@ogygia/devtools 0.11.4 → 0.13.0

package/dist/profiler/index.js

@@ -6,9 +6,9 @@ import { is_ogp, ogp_decode, ogp_encode, recover_ogp_bytes } from "./crypto.js";
 import { AFTER_LOGIN_PARAM, SESSION_COOKIE, describe_cookie_diagnosis, raw_cookie_values, session_cookie_values } from "./session-cookie.js";
 import { label_call, load_lane_of, phase_of_frame } from "./timeline.js";
 import { merge_visits, parse_visit } from "./visit.js";
-import { own_requests } from "./own-requests.js";
 import { MAX_VISITS_PER_KEY } from "./storage/visits.js";
 import { hole_slots } from "./hole-slots.js";
+import { own_requests } from "./own-requests.js";
 import { client_windows, interaction_windows } from "./client-windows.js";
 import { byte_strip } from "./byte-strip.js";
 import { stream_tail } from "./stream-tail.js";
@@ -22,6 +22,7 @@ import { build_lineage, data_prop_names, data_reads, whole_read_line } from "./l
 import { build_ledger, pkg_of } from "./ledger.js";
 import { at_line, build_drill, call_group, tag_fills } from "./drill.js";
 import { forecast_of } from "./forecast.js";
+import { OgygiaError, warn } from "../messages/runtime.js";
 import { site_fixes } from "./site-fixes.js";
 import { may_be_chunk, module_category, module_lookup } from "./module-map.js";
 import { embedded_chunk, embedded_files, embedded_map_of, embedded_source, load_embedded_maps } from "./embedded-maps.js";
@@ -35,12 +36,14 @@ import { gzip_large } from "./compress.js";
 import { io_kind, mark_left_each_run } from "./async-io.js";
 import { set_span_recorder } from "./span.js";
 import { register_profiler_file } from "./frames.js";
+import { devtools_app } from "../app.js";
 import { app_asset_rel, client_dir_candidates, client_file_finder } from "./client-files.js";
 import { build_profiler_router } from "./profiler-router.js";
 import { detect_dev } from "./env.js";
 import { refresh_target } from "./refresh-stub.js";
 import { assets_diff, engine_of, hydration_hazards, vital_parts, weigh_assets } from "@ogygia/core/insights";
-import { hole_stats_of, mark_personal, request_stats_of, set_batch_hole_listener, set_request_stats_detail } from "@ogygia/core/internal/server";
+import { STALE, flights, lock, machine, outbox, policy, scope } from "@ogygia/machine";
+import { current_request_scope, hold_request_stats_detail, hole_stats_of, mark_personal, request_scope, request_stats_of, set_batch_hole_listener } from "@ogygia/core/internal/server";
 import { fnv1a32 } from "@ogygia/core/plugin/utils";
 import { chunkBarrels, chunkContents, chunkDuplicates, chunkHeavy, islandHazards, islandPageKeys, islandPageWhy } from "virtual:ogygia/island-deps";
 import { error, isHttpError, isRedirect } from "@ogygia/router";
@@ -84,6 +87,22 @@ async function read_timed(res, t0) {
 		chunks
 	};
 }
+/** How a sink post is tried again: a sink restarting is ridden out, and a sink that is down costs
+*  each post 30 s at most, so the posts after it are not held long. */
+const SINK_POLICY = /* @__PURE__ */ policy({
+	attempts: 4,
+	backoff: [
+		1e3,
+		5e3,
+		1e4
+	],
+	jitter: .2,
+	deadline: 3e4
+});
+/** The longest one try at a post waits for the sink's answer. */
+const SINK_TRY_MS = 5e3;
+const error_text = (error) => error instanceof Error ? error.message : String(error);
+const noop = () => {};
 register_profiler_file();
 const MAX_VITALS_PATHS = 200;
 const MAX_VITALS_SAMPLES = 30;
@@ -226,36 +245,52 @@ function is_hex_id(s) {
 	}
 	return true;
 }
+/** A status that says the file is not there for good: a client error, but not a timeout or a
+*  rate limit (408, 429), which say "not now". */
+const gone_for_good = (status) => status >= 400 && status < 500 && status !== 408 && status !== 429;
+/** The process's URL weights: an answer (bytes, or a file that is not there) is kept; a failure
+*  (a 5xx, a timeout, the network) is not, so the next report asks again. Reports weighing the
+*  same file at once share one fetch. */
+const url_weights = () => flights.keyed()({
+	name: "profiler url weights",
+	key: ["url"],
+	ignore: { fetch_url: "every report fetches the same hashed file through the app" },
+	run: async ({ url, fetch_url }, signal) => {
+		const res = await fetch_url(url, signal);
+		if (!res.ok) {
+			res.body?.cancel().catch(noop);
+			if (gone_for_good(res.status)) return null;
+			throw new Error(`status ${res.status}`);
+		}
+		const len = Number(res.headers.get("content-length"));
+		if (!res.headers.get("content-encoding") && Number.isFinite(len) && len > 0) {
+			res.body?.cancel().catch(noop);
+			return len;
+		}
+		return (await res.arrayBuffer()).byteLength;
+	}
+});
 /** GET each URL through the app's own fetch and count its bytes — the JS weight of an island's
-*  closure. Cached per process (immutable hashed assets), a handful at a time, capped in time so
-*  a slow static host can never hold a report hostage. */
-async function weigh_urls(urls, fetch_url, cache, budget_ms = 4e3) {
-	const todo = [...new Set(urls)].filter((u) => u && !cache.has(u));
-	const deadline = Date.now() + budget_ms;
+*  closure. Kept per process (`url_weights`), a handful at a time, capped in time so a slow static
+*  host can never hold a report hostage: a URL not weighed within the budget is left out. */
+async function weigh_urls(urls, fetch_url, weights, budget_ms = 4e3) {
+	const todo = [...new Set(urls)].filter((u) => u);
+	const budget = AbortSignal.timeout(budget_ms);
+	const out = {};
 	let i = 0;
 	const worker = async () => {
-		while (i < todo.length && Date.now() < deadline) {
-			const u = todo[i++];
+		while (i < todo.length && !budget.aborted) {
+			const url = todo[i++];
 			try {
-				const res = await with_timeout(fetch_url(u), Math.max(200, deadline - Date.now()), "weigh");
-				if (!res.ok) {
-					cache.set(u, null);
-					continue;
-				}
-				const len = Number(res.headers.get("content-length"));
-				const bytes = !res.headers.get("content-encoding") && Number.isFinite(len) && len > 0 ? len : (await res.arrayBuffer()).byteLength;
-				cache.set(u, bytes);
-			} catch {
-				cache.set(u, null);
-			}
+				const bytes = await weights.get({
+					url,
+					fetch_url
+				}, { signal: budget });
+				if (typeof bytes === "number") out[url] = bytes;
+			} catch {}
 		}
 	};
 	await Promise.all(Array.from({ length: Math.min(6, todo.length) }, worker));
-	const out = {};
-	for (const u of new Set(urls)) {
-		const b = cache.get(u);
-		if (typeof b === "number") out[u] = b;
-	}
 	return out;
 }
 const percentile = (sorted, p) => sorted[Math.min(sorted.length - 1, Math.floor(sorted.length * p))] ?? 0;
@@ -282,6 +317,62 @@ function summarize_measures(entries) {
 const MAX_SPANS_PER_REQUEST = 2e3;
 const MAX_WINDOW_SPANS = 2e4;
 const MAX_TAGS = 16;
+/** The span recorder one recording window installs (`span()` / `tag()` from ogygia/profiler): every
+*  span the window sees, nested through the request's async context, or through the window's own
+*  store where no request is attributed. */
+var WindowSpans = class {
+	/** every span recorded during the window, any request */
+	spans = [];
+	#seq = 0;
+	#als;
+	#span_als;
+	#netmod;
+	constructor(als, span_als, netmod) {
+		this.#als = als;
+		this.#span_als = span_als;
+		this.#netmod = netmod;
+	}
+	begin(name, attrs) {
+		const ctx = this.#als?.getStore();
+		const parent = ctx?.span ?? this.#span_als.getStore();
+		const rec = {
+			id: ++this.#seq,
+			name: String(name).slice(0, 120),
+			start: performance.now(),
+			ms: -1,
+			...attrs ? { attrs: { ...attrs } } : {},
+			...parent !== void 0 ? { parent } : {},
+			caller_site: this.#netmod?.nearest_app_site(),
+			route: ctx?.route ?? null,
+			path: ctx?.path ?? null
+		};
+		if (this.spans.length < MAX_WINDOW_SPANS) this.spans.push(rec);
+		if (ctx && ctx.spans.length < MAX_SPANS_PER_REQUEST) ctx.spans.push(rec);
+		return rec;
+	}
+	within(s, fn) {
+		const als = this.#als;
+		const ctx = als?.getStore();
+		return ctx && als ? als.run({
+			...ctx,
+			span: s.id
+		}, fn) : this.#span_als.run(s.id, fn);
+	}
+	end(s, attrs, error) {
+		s.ms = round2(performance.now() - s.start);
+		if (attrs) s.attrs = {
+			...s.attrs,
+			...attrs
+		};
+		if (error !== void 0) s.error = error instanceof Error ? error.message : String(error);
+	}
+	tag(key, value) {
+		const ctx = this.#als?.getStore();
+		if (!ctx) return;
+		const tags = ctx.entry.tags ??= {};
+		if (key in tags || Object.keys(tags).length < MAX_TAGS) tags[key] = value;
+	}
+};
 /** the process's live profiler (the newest): an older one's background timers stand down */
 const LIVE_PROFILER = Symbol.for("ogygia.profiler.live");
 const MAX_NET_PER_REQUEST = 100;
@@ -290,6 +381,102 @@ const MAX_BACKGROUND_NET = 300;
 const RECORDING_MAX_MS = 35e3;
 const RECORDING_HARD_CAP_MS = 3e4;
 const PER_RENDER_TIMEOUT_MS = 15e3;
+/**
+* What the recorder's owner records (the process's one inspector and attribution context). Its
+* lock says who owns it; this says how: `background` (the trap, the sampler, a started window: a
+* request is matched to it by time, and runs in no request context) or `recording` (a page profile
+* or a header-profiled request: every request is attributed). A recording still running past the
+* hard cap is `cut`: it keeps the inspector until it ends, but the site stops paying for its
+* attribution context.
+*/
+const recorder_machine = machine()({
+	name: "profiler-recorder",
+	initial: "free",
+	steps: {
+		free: ["background", "recording"],
+		background: ["free"],
+		recording: ["free", "cut"],
+		cut: ["free"]
+	},
+	after: { recording: {
+		ms: 32e3,
+		to: "cut",
+		data: (s) => ({
+			token: s.token,
+			since: s.since
+		})
+	} }
+});
+/**
+* A window you start and stop. `recording` lasts at most WINDOW_MAX_MS (a stop that never comes);
+* leaving it, however, ends the capture's work. `stopping` makes the report, and holds the
+* recorder until it is made.
+*/
+const window_machine = machine()({
+	name: "profiler-window",
+	initial: "idle",
+	steps: {
+		idle: ["recording"],
+		recording: ["stopping", "idle"],
+		stopping: ["idle"]
+	},
+	after: { recording: {
+		ms: WINDOW_MAX_MS,
+		to: "idle"
+	} }
+});
+/**
+* One background loop (the trap, the always-on sampler): waiting for its next window (the visit
+* owns the timer), taking one, or ended. `caught` is what it kept so far (the trap's slow requests;
+* the sampler keeps none). It ends `done` (the trap kept all it was asked to), `refused` (a window
+* failed: the inspector refused it), or `retired` (a newer profiler took the process over).
+*/
+const loop_machine = machine()({
+	name: "profiler-background-loop",
+	initial: "idle",
+	steps: {
+		idle: ["scheduled", "retired"],
+		scheduled: [
+			"scheduled",
+			"capturing",
+			"retired"
+		],
+		capturing: [
+			"scheduled",
+			"done",
+			"refused",
+			"retired"
+		],
+		done: ["retired"],
+		refused: ["retired"],
+		retired: []
+	}
+});
+const caught_of = (loop) => {
+	const s = loop.now;
+	return s.kind === "idle" ? 0 : s.caught;
+};
+/** The trap as the dashboard shows it: waiting for or taking a window, stopped by a refusal, or
+*  not running (done, or not armed yet). */
+function trap_state(loop) {
+	const kind = loop.now.kind;
+	if (kind === "scheduled" || kind === "capturing") return "armed";
+	return kind === "refused" ? "stopped" : "done";
+}
+/** The span recorders of the windows recording now, newest last. Spans go to the newest; a window
+*  that ends hands them back to the one before it, never to nothing while another still records
+*  (two profilers in one dev process). */
+const span_windows = [];
+function own_spans(r) {
+	span_windows.push(r);
+	set_span_recorder(r);
+}
+function disown_spans(r) {
+	const at = span_windows.lastIndexOf(r);
+	if (at === -1) return;
+	span_windows.splice(at, 1);
+	set_span_recorder(span_windows.length > 0 ? span_windows[span_windows.length - 1] : null);
+}
 /** the heap's fill (of its limit) past which no timed render is made: one more could end the process */
 const HEAP_STOP = .85;
 /** …and past which the extra renders (what a render keeps, the growth check) are skipped */
@@ -426,36 +613,64 @@ var Profiler = class {
 	#sink_url = null;
 	#sink_key = null;
 	#sink_every = 1e4;
+	/** The background work's owner (the sink's timer, the trap's and the sampler's, their windows):
+	*  closed when a newer profiler takes the process over (`#retire`). */
+	#background = scope();
+	/** The sink's timer, while it runs: its cancel. */
 	#sink_timer = null;
-	#sink_inflight = false;
+	/** The sink's posts, one at a time in the order their rows were read: a failed one is tried
+	*  again before the next goes, so rows reach the sink in order and only once (#293). */
+	#sink_posts = outbox({
+		name: "profiler sink",
+		send: (post, signal) => this.#sink_post(post, signal),
+		id: (post) => post.id,
+		retry: SINK_POLICY,
+		inOrder: true,
+		giveUp: (post, error) => {
+			this.#sink_last = {
+				at: Date.now(),
+				ok: false,
+				rows: post.rows,
+				error: error_text(error)
+			};
+			warn("devtools_profiler_sink_undelivered", { rows: String(post.rows) }, error);
+		},
+		waitUntil: (work) => devtools_app()?.keepAlive(work)
+	});
 	#sink_last = null;
-	#trap_caught = 0;
-	#trap_running = false;
-	#trap_timer = null;
+	/** the trap's loop (see `loop_machine`) */
+	#trap_loop = loop_machine.create();
 	#sample;
 	#sampled = [];
-	#sample_timer = null;
+	/** the always-on sampler's loop */
+	#sample_loop = loop_machine.create();
+	/** why the background loops are off on this host (serverless), when they are */
 	#background_note = null;
 	/** bytes per asset URL, measured once per process */
-	#weights = /* @__PURE__ */ new Map();
+	#weights = url_weights();
 	/** every page asset weighed so far (hashed assets never change): page-assets.ts */
 	#asset_weights = /* @__PURE__ */ new Map();
 	#background_net = [];
-	#window_net = null;
+	/** each capture's own network log while it records (two only after a reset left one running) */
+	#window_nets = /* @__PURE__ */ new Set();
 	#inflight = 0;
-	#recording_since = 0;
 	/** performance.now() when this instance's first request arrived (its cold start, on Lambda) */
 	#first_request_pt;
 	/** requests this instance has handled */
 	#requests_seen = 0;
-	#recorder_busy = false;
+	#recorder = lock();
+	/** what the owner records, and since when (see `recorder_machine`) */
+	#holder = recorder_machine.create();
+	/** the window you start and stop (see `window_machine`) */
+	#win = window_machine.create();
 	/** page profiles waiting for a background window to give the recorder back */
 	#page_waiting = 0;
 	/** the durable report store (SQLite/Redis/Postgres/custom), when configured — else null and the
 	*  in-memory map is all there is (the prior behaviour) */
 	#store = null;
+	/** the store's `init`: kept once it succeeds, tried again by the next use after a failure */
+	#store_init = null;
 	#als = null;
-	#init_done = null;
 	/** Re-assert the `globalThis.fetch` patch before a profile (self-heal if it was replaced). */
 	#ensure_net = null;
 	/** wraps Kit's `event.fetch` (in-process same-origin dispatch) with the recorder, per attributed request */
@@ -479,21 +694,22 @@ var Profiler = class {
 		this.#disabled = options.enabled === false;
 		this.#trap = options.trap && options.trap.over > 0 ? options.trap : null;
 		if (options.store) {
-			this.#store = options.store;
-			(async () => this.#store.init?.())().catch((e) => {
-				console.error("[ogygia/profiler] store init failed; falling back to in-memory:", e);
-				this.#store = null;
+			const store = options.store;
+			this.#store = store;
+			this.#store_init = flights({
+				name: "profiler store init",
+				run: async () => {
+					await store.init?.();
+				}
 			});
+			this.#store_ready();
 		}
 		this.#client_cpu = options.clientCpu !== false;
 		if (options.sink?.url) {
 			this.#sink_url = options.sink.url;
 			this.#sink_key = options.sink.key ?? this.secret ?? null;
 			this.#sink_every = Math.max(1e3, options.sink.every ?? 1e4);
-			if (!Number.isFinite(serverless_work_budget_ms())) {
-				this.#sink_timer = setInterval(() => void this.#sink_flush(), this.#sink_every);
-				this.#sink_timer.unref?.();
-			}
+			if (!Number.isFinite(serverless_work_budget_ms())) this.#sink_timer = this.#background.every(() => void this.#sink_flush(), this.#sink_every);
 		}
 		this.#sample = options.sample ? options.sample : null;
 		globalThis[LIVE_PROFILER] = this;
@@ -531,15 +747,19 @@ var Profiler = class {
 	}
 	/** Stand down: the background timers stop (a sink sends what it holds first). */
 	#retire() {
-		if (this.#trap_timer) clearTimeout(this.#trap_timer);
-		if (this.#sample_timer) clearTimeout(this.#sample_timer);
-		this.#trap_timer = null;
-		this.#sample_timer = null;
-		if (this.#sink_timer) {
-			clearInterval(this.#sink_timer);
-			this.#sink_timer = null;
-			this.#sink_flush();
-		}
+		const sinking = this.#sink_timer !== null;
+		this.#sink_timer = null;
+		for (const loop of [this.#trap_loop, this.#sample_loop]) if (loop.now.kind !== "retired") loop.go("retired", { caught: caught_of(loop) });
+		this.#background.close();
+		if (sinking) this.#sink_flush();
+	}
+	/** A background window's length: `ms`, or less when the profiler stands down meanwhile. */
+	#pause(ms) {
+		return new Promise((done) => {
+			const wait = this.#background.child();
+			wait.defer(done);
+			wait.timeout(() => wait.close(), ms);
+		});
 	}
 	/** Arm the background recorders (once, from the first request). Both need a real server: on a
 	*  serverless host an instance lives for one request and the inspector is often unavailable. */
@@ -549,32 +769,52 @@ var Profiler = class {
 			this.#background_note = "trap / sampling are off on this serverless host (an instance lives for one request).";
 			return;
 		}
-		if (this.#trap && !this.#trap_timer) this.#schedule_trap(1e3);
-		if (this.#sample && !this.#sample_timer) this.#schedule_sample((this.#sample.every ?? 60) * 1e3);
+		if (this.#trap && this.#trap_loop.now.kind === "idle") this.#schedule(this.#trap_loop, () => this.#trap_cycle(), 1e3);
+		if (this.#sample && this.#sample_loop.now.kind === "idle") this.#schedule(this.#sample_loop, () => this.#sample_cycle(), (this.#sample.every ?? 60) * 1e3);
 	}
-	#schedule_trap(delay_ms) {
-		this.#trap_timer = setTimeout(() => void this.#trap_cycle(), delay_ms);
-		this.#trap_timer.unref?.();
+	/** The loop's next window, `delay_ms` from now: a timer of that wait's own visit. */
+	#schedule(loop, cycle, delay_ms) {
+		const s = loop.now;
+		if (s.kind !== "idle" && s.kind !== "scheduled" && s.kind !== "capturing") return;
+		loop.go("scheduled", { caught: caught_of(loop) });
+		loop.scope.timeout(() => void cycle(), delay_ms);
 	}
-	#schedule_sample(delay_ms) {
-		this.#sample_timer = setTimeout(() => void this.#sample_cycle(), delay_ms);
-		this.#sample_timer.unref?.();
+	/** A window failed: the loop stops, and says why (on the dashboard, and once as a message). */
+	#refused(loop, name, caught, error) {
+		if (!loop.move("capturing", "refused", {
+			caught,
+			error: error_text(error)
+		})) return;
+		warn("devtools_profiler_background_stopped", { loop: name }, error);
+	}
+	/** The background loops that stopped, and why the loops are off, when they are: one note. */
+	#background_notes() {
+		const notes = [];
+		if (this.#background_note !== null) notes.push(this.#background_note);
+		const t = this.#trap_loop.now;
+		if (t.kind === "refused") notes.push(`the trap stopped: ${t.error}.`);
+		const s = this.#sample_loop.now;
+		if (s.kind === "refused") notes.push(`always-on sampling stopped: ${s.error}.`);
+		return notes.length === 0 ? null : notes.join(" ");
 	}
 	/** One rolling trap window: sample coarsely, then keep the window only if a request in it blew
 	*  past the threshold. The slowest such request is the report's request; the timeline is its. */
 	async #trap_cycle() {
 		const t = this.#trap;
-		this.#trap_timer = null;
+		const loop = this.#trap_loop;
+		const s = loop.now;
+		if (s.kind !== "scheduled") return;
 		if (this.#superseded()) return this.#retire();
 		const keep = t.keep ?? 3;
-		if (this.#trap_caught >= keep) return;
-		if (this.#page_waiting) return this.#schedule_trap(1e3);
-		if (!this.#try_acquire_recorder()) return this.#schedule_trap(2e3);
-		this.#trap_running = true;
-		this.#recording_since = Date.now();
+		const again = (ms) => this.#schedule(loop, () => this.#trap_cycle(), ms);
+		if (this.#page_waiting) return again(1e3);
+		const token = this.#take("background");
+		if (token === null) return again(2e3);
+		loop.go("capturing", { caught: s.caught });
+		let caught = s.caught;
 		try {
 			const window_ms = t.window ?? 5e3;
-			const cap = await this.#capture_window((t.interval ?? 10) * 1e3, () => new Promise((r) => setTimeout(r, window_ms)), { light: true });
+			const cap = await this.#capture_window((t.interval ?? 10) * 1e3, () => this.#pause(window_ms), { light: true });
 			const slow = this.#ring.filter((e) => !e.internal && e.pt !== void 0 && e.ts >= cap.t0 && e.ts + e.ms <= cap.t1 && e.ms >= t.over).sort((x, y) => y.ms - x.ms)[0];
 			if (slow) {
 				cap.window = {
@@ -607,31 +847,31 @@ var Profiler = class {
 					});
 					this.#sink_flush();
 				}
-				this.#trap_caught++;
+				caught++;
 			}
-		} catch {
-			this.#trap_caught = keep;
+		} catch (error) {
+			return this.#refused(loop, "trap", caught, error);
 		} finally {
-			this.#trap_running = false;
-			this.#recording_since = 0;
-			this.#release_als();
-			this.#release_recorder();
+			this.#free(token);
 		}
-		if (this.#trap_caught < keep) this.#schedule_trap(1e3);
+		if (caught >= keep) loop.move("capturing", "done", { caught });
+		else again(1e3);
 	}
 	/** One always-on sample: a short coarse window folded into the rolling hot-functions table. */
 	async #sample_cycle() {
 		const s = this.#sample;
-		this.#sample_timer = null;
+		const loop = this.#sample_loop;
+		if (loop.now.kind !== "scheduled") return;
 		if (this.#superseded()) return this.#retire();
 		const every_ms = (s.every ?? 60) * 1e3;
-		if (this.#page_waiting) return this.#schedule_sample(Math.min(every_ms, 2e3));
-		if (!this.#try_acquire_recorder()) return this.#schedule_sample(Math.min(every_ms, 5e3));
-		this.#trap_running = true;
-		this.#recording_since = Date.now();
+		const again = (ms) => this.#schedule(loop, () => this.#sample_cycle(), ms);
+		if (this.#page_waiting) return again(Math.min(every_ms, 2e3));
+		const token = this.#take("background");
+		if (token === null) return again(Math.min(every_ms, 5e3));
+		loop.go("capturing", { caught: 0 });
 		try {
 			const window_ms = s.window ?? 2e3;
-			const cap = await this.#capture_window((s.interval ?? 10) * 1e3, () => new Promise((r) => setTimeout(r, window_ms)), { light: true });
+			const cap = await this.#capture_window((s.interval ?? 10) * 1e3, () => this.#pause(window_ms), { light: true });
 			const resolver = await this.#make_resolver();
 			const a = analyze(cap.profile, resolver, void 0, void 0, void 0, this.#module_hint);
 			this.#sampled.push({
@@ -663,15 +903,12 @@ var Profiler = class {
 					}))
 				});
 			}
-		} catch {
-			return;
+		} catch (error) {
+			return this.#refused(loop, "always-on sampler", 0, error);
 		} finally {
-			this.#trap_running = false;
-			this.#recording_since = 0;
-			this.#release_als();
-			this.#release_recorder();
+			this.#free(token);
 		}
-		this.#schedule_sample(every_ms);
+		again(every_ms);
 	}
 	/** The always-on table: every kept window folded, hot functions by summed self time. */
 	#sampled_summary() {
@@ -704,10 +941,10 @@ var Profiler = class {
 		};
 	}
 	#collect_window(call) {
-		if (this.#window_net && this.#window_net.length < MAX_WINDOW_NET) this.#window_net.push(call);
+		for (const net of this.#window_nets) if (net.length < MAX_WINDOW_NET) net.push(call);
 	}
 	/** An attributed request's context: its own calls (capped), each also offered to the window. */
-	#request_ctx(entry) {
+	#request_ctx(entry, owner) {
 		const collect_window = (call) => this.#collect_window(call);
 		return {
 			entry,
@@ -715,6 +952,7 @@ var Profiler = class {
 			spans: [],
 			route: entry.route,
 			path: entry.path,
+			owner,
 			on_net(call) {
 				if (this.net.length < MAX_NET_PER_REQUEST) this.net.push(call);
 				collect_window(call);
@@ -722,7 +960,12 @@ var Profiler = class {
 		};
 	}
 	#init() {
-		return this.#init_done ??= (async () => {
+		return this.#init_done.get();
+	}
+	/** The mount's one-time setup: the background timers and the network capture (it never fails). */
+	#init_done = flights({
+		name: "profiler init",
+		run: async () => {
 			this.#arm_background();
 			if (!this.want_network) return;
 			try {
@@ -747,29 +990,69 @@ var Profiler = class {
 				});
 				this.#ensure_net = ensure_fetch_patched;
 			} catch {}
-		})();
-	}
+		}
+	});
 	/** A recording is "active" only if one started recently — a run abandoned by a frozen/killed
 	*  serverless invocation ages out after the cap instead of wedging the profiler forever. */
 	#recording_active() {
-		return this.#recording_since > 0 && Date.now() - this.#recording_since < RECORDING_MAX_MS;
+		const s = this.#holder.now;
+		return s.kind === "recording" && Date.now() - s.since < RECORDING_MAX_MS;
 	}
-	/** Take the recorder slot without waiting: true if it was free (now ours), false if busy. Recordings
+	/** Take the recorder without waiting: its token if it was free (now ours), null if busy. Recordings
 	*  serialize PER WORKER — one V8 inspector CPU/heap sampler + one attribution context per process — so
 	*  a second recording on the same process is refused, NOT queued in memory: on serverless the process
 	*  can be recycled at any moment (Amplify freezes a worker after ~30 s), so a waiter parked in memory
 	*  is unreliable, and it isn't needed — a retry lands on a different, free worker. The "queue" is the
-	*  CLIENT polling `/page` until a worker says yes (see RunView). */
-	#try_acquire_recorder() {
-		if (this.#recorder_busy) return false;
-		this.#recorder_busy = true;
-		return true;
+	*  CLIENT polling `/page` until a worker says yes (see RunView). A recording that runs past the hard
+	*  cap is cut (its own time, `recorder_machine`): the site stops paying for its context. */
+	#take(kind) {
+		const token = this.#recorder.take();
+		if (token === null) return null;
+		this.#holder.go(kind, {
+			token,
+			since: Date.now()
+		});
+		this.#holder.scope.defer(() => this.#release_als());
+		return token;
+	}
+	/**
+	* The answer to a recording asked for while the recorder is someone else's: a 409 the client
+	* retries, which says who holds it, since when, and whether that holder is STALE: a page recording
+	* past its cap (`cut`, or past RECORDING_MAX_MS by its start), whose request died before its
+	* cleanup ran. Only a stale holder is a reset's to take: a live one (a window someone started, a
+	* page profile still running, the trap) is someone's recording (#290).
+	*/
+	#busy(message) {
+		const s = this.#holder.now;
+		const holder = s.kind === "free" ? null : {
+			kind: this.#win.now.kind !== "idle" ? "window" : s.kind,
+			age_ms: Date.now() - s.since,
+			stale: s.kind === "cut" || s.kind === "recording" && !this.#recording_active()
+		};
+		return new Response(JSON.stringify({
+			busy: true,
+			message,
+			holder
+		}), {
+			status: 409,
+			headers: {
+				"content-type": "application/json; charset=utf-8",
+				"retry-after": "2",
+				"cache-control": "no-store"
+			}
+		});
 	}
-	/** Free the recorder slot. Called only when the recording is truly finished (its inspector session
-	*  closed) — never from the site-unblock watchdog, which may fire while an orphaned run still holds
-	*  the inspector. */
-	#release_recorder() {
-		this.#recorder_busy = false;
+	/** `token` still owns the recorder (a reset, or the next owner, took it otherwise). */
+	#holds(token) {
+		const s = this.#holder.now;
+		return s.kind !== "free" && s.token === token;
+	}
+	/** Free the recorder, only for the token that owns it: false for one a reset took it from. Called
+	*  only when the recording is truly finished (its inspector session closed). */
+	#free(token) {
+		if (!this.#recorder.free(token)) return false;
+		this.#holder.go("free");
+		return true;
 	}
 	/** Production: detach the profiler's AsyncLocalStorage once a recording ends. An ALS that has
 	*  run once stays enabled — every async hop in the process keeps paying a store copy for it — until
@@ -821,10 +1104,9 @@ var Profiler = class {
 			});
 		};
 		sample_mem();
-		const mem_timer = setInterval(sample_mem, 250);
-		mem_timer.unref?.();
+		const sampling = scope();
+		sampling.every(sample_mem, 250);
 		const heap_series = [];
-		let heap_timer;
 		if (!opts.light) try {
 			const v8 = await import("node:v8");
 			const sample_heap = () => {
@@ -834,62 +1116,22 @@ var Profiler = class {
 					mb: v8.getHeapStatistics().used_heap_size / 1048576
 				});
 			};
-			heap_timer = setInterval(sample_heap, HEAP_SERIES_PERIOD_MS);
-			heap_timer.unref?.();
+			sampling.every(sample_heap, HEAP_SERIES_PERIOD_MS);
 		} catch {}
-		this.#window_net = [];
+		const owner = {};
+		const window_net = [];
 		const netmod = await import("./net.js").catch(() => null);
-		if (!opts.light) netmod?.set_stack_capture(true);
-		const spans = [];
-		let span_seq = 0;
-		const als = this.#als;
 		const { AsyncLocalStorage: SpanALS } = await import("node:async_hooks");
 		const span_als = new SpanALS();
-		set_span_recorder({
-			begin: (name, attrs) => {
-				const ctx = als?.getStore();
-				const parent = ctx?.span ?? span_als.getStore();
-				const rec = {
-					id: ++span_seq,
-					name: String(name).slice(0, 120),
-					start: perf_hooks.performance.now(),
-					ms: -1,
-					...attrs ? { attrs: { ...attrs } } : {},
-					...parent !== void 0 ? { parent } : {},
-					caller_site: netmod?.nearest_app_site(),
-					route: ctx?.route ?? null,
-					path: ctx?.path ?? null
-				};
-				if (spans.length < MAX_WINDOW_SPANS) spans.push(rec);
-				if (ctx && ctx.spans.length < MAX_SPANS_PER_REQUEST) ctx.spans.push(rec);
-				return rec;
-			},
-			within: (s, fn) => {
-				const ctx = als?.getStore();
-				return ctx && als ? als.run({
-					...ctx,
-					span: s.id
-				}, fn) : span_als.run(s.id, fn);
-			},
-			end: (s, attrs, error) => {
-				s.ms = round2(perf_hooks.performance.now() - s.start);
-				if (attrs) s.attrs = {
-					...s.attrs,
-					...attrs
-				};
-				if (error !== void 0) s.error = error instanceof Error ? error.message : String(error);
-			},
-			tag: (key, value) => {
-				const ctx = als?.getStore();
-				if (!ctx) return;
-				const tags = ctx.entry.tags ??= {};
-				if (key in tags || Object.keys(tags).length < MAX_TAGS) tags[key] = value;
-			}
-		});
+		const window_spans = new WindowSpans(this.#als, span_als, netmod);
+		const { spans } = window_spans;
 		const iomod = opts.light ? null : await import("./async-io.js").catch(() => null);
-		let io_rec = iomod ? await iomod.record_async_io() : null;
+		let io_rec = iomod ? await iomod.IoRecorder.start() : null;
 		let heap_head = null;
-		set_request_stats_detail(true);
+		const release_detail = hold_request_stats_detail();
+		this.#window_nets.add(window_net);
+		if (!opts.light) netmod?.set_stack_capture(owner, true);
+		own_spans(window_spans);
 		try {
 			await session.post("Profiler.enable");
 			await session.post("Profiler.setSamplingInterval", { interval: interval_us });
@@ -911,7 +1153,7 @@ var Profiler = class {
 						});
 						heap_on = true;
 					} catch (e) {
-						if (process.env.OGYGIA_PROFILER_DEBUG) console.error("[ogygia/profiler] allocation sampling unavailable, GC attribution off:", e);
+						if (process.env.OGYGIA_PROFILER_DEBUG) console.error(new OgygiaError("devtools_profiler_alloc_sampling_unavailable"), e);
 						await session.post("HeapProfiler.startSampling", { samplingInterval: 16384 });
 					}
 				}
@@ -948,7 +1190,7 @@ var Profiler = class {
 			const cpu = process.cpuUsage(cpu0);
 			const elu = perf_hooks.performance.eventLoopUtilization(elu0);
 			const duration_ms = t1 - t0;
-			const net = this.#window_net ?? [];
+			const net = window_net;
 			for (const s of spans) if (s.ms < 0) s.open = true;
 			return {
 				profile,
@@ -986,18 +1228,17 @@ var Profiler = class {
 				})) } : {}
 			};
 		} finally {
-			clearInterval(mem_timer);
-			if (heap_timer) clearInterval(heap_timer);
+			sampling.close();
 			histogram.disable();
-			set_span_recorder(null);
+			disown_spans(window_spans);
 			span_als.disable();
-			set_request_stats_detail(false);
-			netmod?.set_stack_capture(false);
+			release_detail();
+			netmod?.set_stack_capture(owner, false);
 			io_rec?.stop();
 			try {
 				observer?.disconnect();
 			} catch {}
-			this.#window_net = null;
+			this.#window_nets.delete(window_net);
 			try {
 				session.disconnect();
 			} catch {}
@@ -1326,7 +1567,7 @@ var Profiler = class {
 			});
 			gc_attr.window_offset_ms = window_offset_ms;
 		} catch (e) {
-			if (process.env.OGYGIA_PROFILER_DEBUG) console.error("[ogygia/profiler] GC attribution failed:", e);
+			if (process.env.OGYGIA_PROFILER_DEBUG) console.error(new OgygiaError("devtools_profiler_gc_attribution_failed"), e);
 			gc_attr = void 0;
 		}
 		{
@@ -1587,7 +1828,11 @@ var Profiler = class {
 		if (this.ui_enabled && this.secret && !this.dev) {
 			const after_login = ctx.url.searchParams.has(AFTER_LOGIN_PARAM);
 			const diag = this.#cookie_diagnosis(ctx.event);
-			if (after_login || diag.pairs > 0) console.warn(`[ogygia profiler] session not accepted on ${ctx.url.pathname}: ${JSON.stringify(diag)} — ${describe_cookie_diagnosis(diag)}`);
+			if (after_login || diag.pairs > 0) warn("devtools_profiler_session_rejected", {
+				path: ctx.url.pathname,
+				diagnosis: JSON.stringify(diag),
+				reason: describe_cookie_diagnosis(diag)
+			});
 			const target = new URL(ctx.url);
 			target.searchParams.delete(AFTER_LOGIN_PARAM);
 			const next = encodeURIComponent(target.pathname + target.search);
@@ -1610,7 +1855,7 @@ var Profiler = class {
 			window_stop: (c) => this.#window_stop(c),
 			reset: (c) => this.#reset(c),
 			status: () => ({
-				recording: this.#recorder_busy || this.#recording_active(),
+				recording: this.#recorder.held,
 				inflight: this.#inflight,
 				rss_mb: Math.round(process.memoryUsage().rss / 1048576),
 				reports: this.#reports.size
@@ -2486,10 +2731,9 @@ var Profiler = class {
 	*  profile saw with a `.svelte` source on this machine, and the islands (their keys from the
 	*  build), each with the page.data keys it reads — joined to the loads' keys and the seed. */
 	/** every `.svelte` under the app's `src/`, relative to it, listed once (null: no src here) */
-	#svelte_files;
-	/** The `src/`-relative paths of `<name>.svelte` files (a component is named after its file). */
-	async #component_files(name) {
-		this.#svelte_files ??= (async () => {
+	#svelte_files = flights({
+		name: "profiler svelte files",
+		run: async () => {
 			try {
 				const fs = await import("node:fs");
 				const path = await import("node:path");
@@ -2508,8 +2752,12 @@ var Profiler = class {
 				const carried = embedded_files().filter((f) => f.endsWith(".svelte"));
 				return carried.length ? carried : null;
 			}
-		})();
-		const all = await this.#svelte_files;
+		}
+	});
+	/** The `src/`-relative paths of `<name>.svelte` files (a component is named after its file). */
+	async #component_files(name) {
+		const all = await this.#svelte_files.get();
+		if (all === STALE) return [];
 		const leaf = "/" + name + ".svelte";
 		return all ? all.filter((f) => f === name + ".svelte" || f.endsWith(leaf)) : [];
 	}
@@ -2918,7 +3166,7 @@ var Profiler = class {
 			})),
 			site_fixes: this.#site_fixes(),
 			holes: hole_slots(this.#ring),
-			recording: this.#recorder_busy || this.#recording_active(),
+			recording: this.#recorder.held,
 			dev: this.dev,
 			rss_mb: Math.round(process.memoryUsage().rss / 1048576),
 			inflight: this.#inflight,
@@ -2934,12 +3182,12 @@ var Profiler = class {
 			trap: this.#trap ? {
 				over: this.#trap.over,
 				window_ms: this.#trap.window ?? 5e3,
-				caught: this.#trap_caught,
+				caught: caught_of(this.#trap_loop),
 				keep: this.#trap.keep ?? 3,
-				armed: !!this.#trap_timer || this.#trap_running
+				state: trap_state(this.#trap_loop)
 			} : null,
 			sampled: this.#sampled_summary(),
-			background_note: this.#background_note
+			background_note: this.#background_notes()
 		};
 	}
 	#run_page(ctx) {
@@ -2967,7 +3215,6 @@ var Profiler = class {
 			...against && against.length <= 32 ? { against } : {}
 		};
 	}
-	#window = null;
 	async #window_sign(nonce) {
 		const { createHmac } = await import("node:crypto");
 		return createHmac("sha256", this.secret || "ogygia-dev-window").update("window:" + nonce).digest("hex").slice(0, 20);
@@ -2998,8 +3245,10 @@ var Profiler = class {
 			at: Date.now(),
 			instance: this.#instance_id
 		};
+		const store = await this.#store_ready();
+		if (!store?.putVisit) return;
 		try {
-			await this.#store.putVisit({
+			await store.putVisit({
 				key: `${WINDOW_PAGE_PREFIX}${id}\0${rec.at}\0${Math.random().toString(36).slice(2, 8)}`,
 				page: WINDOW_PAGE_PREFIX + id,
 				at: rec.at,
@@ -3009,9 +3258,10 @@ var Profiler = class {
 	}
 	/** The requests every instance wrote for a window. */
 	async #window_requests(id) {
-		if (!this.#store?.listVisits) return [];
+		const store = await this.#store_ready();
+		if (!store?.listVisits) return [];
 		try {
-			return (await this.#store.listVisits(WINDOW_PAGE_PREFIX + id, MAX_VISITS_PER_KEY)).map((r) => JSON.parse(r.visit)).sort((a, b) => a.at - b.at);
+			return (await store.listVisits(WINDOW_PAGE_PREFIX + id, MAX_VISITS_PER_KEY)).map((r) => JSON.parse(r.visit)).sort((a, b) => a.at - b.at);
 		} catch {
 			return [];
 		}
@@ -3019,50 +3269,30 @@ var Profiler = class {
 	/** This instance, told apart from the others in a window's requests. */
 	#instance_id = Math.random().toString(36).slice(2, 10);
 	async #window_start(ctx) {
-		const busy = (message) => new Response(JSON.stringify({
-			busy: true,
-			message
-		}), {
-			status: 409,
-			headers: {
-				"content-type": "application/json; charset=utf-8",
-				"retry-after": "2",
-				"cache-control": "no-store"
-			}
-		});
-		if (this.#window) return busy("A window is already recording: stop it first.");
-		if (this.#recorder_busy && this.#trap_running) {
-			this.#page_waiting++;
-			try {
-				const until = Date.now() + PAGE_WAITS_FOR_BACKGROUND_MS;
-				while (this.#recorder_busy && this.#trap_running && Date.now() < until) await new Promise((r) => setTimeout(r, 50));
-			} finally {
-				this.#page_waiting--;
-			}
-		}
-		if (!this.#try_acquire_recorder()) return busy("Another recording holds the recorder. Try again in a moment.");
-		this.#recording_since = Date.now();
-		this.#trap_running = true;
+		const busy = (message) => this.#busy(message);
+		if (this.#win.now.kind !== "idle") return busy("A window is already recording: stop it first.");
+		await this.#wait_for_background();
+		const nonce = Math.random().toString(36).slice(2, 12) + Date.now().toString(36);
+		const id = `${nonce}.${await this.#window_sign(nonce)}`;
+		const token = this.#take("background");
+		if (token === null) return busy("Another recording holds the recorder. Try again in a moment.");
 		this.#ensure_net?.();
 		let stop;
 		const stopped = new Promise((r) => stop = r);
-		const nonce = Math.random().toString(36).slice(2, 12) + Date.now().toString(36);
-		const id = `${nonce}.${await this.#window_sign(nonce)}`;
-		const timer = setTimeout(() => {
-			stop();
-			done.finally(() => {
-				if (this.#window?.id === id) this.#window_release();
-			});
-		}, WINDOW_MAX_MS);
-		timer.unref?.();
 		const done = this.#capture_window(Math.min(this.sample_interval, 1e3), () => stopped, { light: true });
-		done.catch(() => this.#window_release());
-		this.#window = {
+		this.#win.go("recording", {
 			id,
-			stop,
-			done,
-			timer
+			token,
+			done
+		});
+		const mine = this.#win.now;
+		this.#win.scope.defer(stop);
+		const settled = () => {
+			if (this.#win.now === mine) this.#win.go("idle");
+			const now = this.#win.now;
+			if (now.kind !== "stopping" || now.token !== token) this.#free(token);
 		};
+		done.then(settled, settled);
 		return ctx.json({
 			ok: true,
 			id,
@@ -3071,18 +3301,31 @@ var Profiler = class {
 			max_ms: WINDOW_MAX_MS
 		});
 	}
-	#window_release() {
-		if (this.#window) clearTimeout(this.#window.timer);
-		this.#window = null;
-		this.#trap_running = false;
-		this.#recording_since = 0;
-		this.#release_als();
-		this.#release_recorder();
+	/** A page profile or a window waits (a few seconds at most) for a background window (the trap,
+	*  the sampler, a started window) to give the recorder back. The trap and the sampler do not
+	*  start again while one waits. The wait is its request's: once the request ends, it waits no
+	*  more. */
+	async #wait_for_background() {
+		if (this.#holder.now.kind !== "background") return;
+		this.#page_waiting++;
+		const wait = scope(current_request_scope() ?? void 0);
+		try {
+			wait.timeout(() => wait.close(), PAGE_WAITS_FOR_BACKGROUND_MS);
+			await wait.task(() => this.#holder.wait("free"));
+		} finally {
+			wait.close();
+			this.#page_waiting--;
+		}
 	}
 	async #window_stop(ctx) {
 		const asked = ctx.event ? await this.#window_id_of(ctx.event.request) : null;
-		const w = this.#window && (!asked || this.#window.id === asked) ? this.#window : null;
-		if (!w) {
+		const w = this.#win.now;
+		const ours = w.kind !== "idle" && (!asked || w.id === asked);
+		if (ours && w.kind === "stopping") {
+			const a = await w.answer;
+			return ctx.json(a.body, { status: a.status });
+		}
+		if (!ours || w.kind !== "recording") {
 			if (asked && this.#store?.listVisits) {
 				const reqs = await this.#window_requests(asked);
 				const busy = round2(reqs.reduce((a, r) => a + (r.cpu_ms || 0), 0));
@@ -3112,16 +3355,33 @@ var Profiler = class {
 			}
 			return ctx.json({ error: "No window is recording (start one with POST /window/start)." }, { status: 400 });
 		}
-		w.stop();
-		let cap;
+		const answer = this.#window_answer(w);
+		this.#win.move("recording", "stopping", {
+			id: w.id,
+			token: w.token,
+			answer
+		});
+		const a = await answer;
+		return ctx.json(a.body, { status: a.status });
+	}
+	/** The stopped window's report, made once; the window holds the recorder until it is made. */
+	async #window_answer(w) {
 		try {
-			cap = await w.done;
+			return await this.#window_report(w.id, await w.done);
 		} catch (e) {
-			this.#window_release();
-			return ctx.json({ error: `The window failed: ${e instanceof Error ? e.message : String(e)}` }, { status: 500 });
+			return {
+				status: 500,
+				body: { error: `The window failed: ${e instanceof Error ? e.message : String(e)}` }
+			};
+		} finally {
+			const now = this.#win.now;
+			if (now.kind === "stopping" && now.token === w.token) this.#win.go("idle");
+			this.#free(w.token);
 		}
+	}
+	async #window_report(window_id, cap) {
 		const own = `${this.base}/`;
-		const shared = await this.#window_requests(w.id);
+		const shared = await this.#window_requests(window_id);
 		const others = shared.filter((e) => e.instance !== this.#instance_id && !e.path.startsWith(own) && e.path !== this.base);
 		const requests = [...this.#ring.filter((e) => !e.internal && e.ts >= cap.t0 && e.ts <= cap.t1 && !e.path.startsWith(own) && e.path !== this.base).map((e) => ({
 			method: e.method,
@@ -3132,64 +3392,44 @@ var Profiler = class {
 			cpu_ms: e.cpu_ms,
 			instance: this.#instance_id
 		})), ...others];
-		try {
-			const id = await this.#finish_report(cap, {
-				trigger: "window",
-				...requests[0] ? { request: {
-					method: requests[0].method,
-					path: requests[0].path,
-					route: requests[0].route,
-					ms: requests[0].ms
-				} } : {}
-			});
-			const s = this.#reports.get(id);
-			return ctx.json({
+		const id = await this.#finish_report(cap, {
+			trigger: "window",
+			...requests[0] ? { request: {
+				method: requests[0].method,
+				path: requests[0].path,
+				route: requests[0].route,
+				ms: requests[0].ms
+			} } : {}
+		});
+		const s = this.#reports.get(id);
+		return {
+			status: 200,
+			body: {
 				...report_json(s.analysis, s.meta, this.base, this.#report_extras(s)),
 				window: {
 					ms: round2(cap.t1 - cap.t0),
 					requests,
 					...shared.length ? { instances: new Set(requests.map((r) => r.instance)).size } : {}
 				}
-			});
-		} finally {
-			this.#window_release();
-		}
+			}
+		};
 	}
 	#reset(ctx) {
-		this.#recording_since = 0;
+		if (this.#holder.now.kind !== "free") {
+			this.#recorder.free(this.#recorder.seize());
+			this.#holder.go("free");
+		}
+		if (this.#win.now.kind !== "idle") this.#win.go("idle");
 		this.#release_als();
-		this.#recorder_busy = false;
 		return ctx.redirect(this.base);
 	}
 	async #record_page(ctx, replay) {
 		const event = ctx.event;
-		if (this.#recorder_busy && this.#trap_running) {
-			this.#page_waiting++;
-			try {
-				const until = Date.now() + PAGE_WAITS_FOR_BACKGROUND_MS;
-				while (this.#recorder_busy && this.#trap_running && Date.now() < until) await new Promise((r) => setTimeout(r, 50));
-			} finally {
-				this.#page_waiting--;
-			}
-		}
-		if (!this.#try_acquire_recorder()) return new Response(JSON.stringify({
-			busy: true,
-			message: "A profile is already running on this worker. Waiting for it to finish (or for a free worker)."
-		}), {
-			status: 409,
-			headers: {
-				"content-type": "application/json; charset=utf-8",
-				"retry-after": "2",
-				"cache-control": "no-store"
-			}
-		});
+		await this.#wait_for_background();
+		const token = this.#take("recording");
+		if (token === null) return this.#busy("A profile is already running on this worker. Waiting for it to finish (or for a free worker).");
 		const q = ctx.url.searchParams;
-		this.#recording_since = Date.now();
-		const watchdog = setTimeout(() => {
-			this.#recording_since = 0;
-			this.#release_als();
-		}, 32e3);
-		watchdog.unref?.();
+		const kept_owner = {};
 		this.#ensure_net?.();
 		try {
 			const path = replay?.path ?? q.get("p") ?? "";
@@ -3209,6 +3449,7 @@ var Profiler = class {
 			const request_deadline = Date.now() + detect_request_budget_ms();
 			const deadline = Math.min(budget_deadline, Date.now() + RECORDING_HARD_CAP_MS);
 			const fetch_render = (p, extra) => {
+				if (!this.#holds(token)) return Promise.reject(/* @__PURE__ */ new Error("the recording was reset before it finished"));
 				const left = deadline - Date.now();
 				const ms = Number.isFinite(left) ? Math.max(1, Math.min(PER_RENDER_TIMEOUT_MS, left)) : PER_RENDER_TIMEOUT_MS;
 				return with_timeout(event.fetch(p, { headers: {
@@ -3302,7 +3543,7 @@ var Profiler = class {
 					skipped: heap_skipped
 				} : void 0;
 			};
-			this.#kept?.keep(true);
+			this.#kept?.keep(kept_owner, true);
 			mem_mark("before the timed renders");
 			const cap = await this.#capture_window(interval, async () => {
 				const path_only = target.split("?")[0];
@@ -3373,7 +3614,7 @@ var Profiler = class {
 				cap.set_aside = aside;
 			}
 			const stable = stable_answers(cap.net, run_windows);
-			this.#kept?.keep(false);
+			this.#kept?.keep(kept_owner, false);
 			const almost = /* @__PURE__ */ new Map();
 			if (this.#kept) for (const key of varied_answers(cap.net, run_windows)) {
 				const d = this.#kept.diff(key);
@@ -3404,8 +3645,8 @@ var Profiler = class {
 				} catch {
 					answers = void 0;
 				} finally {
-					this.#answers = null;
-					this.#kept.drop();
+					if (this.#answers === state) this.#answers = null;
+					this.#kept.drop(kept_owner);
 				}
 			}
 			const wait_runs = {};
@@ -3490,12 +3731,18 @@ var Profiler = class {
 			}, true) : (heap_skipped.push("the call-count render (the ×N counts)"), { counts: {} });
 			cap.call_counts = counted.counts;
 			mem_mark("after the coverage render");
-			const app_fetch = async (u) => {
+			const app_fetch = async (u, signal) => {
 				try {
-					const r = await event.fetch(u, { headers: { "x-og-profiler-internal": "1" } });
+					const r = await event.fetch(u, {
+						headers: { "x-og-profiler-internal": "1" },
+						signal
+					});
 					if (r.ok) return r;
 				} catch {}
-				return fetch(new URL(u, event.url.origin), { headers: { "x-og-profiler-internal": "1" } });
+				return fetch(new URL(u, event.url.origin), {
+					headers: { "x-og-profiler-internal": "1" },
+					signal
+				});
 			};
 			const id = await this.#finish_report(cap, {
 				trigger: "page",
@@ -3604,7 +3851,8 @@ var Profiler = class {
 				await this.#lines_for(s, counted.profile, cap.window?.start, stable, wait_runs, almost);
 			} catch {}
 			const persist_wait = Math.max(200, Math.min(PERSIST_WAIT_MS, request_deadline - Date.now() - 2e3));
-			await Promise.race([this.#persist(s), new Promise((r) => setTimeout(r, persist_wait))]);
+			const bound = scope(current_request_scope() ?? void 0);
+			await Promise.race([this.#persist(s), pause(bound, persist_wait)]).finally(() => bound.close());
 			if (q.get("format") === "keep") return ctx.json({
 				id,
 				url: ctx.href("/report/[id]", { id }),
@@ -3626,13 +3874,8 @@ var Profiler = class {
 			if (isHttpError(e) || isRedirect(e)) throw e;
 			return error(500, e instanceof Error && INSPECTOR_ERR.test(e.message) ? "CPU profiling needs a Node.js server (adapter-node or dev). This platform does not expose the V8 inspector." : `Profiling failed: ${e instanceof Error ? e.message : String(e)}`);
 		} finally {
-			clearTimeout(watchdog);
-			this.#recording_since = 0;
-			this.#kept?.keep(false);
-			this.#kept?.drop();
-			this.#answers = null;
-			this.#release_als();
-			this.#release_recorder();
+			this.#kept?.drop(kept_owner);
+			this.#free(token);
 		}
 	}
 	async #upload(ctx) {
@@ -3931,6 +4174,18 @@ var Profiler = class {
 	*  fails the recording). The dump is the same portable JSON the `.ogp` export uses. The returned
 	*  promise settles when the write did: a serverless host freezes the process once the response
 	*  is sent, so a write left running after it may never land — the page recording awaits it. */
+	/** The durable store, once its `init` has succeeded; null when none is configured or its init
+	*  failed this time (said, and tried again by the next use). */
+	async #store_ready() {
+		const store = this.#store;
+		if (!store || !this.#store_init) return store;
+		try {
+			return await this.#store_init.get() === STALE ? null : store;
+		} catch (e) {
+			console.error(new OgygiaError("devtools_profiler_store_init_failed"), e);
+			return null;
+		}
+	}
 	#persist(stored) {
 		if (!this.#store) return Promise.resolve();
 		const meta = stored.meta;
@@ -3945,10 +4200,12 @@ var Profiler = class {
 			dump: JSON.stringify(report_dump(stored.analysis, meta, this.#report_extras(stored)))
 		};
 		return Promise.resolve().then(async () => {
-			await this.#store.putReport(rec);
-			await this.#store.prune?.(Math.max(this.max_reports * 8, 200));
+			const store = await this.#store_ready();
+			if (!store) return;
+			await store.putReport(rec);
+			await store.prune?.(Math.max(this.max_reports * 8, 200));
 		}).catch((err) => {
-			if (process.env.OGYGIA_PROFILER_DEBUG) console.error("[ogygia/profiler] store.putReport failed:", err);
+			if (process.env.OGYGIA_PROFILER_DEBUG) console.error(new OgygiaError("devtools_profiler_put_report_failed"), err);
 		});
 	}
 	/** Memory first, then the durable store: read the dump back, reconstruct, cache in memory. */
@@ -3956,9 +4213,10 @@ var Profiler = class {
 		if (!id) return void 0;
 		const hit = this.#reports.get(id);
 		if (hit) return hit;
-		if (!this.#store) return void 0;
+		const store = await this.#store_ready();
+		if (!store) return void 0;
 		try {
-			const json = await this.#store.getReport(id);
+			const json = await store.getReport(id);
 			if (!json) return void 0;
 			const dump = JSON.parse(json);
 			if (!dump?.meta || !dump.analysis) return void 0;
@@ -3972,15 +4230,16 @@ var Profiler = class {
 			this.#reports.set(id, stored);
 			return stored;
 		} catch (err) {
-			if (process.env.OGYGIA_PROFILER_DEBUG) console.error("[ogygia/profiler] store.getReport failed:", err);
+			if (process.env.OGYGIA_PROFILER_DEBUG) console.error(new OgygiaError("devtools_profiler_get_report_failed"), err);
 			return;
 		}
 	}
 	/** The reports the durable store holds (summaries), newest first — the sidebar's shared list. */
 	async #list_stored(limit = 20) {
-		if (!this.#store) return [];
+		const store = await this.#store_ready();
+		if (!store) return [];
 		try {
-			return (await this.#store.listReports(limit)).map((r) => ({
+			return (await store.listReports(limit)).map((r) => ({
 				id: r.id,
 				label: r.label,
 				page: r.page ?? void 0,
@@ -4501,8 +4760,9 @@ var Profiler = class {
 			if (Object.keys(kept).length) entry.replay_headers = kept;
 		}
 		const profile_header = event.request.headers.get("x-profile");
-		const header_profile = !!profile_header && this.ui_enabled && await this.#key_matches(profile_header) && this.#try_acquire_recorder();
-		const ctx = !!this.#als && (this.dev || this.#recording_active() && !this.#trap_running || header_profile) ? this.#request_ctx(entry) : null;
+		const header_token = !!profile_header && this.ui_enabled && await this.#key_matches(profile_header) ? this.#take("recording") : null;
+		const header_profile = header_token !== null;
+		const ctx = !!this.#als && (this.dev || this.#recording_active() || header_profile) ? this.#request_ctx(entry, request_scope(event.request)) : null;
 		const answers = this.#answers;
 		if (ctx && answers && this.#kept && event.request.headers.get(ANSWERS_HEADER) === answers.token) {
 			const kept = this.#kept;
@@ -4570,47 +4830,36 @@ var Profiler = class {
 			} catch {}
 			return res;
 		};
-		if (header_profile) {
-			this.#recording_since = Date.now();
-			const watchdog = setTimeout(() => {
-				this.#recording_since = 0;
-				this.#release_als();
-			}, 32e3);
-			watchdog.unref?.();
+		if (header_token !== null) try {
+			let res;
+			const cap = await this.#capture_window(100, async () => {
+				res = await run();
+			});
+			this.#finalize(entry, start, cpu0, ctx, event.request);
+			cap.window = {
+				start,
+				end: start + entry.ms
+			};
+			const id = await this.#finish_report(cap, {
+				trigger: "request",
+				request: {
+					method: entry.method,
+					path: entry.path,
+					route: entry.route,
+					ms: entry.ms
+				}
+			});
+			const stored = this.#reports.get(id);
+			if (stored) stored.replay = {
+				path: entry.path + (entry.search ?? ""),
+				headers: entry.replay_headers ?? {}
+			};
 			try {
-				let res;
-				const cap = await this.#capture_window(100, async () => {
-					res = await run();
-				});
-				this.#finalize(entry, start, cpu0, ctx, event.request);
-				cap.window = {
-					start,
-					end: start + entry.ms
-				};
-				const id = await this.#finish_report(cap, {
-					trigger: "request",
-					request: {
-						method: entry.method,
-						path: entry.path,
-						route: entry.route,
-						ms: entry.ms
-					}
-				});
-				const stored = this.#reports.get(id);
-				if (stored) stored.replay = {
-					path: entry.path + (entry.search ?? ""),
-					headers: entry.replay_headers ?? {}
-				};
-				try {
-					res?.headers.append("x-profile-report", `${this.base}/report/${id}`);
-				} catch {}
-				return res;
-			} finally {
-				clearTimeout(watchdog);
-				this.#recording_since = 0;
-				this.#release_als();
-				this.#release_recorder();
-			}
+				res?.headers.append("x-profile-report", `${this.base}/report/${id}`);
+			} catch {}
+			return res;
+		} finally {
+			this.#free(header_token);
 		}
 		try {
 			return await run();
@@ -4661,47 +4910,72 @@ var Profiler = class {
 			if (Number.isFinite(serverless_work_budget_ms())) this.#sink_flush();
 		}
 	}
-	/** Post the buffered rows as NDJSON to the sink. One post in flight at a time; a failure keeps
-	*  the rows for the next try (the buffer drops its oldest request rows when full). */
-	async #sink_flush() {
+	/** Hand the buffered rows to the sink's outbox as one post, now. While a post is out, the rows
+	*  wait in the buffer (capped: it drops the oldest when full) and go in one post once it ends,
+	*  never a post per tick queued behind a sink that is down (#376). Settles once the rows asked
+	*  for were taken or given up; never rejects. */
+	#sink_flush() {
 		if (this.#sink_timer && this.#superseded()) {
-			clearInterval(this.#sink_timer);
+			this.#sink_timer();
 			this.#sink_timer = null;
 		}
-		if (!this.#sink_url || this.#sink_inflight || !this.#sink.size) return;
-		this.#sink_inflight = true;
+		const out = this.#sink_out;
+		if (out !== null) {
+			out.again = true;
+			return out.done;
+		}
+		if (!this.#sink_url || !this.#sink.size) return Promise.resolve();
 		const rows = this.#sink.size;
-		const body = this.#sink.drain();
+		const post = {
+			id: `${this.#sink_run}-${++this.#sink_count}`,
+			body: this.#sink.drain(),
+			rows
+		};
+		const posting = {
+			again: false,
+			done: Promise.resolve()
+		};
+		this.#sink_out = posting;
+		posting.done = this.#sink_posts.put(post).then(() => {
+			this.#sink_out = null;
+			if (posting.again) return this.#sink_flush();
+		});
+		return posting.done;
+	}
+	/** The post out now, and whether a flush asked for the rows read meanwhile. */
+	#sink_out = null;
+	/** Each post's id: this profiler's run, and its count. */
+	#sink_run = Math.random().toString(36).slice(2, 10);
+	#sink_count = 0;
+	/** One try at a post: done once the sink answered ok. Its id rides `idempotency-key`, so a sink
+	*  that saw it already (an answer lost on the way back) can drop the copy. */
+	async #sink_post(post, signal) {
 		try {
 			const res = await fetch(this.#sink_url, {
 				method: "POST",
-				body,
+				body: post.body,
 				headers: {
 					"content-type": "application/x-ndjson",
+					"idempotency-key": post.id,
 					"x-og-profiler-internal": "1",
 					...this.#sink_key ? { authorization: `Bearer ${this.#sink_key}` } : {}
 				},
-				signal: AbortSignal.timeout(5e3)
+				signal: AbortSignal.any([signal, AbortSignal.timeout(SINK_TRY_MS)])
 			});
+			if (!res.ok) throw new Error(`the sink answered ${res.status}`);
 			this.#sink_last = {
 				at: Date.now(),
-				ok: res.ok,
-				rows,
-				...res.ok ? {} : { error: `the sink answered ${res.status}` }
+				ok: true,
+				rows: post.rows
 			};
-			if (!res.ok) {
-				for (const line of body.split("\n")) if (line) this.#sink.push(JSON.parse(line));
-			}
-		} catch (e) {
+		} catch (error) {
 			this.#sink_last = {
 				at: Date.now(),
 				ok: false,
-				rows,
-				error: e instanceof Error ? e.message : String(e)
+				rows: post.rows,
+				error: error_text(error)
 			};
-			for (const line of body.split("\n")) if (line) this.#sink.push(JSON.parse(line));
-		} finally {
-			this.#sink_inflight = false;
+			throw error;
 		}
 	}
 	/** The site view's rows from THIS instance: the request ring and the sampler's windows — what a
@@ -4806,12 +5080,13 @@ function clamp(n, lo, hi) {
 *  is left to settle on its own — the caller has already moved on. */
 function with_timeout(p, ms, label) {
 	if (!Number.isFinite(ms) || ms <= 0) return p;
-	let timer;
-	const timeout = new Promise((_, reject) => {
-		timer = setTimeout(() => reject(new Error(label)), ms);
-		timer.unref?.();
-	});
-	return Promise.race([p.finally(() => clearTimeout(timer)), timeout]);
+	const race = scope();
+	const timeout = new Promise((_, reject) => race.timeout(() => reject(new Error(label)), Math.min(ms, 2147483647)));
+	return Promise.race([p.finally(() => race.close()), timeout]);
+}
+/** Settles after `ms`, or at once when `owner` ends (its timer goes with it). */
+function pause(owner, ms) {
+	return owner.task(() => new Promise((r) => owner.timeout(r, ms)));
 }
 /** OGYGIA_PROFILER_DEBUG: the process's memory at a step of a recording (what the profiler itself
 *  holds on a small serverless instance) */
@@ -4918,4 +5193,4 @@ function imported_from(src, name, file) {
 		return;
 	}
 }
-export { pick_fields, profiler, route_prerendered, self_profile_to_cpuprofile };
+export { pick_fields, profiler, route_prerendered, self_profile_to_cpuprofile, url_weights, weigh_urls };