@zackbart/connecta 0.36.2 → 0.37.0

package/dist/operator-ui/model.d.ts

@@ -57,6 +57,8 @@ interface UiCredential {
     notice?: string;
 }
 export interface UiConnector {
+    /** Complete catalog and status from this detail request, when supported. */
+    overlay?: OperatorConnectorOverlay;
     id: string;
     /** Downstream authentication owner. Older payload fixtures omit it as shared. */
     authScope?: "shared" | "personal";

package/dist/providers/planning-center/lib/constants.d.ts

@@ -55,4 +55,4 @@ export declare const PLANNING_CENTER_MAX_RESPONSE_BYTES: number;
  */
 export declare const PLANNING_CENTER_ADMISSION: ConnectorCallAdmissionPolicy;
 /** Planning Center refuses a request without a descriptive one (HTTP 403). */
-export declare const DEFAULT_USER_AGENT = "connecta/0.36.2 (+https://github.com/zackbart/connecta)";
+export declare const DEFAULT_USER_AGENT = "connecta/0.37.0 (+https://github.com/zackbart/connecta)";

package/dist/request-principal.js

@@ -0,0 +1,34 @@
+// The admitted principal a request-auth resolver may receive (#1103).
+//
+// Only the caller core attached from the admitting authorization counts
+// (`callerOf`, see connector-caller.ts). No argument, program or header can
+// name it, and a context no request admitted has none. Nothing here
+// invents a delegated identity: a caller that is not an admitted person, or a
+// declared agent the deployment explicitly accepts, is refused before the
+// resolver runs.
+import { isAgentName } from "./agent-identity.js";
+import { callerOf } from "./connector-caller.js";
+import { validIdentityReference } from "./identity.js";
+/**
+ * The principal this operation's admitted caller is. Anything else is refused
+ * through `refuse`, the connector's own `auth_required` error.
+ */
+export function requestPrincipalFor(policy, ctx, refuse) {
+    const caller = callerOf(ctx);
+    // An operator check, a context no request admitted, or an open deployment's anonymous caller.
+    if (!caller?.authenticated)
+        throw refuse("acts as the admitted caller, and this operation has none");
+    const { identity } = caller;
+    if (identity.agent !== undefined) {
+        if (policy !== "human-or-agent")
+            throw refuse("refuses agents unless deployment code accepts them");
+        if (!isAgentName(identity.agent) || identity.principal !== undefined || !caller.pool)
+            throw refuse("acts as the admitted caller, and refuses this one");
+        return Object.freeze({ kind: "agent", name: identity.agent, pool: caller.pool });
+    }
+    const principal = identity.principal;
+    if (!validIdentityReference(principal))
+        throw refuse("acts as the admitted caller, and refuses this one");
+    // Fixed key order: `JSON.stringify` of the frozen result is its partition key.
+    return Object.freeze({ kind: "human", namespace: principal.namespace, id: principal.id });
+}

package/dist/request-token.d.ts

@@ -5,3 +5,49 @@ export interface RequestToken {
     /** Drop only the rejected token. This hook never authorizes replay. */
     invalidate?: (rejected: string, ctx: ConnectorContext) => Promise<void>;
 }
+/**
+ * A person inbound auth admitted, as the `{ namespace, id }` a member
+ * reference resolves to. Never taken from arguments, programs or headers.
+ */
+export interface HumanRequestPrincipal {
+    readonly kind: "human";
+    readonly namespace: string;
+    readonly id: string;
+}
+/** A declared agent and the pool it was admitted through. */
+export interface AgentRequestPrincipal {
+    readonly kind: "agent";
+    readonly name: string;
+    readonly pool: string;
+}
+/** The admitted caller a principal-forwarding request resolver receives. */
+export type RequestPrincipal = HumanRequestPrincipal | AgentRequestPrincipal;
+/**
+ * Which admitted callers a principal-forwarding request resolver accepts.
+ * `"human"` refuses agents; `"human-or-agent"` also accepts declared agents.
+ */
+export type RequestPrincipalPolicy = "human" | "human-or-agent";
+/**
+ * Opt-in principal forwarding for request auth: the resolver receives the
+ * admitted caller, and every other caller is refused before it runs.
+ */
+export type PrincipalForwarding = {
+    accept: "human";
+    token: PrincipalRequestToken<HumanRequestPrincipal>;
+} | {
+    accept: "human-or-agent";
+    token: PrincipalRequestToken;
+};
+/** Per-resolution input for a principal-forwarding resolver. */
+export interface RequestTokenInput<P extends RequestPrincipal = RequestPrincipal> {
+    readonly principal: P;
+}
+/**
+ * A request-local Bearer resolver that receives the admitted principal.
+ * Return the same token for the same principal while it is valid.
+ */
+export interface PrincipalRequestToken<P extends RequestPrincipal = RequestPrincipal> {
+    (ctx: ConnectorContext, input: RequestTokenInput<P>): Promise<string>;
+    /** Drop only the rejected token for this principal. This hook never authorizes replay. */
+    invalidate?: (rejected: string, ctx: ConnectorContext, input: RequestTokenInput<P>) => Promise<void>;
+}

package/dist/routes/mcp.js

@@ -267,12 +267,12 @@ function scopedToBody(handler, signal) {
 /**
  * The request's admission permit, owned by its Scope.
  *
- * Admission goes through the controller's Promise rather than its Effect
- * program, on purpose. The pool is shared by every request
- * in the isolate, and a queued request is handed its permit from inside the
- * request whose body just ended. A fiber resumed there would authorize and
- * serve this request in that one's I/O context, which workerd refuses;
- * awaiting `acquire()`'s promise resumes it in its own.
+ * The pool is shared by every request in the isolate, and a queued request is
+ * handed its permit from inside the request whose body just ended. The queue
+ * wakes it through a Promise its own request created
+ * (src/runtime/settlement.ts), and this fiber awaits `acquire()`'s Promise, so
+ * it authorizes and serves this request in its own I/O context, never that
+ * one's, which workerd refuses.
  *
  * The wait stays interruptible, and a permit granted just as it was
  * interrupted still arrives, later, to be released on arrival.

package/dist/routes/ui-config.js

@@ -1,3 +1,4 @@
+import { storedAuthObservation } from "../auth/stored-observation.js";
 import { agentDescriptions } from "../agent-description.js";
 import { readAgentAdmission } from "../agent-observation.js";
 // `GET /ui/api/config`: operator contract v2 (#837, decisions/0006), the
@@ -25,6 +26,8 @@ import { workspaceSubjectOf } from "../workspace-subject.js";
 import { authorized, refuse, scopeFor, serveOperator } from "./operator.js";
 import { isMaintainer, isMember } from "../membership.js";
 import { admitsMaintainer, mayManageConnector, privateJson, readsActivity } from "./shared.js";
+const cachedMaintainers = new WeakSet();
+const cachedMode = (context) => context.url.searchParams.get("live") === "cached";
 const attempt = (operation) => Effect.tryPromise({ try: operation, catch: (error) => error });
 const validName = (name) => recordedToolName({ name }) === name;
 const classified = (tool) => tool.classification === "read" ? "read" : "write";
@@ -65,7 +68,7 @@ function probe(context, registry, connector, scope, work, fallback) {
  */
 function bounded(context, read, fallback) {
     return withDeadlineEffect(() => read(), {
-        timeoutMs: context.opts.config.discovery.probeTimeoutMs,
+        timeoutMs: cachedMaintainers.has(context) ? 500 : context.opts.config.discovery.probeTimeoutMs,
         signal: context.request.signal,
         timeoutError: new Error("Operator config read timed out."),
     }).pipe(Effect.catchDefect((defect) => Effect.fail(defect)), Effect.catch(fallback));
@@ -141,7 +144,7 @@ const isTimestamp = (value) => /^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d\.\d{3}Z$/.test(v
  * declared agent's `lastSeenAt` from the rows this maintainer may see. Agent
  * rows are recorded under the access-token directory with the agent's name.
  */
-function scanActivity(context, authz, registry, rows, agents) {
+export function scanOperatorActivity(context, authz, registry, rows, agents) {
     const activity = context.opts.config.activity;
     if (!activity?.store.list)
         return Effect.succeed("unconfigured");
@@ -232,6 +235,12 @@ function sharedSource(context, connector, row) {
         // Only a connector asking to be authorized has no grant; any other
         // state, a credential prompt or an error included, has one. A grant
         // carries no saved-at time of its own.
+        if (cachedMode(context)) {
+            const observe = storedAuthObservation(connector);
+            return observe
+                ? bounded(context, () => attempt(() => observe(opts.registry.contextFor(connector.id, context.baseUrl, {}))).pipe(Effect.map((ok) => (ok ? { kind: "shared", source: "oauth", savedAt: null } : MISSING))), () => Effect.succeed(MISSING))
+                : Effect.succeed(MISSING);
+        }
         return Effect.succeed(row?.status === "auth_required" ? MISSING : { kind: "shared", source: "oauth", savedAt: null });
     }
     if (described?.auth?.mode === "none" && described.source.kind === "remote-mcp") {
@@ -258,6 +267,13 @@ function connectedPeople(context, connector, people) {
                 ? yield* bounded(context, () => attempt(() => vault.metadata(connector.id, principalKey)).pipe(Effect.map((metadata) => storedCredentialShape(credential, metadata?.fields ?? null).state === "valid")), () => Effect.succeed(false))
                 : false;
         }
+        else if (cachedMode(context)) {
+            const registry = opts.registry.scoped({ connectorIds: [connector.id], principalKey });
+            const observe = storedAuthObservation(connector);
+            ok = observe
+                ? yield* bounded(context, () => attempt(() => observe(registry.contextFor(connector.id, baseUrl, {}))), () => Effect.succeed(false))
+                : false;
+        }
         else {
             const registry = opts.registry.scoped({ connectorIds: [connector.id], principalKey });
             const scope = {};
@@ -354,11 +370,14 @@ function maintainerRead(context, authz) {
         for (const person of [...opts.maintainers, ...[...opts.pools.values()].flatMap(humansOf)])
             people.set(referenceKey(person), person);
         const requestActivity = operatorActivityContext(context, authz);
+        const cached = cachedMode(context);
         const [rows, label, slots] = yield* Effect.all([
-            Effect.forEach(visible, (c) => observe(context, registry, c, requestActivity), {
-                concurrency: resolveDiscoveryConcurrency(opts.config.discovery.concurrency),
-            }),
-            humanLabels(context, authz, [...people.values()]),
+            cached
+                ? Effect.succeed([])
+                : Effect.forEach(visible, (c) => observe(context, registry, c, requestActivity), {
+                    concurrency: resolveDiscoveryConcurrency(opts.config.discovery.concurrency),
+                }),
+            bounded(context, () => humanLabels(context, authz, [...people.values()]), () => Effect.succeed(() => null)),
             // Every declared agent's slot, exactly as GET /ui/access-tokens lists
             // it. Without them the agents list cannot be whole, so a failed read
             // fails the view rather than dropping agents from it.
@@ -399,7 +418,7 @@ function maintainerRead(context, authz) {
             token: tokenSlots.get(name) ?? null,
             lastSeenAt: null,
         }));
-        const activity = yield* scanActivity(context, authz, registry, rows, agents);
+        const activity = yield* scanOperatorActivity(context, authz, registry, rows, agents);
         let admissionsVisible = readsActivity(opts, authz) && activity !== "forbidden";
         // A configured read gate still applies when the history store has no list.
         if (admissionsVisible && activity === "unconfigured" && opts.config.activity?.readGate) {
@@ -572,8 +591,18 @@ function memberRead(context, authz, pools) {
 function configRead(context) {
     return Effect.gen(function* () {
         const authz = yield* authorized(context);
-        if (admitsMaintainer(context.opts, authz))
-            return yield* maintainerRead(context, authz);
+        if (admitsMaintainer(context.opts, authz)) {
+            if (!cachedMode(context))
+                return yield* maintainerRead(context, authz);
+            cachedMaintainers.add(context);
+            // The entire metadata build stays below the browser admission deadline,
+            // even for a store that ignores cancellation or an unusually large roster.
+            return yield* withDeadlineEffect(() => maintainerRead(context, authz), {
+                timeoutMs: 5000,
+                signal: context.request.signal,
+                timeoutError: new Error("Operator metadata timed out."),
+            }).pipe(Effect.catch(() => refuse("operator metadata could not be read", 503)));
+        }
         const pools = memberPools(context, authz);
         if (pools.length > 0)
             return yield* memberRead(context, authz, pools);

package/dist/routes/ui-data.js

@@ -1,3 +1,4 @@
+import { describedTools } from "../described.js";
 // The Effect core of the operator payload: `buildUiData` in src/ui.ts is its
 // Promise face, and the `/ui/connectors/<id>` route yields it directly.
 //
@@ -12,7 +13,7 @@ import { credentialTestRule, describeUndeclaredCredentialFields, storedCredentia
 import { failureRecord, failureStatus, logFailure, recordedToolName, statusFailure } from "../operator-record.js";
 import { closeScope } from "../runtime/connector-scope.js";
 import { withDeadlineEffect } from "../runtime/run.js";
-import { uiProblemFor, uiToolSafety } from "../ui.js";
+import { uiProblemFor } from "../ui.js";
 import { CONNECTA_VERSION } from "../version.js";
 const DETAIL_TIMEOUT_MS = 30_000;
 const DETAIL_TIMED_OUT = "Connection details timed out. Retry this connection.";
@@ -63,11 +64,13 @@ export function uiData(registry, baseUrl, options) {
                 return yield* attempt(async () => (await registry.getTools(c.id, baseUrl, requestScope, {
                     signal,
                     ...(options.defer ? { defer: options.defer } : {}),
-                })).map((t) => ({
+                }))
+                    .flatMap((t) => describedTools([t]))
+                    .map((t) => ({
+                    ...t,
                     name: recordedToolName(t),
                     address: `${c.id}.${recordedToolName(t)}`,
-                    ...(t.description ? { description: t.description } : {}),
-                    safety: uiToolSafety(t),
+                    classification: t.classification === "read" ? "read" : "write",
                 }))).pipe(Effect.map((tools) => ({ status, tools, catalogFailed: false })), 
                 // The registry owns the failed catalog observation; the page only
                 // needs to know there was one.
@@ -169,7 +172,21 @@ export function uiData(registry, baseUrl, options) {
                 status: status.state,
                 ...(problem ? { problem } : {}),
                 toolCount: tools.length,
-                tools,
+                tools: tools.map((tool) => ({
+                    name: tool.name,
+                    address: tool.address,
+                    ...(tool.description ? { description: tool.description } : {}),
+                    safety: tool.classification === "read" ? "runs_in_programs" : "needs_approval",
+                })),
+                overlay: {
+                    id: c.id,
+                    status: status.state,
+                    tools,
+                    ...(problem ? { problem } : {}),
+                    ...(status.registrationPath ? { auth: { registrationPath: status.registrationPath } } : {}),
+                    catalogAgeMs: registry.catalogAgeMs(c.id),
+                    lastCall: null,
+                },
                 // Counts only, and only when a refresh in this runtime produced them.
                 // `Registry.withCatalogObservations` rebuilt the report through
                 ...(status.catalogAccess ? { catalogAccess: status.catalogAccess } : {}),
@@ -193,6 +210,14 @@ export function uiData(registry, baseUrl, options) {
                 oauth: Boolean(c.startAuth && c.disconnectAuth),
                 toolCount: 0,
                 tools: [],
+                overlay: {
+                    id: c.id,
+                    status: "error",
+                    problem: "connector_unavailable",
+                    tools: [],
+                    catalogAgeMs: registry.catalogAgeMs(c.id),
+                    lastCall: null,
+                },
             };
         });
         const row = (c) => Effect.suspend(() => {

package/dist/routes/ui.js

@@ -1,3 +1,4 @@
+import { withDeadlineEffect } from "../runtime/run.js";
 import { operatorAsset } from "../operator-ui/assets.js";
 import { operatorActivityContext } from "./activity-context.js";
 import { isSafeHttpsUrl } from "../branding.js";
@@ -10,7 +11,7 @@ import { CONNECTA_FAVICON_ICO } from "../favicon.js";
 import { CONNECTA_FAVICON_SVG, operatorPageForPath, renderUiHtml } from "../ui.js";
 import { authorized, refuse, scopeFor, serveOperator, visibleRegistry, } from "./operator.js";
 import { managesAgentTokens, mayManageConnector, privateJson, readsActivity } from "./shared.js";
-import { routeUiConfig } from "./ui-config.js";
+import { routeUiConfig, scanOperatorActivity } from "./ui-config.js";
 import { uiData } from "./ui-data.js";
 /**
  * Headers that make an operator-supplied favicon body inert on this origin.
@@ -160,7 +161,14 @@ function connectorDetail(context, id) {
             timeoutMs: opts.config.discovery.probeTimeoutMs,
             signal: request.signal,
         });
-        return privateJson({ ...data.connectors[0], permissions: permissions(connector) });
+        const detail = data.connectors[0];
+        if (detail.overlay)
+            yield* withDeadlineEffect(() => scanOperatorActivity(context, authz, registry, [detail.overlay], []), {
+                timeoutMs: 500,
+                signal: request.signal,
+                timeoutError: new Error("Activity observation timed out."),
+            }).pipe(Effect.catch(() => Effect.succeed("unavailable")));
+        return privateJson({ ...detail, permissions: permissions(connector) });
     });
 }
 /** The summary: every visible connector as "loading", with no probe at all. */

package/dist/runtime/settlement.js

@@ -0,0 +1,59 @@
+// One outcome that a fiber in one request waits on while another request may
+// deliver it: a queued admission permit, a shared token refresh.
+//
+// Effect resumes a waiting fiber synchronously, inside whatever completes the
+// Deferred it awaits, and runs it in the async context it suspended in: the
+// fiber captured a `node:async_hooks` AsyncResource when it suspended and
+// resumes through `runInAsyncScope`. On Workers that context belongs to the
+// waiter's request. workerd refuses to enter it from another request ("Cannot
+// call this AsyncLocalStorage bound function outside of the request in which
+// it was created.") when the Worker's compatibility date is 2025-06-16 or
+// later, in releases since September 2026. The refusal throws out of the call
+// that completed the Deferred, failing the request that released a slot, and
+// the waiter never resumes (#1106). Awaiting a Promise around that wait is no
+// help: the fiber waiting on the Deferred inside the Promise is resumed in the
+// completing request just the same.
+//
+// So nothing here resumes a fiber. `settle` records the outcome and resolves,
+// for each waiter, a Promise that the waiter's own request created. workerd
+// runs a Promise's reactions in the request that created it, whichever
+// request resolves it; Node runs them one microtask later in the waiter's
+// async context. The waiter resumes there. The record itself is synchronous,
+// so a queue's arbitration reads the outcome at once, and a waiter that leaves
+// before it wakes can still give back what it was handed.
+import { Effect } from "effect";
+export class Settlement {
+    exit;
+    wakers = new Set();
+    /** The recorded outcome; undefined until `settle` runs. */
+    get outcome() {
+        return this.exit;
+    }
+    /** Record the first outcome and wake each waiter in its own request. */
+    settle(exit) {
+        if (this.exit)
+            return false;
+        this.exit = exit;
+        const wakers = [...this.wakers];
+        this.wakers.clear();
+        for (const wake of wakers)
+            wake();
+        return true;
+    }
+    /** The outcome, waited for by a fiber that resumes in its own request. */
+    wait() {
+        return Effect.suspend(() => this.exit ??
+            Effect.callback((resume) => {
+                let wake;
+                // Created here, by the waiting fiber, so it belongs to the waiting
+                // request whichever request resolves it.
+                void new Promise((resolve) => {
+                    wake = resolve;
+                }).then(() => resume(this.exit));
+                this.wakers.add(wake);
+                return Effect.sync(() => {
+                    this.wakers.delete(wake);
+                });
+            }));
+    }
+}

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const CONNECTA_VERSION = "0.36.2";
+export declare const CONNECTA_VERSION = "0.37.0";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Generated from package.json by scripts/generate-version.mjs.
 // Workers-safe: no runtime filesystem read or deployment override.
-export const CONNECTA_VERSION = "0.36.2";
+export const CONNECTA_VERSION = "0.37.0";

package/dist/worker.js

@@ -45,10 +45,13 @@ function routeGuestImports(source) {
 }
 /** Loader-only upstream sandbox whose lease disposes handles at run end. */
 export function workerExecutor(options) {
+    // One pool per executor, so per isolate. A queued run may wait out one
+    // default guest deadline: programs spend it awaiting host calls, and a
+    // five-second wait refused nearly every run queued behind one (#1106).
     const admission = new AdmissionController(options.admission ?? {
         concurrency: 2,
         maxQueueSize: 8,
-        queueTimeoutMs: 5_000,
+        queueTimeoutMs: 60_000,
         retryAfterMs: 1_000,
     });
     const active = new Set();

package/documentation/architecture.md

@@ -1753,6 +1753,20 @@ Use the existing stateful fixture vendors and published-edge deployment adapters
   Native transport parity, OAuth and write-provenance suites retain their
   workerd coverage. The shared throwaway RSA key in `test/fixtures/rsa.ts` is
   used by write-provenance and unknown-write-advice fixtures.
+- `test/executor-requests.test.ts` runs overlapping `execute_code` programs
+  as separate workerd requests through the real Worker Loader executor, with
+  real TCP host calls that read their own request's signal. Queued programs
+  and the programs whose release admitted them return their own answers; queue
+  refusals keep the retryable shape. Its fixture applies workerd's request
+  binding of async-context frames, which the pinned runtime predates, through a
+  signal each request owns, so it refuses another request's entry with or
+  without an async-context token, as workerd does; pointing
+  `MINIFLARE_WORKERD_PATH` at a newer workerd runs the native check.
+  `test/executor-native.test.ts` shows that a slot granted just before
+  `close()` never starts a program on the native Worker Loader.
+  `test/request-context.node.test.ts` pins the same wake order and async context
+  on Node for executor and call admission and QuickJS host calls, and gives back
+  grants that shutdown overtook.
 - The request, catalog, auxiliary-call and renewal lifetime
   suites, plus `test/auth-admission-binding.test.ts`, exercise cancellation,
   held native work and garbage collection. These test actual request ownership;
@@ -1786,7 +1800,16 @@ in-memory token caching and exact-token invalidation, with an absent subject
 for service accounts acting as themselves. Workspace providers keep supplying
 subjects and retain their delegated error guidance. `src/request-token.ts`
 owns the callable resolver contract and optional HTTP-401 invalidation hook;
-`remoteMcp()` invokes it without replaying the failed operation.
+`remoteMcp()` invokes it without replaying the failed operation. With
+`auth.principal`, `src/request-principal.ts` reads the admitted caller only
+through `callerOf` (see `src/connector-caller.ts`), refuses callers the policy
+does not accept before resolving, and gives `remoteMcp()` a principal key that
+joins the credential digest, so no client crosses principals. A custom `fetch`
+replaces global fetch and the owned write sender in that connector's transport,
+behind the same redirect wrapper and a same-origin guard.
+`test/remote-mcp-principal-forwarding.test.ts` checks admission, forging,
+client replacement, transport confinement and secrecy on Node, and a real
+service binding on workerd.
 `test/google-service-account-token.test.ts` exercises signing/cache behavior on
 Node and workerd; `test/google-service-account-remote.node.test.ts` checks
 real-socket token/MCP requests, invalidation and one physical attempt per write.
@@ -2026,11 +2049,13 @@ existing execute pipeline, using its request identity and call capabilities.
 The executor seam creates no second request or call owner.
 
 Both built-ins acquire their permits through native admission and return
-execute-once leases with synchronous, idempotent release. A queued standalone
-execution crosses `awaitExecutorLease`'s Promise handoff before host setup, so
-workerd resumes in the waiting request. `execute_code` retains its public
-`acquire()` handoff for that same reason. A cancelled queued handoff withdraws
-its waiter, and a late custom acquisition releases its abandoned lease.
+execute-once leases with synchronous, idempotent release. Admission wakes a
+queued waiter through a Settlement, so it resumes in its own request
+([across requests](#across-requests)). A queued standalone execution also
+crosses `awaitExecutorLease`'s Promise handoff before host setup, and
+`execute_code` retains its public `acquire()` handoff. A cancelled queued
+handoff withdraws its waiter, and a late custom acquisition releases its
+abandoned lease.
 
 The Worker SDK prepares source and dispatchers against an inert loader. The
 native host then acquires the actual Loader handle and RPC entrypoint with
@@ -2046,7 +2071,9 @@ Both built-ins normalize provider leaf returns with `Promise.resolve`, retaining
 direct JavaScript callers' synchronous value tolerance and original host
 rejections. The published provider-function signature remains Promise-shaped.
 
-QuickJS owns host-call fibers in each active run's Scope. Completion,
+QuickJS owns host-call fibers in each active run's Scope, started in the
+async context the run captured: a warm child's IPC events arrive in the
+context of the request that spawned it. Completion,
 interruption, cancellation, recycling and shutdown revoke provider lookup and
 interrupt those fibers; late SDK results and stale IPC cannot reply to another
 run. Releasing a lease during readiness or crash backoff also cancels the old
@@ -2231,24 +2258,40 @@ request's abort handler also releases them idempotently if workerd discards the
 pending continuation on disconnect. Membership cache
 hits precede these bounds; see [organization admission](./auth.md#one-clerk-instance-one-organization-per-deployment).
 
-Asynchronous work shared across requests meets only through a Deferred that the owning
-request completes, never through a fiber that outlives its request. Two
-workerd rules follow, and both have bitten.
-
-**Waiting on a shared Deferred is its own edge.** Deferred resumes a waiting
-fiber synchronously, inside the call that completed it, which on Workers means
-inside the completing request's I/O context. A waiter that goes on to touch its
-own body, transport, or storage there fails with "Cannot perform I/O on behalf
-of a different request", or hangs until its deadline. So the wait runs through
-`runEdge`, and the waiter does its own I/O after awaiting that promise, which
-workerd resumes in the waiter's request as it does any promise resolved from
-another. The same holds one level out for every queue: a queued call, a queued
-`execute_code`, and a queued `/mcp` request are each handed their permit from
-inside the request that released one, so each awaits the controller's
-Promise-shaped `acquire` rather than yielding its Effect program, and does its
-own work only once that promise resolves. Effect's `Semaphore` is not used
-across requests for the same reason, and because a same-tick newcomer can take
-a released permit ahead of a waiter that queued earlier.
+Asynchronous work shared across requests meets only through a `Settlement`
+(`src/runtime/settlement.ts`) that one request settles, never through a fiber
+that outlives its request or a Deferred another request awaits. Two workerd
+rules follow, and both have bitten.
+
+**No request resumes another request's fiber.** Deferred resumes a waiting
+fiber synchronously, inside the call that completed it, and Effect re-enters
+the async context the fiber suspended in through the `AsyncResource` it
+captured. On Workers that context belongs to the waiter's request. Since
+workerd's September 2026 releases, a Worker with compatibility date 2025-06-16
+or later (or `bind_asynclocalstorage_snapshot_to_request`) refuses that entry
+from any other request: "Cannot call this AsyncLocalStorage bound function
+outside of the request in which it was created." The throw escapes the
+completing call, so the request that released an admission slot failed with
+`executor_failed`, and the stranded waiter later timed out (#1106). Older
+runtimes ran the waiter in the completing request instead, where its own I/O
+failed with "Cannot perform I/O on behalf of a different request". Awaiting a
+Promise around the wait fixes neither: the fiber waiting inside that Promise is
+the one resumed. A Settlement records its outcome synchronously, for queue
+arbitration and late-grant cleanup, and wakes each waiter by resolving a
+Promise the waiter's own request created. workerd runs that Promise's reactions
+in the request that created it, and Node runs them a microtask later in the
+waiter's async context. That wake is a turn late, so whatever a waiter acts on
+it rechecks there: an admission queue gives back a grant its controller closed
+in between, while a grant that beat the waiter's own abort stays the waiter's to
+release, and a refresh waiter rechecks its own signal before using a flight's
+answer. Executor admission, `/mcp` request
+admission, connector call admission and OAuth refresh flights all queue through
+Settlements; Effect's `Semaphore` is not used across requests for the same
+reason, and because a same-tick newcomer can take a released permit ahead of a
+waiter that queued earlier. Events from shared native objects follow the same
+rule: a warm QuickJS child's IPC messages arrive in the async context of the
+request that spawned it, so host calls dispatch inside the running program's
+captured context.
 
 **Never read another request's signal.** On workerd, reading `aborted` or
 `reason`, or calling `abort()`, on a signal that belongs to another request