@feasibleone/blong-gogo 1.33.0 → 1.35.0

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## [1.35.0](https://github.com/feasibleone/blong/compare/blong-gogo-v1.34.0...blong-gogo-v1.35.0) (2026-09-21)
+
+
+### Features
+
+* semantic log integration ([b1c0d4a](https://github.com/feasibleone/blong/commit/b1c0d4ab32fb54cda54d20deeaf9162b7c4a3db4))
+
+
+### Bug Fixes
+
+* build ([18ea6c6](https://github.com/feasibleone/blong/commit/18ea6c6c737e70ebb8715eba8bd19c7f459c2c41))
+* decouple sequence diagrams from services ([9bc672a](https://github.com/feasibleone/blong/commit/9bc672a184ed07582452ede3a556aaf3ed0726d9))
+* load ([492a0cf](https://github.com/feasibleone/blong/commit/492a0cf317e57cfea618337c8c2c572c220d8b30))
+* MermaidRenderer loop ([afd21eb](https://github.com/feasibleone/blong/commit/afd21ebe87aa3e90c14a2b676414c55a38415744))
+* sequence diagram leg capturing logic ([65f51cf](https://github.com/feasibleone/blong/commit/65f51cf98f4691caead56d9e4d22200fe40cc5bf))
+* test failures ([6aad7e4](https://github.com/feasibleone/blong/commit/6aad7e444238b7ad9801de4017eaedadb55f16cc))
+
+## [1.34.0](https://github.com/feasibleone/blong/compare/blong-gogo-v1.33.0...blong-gogo-v1.34.0) (2026-09-16)
+
+
+### Features
+
+* ACL ([0278431](https://github.com/feasibleone/blong/commit/027843153849ece048be0e61de51594f917a6277))
+
 ## [1.33.0](https://github.com/feasibleone/blong/compare/blong-gogo-v1.32.0...blong-gogo-v1.33.0) (2026-09-15)
 
 

package/bin/blong.ts

@@ -55,6 +55,19 @@ if (isRealmCreate) {
     process.chdir(resolve(process.cwd(), realmName));
 }
 
+// `blong grant <capability> [--ttl=15m] [--key=<jwk|ENV_VAR>]` — mint a
+// short-lived capability token (see `src/grant.ts`). Like `blong realm`, this
+// stays within the intent model rather than becoming a subcommand tree: `grant`
+// is only a command when it is the first positional and no positional names an
+// existing path (a suite is never run by a `grant` argument in practice, and
+// `existsSync` is the same guard the realm-create branch uses).
+const isGrantCommand = positionals[0] === 'grant' && !positionals.some(p => existsSync(resolve(p)));
+if (isGrantCommand) {
+    const {runGrantCommand} = await import('../src/grant.ts');
+    await runGrantCommand(positionals, rawArgv);
+    process.exit(0);
+}
+
 const parsed = minimist(process.argv.slice(2)) as {_: string[]};
 // The first positional arg is an optional file/folder target; the rest are intents.
 const [maybeTarget, ...rest] = parsed._;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feasibleone/blong-gogo",
-  "version": "1.33.0",
+  "version": "1.35.0",
   "repository": {
     "url": "git+https://github.com/feasibleone/blong.git"
   },
@@ -38,6 +38,7 @@
     "@feasibleone/blong-lib": "^1.0.0",
     "@feasibleone/blong-mle": "^1.0.0",
     "@feasibleone/blong-mock": "^1.0.0",
+    "@feasibleone/semantic-log": "^1.0.0",
     "@keycloak/keycloak-admin-client": "^26.6.2",
     "@kubernetes/client-node": "^1.4.0",
     "@octokit/rest": "^22.0.1",
@@ -90,7 +91,7 @@
     "tap": "^21.6.3",
     "typescript": "^6.0.3",
     "vite": "^8.2.1",
-    "@feasibleone/blong-dev": "1.4.0"
+    "@feasibleone/blong-dev": "1.5.0"
   },
   "scripts": {
     "browser-check": "node scripts/browser-compat-check.mjs",
@@ -98,6 +99,7 @@
     "ci-coverage": "./run-coverage.sh",
     "ci-lint": "blong-dev lint",
     "ci-publish": "node ../../common/scripts/install-run-rush-pnpm.js publish --access public --provenance",
-    "ci-test": "blong-dev test"
+    "ci-test": "blong-dev test",
+    "test": "blong-dev test"
   }
 }

package/src/AdapterBase.ts

@@ -13,8 +13,9 @@ import type net from 'node:net';
 import PQueue from 'p-queue';
 
 import ConfigRuntime from './ConfigRuntime.ts';
-import {isExpectedError} from './lib.ts';
+import {isExpectedError, portLogCalls} from './lib.ts';
 import loop from './loop.ts';
+import {adoptInbound, inboundIdentities, isFlowId} from './semanticContext.ts';
 
 const errorMap: IErrorMap = {
     'adapter.configValidation': 'Adapter config validation:\r\n{message}',
@@ -290,6 +291,26 @@ export class AdapterBase<T, C extends IContext> implements AdapterHandlerContext
 
     async drain(): Promise<void> {}
 
+    /**
+     * Every handler registered for a method, in load order.
+     *
+     * `findHandler` answers with the one function the proxy will call: the newest
+     * group shadows the earlier ones, which is deliberate — it is how a handler
+     * reaches its super. The shadowed implementations stay in `importedMap`, and
+     * this walks them. It exists for an entry point whose answer is a *composition*
+     * of what every provider says rather than a choice between them (the portal
+     * configuration is the first), where shadowing is the wrong default.
+     */
+    findHandlers(methodName: string): unknown[] {
+        const method = this.methodPath(this._methodId(methodName));
+        const handlers: unknown[] = [];
+        this.importedMap?.forEach(imported => {
+            if (Object.prototype.hasOwnProperty.call(imported, method))
+                handlers.push(imported[method]);
+        });
+        return handlers;
+    }
+
     findHandler(methodName: string): unknown {
         methodName = this.methodPath(this._methodId(methodName));
         return this.imported[methodName];
@@ -350,7 +371,38 @@ export class AdapterBase<T, C extends IContext> implements AdapterHandlerContext
         const method = ($meta && $meta.method) || 'exec';
         const handler = this.findHandler(method) || this.imported['exec'];
         if (handler instanceof Function) {
-            return handler.apply(this, params);
+            const run = () => handler.apply(this, params);
+            // A call the caller declared is answered by writing one record here, inside the
+            // leg that arrived: that is what turns the caller's declaration into a receipt
+            // the ledger can match, and it happens only when a flow was traced at all, so an
+            // untraced request still pays nothing.
+            const answered = (): unknown => {
+                const inbound = inboundIdentities($meta as IMeta);
+                if (isFlowId(inbound.flow) && inbound.leg !== undefined) {
+                    // The receipt is the receiver's record for the leg it was handed. It carries
+                    // no declared target - the caller named the ends - so the ledger can tell a
+                    // receipt from a declaration by the leg alone, in one process or many.
+                    portLogCalls(this)?.received(inbound.leg);
+                }
+                return run();
+            };
+            // The callee adopts the identity its caller declared, so the records its
+            // handler writes belong to the caller's execution and its own calls are
+            // declared against the same one. Only adopt, never mint: the two places
+            // that mint a flow are the external request and the cross-process call,
+            // and a port that invented one would fill the ledger with runs nobody
+            // asked for.
+            //
+            // Measured (T-115): the identity *is* on `$meta` here — the gateway route
+            // publishes it before it makes the local call — while the callee's handler
+            // otherwise runs in whatever context its transport scheduled it in, where
+            // `declareCall` finds no flow. What this does *not* do is make a quiet call
+            // visible: a recorded call is a record written inside it, and the ports that
+            // make calls in a served request log nothing at that moment. The leg is
+            // bound correctly; whether it can be seen depends on the callee logging.
+            return isFlowId(inboundIdentities($meta as IMeta).flow)
+                ? adoptInbound($meta as IMeta, method, answered)
+                : run();
         } else {
             throw this.errors['adapter.methodNotFound']({params: {method}});
         }

package/src/BrowserLog.ts

@@ -1,5 +1,5 @@
-import {Internal, type ILog, type ILogger} from '@feasibleone/blong/types';
 import {withProgress} from '@feasibleone/blong-lib';
+import {Internal, type ILog, type ILogger} from '@feasibleone/blong/types';
 import type {Level, Logger as PinoLogger} from 'pino';
 
 // ── level constants (bunyan numeric levels) ──────────────────────────────────
@@ -160,6 +160,17 @@ function createLogger(
     };
 }
 
+/**
+ * The browser's console logger, and the reason it has no call channel.
+ *
+ * A capability is carried in semantic-log's ambient scope, which is
+ * `AsyncLocalStorage` — Node-only and deliberately kept out of the page — and a
+ * page has no retention store and no cluster sink either, so a call record it
+ * could write would exist only to be printed among the messages a developer is
+ * already reading. `ILog.calls` is therefore absent here, and the framework's
+ * call sites fall silent: the same answer the server gives for a flow that opted
+ * out, for a better reason.
+ */
 export default class BrowserLog extends Internal implements ILog {
     #config: IBrowserLogConfig = {level: 'info', logByLevel: false};
     #logger: ISimpleLogger;
@@ -184,7 +195,10 @@ export default class BrowserLog extends Internal implements ILog {
         ) as unknown as PinoLogger<T>;
     }
 
-    public logger(level: Level = this.#config.level ?? 'info', bindings: object): ILogger {
+    public logger(
+        level: Level | 'silent' = this.#config.level ?? 'info',
+        bindings: object,
+    ): ILogger {
         const child = this.#logger.child(bindings as Record<string, unknown>, {level});
         const result: ILogger = {
             trace: undefined,

package/src/Gateway.ts

@@ -2,6 +2,7 @@ import type {
     ApiSchema,
     Errors,
     GatewaySchema,
+    ICallLog,
     IErrorFactory,
     IErrorMap,
     IGateway,
@@ -20,12 +21,24 @@ import {Type, type TSchema} from 'typebox';
 import Value from 'typebox/value';
 import {v4} from 'uuid';
 
+import {TRACE_HEADER, withoutCapabilities} from '@feasibleone/semantic-log/capability';
+import {CALLS_CAPABILITY, GRANT_HEADER} from './callTrace.ts';
+import {grantedCalls, grantKeyFrom} from './grant.ts';
+import {
+    callsFor,
+    declareCall,
+    enterCapability,
+    enterRequestFlow,
+    runInFlow,
+} from './semanticContext.ts';
+
 import {type TypeBoxTypeProvider} from '@fastify/type-provider-typebox';
 import type {IResolution} from './Resolution.ts';
 import type {IRpcClient} from './RpcClient.ts';
 import jwt from './jwt.ts';
 import {isExpectedError, methodId, methodParts, snakeToCamel} from './lib.ts';
 import type {IConfig as IConfigMLE} from './mle.ts';
+import isPublic from './public.ts';
 import swagger from './swagger.ts';
 
 const osName: string = [os.type(), os.platform(), os.release()].join(':');
@@ -169,6 +182,8 @@ export default class Gateway extends Internal implements IGateway {
     #resolution: IResolution;
     #log: ILog;
     #logger: ReturnType<ILog['child']> | undefined;
+    /** The gateway's own call channel: the framework's record of the calls it makes. */
+    #calls: ICallLog | undefined;
     #config: IConfig = {
         host: '0.0.0.0',
         port: 8080,
@@ -285,6 +300,13 @@ export default class Gateway extends Internal implements IGateway {
         return (
             [
                 ['x-request-id'],
+                // The framework's own identity header (see `semanticContext.ts`). It
+                // travels in the body as well, but a request that never reached the
+                // route handler — the one the hooks rejected — is only readable from
+                // here, and this is what lets it keep the flow it was given. The
+                // capabilities decided for the flow travel inside it, in its `cap`
+                // field, which the earliest hook has already rewritten.
+                ['x-semantic-trace'],
                 ['x-b3-traceid', () => v4().replace(/-/g, '')],
                 ['x-b3-spanid'],
                 ['x-b3-parentspanid'],
@@ -531,13 +553,23 @@ export default class Gateway extends Internal implements IGateway {
                         if (!('result' in value)) {
                             const req = this.#local.get(reqName);
                             if (!req) return notfound();
-                            const [result, resultMeta] = (await req.method(params, meta)) ?? null;
+                            // The outermost entry mints the flow: everything this
+                            // request does downstream joins it, and the method it
+                            // was addressed to is the flow's kind.
+                            const [result, resultMeta] =
+                                (await runInFlow(meta as IMeta, methodName, () =>
+                                    req.method(params, meta),
+                                )) ?? null;
                             this._applyMeta(reply, resultMeta as {httpResponse?: unknown});
                             return result;
                         } else if (id == null) {
                             const pub = this.#local.get(pubName);
                             if (!pub) return notfound();
-                            pub.method(params, meta).catch(() => {});
+                            // A notification is an entry of its own, so it starts a
+                            // flow rather than joining one nobody sent.
+                            runInFlow(meta as IMeta, methodName, () =>
+                                pub.method(params, meta),
+                            ).catch(() => {});
                             return {
                                 jsonrpc: '2.0',
                                 result: true,
@@ -545,7 +577,67 @@ export default class Gateway extends Internal implements IGateway {
                         } else {
                             const req = this.#local.get(reqName);
                             if (!req) return notfound();
-                            const [result, resultMeta] = (await req.method(params, meta)) ?? null;
+                            // The same entry as the branch above, and it is the ordinary
+                            // request/response path — which is why it matters most: the
+                            // `onRequest` hook enters the flow with `enterWith`, and that
+                            // does not reach a handler the router schedules from its own
+                            // async resource, so for a while only the *wildcard* branch
+                            // ran inside a flow. Every call the handler made was then
+                            // declared in no flow at all, which is why no served request
+                            // ever produced a leg while tap runs did. `runInFlow` adopts
+                            // the identity the hook published when the meta carries one,
+                            // so this does not mint a second flow for the same request.
+                            const [result, resultMeta] =
+                                (await runInFlow(meta as IMeta, methodName, () =>
+                                    // Declare the hop this route is making. The caller is
+                                    // **`public`** - the surface that answered the request,
+                                    // named apart from the namespace it calls. The gateway realm
+                                    // is a namespace called `gateway`, so a leg whose caller was
+                                    // also called `gateway` drew the public surface and that
+                                    // namespace as one participant, and a realm answering a call
+                                    // to its own namespace read as a self-call. A leg id names a
+                                    // unit, and the API surface is a unit of its own - not the
+                                    // process either: one process hosts a whole suite, so naming
+                                    // the process here would draw every flow of a monolith as the
+                                    // same participant.
+                                    // `methodName` is already the dotted wire name the leg
+                                    // grammar wants, so the leg names the method the request
+                                    // asked for. The callee's receipt then carries the same leg,
+                                    // which is what makes the drawing a call rather than a
+                                    // participation.
+                                    declareCall(
+                                        'public',
+                                        methodName,
+                                        () => {
+                                            // The caller's own records, written inside the leg it
+                                            // just declared: the callee answers with a receipt for
+                                            // the same leg, and a call is finished when it answers -
+                                            // so the start, the end and the failure all belong here.
+                                            // They go through the call channel rather than the level
+                                            // logger: a call is either wanted for the whole flow or
+                                            // it is not, and a request that records nothing pays for
+                                            // no record at all.
+                                            const calls = this.#calls;
+                                            calls?.start(methodName);
+                                            const answered = req.method(params, meta);
+                                            if (answered instanceof Promise) {
+                                                return Promise.resolve(answered).then(
+                                                    value => {
+                                                        calls?.end(methodName);
+                                                        return value;
+                                                    },
+                                                    error => {
+                                                        calls?.error(methodName, error);
+                                                        throw error;
+                                                    },
+                                                );
+                                            }
+                                            calls?.end(methodName);
+                                            return answered;
+                                        },
+                                        meta as IMeta,
+                                    ),
+                                )) ?? null;
                             this._applyMeta(reply, resultMeta as {httpResponse?: unknown});
                             return {
                                 jsonrpc: '2.0',
@@ -602,10 +694,21 @@ export default class Gateway extends Internal implements IGateway {
     public async start(): Promise<IGateway> {
         const old = this.#server;
         this.#logger = this.#log.child({name: 'gateway'}, {level: this.#config.logLevel});
+        // The call channel of *this* component, so its records carry the component the
+        // way its level records do (`logger()` binds the name). Taken once, next to
+        // the logger it belongs to.
+        this.#calls = this.#log.logger(this.#config.logLevel ?? 'info', {name: 'gateway'}).calls;
         try {
             this.#server = fastify({
                 loggerInstance: this.#logger,
                 forceCloseConnections: true,
+                // fastify's own request logging is off, and the framework's records
+                // replace it: it writes the whole request at `info` — headers, the
+                // `Authorization` bearer among them — and a completion line, which is
+                // both more than a reader needs and less than the flow records say.
+                // Nothing else depends on those two lines: the request has a flow, the
+                // flow has its calls, and both are recorded where they belong.
+                disableRequestLogging: true,
                 ajv: {
                     customOptions: {
                         allErrors: true,
@@ -646,6 +749,68 @@ export default class Gateway extends Internal implements IGateway {
                     });
                 },
             );
+            // The entry of a request is its earliest hook, not its route handler: the
+            // authentication and metering hooks run in between, and a call they reject
+            // has no route to be wrapped by, so its records would name no flow at all
+            // (T-105). The identity is published back onto the request headers, which is
+            // where the route handler reads it from when it adopts this same flow.
+            //
+            // Declared with the three-argument callback shape on purpose. Fastify picks the
+            // hook's style from its arity, and a plain function of one argument is awaited
+            // nowhere: every request then stopped in this hook, which looked for a day like a
+            // slow database rather than a signature - the MLE readiness probe timed out at
+            // startup and every realm's tap run failed with a different symptom each time.
+            //
+            // The metadata endpoints and the static assets are not calls: they are the
+            // framework's own plumbing (the MLE key endpoint, the API documentation, what a
+            // browser fetches), and minting an execution per probe filled the observed kinds
+            // with names like `login..well-known.mle` - a deployment's health checks read as
+            // traffic in an observation of its business.
+            this.#server.addHook(
+                'onRequest',
+                async (request: FastifyRequest, _reply: FastifyReply): Promise<void> => {
+                    const pathname = new URL(request.url, 'http://localhost').pathname;
+                    if (isPublic(pathname) && pathname.includes('/.well-known/')) {
+                        return;
+                    }
+                    // Only what the earliest hook can see: the route handler knows the
+                    // real method and re-enters this flow with it, so a path that does
+                    // not name one is left unlabelled rather than guessed at.
+                    const kind = pathname.startsWith('/rpc/')
+                        ? pathname.slice(5).split('/').filter(Boolean).join('.')
+                        : '';
+                    // A capability decides what this process may cost itself, so an
+                    // outside caller does not get to set one: the field is stripped
+                    // from the identity it arrived with, and the decision is made here
+                    // and published in its place. The rest of the identity is adopted
+                    // exactly as it arrived.
+                    const identity = withoutCapabilities(
+                        request.headers[TRACE_HEADER] as string | undefined,
+                    );
+                    if (identity.length > 0) {
+                        request.headers[TRACE_HEADER] = identity;
+                    } else {
+                        delete request.headers[TRACE_HEADER];
+                    }
+                    // The grant, if one arrived, is verified here and now — once per
+                    // request, at the earliest point there is — and what travels on is
+                    // the capability it decided, not the token.
+                    const grantedCallsToRecord = await grantedCalls(
+                        request.headers[GRANT_HEADER] as string | undefined,
+                        grantKeyFrom(this.#config),
+                    );
+                    // A grant wins over the configuration; with none, the configuration
+                    // answers and the answer is published for the process that serves
+                    // the call. Either way the flow is decided here, before the hooks
+                    // that may reject the request: a flow the entry point refused to
+                    // record is not recorded by the service it reaches.
+                    enterCapability(
+                        CALLS_CAPABILITY,
+                        grantedCallsToRecord || callsFor({forward: request.headers} as IMeta, kind),
+                    );
+                    Object.assign(request.headers, enterRequestFlow(request.headers, kind));
+                },
+            );
             await this.#server.register(jwt, {
                 cache: this.#config.jwt?.cache,
                 verify: (token: string, options: {nonce?: string; audience: string}) =>
@@ -704,6 +869,13 @@ export default class Gateway extends Internal implements IGateway {
     }
 
     public async stop(): Promise<IGateway> {
+        // fastify's close() waits on the socket layer, and keep-alive connections made by a
+        // browser backend (or a leftover probe) hold it open indefinitely: the run ends with
+        // a tap "timeout!" against a live server long after every test passed, because the
+        // process never exits. Close the connections first so shutting down actually
+        // shuts down.
+        this.#server?.server.closeIdleConnections?.();
+        this.#server?.server.closeAllConnections?.();
         await this.#server?.close();
         this.#server = null;
         return this;

package/src/Log.ts

@@ -1,12 +1,33 @@
 import {withProgress} from '@feasibleone/blong-lib';
-import {Internal, type ILog, type ILogger} from '@feasibleone/blong/types';
+import {Internal, type ICallLog, type ILog, type ILogger} from '@feasibleone/blong/types';
+import {createCallChannel} from '@feasibleone/semantic-log/capability';
 import {pino, type Logger, type LoggerOptions} from 'pino';
 import {monotonicFactory} from 'ulidx';
+import {callRecord, configureCallTrace, type CallTraceConfig} from './callTrace.ts';
 import type {CacacheTransportOptions} from './pino-cacache.js';
 
 // echo -e "\u001B]8;;https://google.com\u001B\\Кликни тук\u001B]8;;\e\\"
 
 export interface LogConfig extends LoggerOptions {
+    /**
+     * Which implementation is active. This class serves every value except
+     * `semantic`, so it never acts on the key — it is declared because the merged
+     * `log` config is handed to whichever implementation the loader chose, and
+     * stripped before the rest reaches pino.
+     */
+    impl?: string;
+    /** The semantic implementation's store. Not a pino option; stripped below. */
+    cache?: unknown;
+    /**
+     * The call channel: whether a flow's calls are recorded, and whether they
+     * are shown.
+     *
+     * `stdout` is the whole switch under this implementation, because pino has
+     * no retention store and no cluster sink - a record it is not printing does
+     * not exist. The framework's `enabled`/`off` decision still applies first,
+     * so a flow that opted out records nothing whichever logger runs.
+     */
+    calls?: CallTraceConfig;
     /** When provided, log entries are cached to disk via cacache for later inspection. */
     cacache?: CacacheTransportOptions;
 }
@@ -84,6 +105,7 @@ export default class Log extends Internal implements ILog {
     public constructor(config: LogConfig) {
         super();
         this.merge(this.#config, config);
+        configureCallTrace(this.#config.calls);
 
         // Inject a monotonic ULID `id` into every log entry before it reaches any transport
 
@@ -103,11 +125,30 @@ export default class Log extends Internal implements ILog {
             };
         }
 
-        // Remove the cacache option before passing to pino — it is not a pino option
-        const {cacache: _cacacheConfig, ...pinoConfig} = this.#config;
+        // Remove the framework's own keys before passing the rest to pino — none
+        // of them is a pino option. `impl` chose this implementation (reaching
+        // here means it is not `semantic`) and `cache` configures the semantic
+        // implementation's store; `cacache` is this implementation's transport
+        // and is passed to it separately, through the transport targets below.
+        const {
+            cacache: _cacacheConfig,
+            impl: _impl,
+            cache: _semanticCache,
+            calls: _calls,
+            ...pinoConfig
+        } = this.#config;
         this.#logger = pino(pinoConfig);
     }
 
+    /**
+     * Attach the call channel's scope.
+     *
+     * Nothing to attach: the ambient scope a capability is carried in is
+     * semantic-log's own (`AsyncLocalStorage`), reached by the vocabulary the
+     * server bootstrap attaches, and the channel reads it directly.
+     */
+    public async init(): Promise<void> {}
+
     public child<T extends string>(...params: Parameters<Logger<never>['child']>): Logger<T> {
         return this.#logger.child(...params) as Logger<T>;
     }
@@ -142,6 +183,35 @@ export default class Log extends Internal implements ILog {
         return {
             ...result,
             progress: (label, promise, options) => withProgress(result, label, promise, options),
+            calls: this.#callsChannel(child),
         };
     }
+
+    /**
+     * The framework's own account of the calls made through this log.
+     *
+     * Written through the logger it is asked of, so a component's call records carry
+     * the component — the same `name` binding every other record from it does. Under
+     * pino the destination *is* the level: there is nothing to store, so a call
+     * record that is not printed has nowhere else to go. Whether the flow records at
+     * all is the capability's decision, asked before the writer is called, and it is
+     * the same one the semantic implementation asks.
+     */
+    #callsChannel(child: Logger): ICallLog {
+        return createCallChannel(({leg, phase, message, error, fields}) => {
+            child.info(
+                {
+                    ...callRecord(leg, phase),
+                    ...(error === undefined ? {} : {err: error}),
+                    ...fields,
+                },
+                message,
+            );
+        });
+    }
+
+    /** The call channel, as a component that holds the log rather than a logger reaches it. */
+    public get calls(): ICallLog {
+        return this.#callsChannel(this.#logger);
+    }
 }

package/src/Registry.ts

@@ -530,6 +530,13 @@ export default class Registry extends Internal implements IRegistry {
         );
         this.#stopped = true;
         this.#logger = undefined;
+        // The log implementation can hold something the process will not exit without: the
+        // semantic log's in-process cluster service listens on a socket (9455 by default), and
+        // a run that closes every other server still hangs on it — a tap suite that passed
+        // every test then reports "timeout!" against a live server. Stopping it here is what
+        // makes `stop()` mean "nothing of this platform is still running". Optional because
+        // the plain log implementation has nothing to stop.
+        await (this.#log as {stop?: () => Promise<void>})?.stop?.();
         return this;
     }
 

package/src/RpcServer.ts

@@ -3,6 +3,7 @@ import {Internal, type ILog, type IManifest, type IMeta, type IRpcServer} from '
 import fastify, {type FastifyReply, type FastifyRequest, type RouteOptions} from 'fastify';
 
 import type {IResolution} from './Resolution.ts';
+import {adoptInbound} from './semanticContext.ts';
 
 interface IConfig {
     port: number;
@@ -70,9 +71,15 @@ export default class RpcServer extends Internal implements IRpcServer {
                 opcode: method.split('.').pop(),
             };
             attachCheckpoint?.(newMeta as IMeta);
-            const result = await (callback as (...args: unknown[]) => Promise<unknown>).apply(
-                object,
-                [...params, newMeta],
+            // An inbound call joins the flow it was made in when it carries one,
+            // and is an outermost entry when it does not: a peer that sends no
+            // identity gets a flow of its own rather than a continuation of a flow
+            // nobody named.
+            const result = await adoptInbound(newMeta as IMeta, method, () =>
+                (callback as (...args: unknown[]) => Promise<unknown>).apply(object, [
+                    ...params,
+                    newMeta,
+                ]),
             );
             return {
                 jsonrpc: '2.0',
@@ -161,6 +168,10 @@ export default class RpcServer extends Internal implements IRpcServer {
     }
 
     public async stop(): Promise<IRpcServer> {
+        // See Gateway.stop: leftover keep-alive connections would hold the process open and
+        // turn a green run into a tap "timeout!".
+        this.#server.server.closeIdleConnections?.();
+        this.#server.server.closeAllConnections?.();
         await this.#server.close();
         return this;
     }