knitting 0.1.63 → 0.1.73

package/src/runtime/pool.js

@@ -1,20 +1,20 @@
 import { createHostTxQueue } from "./tx-queue.js";
-import { cleanupProcessWorkerMemoryQuietly, createProcessSharedMemoryAllocator, createProcessStealMemoryLayout, createProcessWorkerMemoryLayout, createProcessWorkerNativeSignalNotifier, readProcessSharedMemorySettings, readProcessWorkerCommandPrefix, readProcessWorkerRuntime, spawnProcessWorker, toProcessWorkerBootPayload, } from "./process-worker.js";
-import { serializeWorkerBootstrapData, terminateWorkerQuietly, toWorkerCompatExecArgv, toWorkerSafeExecArgv, } from "./worker-common.js";
+import { cleanupProcessWorkerMemoryQuietly, createProcessSharedMemoryAllocator, createProcessStealMemoryLayout, createProcessWorkerMemoryLayout, createProcessWorkerNativeSignalNotifier, processWorkerUsesIpc, readProcessSharedMemorySettings, readProcessWorkerCommandPrefix, readProcessWorkerRuntime, spawnProcessWorker, toProcessWorkerBootPayload, } from "./process-worker.js";
+import { serializeWorkerBootstrapData, terminateWorkerQuietly, isNodePermissionExecFlag, toWorkerSafeExecArgv, warnDroppedWorkerExecArgv, } from "./worker-common.js";
 import { createSharedMemoryTransport, TRANSPORT_SIGNAL_BYTES, WORKER_STOP, } from "../ipc/transport/shared-memory.js";
 import { ChannelHandler, hostDispatcherLoop, } from "./dispatcher.js";
-import { HEADER_SLOT_STRIDE_U32, lock2, LOCK_SECTOR_BYTE_LENGTH, LockBound, } from "../memory/lock.js";
-// Side-effect import: registers the payload codec (cycle break for Andromeda;
-// see lock.ts). Must run before any lock2() call.
+import { KnittingError } from "../error.js";
+import { createNodeCompletionDoorbell } from "./node-doorbell.js";
+import { DEFAULT_STEAL_CLAIM, HEADER_SLOT_STRIDE_U32, lock2, LOCK_SECTOR_BYTE_LENGTH, LockBound, } from "../memory/lock.js";
+// Registers the payload codec before any lock is built.
 import "../memory/payloadCodec.js";
 import "../worker/loop.js";
 import { createSharedArrayBuffer, createWasmSharedArrayBuffer, IS_BROWSER, RUNTIME, } from "../common/runtime.js";
-import { HAS_NODE_WORKER_THREADS, RUNTIME_WORKER, } from "../common/worker-runtime.js";
+import { HAS_NODE_WORKER_THREADS, isProcessCompletionDoorbell, RUNTIME_WORKER, } from "../common/worker-runtime.js";
 import { probeLockBufferTextCompat } from "../common/shared-buffer-text.js";
 import { signalAbortFactory } from "../shared/abortSignal.js";
 import { createLockControlCarpet } from "../memory/byte-carpet.js";
 import { resolvePayloadBufferOptions, } from "../memory/payload-config.js";
-import { createBufferReferenceReturnReleaseMessage, detachArrayBufferBestEffort, } from "../connections/buffer-reference.js";
 import { spawnCompiledWorkerContext } from "./compiled-worker.js";
 const WORKER_FATAL_MESSAGE_KEY = "__knittingWorkerFatal";
 const isWorkerFatalMessage = (value) => !!value &&
@@ -22,9 +22,16 @@ const isWorkerFatalMessage = (value) => !!value &&
     typeof value[WORKER_FATAL_MESSAGE_KEY] === "string";
 // Bound the wait for a worker to acknowledge loop exit.
 const WORKER_STOP_ACK_TIMEOUT_MS = 50;
-const WORKER_STOP_NEEDS_ACK = RUNTIME === "deno";
-// Keep idle workers self-healing if an Atomics.notify wake is missed.
-const DEFAULT_WORKER_PARK_MS = 1;
+// Node owns returned BufferReference backing stores in a process-global native
+// registry. Give its worker loop a chance to drain deferred producer pins
+// before the host falls back to terminate().
+const WORKER_STOP_NEEDS_ACK = RUNTIME === "deno" || RUNTIME === "node";
+// The park timeout is only a safety net: the host wakes a parked thread worker
+// after every publish, so a long park costs no latency and idles at ~0 CPU.
+const DEFAULT_WORKER_PARK_MS = 1000;
+// A process worker can only be rung across processes by a Node host waking a
+// Node child; every other pairing rediscovers work on this timeout.
+const DEFAULT_PROCESS_WORKER_PARK_MS = 1;
 const SINGLE_WORKER_SPIN_US = 50;
 const DEFAULT_ABORT_SIGNAL_CAPACITY = 258;
 const sanitizePositiveInteger = (value) => {
@@ -36,7 +43,10 @@ const sanitizePositiveInteger = (value) => {
 const resolveAbortSignalCapacity = (value) => sanitizePositiveInteger(value) ?? DEFAULT_ABORT_SIGNAL_CAPACITY;
 const abortSignalByteLength = (capacity) => Math.max(1, Math.ceil(capacity / 32)) * Uint32Array.BYTES_PER_ELEMENT;
 const withDefaultWorkerTimers = (options, workerCount) => {
-    const parkMs = options?.timers?.parkMs ?? DEFAULT_WORKER_PARK_MS;
+    const parkMs = options?.timers?.parkMs ??
+        (options?.runtime === "process"
+            ? DEFAULT_PROCESS_WORKER_PARK_MS
+            : DEFAULT_WORKER_PARK_MS);
     // `??` and not `||`: an explicit `spinMicroseconds: 0` is the whole point of
     // the multi-worker default and must not fall through to it.
     const spinMicroseconds = options?.timers?.spinMicroseconds ??
@@ -57,16 +67,7 @@ const withFixedPayloadConfig = (config) => ({
     mode: "fixed",
     payloadInitialBytes: config.payloadMaxByteLength,
 });
-/**
- * Build the buffers, host-side locks and pending registry that a stealing pool
- * shares. One submit region for every worker to claim from, one private return
- * region per worker, and a single pool-global queue so a response arriving on
- * any lane settles the right promise.
- *
- * Region width follows paper §6.1: the largest power-of-two `g` leaving a spare
- * region for a delayed claimant (`slots / g >= consumers + 1`). At 32 slots that
- * caps how wide a region can be well before it caps the worker count.
- */
+/** Build the shared submit and private return buffers for a stealing pool. */
 export const resolveStealRegionLanes = (consumers) => {
     for (let lanes = LockBound.slots; lanes >= 1; lanes >>= 1) {
         if (LockBound.slots / lanes >= consumers + 1)
@@ -74,9 +75,17 @@ export const resolveStealRegionLanes = (consumers) => {
     }
     throw new RangeError(`${consumers} stealing workers need more than ${LockBound.slots} lanes`);
 };
+/**
+ * Return the widest region allowed by the selected claim discipline. Only
+ * Dekker needs a region per consumer; `ticket` has no regions at all and uses
+ * the width purely as a claim batch size.
+ */
+export const resolveMaxStealRegionLanes = (consumers, stealClaim = DEFAULT_STEAL_CLAIM) => stealClaim === "dekker"
+    ? resolveStealRegionLanes(consumers)
+    : LockBound.slots;
 /** Maximum claimants that leave the protocol's required spare region. */
 export const MAX_STEAL_CONSUMERS = LockBound.slots - 1;
-export const createStealPoolBuffers = ({ threads, payload, regionLanes, abortSignalCapacity, usesAbortSignal, processWorker, }) => {
+export const createStealPoolBuffers = ({ threads, payload, sharedArgs, regionLanes, stealClaim, abortSignalCapacity, usesAbortSignal, processWorker, }) => {
     const basePayloadConfig = resolvePayloadBufferOptions({ options: payload });
     const payloadConfig = processWorker === undefined
         ? basePayloadConfig
@@ -100,9 +109,10 @@ export const createStealPoolBuffers = ({ threads, payload, regionLanes, abortSig
             payload: payloadSab,
         }),
     });
-    const maxLanes = resolveStealRegionLanes(threads);
+    // Keep the default width valid for Dekker; wider regions are explicit.
+    const maxLanes = resolveMaxStealRegionLanes(threads, stealClaim);
     const lanes = regionLanes === undefined
-        ? maxLanes
+        ? resolveStealRegionLanes(threads)
         : Math.min(Math.max(1, regionLanes | 0), maxLanes);
     const resolvedAbortSignalCapacity = resolveAbortSignalCapacity(abortSignalCapacity);
     const processMemory = processWorker === undefined ? undefined : createProcessStealMemoryLayout({
@@ -133,7 +143,11 @@ export const createStealPoolBuffers = ({ threads, payload, regionLanes, abortSig
         textCompat: submitBuffers.textCompat,
         consumers: threads,
         regionLanes: lanes,
+        stealClaim,
         processBoundary: processMemory !== undefined,
+        // Shared arguments are opt-in because the receiving task may outlive the
+        // borrowed region.
+        sharedReturn: sharedArgs === true,
     });
     const returnBuffers = [];
     const hostReturnLocks = [];
@@ -179,13 +193,14 @@ export const createStealPoolBuffers = ({ threads, payload, regionLanes, abortSig
         hostReturnLocks,
         sharedQueue,
         regionLanes: lanes,
+        stealClaim,
         processMemory,
         abortSignalSAB,
         abortSignalMax: processMemory?.abortSignalMax ??
             (abortSignalSAB === undefined ? undefined : resolvedAbortSignalCapacity),
     };
 };
-export const spawnWorkerContext = ({ list, ids, names, sab, thread, debug, hostDebug, totalNumberOfThread, workerCount, source, at, workerOptions, workerExecArgv, permission, host, payload, bufferReferenceReturn, abortSignalCapacity, usesAbortSignal, sharedChannelHandler, stealPool, }) => {
+export const spawnWorkerContext = ({ list, ids, names, sab, thread, debug, debugEpoch, hostDebug, totalNumberOfThread, workerCount, source, at, workerOptions, workerExecArgv, requestedExecArgv, permission, host, payload, sharedBytesEnabled, abortSignalCapacity, usesAbortSignal, sharedChannelHandler, denoCompletionDoorbell, stealPool, }) => {
     if (workerOptions?.runtime === "compiled") {
         return spawnCompiledWorkerContext({
             list,
@@ -200,12 +215,20 @@ export const spawnWorkerContext = ({ list, ids, names, sab, thread, debug, hostD
     const poliWorker = RUNTIME_WORKER;
     const resolvedWorkerOptions = serializeWorkerBootstrapData(withDefaultWorkerTimers(workerOptions, workerCount ?? totalNumberOfThread));
     const useProcessWorkerRuntime = resolvedWorkerOptions.runtime === "process";
+    const canUseDenoCompletionDoorbell = !useProcessWorkerRuntime &&
+        denoCompletionDoorbell !== undefined;
     const processWorkerRuntime = useProcessWorkerRuntime
         ? readProcessWorkerRuntime(resolvedWorkerOptions)
         : undefined;
     const processWorkerCommandPrefix = useProcessWorkerRuntime
         ? readProcessWorkerCommandPrefix(resolvedWorkerOptions)
         : undefined;
+    const canUseProcessCompletionDoorbell = useProcessWorkerRuntime &&
+        host?.doorbell !== false &&
+        processWorkerUsesIpc({
+            processRuntime: processWorkerRuntime,
+            commandPrefix: processWorkerCommandPrefix,
+        });
     const processSharedMemorySettings = useProcessWorkerRuntime
         ? readProcessSharedMemorySettings(resolvedWorkerOptions)
         : undefined;
@@ -238,10 +261,7 @@ export const spawnWorkerContext = ({ list, ids, names, sab, thread, debug, hostD
     const abortBytes = stealPool === undefined && usesAbortSignal === true
         ? abortSignalByteLength(resolvedAbortSignalCapacity)
         : 0;
-    // A stealing process pool carves every lane out of one mapping, so lane
-    // `thread` must find its slice there. Falling back to a private layout would
-    // silently give this lane its own submit region — it would boot and then
-    // never see a task the host published to the shared one.
+    // Stealing process workers use their slice of the pool-wide mapping.
     const stealProcessMemory = stealPool?.processMemory;
     const processWorkerMemory = !useProcessWorkerRuntime
         ? undefined
@@ -264,18 +284,14 @@ export const spawnWorkerContext = ({ list, ids, names, sab, thread, debug, hostD
         createWasmSharedArrayBuffer;
     const createPayloadBuffer = processSharedMemory?.createBuffer;
     const makePayloadBuffer = () => createPayloadBuffer
-        // ProcessSharedBuffer is fixed-size today, so reserve the configured
-        // payload ceiling instead of relying on SAB growth.
+        // Process-shared buffers are fixed-size.
         ? createPayloadBuffer(resolvedPayloadConfig.payloadMaxByteLength)
         : resolvedPayloadConfig.mode === "growable"
             ? createSharedArrayBuffer(resolvedPayloadConfig.payloadInitialBytes, resolvedPayloadConfig.payloadMaxByteLength)
             : createSharedArrayBuffer(resolvedPayloadConfig.payloadInitialBytes);
     const makeLockControlLayout = () => {
-        // Keep the hottest control words in one compact front strip:
-        // transport signals -> request lock -> return lock.
-        // Request/return headers stay in separate contiguous slabs to preserve
-        // sequential batching locality.
-        // Abort bitmap stays at the tail.
+        // Place hot control words first; keep headers contiguous and the abort bitmap
+        // at the tail.
         return createLockControlCarpet({
             signalBytes,
             abortBytes,
@@ -350,68 +366,11 @@ export const spawnWorkerContext = ({ list, ids, names, sab, thread, debug, hostD
         processRuntime: processWorkerRuntime,
         signal: signalBox.opView,
     });
-    const outstandingBorrowedReturns = bufferReferenceReturn === "borrow" && typeof WeakRef === "function"
-        ? new Map()
-        : undefined;
-    const releaseBorrowedReturnToken = (token) => {
-        outstandingBorrowedReturns?.delete(token);
-        worker?.postMessage?.(createBufferReferenceReturnReleaseMessage(token));
-    };
-    const revokeOutstandingBorrowedReturns = (copyBytes) => {
-        if (outstandingBorrowedReturns === undefined)
-            return;
-        for (const [token, record] of outstandingBorrowedReturns) {
-            try {
-                const ref = record.ref.deref();
-                if (ref !== undefined) {
-                    ref.revokeBorrow(copyBytes);
-                    continue;
-                }
-                const aliasBuffer = record.aliasBuffer?.deref();
-                if (aliasBuffer !== undefined &&
-                    detachArrayBufferBestEffort(record.runtime, aliasBuffer) &&
-                    copyBytes) {
-                    releaseBorrowedReturnToken(token);
-                }
-            }
-            catch {
-                // best effort
-            }
-        }
-        outstandingBorrowedReturns.clear();
-    };
-    const returnHooks = bufferReferenceReturn === "borrow"
-        ? {
-            release: releaseBorrowedReturnToken,
-            track: (ref, token, aliasBuffer) => {
-                if (outstandingBorrowedReturns === undefined)
-                    return;
-                const record = outstandingBorrowedReturns.get(token);
-                if (record !== undefined) {
-                    if (aliasBuffer !== undefined) {
-                        record.aliasBuffer = new WeakRef(aliasBuffer);
-                    }
-                    return;
-                }
-                outstandingBorrowedReturns.set(token, {
-                    ref: new WeakRef(ref),
-                    aliasBuffer: aliasBuffer === undefined
-                        ? undefined
-                        : new WeakRef(aliasBuffer),
-                    runtime: ref.runtime,
-                });
-            },
-        }
-        : undefined;
     const queue = stealPool?.sharedQueue ?? createHostTxQueue({
         lock,
         returnLock,
         abortSignals,
-        releaseBufferReferenceReturn: returnHooks,
     });
-    if (stealPool !== undefined) {
-        stealPool.sharedQueue.setReturnHooks(stealPool.consumerId, returnHooks);
-    }
     const { enqueue, rejectAll, txIdle, } = queue;
     const thisSignal = signalBox.opView;
     const a_add = Atomics.add;
@@ -420,8 +379,7 @@ export const spawnWorkerContext = ({ list, ids, names, sab, thread, debug, hostD
     const canNotifySignal = thisSignal.buffer instanceof SharedArrayBuffer;
     const notifySignal = nativeNotifySignal ??
         (canNotifySignal ? (() => a_notify(thisSignal, 0, 1)) : undefined);
-    // Wakes this lane's worker when it is parked (rxStatus 0). Used by send()
-    // (new work just arrived) — the dispatcher drain wakes it the same way.
+    // Wake this lane when its worker is parked.
     const laneWake = () => {
         if (a_load(signalBox.rxStatus, 0) === 0) {
             a_add(thisSignal, 0, 1);
@@ -434,10 +392,26 @@ export const spawnWorkerContext = ({ list, ids, names, sab, thread, debug, hostD
     const ownsChannel = sharedChannelHandler === undefined &&
         stealPool === undefined;
     const ownChannel = sharedChannelHandler ?? new ChannelHandler();
-    // Under stealing there is one queue, so one dispatcher drives it from the
-    // pool; a per-lane dispatcher would double-drain the shared registry.
-    const { check: dispatcherCheck } = stealPool !== undefined
-        ? { check: undefined }
+    const threadCanLoadNodeAddons = permission?.enabled !== true ||
+        permission.unsafe === true || permission.node.allowAddons === true;
+    const useNativeNodeDoorbell = RUNTIME === "node" &&
+        !useProcessWorkerRuntime && host?.doorbell !== false &&
+        host?.nativeDoorbell === true && threadCanLoadNodeAddons;
+    if (RUNTIME === "node" && !useProcessWorkerRuntime &&
+        host?.doorbell !== false && host?.nativeDoorbell === true &&
+        !threadCanLoadNodeAddons) {
+        hostDebug?.("native Node doorbell disabled by worker permissions; using the " +
+            "portable wake path (set permission.node.allowAddons=true to enable)");
+    }
+    // Create the Node doorbell before bootstrapping the worker.
+    let nodeCompletionWake;
+    const nodeCompletionDoorbell = useNativeNodeDoorbell
+        ? createNodeCompletionDoorbell(() => nodeCompletionWake?.())
+        : undefined;
+    const canUseNodeCompletionDoorbell = nodeCompletionDoorbell !== undefined;
+    // A stealing pool has one dispatcher for its shared queue.
+    const { check: dispatcherCheck, wakeCompletion: directCompletionWake, } = stealPool !== undefined
+        ? { check: undefined, wakeCompletion: undefined }
         : hostDispatcherLoop({
             signalBox,
             queue,
@@ -445,7 +419,15 @@ export const spawnWorkerContext = ({ list, ids, names, sab, thread, debug, hostD
             dispatcherOptions: host,
             notifySignal: nativeNotifySignal,
             crossProcess: useProcessWorkerRuntime,
+            nativeCompletionDoorbell: canUseDenoCompletionDoorbell ||
+                canUseNodeCompletionDoorbell,
+            processCompletionDoorbell: canUseProcessCompletionDoorbell,
         });
+    if (canUseDenoCompletionDoorbell && dispatcherCheck !== undefined) {
+        denoCompletionDoorbell.listen(thread, directCompletionWake);
+    }
+    nodeCompletionWake = directCompletionWake;
+    let processCompletionWake = directCompletionWake;
     if (ownsChannel && dispatcherCheck !== undefined) {
         ownChannel.open(dispatcherCheck);
         channelHandler = ownChannel;
@@ -453,7 +435,7 @@ export const spawnWorkerContext = ({ list, ids, names, sab, thread, debug, hostD
             if (dispatcherCheck.isRunning === true)
                 return;
             dispatcherCheck.isRunning = true;
-            Promise.resolve().then(dispatcherCheck);
+            queueMicrotask(dispatcherCheck);
             laneWake();
         };
     }
@@ -478,24 +460,34 @@ export const spawnWorkerContext = ({ list, ids, names, sab, thread, debug, hostD
         at,
         thread,
         debug,
+        debugEpoch,
         workerOptions: resolvedWorkerOptions,
         totalNumberOfThread,
         startAt: signalBox.startAt,
         lock: lockBuffers,
         returnLock: returnLockBuffers,
         payloadConfig: resolvedPayloadConfig,
-        bufferReferenceReturn,
+        sharedReturn: sharedBytesEnabled === true,
         permission,
-        // Mirrors the dispatcher's `canUseDoorbell`: a cross-process worker cannot
-        // ring the host's waiter, so do not make it pay the atomic op.
-        notifyOnHostPublish: !useProcessWorkerRuntime &&
-            host?.doorbell !== false &&
-            (RUNTIME === "bun" || RUNTIME === "node") &&
-            typeof Atomics.waitAsync === "function",
+        // Select the completion doorbell supported by the worker runtime.
+        notifyOnHostPublish: host?.doorbell !== false &&
+            (canUseProcessCompletionDoorbell ||
+                canUseNodeCompletionDoorbell ||
+                (!useProcessWorkerRuntime &&
+                    (RUNTIME === "bun" || RUNTIME === "node") &&
+                    typeof Atomics.waitAsync === "function")),
+        processCompletionDoorbell: canUseProcessCompletionDoorbell,
+        denoCompletionDoorbell: canUseDenoCompletionDoorbell
+            ? denoCompletionDoorbell.pointer
+            : undefined,
+        nodeCompletionDoorbell: canUseNodeCompletionDoorbell
+            ? nodeCompletionDoorbell.pointer
+            : undefined,
         steal: stealPool === undefined ? undefined : {
             consumers: stealPool.consumers,
             consumerId: stealPool.consumerId,
             regionLanes: stealPool.regionLanes,
+            claim: stealPool.stealClaim,
         },
     };
     const baseWorkerOptions = {
@@ -507,6 +499,11 @@ export const spawnWorkerContext = ({ list, ids, names, sab, thread, debug, hostD
     const withExecArgv = workerExecArgv && workerExecArgv.length > 0
         ? { ...baseWorkerOptions, execArgv: workerExecArgv }
         : baseWorkerOptions;
+    const requiredNodePermissionFlags = RUNTIME === "node" &&
+        permission?.enabled === true &&
+        permission.unsafe !== true
+        ? permission.node.flags.filter(isNodePermissionExecFlag)
+        : [];
     if (processWorkerMemory !== undefined) {
         worker = spawnProcessWorker({
             workerUrl,
@@ -519,43 +516,59 @@ export const spawnWorkerContext = ({ list, ids, names, sab, thread, debug, hostD
     }
     else if (HAS_NODE_WORKER_THREADS) {
         try {
-            worker = new WorkerCtor(workerUrl, withExecArgv);
-        }
-        catch (error) {
-            if (error?.code === "ERR_WORKER_INVALID_EXEC_ARGV") {
-                const fallbackExecArgv = toWorkerSafeExecArgv(withExecArgv.execArgv);
-                if (fallbackExecArgv && fallbackExecArgv.length > 0) {
-                    try {
-                        worker = new WorkerCtor(workerUrl, { ...baseWorkerOptions, execArgv: fallbackExecArgv });
+            // The flags the worker actually started with.
+            let appliedExecArgv;
+            try {
+                worker = new WorkerCtor(workerUrl, withExecArgv);
+                appliedExecArgv = withExecArgv.execArgv;
+            }
+            catch (error) {
+                if (error?.code === "ERR_WORKER_INVALID_EXEC_ARGV") {
+                    const fallbackExecArgv = toWorkerSafeExecArgv(withExecArgv.execArgv);
+                    const missingPermissionFlags = requiredNodePermissionFlags.filter((flag) => !fallbackExecArgv?.includes(flag));
+                    if (missingPermissionFlags.length > 0) {
+                        throw new Error("Node rejected the permission flags required by Knitting's " +
+                            `thread worker policy (${missingPermissionFlags.join(", ")}). ` +
+                            "Refusing to retry without them.");
                     }
-                    catch (fallbackError) {
-                        if (fallbackError?.code ===
-                            "ERR_WORKER_INVALID_EXEC_ARGV") {
-                            const compatExecArgv = toWorkerCompatExecArgv(fallbackExecArgv);
-                            if (compatExecArgv && compatExecArgv.length > 0) {
-                                try {
-                                    worker = new WorkerCtor(workerUrl, { ...baseWorkerOptions, execArgv: compatExecArgv });
-                                }
-                                catch {
-                                    worker = new WorkerCtor(workerUrl, baseWorkerOptions);
-                                }
+                    if (fallbackExecArgv && fallbackExecArgv.length > 0) {
+                        try {
+                            worker = new WorkerCtor(workerUrl, { ...baseWorkerOptions, execArgv: fallbackExecArgv });
+                            appliedExecArgv = fallbackExecArgv;
+                        }
+                        catch (fallbackError) {
+                            if (requiredNodePermissionFlags.length > 0) {
+                                throw new Error("Node could not start a thread worker with Knitting's " +
+                                    "permission policy. Refusing to start it without those " +
+                                    `permissions. ${String(fallbackError)}`);
                             }
-                            else {
+                            if (fallbackError?.code ===
+                                "ERR_WORKER_INVALID_EXEC_ARGV") {
                                 worker = new WorkerCtor(workerUrl, baseWorkerOptions);
                             }
+                            else {
+                                throw fallbackError;
+                            }
                         }
-                        else {
-                            throw fallbackError;
-                        }
+                    }
+                    else if (requiredNodePermissionFlags.length > 0) {
+                        throw new Error("Node rejected the permission flags required by Knitting's " +
+                            "thread worker policy. Refusing to start the worker without " +
+                            "those permissions.");
+                    }
+                    else {
+                        worker = new WorkerCtor(workerUrl, baseWorkerOptions);
                     }
                 }
                 else {
-                    worker = new WorkerCtor(workerUrl, baseWorkerOptions);
+                    throw error;
                 }
             }
-            else {
-                throw error;
-            }
+            warnDroppedWorkerExecArgv(requestedExecArgv, appliedExecArgv);
+        }
+        catch (error) {
+            nodeCompletionDoorbell?.close();
+            throw error;
         }
     }
     else {
@@ -565,6 +578,11 @@ export const spawnWorkerContext = ({ list, ids, names, sab, thread, debug, hostD
         worker.postMessage?.(workerDataPayload);
     }
     let closedReason;
+    // A worker that exits because the host asked it to stop is a closed thread,
+    // not a crash. The stop is acknowledged in shared memory before the worker
+    // unwinds, so on a slow host the `exit` event can land ahead of `kills()`
+    // and label an orderly shutdown "Worker exited with code 0".
+    let stopRequested = false;
     const deactivateStealConsumer = () => {
         stealPool?.hostSubmitLock.deactivateStealConsumer(stealPool.consumerId);
     };
@@ -579,26 +597,39 @@ export const spawnWorkerContext = ({ list, ids, names, sab, thread, debug, hostD
             deactivateStealConsumer();
         }
     };
-    // `workerBytesReadable`: while the worker is still alive its pinned bytes
-    // can be copied out; after a crash/exit they are gone and borrows are
-    // detached so stale reads fail loud instead of aliasing freed memory.
-    const markWorkerClosed = (reason, workerBytesReadable = false) => {
+    const markWorkerClosed = (code, reason, cause) => {
         if (closedReason)
             return;
         closedReason = reason;
-        revokeOutstandingBorrowedReturns(workerBytesReadable);
-        rejectAll(reason);
+        const error = new KnittingError(code, reason, cause);
+        if (stealPool !== undefined && stealPool.stealClaim !== "ticket") {
+            // Dekker's shared queue outlives one consumer: the surviving workers
+            // keep claiming from it, so only the calls in flight are rejected.
+            rejectAll(error);
+        }
+        else {
+            // A lane's own queue has no other consumer, so a call accepted after
+            // this point would stay pending forever: close it and reject them all.
+            // Under ticket stealing a claimed ticket may be lost at any point
+            // between CAS and retirement, so the whole shared registry closes and
+            // task-id/slot reuse is prohibited.
+            queue.close(error);
+        }
         channelHandler?.close();
     };
     const onWorkerMessage = (message) => {
+        if (isProcessCompletionDoorbell(message)) {
+            processCompletionWake?.();
+            return;
+        }
         if (!isWorkerFatalMessage(message))
             return;
-        markWorkerClosed(`Worker startup failed: ${message[WORKER_FATAL_MESSAGE_KEY]}`, true);
+        markWorkerClosed("WORKER_STARTUP_FAILED", `Worker startup failed: ${message[WORKER_FATAL_MESSAGE_KEY]}`);
         terminateFailedWorker();
     };
     const onWorkerError = (error) => {
         const message = String(error?.message ?? error);
-        markWorkerClosed(`Worker crashed: ${message}`);
+        markWorkerClosed("WORKER_CRASHED", `Worker crashed: ${message}`, error);
         terminateFailedWorker();
     };
     const nodeWorker = worker;
@@ -606,13 +637,16 @@ export const spawnWorkerContext = ({ list, ids, names, sab, thread, debug, hostD
         nodeWorker.on("message", onWorkerMessage);
         nodeWorker.on("error", onWorkerError);
         nodeWorker.on("exit", (code) => {
-            // Exit is the point at which this endpoint can no longer write WANT, so
-            // survivors may safely ignore any intent it left behind.
             deactivateStealConsumer();
+            nodeCompletionDoorbell?.close();
             if (closedReason !== undefined)
                 return;
+            if (stopRequested) {
+                markWorkerClosed("THREAD_CLOSED", "Thread closed");
+                return;
+            }
             const normalized = typeof code === "number" ? code : -1;
-            markWorkerClosed(`Worker exited with code ${normalized}`);
+            markWorkerClosed("WORKER_EXITED", `Worker exited with code ${normalized}`);
         });
     }
     else {
@@ -646,34 +680,35 @@ export const spawnWorkerContext = ({ list, ids, names, sab, thread, debug, hostD
             return pending;
         };
     };
-    // Ask the worker to leave its loop before termination.
     const requestWorkerStop = async () => {
+        stopRequested = true;
         const stopView = signalBox.stopView;
         if (stopView === undefined)
-            return;
+            return true;
         try {
             Atomics.store(stopView, 0, WORKER_STOP.requested);
             laneWake();
             notifySignal?.();
         }
         catch {
-            return;
+            return false;
         }
         if (!WORKER_STOP_NEEDS_ACK)
-            return;
+            return true;
         const deadline = Date.now() + WORKER_STOP_ACK_TIMEOUT_MS;
         while (Atomics.load(stopView, 0) !== WORKER_STOP.acknowledged) {
             if (Date.now() >= deadline)
-                return;
+                return false;
             await new Promise((resolve) => setTimeout(resolve, 1));
         }
+        return true;
     };
     const context = {
         txIdle,
         call,
         requestStop: requestWorkerStop,
         kills: async () => {
-            markWorkerClosed("Thread closed", true);
+            markWorkerClosed("THREAD_CLOSED", "Thread closed");
             // Process workers must exit before their shared memory is unmapped.
             const awaitExit = processWorkerMemory !== undefined;
             const termination = terminateWorkerQuietly(worker, awaitExit);
@@ -687,9 +722,22 @@ export const spawnWorkerContext = ({ list, ids, names, sab, thread, debug, hostD
         laneWake: sharedChannelHandler !== undefined || stealPool !== undefined
             ? laneWake
             : undefined,
+        laneAwake: stealPool !== undefined
+            ? () => a_load(signalBox.rxStatus, 0) !== 0
+            : undefined,
         bindSend: sharedChannelHandler !== undefined || stealPool !== undefined
             ? ((fn) => void (dispatchSend = fn))
             : undefined,
+        bindCompletionWake: (canUseProcessCompletionDoorbell ||
+            canUseNodeCompletionDoorbell) &&
+            stealPool !== undefined
+            ? ((fn) => {
+                processCompletionWake = fn;
+                nodeCompletionWake = fn;
+            })
+            : undefined,
+        processCompletionDoorbell: canUseProcessCompletionDoorbell,
+        nodeCompletionDoorbell: canUseNodeCompletionDoorbell,
     };
     return context;
 };

package/src/runtime/process-worker.d.ts

@@ -92,6 +92,15 @@ export declare const createProcessWorkerNativeSignalNotifier: ({ processRuntime,
     processRuntime: ProcessWorkerRuntime | undefined;
     signal: Int32Array;
 }) => (() => void) | undefined;
+/**
+ * Whether this host/child pair has the Node-compatible IPC channel that the
+ * process completion-doorbell prototype uses. Deno process workers currently
+ * boot through environment data and do not have that channel.
+ */
+export declare const processWorkerUsesIpc: ({ processRuntime, commandPrefix, }: {
+    processRuntime: ProcessWorkerRuntime | undefined;
+    commandPrefix?: ProcessWorkerCommandPrefix;
+}) => boolean;
 export declare const spawnProcessWorker: (options: {
     workerUrl: string | URL;
     bootPayload: ProcessWorkerBootPayload;