@volter/browser-wali 0.1.5 → 0.1.7

package/dist/thread-worker.js

@@ -1,11 +1,18 @@
+import { WaliSignals, WaliSignalHost } from "./signals.js";
+import { createConfinedWaliSpawnImport } from "./spawn-policy.js";
+import { normalizeProcessFilesystemPolicy, intersectProcessFilesystemPolicies } from "@volter/browser-runtime/browser-process-filesystem-policy.js";
 import { WaliMemoryManager } from "./memory.js";
 import { WaliNetworkHost } from "./network.js";
 import { SharedWaliStdinReader } from "./stdin.js";
-import { WaliSystemHost } from "./system.js";
+import { futexRequeue, WaliSystemHost } from "./system.js";
 import { WaliFileDescriptorTable } from "./filesystem.js";
 import { WaliFilesystemClient, WaliSharedFileDescriptorHost } from "./filesystem-remote.js";
+import { createWaliCodecImports, WaliCodecClient } from "./codec-remote.js";
+import { createSelectImport, SELECT_SCRATCH_BYTES } from "./select.js";
+import { WALI_ENOSYS, waliUnimplementedTraps } from "./capabilities.js";
 import { WaliSharedPipeHost } from "./shared-pipes.js";
-import { BROWSER_PROCESS_RESPONSE_BYTES, applyProcessFilesystemPatch, closeSharedPipe, decodeProcessSnapshot, retainSharedPipe, } from "./process-bridge.js";
+import { BROWSER_PROCESS_RESPONSE_BYTES, closeSharedPipe, decodeProcessSnapshot, retainSharedPipe, } from "./process-bridge.js";
+import { monotonicMilliseconds } from "./monotonic-clock.js";
 class ThreadExit extends Error {
 }
 const scope = globalThis;
@@ -21,14 +28,22 @@ let mmapCursor;
 let sharedMmapRegistry;
 let fatalState;
 let networkChannel;
+let networkHost;
+let signalState;
+let signalHost;
 let filesystemChannel;
+let codecChannel;
 let stdin;
+let terminalAttached = false;
 let stdioAliasRegistry;
 let sharedPipes;
 let childPidAllocator;
 let browserProcessPort;
+let childFilesystemPolicyVersion;
+let inheritedFilesystemPolicy;
 let outputPort;
 let slotIndex = -1;
+let poolSize = 1;
 let coordinatorPort;
 let diagnosticLength;
 let diagnosticBytes;
@@ -39,6 +54,27 @@ const reportedUnsupportedImports = new Set();
 const sleepWord = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
 const diagnosticHistory = [];
 const DIAGNOSTIC_HISTORY_LIMIT = 32;
+/**
+ * THE DIAGNOSTIC RING. A pthread records every syscall it makes (the call and
+ * its result) so that a fatal can print the thread's last moments. It used to
+ * rebuild the whole history on EVERY write -- join 32 lines, encode them,
+ * fill(0) the 16 KiB shared buffer, copy -- twice per syscall, on threads
+ * whose work IS syscalls (oneTBB workers park and wake on futex). Measured
+ * 2026-09-20: the courtyard's depsgraph updates ran 1.3-1.7x and its mesh
+ * copies 2-3x behind the Emscripten skew while the booleans themselves were
+ * at parity. Now each write encodes ONE line into a fixed slot of the ring
+ * (`encodeInto`, no allocation) and bumps a counter; `threads.ts` reads the
+ * last DIAGNOSTIC_HISTORY_LIMIT slots in order when it needs them.
+ * Layout, shared with `WaliThreadPool.diagnostics`: Int32 [0] = lines written
+ * (monotonic); slot i at DIAGNOSTIC_SLOT_OFFSET + i * DIAGNOSTIC_SLOT_BYTES,
+ * a little-endian u16 length then the UTF-8 bytes, truncated to fit.
+ */
+const DIAGNOSTIC_SLOT_BYTES = 480;
+const DIAGNOSTIC_SLOT_OFFSET = Int32Array.BYTES_PER_ELEMENT;
+const diagnosticEncoder = new TextEncoder();
+// `encodeInto` refuses a view over shared memory; the line is encoded into
+// this private scratch and copied into the slot.
+const diagnosticScratch = new Uint8Array(DIAGNOSTIC_SLOT_BYTES - 2);
 const DETACHED_THREAD_RUNTIME_NOTICE = new TextEncoder().encode("== Detached Thread End: unmapself TBD");
 scope.onmessage = (event) => {
     if (event.data.kind === "initialize") {
@@ -53,6 +89,8 @@ scope.onmessage = (event) => {
 };
 function runThread(message) {
     threadId = message.tid;
+    if (signalHost)
+        signalHost.mask = message.signalMask ?? 0n;
     diagnosticHistory.length = 0;
     writeDiagnostic(`tid ${threadId} started function ${message.functionPointer}`);
     try {
@@ -111,18 +149,24 @@ async function initialize(message) {
         sharedPipes = message.sharedPipes;
         childPidAllocator = new Int32Array(message.childPidAllocator);
         browserProcessPort = message.browserProcessPort;
+        childFilesystemPolicyVersion = message.childFilesystemPolicyVersion;
+        inheritedFilesystemPolicy = message.inheritedFilesystemPolicy === undefined ? undefined : normalizeProcessFilesystemPolicy(message.inheritedFilesystemPolicy);
         browserProcessPort?.start();
         outputPort = message.outputPort;
         outputPort?.start();
         slotIndex = message.slotIndex;
+        poolSize = message.poolSize;
         coordinatorPort = message.coordinatorPort;
         coordinatorPort.onmessage = (event) => runThread(event.data);
         coordinatorPort.start();
         diagnosticLength = new Int32Array(message.diagnostic, 0, 1);
         diagnosticBytes = new Uint8Array(message.diagnostic, Int32Array.BYTES_PER_ELEMENT);
         stdin = message.stdin ? new SharedWaliStdinReader(message.stdin) : undefined;
+        terminalAttached = message.terminal === true;
         networkChannel = message.network;
+        signalState = message.signals;
         filesystemChannel = message.filesystem;
+        codecChannel = message.codec;
         const imports = createImports();
         instance = await WebAssembly.instantiate(message.module, imports);
         scope.postMessage({ kind: "ready" });
@@ -134,26 +178,41 @@ async function initialize(message) {
 function createImports() {
     const wali = {};
     const handlers = threadHandlers();
+    let selectScratch = 0;
+    handlers.SYS_select ??= createSelectImport(requiredMemory, (pointer, count, timeout) => handlers.SYS_poll(pointer, count, timeout), () => (selectScratch ||= Number(handlers.SYS_mmap(0, SELECT_SCRATCH_BYTES, 3, 0x22, -1, 0))));
     if (networkChannel) {
         const fallback = { ...handlers };
-        Object.assign(handlers, new WaliNetworkHost(requiredMemory, networkChannel).imports(fallback));
+        Object.assign(handlers, networkHost.imports(fallback));
     }
     for (const descriptor of descriptors) {
         if (descriptor.module !== "wali" || descriptor.kind !== "function")
             continue;
-        const handler = handlers[descriptor.name] ?? (() => {
-            if (!reportedUnsupportedImports.has(descriptor.name)) {
-                reportedUnsupportedImports.add(descriptor.name);
-                console.error(`[WALI pthread ${threadId}] unsupported import: ${descriptor.name}`);
-            }
-            return -38n;
-        });
+        // The SAME question the root instance asks (`runtime.ts`'s
+        // `unimplementedImport`), from the same file: -ENOSYS where a caller can
+        // act on it, a trap for the four names where it cannot. This half already
+        // answered -38n for everything while the root killed the process for
+        // everything, so whether a program survived an unimplemented syscall
+        // depended on WHICH THREAD made the call.
+        const handler = handlers[descriptor.name] ?? (waliUnimplementedTraps(descriptor.name)
+            ? () => { throw new Error(`Unsupported WALI imports: ${descriptor.name}`); }
+            : () => {
+                if (!reportedUnsupportedImports.has(descriptor.name)) {
+                    reportedUnsupportedImports.add(descriptor.name);
+                    const notice = `[WALI pthread ${threadId}] ${descriptor.name} is not implemented; answering -ENOSYS (38) as a kernel would.`;
+                    console.error(notice);
+                    // The same door the root instance uses, over the port this thread
+                    // already holds: a notice from a pthread is no less the host's.
+                    outputPort?.postMessage({ type: "diagnostic", message: notice, tid: threadId });
+                }
+                return WALI_ENOSYS;
+            });
         wali[descriptor.name] = (...args) => {
             const call = `${descriptor.name}(${args.map(String).join(",")})`;
             writeDiagnostic(call);
             try {
                 const result = handler(...args);
                 writeDiagnostic(`${call} => ${String(result)}`);
+                signalHost?.deliver();
                 return result;
             }
             catch (error) {
@@ -173,7 +232,7 @@ function createImports() {
     };
 }
 function threadHandlers() {
-    const systemImports = new WaliSystemHost(requiredMemory, processPid, stdin, fatalState).imports();
+    const systemImports = new WaliSystemHost(requiredMemory, processPid, stdin, fatalState, terminalAttached, poolSize).imports();
     const ioctl = systemImports.SYS_ioctl;
     const filesystemClient = filesystemChannel ? new WaliFilesystemClient(filesystemChannel) : undefined;
     const fileDescriptors = filesystemChannel ? new WaliFileDescriptorTable({
@@ -189,21 +248,100 @@ function threadHandlers() {
             return BigInt(value.byteLength);
         },
         ...(stdioAliasRegistry ? { stdioAliasRegistry } : {}),
+        ...(sharedPipes ? { descriptorState: sharedPipes } : {}),
         specialDescriptorMinimum: 10_000,
         descriptorMaximum: 19_999,
     }) : undefined;
     const localFileImports = fileDescriptors?.imports() ?? {};
     const sharedFileHost = filesystemClient
-        ? new WaliSharedFileDescriptorHost(filesystemClient, stdioAliasRegistry) : undefined;
+        ? new WaliSharedFileDescriptorHost(filesystemClient, stdioAliasRegistry, sharedPipes) : undefined;
     const memoryManager = new WaliMemoryManager(requiredMemory, (fd, offset, length) => sharedFileHost?.readForMapping(fd, offset, length)
         ?? fileDescriptors?.readForMapping(fd, offset, length), requiredMmapCursor(), (fd) => sharedFileHost?.mappingPath(fd) ?? fileDescriptors?.mappingPath(fd), (path, offset, value) => sharedFileHost?.writeForMapping(path, offset, value)
-        ?? fileDescriptors?.writeForMapping(path, offset, value) ?? false, requiredSharedMmapRegistry());
+        ?? fileDescriptors?.writeForMapping(path, offset, value) ?? false, requiredSharedMmapRegistry(), (message) => { outputPort?.postMessage({ type: "diagnostic", message, tid: threadId }); });
+    signalHost = signalState ? new WaliSignalHost(new WaliSignals(signalState), requiredMemory, () => instance?.exports.__indirect_function_table, () => Number(memoryManager.imports().SYS_mmap(0, 4096, 3, 0x22, -1, 0))) : undefined;
+    networkHost = networkChannel ? new WaliNetworkHost(requiredMemory, networkChannel, signalHost) : undefined;
     const fileImports = sharedFileHost?.imports(localFileImports) ?? localFileImports;
-    const sharedPipeHost = sharedPipes ? new WaliSharedPipeHost(requiredMemory, sharedPipes) : undefined;
+    const sharedPipeHost = sharedPipes ? new WaliSharedPipeHost(requiredMemory, sharedPipes, undefined, filesystemClient) : undefined;
     const pipeImports = sharedPipeHost?.imports(fileImports) ?? fileImports;
-    const childProcesses = new Map();
+    const spawnBrowserProcess = (args, filesystemPolicy) => {
+        const [pathname, argvPointer, envPointer, cwdPointer, stdinFd, stdoutFd, stderrFd] = args;
+        if (!browserProcessPort || !childPidAllocator || !sharedPipeHost || !filesystemClient || !networkHost)
+            return -38;
+        if (inheritedFilesystemPolicy) {
+            if (childFilesystemPolicyVersion !== 1)
+                return -95;
+            filesystemPolicy = intersectProcessFilesystemPolicies(inheritedFilesystemPolicy, filesystemPolicy);
+        }
+        const executablePath = readCString(Number(pathname));
+        const argv = readCStringArray(Number(argvPointer));
+        if (argv.length === 0)
+            argv.push(executablePath);
+        const env = {};
+        for (const entry of readCStringArray(Number(envPointer))) {
+            const separator = entry.indexOf("=");
+            if (separator > 0)
+                env[entry.slice(0, separator)] = entry.slice(separator + 1);
+        }
+        const childPid = Atomics.add(childPidAllocator, 0, 1);
+        const process = {
+            control: new SharedArrayBuffer(8 * Int32Array.BYTES_PER_ELEMENT),
+            response: new SharedArrayBuffer(BROWSER_PROCESS_RESPONSE_BYTES),
+            snapshotApplied: false,
+        };
+        const exportPipe = (fd, role) => {
+            const handle = sharedPipeHost.exportBrowserProcessPipe(fd);
+            return handle?.role === role ? retainSharedPipe(handle) : undefined;
+        };
+        const stdin = exportPipe(Number(stdinFd), "reader");
+        const stdout = exportPipe(Number(stdoutFd), "writer");
+        const stderr = exportPipe(Number(stderrFd), "writer");
+        try {
+            const registered = networkHost.registerChild(childPid, process);
+            if (registered < 0)
+                throw new Error(`Child registration failed: ${registered}`);
+            const message = {
+                type: "spawn",
+                pid: childPid,
+                parentPid: processPid,
+                childPidAllocator: childPidAllocator.buffer,
+                descriptorTable: filesystemClient.copyForExecChannel([Number(stdinFd), Number(stdoutFd), Number(stderrFd)]),
+                ...(filesystemPolicy ? { filesystemPolicy } : {}),
+                executablePath,
+                argv,
+                env,
+                ...(Number(envPointer) === 0 ? { inheritEnvironment: true } : {}),
+                cwd: Number(cwdPointer) === 0 ? processCwd : readCString(Number(cwdPointer)),
+                control: process.control,
+                response: process.response,
+                // Mutations are already mirrored continuously by the process
+                // filesystem coordinator; helper launch must not serialize the VFS.
+                filesystemPatch: { files: [], removed: [] },
+                ...(stdin ? { stdin } : {}),
+                ...(stdout ? { stdout } : {}),
+                ...(stderr ? { stderr } : {}),
+            };
+            filesystemClient.prepareSpawn();
+            browserProcessPort.postMessage(message, [message.descriptorTable.port, message.descriptorTable.releasePort]);
+            return childPid;
+        }
+        catch {
+            networkHost.forgetChild(childPid);
+            if (stdin)
+                closeSharedPipe(stdin);
+            if (stdout)
+                closeSharedPipe(stdout);
+            if (stderr)
+                closeSharedPipe(stderr);
+            return -5;
+        }
+    };
+    // A pthread holds its own channel to the process's one codec worker. No
+    // channel means the process did not negotiate the bridge: every codec
+    // import answers -95 before an argument is read.
+    const codecClient = codecChannel ? new WaliCodecClient(codecChannel) : undefined;
     return {
         ...systemImports,
+        ...createWaliCodecImports(requiredMemory, () => codecClient !== undefined, () => codecClient),
         __init: () => 0,
         __deinit: () => 0,
         __proc_exit: () => { throw new ThreadExit(); },
@@ -219,7 +357,42 @@ function threadHandlers() {
         },
         __wasm_thread_spawn: (functionPointer, argumentPointer) => spawnNestedThread(Number(functionPointer), Number(argumentPointer)),
         SYS_exit: () => { throw new ThreadExit(); },
+        /**
+         * A WORKER ENDING THE WHOLE PROCESS SAYS SO, BY THREAD.
+         *
+         * This path is how a pthread ends the process: the status goes in slot 2,
+         * slot 0 goes to 2, and `system.ts`'s `throwIfPthreadFailed` turns that
+         * into `WaliPthreadProcessExit`, which `runtime.ts` makes the process exit
+         * code. The host then sees a clean `exited <status>` with NOTHING naming
+         * the thread that did it -- and a status of 0 reads as an orderly
+         * shutdown, which is the most misleading answer this runtime can give.
+         *
+         * MEASURED 2026-09-19 (WS-W), and it cost a battery: headless Blender on
+         * this runtime ended mid-call twice -- `17-workshop-interior` at its
+         * seq 19, `19-tram-stop` at its seq 28, both immediately after a Cycles
+         * render -- reported to the editor as "Blender exited 0". Blender calls
+         * no `exit()` there. musl does: `wali-musl/src/thread/pthread_create.c`,
+         * `__pthread_exit`, "if this is the only thread in the list, don't
+         * proceed with termination of the thread ... exit(0)". A departing worker
+         * that finds `self->next == self` ends the PROCESS. So the question a
+         * reader needs answered first is WHICH THREAD CALLED THIS, and until this
+         * line existed nothing anywhere recorded it.
+         *
+         * The notice is the same door `runtime.ts` uses for the unimplemented
+         * syscall: `console.error` for devtools and `{type:"diagnostic"}` over
+         * the port this thread already holds, so it reaches the host's
+         * `onDiagnostic` and the editor's console rather than only a nested
+         * worker's devtools. It is not stdout: a kernel does not write to your
+         * streams.
+         */
         SYS_exit_group: (status) => {
+            const notice = `[WALI pthread ${threadId}] SYS_exit_group(${Number(status) & 0xff})`
+                + ` -- a WORKER thread, not the main thread, is ending the process.`
+                + ` If the program did not ask to exit, read musl's __pthread_exit:`
+                + ` a departing thread that finds itself alone on the thread list calls exit(0).`;
+            writeDiagnostic(notice);
+            console.error(notice);
+            outputPort?.postMessage({ type: "diagnostic", message: notice, tid: threadId });
             if (fatalState) {
                 Atomics.store(fatalState, 2, Number(status) & 0xff);
                 Atomics.store(fatalState, 0, 2);
@@ -247,7 +420,9 @@ function threadHandlers() {
         SYS_sigaltstack: (_next, previous) => zeroMemory(Number(previous), 12),
         SYS_mprotect: () => 0n,
         SYS_munmap: () => 0n,
-        SYS_futex: (address, operation, value, timeout) => futex(Number(address), Number(operation), Number(value), Number(timeout)),
+        // All six of the kernel's arguments: FUTEX_REQUEUE reads the timeout slot
+        // as a count and needs `uaddr2` and `val3` as well. See futexRequeue.
+        SYS_futex: (address, operation, value, timeout, address2, value3) => futex(Number(address), Number(operation), Number(value), Number(timeout), Number(address2 ?? 0n), Number(value3 ?? 0n)),
         SYS_clock_gettime: (clock, pointer) => clockGettime(Number(clock), Number(pointer)),
         SYS_clock_nanosleep: (clock, flags, request, remaining) => clockNanosleep(Number(clock), Number(flags), Number(request), Number(remaining)),
         SYS_nanosleep: (request, remaining) => clockNanosleep(1, 0, Number(request), Number(remaining)),
@@ -255,75 +430,27 @@ function threadHandlers() {
         SYS_epoll_pwait: (_fd, _events, _maximum, timeout) => idlePoll(Number(timeout)),
         SYS_gettimeofday: (pointer) => gettimeofday(Number(pointer)),
         SYS_getrandom: (pointer, length) => getrandom(Number(pointer), Number(length)),
-        SYS_browser_spawn: (pathname, argvPointer, envPointer, cwdPointer, stdinFd, stdoutFd, stderrFd) => {
-            if (!browserProcessPort || !childPidAllocator || !sharedPipeHost || !filesystemClient)
-                return -38;
-            const executablePath = readCString(Number(pathname));
-            const argv = readCStringArray(Number(argvPointer));
-            if (argv.length === 0)
-                argv.push(executablePath);
-            const env = {};
-            for (const entry of readCStringArray(Number(envPointer))) {
-                const separator = entry.indexOf("=");
-                if (separator > 0)
-                    env[entry.slice(0, separator)] = entry.slice(separator + 1);
-            }
-            const childPid = Atomics.add(childPidAllocator, 0, 1);
-            const process = {
-                control: new SharedArrayBuffer(8 * Int32Array.BYTES_PER_ELEMENT),
-                response: new SharedArrayBuffer(BROWSER_PROCESS_RESPONSE_BYTES),
-                snapshotApplied: false,
-            };
-            const exportPipe = (fd, role) => {
-                const handle = sharedPipeHost.exportBrowserProcessPipe(fd);
-                return handle?.role === role ? retainSharedPipe(handle) : undefined;
-            };
-            const stdin = exportPipe(Number(stdinFd), "reader");
-            const stdout = exportPipe(Number(stdoutFd), "writer");
-            const stderr = exportPipe(Number(stderrFd), "writer");
-            childProcesses.set(childPid, process);
-            try {
-                const message = {
-                    type: "spawn",
-                    pid: childPid,
-                    executablePath,
-                    argv,
-                    env,
-                    cwd: Number(cwdPointer) === 0 ? processCwd : readCString(Number(cwdPointer)),
-                    control: process.control,
-                    response: process.response,
-                    // Mutations are already mirrored continuously by the process
-                    // filesystem coordinator; helper launch must not serialize the VFS.
-                    filesystemPatch: { files: [], removed: [] },
-                    ...(stdin ? { stdin } : {}),
-                    ...(stdout ? { stdout } : {}),
-                    ...(stderr ? { stderr } : {}),
-                };
-                browserProcessPort.postMessage(message);
-                return childPid;
-            }
-            catch {
-                childProcesses.delete(childPid);
-                if (stdin)
-                    closeSharedPipe(stdin);
-                if (stdout)
-                    closeSharedPipe(stdout);
-                if (stderr)
-                    closeSharedPipe(stderr);
-                return -5;
-            }
-        },
-        SYS_wait4: (requestedPid, status, options) => filesystemClient
-            ? waitForChild(childProcesses, filesystemClient, Number(requestedPid), Number(status), Number(options))
+        SYS_browser_spawn: (...args) => spawnBrowserProcess(args),
+        SYS_browser_spawn_confined_v1: createConfinedWaliSpawnImport(() => memory, () => childFilesystemPolicyVersion === 1, spawnBrowserProcess),
+        SYS_wait4: (requestedPid, status, options) => filesystemClient && networkHost
+            ? waitForChild(networkHost, filesystemClient, Number(requestedPid), Number(status), Number(options), signalHost?.mask ?? 0n)
             : -38n,
         SYS_kill: (requestedPid, signal) => {
+            // `kill(getpid(), 0)` is a liveness probe and a thread asks it of its own
+            // process as the main thread does (`runtime.ts`'s `signalSelf`). It was
+            // answered ESRCH, and a program that probes its own pid from a worker
+            // thread (Volter Harness's `process_is_live`, from a tokio worker) read itself
+            // as dead.
+            if (Number(signal) === 0 && (Number(requestedPid) === 0 || Number(requestedPid) === processPid))
+                return 0n;
             const childPid = Math.abs(Number(requestedPid));
-            if (!childProcesses.has(childPid) || !browserProcessPort)
+            if (!networkHost?.hasChild(childPid) || !browserProcessPort)
                 return -3n;
             browserProcessPort.postMessage({ type: "kill", pid: childPid, signal: Number(signal) });
             return 0n;
         },
         SYS_setpgid: () => 0n,
+        SYS_pidfd_open: () => -38n,
         SYS_open: () => -2n,
         SYS_openat: () => -2n,
         SYS_stat: () => -2n,
@@ -350,6 +477,7 @@ function threadHandlers() {
         SYS_fcntl: (fd, command, argument) => fcntl(Number(fd), Number(command), Number(BigInt.asIntN(32, BigInt(argument)))),
         ...memoryManager.imports(),
         ...pipeImports,
+        ...signalHost?.imports(),
         SYS_ioctl: (fd, request, argument) => sharedPipeHost?.ioctl(Number(fd), Number(request))
             ?? fileDescriptors?.ioctl(Number(fd), Number(request))
             ?? ioctl(stdioDescriptor(Number(fd)) ?? Number(fd), request, argument),
@@ -362,20 +490,24 @@ function spawnNestedThread(functionPointer, argumentPointer) {
     if (!coordinatorPort)
         return -11;
     const response = new Int32Array(new SharedArrayBuffer(2 * Int32Array.BYTES_PER_ELEMENT));
-    coordinatorPort.postMessage({ kind: "spawn", functionPointer, argumentPointer, response: response.buffer });
+    coordinatorPort.postMessage({ kind: "spawn", functionPointer, argumentPointer, signalMask: signalHost?.mask ?? 0n, response: response.buffer });
     Atomics.wait(response, 0, 0);
     return Atomics.load(response, 1);
 }
 function writeDiagnostic(message) {
     if (!diagnosticLength || !diagnosticBytes)
         return;
+    const written = Atomics.load(diagnosticLength, 0);
+    const slot = written % DIAGNOSTIC_HISTORY_LIMIT;
+    const at = DIAGNOSTIC_SLOT_OFFSET - Int32Array.BYTES_PER_ELEMENT + slot * DIAGNOSTIC_SLOT_BYTES;
     diagnosticHistory.push(message);
     if (diagnosticHistory.length > DIAGNOSTIC_HISTORY_LIMIT)
         diagnosticHistory.shift();
-    const encoded = new TextEncoder().encode(diagnosticHistory.join("\n")).subarray(-diagnosticBytes.byteLength);
-    diagnosticBytes.fill(0);
-    diagnosticBytes.set(encoded);
-    Atomics.store(diagnosticLength, 0, encoded.byteLength);
+    const { written: length } = diagnosticEncoder.encodeInto(message, diagnosticScratch);
+    diagnosticBytes.set(diagnosticScratch.subarray(0, length), at + 2);
+    diagnosticBytes[at] = length & 0xff;
+    diagnosticBytes[at + 1] = length >>> 8;
+    Atomics.store(diagnosticLength, 0, written + 1);
 }
 function readlink(pathPointer, outputPointer, length) {
     if (readCString(pathPointer) !== "/proc/self/exe")
@@ -466,42 +598,18 @@ function readCStringArray(pointer) {
     }
     throw new WebAssembly.RuntimeError("WALI process string array is not terminated.");
 }
-function waitForChild(children, filesystem, requestedPid, statusPointer, options) {
-    let childPid;
-    let process;
-    if (requestedPid === -1) {
-        const entry = children.entries().next().value;
-        if (!entry)
-            return -10n;
-        [childPid, process] = entry;
-    }
-    else {
-        const exact = children.get(requestedPid);
-        if (!exact)
-            return -10n;
-        childPid = requestedPid;
-        process = exact;
-    }
-    const control = new Int32Array(process.control);
-    if (Atomics.load(control, 0) === 0) {
-        if ((options & 1) !== 0)
-            return 0n;
-        while (Atomics.load(control, 0) === 0)
-            Atomics.wait(control, 0, 0, 1_000);
-    }
-    if (!process.snapshotApplied) {
-        process.snapshotApplied = true;
-        const patch = decodeProcessSnapshot(process);
-        if (patch)
-            applyProcessFilesystemPatch(filesystem, patch);
-    }
-    if (statusPointer !== 0) {
-        if (statusPointer < 0 || statusPointer + 4 > bytes().byteLength)
-            return -14n;
-        view().setInt32(statusPointer, (Atomics.load(control, 1) & 0xff) << 8, true);
-    }
-    children.delete(childPid);
-    return BigInt(childPid);
+function waitForChild(host, filesystem, requestedPid, statusPointer, options, mask) {
+    if (statusPointer !== 0 && (statusPointer < 0 || statusPointer + 4 > bytes().byteLength))
+        return -14n;
+    const { result, process } = host.waitChild(requestedPid, options, mask);
+    if (result <= 0)
+        return BigInt(result);
+    const patch = decodeProcessSnapshot(process);
+    if (patch)
+        filesystem.importPeerPatch(patch);
+    if (statusPointer !== 0)
+        view().setInt32(statusPointer, (Atomics.load(new Int32Array(process.control), 1) & 0xff) << 8, true);
+    return BigInt(result);
 }
 function requiredMemory() {
     if (!memory)
@@ -525,7 +633,7 @@ function zeroMemory(pointer, length) {
         bytes().fill(0, pointer, pointer + length);
     return 0n;
 }
-function futex(address, operation, value, timeoutPointer) {
+function futex(address, operation, value, timeoutPointer, address2 = 0, value3 = 0) {
     if (address % 4 !== 0)
         return -22n;
     const words = new Int32Array(requiredMemory().buffer);
@@ -533,6 +641,17 @@ function futex(address, operation, value, timeoutPointer) {
     const command = operation & 0x7f;
     if (command === 1 || command === 10)
         return BigInt(Atomics.notify(words, index, Math.max(0, value)));
+    // A pthread worker is where a missing requeue actually strands a thread: its
+    // wait below is a single Atomics.wait with no timeout, so a waiter that the
+    // kernel would have requeued and woken is parked for the life of the
+    // process. futexRequeue carries the whole argument.
+    if (command === 3 || command === 4) {
+        if (address2 % 4 !== 0)
+            return -22n;
+        if (address2 < 0 || address2 + 4 > requiredMemory().buffer.byteLength)
+            return -22n;
+        return futexRequeue(words, index, command, value, timeoutPointer, value3);
+    }
     if (command !== 0 && command !== 9)
         return -38n;
     let timeout;
@@ -543,14 +662,14 @@ function futex(address, operation, value, timeoutPointer) {
             return -22n;
         const milliseconds = Number(seconds * 1000n + nanoseconds / 1000000n);
         timeout = command === 9
-            ? Math.max(0, milliseconds - ((operation & 0x100) !== 0 ? Date.now() : performance.now()))
+            ? Math.max(0, milliseconds - ((operation & 0x100) !== 0 ? Date.now() : monotonicMilliseconds()))
             : milliseconds;
     }
     const result = Atomics.wait(words, index, value, timeout);
     return result === "not-equal" ? -11n : result === "timed-out" ? -110n : 0n;
 }
 function clockGettime(clock, pointer) {
-    const milliseconds = clock === 0 ? performance.timeOrigin + performance.now() : performance.now();
+    const milliseconds = clock === 0 ? performance.timeOrigin + performance.now() : monotonicMilliseconds();
     const nanoseconds = BigInt(Math.floor(milliseconds * 1_000_000));
     view().setBigInt64(pointer, nanoseconds / 1000000000n, true);
     view().setBigInt64(pointer + 8, nanoseconds % 1000000000n, true);
@@ -573,7 +692,7 @@ function clockNanosleep(clock, flags, request, remaining) {
         return -22n;
     let duration = Number(seconds * 1000n + nanoseconds / 1000000n);
     if (flags & 1)
-        duration = Math.max(0, duration - (clock === 0 ? Date.now() : performance.now()));
+        duration = Math.max(0, duration - (clock === 0 ? Date.now() : monotonicMilliseconds()));
     Atomics.wait(sleepWord, 0, 0, duration);
     if (remaining !== 0)
         bytes().fill(0, remaining, remaining + 16);