@nimbus-sh/worker 0.9.0 → 0.11.0

package/dist/facets/manager.js

@@ -15,29 +15,38 @@
  * Long-running processes use a dynamic Worker entrypoint that stays
  * registered in ProcessTable and PortRegistry until exit or kill.
  */
-import { fetchNodeShimsCode } from '../runtime/node-shims-artifact.js';
+import { MK_COMPILED_FN_SOURCE } from '@nimbus-sh/core/_shared/compiled-fn.js';
+import { exitCodeForSignal } from '@nimbus-sh/core/substrate/lifo/shell/signals.js';
+import { fetchNodeFacetSources } from '../runtime/node-shims-artifact.js';
 import { generateSqliteFacetPreamble } from '../runtime/sqlite-shim.js';
 import { getRealNodeImportsCode } from '@nimbus-sh/core/_shared/real-node-imports.js';
-import { FACET_RESIDENT_STORE_SOURCE } from '../vfs/facet-resident-store.js';
 import { VFS_CURSOR_SEED_SOURCE, serializeFacetVfsCursor, } from '@nimbus-sh/core/_shared/facet-vfs-cursor.js';
-import { VFS_WRITE_LEDGER_SOURCE } from '@nimbus-sh/core/_shared/vfs-write-ledger.js';
-import { ExecutionFs } from '@nimbus-sh/core/shell/execution-fs.js';
+import { typescriptLoader } from '@nimbus-sh/core/_shared/typescript-specifiers.js';
 import { stripLeadingSlashes, vfsPathExtension } from '@nimbus-sh/core/vfs/path.js';
 import { clearPortCapability, listPortReservations, readPortReservation, readPortReservationByOwner, releasePortReservation, restoreReservedPortCapability, } from '../session/port-capability.js';
 import { deriveResidentOwner } from './resident-identity.js';
 import { z } from 'zod/v4';
 import { RESIDENT_OWNER_KEY_PREFIX, DURABLE_IMAGES_KEY_PREFIX } from '../session/keys.js';
 import { PORT_CAPABILITY_KEY_PREFIX } from '../session/keys.js';
-import { unbindPublicPortCapability } from '../router/public-directory.js';
-import { prefetchForRequire, ClosureBoundExceededError } from '@nimbus-sh/core/runtime/require-resolver.js';
-import { hasTopLevelModuleSyntax } from '@nimbus-sh/core/runtime/javascript-ast.js';
+import { sessionIdentity, unbindPublicPortCapability } from '../router/public-directory.js';
+import { prefetchForRequire, requireFsOverBridge, ClosureBoundExceededError } from '@nimbus-sh/core/runtime/require-resolver.js';
+import { hasTopLevelModuleSyntax, parseJavaScriptModule } from '@nimbus-sh/core/runtime/javascript-ast.js';
+import { findStaticFsReferences } from '@nimbus-sh/core/runtime/static-fs-refs.js';
+import { planFacetData } from './data-plan.js';
+import { principalTag, profilePrincipal, ReadProfile, verifiedEvidence, } from './read-profile.js';
+/** What the shared read profile may add to one launch: an eighth of its module map's bytes. */
+const READ_PROFILE_LAUNCH_BYTES = Math.floor(VFS_BUNDLE_MAX_BYTES / 8);
+import { NpmCache } from '../npm/cache.js';
 import { bindImportMetaResolve, importMetaDefines } from '@nimbus-sh/core/runtime/import-meta-transform.js';
+import { mayHaveDynamicImport } from '@nimbus-sh/core/runtime/dynamic-import-rewrite.js';
 import { recordFailure, getLastRpcFrame, getLastFacetId } from '@nimbus-sh/platform/oom-discriminator.js';
 import { classifyError } from '@nimbus-sh/platform/oom-classify.js';
 import { TurnBudget, PacedWork, turnChunkMaxBytes, withResolvers } from '@nimbus-sh/fabric/turn-budget.js';
 import { onColdStart } from '@nimbus-sh/fabric/generation.js';
 import { FencedWork, FENCED_WORK_KEY_PREFIX, } from '@nimbus-sh/fabric/fenced-work.js';
-import { EsbuildService, rewriteBundledEsmToCjs, rewriteProvidedCommonJsModules, } from '@nimbus-sh/core/runtime/esbuild-service.js';
+import { rewriteBundledEsmToCjs, rewriteProvidedCommonJsModules, } from '@nimbus-sh/core/runtime/esbuild-service.js';
+import { errorText } from '@nimbus-sh/core/_shared/error-text.js';
+import { DEFAULT_CJS_CONDITIONS, DEFAULT_ESM_CONDITIONS, resolvePackageEntry, parseResolvablePackageJson, } from '@nimbus-sh/core/_shared/exports-resolver.js';
 import { isExecDiagEnabled, recordExecTelemetry } from './exec-telemetry.js';
 import { disposeRpcResource, disposeRpcResources } from '@nimbus-sh/platform/rpc-dispose.js';
 import { sqliteWasmModuleEntry } from './opencode-staging.js';
@@ -49,13 +58,26 @@ import { persistDurableWorkerImage, purgeDurableWorkerImages, } from './durable-
 import { SQLITE_WASM_MODULE_NAME, } from '../runtime/opencode-facet-runner.js';
 import { parsePortFromArgv, resolveLongRunningPort } from '@nimbus-sh/core/runtime/long-running-handle.js';
 import { DEFAULT_FACET_BUNDLE_PROFILE, } from '@nimbus-sh/core/runtime/bundle-profile.js';
-import { CF_COMPAT_DATE, VFS_BUNDLE_MAX_FILES, VFS_BUNDLE_MAX_BYTES, CWD_SNAPSHOT_MAX_FILE_BYTES, BUNDLE_MAX_ENCODED_BYTES, PREFETCH_CACHE_MAX_BYTES, } from '@nimbus-sh/core/constants.js';
+import { CF_COMPAT_DATE, VFS_BUNDLE_MAX_FILES, VFS_BUNDLE_MAX_BYTES, CWD_SNAPSHOT_MAX_FILE_BYTES, BUNDLE_MAX_ENCODED_BYTES, PREFETCH_CACHE_MAX_BYTES, ESM_TRANSFORM_CACHE_MAX_BYTES, FS_LIST_PAGE_LIMIT, } from '@nimbus-sh/core/constants.js';
+import { LEDGER_ROW_BYTES } from '@nimbus-sh/core/runtime/storage-ledger.js';
+import { ONE_SHOT_STORE_MEMORY_BYTES, RESIDENT_CHUNK_BYTES } from '../vfs/facet-resident-limits.js';
 import { MAX_RPC_SAFE_PAYLOAD_BYTES } from '@nimbus-sh/platform/limits.js';
-import { CRED_KERNEL } from '@nimbus-sh/core/runtime/os-contracts.js';
+import { CRED_KERNEL, isNativeBinPath } from '@nimbus-sh/core/runtime/os-contracts.js';
 import { acquireSupervisorAllocation } from '@nimbus-sh/platform/heavy-alloc-coord.js';
+import { supervisorBindingProps } from '@nimbus-sh/fabric/supervisor-props.js';
 import { wasmImageDigest } from './wasm-image-digest.js';
-import { prefetchBundleStart, prefetchBundleEnd, setPrefetchCacheBytes, } from '@nimbus-sh/platform/diag-counters.js';
-const ISOLATED_ESM_TRANSFORM_MIN_BYTES = 512 * 1024;
+import { prefetchBundleStart, prefetchBundleEnd, setPrefetchCacheBytes, setTransformCacheBytes, } from '@nimbus-sh/platform/diag-counters.js';
+const launchAdapters = new WeakMap();
+function filesOf(fs) {
+    let files = launchAdapters.get(fs);
+    if (files === undefined) {
+        files = requireFsOverBridge(fs);
+        launchAdapters.set(fs, files);
+    }
+    return files;
+}
+/** A bundled ESM file this large is rewritten to CJS without esbuild when its shape allows. */
+const BUNDLED_ESM_REWRITE_MIN_BYTES = 512 * 1024;
 /**
  * Detect & restore a Uint8Array that's been JSON-mangled to a
  * {"0":n,"1":n,...} object during the result-envelope round-trip.
@@ -281,6 +303,14 @@ const ENTRYPOINT_TIMER_TRACKER = `
     g.setInterval = function(fn, ms, ...a){ const id = si(fn, ms, ...a); iv.add(id); g.__nimbusPendingTimers++; return id; };
     g.clearInterval = function(id){ if (iv.delete(id)) g.__nimbusPendingTimers--; return ci(id); };
   }
+  // process.exit: the program's pending timers and intervals never fire again.
+  g.__nimbusStopProgramTimers = function(){
+    for (const id of one) ct(id);
+    one.clear();
+    if (typeof ci === "function") for (const id of iv) ci(id);
+    iv.clear();
+    g.__nimbusPendingTimers = 0;
+  };
 })(globalThis);
 `;
 /**
@@ -304,6 +334,11 @@ const ENTRYPOINT_TIMER_TRACKER = `
  */
 const RESIDENCY_MISS_REPORT = `
 const __NIMBUS_RESIDENCY_NAMED_MAX = 20;
+// Everything the next launch of this entry must stage: unanswered reads and
+// modules whose text arrived after boot, too late to compile.
+function __nimbusStagingMisses() {
+  return [...(globalThis.__nimbusVfsResidencyMisses || []), ...(globalThis.__nimbusModuleMisses || [])];
+}
 function __nimbusResidencyMissReport() {
   const __missed = globalThis.__nimbusVfsResidencyMisses;
   if (!__missed || __missed.size === 0) return "";
@@ -370,11 +405,9 @@ const SQLITE_FACET_IMPORT = `import __nimbusSqliteWasmModule from "${SQLITE_WASM
 /**
  * Generate one-shot runtime code with a plain fetch handler.
  */
-export async function generateEntrypointCode(userCode, vfsState, usesSqlite, shims, wasmImports = []) {
+export async function generateEntrypointCode(userCode, vfsState, usesSqlite, sources, wasmImports = []) {
     const safeCode = JSON.stringify(rewriteProvidedCommonJsModules(userCode));
     const bundleSource = await facetVfsBundleSourceFor(vfsState);
-    const safeManifest = vfsState.serializedManifest ?? JSON.stringify(vfsState.manifest);
-    const safeMetadata = vfsState.serializedMetadata ?? JSON.stringify(vfsState.metadata);
     return {
         code: `
 ${bundleSource.imports}
@@ -384,25 +417,7 @@ ${facetWasmImportsSource(wasmImports)}
 const USER_CODE = ${safeCode};
 const __NimbusHostResponse = globalThis.Response;
 
-function __mkCompiledFn(code) {
-  // Node strips a leading shebang from every module before evaluation;
-  // bin scripts are commonly bundled verbatim with their
-  // "#!/usr/bin/env node" line, which is a SyntaxError under new Function.
-  if (typeof code === "string" && code.charCodeAt(0) === 35 && code.charCodeAt(1) === 33) {
-    const __nl = code.indexOf("\\n");
-    code = __nl >= 0 ? code.slice(__nl + 1) : "";
-  }
-  function renameIfDeclared(name) {
-    const re = new RegExp("(?:^|\\\\n|;)\\\\s*(?:const|let|var|function|class)\\\\s+" + name + "(?![$\\\\w])", "m");
-    return re.test(code) ? name + "__nimbus_unused" : name;
-  }
-  const baseParams = [
-    "exports", renameIfDeclared("require"), "module",
-    renameIfDeclared("__filename"),
-    renameIfDeclared("__dirname"),
-  ];
-  return new Function(...baseParams, code);
-}
+${MK_COMPILED_FN_SOURCE}
 
 let __compiledFn = null;
 let __entryCompileFailure = null;
@@ -412,15 +427,13 @@ try {
   __entryCompileFailure = (__e && __e.stack) || (__e && __e.message) || String(__e);
 }
 
-// VFS bundle + manifest + pre-compiled modules — all at module level (startup time).
+// The module bundle and its pre-compiled modules, at module level (startup time).
 const __MODULE_VFS_BUNDLE = ${bundleSource.expression};
-const __MODULE_VFS_MANIFEST = ${safeManifest};
-const __MODULE_VFS_METADATA = ${safeMetadata};
 const __compiledModules = new Map();
 const __compileFailures = new Map();
 // Precompile JS modules AND extensionless CJS entries (bin scripts and
 // shims). workerd forbids new Function at request time, so anything not
-// precompiled here surfaces the misleading "file was not pre-bundled".
+// precompiled here surfaces the misleading "not in this launch's module map".
 ${BUNDLE_PRECOMPILE_LOOP}
 
 class __ProcessExit extends Error {
@@ -430,7 +443,7 @@ class __ProcessExit extends Error {
 export default {
   async fetch(request, workerEnv) {
     const args = await request.json();
-    const { argv, env, cwd: _cwd, filename, dirname, stdin, captureOutput, cred, diag: __diag, vfsCursor } = args;
+    const { argv, env, cwd: _cwd, filename, dirname, stdin, captureOutput, cred, diag: __diag, vfsCursor, dataPlan } = args;
     // Per invocation, not per module: this body is cached on
     // hash(code + bundle + manifest) and reused by any session whose snapshot
     // hashes the same, and epochs are per supervisor incarnation.
@@ -441,10 +454,30 @@ ${VFS_CURSOR_SEED_SOURCE}
     // ends it early.
     const __entryBudgetMs = Infinity;
     let __drainPasses = 0;
-    const __vfsBundle = __MODULE_VFS_BUNDLE;
-    const __vfsManifest = __MODULE_VFS_MANIFEST;
-    const __vfsMetadata = __MODULE_VFS_METADATA;
     const __supervisor = workerEnv?.SUPERVISOR || null;
+    // The same store, namespace and data plan a resident boots on, backed by
+    // this run's heap (runOnce hosts no SQLite; vfs/facet-resident-store.ts).
+    // Declared inside the request, beside the shims, so a loader that reuses
+    // this isolate for another run starts it from an empty store.
+${sources.residentStore}
+    __residentBindInMemory(${ONE_SHOT_STORE_MEMORY_BYTES});
+    __residentSetStorage(undefined, __supervisor);
+    __nsSetCred(cred);
+    __residentSetPlan(dataPlan);
+    __residentSetPushRoots([_cwd || "/home/user", "/tmp"]);
+    // The module bundle stays at module scope: a reused isolate adopts it
+    // again on its next run, and its text cells are shared, not copied.
+    const __residentBooted = await __residentBoot(() => __MODULE_VFS_BUNDLE, __MODULE_VFS_CURSOR, __supervisor);
+    if (__residentBooted.cursor) {
+      globalThis.__nimbusVfsCursor = { epoch: __residentBooted.cursor.epoch, rev: __residentBooted.cursor.rev };
+    }
+    // No user code runs before the namespace answers: it is the view every
+    // synchronous stat, exists and readdir reads (CUTOVER #13).
+    const __namespaceFailure = await __residentRequireNamespace(__supervisor, __residentBooted.failure);
+    if (__namespaceFailure) {
+      return __NimbusHostResponse.json({ exitCode: 1, stdout: "", stderr: __namespaceFailure + "\\n", vfsWrites: {}, residencyMisses: [] });
+    }
+    const __vfsBundle = __nimbusResidentBundle;
     const __pendingIO = [];
     // Fix 6 orphan counters (same as NodeProcess.run) — count RPC writes
     // that get dropped during isolate teardown so reportExit can report them.
@@ -471,24 +504,24 @@ ${VFS_CURSOR_SEED_SOURCE}
     let stdout = "", stderr = "";
     let exitCode = 0;
     const __nimbusDeferProcessExitReport = true;
-${VFS_WRITE_LEDGER_SOURCE}
+${sources.ledger}
     const __vfsDirs = {};
 
 ${ENTRYPOINT_TIMER_TRACKER}
-${shims}
+${sources.shims}
 
 ${ENTRYPOINT_EVENT_LOOP}
 ${RESIDENCY_MISS_REPORT}
 
     // Override console AND process.stdout/stderr for live SUPERVISOR streaming
     if (__supervisor && !captureOutput) {
-      __consoleMod.log = (...a) => { const s = __utilMod.format(...a) + "\\n"; stdout += s; __queueRpcWrite("stdout", __nimbusOutEnc.encode(s)); };
-      __consoleMod.error = (...a) => { const s = __utilMod.format(...a) + "\\n"; stderr += s; __queueRpcWrite("stderr", __nimbusOutEnc.encode(s)); };
+      __consoleMod.log = (...a) => { if (__nimbusProgramStopped) return; const s = __utilMod.format(...a) + "\\n"; stdout += s; __queueRpcWrite("stdout", __nimbusOutEnc.encode(s)); };
+      __consoleMod.error = (...a) => { if (__nimbusProgramStopped) return; const s = __utilMod.format(...a) + "\\n"; stderr += s; __queueRpcWrite("stderr", __nimbusOutEnc.encode(s)); };
       __consoleMod.warn = __consoleMod.error;
       __consoleMod.info = __consoleMod.log;
       __consoleMod.debug = __consoleMod.log;
-      __processMod.stdout.write = (d, enc, cb) => { if (typeof enc === "function") cb = enc; const b = __nimbusOutBytes(d, enc); stdout += __nimbusOutText("stdout", b); __queueRpcWrite("stdout", b); if (typeof cb === "function") queueMicrotask(cb); return true; };
-      __processMod.stderr.write = (d, enc, cb) => { if (typeof enc === "function") cb = enc; const b = __nimbusOutBytes(d, enc); stderr += __nimbusOutText("stderr", b); __queueRpcWrite("stderr", b); if (typeof cb === "function") queueMicrotask(cb); return true; };
+      __processMod.stdout.write = (d, enc, cb) => { if (typeof enc === "function") cb = enc; if (__nimbusProgramStopped) return true; const b = __nimbusOutBytes(d, enc); stdout += __nimbusOutText("stdout", b); __queueRpcWrite("stdout", b); if (typeof cb === "function") queueMicrotask(cb); return true; };
+      __processMod.stderr.write = (d, enc, cb) => { if (typeof enc === "function") cb = enc; if (__nimbusProgramStopped) return true; const b = __nimbusOutBytes(d, enc); stderr += __nimbusOutText("stderr", b); __queueRpcWrite("stderr", b); if (typeof cb === "function") queueMicrotask(cb); return true; };
     }
 
     try { globalThis.console = __consoleMod; } catch {}
@@ -532,6 +565,12 @@ ${RESIDENCY_MISS_REPORT}
         }
       }
     }
+    // A program that ended without process.exit still gets its 'exit' event.
+    if (__nimbusProcessExitCode === null) {
+      __nimbusEmitExit(exitCode);
+      if (__nimbusProcessExitCode !== null) exitCode = __nimbusProcessExitCode;
+      __nimbusProgramStopped = true;
+    }
 
     async function __drainPendingIO(maxPasses = 12) {
       let __settledIO = 0;
@@ -602,8 +641,11 @@ ${RESIDENCY_MISS_REPORT}
       // Unconditional, unlike diag: the supervisor stages these paths into
       // the next bundle for the same entry, so withholding them behind a
       // debug flag would leave the miss to repeat forever.
-      residencyMisses: [...(globalThis.__nimbusVfsResidencyMisses || [])],
-      ...(__diag ? { diag: { drainPasses: __drainPasses, rpcWrites: __rpcWriteCount, fsRpcReads: globalThis.__nimbusFsRpcReads || 0 } } : {}),
+      residencyMisses: __nimbusStagingMisses(),
+      ...(__diag ? { diag: {
+        drainPasses: __drainPasses, rpcWrites: __rpcWriteCount, fsRpcReads: globalThis.__nimbusFsRpcReads || 0,
+        namespaceRefusals: (globalThis.__nimbusVfsCoherence && globalThis.__nimbusVfsCoherence.namespaceRefusals) || 0,
+      } } : {}),
     });
   }
 };
@@ -673,7 +715,7 @@ function facetWasmImportsSource(wasmImports) {
     return `${lines.join('\n')}\nglobalThis.__nimbusPrecompiledWasm = new Map([${entries.join(', ')}]);`
         + `\nglobalThis.__nimbusPrecompiledWasmByDigest = new Map([${byDigest.join(', ')}]);`;
 }
-export async function generateLongRunningNodeCode(userCode, vfsState, opts, usesSqlite, shims, pacer) {
+export async function generateLongRunningNodeCode(userCode, vfsState, opts, usesSqlite, sources, pacer) {
     const safeCode = JSON.stringify(rewriteProvidedCommonJsModules(userCode));
     const safeArgs = JSON.stringify({
         argv: opts.argv || [],
@@ -686,8 +728,6 @@ export async function generateLongRunningNodeCode(userCode, vfsState, opts, uses
         cred: opts.cred,
     });
     const bundleSource = await facetVfsBundleSourceFor(vfsState, pacer);
-    const safeManifest = vfsState.serializedManifest ?? JSON.stringify(vfsState.manifest);
-    const safeMetadata = vfsState.serializedMetadata ?? JSON.stringify(vfsState.metadata);
     return {
         code: `
 ${bundleSource.imports}
@@ -699,18 +739,7 @@ const USER_CODE = ${safeCode};
 const __NIMBUS_ARGS = ${safeArgs};
 const __NimbusHostResponse = globalThis.Response;
 
-function __mkCompiledFn(code) {
-  function renameIfDeclared(name) {
-    const re = new RegExp("(?:^|\\\\n|;)\\\\s*(?:const|let|var|function|class)\\\\s+" + name + "(?![$\\\\w])", "m");
-    return re.test(code) ? name + "__nimbus_unused" : name;
-  }
-  const baseParams = [
-    "exports", renameIfDeclared("require"), "module",
-    renameIfDeclared("__filename"),
-    renameIfDeclared("__dirname"),
-  ];
-  return new Function(...baseParams, code);
-}
+${MK_COMPILED_FN_SOURCE}
 
 let __compiledFn = null;
 let __entryCompileFailure = null;
@@ -725,8 +754,6 @@ try {
 // and this object are the same bytes twice, and for pi that is the largest
 // single allocation in the facet before the program starts.
 let __MODULE_VFS_BUNDLE = ${bundleSource.expression};
-const __MODULE_VFS_MANIFEST = ${safeManifest};
-const __MODULE_VFS_METADATA = ${safeMetadata};
 const __compiledModules = new Map();
 const __compileFailures = new Map();
 // Module evaluation is the ONLY place workerd allows a string to become code —
@@ -735,7 +762,7 @@ const __compileFailures = new Map();
 // here, off the module map. That is why code cannot come from the store.
 ${BUNDLE_PRECOMPILE_LOOP}
 
-${FACET_RESIDENT_STORE_SOURCE}
+${sources.residentStore}
 
 class __ProcessExit extends Error {
   constructor(code) { super("process.exit(" + code + ")"); this.code = code; }
@@ -746,6 +773,15 @@ let __nimbusStarting = null;
 let __nimbusRuntime = null;
 let __nimbusAttachedLifecycle = null;
 
+// The platform's timer, captured at module evaluation, before the shims wrap
+// setTimeout in the resumption barrier. The flush below yields turns for its
+// own bookkeeping; that is not a resumption of the program, and through the
+// wrapped timer it paid a hidden ACQUIRE per yield — the one an inbound
+// request relied on without saying so, and a second one after the response
+// on every request. The request's barrier is taken explicitly, in the shared
+// dispatch (__nimbusServeHttp), exactly once.
+const __nimbusPlatformSetTimeout = setTimeout;
+
 async function __nimbusFlushRuntime() {
   const rt = __nimbusRuntime;
   if (!rt) return;
@@ -765,7 +801,9 @@ async function __nimbusFlushRuntime() {
       rt.drainVfsMutations(),
     ]);
     for (let pass = 0; pass < 12; pass++) {
-      await new Promise((resolve) => setTimeout(resolve, 0));
+      const turn = Promise.withResolvers();
+      __nimbusPlatformSetTimeout(turn.resolve, 0);
+      await turn.promise;
       if (rt.pendingIO.length <= rt.settledIO) break;
       const slice = rt.pendingIO.slice(rt.settledIO);
       rt.settledIO = rt.pendingIO.length;
@@ -794,8 +832,6 @@ async function __nimbusEnsureStarted(workerEnv, workerCtx, __startArgs) {
     // time. Same reason argv/env/pid want to move here.
     const __MODULE_VFS_CURSOR = (__startArgs && __startArgs.vfsCursor) || null;
 ${VFS_CURSOR_SEED_SOURCE}
-    const __vfsManifest = __MODULE_VFS_MANIFEST;
-    const __vfsMetadata = __MODULE_VFS_METADATA;
     const __supervisor = workerEnv?.SUPERVISOR || null;
     // The resident set lives in this facet's own SQLite rather than its heap.
     // A synchronous read cannot block and no JS stack here can be suspended, so
@@ -803,41 +839,56 @@ ${VFS_CURSOR_SEED_SOURCE}
     // \`ctx.storage.sql.exec\` returns a Cursor, not a Promise. See
     // vfs/facet-resident-store.ts.
     __residentBind(workerCtx);
-    const __residentAdopted = __residentAdoptModuleBundle(__MODULE_VFS_BUNDLE, __MODULE_VFS_CURSOR);
-    // The store now holds these bytes; the parsed object is the duplicate.
-    __MODULE_VFS_BUNDLE = null;
-    // One cursor, not two. The seed above publishes the cursor this SPAWN
-    // staged at, which is right for a cold slot and stale for a warm one — the
-    // store's persisted cursor describes what the rows actually are, and it is
-    // the only one that survived the last incarnation.
-    if (__residentAdopted) {
-      globalThis.__nimbusVfsCursor = { epoch: __residentAdopted.epoch, rev: __residentAdopted.rev };
-    }
-    // Bring the store to the authority's current state. This is what makes a
-    // first synchronous read of an untouched file succeed, and it is the ONLY
-    // blocking step: the waiting is done once, here, before the program's
-    // first instruction, so that no synchronous read after it ever has to
-    // wait.
+    __residentSetStorage(__startArgs && __startArgs.storage, __supervisor);
+    __nsSetCred(cred);
+    __residentSetPlan(__startArgs && __startArgs.dataPlan);
+    // The shared read profile's files this launch staged; each is struck off
+    // when read, and what is left at exit is reported unread (read-profile.ts).
+    globalThis.__nimbusProfileStaged = new Set((__startArgs && __startArgs.profileStaged) || []);
+    __residentSetPushRoots([_cwd || "/home/user", "/tmp"]);
+    // Bring the store to the authority's current state before the program's
+    // first instruction. This is what makes a first synchronous read of an
+    // untouched file succeed, and it is the ONLY blocking step: the waiting is
+    // done once, here, so that no synchronous read after it ever has to wait.
     //
-    // Cheap on a warm slot, and no longer merely by assumption: rows the
-    // absolute listing proves current are kept, so the pass fetches what
-    // changed rather than trusting that nothing did. Run whether or not the
-    // adopt produced a cursor — a facet whose snapshot carried none holds an
-    // empty store, and filling it here is what stops its first ACQUIRE from
-    // asking about a null epoch and being answered with a poison.
-    if (__supervisor) {
+    // A cold store adopts this spawn's snapshot and fills the rest. A store
+    // that outlived its process — a durable application's, relaunched or
+    // re-driven — is cheap to bring current: rows the absolute listing proves
+    // current are kept, and only what changed is fetched. It is SERVED only
+    // once that listing has vouched for it: rows it cannot vouch for are a
+    // previous process's, of unknown age, so the kept store is emptied and
+    // this launch boots as a cold one does. See __residentBoot.
+    //
+    // The thunk hands the parsed bundle over and drops this scope's reference,
+    // so a cold boot frees it the moment it is adopted rather than holding it
+    // through the fill. A kept store that reconciles never takes it.
+    const __residentBootStarted = Date.now();
+    const __residentBooted = await __residentBoot(
+      () => { const __bundle = __MODULE_VFS_BUNDLE; __MODULE_VFS_BUNDLE = null; return __bundle; },
+      __MODULE_VFS_CURSOR,
+      __supervisor,
+    );
+    if (__startArgs && __startArgs.diag && __supervisor) {
+      // NIMBUS_DEBUG only: what this process holds, for per-process storage measurement.
       try {
-        const __synced = await __residentSynchronizeFromSupervisor(__supervisor);
-        if (__synced.cursor) {
-          globalThis.__nimbusVfsCursor = { epoch: __synced.cursor.epoch, rev: __synced.cursor.rev };
-        }
-      } catch (__e) {
-        // A failed pass is a smaller resident set, not a dead process: every
-        // path it did not reach reads exactly as it would have without this
-        // store. Surfacing beats a silent capability loss.
-        try { globalThis.__nimbusResidentFillError = (__e && __e.message) || String(__e); } catch {}
-      }
+        const __stats = __residentStats();
+        await __supervisor.stderr(new TextEncoder().encode("[nimbus-debug] resident boot " + JSON.stringify({
+          ms: Date.now() - __residentBootStarted, ...__stats, failure: __residentBooted.failure || null,
+        }) + "\\n"));
+      } catch {}
     }
+    __MODULE_VFS_BUNDLE = null;
+    // One cursor, not two. The seed above publishes the cursor this SPAWN
+    // staged at, which is right for a cold store and stale for a kept one —
+    // the cursor the boot returns describes what the rows actually are.
+    if (__residentBooted.cursor) {
+      globalThis.__nimbusVfsCursor = { epoch: __residentBooted.cursor.epoch, rev: __residentBooted.cursor.rev };
+    }
+    // No user code runs before the namespace answers: it is the view every
+    // synchronous stat, exists and readdir reads (CUTOVER #13). A launch whose
+    // namespace cannot be listed fails here, naming why.
+    const __namespaceFailure = await __residentRequireNamespace(__supervisor, __residentBooted.failure);
+    if (__namespaceFailure) throw new Error(__namespaceFailure);
     const __vfsBundle = __nimbusResidentBundle;
     const __pendingIO = [];
     let __rpcDrops = 0;
@@ -863,23 +914,23 @@ ${VFS_CURSOR_SEED_SOURCE}
     let stdout = "", stderr = "";
     let exitCode = 0;
     const __nimbusDeferProcessExitReport = true;
-${VFS_WRITE_LEDGER_SOURCE}
+${sources.ledger}
     const __vfsDirs = {};
 
 ${ENTRYPOINT_TIMER_TRACKER}
-${shims}
+${sources.shims}
 
 ${ENTRYPOINT_EVENT_LOOP}
 ${RESIDENCY_MISS_REPORT}
 
     if (__supervisor && !captureOutput) {
-      __consoleMod.log = (...a) => { const s = __utilMod.format(...a) + "\\n"; stdout += s; __queueRpcWrite("stdout", __nimbusOutEnc.encode(s)); };
-      __consoleMod.error = (...a) => { const s = __utilMod.format(...a) + "\\n"; stderr += s; __queueRpcWrite("stderr", __nimbusOutEnc.encode(s)); };
+      __consoleMod.log = (...a) => { if (__nimbusProgramStopped) return; const s = __utilMod.format(...a) + "\\n"; stdout += s; __queueRpcWrite("stdout", __nimbusOutEnc.encode(s)); };
+      __consoleMod.error = (...a) => { if (__nimbusProgramStopped) return; const s = __utilMod.format(...a) + "\\n"; stderr += s; __queueRpcWrite("stderr", __nimbusOutEnc.encode(s)); };
       __consoleMod.warn = __consoleMod.error;
       __consoleMod.info = __consoleMod.log;
       __consoleMod.debug = __consoleMod.log;
-      __processMod.stdout.write = (d, enc, cb) => { if (typeof enc === "function") cb = enc; const b = __nimbusOutBytes(d, enc); stdout += __nimbusOutText("stdout", b); __queueRpcWrite("stdout", b); if (typeof cb === "function") queueMicrotask(cb); return true; };
-      __processMod.stderr.write = (d, enc, cb) => { if (typeof enc === "function") cb = enc; const b = __nimbusOutBytes(d, enc); stderr += __nimbusOutText("stderr", b); __queueRpcWrite("stderr", b); if (typeof cb === "function") queueMicrotask(cb); return true; };
+      __processMod.stdout.write = (d, enc, cb) => { if (typeof enc === "function") cb = enc; if (__nimbusProgramStopped) return true; const b = __nimbusOutBytes(d, enc); stdout += __nimbusOutText("stdout", b); __queueRpcWrite("stdout", b); if (typeof cb === "function") queueMicrotask(cb); return true; };
+      __processMod.stderr.write = (d, enc, cb) => { if (typeof enc === "function") cb = enc; if (__nimbusProgramStopped) return true; const b = __nimbusOutBytes(d, enc); stderr += __nimbusOutText("stderr", b); __queueRpcWrite("stderr", b); if (typeof cb === "function") queueMicrotask(cb); return true; };
     }
 
     try { globalThis.console = __consoleMod; } catch {}
@@ -964,7 +1015,7 @@ ${RESIDENCY_MISS_REPORT}
         if (Number(code ?? 0) === 0) code = 1;
         try { await __supervisor.stderr(__nimbusOutEnc.encode(__residencyReport)); } catch {}
       }
-      await __supervisor.reportExit(code, reason || "");
+      await __supervisor.reportExit(code, reason || "", __nimbusStagingMisses(), [...(globalThis.__nimbusProfileStaged || [])]);
       __nimbusProcessExitReported = true;
     };
     const __nimbusReportLifecycleFailure = async (e) => {
@@ -996,6 +1047,11 @@ ${RESIDENCY_MISS_REPORT}
         } else {
           finalCode = Number(await __nimbusProcessExitPromise);
         }
+        if (__nimbusProcessExitCode === null) {
+          __nimbusEmitExit(finalCode);
+          if (__nimbusProcessExitCode !== null) finalCode = __nimbusProcessExitCode;
+          __nimbusProgramStopped = true;
+        }
         await __nimbusFlushRuntime();
         await __nimbusReportFinalExit(finalCode, "");
       })().catch(async (e) => {
@@ -1023,9 +1079,7 @@ ${RESIDENCY_MISS_REPORT}
       try { await __supervisor.stderr(__nimbusOutEnc.encode(tail)); } catch {}
     }
     if (exitCode !== 0) {
-      if (__supervisor && !__nimbusProcessExitReported) {
-        await __supervisor.reportExit(exitCode, stderr || ("exit " + exitCode + "\\n"));
-      }
+      await __nimbusReportFinalExit(exitCode, stderr || ("exit " + exitCode + "\\n"));
       throw new Error(stderr || ("long-running node startup exited " + exitCode));
     }
     __nimbusStarted = true;
@@ -1061,7 +1115,13 @@ export class NimbusProcess extends DurableObject {
     if (startArgs) __nimbusStartArgs = startArgs;
     await __nimbusEnsureStarted(this.env, this.ctx, __nimbusStartArgs);
     if (__nimbusAttachedLifecycle) await __nimbusAttachedLifecycle;
-    return { ok: true };
+    // What this facet's database holds now, and the cap its store keeps
+    // under, for the session's storage ledger (N18).
+    let databaseSize;
+    try { databaseSize = this.ctx.storage.sql.databaseSize; } catch {}
+    let storageCap = null;
+    try { storageCap = __residentStorageCap(); } catch {}
+    return { ok: true, databaseSize, storageCap };
   }
   async fetch(req) { return __nimbusDispatchHttp(req, this.env, this.ctx); }
   async handleHttpRequest(req) { return __nimbusDispatchHttp(req, this.env, this.ctx); }
@@ -1070,13 +1130,33 @@ export class NimbusProcess extends DurableObject {
         modules: bundleSource.modules,
     };
 }
+/**
+ * What the facet store charges itself to hold one cell (facet-resident-store's
+ * __residentCellCost, which this must match): its bytes (a text cell's UTF-8
+ * length) plus 1%, a row per chunk and head, and a page of slack.
+ */
+/** What a module map costs the facet's store that adopts it (N18). A denial is a head row only. */
+function moduleMapStorageBytes(bundle) {
+    let bytes = 0;
+    for (const cell of Object.values(bundle)) {
+        bytes += typeof cell === 'string' || cell instanceof Uint8Array ? residentCellCost(cell) : 2 * LEDGER_ROW_BYTES;
+    }
+    return bytes;
+}
+function residentCellCost(cell) {
+    const isText = typeof cell === 'string';
+    const size = isText ? cell.length : cell.byteLength;
+    const limit = isText ? Math.floor(RESIDENT_CHUNK_BYTES / 3) : RESIDENT_CHUNK_BYTES;
+    const chunks = Math.max(1, Math.ceil(size / limit));
+    const bytes = isText ? new TextEncoder().encode(cell).byteLength : size;
+    return Math.ceil(bytes * 1.01) + (chunks + 1) * LEDGER_ROW_BYTES + 4096;
+}
 /**
  * Drop the raw forms of everything that has been serialized, in place.
  *
- * `bundleSource`, `serializedManifest` and `serializedMetadata` are total
- * encodings of `bundle`, `manifest` and `metadata` — no caller can distinguish
- * a state carrying both from one carrying only the serialized halves, because
- * both facet generators read the serialized halves and nothing else does.
+ * `bundleSource` is a total encoding of `bundle`: no caller can distinguish
+ * a state carrying both from one carrying only the serialized half, because
+ * both facet generators read the serialized half and nothing else does.
  * Holding both doubles the cost of a cached entry for its whole lifetime, and
  * that lifetime spans execs.
  *
@@ -1089,16 +1169,12 @@ export class NimbusProcess extends DurableObject {
 export function releaseSerializedSources(vfsState) {
     if (vfsState.bundleSource)
         vfsState.bundle = {};
-    if (vfsState.serializedManifest !== undefined)
-        vfsState.manifest = {};
-    if (vfsState.serializedMetadata !== undefined)
-        vfsState.metadata = {};
 }
 /**
  * Drop the serialized forms once a module map has been generated from them.
  *
- * The generated source is a total encoding of all three: every byte of the
- * bundle expression, the manifest and the metadata is inside it. Holding them
+ * The generated source is a total encoding of it: every byte of the bundle
+ * expression is inside it. Holding them
  * afterwards keeps a second copy of the largest thing this DO builds alive for
  * as long as the facet runs — for pi, 22.7 MB across the ~20 s window in which
  * the isolate was being reset. For the one-shot path that window is the run;
@@ -1115,8 +1191,6 @@ export function releaseSerializedSources(vfsState) {
  */
 export function releaseGeneratedSources(vfsState) {
     vfsState.bundleSource = undefined;
-    vfsState.serializedManifest = undefined;
-    vfsState.serializedMetadata = undefined;
     vfsState.generatedSourcesReleased = true;
 }
 /**
@@ -1150,7 +1224,9 @@ async function facetVfsBundleSourceFor(vfsState, pacer) {
  * pre-fix readFileString contract).
  */
 async function _readBundleCell(vfs, path) {
-    const bytes = await vfs.readFile(path);
+    const bytes = await filesOf(vfs).readBytes(path);
+    if (bytes === null)
+        throw Object.assign(new Error(`ENOENT: ${path}`), { code: 'ENOENT', path });
     try {
         return new TextDecoder('utf-8', { fatal: true }).decode(bytes);
     }
@@ -1163,6 +1239,12 @@ async function _readBundleCell(vfs, path) {
  * Strings counted as char-length (a slight under-count for non-ASCII
  * but matches the pre-fix behaviour); Uint8Array counted as byteLength.
  */
+/** A cell's raw bytes: UTF-8 for text, as the file is on disk. */
+function _bundleCellRawBytes(cell) {
+    if (cell instanceof Uint8Array)
+        return cell.byteLength;
+    return typeof cell === 'string' ? _encodedSourceBytes(cell) : 0;
+}
 function _bundleCellLength(cell) {
     return typeof cell === 'string' ? cell.length : cell.byteLength;
 }
@@ -1178,13 +1260,10 @@ function _bundleCellLength(cell) {
  * BIN_PACKAGE_SPECULATIVE_MAX_FILE_BYTES); omit it for budget-only checks.
  */
 async function _bundleAdmits(vfs, path, budgetState, perFileCeiling) {
-    let size;
-    try {
-        size = (await vfs.lstat(path)).size;
-    }
-    catch {
+    const stat = await filesOf(vfs).lstat(path).catch(() => null);
+    if (stat === null)
         return false;
-    }
+    const size = stat.size;
     if (perFileCeiling !== undefined && size > perFileCeiling)
         return false;
     return budgetState.totalBytes + size <= VFS_BUNDLE_MAX_BYTES;
@@ -1218,8 +1297,6 @@ function retainedVfsStateBytes(state) {
         for (const moduleSource of Object.values(source.modules))
             bytes += moduleSource.length;
     }
-    bytes += state.serializedManifest?.length ?? 0;
-    bytes += state.serializedMetadata?.length ?? 0;
     return bytes;
 }
 /**
@@ -1299,8 +1376,8 @@ function _jsonEncodedBytes(value) {
     }
     return bytes;
 }
-/** `{"bundle":` + `,"manifest":` + `}` — the frame around the two members. */
-const ENCODED_PAYLOAD_FRAME_BYTES = 23;
+/** `{"bundle":` + `}`: the frame around the one member. */
+const ENCODED_PAYLOAD_FRAME_BYTES = 11;
 /**
  * Running UTF-8 byte length of `JSON.stringify({ bundle, manifest })`,
  * accumulated one cell at a time.
@@ -1316,10 +1393,9 @@ const ENCODED_PAYLOAD_FRAME_BYTES = 23;
  * the total is a sum of independent per-cell terms: exact, incremental, and
  * never holding more than one cell's worth of scratch.
  */
-export function encodedBundleSize(bundle, manifest) {
+export function encodedBundleSize(bundle) {
     const cells = new Map();
     let cellSum = 0;
-    const manifestBytes = _jsonEncodedBytes(manifest);
     const self = {
         add(path, cell) {
             if (cells.has(path))
@@ -1337,7 +1413,7 @@ export function encodedBundleSize(bundle, manifest) {
         },
         get bytes() {
             const separators = Math.max(0, cells.size - 1);
-            return ENCODED_PAYLOAD_FRAME_BYTES + 2 + cellSum + separators + manifestBytes;
+            return ENCODED_PAYLOAD_FRAME_BYTES + 2 + cellSum + separators;
         },
     };
     for (const [path, cell] of Object.entries(bundle))
@@ -1500,7 +1576,13 @@ function _inlineBundleSourceBytes(bundle) {
  * the merge expression concatenates those fragments back to the original
  * string or Uint8Array before module precompilation begins.
  */
-export async function buildFacetVfsBundleSource(bundle, forceSideModules = false, pacer) {
+export async function buildFacetVfsBundleSource(bundle, forceSideModules = false, pacer, { consume = false } = {}) {
+    // \`consume\`: the caller releases the raw cells right after (a launch's
+    // build), so each is taken as its side module is serialized and the map is
+    // never held twice. Side modules always: an inline expression is copied
+    // again into the runner's own source.
+    if (consume)
+        forceSideModules = true;
     // Size the inline form before building it. A bundle that will be split has
     // no use for the whole-bundle expression, and building one to read its
     // length off cost a second full copy of the largest string this DO makes.
@@ -1551,46 +1633,55 @@ export async function buildFacetVfsBundleSource(bundle, forceSideModules = false
         }
         return pieces;
     }
-    const chunks = [];
-    let chunk = {};
-    let estimatedBytes = 0;
-    function flushChunk() {
-        if (Object.keys(chunk).length === 0)
-            return;
-        chunks.push(chunk);
-        chunk = {};
-        estimatedBytes = 0;
-    }
-    for (const [path, cell] of Object.entries(bundle)) {
-        for (const [piecePath, pieceCell] of splitCell(path, cell)) {
-            const pieceBytes = sourceBytes(piecePath, pieceCell);
-            if (piecePath in chunk
-                || (estimatedBytes > 0 && estimatedBytes + pieceBytes > maxModuleBytes)) {
-                flushChunk();
-            }
-            chunk[piecePath] = pieceCell;
-            estimatedBytes += pieceBytes;
-        }
-    }
-    flushChunk();
     const modules = {};
     const imports = [];
     const aliases = [];
-    for (let index = 0; index < chunks.length; index++) {
+    let chunk = {};
+    let chunkPaths = [];
+    let estimatedBytes = 0;
+    // A chunk becomes its side module the moment it is full, so the cells it
+    // carries and their serialization are never both held for the whole map:
+    // consumed, a cell leaves the bundle as its module is written.
+    async function flushChunk() {
+        // Pieces of a split cell fill chunks before the cell's path is complete,
+        // so emptiness is the chunk's own, not its finished paths'.
+        if (estimatedBytes === 0)
+            return;
+        const index = aliases.length;
         const moduleName = `${FACET_VFS_MODULE_PREFIX}${index}.js`;
         const alias = `__nimbusVfsBundle${index}`;
-        const source = _facetBundleModuleSource(chunks[index]);
+        const source = _facetBundleModuleSource(chunk);
         if (_encodedSourceBytes(source) > BUNDLE_MAX_ENCODED_BYTES) {
             throw new Error(`Nimbus: generated VFS side module exceeds encoded limit: ${moduleName}`);
         }
         modules[moduleName] = source;
         imports.push(`import ${alias} from "${moduleName}";`);
         aliases.push(alias);
+        if (consume)
+            for (const path of chunkPaths)
+                delete bundle[path];
+        chunk = {};
+        chunkPaths = [];
+        estimatedBytes = 0;
         // Each side module is an independent serialization of its own cells, so
         // the turn may end between any two of them.
         if (pacer)
             await pacer.spend(source.length);
     }
+    for (const path of Object.keys(bundle)) {
+        const cell = bundle[path];
+        for (const [piecePath, pieceCell] of splitCell(path, cell)) {
+            const pieceBytes = sourceBytes(piecePath, pieceCell);
+            if (piecePath in chunk
+                || (estimatedBytes > 0 && estimatedBytes + pieceBytes > maxModuleBytes)) {
+                await flushChunk();
+            }
+            chunk[piecePath] = pieceCell;
+            estimatedBytes += pieceBytes;
+        }
+        chunkPaths.push(path);
+    }
+    await flushChunk();
     const expression = `(function(__parts){const __out={};for(const __part of __parts){` +
         `for(const [__k,__v] of Object.entries(__part)){const __prev=__out[__k];` +
         `if(__prev===undefined){__out[__k]=__v;}` +
@@ -1645,174 +1736,47 @@ function _fnv1a(s) {
     return h.toString(16);
 }
 const MANIFEST_MAX_DEPTH = 12;
-/**
- * Build the manifest pass — uncapped path→child-names map. UNCHANGED
- * from W2.5b; this is the W2.5b root-cause fix and continues to keep
- * fs.readdirSync / fs.statSync honest regardless of which subset of
- * file CONTENT we ship.
- */
-async function buildManifest(vfs, cwd, scriptPath) {
-    const manifest = {};
-    async function walk(dirPath, depth = 0) {
-        if (depth > MANIFEST_MAX_DEPTH)
-            return;
-        const stripped = dirPath.replace(/^\/+/, '');
-        if (stripped in manifest)
-            return;
-        let entries;
-        try {
-            entries = (await vfs.readdir(stripped));
-        }
-        catch {
-            return;
-        }
-        manifest[stripped] = entries.map((e) => e.name);
-        for (const entry of entries) {
-            if (entry.type === 'directory') {
-                const childPath = stripped ? stripped + '/' + entry.name : entry.name;
-                (await walk(childPath, depth + 1));
-            }
-        }
-    }
-    const cwdStripped = cwd.replace(/^\/+/, '');
-    // ── The path from the root down to the working directory ──────────────
-    //
-    // One level each, before the deep walks, so that every directory on that
-    // chain is ENUMERATED rather than merely mentioned. It is what makes a
-    // synchronous "not there" honest for the shape programs probe most: node's
-    // resolver walks upward asking for `<dir>/node_modules` at every level, and
-    // a config lookup asks for a dotfile directory in $HOME. Those paths mostly
-    // do not exist, and answering that requires having listed the directory
-    // they would be in — otherwise the only honest answer is a refusal, and the
-    // resolver pays a round trip per rung to hear it.
-    //
-    // Cheap by construction: one readdir per component, names only, and the
-    // recursion below each stops immediately.
-    {
-        const segments = cwdStripped ? cwdStripped.split('/') : [];
-        for (let i = 0; i < segments.length; i++) {
-            (await walk(segments.slice(0, i).join('/'), MANIFEST_MAX_DEPTH));
-        }
-    }
-    (await walk(cwdStripped, 0));
-    const nmDir = cwdStripped + '/node_modules';
-    if ((await vfs.exists(nmDir)) && (await vfs.isDirectory(nmDir))) {
-        (await walk(nmDir, 0));
-    }
-    // ── Bin-target package + hoisted dependency roots ─────────────────────
-    //
-    // When the entry script lives in a node_modules outside cwd (npx-cache
-    // packages, globally-installed bins, etc.), buildManifest's cwd walk
-    // misses the package's sibling files. The bin's index.js gets
-    // require-walked + greedy-added to the BUNDLE, but the MANIFEST
-    // (which is the source of truth for `fs.readdirSync`) was empty for
-    // those paths — so `readdirSync('/tmp/.npx-cache/.../template-X')`
-    // returned [] and `create-vite` scaffolded zero files.
-    //
-    // Walk the innermost `node_modules/<pkg>/` of `scriptPath` so its
-    // entire package tree is enumerable via readdir. Also walk that
-    // `node_modules` directory itself: global npm bins resolve hoisted
-    // transitive dependencies as siblings of the bin's own package.
-    // Bounded by MANIFEST_MAX_DEPTH; same depth budget as the cwd walk.
-    if (scriptPath) {
-        const sp = scriptPath.replace(/^\/+/, '');
-        const segs = sp.split('/');
-        let nmIdx = -1;
-        for (let i = segs.length - 1; i >= 0; i--) {
-            if (segs[i] === 'node_modules') {
-                nmIdx = i;
-                break;
-            }
-        }
-        if (nmIdx >= 0) {
-            const isScoped = segs[nmIdx + 1]?.startsWith('@');
-            const pkgEnd = isScoped ? nmIdx + 3 : nmIdx + 2;
-            if (pkgEnd <= segs.length) {
-                const pkgRoot = segs.slice(0, pkgEnd).join('/');
-                if ((await vfs.exists(pkgRoot)) && (await vfs.isDirectory(pkgRoot))) {
-                    (await walk(pkgRoot, 0));
-                }
-            }
-            const nodeModulesRoot = segs.slice(0, nmIdx + 1).join('/');
-            if ((await vfs.exists(nodeModulesRoot)) && (await vfs.isDirectory(nodeModulesRoot))) {
-                (await walk(nodeModulesRoot, 0));
-            }
-        }
-    }
-    return manifest;
-}
-async function buildVfsMetadata(vfs, manifest, bundle) {
-    const paths = new Set(Object.keys(bundle).filter((path) => compiledCellPath(path) === null));
-    for (const [directory, children] of Object.entries(manifest)) {
-        paths.add(directory);
-        for (const child of children) {
-            paths.add(directory ? `${directory}/${child}` : child);
-        }
-    }
-    const metadata = {};
-    for (const path of paths) {
-        try {
-            const stat = await vfs.authority.stat(path, { followSymlinks: false });
-            if (!stat)
-                continue;
-            metadata[path] = {
-                type: stat.type,
-                size: stat.size,
-                mode: stat.mode,
-                uid: stat.uid,
-                gid: stat.gid,
-            };
-        }
-        catch {
-            // The credentialed lookup is authoritative; inaccessible ancestors do
-            // not reveal whether a leaf exists.
-        }
-    }
-    return metadata;
-}
-async function addUnreadableDenialCells(vfs, bundle, metadata) {
-    for (const [path, stat] of Object.entries(metadata)) {
-        if (stat.type === 'directory' || path in bundle)
-            continue;
-        try {
-            (await vfs.access(path, 0o4));
-        }
-        catch (error) {
-            if (typeof error === 'object'
-                && error !== null
-                && 'code' in error
-                && error.code === 'EACCES') {
-                bundle[path] = { error: 'EACCES' };
-            }
-        }
-    }
-}
-/**
- * Greedy-oversample every installed package's main entry. The static
- * prefetch via require-resolver covers the require() chain literally
- * present in source; greedy oversampling adds a safety net for dynamic
- * patterns the regex misses (jest/`bindings`/`import-local` style
- * computed-path requires). Bounded to package.json + 1 main-entry file
- * per package — sub-agent §Q3 quantified the worst-case cumulative
- * budget impact (~322 KiB for fastify, ~1.7 MiB for ts-jest).
- *
- * `requiredPaths` is the static require closure. A package the closure
- * already reached — but reached only through a SUBPATH — has its main entry
- * skipped; see `mainIsSpeculative`.
- */
-// can verify the hash-chunk + shared/ oversample directly. Pre-X.5-C this
-// was a file-local helper. Adding the named export is a pure surface
-// addition — no callers other than buildPrefetchBundle (same file) and
-// the new probe.
-export async function greedyAddMainEntries(vfs, cwd, bundle, budgetState, requiredPaths = new Set()) {
+export async function greedyAddMainEntries(vfs, cwd, bundle, budgetState, requiredPaths = new Set(), options = {}) {
     let added = 0;
+    const groups = [];
+    const bound = Math.min(options.maxBundleBytes ?? VFS_BUNDLE_MAX_BYTES, VFS_BUNDLE_MAX_BYTES);
+    const independent = new Set(Object.keys(bundle));
+    let rawBytes = 0;
+    for (const cell of Object.values(bundle))
+        rawBytes += _bundleCellRawBytes(cell);
+    if (rawBytes >= bound)
+        return { added, groups };
     const cwdStripped = cwd.replace(/^\/+/, '');
     const nmDir = cwdStripped + '/node_modules';
-    if (!((await vfs.exists(nmDir)) && (await vfs.isDirectory(nmDir))))
-        return { added };
+    if (!((await filesOf(vfs).exists(nmDir)) && (await filesOf(vfs).isDirectory(nmDir))))
+        return { added, groups };
     const exts = ['', '.js', '.cjs', '.mjs', '/index.js', '/index.cjs'];
     async function addOne(path) {
         const stripped = path.replace(/^\/+/, '');
+        if ((isBundleModuleCandidate(stripped) || stripped.endsWith('.cjs')) && !isNativeBinPath(stripped)) {
+            if (independent.has(stripped))
+                return false;
+            if (bundle[stripped] === undefined && !(await _bundleAdmits(vfs, stripped, budgetState, BIN_PACKAGE_SPECULATIVE_MAX_FILE_BYTES)))
+                return false;
+            const closure = await prefetchForRequire(requireFsOverBridge(vfs), '', stripped.slice(0, stripped.lastIndexOf('/')), '/' + stripped, bound, options.pacer?.spend.bind(options.pacer), {
+                purpose: 'dependency-closure', held: bundle,
+                maxAdditionalBytes: Math.max(0, bound - rawBytes),
+                maxAdditionalFiles: Math.max(0, VFS_BUNDLE_MAX_FILES - budgetState.fileCount),
+            });
+            if ('kind' in closure || closure.bundle[stripped] === undefined)
+                return false;
+            for (const [member, cell] of Object.entries(closure.bundle)) {
+                if (bundle[member] !== undefined)
+                    continue;
+                bundle[member] = cell;
+                rawBytes += _bundleCellRawBytes(cell);
+                budgetState.totalBytes += _bundleCellLength(cell);
+                budgetState.fileCount++;
+                added++;
+            }
+            groups.push({ root: stripped, members: new Set(Object.keys(closure.bundle)) });
+            return true;
+        }
         if (stripped in bundle)
             return false;
         if (budgetState.fileCount >= VFS_BUNDLE_MAX_FILES)
@@ -1820,7 +1784,7 @@ export async function greedyAddMainEntries(vfs, cwd, bundle, budgetState, requir
         if (budgetState.totalBytes >= VFS_BUNDLE_MAX_BYTES)
             return false;
         try {
-            if (!(await vfs.exists(stripped)) || (await vfs.isDirectory(stripped)))
+            if (!(await filesOf(vfs).exists(stripped)) || (await filesOf(vfs).isDirectory(stripped)))
                 return false;
             // This is a guess at what a program might require, and the same
             // per-file ceiling the entry-package walk applies bounds it: a
@@ -1828,8 +1792,8 @@ export async function greedyAddMainEntries(vfs, cwd, bundle, budgetState, requir
             // `lib/typescript.js` beside the `lib/tsc.js` that actually runs), and
             // one guess must not spend a third of the budget — and a third of the
             // supervisor's headroom — on every invocation that never reads it.
-            // Anything the program really requires arrives through the closure,
-            // which is uncapped.
+            // Literal dependencies use the closure's byte allowance, not this
+            // speculative-root per-file ceiling.
             if (!(await _bundleAdmits(vfs, stripped, budgetState, BIN_PACKAGE_SPECULATIVE_MAX_FILE_BYTES)))
                 return false;
             // A guess must not be a native binary. Nothing in a Workers isolate can
@@ -1839,14 +1803,19 @@ export async function greedyAddMainEntries(vfs, cwd, bundle, budgetState, requir
             // Measured: freeing 1.3 MiB of rollup let `@napi-rs/lzma-linux-x64-gnu`'s
             // 1,445,448-byte `.node` in, which the size guard had been evicting.
             // Only the guess is filtered; a path the closure requires is untouched.
-            if (stripped.endsWith('.node') || stripped.endsWith('.exe'))
+            if (isNativeBinPath(stripped))
                 return false;
             // hardening-r5: preserve binary content as Uint8Array.
+            const stat = await filesOf(vfs).stat(stripped);
+            if (stat === null || rawBytes + stat.size > bound)
+                return false;
             const content = (await _readBundleCell(vfs, stripped));
             const cellLen = _bundleCellLength(content);
-            if (budgetState.totalBytes + cellLen > VFS_BUNDLE_MAX_BYTES)
+            const raw = _bundleCellRawBytes(content);
+            if (budgetState.totalBytes + cellLen > VFS_BUNDLE_MAX_BYTES || rawBytes + raw > bound)
                 return false;
             bundle[stripped] = content;
+            rawBytes += raw;
             budgetState.totalBytes += cellLen;
             budgetState.fileCount++;
             added++;
@@ -1856,26 +1825,6 @@ export async function greedyAddMainEntries(vfs, cwd, bundle, budgetState, requir
             return false;
         }
     }
-    // X.5-C Fix #2 helper: walk a (possibly nested) exports value and
-    // collect every string-leaf path. unbuild-shaped packages like pathe
-    // nest two deep — `exports."."`.{require,import}.{types,default} —
-    // and the previous one-level loop only caught the inner string leaves
-    // when default was at the top, missing the unbuild shape entirely.
-    function collectExportLeaves(node, out) {
-        if (typeof node === 'string') {
-            out.add(node);
-            return;
-        }
-        if (!node || typeof node !== 'object')
-            return;
-        // Order matters for the "most likely usable" leaf: prefer require
-        // (most CJS-friendly), then default, then node, then import. We add
-        // ALL of them to the candidate set — addPkgEntry will probe each.
-        for (const k of ['require', 'node', 'default', 'import']) {
-            if (k in node)
-                collectExportLeaves(node[k], out);
-        }
-    }
     /**
      * Whether guessing at `pkgDir`'s main entry is still a guess.
      *
@@ -1907,47 +1856,52 @@ export async function greedyAddMainEntries(vfs, cwd, bundle, budgetState, requir
         return !reached;
     }
     async function addPkgEntry(pkgDir) {
-        (await addOne(pkgDir + '/package.json'));
+        const manifest = (pkgDir + '/package.json').replace(/^\/+/, '');
+        if (bundle[manifest] === undefined && !(await addOne(manifest)))
+            return;
         // A package the closure reached keeps exactly what it reached; only an
         // unreached one gets the guess below.
         if (!mainIsSpeculative(pkgDir))
             return;
-        let meta;
+        // Malformed JSON, or a package whose entry fields the resolver cannot
+        // read (`main: 7`, `exports: true`) drops that field and keeps the rest;
+        // unparseable JSON is a package with no declared entry. Either way the
+        // next package is unaffected.
+        let pkg;
         try {
-            meta = JSON.parse((await vfs.readFileString(pkgDir + '/package.json')));
+            const text = bundle[manifest];
+            pkg = typeof text === 'string' ? parseResolvablePackageJson(text) : null;
         }
         catch {
-            meta = null;
-        }
-        const candidates = new Set();
-        if (meta) {
-            if (typeof meta.main === 'string')
-                candidates.add(meta.main);
-            if (typeof meta.module === 'string')
-                candidates.add(meta.module);
-            const exp = meta.exports;
-            if (typeof exp === 'string')
-                candidates.add(exp);
-            else if (exp && typeof exp === 'object') {
-                const dot = exp['.'];
-                // X.5-C Fix #2: walk nested condition trees recursively. Without
-                // this, packages with two-level exports (pathe, magic-string,
-                // most unbuild-emitted libs) miss their actual entry leaf and
-                // greedyAddMainEntries falls back to /index.js probing — which
-                // doesn't exist for those packages.
-                collectExportLeaves(dot, candidates);
-            }
-        }
-        if (candidates.size === 0)
-            candidates.add('index.js');
+            pkg = null;
+        }
+        // The root entry a bare require of this package resolves to, in the
+        // order the runtime resolves it (require-resolver.ts resolvePkgSubpathEx):
+        // exports under the CJS conditions, then the ESM ones, then legacy main,
+        // then an index probe, each tried until one lands. A denied root
+        // (`"." : null`) resolves to nothing and falls through the same way. A
+        // hand-rolled walk of `exports["."]` read nothing from a root conditional
+        // map (on-change@6: `{ types, default }`, no ".", no main) and guessed
+        // `index.js`, which does not exist.
+        const candidates = [];
+        if (pkg) {
+            let entry = resolvePackageEntry(pkg, '.', DEFAULT_CJS_CONDITIONS);
+            if (entry === null && pkg.exports != null)
+                entry = resolvePackageEntry(pkg, '.', DEFAULT_ESM_CONDITIONS);
+            if (entry !== null)
+                candidates.push(entry);
+            if (pkg.main !== undefined)
+                candidates.push(pkg.main);
+        }
+        candidates.push('index.js');
         for (const rel of candidates) {
             const norm = rel.replace(/^\.\//, '');
             const base = pkgDir + '/' + norm;
             let landed = false;
             const tries = /\.[a-z]+$/.test(norm) ? [base] : exts.map((e) => base + e);
             for (const candidate of tries) {
-                if ((await vfs.exists(candidate.replace(/^\/+/, ''))) &&
-                    !(await vfs.isDirectory(candidate.replace(/^\/+/, '')))) {
+                if ((await filesOf(vfs).exists(candidate.replace(/^\/+/, ''))) &&
+                    !(await filesOf(vfs).isDirectory(candidate.replace(/^\/+/, '')))) {
                     if ((await addOne(candidate))) {
                         landed = true;
                         break;
@@ -1965,8 +1919,8 @@ export async function greedyAddMainEntries(vfs, cwd, bundle, budgetState, requir
                 // The static walker cannot discover computed hash-chunk imports, so
                 // the greedy oversample is the safety net for their reachability.
                 const entryDir = base.replace(/\/[^/]+$/, '');
-                try {
-                    const sibs = (await vfs.readdir(entryDir));
+                {
+                    const sibs = await (async () => vfs.readdir(entryDir))().catch(() => []);
                     for (const sib of sibs) {
                         if (sib.type !== 'file')
                             continue;
@@ -1994,8 +1948,8 @@ export async function greedyAddMainEntries(vfs, cwd, bundle, budgetState, requir
                     // typical shared/ dir returns 1-5 files.
                     const sharedDir = entryDir + '/shared';
                     const sharedStripped = sharedDir.replace(/^\/+/, '');
-                    if ((await vfs.exists(sharedStripped)) && (await vfs.isDirectory(sharedStripped))) {
-                        for (const sh of (await vfs.readdir(sharedDir))) {
+                    if (await (async () => filesOf(vfs).isDirectory(sharedStripped))().catch(() => false)) {
+                        for (const sh of await (async () => vfs.readdir(sharedDir))().catch(() => [])) {
                             if (sh.type !== 'file')
                                 continue;
                             if (!/\.(cjs|mjs|js)$/.test(sh.name))
@@ -2004,22 +1958,20 @@ export async function greedyAddMainEntries(vfs, cwd, bundle, budgetState, requir
                         }
                     }
                 }
-                catch { /* unreadable dir — drop sibling oversample, entry
-                               file is enough */
-                }
                 break;
             }
         }
     }
     for (const pkgDir of (await speculativePackageDirs(vfs, cwdStripped, bundle)))
         (await addPkgEntry(pkgDir));
-    return { added };
+    return { added, groups };
 }
 /**
- * The packages a computed `require(name)` inside the program can plausibly
- * name: the project root's own runtime `dependencies`, plus every package
- * ONE `dependencies` hop from a package that already owns a file in the
- * static closure. Never devDependencies, never a second hop.
+ * The packages a name resolved at runtime — a computed `require(name)`, or a
+ * resolver call like exsolve's `resolveModulePath(name, { from: rootDir })` —
+ * can plausibly reach: every package ONE `dependencies` hop from a package
+ * the project itself declares or that owns a file in the static closure, plus
+ * those roots themselves. Never devDependencies, never a second hop.
  *
  * Unbounded, the greedy oversample read every installed package's main:
  * for `node -e "import('got')"` in got's repo — a one-file static closure —
@@ -2031,11 +1983,26 @@ export async function greedyAddMainEntries(vfs, cwd, bundle, budgetState, requir
  * tree. Computed requires almost always target a declared runtime
  * dependency of the package doing the requiring, so the bound is one hop
  * over `dependencies` only. Directories, sorted for a stable bundle.
+ *
+ * The project's own dependencies are hop ROOTS and not merely members,
+ * because a bin runs inside the project and resolves from the project root,
+ * where what it names is its host framework's runtime peer rather than
+ * anything its own package declares. Measured on staging, `nuxt dev` on a
+ * `nuxi init` project: npm points `node_modules/.bin/nuxt` at
+ * `@nuxt/cli/bin/nuxi.mjs`, so `@nuxt/cli` owns the entry; `@nuxt/kit` is a
+ * devDependency of `@nuxt/cli` and a dependency of `nuxt`, which the project
+ * declares. Admitting `nuxt` without hopping from it left
+ * `@nuxt/kit/package.json` unstaged, `readFileSync` raised EAGAIN inside
+ * exsolve — which swallows every error — and the CLI reported
+ * `Cannot resolve module "@nuxt/kit" (from: /home/user/nuxt-probe/mvp/)`.
+ * One hop from each project dependency is what the project's own node_modules
+ * was hoisted for; it is the same edge kind and the same single level the
+ * owner hop already spends.
  */
 export async function speculativePackageDirs(vfs, cwdStripped, bundle) {
     const runtimeDeps = async (pkgJsonPath) => {
         try {
-            const meta = JSON.parse((await vfs.readFileString(pkgJsonPath)));
+            const meta = JSON.parse((await filesOf(vfs).readFileString(pkgJsonPath)));
             const names = new Set();
             for (const field of ['dependencies', 'optionalDependencies']) {
                 const deps = meta?.[field];
@@ -2064,7 +2031,7 @@ export async function speculativePackageDirs(vfs, cwdStripped, bundle) {
         let dir = fromDir;
         for (;;) {
             const candidate = dir + '/node_modules/' + name;
-            if ((await vfs.exists(candidate + '/package.json')))
+            if ((await filesOf(vfs).exists(candidate + '/package.json')))
                 return candidate;
             const idx = dir.lastIndexOf('/');
             if (idx <= 0)
@@ -2073,14 +2040,24 @@ export async function speculativePackageDirs(vfs, cwdStripped, bundle) {
         }
     };
     const reached = new Set();
+    const hopped = new Set();
+    // Returns what this hop landed on, so a root can be hopped from without
+    // reading its manifest twice and without the caller tracking the edges.
     const hop = async (fromDir) => {
+        if (hopped.has(fromDir))
+            return [];
+        hopped.add(fromDir);
+        const landed = [];
         for (const name of (await runtimeDeps(fromDir + '/package.json'))) {
             const dir = (await resolveDir(name, fromDir));
-            if (dir !== null)
-                reached.add(dir);
+            if (dir === null)
+                continue;
+            reached.add(dir);
+            landed.push(dir);
         }
+        return landed;
     };
-    (await hop(cwdStripped));
+    const projectDeps = (await hop(cwdStripped));
     const owners = new Set();
     for (const path of Object.keys(bundle)) {
         const owner = ownerOf(path);
@@ -2091,6 +2068,12 @@ export async function speculativePackageDirs(vfs, cwdStripped, bundle) {
         reached.add(owner);
         (await hop(owner));
     }
+    // The second kind of root: what the project declares. A bin resolving from
+    // the project root reaches these packages' dependencies, and nothing else
+    // in this function would — the project's dependency owns no staged file
+    // when the bin that runs belongs to a sibling package.
+    for (const dir of projectDeps)
+        (await hop(dir));
     return [...reached].sort();
 }
 /**
@@ -2159,7 +2142,7 @@ export async function addStaticReadFileAssets(vfs, cwd, bundle, budgetState) {
         if (budgetState.totalBytes >= VFS_BUNDLE_MAX_BYTES)
             return false;
         try {
-            if (!(await vfs.exists(stripped)) || (await vfs.isDirectory(stripped)))
+            if (!(await filesOf(vfs).exists(stripped)) || (await filesOf(vfs).isDirectory(stripped)))
                 return false;
             if (!(await _bundleAdmits(vfs, stripped, budgetState)))
                 return false;
@@ -2255,7 +2238,7 @@ export async function addStaticReadFileAssets(vfs, cwd, bundle, budgetState) {
  *     (0, path_1.resolve)(__dirname, '../../../.ts-jest-digest'), 'utf8');
  *
  * The install pipeline writes `.ts-jest-digest` to VFS correctly
- * (manifest pass at buildManifest enumerates it). But the runtime
+ * (the namespace lists it). But the runtime
  * fs shim's readFileSync (`src/node-shims.ts:202-215`) consults
  * `__vfsBundle` only, and none of the existing bundle-population
  * passes — `prefetchForRequire` (require-graph), `greedyAddMainEntries`
@@ -2334,7 +2317,7 @@ export async function addStaticReadFileDotfilesAndCompiled(vfs, cwd, bundle, bud
         if (budgetState.totalBytes >= VFS_BUNDLE_MAX_BYTES)
             return false;
         try {
-            if (!(await vfs.exists(stripped)) || (await vfs.isDirectory(stripped)))
+            if (!(await filesOf(vfs).exists(stripped)) || (await filesOf(vfs).isDirectory(stripped)))
                 return false;
             if (!(await _bundleAdmits(vfs, stripped, budgetState)))
                 return false;
@@ -2523,13 +2506,10 @@ export async function addBinTargetSiblings(vfs, scriptPath, bundle, budgetState,
                 wasmPaths.push(child);
             if (bundle[child] !== undefined)
                 continue;
-            let size;
-            try {
-                size = (await vfs.lstat(child)).size;
-            }
-            catch {
+            const stat = await filesOf(vfs).lstat(child).catch(() => null);
+            if (stat === null)
                 continue;
-            }
+            const size = stat.size;
             if (size > BIN_PACKAGE_SPECULATIVE_MAX_FILE_BYTES)
                 continue;
             candidates.push({ path: child, size });
@@ -2595,13 +2575,9 @@ export async function collectClosureWasmImages(vfs, bundle, unstagedPaths) {
     for (const path of unstagedPaths) {
         if (byPath.has(path))
             continue;
-        let bytes;
-        try {
-            bytes = await vfs.readFile(path);
-        }
-        catch {
+        const bytes = await filesOf(vfs).readBytes(path).catch(() => null);
+        if (bytes === null)
             continue;
-        }
         byPath.set(path, { vfsPath: '/' + stripLeadingSlashes(path), digest: wasmImageDigest(bytes) });
     }
     return [...byPath.values()];
@@ -2621,21 +2597,29 @@ export async function collectClosureWasmImages(vfs, bundle, unstagedPaths) {
  * Admitted smallest-first for the same reason as the entry-package walk: the
  * budget is shared, so ordering by size maximizes the number of misses a
  * fixed number of bytes repairs.
+ *
+ * `room` is what the snapshot bound leaves after what is already committed
+ * (the static closure, and for learned entries this session's own misses), in
+ * raw bytes: evidence fills that room and never pushes the snapshot past the
+ * bound, so it can never be the reason a launch fails. `bytes` is what this
+ * call staged, in the same unit.
  */
-export async function addObservedReads(vfs, observed, bundle, requiredPaths, budgetState) {
+export async function addObservedReads(vfs, observed, bundle, requiredPaths, budgetState, room = Infinity, pacer) {
     if (!observed || observed.size === 0)
-        return { added: 0 };
+        return { added: 0, bytes: 0 };
+    let bytes = 0;
     const candidates = [];
     for (const path of observed) {
-        if (path === '' || bundle[path] !== undefined)
+        if (path === '')
             continue;
-        let stat;
-        try {
-            stat = (await vfs.lstat(path));
-        }
-        catch {
+        // Already staged, but evictable: the evidence is what makes it required.
+        if (bundle[path] !== undefined) {
+            requiredPaths.add(path);
             continue;
         }
+        const stat = await filesOf(vfs).lstat(path).catch(() => null);
+        if (stat === null)
+            continue;
         if (stat.type === 'directory')
             continue;
         candidates.push({ path, size: stat.size });
@@ -2657,13 +2641,48 @@ export async function addObservedReads(vfs, observed, bundle, requiredPaths, bud
         const cellLen = _bundleCellLength(content);
         if (budgetState.totalBytes + cellLen > VFS_BUNDLE_MAX_BYTES)
             continue;
+        const raw = _bundleCellRawBytes(content);
+        if (bytes + raw > room)
+            continue;
         bundle[candidate.path] = content;
         requiredPaths.add(candidate.path);
+        bytes += raw;
         budgetState.totalBytes += cellLen;
         budgetState.fileCount++;
         added++;
     }
-    return { added };
+    // A module brings its static imports: learned one miss per launch, nuxt's
+    // on-change alone would have cost a relaunch for each of its files.
+    for (const path of observed) {
+        if (!/\.[cm]?js$/.test(path) || bundle[path] === undefined)
+            continue;
+        const closure = await prefetchForRequire(requireFsOverBridge(vfs), '', path.slice(0, path.lastIndexOf('/')), '/' + path, undefined, pacer?.spend.bind(pacer));
+        if ('kind' in closure)
+            continue;
+        for (const [dep, content] of Object.entries(closure.bundle)) {
+            if (closure.speculative.has(dep))
+                continue;
+            if (bundle[dep] !== undefined) {
+                requiredPaths.add(dep);
+                continue;
+            }
+            const cellLen = _bundleCellLength(content);
+            if (budgetState.fileCount >= VFS_BUNDLE_MAX_FILES)
+                break;
+            if (budgetState.totalBytes + cellLen > VFS_BUNDLE_MAX_BYTES)
+                continue;
+            const raw = _bundleCellRawBytes(content);
+            if (bytes + raw > room)
+                continue;
+            bundle[dep] = content;
+            requiredPaths.add(dep);
+            bytes += raw;
+            budgetState.totalBytes += cellLen;
+            budgetState.fileCount++;
+            added++;
+        }
+    }
+    return { added, bytes };
 }
 const RUNTIME_PACKAGE_EXCLUDED_ROOT_DIRS = new Set([
     'docs',
@@ -2706,6 +2725,31 @@ const RUNTIME_PACKAGE_EXCLUDED_FILE_SUFFIXES = [
     '.mov',
     '.webm',
 ];
+/**
+ * Whether the facet's require path could ever load this cell AS A MODULE.
+ *
+ * Not a judgement about whether the file is useful — an evicted cell is a
+ * real loss either way, since the synchronous read it exists for raises
+ * EAGAIN. It is a judgement about what the loss can BREAK. A cell the loader
+ * can resolve is one some other module may be importing, and losing it takes
+ * every importer down with it; a cell it can never resolve is only ever read
+ * as data, by whoever asked for that path specifically.
+ *
+ * Declaration files are the clean case, and the reason this is a suffix test
+ * rather than a content one: `foo.d.ts` is consumed by a type checker and is
+ * never the target of a `require`, so shedding one cannot orphan a module.
+ * That does not contradict the list above keeping them admissible — a `.d.ts`
+ * IS a legitimate runtime read for the one package that reads its own (tsc
+ * and `lib.*.d.ts`). This decides only what goes FIRST once a bound has
+ * already been breached and something has to.
+ */
+function _isLoadableModuleCell(path) {
+    if (isTypescriptDeclarationFile(path))
+        return false;
+    const ext = vfsPathExtension(path);
+    return ext === '.js' || ext === '.mjs' || ext === '.cjs' || ext === '.json'
+        || ext === '.wasm' || ext === '' || bundleTypescriptLoader(path) !== null;
+}
 /**
  * Per-file ceiling for the speculative passes over installed packages: the
  * entry-package walk (`addBinTargetSiblings`) and the main-entry oversample
@@ -2857,7 +2901,7 @@ async function addEntryAbsPathReads(vfs, entryCode, bundle, budgetState) {
         if (budgetState.totalBytes >= VFS_BUNDLE_MAX_BYTES)
             return;
         try {
-            if (!(await vfs.exists(stripped)) || (await vfs.isDirectory(stripped)))
+            if (!(await filesOf(vfs).exists(stripped)) || (await filesOf(vfs).isDirectory(stripped)))
                 return;
             if (!(await _bundleAdmits(vfs, stripped, budgetState)))
                 return;
@@ -2910,8 +2954,19 @@ async function addEntryAbsPathReads(vfs, entryCode, bundle, budgetState) {
     }
     return { added };
 }
-function looksLikeEsm(src) {
-    return hasTopLevelModuleSyntax(src);
+function looksLikeEsm(path, src) {
+    if (!hasTopLevelModuleSyntax(src))
+        return false;
+    if (vfsPathExtension(path) !== '')
+        return true;
+    // No extension: a bin script, or data such as a LICENSE whose prose says "import". Only a parse tells them apart.
+    try {
+        parseJavaScriptModule(src);
+        return true;
+    }
+    catch {
+        return false;
+    }
 }
 /**
  * W3.5 Fix B — module-level cache for ESM→CJS transform results, keyed
@@ -2922,8 +2977,44 @@ function looksLikeEsm(src) {
  *
  * Lives at module scope so warm exec invocations hit the cache without
  * paying the wasm cold-start cost again.
+ *
+ * Bounded by bytes, LRU, and reported to the heap model like the prefetch
+ * cache (see ESM_TRANSFORM_CACHE_MAX_BYTES for the reset it caused
+ * unbounded). An output larger than the whole bound is used for the build
+ * that produced it and not retained: admitting it would evict everything
+ * else to hold something that still does not fit.
  */
 const __esmTransformCache = new Map();
+let __esmTransformCacheBytes = 0;
+function __esmTransformCacheGet(key) {
+    const code = __esmTransformCache.get(key);
+    if (code === undefined)
+        return undefined;
+    // Refresh recency: a Map iterates in insertion order, so the oldest
+    // entry is the first one.
+    __esmTransformCache.delete(key);
+    __esmTransformCache.set(key, code);
+    return code;
+}
+function __esmTransformCacheSet(key, code) {
+    const bytes = key.length + code.length;
+    if (bytes > ESM_TRANSFORM_CACHE_MAX_BYTES)
+        return;
+    const previous = __esmTransformCache.get(key);
+    if (previous !== undefined) {
+        __esmTransformCacheBytes -= key.length + previous.length;
+        __esmTransformCache.delete(key);
+    }
+    __esmTransformCache.set(key, code);
+    __esmTransformCacheBytes += bytes;
+    for (const [oldest, entry] of __esmTransformCache) {
+        if (__esmTransformCacheBytes <= ESM_TRANSFORM_CACHE_MAX_BYTES)
+            break;
+        __esmTransformCache.delete(oldest);
+        __esmTransformCacheBytes -= oldest.length + entry.length;
+    }
+    setTransformCacheBytes(__esmTransformCacheBytes);
+}
 function __cacheKey(src) {
     // FNV-1a 32-bit. Only used for cache keys, NEVER for content
     // integrity. The ~30-byte string we return is a hex hash + length —
@@ -2959,14 +3050,21 @@ function _markBundleEsmAsFailed(bundle, reason) {
         // A TypeScript source is never runnable as staged, so it always needs
         // the emit it cannot get; a JavaScript file only if it is ESM.
         const typescript = bundleTypescriptLoader(path) !== null;
-        if (!typescript && !looksLikeEsm(src))
+        if (!typescript && !looksLikeEsm(path, src))
             continue;
-        const escapedReason = JSON.stringify(`esbuild transform failed for ${path}: ${reason}`);
-        bundle[typescript ? compiledCellKey(path) : path] =
-            '// framework-fixes-F4 diagnostic shim — esbuild rejected the ESM transform\n' +
-                '(function () { throw new Error(' + escapedReason + '); })();\n';
+        bundle[typescript ? compiledCellKey(path) : path] = esbuildDiagnosticShim(path, reason);
     }
 }
+/**
+ * Parseable CommonJS standing in for a module esbuild could not transform: it
+ * throws the esbuild reason when required, so the failure surfaces at the
+ * `require` with its cause rather than as a bare "Cannot use import statement".
+ */
+function esbuildDiagnosticShim(path, reason) {
+    const escapedReason = JSON.stringify(`esbuild transform failed for ${path}: ${reason.replace(/\n/g, ' ')}`);
+    return '// framework-fixes-F4 diagnostic shim — esbuild rejected the ESM transform\n' +
+        '(function () { throw new Error(' + escapedReason + '); })();\n';
+}
 /**
  * The set of bundle entries the facet's startup pre-compile loop turns into
  * functions, minus the ones already in the right format. Everything the loop
@@ -2977,7 +3075,8 @@ function _markBundleEsmAsFailed(bundle, reason) {
  * Extensionless entries are in the set for the same reason the pre-compile
  * loop takes them — that is the shape of nearly every npm `bin` script.
  * `.json` is data and `.cjs` is CommonJS by definition; neither needs the
- * transform. Content, not the path, decides from here: `looksLikeEsm` parses.
+ * transform. Content decides from here: `looksLikeEsm` sniffs module syntax,
+ * and parses an extensionless file, which may be data rather than a script.
  */
 export function isBundleModuleCandidate(path) {
     const ext = vfsPathExtension(path);
@@ -2985,7 +3084,8 @@ export function isBundleModuleCandidate(path) {
 }
 /**
  * The esbuild loader for a TypeScript source in the bundle, or null when the
- * path does not name one.
+ * path does not name one. Which extensions are TypeScript is
+ * `typescriptLoader`'s table, the one a runtime's entry script is decided by.
  *
  * A resolved `.ts` file reaches the facet as TypeScript, and TypeScript is not
  * JavaScript: `new Function` on a type annotation is a SyntaxError whether or
@@ -3004,12 +3104,7 @@ export function isBundleModuleCandidate(path) {
  * gone. So a declaration file is left exactly as it was staged.
  */
 export function bundleTypescriptLoader(path) {
-    if (isTypescriptDeclarationFile(path))
-        return null;
-    const ext = vfsPathExtension(path);
-    if (ext === '.tsx')
-        return 'tsx';
-    return ext === '.ts' || ext === '.mts' || ext === '.cts' ? 'ts' : null;
+    return isTypescriptDeclarationFile(path) ? null : typescriptLoader(path);
 }
 /** `name.d.ts` / `name.d.mts` / `name.d.cts`, by TypeScript's own rule. */
 export function isTypescriptDeclarationFile(path) {
@@ -3078,19 +3173,22 @@ for (const [__p, __c] of Object.entries(__MODULE_VFS_BUNDLE)) {
 `;
 /**
  * Transform every ESM-shaped file in the bundle to CJS via esbuild.
- * Mutates `bundle` in place. Errors are swallowed (the file is left as
- * ESM source); the facet's pre-compile loop will record the SyntaxError
- * into __compileFailures and __loadModule will surface it (Fix C).
+ * Mutates `bundle` in place. A module esbuild rejects becomes a diagnostic
+ * shim that throws the reason when required (`esbuildDiagnosticShim`).
  *
- * Candidate set is `isBundleModuleCandidate`; within it, files with no
- * top-level import/export are already CJS-shaped and left alone.
+ * ESM/TypeScript candidates are `isBundleModuleCandidate`. CommonJS cells,
+ * including .cjs, also visit the rewrite-only path for dynamic import().
  *
  * A JavaScript cell is rewritten in place. A TypeScript source keeps its
  * bytes and gets a compiled cell beside it — see `compiledCellKey`.
  *
+ * When the service transforms in another isolate every cell goes in one
+ * `transformMany`, so a launch costs one round trip and this isolate never
+ * grows esbuild's heap. Transforms that run here are paced like any pass.
+ *
  * Returns the count of files transformed (for diagnostics).
  */
-async function transformEsmInBundle(bundle, esbuild, pacer, isolatedTransform) {
+async function transformEsmInBundle(bundle, esbuild, pacer) {
     let transformed = 0;
     let failed = 0;
     // Snapshot the keys first — esbuild calls await; never iterate-and-mutate.
@@ -3098,104 +3196,140 @@ async function transformEsmInBundle(bundle, esbuild, pacer, isolatedTransform) {
     for (const path of Object.keys(bundle)) {
         if (compiledCellPath(path) !== null)
             continue;
-        if (!isBundleModuleCandidate(path))
+        if (!isBundleModuleCandidate(path) && !path.endsWith('.cjs'))
             continue;
         const src = bundle[path];
         // hardening-r5: binary cells are not ESM. Skip — looksLikeEsm +
         // esbuild.transform expect strings.
         if (typeof src !== 'string')
             continue;
-        if (bundleTypescriptLoader(path) === null) {
-            const esm = looksLikeEsm(src);
-            if (!esm)
+        if (path.endsWith('.cjs')) {
+            if (!mayHaveDynamicImport(src))
                 continue;
         }
+        else if (bundleTypescriptLoader(path) === null && !looksLikeEsm(path, src) && !mayHaveDynamicImport(src))
+            continue;
         candidates.push(path);
     }
+    const settle = (cell, outcome) => {
+        if ('error' in outcome) {
+            // Infrastructure failure is not source code. Abort before the bundle
+            // or immutable loader image can cache a throw-on-require diagnostic.
+            if (outcome.transient)
+                throw new Error(`esbuild transform unavailable for ${cell.path}: ${outcome.error}`);
+            // esbuild's verdict on this source is cached with it; a host that could
+            // not run the transform this time has no verdict to cache.
+            const shim = esbuildDiagnosticShim(cell.path, outcome.error);
+            bundle[cell.target] = shim;
+            __esmTransformCacheSet(cell.key, shim);
+            failed++;
+            return;
+        }
+        const code = bindImportMetaResolve(outcome.code, cell.absUrl);
+        bundle[cell.target] = code;
+        __esmTransformCacheSet(cell.key, code);
+        transformed++;
+    };
+    const transformCells = async (cells) => {
+        let outcomes;
+        try {
+            outcomes = await esbuild.transformMany(cells.map((cell) => cell.request));
+        }
+        catch (e) {
+            // Publishing a whole-bundle diagnostic would poison the next launch
+            // even when the per-cell transform cache correctly rejected it.
+            throw new Error(`esbuild transform service unavailable: ${errorText(e)}`, { cause: e });
+        }
+        cells.forEach((cell, i) => settle(cell, outcomes[i]));
+    };
+    const batch = [];
     for (const path of candidates) {
         const original = bundle[path];
         if (typeof original !== 'string')
             continue;
-        const src = bundleTypescriptLoader(path) === null ? rewriteProvidedCommonJsModules(original) : original;
+        const loader = bundleTypescriptLoader(path);
         // A TypeScript source keeps its bytes; its emit lands beside it.
-        const target = bundleTypescriptLoader(path) === null ? path : compiledCellKey(path);
-        // esbuild-wasm runs inside this isolate, so a transform is computation
-        // like any other pass — the await above it yields nothing on its own.
-        if (pacer)
-            await pacer.spend(src.length);
-        // `import.meta.url` substitution mirrors the sibling fix at
-        // src/runtime/runtime-registry.ts:383-389 (framework-gaps-fix P5).
-        // Without `define`, esbuild's CJS transform reduces `import.meta.url`
-        // to undefined (single-pass) or preserves it literally — only to
-        // SyntaxError at `new Function(...)` parse time (two-pass via
-        // EsbuildService.transform's async-IIFE wrap → "Cannot use
-        // 'import.meta' outside a module"). The substitution value is the
-        // real `file:///<absolute-path>` URL — exactly what real Node returns
-        // for an ESM module at that path.
-        //
-        // Note: cache key now incorporates the path because the transformed
-        // output is path-specific (the URL literal is baked in). Two files
-        // with identical source but different paths would otherwise share a
-        // cache entry and the second file would get the first file's URL.
+        const target = loader === null ? path : compiledCellKey(path);
+        // Source is transformed once per path; import.meta reads metadata from
+        // each evaluation's module object, including its query and fragment.
+        // The source URL still keys transforms and supplies the static parent
+        // for rewritten dynamic imports and diagnostics.
         const absUrl = 'file:///' + path.replace(/^\/+/, '');
-        const key = __cacheKey(src + '\0' + absUrl);
-        const cached = __esmTransformCache.get(key);
-        if (cached) {
+        // Keyed on the staged bytes, so a cell the pre-pass fails has a key too.
+        const key = __cacheKey(original + '\0' + absUrl);
+        const cached = __esmTransformCacheGet(key);
+        if (cached !== undefined) {
             bundle[target] = cached;
             transformed++;
             continue;
         }
+        // Every cell's dynamic import() is the process's: the transform keeps
+        // them, and the facet rewrites each to the process's ESM loader.
+        const moduleMetadata = !path.endsWith('.cjs') && (loader !== null || looksLikeEsm(path, original));
+        const cellFor = (code, rewriteOnly = false) => ({
+            path,
+            target,
+            key,
+            absUrl,
+            request: {
+                code,
+                options: rewriteOnly
+                    ? { rewriteOnly: true, dynamicImportParent: absUrl, moduleMetadata }
+                    : { loader: loader ?? 'js', format: 'cjs', target: 'esnext', define: importMetaDefines(absUrl, true), dynamicImportParent: absUrl, moduleMetadata },
+            },
+        });
+        let src;
         try {
-            const transformOptions = {
-                loader: bundleTypescriptLoader(path) ?? 'js',
-                format: 'cjs',
-                target: 'esnext',
-                define: importMetaDefines(absUrl),
-            };
-            const bounded = transformOptions.loader === 'js' && src.length >= ISOLATED_ESM_TRANSFORM_MIN_BYTES
-                ? rewriteBundledEsmToCjs(src, absUrl)
-                : null;
-            const t = bounded ?? (isolatedTransform && src.length >= ISOLATED_ESM_TRANSFORM_MIN_BYTES
-                ? await isolatedTransform(src, transformOptions)
-                : await esbuild.transform(src, transformOptions));
-            const code = bindImportMetaResolve(t.code, absUrl);
-            bundle[target] = code;
-            __esmTransformCache.set(key, code);
-            transformed++;
+            src = loader === null ? rewriteProvidedCommonJsModules(original) : original;
         }
         catch (e) {
-            // framework-fixes-F4 (2026-05-12): replace the source with a
-            // JS-valid module that throws an INFORMATIVE Error when require'd.
-            //
-            // Pre-fix this catch swallowed the failure silently. The pre-
-            // compile loop then re-saw the ESM source and emitted the
-            // SyntaxError "Cannot use import statement outside a module" into
-            // __compileFailures. __loadModule surfaced that as the user error
-            // — but it told the user nothing about WHY esbuild rejected the
-            // file (was it TLA at module scope? a TypeScript file mistyped
-            // as .js? an unsupported syntax? our esbuild service not init?).
-            //
-            // Post-fix the replacement source is parseable CJS that, when
-            // require()'d, throws a real Error carrying the esbuild reason.
-            // The pre-compile loop succeeds, the file lands in
-            // __compiledModules, and the failure surfaces at require time
-            // with FULL diagnostic context. Net effect for users: the same
-            // upstream tool still fails, but they now see WHY.
-            // Probe: tests/behavioral/npm-create/new/create-astro-diagnostic.mjs
-            // asserts the user-visible error contains "esbuild transform" so
-            // future diagnostic regressions are caught.
-            const reason = (e && e.message) ? String(e.message).replace(/\n/g, ' ') : String(e);
-            const escapedReason = JSON.stringify(`esbuild transform failed for ${path}: ${reason}`);
-            // Build a valid CJS module that throws on load. Use IIFE to keep
-            // module-scope flat (no TLA, no top-level await). Esbuild-cache
-            // this so repeated submits don't re-run the same transform.
-            const diagnosticSrc = '// framework-fixes-F4 diagnostic shim — esbuild rejected the ESM transform\n' +
-                '(function () { throw new Error(' + escapedReason + '); })();\n';
-            bundle[target] = diagnosticSrc;
-            __esmTransformCache.set(key, diagnosticSrc);
-            failed++;
+            // The pre-pass cannot read this cell: a verdict on it alone, like esbuild's.
+            settle(cellFor(original), { error: errorText(e) });
+            continue;
+        }
+        // CommonJS already: only its dynamic import() calls change.
+        const cell = path.endsWith('.cjs') || (loader === null && !looksLikeEsm(path, src)) ? cellFor(src, true) : cellFor(src);
+        if (cell.request.options?.rewriteOnly !== true && loader === null && src.length >= BUNDLED_ESM_REWRITE_MIN_BYTES) {
+            // The bounded rewrite is computation in this isolate, however large.
+            if (pacer)
+                await pacer.spend(src.length);
+            let rewritten;
+            try {
+                rewritten = rewriteBundledEsmToCjs(src, absUrl, true);
+            }
+            catch (e) {
+                rewritten = { error: errorText(e) };
+            }
+            if (rewritten && 'error' in rewritten) {
+                settle(cell, rewritten);
+                continue;
+            }
+            if (rewritten) {
+                // Its declarations are CommonJS now; what import() calls remain go to
+                // the facet like any cell's.
+                if (!mayHaveDynamicImport(rewritten.code) && !rewritten.code.includes('import.meta')) {
+                    settle(cell, rewritten);
+                    continue;
+                }
+                const rest = cellFor(rewritten.code, true);
+                if (esbuild.transformsInIsolate) {
+                    await transformCells([rest]);
+                    continue;
+                }
+                batch.push(rest);
+                continue;
+            }
         }
+        if (esbuild.transformsInIsolate) {
+            if (pacer)
+                await pacer.spend(src.length);
+            await transformCells([cell]);
+            continue;
+        }
+        batch.push(cell);
     }
+    if (batch.length > 0)
+        await transformCells(batch);
     return { transformed, failed };
 }
 /**
@@ -3214,7 +3348,7 @@ async function transformEsmInBundle(bundle, esbuild, pacer, isolatedTransform) {
  * behaviour for code paths that don't have esbuild handy).
  *
  */
-export async function buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bundleProfile = DEFAULT_FACET_BUNDLE_PROFILE, observedReads, pacer, isolatedTransform, maxBundleBytes) {
+export async function buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bundleProfile = DEFAULT_FACET_BUNDLE_PROFILE, observedReads, pacer, maxBundleBytes, learnedFor) {
     // This build accumulates raw VFS contents in the supervisor heap, and did it
     // with nothing watching: the estimator read 9.4 MiB while these bytes were
     // resetting the DO three times. Take the budget the enrichment passes are
@@ -3224,20 +3358,20 @@ export async function buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbui
     const lease = await acquireSupervisorAllocation(VFS_BUNDLE_MAX_BYTES);
     prefetchBundleStart(VFS_BUNDLE_MAX_BYTES);
     try {
-        return await _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bundleProfile, observedReads, pacer, isolatedTransform, maxBundleBytes);
+        return await _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bundleProfile, observedReads, pacer, maxBundleBytes, learnedFor);
     }
     finally {
         prefetchBundleEnd(VFS_BUNDLE_MAX_BYTES);
         lease.release();
     }
 }
-async function _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bundleProfile = DEFAULT_FACET_BUNDLE_PROFILE, observedReads, pacer, isolatedTransform, maxBundleBytes = VFS_BUNDLE_MAX_BYTES) {
+async function _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bundleProfile = DEFAULT_FACET_BUNDLE_PROFILE, observedReads, pacer, maxBundleBytes = VFS_BUNDLE_MAX_BYTES, learnedFor) {
     // Read the cursor BEFORE the walk: a mutation that lands while the bundle
     // is being assembled must be reported as invalidated, not silently missed.
-    const admitted = await vfs.authority.acquire(null, 0);
+    const admitted = await vfs.acquire(null, 0);
     const cursor = { epoch: admitted.epoch, rev: admitted.rev };
     // 1. Static reachable-set walk from entry.
-    const prefetch = (await prefetchForRequire(vfs, entryCode || '', cwd, scriptPath, maxBundleBytes));
+    const prefetch = (await prefetchForRequire(requireFsOverBridge(vfs), entryCode || '', cwd, scriptPath, maxBundleBytes, pacer?.spend.bind(pacer)));
     if ('kind' in prefetch) {
         // A required closure larger than the bound can never launch as a
         // snapshot. Surface it as the process's own failure rather than a
@@ -3245,7 +3379,16 @@ async function _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bu
         throw new ClosureBoundExceededError(prefetch);
     }
     const bundle = { ...prefetch.bundle };
-    const requiredPaths = new Set(Object.keys(prefetch.bundle));
+    const closurePaths = new Set(Object.keys(prefetch.bundle).filter((path) => !prefetch.speculative.has(path)));
+    // Evidence is kept apart from the closure: an observed subpath is not the
+    // closure choosing that corner of a package, and only the closure can fail
+    // a launch. The room evidence may fill is what the closure leaves under the
+    // bound, this session's own misses first, then what other sessions learned.
+    const observedPaths = new Set();
+    const learnedPaths = new Set();
+    let room = maxBundleBytes;
+    for (const path of closurePaths)
+        room -= _bundleCellRawBytes(bundle[path]);
     let truncated = false;
     const budgetState = { totalBytes: 0, fileCount: 0 };
     // Each enrichment pass below re-scans the bundle accumulated so far, so a
@@ -3267,14 +3410,23 @@ async function _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bu
     //     admitted first, ahead of every guess, and they join the required set
     //     rather than the evictable one, because a file evicted here misses
     //     again on the next run and the loop never closes.
-    const observedAdd = (await addObservedReads(vfs, observedReads, bundle, requiredPaths, budgetState));
-    void observedAdd;
+    // Other sessions' misses in the packages this closure can load
+    // (read-profile.ts) are evidence of the same kind: a learned module joins
+    // the module map with its imports, as this session's own misses do.
+    const learned = learnedFor ? await learnedFor(Object.keys(bundle)).catch(() => []) : [];
+    const own = await addObservedReads(vfs, observedReads, bundle, observedPaths, budgetState, Math.max(0, room), pacer);
+    room -= own.bytes;
+    const learnedOnly = new Set(learned.filter((path) => !observedReads?.has(path) && !observedPaths.has(path)));
+    await addObservedReads(vfs, learnedOnly, bundle, learnedPaths, budgetState, Math.max(0, room), pacer);
+    for (const path of observedPaths)
+        learnedPaths.delete(path);
     await paceAfterPass();
     // 2. Greedy oversample — every installed pkg's pkg.json + main.
     //    Catches dynamic-require / `bindings()` / plugin-loader cases the
     //    regex prefetch misses. Its budget is independent from the complete
     //    static require closure, which is correctness-critical.
-    const greedy = (await greedyAddMainEntries(vfs, cwd, bundle, budgetState, requiredPaths));
+    const independentBeforeGroups = new Set(Object.keys(bundle));
+    const greedy = (await greedyAddMainEntries(vfs, cwd, bundle, budgetState, closurePaths, { maxBundleBytes, pacer }));
     await paceAfterPass();
     // 2.25 X.5-Z3: static-readFileSync asset prefetch. Scans every
     //      bundle .js/.mjs/.cjs source for the canonical jsdom shape:
@@ -3349,31 +3501,17 @@ async function _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bu
     //     ESM files (e.g. tldts/dist/es6/index.js, @remix-run/react/dist/esm,
     //     @tailwindcss/vite, react-remove-scroll, astro) silently fail
     //     `new Function` at facet startup and surface as the misleading
-    //     "file was not pre-bundled" at request time.
+    //     "not in this launch's module map" at request time.
     if (esbuild) {
-        try {
-            await transformEsmInBundle(bundle, esbuild, pacer, isolatedTransform);
-            // Recount bytes after the transform — CJS rebuilds can be larger
-            // OR smaller than the ESM source. We don't try to thread totalBytes
-            // through the transform because the eviction loop below recomputes
-            // the encoded size from scratch anyway.
-        }
-        catch (e) {
-            // framework-fixes-F4 (2026-05-12): the prior catch was silent.
-            // Replace every detected-ESM source with the SAME diagnostic
-            // shim transformEsmInBundle's per-file catch installs, so the
-            // user sees "esbuild transform failed (service-level): <reason>"
-            // instead of a bare "Cannot use import statement..." parse
-            // error with no context.
-            const reason = (e && e.message) ? String(e.message).replace(/\n/g, ' ') : String(e);
-            _markBundleEsmAsFailed(bundle, `esbuild service unavailable: ${reason}`);
-        }
+        // Transient failures propagate through the launch failure path before
+        // serialization/cache/LOADER publication. Per-source verdicts still use
+        // the lazy diagnostic cells installed by transformEsmInBundle.
+        await transformEsmInBundle(bundle, esbuild, pacer);
     }
     else {
-        // framework-fixes-F4 (2026-05-12): no esbuild service available at
-        // all (lazy-init failed or never wired). Same diagnostic-shim
-        // treatment so users see WHY the ESM file couldn't be transformed.
-        _markBundleEsmAsFailed(bundle, 'esbuild service not initialized (likely lazy-init failure)');
+        // No esbuild service was given: the ESM cells stage as diagnostics that
+        // say so, rather than as source `new Function` rejects without a reason.
+        _markBundleEsmAsFailed(bundle, 'no esbuild service was given to this launch');
     }
     for (const path of Object.keys(bundle)) {
         if (compiledCellPath(path) === null && (!isBundleModuleCandidate(path) || bundleTypescriptLoader(path) !== null))
@@ -3382,61 +3520,165 @@ async function _buildPrefetchBundle(vfs, scriptPath, cwd, entryCode, esbuild, bu
         if (typeof source !== 'string')
             continue;
         await pacer?.spend(source.length);
-        bundle[path] = rewriteProvidedCommonJsModules(source);
+        try {
+            bundle[path] = rewriteProvidedCommonJsModules(source);
+        }
+        catch {
+            // Unparseable, so not a module and no bundled records to bind: data such as a LICENSE.
+        }
     }
     await paceAfterPass();
-    // 3. Manifest pass — UNCHANGED from W2.5b. Decouples directory shape
-    //    from content cap so fs.readdirSync remains honest even if the
-    //    content for a given file was capped out.
-    await paceAfterPass();
-    const manifest = (await buildManifest(vfs, cwd, scriptPath));
-    await paceAfterPass();
-    // 4. JSON-encoded-size guard, measured in UTF-8 bytes (not UTF-16 code
-    //    units) because that is what workerd charges against the per-module
-    //    text-size budget. Only OPTIONAL enrichment is evictable, largest
-    //    first; the manifest and the static require closure stay.
+    // 4. The snapshot's size guard, in the unit the session DO's memory was
+    //    measured in and the require walk counts: raw bytes, a cell's UTF-8
+    //    length (VFS_BUNDLE_MAX_BYTES, platform/limits.ts, unless the caller
+    //    set its own). The per-module text limit is met by side modules and is
+    //    not a reason to evict. Only
+    //    OPTIONAL enrichment is evictable; the static require closure stays, and
+    //    a closure past the bound by itself fails the launch by name.
     //
     //    Evicting an enrichment file is a real loss — the sync fs reads it
     //    exists for cannot fall back to the supervisor — so the paths that
     //    went are named rather than silently dropped.
-    const size = encodedBundleSize(bundle, manifest);
-    if (size.bytes > BUNDLE_MAX_ENCODED_BYTES) {
+    const size = encodedBundleSize(bundle);
+    const rawBytes = new Map();
+    let rawTotal = 0;
+    for (const [path, cell] of Object.entries(bundle)) {
+        const bytes = _bundleCellRawBytes(cell);
+        rawBytes.set(path, bytes);
+        rawTotal += bytes;
+    }
+    if (rawTotal > maxBundleBytes) {
+        // Only the walk's closure can fail a launch, and the path it names is the
+        // one whose bytes (with its compiled cell) crossed the bound, in walk order.
+        let closureBytes = 0;
+        let crossedAt = null;
+        for (const path of closurePaths) {
+            closureBytes += (rawBytes.get(path) ?? 0) + (rawBytes.get(compiledCellKey(path)) ?? 0);
+            if (crossedAt === null && closureBytes > maxBundleBytes)
+                crossedAt = path;
+        }
+        if (crossedAt !== null) {
+            throw new ClosureBoundExceededError({
+                kind: 'closure-exceeds-bound',
+                entry: scriptPath ?? 'entry code',
+                bytesSeen: closureBytes,
+                bound: maxBundleBytes,
+                lastPath: crossedAt,
+            });
+        }
         // A compiled cell goes with its source: required when the source is.
-        const evictable = Object.keys(bundle)
-            .filter((path) => !requiredPaths.has(compiledCellPath(path) ?? path))
-            .sort((a, b) => _bundleCellLength(bundle[b]) - _bundleCellLength(bundle[a]));
-        const evicted = [];
-        for (const k of evictable) {
-            if (size.bytes <= BUNDLE_MAX_ENCODED_BYTES)
+        //
+        // Order matters as much as the bound. Largest-first alone ranks a cell by
+        // what it costs and never by what losing it costs: an admitted module and
+        // the sibling it imports are both "optional", and shedding the sibling
+        // leaves a module in the bundle that cannot load. On `astro dev` the
+        // snapshot breached its bound by 591 files, and among the largest were
+        // modules while 3,291 declaration files (never a require target) stayed.
+        //
+        // Unloadable cells first, then enrichment largest-first, then dynamic-import
+        // subtrees last-discovered first, so a CLI's own `import()` deferral is shed last.
+        const speculativeRank = new Map();
+        for (const path of prefetch.speculative)
+            speculativeRank.set(path, speculativeRank.size);
+        const rankOf = (path) => speculativeRank.get(compiledCellPath(path) ?? path) ?? -1;
+        // Evidence goes after all enrichment: what others learned before this
+        // session's own misses, each tier last-admitted first.
+        const tierOf = (path) => {
+            const source = compiledCellPath(path) ?? path;
+            return closurePaths.has(source) ? 3 : observedPaths.has(source) ? 2 : learnedPaths.has(source) ? 1 : 0;
+        };
+        const members = new Set();
+        for (const group of greedy.groups)
+            for (const path of group.members)
+                members.add(path);
+        const sources = new Set(Object.keys(bundle).map(path => compiledCellPath(path) ?? path));
+        const independent = new Set([...sources].filter(path => !members.has(path) || independentBeforeGroups.has(path)));
+        const keptGroups = new Set(greedy.groups);
+        const weight = (path) => (rawBytes.get(path) ?? 0) + (rawBytes.get(compiledCellKey(path)) ?? 0);
+        const unitBytes = new Map();
+        for (const group of greedy.groups) {
+            let total = 0;
+            for (const member of group.members)
+                if (!independent.has(member))
+                    total += weight(member);
+            unitBytes.set(group.root, total);
+            if (pacer)
+                await pacer.spend(group.members.size * 256);
+        }
+        const lastAdmittedFirst = (tier) => [...tier].reverse().filter(path => independent.has(path));
+        const enrichment = [...independent, ...greedy.groups.map(group => group.root)]
+            .filter(path => tierOf(path) === 0)
+            .sort((a, b) => {
+            const loadable = (_isLoadableModuleCell(a) ? 1 : 0) - (_isLoadableModuleCell(b) ? 1 : 0);
+            if (loadable !== 0)
+                return loadable;
+            const rankA = rankOf(a);
+            const rankB = rankOf(b);
+            if (rankA !== rankB)
+                return rankA < 0 ? -1 : rankB < 0 ? 1 : rankB - rankA;
+            return (unitBytes.get(b) ?? weight(b)) - (unitBytes.get(a) ?? weight(a));
+        });
+        const evictable = [...enrichment, ...lastAdmittedFirst(learnedPaths), ...lastAdmittedFirst(observedPaths)];
+        async function retainedPaths() {
+            const retained = new Set(independent);
+            for (const group of keptGroups) {
+                let work = 0;
+                for (const path of group.members) {
+                    retained.add(path);
+                    work += path.length + 256;
+                }
+                if (pacer)
+                    await pacer.spend(work);
+            }
+            for (const source of [...retained]) {
+                const compiled = compiledCellKey(source);
+                if (bundle[compiled] !== undefined)
+                    retained.add(compiled);
+            }
+            return retained;
+        }
+        let retained = await retainedPaths();
+        for (const path of evictable) {
+            if (rawTotal <= maxBundleBytes)
                 break;
-            evicted.push([k, _bundleCellLength(bundle[k])]);
+            if (independent.delete(path)) {
+                for (const group of keptGroups)
+                    if (group.members.has(path))
+                        keptGroups.delete(group);
+            }
+            else {
+                for (const group of keptGroups)
+                    if (group.root === path)
+                        keptGroups.delete(group);
+            }
+            retained = await retainedPaths();
+            rawTotal = 0;
+            for (const path of retained)
+                rawTotal += rawBytes.get(path) ?? 0;
+        }
+        const evicted = [];
+        for (const k of Object.keys(bundle)) {
+            if (retained.has(k))
+                continue;
+            evicted.push([k, rawBytes.get(k) ?? 0]);
             delete bundle[k];
             size.remove(k);
         }
         if (evicted.length > 0) {
             truncated = true;
-            console.warn(`[facet-manager] prefetch snapshot exceeded ${BUNDLE_MAX_ENCODED_BYTES} encoded `
-                + `bytes; evicted ${evicted.length} optional file(s). They still exist and `
+            console.warn(`[facet-manager] prefetch snapshot exceeded ${maxBundleBytes} bytes; `
+                + `evicted ${evicted.length} optional file(s). They still exist and `
                 + `async reads still return them; synchronous reads raise EAGAIN: `
                 + `${describeBundleCells(evicted)}`);
         }
     }
     const fileCount = Object.keys(bundle).length;
-    const metadata = (await buildVfsMetadata(vfs, manifest, bundle));
-    (await addUnreadableDenialCells(vfs, bundle, metadata));
-    await paceAfterPass();
-    // Denial cells land after the eviction pass, so account for them before
-    // deciding where the bundle has to live.
-    for (const [path, cell] of Object.entries(bundle))
-        size.add(path, cell);
     const bundleSideModulesRequired = size.bytes > BUNDLE_MAX_ENCODED_BYTES;
     // Suppress lint: `greedy.added` is observed only via diagnostics.
     void greedy;
     const wasmImages = (await collectClosureWasmImages(vfs, bundle, binSiblingAdd.wasmPaths));
     return {
         bundle,
-        manifest,
-        metadata,
         cursor,
         reachableCount: fileCount,
         truncated,
@@ -3518,24 +3760,27 @@ export class FacetManager {
     // spawn created as an OS-child of the attach TUI. When the attach process
     // exits (reported / killed), its serve facet is torn down with it.
     _pairedServeFacet = new Map();
+    // The bundle a resident pid booted from, so the misses it reports at exit
+    // stage into the next launch of the same entry, as a one-shot's do.
+    residentBundleKeys = new Map();
+    /** Per resident pid: the shared read profile's entries its launch staged, settled at its exit. */
+    residentProfileOffers = new Map();
     /**
-     * W3.5 Fix B: lazily-created EsbuildService for the ESM→CJS pre-pass
-     * over the prefetch bundle. Created on first exec where vfs is set;
-     * shared across subsequent execs (warm wasm).  Optional setter
-     * `setEsbuildService` lets NimbusSession share its existing instance
-     * to avoid double-init.
+     * The esbuild the bundle's ESM→CJS pass transforms with. composeFacetManager
+     * sets it: the host's own, or one whose transforms run in the session's
+     * esbuild facet. Never one of this isolate: esbuild-wasm's heap only grows.
      */
     esbuild = null;
     /**
      * Prefetch-bundle cache. buildPrefetchBundle does a full VFS reachable-set
      * walk + greedy oversample + esbuild ESM→CJS pass on EVERY foreground
      * exec — dominant wall-clock on large node_modules. This memoizes the
-     * result (including the serialized facet bundle + manifest) keyed on
+     * result (including the serialized facet bundle) keyed on
      * (bundleProfile, cwd, scriptPath, entryCode identity).
      *
      * Correctness watermark: the GLOBAL SqliteVFS revision. buildPrefetchBundle
      * reads from paths that can lie anywhere in the VFS (addEntryAbsPathReads
-     * pulls absolute-path literals like /tmp/x; buildManifest walks from '/'),
+     * pulls absolute-path literals like /tmp/x),
      * so a cwd-scoped subtree revision cannot guarantee invalidation. The
      * global revision bumps on ANY write, so the cache invalidates on every
      * mutation that could change any file the bundle reads — provably
@@ -3556,6 +3801,35 @@ export class FacetManager {
      * already deliver for the case that matters: running the command again.
      */
     residencyProfiles = new Map();
+    /**
+     * Misses shared across sessions per installed package (read-profile.ts),
+     * kept in the npm tarball cache bucket (NPM_TARBALL_CACHE) beside the
+     * tarballs. Unbound, a miss is learned for this session only
+     * (residencyProfiles).
+     */
+    readProfile = null;
+    /** Read-profile changes dropped after losing every write race. */
+    readProfileConflicts = 0;
+    /** Per module path: its static references at a revision (see _closureStaticRefs). */
+    staticRefsMemo = new Map();
+    /** Modules whose references are remembered: a few programs' closures. */
+    static STATIC_REFS_MEMO_MAX = 16_384;
+    /**
+     * What the prefetch cache holds right now, for /api/_diag/memory: each
+     * entry's key, the revision it was built at, and its retained bytes, next
+     * to the filesystem's live revision and the residency profiles. A launch
+     * that rebuilds where a hit was expected is explained by exactly these:
+     * the revision moved, the key changed, or a miss profile dropped the entry.
+     */
+    prefetchCacheDiag() {
+        return {
+            revision: this.vfs ? this.vfs.revision() : null,
+            entries: [...this.prefetchBundleCache].map(([key, entry]) => ({
+                key, revision: entry.revision, bytes: entry.bytes,
+            })),
+            residencyProfiles: [...this.residencyProfiles].map(([key, paths]) => ({ key, paths: [...paths] })),
+        };
+    }
     /** In-flight request-driven durable-app ensures, single-flight per port. */
     ensureInflight = new Map();
     /** Per-pid chain of journal-row amendments; see `_amendRow`. */
@@ -3593,6 +3867,12 @@ export class FacetManager {
             ? Reflect.get(env, 'NIMBUS_DEBUG')
             : undefined;
         this.debugEnabled = debugVar === '1' || debugVar === 'true';
+        const profiles = ((typeof env === 'object' || typeof env === 'function') && env !== null)
+            ? Reflect.get(env, 'NPM_TARBALL_CACHE')
+            : undefined;
+        this.readProfile = profiles && typeof profiles === 'object'
+            ? new ReadProfile(profiles, Date.now, () => { this.readProfileConflicts++; })
+            : null;
         this.launchJournal = new FencedWork(ctx.storage, {
             generationBase: () => this.processes.pidBase,
             waitUntil: (promise) => this.ctx.waitUntil(promise),
@@ -3617,8 +3897,31 @@ export class FacetManager {
         // Rooted on waitUntil: the hook fires synchronously inside whatever turn
         // ended the process, and the delete must not be a floating promise there.
         this.processes.setOnTerminal((pid) => {
+            this.residentBundleKeys.delete(pid);
+            this.residentProfileOffers.delete(pid);
             this.ctx.waitUntil(this.trackLaunchTask(this._onResidentTerminal(pid)));
         });
+        this.processes.setDefaultSignalAction((pid, code, signal) => this._endBySignal(pid, code, signal));
+    }
+    /**
+     * A signal's default action: the process ends with 128+signo whether its
+     * facet is still being built (the launch stops at its next ownership gate)
+     * or already booted (its resources are released like a kill).
+     */
+    _endBySignal(pid, code, signal) {
+        if (this.processes.get(pid)?.state !== 'running')
+            return;
+        this.portRegistry.unregisterByPid(pid);
+        this.releaseProcessRpcResources(pid);
+        this.revokeProcessVfsWriters(pid);
+        this.processes.exit(pid, code);
+        this.processes.markExit(pid, code, signal);
+        this.processes.closeInput(pid);
+        try {
+            this.hooks.onExternalExit?.(pid, code, signal);
+        }
+        catch { }
+        this._teardownPairedServeFacet(pid);
     }
     /**
      * The process is over. Every end-of-life passes through here: a clean
@@ -3757,12 +4060,42 @@ export class FacetManager {
         }
         return vfs;
     }
+    /** Give the bundle's ESM→CJS pass the host's esbuild, as composeFacetManager does. */
+    setEsbuildService(esbuild) { this.esbuild = esbuild; }
     /**
-     * W3.5 Fix B: hand the FacetManager a pre-warmed EsbuildService for
-     * the ESM→CJS bundle pre-pass. NimbusSession already lazy-creates one
-     * for the user-shell `node` runtime; sharing avoids paying init twice.
+     * The entry script as the facet compiles it: each dynamic `import()` routed
+     * to the process's ESM loader, with the entry's own URL as the parent (Node
+     * names `-e` code `<cwd>/[eval]` and stdin `<cwd>/[stdin]`). The parse runs
+     * in the esbuild facet like every cell's, and is cached by content. The
+     * module-map walk reads the script as written, before this.
      */
-    setEsbuildService(esbuild) { this.esbuild = esbuild; }
+    async _entryDynamicImports(code, filename, cwd) {
+        if (!mayHaveDynamicImport(code))
+            return code;
+        if (this.esbuild === null)
+            throw new Error('entry dynamic import requires the transform service');
+        const base = cwd.replace(/\/+$/, '') || '/';
+        const path = filename === undefined || filename === '<eval>'
+            ? `${base}/[eval]`
+            : filename === '[stdin]' ? `${base}/[stdin]` : filename;
+        const parentUrl = 'file:///' + path.replace(/^\/+/, '');
+        const key = __cacheKey(code + '\0' + parentUrl + '\0entry');
+        const cached = __esmTransformCacheGet(key);
+        if (cached !== undefined)
+            return cached;
+        const [outcome] = await this.esbuild.transformMany([
+            { code, options: { rewriteOnly: true, dynamicImportParent: parentUrl } },
+        ]);
+        // A failed entry rewrite must not reach a Worker Loader as native host
+        // import(), or become an immutable cached image. Preserve the reported
+        // reason for permanent source errors as well as transient failures.
+        if (outcome === undefined)
+            throw new Error('entry transform service returned no outcome');
+        if ('error' in outcome)
+            throw new Error(`entry dynamic import transform failed: ${outcome.error}`);
+        __esmTransformCacheSet(key, outcome.code);
+        return outcome.code;
+    }
     /**
      * The pacer every launch is built under: the session's alarm-driven turn
      * pump, the deployment's chunk bound, and the one check a suspended launch
@@ -3820,36 +4153,211 @@ export class FacetManager {
             return modules;
         if (!this.filesystem)
             throw new Error('Process filesystem authority is not initialized');
-        const vfs = new ExecutionFs(this.filesystem.bind({ pid: entry.pid, cred: entry.cred }));
+        const vfs = this.filesystem.bind({ pid: entry.pid, cred: entry.cred });
         for (const image of wasmImports) {
-            let bytes;
-            try {
-                bytes = (await vfs.readFile(stripLeadingSlashes(image.vfsPath)));
-            }
-            catch {
+            const bytes = await filesOf(vfs).readBytes(stripLeadingSlashes(image.vfsPath)).catch(() => null);
+            if (bytes === null)
                 continue;
-            }
             modules[image.moduleName] = {
                 wasm: bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength),
             };
         }
         return modules;
     }
+    /**
+     * Which contents a resident process holds from its first instruction,
+     * beyond its module map: data-plan.ts over this process's view of the
+     * namespace. A path the plan leaves out is still named and stat-able; a
+     * synchronous read of it is the one honest miss.
+     */
+    async _planResidentData(entry, vfsState, cwd, home, pacer) {
+        if (!this.vfs || !this.filesystem)
+            return { paths: [], storageBytes: 0 };
+        const vfs = this.filesystem.bind({ pid: entry.pid, cred: entry.cred });
+        const started = Date.now();
+        const trace = (what) => {
+            if (!this.debugEnabled)
+                return;
+            this.processes.appendOutput(entry.pid, 'stderr', `[nimbus-debug] data plan: ${what} at ${Date.now() - started} ms\n`);
+        };
+        trace('static references');
+        const refs = await this._closureStaticRefs(vfs, vfsState.bundlePaths ?? [], pacer);
+        trace(`${refs.length} modules name paths; learned reads`);
+        const learned = await this._learnedReads(vfsState, entry.cred);
+        trace(`${learned.length} learned; listing`);
+        let pages = 0;
+        let names = 0;
+        const plan = await planFacetData({
+            list: async (after) => {
+                const page = await vfs.list(after, FS_LIST_PAGE_LIMIT);
+                names += page.entries.length;
+                trace(`page ${++pages}: ${page.entries.length} entries`);
+                return { entries: page.entries, next: page.next };
+            },
+            readText: async (path) => {
+                try {
+                    return await filesOf(vfs).readFileString(path);
+                }
+                catch {
+                    return null;
+                }
+            },
+            // A missing or unreadable component is not a link: the lookup ends there.
+            readlink: async (path) => {
+                try {
+                    return await vfs.readlink(path);
+                }
+                catch {
+                    return null;
+                }
+            },
+            stat: async (path) => {
+                const st = await filesOf(vfs).stat(path).catch(() => null);
+                return st && { kind: st.type, size: st.size };
+            },
+        }, {
+            cwd,
+            home: home || '/home/user',
+            closure: vfsState.bundlePaths ?? [],
+            refs,
+            learned,
+            spend: (units) => pacer.spend(units),
+        });
+        trace(`planned ${plan.paths.length}`);
+        // What the facet's store will hold (N18), in the cost its store charges
+        // itself (facet-resident-store's __residentCellCost): the planned bytes on
+        // overflow pages (1% over), a head and chunk rows per file, a namespace
+        // row per name, and slack for the last write's page.
+        const rows = plan.paths.length * 2 + Math.ceil(plan.bytes / RESIDENT_CHUNK_BYTES) + names;
+        // And the module map, which the store adopts at boot: the process's code,
+        // costed when the map was built (its cells are released once serialized).
+        const moduleBytes = vfsState.moduleStorageBytes ?? moduleMapStorageBytes(vfsState.bundle);
+        const storageBytes = Math.ceil(plan.bytes * 1.01) + rows * LEDGER_ROW_BYTES + moduleBytes + 65_536;
+        return { paths: plan.paths, storageBytes };
+    }
+    /**
+     * Paths earlier launches of the same build missed in this session. Other
+     * sessions' misses (the shared read profile) join the module map instead,
+     * in _buildProcessBundle, where a learned module brings its imports.
+     */
+    async _learnedReads(vfsState, _cred) {
+        return vfsState.bundleKey ? [...(this.residencyProfiles.get(vfsState.bundleKey) ?? [])] : [];
+    }
+    /**
+     * The installed packages a closure can load: every package the lockfiles
+     * pin whose node_modules directory is on the resolution path of the cwd or
+     * of a closure file. A first miss is, by definition, in a package the
+     * closure did not already load, so its package's root is found this way.
+     */
+    _profileRoots(closure, cwd) {
+        const sql = this.ctx.storage.sql;
+        if (!sql)
+            return [];
+        const integrities = new NpmCache(sql).installedIntegrities();
+        if (integrities.size === 0)
+            return [];
+        const dirs = new Set();
+        const ancestors = (dir) => {
+            for (let d = dir;;) {
+                const nm = d === '' ? 'node_modules' : `${d}/node_modules`;
+                if (dirs.has(nm))
+                    return;
+                dirs.add(nm);
+                if (d === '')
+                    return;
+                d = d.slice(0, Math.max(0, d.lastIndexOf('/')));
+            }
+        };
+        ancestors(cwd.replace(/^\/+|\/+$/g, ''));
+        for (const path of closure) {
+            const k = path.replace(/^\/+/, '');
+            ancestors(k.slice(0, Math.max(0, k.lastIndexOf('/'))));
+        }
+        return [...integrities.keys()].filter((root) => {
+            const i = root.lastIndexOf('/node_modules/');
+            const parent = i === -1 ? (root.startsWith('node_modules/') ? 'node_modules' : null) : root.slice(0, i + '/node_modules'.length);
+            return parent !== null && dirs.has(parent);
+        });
+    }
+    /**
+     * A package directory's identity for the shared read profile: the tarball
+     * integrity the session's lockfiles pin, or, for a package no lockfile
+     * pins (a link, a git or file dependency), the content key of its
+     * package.json as this credential reads it.
+     */
+    _packageIdentity(cred) {
+        const sql = this.ctx.storage.sql;
+        const integrities = sql ? new NpmCache(sql).installedIntegrities() : new Map();
+        const view = this.vfs?.as(cred) ?? null;
+        return (root) => {
+            const integrity = integrities.get(root);
+            if (integrity !== undefined)
+                return integrity;
+            if (view === null)
+                return null;
+            try {
+                return `pkgjson:${view.contentKey(root + '/package.json')}`;
+            }
+            catch {
+                return null;
+            }
+        };
+    }
+    /**
+     * What the closure's JavaScript names by a foldable path (static-fs-refs.ts),
+     * read from the VFS as written rather than from the module map, whose ESM
+     * cells were rewritten and lost their import.meta. Each module is parsed once
+     * per revision of it, in this session.
+     */
+    async _closureStaticRefs(vfs, paths, pacer) {
+        const out = [];
+        for (const path of paths) {
+            if (!/\.(?:c|m)?js$/.test(path))
+                continue;
+            let rev;
+            try {
+                rev = await vfs.revision(path);
+            }
+            catch {
+                continue;
+            }
+            const memo = this.staticRefsMemo.get(path);
+            let refs;
+            if (memo && memo.rev === rev) {
+                refs = memo.refs;
+            }
+            else {
+                let source;
+                try {
+                    source = await filesOf(vfs).readFileString(path);
+                }
+                catch {
+                    continue;
+                }
+                await pacer.spend(source.length);
+                refs = findStaticFsReferences(source, '/' + path);
+                this.staticRefsMemo.delete(path);
+                this.staticRefsMemo.set(path, { rev, refs });
+                for (const oldest of this.staticRefsMemo.keys()) {
+                    if (this.staticRefsMemo.size <= FacetManager.STATIC_REFS_MEMO_MAX)
+                        break;
+                    this.staticRefsMemo.delete(oldest);
+                }
+            }
+            if (refs.exact.length + refs.listed.length + refs.patterns.length + refs.cwdRelative.length + refs.resolves.length > 0) {
+                out.push(refs);
+            }
+        }
+        return out;
+    }
     async _buildProcessBundle(entry, spec, pacer) {
         if (!this.vfs) {
-            return { bundle: {}, manifest: {}, metadata: {}, reachableCount: 0, truncated: false };
-        }
-        // W3.5 Fix B: thread an EsbuildService into buildPrefetchBundle so ESM
-        // source files (e.g. tldts/dist/es6/index.js, @remix-run/react,
-        // @tailwindcss/vite, react-remove-scroll, astro) get transformed to CJS
-        // before they hit the facet's `new Function` pre-compile loop. Lazy-create
-        // one if NimbusSession didn't share its own.
-        if (!this.esbuild)
-            this.esbuild = new EsbuildService(this.vfs.as(CRED_KERNEL));
+            return { bundle: {}, reachableCount: 0, truncated: false };
+        }
         this.imageStore.ensureDir();
         if (!this.filesystem)
             throw new Error('Process filesystem authority is not initialized');
-        const vfs = new ExecutionFs(this.filesystem.bind({ pid: entry.pid, cred: entry.cred }));
+        const vfs = this.filesystem.bind({ pid: entry.pid, cred: entry.cred });
         const { cred } = entry;
         const profile = spec.bundleProfile ?? DEFAULT_FACET_BUNDLE_PROFILE;
         const credKey = `${cred.uid}:${cred.gid}:${cred.groups.join(',')}`;
@@ -3878,16 +4386,41 @@ export class FacetManager {
             this.prefetchBundleCache.set(key, cached);
             return { ...cached.vfsState, cacheHit: true, cacheRetained: true };
         }
-        const vfsState = await buildPrefetchBundle(vfs, spec.scriptPath, spec.cwd, spec.entryCode, this.esbuild, profile, this.residencyProfiles.get(key), pacer, this.hooks.transformLargeEsm);
+        const readProfile = this.readProfile;
+        const offered = [];
+        const learnedFor = readProfile === null ? undefined : async (closure) => {
+            const roots = this._profileRoots(closure, spec.cwd);
+            if (roots.length === 0)
+                return [];
+            offered.push(...await readProfile.lookup(roots, this._packageIdentity(cred), READ_PROFILE_LAUNCH_BYTES));
+            return offered.map((entry) => entry.path);
+        };
+        const vfsState = await buildPrefetchBundle(vfs, spec.scriptPath, spec.cwd, spec.entryCode, this.esbuild ?? undefined, profile, this.residencyProfiles.get(key), pacer, undefined, learnedFor);
+        if (offered.length > 0) {
+            const staged = [];
+            const unresolved = [];
+            for (const entry of offered) {
+                if (vfsState.bundle[entry.path] !== undefined) {
+                    staged.push(entry);
+                    continue;
+                }
+                // Not staged: over the budget, or nothing a regular file answers (then it is pruned).
+                const stat = await Promise.resolve(vfs.stat('/' + entry.path, { followSymlinks: false })).catch(() => null);
+                if (stat === null || stat.type !== 'file')
+                    unresolved.push(entry.path);
+            }
+            vfsState.profileOffer = { staged, unresolved };
+        }
         vfsState.bundleKey = key;
-        vfsState.bundleSource = await buildFacetVfsBundleSource(vfsState.bundle, vfsState.bundleSideModulesRequired, pacer);
-        vfsState.serializedManifest = JSON.stringify(vfsState.manifest);
-        vfsState.serializedMetadata = JSON.stringify(vfsState.metadata);
-        // Two more serializations of the same weight as the passes before them.
-        await pacer.spend(vfsState.serializedManifest.length + vfsState.serializedMetadata.length);
-        // The only consumer of the raw cells past this point is a single boolean,
-        // so answer it now rather than hold ~17 MB (pi) to answer it later.
+        vfsState.bundlePaths = Object.keys(vfsState.bundle);
+        // The only consumer of the raw cells past serialization is a single
+        // boolean, so it is answered first; the serialization then consumes them.
         vfsState.usesNodeSqlite = bundleUsesNodeSqlite(spec.entryCode, vfsState.bundle);
+        // And what the module map costs the facet's store, which adopts it at boot
+        // (N18): taken now, while the cells exist, for every launch this state
+        // serves (a cache hit included).
+        vfsState.moduleStorageBytes = moduleMapStorageBytes(vfsState.bundle);
+        vfsState.bundleSource = await buildFacetVfsBundleSource(vfsState.bundle, vfsState.bundleSideModulesRequired, pacer, { consume: true });
         vfsState.cacheHit = false;
         // Serialization is total: bundleSource/serializedManifest/serializedMetadata
         // carry every byte the raw cells and objects do, and both generators read
@@ -4023,7 +4556,43 @@ export class FacetManager {
     hasResidentProcess(pid) {
         return this.processRpcResources.has(pid);
     }
-    noteProcessReportedExit(pid, exitCode) {
+    noteProcessReportedExit(pid, exitCode, residencyMisses, evidence) {
+        // Filed before the exit marks the table: the terminal hook forgets the key.
+        this._recordResidencyMisses(this.residentBundleKeys.get(pid), residencyMisses);
+        const exiting = this.processes.get(pid);
+        const offer = this.residentProfileOffers.get(pid);
+        this.residentProfileOffers.delete(pid);
+        if (this.readProfile && exiting) {
+            // The shared profile learns only what this supervisor served the process
+            // after a miss, as the process's own credential sees it (read-profile.ts).
+            const profile = this.readProfile;
+            const identity = this._packageIdentity(exiting.cred);
+            const view = this.vfs?.as(exiting.cred) ?? null;
+            const served = evidence?.served ?? new Set();
+            // Observers and vouchers are principals the router verified, read off
+            // this session's Durable Object name; an anonymous session only reads.
+            const principal = profilePrincipal(sessionIdentity({ ctx: this.ctx })?.tenantSegment);
+            this.ctx.waitUntil((async () => {
+                const tag = principal === null ? null : await principalTag(principal);
+                if (tag !== null && view !== null && residencyMisses && residencyMisses.length > 0) {
+                    const found = await verifiedEvidence(residencyMisses, served, async (path) => {
+                        try {
+                            const st = view.lstat(path.replace(/^\/+/, ''));
+                            return { type: st.type, size: st.size };
+                        }
+                        catch {
+                            return null;
+                        }
+                    });
+                    if (found.length > 0)
+                        await profile.observe(found, tag, identity);
+                }
+                if (tag !== null && offer !== undefined) {
+                    const unread = evidence?.profileUnread ? new Set(evidence.profileUnread) : null;
+                    await profile.settle(offer.staged, unread, served, new Set(offer.unresolved), tag);
+                }
+            })().catch(() => undefined));
+        }
         this.portRegistry.unregisterByPid(pid);
         this.processes.exit(pid, exitCode);
         const tracked = this.processRpcResources.get(pid);
@@ -4129,7 +4698,7 @@ export class FacetManager {
         }
         const bundleMs = diagOn ? Date.now() - __bundleStart : 0;
         const diagSink = diagOn
-            ? { loadMs: 0, runMs: 0, moduleMapBytes: 0, bundleBytes: 0, manifestBytes: 0, metadataBytes: 0 }
+            ? { loadMs: 0, runMs: 0, moduleMapBytes: 0, bundleBytes: 0 }
             : undefined;
         const abortController = new AbortController();
         // Ctrl-C / kill on a user program has to end the in-flight run, not just
@@ -4140,7 +4709,11 @@ export class FacetManager {
         const onShellAbort = () => abortController.abort();
         opts.signal?.addEventListener('abort', onShellAbort, { once: true });
         try {
-            const result = await this._execViaLoader(code, opts, entry, vfsState, abortController.signal, diagSink);
+            // A one-shot holds its module map and what it was seen to read (both in
+            // the bundle), and plans nothing beyond them: a data plan is chosen from
+            // a listing of the namespace, and a one-shot takes no listing of its own
+            // (§2.8: the principal's image is where that comes from).
+            const result = await this._execViaLoader(code, opts, entry, vfsState, [], abortController.signal, diagSink);
             this._flushVfsWrites(result, entry.pid);
             this._recordResidencyMisses(vfsState.bundleKey, result.residencyMisses);
             this.processes.exit(entry.pid, result.exitCode);
@@ -4156,8 +4729,7 @@ export class FacetManager {
                     drainPasses: result.diag?.drainPasses ?? 0,
                     moduleMapBytes: diagSink.moduleMapBytes,
                     bundleBytes: diagSink.bundleBytes,
-                    manifestBytes: diagSink.manifestBytes,
-                    metadataBytes: diagSink.metadataBytes,
+                    namespaceRefusals: result.diag?.namespaceRefusals ?? 0,
                     rpcWrites: result.diag?.rpcWrites ?? 0,
                     fsRpcReads: result.diag?.fsRpcReads ?? 0,
                     cacheHit: vfsState.cacheHit ?? false,
@@ -4228,13 +4800,13 @@ export class FacetManager {
         }
     }
     // ── One-shot dynamic Worker entrypoint ────────────────────────────────
-    async _execViaLoader(code, opts, entry, vfsState, signal, diagSink) {
+    async _execViaLoader(code, opts, entry, vfsState, dataPlan, signal, diagSink) {
         // Answered by _buildProcessBundle while the raw cells were still in
         // hand; re-deriving it here is what forced them to be retained.
         const usesSqlite = vfsState.usesNodeSqlite ?? bundleUsesNodeSqlite(code, vfsState.bundle);
-        const [sqliteModules, shims] = await Promise.all([
+        const [sqliteModules, sources] = await Promise.all([
             this.sqliteModuleEntry(usesSqlite),
-            fetchNodeShimsCode(this.env),
+            fetchNodeFacetSources(this.env),
         ]);
         const writerId = crypto.randomUUID();
         let writerActivated = false;
@@ -4250,6 +4822,7 @@ export class FacetManager {
             captureOutput: !!opts.captureOutput,
             cred: { ...entry.cred, groups: [...entry.cred.groups] },
             vfsCursor: vfsState.cursor,
+            dataPlan,
             ...(diagSink ? { diag: true } : {}),
         });
         try {
@@ -4270,7 +4843,8 @@ export class FacetManager {
                     // the map, and compiled by the loader like the sqlite sidecar.
                     const wasmImports = facetWasmImports([], vfsState.wasmImages ?? []);
                     const wasmModules = (await this._wasmModulesByValue(entry, wasmImports));
-                    const generatedWorker = await generateEntrypointCode(code, vfsState, usesSqlite, shims, wasmImports);
+                    const entryCode = await this._entryDynamicImports(code, opts.filename, opts.cwd || '/home/user');
+                    const generatedWorker = await generateEntrypointCode(entryCode, vfsState, usesSqlite, sources, wasmImports);
                     if (diagSink) {
                         diagSink.moduleMapBytes = _encodedSourceBytes(generatedWorker.code);
                         for (const source of Object.values(generatedWorker.modules)) {
@@ -4285,8 +4859,6 @@ export class FacetManager {
                         for (const source of Object.values(vfsState.bundleSource?.modules ?? {})) {
                             diagSink.bundleBytes += _encodedSourceBytes(source);
                         }
-                        diagSink.manifestBytes = _encodedSourceBytes(vfsState.serializedManifest ?? '');
-                        diagSink.metadataBytes = _encodedSourceBytes(vfsState.serializedMetadata ?? '');
                     }
                     if (!vfsState.cacheRetained)
                         releaseGeneratedSources(vfsState);
@@ -4353,7 +4925,7 @@ export class FacetManager {
         // the Worker-Loader cache-miss path (with SUPERVISOR bound to THIS call's
         // context, which stays open for the whole run), never in this DO.
         const writerId = crypto.randomUUID();
-        const supervisor = { doId: this.ctx.id.toString(), pid: staged.pid, writerId };
+        const supervisor = { ...supervisorBindingProps(this.ctx, staged.pid), writerId };
         const ctxExports = getNimbusCtxExports();
         let entrypoint;
         let writerActivated = false;
@@ -4434,10 +5006,10 @@ export class FacetManager {
         // other writes flush live through the SUPERVISOR RPC bridge.
         if (this.vfs)
             this.imageStore.ensureDir();
-        const processVfs = this.filesystem ? new ExecutionFs(this.filesystem.bind({ pid: entry.pid, cred: entry.cred })) : null;
+        const processVfs = this.filesystem ? this.filesystem.bind({ pid: entry.pid, cred: entry.cred }) : null;
         const vfsState = processVfs
-            ? await buildPrefetchBundle(processVfs, undefined, opts.cwd, '', this.esbuild || undefined, DEFAULT_FACET_BUNDLE_PROFILE, undefined, undefined, this.hooks.transformLargeEsm)
-            : { bundle: {}, manifest: {}, metadata: {}, reachableCount: 0, truncated: false };
+            ? await buildPrefetchBundle(processVfs, undefined, opts.cwd, '', this.esbuild || undefined, DEFAULT_FACET_BUNDLE_PROFILE)
+            : { bundle: {}, reachableCount: 0, truncated: false };
         const vfsBundle = _serializeBundleForFacet(vfsState.bundle);
         assertStagedBundleFitsRpcPayload(vfsBundle, vfsState.bundle);
         const stageSpec = {
@@ -4448,8 +5020,6 @@ export class FacetManager {
             cwd: opts.cwd,
             stdin: opts.stdin ?? '',
             vfsBundle,
-            vfsManifest: JSON.stringify(vfsState.manifest),
-            vfsMetadata: JSON.stringify(vfsState.metadata),
             vfsCursor: serializeFacetVfsCursor(vfsState.cursor),
         };
         return { pid, command, stageSpec };
@@ -4617,7 +5187,8 @@ export class FacetManager {
             // The handle's route target resolves the RUNNING facet wherever it is
             // hosted; binding it for the pid before the port is announced is what
             // lets the shim's listen()→SUPERVISOR.registerPort back-fill.
-            this.portRegistry.bindFacetStub(pid, handle.routeTarget);
+            // The opencode runner dispatches through node-shims' __nimbusServeHttp, which strips the ACQUIRE.
+            this.portRegistry.bindFacetStub(pid, handle.routeTarget, { deliversAcquire: true });
             this.trackProcessRpcResources(pid, [handle], { releaseOnReportExit: false });
             resourcesTracked = true;
             this.ctx.waitUntil(handle.done
@@ -4755,10 +5326,6 @@ export class FacetManager {
             await Promise.allSettled([...this.launchTasks]);
         await Promise.all(this.rowAmendments.values());
     }
-    /** Whether any launch is suspended waiting for a turn. */
-    get hasPendingLaunchTurns() {
-        return this.launchPump.hasPending;
-    }
     /** Allocate a free loopback port for a resident server facet (from 4096 up). */
     _allocateLoopbackPort() {
         for (let port = 4096; port < 4096 + 4096; port++) {
@@ -5145,7 +5712,14 @@ export class FacetManager {
     async _residentLaunchBody(entry, code, command, cwd, opts, pacer, durableFacetName, launchEnv) {
         const diagOn = isExecDiagEnabled();
         const __bundleStart = diagOn ? Date.now() : 0;
+        if (this.debugEnabled)
+            this.processes.appendOutput(entry.pid, 'stderr', '[nimbus-debug] launch: building the module map\n');
         const vfsState = await this._buildProcessBundle(entry, { scriptPath: opts.filename, cwd, entryCode: code, bundleProfile: opts.bundleProfile }, pacer);
+        const planStart = Date.now();
+        const { paths: dataPlan, storageBytes } = await this._planResidentData(entry, vfsState, cwd, opts.env?.HOME, pacer);
+        if (this.debugEnabled) {
+            this.processes.appendOutput(entry.pid, 'stderr', `[nimbus-debug] data plan: ${dataPlan.length} paths in ${Date.now() - planStart} ms (${pacer.chunks} turns so far)\n`);
+        }
         const bundleMs = diagOn ? Date.now() - __bundleStart : 0;
         // The launch-time overlay (`$PORT`, `$NIMBUS_APP` under a reservation)
         // rides on top of the recipe's env and is never journalled: it is
@@ -5166,13 +5740,13 @@ export class FacetManager {
             : spawnEnv;
         // Answered by _buildProcessBundle while the raw cells were still in hand.
         const usesSqlite = vfsState.usesNodeSqlite ?? bundleUsesNodeSqlite(code, vfsState.bundle);
-        const [sqliteModules, shims] = await Promise.all([
+        const [sqliteModules, sources] = await Promise.all([
             this.sqliteModuleEntry(usesSqlite),
-            fetchNodeShimsCode(this.env),
+            fetchNodeFacetSources(this.env),
         ]);
         // Each image is read by path when the facet loads, never by value here.
         const wasmImports = facetWasmImports([], vfsState.wasmImages ?? []);
-        let generatedWorker = await generateLongRunningNodeCode(code, vfsState, { ...opts, env: processEnv, cred: entry.cred, wasmImports }, usesSqlite, shims, pacer);
+        let generatedWorker = await generateLongRunningNodeCode(await this._entryDynamicImports(code, opts.filename, cwd), vfsState, { ...opts, env: processEnv, cred: entry.cred, wasmImports }, usesSqlite, sources, pacer);
         // Sized here, while the map is still in hand. Reading these after the load
         // would itself be what keeps the map alive, and the whole point of the
         // scoping below is that nothing does.
@@ -5184,10 +5758,13 @@ export class FacetManager {
             }
             moduleMapBytes = _encodedSourceBytes(generatedWorker.code) + bundleBytes;
         }
-        const manifestBytes = diagOn ? _encodedSourceBytes(vfsState.serializedManifest ?? '') : 0;
-        const metadataBytes = diagOn ? _encodedSourceBytes(vfsState.serializedMetadata ?? '') : 0;
         const cacheHit = vfsState.cacheHit ?? false;
         const vfsCursor = vfsState.cursor;
+        if (vfsState.bundleKey)
+            this.residentBundleKeys.set(entry.pid, vfsState.bundleKey);
+        const profileOffer = vfsState.profileOffer;
+        if (profileOffer !== undefined)
+            this.residentProfileOffers.set(entry.pid, profileOffer);
         // The map is generated; the state's only remaining job is its cursor.
         // Released here, before the boot — releasing afterwards keeps the copy
         // alive for exactly the window that was resetting the isolate. A state
@@ -5209,6 +5786,8 @@ export class FacetManager {
             };
             generatedWorker = undefined;
             const vfsTextModules = await this.imageStore.materialize(entry.pid, drainSources(sources), pacer);
+            if (this.debugEnabled)
+                this.processes.appendOutput(entry.pid, 'stderr', '[nimbus-debug] launch: images stored, starting the facet\n');
             // Last gate before the facet exists. A launch now spans many turns, so
             // a kill can land anywhere inside it; booting a process the table has
             // already exited would leave a facet nothing owns, running against a
@@ -5218,7 +5797,12 @@ export class FacetManager {
                 // The attached-TTY runner holds startProcess open for the process's
                 // life; the server/watch runner returns once it is up.
                 startContract: opts.attachedTty ? 'lifetime' : 'boot',
-                startArgs: { vfsCursor },
+                startArgs: {
+                    vfsCursor, dataPlan,
+                    ...(profileOffer !== undefined && profileOffer.staged.length > 0 ? { profileStaged: profileOffer.staged.map((e) => e.path) } : {}),
+                    ...(this.debugEnabled ? { diag: true } : {}),
+                },
+                storageBytes,
                 // A resident whose declared port is reserved binds the owner's
                 // durable slot — the same store a durable worker spawn takes — so the
                 // reservation's durability reaches this process's storage too.
@@ -5238,6 +5822,11 @@ export class FacetManager {
                     },
                 },
             });
+            // Ended while its facet was being created (a signal's default action).
+            if (this.processes.get(entry.pid)?.state !== 'running') {
+                handle.kill();
+                return;
+            }
             if (diagOn) {
                 recordExecTelemetry({
                     command,
@@ -5254,8 +5843,7 @@ export class FacetManager {
                     // when it stayed inline it rides inside worker.js and shows up only
                     // in the total.
                     bundleBytes,
-                    manifestBytes,
-                    metadataBytes,
+                    namespaceRefusals: 0,
                     rpcWrites: 0,
                     fsRpcReads: 0,
                     cacheHit,
@@ -5266,7 +5854,8 @@ export class FacetManager {
             }
             this.trackProcessRpcResources(entry.pid, [handle], { releaseOnReportExit: !opts.attachedTty });
             resourcesTracked = true;
-            this.portRegistry.bindFacetStub(entry.pid, handle.routeTarget);
+            // A node-shims resident: its __nimbusServeHttp takes the delivered ACQUIRE off each request.
+            this.portRegistry.bindFacetStub(entry.pid, handle.routeTarget, { deliversAcquire: true });
             if (opts.attachedTty) {
                 this.ctx.waitUntil(handle.done
                     .catch((e) => {
@@ -5385,6 +5974,7 @@ export class FacetManager {
         let record;
         let durableFacetName;
         let launchEnv;
+        const foreground = opts.foreground ? this._holdForeground(entry.pid, opts.foreground) : null;
         try {
             if (opts.durable) {
                 // A durable spawn on a declared port starts only when a reservation the
@@ -5502,7 +6092,7 @@ export class FacetManager {
             this.trackProcessRpcResources(entry.pid, [handle]);
             resourcesTracked = true;
             this.portRegistry.bindFacetStub(entry.pid, handle.routeTarget);
-            const boot = await handle.booted();
+            const boot = foreground ? await Promise.race([handle.booted(), foreground.interrupted]) : await handle.booted();
             if (record && this.launchJournal.has(entry.pid)) {
                 // Booted and running: the launch proved itself, so the resident
                 // starts its running life with a fresh re-drive budget.
@@ -5545,9 +6135,38 @@ export class FacetManager {
                 this.releaseProcessRpcResources(entry.pid);
             else
                 handle?.kill();
-            this._failLaunch(entry.pid, 'long-running worker boot failed: ' + errorMessage(e));
+            // An interrupt already killed the process; it did not fail.
+            if (!opts.foreground?.signal.aborted)
+                this._failLaunch(entry.pid, 'long-running worker boot failed: ' + errorMessage(e));
             throw e;
         }
+        finally {
+            foreground?.release();
+        }
+    }
+    _holdForeground(pid, launch) {
+        this.processes.setForeground(pid, true);
+        const unsubscribe = this.processes.subscribeLogs(pid, (chunk) => launch.write(chunk.stream, chunk.data));
+        let onAbort = () => { };
+        const interrupted = new Promise((_, reject) => {
+            onAbort = () => {
+                this.kill(pid);
+                reject(new DOMException('the launching command was interrupted', 'AbortError'));
+            };
+        });
+        interrupted.catch(() => { });
+        if (launch.signal.aborted)
+            onAbort();
+        else
+            launch.signal.addEventListener('abort', onAbort, { once: true });
+        return {
+            interrupted,
+            release: () => {
+                launch.signal.removeEventListener('abort', onAbort);
+                unsubscribe();
+                this.processes.setForeground(pid, false);
+            },
+        };
     }
     /**
      * A resident process announcing it bound `port`.
@@ -5788,18 +6407,23 @@ export class FacetManager {
             catch { }
         }
     }
-    /** Kill a running process by PID. */
-    kill(pid) {
+    /**
+     * Kill a running process by PID. Given the signal that ends it (a name
+     * without `SIG`), it exits with that signal's status, 128+signo, and its
+     * exit names `SIG<name>`; without one it is SIGKILL's 137, `killed`.
+     */
+    kill(pid, signal) {
         const entry = this.processes.get(pid);
         if (!entry || entry.state !== 'running')
             return false;
+        const code = signal === undefined ? 137 : exitCodeForSignal(signal);
         this.portRegistry.unregisterByPid(pid);
         this.releaseProcessRpcResources(pid);
         this.revokeProcessVfsWriters(pid);
-        const result = this.processes.kill(pid);
+        const result = this.processes.kill(pid, code);
         if (result) {
             try {
-                this.hooks.onExternalExit?.(pid, 137, 'killed');
+                this.hooks.onExternalExit?.(pid, code, signal === undefined ? 'killed' : `SIG${signal}`);
             }
             catch { }
         }
@@ -5959,5 +6583,5 @@ export class FacetManager {
         }
         return this.portRegistry.has(port);
     }
-    get stats() { return this.processes.stats; }
+    get stats() { return { ...this.processes.stats, readProfileConflicts: this.readProfileConflicts }; }
 }