knitting 0.1.63 → 0.1.73

package/src/memory/lock.js

@@ -9,12 +9,7 @@ import { createSharedArrayBuffer, createWasmSharedArrayBuffer, } from "../common
 import { toSharedBufferRegion, } from "../common/shared-buffer-region.js";
 import { probeLockBufferTextCompat, } from "../common/shared-buffer-text.js";
 import { resolvePayloadBufferOptions, } from "./payload-config.js";
-/**
- * TODO: Compose all the instance where the array is passed as argument
- */
-// const objects replace `enum`s throughout this module: Andromeda's Nova engine
-// panics on `enum`. Value access, duplicate-value members, and type preserved;
-// identical emit on Node/Deno/Bun.
+// Use const objects instead of enums; Andromeda's Nova engine cannot parse enums.
 export const PayloadSignal = {
     UNREACHABLE: 0,
     BigInt: 2,
@@ -68,6 +63,12 @@ export const PayloadBuffer = {
     EnvelopeDynamicHeaderStringExternal: 52,
     NumericArray: 53,
     StaticNumericArray: 54,
+    /** Binary payload already stored in the dynamic arena. */
+    ArenaBinary: 55,
+    /** A returned Uint8Array whose ArrayBuffer ownership was moved to the host. */
+    MovedBinary: 56,
+    /** A returned ArrayBuffer whose ownership was moved to the host. */
+    MovedArrayBuffer: 57,
 };
 // Value -> name lookup (enum reverse-map), for payload-limit error labels.
 // Later keys win on duplicate values (11 -> "String"), as TS enums do.
@@ -116,6 +117,13 @@ export const addTaskFinalizer = (task, finalizer) => {
         }
     };
 };
+/** Take an owner-lifetime transport hold, if the value supports one. */
+export const takePayloadTransportHold = (value) => {
+    if (value === null || typeof value !== "object")
+        return undefined;
+    const finalizer = value[PayloadTransportFinalizer]?.();
+    return typeof finalizer === "function" ? finalizer : undefined;
+};
 export const attachPayloadTransportFinalizer = (task, value) => {
     if (task.finalize !== undefined || value === null || typeof value !== "object") {
         return;
@@ -143,18 +151,19 @@ export const TaskIndex = {
     /**
      * Host -> worker request function id (low 16 bits).
      * High 16 bits are reserved for caller metadata on request path.
-     * NOTE: shares the same storage word as `FlagsToHost`.
+     * Shares storage with `FlagsToHost`.
      */
     FunctionID: 0,
     ID: 1,
     Type: 2,
     Start: 3,
-    End: 4,
-    PayloadLen: 5,
     /**
-     * Low 5 bits: region slot index (0..31).
-     * High 27 bits: reserved for caller metadata (e.g. enqueue timing).
+     * Payload length; bit 31 stores the high bit of a dynamic-region index.
+     * Write the length before `tagTaskSlot()` and mask bit 31 when reading it.
      */
+    End: 4,
+    PayloadLen: 5,
+    /** Low 5 bits hold the dynamic-region index; the remaining bits hold metadata. */
     slotBuffer: 6,
     Size: 8,
     /**
@@ -248,6 +257,35 @@ export const STEAL_PAYLOAD_ACK_SLOT_OFFSET_U32 = STEAL_ACK_SLOT_OFFSET_U32 + 2;
 export const STEAL_LIVE_SLOT_OFFSET_U32 = STEAL_PAYLOAD_ACK_SLOT_OFFSET_U32 + 1;
 /** Host-owned arm word for the return-lock completion doorbell. */
 export const DOORBELL_ARMED_SLOT_OFFSET_U32 = STEAL_LIVE_SLOT_OFFSET_U32 + 1;
+/**
+ * Non-wrapping 64-bit claim head for the `ticket` discipline. The producer
+ * publishes only the low 32 bits of the tail. A successful head CAS validates
+ * the snapshot: with that head unchanged, at most 32 tickets can be pending,
+ * so unsigned subtraction recovers the exact distance even across tail wrap.
+ * Head and tail occupy different slots' header lines (slots 0 and 1).
+ */
+export const STEAL_TICKET_HEAD_SLOT_OFFSET_U32 = DOORBELL_ARMED_SLOT_OFFSET_U32 + 2; // Keep the 64-bit head aligned.
+/** Negative head permanently closes a failed ticket queue. */
+export const STEAL_TICKET_FAILED = -1n;
+const STEAL_TICKET_LIMIT = (1n << 63n) - 1n;
+const STEAL_TICKET_LOW_MASK = 0xffffffffn;
+/**
+ * Publication-order ring. `order[t & 31]` is the slot the producer filled for
+ * ticket `t`, so a ticket names a lane without the ticket having to *be* the
+ * lane: the producer keeps its free-bit allocation and claims follow publication
+ * order. Cell `i` uses the former ACK word; words 14..15
+ * are reserved for the head in slot 0 and the tail in slot 1.
+ */
+export const STEAL_TICKET_ORDER_SLOT_OFFSET_U32 = STEAL_ACK_SLOT_OFFSET_U32;
+/** Ring cells, and therefore the wrap mask, follow the slot count. */
+export const STEAL_TICKET_RING_MASK = (LockBound.slots - 1) | 0;
+/** Bounded CAS retries before a claimant re-polls from the worker loop. */
+const STEAL_TICKET_ATTEMPTS = 2;
+// A producer claims ARMED before ringing the host. Keeping SIGNALLED until the
+// host drains coalesces a burst of published frames into one native/IPC wake.
+const DOORBELL_OFF = 0;
+const DOORBELL_ARMED = 1;
+const DOORBELL_SIGNALLED = 2;
 export const HEADER_U32_LENGTH = LockBound.header +
     (HEADER_SLOT_STRIDE_U32 * LockBound.slots);
 export const HEADER_BYTE_LENGTH = HEADER_U32_LENGTH *
@@ -287,18 +325,56 @@ const makeTaskFrom = (array, at) => {
     fillTaskFrom(task, array, at);
     return task;
 };
-// could be inlined
 const settleTask = (task) => {
     if (task[TaskIndex["FlagsToHost"]] === 0) {
         task.resolve(task.value);
     }
     else {
         task.reject(task.value);
-        // restarting the flag
+        // Clear the rejection marker before the task slot is reused.
         task[TaskIndex["FlagsToHost"]] = 0;
     }
 };
-export const lock2 = ({ headers, headerSlotStrideU32, LockBoundSector, payload, payloadConfig, payloadSector, textCompat, resultList, toSentList, recycleList, processBoundary, consumers, consumerId, regionLanes, notifyOnHostPublish, }) => {
+/**
+ * Claim discipline for stealing consumers.
+ *
+ * - `dekker`: per-consumer intent words and an O(N) peer survey.
+ * - `ticket`: one monotonic counter; a CAS on the head claims lanes in
+ *   publication order, with no regions and no per-consumer state.
+ */
+export const STEAL_CLAIM_DISCIPLINES = ["dekker", "ticket"];
+/** Disciplines that once existed, so a stale config gets a useful error. */
+const REMOVED_STEAL_CLAIMS = {
+    "cas-mask": "cas-mask was removed; use ticket",
+};
+/**
+ * Validate a claim discipline coming from an untrusted source — an env var, or
+ * a JS caller the type system never saw.
+ *
+ * This throws rather than falling back, because a silent fallback is worse than
+ * a crash here: a stale `cas-mask` setting or a typo would quietly run Dekker,
+ * and every benchmark and test built on it would report Dekker's numbers under
+ * another name. Both sides of a lock must also agree, so an unrecognised value
+ * that resolved differently on host and worker would corrupt the protocol.
+ */
+export const assertStealClaim = (value, source) => {
+    if (typeof value === "string" &&
+        STEAL_CLAIM_DISCIPLINES.includes(value)) {
+        return value;
+    }
+    const hint = typeof value === "string" && REMOVED_STEAL_CLAIMS[value] !== undefined
+        ? ` (${REMOVED_STEAL_CLAIMS[value]})`
+        : "";
+    throw new RangeError(`${source} must be one of ${STEAL_CLAIM_DISCIPLINES.join(", ")}; ` +
+        `got ${JSON.stringify(value)}${hint}`);
+};
+/**
+ * The discipline chosen when nothing selects one. Host and worker default
+ * independently, so this must be a single shared constant: two sides landing on
+ * different disciplines would read the same buffer under different protocols.
+ */
+export const DEFAULT_STEAL_CLAIM = "ticket";
+export const lock2 = ({ headers, headerSlotStrideU32, LockBoundSector, payload, payloadConfig, payloadSector, textCompat, resultList, toSentList, recycleList, processBoundary, sharedReturn, moveReturn, consumers, consumerId, regionLanes, stealClaim, notifyOnHostPublish, notifyHostPublish, traceClaim, }) => {
     // Layout within `lockSectorRegion`:
     // - hostBits starts at byte 0
     // - workerBits starts at byte 64
@@ -306,9 +382,8 @@ export const lock2 = ({ headers, headerSlotStrideU32, LockBoundSector, payload,
     // The remaining two cache lines in the 256-byte sector are reserved for the
     // payload allocator lock (`PAYLOAD_LOCK_*` at bytes 128 and 192).
     //
-    // Important: encode() always toggles `hostBits` and decode/resolveHost always
-    // toggles `workerBits`, regardless of which thread calls them. This is why
-    // the "return lock" (worker->host responses) still publishes into `hostBits`.
+    // encode toggles hostBits; decode/resolveHost toggles workerBits. The return
+    // lock therefore publishes responses through hostBits as well.
     const lockSectorRegion = toSharedBufferRegion(LockBoundSector ??
         createWasmSharedArrayBuffer(LOCK_SECTOR_BYTE_LENGTH));
     const LockBoundSAB = lockSectorRegion.sab;
@@ -335,23 +410,28 @@ export const lock2 = ({ headers, headerSlotStrideU32, LockBoundSector, payload,
         headers: headersRegion,
         payload: payloadSAB,
     });
-    // ---- work stealing (multi-consumer) state ----
-    // With N consumers the pending set is A ^ ACK[0] ^ ... ^ ACK[N-1]; every word
-    // still has exactly one writer, so no shared writable word is introduced.
+    // Work-stealing state. Pending lanes are A ^ ACK[0] ^ ... ^ ACK[N-1].
     const stealConsumers = Math.max(1, (consumers ?? 1) | 0);
     const stealEnabled = stealConsumers > 1;
-    // A lock2 built without `consumerId` is the producer endpoint: it encodes but
-    // never claims. It still frees payload slots, so it needs an acknowledgement
-    // word of its own rather than sharing consumer 0's.
+    // The producer encodes and frees payload slots but never claims a region.
     const stealIsProducer = consumerId === undefined;
     const stealId = (consumerId ?? 0) | 0;
     const stealRegionLanes = (regionLanes ?? 8) | 0;
     const stealRegions = (LockBound.slots / stealRegionLanes) | 0;
+    // Validate before use: an unrecognised value must not degrade to Dekker.
+    const stealClaimResolved = stealClaim === undefined
+        ? DEFAULT_STEAL_CLAIM
+        : assertStealClaim(stealClaim, "stealClaim");
+    const stealTicket = stealClaimResolved === "ticket";
     if (stealEnabled) {
+        if (stealTicket && headersSlotStride % 2 !== 0) {
+            throw new RangeError("ticket headers must have an 8-byte aligned slot stride");
+        }
         if (stealRegionLanes < 1 || (stealRegionLanes & (stealRegionLanes - 1)) !== 0) {
             throw new RangeError("regionLanes must be a power of two");
         }
-        if (stealRegions < stealConsumers) {
+        // Dekker requires at least one region per consumer.
+        if (!stealTicket && stealRegions < stealConsumers) {
             throw new RangeError(`regionLanes=${stealRegionLanes} yields ${stealRegions} regions, ` +
                 `too few for ${stealConsumers} consumers`);
         }
@@ -368,11 +448,41 @@ export const lock2 = ({ headers, headerSlotStrideU32, LockBoundSector, payload,
             STEAL_WANT_SLOT_OFFSET_U32;
     }
     const stealLiveIndex = LockBound.header + STEAL_LIVE_SLOT_OFFSET_U32;
+    /** Head (consumer-CAS) and tail (producer-store) on separate slot lines. */
+    const stealTicketHeadIndex = LockBound.header +
+        STEAL_TICKET_HEAD_SLOT_OFFSET_U32;
+    const stealTicketTailIndex = headersSlotStride + LockBound.header +
+        STEAL_TICKET_HEAD_SLOT_OFFSET_U32;
+    const stealTicketTailWord = stealEnabled && stealTicket
+        ? new Int32Array(headersRegion.sab, headersRegion.byteOffset + stealTicketTailIndex * Int32Array.BYTES_PER_ELEMENT, 1)
+        : undefined;
+    const stealTicketView = stealEnabled && stealTicket
+        ? new BigInt64Array(headersRegion.sab, headersRegion.byteOffset, headersRegion.byteLength >>> 3)
+        : undefined;
+    const stealTicketHead64 = stealTicketHeadIndex >>> 1;
+    const stealTicketOrderIndex = new Int32Array(LockBound.slots);
+    for (let slot = 0; slot < LockBound.slots; slot++) {
+        stealTicketOrderIndex[slot] = (slot * headersSlotStride) +
+            LockBound.header + STEAL_TICKET_ORDER_SLOT_OFFSET_U32;
+    }
+    /** A claimant drains at most one region's worth of tickets per CAS. */
+    const stealTicketBatch = stealRegionLanes;
+    const stealTicketSlots = new Int32Array(stealTicketBatch);
+    const stealTicketPublish = stealEnabled && stealIsProducer && stealTicket;
+    /** Producer-private shadow of the tail; the producer is its only writer. */
+    let stealTicketTail = 0 | 0;
+    /** At most 32 tickets can be staged, so equality is safe across uint32 wrap. */
+    let stealTicketPublishedTail = 0 | 0;
     const stealAllLiveMask = stealConsumers === 32
         ? -1
         : ((1 << stealConsumers) - 1) | 0;
     if (stealEnabled && stealIsProducer) {
         Atomics.store(stealView, stealLiveIndex, stealAllLiveMask);
+        // A carpet can outlive one pool on a reused buffer; never inherit owners.
+        if (stealTicket) {
+            Atomics.store(stealTicketView, stealTicketHead64, 0n);
+            Atomics.store(stealTicketTailWord, 0, 0);
+        }
     }
     const stealIsLive = (mask, consumer) => (mask & (1 << consumer)) !== 0;
     let promiseHandler;
@@ -391,6 +501,8 @@ export const lock2 = ({ headers, headerSlotStrideU32, LockBoundSector, payload,
         lockSector: payloadLockRegion,
         textCompat: resolvedTextCompat,
         processBoundary,
+        sharedReturn,
+        moveReturn,
         onPromise: (task, isRejected, value) => {
             if ((task[TASK_LOCAL_FLAGS_INDEX] & TASK_LOCAL_PROMISE_TRACKED_FLAG) !==
                 0 &&
@@ -422,9 +534,9 @@ export const lock2 = ({ headers, headerSlotStrideU32, LockBoundSector, payload,
     const resolved = resultList ?? new RingQueue();
     let deferredCount = 0 | 0;
     let pendingPromiseCount = 0 | 0;
-    // Atomics aliases (hot path)
     const a_load = Atomics.load;
     const a_store = Atomics.store;
+    const a_compareExchange = Atomics.compareExchange;
     const a_notify = Atomics.notify;
     const shouldNotifyHostPublish = notifyOnHostPublish === true;
     const a_waitAsync = typeof Atomics.waitAsync === "function"
@@ -432,14 +544,13 @@ export const lock2 = ({ headers, headerSlotStrideU32, LockBoundSector, payload,
         : undefined;
     // Sender-side cached shadow of the receiver-owned queue word. Under the XSC
     // false-busy-only sender-side staleness property, this may hide newly freed
-    // lanes but cannot make a genuinely pending lane appear free. Refresh only
+    // lanes but cannot make a pending lane appear free. Refresh only
     // when the cached free set is exhausted.
     let workerShadow = 0 | 0;
     // Under stealing, workerBits also records retired lanes.
     const refreshWorkerShadow = () => workerShadow = a_load(workerBits, 0) | 0;
     refreshWorkerShadow();
     const ensureSenderStateHasFree = (state) => (~state) !== 0 ? state : (LastLocal ^ refreshWorkerShadow()) | 0;
-    // RingQueue method aliases (hot path)
     const toBeSentPush = (task) => toBeSent.push(task);
     const toBeSentShift = () => toBeSent.shiftNoClear();
     const toBeSentUnshift = (task) => toBeSent.unshift(task);
@@ -476,83 +587,93 @@ export const lock2 = ({ headers, headerSlotStrideU32, LockBoundSector, payload,
     const encodeManyFrom = (list) => {
         let state = ensureSenderStateHasFree((LastLocal ^ workerShadow) | 0);
         let encoded = 0 | 0;
-        if (list === toBeSent) {
-            while (true) {
-                const task = toBeSentShift();
-                if (!task)
-                    break;
-                state = ensureSenderStateHasFree(state);
-                const bit = encodeWithState(task, state) | 0;
-                if (bit === 0) {
-                    toBeSentUnshift(task);
-                    break;
+        try {
+            if (list === toBeSent) {
+                while (true) {
+                    const task = toBeSentShift();
+                    if (!task)
+                        break;
+                    state = ensureSenderStateHasFree(state);
+                    const bit = encodeWithState(task, state) | 0;
+                    if (bit === 0) {
+                        toBeSentUnshift(task);
+                        break;
+                    }
+                    state = (state ^ bit) | 0;
+                    encoded = (encoded + 1) | 0;
                 }
-                state = (state ^ bit) | 0;
-                encoded = (encoded + 1) | 0;
             }
-        }
-        else {
-            while (true) {
-                const task = list.shiftNoClear();
-                if (!task)
-                    break;
-                state = ensureSenderStateHasFree(state);
-                const bit = encodeWithState(task, state) | 0;
-                if (bit === 0) {
-                    list.unshift(task);
-                    break;
+            else {
+                while (true) {
+                    const task = list.shiftNoClear();
+                    if (!task)
+                        break;
+                    state = ensureSenderStateHasFree(state);
+                    const bit = encodeWithState(task, state) | 0;
+                    if (bit === 0) {
+                        list.unshift(task);
+                        break;
+                    }
+                    state = (state ^ bit) | 0;
+                    encoded = (encoded + 1) | 0;
                 }
-                state = (state ^ bit) | 0;
-                encoded = (encoded + 1) | 0;
             }
+            return encoded;
+        }
+        finally {
+            flushTicketTail();
         }
-        return encoded;
     };
     const encodeManyTrackedFrom = (list) => {
         let state = ensureSenderStateHasFree((LastLocal ^ workerShadow) | 0);
         let encoded = 0 | 0;
         deferredCount = 0 | 0;
-        if (list === toBeSent) {
-            while (true) {
-                const task = toBeSentShift();
-                if (!task)
-                    break;
-                state = ensureSenderStateHasFree(state);
-                const bit = encodeWithState(task, state) | 0;
-                if (bit === 0) {
-                    if (isPromisePayloadPending(task)) {
-                        deferredCount = (deferredCount + 1) | 0;
-                        trackDeferredTask(task);
-                        continue;
+        try {
+            if (list === toBeSent) {
+                while (true) {
+                    const task = toBeSentShift();
+                    if (!task)
+                        break;
+                    state = ensureSenderStateHasFree(state);
+                    const bit = encodeWithState(task, state) | 0;
+                    if (bit === 0) {
+                        if (isPromisePayloadPending(task)) {
+                            deferredCount = (deferredCount + 1) | 0;
+                            trackDeferredTask(task);
+                            continue;
+                        }
+                        toBeSentUnshift(task);
+                        break;
                     }
-                    toBeSentUnshift(task);
-                    break;
+                    state = (state ^ bit) | 0;
+                    encoded = (encoded + 1) | 0;
                 }
-                state = (state ^ bit) | 0;
-                encoded = (encoded + 1) | 0;
             }
-        }
-        else {
-            while (true) {
-                const task = list.shiftNoClear();
-                if (!task)
-                    break;
-                state = ensureSenderStateHasFree(state);
-                const bit = encodeWithState(task, state) | 0;
-                if (bit === 0) {
-                    if (isPromisePayloadPending(task)) {
-                        deferredCount = (deferredCount + 1) | 0;
-                        trackDeferredTask(task);
-                        continue;
+            else {
+                while (true) {
+                    const task = list.shiftNoClear();
+                    if (!task)
+                        break;
+                    state = ensureSenderStateHasFree(state);
+                    const bit = encodeWithState(task, state) | 0;
+                    if (bit === 0) {
+                        if (isPromisePayloadPending(task)) {
+                            deferredCount = (deferredCount + 1) | 0;
+                            trackDeferredTask(task);
+                            continue;
+                        }
+                        list.unshift(task);
+                        break;
                     }
-                    list.unshift(task);
-                    break;
+                    state = (state ^ bit) | 0;
+                    encoded = (encoded + 1) | 0;
                 }
-                state = (state ^ bit) | 0;
-                encoded = (encoded + 1) | 0;
             }
+            return encoded;
+        }
+        finally {
+            flushTicketTail();
         }
-        return encoded;
     };
     const encodeAll = () => {
         if (toBeSent.isEmpty)
@@ -561,11 +682,28 @@ export const lock2 = ({ headers, headerSlotStrideU32, LockBoundSector, payload,
         deferredCount = 0 | 0;
         return toBeSent.isEmpty;
     };
+    const notifyHostPublication = () => {
+        if (a_compareExchange(doorbellArmed, 0, DOORBELL_ARMED, DOORBELL_SIGNALLED) === DOORBELL_ARMED) {
+            if (notifyHostPublish !== undefined) {
+                try {
+                    notifyHostPublish();
+                }
+                catch {
+                    // A callback can be unavailable after forced worker teardown. Restore
+                    // the arm only when it still belongs to this publication, so a later
+                    // result can retry without overwriting a host-side disarm/re-arm.
+                    a_compareExchange(doorbellArmed, 0, DOORBELL_SIGNALLED, DOORBELL_ARMED);
+                }
+            }
+            else {
+                a_notify(hostBits, 0, 1);
+            }
+        }
+    };
     const storeHost = (bit) => {
         a_store(hostBits, 0, LastLocal = (LastLocal ^ bit) | 0);
-        if (shouldNotifyHostPublish && a_load(doorbellArmed, 0) !== 0) {
-            a_notify(hostBits, 0, 1);
-        }
+        if (shouldNotifyHostPublish)
+            notifyHostPublication();
     };
     const storeWorker = (bit) => a_store(workerBits, 0, LastWorker = (LastWorker ^ bit) | 0);
     const encode = (task, state = (LastLocal ^ workerShadow) | 0) => {
@@ -576,7 +714,12 @@ export const lock2 = ({ headers, headerSlotStrideU32, LockBoundSector, payload,
         if (!encodeTaskValue(task, selectedSlotIndex = 31 - clz32(free))) {
             return false;
         }
-        return encodeAt(task, selectedSlotIndex, selectedSlotBit = 1 << selectedSlotIndex);
+        try {
+            return encodeAt(task, selectedSlotIndex, selectedSlotBit = 1 << selectedSlotIndex);
+        }
+        finally {
+            flushTicketTail();
+        }
     };
     const encodeTracked = (task, state = (LastLocal ^ workerShadow) | 0) => {
         deferredCount = 0 | 0;
@@ -591,7 +734,12 @@ export const lock2 = ({ headers, headerSlotStrideU32, LockBoundSector, payload,
             }
             return false;
         }
-        return encodeAt(task, selectedSlotIndex, selectedSlotBit = 1 << selectedSlotIndex);
+        try {
+            return encodeAt(task, selectedSlotIndex, selectedSlotBit = 1 << selectedSlotIndex);
+        }
+        finally {
+            flushTicketTail();
+        }
     };
     const encodeAt = (task, at, bit) => {
         const off = (at * headersSlotStride) + slotBaseU32;
@@ -603,13 +751,40 @@ export const lock2 = ({ headers, headerSlotStrideU32, LockBoundSector, payload,
         headersBuffer[off + 5] = task[5];
         headersBuffer[off + 6] = task[6];
         headersBuffer[off + TASK_LOCAL_FLAGS_INDEX] = 0;
+        if (stealTicketPublish) {
+            // The tail's seq-cst store publishes the header, ring cell and host bit
+            // together. Ticket consumers acquire the tail before reading a lane;
+            // unlike region consumers, they never arbitrate through hostBits.
+            stealView[stealTicketOrderIndex[stealTicketTail & STEAL_TICKET_RING_MASK]] = at;
+            stealTicketTail = (stealTicketTail + 1) | 0;
+            if (shouldNotifyHostPublish) {
+                a_store(hostBits, 0, LastLocal = (LastLocal ^ bit) | 0);
+            }
+            else {
+                hostBits[0] = LastLocal = (LastLocal ^ bit) | 0;
+            }
+            // The tail store is deferred so a burst pays one atomic, not one each.
+            // Nothing is claimable until it lands, which is what makes the batch
+            // atomic; every exit from an encode path must flush, including throws.
+            return true;
+        }
         storeHost(bit);
         return true;
     };
-    const hasSpace = () => (hostBits[0] ^ LastWorker) !== 0;
     /**
-     * WORKER SIDE: decode
+     * Publish accumulated tickets. Consumers cannot see any lane of the batch
+     * until this store lands, so skipping it strands the slots forever.
      */
+    const flushTicketTail = () => {
+        if (stealTicketPublishedTail === stealTicketTail)
+            return;
+        stealTicketPublishedTail = stealTicketTail;
+        a_store(stealTicketTailWord, 0, stealTicketTail);
+        // A notifier must not run while its tickets are still invisible.
+        if (shouldNotifyHostPublish)
+            notifyHostPublication();
+    };
+    const hasSpace = () => (hostBits[0] ^ LastWorker) !== 0;
     const decode = () => {
         let diff = (a_load(hostBits, 0) ^ LastWorker) | 0;
         if (diff === 0)
@@ -640,21 +815,21 @@ export const lock2 = ({ headers, headerSlotStrideU32, LockBoundSector, payload,
         lastTake = last;
         return true;
     };
-    /**
-     * WORKER SIDE: decode, region-Dekker stealing variant.
-     *
-     * Claims one whole region of `stealRegionLanes` lanes per handshake, so the
-     * StoreLoad barrier is amortised over the region rather than paid per task.
-     * Priority is fixed by endpoint id: a junior withdraws for a senior, so at
-     * most one consumer ever acknowledges a published generation.
-     *
-     * The C reference needs an explicit mfence between the intent store and the
-     * peer loads. `Atomics.store` is sequentially consistent in JS, so that
-     * barrier is implicit here and holds on x86 and ARM alike.
-     */
     const stealLaneMask = (region) => stealRegionLanes === 32
         ? -1
         : ((((1 << stealRegionLanes) - 1) << (region * stealRegionLanes)) | 0);
+    const stealRegionBits = stealRegionLanes === 32
+        ? -1
+        : ((1 << stealRegionLanes) - 1) | 0;
+    /** Find the oldest pending lane in a claimed region. */
+    const stealOldestLane = (region, take) => {
+        const low = (region * stealRegionLanes) | 0;
+        const lanes = ((take >>> low) & stealRegionBits) | 0;
+        const predecessors = ((lanes >>> 1) | (lanes << (stealRegionLanes - 1))) & stealRegionBits;
+        const oldest = (lanes & ~predecessors) | 0;
+        return low +
+            (oldest === 0 ? stealRegionLanes - 1 : 31 - clz32(oldest >>> 0));
+    };
     const stealJuniorWants = (intent) => {
         const live = a_load(stealView, stealLiveIndex) | 0;
         for (let c = stealId + 1; c < stealConsumers; c++) {
@@ -667,6 +842,7 @@ export const lock2 = ({ headers, headerSlotStrideU32, LockBoundSector, payload,
     };
     const stealHome = ((stealRegions * stealId) / stealConsumers) | 0;
     let stealCursor = stealHome;
+    /** Decode one region using the Dekker claim protocol. */
     const decodeSteal = () => {
         // workerBits includes retired lanes under stealing.
         const pending = (a_load(hostBits, 0) ^ a_load(workerBits, 0)) | 0;
@@ -682,6 +858,8 @@ export const lock2 = ({ headers, headerSlotStrideU32, LockBoundSector, payload,
             }
         }
         const liveBeforeClaim = a_load(stealView, stealLiveIndex) | 0;
+        // Prefer regions no live peer currently wants; the handshake below provides
+        // the actual mutual exclusion.
         let peerIntent = 0 | 0;
         let seniorIntent = 0 | 0;
         for (let c = 0; c < stealConsumers; c++) {
@@ -709,59 +887,198 @@ export const lock2 = ({ headers, headerSlotStrideU32, LockBoundSector, payload,
             return false;
         const intent = (1 << region) | 0;
         a_store(stealView, stealWantIndex[stealId], intent);
-        // Dekker StoreLoad: implicit, `Atomics.store` above is seq-cst.
+        // Atomics.store is sequentially consistent, so it supplies the StoreLoad
+        // barrier required by Dekker.
+        // A senior claimant has priority.
         let seniorConflict = false;
-        let juniorConflict = false;
-        for (let c = 0; c < stealConsumers; c++) {
-            if (c === stealId || !stealIsLive(liveBeforeClaim, c))
+        for (let c = 0; c < stealId; c++) {
+            if (!stealIsLive(liveBeforeClaim, c))
                 continue;
-            if ((a_load(stealView, stealWantIndex[c]) & intent) === 0)
-                continue;
-            if (c < stealId)
+            if ((a_load(stealView, stealWantIndex[c]) & intent) !== 0) {
                 seniorConflict = true;
-            else
-                juniorConflict = true;
+                break;
+            }
         }
         if (seniorConflict) {
             a_store(stealView, stealWantIndex[stealId], 0);
             return false;
         }
+        let juniorConflict = false;
+        for (let c = stealId + 1; c < stealConsumers; c++) {
+            if (!stealIsLive(liveBeforeClaim, c))
+                continue;
+            if ((a_load(stealView, stealWantIndex[c]) & intent) !== 0) {
+                juniorConflict = true;
+                break;
+            }
+        }
         if (juniorConflict) {
             while (stealJuniorWants(intent)) { /* junior withdraws */ }
         }
-        // Last control loads before ownership. After this no control word is read
-        // until every slot in `take` has been decoded.
+        // No control word is read again until all selected slots are decoded.
         const take = ((a_load(hostBits, 0) ^ a_load(workerBits, 0)) &
             stealLaneMask(region)) | 0;
         if (take === 0) {
             a_store(stealView, stealWantIndex[stealId], 0);
             return false;
         }
-        // Retire decoded lanes and release the region even if decoding throws.
+        // Retire lanes and release the claim even if decoding throws.
         let lanes = take;
         let done = 0 | 0;
+        // Decode the claimed lanes in producer order.
+        let at = stealOldestLane(region, take);
+        const regionLow = (region * stealRegionLanes) | 0;
+        const regionHigh = (regionLow + stealRegionLanes - 1) | 0;
         try {
-            while (lanes !== 0) {
-                const bit = (lanes & -lanes) | 0;
-                decodeAt(31 - clz32(bit >>> 0));
-                lanes = (lanes & (lanes - 1)) | 0;
-                done = (done ^ bit) | 0;
+            for (let step = 0; step < stealRegionLanes; step++) {
+                const bit = (1 << at) | 0;
+                if ((lanes & bit) !== 0) {
+                    decodeAt(at);
+                    lanes = (lanes ^ bit) | 0;
+                    done = (done ^ bit) | 0;
+                    if (lanes === 0)
+                        break;
+                }
+                at = at === regionLow ? regionHigh : at - 1;
             }
         }
         finally {
-            // ACK before clearing intent.
+            // Publish the ACK before clearing intent.
             LastWorker = (LastWorker ^ done) | 0;
             if (done !== 0)
                 Atomics.xor(workerBits, 0, done);
             a_store(stealView, stealWantIndex[stealId], 0);
-            // Restart from this consumer's home region.
             stealCursor = stealHome;
+            // Maybe in the future
+            // stealCursor = (region + 1) % stealRegions;
         }
         return true;
     };
     /**
-     * HOST SIDE: decode version
+     * Claim tickets from one monotonic counter.
+     *
+     * The ticket is the arbiter and the FIFO order at once: a winning CAS owns
+     * lanes nobody else can name, so there are no regions, no intent words, no
+     * peer survey and no liveness mask. An idle poll costs two loads and no RMW.
      */
+    const decodeStealTicket = () => {
+        for (let attempt = 0; attempt < STEAL_TICKET_ATTEMPTS; attempt++) {
+            const head = Atomics.load(stealTicketView, stealTicketHead64);
+            if (head === STEAL_TICKET_FAILED)
+                return false;
+            const lowHead = Number(head & STEAL_TICKET_LOW_MASK);
+            const available = (a_load(stealTicketTailWord, 0) - lowHead) >>> 0;
+            if (available === 0)
+                return false;
+            // A valid head has at most 32 published tickets ahead of it. Larger
+            // distances are stale snapshots; the 64-bit head is still the arbiter.
+            if (available > LockBound.slots)
+                continue;
+            const batch = Math.min(available, stealTicketBatch);
+            const next = head + BigInt(batch);
+            if (next > STEAL_TICKET_LIMIT) {
+                Atomics.store(stealTicketView, stealTicketHead64, STEAL_TICKET_FAILED);
+                throw new RangeError("ticket queue exhausted its 64-bit sequence");
+            }
+            const ringHead = lowHead & STEAL_TICKET_RING_MASK;
+            // Read the lane ids *before* the CAS. Cell `head & 31` cannot be refilled
+            // while the head still sits at `head` (refilling it needs a free slot,
+            // which needs a retire, which needs a claim), but once the CAS moves the
+            // head past a ticket the producer may reuse that cell immediately.
+            for (let i = 0; i < batch; i++) {
+                stealTicketSlots[i] = stealView[stealTicketOrderIndex[(ringHead + i) & STEAL_TICKET_RING_MASK]] & STEAL_TICKET_RING_MASK;
+            }
+            if (Atomics.compareExchange(stealTicketView, stealTicketHead64, head, next) !== head)
+                continue;
+            let done = 0 | 0;
+            try {
+                for (let i = 0; i < batch; i++) {
+                    const at = stealTicketSlots[i];
+                    decodeAt(at);
+                    done = (done ^ (1 << at)) | 0;
+                }
+            }
+            catch (error) {
+                // Decoding may already have consumed payload state. Replaying the
+                // unfinished batch is unsafe; report the fatal error and stop claims.
+                Atomics.store(stealTicketView, stealTicketHead64, STEAL_TICKET_FAILED);
+                throw error;
+            }
+            finally {
+                LastWorker = (LastWorker ^ done) | 0;
+                if (done !== 0)
+                    Atomics.xor(workerBits, 0, done);
+            }
+            return true;
+        }
+        return false;
+    };
+    /**
+     * Debug-only wrapper around a steal claim, for the `steal` namespace.
+     *
+     * It is selected once, when `decode` is chosen below, so an untraced lock
+     * hands out the bare claim function: no flag test, no extra load, no change
+     * to the claim path. Everything reported is read from outside the claim,
+     * before and after it, so the wrapper cannot perturb the protocol either.
+     *
+     * - `lanes`: in ticket order for `ticket`, ascending for `dekker`.
+     * - `head`: ticket head before and after. `peers` is how many tickets other
+     *   consumers took in between; 0 means `head` spans exactly this claim.
+     * - `region`/`home`: `dekker` only; `steal` marks a region off this
+     *   consumer's home.
+     * - `lost`: polls since the last claim that saw work and still came back
+     *   empty, i.e. a peer got there first.
+     */
+    const traceStealClaims = (claim, trace) => {
+        let lost = 0;
+        return () => {
+            const before = LastWorker;
+            let head = 0n;
+            let visible = 0;
+            if (stealTicket) {
+                head = Atomics.load(stealTicketView, stealTicketHead64);
+                if (head !== STEAL_TICKET_FAILED) {
+                    visible = (a_load(stealTicketTailWord, 0) -
+                        Number(head & STEAL_TICKET_LOW_MASK)) >>> 0;
+                }
+            }
+            else {
+                visible = (a_load(hostBits, 0) ^ a_load(workerBits, 0)) | 0;
+            }
+            if (!claim()) {
+                if (visible !== 0)
+                    lost++;
+                return false;
+            }
+            const taken = (LastWorker ^ before) | 0;
+            let count = 0;
+            for (let bits = taken; bits !== 0; bits &= bits - 1)
+                count++;
+            let message;
+            if (stealTicket) {
+                const after = Atomics.load(stealTicketView, stealTicketHead64);
+                const lanes = [];
+                for (let i = 0; i < count; i++)
+                    lanes.push(stealTicketSlots[i]);
+                message = `claim count=${count} lanes=${lanes.join(",")}` +
+                    ` head=${head}→${after} peers=${Number(after - head) - count}`;
+            }
+            else {
+                const lanes = [];
+                for (let lane = 0; lane < LockBound.slots; lane++) {
+                    if ((taken & (1 << lane)) !== 0)
+                        lanes.push(lane);
+                }
+                const region = (lanes[0] / stealRegionLanes) | 0;
+                message = `claim count=${count} lanes=${lanes.join(",")}` +
+                    ` region=${region} home=${stealHome}` +
+                    (region === stealHome ? "" : " steal");
+            }
+            trace(`${message} lost=${lost}`);
+            lost = 0;
+            return true;
+        };
+    };
     const resolveHost = ({ queue, onResolved, shouldSettle, activeRejectPlaceholder, }) => {
         const getTask = takeTask({ queue });
         let lastResolved = 32;
@@ -887,27 +1204,21 @@ export const lock2 = ({ headers, headerSlotStrideU32, LockBoundSector, payload,
             return modified;
         };
     };
-    /**
-     * HOST SIDE: wait until the producer changes hostBits.
-     *
-     * LastWorker is the host's acknowledgement shadow. Passing it as the
-     * expected value makes the arm race-free: a publication between the drain
-     * and this call returns `not-equal` synchronously instead of being lost.
-    */
+    /** Wait for a producer publication without losing an intervening wakeup. */
     const waitForHostChange = (timeoutMs) => {
         if (a_waitAsync === undefined) {
-            a_store(doorbellArmed, 0, 0);
+            a_store(doorbellArmed, 0, DOORBELL_OFF);
             return undefined;
         }
-        a_store(doorbellArmed, 0, 1);
+        a_store(doorbellArmed, 0, DOORBELL_ARMED);
         try {
             const wait = a_waitAsync(hostBits, 0, LastWorker | 0, timeoutMs);
             if (!wait.async)
-                a_store(doorbellArmed, 0, 0);
+                a_store(doorbellArmed, 0, DOORBELL_OFF);
             return wait;
         }
         catch {
-            a_store(doorbellArmed, 0, 0);
+            a_store(doorbellArmed, 0, DOORBELL_OFF);
             // Some runtimes reject particular SharedArrayBuffer implementations
             // (for example a growable or native-backed buffer). Fall back to the
             // existing dispatcher rather than turning a capability issue into a
@@ -915,6 +1226,18 @@ export const lock2 = ({ headers, headerSlotStrideU32, LockBoundSector, payload,
             return undefined;
         }
     };
+    /**
+     * Arm a native host notifier with the same no-lost-wakeup property as
+     * waitAsync: a publication before or during the arm is observed directly,
+     * while one after the observation sees the shared armed bit and rings.
+     */
+    const armHostNotifier = () => {
+        a_store(doorbellArmed, 0, DOORBELL_ARMED);
+        if (a_load(hostBits, 0) === (LastWorker | 0))
+            return true;
+        a_store(doorbellArmed, 0, DOORBELL_OFF);
+        return false;
+    };
     const decodeAt = (at) => {
         const off = (at * headersSlotStride) + slotBaseU32;
         const recycled = recycleShift();
@@ -972,6 +1295,11 @@ export const lock2 = ({ headers, headerSlotStrideU32, LockBoundSector, payload,
         }
         const bit = 1 << id;
         const previous = Atomics.and(stealView, stealLiveIndex, ~bit);
+        if (stealTicket) {
+            // No durable ownership record exists for a dead claimant. The host must
+            // close the shared pending registry instead of reusing this queue.
+            Atomics.store(stealTicketView, stealTicketHead64, STEAL_TICKET_FAILED);
+        }
         return (previous & bit) !== 0;
     };
     return {
@@ -981,7 +1309,12 @@ export const lock2 = ({ headers, headerSlotStrideU32, LockBoundSector, payload,
         encodeAll,
         publish,
         flushPending,
-        decode: stealEnabled ? decodeSteal : decode,
+        // Chosen once: an untraced lock gets the claim function itself.
+        decode: stealEnabled
+            ? (traceClaim === undefined
+                ? (stealTicket ? decodeStealTicket : decodeSteal)
+                : traceStealClaims(stealTicket ? decodeStealTicket : decodeSteal, traceClaim))
+            : decode,
         hasSpace,
         resolved,
         hostBits,
@@ -989,8 +1322,9 @@ export const lock2 = ({ headers, headerSlotStrideU32, LockBoundSector, payload,
         recyclecList,
         resolveHost,
         waitForHostChange,
+        armHostNotifier,
         setHostWaiterArmed: (armed) => {
-            a_store(doorbellArmed, 0, armed ? 1 : 0);
+            a_store(doorbellArmed, 0, armed ? DOORBELL_ARMED : DOORBELL_OFF);
         },
         hasPendingFrames: () => toBeSent.size !== 0,
         getPendingFrameCount: () => toBeSent.size | 0,