@zackbart/connecta 0.24.4 → 0.26.0

package/dist/executors/quickjs.js

@@ -1,13 +1,24 @@
 // Node's built-in code-mode executor. QuickJS itself lives in a disposable
 // child process: guest CPU, WASM aborts, and interpreter OOMs cannot block or
 // terminate the HTTP-serving process.
+//
+// The pool is Effect inside and Promise at the edge. A child process is a
+// scoped resource: its Scope owns the startup watchdog and a finalizer that
+// kills the process and waits a bounded time for it to go. Retiring a child —
+// recycled after a deadline, a cancellation, a released lease, or shutdown —
+// is closing that Scope, so every path out of a child runs the same teardown.
+// Respawn after a crash waits out a Schedule. The IPC protocol stays plain:
+// the child's messages arrive as Node events, and host calls are the
+// Promise-shaped provider functions execute.ts hands over.
 import { Buffer } from "node:buffer";
 import { fork } from "node:child_process";
 import { existsSync } from "node:fs";
 import { fileURLToPath } from "node:url";
+import { Deferred, Duration, Effect, Exit, Schedule, Scope } from "effect";
 import { AdmissionController, ExecutorAdmissionError, ExecutorExecutionError, } from "../executor-admission.js";
 import { msg } from "../errors.js";
 import { MAX_EXECUTE_LOG_CHARS } from "../executor-result.js";
+import { detach, fromSignal, runEdge } from "../runtime/run.js";
 import { hostCallLabel, MAX_QUICKJS_IPC_BYTES, MAX_QUICKJS_HOST_RPC_BYTES, serializedBytes, stringifyBounded, } from "./quickjs-protocol.js";
 export { normalizeCode } from "./quickjs-runtime.js";
 const DEFAULT_TIMEOUT_MS = 30_000;
@@ -19,8 +30,19 @@ const DEFAULT_MAX_QUEUE_SIZE = 32;
 const DEFAULT_QUEUE_TIMEOUT_MS = 5_000;
 const CHILD_EXIT_GRACE_MS = 250;
 const CHILD_STARTUP_TIMEOUT_MS = 10_000;
+// How long a retired child gets to exit after SIGTERM before SIGKILL.
+const CHILD_KILL_GRACE_MS = 1_000;
 const MAX_CHILD_STDERR_BYTES = 8 * 1024;
 const MAX_ERROR_CHARS = 4_000;
+// Respawn backoff after consecutive crashes: 100 ms, doubling, capped at 5 s.
+// A value, not a running effect: stepping it happens inside a request's fiber.
+const CRASH_BACKOFF = Schedule.min([
+    Schedule.exponential(Duration.millis(100)),
+    Schedule.spaced(Duration.seconds(5)),
+]);
+const crashBackoff = Effect.map(Schedule.toStep(CRASH_BACKOFF), (step) => (crashedAt) => step(crashedAt, undefined).pipe(Effect.map(([, delay]) => crashedAt + Duration.toMillis(delay)), 
+// Neither schedule ever halts; a halt here would be a broken invariant.
+Effect.orDie));
 function retainStderrTail(current, chunk) {
     const incoming = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
     if (incoming.length >= MAX_CHILD_STDERR_BYTES) {
@@ -66,43 +88,43 @@ function errorPayload(error) {
         error: message,
     });
 }
-function delay(ms, signal) {
-    if (ms <= 0)
-        return Promise.resolve();
-    return new Promise((resolve, reject) => {
-        const timer = setTimeout(() => {
-            signal?.removeEventListener("abort", onAbort);
-            resolve();
-        }, ms);
-        const onAbort = () => {
-            clearTimeout(timer);
-            signal?.removeEventListener("abort", onAbort);
-            reject(new ExecutorAdmissionError("executor_cancelled", "Execution was cancelled while the sandbox was restarting."));
-        };
-        signal?.addEventListener("abort", onAbort, { once: true });
-        if (signal?.aborted)
-            onAbort();
-    });
+function cancelled(message) {
+    return new ExecutorAdmissionError("executor_cancelled", message);
+}
+function shuttingDown() {
+    return new ExecutorAdmissionError("executor_closed", "Executor is shutting down.");
 }
-function waitForReady(ready, signal) {
+/**
+ * Wait for `effect` unless the caller's signal aborts first, which fails with
+ * `executor_cancelled`. An already-aborted signal fails without waiting, even
+ * when the effect would have completed at once.
+ */
+function unlessCancelled(effect, signal, message) {
     if (!signal)
-        return ready;
-    return new Promise((resolve, reject) => {
-        let settled = false;
-        const finish = (operation) => {
-            if (settled)
-                return;
-            settled = true;
-            signal.removeEventListener("abort", onAbort);
-            operation();
-        };
-        const onAbort = () => finish(() => reject(new ExecutorAdmissionError("executor_cancelled", "Execution was cancelled while the sandbox was starting.")));
-        signal.addEventListener("abort", onAbort, { once: true });
-        if (signal.aborted) {
-            onAbort();
-            return;
-        }
-        void ready.then(() => finish(resolve), (error) => finish(() => reject(error instanceof Error ? error : new Error(String(error)))));
+        return effect;
+    if (signal.aborted)
+        return Effect.fail(cancelled(message));
+    return Effect.raceAllFirst([
+        effect,
+        fromSignal(signal).pipe(Effect.mapError(() => cancelled(message))),
+    ]);
+}
+/**
+ * The child's release: SIGTERM, then wait for the exit, bounded — a child
+ * still there after the grace gets SIGKILL and is not waited on further. A
+ * child that already exited is left alone.
+ */
+function terminate(child) {
+    return Effect.suspend(() => {
+        if (Deferred.isDoneUnsafe(child.exited))
+            return Effect.void;
+        child.process.kill();
+        return Effect.raceAllFirst([
+            Deferred.await(child.exited),
+            Effect.sleep(Duration.millis(CHILD_KILL_GRACE_MS)).pipe(Effect.andThen(Effect.sync(() => {
+                child.process.kill("SIGKILL");
+            }))),
+        ]);
     });
 }
 class QuickJsChildPool {
@@ -112,6 +134,9 @@ class QuickJsChildPool {
     slots;
     available;
     runtimeOptions;
+    // Scope closes still in flight, so close() can wait out every child rather
+    // than only the ones it retired itself.
+    retiring = new Set();
     closed = false;
     nextJobId = 1;
     constructor(options) {
@@ -130,7 +155,7 @@ class QuickJsChildPool {
             maxStackSizeBytes: positiveWhole(options.maxStackSizeBytes, DEFAULT_STACK_LIMIT_BYTES, "maxStackSizeBytes"),
         };
         this.slots = Array.from({ length: concurrency }, () => ({
-            consecutiveCrashes: 0,
+            crashes: [],
             notBefore: 0,
         }));
         this.available = [...this.slots];
@@ -152,12 +177,14 @@ class QuickJsChildPool {
                 if (executed)
                     throw new Error("Executor lease may execute only once.");
                 executed = true;
-                return this.run(slot, code, providers, options.signal);
+                return runEdge(this.run(slot, code, providers, options.signal));
             },
             release: () => {
                 if (released)
                     return;
                 released = true;
+                // A lease let go mid-run takes its child with it: the program is
+                // abandoned, and the next lease must not inherit its leftovers.
                 if (slot.active) {
                     this.rejectActive(slot, new Error("Executor lease was released during execution."));
                     this.recycle(slot);
@@ -184,68 +211,56 @@ class QuickJsChildPool {
             return;
         this.closed = true;
         this.admission.close();
-        const exits = this.slots.map((slot) => this.stopSlot(slot));
-        await Promise.allSettled(exits);
+        for (const slot of this.slots)
+            this.stopSlot(slot);
+        await Promise.allSettled(this.retiring);
     }
-    async run(slot, code, providers, signal) {
-        if (signal?.aborted) {
-            throw new ExecutorAdmissionError("executor_cancelled", "Execution was cancelled before it started.");
-        }
-        await this.ensureChild(slot, signal);
-        if (signal?.aborted) {
-            throw new ExecutorAdmissionError("executor_cancelled", "Execution was cancelled before it started.");
-        }
-        const child = slot.child;
-        if (!child?.connected) {
-            throw new Error("QuickJS child IPC channel is unavailable.");
-        }
-        const id = this.nextJobId++;
-        const providerMap = new Map(providers.map((item) => [item.name, item]));
-        let payloadJson;
-        let runMessage;
-        try {
-            payloadJson = stringifyBounded({
-                id,
-                code,
-                providers: providers.map((item) => ({
-                    name: item.name,
-                    ...(item.prelude ? { prelude: item.prelude } : {}),
-                })),
-                options: this.runtimeOptions,
-            }, "QuickJS run payload");
-            runMessage = { type: "run", payloadJson };
-            stringifyBounded(runMessage, "QuickJS run IPC envelope");
-        }
-        catch (err) {
-            return { result: undefined, error: msg(err) };
-        }
-        child.ref();
-        child.channel?.ref();
-        return new Promise((resolve, reject) => {
-            const wallTimer = setTimeout(() => {
-                this.rejectActive(slot, new Error(`QuickJS child exceeded the ${this.runtimeOptions.timeoutMs}ms wall budget and was terminated.`));
-                this.recycle(slot);
-            }, this.runtimeOptions.timeoutMs + CHILD_EXIT_GRACE_MS);
+    // One execution on a leased slot: a ready child, the run message, then the
+    // outcome raced against the wall deadline and the caller's abort. Either of
+    // those settles the outcome and recycles the child; the race's losers are
+    // interrupted, which clears their timer and abort listener.
+    run(slot, code, providers, signal) {
+        return Effect.gen({ self: this }, function* () {
+            if (signal?.aborted) {
+                return yield* Effect.fail(cancelled("Execution was cancelled before it started."));
+            }
+            yield* this.ensureChild(slot, signal);
+            if (signal?.aborted) {
+                return yield* Effect.fail(cancelled("Execution was cancelled before it started."));
+            }
+            const child = slot.child?.process;
+            if (!child?.connected) {
+                return yield* Effect.fail(new Error("QuickJS child IPC channel is unavailable."));
+            }
+            const id = this.nextJobId++;
+            const providerMap = new Map(providers.map((item) => [item.name, item]));
+            let runMessage;
+            try {
+                const payloadJson = stringifyBounded({
+                    id,
+                    code,
+                    providers: providers.map((item) => ({
+                        name: item.name,
+                        ...(item.prelude ? { prelude: item.prelude } : {}),
+                    })),
+                    options: this.runtimeOptions,
+                }, "QuickJS run payload");
+                runMessage = { type: "run", payloadJson };
+                stringifyBounded(runMessage, "QuickJS run IPC envelope");
+            }
+            catch (err) {
+                return { result: undefined, error: msg(err) };
+            }
+            child.ref();
+            child.channel?.ref();
             const active = {
                 id,
                 logs: [],
                 logChars: 0,
                 providers: providerMap,
-                resolve,
-                reject,
-                ...(signal ? { signal } : {}),
-                wallTimer,
+                outcome: Deferred.makeUnsafe(),
             };
-            active.onAbort = () => {
-                this.rejectActive(slot, new ExecutorAdmissionError("executor_cancelled", "Execution was cancelled."));
-                this.recycle(slot);
-            };
-            signal?.addEventListener("abort", active.onAbort, { once: true });
             slot.active = active;
-            if (signal?.aborted) {
-                active.onAbort();
-                return;
-            }
             try {
                 child.send(runMessage, (error) => {
                     if (!error || slot.active?.id !== id)
@@ -258,87 +273,144 @@ class QuickJsChildPool {
                 this.rejectActive(slot, err instanceof Error ? err : new Error(String(err)));
                 this.recycle(slot);
             }
+            // Settle the outcome from outside the child, then leave the verdict to
+            // the outcome contender: exactly one party ever settles it. A run that
+            // has already settled keeps its child.
+            const endWith = (error) => Effect.sync(() => {
+                if (slot.active !== active)
+                    return;
+                this.rejectActive(slot, error);
+                this.recycle(slot);
+            }).pipe(Effect.andThen(Effect.never));
+            const contenders = [
+                Deferred.await(active.outcome),
+                Effect.sleep(Duration.millis(this.runtimeOptions.timeoutMs + CHILD_EXIT_GRACE_MS)).pipe(Effect.andThen(endWith(new Error(`QuickJS child exceeded the ${this.runtimeOptions.timeoutMs}ms wall budget and was terminated.`)))),
+            ];
+            if (signal) {
+                contenders.push(fromSignal(signal).pipe(Effect.catch(() => endWith(cancelled("Execution was cancelled.")))));
+            }
+            return yield* Effect.raceAllFirst(contenders);
         });
     }
-    async ensureChild(slot, signal) {
-        if (this.closed) {
-            throw new ExecutorAdmissionError("executor_closed", "Executor is shutting down.");
-        }
-        if (slot.child?.connected) {
-            if (slot.ready)
-                await waitForReady(slot.ready, signal);
-            return;
-        }
-        await delay(Math.max(0, slot.notBefore - Date.now()), signal);
-        if (this.closed) {
-            throw new ExecutorAdmissionError("executor_closed", "Executor is shutting down.");
-        }
-        const sourceMode = import.meta.url.endsWith(".ts");
-        const childUrl = new URL(sourceMode ? "./quickjs-child.ts" : "./quickjs-child.js", import.meta.url);
-        const childPath = fileURLToPath(childUrl);
-        if (!existsSync(childPath)) {
-            throw new Error(`QuickJS child entry is missing at ${childPath}. ` +
-                "The @zackbart/connecta/quickjs subpath requires the package file " +
-                "layout on disk; externalize @zackbart/connecta (or at least " +
-                "@zackbart/connecta/quickjs) when bundling the server.");
-        }
-        const child = fork(childPath, [], {
+    // A ready child on the slot: the warm one, or a new one once any crash
+    // backoff has passed. Waiting stops at the caller's abort, but a child that
+    // is still starting keeps starting for whoever leases the slot next.
+    ensureChild(slot, signal) {
+        return Effect.gen({ self: this }, function* () {
+            if (this.closed)
+                return yield* Effect.fail(shuttingDown());
+            const current = slot.child;
+            if (current?.process.connected) {
+                return yield* this.awaitReady(current, signal);
+            }
+            // Disconnected but not yet closed: already on its way out.
+            if (current)
+                this.retire(slot, current);
+            for (const crashedAt of slot.crashes.splice(0)) {
+                slot.backoff ??= yield* crashBackoff;
+                slot.notBefore = yield* slot.backoff(crashedAt);
+            }
+            const wait = slot.notBefore - Date.now();
+            if (wait > 0) {
+                yield* unlessCancelled(Effect.sleep(Duration.millis(wait)), signal, "Execution was cancelled while the sandbox was restarting.");
+            }
+            if (this.closed)
+                return yield* Effect.fail(shuttingDown());
+            const child = yield* this.spawn(slot);
+            return yield* this.awaitReady(child, signal);
+        });
+    }
+    awaitReady(child, signal) {
+        if (Deferred.isDoneUnsafe(child.ready))
+            return Deferred.await(child.ready);
+        return unlessCancelled(Deferred.await(child.ready), signal, "Execution was cancelled while the sandbox was starting.");
+    }
+    // Acquire a child into a Scope of its own. The Scope outlives the request
+    // that started the child — a warm child serves many leases — and closes
+    // when the pool retires it. The watchdog is forked during acquisition, so
+    // its finalizer is registered before the release and runs after it: the
+    // SIGTERM goes out first, synchronously, and the watchdog stops after.
+    spawn(slot) {
+        return Effect.suspend(() => {
+            const sourceMode = import.meta.url.endsWith(".ts");
+            const childUrl = new URL(sourceMode ? "./quickjs-child.ts" : "./quickjs-child.js", import.meta.url);
+            const childPath = fileURLToPath(childUrl);
+            if (!existsSync(childPath)) {
+                return Effect.fail(new Error(`QuickJS child entry is missing at ${childPath}. ` +
+                    "The @zackbart/connecta/quickjs subpath requires the package file " +
+                    "layout on disk; externalize @zackbart/connecta (or at least " +
+                    "@zackbart/connecta/quickjs) when bundling the server."));
+            }
+            const scope = Scope.makeUnsafe();
+            return Effect.acquireRelease(Effect.sync(() => this.forkChild(slot, scope, childPath, sourceMode)).pipe(Effect.tap((child) => Effect.forkIn(this.startupWatchdog(slot, child), scope))), terminate).pipe(Scope.provide(scope));
+        });
+    }
+    // Fails a child that never reports ready. It lives in the child's Scope,
+    // so it ends with the child, and it finishes as soon as readiness settles
+    // either way, so a ready child leaves no timer behind.
+    startupWatchdog(slot, child) {
+        return Effect.raceFirst(Deferred.await(child.ready).pipe(Effect.ignore), Effect.sleep(Duration.millis(CHILD_STARTUP_TIMEOUT_MS)).pipe(Effect.andThen(Effect.sync(() => this.failChildStartup(slot, child, new Error(`QuickJS child did not become ready within ${CHILD_STARTUP_TIMEOUT_MS}ms.`))))));
+    }
+    forkChild(slot, scope, childPath, sourceMode) {
+        const subprocess = fork(childPath, [], {
             // The child needs only its entry path, exec arguments, and IPC channel.
             // Do not copy deployment credentials or Node startup configuration into
-            // the process that contains the guest runtime.
-            env: {},
+            // the process that contains the guest runtime. `TZ` alone is set: the
+            // guest's local-time methods read the child's zone, and pinning it to
+            // UTC makes them the same on every host, like a Dynamic Worker's (P6).
+            env: { TZ: "UTC" },
             execArgv: sourceMode ? ["--import", "tsx"] : [],
             stdio: ["ignore", "ignore", "pipe", "ipc"],
         });
+        const child = {
+            process: subprocess,
+            scope,
+            ready: Deferred.makeUnsafe(),
+            exited: Deferred.makeUnsafe(),
+            retired: false,
+        };
         let stderrTail = Buffer.alloc(0);
-        child.stderr?.on("data", (chunk) => {
+        subprocess.stderr?.on("data", (chunk) => {
             stderrTail = retainStderrTail(stderrTail, chunk);
         });
-        child.stderr?.unref?.();
+        subprocess.stderr?.unref?.();
         slot.child = child;
-        slot.ready = new Promise((resolve, reject) => {
-            slot.resolveReady = resolve;
-            slot.rejectReady = reject;
-        });
-        slot.readyTimer = setTimeout(() => {
-            if (slot.child !== child || !slot.ready)
-                return;
-            const error = new Error(`QuickJS child did not become ready within ${CHILD_STARTUP_TIMEOUT_MS}ms.`);
-            this.failChildStartup(slot, child, error);
-        }, CHILD_STARTUP_TIMEOUT_MS);
-        child.on("message", (message) => {
+        subprocess.on("message", (message) => {
             void this.onMessage(slot, child, message);
         });
-        child.on("error", (error) => {
+        subprocess.on("error", (error) => {
             if (slot.child !== child)
                 return;
-            if (slot.ready) {
+            if (!Deferred.isDoneUnsafe(child.ready)) {
                 this.failChildStartup(slot, child, error);
                 return;
             }
             this.rejectActive(slot, error);
             this.recycle(slot);
         });
+        subprocess.once("exit", () => {
+            Deferred.doneUnsafe(child.exited, Exit.void);
+        });
         // `close`, unlike `exit`, runs after the stdio streams have closed, so the
         // diagnostic includes stderr bytes flushed immediately before a crash.
-        child.on("close", (code, exitSignal) => {
-            const expected = slot.expectedExit === child;
-            if (slot.expectedExit === child)
-                slot.expectedExit = undefined;
+        subprocess.on("close", (code, exitSignal) => {
+            Deferred.doneUnsafe(child.exited, Exit.void);
+            const expected = child.retired;
+            const current = slot.child === child;
             const exitDescription = `${exitSignal ? `signal ${exitSignal}` : `code ${String(code)}`}`;
-            this.rejectChildReady(slot, child, childExitError(`QuickJS child exited before becoming ready (${exitDescription}).`, stderrTail));
-            if (slot.child === child)
-                slot.child = undefined;
-            if (expected)
+            // Charge the crash and detach the child before failing its readiness:
+            // a settled Deferred resumes its waiter synchronously, and a successor
+            // must never find a dead child on the slot or a crash not yet counted.
+            if (!expected)
+                this.recordCrash(slot);
+            this.retire(slot, child, childExitError(`QuickJS child exited before becoming ready (${exitDescription}).`, stderrTail));
+            if (expected || !current)
                 return;
-            this.recordCrash(slot);
-            const error = childExitError(`QuickJS child exited unexpectedly (${exitDescription}).`, stderrTail);
-            this.rejectActive(slot, error);
+            this.rejectActive(slot, childExitError(`QuickJS child exited unexpectedly (${exitDescription}).`, stderrTail));
         });
-        child.unref();
-        child.channel?.unref();
-        if (slot.ready)
-            await waitForReady(slot.ready, signal);
+        subprocess.unref();
+        subprocess.channel?.unref();
+        return child;
     }
     async onMessage(slot, child, message) {
         // A compromised child is exactly the adversary this process boundary
@@ -347,7 +419,8 @@ class QuickJsChildPool {
         if (!message || typeof message !== "object")
             return;
         if (message.type === "ready") {
-            this.resolveChildReady(slot, child);
+            if (slot.child === child)
+                Deferred.doneUnsafe(child.ready, Exit.void);
             return;
         }
         const active = slot.active;
@@ -381,7 +454,7 @@ class QuickJsChildPool {
         if (message.type === "host-call") {
             if (message.jobId !== active.id)
                 return;
-            await this.handleHostCall(slot, child, active, message);
+            await this.handleHostCall(slot, child.process, active, message);
             return;
         }
         if (message.type !== "result" || message.jobId !== active.id)
@@ -393,7 +466,9 @@ class QuickJsChildPool {
         }
         try {
             const payload = JSON.parse(message.payloadJson);
-            slot.consecutiveCrashes = 0;
+            // A result ends any crash streak: the next crash backs off from 100 ms.
+            slot.crashes.length = 0;
+            slot.backoff = undefined;
             slot.notBefore = 0;
             this.resolveActive(slot, payload.outcome);
             if (payload.timedOut) {
@@ -482,94 +557,62 @@ class QuickJsChildPool {
         const resolved = outcome.logs === undefined && active.logs.length > 0
             ? { ...outcome, logs: active.logs }
             : outcome;
-        this.clearActive(slot, active);
-        active.resolve(resolved);
+        this.clearActive(slot);
+        Deferred.doneUnsafe(active.outcome, Exit.succeed(resolved));
     }
     rejectActive(slot, error) {
         const active = slot.active;
         if (!active)
             return;
-        this.clearActive(slot, active);
+        this.clearActive(slot);
         if (active.logs.length > 0)
             Object.assign(error, { logs: active.logs });
-        active.reject(error);
+        Deferred.doneUnsafe(active.outcome, Exit.fail(error));
     }
-    clearActive(slot, active) {
-        clearTimeout(active.wallTimer);
-        if (active.onAbort) {
-            active.signal?.removeEventListener("abort", active.onAbort);
-        }
+    clearActive(slot) {
         slot.active = undefined;
-        slot.child?.unref();
-        slot.child?.channel?.unref();
-    }
-    resolveChildReady(slot, child) {
-        if (slot.child !== child || !slot.ready)
-            return;
-        if (slot.readyTimer)
-            clearTimeout(slot.readyTimer);
-        const resolve = slot.resolveReady;
-        slot.ready = undefined;
-        slot.resolveReady = undefined;
-        slot.rejectReady = undefined;
-        slot.readyTimer = undefined;
-        resolve?.();
-    }
-    rejectChildReady(slot, child, error) {
-        if (slot.child !== child || !slot.ready)
-            return;
-        if (slot.readyTimer)
-            clearTimeout(slot.readyTimer);
-        const reject = slot.rejectReady;
-        slot.ready = undefined;
-        slot.resolveReady = undefined;
-        slot.rejectReady = undefined;
-        slot.readyTimer = undefined;
-        reject?.(error);
+        slot.child?.process.unref();
+        slot.child?.process.channel?.unref();
     }
     recordCrash(slot) {
-        slot.consecutiveCrashes++;
-        slot.notBefore =
-            Date.now() +
-                Math.min(5_000, 100 * 2 ** (slot.consecutiveCrashes - 1));
+        slot.crashes.push(Date.now());
     }
     failChildStartup(slot, child, error) {
-        if (slot.child !== child || !slot.ready)
+        if (slot.child !== child || Deferred.isDoneUnsafe(child.ready))
             return;
-        // Detach before the rejected readiness promise can release the lease. A
-        // queued successor must never observe a connected child that is unready
-        // and already on its way out.
-        slot.expectedExit = child;
-        this.rejectChildReady(slot, child, error);
-        slot.child = undefined;
         this.recordCrash(slot);
-        child.kill();
+        this.retire(slot, child, error);
     }
     recycle(slot) {
         const child = slot.child;
         if (!child)
             return;
-        this.rejectChildReady(slot, child, new Error("QuickJS child was recycled before becoming ready."));
-        slot.expectedExit = child;
-        slot.child = undefined;
-        child.kill();
+        this.retire(slot, child, new Error("QuickJS child was recycled before becoming ready."));
     }
     stopSlot(slot) {
         const child = slot.child;
         if (!child)
-            return Promise.resolve();
+            return;
         this.rejectActive(slot, new ExecutorExecutionError("executor_closed", "Executor is shutting down."));
-        this.rejectChildReady(slot, child, new ExecutorAdmissionError("executor_closed", "Executor is shutting down."));
-        slot.expectedExit = child;
-        slot.child = undefined;
-        return new Promise((resolve) => {
-            const timer = setTimeout(resolve, 1_000);
-            child.once("exit", () => {
-                clearTimeout(timer);
-                resolve();
-            });
-            child.kill();
-        });
+        this.retire(slot, child, shuttingDown());
+    }
+    // Let a child go: off the slot first, so nothing new reaches it, then its
+    // Scope closes — the finalizer's SIGTERM is sent before this returns, since
+    // a detached fiber runs synchronously up to its first wait — and last its
+    // readiness fails with `readyError` if it never reported ready. Idempotent.
+    // The bounded wait for the exit continues in the background; close() waits
+    // for every one still running.
+    retire(slot, child, readyError) {
+        if (slot.child === child)
+            slot.child = undefined;
+        if (!child.retired) {
+            child.retired = true;
+            const closing = detach(Scope.close(child.scope, Exit.void));
+            this.retiring.add(closing);
+            void closing.then(() => this.retiring.delete(closing));
+        }
+        if (readyError)
+            Deferred.doneUnsafe(child.ready, Exit.fail(readyError));
     }
 }
 /**