@christianirack/brainllm-runtime 0.4.0 → 0.6.0

package/server/server.mjs

@@ -6,9 +6,9 @@
 //
 // It serves, in this order:
 //   GET  /_health                → 200 {"ok":true,"build":"<sig>"}
-//   POST /_r/<hash>/<fn>         → RPC to a `server:` function (same origin + X-Brain-RPC, 64 KB, rate limit, 10 s)
+//   POST /_r/<hash>/<fn>         → RPC to a `server:` function (same origin + X-Brain-RPC; body, rate and time limits from brain.json `server`)
 //   GET  routes in the manifest  → SSR: load(ctx) → render the view on the DOM shim → page with props and SEO head
-//   GET  files in dist/          → static (precompressed .br/.gz when accepted; /_b/* immutable), clean URLs
+//   GET  files in dist/          → static (the smallest accepted .zst/.br/.gz sibling; /_b/* immutable), clean URLs
 //   anything else                → 404 page
 // Every response carries the security headers; every HTML response gets a fresh CSP nonce on each <script>.
 //
@@ -19,7 +19,9 @@
 // `<!--brain:props-->` inside <script type="application/json" id="brain-props">.
 import { createServer as http, STATUS_CODES, request as httpRequest, Agent as HttpAgent } from 'node:http'
 import net from 'node:net'
+import { installNativeSockets } from './native-sockets.mjs'
 import { Readable } from 'node:stream'
+import zlib from 'node:zlib'
 import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto'
 import { existsSync, readFileSync, realpathSync, statSync, lstatSync } from 'node:fs'
 import * as Module from 'node:module'
@@ -66,6 +68,8 @@ const b64u = b => Buffer.from(b).toString('base64url')
 const tag = s => createHash('sha1').update(s).digest('base64url').slice(0, 22)
 
 // Errors a server function may throw on purpose: { errors: { field: msg } } → 422; { status, message } with 4xx → that
+const LIST_OPTIONS = ['search','limit','offset','filter','sort','cursor','after','include','aggregate','count']
+const FILTER_OPS = ['eq','ne','gt','gte','lt','lte','between','in','exists','prefix','iprefix','has']
 export class HttpError extends Error {
   constructor(status, message, extra) {
     super(message)
@@ -81,7 +85,20 @@ function intendedStatus(error) {
   const plain = Object.getPrototypeOf(error) === Object.prototype || Object.getPrototypeOf(error) === null
   return Number.isInteger(status) && STATUS_CODES[status] && (error instanceof HttpError && status >= 400 && status <= 599 || plain && status >= 400 && status < 500) ? status : null
 }
+// A deliberate public failure → { status, message } for f.error: a plain `{ message }` without a status (400) or an
+// author's Error subclass with a 4xx `status`. Plain `{ status, message }` keeps its message private (driver detail);
+// built-in errors and bare `Error` messages stay private too.
+const BUILTIN_ERRORS = new Set([Error, TypeError, RangeError, SyntaxError, ReferenceError, EvalError, URIError, AggregateError].map(c => c.prototype))
+function publicError(error) {
+  if (!error || typeof error !== 'object' || error instanceof HttpError) return null
+  const proto = Object.getPrototypeOf(error), plain = proto === Object.prototype || proto === null
+  const typed = error instanceof Error && !BUILTIN_ERRORS.has(proto)
+  const status = plain ? (error.status === undefined ? 400 : 0) : error.status, message = error.message
+  if (!(plain || typed) || typeof message !== 'string' || !message || message.length > 500) return null
+  return Number.isInteger(status) && status >= 400 && status < 500 && STATUS_CODES[status] ? { status, message } : null
+}
 const REDIRECT_CODES = new Set([301, 302, 303, 307, 308])
+const NOINDEX = 'noindex, nofollow'
 function safeLocation(value) {
   if (typeof value !== 'string' || value.length > 8192 || !value.startsWith('/') || value.startsWith('//') || /[\\\x00-\x20\x7f]/.test(value) || /^\/%2f/i.test(value) || /%(?:0[0-9a-f]|1[0-9a-f]|5c|7f)/i.test(value) || /%20/i.test(value.split(/[?#]/,1)[0])) throw new HttpError(500, 'Invalid same-site redirect location')
   return value
@@ -119,8 +136,11 @@ function defaultError(status, rid, home = '/') {
   return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="robots" content="noindex,nofollow"><title>${status} — ${esc(title)}</title></head><body><main><h1>${status} — ${esc(title)}</h1><p>The request could not be completed. Try again or contact support with this reference.</p><p>Reference: <code>${esc(rid)}</code></p><a href="${esc(home)}">Return home</a></main></body></html>`
 }
 
-// Coding weights are transport preferences, not substring matches (br;q=0 explicitly forbids Brotli).
-export function acceptedEncodings(header = '') {
+// Coding weights are transport preferences, not substring matches (br;q=0 explicitly forbids Brotli). Ties keep the
+// server order: static files prefer their max-level .br, dynamic bodies prefer zstd (fastest at a Brotli-like ratio).
+// zstd is offered only where node:zlib has it (Node 22.15+).
+const ZSTD = typeof zlib.zstdCompressSync === 'function'
+export function acceptedEncodings(header = '', order = ['br', 'zstd', 'gzip']) {
   const values = new Map()
   for (const part of String(header).split(',')) {
     const [name, ...params] = part.trim().split(';')
@@ -131,8 +151,19 @@ export function acceptedEncodings(header = '') {
     }
     values.set(name.toLowerCase(),q)
   }
-  return ['br','gzip'].map(name => [name,values.get(name) ?? values.get('*') ?? 0]).filter(([,q]) => q > 0).sort((a,b) => b[1] - a[1]).map(([name]) => name)
+  return order.filter(name => name !== 'zstd' || ZSTD).map(name => [name,values.get(name) ?? values.get('*') ?? 0]).filter(([,q]) => q > 0).sort((a,b) => b[1] - a[1]).map(([name]) => name)
+}
+// Response compression (docs/PERFORMANCE.md): text bodies of at least 1 KiB, negotiated per request; a body that
+// already has an encoding, a `no-transform` cache policy or a status without content is sent as is.
+const COMPRESSIBLE = /^(?:text\/|image\/svg\+xml|application\/(?:json|javascript|xml|[\w.-]+\+(?:json|xml)))/i
+const DYNAMIC = ['zstd', 'br', 'gzip']
+const varyEncoding = v => (/accept-encoding/i.test(v || '') ? v : [v, 'Accept-Encoding'].filter(Boolean).join(', '))
+function bodyEncoding(req, status, headers) {
+  if (status < 200 || status === 204 || status === 206 || status === 304 || headers['content-encoding'] || !COMPRESSIBLE.test(headers['content-type'] || '') || /no-transform/i.test(headers['cache-control'] || '')) return null
+  return acceptedEncodings(req.headers['accept-encoding'], DYNAMIC)[0] || ''
 }
+const encodeBody = (enc, buf) => enc === 'zstd' ? zlib.zstdCompressSync(buf) : enc === 'br' ? zlib.brotliCompressSync(buf, { params: { [zlib.constants.BROTLI_PARAM_QUALITY]: 5, [zlib.constants.BROTLI_PARAM_SIZE_HINT]: buf.length } }) : zlib.gzipSync(buf)
+const encodeStream = enc => enc === 'zstd' ? zlib.createZstdCompress() : enc === 'br' ? zlib.createBrotliCompress({ params: { [zlib.constants.BROTLI_PARAM_QUALITY]: 5 } }) : zlib.createGzip()
 
 function googleSignInPage(page) {
   let head = false, templates = 0
@@ -240,7 +271,7 @@ export function nativeAuthBridge(raw) {
       let outgoing, timer, done = false, bytes = 0, requestBytes = 0, failure
       const chunks = []
       const headers = { 'x-request-id':rid }
-      for (const key of ['origin','authorization','content-type','content-length','x-brain-rpc','accept','x-brain-webhook-id','x-brain-webhook-timestamp','x-brain-webhook-signature']) {
+      for (const key of ['origin','authorization','content-type','content-length','x-brain-rpc','accept','x-brain-webhook-id','x-brain-webhook-timestamp','x-brain-webhook-signature','user-agent','dnt','sec-gpc','cf-ipcountry']) {
         const value = req.headers[key]
         if (typeof value === 'string' && value.length <= 8192) headers[key] = value
       }
@@ -295,7 +326,7 @@ export function nativeAuthBridge(raw) {
       if (typeof id !== 'string' || !/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(id)) throw new HttpError(400, 'Invalid native record identifier')
       return '/api/' + name + '/' + id
     }
-    const request = async (method, path, body) => {
+    const request = async (method, path, body, notFound) => {
       if (response.writableEnded || response.destroyed) throw new HttpError(409, 'The server request has ended')
       if (method !== 'GET' && incoming.method !== 'POST') throw new HttpError(405, 'Native writes require a server function called through POST')
       let bytes = Buffer.alloc(0)
@@ -315,6 +346,14 @@ export function nativeAuthBridge(raw) {
       let value
       try {
         await proxy(req, response, new URL(path, target), rid, (_res, status, data, headers) => {
+          if (status === 422) {
+            // the backend's own field messages (never driver text): a server function that rethrows answers 422 {errors}
+            let fields
+            try { fields = JSON.parse(data.toString('utf8'))?.error?.fields } catch {}
+            const errors = fields && typeof fields === 'object' && !Array.isArray(fields) ? Object.fromEntries(Object.entries(fields).filter(([k, v]) => typeof v === 'string' && k.length <= 128).slice(0, 64).map(([k, v]) => [k, v.slice(0, 512)])) : {}
+            throw new HttpError(422, 'Invalid input', { errors })
+          }
+          if (status === 404 && notFound) { value = notFound(); return }
           if (status < 200 || status >= 300) throw new HttpError(status >= 400 && status < 500 ? status : 503, 'Native resource request failed')
           if (status === 204) { value = null; return }
           if (!String(headers['content-type'] || '').startsWith('application/json')) throw new HttpError(502, 'Native resource response must be JSON')
@@ -324,17 +363,80 @@ export function nativeAuthBridge(raw) {
       if (response.destroyed || response.writableEnded) throw new HttpError(409, 'The server request has ended')
       return value
     }
+    const names = (value, label) => {
+      const list = typeof value === 'string' ? value.split(',') : value
+      if (!Array.isArray(list) || list.length > 16 || list.some(item => typeof item !== 'string' || !/^[a-z][a-z0-9_]{0,47}$/.test(item))) throw new HttpError(400, `Invalid native ${label} names`)
+      return list.join(',')
+    }
     return Object.freeze({
+      // the HTTP list contract (docs/backend/filters.md, sorting.md, pagination.md): the backend validates declared
+      // filters and sorts and answers 422 {errors}; this only rejects shapes the query string cannot express
       list(options = {}) {
-        if (!options || typeof options !== 'object' || Array.isArray(options) || Object.keys(options).some(key => !['search','limit','offset'].includes(key))) throw new HttpError(400, 'Invalid native list options')
-        const {search = '', limit = 20, offset = 0} = options
-        if (typeof search !== 'string' || Buffer.byteLength(search) > 256 || !Number.isInteger(limit) || limit < 1 || limit > 100 || !Number.isInteger(offset) || offset < 0 || offset > 10000) throw new HttpError(400, 'Invalid native list pagination or search')
-        return request('GET', '/api/' + name + '?' + new URLSearchParams({search,limit:String(limit),offset:String(offset)}))
+        if (!options || typeof options !== 'object' || Array.isArray(options) || Object.keys(options).some(key => !LIST_OPTIONS.includes(key))) throw new HttpError(400, 'Invalid native list options')
+        const {search, limit, offset, filter, sort, cursor, after, include, aggregate, count} = options
+        if ((search !== undefined && (typeof search !== 'string' || Buffer.byteLength(search) > 256)) || (limit !== undefined && (!Number.isInteger(limit) || limit < 1 || limit > 100)) || (offset !== undefined && (!Number.isInteger(offset) || offset < 0 || offset > 10000))) throw new HttpError(400, 'Invalid native list pagination or search')
+        const q = new URLSearchParams()
+        if (filter !== undefined) {
+          if (!filter || typeof filter !== 'object' || Array.isArray(filter) || Object.keys(filter).length > 32) throw new HttpError(400, 'Invalid native list filter')
+          const scalar = value => {
+            if (typeof value === 'number' && Number.isFinite(value)) return String(value)
+            if (typeof value === 'boolean') return String(value)
+            if (typeof value === 'string' && Buffer.byteLength(value) <= 256) return value
+            throw new HttpError(400, 'Invalid native filter value')
+          }
+          for (const [field, condition] of Object.entries(filter)) {
+            if (!/^[a-z][a-z0-9_]{0,47}(?:\.[a-z][a-z0-9_]{0,47})?$/.test(field)) throw new HttpError(400, 'Invalid native list filter field')
+            const ops = condition && typeof condition === 'object' && !Array.isArray(condition) ? Object.entries(condition) : [['eq', condition]]
+            if (!ops.length) throw new HttpError(400, 'Invalid native filter value')
+            for (const [op, value] of ops) {
+              if (!FILTER_OPS.includes(op)) throw new HttpError(400, 'Invalid native filter operator')
+              let raw
+              if (op === 'in' || op === 'between' || op === 'has') {
+                const items = Array.isArray(value) ? value : [value]
+                if (!items.length || items.length > 50 || (op === 'between' && items.length !== 2)) throw new HttpError(400, 'Invalid native filter value')
+                raw = items.map(scalar)
+                if (raw.some(item => item.includes(','))) throw new HttpError(400, 'Invalid native filter value')
+                raw = raw.join(',')
+              } else raw = scalar(value)
+              q.append(op === 'eq' ? field : `${field}[${op}]`, raw)
+            }
+          }
+        }
+        if (search !== undefined) q.set('search', search)
+        if (limit !== undefined) q.set('limit', String(limit))
+        if (offset !== undefined) q.set('offset', String(offset))
+        if (sort !== undefined) {
+          const keys = typeof sort === 'string' ? sort.split(',') : sort
+          if (!Array.isArray(keys) || !keys.length || keys.length > 4 || keys.some(key => typeof key !== 'string' || !/^-?[a-z][a-z0-9_]{0,47}$/.test(key))) throw new HttpError(400, 'Invalid native list sort')
+          q.set('sort', keys.join(','))
+        }
+        if (cursor !== undefined && after !== undefined) throw new HttpError(400, 'Use either cursor or after')
+        for (const [key, value] of [['cursor', cursor], ['after', after]]) if (value !== undefined) {
+          if (typeof value !== 'string' || !/^[A-Za-z0-9_-]{1,2048}$/.test(value)) throw new HttpError(400, 'Invalid native list cursor')
+          q.set(key, value)
+        }
+        for (const [key, value] of [['include', include], ['aggregate', aggregate], ['count', count]]) if (value !== undefined) q.set(key, names(value, key))
+        const query = q.toString()
+        return request('GET', '/api/' + name + (query ? '?' + query : ''))
+      },
+      get(id, options = {}) {
+        if (!options || typeof options !== 'object' || Array.isArray(options) || Object.keys(options).some(key => key !== 'include')) throw new HttpError(400, 'Invalid native get options')
+        const path = idPath(id)
+        return request('GET', options.include === undefined ? path : path + '?' + new URLSearchParams({include: names(options.include, 'include')}))
       },
-      get: id => request('GET', idPath(id)),
       create: values => request('POST', '/api/' + name, values),
       update: (id, values) => request('PUT', idPath(id), values),
+      // only the sent fields change (docs/backend/patch.md); null clears an optional field
+      async patch(id, values) {
+        if (values && typeof values === 'object' && !Array.isArray(values) && !Object.keys(values).length) throw new HttpError(422, 'Send at least one field', { errors: { body: 'Send at least one field to change' } })
+        return request('PATCH', idPath(id), values)
+      },
       remove: id => request('DELETE', idPath(id)),
+      // an earlier slug of a readable record → its current slug; live, unknown or unreadable slugs → null
+      slugRedirect(slug) {
+        if (typeof slug !== 'string' || !/^[A-Za-z0-9._~-]{1,512}$/.test(slug)) throw new HttpError(400, 'Invalid native slug')
+        return request('GET', '/api/' + name + '/redirects/' + slug, undefined, () => null).then(value => typeof value?.slug === 'string' ? value.slug : null)
+      },
     })
   }
   async function login(incoming,response,rid,credentials) {
@@ -362,9 +464,16 @@ export function nativeAuthBridge(raw) {
     } finally {request.destroy();bytes.fill(0)}
     return {user}
   }
+  // ctx.backend for one server request (load, actions, RPC, dev sidecar): the same object everywhere
+  const backend = (incoming, response, rid) => Object.freeze({
+    resource: name => resource(incoming, response, rid, name),
+    slugRedirect: (name, slug) => resource(incoming, response, rid, name).slugRedirect(slug),
+    login: credentials => login(incoming, response, rid, credentials),
+  })
   return {
     proxy,
     resource,
+    backend,
     login,
     async prepare(req, res, rid) {
       if (!cookies(req, false)) { req.$nativeUser = null; req.$nativeAuth ||= Promise.resolve(); return }
@@ -389,6 +498,7 @@ export function nativeAuthBridge(raw) {
         headers: () => req.$nativeLoginHeaders || {},
       }
     },
+    _socketCookie: req => cookies(req, false),
     close() { stopped = true; for (const request of owned) request.destroy(); agent.destroy() },
   }
 }
@@ -397,10 +507,10 @@ export function createServer(o = {}) {
   const dist = resolve(o.dist || process.cwd())
   const env = Object.freeze({ ...(o.env || ENV) }) // ctx.env: what the supervisor passed, read-only
   const native = nativeAuthBridge(o.backendURL ?? env.BRAIN_BACKEND_URL)
-  const TIMEOUT = +(o.timeout ?? env.BRAIN_TIMEOUT_MS ?? 10000)
-  const LIMIT = +(o.rateLimit ?? env.BRAIN_RPC_LIMIT ?? 60) // per IP + function, per minute
-  const MAX_BODY = 64 * 1024
+  if (o.nativeSockets !== undefined && typeof o.nativeSockets !== 'boolean') throw Error('nativeSockets must be an explicit boolean')
+  const SITEMAP_BYTES = +(o.sitemapBytes ?? 50 * 1024 * 1024) // protocol: 50 MB uncompressed per sitemap file
   const secret = o.secret ?? env.BRAIN_SECRET ?? ''
+  const COMPRESS = o.compress !== false && env.BRAIN_COMPRESS !== 'off' // a proxy that already compresses can opt out
   const sink = o.log || ((level, msg, extra) => console[level === 'error' ? 'error' : 'log'](json({ t: new Date().toISOString(), level, msg, ...extra })))
   const log = (level, msg, extra = {}) => {
     const safe = { ...extra }
@@ -415,10 +525,39 @@ export function createServer(o = {}) {
       safe.private = true; safe.valuesCaptured = false
       safe.fix = kind === 'TypeError' ? 'Check nullable values, argument types and the data contract at these source frames' : kind === 'ReferenceError' ? 'Check the missing binding or import at these source frames' : kind === 'RangeError' ? 'Check recursive calls, array sizes and configured resource budgets at these source frames' : kind === 'SyntaxError' ? 'Check module syntax or JSON input parsing at these source frames without logging input values' : 'Inspect these source frames and the request reference; reproduce with synthetic inputs'
     }
+    // a compiler budget failure (brain-budget.js) keeps its own code, limit, source position and fix
+    const b = safe.budgetFailure
+    delete safe.budgetFailure
+    if (b) Object.assign(safe, b)
     if (typeof safe.path === 'string') safe.path = safe.path.split(/[?#]/, 1)[0].slice(0, 2048)
     sink(level, msg, safe)
   }
+  // log fields for a thrown value: its stack (sanitized by log) plus, for B09xx budget failures, the typed fields only
+  const trace = e => {
+    const out = { stack: String((e && e.stack) || e) }
+    if (e && e.kind === 'budget' && /^B09\d\d$/.test(e.code) && typeof e.budget === 'string' && /^[a-zA-Z]{1,16}$/.test(e.budget)) {
+      const str = (v, n) => typeof v === 'string' ? v.slice(0, n) : null, pos = v => Number.isSafeInteger(v) && v > 0 ? v : null
+      out.budgetFailure = { code: e.code, budget: e.budget, limit: Number.isFinite(e.limit) ? e.limit : null, file: str(e.file, 256), component: str(e.component, 80), line: pos(e.line), column: pos(e.column), fix: str(e.fix, 200) || 'Bound the work or move it to an owned worker.' }
+    }
+    return out
+  }
   const mf = readManifest(dist)
+  // brain.json `server` (§11.1), written into the manifest by the build; createServer options and env still win
+  const SL = mf.server || {}
+  const TIMEOUT = +(o.timeout ?? env.BRAIN_TIMEOUT_MS ?? SL.timeoutMs ?? 10000)
+  const LIMIT = +(o.rateLimit ?? env.BRAIN_RPC_LIMIT ?? SL.rpcPerMinute ?? 60) // per IP + function, per minute
+  const BODY_KB = +(o.maxBodyKB ?? env.BRAIN_MAX_BODY_KB ?? SL.maxBodyKB ?? 1024)
+  if (!Number.isInteger(BODY_KB) || BODY_KB < 1 || BODY_KB > 65536) throw Error('brain.json server.maxBodyKB must be an integer from 1 to 65536 (KB)')
+  const MAX_BODY = BODY_KB * 1024 // RPC and form bodies; bounded reads never buffer more
+  const TOO_BIG = `Body larger than ${BODY_KB} KB; raise brain.json server.maxBodyKB`
+  // a streamed route holds its 200 head this long for load() (#232): a load that settles in time still answers its
+  // real status (303 redirect, 404 notFound, deliberate 4xx, 500); a slower one streams and handles them inline
+  const STREAM_HOLD = +(o.streamHoldMs ?? 200)
+  const tooBig = (rid, path) => (log('warn', 'body too large', { rid, path, limitKB: BODY_KB, fix: 'Raise brain.json server.maxBodyKB (or BRAIN_MAX_BODY_KB), up to 65536' }), TOO_BIG)
+  const hasManifestSockets = Object.hasOwn(mf,'nativeSockets')
+  if (hasManifestSockets && typeof mf.nativeSockets !== 'boolean') throw Error('Manifest nativeSockets must be an explicit boolean')
+  const nativeSockets = o.nativeSockets === undefined ? hasManifestSockets && mf.nativeSockets : o.nativeSockets
+  if (nativeSockets && !native) throw Error('Native sockets require a configured native backend')
   // the build's single route table (#187): already in match order, each with its RegExp source (named groups = params)
   const routes = mf.routes.map(r => ({ ...r, rx: r.rx ? new RegExp(r.rx) : exact(r.path) }))
   // the real path: Node imports file URLs through realpath, and the /_b/ hook must name the same modules (a symlinked
@@ -427,6 +566,7 @@ export function createServer(o = {}) {
   // Base path (§23 #148): the app lives under mf.base ("/app/"); routes, files and functions are matched on the app
   // path (base stripped); redirects the app gives as app paths get it back.
   const BASE = mf.base || '/'
+  const analyticsTag = native && (o.analytics ?? env.BRAIN_ANALYTICS) !== 'off' && o.analytics !== false ? `<script type="module" async src="${BASE}_brain/analytics.js"></script>` : ''
   const RD = mf.redirects || {}, RDX = (RD.patterns || []).map(p => ({ re: new RegExp(p.re), to: p.to, status: p.status || 301 }))
   // `/old/` and `/old` are the same source (brain-seo normalizes the trailing slash)
   const redirectOf = path => {
@@ -440,6 +580,28 @@ export function createServer(o = {}) {
     return null
   }
   const withBase = u => (typeof u === 'string' && BASE !== '/' && u.startsWith('/') && !u.startsWith('//') && !(u + '/').startsWith(BASE) ? BASE + u.slice(1) : u)
+  // §33 crawler-safe URLs: the redirect rule, the trailing-slash policy (brain.json seo.trailingSlash, default "never")
+  // and the canonical host (seo.canonicalHost → site) are folded into ONE hop; loopback hosts are never redirected
+  // (a proxy that does not forward Host, local runs). The query is kept unless a rule's target has its own.
+  const SLASH = RD.slash || 'never', HOST = typeof RD.host === 'string' && /^https?:\/\//.test(RD.host) ? new URL(RD.host) : null
+  const loopback = h => !h || /^(?:localhost|127(?:\.\d+){3}|\[::1\])(?::\d+)?$/i.test(h)
+  const canonicalOf = (req, url) => {
+    let path = url.pathname, query = url.search, status = 301, moved = false
+    const to = redirectOf(path)
+    if (to) {
+      if (/^https?:\/\//.test(to[0])) return [to[0], to[1], true]
+      const q = to[0].indexOf('?')
+      path = q < 0 ? to[0] : to[0].slice(0, q)
+      if (q >= 0) query = to[0].slice(q)
+      status = to[1]
+      moved = true
+    }
+    if (path !== '/' && SLASH === 'never' && path.endsWith('/')) path = path.replace(/\/+$/, '') || '/'
+    else if (path !== '/' && SLASH === 'always' && !path.endsWith('/') && !/\.[^/]*$/.test(path)) path += '/'
+    const host = HOST && !loopback(req.headers.host) && req.headers.host.toLowerCase() !== HOST.host
+    if (!moved && !host && path === url.pathname) return null
+    return [(host ? HOST.origin : '') + withBase(path) + query, status, host]
+  }
   hook(distURL, BASE)
 
   // ---------- helpers ----------
@@ -476,6 +638,16 @@ export function createServer(o = {}) {
         delete headers['content-length']; delete headers['content-encoding']; delete headers.etag
       }
     }
+    const enc = COMPRESS ? bodyEncoding(res.req, status, headers) : null
+    if (enc != null) {
+      headers = { ...headers, vary: varyEncoding(headers.vary) }
+      const size = body ? Buffer.byteLength(body) : 0
+      if (enc && size >= 1024 && res.req.method !== 'HEAD') {
+        body = encodeBody(enc, Buffer.isBuffer(body) ? body : Buffer.from(body))
+        headers['content-encoding'] = enc
+        delete headers['content-length']
+      }
+    }
     res.writeHead(status, { ...SECURITY, ...(server.draining ? { connection: 'close' } : {}), ...headers })
     res.end(res.req.method === 'HEAD' || status === 204 || status === 205 || status === 304 ? undefined : body)
   }
@@ -488,13 +660,18 @@ export function createServer(o = {}) {
       if (inm && inm.split(',').some(t => t.trim().replace(/^W\//, '') === etag.replace(/^W\//, ''))) return send(res, 304, '', headers)
     }
     const nonce = randomBytes(16).toString('base64')
+    // behavior analytics (docs/backend/analytics.md): with a native backend every page loads its collector as an async
+    // module served by that backend, outside the build and the route budgets; BRAIN_ANALYTICS=off skips the tag
+    if (analyticsTag && !page.includes(analyticsTag)) page = page.includes('</head>') ? page.replace('</head>', analyticsTag + '</head>') : page + analyticsTag
     const body = page.replace(/<script(?![^>]*\bnonce=)/g, `<script nonce="${nonce}"`)
     send(res, status, body, { 'content-type': MIME['.html'], 'content-security-policy': withNonce(mf.csp || CSP0, nonce), 'cache-control': 'no-cache', ...(googleSignInPage(page) ? { 'cross-origin-opener-policy': 'same-origin-allow-popups' } : {}), ...(mf.build ? { 'x-brain-build': mf.build } : {}), ...headers })
   }
   const notFound = (req, res) => failPage(res, 404, res.getHeader('x-request-id'))
+  // `gone()` from load (§33): 410 tells crawlers the URL was removed for good; views/410.brain, else the 404 page
+  const missing = (req, res, x) => (x && x.gone === true ? failPage(res, 410, res.getHeader('x-request-id')) : notFound(req, res))
   const failPage = (res, status, rid) => {
     if (!wantsHtml(res.req)) return send(res, status, json({ schemaVersion: 1, status, rid, error: STATUS_CODES[status] || 'Request failed' }), { 'content-type': MIME['.json'] })
-    const custom = (status === 404 && mf.notFound) || (mf.errors && mf.errors[status]) || `${status}.html`
+    const custom = (status === 404 && mf.notFound) || (mf.errors && mf.errors[status]) || (status === 410 && !file('410.html') ? mf.notFound : `${status}.html`)
     const path = typeof custom === 'string' && file(custom)
     return html(res, status, path ? readFileSync(path, 'utf8') : defaultError(status, rid, BASE))
   }
@@ -521,7 +698,7 @@ export function createServer(o = {}) {
     const { user, session: ses } = native ? { user: req.$nativeUser ?? null, session: native.session(req, res, res.getHeader('x-request-id')) } : sessionFrom(cookies, secret)
     return {
       url, query: Object.fromEntries(url.searchParams), cookies, user, session: ses, env,
-      ...(native ? { backend: Object.freeze({resource: name => native.resource(req, res, res.getHeader('x-request-id'), name),login:credentials=>native.login(req,res,res.getHeader('x-request-id'),credentials)}) } : {}),
+      ...(native ? { backend: native.backend(req, res, res.getHeader('x-request-id')) } : {}),
       // `prefetch`: the router fetched this page ahead of a click (§19); a `load` with side effects can skip them
       prefetch: req.headers['x-brain-prefetch'] === '1',
       req: { method: req.method, headers: req.headers, ip: ipOf(req) }, ...extra,
@@ -601,38 +778,42 @@ export function createServer(o = {}) {
         for (const m of route.middleware || []) middleware.push(await load(m))
         r = await runChain({ guards, middleware, ctx })
       } catch (e) {
-        log('error', 'guard failed', { rid, path: url.pathname, stack: String((e && e.stack) || e) })
+        log('error', 'guard failed', { rid, path: url.pathname, ...trace(e) })
         return errorPage(req, res, route, params, url, rid)
       }
-      if (r.redirect) return send(res, r.status, '', { location: withBase(redirect(r.redirect, r.status ?? 303).redirect), 'cache-control': 'no-store', ...ctx.session.headers() })
+      // a guarded page must not reach the index through its login redirect (§33): the redirect itself says noindex
+      if (r.redirect) return send(res, r.status, '', { location: withBase(redirect(r.redirect, r.status ?? 303).redirect), 'cache-control': 'no-store', 'x-robots-tag': NOINDEX, ...ctx.session.headers() })
       if (r.deny !== undefined) return forbidden(req, res, url, rid, r.deny)
       extra = r.headers
     }
-    if (route.stream && route.server && !fixed && !forms && status === 200 && !res.$capture) return streamed(req, res, route, params, url, rid, ctx, keep(extra || {}))
+    // what load() thrown or returned instead of props answers: redirect, notFound() (F11), deliberate status, failure
+    const loadOutcome = e => {
+      if (e && e.redirect) return send(res, e.status || 303, '', { location: withBase(redirect(e.redirect, e.status ?? 303).redirect), ...ctx.session.headers() })
+      if ((e instanceof HttpError && e.status === 404) || (e && e.notFound === true)) return missing(req, res, e) // `notFound()` 404 / `gone()` 410
+      const status = intendedStatus(e) || 500
+      log('error', 'load failed', { rid, path: url.pathname, status, ...trace(e) })
+      return status === 500 ? errorPage(req, res, route, params, url, rid) : failPage(res, status, rid)
+    }
+    if (route.stream && route.server && !fixed && !forms && status === 200 && !res.$capture) return streamed(req, res, route, params, url, rid, ctx, keep(extra || {}), loadOutcome)
     try {
       if (!fixed && route.server) {
         const m = await load(route.server)
         if (typeof m.load === 'function') props = (await withTimeout(Promise.resolve(m.load(ctx)), TIMEOUT)) ?? {}
       }
     } catch (e) {
-      if (e && e.redirect) return send(res, e.status || 303, '', { location: withBase(redirect(e.redirect, e.status ?? 303).redirect), ...ctx.session.headers() })
-      if ((e instanceof HttpError && e.status === 404) || (e && e.notFound === true)) return notFound(req, res) // `throw notFound()` (F11)
-      const status = intendedStatus(e) || 500
-      log('error', 'load failed', { rid, path: url.pathname, status, stack: String((e && e.stack) || e) })
-      return status === 500 ? errorPage(req, res, route, params, url, rid) : failPage(res, status, rid)
+      return loadOutcome(e)
     }
-    if (props && props.redirect) return send(res, props.status || 303, '', { location: withBase(redirect(props.redirect, props.status ?? 303).redirect), ...ctx.session.headers() })
-    if (props && props.notFound === true) return notFound(req, res) // `return notFound()` (F11)
+    if (props && (props.redirect || props.notFound === true)) return loadOutcome(props) // `return redirect()` / `return notFound()`
     let body, seo, failed
     try {
       const at = { path: url.pathname, params: params || {}, query: Object.fromEntries(url.searchParams) } // route() (§41.5)
       ;({ body, seo, failed } = await (queue = queue.then(() => render(route, props, forms, at), () => render(route, props, forms, at))))
     } catch (e) {
-      log('error', 'render failed', { rid, path: url.pathname, stack: String((e && e.stack) || e) })
+      log('error', 'render failed', { rid, path: url.pathname, ...trace(e) })
       return failPage(res, 500, rid)
     }
     // a component that failed shows its fallback inside the page (still 200); the error goes to the log with the rid
-    for (const f of failed || []) log('error', 'component failed during SSR', { rid, path: url.pathname, comp: f.comp, where: f.w, stack: String((f.e && f.e.stack) || f.e) })
+    for (const f of failed || []) log('error', 'component failed during SSR', { rid, path: url.pathname, comp: f.comp, where: f.w, ...trace(f.e) })
     const page = readFileSync(file(route.page), 'utf8')
       .replace('<!--brain:ssr-->', () => body)
       .replace('<!--brain:props-->', () => jsonInHtml(props))
@@ -644,19 +825,33 @@ export function createServer(o = {}) {
     html(res, status, out, keep({ ...extra, ...ctx.session.headers() }), own ? undefined : 'W/"' + tag(out) + '"')
   }
   // Streaming SSR (#232, `route.stream`: the build sets it when the view's <meta seo> is static and it has a load()):
-  // the page up to the region (head, CSS, layout shell) is sent at once, the view when load() ends. The status and
-  // headers are already out by then, so a redirect from load() becomes location.replace and a failure an inline notice
-  // with the request id (both logged); load() cannot change the session on a streamed route.
-  async function streamed(req, res, route, params, url, rid, ctx, extra) {
+  // load() starts first and the head waits up to STREAM_HOLD for it: a load that redirects, is not found or throws a
+  // status in that time gets the same answer as a non-streamed route (`outcome`). Past it, the page up to the region
+  // (head, CSS, layout shell) is sent, the view when load() ends. The status and headers are out by then, so a late
+  // redirect becomes location.replace and a late failure an inline notice with the request id (both logged); load()
+  // cannot change the session on a streamed route.
+  async function streamed(req, res, route, params, url, rid, ctx, extra, outcome) {
     const [top, bottom = ''] = readFileSync(file(route.page), 'utf8').split('<!--brain:ssr-->')
     const sm = await load(route.server)
+    const loadP = typeof sm.load === 'function' ? withTimeout(Promise.resolve().then(() => sm.load(ctx)), TIMEOUT) : Promise.resolve(null)
+    loadP.catch(() => {}) // handled below; never an unhandled rejection while the loading view renders
+    let timer
+    const early = await Promise.race([loadP.then(v => ({ v }), e => ({ e })), new Promise(r => (timer = setTimeout(r, STREAM_HOLD)))])
+    clearTimeout(timer)
+    if (early && (early.e !== undefined || (early.v && (early.v.redirect || early.v.notFound === true)))) return outcome(early.e !== undefined ? early.e : early.v)
     const seoF = sm.seo || (await load(route.view)).default.seo
     if (route.i18n) await load(route.i18n)
     const nonce = randomBytes(16).toString('base64'), n = h => h.replace(/<script(?![^>]*\bnonce=)/g, `<script nonce="${nonce}"`)
+    const enc = COMPRESS && req.method !== 'HEAD' ? acceptedEncodings(req.headers['accept-encoding'], DYNAMIC)[0] : null
     res.writeHead(200, {
       ...SECURITY, 'content-type': MIME['.html'], 'content-security-policy': withNonce(mf.csp || CSP0, nonce), 'cache-control': 'no-cache',
       ...(mf.build ? { 'x-brain-build': mf.build } : {}), ...extra, ...ctx.session.headers(),
+      ...(COMPRESS ? { vary: varyEncoding(extra.vary) } : {}), ...(enc ? { 'content-encoding': enc } : {}),
     })
+    // each chunk is flushed through the encoder, so the head still reaches the browser before load() ends
+    const zs = enc ? encodeStream(enc) : null
+    if (zs) zs.pipe(res)
+    const write = s => (zs ? (zs.write(s), zs.flush()) : res.write(s))
     globalThis.__brainLocale = route.locale || null
     let seo0 = null
     try {
@@ -664,25 +859,22 @@ export function createServer(o = {}) {
     } finally {
       globalThis.__brainLocale = null
     }
-    // load() starts now: the loading view (#253) renders while it runs
-    const loadP = typeof sm.load === 'function' ? withTimeout(Promise.resolve().then(() => sm.load(ctx)), TIMEOUT) : Promise.resolve(null)
-    loadP.catch(() => {}) // handled below; never an unhandled rejection while the loading view renders
     const at = { path: url.pathname, params: params || {}, query: Object.fromEntries(url.searchParams) }
-    res.write(n(head(top, seo0, url.pathname)))
+    write(n(head(top, seo0, url.pathname)))
     // QA #253: the folder's _loading.brain goes in the region with the first chunk (SPEC: shows while load runs),
     // between two marker comments; the last chunk starts with a script that removes them and what is between
     let clear = ''
-    if (route.loading) {
+    if (route.loading && !early) { // the loading view (#253) only when load() is still running
       try {
         const lr = { ...route, view: route.loading, layouts: [], server: null }
         const { body } = await (queue = queue.then(() => render(lr, {}, null, at), () => render(lr, {}, null, at)))
-        res.write(n(`<!--brain:loading-->${body}<!--/brain:loading-->`))
+        write(n(`<!--brain:loading-->${body}<!--/brain:loading-->`))
         clear = `<script>{const s=document.currentScript;let x=0;for(const c of[...s.parentNode.childNodes]){if(c.data=='brain:loading')x=1;if(x)c.remove();if(c.data=='/brain:loading')x=0}s.remove()}</script>`
       } catch (e) {
-        log('error', 'loading view failed (streamed)', { rid, path: url.pathname, stack: String((e && e.stack) || e) })
+        log('error', 'loading view failed (streamed)', { rid, path: url.pathname, ...trace(e) })
       }
     }
-    const end = (body, props = {}, b = bottom) => res.end(n(clear + body + b.replace('<!--brain:props-->', () => jsonInHtml(props))))
+    const end = (body, props = {}, b = bottom) => (zs || res).end(n(clear + body + b.replace('<!--brain:props-->', () => jsonInHtml(props))))
     // QA #289: the page closes with the _error.brain template (its client mounts the error view with { message, rid }),
     // never with the route's own mount script, which would replace the error with the view rendered from {}. Without an
     // _error.brain the notice stays: the view's mount script is left out.
@@ -699,19 +891,20 @@ export function createServer(o = {}) {
       props = (await loadP) ?? {}
       if (props.redirect || props.notFound === true) throw props
     } catch (e) {
-      if (e && e.redirect) return end(`<script>location.replace(${jsonInHtml(withBase(redirect(e.redirect, e.status ?? 303).redirect))})</script>`)
+      // too late for a real redirect: the page says noindex so the stub never enters the index
+      if (e && e.redirect) return end(`<meta name="robots" content="noindex"><script>location.replace(${jsonInHtml(withBase(redirect(e.redirect, e.status ?? 303).redirect))})</script>`)
       // a streamed page already sent its 200 head: the region gets the not-found notice and the page is noindex
       if (e && e.notFound === true) return end(`<meta name="robots" content="noindex"><p role="alert" class="brain-fallback">Page not found.</p>`, {}, bottom.replace(/<script type="module">(?:(?!<\/script>)[\s\S])*?brain-view[\s\S]*?<\/script>/g, ''))
-      log('error', 'load failed (streamed)', { rid, path: url.pathname, status: 200, stack: String((e && e.stack) || e) }) // headers already out
+      log('error', 'load failed (streamed)', { rid, path: url.pathname, status: 200, ...trace(e) }) // headers already out
       return fail()
     }
     try {
       const { body, failed } = await (queue = queue.then(() => render(route, props, null, at), () => render(route, props, null, at)))
-      for (const f of failed || []) log('error', 'component failed during SSR', { rid, path: url.pathname, comp: f.comp, where: f.w, stack: String((f.e && f.e.stack) || f.e) })
+      for (const f of failed || []) log('error', 'component failed during SSR', { rid, path: url.pathname, comp: f.comp, where: f.w, ...trace(f.e) })
       const pm = params && Object.keys(params).length ? `<meta name="brain-params" content="${esc(JSON.stringify(params))}">` : ''
       end(pm + body, props)
     } catch (e) {
-      log('error', 'render failed (streamed)', { rid, path: url.pathname, status: 200, stack: String((e && e.stack) || e) })
+      log('error', 'render failed (streamed)', { rid, path: url.pathname, status: 200, ...trace(e) })
       await fail()
     }
   }
@@ -728,6 +921,7 @@ export function createServer(o = {}) {
   }
   // deny → views/403.brain (manifest `forbidden`, props.reason) or the static 403.html, always status 403
   function forbidden(req, res, url, rid, reason) {
+    res.setHeader('x-robots-tag', NOINDEX) // a members-only page never enters the index (§33)
     if (!wantsHtml(req)) return failPage(res, 403, rid)
     if (mf.forbidden) return ssr(req, res, mf.forbidden, {}, url, rid, null, 403, { reason })
     const f = file('403.html')
@@ -802,7 +996,7 @@ export function createServer(o = {}) {
     try {
       raw = await body(req, MAX_BODY)
     } catch {
-      return fail(413, 'Body larger than 64 KB')
+      return fail(413, tooBig(rid, url.pathname))
     }
     if (native) await native.prepare(req, res, rid)
     const ctx = context(req, res, url, { params: {} })
@@ -810,11 +1004,11 @@ export function createServer(o = {}) {
     try {
       f = (await load(modPath))[fn]
     } catch (e) {
-      log('error', 'rpc module failed to load', { rid, fn: hash + '/' + fn, stack: String((e && e.stack) || e) })
+      log('error', 'rpc module failed to load', { rid, fn: hash + '/' + fn, ...trace(e) })
       return fail(500, 'Internal error', { rid })
     }
     const r = await callRpc({ fn: f, args: raw, ctx, timeout: TIMEOUT })
-    if (r.cause) log('error', r.status === 504 ? 'rpc timeout' : 'rpc failed', { rid, fn: hash + '/' + fn, ms: TIMEOUT, stack: String((r.cause && r.cause.stack) || r.cause) })
+    if (r.cause) log('error', r.status === 504 ? 'rpc timeout' : 'rpc failed', { rid, fn: hash + '/' + fn, ms: TIMEOUT, ...trace(r.cause) })
     const b = r.status >= 500 ? { ...r.body, rid } : r.body
     send(res, r.status, json(b), { 'content-type': MIME['.json'], 'cache-control': 'no-store', ...(r.headers || {}), ...ctx.session.headers() })
   }
@@ -842,7 +1036,7 @@ export function createServer(o = {}) {
     try {
       raw = await body(req, MAX_BODY)
     } catch {
-      return plain(413, 'Form larger than 64 KB')
+      return plain(413, tooBig(rid, url.pathname))
     }
     const id = new URLSearchParams(raw).get('_brain') || '', modPath = mf.rpc[id.split('/')[0]]
     if (!modPath) return plain(400, 'Unknown form')
@@ -852,12 +1046,13 @@ export function createServer(o = {}) {
     try {
       module = await load(modPath)
       rules = await load('_server/brain-form.js')
+      if (route.i18n) await load(route.i18n) // the page's dictionary: validation messages in its language (§37)
     } catch (e) {
-      log('error', 'form module failed to load', { rid, fn: id, stack: String((e && e.stack) || e) })
+      log('error', 'form module failed to load', { rid, fn: id, ...trace(e) })
       return failPage(res, 500, rid)
     }
-    const r = await callForm({ module, raw, ctx, rules, key: ipOf(req) + ' ' + id, limit: LIMIT, timeout: TIMEOUT })
-    if (r.cause) log('error', 'form failed', { rid, fn: id, stack: String((r.cause && r.cause.stack) || r.cause) })
+    const r = await callForm({ module, raw, ctx, rules, key: ipOf(req) + ' ' + id, limit: LIMIT, timeout: TIMEOUT, locale: route.locale })
+    if (r.cause) log('error', 'form failed', { rid, fn: id, ...trace(r.cause) })
     if (r.status === 303) return send(res, 303, '', { location: withBase(r.location), 'cache-control': 'no-store', ...ctx.session.headers() })
     if (r.status === 422) return ssr(req, res, route, params, url, rid, r.state, 422)
     plain(r.status, r.body.error, r.headers)
@@ -895,11 +1090,13 @@ export function createServer(o = {}) {
         for (const p of Array.isArray(list) ? list : []) {
           const path = fill(r.path, p)
           if (!path) continue
-          if (urls.length < MAX_URLS) urls.push({ loc: origin + withBase(path), lastmod: day(p.lastmod) })
+          const loc = origin + withBase(path)
+          if (loc.length > 2048) log('warn', 'sitemap(): URL longer than 2048 characters left out; fix: shorten the slug', { view: r.view, loc: loc.slice(0, 120) })
+          else if (urls.length < MAX_URLS) urls.push({ loc, lastmod: day(p.lastmod) })
           else dropped++
         }
       } catch (e) {
-        log('error', 'sitemap() failed', { view: r.view, stack: String((e && e.stack) || e) })
+        log('error', 'sitemap() failed', { view: r.view, ...trace(e) })
       }
     }
     if (dropped) log('warn', 'sitemap(): more than 50000 URLs, the rest are not listed', { dropped })
@@ -912,6 +1109,23 @@ export function createServer(o = {}) {
     if (!dynRun) dynRun = collect(origin).finally(() => (dynRun = null))
     return dynRun
   }
+  // §33 S01: every sitemap file holds at most 50 000 URLs and SITEMAP_BYTES bytes of UTF-8 XML; the dynamic URLs fill
+  // /sitemap-dynamic.xml, /sitemap-dynamic-2.xml, … in sitemap() order, so the split is deterministic
+  const SET_HEAD = '<?xml version="1.0" encoding="UTF-8"?>\n<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">\n'
+  const SET_FOOT = '</urlset>\n'
+  const bytes = t => Buffer.byteLength(t)
+  function pages(urls) {
+    const out = [[]]
+    let size = bytes(SET_HEAD + SET_FOOT)
+    for (const u of urls) {
+      const line = `  <url><loc>${esc(u.loc)}</loc>${u.lastmod ? `<lastmod>${esc(u.lastmod)}</lastmod>` : ''}</url>\n`
+      const n = bytes(line)
+      if (out.at(-1).length && (out.at(-1).length >= MAX_URLS || size + n > SITEMAP_BYTES)) out.push([]), (size = bytes(SET_HEAD + SET_FOOT))
+      out.at(-1).push(line)
+      size += n
+    }
+    return out.map(p => p.join(''))
+  }
   async function serveSitemap(req, res, url) {
     const f = file('/sitemap.xml')
     if (!f) return false
@@ -919,22 +1133,24 @@ export function createServer(o = {}) {
     const origin = [...text.matchAll(/<loc>(https?:\/\/[^<]+)<\/loc>/g)].map(m => URL.canParse(m[1]) && new URL(m[1]).origin).find(Boolean)
     if (!origin) return false
     const index = text.includes('<sitemapindex')
-    const urls = await dynamicUrls(origin)
-    // a urlset that would pass 50 000 URLs with the dynamic ones is split: index → static file + dynamic file
-    const split = !index && (text.match(/<url>/g) || []).length + urls.length > MAX_URLS
+    const sets = pages(await dynamicUrls(origin))
+    // a urlset that would pass either limit with the dynamic URLs is split: index → static file + dynamic file(s)
+    const split = !index && (sets.length > 1 || (text.match(/<url>/g) || []).length + (sets[0].match(/<url>/g) || []).length > MAX_URLS || bytes(text) + bytes(sets[0]) > SITEMAP_BYTES)
     const xml = body => send(res, 200, req.method === 'HEAD' ? '' : body, { 'content-type': MIME['.xml'], 'cache-control': 'public, max-age=300' })
     if (url.pathname === '/sitemap-static.xml') return split ? (xml(text), true) : false
-    if (url.pathname === '/sitemap-dynamic.xml' && !index && !split) return false
+    const name = i => (i ? `/sitemap-dynamic-${i + 1}.xml` : '/sitemap-dynamic.xml')
     const child = p => `  <sitemap><loc>${esc(origin + withBase(p))}</loc></sitemap>\n`
-    const set = urls.map(u => `  <url><loc>${esc(u.loc)}</loc>${u.lastmod ? `<lastmod>${esc(u.lastmod)}</lastmod>` : ''}</url>\n`).join('')
+    const kids = sets.map((_, i) => child(name(i))).join('')
+    if (url.pathname !== '/sitemap.xml') {
+      const i = sets.findIndex((_, i) => name(i) === url.pathname)
+      return i >= 0 && (index || split) ? (xml(SET_HEAD + sets[i] + SET_FOOT), true) : false
+    }
     xml(
-      url.pathname === '/sitemap-dynamic.xml'
-        ? `<?xml version="1.0" encoding="UTF-8"?>\n<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">\n${set}</urlset>\n`
-        : index
-          ? text.replace('</sitemapindex>', `${child('/sitemap-dynamic.xml')}</sitemapindex>`)
-          : split
-            ? `<?xml version="1.0" encoding="UTF-8"?>\n<sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">\n${child('/sitemap-static.xml')}${child('/sitemap-dynamic.xml')}</sitemapindex>\n`
-            : text.replace('</urlset>', set + '</urlset>'),
+      index
+        ? text.replace('</sitemapindex>', `${kids}</sitemapindex>`)
+        : split
+          ? `<?xml version="1.0" encoding="UTF-8"?>\n<sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">\n${child('/sitemap-static.xml')}${kids}</sitemapindex>\n`
+          : text.replace('</urlset>', sets[0] + '</urlset>'),
     )
     return true
   }
@@ -963,7 +1179,7 @@ export function createServer(o = {}) {
   function serveStatic(req, res, url) {
     const p = publicStaticPath(url.pathname)
     if (p === null) return false
-    const candidates = p.endsWith('/') ? [p + 'index.html'] : [p, p + '.html', p + '/index.html']
+    const candidates = p.endsWith('/') ? [p + 'index.html', ...(p.length > 1 ? [p.slice(0, -1) + '.html'] : [])] : [p, p + '.html', p + '/index.html']
     for (const c of candidates) {
       const f = file(c)
       if (!f) continue
@@ -982,13 +1198,16 @@ export function createServer(o = {}) {
         'cache-control': p.startsWith('/_b/') ? 'public, max-age=31536000, immutable' : p === '/sw.js' ? 'no-cache' : 'public, max-age=3600',
         vary: 'accept-encoding',
       }
+      // the smallest precompressed sibling the client accepts (the build keeps only those smaller than the file)
+      let best = null
       for (const enc of acceptedEncodings(req.headers['accept-encoding'])) {
-        const suffix = enc === 'br' ? '.br' : '.gz'
-        const encoded = file(c + suffix)
-        if (encoded) {
-          send(res, 200, req.method === 'HEAD' ? '' : readFileSync(encoded), { ...headers, 'content-encoding': enc })
-          return true
-        }
+        const encoded = file(c + (enc === 'br' ? '.br' : enc === 'zstd' ? '.zst' : '.gz'))
+        const size = encoded ? statSync(encoded).size : Infinity
+        if (encoded && (!best || size < best.size)) best = { enc, encoded, size }
+      }
+      if (best) {
+        send(res, 200, req.method === 'HEAD' ? '' : readFileSync(best.encoded), { ...headers, 'content-encoding': best.enc })
+        return true
       }
       send(res, 200, req.method === 'HEAD' ? '' : readFileSync(f), headers)
       return true
@@ -1018,12 +1237,9 @@ export function createServer(o = {}) {
       req.$brainPath = url.pathname
       if (native && /^\/(?:api(?:\/|$)|_brain(?:\/|$)|s\/)/.test(url.pathname)) return await native.proxy(req,res,url,rid,send)
       // redirects.json (manifest `redirects`, brain-seo server_json): exact sources first, then patterns, on the app path;
-      // same-site targets get the base, the query is kept when the target has none
-      const to = redirectOf(url.pathname)
-      if (to && (req.method === 'GET' || req.method === 'HEAD')) {
-        const loc = /^https?:\/\//.test(to[0]) ? to[0] : withBase(to[0]) + (to[0].includes('?') ? '' : url.search)
-        return send(res, to[1], '', { location: loc, 'cache-control': to[1] === 301 || to[1] === 308 ? 'public, max-age=3600' : 'no-store' }, true)
-      }
+      // same-site targets get the base, the query is kept when the target has none; slash policy and host in the same hop
+      const to = (req.method === 'GET' || req.method === 'HEAD') && canonicalOf(req, url)
+      if (to) return send(res, to[1], '', { location: to[0], 'cache-control': to[1] === 301 || to[1] === 308 ? 'public, max-age=3600' : 'no-store' }, to[2])
       const r = /^\/_r\/([\w-]+)\/([\w$]+)$/.exec(url.pathname)
       if (r) return await rpc(req, res, r[1], r[2], url, rid)
       if (url.pathname.startsWith('/_r/')) return send(res, 404, json({ error: 'Unknown function' }), { 'content-type': MIME['.json'] })
@@ -1039,16 +1255,17 @@ export function createServer(o = {}) {
         return await (post ? formPost : ssr)(req, res, route, m.groups ? { ...m.groups } : {}, url, rid)
       }
       if (post) return send(res, 405, 'Method not allowed', { allow: 'GET, HEAD' })
-      if (DYN.length && (url.pathname === '/sitemap.xml' || url.pathname === '/sitemap-dynamic.xml' || url.pathname === '/sitemap-static.xml') && (await serveSitemap(req, res, url))) return
+      if (DYN.length && /^\/sitemap(-static|-dynamic(-\d+)?)?\.xml$/.test(url.pathname) && (await serveSitemap(req, res, url))) return
       if (serveStatic(req, res, url)) return
       notFound(req, res)
     } catch (e) {
-      log('error', 'unhandled', { rid, path: req.url, stack: String((e && e.stack) || e) })
+      log('error', 'unhandled', { rid, path: req.url, ...trace(e) })
       if (!res.headersSent) failPage(res, intendedStatus(e) || 500, rid)
       else res.end()
     }
   })
   if (native) server.once('close', () => native.close())
+  if (native && nativeSockets) server.$brainSocketStop = installNativeSockets(server,{target:o.backendURL ?? env.BRAIN_BACKEND_URL,base:BASE,cookie:native._socketCookie,log})
   server.headersTimeout = 15000
   server.requestTimeout = 30000
   return server
@@ -1196,6 +1413,8 @@ export async function callRpc({ fn, args, ctx, key, limit = 60, timeout = 10000
   } catch (e) {
     if (e && e.errors && typeof e.errors === 'object') return { status: 422, body: { error: e.message || 'Invalid input', errors: e.errors } }
     if (e instanceof HttpError && e.status === 504) return { status: 504, body: { error: 'Timeout' }, cause: e }
+    const pub = publicError(e)
+    if (pub) return { status: pub.status, body: { error: pub.message } }
     const deliberate = intendedStatus(e)
     if (deliberate && deliberate < 500) return { status: deliberate, body: { error: e instanceof HttpError ? e.message : STATUS_CODES[deliberate] } }
     if (deliberate) return {status:deliberate,body:{error:STATUS_CODES[deliberate]},cause:e}
@@ -1205,7 +1424,10 @@ export async function callRpc({ fn, args, ctx, key, limit = 60, timeout = 10000
 // A form posted without JS (§38) → { status: 303, location } | { status: 422, state } | { status, body } (400/429).
 // `module` exports the function and `$forms`; `rules` = { rule, check } (brain-schema / brain-form). `state` is what the
 // page re-renders with: { '<hash>/<fn>': { values, errors, error } }.
-export async function callForm({ module, raw, ctx, rules, key, limit = 60, timeout = 10000 }) {
+// `locale` (§37): the page's language, so the schema messages (`form.*`) and the generic error come from its dictionary
+// (globalThis.__brainDict, filled by the page's chunk) like form() in the browser. It is set only around the synchronous
+// validation, so concurrent requests in other languages never see it.
+export async function callForm({ module, raw, ctx, rules, key, limit = 60, timeout = 10000, locale }) {
   const q = new URLSearchParams(raw || ''), id = q.get('_brain') || '', fn = id.split('/')[1] || ''
   if (key) {
     const ra = overLimit(key, limit)
@@ -1213,7 +1435,16 @@ export async function callForm({ module, raw, ctx, rules, key, limit = 60, timeo
   }
   if (!/^[A-Za-z_$][\w$]*$/.test(fn) || typeof (module && module[fn]) !== 'function') return { status: 400, body: { error: 'Unknown form' } }
   const schema = module.$forms && module.$forms[fn]
-  const { values, errors } = schema ? coerce(rules, schema, q) : { values: Object.fromEntries([...q].filter(([k]) => k !== '_brain')), errors: {} }
+  const G = globalThis, had = '__brainLocale' in G, prev = G.__brainLocale
+  let values, errors, generic
+  if (locale) G.__brainLocale = locale
+  try {
+    ;({ values, errors } = schema ? coerce(rules, schema, q) : { values: Object.fromEntries([...q].filter(([k]) => k !== '_brain')), errors: {} })
+    const D = G.__brainDict, m = locale && D && D[locale] && D[locale]['form.error']
+    generic = typeof m === 'string' ? m : 'Something went wrong. Try again.'
+  } finally {
+    if (locale) had ? (G.__brainLocale = prev) : delete G.__brainLocale
+  }
   const again = (errs, error, cause) => ({ status: 422, state: { [id]: { values, errors: errs, error } }, cause })
   if (Object.keys(errors).length) return again(errors, '')
   let r
@@ -1222,10 +1453,12 @@ export async function callForm({ module, raw, ctx, rules, key, limit = 60, timeo
   } catch (e) {
     if (e && e.errors && typeof e.errors === 'object') return again(e.errors, '')
     if (e instanceof HttpError && e.status >= 400 && e.status < 500) return again({}, e.message)
+    const pub = publicError(e)
+    if (pub) return again({}, pub.message)
     const deliberate = intendedStatus(e)
     if (deliberate && deliberate < 500) return {status:deliberate,body:{error:STATUS_CODES[deliberate]}}
     if (deliberate) return {status:deliberate,body:{error:STATUS_CODES[deliberate]},cause:e}
-    return again({}, 'Something went wrong. Try again.', e)
+    return again({}, generic, e)
   }
   if (r && r.errors) return again(r.errors, '')
   const to = r && r.redirect != null ? safeLocation(r.redirect) : ctx.url.pathname + ctx.url.search
@@ -1284,7 +1517,7 @@ function body(req, max) {
     // past the limit the rest is drained without keeping it (so the 413 reaches the client); far past it, cut
     req.on('data', c => {
       n += c.length
-      if (n > 16 * max) req.destroy()
+      if (n > max + Math.min(15 * max, 16 << 20)) req.destroy() // at most 16 MB of drain for a large limit
       else if (n <= max) parts.push(c)
     })
     req.on('end', () => (n > max ? fail(new Error('too large')) : ok(Buffer.concat(parts).toString('utf8'))))
@@ -1426,6 +1659,7 @@ if (process.argv[1] && real(process.argv[1]) === real(fileURLToPath(import.meta.
   const drain = () => {
     if (s.draining) return
     s.draining = true
+    s.$brainSocketStop?.()
     const ms = +(ENV.BRAIN_DRAIN_MS || 10000)
     const force = setTimeout(() => {
       s.closeAllConnections()