exitCode, timedOut ? 'rpc' : 'runtime-worker', reason);
-            // Non-timeout failure: route through external-exit so the log
-            // store marks exit AND the tabs-UI structured event fires. The
-            // timeout path already called onExternalExit from the timeout
-            // handler; _reportExternalExit's getExit() guard dedupes.
-            if (!timedOut) {
-                try {
-                    this.hooks.onExternalExit?.(entry.pid, exitCode, reason);
-                }
-                catch { }
+            this._w5RecordTermination(entry.pid, exitCode, 'runtime-worker', reason);
+            try {
+                this.hooks.onExternalExit?.(entry.pid, exitCode, reason);
             }
+            catch { }
             return { exitCode, stdout: '', stderr: errorMessage(err) };
         }
         finally {
-            this.timedOutProcessIds.delete(entry.pid);
+            opts.signal?.removeEventListener('abort', onShellAbort);
+            pacer.settle();
         }
     }
     /**
@@ -3853,7 +4204,7 @@ export class FacetManager {
     }
     // ── One-shot dynamic Worker entrypoint ────────────────────────────────
     async _execViaLoader(code, opts, entry, vfsState, signal, diagSink) {
-        // Answered by _buildPrefetchBundleCached while the raw cells were still in
+        // Answered by _buildProcessBundle while the raw cells were still in
         // hand; re-deriving it here is what forced them to be retained.
         const usesSqlite = vfsState.usesNodeSqlite ?? bundleUsesNodeSqlite(code, vfsState.bundle);
         const [sqliteModules, shims] = await Promise.all([
@@ -3873,13 +4224,6 @@ export class FacetManager {
             stdin: opts.stdin || '',
             captureOutput: !!opts.captureOutput,
             cred: { ...entry.cred, groups: [...entry.cred.groups] },
-            // Absolute wall-clock instant the entry drain must stop at, derived
-            // from the same FACET_TIMEOUT_MS the supervisor's kill timer uses. It
-            // is stamped here rather than computed facet-side so the budget tracks
-            // the real remaining lifetime; everything still to happen before the
-            // facet runs (module map build, LOADER.load, the RPC hop) only makes
-            // this earlier than the kill, which is the safe direction.
-            entryDeadlineAt: Date.now() + FACET_TIMEOUT_MS - ONE_SHOT_EXIT_RESERVE_MS,
             vfsCursor: vfsState.cursor,
             ...(diagSink ? { diag: true } : {}),
         });
@@ -3893,16 +4237,21 @@ export class FacetManager {
                 // here rather than named by the enclosing frame, and the serialized
                 // forms it was built from are released unless the prefetch cache is
                 // keeping them. Otherwise the coordinator carries a second full copy
-                // of the program for the whole FACET_TIMEOUT_MS the facet then runs
-                // for, which is the window the isolate was being reset in.
+                // of the program for the whole run the facet then performs,
+                // which is the window the isolate was being reset in.
                 code: async () => {
-                    const generatedWorker = await generateEntrypointCode(code, vfsState, usesSqlite, shims);
+                    // A one-shot has no disk reader at load, so the closure's wasm
+                    // images ride by value: read here, inside the scope that holds
+                    // the map, and compiled by the loader like the sqlite sidecar.
+                    const wasmImports = facetWasmImports([], vfsState.wasmImages ?? []);
+                    const wasmModules = this._wasmModulesByValue(entry, wasmImports);
+                    const generatedWorker = await generateEntrypointCode(code, vfsState, usesSqlite, shims, wasmImports);
                     if (diagSink) {
                         diagSink.moduleMapBytes = _encodedSourceBytes(generatedWorker.code);
                         for (const source of Object.values(generatedWorker.modules)) {
                             diagSink.moduleMapBytes += _encodedSourceBytes(source);
                         }
-                        for (const m of Object.values(sqliteModules)) {
+                        for (const m of [...Object.values(sqliteModules), ...Object.values(wasmModules)]) {
                             diagSink.moduleMapBytes += m.wasm.byteLength;
                         }
                         // Read before the release below, which is the last moment the
@@ -3922,7 +4271,7 @@ export class FacetManager {
                         compatibilityDate: CF_COMPAT_DATE,
                         compatibilityFlags: ['nodejs_compat', 'nodejs_compat_v2'],
                         mainModule: 'runner.js',
-                        modules: { 'runner.js': generatedWorker.code, ...generatedWorker.modules, ...sqliteModules },
+                        modules: { 'runner.js': generatedWorker.code, ...generatedWorker.modules, ...sqliteModules, ...wasmModules },
                     };
                 },
                 request: new Request('http://nimbus-runtime.local/run', {
@@ -4330,7 +4679,7 @@ export class FacetManager {
     _assertLaunchStillOwned(pid) {
         if (this.processes.get(pid)?.state === 'running')
             return;
-        throw new Error(`Nimbus: resident launch for pid ${pid} was cancelled while it was suspended`);
+        throw new Error(`Nimbus: the launch for pid ${pid} was cancelled while it was suspended`);
     }
     /**
      * The one way this manager boots a resident process. Every resident process
@@ -4486,6 +4835,21 @@ export class FacetManager {
             return '(no output captured)';
         }
     }
+    /**
+     * A launch that fails before its process is running reports the same way
+     * regardless of which phase failed: the pid is exited, the terminal event
+     * recorded, and the session notified. Callers do their phase-specific
+     * cleanup (ports, tracked RPC resources) first and pass a reason that names
+     * the phase.
+     */
+    _failLaunch(pid, reason) {
+        this.processes.exit(pid, 1);
+        this._w5RecordTermination(pid, 1, 'facet', reason);
+        try {
+            this.hooks.onExternalExit?.(pid, 1, reason);
+        }
+        catch { }
+    }
     /** Flush files written by the script back to the supervisor's VFS. */
     _flushVfsWrites(result, pid) {
         if (!this.vfs || !result.vfsWrites)
@@ -4505,34 +4869,6 @@ export class FacetManager {
             vfs.writeFile(path, restored);
         }
     }
-    /** Execution timeout. */
-    async _execWithTimeout(promise, entry, abort) {
-        let timer;
-        const timeout = new Promise((_, reject) => {
-            timer = setTimeout(() => {
-                this.timedOutProcessIds.add(entry.pid);
-                abort();
-                // The process cannot report exit after the request is cancelled, so
-                // notify the session explicitly.
-                try {
-                    this.hooks.onExternalExit?.(entry.pid, 124, // conventional timeout exit code
-                    `timeout after ${FACET_TIMEOUT_MS / 1000}s`);
-                }
-                catch { }
-                reject(new Error(`Process timed out after ${FACET_TIMEOUT_MS / 1000}s`));
-            }, FACET_TIMEOUT_MS);
-        });
-        // Always clear the timer; otherwise a successful run would still
-        // trigger the timeout callback at FACET_TIMEOUT_MS, spuriously
-        // marking the exit code as 124.
-        try {
-            return await Promise.race([promise, timeout]);
-        }
-        finally {
-            if (timer !== undefined)
-                clearTimeout(timer);
-        }
-    }
     /**
      * Re-drive a journalled launch after an instance reset. What the journal
      * row carries is the recipe and nothing else: env and credentials are never
@@ -4544,24 +4880,36 @@ export class FacetManager {
         switch (recipe.kind) {
             case 'node': return this._spawnResident(recipe.code, recipe.opts, attempt);
             case 'worker': {
-                // The embedder's resolver decides everything; only a self-owned
-                // launch — nobody composed an embedder hook — falls through to the
-                // session's image-store default.
-                const resolve = this.hooks.resolveWorkerLaunch ?? this.hooks.resolveWorkerLaunchFallback;
+                // Which resolver a worker recipe re-drives through is decided by
+                // `recipe.resident`, and it is not a flag: it is the interpreter
+                // image (`{ runtime, argv }`) of a python/ruby socket server the
+                // SESSION launched for itself. Only those recipes take the
+                // image-store fallback, because the session persisted that image and
+                // no embedder was ever asked about the launch. Every other worker
+                // recipe — an embedder's `spawnWorker`, durable or not — re-drives
+                // through the embedder's `resolveWorkerLaunch`, and falls back to the
+                // image store only when no embedder hook is composed at all.
+                const resolve = recipe.resident
+                    ? this.hooks.resolveWorkerLaunchFallback
+                    : this.hooks.resolveWorkerLaunch ?? this.hooks.resolveWorkerLaunchFallback;
                 if (!resolve)
                     throw new Error('resident launch journal holds a worker launch but no resolveWorkerLaunch hook is composed');
                 const resolved = await resolve(recipe);
                 if (resolved === null)
                     return undefined;
-                const { 'worker.js': workerCode, ...modules } = resolved.modules;
+                const mainModule = resolved.mainModule ?? recipe.mainModule ?? DEFAULT_WORKER_MAIN_MODULE;
+                const { [mainModule]: workerCode, ...modules } = resolved.modules;
                 if (workerCode === undefined)
-                    throw new Error('resolved worker launch carries no worker.js module');
+                    throw new Error(`resolved worker launch carries no ${mainModule} main module`);
                 return this._spawnWorker(workerCode, record.command, recipe.cwd, {
-                    port: recipe.port > 0 ? recipe.port : undefined, modules, compatibilityDate: recipe.compatibilityDate,
-                    compatibilityFlags: recipe.compatibilityFlags, startArgs: recipe.startArgs,
+                    port: recipe.resident ? record.port : recipe.port > 0 ? recipe.port : undefined, modules, compatibilityDate: recipe.compatibilityDate,
+                    compatibilityFlags: recipe.compatibilityFlags, startArgs: resolved.startArgs ?? recipe.startArgs,
+                    resident: recipe.resident, restart: record.restart,
                     env: resolved.env ?? undefined, globalOutbound: resolved.globalOutbound,
                     vfsWasmModules: resolved.vfsWasmModules,
-                    durable: { owner: recipe.owner, image: recipe.image },
+                    vfsTextModules: resolved.vfsTextModules,
+                    mainModule,
+                    durable: { owner: residentOwner(record) ?? recipe.owner, image: recipe.image },
                 }, attempt);
             }
         }
@@ -4641,7 +4989,7 @@ export class FacetManager {
      */
     async _runResidentLaunch(entry, code, command, opts, attempt) {
         const cwd = opts.cwd || '/home/user';
-        const pacer = new TurnBudget(this.launchPump, turnChunkMaxBytes(this.env), () => this._assertLaunchStillOwned(entry.pid));
+        const pacer = this._launchPacer(entry.pid);
         // Journalled before the first byte of work. A launch that FAILS deletes
         // its row on the way out — its process has already been exited and the
         // user notified, so there is nothing left to owe. A launch that SETTLES
@@ -4652,50 +5000,88 @@ export class FacetManager {
         // terminal hook when the process ends. A re-drive owns its own process,
         // so the caller's pid goes with the instance that had it.
         //
-        // Durability is a property of the RESERVATION, not the recipe: a resident
-        // that declares a port at spawn claims the durable contract the port's
-        // reservation declares — the owner's durable slot for a store and the
-        // row's port/owner for `ensureDurableAppOnPort`. A resident whose port is
-        // only learned at listen() gets the same journal+capability durability at
-        // registration (see `registerPort`), but keeps its ephemeral facet name —
-        // the store cannot be re-rooted under a running facet.
-        let durableFacetName;
-        let durablePort;
-        let durableOwner;
+        // Every resident has an identity from the moment it is spawned: derived
+        // from the working directory and argv (never the env), so the same
+        // `node server.js` from the same directory is the same application
+        // across restarts and resets. A resident that declares a port at spawn
+        // which an EXPLICIT reservation holds (an embedder's ensureDurableApp)
+        // adopts that reservation's owner instead — the landed contract: the
+        // embedder declared the port, so whatever binds it is the application.
+        //
+        // A second live instance of the same derived identity is ephemeral: it
+        // runs, but it is not the durable one — it takes no slot (the slot is
+        // the identity's, and a live facet already holds it), claims no
+        // reservation, and is not journalled, so nothing re-drives it and a
+        // port it binds retires the previous occupant's capability like any
+        // unrelated process would.
+        const derivedOwner = await deriveResidentOwner(cwd, opts.argv ?? []);
+        let owner = derivedOwner;
         if (opts.port !== undefined && opts.port > 0 && opts.port < 65536) {
-            const reservation = await readPortReservation(this.ctx, opts.port);
-            if (reservation !== null && reservation.owner !== null) {
-                durableOwner = reservation.owner;
-                durablePort = opts.port;
-                durableFacetName = await acquireDurableFacetSlot(this.ctx, durableOwner);
+            const declared = await readPortReservation(this.ctx, opts.port);
+            if (declared !== null && declared.owner !== null && declared.kind === 'explicit') {
+                owner = declared.owner;
             }
         }
+        const initial = {
+            pid: entry.pid, command, attempt, phase: 'starting', owner,
+            recipe: { kind: 'node', code, opts: { ...opts, skipSpawn: undefined, callerPid: undefined } },
+            restart: residentRestartPolicy(opts.env),
+        };
+        let duplicateOf;
+        try {
+            duplicateOf = await this._claimResident(initial);
+            this._assertLaunchStillOwned(entry.pid);
+        }
+        catch (e) {
+            pacer.settle();
+            await this._releaseResidentClaim(entry.pid);
+            await this.launchJournal.release(entry.pid);
+            this._failLaunch(entry.pid, 'long-running node launch failed: ' + errorMessage(e));
+            throw e;
+        }
+        const ephemeral = duplicateOf !== null;
+        // The reservation the identity holds, if any: its port is what `$PORT`
+        // is set to and what the facet's durable slot is bound for, so the
+        // resident's `ctx.storage` persists across resets the way a durable
+        // worker's does.
+        const held = ephemeral ? null : await readPortReservationByOwner(this.ctx, owner);
+        let durableFacetName;
+        let launchEnv;
+        if (held !== null) {
+            durableFacetName = await acquireDurableFacetSlot(this.ctx, owner);
+            launchEnv = {
+                PORT: String(held.port),
+                NIMBUS_APP: held.reservation.name ?? owner,
+            };
+        }
+        if (ephemeral) {
+            this.ephemeralPids.set(entry.pid, owner);
+            this.hooks.notify?.(`\x1b[2m[nimbus: second instance of "${(opts.argv ?? []).join(' ') || command}" `
+                + `is not the durable one — pid ${duplicateOf} keeps the identity]\x1b[0m\r\n`);
+        }
         const record = {
             pid: entry.pid,
             command,
             attempt,
             phase: 'starting',
             recipe: { kind: 'node', code, opts: { ...opts, skipSpawn: undefined, callerPid: undefined } },
-            ...(durablePort !== undefined ? { port: durablePort, owner: durableOwner } : {}),
+            owner,
+            ...(held !== null ? { port: held.port, injectedPort: held.port } : {}),
+            restart: residentRestartPolicy(opts.env),
         };
         try {
-            await this.launchJournal.journal(record);
+            if (!ephemeral)
+                await this.launchJournal.journal(record);
         }
         catch (e) {
             // A resident that cannot be journalled does not start; the failure is
             // reported the way a boot failure is.
             pacer.settle();
-            this.processes.exit(entry.pid, 1);
-            const reason = 'long-running node launch failed: ' + errorMessage(e);
-            this._w5RecordTermination(entry.pid, 1, 'facet', reason);
-            try {
-                this.hooks.onExternalExit?.(entry.pid, 1, reason);
-            }
-            catch { }
+            this._failLaunch(entry.pid, 'long-running node launch failed: ' + errorMessage(e));
             throw e;
         }
         try {
-            await this._residentLaunchBody(entry, code, command, cwd, opts, pacer, durableFacetName);
+            await this._residentLaunchBody(entry, code, command, cwd, opts, pacer, durableFacetName, launchEnv);
         }
         catch (e) {
             await this.launchJournal.release(entry.pid);
@@ -4707,27 +5093,26 @@ export class FacetManager {
         // Booted and running: the launch proved itself, so the resident starts
         // its running life with a fresh re-drive budget. If the process already
         // ended inside the launch body's own settlement, the terminal hook has
-        // released the row — do not write it back.
+        // released the row — do not write it back. Amended, not rewritten from
+        // `record`: a port the program bound during its boot has already been
+        // stamped onto the row, and the settle must not lose it.
         if (this.launchJournal.has(entry.pid)) {
-            await this.launchJournal.journal({ ...record, attempt: 0, phase: 'running' });
+            await this._amendRow(entry.pid, (row) => ({ ...row, attempt: 0, phase: 'running' }));
         }
     }
-    async _residentLaunchBody(entry, code, command, cwd, opts, pacer, durableFacetName) {
-        if (this.vfs && !this.esbuild) {
-            this.esbuild = new EsbuildService(this.vfs.as(CRED_KERNEL));
-        }
-        if (this.vfs)
-            this.imageStore.ensureDir();
+    async _residentLaunchBody(entry, code, command, cwd, opts, pacer, durableFacetName, launchEnv) {
         const diagOn = isExecDiagEnabled();
         const __bundleStart = diagOn ? Date.now() : 0;
-        const processVfs = this.vfs?.as(entry.cred);
-        const vfsState = processVfs
-            ? await buildPrefetchBundle(processVfs, opts.filename, cwd, code, this.esbuild || undefined, opts.bundleProfile, undefined, pacer, this.hooks.transformLargeEsm)
-            : { bundle: {}, manifest: {}, metadata: {}, reachableCount: 0, truncated: false };
+        const vfsState = await this._buildProcessBundle(entry, { scriptPath: opts.filename, cwd, entryCode: code, bundleProfile: opts.bundleProfile }, pacer);
         const bundleMs = diagOn ? Date.now() - __bundleStart : 0;
+        // The launch-time overlay (`$PORT`, `$NIMBUS_APP` under a reservation)
+        // rides on top of the recipe's env and is never journalled: it is
+        // re-derived from the reservation on every launch, so a port the
+        // application was given follows the reservation, not the recipe.
+        const spawnEnv = launchEnv === undefined ? opts.env : { ...(opts.env || {}), ...launchEnv };
         const processEnv = opts.attachedTty
             ? {
-                ...(opts.env || {}),
+                ...(spawnEnv || {}),
                 NIMBUS_ATTACHED_TTY: '1',
                 NIMBUS_CP_CHILD_PID: String(entry.pid),
                 TERM: opts.env?.TERM || 'xterm-256color',
@@ -4736,13 +5121,16 @@ export class FacetManager {
                 LINES: opts.env?.LINES || '24',
                 FORCE_COLOR: opts.env?.FORCE_COLOR || '1',
             }
-            : opts.env;
-        const usesSqlite = bundleUsesNodeSqlite(code, vfsState.bundle);
+            : spawnEnv;
+        // Answered by _buildProcessBundle while the raw cells were still in hand.
+        const usesSqlite = vfsState.usesNodeSqlite ?? bundleUsesNodeSqlite(code, vfsState.bundle);
         const [sqliteModules, shims] = await Promise.all([
             this.sqliteModuleEntry(usesSqlite),
             fetchNodeShimsCode(this.env),
         ]);
-        let generatedWorker = await generateLongRunningNodeCode(code, vfsState, { ...opts, env: processEnv, cred: entry.cred }, usesSqlite, shims, pacer);
+        // Each image is read by path when the facet loads, never by value here.
+        const wasmImports = facetWasmImports([], vfsState.wasmImages ?? []);
+        let generatedWorker = await generateLongRunningNodeCode(code, vfsState, { ...opts, env: processEnv, cred: entry.cred, wasmImports }, usesSqlite, shims, pacer);
         // Sized here, while the map is still in hand. Reading these after the load
         // would itself be what keeps the map alive, and the whole point of the
         // scoping below is that nothing does.
@@ -4754,21 +5142,31 @@ export class FacetManager {
             }
             moduleMapBytes = _encodedSourceBytes(generatedWorker.code) + bundleBytes;
         }
-        const manifestBytes = diagOn ? _encodedSourceBytes(JSON.stringify(vfsState.manifest)) : 0;
-        const metadataBytes = diagOn ? _encodedSourceBytes(JSON.stringify(vfsState.metadata)) : 0;
+        const manifestBytes = diagOn ? _encodedSourceBytes(vfsState.serializedManifest ?? '') : 0;
+        const metadataBytes = diagOn ? _encodedSourceBytes(vfsState.serializedMetadata ?? '') : 0;
         const cacheHit = vfsState.cacheHit ?? false;
         const vfsCursor = vfsState.cursor;
-        releaseResidentLaunchSources(vfsState);
+        // The map is generated; the state's only remaining job is its cursor.
+        // Released here, before the boot — releasing afterwards keeps the copy
+        // alive for exactly the window that was resetting the isolate. A state
+        // the cache retained is the cache's to keep, and is served to the next
+        // launch of the same entry.
+        if (!vfsState.cacheRetained)
+            releaseGeneratedSources(vfsState);
         let handle;
         let resourcesTracked = false;
         try {
-            const vfsTextModules = await this.imageStore.materialize(entry.pid, {
+            // Assembled as one record of the SAME string objects the generator
+            // produced — no copy — and then handed over: this frame drops its own
+            // reference before materialize runs, and the sequence below drops each
+            // source as the store takes it, so one image's text is resident rather
+            // than every image's twice over.
+            const sources = {
                 'worker.js': generatedWorker.code,
                 ...generatedWorker.modules,
-            }, pacer);
-            // The image store has taken it; this frame must not be what holds the
-            // only other copy while the facet boots.
+            };
             generatedWorker = undefined;
+            const vfsTextModules = await this.imageStore.materialize(entry.pid, drainSources(sources), pacer);
             // Last gate before the facet exists. A launch now spans many turns, so
             // a kill can land anywhere inside it; booting a process the table has
             // already exited would leave a facet nothing owns, running against a
@@ -4819,6 +5217,7 @@ export class FacetManager {
                     rpcWrites: 0,
                     fsRpcReads: 0,
                     cacheHit,
+                    turns: pacer.chunks,
                     exitCode: 0,
                     at: Date.now(),
                 });
@@ -4862,26 +5261,43 @@ export class FacetManager {
             }
         }
         catch (e) {
+            // A program classified as long-running that ended on its own during
+            // its boot — `json-server --version` prints and exits 0 — reported its
+            // exit through the supervisor, which released the facet and rejected
+            // the boot handshake with 'resident process released'. That is a
+            // completed run, not a failed launch: the process table already holds
+            // its real exit code, and the caller reports that code.
             this.portRegistry.unregisterByPid(entry.pid);
             if (resourcesTracked)
                 this.releaseProcessRpcResources(entry.pid);
-            else
-                handle?.kill();
-            this.processes.exit(entry.pid, 1);
-            const reason = 'long-running node boot failed: ' + errorMessage(e);
-            this._w5RecordTermination(entry.pid, 1, 'facet', reason);
-            try {
-                this.hooks.onExternalExit?.(entry.pid, 1, reason);
-            }
-            catch { }
+            if (this.processExitCode(entry.pid) !== null)
+                return;
+            handle?.kill();
+            this._failLaunch(entry.pid, 'long-running node boot failed: ' + errorMessage(e));
             throw e;
         }
     }
     /**
-     * Spawn a long-running dynamic Worker, boot it, and return its boot payload.
+     * The exit code of a launched process that has already ended, or null
+     * while it runs. What a caller that started a resident reads to tell a
+     * server that is up from a program that finished during its boot.
+     */
+    processExitCode(pid) {
+        const entry = this.processes.get(pid);
+        if (entry === undefined || entry.state === 'running')
+            return null;
+        return entry.exitCode ?? 0;
+    }
+    /**
+     * Spawn a long-running dynamic Worker, boot it, and return its boot payload
+     * beside the pid and the process's own inbound facet.
      *
      * The shared primitive for any runtime that serves over
-     * handleHttpRequest(Request) — the python and ruby socket servers today.
+     * handleHttpRequest(Request) — the python and ruby socket servers today —
+     * and for an embedder's own Worker-class program: `workerCode` boots as
+     * `opts.mainModule` (default `worker.js`), `opts.modules` ride inline,
+     * `opts.vfsTextModules` and `opts.vfsWasmModules` are read by path when the
+     * facet loads.
      *
      * The interpreter image it carries is the memory that should not sit in the
      * session's own isolate — ruby's interpreter+stdlib alone is 34.3 MiB — and
@@ -4889,14 +5305,24 @@ export class FacetManager {
      * no readiness coupling back into the session: the runner answers
      * startProcess with its boot payload and the caller waits on that one
      * promise, so nothing polls the port to decide the process is up.
+     *
+     * The returned `facet` is bound to the resident handle's route target — the
+     * same target a registered port routes to — so a port-less process can be
+     * invoked directly. It has no release: `kill(pid)` is the one lifecycle
+     * owner, and the facet is dead once the pid is.
      */
     async spawnWorker(workerCode, command, cwd, opts = {}) {
         return this._spawnWorker(workerCode, command, cwd, opts, 0);
     }
     /** `attempt` is the journal's re-drive budget, as `_spawnResident` carries it. */
     async _spawnWorker(workerCode, command, cwd, opts, attempt) {
+        if (opts.resident && !opts.durable) {
+            opts = { ...opts, durable: { owner: await deriveResidentOwner(cwd, opts.resident.argv) } };
+        }
         this.processes.reap();
-        const entry = this.processes.spawn(command, [], cwd);
+        // The table entry carries the same argv the identity is derived from, so
+        // a runtime resident reads the same way through either path.
+        const entry = this.processes.spawn(command, opts.resident?.argv ?? [], cwd);
         // Stamp the process-table entry so /api/processes exposes this as a
         // long-running process.
         this.processes.setLongRunning(entry.pid);
@@ -4908,17 +5334,22 @@ export class FacetManager {
         catch { }
         const compatibilityDate = opts.compatibilityDate ?? CF_COMPAT_DATE;
         const compatibilityFlags = opts.compatibilityFlags || ['nodejs_compat'];
+        const mainModule = opts.mainModule ?? DEFAULT_WORKER_MAIN_MODULE;
+        if (opts.modules && Object.hasOwn(opts.modules, mainModule)) {
+            throw new Error(`Nimbus: spawnWorker main module '${mainModule}' is also an inline module; workerCode is the main module`);
+        }
         let handle;
         let resourcesTracked = false;
         let record;
         let durableFacetName;
+        let launchEnv;
         try {
             if (opts.durable) {
                 // A durable spawn on a declared port starts only when a reservation the
                 // owner already holds is persisted. Validated before the journal row is
                 // written and before the process boots, so a foreign or absent
                 // reservation refuses the launch rather than stealing the exposure.
-                if (opts.port && opts.port > 0 && opts.port < 65536) {
+                if (!opts.resident && opts.port && opts.port > 0 && opts.port < 65536) {
                     const preFlight = await readPortReservation(this.ctx, opts.port);
                     if (preFlight === null || preFlight.owner !== opts.durable.owner) {
                         throw new Error('port reservation conflict: durable worker does not own port ' + opts.port);
@@ -4944,7 +5375,17 @@ export class FacetManager {
                         modules: opts.modules ?? {},
                         ...(opts.env !== undefined ? { env: opts.env } : {}),
                         vfsWasmModules: opts.vfsWasmModules,
+                        vfsTextModules: opts.vfsTextModules,
+                        ...(opts.mainModule !== undefined ? { mainModule: opts.mainModule } : {}),
+                        startArgs: opts.startArgs,
                     });
+                await this.ctx.storage.transaction(async (txn) => {
+                    const key = `${DURABLE_IMAGES_KEY_PREFIX}${opts.durable.owner}`;
+                    const images = await txn.get(key) ?? [];
+                    if (!images.some((held) => held.runner === image.runner && held.application === image.application)) {
+                        await txn.put(key, [...images, image]);
+                    }
+                });
                 // Journalled before the launch's first byte of work, so a row a
                 // later instance reads proves this process never ended.
                 record = {
@@ -4960,27 +5401,45 @@ export class FacetManager {
                         cwd,
                         compatibilityDate,
                         compatibilityFlags,
-                        startArgs: opts.startArgs,
+                        ...(opts.durable.image && !opts.resident ? { startArgs: opts.startArgs } : {}),
+                        ...(opts.resident ? { resident: opts.resident } : {}),
+                        ...(opts.mainModule !== undefined ? { mainModule: opts.mainModule } : {}),
                     },
                     // The row-level fields `ensureDurableAppOnPort` reads — same values
                     // the recipe carries, stamped so port/owner lookup never depends on
                     // the recipe's kind.
-                    ...(opts.port !== undefined && opts.port > 0
-                        ? { port: opts.port, owner: opts.durable.owner }
-                        : {}),
+                    owner: opts.durable.owner,
+                    restart: opts.restart ?? 'never',
+                    ...(opts.port !== undefined && opts.port > 0 ? { port: opts.port } : {}),
                 };
                 // The durable facet name is claimed once, ever, from DO storage — a
                 // re-drive after a reset, an eviction's re-attach and a relaunch all
                 // land on the same `app-slot-<n>`, which is the only thing that keeps
                 // the retained SQLite bound to this application.
-                durableFacetName = await acquireDurableFacetSlot(this.ctx, opts.durable.owner);
-                await this.launchJournal.journal(record);
+                const duplicate = await this._claimResident(record);
+                if (duplicate !== null) {
+                    this.ephemeralPids.set(entry.pid, opts.durable.owner);
+                    this.hooks.notify?.(`\x1b[2m[nimbus: second instance of "${command}" is not the durable one — pid ${duplicate} keeps the identity]\x1b[0m\r\n`);
+                }
+                else if (!opts.resident || await readPortReservationByOwner(this.ctx, opts.durable.owner)) {
+                    durableFacetName = await acquireDurableFacetSlot(this.ctx, opts.durable.owner);
+                }
+                if (duplicate === null) {
+                    const held = await readPortReservationByOwner(this.ctx, opts.durable.owner);
+                    if (held) {
+                        launchEnv = { PORT: String(held.port), NIMBUS_APP: held.reservation.name ?? opts.durable.owner };
+                        await this._amendRow(entry.pid, (row) => ({ ...row, port: held.port, injectedPort: held.port }));
+                    }
+                }
             }
             handle = await this._startResidentProcess(entry.pid, {
                 // These runners answer startProcess with a boot payload (listening
                 // port, or a completed non-server run) and stay resident after it.
                 startContract: 'boot',
-                startArgs: opts.startArgs,
+                startArgs: opts.resident && opts.startArgs && typeof opts.startArgs === 'object'
+                    ? { ...opts.startArgs, supervisorPid: entry.pid,
+                        ...(launchEnv ? { userEnv: { ...z.record(z.string(), z.unknown()).parse(Reflect.get(opts.startArgs, 'userEnv') ?? {}), ...launchEnv } } : {}) }
+                    : opts.startArgs,
                 ...(durableFacetName !== undefined
                     ? { facet: { name: durableFacetName, durable: true } }
                     : {}),
@@ -4989,10 +5448,11 @@ export class FacetManager {
                     code: {
                         compatibilityDate,
                         compatibilityFlags,
-                        mainModule: 'worker.js',
-                        modules: { 'worker.js': workerCode, ...(opts.modules || {}) },
+                        mainModule,
+                        modules: { ...(opts.modules || {}), [mainModule]: workerCode },
                         vfsWasmModules: opts.vfsWasmModules,
-                        ...(opts.env !== undefined ? { env: opts.env } : {}),
+                        ...(opts.vfsTextModules !== undefined ? { vfsTextModules: opts.vfsTextModules } : {}),
+                        ...(opts.env !== undefined || launchEnv !== undefined ? { env: { ...opts.env, ...launchEnv } } : {}),
                         ...(opts.globalOutbound !== undefined ? { globalOutbound: opts.globalOutbound } : {}),
                     },
                 },
@@ -5001,13 +5461,13 @@ export class FacetManager {
             resourcesTracked = true;
             this.portRegistry.bindFacetStub(entry.pid, handle.routeTarget);
             const boot = await handle.booted();
-            if (opts.durable && this.launchJournal.has(entry.pid) && record) {
+            if (record && this.launchJournal.has(entry.pid)) {
                 // Booted and running: the launch proved itself, so the resident
                 // starts its running life with a fresh re-drive budget.
-                await this.launchJournal.journal({ ...record, attempt: 0, phase: 'running' });
+                await this._amendRow(entry.pid, (row) => ({ ...row, attempt: 0, phase: 'running' }));
             }
             if (opts.port && opts.port > 0 && opts.port < 65536) {
-                if (opts.durable) {
+                if (opts.durable && !opts.resident) {
                     // Re-read after the boot: a release or reassignment during it wins.
                     // The durable launch registers only under a reservation it still
                     // owns; it never clears or takes a foreign exposure.
@@ -5019,17 +5479,23 @@ export class FacetManager {
                     // re-drove this launch, and preview URLs minted against it stay
                     // valid: the durable capability is re-adopted through the
                     // reservation's own path, gated on the stored owner.
-                    this.portRegistry.register(opts.port, entry.pid);
-                    await restoreReservedPortCapability({ ctx: this.ctx, portRegistry: this.portRegistry }, opts.port, opts.durable.owner);
-                }
-                else {
-                    // A new process on a port retires the previous occupant's preview
-                    // capability, so a URL handed out for that one cannot reach this one.
-                    await clearPortCapability({ ctx: this.ctx, portRegistry: this.portRegistry }, opts.port);
-                    this.portRegistry.register(opts.port, entry.pid);
                 }
+                await this._registerResidentPort(entry.pid, opts.port);
             }
-            return { pid: entry.pid, boot };
+            const target = handle.routeTarget;
+            return {
+                pid: entry.pid,
+                boot,
+                facet: {
+                    fetch: (request) => target.handleHttpRequest(request),
+                    connect: async (request) => {
+                        if (typeof target.handleWebSocketRequest !== 'function') {
+                            throw new Error(`Nimbus: worker pid ${entry.pid} accepts no WebSocket upgrades`);
+                        }
+                        return target.handleWebSocketRequest(request);
+                    },
+                },
+            };
         }
         catch (e) {
             this.portRegistry.unregisterByPid(entry.pid);
@@ -5037,51 +5503,227 @@ export class FacetManager {
                 this.releaseProcessRpcResources(entry.pid);
             else
                 handle?.kill();
-            this.processes.exit(entry.pid, 1);
-            const reason = 'long-running worker boot failed: ' + errorMessage(e);
-            this._w5RecordTermination(entry.pid, 1, 'facet', reason);
-            try {
-                this.hooks.onExternalExit?.(entry.pid, 1, reason);
-            }
-            catch { }
+            this._failLaunch(entry.pid, 'long-running worker boot failed: ' + errorMessage(e));
             throw e;
         }
     }
     /**
-     * A resident process announcing it bound `port`. When the port is reserved,
-     * the reservation's owner is stamped onto this pid's journal row — the
-     * reservation is what declares which application the port serves, and a
-     * resident that binds it inherits the whole durable contract: the row names
-     * the port `ensureDurableAppOnPort` looks up, the minted capability is
-     * re-adopted rather than retired, and `removeDurableApp` can find the launch
-     * by owner.
+     * A resident process announcing it bound `port`.
+     *
+     * The stamp is unconditional: the pid's journal row gets `{ port }`
+     * whether or not anything reserved it, which is what lets
+     * `ensureDurableAppOnPort` re-drive ANY resident a reset killed — the
+     * scoped URLs need no capability, so this alone makes every server's
+     * preview survive a reset on demand.
+     *
+     * The capability is bound to identity, not to the port. The stored
+     * capability is re-adopted only when the row's owner IS the reservation's
+     * owner; any other occupant — an unrelated server, a pid outside the
+     * resident lifecycle, the ephemeral second instance of an identity —
+     * retires it and mints fresh, so a shared link 404s rather than reaching
+     * a program it was never handed out for. An EXPLICIT reservation (an
+     * embedder's `ensureDurableApp`) is the one exception, and it is the
+     * landed contract: the embedder declared the port, so the row adopts the
+     * reservation's owner and the capability with it.
      *
-     * A pid with no journal row — a process outside the resident lifecycle —
-     * registering on a reserved port takes it as today: the stored capability
-     * is retired and a fresh one is minted, the reservation stays with the
-     * owner. An accidental port reuse inside one session therefore cannot
-     * inherit the public capability; same-session processes are one trust
-     * domain, so this is hygiene, not a security boundary.
+     * Under an injected `$PORT`, a resident that binds a different port is
+     * registered anyway — the server must not break — but the row records
+     * the mismatch, so `apps.list` reports it as failed and the user is told.
      */
     async _registerResidentPort(pid, port) {
         const reservation = await readPortReservation(this.ctx, port);
-        const rowKey = `${FENCED_WORK_KEY_PREFIX}${pid}`;
-        const rows = await this.launchJournal.rows();
-        const row = rows.get(rowKey);
-        if (reservation !== null && reservation.owner !== null && row !== undefined) {
-            if (row.port !== port || residentOwner(row) !== reservation.owner) {
-                await this.launchJournal.journal({ ...row, port, owner: reservation.owner });
+        let claimedBy;
+        if (reservation?.owner && reservation.kind === 'explicit' && !this.ephemeralPids.has(pid)) {
+            const owner = reservation.owner;
+            const anotherLive = [...(await this.launchJournal.rows()).values()].some((row) => row.pid !== pid && residentOwner(row) === owner
+                && row.pid > this.processes.pidBase && this.processes.get(row.pid)?.state === 'running');
+            if (!anotherLive)
+                claimedBy = owner;
+        }
+        let newlyMismatched = false;
+        const row = await this._amendRow(pid, (current) => {
+            const owner = claimedBy ?? residentOwner(current);
+            const injected = current.injectedPort;
+            // Under an injected $PORT, the reserved port is the row's port for as
+            // long as this pid holds it; a second, different binding is recorded
+            // as the mismatch rather than displacing it.
+            const holdsInjected = injected !== undefined && injected !== port
+                && this.portRegistry.get(injected)?.pid === pid;
+            const stampedPort = holdsInjected ? injected : port;
+            const portMismatch = injected !== undefined && injected !== port && !holdsInjected
+                ? { listened: port, reserved: injected }
+                : undefined;
+            const same = current.port === stampedPort && residentOwner(current) === owner
+                && (current.portMismatch?.listened === portMismatch?.listened)
+                && (current.portMismatch?.reserved === portMismatch?.reserved);
+            if (same)
+                return current;
+            newlyMismatched = portMismatch !== undefined && current.portMismatch === undefined;
+            const { portMismatch: _dropped, ...rest } = current;
+            return {
+                ...rest,
+                port: stampedPort,
+                ...(owner !== undefined ? { owner } : {}),
+                ...(portMismatch !== undefined ? { portMismatch } : {}),
+            };
+        });
+        if (newlyMismatched && row?.portMismatch !== undefined) {
+            this.hooks.notify?.(`\x1b[2m[nimbus: "${row.command}" listened on ${port} but its reservation owns `
+                + `${row.portMismatch.reserved} ($PORT) — the app's URL will not reach it]\x1b[0m\r\n`);
+        }
+        // A pid nothing journalled — the in-process dev servers, a builtin's
+        // adopted wrapper pid — still has an identity: the process table's. It
+        // re-adopts a reservation it owns exactly as a resident does; the one
+        // thing it cannot do is adopt an EXPLICIT owner, because there is no row
+        // to stamp the adoption on, so it registers ephemeral on that port.
+        const owner = row === undefined
+            ? (await this.residentIdentity(pid))?.owner
+            : residentOwner(row);
+        if (claimedBy !== undefined && row !== undefined && this.residentClaims.get(pid) !== claimedBy) {
+            const previousOwner = this.residentClaims.get(pid);
+            await this._releaseResidentClaim(pid);
+            const duplicate = await this._claimResident(row);
+            if (duplicate !== null) {
+                this.ephemeralPids.set(pid, claimedBy);
+                await this.launchJournal.release(pid);
             }
+            else if (previousOwner && row.recipe.kind === 'worker') {
+                // Adoption moves retained images with the identity, including the
+                // index that survives a clean exit after the journal row is released.
+                await this.ctx.storage.transaction(async (txn) => {
+                    const previousKey = `${DURABLE_IMAGES_KEY_PREFIX}${previousOwner}`;
+                    const nextKey = `${DURABLE_IMAGES_KEY_PREFIX}${claimedBy}`;
+                    const previous = await txn.get(previousKey) ?? [];
+                    const next = await txn.get(nextKey) ?? [];
+                    const combined = [...next];
+                    for (const image of previous) {
+                        if (!combined.some((held) => held.runner === image.runner && held.application === image.application))
+                            combined.push(image);
+                    }
+                    await txn.put(nextKey, combined);
+                    await txn.delete(previousKey);
+                });
+            }
+        }
+        if (reservation !== null && reservation.owner !== null && owner === reservation.owner && !this.ephemeralPids.has(pid)) {
             this.portRegistry.register(port, pid);
             await restoreReservedPortCapability({ ctx: this.ctx, portRegistry: this.portRegistry }, port, reservation.owner);
             return;
         }
-        // A new process on an unreserved port — or one the journal does not know —
-        // retires the previous occupant's preview capability, so a URL handed out
-        // for that one cannot reach this one.
+        // Any other occupant retires the previous one's capability — and its
+        // directory row, so a public link goes dead rather than dangling — and
+        // registers with a fresh one. The owner's reservation survives it.
+        if (reservation?.owner) {
+            this.hooks.notify?.(`\x1b[2m[nimbus: port ${port} belongs to ${reservation.owner}; pid ${pid} registers ephemeral (owner ${owner ?? 'none'})]\x1b[0m\r\n`);
+        }
+        if (reservation?.visibility === 'public' && reservation.capability !== null) {
+            await unbindPublicPortCapability(this._publicDirectoryHost(), reservation.capability);
+        }
         await clearPortCapability({ ctx: this.ctx, portRegistry: this.portRegistry }, port);
         this.portRegistry.register(port, pid);
     }
+    /**
+     * Who a pid is. One resolver, in precedence order: the ephemeral-duplicate
+     * mark, the journal row (the owner a launch this manager made was stamped
+     * with — derived from the launch's own cwd+argv, or adopted from an
+     * explicit reservation), and finally the process table. The table knows
+     * cwd and argv for every pid, so a serving process nothing journalled — the
+     * in-process Vite dev server, real-vite, a staged artifact, any wrapper pid
+     * a builtin adopted — has the same derived identity shape as a resident
+     * and answers to the same app verbs. It just cannot be re-driven after a
+     * reset: only a journal row carries a recipe. Null only for a pid that is
+     * neither journalled nor running.
+     */
+    async residentIdentity(pid) {
+        const duplicated = this.ephemeralPids.get(pid);
+        if (duplicated !== undefined)
+            return { owner: duplicated, ephemeral: true, port: undefined };
+        const row = (await this.launchJournal.rows()).get(`${FENCED_WORK_KEY_PREFIX}${pid}`);
+        if (row !== undefined)
+            return { owner: residentOwner(row), ephemeral: false, port: row.port };
+        const entry = this.processes.get(pid);
+        if (entry === undefined || entry.state !== 'running')
+            return null;
+        return {
+            owner: await deriveResidentOwner(entry.cwd, entry.argv),
+            ephemeral: false,
+            port: this.portRegistry.getAll().find((live) => live.pid === pid)?.port,
+        };
+    }
+    /**
+     * Every stamped identity — the reservations, and the journal rows that
+     * carry an owner — folded one row per owner. A live pid in THIS instance
+     * makes it running (or starting, until its launch settles and its port
+     * is registered); a mismatch diagnostic makes it failed; everything else
+     * is stopped, which for a row a reset left behind means re-drivable on
+     * request.
+     */
+    async listResidentApps() {
+        const apps = new Map();
+        for (const [port, reservation] of await listPortReservations(this.ctx)) {
+            if (reservation.owner === null)
+                continue;
+            apps.set(reservation.owner, {
+                owner: reservation.owner,
+                name: reservation.name ?? null,
+                port,
+                pid: null,
+                status: 'stopped',
+                visibility: reservation.visibility,
+                capability: reservation.capability,
+                restart: 'never',
+                diagnostic: null,
+            });
+        }
+        for (const [, row] of await this.launchJournal.rows()) {
+            const owner = residentOwner(row);
+            if (owner === undefined)
+                continue;
+            const app = apps.get(owner) ?? {
+                owner, name: null, port: null, pid: null, status: 'stopped',
+                visibility: 'scoped', capability: null, restart: 'never', diagnostic: null,
+            };
+            if (app.port === null && row.port !== undefined && row.port > 0)
+                app.port = row.port;
+            if (row.restart !== undefined)
+                app.restart = row.restart;
+            const entry = this.processes.get(row.pid);
+            const live = row.pid > this.processes.pidBase && entry?.state === 'running';
+            if (live) {
+                app.pid = row.pid;
+                const bound = app.port !== null && this.portRegistry.get(app.port)?.pid === row.pid;
+                app.status = row.phase === 'running' && bound ? 'running' : 'starting';
+            }
+            if (row.portMismatch !== undefined) {
+                app.status = 'failed';
+                app.diagnostic = `listened on ${row.portMismatch.listened}, owns ${row.portMismatch.reserved}`;
+            }
+            apps.set(owner, app);
+        }
+        // Every process serving a port is an application whether or not a
+        // journal row backs it — the identity comes from the same resolver the
+        // verbs use, so what `list` shows is what `expose` will bind. A row-backed
+        // app already carries its pid from above; this only adds the servers
+        // nothing journalled (the dev servers, adopted wrapper pids).
+        for (const live of this.portRegistry.getAll()) {
+            const identity = await this.residentIdentity(live.pid);
+            if (identity === null || identity.ephemeral || identity.owner === undefined)
+                continue;
+            const app = apps.get(identity.owner) ?? {
+                owner: identity.owner, name: null, port: null, pid: null, status: 'stopped',
+                visibility: 'scoped', capability: null, restart: 'never', diagnostic: null,
+            };
+            if (app.pid !== null)
+                continue;
+            app.pid = live.pid;
+            if (app.port === null)
+                app.port = live.port;
+            if (app.status === 'stopped')
+                app.status = 'running';
+            apps.set(identity.owner, app);
+        }
+        return [...apps.values()];
+    }
     async registerPort(pid, port) {
         if (port > 0 && port < 65536) {
             await this._registerResidentPort(pid, port);
@@ -5149,9 +5791,6 @@ export class FacetManager {
             if (residentOwner(record) !== owner)
                 continue;
             ownedPids.push(record.pid);
-            const rowPort = record.port ?? (record.recipe.kind === 'worker' ? record.recipe.port : 0);
-            if (rowPort > 0)
-                ownedPorts.add(rowPort);
         }
         for (const pid of ownedPids)
             this.kill(pid);
@@ -5169,18 +5808,29 @@ export class FacetManager {
             }
         }
         for (const port of ownedPorts) {
+            // A port stamp is not ownership. Release only a reservation that still
+            // belongs to this owner, and never unregister somebody else's listener.
+            if ((await readPortReservation(this.ctx, port))?.owner !== owner)
+                continue;
             await releasePortReservation(this.ctx, { owner, port });
-            this.portRegistry.unregister(port);
+            const live = this.portRegistry.get(port);
+            if (live && ownedPids.includes(live.pid))
+                this.portRegistry.unregister(port);
+        }
+        const imageRows = await this.ctx.storage.list({ prefix: DURABLE_IMAGES_KEY_PREFIX });
+        const ownedImages = [...(imageRows.get(`${DURABLE_IMAGES_KEY_PREFIX}${owner}`) ?? [])];
+        const retainedImages = [...imageRows].filter(([key]) => key !== `${DURABLE_IMAGES_KEY_PREFIX}${owner}`).flatMap(([, images]) => images);
+        for (const row of journalRows.values()) {
+            if (row.recipe.kind !== 'worker')
+                continue;
+            (residentOwner(row) === owner ? ownedImages : retainedImages).push(row.recipe.image);
         }
+        const imagesPurged = this.vfs ? purgeDurableWorkerImages(this.vfs, ownedImages, retainedImages) : 0;
+        await this.ctx.storage.delete(`${DURABLE_IMAGES_KEY_PREFIX}${owner}`);
+        await this.ctx.storage.delete(`${RESIDENT_OWNER_KEY_PREFIX}${owner}`);
         const purged = await this.launchJournal.purgeWhere((record) => residentOwner(record) === owner);
-        const name = await freeDurableFacetSlot(this.ctx, owner);
-        if (name !== null) {
-            try {
-                deleteFacetStorage(this.ctx, name);
-            }
-            catch { /* already gone */ }
-        }
-        return name !== null || purged > 0 || ownedPorts.size > 0;
+        const name = await freeDurableFacetSlot(this.ctx, owner, (slot) => deleteFacetStorage(this.ctx, slot));
+        return name !== null || purged > 0 || ownedPorts.size > 0 || imagesPurged > 0;
     }
     /** The session-shaped view the public-directory helpers read env from. */
     _publicDirectoryHost() {
@@ -5219,19 +5869,20 @@ export class FacetManager {
     async _ensureDurableAppOnPort(port) {
         if (this.portRegistry.has(port))
             return 'started';
-        // The reservation says the port means something to someone; the journal
-        // row is what makes it a launch this instance owes. A reservation with
-        // no row (the spawn died before journalling, or the app was removed and
-        // the release already ran) answers absent — nothing here can bring back
-        // an application with no recipe.
+        // The journal row is what makes a port a launch this instance owes —
+        // reservation or not: every resident's row is stamped with the port it
+        // bound, so any of them re-drives on request. A port with no stamped
+        // row (nothing ever bound it, or the app was removed and its rows
+        // purged) answers absent — nothing here can bring back an application
+        // with no recipe. When more than one row names the port, the
+        // reservation's owner wins; otherwise the newest launch does.
         const reservation = await readPortReservation(this.ctx, port);
-        if (reservation === null || reservation.owner === null)
-            return 'absent';
         const rows = await this.launchJournal.rows();
-        // The reservation names the owner; the row's stamped port names which
-        // resident serves it — kind-agnostic, so a node resident that bound the
-        // port re-drives the same way a durable worker launch does.
-        const entry = [...rows].find(([, record]) => record.port === port && residentOwner(record) === reservation.owner);
+        const candidates = [...rows].filter(([, record]) => record.port === port);
+        const ownerRow = reservation !== null && reservation.owner !== null
+            ? candidates.find(([, record]) => residentOwner(record) === reservation.owner)
+            : undefined;
+        const entry = ownerRow ?? candidates.sort(([, a], [, b]) => b.pid - a.pid)[0];
         if (entry === undefined)
             return 'absent';
         const [rowKey, record] = entry;