@dcasegr/skein 0.0.0-stage → 0.1.1

package/dist/host/router.js

@@ -0,0 +1,2389 @@
+// The host as a reverse proxy (#40): each instance is an HTTP server — its
+// front door (programs/frontdoor) — at an origin of its own, and the router
+// only picks the instance a request is for and forwards it. Routing comes
+// before authentication, because a BRC-104 handshake does not name its
+// recipient: the URL is the recipient. The router holds no sessions and no
+// mailbox: it keeps the hostname → instance map (host.db), the kernels it has
+// hydrated, the providers (the waker and the cron provider among them), the
+// feeds, the broadcaster, the fuel ledger.
+//
+//   http://<handle>.localhost:<port>/…   an instance's origin (the Host header). The stock AuthFetch keeps one
+//                                         session per origin, and shakes hands at <origin>/.well-known/auth: this
+//                                         is the form it is served by. (SKEIN_INSTANCE_ORIGIN: another template.)
+//   http://<host>:<port>/@<handle>/…      the same instance for our own clients (a dev form): the router strips
+//                                         the prefix for the routes; the client signs the path it sent, and its
+//                                         handshake goes under the prefix (src/client/raw.ts).
+//   The host's own origin (a host name whose first label is no instance) is the host skein's BRC-169 server
+//   (#113): these requests go to the host skein, as any request goes to its instance, under the onboarding
+//   app's routes (shruggr/skein-onboard: it registers, certifies through the certifier provider, records and
+//   answers; DISCOVERY below):
+//   GET  /manifest.json                          → /onboard/manifest.json   BRC-169 §5.1
+//   GET  /.well-known/metanet-handles/resolve    → /onboard/resolve         BRC-169 §5.2
+//   GET  /.well-known/metanet-handles/search     → /onboard/search          BRC-169 §5.6
+//   POST /.well-known/auth                       → /.well-known/auth        the BRC-103 handshake (#135: a registration is signed)
+//   POST /account/register                       → /onboard/register        a mailbox instance and its certificate (signed)
+//   POST /account/profile                        → /onboard/profile         a handle holder's signed profile
+//   GET  /bsvalias/id/<handle>[@<domain>]        → /onboard/bsvalias/id/…   the paymail PKI, from the same records
+//   With no host skein: 404 (tests may answer them with a fixture: `discovery`).
+//   GET  /skeins?key=<hex>                at the host's own origin: the skeins here whose head `grants` names the key
+//                                         among root's holders, [{handle, identity, url}] (no wallet token tracks them)
+//   GET  /.well-known/skein-host          at every host name, an instance's too (#103): {origin, domain} — this
+//                                         router's origin and the handle domain (the onboarding app's
+//                                         config.onboard.domain), for a page an instance serves (the management
+//                                         site) to find the manifest and register
+//   GET  /<app>/.live/<topic>             at an instance's origin (#138): the liveness tool's beats for that app's
+//                                         liveness on the topic (liveness.ts), served by the host, no program:
+//                                         JSON [{sender: <identity key, hex>, at: <ms>, body: <base64>, from: <peer
+//                                         ID>}], newest first; 404 when the app keeps no liveness for the topic.
+//                                         Unsigned, nothing logged; metered as a read (billing.ts)
+//   GET  /<app>/.events?event=<name>&topic=<t>[&topic=<t2>…]
+//                                         at an instance's origin (#148): a Server-Sent Events stream of the app's
+//                                         emitted events of that name whose `topic` is one of those (events.ts),
+//                                         served by the host, no program: `id` the event's place in the log
+//                                         (<n>.<seq>.<i>.<thread>), `event` its name, `data` the record as DAG-JSON.
+//                                         First the last one per topic (or, with Last-Event-ID, every one after
+//                                         it, folded from the log), then each as handed over (its place in the
+//                                         kernel's notice: no log read). 400 without
+//                                         `event` or a `topic`; 404 when the app is not installed. Unsigned,
+//                                         nothing logged; each message metered as a read. Closed at the app's
+//                                         uninstall and when the instance stops
+//   POST /arc/callback                    Arcade's webhook (Bearer: the host token)
+//
+// The broadcaster (#58, #65, arc.ts) takes the instances' broadcast events
+// (a durable queue in host.db, retries, one Arcade session) and routes what
+// Arcade says of a transaction to every instance whose state holds it (a
+// `has` of its CID, cached): a proof as an unsigned event in box `chain`,
+// any other status as a signed message from the status provider.
+//
+// A request for an instance goes to one of its two doors (#135, frontdoor.ts
+// serveHttp): a read — a path the instance's reads head names — is served by
+// a `call` (no entry; its fuel metered); a signed request for a message route
+// (#68, #66) is appended as received — one `request` entry, verified by
+// nothing here — and the client's connection held until the thread the kernel
+// steps the front door on comes to rest; its answer, signed on the session
+// inside, is the response. Past `answerWaitMs`, or at shutdown, 503 +
+// Retry-After. An unsigned request goes through the door only at an open row
+// whose filter validates the payload (#135: signed or validated; answered
+// plain); otherwise for a message route it is 401, for nothing 404, answered
+// without an entry.
+//
+// What the instances send out goes through the host's providers (#70,
+// providers.ts): each kernel hands over the messages its steps emitted
+// (unsigned, #126 step 4) to a `local` provider or a libp2p recipient, and the provider's
+// answer comes back as a signed message, a `local` request entry. The HTTP
+// proxy (`fetch`) answers a URL of this host's own in process (the same
+// path, no socket) and sends any other out; the waker keeps the instances'
+// deadlines and their shells' sleeps (#69); the cron provider their
+// schedules, each tick a signed message (#69, cron.ts; host.db
+// `cron_schedule`); the status provider tells the instances that subscribe
+// to it how their transactions stand (#65); the libp2p node is the
+// instance's own (p2p.ts); the instance manager (#90) creates, starts and
+// stops instances for the host skein alone (host.db `host_settings`:
+// `skein-host init` made it; createInstance claims a new instance before
+// its row is enabled, which publishes its hostname; image `mailbox`, #113, a
+// mailbox instance for a registration); the certifier (#113) signs handle
+// certificates for the host skein alone. Each genesis it writes names the providers' keys
+// in its address book (`addressBook`). A kernel's broadcast events go to the
+// broadcaster (#65).
+//
+// The libp2p host (#51, p2p.ts) is the router's too: one node per instance
+// whose genesis declares `libp2p` or whose dispatch table has a libp2p row
+// (#72, #77: a topic or a protocol), each topic message and stream
+// frame one request entry (`p2pInbound`: the verdict or the frame's answer
+// read off its thread and handed back to GossipSub or the stream). The node
+// follows the dispatch table: once the kernel has processed what the host
+// handed it (`settle`), the router reads the head (a kernel read), and when
+// it moved, declares the instance's libp2p config again — an install's
+// topics subscribed, an uninstall's unsubscribed, live (`syncDispatch`).
+// The host's headers feed (#102, `headersFeed`, SKEIN_HEADERS_URL; feeds.ts)
+// follows the table the same way: an enabled instance is subscribed while
+// a row of it takes events in box `chain` (the chain app's), else not. The
+// router itself listens to it too (#132, image-chain.ts): the default image
+// carries the whole header chain and grows with every header the feed
+// brings (filled from genesis at start from the feed's chaintracks history),
+// and createInstance boots each new skein from the image as it stands.
+//
+// Nothing here is an instance's clock but its providers (#69): a schedule
+// originates in a program's step, as a message to the cron provider; an
+// idle-stopped instance is hydrated for a tick only if something in it
+// subscribes the tick's box (from the cron provider, or from anyone).
+import { createServer } from "node:http";
+import { join } from "node:path";
+import { KeyDeriver, P2PKH, PrivateKey, ProtoWallet, Transaction } from "@bsv/sdk";
+import * as dagCbor from "@ipld/dag-cbor";
+import { CID } from "multiformats/cid";
+import { rootIdentity } from "../runtime/identity.js";
+import { DEFAULTS, short, stampMs } from "../runtime/log.js";
+import { ARC_ROUTE, Broadcaster } from "./arc.js";
+import { DEFAULT_BOX, Feeds, feedsOf, txCid } from "./feeds.js";
+import { Cron, dbSchedules } from "./cron.js";
+import { currentDispatch, takesEvent, takesMail } from "../runtime/dispatch.js";
+import { isSet, parseRocksSpec, parseSqliteSpec, storeSpec } from "../runtime/index-store.js";
+import { WasmHost } from "./wasm-kernel.js";
+import { openStoreFile, storeExists } from "./stores.js";
+import { rootOf } from "./install.js";
+import { OVERLAY_ROLE } from "./manifest.js";
+import { appHead } from "./plan.js";
+import { existsSync, realpathSync, statSync } from "node:fs";
+import { now as clockNow } from "./clock.js";
+import { boot, bootStore, imageSource, isOverlayImage } from "./boot.js";
+import { chainHeader, historyOf, ImageChain, skeinTip } from "./image-chain.js";
+import { admitOf, BEEF_PROTOCOL, OverlaySync, SYNC_PROTOCOL } from "./sync.js";
+import { ANSWER_WAIT_MS, appendRequest, cidOf, headerMap, serveHttp, unavailable } from "./frontdoor.js";
+import { keyBytes, keyHex } from "./genesis.js";
+import { HANDLE, pathOnly, TOKEN_HANDLE, topicsOf, validHandle } from "./instances.js";
+import { signClaim } from "../client/raw.js";
+import { DoorAnswered, Kernel, KernelHost } from "./kernel.js";
+import { foldLiveness, livenessEvent, livenessOf } from "./liveness.js";
+import { EventStreams, eventsQuery, sseMessage } from "./events.js";
+import { beaconEvent, beaconsOf, DEFAULT_LISTEN, emittedEvents, foldBeacons, foldSubscriptions, libp2pConfig, P2PHost, subscribedTopics, subscriptionEvent, subscriptionsOf } from "./p2p.js";
+import { peerIdFromMultihash, peerIdFromString } from "@libp2p/peer-id";
+import { MESSAGE_KEY_ID, MESSAGE_PROTOCOL, Providers, tooLarge } from "./providers.js";
+import { closeControl, listenControl } from "./control.js";
+import { Deliverer } from "./deliver.js";
+import { certify, RESOLVE_PATH, SEARCH_PATH } from "./handles.js";
+import { allocation, BILLING_HEAD, closedBy, mismatch, Period, periodRecord, priceHost, stateOf, termsOf, tickBody } from "./billing.js";
+import * as Digest from "multiformats/hashes/digest";
+const json = (status, v) => ({ status, headers: { "content-type": "application/json" }, body: new TextEncoder().encode(JSON.stringify(v)) });
+const KEY = /^0[23][0-9a-f]{64}$/;
+/** #148: an app's event stream, at an instance's origin. */
+const EVENTS_ROUTE = /^\/([^/]+)\/\.events$/;
+/** The apps a dispatch table names (an app with no row left is uninstalled). */
+const appsOf = (rows) => new Set(rows.map((r) => r.app).filter((x) => typeof x === "string"));
+export { HANDLE };
+/** Handles no instance may take on this host (H3), besides the router origin's own first label (Router.reserved): `id` (the router's own in production) and `host` (the host skein's). */
+export const RESERVED_HANDLES = new Set(["id", "host"]);
+/** The registration signature (#113: the onboarding app checks it): [2, "skein register"], key ID the username, counterparty anyone, over `register <username>@<domain>`. */
+export const REGISTER_PROTOCOL = [2, "skein register"];
+/** A handle's domain as a manager's `create` takes it: a host name, lower case. */
+const DOMAIN = /^[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?$/;
+/** The onboarding app (shruggr/skein-onboard, #90, #113): the host skein's app that serves BRC-169 on the host's own origin. */
+export const ONBOARD_APP = "onboard";
+/**
+ * The host's own origin's BRC-169 requests (#113) → the host skein's routes
+ * (the onboarding app's, under /onboard/): method + path → route.
+ */
+export const DISCOVERY = {
+    "GET /manifest.json": `/${ONBOARD_APP}/manifest.json`,
+    [`GET ${RESOLVE_PATH}`]: `/${ONBOARD_APP}/resolve`,
+    [`GET ${SEARCH_PATH}`]: `/${ONBOARD_APP}/search`,
+    "POST /account/register": `/${ONBOARD_APP}/register`,
+    // #135: a registration is a signed request: the stock client's handshake at the host's own origin is the host skein's.
+    "POST /.well-known/auth": "/.well-known/auth",
+    "POST /account/profile": `/${ONBOARD_APP}/profile`,
+};
+/** The paymail PKI (`GET /bsvalias/id/<handle>[@<domain>]`) → the app's prefix row `/onboard/bsvalias/id/…`. */
+export const PAYMAIL_PREFIX = "/bsvalias/id/";
+/** The BRC-169 domain a host name stands for: a dev router at a loopback address answers for `localhost`. */
+export const domainOf = (hostname) => {
+    const h = hostname.toLowerCase();
+    return h === "127.0.0.1" || h === "::1" || h === "[::1]" || h === "" ? "localhost" : h;
+};
+/**
+ * The BRC-169 domain of this host (H4): its public origin's host name
+ * (SKEIN_ROUTER_ORIGIN, default the loopback: `localhost`). What a created
+ * instance, a claim and a mailbox instance record when nothing names one,
+ * and what /.well-known/skein-host answers.
+ */
+export const hostDomain = (origin) => {
+    try {
+        return domainOf(new URL(origin.replace("{port}", "0")).hostname);
+    }
+    catch {
+        return "localhost";
+    } // an origin that is no URL: the loopback's
+};
+/**
+ * SKEIN_HTTP=fetch: the HTTP proxy's requests (#70, the `fetch` provider)
+ * performed for real; `timeoutMs` (default 30 000) bounds the whole exchange,
+ * `maxBytes` (#91) the response body: reading stops past it, and the request
+ * fails.
+ */
+export async function fetchHttp(req) {
+    const ac = new AbortController();
+    const timer = setTimeout(() => ac.abort(new Error(`timed out after ${req.timeoutMs ?? 30_000} ms`)), req.timeoutMs ?? 30_000);
+    try {
+        const r = await fetch(req.url, { method: req.method, headers: req.headers, body: req.body, signal: ac.signal });
+        const headers = Object.fromEntries(r.headers.entries());
+        if (req.maxBytes === undefined || !r.body)
+            return { status: r.status, headers, body: new Uint8Array(await r.arrayBuffer()) };
+        const chunks = [];
+        let n = 0;
+        for await (const c of r.body) {
+            n += c.length;
+            if (n > req.maxBytes) {
+                ac.abort();
+                throw new Error(tooLarge(req.maxBytes));
+            }
+            chunks.push(c);
+        }
+        return { status: r.status, headers, body: new Uint8Array(Buffer.concat(chunks)) };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * The warning for an agent whose genesis names no owner messagebox
+ * (`defaults.ownerMessagebox`): its sends to the owner — every answer to him —
+ * fail, since nothing else tells it where his mailbox is. Undefined if it names one.
+ */
+export function noOwnerMessagebox(genesis) {
+    // An image (#89, #143) names no root: the claim brings the claimant's messagebox (into the address book).
+    if (genesis && genesis.root === undefined)
+        return undefined;
+    const d = genesis?.defaults;
+    if (typeof d?.ownerMessagebox === "string" && d.ownerMessagebox)
+        return undefined;
+    return "WARNING: its genesis names no owner messagebox (defaults.ownerMessagebox): nothing it sends the owner (its answers) can be delivered. " +
+        "Create the owner's mailbox instance (skein-host add <name> --mailbox --owner <key>) or set SKEIN_OWNER_MESSAGEBOX, then re-genesis it (a new store)";
+}
+/** A sendMessage request's box and recipient, for the delivery log line ("" if the body is neither CBOR nor JSON). */
+function describeDelivery(req) {
+    const b = req.body ?? new Uint8Array();
+    let m;
+    try {
+        m = dagCbor.decode(b).message;
+    }
+    catch {
+        try {
+            m = JSON.parse(new TextDecoder().decode(b)).message;
+        }
+        catch { /* neither: the line names no box; the delivery's result is logged beside it */ }
+    }
+    if (!m)
+        return "";
+    const to = m.recipient instanceof Uint8Array ? Buffer.from(m.recipient).toString("hex") : typeof m.recipient === "string" ? m.recipient : "";
+    return `${String(m.messageBox ?? "?")}${to ? ` for ${short(to)}` : ""}`;
+}
+/** An error answer's description (JSON {description | error}), else its first 200 bytes. */
+function errorOf(body) {
+    const t = new TextDecoder().decode(body.subarray(0, 2000));
+    try {
+        const j = JSON.parse(t);
+        return String(j.description ?? j.error ?? t.slice(0, 200));
+    }
+    catch {
+        return t.slice(0, 200);
+    } // not JSON: the text itself is the description
+}
+export class Router {
+    o;
+    feeds;
+    /** The cron provider's schedules (#69). */
+    cron;
+    /** The host's broadcaster (#58, #65): present when the host has an Arcade. */
+    arc;
+    /** The libp2p host (#51): one node per instance whose genesis declares libp2p. */
+    p2p;
+    /** shruggr/skein#150: overlay sync over the libp2p node (sync.ts). */
+    sync;
+    /** The host's providers (#70): what carries the instances' messages out. */
+    providers;
+    /** #148: the pages' subscriptions to their apps' emitted events (GET /<app>/.events), per instance. */
+    events;
+    /** The certifier (#100, #113): signs the BRC-169 handle certificates, for the host skein's onboarding app (the `certifier` provider). */
+    certifier;
+    /** #157: the `deliver` intention's carrier (BRC-103/104, the sessions the host keeps). */
+    deliverer;
+    loaded = new Map();
+    loading = new Map();
+    /** #156: the host chain record each running instance was last sent (a `chain` event), by handle; cleared at each start. */
+    sentChain = new Map();
+    /** Rows being created (#90): hydrated before their hostname is published (disabled until claimed). */
+    unpublished = new Set();
+    queues = new Map();
+    /** The libp2p nodes following their dispatch tables (#72: syncDispatch after a settle). */
+    syncing = new Set();
+    idleTimer;
+    ledgerTimer;
+    /** The fuel of calls not yet written to the ledger: instance\0caller\0op → {calls, fuel}. */
+    owed = new Map();
+    stopped = false;
+    closing;
+    /** Settles when the router starts shutting down: every client still waiting on a thread is answered 503 (#66). */
+    stopping;
+    stopNow;
+    /** Requests being forwarded (their clients held on a thread). */
+    inflight = new Set();
+    servers = [];
+    port = 0;
+    /** The control socket (control.ts), while this router listens on one. */
+    control;
+    /** The default image (#89), with its chain part (#132): what createInstance boots a new skein from. */
+    image;
+    /** #130: each billed instance as last read (its host row's terms, the kernel's billing state), and what this host metered since its last tick. */
+    views = new Map();
+    periods = new Map();
+    /** Instances a tick is on its way to; and those sent their first (billing starts with it) since this router started: the timer sends it again. */
+    ticking = new Set();
+    firstTicks = new Set();
+    tickTimer;
+    /** The host's provider keys (its billing key among them, #130). */
+    providerKey;
+    /** The one-process kernels this router holds (#158), by database directory. */
+    kernelHosts = new Map();
+    wasmHosts = new Map();
+    /** The wasm kernel's host over the SQLite database at `db` (the settled split): its machines, its host chain. */
+    wasmHost(db) {
+        let h = this.wasmHosts.get(db);
+        if (!h) {
+            h = WasmHost.acquire(db, { network: this.chainNetwork() ?? "main", log: (l) => this.say("kernel", l) });
+            this.wasmHosts.set(db, h);
+        }
+        return h;
+    }
+    /** The `skein-kernel host` process for the RocksDB database at `dir` (#158), started on first use. */
+    kernelHost(dir) {
+        let h = this.kernelHosts.get(dir);
+        if (!h) {
+            h = KernelHost.acquire(dir, { command: this.o.kernel?.command, env: this.kernelEnv(), log: (l) => this.say("kernel", l) });
+            this.kernelHosts.set(dir, h);
+        }
+        return h;
+    }
+    constructor(o) {
+        this.o = o;
+        if (o.rocksStore)
+            this.kernelHost(o.rocksStore); // started with the router: the host's reads go through it (stores.ts)
+        this.image = new ImageChain({ db: o.db, history: historyOf(o.headersFeed), log: (l) => this.say("router", l) });
+        this.stopping = new Promise((r) => { this.stopNow = r; });
+        this.feeds = new Feeds({
+            headers: (h, box, raws) => this.chainHeaders(h, box, raws), log: (s, l) => this.say(s, l),
+            maxQueue: o.feeds?.maxQueue, backoff: o.feeds?.backoff,
+        });
+        this.cron = new Cron({
+            now: () => stampMs(this.now()), store: dbSchedules(o.db), log: (s, l) => this.say(s, l),
+            tick: async (s, body) => {
+                const row = this.o.db.get(s.instance);
+                if (!row || row.status !== "enabled") {
+                    this.cron.forget(s.instance);
+                    throw new Error("the instance is gone");
+                }
+                await this.providers.send(s.instance, "cron", keyBytes(s.recipient), s.box, body);
+            },
+            // An idle-stopped instance is hydrated for a tick only if something in it takes the box (from the cron provider, or anyone).
+            wake: async (s) => {
+                const l = this.loaded.get(s.instance);
+                if ((l && !l.kernel.gone) || this.loading.has(s.instance))
+                    return true;
+                return await this.subscribes(s.instance, s.box, this.providers.key("cron"));
+            },
+        });
+        if (o.arc) {
+            this.arc = new Broadcaster({
+                arc: o.arc, db: o.db, fetch: o.arcFetch, backoff: o.feeds?.backoff, ...(o.arcRetry ? { retry: o.arcRetry } : {}), log: (s, l) => this.say(s, l),
+                admit: (h, box, ev) => this.admitEvent(h, box, ev),
+                status: async (h, body, subject) => {
+                    const id = this.o.db.get(h)?.identity;
+                    if (!id)
+                        throw new Error("its identity is not known yet");
+                    await this.providers.send(h, "status", keyBytes(id), "chain/status", body, subject);
+                },
+                now: () => stampMs(this.now()),
+                instances: () => ({ all: this.o.db.list("enabled").map((r) => r.handle), running: [...this.loaded].filter(([, l]) => !l.kernel.gone).map(([h]) => h) }),
+                holds: async (h, txid) => await (await this.hydrate(h)).kernel.hasBlock(txCid(txid)),
+            });
+        }
+        if (o.peerKeyFor) {
+            this.p2p = new P2PHost({
+                host: o.libp2p ?? { listen: DEFAULT_LISTEN, bootstrap: [], dht: "off", relays: [], mdns: false },
+                keyOf: o.peerKeyFor, discoveryMs: o.libp2pDiscoveryMs,
+                inbound: (h, c) => this.p2pInbound(h, c),
+                log: (s, l) => this.say(s, l),
+                // #126: a beacon's beat signed by the instance's signer, as an intention request is.
+                sign: (h, data) => this.signAs(h, data),
+                identity: async (h) => { const id = this.o.db.get(h)?.identity; return id ? keyBytes(id) : undefined; },
+                beat: (h, topic, b) => { this.sync?.beat(h, topic, b); void this.rememberPeer(h, topic, b.from); },
+            });
+            const p2pHost = this.p2p;
+            this.sync = new OverlaySync({
+                overlayOf: (h, liveTopic) => this.loaded.get(h)?.beacons.find((b) => b.topic === liveTopic)?.app,
+                local: (h, app, fn, query) => this.overlayRead(h, app, fn, query),
+                ownBeat: (h, liveTopic) => this.loaded.get(h)?.beacons.find((b) => b.topic === liveTopic)?.body,
+                deliver: (h, peer, beef) => this.p2pInbound(h, { transport: "libp2p", protocol: BEEF_PROTOCOL, from: peerIdFromString(peer).toMultihash().bytes, body: beef }),
+                header: async (h, height) => {
+                    const row = this.o.db.get(h);
+                    if (!row || !storeExists(storeSpec(row)))
+                        return undefined;
+                    const st = openStoreFile(storeSpec(row), { readOnly: true });
+                    try {
+                        return await chainHeader(st, height);
+                    }
+                    finally {
+                        st.close();
+                    }
+                },
+                request: (h, peer, body) => p2pHost.request(h, peer, SYNC_PROTOCOL, body),
+                beats: (h, liveTopic) => p2pHost.live.live(h, liveTopic),
+                self: (h) => p2pHost.peerId(h),
+                log: (s, l) => this.say(s, l),
+            });
+        }
+        // Without a host's own provider keys: a router's own, fresh (a test's).
+        const own = o.providerKeyFor ? undefined : new KeyDeriver(PrivateKey.fromRandom());
+        const keyOf = o.providerKeyFor ?? ((n) => own.derivePrivateKey([2, "skein provider"], n, "self"));
+        this.providerKey = keyOf;
+        // The certifier key is the certifier provider's (signer.ts certifierKey: providerKey("certifier")).
+        this.certifier = new ProtoWallet(keyOf("certifier"));
+        const p2p = this.p2p;
+        this.deliverer = new Deliverer({ http: (req, from) => this.http(req, from), log: (s, l) => this.say(s, l) });
+        this.events = new EventStreams({
+            open: (h) => { const row = this.o.db.get(h); return row && storeExists(storeSpec(row)) ? openStoreFile(storeSpec(row), { readOnly: true }) : undefined; },
+        });
+        this.providers = new Providers({
+            keyOf,
+            append: (h, pkg) => this.appendLocal(h, pkg),
+            identity: async (h) => { const id = this.o.db.get(h)?.identity; return id ? keyBytes(id) : undefined; },
+            sign: (h, data) => this.signAs(h, data),
+            fetch: (req, from) => this.http(req, from),
+            ...(this.arc ? { broadcast: (h, tx, beef) => { this.arc.enqueue(h, tx, beef); } } : {}),
+            ...(p2p ? { topicEvent: (h, rec) => this.topicEvent(h, rec) } : {}),
+            ...(o.appEvent ? { appEvent: o.appEvent } : {}),
+            emitted: (h, rec, place) => this.events.emitted(h, rec, place),
+            deliver: (h, id, rec) => this.deliver(h, id, rec),
+            cron: (h, sender, id, body) => this.cron.request(h, sender, id, body),
+            // #90: the instance manager acts for the host skein alone.
+            manager: {
+                from: () => { const r = this.o.db.hostSkein(); return r?.identity ? { handle: r.handle, identity: r.identity } : undefined; },
+                // #162: SKEIN_MANAGER_FOR — these instances too (each by its own identity).
+                alsoFor: () => (this.o.managerFor ?? []).flatMap((h) => { const r = this.o.db.get(h); return r?.identity && r.status === "enabled" ? [{ handle: r.handle, identity: r.identity }] : []; }),
+                request: (box, body) => this.manage(box, body),
+            },
+            // #113: the certifier signs for the host skein alone (the onboarding app records each issue).
+            certifier: (box, body) => certify(this.certifier, box, body),
+            // #130: a payment is this host's: kept and broadcast.
+            ...(o.billing ? { payment: (h, rec) => this.payment(h, rec) } : {}),
+            ...(p2p ? {
+                p2p: {
+                    publish: (h, topic, body) => p2p.publish(h, topic, body),
+                    dial: (h, peer, protocol, frames) => p2p.dial(h, peer, protocol, frames),
+                    send: (h, s, body) => p2p.send(h, s, body),
+                    close: (h, s) => p2p.close(h, s),
+                },
+            } : {}),
+            now: () => stampMs(this.now()),
+            log: (s, l) => this.say(s, l),
+        });
+        if (o.cron !== false)
+            this.cron.start();
+        const idle = o.idleMs ?? 0;
+        if (idle > 0)
+            this.idleTimer = setInterval(() => void this.reap(idle), Math.max(50, Math.min(idle / 4, 10_000)));
+        this.ledgerTimer = setInterval(() => this.flushLedger(), o.ledgerMs ?? 5000);
+        if (o.billing)
+            this.tickTimer = setInterval(() => void this.tickAll(), o.billing.tickMs);
+    }
+    say(source, line) { this.o.log?.(source, line); }
+    now() { return (this.o.now ?? clockNow)(); }
+    /** The router's clock, as entries are stamped. */
+    nowStamp() { return this.now(); }
+    /** This host's own origin. */
+    origin() { return (this.o.origin ?? "http://127.0.0.1:{port}").replace("{port}", String(this.port || this.o.port || 0)); }
+    /**
+     * The first label of the router's own origin, when its host name is a
+     * name (`id` for id.skein.nexus), else undefined: no instance may take it,
+     * so a request to the router's origin never reaches an instance (H3).
+     */
+    ownLabel() {
+        let h;
+        try {
+            h = new URL(this.origin()).hostname.toLowerCase();
+        }
+        catch {
+            return undefined;
+        } // an origin that is no URL names no label
+        if (!h.includes(".") || /^[0-9.]+$/.test(h) || h.startsWith("["))
+            return undefined;
+        return h.split(".")[0];
+    }
+    /** Whether `handle` is reserved on this host: `id`, `host` (RESERVED_HANDLES), or the router origin's own first label. */
+    reserved(handle) {
+        return RESERVED_HANDLES.has(handle) || (handle === this.ownLabel() && !this.ownLabelInstance(handle));
+    }
+    /**
+     * The router's own label as an instance (2026-10-28, one public name): allowed only when the operator names
+     * that handle in SKEIN_MANAGER_FOR (managerFor) — the Open Exchange's config instance at the host's own
+     * origin. Its hostname then serves the instance; the router keeps /.well-known/skein-host, /skeins and
+     * /arc/callback there. Any other row named like the router's origin still never takes its requests.
+     */
+    ownLabelInstance(handle) {
+        return handle === this.ownLabel() && this.managerFor(handle);
+    }
+    /** This host's BRC-169 domain: its origin's host name (hostDomain). */
+    domain() { return hostDomain(this.origin()); }
+    /** An instance's origin: where its front door is, what BRC-169 publishes as its messagebox. */
+    originOf(handle) {
+        // #161: a path-only handle (a token id) has no hostname: its origin is /@<handle> on the host's own.
+        if (pathOnly(handle))
+            return `${this.origin().replace(/\/+$/, "")}/@${handle}`;
+        return (this.o.instanceOrigin ?? "http://{handle}.localhost:{port}").replace("{handle}", handle).replace("{port}", String(this.port || this.o.port || 0));
+    }
+    /** Hydrate every enabled row once (recovery at hydrate time: what a waiting thread awaits is handed to the providers again), then let them idle out. */
+    async start() {
+        // #132: the image's chain part, filled from the feed's history (from genesis once; then from near its tip), then grown by the feed.
+        if (this.o.headersFeed) {
+            void this.image.start();
+            this.feeds.listen(this.o.headersFeed, (raws) => { void this.image.headers(raws); });
+        }
+        for (const row of this.o.db.list("enabled")) {
+            try {
+                await this.hydrate(row.handle);
+            }
+            catch (e) {
+                this.say(row.handle, `not started: ${e.message}`);
+            }
+        }
+    }
+    /**
+     * Stop everything this router started (#61), once: the providers' (the
+     * waker's, the cron provider's), the idle reaper's and the ledger's timers
+     * (the owed fuel written first), its
+     * servers and their connections, the control socket (its file removed), the header feeds' and the broadcaster's
+     * SSE clients, the libp2p nodes, and every kernel process it spawned — one
+     * still hydrating included. Afterwards nothing of it keeps the process
+     * alive: `skein-host run`'s shutdown and every one-shot command that builds
+     * a router (`add --boot/--packet`) end with it.
+     */
+    close() {
+        this.closing ??= this.shutdown();
+        return this.closing;
+    }
+    /** The same as `close()`. */
+    stop() { return this.close(); }
+    /**
+     * Listen on the control socket at `path` ($SKEIN_HOME/host.sock for
+     * `skein-host run`; mode 0600, no HTTP route): `skein-host event` sends its
+     * event here while this router runs, and it reaches the instance as a tick
+     * due now (cronEvent). Removed by `close()`.
+     */
+    async listenControl(path) {
+        if (this.stopped)
+            throw new Error("the router is stopping");
+        const server = await listenControl(path, {
+            event: async (h, box, ev) => (await this.cronEvent(h, box, ev)).toString(),
+            reclaim: (h) => this.reclaim(h),
+            message: async (h, m, body) => (await this.messageLocal(h, m, body)).toString(),
+        });
+        this.control = { server, path };
+        this.say("router", `control socket at ${path}`);
+    }
+    async shutdown() {
+        this.stopped = true;
+        this.sync?.stop();
+        // Clients waiting on a thread are answered 503 + Retry-After before the servers close (#66).
+        this.stopNow();
+        if (this.inflight.size) {
+            await Promise.all([...this.inflight].map((p) => p.catch(() => { }))); // each answers its own client (a 503 now): this only waits for them
+            await new Promise((r) => setTimeout(r, 50)); // their 503s written before the sockets close
+        }
+        clearInterval(this.idleTimer);
+        clearInterval(this.ledgerTimer);
+        clearInterval(this.tickTimer);
+        this.flushLedger();
+        const closed = this.servers.map((s) => new Promise((r) => { s.close(() => r()); s.closeAllConnections(); }));
+        this.servers = [];
+        if (this.control)
+            closed.push(closeControl(this.control.server, this.control.path));
+        this.control = undefined;
+        this.providers.stop();
+        this.events.stop();
+        await Promise.all([this.cron.stop(), this.feeds.stop(), this.arc?.stop(), this.p2p?.stop()]);
+        // A kernel still hydrating: its load finishes (or fails) first, then it is stopped with the rest.
+        await Promise.all([...this.loading.values()].map((p) => p.catch(() => { }))); // a failed load was reported to whoever asked for it
+        await Promise.all([...this.loaded.values()].map((l) => l.kernel.stop()));
+        this.loaded.clear();
+        // #158: the one-process kernels released (the last holder's release stops the process: its database flushed).
+        await Promise.all([...this.kernelHosts.values()].map((h) => h.release()));
+        this.kernelHosts.clear();
+        await Promise.all([...this.wasmHosts.values()].map((h) => h.release()));
+        this.wasmHosts.clear();
+        await Promise.all(closed);
+    }
+    /**
+     * `skein-host event` (#69): a message from the cron provider into `box`, as
+     * a tick due now would be — {...event, kind: event.kind ?? "cron", due:
+     * now}, signed by the provider and appended as a `local` request; the
+     * instance takes it by its subscription to the box (from the cron provider,
+     * or from anyone). The entry's CID.
+     */
+    async cronEvent(handle, box, event) {
+        const row = this.o.db.get(handle);
+        if (!row || row.status !== "enabled")
+            throw new Error(`no enabled instance ${handle}`);
+        const l = await this.hydrate(handle);
+        return await this.providers.send(handle, "cron", keyBytes(l.identity), box, { ...event, kind: event.kind ?? "cron", due: stampMs(this.now()) });
+    }
+    /**
+     * A plain entry (#29, #65): a self-validating event from the host's wiring
+     * (a header feed, the broadcaster's proof), admitted into the instance in
+     * `box` with its record beside the entry (#164: the kernel puts it — after
+     * the door, when `box`'s event route names kernel.beef: its BEEFs decoded
+     * and checked, the bytes never stored; a BUMP that does not check, or no
+     * BEEF, is turned away: DoorAnswered, thrown, nothing written). The kernel
+     * routes it by its `subject` to the thread awaiting that record, else to
+     * `box`'s event route.
+     */
+    async admitEvent(handle, box, event) {
+        return await this.serial(handle, async () => {
+            const l = await this.hydrate(handle);
+            const closed = this.closed(handle);
+            if (closed)
+                throw new Error(`not forwarded (#130): ${closed}`);
+            const e = await l.kernel.admit({ box, event: cidOf(event) }, { event }, this.now());
+            this.settle(l);
+            return e;
+        });
+    }
+    /**
+     * #157: a `deliver` intention from `handle`, carried (deliver.ts: BRC-103/104 with the instance's
+     * key) and its answer admitted in box `deliver` — it stands on its own at the door (the server's
+     * signature). No answer: nothing admitted, the thread rests (offered again at its next start).
+     */
+    async deliver(handle, id, rec) {
+        const l = await this.hydrate(handle);
+        const mail = await l.kernel.store.get(rec.message);
+        const body = dagCbor.encode(await l.kernel.store.get(mail.body));
+        const ans = await this.deliverer.carry(handle, l.wallet, id, rec, mail, body);
+        if (!ans)
+            return false;
+        try {
+            await this.admitEvent(handle, "deliver", ans);
+            this.say(handle, `deliver → ${String(rec.url)}: HTTP ${ans.status}, the signed answer admitted`);
+            return true;
+        }
+        catch (e) {
+            this.say(handle, `deliver → ${String(rec.url)}: the answer turned away: ${e.message}`);
+            return false;
+        }
+    }
+    /**
+     * A message for an instance (#70): a provider's signed answer, a forwarded
+     * claim, or the loopback's own emit, appended as received — a `local`
+     * request entry, {kind: "message", message, body}; the front door checks it
+     * (the signature, or for the loopback the record in the store) and routes
+     * it. Nobody waits on it.
+     */
+    async appendLocal(handle, pkg) {
+        return await this.serial(handle, async () => {
+            const l = await this.hydrate(handle);
+            // #130: the gate lets through the instance's own messages to itself (the loopback), nothing else.
+            const closed = this.closed(handle);
+            if (closed && !isLoopback(pkg, l.identity))
+                throw new Error(`not forwarded (#130): ${closed}`);
+            const e = await appendRequest(l.kernel, "local", pkg, this.now());
+            this.settle(l);
+            return e;
+        });
+    }
+    /**
+     * #142: a message signed outside the host (the client `skein`, with the operator's key), delivered on
+     * the host machine over the control socket: its mail record (dag-cbor) and body, appended as a `local`
+     * request (appendLocal — the path a forwarded claim takes). The front door checks the signature and
+     * admits it by the dispatch table as it would any signed message; this waits for its verdict and
+     * throws on a refusal. The host signs nothing. The entry.
+     */
+    async messageLocal(handle, messageBytes, body) {
+        if (!this.o.db.get(handle))
+            throw new Error(`no instance ${handle}`);
+        let message;
+        try {
+            message = dagCbor.decode(messageBytes);
+        }
+        catch {
+            throw new Error("the message is not dag-cbor");
+        }
+        if (!message || typeof message !== "object" || Array.isArray(message) || !message.signature)
+            throw new Error("not a signed message (a mail record with its signature)");
+        // #143: turned away at the door (a filter, the transport's check) writes no entry: DoorAnswered, thrown.
+        const entry = await this.appendLocal(handle, { kind: "message", message, body });
+        const l = await this.hydrate(handle);
+        const a = await l.kernel.answer(entry, this.o.answerWaitMs ?? ANSWER_WAIT_MS);
+        if (a.state === "errored")
+            throw new Error(`the front door failed: ${a.error}`);
+        if (a.state !== "finished")
+            throw new Error(`not judged in time (${a.state}); entry ${entry}`);
+        const v = dagCbor.decode(a.answer);
+        if (v.verdict !== "accept")
+            throw new Error(`${v.verdict ?? "not accepted"}: ${v.reason ?? ""}`.trim());
+        return entry;
+    }
+    /** Sign `data` with `handle`'s signer: [2, "metanet handles envelope"] / `send` / anyone — an intention request's signature (providers.ts), a beacon's beat (p2p.ts beaconFrame). */
+    async signAs(handle, data) {
+        const row = this.o.db.get(handle);
+        if (!row)
+            throw new Error(`no instance ${handle}`);
+        const { signature } = await (await this.o.walletFor(row)).createSignature({ protocolID: MESSAGE_PROTOCOL, keyID: MESSAGE_KEY_ID, counterparty: "anyone", data: [...data] });
+        return Uint8Array.from(signature);
+    }
+    /**
+     * An inbound libp2p message or stream frame (#51, #68): appended as
+     * received (the message with its signature; the frame), and the verdict
+     * — or the frame's answer — read off the thread the front door is stepped
+     * on, once it comes to rest (#66). The front door verifies, routes, and
+     * admits what an accept carries (the message's `p2p` event first); a
+     * redelivered message it accepted before is `ignore`. Its thread failing,
+     * or not answering within the wait, is `ignore` (no penalty). A frame a
+     * route's filter answers at the door (a read, #143: nothing written) is
+     * answered with the filter's body (#154: the overlay's sync protocol).
+     */
+    async p2pInbound(handle, call) {
+        const l = await this.hydrate(handle);
+        const closed = this.closed(handle);
+        if (closed)
+            return { verdict: "ignore", reason: `not forwarded (#130): ${closed}` };
+        const source = `libp2p:${call.topic ?? call.protocol ?? "?"}`;
+        let from = "";
+        try {
+            from = peerIdFromMultihash(Digest.decode(call.from)).toString();
+        }
+        catch { /* not a peer ID: only this log line's name; the front door judges the record */ }
+        // The settled sync design (David 2026-10-30, skein-overlay 0.20.0): an `admit` announcement on an overlay
+        // topic is the host's, never the instance's — fetched from the announcer unless held (sync.ts), nothing
+        // logged; GossipSub's verdict ignore (no forward: each node announces its own admission).
+        if (call.topic !== undefined && this.sync) {
+            const app = this.loaded.get(handle)?.beacons.find((b) => b.topic === `${call.topic}-live`)?.app;
+            const txid = app ? admitOf(call.topic, call.body) : undefined;
+            if (app && txid && from) {
+                this.sync.admit(handle, app, call.topic, txid, from);
+                return { verdict: "ignore", reason: "an announcement: the host fetches it" };
+            }
+        }
+        const record = call.topic !== undefined
+            ? { kind: "p2p", topic: call.topic, from: call.from, seqno: call.seqno ?? new Uint8Array(), signature: call.signature ?? new Uint8Array(), body: call.body }
+            : { kind: "p2p-frame", protocol: call.protocol ?? "", from: call.from, body: call.body };
+        let entry;
+        try {
+            entry = await appendRequest(l.kernel, "libp2p", record, this.now());
+        }
+        catch (e) {
+            if (!(e instanceof DoorAnswered))
+                throw e;
+            // #154: a frame on a stream answered by a filter (a read: nothing written) — its body is the answer frame.
+            if (call.topic === undefined && e.answer.kind === "answer")
+                return { verdict: "accept", body: e.answer.body ?? new Uint8Array() };
+            // #121, #143: turned away at the door (nothing written). A bad signature or a bad BEEF is the sender's fault
+            // (reject: GossipSub penalises the forwarder); what this instance cannot judge (no chain state, a failing check) is ignore.
+            const reason = e.answer.reason ?? "turned away";
+            const verdict = e.answer.status < 500 && !/no chain state/.test(reason) ? "reject" : "ignore";
+            this.say(handle, `${source} from ${from}: ${verdict} (turned away at the door: ${reason})`);
+            return { verdict, reason };
+        }
+        const a = await l.kernel.answer(entry, this.o.answerWaitMs ?? ANSWER_WAIT_MS);
+        this.settle(l);
+        if (a.state !== "finished") {
+            const why = a.state === "errored" ? `the front door failed: ${a.error}` : `not answered in time (${a.state})`;
+            this.say(handle, `${source} from ${from}: ${why}`);
+            return { verdict: "ignore", reason: why };
+        }
+        const r = dagCbor.decode(a.answer);
+        const verdict = r.verdict === "accept" || r.verdict === "reject" ? r.verdict : "ignore";
+        if (verdict !== "accept" || process.env.SKEIN_LIBP2P_VERBOSE)
+            this.say(handle, `${source} from ${from}: ${verdict}${r.reason ? ` (${r.reason})` : ""}`);
+        return { verdict, ...(r.body instanceof Uint8Array ? { body: r.body } : {}), ...(r.close ? { close: true } : {}), ...(r.reason ? { reason: r.reason } : {}) };
+    }
+    /** Until nothing is queued and every loaded kernel has processed what it was given (tests, corpus). */
+    async settled() {
+        for (let i = 0; i < 1000; i++) {
+            await Promise.all([...this.queues.values()]);
+            await Promise.all([...this.loaded.values()].map((l) => l.kernel.idle().catch(() => { }))); // a kernel that exited is reported by its exit (hydrate's `exited`): this only waits
+            await this.providers.idle(); // what the providers carry now (#70): its answers are entries
+            await this.arc?.idle(); // the broadcaster's posts (#65): their answers are statuses to route
+            await Promise.all([...this.syncing]); // the libp2p nodes following their dispatch tables (#72, #77)
+            await new Promise((r) => setImmediate(r));
+            if (!this.syncing.size && !this.queues.size && !this.providers.busy() && !this.arc?.busy() && [...this.loaded.values()].every((l) => l.kernel.busy === 0))
+                return;
+        }
+    }
+    /**
+     * Run `f` after everything else queued for this instance: the host's own admissions (events from its
+     * wiring, `local` messages: the waker's, the providers', the loopback, a forwarded claim) reach the
+     * kernel in the order the host made them, each after its hydrate and `closed` check, and `settled`
+     * waits on them. Not the log's order: the kernel assigns every entry's place (#163), so HTTP and
+     * libp2p arrivals, which do not queue here, need no queue.
+     */
+    serial(handle, f) {
+        const prev = this.queues.get(handle) ?? Promise.resolve();
+        // f's failure goes to its caller through `next`; the queue only keeps the order.
+        const next = prev.catch(() => { }).then(f);
+        const tail = next.catch(() => { });
+        this.queues.set(handle, tail);
+        void tail.then(() => { if (this.queues.get(handle) === tail)
+            this.queues.delete(handle); });
+        return next;
+    }
+    // ---------------------------------------------------------------- the host chain (#156)
+    /**
+     * The network the host chain is on: SKEIN_NETWORK (`network`), else the genesis defaults'
+     * `walletNetwork` (a test host's), else the kernel's default (main).
+     */
+    chainNetwork() {
+        const d = this.o.genesis?.defaults;
+        return this.o.network ?? (typeof d?.walletNetwork === "string" ? d.walletNetwork : undefined);
+    }
+    /** The kernels' environment: the configured one, and the host chain's network (#156). */
+    kernelEnv() {
+        const net = this.chainNetwork();
+        return net ? { ...this.o.kernel?.env, SKEIN_NETWORK: net } : this.o.kernel?.env;
+    }
+    /**
+     * A run of headers from a feed for `handle` (#156): into the host chain — the one kernel
+     * process's for a RocksDB set (an instance not running is not hydrated for it: it gets the
+     * chain at its next start), the instance's own serve kernel's otherwise — then, when the
+     * record changed for it, the `chain` event.
+     */
+    async chainHeaders(handle, box, raws) {
+        const row = this.o.db.get(handle);
+        if (!row)
+            return;
+        const rocks = parseRocksSpec(storeSpec(row));
+        const sq = parseSqliteSpec(storeSpec(row));
+        let tip;
+        if (rocks || sq) {
+            tip = rocks ? await this.kernelHost(rocks.dir).chainHeaders(raws) : await this.wasmHost(sq.db).chainHeaders(raws);
+            const l = this.loaded.get(handle);
+            if (!l || l.kernel.gone)
+                return;
+        }
+        else {
+            tip = await (await this.hydrate(handle)).kernel.chainHeaders(raws);
+        }
+        await this.chainEvent(handle, box, tip);
+    }
+    /** The `chain` event (#156) for `handle` in `box`, unless it was sent that record already since its start. */
+    async chainEvent(handle, box, tip) {
+        const key = tip.root.toString();
+        if (this.sentChain.get(handle) === key)
+            return;
+        this.sentChain.set(handle, key);
+        try {
+            await this.admitEvent(handle, box, { kind: "chain", root: tip.root, height: tip.height });
+        }
+        catch (e) {
+            if (this.sentChain.get(handle) === key)
+                this.sentChain.delete(handle);
+            throw e;
+        }
+    }
+    /**
+     * Fresh-host bootstrap (#156): the host chain empty and the instance's tree (its head `main`,
+     * an image's) carrying `chain/headers`: those imported into the host chain before the
+     * instance's first event. A tree with none, or a host chain with a tip: nothing.
+     */
+    async chainBootstrap(handle, kernel) {
+        if (await kernel.chainTip())
+            return;
+        const tree = await kernel.call("head", "main");
+        if (!tree || tree.code !== 0x78)
+            return;
+        try {
+            const t0 = Date.now();
+            const got = await kernel.chainImport(tree);
+            this.say("router", `host chain: ${got.added} headers imported from ${handle}'s image (tip ${got.height}, ${Date.now() - t0} ms)`);
+        }
+        catch (e) {
+            const m = e.message;
+            if (!/NoChain|NotEmpty/.test(m))
+                this.say(handle, `host chain: the image's chain not imported: ${m}`);
+        }
+    }
+    /** At start (and once an app takes box `chain` — an install): the host chain's current record, as the `chain` event. */
+    async chainBirth(handle) {
+        const l = this.loaded.get(handle);
+        if (!l || l.kernel.gone)
+            return;
+        const rows = l.rows ?? (await l.kernel.dispatch()).rows;
+        if (!rows.some((r) => r.address === DEFAULT_BOX && takesEvent(r, DEFAULT_BOX)))
+            return;
+        const tip = await l.kernel.chainTip();
+        if (tip)
+            await this.chainEvent(handle, DEFAULT_BOX, tip);
+    }
+    // ---------------------------------------------------------------- hydration
+    /** The instance's kernel, started (and its genesis written) if it is not loaded. */
+    hydrate(handle) {
+        const l = this.loaded.get(handle);
+        if (l && !l.kernel.gone)
+            return Promise.resolve(l);
+        let p = this.loading.get(handle);
+        if (!p) {
+            p = this.load(handle).finally(() => this.loading.delete(handle));
+            this.loading.set(handle, p);
+        }
+        return p;
+    }
+    async load(handle) {
+        if (this.stopped)
+            throw new Error("the router is stopping");
+        const row = this.o.db.get(handle);
+        if (!row || (row.status !== "enabled" && !this.unpublished.has(handle)))
+            throw new Error(`no enabled instance ${handle}`);
+        const wallet = await this.o.walletFor(row);
+        const identity = await rootIdentity(wallet);
+        if (row.identity && row.identity !== identity)
+            throw new Error(`its signer is ${short(identity)}, not the recorded identity ${short(row.identity)}`);
+        const ko = {
+            db: storeSpec(row), handle: row.handle, domain: row.domain, wallet, command: this.o.kernel?.command, env: this.kernelEnv(),
+            log: (line) => this.say(handle, line),
+            emit: (o) => this.providers.deliver(handle, o),
+            exited: (code, signal) => {
+                if (this.loaded.get(handle)?.kernel === kernel)
+                    this.loaded.delete(handle);
+                if (code !== 0)
+                    this.say(handle, `kernel exited (${signal ?? `code ${code}`})`);
+            },
+        };
+        // #158: a RocksDB set is an instance of the host's one kernel process (opened there: hydrate); else a serve process of its own.
+        // The settled split (2026-10-31): a SQLite set's machine is the wasm kernel, loaded in this process on a worker.
+        const rocks = parseRocksSpec(ko.db);
+        const sq = parseSqliteSpec(ko.db);
+        const kernel = sq ? await this.wasmHost(sq.db).open(ko) : rocks ? await this.kernelHost(rocks.dir).open(ko) : new Kernel(ko);
+        let g;
+        try {
+            if (!(await kernel.store.log.tip())) {
+                // No tree was loaded into this store (`skein-host add --boot/--packet` does that): the stock system, through the same loader.
+                const b = await boot(kernel, { kind: "code" }, this.genesisConfig(row, identity), this.now());
+                this.say(handle, `genesis ${b.entry}`);
+            }
+            g = await kernel.genesis();
+            if (!g)
+                throw new Error("the store's log does not start with a genesis this kernel reads (format 3, #40): start a new store (re-genesis)");
+            if (keyHex(g.identity) !== identity)
+                throw new Error(`the signer (${short(identity)}) is not this instance's identity (${short(keyHex(g.identity))})`);
+            await kernel.start();
+            // #156: after the start (the genesis processed: its tree is the head `main`), before any event is admitted.
+            await this.chainBootstrap(handle, kernel);
+            await kernel.running(identity);
+            void kernel.idle().catch(() => { }); // busy until what start resumed is done; a kernel that exits meanwhile is reported by its exit
+            if (!row.identity)
+                this.o.db.add(row.handle, { identity });
+            if (row.kind !== "mailbox") {
+                const w = noOwnerMessagebox(g);
+                if (w)
+                    this.say(handle, w);
+            }
+            this.feeds.declare(handle, feedsOf(g));
+        }
+        catch (e) {
+            await kernel.stop(1000);
+            throw e;
+        }
+        // #119: the apps' subscriptions, read from the log (the kernel writes nothing for them).
+        const subs = await this.foldSubscriptions(storeSpec(row)).catch((e) => { this.say(handle, `libp2p: the subscriptions not read: ${e.message}`); return []; });
+        // #126: the apps' beacons, read from the log the same way.
+        const beacons = await this.foldBeacons(storeSpec(row)).catch((e) => { this.say(handle, `libp2p: the beacons not read: ${e.message}`); return []; });
+        // #138: the apps' liveness, read from the log the same way.
+        const live = await this.readLiveness(storeSpec(row)).catch((e) => { this.say(handle, `libp2p: the liveness not read: ${e.message}`); return []; });
+        const l = { row, kernel, identity, wallet, genesis: g, subs, beacons, live };
+        // Its node (the genesis's libp2p and the dispatch table's libp2p rows), before anything it runs can publish or dial; the host's headers feed.
+        await this.syncDispatch(l, true);
+        this.loaded.set(handle, l);
+        // #156: the host chain as it stands, once at each start (not awaited: an admit made here would wait on this load).
+        this.sentChain.delete(handle);
+        void this.chainBirth(handle).catch((e) => this.say(handle, `host chain: the start event not sent: ${e.message}`));
+        // The settled sync design: the peers each overlay topic's beats came from (host.db), asked at once.
+        if (this.sync)
+            void this.askKnownPeers(l).catch((e) => this.say(handle, `sync: the known peers not asked: ${e.message}`));
+        await this.syncBilling(l).catch((e) => this.say(handle, `billing: not read: ${e.message}`));
+        this.say("router", `hydrated ${handle} (${short(identity)})`);
+        return l;
+    }
+    /**
+     * Whether a stopped instance's route table routes an entry in `box` — an event, or (given a
+     * sender) a message: the kernel's rule (#77, #143: dispatch.zig forMail/forEvent, by the box
+     * alone; who may run the function is the gate's, when it is routed). Read from its store file,
+     * read-only, with no kernel.
+     */
+    async subscribes(handle, box, sender) {
+        const row = this.o.db.get(handle);
+        if (!row || !storeExists(storeSpec(row)))
+            return false;
+        const s = openStoreFile(storeSpec(row), { readOnly: true });
+        try {
+            const rows = await currentDispatch(s);
+            return !!rows?.some((r) => sender !== undefined ? takesMail(r, box) : takesEvent(r, box));
+        }
+        finally {
+            s.close();
+        }
+    }
+    /**
+     * Boot a row's empty store from a system tree or a checkpoint (issue #4,
+     * boot.ts) before its first hydration; the row's identity is its signer's.
+     */
+    async bootRow(handle, src, o = {}) {
+        const row = this.o.db.get(handle);
+        if (!row)
+            throw new Error(`no instance ${handle}`);
+        if (this.loaded.has(handle))
+            throw new Error(`${handle} is loaded: boot only an empty store`);
+        if (o.image && src.kind !== "tree")
+            throw new Error("an image is a system tree");
+        if (o.manager && !o.image)
+            throw new Error("the instance manager is the host skein's, and the host skein is an image");
+        if ((o.owner || o.appConfig) && !o.image)
+            throw new Error("an owner and app config at birth are an image's (#142)");
+        const identity = await rootIdentity(await this.o.walletFor(row));
+        // #142: an image booted with its owner named (the host skein): the owner's rows and its apps' `$owner` rows at birth, no claim row.
+        const c = src.kind === "checkpoint" ? { identity, root: [this.o.owner ?? identity], handle: row.handle, domain: row.domain } : o.image ? { ...this.imageConfig(row, identity, { manager: o.manager }), ...(o.owner ? { root: [o.owner] } : {}), ...(o.appConfig ? { appConfig: o.appConfig } : {}) } : this.genesisConfig(row, identity, src.kind === "code");
+        const b = await bootStore({ db: storeSpec(row), handle: row.handle, domain: row.domain, command: this.o.kernel?.command, env: this.kernelEnv(), log: (l) => this.say(handle, l) }, src, c, this.now());
+        this.o.db.add(row.handle, { identity, ...(b.tree ? { tree: b.tree.toString() } : {}) });
+        return b;
+    }
+    /** The owner's messagebox: configured, else its mailbox instance here. */
+    ownerMessagebox() {
+        if (this.o.ownerMessagebox)
+            return this.o.ownerMessagebox;
+        const mb = this.o.owner ? this.o.db.mailboxOf(this.o.owner) : undefined;
+        return mb ? this.originOf(mb.handle) : undefined;
+    }
+    /**
+     * A new agent's address book seed (#70): this host's providers — the HTTP
+     * proxy, the waker, the cron provider (#69), the libp2p node (when it runs
+     * one), the status provider (#65, when it has an Arcade) — and the owner's
+     * mailbox, when it knows it.
+     */
+    addressSeed(handle) {
+        const names = ["fetch", "waker", "cron", ...(this.p2p ? ["libp2p"] : []), ...(this.arc ? ["status"] : []), ...(handle !== undefined && this.managerFor(handle) ? ["manager"] : [])];
+        const out = this.providers.entries(names);
+        const mb = this.ownerMessagebox();
+        if (this.o.owner && mb)
+            out.push({ key: keyBytes(this.o.owner), transport: "mailbox", address: mb, ...(this.o.ownerHandle ?? {}) });
+        return out;
+    }
+    /**
+     * What this host brings to an image's genesis (#89): only its own facts —
+     * the instance's identity, handle and domain, its providers in the address
+     * book, where its domain resolves, the host's defaults. No owner, no
+     * owner's mailbox, no inference peer, no names: the image is the same for
+     * everyone, and the owner is the claim's sender (#127). `manager`
+     * (#90, #113): the host skein's — the instance manager and the certifier
+     * in its address book too (no other instance's book names them).
+     */
+    imageConfig(row, identity, o = {}) {
+        // #162: an instance SKEIN_MANAGER_FOR names gets the instance manager (not the certifier), as the host skein has it.
+        const seed = this.providers.entries(["fetch", "waker", "cron", ...(this.p2p ? ["libp2p"] : []), ...(this.arc ? ["status"] : []), ...(o.manager ? ["manager", "certifier"] : this.managerFor(row.handle) ? ["manager"] : [])]);
+        return {
+            identity, handle: row.handle, domain: row.domain, resolveOrigin: this.origin(), network: this.o.network, addressBook: seed,
+            providers: Object.fromEntries(seed.map((e) => [e.address, Buffer.from(e.key).toString("hex")])),
+            feeds: this.o.genesis?.feeds, defaults: this.o.genesis?.defaults, overrides: this.o.fuelPerStep ? { fuelPerStep: this.o.fuelPerStep } : undefined,
+            warn: (l) => this.say(row.handle, l),
+        };
+    }
+    /** #162: whether SKEIN_MANAGER_FOR names `handle` (the instance manager in its address book, its messages taken). */
+    managerFor(handle) { return (this.o.managerFor ?? []).includes(handle); }
+    /**
+     * #162: the image a create names, as a boot source — the built-in `default` (this host's, with its
+     * chain part), or a directory `<imagesDir>/<name>` (SKEIN_IMAGES_DIR, default $SKEIN_HOME/images;
+     * the layout `skein-host add --image <dir>` takes: with no bin/ merged over the default image as
+     * images/host is, with bin/ a complete image). Its path resolved first (a link to an app repository's
+     * image/ reads `..` beside the repository's image, not beside the link).
+     */
+    async namedImage(name, host) {
+        if (host || name === undefined || name === "default")
+            return await this.image.source({ host, ...(name ? { image: name } : {}) });
+        const dir = this.imageDir(name);
+        if (!dir)
+            throw new Error(`image ${JSON.stringify(name)}: this host has the default image, mailbox instances${this.o.imagesDir ? ` and the images in ${this.o.imagesDir}` : ""}`);
+        return isOverlayImage(dir) ? await this.image.source({ overlay: dir }) : await imageSource(dir);
+    }
+    /** #162: an image by name: its directory under imagesDir (resolved), or undefined. */
+    imageDir(name) {
+        if (!this.o.imagesDir || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(name) || name === "host" || name === "mailbox")
+            return undefined;
+        try {
+            const d = realpathSync(join(this.o.imagesDir, name));
+            return statSync(d).isDirectory() ? d : undefined;
+        }
+        catch {
+            return undefined;
+        } // no such image here
+    }
+    /** Whether `owner` holds root on the instance (#143: the head `grants`): claimed by that key. */
+    async claimedBy(l, owner) {
+        const root = await l.kernel.call("head", "grants");
+        if (!root)
+            return false;
+        const g = await l.kernel.store.get(root).catch(() => undefined);
+        return (g?.roles?.root ?? []).some((k) => k instanceof Uint8Array && Buffer.from(k).toString("hex") === owner);
+    }
+    /**
+     * A new instance from an image, owned by `owner` (#90: the instance
+     * manager's `create`; `skein-host init` for the host skein). In this order:
+     * the row, disabled (no hostname: nothing reaches it); its identity
+     * derived (the signer's, key ID = the handle) and its store booted from the
+     * image (only `default`, the default image, so far); its kernel started
+     * unpublished; `claim` (#127) — the owner's own signed claim, a message in
+     * box `claim` naming no recipient (it was signed before the instance
+     * existed), with its body — forwarded into it as a `local` request, its
+     * first entry after the genesis: the front door checks the signature, and
+     * the kernel takes the owner from the signer (the owner's admin rows
+     * written, the claim row removed); only then (`publish`, default true) the
+     * row enabled, which publishes its hostname. No request can reach the claim
+     * row first. The host signs nothing for the owner. With no `claim` (a bare
+     * image: `skein-host init`), the instance keeps its claim row, from anyone:
+     * the first sender of a claim owns it. `host`: the host skein — the
+     * instance manager and the certifier in its address book, and recorded as
+     * the host skein (host.db). `domain`: the handle's domain, recorded with
+     * the row (default `localhost`). A refusal throws (a bad or taken handle, a
+     * bad key, another image, a claim not `owner`'s or refused: the row is left
+     * disabled, its store kept for a look).
+     *
+     * `owned` (#164): a non-host image instance born owned as the host skein
+     * is — its genesis's `root` is `owner`, no claim (none taken, none made:
+     * the image's claim route is not seeded), no instance manager or
+     * certifier in its address book (those stay the host skein's and
+     * SKEIN_MANAGER_FOR's).
+     *
+     * Image `mailbox` (#113): a mailbox instance for `owner` — the front door
+     * and the messagebox, its owner in its genesis (no claim) — published at
+     * once (`publish`). The same owner and handle again: the same answer (it
+     * exists, enabled again if it was not, at `domain` if given); a key with
+     * another mailbox here is refused. One creation path: the manager's `create` (the onboarding app's
+     * registrations) and `skein-host add --mailbox` both come here.
+     */
+    async createInstance(handle, owner, o = {}) {
+        if (!validHandle(handle))
+            throw new Error(`handle ${JSON.stringify(handle)}: lower-case letters, digits and "-", at most 63, as a hostname label; or a token id <txid>_<vout> (path-only, #161)`);
+        if (this.reserved(handle) && !(o.host && handle === "host"))
+            throw new Error(`handle ${handle} is reserved`);
+        if (!KEY.test(owner))
+            throw new Error("owner: not an identity key (33 bytes)");
+        if (o.image !== undefined && o.image !== "default" && o.image !== "mailbox" && !this.imageDir(o.image))
+            throw new Error(`image ${JSON.stringify(o.image)}: this host has the default image${this.o.imagesDir ? `, the images in ${this.o.imagesDir}` : ""} and mailbox instances`);
+        if (o.domain !== undefined && !DOMAIN.test(o.domain))
+            throw new Error(`domain ${JSON.stringify(o.domain)}: a host name, lower case`);
+        if (o.image === "mailbox")
+            return await this.createMailbox(handle, owner, o);
+        if (o.host && (o.claim !== undefined || o.needsClaim))
+            throw new Error("the host skein is born owned (#142): no claim");
+        // #164: an owned image instance is born owned as the host skein is: no claim.
+        if (o.owned && (o.claim !== undefined || o.needsClaim))
+            throw new Error("an owned instance is born owned (#164): no claim");
+        const owned = o.host || o.owned;
+        let claim = o.claim !== undefined ? claimOf(o.claim) : undefined;
+        // #162: a one-key host claims what it creates itself — the claim signed by its shared key (the owner).
+        if (!claim && !owned && this.o.claimer && o.needsClaim) {
+            const me = (await this.o.claimer.getPublicKey({ identityKey: true })).publicKey;
+            if (owner !== me)
+                throw new Error(`owner: on a one-key host the claim is the host's own key's (${short(me)}): name it or no owner, or forward the owner's signed claim`);
+            claim = claimOf(await signClaim(this.o.claimer));
+        }
+        if (!claim && o.needsClaim)
+            claimOf(undefined);
+        if (claim)
+            claimProblem(claim, owner);
+        if (this.o.db.get(handle))
+            throw new Error(`handle ${handle} is taken`);
+        const store = this.newStore(handle);
+        if (storeExists(storeSpec({ store, handle })))
+            throw new Error(`handle ${handle}: a store is at ${storeSpec({ store, handle })} already`);
+        this.o.db.add(handle, { store, status: "disabled", domain: o.domain ?? await this.handleDomain(), ...(o.topics?.length ? { topics: JSON.stringify(o.topics) } : {}) }); // #137: the names it is routed by. H4: never the column's `localhost` on a host with a domain
+        this.unpublished.add(handle);
+        try {
+            await this.image.ready; // #132: born with the chain as the host holds it
+            // #142, #143: the host skein from the host image (images/host over images/default), its genesis's `root` the
+            // operator's key, `appConfig` merged.
+            // #162: any instance's app config at birth (a create's `config`), the host skein's owner at birth.
+            // #164: an owned instance's genesis names `owner` root (boot.ts then seeds no claim route), as the host skein's does.
+            await this.bootRow(handle, await this.namedImage(o.image, o.host), { image: true, manager: o.host, ...(owned ? { owner } : {}), ...(o.appConfig ? { appConfig: o.appConfig } : {}) });
+            const l = await this.hydrate(handle);
+            if (claim) {
+                // #127: the owner's own message, forwarded as signed; the host signs nothing for the owner. #143: one the door
+                // turns away (its signature does not hold) writes no entry.
+                let entry;
+                try {
+                    entry = await this.appendLocal(handle, { kind: "message", message: claim.message, body: claim.body });
+                }
+                catch (e) {
+                    if (e instanceof DoorAnswered)
+                        throw new Error(`the claim message was refused at the door (${e.answer.reason ?? e.answer.status}); ${handle} is left disabled`);
+                    throw e;
+                }
+                await this.queues.get(handle);
+                await l.kernel.idle();
+                if (!(await this.claimedBy(l, owner)))
+                    throw new Error(`the claim ${entry} was refused (its log says why); ${handle} is left disabled`);
+            }
+            if (o.host)
+                this.o.db.setSetting("host_skein", handle);
+            if (o.publish !== false) {
+                this.o.db.setStatus(handle, "enabled");
+                await this.refollowHeaders(handle);
+            }
+            const tip = this.image.tip();
+            this.say("router", `created ${handle} (${short(l.identity)}) from the ${o.host ? "host" : o.image ?? "default"} image${tip ? ` (its chain to ${tip.height})` : ""}, ${owned ? `owned by ${short(owner)}${o.host ? "" : " (born owned, #164)"}` : claim ? `claimed by ${short(owner)}${o.claim === undefined ? " (the host's own key, #162)" : ""}` : "unclaimed (its claim row from anyone)"}${o.publish !== false ? `, at ${this.originOf(handle)}` : ""}${o.host ? ": the host skein" : ""}`);
+            return { handle, identity: l.identity, url: this.originOf(handle) };
+        }
+        finally {
+            this.unpublished.delete(handle);
+        }
+    }
+    /** host.db's `store` for a new instance (#96): its set in the host's LMDB environment (SKEIN_STORE), else its own file. */
+    newStore(handle) {
+        if (this.o.sqliteStore)
+            return `sqlite:${this.o.sqliteStore}`; // the settled split: the wasm kernel
+        if (this.o.rocksStore)
+            return `rocksdb:${this.o.rocksStore}`; // #158
+        return this.o.lmdbStore ? `lmdb:${this.o.lmdbStore}` : join(this.o.home ?? ".", "instances", handle, "runtime.db");
+    }
+    /** createInstance's image `mailbox` (#113). */
+    async createMailbox(handle, owner, o) {
+        const had = this.o.db.get(handle);
+        if (had) {
+            if (had.kind !== "mailbox" || had.owner !== owner)
+                throw new Error(`handle ${handle} is taken`);
+            // The handle's domain is the asker's (a row registered before #113 took the request's host name).
+            if (o.domain && had.domain !== o.domain)
+                this.o.db.add(handle, { domain: o.domain });
+            if (o.publish !== false && had.status !== "enabled")
+                this.o.db.setStatus(handle, "enabled");
+            const identity = had.identity ?? await rootIdentity(await this.o.walletFor(had));
+            return { handle, identity, url: this.originOf(handle) };
+        }
+        const mine = this.o.db.list().find((r) => r.kind === "mailbox" && r.owner === owner);
+        if (mine)
+            throw new Error(`${short(owner)} has a mailbox instance here already: ${mine.handle}`);
+        const store = this.newStore(handle);
+        if (storeExists(storeSpec({ store, handle })))
+            throw new Error(`handle ${handle}: a store is at ${storeSpec({ store, handle })} already`);
+        this.o.db.add(handle, { store, status: "disabled", kind: "mailbox", owner, ...(o.domain ? { domain: o.domain } : {}) });
+        await this.bootRow(handle, { kind: "code" });
+        const identity = this.o.db.get(handle).identity;
+        if (o.publish !== false)
+            this.o.db.setStatus(handle, "enabled");
+        this.say("router", `created mailbox instance ${handle}@${this.o.db.get(handle).domain} (${short(identity)}) for ${short(owner)}${o.publish !== false ? `, at ${this.originOf(handle)}` : ""}`);
+        return { handle, identity, url: this.originOf(handle) };
+    }
+    /**
+     * The instance manager's work (#90; providers.ts `manager`): a message from
+     * the host skein in box `create`, `start` or `stop` → the answer body. A
+     * refusal throws (the provider answers {error}).
+     */
+    async manage(box, b) {
+        const handle = typeof b.handle === "string" ? b.handle : "";
+        if (box === "create") {
+            // #162: on a one-key host with no claim forwarded, the owner is the host's own key (named or not).
+            const shared = this.o.claimer && b.claim == null ? (await this.o.claimer.getPublicKey({ identityKey: true })).publicKey : undefined;
+            const owner = b.owner instanceof Uint8Array ? Buffer.from(b.owner).toString("hex") : typeof b.owner === "string" ? b.owner : shared ?? "";
+            if (b.image != null && typeof b.image !== "string")
+                throw new Error("image: the image's name (text)");
+            if (b.domain != null && typeof b.domain !== "string")
+                throw new Error("domain: a host name (text)");
+            // #162: `config` — the new instance's app config at birth, by app name (as an install's --config), any image's.
+            if (b.config != null && (typeof b.config !== "object" || Array.isArray(b.config) || b.config instanceof Uint8Array || Object.values(b.config).some((x) => !x || typeof x !== "object" || Array.isArray(x))))
+                throw new Error("config: the apps' config at birth, {<app>: {…}}");
+            // #127: a skein from the default image comes with its owner's signed claim (the registrant's, forwarded); #162: a one-key host's own.
+            // skein-amm#4: `beef` — an Atomic BEEF (the token's deploy) handed into the new instance once it is up.
+            if (b.beef != null && !(b.beef instanceof Uint8Array))
+                throw new Error("beef: an Atomic BEEF (bytes)");
+            const topics = topicsArg(b.topics);
+            const c = await this.createInstance(handle, owner, { image: b.image ?? undefined, ...(typeof b.domain === "string" ? { domain: b.domain } : {}), ...(b.claim != null ? { claim: b.claim } : {}), ...(b.config != null ? { appConfig: b.config } : {}), ...(topics ? { topics } : {}), needsClaim: true });
+            const answer = { handle: c.handle, identity: keyBytes(c.identity), url: c.url };
+            if (b.beef instanceof Uint8Array)
+                answer.delivered = await this.deliverBeef(c.handle, b.beef);
+            return answer;
+        }
+        if (box !== "start" && box !== "stop")
+            throw new Error(`the instance manager takes create, start and stop: not ${box}`);
+        const row = this.o.db.get(handle);
+        if (!row)
+            throw new Error(`no instance ${handle}`);
+        if (row.handle === this.o.db.hostSkein()?.handle)
+            throw new Error(`${handle} is the host skein: it is not started or stopped by a message from itself`);
+        if (box === "start") {
+            // #137: `topics` replaces the names the row is routed by; absent keeps them.
+            const topics = topicsArg(b.topics);
+            if (topics)
+                this.o.db.setTopics(handle, topics);
+            this.o.db.setStatus(handle, "enabled");
+            await this.hydrate(handle);
+            await this.refollowHeaders(handle);
+            this.say("router", `${handle}: started by the instance manager`);
+            return { handle, started: true, url: this.originOf(handle) };
+        }
+        this.o.db.setStatus(handle, "disabled");
+        await this.refollowHeaders(handle);
+        const l = this.loaded.get(handle);
+        if (l) {
+            this.loaded.delete(handle);
+            await l.kernel.stop();
+        }
+        // skein-amm#4: off its libp2p node too (as reclaim), so a stopped instance's beacons stop beating; a start's hydrate declares it again.
+        await this.p2p?.declare(handle, undefined).catch(() => { });
+        this.events.drop(handle);
+        this.say("router", `${handle}: stopped by the instance manager`);
+        return { handle, stopped: true };
+    }
+    /**
+     * A create's `beef` (skein-amm#4): the Atomic BEEF handed into the new instance's receive row
+     * (/skein/overlay/beef/1.0.0) exactly as a catch-up's fetched BEEF is (sync.ts `deliver`), from the
+     * host's own peer, and the answer → {verdict, reason?}. No topic is named here: the instance's engine
+     * judges it under the topics its config declares. Turned away at the door (unmined, a bad BUMP): reported,
+     * not retried; the instance stays created.
+     */
+    async deliverBeef(handle, beef) {
+        let from = new Uint8Array();
+        try {
+            if (this.p2p)
+                from = peerIdFromString(this.p2p.peerId(handle)).toMultihash().bytes;
+        }
+        catch { /* no peer: the record names none */ }
+        // The door checks the BUMPs against chain/state: the host chain's event (#156, sent at the start, not awaited there) taken first.
+        await this.chainBirth(handle).catch(() => { });
+        const l = this.loaded.get(handle);
+        if (l) {
+            await this.queues.get(handle);
+            await l.kernel.idle().catch(() => { });
+        }
+        try {
+            const r = await this.p2pInbound(handle, { transport: "libp2p", protocol: BEEF_PROTOCOL, from, body: beef });
+            this.say("router", `${handle}: the create's BEEF delivered: ${r.verdict}${r.reason ? ` (${r.reason})` : ""}`);
+            return { verdict: r.verdict, ...(r.reason ? { reason: r.reason } : {}) };
+        }
+        catch (e) {
+            const reason = e.message;
+            this.say("router", `${handle}: the create's BEEF not delivered: ${reason}`);
+            return { verdict: "ignore", reason };
+        }
+    }
+    /** What this host brings to a new instance's genesis (boot.ts): the owner and its messagebox, the inference peer, their names, the host's defaults. */
+    genesisConfig(row, identity, code = true) {
+        if (row.kind === "mailbox") {
+            if (!row.owner)
+                throw new Error(`${row.handle}: a mailbox instance names its owner`);
+            return { identity, root: [row.owner], handle: row.handle, domain: row.domain, mailbox: true, network: this.o.network };
+        }
+        if (!this.o.owner)
+            throw new Error("an empty store needs the owner's identity key (SKEIN_OWNER) for its genesis");
+        const genesisDefaults = this.o.genesis?.defaults;
+        const hostDefaults = { ...genesisDefaults, ...(this.o.fuelPerStep ? { fuelPerStep: this.o.fuelPerStep } : {}) };
+        const warn = (l) => this.say(row.handle, l);
+        const facts = { ownerMessagebox: this.ownerMessagebox(), resolveOrigin: this.origin(), addressBook: this.addressSeed(row.handle), providers: Object.fromEntries(this.addressSeed(row.handle).filter((e) => e.transport === "local").map((e) => [e.address, Buffer.from(e.key).toString("hex")])) };
+        if (!code) {
+            // A system tree: its config wins; the host fills what it leaves unset. SKEIN_FUEL_PER_STEP stays an explicit (dev) override.
+            return {
+                identity, root: [this.o.owner], handle: row.handle, domain: row.domain, infer: this.o.infer, ownerHandle: this.o.ownerHandle, inferHandle: this.o.inferHandle,
+                feeds: this.o.genesis?.feeds, defaults: genesisDefaults, overrides: this.o.fuelPerStep ? { fuelPerStep: this.o.fuelPerStep } : undefined, warn, network: this.o.network, ...facts,
+            };
+        }
+        return {
+            identity, root: [this.o.owner], handle: row.handle, domain: row.domain, infer: this.o.infer, ownerHandle: this.o.ownerHandle, inferHandle: this.o.inferHandle,
+            // Code genesis takes DEFAULTS under the host's.
+            defaults: Object.keys(hostDefaults).length ? { ...DEFAULTS, ...hostDefaults } : undefined,
+            subscriptions: this.o.genesis?.subscriptions,
+            feeds: this.o.genesis?.feeds,
+            libp2p: this.o.genesis?.libp2p, dispatch: this.o.genesis?.dispatch,
+            network: this.o.network, ...facts,
+        };
+    }
+    /**
+     * The kernel counts as busy until it has processed what was just admitted
+     * (its `idle` answers after the drain); then the libp2p node and the host's
+     * headers feed follow the dispatch table (#72, #77, #102).
+     */
+    settle(l) {
+        const p = l.kernel.idle().then(() => this.syncDispatch(l)).then(() => this.syncBilling(l)).catch((e) => this.say(l.row.handle, `the dispatch table not followed: ${e.message}`));
+        this.syncing.add(p);
+        void p.finally(() => this.syncing.delete(p));
+    }
+    /**
+     * What the host does by the instance's dispatch table (#72, #77, #102):
+     * read the table (the kernel's `dispatch` frame); when its chain's tip
+     * moved since it was last followed (or `first`), the host's headers feed
+     * subscribes or unsubscribes it (followHeaders), and its libp2p node is
+     * declared again as its genesis and the table ask (p2p.ts libp2pConfig) —
+     * started, reconfigured (topics subscribed and unsubscribed, protocols
+     * handled and unhandled) or stopped. A failure is logged, not fatal.
+     */
+    async syncDispatch(l, first = false) {
+        if ((!this.p2p && !this.o.headersFeed && !this.events.open(l.row.handle)) || l.kernel.gone)
+            return;
+        const d = await l.kernel.dispatch().catch((e) => { this.say(l.row.handle, `the dispatch table not read: ${e.message}`); return undefined; });
+        if (d === undefined)
+            return;
+        const key = d.tip ? d.tip.toString() : "";
+        if (!first && key === (l.dispatchTip ?? ""))
+            return;
+        l.dispatchTip = key;
+        l.rows = d.rows;
+        this.followHeaders(l.row.handle, d.rows);
+        // #148: an uninstalled app's event streams close.
+        if (this.events.open(l.row.handle))
+            this.events.keep(l.row.handle, appsOf(d.rows));
+        // #126: an uninstalled app's beacons stop — an app with no row left in the table (an uninstall
+        // removes every row naming the app and leaves its heads).
+        if (l.beacons.length || l.live.length) {
+            const apps = appsOf(d.rows);
+            l.beacons = l.beacons.filter((b) => apps.has(b.app));
+            l.live = l.live.filter((x) => apps.has(x.app)); // #138: and its liveness
+        }
+        await this.declareP2P(l, first);
+    }
+    /** The instance's libp2p node declared as its genesis, its table and its apps' subscriptions (#119) ask. */
+    async declareP2P(l, first = false) {
+        if (!this.p2p)
+            return;
+        const rows = (l.rows ?? []);
+        await this.p2p.declare(l.row.handle, libp2pConfig(l.genesis, rows, subscribedTopics(l.subs), l.beacons.length > 0 || l.live.length > 0)).catch((e) => this.say(l.row.handle, `libp2p: ${first ? "not started" : "not reconfigured"}: ${e.message}`));
+        this.p2p.beacons(l.row.handle, l.beacons);
+        this.p2p.liveness(l.row.handle, l.live);
+    }
+    /** #138: the apps' liveness, folded from the instance's log (liveness.ts livenessOf), the store file read-only. */
+    async readLiveness(store) {
+        if (!this.p2p || !storeExists(store))
+            return [];
+        const s = openStoreFile(store, { readOnly: true });
+        try {
+            return await livenessOf(s);
+        }
+        finally {
+            s.close();
+        }
+    }
+    /** #126: the apps' beacons, folded from the instance's log (p2p.ts beaconsOf), the store file read-only. */
+    async foldBeacons(store) {
+        if (!this.p2p || !storeExists(store))
+            return [];
+        const s = openStoreFile(store, { readOnly: true });
+        try {
+            return await beaconsOf(s);
+        }
+        finally {
+            s.close();
+        }
+    }
+    /**
+     * #119: the apps' subscriptions, folded from the instance's log — the
+     * libp2p node's recovery at hydrate, by reading (p2p.ts subscriptionsOf;
+     * the store file opened read-only beside the kernel, as `subscribes` reads it).
+     */
+    async foldSubscriptions(store) {
+        if (!this.p2p || !storeExists(store))
+            return [];
+        const s = openStoreFile(store, { readOnly: true });
+        try {
+            return await subscriptionsOf(s);
+        }
+        finally {
+            s.close();
+        }
+    }
+    /**
+     * A `subscribe` / `unsubscribe` event from `handle` (#119, after its step's
+     * commit; the kernel checked it as it was emitted): the subscriptions
+     * change and the node is declared again — the topic subscribed, or left
+     * when no subscription, row or genesis topic takes it any more. Which app's
+     * program runs for a message on it is the kernel's (the subscription). An
+     * instance still loading reads the event from its log at hydrate; it is
+     * applied after that too (the same result).
+     */
+    topicEvent(handle, rec) {
+        if (rec.event === "beacon" || rec.event === "unbeacon")
+            return this.beaconEvent(handle, rec);
+        // An overlay before skein-overlay 0.20.0 emits want / unwant: nothing asks for them any more (the settled sync design).
+        if (rec.event === "want" || rec.event === "unwant")
+            return;
+        if (rec.event === "liveness" || rec.event === "unliveness")
+            return this.livenessEvent(handle, rec);
+        const e = subscriptionEvent(rec);
+        if ("refused" in e) {
+            this.say(handle, `libp2p: ${String(rec.event)}: ${e.refused}`);
+            return;
+        }
+        const topic = e.event === "subscribe" ? e.sub.topic : e.topic;
+        const app = e.event === "subscribe" ? e.sub.app : e.app;
+        const apply = async () => {
+            const l = this.loaded.get(handle) ?? await this.loading.get(handle)?.catch(() => undefined);
+            if (!l || l.kernel.gone)
+                return;
+            foldSubscriptions([e], l.subs);
+            this.say(handle, `libp2p: ${e.event} ${topic} (app ${app}${e.event === "subscribe" ? ` → ${e.sub.program}.${e.sub.fn}` : ""})`);
+            await this.declareP2P(l);
+        };
+        const p = apply().catch((x) => this.say(handle, `libp2p: ${e.event} ${topic}: ${x.message}`));
+        this.syncing.add(p);
+        void p.finally(() => this.syncing.delete(p));
+    }
+    /**
+     * A `liveness` / `unliveness` event from `handle` (#138, after its step's commit; the kernel
+     * checked its shape as it was emitted): the liveness changes and the node's liveness tool follows
+     * it (P2PHost.liveness) — the topic subscribed without admitting its messages, or left. An instance
+     * still loading reads it from its log.
+     */
+    livenessEvent(handle, rec) {
+        const e = livenessEvent(rec);
+        if ("refused" in e) {
+            this.say(handle, `libp2p: ${String(rec.event)}: ${e.refused}`);
+            return;
+        }
+        const apply = async () => {
+            const l = this.loaded.get(handle) ?? await this.loading.get(handle)?.catch(() => undefined);
+            if (!l || l.kernel.gone)
+                return;
+            foldLiveness([e], l.live);
+            await this.declareP2P(l);
+        };
+        const p = apply().catch((x) => this.say(handle, `libp2p: ${e.event}: ${x.message}`));
+        this.syncing.add(p);
+        void p.finally(() => this.syncing.delete(p));
+    }
+    /**
+     * GET /<app>/.live/<topic> at an instance's origin (#138): the liveness tool's set for the app's
+     * liveness on the topic, served by the host — no program, no entry, nothing logged; metered as a
+     * read (bytes served). 404 when the app keeps no liveness for the topic (or the host has no libp2p).
+     */
+    async liveRead(handle, route, app, topic) {
+        const none = () => json(404, { status: "error", code: "ERR_NOT_FOUND", description: `app ${app} keeps no liveness for ${topic}` });
+        if (!this.p2p)
+            return none();
+        try {
+            await this.hydrate(handle);
+        }
+        catch (e) {
+            return json(503, { status: "error", code: "ERR_UNAVAILABLE", description: e.message });
+        }
+        const closed = this.closed(handle);
+        if (closed)
+            return json(402, { status: "error", code: "ERR_PAYMENT_REQUIRED", description: closed });
+        const beats = this.p2p.live.read(handle, app, topic);
+        if (!beats)
+            return none();
+        const r = json(200, beats.map((b) => ({ sender: b.sender, at: b.at, body: Buffer.from(b.body).toString("base64"), from: b.from })));
+        this.meter(handle, { at: stampMs(this.now()), op: `GET ${route}`, fuel: 0, bytes: r.body.length });
+        return r;
+    }
+    /**
+     * GET /<app>/.events at an instance's origin (#148, events.ts): the app's emitted events of the
+     * asked name and topics as a Server-Sent Events stream — the backlog folded from the log, then each
+     * as it is handed over — held open until the client goes, the app is uninstalled or the instance
+     * stops. The host's own (no program, no entry, nothing logged); each message metered as a read.
+     */
+    async eventStream(handle, route, app, url, req, res, cors) {
+        const answer = (r) => { if (!res.headersSent) {
+            res.writeHead(r.status, { ...cors, ...r.headers, "content-length": String(r.body.length) });
+            res.end(r.body);
+        } };
+        try {
+            const last = req.headers["last-event-id"];
+            const q = eventsQuery(app, url.searchParams, Array.isArray(last) ? last[0] : last);
+            if ("problem" in q)
+                return answer(json(400, { status: "error", code: "ERR_BAD_REQUEST", description: q.problem }));
+            if (this.stopped)
+                return answer(json(503, { status: "error", code: "ERR_UNAVAILABLE", description: "the host is shutting down" }));
+            let l;
+            try {
+                l = await this.hydrate(handle);
+            }
+            catch (e) {
+                return answer(json(503, { status: "error", code: "ERR_UNAVAILABLE", description: e.message }));
+            }
+            const closed = this.closed(handle);
+            if (closed)
+                return answer(json(402, { status: "error", code: "ERR_PAYMENT_REQUIRED", description: closed }));
+            if (!appsOf((await l.kernel.dispatch()).rows).has(app))
+                return answer(json(404, { status: "error", code: "ERR_NOT_FOUND", description: `no app ${app} installed here` }));
+            res.writeHead(200, { ...cors, "content-type": "text/event-stream", "cache-control": "no-cache", connection: "keep-alive" });
+            res.flushHeaders();
+            let forget;
+            let gone = false;
+            res.on("close", () => { gone = true; forget?.(); });
+            const send = (d) => {
+                const m = sseMessage(d);
+                res.write(m);
+                this.meter(handle, { at: stampMs(this.now()), op: `GET ${route}`, fuel: 0, bytes: Buffer.byteLength(m) });
+            };
+            forget = await this.events.subscribe(handle, q, send, () => res.end());
+            if (gone)
+                forget();
+        }
+        catch (e) {
+            this.say(handle, `events: ${e.message}`);
+            if (res.headersSent)
+                res.end();
+            else
+                answer(json(500, { status: "error", code: "ERR_INTERNAL", description: e.message }));
+        }
+    }
+    /** How long a peer that beat on a topic is remembered without beating again (ms): 30 days (David to review). */
+    static PEER_KEEP_MS = 30 * 86_400_000;
+    /**
+     * A beat kept from `peer` on `liveTopic` at `handle` (the settled sync design): when an overlay app
+     * of the instance beats on that topic, the peer and its addresses (the node's peer store) upserted
+     * into host.db `topic_peers`, keyed by the overlay topic. What a restart asks first.
+     */
+    async rememberPeer(handle, liveTopic, peer) {
+        if (!liveTopic.endsWith("-live") || !this.p2p)
+            return;
+        if (!this.loaded.get(handle)?.beacons.some((b) => b.topic === liveTopic))
+            return;
+        try {
+            this.o.db.seenPeer(handle, liveTopic.slice(0, -"-live".length), peer, await this.p2p.peerAddrs(handle, peer), stampMs(this.now()));
+        }
+        catch (e) {
+            this.say(handle, `sync: peer ${peer} not remembered: ${e.message}`);
+        }
+    }
+    /**
+     * At a start (hydrate): for each overlay topic the instance beats on, the peers host.db remembers
+     * (rows older than PEER_KEEP_MS pruned first) dialled, a few at a time, failures dropped silently;
+     * each that answers asked at once — the locator and the tail (sync.ts `reconnect`) — without waiting
+     * for a beat.
+     */
+    async askKnownPeers(l) {
+        const handle = l.row.handle;
+        if (!this.p2p || !this.sync)
+            return;
+        this.o.db.prunePeers(stampMs(this.now()) - Router.PEER_KEEP_MS);
+        const jobs = [];
+        for (const b of l.beacons) {
+            if (!b.topic.endsWith("-live"))
+                continue;
+            const topic = b.topic.slice(0, -"-live".length);
+            for (const r of this.o.db.topicPeers(handle, topic))
+                if (r.peer !== this.p2p.peerId(handle))
+                    jobs.push({ app: b.app, topic, peer: r.peer, addrs: r.addrs });
+        }
+        const p2p = this.p2p, sync = this.sync;
+        const one = async (j) => {
+            try {
+                await p2p.connect(handle, j.peer, j.addrs);
+            }
+            catch {
+                return;
+            } // a peer gone: dropped silently
+            sync.reconnect(handle, j.app, j.topic, j.peer);
+        };
+        for (let i = 0; i < jobs.length; i += 4)
+            await Promise.all(jobs.slice(i, i + 4).map(one));
+    }
+    /**
+     * shruggr/skein#154: our own overlay's read, for the sync's puller (its locator and what it lacks) —
+     * the engine's function `fn` (`anchors`, `admitted`) by a kernel call (the `call` op; nothing
+     * appended, nothing logged), not through the app's http table, which an app need not publish. The
+     * program is the app record's engine (its role `overlay`); the argument is what a read route's
+     * filter is handed (docs/APPS.md "Filters": the route handler contract's fields), `match` naming the
+     * app, so the engine reads its configuration from the app record as it does for its read routes.
+     * Its answer is the read route's `{status, type, body}`: the body's JSON, or a throw on another status.
+     */
+    async overlayRead(handle, app, fn, query) {
+        const l = await this.hydrate(handle);
+        const root = await l.kernel.call("head", appHead(app));
+        if (!root)
+            throw new Error(`${app}: no app record`);
+        const engine = (await l.kernel.store.get(root)).programs?.[OVERLAY_ROLE];
+        if (!(engine instanceof CID))
+            throw new Error(`${app}: its app record has no engine (role ${OVERLAY_ROLE})`);
+        const qs = new URLSearchParams(query).toString();
+        const route = `/${app}/${fn}`;
+        const http = { method: "GET", path: route, route, query: qs ? `?${qs}` : "", headers: {}, body: new Uint8Array() };
+        const arg = { transport: "http", request: { kind: "http", ...http }, match: { transport: "http", address: route, app }, ...http, contentType: "" };
+        const c = await l.kernel.invoke(engine, fn, dagCbor.encode(arg), { now: stampMs(this.now()) });
+        if (!c.ok)
+            throw new Error(`${app}.${fn}: ${c.error}`);
+        const a = dagCbor.decode(c.result);
+        const text = a.body instanceof Uint8Array ? Buffer.from(a.body).toString("utf8") : "";
+        if (a.status !== 200)
+            throw new Error(`${app}.${fn}: ${a.status} ${text.slice(0, 200)}`);
+        return JSON.parse(text);
+    }
+    /**
+     * A `beacon` / `unbeacon` event from `handle` (#126, after its step's commit;
+     * the kernel checked its shape as it was emitted): the beacons change and
+     * the node beats them (P2PHost.beacons) — started if a beacon needs it; the
+     * topic is not subscribed. An instance still loading reads it from its log.
+     */
+    beaconEvent(handle, rec) {
+        const e = beaconEvent(rec);
+        if ("refused" in e) {
+            this.say(handle, `libp2p: ${String(rec.event)}: ${e.refused}`);
+            return;
+        }
+        const apply = async () => {
+            const l = this.loaded.get(handle) ?? await this.loading.get(handle)?.catch(() => undefined);
+            if (!l || l.kernel.gone)
+                return;
+            foldBeacons([e], l.beacons);
+            await this.declareP2P(l);
+        };
+        const p = apply().catch((x) => this.say(handle, `libp2p: ${e.event}: ${x.message}`));
+        this.syncing.add(p);
+        void p.finally(() => this.syncing.delete(p));
+    }
+    /**
+     * The host's headers feed (#102) for an instance whose dispatch table is
+     * `rows`: subscribed (box `chain`) while it is enabled and a row takes
+     * events in box `chain` by name (the chain app's `event` row; dispatch.zig
+     * forEvent) — a catch-all `*` row (a mailbox instance's) is not one —
+     * else not. One line when that changes.
+     */
+    followHeaders(handle, rows) {
+        const url = this.o.headersFeed;
+        if (!url)
+            return;
+        const want = this.o.db.get(handle)?.status === "enabled" && rows.some((r) => r.address === DEFAULT_BOX && takesEvent(r, DEFAULT_BOX));
+        if (want === this.feeds.hosts(handle))
+            return;
+        // #141: on subscribing, the headers it lacks first — from its tip (its chain state's, else its image's) to the host's.
+        const backfill = async () => {
+            const row = this.o.db.get(handle);
+            if (!row || !storeExists(storeSpec(row)))
+                return [];
+            const s = openStoreFile(storeSpec(row), { readOnly: true });
+            let tip;
+            try {
+                tip = await skeinTip(s);
+            }
+            finally {
+                s.close();
+            }
+            return await this.image.after(tip);
+        };
+        void this.feeds.host(handle, want ? { kind: "headers", url, box: DEFAULT_BOX } : undefined, want ? backfill : undefined);
+        this.say("router", `${handle}: ${want ? "subscribed to" : "unsubscribed from"} the host's headers feed ${url}`);
+        // #156: an app that takes box `chain` installed into a running instance: the host chain as it stands, now.
+        if (want)
+            void this.chainBirth(handle).catch((e) => this.say(handle, `host chain: the install event not sent: ${e.message}`));
+    }
+    /** Follow the host's headers feed for an instance whose status changed (#102): its table read again. */
+    async refollowHeaders(handle) {
+        if (!this.o.headersFeed)
+            return;
+        const l = this.loaded.get(handle);
+        const d = l && !l.kernel.gone ? await l.kernel.dispatch().catch((e) => { this.say(handle, `the dispatch table not read: ${e.message}`); return undefined; }) : undefined;
+        this.followHeaders(handle, d?.rows ?? []);
+    }
+    /**
+     * The waker answers every wake-me due by this router's clock, and the cron
+     * provider sends every tick due (#69) — what their timers do in real time,
+     * for a clock that is not (a script clock: tests, the corpus).
+     */
+    async wake() {
+        this.providers.wakeDue();
+        await this.cron.tick();
+        await this.providers.idle();
+    }
+    /** An instance's next wake (ms), if any (the host page): the waker's earliest, or its next tick (#69). */
+    nextWake(handle) {
+        const xs = [this.providers.nextWake(handle), ...this.cron.of(handle).map((s) => s.next)].filter((x) => x !== undefined);
+        return xs.length ? Math.min(...xs) : undefined;
+    }
+    /** Stop kernels idle for `ms` with nothing queued. Their deadlines and sleeps stay with the waker, their schedules with the cron provider. */
+    async reap(ms) {
+        for (const [handle, l] of this.loaded) {
+            if (l.kernel.busy > 0 || this.queues.has(handle) || Date.now() - l.kernel.last < ms)
+                continue;
+            this.loaded.delete(handle);
+            this.say("router", `${handle}: idle, stopped`);
+            await l.kernel.stop();
+        }
+    }
+    // ---------------------------------------------------------------- the fuel ledger
+    charge(instance, caller, op, fuel) {
+        const k = `${instance}\0${caller}\0${op}`;
+        const x = this.owed.get(k) ?? { calls: 0, fuel: 0 };
+        x.calls += 1;
+        x.fuel += fuel;
+        this.owed.set(k, x);
+    }
+    /** Write what calls cost since the last flush (host.db, never the log). */
+    flushLedger() {
+        if (!this.owed.size)
+            return;
+        const rows = [...this.owed].map(([k, v]) => { const [instance, caller, op] = k.split("\0"); return { instance, caller, op, ...v }; });
+        this.owed.clear();
+        try {
+            this.o.db.charge(rows);
+        }
+        catch (e) {
+            this.say("router", `ledger: ${e.message}`);
+        }
+    }
+    // ---------------------------------------------------------------- billing (#130, billing.ts)
+    /** Why this host forwards nothing to `handle` (undefined: it forwards as usual). */
+    closed(handle) {
+        return closedBy(this.views.get(handle));
+    }
+    /** A billed instance as this host last read it (#130). */
+    billingView(handle) { return this.views.get(handle); }
+    /** A line of this host's log for `handle`'s period (#130): a request it served, a read call it made. */
+    meter(handle, line) {
+        if (!this.o.billing || !this.views.get(handle)?.terms)
+            return;
+        let p = this.periods.get(handle);
+        if (!p)
+            this.periods.set(handle, (p = new Period(line.at)));
+        p.add(line);
+    }
+    /**
+     * Read the instance's billing (#130): its host row's terms (the dispatch table) and its kernel's
+     * billing state (the head `billing`), checked against what this host supports. A skein with a host
+     * row this host has not ticked yet is ticked now; one whose unreported amounts would take its tally
+     * to its allocation, early. When it went asleep (and woke) goes to host.db (the grace).
+     */
+    async syncBilling(l) {
+        const cfg = this.o.billing;
+        if (!cfg || l.kernel.gone)
+            return;
+        const handle = l.row.handle;
+        // The table as syncDispatch just read it (it follows the table when the host has libp2p or a headers feed), else read now.
+        const rows = (this.p2p || this.o.headersFeed) && l.rows ? l.rows : (await l.kernel.dispatch()).rows;
+        const terms = termsOf(rows);
+        if (!terms) {
+            if (this.views.has(handle)) {
+                this.views.delete(handle);
+                this.o.db.forgetBilling(handle);
+                this.say(handle, "billing: no host row: not billed");
+            }
+            return;
+        }
+        const root = await l.kernel.call("head", BILLING_HEAD);
+        const state = root ? stateOf(await l.kernel.store.get(root)) : undefined;
+        const why = mismatch(cfg, this.providers.key("billing"), terms);
+        const was = this.views.get(handle);
+        const view = { terms, ...(state ? { state } : {}), ...(why ? { mismatch: why } : {}) };
+        this.views.set(handle, view);
+        const mine = state && state.host === terms.host ? state : undefined;
+        this.o.db.setBilling(handle, { host: terms.host, ...(mine ? { tally: mine.tally, allocation: allocation(mine) } : {}), asleep: !!mine?.asleep, ...(why ? { mismatch: why } : {}) }, stampMs(this.now()));
+        const closed = closedBy(view);
+        if (closed !== closedBy(was))
+            this.say(handle, closed ? `billing: closed — ${closed}` : "billing: open");
+        if (why || mine?.asleep)
+            return;
+        if (mine)
+            this.firstTicks.delete(handle);
+        else if (this.firstTicks.has(handle))
+            return; // sent: the timer sends it again
+        else
+            this.firstTicks.add(handle);
+        const p = this.periods.get(handle);
+        const owed = p ? priceHost(terms.rates, p.fuel, p.served) : 0n;
+        if (!mine || (p && !p.empty && mine.tally + owed >= allocation(mine)))
+            void this.billingTick(handle).catch((e) => this.say(handle, `billing: tick: ${e.message}`));
+    }
+    /** Tick every billed instance this router holds (the timer, every tickMs). */
+    async tickAll() {
+        for (const [handle, l] of this.loaded) {
+            if (l.kernel.gone || !this.views.get(handle)?.terms)
+                continue;
+            await this.billingTick(handle).catch((e) => this.say(handle, `billing: tick: ${e.message}`));
+        }
+    }
+    /**
+     * The host's tick to `handle` (#130 decided 4): signed by its billing key, in the host row's box —
+     * {kind: "tick", at, allowance, fuel, served, log} — the period since its last tick closed, its log
+     * record kept (host.db billing_ticks: `log` is that record's CID). Not to an instance the gate
+     * holds (asleep, other terms), nor twice at once. The tick's entry, or undefined.
+     */
+    async billingTick(handle) {
+        const cfg = this.o.billing;
+        const v = this.views.get(handle);
+        if (!cfg || !v?.terms || this.closed(handle) || this.ticking.has(handle))
+            return undefined;
+        const l = this.loaded.get(handle);
+        if (!l || l.kernel.gone)
+            return undefined;
+        this.ticking.add(handle);
+        try {
+            const at = stampMs(this.now());
+            const p = this.periods.get(handle) ?? new Period(at);
+            this.periods.set(handle, new Period(at));
+            const log = periodRecord(l.identity, p, at);
+            this.o.db.billingTick(handle, at, log.cid.toString(), log.bytes);
+            return await this.providers.send(handle, "billing", keyBytes(l.identity), v.terms.address, tickBody(at, cfg, p, log.cid));
+        }
+        finally {
+            this.ticking.delete(handle);
+        }
+    }
+    /**
+     * A `payment` event from `handle` (#130 decided 6: its pay step's, the kernel lets no other step
+     * emit one): this host is the payee. Its wiring: the payment kept (host.db billing_payments, with
+     * whether its output pays the key the BRC-29 remittance derives from this host's billing key) and
+     * broadcast (its Arcade, once).
+     */
+    payment(handle, rec) {
+        const p = (async () => {
+            const beef = rec.tx instanceof Uint8Array ? rec.tx : undefined;
+            const amount = typeof rec.amount === "number" ? rec.amount : undefined;
+            const vout = typeof rec.outputIndex === "number" ? rec.outputIndex : undefined;
+            const rem = rec.remittance;
+            if (!beef || amount === undefined || vout === undefined || !rem) {
+                this.say(handle, "billing: a payment event without its transaction, amount or remittance: ignored");
+                return;
+            }
+            const tx = Transaction.fromAtomicBEEF([...beef]);
+            let ours = false;
+            try {
+                const key = new KeyDeriver(this.providerKey("billing")).derivePrivateKey([2, "3241645161d8"], `${rem.derivationPrefix} ${rem.derivationSuffix}`, String(rem.senderIdentityKey));
+                const out = tx.outputs[vout];
+                ours = !!out && out.satoshis === amount && out.lockingScript.toHex() === new P2PKH().lock(key.toPublicKey().toHash()).toHex();
+            }
+            catch { /* a remittance that derives nothing: kept, not ours */ }
+            const checkpoint = CID.asCID(rec.checkpoint)?.toString();
+            const txid = tx.id("hex");
+            const fresh = this.o.db.billingPayment({ instance: handle, txid, amount, at: stampMs(this.now()), beef, remittance: rem, ours, ...(checkpoint ? { checkpoint } : {}) });
+            if (fresh && this.arc)
+                this.arc.enqueue(handle, Uint8Array.from(tx.toBinary()), beef);
+            this.say(handle, `billing: payment ${txid.slice(0, 8)}… ${amount} sats${ours ? "" : " (its output does not pay this host's derived key)"}${checkpoint ? `, checkpoint ${checkpoint.slice(-8)}` : ""}`);
+        })().catch((e) => this.say(handle, `billing: payment: ${e.message}`));
+        this.syncing.add(p);
+        void p.finally(() => this.syncing.delete(p));
+    }
+    /**
+     * Reclaim an instance (#130 decided 9; `skein-host reclaim`): its kernel stopped, its row and its
+     * billing removed, its store deleted. The host's call to make, after the grace; nothing here makes
+     * it on its own. Not the host skein.
+     */
+    async reclaim(handle) {
+        const row = this.o.db.get(handle);
+        if (!row)
+            throw new Error(`no instance ${handle}`);
+        if (row.handle === this.o.db.hostSkein()?.handle)
+            throw new Error(`${handle} is the host skein`);
+        this.o.db.setStatus(handle, "disabled");
+        await this.refollowHeaders(handle);
+        const l = this.loaded.get(handle);
+        if (l) {
+            this.loaded.delete(handle);
+            await l.kernel.stop();
+        }
+        await this.p2p?.declare(handle, undefined).catch(() => { });
+        this.events.drop(handle);
+        this.cron.forget(handle);
+        this.views.delete(handle);
+        this.periods.delete(handle);
+        this.o.db.forgetBilling(handle);
+        this.o.db.remove(handle);
+        if (isSet(row.store)) {
+            // #96, #158: the host never writes an LMDB environment or a RocksDB database; the set stays in it (its handle cannot be created again here).
+            this.say("router", `${handle}: reclaimed (its set in ${row.store} left in place: the host writes no instance store)`);
+            return;
+        }
+        await removeStore(row.store);
+        this.say("router", `${handle}: reclaimed (its store ${row.store} deleted)`);
+    }
+    // ---------------------------------------------------------------- HTTP
+    /** Whether a URL is this host's own (answered in process: no DNS, no socket). */
+    isLocal(url) {
+        let u;
+        try {
+            u = new URL(url);
+        }
+        catch {
+            return false;
+        } // a URL that does not parse is not this host's (the caller's fetch reports it)
+        if (!this.port)
+            return false;
+        const mine = (o) => { try {
+            return new URL(o).host === u.host;
+        }
+        catch {
+            return false;
+        } }; // an origin setting that is no URL matches nothing
+        if (mine(this.origin()))
+            return true;
+        const port = u.port || (u.protocol === "https:" ? "443" : "80");
+        if (port !== String(this.port))
+            return false;
+        const h = u.hostname.toLowerCase();
+        return h === "127.0.0.1" || h === "localhost" || h === "[::1]" || h === "::1" || h.endsWith(".localhost");
+    }
+    /** Which instance a URL is for: `/@<handle>` (stripped for the routes), or a `<handle>.` host name. */
+    target(url) {
+        const enabled = (h) => this.o.db.get(h)?.status === "enabled";
+        const m = /^\/@([^/]+)(\/.*)?$/.exec(url.pathname);
+        if (m) {
+            const h = decodeURIComponent(m[1]);
+            return enabled(h) ? { handle: h, route: m[2] ?? "/" } : undefined;
+        }
+        const name = url.hostname.toLowerCase();
+        const label = name.includes(".") ? name.split(".")[0] : "";
+        if (label && HANDLE.test(label) && (label !== this.ownLabel() || this.ownLabelInstance(label)) && enabled(label))
+            return { handle: label, route: url.pathname }; // #161: a path-only handle never by hostname
+        return undefined;
+    }
+    /**
+     * The HTTP proxy's request (#70, the `fetch` provider): this host's own URLs in
+     * process, the rest as configured. A delivery (`POST …/sendMessage`, from
+     * instance `from`) is logged in one line: where it went, how, and the result.
+     */
+    async http(req, from) {
+        const local = this.isLocal(req.url);
+        const delivery = req.method === "POST" && /\/sendMessage$/.test(new URL(req.url, "http://x").pathname);
+        const said = (what) => { if (delivery)
+            this.say(from ?? "router", `deliver${((d) => d ? ` ${d}` : "")(describeDelivery(req))} → ${req.url} (${local ? "local" : "remote"}): ${what}`); };
+        try {
+            let r;
+            if (local) {
+                const d = await this.dispatch({ method: req.method, url: req.url, headers: headerMap(req.headers ?? {}), body: req.body ?? new Uint8Array(), ...(from ? { from } : {}) });
+                r = { status: d.status, headers: d.headers, body: d.body };
+            }
+            else {
+                const f = this.o.http ?? (process.env.SKEIN_HTTP === "fetch" ? fetchHttp : undefined);
+                if (!f)
+                    throw new Error(`this host answers no http beyond its own (${req.url})`);
+                r = await f(req);
+            }
+            said(r.status === 200 ? "200 delivered" : `HTTP ${r.status} ${errorOf(r.body)}`.trimEnd());
+            return r;
+        }
+        catch (e) {
+            said(`failed: ${e.message}`);
+            throw e;
+        }
+    }
+    /** One request, whoever made it: a socket's, or an instance's own http. */
+    async dispatch(req) {
+        const url = new URL(req.url);
+        if (req.method === "GET" && url.pathname === "/.well-known/skein-host") {
+            // #130: the terms this host bills by — what an owner grants as the host row (`skein host`).
+            const b = this.o.billing;
+            const billing = b ? { key: this.providers.key("billing"), x: b.x, rates: b.rates, allowance: b.allowance, tickMs: b.tickMs, graceMs: b.graceMs } : undefined;
+            return json(200, { origin: this.origin(), domain: await this.handleDomain(), ...(billing ? { billing } : {}) });
+        }
+        const t = this.target(url);
+        // The router's own paths at its own hostname stay the router's when an instance takes that label (ownLabelInstance).
+        if (t && !/^\/@/.test(url.pathname) && this.ownLabelInstance(t.handle)) {
+            if (req.method === "GET" && url.pathname === "/skeins")
+                return await this.skeinsHeldBy(url.searchParams.get("key") ?? "");
+            if (url.pathname === `${ARC_ROUTE}/callback`)
+                return await this.arcRequest(req, url.pathname);
+        }
+        // #161: an overlay request routed by its topic goes to the token instance it names, at an instance's
+        // hostname too (one public name for the pages and the wallets' provider URL, 2026-10-28).
+        if (req.method === "POST" && (url.pathname === "/submit" || url.pathname === "/lookup") && (!t || t.route === url.pathname)) {
+            const o = this.overlayTarget(url.pathname, req);
+            if ("problem" in o)
+                return json(400, { status: "error", code: "ERR_BAD_REQUEST", description: o.problem });
+            if (o.handle)
+                return await this.held(this.forward(o.handle, url.pathname, url, req));
+        }
+        const serve = async (x) => {
+            // #138: the liveness tool's read, the host's own (no program).
+            const live = req.method === "GET" ? /^\/([^/]+)\/\.live\/([^/]+)$/.exec(x.route) : null;
+            if (live)
+                return await this.held(this.liveRead(x.handle, x.route, decodeURIComponent(live[1]), decodeURIComponent(live[2])));
+            // #148: a stream, served on a socket only (handler).
+            if (req.method === "GET" && EVENTS_ROUTE.test(x.route))
+                return json(400, { status: "error", code: "ERR_BAD_REQUEST", description: "an event stream (text/event-stream) is served on a connection of its own, not in process" });
+            return await this.held(this.forward(x.handle, x.route, url, req));
+        };
+        if (t)
+            return await serve(t);
+        const path = url.pathname;
+        if (req.method === "GET" && path === "/skeins")
+            return await this.skeinsHeldBy(url.searchParams.get("key") ?? "");
+        // #113: the host's own origin's BRC-169 requests are the host skein's (its onboarding app's routes).
+        const route = DISCOVERY[`${req.method} ${path}`] ?? (req.method === "GET" && path.startsWith(PAYMAIL_PREFIX) ? `/${ONBOARD_APP}${path}` : undefined);
+        if (route) {
+            const host = this.o.db.hostSkein();
+            if (host?.status === "enabled")
+                return await this.held(this.forward(host.handle, route, url, req));
+            const f = await this.o.discovery?.(req, url);
+            if (f)
+                return f;
+            return json(404, { status: "error", code: "ERR_NOT_FOUND", description: "this host has no host skein (skein-host init): no BRC-169 here" });
+        }
+        if (path === `${ARC_ROUTE}/callback`)
+            return await this.arcRequest(req, path);
+        // SKEIN_ROOT_INSTANCE: a hostname that is no instance's serves the root instance (the standalone's one app at localhost:<port>/),
+        // after the host's own paths above.
+        const root = this.o.rootInstance;
+        if (root && this.o.db.get(root)?.status === "enabled")
+            return await serve({ handle: root, route: path });
+        return json(404, { status: "error", code: "ERR_NOT_FOUND", description: "no instance here: an instance is at http://<handle>.localhost:<port>/ or /@<handle>/" });
+    }
+    /**
+     * #161, #137: an overlay request at the bare host — POST /submit (the topics its X-Topics names: a
+     * comma list or a JSON array, as the overlay reads it) or POST /lookup (its JSON body's `service`,
+     * and a `topic` beside it or in its query) — routed to the instance that serves the names:
+     *
+     *   - a token's name, `tm_color_<id>` / `ls_color_<id>` whose `<id>` is an enabled path-only
+     *     instance here: that instance (#161, the handle naming convention; checked first);
+     *   - any other name (`tm_color`, `ls_color`, …): the enabled instance whose `topics` (the
+     *     names the instance manager's create or start named, host.db) contain it. Whether the instance
+     *     has run yet does not matter. Two instances taking the same name: a problem (400, "N instances
+     *     here take <name>").
+     *
+     * Every name that maps must map to the same instance (else a problem: 400); a name mapping to no
+     * instance here beside one that does is a problem too. Nothing maps: no handle (the hostname's
+     * instance, or the bare host, as before).
+     */
+    overlayTarget(path, req) {
+        const names = [];
+        if (path === "/submit") {
+            const h = (req.headers["x-topics"] ?? "").trim();
+            if (!h)
+                return {};
+            if (h.startsWith("[")) {
+                let j;
+                try {
+                    j = JSON.parse(h);
+                }
+                catch {
+                    return {};
+                } // the overlay's own refusal, at no instance: the bare host's
+                if (!Array.isArray(j))
+                    return {};
+                for (const t of j)
+                    if (typeof t === "string")
+                        names.push(t);
+            }
+            else
+                names.push(...h.split(",").map((x) => x.trim()).filter(Boolean));
+        }
+        else {
+            let j;
+            try {
+                j = JSON.parse(new TextDecoder().decode(req.body));
+            }
+            catch {
+                return {};
+            }
+            if (!j || typeof j !== "object")
+                return {};
+            const q = j.query;
+            for (const t of [j.service, j.topic, q && typeof q === "object" ? q.topic : undefined])
+                if (typeof t === "string")
+                    names.push(t);
+        }
+        const enabled = (h) => this.o.db.get(h)?.status === "enabled";
+        const rows = this.o.db.list("enabled");
+        const mapped = [];
+        for (const name of names) {
+            const id = /^(?:tm|ls)_color_(.+)$/.exec(name)?.[1];
+            if (id && TOKEN_HANDLE.test(id) && enabled(id)) {
+                mapped.push(id);
+                continue;
+            }
+            const by = rows.filter((r) => topicsOf(r).includes(name)).map((r) => r.handle);
+            if (by.length > 1)
+                return { problem: `${by.length} instances here take ${name} (${by.join(", ")}): send it to one of them (/@<handle>/${path.slice(1)})` };
+            mapped.push(by[0]);
+        }
+        const hit = [...new Set(mapped.filter((x) => !!x))];
+        if (!hit.length)
+            return {};
+        if (hit.length > 1)
+            return { problem: `the names map to ${hit.length} instances here (${hit.join(", ")}): one request goes to one; send one per instance` };
+        const stray = names.filter((_, i) => !mapped[i]);
+        if (stray.length)
+            return { problem: `${stray.join(", ")}: no instance here takes ${stray.length > 1 ? "these" : "it"} beside ${hit[0]}: send one request per instance` };
+        return { handle: hit[0] };
+    }
+    /**
+     * GET /skeins?key=<hex> at the host's own origin: the skeins on this host whose head `grants`
+     * (#143) names `key` among root's holders — each enabled agent row's store file read read-only,
+     * no kernel — as JSON [{handle, identity, url}]. A key's skeins are the host's to say (no token
+     * in a wallet tracks them). Unsigned, anyone; mailbox instances are not listed.
+     */
+    async skeinsHeldBy(key) {
+        if (!/^0[23][0-9a-f]{64}$/.test(key))
+            return json(400, { status: "error", code: "ERR_BAD_REQUEST", description: "key: an identity key (33 bytes, hex)" });
+        const out = [];
+        for (const row of this.o.db.list("enabled")) {
+            if (row.kind === "mailbox" || !row.identity || !storeExists(storeSpec(row)))
+                continue;
+            let roots;
+            const s = openStoreFile(storeSpec(row), { readOnly: true });
+            try {
+                roots = await rootOf(s);
+            }
+            catch {
+                roots = [];
+            }
+            finally {
+                s.close();
+            }
+            if (roots.includes(key))
+                out.push({ handle: row.handle, identity: row.identity, url: this.originOf(row.handle) });
+        }
+        return json(200, out);
+    }
+    /** A forwarded request, held among the in-flight ones (shutdown answers them 503). */
+    async held(p) {
+        this.inflight.add(p);
+        try {
+            return await p;
+        }
+        finally {
+            this.inflight.delete(p);
+        }
+    }
+    /**
+     * The handle domain (#113): the host skein's onboarding app's
+     * `config.onboard.domain` (the app record, a kernel read), the one setting
+     * every handle here is at. With no host skein or no app: this router's
+     * origin's host name as a domain.
+     */
+    async handleDomain() {
+        const fallback = this.domain();
+        const host = this.o.db.hostSkein();
+        if (host?.status !== "enabled")
+            return fallback;
+        try {
+            const l = await this.hydrate(host.handle);
+            const root = await l.kernel.call("head", `${ONBOARD_APP}/app`);
+            if (!root)
+                return fallback;
+            const rec = await l.kernel.store.get(root);
+            const d = rec.config?.[ONBOARD_APP]?.domain;
+            return typeof d === "string" && d ? d.toLowerCase() : "localhost";
+        }
+        catch (e) {
+            this.say("router", `the handle domain: not read from ${host.handle}: ${e.message}`);
+            return fallback;
+        }
+    }
+    /** Arcade's webhook (#58, arc.ts); 404 when the host has no Arcade. */
+    async arcRequest(req, path) {
+        if (!this.arc)
+            return json(404, { status: "error", code: "ERR_NOT_FOUND", description: "this host has no Arcade" });
+        if (req.method === "POST")
+            return await this.arc.callback(req.headers, req.body);
+        return json(404, { status: "error", code: "ERR_NOT_FOUND", description: `no ${req.method} ${path}` });
+    }
+    /**
+     * A request for an instance (#68, #66): appended as received, and the
+     * client's connection held until the thread it launched comes to rest —
+     * then its answer, signed on the session inside. Past `answerWaitMs`, or
+     * when the router shuts down, 503 + Retry-After (the thread goes on). A
+     * read's call fuel (the explorer's) is charged to the ledger.
+     */
+    async forward(handle, route, url, req) {
+        if (this.stopped)
+            return unavailable("the host is shutting down");
+        let l;
+        try {
+            l = await this.hydrate(handle);
+        }
+        catch (e) {
+            return json(503, { status: "error", code: "ERR_UNAVAILABLE", description: e.message });
+        }
+        // #130: asleep, or terms this host does not serve: nothing is forwarded.
+        const closed = this.closed(handle);
+        if (closed)
+            return json(402, { status: "error", code: "ERR_PAYMENT_REQUIRED", description: closed });
+        // #135: two doors — a read by a call, a signed request through the door (serveHttp).
+        const a = await serveHttp(l.kernel, { method: req.method, path: url.pathname, route, query: url.search, headers: req.headers, body: req.body }, { now: this.now(), waitMs: this.o.answerWaitMs, stop: this.stopping });
+        this.settle(l);
+        // Charged to the identity the front door verified (H13), never to a header as the client sent it.
+        if (a.fuel !== undefined)
+            this.charge(handle, a.caller ?? "", `${route} (read)`, a.fuel);
+        // #130: what never reaches the log — the read call's fuel, the bytes served — for its next tick.
+        this.meter(handle, { at: stampMs(this.now()), op: `${req.method} ${route}`, ...(a.caller ? { caller: a.caller } : {}), fuel: a.fuel ?? 0, bytes: a.body.length });
+        return { status: a.status, headers: a.headers, body: a.body };
+    }
+    /** The HTTP handler: CORS, then dispatch. */
+    handler() {
+        return (req, res) => {
+            const cors = {
+                "access-control-allow-origin": "*", "access-control-allow-headers": "*", "access-control-allow-methods": "*", "access-control-expose-headers": "*",
+            };
+            if (req.method === "OPTIONS") {
+                res.writeHead(200, cors).end();
+                return;
+            }
+            // #148: an event stream is held open, not buffered.
+            if (req.method === "GET") {
+                const url = new URL(`http://${req.headers.host ?? `127.0.0.1:${this.port}`}${req.url ?? "/"}`);
+                const t = this.target(url);
+                const m = t ? EVENTS_ROUTE.exec(t.route) : null;
+                if (t && m) {
+                    void this.eventStream(t.handle, t.route, decodeURIComponent(m[1]), url, req, res, cors);
+                    return;
+                }
+            }
+            const chunks = [];
+            req.on("data", (c) => chunks.push(c));
+            req.on("end", () => {
+                const url = `http://${req.headers.host ?? `127.0.0.1:${this.port}`}${req.url ?? "/"}`;
+                this.dispatch({ method: req.method ?? "GET", url, headers: headerMap(req.headers), body: new Uint8Array(Buffer.concat(chunks)) })
+                    .then((r) => { res.writeHead(r.status, { ...cors, ...r.headers, "content-length": String(r.body.length) }); res.end(r.body); })
+                    .catch((e) => { if (!res.headersSent) {
+                    res.writeHead(500, { ...cors, "content-type": "application/json" });
+                    res.end(JSON.stringify({ status: "error", code: "ERR_INTERNAL", description: e.message }));
+                } });
+            });
+        };
+    }
+    /**
+     * Listen on `port` (0: any) at each of `hosts` (default the IPv4 and IPv6
+     * loopbacks: `<handle>.localhost` resolves to either).
+     */
+    async listen(port, hosts = ["127.0.0.1", "::1"]) {
+        const list = Array.isArray(hosts) ? hosts : [hosts];
+        for (const [i, host] of list.entries()) {
+            const server = createServer(this.handler());
+            // A client's idle socket is the client's to close (undici: 4 s): a server that closes first races a
+            // client whose event loop was busy past the server's 5 s default — a large install message (#83:
+            // a module whole) is seconds of the SDK's per-byte checks — and the client's next request is reset.
+            server.keepAliveTimeout = 65_000;
+            server.headersTimeout = 66_000;
+            try {
+                await new Promise((resolve, reject) => {
+                    server.once("error", reject);
+                    server.listen(i === 0 ? port : this.port, host, () => { server.off("error", reject); resolve(); });
+                });
+            }
+            catch (e) {
+                if (i === 0)
+                    throw e;
+                this.say("router", `not listening on ${host}: ${e.message}`);
+                continue;
+            }
+            if (i === 0)
+                this.port = server.address().port;
+            this.servers.push(server);
+        }
+        // The host is up: its one status subscription (#58), resumed where it left off.
+        this.arc?.start();
+        return this.servers[0];
+    }
+}
+/** A create's `claim` ({message, body}), checked for its shape (throws; undefined: missing). */
+/**
+ * The instance manager's `topics` (#137): the overlay names (gossip topics and lookup services alike)
+ * the host routes to the instance at the bare host — plain non-empty strings, no duplicates; absent → undefined.
+ */
+function topicsArg(v) {
+    if (v == null)
+        return undefined;
+    if (!Array.isArray(v) || v.some((t) => typeof t !== "string" || !t) || new Set(v).size !== v.length)
+        throw new Error("topics: the overlay names the host routes to it, [text, …], each non-empty, no duplicates");
+    return v;
+}
+function claimOf(v) {
+    const c = v;
+    if (!c || typeof c !== "object" || !c.message || typeof c.message !== "object" || !(c.body instanceof Uint8Array)) {
+        throw new Error("claim: the owner's signed claim {message, body} (#127: a message in box claim, signed by the owner, naming no recipient)");
+    }
+    return { message: c.message, body: c.body };
+}
+/** Why a claim cannot be forwarded for `owner` (throws): not a claim, another sender, a recipient named. The signature is the front door's to check. */
+function claimProblem(c, owner) {
+    const m = c.message;
+    if (m.kind !== "mail" || m.op !== "put" || m.box !== "claim")
+        throw new Error("claim: not a message in box claim");
+    if (!(m.sender instanceof Uint8Array) || Buffer.from(m.sender).toString("hex") !== owner)
+        throw new Error("claim: its sender is not the owner");
+    if (m.recipient !== undefined)
+        throw new Error("claim: it names a recipient (a claim is signed before the instance exists: it names none)");
+    if (!(m.signature instanceof Uint8Array))
+        throw new Error("claim: not signed");
+}
+/** #130: a package that is the instance's own message to itself (the loopback: unsigned, sender and recipient its identity). */
+function isLoopback(pkg, identity) {
+    const m = pkg.message;
+    const hex = (k) => k instanceof Uint8Array ? Buffer.from(k).toString("hex") : "";
+    return !!m && m.signature === undefined && hex(m.sender) === identity && hex(m.recipient) === identity;
+}
+/** #130: a reclaimed instance's store: the file, its -wal and -shm, and its directory when that empties. */
+async function removeStore(store) {
+    const fs = await import("node:fs/promises");
+    const { dirname } = await import("node:path");
+    for (const f of [store, `${store}-wal`, `${store}-shm`])
+        await fs.rm(f, { force: true });
+    await fs.rmdir(dirname(store)).catch(() => { }); // not empty, or not its own: left
+}