@thomas.f/prnext 0.1.11-alpha → 0.1.12-alpha

package/runtime/app-render.mjs

@@ -1,4 +1,5 @@
 import React from 'react';
+import diagnostics from '../compat/diagnostics.cjs';
 import { runtimeProfile } from './profile.mjs';
 import { fontPreloads } from './font-preload.mjs';
 import { advancedRoutingSources } from './app-routing-state.mjs';
@@ -25,10 +26,14 @@ import { partialArtifact, partialShell } from './app-partial.mjs';
 import { partialKeyMap } from './app-partial-model.mjs';
 import { partialIdentity } from './partial-artifact-cache.mjs';
 import { isDraftRequest } from '../compat/draft.cjs';
+import { createRscLifecycle } from './rsc-lifecycle.mjs';
+import { trackRequestWork } from './request-work.mjs';
+import { createRscWorkWatchdog } from './rsc-work-watchdog.mjs';
 
 installFetchCache();
 
 const workers = new Map();
+const lifecycles = new WeakMap();
 const metadata = new WeakMap();
 const artifacts = new WeakMap();
 const edgeManifests = new WeakMap();
@@ -97,6 +102,7 @@ globalThis.__webpack_chunk_load__ = id => {
 
 function getWorker(production) {
   if (workers.has(production)) return workers.get(production);
+  const created = diagnostics.enabled ? performance.now() : 0;
   const current = new Worker(new URL('./rsc-worker.mjs', import.meta.url), {
     execArgv: ['--conditions=react-server'], stdout: true, stderr: true,
     // Production nursery policy; an explicit Node semi-space flag takes
@@ -105,37 +111,68 @@ function getWorker(production) {
     env: { ...process.env, NODE_ENV: production ? 'production' : 'development' },
   });
   workers.set(production, current);
+  if (diagnostics.enabled) {
+    current.once('online', () => diagnostics.record('wake', {phase:'rsc-online', durationMs:performance.now()-created}));
+    const ready = message => {
+      if (message.type !== 'rsc-ready') return;
+      diagnostics.record('wake', {phase:'rsc-ready', durationMs:performance.now()-created});
+      current.off('message', ready);
+    };
+    current.on('message', ready);
+  }
+  let workWatchdog;
+  const lifecycle = createRscLifecycle(() => { workWatchdog?.close(); return current.terminate(); });
+  workWatchdog = createRscWorkWatchdog({
+    probe: token => current.postMessage({ type: 'work-probe', token }),
+    retire: error => {
+      console.error('[prnext] RSC background worker stopped responding:', error);
+      return lifecycle.terminate(error);
+    },
+  });
+  lifecycles.set(current, lifecycle);
   metadata.set(current, workerMetadata(current));
   artifacts.set(current, workerArtifacts(current));
   // The HTTP worker's stdout belongs to its Rust transport. User code and React
   // diagnostics in the separate RSC environment must never corrupt that stream.
   current.stdout.pipe(process.stderr);
   current.stderr.pipe(process.stderr);
-  function fail(error) {
-    if (workers.get(production) === current) workers.delete(production);
+  function fail(error, exited = false) {
+    // Keep a retiring isolate registered until its actual exit; callers may
+    // wait for replacement but cannot start an unbounded series of retirees.
+    if (exited && workers.get(production) === current) workers.delete(production);
+    lifecycle.close(error);
+    workWatchdog.close();
     for (const [id, request] of pending) {
       if (request.worker !== current) continue;
       clearTimeout(request.timeout);
       pending.delete(id);
+      request.lease.release();
+      request.settle();
+      request.releaseWorkWatch?.();
       request.detach?.();
       request.channel?.error(error);
       request.reject(error);
     }
   }
-  current.on('message', ({ id, type, chunk, byteOffset, byteLength, done, body, status, rscError, boundaryIndex, headers, error, staticParams, staticMetadata, navigation }) => {
+  current.on('message', ({ id, type, token, chunk, byteOffset, byteLength, done, body, status, rscError, boundaryIndex, headers, error, staticParams, staticMetadata, navigation }) => {
+    if (type === 'work-responsive') { workWatchdog.ack(token); return; }
     const request = pending.get(id);
     if (!request || request.worker !== current) return;
     // A timed-out mutation can still be running after its HTTP caller leaves.
     // Its retirement marker must be honored before discarding cancelled output.
     if (error?.retireWorker) {
-      if (workers.get(production) === current) workers.delete(production);
-      void current.terminate();
+      void lifecycle.terminate(new Error(error.message)).catch(error => console.error('[prnext] RSC worker termination failed:', error));
     }
     if (request.cancelled && type !== 'settled') return;
     if (type === 'settled') {
-      if (!request.cancelled) return;
       pending.delete(id); clearTimeout(request.timeout);
-      if (!hasPending(current)) current.unref();
+      request.lease.release();
+      request.detach?.();
+      request.settle();
+      request.releaseWorkWatch?.();
+      // terminate() keeps its exit event referenced. A late settlement must
+      // not undo that reference while build publication awaits shutdown.
+      if (!hasPending(current) && !lifecycle.retiring) current.unref();
       return;
     }
     if (type === 'start') {
@@ -145,11 +182,19 @@ function getWorker(production) {
     }
     if (type === 'chunk') {
       try { request.channel.chunk(chunk, byteOffset, byteLength); }
-      catch (error) { request.channel.error(error); current.postMessage({ id, type: 'cancel' }); }
+      catch (error) { request.channel.error(error); current.postMessage({ id, type: 'cancel' }); request.cancel(error); }
       if (!done) return;
     }
-    pending.delete(id);
+    if (request.completed) {
+      if (error) console.error('[prnext] RSC background work failed:', error.stack || error.message);
+      return;
+    }
+    request.completed = true;
+    // The response deadline ends with its successful terminal frame. Cache
+    // work can legitimately continue afterwards and retains its own bounds;
+    // supervise isolate responsiveness, not total background-task duration.
     clearTimeout(request.timeout);
+    request.releaseWorkWatch = workWatchdog.add();
     request.detach?.();
     if (type === 'end' || done) request.channel.end();
     else if (error) {
@@ -171,51 +216,71 @@ function getWorker(production) {
       // ArrayBuffer overload: a view of the transferred allocation, no copy.
       request.resolve({ body: Buffer.from(body), status: status || 200, rscError, boundaryIndex, headers, staticMetadata, navigation });
     }
-    if (!hasPending(current)) current.unref();
+    // Keep only settlement bookkeeping after sending the body. The
+    // isolate can still be flushing cache writes after its terminal frame.
+    request.channel = undefined;
+    request.resolve = request.reject = () => {};
   });
   current.on('error', fail);
-  current.on('exit', code => fail(new Error(`App Router worker exited (${code})`)));
+  current.on('exit', code => fail(new Error(`App Router worker exited (${code})`), true));
   current.unref();
   return current;
 }
 
 export function closeAppRuntime() {
   const current = [...workers.values()];
-  workers.clear();
-  return Promise.all(current.map(worker => worker.terminate()));
+  return Promise.all(current.map(worker => lifecycles.get(worker).terminate()));
 }
 
-export function renderFlight(request, { softTimeoutMs = 25_000, hardTimeoutMs = 28_000, signal } = {}) {
+export async function renderFlight(request, { softTimeoutMs = 25_000, hardTimeoutMs = 28_000, signal } = {}) {
+  const deadline = performance.now() + hardTimeoutMs;
+  let current, lifecycle, lease;
+  for (;;) {
+    signal?.throwIfAborted();
+    current = getWorker(Boolean(request.production));
+    lifecycle = lifecycles.get(current);
+    if (lifecycle.retiring) {
+      await lifecycle.waitForRetirement({ signal, timeoutMs: deadline - performance.now() });
+      continue;
+    }
+    try { lease = await lifecycle.acquire({ signal, timeoutMs: deadline - performance.now() }); }
+    catch (error) { if (lifecycle.retiring) continue; throw error; }
+    if (lifecycle.closed) { lease.release(); continue; }
+    break;
+  }
   return new Promise((resolve, reject) => {
-    const current = getWorker(Boolean(request.production));
+    if (signal?.aborted) { lease.release(); reject(signal.reason); return; }
+    if (performance.now() >= deadline) { lease.release(); reject(appTimeoutError('RSC admission', hardTimeoutMs)); return; }
     current.ref();
     const id = ++nextId;
+    let settle;
+    trackRequestWork(new Promise(resolve => { settle = resolve; }), signal, { deadline, supervised: true });
     const timeout = setTimeout(() => {
       // A blocking npm dependency cannot honor an AbortSignal. Retire the
       // isolate at the hard deadline so subsequent requests can recover.
-      if (workers.get(Boolean(request.production)) === current) workers.delete(Boolean(request.production));
-      void current.terminate();
+      void lifecycle.terminate(appTimeoutError('RSC worker', hardTimeoutMs)).finally(settle).catch(error => console.error('[prnext] RSC worker termination failed:', error));
       pending.delete(id);
+      lease.release();
       const error = appTimeoutError('RSC worker', hardTimeoutMs);
+      if (entry.completed) console.error('[prnext] RSC background work failed:', error);
       entry.channel?.error(error);
       entry.detach?.();
       reject(error);
-    }, hardTimeoutMs);
-    const entry = { worker: current, resolve, reject, timeout, operation: request.operation };
+    }, Math.max(0, deadline - performance.now()));
+    const entry = { worker: current, resolve, reject, timeout, operation: request.operation, lease, settle };
     function cancel(reason) {
+      if (entry.cancelled) return;
       // Keep the independent deadline until the isolate confirms settlement.
       // A disconnected client must not disable recovery of blocked npm code.
       entry.cancelled = true;
+      lease.cancel();
       entry.detach?.();
-      // HTTP callers can leave faster than arbitrary npm work can unwind.
-      // Bound abandoned work independently of the admission of live requests.
-      if (hasPending(current, 16, true)) {
-        if (workers.get(Boolean(request.production)) === current) workers.delete(Boolean(request.production));
-        void current.terminate();
-      }
-      if (!hasPending(current)) current.unref();
+      // Pause new work at 16 abandoned requests while their acknowledgements
+      // settle. Existing mutation/cache work keeps its original hard deadline.
+      if (!hasPending(current) && !lifecycle.retiring) current.unref();
       reject(reason instanceof Error ? reason : new Error('App Router response was cancelled'));
     }
+    entry.cancel = cancel;
     if (request.stream) entry.channel = parentStreamChannel(current, id, cancel);
     if (signal) {
       const onAbort = () => {
@@ -225,11 +290,10 @@ export function renderFlight(request, { softTimeoutMs = 25_000, hardTimeoutMs =
       };
       entry.detach = () => signal.removeEventListener('abort', onAbort);
       signal.addEventListener('abort', onAbort, { once: true });
-      if (signal.aborted) { clearTimeout(timeout); onAbort(); return; }
     }
     pending.set(id, entry);
     try {
-      const wire = { ...request, renderTimeoutMs: softTimeoutMs };
+      const wire = { ...request, renderTimeoutMs: Math.min(softTimeoutMs, Math.max(1, deadline - performance.now())) };
       if (request.production) {
         const artifactId = artifacts.get(current)(wire.partialFlight);
         if (artifactId !== undefined) { wire.partialFlightId = artifactId; delete wire.partialFlight; }
@@ -243,9 +307,11 @@ export function renderFlight(request, { softTimeoutMs = 25_000, hardTimeoutMs =
     catch (error) {
       clearTimeout(timeout);
       pending.delete(id);
+      lease.release();
+      settle();
       entry.detach?.();
       reject(error);
-      if (!hasPending(current)) current.unref();
+      if (!hasPending(current) && !lifecycle.retiring) current.unref();
     }
   });
 }

package/runtime/app-stream-html.mjs

@@ -1,3 +1,4 @@
+import { htmlEnvelope } from './html-envelope.mjs';
 import React from 'react';
 import { fontPreloads } from './font-preload.mjs';
 import { isDynamicBailout } from '../compat/dynamic-bailout.cjs';
@@ -12,58 +13,6 @@ import { renderAppRecoveryShell } from './app-recovery.mjs';
 import { partialModel } from './app-partial-model.mjs';
 import { streamSelector } from './stream-select.mjs';
 
-// Do not insert bootstrap scripts inside a split HTML tag or raw-text element.
-// React may split a large inline script across arbitrary byte chunks.
-function htmlEnvelope({ resumed = false } = {}) {
-  let pending = '';
-  let closing = '';
-  let received = 0;
-  return {
-    append(text) {
-      received += Buffer.byteLength(text);
-      if (received > MAX_RESPONSE_BYTES) throw new Error('HTML response exceeds the 16 MiB PRNext limit');
-      pending += text;
-      let ready = '';
-      while (pending) {
-        const start = pending.indexOf('<');
-        if (start < 0) { ready += pending; pending = ''; break; }
-        if (start) { ready += pending.slice(0, start); pending = pending.slice(start); }
-        let end = -1;
-        if (pending.startsWith('<!--')) {
-          const comment = pending.indexOf('-->');
-          if (comment >= 0) end = comment + 2;
-        } else {
-          let quote;
-          for (let index = 1; index < pending.length; index++) {
-            const char = pending[index];
-            if (quote) { if (char === quote) quote = undefined; }
-            else if (char === '"' || char === "'") quote = char;
-            else if (char === '>') { end = index; break; }
-          }
-        }
-        if (end < 0) break;
-        const tag = pending.slice(0, end + 1);
-        const raw = /^<(script|style|textarea|title|svg|math)(?:\s|>)/i.exec(tag);
-        if (raw && !tag.endsWith('/>')) {
-          const match = new RegExp(`</${raw[1]}\\s*>`, 'i').exec(pending.slice(end + 1));
-          if (!match) break;
-          end += 1 + match.index + match[0].length;
-          ready += pending.slice(0, end); pending = pending.slice(end);
-        } else {
-          if (/^<\/(body|html)\s*>$/i.test(tag)) closing += tag;
-          else ready += tag;
-          pending = pending.slice(end + 1);
-        }
-      }
-      return ready;
-    },
-    finish() {
-      if (pending || !(resumed ? /^(?:<\/body><\/html>){1,2}$/i : /^<\/body><\/html>$/i).test(closing)) throw new Error('App Router root layout did not close its body and html elements');
-      return resumed ? '</body></html>' : closing;
-    },
-  };
-}
-
 // The SSR decoder and HTML bootstrap share each Flight allocation. Unlike
 // ReadableStream.tee(), this tap stops reading when the HTML consumer stalls.
 // Before a document shell exists, at most the overall 16 MiB response limit can

package/runtime/html-envelope.mjs

@@ -0,0 +1,73 @@
+import { MAX_RESPONSE_BYTES } from './http.mjs';
+
+// Do not insert Flight/bootstrap scripts inside a split tag or raw-text element.
+// Scan by index: ordinary tags stay in one contiguous slice, instead of creating
+// a new tail and output string for every cell of a rendered table.
+export function htmlEnvelope({ resumed = false } = {}) {
+  let pending = '';
+  let closing = '';
+  let received = 0;
+  const rawStart = /<(script|style|textarea|title|svg|math)(?:\s|>)/iy;
+  const rawEnds = new Map();
+  const documentEnd = /<\/(body|html)\s*>/iy;
+  return {
+    append(text) {
+      received += Buffer.byteLength(text);
+      if (received > MAX_RESPONSE_BYTES) throw new Error('HTML response exceeds the 16 MiB PRNext limit');
+      pending += text;
+      let cursor = 0, output = 0, ready = '';
+      while (cursor < pending.length) {
+        const start = pending.indexOf('<', cursor);
+        if (start < 0) { cursor = pending.length; break; }
+        cursor = start;
+        let end = -1;
+        if (pending.startsWith('<!--', start)) {
+          const comment = pending.indexOf('-->', start);
+          if (comment >= 0) end = comment + 2;
+        } else {
+          let quote;
+          for (let index = start + 1; index < pending.length; index++) {
+            const char = pending[index];
+            if (quote) { if (char === quote) quote = undefined; }
+            else if (char === '"' || char === "'") quote = char;
+            else if (char === '>') { end = index; break; }
+          }
+        }
+        if (end < 0) break;
+        // Most tags need no special handling. Reject their ASCII prefixes
+        // before running the raw-element and document-closing expressions;
+        // the expressions still validate every candidate in full.
+        const first = pending.charCodeAt(start + 1) | 32;
+        const second = pending.charCodeAt(start + 2) | 32;
+        const rawCandidate = first === 115 && (second === 99 || second === 116 || second === 118) ||
+          first === 116 && (second === 101 || second === 105) || first === 109 && second === 97;
+        rawStart.lastIndex = start;
+        const raw = rawCandidate && rawStart.exec(pending);
+        if (raw && pending[end - 1] !== '/') {
+          const name = raw[1].toLowerCase();
+          let pattern = rawEnds.get(name);
+          if (!pattern) { pattern = new RegExp(`</${name}\\s*>`, 'ig'); rawEnds.set(name, pattern); }
+          pattern.lastIndex = end + 1;
+          const match = pattern.exec(pending);
+          if (!match) break;
+          cursor = pattern.lastIndex;
+        } else {
+          documentEnd.lastIndex = start;
+          if (first === 47 && (second === 98 || second === 104) && documentEnd.test(pending) && documentEnd.lastIndex === end + 1) {
+            ready += pending.slice(output, start);
+            closing += pending.slice(start, end + 1);
+            output = end + 1;
+          }
+          cursor = end + 1;
+        }
+      }
+      ready += pending.slice(output, cursor);
+      pending = pending.slice(cursor);
+      return ready;
+    },
+    finish() {
+      if (pending || !(resumed ? /^(?:<\/body><\/html>){1,2}$/i : /^<\/body><\/html>$/i).test(closing)) throw new Error('App Router root layout did not close its body and html elements');
+      return resumed ? '</body></html>' : closing;
+    },
+  };
+}

package/runtime/http.mjs

@@ -184,7 +184,7 @@ export function plainResponse(status, message) {
 
 export function errorResponse(error, production = process.env.NODE_ENV === 'production') {
   console.error('[prnext]', error?.stack || error);
-  const status = [400, 504].includes(error?.statusCode) ? error.statusCode : 500;
-  const message = status === 400 ? 'Bad Request' : status === 504 ? 'Gateway Timeout' : 'Internal Server Error';
+  const status = [400, 503, 504].includes(error?.statusCode) ? error.statusCode : 500;
+  const message = status === 400 ? 'Bad Request' : status === 503 ? 'Service Unavailable' : status === 504 ? 'Gateway Timeout' : 'Internal Server Error';
   return plainResponse(status, production || status === 400 ? message : String(error?.stack || error));
 }

package/runtime/profiles.json

@@ -6,7 +6,8 @@
     "renderStarts": 16,
     "liveResponses": 32,
     "apiConcurrency": 512,
-    "responseBufferMiB": 8
+    "responseBufferMiB": 8,
+    "renderIdleSeconds": null
   },
   "compact": {
     "optimizeForSize": true,
@@ -15,16 +16,18 @@
     "renderStarts": 16,
     "liveResponses": 32,
     "apiConcurrency": 512,
-    "responseBufferMiB": 8
+    "responseBufferMiB": 8,
+    "renderIdleSeconds": 30
   },
   "balanced": {
-    "optimizeForSize": true,
-    "semiSpaceMiB": 8,
+    "optimizeForSize": false,
+    "semiSpaceMiB": 4,
     "youngGenerationMiB": 16,
     "renderStarts": 16,
     "liveResponses": 32,
     "apiConcurrency": 256,
-    "responseBufferMiB": 4
+    "responseBufferMiB": 4,
+    "renderIdleSeconds": 300
   },
   "speed": {
     "optimizeForSize": false,
@@ -33,15 +36,17 @@
     "renderStarts": 32,
     "liveResponses": 128,
     "apiConcurrency": 512,
-    "responseBufferMiB": 16
+    "responseBufferMiB": 16,
+    "renderIdleSeconds": null
   },
   "memory": {
     "optimizeForSize": true,
     "semiSpaceMiB": 2,
     "youngGenerationMiB": 4,
     "renderStarts": 8,
-    "liveResponses": 16,
+    "liveResponses": 28,
     "apiConcurrency": 64,
-    "responseBufferMiB": 1
+    "responseBufferMiB": 1,
+    "renderIdleSeconds": 30
   }
 }

package/runtime/request-work.mjs

@@ -1,7 +1,7 @@
 // Track the actual application promise as well as the HTTP wrapper. A wrapper
 // can reject on abort while npm code keeps running and retaining its context.
 export const requestWork = Symbol.for('prnext.request-work');
-export function trackRequestWork(promise, signal) {
-  signal?.[requestWork]?.(promise);
+export function trackRequestWork(promise, signal, options) {
+  signal?.[requestWork]?.(promise, options);
   return promise;
 }

package/runtime/rsc-lifecycle.mjs

@@ -0,0 +1,119 @@
+import { appTimeoutError } from './app-errors.mjs';
+
+// Per-isolate admission includes abandoned requests until the isolate confirms
+// settlement. A burst of cooperative cancellations gets time to acknowledge
+// without immediately terminating unrelated active responses.
+export function createRscLifecycle(retire, {
+  cancellationLimit = 16, maxActive = 512, maxWaiters = 512,
+} = {}) {
+  for (const [name, value] of Object.entries({ cancellationLimit, maxActive, maxWaiters })) {
+    if (!Number.isSafeInteger(value) || value <= 0) throw new TypeError(`${name} must be a positive safe integer`);
+  }
+  if (typeof retire !== 'function') throw new TypeError('retire must be a function');
+  const active = new Set(), waiters = new Set(), retirementWaiters = new Set();
+  let cancelled = 0, closedError, retirement, retired = false, retirementFailed = false, retirementError;
+  const timeoutError = milliseconds => appTimeoutError('RSC admission', milliseconds);
+  const available = () => !closedError && cancelled < cancellationLimit && active.size < maxActive;
+
+  function lease() {
+    const token = { cancelled: false };
+    active.add(token);
+    return {
+      cancel() {
+        if (!active.has(token) || token.cancelled) return;
+        token.cancelled = true;
+        cancelled++;
+        // Pressure closes admission, never shortens an existing request's
+        // deadline. Mutations and cache work may legitimately outlive callers.
+      },
+      release() {
+        if (!active.delete(token)) return;
+        if (token.cancelled) cancelled--;
+        drain();
+      },
+    };
+  }
+
+  function drain() {
+    for (const waiter of waiters) {
+      if (!available()) break;
+      waiter.cleanup();
+      if (waiter.signal?.aborted) waiter.reject(waiter.signal.reason);
+      else if (performance.now() >= waiter.deadline) waiter.reject(timeoutError(waiter.timeoutMs));
+      else waiter.resolve(lease());
+    }
+  }
+
+  function acquire({ signal, timeoutMs = 28000 } = {}) {
+    if (signal?.aborted) return Promise.reject(signal.reason);
+    if (closedError) return Promise.reject(closedError);
+    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) return Promise.reject(timeoutError(timeoutMs));
+    if (available()) return Promise.resolve(lease());
+    return queue(waiters, signal, timeoutMs);
+  }
+
+  function queue(collection, signal, timeoutMs) {
+    if (waiters.size + retirementWaiters.size >= maxWaiters) {
+      const error = new Error('App Router RSC admission queue is full');
+      error.statusCode = 503;
+      return Promise.reject(error);
+    }
+    return new Promise((resolve, reject) => {
+      let timer;
+      const onAbort = () => { waiter.cleanup(); reject(signal.reason); };
+      const waiter = { signal, timeoutMs, deadline: performance.now() + timeoutMs, resolve, reject,
+        cleanup() { collection.delete(waiter); clearTimeout(timer); signal?.removeEventListener('abort', onAbort); },
+      };
+      collection.add(waiter);
+      signal?.addEventListener('abort', onAbort, { once: true });
+      timer = setTimeout(() => { waiter.cleanup(); reject(timeoutError(timeoutMs)); }, timeoutMs);
+    });
+  }
+
+  function waitForRetirement({ signal, timeoutMs = 28000 } = {}) {
+    if (signal?.aborted) return Promise.reject(signal.reason);
+    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) return Promise.reject(timeoutError(timeoutMs));
+    if (!retirement) return Promise.reject(new Error('App Router worker is not retiring'));
+    if (retired) return retirementFailed ? Promise.reject(retirementError) : Promise.resolve();
+    return queue(retirementWaiters, signal, timeoutMs);
+  }
+
+  function finishRetirement(error, failed = false) {
+    retired = true;
+    retirementFailed = failed;
+    retirementError = error;
+    for (const waiter of retirementWaiters) {
+      waiter.cleanup();
+      if (waiter.signal?.aborted) waiter.reject(waiter.signal.reason);
+      else if (performance.now() >= waiter.deadline) waiter.reject(timeoutError(waiter.timeoutMs));
+      else if (failed) waiter.reject(error);
+      else waiter.resolve();
+    }
+  }
+
+  function close(error = new Error('App Router worker closed')) {
+    if (closedError) return;
+    closedError = error;
+    for (const waiter of waiters) { waiter.cleanup(); waiter.reject(error); }
+  }
+
+  function terminate(error = new Error('App Router worker retired')) {
+    close(error);
+    // Worker.terminate() adds an exit listener. Share exactly one call/promise
+    // across all request deadlines, cancellation pressure and shutdown paths.
+    if (!retirement) {
+      retirement = Promise.resolve().then(retire);
+      // One observer per isolate, rather than one Promise reaction retained
+      // for every caller that times out/aborts while the isolate is stopping.
+      retirement.then(() => finishRetirement(), error => finishRetirement(error, true));
+    }
+    return retirement;
+  }
+
+  return {
+    acquire, close, terminate, waitForRetirement,
+    get retiring() { return retirement ?? null; },
+    get closed() { return !!closedError; },
+    get stats() { return { active: active.size, cancelled, waiting: waiters.size + retirementWaiters.size, closed: !!closedError }; },
+  };
+}

package/runtime/rsc-work-watchdog.mjs

@@ -0,0 +1,75 @@
+// Response deadlines stop when a response completes. While its cache work is
+// still settling, probe the shared isolate's responsiveness instead of imposing
+// another deadline on legitimate asynchronous work. Fully idle isolates have
+// no watchdog timer.
+export function createRscWorkWatchdog({ probe, retire, intervalMs = 5000, timeoutMs = 30000 } = {}) {
+  if (typeof probe !== 'function' || typeof retire !== 'function') throw new TypeError('probe and retire must be functions');
+  for (const [name, value] of Object.entries({ intervalMs, timeoutMs })) {
+    if (!Number.isSafeInteger(value) || value <= 0) throw new TypeError(`${name} must be a positive safe integer`);
+  }
+  let work = 0, timer, expected, nextToken = 0, closed = false;
+
+  function clear() {
+    clearTimeout(timer);
+    timer = undefined;
+    expected = undefined;
+  }
+
+  function close() {
+    if (closed) return;
+    closed = true;
+    work = 0;
+    clear();
+  }
+
+  function fail(token, error) {
+    if (closed || !work || expected !== token) return;
+    close();
+    // Close first so concurrent timeout/probe failures cannot retire twice.
+    void Promise.resolve().then(() => retire(error)).catch(failure => {
+      console.error('[prnext] RSC work watchdog retirement failed:', failure);
+    });
+  }
+
+  function schedule() {
+    if (closed || !work || timer !== undefined) return;
+    timer = setTimeout(() => {
+      timer = undefined;
+      if (closed || !work) return;
+      const token = ++nextToken;
+      expected = token;
+      // The default exceeds the existing foreground render deadline: a
+      // synchronous foreground render must not lose its established budget.
+      timer = setTimeout(() => fail(token, new Error(`App Router worker did not acknowledge its background-work probe within ${timeoutMs} ms`)), timeoutMs);
+      timer.unref();
+      try {
+        Promise.resolve(probe(token)).catch(error => fail(token, error));
+      } catch (error) { fail(token, error); }
+    }, intervalMs);
+    timer.unref();
+  }
+
+  function add() {
+    if (closed) return () => {};
+    work++;
+    schedule();
+    let released = false;
+    return () => {
+      if (released) return;
+      released = true;
+      if (closed) return;
+      if (--work === 0) clear();
+    };
+  }
+
+  function ack(token) {
+    if (closed || !work || expected === undefined || token !== expected) return;
+    clear();
+    schedule();
+  }
+
+  return {
+    add, ack, close,
+    get stats() { return { work, scheduled: timer !== undefined, awaitingAck: expected !== undefined, closed }; },
+  };
+}