cluster: port Node's cluster and child_process handle-passing suites (+43 upstream tests; cluster 54 → 85) and implement what they expose — round-robin fd handoff, SCHED_NONE shared handles, UDP clustering, IPC handle passing

[cirospaciari]

Brings node:cluster in line with Node v26.3.0 by porting the upstream cluster suite verbatim and implementing the runtime machinery the tests expose as missing — until now workers silently bound their own sockets, so nothing was actually shared. IPC handle passing (process.send(msg, handle)) is implemented on the way, since round-robin scheduling is built on it, and the upstream child_process tests that exercise it are ported too.

vendored suite	before	after
test-cluster-* (parallel + sequential)	54 files	85 files, 85/85 passing (31 added, 14 re-synced to v26.3.0)
test-child-process-* handle passing / fork	—	12 added (fork-net-server, fork-net-socket, send-keep-open, pass-fd, internal, advanced-serialization framing, …)

In total 43 upstream tests are added (31 cluster + 12 child_process) and 15 existing ones re-synced, alongside ~41 new Bun-side test cases (cluster.test.ts, the new child_process_ipc_handle.test.ts, child_process.test.ts, node-net.test.ts, spawn.ipc.bun-node.test.ts). Numbers are local debug-build sweeps (Linux and macOS). Every vendored file is byte-identical to upstream; test/expectations.txt is untouched.

Behavior changes

• Real round-robin scheduling (SCHED_RR): the primary owns the listen socket, accepts with reads paused (bytes stay in the kernel buffer, so data that arrives before the worker attaches is not lost), and hands each accepted fd to a worker over the IPC channel as SCM_RIGHTS ancillary data. Workers adopt Node's faux listen handle — ref()/unref() via timer, idempotent close(), getsockname from the primary's cached sockname — instead of binding their own socket. newconn/accepted replies, redistribution when a worker declines, and the maxConnections accept check match Node. Beyond Node: a connection that was in flight to a worker that crashed is handed to another worker instead of being leaked; after a graceful disconnect the primary just drops its copy; a live worker's act:close leaves the connection to its ack exactly as Node does. A peer that resets a queued connection no longer crashes the primary.
• SCHED_NONE / shared handles: the primary binds (never listens) via a new native bind-only path, ships the fd to every worker that asks, and each worker does its own listen(2) on the duplicated fd (new us_socket_group_listen_fd, which validates before touching the descriptor's flags). Bind errnos are captured once and replayed to every worker (EADDRINUSE arrives as an 'error' event with Node's ExceptionWithHostPort shape). server.close() in a worker releases its share immediately, so the same worker can re-listen; server.address() reports the shared unix path; abstract-namespace names bind with the exact length. A user-supplied listen({ fd }) is validated the way Node's createServerHandle does — anything that cannot serve (non-sockets, connected stream sockets such as a spawned process's stdio, datagram sockets) is EINVAL, and the primary's own descriptor is left alone.
• UDP clustering: dgram sockets in workers route non-exclusive binds through the primary's shared handle (UDP is never round-robin), including bind({ fd }); new native UDP-from-fd adoption (us_create_udp_socket_from_fd) and a UDPSocket.fd getter back it. A worker that fails to adopt the shared fd releases it.
• cluster._getServer query tuples match Node's listenInCluster: pipes query as (path, -1, -1), fds as (null, null, null), listen(port, host) carries the real address/family, and reusePort: true forces exclusive (net and dgram) so each worker binds its own SO_REUSEPORT socket. Primary handle keys only get the per-listen :index suffix for port-0 listens, so fixed ports/pipes/fds share one handle across workers. http.Server.listen() in a worker reports listening to the primary (and stays quiet in a child that merely inherited NODE_UNIQUE_ID without a channel).
• IPC handle passing (child.send / process.send / worker.send with a handle): net.Socket, net.Server and dgram.Socket handles cross the channel (fd via SCM_RIGHTS, the NODE_HANDLE ack protocol that already existed in the wire layer; the JS serialize/parse halves were stubs). Semantics follow lib/internal/child_process.js: a sent net.Socket is detached from the sender (no 'end'/'close' there, server connection count decremented) unless keepOpen; TLS sockets are rejected with ERR_INVALID_HANDLE_TYPE; a received handle that lands on fd 0 is adopted; a handle that arrives right before the channel's EOF is still delivered; a send that fails after detaching closes the native socket; owned descriptors are released even when they were allocated at 0–2. disconnect() reports disconnected at once (later send() fails, a second disconnect() errors) but, as in Node, the close waits for the messages queued behind a handle that is still awaiting its ack — only user-initiated disconnects wait; a dead peer or exit closes immediately.
• NODE_-prefixed messages ({ cmd: "NODE_…" }) are routed to 'internalMessage' on both ends, as Node documents; this applies to Bun.spawn({ ipc }) children too.
• Windows handle transfer: sockets cross processes with WSADuplicateSocketW — the exported WSAPROTOCOL_INFOW rides along with the IPC message and the receiver imports it. Pipe and UDP shared binds report ENOTSUP on Windows rather than pretending to work.
• fork() from a parent whose stdio slot is closed gives the child /dev/null for that slot (libuv's behaviour). The plain inherit action captured whatever descriptor was created next — the IPC socketpair's parent end — so the child held its own channel open and never saw disconnect().
• child_process stdio accepts fs write streams (their fd is taken from the stream's sink), and passing a stream with no descriptor gives a clear error instead of a TODO.
• internal/cluster/round_robin_handle and internal/test/binding (a udp_wrap.UDP bind/fd shim) resolve for the vendored --expose-internals tests, gated exactly like bun:internal-for-testing.
• Stale-listen protection (listeningId) so a listen() superseded before the primary replies closes the late handle instead of adopting it. server.blockList rejections under round-robin are closed silently ('drop' is for maxConnections), as in Node.

Bun-side tests

test/js/node/cluster.test.ts (+~1000 lines: scheduling, shared handles, unix/abstract paths, fd validation, dgram release, mid-handoff crash, early bytes, blockList, …), new test/js/node/child_process/child_process_ipc_handle.test.ts (handle passing semantics: detach, keepOpen, TLS rejection, fd 0, queued handles on channel close, disconnect ordering), plus additions to child_process.test.ts, node-net.test.ts and spawn.ipc.bun-node.test.ts. The latter previously asserted that a received net.Socket handle is rejected — that only held while parseHandle threw; it now asserts that net.Socket and dgram.Socket handles are delivered and that the descriptors are released.

Known limitations / follow-ups

• http/https server connection sockets have no transferable handle in Bun (they are native, like TLS sockets), so child.send(msg, httpSocket) sends the message without the handle — the same path Node takes for a handle-less socket, but Node's http sockets do have one; documenting or throwing like TLS is a follow-up.
• A socket is converted (and detached) when send() is called, not when the message is actually written as in Node, so a socket queued behind an un-acked handle is not reusable if the channel dies first. A late-adopted server/dgram handle is emitted after 'disconnect' where Node emits it before.
• Cluster-internal messages are marked by wire type rather than recognised by the NODE_ prefix on receipt, so a worker that monkey-patches process.send breaks the worker↔primary protocol (works in Node).
• Under round-robin the 'drop' event for maxConnections is emitted without Node's address payload; server.listen({ fd }) on an fd that is already listening resolves rather than failing with EEXIST.
• Pipe and UDP shared binds are not supported on Windows (ENOTSUP); the cluster tests covering them are skipped there. cluster.schedulingPolicy still defaults to SCHED_RR on Windows (Node defaults to SCHED_NONE there); flipping it deserves its own PR now that shared handles work.
• The primary's accepted-socket pause relies on the accept callback running before the first read poll; a uSockets-level accept-paused option would make that structural.
• spawnSync with a closed inherited stdio slot still fails with EBADF (pre-existing; Node aborts on the same input).

---

no test proof · iteration 71 · Platform-specific test(s) that do not run on this machine. Deferring to CI, which covers all platforms: test/js/bun/net/named-pipe-listen-error.test.ts test/js/bun/spawn/spawn.ipc.bun-node.test.ts test/js/node/child_process/child_process_ipc_handle.test.ts test/js/node/cluster.test.ts

[robobun]

^{Updated 9:40 PM PT - Aug 11th, 2026}

✅ @robobun, your commit 478a1a6e5d605e08e7c753cbd285bc4c8f9c18ed passed in Build #92820! 🎉

---

🧪   To try this PR locally:

bunx bun-pr 31829

That installs a local version of the PR into your bun-31829 executable, so you can run:

bun-31829 --bun

[coderabbitai]

Looking for one thing? Review this PR in Change Stack to search files, summaries, diffs, and code without losing your place.

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

Adds uSockets FD-adoption APIs (listener and UDP), exposes FDs to Rust/JS, implements primary-side raw bind and SharedHandle, propagates FDs via IPC (serialize/parse + Windows payloads), updates worker adoption/handle lifecycle and round‑robin accept logic, and adds extensive cluster TCP/UDP tests.

Changes

Cluster FD sharing and Node compatibility

Layer / File(s)	Summary
uSockets C: listener/UDP FD adoption & socket helpers packages/bun-usockets/src/bsd.c, packages/bun-usockets/src/context.c, packages/bun-usockets/src/eventing/libuv.c, packages/bun-usockets/src/internal/networking/bsd.h, packages/bun-usockets/src/internal/internal.h, packages/bun-usockets/src/loop.c, packages/bun-usockets/src/socket.c	Adds C APIs us_socket_group_listen_fd and us_create_udp_socket_from_fd, socket export/import helpers and bsd_create_bound_socket, bsd_recvmmsg(max_packets), us_poll_start_rc, shared_fd flag, and refines socket-from-fd and IPC write error handling.
Rust FFI & runtime socket wrappers src/uws_sys/SocketGroup.rs, src/uws_sys/udp.rs, src/runtime/socket/Listener.rs, src/runtime/socket/udp_socket.rs, src/runtime/socket/sockets.classes.ts	Rust FFI for listen_fd, us_create_udp_socket_from_fd, and us_udp_socket_fd; Listener and UDPSocket paths now support creating/adopting sockets from native FDs and expose JS fd getter.
libusockets public header packages/bun-usockets/src/libusockets.h	Public declarations for UDP-from-FD constructor, UDP fd accessor, and socket-group listen_fd added.
IPC handle serialization and JSC plumbing src/js/builtins/Ipc.ts, src/jsc/ipc.rs	serialize/parseHandle handle net.Server/net.Socket transfer; JSC IPC gains Handle close_on_complete, Windows import/export helpers, $hasHandle/$fd ack/nack flow, and shutdown draining of pending sends.
Runtime IPC host and host bindings src/runtime/ipc_host.rs, src/runtime/node/node_cluster_binding.rs	do_send accepts peer_pid and attaches Windows duplicated-socket payloads; cluster_raw_bind and cluster_close_handle host functions create/close bound sockets for SharedHandle and return {fd,port} or errno.
Primary-side SharedHandle and scheduling src/js/internal/cluster/SharedHandle.ts, src/js/internal/cluster/primary.ts, src/resolve_builtins/HardcodedModule.rs, src/runtime/jsc_hooks.rs, src/js/internal/test/binding.ts, src/js/internal/shared.ts	New SharedHandle stores primary bind {fd,port} or errno, primary uses SharedHandle for SCHED_NONE, registers internal test modules and kClusterOwner symbol, and provides a lightweight internalBinding shim for tests.
Worker adoption and child IPC wiring src/js/internal/cluster/child.ts	Worker synthesizes makeConnectionHandle/makeSharedHandle from $fd, updates newconn and _getServer reply handling, and hardens disconnect logic.
Round‑robin accept distribution src/js/internal/cluster/RoundRobinHandle.ts	Adds listening flag and inFlight tracking, creates paused net server to immediately wrap accepted sockets, and manages in-flight handles until worker ack to avoid leaks/late-acks.
Node net/http/dgram cluster paths src/js/node/net.ts, src/js/node/_http_server.ts, src/js/node/dgram.ts	listenInCluster refactor with shared-handle adoption vs faux RR, socket.server tagging on connection, Server.close preferring stop(false), UDPSocket bind adoption via shared handles, bunBindSocket refactor, and cleanup of state.clusterHandle on close.
SocketConfig platform handling src/runtime/socket/Handlers.rs	Platform-specific Fd conversion for Windows vs non-Windows in generated SocketConfig handling.
Cluster conformance and regression tests test/js/node/test/parallel/*, test/js/node/test/sequential/*	Adds/updates ~50 tests covering TCP/UDP handle transfer, shared vs RR behavior, IPv6, pipe/fd listening, privileged-bind gating, error propagation, lifecycle/ref/unref semantics, acceptance-failure, and many coordination scenarios.

Suggested reviewers:

• alii
• Jarred-Sumner
• RiskyMH

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the PR's main changes, including cluster scheduling, handle passing, and UDP clustering, though it is longer than preferred.
Description check	✅ Passed	The description thoroughly explains the changes, verification results, test coverage, and known limitations, despite not using the template headings exactly.

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Found 9 issues this PR may fix:

1. process sendHandle argument not supported #6743 - PR implements process.send(msg, handle) / worker.send(msg, handle) with net.Socket/net.Server handle passing over IPC via SCM_RIGHTS
2. bun not working with multiple instances an cluster PM2 #12466 - PR fixes cluster socket sharing (SCHED_RR round-robin and SCHED_NONE shared handles) which PM2 cluster mode relies on
3. Bun.serve and node:cluster don't round-robin http requests when listening on unix domain socket #13611 - PR implements real round-robin scheduling (SCHED_RR) where the primary accepts connections and hands fds to workers
4. Bun dont work with cluster #14727 - PR overhauls cluster worker listen/port sharing so workers no longer silently bind their own sockets
5. UDP Cluster not sharing workload #14880 - PR adds UDP clustering support, routing non-exclusive dgram binds through the primary's shared handle
6. Bun Cluster Mode TCP Server in Docker Container - "Failed to listen at" #17762 - PR fixes cluster listen path and handle key generation, addressing "Failed to listen" errors in containerized environments
7. Cluster module freezes on worker disconnect when using unshared TCP servers #20642 - PR adds stale-listen protection and worker faux listen handles, relevant to cluster disconnect handling
8. server.on is undefined in subprocess #31712 - PR implements IPC handle passing so server/socket objects arrive correctly in subprocesses
9. discord-hybrid-sharding error #11330 - PR fixes cluster IPC messaging and handle passing that discord-hybrid-sharding depends on

If this is helpful, copy the block below into the PR description to auto-close these issues on merge.

Fixes #6743
Fixes #12466
Fixes #13611
Fixes #14727
Fixes #14880
Fixes #17762
Fixes #20642
Fixes #31712
Fixes #11330

🤖 Generated with Claude Code

[coderabbitai]

Actionable comments posted: 4

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

src/runtime/socket/udp_socket.rs (1)

586-642: 🧹 Nitpick | 🔵 Trivial | 💤 Low value

Minor: Error message may be misleading for fd-adoption failures.

When create_from_fd fails (returns null), err remains 0 since no error output is passed, so the code falls through to line 642's "Failed to bind socket" message. This is technically inaccurate since fd-adoption is not a bind operation.

Consider either:

1. Checking if config.fd.is_some() and emitting a distinct message like "Failed to adopt socket from fd", or
2. Having create_from_fd also populate an error code if the uSockets API supports it.

Given fd adoption is primarily for cluster IPC where the fd should be valid, this is low priority.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/runtime/socket/udp_socket.rs` around lines 586 - 642, The failure path
treating all null returns as a bind error is misleading when create_from_fd
(used when config.fd is Some) fails because err stays 0; update the error
handling after the created null check to distinguish fd-adoption failures from
bind failures: inspect config.fd (or the branch taken) and, when creation came
from create_from_fd, produce/throw a distinct error message like "Failed to
adopt socket from fd" (and still set this.closed/set this.socket appropriately);
leave the existing behavior for the create(...) branch that uses err and
SystemError construction unchanged. Use the identifiers create_from_fd, create,
config.fd, created, err, this.socket, and this.closed to locate and modify the
logic.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/bun-usockets/src/context.c`:
- Around line 391-412: us_socket_group_listen_fd is not applying the
LIBUS_LISTEN_DEFER_ACCEPT flag when adopting an existing fd, causing behavior to
diverge from us_socket_group_listen; update the fd-adoption path so the same
defer-accept behavior is applied: detect LIBUS_LISTEN_DEFER_ACCEPT in
us_socket_group_listen_fd and apply the same socket option handling used in
us_socket_group_listen (e.g. invoke the same helper or call the same
socket-option logic before or after us_internal_init_listen_socket), ensuring
the defer-accept option is propagated for the adopted listener.

In `@src/js/node/dgram.ts`:
- Around line 400-409: The success callback that sets up the socket should guard
against state.handle being null before accessing it: check if state.handle is
null (or falsy) at the top of the callback and return early if so; preserve
behavior for unrefOnBind (call socket.unref() if set) but do not assign to
state.handle.socket or mutate state.receiving/bindState when state.handle is
missing; keep emitting "listening" only when state.handle exists and the
assignment succeeded. Ensure you reference the existing symbols state.handle,
socket, state.unrefOnBind, state.receiving, state.bindState, BIND_STATE_BOUND,
and self.emit("listening") while making the guard.

In `@src/js/node/net.ts`:
- Around line 2622-2647: The clustered accept path in onClusterConnection
diverges from the normal ServerHandlers.open() flow: it bypasses blockList
checks, skips the server constructor's connectionListener, fails to emit "drop"
when maxConnections rejects, and causes a double-decrement of _connections by
both manually adjusting the counter and by setting socket.server (which makes
Socket.prototype._destroy decrement it). Fix by routing the accepted client
socket through the same admission/accept logic used by ServerHandlers.open() (so
blockList is applied, the configured connectionListener runs, and "drop" is
emitted on rejects) instead of duplicating logic here; remove the manual
increment/decrement or avoid setting socket.server before the shared handler
runs to prevent double-decrement; keep existing symbols (onClusterConnection,
ServerHandlers.open, socket.server, self._connections, connectionListener,
"drop") to locate and change the code.
- Around line 2571-2579: The shared-handle branch sets handle.adopted and stores
the wrapper but doesn't mark it as the cluster owner, so
Worker.prototype._disconnect() won't escalate shutdown via server.close();
instead it calls handle.close() which after adopted=true doesn't close the real
listener. Fix by tagging the wrapper stored in handles with the kClusterOwner
symbol (the same owner marker child.ts expects) when assigning
server[kClusterHandle] = handle and before server.once("close", () =>
handle.close()); ensure the wrapper in the handles collection carries
kClusterOwner so disconnect will call server.close() and drain the listener
rather than directly closing the handle.

---

Outside diff comments:
In `@src/runtime/socket/udp_socket.rs`:
- Around line 586-642: The failure path treating all null returns as a bind
error is misleading when create_from_fd (used when config.fd is Some) fails
because err stays 0; update the error handling after the created null check to
distinguish fd-adoption failures from bind failures: inspect config.fd (or the
branch taken) and, when creation came from create_from_fd, produce/throw a
distinct error message like "Failed to adopt socket from fd" (and still set
this.closed/set this.socket appropriately); leave the existing behavior for the
create(...) branch that uses err and SystemError construction unchanged. Use the
identifiers create_from_fd, create, config.fd, created, err, this.socket, and
this.closed to locate and modify the logic.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 56fe55fc-c6c2-4c00-a2cd-77e6789c446e

📥 Commits

Reviewing files that changed from the base of the PR and between 977f054 and 1671cad.

📒 Files selected for processing (70)

• packages/bun-usockets/src/context.c
• packages/bun-usockets/src/libusockets.h
• packages/bun-usockets/src/udp.c
• src/js/builtins/Ipc.ts
• src/js/internal/cluster/RoundRobinHandle.ts
• src/js/internal/cluster/SharedHandle.ts
• src/js/internal/cluster/child.ts
• src/js/internal/cluster/primary.ts
• src/js/internal/shared.ts
• src/js/internal/test/binding.ts
• src/js/node/dgram.ts
• src/js/node/net.ts
• src/jsc/ipc.rs
• src/resolve_builtins/HardcodedModule.rs
• src/runtime/ipc_host.rs
• src/runtime/jsc_hooks.rs
• src/runtime/node/node_cluster_binding.rs
• src/runtime/socket/Listener.rs
• src/runtime/socket/sockets.classes.ts
• src/runtime/socket/udp_socket.rs
• src/uws_sys/SocketGroup.rs
• src/uws_sys/udp.rs
• test/js/node/test/parallel/test-cluster-accept-fail.js
• test/js/node/test/parallel/test-cluster-basic.js
• test/js/node/test/parallel/test-cluster-bind-privileged-port.js
• test/js/node/test/parallel/test-cluster-bind-twice.js
• test/js/node/test/parallel/test-cluster-concurrent-disconnect.js
• test/js/node/test/parallel/test-cluster-dgram-1.js
• test/js/node/test/parallel/test-cluster-dgram-2.js
• test/js/node/test/parallel/test-cluster-dgram-bind-fd.js
• test/js/node/test/parallel/test-cluster-dgram-reuse.js
• test/js/node/test/parallel/test-cluster-disconnect-exitedAfterDisconnect-race.js
• test/js/node/test/parallel/test-cluster-disconnect-race.js
• test/js/node/test/parallel/test-cluster-disconnect-unshared-tcp.js
• test/js/node/test/parallel/test-cluster-disconnect-unshared-udp.js
• test/js/node/test/parallel/test-cluster-disconnect.js
• test/js/node/test/parallel/test-cluster-eaccess.js
• test/js/node/test/parallel/test-cluster-eaddrinuse.js
• test/js/node/test/parallel/test-cluster-fork-stdio.js
• test/js/node/test/parallel/test-cluster-fork-windowsHide.js
• test/js/node/test/parallel/test-cluster-listen-pipe-readable-writable.js
• test/js/node/test/parallel/test-cluster-message.js
• test/js/node/test/parallel/test-cluster-net-listen-backlog.js
• test/js/node/test/parallel/test-cluster-net-listen-ipv6only-false.js
• test/js/node/test/parallel/test-cluster-net-listen-relative-path.js
• test/js/node/test/parallel/test-cluster-net-reuseport.js
• test/js/node/test/parallel/test-cluster-net-send.js
• test/js/node/test/parallel/test-cluster-net-server-drop-connection.js
• test/js/node/test/parallel/test-cluster-rr-handle-close.js
• test/js/node/test/parallel/test-cluster-rr-handle-keep-loop-alive.js
• test/js/node/test/parallel/test-cluster-rr-handle-ref-unref.js
• test/js/node/test/parallel/test-cluster-send-deadlock.js
• test/js/node/test/parallel/test-cluster-send-handle-twice.js
• test/js/node/test/parallel/test-cluster-send-socket-to-worker-http-server.js
• test/js/node/test/parallel/test-cluster-server-restart-none.js
• test/js/node/test/parallel/test-cluster-server-restart-rr.js
• test/js/node/test/parallel/test-cluster-shared-handle-bind-error.js
• test/js/node/test/parallel/test-cluster-shared-handle-bind-privileged-port.js
• test/js/node/test/parallel/test-cluster-shared-leak.js
• test/js/node/test/parallel/test-cluster-worker-events.js
• test/js/node/test/parallel/test-cluster-worker-handle-close.js
• test/js/node/test/parallel/test-cluster-worker-isdead.js
• test/js/node/test/parallel/test-cluster-worker-kill-signal.js
• test/js/node/test/parallel/test-cluster-worker-no-exit.js
• test/js/node/test/parallel/test-cluster-worker-wait-server-close.js
• test/js/node/test/sequential/test-cluster-inspect-brk.js
• test/js/node/test/sequential/test-cluster-net-listen-ipv6only-none.js
• test/js/node/test/sequential/test-cluster-net-listen-ipv6only-rr.js
• test/js/node/test/sequential/test-cluster-port-reuse-between-workers.js
• test/js/node/test/sequential/test-cluster-send-handle-large-payload.js

💤 Files with no reviewable changes (1)

• test/js/node/test/parallel/test-cluster-bind-privileged-port.js

[coderabbitai]

Actionable comments posted: 7

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/bun-usockets/src/context.c`:
- Around line 394-396: The current conditional in
packages/bun-usockets/src/context.c that sets *error = ENOTSUP and returns for
LIBUS_USE_LIBUV || WIN32 hard-stubs listener and UDP adoption on Windows;
replace this stub with a Windows-specific adoption implementation (or at minimum
only exclude LIBUV, not WIN32) so the cluster shared-handle feature works on
Windows. Locate the listener adoption and UDP adoption branches in context.c
(the blocks that currently set ENOTSUP) and implement the Windows equivalent:
mirror the POSIX adoption logic but use Windows APIs (e.g.,
WSADuplicateSocket/WSASocket or DuplicateHandle patterns) or call the shared
helper you have for creating sockets from passed handles, ensuring the same
return/error semantics as the POSIX path and preserving the same function
interfaces used by the rest of the code.

In `@src/js/internal/cluster/child.ts`:
- Line 197: The success path in rr() must use the same callback signature as
shared(): ensure rr() calls cb with three arguments (status, handle, message)
rather than two; update rr() to invoke cb(0, handle, message) (or cb(0, handle,
null) if there is no message object) so cb, shared(), rr(), handle and message
all use a consistent (errno, handle, message) signature.

In `@src/js/internal/cluster/RoundRobinHandle.ts`:
- Around line 39-48: When running on Windows, instead of silently destroying
accepted sockets in the net.createServer callback, emit a one-time warning
explaining that round-robin FD-passing isn't supported on win32; modify the
RoundRobinHandle instance (the code that sets this.server and calls
this.distribute and makeAcceptedHandle) to call process.emitWarning with a clear
message only once per server/handle (e.g., set a boolean flag like
this._warnedWin32RR on the instance before destroying the socket), so the socket
can still be destroyed but users get a visible warning; alternatively, if you
prefer changing the scheduling default, adjust the code that sets
cluster.schedulingPolicy to SCHED_NONE on win32 instead of SCHED_RR so this
branch is not reachable on Windows.

In `@src/js/node/net.ts`:
- Around line 2602-2614: The call to server[kRealListen](...) inside the async
_getServer() callback must be guarded so synchronous throws don't become
uncaught: wrap the server[kRealListen](path, port, hostname, exclusive,
ipv6Only, allowHalfOpen, reusePort, tls, contexts, onListen, handle.sharedFd)
invocation in a try/catch, and in the catch emit the error on the server
(server.emit("error", err)) and ensure the adopted shared handle
(handle.sharedFd) is properly closed/released (and/or call the same cleanup used
by the other adopt-fd path) so the shared-handle wrapper does not remain open;
keep behavior consistent with Server.listen()’s error path.
- Around line 2662-2678: onClusterConnection currently creates a plain new
Socket and calls socket.connect({fd,...}) which returns early and bypasses
ServerHandlers.open TLS/attach lifecycle; change it to instantiate the server's
configured socket class (use ServerHandlers.open's [kSocketClass] / kSocketClass
analog) set the TLS flags (_requestCert/_rejectUnauthorized or bunTlsSymbol) on
that instance, and adopt/attach the accepted fd via the same [kAttach] path used
in ServerHandlers.open (instead of socket.connect({fd})); this ensures the RR
accepted socket runs the same attach/handshake and emits
secureConnection/connection consistently with non-RR accepts (refer to
onClusterConnection, Socket, doConnect, bunTlsSymbol, ServerHandlers.open,
[kSocketClass], and [kAttach]).

In `@src/jsc/ipc.rs`:
- Line 1969: The call to msg_data.put(global_this, b"$fd",
JSValue::js_number_from_int32(fd.uv())) can throw (e.g. frozen object or proxy
trap) but its result is discarded, leaving a pending exception before
handle_ipc_message is invoked; wrap the put result check and, on failure, clear
or handle the exception exactly like the adjacent get logic (check the return
value, call ctx.clear_exception()/ctx.exception() or the project equivalent to
consume the error) so any thrown exception is cleared before calling
handle_ipc_message; locate the put invocation in function handling IPC messages
(msg_data.put, global_this, JSValue::js_number_from_int32, handle_ipc_message)
and add the same error-check/clear path used for the get call.

In `@src/runtime/socket/udp_socket.rs`:
- Around line 586-609: The fd-adoption branch using
uws::udp::Socket::create_from_fd currently leaves `err` as 0 on failure and
later reports a generic "Failed to bind socket"; update the failure path for the
`if let Some(fd) = config.fd` branch so that when `create_from_fd(...)` returns
a null/none failure you capture and propagate the OS errno (or map the uws
error) into `err` and/or construct the Node-compatible error with the original
errno/code rather than overwriting it; apply the same change to the other
create_from_fd/create handling block that mirrors this logic (the other branch
handling `create_from_fd` vs `create`), ensuring symbols like `created`, `err`,
`config.fd`, `uws::udp::Socket::create_from_fd`, `uws::udp::Socket::create`, and
`this_ptr` are used to locate and implement the fix.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: fa6ebc42-028f-4181-afcf-86935e5b49a1

📥 Commits

Reviewing files that changed from the base of the PR and between 1671cad and fb2be85.

📒 Files selected for processing (73)

• packages/bun-usockets/src/bsd.c
• packages/bun-usockets/src/context.c
• packages/bun-usockets/src/internal/internal.h
• packages/bun-usockets/src/internal/networking/bsd.h
• packages/bun-usockets/src/libusockets.h
• packages/bun-usockets/src/loop.c
• packages/bun-usockets/src/socket.c
• packages/bun-usockets/src/udp.c
• src/js/builtins/Ipc.ts
• src/js/internal/cluster/RoundRobinHandle.ts
• src/js/internal/cluster/SharedHandle.ts
• src/js/internal/cluster/child.ts
• src/js/internal/cluster/primary.ts
• src/js/internal/shared.ts
• src/js/internal/test/binding.ts
• src/js/node/_http_server.ts
• src/js/node/dgram.ts
• src/js/node/net.ts
• src/jsc/ipc.rs
• src/resolve_builtins/HardcodedModule.rs
• src/runtime/ipc_host.rs
• src/runtime/jsc_hooks.rs
• src/runtime/node/node_cluster_binding.rs
• src/runtime/socket/Listener.rs
• src/runtime/socket/sockets.classes.ts
• src/runtime/socket/udp_socket.rs
• src/uws_sys/SocketGroup.rs
• src/uws_sys/udp.rs
• test/js/node/test/parallel/test-cluster-accept-fail.js
• test/js/node/test/parallel/test-cluster-basic.js
• test/js/node/test/parallel/test-cluster-bind-privileged-port.js
• test/js/node/test/parallel/test-cluster-concurrent-disconnect.js
• test/js/node/test/parallel/test-cluster-dgram-1.js
• test/js/node/test/parallel/test-cluster-dgram-2.js
• test/js/node/test/parallel/test-cluster-dgram-bind-fd.js
• test/js/node/test/parallel/test-cluster-dgram-reuse.js
• test/js/node/test/parallel/test-cluster-disconnect-exitedAfterDisconnect-race.js
• test/js/node/test/parallel/test-cluster-disconnect-race.js
• test/js/node/test/parallel/test-cluster-disconnect-unshared-tcp.js
• test/js/node/test/parallel/test-cluster-disconnect-unshared-udp.js
• test/js/node/test/parallel/test-cluster-disconnect.js
• test/js/node/test/parallel/test-cluster-eaccess.js
• test/js/node/test/parallel/test-cluster-eaddrinuse.js
• test/js/node/test/parallel/test-cluster-fork-windowsHide.js
• test/js/node/test/parallel/test-cluster-listen-pipe-readable-writable.js
• test/js/node/test/parallel/test-cluster-message.js
• test/js/node/test/parallel/test-cluster-net-listen-backlog.js
• test/js/node/test/parallel/test-cluster-net-listen-ipv6only-false.js
• test/js/node/test/parallel/test-cluster-net-listen-relative-path.js
• test/js/node/test/parallel/test-cluster-net-reuseport.js
• test/js/node/test/parallel/test-cluster-net-send.js
• test/js/node/test/parallel/test-cluster-net-server-drop-connection.js
• test/js/node/test/parallel/test-cluster-rr-handle-close.js
• test/js/node/test/parallel/test-cluster-rr-handle-keep-loop-alive.js
• test/js/node/test/parallel/test-cluster-rr-handle-ref-unref.js
• test/js/node/test/parallel/test-cluster-send-deadlock.js
• test/js/node/test/parallel/test-cluster-send-socket-to-worker-http-server.js
• test/js/node/test/parallel/test-cluster-server-restart-none.js
• test/js/node/test/parallel/test-cluster-server-restart-rr.js
• test/js/node/test/parallel/test-cluster-shared-handle-bind-error.js
• test/js/node/test/parallel/test-cluster-shared-handle-bind-privileged-port.js
• test/js/node/test/parallel/test-cluster-shared-leak.js
• test/js/node/test/parallel/test-cluster-worker-events.js
• test/js/node/test/parallel/test-cluster-worker-handle-close.js
• test/js/node/test/parallel/test-cluster-worker-isdead.js
• test/js/node/test/parallel/test-cluster-worker-kill-signal.js
• test/js/node/test/parallel/test-cluster-worker-no-exit.js
• test/js/node/test/parallel/test-cluster-worker-wait-server-close.js
• test/js/node/test/sequential/test-cluster-inspect-brk.js
• test/js/node/test/sequential/test-cluster-net-listen-ipv6only-none.js
• test/js/node/test/sequential/test-cluster-net-listen-ipv6only-rr.js
• test/js/node/test/sequential/test-cluster-port-reuse-between-workers.js
• test/js/node/test/sequential/test-cluster-send-handle-large-payload.js

💤 Files with no reviewable changes (1)

• test/js/node/test/parallel/test-cluster-bind-privileged-port.js

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

src/js/internal/cluster/RoundRobinHandle.ts (1)

90-103: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Cache the listen failure before registering late workers.

After the first "error" event, this.listening stays false and no failure state is stored. Any later add() call attaches fresh once("listening") / once("error") handlers to a server that will never emit either again, so that worker never gets its reply.

🔧 Minimal fix

 export default class RoundRobinHandle {
   key;
   all;
   free;
   handles;
   handle;
   server;
   listening;
+  listenError;
   // worker.id -> handle sent in a `newconn` whose ack hasn't arrived yet.
   // If that worker dies first, the ack never comes and the handle would leak
   // (keeping the accepted socket - and the primary's event loop - alive).
   inFlight;

   constructor(key, address, { port, fd, flags, backlog, readableAll, writableAll }) {
     net ??= require("node:net");
     this.key = key;
@@
     this.handle = null;
     this.listening = false;
+    this.listenError = null;
     this.inFlight = new Map();
@@
     this.server.once("listening", () => {
       this.listening = true;
       this.handle = this.server._handle;
     });
+    this.server.once("error", err => {
+      this.listenError = err;
+    });
   }

   add(worker, send) {
@@
-    if (this.listening) return done();
+    if (this.listening) return done();
+    if (this.listenError) {
+      const err = this.listenError;
+      const errno = typeof err.errno === "number" && err.errno !== 0 ? -Math.abs(err.errno) : -1;
+      send(errno, typeof err.code === "string" ? { errcode: err.code } : null, null);
+      return;
+    }

     // Still busy binding.
     this.server.once("listening", done);

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/js/internal/cluster/RoundRobinHandle.ts` around lines 90 - 103, The
listen error handler in RoundRobinHandle (the server.once("error", ...) block)
currently sends the failure only to current waiter and leaves this.listening
false so later add() calls attach handlers to a dead server; modify the error
handler to cache the failure (e.g., set a this.listenError object containing the
normalized errno and errcode) in addition to calling send(), and update add()
(or the code path that registers new worker waiters) to check for
this.listenError and immediately reply using send(cachedErrno, { errcode }) so
late workers receive the same failure instead of waiting for events that will
never come. Ensure you reference and set the same normalized errno logic used
now and preserve existing send(...) semantics.

♻️ Duplicate comments (1)

src/js/node/net.ts (1)

2575-2578: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Keep the errcode fallback scoped to the cases where numeric errno is unusable.

This broadens the generic-Error path to every reply carrying a string errcode. If the primary includes errcode on POSIX too, clustered workers will now skip ExceptionWithHostPort for normal bind failures and emit a different Node-visible error shape than the non-cluster path.

#!/bin/bash
set -euo pipefail

echo "=== errcode producers/consumers ==="
rg -n -C3 '\berrcode\b' src/js/internal/cluster/primary.ts src/js/internal/cluster/child.ts src/js/node/net.ts

echo
echo "=== worker-side bind reconstruction ==="
sed -n '2570,2588p' src/js/node/net.ts

If src/js/internal/cluster/primary.ts shows reply.errcode is attached unconditionally, this branch should stay limited to the Windows/non-uv fallback instead of replacing ExceptionWithHostPort everywhere. As per coding guidelines, “Match Node's full error contract.”

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/js/node/net.ts` around lines 2575 - 2578, The current check on
reply.errcode is too broad; restrict the fallback to string errcode only when
numeric errno is unusable (e.g., Windows/uv fallback) so we don't supplant
ExceptionWithHostPort on POSIX. Update the condition around reply.errcode in the
net error-reconstruction logic to require both typeof reply?.errcode ===
"string" and (process.platform === "win32" || typeof reply?.errno !== "number"
|| reply.errno == null), leaving the existing ExceptionWithHostPort path intact
for cases where a numeric errno is present; reference the symbols reply.errcode,
reply.errno, and ExceptionWithHostPort when making this change.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@src/js/internal/cluster/RoundRobinHandle.ts`:
- Around line 90-103: The listen error handler in RoundRobinHandle (the
server.once("error", ...) block) currently sends the failure only to current
waiter and leaves this.listening false so later add() calls attach handlers to a
dead server; modify the error handler to cache the failure (e.g., set a
this.listenError object containing the normalized errno and errcode) in addition
to calling send(), and update add() (or the code path that registers new worker
waiters) to check for this.listenError and immediately reply using
send(cachedErrno, { errcode }) so late workers receive the same failure instead
of waiting for events that will never come. Ensure you reference and set the
same normalized errno logic used now and preserve existing send(...) semantics.

---

Duplicate comments:
In `@src/js/node/net.ts`:
- Around line 2575-2578: The current check on reply.errcode is too broad;
restrict the fallback to string errcode only when numeric errno is unusable
(e.g., Windows/uv fallback) so we don't supplant ExceptionWithHostPort on POSIX.
Update the condition around reply.errcode in the net error-reconstruction logic
to require both typeof reply?.errcode === "string" and (process.platform ===
"win32" || typeof reply?.errno !== "number" || reply.errno == null), leaving the
existing ExceptionWithHostPort path intact for cases where a numeric errno is
present; reference the symbols reply.errcode, reply.errno, and
ExceptionWithHostPort when making this change.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: f1da101a-81f0-4a50-bd2b-423efb95b711

📥 Commits

Reviewing files that changed from the base of the PR and between fb2be85 and 5e7dd5b.

📒 Files selected for processing (5)

• packages/bun-usockets/src/context.c
• src/js/internal/cluster/RoundRobinHandle.ts
• src/js/node/net.ts
• test/js/node/test/parallel/test-cluster-accept-fail.js
• test/js/node/test/parallel/test-cluster-worker-wait-server-close.js

[coderabbitai]

Actionable comments posted: 3

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (3)

packages/bun-usockets/src/socket.c (1)

412-425: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Initialize last_write_failed in the fd-adoption constructor.

us_socket_from_fd() manually fills a us_socket_t that came from us_create_poll(), so this path does not start zeroed. Leaving s->flags.last_write_failed uninitialized makes the new adopted-socket path nondeterministic the first time write/backpressure logic consults that bit.

🔧 Proposed fix

     s->flags.is_paused = 0;
     s->flags.is_ipc = ipc;
     s->flags.is_closed = 0;
     s->flags.adopted = 0;
+    s->flags.last_write_failed = 0;
     s->connect_state = NULL;

Based on learnings, us_create_poll uses us_malloc, so struct fields — including bitfields like us_socket_t::flags.last_write_failed — are not zero-initialized and every allocation path must explicitly initialize the flags it relies on.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/bun-usockets/src/socket.c` around lines 412 - 425, The fd-adoption
path (us_socket_from_fd) leaves the bitfield last_write_failed uninitialized
because us_create_poll uses us_malloc (no zeroing); update the constructor code
that sets s->group/s->kind/... to explicitly initialize
s->flags.last_write_failed = 0 (i.e., set the
us_socket_t::flags.last_write_failed bit to 0 alongside the other flags in
socket.c inside us_socket_from_fd) so write/backpressure logic is deterministic.

packages/bun-usockets/src/context.c (1)

391-415: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Handle poll arming failures in us_socket_group_listen_fd() (use us_poll_start_rc)

us_socket_group_listen_fd() currently calls us_poll_start(...) and ignores libuv/epoll-kqueue poll-init/start return codes; us_poll_start_rc(...) exists specifically to surface those failures. If poll arming fails, unwind (close/free and unlink as appropriate), set *error, and return 0 instead of returning a live listener with no registered accept poll.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/bun-usockets/src/context.c` around lines 391 - 415,
us_socket_group_listen_fd currently ignores poll start failures; replace the
call to us_poll_start(...) with us_poll_start_rc(...) and check its return
value, and if it fails then undo the partial setup: set *error to LIBUS_ERR (or
appropriate error from the rc), stop/close/free/unlink the us_poll_t created by
us_create_poll (ensuring the fd is closed if necessary), and return 0 instead of
returning the listener; keep the existing us_poll_init(...) and
us_internal_init_listen_socket(...) calls only after poll arming succeeds, and
ensure the deferred_accept handling remains intact when poll start succeeds.

src/jsc/ipc.rs (1)

771-793: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Only detach the local handle after a real ACK.

complete() now tears down the sender-side handle on every completion, but on_ack_nack() also reaches this path after MAX_HANDLE_RETRANSMISSIONS NACKs. That means a receiver that explicitly failed to import the handle still causes the sender to terminate() its own socket/server, losing the only live copy. Split success completion from failed/aborted completion so the local handle is closed only on the ACKed transfer path.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/jsc/ipc.rs` around lines 771 - 793, complete() currently calls
terminate() and drops the local handle whenever close_on_complete is set, but
on_ack_nack() routes NACK/failure completions through the same path causing
premature teardown; modify the logic so that only the ACK-success path (not the
NACK/failure path) triggers closing the local handle and calling the native
terminate() on handle.js. Locate the complete() method and the on_ack_nack()
caller paths and split them into two outcomes (e.g., complete_success vs
complete_abort) or add an explicit boolean parameter to complete(self, global,
acked: bool) so you only perform the terminate() / close_on_complete branch when
acked is true; ensure on_ack_nack() invokes the abort path (or calls
complete(..., false)) and successful ACK handling invokes complete(..., true) so
the sender retains the socket/server on failed imports.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/bun-usockets/src/bsd.c`:
- Around line 1090-1092: The TCP path in bsd_create_bound_socket currently sets
*error = LIBUS_ERR (or WSAGetLastError on Windows) when getaddrinfo() fails;
change it to mirror bsd_create_udp_socket by capturing the getaddrinfo() return
(gai_result) and set *error = -gai_result so callers receive the actual
getaddrinfo() error code; update the error assignment and return path around the
getaddrinfo() call in bsd_create_bound_socket to use the negative gai_result
value instead of LIBUS_ERR/WSA error so the Rust-side translation contract
remains consistent.

In `@src/runtime/node/node_cluster_binding.rs`:
- Around line 245-257: The code currently calls
crate::ipc_host::attach_windows_socket_payload(...) and then unconditionally
sets message.put(global, b"$hasHandle", JSValue::TRUE) and native_handle =
Some(bun_jsc::ipc::Handle::init(...)); change this so the Windows socket-export
result is checked: call attach_windows_socket_payload and only set the
$hasHandle flag and assign native_handle when that call succeeds; on failure
treat it as "send without handle" (do not set $hasHandle or native_handle) to
match ipc_host::do_send behavior and avoid advertising a handle the receiver
cannot reconstruct. Ensure you still call bun_jsc::ipc::Handle::init(...) only
in the success branch.

In `@src/runtime/socket/Handlers.rs`:
- Around line 512-524: The Windows branch narrows the JS-visible socket value by
casting to u32 before rebuilding an Fd, which corrupts pointer-sized SOCKET
values on 64-bit Windows; in the #[cfg(windows)] block that constructs
Fd::from_system use a pointer-sized cast (preserve full width) instead of v as
u32 — e.g., cast v to usize (or the platform pointer-sized integer) then to *mut
c_void when calling Fd::from_system for generated.fd; ensure you only change the
#[cfg(windows)] arm around Fd::from_system and keep the #[cfg(not(windows))]
Fd::from_uv branch unchanged.

---

Outside diff comments:
In `@packages/bun-usockets/src/context.c`:
- Around line 391-415: us_socket_group_listen_fd currently ignores poll start
failures; replace the call to us_poll_start(...) with us_poll_start_rc(...) and
check its return value, and if it fails then undo the partial setup: set *error
to LIBUS_ERR (or appropriate error from the rc), stop/close/free/unlink the
us_poll_t created by us_create_poll (ensuring the fd is closed if necessary),
and return 0 instead of returning the listener; keep the existing
us_poll_init(...) and us_internal_init_listen_socket(...) calls only after poll
arming succeeds, and ensure the deferred_accept handling remains intact when
poll start succeeds.

In `@packages/bun-usockets/src/socket.c`:
- Around line 412-425: The fd-adoption path (us_socket_from_fd) leaves the
bitfield last_write_failed uninitialized because us_create_poll uses us_malloc
(no zeroing); update the constructor code that sets s->group/s->kind/... to
explicitly initialize s->flags.last_write_failed = 0 (i.e., set the
us_socket_t::flags.last_write_failed bit to 0 alongside the other flags in
socket.c inside us_socket_from_fd) so write/backpressure logic is deterministic.

In `@src/jsc/ipc.rs`:
- Around line 771-793: complete() currently calls terminate() and drops the
local handle whenever close_on_complete is set, but on_ack_nack() routes
NACK/failure completions through the same path causing premature teardown;
modify the logic so that only the ACK-success path (not the NACK/failure path)
triggers closing the local handle and calling the native terminate() on
handle.js. Locate the complete() method and the on_ack_nack() caller paths and
split them into two outcomes (e.g., complete_success vs complete_abort) or add
an explicit boolean parameter to complete(self, global, acked: bool) so you only
perform the terminate() / close_on_complete branch when acked is true; ensure
on_ack_nack() invokes the abort path (or calls complete(..., false)) and
successful ACK handling invokes complete(..., true) so the sender retains the
socket/server on failed imports.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 3a4b14c5-d27b-40d4-b7f4-be3fec5418dc

📥 Commits

Reviewing files that changed from the base of the PR and between 422083f and f461c69.

📒 Files selected for processing (28)

• packages/bun-usockets/src/bsd.c
• packages/bun-usockets/src/context.c
• packages/bun-usockets/src/eventing/libuv.c
• packages/bun-usockets/src/internal/networking/bsd.h
• packages/bun-usockets/src/socket.c
• src/js/builtins/Ipc.ts
• src/js/internal/cluster/RoundRobinHandle.ts
• src/js/internal/cluster/SharedHandle.ts
• src/js/internal/cluster/child.ts
• src/jsc/ipc.rs
• src/runtime/api/bun/subprocess.rs
• src/runtime/ipc_host.rs
• src/runtime/node/node_cluster_binding.rs
• src/runtime/socket/Handlers.rs
• src/uws/lib.rs
• src/uws_sys/lib.rs
• test/js/node/test/parallel/test-cluster-accept-fail.js
• test/js/node/test/parallel/test-cluster-disconnect.js
• test/js/node/test/parallel/test-cluster-message.js
• test/js/node/test/parallel/test-cluster-net-send.js
• test/js/node/test/parallel/test-cluster-send-socket-to-worker-http-server.js
• test/js/node/test/parallel/test-cluster-server-restart-none.js
• test/js/node/test/parallel/test-cluster-shared-handle-bind-error.js
• test/js/node/test/parallel/test-cluster-shared-leak.js
• test/js/node/test/parallel/test-cluster-worker-handle-close.js
• test/js/node/test/parallel/test-cluster-worker-wait-server-close.js
• test/js/node/test/sequential/test-cluster-net-listen-ipv6only-none.js
• test/js/node/test/sequential/test-cluster-send-handle-large-payload.js

💤 Files with no reviewable changes (14)

• test/js/node/test/parallel/test-cluster-message.js
• test/js/node/test/parallel/test-cluster-accept-fail.js
• test/js/node/test/parallel/test-cluster-shared-leak.js
• test/js/node/test/parallel/test-cluster-server-restart-none.js
• src/js/builtins/Ipc.ts
• test/js/node/test/parallel/test-cluster-worker-handle-close.js
• test/js/node/test/parallel/test-cluster-shared-handle-bind-error.js
• test/js/node/test/parallel/test-cluster-disconnect.js
• test/js/node/test/parallel/test-cluster-net-send.js
• test/js/node/test/parallel/test-cluster-send-socket-to-worker-http-server.js
• test/js/node/test/parallel/test-cluster-worker-wait-server-close.js
• test/js/node/test/sequential/test-cluster-net-listen-ipv6only-none.js
• src/js/internal/cluster/RoundRobinHandle.ts
• test/js/node/test/sequential/test-cluster-send-handle-large-payload.js

[robobun]

Follow-up: #40041 emits a received net.Server handle right after listen({ fd }) returns instead of from its 'listening' timer. The handle arrived after the messages sent behind it, which made "a handle sent right before the child's disconnect() is still delivered" in child_process_ipc_handle.test.ts red on main.

[robobun]

On Windows, a process that shares a listening socket with another process could block in accept() and stop its event loop. #41358 fixes this in the accept path.

[robobun]

The "a received handle that lands on fd 0 is adopted" test from this PR flakes on the x64-asan lane: JSC's lazily opened /proc/self/statm descriptor can take fd 0 after the child's closeSync(0). Fixed in #41722.