@ogygia/core 0.12.3 → 0.13.0

package/dist/server/page-stream.js

@@ -1,4 +1,4 @@
-import { PAGE_DEFER_KEY, PAGE_SETTLED_KEY } from "../page-defer.js";
+import { PAGE_DEFER_GLOBAL, PAGE_DEFER_KEY, PAGE_SETTLED_KEY } from "../page-defer.js";
 import { escape_script_text } from "../escape.js";
 import { stringify } from "devalue";
 // src/server/page-stream.ts
@@ -118,4 +118,121 @@ function normalize_error(err) {
 	if (err && typeof err === "object" && "message" in err) return { message: String(err.message) };
 	return { message: String(err) };
 }
-export { DeferRef, SettledRef, defer_reducer, is_thenable, normalize_error, page_seed_reducers, resolve_script, settle_deferred, stage_deferred };
+/** `</body>` as bytes (ASCII: the same in every UTF-8 document). */
+const BODY_CLOSE_BYTES = [
+	60,
+	47,
+	98,
+	111,
+	100,
+	121,
+	62
+];
+/** Does `</body>` end in `chunk` — searched backwards from its end, where it sits — or straddle the
+*  boundary with the previous chunk's last bytes (`carry`, at most 6)? No decode. */
+function has_body_close(carry, chunk) {
+	const at_bytes = (buf, i) => {
+		for (let k = 0; k < 7; k++) if (buf[i + k] !== BODY_CLOSE_BYTES[k]) return false;
+		return true;
+	};
+	for (let i = chunk.lastIndexOf(60); i !== -1; i = i === 0 ? -1 : chunk.lastIndexOf(60, i - 1)) if (at_bytes(chunk, i)) return true;
+	if (!carry.length) return false;
+	const seam = new Uint8Array(carry.length + Math.min(6, chunk.length));
+	seam.set(carry);
+	seam.set(chunk.subarray(0, seam.length - carry.length), carry.length);
+	for (let i = 0; i + 7 <= seam.length; i++) if (at_bytes(seam, i)) return true;
+	return false;
+}
+/**
+* Stream the captured `$page.data` promises into islands (csr=false, real browser load). The
+* document — carrying the pending seed + resolve-global bootstrap — is already built by `resolve`;
+* here we (1) forward it, (2) DRAIN Kit's own dead csr=false resolve tail so its
+* `__sveltekit_<hash> is not defined` never reaches the browser, and (3) emit one
+* `<script>__ogygia_page_resolve(id, ok, value)<\/script>` per promise AS IT SETTLES — completion
+* order, non-blocking. Each island's `{#await page.data.x}` flips pending → resolved live.
+*
+* The stream is the request's (`request`, its owner): the visitor leaving, or the body cancelled,
+* stops Kit's reader and drops what settles after.
+*/
+function stream_page_deferred(request, response, deferred, initial_next_id, reducers) {
+	const source = response.body;
+	if (!source) return response;
+	const reader = source.getReader();
+	const encoder = new TextEncoder();
+	const owner = request.child();
+	owner.defer(() => void reader.cancel().catch(() => {}));
+	const stream = new ReadableStream({
+		async start(controller) {
+			let carry = /* @__PURE__ */ new Uint8Array(0);
+			try {
+				for (;;) {
+					const { value, done } = await reader.read();
+					if (done) break;
+					controller.enqueue(value);
+					if (has_body_close(carry, value)) break;
+					carry = value.length >= 6 ? value.subarray(value.length - 6) : value;
+				}
+			} catch {}
+			(async () => {
+				try {
+					for (;;) {
+						const { done } = await reader.read();
+						if (done) break;
+					}
+				} catch {}
+			})();
+			let pending = deferred.length;
+			let next_id = initial_next_id;
+			let closed = false;
+			const maybe_close = () => {
+				if (pending === 0 && !closed) {
+					closed = true;
+					try {
+						controller.close();
+					} catch {}
+				}
+			};
+			const push = (id, ok, value) => {
+				if (owner.closed) return;
+				try {
+					controller.enqueue(encoder.encode(resolve_script(PAGE_DEFER_GLOBAL, id, {
+						ok,
+						value
+					}, reducers)));
+				} catch {}
+			};
+			const settled = (id, ok, value) => {
+				push(id, ok, value);
+				pending -= 1;
+				maybe_close();
+			};
+			const stream_one = (id, promise) => {
+				Promise.resolve(promise).then((value) => {
+					let staged;
+					try {
+						staged = stage_deferred(value, next_id);
+					} catch (error) {
+						return settled(id, false, error);
+					}
+					next_id = staged.next_id;
+					pending += staged.deferred.length;
+					for (const n of staged.deferred) stream_one(n.id, n.promise);
+					settled(id, true, staged.staged);
+				}, (error) => settled(id, false, error));
+			};
+			for (const { id, promise } of deferred) stream_one(id, promise);
+			maybe_close();
+		},
+		cancel() {
+			owner.close();
+		}
+	});
+	const headers = new Headers(response.headers);
+	headers.delete("content-length");
+	return new Response(stream, {
+		status: response.status,
+		statusText: response.statusText,
+		headers
+	});
+}
+export { DeferRef, SettledRef, defer_reducer, is_thenable, normalize_error, page_seed_reducers, resolve_script, settle_deferred, stage_deferred, stream_page_deferred };

package/dist/server/personal-response.d.ts

@@ -1,6 +1 @@
-/**
- * A page made for ONE browser — its devtools events (hooks.ts), the profiler's beacon (profiler/), the
- * switch's Set-Cookie — must never reach a shared cache, whatever `cache-control` the app set: a CDN that
- * keeps HTML would hand that browser's page to every visitor.
- */
 export declare function mark_personal(response: Response): void;

package/dist/server/personal-response.js

@@ -1,13 +1,17 @@
+import { warn } from "../messages/server.js";
 // src/server/personal-response.ts
 /**
 * A page made for ONE browser — its devtools events (hooks.ts), the profiler's beacon (profiler/), the
 * switch's Set-Cookie — must never reach a shared cache, whatever `cache-control` the app set: a CDN that
-* keeps HTML would hand that browser's page to every visitor.
+* keeps HTML would hand that browser's page to every visitor. A response whose headers cannot be
+* changed (a fetched or redirect Response handed back as it is) is left as it is, and said.
 */
 function mark_personal(response) {
 	try {
 		response.headers.set("cache-control", "private, no-store");
 		response.headers.append("vary", "Cookie");
-	} catch {}
+	} catch (error) {
+		warn("personal_response_unmarked", { status: response.status }, error);
+	}
 }
 export { mark_personal };

package/dist/server/props-wire.js

@@ -5,6 +5,7 @@ import { register_wire_kind } from "../live-transport.js";
 import { register_derived_kind, register_store_kind } from "../store-transport.js";
 import { register_snippet_kind } from "../region-snippet.js";
 import { register_fn_kind } from "../fn-transport.js";
+import { OgygiaError } from "../messages/server.js";
 import { analyze, json_culprit, plan_seed_refs } from "../seed-refs.js";
 import { stringify } from "devalue";
 // src/server/props-wire.ts
@@ -85,7 +86,10 @@ function stringify_props(value, entry, seed_refs = null, wire_out = null) {
 		return stringify(value, reducers);
 	} catch (e) {
 		const detail = e instanceof Error ? e.message : String(e);
-		throw new Error(`[ogygia] island "${entry}": a captured prop is not serializable — ${detail}. Captured host values cross the boundary via devalue; functions/Promises cannot, and a class instance only can when the class declares a static [ogygia.wire] codec. Pass a serializable value, add a codec, or move that logic inside the island component.`);
+		throw new OgygiaError("prop_not_serializable", {
+			entry,
+			detail
+		});
 	}
 }
 /**

package/dist/server/region-endpoint.js

@@ -5,6 +5,7 @@ import { encode_region_props, ensure_prop_kinds } from "./region-props.js";
 import { record_server_event } from "../events/server-registry.js";
 import { B64Url } from "./payload.js";
 import { REF_WIRE_KEY, ref_reducer } from "../ref.js";
+import { OgygiaError, warn } from "../messages/server.js";
 import { island_fingerprint } from "./fingerprint.js";
 import { stringify } from "devalue";
 import { getRequestEvent } from "virtual:ogygia/request-event";
@@ -127,14 +128,21 @@ function mint_region_capability(entry, payload, ttl = 0) {
 function mintServerIsland(entry, props, ttl = 0) {
 	ensure_prop_kinds();
 	const payload = B64Url.encode(stringify(props, { [REF_WIRE_KEY]: ref_reducer(PROP_FAMILIES) }));
-	if (payload.length > 8192) throw new Error(`[ogygia] server island "${entry}": props payload is ${payload.length} b64 chars (max ${MAX_REGION_PROPS_LEN}). Shrink what you pass into the deferred region — the handle would reject this capability anyway.`);
+	if (payload.length > 8192) throw new OgygiaError("hole_props_too_large", {
+		entry,
+		length: payload.length,
+		max: MAX_REGION_PROPS_LEN
+	});
 	return mint_region_capability(entry, payload, ttl);
 }
 /** HMAC-signed `<endpoint>?id&props&exp&sig` (`handle({ endpoint })`, default `/__ogygia__`) for re-rendering `entry` with `props`. */
 function makeRegionEndpoint(entry, props = {}) {
 	const payload = encode_region_props(props);
 	if (payload == null) {
-		console.warn(`[ogygia] render:'live' region ${entry} has props that cannot cross the wire (non-serializable or >${MAX_REGION_PROPS_LEN} b64 chars) — no revalidate endpoint minted (behaves like a static lake).`);
+		warn("live_props_not_serializable", {
+			entry,
+			max: MAX_REGION_PROPS_LEN
+		});
 		return "";
 	}
 	return mint_region_capability(entry, payload);

package/dist/server/render-cache.d.ts

@@ -1,26 +1,30 @@
-/** Cache key for a region render — id + props payload + session seal. `exp`/`sig` (which rotate per
- *  mint) and `ttl` (a cache-window declaration, not a render input) are DELIBERATELY excluded so
- *  two renders of the same region+props+user hit; session is INCLUDED so users never cross. */
-export declare function render_cache_key(id: string, props_payload: string, session: string): string;
-/** Cached HTML for `key`, or null on miss/expiry. A live hit is an LRU touch. */
-export declare function render_cache_get(key: string, now: number): string | null;
-/** Cache `html` for `ttl_sec` seconds. No-op for `ttl_sec <= 0` (dynamic holes are never cached). */
-export declare function render_cache_set(key: string, html: string, ttl_sec: number, now: number): void;
-/** Test/ops hook: drop everything. */
-export declare function render_cache_clear(): void;
-/** Test/ops hook: live entries + resident bytes. */
-export declare function render_cache_stats(): {
-  entries: number;
-  bytes: number;
+/** What a region render is made from: the region, its props, the visitor's session seal, and (when
+ *  its tree reads `page.data`) the page it renders for. */
+export type RenderKey = {
+  id: string;
+  payload: string;
+  session: string;
+  page: string | null;
 };
+/** Cache key for a region render — id + props payload + session seal (+ the page, for a tree that
+ *  reads `page.data`). `exp`/`sig` (which rotate per mint) and `ttl` (a cache-window declaration,
+ *  not a render input) are DELIBERATELY excluded so two renders of the same region+props+user hit;
+ *  session is INCLUDED so users never cross. Each part is its own key field, so two calls whose
+ *  parts differ never share an entry, whatever the parts hold. */
+export declare function render_cache_key(id: string, payload: string, session: string, page?: string | null): RenderKey;
+/** Test/ops hook: the HTML kept for `key` now, or null. */
+export declare function render_cache_get(key: RenderKey): string | null;
+/** Test/ops hook: drop everything, the flights in progress too (what they render is not kept, and
+ *  the calls waiting on them render afresh). */
+export declare function render_cache_clear(): void;
 /**
  * THE shared cache-fronted render (G2) — the ONE seam both the deferred-region endpoint
  * (#render_component) and the inline-island page render (Region.svelte) call. A hit returns the
- * memo; a miss renders via `render_body()` (the caller supplies it — the endpoint wraps its render
- * in a concurrency gate + timeout, the inline path renders directly), then caches. `cache` is
- * `undefined`/`ttl<=0` for a dynamic hole → always renders, never stores. `now` injected for tests.
+ * memo; a miss renders via `render_body(signal)` (the caller supplies it — the endpoint wraps its
+ * render in a concurrency gate + timeout, the inline path renders directly), then caches. `cache`
+ * is `undefined`/`ttl<=0` for a dynamic hole → always renders, never stores.
  */
-export declare function cached_render(render_body: () => string | null | Promise<string | null>, cache: {
-  key: string;
+export declare function cached_render(render_body: (signal?: AbortSignal) => string | null | Promise<string | null>, cache: {
+  key: RenderKey;
   ttl: number;
-} | undefined, now: number, report?: (outcome: "hit" | "miss" | "none") => void): Promise<string | null>;
+} | undefined, report?: (outcome: "hit" | "miss" | "none") => void, signal?: AbortSignal): Promise<string | null>;

package/dist/server/render-cache.js

@@ -1,51 +1,110 @@
-import { SizedLru } from "./sized-lru.js";
-const store = new SizedLru(67108864, 500);
-/** Cache key for a region render — id + props payload + session seal. `exp`/`sig` (which rotate per
-*  mint) and `ttl` (a cache-window declaration, not a render input) are DELIBERATELY excluded so
-*  two renders of the same region+props+user hit; session is INCLUDED so users never cross. */
-function render_cache_key(id, props_payload, session) {
-	return id + " " + props_payload + " " + session;
-}
-/** Cached HTML for `key`, or null on miss/expiry. A live hit is an LRU touch. */
-function render_cache_get(key, now) {
-	return store.get(key, now);
+import { STALE, flights } from "@ogygia/machine";
+// src/server/render-cache.ts
+/**
+* Server-side per-region HTML render cache (reconciler R6 — the SSR-compute lever).
+*
+* The deferred/held-region endpoint (`#render_component` in hooks.ts) is the ONE place ogygia
+* renders a region out-of-band as (id + props) → HTML. Today it re-renders fresh every request.
+* When a region opts into a positive `maxAge` (a signed `ttl` on its capability URL), the author
+* has DECLARED its output stable for that window — so memoizing the render for `ttl` seconds turns
+* an expensive region into a one-render-then-serve-cached region across ALL requests. That is the
+* only server-compute win reachable without making the monolithic page render region-granular
+* (which would need the off-limits compiler); a plain inline island never reaches this seam.
+*
+* CORRECTNESS: the cache key includes the SESSION seal, so a per-user (`private, max-age`) render
+* is never served to another user — exactly matching the browser Cache-Control the same `ttl`
+* produces. `ttl <= 0` (the default `no-store` hole) is never cached. Bounded in BYTES (a region
+* render can be up to `MAX_REGION_BODY`, 2 MB) and in entries, TTL-expiring, so it can't grow
+* unbounded across a long-lived server process.
+*
+* ONE RENDER PER KEY IN FLIGHT (#244): the renders are a `flights()`, one flight per key, and every
+* call for that key while it renders joins it instead of rendering again, so a burst of one cached
+* hole takes one render gate slot, not one per request.
+*
+* - A failed render fails the calls that joined it too, and is not kept: the next call renders
+*   afresh. They asked for the same render (same region, props and visitor), so it failed for them
+*   as it would have on their own; each trying again in turn would be the burst this stops, on the
+*   path that is already failing (a hung upstream would time each of them out, each holding a slot).
+* - Each call joins with its own request's signal. A request that leaves (a cancelled batch, #245)
+*   leaves the flight alone: the render goes on, in its place in the render queue, for the calls
+*   still waiting on it, and is stopped only once every one of them has left. The render is handed
+*   the flight's signal, not its opener's.
+*/
+/** Resident budget for cached region HTML. */
+const MAX_BYTES = 67108864;
+const ENTRY_SHARE = Math.floor(MAX_BYTES / 500);
+const renders = flights.keyed()({
+	name: "render cache",
+	key: [
+		"id",
+		"payload",
+		"session",
+		"page"
+	],
+	ignore: {
+		render_body: "the render of the key: the same region, props, visitor and page",
+		ttl: "how long the HTML stays, not what is rendered"
+	},
+	run: async (ask, signal) => ask.render_body(signal),
+	keep: (html, ask) => html === null ? 0 : ask.ttl * 1e3,
+	max: MAX_BYTES,
+	weigh: (html) => Math.max(html?.length ?? 0, ENTRY_SHARE)
+});
+/** Cache key for a region render — id + props payload + session seal (+ the page, for a tree that
+*  reads `page.data`). `exp`/`sig` (which rotate per mint) and `ttl` (a cache-window declaration,
+*  not a render input) are DELIBERATELY excluded so two renders of the same region+props+user hit;
+*  session is INCLUDED so users never cross. Each part is its own key field, so two calls whose
+*  parts differ never share an entry, whatever the parts hold. */
+function render_cache_key(id, payload, session, page = null) {
+	return {
+		id,
+		payload,
+		session,
+		page
+	};
 }
-/** Cache `html` for `ttl_sec` seconds. No-op for `ttl_sec <= 0` (dynamic holes are never cached). */
-function render_cache_set(key, html, ttl_sec, now) {
-	if (ttl_sec <= 0) return;
-	store.set(key, html, html.length, now + ttl_sec * 1e3);
+/** Test/ops hook: the HTML kept for `key` now, or null. */
+function render_cache_get(key) {
+	const seen = renders.peek(key);
+	return seen?.kind === "kept" ? seen.answer : null;
 }
-/** Test/ops hook: drop everything. */
+/** Test/ops hook: drop everything, the flights in progress too (what they render is not kept, and
+*  the calls waiting on them render afresh). */
 function render_cache_clear() {
-	store.clear();
-}
-/** Test/ops hook: live entries + resident bytes. */
-function render_cache_stats() {
-	return {
-		entries: store.size,
-		bytes: store.bytes
-	};
+	renders.drop(() => true);
 }
 /**
 * THE shared cache-fronted render (G2) — the ONE seam both the deferred-region endpoint
 * (#render_component) and the inline-island page render (Region.svelte) call. A hit returns the
-* memo; a miss renders via `render_body()` (the caller supplies it — the endpoint wraps its render
-* in a concurrency gate + timeout, the inline path renders directly), then caches. `cache` is
-* `undefined`/`ttl<=0` for a dynamic hole → always renders, never stores. `now` injected for tests.
+* memo; a miss renders via `render_body(signal)` (the caller supplies it — the endpoint wraps its
+* render in a concurrency gate + timeout, the inline path renders directly), then caches. `cache`
+* is `undefined`/`ttl<=0` for a dynamic hole → always renders, never stores.
 */
-async function cached_render(render_body, cache, now, report) {
-	if (cache !== void 0 && cache.ttl > 0) {
-		const hit = render_cache_get(cache.key, now);
-		if (hit !== null) {
-			report?.("hit");
-			return hit;
+async function cached_render(render_body, cache, report, signal) {
+	if (cache === void 0 || cache.ttl <= 0) {
+		const body = await render_body(signal);
+		report?.("none");
+		return body;
+	}
+	const ask = {
+		...cache.key,
+		render_body,
+		ttl: cache.ttl
+	};
+	for (;;) {
+		const opens = renders.peek(cache.key) === void 0;
+		let html;
+		try {
+			html = await renders.get(ask, { signal });
+		} catch (error) {
+			report?.("none");
+			throw error;
+		}
+		if (html !== STALE) {
+			report?.(html === null ? "none" : opens ? "miss" : "hit");
+			return html;
 		}
+		if (signal?.aborted) throw signal.reason;
 	}
-	const body = await render_body();
-	if (cache !== void 0 && cache.ttl > 0 && body !== null) {
-		render_cache_set(cache.key, body, cache.ttl, now);
-		report?.("miss");
-	} else report?.("none");
-	return body;
 }
-export { cached_render, render_cache_clear, render_cache_get, render_cache_key, render_cache_set, render_cache_stats };
+export { cached_render, render_cache_clear, render_cache_get, render_cache_key };

package/dist/server/render-page.js

@@ -1,7 +1,10 @@
+import { request_local } from "../plugin/request-scope.js";
 import { islands_endpoint } from "./endpoint.js";
 import { look_up_page } from "./page-facts.js";
 import { merge_seed_ask, shape_page_data } from "./seed-shape.js";
 import { PAGE_FACTS_SCRIPT_TYPE } from "../page-facts-script.js";
+import { line } from "../messages/server.js";
+import { flights } from "@ogygia/machine";
 import * as devalue from "devalue";
 // src/server/render-page.ts
 let warn = null;
@@ -25,8 +28,35 @@ function page_url_of(event) {
 	} catch {}
 	return event.url;
 }
-const looked_up = /* @__PURE__ */ new WeakMap();
-const facts_of = /* @__PURE__ */ new WeakMap();
+/** Why a page-facts look-up's inputs are not its key: a request has one look-up. */
+const ONE_PER_REQUEST = "a request has one look-up";
+/**
+* Each request's look-up of its page's facts, a flight of one key the request owns: looked up once
+* per request (a failed one is not kept), its answer the page's facts (null: unavailable), its
+* streamed reader let go when the request ends.
+*/
+const looked_up = request_local((owner) => flights.keyed()({
+	name: "page facts",
+	key: [],
+	ignore: {
+		page: ONE_PER_REQUEST,
+		fetch: ONE_PER_REQUEST,
+		decoders: ONE_PER_REQUEST
+	},
+	run: ({ page, fetch, decoders }) => look_up_page(page, fetch, decoders, owner).then((facts) => {
+		if (!("miss" in facts)) return facts;
+		warn?.(line("outside_page_data_unavailable", {
+			path: page.pathname,
+			miss: facts.miss
+		}));
+		return null;
+	})
+}));
+/** The page's facts this request looked up, or undefined. */
+function facts_of(request) {
+	const entry = looked_up(request).peek({});
+	return entry?.kind === "kept" ? entry.answer ?? void 0 : void 0;
+}
 /**
 * Before an async render root starts: in a request rendering FOR a page, that page's facts, looked
 * up once. `reads_data`: does this render read `page.data` (`null`: unknown here — a remote call
@@ -36,19 +66,17 @@ const facts_of = /* @__PURE__ */ new WeakMap();
 function prepare_render_page(event, transport, reads_data) {
 	if (!event || !renders_for_a_page(event)) return;
 	if (!(reads_data ?? event.isRemoteRequest === true)) return;
-	const request = event.request;
-	const known = looked_up.get(request);
-	if (known) return known;
 	const page = page_url_of(event);
 	if (page === event.url) return;
+	const look_up = looked_up(event.request);
+	if (look_up.peek({})?.kind === "kept") return;
 	const decoders = {};
 	for (const name in transport ?? {}) decoders[name] = transport[name].decode;
-	const p = look_up_page(page, event.fetch, decoders).then((facts) => {
-		if ("miss" in facts) warn?.(`[ogygia] ${page.pathname}: the page's data for a render outside it is unavailable: ${facts.miss}. The render sees an empty page.data.`);
-		else facts_of.set(request, facts);
-	});
-	looked_up.set(request, p);
-	return p;
+	return look_up.get({
+		page,
+		fetch: event.fetch,
+		decoders
+	}).then(() => {});
 }
 /**
 * The page a render sees. `snapshot`: what this request's page render recorded, if anything. `null`
@@ -57,7 +85,7 @@ function prepare_render_page(event, transport, reads_data) {
 function render_page(snapshot, event) {
 	if (!snapshot && !event) return null;
 	if (event && renders_for_a_page(event)) {
-		const facts = facts_of.get(event.request);
+		const facts = facts_of(event.request);
 		return {
 			url: facts?.url ?? page_url_of(event),
 			params: facts?.params ?? {},
@@ -105,7 +133,10 @@ function watched_data(facts, say) {
 			if (!seen) warned_keys.set(facts, seen = /* @__PURE__ */ new Set());
 			if (!seen.has(key)) {
 				seen.add(key);
-				say(`[ogygia] ${facts.url.pathname}: a region rendered outside its page read page.data.${key}, which this page's server loads do not produce. A key a universal load (+page.ts / +layout.ts) returns exists only inside a full page render: return it from a server load, or pass it as a prop.`);
+				say(line("outside_page_data_key", {
+					path: facts.url.pathname,
+					key
+				}));
 			}
 		}
 		return Reflect.get(target, key, receiver);
@@ -123,7 +154,7 @@ function render_page_version(event, snapshot) {
 	if (!event) return "";
 	const known = versions.get(event.request);
 	if (known !== void 0) return known;
-	const data = renders_for_a_page(event) ? facts_of.get(event.request)?.data : snapshot?.data;
+	const data = renders_for_a_page(event) ? facts_of(event.request)?.data : snapshot?.data;
 	let v = "";
 	if (data && typeof data === "object") try {
 		v = fnv1a(JSON.stringify(data));
@@ -162,7 +193,7 @@ function note_render_page_ask(event, seed) {
 */
 function render_page_facts_script(event, transport) {
 	if (!event || !renders_for_a_page(event)) return "";
-	const facts = facts_of.get(event.request);
+	const facts = facts_of(event.request);
 	const keys = asks_of.get(event.request);
 	if (!facts || !keys) return "";
 	const encoders = {};

package/dist/server/request-stats.d.ts

@@ -9,7 +9,7 @@
  * WeakMap — the record dies with the request, nothing is deleted, and the two modules never
  * import each other (hooks.ts imports the profiler lazily; the profiler must not import hooks).
  *
- * DETAIL is opt-in (`set_request_stats_detail`): the profiler turns it on for the length of a
+ * DETAIL is opt-in (`hold_request_stats_detail`): the profiler holds it on for the length of a
  * recording, and only then does the handle spend anything on the per-island rows, the seed
  * explainer and the hole notes below. Off, a request pays one WeakMap write of the totals.
  */
@@ -163,12 +163,14 @@ export declare function set_batch_hole_listener(fn: ((request: Request, s: Batch
 export declare function has_batch_hole_listener(): boolean;
 export declare function record_batch_hole_stats(request: Request, s: BatchHoleStats): void;
 /**
- * The profiler turns detail on for a recording; off, the handle records totals only. COUNTED, not a
- * switch: the flag is the process's, while a recorder lock is one profiler instance's — and two can
- * live at once (the dev server re-runs the app's hooks on an edit and `ogygia.handle()` builds a new
- * profiler, while the old one's sample and trap timers still record). The first window to end then
- * turned detail off under the other's render: its report kept no island rows ("islands 1, rows 0")
- * and named its islands by their files. On while any window records.
+ * The profiler asks for detail for a recording; with nobody asking, the handle records totals only.
+ * HELD, not a switch: the flag is the process's, while a recorder lock is one profiler instance's —
+ * and two can live at once (the dev server re-runs the app's hooks on an edit and `ogygia.handle()`
+ * builds a new profiler, while the old one's sample and trap timers still record). The first window
+ * to end once turned detail off under the other's render: its report kept no island rows ("islands
+ * 1, rows 0") and named its islands by their files. On while any hold stands; each hold is its
+ * caller's, and its release lets go of that hold only, once (a second call does nothing), so an
+ * extra "off" can never end someone else's.
  */
-export declare function set_request_stats_detail(on: boolean): void;
+export declare function hold_request_stats_detail(): () => void;
 export declare function request_stats_detailed(): boolean;

package/dist/server/request-stats.js

@@ -36,19 +36,27 @@ function record_batch_hole_stats(request, s) {
 	batch_listener?.(request, s);
 }
 /**
-* The profiler turns detail on for a recording; off, the handle records totals only. COUNTED, not a
-* switch: the flag is the process's, while a recorder lock is one profiler instance's — and two can
-* live at once (the dev server re-runs the app's hooks on an edit and `ogygia.handle()` builds a new
-* profiler, while the old one's sample and trap timers still record). The first window to end then
-* turned detail off under the other's render: its report kept no island rows ("islands 1, rows 0")
-* and named its islands by their files. On while any window records.
+* The profiler asks for detail for a recording; with nobody asking, the handle records totals only.
+* HELD, not a switch: the flag is the process's, while a recorder lock is one profiler instance's —
+* and two can live at once (the dev server re-runs the app's hooks on an edit and `ogygia.handle()`
+* builds a new profiler, while the old one's sample and trap timers still record). The first window
+* to end once turned detail off under the other's render: its report kept no island rows ("islands
+* 1, rows 0") and named its islands by their files. On while any hold stands; each hold is its
+* caller's, and its release lets go of that hold only, once (a second call does nothing), so an
+* extra "off" can never end someone else's.
 */
-function set_request_stats_detail(on) {
-	detail_depth = on ? detail_depth + 1 : Math.max(0, detail_depth - 1);
-	detailed = detail_depth > 0;
-}
-let detail_depth = 0;
+function hold_request_stats_detail() {
+	const hold = {};
+	detail_holds.add(hold);
+	detailed = true;
+	return () => {
+		if (!detail_holds.delete(hold)) return;
+		detailed = detail_holds.size > 0;
+	};
+}
+/** Who asked for detail, each until its own release. */
+const detail_holds = /* @__PURE__ */ new Set();
 function request_stats_detailed() {
 	return detailed;
 }
-export { has_batch_hole_listener, hole_stats_of, record_batch_hole_stats, record_hole_stats, record_request_stats, request_stats_detailed, request_stats_of, request_stats_wanted, set_batch_hole_listener, set_request_stats_detail, want_request_stats };
+export { has_batch_hole_listener, hold_request_stats_detail, hole_stats_of, record_batch_hole_stats, record_hole_stats, record_request_stats, request_stats_detailed, request_stats_of, request_stats_wanted, set_batch_hole_listener, want_request_stats };

package/dist/server/rules.d.ts

@@ -0,0 +1,11 @@
+import { Rules } from "../rules.js";
+import { Scope } from "@ogygia/machine";
+type ServerRule = "rule_request_scope_open" | "rule_flight_kept_failure";
+/** The server's rules. */
+export declare const server_rules: Rules<ServerRule>;
+/** A response ended (its body read to the end, cancelled, or none): its request's scope must be
+ *  closed by the time the next check runs. */
+export declare function note_response_end(owner: Scope): void;
+/** Rules on: checked after each response, and what broke is said with its code. */
+export declare function install_server_rules(): void;
+export {};