knitting 0.1.56 → 0.1.61

package/src/memory/lock.js

@@ -1,5 +1,10 @@
 import RingQueue from "../ipc/tools/ring-queue.js";
-import { decodePayload, encodePayload } from "./payloadCodec.js";
+let registeredEncodePayload;
+let registeredDecodePayload;
+export const registerLockPayloadCodec = (encode, decode) => {
+    registeredEncodePayload = encode;
+    registeredDecodePayload = decode;
+};
 import { createSharedArrayBuffer, createWasmSharedArrayBuffer, } from "../common/runtime.js";
 import { toSharedBufferRegion, } from "../common/shared-buffer-region.js";
 import { probeLockBufferTextCompat, } from "../common/shared-buffer-text.js";
@@ -7,69 +12,76 @@ import { resolvePayloadBufferOptions, } from "./payload-config.js";
 /**
  * TODO: Compose all the instance where the array is passed as argument
  */
-export var PayloadSignal;
-(function (PayloadSignal) {
-    PayloadSignal[PayloadSignal["UNREACHABLE"] = 0] = "UNREACHABLE";
-    PayloadSignal[PayloadSignal["BigInt"] = 2] = "BigInt";
-    PayloadSignal[PayloadSignal["True"] = 3] = "True";
-    PayloadSignal[PayloadSignal["False"] = 4] = "False";
-    PayloadSignal[PayloadSignal["Undefined"] = 5] = "Undefined";
-    PayloadSignal[PayloadSignal["NaN"] = 6] = "NaN";
-    PayloadSignal[PayloadSignal["Float64"] = 9] = "Float64";
-    PayloadSignal[PayloadSignal["Null"] = 10] = "Null";
-})(PayloadSignal || (PayloadSignal = {}));
-export var PayloadBuffer;
-(function (PayloadBuffer) {
-    PayloadBuffer[PayloadBuffer["BORDER_SIGNAL_BUFFER"] = 11] = "BORDER_SIGNAL_BUFFER";
-    PayloadBuffer[PayloadBuffer["String"] = 11] = "String";
-    PayloadBuffer[PayloadBuffer["Json"] = 12] = "Json";
-    PayloadBuffer[PayloadBuffer["StaticString"] = 15] = "StaticString";
-    PayloadBuffer[PayloadBuffer["StaticJson"] = 16] = "StaticJson";
-    PayloadBuffer[PayloadBuffer["Binary"] = 17] = "Binary";
-    PayloadBuffer[PayloadBuffer["StaticBinary"] = 18] = "StaticBinary";
-    PayloadBuffer[PayloadBuffer["Int32Array"] = 19] = "Int32Array";
-    PayloadBuffer[PayloadBuffer["Float64Array"] = 20] = "Float64Array";
-    PayloadBuffer[PayloadBuffer["BigInt64Array"] = 21] = "BigInt64Array";
-    PayloadBuffer[PayloadBuffer["BigUint64Array"] = 22] = "BigUint64Array";
-    PayloadBuffer[PayloadBuffer["DataView"] = 23] = "DataView";
-    PayloadBuffer[PayloadBuffer["Error"] = 24] = "Error";
-    PayloadBuffer[PayloadBuffer["Date"] = 25] = "Date";
-    PayloadBuffer[PayloadBuffer["Symbol"] = 26] = "Symbol";
-    PayloadBuffer[PayloadBuffer["StaticSymbol"] = 27] = "StaticSymbol";
-    PayloadBuffer[PayloadBuffer["BigInt"] = 28] = "BigInt";
-    PayloadBuffer[PayloadBuffer["StaticBigInt"] = 29] = "StaticBigInt";
-    PayloadBuffer[PayloadBuffer["StaticInt32Array"] = 31] = "StaticInt32Array";
-    PayloadBuffer[PayloadBuffer["StaticFloat64Array"] = 32] = "StaticFloat64Array";
-    PayloadBuffer[PayloadBuffer["StaticBigInt64Array"] = 33] = "StaticBigInt64Array";
-    PayloadBuffer[PayloadBuffer["StaticBigUint64Array"] = 34] = "StaticBigUint64Array";
-    PayloadBuffer[PayloadBuffer["StaticDataView"] = 35] = "StaticDataView";
-    PayloadBuffer[PayloadBuffer["ArrayBuffer"] = 36] = "ArrayBuffer";
-    PayloadBuffer[PayloadBuffer["StaticArrayBuffer"] = 37] = "StaticArrayBuffer";
-    PayloadBuffer[PayloadBuffer["Buffer"] = 38] = "Buffer";
-    PayloadBuffer[PayloadBuffer["StaticBuffer"] = 39] = "StaticBuffer";
-    PayloadBuffer[PayloadBuffer["EnvelopeStaticHeader"] = 40] = "EnvelopeStaticHeader";
-    PayloadBuffer[PayloadBuffer["EnvelopeDynamicHeader"] = 41] = "EnvelopeDynamicHeader";
-    PayloadBuffer[PayloadBuffer["EnvelopeStaticHeaderString"] = 42] = "EnvelopeStaticHeaderString";
-    PayloadBuffer[PayloadBuffer["EnvelopeDynamicHeaderString"] = 43] = "EnvelopeDynamicHeaderString";
-    PayloadBuffer[PayloadBuffer["ExternalPayload"] = 44] = "ExternalPayload";
-    PayloadBuffer[PayloadBuffer["StaticExternalPayload"] = 45] = "StaticExternalPayload";
-    PayloadBuffer[PayloadBuffer["ProcessSharedBuffer"] = 46] = "ProcessSharedBuffer";
-    PayloadBuffer[PayloadBuffer["BufferReference"] = 47] = "BufferReference";
-    PayloadBuffer[PayloadBuffer["SharedArrayBuffer"] = 48] = "SharedArrayBuffer";
-    PayloadBuffer[PayloadBuffer["EnvelopeStaticHeaderExternal"] = 49] = "EnvelopeStaticHeaderExternal";
-    PayloadBuffer[PayloadBuffer["EnvelopeDynamicHeaderExternal"] = 50] = "EnvelopeDynamicHeaderExternal";
-    PayloadBuffer[PayloadBuffer["EnvelopeStaticHeaderStringExternal"] = 51] = "EnvelopeStaticHeaderStringExternal";
-    PayloadBuffer[PayloadBuffer["EnvelopeDynamicHeaderStringExternal"] = 52] = "EnvelopeDynamicHeaderStringExternal";
-    PayloadBuffer[PayloadBuffer["NumericArray"] = 53] = "NumericArray";
-    PayloadBuffer[PayloadBuffer["StaticNumericArray"] = 54] = "StaticNumericArray";
-})(PayloadBuffer || (PayloadBuffer = {}));
-export var LockBound;
-(function (LockBound) {
-    LockBound[LockBound["paddingLock"] = 0] = "paddingLock";
-    LockBound[LockBound["padding"] = 0] = "padding";
-    LockBound[LockBound["slots"] = 32] = "slots";
-    LockBound[LockBound["header"] = 0] = "header";
-})(LockBound || (LockBound = {}));
+// const objects replace `enum`s throughout this module: Andromeda's Nova engine
+// panics on `enum`. Value access, duplicate-value members, and type preserved;
+// identical emit on Node/Deno/Bun.
+export const PayloadSignal = {
+    UNREACHABLE: 0,
+    BigInt: 2,
+    True: 3,
+    False: 4,
+    Undefined: 5,
+    NaN: 6,
+    Float64: 9,
+    Null: 10,
+};
+export const PayloadBuffer = {
+    BORDER_SIGNAL_BUFFER: 11,
+    String: 11,
+    Json: 12,
+    StaticString: 15,
+    StaticJson: 16,
+    Binary: 17,
+    StaticBinary: 18,
+    Int32Array: 19,
+    Float64Array: 20,
+    BigInt64Array: 21,
+    BigUint64Array: 22,
+    DataView: 23,
+    Error: 24,
+    Date: 25,
+    Symbol: 26,
+    StaticSymbol: 27,
+    BigInt: 28,
+    StaticBigInt: 29,
+    StaticInt32Array: 31,
+    StaticFloat64Array: 32,
+    StaticBigInt64Array: 33,
+    StaticBigUint64Array: 34,
+    StaticDataView: 35,
+    ArrayBuffer: 36,
+    StaticArrayBuffer: 37,
+    Buffer: 38,
+    StaticBuffer: 39,
+    EnvelopeStaticHeader: 40,
+    EnvelopeDynamicHeader: 41,
+    EnvelopeStaticHeaderString: 42,
+    EnvelopeDynamicHeaderString: 43,
+    ExternalPayload: 44,
+    StaticExternalPayload: 45,
+    ProcessSharedBuffer: 46,
+    BufferReference: 47,
+    SharedArrayBuffer: 48,
+    EnvelopeStaticHeaderExternal: 49,
+    EnvelopeDynamicHeaderExternal: 50,
+    EnvelopeStaticHeaderStringExternal: 51,
+    EnvelopeDynamicHeaderStringExternal: 52,
+    NumericArray: 53,
+    StaticNumericArray: 54,
+};
+// Value -> name lookup (enum reverse-map), for payload-limit error labels.
+// Later keys win on duplicate values (11 -> "String"), as TS enums do.
+const PayloadBufferName = {};
+for (const key of Object.keys(PayloadBuffer)) {
+    PayloadBufferName[PayloadBuffer[key]] = key;
+}
+export const payloadBufferName = (value) => PayloadBufferName[value] ?? String(value);
+export const LockBound = {
+    paddingLock: 0,
+    padding: 0,
+    slots: 32,
+    header: 0,
+};
 export const LOCK_CACHE_LINE_BYTES = 64;
 export const LOCK_SECTOR_BYTES = 256;
 export const PayloadTransportFinalizer = Symbol.for("knitting.payloadCodec.transportFinalizer");
@@ -123,34 +135,33 @@ export const runTaskFinalizers = (task) => {
         }
     }
 };
-export var TaskIndex;
-(function (TaskIndex) {
+export const TaskIndex = {
     /**
      * Worker -> host response flags word.
      */
-    TaskIndex[TaskIndex["FlagsToHost"] = 0] = "FlagsToHost";
+    FlagsToHost: 0,
     /**
      * Host -> worker request function id (low 16 bits).
      * High 16 bits are reserved for caller metadata on request path.
      * NOTE: shares the same storage word as `FlagsToHost`.
      */
-    TaskIndex[TaskIndex["FunctionID"] = 0] = "FunctionID";
-    TaskIndex[TaskIndex["ID"] = 1] = "ID";
-    TaskIndex[TaskIndex["Type"] = 2] = "Type";
-    TaskIndex[TaskIndex["Start"] = 3] = "Start";
-    TaskIndex[TaskIndex["End"] = 4] = "End";
-    TaskIndex[TaskIndex["PayloadLen"] = 5] = "PayloadLen";
+    FunctionID: 0,
+    ID: 1,
+    Type: 2,
+    Start: 3,
+    End: 4,
+    PayloadLen: 5,
     /**
      * Low 5 bits: region slot index (0..31).
      * High 27 bits: reserved for caller metadata (e.g. enqueue timing).
      */
-    TaskIndex[TaskIndex["slotBuffer"] = 6] = "slotBuffer";
-    TaskIndex[TaskIndex["Size"] = 8] = "Size";
+    slotBuffer: 6,
+    Size: 8,
     /**
      * Total slot length in Uint32 words, including the task header.
      */
-    TaskIndex[TaskIndex["TotalBuff"] = 144] = "TotalBuff";
-})(TaskIndex || (TaskIndex = {}));
+    TotalBuff: 144,
+};
 export const TASK_SLOT_INDEX_BITS = 5;
 export const TASK_SLOT_INDEX_MASK = (1 << TASK_SLOT_INDEX_BITS) - 1;
 export const TASK_SLOT_META_BITS = 32 - TASK_SLOT_INDEX_BITS;
@@ -186,10 +197,9 @@ export const setTaskSlotMeta = (task, value) => {
     task[TaskIndex.slotBuffer] =
         ((task[TaskIndex.slotBuffer] & TASK_SLOT_INDEX_MASK) | encodedMeta) >>> 0;
 };
-export var TaskFlag;
-(function (TaskFlag) {
-    TaskFlag[TaskFlag["Reject"] = 1] = "Reject";
-})(TaskFlag || (TaskFlag = {}));
+export const TaskFlag = {
+    Reject: 1,
+};
 // Main queue lock layout in bytes.
 // The queue protocol uses two Int32 signal words, each on its own cache line:
 // - hostBits at byte 0
@@ -216,6 +226,27 @@ export const HEADER_TASK_LINE_U32 = LOCK_CACHE_LINE_BYTES /
 export const HEADER_STATIC_PAYLOAD_U32 = TaskIndex.TotalBuff -
     HEADER_TASK_LINE_U32;
 export const HEADER_TASK_OFFSET_IN_SLOT_U32 = HEADER_STATIC_PAYLOAD_U32;
+// Work-stealing control words live in the unused tail of each slot's header
+// cache line. Task words occupy 0..7 (`TASK_LOCAL_FLAGS_INDEX = 7`) of the
+// 16-word line, leaving words 8..15 free. Consumer `c` owns slot `c`'s pair, and
+// because the slot stride is exactly 9 cache lines those pairs land on distinct
+// lines. `ACK[c]` and `WANT[c]` share one line on purpose: same single writer,
+// and a peer reading one pulls the other for free.
+export const STEAL_ACK_SLOT_OFFSET_U32 = HEADER_TASK_OFFSET_IN_SLOT_U32 +
+    TaskIndex.Size;
+export const STEAL_WANT_SLOT_OFFSET_U32 = STEAL_ACK_SLOT_OFFSET_U32 + 1;
+/**
+ * The payload allocator needs its own participant-owned ACK per consumer, since
+ * several workers can free payload slots from one shared allocator. No intent
+ * word: freeing needs no arbitration, a consumer only frees what it drained.
+ */
+export const STEAL_PAYLOAD_ACK_SLOT_OFFSET_U32 = STEAL_ACK_SLOT_OFFSET_U32 + 2;
+/**
+ * Host-owned liveness mask for stealing consumers. A dead claimant may leave
+ * its WANT word set forever; survivors ignore WANT from consumers whose bit is
+ * clear here. This preserves single-writer ownership of every WANT word.
+ */
+export const STEAL_LIVE_SLOT_OFFSET_U32 = STEAL_PAYLOAD_ACK_SLOT_OFFSET_U32 + 1;
 export const HEADER_U32_LENGTH = LockBound.header +
     (HEADER_SLOT_STRIDE_U32 * LockBound.slots);
 export const HEADER_BYTE_LENGTH = HEADER_U32_LENGTH *
@@ -240,6 +271,8 @@ export const makeTask = () => {
 const fillTaskFrom = (task, array, at) => {
     task[0] = array[at];
     task[1] = array[at + 1];
+    // Raw numeric tag word; const-object payload "enums" are strict literal unions
+    // (numeric `enum` accepted any number), so cast back on restore.
     task[2] = array[at + 2];
     task[3] = array[at + 3];
     task[4] = array[at + 4];
@@ -264,7 +297,7 @@ const settleTask = (task) => {
         task[TaskIndex["FlagsToHost"]] = 0;
     }
 };
-export const lock2 = ({ headers, headerSlotStrideU32, LockBoundSector, payload, payloadConfig, payloadSector, textCompat, resultList, toSentList, recycleList, }) => {
+export const lock2 = ({ headers, headerSlotStrideU32, LockBoundSector, payload, payloadConfig, payloadSector, textCompat, resultList, toSentList, recycleList, processBoundary, consumers, consumerId, regionLanes, }) => {
     // Layout within `lockSectorRegion`:
     // - hostBits starts at byte 0
     // - workerBits starts at byte 64
@@ -296,8 +329,62 @@ export const lock2 = ({ headers, headerSlotStrideU32, LockBoundSector, payload,
         headers: headersRegion,
         payload: payloadSAB,
     });
+    // ---- work stealing (multi-consumer) state ----
+    // With N consumers the pending set is A ^ ACK[0] ^ ... ^ ACK[N-1]; every word
+    // still has exactly one writer, so no shared writable word is introduced.
+    const stealConsumers = Math.max(1, (consumers ?? 1) | 0);
+    const stealEnabled = stealConsumers > 1;
+    // A lock2 built without `consumerId` is the producer endpoint: it encodes but
+    // never claims. It still frees payload slots, so it needs an acknowledgement
+    // word of its own rather than sharing consumer 0's.
+    const stealIsProducer = consumerId === undefined;
+    const stealId = (consumerId ?? 0) | 0;
+    const stealRegionLanes = (regionLanes ?? 8) | 0;
+    const stealRegions = (LockBound.slots / stealRegionLanes) | 0;
+    if (stealEnabled) {
+        if (stealRegionLanes < 1 || (stealRegionLanes & (stealRegionLanes - 1)) !== 0) {
+            throw new RangeError("regionLanes must be a power of two");
+        }
+        if (stealRegions < stealConsumers) {
+            throw new RangeError(`regionLanes=${stealRegionLanes} yields ${stealRegions} regions, ` +
+                `too few for ${stealConsumers} consumers`);
+        }
+        if (stealId < 0 || stealId >= stealConsumers) {
+            throw new RangeError(`consumerId ${stealId} out of range`);
+        }
+    }
+    // Int32 alias over the headers SAB so the control words get signed bit math
+    // consistent with the rest of the protocol.
+    const stealView = new Int32Array(headersRegion.sab, headersRegion.byteOffset, headersRegion.byteLength >>> 2);
+    const stealAckIndex = new Int32Array(stealConsumers);
+    const stealWantIndex = new Int32Array(stealConsumers);
+    for (let c = 0; c < stealConsumers; c++) {
+        const slotBase = (c * headersSlotStride) + LockBound.header;
+        stealAckIndex[c] = slotBase + STEAL_ACK_SLOT_OFFSET_U32;
+        stealWantIndex[c] = slotBase + STEAL_WANT_SLOT_OFFSET_U32;
+    }
+    const stealLiveIndex = LockBound.header + STEAL_LIVE_SLOT_OFFSET_U32;
+    const stealAllLiveMask = stealConsumers === 32
+        ? -1
+        : ((1 << stealConsumers) - 1) | 0;
+    if (stealEnabled && stealIsProducer) {
+        Atomics.store(stealView, stealLiveIndex, stealAllLiveMask);
+    }
+    const stealIsLive = (mask, consumer) => (mask & (1 << consumer)) !== 0;
+    const stealAckXorAll = () => {
+        let x = 0 | 0;
+        for (let c = 0; c < stealConsumers; c++) {
+            x = (x ^ a_load(stealView, stealAckIndex[c])) | 0;
+        }
+        return x;
+    };
     let promiseHandler;
-    const encodeTask = encodePayload({
+    if (registeredEncodePayload === undefined ||
+        registeredDecodePayload === undefined) {
+        throw new Error("Payload codec not registered before lock2(). Ensure the module that " +
+            'builds locks imports "./payloadCodec.ts" (it self-registers on load).');
+    }
+    const encodeTask = registeredEncodePayload({
         payload: {
             sab: payloadSAB,
             config: resolvedPayloadConfig,
@@ -306,6 +393,7 @@ export const lock2 = ({ headers, headerSlotStrideU32, LockBoundSector, payload,
         headerSlotStrideU32: headersSlotStride,
         lockSector: payloadLockRegion,
         textCompat: resolvedTextCompat,
+        processBoundary,
         onPromise: (task, isRejected, value) => {
             if ((task[TASK_LOCAL_FLAGS_INDEX] & TASK_LOCAL_PROMISE_TRACKED_FLAG) !==
                 0 &&
@@ -318,7 +406,7 @@ export const lock2 = ({ headers, headerSlotStrideU32, LockBoundSector, payload,
             promiseHandler(task, isRejected, value);
         },
     });
-    const decodeTask = decodePayload({
+    const decodeTask = registeredDecodePayload({
         payload: {
             sab: payloadSAB,
             config: resolvedPayloadConfig,
@@ -327,6 +415,7 @@ export const lock2 = ({ headers, headerSlotStrideU32, LockBoundSector, payload,
         headerSlotStrideU32: headersSlotStride,
         lockSector: payloadLockRegion,
         textCompat: resolvedTextCompat,
+        processBoundary,
     });
     let LastLocal = 0 | 0;
     let LastWorker = 0 | 0;
@@ -343,8 +432,11 @@ export const lock2 = ({ headers, headerSlotStrideU32, LockBoundSector, payload,
     // false-busy-only sender-side staleness property, this may hide newly freed
     // lanes but cannot make a genuinely pending lane appear free. Refresh only
     // when the cached free set is exhausted.
-    let workerShadow = a_load(workerBits, 0) | 0;
-    const refreshWorkerShadow = () => workerShadow = a_load(workerBits, 0) | 0;
+    let workerShadow = 0 | 0;
+    const refreshWorkerShadow = stealEnabled
+        ? () => workerShadow = stealAckXorAll()
+        : () => workerShadow = a_load(workerBits, 0) | 0;
+    refreshWorkerShadow();
     const ensureSenderStateHasFree = (state) => (~state) !== 0 ? state : (LastLocal ^ refreshWorkerShadow()) | 0;
     // RingQueue method aliases (hot path)
     const toBeSentPush = (task) => toBeSent.push(task);
@@ -542,6 +634,122 @@ export const lock2 = ({ headers, headerSlotStrideU32, LockBoundSector, payload,
         lastTake = last;
         return true;
     };
+    /**
+     * WORKER SIDE: decode, region-Dekker stealing variant.
+     *
+     * Claims one whole region of `stealRegionLanes` lanes per handshake, so the
+     * StoreLoad barrier is amortised over the region rather than paid per task.
+     * Priority is fixed by endpoint id: a junior withdraws for a senior, so at
+     * most one consumer ever acknowledges a published generation.
+     *
+     * The C reference needs an explicit mfence between the intent store and the
+     * peer loads. `Atomics.store` is sequentially consistent in JS, so that
+     * barrier is implicit here and holds on x86 and ARM alike.
+     */
+    const stealLaneMask = (region) => stealRegionLanes === 32
+        ? -1
+        : ((((1 << stealRegionLanes) - 1) << (region * stealRegionLanes)) | 0);
+    const stealPeerAcks = () => {
+        let x = 0 | 0;
+        for (let c = 0; c < stealConsumers; c++) {
+            if (c !== stealId)
+                x = (x ^ a_load(stealView, stealAckIndex[c])) | 0;
+        }
+        return x;
+    };
+    const stealJuniorWants = (intent) => {
+        const live = a_load(stealView, stealLiveIndex) | 0;
+        for (let c = stealId + 1; c < stealConsumers; c++) {
+            if (!stealIsLive(live, c))
+                continue;
+            if ((a_load(stealView, stealWantIndex[c]) & intent) !== 0)
+                return true;
+        }
+        return false;
+    };
+    let stealCursor = ((stealRegions * stealId) / stealConsumers) | 0;
+    const decodeSteal = () => {
+        const pending = (a_load(hostBits, 0) ^ LastWorker ^ stealPeerAcks()) | 0;
+        if (pending === 0)
+            return false;
+        let pendingRegions = 0 | 0;
+        if (stealRegions === 1)
+            pendingRegions = 1;
+        else {
+            for (let r = 0; r < stealRegions; r++) {
+                if ((pending & stealLaneMask(r)) !== 0)
+                    pendingRegions |= 1 << r;
+            }
+        }
+        const liveBeforeClaim = a_load(stealView, stealLiveIndex) | 0;
+        let peerIntent = 0 | 0;
+        let seniorIntent = 0 | 0;
+        for (let c = 0; c < stealConsumers; c++) {
+            if (c === stealId || !stealIsLive(liveBeforeClaim, c))
+                continue;
+            const value = a_load(stealView, stealWantIndex[c]) | 0;
+            peerIntent |= value;
+            if (c < stealId)
+                seniorIntent |= value;
+        }
+        const notSenior = pendingRegions & ~seniorIntent;
+        if (notSenior === 0)
+            return false;
+        const clean = pendingRegions & ~peerIntent;
+        const candidates = clean !== 0 ? clean : notSenior;
+        let region = -1;
+        for (let step = 0; step < stealRegions; step++) {
+            const candidate = (stealCursor + step) % stealRegions;
+            if ((candidates & (1 << candidate)) !== 0) {
+                region = candidate;
+                break;
+            }
+        }
+        if (region < 0)
+            return false;
+        const intent = (1 << region) | 0;
+        a_store(stealView, stealWantIndex[stealId], intent);
+        // Dekker StoreLoad: implicit, `Atomics.store` above is seq-cst.
+        let seniorConflict = false;
+        let juniorConflict = false;
+        for (let c = 0; c < stealConsumers; c++) {
+            if (c === stealId || !stealIsLive(liveBeforeClaim, c))
+                continue;
+            if ((a_load(stealView, stealWantIndex[c]) & intent) === 0)
+                continue;
+            if (c < stealId)
+                seniorConflict = true;
+            else
+                juniorConflict = true;
+        }
+        if (seniorConflict) {
+            a_store(stealView, stealWantIndex[stealId], 0);
+            return false;
+        }
+        if (juniorConflict) {
+            while (stealJuniorWants(intent)) { /* junior withdraws */ }
+        }
+        // Last control loads before ownership. After this no control word is read
+        // until every slot in `take` has been decoded.
+        const take = ((a_load(hostBits, 0) ^ LastWorker ^ stealPeerAcks()) &
+            stealLaneMask(region)) | 0;
+        if (take === 0) {
+            a_store(stealView, stealWantIndex[stealId], 0);
+            return false;
+        }
+        let lanes = take;
+        while (lanes !== 0) {
+            decodeAt(31 - clz32((lanes & -lanes) >>> 0));
+            lanes = (lanes & (lanes - 1)) | 0;
+        }
+        // Retire the whole claimed mask with one ACK store, then release the region.
+        // ACK before intent-clear (paper Assumption 2(ii)).
+        LastWorker = (LastWorker ^ take) | 0;
+        a_store(stealView, stealAckIndex[stealId], LastWorker);
+        a_store(stealView, stealWantIndex[stealId], 0);
+        stealCursor = (region + 1) % stealRegions;
+        return true;
+    };
     /**
      * HOST SIDE: decode version
      */
@@ -711,6 +919,24 @@ export const lock2 = ({ headers, headerSlotStrideU32, LockBoundSector, payload,
         deferredCount = 0 | 0;
         pendingPromiseCount = 0 | 0;
     };
+    /**
+     * HOST SIDE: remove a terminated consumer from stealing arbitration.
+     *
+     * Its ACK remains part of the generation XOR forever, because it records
+     * lanes that consumer retired while alive. Only its stale WANT becomes
+     * ineligible. The caller must invoke this only after the endpoint can no
+     * longer execute; there is deliberately no matching reactivation operation.
+     */
+    const deactivateStealConsumer = (id) => {
+        if (!stealEnabled || !stealIsProducer)
+            return false;
+        if (!Number.isInteger(id) || id < 0 || id >= stealConsumers) {
+            throw new RangeError(`consumerId ${id} out of range`);
+        }
+        const bit = 1 << id;
+        const previous = Atomics.and(stealView, stealLiveIndex, ~bit);
+        return (previous & bit) !== 0;
+    };
     return {
         enlist,
         encode,
@@ -718,7 +944,7 @@ export const lock2 = ({ headers, headerSlotStrideU32, LockBoundSector, payload,
         encodeAll,
         publish,
         flushPending,
-        decode,
+        decode: stealEnabled ? decodeSteal : decode,
         hasSpace,
         resolved,
         hostBits,
@@ -729,6 +955,7 @@ export const lock2 = ({ headers, headerSlotStrideU32, LockBoundSector, payload,
         getPendingFrameCount: () => toBeSent.size | 0,
         getPendingPromiseCount: () => pendingPromiseCount | 0,
         resetPendingState,
+        deactivateStealConsumer,
         takeDeferredCount: () => {
             const count = deferredCount | 0;
             deferredCount = 0 | 0;

package/src/memory/payloadCodec.d.ts

@@ -6,7 +6,7 @@ import type { SharedBufferSource } from "../common/shared-buffer-region.js";
  * Returns `true` when the payload is encoded successfully.
  * Returns `false` when dynamic payload space could not be reserved.
  */
-export declare const encodePayload: ({ lockSector, payload, sab, payloadConfig, headersBuffer, headerSlotStrideU32, textCompat, onPromise, }: {
+export declare const encodePayload: ({ lockSector, payload, sab, payloadConfig, headersBuffer, headerSlotStrideU32, textCompat, onPromise, processBoundary, }: {
     lockSector?: SharedBufferSource;
     payload?: {
         sab?: SharedBufferSource;
@@ -24,8 +24,13 @@ export declare const encodePayload: ({ lockSector, payload, sab, payloadConfig,
     headerSlotStrideU32?: number;
     textCompat?: LockBufferTextCompat;
     onPromise?: PromisePayloadHandler;
+    /**
+     * Reject process-local pointer payloads while preserving ProcessSharedBuffer.
+     * Process transports must set this on both encoders and decoders.
+     */
+    processBoundary?: boolean;
 }) => (task: Task, slotIndex: number) => boolean;
-export declare const decodePayload: ({ lockSector, payload, sab, payloadConfig, headersBuffer, headerSlotStrideU32, textCompat, host, }: {
+export declare const decodePayload: ({ lockSector, payload, sab, payloadConfig, headersBuffer, headerSlotStrideU32, textCompat, host, processBoundary, }: {
     lockSector?: SharedBufferSource;
     payload?: {
         sab?: SharedBufferSource;
@@ -43,4 +48,8 @@ export declare const decodePayload: ({ lockSector, payload, sab, payloadConfig,
     headerSlotStrideU32?: number;
     textCompat?: LockBufferTextCompat;
     host?: true;
+    /**
+     * Reject process-local pointer payloads before reading pointer/token metadata.
+     */
+    processBoundary?: boolean;
 }) => (task: Task, slotIndex: number, specialFlags?: number) => void;