@sproutboat/runtime 0.35.0 → 0.36.0

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @sproutboat/runtime
 
+## 0.36.0
+
+### Minor Changes
+
+- 7a9c1f9: `AsyncLocalStorage` (`import { AsyncLocalStorage } from "node:async_hooks"`, once the CLI maps the import), as Workers has it: `run`, `exit`, `getStore` and the static `snapshot`. `enterWith` and `disable` throw, as there. The static `bind` is not provided: Porffor compiles a `.bind(` call on a function value to `Function.prototype.bind`, so use `snapshot()`. The toolchain patches Porffor's job queue and timers to carry one current-context value: a promise reaction (then, await, a coroutine resume, a native response callback) and a timer record it when they are created and set it when they run, so the store follows a request across awaits, microtasks, timers, intervals, async fetch and WebSocket callbacks and `ctx.waitUntil`, and requests interleaved in one process never see each other's. Cost: a reaction is 56 bytes, not 40, and each job does one load. The context is only ever set by `AsyncLocalStorage`. Nothing an existing app observes changes, so there is no new compatibility date: `node:async_hooks` did not work at any date before (the import built and `new AsyncLocalStorage()` threw). New native test `test:native-async-local-storage` (needs `SB_CLI`).
+- a68d923: `x-sb-cpu-ms` is per request when requests interleave in one process. A request is charged the thread CPU time of the slices in which it ran (the toolchain's async context carries a request id through awaits, reactions and timers, and the clock is read only when the running request changes, so a request that runs alone costs two reads). Before, the stamp was the process CPU delta across the handler, which is right only for a handler that answers synchronously, so an async handler was never stamped. From compatibility date `2026-11-02` an async handler is stamped too (its response is a string with no Set-Cookie, as for a sync one); earlier dates still send no stamp for an async handler. A synchronous handler's stamp is now thread time, which leaves out the egress threads. New native test `test:native-cpu-requests`: a 200 ms spinner among eight waiters is charged its 200 ms and the waiters under 60 ms, two spinners are each charged their own, and the date gate.
+
 ## 0.35.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/runtime",
-  "version": "0.35.0",
+  "version": "0.36.0",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/native-fetch-prelude.js

@@ -3104,16 +3104,14 @@ function __sbCpuMs() {
   return ms;
 }
 
-// The `x-sb-cpu-ms` value for the CPU time since `t0`, as three decimals, floored at zero: one
-// clock read and one format call in C, where it was a read, a format, a parse and a toFixed.
-// oxlint-disable-next-line no-unused-vars -- `t0` is read inside the RawC block below, not by JS.
-function __sbCpuStamp(t0) {
+// The `x-sb-cpu-ms` value for a CPU time in ms, as three decimals, floored at zero: one format call
+// in C, where it was a format, a parse and a toFixed.
+// oxlint-disable-next-line no-unused-vars -- `cpu` is read inside the RawC block below, not by JS.
+function __sbCpuStamp(cpu) {
   let res = "0.000";
   // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
   Porffor.c`
-    struct timespec __ts;
-    clock_gettime(CLOCK_PROCESS_CPUTIME_ID, &__ts);
-    double __d = ((double)__ts.tv_sec * 1000.0 + (double)__ts.tv_nsec / 1000000.0) - (t0.type == 1 ? (double)t0.val : 0.0);
+    double __d = cpu.type == 1 ? (double)cpu.val : 0.0;
     if (!(__d >= 0)) __d = 0;
     char __b[32];
     int __n = snprintf(__b, sizeof(__b), "%.3f", __d);
@@ -3122,6 +3120,33 @@ function __sbCpuStamp(t0) {
   return res;
 }
 
+// Per-request CPU (toolchain async-context.ts): a request is a small id whose thread CPU time is
+// summed over the slices in which it ran, however requests interleave. 0 when no slot is free.
+function __sbCpuBegin() {
+  let id = 0;
+  // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+  Porffor.c`
+    id = (f64)porf_cpu_begin();
+  `;
+  return id;
+}
+// oxlint-disable-next-line no-unused-vars -- `cell` is read inside the RawC block below, not by JS.
+function __sbCpuTake(cell) {
+  let ms = 0;
+  // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+  Porffor.c`
+    ms = porf_cpu_read_ms((u32)cell.val);
+  `;
+  return ms;
+}
+// oxlint-disable-next-line no-unused-vars -- `cell` is read inside the RawC block below, not by JS.
+function __sbCpuEnd(cell) {
+  // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+  Porffor.c`
+    porf_cpu_end((u32)cell.val);
+  `;
+}
+
 // #28 — stamp `x-sb-cpu-ms` onto a handler Response. Porffor alpha-10's
 // native-fetch serializer only reads headers from the plain object passed to
 // `new Response(body, { headers })` — a later `.set()` or a `Headers` instance
@@ -3129,7 +3154,7 @@ function __sbCpuStamp(t0) {
 // with one extra header. Safe only for a string body (the norm under
 // http-sync-v0) with no Set-Cookie to comma-fold; anything else is returned
 // untouched and the edge simply omits cpuMs for that request.
-function __sbTagCpu(res, t0) {
+function __sbTagCpu(res, cpu) {
   try {
     // A string body and no Set-Cookie, as before. The native writer reads Headers' flat `_entries`,
     // so the stamp is appended to the handler's own Response instead of building a second one (a
@@ -3137,7 +3162,7 @@ function __sbTagCpu(res, t0) {
     // the handler set itself is replaced by the measured one, as before.
     const headers = res && res.headers;
     if (headers && __sbIsStr(__sbRawBody(res)) && !headers.has("set-cookie")) {
-      const stamp = __sbCpuStamp(t0);
+      const stamp = __sbCpuStamp(cpu);
       const entries = headers._entries;
       let set = false;
       for (let i = 0; i < entries.length; i += 2) {
@@ -9160,7 +9185,7 @@ function __sbInstallWebSockets() {
   globalThis.WebSocketRequestResponsePair = __SbWebSocketRequestResponsePair;
 }
 
-async function __sbFetchWithDrain(res, tasks, bindingCall, rethrow, top) {
+async function __sbFetchWithDrain(res, tasks, bindingCall, rethrow, top, cpuCell) {
   let r;
   try {
     r = res && __sbIsFn(res.then) ? await res : res;
@@ -9178,6 +9203,12 @@ async function __sbFetchWithDrain(res, tasks, bindingCall, rethrow, top) {
     // #179 — a rejected handler promise must not take the process down with it.
     r = __sbErrorResponse(error, bindingCall);
   }
+  // From 2026-11-02 an async handler reports its CPU too: the thread time of the slices in which this
+  // request ran, not its neighbours' (before it, only a handler that answered synchronously did).
+  if (cpuCell) {
+    if (__sbCompatDate() >= "2026-11-02") __sbTagCpu(r, __sbCpuTake(cpuCell));
+    __sbCpuEnd(cpuCell);
+  }
   // The response goes out now and ctx.waitUntil work keeps running after it, as in
   // workerd; it was awaited first, so a 1.5 s background task delayed the response by
   // 1.5 s. The 25 s cap still bounds it. Not called for no tasks: an async call is a coroutine and a promise.
@@ -9287,6 +9318,87 @@ globalThis.__sbOnUnhandledRejection = function (reason, promise) {
   }
 };
 
+// AsyncLocalStorage (node:async_hooks, as Workers has it: run, getStore, exit and the static snapshot
+// (no bind, enterWith or disable). The patched Porffor (toolchain async-context.ts) keeps one
+// "current context" value that every promise reaction, await and timer records when it is created and
+// sets when it runs. Here that value is a frame: the stores of the AsyncLocalStorage instances
+// entered so far, in two parallel arrays (a frame is never changed, run() makes a new one).
+function __sbCtxGet() {
+  let frame;
+  // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+  Porffor.c`
+    frame = porf_unpack(porf_async_ctx_bits);
+  `;
+  return frame;
+}
+// oxlint-disable-next-line no-unused-vars -- `frame` is read inside the RawC block below, not by JS.
+function __sbCtxSet(frame) {
+  // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+  Porffor.c`
+    porf_async_ctx_bits = porf_pack(frame);
+  `;
+}
+function __sbFrameIndex(frame, als) {
+  if (!frame) return -1;
+  const keys = frame.keys;
+  for (let i = 0; i < keys.length; i++) if (keys[i] === als) return i;
+  return -1;
+}
+function __sbFrameWith(frame, als, store) {
+  const keys = [];
+  const vals = [];
+  if (frame) {
+    for (let i = 0; i < frame.keys.length; i++) {
+      if (frame.keys[i] === als) continue;
+      keys.push(frame.keys[i]);
+      vals.push(frame.vals[i]);
+    }
+  }
+  keys.push(als);
+  vals.push(store);
+  return { keys, vals };
+}
+function __sbRunInFrame(frame, fn, args) {
+  const previous = __sbCtxGet();
+  __sbCtxSet(frame);
+  try {
+    return fn.apply(undefined, args);
+  } finally {
+    __sbCtxSet(previous);
+  }
+}
+// A function constructor, not a class: Porffor refuses `new` on a class reached through an alias
+// (const { AsyncLocalStorage } = globalThis), which is how a bundled import arrives.
+function __SbAsyncLocalStorage() {}
+__SbAsyncLocalStorage.prototype.run = function (store, fn, ...args) {
+  if (!__sbIsFn(fn)) throw new TypeError("The \"callback\" argument must be of type function.");
+  return __sbRunInFrame(__sbFrameWith(__sbCtxGet(), this, store), fn, args);
+};
+__SbAsyncLocalStorage.prototype.exit = function (fn, ...args) {
+  if (!__sbIsFn(fn)) throw new TypeError("The \"callback\" argument must be of type function.");
+  return __sbRunInFrame(__sbFrameWith(__sbCtxGet(), this, undefined), fn, args);
+};
+__SbAsyncLocalStorage.prototype.getStore = function () {
+  const frame = __sbCtxGet();
+  const at = __sbFrameIndex(frame, this);
+  return at === -1 ? undefined : frame.vals[at];
+};
+__SbAsyncLocalStorage.prototype.enterWith = function () {
+  throw new Error("AsyncLocalStorage.enterWith() is not supported");
+};
+__SbAsyncLocalStorage.prototype.disable = function () {
+  throw new Error("AsyncLocalStorage.disable() is not supported");
+};
+// AsyncLocalStorage.bind(fn) is not provided: Porffor compiles a call of .bind on a function value to
+// Function.prototype.bind whatever properties the function has. snapshot() does the same job.
+__SbAsyncLocalStorage.snapshot = function () {
+  const frame = __sbCtxGet();
+  return function (fn, ...args) {
+    return __sbRunInFrame(frame, fn, args);
+  };
+};
+globalThis.AsyncLocalStorage = __SbAsyncLocalStorage;
+
 // Shared by alarm and scheduled: both reply with an empty 204 once their
 // handler (and anything it queued via `waitUntil`) has settled.
 async function __sb204WithDrain(res, tasks) {
@@ -9509,7 +9621,8 @@ globalThis.__sbEntry = function (handlers, request) {
     // itself returned, but never one derived from `.then()`, so chaining the
     // tag on hangs the request forever. cpuMs is documented as absent for
     // async handlers (see LogEvent in services/edge) — that is this.
-    const __t0 = __sbCpuMs();
+    const __cpuCell = __sbCpuBegin();
+    const __t0 = __cpuCell ? 0 : __sbCpuMs();
     const __sbTasks = [];
     const ctx = {
       waitUntil(p) {
@@ -9531,14 +9644,21 @@ globalThis.__sbEntry = function (handlers, request) {
     } catch (error) {
       // #179 — a synchronous throw anywhere in the handler must not take the
       // whole process (and every other in-flight request) down with it.
+      __sbCpuEnd(__cpuCell);
       return __sbErrorResponse(error, bindingCall);
     }
     // Same promise-identity rule as above applies to `__sbFetchWithDrain`'s
     // own return, which is why it's tail-called rather than chained on here.
-    if (__sbTasks.length || (__res && __sbIsFn(__res.then)) || __sbHasStreamBody(__res)) return __sbFetchWithDrain(__res, __sbTasks, bindingCall, false, true);
+    if (__sbTasks.length || (__res && __sbIsFn(__res.then)) || __sbHasStreamBody(__res)) return __sbFetchWithDrain(__res, __sbTasks, bindingCall, false, true, __cpuCell);
     // A WebSocket handshake answer (from 2026-10-30): its client end becomes the host socket.
-    if (__sbHasWebSocket(__res)) return __sbWsHostResponse(__res);
-    return __sbTagCpu(__res, __t0);
+    if (__sbHasWebSocket(__res)) {
+      __sbCpuEnd(__cpuCell);
+      return __sbWsHostResponse(__res);
+    }
+    // The request ran alone from start to here: its own slices, or the process delta where no slot was free.
+    const __cpu = __cpuCell ? __sbCpuTake(__cpuCell) : __sbCpuMs() - __t0;
+    __sbCpuEnd(__cpuCell);
+    return __sbTagCpu(__res, __cpu);
   }
   if (!__sbTriggerAuthed(request)) return new Response("forbidden", { status: 403 });
 

package/test/concurrent-driver.ts

@@ -0,0 +1,291 @@
+import assert from "node:assert/strict";
+
+// Drives test/fixtures/concurrent-app.js with many interleaved requests and checks that every
+// reply holds only its own request's values. Used by native-concurrent-requests.ts (a standalone
+// binary) and by sproutd's smoke (a worker serving up to 8 requests at once).
+
+/** An upstream the app's fetch() calls: answers after `ms`, echoing the id it was asked for. */
+export function startUpstream() {
+  return Bun.serve({
+    port: 0,
+    hostname: "127.0.0.1",
+    async fetch(request) {
+      const url = new URL(request.url);
+      await Bun.sleep(Number(url.searchParams.get("ms") || 0));
+      return Response.json({ id: url.searchParams.get("id"), header: request.headers.get("x-rid") });
+    },
+  });
+}
+
+type Json = string | number | boolean | null | Json[] | { readonly [key: string]: Json };
+
+let seed = 12345;
+const rand = (n: number) => {
+  seed = (seed * 1103515245 + 12345) & 0x7fffffff;
+  return seed % n;
+};
+
+export interface DriverOptions {
+  readonly base: string;
+  readonly host?: string;
+  readonly upstream?: string;
+  readonly requests: number;
+  readonly rounds: number;
+  /** Whether the host carries client WebSockets (a standalone binary answers 501). */
+  readonly clientSockets: boolean;
+  readonly store: boolean;
+  /** Most requests (and sockets) in flight at once; sproutd queues 32 per app and refuses the rest. Default: all. */
+  readonly limit?: number;
+}
+
+const randomId = (round: number, i: number) => `r${round}-${i}-${rand(1e9).toString(36)}`;
+
+export async function drive(options: DriverOptions): Promise<{ requests: number; failures: string[] }> {
+  const { base, upstream, requests, rounds } = options;
+  const failures: string[] = [];
+  const fail = (msg: string) => failures.push(msg);
+  const hostHeader: Record<string, string> = options.host ? { host: options.host } : {};
+  const get = (path: string, rid: string, init: RequestInit = {}) =>
+    fetch(`${base}${path}`, {
+      ...init,
+      headers: { ...hostHeader, "x-rid": rid, cookie: `sid=${rid}` },
+    });
+  const expectOwn = (kind: string, rid: string, value: Json, expected: Json) => {
+    if (JSON.stringify(value) !== JSON.stringify(expected))
+      fail(`${kind} ${rid}: got ${JSON.stringify(value)}, wanted ${JSON.stringify(expected)}`);
+  };
+  let total = 0;
+
+  const one = async (round: number, i: number) => {
+    const rid = randomId(round, i);
+    const delays = [rand(8), rand(8), rand(8)].join(",");
+    total++;
+    switch (i % 10) {
+      case 0:
+      case 1: {
+        const alloc = i % 2 ? "&alloc=1" : "";
+        const up = upstream ? `&up=${encodeURIComponent(upstream)}` : "";
+        const r = await get(`/mix?d=${delays}${alloc}${up}`, rid);
+        const body: {
+          rid: string;
+          steps: {
+            rid: string;
+            cookie: string;
+            url: string;
+            method: string;
+            env: string;
+            ctx: boolean;
+            cf: boolean;
+            headers: boolean;
+          }[];
+          mine: { id: string; text: string; list: string };
+          extra: string;
+          xrid: string;
+          upstream?: { id: string; header: string };
+        } = await r.json();
+        expectOwn("mix.rid", rid, body.rid, rid);
+        expectOwn("mix.header", rid, r.headers.get("x-rid"), rid);
+        expectOwn("mix.echo", rid, r.headers.get("x-echo"), rid);
+        for (const s of body.steps) {
+          expectOwn("mix.step.rid", rid, s.rid, rid);
+          expectOwn("mix.step.cookie", rid, s.cookie, `sid=${rid}`);
+          expectOwn("mix.step.url", rid, new URL(s.url).searchParams.get("d"), delays);
+          expectOwn("mix.step.flags", rid, [s.method, s.env, s.ctx, s.cf, s.headers], ["GET", "hi", true, true, true]);
+        }
+        expectOwn("mix.mine", rid, [body.mine.id, body.mine.text], [rid, "t-" + rid]);
+        expectOwn("mix.list", rid, body.mine.list, Array.from({ length: 20 }, (_, k) => `${rid}:${k}`).join(","));
+        expectOwn("mix.extra", rid, [body.extra, body.xrid], [rid, rid]);
+        if (upstream) expectOwn("mix.upstream", rid, [body.upstream?.id, body.upstream?.header], [rid, rid]);
+        break;
+      }
+      case 2: {
+        const r = await get(`/promise?d=${delays}`, rid);
+        const body: {
+          rid: string;
+          all: string[];
+          raced: string;
+          settled: string[];
+          again: string;
+        } = await r.json();
+        expectOwn(
+          "promise",
+          rid,
+          [body.rid, body.all, body.raced, body.settled, body.again],
+          [rid, [rid, rid, rid], rid, ["e-" + rid, rid], rid],
+        );
+        break;
+      }
+      case 3: {
+        const r = await get(`/boom?d=${delays}`, rid);
+        if (r.status !== 500) fail(`boom ${rid}: status ${r.status}`);
+        const text = await r.text();
+        if (text.includes("boom-")) fail(`boom ${rid}: the error text reached the client: ${text}`);
+        break;
+      }
+      case 4: {
+        const r = await get(`/catch?d=${delays}`, rid);
+        const body: { rid: string; message: string; again: string } = await r.json();
+        expectOwn("catch", rid, [body.rid, body.message, body.again], [rid, "caught-" + rid, rid]);
+        break;
+      }
+      case 5: {
+        const r = await get(`/reject?d=${delays}`, rid);
+        const body: { rid: string; ok: boolean; again: string } = await r.json();
+        expectOwn("reject", rid, [r.status, body.rid, body.ok, body.again], [200, rid, true, rid]);
+        break;
+      }
+      case 6: {
+        // A request body that arrives in pieces while others are being served.
+        const pieces = 3 + rand(4);
+        const data: Uint8Array[] = [];
+        let sum = 0;
+        let bytes = 0;
+        for (let p = 0; p < pieces; p++) {
+          const chunk = new Uint8Array(1000 + rand(3000));
+          for (let k = 0; k < chunk.length; k++) chunk[k] = rand(256);
+          for (const b of chunk) sum = (sum + b) % 1000003;
+          bytes += chunk.length;
+          data.push(chunk);
+        }
+        const stream = new ReadableStream<Uint8Array>({
+          async pull(controller) {
+            const next = data.shift();
+            if (!next) return controller.close();
+            await Bun.sleep(1 + rand(5));
+            controller.enqueue(next);
+          },
+        });
+        // SAFETY: Bun accepts a streamed body with duplex: "half"; its RequestInit type does not list the field.
+        const r = await get(`/body`, rid, { method: "POST", body: stream, duplex: "half" } as RequestInit);
+        const body: { rid: string; bytes: number; sum: number; again: string } = await r.json();
+        expectOwn("body", rid, [body.rid, body.bytes, body.sum, body.again], [rid, bytes, sum, rid]);
+        break;
+      }
+      case 7: {
+        const r = await get(`/stream?d=${delays}`, rid);
+        const text = await r.text();
+        const lines = text.trim().split("\n");
+        expectOwn(
+          "stream",
+          rid,
+          lines,
+          Array.from({ length: 8 }, (_, k) => `${rid}:${k}:${rid}`),
+        );
+        break;
+      }
+      case 8: {
+        if (options.store && round % 2 === 0) {
+          const r = await get(`/store?d=${delays}`, rid);
+          const body: { rid: string; kv: string; row: string; again: string } = await r.json();
+          expectOwn("store", rid, [body.rid, body.kv, body.row, body.again], [rid, rid, "v-" + rid, rid]);
+        } else {
+          const r = await get(`/pair?d=${rand(4)}`, rid);
+          const body: { rid: string; log: string[] } = await r.json();
+          expectPair(rid, body);
+        }
+        break;
+      }
+      case 9: {
+        const text = "x".repeat(2000 + rand(5000)) + rid;
+        const r = await get(`/text?d=${delays}`, rid, { method: "POST", body: text });
+        const body: { rid: string; bytes: number; sum: number; again: string } = await r.json();
+        let sum = 0;
+        for (let k = 0; k < text.length; k++) sum = (sum + text.charCodeAt(k)) % 1000003;
+        expectOwn("text", rid, [body.rid, body.bytes, body.sum, body.again], [rid, text.length, sum, rid]);
+        break;
+      }
+    }
+    if (i % 10 === 0) {
+      // ctx.waitUntil ran with this request's values, whatever ran in between.
+      await Bun.sleep(40);
+      const w: {
+        rid: string;
+        again: string;
+        mine: string;
+        ctx: boolean;
+      } | null = await (await get(`/wu`, rid)).json();
+      expectOwn("waitUntil", rid, w, { rid, again: rid, mine: rid, ctx: true });
+    }
+  };
+
+  const expectPair = (rid: string, body: { rid: string; log: string[] }) => {
+    const want: string[] = [];
+    for (let k = 0; k < 4; k++) want.push(`s:${rid}:${k}`, `c:echo:${rid}:${k}:${rid}`);
+    const sorted = (a: string[]) => [...a].sort();
+    expectOwn("pair", rid, [body.rid, sorted(body.log)], [rid, sorted(want)]);
+  };
+
+  const socket = async (round: number, i: number) => {
+    const rid = randomId(round, i);
+    total++;
+    // SAFETY: Bun takes a headers option on the WebSocket constructor; the DOM type does not list it.
+    const ws = new WebSocket(`${base.replace("http:", "ws:")}/ws?d=${rand(6)}`, {
+      headers: { ...hostHeader, "x-rid": rid },
+    } as never);
+    const got: string[] = [];
+    await new Promise<void>((done) => {
+      const timer = setTimeout(() => {
+        fail(`ws ${rid}: timed out with ${got.join(",")}`);
+        done();
+      }, 15000);
+      ws.addEventListener("open", () => {
+        for (let k = 0; k < 4; k++) ws.send(`m${k}`);
+      });
+      ws.addEventListener("message", (e) => {
+        got.push(String(e.data));
+        if (got.length === 4) {
+          clearTimeout(timer);
+          ws.close(1000, "done");
+          done();
+        }
+      });
+      ws.addEventListener("error", () => {
+        clearTimeout(timer);
+        fail(`ws ${rid}: error`);
+        done();
+      });
+    });
+    expectOwn(
+      "ws",
+      rid,
+      got.sort(),
+      [0, 1, 2, 3].map((k) => `${rid}|m${k}|${rid}`),
+    );
+  };
+
+  for (let round = 0; round < rounds; round++) {
+    const work: (() => Promise<void>)[] = [];
+    for (let i = 0; i < requests; i++) {
+      work.push(() =>
+        one(round, i).catch((error) => {
+          fail(`request ${round}-${i} threw ${String(error)}`);
+        }),
+      );
+    }
+    if (options.clientSockets) {
+      for (let i = 0; i < 6; i++)
+        work.push(() => socket(round, i).catch((error) => fail(`socket ${round}-${i} threw ${String(error)}`)));
+    }
+    // At most `limit` at a time, started in order.
+    let next = 0;
+    const runner = async () => {
+      while (next < work.length) {
+        const job = work[next++];
+        if (job) await job();
+      }
+    };
+    await Promise.all(Array.from({ length: Math.min(options.limit ?? work.length, work.length) }, runner));
+  }
+  // Nothing shared between requests: no two saw the same cf, headers or ctx object.
+  const report: {
+    maxActive: number;
+    cfShared: boolean;
+    headersShared: boolean;
+    ctxShared: boolean;
+  } = await (await get("/report", "report")).json();
+  if (report.cfShared || report.headersShared || report.ctxShared)
+    fail(`objects shared across requests: ${JSON.stringify(report)}`);
+  if (report.maxActive < 2) fail(`requests never overlapped (max ${report.maxActive} at once)`);
+  assert(Array.isArray(failures));
+  return { requests: total, failures };
+}

package/test/fixtures/als-app.js

@@ -0,0 +1,136 @@
+// AsyncLocalStorage as Workers has it (nodejs_compat). The same file runs on workerd for the
+// comparison, where the class comes from node:async_hooks; here the prelude's global stands in
+// until the CLI maps the import.
+const ALS = globalThis.__sbAlsForTest || globalThis.AsyncLocalStorage;
+const als = new ALS();
+const other = new ALS();
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+async function run(path, id, delay) {
+  if (path === "/basic") {
+    const out = [];
+    out.push(als.getStore());
+    out.push(als.run("a", () => als.getStore()));
+    out.push(als.run("a", () => als.run("b", () => als.getStore())));
+    out.push(als.run("a", () => als.run("b", () => als.exit(() => als.getStore()))));
+    out.push(als.run("a", () => other.run("x", () => [als.getStore(), other.getStore()])));
+    out.push(als.getStore());
+    try {
+      als.run("t", () => {
+        throw new Error("boom");
+      });
+    } catch (e) {
+      out.push(["threw", e.message, als.getStore()]);
+    }
+    out.push(als.run("args", (x, y) => [als.getStore(), x, y], 1, 2));
+    out.push(als.run("v", () => 7));
+    return out;
+  }
+  if (path === "/await") {
+    return als.run({ id }, async () => {
+      const seen = [als.getStore().id];
+      await sleep(delay);
+      seen.push(als.getStore().id);
+      await null;
+      seen.push(als.getStore().id);
+      await Promise.resolve().then(() => seen.push(als.getStore().id));
+      await new Promise((resolve) =>
+        setTimeout(() => {
+          seen.push(als.getStore().id);
+          resolve();
+        }, delay),
+      );
+      await Promise.all([
+        sleep(delay),
+        (async () => {
+          await sleep(1);
+          seen.push(als.getStore().id);
+        })(),
+      ]);
+      const viaThen = await new Promise((resolve) => {
+        sleep(delay).then(() => resolve(als.getStore().id));
+      });
+      seen.push(viaThen);
+      queueMicrotask(() => seen.push("q" + als.getStore().id));
+      await sleep(1);
+      let ticks = 0;
+      await new Promise((resolve) => {
+        const timer = setInterval(() => {
+          seen.push("i" + als.getStore().id);
+          if (++ticks === 2) {
+            clearInterval(timer);
+            resolve();
+          }
+        }, 1);
+      });
+      try {
+        await Promise.reject(new Error("r"));
+      } catch (e) {
+        seen.push("c" + als.getStore().id);
+      }
+      await Promise.allSettled([Promise.reject(new Error("s"))]);
+      seen.push("s" + als.getStore().id);
+      return seen;
+    });
+  }
+  if (path === "/bind") {
+    const snapped = als.run("captured", () => ALS.snapshot());
+    const bound = () => snapped(() => als.getStore());
+    const snap = als.run("snap", () => ALS.snapshot());
+    const results = [bound(), als.run("other", () => bound()), snap(() => als.getStore()), als.getStore()];
+    await sleep(1);
+    results.push(
+      await als.run("later", async () => {
+        await sleep(1);
+        return bound();
+      }),
+    );
+    return results;
+  }
+  if (path === "/nested-async") {
+    const inner = async () => {
+      await sleep(delay);
+      return als.getStore();
+    };
+    const a = als.run("outer", async () => {
+      const x = await inner();
+      const y = await als.run("inner", () => inner());
+      const z = await inner();
+      return [x, y, z, als.getStore()];
+    });
+    return await a;
+  }
+  if (path === "/leak") {
+    // A run() that finished leaves nothing behind, even while its async work is pending.
+    let pending;
+    als.run("gone", () => {
+      pending = sleep(delay);
+    });
+    const before = als.getStore();
+    await pending;
+    return [before, als.getStore()];
+  }
+  return null;
+}
+
+export default {
+  async fetch(request, env, ctx) {
+    const url = new URL(request.url);
+    const id = url.searchParams.get("id") || "";
+    const delay = Number(url.searchParams.get("d") || 1);
+    if (url.pathname === "/wu") {
+      als.run({ id }, () => {
+        ctx.waitUntil(
+          (async () => {
+            await sleep(delay);
+            globalThis.__alsWu = als.getStore().id;
+          })(),
+        );
+      });
+      return new Response("scheduled");
+    }
+    if (url.pathname === "/wu-read") return new Response(String(globalThis.__alsWu));
+    const result = await run(url.pathname, id, delay);
+    return Response.json(result);
+  },
+};

package/test/fixtures/concurrent-app.js

@@ -0,0 +1,229 @@
+// The app under test in native-concurrent-requests.ts: every route keeps its own request's
+// values in locals, awaits on timers, fetch(), body streams, KV, D1 and WebSockets, and
+// reports what it saw before and after each await. A reply that holds another request's id
+// is a leak between interleaved requests. Written to the subset every host compiles.
+const seenCf = [];
+const seenHeaders = [];
+const seenCtx = [];
+const wakeups = {};
+let active = 0;
+let maxActive = 0;
+let dbReady = false;
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+async function handle(request, env, ctx) {
+  {
+    const url = new URL(request.url);
+    const path = url.pathname;
+    const rid = request.headers.get("x-rid") || url.searchParams.get("id") || "";
+    const delays = (url.searchParams.get("d") || "3,3,3").split(",").map(Number);
+    const snap = () => ({
+      rid: request.headers.get("x-rid"),
+      cookie: request.headers.get("cookie"),
+      url: request.url,
+      method: request.method,
+      env: env.GREETING,
+      ctx: ctx === myCtx,
+      cf: request.cf === myCf,
+      headers: request.headers === myHeaders,
+    });
+    const myCtx = ctx;
+    const myCf = request.cf;
+    const myHeaders = request.headers;
+    seenCf.push(myCf);
+    seenHeaders.push(myHeaders);
+    seenCtx.push(ctx);
+
+    if (path === "/report") {
+      return Response.json({
+        n: seenCf.length,
+        maxActive,
+        cfShared: new Set(seenCf).size !== seenCf.length,
+        headersShared: new Set(seenHeaders).size !== seenHeaders.length,
+        ctxShared: new Set(seenCtx).size !== seenCtx.length,
+      });
+    }
+    if (path === "/wu") return Response.json(wakeups[rid] || null);
+
+    if (path === "/mix") {
+      // Locals that must survive every await and every collection in between.
+      const mine = { id: rid, list: [], text: "t-" + rid };
+      for (let i = 0; i < 20; i++) mine.list.push(rid + ":" + i);
+      const out = { rid, steps: [snap()] };
+      const extra = new Headers(request.headers);
+      extra.set("x-mine", rid);
+      ctx.waitUntil(
+        (async () => {
+          await sleep(5 + delays[0]);
+          wakeups[rid] = { rid, again: request.headers.get("x-rid"), mine: mine.id, ctx: ctx === myCtx };
+        })(),
+      );
+      for (let i = 0; i < delays.length; i++) {
+        await sleep(delays[i]);
+        if (url.searchParams.get("alloc")) {
+          // Garbage between awaits: forces collections while other requests are suspended.
+          let junk = [];
+          for (let k = 0; k < 40; k++) junk.push("j".repeat(2000 + k) + k);
+          junk = null;
+        }
+        out.steps.push(snap());
+      }
+      const upstream = url.searchParams.get("up");
+      if (upstream) {
+        const r = await fetch(upstream + "/echo?id=" + rid + "&ms=" + delays[0], { headers: { "x-rid": rid } });
+        out.upstream = await r.json();
+        out.steps.push(snap());
+      }
+      out.mine = { id: mine.id, text: mine.text, list: mine.list.join(",") };
+      out.extra = extra.get("x-mine");
+      out.xrid = extra.get("x-rid");
+      return Response.json(out, { headers: { "x-rid": rid, "x-echo": rid } });
+    }
+
+    if (path === "/promise") {
+      // A promise returned from an async function and adopted by another, with timers between.
+      const inner = async () => {
+        await sleep(delays[0]);
+        return { rid, from: "inner", seen: request.headers.get("x-rid") };
+      };
+      const outer = async () => {
+        const v = await inner();
+        await sleep(delays[1] || 1);
+        return v;
+      };
+      const all = await Promise.all([outer(), outer(), inner()]);
+      const raced = await Promise.race([sleep(50).then(() => "slow"), sleep(delays[0]).then(() => rid)]);
+      const settled = await Promise.allSettled([Promise.reject(new Error("e-" + rid)), Promise.resolve(rid)]);
+      return Response.json({
+        rid,
+        all: all.map((x) => x.seen),
+        raced,
+        settled: [settled[0].reason.message, settled[1].value],
+        again: request.headers.get("x-rid"),
+      });
+    }
+
+    if (path === "/boom") {
+      await sleep(delays[0]);
+      throw new Error("boom-" + rid);
+    }
+    if (path === "/catch") {
+      try {
+        await sleep(delays[0]);
+        throw new Error("caught-" + rid);
+      } catch (error) {
+        await sleep(delays[1] || 1);
+        return Response.json({ rid, message: error.message, again: request.headers.get("x-rid") });
+      }
+    }
+    if (path === "/reject") {
+      // Nothing waits on this rejection: the request and its neighbours go on.
+      Promise.reject(new Error("unhandled-" + rid));
+      await sleep(delays[0]);
+      return Response.json({ rid, ok: true, again: request.headers.get("x-rid") });
+    }
+
+    if (path === "/body") {
+      // The body is read in pieces with a timer between each, other requests interleaving.
+      const reader = request.body.getReader();
+      let bytes = 0;
+      let sum = 0;
+      let pieces = 0;
+      for (;;) {
+        const { value, done } = await reader.read();
+        if (done) break;
+        pieces++;
+        bytes += value.length;
+        for (let i = 0; i < value.length; i++) sum = (sum + value[i]) % 1000003;
+        await sleep(1);
+      }
+      return Response.json({ rid, bytes, sum, pieces, again: request.headers.get("x-rid") });
+    }
+    if (path === "/text") {
+      const text = await request.text();
+      await sleep(delays[0]);
+      let sum = 0;
+      for (let i = 0; i < text.length; i++) sum = (sum + text.charCodeAt(i)) % 1000003;
+      return Response.json({ rid, bytes: text.length, sum, again: request.headers.get("x-rid") });
+    }
+
+    if (path === "/stream") {
+      let i = 0;
+      const n = 8;
+      const stream = new ReadableStream({
+        async pull(controller) {
+          await sleep(delays[0]);
+          if (i === n) {
+            controller.close();
+            return;
+          }
+          controller.enqueue(new TextEncoder().encode(rid + ":" + i + ":" + request.headers.get("x-rid") + "\n"));
+          i++;
+        },
+      });
+      return new Response(stream, { headers: { "content-type": "text/plain", "x-rid": rid } });
+    }
+
+    if (path === "/store") {
+      if (!dbReady) {
+        dbReady = true;
+        await env.DB.exec("CREATE TABLE IF NOT EXISTS t (rid TEXT, v TEXT)");
+      }
+      await env.KV.put("k-" + rid, rid);
+      await sleep(delays[0]);
+      const kv = await env.KV.get("k-" + rid);
+      await env.DB.prepare("INSERT INTO t (rid, v) VALUES (?, ?)")
+        .bind(rid, "v-" + rid)
+        .run();
+      await sleep(delays[1] || 1);
+      const row = await env.DB.prepare("SELECT v FROM t WHERE rid = ?").bind(rid).first();
+      return Response.json({ rid, kv, row: row && row.v, again: request.headers.get("x-rid") });
+    }
+
+    if (path === "/pair") {
+      // A WebSocketPair that stays in the worker: messages with timers between them.
+      const [client, server] = Object.values(new WebSocketPair());
+      server.accept();
+      client.accept();
+      const log = [];
+      server.addEventListener("message", (e) => {
+        log.push("s:" + e.data);
+        server.send("echo:" + e.data + ":" + request.headers.get("x-rid"));
+      });
+      client.addEventListener("message", (e) => log.push("c:" + e.data));
+      for (let i = 0; i < 4; i++) {
+        client.send(rid + ":" + i);
+        await sleep(delays[0]);
+      }
+      await sleep(5);
+      client.close(1000, rid);
+      return Response.json({ rid, log });
+    }
+
+    if (path === "/ws") {
+      // A client socket (hosts that carry them): each message is answered after a timer.
+      if (request.headers.get("Upgrade") !== "websocket") return new Response("expected websocket", { status: 426 });
+      const [client, server] = Object.values(new WebSocketPair());
+      server.accept();
+      server.addEventListener("message", async (e) => {
+        await sleep(delays[0]);
+        server.send(rid + "|" + e.data + "|" + request.headers.get("x-rid"));
+      });
+      return new Response(null, { status: 101, webSocket: client });
+    }
+
+    return new Response("ok " + rid);
+  }
+}
+
+export default {
+  async fetch(request, env, ctx) {
+    active++;
+    if (active > maxActive) maxActive = active;
+    try {
+      return await handle(request, env, ctx);
+    } finally {
+      active--;
+    }
+  },
+};

package/test/native-async-local-storage.ts

@@ -0,0 +1,97 @@
+import assert from "node:assert/strict";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+// AsyncLocalStorage (design 02, milestone 2): the store follows the control flow across
+// awaits, promise reactions, timers, intervals, microtasks and ctx.waitUntil, and many
+// requests interleaved in one process each see only their own. The expected values are what
+// workerd (nodejs_compat) answers for test/fixtures/als-app.js.
+const cli = process.env.SB_CLI;
+if (!cli) {
+  console.log("skipped: set SB_CLI to a sproutboat-cli checkout linked to this checkout (it builds the sprouts)");
+  process.exit(0);
+}
+
+function freePort(): number {
+  const listener = Bun.listen({ hostname: "127.0.0.1", port: 0, socket: { data() {} } });
+  const port = listener.port;
+  listener.stop(true);
+  return port;
+}
+
+const workdir = mkdtempSync(join(tmpdir(), "sb-native-als-"));
+let server: ReturnType<typeof Bun.spawn> | undefined;
+try {
+  const project = join(workdir, "app");
+  mkdirSync(join(project, "src"), { recursive: true });
+  writeFileSync(join(project, "src/index.js"), readFileSync(new URL("./fixtures/als-app.js", import.meta.url)));
+  writeFileSync(
+    join(project, "sproutboat.jsonc"),
+    JSON.stringify({ name: "als", main: "src/index.js", compatibility_date: process.env.SB_COMPAT ?? "2026-11-01" }),
+  );
+  const built = Bun.spawnSync(["bun", join(cli, "src/main.ts"), "build", "--standalone", "--target", "host"], {
+    cwd: project,
+    stdout: "inherit",
+    stderr: "inherit",
+  });
+  assert.equal(built.exitCode, 0, "the CLI could not build the sprout");
+  const port = freePort();
+  server = Bun.spawn([join(project, "dist/als")], {
+    cwd: project,
+    env: { ...process.env, PORT: String(port), SB_DATA_DIR: join(project, "data") },
+    stdout: "ignore",
+    stderr: "inherit",
+  });
+  const base = `http://127.0.0.1:${port}`;
+  let ready = false;
+  for (let attempt = 0; attempt < 100 && !ready; attempt++) {
+    try {
+      await fetch(`${base}/none`, { signal: AbortSignal.timeout(500) });
+      ready = true;
+    } catch {
+      if (server.exitCode !== null) break;
+      await Bun.sleep(100);
+    }
+  }
+  assert(ready, "the standalone app did not start");
+  const get = async (path: string) => (await fetch(`${base}${path}`)).json();
+
+  assert.deepEqual(await get("/basic"), [
+    null,
+    "a",
+    "b",
+    null,
+    ["a", "x"],
+    null,
+    ["threw", "boom", null],
+    ["args", 1, 2],
+    7,
+  ]);
+  const steps = (id: string) => [id, id, id, id, id, id, id, `q${id}`, `i${id}`, `i${id}`, `c${id}`, `s${id}`];
+  assert.deepEqual(await get("/await?id=one&d=2"), steps("one"));
+  assert.deepEqual(await get("/bind"), ["captured", "captured", "snap", null, "captured"]);
+  assert.deepEqual(await get("/nested-async?d=2"), ["outer", "inner", "outer", "outer"]);
+  assert.deepEqual(await get("/leak?d=2"), [null, null]);
+  await (await fetch(`${base}/wu?id=wu1&d=20`)).text();
+  await Bun.sleep(100);
+  assert.equal(await (await fetch(`${base}/wu-read`)).text(), "wu1");
+  console.log(
+    "run, exit and snapshot behave as workerd's; the store follows awaits, timers, intervals, microtasks and waitUntil",
+  );
+
+  // Many requests at once, each with its own store and its own delays.
+  const ids = Array.from({ length: 60 }, (_, i) => `req${i}`);
+  const answers = await Promise.all(ids.map((id, i) => get(`/await?id=${id}&d=${1 + (i % 7)}`)));
+  ids.forEach((id, i) => assert.deepEqual(answers[i], steps(id), `request ${id} saw another request's store`));
+  const nested = await Promise.all(ids.map((id, i) => get(`/nested-async?id=${id}&d=${1 + (i % 5)}`)));
+  nested.forEach((answer) => assert.deepEqual(answer, ["outer", "inner", "outer", "outer"]));
+  assert.equal(server.exitCode, null, "the server exited");
+  console.log("60 interleaved requests each saw only their own store at every await");
+} finally {
+  if (server) {
+    server.kill(9);
+    await server.exited;
+  }
+  rmSync(workdir, { recursive: true, force: true });
+}

package/test/native-concurrent-requests.ts

@@ -0,0 +1,87 @@
+import assert from "node:assert/strict";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { drive, startUpstream } from "./concurrent-driver";
+
+// Concurrent requests in one process (design 02, milestone 1). A standalone binary serves many
+// requests at once: they interleave on timers, request and response body streams, KV, D1 and
+// in-worker WebSockets, and each reply must hold only its own request's values (headers, body,
+// cookie, env, ctx, cf, errors, ctx.waitUntil results). The same app and driver run against a
+// sproutd worker (test/concurrency-smoke.py, which serves up to 8 requests per process).
+const cli = process.env.SB_CLI;
+if (!cli) {
+  console.log("skipped: set SB_CLI to a sproutboat-cli checkout linked to this checkout (it builds the sprouts)");
+  process.exit(0);
+}
+
+function freePort(): number {
+  const listener = Bun.listen({ hostname: "127.0.0.1", port: 0, socket: { data() {} } });
+  const port = listener.port;
+  listener.stop(true);
+  return port;
+}
+
+const workdir = mkdtempSync(join(tmpdir(), "sb-native-concurrent-"));
+const upstream = startUpstream();
+let server: ReturnType<typeof Bun.spawn> | undefined;
+try {
+  const project = join(workdir, "app");
+  mkdirSync(join(project, "src"), { recursive: true });
+  writeFileSync(join(project, "src/index.js"), readFileSync(new URL("./fixtures/concurrent-app.js", import.meta.url)));
+  writeFileSync(
+    join(project, "sproutboat.jsonc"),
+    JSON.stringify({
+      name: "conc",
+      main: "src/index.js",
+      compatibility_date: process.env.SB_COMPAT ?? "2026-11-01",
+      vars: { GREETING: "hi" },
+      kv_namespaces: ["KV"],
+      d1_databases: ["DB"],
+    }),
+  );
+  const built = Bun.spawnSync(["bun", join(cli, "src/main.ts"), "build", "--standalone", "--target", "host"], {
+    cwd: project,
+    stdout: "inherit",
+    stderr: "inherit",
+  });
+  assert.equal(built.exitCode, 0, "the CLI could not build the sprout");
+  const port = freePort();
+  server = Bun.spawn([join(project, "dist/conc")], {
+    cwd: project,
+    env: { ...process.env, PORT: String(port), SB_EGRESS_ALLOW: "127.0.0.1", SB_DATA_DIR: join(project, "data") },
+    stdout: "ignore",
+    stderr: "ignore",
+  });
+  const base = `http://127.0.0.1:${port}`;
+  let ready = false;
+  for (let attempt = 0; attempt < 100 && !ready; attempt++) {
+    try {
+      await fetch(`${base}/ping`, { signal: AbortSignal.timeout(500) });
+      ready = true;
+    } catch {
+      if (server.exitCode !== null) break;
+      await Bun.sleep(100);
+    }
+  }
+  assert(ready, "the standalone app did not start");
+
+  const { requests, failures } = await drive({
+    base,
+    upstream: `http://127.0.0.1:${upstream.port}`,
+    requests: Number(process.env.SB_CONC_REQUESTS ?? 40),
+    rounds: Number(process.env.SB_CONC_ROUNDS ?? 5),
+    clientSockets: false,
+    store: true,
+  });
+  assert.equal(failures.length, 0, `cross-request leaks or failures:\n${failures.slice(0, 20).join("\n")}`);
+  assert.equal(server.exitCode, null, "the server exited");
+  console.log(`Standalone: ${requests} interleaved requests, no value crossed between them`);
+} finally {
+  if (server) {
+    server.kill(9);
+    await server.exited;
+  }
+  upstream.stop(true);
+  rmSync(workdir, { recursive: true, force: true });
+}

package/test/native-cpu-requests.ts

@@ -0,0 +1,156 @@
+import assert from "node:assert/strict";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { ensurePorffor } from "../../toolchain/src/acquire";
+import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
+
+// Per-request CPU (design 02): x-sb-cpu-ms counts the thread CPU time of the slices in which one
+// request ran. A spinner interleaved with requests that wait is charged for its own work, the
+// waiters for theirs, whatever order they run in. An async handler reports it from compatibility
+// date 2026-11-02; before that only a handler that answers synchronously does.
+const handler = `export default {async fetch(request) {
+  const url = new URL(request.url);
+  const ms = Number(url.searchParams.get("ms") || 0);
+  const sleep = (n) => new Promise((resolve) => setTimeout(resolve, n));
+  // Work, not wall time: a loaded machine deschedules the process, and CPU time must not follow wall time.
+  const spin = (n) => { let x = 1; for (let i = 0; i < n * 40000; i++) x = (x * 1.0000001 + i) % 1000003; return x; };
+  if (url.pathname === "/spin") {
+    await sleep(5);
+    spin(ms / 2);
+    await sleep(5);
+    spin(ms / 2);
+    return new Response("spun");
+  }
+  if (url.pathname === "/wait") {
+    await sleep(ms);
+    return new Response("waited");
+  }
+  if (url.pathname === "/sync") {
+    spin(ms);
+    return new Response("sync");
+  }
+  return new Response("none", { status: 404 });
+}};`;
+
+function freePort(): number {
+  const listener = Bun.listen({ hostname: "127.0.0.1", port: 0, socket: { data() {} } });
+  const port = listener.port;
+  listener.stop(true);
+  return port;
+}
+
+const workdir = await mkdtemp(join(tmpdir(), "sb-native-cpu-requests-"));
+const servers: ReturnType<typeof Bun.spawn>[] = [];
+async function build(date: string): Promise<number> {
+  const porffor = await ensurePorffor();
+  const node = Bun.which("node");
+  if (!node) throw new Error("native cpu test needs node on PATH");
+  const [core, broker] = await Promise.all([readFile(preludePath, "utf8"), readFile(transportPath("broker"), "utf8")]);
+  assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
+  const generated = join(workdir, `cpu-${date}.generated.js`);
+  const binary = join(workdir, `cpu-${date}`);
+  await writeFile(
+    generated,
+    wrapNativeFetchHandler(handler, core.replace(TRANSPORT_MARKER, broker), undefined, undefined, undefined, date),
+  );
+  const compile = Bun.spawn(
+    [node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"],
+    {
+      cwd: workdir,
+      env: process.env,
+      stdout: "pipe",
+      stderr: "pipe",
+    },
+  );
+  const [exitCode, stdout, stderr] = await Promise.all([
+    compile.exited,
+    new Response(compile.stdout).text(),
+    new Response(compile.stderr).text(),
+  ]);
+  assert.equal(exitCode, 0, `Porffor native compile failed:\n${stderr}\n${stdout}`);
+  const port = freePort();
+  const server = Bun.spawn([binary], {
+    cwd: workdir,
+    env: { ...process.env, PORT: String(port) },
+    stdout: "ignore",
+    stderr: "inherit",
+  });
+  servers.push(server);
+  for (let attempt = 0; attempt < 50; attempt++) {
+    try {
+      await fetch(`http://127.0.0.1:${port}/none`, { signal: AbortSignal.timeout(500) });
+      return port;
+    } catch {
+      if (server.exitCode !== null) break;
+      await Bun.sleep(100);
+    }
+  }
+  throw new Error("compiled handler did not start");
+}
+
+try {
+  const port = await build("2026-11-02");
+  const cpu = async (path: string) => {
+    const response = await fetch(`http://127.0.0.1:${port}${path}`);
+    await response.text();
+    const header = response.headers.get("x-sb-cpu-ms");
+    assert(header !== null, `${path} has no x-sb-cpu-ms`);
+    return Number(header);
+  };
+
+  const alone = await cpu("/spin?ms=200");
+  assert(alone > 10, `a spinner alone reports only ${alone} ms`);
+  const sync = await cpu("/sync?ms=200");
+  assert(
+    sync > alone * 0.5 && sync < alone * 2,
+    `a synchronous spinner of the same work reports ${sync} ms, the async one ${alone}`,
+  );
+  const idle = await cpu("/wait?ms=50");
+  assert(idle < alone / 4 && idle < 30, `a request that only waits reports ${idle} ms (a spinner: ${alone})`);
+
+  // Together: the spinner next to eight waiters, repeated so the slices interleave differently.
+  for (let round = 0; round < 3; round++) {
+    const results = await Promise.all([
+      cpu("/spin?ms=200"),
+      ...Array.from({ length: 8 }, (_, i) => cpu(`/wait?ms=${150 + i * 20}`)),
+    ]);
+    const [spinner, ...waiters] = results;
+    assert(
+      spinner > alone * 0.5 && spinner < alone * 2,
+      `round ${round}: the spinner reports ${spinner} ms, alone it did ${alone}`,
+    );
+    for (const waiter of waiters)
+      assert(
+        waiter < alone / 4 && waiter < 60,
+        `round ${round}: a waiter was charged ${waiter} ms (the spinner: ${spinner})`,
+      );
+  }
+  // Two spinners at once are each charged their own work, not both.
+  const [a, b] = await Promise.all([cpu("/spin?ms=200"), cpu("/spin?ms=200")]);
+  assert(
+    a > alone * 0.5 && a < alone * 1.6 && b > alone * 0.5 && b < alone * 1.6,
+    `two spinners report ${a} and ${b} ms, one alone ${alone}`,
+  );
+  console.log(`per-request CPU holds under interleaving (a spinner ${alone.toFixed(0)} ms, waiters a few ms)`);
+
+  // Before 2026-11-02 an async handler still reports nothing.
+  const oldPort = await build("2026-11-01");
+  const old = await fetch(`http://127.0.0.1:${oldPort}/spin?ms=20`);
+  await old.text();
+  assert.equal(old.headers.get("x-sb-cpu-ms"), null, "an async handler is stamped before 2026-11-02");
+  const oldSync = await fetch(`http://127.0.0.1:${oldPort}/sync?ms=20`);
+  await oldSync.text();
+  assert.equal(
+    oldSync.headers.get("x-sb-cpu-ms"),
+    null,
+    "this handler is async, so it is not stamped before 2026-11-02",
+  );
+  console.log("before 2026-11-02 an async handler is not stamped");
+} finally {
+  for (const server of servers) {
+    server.kill(9);
+    await server.exited;
+  }
+  await rm(workdir, { recursive: true, force: true });
+}