@terminus-ai/cli 0.0.1

package/bin/appdev.mjs

@@ -0,0 +1,4446 @@
+/**
+ * `terminus dev` — a local Terminus-app harness that speaks the production
+ * runtime protocol. It serves the built ui/ bundle as real multi-file HTTP
+ * (live from disk) plus the same-origin `/_terminus/*` runtime API that
+ * `@terminus-ai/app-sdk` uses on `*.apps.terminus.build` — no injected bridge, no
+ * harness-only transport: the exact SDK code path that runs in production
+ * runs here.
+ *
+ * The wire is the contract's (doors.json in the SDK's conformance bundle,
+ * vendored under bin/vendor/app-runtime-v1/): every door it marks as served
+ * by `terminus dev` answers the documented shapes, every refusal is the one
+ * `{error: {code, message, details?}}` envelope with the code and status
+ * production answers for the same condition, and the doors a local host
+ * cannot serve (connectors, services, service jobs, egress, the sign-in
+ * callback) answer `501 unsupported_in_dev`.
+ *
+ * Simulated members make multiplayer development local. Production gives
+ * every user their own opaque app session; the harness gives every member
+ * their own ORIGIN — one port per member:
+ *
+ *   terminus dev --members 2 --port 8868
+ *   → alan: http://localhost:8868/    bob: http://localhost:8869/
+ *
+ * Two tabs, two identities, one shared event bus. Every simulated user gets
+ * one app capsule under .terminus/dev/users/{member}/apps/{app}/ containing a
+ * real SQLite database plus content-addressed object storage. Collection
+ * records, mutation receipts, and change cursors survive restarts; realtime
+ * events remain signals rather than truth: nothing is retained or replayed.
+ *
+ * `--guest` adds one more port after the members': a visitor who is not
+ * signed in, as an app open to guests meets one. It gets the contract's guest
+ * bootstrap, the app's own files and the capability assets the app declares,
+ * and every other door refuses it, 401 unauthorized, as production does. The
+ * app's `session.signIn()` lands on a page that picks the member to sign in
+ * as; the port then IS that member — the same origin, so what the SDK kept
+ * for the guest in this browser moves into the account — until it signs out.
+ */
+
+import { readFile, rm, stat } from "node:fs/promises";
+import { createServer } from "node:http";
+import path from "node:path";
+import { deflateSync } from "node:zlib";
+
+import { APP_RUNTIME_API_VERSION } from "./app-runtime-contract.mjs";
+import { injectAppRouteScript } from "./app-route-script.mjs";
+import { CliError, parseFlags, usageError } from "./client.mjs";
+import { Api, connect } from "./http.mjs";
+import { packageKind, readAppPackage, resolveCreation } from "./apps.mjs";
+import { resolveTemplate } from "./devtriggers.mjs";
+import { DEV_DIRECTORY, ensureDevDirectory, sha256 } from "./files.mjs";
+import { nextCronAfter } from "./schedules.mjs";
+import {
+  compareStrings,
+  compiledWhereMatches,
+  recordSearchMatches,
+  searchText,
+  sortRecords,
+  validateSort,
+  validateWhere,
+} from "./vendor/where.mjs";
+import { enforceWriteRules, normalizedWriteRules } from "./write-rules.mjs";
+import { DevCapsuleStore, DevSystemStore } from "./dev-capsules.mjs";
+import {
+  APP_HOST,
+  DOORS,
+  LIMITS,
+  idempotencyKey,
+  matchDoor,
+  refuseUnknownFields,
+  returnToPath,
+  runtimeError,
+  sendRuntimeError,
+} from "./dev-contract.mjs";
+import {
+  DevDataPlane,
+  pageLimit,
+  requestMediaType,
+  safeListPrefix,
+  safeRelativePath,
+} from "./dev-data.mjs";
+import { DEFAULT_DEV_MEMBER, DEFAULT_DEV_MEMBERS } from "./dev-members.mjs";
+import { fetchPublicImage, fetchPublicPage } from "./dev-net.mjs";
+import {
+  answerServerDoor,
+  createDevServerTier,
+  devInstallationId,
+  fetchPublicText,
+  serverError,
+} from "./dev-server-ops.mjs";
+import {
+  DEV_NOTIFICATION_POPUP_PATH,
+  DEV_NOTIFICATION_POPUP_SCRIPT,
+  DEV_NOTIFICATION_STREAM_PATH,
+  injectDevNotificationPopup,
+} from "./dev-notification-popup.mjs";
+import {
+  answerDevAbout,
+  assertDevPortRangeAvailable,
+  closeDevServer,
+  DEV_ABOUT_PATH,
+  devPortUnavailableError,
+  isLoopbackHost,
+  isLoopbackOrigin,
+  isSameOrigin,
+  listenDevServer,
+  refuseCrossSite,
+  refuseForeignHost,
+  resolveDevPortRange,
+} from "./dev-ports.mjs";
+
+/** The app and release every local member runs: the folder, as one release. */
+const DEV_APP_ID = "dev-app";
+const DEV_RELEASE_ID = "dev-release";
+/** Where users.profile sends a browser: the harness's page for a member. */
+const DEV_PROFILE_PREFIX = "/__terminus_dev/users/";
+/** A collect submission's undo window, as the platform keeps it. */
+const COLLECT_UNDO_MS = 120_000;
+/** What a guest is told at a door that needs an account, in production's
+ * words; the code (and so the status) is the contract's `guest.refusal`. */
+const GUEST_REFUSAL = "Sign in to use this (guest mode)";
+/** The sign-in door (`host.signin`): a navigation, whose picker on the
+ * guest's port posts its form back to the same path. */
+const SIGN_IN_PATH = DOORS.doors.find((door) => door.id === "host.signin").path;
+/** The picker's form is a member's handle and a place: this is plenty. */
+const SIGN_IN_FORM_BYTES = 16 * 1024;
+/** The seven hues Chats draws contact monograms in — the notification
+ * corner's too, so a face on the sign-in page is the same face there. */
+const MONOGRAM_HUES = [211, 254, 291, 338, 14, 32, 168];
+
+const CONTENT_TYPES = new Map([
+  [".html", "text/html; charset=utf-8"],
+  [".js", "text/javascript; charset=utf-8"],
+  [".mjs", "text/javascript; charset=utf-8"],
+  [".css", "text/css; charset=utf-8"],
+  [".json", "application/json"],
+  [".svg", "image/svg+xml"],
+  [".png", "image/png"],
+  [".jpg", "image/jpeg"],
+  [".jpeg", "image/jpeg"],
+  [".webp", "image/webp"],
+  [".gif", "image/gif"],
+  [".ico", "image/x-icon"],
+  [".woff2", "font/woff2"],
+  [".woff", "font/woff"],
+  [".txt", "text/plain; charset=utf-8"],
+]);
+function horizontalForbidden(message) {
+  return runtimeError("forbidden", message);
+}
+
+/** The contract's guest bootstrap (app-host.json `guest.bootstrap`) with its
+ * `{resolve.*}` placeholders filled in from `resolve`, as the app host fills
+ * them from the platform's resolve answer; everything else is the
+ * contract's own. A placeholder with no value here is a contract the harness
+ * has not caught up with, and says so rather than answer a guest wrongly. */
+function fillGuestBootstrap(template, resolve) {
+  if (typeof template === "string") {
+    const placeholder = /^\{resolve\.([a-z_]+)\}$/u.exec(template);
+    if (!placeholder) return template;
+    if (!Object.hasOwn(resolve, placeholder[1])) {
+      throw new Error(`the contract's guest bootstrap names {resolve.${placeholder[1]}}, which terminus dev does not fill`);
+    }
+    return resolve[placeholder[1]];
+  }
+  if (Array.isArray(template)) return template.map((item) => fillGuestBootstrap(item, resolve));
+  if (template && typeof template === "object") {
+    return Object.fromEntries(
+      Object.entries(template).map(([key, value]) => [key, fillGuestBootstrap(value, resolve)]),
+    );
+  }
+  return template;
+}
+
+/** A face without a picture, as the notification corner draws one: a hue
+ * and up to two initials from the handle. */
+function monogram(handle) {
+  let hash = 0;
+  for (const character of String(handle)) hash = (hash * 31 + character.charCodeAt(0)) | 0;
+  const parts = String(handle).replace(/^@/u, "").split(/[\s._-]+/u).filter(Boolean);
+  return {
+    hue: Math.abs(hash) % MONOGRAM_HUES.length,
+    initials: (parts.slice(0, 2).map((part) => [...part][0]).join("") || "?").toUpperCase(),
+  };
+}
+
+function declaredHorizontalCapability(capabilities, id, version, operation = null) {
+  const declaration = (capabilities?.horizontal ?? []).find(
+    (entry) => entry.id === id && entry.version === version,
+  );
+  if (!declaration) {
+    throw horizontalForbidden(
+      `app release did not declare horizontal capability '${id}' version ${version}`,
+    );
+  }
+  if (operation && Array.isArray(declaration.operations)
+    && !declaration.operations.includes(operation)) {
+    throw horizontalForbidden(
+      `app release did not declare horizontal operation '${id}' version ${version}#${operation}`,
+    );
+  }
+  return declaration;
+}
+
+/** The horizontal capability plane, proxied from the platform.
+ *
+ * The dev harness no longer mirrors capability assets or reimplements
+ * operations — the CLI is a thin authenticated wrapper, and the platform is
+ * the one implementation of its own capability plane. What stays local is
+ * the release-contract gate (the same declaration semantics the production
+ * app host enforces) and the declared-set filter on the registry listing,
+ * because a CLI login is a user credential rather than an app session, so
+ * the platform cannot scope the listing for us. Brokered operations require
+ * a real app session and therefore `terminus dev --remote`; here they
+ * return the platform's own authorization error, truthfully.
+ *
+ * A guest reaches the assets alone (the door gate sends nothing else here),
+ * and fetches them as the app host fetches a guest's: public bytes, asked
+ * for with no credential and no artifact context — never the developer's.
+ */
+async function serveHorizontalCapability(segments, request, response, capabilities, platform, { guest = false } = {}) {
+  const method = (request.method ?? "GET").toUpperCase();
+  if (!platform) {
+    throw runtimeError(
+      "service_unavailable",
+      "platform capabilities need a signed-in CLI: run `terminus login`, then restart `terminus dev`",
+    );
+  }
+  const { forwardPlatformRequest } = await import("./appdev-remote.mjs");
+  const context = platform.artifactContext ?? null;
+  if (segments.length === 0 && method === "GET") {
+    // The platform's refusal is the app's to read, so its status comes back
+    // as it was answered.
+    const upstream = await new Api({ base: platform.apiBase, token: platform.token }).open("GET /v1/capabilities", {
+      headers: context ? { "x-terminus-artifact-context": context } : {},
+    });
+    const registry = await upstream.json().catch(() => null);
+    if (!upstream.ok && registry?.error?.code) return sendJson(response, upstream.status, registry);
+    if (!upstream.ok || !registry) {
+      throw runtimeError("upstream_failed", `the platform capability registry returned ${upstream.status}`);
+    }
+    return sendJson(response, 200, {
+      ...registry,
+      capabilities: (registry.capabilities ?? []).filter((entry) => (
+        (capabilities?.horizontal ?? []).some(
+          (declared) => declared.id === entry.id && declared.version === entry.version,
+        )
+      )),
+    });
+  }
+  const [id, rawMajor, surface, ...rest] = segments;
+  const version = /^v[1-9][0-9]*$/u.test(rawMajor ?? "") ? Number(rawMajor.slice(1)) : NaN;
+  if (!Number.isSafeInteger(version)) {
+    throw runtimeError("not_found", "horizontal capability route not found");
+  }
+  declaredHorizontalCapability(capabilities, id, version);
+  const target = (suffix) => `${platform.apiBase}/capabilities/${encodeURIComponent(id)}/${rawMajor}${suffix}`;
+  if (!surface && method === "GET") {
+    return forwardPlatformRequest(target(""), platform.token, method, request, response, context);
+  }
+  if (surface === "assets" && rest.length && (method === "GET" || method === "HEAD")) {
+    try {
+      for (const encoded of rest) {
+        const segment = decodeURIComponent(encoded);
+        if (!segment || segment === "." || segment === ".." || segment.includes("/") || segment.includes("\\")) {
+          throw runtimeError("not_found", "horizontal capability asset not found");
+        }
+      }
+    } catch (error) {
+      if (error?.status) throw error;
+      throw runtimeError("not_found", "horizontal capability asset not found");
+    }
+    return forwardPlatformRequest(
+      target(`/assets/${rest.join("/")}`),
+      guest ? null : platform.token,
+      method,
+      request,
+      response,
+      guest ? null : context,
+    );
+  }
+  if (surface === "operations" && rest.length === 1 && method === "POST") {
+    declaredHorizontalCapability(capabilities, id, version, rest[0]);
+    return forwardPlatformRequest(target(`/operations/${encodeURIComponent(rest[0])}`), platform.token, method, request, response, context);
+  }
+  throw runtimeError("not_found", "horizontal capability route not found");
+}
+
+const MAX_DEV_AVATAR_BYTES = 2 * 1024 * 1024;
+const DEV_HANDLE_PATTERN = /^[a-z0-9][a-z0-9._~-]{0,63}$/;
+
+const DEFAULT_DEV_AVATAR_COLORS = [
+  [71, 109, 133],
+  [123, 91, 138],
+  [177, 105, 82],
+  [70, 130, 110],
+  [150, 117, 57],
+  [90, 105, 150],
+];
+const RECORD_ID_PATTERN = new RegExp(LIMITS.record_id_pattern);
+function requireManagedName(raw, kind) {
+  const value = String(raw ?? "");
+  if (!/^[a-z][a-z0-9_-]{0,63}$/.test(value)) throw new CliError(`invalid ${kind} name`);
+  return value;
+}
+
+function requireManagedId(raw) {
+  const value = String(raw ?? "");
+  if (!RECORD_ID_PATTERN.test(value)) {
+    throw new CliError("invalid record id");
+  }
+  return value;
+}
+
+/** An event's notify, checked as the backend's `validate_event_notify` does:
+ * the trimmed title, the body and the route each counted in characters. */
+function normalizeEventNotify(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new CliError("invalid notify");
+  }
+  const title = typeof raw.title === "string" ? raw.title.trim() : "";
+  const body = raw.body === undefined ? "" : raw.body;
+  const route = raw.route === undefined || raw.route === null ? null : raw.route;
+  if (!title
+    || [...title].length > LIMITS.notification_title_chars
+    || typeof body !== "string"
+    || [...body].length > LIMITS.notification_body_chars
+    || (route !== null
+      && (typeof route !== "string" || [...route].length > LIMITS.notification_route_chars))) {
+    throw new CliError("invalid notify");
+  }
+  return { title, body, route };
+}
+
+/** How much of what was said a mention row previews. */
+const MENTION_PREVIEW_CHARS = 140;
+/** How long one presence write keeps a member on a topic — the platform's
+ * presence field lifetime. The SDK re-asserts every ~25s while a room is open. */
+const PRESENCE_TTL_MS = 55_000;
+
+/** The first `count` characters, counted as the platform counts them (code
+ * points, so an emoji is never cut in half). */
+function firstChars(text, count) {
+  return [...text].slice(0, count).join("");
+}
+
+/** A transaction's or a delivery's notify: an event's, plus who its message
+ * row is for — "absent" (everyone not looking, the default) or "mentioned"
+ * (no message row at all; the mentioned have their own). */
+function normalizeWriteNotify(raw) {
+  const notify = normalizeEventNotify(raw);
+  if (raw.audience === undefined || raw.audience === null) return notify;
+  if (raw.audience !== "absent" && raw.audience !== "mentioned") {
+    throw new CliError("notify.audience must be absent or mentioned");
+  }
+  return { ...notify, audience: raw.audience };
+}
+
+/** The rings a transaction or a delivery commits with: an optional notify,
+ * and the handles to mention (at most the contract's `mentions`). */
+function normalizeWriteRings(body, write) {
+  const notify = body?.notify == null ? null : normalizeWriteNotify(body.notify);
+  const mentions = body?.mentions ?? [];
+  if (!Array.isArray(mentions) || mentions.some((handle) => typeof handle !== "string")) {
+    throw new CliError("mentions must be a list of handles");
+  }
+  if (mentions.length > LIMITS.mentions) {
+    throw new CliError(`at most ${LIMITS.mentions} mentions per ${write}`);
+  }
+  return { notify, mentions };
+}
+
+/** Handles resolved the way the platform resolves them (`space_member_targets`):
+ * trimmed, leading "@"s dropped, lowercased, and matched against `members` —
+ * never the sender, each person once. Unknown handles and non-members drop
+ * silently. */
+function mentionTargets(members, handles, sender) {
+  const wanted = new Set(
+    handles
+      .map((handle) => String(handle).trim().replace(/^@+/, "").toLowerCase())
+      .filter(Boolean),
+  );
+  return members.filter((candidate) => candidate !== sender && wanted.has(candidate.toLowerCase()));
+}
+
+const COLLECTION_PERMISSION_TOKENS = new Set([
+  "allow", "deny", "user", "agent", "automation", "capsule-owner",
+  "record-creator", "record-updater", "space-member", "space-editor", "space-admin",
+]);
+
+function validateCollectionPermissionRule(rule, { fieldRule = false, depth = 0 } = {}) {
+  if (depth > 8) throw new CliError("collection permission rules are nested too deeply");
+  if (typeof rule === "string") {
+    if (!COLLECTION_PERMISSION_TOKENS.has(rule)) {
+      throw new CliError(`unknown collection permission token '${rule}'`);
+    }
+    if (fieldRule && ["record-creator", "record-updater"].includes(rule)) {
+      throw new CliError("field permission rules cannot depend on record provenance");
+    }
+    return;
+  }
+  if (!rule || typeof rule !== "object" || Array.isArray(rule)) {
+    throw new CliError("collection permission rules must be tokens or rule objects");
+  }
+  const entries = Object.entries(rule);
+  if (entries.length !== 1) throw new CliError("collection permission rule objects have one operator");
+  const [operator, value] = entries[0];
+  if (operator === "fieldEqualsActor") {
+    if (fieldRule) throw new CliError("field permission rules cannot inspect record fields");
+    if (typeof value !== "string" || !/^[A-Za-z0-9_.-]{1,64}$/.test(value)) {
+      throw new CliError("fieldEqualsActor requires a short field name");
+    }
+    return;
+  }
+  if (operator === "not") {
+    validateCollectionPermissionRule(value, { fieldRule, depth: depth + 1 });
+    return;
+  }
+  if (!["anyOf", "allOf"].includes(operator) || !Array.isArray(value)
+    || !value.length || value.length > 16) {
+    throw new CliError("permission anyOf/allOf requires 1-16 nested rules");
+  }
+  for (const nested of value) {
+    validateCollectionPermissionRule(nested, { fieldRule, depth: depth + 1 });
+  }
+}
+
+function validateCollectionPermissions(raw) {
+  if (raw === undefined) return undefined;
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new CliError("collection permissions must be an object");
+  }
+  for (const [action, rule] of Object.entries(raw)) {
+    if (!["read", "create", "update", "delete", "fields"].includes(action)) {
+      throw new CliError(`unknown collection permission '${action}'`);
+    }
+    if (action !== "fields") {
+      validateCollectionPermissionRule(rule);
+      continue;
+    }
+    if (!rule || typeof rule !== "object" || Array.isArray(rule)
+      || Object.keys(rule).length > 32) {
+      throw new CliError("collection field permissions must be an object with at most 32 fields");
+    }
+    for (const [field, permissions] of Object.entries(rule)) {
+      if (!/^[A-Za-z0-9_.-]{1,64}$/.test(field)
+        || !permissions || typeof permissions !== "object" || Array.isArray(permissions)) {
+        throw new CliError(`invalid field permission '${field}'`);
+      }
+      for (const [operation, fieldRule] of Object.entries(permissions)) {
+        if (!["read", "write"].includes(operation)) {
+          throw new CliError(`unknown field permission '${field}.${operation}'`);
+        }
+        validateCollectionPermissionRule(fieldRule, { fieldRule: true });
+      }
+    }
+  }
+  return structuredClone(raw);
+}
+
+function normalizeCollectionDefinition(name, raw, { strict = true } = {}) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new CliError("collection definition must be an object");
+  }
+  if (strict) {
+    const unknown = Object.keys(raw).find(
+      (field) => ![
+        "ownership", "search", "schema", "indexes", "unique", "relations", "permissions",
+        "validate",
+      ].includes(field),
+    );
+    if (unknown) throw new CliError(`unknown collection definition field '${unknown}'`);
+  }
+  const ownership = raw.ownership ?? "personal";
+  if (!["personal", "space"].includes(ownership)) {
+    throw new CliError("collection ownership must be personal or space");
+  }
+  const search = raw.search ?? [];
+  if (
+    !Array.isArray(search)
+    || search.length > 8
+    || new Set(search).size !== search.length
+    || search.some((field) => !/^[A-Za-z0-9_.-]{1,64}$/.test(field))
+  ) {
+    throw new CliError("collection search accepts up to 8 unique short field names");
+  }
+  const schemaValid = raw.schema === undefined
+    || typeof raw.schema === "string"
+    || (raw.schema !== null && typeof raw.schema === "object" && !Array.isArray(raw.schema));
+  if (!schemaValid) {
+    throw new CliError("collection schema must be JSON Schema or a bundle path");
+  }
+  const normalizeFields = (key, maximum) => {
+    const fields = raw[key] ?? [];
+    if (!Array.isArray(fields) || fields.length > maximum
+      || new Set(fields).size !== fields.length
+      || fields.some((field) => !/^[A-Za-z0-9_.-]{1,64}$/.test(field))) {
+      throw new CliError(`collection ${key} accepts up to ${maximum} unique short field names`);
+    }
+    return [...fields];
+  };
+  const indexes = normalizeFields("indexes", 16);
+  const unique = normalizeFields("unique", 8);
+  for (const field of unique) if (!indexes.includes(field)) indexes.push(field);
+  if (indexes.length > 16) {
+    throw new CliError("collection indexes plus unique fields exceed 16 fields");
+  }
+  const relations = raw.relations ?? {};
+  if (!relations || typeof relations !== "object" || Array.isArray(relations)
+    || Object.keys(relations).length > 16) {
+    throw new CliError("collection relations must be an object with at most 16 relations");
+  }
+  for (const [relationName, relation] of Object.entries(relations)) {
+    if (!/^[A-Za-z0-9_.-]{1,64}$/.test(relationName)
+      || !relation || typeof relation !== "object" || Array.isArray(relation)) {
+      throw new CliError(`invalid relation '${relationName}'`);
+    }
+    const unknown = Object.keys(relation).find(
+      (field) => !["collection", "field", "cardinality", "required", "onDelete"].includes(field),
+    );
+    if (unknown) throw new CliError(`unknown relation field '${relationName}.${unknown}'`);
+    if (!/^[a-z][a-z0-9_-]{0,63}$/.test(relation.collection ?? "")) {
+      throw new CliError(`relation '${relationName}' requires a target collection`);
+    }
+    if (relation.field !== undefined && !/^[A-Za-z0-9_.-]{1,64}$/.test(relation.field)) {
+      throw new CliError(`relation '${relationName}' has an invalid record field`);
+    }
+    if (relation.cardinality !== undefined && !["one", "many"].includes(relation.cardinality)) {
+      throw new CliError(`relation '${relationName}' cardinality must be one or many`);
+    }
+    if (relation.required !== undefined && typeof relation.required !== "boolean") {
+      throw new CliError(`relation '${relationName}' required must be boolean`);
+    }
+    if (relation.onDelete !== undefined && !["restrict", "cascade"].includes(relation.onDelete)) {
+      throw new CliError(`relation '${relationName}' onDelete must be restrict or cascade`);
+    }
+  }
+  const permissions = validateCollectionPermissions(raw.permissions);
+  const validate = normalizedWriteRules(raw.validate);
+  const definition = {
+    name,
+    ownership,
+    search,
+    indexes,
+    unique,
+    relations: structuredClone(relations),
+    ...(permissions === undefined ? {} : { permissions }),
+    ...(raw.schema !== undefined ? { schema: raw.schema } : {}),
+    ...(validate === undefined ? {} : { validate }),
+  };
+  if (Buffer.byteLength(JSON.stringify(definition)) > LIMITS.collection_definition_bytes) {
+    throw new CliError(`collection definition exceeds ${LIMITS.collection_definition_bytes / 1024} KiB`);
+  }
+  return definition;
+}
+
+function jsonTypeMatches(value, expected) {
+  if (expected === "object") return value !== null && typeof value === "object" && !Array.isArray(value);
+  if (expected === "array") return Array.isArray(value);
+  if (expected === "string") return typeof value === "string";
+  if (expected === "number") return typeof value === "number" && Number.isFinite(value);
+  if (expected === "integer") return Number.isSafeInteger(value);
+  if (expected === "boolean") return typeof value === "boolean";
+  if (expected === "null") return value === null;
+  return true;
+}
+
+/** Match the deliberately small production JSON-Schema subset. Richer client
+ * validation is welcome, but the persistence door must enforce the same
+ * object/required/property-type floor in every environment. */
+function validateRecordSchema(declaration, record) {
+  if (record === null || typeof record !== "object" || Array.isArray(record)) {
+    throw new CliError("collection records must be JSON objects");
+  }
+  const schema = declaration.schema;
+  if (!schema || typeof schema !== "object" || Array.isArray(schema)) return;
+  if (typeof schema.type === "string" && !jsonTypeMatches(record, schema.type)) {
+    throw new CliError(`record does not match schema type '${schema.type}'`);
+  }
+  if (Array.isArray(schema.required)) {
+    for (const field of schema.required.filter((value) => typeof value === "string")) {
+      if (!Object.hasOwn(record, field)) {
+        throw new CliError(`record is missing required field '${field}'`);
+      }
+    }
+  }
+  if (schema.properties && typeof schema.properties === "object" && !Array.isArray(schema.properties)) {
+    for (const [field, property] of Object.entries(schema.properties)) {
+      if (!Object.hasOwn(record, field)) continue;
+      if (
+        property
+        && typeof property === "object"
+        && typeof property.type === "string"
+        && !jsonTypeMatches(record[field], property.type)
+      ) {
+        throw new CliError(`record field '${field}' must be ${property.type}`);
+      }
+    }
+  }
+}
+
+function validateManagedRecord(declaration, record) {
+  validateRecordSchema(declaration, record);
+  if (Buffer.byteLength(JSON.stringify(record)) > LIMITS.record_value_bytes) {
+    throw runtimeError("payload_too_large", `record exceeds ${LIMITS.record_value_bytes / 1024} KiB`);
+  }
+}
+
+function permissionRuleAllows(rule, actor, record = null) {
+  if (typeof rule === "string") {
+    return {
+      allow: true,
+      deny: false,
+      user: actor.principal === "user",
+      agent: actor.principal === "agent",
+      automation: actor.principal === "automation",
+      "capsule-owner": actor.userId === actor.capsuleOwner,
+      "record-creator": record?.created_by_user_id === actor.userId,
+      "record-updater": record?.updated_by_user_id === actor.userId,
+      "space-member": Boolean(actor.spaceRole),
+      "space-editor": ["manager", "owner", "admin", "editor"].includes(actor.spaceRole),
+      "space-admin": ["manager", "owner", "admin"].includes(actor.spaceRole),
+    }[rule] ?? false;
+  }
+  const [operator, operand] = Object.entries(rule ?? {})[0] ?? [];
+  if (operator === "fieldEqualsActor") return record?.value?.[operand] === actor.userId;
+  if (operator === "anyOf") return operand.some((nested) => permissionRuleAllows(nested, actor, record));
+  if (operator === "allOf") return operand.every((nested) => permissionRuleAllows(nested, actor, record));
+  if (operator === "not") return !permissionRuleAllows(operand, actor, record);
+  return false;
+}
+
+function authorizeCollection(declaration, action, actor, record = null) {
+  const rule = declaration.permissions?.[action];
+  if (rule === undefined || permissionRuleAllows(rule, actor, record)) return;
+  const error = new CliError(`collection ${action} permission denied`);
+  error.status = 403;
+  throw error;
+}
+
+function fieldPermissionAllows(declaration, field, action, actor) {
+  const rule = declaration.permissions?.fields?.[field]?.[action];
+  return rule === undefined || permissionRuleAllows(rule, actor);
+}
+
+function authorizeChangedFields(declaration, actor, before, after) {
+  for (const field of new Set([
+    ...Object.keys(before ?? {}),
+    ...Object.keys(after ?? {}),
+  ])) {
+    if (JSON.stringify(before?.[field]) === JSON.stringify(after?.[field])) continue;
+    if (!fieldPermissionAllows(declaration, field, "write", actor)) {
+      const error = new CliError(`collection field '${field}' is not writable by this actor`);
+      error.status = 403;
+      throw error;
+    }
+  }
+}
+
+function redactCollectionRecord(declaration, actor, record) {
+  return {
+    ...record,
+    value: Object.fromEntries(Object.entries(record.value).filter(([field]) => (
+      fieldPermissionAllows(declaration, field, "read", actor)
+    ))),
+  };
+}
+
+function requireReadableField(declaration, actor, field) {
+  if (fieldPermissionAllows(declaration, field, "read", actor)) return;
+  const error = new CliError(`collection field '${field}' is not readable by this actor`);
+  error.status = 403;
+  throw error;
+}
+
+function whereFieldNames(value, fields = new Set()) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return fields;
+  for (const [key, nested] of Object.entries(value)) {
+    if (!key.startsWith("$")) fields.add(key);
+    if (key === "$and" || key === "$or") {
+      for (const branch of Array.isArray(nested) ? nested : []) whereFieldNames(branch, fields);
+    } else if (key === "$not") whereFieldNames(nested, fields);
+  }
+  return fields;
+}
+
+/** The §2.6 query grammar is evaluated by the ONE JavaScript evaluator the
+ * SDK publishes as `@terminus-ai/app-sdk/where`, vendored byte-for-byte at
+ * `bin/vendor/where.mjs` and pinned by `test/contracts/app-runtime-v1/`.
+ * These wrappers add only the harness's own door checks (the where byte
+ * limit) and the `{ id, value }` record shape the collection store uses. */
+export function validateWhereFilter(filter) {
+  if (!filter || typeof filter !== "object" || Array.isArray(filter)) {
+    throw new CliError("where must be a JSON object");
+  }
+  if (Buffer.byteLength(JSON.stringify(filter)) > LIMITS.where_bytes) {
+    throw new CliError("where must be a small JSON object");
+  }
+  return validateWhere(filter);
+}
+
+/** Does `value` satisfy `where`? Validates like the backend's 400 door. */
+export function whereMatches(value, filter) {
+  return compiledWhereMatches(value, validateWhereFilter(filter ?? {}));
+}
+
+/** Filter `{ id, value }` records by a compiled (or raw) where filter. */
+export function filterManagedRecords(records, filter) {
+  const compiled = filter && "containment" in filter && "conditions" in filter
+    ? filter
+    : validateWhereFilter(filter ?? {});
+  return records.filter((record) => compiledWhereMatches(record.value, compiled));
+}
+
+/** `ORDER BY data->field [DESC] NULLS LAST, record_id` (or record_id alone). */
+export function sortManagedRecords(records, sort) {
+  return sortRecords(records, sort || undefined);
+}
+
+/** Searchable text per §2.6: the declared search fields, else the record. */
+export function searchTextOf(declaration, value) {
+  return searchText(declaration?.search, value);
+}
+
+/** `websearch_to_tsquery`-style matching (whole tokens, AND/OR/NOT, quoted
+ * phrases) over the declared search fields — the production semantics, not
+ * a substring scan. */
+export function searchManagedRecords(declaration, records, query) {
+  return records.filter((record) => recordSearchMatches(declaration?.search, record.value, query));
+}
+
+/** Spaces, invitations and blocks as the harness keeps them. The doors
+ * decide who may do what (the platform's rules and words); this only holds
+ * the state and its one rule of shape: a space's first member is its owner. */
+class DevSpaceRegistry {
+  constructor(systemStore) {
+    this.systemStore = systemStore;
+    this.spaces = [];
+    this.invitations = [];
+    this.blocks = [];
+  }
+
+  load() {
+    this.spaces = this.systemStore.loadSpaces();
+    this.invitations = this.systemStore.loadSpaceInvitations();
+    this.blocks = this.systemStore.loadUserBlocks();
+  }
+
+  save() {
+    this.systemStore.saveSpaces(this.spaces);
+    this.systemStore.saveSpaceInvitations(this.invitations);
+    this.systemStore.saveUserBlocks(this.blocks);
+  }
+
+  find(spaceId) {
+    return this.spaces.find((space) => space.id === spaceId) ?? null;
+  }
+
+  memberRole(spaceId, member) {
+    const space = this.find(spaceId);
+    if (!space || !space.members.includes(member)) return null;
+    return space.roles?.[member] ?? (space.members[0] === member ? "owner" : "editor");
+  }
+
+  canManage(spaceId, member) {
+    return ["owner", "admin"].includes(this.memberRole(spaceId, member));
+  }
+
+  isBlocked(first, second) {
+    return this.blocks.some(({ blocker, blocked }) => (
+      (blocker === first && blocked === second) || (blocker === second && blocked === first)
+    ));
+  }
+
+  blockedBy(blocker, blocked) {
+    return this.blocks.some((entry) => entry.blocker === blocker && entry.blocked === blocked);
+  }
+
+  setBlocked(blocker, blocked, value) {
+    this.blocks = this.blocks.filter((entry) => (
+      entry.blocker !== blocker || entry.blocked !== blocked
+    ));
+    if (value) this.blocks.push({ blocker, blocked });
+  }
+
+  /** A direct space's other person, for `member`. */
+  peer(space, member) {
+    return space.kind === "direct" ? space.members.find((candidate) => candidate !== member) ?? null : null;
+  }
+
+  /** The platform's refusal of any activity in a direct space while either
+   * person has blocked the other. */
+  ensureConversationActive(spaceId, member) {
+    const space = this.find(spaceId);
+    if (space?.kind !== "direct") return;
+    const peer = this.peer(space, member);
+    if (peer && this.isBlocked(member, peer)) {
+      throw runtimeError(
+        "forbidden",
+        "direct conversation activity is disabled while either person has blocked the other",
+      );
+    }
+  }
+
+  pendingInvitations(spaceId) {
+    const now = Date.now();
+    return this.invitations
+      .filter((invitation) => invitation.spaceId === spaceId
+        && invitation.status === "pending"
+        && Date.parse(invitation.expiresAt) > now)
+      .sort((left, right) => compareStrings(left.createdAt, right.createdAt));
+  }
+
+  /** The invitation for `invitee`: a pending one already there, or a new one. */
+  invite(spaceId, inviter, invitee, role = "editor") {
+    const existing = this.pendingInvitations(spaceId).find((invitation) => invitation.invitee === invitee);
+    if (existing) return { invitation: existing, created: false };
+    const createdAt = new Date();
+    const invitation = {
+      id: crypto.randomUUID(),
+      spaceId,
+      inviter,
+      invitee,
+      role,
+      status: "pending",
+      createdAt: createdAt.toISOString(),
+      expiresAt: new Date(createdAt.getTime() + 7 * 24 * 60 * 60 * 1000).toISOString(),
+      resolvedAt: null,
+    };
+    this.invitations.push(invitation);
+    return { invitation, created: true };
+  }
+
+  resolveInvitation(invitationId, invitee, status) {
+    const invitation = this.invitations.find((candidate) => candidate.id === invitationId);
+    if (!invitation || invitation.invitee !== invitee || invitation.status !== "pending") {
+      throw runtimeError("not_found", "pending invitation not found");
+    }
+    if (Date.parse(invitation.expiresAt) <= Date.now()) {
+      throw runtimeError("not_found", "space invitation is invalid or expired");
+    }
+    const space = this.find(invitation.spaceId);
+    if (!space) throw runtimeError("not_found", "space not found");
+    invitation.status = status;
+    invitation.resolvedAt = new Date().toISOString();
+    if (status === "accepted" && !space.members.includes(invitee)) {
+      space.members.push(invitee);
+      space.roles[invitee] = invitation.role;
+      space.joined[invitee] = invitation.resolvedAt;
+      space.updatedAt = invitation.resolvedAt;
+    }
+    return { invitation, space };
+  }
+
+  /** Forget a space and its invitations (a space with children is never
+   * deleted, so nothing is left pointing at it). */
+  removeSpace(spaceId) {
+    this.spaces = this.spaces.filter((space) => space.id !== spaceId);
+    this.invitations = this.invitations.filter((invitation) => invitation.spaceId !== spaceId);
+  }
+}
+
+/** A member's own presence topic: a personal install has no space to park
+ * presence on, so it lives here — the harness's spelling of the platform's
+ * `(user_id, app_id)` topic. Never on the wire. */
+const accountTopic = (member) => `account:${member}`;
+
+/** A stream's first message, as the platform opens one: how long its client
+ * waits to reconnect after a drop (the SSE `retry:` field) — two seconds
+ * plus up to six more, drawn per stream, so a restart that drops every
+ * window is not answered by every window at once — then stream_open. */
+function streamOpening() {
+  const retryMs = 2000 + Math.floor(Math.random() * 6001);
+  return `retry: ${retryMs}\ndata: ${JSON.stringify({ type: "stream_open" })}\n\n`;
+}
+
+/**
+ * The live transport: one SSE stream per open window, each a member's
+ * account stream. It carries frames and nothing else — no sequence, no
+ * epoch, no ring to replay from — so a (re)connect starts at stream_open and
+ * recovers state through the JSON doors, as on the platform.
+ */
+class DevEventBus {
+  constructor(appId) {
+    this.appId = appId;
+    // { member, res, rooms: Set | null, corner? } — a `corner` stream is the
+    // harness's notification corner: account frames only, and not presence.
+    this.streams = new Set();
+    this.presence = new Map();
+    this.beats = new Map();
+    this.looks = new Map();
+  }
+
+  /** The common envelope (`space_id` null on account and personal frames). */
+  envelope(type, spaceId, from, event, transient) {
+    return {
+      type,
+      transient: Boolean(transient),
+      space_id: spaceId ?? null,
+      app_id: this.appId,
+      from,
+      event,
+      published_at: new Date().toISOString(),
+    };
+  }
+
+  /** One frame down one stream; its `rooms` filter narrows room_event frames,
+   * and a corner stream hears the account and nothing else. */
+  send(stream, frame) {
+    if (stream.corner && frame.type !== "account_event") return;
+    const event = frame.event;
+    if (stream.rooms && event?.type === "room_event" && typeof event.room_id === "string"
+      && !stream.rooms.has(event.room_id)) {
+      return;
+    }
+    stream.res.write(`data: ${JSON.stringify(frame)}\n\n`);
+  }
+
+  /** A frame to every stream of `members`, except `except`'s. */
+  deliver(members, frame, { except = null } = {}) {
+    const wanted = new Set(members);
+    for (const stream of this.streams) {
+      if (wanted.has(stream.member) && stream.member !== except) this.send(stream, frame);
+    }
+  }
+
+  /** Whether `member` has an app open on a live stream — online, as presence
+   * counts it. The notification corner is the desk's, not the app's. */
+  hasStream(member) {
+    for (const stream of this.streams) if (stream.member === member && !stream.corner) return true;
+    return false;
+  }
+
+  /** Set (or with null clear) `member`'s presence state on `topic`. Every
+   * state written is proof of life; an unchanged re-assert — the SDK's
+   * heartbeat — changes nothing and is silent. A clear is no beat: it is the
+   * member leaving the topic, their state and their presence on it gone.
+   * Answers whether the state changed — for a clear, whether there was one. */
+  setPresence(topic, member, state) {
+    if (!this.presence.has(topic)) this.presence.set(topic, new Map());
+    const states = this.presence.get(topic);
+    if (state === null || state === undefined) {
+      this.beats.get(topic)?.delete(member);
+      return states.delete(member);
+    }
+    this.beat(topic, member);
+    if (JSON.stringify(states.get(member)) === JSON.stringify(state)) return false;
+    states.set(member, state);
+    return true;
+  }
+
+  presenceStates(topic) {
+    return this.presence.get(topic) ?? new Map();
+  }
+
+  /** Every presence write keeps a member on a topic for PRESENCE_TTL_MS. */
+  beat(topic, member) {
+    if (!this.beats.has(topic)) this.beats.set(topic, new Map());
+    this.beats.get(topic).set(member, Date.now());
+  }
+
+  presentOn(topic, member, now = Date.now()) {
+    const at = this.beats.get(topic)?.get(member);
+    return at !== undefined && now - at <= PRESENCE_TTL_MS;
+  }
+
+  /** One window's word on whether it is looking at `topic`. */
+  look(topic, member, window, looking) {
+    if (!this.looks.has(topic)) this.looks.set(topic, new Map());
+    this.looks.get(topic).set(`${member}\n${window}`, { at: Date.now(), looking });
+  }
+
+  /** Looking, as the platform decides who a message need not ring: any of the
+   * member's windows says so within the lifetime — or, when none of their
+   * windows says anything, any unexpired presence. */
+  lookingOn(topic, member, now = Date.now()) {
+    let spoke = false;
+    for (const [key, look] of this.looks.get(topic) ?? []) {
+      if (!key.startsWith(`${member}\n`) || now - look.at > PRESENCE_TTL_MS) continue;
+      if (look.looking) return true;
+      spoke = true;
+    }
+    return !spoke && this.presentOn(topic, member, now);
+  }
+
+  /** The member's personal-install state, which a space query composes in
+   * for anyone who never set a space-scoped one. */
+  memberPresenceState(member) {
+    return this.presence.get(accountTopic(member))?.get(member);
+  }
+
+  forgetTopic(topic) {
+    this.presence.delete(topic);
+    this.beats.delete(topic);
+    this.looks.delete(topic);
+  }
+
+  /** Drop `member`'s presence — state and liveness — from each topic. */
+  forgetMember(topics, member) {
+    for (const topic of topics) {
+      this.presence.get(topic)?.delete(member);
+      this.beats.get(topic)?.delete(member);
+    }
+  }
+}
+
+function isJsonContentType(value) {
+  const essence = String(value ?? "").split(";")[0].trim().toLowerCase();
+  const [type, subtype] = essence.split("/");
+  return type === "application" && Boolean(subtype) && (subtype === "json" || subtype.endsWith("+json"));
+}
+
+/** A request body, at most `limit` bytes (413 past it). The body is read to
+ * its end either way, so the refusal reaches the client whole. */
+async function readBodyBuffer(request, limit) {
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of request) {
+    size += chunk.length;
+    if (size <= limit) chunks.push(chunk);
+  }
+  if (size > limit) {
+    throw runtimeError("payload_too_large", `the request body is larger than ${limit} bytes`);
+  }
+  return Buffer.concat(chunks);
+}
+
+/** A JSON door's body: application/json, within `limit`, parsed. */
+async function readJsonBody(request, limit = LIMITS.default_body_bytes) {
+  if (!isJsonContentType(request.headers["content-type"])) {
+    // Drain it, so the refusal is heard.
+    await readBodyBuffer(request, limit).catch(() => undefined);
+    throw runtimeError("bad_request", "Expected request with `Content-Type: application/json`");
+  }
+  const raw = (await readBodyBuffer(request, limit)).toString("utf8");
+  if (!raw.trim()) throw runtimeError("bad_request", "the request body is empty; send a JSON value");
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw runtimeError("bad_request", "request body is not valid JSON");
+  }
+}
+
+function sendJson(response, status, value, headers = {}) {
+  response.writeHead(status, { "content-type": "application/json", ...headers });
+  response.end(JSON.stringify(value ?? null));
+}
+
+function isPlainObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function crc32(bytes) {
+  let crc = 0xffffffff;
+  for (const byte of bytes) {
+    crc ^= byte;
+    for (let bit = 0; bit < 8; bit += 1) {
+      crc = (crc >>> 1) ^ (crc & 1 ? 0xedb88320 : 0);
+    }
+  }
+  return (crc ^ 0xffffffff) >>> 0;
+}
+
+function pngChunk(type, data = Buffer.alloc(0)) {
+  const kind = Buffer.from(type, "ascii");
+  const length = Buffer.alloc(4);
+  length.writeUInt32BE(data.length);
+  const checksum = Buffer.alloc(4);
+  checksum.writeUInt32BE(crc32(Buffer.concat([kind, data])));
+  return Buffer.concat([length, kind, data, checksum]);
+}
+
+/** Small dependency-free platform-style fallback avatar. The color is stable
+ * per handle, so local identities remain visually distinct across restarts. */
+function generatedDevAvatar(handle) {
+  const width = 64;
+  const height = 64;
+  const digest = sha256(handle, "buffer");
+  const background = DEFAULT_DEV_AVATAR_COLORS[digest[0] % DEFAULT_DEV_AVATAR_COLORS.length];
+  const stride = 1 + width * 4;
+  const pixels = Buffer.alloc(stride * height);
+  for (let y = 0; y < height; y += 1) {
+    const row = y * stride;
+    pixels[row] = 0;
+    for (let x = 0; x < width; x += 1) {
+      const head = (x - 32) ** 2 + (y - 22) ** 2 <= 11 ** 2;
+      const body = ((x - 32) / 24) ** 2 + ((y - 59) / 24) ** 2 <= 1;
+      const color = head || body ? [247, 247, 243] : background;
+      const offset = row + 1 + x * 4;
+      pixels[offset] = color[0];
+      pixels[offset + 1] = color[1];
+      pixels[offset + 2] = color[2];
+      pixels[offset + 3] = 255;
+    }
+  }
+  const header = Buffer.alloc(13);
+  header.writeUInt32BE(width, 0);
+  header.writeUInt32BE(height, 4);
+  header.set([8, 6, 0, 0, 0], 8);
+  return Buffer.concat([
+    Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]),
+    pngChunk("IHDR", header),
+    pngChunk("IDAT", deflateSync(pixels)),
+    pngChunk("IEND"),
+  ]);
+}
+
+const defaultDevProfiles = new Map();
+
+function defaultDevProfile(handle) {
+  const cached = defaultDevProfiles.get(handle);
+  if (cached) return cached;
+  const catalogName = DEFAULT_DEV_MEMBERS.find((name) => name.toLowerCase() === handle);
+  const name = catalogName ?? handle
+    .split(/[._~-]+/)
+    .filter(Boolean)
+    .map((part) => part[0].toUpperCase() + part.slice(1))
+    .join(" ");
+  const bytes = generatedDevAvatar(handle);
+  const profile = {
+    handle,
+    name,
+    bio: "Local Terminus test account.",
+    avatar: {
+      bytes,
+      contentType: "image/png",
+      version: sha256(bytes).slice(0, 8),
+    },
+  };
+  defaultDevProfiles.set(handle, profile);
+  return profile;
+}
+
+function requestedDevMembers(raw, profiles) {
+  if (raw == null) return profiles.size ? [...profiles.keys()] : [DEFAULT_DEV_MEMBER];
+  if (Array.isArray(raw)) return raw;
+  const value = String(raw).trim();
+  if (/^\d+$/.test(value)) {
+    const count = Number(value);
+    if (!Number.isSafeInteger(count) || count < 1 || count > DEFAULT_DEV_MEMBERS.length) {
+      throw new CliError(`--members must be between 1 and ${DEFAULT_DEV_MEMBERS.length}`);
+    }
+    return DEFAULT_DEV_MEMBERS.slice(0, count).map((name) => name.toLowerCase());
+  }
+  return value.split(",").map((member) => member.trim()).filter(Boolean);
+}
+
+function sniffDevAvatar(bytes) {
+  if (bytes.length >= 3 && bytes[0] === 0xff && bytes[1] === 0xd8 && bytes[2] === 0xff) {
+    return "image/jpeg";
+  }
+  if (bytes.length >= 8 && bytes.subarray(0, 8).equals(
+    Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]),
+  )) {
+    return "image/png";
+  }
+  if (bytes.length >= 12 && bytes.subarray(0, 4).toString() === "RIFF"
+    && bytes.subarray(8, 12).toString() === "WEBP") {
+    return "image/webp";
+  }
+  return null;
+}
+
+function escapeHtml(value) {
+  return String(value)
+    .replaceAll("&", "&amp;")
+    .replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;")
+    .replaceAll('"', "&quot;")
+    .replaceAll("'", "&#39;");
+}
+
+function normalizeDevHandle(raw) {
+  const handle = String(raw ?? "").trim().replace(/^@/, "");
+  if (!DEV_HANDLE_PATTERN.test(handle)) {
+    throw new CliError(`invalid local member handle '${handle}'`);
+  }
+  return handle;
+}
+
+function normalizeDevProfileText(raw, field, max, { multiline = false } = {}) {
+  if (typeof raw !== "string") throw new CliError(`${field} must be a string`);
+  const value = String(raw ?? "").replaceAll("\r\n", "\n").replaceAll("\r", "\n").trim();
+  if ((!multiline && !value) || [...value].length > max) {
+    throw new CliError(`${field} must be ${multiline ? `at most ${max}` : `1-${max}`} characters`);
+  }
+  if ([...value].some((character) => {
+    return /\p{Cc}/u.test(character) && (character !== "\n" || !multiline);
+  })) {
+    throw new CliError(`${field} contains unsupported control characters`);
+  }
+  return value;
+}
+
+async function loadDevProfiles(profileFile) {
+  const profiles = new Map();
+  if (!profileFile) return profiles;
+  const absolute = path.resolve(profileFile);
+  let document;
+  try {
+    document = JSON.parse(await readFile(absolute, "utf8"));
+  } catch (error) {
+    throw new CliError(`could not read --profiles ${absolute}: ${error.message}`);
+  }
+  if (!document || typeof document !== "object" || Array.isArray(document)) {
+    throw new CliError("--profiles must be a JSON object keyed by local member handle");
+  }
+  for (const [rawHandle, rawProfile] of Object.entries(document)) {
+    const handle = normalizeDevHandle(rawHandle);
+    if (!rawProfile || typeof rawProfile !== "object" || Array.isArray(rawProfile)) {
+      throw new CliError(`profile for @${handle} must be an object`);
+    }
+    const unknown = Object.keys(rawProfile).find(
+      (field) => !["name", "bio", "avatar"].includes(field),
+    );
+    if (unknown) throw new CliError(`unknown profile field '${unknown}' for @${handle}`);
+    const name = normalizeDevProfileText(rawProfile.name ?? handle, `name for @${handle}`, 80);
+    const bio = normalizeDevProfileText(
+      rawProfile.bio ?? "",
+      `bio for @${handle}`,
+      280,
+      { multiline: true },
+    );
+    let avatar = null;
+    if (rawProfile.avatar != null) {
+      if (typeof rawProfile.avatar !== "string" || !rawProfile.avatar.trim()) {
+        throw new CliError(`avatar for @${handle} must be a file path`);
+      }
+      const avatarPath = path.resolve(path.dirname(absolute), String(rawProfile.avatar));
+      const bytes = await readFile(avatarPath).catch((error) => {
+        throw new CliError(`could not read avatar for @${handle}: ${error.message}`);
+      });
+      if (!bytes.length || bytes.length > MAX_DEV_AVATAR_BYTES) {
+        throw new CliError(`avatar for @${handle} must be 1 byte-${MAX_DEV_AVATAR_BYTES} bytes`);
+      }
+      const contentType = sniffDevAvatar(bytes);
+      if (!contentType) {
+        throw new CliError(`avatar for @${handle} must be a JPEG, PNG, or WebP image`);
+      }
+      avatar = { bytes, contentType, version: sha256(bytes).slice(0, 8) };
+    }
+    profiles.set(handle, { handle, name, bio, avatar });
+  }
+  return profiles;
+}
+
+function parseCollectionCursor(raw) {
+  if (raw === null || raw === undefined || raw === "") return 0;
+  const match = /^c1_(\d+)$/.exec(String(raw));
+  if (!match) throw new CliError("invalid collection cursor");
+  return Number(match[1]);
+}
+
+function collectionCursor(value) {
+  return `c1_${value}`;
+}
+
+function parseCollaborationCursor(raw) {
+  if (raw === null || raw === undefined || raw === "") return 0;
+  const match = /^o1_(\d+)$/.exec(String(raw));
+  if (!match) throw new CliError("invalid collaboration cursor");
+  return Number(match[1]);
+}
+
+function collaborationCursor(value) {
+  return `o1_${value}`;
+}
+
+/**
+ * Start the harness servers: one HTTP port per member, all sharing the same
+ * fixture store and event bus. Returns member→port plus a close handle so
+ * tests can drive the real protocol.
+ */
+/** Open an app package for the harness: runtime index only — no source
+ * snapshot (dev materials feed the local runtime, not a ledger) and no file
+ * content (the bundle is served from disk). */
+export function readDevPackage(dir) {
+  return readAppPackage(dir, { allowMissingUi: true, includeSource: false, includeContent: false });
+}
+
+/** Fail before the harness creates fixture state, contacts the production
+ * runtime, or binds a port when the configured browser bundle is absent. */
+export function requireBuiltDevBundle(pkg) {
+  if (pkg.hasUi) return;
+  if (pkg.manifest.kind !== "app") {
+    throw new CliError("terminus dev serves browser-app bundles; this package has no browser interface");
+  }
+  throw new CliError(
+    `No built bundle in ${pkg.uiDirectory}/. Run \`npm run build\` before \`terminus dev\`.`,
+  );
+}
+
+/** Static ui/ files, live from disk. Extensionless misses fall back to
+ * index.html. Every HTML document gets the app host's route script, as the
+ * host serves it; `transformHtml` then adds what only the local harness mounts
+ * (its request control) — `dev --remote` passes none. */
+export async function serveUiAsset(
+  pkg,
+  uiDir,
+  url,
+  request,
+  response,
+  { transformHtml } = {},
+) {
+  let relative = url.pathname === "/" ? "index.html" : safeRelativePath(url.pathname);
+  let file = relative ? path.join(uiDir, relative) : null;
+  let exists = file
+    ? await stat(file).then((entry) => entry.isFile()).catch(() => false)
+    : false;
+  const acceptsHtml = String(request.headers.accept ?? "").includes("text/html");
+  if (!exists && acceptsHtml && relative && !relative.includes(".")) {
+    relative = "index.html";
+    file = path.join(uiDir, relative);
+    exists = await stat(file).then((entry) => entry.isFile()).catch(() => false);
+  }
+  if (!file || !exists) {
+    // Defensive guidance if a rebuild removes index.html while a running
+    // harness is serving files live from disk.
+    const indexExists = await stat(path.join(uiDir, "index.html"))
+      .then((entry) => entry.isFile())
+      .catch(() => false);
+    if (!indexExists && acceptsHtml) {
+      response.writeHead(503, { "content-type": "text/html; charset=utf-8" });
+      return response.end(
+        `<!doctype html><meta charset="utf-8"><title>terminus dev</title>`
+        + `<body style="font: 15px/1.6 system-ui; max-width: 34rem; margin: 4rem auto; padding: 0 1rem">`
+        + `<h1 style="font-size:1.2rem">No built bundle yet</h1>`
+        + `<p><code>${pkg.manifest.slug}</code> has nothing in <code>${pkg.uiDirectory}/</code>. Either:</p>`
+        + `<ul><li>run the app's build (<code>terminus build</code> or <code>npm run build</code>) and refresh — `
+        + `the harness serves it live from disk, or</li>`
+        + `<li>develop with hot reload: <code>npm run dev</code> and open the Vite port `
+        + `(the scaffold proxies <code>/_terminus</code> here).</li></ul>`
+        + `<p>The runtime protocol at <code>/_terminus/*</code> is already live.</p>`,
+      );
+    }
+    response.writeHead(404, { "content-type": "text/plain" });
+    return response.end("not found");
+  }
+  const type = CONTENT_TYPES.get(path.extname(file).toLowerCase()) ?? "application/octet-stream";
+  const bytes = await readFile(file);
+  let body = bytes;
+  if (type.startsWith("text/html")) {
+    const html = injectAppRouteScript(bytes.toString("utf8"));
+    body = Buffer.from(transformHtml ? transformHtml(html) : html);
+  }
+  response.writeHead(200, { "content-type": type });
+  response.end(body);
+}
+
+export async function startDevServer(dir, options = {}) {
+  const pkg = options.pkg ?? await readDevPackage(dir);
+  requireBuiltDevBundle(pkg);
+  const profiles = await loadDevProfiles(options.profiles);
+  const members = requestedDevMembers(options.members, profiles).map(normalizeDevHandle);
+  if (!members.length) throw new CliError("--members needs at least one handle");
+  if (new Set(members).size !== members.length) throw new CliError("--members contains duplicates");
+  const unavailableProfile = [...profiles.keys()].find((handle) => !members.includes(handle));
+  if (unavailableProfile) {
+    throw new CliError(`profile @${unavailableProfile} is not included in --members`);
+  }
+  const guest = Boolean(options.guest);
+  // Who each port is. The identity IS the port: a member's port is always
+  // that member (signed out after /_terminus/logout, until the app is opened
+  // again), and the guest's port — the last one, after the members' — is
+  // nobody until someone signs in on it, and nobody again once they sign out.
+  const seats = [
+    ...members.map((member) => ({ member, guest: false, signedOut: false, port: null })),
+    ...(guest ? [{ member: null, guest: true, signedOut: false, port: null }] : []),
+  ];
+  const guestSeat = seats.find((seat) => seat.guest) ?? null;
+  const basePort = resolveDevPortRange(options.port, seats.length);
+  await assertDevPortRangeAvailable({
+    basePort,
+    commandArgs: options.commandArgs,
+    count: seats.length,
+    directory: dir,
+    guest,
+    members,
+    viteProxy: true,
+  });
+  const appId = pkg.id ?? `@local/${pkg.manifest.slug}`;
+  /** The app's name in a bootstrap: the last part of its address. */
+  const appSlug = appId.split("/").at(-1);
+  /** What a guest's bootstrap says: the contract's own, filled in the way the
+   * app host fills it from the platform's resolve answer for this app. */
+  const guestBootstrap = guest
+    ? fillGuestBootstrap(APP_HOST.guest.bootstrap, { app_id: DEV_APP_ID, slug: appSlug, name: appSlug })
+    : null;
+  const rootDir = path.join(dir, DEV_DIRECTORY);
+  if (options.fresh) await rm(rootDir, { recursive: true, force: true });
+  await ensureDevDirectory(dir);
+  const systemStore = new DevSystemStore(rootDir, appId);
+  const registry = new DevSpaceRegistry(systemStore);
+  registry.load();
+  const bus = new DevEventBus(DEV_APP_ID);
+  const dataPlane = new DevDataPlane({ rootDir, db: systemStore.db, appId });
+  const uiDir = path.join(dir, pkg.uiDirectory);
+  const notifications = [];
+  // Per member: until when they have paused this app's notifications, as
+  // production keeps it on their installation (`notifications_paused_until`).
+  // In memory, like the notifications themselves.
+  const notificationPauses = new Map();
+  // Per member and space: muted (true) or left to ring (false); no entry
+  // follows the member's default, and `defaultMutes` holds who mutes by
+  // default. Production keeps these on the membership and the installation.
+  const spaceMutes = new Map();
+  const defaultMutes = new Set();
+  // One release: every member runs this folder, so each collection has one
+  // definition here, the same for all of them, and a name is never redefined
+  // (a differing definition is refused). The platform pins definitions per
+  // installation release and so also checks a write to a space collection
+  // against the published release's definition when the writer is on an
+  // older one — one set of rules for data the members share. Locally the
+  // writer's release IS the published one, so that second check would run
+  // the same rules twice; there is nothing to build.
+  const collectionDefinitions = new Map(
+    systemStore.collectionDefinitions().map(([name, definition]) => [
+      name,
+      normalizeCollectionDefinition(name, definition, { strict: false }),
+    ]),
+  );
+  for (const definition of pkg.manifest.resources?.collections ?? []) {
+    const normalized = normalizeCollectionDefinition(definition.name, definition, { strict: false });
+    const persisted = normalizeCollectionDefinition(
+      definition.name,
+      systemStore.defineCollection(definition.name, normalized).existing,
+      { strict: false },
+    );
+    if (JSON.stringify(persisted) !== JSON.stringify(normalized)) {
+      throw runtimeError("conflict", `collection '${definition.name}' was already defined differently for this release`);
+    }
+    collectionDefinitions.set(definition.name, normalized);
+  }
+  const capsules = new Map(
+    members.map((member) => [member, new DevCapsuleStore(rootDir, appId, member)]),
+  );
+  // The platform compacts collaboration journals every 30 s: the operations a
+  // snapshot covers leave the journal, and a reader behind them resets to the
+  // snapshot. Here too, so an app's reset path runs before it is published.
+  const compactor = setInterval(() => {
+    try {
+      systemStore.compactCollaboration();
+    } catch {
+      // The next tick tries again, as the platform's worker does.
+    }
+  }, options.collaborationCompactionMs ?? 30_000);
+  compactor.unref();
+  const automationJobs = new Map();
+  // A queued job starts after this long (the platform's worker picks jobs up
+  // a moment later; tests that cancel one keep it queued longer).
+  const jobStartMs = options.jobStartMs ?? 0;
+  const jobTimers = new Set();
+  const scheduleOverrides = new Map();
+  // The first answer of each optional Idempotency-Key (events, notifications,
+  // collect, jobs): a replay repeats no effect and answers it again.
+  const replays = new Map();
+  // Per-minute and per-day budgets the platform enforces.
+  const budgets = new Map();
+  const collectSubmissions = new Map();
+  // The app's server/ code runs here the way the platform runs it: the sync
+  // door, `server.run` steps, records in this data space, and syscalls onto
+  // the member's own files.
+  const serverTier = createDevServerTier({
+    dir,
+    manifest: pkg.manifest,
+    store: systemStore,
+    capsule: { read: serverCapsuleRead, write: serverCapsuleWrite },
+    collect: serverCollect,
+    // The public web its fetches reach is the net doors' (tests stand one in).
+    fetchText: (url) => fetchPublicText(url, {
+      fetchImpl: options.netFetch ?? null,
+      ...(options.netTimeoutMs ? { timeoutMs: options.netTimeoutMs } : {}),
+    }),
+    ...(options.serverLog ? { log: options.serverLog } : {}),
+    ...(options.serverRelay ? { relay: options.serverRelay } : {}),
+  });
+
+  function capsule(member) {
+    const store = capsules.get(member);
+    if (!store) throw new CliError(`no local capsule for @${member}`);
+    return store;
+  }
+
+  function profile(member) {
+    const fallback = defaultDevProfile(member);
+    const configured = profiles.get(member);
+    if (!configured) return fallback;
+    return {
+      ...fallback,
+      ...configured,
+      avatar: configured.avatar ?? fallback.avatar,
+    };
+  }
+
+  /** PublicUser: `{id, handle, display_name, avatar_url, public_profile_url}`. */
+  function publicIdentity(member) {
+    const fixture = profile(member);
+    return {
+      id: member,
+      handle: member,
+      display_name: fixture.name,
+      avatar_url: fixture.avatar
+        ? `/_terminus/users/${encodeURIComponent(member)}/avatar?v=${fixture.avatar.version}`
+        : null,
+      public_profile_url: `/_terminus/users/${encodeURIComponent(member)}/profile`,
+    };
+  }
+
+  function publicInvitation(invitation) {
+    return {
+      id: invitation.id,
+      space_id: invitation.spaceId,
+      invitee: publicIdentity(invitation.invitee),
+      role: invitation.role,
+      status: invitation.status,
+      created_at: invitation.createdAt,
+      expires_at: invitation.expiresAt,
+    };
+  }
+
+  function invitationReceipt(invitation, created) {
+    return {
+      id: invitation.id,
+      user_id: invitation.invitee,
+      handle: invitation.invitee,
+      created,
+    };
+  }
+
+  /** A handle the way the platform reads one from a request: trimmed, one
+   * leading "@" dropped, lowercased. */
+  function handleInput(raw) {
+    if (typeof raw !== "string") throw runtimeError("bad_request", "handles are strings");
+    const handle = raw.trim().replace(/^@/u, "").toLowerCase();
+    if (!handle || handle.length > 64) throw runtimeError("bad_request", "invalid handle");
+    return handle;
+  }
+
+  /** A person in this local directory, or 404 as the platform answers it. */
+  function knownPerson(raw) {
+    const handle = handleInput(raw);
+    if (!members.includes(handle)) throw runtimeError("not_found", `no user with handle @${handle}`);
+    return handle;
+  }
+
+  /* ── the live transport ──────────────────────────────────────────────── */
+
+  const memberOrigin = (member, role) => ({ kind: "member", user_id: member, ...(role ? { role } : {}) });
+  const PLATFORM = { kind: "platform" };
+
+  /* A platform change signal reaches every member who can read the change,
+   * the writer's own windows included — and nobody else (D3). */
+
+  /** A change to a space's own records, objects or roster: every member
+   * hears it. */
+  function signalSpace(spaceId, from, event, { transient = false } = {}) {
+    const space = registry.find(spaceId);
+    if (!space) return;
+    bus.deliver(space.members, bus.envelope("space_event", spaceId, from, event, transient));
+  }
+
+  /** A change to `member`'s own data: their windows alone. Their collection
+   * is theirs even opened inside a space, which the frame still names (their
+   * window there reads it) — nobody else reads that change feed, and a frame
+   * of it on someone else's stream could pass for one of theirs. */
+  function signalOwner(member, spaceId, from, event, { transient = false } = {}) {
+    bus.deliver([member], bus.envelope("space_event", spaceId, from, event, transient));
+  }
+
+  /** A write to a resource a call names the owner of — a bucket, a
+   * collaboration document: the space's own when the write named a space,
+   * else the writer's own. */
+  function signalWrite(member, spaceId, event, options = {}) {
+    if (spaceId) signalSpace(spaceId, memberOrigin(member), event, options);
+    else signalOwner(member, null, memberOrigin(member), event, options);
+  }
+
+  /** An account frame to `member`: space_id null, the space named inside. */
+  function accountEvent(member, event) {
+    bus.deliver([member], bus.envelope("account_event", null, PLATFORM, event, false));
+  }
+
+  /** A presence frame about `member`: online with the state they set (none
+   * for a window that just opened), or — a cleared state, their last window
+   * closing — `online: false`, which is a leave. */
+  function presenceFrame(spaceId, member, state) {
+    return bus.envelope("presence", spaceId, memberOrigin(member), (
+      state === null ? { online: false } : { online: true, ...(state === undefined ? {} : { state }) }
+    ), true);
+  }
+
+  /** Everyone `member` shares a space with — never `member`. */
+  function coMembers(member) {
+    const peers = new Set();
+    for (const space of registry.spaces) {
+      if (!space.members.includes(member)) continue;
+      for (const peer of space.members) if (peer !== member) peers.add(peer);
+    }
+    return [...peers];
+  }
+
+  /** `member`'s last live window closed: every co-member hears `online:
+   * false` in each space they share (the frame names it, so that space's
+   * rooms apply it) and once with no space, for personal-install rooms; and
+   * the member's presence leaves those topics, so the presence query agrees.
+   * Never their own streams (D3). */
+  function announcePresenceGone(member) {
+    const spaces = registry.spaces.filter((space) => space.members.includes(member));
+    bus.forgetMember([...spaces.map((space) => space.id), accountTopic(member)], member);
+    for (const space of spaces) {
+      bus.deliver(space.members.filter((peer) => peer !== member), presenceFrame(space.id, member, null));
+    }
+    bus.deliver(coMembers(member), presenceFrame(null, member, null));
+  }
+
+  /* ── spaces ─────────────────────────────────────────────────────────── */
+
+  /** The space, when `member` is in it; the platform's 404 otherwise. */
+  function requireSpace(member, spaceId) {
+    const space = registry.find(spaceId);
+    if (!space || !space.members.includes(member)) throw runtimeError("not_found", "app space not found");
+    return space;
+  }
+
+  /** A viewer reads a space and writes nothing in it — the platform's rule,
+   * so a member moved to Can view is turned away here as they will be there. */
+  function requireSpaceWriter(member, spaceId) {
+    if (spaceId && registry.memberRole(requireSpace(member, spaceId).id, member) === "viewer") {
+      throw runtimeError("forbidden", "space write access is required");
+    }
+  }
+
+  function requireGroup(space) {
+    if (space.kind !== "group") {
+      throw runtimeError("bad_request", "direct conversations do not support group management");
+    }
+  }
+
+  function requireManager(space, member) {
+    if (!registry.canManage(space.id, member)) throw runtimeError("forbidden", "space admin access is required");
+  }
+
+  /** Whether `spaceId`'s messages ring `member` with nothing: their own choice
+   * for it, else their default. A mention rings them either way. */
+  function mutedFor(member, spaceId) {
+    return spaceMutes.get(`${member}\n${spaceId}`) ?? defaultMutes.has(member);
+  }
+
+  /** Space: the caller's view of one space. `peer` names who a direct space
+   * is with — its other member, or, until they answer, the person invited;
+   * null for a group, or once nobody else is in it or invited — so an app
+   * labels a conversation without reading its roster. Blocks are between the
+   * two members; a viewer reads a space and sends nothing into it. */
+  function spaceView(space, member) {
+    const role = registry.memberRole(space.id, member);
+    const direct = space.kind === "direct";
+    const manager = role === "owner" || role === "admin";
+    const writer = manager || role === "editor";
+    const peer = registry.peer(space, member);
+    const asked = direct && !peer ? (registry.pendingInvitations(space.id)[0]?.invitee ?? null) : null;
+    const blockedByMe = Boolean(peer && registry.blockedBy(member, peer));
+    const blockedByPeer = Boolean(peer && registry.blockedBy(peer, member));
+    return {
+      id: space.id,
+      name: space.name,
+      kind: space.kind,
+      peer: (peer ?? asked) ? publicIdentity(peer ?? asked) : null,
+      parent_id: space.parentId ?? null,
+      meta: space.meta ?? null,
+      my_role: role,
+      blocked_by_me: blockedByMe,
+      blocked_by_peer: blockedByPeer,
+      muted: mutedFor(member, space.id),
+      capabilities: {
+        can_send: writer && !(blockedByMe || blockedByPeer),
+        can_invite: !direct && manager,
+        can_remove_members: !direct && manager,
+        can_manage_roles: !direct && manager,
+        can_update: direct || manager,
+        can_leave: !direct && role !== "owner",
+        can_block_peer: direct && Boolean(peer),
+        can_delete: role === "owner",
+      },
+    };
+  }
+
+  const ROLE_ORDER = { owner: 0, admin: 1, editor: 2, viewer: 3 };
+
+  /** SpaceMember rows: the owner, then admins, editors and viewers, each by handle. */
+  function memberRows(space) {
+    return space.members
+      .map((handle) => ({
+        ...publicIdentity(handle),
+        role: registry.memberRole(space.id, handle),
+        joined_at: space.joined?.[handle] ?? space.createdAt,
+      }))
+      .sort((left, right) => (ROLE_ORDER[left.role] - ROLE_ORDER[right.role])
+        || compareStrings(left.handle, right.handle));
+  }
+
+  function spaceName(raw) {
+    const name = typeof raw === "string" ? raw.trim() : null;
+    if (!name || [...name].length > LIMITS.space_name_chars) {
+      throw runtimeError("bad_request", `space name must be 1-${LIMITS.space_name_chars} characters`);
+    }
+    return name;
+  }
+
+  /** App-defined meta: a JSON object every member reads, at most the
+   * contract's `space_meta_bytes`. */
+  function spaceMeta(raw) {
+    if (!isPlainObject(raw)) throw runtimeError("bad_request", "meta must be a JSON object or null");
+    if (Buffer.byteLength(JSON.stringify(raw)) > LIMITS.space_meta_bytes) {
+      throw runtimeError("payload_too_large", `space meta is at most ${LIMITS.space_meta_bytes} bytes`);
+    }
+    return structuredClone(raw);
+  }
+
+  /** How an invitation reads. Being asked to talk to one person and being
+   * added to a room of eleven are different requests, and the difference is
+   * the only thing the recipient needs in order to answer. */
+  function invitationCopy(space, inviter) {
+    const direct = space?.kind === "direct";
+    return {
+      direct,
+      title: direct
+        ? `@${inviter} wants to chat with you`
+        : `@${inviter} invited you to ${space?.name ?? "a space"}`,
+    };
+  }
+
+  function ringInvitation(space, inviter, invitation) {
+    const copy = invitationCopy(space, inviter);
+    notifyMember({
+      id: crypto.randomUUID(),
+      member: invitation.invitee,
+      title: copy.title,
+      body: copy.direct
+        ? `Accept to start a conversation in ${pkg.id ?? pkg.manifest.slug}.`
+        : `Review the request before joining ${pkg.id ?? pkg.manifest.slug}.`,
+      route: null,
+      data: { kind: "space.invited", space_id: space.id, invitation_id: invitation.id },
+      read_at: null,
+      created_at: new Date().toISOString(),
+    });
+  }
+
+  /* ── notifications ──────────────────────────────────────────────────── */
+
+  /** Until when `member` has paused notifications, or null once the pause is
+   * over — it ends on its own, as in production. */
+  function pausedUntil(member) {
+    const until = notificationPauses.get(member);
+    if (until && Date.parse(until) > Date.now()) return until;
+    notificationPauses.delete(member);
+    return null;
+  }
+
+  /** AppNotice: the row an app reads. */
+  function appNotice(item) {
+    const kind = { "space.invited": "invite", mention: "mention", message: "message" }[item.data?.kind] ?? "notice";
+    return {
+      id: item.id,
+      kind,
+      title: item.title,
+      body: item.body ?? "",
+      route: item.route ?? null,
+      data: item.data ?? {},
+      space_id: item.data?.space_id ?? null,
+      read_at: item.read_at,
+      created_at: item.created_at,
+    };
+  }
+
+  /** Ring `notice.member`: a row, and notification.created on their account
+   * stream. A paused member is rung by nothing but an invite, and nothing is
+   * saved up for when the pause ends. One unread message row per member and
+   * space, updated in place. Says whether it rang. */
+  function notifyMember(notice) {
+    if (pausedUntil(notice.member) && notice.data?.kind !== "space.invited") return false;
+    let item = notice;
+    if (notice.data?.kind === "message" && notice.data?.space_id) {
+      const existing = notifications.find((candidate) => candidate.member === notice.member
+        && candidate.data?.kind === "message"
+        && candidate.data?.space_id === notice.data.space_id
+        && !candidate.read_at);
+      if (existing) {
+        Object.assign(existing, {
+          title: notice.title,
+          body: notice.body,
+          route: notice.route,
+          data: notice.data,
+          created_at: notice.created_at,
+        });
+        item = existing;
+      } else {
+        notifications.push(notice);
+      }
+    } else {
+      notifications.push(notice);
+    }
+    accountEvent(item.member, {
+      type: "notification.created",
+      notification_id: item.id,
+      title: item.title,
+      body: item.body ?? "",
+      data: item.data ?? {},
+    });
+    return true;
+  }
+
+  /** Looking at the space right now, as the platform counts it for a bell:
+   * one of the member's windows showing it (visible, with a state), or —
+   * for a client that says nothing about windows — presence on the space's
+   * own topic within its lifetime. An open stream alone is not looking:
+   * every open app holds one stream for all of a member's spaces. */
+  function memberLooking(member, spaceId) {
+    return bus.lookingOn(spaceId, member);
+  }
+
+  /** The app's message row for everyone in `targets` who is not the actor,
+   * not `excluded` (the mentioned: their own row already rang), and not
+   * looking at the space right now — a bell is for people who are not. */
+  function notifyAbsentMembers(space, actor, notify, data, excluded = new Set(), targets = space.members) {
+    for (const target of targets) {
+      if (target === actor || excluded.has(target) || memberLooking(target, space.id)) continue;
+      // A space they muted rings them with nothing but a mention.
+      if (mutedFor(target, space.id)) continue;
+      notifyMember({
+        id: crypto.randomUUID(),
+        member: target,
+        title: notify.title,
+        body: notify.body,
+        route: notify.route,
+        // Who it came from, which the row did not carry and the local
+        // notification corner needs: a card with a face on it is how a person
+        // testing four windows tells four cards apart.
+        data: { ...data, from: publicIdentity(actor) },
+        read_at: null,
+        created_at: new Date().toISOString(),
+      });
+    }
+  }
+
+  /** The platform's own row for each person a write names: "@sender mentioned
+   * you in <space>", in the platform's words, one row per mention, and none
+   * for someone who paused the app. */
+  function ringMentions(space, actor, targets, { body, route, data }) {
+    // A direct space is named after the other person from its creator's side
+    // ("in Bob" would read wrong to Bob): it says only who.
+    const title = space.kind === "direct"
+      ? `@${actor} mentioned you`
+      : `@${actor} mentioned you in ${space.name}`;
+    for (const target of targets) {
+      const rang = notifyMember({
+        id: crypto.randomUUID(),
+        member: target,
+        title,
+        body,
+        route,
+        data: { kind: "mention", ...data },
+        read_at: null,
+        created_at: new Date().toISOString(),
+      });
+      if (rang) console.log(`[notify @${target}] ${title}: ${body}`);
+    }
+  }
+
+  /** The rings a transaction or a delivery commits with, once, on its first
+   * commit — a replay never gets here. */
+  function ringSpaceWrite(space, actor, candidates, { notify, mentions }, data) {
+    const mentioned = mentionTargets(candidates, mentions, actor);
+    ringMentions(space, actor, mentioned, {
+      body: firstChars(notify?.body ?? "", MENTION_PREVIEW_CHARS),
+      route: notify?.route ?? null,
+      data,
+    });
+    if (notify && notify.audience !== "mentioned") {
+      notifyAbsentMembers(
+        space,
+        actor,
+        notify,
+        { kind: "message", ...data },
+        new Set(mentioned),
+        candidates,
+      );
+    }
+  }
+
+  /* ── budgets and replays ─────────────────────────────────────────────── */
+
+  /** Count one use of `key` against `limit` per `windowMs`; false when spent. */
+  function spend(key, limit, windowMs) {
+    const now = Date.now();
+    const recent = (budgets.get(key) ?? []).filter((at) => now - at < windowMs);
+    if (recent.length >= limit) {
+      budgets.set(key, recent);
+      return false;
+    }
+    recent.push(now);
+    budgets.set(key, recent);
+    return true;
+  }
+
+  /** Run `task` once per optional Idempotency-Key: the same key and request
+   * answers the first answer again and repeats no effect; the same key naming
+   * another request is 409 idempotency_conflict. A door checks only its
+   * request's own shape before calling this and every other check inside
+   * `task`, so a replay is recognized before any of them — permission,
+   * budget, space — as the contract says it is. */
+  async function once(door, member, key, request, task) {
+    if (!key) return task();
+    const slot = `${door}\n${member}\n${key}`;
+    const fingerprint = sha256(JSON.stringify(request ?? null));
+    const prior = replays.get(slot);
+    if (prior) {
+      if (prior.fingerprint !== fingerprint) {
+        throw runtimeError("idempotency_conflict", "Idempotency-Key was already used for a different request");
+      }
+      if (prior.pending) {
+        throw runtimeError("still_pending", "a request with this Idempotency-Key is still in flight");
+      }
+      return structuredClone(prior.answer);
+    }
+    replays.set(slot, { fingerprint, pending: true });
+    try {
+      const answer = await task();
+      replays.set(slot, { fingerprint, answer: structuredClone(answer) });
+      return answer;
+    } catch (error) {
+      replays.delete(slot);
+      throw error;
+    }
+  }
+
+  /** Optional cross-boundary authority stays release-pinned in production;
+   * the harness refuses it identically. */
+  function requireCapability(group, capability) {
+    const declared = pkg.manifest.capabilities?.[group];
+    if (!Array.isArray(declared) || !declared.includes(capability)) {
+      throw runtimeError(
+        "forbidden",
+        `this release did not declare ${group}:${capability} access`
+          + " — use the corresponding Terminus SDK call so terminus validate can compile the release grant",
+      );
+    }
+  }
+
+  /* ── collections ────────────────────────────────────────────────────── */
+
+  function collectionScopeKey(declaration, spaceId, name) {
+    if (declaration.ownership === "space") return `space:${spaceId}:${name}`;
+    return spaceId ? `member:${spaceId}:${name}` : `personal:${name}`;
+  }
+
+  function visibleCollectionChange(declaration, actor, rawChange) {
+    const policyRecord = rawChange.policy_record === null
+      ? null
+      : {
+          value: rawChange.policy_record,
+          created_by_user_id: rawChange.policy_created_by_user_id,
+          updated_by_user_id: rawChange.policy_updated_by_user_id,
+        };
+    try {
+      authorizeCollection(declaration, "read", actor, policyRecord);
+    } catch (error) {
+      if (error?.status === 403) return null;
+      throw error;
+    }
+    const committed = { ...rawChange, cursor: collectionCursor(rawChange.cursor) };
+    delete committed.policy_record;
+    delete committed.policy_created_by_user_id;
+    delete committed.policy_updated_by_user_id;
+    if (committed.value && typeof committed.value === "object" && !Array.isArray(committed.value)) {
+      committed.value = redactCollectionRecord(
+        declaration,
+        actor,
+        { value: committed.value },
+      ).value;
+    }
+    return committed;
+  }
+
+  /** The `record_changed` wake, to who can read the change: a space-owned
+   * collection's members, or a personal collection's owner alone — inside a
+   * space too. The harness's frames are thin — no value and no prev_cursor,
+   * so a live projection always drains the change feed — but they carry the
+   * platform's clock as the hosted ones do: a put says when its record was
+   * first written and when this change committed, a delete when it
+   * committed. */
+  function publishCollectionWake(member, spaceId, { declaration, operation, collection, recordId }, rawChange) {
+    const event = {
+      type: "record_changed",
+      operation,
+      collection,
+      ...(recordId === null ? {} : { record_id: recordId }),
+      mutation_id: rawChange.mutation_id,
+      cursor: collectionCursor(rawChange.cursor),
+      ...(operation === "put" ? { created_at: rawChange.created_at } : {}),
+      ...(operation === "put" || operation === "delete"
+        ? { committed_at: rawChange.committed_at }
+        : {}),
+    };
+    if (declaration.ownership === "space") signalSpace(spaceId, memberOrigin(member), event);
+    else signalOwner(member, spaceId, memberOrigin(member), event);
+  }
+
+  function collectionDefinition(name) {
+    const definition = collectionDefinitions.get(name);
+    if (!definition) throw runtimeError("forbidden", `release did not declare collections:${name}`);
+    return definition;
+  }
+
+  function requireCollectionScope(declaration, member, requestedSpaceId) {
+    const spaceId = requestedSpaceId || null;
+    if (declaration.ownership === "space" && !spaceId) {
+      throw runtimeError("bad_request", "space-owned collections require space_id");
+    }
+    if (spaceId) requireSpace(member, spaceId);
+    return spaceId;
+  }
+
+  function managedStoreMember(declaration, member, spaceId) {
+    if (declaration.ownership !== "space") return member;
+    return registry.find(spaceId).members[0];
+  }
+
+  function managedPolicyActor(declaration, member, spaceId, principal = "user") {
+    return {
+      userId: member,
+      principal,
+      capsuleOwner: managedStoreMember(declaration, member, spaceId),
+      spaceRole: spaceId ? registry.memberRole(spaceId, member) : null,
+    };
+  }
+
+  /** A store refusal, in the contract's code for it. */
+  function storeConflict(result) {
+    return runtimeError(result.code ?? "conflict", result.conflict);
+  }
+
+  /** Run a capsule transaction, answering a mid-transaction refusal in its code. */
+  function transact(store, input) {
+    try {
+      return store.transactRecords(input);
+    } catch (error) {
+      if (error?.conflictCode) throw runtimeError(error.conflictCode, error.message);
+      throw error;
+    }
+  }
+
+  function validateLocalDeclaredConstraints(store, member, spaceId, inputOperations) {
+    const baseOwnership = inputOperations[0].declaration.ownership;
+    const compatible = [...collectionDefinitions.entries()].filter(([, declaration]) => (
+      spaceId === null
+        ? declaration.ownership !== "space"
+        : (declaration.ownership === "space") === (baseOwnership === "space")
+    ));
+    const states = new Map(compatible.map(([name, declaration]) => [
+      name,
+      {
+        declaration,
+        scopeKey: collectionScopeKey(declaration, spaceId, name),
+        records: new Map(
+          store.listRecords(collectionScopeKey(declaration, spaceId, name), name)
+            .map((record) => [record.id, record]),
+        ),
+      },
+    ]));
+    const operations = inputOperations.map((operation) => ({ ...operation }));
+    for (const operation of operations.filter((candidate) => candidate.operation === "put")) {
+      const state = states.get(operation.collection);
+      const prior = state.records.get(operation.recordId);
+      state.records.set(operation.recordId, {
+        id: operation.recordId,
+        value: operation.value,
+        created_by_user_id: prior?.created_by_user_id ?? member,
+        updated_by_user_id: member,
+      });
+    }
+    const deleting = new Set(
+      operations.filter((operation) => operation.operation === "delete")
+        .map((operation) => `${operation.collection}\0${operation.recordId}`),
+    );
+    let expanded = true;
+    while (expanded) {
+      expanded = false;
+      for (const [sourceCollection, state] of states) {
+        for (const source of state.records.values()) {
+          const sourceAddress = `${sourceCollection}\0${source.id}`;
+          if (deleting.has(sourceAddress)) continue;
+          for (const [relationName, relation] of Object.entries(state.declaration.relations)) {
+            const raw = source.value[relation.field ?? relationName];
+            const targetIds = relation.cardinality === "many" ? raw : [raw];
+            if (!Array.isArray(targetIds)) continue;
+            if (!targetIds.some((targetId) => deleting.has(`${relation.collection}\0${targetId}`))) {
+              continue;
+            }
+            if ((relation.onDelete ?? "restrict") !== "cascade") {
+              throw runtimeError(
+                "conflict",
+                `cannot delete relation target: '${relationName}' from ${sourceCollection}/${source.id} restricts deletion`,
+              );
+            }
+            deleting.add(sourceAddress);
+            operations.push({
+              scopeKey: state.scopeKey,
+              collection: sourceCollection,
+              recordId: source.id,
+              operation: "delete",
+              expectedVersion: null,
+              declaration: state.declaration,
+              cascaded: true,
+            });
+            expanded = true;
+          }
+        }
+      }
+    }
+    for (const address of deleting) {
+      const [collection, recordId] = address.split("\0");
+      states.get(collection)?.records.delete(recordId);
+    }
+    for (const [collection, state] of states) {
+      for (const field of state.declaration.unique) {
+        const seen = new Map();
+        for (const record of state.records.values()) {
+          const value = record.value[field];
+          if (value === undefined || value === null) continue;
+          if (!["string", "number", "boolean"].includes(typeof value)
+            || Buffer.byteLength(JSON.stringify(value)) > 2048) {
+            throw new CliError(`unique field '${field}' must be a scalar no larger than 2 KiB`);
+          }
+          const key = JSON.stringify(value);
+          if (seen.has(key)) {
+            throw runtimeError("conflict", `unique field '${field}' duplicates ${collection}/${seen.get(key)}`);
+          }
+          seen.set(key, record.id);
+        }
+      }
+      for (const field of state.declaration.indexes) {
+        for (const record of state.records.values()) {
+          const value = record.value[field];
+          if (value === undefined || value === null) continue;
+          if (!["string", "number", "boolean"].includes(typeof value)
+            || Buffer.byteLength(JSON.stringify(value)) > 2048) {
+            throw new CliError(`indexed field '${field}' must be a scalar no larger than 2 KiB`);
+          }
+        }
+      }
+      for (const record of state.records.values()) {
+        for (const [relationName, relation] of Object.entries(state.declaration.relations)) {
+          const raw = record.value[relation.field ?? relationName];
+          if (raw === undefined || raw === null) {
+            if (relation.required) throw new CliError(`required relation '${relationName}' is missing`);
+            continue;
+          }
+          const targetIds = relation.cardinality === "many" ? raw : [raw];
+          if (!Array.isArray(targetIds)
+            || targetIds.some((targetId) => typeof targetId !== "string")) {
+            throw new CliError(`relation '${relationName}' has invalid record ids`);
+          }
+          const target = states.get(relation.collection);
+          if (!target || targetIds.some((targetId) => !target.records.has(targetId))) {
+            throw runtimeError("conflict", `relation '${relationName}' targets a missing record`);
+          }
+        }
+      }
+    }
+    return operations;
+  }
+
+  /** A record write's precondition: `expected` 0 means the record must not
+   * exist yet, a positive one must be its version. */
+  function requireExpectedVersion(prior, expected, address = null) {
+    const current = prior?.version ?? 0;
+    if ((expected === 0 && prior !== null) || (expected !== null && expected > 0 && expected !== current)) {
+      throw runtimeError(
+        "version_conflict",
+        address
+          ? `record '${address}' changed (current ${current}); refresh before retrying`
+          : `record version changed (current ${current}); refresh before retrying`,
+      );
+    }
+  }
+
+  /** The first answer of a record write whose Idempotency-Key already has a
+   * receipt, or null. Recognized before any other check — the version, the
+   * collection's permissions and write rules — as the platform recognizes
+   * it (receipt, then version, then permission), so a replay answers the
+   * first answer even where those checks would now refuse the write. */
+  function replayedMutation(store, scopeKey, collection, mutationId, signature) {
+    const receipt = store.mutationReceipt(scopeKey, collection, mutationId);
+    if (!receipt) return null;
+    if (receipt.requestSha256 !== signature) {
+      throw runtimeError("idempotency_conflict", "Idempotency-Key was already used for a different mutation");
+    }
+    return { ...receipt.response, replayed: true };
+  }
+
+  /** One record put or delete through the capsule, with its constraints and
+   * cascades, its wakes, and the receipt the door answers. */
+  function commitRecordMutation({ member, spaceId, declaration, name, id, operation, expected, value, mutationId, principal = "user" }) {
+    const scopeKey = collectionScopeKey(declaration, spaceId, name);
+    const store = capsule(managedStoreMember(declaration, member, spaceId));
+    const policyActor = managedPolicyActor(declaration, member, spaceId, principal);
+    if (operation === "put") validateManagedRecord(declaration, value);
+    const signature = sha256(JSON.stringify({ operation, id, expected, value }));
+    const replay = replayedMutation(store, scopeKey, name, mutationId, signature);
+    if (replay) return replay;
+    const prior = store.getRecord(scopeKey, name, id);
+    requireExpectedVersion(prior, expected);
+    if (operation === "put") {
+      authorizeCollection(declaration, prior ? "update" : "create", policyActor, {
+        value,
+        created_by_user_id: prior?.created_by_user_id ?? member,
+        updated_by_user_id: member,
+      });
+      authorizeChangedFields(declaration, policyActor, prior?.value, value);
+      enforceWriteRules(declaration, member, prior?.value, value);
+    } else if (prior) {
+      authorizeCollection(declaration, "delete", policyActor, prior);
+    }
+    const constrained = validateLocalDeclaredConstraints(store, member, spaceId, [{
+      scopeKey,
+      collection: name,
+      recordId: id,
+      operation,
+      expectedVersion: expected,
+      ...(operation === "put" ? { value } : {}),
+      declaration,
+    }]);
+    constrained[0].mutationId = mutationId;
+    const result = constrained.length === 1
+      ? store.mutateRecord({ ...constrained[0], requestSha256: signature, actor: member })
+      : transact(store, {
+          transactionScope: `${declaration.ownership === "space" ? "space" : (spaceId ? "member" : "personal")}:${spaceId || member}`,
+          transactionId: `single:${mutationId}`,
+          requestSha256: signature,
+          operations: constrained,
+          actor: member,
+        });
+    if (result.conflict) throw storeConflict(result);
+    for (const [index, rawChange] of result.changes.entries()) {
+      publishCollectionWake(member, spaceId, constrained[index], rawChange);
+    }
+    return constrained.length === 1
+      ? result.response
+      : { ...result.response.results[0], cascaded: result.response.cascaded };
+  }
+
+  async function collectionRecords(member, name, spaceId) {
+    const declaration = collectionDefinition(name);
+    requireCollectionScope(declaration, member, spaceId);
+    return capsule(managedStoreMember(declaration, member, spaceId))
+      .listRecords(collectionScopeKey(declaration, spaceId, name), name);
+  }
+
+  /* ── bootstrap, jobs, server code ───────────────────────────────────── */
+
+  /** The session's own view, trimmed to what is read (D23). */
+  function bootstrap(member) {
+    return {
+      platform_api_version: APP_RUNTIME_API_VERSION,
+      guest: false,
+      app: { id: DEV_APP_ID, slug: appSlug, name: appSlug, icon_url: "/_terminus/icon" },
+      installation: { id: devInstallationId(member), release_id: DEV_RELEASE_ID, release_version: 1 },
+      user: publicIdentity(member),
+      data: { grants: [], resource_grants: [] },
+    };
+  }
+
+  /** An id the platform mints as a UUID (jobs, notifications, collect
+   * submissions — and so does this harness): anything else in the path is a
+   * malformed request, 400, as the platform's path extractor answers it. */
+  function uuidParam(raw, what) {
+    const value = String(raw ?? "");
+    if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu.test(value)) {
+      throw runtimeError("bad_request", `invalid ${what} id`);
+    }
+    return value.toLowerCase();
+  }
+
+  function localJob(member, id) {
+    return automationJobs.get(`${member}\0${uuidParam(id, "job")}`) ?? null;
+  }
+
+  /** AppJob, as the door answers it. */
+  function jobView(job) {
+    return {
+      id: job.id,
+      automation: job.automation,
+      status: job.status,
+      input: job.input,
+      result: job.result,
+      error: job.error,
+      attempts: job.attempts,
+      created_at: job.created_at,
+      finished_at: job.finished_at,
+    };
+  }
+
+  /** A job reached a terminal state: its owner's windows hear job.updated. */
+  function finishJob(member, job, status) {
+    job.status = status;
+    job.finished_at = new Date().toISOString();
+    accountEvent(member, { type: "job.updated", job_id: job.id, status });
+  }
+
+  function declaredAutomation(name) {
+    const automation = (pkg.manifest.workloads?.automations ?? [])
+      .find((candidate) => candidate.name === name);
+    if (!automation) throw runtimeError("forbidden", `release did not declare automation:${name}`);
+    return automation;
+  }
+
+  function mutateAutomationRecord(member, job, index, action, params) {
+    const name = requireManagedName(params.collection, "collection");
+    const id = requireManagedId(params.record_id);
+    const declaration = collectionDefinition(name);
+    const spaceId = params.space_id ?? job.space_id ?? null;
+    requireCollectionScope(declaration, member, spaceId);
+    requireSpaceWriter(member, spaceId);
+    const expected = params.expected_version ?? null;
+    if (expected !== null && (!Number.isSafeInteger(expected) || expected < 0)) {
+      throw new CliError("expected_version must be zero or a positive object version");
+    }
+    return commitRecordMutation({
+      member,
+      spaceId,
+      declaration,
+      name,
+      id,
+      operation: action === "collection.put" ? "put" : "delete",
+      expected,
+      value: action === "collection.put" ? params.value : undefined,
+      mutationId: `automation:${job.id}:${index}`,
+      principal: "automation",
+    });
+  }
+
+  /** Server code's capsule syscalls: the member's own private files — the
+   * ones the app's data doors read and write. */
+  async function serverCapsuleRead(member, requested) {
+    if (!safeRelativePath(requested)) throw serverError(400, "bad_request", "invalid path");
+    try {
+      return (await dataPlane.read(dataPlane.root(member), requested)).bytes;
+    } catch (error) {
+      if (error?.apiCode === "not_found") throw serverError(404, "not_found", `not found: ${requested}`);
+      throw serverError(400, "bad_request", error?.message ?? "invalid path");
+    }
+  }
+
+  async function serverCapsuleWrite(member, requested, bytes) {
+    if (!safeRelativePath(requested)) throw serverError(400, "bad_request", "invalid path");
+    await dataPlane.write(dataPlane.root(member), requested, Buffer.from(bytes));
+    // Live pages hear it the way the platform tells them: a data object
+    // changed, and the server changed it.
+    signalOwner(member, null, { kind: "server", user_id: member }, {
+      type: "object_changed",
+      plane: "data",
+      zone: "private",
+      path: requested,
+      operation: "put",
+    }, { transient: true });
+  }
+
+  /** A server op's collect submission, bench-shaped like the app's own door. */
+  function serverCollect(member, channel, payload) {
+    const channels = pkg.manifest.capabilities?.collect?.channels ?? {};
+    const declared = Object.hasOwn(channels, channel) ? channels[channel] : null;
+    if (!declared || declared.kind !== "documents") {
+      throw serverError(403, "forbidden", `no declared documents collect channel '${channel}'`);
+    }
+    const id = crypto.randomUUID();
+    console.log(`[collect:${channel}] submission ${id} from @${member}'s server code:`, JSON.stringify(payload));
+    return { delivered: true, id };
+  }
+
+  async function executeLocalAutomation(member, job) {
+    const automation = declaredAutomation(job.automation);
+    const context = {
+      job_id: job.id,
+      app_id: DEV_APP_ID,
+      installation_id: devInstallationId(member),
+      release_id: DEV_RELEASE_ID,
+      user_id: member,
+      space_id: job.space_id,
+      scheduled_for: null,
+      attempt: 1,
+    };
+    const results = [];
+    for (const [index, step] of automation.steps.entries()) {
+      const params = resolveTemplate(step.params, job.input, context, results);
+      let result;
+      if (step.action === "collection.put" || step.action === "collection.delete") {
+        result = mutateAutomationRecord(member, job, index, step.action, params);
+      } else if (step.action === "notification.create") {
+        if (pkg.manifest.shell?.notifications !== true) {
+          throw runtimeError("forbidden", "release did not declare shell.notifications");
+        }
+        const title = String(params.title ?? "").trim();
+        const body = String(params.body ?? "");
+        if (!title || [...title].length > LIMITS.notification_title_chars
+          || [...body].length > LIMITS.notification_body_chars) {
+          throw new CliError("invalid notification");
+        }
+        const item = {
+          id: crypto.randomUUID(),
+          member,
+          title,
+          body,
+          route: params.route ?? null,
+          data: params.data ?? {},
+          read_at: null,
+          created_at: new Date().toISOString(),
+        };
+        if (notifyMember(item)) {
+          console.log(`[notification] ${item.title}: ${item.body}`);
+          result = { id: item.id, created: true };
+        } else {
+          result = { created: false, paused: true };
+        }
+      } else if (step.action === "connector.request" || step.action === "service.invoke") {
+        throw runtimeError(
+          "unsupported_in_dev",
+          `${step.action} is not available in terminus dev; mock that broker boundary in app code`,
+        );
+      } else if (step.action === "server.run") {
+        result = await serverTier.runStep(member, params);
+      } else {
+        throw new CliError(`unsupported declarative action '${step.action}'`);
+      }
+      results.push({ action: step.action, result });
+    }
+    return { steps: results };
+  }
+
+  /* ── data and storage ───────────────────────────────────────────────── */
+
+  /** The data root a request names: its zone, and with space_id the
+   * caller's own member shard in that space. */
+  function dataRoot(member, query, { write = false } = {}) {
+    const spaceId = query.get("space_id") || null;
+    if (spaceId) {
+      requireSpace(member, spaceId);
+      if (write) requireSpaceWriter(member, spaceId);
+    }
+    return { root: dataPlane.root(member, { zone: query.get("zone") || "private", spaceId }) };
+  }
+
+  /** A bucket a request names: the space's with space_id, else the caller's. */
+  function bucketScope(member, bucket, query, { write = false } = {}) {
+    if (!/^[A-Za-z0-9_-][A-Za-z0-9._-]{0,63}$/u.test(bucket)) {
+      throw runtimeError("bad_request", "invalid bucket name");
+    }
+    const spaceId = query.get("space_id") || null;
+    if (spaceId) {
+      const space = requireSpace(member, spaceId);
+      if (write) requireSpaceWriter(member, spaceId);
+      // A space's objects live in its first member's capsule, beside that
+      // member's own and other spaces' — keyed apart, as the platform keeps them.
+      return { store: capsule(space.members[0]), key: `spaces/${spaceId}/${bucket}`, spaceId };
+    }
+    return { store: capsule(member), key: bucket, spaceId: null };
+  }
+
+  function objectPath(raw) {
+    const relative = safeRelativePath(raw);
+    if (!relative) throw runtimeError("bad_request", "invalid bucket object path");
+    return relative;
+  }
+
+  /** A delete's precondition names what it deletes: `missing` asks for
+   * absence, which a delete cannot act on (a file's or an object's alike). */
+  function refuseAbsentDelete(query) {
+    if (query.get("expected_sha256") === "missing") {
+      throw runtimeError("bad_request", "expected_sha256=missing asks for absence, and a delete needs something to delete");
+    }
+  }
+
+  /** A bucket write's compare-and-set, as a file write's: `expected_sha256`
+   * of `missing` means the object must not exist yet, any other value must
+   * be its current sha256 — so members sharing a space's bucket never write
+   * over each other's files unseen. */
+  function requireObjectVersion(store, key, relative, expected) {
+    if (expected === null || expected === undefined) return;
+    const actual = store.objectEntry(key, relative)?.sha256 ?? "missing";
+    if (actual !== expected) {
+      throw runtimeError("version_conflict", `'${relative}' changed: expected ${expected}, found ${actual}`);
+    }
+  }
+
+  /* ── the doors ──────────────────────────────────────────────────────── */
+
+  /** A JSON door's body: within its limit, an object, no unknown field. */
+  async function jsonBody(ctx) {
+    const body = await readJsonBody(ctx.request, ctx.door.body_limit_bytes ?? LIMITS.default_body_bytes);
+    if (!ctx.door.request?.$body) {
+      if (!isPlainObject(body)) throw runtimeError("bad_request", "the JSON body must be an object");
+      refuseUnknownFields(ctx.door, body);
+    }
+    return body;
+  }
+
+  /** A bytes door's body, within its limit. */
+  function rawBody(ctx) {
+    return readBodyBuffer(ctx.request, ctx.door.body_limit_bytes ?? LIMITS.default_body_bytes);
+  }
+
+  function optionalInteger(raw, field) {
+    if (raw === null || raw === undefined || raw === "") return null;
+    if (!/^-?[0-9]+$/u.test(String(raw))) throw runtimeError("bad_request", `${field} must be an integer`);
+    return Number(raw);
+  }
+
+  const HANDLERS = {
+    // A guest's is the contract's guest bootstrap, as the app host answers it.
+    "session.bootstrap": ({ member, response }) => sendJson(
+      response,
+      200,
+      member === null ? guestBootstrap : bootstrap(member),
+    ),
+
+    "users.lookup": ({ response, query }) => sendJson(response, 200, publicIdentity(knownPerson(query.get("handle") ?? ""))),
+
+    "users.search": ({ member, response, query }) => {
+      const needle = String(query.get("q") ?? "").trim().replace(/^@/u, "").toLowerCase();
+      const users = needle.length < 2 || needle.length > 64
+        ? []
+        : members
+            .filter((handle) => handle !== member
+              && (handle.startsWith(needle) || profile(handle).name.toLowerCase().startsWith(needle)))
+            .slice(0, LIMITS.user_search_results)
+            .map(publicIdentity);
+      return sendJson(response, 200, { users });
+    },
+
+    "users.avatar": ({ response, params }) => {
+      const handle = String(params.user_id).toLowerCase();
+      if (!members.includes(handle)) throw runtimeError("not_found", `no user @${handle}`);
+      const { avatar } = profile(handle);
+      if (!avatar) throw runtimeError("not_found", `no avatar for @${handle}`);
+      response.writeHead(200, {
+        "content-type": avatar.contentType,
+        "cache-control": "public, max-age=31536000, immutable",
+      });
+      return response.end(avatar.bytes);
+    },
+
+    // The platform redirects to the person's public page; locally that page
+    // is the harness's own.
+    "users.profile": ({ response, params }) => {
+      const handle = String(params.handle).toLowerCase();
+      if (!members.includes(handle)) throw runtimeError("not_found", `no user with handle @${handle}`);
+      response.writeHead(307, { location: `${DEV_PROFILE_PREFIX}${encodeURIComponent(handle)}` });
+      return response.end();
+    },
+
+    "spaces.list": ({ member, response }) => sendJson(response, 200, {
+      spaces: registry.spaces
+        .filter((space) => space.members.includes(member))
+        .sort((left, right) => compareStrings(right.updatedAt, left.updatedAt) || compareStrings(left.id, right.id))
+        .slice(0, LIMITS.page_size)
+        .map((space) => spaceView(space, member)),
+    }),
+
+    "spaces.create": async (ctx) => {
+      const { member, response } = ctx;
+      const body = await jsonBody(ctx);
+      const kind = body.kind ?? "group";
+      if (kind !== "direct" && kind !== "group") throw runtimeError("bad_request", "kind must be direct or group");
+      if (!Array.isArray(body.member_handles)) {
+        throw runtimeError("bad_request", "member_handles must be a list of handles");
+      }
+      const name = body.name === undefined || body.name === null ? "New space" : spaceName(body.name);
+      const meta = body.meta === undefined || body.meta === null ? null : spaceMeta(body.meta);
+      let parentId = null;
+      if (body.parent_id !== undefined && body.parent_id !== null) {
+        if (typeof body.parent_id !== "string") throw runtimeError("bad_request", "parent_id must be a space id");
+        parentId = requireSpace(member, body.parent_id).id;
+      }
+      // One transaction: every handle is checked before anything exists.
+      const handles = [...new Set(body.member_handles.map((raw) => knownPerson(raw)))];
+      const others = handles.filter((handle) => handle !== member);
+      if (kind === "direct") {
+        if (!others.length) throw runtimeError("bad_request", "a direct conversation requires another person");
+        if (handles.length !== 1) {
+          throw runtimeError("bad_request", "a direct conversation requires exactly one other person");
+        }
+        if (registry.isBlocked(member, others[0])) {
+          throw runtimeError(
+            "forbidden",
+            "a direct conversation cannot be started while either person has blocked the other",
+          );
+        }
+      } else if (others.length !== handles.length) {
+        throw runtimeError("bad_request", "you are already in this space");
+      }
+      if (others.length + 1 > LIMITS.delivery_recipients) {
+        throw runtimeError("bad_request", `a space can have at most ${LIMITS.delivery_recipients} people`);
+      }
+      const now = new Date().toISOString();
+      const space = {
+        id: `s-${crypto.randomUUID().slice(0, 8)}`,
+        name,
+        kind,
+        members: [member],
+        roles: { [member]: "owner" },
+        parentId,
+        meta,
+        joined: { [member]: now },
+        createdAt: now,
+        updatedAt: now,
+      };
+      registry.spaces.push(space);
+      const invited = others.map((handle) => registry.invite(space.id, member, handle));
+      registry.save();
+      for (const { invitation, created } of invited) {
+        if (created) ringInvitation(space, member, invitation);
+      }
+      // The creator is its first member: every one of their windows hears it
+      // open on the account stream, the way an invitee's windows hear the
+      // space they joined — a space made in one window lists in all of them.
+      accountEvent(member, { type: "space_membership_joined", space_id: space.id });
+      signalSpace(space.id, PLATFORM, { type: "space_invitations_updated" }, { transient: true });
+      return sendJson(response, 200, {
+        space: spaceView(space, member),
+        invitations: invited.map(({ invitation, created }) => invitationReceipt(invitation, created)),
+      });
+    },
+
+    "spaces.update": async (ctx) => {
+      const { member, response, params } = ctx;
+      const body = await jsonBody(ctx);
+      const space = requireSpace(member, params.space_id);
+      if (!Object.hasOwn(body, "name") && !Object.hasOwn(body, "meta")) {
+        throw runtimeError("bad_request", "send name, meta, or both");
+      }
+      const change = {};
+      if (Object.hasOwn(body, "name")) {
+        change.name = spaceName(body.name);
+        requireGroup(space);
+        requireManager(space, member);
+      }
+      if (Object.hasOwn(body, "meta")) {
+        change.meta = body.meta === null ? null : spaceMeta(body.meta);
+        if (space.kind === "group") requireManager(space, member);
+      }
+      Object.assign(space, change, { updatedAt: new Date().toISOString() });
+      registry.save();
+      signalSpace(space.id, PLATFORM, { type: "space_conversation_updated" }, { transient: true });
+      return sendJson(response, 200, { space: spaceView(space, member) });
+    },
+
+    "spaces.delete": async ({ member, response, params }) => {
+      const space = requireSpace(member, params.space_id);
+      if (registry.memberRole(space.id, member) !== "owner") {
+        throw runtimeError("forbidden", "only the space owner can delete the space");
+      }
+      // A parent goes after its children, whoever is in them: the platform
+      // never leaves a space pointing at one that is gone.
+      if (registry.spaces.some((candidate) => candidate.parentId === space.id)) {
+        throw runtimeError("conflict", "other spaces sit under this one; delete them first");
+      }
+      const everyone = [...space.members];
+      for (const store of capsules.values()) store.deleteSpace(space.id);
+      systemStore.deleteSpace(space.id);
+      await dataPlane.removeSpace(space.id);
+      registry.removeSpace(space.id);
+      registry.save();
+      for (const key of [...spaceMutes.keys()]) {
+        if (key.endsWith(`\n${space.id}`)) spaceMutes.delete(key);
+      }
+      bus.forgetTopic(space.id);
+      for (const target of everyone) accountEvent(target, { type: "space_deleted", space_id: space.id });
+      return sendJson(response, 200, { ok: true });
+    },
+
+    "spaces.members": ({ member, response, params }) => (
+      sendJson(response, 200, { members: memberRows(requireSpace(member, params.space_id)) })
+    ),
+
+    "spaces.invite": async (ctx) => {
+      const { member, response, params } = ctx;
+      const body = await jsonBody(ctx);
+      const space = requireSpace(member, params.space_id);
+      requireGroup(space);
+      requireManager(space, member);
+      const role = body.role ?? "editor";
+      if (!["admin", "editor", "viewer"].includes(role)) {
+        throw runtimeError("bad_request", "member role must be admin, editor, or viewer");
+      }
+      if (role === "admin" && registry.memberRole(space.id, member) !== "owner") {
+        throw runtimeError("forbidden", "only the space owner can invite another admin");
+      }
+      if (typeof body.handle !== "string" || !body.handle.trim().replace(/^@/u, "")) {
+        throw runtimeError("bad_request", "invitee is required");
+      }
+      const handle = knownPerson(body.handle);
+      if (handle === member) throw runtimeError("bad_request", "you are already in this space");
+      if (space.members.includes(handle)) throw runtimeError("conflict", "one of those users is already a member");
+      const pending = registry.pendingInvitations(space.id);
+      if (!pending.some((invitation) => invitation.invitee === handle)
+        && space.members.length + pending.length >= LIMITS.delivery_recipients) {
+        throw runtimeError("bad_request", `a space can have at most ${LIMITS.delivery_recipients} people`);
+      }
+      const { invitation, created } = registry.invite(space.id, member, handle, role);
+      if (created) {
+        space.updatedAt = invitation.createdAt;
+        registry.save();
+        signalSpace(space.id, PLATFORM, { type: "space_invitations_updated" }, { transient: true });
+        ringInvitation(space, member, invitation);
+      }
+      return sendJson(response, 200, { invitation: invitationReceipt(invitation, created) });
+    },
+
+    "spaces.update_member": async (ctx) => {
+      const { member, response, params } = ctx;
+      const body = await jsonBody(ctx);
+      const role = body.role;
+      if (!["admin", "editor", "viewer"].includes(role)) {
+        throw runtimeError("bad_request", "group member role must be admin, editor, or viewer");
+      }
+      const space = requireSpace(member, params.space_id);
+      requireGroup(space);
+      requireManager(space, member);
+      const target = String(params.member_id).toLowerCase();
+      const targetRole = registry.memberRole(space.id, target);
+      if (!targetRole) throw runtimeError("not_found", "space member not found");
+      if (targetRole === "owner") throw runtimeError("forbidden", "the space owner role cannot be changed");
+      if (registry.memberRole(space.id, member) === "admin" && (targetRole === "admin" || role === "admin")) {
+        throw runtimeError("forbidden", "only the space owner can manage admins");
+      }
+      space.roles[target] = role;
+      space.updatedAt = new Date().toISOString();
+      registry.save();
+      signalSpace(space.id, PLATFORM, { type: "space_members_updated" }, { transient: true });
+      return sendJson(response, 200, { member: memberRows(space).find((row) => row.id === target) });
+    },
+
+    "spaces.remove_member": ({ member, response, params }) => {
+      const space = requireSpace(member, params.space_id);
+      requireGroup(space);
+      requireManager(space, member);
+      const target = String(params.member_id).toLowerCase();
+      const targetRole = registry.memberRole(space.id, target);
+      if (!targetRole) throw runtimeError("not_found", "space member not found");
+      if (targetRole === "owner") throw runtimeError("forbidden", "the space owner cannot be removed");
+      if (registry.memberRole(space.id, member) === "admin" && targetRole === "admin") {
+        throw runtimeError("forbidden", "only the space owner can remove an admin");
+      }
+      space.members = space.members.filter((handle) => handle !== target);
+      delete space.roles[target];
+      space.updatedAt = new Date().toISOString();
+      registry.save();
+      accountEvent(target, { type: "space_membership_left", space_id: space.id });
+      signalSpace(space.id, PLATFORM, { type: "space_members_updated" }, { transient: true });
+      return sendJson(response, 200, { ok: true });
+    },
+
+    "spaces.leave": ({ member, response, params }) => {
+      const space = requireSpace(member, params.space_id);
+      requireGroup(space);
+      if (registry.memberRole(space.id, member) === "owner") {
+        throw runtimeError("forbidden", "the space owner cannot be removed");
+      }
+      space.members = space.members.filter((handle) => handle !== member);
+      delete space.roles[member];
+      space.updatedAt = new Date().toISOString();
+      registry.save();
+      accountEvent(member, { type: "space_membership_left", space_id: space.id });
+      signalSpace(space.id, PLATFORM, { type: "space_members_updated" }, { transient: true });
+      return sendJson(response, 200, { ok: true });
+    },
+
+    "spaces.invitations": ({ member, response, params }) => sendJson(response, 200, {
+      invitations: registry.pendingInvitations(requireSpace(member, params.space_id).id)
+        .slice(0, LIMITS.page_size)
+        .map(publicInvitation),
+    }),
+
+    "spaces.block_peer": (ctx) => blockDoor(ctx, true),
+    "spaces.unblock_peer": (ctx) => blockDoor(ctx, false),
+
+    "spaces.cursors": ({ member, response, params }) => {
+      const space = requireSpace(member, params.space_id);
+      const roles = Object.fromEntries(space.members.map((handle) => [handle, registry.memberRole(space.id, handle)]));
+      return sendJson(response, 200, systemStore.spaceCursors(space.id, space.members, roles));
+    },
+
+    "spaces.update_cursor": async (ctx) => {
+      const { member, response, params } = ctx;
+      const space = requireSpace(member, params.space_id);
+      registry.ensureConversationActive(space.id, member);
+      const body = await jsonBody(ctx);
+      if (body.delivered_through === undefined && body.read_through === undefined) {
+        throw runtimeError("bad_request", "at least one space cursor is required");
+      }
+      for (const field of ["delivered_through", "read_through"]) {
+        const value = body[field];
+        if (value !== undefined && (!Number.isSafeInteger(value) || value < 0)) {
+          throw runtimeError("bad_request", "space cursors must be nonnegative integers");
+        }
+      }
+      const result = systemStore.updateSpaceCursor(space.id, member, {
+        deliveredThrough: body.delivered_through,
+        readThrough: body.read_through,
+      });
+      if (result.conflict) throw runtimeError("conflict", result.conflict);
+      // Only a real move wakes the space: a read receipt repeated by every
+      // open window tells the other members nothing.
+      if (result.advanced) {
+        signalSpace(space.id, memberOrigin(member), {
+          type: "space_cursor_updated",
+          user_id: member,
+          delivered_through: result.cursor.delivered_through,
+          read_through: result.cursor.read_through,
+        });
+      }
+      return sendJson(response, 200, result.cursor);
+    },
+
+    "spaces.mute": async (ctx) => {
+      const { member, response, params } = ctx;
+      const body = await jsonBody(ctx);
+      if (!registry.memberRole(params.space_id, member)) throw runtimeError("not_found", "space not found");
+      const muted = body.muted ?? null;
+      if (muted !== null && typeof muted !== "boolean") {
+        throw runtimeError("bad_request", "muted must be true, false or null");
+      }
+      if (muted === null) spaceMutes.delete(`${member}\n${params.space_id}`);
+      else spaceMutes.set(`${member}\n${params.space_id}`, muted);
+      // Their other windows re-read; nobody else hears of it.
+      accountEvent(member, { type: "space_notifications_updated", space_id: params.space_id });
+      return sendJson(response, 200, { muted: mutedFor(member, params.space_id) });
+    },
+
+    "data.list": async ({ member, response, query }) => {
+      const { root } = dataRoot(member, query);
+      return sendJson(response, 200, await dataPlane.list(root, {
+        prefix: query.get("prefix") ?? "",
+        after: query.get("after"),
+        limit: pageLimit(query.get("limit")),
+      }));
+    },
+
+    "data.read": async ({ member, response, query }) => {
+      const { root } = dataRoot(member, query);
+      const { bytes, entry, schema } = await dataPlane.read(root, query.get("path"));
+      response.writeHead(200, {
+        "content-type": entry.media_type,
+        etag: `"${entry.sha256}"`,
+        "x-terminus-data-version": String(entry.version),
+        ...(schema.id === null ? {} : { "x-terminus-schema-id": schema.id }),
+        ...(schema.version === null ? {} : { "x-terminus-schema-version": String(schema.version) }),
+      });
+      return response.end(bytes);
+    },
+
+    "data.write": async (ctx) => {
+      const { member, request, response, query } = ctx;
+      const { root } = dataRoot(member, query, { write: true });
+      if (query.get("observation_id")) {
+        throw runtimeError("not_found", "observation not found: terminus dev records no connector observations");
+      }
+      const schemaId = query.get("schema_id") || null;
+      if (schemaId !== null && !/^[A-Za-z0-9][A-Za-z0-9._:/@-]{0,199}$/u.test(schemaId)) {
+        throw runtimeError("bad_request", "invalid schema_id");
+      }
+      const schemaVersion = optionalInteger(query.get("schema_version"), "schema_version");
+      const receipt = await dataPlane.write(root, query.get("path"), await rawBody(ctx), {
+        mediaType: requestMediaType(request),
+        expectedSha256: query.get("expected_sha256"),
+        schemaId,
+        schemaVersion,
+      });
+      // A member's files are their own, their shard in a space included:
+      // the change reaches their windows alone, naming no space, as the
+      // platform's frame for it does.
+      signalOwner(member, null, memberOrigin(member), {
+        type: "object_changed",
+        plane: "data",
+        zone: root.zone,
+        path: receipt.path,
+        operation: "put",
+      }, { transient: true });
+      return sendJson(response, 200, receipt);
+    },
+
+    "data.delete": async ({ member, response, query }) => {
+      refuseAbsentDelete(query);
+      const { root } = dataRoot(member, query, { write: true });
+      const result = await dataPlane.remove(root, query.get("path"), {
+        expectedSha256: query.get("expected_sha256"),
+      });
+      signalOwner(member, null, memberOrigin(member), {
+        type: "object_changed",
+        plane: "data",
+        zone: root.zone,
+        path: safeRelativePath(query.get("path")),
+        operation: "delete",
+      }, { transient: true });
+      return sendJson(response, 200, result);
+    },
+
+    "storage.list": ({ member, response, query, params }) => {
+      const { store, key } = bucketScope(member, params.bucket, query);
+      const prefix = safeListPrefix(query.get("prefix") ?? "");
+      if (prefix === null) throw runtimeError("bad_request", "invalid bucket prefix");
+      return sendJson(response, 200, store.listObjects(key, prefix, {
+        after: query.get("after") || null,
+        limit: pageLimit(query.get("limit")),
+      }));
+    },
+
+    "storage.read": ({ member, response, query, params }) => {
+      const { store, key } = bucketScope(member, params.bucket, query);
+      const object = store.getObject(key, objectPath(query.get("path")));
+      if (!object) throw runtimeError("not_found", "data object not found");
+      response.writeHead(200, { "content-type": object.entry.media_type, etag: `"${object.entry.sha256}"` });
+      return response.end(object.bytes);
+    },
+
+    "storage.write": async (ctx) => {
+      const { member, request, response, query, params } = ctx;
+      const { store, key, spaceId } = bucketScope(member, params.bucket, query, { write: true });
+      const relative = objectPath(query.get("path"));
+      const bytes = await rawBody(ctx);
+      // Checked and written in one turn: nothing lands between the two.
+      requireObjectVersion(store, key, relative, query.get("expected_sha256"));
+      const receipt = store.putObject(key, relative, bytes, requestMediaType(request));
+      signalWrite(member, spaceId, {
+        type: "object_changed",
+        plane: "storage",
+        bucket: params.bucket,
+        path: relative,
+        operation: "put",
+      }, { transient: true });
+      return sendJson(response, 200, receipt);
+    },
+
+    "storage.delete": ({ member, response, query, params }) => {
+      refuseAbsentDelete(query);
+      const { store, key, spaceId } = bucketScope(member, params.bucket, query, { write: true });
+      const relative = objectPath(query.get("path"));
+      requireObjectVersion(store, key, relative, query.get("expected_sha256"));
+      store.deleteObject(key, relative);
+      signalWrite(member, spaceId, {
+        type: "object_changed",
+        plane: "storage",
+        bucket: params.bucket,
+        path: relative,
+        operation: "delete",
+      }, { transient: true });
+      return sendJson(response, 200, { ok: true });
+    },
+
+    "collections.define": async (ctx) => {
+      const name = requireManagedName(ctx.params.collection, "collection");
+      const requested = normalizeCollectionDefinition(name, await jsonBody(ctx));
+      const existing = collectionDefinitions.get(name);
+      if (existing && JSON.stringify(existing) !== JSON.stringify(requested)) {
+        throw runtimeError("conflict", `collection '${name}' was already defined differently for this release`);
+      }
+      if (!existing && collectionDefinitions.size >= LIMITS.collections_per_release) {
+        throw new CliError(`a release can define at most ${LIMITS.collections_per_release} collections`);
+      }
+      const persisted = normalizeCollectionDefinition(
+        name,
+        systemStore.defineCollection(name, requested).existing,
+        { strict: false },
+      );
+      if (JSON.stringify(persisted) !== JSON.stringify(requested)) {
+        throw runtimeError("conflict", `collection '${name}' was already defined differently for this release`);
+      }
+      collectionDefinitions.set(name, requested);
+      return sendJson(ctx.response, 200, requested);
+    },
+
+    "collections.list": async ({ member, response, query, params }) => {
+      const name = requireManagedName(params.collection, "collection");
+      const spaceId = query.get("space_id") || null;
+      const declaration = collectionDefinition(name);
+      requireCollectionScope(declaration, member, spaceId);
+      const store = capsule(managedStoreMember(declaration, member, spaceId));
+      const policyActor = managedPolicyActor(declaration, member, spaceId);
+      // Cursor-before-rows: draining from here may repeat a concurrent commit
+      // but cannot miss one between this point and the scan.
+      const snapshotCursor = collectionCursor(store.scopeWindow(collectionScopeKey(declaration, spaceId, name)).head);
+      let rawWhere = {};
+      if (query.get("where")) {
+        try {
+          rawWhere = JSON.parse(query.get("where"));
+        } catch {
+          throw runtimeError("bad_request", "where must be a JSON object");
+        }
+      }
+      for (const field of whereFieldNames(rawWhere)) requireReadableField(declaration, policyActor, field);
+      const where = validateWhereFilter(rawWhere);
+      let records = (await collectionRecords(member, name, spaceId)).filter((record) => {
+        try {
+          authorizeCollection(declaration, "read", policyActor, record);
+          return true;
+        } catch (error) {
+          if (error?.status === 403) return false;
+          throw error;
+        }
+      });
+      records = filterManagedRecords(records, where);
+      const search = (query.get("search") ?? "").trim();
+      if (search) {
+        for (const field of declaration.search) requireReadableField(declaration, policyActor, field);
+        records = searchManagedRecords(declaration, records, search);
+      }
+      const sortSpec = query.get("sort");
+      let supportsCursor = true;
+      if (sortSpec) {
+        validateSort(sortSpec);
+        requireReadableField(declaration, policyActor, sortSpec.replace(/^-/u, ""));
+        if (query.get("after")) {
+          throw new CliError("after cursors page the default id order; sorted queries page by limit");
+        }
+        supportsCursor = false;
+      }
+      records = sortManagedRecords(records, sortSpec);
+      const after = supportsCursor ? query.get("after") : null;
+      const start = after ? records.findIndex((record) => compareStrings(record.id, after) > 0) : 0;
+      const from = start < 0 ? records.length : start;
+      const limit = pageLimit(query.get("limit"));
+      const page = records.slice(from, from + limit)
+        .map((record) => redactCollectionRecord(declaration, policyActor, record));
+      const hasMore = records.length > from + limit;
+      return sendJson(response, 200, {
+        records: page,
+        next_cursor: hasMore && supportsCursor ? (page.at(-1)?.id ?? null) : null,
+        has_more: hasMore,
+        sync_cursor: snapshotCursor,
+      });
+    },
+
+    "collections.get": ({ member, response, query, params }) => {
+      const name = requireManagedName(params.collection, "collection");
+      const id = requireManagedId(params.record_id);
+      const spaceId = query.get("space_id") || null;
+      const declaration = collectionDefinition(name);
+      requireCollectionScope(declaration, member, spaceId);
+      const record = capsule(managedStoreMember(declaration, member, spaceId))
+        .getRecord(collectionScopeKey(declaration, spaceId, name), name, id);
+      if (record === null) throw runtimeError("not_found", "record not found");
+      const policyActor = managedPolicyActor(declaration, member, spaceId);
+      authorizeCollection(declaration, "read", policyActor, record);
+      return sendJson(response, 200, redactCollectionRecord(declaration, policyActor, record));
+    },
+
+    "collections.put": (ctx) => recordMutation(ctx, "put"),
+    "collections.delete": (ctx) => recordMutation(ctx, "delete"),
+
+    "collections.deliver": async (ctx) => {
+      const { member, request, response, params } = ctx;
+      const name = requireManagedName(params.collection, "collection");
+      const declaration = collectionDefinition(name);
+      if (declaration.ownership !== "personal") {
+        throw new CliError("delivery requires a personal collection so each recipient owns a replica");
+      }
+      const mutationId = idempotencyKey(request, { required: true, door: "collection delivery" });
+      const body = await jsonBody(ctx);
+      const deliverySpaceId = typeof body.space_id === "string" ? body.space_id : "";
+      if (!deliverySpaceId) throw runtimeError("bad_request", "a collaborative space is required");
+      const id = requireManagedId(body.record_id);
+      const value = body.value;
+      const rings = normalizeWriteRings(body, "delivery");
+      const { notify } = rings;
+      const space = requireSpace(member, deliverySpaceId);
+      requireSpaceWriter(member, deliverySpaceId);
+      registry.ensureConversationActive(deliverySpaceId, member);
+      validateManagedRecord(declaration, value);
+      // Ring intent is part of the idempotent request: the same key naming
+      // other people, or saying something else, is a different delivery.
+      const signature = sha256(JSON.stringify({
+        operation: "deliver",
+        spaceId: deliverySpaceId,
+        collection: name,
+        id,
+        value,
+        ...(notify ? { notify } : {}),
+        ...(rings.mentions.length ? { mentions: rings.mentions } : {}),
+      }));
+      // A committed delivery's key answers its first answer before the
+      // recipients' permissions and the write rules are asked again.
+      const receipt = systemStore.deliveryReceipt({ spaceId: deliverySpaceId, collection: name, mutationId });
+      if (receipt && (receipt.recordId !== id || receipt.requestSha256 !== signature)) {
+        throw runtimeError("idempotency_conflict", "Idempotency-Key was already used for a different delivery");
+      }
+      if (receipt?.response) return sendJson(response, 200, { ...receipt.response, replayed: true });
+      const recipients = [...space.members];
+      if (!recipients.length || recipients.length > LIMITS.delivery_recipients) {
+        throw new CliError(`record delivery requires a space with 1-${LIMITS.delivery_recipients} current members`);
+      }
+      for (const target of recipients) {
+        const deliveryActor = {
+          userId: member,
+          principal: "user",
+          capsuleOwner: target,
+          spaceRole: registry.memberRole(deliverySpaceId, member),
+        };
+        authorizeCollection(declaration, "create", deliveryActor, {
+          value,
+          created_by_user_id: member,
+          updated_by_user_id: member,
+        });
+        authorizeChangedFields(declaration, deliveryActor, undefined, value);
+        validateLocalDeclaredConstraints(capsule(target), member, deliverySpaceId, [{
+          scopeKey: collectionScopeKey(declaration, deliverySpaceId, name),
+          collection: name,
+          recordId: id,
+          operation: "put",
+          expectedVersion: 0,
+          value,
+          declaration,
+        }]);
+      }
+      // Validate rules run once, sender-side: every recipient stores the
+      // same delivered value, so one enforcement covers the fan-out.
+      enforceWriteRules(declaration, member, null, value);
+      const delivery = systemStore.beginDelivery({
+        spaceId: deliverySpaceId,
+        collection: name,
+        mutationId,
+        recordId: id,
+        requestSha256: signature,
+        recipients,
+      });
+      if (delivery.conflict) throw storeConflict(delivery);
+      if (delivery.response) return sendJson(response, 200, { ...delivery.response, replayed: true });
+      const deliveryScopeKey = `member:${deliverySpaceId}:${name}`;
+      let senderCursor = null;
+      for (const target of delivery.recipients) {
+        const result = capsule(target).mutateRecord({
+          scopeKey: deliveryScopeKey,
+          collection: name,
+          recordId: id,
+          mutationId,
+          requestSha256: signature,
+          operation: "put",
+          expectedVersion: 0,
+          value,
+          actor: member,
+          deliverySequence: delivery.sequence,
+          deliveryRecipients: delivery.recipients,
+        });
+        if (result.conflict) throw storeConflict(result);
+        if (target === member) senderCursor = result.response.sync_cursor;
+      }
+      const result = {
+        id,
+        value,
+        version: 1,
+        sequence: delivery.sequence,
+        recipients: delivery.recipients,
+        mutation_id: mutationId,
+        sync_cursor: senderCursor,
+      };
+      systemStore.commitDelivery({ spaceId: deliverySpaceId, collection: name, mutationId, response: result });
+      // Each recipient the delivery froze hears it once: the record_delivered
+      // frame of their own replica, which their own change feed then reads.
+      // No replica sends a record_changed of its own, to its owner or anyone.
+      bus.deliver(delivery.recipients, bus.envelope("space_event", deliverySpaceId, memberOrigin(member), {
+        type: "record_delivered",
+        collection: name,
+        record_id: id,
+        sequence: delivery.sequence,
+        mutation_id: mutationId,
+      }, false));
+      // Rung among the frozen recipients, on this first commit only: a
+      // replay returned above, before anyone could be rung twice.
+      ringSpaceWrite(space, member, delivery.recipients, rings, {
+        space_id: deliverySpaceId,
+        collection: name,
+        record_id: id,
+        sequence: delivery.sequence,
+      });
+      return sendJson(response, 200, result);
+    },
+
+    "collections.changes": ({ member, response, query, params }) => {
+      const name = requireManagedName(params.collection, "collection");
+      const spaceId = query.get("space_id") || null;
+      const declaration = collectionDefinition(name);
+      requireCollectionScope(declaration, member, spaceId);
+      const store = capsule(managedStoreMember(declaration, member, spaceId));
+      const policyActor = managedPolicyActor(declaration, member, spaceId);
+      const after = parseCollectionCursor(query.get("after"));
+      const page = store.changes(collectionScopeKey(declaration, spaceId, name), after);
+      if (page.resetRequired) {
+        return sendJson(response, 200, {
+          reset_required: true,
+          reason: "cursor_expired",
+          cursor: collectionCursor(page.window.head),
+          retained_after: collectionCursor(page.window.retainedAfter),
+          changes: [],
+          has_more: false,
+        });
+      }
+      const changes = page.changes
+        .map((change) => visibleCollectionChange(declaration, policyActor, change))
+        .filter(Boolean);
+      const scannedCursor = page.changes.at(-1)?.cursor ?? after;
+      return sendJson(response, 200, {
+        reset_required: false,
+        cursor: page.hasMore ? collectionCursor(scannedCursor) : collectionCursor(page.window.head),
+        retained_after: collectionCursor(page.window.retainedAfter),
+        has_more: page.hasMore,
+        changes,
+      });
+    },
+
+    "collections.rebuild": async ({ member, response, query, params }) => {
+      const name = requireManagedName(params.collection, "collection");
+      const spaceId = query.get("space_id") || null;
+      const declaration = collectionDefinition(name);
+      requireCollectionScope(declaration, member, spaceId);
+      const store = capsule(managedStoreMember(declaration, member, spaceId));
+      const records = await collectionRecords(member, name, spaceId);
+      const { change } = store.appendReset(collectionScopeKey(declaration, spaceId, name), name, member, records.length);
+      publishCollectionWake(member, spaceId, { declaration, operation: "reset", collection: name, recordId: null }, change);
+      return sendJson(response, 200, { rebuilt: records.length, sync_cursor: collectionCursor(change.cursor) });
+    },
+
+    "transactions.commit": (ctx) => transactionDoor(ctx),
+
+    "collaboration.append": async (ctx) => {
+      const { member, response, params } = ctx;
+      const documentId = requireManagedId(params.document_id);
+      const body = await jsonBody(ctx);
+      const spaceId = typeof body.space_id === "string" && body.space_id ? body.space_id : null;
+      if (spaceId) requireSpaceWriter(member, spaceId);
+      const operations = body.operations;
+      if (!Array.isArray(operations) || !operations.length || operations.length > LIMITS.collaboration_batch_operations) {
+        throw new CliError(`collaboration batches contain 1-${LIMITS.collaboration_batch_operations} operations`);
+      }
+      const ids = new Set();
+      for (const operation of operations) {
+        const id = String(operation?.id ?? "");
+        if (!id || id.length > LIMITS.idempotency_key_chars || ids.has(id)) {
+          throw new CliError(`operation ids must be 1-${LIMITS.idempotency_key_chars} visible, unique characters`);
+        }
+        ids.add(id);
+      }
+      const result = systemStore.appendCollaboration({
+        scopeKey: spaceId ? `space:${spaceId}` : `personal:${member}`,
+        documentId,
+        actor: member,
+        sessionId: `dev-${member}`,
+        operations,
+      });
+      if (result.conflict) throw storeConflict(result);
+      const cursor = collaborationCursor(result.head);
+      signalWrite(member, spaceId, { type: "collaboration_changed", document_id: documentId, cursor });
+      return sendJson(response, 200, {
+        cursor,
+        operations: result.operations.map((operation) => ({
+          ...operation,
+          cursor: collaborationCursor(operation.cursor),
+        })),
+      });
+    },
+
+    "collaboration.read": ({ member, response, query, params }) => {
+      const documentId = requireManagedId(params.document_id);
+      const spaceId = query.get("space_id") || null;
+      if (spaceId) requireSpace(member, spaceId);
+      const after = parseCollaborationCursor(query.get("after"));
+      const result = systemStore.listCollaboration({
+        scopeKey: spaceId ? `space:${spaceId}` : `personal:${member}`,
+        documentId,
+        after,
+        limit: pageLimit(query.get("limit"), LIMITS.page_size),
+      });
+      if (after < result.retainedAfter) {
+        return sendJson(response, 200, {
+          reset_required: true,
+          reason: "cursor_expired",
+          cursor: collaborationCursor(result.head),
+          snapshot_cursor: collaborationCursor(result.snapshotSequence),
+          snapshot: result.snapshot,
+          operations: [],
+          has_more: false,
+        });
+      }
+      const cursor = result.operations.at(-1)?.cursor ?? result.head;
+      return sendJson(response, 200, {
+        reset_required: false,
+        cursor: collaborationCursor(cursor),
+        snapshot_cursor: collaborationCursor(result.snapshotSequence),
+        snapshot: after === 0 ? result.snapshot : null,
+        operations: result.operations.map((operation) => ({
+          ...operation,
+          cursor: collaborationCursor(operation.cursor),
+        })),
+        has_more: result.hasMore,
+      });
+    },
+
+    "collaboration.snapshot": async (ctx) => {
+      const { member, response, params } = ctx;
+      const documentId = requireManagedId(params.document_id);
+      const body = await jsonBody(ctx);
+      const spaceId = typeof body.space_id === "string" && body.space_id ? body.space_id : null;
+      if (spaceId) requireSpaceWriter(member, spaceId);
+      const result = systemStore.snapshotCollaboration({
+        scopeKey: spaceId ? `space:${spaceId}` : `personal:${member}`,
+        documentId,
+        through: parseCollaborationCursor(body.through),
+        snapshot: body.snapshot,
+      });
+      if (result.conflict) throw runtimeError("conflict", result.conflict);
+      return sendJson(response, 200, {
+        ok: true,
+        cursor: collaborationCursor(result.head),
+        snapshot_cursor: collaborationCursor(result.through),
+      });
+    },
+
+    "events.publish": (ctx) => publishDoor(ctx),
+    "events.stream": (ctx) => streamDoor(ctx),
+
+    "events.presence": ({ member, response, query }) => {
+      const spaceId = query.get("space_id") || "";
+      if (!spaceId) throw runtimeError("bad_request", "a collaborative space is required");
+      const space = requireSpace(member, spaceId);
+      const online = space.members.filter((handle) => bus.hasStream(handle));
+      // A space-scoped state wins; a personal install only ever parked one on
+      // its own topic, and the space query composes that in — the precedence
+      // `presence_response` applies on the platform.
+      const spaceStates = bus.presenceStates(spaceId);
+      const states = {};
+      for (const handle of online) {
+        const state = spaceStates.has(handle) ? spaceStates.get(handle) : bus.memberPresenceState(handle);
+        if (state !== undefined) states[handle] = state;
+      }
+      return sendJson(response, 200, { online, states });
+    },
+
+    "events.set_presence": async (ctx) => {
+      const { member, response } = ctx;
+      const body = await jsonBody(ctx);
+      const state = body.state ?? null;
+      const window = body.window ?? null;
+      if (window !== null && (typeof window !== "string" || !/^[A-Za-z0-9_-]{1,64}$/u.test(window))) {
+        throw runtimeError("bad_request", "window is 1-64 letters, digits, dashes or underscores");
+      }
+      if (state !== null && Buffer.byteLength(JSON.stringify(state)) > LIMITS.presence_state_bytes) {
+        throw runtimeError("payload_too_large", `presence state exceeds ${LIMITS.presence_state_bytes} bytes`);
+      }
+      const spaceId = typeof body.space_id === "string" && body.space_id ? body.space_id : null;
+      if (!spaceId) {
+        // A personal install parks its state on its own topic, and the change
+        // reaches co-members across every shared space — never the setter. A
+        // clear is a leave, heard as `online: false`.
+        if (bus.setPresence(accountTopic(member), member, state)) {
+          bus.deliver(coMembers(member), presenceFrame(null, member, state));
+        }
+        return sendJson(response, 200, { ok: true });
+      }
+      const space = requireSpace(member, spaceId);
+      registry.ensureConversationActive(spaceId, member);
+      // The space's other members hear the change; a clear — the member left
+      // the space's presence — as `online: false`.
+      if (bus.setPresence(spaceId, member, state)) {
+        bus.deliver(space.members, presenceFrame(spaceId, member, state), { except: member });
+      }
+      // Hidden, or cleared (the space was left), a window is not looking.
+      if (window) bus.look(spaceId, member, window, body.visible !== false && state !== null);
+      return sendJson(response, 200, { ok: true });
+    },
+
+    "notifications.create": async (ctx) => {
+      const { member, request, response } = ctx;
+      const body = await jsonBody(ctx);
+      const title = typeof body.title === "string" ? body.title.trim() : "";
+      const text = body.body ?? "";
+      const route = body.route ?? null;
+      const data = body.data ?? {};
+      if (!title || [...title].length > LIMITS.notification_title_chars
+        || typeof text !== "string" || [...text].length > LIMITS.notification_body_chars
+        || (route !== null && (typeof route !== "string" || [...route].length > LIMITS.notification_route_chars))) {
+        throw runtimeError("bad_request", "invalid notification");
+      }
+      if (Buffer.byteLength(JSON.stringify(data)) > LIMITS.notification_data_bytes) {
+        throw runtimeError("payload_too_large", `notification data is at most ${LIMITS.notification_data_bytes} bytes`);
+      }
+      const key = idempotencyKey(request);
+      const answer = await once("notifications.create", member, key, body, () => {
+        if (pkg.manifest.shell?.notifications !== true) {
+          throw runtimeError("forbidden", "release did not declare shell.notifications");
+        }
+        const item = {
+          id: crypto.randomUUID(),
+          member,
+          title,
+          body: text,
+          route,
+          data,
+          read_at: null,
+          created_at: new Date().toISOString(),
+        };
+        if (!notifyMember(item)) return { created: false, paused: true };
+        console.log(`[notification] ${item.title}: ${item.body}`);
+        return { id: item.id, created: true };
+      });
+      return sendJson(response, 200, answer);
+    },
+
+    "notifications.list": ({ member, response, query }) => {
+      const mine = notifications.filter((item) => item.member === member).slice().reverse();
+      const after = query.get("after");
+      let from = 0;
+      if (after) {
+        const index = mine.findIndex((item) => item.id === after);
+        if (index < 0) throw runtimeError("bad_request", "invalid notifications cursor");
+        from = index + 1;
+      }
+      const limit = pageLimit(query.get("limit"), 50);
+      const page = mine.slice(from, from + limit);
+      return sendJson(response, 200, {
+        notifications: page.map(appNotice),
+        next_cursor: mine.length > from + limit ? page.at(-1).id : null,
+      });
+    },
+
+    "notifications.read": ({ member, response, params }) => {
+      const id = uuidParam(params.notification_id, "notification");
+      const item = notifications.find((candidate) => candidate.id === id && candidate.member === member);
+      if (!item) throw runtimeError("not_found", "notification not found");
+      if (!item.read_at) item.read_at = new Date().toISOString();
+      return sendJson(response, 200, { ok: true });
+    },
+
+    "notifications.pause_status": ({ member, response }) => sendJson(response, 200, { paused_until: pausedUntil(member) }),
+
+    "notifications.pause": async (ctx) => {
+      const { member, response } = ctx;
+      const body = await jsonBody(ctx);
+      const until = body.until === null || body.until === undefined ? null : new Date(body.until);
+      if (until && (typeof body.until !== "string" || Number.isNaN(until.getTime()))) {
+        throw runtimeError("bad_request", "until must be an RFC 3339 time or null");
+      }
+      if (until && until.getTime() - Date.now() > LIMITS.notification_pause_days * 24 * 60 * 60 * 1000) {
+        throw runtimeError("bad_request", `a pause can last at most ${LIMITS.notification_pause_days} days`);
+      }
+      if (until && until.getTime() > Date.now()) notificationPauses.set(member, until.toISOString());
+      else notificationPauses.delete(member);
+      return sendJson(response, 200, { paused_until: pausedUntil(member) });
+    },
+
+    "notifications.default_mute_status": ({ member, response }) => sendJson(response, 200, { muted: defaultMutes.has(member) }),
+
+    "notifications.default_mute": async (ctx) => {
+      const { member, response } = ctx;
+      const body = await jsonBody(ctx);
+      if (typeof body.muted !== "boolean") throw runtimeError("bad_request", "muted must be true or false");
+      if (body.muted) defaultMutes.add(member);
+      else defaultMutes.delete(member);
+      accountEvent(member, { type: "space_notifications_updated", space_id: null });
+      return sendJson(response, 200, { muted: defaultMutes.has(member) });
+    },
+
+    "jobs.run": async (ctx) => {
+      const { member, request, response } = ctx;
+      const body = await jsonBody(ctx);
+      if (!isPlainObject(body.input)) {
+        throw runtimeError("bad_request", "automation input must be an object no larger than 256 KiB");
+      }
+      const automation = typeof body.automation === "string" ? body.automation : "";
+      const spaceId = body.space_id ?? null;
+      const key = idempotencyKey(request);
+      // A replayed key answers the job it made before the release's
+      // declarations or the space are asked about it again.
+      const answer = await once("jobs.run", member, key, body, () => {
+        declaredAutomation(automation);
+        if (spaceId !== null) requireSpace(member, String(spaceId));
+        const job = {
+          id: crypto.randomUUID(),
+          automation,
+          status: "queued",
+          input: structuredClone(body.input),
+          result: null,
+          error: null,
+          attempts: 0,
+          space_id: spaceId,
+          created_at: new Date().toISOString(),
+          finished_at: null,
+        };
+        automationJobs.set(`${member}\0${job.id}`, job);
+        const timer = setTimeout(async () => {
+          jobTimers.delete(timer);
+          if (job.status !== "queued") return;
+          job.status = "running";
+          job.attempts = 1;
+          try {
+            job.result = await executeLocalAutomation(member, job);
+            finishJob(member, job, "succeeded");
+          } catch (error) {
+            job.error = error instanceof Error ? error.message : String(error);
+            finishJob(member, job, "failed");
+          }
+        }, jobStartMs);
+        jobTimers.add(timer);
+        return { id: job.id, automation: job.automation, status: "queued" };
+      });
+      return sendJson(response, 200, answer);
+    },
+
+    "jobs.get": ({ member, response, params }) => {
+      const job = localJob(member, params.job_id);
+      if (!job) throw runtimeError("not_found", "job not found");
+      return sendJson(response, 200, jobView(job));
+    },
+
+    // Only this member's queued jobs can be cancelled; anything else — one
+    // that ran, or one that is not theirs — is the platform's 409.
+    "jobs.cancel": ({ member, response, params }) => {
+      const job = localJob(member, params.job_id);
+      if (job?.status !== "queued") throw runtimeError("conflict", "only queued non-migration jobs can be cancelled");
+      finishJob(member, job, "cancelled");
+      return sendJson(response, 200, { ok: true });
+    },
+
+    "schedules.list": ({ member, response }) => sendJson(response, 200, {
+      schedules: (pkg.manifest.workloads?.schedules ?? []).map((schedule) => ({
+        name: schedule.name,
+        automation: schedule.automation,
+        cron: schedule.cron,
+        enabled: scheduleOverrides.get(`${member}\0${schedule.name}`) ?? schedule.enabled ?? true,
+        next_run_at: nextCronAfter(schedule.cron),
+        last_enqueued_at: null,
+        origin: "declared",
+      })),
+    }),
+
+    "schedules.set_enabled": async (ctx) => {
+      const { member, response, params } = ctx;
+      const name = params.schedule_name;
+      if (!(pkg.manifest.workloads?.schedules ?? []).some((schedule) => schedule.name === name)) {
+        throw runtimeError("not_found", "schedule not found");
+      }
+      const body = await jsonBody(ctx);
+      if (typeof body.enabled !== "boolean") throw runtimeError("bad_request", "enabled must be boolean");
+      scheduleOverrides.set(`${member}\0${name}`, body.enabled);
+      return sendJson(response, 200, { name, enabled: body.enabled });
+    },
+
+    "lifecycle.status": ({ response }) => {
+      const target = pkg.manifest.lifecycle?.data_version ?? 1;
+      return sendJson(response, 200, {
+        installed_data_version: target,
+        target_data_version: target,
+        migrations: (pkg.manifest.lifecycle?.migrations ?? []).map((migration) => ({
+          from: migration.from,
+          to: migration.to,
+          status: "succeeded",
+          error: null,
+        })),
+      });
+    },
+
+    "logs.write": async (ctx) => {
+      const { member, response } = ctx;
+      const body = await jsonBody(ctx);
+      const level = body.level ?? "info";
+      const message = typeof body.message === "string" ? body.message.trim() : "";
+      if (!["debug", "info", "warn", "error"].includes(level)
+        || !message || [...message].length > LIMITS.log_message_chars) {
+        throw runtimeError("bad_request", "invalid log entry");
+      }
+      if (body.detail !== undefined && Buffer.byteLength(JSON.stringify(body.detail)) > LIMITS.log_detail_bytes) {
+        throw runtimeError("payload_too_large", `a log line's detail is at most ${LIMITS.log_detail_bytes} bytes`);
+      }
+      if (!spend(`logs\n${member}`, LIMITS.logs_per_minute, 60_000)) {
+        throw runtimeError("rate_limited", "browser logging is rate limited");
+      }
+      console.log(`[app:${level}] ${message}`, body.detail ?? "");
+      return sendJson(response, 200, { ok: true });
+    },
+
+    "net.fetch": async ({ response, query }) => {
+      requireCapability("network_proxy", "public-text");
+      const fetched = await fetchPublicPage(query.get("url"), {
+        partial: ["1", "true"].includes(String(query.get("partial") ?? "")),
+        fetchImpl: options.netFetch ?? null,
+        ...(options.netTimeoutMs ? { timeoutMs: options.netTimeoutMs } : {}),
+      });
+      return sendJson(response, 200, fetched);
+    },
+
+    "net.image": async ({ response, query }) => {
+      requireCapability("network_proxy", "public-image");
+      const image = await fetchPublicImage(query.get("url"), {
+        fetchImpl: options.netFetch ?? null,
+        ...(options.netTimeoutMs ? { timeoutMs: options.netTimeoutMs } : {}),
+      });
+      response.writeHead(200, {
+        "content-type": image.content_type,
+        "content-length": String(image.bytes.length),
+        "cache-control": "private, no-store",
+        "x-content-type-options": "nosniff",
+        "x-terminus-url": image.url,
+      });
+      return response.end(image.bytes);
+    },
+
+    "capabilities.list": (ctx) => capabilityDoor(ctx, []),
+    "capabilities.describe": (ctx) => capabilityDoor(ctx, [ctx.params.id, ctx.params.major]),
+    "capabilities.invoke": (ctx) => capabilityDoor(ctx, [ctx.params.id, ctx.params.major, "operations", ctx.params.operation_id]),
+    "capabilities.asset": (ctx) => capabilityDoor(ctx, [ctx.params.id, ctx.params.major, "assets", ...ctx.params.path.split("/")]),
+
+    "server.call": async (ctx) => {
+      const body = await jsonBody(ctx);
+      return answerServerDoor(serverTier, ctx.member, ctx.params.op, body, ctx.response);
+    },
+
+    // The collect plane, bench-shaped: declared channels accept submissions
+    // and print them. There are no maintainers or consent grants offline, so
+    // nothing is delivered; a submission is taken back inside its undo
+    // window (undone) or after it (retracted), as on the platform.
+    "collect.submit": async (ctx) => {
+      const { member, request, response, params } = ctx;
+      const body = await jsonBody(ctx);
+      if (Buffer.byteLength(JSON.stringify(body.payload ?? null)) > LIMITS.collect_payload_bytes) {
+        throw runtimeError("payload_too_large", `a collect submission is at most ${LIMITS.collect_payload_bytes} bytes`);
+      }
+      // A replayed key answers its first answer before the channel's
+      // declaration or its daily budget is asked about it again.
+      const answer = await once(`collect.submit\n${params.channel}`, member, idempotencyKey(request), body, () => {
+        const channel = declaredCollectChannel(params.channel);
+        if (!spend(`collect\n${member}\n${channel}`, LIMITS.collect_submissions_per_day, 24 * 60 * 60 * 1000)) {
+          throw runtimeError("rate_limited", "the channel's daily submissions are spent");
+        }
+        const id = crypto.randomUUID();
+        const at = Date.now();
+        collectSubmissions.set(id, { member, channel, at });
+        console.log(`[collect:${channel}] submission ${id}:`, JSON.stringify(body.payload ?? null));
+        return { id, deliver_after: new Date(at + COLLECT_UNDO_MS).toISOString(), delivered: false };
+      });
+      return sendJson(response, 200, answer);
+    },
+
+    "collect.retract": ({ member, response, params }) => {
+      const id = uuidParam(params.document_id, "submission");
+      const channel = declaredCollectChannel(params.channel);
+      const submission = collectSubmissions.get(id);
+      if (!submission || submission.member !== member || submission.channel !== channel) {
+        throw runtimeError("not_found", "no such submission of yours to withdraw");
+      }
+      console.log(`[collect:${channel}] retracted ${id}`);
+      if (Date.now() - submission.at < COLLECT_UNDO_MS) {
+        collectSubmissions.delete(id);
+        return sendJson(response, 200, { id, undone: true });
+      }
+      return sendJson(response, 200, { id, retracted: true });
+    },
+
+    "host.icon": async ({ request, response, method }) => {
+      if (!options.iconRemote) throw runtimeError("not_found", "this draft has no platform icon");
+      // The Studio-owned icon of the linked creation, revalidated by ETag.
+      const { login, appId } = options.iconRemote;
+      const upstream = await login.open("GET /v1/apps/{app_id}/icon", {
+        params: { app_id: appId },
+        headers: request.headers["if-none-match"] ? { "if-none-match": request.headers["if-none-match"] } : {},
+      });
+      const headers = {};
+      for (const name of ["content-type", "cache-control", "etag"]) {
+        const value = upstream.headers.get(name);
+        if (value) headers[name] = value;
+      }
+      response.writeHead(upstream.status, headers);
+      if (method === "HEAD" || upstream.status === 304) return response.end();
+      return response.end(Buffer.from(await upstream.arrayBuffer()));
+    },
+  };
+
+  function declaredCollectChannel(channel) {
+    const declared = pkg.manifest.capabilities?.collect?.channels?.[channel];
+    if (!declared || declared.kind !== "documents") {
+      throw runtimeError("forbidden", `the release does not declare collect channel '${channel}'`);
+    }
+    return channel;
+  }
+
+  function capabilityDoor({ member, request, response }, segments) {
+    return serveHorizontalCapability(
+      segments.map((segment) => encodeURIComponent(segment)),
+      request,
+      response,
+      pkg.manifest.capabilities,
+      options.platform,
+      { guest: member === null },
+    );
+  }
+
+  async function blockDoor({ member, response, params }, blocked) {
+    const space = requireSpace(member, params.space_id);
+    if (space.kind !== "direct") {
+      throw runtimeError("bad_request", "blocking a peer requires a direct conversation");
+    }
+    const peer = space.members.length === 2 ? registry.peer(space, member) : null;
+    if (!peer) throw runtimeError("conflict", "direct conversation does not currently have one peer");
+    registry.setBlocked(member, peer, blocked);
+    registry.save();
+    signalSpace(space.id, PLATFORM, { type: "space_relationship_updated" }, { transient: true });
+    return sendJson(response, 200, { ok: true, peer_user_id: peer });
+  }
+
+  async function recordMutation(ctx, operation) {
+    const { member, request, response, query, params } = ctx;
+    const name = requireManagedName(params.collection, "collection");
+    const id = requireManagedId(params.record_id);
+    const spaceId = query.get("space_id") || null;
+    const declaration = collectionDefinition(name);
+    requireCollectionScope(declaration, member, spaceId);
+    requireSpaceWriter(member, spaceId);
+    const mutationId = idempotencyKey(request, { required: true, door: "a record write" });
+    const expected = optionalInteger(query.get("expected_version"), "expected_version");
+    if (expected !== null && expected < 0) {
+      throw new CliError("expected_version must be zero or a positive object version");
+    }
+    const value = operation === "put" ? await jsonBody(ctx) : undefined;
+    const receipt = commitRecordMutation({ member, spaceId, declaration, name, id, operation, expected, value, mutationId });
+    return sendJson(response, 200, receipt);
+  }
+
+  async function transactionDoor(ctx) {
+    const { member, request, response } = ctx;
+    const transactionId = idempotencyKey(request, { required: true, door: "a record transaction" });
+    const body = await jsonBody(ctx);
+    if (!Array.isArray(body.operations) || !body.operations.length
+      || body.operations.length > LIMITS.transaction_operations) {
+      throw new CliError(`record transactions contain 1-${LIMITS.transaction_operations} operations`);
+    }
+    const spaceId = typeof body.space_id === "string" && body.space_id ? body.space_id : null;
+    // Rings go to a space's members, so a personal transaction has none.
+    const rings = normalizeWriteRings(body, "transaction");
+    const ringing = Boolean(rings.notify) || rings.mentions.length > 0;
+    if (ringing && !spaceId) throw new CliError("notify and mentions need a space_id");
+    const addresses = new Set();
+    let transactionScope = null;
+    let storeMember = null;
+    let operations = body.operations.map((operation) => {
+      if (!isPlainObject(operation) || !["put", "delete"].includes(operation.action)) {
+        throw new CliError("transaction operations must be put or delete objects");
+      }
+      const collection = requireManagedName(operation.collection, "collection");
+      const recordId = requireManagedId(operation.id);
+      const address = `${collection}\0${recordId}`;
+      if (addresses.has(address)) {
+        throw new CliError(`transaction addresses '${collection}/${recordId}' more than once`);
+      }
+      addresses.add(address);
+      const declaration = collectionDefinition(collection);
+      requireCollectionScope(declaration, member, spaceId);
+      requireSpaceWriter(member, spaceId);
+      const kind = declaration.ownership === "space" ? "space" : (spaceId ? "member" : "personal");
+      const scope = `${kind}:${spaceId || member}`;
+      const owner = managedStoreMember(declaration, member, spaceId);
+      if (transactionScope !== null && (transactionScope !== scope || storeMember !== owner)) {
+        throw new CliError("one transaction cannot cross capsule or ownership scopes");
+      }
+      transactionScope = scope;
+      storeMember = owner;
+      const expectedVersion = operation.expected_version ?? null;
+      if (expectedVersion !== null && (!Number.isSafeInteger(expectedVersion) || expectedVersion < 0)) {
+        throw new CliError("expected_version must be zero or a positive object version");
+      }
+      if (operation.action === "put") validateManagedRecord(declaration, operation.value);
+      return {
+        scopeKey: collectionScopeKey(declaration, spaceId, collection),
+        collection,
+        recordId,
+        operation: operation.action,
+        expectedVersion,
+        ...(operation.action === "put" ? { value: operation.value } : {}),
+        declaration,
+      };
+    });
+    // A transaction that rings is refused in a blocked direct conversation,
+    // as a published event or a delivery is; one that rings no one is the
+    // write it always was.
+    if (ringing) registry.ensureConversationActive(spaceId, member);
+    const transactionStore = capsule(storeMember);
+    const requestSha256 = sha256(JSON.stringify(body));
+    // Receipt, then versions, then permissions — the platform's order: a
+    // replayed batch answers its first answer before a write rule that now
+    // denies its updates, or a record that has moved on, is asked about it.
+    const receipt = transactionStore.transactionReceipt(transactionScope, transactionId);
+    if (receipt) {
+      if (receipt.requestSha256 !== requestSha256) {
+        throw runtimeError("idempotency_conflict", "Idempotency-Key was already used for a different transaction");
+      }
+      return sendJson(response, 200, { ...receipt.response, replayed: true });
+    }
+    for (const operation of operations) {
+      requireExpectedVersion(
+        transactionStore.getRecord(operation.scopeKey, operation.collection, operation.recordId),
+        operation.expectedVersion,
+        `${operation.collection}/${operation.recordId}`,
+      );
+    }
+    for (const operation of operations) {
+      const prior = transactionStore.getRecord(operation.scopeKey, operation.collection, operation.recordId);
+      const policyActor = managedPolicyActor(operation.declaration, member, spaceId);
+      if (operation.operation === "put") {
+        authorizeCollection(operation.declaration, prior ? "update" : "create", policyActor, {
+          value: operation.value,
+          created_by_user_id: prior?.created_by_user_id ?? member,
+          updated_by_user_id: member,
+        });
+        authorizeChangedFields(operation.declaration, policyActor, prior?.value, operation.value);
+        enforceWriteRules(operation.declaration, member, prior?.value, operation.value);
+      } else if (prior) {
+        authorizeCollection(operation.declaration, "delete", policyActor, prior);
+      }
+    }
+    operations = validateLocalDeclaredConstraints(transactionStore, member, spaceId, operations);
+    const result = transact(transactionStore, {
+      transactionScope,
+      transactionId,
+      requestSha256,
+      operations,
+      actor: member,
+    });
+    if (result.conflict) throw storeConflict(result);
+    for (const [index, rawChange] of result.changes.entries()) {
+      publishCollectionWake(member, spaceId, operations[index], rawChange);
+    }
+    // Committed with the write: the first commit rings, a replay rings nobody.
+    if (ringing && !result.response.replayed) {
+      const space = registry.find(spaceId);
+      ringSpaceWrite(space, member, [...space.members], rings, {
+        space_id: spaceId,
+        transaction_id: transactionId,
+      });
+    }
+    return sendJson(response, 200, result.response);
+  }
+
+  /** POST /events: an app event (or a batch) to every OTHER member's streams —
+   * never back to any window of its publisher. */
+  async function publishDoor(ctx) {
+    const { member, request, response } = ctx;
+    const body = await jsonBody(ctx);
+    const mentions = body.mentions ?? [];
+    if (!Array.isArray(mentions) || mentions.some((handle) => typeof handle !== "string")) {
+      throw new CliError("mentions must be a list of handles");
+    }
+    if (mentions.length > LIMITS.mentions) throw new CliError(`at most ${LIMITS.mentions} mentions per event`);
+    if (body.transient !== undefined && typeof body.transient !== "boolean") {
+      throw new CliError("transient must be true or false");
+    }
+    const transient = body.transient === true;
+    if (transient && mentions.length) throw new CliError("transient events cannot carry mentions");
+    const notify = body.notify === undefined || body.notify === null ? null : normalizeEventNotify(body.notify);
+    if (transient && notify) throw new CliError("transient events cannot carry notify");
+    const batch = Object.hasOwn(body, "events");
+    if (batch === Object.hasOwn(body, "event")) throw new CliError("provide exactly one of `event` or `events`");
+    if (batch) {
+      if (mentions.length) throw new CliError("event batches cannot carry mentions");
+      if (notify) throw new CliError("event batches cannot carry notify");
+      if (!Array.isArray(body.events) || !body.events.length || body.events.length > LIMITS.event_batch) {
+        throw new CliError(`events batches carry 1..=${LIMITS.event_batch} events`);
+      }
+    }
+    const spaceId = typeof body.space_id === "string" ? body.space_id : "";
+    if (!spaceId) throw runtimeError("bad_request", "a collaborative space is required");
+    // A replayed key answers its first answer before the space, a block or
+    // the publish budget is asked about it again.
+    const answer = await once("events.publish", member, idempotencyKey(request), body, () => {
+      const space = requireSpace(member, spaceId);
+      registry.ensureConversationActive(spaceId, member);
+      const role = registry.memberRole(spaceId, member);
+      const publishOne = (event) => {
+        if (Buffer.byteLength(JSON.stringify(event ?? null)) > LIMITS.event_payload_bytes) {
+          return { error: "payload_too_large" };
+        }
+        const budget = transient ? LIMITS.publish_transient_per_minute : LIMITS.publish_durable_per_minute;
+        if (!spend(`publish\n${member}\n${spaceId}\n${transient}`, budget, 60_000)) {
+          return { error: "rate_limited" };
+        }
+        bus.deliver(
+          space.members,
+          bus.envelope("space_event", spaceId, memberOrigin(member, role), event ?? {}, transient),
+          { except: member },
+        );
+        return { ok: true, transient };
+      };
+      if (batch) return { results: body.events.map(publishOne) };
+      const result = publishOne(body.event);
+      if (result.error === "payload_too_large") {
+        throw runtimeError("payload_too_large", `an event payload is at most ${LIMITS.event_payload_bytes} bytes`);
+      }
+      if (result.error === "rate_limited") throw runtimeError("rate_limited", "event publishing is rate limited");
+      // Mention fan-out, production-contained: current members only, never
+      // the actor, each once; unknown handles drop silently. An event's row
+      // previews the event's own `preview` and opens nowhere in particular.
+      const mentioned = mentionTargets(space.members, mentions, member);
+      const preview = body.event?.preview;
+      ringMentions(space, member, mentioned, {
+        body: firstChars(typeof preview === "string" ? preview : "", MENTION_PREVIEW_CHARS),
+        route: null,
+        data: { space_id: spaceId },
+      });
+      if (notify) {
+        notifyAbsentMembers(space, member, notify, { kind: "message", space_id: spaceId }, new Set(mentioned));
+      }
+      return result;
+    });
+    return sendJson(response, 200, answer);
+  }
+
+  /** GET /events: the member's account stream. stream_open first; after that
+   * only what happens from now on — nothing is replayed. A stream is its
+   * port's, and ends when who that port is changes (endSeatStreams). */
+  function streamDoor({ member, seat, request, response, query }) {
+    response.writeHead(200, {
+      "content-type": "text/event-stream",
+      "cache-control": "no-store",
+      connection: "keep-alive",
+    });
+    response.write(streamOpening());
+    const rooms = String(query.get("rooms") ?? "").split(",").map((room) => room.trim()).filter(Boolean);
+    const joined = !bus.hasStream(member);
+    const stream = { member, seat, res: response, rooms: rooms.length ? new Set(rooms) : null };
+    bus.streams.add(stream);
+    // A member's first live window: co-members' streams hear they came
+    // online. Their last one closing is the leave those streams hear.
+    request.on("close", () => {
+      if (bus.streams.delete(stream) && !bus.hasStream(member)) announcePresenceGone(member);
+    });
+    if (joined) bus.deliver(coMembers(member), presenceFrame(null, member));
+  }
+
+  async function handleRuntime(seat, url, request, response) {
+    const method = (request.method ?? "GET").toUpperCase();
+    const doorPath = url.pathname.slice("/_terminus".length);
+    // The guest's sign-in page posts its form back to the sign-in door, which
+    // the contract — a navigation — answers only to GET: the form is the
+    // harness's own, and only the guest's port shows it.
+    if (seat.guest && method === "POST" && doorPath === SIGN_IN_PATH) {
+      return pickSignIn(seat, request, response);
+    }
+    const match = matchDoor(method, doorPath);
+    if (!match) throw runtimeError("not_found", `no door ${url.pathname}`);
+    if (!match.door) {
+      response.setHeader("allow", match.methods.join(", "));
+      throw runtimeError("method_not_allowed", `${url.pathname} does not answer ${method}`);
+    }
+    const { door, params } = match;
+    if (door.id === "host.logout") return signOut(seat, response);
+    if (door.id === "host.signin") return signIn(seat, url, response);
+    const member = seat.member;
+    // A guest reaches what the contract lets a guest reach — the bootstrap,
+    // the app's declared capability assets, the host's own doors — and every
+    // other door refuses them before it looks at anything, as the app host
+    // refuses a visitor who has no session.
+    if (member === null && !door.guest_allowed) {
+      throw runtimeError(APP_HOST.guest.refusal.code, GUEST_REFUSAL);
+    }
+    // Signed out, the member's windows send no session at all — the app
+    // host's sign-out door removed its cookie — and a request without one is
+    // unauthorized, as the app host and `dev --remote` answer it
+    // (session_ended is a session the platform recognizes as revoked or
+    // expired, and the SDK's own answer on the device that signed out).
+    if (door.auth === "app_session" && seat.signedOut) {
+      throw runtimeError("unauthorized", "App session required: open the app again to sign in");
+    }
+    const handler = HANDLERS[door.id];
+    if (door.hosts.dev === "unsupported" || !handler) {
+      throw runtimeError(
+        "unsupported_in_dev",
+        `terminus dev cannot serve ${door.method} /_terminus${door.path}; `
+          + "exercise it against a real host (terminus dev --remote) and mock it in app code here",
+      );
+    }
+    return handler({ member, seat, request, response, url, query: url.searchParams, params, door, method });
+  }
+
+  /* ── who a port is: sign-in and sign-out ─────────────────────────────── */
+
+  /** The member signed in on `seat`, or the guest's refusal: the harness's
+   * own controls are a person's, and a guest is nobody yet. */
+  function signedInMember(seat) {
+    if (seat.member === null) throw runtimeError(APP_HOST.guest.refusal.code, GUEST_REFUSAL);
+    return seat.member;
+  }
+
+  /** Every stream a port opened ends when who that port is changes — a
+   * sign-out, or someone signing in on the guest's port. A stream is for the
+   * member it opened as: left open, a window that is somebody else now would
+   * go on hearing the last person's frames. Its client reconnects as whoever
+   * the port is now, or is refused. */
+  function endSeatStreams(seat) {
+    for (const stream of [...bus.streams]) {
+      if (stream.seat !== seat) continue;
+      bus.streams.delete(stream);
+      stream.res.end();
+      if (!stream.corner && !bus.hasStream(stream.member)) announcePresenceGone(stream.member);
+    }
+  }
+
+  /** `/_terminus/logout`. Production revokes the session, clears its cookie
+   * and sends the browser to sign in again; until the person does, every
+   * door answers 401. Here the identity is the port, so the port forgets who
+   * signed in on it: a member's port is signed out — the app itself stands
+   * in for the sign-in page, and opening it again (what the desk does when
+   * it opens a window) signs them back in — and the guest's port is a guest
+   * again. */
+  function signOut(seat, response) {
+    if (seat.guest ? seat.member !== null : !seat.signedOut) endSeatStreams(seat);
+    if (seat.guest) seat.member = null;
+    else seat.signedOut = true;
+    response.writeHead(303, { location: "/" });
+    return response.end();
+  }
+
+  /** `/_terminus/signin?return_to=<path>` (`session.signIn()`): sign in, then
+   * come back to the place. A port somebody is on goes straight back — a
+   * member's signed-out port is signed in again, as opening the app does —
+   * and the guest's port gets the page that picks who signs in. */
+  function signIn(seat, url, response) {
+    const place = returnToPath(url.searchParams.get("return_to"));
+    if (seat.member === null) return answerSignInPicker(place, response);
+    seat.signedOut = false;
+    response.writeHead(303, { location: place });
+    return response.end();
+  }
+
+  /** The sign-in page's form: the guest's port becomes the member picked,
+   * then goes to the place. Only a same-origin POST does it — a link that
+   * signs a port in (`?member=`) would be the deleted `?as=` shim again — and
+   * the origin stays the port's, so what the app kept for the guest in this
+   * browser is still there to move into the account. */
+  async function pickSignIn(seat, request, response) {
+    if (!isSameOrigin(request)) {
+      await readBodyBuffer(request, SIGN_IN_FORM_BYTES).catch(() => undefined);
+      throw runtimeError("forbidden", "the sign-in form is answered only for this app's own pages");
+    }
+    const type = String(request.headers["content-type"] ?? "").split(";")[0].trim().toLowerCase();
+    const body = await readBodyBuffer(request, SIGN_IN_FORM_BYTES);
+    if (type !== "application/x-www-form-urlencoded") {
+      throw runtimeError("bad_request", "the sign-in form posts application/x-www-form-urlencoded");
+    }
+    const form = new URLSearchParams(body.toString("utf8"));
+    const place = returnToPath(form.get("return_to"));
+    // Signed in already (another tab of the page got there first) is signed
+    // in, as the platform's sign-in treats a live session: straight back.
+    if (seat.member === null) {
+      const picked = form.get("member");
+      if (!picked) throw runtimeError("bad_request", "pick the member to sign in as");
+      const member = knownPerson(picked);
+      endSeatStreams(seat);
+      seat.member = member;
+    }
+    response.writeHead(303, { location: place });
+    return response.end();
+  }
+
+  /** The guest's sign-in page. On Terminus a guest signs in, or makes an
+   * account, on the platform's own page; here the people are the members, so
+   * the page asks which of them this is. It draws each as a monogram — an
+   * avatar is a door a guest may not open — and loads nothing at all: no
+   * script, no image, nothing from anywhere else. */
+  function answerSignInPicker(place, response) {
+    const people = members.map((handle) => {
+      const face = monogram(handle);
+      return `<li><button type="submit" name="member" value="${escapeHtml(handle)}">`
+        + `<span class="face hue-${face.hue}" aria-hidden="true">${escapeHtml(face.initials)}</span>`
+        + `<span class="who"><span class="name">${escapeHtml(profile(handle).name)}</span>`
+        + `<span class="handle">@${escapeHtml(handle)}</span></span></button></li>`;
+    }).join("");
+    const hues = MONOGRAM_HUES.map((hue, index) => `.hue-${index}{--hue:${hue}}`).join("");
+    response.writeHead(200, {
+      "cache-control": "no-store",
+      "content-type": "text/html; charset=utf-8",
+      "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; "
+        + "base-uri 'none'; frame-ancestors 'none'",
+      "x-content-type-options": "nosniff",
+    });
+    return response.end(
+      `<!doctype html><html lang="en"><meta charset="utf-8"><meta name="viewport" content="width=device-width">`
+      + `<title>Sign in · ${escapeHtml(appSlug)}</title>`
+      + `<style>body{margin:0;background:#f7f7f3;color:#20211f;font:15px/1.5 system-ui,-apple-system,"Segoe UI",sans-serif}`
+      + `main{max-width:26rem;margin:12vh auto;padding:0 1.5rem}`
+      + `.tag{margin:0 0 .75rem;color:#696b65;font-size:12px;letter-spacing:.04em;text-transform:uppercase}`
+      + `h1{font:600 1.7rem/1.15 Georgia,serif;margin:0 0 .5rem}.lede{color:#4a4b47;margin:0 0 1.5rem}`
+      + `ul{list-style:none;margin:0;padding:0;display:grid;gap:.5rem}`
+      + `button{display:flex;align-items:center;gap:.75rem;width:100%;padding:.6rem .75rem;`
+      + `border:1px solid #dcdcd4;border-radius:12px;background:#fff;color:inherit;font:inherit;text-align:left;cursor:pointer}`
+      + `button:hover,button:focus-visible{border-color:#2d68d8;outline:none;box-shadow:0 0 0 3px rgb(45 104 216/.15)}`
+      + `.face{flex:none;display:grid;place-items:center;width:2.25rem;height:2.25rem;border-radius:50%;`
+      + `color:#fff;font-weight:600;font-size:.85rem;`
+      + `background:linear-gradient(180deg,hsl(var(--hue) 44% 69%),hsl(var(--hue) 42% 53%))}${hues}`
+      + `.who{display:grid}.name{font-weight:600}.handle{color:#696b65;font-size:13px}`
+      + `.back{display:inline-block;margin-top:1.25rem;color:#2d68d8;text-decoration:none}`
+      + `.back:hover{text-decoration:underline}</style>`
+      + `<main><p class="tag">terminus dev</p><h1>Sign in to ${escapeHtml(appSlug)}</h1>`
+      + `<p class="lede">You are a guest here: nobody is signed in on this port. On Terminus this is where `
+      + `a guest signs in or makes an account; here, pick who signs in.</p>`
+      + `<form method="post" action="/_terminus${SIGN_IN_PATH}">`
+      + `<input type="hidden" name="return_to" value="${escapeHtml(place)}"><ul>${people}</ul></form>`
+      + `<a class="back" href="${escapeHtml(place)}">Stay a guest</a></main></html>`,
+    );
+  }
+
+  const portByMember = new Map();
+
+  /** The harness's own invitation control: a person's pending invitations,
+   * and their answer to one. On Terminus this is the account's Notification
+   * Center, which an app never draws. */
+  async function handleDevRequests(member, url, request, response) {
+    const method = (request.method ?? "GET").toUpperCase();
+    const rest = url.pathname.replace(/^\/__terminus_dev\/requests\/?/u, "").split("/").filter(Boolean);
+    if (rest.length === 0 && method === "GET") {
+      return sendJson(response, 200, {
+        requests: registry.invitations
+          .filter((invitation) => invitation.invitee === member
+            && invitation.status === "pending"
+            && Date.parse(invitation.expiresAt) > Date.now())
+          .map((invitation) => {
+            const space = registry.find(invitation.spaceId);
+            return {
+              id: invitation.id,
+              space_id: invitation.spaceId,
+              space_name: space?.name ?? "Space",
+              kind: space?.kind ?? "group",
+              title: invitationCopy(space, invitation.inviter).title,
+              inviter: publicIdentity(invitation.inviter),
+              // Who else is already in the room: a group invitation is a
+              // question about the people in it.
+              members: (space?.members ?? []).map((handle) => publicIdentity(handle)),
+              created_at: invitation.createdAt,
+              expires_at: invitation.expiresAt,
+            };
+          }),
+      });
+    }
+    if (rest.length === 2 && method === "POST" && ["accept", "decline"].includes(rest[1])) {
+      const invitationId = decodeURIComponent(rest[0]);
+      const status = rest[1] === "accept" ? "accepted" : "declined";
+      const { invitation, space } = registry.resolveInvitation(invitationId, member, status);
+      registry.save();
+      for (const notice of notifications) {
+        if (notice.member === member && notice.data?.invitation_id === invitationId && !notice.read_at) {
+          notice.read_at = new Date().toISOString();
+        }
+      }
+      accountEvent(member, { type: "space_invitation_resolved", space_id: invitation.spaceId });
+      if (status === "accepted") {
+        accountEvent(member, { type: "space_membership_joined", space_id: invitation.spaceId });
+        signalSpace(invitation.spaceId, PLATFORM, { type: "space_members_updated" }, { transient: true });
+      } else {
+        signalSpace(invitation.spaceId, PLATFORM, { type: "space_invitations_updated" }, { transient: true });
+      }
+      return sendJson(response, 200, {
+        ok: true,
+        status,
+        space: { id: space.id, name: space.name },
+      });
+    }
+    throw runtimeError("not_found", "unknown local request-control route");
+  }
+
+  /** The notification corner's stream: the member's account frames, as the
+   * desk hears them on Terminus — stream_open, then only what happens from
+   * now on. It is not an app's stream, so it never counts as the member being
+   * online, and no presence frame announces it. */
+  function answerCornerStream(seat, request, response) {
+    const member = signedInMember(seat);
+    const method = (request.method ?? "GET").toUpperCase();
+    if (method !== "GET") {
+      response.setHeader("allow", "GET");
+      throw runtimeError("method_not_allowed", "the notification corner's stream is read with GET");
+    }
+    response.writeHead(200, {
+      "content-type": "text/event-stream",
+      "cache-control": "no-store",
+      connection: "keep-alive",
+    });
+    response.write(streamOpening());
+    const stream = { member, seat, res: response, rooms: null, corner: true };
+    bus.streams.add(stream);
+    request.on("close", () => bus.streams.delete(stream));
+  }
+
+  /** A local member's public page: where users.profile sends a browser. */
+  function answerDevProfile(url, response) {
+    const handle = decodeURIComponent(url.pathname.slice(DEV_PROFILE_PREFIX.length)).toLowerCase();
+    if (!members.includes(handle)) throw runtimeError("not_found", `no user with handle @${handle}`);
+    const fixture = profile(handle);
+    const identity = publicIdentity(handle);
+    const avatar = identity.avatar_url
+      ? `<img src="${escapeHtml(identity.avatar_url)}" alt="">`
+      : `<span aria-hidden="true">${escapeHtml([...fixture.name][0]?.toUpperCase() ?? "?")}</span>`;
+    response.writeHead(200, {
+      "content-type": "text/html; charset=utf-8",
+      "content-security-policy": "default-src 'none'; img-src 'self'; style-src 'unsafe-inline'",
+    });
+    return response.end(
+      `<!doctype html><html lang="en"><meta charset="utf-8"><meta name="viewport" content="width=device-width">`
+      + `<title>${escapeHtml(fixture.name)} · Local Terminus profile</title>`
+      + `<style>body{margin:0;background:#f7f7f3;color:#20211f;font:15px/1.6 system-ui,sans-serif}`
+      + `main{max-width:38rem;margin:12vh auto;padding:0 1.5rem}.avatar{width:5rem;height:5rem;border-radius:50%;`
+      + `display:grid;place-items:center;overflow:hidden;background:#dedfd8;font:600 2rem serif}`
+      + `.avatar img{width:100%;height:100%;object-fit:cover}h1{font:600 2.2rem/1.1 Georgia,serif;margin:1rem 0 .2rem}`
+      + `.handle{color:#696b65}.bio{white-space:pre-wrap;margin-top:1.5rem;max-width:34rem}</style>`
+      + `<main><div class="avatar">${avatar}</div><h1>${escapeHtml(fixture.name)}</h1>`
+      + `<div class="handle">@${escapeHtml(handle)}</div>`
+      + (fixture.bio ? `<p class="bio">${escapeHtml(fixture.bio)}</p>` : "")
+      + `</main></html>`,
+    );
+  }
+
+  /** One request to `seat`'s port, answered as whoever that port is now. */
+  async function handleRequest(seat, request, response) {
+    // The runtime brokers capabilities billed to the developer, and no page
+    // but one addressed to localhost may reach it (see isLoopbackHost).
+    if (!isLoopbackHost(request)) return refuseForeignHost(request, response);
+    const url = new URL(request.url ?? "/", `http://localhost:${request.socket.localPort}`);
+    // The runtime and the harness's own controls answer only pages on this
+    // machine (see isLoopbackOrigin); the app's pages stay open to a link
+    // from anywhere.
+    const runtime = url.pathname === "/_terminus" || url.pathname.startsWith("/_terminus/");
+    if ((runtime || url.pathname.startsWith("/__terminus_dev/")) && !isLoopbackOrigin(request)) {
+      return refuseCrossSite(response);
+    }
+    try {
+      if (url.pathname === "/__terminus_dev/requests" || url.pathname.startsWith("/__terminus_dev/requests/")) {
+        return await handleDevRequests(signedInMember(seat), url, request, response);
+      }
+      if (url.pathname === DEV_ABOUT_PATH) {
+        return answerDevAbout(request, response, {
+          kind: "app",
+          app: pkg.id ?? pkg.manifest.slug,
+          directory: path.resolve(dir),
+          member: seat.member,
+          ports: Object.fromEntries(portByMember),
+          ...(guestSeat ? { guest_port: guestSeat.port } : {}),
+        });
+      }
+      if (url.pathname.startsWith(DEV_PROFILE_PREFIX)) return answerDevProfile(url, response);
+      if (url.pathname === DEV_NOTIFICATION_STREAM_PATH) return answerCornerStream(seat, request, response);
+      if (url.pathname === DEV_NOTIFICATION_POPUP_PATH) {
+        const method = (request.method ?? "GET").toUpperCase();
+        if (method !== "GET" && method !== "HEAD") {
+          response.setHeader("allow", "GET, HEAD");
+          throw runtimeError("method_not_allowed", "the notification corner is a script to load");
+        }
+        response.writeHead(200, {
+          "cache-control": "no-store",
+          "content-type": "text/javascript; charset=utf-8",
+        });
+        return response.end(method === "HEAD" ? undefined : DEV_NOTIFICATION_POPUP_SCRIPT);
+      }
+      if (runtime) return await handleRuntime(seat, url, request, response);
+      // Opening the app — a page, not a script or an image — signs a member
+      // who signed out back in. The guest's port has nobody to sign back in:
+      // a guest signs in through the app (session.signIn()).
+      if (seat.signedOut && String(request.headers.accept ?? "").includes("text/html")) {
+        seat.signedOut = false;
+      }
+      await serveUiAsset(pkg, uiDir, url, request, response, {
+        // The notification corner is a person's account: a guest has none.
+        transformHtml: seat.member === null ? undefined : injectDevNotificationPopup,
+      });
+    } catch (error) {
+      if (response.headersSent) return response.end();
+      sendRuntimeError(response, error);
+    }
+  }
+
+  const servers = [];
+  try {
+    // A server per seat, and the seat is fixed when the server is made: who
+    // a request is never depends on looking its port up — nor on a fallback
+    // that could answer a guest's port as somebody.
+    for (const [index, seat] of seats.entries()) {
+      const server = createServer((request, response) => handleRequest(seat, request, response));
+      const requested = basePort === 0 ? 0 : basePort + index;
+      await listenDevServer(server, requested);
+      seat.port = server.address().port;
+      if (!seat.guest) portByMember.set(seat.member, seat.port);
+      servers.push(server);
+    }
+  } catch (error) {
+    clearInterval(compactor);
+    await Promise.all(servers.map(closeDevServer));
+    await serverTier.close();
+    for (const store of capsules.values()) store.close();
+    systemStore.close();
+    if (error?.code === "EADDRINUSE" && basePort !== 0) {
+      const port = basePort + servers.length;
+      throw await devPortUnavailableError({
+        basePort,
+        commandArgs: options.commandArgs,
+        count: seats.length,
+        directory: dir,
+        guest,
+        members,
+        failures: [{ port, error }],
+        viteProxy: true,
+      });
+    }
+    throw error;
+  }
+
+  return {
+    manifest: pkg.manifest,
+    hasUi: pkg.hasUi,
+    uiDirectory: pkg.uiDirectory,
+    rootDir,
+    profilesFile: options.profiles ? path.resolve(options.profiles) : null,
+    ports: portByMember,
+    /** The guest's port (--guest), after the members'; null without one. */
+    guestPort: guestSeat?.port ?? null,
+    /** Per-member capsule stores (tests use them to age the change window). */
+    capsules,
+    /** The doors this harness serves, by door id (a test holds it to doors.json). */
+    doors: Object.keys(HANDLERS),
+    async close() {
+      clearInterval(compactor);
+      for (const timer of jobTimers) clearTimeout(timer);
+      for (const stream of bus.streams) stream.res.end();
+      bus.streams.clear();
+      await Promise.all(servers.map(closeDevServer));
+      await serverTier.close();
+      for (const store of capsules.values()) store.close();
+      systemStore.close();
+    },
+  };
+}
+
+export async function devCommand(args) {
+  const flags = parseFlags(args, "dev");
+  const dir = path.resolve(flags._[0] ?? ".");
+  // Agents get the browser dev (the VM-free draft dev, seeded by a push
+  // of the local folder; no terminal REPL — decision of
+  // 2026-08-31), not the browser-app fixture harness.
+  const kind = await packageKind(dir);
+  if (kind === "agent") {
+    const { agentDevCommand } = await import("./agentdev.mjs");
+    return agentDevCommand(dir, flags, args);
+  }
+  // Services get a local test session against the deployed endpoint: the
+  // package's own dev/ page on a local port, invocations relayed through the
+  // platform's draft-test lane.
+  if (kind === "service") {
+    const { serviceDevCommand } = await import("./servicedev.mjs");
+    return serviceDevCommand(dir, flags, args);
+  }
+  const pkg = await readDevPackage(dir);
+  requireBuiltDevBundle(pkg);
+  if (flags.remote) return remoteDevCommand(dir, flags, pkg, args);
+  let iconRemote = null;
+  let platform = null;
+  try {
+    const api = await connect(flags);
+    platform = { apiBase: api.base, token: api.token };
+    const linked = pkg.id ? await resolveCreation(api, pkg.id) : null;
+    if (linked) iconRemote = { login: api, appId: linked.id };
+    try {
+      // A capability dev session makes the platform's brokered operations
+      // (web search, geocoding, provider tokens) work against this local
+      // folder exactly as they would for the published app — gated by the
+      // locally compiled declarations, spending the developer's own budgets
+      // and credits.
+      const dev = await api.json("POST /v1/app-runtime/dev-sessions", {
+        body: {
+          app_id: linked?.id ?? null,
+          app_ref: pkg.id ?? `@local/${pkg.manifest.slug}`,
+          capabilities: pkg.manifest.capabilities ?? {},
+        },
+      });
+      if (dev?.token) platform = { apiBase: api.base, token: dev.token, artifactContext: "app" };
+    } catch {
+      // Without a dev session, the pure capability lanes still answer under
+      // the login bearer.
+    }
+  } catch {
+    // Local runtime/data development remains available offline. Once logged
+    // in, restarting the harness reconnects the platform capability plane
+    // and the Studio-owned icon.
+  }
+  const harness = await startDevServer(dir, {
+    commandArgs: args,
+    fresh: Boolean(flags.fresh),
+    guest: Boolean(flags.guest),
+    members: flags.members,
+    port: flags.port,
+    profiles: flags.profiles,
+    iconRemote,
+    platform,
+    pkg,
+  });
+  console.log(`terminus dev — ${pkg.id ?? harness.manifest.slug}`);
+  console.log(`Data space: ${harness.rootDir}`);
+  if (harness.profilesFile) console.log(`Profile fixtures: ${harness.profilesFile}`);
+  for (const [member, port] of harness.ports) {
+    console.log(`  @${member}: http://localhost:${port}/`);
+  }
+  if (harness.guestPort !== null) console.log(`  guest: http://localhost:${harness.guestPort}/ (signed out)`);
+  console.log("One port per member: open two members in two tabs to develop multiplayer behaviour live.");
+  if (harness.guestPort !== null) {
+    console.log("The guest is someone who is not signed in; the app's sign-in (session.signIn()) picks a member there.");
+  }
+  await new Promise(() => {}); // runs until Ctrl-C
+}
+
+/** `dev --remote`: the local bundle over the production runtime. Opt-in —
+ * the SQLite harness stays the default. */
+async function remoteDevCommand(dir, flags, pkg, commandArgs) {
+  for (const flag of ["members", "profiles", "guest", "fresh"]) {
+    if (flags[flag] !== undefined) throw usageError(`--${flag} applies to the local harness, not --remote`);
+  }
+  if (!pkg.id) {
+    throw usageError("dev --remote needs a published app: set `id` in terminus.json (terminus remote add)");
+  }
+  const api = await connect(flags);
+  const app = await resolveCreation(api, pkg.id);
+  if (!app) throw new CliError(`no published app with address ${pkg.id} in your account`);
+  const { mintRemoteAppSession, startRemoteDevServer } = await import("./appdev-remote.mjs");
+  const minted = await mintRemoteAppSession({ api, appId: app.id });
+  const harness = await startRemoteDevServer(dir, {
+    commandArgs,
+    port: flags.port,
+    pkg,
+    remote: {
+      login: api,
+      token: minted.token,
+      appId: app.id,
+      webHost: minted.webHost,
+    },
+  });
+  console.log(`terminus dev --remote — ${pkg.id} (${minted.appName ?? app.name ?? app.id})`);
+  console.log(`Runtime: ${api.base}/app-runtime/* as the app session of ${minted.webHost}`);
+  if (minted.expiresAt) console.log(`App session expires: ${minted.expiresAt}`);
+  console.log(`  http://localhost:${harness.port}/`);
+  await new Promise(() => {}); // runs until Ctrl-C
+}