@christianirack/brainllm-runtime 0.8.9 → 0.8.11

package/brain-form.js

@@ -305,7 +305,7 @@ function createForm(schema, o, readRule, validateRule, remote) {
         else {
           saved.v = untrack(now) // saved: no longer dirty
           // `return { redirect: '/x' }` from the server function: the same page the 303 reaches without JS (§38)
-          if (typeof r?.redirect === 'string' && r.redirect[0] === '/' && r.redirect[1] !== '/') go(r.redirect)
+          if (typeof r?.redirect === 'string' && /^\/(?![\/\\])/.test(r.redirect) && !/[\\\x00-\x20\x7f]/.test(r.redirect)) go(r.redirect)
         }
         return r
       } catch (x) {

package/brain-lazy.js

@@ -23,6 +23,16 @@ function reloadOnce() {
   }
 }
 
+// The observer is built in its own scope and reaches `go` through a box emptied on stop. A callback closing over
+// lazy()'s scope kept the owner, the props and the built component alive after unmount and disconnect() (measured:
+// parent and child survived forced GCs for the whole 10 s `--heap` grace, B0601; Chrome still holds the observer).
+function visible(el, go) {
+  const box = { go }
+  const io = new IntersectionObserver(es => es.some(e => e.isIntersecting) && box.go?.(), { rootMargin: '200px' })
+  io.observe(el)
+  return () => { box.go = null; io.disconnect() }
+}
+
 export function lazy(el, imp, mode, props = {}) {
   const owner = I.owner()
   let dead = false, stop = () => {}, retry = () => {}, clicked = null, built
@@ -77,11 +87,8 @@ export function lazy(el, imp, mode, props = {}) {
     }
   } else if (G.document && document.visibilityState === 'hidden') {
     go() // a hidden tab runs no observer: without this the content is missing until the tab is shown
-  } else if (G.IntersectionObserver) {
-    const io = new IntersectionObserver(es => es.some(e => e.isIntersecting) && go(), { rootMargin: '200px' })
-    io.observe(el)
-    stop = () => io.disconnect()
-  } else go()
+  } else if (G.IntersectionObserver) stop = visible(el, go)
+  else go()
   if (owner)
     fx(() => () => {
       dead = true

package/brain-router.js

@@ -15,6 +15,10 @@
 // else → full page load: the server decides.
 import { prefetchPage } from './brain-prefetch-shared.js'
 const G = globalThis
+// The view mounted after a swap is a new page: its components number their instance ids from the start (codegen #268:
+// the first keeps `id`, later ones `id~2`), as the server does per render. Without this, a layout header mounted again
+// on each navigation counted the page it replaced and came back as `main-nav~2`, so `#main-nav` CSS stopped applying.
+const fresh = () => { G.__brainIds = (G.__brainIds || 0) + 1 }
 // Base path (<meta name="brain-base" content="/app/">, §23 #148): links in the HTML already carry it; guards and
 // routes work with app paths (strip), and app paths given to go()/navigate()/redirect() get it (app). '/' when absent.
 const base = () => G.document?.querySelector('meta[name=brain-base]')?.getAttribute('content') || '/'
@@ -73,17 +77,20 @@ export function redirect(url, status = 303) {
   throw { redirect: String(url), status }
 }
 export const deny = (reason = 'Forbidden') => ({ deny: String(reason) })
+// A guard redirects to same-site paths only: `//host`, `/\\host` and a control character after the first `/` (browsers
+// drop tabs and newlines) leave the site. Anything else is a full load, where the server's redirect() refuses it.
+const local = u => typeof u === 'string' && /^\/(?![\/\\])/.test(u) && !/[\\\x00-\x20\x7f]/.test(u)
 // guard result → true (go on) · false (cancel) · string (redirect) · null (full load: the server decides, e.g. 403)
 const outcome = v =>
   v && typeof v === 'object'
     ? typeof v.redirect === 'string'
-      ? v.redirect
+      ? local(v.redirect) ? v.redirect : null
       : v.deny !== undefined
         ? null
         : true
-    : v === false || typeof v === 'string'
+    : v === false || local(v)
       ? v
-      : true
+      : typeof v === 'string' ? null : true
 
 export function router(o = {}) {
   const region = o.region || 'main'
@@ -124,7 +131,7 @@ export function router(o = {}) {
         v = await g(ctx)
       } catch (e) {
         if (asked) return null
-        return typeof e?.redirect === 'string' ? e.redirect : null
+        return local(e?.redirect) ? e.redirect : null
       }
       v = outcome(v)
       if (v !== true) return asked ? null : v
@@ -170,6 +177,7 @@ export function router(o = {}) {
             const el = document.querySelector(region), mount = c.m || c.mount
             if (w.done || my !== seq || !el || !mount) return // the page arrived first
             dispose(el)
+            fresh()
             for (const n of [...el.childNodes]) if (!/^(STYLE|LINK)$/.test(n.nodeName)) n.remove() // the view's CSS stays (BUILD #35)
             el.$d = mount(v.default, el, {})
           })
@@ -207,6 +215,7 @@ export function router(o = {}) {
       const swap = () => {
         if (my !== seq) return
         dispose(cur)
+        fresh()
         cur.replaceChildren(...[...next.childNodes].map(adopt))
         // Scripts parsed by DOMParser never run: the region's own scripts (the view's mount, `e.$d = mount(...)`) are
         // recreated so they execute. Already-imported modules come from the module map: their state survives.
@@ -490,6 +499,7 @@ export function predict(o = {}, same = () => false) {
     if (dead || document.hidden || net?.saveData) return
     while (busy < PARALLEL && queue.length) {
       const k = queue.shift()
+      rank.delete(k) // rank only orders the queue: it leaves with the entry
       if (cache.has(k)) continue
       busy++
       get(k).finally(() => { busy--; pump() })
@@ -516,7 +526,7 @@ export function predict(o = {}, same = () => false) {
   const evs = ['pointerover', 'focusin', 'touchstart']
   for (const t of evs) document.addEventListener(t, intent, { passive: true, capture: true })
   const forget = () => {
-    epoch++; queue.length = 0; cache.clear(); bytes = 0; count = 0
+    epoch++; queue.length = 0; rank.clear(); cache.clear(); bytes = 0; count = 0
     for (const c of running.values()) c.abort()
     running.clear()
   }
@@ -526,13 +536,13 @@ export function predict(o = {}, same = () => false) {
     for (const { target: a, isIntersecting } of es) {
       const k = ok(a), i = queue.indexOf(k)
       if (isIntersecting) thin() || want(k, false, (a.closest('footer,aside') ? 1e7 : 0) + a.getBoundingClientRect().top)
-      else if (i >= 0) queue.splice(i, 1) // left the viewport before its turn
+      else if (i >= 0) queue.splice(i, 1), rank.delete(k) // left the viewport before its turn
     }
   }, { rootMargin: '200px' })
   return {
     scan() {
       if (dead) return
-      count = 0; queue.length = 0; planned.clear(); seen = new WeakSet(); io?.disconnect()
+      count = 0; queue.length = 0; rank.clear(); planned.clear(); seen = new WeakSet(); io?.disconnect()
       const anchors = document.querySelectorAll('a[href]'), allowed = new Set()
       for (const a of anchors) { const k = ok(a); if (k) allowed.add(k); if (io && !seen.has(a)) { seen.add(a); io.observe(a) } }
       // Compiler-generated graph, validated against the current DOM: hidden/opted-out links cannot sneak in.

package/brain.js

@@ -277,11 +277,16 @@ export function insert(p, f, end) {
 
 // aria-* and data-* are enumerated, not boolean: true and false render as text (k[4] is their dash)
 // A select only takes a value its options offer, and {#each}/{#if} options mount after attr() or change later.
+// An array (<select multiple>) selects each option it lists (value attribute, else text, as the browser reads it).
+const pick = (el, v) => {
+  if (!Array.isArray(v)) return el.value !== v && (el.value = v)
+  for (const o of el.querySelectorAll('option')) o.selected = v.includes(o.getAttribute('value') ?? o.textContent)
+}
 const keepSelected = (el, f, M = globalThis.MutationObserver) =>
   M && new M(() => {
-    const i = el.selectedIndex
-    el.value = typeof f == 'function' ? untrack(f) : f
-    if (el.selectedIndex < 0) el.selectedIndex = i // no option matches yet: the browser's choice stays
+    const i = el.selectedIndex, v = typeof f == 'function' ? untrack(f) : f
+    pick(el, v)
+    if (el.selectedIndex < 0 && !Array.isArray(v)) el.selectedIndex = i // no option matches yet: the browser's choice stays
   }).observe(el, { childList: true, subtree: true })
 
 export function attr(el, k, f) {
@@ -290,18 +295,45 @@ export function attr(el, k, f) {
     k.startsWith('style:')
       ? ((k = k.slice(6)), v => (v == null || v === false ? el.style.removeProperty(k) : el.style.setProperty(k, v)))
       : /^(value|checked|selected)$/.test(k) && !(k == 'value' && el.tagName == 'OPTION') // an option's value is its attribute (SSR, value="")
-        ? ((el.tagName == 'SELECT' && k == 'value') ? keepSelected(el, f) : 0, v => {
-            if (el[k] !== v) el[k] = v
-          })
-        : v => (v == null || (v === false && k[4] != '-') ? el.removeAttribute(k) : el.setAttribute(k, v === true && k[4] != '-' ? '' : /^(href|src|action|formaction|poster)$/.test(k) && typeof v == 'string' ? inBase(v) : v))
+        ? el.tagName == 'SELECT' && k == 'value'
+          ? (keepSelected(el, f), v => pick(el, v))
+          : v => {
+              if (el[k] !== v) el[k] = v
+            }
+        : v => (v == null || (v === false && k[4] != '-') ? el.removeAttribute(k) : el.setAttribute(k, v === true && k[4] != '-' ? '' : typeof v == 'string' ? safeUrl(el, k, v) : v))
   )
 }
+// Attributes whose value is a URL the browser follows or loads (§31): one list for the browser and SSR (server.mjs renders
+// through this same attr()); brain-check security.rs URL_ATTRS checks literal values against the same names.
+// `url`: one URL · `list`: a srcset (`url descriptor, …`) · `space`: space-separated URLs. `data` is a URL on <object> only.
+const URL_ATTRS = { href: 'url', src: 'url', action: 'url', formaction: 'url', poster: 'url', 'xlink:href': 'url', cite: 'url', data: 'url', background: 'url', longdesc: 'url', manifest: 'url', codebase: 'url', icon: 'url', srcset: 'list', imagesrcset: 'list', ping: 'space' }
+const safeUrl = (el, k, v, kind = Object.hasOwn(URL_ATTRS, k.toLowerCase()) && URL_ATTRS[k.toLowerCase()]) =>
+  !kind || (k.toLowerCase() == 'data' && el.tagName != 'OBJECT') ? v
+    : kind == 'url' ? inBase(v)
+    : kind == 'space' ? v.split(/\s+/).filter(Boolean).map(u => inBase(u)).filter(Boolean).join(' ')
+    : srcsetCandidates(v).map(([u, d]) => [inBase(u), d]).filter(([u]) => u).map(([u, d]) => d ? u + ' ' + d : u).join(', ')
+// `a.jpg 1x, data:image/png;base64,AA== 2x` → [[url, descriptor], …] (HTML srcset parsing: a URL ends at whitespace,
+// trailing commas end a candidate without descriptor, descriptors run to the next comma).
+const srcsetCandidates = (v, out = [], i = 0) => {
+  for (;;) {
+    while (i < v.length && /[\s,]/.test(v[i])) i++
+    if (i >= v.length) return out
+    let j = i
+    while (j < v.length && !/\s/.test(v[j])) j++
+    let url = v.slice(i, j), d = ''
+    if (/,+$/.test(url)) url = url.replace(/,+$/, '')
+    else { const e = v.indexOf(',', j); d = v.slice(j, e < 0 ? v.length : e).trim(); j = e < 0 ? v.length : e }
+    out.push([url, d])
+    i = j
+  }
+}
 // Base path (§23 #148): <meta name="brain-base"> in the browser, globalThis.__brainBase while server.mjs renders.
 // A computed app URL ('/posts/7') gets it; literal ones already have it from the build.
 const base = (m = document.querySelector('meta[name=brain-base]')) => globalThis.__brainBase || (m ? m.getAttribute('content') : '/')
 // javascript:, vbscript: and data: (other than data:image/) in a bound URL are dropped and reported (B0213, §31)
+// (tabs and newlines inside the scheme do not hide it: the browser strips them before reading the scheme)
 const inBase = (v, b = base()) =>
-  /^\s*(javascript|vbscript|data(?!:image\/)):/i.test(v)
+  /^[\s\x00-\x1f]*(javascript|vbscript|data(?!:image\/)):/i.test(v.replace(/[\t\n\r]/g, ''))
     ? (oops(Error('B0213 blocked URL scheme')), '')
     : v[0] == '/' && v[1] != '/' && !(v + '/').startsWith(b) ? b + v.slice(1) : v
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@christianirack/brainllm-runtime",
-  "version": "0.8.9",
+  "version": "0.8.11",
   "description": "The BRAINLLM runtime for the Rust-built web compiler for LLMs: dependency-free ES modules (signals, DOM, router, data, forms, channels). The brain binary embeds this same version.",
   "type": "module",
   "exports": {

package/server/server.mjs

@@ -7,6 +7,7 @@
 // It serves, in this order:
 //   GET  /_health                → 200 {"ok":true,"build":"<sig>"}
 //   GET  /health[/live|/ready]   → forwarded to the native backend, or 200 {"ok":true} without one
+//   GET  /_brain/health[/live|/ready] → the same probe (mapped to /health…), never forwarded as a /_brain call
 //   POST /_r/<hash>/<fn>         → RPC to a `server:` function (same origin + X-Brain-RPC; body, rate and time limits from brain.json `server`)
 //   GET  routes in the manifest  → SSR: load(ctx) → render the view on the DOM shim → page with props and SEO head
 //   GET  files in dist/          → static (the smallest accepted .zst/.br/.gz sibling; /_b/* immutable), clean URLs
@@ -226,17 +227,31 @@ function googleSignInPage(page) {
 
 // One configured loopback authority. No user-controlled target, proxy, redirect, auth cache or pending queue.
 // ctx.backend.files(bucket): the same file calls as job and route handlers (docs/backend/files.md).
-function bucketClient(target, key, bucket) {
+function bucketClient(target, key, bucket, readBudgetMs = () => 0) {
   const UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i
   if (typeof bucket !== 'string' || !/^[a-z][a-z0-9_]{0,47}$/.test(bucket)) throw new HttpError(400, 'Invalid native bucket name')
   const base = '/_brain/files/' + bucket
   const idPath = id => { if (typeof id !== 'string' || !UUID.test(id)) throw new HttpError(404, 'No file has this id; file ids are UUIDs'); return base + '/' + id }
+  // A read waits for a draining or restarting backend like ctx.backend reads do (nativeAuthBridge); a write never repeats.
   const send = async (method, path, body, timeout) => {
-    let response
-    try { response = await fetch(new URL(path, target), { method, redirect: 'error', signal: AbortSignal.timeout(timeout), headers: { 'x-api-key': key }, body }) } catch { throw new HttpError(503, 'Native backend is unavailable') }
-    if (response.ok) return response
-    await response.body?.cancel()
-    throw new HttpError(response.status >= 400 && response.status < 500 ? response.status : 503, 'Native file request failed')
+    const end = Date.now() + (method === 'GET' ? readBudgetMs() : 0)
+    for (let wait = 250; ; wait = Math.min(wait * 2, 2000)) {
+      let response, failure, notNow = false
+      try { response = await fetch(new URL(path, target), { method, redirect: 'error', signal: AbortSignal.timeout(timeout), headers: { 'x-api-key': key }, body }) } catch (e) {
+        failure = new HttpError(503, 'Native backend is unavailable', { temporary: true }); notNow = e?.name !== 'TimeoutError'
+      }
+      if (response?.ok) return response
+      if (response) {
+        let code
+        try { code = (await response.json())?.error?.code } catch {}
+        const retryAfter = Number(response.headers.get('retry-after'))
+        notNow = [502, 503, 504].includes(response.status) && (!code || code === 'DRAINING' || code === 'OVERLOADED')
+        failure = new HttpError(response.status >= 400 && response.status < 500 ? response.status : 503, 'Native file request failed', { temporary: response.status === 429 || response.status === 503 || notNow, ...(typeof code === 'string' && /^[A-Z][A-Z0-9_]{0,63}$/.test(code) ? { code } : {}), ...(retryAfter > 0 ? { retryAfter } : {}) })
+      }
+      const pause = Math.max(wait, (failure.retryAfter || 0) * 1000)
+      if (!notNow || Date.now() + pause > end) throw failure
+      await new Promise(done => setTimeout(done, pause))
+    }
   }
   const json = async response => { try { return await response.json() } catch { throw new HttpError(502, 'Native file response is invalid') } }
   return Object.freeze({
@@ -266,7 +281,13 @@ function bucketClient(target, key, bucket) {
     async remove(id) { await send('DELETE', idPath(id), undefined, 10000); return null },
   })
 }
-export function nativeAuthBridge(raw, refused, serviceKey, report, ownSession) {
+// Failures of a native read that may be asked again (a gateway error, DRAINING, OVERLOADED), marked where built.
+const askAgain = new WeakSet()
+// `readBudget`: ms (or a function giving them) a read may spend waiting for a draining or restarting backend; the
+// server passes its load timeout minus a second, so the page still answers within it.
+export function nativeAuthBridge(raw, refused, serviceKey, report, ownSession, readBudget = 8000) {
+  const budget = typeof readBudget === 'function' ? readBudget : () => readBudget
+  const readBudgetMs = () => Math.max(0, Math.min(Number(budget()) || 0, 30000))
   // How to fix the configuration is for the operator: a visitor of a production app reads a generic message.
   const configuration = (status, detail, rid, shown = 'This service is not available right now') => {
     if (process.env.NODE_ENV !== 'production') return new HttpError(status, detail)
@@ -602,7 +623,12 @@ export function nativeAuthBridge(raw, refused, serviceKey, report, ownSession) {
             const code = typeof answer?.code === 'string' && /^[A-Z][A-Z0-9_]{0,63}$/.test(answer.code) ? answer.code : undefined
             const fix = code && typeof answer.fix === 'string' ? answer.fix.slice(0, 512) : undefined
             const wait = Number(headers['retry-after'])
-            throw new HttpError(status >= 400 && status < 500 ? status : 503, NATIVE_FAILED, { code, fix, temporary: status === 429 || status === 503, ...(wait > 0 ? { retryAfter: wait } : {}) })
+            // A gateway error, or a backend draining/at capacity, is "not now": a read may ask again (below). A code
+            // of the backend's own (BATCH_TOO_SLOW…) is an answer on purpose and is never repeated.
+            const notNow = [502, 503, 504].includes(status) && (!code || code === 'DRAINING' || code === 'OVERLOADED')
+            const failure = new HttpError(status >= 400 && status < 500 ? status : 503, NATIVE_FAILED, { code, fix, temporary: status === 429 || status === 503 || notNow, ...(wait > 0 ? { retryAfter: wait } : {}) })
+            if (notNow) askAgain.add(failure)
+            throw failure
           }
           if (status === 204) { value = null; return }
           if (!String(headers['content-type'] || '').startsWith('application/json')) throw new HttpError(502, 'Native resource response must be JSON')
@@ -610,15 +636,20 @@ export function nativeAuthBridge(raw, refused, serviceKey, report, ownSession) {
           if (remembers && typeof headers.etag === 'string') rememberRead(path, headers.etag, data)
       }
       try {
-        // A restarting backend refuses connections for a few seconds: a read waits for it instead of failing the page.
-        for (let wait = 250; ; wait *= 2) {
+        // An autodeploy drains the backend (503 DRAINING, then a closed port) and starts the new one: a read waits for
+        // it within the load budget instead of failing the page, honoring Retry-After. A write is never repeated.
+        const end = Date.now() + readBudgetMs()
+        for (let wait = 250; ; wait = Math.min(wait * 2, 2000)) {
           try {
             await proxy(req, response, new URL(path, target), rid, answered, 2 * 1024 * 1024)
             break
           } catch (e) {
-            if (method !== 'GET' || wait > 2000 || stopped || response.destroyed || !['ECONNREFUSED', 'ECONNRESET'].includes(e?.transport)) throw e
+            const transient = ['ECONNREFUSED', 'ECONNRESET'].includes(e?.transport) || askAgain.has(e)
+            const pause = Math.max(wait, (e?.retryAfter || 0) * 1000)
+            if (method !== 'GET' || !transient || stopped || response.destroyed || Date.now() + pause > end) throw e
             req.destroy()
-            await new Promise(done => setTimeout(done, wait))
+            await new Promise(done => setTimeout(done, pause))
+            if (stopped || response.destroyed) throw e
             req = conditional(outgoing())
           }
         }
@@ -841,7 +872,7 @@ export function nativeAuthBridge(raw, refused, serviceKey, report, ownSession) {
     // A declared file bucket from trusted server code, with BRAIN_SERVICE_API_KEY and its files.<bucket> scope
     files: bucket => {
       if (!serviceKey) throw configuration(503, 'ctx.backend.files needs BRAIN_SERVICE_API_KEY: create an API key with a files.<bucket> scope')
-      return bucketClient(target, serviceKey, bucket)
+      return bucketClient(target, serviceKey, bucket, readBudgetMs)
     },
     slugRedirect: (name, slug) => resource(incoming, response, rid, name).slugRedirect(slug),
     // A declared operation, as this visitor (docs/backend/transactions.md).
@@ -900,7 +931,7 @@ export function createServer(o = {}) {
   const env = Object.freeze(visibleEnv)
   const backendSession = o.backendSession ?? env.BRAIN_BACKEND_SESSION
   if (backendSession && backendSession !== 'app') throw Error("BRAIN_BACKEND_SESSION must be app, or unset for the backend's own session")
-  const native = nativeAuthBridge(o.backendURL ?? env.BRAIN_BACKEND_URL, (...why) => originRefused(...why), serviceKey, (...entry) => log(...entry), backendSession === 'app')
+  const native = nativeAuthBridge(o.backendURL ?? env.BRAIN_BACKEND_URL, (...why) => originRefused(...why), serviceKey, (...entry) => log(...entry), backendSession === 'app', () => TIMEOUT - 1000)
   // Using the native backend does not have to mean it owns the visitor's session: `app` keeps the signed cookie.
   const nativeSession = native && backendSession !== 'app'
   if (o.nativeSockets !== undefined && typeof o.nativeSockets !== 'boolean') throw Error('nativeSockets must be an explicit boolean')
@@ -910,6 +941,7 @@ export function createServer(o = {}) {
   const sink = o.log || ((level, msg, extra) => console[level === 'error' ? 'error' : 'log'](json({ t: new Date().toISOString(), level, msg, ...extra })))
   // Requests in flight by rid: a 5xx whose cause reached no log line gets one when the response closes (dispatch below).
   const liveRequests = new Map()
+  const hooked = new WeakSet() // core modules whose error hook reports to this server's log (render below)
   let statusPageWindow = 0, statusPageLogs = 0
   const log = (level, msg, extra = {}) => {
     const safe = { ...extra }
@@ -918,12 +950,13 @@ export function createServer(o = {}) {
     if (typeof safe.stack === 'string') {
       const kind = /^(TypeError|ReferenceError|RangeError|SyntaxError|AggregateError|Error):/.exec(safe.stack)?.[1] || 'Error'
       safe.errorType = kind
-      safe.code = kind === 'Error' ? 'NODE_INTERNAL_ERROR' : 'NODE_' + kind.replace(/Error$/, '').toUpperCase() + '_ERROR'
+      // "not now" (a 429/503, a backend restarting or busy) is not a defect: its own code, so alerts can tell them apart
+      safe.code = safe.temporary ? 'NODE_TEMPORARY_ERROR' : kind === 'Error' ? 'NODE_INTERNAL_ERROR' : 'NODE_' + kind.replace(/Error$/, '').toUpperCase() + '_ERROR'
       const truncated = safe.stack.length > 32768 || safe.stack.split('\n').length > 41
       safe.traceTruncated = truncated
       safe.stack = safe.stack.slice(0, 32768).split('\n').filter(line => /^\s+at (?:async )?(?:[A-Za-z0-9_.$<>]+(?: \[as [A-Za-z0-9_$]+\])? \()?(?:file:\/\/\/|\/|node:)[^\s()?#]*:\d+:\d+\)?$/.test(line) && line.length <= 1024).slice(0, 40).join('\n')
       safe.private = true; safe.valuesCaptured = false
-      safe.fix = kind === 'TypeError' ? 'Check nullable values, argument types and the data contract at these source frames' : kind === 'ReferenceError' ? 'Check the missing binding or import at these source frames' : kind === 'RangeError' ? 'Check recursive calls, array sizes and configured resource budgets at these source frames' : kind === 'SyntaxError' ? 'Check module syntax or JSON input parsing at these source frames without logging input values' : 'Inspect these source frames and the request reference; reproduce with synthetic inputs'
+      safe.fix = safe.thrown ? `A non-Error value (${safe.thrown}) was thrown, so there are no source frames; throw an Error (or HttpError) instead` : safe.temporary ? 'A dependency answered not now (rate limit, restart, overload or a closed connection); the same request can succeed later. If it persists, check the backend health and its Retry-After' : kind === 'TypeError' ? 'Check nullable values, argument types and the data contract at these source frames' : kind === 'ReferenceError' ? 'Check the missing binding or import at these source frames' : kind === 'RangeError' ? 'Check recursive calls, array sizes and configured resource budgets at these source frames' : kind === 'SyntaxError' ? 'Check module syntax or JSON input parsing at these source frames without logging input values' : 'Inspect these source frames and the request reference; reproduce with synthetic inputs'
     }
     // a compiler budget failure (brain-budget.js) keeps its own code, limit, source position and fix
     const b = safe.budgetFailure
@@ -949,6 +982,9 @@ export function createServer(o = {}) {
   // log fields for a thrown value: its stack (sanitized by log) plus, for B09xx budget failures, the typed fields only
   const trace = e => {
     const out = { stack: String((e && e.stack) || e) }
+    // a thrown plain object, string or undefined has no stack: say what kind of value it was (never the value itself)
+    if (!(e instanceof Error)) out.thrown = e === null ? 'null' : Array.isArray(e) ? 'array' : typeof e
+    if (e && typeof e === 'object' && (e.temporary === true || e.status === 429 || e.status === 503)) out.temporary = true
     if (e instanceof HttpError && (OWN_CAUSES.has(e.message) || e.message.startsWith('Native authentication is unavailable:'))) out.cause = e.message
     if (e && e.code === 'ERR_MODULE_NOT_FOUND') out.fix = 'this process runs an older build whose files are gone; restart it after brain build'
     if (e && CODE_SHAPE.test(e.transport || '')) out.transport = e.transport
@@ -1136,6 +1172,34 @@ export function createServer(o = {}) {
     if (!mods.has(rel)) mods.set(rel, import(new URL(rel.replace(/^\//, ''), distURL).href))
     return mods.get(rel)
   }
+  // Every module a request can import (the DOM shim, the core, each route's view, layouts, guards, middleware, server
+  // module, dictionary, loading and error views, the RPC modules), imported once, one after another. `node server.mjs`
+  // runs it before `brain:ready`, so the first request after a (re)start finds them loaded instead of reading,
+  // compiling and evaluating the app's module graph (and its packages) while the visitor waits. A module that throws
+  // stays rejected in `mods`, exactly as the request that imports it would have found it; it is counted, never fatal.
+  const warm = async () => {
+    const want = new Set(['_server/dom.js', mf.core])
+    const add = r => {
+      if (!r || typeof r !== 'object') return
+      for (const k of ['view', 'server', 'loading', 'i18n']) if (typeof r[k] === 'string') want.add(r[k])
+      for (const k of ['layouts', 'guards', 'middleware']) for (const m of r[k] || []) if (typeof m === 'string') want.add(m)
+      add(r.error)
+    }
+    for (const r of mf.routes) add(r)
+    add(mf.notFound)
+    add(mf.forbidden)
+    for (const m of Object.values(mf.rpc)) if (typeof m === 'string') want.add(m)
+    for (const m of ['_server/brain-hydrate.js', '_server/brain-form.js']) if (file(m)) want.add(m)
+    let failed = 0
+    for (const rel of want) {
+      try {
+        await load(rel)
+      } catch {
+        failed++
+      }
+    }
+    return { modules: want.size, failed }
+  }
 
   const context = (req, res, url, extra) => {
     const cookies = parseCookies(req.headers.cookie)
@@ -1162,15 +1226,19 @@ export function createServer(o = {}) {
   let ssrBytes = 0
   async function cached(req, res, route, params, url, rid) {
     const n = +route.cache, ms = n * 1000, key = (route.locale || '') + url.pathname + cacheSearch(url)
-    const fill = () => {
+    // `kept.answer`: what this render answered when it was not a 200 (an error page, a redirect, a not-found), so the
+    // request that started it replays that answer instead of running load() and its backend reads a second time
+    const fill = (kept = {}) => {
       let failed = false
+      const set = {}
       return new Promise(ok => {
         const cap = { req, $capture: (out, h, st) => {
           const headers = Object.fromEntries(Object.entries(h).map(([k, v]) => [k.toLowerCase(), v]))
           const privateResponse = headers['set-cookie'] || headers['vary'] || /private|no-store|no-cache/i.test(headers['cache-control'] || '')
           if (st >= 500) failed = true
+          if (st !== 200) kept.answer = { page: out, h, st, set }
           ok(st === 200 ? { out, h, cacheable: !privateResponse, etag: 'W/"' + tag(out) + '"', t: Date.now(), bytes: Buffer.byteLength(out) } : null)
-        }, writeHead(st) { if (st >= 500) failed = true }, end: () => ok(null), setHeader() {}, getHeader: name => (name === 'x-request-id' ? rid : undefined), once() {}, removeListener() {} }
+        }, writeHead(st, h) { if (st >= 500) failed = true; kept.answer = { st, h: h || {}, set } }, end: body => { if (kept.answer && kept.answer.page === undefined) kept.answer.body = body; ok(null) }, setHeader(k, v) { set[k] = v }, getHeader: name => (name === 'x-request-id' ? rid : set[name]), once() {}, removeListener() {} }
         ssr(req, cap, route, params, url, rid, null, 200, null, true).catch(() => ok(null))
       }).then(c => {
         // A failed revalidation keeps the copy until 2N, which is what `stale-if-error` promises downstream.
@@ -1208,14 +1276,23 @@ export function createServer(o = {}) {
       if (c?.cacheable) return serve(c)
       return ssr(req, res, route, params, url, rid, null, 200, null, true)
     }
-    const filling = fill().finally(() => FILLING.delete(key))
+    const kept = {}
+    const filling = fill(kept).finally(() => FILLING.delete(key))
     FILLING.set(key, filling)
     c = await filling
     if (c) return serve(c)
     // the first render already asked the backend and logged why; another would only spend more of a limit it just hit
     if (req.$brainFailedReads?.temporary) return comeBackPage(req, res, route, params, url, rid)
     delete req.$brainFailedReads
-    return ssr(req, res, route, params, url, rid, null, 200, null, true) // a redirect or an error: as usual
+    // a redirect, a not-found or an error page: the answer that render produced, not a second load() (and its reads)
+    const a = kept.answer
+    if (a && !res.headersSent) {
+      for (const [k, v] of Object.entries(a.set)) res.setHeader(k, v)
+      if (a.page !== undefined) return html(res, a.st, a.page, a.h)
+      res.writeHead(a.st, a.h)
+      return void res.end(a.body)
+    }
+    return ssr(req, res, route, params, url, rid, null, 200, null, true) // nothing to replay (the render threw): as usual
   }
   const comeBackPage = (req, res, route, params, url, rid) => {
     res.setHeader('retry-after', String(Math.min(Math.ceil(req.$brainFailedReads.retryAfter) || 5, 3600)))
@@ -1311,7 +1388,8 @@ export function createServer(o = {}) {
       .replace('<!--brain:props-->', () => jsonInHtml(props))
     // a page behind a guard passes it only for its visitor: it stays out of the index even when it renders (§33)
     if (route.guards && route.guards.length) res.setHeader('x-robots-tag', NOINDEX)
-    let out = head(page, seo, url.pathname, url.search)
+    // with seo.trailingSlash "ignore" both forms answer: the canonical takes the form the sitemap lists (no slash)
+    let out = head(page, seo, SLASH === 'always' || url.pathname === '/' ? url.pathname : url.pathname.replace(/\/+$/, '') || '/', url.search)
     // route params for route() in the browser (the client has no route table)
     if (params && Object.keys(params).length) out = out.replace('</head>', () => `<meta name="brain-params" content="${esc(JSON.stringify(params))}"></head>`)
     if (forms) out = out.replace('</body>', () => `<script type="application/json" id="brain-forms">${jsonInHtml(forms)}</script></body>`)
@@ -1450,6 +1528,18 @@ export function createServer(o = {}) {
     const root = doc.createElement('div')
     const core = await load(mf.core)
     const mount = core.mount || core.m
+    // The core's console fallback (`BRAIN_ERROR: …`) is for the browser: on the server an fx/drv error goes to this
+    // render's failures (logged with rid and path by ssr()), once. A component boundary (brain-guard) collects its own.
+    if (core._err && !hooked.has(core)) {
+      hooked.add(core)
+      core._err((e, x, w) => {
+        if (w === 'render' || w === 'B0908') return // brain-guard reports these itself, with the component's name
+        for (let o = x; o; o = o.nodeType ? o.parentNode : o.p) if (o.$g) return
+        const into = globalThis.__brainSSR
+        if (into) into.push({ e, w, comp: null })
+        else log('error', 'component failed after SSR', { where: w, ...trace(e) }) // an async fx of a finished render
+      })
+    }
     const V = (await load(route.view)).default
     const L = []
     for (const l of route.layouts || []) L.push((await load(l)).default)
@@ -1500,8 +1590,16 @@ export function createServer(o = {}) {
     if (req.method !== 'POST') return fail(405, 'Use POST', { $h: { allow: 'POST' } })
     if (req.headers['x-brain-rpc'] !== '1') return fail(403, 'Missing X-Brain-RPC header')
     if (!sameOrigin(req)) return originRefused('B0741', req, rid, 'rpc'), fail(403, 'Cross-origin request', { brainCode: 'B0741' })
-    const modPath = mf.rpc[hash]
-    if (!modPath || !/^[A-Za-z_$][\w$]*$/.test(fn)) return fail(404, 'Unknown function')
+    const modPath = fnId(hash + '/' + fn) && Object.hasOwn(mf.rpc, hash) && mf.rpc[hash]
+    if (!modPath) return fail(404, 'Unknown function')
+    let f
+    try {
+      f = serverFn(await load(modPath), fn)
+    } catch (e) {
+      log('error', 'rpc module failed to load', { rid, fn: hash + '/' + fn, ...trace(e) })
+      return fail(500, 'Internal error', { rid })
+    }
+    if (typeof f !== 'function') return fail(404, 'Unknown function') // a guessed name never gets a rate-limit key
     const ra = overLimit(ipOf(req) + ' ' + hash + '/' + fn, LIMIT) // before reading the body
     if (ra) return fail(429, 'Too many requests', { $h: { 'retry-after': String(ra) } })
     let raw
@@ -1513,13 +1611,6 @@ export function createServer(o = {}) {
     }
     if (native) await native.prepare(req, res, rid)
     const ctx = context(req, res, url, { params: {} })
-    let f
-    try {
-      f = (await load(modPath))[fn]
-    } catch (e) {
-      log('error', 'rpc module failed to load', { rid, fn: hash + '/' + fn, ...trace(e) })
-      return fail(500, 'Internal error', { rid })
-    }
     const r = await callRpc({ fn: f, args: raw, ctx, timeout: TIMEOUT })
     if (r.cause) log('error', r.status === 504 ? 'rpc timeout' : 'rpc failed', { rid, fn: hash + '/' + fn, ms: TIMEOUT, ...trace(r.cause) })
     const b = r.status >= 500 ? { ...r.body, rid } : r.body
@@ -1552,8 +1643,8 @@ export function createServer(o = {}) {
       if (e.aborted) return
       return plain(413, tooBig(rid, url.pathname))
     }
-    const id = new URLSearchParams(raw).get('_brain') || '', modPath = mf.rpc[id.split('/')[0]]
-    if (!modPath) return plain(400, 'Unknown form')
+    const id = new URLSearchParams(raw).get('_brain') || '', fid = fnId(id), modPath = fid && Object.hasOwn(mf.rpc, fid.hash) && mf.rpc[fid.hash]
+    if (!modPath) return plain(400, 'Unknown form') // only `<hash>/<name>`: no rate-limit key for anything else
     if (native) await native.prepare(req, res, rid)
     const ctx = context(req, res, url, { params })
     let module, rules
@@ -1565,7 +1656,7 @@ export function createServer(o = {}) {
       log('error', 'form module failed to load', { rid, fn: id, ...trace(e) })
       return failPage(res, 500, rid)
     }
-    const r = await callForm({ module, raw, ctx, rules, key: ipOf(req) + ' ' + id, limit: LIMIT, timeout: TIMEOUT, locale: route.locale })
+    const r = await callForm({ module, raw, ctx, rules, key: ipOf(req) + ' ' + fid.hash + '/' + fid.fn, limit: LIMIT, timeout: TIMEOUT, locale: route.locale })
     if (r.cause) log('error', 'form failed', { rid, fn: id, ...trace(r.cause) })
     if (r.status === 303) return send(res, 303, '', { location: withBase(r.location), 'cache-control': 'no-store', ...ctx.session.headers() })
     if (r.status === 422) return ssr(req, res, route, params, url, rid, r.state, 422)
@@ -1677,6 +1768,9 @@ export function createServer(o = {}) {
   }
 
   // ---------- static ----------
+  // Never served (brain-pack private.rs holds the same list for the Rust handler and every generated host config).
+  const PRIVATE_PREFIXES = ['_server', '_brain', 'server.mjs']
+  const PRIVATE_FILES = ['_headers', '_redirects']
   // §33 content negotiation: `Accept` preferring text/markdown gets the page's Markdown twin (`/pricing` → pricing.md,
   // `/` → index.md) when the build published one (`seo.markdown`, default true; never for noindex pages).
   function publicStaticPath(pathname) {
@@ -1684,8 +1778,8 @@ export function createServer(o = {}) {
     try { path = decodeURIComponent(pathname) } catch { return null }
     if (/[\\\x00]/.test(path)) return null
     const clean = normalize(path).replaceAll('\\', '/')
-    const rel = clean.replace(/^\/+/, '')
-    if (rel.startsWith('_server') || rel.startsWith('_brain') || rel.startsWith('server.mjs') || rel === '_headers' || rel === '_redirects' || clean.split('/').some(part => part.startsWith('.') && part !== '.well-known')) return null
+    const rel = clean.replace(/^\/+/, '').toLowerCase() // a case-insensitive file system opens _SERVER/ as _server/
+    if (PRIVATE_PREFIXES.some(p => rel.startsWith(p)) || PRIVATE_FILES.includes(rel) || clean.split('/').some(part => part.startsWith('.') && part.toLowerCase() !== '.well-known')) return null
     return path
   }
   function serveTwin(req, res, url) {
@@ -1759,6 +1853,9 @@ export function createServer(o = {}) {
   // /health is reserved for the backend (B0735), so an app cannot declare it and deploy gates ask this port for it. An app
   // page at that path still wins: this only runs where the answer would have been a 404. Nothing here names the backend.
   const isProbe = path => path === '/health' || path === '/health/live' || path === '/health/ready'
+  // /_brain/health[/live|/ready] is the same probe under the framework prefix; the backend only serves /health, so it is
+  // answered here (mapped to that route) instead of being forwarded with the rest of /_brain and coming back a 404.
+  const brainProbe = path => path.startsWith('/_brain/health') && isProbe(path.slice(7)) ? path.slice(7) : null
   const answerProbe = async (req, res, url, rid) => {
     const headers = { 'content-type': MIME['.json'], 'cache-control': 'no-store' }
     if (req.method !== 'GET' && req.method !== 'HEAD') return notFound(req, res)
@@ -1843,10 +1940,15 @@ export function createServer(o = {}) {
       let url = full
       if (BASE !== '/') {
         if (full.pathname === BASE.slice(0, -1)) return send(res, 301, '', { location: BASE + full.search })
-        if (!full.pathname.startsWith(BASE)) return isProbe(full.pathname) ? await answerProbe(req, res, full, rid) : notFound(req, res)
+        if (!full.pathname.startsWith(BASE)) {
+          const probe = isProbe(full.pathname) ? full.pathname : brainProbe(full.pathname)
+          return probe ? await answerProbe(req, res, new URL(probe, full), rid) : notFound(req, res)
+        }
         url = new URL('/' + full.pathname.slice(BASE.length) + full.search, full) // the app path
       }
       req.$brainPath = url.pathname
+      const probe = brainProbe(url.pathname)
+      if (probe) return await answerProbe(req, res, new URL(probe, url), rid)
       if (native && /^\/_brain\/files(?:\/|$)/.test(url.pathname)) return await native.fileStream(req,res,url,rid)
       if (native && /^\/(?:api(?:\/|$)|_brain(?:\/|$)|s\/)/.test(url.pathname)) return await native.proxy(req,res,url,rid,send)
       const declaredRoute = native && nativeRoutes.find(route => route.rx.test(url.pathname))
@@ -1911,6 +2013,8 @@ export function createServer(o = {}) {
   server.headersTimeout = 15000
   // With a native backend the file upload deadline is enforced per request (above); 30 s stays for every other body.
   server.requestTimeout = native ? 320000 : 30000
+  // `warm: true` (`node server.mjs`): import the app's modules now; requests that arrive meanwhile share the same imports
+  if (o.warm) server.$brainWarm = warm()
   return server
 }
 
@@ -2094,19 +2198,50 @@ export async function runChain({ guards = [], middleware = [], ctx }) {
 }
 
 // ---------- shared request logic (server.mjs handlers and the dev server's sidecar call the same code, §11.1) ----------
-const HITS = new Map() // `${key}` → [windowStart, count]
+// Fixed 60 s window per key (ip + the validated `hash/fn`). Callers count only a function that exists, so the keys are
+// bounded by clients × real functions; HITS_MAX is the hard cap anyway (the oldest window goes first, like REVOKED) and a
+// key past HITS_KEY_MAX characters is stored as its digest. The map stays ordered by window start: a new window is
+// re-inserted at the end, so the expired entries are always the first ones.
+const HITS = new Map() // key → [windowStart, count]
+export const HITS_MAX = 50000, HITS_KEY_MAX = 256
+export const rateLimitKeys = () => HITS.size
+const WINDOW = 60000
+const dropExpired = now => {
+  for (const [k, [t]] of HITS) {
+    if (now - t <= WINDOW) break
+    HITS.delete(k)
+  }
+}
 let sweeping = null
-// Fixed 60 s window per key (ip + function). Returns 0, or the seconds to wait (Retry-After).
+// Returns 0, or the seconds to wait (Retry-After).
 export function overLimit(key, max = 60) {
-  if (!sweeping)
-    (sweeping = setInterval(() => {
-      const now = Date.now()
-      for (const [k, [t]] of HITS) if (now - t > 60000) HITS.delete(k)
-    }, 60000)).unref()
+  if (!sweeping) (sweeping = setInterval(() => dropExpired(Date.now()), WINDOW)).unref()
+  key = String(key)
+  if (key.length > HITS_KEY_MAX) key = createHash('sha256').update(key).digest('base64url')
   const now = Date.now()
   let h = HITS.get(key)
-  if (!h || now - h[0] > 60000) HITS.set(key, (h = [now, 0]))
-  return ++h[1] > max ? Math.ceil((h[0] + 60000 - now) / 1000) : 0
+  if (!h || now - h[0] > WINDOW) {
+    if (h) HITS.delete(key)
+    dropExpired(now)
+    while (HITS.size >= HITS_MAX) HITS.delete(HITS.keys().next().value)
+    HITS.set(key, (h = [now, 0]))
+  }
+  return ++h[1] > max ? Math.ceil((h[0] + WINDOW - now) / 1000) : 0
+}
+// A server function's id, `<hash>/<name>`: the RPC path and a form's `_brain` field. Anything else is refused before
+// it reaches the rate limit (a suffix such as `hash/login/1` would otherwise run `login` under a fresh budget).
+const FN_ID = /^([\w-]{1,64})\/([A-Za-z_$][\w$]{0,127})$/
+export const fnId = id => {
+  const m = typeof id === 'string' ? FN_ID.exec(id) : null
+  return m ? { hash: m[1], fn: m[2] } : null
+}
+// The only functions RPC and form posts may run: the ones a view declares with `server:`, which the generated server
+// module lists in `$server`. Its other exports (`load`, `paths`, `sitemap`, `seo`, `head`, `$forms`) run behind the
+// route's guards or at render time and are never callable by name; a module without the list exposes nothing.
+export const serverFn = (module, name) => {
+  const list = module && module.$server
+  const f = Array.isArray(list) && typeof name === 'string' && list.includes(name) ? module[name] : undefined
+  return typeof f === 'function' ? f : undefined
 }
 // t(), fmt and locale() read globalThis.__brainLocale. A render sets it while nothing else runs (renders are serialized);
 // load(), guards and form handlers overlap across awaits, so each carries its page's language in the async context.
@@ -2147,11 +2282,11 @@ export function parseArgs(raw) {
 // Runs one `server:` function → { status, body, headers?, cause? }. `args`: raw body string or an array. With `key`, the
 // rate limit applies here too. `cause` (500/504) is the real error, for the caller's log; the body stays generic.
 export async function callRpc({ fn, args, ctx, key, limit = 60, timeout = 10000 }) {
+  if (typeof fn !== 'function') return { status: 404, body: { error: 'Unknown function' } } // never counted: no key per guess
   if (key) {
     const ra = overLimit(key, limit)
     if (ra) return { status: 429, body: { error: 'Too many requests' }, headers: { 'retry-after': String(ra) } }
   }
-  if (typeof fn !== 'function') return { status: 404, body: { error: 'Unknown function' } }
   let a
   try {
     a = typeof args === 'string' || args == null ? parseArgs(args || '') : args
@@ -2182,12 +2317,14 @@ export async function callRpc({ fn, args, ctx, key, limit = 60, timeout = 10000
 // English text for the server's log: a form or a server function never shows it to a visitor
 const NATIVE_FAILED = 'Native resource request failed'
 export async function callForm({ module, raw, ctx, rules, key, limit = 60, timeout = 10000, locale }) {
-  const q = new URLSearchParams(raw || ''), id = q.get('_brain') || '', fn = id.split('/')[1] || ''
+  const q = new URLSearchParams(raw || ''), id = q.get('_brain') || '', fn = fnId(id)?.fn
+  // exactly `<hash>/<name>` naming a `server:` function, checked before the rate limit counts anything
+  const run = fn && serverFn(module, fn)
+  if (!run) return { status: 400, body: { error: 'Unknown form' } }
   if (key) {
     const ra = overLimit(key, limit)
     if (ra) return { status: 429, body: { error: 'Too many requests' }, headers: { 'retry-after': String(ra) } }
   }
-  if (!/^[A-Za-z_$][\w$]*$/.test(fn) || typeof (module && module[fn]) !== 'function') return { status: 400, body: { error: 'Unknown form' } }
   const schema = module.$forms && module.$forms[fn]
   const G = globalThis, had = '__brainLocale' in G, prev = G.__brainLocale
   let values, errors, generic
@@ -2204,7 +2341,7 @@ export async function callForm({ module, raw, ctx, rules, key, limit = 60, timeo
   let r
   try {
     ctx.signal ||= newSignal()
-    r = await withTimeout(pageLocale.run(locale, () => Promise.resolve(module[fn](ctx, values))), timeout, ctx)
+    r = await withTimeout(pageLocale.run(locale, () => Promise.resolve(run(ctx, values))), timeout, ctx)
   } catch (e) {
     if (e && e.errors && typeof e.errors === 'object') return again(e.errors, '')
     if (e instanceof HttpError && e.status >= 400 && e.status < 500) return again({}, e.message === NATIVE_FAILED ? generic : e.message)
@@ -2368,11 +2505,11 @@ export function prefersMarkdown(accept) {
 function head(page, seo, path, search = '') {
   let h = page
   // `<meta seo query="page">`: these parameters make a different page; any other (a dialog, a tracking tag) does not
-  let identity = ''
+  let identity = '', query = ''
   h = h.replace(/<meta name="brain-query" content="([^"]*)">/, (_, keys) => {
     const given = new URLSearchParams(search), kept = new URLSearchParams()
     for (const key of keys.split(/[\s,]+/)) for (const value of key ? given.getAll(key) : []) kept.append(key, value)
-    if (kept.size) identity = esc('?' + kept)
+    if (kept.size) identity = esc((query = '?' + kept))
     return ''
   })
   if (path) {
@@ -2381,7 +2518,7 @@ function head(page, seo, path, search = '') {
     h = h.replace(/(<link[^>]*rel=["']canonical["'][^>]*href=")([^"]*)(")/i, (m, a, v, b) => a + real(v) + b)
     h = h.replace(/(<meta[^>]*property=["']og:url["'][^>]*content=")([^"]*)(")/i, (m, a, v, b) => a + real(v) + b)
   }
-  if (!seo) return h
+  if (!seo) return graph(h, path, query)
   const meta = (attr, key, val, escaped) => {
     const tag = `<meta ${attr}="${esc(key)}" content="${escaped ? val.replace(/"/g, '&quot;') : esc(val)}">`
     const rx = new RegExp(`<meta[^>]*\\b${attr}=["']${key.replace(/[.*+?^${}()|[\]\\:]/g, '\\$&')}["'][^>]*>`, 'i')
@@ -2392,9 +2529,13 @@ function head(page, seo, path, search = '') {
     if (v == null || k === '$head' || k === 'schema' || k === 'lastmod') continue
     if (k === 'title') h = /<title>[\s\S]*?<\/title>/i.test(h) ? h.replace(/<title>[\s\S]*?<\/title>/i, () => `<title>${esc(v)}</title>`) : h.replace('</head>', () => `<title>${esc(v)}</title></head>`)
     else if (k === 'canonical') {
-      const tag = `<link rel="canonical" href="${esc(v)}">`
+      // a root-relative canonical takes the origin the build wrote into the template (PUBLIC_SITE_URL), as it does on
+      // a prerendered page: a relative canonical is ignored by search engines
+      const built = /^\/(?!\/)/.test(v) && /<link[^>]*rel=["']canonical["'][^>]*href="(https?:\/\/[^/"]+)/i.exec(h)?.[1]
+      const url = built ? built + v : v
+      const tag = `<link rel="canonical" href="${esc(url)}">`
       h = /<link[^>]*rel=["']canonical["'][^>]*>/i.test(h) ? h.replace(/<link[^>]*rel=["']canonical["'][^>]*>/i, () => tag) : h.replace('</head>', () => tag + '</head>')
-      if (seo['og:url'] == null) meta('property', 'og:url', v) // og:url follows the canonical unless the view sets its own
+      if (seo['og:url'] == null) meta('property', 'og:url', url) // og:url follows the canonical unless the view sets its own
     } else if (k === 'jsonld') h = h.replace('</head>', () => `<script type="application/ld+json">${jsonInHtml(v)}</script></head>`)
     else if (/^(og|twitter|article):/.test(k)) meta('property', k, v)
     else if (typeof v === 'string') meta('name', k, v)
@@ -2431,7 +2572,26 @@ function head(page, seo, path, search = '') {
     if (/<link[^>]*rel=["']canonical["']/i.test(seo.$head)) h = h.replace(/<link[^>]*rel=["']canonical["'][^>]*>/gi, '')
     h = h.replace('</head>', () => seo.$head + '</head>')
   }
-  return h
+  return graph(h, path, query, seo)
+}
+// The WebSite + WebPage graph the build wrote into the template (brain-seo ServerHead::apply): its pattern URLs become
+// this request's, like the canonical, and the WebPage takes this request's title and description.
+function graph(h, path, query, seo) {
+  return h.replace(/(<script type="application\/ld\+json">)(\{"@context":"https:\/\/schema\.org","@graph"[\s\S]*?)(<\/script>)/, (m, a, body, b) => {
+    let g
+    try { g = JSON.parse(body) } catch { return m }
+    const url = v => (typeof v === 'string' && path ? v.replace(/^(https?:\/\/[^/#]+)(\/[^#]*)(#.*)?$/, (u, o, p, hash = '') => (/\/[:*]/.test(p) ? o + path + query + hash : u)) : v)
+    const title = /<title>([\s\S]*?)<\/title>/i.exec(h)?.[1]
+    for (const node of g['@graph'] ?? []) {
+      for (const k of ['@id', 'url']) if (k in node) node[k] = url(node[k])
+      if (node.isPartOf?.['@id']) node.isPartOf['@id'] = url(node.isPartOf['@id'])
+      if ([node['@type']].flat().includes('WebPage')) {
+        if (title && node.name == null) node.name = title.replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&quot;/g, '"').replace(/&#39;/g, "'").replace(/&amp;/g, '&')
+        if (seo?.description != null && node.description == null) node.description = String(seo.description)
+      }
+    }
+    return a + jsonInHtml(g) + b
+  })
 }
 // `/_b/<hash>.js` imports inside the chunks resolve to files in dist/ (same hook as the build's prerender)
 let hooked = false
@@ -2452,6 +2612,8 @@ function hook(base, app = '/') {
 }
 
 const LISTEN_WAIT_MS = 10000
+// the supervisor gives an instance 30 s to print brain:ready: warming may hold it this long at most
+const WARM_WAIT_MS = 15000
 // `node server.mjs` (directly or under `brain start`); paths compared after symlinks (/var → /private/var on macOS)
 function real(p) {
   try {
@@ -2464,12 +2626,17 @@ if (process.argv[1] && real(process.argv[1]) === real(fileURLToPath(import.meta.
   process.env.NODE_ENV = 'production'
   // A closed log pipe is the operator's matter: requests do not depend on it.
   for (const stream of [process.stdout, process.stderr]) stream.on('error', error => { if (error.code !== 'EPIPE') throw error })
-  const s = createServer({ dist: fileURLToPath(new URL('.', import.meta.url)) })
+  const s = createServer({ dist: fileURLToPath(new URL('.', import.meta.url)), warm: true })
   const fd = ENV.BRAIN_LISTEN_FD
   const where = fd ? { fd: Number(fd) } : { port: +(ENV.PORT || 3000), host: ENV.HOST || '127.0.0.1' }
-  s.once('listening', () => {
+  s.once('listening', async () => {
+    // ready once the app's modules are imported (see `warm`), so a reload only switches traffic to a warm instance;
+    // a slow machine gets WARM_WAIT_MS at most, the rest keeps importing while requests are served
+    let timer
+    const warmed = await Promise.race([s.$brainWarm, new Promise(r => (timer = setTimeout(r, WARM_WAIT_MS)))])
+    clearTimeout(timer)
     process.stdout.write(`brain:ready ${process.pid}\n`) // the supervisor waits for this line (§34)
-    console.log(json({ t: new Date().toISOString(), level: 'info', msg: 'listening', ...(fd ? { fd: Number(fd) } : where) }))
+    console.log(json({ t: new Date().toISOString(), level: 'info', msg: 'listening', ...(fd ? { fd: Number(fd) } : where), ...(warmed ? { warmModules: warmed.modules, warmFailed: warmed.failed } : { warm: 'continuing' }) }))
   })
   // A restart may find the previous instance still draining: wait for it, briefly. Two live servers never share a port.
   const waitUntil = Date.now() + LISTEN_WAIT_MS