@nimbus-sh/worker 0.6.0 → 0.7.0

package/dist/facets/manager.js

@@ -21,14 +21,14 @@ import { getRealNodeImportsCode } from '@nimbus-sh/core/_shared/real-node-import
 import { FACET_RESIDENT_STORE_SOURCE } from '../vfs/facet-resident-store.js';
 import { VFS_CURSOR_SEED_SOURCE, serializeFacetVfsCursor, } from '@nimbus-sh/core/_shared/facet-vfs-cursor.js';
 import { VFS_WRITE_LEDGER_SOURCE } from '@nimbus-sh/core/_shared/vfs-write-ledger.js';
-import { vfsPathExtension } from '@nimbus-sh/core/vfs/path.js';
+import { stripLeadingSlashes, vfsPathExtension } from '@nimbus-sh/core/vfs/path.js';
 import { clearPortCapability, listPortReservations, readPortReservation, readPortReservationByOwner, releasePortReservation, restoreReservedPortCapability, } from '../session/port-capability.js';
 import { deriveResidentOwner } from './resident-identity.js';
 import { z } from 'zod/v4';
 import { RESIDENT_OWNER_KEY_PREFIX, DURABLE_IMAGES_KEY_PREFIX } from '../session/keys.js';
 import { PORT_CAPABILITY_KEY_PREFIX } from '../session/keys.js';
 import { unbindPublicPortCapability } from '../router/public-directory.js';
-import { prefetchForRequire } from '@nimbus-sh/core/runtime/require-resolver.js';
+import { prefetchForRequire, ClosureBoundExceededError } from '@nimbus-sh/core/runtime/require-resolver.js';
 import { hasTopLevelModuleSyntax } from '@nimbus-sh/core/runtime/javascript-ast.js';
 import { bindImportMetaResolve, importMetaDefines } from '@nimbus-sh/core/runtime/import-meta-transform.js';
 import { recordFailure, getLastRpcFrame, getLastFacetId } from '@nimbus-sh/platform/oom-discriminator.js';
@@ -48,10 +48,11 @@ import { persistDurableWorkerImage, purgeDurableWorkerImages, } from './durable-
 import { SQLITE_WASM_MODULE_NAME, } from '../runtime/opencode-facet-runner.js';
 import { parsePortFromArgv, resolveLongRunningPort } from '@nimbus-sh/core/runtime/long-running-handle.js';
 import { DEFAULT_FACET_BUNDLE_PROFILE, } from '@nimbus-sh/core/runtime/bundle-profile.js';
-import { BUNDLE_BUILD_DEADLINE_MS, CF_COMPAT_DATE, FACET_TIMEOUT_MS, VFS_BUNDLE_MAX_FILES, VFS_BUNDLE_MAX_BYTES, CWD_SNAPSHOT_MAX_FILE_BYTES, BUNDLE_MAX_ENCODED_BYTES, PREFETCH_CACHE_MAX_BYTES, } from '@nimbus-sh/core/constants.js';
+import { CF_COMPAT_DATE, VFS_BUNDLE_MAX_FILES, VFS_BUNDLE_MAX_BYTES, CWD_SNAPSHOT_MAX_FILE_BYTES, BUNDLE_MAX_ENCODED_BYTES, PREFETCH_CACHE_MAX_BYTES, } from '@nimbus-sh/core/constants.js';
 import { MAX_RPC_SAFE_PAYLOAD_BYTES } from '@nimbus-sh/platform/limits.js';
 import { CRED_KERNEL } from '@nimbus-sh/core/runtime/os-contracts.js';
 import { acquireSupervisorAllocation } from '@nimbus-sh/platform/heavy-alloc-coord.js';
+import { wasmImageDigest } from './wasm-image-digest.js';
 import { prefetchBundleStart, prefetchBundleEnd, setPrefetchCacheBytes, } from '@nimbus-sh/platform/diag-counters.js';
 const ISOLATED_ESM_TRANSFORM_MIN_BYTES = 512 * 1024;
 /**
@@ -131,34 +132,6 @@ function parseFacetManagerEnv(env) {
         rawEnv: env,
     };
 }
-/**
- * Reserve held back from a one-shot facet's lifetime so a program that runs
- * out of time is still alive to say so.
- *
- * A one-shot exec is ALREADY bounded: `_execWithTimeout` kills it at
- * FACET_TIMEOUT_MS with exit 124 and "[process killed: timeout after 30s]".
- * The entry drain must therefore not be a second, tighter, independent
- * timeout. Measured against a deployed Worker, floating async work of 5s /
- * 15s / 25s completes and 40s is killed by that outer bound at exactly 30s —
- * so the fixed 8s budget this used to carry was abandoning programs 22
- * seconds before anything actually required it.
- *
- * The drain therefore runs to the outer bound MINUS this reserve, which is
- * what buys the facet time to flush and report the honest "still in flight"
- * reason instead of the supervisor's generic kill. The reserve has to cover
- * the longest tail a facet can have after the drain: settling pending RPC,
- * writing back __vfsWrites (bounded by MAX_RPC_SAFE_PAYLOAD_BYTES; a 20 MiB
- * write-back measures ~1.5s), draining children, then reportExit.
- */
-export const ONE_SHOT_EXIT_RESERVE_MS = 3_000;
-/**
- * Budget used when the supervisor did not stamp an absolute deadline on the
- * payload. The deadline is the real bound — see `entryDeadlineAt` — because
- * it is measured from the supervisor's own timer rather than restarted when
- * the drain begins, so a slow module init cannot push the drain past the kill
- * and lose the honest message.
- */
-export const ONE_SHOT_ENTRY_DEADLINE_MS = FACET_TIMEOUT_MS - ONE_SHOT_EXIT_RESERVE_MS;
 /**
  * How long a RESIDENT facet settles its startup before answering its boot
  * call. It keeps running afterwards, so this is not a lifetime decision: the
@@ -174,8 +147,11 @@ export const RESIDENT_BOOT_SETTLE_MS = 1000;
  * servers, requests in flight. A promise is not a handle: a program whose
  * last act leaves `new Promise(() => {})` unsettled prints its output and
  * exits 0. Counting unsettled promises as work was a real divergence from
- * that — such a program burned the whole facet lifetime and was then
- * reported as having not finished.
+ * that — such a program's drain used to end early and it was
+ * reported as having not finished. A user-invoked program runs this loop
+ * with NO deadline — Node itself has no wall-clock kill; the only endings
+ * are the program's exit and a signal. Callers that still pass a finite
+ * deadline (the resident boot settle) arm the expiry timer.
  *
  * Three kinds of handle, each owned by the shim that creates them:
  *
@@ -188,13 +164,6 @@ export const RESIDENT_BOOT_SETTLE_MS = 1000;
  *   - listening SERVERS (`__portRegistry`), open until the program closes
  *     them.
  *
- * The bound is a REAL wall-clock deadline, armed as a timer rather than
- * compared against `Date.now()`: a `setTimeout(0)` turn in workerd costs
- * ~5µs, so the pass budget this loop used to carry (50k) expired after
- * ~150ms and silently overrode every longer deadline the callers declared —
- * anything slower than that, including an ordinary network fetch, was
- * abandoned mid-flight and reported as a clean exit.
- *
  * The loop subscribes to the exit promise ONCE — a per-pass
  * `exitPromise.then()` allocates a promise every iteration — and yields
  * through the raw setTimeout so its own ticks don't inflate the timer count
@@ -231,16 +200,21 @@ async function __nimbusRunEventLoop(__countHandles, __exitPromise, __deadlineMs,
     ? globalThis.__nimbusRawClearTimeout
     : globalThis.clearTimeout;
   let __expired = false;
-  const __deadline = __rawSetTimeout(() => { __expired = true; }, __deadlineMs);
   let __pass = 0;
+  // A user-invoked program runs until it exits or is killed — there is no
+  // wall-clock deadline, so no expiry timer is armed at all. (Callers that
+  // still pass a finite deadline get the timer for compatibility.)
+  const __deadline = Number.isFinite(__deadlineMs)
+    ? __rawSetTimeout(() => { __expired = true; }, __deadlineMs)
+    : null;
   while (!__exited && !__expired && (__pass < __minPasses || __countHandles() > 0)) {
     // The warm-up passes give a settling microtask chain its turns and cost
     // ~5µs each; past them the loop is waiting on wall-clock work, where
-    // spinning at 0ms would burn the isolate's CPU for the whole deadline.
+    // spinning at 0ms would burn the isolate's CPU indefinitely.
     await new Promise((resolve) => __rawSetTimeout(resolve, __pass < __minPasses ? 0 : 1));
     __pass++;
   }
-  try { __rawClearTimeout(__deadline); } catch {}
+  if (__deadline !== null) { try { __rawClearTimeout(__deadline); } catch {} }
   // \`pending\` is what the caller reports when it gives up: a one-shot program
   // still holding a handle did NOT finish, and exiting 0 would claim it did.
   return { passes: __pass, pending: __exited ? 0 : __countHandles() };
@@ -395,7 +369,7 @@ const SQLITE_FACET_IMPORT = `import __nimbusSqliteWasmModule from "${SQLITE_WASM
 /**
  * Generate one-shot runtime code with a plain fetch handler.
  */
-export async function generateEntrypointCode(userCode, vfsState, usesSqlite, shims) {
+export async function generateEntrypointCode(userCode, vfsState, usesSqlite, shims, wasmImports = []) {
     const safeCode = JSON.stringify(userCode);
     const bundleSource = await facetVfsBundleSourceFor(vfsState);
     const safeManifest = vfsState.serializedManifest ?? JSON.stringify(vfsState.manifest);
@@ -405,6 +379,7 @@ export async function generateEntrypointCode(userCode, vfsState, usesSqlite, shi
 ${bundleSource.imports}
 ${REAL_NODE_IMPORTS}
 ${usesSqlite ? SQLITE_FACET_IMPORT : ''}
+${facetWasmImportsSource(wasmImports)}
 const USER_CODE = ${safeCode};
 const __NimbusHostResponse = globalThis.Response;
 
@@ -454,20 +429,16 @@ class __ProcessExit extends Error {
 export default {
   async fetch(request, workerEnv) {
     const args = await request.json();
-    const { argv, env, cwd: _cwd, filename, dirname, stdin, captureOutput, cred, diag: __diag, entryDeadlineAt, vfsCursor } = args;
+    const { argv, env, cwd: _cwd, filename, dirname, stdin, captureOutput, cred, diag: __diag, vfsCursor } = args;
     // Per invocation, not per module: this body is cached on
     // hash(code + bundle + manifest) and reused by any session whose snapshot
     // hashes the same, and epochs are per supervisor incarnation.
     const __MODULE_VFS_CURSOR = vfsCursor || null;
 ${VFS_CURSOR_SEED_SOURCE}
-    // What is left of this facet's lifetime, measured from the supervisor's
-    // own timeout timer rather than from whenever the drain happens to start
-    // — a slow module init must not be able to push the drain past the kill
-    // and lose the honest reason. Same shape as the git network facet's
-    // phaseDeadline.
-    const __entryBudgetMs = Number.isFinite(entryDeadlineAt)
-      ? Math.max(0, Number(entryDeadlineAt) - Date.now())
-      : ${ONE_SHOT_ENTRY_DEADLINE_MS};
+    // A user-invoked program has no wall-clock lifetime: the drain runs the
+    // entrypoint's event loop until Node would exit, and only a kill (Ctrl-C)
+    // ends it early.
+    const __entryBudgetMs = Infinity;
     let __drainPasses = 0;
     const __vfsBundle = __MODULE_VFS_BUNDLE;
     const __vfsManifest = __MODULE_VFS_MANIFEST;
@@ -486,11 +457,12 @@ ${VFS_CURSOR_SEED_SOURCE}
     };
     let __rpcWriteChain = Promise.resolve();
     let __rpcWriteCount = 0;
-    const __queueRpcWrite = (method, s) => {
+    // The relay carries bytes (see "Process output is bytes" in the shims).
+    const __queueRpcWrite = (method, bytes) => {
       __rpcWriteCount++;
       const __task = __rpcWriteChain
-        .then(() => __supervisor[method](s))
-        .catch((e) => __onRpcDrop(s.length, e));
+        .then(() => __supervisor[method](bytes))
+        .catch((e) => __onRpcDrop(bytes.byteLength, e));
       __rpcWriteChain = __task.then(() => {}, () => {});
       __pendingIO.push(__task);
     };
@@ -509,13 +481,13 @@ ${RESIDENCY_MISS_REPORT}
 
     // Override console AND process.stdout/stderr for live SUPERVISOR streaming
     if (__supervisor && !captureOutput) {
-      __consoleMod.log = (...a) => { const s = __utilMod.format(...a) + "\\n"; stdout += s; __queueRpcWrite("stdout", s); };
-      __consoleMod.error = (...a) => { const s = __utilMod.format(...a) + "\\n"; stderr += s; __queueRpcWrite("stderr", s); };
+      __consoleMod.log = (...a) => { const s = __utilMod.format(...a) + "\\n"; stdout += s; __queueRpcWrite("stdout", __nimbusOutEnc.encode(s)); };
+      __consoleMod.error = (...a) => { const s = __utilMod.format(...a) + "\\n"; stderr += s; __queueRpcWrite("stderr", __nimbusOutEnc.encode(s)); };
       __consoleMod.warn = __consoleMod.error;
       __consoleMod.info = __consoleMod.log;
       __consoleMod.debug = __consoleMod.log;
-      __processMod.stdout.write = (d, enc, cb) => { if (typeof enc === "function") cb = enc; const s = String(d); stdout += s; __queueRpcWrite("stdout", s); if (typeof cb === "function") queueMicrotask(cb); return true; };
-      __processMod.stderr.write = (d, enc, cb) => { if (typeof enc === "function") cb = enc; const s = String(d); stderr += s; __queueRpcWrite("stderr", s); if (typeof cb === "function") queueMicrotask(cb); return true; };
+      __processMod.stdout.write = (d, enc, cb) => { if (typeof enc === "function") cb = enc; const b = __nimbusOutBytes(d, enc); stdout += __nimbusOutText("stdout", b); __queueRpcWrite("stdout", b); if (typeof cb === "function") queueMicrotask(cb); return true; };
+      __processMod.stderr.write = (d, enc, cb) => { if (typeof enc === "function") cb = enc; const b = __nimbusOutBytes(d, enc); stderr += __nimbusOutText("stderr", b); __queueRpcWrite("stderr", b); if (typeof cb === "function") queueMicrotask(cb); return true; };
     }
 
     try { globalThis.console = __consoleMod; } catch {}
@@ -546,18 +518,7 @@ ${RESIDENCY_MISS_REPORT}
       const __drain = await __nimbusRunEntrypointToExit(__entryResult, __entryBudgetMs);
       __drainPasses = __drain.passes;
       if (__nimbusProcessExitCode !== null) exitCode = __nimbusProcessExitCode;
-      // This facet's lifetime IS the event loop, so a handle still open when
-      // the deadline passes is work that will never run. Reporting exit 0
-      // there is the silent-truncation failure: name the limit and fail.
-      else if (__drain.pending > 0) {
-        const __why = "node: reached the ${FACET_TIMEOUT_MS / 1000}s facet lifetime limit with " +
-          __drain.pending + " operation(s) still in flight; the rest of the program did not run. " +
-          "A program that needs longer than ${FACET_TIMEOUT_MS / 1000}s has to run as a " +
-          "long-running process (node --watch, or a server), which is not bound by it.\\n";
-        stderr += __why;
-        exitCode = 1;
-        if (__supervisor && !captureOutput) __queueRpcWrite("stderr", __why);
-      }
+
       if (__nimbusLiveStdinPump && !__nimbusAttachedTty) await __nimbusLiveStdinPump;
     } catch (e) {
       if (e instanceof __ProcessExit) { exitCode = e.code; }
@@ -566,7 +527,7 @@ ${RESIDENCY_MISS_REPORT}
         stderr += trace + "\\n";
         exitCode = 1;
         if (__supervisor && !captureOutput) {
-          try { __pendingIO.push(__supervisor.stderr(trace + "\\n").catch((e2) => __onRpcDrop((trace || "").length + 1, e2))); } catch {}
+          try { const __traceBytes = __nimbusOutEnc.encode(trace + "\\n"); __pendingIO.push(__supervisor.stderr(__traceBytes).catch((e2) => __onRpcDrop(__traceBytes.byteLength, e2))); } catch {}
         }
       }
     }
@@ -592,7 +553,7 @@ ${RESIDENCY_MISS_REPORT}
     if (__residencyReport) {
       stderr += __residencyReport;
       if (exitCode === 0) exitCode = 1;
-      if (__supervisor && !captureOutput) __queueRpcWrite("stderr", __residencyReport);
+      if (__supervisor && !captureOutput) __queueRpcWrite("stderr", __nimbusOutEnc.encode(__residencyReport));
     }
 
     await __drainPendingIO();
@@ -606,7 +567,7 @@ ${RESIDENCY_MISS_REPORT}
         exitCode = 1;
         if (!captureOutput) {
           try {
-            await __supervisor.stderr(trace + "\\n");
+            await __supervisor.stderr(__nimbusOutEnc.encode(trace + "\\n"));
           } catch {}
         }
       }
@@ -656,6 +617,61 @@ ${RESIDENCY_MISS_REPORT}
  * compiled user entry is booted once and the exported entrypoint keeps
  * serving HTTP requests from the shimmed http.Server registry.
  */
+/**
+ * Hand a record's entries to a consumer one at a time, releasing each as it
+ * goes, so the record stops being a second holder of the whole set.
+ *
+ * The image store takes its images as a sequence for exactly this: a launch's
+ * module text is the largest thing the coordinator assembles, and holding it
+ * in two places at once is what the 128 MiB isolate could not survive.
+ */
+function* drainSources(sources) {
+    for (const name of Object.keys(sources)) {
+        const source = sources[name];
+        delete sources[name];
+        yield [name, source];
+    }
+}
+/** The module-map name a precompiled wasm image travels under. */
+export function facetWasmModuleName(index) {
+    return `__nimbus_wasm_${index}.wasm`;
+}
+/**
+ * The wasm imports one launch stages: the images its options name, then
+ * every image the closure walk recorded (FacetVfsState.wasmImages) that the
+ * options did not already name by path. One member per path; the closure's
+ * record supplies the digest an option without one lacks.
+ */
+export function facetWasmImports(named, closure) {
+    const byPath = new Map();
+    for (const image of named)
+        byPath.set(image.vfsPath, image);
+    for (const image of closure) {
+        const seen = byPath.get(image.vfsPath);
+        if (seen === undefined)
+            byPath.set(image.vfsPath, image);
+        else if (seen.digest === undefined)
+            byPath.set(image.vfsPath, { ...seen, digest: image.digest });
+    }
+    return [...byPath.values()].map((image, index) => ({ ...image, moduleName: facetWasmModuleName(index) }));
+}
+/**
+ * The static imports that compile a launch's wasm images at module eval and
+ * park them by VFS path for the node-shims WebAssembly seam.
+ */
+function facetWasmImportsSource(wasmImports) {
+    if (wasmImports.length === 0)
+        return '';
+    const lines = wasmImports.map((entry, index) => `import __nimbusWasm${index} from ${JSON.stringify(entry.moduleName)};`);
+    const entries = wasmImports.map((entry, index) => `[${JSON.stringify(stripLeadingSlashes(entry.vfsPath))}, __nimbusWasm${index}]`);
+    const byDigest = wasmImports
+        .map((entry, index) => (entry.digest === undefined
+        ? null
+        : `[${JSON.stringify(entry.digest)}, __nimbusWasm${index}]`))
+        .filter((line) => line !== null);
+    return `${lines.join('\n')}\nglobalThis.__nimbusPrecompiledWasm = new Map([${entries.join(', ')}]);`
+        + `\nglobalThis.__nimbusPrecompiledWasmByDigest = new Map([${byDigest.join(', ')}]);`;
+}
 export async function generateLongRunningNodeCode(userCode, vfsState, opts, usesSqlite, shims, pacer) {
     const safeCode = JSON.stringify(userCode);
     const safeArgs = JSON.stringify({
@@ -669,14 +685,15 @@ export async function generateLongRunningNodeCode(userCode, vfsState, opts, uses
         cred: opts.cred,
     });
     const bundleSource = await facetVfsBundleSourceFor(vfsState, pacer);
-    const safeManifest = JSON.stringify(vfsState.manifest);
-    const safeMetadata = JSON.stringify(vfsState.metadata);
+    const safeManifest = vfsState.serializedManifest ?? JSON.stringify(vfsState.manifest);
+    const safeMetadata = vfsState.serializedMetadata ?? JSON.stringify(vfsState.metadata);
     return {
         code: `
 ${bundleSource.imports}
 import { DurableObject } from "cloudflare:workers";
 ${REAL_NODE_IMPORTS}
 ${usesSqlite ? SQLITE_FACET_IMPORT : ''}
+${facetWasmImportsSource(opts.wasmImports ?? [])}
 const USER_CODE = ${safeCode};
 const __NIMBUS_ARGS = ${safeArgs};
 const __NimbusHostResponse = globalThis.Response;
@@ -832,11 +849,12 @@ ${VFS_CURSOR_SEED_SOURCE}
     };
     let __rpcWriteChain = Promise.resolve();
     let __rpcWriteCount = 0;
-    const __queueRpcWrite = (method, s) => {
+    // The relay carries bytes (see "Process output is bytes" in the shims).
+    const __queueRpcWrite = (method, bytes) => {
       __rpcWriteCount++;
       const __task = __rpcWriteChain
-        .then(() => __supervisor[method](s))
-        .catch((e) => __onRpcDrop(s.length, e));
+        .then(() => __supervisor[method](bytes))
+        .catch((e) => __onRpcDrop(bytes.byteLength, e));
       __rpcWriteChain = __task.then(() => {}, () => {});
       __pendingIO.push(__task);
     };
@@ -854,13 +872,13 @@ ${ENTRYPOINT_EVENT_LOOP}
 ${RESIDENCY_MISS_REPORT}
 
     if (__supervisor && !captureOutput) {
-      __consoleMod.log = (...a) => { const s = __utilMod.format(...a) + "\\n"; stdout += s; __queueRpcWrite("stdout", s); };
-      __consoleMod.error = (...a) => { const s = __utilMod.format(...a) + "\\n"; stderr += s; __queueRpcWrite("stderr", s); };
+      __consoleMod.log = (...a) => { const s = __utilMod.format(...a) + "\\n"; stdout += s; __queueRpcWrite("stdout", __nimbusOutEnc.encode(s)); };
+      __consoleMod.error = (...a) => { const s = __utilMod.format(...a) + "\\n"; stderr += s; __queueRpcWrite("stderr", __nimbusOutEnc.encode(s)); };
       __consoleMod.warn = __consoleMod.error;
       __consoleMod.info = __consoleMod.log;
       __consoleMod.debug = __consoleMod.log;
-      __processMod.stdout.write = (d, enc, cb) => { if (typeof enc === "function") cb = enc; const s = String(d); stdout += s; __queueRpcWrite("stdout", s); if (typeof cb === "function") queueMicrotask(cb); return true; };
-      __processMod.stderr.write = (d, enc, cb) => { if (typeof enc === "function") cb = enc; const s = String(d); stderr += s; __queueRpcWrite("stderr", s); if (typeof cb === "function") queueMicrotask(cb); return true; };
+      __processMod.stdout.write = (d, enc, cb) => { if (typeof enc === "function") cb = enc; const b = __nimbusOutBytes(d, enc); stdout += __nimbusOutText("stdout", b); __queueRpcWrite("stdout", b); if (typeof cb === "function") queueMicrotask(cb); return true; };
+      __processMod.stderr.write = (d, enc, cb) => { if (typeof enc === "function") cb = enc; const b = __nimbusOutBytes(d, enc); stderr += __nimbusOutText("stderr", b); __queueRpcWrite("stderr", b); if (typeof cb === "function") queueMicrotask(cb); return true; };
     }
 
     try { globalThis.console = __consoleMod; } catch {}
@@ -914,7 +932,7 @@ ${RESIDENCY_MISS_REPORT}
         stderr += trace + "\\n";
         exitCode = 1;
         if (__supervisor && !captureOutput) {
-          try { __pendingIO.push(__supervisor.stderr(trace + "\\n").catch((e2) => __onRpcDrop((trace || "").length + 1, e2))); } catch {}
+          try { const __traceBytes = __nimbusOutEnc.encode(trace + "\\n"); __pendingIO.push(__supervisor.stderr(__traceBytes).catch((e2) => __onRpcDrop(__traceBytes.byteLength, e2))); } catch {}
         }
       }
     }
@@ -943,7 +961,7 @@ ${RESIDENCY_MISS_REPORT}
       if (__residencyReport) {
         stderr += __residencyReport;
         if (Number(code ?? 0) === 0) code = 1;
-        try { await __supervisor.stderr(__residencyReport); } catch {}
+        try { await __supervisor.stderr(__nimbusOutEnc.encode(__residencyReport)); } catch {}
       }
       await __supervisor.reportExit(code, reason || "");
       __nimbusProcessExitReported = true;
@@ -952,7 +970,7 @@ ${RESIDENCY_MISS_REPORT}
       const trace = (e && e.stack) || (e && e.message) || String(e);
       stderr += trace + "\\n";
       if (__supervisor) {
-        try { await __supervisor.stderr(trace + "\\n"); } catch {}
+        try { await __supervisor.stderr(__nimbusOutEnc.encode(trace + "\\n")); } catch {}
         await __nimbusReportFinalExit(1, trace + "\\n");
       }
     };
@@ -1001,7 +1019,7 @@ ${RESIDENCY_MISS_REPORT}
       const tail = "[orphan output: " + __rpcDrops + " dropped RPC write(s), ~" +
         __rpcDropBytes + " bytes lost" +
         (__rpcLastError ? "; last error: " + __rpcLastError : "") + "]\\n";
-      try { await __supervisor.stderr(tail); } catch {}
+      try { await __supervisor.stderr(__nimbusOutEnc.encode(tail)); } catch {}
     }
     if (exitCode !== 0) {
       if (__supervisor && !__nimbusProcessExitReported) {
@@ -1057,16 +1075,15 @@ export class NimbusProcess extends DurableObject {
  * `bundleSource`, `serializedManifest` and `serializedMetadata` are total
  * encodings of `bundle`, `manifest` and `metadata` — no caller can distinguish
  * a state carrying both from one carrying only the serialized halves, because
- * `generateEntrypointCode` reads the serialized halves and nothing else does.
+ * both facet generators read the serialized halves and nothing else does.
  * Holding both doubles the cost of a cached entry for its whole lifetime, and
  * that lifetime spans execs.
  *
- * Only for states on the one-shot cached path, and applied there whether or
- * not the entry turns out small enough to retain: the invocation being served
- * reads the serialized forms too. `spawnNode` and `_stageOpencodeFacet` build
- * their own uncached states and genuinely re-read the raw cells
- * (`_serializeBundleForFacet`, `assertStagedBundleFitsRpcPayload`); neither
- * goes through here.
+ * Applied by `_buildProcessBundle` to every state it builds, whether or not
+ * the entry turns out small enough to retain: the launch being served reads
+ * the serialized forms too. `_stageOpencodeFacet` builds its own uncached
+ * state and genuinely re-reads the raw cells
+ * (`assertStagedBundleFitsRpcPayload`); it does not go through here.
  */
 export function releaseSerializedSources(vfsState) {
     if (vfsState.bundleSource)
@@ -1076,31 +1093,6 @@ export function releaseSerializedSources(vfsState) {
     if (vfsState.serializedMetadata !== undefined)
         vfsState.metadata = {};
 }
-/**
- * Drop everything a resident launch has finished reading, in place.
- *
- * The one-shot path releases its map at LOADER.load; this is the same policy
- * for the path `spawnNode` takes, which is the path every attached-TTY npm bin
- * takes — how a real agentic CLI starts. The generated source is a total
- * encoding of the cells, the manifest and the metadata, and the only thing the
- * rest of a launch reads off the state is `cursor`. Everything else is a second
- * copy of the largest thing this DO builds — 22.9 MB for pi — held for exactly
- * as long as the facet takes to boot on it.
- *
- * Holding it reset the session isolate with exceededMemory, and an isolate
- * reset tears the terminal WebSocket down with no exit frame: the dead screen
- * reading "[process terminal closed]".
- *
- * An emptied state can still generate a map — it would just generate one with
- * no program in it — so this marks the state instead of trusting callers to
- * stop.
- */
-export function releaseResidentLaunchSources(vfsState) {
-    vfsState.bundle = {};
-    vfsState.manifest = {};
-    vfsState.metadata = {};
-    vfsState.generatedSourcesReleased = true;
-}
 /**
  * Drop the serialized forms once a module map has been generated from them.
  *
@@ -1108,12 +1100,19 @@ export function releaseResidentLaunchSources(vfsState) {
  * bundle expression, the manifest and the metadata is inside it. Holding them
  * afterwards keeps a second copy of the largest thing this DO builds alive for
  * as long as the facet runs — for pi, 22.7 MB across the ~20 s window in which
- * the isolate was being reset.
+ * the isolate was being reset. For the one-shot path that window is the run;
+ * for a resident launch — the path every attached-TTY npm bin takes, how a
+ * real agentic CLI starts — it is the boot, and holding the copy across it
+ * reset the session isolate with exceededMemory, which tears the terminal
+ * WebSocket down with no exit frame: the dead screen reading "[process
+ * terminal closed]".
  *
  * Only for a state the prefetch cache refused. A retained entry's serialized
- * forms ARE the entry, and a later exec is served from them.
+ * forms ARE the entry, and a later launch is served from them. An emptied
+ * state could still generate a map — one with no program in it — so this
+ * marks the state instead of trusting callers to stop.
  */
-function releaseGeneratedSources(vfsState) {
+export function releaseGeneratedSources(vfsState) {
     vfsState.bundleSource = undefined;
     vfsState.serializedManifest = undefined;
     vfsState.serializedMetadata = undefined;
@@ -1166,6 +1165,29 @@ function _readBundleCell(vfs, path) {
 function _bundleCellLength(cell) {
     return typeof cell === 'string' ? cell.length : cell.byteLength;
 }
+/**
+ * Pre-read admission check for a bundle candidate: refuse BEFORE reading
+ * when the file's on-disk size already exceeds the remaining bundle budget
+ * or the caller's per-file ceiling. Without this every helper read a file
+ * in full, then discarded it when the post-read `cellLen` check tripped —
+ * on trees with several 5–10 MiB artifacts that read alone was the memory
+ * pressure that reset the isolate.
+ *
+ * `perFileCeiling` is the pass's own cap (e.g. CWD_SNAPSHOT_MAX_FILE_BYTES,
+ * BIN_PACKAGE_SPECULATIVE_MAX_FILE_BYTES); omit it for budget-only checks.
+ */
+function _bundleAdmits(vfs, path, budgetState, perFileCeiling) {
+    let size;
+    try {
+        size = vfs.lstat(path).size;
+    }
+    catch {
+        return false;
+    }
+    if (perFileCeiling !== undefined && size > perFileCeiling)
+        return false;
+    return budgetState.totalBytes + size <= VFS_BUNDLE_MAX_BYTES;
+}
 /** What a bundle currently weighs, and so what one more pass over it costs. */
 function _bundleWeight(bundle) {
     let weight = 0;
@@ -1770,12 +1792,16 @@ function addUnreadableDenialCells(vfs, bundle, metadata) {
  * computed-path requires). Bounded to package.json + 1 main-entry file
  * per package — sub-agent §Q3 quantified the worst-case cumulative
  * budget impact (~322 KiB for fastify, ~1.7 MiB for ts-jest).
+ *
+ * `requiredPaths` is the static require closure. A package the closure
+ * already reached — but reached only through a SUBPATH — has its main entry
+ * skipped; see `mainIsSpeculative`.
  */
 // can verify the hash-chunk + shared/ oversample directly. Pre-X.5-C this
 // was a file-local helper. Adding the named export is a pure surface
 // addition — no callers other than buildPrefetchBundle (same file) and
 // the new probe.
-export function greedyAddMainEntries(vfs, cwd, bundle, budgetState) {
+export function greedyAddMainEntries(vfs, cwd, bundle, budgetState, requiredPaths = new Set()) {
     let added = 0;
     const cwdStripped = cwd.replace(/^\/+/, '');
     const nmDir = cwdStripped + '/node_modules';
@@ -1801,7 +1827,16 @@ export function greedyAddMainEntries(vfs, cwd, bundle, budgetState) {
             // supervisor's headroom — on every invocation that never reads it.
             // Anything the program really requires arrives through the closure,
             // which is uncapped.
-            if (vfs.lstat(stripped).size > BIN_PACKAGE_SPECULATIVE_MAX_FILE_BYTES)
+            if (!_bundleAdmits(vfs, stripped, budgetState, BIN_PACKAGE_SPECULATIVE_MAX_FILE_BYTES))
+                return false;
+            // A guess must not be a native binary. Nothing in a Workers isolate can
+            // load a `.node` addon or a `.exe` — the ABI policy classifies them
+            // native-unsupported and the installer says so at install time — so
+            // admitting one spends the budget on bytes no code path can reach.
+            // Measured: freeing 1.3 MiB of rollup let `@napi-rs/lzma-linux-x64-gnu`'s
+            // 1,445,448-byte `.node` in, which the size guard had been evicting.
+            // Only the guess is filtered; a path the closure requires is untouched.
+            if (stripped.endsWith('.node') || stripped.endsWith('.exe'))
                 return false;
             // hardening-r5: preserve binary content as Uint8Array.
             const content = _readBundleCell(vfs, stripped);
@@ -1838,8 +1873,42 @@ export function greedyAddMainEntries(vfs, cwd, bundle, budgetState) {
                 collectExportLeaves(node[k], out);
         }
     }
+    /**
+     * Whether guessing at `pkgDir`'s main entry is still a guess.
+     *
+     * It is, for a package nothing required: that is what this pass exists for,
+     * and a dynamic `require(variable)` leaves no edge to follow. It is NOT for
+     * a package the closure reached only through a subpath export — there the
+     * program has told us exactly which corner of the package it uses, and the
+     * main entry is a different graph that no require reaches. Adding it anyway
+     * is how `rollup/parseAst` (7.9 KB of binding) dragged in rollup's whole
+     * bundler: `dist/shared/rollup.js` at 941 KB and, through the `module`
+     * candidate, `dist/es/shared/node-entry.js` at 951 KB — measured together
+     * as 46.5% of a real-vite snapshot, reached by no require in it.
+     *
+     * A package that loads its own main from a subpath at runtime does so
+     * through a static edge, so it is in the closure and unaffected.
+     */
+    function mainIsSpeculative(pkgDir) {
+        const prefix = pkgDir.replace(/^\/+/, '') + '/';
+        let reached = false;
+        for (const path of requiredPaths) {
+            if (!path.startsWith(prefix))
+                continue;
+            // package.json alone is resolution metadata, not a use of the package.
+            if (path === prefix + 'package.json')
+                continue;
+            reached = true;
+            break;
+        }
+        return !reached;
+    }
     function addPkgEntry(pkgDir) {
         addOne(pkgDir + '/package.json');
+        // A package the closure reached keeps exactly what it reached; only an
+        // unreached one gets the guess below.
+        if (!mainIsSpeculative(pkgDir))
+            return;
         let meta;
         try {
             meta = JSON.parse(vfs.readFileString(pkgDir + '/package.json'));
@@ -1939,27 +2008,87 @@ export function greedyAddMainEntries(vfs, cwd, bundle, budgetState) {
             }
         }
     }
-    try {
-        for (const pkg of vfs.readdir(nmDir)) {
-            if (pkg.type !== 'directory')
-                continue;
-            const pkgDir = nmDir + '/' + pkg.name;
-            if (pkg.name.startsWith('@')) {
-                try {
-                    for (const sub of vfs.readdir(pkgDir)) {
-                        if (sub.type === 'directory')
-                            addPkgEntry(pkgDir + '/' + sub.name);
-                    }
-                }
-                catch { /* ignore */ }
-            }
-            else {
-                addPkgEntry(pkgDir);
+    for (const pkgDir of speculativePackageDirs(vfs, cwdStripped, bundle))
+        addPkgEntry(pkgDir);
+    return { added };
+}
+/**
+ * The packages a computed `require(name)` inside the program can plausibly
+ * name: the project root's own runtime `dependencies`, plus every package
+ * ONE `dependencies` hop from a package that already owns a file in the
+ * static closure. Never devDependencies, never a second hop.
+ *
+ * Unbounded, the greedy oversample read every installed package's main:
+ * for `node -e "import('got')"` in got's repo — a one-file static closure —
+ * that was 1,526 files / 10.9 MB from 706 packages, which every later pass
+ * re-scanned and esbuild-wasm transformed, and the exec path's 20 s bundle
+ * deadline fired on a program that reads none of it. A bound that followed
+ * dependency edges from the project's devDependencies reached all 772 of
+ * them (measured), because a library repo's dev toolchain reaches the whole
+ * tree. Computed requires almost always target a declared runtime
+ * dependency of the package doing the requiring, so the bound is one hop
+ * over `dependencies` only. Directories, sorted for a stable bundle.
+ */
+export function speculativePackageDirs(vfs, cwdStripped, bundle) {
+    const runtimeDeps = (pkgJsonPath) => {
+        try {
+            const meta = JSON.parse(vfs.readFileString(pkgJsonPath));
+            const names = new Set();
+            for (const field of ['dependencies', 'optionalDependencies']) {
+                const deps = meta?.[field];
+                if (deps && typeof deps === 'object')
+                    for (const name of Object.keys(deps))
+                        names.add(name);
             }
+            return [...names];
+        }
+        catch {
+            return [];
+        }
+    };
+    // The package that owns a bundle file: the last node_modules segment.
+    const ownerOf = (path) => {
+        const idx = path.lastIndexOf('/node_modules/');
+        if (idx === -1)
+            return null;
+        const segs = path.slice(idx + '/node_modules/'.length).split('/');
+        const name = segs[0]?.startsWith('@') ? segs.slice(0, 2).join('/') : segs[0];
+        return name ? path.slice(0, idx + '/node_modules/'.length) + name : null;
+    };
+    // Resolve a bare name the way require does from `fromDir`: the nearest
+    // node_modules up the tree that has it.
+    const resolveDir = (name, fromDir) => {
+        let dir = fromDir;
+        for (;;) {
+            const candidate = dir + '/node_modules/' + name;
+            if (vfs.exists(candidate + '/package.json'))
+                return candidate;
+            const idx = dir.lastIndexOf('/');
+            if (idx <= 0)
+                return null;
+            dir = dir.slice(0, idx);
+        }
+    };
+    const reached = new Set();
+    const hop = (fromDir) => {
+        for (const name of runtimeDeps(fromDir + '/package.json')) {
+            const dir = resolveDir(name, fromDir);
+            if (dir !== null)
+                reached.add(dir);
         }
+    };
+    hop(cwdStripped);
+    const owners = new Set();
+    for (const path of Object.keys(bundle)) {
+        const owner = ownerOf(path);
+        if (owner !== null)
+            owners.add(owner);
     }
-    catch { /* ignore */ }
-    return { added };
+    for (const owner of owners) {
+        reached.add(owner);
+        hop(owner);
+    }
+    return [...reached].sort();
 }
 /**
  * X.5-Z3: scan every JS source already in `bundle` for static
@@ -2029,6 +2158,8 @@ export function addStaticReadFileAssets(vfs, cwd, bundle, budgetState) {
         try {
             if (!vfs.exists(stripped) || vfs.isDirectory(stripped))
                 return false;
+            if (!_bundleAdmits(vfs, stripped, budgetState))
+                return false;
             // hardening-r5: preserve binary content as Uint8Array.
             const content = _readBundleCell(vfs, stripped);
             const cellLen = _bundleCellLength(content);
@@ -2202,6 +2333,8 @@ export function addStaticReadFileDotfilesAndCompiled(vfs, cwd, bundle, budgetSta
         try {
             if (!vfs.exists(stripped) || vfs.isDirectory(stripped))
                 return false;
+            if (!_bundleAdmits(vfs, stripped, budgetState))
+                return false;
             // hardening-r5: preserve binary content as Uint8Array.
             const content = _readBundleCell(vfs, stripped);
             const cellLen = _bundleCellLength(content);
@@ -2307,7 +2440,7 @@ export function addStaticReadFileDotfilesAndCompiled(vfs, cwd, bundle, budgetSta
  */
 export function addBinTargetSiblings(vfs, scriptPath, bundle, budgetState, bundleProfile) {
     if (!scriptPath)
-        return { added: 0 };
+        return { added: 0, wasmPaths: [] };
     const stripped = scriptPath.replace(/^\/+/, '');
     // Find the *innermost* node_modules/<pkg> root. Handles scoped
     // packages (`@org/name`) too.
@@ -2320,11 +2453,11 @@ export function addBinTargetSiblings(vfs, scriptPath, bundle, budgetState, bundl
         }
     }
     if (nmIdx < 0)
-        return { added: 0 };
+        return { added: 0, wasmPaths: [] };
     const isScoped = segs[nmIdx + 1]?.startsWith('@');
     const pkgEnd = isScoped ? nmIdx + 3 : nmIdx + 2;
     if (pkgEnd > segs.length)
-        return { added: 0 };
+        return { added: 0, wasmPaths: [] };
     const pkgRoot = segs.slice(0, pkgEnd).join('/');
     // npm-create-fix wave (2026-05-12): scaffold profile needs this cap
     // high enough to cover
@@ -2350,6 +2483,10 @@ export function addBinTargetSiblings(vfs, scriptPath, bundle, budgetState, bundl
     // an unread multi-MiB cell costs a stat rather than a transfer.
     let visited = 0;
     const candidates = [];
+    // Every wasm image under the package, whatever its size: an image rides in
+    // the module map by path and is compiled by the loader, so the bundle's
+    // per-file cap does not apply to it (see FacetVfsState.wasmImages).
+    const wasmPaths = [];
     const queue = [pkgRoot];
     while (queue.length > 0 && visited < MAX_PKG_FILES) {
         const dir = queue.shift();
@@ -2379,6 +2516,8 @@ export function addBinTargetSiblings(vfs, scriptPath, bundle, budgetState, bundl
             // to it) or outside this profile's package-data policy.
             if (!shouldIncludeBinPackageFile(pkgRoot, child, bundleProfile))
                 continue;
+            if (child.endsWith('.wasm'))
+                wasmPaths.push(child);
             if (bundle[child] !== undefined)
                 continue;
             let size;
@@ -2409,6 +2548,8 @@ export function addBinTargetSiblings(vfs, scriptPath, bundle, budgetState, bundl
             break;
         if (budgetState.totalBytes >= VFS_BUNDLE_MAX_BYTES)
             break;
+        if (candidate.size > VFS_BUNDLE_MAX_BYTES - budgetState.totalBytes)
+            continue;
         // hardening-r5: preserve binary content as Uint8Array.
         let content;
         try {
@@ -2427,7 +2568,40 @@ export function addBinTargetSiblings(vfs, scriptPath, bundle, budgetState, bundl
         budgetState.fileCount++;
         added++;
     }
-    return { added };
+    return { added, wasmPaths };
+}
+/**
+ * The wasm images a program's closure holds, by path and content digest.
+ *
+ * Two sources, one record: a `.wasm` cell the walk already staged (digested
+ * from the cell, no second read), and a `.wasm` file the bin-package pass
+ * saw but did not stage because it is over the bundle's per-file cap —
+ * esbuild-wasm's 11.9 MiB image is the motivating one. A launch stages each
+ * as a module-map member the loader compiles, registered under both keys,
+ * so the program's own `new WebAssembly.Module(bytes)` is answered from the
+ * map whether it read the bytes by path or carried them inline. A file that
+ * cannot be read is left out; the seam's refusal names the module later.
+ */
+export function collectClosureWasmImages(vfs, bundle, unstagedPaths) {
+    const byPath = new Map();
+    for (const [path, cell] of Object.entries(bundle)) {
+        if (!path.endsWith('.wasm') || !(cell instanceof Uint8Array))
+            continue;
+        byPath.set(path, { vfsPath: '/' + stripLeadingSlashes(path), digest: wasmImageDigest(cell) });
+    }
+    for (const path of unstagedPaths) {
+        if (byPath.has(path))
+            continue;
+        let bytes;
+        try {
+            bytes = vfs.readFile(path);
+        }
+        catch {
+            continue;
+        }
+        byPath.set(path, { vfsPath: '/' + stripLeadingSlashes(path), digest: wasmImageDigest(bytes) });
+    }
+    return [...byPath.values()];
 }
 /**
  * Stage the paths an earlier run of the same entry read synchronously and did
@@ -2611,13 +2785,8 @@ function addCwdProjectFiles(vfs, cwd, bundle, budgetState) {
             // Skip an oversized file before reading it: this walk guesses at what
             // the program might read, and one guess must not spend the budget (or
             // the supervisor's headroom) that every later invocation then carries.
-            try {
-                if (vfs.lstat(child).size > CWD_SNAPSHOT_MAX_FILE_BYTES)
-                    continue;
-            }
-            catch {
+            if (!_bundleAdmits(vfs, child, budgetState, CWD_SNAPSHOT_MAX_FILE_BYTES))
                 continue;
-            }
             let content;
             try {
                 content = _readBundleCell(vfs, child);
@@ -2687,6 +2856,8 @@ function addEntryAbsPathReads(vfs, entryCode, bundle, budgetState) {
         try {
             if (!vfs.exists(stripped) || vfs.isDirectory(stripped))
                 return;
+            if (!_bundleAdmits(vfs, stripped, budgetState))
+                return;
             // hardening-r5: preserve binary content as Uint8Array.
             const content = _readBundleCell(vfs, stripped);
             const cellLen = _bundleCellLength(content);
@@ -3039,7 +3210,7 @@ async function transformEsmInBundle(bundle, esbuild, pacer, isolatedTransform) {
  * behaviour for code paths that don't have esbuild handy).
  *
  */
-export async function buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bundleProfile = DEFAULT_FACET_BUNDLE_PROFILE, observedReads, pacer, isolatedTransform) {
+export async function buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bundleProfile = DEFAULT_FACET_BUNDLE_PROFILE, observedReads, pacer, isolatedTransform, maxBundleBytes) {
     // This build accumulates raw VFS contents in the supervisor heap, and did it
     // with nothing watching: the estimator read 9.4 MiB while these bytes were
     // resetting the DO three times. Take the budget the enrichment passes are
@@ -3049,19 +3220,25 @@ export async function buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbui
     const lease = await acquireSupervisorAllocation(VFS_BUNDLE_MAX_BYTES);
     prefetchBundleStart(VFS_BUNDLE_MAX_BYTES);
     try {
-        return await _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bundleProfile, observedReads, pacer, isolatedTransform);
+        return await _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bundleProfile, observedReads, pacer, isolatedTransform, maxBundleBytes);
     }
     finally {
         prefetchBundleEnd(VFS_BUNDLE_MAX_BYTES);
         lease.release();
     }
 }
-async function _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bundleProfile = DEFAULT_FACET_BUNDLE_PROFILE, observedReads, pacer, isolatedTransform) {
+async function _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bundleProfile = DEFAULT_FACET_BUNDLE_PROFILE, observedReads, pacer, isolatedTransform, maxBundleBytes = VFS_BUNDLE_MAX_BYTES) {
     // Read the cursor BEFORE the walk: a mutation that lands while the bundle
     // is being assembled must be reported as invalidated, not silently missed.
     const cursor = { epoch: vfs.epoch, rev: vfs.revision() };
     // 1. Static reachable-set walk from entry.
-    const prefetch = prefetchForRequire(vfs, entryCode || '', cwd, scriptPath);
+    const prefetch = prefetchForRequire(vfs, entryCode || '', cwd, scriptPath, maxBundleBytes);
+    if ('kind' in prefetch) {
+        // A required closure larger than the bound can never launch as a
+        // snapshot. Surface it as the process's own failure rather than a
+        // build error: the caller maps it to exit 1 + stderr.
+        throw new ClosureBoundExceededError(prefetch);
+    }
     const bundle = { ...prefetch.bundle };
     const requiredPaths = new Set(Object.keys(prefetch.bundle));
     let truncated = false;
@@ -3092,7 +3269,7 @@ async function _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bu
     //    Catches dynamic-require / `bindings()` / plugin-loader cases the
     //    regex prefetch misses. Its budget is independent from the complete
     //    static require closure, which is correctness-critical.
-    const greedy = greedyAddMainEntries(vfs, cwd, bundle, budgetState);
+    const greedy = greedyAddMainEntries(vfs, cwd, bundle, budgetState, requiredPaths);
     await paceAfterPass();
     // 2.25 X.5-Z3: static-readFileSync asset prefetch. Scans every
     //      bundle .js/.mjs/.cjs source for the canonical jsdom shape:
@@ -3125,7 +3302,6 @@ async function _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bu
     //      as data, etc.) without needing a per-pkg whitelist.
     //      No-op when entry isn't inside node_modules.
     const binSiblingAdd = addBinTargetSiblings(vfs, scriptPath, bundle, budgetState, bundleProfile);
-    void binSiblingAdd;
     await paceAfterPass();
     // 2.34 project-data snapshot: sync Node fs cannot await the
     // supervisor. Include a bounded snapshot of the current working tree
@@ -3241,6 +3417,7 @@ async function _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bu
     const bundleSideModulesRequired = size.bytes > BUNDLE_MAX_ENCODED_BYTES;
     // Suppress lint: `greedy.added` is observed only via diagnostics.
     void greedy;
+    const wasmImages = collectClosureWasmImages(vfs, bundle, binSiblingAdd.wasmPaths);
     return {
         bundle,
         manifest,
@@ -3249,8 +3426,11 @@ async function _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bu
         reachableCount: fileCount,
         truncated,
         bundleSideModulesRequired,
+        ...(wasmImages.length > 0 ? { wasmImages } : {}),
     };
 }
+/** The main module name a worker launch boots from unless told otherwise. */
+export const DEFAULT_WORKER_MAIN_MODULE = 'worker.js';
 const ROUTEABLE_PORT_ATTACH_TIMEOUT_MS = 1_000;
 /** A port request may wait this long for a durable app's re-drive to boot. */
 const DURABLE_ENSURE_BOOT_BUDGET_MS = 12_000;
@@ -3316,7 +3496,6 @@ export class FacetManager {
      * journal recovery rides the first pump.
      */
     launchPump;
-    timedOutProcessIds = new Set();
     // attach-pid → serve-pid: the resident serve facet a bare-`opencode` dual
     // spawn created as an OS-child of the attach TUI. When the attach process
     // exits (reported / killed), its serve facet is torn down with it.
@@ -3564,61 +3743,92 @@ export class FacetManager {
      */
     setEsbuildService(esbuild) { this.esbuild = esbuild; }
     /**
-     * buildPrefetchBundle wrapped in a global-revision-keyed cache. On a hit
-     * (same key AND the VFS hasn't been mutated since) it returns the memoized
-     * bundle + pre-built facet source, skipping the full VFS walk + esbuild
-     * pass + source construction. See `prefetchBundleCache` for the
-     * correctness argument behind the conservative global-revision watermark.
-     *
-     * The bundle source and manifest are computed once on the miss path and
-     * stored so subsequent hits skip rebuilding them too.
+     * The pacer every launch is built under: the session's alarm-driven turn
+     * pump, the deployment's chunk bound, and the one check a suspended launch
+     * makes when it resumes — that the process it is building for still exists.
      */
+    _launchPacer(pid) {
+        return new TurnBudget(this.launchPump, turnChunkMaxBytes(this.env), () => this._assertLaunchStillOwned(pid));
+    }
     /**
-     * Bound the prefetch build, so a cache miss cannot be a silent hang.
+     * Assemble the filesystem bundle a process boots on, across as many
+     * Durable Object turns as it takes.
+     *
+     * The one builder for every Node process this manager starts. A one-shot
+     * exec and a resident launch used to own two copies of this: exec's was
+     * memoized behind the prefetch cache and raced a wall-clock deadline in a
+     * single turn; the resident's was paged with a TurnBudget and never cached.
+     * Two paths, one job — and a tree large enough to page on one path hit the
+     * deadline on the other, failing every `node -e` in it with "assembling the
+     * filesystem bundle … exceeded". What the two callers genuinely differ in is
+     * the entry, the working directory and the process they build for; that is
+     * all they supply. Everything else — the revision-keyed cache and its stale
+     * eviction, the residency profile a previous miss learned, the reachable-set
+     * walk and its enrichment passes, the ESM→CJS transform, the manifest and
+     * metadata, the module-map serialization with its side-module split, the
+     * `node:sqlite` answer, and the release of the raw cells once they are
+     * serialized — happens here, once, and yields the turn whenever a chunk's
+     * worth of it has been done.
      *
-     * The build was awaited entirely OUTSIDE `_execWithTimeout`, which wraps
-     * only `_execViaLoader`. So every timeout in the system — the 30 s facet
-     * bound, the 60 s bin-dispatch bound — sat downstream of a step that could
-     * take arbitrarily long, and a heavy build wedged the Durable Object with
-     * nothing able to report it. Observed as a terminal that goes quiet and
-     * never returns, with no exit record for the process.
+     * There is no deadline. A launch that spans turns costs turns, not a held
+     * thread, so a large tree is not a defect to be reported at N seconds; the
+     * pacer's `stillWanted` check is what ends a build nothing will use — a
+     * process killed while its build was suspended throws from the next resume,
+     * and the caller reports that as it reports any other launch failure.
      *
-     * WHAT THIS CAN AND CANNOT CATCH, stated plainly because the difference
-     * decides whether a given hang is fixed by it. The build is asynchronous —
-     * it awaits the VFS walk and the esbuild ESM→CJS pass — so a stall at any
-     * of those points is caught and reported here. A stall inside ONE
-     * synchronous stretch is not: a JS stack that never yields cannot be raced
-     * by anything in the same isolate, so serializing a multi-megabyte bundle
-     * in a single pass still wedges, and the deadline fires only once the stack
-     * finally unwinds. That class needs the work bounded at its INPUT rather
-     * than timed at its edge, which is a separate change; this one converts
-     * every interruptible stall from a silent wedge into a loud failure, and
-     * makes the remaining class the only one left to explain.
+     * The returned state carries its serialized forms (`bundleSource`,
+     * `serializedManifest`, `serializedMetadata`) and has already released the
+     * raw ones: `generateEntrypointCode` and `generateLongRunningNodeCode` read
+     * the serialized forms and nothing else. A state the cache retained belongs
+     * to the cache — a caller must not release its serialized forms either
+     * (`cacheRetained` says which); one the cache refused belongs to the caller
+     * alone, and `releaseGeneratedSources` drops it once a map is generated.
+     *
+     * A session without a filesystem gets an empty state: there is nothing to
+     * stage and nothing to yield for.
      */
-    async _withBundleBuildDeadline(build, command) {
-        let timer;
-        try {
-            return await Promise.race([
-                build,
-                new Promise((_resolve, reject) => {
-                    timer = setTimeout(() => reject(new Error(`Nimbus: assembling the filesystem bundle for \`${command}\` exceeded `
-                        + `${BUNDLE_BUILD_DEADLINE_MS}ms. The process was not started. This is the `
-                        + 'bundle build, not the program: it runs in the session Durable Object, so '
-                        + 'it is reported rather than allowed to wedge the session.')), BUNDLE_BUILD_DEADLINE_MS);
-                }),
-            ]);
-        }
-        finally {
-            if (timer !== undefined)
-                clearTimeout(timer);
-            // The build keeps running after a timeout — nothing here can interrupt
-            // it — so its rejection must not surface later as an unhandled one.
-            build.catch(() => { });
+    /**
+     * The closure's wasm images as module-map members for a one-shot facet,
+     * read by path under the process's own credential. An image that cannot
+     * be read is left out; the program's compile then meets the seam's own
+     * refusal, which names the module.
+     */
+    _wasmModulesByValue(entry, wasmImports) {
+        const modules = {};
+        if (!this.vfs || wasmImports.length === 0)
+            return modules;
+        const vfs = this.vfs.as(entry.cred);
+        for (const image of wasmImports) {
+            let bytes;
+            try {
+                bytes = vfs.readFile(stripLeadingSlashes(image.vfsPath));
+            }
+            catch {
+                continue;
+            }
+            modules[image.moduleName] = {
+                wasm: bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength),
+            };
         }
+        return modules;
     }
-    async _buildPrefetchBundleCached(vfs, scriptPath, cwd, entryCode, credKey, bundleProfile) {
-        const profile = bundleProfile ?? DEFAULT_FACET_BUNDLE_PROFILE;
-        const key = `${profile}\x00${credKey}\x00${cwd}\x00${scriptPath ?? ''}\x00${_fnv1a(entryCode)}`;
+    async _buildProcessBundle(entry, spec, pacer) {
+        if (!this.vfs) {
+            return { bundle: {}, manifest: {}, metadata: {}, reachableCount: 0, truncated: false };
+        }
+        // W3.5 Fix B: thread an EsbuildService into buildPrefetchBundle so ESM
+        // source files (e.g. tldts/dist/es6/index.js, @remix-run/react,
+        // @tailwindcss/vite, react-remove-scroll, astro) get transformed to CJS
+        // before they hit the facet's `new Function` pre-compile loop. Lazy-create
+        // one if NimbusSession didn't share its own.
+        if (!this.esbuild)
+            this.esbuild = new EsbuildService(this.vfs.as(CRED_KERNEL));
+        this.imageStore.ensureDir();
+        const vfs = this.vfs.as(entry.cred);
+        const { cred } = entry;
+        const profile = spec.bundleProfile ?? DEFAULT_FACET_BUNDLE_PROFILE;
+        const credKey = `${cred.uid}:${cred.gid}:${cred.groups.join(',')}`;
+        const key = `${profile}\x00${credKey}\x00${spec.cwd}\x00${spec.scriptPath ?? ''}\x00${_fnv1a(spec.entryCode)}`;
         const revision = vfs.revision();
         // An entry built at an older revision can never be SERVED again — the
         // lookup below requires an exact match — so from the first write after it
@@ -3627,11 +3837,11 @@ export class FacetManager {
         // replaces it allocates, so the stale filesystem graph and the new one
         // never co-reside.
         let evictedStale = false;
-        for (const [staleKey, entry] of this.prefetchBundleCache) {
-            if (entry.revision === revision)
+        for (const [staleKey, stale] of this.prefetchBundleCache) {
+            if (stale.revision === revision)
                 continue;
             this.prefetchBundleCache.delete(staleKey);
-            this.prefetchCacheBytes -= entry.bytes;
+            this.prefetchCacheBytes -= stale.bytes;
             evictedStale = true;
         }
         if (evictedStale)
@@ -3643,24 +3853,26 @@ export class FacetManager {
             this.prefetchBundleCache.set(key, cached);
             return { ...cached.vfsState, cacheHit: true, cacheRetained: true };
         }
-        const vfsState = await buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, this.esbuild || undefined, bundleProfile, this.residencyProfiles.get(key), undefined, this.hooks.transformLargeEsm);
+        const vfsState = await buildPrefetchBundle(vfs, spec.scriptPath, spec.cwd, spec.entryCode, this.esbuild, profile, this.residencyProfiles.get(key), pacer, this.hooks.transformLargeEsm);
         vfsState.bundleKey = key;
-        vfsState.bundleSource = await buildFacetVfsBundleSource(vfsState.bundle, vfsState.bundleSideModulesRequired);
+        vfsState.bundleSource = await buildFacetVfsBundleSource(vfsState.bundle, vfsState.bundleSideModulesRequired, pacer);
         vfsState.serializedManifest = JSON.stringify(vfsState.manifest);
         vfsState.serializedMetadata = JSON.stringify(vfsState.metadata);
+        // Two more serializations of the same weight as the passes before them.
+        await pacer.spend(vfsState.serializedManifest.length + vfsState.serializedMetadata.length);
         // The only consumer of the raw cells past this point is a single boolean,
         // so answer it now rather than hold ~17 MB (pi) to answer it later.
-        vfsState.usesNodeSqlite = bundleUsesNodeSqlite(entryCode, vfsState.bundle);
+        vfsState.usesNodeSqlite = bundleUsesNodeSqlite(spec.entryCode, vfsState.bundle);
         vfsState.cacheHit = false;
         // Serialization is total: bundleSource/serializedManifest/serializedMetadata
-        // carry every byte the raw cells and objects do, and generateEntrypointCode
-        // reads only the serialized forms. Retaining both doubled what an entry
-        // costs for its whole lifetime — measured for pi at 502af77, per entry:
-        // raw 17,253,610 + source 18,262,324 + manifest 600,060 + metadata
-        // 3,841,244 = 39,957,238 B, of which the raw halves are 21,694,914 B held
-        // to answer `usesNodeSqlite`. Dropping them is a pure release: nothing
-        // downstream of this method reads them, and a cache MISS rebuilds from the
-        // VFS rather than from anything discarded here.
+        // carry every byte the raw cells and objects do, and both generators read
+        // only the serialized forms. Retaining both doubled what an entry costs
+        // for its whole lifetime — measured for pi at 502af77, per entry: raw
+        // 17,253,610 + source 18,262,324 + manifest 600,060 + metadata 3,841,244
+        // = 39,957,238 B, of which the raw halves are 21,694,914 B held to answer
+        // `usesNodeSqlite`. Dropping them is a pure release: nothing downstream of
+        // this method reads them, and a cache MISS rebuilds from the VFS rather
+        // than from anything discarded here.
         //
         // Released BEFORE admission so the byte bound prices what the entry costs
         // from here on, not the peak it passed through on the way in.
@@ -3823,7 +4035,7 @@ export class FacetManager {
         if (opts.skipSpawn && opts.callerPid != null) {
             // The caller already allocated the PID via the supervisor
             // (with their own user-facing label). Look up the full entry
-            // from the table — _execWithTimeout etc. need the canonical
+            // from the table — the exec path needs the canonical
             // ProcessEntry shape. Do NOT reap() either: reaping would
             // clear the caller's just-spawned entry because its startTime
             // is recent (< 60s) but reap() ALSO drops 'running' entries
@@ -3848,30 +4060,62 @@ export class FacetManager {
                 catch { }
             }
         }
-        // W3.5 Fix B: thread an EsbuildService into buildPrefetchBundle so
-        // ESM source files (e.g. tldts/dist/es6/index.js, @remix-run/react,
-        // @tailwindcss/vite, react-remove-scroll, astro) get transformed to
-        // CJS before they hit the facet's `new Function` pre-compile loop.
-        // Lazy-create one if NimbusSession didn't share its own.
-        if (this.vfs && !this.esbuild) {
-            this.esbuild = new EsbuildService(this.vfs.as(CRED_KERNEL));
-        }
         const diagOn = isExecDiagEnabled();
         const __bundleStart = diagOn ? Date.now() : 0;
-        if (this.vfs)
-            this.imageStore.ensureDir();
-        const processVfs = this.vfs?.as(entry.cred);
-        const credKey = `${entry.cred.uid}:${entry.cred.gid}:${entry.cred.groups.join(',')}`;
-        const vfsState = processVfs
-            ? await this._withBundleBuildDeadline(this._buildPrefetchBundleCached(processVfs, opts.filename, opts.cwd || '/home/user', code, credKey, opts.bundleProfile), command)
-            : { bundle: {}, manifest: {}, metadata: {}, reachableCount: 0, truncated: false };
+        // Paced like a resident launch: a tree too large for one turn costs
+        // turns, and the pacer's stillWanted check ends a build whose process was
+        // killed while it was suspended. The pacer is settled in the finally
+        // below and not before, because the invocation that granted the last
+        // chunk awaits `chunkEnded` (PacedWork.pump) and has to stay the one
+        // that owns the run: settling at the end of the build would release that
+        // turn with the facet still to load and run on it.
+        const pacer = this._launchPacer(entry.pid);
+        let vfsState;
+        try {
+            vfsState = await this._buildProcessBundle(entry, { scriptPath: opts.filename, cwd: opts.cwd || '/home/user', entryCode: code, bundleProfile: opts.bundleProfile }, pacer);
+        }
+        catch (err) {
+            // The require closure that cannot fit the snapshot bound is the
+            // process's own answer, not a build failure: exit 1 with a stderr
+            // that names the entry, the staged bytes at the stop, the bound,
+            // and the remedy — the same shape the got/next guards print.
+            pacer.settle();
+            if (err instanceof ClosureBoundExceededError) {
+                const o = err.outcome;
+                const mib = (n) => `${(n / 1048576).toFixed(1)} MiB`;
+                const stderr = `require closure for ${o.entry} exceeds the snapshot bound: ` +
+                    `${mib(o.bytesSeen)} staged when ${o.lastPath} crossed the ` +
+                    `${mib(o.bound)} bound; the process was not started.\n` +
+                    `Run it as a server or split the entry; there is no flag to bypass.`;
+                if (this.processes.get(entry.pid)?.state === 'running') {
+                    this._failLaunch(entry.pid, stderr);
+                }
+                return { exitCode: 1, stdout: '', stderr };
+            }
+            // A failed build is thrown to the caller exactly as before. What must
+            // not be left behind is the process entry: it was spawned above and
+            // would otherwise sit 'running' forever for a process that never
+            // started. A build ended by a kill finds its entry already exited and
+            // reports nothing twice.
+            if (this.processes.get(entry.pid)?.state === 'running') {
+                this._failLaunch(entry.pid, `assembling the filesystem bundle for \`${command}\` failed: ${errorMessage(err)}`);
+            }
+            throw err;
+        }
         const bundleMs = diagOn ? Date.now() - __bundleStart : 0;
         const diagSink = diagOn
             ? { loadMs: 0, runMs: 0, moduleMapBytes: 0, bundleBytes: 0, manifestBytes: 0, metadataBytes: 0 }
             : undefined;
         const abortController = new AbortController();
+        // Ctrl-C / kill on a user program has to end the in-flight run, not just
+        // mark the table row: the runOnce request carries this signal.
+        this.processes.setTerminator(entry.pid, () => abortController.abort());
+        // A shell Ctrl+C arrives as an abort on the command's signal — it is the
+        // same kill, forwarded onto the controller the runOnce request carries.
+        const onShellAbort = () => abortController.abort();
+        opts.signal?.addEventListener('abort', onShellAbort, { once: true });
         try {
-            const result = await this._execWithTimeout(this._execViaLoader(code, opts, entry, vfsState, abortController.signal, diagSink), entry, () => abortController.abort());
+            const result = await this._execViaLoader(code, opts, entry, vfsState, abortController.signal, diagSink);
             this._flushVfsWrites(result, entry.pid);
             this._recordResidencyMisses(vfsState.bundleKey, result.residencyMisses);
             this.processes.exit(entry.pid, result.exitCode);
@@ -3892,6 +4136,7 @@ export class FacetManager {
                     rpcWrites: result.diag?.rpcWrites ?? 0,
                     fsRpcReads: result.diag?.fsRpcReads ?? 0,
                     cacheHit: vfsState.cacheHit ?? false,
+                    turns: pacer.chunks,
                     exitCode: result.exitCode,
                     at: Date.now(),
                 });
@@ -3899,31 +4144,27 @@ export class FacetManager {
             return result;
         }
         catch (err) {
-            // If the timeout already fired, it already called onExternalExit
-            // with code 124 and reason "timeout…". Don't clobber that with a
-            // generic exit code 1. (_reportExternalExit's guard separately
-            // prevents double-dump; this stops ProcessTable from showing a
-            // different exit code than the ring buffer's footer.)
-            const timedOut = this.timedOutProcessIds.has(entry.pid);
-            const exitCode = timedOut ? 124 : 1;
-            const reason = timedOut ? 'timeout' : `runtime worker error: ${errorMessage(err)}`;
+            // The abort controller firing means this run ended BY a kill — the
+            // shell's Ctrl+C or `kill <pid>`. The process was not a crash and the
+            // abort text is not its stderr: mark it killed and hand back 130 (the
+            // shell's signalled status) with nothing for the terminal to print.
+            if (abortController.signal.aborted) {
+                this.processes.kill(entry.pid);
+                return { exitCode: 130, stdout: '', stderr: '' };
+            }
+            const exitCode = 1;
+            const reason = `runtime worker error: ${errorMessage(err)}`;
             this.processes.exit(entry.pid, exitCode);
-            // W5 Lever 5: ring entry on every catch-path exit.
-            this._w5RecordTermination(entry.pid, exitCode, timedOut ? 'rpc' : 'runtime-worker', reason);
-            // Non-timeout failure: route through external-exit so the log
-            // store marks exit AND the tabs-UI structured event fires. The
-            // timeout path already called onExternalExit from the timeout
-            // handler; _reportExternalExit's getExit() guard dedupes.
-            if (!timedOut) {
-                try {
-                    this.hooks.onExternalExit?.(entry.pid, exitCode, reason);
-                }
-                catch { }
+            this._w5RecordTermination(entry.pid, exitCode, 'runtime-worker', reason);
+            try {
+                this.hooks.onExternalExit?.(entry.pid, exitCode, reason);
             }
+            catch { }
             return { exitCode, stdout: '', stderr: errorMessage(err) };
         }
         finally {
-            this.timedOutProcessIds.delete(entry.pid);
+            opts.signal?.removeEventListener('abort', onShellAbort);
+            pacer.settle();
         }
     }
     /**
@@ -3963,7 +4204,7 @@ export class FacetManager {
     }
     // ── One-shot dynamic Worker entrypoint ────────────────────────────────
     async _execViaLoader(code, opts, entry, vfsState, signal, diagSink) {
-        // Answered by _buildPrefetchBundleCached while the raw cells were still in
+        // Answered by _buildProcessBundle while the raw cells were still in
         // hand; re-deriving it here is what forced them to be retained.
         const usesSqlite = vfsState.usesNodeSqlite ?? bundleUsesNodeSqlite(code, vfsState.bundle);
         const [sqliteModules, shims] = await Promise.all([
@@ -3983,13 +4224,6 @@ export class FacetManager {
             stdin: opts.stdin || '',
             captureOutput: !!opts.captureOutput,
             cred: { ...entry.cred, groups: [...entry.cred.groups] },
-            // Absolute wall-clock instant the entry drain must stop at, derived
-            // from the same FACET_TIMEOUT_MS the supervisor's kill timer uses. It
-            // is stamped here rather than computed facet-side so the budget tracks
-            // the real remaining lifetime; everything still to happen before the
-            // facet runs (module map build, LOADER.load, the RPC hop) only makes
-            // this earlier than the kill, which is the safe direction.
-            entryDeadlineAt: Date.now() + FACET_TIMEOUT_MS - ONE_SHOT_EXIT_RESERVE_MS,
             vfsCursor: vfsState.cursor,
             ...(diagSink ? { diag: true } : {}),
         });
@@ -4003,16 +4237,21 @@ export class FacetManager {
                 // here rather than named by the enclosing frame, and the serialized
                 // forms it was built from are released unless the prefetch cache is
                 // keeping them. Otherwise the coordinator carries a second full copy
-                // of the program for the whole FACET_TIMEOUT_MS the facet then runs
-                // for, which is the window the isolate was being reset in.
+                // of the program for the whole run the facet then performs,
+                // which is the window the isolate was being reset in.
                 code: async () => {
-                    const generatedWorker = await generateEntrypointCode(code, vfsState, usesSqlite, shims);
+                    // A one-shot has no disk reader at load, so the closure's wasm
+                    // images ride by value: read here, inside the scope that holds
+                    // the map, and compiled by the loader like the sqlite sidecar.
+                    const wasmImports = facetWasmImports([], vfsState.wasmImages ?? []);
+                    const wasmModules = this._wasmModulesByValue(entry, wasmImports);
+                    const generatedWorker = await generateEntrypointCode(code, vfsState, usesSqlite, shims, wasmImports);
                     if (diagSink) {
                         diagSink.moduleMapBytes = _encodedSourceBytes(generatedWorker.code);
                         for (const source of Object.values(generatedWorker.modules)) {
                             diagSink.moduleMapBytes += _encodedSourceBytes(source);
                         }
-                        for (const m of Object.values(sqliteModules)) {
+                        for (const m of [...Object.values(sqliteModules), ...Object.values(wasmModules)]) {
                             diagSink.moduleMapBytes += m.wasm.byteLength;
                         }
                         // Read before the release below, which is the last moment the
@@ -4032,7 +4271,7 @@ export class FacetManager {
                         compatibilityDate: CF_COMPAT_DATE,
                         compatibilityFlags: ['nodejs_compat', 'nodejs_compat_v2'],
                         mainModule: 'runner.js',
-                        modules: { 'runner.js': generatedWorker.code, ...generatedWorker.modules, ...sqliteModules },
+                        modules: { 'runner.js': generatedWorker.code, ...generatedWorker.modules, ...sqliteModules, ...wasmModules },
                     };
                 },
                 request: new Request('http://nimbus-runtime.local/run', {
@@ -4440,7 +4679,7 @@ export class FacetManager {
     _assertLaunchStillOwned(pid) {
         if (this.processes.get(pid)?.state === 'running')
             return;
-        throw new Error(`Nimbus: resident launch for pid ${pid} was cancelled while it was suspended`);
+        throw new Error(`Nimbus: the launch for pid ${pid} was cancelled while it was suspended`);
     }
     /**
      * The one way this manager boots a resident process. Every resident process
@@ -4630,34 +4869,6 @@ export class FacetManager {
             vfs.writeFile(path, restored);
         }
     }
-    /** Execution timeout. */
-    async _execWithTimeout(promise, entry, abort) {
-        let timer;
-        const timeout = new Promise((_, reject) => {
-            timer = setTimeout(() => {
-                this.timedOutProcessIds.add(entry.pid);
-                abort();
-                // The process cannot report exit after the request is cancelled, so
-                // notify the session explicitly.
-                try {
-                    this.hooks.onExternalExit?.(entry.pid, 124, // conventional timeout exit code
-                    `timeout after ${FACET_TIMEOUT_MS / 1000}s`);
-                }
-                catch { }
-                reject(new Error(`Process timed out after ${FACET_TIMEOUT_MS / 1000}s`));
-            }, FACET_TIMEOUT_MS);
-        });
-        // Always clear the timer; otherwise a successful run would still
-        // trigger the timeout callback at FACET_TIMEOUT_MS, spuriously
-        // marking the exit code as 124.
-        try {
-            return await Promise.race([promise, timeout]);
-        }
-        finally {
-            if (timer !== undefined)
-                clearTimeout(timer);
-        }
-    }
     /**
      * Re-drive a journalled launch after an instance reset. What the journal
      * row carries is the recipe and nothing else: env and credentials are never
@@ -4669,9 +4880,15 @@ export class FacetManager {
         switch (recipe.kind) {
             case 'node': return this._spawnResident(recipe.code, recipe.opts, attempt);
             case 'worker': {
-                // The embedder's resolver decides everything; only a self-owned
-                // launch — nobody composed an embedder hook — falls through to the
-                // session's image-store default.
+                // Which resolver a worker recipe re-drives through is decided by
+                // `recipe.resident`, and it is not a flag: it is the interpreter
+                // image (`{ runtime, argv }`) of a python/ruby socket server the
+                // SESSION launched for itself. Only those recipes take the
+                // image-store fallback, because the session persisted that image and
+                // no embedder was ever asked about the launch. Every other worker
+                // recipe — an embedder's `spawnWorker`, durable or not — re-drives
+                // through the embedder's `resolveWorkerLaunch`, and falls back to the
+                // image store only when no embedder hook is composed at all.
                 const resolve = recipe.resident
                     ? this.hooks.resolveWorkerLaunchFallback
                     : this.hooks.resolveWorkerLaunch ?? this.hooks.resolveWorkerLaunchFallback;
@@ -4680,15 +4897,18 @@ export class FacetManager {
                 const resolved = await resolve(recipe);
                 if (resolved === null)
                     return undefined;
-                const { 'worker.js': workerCode, ...modules } = resolved.modules;
+                const mainModule = resolved.mainModule ?? recipe.mainModule ?? DEFAULT_WORKER_MAIN_MODULE;
+                const { [mainModule]: workerCode, ...modules } = resolved.modules;
                 if (workerCode === undefined)
-                    throw new Error('resolved worker launch carries no worker.js module');
+                    throw new Error(`resolved worker launch carries no ${mainModule} main module`);
                 return this._spawnWorker(workerCode, record.command, recipe.cwd, {
                     port: recipe.resident ? record.port : recipe.port > 0 ? recipe.port : undefined, modules, compatibilityDate: recipe.compatibilityDate,
                     compatibilityFlags: recipe.compatibilityFlags, startArgs: resolved.startArgs ?? recipe.startArgs,
                     resident: recipe.resident, restart: record.restart,
                     env: resolved.env ?? undefined, globalOutbound: resolved.globalOutbound,
                     vfsWasmModules: resolved.vfsWasmModules,
+                    vfsTextModules: resolved.vfsTextModules,
+                    mainModule,
                     durable: { owner: residentOwner(record) ?? recipe.owner, image: recipe.image },
                 }, attempt);
             }
@@ -4769,7 +4989,7 @@ export class FacetManager {
      */
     async _runResidentLaunch(entry, code, command, opts, attempt) {
         const cwd = opts.cwd || '/home/user';
-        const pacer = new TurnBudget(this.launchPump, turnChunkMaxBytes(this.env), () => this._assertLaunchStillOwned(entry.pid));
+        const pacer = this._launchPacer(entry.pid);
         // Journalled before the first byte of work. A launch that FAILS deletes
         // its row on the way out — its process has already been exited and the
         // user notified, so there is nothing left to owe. A launch that SETTLES
@@ -4881,17 +5101,9 @@ export class FacetManager {
         }
     }
     async _residentLaunchBody(entry, code, command, cwd, opts, pacer, durableFacetName, launchEnv) {
-        if (this.vfs && !this.esbuild) {
-            this.esbuild = new EsbuildService(this.vfs.as(CRED_KERNEL));
-        }
-        if (this.vfs)
-            this.imageStore.ensureDir();
         const diagOn = isExecDiagEnabled();
         const __bundleStart = diagOn ? Date.now() : 0;
-        const processVfs = this.vfs?.as(entry.cred);
-        const vfsState = processVfs
-            ? await buildPrefetchBundle(processVfs, opts.filename, cwd, code, this.esbuild || undefined, opts.bundleProfile, undefined, pacer, this.hooks.transformLargeEsm)
-            : { bundle: {}, manifest: {}, metadata: {}, reachableCount: 0, truncated: false };
+        const vfsState = await this._buildProcessBundle(entry, { scriptPath: opts.filename, cwd, entryCode: code, bundleProfile: opts.bundleProfile }, pacer);
         const bundleMs = diagOn ? Date.now() - __bundleStart : 0;
         // The launch-time overlay (`$PORT`, `$NIMBUS_APP` under a reservation)
         // rides on top of the recipe's env and is never journalled: it is
@@ -4910,12 +5122,15 @@ export class FacetManager {
                 FORCE_COLOR: opts.env?.FORCE_COLOR || '1',
             }
             : spawnEnv;
-        const usesSqlite = bundleUsesNodeSqlite(code, vfsState.bundle);
+        // Answered by _buildProcessBundle while the raw cells were still in hand.
+        const usesSqlite = vfsState.usesNodeSqlite ?? bundleUsesNodeSqlite(code, vfsState.bundle);
         const [sqliteModules, shims] = await Promise.all([
             this.sqliteModuleEntry(usesSqlite),
             fetchNodeShimsCode(this.env),
         ]);
-        let generatedWorker = await generateLongRunningNodeCode(code, vfsState, { ...opts, env: processEnv, cred: entry.cred }, usesSqlite, shims, pacer);
+        // Each image is read by path when the facet loads, never by value here.
+        const wasmImports = facetWasmImports([], vfsState.wasmImages ?? []);
+        let generatedWorker = await generateLongRunningNodeCode(code, vfsState, { ...opts, env: processEnv, cred: entry.cred, wasmImports }, usesSqlite, shims, pacer);
         // Sized here, while the map is still in hand. Reading these after the load
         // would itself be what keeps the map alive, and the whole point of the
         // scoping below is that nothing does.
@@ -4927,21 +5142,31 @@ export class FacetManager {
             }
             moduleMapBytes = _encodedSourceBytes(generatedWorker.code) + bundleBytes;
         }
-        const manifestBytes = diagOn ? _encodedSourceBytes(JSON.stringify(vfsState.manifest)) : 0;
-        const metadataBytes = diagOn ? _encodedSourceBytes(JSON.stringify(vfsState.metadata)) : 0;
+        const manifestBytes = diagOn ? _encodedSourceBytes(vfsState.serializedManifest ?? '') : 0;
+        const metadataBytes = diagOn ? _encodedSourceBytes(vfsState.serializedMetadata ?? '') : 0;
         const cacheHit = vfsState.cacheHit ?? false;
         const vfsCursor = vfsState.cursor;
-        releaseResidentLaunchSources(vfsState);
+        // The map is generated; the state's only remaining job is its cursor.
+        // Released here, before the boot — releasing afterwards keeps the copy
+        // alive for exactly the window that was resetting the isolate. A state
+        // the cache retained is the cache's to keep, and is served to the next
+        // launch of the same entry.
+        if (!vfsState.cacheRetained)
+            releaseGeneratedSources(vfsState);
         let handle;
         let resourcesTracked = false;
         try {
-            const vfsTextModules = await this.imageStore.materialize(entry.pid, {
+            // Assembled as one record of the SAME string objects the generator
+            // produced — no copy — and then handed over: this frame drops its own
+            // reference before materialize runs, and the sequence below drops each
+            // source as the store takes it, so one image's text is resident rather
+            // than every image's twice over.
+            const sources = {
                 'worker.js': generatedWorker.code,
                 ...generatedWorker.modules,
-            }, pacer);
-            // The image store has taken it; this frame must not be what holds the
-            // only other copy while the facet boots.
+            };
             generatedWorker = undefined;
+            const vfsTextModules = await this.imageStore.materialize(entry.pid, drainSources(sources), pacer);
             // Last gate before the facet exists. A launch now spans many turns, so
             // a kill can land anywhere inside it; booting a process the table has
             // already exited would leave a facet nothing owns, running against a
@@ -4992,6 +5217,7 @@ export class FacetManager {
                     rpcWrites: 0,
                     fsRpcReads: 0,
                     cacheHit,
+                    turns: pacer.chunks,
                     exitCode: 0,
                     at: Date.now(),
                 });
@@ -5035,20 +5261,43 @@ export class FacetManager {
             }
         }
         catch (e) {
+            // A program classified as long-running that ended on its own during
+            // its boot — `json-server --version` prints and exits 0 — reported its
+            // exit through the supervisor, which released the facet and rejected
+            // the boot handshake with 'resident process released'. That is a
+            // completed run, not a failed launch: the process table already holds
+            // its real exit code, and the caller reports that code.
             this.portRegistry.unregisterByPid(entry.pid);
             if (resourcesTracked)
                 this.releaseProcessRpcResources(entry.pid);
-            else
-                handle?.kill();
+            if (this.processExitCode(entry.pid) !== null)
+                return;
+            handle?.kill();
             this._failLaunch(entry.pid, 'long-running node boot failed: ' + errorMessage(e));
             throw e;
         }
     }
     /**
-     * Spawn a long-running dynamic Worker, boot it, and return its boot payload.
+     * The exit code of a launched process that has already ended, or null
+     * while it runs. What a caller that started a resident reads to tell a
+     * server that is up from a program that finished during its boot.
+     */
+    processExitCode(pid) {
+        const entry = this.processes.get(pid);
+        if (entry === undefined || entry.state === 'running')
+            return null;
+        return entry.exitCode ?? 0;
+    }
+    /**
+     * Spawn a long-running dynamic Worker, boot it, and return its boot payload
+     * beside the pid and the process's own inbound facet.
      *
      * The shared primitive for any runtime that serves over
-     * handleHttpRequest(Request) — the python and ruby socket servers today.
+     * handleHttpRequest(Request) — the python and ruby socket servers today —
+     * and for an embedder's own Worker-class program: `workerCode` boots as
+     * `opts.mainModule` (default `worker.js`), `opts.modules` ride inline,
+     * `opts.vfsTextModules` and `opts.vfsWasmModules` are read by path when the
+     * facet loads.
      *
      * The interpreter image it carries is the memory that should not sit in the
      * session's own isolate — ruby's interpreter+stdlib alone is 34.3 MiB — and
@@ -5056,6 +5305,11 @@ export class FacetManager {
      * no readiness coupling back into the session: the runner answers
      * startProcess with its boot payload and the caller waits on that one
      * promise, so nothing polls the port to decide the process is up.
+     *
+     * The returned `facet` is bound to the resident handle's route target — the
+     * same target a registered port routes to — so a port-less process can be
+     * invoked directly. It has no release: `kill(pid)` is the one lifecycle
+     * owner, and the facet is dead once the pid is.
      */
     async spawnWorker(workerCode, command, cwd, opts = {}) {
         return this._spawnWorker(workerCode, command, cwd, opts, 0);
@@ -5066,7 +5320,9 @@ export class FacetManager {
             opts = { ...opts, durable: { owner: await deriveResidentOwner(cwd, opts.resident.argv) } };
         }
         this.processes.reap();
-        const entry = this.processes.spawn(command, [], cwd);
+        // The table entry carries the same argv the identity is derived from, so
+        // a runtime resident reads the same way through either path.
+        const entry = this.processes.spawn(command, opts.resident?.argv ?? [], cwd);
         // Stamp the process-table entry so /api/processes exposes this as a
         // long-running process.
         this.processes.setLongRunning(entry.pid);
@@ -5078,6 +5334,10 @@ export class FacetManager {
         catch { }
         const compatibilityDate = opts.compatibilityDate ?? CF_COMPAT_DATE;
         const compatibilityFlags = opts.compatibilityFlags || ['nodejs_compat'];
+        const mainModule = opts.mainModule ?? DEFAULT_WORKER_MAIN_MODULE;
+        if (opts.modules && Object.hasOwn(opts.modules, mainModule)) {
+            throw new Error(`Nimbus: spawnWorker main module '${mainModule}' is also an inline module; workerCode is the main module`);
+        }
         let handle;
         let resourcesTracked = false;
         let record;
@@ -5115,6 +5375,8 @@ export class FacetManager {
                         modules: opts.modules ?? {},
                         ...(opts.env !== undefined ? { env: opts.env } : {}),
                         vfsWasmModules: opts.vfsWasmModules,
+                        vfsTextModules: opts.vfsTextModules,
+                        ...(opts.mainModule !== undefined ? { mainModule: opts.mainModule } : {}),
                         startArgs: opts.startArgs,
                     });
                 await this.ctx.storage.transaction(async (txn) => {
@@ -5141,6 +5403,7 @@ export class FacetManager {
                         compatibilityFlags,
                         ...(opts.durable.image && !opts.resident ? { startArgs: opts.startArgs } : {}),
                         ...(opts.resident ? { resident: opts.resident } : {}),
+                        ...(opts.mainModule !== undefined ? { mainModule: opts.mainModule } : {}),
                     },
                     // The row-level fields `ensureDurableAppOnPort` reads — same values
                     // the recipe carries, stamped so port/owner lookup never depends on
@@ -5185,9 +5448,10 @@ export class FacetManager {
                     code: {
                         compatibilityDate,
                         compatibilityFlags,
-                        mainModule: 'worker.js',
-                        modules: { 'worker.js': workerCode, ...(opts.modules || {}) },
+                        mainModule,
+                        modules: { ...(opts.modules || {}), [mainModule]: workerCode },
                         vfsWasmModules: opts.vfsWasmModules,
+                        ...(opts.vfsTextModules !== undefined ? { vfsTextModules: opts.vfsTextModules } : {}),
                         ...(opts.env !== undefined || launchEnv !== undefined ? { env: { ...opts.env, ...launchEnv } } : {}),
                         ...(opts.globalOutbound !== undefined ? { globalOutbound: opts.globalOutbound } : {}),
                     },
@@ -5218,7 +5482,20 @@ export class FacetManager {
                 }
                 await this._registerResidentPort(entry.pid, opts.port);
             }
-            return { pid: entry.pid, boot };
+            const target = handle.routeTarget;
+            return {
+                pid: entry.pid,
+                boot,
+                facet: {
+                    fetch: (request) => target.handleHttpRequest(request),
+                    connect: async (request) => {
+                        if (typeof target.handleWebSocketRequest !== 'function') {
+                            throw new Error(`Nimbus: worker pid ${entry.pid} accepts no WebSocket upgrades`);
+                        }
+                        return target.handleWebSocketRequest(request);
+                    },
+                },
+            };
         }
         catch (e) {
             this.portRegistry.unregisterByPid(entry.pid);
@@ -5294,7 +5571,14 @@ export class FacetManager {
             this.hooks.notify?.(`\x1b[2m[nimbus: "${row.command}" listened on ${port} but its reservation owns `
                 + `${row.portMismatch.reserved} ($PORT) — the app's URL will not reach it]\x1b[0m\r\n`);
         }
-        const owner = row === undefined ? undefined : residentOwner(row);
+        // A pid nothing journalled — the in-process dev servers, a builtin's
+        // adopted wrapper pid — still has an identity: the process table's. It
+        // re-adopts a reservation it owns exactly as a resident does; the one
+        // thing it cannot do is adopt an EXPLICIT owner, because there is no row
+        // to stamp the adoption on, so it registers ephemeral on that port.
+        const owner = row === undefined
+            ? (await this.residentIdentity(pid))?.owner
+            : residentOwner(row);
         if (claimedBy !== undefined && row !== undefined && this.residentClaims.get(pid) !== claimedBy) {
             const previousOwner = this.residentClaims.get(pid);
             await this._releaseResidentClaim(pid);
@@ -5338,15 +5622,33 @@ export class FacetManager {
         await clearPortCapability({ ctx: this.ctx, portRegistry: this.portRegistry }, port);
         this.portRegistry.register(port, pid);
     }
-    /** What a pid's journal row says about who it is; null for a pid without one. */
+    /**
+     * Who a pid is. One resolver, in precedence order: the ephemeral-duplicate
+     * mark, the journal row (the owner a launch this manager made was stamped
+     * with — derived from the launch's own cwd+argv, or adopted from an
+     * explicit reservation), and finally the process table. The table knows
+     * cwd and argv for every pid, so a serving process nothing journalled — the
+     * in-process Vite dev server, real-vite, a staged artifact, any wrapper pid
+     * a builtin adopted — has the same derived identity shape as a resident
+     * and answers to the same app verbs. It just cannot be re-driven after a
+     * reset: only a journal row carries a recipe. Null only for a pid that is
+     * neither journalled nor running.
+     */
     async residentIdentity(pid) {
         const duplicated = this.ephemeralPids.get(pid);
         if (duplicated !== undefined)
             return { owner: duplicated, ephemeral: true, port: undefined };
         const row = (await this.launchJournal.rows()).get(`${FENCED_WORK_KEY_PREFIX}${pid}`);
-        if (row === undefined)
+        if (row !== undefined)
+            return { owner: residentOwner(row), ephemeral: false, port: row.port };
+        const entry = this.processes.get(pid);
+        if (entry === undefined || entry.state !== 'running')
             return null;
-        return { owner: residentOwner(row), ephemeral: false, port: row.port };
+        return {
+            owner: await deriveResidentOwner(entry.cwd, entry.argv),
+            ephemeral: false,
+            port: this.portRegistry.getAll().find((live) => live.pid === pid)?.port,
+        };
     }
     /**
      * Every stamped identity — the reservations, and the journal rows that
@@ -5398,6 +5700,28 @@ export class FacetManager {
             }
             apps.set(owner, app);
         }
+        // Every process serving a port is an application whether or not a
+        // journal row backs it — the identity comes from the same resolver the
+        // verbs use, so what `list` shows is what `expose` will bind. A row-backed
+        // app already carries its pid from above; this only adds the servers
+        // nothing journalled (the dev servers, adopted wrapper pids).
+        for (const live of this.portRegistry.getAll()) {
+            const identity = await this.residentIdentity(live.pid);
+            if (identity === null || identity.ephemeral || identity.owner === undefined)
+                continue;
+            const app = apps.get(identity.owner) ?? {
+                owner: identity.owner, name: null, port: null, pid: null, status: 'stopped',
+                visibility: 'scoped', capability: null, restart: 'never', diagnostic: null,
+            };
+            if (app.pid !== null)
+                continue;
+            app.pid = live.pid;
+            if (app.port === null)
+                app.port = live.port;
+            if (app.status === 'stopped')
+                app.status = 'running';
+            apps.set(identity.owner, app);
+        }
         return [...apps.values()];
     }
     async registerPort(pid, port) {