Reuse restricted engines with fresh invocation state and revocable ports

restricted-execution/worker.mjs

@@ -1,5 +1,7 @@
 // Platform entrypoint, evaluated before loading the authored registry. A fresh
-// engine process owns exactly one frame. BROKER grants only that frame's ports.
+// Worker owns exactly one frame. The parent engine is reusable; BROKER's host
+// token grants only this frame and expires before the next invocation.
+const monotonic = performance.now.bind(performance);
 const deny = () => {
   throw Error("RESTRICTED_AMBIENT_ACCESS");
 };
@@ -48,7 +50,9 @@ export default {
     if (used) return new Response("FRAME_EXPIRED", { status: 409 });
     used = true;
     const input = await request.json();
+    const loading = monotonic();
     const source = await import("./package.mjs");
+    const initializationMs = monotonic() - loading;
     const registry = source[env.CONFIG.registryExport];
     if (
       !registry ||
@@ -59,7 +63,7 @@ export default {
     let open = true;
     const channel = async (value) => {
       if (!open) throw Error("EXPIRED_CONTEXT");
-      const response = await env.BROKER.fetch("http://frame/port", {
+      const response = await env.BROKER.fetch("http://frame/port/" + env.CONFIG.frameToken, {
         method: "POST",
         body: JSON.stringify(value),
       });
@@ -71,6 +75,7 @@ export default {
         });
       return result.output;
     };
+    const running = monotonic();
     try {
       const output = await registry.invoke(
         { exportId: input.exportId, workspace: input.workspace, receiver: input.receiver, input: input.input },
@@ -78,7 +83,13 @@ export default {
       );
       const body = JSON.stringify({ status: "returned", output });
       if (new TextEncoder().encode(body).length > env.CONFIG.maxBytes) throw Error("RESTRICTED_OUTPUT_LIMIT");
-      return new Response(body, { headers: { "content-type": "application/json" } });
+      return new Response(body, {
+        headers: {
+          "content-type": "application/json",
+          "x-quixos-initialization-ms": String(initializationMs),
+          "x-quixos-execution-ms": String(monotonic() - running),
+        },
+      });
     } catch (error) {
       // Only authored/codec rejection codes cross the engine boundary. Engine
       // diagnostics stay private to the supervisor, never become protocol data.