@volter/browser-wali 0.1.4 → 0.1.6

package/dist/memory.js

@@ -13,8 +13,34 @@ const DEFAULT_MMAP_BASE = 256 * 1024 * 1024;
 const MMAP_CURSOR_INDEX = 0;
 const PROGRAM_BREAK_INDEX = 1;
 const ALLOCATOR_LOCK_INDEX = 2;
-const ALLOCATOR_HEADER_WORDS = 3;
-const FREE_RANGE_SLOTS = 512;
+// The address-space instrument. These words exist because the ways this
+// allocator could lose address space were all SILENT: a release that no
+// free-range slot could hold was dropped with a bare `return`, a munmap from a
+// thread that did not map the range was retained forever, and the mmap cursor
+// was stored as a 32-bit word, so a reservation past the 4 GiB ceiling wrapped
+// to a low address instead of refusing. Each is counted here and the ones that
+// still can happen are surfaced through the runtime's `onDiagnostic`; the
+// numbers are what a reader gets instead of "3 GB free" over a refused 8 MiB.
+const DROPPED_RELEASES_INDEX = 3;
+const DROPPED_KIB_INDEX = 4;
+const CURSOR_HIGH_WATER_KIB_INDEX = 5;
+const FREE_RANGE_PEAK_INDEX = 6;
+const RETAINED_MUNMAPS_INDEX = 7;
+const RETAINED_KIB_INDEX = 8;
+const CEILING_REFUSALS_INDEX = 9;
+const FREE_RANGE_COUNT_INDEX = 10;
+const TOUCHED_HIGH_WATER_INDEX = 11;
+const ALLOCATOR_HEADER_WORDS = 12;
+// The free-range table is DENSE: entries [0, count) are live, a removed entry
+// is swapped with the last, and every scan is over the ranges that exist, not
+// over the capacity. MEASURED 2026-09-19 on the courtyard model alone: a
+// 512-slot sparse table filled before the model's tenth call, 8,192 released
+// ranges were then dropped (693 MiB of address space lost by the 1 GiB mark),
+// the cursor walked to 4,095 MiB and wrapped. mallocng maps every group and
+// every large chunk on its own and unmaps them out of order, so the live
+// free-range count is a property of the guest's heap, not of this table.
+const FREE_RANGE_SLOTS = 16_384;
+const RESERVE_REFUSED = -1;
 const FREE_RANGE_WORDS = 2;
 const ALLOCATOR_CONTROL_WORDS = ALLOCATOR_HEADER_WORDS + FREE_RANGE_SLOTS * FREE_RANGE_WORDS;
 const SHARED_MMAP_REGISTRY_SLOTS = 256;
@@ -40,14 +66,16 @@ export class WaliMemoryManager {
     readFile;
     fileKey;
     writeSharedFile;
+    report;
     mappings = [];
     allocatorState;
     allocatorInitialized = false;
-    constructor(memory, readFile, sharedMmapCursor, fileKey, writeSharedFile, sharedMmapRegistry) {
+    constructor(memory, readFile, sharedMmapCursor, fileKey, writeSharedFile, sharedMmapRegistry, report) {
         this.memory = memory;
         this.readFile = readFile;
         this.fileKey = fileKey;
         this.writeSharedFile = writeSharedFile;
+        this.report = report;
         const control = sharedMmapCursor ?? createWaliAllocatorControl();
         this.allocatorState = new Int32Array(control);
         if (this.allocatorState.length < ALLOCATOR_CONTROL_WORDS) {
@@ -64,6 +92,15 @@ export class WaliMemoryManager {
         this.initializeAllocator();
         return this.allocatorState.buffer;
     }
+    forkSnapshot() {
+        return { mappings: this.mappings.map(mapping => ({ ...mapping })),
+            ...(this.sharedRegistry ? { registry: this.sharedRegistry.buffer.slice(0) } : {}) };
+    }
+    restoreFork(snapshot) {
+        this.mappings.push(...snapshot.mappings.map(mapping => ({ ...mapping })));
+        if (snapshot.registry && this.sharedRegistry)
+            this.sharedRegistry.set(new Int32Array(snapshot.registry));
+    }
     imports() {
         return {
             SYS_brk: (address) => this.brk(Number(address)),
@@ -82,9 +119,12 @@ export class WaliMemoryManager {
             return BigInt(current);
         if (!validAddress(requested))
             return BigInt(current);
-        const mmapCursor = Atomics.load(this.allocatorState, MMAP_CURSOR_INDEX);
-        const firstMapping = mmapCursor === 0 ? DEFAULT_MMAP_BASE : mmapCursor;
-        if (requested > firstMapping)
+        // The break grows below the mmap region and never into it. The region's
+        // base is fixed at DEFAULT_MMAP_BASE (or the initial memory size when that
+        // is larger, in which case no brk succeeds and mallocng maps its meta
+        // areas instead); comparing against the moving cursor let the break climb
+        // over live mappings.
+        if (requested > DEFAULT_MMAP_BASE)
             return BigInt(current);
         if (!this.ensureCapacity(requested))
             return BigInt(current);
@@ -98,9 +138,21 @@ export class WaliMemoryManager {
         const anonymous = Boolean(flags & MAP_ANONYMOUS);
         if ((anonymous && fd !== -1) || (!anonymous && fd < 0))
             return -ENODEV;
-        const fileContents = anonymous ? undefined : this.readFile(fd, offset, length);
-        if (!anonymous && !fileContents)
-            return -9n;
+        let fileContents;
+        if (!anonymous) {
+            try {
+                fileContents = this.readFile(fd, offset, length);
+            }
+            catch (error) {
+                // A kernel answers a failed file mapping with an errno; this runtime
+                // used to die here (an EMSGSIZE from the filesystem channel on a
+                // large file was a fatal for the whole program, 2026-09-19).
+                this.say(`[WALI] mmap of fd ${fd}, ${length} bytes at ${offset}, could not read the file: ${error instanceof Error ? error.message : String(error)}`);
+                return -EIO;
+            }
+            if (!fileContents)
+                return -9n;
+        }
         const size = align(length, LINUX_PAGE_SIZE);
         const fixed = Boolean(flags & MAP_FIXED);
         const shared = Boolean(flags & MAP_SHARED);
@@ -121,6 +173,8 @@ export class WaliMemoryManager {
             }
         }
         const start = fixed ? requested : registryClaim?.start ?? this.reserve(size);
+        if (start === RESERVE_REFUSED)
+            return -ENOMEM;
         if (!validAddress(start) || (fixed && start % LINUX_PAGE_SIZE !== 0))
             return -EINVAL;
         const end = start + size;
@@ -135,7 +189,7 @@ export class WaliMemoryManager {
             ...(registryClaim ? { registrySlot: registryClaim.slot } : {}),
         });
         if (!registryClaim?.existing) {
-            new Uint8Array(this.memory().buffer).fill(0, start, end);
+            this.zeroForHandout(start, end);
             if (fileContents)
                 new Uint8Array(this.memory().buffer).set(fileContents, start);
         }
@@ -159,14 +213,24 @@ export class WaliMemoryManager {
         const index = this.mappings.findIndex((candidate) => address >= candidate.start && end <= candidate.end);
         const mapping = index >= 0 ? this.mappings[index] : undefined;
         // Mapping metadata is local to a syscall host, but a Unix process may
-        // mmap on one pthread and munmap on another. Releasing an unknown range
-        // into the process-wide free list lets a later mmap overlap its still-live
-        // owner and corrupts allocators such as musl malloc and SQLite. Retain the
-        // address conservatively; the process's WebAssembly memory is discarded
-        // in full when the command exits.
-        if (!mapping)
+        // mmap on one pthread and munmap on another: mallocng frees a >=128 KiB
+        // chunk on whichever thread calls free(), and unmaps it there. The
+        // address space is process-wide (`allocatorState`), so the range goes back
+        // to the process's free list the way a kernel would take it. The one
+        // thing another thread's record could carry that this one cannot see is a
+        // shared FILE mapping's flush, and those live in the shared registry, so a
+        // range a live registry entry covers is retained (counted, surfaced) rather
+        // than released under it. Retaining every unknown range instead leaked the
+        // address space of every cross-thread free until the 4 GiB ceiling.
+        if (!mapping) {
+            if (this.sharedRegistryCovers(address, end)) {
+                this.noteRetainedMunmap(end - address);
+                return 0n;
+            }
+            this.release(address, end);
             return 0n;
-        if (mapping?.registrySlot !== undefined) {
+        }
+        if (mapping.registrySlot !== undefined) {
             if (address !== mapping.start || end !== mapping.end)
                 return -EINVAL;
             if (!this.flushMapping(mapping, address, end))
@@ -175,17 +239,98 @@ export class WaliMemoryManager {
             this.mappings.splice(index, 1);
             return 0n;
         }
-        if (mapping?.shared && mapping.references > 1) {
+        if (mapping.shared && mapping.references > 1) {
             mapping.references -= 1;
             return 0n;
         }
-        if (mapping?.shared && !this.flushMapping(mapping, address, end))
+        if (mapping.shared && !this.flushMapping(mapping, address, end))
             return -EIO;
-        this.mappings.splice(index, 1);
-        new Uint8Array(this.memory().buffer).fill(0, address, Math.min(end, this.memory().buffer.byteLength));
+        // A partial unmap keeps the remainder on record, so a later unmap of the
+        // rest is still this thread's own mapping and not an unknown range.
+        if (address === mapping.start && end === mapping.end) {
+            this.mappings.splice(index, 1);
+        }
+        else if (address === mapping.start) {
+            mapping.fileOffset += end - mapping.start;
+            mapping.start = end;
+        }
+        else if (end === mapping.end) {
+            mapping.end = address;
+        }
+        else {
+            this.mappings.push({ ...mapping, start: end, fileOffset: mapping.fileOffset + (end - mapping.start) });
+            mapping.end = address;
+        }
+        // No zeroing here: the next mmap of these bytes zeroes them (`zeroForHandout`),
+        // and zeroing on both sides doubled the cost of every large free.
         this.release(address, end);
         return 0n;
     }
+    /**
+     * Zero a range about to be handed out, and only the part of it that has
+     * been handed out before. Memory the wasm module grows into is already
+     * zero, so the bytes above the touched high-water mark need nothing; a
+     * reused range below it holds whatever its last owner left.
+     * MEASURED 2026-09-19: malloc+free of an UNTOUCHED 64 MiB took 40 ms on
+     * WALI against 4 ms on Emscripten, with the copy and the memset themselves
+     * at 2.3 and 0.9 ms -- the whole cost was two byte-view fills of shared
+     * memory, one here and one on munmap. V8 fills a SharedArrayBuffer through
+     * Uint8Array 15x slower than a plain buffer (20.9 ms vs 1.4 ms per 64 MiB,
+     * node 26); through Float64Array it is 2.5 ms, so the aligned body is
+     * filled 8 bytes at a time.
+     */
+    zeroForHandout(start, end) {
+        end = Math.min(end, this.memory().buffer.byteLength);
+        if (end <= start)
+            return;
+        let touched = Atomics.load(this.allocatorState, TOUCHED_HIGH_WATER_INDEX) >>> 0;
+        if (start < touched)
+            this.zero(start, Math.min(end, touched));
+        while (end > touched) {
+            const seen = Atomics.compareExchange(this.allocatorState, TOUCHED_HIGH_WATER_INDEX, touched | 0, end | 0) >>> 0;
+            if (seen === touched)
+                break;
+            touched = seen;
+        }
+    }
+    zero(start, end) {
+        const buffer = this.memory().buffer;
+        const bytes = new Uint8Array(buffer);
+        const bodyStart = (start + 7) & ~7;
+        const bodyEnd = end & ~7;
+        if (bodyEnd <= bodyStart) {
+            bytes.fill(0, start, end);
+            return;
+        }
+        if (bodyStart > start)
+            bytes.fill(0, start, bodyStart);
+        new Float64Array(buffer, bodyStart, (bodyEnd - bodyStart) / 8).fill(0);
+        if (end > bodyEnd)
+            bytes.fill(0, bodyEnd, end);
+    }
+    sharedRegistryCovers(start, end) {
+        const registry = this.sharedRegistry;
+        if (!registry)
+            return false;
+        this.lockSharedRegistry();
+        try {
+            for (let slot = 0; slot < SHARED_MMAP_REGISTRY_SLOTS; slot += 1) {
+                const base = registryBase(slot);
+                if (Atomics.load(registry, base + REGISTRY_STATE) === 0)
+                    continue;
+                if ((Atomics.load(registry, base + REGISTRY_REFERENCES) >>> 0) === 0)
+                    continue;
+                const mappedStart = Atomics.load(registry, base + REGISTRY_START) >>> 0;
+                const mappedEnd = mappedStart + (Atomics.load(registry, base + REGISTRY_SIZE) >>> 0);
+                if (start < mappedEnd && end > mappedStart)
+                    return true;
+            }
+            return false;
+        }
+        finally {
+            this.unlockSharedRegistry();
+        }
+    }
     mremap(address, oldLength, newLength, flags, requested) {
         if (!validPageRange(address, oldLength) || !Number.isSafeInteger(newLength) || newLength <= 0)
             return -EINVAL;
@@ -202,7 +347,6 @@ export class WaliMemoryManager {
         if (oldEnd > this.memory().buffer.byteLength)
             return -ENOMEM;
         if (newSize <= oldSize) {
-            new Uint8Array(this.memory().buffer).fill(0, address + newSize, address + oldSize);
             if (mapping)
                 mapping.end = address + newSize;
             this.release(address + newSize, oldEnd);
@@ -216,7 +360,7 @@ export class WaliMemoryManager {
         const canReserveTail = this.reserveTail(oldEnd, expandedEnd);
         const canExpand = canReserveTail && this.ensureCapacity(expandedEnd);
         if (canExpand) {
-            new Uint8Array(this.memory().buffer).fill(0, address + oldSize, expandedEnd);
+            this.zeroForHandout(address + oldSize, expandedEnd);
             if (mapping)
                 mapping.end = expandedEnd;
             return BigInt(address);
@@ -228,6 +372,8 @@ export class WaliMemoryManager {
         const target = flags & MREMAP_FIXED
             ? requested
             : this.reserve(newSize);
+        if (target === RESERVE_REFUSED)
+            return -ENOMEM;
         const targetEnd = target + newSize;
         if (!validAddress(target) || target % LINUX_PAGE_SIZE !== 0 || this.overlaps(target, targetEnd, mapping))
             return -EINVAL;
@@ -237,8 +383,7 @@ export class WaliMemoryManager {
             return -ENOMEM;
         }
         const contents = new Uint8Array(this.memory().buffer).slice(address, address + Math.min(oldSize, newSize));
-        new Uint8Array(this.memory().buffer).fill(0, address, address + oldSize);
-        new Uint8Array(this.memory().buffer).fill(0, target, targetEnd);
+        this.zeroForHandout(target, targetEnd);
         new Uint8Array(this.memory().buffer).set(contents, target);
         this.release(address, oldEnd);
         if (mapping) {
@@ -307,6 +452,8 @@ export class WaliMemoryManager {
             if (freeSlot < 0)
                 return;
             const start = this.reserve(size);
+            if (start === RESERVE_REFUSED)
+                return;
             const base = registryBase(freeSlot);
             Atomics.store(registry, base + REGISTRY_HASH_A, hashA | 0);
             Atomics.store(registry, base + REGISTRY_HASH_B, hashB | 0);
@@ -348,15 +495,15 @@ export class WaliMemoryManager {
     reserve(size) {
         this.lockAllocator();
         try {
-            for (let slot = 0; slot < FREE_RANGE_SLOTS; slot += 1) {
+            const count = this.freeRangeCount();
+            for (let slot = 0; slot < count; slot += 1) {
                 const base = freeRangeBase(slot);
                 const start = Atomics.load(this.allocatorState, base) >>> 0;
                 const available = Atomics.load(this.allocatorState, base + 1) >>> 0;
                 if (available < size)
                     continue;
                 if (available === size) {
-                    Atomics.store(this.allocatorState, base, 0);
-                    Atomics.store(this.allocatorState, base + 1, 0);
+                    this.removeFreeRange(slot);
                 }
                 else {
                     Atomics.store(this.allocatorState, base, (start + size) | 0);
@@ -368,7 +515,16 @@ export class WaliMemoryManager {
             if (cursor === 0) {
                 cursor = align(Math.max(this.memory().buffer.byteLength, DEFAULT_MMAP_BASE), LINUX_PAGE_SIZE);
             }
+            // wasm32 addresses end at 0xffff_ffff. Storing `cursor + size` past it
+            // wrapped the cursor to a low address (the store is a 32-bit word), and
+            // the next mapping was handed out over the data segment. Refuse instead;
+            // mmap turns this into ENOMEM, which the guest already handles.
+            if (cursor + size > 0xffff_ffff) {
+                this.noteCeiling(cursor, size);
+                return RESERVE_REFUSED;
+            }
             Atomics.store(this.allocatorState, MMAP_CURSOR_INDEX, (cursor + size) | 0);
+            this.noteCursor(cursor + size);
             return cursor;
         }
         finally {
@@ -390,19 +546,16 @@ export class WaliMemoryManager {
             let mergedEnd = end;
             for (;;) {
                 let merged = false;
-                for (let slot = 0; slot < FREE_RANGE_SLOTS; slot += 1) {
+                for (let slot = 0; slot < this.freeRangeCount(); slot += 1) {
                     const base = freeRangeBase(slot);
                     const rangeStart = Atomics.load(this.allocatorState, base) >>> 0;
-                    const rangeSize = Atomics.load(this.allocatorState, base + 1) >>> 0;
-                    if (rangeSize === 0)
-                        continue;
-                    const rangeEnd = rangeStart + rangeSize;
+                    const rangeEnd = rangeStart + (Atomics.load(this.allocatorState, base + 1) >>> 0);
                     if (rangeEnd < mergedStart || rangeStart > mergedEnd)
                         continue;
                     mergedStart = Math.min(mergedStart, rangeStart);
                     mergedEnd = Math.max(mergedEnd, rangeEnd);
-                    Atomics.store(this.allocatorState, base, 0);
-                    Atomics.store(this.allocatorState, base + 1, 0);
+                    this.removeFreeRange(slot);
+                    slot -= 1;
                     merged = true;
                 }
                 if (!merged)
@@ -414,12 +567,34 @@ export class WaliMemoryManager {
                 this.collapseFreeTail();
             }
             else if (mergedEnd <= cursor) {
-                const freeSlot = this.firstFreeRangeSlot();
-                if (freeSlot < 0)
+                const count = this.freeRangeCount();
+                if (count < FREE_RANGE_SLOTS) {
+                    this.storeFreeRange(count, mergedStart, mergedEnd - mergedStart);
+                    Atomics.store(this.allocatorState, FREE_RANGE_COUNT_INDEX, count + 1);
+                    this.noteFreeRangeOccupancy(count + 1);
                     return;
-                const base = freeRangeBase(freeSlot);
-                Atomics.store(this.allocatorState, base, mergedStart | 0);
-                Atomics.store(this.allocatorState, base + 1, (mergedEnd - mergedStart) | 0);
+                }
+                // The table is full. Keep the larger ranges: the smallest entry gives
+                // way to a bigger release, and whichever is lost is counted and said.
+                let smallest = 0;
+                let smallestSize = Infinity;
+                for (let slot = 0; slot < count; slot += 1) {
+                    const size = Atomics.load(this.allocatorState, freeRangeBase(slot) + 1) >>> 0;
+                    if (size < smallestSize) {
+                        smallest = slot;
+                        smallestSize = size;
+                    }
+                }
+                if (smallestSize < mergedEnd - mergedStart) {
+                    this.storeFreeRange(smallest, mergedStart, mergedEnd - mergedStart);
+                    this.noteDroppedRelease(smallestSize);
+                }
+                else {
+                    this.noteDroppedRelease(mergedEnd - mergedStart);
+                }
+            }
+            else {
+                this.noteDroppedRelease(mergedEnd - mergedStart);
             }
         }
         finally {
@@ -427,6 +602,8 @@ export class WaliMemoryManager {
         }
     }
     reserveTail(start, end) {
+        if (end > 0xffff_ffff)
+            return false;
         this.lockAllocator();
         try {
             if ((Atomics.load(this.allocatorState, MMAP_CURSOR_INDEX) >>> 0) !== start)
@@ -438,25 +615,105 @@ export class WaliMemoryManager {
             this.unlockAllocator();
         }
     }
-    firstFreeRangeSlot() {
-        for (let slot = 0; slot < FREE_RANGE_SLOTS; slot += 1) {
-            if ((Atomics.load(this.allocatorState, freeRangeBase(slot) + 1) >>> 0) === 0)
-                return slot;
+    /**
+     * THE ADDRESS-SPACE INSTRUMENT. Read this before changing `release()` or
+     * `reserve()`: both of them could lose address space without saying a word,
+     * and that silence is what made the second Blender model in a session die at
+     * an 8 MiB numpy array while every headroom probe reported gigabytes free.
+     * A probe that allocates until refused COALESCES into a few large ranges and
+     * never fills the slot table; the pattern that fills it is many small
+     * non-adjacent mappings freed out of order, which is what mallocng does with
+     * every group it maps and every large chunk (the courtyard's free ranges
+     * averaged 80 KiB).
+     */
+    noteDroppedRelease(bytes) {
+        const dropped = Atomics.add(this.allocatorState, DROPPED_RELEASES_INDEX, 1) + 1;
+        const kib = Atomics.add(this.allocatorState, DROPPED_KIB_INDEX, Math.round(bytes / 1024)) + Math.round(bytes / 1024);
+        // One line per power of two: the first drop is the news, and the hundredth
+        // copy of a notice buries the first (the same rule the -ENOSYS and thread
+        // pool notices follow in runtime.ts).
+        if ((dropped & (dropped - 1)) !== 0)
+            return;
+        this.say(`[WALI] the mmap free-range table is full (${FREE_RANGE_SLOTS} slots):`
+            + ` ${dropped} released range${dropped === 1 ? "" : "s"} could not be recorded,`
+            + ` ${(kib / 1024).toFixed(1)} MiB of address space unreusable.`);
+    }
+    noteCursor(cursor) {
+        const kib = Math.round(cursor / 1024);
+        const previous = Atomics.load(this.allocatorState, CURSOR_HIGH_WATER_KIB_INDEX) >>> 0;
+        if (kib > previous)
+            Atomics.store(this.allocatorState, CURSOR_HIGH_WATER_KIB_INDEX, kib | 0);
+    }
+    noteRetainedMunmap(bytes) {
+        const count = Atomics.add(this.allocatorState, RETAINED_MUNMAPS_INDEX, 1) + 1;
+        const kib = Atomics.add(this.allocatorState, RETAINED_KIB_INDEX, Math.round(bytes / 1024)) + Math.round(bytes / 1024);
+        if ((count & (count - 1)) !== 0)
+            return;
+        this.say(`[WALI] munmap of a range this thread did not map: ${count} retained,`
+            + ` ${(kib / 1024).toFixed(1)} MiB of address space never released.`);
+    }
+    noteCeiling(cursor, size) {
+        const count = Atomics.add(this.allocatorState, CEILING_REFUSALS_INDEX, 1) + 1;
+        this.say(`[WALI] mmap cursor ${(cursor / 1048576).toFixed(0)} MiB + ${(size / 1048576).toFixed(2)} MiB`
+            + ` passes the 4096 MiB wasm32 ceiling (${count}).`);
+    }
+    say(notice) {
+        const line = `${notice} ${this.stateSuffix()}`;
+        console.error(line);
+        this.report?.(line);
+    }
+    stateSuffix() {
+        const occupied = this.freeRangeCount();
+        let free = 0;
+        for (let slot = 0; slot < occupied; slot += 1)
+            free += Atomics.load(this.allocatorState, freeRangeBase(slot) + 1) >>> 0;
+        const cursor = Atomics.load(this.allocatorState, MMAP_CURSOR_INDEX) >>> 0;
+        return `{cursor ${(cursor / 1048576).toFixed(0)} MiB, memory ${(this.memory().buffer.byteLength / 1048576).toFixed(0)} MiB,`
+            + ` free table ${occupied}/${FREE_RANGE_SLOTS} ranges holding ${(free / 1048576).toFixed(1)} MiB}`;
+    }
+    noteFreeRangeOccupancy(occupied) {
+        if (occupied > (Atomics.load(this.allocatorState, FREE_RANGE_PEAK_INDEX) >>> 0)) {
+            Atomics.store(this.allocatorState, FREE_RANGE_PEAK_INDEX, occupied | 0);
+        }
+    }
+    /** The instrument's totals, for a host that wants them at the end of a run. */
+    addressSpaceReport() {
+        return {
+            droppedReleases: Atomics.load(this.allocatorState, DROPPED_RELEASES_INDEX) >>> 0,
+            droppedKiB: Atomics.load(this.allocatorState, DROPPED_KIB_INDEX) >>> 0,
+            cursorHighWaterKiB: Atomics.load(this.allocatorState, CURSOR_HIGH_WATER_KIB_INDEX) >>> 0,
+            freeRangePeak: Atomics.load(this.allocatorState, FREE_RANGE_PEAK_INDEX) >>> 0,
+        };
+    }
+    freeRangeCount() {
+        return Atomics.load(this.allocatorState, FREE_RANGE_COUNT_INDEX);
+    }
+    storeFreeRange(slot, start, size) {
+        const base = freeRangeBase(slot);
+        Atomics.store(this.allocatorState, base, start | 0);
+        Atomics.store(this.allocatorState, base + 1, size | 0);
+    }
+    /** Swap-remove: the last live entry takes the vacated slot. Caller holds the allocator lock. */
+    removeFreeRange(slot) {
+        const last = this.freeRangeCount() - 1;
+        if (slot !== last) {
+            const from = freeRangeBase(last);
+            this.storeFreeRange(slot, Atomics.load(this.allocatorState, from) >>> 0, Atomics.load(this.allocatorState, from + 1) >>> 0);
         }
-        return -1;
+        this.storeFreeRange(last, 0, 0);
+        Atomics.store(this.allocatorState, FREE_RANGE_COUNT_INDEX, last);
     }
     collapseFreeTail() {
         for (;;) {
             const cursor = Atomics.load(this.allocatorState, MMAP_CURSOR_INDEX) >>> 0;
             let collapsed = false;
-            for (let slot = 0; slot < FREE_RANGE_SLOTS; slot += 1) {
+            for (let slot = 0; slot < this.freeRangeCount(); slot += 1) {
                 const base = freeRangeBase(slot);
                 const start = Atomics.load(this.allocatorState, base) >>> 0;
                 const size = Atomics.load(this.allocatorState, base + 1) >>> 0;
-                if (size === 0 || start + size !== cursor)
+                if (start + size !== cursor)
                     continue;
-                Atomics.store(this.allocatorState, base, 0);
-                Atomics.store(this.allocatorState, base + 1, 0);
+                this.removeFreeRange(slot);
                 Atomics.store(this.allocatorState, MMAP_CURSOR_INDEX, start | 0);
                 collapsed = true;
                 break;