@homie-rocks/studio 0.32.0 → 0.33.0

package/worker/index.mjs

@@ -83,9 +83,12 @@
  * on the Table's alarm: Workers AI through the optional AI binding (deploy adds
  * it when a server uses it), or the owner's own key (secret HOMIE_BRAIN_KEY).
  */
+import { playerEnabled, EMBED_GAME_JS } from './embed.mjs';
 import { NetRoom, WATCH_POLICIES, departure, errorLine, versionOf } from './room.mjs';
+import { hostedGame, hostedBuild, startHost } from './hosted.mjs';
+import { roomStore, restoreDelay } from './room-store.mjs';
 import { appCors, isAppOrigin } from './standalone.mjs';
-import { ROOM_ID, badRoomPage, frameAncestors, noWatchPage, playPage, watchPage } from './pages.mjs';
+import { ROOM_ID, badRoomPage, embedAncestors, embedPreview, frameAncestors, noWatchPage, playPage, watchPage } from './pages.mjs';
 import {
   PUBLIC_SERVER, SERVER_ID, homeOf, memberCounts, memberOf, noteMember, policyOf, pooledRoom, roomCode, roomServer, serverAccess, serverPassOf, serverView, serversOf,
   setMembership,
@@ -124,6 +127,8 @@ import { licenseOf } from './license.mjs';
 import { PART_FILES, isPartsPath, partsRoutes, withPartsBand } from './parts.mjs';
 
 export { SEAT_MAX } from './seats.mjs';
+// Server-hosted games (NETPLAY.md section 29): the studio's site/src/worker.mjs hands the build's rules over with this.
+export { hostRules } from './hosted.mjs';
 /** For a studio whose Worker has player accounts: hand their server API to the back office once (worker/office.mjs). */
 export { usePlayers } from './office.mjs';
 /** For a studio's own wrapper Worker: count its own pages the way the template counts its pages. */
@@ -145,11 +150,17 @@ const json = (body, status = 200, extra = {}) => new Response(`${JSON.stringify(
 });
 
 /** The catalogue `homie-studio build` writes into the site (games.json). */
+const catalogueCache = new WeakMap();
 async function catalogue(env, origin) {
   try {
     const res = await env.ASSETS.fetch(new Request(`${origin}/games.json`));
     if (!res.ok) return { studio: { name: env.STUDIO_NAME || 'Studio' }, games: [] };
-    return await res.json();
+    const tag = res.headers.get('etag');
+    const hit = catalogueCache.get(env.ASSETS);
+    if (tag && hit?.tag === tag && hit.origin === origin) { await res.body?.cancel(); return hit.value; }
+    const value = await res.json();
+    if (tag) catalogueCache.set(env.ASSETS, { tag, origin, value });
+    return value;
   } catch { return { studio: { name: env.STUDIO_NAME || 'Studio' }, games: [] }; }
 }
 
@@ -448,7 +459,10 @@ function notAHomie(request) {
  * frame was opened with an agent's ticket (section 17): the game plays as that AI, named "<label> · AI".
  */
 async function gameDocument(request, env, url, game, meta, cat, { agent = null } = {}) {
+  const embedded = url.searchParams.get('embed') === '1' && playerEnabled(cat, meta);
   const asked = url.searchParams.get('room');
+  // A player card's game joins a public room, or `main`: the room Play itself falls back to when the lobby does not answer.
+  if (embedded && (!/^(?:pub-[1-9][0-9]*|main)$/.test(asked || '') || url.searchParams.has('t') || url.searchParams.has('watch') || url.searchParams.get('want') === 'screen')) return new Response('Player cards join public rooms through the player address.\n', { status: 400 });
   // A room code the relay cannot use is refused here too, never swapped for another room.
   if (asked !== null && !ROOM_ID.test(asked)) return new Response('That room link does not work: a room code is 1 to 32 letters, digits, - or _.\n', { status: 400, headers: { 'content-type': 'text/plain; charset=utf-8', 'cache-control': 'no-store' } });
   const res = await env.ASSETS.fetch(new Request(`${url.origin}/games/${game}/index.html`));
@@ -496,11 +510,11 @@ async function gameDocument(request, env, url, game, meta, cat, { agent = null }
     // game.json "saves": the play shell around this frame answers @homie-rocks/studio/saves (saves/SAVES.md).
     ...(meta?.saves && want === 'play' ? { saves: true } : {}),
     // The studio sells something in this game (shop/SHOP.md): the play shell answers @homie-rocks/studio/shop. A
-    // watcher has no shop; the shell itself says "kids" on a kids server and shows only a code on a television.
+    // watcher has no shop; the shell follows the studio shop policy for kids servers and television checkout.
     ...(!agent && !watching && shellShop(cat, game) ? { shop: true } : {}),
   };
   let html = await res.text();
-  const head = `<script>window.HOMIE_NET=${JSON.stringify(cfg).replace(/</g, '\\u003c')}</script>`;
+  const head = `${embedded ? `<script>${EMBED_GAME_JS}</script>` : ''}<script>window.HOMIE_NET=${JSON.stringify(cfg).replace(/</g, '\\u003c')}</script>`;
   html = /<head[^>]*>/i.test(html) ? html.replace(/<head([^>]*)>/i, `<head$1>${head}`) : head + html;
   return new Response(html, {
     headers: {
@@ -508,7 +522,7 @@ async function gameDocument(request, env, url, game, meta, cat, { agent = null }
       'cache-control': 'no-store, no-transform',
       'access-control-allow-origin': '*',
       // The game runs in an opaque origin: it cannot read this site's storage or cookies.
-      'content-security-policy': `sandbox allow-scripts allow-pointer-lock allow-forms allow-modals allow-popups; frame-ancestors ${frameAncestors(cat)}`,
+      'content-security-policy': `sandbox allow-scripts allow-pointer-lock allow-forms allow-modals allow-popups; frame-ancestors ${embedded ? `'self' ${embedAncestors(cat, url.origin, env.HOMIE_EMBED_PREVIEW === '1').replace("'none'", '')}` : frameAncestors(cat)}`,
     },
   });
 }
@@ -567,7 +581,8 @@ function finish(res, path) {
   const cache = res.headers.get('cache-control') ?? '';
   const addNt = !/no-transform/i.test(cache);
   // GAME PARTS: a shared part's preview page is framed by the part's page and the hub, sandboxed (worker/parts.mjs).
-  const addXfo = !res.headers.has('x-frame-options') && !GAME_FILES.test(path) && !PART_FILES.test(path);
+  const playerFrame = /^\/[a-z0-9][a-z0-9-]{0,39}\/play\/embed$/.test('/' + path.split('/').filter(Boolean).join('/')) && res.status === 200 && /frame-ancestors/.test(res.headers.get('content-security-policy') ?? '');
+  const addXfo = !playerFrame && !res.headers.has('x-frame-options') && !GAME_FILES.test(path) && !PART_FILES.test(path);
   if (!addNt && !addXfo) return res;
   const headers = new Headers(res.headers);
   if (addNt) headers.set('cache-control', cache ? `${cache}, no-transform` : 'no-transform');
@@ -770,7 +785,7 @@ async function route(request, env, ctx) {
           : want === '/' ? ldScript(homeLd(cat, url.origin))
             : game && parts.length === 1 ? ldScript(landingLd(cat, game, url.origin, { shop: await sellingShop(env, cat) }))
               : ldScript([studioNode(cat, url.origin, { full: true })]);
-        return customPage(cat, html, { active, schema });
+        return customPage(cat, html, { active, schema, origin: url.origin, playerGame: game && parts.length === 1 ? game : null });
       }
     }
   }
@@ -836,6 +851,12 @@ async function route(request, env, ctx) {
     if (parts.length === 1 && !path.endsWith('/')) return Response.redirect(`${url.origin}/${game}/`, 301);
     const cat = await getCat();
     let sub = parts.slice(1).join('/');
+    if (sub === '__restart') {
+      if (env.HOMIE_PREVIEW !== '1' || request.method !== 'POST' || !hostedGame(game)) return new Response('not found', { status: 404 });
+      const room = url.searchParams.get('room') ?? '';
+      if (!ROOM_ID.test(room)) return new Response('invalid room', { status: 400 });
+      return env.TABLE.get(env.TABLE.idFromName(`${game}/${room}`)).fetch(`https://table/__restart?game=${game}&room=${room}`, { method: 'POST' });
+    }
     // Read now, not from a Worker instance's 5 s cache: a game the owner just made private shuts at once everywhere.
     const settings = await settingsOf(env, { fresh: true });
     // The owner's launch state and room size (worker/office.mjs): a private or invite-only game lets in only those
@@ -933,9 +954,12 @@ async function route(request, env, ctx) {
       if (body.join !== false && !d.ok) return json({ ok: false, error: d.why, message: 'This server\'s door does not let you in.' }, 403);
       try { return json(await setMembership(env, game, srv.id, acct.slice(2), { join: body.join !== false, home: body.home === true })); } catch { return json({ ok: false, error: 'not-migrated', message: 'This studio\'s database has no servers yet (migration 0006).' }, 503); }
     }
-    if (sub === 'tv' || sub === 'play') {
-      const screen = sub === 'tv' || url.searchParams.get('screen') === '1';
-      const asked = askedRoom;
+    if (sub === 'play/preview' && env.HOMIE_EMBED_PREVIEW === '1' && isLocalOrigin(url.origin)) return embedPreview(cat, meta, url.origin);
+    if (sub === 'tv' || sub === 'play' || sub === 'play/embed') {
+      const embed = sub === 'play/embed';
+      if (embed && (!playerEnabled(cat, meta) || launch !== 'public')) return notFoundPage('This game does not play inside a post. Open its studio page to play.', cat);
+      const screen = !embed && (sub === 'tv' || url.searchParams.get('screen') === '1');
+      const asked = embed ? null : askedRoom;
       if (asked !== null && !ROOM_ID.test(asked)) return badRoomPage(cat, meta, asked, { screen });
       if (!door.ok) return shut();
       // Which server: the path's, the room's, else (Play) the player's home server, else public.
@@ -943,7 +967,7 @@ async function route(request, env, ctx) {
       if (asked !== null && !srv) return notFoundPage(`${meta.name} has no server for the room "${asked}".`, cat);
       const named = asked !== null && !pooledRoom(asked);
       if (!srv) {
-        const acct = await accountSub(request, env);
+        const acct = embed ? null : await accountSub(request, env);
         const home = acct?.startsWith('p-') ? await homeOf(env, game, acct.slice(2)) : null;
         const h = home ? serverById(home) : null;
         srv = h && h.state === 'open' ? h : serverById('public') ?? PUBLIC_SERVER;
@@ -971,15 +995,15 @@ async function route(request, env, ctx) {
         const local = isLocalOrigin(url.origin);
         let qr = null;
         if (!local) try { qr = qrSvg(joinUrl, { title: `Join ${meta.name ?? game}` }); } catch { /* too long for a QR: the address shows as text */ }
-        // The shop on a television is a code to buy on a phone (the TV never sells; never on a kids server).
+        // Television checkout and kids-server visibility follow the studio shop policy.
         const sh = shellShop(cat, game, { kids: pol.kids });
         let shopQr = null;
         if (sh && !local) try { shopQr = qrSvg(`${url.origin}/shop/?game=${encodeURIComponent(game)}`, { title: `Shop: ${meta.name ?? game}` }); } catch { shopQr = null; }
-        return playPage(cat, meta, { screen: true, joinUrl, qr, local, room, ticket, owner: d.owner, launch, server, shop: sh ? { ...sh, qr: shopQr, url: `${url.origin}/shop/?game=${game}` } : null });
+        return playPage(cat, meta, { origin: url.origin, screen: true, joinUrl, qr, local, room, ticket, owner: d.owner, launch, server, shop: sh ? { ...sh, qr: shopQr, url: `${url.origin}/shop/?game=${game}` } : null });
       }
       await countVisit(request, env, ctx, game, 'play');
       shareDaily(cat, url, ctx);
-      return playPage(cat, meta, { ticket, owner: d.owner, launch, server, ...(await chatWho(env, game, srv, d.acct)), shop: shellShop(cat, game, { kids: pol.kids }) });
+      return playPage(cat, meta, { origin: url.origin, embed, preview: env.HOMIE_EMBED_PREVIEW === '1', ticket: embed ? null : ticket, owner: !embed && d.owner, launch, server, ...(embed ? {} : await chatWho(env, game, srv, d.acct)), shop: shellShop(cat, game, { kids: pol.kids }) });
     }
     if (sub === 'watch') {
       // The same door as Play: a game that is private or an invite-only beta is watched only by whoever may play it.
@@ -996,7 +1020,7 @@ async function route(request, env, ctx) {
       const ticket = d.holder ? await ticketFor(env, game, d.holder) : null;
       await countVisit(request, env, ctx, game, 'watch');
       shareDaily(cat, url, ctx);
-      return watchPage(cat, meta, { room: asked, ticket, policy, owner: d.owner, ...(await chatWho(env, game, srv, d.acct)) });
+      return watchPage(cat, meta, { origin: url.origin, room: asked, ticket, policy, owner: d.owner, ...(await chatWho(env, game, srv, d.acct)) });
     }
     if (sub === 'api/watch') {
       if (!door.ok || watchOf(meta) === 'off') return json({ ok: false, error: 'not-found' }, 404);
@@ -1030,6 +1054,7 @@ async function route(request, env, ctx) {
       // game that named none then) and is matched with copies of that build. What it says is its own word, so the
       // Lobby is told it came from an app (`app=1`) and keeps only a few such builds' rooms (LOBBY_APP_VERSIONS).
       const ver = app ? versionOf(url.searchParams.get('gv')) : versionOf(meta?.netplay?.version);
+      if (app && meta?.room?.host === 'server' && ver !== meta.room.build) return json({ ok: false, error: 'stale', message: 'Update the app to play online.' }, 409);
       return lobby().fetch(`https://lobby/join?max=${humanSeats(pol)}&server=${srv.id}&rooms=${srv.roomsMax}${not ? `&not=${encodeURIComponent(not)}` : ''}${ver ? `&ver=${encodeURIComponent(ver)}` : ''}${app ? '&app=1' : ''}`, { method: 'POST' });
     }
     if (sub === 'api/agent') {
@@ -1117,7 +1142,7 @@ async function route(request, env, ctx) {
       const cur = versionOf(meta?.netplay?.version) ?? '';
       const gv = versionOf(url.searchParams.get('gv')) ?? '';
       const stall = Number(meta?.netplay?.stallMs) || 0;
-      const target = `https://table/${sub}?game=${encodeURIComponent(game)}&room=${encodeURIComponent(room)}&max=${max}${b ? `&b=${b}` : ''}${who ? `&via=${encodeURIComponent(who)}` : ''}${sub === '__net' ? `&wp=${policy}${w ? '&w=1' : ''}` : ''}&pol=${encodeFacts(pol)}&chat=${encodeFacts(lean)}${acct ? '&acct=1' : ''}${member ? '&mem=1' : ''}${hub ? '&hub=1' : ''}${ag ? `&ag=${encodeFacts(ag)}` : ''}${badge ? `&bd=${encodeURIComponent(badge)}` : ''}&cur=${encodeURIComponent(cur)}${gv ? `&gv=${encodeURIComponent(gv)}` : ''}${stall ? `&stall=${stall}` : ''}`;
+      const target = `https://table/${sub}?game=${encodeURIComponent(game)}&room=${encodeURIComponent(room)}&max=${max}${b ? `&b=${b}` : ''}${who ? `&via=${encodeURIComponent(who)}` : ''}${sub === '__net' ? `&wp=${policy}${w ? '&w=1' : ''}` : ''}&pol=${encodeFacts(pol)}&chat=${encodeFacts(lean)}${acct ? '&acct=1' : ''}${member ? '&mem=1' : ''}${hub ? '&hub=1' : ''}${ag ? `&ag=${encodeFacts(ag)}` : ''}${badge ? `&bd=${encodeURIComponent(badge)}` : ''}&cur=${encodeURIComponent(cur)}${gv ? `&gv=${encodeURIComponent(gv)}` : ''}${stall ? `&stall=${stall}` : ''}${meta?.room?.host === 'server' ? '&host=server' : ''}`;
       // The room's own failure to answer is told apart from the browser going away while it was connecting (a closed
       // tab, a reload racing its own socket): the second is a departure, said in one line with its room, never an
       // uncaught error with nothing on it.
@@ -1130,6 +1155,7 @@ async function route(request, env, ctx) {
     // The same knock, relative to the game's own page: the same answer (see notAHomie).
     if (sub === '__homie' || sub.startsWith('__homie/')) return notAHomie(request);
     if (sub === '__game' || sub === '__game/' || sub === '__game/index.html') {
+      if (url.searchParams.get('embed') === '1' && (!playerEnabled(cat, meta) || launch !== 'public')) return notFoundPage('Embedding is off for this game.', cat);
       const who = await ticketSub(env, game, url.searchParams.get('t'));
       if (launch !== 'public' && !(await ticketAllows(env, who, launch))) return new Response('This game is not open to you.\n', { status: 403, headers: { 'content-type': 'text/plain; charset=utf-8', 'cache-control': 'no-store' } });
       // An agent's frame (hands `self`): the game plays as that AI.
@@ -1182,6 +1208,18 @@ async function fallback(request, env, url, getCat) {
 }
 
 
+/** A server-hosted room in play keeps the alarm this far ahead; a paused one ends this long after its pause (the relay's `forgetMs`). */
+const ROOM_ALARM_MS = 10 * 60_000;
+const ROOM_PAUSE_MS = 60_000;
+
+/** Watchers, AI seats and restoration never extend an absence. */
+export function roomEndAt({ people, pausedAt, createdAt, restoredAt = null, savedAt = null, alarmAt = null }) {
+  // Only people keep play alive. With no durable alarm, the last save bounds an unrecorded departure.
+  const absence = pausedAt ?? (restoredAt !== null && alarmAt === null ? savedAt : null) ?? restoredAt ?? createdAt;
+  return people > 0 ? Infinity : absence + ROOM_PAUSE_MS;
+}
+
+
 /**
  * TABLE — one public room: the netplay relay (room.mjs) for every browser in it.
  * It keeps nothing per frame; seats and a checkpoint go to storage (a deploy
@@ -1218,8 +1256,23 @@ export class Table {
     this.chatReadAt = 0;
     this.chatPend = { neurons: 0, ok: 0, held: 0, error: 0 };
     this.chatSent = { chatLines: 0, chatReacts: 0, held: {} };
+    /**
+     * Revision 10 (NETPLAY.md section 29): the host runtime of a server-hosted room (rules/host.ts), and when this
+     * room next needs the object's one alarm (the house guides and the day's counters share it).
+     */
+    this.hostRt = null;
+    this.roomAlarmAt = 0;
+    this.durable = null;
+    this.roomSave = null;
+    this.endedRoom = null;
+    this.pausedAt = null;
     ctx.blockConcurrencyWhile(async () => {
+      // Only a confirmed missing alarm permits the save-age fallback. A read failure is not evidence of absence.
+      this.recoveredAlarmAt = Infinity;
+      try { this.recoveredAlarmAt = (await ctx.storage.getAlarm?.()) ?? null; }
+      catch (error) { this.storageProblem(error); }
       this.saved = (await ctx.storage.get('net')) ?? null;
+      if (this.saved?.retired === true) this.cleanupPending = true;
       this.recorded = (await ctx.storage.get('recorded')) ?? 0;
       this.officeSaved = (await ctx.storage.get('office')) ?? null;
     });
@@ -1235,15 +1288,15 @@ export class Table {
       maxPlayers: max,
       perIp: perAddress(max),
       store: {
-        save: (o) => { storage.put('net', o).catch(() => {}); },
-        clear: () => { storage.delete('net').catch(() => {}); },
+        save: (o) => { if (this.hostRt) this.saveRoom(this.hostRt.save()); else if (!hostedGame(game)) storage.put('net', o).catch(() => {}); },
+        clear: () => { this.clearRoom(); },
       },
       // The room's lifecycle, one line each with its time and room (worker/room.mjs `log`): a hello, a leave, an
       // election, a build change, and `failed` (a room operation that threw). A departure and a failure seconds apart
       // are told apart by these. HOMIE_ROOM_LOG=0 keeps only the failures.
       log: (line) => this.say(line),
     });
-    if (this.saved) this.room.restore(this.saved);
+    if (this.saved && !hostedGame(game)) this.room.restore(this.saved);
     if (this.officeSaved) this.room.restoreOffice(this.officeSaved);
     this.vocabRead = this.readVocab(game).catch(() => false);
     // Room chat (section 19): typed text the floor let through waits for the studio's own Workers AI.
@@ -1254,9 +1307,334 @@ export class Table {
     this.room.onUnsaid = (ids) => this.keptQueue(() => forgetLines(this.env, this.game, this.code, ids));
     // A game's own decisions (section 20): the host's typed questions, for a game whose game.json opts in.
     this.room.decider = (state, questions, opts) => this.decide(state, questions, opts);
+    // A server-hosted room that forgets everything (nobody came back, or the owner closed it) ends its host runtime.
+    this.room.onForget = () => { if (this.hostRt) this.finishRoom('forgotten'); };
     return this.room;
   }
 
+  /* ------------------------------------------------------------ the server as host (NETPLAY.md section 29) */
+
+  /**
+   * A room of a server-hosted game gets its host runtime before its first socket is attached, so no browser is ever
+   * elected. `hosted`: the Worker's word that this game's settings say `host: server`. Rules that are missing from
+   * this build, or do not fit the contract, do not start: the room refuses joins and says why.
+   */
+  ensureHost(room, hosted) {
+    if (this.hostRt || !this.game) return;
+    if (!hostedGame(this.game)) {
+      if (hosted) room.failServerHost('This game runs its rules on the server, and this build of the site does not hold them. Build and deploy it again.');
+      return;
+    }
+    let restoring = false;
+    let pauseWriteFailed = false;
+    try {
+      const build = hostedBuild(this.game);
+      try { this.durable ??= roomStore(this.ctx.storage); } catch (error) { this.storageProblem(error); }
+      let saved = this.cleanupPending ? null : this.readRoom();
+      restoring = Boolean(saved);
+      let boot = { epoch: 0, count: 0 };
+      try { boot = this.durable?.boots() ?? boot; } catch (error) { if (saved) throw error; this.storageProblem(error); }
+      if (!Number.isSafeInteger(boot.epoch) || boot.epoch < 0 || !Number.isInteger(boot.count) || boot.count < 0) {
+        const error = new Error('saved boot counter is invalid');
+        if (saved) throw error;
+        this.storageProblem(error); this.clearRoom(); boot = { epoch: 0, count: 0 };
+      }
+      if (saved && saved.buildHash !== build.build) boot.count = 0;
+      // A restore's provisional pause is not a recorded departure. A stored alarm,
+      // even one now due, has not yet confirmed expiry. The alarm handler owns that decision.
+      const restorePause = saved?.pauseFromRestore === true && Date.now() >= saved.pausedAt + ROOM_PAUSE_MS && this.recoveredAlarmAt !== null ? null : saved?.pausedAt;
+      const restoredEnd = saved ? roomEndAt({ people: 0, pausedAt: restorePause, restoredAt: Date.now(), savedAt: saved.at, alarmAt: this.recoveredAlarmAt }) : Infinity;
+      const expired = Date.now() >= restoredEnd;
+      if (saved && (saved.stateHash !== build.stateHash || boot.count >= 2 || expired)) {
+        const why = saved.stateHash !== build.stateHash ? 'state-changed' : boot.count >= 2 ? 'restore loop' : 'nobody-returned';
+        const tokens = new Set((saved.net.seats ?? []).map((s) => s[1]));
+        this.finishRoom(why);
+        room.forget(); room.ended = null;
+        // Only a holder returning to the old match is rematched. A new visitor uses this name immediately.
+        if (!expired) room.endedMatch = { why, ver: build.build, tokens, until: Date.now() + ROOM_PAUSE_MS };
+        this.room = room; saved = null; restoring = false; boot = { epoch: 0, count: 0 };
+      }
+      this.roomSave = saved;
+      if (saved) {
+        // The seat map and the world came from one transaction. No unrelated net write can take a body from its token.
+        room.seats.clear(); room.state.clear(); room.stateBytes = 0;
+        room.restore({ ...saved.net, savedAt: Date.now(), durable: true });
+        this.pausedAt = restoredEnd - ROOM_PAUSE_MS;
+        this.pauseFromRestore = saved.pauseFromRestore = saved.pausedAt === null || saved.pauseFromRestore === true;
+        saved.pausedAt = this.pausedAt;
+        // A failed pause write must never be mistaken for an invalid host save.
+        try { this.durable.write(saved); } catch (error) { pauseWriteFailed = true; this.storageProblem(error); }
+      }
+      const epoch = saved ? Math.max(saved.host.core.epoch, boot.epoch) + 1 : undefined;
+      if (saved) this.durable.boot({ epoch, count: boot.count });
+      this.hostCreatedAt = Date.now();
+      let ticks = 0;
+      this.hostRt = startHost(this.game, {
+        ...(saved ? { restore: new TextEncoder().encode((saved.hostText ?? JSON.stringify(saved.host))), restoreEpoch: epoch, startDelayMs: boot.count === 1 ? restoreDelay(`${this.game}/${this.code}`) : 0 } : {}),
+        store: { save: (bytes) => this.saveRoom(bytes) },
+        onTick: () => {
+          if (!saved) return;
+          ticks += 1;
+          if (ticks === 1) this.pendingBoot = { epoch, count: saved.buildHash !== build.build ? 0 : boot.count + 1 };
+          if (ticks === 10 * build.settings.tickHz) this.pendingBoot = { epoch, count: 0 };
+          if (this.pendingBoot && Date.now() >= (this.bootRetryAt ?? 0)) { try { this.durable.boot(this.pendingBoot); this.pendingBoot = null; this.bootFailures = 0; } catch (error) { this.bootRetryAt = Date.now() + Math.min(60_000, 1000 * 2 ** Math.min(this.bootFailures ?? 0, 6)); this.bootFailures = (this.bootFailures ?? 0) + 1; this.storageProblem(error); } }
+        },
+        send: (m, text) => room.hostFrame(m, text),
+        log: (line) => { if (line.ev === 'persist-failed') this.storageProblem(new Error(line.error)); else this.say(line); },
+        onPause: () => { this.pauseFromRestore = false; this.pausedAt ??= Date.now(); this.armRoom(this.pausedAt + ROOM_PAUSE_MS); },
+        onResume: () => { this.pauseFromRestore = false; this.pausedAt = null; if (this.hostRt) { try { this.saveRoom(this.hostRt.save()); } catch { /* retry already scheduled */ } } this.retimeRound(); this.armRoom(Date.now() + ROOM_ALARM_MS); },
+        onEnd: (why) => this.endHosted(why),
+      });
+      room.setServerHost(this.hostRt);
+      room.gameVer = build.build;
+      room.setCurrent(build.build);
+      if (pauseWriteFailed) { try { this.saveRoom(this.hostRt.save()); } catch { /* the save retry retains the original absence */ } }
+      if (saved) {
+        this.retimeRound();
+        room.hostFrame({ t: 'state', k: 'shared', d: this.hostRt.core.shared() });
+        room.hostFrame({ t: 'snap', from: null, e: epoch, k: this.hostRt.tick, st: Date.now(), d: this.hostRt.core.snapshot(), c: [] });
+      }
+      this.armRoom(roomEndAt({ people: 0, pausedAt: this.pausedAt, createdAt: this.hostCreatedAt }));
+    } catch (error) {
+      this.hostRt?.stop(); this.hostRt = null;
+      if (restoring) {
+        this.storageProblem(error);
+        room.forget(); this.clearRoom();
+        this.skipSave = true;
+        this.ensureHost(room, hosted);
+        return;
+      }
+      room.failServerHost(`This game's rules could not start: ${String(error?.message ?? error).slice(0, 160)}`);
+    }
+  }
+
+  saveRoom(bytes) {
+    const now = Date.now();
+    if (now < (this.saveRetryAt ?? 0)) throw this.saveError ?? new Error('room save retry is waiting');
+    try {
+      this.durable ??= roomStore(this.ctx.storage);
+      const build = hostedBuild(this.game);
+      const host = new TextDecoder().decode(bytes);
+      const saved = { v: 1, game: this.game, room: this.code, at: now, pauseFromRestore: this.hostRt?.paused === true && this.pauseFromRestore === true, pausedAt: this.hostRt?.paused ? this.pausedAt ?? now : null, stateHash: build.stateHash, buildHash: build.build, host, net: this.room.saved() };
+      const clearing = this.cleanupPending;
+      if (clearing) this.durable.clear();
+      this.durable.write(saved);
+      if (clearing) { this.cleanupGeneration = (this.cleanupGeneration ?? 0) + 1; this.queueNetCleanup(false); }
+      this.roomSave = saved; this.cleanupPending = false; clearTimeout(this.cleanupRetry); this.cleanupRetry = null;
+      this.saveFailures = 0; this.saveRetryAt = 0; this.saveError = null;
+      clearTimeout(this.saveRetry); this.saveRetry = null;
+      this.storageHealth = { ok: !this.pendingBoot };
+    } catch (error) {
+      this.saveError = error;
+      const delay = Math.min(60_000, 1000 * 2 ** Math.min(this.saveFailures ?? 0, 6));
+      this.saveFailures = (this.saveFailures ?? 0) + 1; this.saveRetryAt = now + delay;
+      this.storageProblem(error);
+      if (!this.saveRetry) {
+        this.saveRetry = setTimeout(() => {
+          this.saveRetry = null;
+          if (this.hostRt) { try { this.saveRoom(this.hostRt.save()); } catch { /* saveRoom scheduled the next attempt */ } }
+        }, delay);
+        this.saveRetry?.unref?.();
+      }
+      throw error;
+    }
+  }
+
+  retimeRound() {
+    if (!this.hostRt) return;
+    const r = this.hostRt.core.save().round;
+    const period = 1000 / hostedBuild(this.game).settings.tickHz;
+    this.room.hostFrame({ t: 'round', round: { ...this.room.lastRound, n: r[0], phase: r[1] ? 'live' : 'over', endsAt: Date.now() + (r[2] - this.hostRt.tick) * period, startedAt: Date.now() + (r[3] - this.hostRt.tick) * period } });
+  }
+
+  storageProblem(error) {
+    this.storageHealth = { ok: false, message: String(error?.message ?? error).slice(0, 160), since: this.storageHealth?.ok === false ? this.storageHealth.since : Date.now() };
+    if (Date.now() < (this.storageLogAt ?? 0)) return;
+    this.storageLogAt = Date.now() + 1000;
+    this.say({ ev: 'persist-failed', build: hostedBuild(this.game)?.build, error: this.storageHealth.message });
+  }
+
+  readRoom(validateHost = false) {
+    if (this.skipSave) { this.skipSave = false; return null; }
+    try {
+      if (this.durable?.boots()?.retired === true) { this.clearRoom(); return null; }
+      const saved = this.durable?.read();
+      if (!saved) return null;
+      if (saved.v !== 1 || typeof saved.game !== 'string' || typeof saved.room !== 'string' ||
+          this.game && saved.game !== this.game || this.code && saved.room !== this.code ||
+          !Number.isFinite(saved.at) || saved.at < 0 || saved.at > Date.now() + 5000 || saved.pausedAt !== null && (!Number.isFinite(saved.pausedAt) || saved.pausedAt < 0 || saved.pausedAt > Date.now() + 5000) ||
+          saved.pauseFromRestore !== undefined && typeof saved.pauseFromRestore !== 'boolean' ||
+          saved.host?.v !== 1 || !saved.net || typeof saved.stateHash !== 'string' || typeof saved.buildHash !== 'string') throw new Error('save envelope does not fit this room');
+      saved.at = Math.min(saved.at, Date.now());
+      if (saved.pausedAt !== null) saved.pausedAt = Math.min(saved.pausedAt, Date.now());
+      if (hostedGame(saved.game) && saved.stateHash !== hostedBuild(saved.game).stateHash) return saved;
+      this.game ??= saved.game; this.code ??= saved.room;
+      const seats = saved.net.seats;
+      const cap = hostedBuild(saved.game)?.seats ?? 32;
+      if (saved.net.v !== 1 || saved.net.room !== saved.room || !Array.isArray(seats) || seats.length > cap ||
+          new Set(seats.map((s) => s?.[0])).size !== seats.length || new Set(seats.map((s) => s?.[1])).size !== seats.length ||
+          seats.some((s) => !Array.isArray(s) || !Number.isInteger(s[0]) || s[0] < 0 || s[0] >= cap || typeof s[1] !== 'string' || s[1].length > 128 || typeof s[2] !== 'string' || s[2].length > 40 || s[4] !== null && (!Number.isSafeInteger(s[4]) || s[4] < 0) || s[5] !== null && !Number.isFinite(s[5]))) throw new Error('saved seats do not fit this room');
+      if (validateHost && hostedGame(saved.game) && saved.stateHash === hostedBuild(saved.game).stateHash) {
+        const probe = startHost(saved.game, { restore: new TextEncoder().encode(saved.hostText ?? JSON.stringify(saved.host)), send() {} });
+        probe.stop();
+      } else if (!hostedGame(saved.game)) throw new Error('saved game is not in this build');
+      return saved;
+    } catch (error) { this.storageProblem(error); this.clearRoom(); return null; }
+  }
+
+  clearRoom() {
+    this.cleanupGeneration = (this.cleanupGeneration ?? 0) + 1;
+    this.roomSave = null; this.saved = null; this.pendingBoot = null;
+    try { this.durable?.retire(); this.durable?.clear(); this.cleanupPending = false; clearTimeout(this.cleanupRetry); this.cleanupRetry = null; }
+    catch (error) { this.retryCleanup(error); }
+    this.queueNetCleanup(this.cleanupPending);
+  }
+
+  queueNetCleanup(retired) {
+    // The key-value record can preserve retirement when SQL writes, not just deletes, are unavailable.
+    // Serialize it with a later successful save so an older failure cannot retire the new match.
+    const generation = this.cleanupGeneration;
+    this.netCleanup = (this.netCleanup ?? Promise.resolve()).then(() => {
+      if (generation !== this.cleanupGeneration) return;
+      return retired ? this.ctx.storage.put('net', { retired: true }) : this.ctx.storage.delete('net');
+    }).then(() => {
+      if (generation !== this.cleanupGeneration) return;
+      this.netCleanupFailed = false;
+      clearTimeout(this.netCleanupRetry); this.netCleanupRetry = null;
+      if (!this.cleanupPending) this.cleanupFailures = 0;
+    }).catch((error) => {
+      if (generation !== this.cleanupGeneration) return;
+      if (retired) { this.retryCleanup(error); return; }
+      // Removing an old key marker is not permission to delete a newer SQL match.
+      this.netCleanupFailed = true; this.storageProblem(error);
+      const delay = Math.min(60_000, 1000 * 2 ** Math.min(this.cleanupFailures ?? 0, 6));
+      this.cleanupFailures = (this.cleanupFailures ?? 0) + 1;
+      this.armRoom(Date.now() + delay);
+      if (!this.netCleanupRetry) {
+        this.netCleanupRetry = setTimeout(() => { this.netCleanupRetry = null; if (generation === this.cleanupGeneration) this.queueNetCleanup(false); }, delay);
+        this.netCleanupRetry?.unref?.();
+      }
+    });
+    this.ctx.waitUntil(this.netCleanup);
+  }
+
+  retryCleanup(error) {
+    this.cleanupPending = true; this.storageProblem(error);
+    const delay = Math.min(60_000, 1000 * 2 ** Math.min(this.cleanupFailures ?? 0, 6));
+    this.cleanupFailures = (this.cleanupFailures ?? 0) + 1;
+    this.armRoom(Date.now() + delay);
+    // An alarm write can fail as well. Keep the end pending for this object's lifetime.
+    if (!this.cleanupRetry) {
+      this.cleanupRetry = setTimeout(() => { this.cleanupRetry = null; if (this.cleanupPending) this.clearRoom(); }, delay);
+      this.cleanupRetry?.unref?.();
+    }
+  }
+
+  finishRoom(why) {
+    this.hostRt?.stop(); this.hostRt = null;
+    clearInterval(this.timer); this.timer = null;
+    clearTimeout(this.saveRetry); this.saveRetry = null; this.saveRetryAt = 0;
+    this.clearRoom();
+    const room = this.room;
+    if (room) {
+      this.officeSaved = room.officeSaved();
+      room.ended = { why, ver: hostedBuild(this.game)?.build ?? null };
+      for (const w of room.watchers) { try { w.close(1000, 'room-over'); } catch { /* gone */ } }
+      room.watchers.clear();
+    }
+    this.tellLobby({ ended: true });
+    this.say({ ev: 'host-over', why, build: hostedBuild(this.game)?.build, ...(why === 'restore loop' ? { message: 'This room shares its isolate and may not be the cause.' } : {}) });
+    this.room = null; this.endedRoom = null; this.pausedAt = null;
+  }
+
+  /** The room wants the alarm at `at` (ms): set it unless an earlier one is already waiting. */
+  armRoom(at) {
+    this.roomAlarmAt = at;
+    this.alarmWrite = (this.alarmWrite ?? Promise.resolve()).then(async () => {
+      const cur = await this.ctx.storage.getAlarm();
+      if (cur === null || cur > at) await this.ctx.storage.setAlarm(at);
+      this.alarmFailures = 0;
+    }).catch((error) => {
+      this.storageProblem(error);
+      if (this.alarmRetry) return;
+      const delay = Math.min(60_000, 1000 * 2 ** Math.min(this.alarmFailures ?? 0, 6));
+      this.alarmFailures = (this.alarmFailures ?? 0) + 1;
+      this.alarmRetry = setTimeout(() => { this.alarmRetry = null; this.armRoom(this.roomAlarmAt); }, delay);
+      this.alarmRetry?.unref?.();
+    });
+    this.ctx.waitUntil(this.alarmWrite);
+  }
+
+  /**
+   * The rules failed again and again (rules/host.ts: the budget on every tick for two seconds, or slow ticks for
+   * five): the room ends. Its players are told, their seats are freed, and the next visitor starts a fresh room.
+   */
+  endHosted(why) {
+    const room = this.room;
+    if (!room) return;
+    this.finishRoom(why);
+    this.hostRt = null;
+    for (const c of [...room.clients.values()]) {
+      if (c.helloed) room.error(c, 'room-over', 'This room ended. Joining a fresh room.', { rematch: true, ver: room.ended.ver });
+      room.clients.delete(c.id);
+      try { c.conn.close(1011, 'room-over'); } catch { /* gone */ }
+    }
+    room.emptySince = Date.now();
+    room.forget();
+    this.report();
+  }
+
+  /**
+   * The room's part of the alarm (section 4.5 of the design). A room nobody came back to within a minute of its
+   * pause ends: the relay forgets it and its stored seats go (`office` and `recorded` stay). A room in play keeps an
+   * alarm ahead of it, so one that Cloudflare restarted and nobody returned to is still ended. After a restart there
+   * is no room in memory: stored seats of a server-hosted room that nobody reconnected to are deleted.
+   */
+  async roomAlarm() {
+    try { await this.runRoomAlarm(); this.roomAlarmFailures = 0; }
+    catch (error) {
+      this.storageProblem(error);
+      const delay = Math.min(60_000, 1000 * 2 ** Math.min(this.roomAlarmFailures ?? 0, 6));
+      this.roomAlarmFailures = (this.roomAlarmFailures ?? 0) + 1;
+      this.armRoom(Date.now() + delay);
+    }
+  }
+
+  async runRoomAlarm() {
+    if (this.netCleanupFailed) this.queueNetCleanup(false);
+    if (this.cleanupPending) this.clearRoom();
+    const now = Date.now();
+    const room = this.room;
+    if (!room || !this.hostRt) {
+      if (this.ctx.storage.sql?.exec("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'save'").toArray().length) {
+        this.durable ??= roomStore(this.ctx.storage);
+        const saved = this.cleanupPending ? null : this.readRoom(true);
+        if (saved) {
+          this.game = saved.game; this.code = saved.room;
+          if (saved.stateHash !== hostedBuild(saved.game)?.stateHash) { this.finishRoom('state-changed'); return; }
+          // No saved pause means people were present. The first cold wake starts the absence period.
+          if (saved.pausedAt === null) {
+            this.pausedAt ??= now; saved.pausedAt = this.pausedAt; this.durable.write(saved);
+          }
+          const endAt = roomEndAt({ people: 0, pausedAt: saved.pausedAt, createdAt: now });
+          if (now < endAt) { this.armRoom(endAt); return; }
+          this.finishRoom('nobody-returned');
+        }
+      }
+      if (this.saved?.hosted === 'server') { const was = this.saved.room ?? null; this.saved = null; await this.ctx.storage.delete('net').catch(() => {}); this.say({ ev: 'host-over', why: 'nobody-returned', room: was }); }
+      return;
+    }
+    if (!this.hostRt) return;
+    const endAt = roomEndAt({ people: this.hostRt.people, pausedAt: this.pausedAt, createdAt: this.hostCreatedAt });
+    if (endAt === Infinity) { if (now >= this.roomAlarmAt - 1000) this.armRoom(now + ROOM_ALARM_MS); else this.armRoom(this.roomAlarmAt); return; }
+    if (now < endAt) { this.armRoom(endAt); return; }
+    // Nobody returned: neither watchers nor AI seats keep the paused room.
+    this.finishRoom('nobody-returned');
+    for (const c of [...room.clients.values()]) { if (c.helloed) room.error(c, 'room-over', 'Everyone left, so this room ended.', { rematch: true }); room.clients.delete(c.id); try { c.conn.close(1000, 'room-over'); } catch { /* gone */ } }
+    room.forget();
+    this.report();
+  }
+
   /**
    * One log line of this room: `{ at, ev, game, room, … }`. Never a seat token, a ticket, a browser key or an address;
    * a failure goes to the error stream, everything else to the log (and not at all with HOMIE_ROOM_LOG=0).
@@ -1420,7 +1798,8 @@ export class Table {
       if (!talks(room.policy) || !room.vocab || !(room.policy.guides > 0)) return;
       this.house = new HouseAgents({
         room, env: this.env,
-        setAlarm: (at) => { this.ctx.storage.setAlarm(at).catch(() => {}); },
+        // The room's own alarm (a paused server-hosted room ends on it) is never pushed back by a guide's.
+        setAlarm: (at) => { this.ctx.storage.setAlarm(this.roomAlarmAt > Date.now() ? Math.min(at, this.roomAlarmAt) : at).catch(() => {}); },
         budget: { left: (kind) => this.brainCap[kind] - this.brainUsed[kind], spend: (c) => this.brainSpend(c) },
         log: (line) => { try { console.log(JSON.stringify(line)); } catch { /* no console */ } },
       });
@@ -1485,6 +1864,7 @@ export class Table {
     // A brain that throws never takes the room with it: the alarm is not retried, the guides answer from the floor.
     try { if (this.house) await this.house.onAlarm(); } catch (error) { try { console.log(JSON.stringify({ ev: 'brain-alarm-failed', room: this.code, error: String(error?.stack ?? error).slice(0, 400) })); } catch { /* no console */ } }
     try { await this.flushBrain(); } catch { /* counted next time */ }
+    try { await this.roomAlarm(); } catch (error) { this.say({ ev: 'failed', op: 'room-alarm', error: errorLine(error) }); }
   }
 
   async fetch(request) {
@@ -1492,10 +1872,16 @@ export class Table {
     const game = url.searchParams.get('game');
     const code = url.searchParams.get('room');
     const max = Math.max(1, Math.min(SEAT_MAX, Math.floor(Number(url.searchParams.get('max'))) || 8));
+    if (url.pathname === '/__restart') {
+      if (this.env.HOMIE_PREVIEW !== '1' || request.method !== 'POST') return new Response('not found', { status: 404 });
+      // No last-chance save: this measures exactly what a real abrupt restart can lose.
+      setTimeout(() => this.ctx.abort('Preview forced restart'), 25);
+      return json({ ok: true });
+    }
     const room = this.roomFor(game, code, max);
     // The back office (worker/office.mjs), from the studio's Worker only: the room as its owner sees it, and the
     // owner's signed controls, which this room verifies before it applies one (NETPLAY.md section 15).
-    if (url.pathname === '/__facts') return json({ ...room.officeFacts(), ...(this.house ? { brains: this.house.facts() } : {}) });
+    if (url.pathname === '/__facts') return json({ ...room.officeFacts(), durability: this.storageHealth ?? { ok: true }, ...(this.house ? { brains: this.house.facts() } : {}) });
     // A chat line as the room keeps it (section 19), for a report: the Worker files the room's own copy, never a reporter's.
     if (url.pathname === '/__chat') {
       const id = url.searchParams.get('id');
@@ -1521,6 +1907,8 @@ export class Table {
     // Revision 9: the game's own stall time and the build that is live now, the Worker's word with every socket.
     const said = url.searchParams.has('cur');
     if (said) { room.setStall(url.searchParams.get('stall')); room.setCurrent(url.searchParams.get('cur') || null); }
+    // Restore before applying the Worker's current policy: a save must not replace a newer policy.
+    this.ensureHost(room, url.searchParams.get('host') === 'server');
     // The room's policy (section 17), composed by the Worker for every socket: a newer one than the room's applies.
     const pol = decodeFacts(url.searchParams.get('pol'));
     // The room's chat rules ride beside it (they may be longer than a policy): section 19.
@@ -1633,6 +2021,8 @@ export class Table {
       if (n % 4 === 0) { room.tellWatchers(); this.report(); this.recordRound(); this.syncHouse(); }
       // Room chat's counts, once a minute (section 19).
       if (n % 240 === 0) this.ctx.waitUntil(this.flushChat().catch(() => {}));
+      // A server-hosted room in play keeps its alarm ahead of it (re-armed every five minutes of play).
+      if (n % 1200 === 0 && this.hostRt?.running) this.armRoom(Date.now() + ROOM_ALARM_MS);
       if (room.seats.size === 0 && room.clients.size === 0) this.openCounted = false;
       if (room.clients.size === 0 && room.watchers.size === 0) { clearInterval(this.timer); this.timer = null; this.report(); this.ctx.waitUntil(this.flushChat().catch(() => {})); if (this.house) { this.ctx.waitUntil(this.flushBrain(true).catch(() => {})); this.house = null; } }
     }, 250);
@@ -1665,7 +2055,7 @@ export class Table {
   /** Tell the Lobby how many players this room has, when it changes. */
   report() {
     const room = this.room;
-    if (!room || !this.game) return;
+    if (!room || !this.game || this.endedRoom) return;
     const counts = room.facts().counts;
     // Players are people (an agent never counts as one, DESIGN D9); agents and AI bodies are reported apart.
     const players = counts.players;
@@ -1868,6 +2258,7 @@ export class Lobby {
     if (url.pathname === '/report' && request.method === 'POST') {
       const body = await request.json().catch(() => ({}));
       if (typeof body.room !== 'string' || !ROOM_ID.test(body.room)) return json({ ok: false }, 400);
+      if (body.ended === true) { this.rooms.delete(body.room); this.seen.delete(body.room); this.save(); return json({ ok: true }); }
       // The owner closed this room: matched with nobody until then (and forgotten as a public room).
       if (Number.isFinite(body.closed)) {
         if (body.closed > now) { this.closed.set(body.room, body.closed); this.rooms.delete(body.room); } else this.closed.delete(body.room);