@threadedstack/wmd-web 0.0.0-stage → 0.1.12

package/src/host/jit.js

@@ -0,0 +1,1903 @@
+// The JIT door: wmd.jit_load / jit_compile / jit_sync / jit_flush / jit_known / jit_note
+// for vm.wasm in Web Workers (web/docs/host-interface.md §5; runner/src/jit.rs).
+//
+// The runner keeps one global, ordered slot list; slot k is at table index tableMin+k in
+// every thread's table (tableMin: vm.wasm's table import minimum, tableMinOf). Here the list lives in SharedArrayBuffers so any Worker can
+// read it synchronously (a Worker inside jit_sync cannot receive postMessage):
+//
+//   store.ctl   header cells (lock, flush generation, record count, ...) + counters
+//   store.recs  one record per loaded module: where its bytes are in the log, its
+//               first slot, how many functions it exports, its content hash, timings
+//   store.log   the module bytes. A flush never rewrites it, so a Worker that is reading
+//               bytes while another flushes reads valid bytes. Nothing in a machine run
+//               flushes, so in share mode (the hub below) the log is reclaimable (W31):
+//               the hub marks a record delivered once it has posted that record's Module
+//               to every port, and append() reuses the space of delivered records (see
+//               "Reclaiming the log"). Without sharing nothing is reclaimed. A Worker
+//               that cannot receive a Module the hub posted, or starts after its bytes
+//               were reused, compiles a copy from bytes the hub keeps (W31b).
+//
+// Each Worker compiles the bytes it has not compiled yet with the synchronous
+// `new WebAssembly.Module` (allowed in Workers) and keeps the Module by log offset, so
+// a module loaded twice, or again after a flush, is compiled once per Worker. Each
+// thread (one vm.wasm instance + its own table) instantiates each module once per
+// flush generation, with env.mem0/mem1 = the shared memory, env.tbl = its table and
+// hst.h0..h16 = its own vm_helper_N exports (jit.rs instantiate_in).
+
+export const TABLE_MIN = 155 // the default table import minimum (vm.wasm before W3.3); JIT slots start at the module's own, tableMinOf
+export const HELPERS = 17 // vm_helper_0 .. vm_helper_16
+
+// header (Int32 cells of store.ctl)
+export const H_LOCK = 0
+// The JS API's limit on a table's length (the same in V8, SpiderMonkey and JavaScriptCore).
+export const TABLE_MAX_ENTRIES = 10_000_000
+export const H_GEN = 1 // flush generation
+export const H_NMOD = 2 // records published (monotonic over the whole session)
+export const H_MOD_START = 3 // first record of the current generation
+export const H_NSLOTS = 4 // slots in the current generation
+export const H_LOG_USED = 5 // bytes of store.log in use
+export const H_TABLE_MAX = 6 // largest table size any thread reached
+export const H_FULL = 7 // set once an engine resource failure was seen: refuse new modules
+export const H_LOG_TAIL = 8 // records below this own no live log bytes
+export const H_LOG_LIM = 9 // end of the free run that starts at H_LOG_USED (0: up to the buffer's end)
+export const H_DELIV = 10 // deliveries the hub has marked (a counter, only ever grows)
+export const H_FAIL_D = 11 // H_DELIV + 1 at the last allocation that found no room (0: none)
+export const H_FAIL_G = 12 // ... the generation then
+export const H_FAIL_N = 13 // ... and the smallest size that failed
+export const H_NORECLAIM = 14 // set (1) once a Worker could not receive a hub Module: the log is append-only from then on
+export const JIT_OVER_BUDGET = -2 // jit_load: refused for the module budget (vm VM_JIT_OVER_BUDGET): the guest releases every module
+export const JIT_LATER = -4 // D-515: jit_load: the engine takes no code now (vm VM_JIT_LATER): the guest interprets the blocks and asks again later
+export const H_LIVE_KIB = 15 // KiB of module bytes loaded in the current generation (W34: the footprint budget)
+export const H_SLOT0 = 16 // H_NSLOTS when the current generation started (W34: slots are never rewound); live slots = H_NSLOTS - H_SLOT0
+export const H_BUDGET_KIB = 17 // D-511: a budget the engine taught us (0: none): live KiB well under where a compile ran out of code space
+export const H_MARK = 18 // D-514: use marks read so far (markUse): a record's R_USED is the last one that saw its functions entered
+export const H_MARK_KIB = 19 // D-514: KiB of modules loaded since the last markUse
+export const H_DROPS = 20 // D-514: records in store.drops (every Worker clears their table entries when it syncs)
+export const KNOWN_KEY_BYTES = 32 // W77: struct vm_known_rec's key (vm/cache.h; jit-cache.js KEY_BYTES)
+export const KNOWN_NOTE_BYTES = 56 // ... and a whole record, as jit_note passes them
+const MIN_LEARNED_KIB = 64 << 10
+const COMPILE_RETRY_MAX_MS = 1600 // D-512: tries after 50, 100, ... 1600 ms: about 3 s in all
+export const H_POOL_FULL = 21 // D-515: set while the engine's code pool is full (codePool): new modules wait
+export const HDR_INTS = 22 // P-B9: jit-snap.js reads and writes the header
+export const VM_CELLS = 1 << 21 // vm wasm_emit.h: the live flags and use marks are per table index modulo this
+const MARK_PARTS = 8 // D-514: the use marks are read each time this part of the budget was loaded
+export const KNOWN_DROPPED = -2 // D-514: jit_known's answer for a dropped block (vm cache.h VM_KNOWN_DROPPED): it is compiled at its next run
+const EVICT_SPARSE = 1 / 2 // D-514: a module where fewer of its functions ran is dropped after the cold ones
+const EVICT_KEEP = 5 / 8 // D-514: an eviction drops cold modules until the live ones fit in this part of the budget
+const EVICT_MIN = 1 / 8 // ... and frees at least this part of it, or the guest releases every module instead
+const POOL_CHECK_MS = 2000 // D-515: at most one code pool check a thread in this time
+const POOL_PROBE_N = 1500000 // D-515: loop passes of the check: about 2 ms compiled, 40 ms interpreted
+const POOL_SLOW_X = 6 // D-515: a check this many times slower than this thread's fastest means the pool is full
+const POOL_LEARN = 3 / 4 // D-515: the budget from then on, of the modules live when the pool filled
+
+// counters after the header: each a pair of Int32 cells (low word, unsigned; high word).
+// D-419: not BigInt64 cells: Atomics.add on a BigInt64Array returns a new BigInt, garbage a
+// vCPU Worker made at every jit_known (53,000 in a boot), and WebKit collects garbage late in a
+// thread holding the guest's memory (D-419, gcnudge.js).
+export const STATS = [
+  'loads', // jit_load calls
+  'compiles', // jit_compile calls (the compile-worker thread)
+  'knownAsks', // jit_known calls
+  'notes', // jit_note calls
+  'appendCompiles', // modules compiled by the thread that loaded them
+  'appendCompileNs',
+  'validateNs', // WebAssembly.validate in jit_compile when it does not compile
+  'syncs', // jit_sync passes (every jit_load/jit_flush/jit_sync and thread start)
+  'syncNs', // total time inside sync, compiles and instantiations included
+  'syncCompiles', // modules a thread compiled during sync (it had not seen the bytes)
+  'syncCompileNs',
+  'instantiates',
+  'instantiateNs',
+  'tableSets',
+  'tableGrows',
+  'bytes', // module bytes loaded (with duplicates)
+  'logDedup', // loads whose bytes were already in the log
+  'moduleCacheHits', // loads/syncs that found a compiled Module in this Worker
+  'flushes',
+  'failures', // jit_load/jit_compile that returned -1
+  'hashNs',
+  'shareSent', // Modules this door posted to the hub (compiled once, here)
+  'shareRecv', // Modules received from the hub and installed (no compile)
+  'shareWaits', // syncs that suspended to wait for a Module from the hub
+  'shareWaitNs',
+  'shareTimeouts', // waits that gave up and compiled a local copy
+  'compileRetries', // a compile that threw and was tried again
+  'outOfCode', // D-511: compiles the engine refused for code space: each releases every module and lowers the budget
+  'refused', // jit_load/jit_compile refused after an engine resource failure (-1)
+  'logReclaimedBytes', // log bytes released for reuse (the hub had delivered their Modules)
+  'logWraps', // module bytes placed below the previous end of the log (reused space)
+  'shareFreedWaits', // local-compile fallbacks that found the bytes delivered or released and waited for the hub instead
+  'shareBytesWanted', // module bytes asked of the hub for a local copy (W31b)
+  'shareBytesCompiles', // local copies compiled from bytes the hub sent
+  'shareResends', // waits that ended without the Module and asked the hub to post it again (W57)
+  'translated', // W77: functions jit_load/jit_compile got from the guest (blocks it translated)
+  'cacheHits', // W77: jit_known answered with a function from the page's cache (jit-cache.js)
+  'cacheMisses', // W77: jit_known for a key the cache's index does not have
+  'cacheLoads', // W77: module bytes read from the cache (once per module and flush generation)
+  'cacheLoadNs',
+  'cacheFails', // W77: a key the index has whose module could not be read or loaded (the guest translates it)
+  'cacheNotes', // W77: block keys sent to the page for the cache
+  'knownHits', // D-513: jit_known answered from this session's notes (the same code at another physical page)
+  'knownNotes', // D-513: block keys this session's table took
+  'knownReloads', // D-513: modules of an older generation loaded again from the log for a jit_known hit
+  'knownGone', // D-513: hits from an older generation whose module bytes the log had reused (the guest translates)
+  'evictions', // D-514: budget refusals answered by dropping the modules no block entered lately
+  'evictedModules', // D-514: modules those dropped
+  'evictedKiB',
+  'knownDropped', // D-514: hits on a dropped module: a miss, so the block is compiled again with the other blocks in use
+  'marks', // D-514: passes over the use marks
+  'poolChecks', // D-515: code pool checks (WebKit)
+  'poolFull', // D-515: checks that found the code pool newly full
+  'poolBack', // D-515: checks that found room in it again
+  'poolLater', // D-515: loads answered JIT_LATER while it was full
+]
+const S = Object.fromEntries(STATS.map((n, i) => [n, i]))
+const TWO32 = 4294967296
+/** Add v (a non-negative integer Number, up to 2^53) to counter i: low word, carry and high part. */
+export function statAdd(st, i, v) {
+  const vlo = v % TWO32
+  const old = Atomics.add(st, 2 * i, vlo | 0) >>> 0
+  const hi = (v - vlo) / TWO32 + (old + vlo >= TWO32 ? 1 : 0)
+  if (hi) Atomics.add(st, 2 * i + 1, hi)
+}
+/**
+ * Counter i. Read again while the high word moved under the read; an adder between its low-word
+ * add and its carry (a few instructions) can still make one read 2^32 low, never the total: stats only.
+ */
+export function statLoad(st, i) {
+  for (;;) {
+    const hi = Atomics.load(st, 2 * i + 1)
+    const lo = Atomics.load(st, 2 * i) >>> 0
+    if (Atomics.load(st, 2 * i + 1) === hi) return hi * TWO32 + lo
+  }
+}
+const STATS_OFF = HDR_INTS * 4
+const CTL_BYTES = STATS_OFF + STATS.length * 8
+
+// records (Int32 cells of store.recs)
+export const REC_INTS = 17
+export const R_LOG_OFF = 0
+export const R_LEN = 1
+export const R_SLOT_BASE = 2
+export const R_NFUNCS = 3
+export const R_HASH_LO = 4
+export const R_HASH_HI = 5
+export const R_APPEND_US = 6 // compile time in the loading thread (0: not compiled there)
+export const R_SYNC_US = 7 // compile time in a thread that synced it (last one wins)
+export const R_INST_US = 8 // instantiate time (last one wins)
+export const R_KIND = 9 // 1 jit_load, 2 jit_compile, 3 a module from the page's cache (W77)
+export const R_GEN = 10
+export const R_OWNER = 11 // the record whose log allocation holds this module's bytes (itself, or the one it was de-duplicated against)
+export const R_DELIVERED = 12 // set (1) only by the hub: it posted this record's Module to every port it had and keeps it (and its bytes) for later ones
+export const R_FREED = 13 // set (1) only by append(), under H_LOCK: the record's log bytes may be overwritten
+export const R_USED = 14 // D-514: the H_MARK that last saw one of its functions entered (the next one, when it was loaded)
+export const R_DROPPED = 15 // D-514: set (1) under H_LOCK when evict dropped it: no Worker installs it, every one clears its slots
+export const R_USEDN = 16 // D-514: how many of its functions were entered in the mark that set R_USED (all of them, when it was loaded)
+const REC_BYTES = REC_INTS * 4
+
+// D-513: this session's block keys (store.known): a header, KN_BUCKETS chain heads (entry + 1), then
+// entries of KN_INTS: the key (8 ints), the generation, the table index, rlo, rlen, the span hash (2),
+// the next entry + 1, the record that holds the function. Entries outlive a release: a hit from an
+// older generation loads that record's module again from the log (store.reload: per owner record, the
+// record it was loaded again as + 1 and that generation). Only read and written under vm.wasm's cache
+// lock (jit_known, jit_note).
+const KN_HDR = 4 // count
+const KN_BUCKETS = 1 << 16
+const KN_INTS = 16
+const KN_E = KN_HDR + KN_BUCKETS
+export const KN_MAX_ENTRIES = 1 << 20
+const knBytes = n => (KN_E + n * KN_INTS) * 4
+
+const now = () => performance.now()
+
+/**
+ * D-515: JavaScriptCore stops compiling wasm once its executable pool is full, with no error: new
+ * code and code that becomes hot then stay in its interpreter, about 20 times slower, and such a
+ * module stays there for good, even once the pool has room (a new copy of the same bytes does not).
+ * Speed is the only sign. Returns the ms a fresh module's loop takes after it had the chance to be
+ * compiled: about 2 ms compiled, 40 ms interpreted.
+ */
+export function poolProbe() {
+  const code = [1, 2, 0x7f, 0x03, 0x40, 0x20, 2, 0x41, 31, 0x6c, 0x20, 1, 0x6a, 0x41, (Math.random() * 63) | 0, 0x6a, 0x21, 2, 0x20, 1, 0x41, 1, 0x6a, 0x22, 1, 0x20, 0, 0x48, 0x0d, 0, 0x0b, 0x20, 2, 0x0b]
+  const bytes = new Uint8Array([0, 97, 115, 109, 1, 0, 0, 0, 1, 6, 1, 0x60, 1, 0x7f, 1, 0x7f, 3, 2, 1, 0, 7, 5, 1, 1, 102, 0, 0, 10, code.length + 2, 1, code.length, ...code])
+  const f = new WebAssembly.Instance(new WebAssembly.Module(bytes)).exports.f
+  f(POOL_PROBE_N)
+  const t = now()
+  f(POOL_PROBE_N)
+  return now() - t
+}
+const ns = ms => Math.round(ms * 1e6)
+
+/** The shared buffers of one machine's JIT door. Created once by the page. */
+export function createJitStore({ logMax = 1 << 30, recMax = 1 << 20, logInitial = 1 << 20, recInitial = 4096, reclaim = true } = {}) {
+  if (typeof SharedArrayBuffer.prototype.grow !== 'function') {
+    throw new Error('the JIT door needs growable SharedArrayBuffers (SharedArrayBuffer.prototype.grow)')
+  }
+  const ctl = new SharedArrayBuffer(CTL_BYTES)
+  if (!reclaim) Atomics.store(new Int32Array(ctl, 0, HDR_INTS), H_NORECLAIM, 1) // append-only log from the start
+  return {
+    ctl,
+    recs: new SharedArrayBuffer(recInitial * REC_BYTES, { maxByteLength: recMax * REC_BYTES }),
+    log: new SharedArrayBuffer(logInitial, { maxByteLength: logMax }),
+    known: new SharedArrayBuffer(knBytes(4096), { maxByteLength: knBytes(KN_MAX_ENTRIES) }),
+    reload: new SharedArrayBuffer(recInitial * 8, { maxByteLength: recMax * 8 }),
+    drops: new SharedArrayBuffer(recInitial * 4, { maxByteLength: recMax * 4 }),
+  }
+}
+
+/** 2 x 32-bit content hash (FNV-1a / murmur-style mix over 4-byte words). */
+export function hash64(b) {
+  let h1 = 0x811c9dc5 | 0
+  let h2 = 0x9747b28c | 0
+  const n = b.length
+  let i = 0
+  for (; i + 4 <= n; i += 4) {
+    const w = b[i] | (b[i + 1] << 8) | (b[i + 2] << 16) | (b[i + 3] << 24)
+    h1 = Math.imul(h1 ^ w, 0x01000193)
+    h2 = Math.imul(h2 ^ w, 0x5bd1e995)
+    h2 ^= h2 >>> 15
+  }
+  for (; i < n; i++) {
+    h1 = Math.imul(h1 ^ b[i], 0x01000193)
+    h2 = Math.imul(h2 ^ b[i], 0x5bd1e995)
+  }
+  return [h1 | 0, (h2 ^ n) | 0]
+}
+
+/**
+ * Names of the function exports of a wasm module, in export order, read from the
+ * bytes without compiling. null when the bytes are not a well-formed module header /
+ * section list. (Slot i of a module is its i-th function export: jit.rs load_slots,
+ * runner/src/batch.rs.)
+ */
+export function funcExportNames(bytes) {
+  if (bytes.length < 8 || bytes[0] !== 0 || bytes[1] !== 0x61 || bytes[2] !== 0x73 || bytes[3] !== 0x6d) return null
+  let i = 8
+  const leb = () => {
+    let r = 0
+    let s = 0
+    for (;;) {
+      if (i >= bytes.length) throw new Error('truncated')
+      const x = bytes[i++]
+      r += (x & 0x7f) * 2 ** s
+      if (!(x & 0x80)) return r
+      s += 7
+      if (s > 35) throw new Error('bad leb')
+    }
+  }
+  try {
+    let names = []
+    while (i < bytes.length) {
+      const id = bytes[i++]
+      const len = leb()
+      const end = i + len
+      if (end > bytes.length) return null
+      if (id === 7) {
+        const count = leb()
+        for (let k = 0; k < count; k++) {
+          const nl = leb()
+          const name = new TextDecoder().decode(bytes.slice(i, i + nl))
+          i += nl
+          const kind = bytes[i++]
+          leb()
+          if (kind === 0) names.push(name)
+        }
+        if (i !== end) return null
+      }
+      i = end
+    }
+    return names
+  } catch {
+    return null
+  }
+}
+
+const moduleFuncNames = module =>
+  WebAssembly.Module.exports(module)
+    .filter(e => e.kind === 'function')
+    .map(e => e.name)
+
+/**
+ * One Worker's side of the door.
+ *
+ * @param {object} o
+ * @param {{ctl:SharedArrayBuffer, recs:SharedArrayBuffer, log:SharedArrayBuffer}} o.store
+ * @param {WebAssembly.Memory} o.memory   the machine's one shared memory
+ * @param {(msg:string)=>void} [o.log]    host diagnostics (stderr)
+ * @param {'compile'|'validate'|'none'} [o.compileOnCompile]  what jit_compile does with the
+ *        bytes before publishing them: compile (so V8 can share the code with the vCPU's
+ *        compile of the same bytes), validate only, or nothing
+ * @param {string} [o.brk]  test mutation: 'load' makes jit_load return -1, 'compile'
+ *        jit_compile, 'all' both; 'noclear' makes a flush leave old table entries in place
+ *        (the P-B2 adversary's mutation; only door-level tests can catch it, since no
+ *        guest run calls jit_flush)
+ * @param {(() => number)|null} [o.codePool]  D-515: poolProbe where the engine's code pool can fill without an error (WebKit)
+ * @param {number} [o.maxLiveBytes]  W34: refuse new modules (JIT_OVER_BUDGET: the guest interprets the block, then releases every module) once this many
+ *        bytes of modules are live in the current generation (0: no budget). WebKit counts what the engine
+ *        keeps per module (about 2x its bytes; never freed before a flush) toward its 8 GiB kill limit.
+ * @param {{port:{postMessage:Function, onmessage:any}, waitMs?:number}|null} [o.share]
+ *        compile each module once per process and share the Module through a hub
+ *        (src/host/jit-hub.js) instead of compiling a copy per Worker. Needs a caller
+ *        that can wait: the imports then return a Promise when a Module has not arrived
+ *        yet, so the Worker wraps them in WebAssembly.Suspending (JSPI) and calls the
+ *        guest through WebAssembly.promising. See README "F1".
+ */
+export function createJitDoor({ store, memory, ram = null, log = () => {}, compileOnCompile = 'validate', brk = '', share = null, tableMin = TABLE_MIN, maxLiveBytes = 0, cache = null, usedBase = 0, codePool = null, poolEvery = POOL_CHECK_MS }) {
+  const hdr = new Int32Array(store.ctl, 0, HDR_INTS)
+  const st = new Int32Array(store.ctl, STATS_OFF, STATS.length * 2)
+  const R = new Int32Array(store.recs) // length-tracking views over growable buffers
+  const L = new Uint8Array(store.log)
+  const KN = store.known ? new Int32Array(store.known) : null
+  const RL = store.reload ? new Int32Array(store.reload) : null
+  const DL = store.drops ? new Int32Array(store.drops) : null
+  const add = (k, v = 1) => statAdd(st, S[k], v)
+  let budgetLogged = false
+
+  // per Worker: compiled modules by log offset; content index for de-duplication.
+  // `modules` holds this generation's Modules only: the first sync (or flush) that
+  // sees a new generation drops the map, so after a flush nothing in this Worker
+  // (map, instances, table entries) references an old Module and the engine can free
+  // its code (P-B2 adversarial F1: a Worker used to keep every Module forever).
+  // Keys of `modules`, `instances`, the waiters and the hub messages (still named logOff
+  // there) are a module's OWNER record index, not its log offset: the log is reused, so an
+  // offset can hold a different module later, while an owner index never does.
+  let modules = new Map() // owner -> {module, names}
+  let modulesGen = 0
+  let hubBytes = new Map() // owner -> module bytes the hub sent on request (W31b; this generation)
+  let wanted = new Set() // owners whose bytes were asked of the hub (this generation)
+  let noBytes = new Set() // ... and that the hub answered 'lost' (it keeps no bytes for them)
+  const byHash = new Map() // "hi:lo:len" -> owner (the newest record that allocated those bytes)
+  let indexed = 0
+  function releaseOldModules(g) {
+    if (g === modulesGen) return
+    modules = new Map()
+    hubBytes = new Map()
+    wanted = new Set()
+    noBytes = new Set()
+    modulesGen = g
+  }
+
+  // An engine resource failure (Firefox: "out of memory" when its per-process wasm code
+  // space is used up) is not the module's fault: CompileError/LinkError are.
+  const isResource = err => !(err instanceof WebAssembly.CompileError || err instanceof WebAssembly.LinkError)
+
+  /**
+   * new WebAssembly.Module(bytes); on a resource failure, try again for a few seconds. D-512: right
+   * after a release, other Workers still hold the released Modules until each one syncs (an idle
+   * vCPU within a second, vm machine.c) and Firefox frees their code only then. Throws if every
+   * try fails.
+   */
+  const pause = new Int32Array(new SharedArrayBuffer(4))
+  function compileModule(bytes) {
+    for (let ms = 50; ; ms *= 2) {
+      try {
+        return new WebAssembly.Module(bytes)
+      } catch (err) {
+        if (!isResource(err) || ms > COMPILE_RETRY_MAX_MS) throw err
+        if (ms === 50) log(`wmd-web: jit: compile failed (${err && err.message ? err.message : err}); trying again for a few seconds`)
+        add('compileRetries')
+        Atomics.wait(pause, 0, 0, ms)
+      }
+    }
+  }
+
+  /** D-511: the budget in force: the page's, or lower, one the engine taught us (outOfCode). */
+  function liveBudget() {
+    const learned = Atomics.load(hdr, H_BUDGET_KIB) * 1024
+    return maxLiveBytes && learned ? Math.min(maxLiveBytes, learned) : maxLiveBytes || learned
+  }
+  /**
+   * D-511: the engine refused code (Firefox: "out of memory" when live and released modules fill its
+   * code space). Release every module and keep the live ones well under where this happened from now
+   * on: over budget, not -1, so the guest releases instead of compiling each block alone and the
+   * engine collects the released ones. If nothing fits after the release, the guest stops loading.
+   */
+  function outOfCode(err) {
+    const live = Atomics.load(hdr, H_LIVE_KIB)
+    const kib = Math.max(MIN_LEARNED_KIB, Math.floor(live * 0.6))
+    const cur = Atomics.load(hdr, H_BUDGET_KIB)
+    if (!cur || kib < cur) Atomics.store(hdr, H_BUDGET_KIB, kib)
+    add('outOfCode')
+    log(`wmd-web: jit: the engine refused more code at ${live} KiB of live modules (${err && err.message ? err.message : err}); releasing every module, budget ${Math.min(kib, cur || kib)} KiB from now on`)
+    return JIT_OVER_BUDGET
+  }
+
+  let poolNext = 0
+  let poolFast = Infinity
+  /**
+   * D-515: before a new module is compiled. While the engine's code pool is full (codePool, checked
+   * at most once each poolEvery) the answer is JIT_LATER: the guest interprets the blocks and asks
+   * again later, so no module is loaded only to run interpreted for good. A pool that fills with the
+   * live modules near the budget lowers the budget to POOL_LEARN of them and answers JIT_OVER_BUDGET
+   * (the guest drops cold modules); one that fills well under it holds code dropped lately that is not
+   * given back yet, and waiting is the cure. 0: compile.
+   */
+  function checkPool() {
+    if (!codePool) return 0
+    const t = now()
+    const was = Atomics.load(hdr, H_POOL_FULL)
+    if (t < poolNext) return was ? JIT_LATER : 0
+    poolNext = t + poolEvery
+    add('poolChecks')
+    let ms = codePool()
+    if (ms > poolFast * POOL_SLOW_X) ms = Math.min(ms, codePool()) // not a pause of this thread
+    poolFast = Math.min(poolFast, Math.max(ms, 0.05))
+    const full = ms > poolFast * POOL_SLOW_X
+    const at = () => new Date().toISOString().slice(11, 19)
+    if (!full) {
+      if (was && Atomics.compareExchange(hdr, H_POOL_FULL, 1, 0) === 1) {
+        add('poolBack')
+        log(`wmd-web: jit: the engine compiles code again (${at()})`)
+      }
+      return 0
+    }
+    if (was || Atomics.compareExchange(hdr, H_POOL_FULL, 0, 1) !== 0) return JIT_LATER
+    add('poolFull')
+    const live = Atomics.load(hdr, H_LIVE_KIB)
+    const budget = liveBudget()
+    const what = `${at()}, ${live} KiB of live modules, new code ${(ms / poolFast).toFixed(0)}x slower`
+    if (budget && live * 1024 < budget * POOL_LEARN) {
+      log(`wmd-web: jit: the engine's code pool is full (${what}); under the budget: it holds code dropped lately, new blocks wait`)
+      return JIT_LATER
+    }
+    const kib = Math.max(MIN_LEARNED_KIB, Math.floor(live * POOL_LEARN))
+    lock()
+    try {
+      const cur = Atomics.load(hdr, H_BUDGET_KIB)
+      if (!cur || kib < cur) Atomics.store(hdr, H_BUDGET_KIB, kib)
+    } finally {
+      unlock()
+    }
+    log(`wmd-web: jit: the engine's code pool is full (${what}); dropping cold modules, budget ${kib} KiB from now on`)
+    return JIT_OVER_BUDGET
+  }
+
+  // Sharing (o.share): Modules compiled by other Workers arrive here from the hub.
+  const waiters = new Map() // logOff -> resolve()
+  const forceLocal = new Set() // logOffs whose Module did not arrive in time: compile here
+  const lost = new Set() // logOffs the hub could not forward to this Worker
+  let deserErrors = 0 // 'messageerror' events on the hub port
+  const errorWaitMs = share?.errorWaitMs ?? 1500
+  const lostForGood = new Set() // ... being compiled locally: no Module will come
+  if (share) {
+    const wakeAll = () => {
+      for (const w of waiters.values()) w()
+      waiters.clear()
+    }
+    // A Module the engine could not deserialize here arrives as 'messageerror' with no data,
+    // so which one is lost is not known (P-B7: Firefox, past its per-process wasm code limit,
+    // failed the late Modules of a 190-Module boot; the sync then waited the whole waitMs).
+    // From then on a wait for a Module is short, and the wait that is open is cut short.
+    // The log may already have reused the lost Module's bytes (the hub counted it delivered when
+    // it posted it): the copy is then compiled from bytes the hub keeps (W31b, wantBytes).
+    share.port.onmessageerror = () => {
+      if (!deserErrors++) {
+        log(`wmd-web: jit: a Module from the hub could not be received here; this Worker asks the hub for the Modules it misses from now on`)
+        // W57: Firefox lost runs of the Modules the hub pushed (hundreds in a row) but delivered every one
+        // it posted in answer to this Worker's own request: stop the pushes, ask for what is missing
+        if (RESENDS) {
+          try {
+            share.port.postMessage({ t: 'pull' })
+          } catch {}
+        }
+      }
+      wakeAll()
+    }
+    share.port.onmessage = e => {
+      const m = e.data
+      // a flush elsewhere: whatever a sync here waits for may never come; let it re-sync
+      if (m.t === 'flush' || m.t === 'drop') return wakeAll()
+      if (m.t === 'lost') {
+        // the hub could not forward this Module to us: compile a copy instead of waiting;
+        // or it keeps no bytes for a Module we asked for (a flushed generation, or evicted)
+        if (wanted.has(m.logOff) && m.gen === modulesGen) noBytes.add(m.logOff)
+        lost.add(m.logOff)
+        const w = waiters.get(m.logOff)
+        if (w) {
+          waiters.delete(m.logOff)
+          w()
+        }
+        return
+      }
+      if (m.t === 'bytes') {
+        // the answer to wantBytes: a local copy of that Module can now be compiled
+        if (m.gen > modulesGen) releaseOldModules(m.gen)
+        if (m.gen === modulesGen) hubBytes.set(m.logOff, m.bytes)
+        const w = waiters.get(m.logOff)
+        if (w) {
+          waiters.delete(m.logOff)
+          w()
+        }
+        return
+      }
+      if (m.t !== 'mod') return
+      if (m.gen < Atomics.load(hdr, H_GEN)) return wakeAll() // a flushed generation's module
+      if (m.gen > modulesGen) releaseOldModules(m.gen)
+      if (m.gen === modulesGen && !modules.has(m.logOff)) {
+        try {
+          modules.set(m.logOff, { module: m.module, names: moduleFuncNames(m.module), shared: true })
+        } catch (err) {
+          log(`wmd-web: jit: a shared module could not be received (${err && err.message ? err.message : err})`)
+        }
+      }
+      const w = waiters.get(m.logOff)
+      if (w) {
+        waiters.delete(m.logOff)
+        w()
+      }
+    }
+    // W57: the hub posts nothing to this port before this: Firefox failed (as 'messageerror') every
+    // Module the hub posted while this Worker was still starting, the first 7 to 83 of a boot
+    try {
+      share.port.postMessage({ t: 'hello', pull: share.pull ?? true }) // D-512: a Module only when this door asks (askMissing)
+    } catch {}
+  }
+
+  const breakLoad = brk === 'load' || brk === 'all'
+  const breakCompile = brk === 'compile' || brk === 'all'
+  const breakClear = brk === 'noclear'
+
+  // per thread (reset by attach)
+  let table = null
+  let imports = null
+  let gen = -1
+  let applied = 0
+  let instances = new Map() // owner -> Instance (this generation)
+
+  function lock() {
+    for (let spins = 0; Atomics.compareExchange(hdr, H_LOCK, 0, 1) !== 0; spins++) {
+      if (spins > 100) {
+        try {
+          Atomics.wait(hdr, H_LOCK, 1, 1)
+        } catch {} // the main thread of a test runner may not wait
+      }
+    }
+  }
+  function unlock() {
+    Atomics.store(hdr, H_LOCK, 0)
+    Atomics.notify(hdr, H_LOCK, 1)
+  }
+
+  function rec(r) {
+    const b = r * REC_INTS
+    return {
+      logOff: Atomics.load(R, b + R_LOG_OFF),
+      len: Atomics.load(R, b + R_LEN),
+      slotBase: Atomics.load(R, b + R_SLOT_BASE),
+      nfuncs: Atomics.load(R, b + R_NFUNCS),
+      hl: Atomics.load(R, b + R_HASH_LO),
+      hh: Atomics.load(R, b + R_HASH_HI),
+      owner: Atomics.load(R, b + R_OWNER),
+    }
+  }
+
+  const hkey = (hl, hh, len) => `${hh}:${hl}:${len}`
+
+  const ownerGen = new Map()
+  function indexRecords() {
+    const n = Atomics.load(hdr, H_NMOD)
+    for (; indexed < n; indexed++) {
+      const x = rec(indexed)
+      // only records that own their bytes; the newest wins, so after the older copy's
+      // bytes were released a live copy of the same module is still found
+      if (x.owner === indexed) byHash.set(hkey(x.hl, x.hh, x.len), indexed)
+      ownerGen.set(x.owner, Atomics.load(R, indexed * REC_INTS + R_GEN)) // W34: the newest generation that uses the owner's bytes
+    }
+  }
+
+  function sameBytes(off, bytes) {
+    for (let i = 0; i < bytes.length; i++) if (L[off + i] !== bytes[i]) return false
+    return true
+  }
+
+  function ensure(sab, bytes) {
+    if (sab.byteLength >= bytes) return true
+    if (bytes > sab.maxByteLength) return false
+    sab.grow(Math.min(sab.maxByteLength, Math.max(bytes, sab.byteLength * 2)))
+    return true
+  }
+
+  // ---- Reclaiming the log (W31) ----
+  //
+  // Nothing in a machine run calls jit_flush (the only generation change), so the log only
+  // grew and a long build loop filled it ("module log full": every new block then stayed in
+  // vm.wasm's interpreter, about 10x slower).
+  //
+  // Only with sharing (o.share: a hub holds every Module of the generation). Without it
+  // every thread compiles from the log whenever it syncs, so any byte may be read at any
+  // time and nothing is ever released: append() refuses at logMax, as it always did.
+  //
+  // Delivery. The hub (jit-hub-core.js) sets R_DELIVERED of a record with Atomics.store
+  // only after it posted that record's Module to every port it had, and it keeps the
+  // Module, and a copy of its bytes, for ports that connect later. So a door never needs
+  // the log bytes: it gets the Module from the hub; when the hub could not post it
+  // ('lost'), from a local compile of the log, which the hub does not mark delivered; and
+  // when a posted Module could not be received ('messageerror', Firefox past its wasm code
+  // limit) or a replay comes after the bytes were reused, from a local compile of the
+  // bytes the hub sends on request (wantBytes, W31b). Door progress is not
+  // tracked at all, so an idle or finished thread cannot hold the log back, and a thread
+  // that attaches late gets every slot from the hub's replay.
+  //
+  // A record's bytes may be released when it owns them (R_OWNER is itself: a record
+  // de-duplicated against an older one owns nothing), and it is delivered or belongs to
+  // an older generation (a flush made the table forget it; every door re-syncs from
+  // H_MOD_START). Release = R_FREED := 1, set under H_LOCK just before the space can be
+  // overwritten. H_LOG_TAIL is the lowest record that may own live bytes.
+  //
+  // Placement. The live allocations are the owner records in [tail, nmod) that are not
+  // freed. A new module goes into the lowest gap among them that fits (so freed space at
+  // the front is reused first: a ring in the steady state), then after the last one,
+  // growing the buffer only if that does not fit; each module stays contiguous.
+  // H_LOG_USED is the end of the last placement and H_LOG_LIM the start of the next live
+  // allocation (0: none), so the common append is a bump. A release pass runs only when
+  // the free run at the head has no room, so a module logged twice stays de-duplicated
+  // for as long as nothing needed the space.
+  //
+  // Ordering (readers take no lock). The only readers of log bytes are a local-compile
+  // fallback (install) and the unlocked de-duplication compare. append() overwrites a
+  // range only after it stored R_FREED for every owner overlapping it (seq-cst, under the
+  // lock), and a record is freed only if the hub had delivered it. A reader reads the
+  // bytes first and then loads R_FREED: if that load sees 0 the store came later in the
+  // seq-cst order, so the overwrite (after the store) came after the reads, and they saw
+  // the module's own bytes; if it sees 1 the bytes are discarded unread (a fallback then
+  // waits for the hub instead). A fallback also refuses to start once R_DELIVERED is set.
+  // De-duplication takes a candidate without the lock and re-checks R_FREED under it:
+  // while it is 0 under the lock nothing has been overwritten, so the unlocked compare
+  // read intact bytes. The per-door Module maps are keyed by owner record index, never by
+  // offset, so a reused offset is never mistaken for the old module.
+  const align8 = n => (n + 7) & ~7
+  const isFreed = r => Atomics.load(R, r * REC_INTS + R_FREED) !== 0
+  // gone: released, or of a flushed generation (reclaimable at any time, undelivered or not).
+  // A de-duplication hit must be of the current generation: a new record that used an old
+  // generation's allocation would depend on bytes the flush made reclaimable.
+  const isDropped = r => Atomics.load(R, r * REC_INTS + R_DROPPED) !== 0
+  const isGone = r => isDropped(r) || (share && (isFreed(r) || Atomics.load(R, r * REC_INTS + R_GEN) !== Atomics.load(hdr, H_GEN)))
+
+  /** Release the bytes of delivered records (H_LOCK held; sharing only). */
+  function reclaim(nmod) {
+    const g = Atomics.load(hdr, H_GEN)
+    let freed = 0
+    let first = -1
+    for (let r = Atomics.load(hdr, H_LOG_TAIL); r < nmod; r++) {
+      const b = r * REC_INTS
+      if (Atomics.load(R, b + R_OWNER) !== r || Atomics.load(R, b + R_FREED)) continue
+      if (Atomics.load(R, b + R_DELIVERED) || Atomics.load(R, b + R_GEN) < g || Atomics.load(R, b + R_DROPPED)) {
+        Atomics.store(R, b + R_FREED, 1)
+        freed += align8(Atomics.load(R, b + R_LEN))
+      } else if (first < 0) first = r
+    }
+    Atomics.store(hdr, H_LOG_TAIL, first < 0 ? nmod : first)
+    if (freed) add('logReclaimedBytes', freed)
+  }
+
+  /** Room for `len` bytes in the log: its offset, or -1 when full (H_LOCK held). */
+  function allocLog(len) {
+    const n = align8(len)
+    const h = Atomics.load(hdr, H_LOG_USED)
+    if (!share || Atomics.load(hdr, H_NORECLAIM)) {
+      // today's behaviour: append only, grow, refuse at logMax
+      if (!ensure(store.log, h + n)) return -1
+      Atomics.store(hdr, H_LOG_USED, h + n)
+      return h
+    }
+    const take = (off, lim) => {
+      if (off < h) add('logWraps')
+      Atomics.store(hdr, H_LOG_USED, off + n)
+      Atomics.store(hdr, H_LOG_LIM, lim)
+      Atomics.store(hdr, H_FAIL_D, 0)
+      return off
+    }
+    const lim = Atomics.load(hdr, H_LOG_LIM)
+    if (h + n <= (lim || store.log.byteLength)) return take(h, lim)
+    const nmod = Atomics.load(hdr, H_NMOD)
+    // D-513: grow before reusing anything while under the budget (the buffer doubles, so up to twice
+    // it): jit_known loads a module of the generations before a release again from these bytes (knHit)
+    const keep = Math.min(store.log.maxByteLength, liveBudget())
+    if (keep && store.log.byteLength < keep) {
+      let top = h
+      for (let r = Atomics.load(hdr, H_LOG_TAIL); r < nmod; r++) {
+        const b = r * REC_INTS
+        if (Atomics.load(R, b + R_OWNER) !== r || Atomics.load(R, b + R_FREED)) continue
+        top = Math.max(top, Atomics.load(R, b + R_LOG_OFF) + align8(Atomics.load(R, b + R_LEN)))
+      }
+      if (top + n <= keep && ensure(store.log, top + n)) return take(top, 0)
+    }
+    const d = Atomics.load(hdr, H_DELIV) + 1
+    const g = Atomics.load(hdr, H_GEN)
+    // nothing was delivered or flushed since the last failure: a same or bigger module still does not fit
+    if (Atomics.load(hdr, H_FAIL_D) === d && Atomics.load(hdr, H_FAIL_G) === g && n >= Atomics.load(hdr, H_FAIL_N)) return -1
+    reclaim(nmod)
+    const iv = []
+    for (let r = Atomics.load(hdr, H_LOG_TAIL); r < nmod; r++) {
+      const b = r * REC_INTS
+      if (Atomics.load(R, b + R_OWNER) !== r || Atomics.load(R, b + R_FREED)) continue
+      const o = Atomics.load(R, b + R_LOG_OFF)
+      iv.push([o, o + align8(Atomics.load(R, b + R_LEN))])
+    }
+    iv.sort((a, b) => a[0] - b[0])
+    let prev = 0
+    for (const [o, e] of iv) {
+      if (o - prev >= n) return take(prev, o)
+      if (e > prev) prev = e
+    }
+    if (prev + n <= store.log.byteLength || ensure(store.log, prev + n)) return take(prev, 0)
+    const same = Atomics.load(hdr, H_FAIL_D) === d && Atomics.load(hdr, H_FAIL_G) === g
+    Atomics.store(hdr, H_FAIL_N, same ? Math.min(n, Atomics.load(hdr, H_FAIL_N)) : n)
+    Atomics.store(hdr, H_FAIL_G, g)
+    Atomics.store(hdr, H_FAIL_D, d)
+    return -1
+  }
+
+  /**
+   * A private copy of guest bytes [ptr, ptr+len). Both are wasm i32s, which JS receives
+   * signed: an address at or above 2 GiB arrives negative (W23: "Start offset
+   * -2147302880 is outside the bounds of the buffer" once vm.wasm's heap passed 2 GiB),
+   * so they are read as unsigned, as wasi.js and chan.js do and the runner's u32 params
+   * (jit.rs jit_load). null when the range is not inside the memory.
+   */
+  function readGuest(ptr, len) {
+    ptr >>>= 0
+    len >>>= 0
+    const buf = memory.buffer
+    if (ptr + len > buf.byteLength) return null
+    const out = new Uint8Array(len)
+    out.set(new Uint8Array(buf, ptr, len))
+    return out
+  }
+  const outside = (kind, ptr, len) => {
+    add('failures')
+    log(`wmd-web: jit_${kind}: module bytes at ${ptr >>> 0}+${len >>> 0} are outside the guest memory (${memory.buffer.byteLength} bytes)`)
+    return -1
+  }
+
+  // W77: this Worker's last appended guest modules, for jit_note (its table index -> module)
+  const RECENT = 64
+  const recent = []
+  let lastRec = -1 // the record the last successful append published
+  function recentFor(tidx) {
+    for (let i = recent.length - 1; i >= 0; i--) {
+      const x = recent[i]
+      if (tidx >= x.base && tidx < x.base + x.n) return x
+    }
+    return null
+  }
+  /** jit_known's answer: the span (rlo, rlen, span hash) at ptr+32, as jit.rs jit_known writes it. */
+  function writeSpan(ptr, e) {
+    const at = (ptr >>> 0) + KNOWN_KEY_BYTES
+    const buf = memory.buffer
+    if (at + 16 > buf.byteLength) return false
+    const dv = new DataView(buf, at, 16)
+    dv.setUint32(0, e[2] >>> 0, true)
+    dv.setUint32(4, e[3] >>> 0, true)
+    dv.setUint32(8, e[4] >>> 0, true)
+    dv.setUint32(12, e[5] >>> 0, true)
+    return true
+  }
+  /** After a hit: this thread's table must hold the function before the guest calls it. */
+  function hitDone(ptr, e, tidx, hit = 'cacheHits') {
+    if (!writeSpan(ptr, e)) {
+      add('cacheFails')
+      return -1
+    }
+    const failed = err => {
+      add('cacheFails')
+      log(`wmd-web: jit_known: ${err && err.message ? err.message : err}`)
+      return -1
+    }
+    try {
+      if (share) {
+        const p = syncShared()
+        if (p) return p.then(() => (add(hit), tidx), failed)
+      } else sync()
+    } catch (err) {
+      return failed(err)
+    }
+    add(hit)
+    return tidx
+  }
+
+  const knSlot = K => ((Math.imul(K[0] ^ K[2], 0x9e3779b1) ^ K[1] ^ K[3]) >>> 0) & (KN_BUCKETS - 1)
+  /** D-513: the entry of this session's table for key K, or -1. */
+  function knFind(K) {
+    for (let j = KN[KN_HDR + knSlot(K)] - 1; j >= 0; j = KN[KN_E + j * KN_INTS + 14] - 1) {
+      const o = KN_E + j * KN_INTS
+      let i = 0
+      while (i < 8 && KN[o + i] === K[i]) i++
+      if (i === 8) return j
+    }
+    return -1
+  }
+  /** D-513: key K (8 ints of `src` from `at`) names table index tidx with span v[0..3]; the newest note wins. */
+  function knNote(src, at, tidx, v) {
+    const r = recOfIndex(tidx)
+    if (r < 0) return
+    const K = src.subarray(at, at + 8)
+    let j = knFind(K)
+    if (j < 0) {
+      j = KN[0]
+      if (j >= KN_MAX_ENTRIES || !ensure(store.known, knBytes(j + 1))) return
+      const o = KN_E + j * KN_INTS
+      KN.set(K, o)
+      const h = KN_HDR + knSlot(K)
+      KN[o + 14] = KN[h]
+      KN[h] = j + 1
+      KN[0] = j + 1
+      add('knownNotes')
+    }
+    const o = KN_E + j * KN_INTS
+    KN[o + 8] = R[r * REC_INTS + R_GEN]
+    KN[o + 9] = tidx
+    KN.set(v, o + 10)
+    KN[o + 15] = r
+  }
+  /** The record whose slots hold table index tidx, or -1 (records take slots in order). */
+  function recOfIndex(tidx) {
+    const i = tidx - tableMin
+    let lo = 0
+    let hi = Atomics.load(hdr, H_NMOD) - 1
+    if (i < 0 || hi < 0) return -1
+    while (lo < hi) {
+      const m = (lo + hi + 1) >> 1
+      if (R[m * REC_INTS + R_SLOT_BASE] <= i) lo = m
+      else hi = m - 1
+    }
+    for (let r = lo; r >= 0; r--) {
+      const b = r * REC_INTS
+      const n = R[b + R_NFUNCS]
+      if (R[b + R_SLOT_BASE] > i) continue
+      return i < R[b + R_SLOT_BASE] + n ? r : -1
+    }
+    return -1
+  }
+  /** D-513: a hit on entry o: its function in this generation, the module loaded again from the log when it is older. */
+  function knHit(ptr, o) {
+    const g = Atomics.load(hdr, H_GEN)
+    const e = KN.slice(o + 8, o + 14)
+    const r = KN[o + 15]
+    // D-514: an eviction dropped the module because few of its functions ran; loading it again
+    // would bring the rest back, so the block is compiled again (at once: it was busy), with other busy ones
+    const dropped = () => {
+      add('knownDropped')
+      return KNOWN_DROPPED
+    }
+    if (KN[o + 8] === g) return isDropped(r) ? dropped() : hitDone(ptr, e, KN[o + 9], 'knownHits')
+    const owner = R[r * REC_INTS + R_OWNER]
+    const func = KN[o + 9] - tableMin - R[r * REC_INTS + R_SLOT_BASE]
+    const nr0 = RL.length > owner * 2 + 1 && Atomics.load(RL, owner * 2 + 1) === g ? Atomics.load(RL, owner * 2) - 1 : -1
+    if (nr0 >= 0 && isDropped(nr0)) return dropped()
+    let nr = nr0
+    if (nr < 0) {
+      const x = rec(owner)
+      const bytes = isFreed(owner) ? null : L.slice(x.logOff, x.logOff + x.len)
+      if (!bytes || isFreed(owner)) {
+        add('knownGone')
+        return -1
+      }
+      if (append(bytes, 3, 'compile') < 0 || !ensure(store.reload, (owner + 1) * 8)) return -1
+      nr = lastRec
+      Atomics.store(RL, owner * 2, nr + 1)
+      Atomics.store(RL, owner * 2 + 1, R[nr * REC_INTS + R_GEN])
+      add('knownReloads')
+    }
+    const b = nr * REC_INTS
+    if (func < 0 || func >= R[b + R_NFUNCS]) return -1
+    const tidx = tableMin + R[b + R_SLOT_BASE] + func
+    KN[o + 8] = e[0] = R[b + R_GEN]
+    KN[o + 9] = e[1] = tidx
+    KN[o + 15] = nr
+    return hitDone(ptr, e, tidx, 'knownHits')
+  }
+  /**
+   * W77: wmd.jit_known(ptr) over the page's cache (jit-cache.js): the table index of the
+   * function an earlier visit compiled for the block key at ptr, or -1. A miss answers at
+   * once; a hit on a module not loaded in this generation waits for its bytes (sharing only:
+   * the import is a JSPI Suspending then).
+   */
+  function known(ptr) {
+    const kb = readGuest(ptr, KNOWN_KEY_BYTES)
+    if (!kb) return -1
+    const K = new Int32Array(kb.buffer)
+    if (KN) {
+      const s = knFind(K)
+      if (s >= 0) return knHit(ptr, KN_E + s * KN_INTS)
+    }
+    if (!cache) return -1
+    const lk = cache.lookup
+    const j = lk.find(K)
+    if (j < 0) {
+      add('cacheMisses')
+      return -1
+    }
+    const e = lk.entry(j).slice()
+    const mod = e[0]
+    const func = e[1]
+    const g = Atomics.load(hdr, H_GEN)
+    const [lr, lg] = lk.loaded(mod)
+    if (lr && lg === g) {
+      const b = (lr - 1) * REC_INTS
+      if (Atomics.load(R, b + R_GEN) === g && func < R[b + R_NFUNCS]) return hitDone(ptr, e, tableMin + R[b + R_SLOT_BASE] + func)
+    }
+    if (!share) {
+      add('cacheFails') // no JSPI: this thread cannot wait for the bytes
+      return -1
+    }
+    const [hl, hh, len] = lk.mod(mod)
+    const t = now()
+    return cache.request(hl, hh, len).then(
+      bytes => {
+        add('cacheLoads')
+        add('cacheLoadNs', ns(now() - t))
+        if (!bytes || bytes.length !== len >>> 0) {
+          add('cacheFails')
+          return -1
+        }
+        const [a, b] = hash64(bytes)
+        if (a !== hl || b !== hh) {
+          add('cacheFails')
+          return -1
+        }
+        const base = append(bytes, 3, 'compile')
+        if (base < 0) {
+          add('cacheFails')
+          return -1
+        }
+        const r = lastRec
+        if (func >= R[r * REC_INTS + R_NFUNCS]) {
+          add('cacheFails')
+          return -1
+        }
+        lk.setLoaded(mod, r, R[r * REC_INTS + R_GEN])
+        return hitDone(ptr, e, base + func)
+      },
+      err => {
+        add('cacheFails')
+        log(`wmd-web: jit_known: cache read: ${err && err.message ? err.message : err}`)
+        return -1
+      },
+    )
+  }
+  /** W77: wmd.jit_note(ptr, n): the keys of blocks just compiled, to the page's cache with their modules. */
+  function note(ptr, n) {
+    n >>>= 0
+    if (!n) return
+    const b = readGuest(ptr, n * KNOWN_NOTE_BYTES)
+    if (!b) return
+    if (KN) {
+      const I = new Int32Array(b.buffer)
+      for (let i = 0; i < n; i++) {
+        const w = (i * KNOWN_NOTE_BYTES) >> 2
+        knNote(I, w, I[w + 12], I.subarray(w + 8, w + 12))
+      }
+    }
+    if (!cache) return
+    const dv = new DataView(b.buffer)
+    const mods = []
+    const modIx = new Map()
+    const ents = []
+    for (let i = 0; i < n; i++) {
+      const o = i * KNOWN_NOTE_BYTES
+      const tidx = dv.getInt32(o + 48, true)
+      const x = recentFor(tidx)
+      if (!x) continue
+      let mi = modIx.get(x)
+      if (mi === undefined) {
+        mi = mods.length
+        mods.push({ hl: x.hl, hh: x.hh, len: x.len, bytes: x.bytes || undefined })
+        x.bytes = null // sent once from this Worker
+        modIx.set(x, mi)
+      }
+      ents.push({ key: b.slice(o, o + KNOWN_KEY_BYTES), mod: mi, func: tidx - x.base, rlo: dv.getUint32(o + 32, true), rlen: dv.getUint32(o + 36, true), spanLo: dv.getInt32(o + 40, true), spanHi: dv.getInt32(o + 44, true) })
+    }
+    if (!ents.length) return
+    add('cacheNotes', ents.length)
+    cache.note({ mods, ents })
+  }
+
+  /** Register a module's bytes; returns the table index of its first function, or -1. */
+  function append(bytes, kind, how) {
+    for (;;) {
+      const r = appendOnce(bytes, kind, how)
+      if (r !== AGAIN) return r
+    }
+  }
+  function appendOnce(bytes, kind, how) {
+    add('bytes', bytes.length)
+    const th = now()
+    const [hl, hh] = hash64(bytes)
+    add('hashNs', ns(now() - th))
+    indexRecords()
+    // a de-duplication candidate: the record owning identical bytes that are still in the log
+    let owner = byHash.get(hkey(hl, hh, bytes.length)) ?? -1
+    if (owner >= 0 && (isGone(owner) || !sameBytes(rec(owner).logOff, bytes))) owner = -1
+    let m = owner >= 0 ? modules.get(owner) : undefined
+    let compileUs = 0
+    let compiledHere = false
+    if (m) add('moduleCacheHits')
+    if (!m && Atomics.load(hdr, H_FULL)) {
+      // The function table is full for good. Over budget, not -1: -1 makes the guest compile every
+      // block of the batch alone, each refused again; a release that frees nothing stops its loads.
+      add('refused')
+      add('failures')
+      return JIT_OVER_BUDGET
+    }
+    // W34: identical bytes already live in this generation add nothing an engine keeps (every Worker
+    // instantiates an owner once per generation); bytes owned by an older generation are counted again
+    const liveHere = owner >= 0 && ownerGen.get(owner) === Atomics.load(hdr, H_GEN)
+    // D-512: a compile thread (jit_compile: it runs no blocks) keeps no Module. One waiting for work
+    // would hold its last generation's for good, and Firefox frees code only once no Worker holds it.
+    const keep = kind !== 2 || !share
+    if (!m && liveHere && !keep) {
+      const names = funcExportNames(bytes)
+      if (names) {
+        m = { module: null, names }
+        add('moduleCacheHits')
+      }
+    }
+    if (!m && !liveHere && how === 'compile') {
+      const p = checkPool()
+      if (p) {
+        add(p === JIT_LATER ? 'poolLater' : 'refused')
+        return p
+      }
+    }
+    const budget = liveBudget()
+    if (!m && !liveHere && budget && Atomics.load(hdr, H_LIVE_KIB) * 1024 + bytes.length > budget) {
+      // W34: the engine keeps every live module; stay under the budget so the page does not pass WebKit's kill limit
+      if (!budgetLogged) {
+        budgetLogged = true
+        log(`wmd-web: jit: module budget reached (${Atomics.load(hdr, H_LIVE_KIB)} KiB live of ${budget >> 10}); the guest drops its compiled blocks and compiles again`)
+      }
+      add('refused')
+      add('failures')
+      return JIT_OVER_BUDGET
+    }
+    if (!m) {
+      try {
+        if (how === 'compile') {
+          const t = now()
+          const module = compileModule(bytes)
+          compiledHere = true
+          const dt = now() - t
+          compileUs = Math.max(1, Math.round(dt * 1000))
+          add('appendCompiles')
+          add('appendCompileNs', ns(dt))
+          m = { module, names: moduleFuncNames(module) }
+        } else {
+          if (how === 'validate') {
+            const t = now()
+            const ok = WebAssembly.validate(bytes)
+            add('validateNs', ns(now() - t))
+            if (!ok) throw new Error('module does not validate')
+          }
+          const names = funcExportNames(bytes)
+          if (!names) throw new Error('malformed module')
+          m = { module: null, names }
+        }
+      } catch (err) {
+        add('failures')
+        if (how === 'compile' && isResource(err)) return outOfCode(err)
+        log(`wmd-web: jit_${kind === 1 ? 'load' : 'compile'}: compile: ${err && err.message ? err.message : err}`)
+        return -1
+      }
+    }
+    let base
+    let recGen = 0
+    let key = owner
+    lock()
+    try {
+      const r = Atomics.load(hdr, H_NMOD)
+      // released since the unlocked check: the bytes may be reused, log the module again
+      if (owner >= 0 && isGone(owner)) {
+        if (!m.module) return AGAIN // D-512: no Module of its own to post: compile it after all
+        owner = -1
+      }
+      let logOff
+      if (owner < 0) {
+        const off = allocLog(bytes.length)
+        if (off < 0) {
+          add('failures')
+          log(`wmd-web: jit: module log full (${Atomics.load(hdr, H_LOG_USED)} bytes${share ? `; ${r - Atomics.load(hdr, H_LOG_TAIL)} records from #${Atomics.load(hdr, H_LOG_TAIL)} not delivered by the hub or flushed` : ''})`)
+          return -1
+        }
+        L.set(bytes, off)
+        logOff = off
+        key = r
+      } else {
+        logOff = rec(owner).logOff
+        key = owner
+        add('logDedup')
+      }
+      if (!ensure(store.recs, (r + 1) * REC_BYTES)) {
+        add('failures')
+        log(`wmd-web: jit: module record list full (${r} records; records are not reclaimed, so this is the next limit after the module log)`)
+        return -1
+      }
+      const slotBase = Atomics.load(hdr, H_NSLOTS)
+      base = tableMin + slotBase
+      if (base + m.names.length > TABLE_MAX_ENTRIES) {
+        // Slots are never rewound (W34) and table.grow past the engines' limit throws
+        // in every Worker's sync: refuse here instead, once and for good.
+        add('failures')
+        Atomics.store(hdr, H_FULL, 1)
+        log(`wmd-web: jit: function table full (${TABLE_MAX_ENTRIES} entries); new blocks stay in the guest's interpreter from now on`)
+        return -1
+      }
+      const b = r * REC_INTS
+      R[b + R_LOG_OFF] = logOff
+      R[b + R_LEN] = bytes.length
+      if (owner < 0 || ownerGen.get(owner) !== Atomics.load(hdr, H_GEN)) {
+        Atomics.add(hdr, H_LIVE_KIB, Math.ceil(bytes.length / 1024))
+        const kib = Atomics.add(hdr, H_MARK_KIB, Math.ceil(bytes.length / 1024)) + Math.ceil(bytes.length / 1024)
+        if (budget && kib * 1024 >= budget / MARK_PARTS) markUse()
+      }
+      R[b + R_SLOT_BASE] = slotBase
+      R[b + R_NFUNCS] = m.names.length
+      R[b + R_HASH_LO] = hl
+      R[b + R_HASH_HI] = hh
+      R[b + R_APPEND_US] = compileUs
+      R[b + R_SYNC_US] = 0
+      R[b + R_INST_US] = 0
+      R[b + R_KIND] = kind
+      recGen = Atomics.load(hdr, H_GEN)
+      R[b + R_GEN] = recGen
+      R[b + R_OWNER] = key
+      R[b + R_USED] = Atomics.load(hdr, H_MARK) + 1 // D-514: new: not cold before the next mark has looked
+      R[b + R_DROPPED] = 0
+      R[b + R_USEDN] = R[b + R_NFUNCS]
+      // A new owner record whose Module came from this Worker's cache (the de-duplication owner
+      // was released between the unlocked check and the lock) must be posted too, or the other
+      // vCPUs wait waitMs for it before compiling from the log.
+      if (share && m.module && (compiledHere || key === r)) {
+        // Post before publishing: once the record is visible other vCPUs wait for this
+        // Module, so a post that fails (Firefox past its code limit can fail to
+        // serialize one) must leave the module unpublished; -1 is what the guest handles.
+        try {
+          share.port.postMessage({ t: 'mod', logOff: key, gen: recGen, module: m.module, bytes }) // the hub keeps the bytes for copies (W31b)
+        } catch (err) {
+          add('failures')
+          return outOfCode(err)
+        }
+        add('shareSent')
+      }
+      Atomics.store(hdr, H_NSLOTS, slotBase + m.names.length)
+      Atomics.store(hdr, H_NMOD, r + 1) // publish (seq-cst store after the plain writes)
+      lastRec = r
+    } finally {
+      unlock()
+    }
+    if (kind !== 3) {
+      add('translated', m.names.length)
+      // W77: the notes for these functions follow from this thread (cache.c cp_publish)
+      if (cache) {
+        recent.push({ base, n: m.names.length, hl, hh, len: bytes.length, bytes })
+        if (recent.length > RECENT) recent.shift()
+      }
+    }
+    // Keep it for this generation. The record may be the first this Worker sees of a
+    // new generation (a flush ran since its last sync): move to it now, or the sync
+    // that follows would drop the Module and wait for it from the hub, which does not
+    // send a Module back to the Worker that posted it.
+    if (recGen > modulesGen) releaseOldModules(recGen)
+    if (keep && m.module && recGen === modulesGen && !modules.has(key)) modules.set(key, m)
+    return base
+  }
+
+  const AGAIN = Symbol('again')
+  class Missing {
+    constructor(logOff) {
+      this.logOff = logOff
+    }
+  }
+
+  /** Compile this Worker's own copy of record r's module from `bytes` and keep it. */
+  function compileLocal(r, bytes) {
+    const owner = Atomics.load(R, r * REC_INTS + R_OWNER)
+    const t = now()
+    const module = compileModule(bytes)
+    const dt = now() - t
+    add('syncCompiles')
+    add('syncCompileNs', ns(dt))
+    Atomics.store(R, r * REC_INTS + R_SYNC_US, Math.max(1, Math.round(dt * 1000)))
+    const m = { module, names: moduleFuncNames(module) }
+    modules.set(owner, m)
+    forceLocal.delete(owner)
+    return m
+  }
+
+  /** Ask the hub for the bytes of `owner` (once per generation); they arrive as {t:'bytes'}. */
+  function wantBytes(owner) {
+    if (!share || wanted.has(owner)) return
+    wanted.add(owner)
+    add('shareBytesWanted')
+    try {
+      share.port.postMessage({ t: 'want', logOff: owner, gen: modulesGen })
+    } catch {}
+  }
+
+  function install(r, mayWait) {
+    if (isDropped(r)) return // D-514
+    const x = rec(r)
+    let m = modules.get(x.owner)
+    if (m && !m.module) m = undefined
+    if (m) {
+      if (m.shared && !m.counted) {
+        m.counted = true
+        add('shareRecv')
+      } else add('moduleCacheHits')
+    } else if (hubBytes.has(x.owner)) {
+      // W31b: the hub sent this Module's bytes (the Module itself could not be received here,
+      // and the log may have reused its bytes): compile the copy from them
+      m = compileLocal(r, hubBytes.get(x.owner))
+      hubBytes.delete(x.owner)
+      add('shareBytesCompiles')
+    } else {
+      // Sharing: the Module was compiled by the Worker that loaded it and is on its way
+      // through the hub; wait for it rather than compile another copy.
+      if (mayWait && !forceLocal.has(x.owner)) throw new Missing(x.owner)
+      // sharing: a record the hub delivered (or whose bytes were released) is the hub's to
+      // supply: ask it for the bytes and wait, never read bytes that may be reused
+      const freedWait = () => {
+        add('shareFreedWaits')
+        wantBytes(x.owner)
+        throw new Missing(x.owner)
+      }
+      if (share && ((!Atomics.load(hdr, H_NORECLAIM) && Atomics.load(R, x.owner * REC_INTS + R_DELIVERED)) || isGone(x.owner))) freedWait()
+      const bytes = L.slice(x.logOff, x.logOff + x.len) // a plain (non-shared) copy
+      if (share && isGone(x.owner)) freedWait() // released while we copied: the copy may be torn
+      m = compileLocal(r, bytes)
+    }
+    if (m.names.length !== x.nfuncs) throw new Error(`jit module ${r} exports ${m.names.length} functions, record says ${x.nfuncs}`)
+    let inst = instances.get(x.owner)
+    if (!inst) {
+      const t = now()
+      inst = new WebAssembly.Instance(m.module, imports)
+      const dt = now() - t
+      add('instantiates')
+      add('instantiateNs', ns(dt))
+      Atomics.store(R, r * REC_INTS + R_INST_US, Math.max(1, Math.round(dt * 1000)))
+      instances.set(x.owner, inst)
+    }
+    const first = tableMin + x.slotBase
+    growTable(first + x.nfuncs)
+    for (let i = 0; i < x.nfuncs; i++) table.set(first + i, inst.exports[m.names[i]])
+    add('tableSets', x.nfuncs)
+  }
+
+  function growTable(need) {
+    if (table.length < need) {
+      // Exactly to `need`, as jit.rs does: the guest's dispatcher treats an index at or
+      // past table.size as "not synced yet" (IR_EXIT_SYNC_MISS, wasm_emit.c) and calls
+      // jit_sync, so the table must never be larger than what this thread installed.
+      table.grow(need - table.length)
+      add('tableGrows')
+      for (let cur = Atomics.load(hdr, H_TABLE_MAX); cur < table.length; cur = Atomics.load(hdr, H_TABLE_MAX)) {
+        if (Atomics.compareExchange(hdr, H_TABLE_MAX, cur, table.length) === cur) break
+      }
+    }
+  }
+
+  // W34: slots are never rewound, so nothing below the first slot of the generation a
+  // clear starts is set again; each clear covers only what may have been set since (a
+  // guest that releases often would otherwise clear its whole, ever longer, table every
+  // time). Not past that first slot: a sync can install the new generation's first
+  // records before it sees the flush, and installs them again after this clear.
+  let clearedTo = tableMin
+  function clearTable(slot0) {
+    if (breakClear) return // test mutation (brk='noclear'): the door-level flush tests must catch it
+    for (let i = clearedTo; i < table.length; i++) table.set(i, null)
+    clearedTo = Math.min(table.length, tableMin + slot0)
+  }
+
+  /**
+   * Bring this thread's table up to date with the global slot list (jit.rs
+   * sync_store). With `mayWait` (sharing), returns the log offset of a Module that has
+   * not arrived yet instead of compiling it; the caller waits and calls again (the
+   * thread's progress, `applied`, is kept). Returns undefined when up to date.
+   */
+  function sync(mayWait = false) {
+    if (!table) throw new Error('jit_sync before the thread was attached')
+    const t = now()
+    add('syncs')
+    try {
+      syncLoop(mayWait)
+    } catch (err) {
+      if (err instanceof Missing) return err.logOff
+      throw err
+    } finally {
+      add('syncNs', ns(now() - t))
+    }
+  }
+  function syncLoop(mayWait) {
+    for (;;) {
+      const g = Atomics.load(hdr, H_GEN)
+      if (g !== gen) {
+        const start = Atomics.load(hdr, H_MOD_START)
+        const slot0 = Atomics.load(hdr, H_SLOT0)
+        if (Atomics.load(hdr, H_GEN) !== g) continue
+        if (gen !== -1) clearTable(slot0)
+        releaseOldModules(g)
+        instances = new Map()
+        applied = start
+        gen = g
+      }
+      applyDrops()
+      const n = Atomics.load(hdr, H_NMOD)
+      for (; applied < n; ) {
+        install(applied, mayWait)
+        applied++
+      }
+      if (Atomics.load(hdr, H_GEN) === gen) break // else a flush ran meanwhile: redo
+    }
+  }
+
+  // How long a vCPU waits for a Module before it compiles its own copy. Every published
+  // module was compiled and posted by its loader, so the wait normally ends in well
+  // under a millisecond; the copy is only for a hub that stopped answering.
+  const waitMs = share?.waitMs ?? 3000
+  /** Wait (the Worker's event loop runs) until `logOff` arrives, or waitMs passes. */
+  function arrival(logOff) {
+    return new Promise(resolve => {
+      const timer = setTimeout(() => {
+        if (waiters.get(logOff) === done) waiters.delete(logOff)
+        resolve(false)
+      }, deserErrors || timeouts.has(logOff) ? Math.min(waitMs, errorWaitMs) : waitMs)
+      const done = () => {
+        clearTimeout(timer)
+        resolve(true)
+      }
+      waiters.set(logOff, done)
+    })
+  }
+
+  /** sync for a caller that can wait: undefined when done at once, else a Promise. */
+  const LOCAL_TRIES = 3 // local copies that may fail with a resource error, and timeouts for one Module, before the thread traps
+  // W57: waits for one Module that end by asking the hub to post it again, before a local copy. A Module
+  // Firefox failed to deliver ('messageerror', seen with its code space far from full) arrives when posted
+  // again; a copy per vCPU instead filled the code space and trapped the guest.
+  const RESENDS = share?.resends ?? 4
+  const asked = new Set() // "gen:owner" asked of the hub in a batch (the port had failed a message)
+  function resend(logOff) {
+    add('shareResends')
+    try {
+      share.port.postMessage({ t: 'resend', logOffs: [logOff], gen: modulesGen })
+    } catch {}
+  }
+  /** W57: ask the hub, in one message, for `miss` and every later Module this thread lacks (not asked yet). */
+  function askMissing(miss, again = false) {
+    const want = [miss]
+    asked.add(`${modulesGen}:${miss}`)
+    const n = Atomics.load(hdr, H_NMOD)
+    for (let r = applied; r < n && want.length < 1024; r++) {
+      const o = Atomics.load(R, r * REC_INTS + R_OWNER)
+      const k = `${modulesGen}:${o}`
+      if (modules.has(o) || o === miss || (asked.has(k) && !again) || isDropped(r)) continue
+      asked.add(k)
+      want.push(o)
+    }
+    add('shareResends', want.length)
+    try {
+      share.port.postMessage({ t: 'resend', logOffs: want, gen: modulesGen })
+    } catch {}
+  }
+  const localFails = new Map() // logOff -> failed local compiles
+  const timeouts = new Map() // logOff -> waits that ended without the Module
+  const localTried = new Set() // logOffs a local copy was tried for
+  let portLossy = false // a wait ended without its Module, asked again too: this port does not deliver reliably, so a missing Module is compiled at once
+  let resendLogged = 0
+  function syncShared() {
+    let miss = sync(true)
+    if (miss === undefined) return undefined
+    return (async () => {
+      while (miss !== undefined) {
+        // nothing can supply it: the log reused its bytes and the hub has none (W31b)
+        if (noBytes.has(miss) && !modules.has(miss) && Atomics.load(hdr, H_GEN) === modulesGen) {
+          throw new Error(`jit: the Module at log offset ${miss} (generation ${modulesGen}) could not be received from the hub${deserErrors ? ' (messageerror)' : ''}, its bytes in the module log were reused and the hub keeps no copy of them (evicted past its byte limit)`)
+        }
+        const t = now()
+        add('shareWaits')
+        let ok = modules.has(miss) || lost.has(miss)
+        // On a lossy port a missing Module is compiled here at once, once: waiting for each of the
+        // 190 Modules of a boot one after another took minutes (P-B7 review, Firefox). If the copy
+        // cannot be made (its log bytes are released) the Module is the hub's to supply: wait.
+        const now_ = !ok && portLossy && !localTried.has(miss)
+        // D-512: the hub posts a Module only when asked (hello pull), so a missing one is asked for at once
+        if (!ok && !now_ && RESENDS && !asked.has(`${modulesGen}:${miss}`)) askMissing(miss)
+        if (!ok && !now_) ok = await arrival(miss)
+        add('shareWaitNs', ns(now() - t))
+        if (now_) {
+          localTried.add(miss)
+          forceLocal.add(miss)
+        } else if (lost.has(miss) && !modules.has(miss)) {
+          lost.delete(miss)
+          lostForGood.add(miss)
+          forceLocal.add(miss) // a local copy is the only way left; if it fails, the thread traps
+        } else if (!ok && !modules.has(miss)) {
+          add('shareTimeouts')
+          const n = (timeouts.get(miss) || 0) + 1
+          timeouts.set(miss, n)
+          const ms = deserErrors || n > 1 ? Math.min(waitMs, errorWaitMs) : waitMs
+          if (n <= RESENDS) {
+            if (!resendLogged++) log(`wmd-web: jit: module at log offset ${miss} (generation ${modulesGen}) did not arrive from the hub in ${ms} ms; asking the hub to post it again`)
+            // a lost batch is asked again as a batch: one wait per Module of it cost minutes (W57 review)
+            if (deserErrors) askMissing(miss, true)
+            else resend(miss)
+            continue
+          }
+          if (n - RESENDS >= LOCAL_TRIES) {
+            throw new Error(`jit: the Module at log offset ${miss} (generation ${modulesGen}) did not arrive from the hub in ${n} waits of ${ms} ms${deserErrors ? ' (a hub message could not be deserialized here)' : ''} and no local copy could be made (its bytes in the module log were released after the hub delivered it)`)
+          }
+          log(`wmd-web: jit: module at log offset ${miss} (generation ${modulesGen}) did not arrive from the hub in ${ms} ms; compiling a copy${portLossy ? '' : '; every later missing Module is compiled at once (this hub port does not deliver reliably)'}`)
+          portLossy = true
+          localTried.add(miss)
+          forceLocal.add(miss)
+        }
+        try {
+          miss = sync(true)
+        } catch (err) {
+          // The copy did not compile (the engine is out of code space). If the Module was only
+          // late it will still come (its loader compiled and posted it), so wait again; but not
+          // forever, and not at all when the port loses Modules.
+          if (!forceLocal.has(miss) || !isResource(err) || lostForGood.has(miss)) throw err
+          forceLocal.delete(miss)
+          const n = (localFails.get(miss) || 0) + 1
+          localFails.set(miss, n)
+          const why = err && err.message ? err.message : String(err)
+          if (n >= LOCAL_TRIES || deserErrors) {
+            throw new Error(`jit: the Module at log offset ${miss} could not be received from the hub${deserErrors ? ' (messageerror)' : ''} and a local copy could not be compiled (${why}; ${n} tries): the engine is out of code space for it`)
+          }
+          log(`wmd-web: jit: the local copy of the Module at log offset ${miss} failed (${why}); waiting for the hub again (${n}/${LOCAL_TRIES})`)
+        }
+      }
+    })()
+  }
+
+  // ---- Dropping cold and sparse modules (D-514) ----
+  //
+  // WebKit gives a page about 350 MB of executable memory; a Go build's modules want about 1 GB of
+  // it. A release (flush) drops every module, so the code in use starts again in WebKit's
+  // interpreter, and the old copies hold the memory until each Worker lets go of them. Instead the
+  // guest's blocks mark their table index each time one is entered through its live flag (vm.wasm's
+  // use marks, at usedBase in memory 0). markUse moves those marks to the records; evict picks the
+  // modules no block entered lately, then the ones where few blocks were entered (a module holds
+  // about a hundred blocks compiled together, and one busy block would keep all of them); the guest
+  // turns their functions off, and drop() takes them out of every Worker (its table entries,
+  // instances and Modules) and out of the hub. The busy blocks of a dropped module are compiled
+  // again (knHit answers a miss for them), together, so the code in use ends up in fewer modules.
+
+  /** H_LOCK held: records whose functions were entered since the last mark get the new mark and the count. */
+  function markUse() {
+    Atomics.store(hdr, H_MARK_KIB, 0)
+    const m = Atomics.add(hdr, H_MARK, 1) + 1
+    add('marks')
+    if (!usedBase) return m
+    const U = new Uint8Array(memory.buffer)
+    const n = Atomics.load(hdr, H_NMOD)
+    for (let r = Atomics.load(hdr, H_MOD_START); r < n; r++) {
+      const b = r * REC_INTS
+      if (R[b + R_DROPPED]) continue
+      const lo = tableMin + R[b + R_SLOT_BASE]
+      let nu = 0
+      for (let i = 0, nf = R[b + R_NFUNCS]; i < nf; i++) {
+        const k = usedBase + ((lo + i) & (VM_CELLS - 1))
+        if (U[k]) {
+          nu++
+          U[k] = 0
+        }
+      }
+      if (nu) {
+        R[b + R_USED] = m
+        R[b + R_USEDN] = nu
+      }
+    }
+    return m
+  }
+
+  let evictPending = null // records evict(0) picked, for evict(1)
+  /**
+   * wmd.jit_evict (vm cache.h jit_evict). mode 0: pick modules until the live ones fit in
+   * EVICT_KEEP of the budget: first the ones no block entered in the last mark, least recently
+   * used first, then the ones where fewer than EVICT_SPARSE of the functions were entered, the
+   * emptiest first. Write their table index ranges [lo, hi) at ptr (sorted, at most cap) and return
+   * how many, or 0 when that frees less than EVICT_MIN of it (the guest then releases every
+   * module). Never the module at table index keep (the dispatcher). mode 1: drop what mode 0 picked.
+   */
+  function evict(mode, keep, ptr, cap) {
+    if (mode === 1) return drop()
+    evictPending = null
+    const budget = liveBudget()
+    if (!usedBase || !budget || !DL) return 0
+    lock()
+    try {
+      const m = markUse()
+      const g = Atomics.load(hdr, H_GEN)
+      const n = Atomics.load(hdr, H_NMOD)
+      const groups = new Map() // owner -> {used, fns, busy, recs, kib}
+      for (let r = Atomics.load(hdr, H_MOD_START); r < n; r++) {
+        const b = r * REC_INTS
+        if (R[b + R_DROPPED] || R[b + R_GEN] !== g) continue
+        const o = R[b + R_OWNER]
+        let x = groups.get(o)
+        if (!x) groups.set(o, (x = { o, used: 0, fns: 0, busy: 0, recs: [], kib: o === r || R[o * REC_INTS + R_GEN] !== g ? Math.ceil(R[b + R_LEN] / 1024) : 0 }))
+        const lo = tableMin + R[b + R_SLOT_BASE]
+        const nf = R[b + R_NFUNCS]
+        x.used = Math.max(x.used, keep >= lo && keep < lo + nf ? Infinity : R[b + R_USED])
+        x.fns += nf
+        if (R[b + R_USED] >= m) x.busy += R[b + R_USEDN]
+        x.recs.push(r)
+      }
+      const all = [...groups.values()]
+      const cold = all.filter(x => x.used < m).sort((a, b) => a.used - b.used || a.o - b.o)
+      const sparse = all
+        .filter(x => x.used === m && x.busy < x.fns * EVICT_SPARSE)
+        .sort((a, b) => a.busy / a.fns - b.busy / b.fns || a.o - b.o)
+      let live = Atomics.load(hdr, H_LIVE_KIB)
+      const keepKiB = Math.floor((budget * EVICT_KEEP) / 1024)
+      const pick = []
+      let ranges = 0
+      let freed = 0
+      for (const x of [...cold, ...sparse]) {
+        if (live <= keepKiB || ranges + x.recs.length > cap) break
+        pick.push(x)
+        ranges += x.recs.length
+        live -= x.kib
+        freed += x.kib
+      }
+      if (!pick.length || freed * 1024 < budget * EVICT_MIN) return 0
+      const iv = []
+      for (const x of pick) for (const r of x.recs) iv.push([tableMin + R[r * REC_INTS + R_SLOT_BASE], R[r * REC_INTS + R_NFUNCS]])
+      iv.sort((a, b) => a[0] - b[0])
+      const out = new DataView(memory.buffer, ptr >>> 0, iv.length * 8)
+      iv.forEach(([lo, nf], i) => {
+        out.setUint32(i * 8, lo, true)
+        out.setUint32(i * 8 + 4, lo + nf, true)
+      })
+      evictPending = { gen: g, pick, freed }
+      return iv.length
+    } finally {
+      unlock()
+    }
+  }
+
+  /** evict(1): the guest turned the picked modules' functions off; drop them everywhere. */
+  function drop() {
+    const p = evictPending
+    evictPending = null
+    if (!p) return 0
+    const owners = []
+    lock()
+    try {
+      if (Atomics.load(hdr, H_GEN) !== p.gen) return 0
+      let k = Atomics.load(hdr, H_DROPS)
+      for (const x of p.pick) {
+        for (const r of x.recs) {
+          if (!ensure(store.drops, (k + 1) * 4)) break
+          Atomics.store(R, r * REC_INTS + R_DROPPED, 1)
+          DL[k++] = r
+        }
+        owners.push(x.o)
+      }
+      Atomics.sub(hdr, H_LIVE_KIB, Math.min(p.freed, Atomics.load(hdr, H_LIVE_KIB)))
+      Atomics.store(hdr, H_DROPS, k)
+    } finally {
+      unlock()
+    }
+    add('evictions')
+    add('evictedModules', owners.length)
+    add('evictedKiB', p.freed)
+    if (share) share.port.postMessage({ t: 'drop', gen: p.gen, owners })
+    return owners.length
+  }
+
+  // per thread: drops this thread's table has taken
+  let dropsApplied = 0
+  /** Clear the table entries, instances and Modules of the records dropped since this thread last looked. */
+  function applyDrops() {
+    if (!DL) return
+    const nd = Atomics.load(hdr, H_DROPS)
+    for (; dropsApplied < nd; dropsApplied++) {
+      const r = DL[dropsApplied]
+      const b = r * REC_INTS
+      if (Atomics.load(R, b + R_GEN) !== gen) continue
+      const o = Atomics.load(R, b + R_OWNER)
+      if (r < applied) {
+        const first = tableMin + Atomics.load(R, b + R_SLOT_BASE)
+        for (let i = 0, nf = Atomics.load(R, b + R_NFUNCS); i < nf && first + i < table.length; i++) table.set(first + i, null)
+      }
+      instances.delete(o)
+      modules.delete(o)
+      hubBytes.delete(o)
+    }
+  }
+
+  function flush() {
+    let g
+    lock()
+    try {
+      // H_MOD_START and H_SLOT0 before H_GEN, so a reader that sees the new generation
+      // also sees where it starts (sync re-reads H_GEN after H_MOD_START).
+      // H_NSLOTS is not rewound (W34): the guest flushes while other vCPUs run, and a
+      // vCPU whose table is not synced yet may still call a slot index it read before
+      // the flush. With slots only ever growing, that index is either an old entry
+      // (still the old, correct function until its thread syncs) or past its table
+      // (IR_EXIT_SYNC_MISS); a rewound index could name another block's new function.
+      Atomics.store(hdr, H_MOD_START, Atomics.load(hdr, H_NMOD))
+      Atomics.store(hdr, H_SLOT0, Atomics.load(hdr, H_NSLOTS))
+      g = Atomics.add(hdr, H_GEN, 1) + 1
+      Atomics.store(hdr, H_LIVE_KIB, 0)
+    } finally {
+      unlock()
+    }
+    if (share) share.port.postMessage({ t: 'flush', gen: g }) // the hub drops older Modules
+    add('flushes')
+  }
+
+
+  const loadFailed = err => {
+    log(`wmd-web: jit_load: ${err && err.message ? err.message : err}`)
+    return -1
+  }
+  const imp = {
+    load(ptr, len) {
+      add('loads')
+      if (breakLoad) return -1
+      const bytes = readGuest(ptr, len)
+      if (!bytes) return outside('load', ptr, len)
+      const base = append(bytes, 1, 'compile')
+      if (base < 0) return base // -1, or JIT_OVER_BUDGET (-2) for the budget refusal
+      try {
+        if (share) {
+          const p = syncShared()
+          if (p) return p.then(() => base, loadFailed)
+        } else sync()
+      } catch (err) {
+        return loadFailed(err)
+      }
+      return base
+    },
+    compile(ptr, len) {
+      add('compiles')
+      if (breakCompile) return -1
+      // sharing: the compile thread compiles (once for the process) and shares it
+      const bytes = readGuest(ptr, len)
+      if (!bytes) return outside('compile', ptr, len)
+      return append(bytes, 2, share ? 'compile' : compileOnCompile)
+    },
+    sync() {
+      // failure is fatal, as in the runner (exit 4): the throw traps the thread
+      if (share) return syncShared()
+      sync()
+    },
+    flush() {
+      flush()
+      if (share) return syncShared()
+      sync()
+    },
+    known(ptr) {
+      add('knownAsks')
+      if (!cache && !KN) return -1
+      return known(ptr)
+    },
+    note(ptr, n) {
+      add('notes')
+      if (cache || KN) note(ptr, n)
+    },
+    evict(mode, keep, ptr, cap) {
+      return evict(mode, keep, ptr, cap)
+    },
+  }
+
+  return {
+    imports: imp,
+    /** A new vm.wasm instance (a new thread) on this Worker: its table and helpers. */
+    attach(instance, tbl) {
+      table = tbl
+      const ub = instance.exports.vm_jit_used_base
+      if (typeof ub === 'function' && !usedBase) usedBase = ub() >>> 0
+      const hst = {}
+      for (let i = 0; i < HELPERS; i++) {
+        const f = instance.exports[`vm_helper_${i}`]
+        if (typeof f !== 'function') throw new Error(`vm.wasm has no export vm_helper_${i}`)
+        hst[`h${i}`] = f
+      }
+      imports = { env: ram ? { mem0: memory, mem1: memory, win: ram, tbl } : { mem0: memory, mem1: memory, tbl }, hst }
+      gen = -1
+      applied = 0
+      clearedTo = tableMin
+      instances = new Map()
+      dropsApplied = Atomics.load(hdr, H_DROPS) // install skips what is dropped already
+    },
+    /** For tests: attach with an explicit helper list instead of a vm.wasm instance. */
+    attachRaw(tbl, helpers) {
+      table = tbl
+      const hst = {}
+      helpers.forEach((f, i) => (hst[`h${i}`] = f))
+      imports = { env: ram ? { mem0: memory, mem1: memory, win: ram, tbl } : { mem0: memory, mem1: memory, tbl }, hst }
+      gen = -1
+      applied = 0
+      clearedTo = tableMin
+      instances = new Map()
+      dropsApplied = Atomics.load(hdr, H_DROPS) // install skips what is dropped already
+    },
+    sync: () => {
+      if (share) throw new Error('jit door: sharing is on, use syncAsync()')
+      sync()
+    },
+    /** For JS callers that can wait (a new thread before wasi_thread_start). */
+    syncAsync: async () => {
+      if (share) await syncShared()
+      else sync()
+    },
+    get compiledModules() {
+      return modules.size
+    },
+  }
+}
+
+function pct(sorted, p) {
+  if (!sorted.length) return 0
+  return sorted[Math.min(sorted.length - 1, Math.floor((p / 100) * sorted.length))]
+}
+
+/** Counters and per-module compile cost, read from the store (page side). */
+export function readJitStats(store) {
+  const hdr = new Int32Array(store.ctl, 0, HDR_INTS)
+  const st = new Int32Array(store.ctl, STATS_OFF, STATS.length * 2)
+  const R = new Int32Array(store.recs)
+  const out = {}
+  STATS.forEach((k, i) => {
+    const v = statLoad(st, i)
+    out[k] = k.endsWith('Ns') ? Math.round(v / 1e4) / 100 : v // ...Ns reported in ms
+  })
+  for (const k of Object.keys(out)) {
+    if (k.endsWith('Ns')) {
+      out[`${k.slice(0, -2)}Ms`] = out[k]
+      delete out[k]
+    }
+  }
+  const n = Atomics.load(hdr, H_NMOD)
+  const append = []
+  const sync = []
+  const inst = []
+  let funcs = 0
+  let maxLen = 0
+  for (let r = 0; r < n; r++) {
+    const b = r * REC_INTS
+    funcs += R[b + R_NFUNCS]
+    maxLen = Math.max(maxLen, R[b + R_LEN])
+    if (R[b + R_APPEND_US]) append.push(R[b + R_APPEND_US] / 1000)
+    if (R[b + R_SYNC_US]) sync.push(R[b + R_SYNC_US] / 1000)
+    if (R[b + R_INST_US]) inst.push(R[b + R_INST_US] / 1000)
+  }
+  const summary = a => {
+    a.sort((x, y) => x - y)
+    const sum = a.reduce((s, v) => s + v, 0)
+    return { n: a.length, totalMs: +sum.toFixed(2), p50Ms: +pct(a, 50).toFixed(3), p99Ms: +pct(a, 99).toFixed(3), maxMs: +(a.at(-1) ?? 0).toFixed(3) }
+  }
+  out.modules = n
+  out.functions = funcs
+  out.maxModuleBytes = maxLen
+  out.flushGen = Atomics.load(hdr, H_GEN)
+  out.liveModules = n - Atomics.load(hdr, H_MOD_START)
+  out.liveSlots = Atomics.load(hdr, H_NSLOTS) - Atomics.load(hdr, H_SLOT0)
+  out.slots = Atomics.load(hdr, H_NSLOTS)
+  out.liveKiB = Atomics.load(hdr, H_LIVE_KIB) // W34: what the module budget counts
+  out.tableMax = Atomics.load(hdr, H_TABLE_MAX)
+  out.logBytes = Atomics.load(hdr, H_LOG_USED)
+  out.logCapacity = store.log.byteLength
+  out.logTail = Atomics.load(hdr, H_LOG_TAIL) // owner records below it have had their bytes released
+  let live = 0
+  let delivered = 0
+  for (let r = out.logTail; r < n; r++) {
+    if (R[r * REC_INTS + R_OWNER] !== r || R[r * REC_INTS + R_FREED]) continue
+    live++
+    if (R[r * REC_INTS + R_DELIVERED]) delivered++
+  }
+  out.logLiveRecords = live // owners whose bytes are still in the log
+  out.logLiveDelivered = delivered // ... of which the hub delivered (released at the next release pass)
+  out.recordsUsed = n
+  out.recordsMax = Math.floor(store.recs.maxByteLength / REC_BYTES) // records are not reclaimed: the next limit after the log
+  out.recordBytes = store.recs.byteLength
+  out.compileInLoader = summary(append) // per module, in the thread that loaded it
+  out.compileInSync = summary(sync) // per module, in a thread that synced it
+  out.instantiate = summary(inst)
+  return out
+}
+
+/**
+ * The minimum of the table a wasm module imports (vm.wasm's env.__indirect_function_table),
+ * read from the binary's import section, as the runner reads it from the module's import
+ * type (host.rs table_min). The JS API does not expose import limits. vm.wasm's minimum
+ * grows when it gains functions taken by address (155 before W3.3, 158 after), and the
+ * JIT slots start right after it. null when the module imports no table.
+ *
+ * With more than one table import, env.__indirect_function_table is the one (it is the
+ * only table the browser host provides, worker.js); without it, the last table import
+ * (host.rs keeps the last). Custom sections anywhere, any LEB128 length (non-minimal
+ * encodings included), table64/memory64/shared/custom-page-size limits, typed function
+ * references ((ref null? ht), 0x63/0x64 + a heap type) in table and global imports, and
+ * exact function imports (0x20) are parsed. Throws on what is not a module or is cut short.
+ * @param {ArrayBuffer|SharedArrayBuffer|ArrayBufferView} bytes
+ * @returns {number|null}
+ */
+export function tableMinOf(bytes) {
+  const b = ArrayBuffer.isView(bytes) ? new Uint8Array(bytes.buffer, bytes.byteOffset, bytes.byteLength) : new Uint8Array(bytes)
+  let p = 8
+  let end = b.length
+  const byte = () => {
+    if (p >= end) throw new Error('tableMinOf: truncated module')
+    return b[p++]
+  }
+  const u = () => {
+    // unsigned LEB128 (u32 or, for table64/memory64 limits, u64: a Number, exact to 2^53)
+    let r = 0
+    let mul = 1
+    for (let n = 0; ; n++) {
+      if (n >= 10) throw new Error('tableMinOf: LEB128 too long')
+      const x = byte()
+      r += (x & 0x7f) * mul
+      if (!(x & 0x80)) return r
+      mul *= 128
+    }
+  }
+  const s33 = () => {
+    // a heap type: a negative abbreviation (one byte) or a type index (s33 LEB)
+    for (let n = 0; n < 5; n++) if (!(byte() & 0x80)) return
+    throw new Error('tableMinOf: LEB128 too long')
+  }
+  const name = () => {
+    const n = u()
+    if (p + n > end) throw new Error('tableMinOf: truncated module')
+    const s = new TextDecoder().decode(b.subarray(p, p + n))
+    p += n
+    return s
+  }
+  const reftype = t => {
+    if (t === 0x63 || t === 0x64) s33() // (ref null ht) / (ref ht)
+  }
+  const valtype = () => reftype(byte())
+  const limits = () => {
+    // bit 0: has a maximum; bit 1: shared; bit 2: 64-bit index; bit 3: custom page size
+    const flags = byte()
+    if (flags & ~0x0f) throw new Error(`tableMinOf: limits flags ${flags}`)
+    const min = u()
+    if (flags & 1) u()
+    if (flags & 8) u()
+    return min
+  }
+  if (b.length < 8 || b[0] !== 0 || b[1] !== 0x61 || b[2] !== 0x73 || b[3] !== 0x6d) throw new Error('tableMinOf: not a wasm module')
+  while (p < b.length) {
+    end = b.length
+    const id = byte()
+    const size = u()
+    const next = p + size
+    if (next > b.length) throw new Error('tableMinOf: truncated module')
+    if (id !== 2) {
+      p = next
+      continue
+    }
+    end = next // the import section's own end
+    let last = null
+    let named = null
+    for (let n = u(); n > 0; n--) {
+      const mod = name()
+      const isIft = name() === '__indirect_function_table' && mod === 'env' // both names are read
+      const kind = byte()
+      if (kind === 0 || kind === 0x20) u() // function (or exact function): type index
+      else if (kind === 1) {
+        reftype(byte())
+        const min = limits()
+        last = min
+        if (isIft) named = min
+      } else if (kind === 2) limits() // memory
+      else if (kind === 3) {
+        valtype()
+        byte() // mutability
+      } else if (kind === 4) {
+        byte() // tag: attribute
+        u()
+      } else throw new Error(`tableMinOf: import kind ${kind}`)
+    }
+    return named ?? last
+  }
+  return null
+}