@threadedstack/wmd-web 0.1.19 → 0.1.20

package/README.md

@@ -159,10 +159,11 @@ The interface this host implements is in [docs/host-interface.md](docs/host-inte
 
 `createBuilder` runs BuildKit (moby/buildkit v0.33.0) in a privileged builder machine in the page and builds a
 Dockerfile there. The result is `{index, packs}`, the shape `pullImage` returns, so `bootWmd` can run it at once.
-Chromium, Firefox and WebKit all pass the same 18 build steps (plan `docs/plans/web-buildkit-impl.md`, section 10).
+Chromium, Firefox and WebKit all pass the same 18 build steps, and Node and Go projects for arm64 and amd64 (plan
+`docs/plans/web-buildkit-impl.md`, section 10).
 
 ```js
-import { createBuilder } from 'wmd-web/build'
+import { buildImage, createBuilder } from 'wmd-web/build'
 
 const builder = await createBuilder({
   vmUrl, files,                       // as bootWmd: the engine and the builder arch's guest files
@@ -176,6 +177,9 @@ const builder = await createBuilder({
 const r = await builder.build({ context: { Dockerfile: 'FROM alpine:3.20\nRUN echo hi > /x\n' } })
 // r: {index, packs, log, path: 'fast'|'buildkit', ms, cached}
 await builder.close()
+
+// or, for one build: createBuilder + build + close in one call
+const r2 = await buildImage({ ...builderOptions, context, timeoutMs: 30 * 60_000 })
 ```
 
 - **The cache stays.** The disk outlives the builder and the visit. After a reload, or after a tab was killed
@@ -190,7 +194,24 @@ await builder.close()
   for layer the same as BuildKit's (40 compared cases): under 0.4 s once its base image is pulled, where a warm
   BuildKit takes 5 to 14 s.
 - **Errors:** `BuildError {step, tail, reason}`: `reason` is `'no-space'`, `'quota'`, `'disk'`, `'timeout'`, `'pin'`
-  or `'secret'`. Cancelling with `signal` stops the step and leaves nothing behind.
+  or `'secret'`. Cancelling with `signal` stops the step and leaves nothing behind. A failed build also carries `jit`
+  (the engine's last JIT messages), `net` (the guest network's counters and events), and, when the machine itself
+  stopped, `machine` (why, and its last output).
+- **RAM and vCPUs.** The default is 1536 MiB and 2 vCPUs (`ram`, `cpus`). Small builds and the proxy project in the
+  plan fit. A build that compiles a native addon or bundles a large app needed 3072 MiB and 4 vCPUs (plan 10.5); a
+  single `RUN` step must finish within `timeoutMs`, since BuildKit resumes from its cache only between steps.
+- **WebKit** builds Go and Node images and the real projects of the plan, but slower: its code space fills and new
+  code runs in the interpreter for a while (a `{t:'slow', reason:'webkit-code-space'}` event says so).
+  - In WebKit, node in `RUN` steps runs its JavaScript in the interpreter (D-553, `nodeInterpreted`, an
+    `{t:'node-interpreted'}` event): node's own JIT writes code faster than WebKit's code pool takes it, and a
+    1,600-package `pnpm` install did not end in 27 minutes. A preload bound at `/dev/.wmd-node.js` and named in
+    `NODE_OPTIONS` (`--require`) turns off V8's compilers; WebAssembly still works. The image and the cache keys do
+    not change. `nodeInterpreted: false` turns it off; `true` turns it on elsewhere.
+  - npm closes a TLS handshake that is not done 15 s after the connect. The guest network lets 4 handshakes go at
+    once, sends a ClientHello that waited on a fresh connection, and sends an unanswered one again once (D-552); it
+    dials a stream again when the remote closes it before any byte crossed (D-551).
+  - WebKit cannot read a Blob of 128 MiB or more whole (`NotReadableError`). Read the `tar` Blob a build returns
+    with `blobBytes(blob)` from `wmd-web/build`, which reads it in slices (D-554).
 - **The builder images** are built with `make web-builder` (wmd builds them; Docker Desktop is not used) into
   `web/dist/builder/builder-<arch>.tar`, and their sha256 is pinned in `src/build/pin.js`. `make web-release` puts
   them next to the release tgz.

package/RELEASE.json

@@ -1,66 +1,50 @@
 {
   "name": "wmd-web",
-  "version": "0.4.0",
-  "commit": "89688f12e0caef39ab0a159b39c00f3525e31051",
-  "previous": "wmd-web-v0.1.0",
+  "version": "0.5.1",
+  "commit": "f0089e9f12e73d951b5a3a47f962764edc1c39a3",
+  "previous": "wmd-web-v0.5.0",
   "decisions": [
-    "D-486",
-    "D-488",
-    "D-494",
-    "D-498",
-    "D-505",
-    "D-506",
-    "D-507",
-    "D-509",
-    "D-511",
-    "D-516",
-    "D-518",
-    "D-531",
-    "D-533",
-    "D-539",
-    "D-542",
-    "D-544",
-    "D-545",
-    "D-547",
-    "D-548"
+    "D-552",
+    "D-554"
   ],
-  "vmSources": "7a707b82c43d3f1eb999476cad68e7ce79cc9cb5",
+  "vmSources": "543f2ee1a363719c2a973fff350d54a54d325286",
   "guest": {
     "arch": "arm64",
     "files": {
       "vm.wasm": {
-        "sha256": "40299e37e788189e6d3bea9d9cdaefa241a5acf27931e6aae14117c100b036ec",
-        "bytes": 1561499
+        "sha256": "73bee71d7453a130f7991c7cead3bc12787050116217f635f9f523f584d2577d",
+        "bytes": 1562868
       },
       "Image": {
-        "sha256": "1d296c86b1fee0a10d0c2571b7e19854fe85ca0250cc9fadfe75eb268e48be7b",
+        "sha256": "6952a8d4f1bafec9c3e3b17e2c4af20ab5de8a7086956d087979804be2a01353",
         "bytes": 39049224
       },
       "Image-4k": {
-        "sha256": "6296e3d9fc7bb06a26340bb4453b5f0970d6b55452903546ba2c762820e2df5b",
+        "sha256": "47a1dcf06bcd1cc31fb4f02adbd1e035bc9e9a243fe57f3efd71b4a287581de2",
         "bytes": 38828040
       },
       "initramfs.cpio.gz": {
-        "sha256": "f008aa9e0f6b4e913242f9982d3b194dba7dc39042a24bc89be64630672125af",
-        "bytes": 4685204
+        "sha256": "efa6eb2338cb01d87eeebce8035ed7a26b00edcfc3b9db963b38272715d2ee9d",
+        "bytes": 4683846
       }
     }
   },
   "files": {
-    "README.md": "3c12ca29aab5160b955ba3f50035f19be1dbf0278c4fb006e253a37ac9efbe6a",
+    "README.md": "6962e410444bcf44ba6dd8498673e2de17ee4f8b96e1d29044a55b8f0dbcd8de",
     "export-page/coi-sw.js": "0300e670b413cb2e0aae35843fc583546bbf6687df971ab6df41cfa3b0d494d7",
     "export-page/index.html": "f5450c89e63601bbbbffef421f03491b231d1f143070012c1c5315d4b0059f43",
     "export-page/run.css": "b57adf1e76553549c1f89ff157b7973409dedc21889cd3932948cd05b51adc6f",
     "export-page/run.js": "717636a632a40469106ddf1383e198eaac5d83651b5866d0699ec04b82462b7f",
-    "guest/arm64/Image": "1d296c86b1fee0a10d0c2571b7e19854fe85ca0250cc9fadfe75eb268e48be7b",
-    "guest/arm64/Image-4k": "6296e3d9fc7bb06a26340bb4453b5f0970d6b55452903546ba2c762820e2df5b",
-    "guest/arm64/initramfs.cpio.gz": "f008aa9e0f6b4e913242f9982d3b194dba7dc39042a24bc89be64630672125af",
-    "guest/arm64/vm.wasm": "40299e37e788189e6d3bea9d9cdaefa241a5acf27931e6aae14117c100b036ec",
-    "package.json": "778ef2457ab01f302387c811d796b7c61f97feb095725da285655629965f2b5e",
+    "guest/arm64/Image": "6952a8d4f1bafec9c3e3b17e2c4af20ab5de8a7086956d087979804be2a01353",
+    "guest/arm64/Image-4k": "47a1dcf06bcd1cc31fb4f02adbd1e035bc9e9a243fe57f3efd71b4a287581de2",
+    "guest/arm64/initramfs.cpio.gz": "efa6eb2338cb01d87eeebce8035ed7a26b00edcfc3b9db963b38272715d2ee9d",
+    "guest/arm64/vm.wasm": "73bee71d7453a130f7991c7cead3bc12787050116217f635f9f523f584d2577d",
+    "package.json": "7d43c05047d0a3ea56b4a7709f48a60de32e15c3bdf328d55435c46637981b40",
     "src/base.js": "982f8e46dbb727ec542a494ebdb884ccd19a31ff4e091425b2d1fc01b0d4754a",
-    "src/boot.js": "62f5cf901d797d53bef584b3c6c0c7fb1a4cc8e2450e9570d6289c72036ed025",
-    "src/build/builder.js": "751ea022e1f6f0c6ab79bd4efd6cfe0d705268ff7f699af87dcc64d1871ccc52",
-    "src/build/context.js": "4baf1884d366455f3f76f397575d515671585ebf5deb27bc35bc2b1dd9c6bc11",
+    "src/blob.js": "bb2a2f0d87ce236280a7be2f246c926010dfe07f649c27da5e70d8eb5eaf7061",
+    "src/boot.js": "b1819d2b8abd46fd42f10a986719a311bedca705fc368a4cd19cc121b04b57d2",
+    "src/build/builder.js": "0d5355c8570b0ecedce25602ff7f60c49b7daaed669426328f05f52e26048213",
+    "src/build/context.js": "d38097c61dbdadc4d41290c010425a4422f499aba473fa2b83f2a5c41e543571",
     "src/build/dockerfile.js": "5957fe3d4ac8ff8b312f980ee04bd1d98ad4373a61f9a33e02f1ff1108b6ea53",
     "src/build/dockerignore.js": "8fc03d09da020f43ea483979b1183891b71d76f012379ab7813838ea0e53c546",
     "src/build/fast.js": "bf7373a43cce995b21751c317a58d18438f9fd2f670266b314b1151ef3cdb9e8",
@@ -93,8 +77,8 @@
     "src/host/clock.js": "aba6af3a8b1a985ae340892222e4b482d33afe20f5c8b3a4c7403ce87d1e247c",
     "src/host/ctl.js": "ca2ebbb940c9668cb0573c959cd2ff8982f96d58dfdb8dce39d304b89e033dd7",
     "src/host/disk-map.js": "3d7e0d7d488ce25fc6a0e4dc0a9b1c8fc2af96bac1c03491a1d30be392af268b",
-    "src/host/disk-worker.js": "9d470cdc72d9e1fbf955e466ec2562abe780f2c6d89174ca3e4fbb1828f8dd76",
-    "src/host/disk.js": "373e23539e3916674b7e8708d2e3ae22578214129e56936765db5c8f465cb343",
+    "src/host/disk-worker.js": "6e82bfeb4aa3f8b02bd7cb2de7427def26114e016f6b05196c8485d7fc8315ee",
+    "src/host/disk.js": "e941e62cc2d9a83582d53c80c09c5f0f682508f77390237bedff4051c489b2cd",
     "src/host/errno.js": "26021d85962084be2c43c98fb3accafc2a8f11fbf3c8a5b8d484bd6a088ae4db",
     "src/host/fs.js": "d6753f74db35b7b01baa8709fc7fdcdfc8d638dfe42f454b0a833b22111e8f4a",
     "src/host/gcnudge.js": "4a6569cb73ae24a11fc4ac8c467380bd9efba0bb5fa9867b797bc4f153ab15ab",
@@ -103,7 +87,7 @@
     "src/host/jit-hub-core.js": "f8d39dd0e4cbd42568bf56a8a7105f321d33bcf2d5faf8756d45a1ed692bd344",
     "src/host/jit-hub.js": "cf3fc9f9d4e3fb50c41d6de5e2523f380d3c6c1feaf61c15d90cde89aec2f4c3",
     "src/host/jit-snap.js": "3932f36047c9edeb7f59282d1c37fef19c8f5a9fe4bd0192fb93aa64030fe51d",
-    "src/host/jit.js": "cb39f90df63752a7d4077f6972731cf4b1d8026cb4ca594e32f9203be6fe1edb",
+    "src/host/jit.js": "72ef7334506fde2b3724cee93b52a987fbd6d45473b8de93d914db8a80ae9e17",
     "src/host/layout.js": "d5bc5aa9292630b204438df5d6278fda6daa2a65acc061e1c57e0272b32fecc8",
     "src/host/monitor.js": "ae1741ba35668bcc6192642246494433b175668933921634c699af5a0a69acc0",
     "src/host/p9mount.js": "43246601fc1e27d5294742e4482ed166a50c665cb5f526c3646a47dd27e06150",
@@ -113,14 +97,14 @@
     "src/host/wasi.js": "fbafa239b8fb4083f7e8c910b1adab38901e8e7cffd247284a9abb2847eaf4bd",
     "src/host/wmd-imports.js": "3a00562f7c9c7787ab3841b14dde5d903a78f43ed19c43a2f5e31fd8a14c09d2",
     "src/host/yamux.js": "f4044f14f7e836224bdb4b1e53e59c565ee478b83b2e428fffb9f7a048768f79",
-    "src/image-files.js": "7bac16bd278d17ba291dfe4771564627b5efbdda927b429018a75e8b906dd4cd",
+    "src/image-files.js": "19f90a7d3c8accae5093e53bb85fe7e158ac1dd18866283722171eccb1d7e37a",
     "src/net/dhcp-dns.js": "fdfa7c7d5cbbb4a8774b7dee195bf2df22a0c3fe8f20ac9694b24485fa8f25d5",
     "src/net/net-worker.js": "0a2ce998f69807e386ded7ff1bee53687a1d59ed76d7ef46e2eb6f958b14ad38",
     "src/net/packet.js": "d658f26fa84324a88d7dbc26af9c4a9c10e977c3060f16f7db431496eacd1127",
     "src/net/peer.js": "d83cf85639f6197fe26c877eb79f8c9afc017bf2362dc2b22a8b6bd0f45f3f19",
     "src/net/proto.js": "abfc8cd6f4331cbc98fcb1b0bba0795ff3042cc7db10476673ead1723249eee0",
     "src/net/relay-client.js": "4101de76dc0251db46839dc786cce677e4020795adf022bdce14bcf7edf8f864",
-    "src/net/stack.js": "cd451cce7130f08e59cc19c961d2a5fca8416e577a40df1419ab6d5046018891",
+    "src/net/stack.js": "b721e4e116b0611abfe8ec1c6f2e212efd89a11f745fef2222ca5de474d8c0a9",
     "src/net/switch.js": "bb047fb1ceeb10a84b5475916ead916362accf0e6f42a86561653dfad0c6c50d",
     "src/net/wisp-client.js": "653961c4b735f2f74e5ea89e75c387f15ec8b8d9ed4c45d06c7d6b2a04968d42",
     "src/net/wisp-transport.js": "2b71201f3c686078c867e8995bf5c1cd6d47a0d415f476f3a33fbd5729a55f74",
@@ -128,7 +112,7 @@
     "src/registry/client.js": "fd38550e9afd82c5cb498513d245c33357a71697b3b2e6dd78538934bcc9d879",
     "src/registry/converter.js": "1fb8294fd5275f6772c27130cc9ba70bd46fafaf440884d42448036618229f37",
     "src/registry/hub.js": "cd672323bd1f96bd1d7e9eed80d4f36891e919e456fc0deb378fa0c7e3b6f249",
-    "src/registry/load-tar.js": "9dd2b5d8884c64247339b141ab5a57b8ab1a2e007c32aa45b1103b37405b0ed7",
+    "src/registry/load-tar.js": "219d6701f5c938e27e3ca36ade8fcea8114a5f2b1511496f0dbd60137290867f",
     "src/registry/oci.js": "6a51ea16b34a65c0e732730f3e07d7ad16c50f6943a486ec05ca6aa3e98676a1",
     "src/registry/pack-worker.js": "fd6798851cb7815dacfcb67fc78c41654209c5504d8fd343aae524e99de1c741",
     "src/registry/pull.js": "24f2e01a76c9f7f27896af69b989f8c97f0ca31712b3e8110aaa5b5e3148b04b",

package/guest/arm64/Image

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/guest/arm64/Image
 size: 39049224 bytes
-sha256: 1d296c86b1fee0a10d0c2571b7e19854fe85ca0250cc9fadfe75eb268e48be7b
+sha256: 6952a8d4f1bafec9c3e3b17e2c4af20ab5de8a7086956d087979804be2a01353

package/guest/arm64/Image-4k

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/guest/arm64/Image-4k
 size: 38828040 bytes
-sha256: 6296e3d9fc7bb06a26340bb4453b5f0970d6b55452903546ba2c762820e2df5b
+sha256: 47a1dcf06bcd1cc31fb4f02adbd1e035bc9e9a243fe57f3efd71b4a287581de2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@threadedstack/wmd-web",
-  "version": "0.1.19",
+  "version": "0.1.20",
   "license": "MIT",
   "homepage": "https://github.com/threadedstack/wmd-releases",
   "repository": {
@@ -9,9 +9,9 @@
   },
   "description": "Browser host for wmd's guest vm.wasm (Web Workers + shared memory + WASI preview1)",
   "wmd": {
-    "tag": "v0.1.19",
-    "commit": "89688f12e0caef39ab0a159b39c00f3525e31051",
-    "web": "0.4.0"
+    "tag": "v0.1.20",
+    "commit": "f0089e9f12e73d951b5a3a47f962764edc1c39a3",
+    "web": "0.5.1"
   },
   "type": "module",
   "main": "./src/boot.js",

package/src/blob.js

@@ -0,0 +1,12 @@
+// D-554: WebKit (Playwright's WebKit 26 here) cannot read a Blob of 128 MiB or more whole: arrayBuffer() and stream()
+// fail with NotReadableError ("The I/O read operation failed."). Slices of the same Blob read. Measured with 128, 256
+// and 400 MiB Blobs; 64 MiB read whole. Readers of large slices (a tar entry, a layer) go through here too.
+const SLICE = 16 << 20
+
+/** A Blob's bytes, read in 16 MiB slices. */
+export async function blobBytes(b) {
+  if (b.size <= SLICE) return new Uint8Array(await b.arrayBuffer())
+  const out = new Uint8Array(b.size)
+  for (let o = 0; o < b.size; o += SLICE) out.set(new Uint8Array(await b.slice(o, o + SLICE).arrayBuffer()), o)
+  return out
+}

package/src/boot.js

@@ -192,6 +192,13 @@ export const WEBKIT_CODE_BUDGET_MIB = 144
  */
 export const WEBKIT_JIT_THRESHOLD = 1000
 
+/**
+ * D-551: how deep compiled guest calls may nest in WebKit (vm.wasm's WMD_MIRROR_DEPTH; 32, and 64 for region
+ * calls, elsewhere). An amd64 go build in WebKit trapped with "Maximum call stack size exceeded" at about 33
+ * frames of block code, which killed the machine; Chromium and Firefox ran the same build at 32.
+ */
+export const WEBKIT_MIRROR_DEPTH = 8
+
 const MiB = 1 << 20
 
 /**
@@ -342,7 +349,7 @@ export function fmaFuses() {
 
 /**
  * W32: the environment vm.wasm starts with in this browser: vmEnv's, plus
- * WMD_JIT_THRESHOLD=WEBKIT_JIT_THRESHOLD in WebKit, W30's WMD_TRACE_MAX for the engine and
+ * WMD_JIT_THRESHOLD=WEBKIT_JIT_THRESHOLD and D-551's WMD_MIRROR_DEPTH=WEBKIT_MIRROR_DEPTH in WebKit, W30's WMD_TRACE_MAX for the engine and
  * W33's WMD_RESCUE_MS, D-539's WMD_FMA_FUSED=1 where the engine fuses relaxed_madd (fmaFuses) and, in
  * Chromium, D-542's WMD_RGN_DUP=1 (regions copy sampled-hot compiled blocks of their page; Firefox's go ran
  * slower with it, WebKit did not move), each unless the caller sets it. Kept out of the boot key (bootKeyOf hashes vmEnv's list), so a checkpoint or base
@@ -355,6 +362,7 @@ export function browserEnv(env, nav = globalThis.navigator, fused = fmaFuses())
   const has = k => env.some(e => e.startsWith(`${k}=`))
   const add = []
   if (isWebKit(nav) && !has('WMD_JIT_THRESHOLD')) add.push(`WMD_JIT_THRESHOLD=${WEBKIT_JIT_THRESHOLD}`)
+  if (isWebKit(nav) && !has('WMD_MIRROR_DEPTH')) add.push(`WMD_MIRROR_DEPTH=${WEBKIT_MIRROR_DEPTH}`)   // D-551
   if (!has('WMD_TRACE_MAX')) add.push(`WMD_TRACE_MAX=${BROWSER_TRACE_MAX[engineOf(nav)]}`)
   if (!has('WMD_RESCUE_MS')) add.push(`WMD_RESCUE_MS=${BROWSER_RESCUE_MS}`)
   if (!has('WMD_FMA_FUSED') && fused) add.push('WMD_FMA_FUSED=1')   // D-539

package/src/build/builder.js

@@ -6,7 +6,8 @@
 // the image back as a Docker tar on buildctl's stdout and converts it with loadImageTar. A Dockerfile with no RUN
 // is built in the page instead (fast.js), unless fast: false.
 
-import { bootWmd } from '../boot.js'
+import { blobBytes } from '../blob.js'
+import { bootWmd, isWebKit } from '../boot.js'
 import { MAIN_PROC_ID, containerBundle, fillRunRequest } from '../host/ctl.js'
 import { DiskError, deleteDisk, openDisk, sweepDisks } from '../host/disk.js'
 import { p9MountOptions } from '../host/p9mount.js'
@@ -15,6 +16,8 @@ import { packContext, readTarFile } from './context.js'
 import { BUILDER_PINS } from './pin.js'
 import { FastRefused, fastBuild, fastEligible } from './fast.js'
 
+export { blobBytes } // D-554: read the tar Blob a build returns with it (WebKit cannot read 128 MiB or more whole)
+
 export const ARCHES = {
   arm64: {
     platform: 'linux/arm64',
@@ -41,13 +44,68 @@ const FULL_MIB = 64 // /bk with less free than this during a failed build: the b
 const enc = new TextEncoder()
 /** host/jit.js's line when the engine's code pool is full (D-515). */
 export const POOL_FULL_RE = /wmd-web: jit: the engine's code pool is full/
+const JIT_LINE_RE = /^(?:vm\.wasm: JIT|wmd-web: jit:)/
+const JIT_LINES = 60 // guest/host JIT messages kept (a ring)
+const JIT_EVENTS = 200 // 'jit' events sent in a builder's life: the vm repeats some of them at every release
+const JIT_KINDS = [
+  [/the engine's code pool is full/, 'pool-full'],
+  [/the engine compiles code again/, 'pool-back'],
+  [/blocks run in the interpreter from now on/, 'interpreter-from-now-on'], // vm cache_release: release_dead
+  [/waiting before releasing again/, 'release-deferred'], // D-445 grace window
+  [/JIT release/, 'release'],
+  [/module budget reached|budget \d+ KiB from now on|refused more code/, 'budget'],
+]
+/** What a JIT message line says, or null for a line that is not one. */
+export function jitKind(line) {
+  if (!JIT_LINE_RE.test(line)) return null
+  return JIT_KINDS.find(([re]) => re.test(line))?.[1] || 'other'
+}
+/**
+ * The guest's stderr into whole lines: the JIT's messages are kept in a ring with the time (performance.now, ms)
+ * and sent as {t:'jit', what, line} events, so a build that crawls in the interpreter can be told from one that hangs.
+ */
+export function jitWatch({ onEvent = () => {}, max = JIT_LINES, maxEvents = JIT_EVENTS, now = () => Math.round(performance.now()) } = {}) {
+  const ring = []
+  let buf = ''
+  let events = 0
+  let skipped = 0
+  const line = l => {
+    const what = jitKind(l)
+    if (!what) return
+    const at = now()
+    ring.push({ at, what, line: l.slice(0, 400) })
+    if (ring.length > max) ring.shift()
+    if (what === 'other') return
+    if (events < maxEvents || what === 'interpreter-from-now-on') {
+      events++
+      onEvent({ t: 'jit', what, line: l.slice(0, 400) })
+    } else skipped++
+  }
+  return {
+    push(text) {
+      buf += text
+      let i
+      while ((i = buf.indexOf('\n')) >= 0) {
+        line(buf.slice(0, i))
+        buf = buf.slice(i + 1)
+      }
+      if (buf.length > 4096) buf = buf.slice(-4096)
+    },
+    lines: () => ring.slice(),
+    skipped: () => skipped,
+  }
+}
 
 export class BuildError extends Error {
-  constructor(message, { step = null, tail = '', reason = null } = {}) {
+  constructor(message, { step = null, tail = '', reason = null, jit = null, machine = null } = {}) {
     super(message)
     this.name = 'BuildError'
     this.step = step
     this.tail = tail
+    this.jit = jit // the builder's last JIT messages ([{at, what, line}]), when it kept them
+    // when buildctl's stream ended without an exit (code 125): why it closed, whether the machine ended, the
+    // machine's stderr tail and the start script's last lines
+    this.machine = machine
     this.reason = reason // 'no-space' | 'quota' | 'disk' | 'timeout' | 'pin' | 'secret' | null
   }
 }
@@ -220,7 +278,7 @@ async function indexDigest(index) {
 async function bytesOf(x, fetchFn) {
   if (x instanceof Uint8Array) return x
   if (x instanceof ArrayBuffer) return new Uint8Array(x)
-  if (typeof Blob !== 'undefined' && x instanceof Blob) return new Uint8Array(await x.arrayBuffer())
+  if (typeof Blob !== 'undefined' && x instanceof Blob) return blobBytes(x)
   const r = await fetchFn(x)
   if (!r.ok) throw new Error(`${x}: ${r.status} ${r.statusText}`)
   return new Uint8Array(await r.arrayBuffer())
@@ -348,10 +406,88 @@ function aborted(signal) {
  * @param {string[]} [o.registryMirrors]    Docker Hub mirrors (host[:port], in order) BuildKit tries before docker.io; list a plain-http one
  *                                           in httpRegistries too
  * @param {Record<string,string>} [o.registryCAs]  host -> PEM: CAs BuildKit checks that registry's certificate against
+ * @param {boolean} [o.nodeInterpreted]     D-553: node in RUN steps runs its JavaScript in the interpreter (a preload turns
+ *                                           off V8's compilers; WebAssembly stays). Default: on in WebKit, off elsewhere.
+ *                                           Without it, WebKit cannot keep up with the code node's JIT writes, and an npm
+ *                                           install of 1,600 packages does not end in 30 minutes.
  * @param {Function} [o.onEvent]
  * @param {AbortSignal} [o.signal]
  * @param {object} [o.boot]                  extra bootWmd options (tests)
  */
+/**
+ * D-553: the preload node runs in a RUN step (NODE_OPTIONS --require). It turns off V8's compilers, so node runs its
+ * JavaScript in the interpreter and writes no new machine code; WebAssembly stays (node-gyp's undici needs it, which
+ * --jitless removed). Each flag only where that V8 has it (V8 prints an error for an unknown one): measured on node
+ * 12, 14, 16, 18, 20, 22 and 24.
+ */
+export const NODE_PRELOAD = `try {
+  var v = process.versions.v8.split('.').map(Number), m = v[0] * 100 + v[1], f = ['--no-opt']
+  if (m >= 708) f.push('--regexp-interpret-all')
+  if (m >= 904) f.push('--no-sparkplug', '--liftoff-only')
+  if (m >= 1100) f.push('--no-maglev')
+  require('v8').setFlagsFromString(f.join(' '))
+} catch (e) {}
+`
+
+/**
+ * D-553: buildkit-runc that makes node in a RUN step load NODE_PRELOAD (runc ... --bundle <dir> ...). BuildKit writes
+ * config.json on one line (json.Encoder). awk walks it as JSON, strings and escapes included (inside a string a quote
+ * is \", so the keys it looks for cannot occur there):
+ * - it appends a read-only bind of /usr/local/lib/wmd-node.js at /dev/.wmd-node.js to the end of "mounts", after
+ *   BuildKit's /dev tmpfs, so the file is in that tmpfs and never in the step's layer;
+ * - then it adds --require=/dev/.wmd-node.js to the first "env":[ (process.env)'s NODE_OPTIONS, or a NODE_OPTIONS
+ *   element at the front.
+ * Without a "mounts" array it changes nothing (a --require of a missing file would stop node).
+ */
+export const RUNC_NODE = String.raw`#!/bin/sh
+b=
+p=
+for a in "$@"; do
+  case "$a" in --bundle=*) b=$(printf %s "$a" | cut -c10-) ;; esac
+  case "$p" in --bundle|-b) b=$a ;; esac
+  p=$a
+done
+c="$b/config.json"
+if [ -n "$b" ] && [ -f "$c" ]; then
+  awk -v M='{"destination":"/dev/.wmd-node.js","type":"bind","source":"/usr/local/lib/wmd-node.js","options":["rbind","ro"]}' -v R='--require=/dev/.wmd-node.js' '
+  function shut(s, st,   n, i, ch, ins, esc, d) {
+    n = length(s); ins = 0; esc = 0; d = 0
+    for (i = st; i <= n; i++) {
+      ch = substr(s, i, 1)
+      if (ins) { if (esc) esc = 0; else if (ch == "\\") esc = 1; else if (ch == "\"") ins = 0 }
+      else if (ch == "\"") ins = 1
+      else if (ch == "[" || ch == "{") d++
+      else if (ch == "]" || ch == "}") { if (!d) return i; d-- }
+    }
+    return 0
+  }
+  {
+    s = $0
+    k = index(s, ",\"mounts\":["); if (!k) k = index(s, "{\"mounts\":[")
+    if (!k || index(s, "\"destination\":\"/dev/.wmd-node.js\"")) { print s; next }
+    st = k + 11; e = shut(s, st); if (!e) { print s; next }
+    s = substr(s, 1, e - 1) (e == st ? "" : ",") M substr(s, e)
+    k = index(s, "\"env\":["); if (!k) { print s; next }
+    st = k + 7; n = length(s); ins = 0; esc = 0; found = 0; q = 0; L = length(R) + 1
+    for (i = st; i <= n; i++) {
+      ch = substr(s, i, 1)
+      if (ins) {
+        if (esc) esc = 0
+        else if (ch == "\\") esc = 1
+        else if (ch == "\"") {
+          ins = 0
+          if (substr(s, q, 14) == "\"NODE_OPTIONS=") { found = 1; s = substr(s, 1, i - 1) " " R substr(s, i); i += L; n += L }
+        }
+      } else if (ch == "\"") { ins = 1; q = i }
+      else if (ch == "]") break
+    }
+    if (!found) s = substr(s, 1, st - 1) "\"NODE_OPTIONS=" R "\"" (substr(s, st, 1) == "]" ? "" : ",") substr(s, st)
+    print s
+  }' "$c" > "$c.wmd" && mv "$c.wmd" "$c"
+fi
+exec /usr/bin/buildkit-runc "$@"
+`
+
 export async function createBuilder(o) {
   const archName = o.arch || 'arm64'
   const arch = ARCHES[archName]
@@ -359,11 +495,13 @@ export async function createBuilder(o) {
   if (o.disk !== false) checkNamespace(o.disk?.namespace)
   if (!o.relay?.url) throw new TypeError('relay: {url}: the builder pulls base images through it')
   const fetchFn = o.fetch || globalThis.fetch.bind(globalThis)
+  // every event carries `at`: performance.now() in ms (`ms` is a duration in some events)
   const emit = ev => {
     try {
-      o.onEvent?.(ev)
+      o.onEvent?.({ at: Math.round(performance.now()), ...ev })
     } catch {}
   }
+  const jit = jitWatch({ onEvent: emit })
   const ram = o.ram || 1536
   const cpus = o.cpus || 2
   const t0 = performance.now()
@@ -398,7 +536,16 @@ export async function createBuilder(o) {
     ...(o.registryMirrors?.length ? [`WMD_BK_MIRRORS=${o.registryMirrors.map(checkHost).join(',')}`] : []),
     ...(o.registryCAs && Object.keys(o.registryCAs).length ? [`WMD_BK_CA=${Object.entries(o.registryCAs).map(([h, pem]) => `${checkHost(h)}=${b64utf8(pem)}`).join(' ')}`] : []),
   ]
-  const argv = ['/usr/local/bin/wmd-buildkitd']
+  const interp = o.nodeInterpreted ?? isWebKit()
+  // D-553: BuildKit starts each RUN step with buildkit-runc from PATH; a wrapper earlier in PATH makes node in the step
+  // load a preload that turns off V8's compilers, then runs the real one. The image and the cache keys stay as they are.
+  const argv = interp
+    ? ['/bin/sh', '-c', 'mkdir -p /usr/local/lib && printf %s "$WMD_NODE_PRELOAD" > /usr/local/lib/wmd-node.js && printf %s "$WMD_RUNC_WRAP" > /usr/local/bin/buildkit-runc && chmod 0755 /usr/local/bin/buildkit-runc && exec /usr/local/bin/wmd-buildkitd']
+    : ['/usr/local/bin/wmd-buildkitd']
+  if (interp) {
+    env.push(`WMD_RUNC_WRAP=${RUNC_NODE}`, `WMD_NODE_PRELOAD=${NODE_PRELOAD}`)
+    emit({ t: 'node-interpreted', message: "node in RUN steps runs its JavaScript in the interpreter: WebKit's code pool cannot keep up with node's JIT" })
+  }
   const b = containerBundle({ args: argv, env, cwd: '/', hostname: 'buildkitsandbox', networkDisabled: false, ip: '192.168.127.2', gateway: '192.168.127.1', privileged: true })
   const append = [...arch.console, 'rdinit=/sbin/init', 'loglevel=4', 'norandmaps', 'wmd.init', 'wmd.p9tag=wmdroot', 'wmd.control=vport', 'wmd.exit'].join(' ')
   const args = [
@@ -425,6 +572,7 @@ export async function createBuilder(o) {
       ...(disk ? { disk } : {}),
       onStderr: s => {
         stderr = (stderr + s).slice(-16384)
+        jit.push(s)
         // WebKit: the engine's code pool filled, so new code waits and the guest runs slower (D-515; plan 5.10)
         if (!slowSaid && POOL_FULL_RE.test(s)) {
           slowSaid = true
@@ -482,6 +630,8 @@ export async function createBuilder(o) {
     throw e
   }
   emit({ t: 'ready', ms: Math.round(performance.now() - t0), platform: arch.platform })
+  let endedWith = null
+  ended.then(r => (endedWith = { code: r?.code ?? null, reason: r?.reason ?? null }), () => {})
 
   let seq = 0
   let busy = false
@@ -539,14 +689,14 @@ export async function createBuilder(o) {
         clearTimeout(killTimer)
         signal?.removeEventListener('abort', kill)
       }
-      if (!binary) return { code: r.code ?? null, out, err }
+      if (!binary) return { code: r.code ?? null, out, err, error: r.error ?? null }
       const bytes = new Uint8Array(size)
       let at = 0
       for (const c of chunks) {
         bytes.set(c, at)
         at += c.length
       }
-      return { code: r.code ?? null, out: bytes, err }
+      return { code: r.code ?? null, out: bytes, err, error: r.error ?? null }
     })()
   }
   const sh = (cmd, opts) => inGuest(['/bin/sh', '-c', cmd], opts)
@@ -563,6 +713,15 @@ export async function createBuilder(o) {
     inGuest,
     sh,
     log: () => mainLog.lines,
+    jitLines: () => jit.lines(),
+    /** The machine's state for a failure report: {ended ({code, reason} or null), stderr tail, start script's tail}. */
+    machineState: () => ({ ended: endedWith, stderr: stderr.slice(-4000), main: mainLog.tail.slice(-3000) }),
+    /** The guest network's counters and its last 40 events (resets, refusals, D-551 redials), or null. */
+    netStats: async () => {
+      const n = await vm.net?.stats?.().catch(() => null)
+      if (!n?.stack) return n ?? null
+      return { stack: { ...n.stack, events: (n.stack.events || []).slice(-40) }, relay: n.relay ?? null }
+    },
     /** Free MiB and free inodes on /bk. */
     async room() {
       const r = await sh("df -Pm /bk | awk 'NR==2{print $4}'; df -Pi /bk | awk 'NR==2{print $4, $2}'")
@@ -609,6 +768,7 @@ async function keepBuilt(store, index, packs) {
 async function runBuild(builder, req, emit) {
   const t0 = performance.now()
   const onEvent = ev => {
+    ev = { at: Math.round(performance.now()), ...ev }
     emit(ev)
     try {
       req.onEvent?.(ev)
@@ -650,7 +810,18 @@ async function runBuild(builder, req, emit) {
   const dir = `/run/ctx/${id}`
   // req.signal and timeoutMs cover everything from here: the context, the upload, buildctl and the conversion
   const ac = new AbortController()
-  const timer = req.timeoutMs ? setTimeout(() => ac.abort(new BuildError(`the build ran past ${req.timeoutMs} ms`, { reason: 'timeout' })), req.timeoutMs) : null
+  let lastStep = null
+  const timer = req.timeoutMs
+    ? setTimeout(
+        () => {
+          const e = new BuildError(`the build ran past ${req.timeoutMs} ms${lastStep ? `, in the step ${lastStep}` : ''}`, { reason: 'timeout', step: lastStep, tail: log.tail.slice(-4000), jit: builder.jitLines?.() ?? null })
+          ac.abort(e)
+          // the network's counters join the error while buildctl is stopped (SIGINT, then 5 s), before it is thrown
+          builder.netStats?.().then(n => (e.net = n), () => {})
+        },
+        req.timeoutMs,
+      )
+    : null
   const onAbort = () => ac.abort(new BuildCancelled())
   req.signal?.addEventListener('abort', onAbort, { once: true })
   const check = () => {
@@ -698,7 +869,6 @@ async function runBuild(builder, req, emit) {
     if (req.push?.auth) xenv.push(`DOCKER_CONFIG=${dir}/auth`)
     args.push('--output', `type=docker,${req.tag ? `name=${req.tag},` : ''}dest=-`)
     if (req.push) args.push('--output', `type=image,name=${req.push.name},push=true${req.push.insecure ? ',registry.insecure=true' : ''}`)
-    let lastStep = null
     const errLines = [] // buildctl's own error lines (no step), not the steps' output
     const pr = progressReader({
       onStep: ev => {
@@ -737,8 +907,22 @@ async function runBuild(builder, req, emit) {
       if (builder.disk?.events?.slice?.(diskMark).some(e => e.reason === 'quota')) reason = 'quota'
       if (!reason && /input\/output error|read-only file system/i.test(tail)) reason = 'disk'
       const failed = [...pr.vertexes.values()].find(v => v.error)
-      const why = failed?.error || tail.split('\n').filter(Boolean).pop() || `buildctl exited ${r.code}`
-      throw new BuildError(`the build failed${failed ? ` at ${failed.name}` : ''}: ${why.slice(0, 500)}`, { step: failed?.name || lastStep, tail, reason })
+      const why = failed?.error || tail.split('\n').filter(Boolean).pop() || `buildctl exited ${r.code}${r.error ? ` (${r.error})` : ''}`
+      // a stream that ended with no exit frame: the machine's side says why
+      let machine = null
+      if (r.code === 125 && r.error) {
+        await new Promise(res => setTimeout(res, 2000)) // let a machine that is going down report it
+        machine = { stream: r.error, ...(builder.machineState?.() ?? {}) }
+      }
+      const err = new BuildError(`the build failed${failed ? ` at ${failed.name}` : ''}: ${why.slice(0, 500)}`, { step: failed?.name || lastStep, tail, reason, jit: builder.jitLines?.() ?? null, machine })
+      err.net = (await builder.netStats?.().catch(() => null)) ?? null
+      // buildkitd's side (a session it closed, a worker error): its last log lines, when the machine still answers
+      if (r.code !== 125) {
+        const d = await Promise.race([builder.sh('tail -n 40 /run/buildkitd.log').catch(() => null), new Promise(res => setTimeout(res, 10_000, null))])
+        err.daemonLog = d?.out ? d.out.slice(-6000) : null
+      }
+      check() // a cancel or timeout during these waits wins
+      throw err
     }
     onEvent({ t: 'export', bytes: r.out.length })
     const t1 = performance.now()
@@ -784,7 +968,8 @@ async function ensureRoom(builder, onEvent, signal) {
 export async function buildImage(o) {
   const builder = await createBuilder(o)
   try {
-    return await builder.build(o)
+    // o.onEvent already hears every build event through the builder: given to build() too, each would come twice
+    return await builder.build({ ...o, onEvent: undefined })
   } finally {
     await builder.close()
   }

package/src/build/context.js

@@ -1,6 +1,7 @@
 // The build context (docs/plans/web-buildkit-impl.md 5.6): turn a file source, a plain object or a tar into the
 // one tar the page sends to the builder. .dockerignore is applied here with a port of moby's patternmatcher, so
 // ignored files are never read; BuildKit applies it again and stays the source of truth.
+import { blobBytes } from '../blob.js'
 import { matcher, parseDockerignore } from './dockerignore.js'
 import { decodeText, scanTar, tarWriter } from './tar.js'
 
@@ -108,7 +109,7 @@ function tarReader(input) {
   const u8 = input instanceof ArrayBuffer ? new Uint8Array(input) : input
   const total = blob ? input.size : u8.length
   const read = blob
-    ? async (o, n) => new Uint8Array(await input.slice(o, o + n).arrayBuffer())
+    ? (o, n) => blobBytes(input.slice(o, o + n))
     : (o, n) => u8.subarray(o, o + n)
   return { blob, u8, total, read }
 }
@@ -175,7 +176,7 @@ async function packTar(input, dockerfile, lim) {
     if (err instanceof ContextError) throw err
     throw new ContextError('bad-source', '', `build context: ${err.message}`)
   }
-  const tar = blob ? new Uint8Array(await input.arrayBuffer()) : u8
+  const tar = blob ? await blobBytes(input) : u8
   return { tar, files, bytes, ignored: 0, dockerfile }
 }
 

package/src/host/disk-worker.js

@@ -71,7 +71,14 @@ function serve(mailbox, disk, closeFiles) {
   let ops = 0
   const post = () => self.postMessage({ t: 'stats', stats: { ...stats, ...disk.usage() } })
   for (;;) {
-    if (Atomics.load(i32, 5) === 1) break
+    const ctl = Atomics.load(i32, 5)
+    if (ctl === 1) break
+    if (ctl === 2) {
+      // tests (gate 9): the Worker ends with no word, as a crashed one does; a vCPU waiting on it gives up after WAIT_MS
+      closeFiles()
+      self.close()
+      return
+    }
     const s = Atomics.load(i32, 1)
     if (s === STATE.GONE) break
     if (s !== STATE.POSTED) {

package/src/host/disk.js

@@ -10,7 +10,7 @@
 //   i32[2] op       0 read, 1 write, 2 flush, 3 discard (blk.c's BLK_OP_*)
 //   i32[3] len      bytes (u32)
 //   i32[4] result   0 or a negative errno
-//   i32[5] control  1: the page asks the Worker to flush and close
+//   i32[5] control  1: the page asks the Worker to flush and close; 2 (tests): it ends at once and answers nothing
 //   f64[3] off      byte offset (bytes 24..31)
 //   data from byte 64, DATA bytes; longer reads and writes go in pieces
 //

package/src/host/jit.js

@@ -69,6 +69,8 @@ const POOL_CHECK_MS = 2000 // D-515: at most one code pool check a thread in thi
 const POOL_PROBE_N = 1500000 // D-515: loop passes of the check: about 2 ms compiled, 40 ms interpreted
 const POOL_SLOW_X = 6 // D-515: a check this many times slower than this thread's fastest means the pool is full
 const POOL_LEARN = 3 / 4 // D-515: the budget from then on, of the modules live when the pool filled
+const POOL_RECOVER_N = 5 // a learned budget grows again after this many checks in a row that found room (10 s at POOL_CHECK_MS)
+const POOL_RECOVER_X = 4 / 3 // ... by this factor each time (the inverse of POOL_LEARN), never past maxLiveBytes
 
 // counters after the header: each a pair of Int32 cells (low word, unsigned; high word).
 // D-419: not BigInt64 cells: Atomics.add on a BigInt64Array returns a new BigInt, garbage a
@@ -404,6 +406,38 @@ export function createJitDoor({ store, memory, ram = null, log = () => {}, compi
 
   let poolNext = 0
   let poolFast = Infinity
+  let poolRoom = 0 // checks in a row that found room, with the shared budget unchanged
+  let budgetSeen = -1 // the shared budget at the last check: a change (another Worker grew or lowered it) starts the count again
+  /**
+   * The engine has had room for POOL_RECOVER_N checks in a row: a budget learned while released code
+   * was not yet freed (WebKit frees it 30-40 s late, D-445) grows back by POOL_RECOVER_X, and is
+   * dropped once it reaches maxLiveBytes (the original cap). Without a cap there is nothing to
+   * return to.
+   */
+  function recoverBudget() {
+    if (!maxLiveBytes) return
+    // the budget is shared and every Worker checks: without this, N Workers would grow it N times as fast
+    const seen = Atomics.load(hdr, H_BUDGET_KIB)
+    if (seen !== budgetSeen) {
+      budgetSeen = seen
+      poolRoom = 0
+    }
+    if (++poolRoom < POOL_RECOVER_N) return
+    poolRoom = 0
+    if (!seen) return
+    lock()
+    try {
+      const cur = Atomics.load(hdr, H_BUDGET_KIB)
+      if (!cur) return
+      const next = Math.ceil(cur * POOL_RECOVER_X)
+      const done = next * 1024 >= maxLiveBytes
+      Atomics.store(hdr, H_BUDGET_KIB, done ? 0 : next)
+      budgetSeen = done ? 0 : next
+      log(`wmd-web: jit: the engine has had room for ${POOL_RECOVER_N} checks; budget ${done ? `back to its cap of ${maxLiveBytes >> 10} KiB` : `${next} KiB`}`)
+    } finally {
+      unlock()
+    }
+  }
   /**
    * D-515: before a new module is compiled. While the engine's code pool is full (codePool, checked
    * at most once each poolEvery) the answer is JIT_LATER: the guest interprets the blocks and asks
@@ -423,8 +457,10 @@ export function createJitDoor({ store, memory, ram = null, log = () => {}, compi
     if (ms > poolFast * POOL_SLOW_X) ms = Math.min(ms, codePool()) // not a pause of this thread
     poolFast = Math.min(poolFast, Math.max(ms, 0.05))
     const full = ms > poolFast * POOL_SLOW_X
+    if (full) poolRoom = 0
     const at = () => new Date().toISOString().slice(11, 19)
     if (!full) {
+      recoverBudget()
       if (was && Atomics.compareExchange(hdr, H_POOL_FULL, 1, 0) === 1) {
         add('poolBack')
         log(`wmd-web: jit: the engine compiles code again (${at()})`)

package/src/image-files.js

@@ -4,6 +4,7 @@
 // `USER name`, devcontainer `remoteUser` or `--chown=app:app` (resolveUser). W66: another image's files,
 // for `COPY --from` and multi-stage builds (walk).
 
+import { blobBytes } from './blob.js'
 import { ENOENT, FsError } from './fs/errno.js'
 import { Overlay } from './fs/overlay.js'
 import { Pack, bytesSource } from './fs/pack.js'
@@ -19,7 +20,7 @@ async function layerBytes(l, i, fetchFn) {
   }
   if (l instanceof Uint8Array) return l
   if (l instanceof ArrayBuffer || (typeof SharedArrayBuffer !== 'undefined' && l instanceof SharedArrayBuffer)) return new Uint8Array(l)
-  if (typeof Blob !== 'undefined' && l instanceof Blob) return new Uint8Array(await l.arrayBuffer())
+  if (typeof Blob !== 'undefined' && l instanceof Blob) return blobBytes(l)
   throw new TypeError(`layer ${i}: a URL, bytes or a Blob, not ${Object.prototype.toString.call(l)}`)
 }
 

package/src/net/stack.js

@@ -57,6 +57,22 @@ const HALF_OPEN_IDLE_MS = 10 * 60_000
 const SYNACK_GIVE_UP_MS = 60_000 // Linux: tcp_synack_retries (5), about 63 s
 const GUEST_CLOSED_IDLE_MS = 120_000 // the guest's FIN is in, the remote says nothing: its kernel forgot it (FIN_WAIT2, 60 s)
 const MAX_PENDING = 32 // handshakes not finished at once (more get a RST), so abandoned ones cannot take every relay slot
+// D-551: npm's CDN ends (FIN) a connection whose TLS handshake is not done 15 s after the connect, and the relay
+// connects when the guest's SYN comes. A slow guest (WebKit) can miss that before its ClientHello. A remote that
+// ends a connection nothing has crossed, REDIAL_MIN_MS or more after it opened, is dialled once more instead.
+const REDIAL_MIN_MS = 5_000
+// D-552: a guest that runs many TLS handshakes at once (pnpm opens 16) splits its CPU among them, and in a slow guest
+// (WebKit) none ends inside npm's 15 s. At most TLS_HANDSHAKES run at once: a ClientHello waits here for its turn, then
+// goes out on a stream dialled again when the one it has is TLS_FRESH_MS old. A remote that ends a stream before it
+// answers the ClientHello gets the hello once more on a new stream. A handshake holds its turn at most TLS_TURN_MS.
+const TLS_HANDSHAKES = 4
+const TLS_FRESH_MS = 3_000
+const TLS_TURN_MS = 20_000
+const TLS_HELLO_MAX = 16 << 10 // bytes kept for a replay
+const T_NONE = 0 // no guest bytes yet
+const T_WAIT = 1 // a ClientHello waits for a turn
+const T_TURN = 2 // the handshake has a turn
+const T_DONE = 3 // past the handshake, or not TLS
 const INTERNAL_ZONE = 'wmd.internal'
 
 const P_CONNECTING = 1 // waiting for the relay's CONNECTED
@@ -122,6 +138,14 @@ class Conn {
     this.lastRemote = 0 // the last data or end from the relay
     this.bytesIn = 0 // guest -> relay
     this.bytesOut = 0 // relay -> guest
+    this.redialAt = 0 // D-551: when the stream was dialled again (0: not); its answer is pending while redialing
+    this.redialing = false
+    this.dialAt = 0 // when the relay stream the guest's bytes go to connected
+    this.tls = T_NONE // D-552
+    this.tlsAt = 0 // when the handshake got its turn
+    this.hello = null // the guest's bytes sent before the remote answered (a replay sends them again)
+    this.helloBytes = 0
+    this.helloReplayed = false
   }
   inflight() {
     return seqDiff(this.sndNxt, this.sndUna)
@@ -154,6 +178,9 @@ export class NetStack {
     this.peers = o.peers || null // W56: the switch's guests (peer.js)
     this.now = o.now || (() => performance.now())
     this.maxConns = o.maxConns ?? 256
+    this.tlsMax = o.tlsHandshakes ?? TLS_HANDSHAKES
+    this.tlsTurns = new Set() // D-552: handshakes with a turn
+    this.tlsWait = [] // and those waiting for one, oldest first
     this.log = o.log || (() => {})
     this.conns = new Map() // key -> Conn
     this.byId = new Map() // relay stream id -> Conn
@@ -473,6 +500,7 @@ export class NetStack {
   /** The relay's answer to a connect. */
   onConnected(id, code, credit, detail) {
     const c = this.byId.get(id)
+    if (c?.redialing) return this.#redialed(c, code, credit, detail)
     if (!c || c.phase !== P_CONNECTING) {
       if (!c && code === E.OK) this.relay.abort(id) // a connect that came back after we gave up on it
       return
@@ -494,7 +522,7 @@ export class NetStack {
     if (this.stats.connectMs.length > 100) this.stats.connectMs.shift()
     c.relayCredit = credit
     c.phase = P_SYNACK
-    c.synAckAt = this.now()
+    c.synAckAt = c.dialAt = this.now()
     c.sndNxt = seqAdd(c.iss, 1)
     this.#synAck(c)
   }
@@ -615,6 +643,8 @@ export class NetStack {
 
   /** Send held guest bytes to the relay as credit allows, in messages of up to MAX_DATA (one per segment cost a WebSocket message each). */
   #flushToRelay(c) {
+    if (c.redialing) return // D-551: the new stream has no answer yet; #redialed flushes
+    if (c.tls !== T_DONE && c.via === this.relay && !this.#tlsGate(c)) return
     while (c.toRelay.length && c.relayCredit > 0) {
       const n = Math.min(c.toRelayBytes, c.relayCredit, MAX_DATA)
       let part
@@ -637,6 +667,13 @@ export class NetStack {
       }
       c.toRelayBytes -= n
       c.relayCredit -= n
+      if (c.tls === T_TURN && !c.bytesOut && c.hello) {
+        // past the cap the hello is not kept at all (a replay with a gap would be garbage)
+        if (c.helloBytes + n <= TLS_HELLO_MAX) {
+          c.hello.push(part.slice())
+          c.helloBytes += n
+        } else c.hello = null
+      }
       c.via.data(c.id, part)
     }
     if (c.guestFin && !c.toRelay.length && !c.relayEndSent) {
@@ -676,16 +713,119 @@ export class NetStack {
   onRelayEnd(id) {
     const c = this.byId.get(id)
     if (!c) return
+    if (this.#redial(c) || this.#tlsReplay(c)) return
     c.remoteEnd = true
     c.lastRemote = this.now()
     this.wantsSend.add(c)
     this.#trySend(c)
   }
 
+  /** D-551: the remote ended a stream nothing has crossed, a while after it opened: dial it again, once, and say nothing to the guest. False when it does not qualify. */
+  #redial(c) {
+    if (c.redialAt || c.via !== this.relay || c.phase !== P_OPEN || c.bytesOut || c.bytesIn - c.toRelayBytes || c.guestFin) return false
+    if (this.now() - c.dialAt < REDIAL_MIN_MS) return false
+    this.stats.redials = (this.stats.redials || 0) + 1
+    this.#dialAgain(c, 'ended unused')
+    return true
+  }
+
+  /** A new relay stream for c, the old one aborted; the guest hears nothing. Its bytes wait in toRelay until #redialed. */
+  #dialAgain(c, why) {
+    this.relay.abort(c.id)
+    this.byId.delete(c.id)
+    c.id = this.nextId++
+    this.byId.set(c.id, c)
+    c.relayCredit = 0
+    c.redialing = true
+    c.redialAt = this.now()
+    this.#event({ ev: 'redial', why, to: `${u32ToIp(c.rip)}:${c.rport}`, afterMs: Math.round(c.redialAt - c.dialAt) })
+    this.relay.connect(c.id, u32ToIp(c.rip), c.rport)
+  }
+
+  /** D-552: may the guest's bytes go to the relay now? Sorts a stream's first bytes into TLS or not, and holds a ClientHello until it has a turn. */
+  #tlsGate(c) {
+    if (c.tls === T_TURN) {
+      // the guest's bytes after the server's first flight end its part of the handshake
+      if (c.bytesOut && c.toRelayBytes) this.#tlsDone(c)
+      return true
+    }
+    if (c.tls === T_WAIT) return false
+    if (!c.toRelayBytes) return true
+    const h = c.toRelay[0]
+    if (c.bytesOut || h[0] !== 0x16 || (h.length > 1 && h[1] !== 0x03)) {
+      c.tls = T_DONE // the remote spoke first, or not a TLS handshake record
+      return true
+    }
+    if (this.tlsTurns.size >= this.tlsMax) {
+      c.tls = T_WAIT
+      this.tlsWait.push(c)
+      this.stats.tlsWaits = (this.stats.tlsWaits || 0) + 1
+      return false
+    }
+    return this.#tlsStart(c)
+  }
+
+  /** The handshake gets a turn. False when its stream is dialled again first (#redialed sends the hello). */
+  #tlsStart(c) {
+    c.tls = T_TURN
+    c.tlsAt = this.now()
+    c.hello = []
+    c.helloBytes = 0
+    this.tlsTurns.add(c)
+    if (!c.redialing && c.phase === P_OPEN && c.bytesIn === c.toRelayBytes && this.now() - c.dialAt >= TLS_FRESH_MS) {
+      this.stats.tlsFresh = (this.stats.tlsFresh || 0) + 1
+      this.#dialAgain(c, 'fresh for a ClientHello')
+      return false
+    }
+    return true
+  }
+
+  #tlsDone(c) {
+    c.tls = T_DONE
+    c.hello = null
+    if (this.tlsTurns.delete(c)) this.#tlsNext()
+  }
+
+  /** Turns free: the oldest waiting hellos go. */
+  #tlsNext() {
+    while (this.tlsTurns.size < this.tlsMax && this.tlsWait.length) {
+      const c = this.tlsWait.shift()
+      if (c.tls !== T_WAIT || this.conns.get(c.key) !== c) continue // closed, or its 4-tuple reused by a new connection
+      if (this.#tlsStart(c)) this.#flushToRelay(c)
+    }
+  }
+
+  /** D-552: the remote ended or reset a stream before it answered the guest's ClientHello: send the hello once more on a new stream. */
+  #tlsReplay(c) {
+    if (c.tls !== T_TURN || c.bytesOut || c.helloReplayed || !c.hello || !c.helloBytes || c.guestFin || c.via !== this.relay) return false
+    c.helloReplayed = true
+    c.toRelay.unshift(...c.hello)
+    c.toRelayBytes += c.helloBytes
+    c.hello = []
+    c.helloBytes = 0
+    this.stats.tlsReplays = (this.stats.tlsReplays || 0) + 1
+    this.#dialAgain(c, 'replay the ClientHello')
+    return true
+  }
+
+  #redialed(c, code, credit, detail) {
+    c.redialing = false
+    if (code !== E.OK) return this.#close(c, `redial: ${E_NAMES[code] || code}${detail ? ` (${detail})` : ''}`, false)
+    c.dialAt = this.now()
+    c.relayCredit = credit
+    this.#flushToRelay(c)
+    if (this.#rcvWnd(c) > c.lastWndSent) {
+      c.needAck = true
+      this.acks.add(c)
+    }
+  }
+
   onRelayAbort(id, code, reason) {
     const c = this.byId.get(id)
     if (!c) return
+    if (c.redialing) return this.#redialed(c, code || E.GONE, 0, reason)
     if (c.phase === P_CONNECTING) return this.onConnected(id, code || E.GONE, 0, reason)
+    if (this.#tlsReplay(c)) return
     this.#event({ ev: 'abort', to: `${u32ToIp(c.rip)}:${c.rport}`, why: E_NAMES[code] || code, reason })
     this.#close(c, `relay: ${E_NAMES[code] || code} ${reason || ''}`.trim(), false)
   }
@@ -765,6 +905,12 @@ export class NetStack {
     this.byId.delete(c.id)
     this.wantsSend.delete(c)
     this.acks.delete(c)
+    if (c.tls === T_TURN) this.#tlsDone(c)
+    else if (c.tls === T_WAIT) {
+      c.tls = T_DONE
+      const i = this.tlsWait.indexOf(c)
+      if (i >= 0) this.tlsWait.splice(i, 1)
+    }
   }
 
   /** After a batch of input: one ACK per connection that needs one. */
@@ -782,6 +928,12 @@ export class NetStack {
   tick() {
     const t = this.now()
     for (const c of [...this.conns.values()]) {
+      if (c.redialing && t - c.redialAt > CONNECT_TIMEOUT_MS) {
+        this.relay.abort(c.id)
+        this.#redialed(c, E.TIMEOUT, 0, 'no answer from the relay')
+        continue
+      }
+      if (c.tls === T_TURN && t - c.tlsAt > TLS_TURN_MS) this.#tlsDone(c) // a slow handshake goes on without its turn
       if (c.phase === P_CONNECTING) {
         if (t - c.openedAt > CONNECT_TIMEOUT_MS) {
           c.via.abort(c.id)

package/src/registry/load-tar.js

@@ -11,6 +11,7 @@
 // copy is the layer handed to the converter Worker); a Blob is read one entry at a time, so the whole tar is
 // never in memory at once.
 
+import { blobBytes } from '../blob.js'
 import { createConverter } from './converter.js'
 import { RegistryError, sha256 } from './hub.js'
 import { CONVERTER } from './pull.js'
@@ -126,7 +127,7 @@ function source(input) {
   if (input instanceof Uint8Array) return { size: input.length, read: async (off, len) => input.subarray(off, off + len) }
   if (input instanceof ArrayBuffer) return source(new Uint8Array(input))
   if (typeof Blob !== 'undefined' && input instanceof Blob) {
-    return { size: input.size, read: async (off, len) => new Uint8Array(await input.slice(off, off + len).arrayBuffer()) }
+    return { size: input.size, read: (off, len) => blobBytes(input.slice(off, off + len)) }
   }
   throw new TypeError('loadImageTar: the tar as a Uint8Array, ArrayBuffer or Blob')
 }