@irtio/runtime 0.10.1 → 1.0.0

package/dist/{chunk-EENJ37KK.js → chunk-LT46QFLW.js}

@@ -9,6 +9,181 @@ var RoomFullError = class extends Error {
   name = "RoomFullError";
 };
 
+// src/core/caps.ts
+import {
+  ErrorCode,
+  FrameType,
+  encodeErrorPayload,
+  encodeFrame,
+  formatError
+} from "@irtio/protocol";
+import { encodeSnapshot } from "@irtio/schema";
+var RELAY_STATE_BYTES = 512 * 1024;
+var RELAY_RECORDS_PER_COLLECTION = 1024;
+var RELAY_WRITES_PER_SECOND = 35;
+var DEFAULT_RECORDS_PER_COLLECTION = RELAY_RECORDS_PER_COLLECTION;
+var RELAY_WRITE_CAPS = {
+  stateBytes: RELAY_STATE_BYTES,
+  recordsPerCollection: RELAY_RECORDS_PER_COLLECTION,
+  writesPerSecond: RELAY_WRITES_PER_SECOND
+};
+function refuseByName(core, clientId, code, vars) {
+  const message = formatError(code, vars);
+  core.recordEvent("write-rejected", clientId, `${code}: ${message}`);
+  core.send(
+    clientId,
+    encodeFrame(
+      FrameType.ERROR,
+      encodeErrorPayload({ code: ErrorCode[code].code, message, fatal: false })
+    )
+  );
+}
+function maxTypeBytes(t) {
+  const optional = t.opt ? 1 : 0;
+  switch (t.kind) {
+    case "bool":
+    case "u8":
+      return optional + 1;
+    case "u16":
+      return optional + 2;
+    case "u32":
+    case "i32":
+    case "f32":
+      return optional + 4;
+    case "f64":
+      return optional + 8;
+    case "enum":
+      return optional + 2;
+    case "str":
+      return optional + 5 + t.max * 4;
+    case "ref":
+      return optional + 5 + 64 * 4;
+    case "list":
+      return optional + 5 + t.max * maxTypeBytes(t.item);
+    case "struct": {
+      let sum = optional;
+      for (const f of Object.values(t.fields)) sum += maxTypeBytes(f);
+      return sum;
+    }
+    default:
+      return optional + 8;
+  }
+}
+function maxRecordBytes(c) {
+  let sum = 5 + 64 * 4 + 5 + 64 * 4;
+  for (const f of c.fields) sum += maxTypeBytes(f.type);
+  return sum;
+}
+var STALE_MEASURE_TICKS = 300;
+var StateMeter = class {
+  constructor(core, cap) {
+    this.core = core;
+    this.cap = cap;
+    this.figure = this.measure();
+  }
+  core;
+  cap;
+  /** The running figure: the last exact measure plus every accepted write's upper bound since. */
+  figure;
+  measuredAtTick = -1;
+  measure() {
+    const bytes = encodeSnapshot(this.core.ext, this.core.plain, { tick: this.core.tick });
+    this.measuredAtTick = this.core.tick;
+    return bytes.length;
+  }
+  /** Has the figure gone long enough without an exact measure to be worth distrusting? */
+  stale() {
+    return this.core.tick - this.measuredAtTick >= STALE_MEASURE_TICKS;
+  }
+  /**
+   * The truth, if it is worth paying for: over half the cap, or stale, and at most once a tick.
+   * A small room that is being written to steadily encodes once every {@link STALE_MEASURE_TICKS}
+   * ticks and otherwise uses the running figure, which is why it costs next to nothing.
+   */
+  refresh() {
+    if (this.measuredAtTick === this.core.tick) return;
+    if (this.figure * 2 <= this.cap && !this.stale()) return;
+    this.figure = this.measure();
+  }
+  /** `true` when a write that could add `growth` bytes must be refused. */
+  wouldExceed(growth) {
+    if (this.stale()) this.refresh();
+    if (this.figure + growth <= this.cap) return false;
+    this.refresh();
+    return this.figure + growth > this.cap;
+  }
+  /** Records an accepted write's upper bound. */
+  grew(growth) {
+    this.figure += growth;
+  }
+  /** The current figure, for the room row and `irtio rooms`. Exact when it matters. */
+  bytes() {
+    this.refresh();
+    return this.figure;
+  }
+};
+var states = /* @__PURE__ */ new WeakMap();
+function installCaps(core, caps) {
+  states.set(core, {
+    caps,
+    meter: caps.stateBytes !== void 0 ? new StateMeter(core, caps.stateBytes) : void 0,
+    buckets: /* @__PURE__ */ new Map()
+  });
+}
+function stateOf(core) {
+  let s = states.get(core);
+  if (!s) {
+    s = { caps: {}, meter: void 0, buckets: /* @__PURE__ */ new Map() };
+    states.set(core, s);
+  }
+  return s;
+}
+function recordCap(core) {
+  return stateOf(core).caps.recordsPerCollection ?? DEFAULT_RECORDS_PER_COLLECTION;
+}
+function admitGrowth(core, clientId, growth) {
+  const meter = stateOf(core).meter;
+  if (!meter) return true;
+  if (meter.wouldExceed(growth)) {
+    refuseByName(core, clientId, "E_STATE_CAP", { limit: meter.cap });
+    return false;
+  }
+  meter.grew(growth);
+  return true;
+}
+function stateBytesOf(core) {
+  return stateOf(core).meter?.bytes();
+}
+function admitWrite(core, clientId, nowMs, ops = 1) {
+  const s = stateOf(core);
+  const limit = s.caps.writesPerSecond;
+  if (limit === void 0) return true;
+  const cost = Math.max(1, ops);
+  let bucket = s.buckets.get(clientId);
+  if (!bucket) {
+    bucket = { tokens: limit, at: nowMs, told: false };
+    s.buckets.set(clientId, bucket);
+  }
+  const elapsed = nowMs - bucket.at;
+  if (elapsed > 0) {
+    bucket.tokens = Math.min(limit, bucket.tokens + elapsed * limit / 1e3);
+    bucket.at = nowMs;
+  }
+  if (bucket.tokens >= cost) {
+    bucket.tokens -= cost;
+    bucket.told = false;
+    return true;
+  }
+  if (!bucket.told) {
+    bucket.told = true;
+    refuseByName(core, clientId, "E_WRITE_RATE", { limit });
+  }
+  return false;
+}
+function forgetWriter(core, clientId) {
+  states.get(core)?.buckets.delete(clientId);
+}
+
 // src/core/inspect.ts
 import { EntityCollection } from "@irtio/schema";
 var EVENT_RING_SIZE = 100;
@@ -39,17 +214,20 @@ function inspectState(schema, plain) {
 
 // src/core/rpc.ts
 import {
-  FrameType,
+  ErrorCode as ErrorCode2,
+  FrameType as FrameType2,
+  OWNERSHIP_ASK,
   decodeCall,
   decodeReply,
   encodeCall,
-  encodeFrame,
+  encodeFrame as encodeFrame2,
   encodeReply,
+  isReservedRpcName,
   rpcByIdOf,
   rpcTable
 } from "@irtio/protocol";
 import {
-  SERVER_OWNER,
+  SERVER_OWNER as SERVER_OWNER2,
   decodeFields,
   encodeFields,
   validateValue
@@ -81,15 +259,279 @@ function deepEqual(a, b) {
   return true;
 }
 
+// src/core/ownership.ts
+import { SERVER_OWNER, defaultRecord } from "@irtio/schema";
+var ASK_WINDOW_MS = 5e3;
+var states2 = /* @__PURE__ */ new WeakMap();
+function stateOf2(core) {
+  let s = states2.get(core);
+  if (!s) {
+    s = { holds: /* @__PURE__ */ new Map(), asks: /* @__PURE__ */ new Map(), askUnknownWarned: false };
+    states2.set(core, s);
+  }
+  return s;
+}
+function keyOf(collection, id) {
+  return `${collection} ${id}`;
+}
+function policyCollections(core) {
+  return core.ext.collections.filter(
+    (c) => c.kind === "entity" && c.ownership !== void 0
+  );
+}
+function wallNow(core) {
+  return core.wallNow();
+}
+function holdOn(core, collection, id) {
+  return states2.get(core)?.holds.get(keyOf(collection, id));
+}
+function holdCount(core) {
+  return states2.get(core)?.holds.size ?? 0;
+}
+function placeHolds(core, clientId, playerId) {
+  const s = stateOf2(core);
+  const now = wallNow(core);
+  for (const c of policyCollections(core)) {
+    const policy = c.ownership;
+    const coll = plainEntity(core.plain, c.name);
+    for (const id of [...coll.ids()]) {
+      if (coll.ownerOf(id) !== clientId) continue;
+      const hold = {
+        collection: c.name,
+        id,
+        holder: playerId,
+        deadlineMs: now + policy.holdMs,
+        // `then` is the D77 spec's own name for the leave action; a hold is plain data nothing
+        // ever awaits.
+        // biome-ignore lint/suspicious/noThenProperty: see above
+        then: policy.then
+      };
+      if (policy.holdMs <= 0) {
+        act(core, hold);
+        continue;
+      }
+      s.holds.set(keyOf(c.name, id), hold);
+    }
+  }
+}
+function reclaimHolds(core, clientId, playerId) {
+  const s = states2.get(core);
+  if (!s || s.holds.size === 0) return 0;
+  let reclaimed = 0;
+  for (const [key, hold] of [...s.holds]) {
+    if (hold.holder !== playerId) continue;
+    s.holds.delete(key);
+    const coll = plainEntity(core.plain, hold.collection);
+    if (!coll.has(hold.id)) continue;
+    trackedEntity(core, hold.collection).setOwner(hold.id, clientId);
+    reclaimed++;
+  }
+  return reclaimed;
+}
+function expireHolds(core) {
+  const s = states2.get(core);
+  if (!s || s.holds.size === 0) return;
+  const now = wallNow(core);
+  for (const [key, hold] of [...s.holds]) {
+    if (hold.deadlineMs > now) continue;
+    s.holds.delete(key);
+    act(core, hold);
+  }
+}
+function act(core, hold) {
+  const coll = plainEntity(core.plain, hold.collection);
+  if (!coll.has(hold.id)) return;
+  const tracked = trackedEntity(core, hold.collection);
+  switch (hold.then) {
+    case "remove":
+      tracked.remove(hold.id);
+      return;
+    case "release":
+      tracked.setOwner(hold.id, SERVER_OWNER);
+      return;
+    case "nearest": {
+      const to = nearestConnected(core, hold.collection, hold.id);
+      tracked.setOwner(hold.id, to ?? SERVER_OWNER);
+      return;
+    }
+    case "random": {
+      const candidates = connectedClients(core);
+      if (candidates.length === 0) {
+        tracked.setOwner(hold.id, SERVER_OWNER);
+        return;
+      }
+      const pick = candidates[Math.floor(core.rng.next() * candidates.length)];
+      tracked.setOwner(hold.id, pick);
+      return;
+    }
+    default:
+      return;
+  }
+}
+function connectedClients(core) {
+  const out = [];
+  for (const entry of core.clients.values()) if (entry.connected) out.push(entry.clientId);
+  return out;
+}
+function numberAt(record, field) {
+  if (!record) return void 0;
+  const v = record[field];
+  return typeof v === "number" && Number.isFinite(v) ? v : void 0;
+}
+function distanceTo(core, policy, object, clientId) {
+  const position = policy.position;
+  if (!position || !object) return void 0;
+  const players = plainEntity(core.plain, position.players);
+  const player = players.get(clientId);
+  const px = numberAt(player, position.x);
+  const py = numberAt(player, position.y);
+  const ox = numberAt(object, position.x);
+  const oy = numberAt(object, position.y);
+  if (px === void 0 || py === void 0 || ox === void 0 || oy === void 0)
+    return void 0;
+  return Math.hypot(px - ox, py - oy);
+}
+function nearestConnected(core, collection, id) {
+  const c = core.ext.collections.find((x) => x.name === collection);
+  const policy = c?.ownership;
+  if (!policy?.position) return void 0;
+  const object = plainEntity(core.plain, collection).get(id);
+  let best;
+  let bestDistance = Number.POSITIVE_INFINITY;
+  for (const clientId of connectedClients(core)) {
+    const d = distanceTo(core, policy, object, clientId);
+    if (d === void 0 || d >= bestDistance) continue;
+    bestDistance = d;
+    best = clientId;
+  }
+  return best;
+}
+function addPerPlayerRecords(core, clientId) {
+  for (const c of core.ext.collections) {
+    if (c.kind !== "entity" || !c.perPlayer) continue;
+    const coll = plainEntity(core.plain, c.name);
+    if (coll.has(clientId)) {
+      if (coll.ownerOf(clientId) !== clientId) {
+        trackedEntity(core, c.name).setOwner(clientId, clientId);
+      }
+      continue;
+    }
+    try {
+      trackedEntity(core, c.name).add(clientId, defaultRecord(c), { owner: clientId });
+    } catch (err) {
+      core.log("error", `perPlayer add on ${c.name} failed for ${clientId}:`, err);
+    }
+  }
+}
+function askOn(core, collection, id) {
+  return states2.get(core)?.asks.get(keyOf(collection, id));
+}
+function trackAsk(core, ask) {
+  stateOf2(core).asks.set(keyOf(ask.collection, ask.id), ask);
+}
+function clearAsk(core, collection, id) {
+  states2.get(core)?.asks.delete(keyOf(collection, id));
+}
+function asksInFlight(core) {
+  const s = states2.get(core);
+  return s ? [...s.asks.values()] : [];
+}
+function askCount(core) {
+  return states2.get(core)?.asks.size ?? 0;
+}
+function warnSdkPredatesAsk(core, clientId) {
+  const s = stateOf2(core);
+  if (s.askUnknownWarned) return;
+  s.askUnknownWarned = true;
+  core.log("warn", `client ${clientId}'s SDK predates $ownership.ask; ask auto-declined`);
+}
+function grantOwnership(core, collection, id, clientId) {
+  trackedEntity(core, collection).setOwner(id, clientId);
+}
+function resolveTransfer(core, clientId, c, id) {
+  const policy = c.ownership;
+  const coll = plainEntity(core.plain, c.name);
+  const owner = coll.ownerOf(id);
+  if (owner === clientId) return "granted";
+  const hold = holdOn(core, c.name, id);
+  if (hold) {
+    const playerId = core.clients.get(clientId)?.playerId ?? clientId;
+    if (hold.holder !== playerId) return "refused";
+    reclaimHolds(core, clientId, playerId);
+    return coll.ownerOf(id) === clientId ? "granted" : "refused";
+  }
+  switch (policy.transfer) {
+    case "never":
+      return "refused";
+    case "free":
+      grantOwnership(core, c.name, id, clientId);
+      return "granted";
+    case "closer": {
+      if (owner === void 0 || owner === SERVER_OWNER) {
+        grantOwnership(core, c.name, id, clientId);
+        return "granted";
+      }
+      const object = coll.get(id);
+      const ownerDistance = distanceTo(core, policy, object, owner);
+      if (ownerDistance === void 0) {
+        grantOwnership(core, c.name, id, clientId);
+        return "granted";
+      }
+      const mine = distanceTo(core, policy, object, clientId);
+      if (mine === void 0) return "refused";
+      if (mine + policy.by >= ownerDistance) return "refused";
+      grantOwnership(core, c.name, id, clientId);
+      return "granted";
+    }
+    // ---- M6 ask packet ----
+    case "ask": {
+      if (owner === void 0 || owner === SERVER_OWNER) {
+        grantOwnership(core, c.name, id, clientId);
+        return "granted";
+      }
+      if (core.clients.get(owner)?.connected !== true) return "gone";
+      return "pending";
+    }
+    // ---- end M6 ask packet ----
+    default:
+      return "refused";
+  }
+}
+function serializeHolds(core) {
+  const s = states2.get(core);
+  if (!s || s.holds.size === 0) return void 0;
+  const json = JSON.stringify([...s.holds.values()]);
+  return new TextEncoder().encode(json);
+}
+function restoreHolds(core, bytes) {
+  const s = stateOf2(core);
+  s.holds.clear();
+  if (!bytes || bytes.length === 0) return;
+  try {
+    const parsed = JSON.parse(new TextDecoder().decode(bytes));
+    for (const h of parsed) {
+      if (typeof h?.collection !== "string" || typeof h.id !== "string" || typeof h.holder !== "string" || typeof h.deadlineMs !== "number") {
+        continue;
+      }
+      s.holds.set(keyOf(h.collection, h.id), h);
+    }
+  } catch (err) {
+    core.log("warn", "hold deadlines did not decode; the room wakes holding nothing:", err);
+  }
+}
+
 // src/core/rpc.ts
 var RPC_TIMEOUT_MS = 5e3;
 var REQUEST_OWNERSHIP = "requestOwnership";
-var states = /* @__PURE__ */ new WeakMap();
-function stateOf(core) {
-  let s = states.get(core);
+var RpcTimeoutError = class extends Error {
+};
+var DEFERRED = /* @__PURE__ */ Symbol("deferred reply");
+var states3 = /* @__PURE__ */ new WeakMap();
+function stateOf3(core) {
+  let s = states3.get(core);
   if (!s) {
     s = { nextReqId: 1, pending: /* @__PURE__ */ new Map() };
-    states.set(core, s);
+    states3.set(core, s);
   }
   return s;
 }
@@ -101,7 +543,7 @@ function errorText(code, detail) {
 }
 function sendReply(core, clientId, reqId, result, error) {
   const payload = result === null ? encodeReply({ reqId, ok: false, error: error ?? errorText("E_INTERNAL") }) : encodeReply({ reqId, ok: true, result });
-  core.send(clientId, encodeFrame(FrameType.REPLY, payload));
+  core.send(clientId, encodeFrame2(FrameType2.REPLY, payload));
 }
 function handleCall(core, clientId, payload) {
   let call;
@@ -119,6 +561,16 @@ function handleCall(core, clientId, payload) {
     sendReply(core, clientId, call.reqId, null, errorText("E_RPC_UNKNOWN", `rpcId ${call.rpcId}`));
     return true;
   }
+  if (isReservedRpcName(desc.name)) {
+    sendReply(
+      core,
+      clientId,
+      call.reqId,
+      null,
+      errorText("E_RPC_REJECTED", `${desc.name} is reserved by irtio`)
+    );
+    return true;
+  }
   if (desc.direction !== "server") {
     sendReply(
       core,
@@ -146,7 +598,8 @@ function handleCall(core, clientId, payload) {
   const ctx = { ...core.ctxFor(clientId), clientTick: call.clientTick || void 0 };
   let result;
   if (desc.name === REQUEST_OWNERSHIP) {
-    result = runRequestOwnership(core, clientId, ctx, params);
+    result = runRequestOwnership(core, clientId, ctx, params, call.reqId, desc);
+    if (result === DEFERRED) return true;
   } else {
     const impl = core.definition.config.rpc?.[desc.name];
     if (!impl) {
@@ -175,29 +628,126 @@ function handleCall(core, clientId, payload) {
   }
   return true;
 }
-function runRequestOwnership(core, clientId, ctx, params) {
+function runRequestOwnership(core, clientId, ctx, params, reqId, desc) {
   const name = String(params.entity ?? "");
   const id = String(params.id ?? "");
   const c = collectionDescOf(core.ext, name);
-  if (!c || c.kind !== "entity" || c.serverOwned) return { granted: false };
+  if (!c || c.kind !== "entity" || c.serverOwned) return refused("gone");
   const plain = plainEntity(core.plain, name);
-  if (!plain.has(id)) return { granted: false };
+  if (!plain.has(id)) return refused("gone");
   const handler = core.definition.config.onOwnershipRequest;
   const tracked = trackedEntity(core, name);
+  if (!handler && c.ownership) {
+    if (askOn(core, name, id)) return refused("pending");
+    const verdict = resolveTransfer(core, clientId, c, id);
+    if (verdict === "pending") return beginAsk(core, clientId, name, id, reqId, desc);
+    if (verdict === "gone") return refused("gone");
+    return verdict === "granted" ? granted() : refused("");
+  }
   if (handler) {
     const ran = core.tryRun("onOwnershipRequest", () => handler(core.anyState, name, id, ctx));
     if (ran.ok && ran.value === true && plain.ownerOf(id) !== clientId) {
       tracked.setOwner(id, clientId);
     }
-    return { granted: plain.ownerOf(id) === clientId };
+    return plain.ownerOf(id) === clientId ? granted() : refused("");
   }
   const owner = plain.ownerOf(id);
-  if (owner === clientId) return { granted: true };
-  if (owner !== SERVER_OWNER) return { granted: false };
+  if (owner === clientId) return granted();
+  if (owner !== SERVER_OWNER2) return refused("");
   tracked.setOwner(id, clientId);
-  return { granted: true };
+  return granted();
+}
+function granted() {
+  return { granted: true, reason: "" };
+}
+function refused(reason) {
+  return { granted: false, reason };
+}
+var UNKNOWN_RPC_PREFIX = ErrorCode2.E_RPC_UNKNOWN.message.split("{")[0] ?? "";
+function isUnknownRpcReply(err) {
+  return err.message.startsWith(UNKNOWN_RPC_PREFIX) || err.message.startsWith("E_RPC_UNKNOWN");
+}
+function replyToAsker(core, clientId, reqId, desc, result) {
+  if (!desc.returns) {
+    sendReply(core, clientId, reqId, new Uint8Array(0));
+    return;
+  }
+  sendReply(core, clientId, reqId, encodeFields(desc.returns, result));
+}
+function beginAsk(core, asker, collection, id, askerReqId, askerDesc) {
+  const owner = plainEntity(core.plain, collection).ownerOf(id);
+  if (owner === void 0 || owner === SERVER_OWNER2) return refused("gone");
+  const askDesc = rpcTable(core.definition.schema).find((r) => r.name === OWNERSHIP_ASK);
+  if (!askDesc) {
+    core.log("error", `${OWNERSHIP_ASK} is missing from the rpc table; the ask cannot be sent`);
+    return refused("declined");
+  }
+  let settled = false;
+  const answer = (grant, reason) => {
+    if (settled) return;
+    settled = true;
+    clearAsk(core, collection, id);
+    if (grant) grantOwnership(core, collection, id, asker);
+    replyToAsker(core, asker, askerReqId, askerDesc, grant ? granted() : refused(reason));
+  };
+  const ownerReqId = callClient(
+    core,
+    owner,
+    askDesc,
+    { entity: collection, id, from: asker },
+    {
+      timeoutMs: ASK_WINDOW_MS,
+      resolve: (value) => {
+        const say = value?.granted === true;
+        if (!say) {
+          answer(false, "declined");
+          return;
+        }
+        const coll = plainEntity(core.plain, collection);
+        const stillTheirs = coll.has(id) && coll.ownerOf(id) === owner;
+        const askerHere = core.clients.get(asker)?.connected === true;
+        if (!stillTheirs || !askerHere) {
+          answer(false, "gone");
+          return;
+        }
+        answer(true, "");
+      },
+      reject: (err) => {
+        if (isUnknownRpcReply(err)) warnSdkPredatesAsk(core, owner);
+        answer(false, err instanceof RpcTimeoutError ? "timeout" : "declined");
+      }
+    }
+  );
+  if (settled) return DEFERRED;
+  const ask = {
+    collection,
+    id,
+    asker,
+    owner,
+    ownerReqId,
+    deadlineMs: core.host.now() + ASK_WINDOW_MS,
+    answer
+  };
+  trackAsk(core, ask);
+  return DEFERRED;
+}
+function cancelAsksFor(core, clientId) {
+  for (const ask of asksInFlight(core)) {
+    if (ask.asker !== clientId && ask.owner !== clientId) continue;
+    stateOf3(core).pending.delete(pendingKey(ask.owner, ask.ownerReqId));
+    ask.answer(false, "declined");
+  }
+}
+function cancelAllAsks(core) {
+  for (const ask of asksInFlight(core)) {
+    stateOf3(core).pending.delete(pendingKey(ask.owner, ask.ownerReqId));
+    ask.answer(false, "declined");
+  }
 }
 function descFor(core, name) {
+  if (isReservedRpcName(name)) {
+    throw new Error(`room.call: ${name} is reserved by irtio and cannot be called from room code`);
+  }
   const found = rpcTable(core.definition.schema).find((r) => r.name === name);
   if (!found) throw new Error(`room.call: unknown rpc ${JSON.stringify(name)}`);
   if (found.direction !== "client") {
@@ -206,16 +756,38 @@ function descFor(core, name) {
   return found;
 }
 function sendCall(core, clientId, desc, params) {
-  const s = stateOf(core);
+  const s = stateOf3(core);
   const reqId = s.nextReqId;
   s.nextReqId = s.nextReqId + 1 >>> 0 || 1;
   const bytes = encodeFields(desc.params, params);
   core.send(
     clientId,
-    encodeFrame(FrameType.CALL, encodeCall({ reqId, rpcId: desc.index, params: bytes }))
+    encodeFrame2(FrameType2.CALL, encodeCall({ reqId, rpcId: desc.index, params: bytes }))
   );
   return reqId;
 }
+function callClient(core, clientId, desc, params, settle) {
+  const entry = core.clients.get(clientId);
+  if (!entry || !entry.connected) {
+    core.scheduleContinuationFlush();
+    settle.reject(new Error(`room.call: ${clientId} is not connected`));
+    return 0;
+  }
+  const reqId = sendCall(core, clientId, desc, params);
+  const s = stateOf3(core);
+  s.pending.set(pendingKey(clientId, reqId), {
+    clientId,
+    name: desc.name,
+    returns: desc.returns,
+    deadline: core.host.now() + settle.timeoutMs,
+    resolve: settle.resolve,
+    reject: settle.reject
+  });
+  if (core.mode === "event") {
+    core.loop.after(settle.timeoutMs, () => checkTimeouts(core));
+  }
+  return reqId;
+}
 function createCallProxy(core, clientId) {
   return new Proxy(
     {},
@@ -225,25 +797,11 @@ function createCallProxy(core, clientId) {
         return (params) => {
           const desc = descFor(core, prop);
           return new Promise((resolve, reject2) => {
-            const entry = core.clients.get(clientId);
-            if (!entry || !entry.connected) {
-              core.scheduleContinuationFlush();
-              reject2(new Error(`room.call: ${clientId} is not connected`));
-              return;
-            }
-            const reqId = sendCall(core, clientId, desc, params ?? {});
-            const s = stateOf(core);
-            s.pending.set(pendingKey(clientId, reqId), {
-              clientId,
-              name: desc.name,
-              returns: desc.returns,
-              deadline: core.host.now() + RPC_TIMEOUT_MS,
+            callClient(core, clientId, desc, params ?? {}, {
+              timeoutMs: RPC_TIMEOUT_MS,
               resolve,
               reject: reject2
             });
-            if (core.mode === "event") {
-              core.loop.after(RPC_TIMEOUT_MS, () => checkTimeouts(core));
-            }
           });
         };
       }
@@ -280,7 +838,7 @@ function handleReply(core, clientId, payload) {
     core.log("warn", `REPLY from ${clientId} failed to decode:`, err);
     return false;
   }
-  const s = stateOf(core);
+  const s = stateOf3(core);
   const key = pendingKey(clientId, reply.reqId);
   const pending = s.pending.get(key);
   if (!pending) {
@@ -304,7 +862,7 @@ function handleReply(core, clientId, payload) {
   return true;
 }
 function rejectPendingFor(core, clientId, reason) {
-  const s = stateOf(core);
+  const s = stateOf3(core);
   for (const [key, p] of [...s.pending]) {
     if (p.clientId !== clientId) continue;
     s.pending.delete(key);
@@ -312,17 +870,17 @@ function rejectPendingFor(core, clientId, reason) {
   }
 }
 function checkTimeouts(core) {
-  const s = stateOf(core);
+  const s = stateOf3(core);
   if (s.pending.size === 0) return;
   const now = core.host.now();
   for (const [key, p] of [...s.pending]) {
     if (p.deadline > now) continue;
     s.pending.delete(key);
-    p.reject(new Error(errorText("E_RPC_TIMEOUT", `rpc ${p.name} timed out`)));
+    p.reject(new RpcTimeoutError(errorText("E_RPC_TIMEOUT", `rpc ${p.name} timed out`)));
   }
 }
 function rejectAllPending(core, reason) {
-  const s = stateOf(core);
+  const s = stateOf3(core);
   for (const [key, p] of [...s.pending]) {
     s.pending.delete(key);
     p.reject(new Error(reason));
@@ -330,15 +888,15 @@ function rejectAllPending(core, reason) {
 }
 
 // src/core/loop.ts
-import { FrameType as FrameType2 } from "@irtio/protocol";
+import { FrameType as FrameType3 } from "@irtio/protocol";
 
 // src/core/host-calls.ts
-var states2 = /* @__PURE__ */ new WeakMap();
-function stateOf2(core) {
-  let s = states2.get(core);
+var states4 = /* @__PURE__ */ new WeakMap();
+function stateOf4(core) {
+  let s = states4.get(core);
   if (!s) {
     s = { nextReqId: 1, pending: /* @__PURE__ */ new Map() };
-    states2.set(core, s);
+    states4.set(core, s);
   }
   return s;
 }
@@ -346,12 +904,16 @@ function rejectAsEvent(core, err) {
   core.scheduleContinuationFlush();
   return Promise.reject(err);
 }
+function resolveAsEvent(core, value) {
+  core.scheduleContinuationFlush();
+  return Promise.resolve(value);
+}
 function startHostCall(core, call, map) {
   if (core.stopped) {
     return rejectAsEvent(core, new Error(`room.${call.kind}: the room is stopped`));
   }
   return new Promise((resolve, reject2) => {
-    const s = stateOf2(core);
+    const s = stateOf4(core);
     const reqId = s.nextReqId;
     s.nextReqId = s.nextReqId + 1 >>> 0 || 1;
     s.pending.set(reqId, {
@@ -375,7 +937,7 @@ function startHostCall(core, call, map) {
   });
 }
 function completeHostCall(core, reqId, result) {
-  const s = stateOf2(core);
+  const s = stateOf4(core);
   const pending = s.pending.get(reqId);
   if (!pending) return false;
   s.pending.delete(reqId);
@@ -384,7 +946,7 @@ function completeHostCall(core, reqId, result) {
   return true;
 }
 function checkHostCallTimeouts(core) {
-  const s = stateOf2(core);
+  const s = stateOf4(core);
   if (s.pending.size === 0) return;
   const now = core.host.now();
   for (const [reqId, p] of [...s.pending]) {
@@ -394,7 +956,7 @@ function checkHostCallTimeouts(core) {
   }
 }
 function rejectAllHostCalls(core, reason) {
-  const s = stateOf2(core);
+  const s = stateOf4(core);
   for (const [reqId, p] of [...s.pending]) {
     s.pending.delete(reqId);
     p.reject(new Error(reason));
@@ -403,7 +965,7 @@ function rejectAllHostCalls(core, reason) {
 
 // src/core/writes.ts
 import {
-  SERVER_OWNER as SERVER_OWNER2,
+  SERVER_OWNER as SERVER_OWNER3,
   cloneValue,
   decodeDelta,
   encodeDelta,
@@ -493,6 +1055,9 @@ function applyWrite(core, clientId, payload) {
     core.log("warn", `WRITE from ${clientId} failed to decode:`, err);
     return { ok: false };
   }
+  let ops = 0;
+  for (const dc of delta.collections) ops += dc.ops.length;
+  if (!admitWrite(core, clientId, core.host.now(), ops)) return { ok: true };
   const judged = core.clients.get(clientId);
   if (judged && delta.tick > judged.lastClientTick) {
     judged.lastClientTick = delta.tick;
@@ -513,8 +1078,19 @@ function reject(core, clientId, c, op, reason) {
   correctLeaves(core, clientId, c.name, op.id, leafPaths(fieldList(c), op.mask));
 }
 function applyOp(core, clientId, c, op) {
-  if (op.op !== "update") {
-    reject(core, clientId, c, op, `op '${op.op}' is not allowed in a WRITE`);
+  if (op.op === "add" || op.op === "remove") {
+    if (c.kind !== "entity" || c.serverOwned || !c.clientCreate) {
+      reject(
+        core,
+        clientId,
+        c,
+        op,
+        `op '${op.op}' is not allowed in a WRITE (${c.name} does not declare clientCreate)`
+      );
+      return;
+    }
+    if (op.op === "add") applyAdd(core, clientId, c, op);
+    else applyRemove(core, clientId, c, op);
     return;
   }
   if (c.kind !== "entity") {
@@ -537,26 +1113,28 @@ function applyOp(core, clientId, c, op) {
     return;
   }
   const fields = fieldList(c);
+  const growth = updateGrowth(c, leafPaths(fields, op.mask));
+  if (growth > 0 && !admitGrowth(core, clientId, growth)) return;
   const prev = cloneValue(current);
   const next = cloneValue(current);
   applyMaskedPatch(fields, next, op.patch, op.mask);
   const requested = cloneValue(next);
   const simulated = c.physics;
   if (simulated) {
-    const refused = [];
+    const refused2 = [];
     for (const leaf of leafPaths(fields, op.mask)) {
       const field = leaf.names[0];
       if (simulated.intents.includes(field)) continue;
       next[field] = cloneValue(prev[field]);
-      refused.push(
+      refused2.push(
         simulated.bodyFields.has(field) ? `${field} (simulated)` : `${field} (not an intent)`
       );
     }
-    if (refused.length > 0) {
-      core.recordEvent("write-rejected", clientId, `${c.name}: ${refused.join(", ")}`);
+    if (refused2.length > 0) {
+      core.recordEvent("write-rejected", clientId, `${c.name}: ${refused2.join(", ")}`);
       core.log(
         "warn",
-        `WRITE to ${c.name}.${op.id} from ${clientId} touched fields the owner does not write: ${refused.join(", ")}`
+        `WRITE to ${c.name}.${op.id} from ${clientId} touched fields the owner does not write: ${refused2.join(", ")}`
       );
     }
   }
@@ -594,6 +1172,66 @@ function applyOp(core, clientId, c, op) {
   );
   correctLeaves(core, clientId, c.name, op.id, corrected);
 }
+function applyAdd(core, clientId, c, op) {
+  const plainColl = plainEntity(core.plain, c.name);
+  if (plainColl.has(op.id)) {
+    reject(core, clientId, c, op, `id ${JSON.stringify(op.id)} already exists`);
+    return;
+  }
+  const cap = recordCap(core);
+  if (plainColl.size >= cap) {
+    refuseByName(core, clientId, "E_RECORD_CAP", { entity: c.name, limit: cap });
+    return;
+  }
+  if (!admitGrowth(core, clientId, maxRecordBytes(c))) return;
+  try {
+    trackedEntity(core, c.name).add(op.id, op.value, { owner: clientId });
+  } catch (err) {
+    reject(core, clientId, c, op, `add rejected: ${String(err)}`);
+    return;
+  }
+  core.recordEvent("write", clientId, `${c.name}: added ${op.id}`);
+}
+function applyRemove(core, clientId, c, op) {
+  const plainColl = plainEntity(core.plain, c.name);
+  if (!plainColl.has(op.id)) return;
+  if (plainColl.ownerOf(op.id) !== clientId) {
+    reject(core, clientId, c, op, "not the owner");
+    return;
+  }
+  trackedEntity(core, c.name).remove(op.id);
+  core.recordEvent("write", clientId, `${c.name}: removed ${op.id}`);
+}
+function updateGrowth(c, leaves) {
+  let growth = 0;
+  for (const leaf of leaves) {
+    const first = leaf.path[0];
+    if (first === void 0) continue;
+    const field = c.fields[first];
+    if (!field) continue;
+    const bound = maxTypeBytes(field.type);
+    if (isFixedWidth(field.type)) continue;
+    growth += bound;
+  }
+  return growth;
+}
+function isFixedWidth(t) {
+  switch (t.kind) {
+    case "bool":
+    case "u8":
+    case "u16":
+    case "u32":
+    case "i32":
+    case "f32":
+    case "f64":
+    case "enum":
+      return t.opt !== true;
+    case "struct":
+      return Object.values(t.fields).every(isFixedWidth) && t.opt !== true;
+    default:
+      return false;
+  }
+}
 function serverWinsCorrections(core, dirty) {
   const ext = core.ext;
   for (const [name, cd] of dirty) {
@@ -604,7 +1242,7 @@ function serverWinsCorrections(core, dirty) {
     const fields = fieldList(c);
     for (const [id, rd] of cd.updated) {
       const owner = coll.ownerOf(id);
-      if (owner === void 0 || owner === SERVER_OWNER2) continue;
+      if (owner === void 0 || owner === SERVER_OWNER3) continue;
       const entry = core.clients.get(owner);
       if (!entry || !entry.connected) continue;
       const value = coll.get(id);
@@ -700,8 +1338,8 @@ var Loop = class {
   }
   /** Applies one queued/immediate frame. Returns `false` on a malformed payload. */
   applyFrame(f) {
-    if (f.type === FrameType2.WRITE) return applyWrite(this.core, f.clientId, f.payload).ok;
-    if (f.type === FrameType2.CALL) return handleCall(this.core, f.clientId, f.payload);
+    if (f.type === FrameType3.WRITE) return applyWrite(this.core, f.clientId, f.payload).ok;
+    if (f.type === FrameType3.CALL) return handleCall(this.core, f.clientId, f.payload);
     return true;
   }
   // -------------------------------------------------------------------------
@@ -2088,7 +2726,7 @@ import {
   createDirtySet,
   createFieldMask,
   encodeDelta as encodeDelta2,
-  encodeSnapshot,
+  encodeSnapshot as encodeSnapshot2,
   filterDirty,
   isDirtyEmpty,
   markAdd,
@@ -2195,7 +2833,7 @@ function viewKeyFor(ext, role) {
   return infoOf(ext).scoped.has(role) ? role : "all";
 }
 function encodeViewSnapshot(ext, plain, role, tick, memberships) {
-  return encodeSnapshot(
+  return encodeSnapshot2(
     ext,
     plain,
     { tick },
@@ -2325,7 +2963,7 @@ function catchUpDirty(ext, plain, fromRole, toRole) {
 import { withBuiltins } from "@irtio/protocol";
 import { ByteReader as ByteReader3, ByteWriter as ByteWriter3, decodeSnapshot } from "@irtio/schema";
 var SNAPSHOT_FORMAT_VERSION = 3;
-var READABLE_SNAPSHOT_VERSIONS = [1, 2, 3];
+var READABLE_SNAPSHOT_VERSIONS = [1, 2, 3, 4];
 function parseHibernationBlob(bytes) {
   const r = new ByteReader3(bytes);
   const version = r.u8();
@@ -2342,7 +2980,12 @@ function parseHibernationBlob(bytes) {
     const section = r.blob();
     if (section.length > 0) physics = section;
   }
-  return { version, seed, rngState, tick, mode, schemaHash8, physics, snapshot: r.rest() };
+  let holds;
+  if (version >= 4) {
+    const section = r.blob();
+    if (section.length > 0) holds = section;
+  }
+  return { version, seed, rngState, tick, mode, schemaHash8, physics, holds, snapshot: r.rest() };
 }
 function sameSchemaHash(a, b) {
   if (!a || !b) return true;
@@ -2350,10 +2993,10 @@ function sameSchemaHash(a, b) {
   for (let i = 0; i < a.length; i++) if (a[i] !== b[i]) return false;
   return true;
 }
-function writeHibernationBlob(header, snapshot, physics) {
+function writeHibernationBlob(header, snapshot, physics, holds) {
   const hash = header.schemaHash8;
-  const version = hash ? 3 : physics ? 2 : 1;
-  const w = new ByteWriter3(snapshot.length + (physics?.length ?? 0) + 32);
+  const version = holds && holds.length > 0 ? 4 : hash ? 3 : physics ? 2 : 1;
+  const w = new ByteWriter3(snapshot.length + (physics?.length ?? 0) + (holds?.length ?? 0) + 40);
   w.u8(version);
   w.u32(header.seed >>> 0);
   w.u32(header.rngState >>> 0);
@@ -2361,6 +3004,7 @@ function writeHibernationBlob(header, snapshot, physics) {
   w.u8(header.mode === "event" ? 1 : 0);
   if (hash) w.bytes(hash);
   if (version >= 2) w.blob(physics ?? new Uint8Array(0));
+  if (version >= 4) w.blob(holds ?? new Uint8Array(0));
   w.bytes(snapshot);
   return w.finish();
 }
@@ -2434,23 +3078,23 @@ var TimelineRecorder = class {
 
 // src/core/room.ts
 import {
-  FrameType as FrameType5,
+  FrameType as FrameType6,
   PRESENCE_COLLECTION,
   ProfileLedger,
   busChannelProblem as busChannelProblem2,
   decodeFrame,
   encodeCorrectFrame,
-  encodeFrame as encodeFrame4,
+  encodeFrame as encodeFrame5,
   withBuiltins as withBuiltins2
 } from "@irtio/protocol";
 import {
   cloneValue as cloneValue2,
   createDirtySet as createDirtySet2,
   createState,
-  decodeSnapshot as decodeSnapshot2,
-  encodeDelta as encodeDelta4,
-  encodeSnapshot as encodeSnapshot2,
-  isDirtyEmpty as isDirtyEmpty3,
+  decodeSnapshot as decodeSnapshot3,
+  encodeDelta as encodeDelta5,
+  encodeSnapshot as encodeSnapshot4,
+  isDirtyEmpty as isDirtyEmpty4,
   track,
   validateForDeploy
 } from "@irtio/schema";
@@ -2555,7 +3199,7 @@ var PoseHistory = class {
         const scratch = spec.scratch;
         scratch.fill(0);
         try {
-          spec.read(instance, scratch);
+          spec.read(instance, scratch, id);
           entry.channels.set(scratch, o2);
         } catch (err) {
           if (!this.hookFailed.has(collection)) {
@@ -2709,7 +3353,7 @@ function historyOf(config) {
   }
   return { depth, channels };
 }
-function keyOf(collection, id) {
+function keyOf2(collection, id) {
   return `${collection} ${id}`;
 }
 function angleOf(qz, qw) {
@@ -2734,7 +3378,7 @@ var BaseScratch = class {
     this.sync();
     this.present.clear();
     for (let i = 0; i < entry.count; i++) {
-      const key = keyOf(entry.collections[i], entry.ids[i]);
+      const key = keyOf2(entry.collections[i], entry.ids[i]);
       const e = this.bodies.get(key);
       if (!e) continue;
       poseAt(entry, i, this.pose);
@@ -2760,7 +3404,7 @@ var BaseScratch = class {
     const now = this.tickNow();
     const seen = /* @__PURE__ */ new Set();
     this.physics.eachTrackedBody((collection, id, body) => {
-      const key = keyOf(collection, id);
+      const key = keyOf2(collection, id);
       seen.add(key);
       const signature = this.signatureOf(body);
       const existing = this.bodies.get(key);
@@ -3205,13 +3849,13 @@ function lobbyConfigOf(core) {
   if (!schemaHasLobby(core.definition.schema)) return void 0;
   return declared;
 }
-function stateOf3(core) {
+function stateOf5(core) {
   return core.anyState[LOBBY_STATE];
 }
 function evaluateLobby(core) {
   const config = lobbyConfigOf(core);
   if (config === void 0) return;
-  const state = stateOf3(core);
+  const state = stateOf5(core);
   if (state === void 0) return;
   const members = trackedEntity(core, LOBBY_MEMBERS);
   const policy = config.start ?? "when-full";
@@ -3250,7 +3894,7 @@ function evaluateLobby(core) {
 function startLobby(core, why) {
   const runtime = runtimeOf(core);
   if (runtime.started) return;
-  const state = stateOf3(core);
+  const state = stateOf5(core);
   if (state === void 0 || state.phase === "started") {
     runtime.started = true;
     return;
@@ -3273,7 +3917,7 @@ function makeLobby(core) {
       "room.lobby: this room has no lobby. Spread lobbyCollections into the schema and declare lobby: {} in defineRoom \u2014 both are needed, and defineRoom refuses either one alone"
     );
   }
-  const state = stateOf3(core);
+  const state = stateOf5(core);
   const members = trackedEntity(core, LOBBY_MEMBERS);
   return {
     get phase() {
@@ -3311,7 +3955,7 @@ function makeLobby(core) {
 function setLobbyPublic(core, value) {
   const config = lobbyConfigOf(core);
   if (config === void 0) return;
-  const state = stateOf3(core);
+  const state = stateOf5(core);
   if (state === void 0) return;
   if (state.phase === "started") {
     core.log(
@@ -3330,7 +3974,15 @@ function setLobbyPublic(core, value) {
 }
 
 // src/core/messages.ts
-import { FrameType as FrameType3, decodeMsg, encodeFrame as encodeFrame2, encodeMsg } from "@irtio/protocol";
+import {
+  FrameType as FrameType4,
+  decodeChatMsg,
+  decodeMsg,
+  encodeChatMsg,
+  encodeFrame as encodeFrame3,
+  encodeMsg,
+  isChatMsg
+} from "@irtio/protocol";
 import { decodeFields as decodeFields2 } from "@irtio/schema";
 function toRoomTarget(target) {
   switch (target.kind) {
@@ -3378,6 +4030,7 @@ function decodeTyped(core, clientId, index, payload) {
 }
 function handleMsg(core, clientId, payload) {
   core.recordEvent("msg", clientId);
+  if (isChatMsg(payload)) return handleChat(core, clientId, payload);
   let msg;
   try {
     msg = decodeMsg(payload);
@@ -3410,8 +4063,8 @@ function handleMsg(core, clientId, payload) {
     if (!ran.ok || ran.value === false) return true;
   }
   if (msg.target.kind === "server") return true;
-  const frame = encodeFrame2(
-    FrameType3.MSG,
+  const frame = encodeFrame3(
+    FrameType4.MSG,
     encodeMsg({
       target: { kind: "client", clientId },
       payload: msg.payload,
@@ -3421,32 +4074,785 @@ function handleMsg(core, clientId, payload) {
   deliver(core, msg.target, frame, clientId);
   return true;
 }
+function handleChat(core, clientId, payload) {
+  let chat;
+  try {
+    chat = decodeChatMsg(payload);
+  } catch (err) {
+    core.log("warn", `chat from ${clientId} failed to decode:`, err);
+    return false;
+  }
+  if (chat.target.kind !== "all" && chat.target.kind !== "client") {
+    core.stats.messagesDropped++;
+    return true;
+  }
+  const onChat = core.definition.config.onChat;
+  if (onChat) {
+    const line = {
+      from: clientId,
+      text: chat.text,
+      target: chat.target.kind === "all" ? "all" : chat.target.clientId
+    };
+    const ran = core.tryRun("onChat", () => onChat(core.anyState, line, core.ctxFor(clientId)));
+    if (!ran.ok || ran.value === false) return true;
+  }
+  const frame = encodeFrame3(
+    FrameType4.MSG,
+    encodeChatMsg({ target: { kind: "client", clientId }, text: chat.text })
+  );
+  deliver(core, chat.target, frame, clientId);
+  return true;
+}
 function wireTargetOf(target) {
   return target === "all" ? { kind: "all" } : typeof target === "string" ? { kind: "client", clientId: target } : { kind: "role", role: target.role };
 }
 function sendMessage(core, target, bytes) {
-  const frame = encodeFrame2(
-    FrameType3.MSG,
+  const frame = encodeFrame3(
+    FrameType4.MSG,
     encodeMsg({ target: { kind: "server" }, payload: bytes })
   );
   deliver(core, wireTargetOf(target), frame);
 }
 function sendTypedMessage(core, index, target, payload) {
-  const frame = encodeFrame2(
-    FrameType3.MSG,
+  const frame = encodeFrame3(
+    FrameType4.MSG,
     encodeMsg({ target: { kind: "server" }, payload, typed: { index } })
   );
   deliver(core, wireTargetOf(target), frame);
 }
 
+// src/core/replay.ts
+import {
+  CLIP_MAX_BYTES,
+  CLIP_TTL_DEFAULT_MS,
+  RECORDING_MAX_BYTES,
+  clipExpiryEpochS,
+  encodeClip,
+  encodeRecordingChunk,
+  parseRetention
+} from "@irtio/protocol";
+import {
+  encodeDelta as encodeDelta3,
+  encodeSnapshot as encodeSnapshot3,
+  isDirtyEmpty as isDirtyEmpty2
+} from "@irtio/schema";
+
+// src/core/replay-excerpt.ts
+import {
+  applyDelta,
+  decodeDelta as decodeDelta2,
+  decodeSnapshot as decodeSnapshot2
+} from "@irtio/schema";
+var EXCERPT_MAX_SECONDS = 30;
+var EXCERPT_BURST = 4;
+var EXCERPT_COOLDOWN_MS = 1e3;
+var EXCERPT_MAX_BYTES = 4 * 1024 * 1024;
+var ExcerptTooLargeError = class extends Error {
+  constructor(bytes) {
+    super(`excerpt output passed ${EXCERPT_MAX_BYTES} bytes`);
+    this.bytes = bytes;
+    this.name = "ExcerptTooLargeError";
+  }
+  bytes;
+};
+function estimateValue(value) {
+  if (typeof value === "string") return value.length + 2;
+  if (Array.isArray(value)) {
+    let n = 2;
+    for (const v of value) n += estimateValue(v) + 1;
+    return n;
+  }
+  if (typeof value === "object" && value !== null) {
+    let n = 2;
+    for (const [k, v] of Object.entries(value)) {
+      n += k.length + 3 + estimateValue(v);
+    }
+    return n;
+  }
+  return 8;
+}
+function copyValue(value) {
+  if (Array.isArray(value)) return value.map(copyValue);
+  if (typeof value === "object" && value !== null) {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) out[k] = copyValue(v);
+    return out;
+  }
+  return value;
+}
+function projectTick(state, wanted, ids) {
+  const entities = {};
+  let bytes = 0;
+  for (const desc of wanted) {
+    const coll = state[desc.name];
+    if (coll === void 0) continue;
+    const rows = {};
+    let any = false;
+    for (const id of [...coll.ids()]) {
+      if (ids !== void 0 && !ids.has(id)) continue;
+      const record = coll.get(id);
+      if (record === void 0) continue;
+      const row = {};
+      for (const field of desc.fields) {
+        const v = record[field.name];
+        if (v === void 0) continue;
+        row[field.name] = copyValue(v);
+        bytes += field.name.length + 3 + estimateValue(v);
+      }
+      bytes += id.length + 4;
+      rows[id] = row;
+      any = true;
+    }
+    if (any) {
+      bytes += desc.name.length + 4;
+      entities[desc.name] = rows;
+    }
+  }
+  return { entities, bytes };
+}
+function wantedCollections(ext, names) {
+  const all = ext.collections.filter((c) => c.kind === "entity");
+  if (names === void 0) return [...all];
+  const wanted = new Set(names);
+  return all.filter((c) => wanted.has(c.name));
+}
+function unknownCollection(ext, options) {
+  const names = options?.collections;
+  if (names === void 0) return void 0;
+  const known = new Set(
+    ext.collections.filter((c) => c.kind === "entity").map((c) => c.name)
+  );
+  for (const name of names) {
+    if (!known.has(name)) return String(name);
+  }
+  return void 0;
+}
+function walkExcerpt(ext, ring, tickRate, seconds, options) {
+  const ringFrames = ring.frames;
+  const last = ringFrames[ringFrames.length - 1];
+  if (last === void 0) return { startTick: 0, endTick: 0, tickRate, frames: [] };
+  const from = last.tick - Math.ceil(seconds * tickRate);
+  const window = ring.tail(from);
+  const head = window[0];
+  if (head === void 0 || !head.keyframe) {
+    return { startTick: 0, endTick: 0, tickRate, frames: [] };
+  }
+  const wanted = wantedCollections(ext, options?.collections);
+  const ids = options?.ids === void 0 ? void 0 : new Set(options.ids);
+  const state = decodeSnapshot2(ext, head.bytes).state;
+  const frames = [];
+  let bytes = 0;
+  const emit = (tick) => {
+    if (tick < from) return;
+    const { entities, bytes: n } = projectTick(state, wanted, ids);
+    bytes += n;
+    if (bytes > EXCERPT_MAX_BYTES) throw new ExcerptTooLargeError(bytes);
+    frames.push({ tick, entities });
+  };
+  if (window[1]?.tick !== head.tick) emit(head.tick);
+  for (let i = 1; i < window.length; i++) {
+    const f = window[i];
+    if (f.keyframe) continue;
+    applyDelta(ext, state, decodeDelta2(ext, f.bytes));
+    emit(f.tick);
+  }
+  const first = frames[0];
+  return {
+    startTick: first?.tick ?? head.tick,
+    endTick: frames[frames.length - 1]?.tick ?? head.tick,
+    tickRate,
+    frames
+  };
+}
+
+// src/core/replay.ts
+var REPLAY_DEFAULT_SECONDS = 60;
+var REPLAY_MAX_SECONDS = 300;
+var REPLAY_RING_MAX_BYTES = 8 * 1024 * 1024;
+var REPLAY_KEYFRAME_SECONDS = 2;
+var CLIP_COOLDOWN_MS = 1e3;
+var CLIP_BURST = 8;
+var ReplayRing = class {
+  /**
+   * M6 record packet: `onEvict` is handed every segment the ring drops, oldest first, at the
+   * moment it drops it — which is the whole of what a recording is. It is optional and unset in
+   * every room that did not ask to record, so the ring a clip-only room runs is the ring it ran
+   * before this packet, allocation for allocation.
+   *
+   * A *wipe* deliberately does not call it. A wipe is one segment that outgrew the entire ring, so
+   * emitting it would mean writing a chunk bigger than the bound the ring exists to keep. For a
+   * clip that is "holds less footage than it asked for"; for a recording it is not, because the
+   * frames after the wipe are deltas whose keyframe was never written, and playback skips
+   * mid-stream keyframes rather than re-basing on them. So a wipe is not silently less footage: it
+   * ENDS the recording (`append` returns `true` and the flush tap stops it), which turns wrong
+   * footage into short footage.
+   */
+  constructor(bounds, onEvict) {
+    this.bounds = bounds;
+    this.onEvict = onEvict;
+  }
+  bounds;
+  onEvict;
+  items = [];
+  total = 0;
+  /** How many times an oversized segment has emptied the ring. Read through `append`'s return. */
+  wipes = 0;
+  /** The tick the newest keyframe went in at; `-1` while the ring is empty. */
+  lastKeyframeTick = -1;
+  get frames() {
+    return this.items;
+  }
+  get bytes() {
+    return this.total;
+  }
+  get empty() {
+    return this.items.length === 0;
+  }
+  /** How many oversized segments have emptied the ring. A test's handle on the degenerate case. */
+  get wipeCount() {
+    return this.wipes;
+  }
+  /**
+   * Appends a frame and trims. Returns `true` when the trim had to throw the *whole* ring away
+   * (an oversized segment with nowhere to cut), which the caller has to know about: the ring is
+   * now empty, so anything it was about to append next would head the ring without a keyframe.
+   */
+  append(frame) {
+    this.items.push(frame);
+    this.total += frame.bytes.length;
+    if (frame.keyframe) this.lastKeyframeTick = frame.tick;
+    const before = this.wipes;
+    this.trim();
+    return this.wipes !== before;
+  }
+  /** Is a keyframe due at `tick`? Always true while the ring is empty. */
+  keyframeDue(tick) {
+    return this.empty || tick - this.lastKeyframeTick >= this.bounds.keyframeEvery;
+  }
+  /** The frames from the newest keyframe at or before `fromTick` to the end. */
+  tail(fromTick) {
+    let start = 0;
+    for (let i = 0; i < this.items.length; i++) {
+      const f = this.items[i];
+      if (f.keyframe && f.tick <= fromTick) start = i;
+    }
+    return this.items.slice(start);
+  }
+  trim() {
+    const last = this.items[this.items.length - 1];
+    if (!last) return;
+    for (; ; ) {
+      const head = this.items[0];
+      if (!head) return;
+      const overBytes = this.total > this.bounds.maxBytes;
+      const overWindow = last.tick - head.tick > this.bounds.windowTicks;
+      if (!overBytes && !overWindow) return;
+      let next = -1;
+      for (let i = 1; i < this.items.length; i++) {
+        if (this.items[i]?.keyframe === true) {
+          next = i;
+          break;
+        }
+      }
+      if (next === -1) {
+        if (!overBytes) return;
+        this.items = [];
+        this.total = 0;
+        this.lastKeyframeTick = -1;
+        this.wipes++;
+        return;
+      }
+      for (let i = 0; i < next; i++) this.total -= this.items[i].bytes.length;
+      const evicted = this.items.slice(0, next);
+      this.items = this.items.slice(next);
+      this.onEvict?.(evicted);
+    }
+  }
+};
+var RECORD_QUEUE_MAX = 2;
+var states5 = /* @__PURE__ */ new WeakMap();
+function configOf(core) {
+  const config = core.definition.config;
+  return config.replay;
+}
+function replayArmed(core) {
+  return configOf(core) !== void 0;
+}
+function stateOf6(core) {
+  const declared = configOf(core);
+  if (declared === void 0) return void 0;
+  let s = states5.get(core);
+  if (!s) {
+    const tickRate = core.definition.config.tickRate ?? 20;
+    const seconds = Math.min(
+      REPLAY_MAX_SECONDS,
+      Math.max(1, Math.floor(declared.seconds ?? REPLAY_DEFAULT_SECONDS))
+    );
+    const record = declared.record === true;
+    const outbox = [];
+    const ttlMs = parseRetention(declared.ttl) ?? CLIP_TTL_DEFAULT_MS;
+    s = {
+      seconds,
+      ttlMs,
+      recExpiresAtEpochS: void 0,
+      view: declared.view ?? "",
+      ring: new ReplayRing(
+        {
+          windowTicks: Math.max(1, Math.ceil(seconds * tickRate)),
+          keyframeEvery: Math.max(1, Math.round(REPLAY_KEYFRAME_SECONDS * tickRate)),
+          maxBytes: REPLAY_RING_MAX_BYTES
+        },
+        record ? (frames) => outbox.push(...frames) : void 0
+      ),
+      clipTokens: CLIP_BURST,
+      lastRefillAt: Number.NEGATIVE_INFINITY,
+      clipsTaken: 0,
+      excerptTokens: EXCERPT_BURST,
+      lastExcerptRefillAt: Number.NEGATIVE_INFINITY,
+      excerptsTaken: 0,
+      disarmed: false,
+      record,
+      outbox,
+      queued: [],
+      recId: void 0,
+      nextSeq: 0,
+      encoded: 0,
+      recBytes: 0,
+      inFlight: false,
+      recStopped: false,
+      recWarned: false,
+      recExpiryWarned: false,
+      finalDrained: false,
+      dropInFlight: false,
+      chunksOut: 0
+    };
+    states5.set(core, s);
+  }
+  return s;
+}
+function omniscientMemberships(core) {
+  const out = /* @__PURE__ */ new Map();
+  for (const desc of core.ext.collections) {
+    if (desc.visibility !== "spatial-grid") continue;
+    out.set(desc.name, new Set(plainEntity(core.plain, desc.name).ids()));
+  }
+  return out;
+}
+function hasRoleScoped(core) {
+  return core.ext.collections.some((c) => c.visibility === "role");
+}
+function hasSpatial(core) {
+  return core.ext.collections.some(
+    (c) => c.visibility === "spatial-grid"
+  );
+}
+function recorderSnapshot(core, state) {
+  if (state.view === "") {
+    return encodeSnapshot3(core.ext, core.plain, { tick: core.tick });
+  }
+  return encodeViewSnapshot(
+    core.ext,
+    core.plain,
+    state.view,
+    core.tick,
+    omniscientMemberships(core)
+  );
+}
+function recorderDelta(core, state, dirty) {
+  if (state.view === "") {
+    if (isDirtyEmpty2(dirty)) return null;
+    return encodeDelta3(core.ext, core.plain, dirty, { tick: core.tick });
+  }
+  return encodeViewDelta(core.ext, core.plain, dirty, state.view, core.tick);
+}
+function cacheKeyFor(core, state) {
+  if (hasSpatial(core)) return void 0;
+  if (state.view === "") return hasRoleScoped(core) ? void 0 : "all";
+  return viewKeyFor(core.ext, state.view);
+}
+function recordFlush(core, dirty, byView) {
+  const state = stateOf6(core);
+  if (!state || state.disarmed) return;
+  appendFlush(core, state, dirty, byView);
+  if (state.record) pumpDrain(core, state);
+}
+function appendFlush(core, state, dirty, byView) {
+  const ring = state.ring;
+  if (!ring.empty && isDirtyEmpty2(dirty)) return;
+  if (ring.keyframeDue(core.tick)) {
+    const wiped2 = ring.append({
+      tick: core.tick,
+      keyframe: true,
+      bytes: recorderSnapshot(core, state)
+    });
+    if (wiped2) {
+      disarm(core, state);
+      return;
+    }
+  }
+  const key = cacheKeyFor(core, state);
+  const cached = key === void 0 ? void 0 : byView.get(key);
+  const delta = cached ?? recorderDelta(core, state, dirty);
+  if (!delta) return;
+  const wiped = ring.append({ tick: core.tick, keyframe: false, bytes: delta });
+  if (wiped && state.record) {
+    stopRecording(
+      core,
+      state,
+      `one replay segment was larger than the whole ${REPLAY_RING_MAX_BYTES}-byte ring, so the ring was emptied and the footage after it could not be re-based`
+    );
+  }
+}
+function disarm(core, state) {
+  state.disarmed = true;
+  if (state.record) stopRecording(core, state, "the replay ring disarmed");
+  core.host.log("warn", [
+    `irtio: room ${core.roomId}: a single replay keyframe is larger than the replay ring's ${REPLAY_RING_MAX_BYTES}-byte bound, so nothing could ever be held. Recording is off for the life of this room and room.replay.clip() will refuse. Record a narrower view (\`replay: { view: <role> }\`) or hold less state in the recorded collections.`
+  ]);
+}
+function assembleClip(core, seconds) {
+  const state = stateOf6(core);
+  if (!state || state.disarmed || state.ring.empty) return void 0;
+  const tickRate = core.definition.config.tickRate ?? 20;
+  const want = Math.min(state.seconds, Math.max(1, Math.floor(seconds ?? state.seconds)));
+  const ringFrames = state.ring.frames;
+  const last = ringFrames[ringFrames.length - 1];
+  const frames = state.ring.tail(last.tick - Math.ceil(want * tickRate)).map((f) => ({
+    tick: f.tick,
+    kind: f.keyframe ? "keyframe" : "delta",
+    bytes: f.bytes
+  }));
+  const head = frames[0];
+  if (head === void 0 || head.kind !== "keyframe") return void 0;
+  const clip = {
+    // The GAME schema's hash, not the extended one's. That is what a client puts in its HELLO,
+    // so it is the value playback can actually compare against — and it is the hash a deploy
+    // changes, which is the whole thing the pin exists to catch.
+    schemaHash8: core.definition.schema.hash8,
+    tickRate,
+    startTick: head.tick,
+    durationTicks: last.tick - head.tick,
+    view: state.view,
+    frames
+  };
+  return encodeClip(clip);
+}
+function takeClip(core, seconds) {
+  if (!replayArmed(core)) {
+    return rejectAsEvent(
+      core,
+      new Error(
+        "room.replay.clip: this room type did not declare `replay:`, so nothing is being recorded. Add `replay: { seconds: 60 }` to the room config to arm the ring."
+      )
+    );
+  }
+  const state = stateOf6(core);
+  const now = core.host.now();
+  if (state.lastRefillAt === Number.NEGATIVE_INFINITY) state.lastRefillAt = now;
+  const refilled = Math.floor((now - state.lastRefillAt) / CLIP_COOLDOWN_MS);
+  if (refilled > 0) {
+    state.clipTokens = Math.min(CLIP_BURST, state.clipTokens + refilled);
+    state.lastRefillAt += refilled * CLIP_COOLDOWN_MS;
+  }
+  if (state.clipTokens <= 0) {
+    return rejectAsEvent(
+      core,
+      new Error(
+        `E_CLIP_COOLDOWN: room.replay.clip allows bursts of ${CLIP_BURST}, refilled one every ${CLIP_COOLDOWN_MS}ms per room; this room is out of clip tokens right now`
+      )
+    );
+  }
+  if (state.disarmed) {
+    return rejectAsEvent(
+      core,
+      new Error(
+        `E_CLIP_DISARMED: recording stopped in this room because a single replay keyframe was larger than the ${REPLAY_RING_MAX_BYTES}-byte replay ring; see the warning on this room's log`
+      )
+    );
+  }
+  let bytes;
+  try {
+    bytes = assembleClip(core, seconds);
+  } catch (err) {
+    return rejectAsEvent(
+      core,
+      new Error(`E_CLIP_ENCODE: the replay ring could not be encoded: ${String(err)}`)
+    );
+  }
+  if (bytes === void 0) {
+    return rejectAsEvent(
+      core,
+      new Error("E_CLIP_EMPTY: the replay ring is empty \u2014 this room has not flushed a change yet")
+    );
+  }
+  if (bytes.length > CLIP_MAX_BYTES) {
+    return rejectAsEvent(
+      core,
+      new Error(
+        `E_CLIP_TOO_LARGE: this clip is ${bytes.length} bytes and the limit is ${CLIP_MAX_BYTES}`
+      )
+    );
+  }
+  state.clipTokens--;
+  state.clipsTaken++;
+  return startHostCall(
+    core,
+    { kind: "clip", bytes, expiresAtEpochS: clipExpiryEpochS(core.wallNow(), state.ttlMs) },
+    (value) => ({ id: value ?? "" })
+  );
+}
+function takeExcerpt(core, options) {
+  if (!replayArmed(core)) {
+    return rejectAsEvent(
+      core,
+      new Error(
+        "E_REPLAY_UNARMED: room.replay.excerpt: this room type did not declare `replay:`, so nothing is being recorded. Add `replay: { seconds: 60 }` to the room config to arm the ring."
+      )
+    );
+  }
+  const seconds = options?.seconds;
+  if (typeof seconds !== "number" || !Number.isFinite(seconds) || seconds <= 0) {
+    return rejectAsEvent(
+      core,
+      new Error(
+        "E_EXCERPT_BAD_ARGS: room.replay.excerpt needs { seconds } as a positive number, got " + JSON.stringify(seconds)
+      )
+    );
+  }
+  if (seconds > EXCERPT_MAX_SECONDS) {
+    return rejectAsEvent(
+      core,
+      new Error(
+        `E_EXCERPT_TOO_LONG: room.replay.excerpt decodes at most ${EXCERPT_MAX_SECONDS} seconds at a time and was asked for ${seconds}. An excerpt is a killcam, not a match; for a whole match use \`replay: { record: true }\`.`
+      )
+    );
+  }
+  const badName = unknownCollection(core.ext, options);
+  if (badName !== void 0) {
+    return rejectAsEvent(
+      core,
+      new Error(
+        `E_EXCERPT_BAD_ARGS: room.replay.excerpt was asked for the collection ${JSON.stringify(
+          badName
+        )}, which is not an entity collection in this room's schema. Singleton collections are not excerptable.`
+      )
+    );
+  }
+  const state = stateOf6(core);
+  if (state.disarmed) {
+    return rejectAsEvent(
+      core,
+      new Error(
+        `E_EXCERPT_DISARMED: recording stopped in this room because a single replay keyframe was larger than the ${REPLAY_RING_MAX_BYTES}-byte replay ring; see the warning on this room's log`
+      )
+    );
+  }
+  const now = core.host.now();
+  if (state.lastExcerptRefillAt === Number.NEGATIVE_INFINITY) state.lastExcerptRefillAt = now;
+  const refilled = Math.floor((now - state.lastExcerptRefillAt) / EXCERPT_COOLDOWN_MS);
+  if (refilled > 0) {
+    state.excerptTokens = Math.min(EXCERPT_BURST, state.excerptTokens + refilled);
+    state.lastExcerptRefillAt += refilled * EXCERPT_COOLDOWN_MS;
+  }
+  if (state.excerptTokens <= 0) {
+    return rejectAsEvent(
+      core,
+      new Error(
+        `E_EXCERPT_COOLDOWN: room.replay.excerpt allows bursts of ${EXCERPT_BURST}, refilled one every ${EXCERPT_COOLDOWN_MS}ms per room; this room is out of excerpt tokens right now`
+      )
+    );
+  }
+  state.excerptTokens--;
+  const tickRate = core.definition.config.tickRate ?? 20;
+  let out;
+  try {
+    out = walkExcerpt(core.ext, state.ring, tickRate, seconds, options);
+  } catch (err) {
+    if (err instanceof ExcerptTooLargeError) {
+      return rejectAsEvent(
+        core,
+        new Error(
+          `E_EXCERPT_TOO_LARGE: this excerpt would materialize about ${err.bytes} bytes of frames and the limit is ${EXCERPT_MAX_BYTES}. Ask for fewer seconds, or name the collections (and ids) you actually need in \`collections\`/\`ids\`.`
+        )
+      );
+    }
+    return rejectAsEvent(
+      core,
+      new Error(`E_EXCERPT_DECODE: the replay ring could not be decoded: ${String(err)}`)
+    );
+  }
+  state.excerptsTaken++;
+  return resolveAsEvent(core, out);
+}
+var recordingCap = RECORDING_MAX_BYTES;
+function stopRecording(core, state, why) {
+  if (state.recStopped) return;
+  state.recStopped = true;
+  state.outbox.length = 0;
+  state.queued.length = 0;
+  if (state.recWarned) return;
+  state.recWarned = true;
+  core.host.log("warn", [
+    `irtio: room ${core.roomId}: full-match recording stopped (${why}). The chunks already written stay playable and room.replay.clip() still works; nothing further is recorded for the life of this room.`
+  ]);
+}
+function pumpDrain(core, state) {
+  if (state.recStopped) {
+    state.outbox.length = 0;
+    return;
+  }
+  if (state.outbox.length > 0) {
+    const frames = state.outbox.splice(0, state.outbox.length);
+    encodeAndQueue(core, state, frames);
+  }
+  sendNext(core, state);
+}
+function encodeAndQueue(core, state, frames) {
+  if (frames.length === 0) return;
+  if (state.recExpiresAtEpochS === void 0) {
+    state.recExpiresAtEpochS = clipExpiryEpochS(core.wallNow(), state.ttlMs);
+  }
+  const first = frames[0];
+  const header = state.encoded === 0 ? {
+    // The GAME schema's hash, for `assembleClip`'s reason: it is what a client's HELLO
+    // carries and what a deploy changes.
+    schemaHash8: core.definition.schema.hash8,
+    tickRate: core.definition.config.tickRate ?? 20,
+    startTick: first.tick,
+    view: state.view
+  } : void 0;
+  if (header !== void 0 && first.keyframe !== true) {
+    stopRecording(core, state, "the first chunk would not have begun with a keyframe");
+    return;
+  }
+  let bytes;
+  try {
+    bytes = encodeRecordingChunk(
+      frames.map((f) => ({
+        tick: f.tick,
+        kind: f.keyframe ? "keyframe" : "delta",
+        bytes: f.bytes
+      })),
+      header
+    );
+  } catch (err) {
+    stopRecording(core, state, `the chunk could not be encoded: ${String(err)}`);
+    return;
+  }
+  if (bytes.length === 0) return;
+  if (state.recBytes + bytes.length > recordingCap) {
+    stopRecording(
+      core,
+      state,
+      `it reached the ${recordingCap}-byte per-recording limit after ${state.chunksOut} chunk(s)`
+    );
+    return;
+  }
+  state.encoded++;
+  state.queued.push(bytes);
+  if (state.queued.length > RECORD_QUEUE_MAX) {
+    stopRecording(
+      core,
+      state,
+      `the store is answering slower than the ring evicts: ${RECORD_QUEUE_MAX} chunk(s) were already waiting behind the one in flight, and dropping one would have left a gap nothing downstream could re-base on`
+    );
+  }
+}
+function sendNext(core, state, all = false) {
+  if (state.recStopped && !state.finalDrained) return;
+  const parallel = all && state.recId !== void 0;
+  for (; ; ) {
+    if (state.inFlight && !parallel) return;
+    const bytes = state.queued.shift();
+    if (bytes === void 0) return;
+    sendChunk(core, state, bytes);
+    if (!parallel) return;
+  }
+}
+function warnRecordingOutlivedTtl(core, state) {
+  if (state.recExpiryWarned) return;
+  const expiresAtEpochS = state.recExpiresAtEpochS;
+  if (expiresAtEpochS === void 0 || expiresAtEpochS * 1e3 > core.wallNow()) return;
+  state.recExpiryWarned = true;
+  core.host.log("warn", [
+    `irtio: room ${core.roomId}: this full-match recording expired at ${expiresAtEpochS} (unix seconds) while it was still being written. A recording is kept for replay.ttl from its first stored chunk, so a ttl shorter than the match deletes the recording while the match is still running and its link answers 404. Set replay.ttl to at least the length of a match.`
+  ]);
+}
+function sendChunk(core, state, bytes) {
+  warnRecordingOutlivedTtl(core, state);
+  const seq = state.nextSeq;
+  state.nextSeq++;
+  state.chunksOut++;
+  state.recBytes += bytes.length;
+  state.inFlight = true;
+  startHostCall(
+    core,
+    {
+      kind: "record-chunk",
+      recId: state.recId,
+      seq,
+      bytes,
+      // The first chunk's expiry, on every chunk. `encodeAndQueue` set it before anything could
+      // reach here; the fallback is a value, not a second policy.
+      expiresAtEpochS: state.recExpiresAtEpochS ?? clipExpiryEpochS(core.wallNow(), state.ttlMs)
+    },
+    (value) => value ?? ""
+  ).then((id) => {
+    state.inFlight = false;
+    state.dropInFlight = false;
+    if (state.recId === void 0 && id !== "") state.recId = id;
+    sendNext(core, state, state.finalDrained);
+  }).catch((err) => {
+    state.inFlight = false;
+    if (state.dropInFlight) {
+      state.dropInFlight = false;
+      if (state.recId === void 0) {
+        stopRecording(
+          core,
+          state,
+          "the reply carrying the recording's id was dropped before it arrived, and a second chunk would have been stored as a second recording"
+        );
+        return;
+      }
+      sendNext(core, state, state.finalDrained);
+      return;
+    }
+    if (state.queued.length > 0) {
+      const bytes2 = state.queued.reduce((n, b) => n + b.length, 0);
+      core.host.log("warn", [
+        `irtio: room ${core.roomId}: the full-match recording lost its last ${state.queued.length} chunk(s) (${bytes2} bytes). The room ended before the store answered the first chunk, so the recording's id was never known here and the tail had nowhere to go. Everything already stored plays.`
+      ]);
+      state.queued.length = 0;
+    }
+    stopRecording(core, state, `a chunk was not stored: ${String(err)}`);
+  });
+}
+function drainRecordingFinal(core) {
+  const state = states5.get(core);
+  if (!state || !state.record || state.recStopped || state.finalDrained) return;
+  state.finalDrained = true;
+  const remaining = state.ring.frames;
+  const frames = [...state.outbox.splice(0, state.outbox.length), ...remaining];
+  if (frames.length > 0) encodeAndQueue(core, state, frames);
+  sendNext(core, state, true);
+  state.recStopped = true;
+}
+function recordingId(core) {
+  return states5.get(core)?.recId;
+}
+function noteRecordingRepliesDropped(core) {
+  const state = states5.get(core);
+  if (state?.inFlight === true) state.dropInFlight = true;
+}
+
 // src/core/room-api.ts
 import {
-  FrameType as FrameType4,
+  FrameType as FrameType5,
   busChannelProblem,
   busPayloadProblem,
-  encodeFrame as encodeFrame3
+  encodeFrame as encodeFrame4
 } from "@irtio/protocol";
-import { encodeDelta as encodeDelta3, encodeFields as encodeFields2, isDirtyEmpty as isDirtyEmpty2 } from "@irtio/schema";
+import { encodeDelta as encodeDelta4, encodeFields as encodeFields2, isDirtyEmpty as isDirtyEmpty3 } from "@irtio/schema";
 function makePhysicsApi(p) {
   return {
     get rapier() {
@@ -3796,6 +5202,30 @@ function createRoomApi(core, publicUrl) {
     get lobby() {
       return makeLobby(core);
     },
+    // ---- M6 lane N: replays ----
+    // D81: one getter, and deliberately only one. Everything replays do — the ring, the
+    // eviction invariant, the recorder view, the clip assembly, the cooldown — lives in
+    // `core/replay.ts` behind these two calls, so this file stays what it says it is: a facade
+    // that reads through.
+    get replay() {
+      return {
+        get armed() {
+          return replayArmed(core);
+        },
+        clip: (seconds) => takeClip(core, seconds),
+        // M7 planned feature 5: the ring read back as plain frames. Same read-through shape as
+        // `clip` — the walk, the projection and the whole budget live in `core/replay-excerpt.ts`
+        // and `core/replay.ts`.
+        excerpt: (options) => takeExcerpt(core, options),
+        // M6 record packet: the id of the recording being written, once the first chunk has been
+        // stored. A getter, like `armed`, so a game reading it late in a match sees the id rather
+        // than the `undefined` it would have captured at the start of one.
+        get recording() {
+          return recordingId(core);
+        }
+      };
+    },
+    // ---- end M6 lane N ----
     alarm(name, atMs) {
       if (!isAlarmName(core, name, "room.alarm")) return;
       if (!Number.isFinite(atMs)) {
@@ -3878,10 +5308,10 @@ function setRole(core, clientId, role) {
   }
   if (entry.role === role) return;
   const dirty = catchUpDirty(core.ext, core.plain, entry.role, role);
-  if (!isDirtyEmpty2(dirty)) {
+  if (!isDirtyEmpty3(dirty)) {
     core.send(
       clientId,
-      encodeFrame3(FrameType4.DELTA, encodeDelta3(core.ext, core.plain, dirty, { tick: core.tick }))
+      encodeFrame4(FrameType5.DELTA, encodeDelta4(core.ext, core.plain, dirty, { tick: core.tick }))
     );
   }
   entry.role = role;
@@ -3984,6 +5414,10 @@ var RoomCore = class _RoomCore {
   };
   tick = 0;
   stopped = false;
+  // ---- M6 lane K: stateful relay ----
+  /** D77: the wall clock hold deadlines are measured against. See `RoomCoreOptions.wallNow`. */
+  wallNow;
+  // ---- end M6 lane K ----
   /**
    * Called for every handler throw `tryRun` swallows, before it is logged. A test harness sets
    * this so a room that breaks fails the test that broke it (bug 2): the runtime's job is to
@@ -4035,7 +5469,7 @@ var RoomCore = class _RoomCore {
       restored = candidate;
     }
     if (restored) {
-      plain = decodeSnapshot2(this.ext, restored.snapshot).state;
+      plain = decodeSnapshot3(this.ext, restored.snapshot).state;
       const presence = plainEntity(plain, PRESENCE_COLLECTION);
       for (const id of [...presence.ids()]) presence.remove(id);
       if (restored.mode !== this.mode) {
@@ -4060,6 +5494,9 @@ var RoomCore = class _RoomCore {
     const historySetup = this.physics ? historyOf(definition.config.physics) : void 0;
     this.rewindState = historySetup === void 0 ? void 0 : new RewindState(historySetup);
     this.subscribeDeclaredChannels();
+    installCaps(self, options.caps ?? {});
+    this.wallNow = options.wallNow ?? (() => Date.now());
+    restoreHolds(self, restored?.holds);
     if (restored) {
       const onWake = definition.config.onWake;
       if (onWake) this.guard("onWake", () => onWake(this.state, this.room));
@@ -4083,6 +5520,37 @@ var RoomCore = class _RoomCore {
   get busConfig() {
     return this.definition.config.bus;
   }
+  /**
+   * M7 D-P2: the platform notice, and the room's veto.
+   *
+   * Answers whether the supervisor should broadcast. `false` — the veto — comes back for exactly
+   * one input: a handler that ran and returned `false`. Every other path answers `true`, and each
+   * one is a different way of the room having said nothing:
+   *
+   * - **No handler.** A room that never wrote this hook. The design's whole point is that its
+   *   players still hear the warning; a code-less room does not even reach this file.
+   * - **A handler that threw.** `tryRun` and not `guard`, so the throw counts toward the crash
+   *   threshold like any other, and it still does not become a veto. This is the one place the
+   *   convention differs from `onChat`, where a throw refuses, and the reason is the asymmetry of
+   *   the two losses: a chat line nobody sees is small; a save-loss warning nobody sees is the
+   *   feature not existing.
+   * - **A stopped room.** Nobody to ask, and for `closing` nobody left to veto for.
+   *
+   * The handler may also have written state, posted chat or started an end sequence. All of that
+   * is ordinary handler work and is flushed here the way an alarm's is.
+   */
+  deliverPlatformNotice(notice) {
+    if (this.stopped) return true;
+    const handler = this.definition.config.onPlatformNotice;
+    if (!handler) return true;
+    this.recordEvent("notice", void 0, notice.phase);
+    const ran = this.tryRun(
+      "onPlatformNotice",
+      () => handler(this.anyState, notice, this.room)
+    );
+    this.eventFlush();
+    return !(ran.ok && ran.value === false);
+  }
   /**
    * D59: one published message arriving on a channel this room is subscribed to.
    *
@@ -4371,6 +5839,8 @@ var RoomCore = class _RoomCore {
   }
   stop() {
     if (this.stopped) return;
+    drainRecordingFinal(this.internals);
+    cancelAllAsks(this.internals);
     this.stopped = true;
     this.started = false;
     this.loop.stop();
@@ -4400,15 +5870,22 @@ var RoomCore = class _RoomCore {
         mode: this.mode,
         schemaHash8: this.ext.hash8
       },
-      encodeSnapshot2(this.ext, this.plain, { tick: this.tick }),
-      physics
+      encodeSnapshot4(this.ext, this.plain, { tick: this.tick }),
+      physics,
+      // ---- M6 lane K: stateful relay ----
+      // D77: hold deadlines are state, so they go where the state goes. `undefined` for a room
+      // holding nothing, which keeps its blob byte-identical to the one it wrote before D77.
+      serializeHolds(this.internals)
+      // ---- end M6 lane K ----
     );
   }
   serialize() {
     const onSleep = this.definition.config.onSleep;
     if (onSleep) this.guard("onSleep", () => onSleep(this.state, this.room));
     this.loop.clearAllTimers();
+    cancelAllAsks(this.internals);
     rejectAllPending(this.internals, "room is hibernating");
+    noteRecordingRepliesDropped(this.internals);
     rejectAllHostCalls(this.internals, "room is hibernating");
     return this.snapshot();
   }
@@ -4476,6 +5953,18 @@ var RoomCore = class _RoomCore {
       // a key join `ctx.playerId` is exactly as durable as the resume token and no more. A JWT
       // join (D27, week 13) passes the verified `<iss>:<sub>` in `JoinOptions.playerId` instead,
       // and nothing else here changes.
+      //
+      // ---- M6 lane K: stateful relay ----
+      // An existing entry keeps the `playerId` it was created with: this is `existing ?? {...}`,
+      // so a rejoin never overwrites it. That is deliberate and it is the safe direction — a
+      // session's identity cannot be changed by anything a later HELLO on the same seat says. It
+      // has one visible consequence, and D77's holds are where it shows: a client that joins
+      // anonymously and presents an assertion later in the same session keeps the resume token's
+      // client id as its `playerId`, so its holds stay bound to the token rather than moving to
+      // the verified subject. Its next fresh join binds them to the subject. Said in
+      // `authority-models.md` too, because a developer meets it as "my holds did not follow me to
+      // the other tab" rather than as a line in this file.
+      // ---- end M6 lane K ----
       playerId: options.playerId ?? clientId,
       npc: options.npc === true,
       role,
@@ -4493,6 +5982,8 @@ var RoomCore = class _RoomCore {
     entry.connected = true;
     this.clients.set(clientId, entry);
     this.invalidateClients();
+    reclaimHolds(this.internals, clientId, entry.playerId);
+    addPerPlayerRecords(this.internals, clientId);
     const onJoin = this.definition.config.onJoin;
     if (onJoin) {
       const ctx = this.ctxFor(clientId, reconnecting);
@@ -4526,7 +6017,7 @@ var RoomCore = class _RoomCore {
   /** Event mode only: presence/lifecycle changes are their own event. No-op in tick mode. */
   eventFlush() {
     if (this.mode !== "event" || this.stopped) return;
-    if (isDirtyEmpty3(this.tracked.dirty)) return;
+    if (isDirtyEmpty4(this.tracked.dirty)) return;
     this.tick++;
     this.flush();
     this.captureTimeline();
@@ -4542,6 +6033,9 @@ var RoomCore = class _RoomCore {
       const ctx = this.ctxFor(clientId);
       this.guard("onLeave", () => onLeave(this.state, ctx, reason));
     }
+    cancelAsksFor(this.internals, clientId);
+    placeHolds(this.internals, clientId, entry.playerId);
+    forgetWriter(this.internals, clientId);
     this.presence.remove(clientId);
     this.recordEvent("leave", clientId, reason);
     rejectPendingFor(this.internals, clientId, "client disconnected");
@@ -4559,6 +6053,7 @@ var RoomCore = class _RoomCore {
     }
     entry.connected = false;
     entry.correction = void 0;
+    cancelAsksFor(this.internals, clientId);
     const record = this.presence.get(clientId);
     if (record && record.connected !== false) record.connected = false;
     this.invalidateClients();
@@ -4675,6 +6170,22 @@ var RoomCore = class _RoomCore {
    * `receive()` accepted, plus the join snapshots this room handed the host to wrap in a
    * `WELCOME` (the host builds that frame, so the room never sees it — see the docs page).
    */
+  // ---- M6 lane K: stateful relay ----
+  /** D77: the encoded state size, when a host set the state cap. See `caps.ts`. */
+  stateBytes() {
+    return stateBytesOf(this.internals);
+  }
+  /** D77: how many records are held for players who have left. */
+  holdCount() {
+    return holdCount(this.internals);
+  }
+  // ---- end M6 lane K ----
+  // ---- M6 ask packet ----
+  /** How many `transfer: 'ask'` requests are waiting on an owner's answer right now. */
+  askCount() {
+    return askCount(this.internals);
+  }
+  // ---- end M6 ask packet ----
   profile() {
     return this.ledger?.snapshot();
   }
@@ -4705,20 +6216,20 @@ var RoomCore = class _RoomCore {
       return;
     }
     switch (type) {
-      case FrameType5.WRITE:
-      case FrameType5.CALL: {
-        if (type === FrameType5.WRITE) this.recordEvent("write", clientId);
+      case FrameType6.WRITE:
+      case FrameType6.CALL: {
+        if (type === FrameType6.WRITE) this.recordEvent("write", clientId);
         if (this.mode === "tick") {
           this.loop.enqueue({ clientId, type, payload: payload.slice() });
         } else if (!this.loop.applyEvent({ clientId, type, payload })) {
           this.badFrame(
             clientId,
-            `malformed ${type === FrameType5.WRITE ? "WRITE" : "CALL"} payload`
+            `malformed ${type === FrameType6.WRITE ? "WRITE" : "CALL"} payload`
           );
         }
         return;
       }
-      case FrameType5.REPLY: {
+      case FrameType6.REPLY: {
         if (!handleReply(this.internals, clientId, payload)) {
           this.badFrame(clientId, "malformed REPLY payload");
         } else {
@@ -4726,7 +6237,7 @@ var RoomCore = class _RoomCore {
         }
         return;
       }
-      case FrameType5.MSG: {
+      case FrameType6.MSG: {
         if (this.mode === "event") this.tick++;
         const ok = handleMsg(this.internals, clientId, payload);
         if (this.mode === "event") this.flush();
@@ -4744,6 +6255,7 @@ var RoomCore = class _RoomCore {
    */
   flush() {
     evaluateLobby(this.internals);
+    expireHolds(this.internals);
     const dirty = this.tracked.flush();
     serverWinsCorrections(this.internals, dirty);
     this.ledger?.newFlush();
@@ -4801,14 +6313,14 @@ var RoomCore = class _RoomCore {
           let shared;
           if (entry.pendingJoinAdds) {
             const sharedDirty = sharedViewDirty(this.ext, sourceDirty, entry.role);
-            shared = isDirtyEmpty3(sharedDirty) ? null : encodeDelta4(this.ext, this.plain, sharedDirty, { tick: this.tick });
+            shared = isDirtyEmpty4(sharedDirty) ? null : encodeDelta5(this.ext, this.plain, sharedDirty, { tick: this.tick });
             if (shared) this.stats.encodesLastFlush++;
           } else {
             const key = viewKeyFor(this.ext, entry.role);
             let cached = byView.get(key);
             if (cached === void 0) {
               const sharedDirty = sharedViewDirty(this.ext, dirty, entry.role);
-              cached = isDirtyEmpty3(sharedDirty) ? null : encodeDelta4(this.ext, this.plain, sharedDirty, { tick: this.tick });
+              cached = isDirtyEmpty4(sharedDirty) ? null : encodeDelta5(this.ext, this.plain, sharedDirty, { tick: this.tick });
               if (cached) this.stats.encodesLastFlush++;
               byView.set(key, cached);
             }
@@ -4817,7 +6329,7 @@ var RoomCore = class _RoomCore {
           if (shared) {
             this.send(
               entry.clientId,
-              encodeFrame4(FrameType5.DELTA, shared),
+              encodeFrame5(FrameType6.DELTA, shared),
               this.ledger ? { shared } : void 0
             );
           }
@@ -4828,7 +6340,7 @@ var RoomCore = class _RoomCore {
             memberships
           );
           const encodeStarted = performance.now();
-          delta = isDirtyEmpty3(aoiDirty) ? null : encodeDelta4(this.ext, this.plain, aoiDirty, { tick: this.tick });
+          delta = isDirtyEmpty4(aoiDirty) ? null : encodeDelta5(this.ext, this.plain, aoiDirty, { tick: this.tick });
           this.stats.aoiEncodeMs += performance.now() - encodeStarted;
           if (delta) {
             this.stats.encodesLastFlush++;
@@ -4859,7 +6371,7 @@ var RoomCore = class _RoomCore {
         if (delta) {
           this.send(
             entry.clientId,
-            encodeFrame4(FrameType5.DELTA, delta),
+            encodeFrame5(FrameType6.DELTA, delta),
             this.ledger ? {
               ...churn ? { churn } : {},
               ...spatialDescs.length > 0 ? {} : { shared: delta }
@@ -4870,6 +6382,7 @@ var RoomCore = class _RoomCore {
       entry.correction = void 0;
       entry.accepted.clear();
     }
+    recordFlush(this.internals, dirty, byView);
   }
 };
 function encodeSection(physics) {
@@ -4885,6 +6398,11 @@ function encodeSection(physics) {
 export {
   HOST_CALL_TIMEOUT_MS,
   RoomFullError,
+  RELAY_STATE_BYTES,
+  RELAY_RECORDS_PER_COLLECTION,
+  RELAY_WRITES_PER_SECOND,
+  DEFAULT_RECORDS_PER_COLLECTION,
+  RELAY_WRITE_CAPS,
   EVENT_RING_SIZE,
   inspectState,
   RPC_TIMEOUT_MS,