@christianirack/brainllm-runtime 0.8.8 → 0.8.10

package/brain-form.js

@@ -305,7 +305,7 @@ function createForm(schema, o, readRule, validateRule, remote) {
         else {
           saved.v = untrack(now) // saved: no longer dirty
           // `return { redirect: '/x' }` from the server function: the same page the 303 reaches without JS (§38)
-          if (typeof r?.redirect === 'string' && r.redirect[0] === '/' && r.redirect[1] !== '/') go(r.redirect)
+          if (typeof r?.redirect === 'string' && /^\/(?![\/\\])/.test(r.redirect) && !/[\\\x00-\x20\x7f]/.test(r.redirect)) go(r.redirect)
         }
         return r
       } catch (x) {

package/brain-lazy.js

@@ -23,6 +23,16 @@ function reloadOnce() {
   }
 }
 
+// The observer is built in its own scope and reaches `go` through a box emptied on stop. A callback closing over
+// lazy()'s scope kept the owner, the props and the built component alive after unmount and disconnect() (measured:
+// parent and child survived forced GCs for the whole 10 s `--heap` grace, B0601; Chrome still holds the observer).
+function visible(el, go) {
+  const box = { go }
+  const io = new IntersectionObserver(es => es.some(e => e.isIntersecting) && box.go?.(), { rootMargin: '200px' })
+  io.observe(el)
+  return () => { box.go = null; io.disconnect() }
+}
+
 export function lazy(el, imp, mode, props = {}) {
   const owner = I.owner()
   let dead = false, stop = () => {}, retry = () => {}, clicked = null, built
@@ -77,11 +87,8 @@ export function lazy(el, imp, mode, props = {}) {
     }
   } else if (G.document && document.visibilityState === 'hidden') {
     go() // a hidden tab runs no observer: without this the content is missing until the tab is shown
-  } else if (G.IntersectionObserver) {
-    const io = new IntersectionObserver(es => es.some(e => e.isIntersecting) && go(), { rootMargin: '200px' })
-    io.observe(el)
-    stop = () => io.disconnect()
-  } else go()
+  } else if (G.IntersectionObserver) stop = visible(el, go)
+  else go()
   if (owner)
     fx(() => () => {
       dead = true

package/brain-router.js

@@ -15,6 +15,10 @@
 // else → full page load: the server decides.
 import { prefetchPage } from './brain-prefetch-shared.js'
 const G = globalThis
+// The view mounted after a swap is a new page: its components number their instance ids from the start (codegen #268:
+// the first keeps `id`, later ones `id~2`), as the server does per render. Without this, a layout header mounted again
+// on each navigation counted the page it replaced and came back as `main-nav~2`, so `#main-nav` CSS stopped applying.
+const fresh = () => { G.__brainIds = (G.__brainIds || 0) + 1 }
 // Base path (<meta name="brain-base" content="/app/">, §23 #148): links in the HTML already carry it; guards and
 // routes work with app paths (strip), and app paths given to go()/navigate()/redirect() get it (app). '/' when absent.
 const base = () => G.document?.querySelector('meta[name=brain-base]')?.getAttribute('content') || '/'
@@ -73,17 +77,20 @@ export function redirect(url, status = 303) {
   throw { redirect: String(url), status }
 }
 export const deny = (reason = 'Forbidden') => ({ deny: String(reason) })
+// A guard redirects to same-site paths only: `//host`, `/\\host` and a control character after the first `/` (browsers
+// drop tabs and newlines) leave the site. Anything else is a full load, where the server's redirect() refuses it.
+const local = u => typeof u === 'string' && /^\/(?![\/\\])/.test(u) && !/[\\\x00-\x20\x7f]/.test(u)
 // guard result → true (go on) · false (cancel) · string (redirect) · null (full load: the server decides, e.g. 403)
 const outcome = v =>
   v && typeof v === 'object'
     ? typeof v.redirect === 'string'
-      ? v.redirect
+      ? local(v.redirect) ? v.redirect : null
       : v.deny !== undefined
         ? null
         : true
-    : v === false || typeof v === 'string'
+    : v === false || local(v)
       ? v
-      : true
+      : typeof v === 'string' ? null : true
 
 export function router(o = {}) {
   const region = o.region || 'main'
@@ -124,7 +131,7 @@ export function router(o = {}) {
         v = await g(ctx)
       } catch (e) {
         if (asked) return null
-        return typeof e?.redirect === 'string' ? e.redirect : null
+        return local(e?.redirect) ? e.redirect : null
       }
       v = outcome(v)
       if (v !== true) return asked ? null : v
@@ -170,6 +177,7 @@ export function router(o = {}) {
             const el = document.querySelector(region), mount = c.m || c.mount
             if (w.done || my !== seq || !el || !mount) return // the page arrived first
             dispose(el)
+            fresh()
             for (const n of [...el.childNodes]) if (!/^(STYLE|LINK)$/.test(n.nodeName)) n.remove() // the view's CSS stays (BUILD #35)
             el.$d = mount(v.default, el, {})
           })
@@ -207,6 +215,7 @@ export function router(o = {}) {
       const swap = () => {
         if (my !== seq) return
         dispose(cur)
+        fresh()
         cur.replaceChildren(...[...next.childNodes].map(adopt))
         // Scripts parsed by DOMParser never run: the region's own scripts (the view's mount, `e.$d = mount(...)`) are
         // recreated so they execute. Already-imported modules come from the module map: their state survives.
@@ -490,6 +499,7 @@ export function predict(o = {}, same = () => false) {
     if (dead || document.hidden || net?.saveData) return
     while (busy < PARALLEL && queue.length) {
       const k = queue.shift()
+      rank.delete(k) // rank only orders the queue: it leaves with the entry
       if (cache.has(k)) continue
       busy++
       get(k).finally(() => { busy--; pump() })
@@ -516,7 +526,7 @@ export function predict(o = {}, same = () => false) {
   const evs = ['pointerover', 'focusin', 'touchstart']
   for (const t of evs) document.addEventListener(t, intent, { passive: true, capture: true })
   const forget = () => {
-    epoch++; queue.length = 0; cache.clear(); bytes = 0; count = 0
+    epoch++; queue.length = 0; rank.clear(); cache.clear(); bytes = 0; count = 0
     for (const c of running.values()) c.abort()
     running.clear()
   }
@@ -526,13 +536,13 @@ export function predict(o = {}, same = () => false) {
     for (const { target: a, isIntersecting } of es) {
       const k = ok(a), i = queue.indexOf(k)
       if (isIntersecting) thin() || want(k, false, (a.closest('footer,aside') ? 1e7 : 0) + a.getBoundingClientRect().top)
-      else if (i >= 0) queue.splice(i, 1) // left the viewport before its turn
+      else if (i >= 0) queue.splice(i, 1), rank.delete(k) // left the viewport before its turn
     }
   }, { rootMargin: '200px' })
   return {
     scan() {
       if (dead) return
-      count = 0; queue.length = 0; planned.clear(); seen = new WeakSet(); io?.disconnect()
+      count = 0; queue.length = 0; rank.clear(); planned.clear(); seen = new WeakSet(); io?.disconnect()
       const anchors = document.querySelectorAll('a[href]'), allowed = new Set()
       for (const a of anchors) { const k = ok(a); if (k) allowed.add(k); if (io && !seen.has(a)) { seen.add(a); io.observe(a) } }
       // Compiler-generated graph, validated against the current DOM: hidden/opted-out links cannot sneak in.

package/brain.js

@@ -277,11 +277,16 @@ export function insert(p, f, end) {
 
 // aria-* and data-* are enumerated, not boolean: true and false render as text (k[4] is their dash)
 // A select only takes a value its options offer, and {#each}/{#if} options mount after attr() or change later.
+// An array (<select multiple>) selects each option it lists (value attribute, else text, as the browser reads it).
+const pick = (el, v) => {
+  if (!Array.isArray(v)) return el.value !== v && (el.value = v)
+  for (const o of el.querySelectorAll('option')) o.selected = v.includes(o.getAttribute('value') ?? o.textContent)
+}
 const keepSelected = (el, f, M = globalThis.MutationObserver) =>
   M && new M(() => {
-    const i = el.selectedIndex
-    el.value = typeof f == 'function' ? untrack(f) : f
-    if (el.selectedIndex < 0) el.selectedIndex = i // no option matches yet: the browser's choice stays
+    const i = el.selectedIndex, v = typeof f == 'function' ? untrack(f) : f
+    pick(el, v)
+    if (el.selectedIndex < 0 && !Array.isArray(v)) el.selectedIndex = i // no option matches yet: the browser's choice stays
   }).observe(el, { childList: true, subtree: true })
 
 export function attr(el, k, f) {
@@ -290,18 +295,45 @@ export function attr(el, k, f) {
     k.startsWith('style:')
       ? ((k = k.slice(6)), v => (v == null || v === false ? el.style.removeProperty(k) : el.style.setProperty(k, v)))
       : /^(value|checked|selected)$/.test(k) && !(k == 'value' && el.tagName == 'OPTION') // an option's value is its attribute (SSR, value="")
-        ? ((el.tagName == 'SELECT' && k == 'value') ? keepSelected(el, f) : 0, v => {
-            if (el[k] !== v) el[k] = v
-          })
-        : v => (v == null || (v === false && k[4] != '-') ? el.removeAttribute(k) : el.setAttribute(k, v === true && k[4] != '-' ? '' : /^(href|src|action|formaction|poster)$/.test(k) && typeof v == 'string' ? inBase(v) : v))
+        ? el.tagName == 'SELECT' && k == 'value'
+          ? (keepSelected(el, f), v => pick(el, v))
+          : v => {
+              if (el[k] !== v) el[k] = v
+            }
+        : v => (v == null || (v === false && k[4] != '-') ? el.removeAttribute(k) : el.setAttribute(k, v === true && k[4] != '-' ? '' : typeof v == 'string' ? safeUrl(el, k, v) : v))
   )
 }
+// Attributes whose value is a URL the browser follows or loads (§31): one list for the browser and SSR (server.mjs renders
+// through this same attr()); brain-check security.rs URL_ATTRS checks literal values against the same names.
+// `url`: one URL · `list`: a srcset (`url descriptor, …`) · `space`: space-separated URLs. `data` is a URL on <object> only.
+const URL_ATTRS = { href: 'url', src: 'url', action: 'url', formaction: 'url', poster: 'url', 'xlink:href': 'url', cite: 'url', data: 'url', background: 'url', longdesc: 'url', manifest: 'url', codebase: 'url', icon: 'url', srcset: 'list', imagesrcset: 'list', ping: 'space' }
+const safeUrl = (el, k, v, kind = Object.hasOwn(URL_ATTRS, k.toLowerCase()) && URL_ATTRS[k.toLowerCase()]) =>
+  !kind || (k.toLowerCase() == 'data' && el.tagName != 'OBJECT') ? v
+    : kind == 'url' ? inBase(v)
+    : kind == 'space' ? v.split(/\s+/).filter(Boolean).map(u => inBase(u)).filter(Boolean).join(' ')
+    : srcsetCandidates(v).map(([u, d]) => [inBase(u), d]).filter(([u]) => u).map(([u, d]) => d ? u + ' ' + d : u).join(', ')
+// `a.jpg 1x, data:image/png;base64,AA== 2x` → [[url, descriptor], …] (HTML srcset parsing: a URL ends at whitespace,
+// trailing commas end a candidate without descriptor, descriptors run to the next comma).
+const srcsetCandidates = (v, out = [], i = 0) => {
+  for (;;) {
+    while (i < v.length && /[\s,]/.test(v[i])) i++
+    if (i >= v.length) return out
+    let j = i
+    while (j < v.length && !/\s/.test(v[j])) j++
+    let url = v.slice(i, j), d = ''
+    if (/,+$/.test(url)) url = url.replace(/,+$/, '')
+    else { const e = v.indexOf(',', j); d = v.slice(j, e < 0 ? v.length : e).trim(); j = e < 0 ? v.length : e }
+    out.push([url, d])
+    i = j
+  }
+}
 // Base path (§23 #148): <meta name="brain-base"> in the browser, globalThis.__brainBase while server.mjs renders.
 // A computed app URL ('/posts/7') gets it; literal ones already have it from the build.
 const base = (m = document.querySelector('meta[name=brain-base]')) => globalThis.__brainBase || (m ? m.getAttribute('content') : '/')
 // javascript:, vbscript: and data: (other than data:image/) in a bound URL are dropped and reported (B0213, §31)
+// (tabs and newlines inside the scheme do not hide it: the browser strips them before reading the scheme)
 const inBase = (v, b = base()) =>
-  /^\s*(javascript|vbscript|data(?!:image\/)):/i.test(v)
+  /^[\s\x00-\x1f]*(javascript|vbscript|data(?!:image\/)):/i.test(v.replace(/[\t\n\r]/g, ''))
     ? (oops(Error('B0213 blocked URL scheme')), '')
     : v[0] == '/' && v[1] != '/' && !(v + '/').startsWith(b) ? b + v.slice(1) : v
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@christianirack/brainllm-runtime",
-  "version": "0.8.8",
+  "version": "0.8.10",
   "description": "The BRAINLLM runtime for the Rust-built web compiler for LLMs: dependency-free ES modules (signals, DOM, router, data, forms, channels). The brain binary embeds this same version.",
   "type": "module",
   "exports": {

package/server/server.mjs

@@ -7,6 +7,7 @@
 // It serves, in this order:
 //   GET  /_health                → 200 {"ok":true,"build":"<sig>"}
 //   GET  /health[/live|/ready]   → forwarded to the native backend, or 200 {"ok":true} without one
+//   GET  /_brain/health[/live|/ready] → the same probe (mapped to /health…), never forwarded as a /_brain call
 //   POST /_r/<hash>/<fn>         → RPC to a `server:` function (same origin + X-Brain-RPC; body, rate and time limits from brain.json `server`)
 //   GET  routes in the manifest  → SSR: load(ctx) → render the view on the DOM shim → page with props and SEO head
 //   GET  files in dist/          → static (the smallest accepted .zst/.br/.gz sibling; /_b/* immutable), clean URLs
@@ -193,7 +194,7 @@ const cacheSearch = url => {
   return kept.size ? '?' + kept : ''
 }
 // Messages this file writes itself, safe to log as the cause; anything else in an error message may hold private data.
-const OWN_CAUSES = new Set(['Backend request unavailable', 'Backend request timed out', 'Backend response exceeds its byte budget', 'Backend request capacity is unavailable', 'Backend stream capacity is unavailable', 'Native file request failed', 'Native file response is invalid', 'Native authentication is temporarily unavailable', 'Native resource response must be JSON', 'Native resource response is invalid', 'Native resource request failed', 'Invalid final response status', 'Invalid configured redirect location', 'timeout'])
+const OWN_CAUSES = new Set(['Backend request unavailable', 'Backend request timed out', 'Backend response exceeds its byte budget', 'Backend request capacity is unavailable', 'Backend stream capacity is unavailable', 'Native file request failed', 'Native file response is invalid', 'Native resource response must be JSON', 'Native resource response is invalid', 'Native resource request failed', 'Invalid final response status', 'Invalid configured redirect location', 'timeout'])
 const CODE_SHAPE = /^[A-Z][A-Z0-9_]{0,63}$/
 const varyEncoding = v => (/accept-encoding/i.test(v || '') ? v : [v, 'Accept-Encoding'].filter(Boolean).join(', '))
 function bodyEncoding(req, status, headers) {
@@ -226,17 +227,31 @@ function googleSignInPage(page) {
 
 // One configured loopback authority. No user-controlled target, proxy, redirect, auth cache or pending queue.
 // ctx.backend.files(bucket): the same file calls as job and route handlers (docs/backend/files.md).
-function bucketClient(target, key, bucket) {
+function bucketClient(target, key, bucket, readBudgetMs = () => 0) {
   const UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i
   if (typeof bucket !== 'string' || !/^[a-z][a-z0-9_]{0,47}$/.test(bucket)) throw new HttpError(400, 'Invalid native bucket name')
   const base = '/_brain/files/' + bucket
   const idPath = id => { if (typeof id !== 'string' || !UUID.test(id)) throw new HttpError(404, 'No file has this id; file ids are UUIDs'); return base + '/' + id }
+  // A read waits for a draining or restarting backend like ctx.backend reads do (nativeAuthBridge); a write never repeats.
   const send = async (method, path, body, timeout) => {
-    let response
-    try { response = await fetch(new URL(path, target), { method, redirect: 'error', signal: AbortSignal.timeout(timeout), headers: { 'x-api-key': key }, body }) } catch { throw new HttpError(503, 'Native backend is unavailable') }
-    if (response.ok) return response
-    await response.body?.cancel()
-    throw new HttpError(response.status >= 400 && response.status < 500 ? response.status : 503, 'Native file request failed')
+    const end = Date.now() + (method === 'GET' ? readBudgetMs() : 0)
+    for (let wait = 250; ; wait = Math.min(wait * 2, 2000)) {
+      let response, failure, notNow = false
+      try { response = await fetch(new URL(path, target), { method, redirect: 'error', signal: AbortSignal.timeout(timeout), headers: { 'x-api-key': key }, body }) } catch (e) {
+        failure = new HttpError(503, 'Native backend is unavailable', { temporary: true }); notNow = e?.name !== 'TimeoutError'
+      }
+      if (response?.ok) return response
+      if (response) {
+        let code
+        try { code = (await response.json())?.error?.code } catch {}
+        const retryAfter = Number(response.headers.get('retry-after'))
+        notNow = [502, 503, 504].includes(response.status) && (!code || code === 'DRAINING' || code === 'OVERLOADED')
+        failure = new HttpError(response.status >= 400 && response.status < 500 ? response.status : 503, 'Native file request failed', { temporary: response.status === 429 || response.status === 503 || notNow, ...(typeof code === 'string' && /^[A-Z][A-Z0-9_]{0,63}$/.test(code) ? { code } : {}), ...(retryAfter > 0 ? { retryAfter } : {}) })
+      }
+      const pause = Math.max(wait, (failure.retryAfter || 0) * 1000)
+      if (!notNow || Date.now() + pause > end) throw failure
+      await new Promise(done => setTimeout(done, pause))
+    }
   }
   const json = async response => { try { return await response.json() } catch { throw new HttpError(502, 'Native file response is invalid') } }
   return Object.freeze({
@@ -266,7 +281,13 @@ function bucketClient(target, key, bucket) {
     async remove(id) { await send('DELETE', idPath(id), undefined, 10000); return null },
   })
 }
-export function nativeAuthBridge(raw, refused, serviceKey, report, ownSession) {
+// Failures of a native read that may be asked again (a gateway error, DRAINING, OVERLOADED), marked where built.
+const askAgain = new WeakSet()
+// `readBudget`: ms (or a function giving them) a read may spend waiting for a draining or restarting backend; the
+// server passes its load timeout minus a second, so the page still answers within it.
+export function nativeAuthBridge(raw, refused, serviceKey, report, ownSession, readBudget = 8000) {
+  const budget = typeof readBudget === 'function' ? readBudget : () => readBudget
+  const readBudgetMs = () => Math.max(0, Math.min(Number(budget()) || 0, 30000))
   // How to fix the configuration is for the operator: a visitor of a production app reads a generic message.
   const configuration = (status, detail, rid, shown = 'This service is not available right now') => {
     if (process.env.NODE_ENV !== 'production') return new HttpError(status, detail)
@@ -308,9 +329,9 @@ export function nativeAuthBridge(raw, refused, serviceKey, report, ownSession) {
     if (!user || typeof user.id !== 'string' || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(user.id) || typeof user.email !== 'string' || user.email.length > 254 || typeof user.role !== 'string' || !/^[a-z][a-z0-9_]{0,47}$/.test(user.role) || ['public','owner'].includes(user.role) || typeof user.verified !== 'boolean') throw new HttpError(503,'Native authentication response is unavailable')
     return Object.freeze({id:user.id,email:user.email,role:user.role,verified:user.verified})
   }
-  const unavailable = () => new HttpError(503, 'Native authentication is temporarily unavailable')
+  const unavailable = (why = 'the backend did not answer') => new HttpError(503, `Native authentication is unavailable: ${why}`)
   const call = (incoming, response, path, method, rid, origin) => {
-    if (stopped || active >= 8) return Promise.reject(unavailable())
+    if (stopped || active >= 8) return Promise.reject(unavailable(stopped ? 'the server is shutting down' : '8 session checks are already in flight'))
     const cookie = cookies(incoming, method === 'POST')
     const client = forwardedFor(incoming)
     active++
@@ -350,7 +371,7 @@ export function nativeAuthBridge(raw, refused, serviceKey, report, ownSession) {
           })
         })
         owned.add(outgoing); incoming.once('aborted', cancel); response.once('close', disconnected)
-        timer = setTimeout(() => outgoing.destroy(unavailable()), 2000)
+        timer = setTimeout(() => outgoing.destroy(unavailable('the backend took more than 2 s')), 2000)
         outgoing.once('error', () => finish(true)); outgoing.end()
       } catch { outgoing?.destroy(); finish(true) }
     })
@@ -363,7 +384,7 @@ export function nativeAuthBridge(raw, refused, serviceKey, report, ownSession) {
     let origin
     try { origin = new URL(process.env.PUBLIC_SITE_URL).origin } catch { origin = 'https://' + (req.headers['x-forwarded-host'] || req.headers.host) }
     return new Promise((resolve, reject) => {
-      if (stopped || active >= 8) return reject(unavailable())
+      if (stopped || active >= 8) return reject(unavailable(stopped ? 'the server is shutting down' : '8 session checks are already in flight'))
       active++
       let settled = false
       const done = (error, value) => { if (settled) return; settled = true; active--; clearTimeout(timer); error ? reject(unavailable()) : resolve(value) }
@@ -388,7 +409,7 @@ export function nativeAuthBridge(raw, refused, serviceKey, report, ownSession) {
           } catch { done(true) }
         })
       })
-      const timer = setTimeout(() => outgoing.destroy(unavailable()), 2000)
+      const timer = setTimeout(() => outgoing.destroy(unavailable('the backend took more than 2 s')), 2000)
       owned.add(outgoing); outgoing.once('close', () => owned.delete(outgoing))
       outgoing.once('error', () => done(true)); outgoing.end()
     })
@@ -602,7 +623,12 @@ export function nativeAuthBridge(raw, refused, serviceKey, report, ownSession) {
             const code = typeof answer?.code === 'string' && /^[A-Z][A-Z0-9_]{0,63}$/.test(answer.code) ? answer.code : undefined
             const fix = code && typeof answer.fix === 'string' ? answer.fix.slice(0, 512) : undefined
             const wait = Number(headers['retry-after'])
-            throw new HttpError(status >= 400 && status < 500 ? status : 503, NATIVE_FAILED, { code, fix, temporary: status === 429 || status === 503, ...(wait > 0 ? { retryAfter: wait } : {}) })
+            // A gateway error, or a backend draining/at capacity, is "not now": a read may ask again (below). A code
+            // of the backend's own (BATCH_TOO_SLOW…) is an answer on purpose and is never repeated.
+            const notNow = [502, 503, 504].includes(status) && (!code || code === 'DRAINING' || code === 'OVERLOADED')
+            const failure = new HttpError(status >= 400 && status < 500 ? status : 503, NATIVE_FAILED, { code, fix, temporary: status === 429 || status === 503 || notNow, ...(wait > 0 ? { retryAfter: wait } : {}) })
+            if (notNow) askAgain.add(failure)
+            throw failure
           }
           if (status === 204) { value = null; return }
           if (!String(headers['content-type'] || '').startsWith('application/json')) throw new HttpError(502, 'Native resource response must be JSON')
@@ -610,15 +636,20 @@ export function nativeAuthBridge(raw, refused, serviceKey, report, ownSession) {
           if (remembers && typeof headers.etag === 'string') rememberRead(path, headers.etag, data)
       }
       try {
-        // A restarting backend refuses connections for a few seconds: a read waits for it instead of failing the page.
-        for (let wait = 250; ; wait *= 2) {
+        // An autodeploy drains the backend (503 DRAINING, then a closed port) and starts the new one: a read waits for
+        // it within the load budget instead of failing the page, honoring Retry-After. A write is never repeated.
+        const end = Date.now() + readBudgetMs()
+        for (let wait = 250; ; wait = Math.min(wait * 2, 2000)) {
           try {
             await proxy(req, response, new URL(path, target), rid, answered, 2 * 1024 * 1024)
             break
           } catch (e) {
-            if (method !== 'GET' || wait > 2000 || stopped || response.destroyed || !['ECONNREFUSED', 'ECONNRESET'].includes(e?.transport)) throw e
+            const transient = ['ECONNREFUSED', 'ECONNRESET'].includes(e?.transport) || askAgain.has(e)
+            const pause = Math.max(wait, (e?.retryAfter || 0) * 1000)
+            if (method !== 'GET' || !transient || stopped || response.destroyed || Date.now() + pause > end) throw e
             req.destroy()
-            await new Promise(done => setTimeout(done, wait))
+            await new Promise(done => setTimeout(done, pause))
+            if (stopped || response.destroyed) throw e
             req = conditional(outgoing())
           }
         }
@@ -841,7 +872,7 @@ export function nativeAuthBridge(raw, refused, serviceKey, report, ownSession) {
     // A declared file bucket from trusted server code, with BRAIN_SERVICE_API_KEY and its files.<bucket> scope
     files: bucket => {
       if (!serviceKey) throw configuration(503, 'ctx.backend.files needs BRAIN_SERVICE_API_KEY: create an API key with a files.<bucket> scope')
-      return bucketClient(target, serviceKey, bucket)
+      return bucketClient(target, serviceKey, bucket, readBudgetMs)
     },
     slugRedirect: (name, slug) => resource(incoming, response, rid, name).slugRedirect(slug),
     // A declared operation, as this visitor (docs/backend/transactions.md).
@@ -900,7 +931,7 @@ export function createServer(o = {}) {
   const env = Object.freeze(visibleEnv)
   const backendSession = o.backendSession ?? env.BRAIN_BACKEND_SESSION
   if (backendSession && backendSession !== 'app') throw Error("BRAIN_BACKEND_SESSION must be app, or unset for the backend's own session")
-  const native = nativeAuthBridge(o.backendURL ?? env.BRAIN_BACKEND_URL, (...why) => originRefused(...why), serviceKey, (...entry) => log(...entry), backendSession === 'app')
+  const native = nativeAuthBridge(o.backendURL ?? env.BRAIN_BACKEND_URL, (...why) => originRefused(...why), serviceKey, (...entry) => log(...entry), backendSession === 'app', () => TIMEOUT - 1000)
   // Using the native backend does not have to mean it owns the visitor's session: `app` keeps the signed cookie.
   const nativeSession = native && backendSession !== 'app'
   if (o.nativeSockets !== undefined && typeof o.nativeSockets !== 'boolean') throw Error('nativeSockets must be an explicit boolean')
@@ -910,6 +941,7 @@ export function createServer(o = {}) {
   const sink = o.log || ((level, msg, extra) => console[level === 'error' ? 'error' : 'log'](json({ t: new Date().toISOString(), level, msg, ...extra })))
   // Requests in flight by rid: a 5xx whose cause reached no log line gets one when the response closes (dispatch below).
   const liveRequests = new Map()
+  const hooked = new WeakSet() // core modules whose error hook reports to this server's log (render below)
   let statusPageWindow = 0, statusPageLogs = 0
   const log = (level, msg, extra = {}) => {
     const safe = { ...extra }
@@ -918,12 +950,13 @@ export function createServer(o = {}) {
     if (typeof safe.stack === 'string') {
       const kind = /^(TypeError|ReferenceError|RangeError|SyntaxError|AggregateError|Error):/.exec(safe.stack)?.[1] || 'Error'
       safe.errorType = kind
-      safe.code = kind === 'Error' ? 'NODE_INTERNAL_ERROR' : 'NODE_' + kind.replace(/Error$/, '').toUpperCase() + '_ERROR'
+      // "not now" (a 429/503, a backend restarting or busy) is not a defect: its own code, so alerts can tell them apart
+      safe.code = safe.temporary ? 'NODE_TEMPORARY_ERROR' : kind === 'Error' ? 'NODE_INTERNAL_ERROR' : 'NODE_' + kind.replace(/Error$/, '').toUpperCase() + '_ERROR'
       const truncated = safe.stack.length > 32768 || safe.stack.split('\n').length > 41
       safe.traceTruncated = truncated
       safe.stack = safe.stack.slice(0, 32768).split('\n').filter(line => /^\s+at (?:async )?(?:[A-Za-z0-9_.$<>]+(?: \[as [A-Za-z0-9_$]+\])? \()?(?:file:\/\/\/|\/|node:)[^\s()?#]*:\d+:\d+\)?$/.test(line) && line.length <= 1024).slice(0, 40).join('\n')
       safe.private = true; safe.valuesCaptured = false
-      safe.fix = kind === 'TypeError' ? 'Check nullable values, argument types and the data contract at these source frames' : kind === 'ReferenceError' ? 'Check the missing binding or import at these source frames' : kind === 'RangeError' ? 'Check recursive calls, array sizes and configured resource budgets at these source frames' : kind === 'SyntaxError' ? 'Check module syntax or JSON input parsing at these source frames without logging input values' : 'Inspect these source frames and the request reference; reproduce with synthetic inputs'
+      safe.fix = safe.thrown ? `A non-Error value (${safe.thrown}) was thrown, so there are no source frames; throw an Error (or HttpError) instead` : safe.temporary ? 'A dependency answered not now (rate limit, restart, overload or a closed connection); the same request can succeed later. If it persists, check the backend health and its Retry-After' : kind === 'TypeError' ? 'Check nullable values, argument types and the data contract at these source frames' : kind === 'ReferenceError' ? 'Check the missing binding or import at these source frames' : kind === 'RangeError' ? 'Check recursive calls, array sizes and configured resource budgets at these source frames' : kind === 'SyntaxError' ? 'Check module syntax or JSON input parsing at these source frames without logging input values' : 'Inspect these source frames and the request reference; reproduce with synthetic inputs'
     }
     // a compiler budget failure (brain-budget.js) keeps its own code, limit, source position and fix
     const b = safe.budgetFailure
@@ -949,7 +982,11 @@ export function createServer(o = {}) {
   // log fields for a thrown value: its stack (sanitized by log) plus, for B09xx budget failures, the typed fields only
   const trace = e => {
     const out = { stack: String((e && e.stack) || e) }
-    if (e instanceof HttpError && OWN_CAUSES.has(e.message)) out.cause = e.message
+    // a thrown plain object, string or undefined has no stack: say what kind of value it was (never the value itself)
+    if (!(e instanceof Error)) out.thrown = e === null ? 'null' : Array.isArray(e) ? 'array' : typeof e
+    if (e && typeof e === 'object' && (e.temporary === true || e.status === 429 || e.status === 503)) out.temporary = true
+    if (e instanceof HttpError && (OWN_CAUSES.has(e.message) || e.message.startsWith('Native authentication is unavailable:'))) out.cause = e.message
+    if (e && e.code === 'ERR_MODULE_NOT_FOUND') out.fix = 'this process runs an older build whose files are gone; restart it after brain build'
     if (e && CODE_SHAPE.test(e.transport || '')) out.transport = e.transport
     if (e && typeof e.code === 'string' && CODE_SHAPE.test(e.code)) out.backendCode = e.code
     if (e && e.kind === 'budget' && /^B09\d\d$/.test(e.code) && typeof e.budget === 'string' && /^[a-zA-Z]{1,16}$/.test(e.budget)) {
@@ -1135,6 +1172,34 @@ export function createServer(o = {}) {
     if (!mods.has(rel)) mods.set(rel, import(new URL(rel.replace(/^\//, ''), distURL).href))
     return mods.get(rel)
   }
+  // Every module a request can import (the DOM shim, the core, each route's view, layouts, guards, middleware, server
+  // module, dictionary, loading and error views, the RPC modules), imported once, one after another. `node server.mjs`
+  // runs it before `brain:ready`, so the first request after a (re)start finds them loaded instead of reading,
+  // compiling and evaluating the app's module graph (and its packages) while the visitor waits. A module that throws
+  // stays rejected in `mods`, exactly as the request that imports it would have found it; it is counted, never fatal.
+  const warm = async () => {
+    const want = new Set(['_server/dom.js', mf.core])
+    const add = r => {
+      if (!r || typeof r !== 'object') return
+      for (const k of ['view', 'server', 'loading', 'i18n']) if (typeof r[k] === 'string') want.add(r[k])
+      for (const k of ['layouts', 'guards', 'middleware']) for (const m of r[k] || []) if (typeof m === 'string') want.add(m)
+      add(r.error)
+    }
+    for (const r of mf.routes) add(r)
+    add(mf.notFound)
+    add(mf.forbidden)
+    for (const m of Object.values(mf.rpc)) if (typeof m === 'string') want.add(m)
+    for (const m of ['_server/brain-hydrate.js', '_server/brain-form.js']) if (file(m)) want.add(m)
+    let failed = 0
+    for (const rel of want) {
+      try {
+        await load(rel)
+      } catch {
+        failed++
+      }
+    }
+    return { modules: want.size, failed }
+  }
 
   const context = (req, res, url, extra) => {
     const cookies = parseCookies(req.headers.cookie)
@@ -1161,15 +1226,19 @@ export function createServer(o = {}) {
   let ssrBytes = 0
   async function cached(req, res, route, params, url, rid) {
     const n = +route.cache, ms = n * 1000, key = (route.locale || '') + url.pathname + cacheSearch(url)
-    const fill = () => {
+    // `kept.answer`: what this render answered when it was not a 200 (an error page, a redirect, a not-found), so the
+    // request that started it replays that answer instead of running load() and its backend reads a second time
+    const fill = (kept = {}) => {
       let failed = false
+      const set = {}
       return new Promise(ok => {
         const cap = { req, $capture: (out, h, st) => {
           const headers = Object.fromEntries(Object.entries(h).map(([k, v]) => [k.toLowerCase(), v]))
           const privateResponse = headers['set-cookie'] || headers['vary'] || /private|no-store|no-cache/i.test(headers['cache-control'] || '')
           if (st >= 500) failed = true
+          if (st !== 200) kept.answer = { page: out, h, st, set }
           ok(st === 200 ? { out, h, cacheable: !privateResponse, etag: 'W/"' + tag(out) + '"', t: Date.now(), bytes: Buffer.byteLength(out) } : null)
-        }, writeHead(st) { if (st >= 500) failed = true }, end: () => ok(null), setHeader() {}, getHeader: name => (name === 'x-request-id' ? rid : undefined), once() {}, removeListener() {} }
+        }, writeHead(st, h) { if (st >= 500) failed = true; kept.answer = { st, h: h || {}, set } }, end: body => { if (kept.answer && kept.answer.page === undefined) kept.answer.body = body; ok(null) }, setHeader(k, v) { set[k] = v }, getHeader: name => (name === 'x-request-id' ? rid : set[name]), once() {}, removeListener() {} }
         ssr(req, cap, route, params, url, rid, null, 200, null, true).catch(() => ok(null))
       }).then(c => {
         // A failed revalidation keeps the copy until 2N, which is what `stale-if-error` promises downstream.
@@ -1207,14 +1276,23 @@ export function createServer(o = {}) {
       if (c?.cacheable) return serve(c)
       return ssr(req, res, route, params, url, rid, null, 200, null, true)
     }
-    const filling = fill().finally(() => FILLING.delete(key))
+    const kept = {}
+    const filling = fill(kept).finally(() => FILLING.delete(key))
     FILLING.set(key, filling)
     c = await filling
     if (c) return serve(c)
     // the first render already asked the backend and logged why; another would only spend more of a limit it just hit
     if (req.$brainFailedReads?.temporary) return comeBackPage(req, res, route, params, url, rid)
     delete req.$brainFailedReads
-    return ssr(req, res, route, params, url, rid, null, 200, null, true) // a redirect or an error: as usual
+    // a redirect, a not-found or an error page: the answer that render produced, not a second load() (and its reads)
+    const a = kept.answer
+    if (a && !res.headersSent) {
+      for (const [k, v] of Object.entries(a.set)) res.setHeader(k, v)
+      if (a.page !== undefined) return html(res, a.st, a.page, a.h)
+      res.writeHead(a.st, a.h)
+      return void res.end(a.body)
+    }
+    return ssr(req, res, route, params, url, rid, null, 200, null, true) // nothing to replay (the render threw): as usual
   }
   const comeBackPage = (req, res, route, params, url, rid) => {
     res.setHeader('retry-after', String(Math.min(Math.ceil(req.$brainFailedReads.retryAfter) || 5, 3600)))
@@ -1310,7 +1388,8 @@ export function createServer(o = {}) {
       .replace('<!--brain:props-->', () => jsonInHtml(props))
     // a page behind a guard passes it only for its visitor: it stays out of the index even when it renders (§33)
     if (route.guards && route.guards.length) res.setHeader('x-robots-tag', NOINDEX)
-    let out = head(page, seo, url.pathname, url.search)
+    // with seo.trailingSlash "ignore" both forms answer: the canonical takes the form the sitemap lists (no slash)
+    let out = head(page, seo, SLASH === 'always' || url.pathname === '/' ? url.pathname : url.pathname.replace(/\/+$/, '') || '/', url.search)
     // route params for route() in the browser (the client has no route table)
     if (params && Object.keys(params).length) out = out.replace('</head>', () => `<meta name="brain-params" content="${esc(JSON.stringify(params))}"></head>`)
     if (forms) out = out.replace('</body>', () => `<script type="application/json" id="brain-forms">${jsonInHtml(forms)}</script></body>`)
@@ -1449,6 +1528,18 @@ export function createServer(o = {}) {
     const root = doc.createElement('div')
     const core = await load(mf.core)
     const mount = core.mount || core.m
+    // The core's console fallback (`BRAIN_ERROR: …`) is for the browser: on the server an fx/drv error goes to this
+    // render's failures (logged with rid and path by ssr()), once. A component boundary (brain-guard) collects its own.
+    if (core._err && !hooked.has(core)) {
+      hooked.add(core)
+      core._err((e, x, w) => {
+        if (w === 'render' || w === 'B0908') return // brain-guard reports these itself, with the component's name
+        for (let o = x; o; o = o.nodeType ? o.parentNode : o.p) if (o.$g) return
+        const into = globalThis.__brainSSR
+        if (into) into.push({ e, w, comp: null })
+        else log('error', 'component failed after SSR', { where: w, ...trace(e) }) // an async fx of a finished render
+      })
+    }
     const V = (await load(route.view)).default
     const L = []
     for (const l of route.layouts || []) L.push((await load(l)).default)
@@ -1499,8 +1590,16 @@ export function createServer(o = {}) {
     if (req.method !== 'POST') return fail(405, 'Use POST', { $h: { allow: 'POST' } })
     if (req.headers['x-brain-rpc'] !== '1') return fail(403, 'Missing X-Brain-RPC header')
     if (!sameOrigin(req)) return originRefused('B0741', req, rid, 'rpc'), fail(403, 'Cross-origin request', { brainCode: 'B0741' })
-    const modPath = mf.rpc[hash]
-    if (!modPath || !/^[A-Za-z_$][\w$]*$/.test(fn)) return fail(404, 'Unknown function')
+    const modPath = fnId(hash + '/' + fn) && Object.hasOwn(mf.rpc, hash) && mf.rpc[hash]
+    if (!modPath) return fail(404, 'Unknown function')
+    let f
+    try {
+      f = serverFn(await load(modPath), fn)
+    } catch (e) {
+      log('error', 'rpc module failed to load', { rid, fn: hash + '/' + fn, ...trace(e) })
+      return fail(500, 'Internal error', { rid })
+    }
+    if (typeof f !== 'function') return fail(404, 'Unknown function') // a guessed name never gets a rate-limit key
     const ra = overLimit(ipOf(req) + ' ' + hash + '/' + fn, LIMIT) // before reading the body
     if (ra) return fail(429, 'Too many requests', { $h: { 'retry-after': String(ra) } })
     let raw
@@ -1512,13 +1611,6 @@ export function createServer(o = {}) {
     }
     if (native) await native.prepare(req, res, rid)
     const ctx = context(req, res, url, { params: {} })
-    let f
-    try {
-      f = (await load(modPath))[fn]
-    } catch (e) {
-      log('error', 'rpc module failed to load', { rid, fn: hash + '/' + fn, ...trace(e) })
-      return fail(500, 'Internal error', { rid })
-    }
     const r = await callRpc({ fn: f, args: raw, ctx, timeout: TIMEOUT })
     if (r.cause) log('error', r.status === 504 ? 'rpc timeout' : 'rpc failed', { rid, fn: hash + '/' + fn, ms: TIMEOUT, ...trace(r.cause) })
     const b = r.status >= 500 ? { ...r.body, rid } : r.body
@@ -1551,8 +1643,8 @@ export function createServer(o = {}) {
       if (e.aborted) return
       return plain(413, tooBig(rid, url.pathname))
     }
-    const id = new URLSearchParams(raw).get('_brain') || '', modPath = mf.rpc[id.split('/')[0]]
-    if (!modPath) return plain(400, 'Unknown form')
+    const id = new URLSearchParams(raw).get('_brain') || '', fid = fnId(id), modPath = fid && Object.hasOwn(mf.rpc, fid.hash) && mf.rpc[fid.hash]
+    if (!modPath) return plain(400, 'Unknown form') // only `<hash>/<name>`: no rate-limit key for anything else
     if (native) await native.prepare(req, res, rid)
     const ctx = context(req, res, url, { params })
     let module, rules
@@ -1564,7 +1656,7 @@ export function createServer(o = {}) {
       log('error', 'form module failed to load', { rid, fn: id, ...trace(e) })
       return failPage(res, 500, rid)
     }
-    const r = await callForm({ module, raw, ctx, rules, key: ipOf(req) + ' ' + id, limit: LIMIT, timeout: TIMEOUT, locale: route.locale })
+    const r = await callForm({ module, raw, ctx, rules, key: ipOf(req) + ' ' + fid.hash + '/' + fid.fn, limit: LIMIT, timeout: TIMEOUT, locale: route.locale })
     if (r.cause) log('error', 'form failed', { rid, fn: id, ...trace(r.cause) })
     if (r.status === 303) return send(res, 303, '', { location: withBase(r.location), 'cache-control': 'no-store', ...ctx.session.headers() })
     if (r.status === 422) return ssr(req, res, route, params, url, rid, r.state, 422)
@@ -1676,6 +1768,9 @@ export function createServer(o = {}) {
   }
 
   // ---------- static ----------
+  // Never served (brain-pack private.rs holds the same list for the Rust handler and every generated host config).
+  const PRIVATE_PREFIXES = ['_server', '_brain', 'server.mjs']
+  const PRIVATE_FILES = ['_headers', '_redirects']
   // §33 content negotiation: `Accept` preferring text/markdown gets the page's Markdown twin (`/pricing` → pricing.md,
   // `/` → index.md) when the build published one (`seo.markdown`, default true; never for noindex pages).
   function publicStaticPath(pathname) {
@@ -1683,8 +1778,8 @@ export function createServer(o = {}) {
     try { path = decodeURIComponent(pathname) } catch { return null }
     if (/[\\\x00]/.test(path)) return null
     const clean = normalize(path).replaceAll('\\', '/')
-    const rel = clean.replace(/^\/+/, '')
-    if (rel.startsWith('_server') || rel.startsWith('_brain') || rel.startsWith('server.mjs') || rel === '_headers' || rel === '_redirects' || clean.split('/').some(part => part.startsWith('.') && part !== '.well-known')) return null
+    const rel = clean.replace(/^\/+/, '').toLowerCase() // a case-insensitive file system opens _SERVER/ as _server/
+    if (PRIVATE_PREFIXES.some(p => rel.startsWith(p)) || PRIVATE_FILES.includes(rel) || clean.split('/').some(part => part.startsWith('.') && part.toLowerCase() !== '.well-known')) return null
     return path
   }
   function serveTwin(req, res, url) {
@@ -1706,6 +1801,15 @@ export function createServer(o = {}) {
     const href = tag && /\bhref="(https?:\/\/[^"<>\s]+)"/.exec(tag)?.[1].replaceAll('&amp;', '&')
     return href && URL.canParse(href) && !/\/[:*]/.test(new URL(href).pathname) ? { link: `<${href}>; rel="canonical"` } : {}
   }
+  // What exists whatever the routes say: generated sitemaps, built files and the icon browsers ask for by habit.
+  async function serveFixed(req, res, url) {
+    if (DYN.length && /^\/sitemap(-static|-dynamic(-\d+)?)?\.xml$/.test(url.pathname) && (await serveSitemap(req, res, url))) return true
+    if (serveStatic(req, res, url)) return true
+    if (url.pathname !== '/favicon.ico' || !file('favicon.svg')) return false
+    send(res, 301, '', { location: withBase('/favicon.svg'), 'cache-control': 'public, max-age=86400' })
+    return true
+  }
+
   function serveStatic(req, res, url) {
     const p = publicStaticPath(url.pathname)
     if (p === null) return false
@@ -1749,6 +1853,9 @@ export function createServer(o = {}) {
   // /health is reserved for the backend (B0735), so an app cannot declare it and deploy gates ask this port for it. An app
   // page at that path still wins: this only runs where the answer would have been a 404. Nothing here names the backend.
   const isProbe = path => path === '/health' || path === '/health/live' || path === '/health/ready'
+  // /_brain/health[/live|/ready] is the same probe under the framework prefix; the backend only serves /health, so it is
+  // answered here (mapped to that route) instead of being forwarded with the rest of /_brain and coming back a 404.
+  const brainProbe = path => path.startsWith('/_brain/health') && isProbe(path.slice(7)) ? path.slice(7) : null
   const answerProbe = async (req, res, url, rid) => {
     const headers = { 'content-type': MIME['.json'], 'cache-control': 'no-store' }
     if (req.method !== 'GET' && req.method !== 'HEAD') return notFound(req, res)
@@ -1833,10 +1940,15 @@ export function createServer(o = {}) {
       let url = full
       if (BASE !== '/') {
         if (full.pathname === BASE.slice(0, -1)) return send(res, 301, '', { location: BASE + full.search })
-        if (!full.pathname.startsWith(BASE)) return isProbe(full.pathname) ? await answerProbe(req, res, full, rid) : notFound(req, res)
+        if (!full.pathname.startsWith(BASE)) {
+          const probe = isProbe(full.pathname) ? full.pathname : brainProbe(full.pathname)
+          return probe ? await answerProbe(req, res, new URL(probe, full), rid) : notFound(req, res)
+        }
         url = new URL('/' + full.pathname.slice(BASE.length) + full.search, full) // the app path
       }
       req.$brainPath = url.pathname
+      const probe = brainProbe(url.pathname)
+      if (probe) return await answerProbe(req, res, new URL(probe, url), rid)
       if (native && /^\/_brain\/files(?:\/|$)/.test(url.pathname)) return await native.fileStream(req,res,url,rid)
       if (native && /^\/(?:api(?:\/|$)|_brain(?:\/|$)|s\/)/.test(url.pathname)) return await native.proxy(req,res,url,rid,send)
       const declaredRoute = native && nativeRoutes.find(route => route.rx.test(url.pathname))
@@ -1867,6 +1979,8 @@ export function createServer(o = {}) {
         if (!m) continue
         // a form page without load is prerendered: GET serves that file (build ETag); only its POST needs the server
         if (!post && route.forms && serveStatic(req, res, url)) return
+        // a parameter never hides a real file: `/[code]` must not swallow /favicon.svg, /sitemap.xml or a prerendered /login
+        if (!post && m.groups && (await serveFixed(req, res, url))) return
         if (!post && serveTwin(req, res, url)) return
         const paged = post ? null : pageParameter(route, url)
         if (paged === 404) return notFound(req, res)
@@ -1874,15 +1988,13 @@ export function createServer(o = {}) {
         return await (post ? formPost : ssr)(req, res, route, m.groups ? { ...m.groups } : {}, url, rid)
       }
       if (post) return send(res, 405, 'Method not allowed', { allow: 'GET, HEAD' })
-      if (DYN.length && /^\/sitemap(-static|-dynamic(-\d+)?)?\.xml$/.test(url.pathname) && (await serveSitemap(req, res, url))) return
-      if (serveStatic(req, res, url)) return
-      // browsers still ask for /favicon.ico: the app's SVG icon answers it
-      if (url.pathname === '/favicon.ico' && file('favicon.svg')) return send(res, 301, '', { location: withBase('/favicon.svg'), 'cache-control': 'public, max-age=86400' })
+      if (await serveFixed(req, res, url)) return
       if (isProbe(url.pathname)) return await answerProbe(req, res, url, rid)
       notFound(req, res)
     } catch (e) {
       const busy = e instanceof HttpError && e.code === 'BRIDGE_BUSY'
       if (busy) log('warn', 'backend bridge busy', { rid, path: req.$brainPath || String(req.url || '').split('?')[0], fix: e.fix })
+      else if (e instanceof HttpError && OWN_CAUSES.has(e.message)) log('warn', 'backend unavailable', { rid, path: req.$brainPath || String(req.url || '').split('?')[0], status: e.status, cause: e.message, ...(CODE_SHAPE.test(e.transport || '') ? { transport: e.transport } : {}) })
       else log('error', 'unhandled', { rid, path: req.url, ...trace(e) })
       try {
         if (busy && !res.headersSent) { res.setHeader('retry-after', String(e.retryAfter)); failPage(res, 503, rid, { code: e.code, message: 'Service Unavailable', fix: e.fix }) }
@@ -1901,6 +2013,8 @@ export function createServer(o = {}) {
   server.headersTimeout = 15000
   // With a native backend the file upload deadline is enforced per request (above); 30 s stays for every other body.
   server.requestTimeout = native ? 320000 : 30000
+  // `warm: true` (`node server.mjs`): import the app's modules now; requests that arrive meanwhile share the same imports
+  if (o.warm) server.$brainWarm = warm()
   return server
 }
 
@@ -2084,19 +2198,50 @@ export async function runChain({ guards = [], middleware = [], ctx }) {
 }
 
 // ---------- shared request logic (server.mjs handlers and the dev server's sidecar call the same code, §11.1) ----------
-const HITS = new Map() // `${key}` → [windowStart, count]
+// Fixed 60 s window per key (ip + the validated `hash/fn`). Callers count only a function that exists, so the keys are
+// bounded by clients × real functions; HITS_MAX is the hard cap anyway (the oldest window goes first, like REVOKED) and a
+// key past HITS_KEY_MAX characters is stored as its digest. The map stays ordered by window start: a new window is
+// re-inserted at the end, so the expired entries are always the first ones.
+const HITS = new Map() // key → [windowStart, count]
+export const HITS_MAX = 50000, HITS_KEY_MAX = 256
+export const rateLimitKeys = () => HITS.size
+const WINDOW = 60000
+const dropExpired = now => {
+  for (const [k, [t]] of HITS) {
+    if (now - t <= WINDOW) break
+    HITS.delete(k)
+  }
+}
 let sweeping = null
-// Fixed 60 s window per key (ip + function). Returns 0, or the seconds to wait (Retry-After).
+// Returns 0, or the seconds to wait (Retry-After).
 export function overLimit(key, max = 60) {
-  if (!sweeping)
-    (sweeping = setInterval(() => {
-      const now = Date.now()
-      for (const [k, [t]] of HITS) if (now - t > 60000) HITS.delete(k)
-    }, 60000)).unref()
+  if (!sweeping) (sweeping = setInterval(() => dropExpired(Date.now()), WINDOW)).unref()
+  key = String(key)
+  if (key.length > HITS_KEY_MAX) key = createHash('sha256').update(key).digest('base64url')
   const now = Date.now()
   let h = HITS.get(key)
-  if (!h || now - h[0] > 60000) HITS.set(key, (h = [now, 0]))
-  return ++h[1] > max ? Math.ceil((h[0] + 60000 - now) / 1000) : 0
+  if (!h || now - h[0] > WINDOW) {
+    if (h) HITS.delete(key)
+    dropExpired(now)
+    while (HITS.size >= HITS_MAX) HITS.delete(HITS.keys().next().value)
+    HITS.set(key, (h = [now, 0]))
+  }
+  return ++h[1] > max ? Math.ceil((h[0] + WINDOW - now) / 1000) : 0
+}
+// A server function's id, `<hash>/<name>`: the RPC path and a form's `_brain` field. Anything else is refused before
+// it reaches the rate limit (a suffix such as `hash/login/1` would otherwise run `login` under a fresh budget).
+const FN_ID = /^([\w-]{1,64})\/([A-Za-z_$][\w$]{0,127})$/
+export const fnId = id => {
+  const m = typeof id === 'string' ? FN_ID.exec(id) : null
+  return m ? { hash: m[1], fn: m[2] } : null
+}
+// The only functions RPC and form posts may run: the ones a view declares with `server:`, which the generated server
+// module lists in `$server`. Its other exports (`load`, `paths`, `sitemap`, `seo`, `head`, `$forms`) run behind the
+// route's guards or at render time and are never callable by name; a module without the list exposes nothing.
+export const serverFn = (module, name) => {
+  const list = module && module.$server
+  const f = Array.isArray(list) && typeof name === 'string' && list.includes(name) ? module[name] : undefined
+  return typeof f === 'function' ? f : undefined
 }
 // t(), fmt and locale() read globalThis.__brainLocale. A render sets it while nothing else runs (renders are serialized);
 // load(), guards and form handlers overlap across awaits, so each carries its page's language in the async context.
@@ -2137,11 +2282,11 @@ export function parseArgs(raw) {
 // Runs one `server:` function → { status, body, headers?, cause? }. `args`: raw body string or an array. With `key`, the
 // rate limit applies here too. `cause` (500/504) is the real error, for the caller's log; the body stays generic.
 export async function callRpc({ fn, args, ctx, key, limit = 60, timeout = 10000 }) {
+  if (typeof fn !== 'function') return { status: 404, body: { error: 'Unknown function' } } // never counted: no key per guess
   if (key) {
     const ra = overLimit(key, limit)
     if (ra) return { status: 429, body: { error: 'Too many requests' }, headers: { 'retry-after': String(ra) } }
   }
-  if (typeof fn !== 'function') return { status: 404, body: { error: 'Unknown function' } }
   let a
   try {
     a = typeof args === 'string' || args == null ? parseArgs(args || '') : args
@@ -2172,12 +2317,14 @@ export async function callRpc({ fn, args, ctx, key, limit = 60, timeout = 10000
 // English text for the server's log: a form or a server function never shows it to a visitor
 const NATIVE_FAILED = 'Native resource request failed'
 export async function callForm({ module, raw, ctx, rules, key, limit = 60, timeout = 10000, locale }) {
-  const q = new URLSearchParams(raw || ''), id = q.get('_brain') || '', fn = id.split('/')[1] || ''
+  const q = new URLSearchParams(raw || ''), id = q.get('_brain') || '', fn = fnId(id)?.fn
+  // exactly `<hash>/<name>` naming a `server:` function, checked before the rate limit counts anything
+  const run = fn && serverFn(module, fn)
+  if (!run) return { status: 400, body: { error: 'Unknown form' } }
   if (key) {
     const ra = overLimit(key, limit)
     if (ra) return { status: 429, body: { error: 'Too many requests' }, headers: { 'retry-after': String(ra) } }
   }
-  if (!/^[A-Za-z_$][\w$]*$/.test(fn) || typeof (module && module[fn]) !== 'function') return { status: 400, body: { error: 'Unknown form' } }
   const schema = module.$forms && module.$forms[fn]
   const G = globalThis, had = '__brainLocale' in G, prev = G.__brainLocale
   let values, errors, generic
@@ -2194,7 +2341,7 @@ export async function callForm({ module, raw, ctx, rules, key, limit = 60, timeo
   let r
   try {
     ctx.signal ||= newSignal()
-    r = await withTimeout(pageLocale.run(locale, () => Promise.resolve(module[fn](ctx, values))), timeout, ctx)
+    r = await withTimeout(pageLocale.run(locale, () => Promise.resolve(run(ctx, values))), timeout, ctx)
   } catch (e) {
     if (e && e.errors && typeof e.errors === 'object') return again(e.errors, '')
     if (e instanceof HttpError && e.status >= 400 && e.status < 500) return again({}, e.message === NATIVE_FAILED ? generic : e.message)
@@ -2358,11 +2505,11 @@ export function prefersMarkdown(accept) {
 function head(page, seo, path, search = '') {
   let h = page
   // `<meta seo query="page">`: these parameters make a different page; any other (a dialog, a tracking tag) does not
-  let identity = ''
+  let identity = '', query = ''
   h = h.replace(/<meta name="brain-query" content="([^"]*)">/, (_, keys) => {
     const given = new URLSearchParams(search), kept = new URLSearchParams()
     for (const key of keys.split(/[\s,]+/)) for (const value of key ? given.getAll(key) : []) kept.append(key, value)
-    if (kept.size) identity = esc('?' + kept)
+    if (kept.size) identity = esc((query = '?' + kept))
     return ''
   })
   if (path) {
@@ -2371,7 +2518,7 @@ function head(page, seo, path, search = '') {
     h = h.replace(/(<link[^>]*rel=["']canonical["'][^>]*href=")([^"]*)(")/i, (m, a, v, b) => a + real(v) + b)
     h = h.replace(/(<meta[^>]*property=["']og:url["'][^>]*content=")([^"]*)(")/i, (m, a, v, b) => a + real(v) + b)
   }
-  if (!seo) return h
+  if (!seo) return graph(h, path, query)
   const meta = (attr, key, val, escaped) => {
     const tag = `<meta ${attr}="${esc(key)}" content="${escaped ? val.replace(/"/g, '&quot;') : esc(val)}">`
     const rx = new RegExp(`<meta[^>]*\\b${attr}=["']${key.replace(/[.*+?^${}()|[\]\\:]/g, '\\$&')}["'][^>]*>`, 'i')
@@ -2382,9 +2529,13 @@ function head(page, seo, path, search = '') {
     if (v == null || k === '$head' || k === 'schema' || k === 'lastmod') continue
     if (k === 'title') h = /<title>[\s\S]*?<\/title>/i.test(h) ? h.replace(/<title>[\s\S]*?<\/title>/i, () => `<title>${esc(v)}</title>`) : h.replace('</head>', () => `<title>${esc(v)}</title></head>`)
     else if (k === 'canonical') {
-      const tag = `<link rel="canonical" href="${esc(v)}">`
+      // a root-relative canonical takes the origin the build wrote into the template (PUBLIC_SITE_URL), as it does on
+      // a prerendered page: a relative canonical is ignored by search engines
+      const built = /^\/(?!\/)/.test(v) && /<link[^>]*rel=["']canonical["'][^>]*href="(https?:\/\/[^/"]+)/i.exec(h)?.[1]
+      const url = built ? built + v : v
+      const tag = `<link rel="canonical" href="${esc(url)}">`
       h = /<link[^>]*rel=["']canonical["'][^>]*>/i.test(h) ? h.replace(/<link[^>]*rel=["']canonical["'][^>]*>/i, () => tag) : h.replace('</head>', () => tag + '</head>')
-      if (seo['og:url'] == null) meta('property', 'og:url', v) // og:url follows the canonical unless the view sets its own
+      if (seo['og:url'] == null) meta('property', 'og:url', url) // og:url follows the canonical unless the view sets its own
     } else if (k === 'jsonld') h = h.replace('</head>', () => `<script type="application/ld+json">${jsonInHtml(v)}</script></head>`)
     else if (/^(og|twitter|article):/.test(k)) meta('property', k, v)
     else if (typeof v === 'string') meta('name', k, v)
@@ -2421,7 +2572,26 @@ function head(page, seo, path, search = '') {
     if (/<link[^>]*rel=["']canonical["']/i.test(seo.$head)) h = h.replace(/<link[^>]*rel=["']canonical["'][^>]*>/gi, '')
     h = h.replace('</head>', () => seo.$head + '</head>')
   }
-  return h
+  return graph(h, path, query, seo)
+}
+// The WebSite + WebPage graph the build wrote into the template (brain-seo ServerHead::apply): its pattern URLs become
+// this request's, like the canonical, and the WebPage takes this request's title and description.
+function graph(h, path, query, seo) {
+  return h.replace(/(<script type="application\/ld\+json">)(\{"@context":"https:\/\/schema\.org","@graph"[\s\S]*?)(<\/script>)/, (m, a, body, b) => {
+    let g
+    try { g = JSON.parse(body) } catch { return m }
+    const url = v => (typeof v === 'string' && path ? v.replace(/^(https?:\/\/[^/#]+)(\/[^#]*)(#.*)?$/, (u, o, p, hash = '') => (/\/[:*]/.test(p) ? o + path + query + hash : u)) : v)
+    const title = /<title>([\s\S]*?)<\/title>/i.exec(h)?.[1]
+    for (const node of g['@graph'] ?? []) {
+      for (const k of ['@id', 'url']) if (k in node) node[k] = url(node[k])
+      if (node.isPartOf?.['@id']) node.isPartOf['@id'] = url(node.isPartOf['@id'])
+      if ([node['@type']].flat().includes('WebPage')) {
+        if (title && node.name == null) node.name = title.replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&quot;/g, '"').replace(/&#39;/g, "'").replace(/&amp;/g, '&')
+        if (seo?.description != null && node.description == null) node.description = String(seo.description)
+      }
+    }
+    return a + jsonInHtml(g) + b
+  })
 }
 // `/_b/<hash>.js` imports inside the chunks resolve to files in dist/ (same hook as the build's prerender)
 let hooked = false
@@ -2442,6 +2612,8 @@ function hook(base, app = '/') {
 }
 
 const LISTEN_WAIT_MS = 10000
+// the supervisor gives an instance 30 s to print brain:ready: warming may hold it this long at most
+const WARM_WAIT_MS = 15000
 // `node server.mjs` (directly or under `brain start`); paths compared after symlinks (/var → /private/var on macOS)
 function real(p) {
   try {
@@ -2454,12 +2626,17 @@ if (process.argv[1] && real(process.argv[1]) === real(fileURLToPath(import.meta.
   process.env.NODE_ENV = 'production'
   // A closed log pipe is the operator's matter: requests do not depend on it.
   for (const stream of [process.stdout, process.stderr]) stream.on('error', error => { if (error.code !== 'EPIPE') throw error })
-  const s = createServer({ dist: fileURLToPath(new URL('.', import.meta.url)) })
+  const s = createServer({ dist: fileURLToPath(new URL('.', import.meta.url)), warm: true })
   const fd = ENV.BRAIN_LISTEN_FD
   const where = fd ? { fd: Number(fd) } : { port: +(ENV.PORT || 3000), host: ENV.HOST || '127.0.0.1' }
-  s.once('listening', () => {
+  s.once('listening', async () => {
+    // ready once the app's modules are imported (see `warm`), so a reload only switches traffic to a warm instance;
+    // a slow machine gets WARM_WAIT_MS at most, the rest keeps importing while requests are served
+    let timer
+    const warmed = await Promise.race([s.$brainWarm, new Promise(r => (timer = setTimeout(r, WARM_WAIT_MS)))])
+    clearTimeout(timer)
     process.stdout.write(`brain:ready ${process.pid}\n`) // the supervisor waits for this line (§34)
-    console.log(json({ t: new Date().toISOString(), level: 'info', msg: 'listening', ...(fd ? { fd: Number(fd) } : where) }))
+    console.log(json({ t: new Date().toISOString(), level: 'info', msg: 'listening', ...(fd ? { fd: Number(fd) } : where), ...(warmed ? { warmModules: warmed.modules, warmFailed: warmed.failed } : { warm: 'continuing' }) }))
   })
   // A restart may find the previous instance still draining: wait for it, briefly. Two live servers never share a port.
   const waitUntil = Date.now() + LISTEN_WAIT_MS