@volter/twin-standard 1.0.159 → 1.0.160

package/dist/src/walk/serve-pack.js

@@ -44,6 +44,12 @@ async function serve(pack, options) {
         }
         throw error;
     }
+    // a raw-TCP pack's HTTP control seam is the side port its descriptor declares for HTTP (a mail relay's policy door),
+    // where the pack's factory names it by that side port's option
+    const declared = descriptor?.transport === 'raw-tcp' ? descriptor.sidePorts?.find((side) => (side.scheme ?? 'http') === 'http') : undefined;
+    const control = declared ? server[declared.option] : undefined;
+    if (server.inspectPort === undefined && typeof control === 'number')
+        server = { ...server, inspectPort: control };
     if (!database)
         return server;
     const backing = database;

package/dist/src/walk/shape.d.ts

@@ -69,7 +69,7 @@ export type LineShape = {
      *  command-reply table reads them; moves `conn` past an intermediate reply. */
     check: (conn: LineConnection, line: string | null, codes: number[]) => string[];
 };
-/** The SHAPE of a line protocol (scripts/derive-pack.ts from an RFC's command-reply table): each reply a
+/** The SHAPE of a line protocol (the derivation, from an RFC's command-reply table): each reply a
  *  code the spec allows the command it answers, or one any command may answer. A line after an
  *  intermediate reply (DATA's payload, a SASL response) is answered as that command's `then`. */
 export declare function lineShape(pkg: string): LineShape | undefined;

package/dist/src/walk/shape.js

@@ -292,7 +292,7 @@ function unitResponseOwner(pkg, manifest) {
     };
     return { pathOf, checker };
 }
-/** The SHAPE of a line protocol (scripts/derive-pack.ts from an RFC's command-reply table): each reply a
+/** The SHAPE of a line protocol (the derivation, from an RFC's command-reply table): each reply a
  *  code the spec allows the command it answers, or one any command may answer. A line after an
  *  intermediate reply (DATA's payload, a SASL response) is answered as that command's `then`. */
 export function lineShape(pkg) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/twin-standard",
-  "version": "1.0.159",
+  "version": "1.0.160",
   "description": "The Protocol 3 standard for Volter twin packs: the criteria a pack is graded by, the grader, the gate a pack repository and the twin catalog run on every change and submission, and the spec derivation the grade checks against. Pin a version: every place a pack is judged judges by that standard.",
   "keywords": [
     "twin",
@@ -77,8 +77,8 @@
     "yaml": "2.9.0"
   },
   "peerDependencies": {
-    "@volter/world-core": "3.0.164",
-    "@volter/world-runtime": "^3.0.188",
+    "@volter/world-core": "3.0.165",
+    "@volter/world-runtime": "^3.0.190",
     "playwright": "^1.63.0"
   },
   "peerDependenciesMeta": {
@@ -110,7 +110,9 @@
     "openai": "^7.25.0",
     "stripe": "^23.0.0",
     "@google/genai": "2.13.0",
-    "@google/generative-ai": "0.24.1"
+    "@google/generative-ai": "0.24.1",
+    "nodemailer": "^10.0.6",
+    "twitter-api-v2": "^1.29.1"
   },
   "engines": {
     "node": ">=22.6"

package/src/check-sources.ts

@@ -2,13 +2,13 @@
 // check-sources — the evidence a derived pack cites, fetched (docs/contributing/architecture.md,
 // "Protocol 3", Correcting the spec and The semantics layer). Every URL a state transition's `source`,
 // a handler's `// source:` line or a spec patch's `why` names is fetched once and its answer recorded in `spec/sources.json`; a patch's
-// `quote` is looked for in the text of the page its `source` names. derive-pack reads the record offline
+// `quote` is looked for in the text of the page its `source` names. the derivation reads the record offline
 // and refuses a dead source, one never checked, and a quote its page does not hold.
 //
 // Documentation pages, never a vendor's API: each is fetched at most once per run, sixteen at a time,
 // and a page already recorded as found is not fetched again (--recheck fetches everything).
 //
-// Usage: twin-standard check-sources <pack dir> [--recheck]   (twin-world: bun scripts/check-sources.ts <vendor>)
+// Usage: twin-standard check-sources <pack dir> [--recheck]
 import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { unitAt } from './unit.ts';

package/src/clients/resend.first-use.json

@@ -1,11 +1,11 @@
 {
   "schemaVersion": 1,
   "source": "https://www.npmjs.com/package/resend/v/6.6.0",
-  "about": "Send a synthetic sign-in email through the official SDK and inspect the retained message and local inbox after restart. Advance the frozen World clock to settle synthetic delivery before retained-state inspection.",
+  "about": "Send a synthetic sign-in email through the official SDK and inspect the retained message after restart. Advance the frozen World clock to settle synthetic delivery before retained-state inspection.",
   "files": {
     "package.json": "{\n  \"name\": \"resend-installed-customer\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"dependencies\": {\n    \"resend\": \"6.6.0\"\n  }\n}\n",
     ".env.example": "RESEND_API_KEY=\n",
-    "inspect-email.mjs": "import assert from 'node:assert/strict';\nimport { readFileSync } from 'node:fs';\nimport { Resend } from 'resend';\n\nassert.ok(process.env.VOLTER_WORLD, 'run this script through the World');\nconst { id } = JSON.parse(readFileSync('last-email.json', 'utf8'));\nconst resend = new Resend(process.env.RESEND_API_KEY);\nconst saved = await resend.emails.get(id);\nassert.equal(saved.error, null);\nassert.equal(saved.data.last_event, 'delivered');\nconst response = await fetch(`${process.env.RESEND_TWIN_URL}/_twin/mail?to=owner%40world.test`);\nassert.equal(response.status, 200);\nconst inbox = await response.json();\nconst email = inbox.mail.find((message) => message.id === id);\nassert.ok(email, 'the delivered message must be in the local inbox');\nassert.equal(email.subject, 'Your local sign-in code');\nassert.match(email.text, /123456/);\nassert.match(email.html, /<strong>123456<\\/strong>/);\nconsole.log('local inbox contains the delivered email and sign-in code');\n",
+    "inspect-email.mjs": "import assert from 'node:assert/strict';\nimport { readFileSync } from 'node:fs';\nimport { Resend } from 'resend';\n\nassert.ok(process.env.VOLTER_WORLD, 'run this script through the World');\nconst { id } = JSON.parse(readFileSync('last-email.json', 'utf8'));\nconst resend = new Resend(process.env.RESEND_API_KEY);\nconst saved = await resend.emails.get(id);\nassert.equal(saved.error, null);\nassert.equal(saved.data.last_event, 'delivered');\nassert.equal(saved.data.subject, 'Your local sign-in code');\nassert.match(saved.data.text, /123456/);\nassert.match(saved.data.html, /<strong>123456<\\/strong>/);\nconsole.log('the retained email reads back with its sign-in code');\n",
     "send-email.mjs": "import assert from 'node:assert/strict';\nimport { writeFileSync } from 'node:fs';\nimport { Resend } from 'resend';\n\nassert.ok(process.env.VOLTER_WORLD, 'run this script through the World');\nconst resend = new Resend(process.env.RESEND_API_KEY);\nconst email = {\n  from: 'Example app <onboarding@resend.dev>',\n  to: ['owner@world.test'],\n  subject: 'Your local sign-in code',\n  text: 'Your synthetic sign-in code is 123456.',\n  html: '<p>Your synthetic sign-in code is <strong>123456</strong>.</p>'\n};\nconst sent = await resend.emails.send(email);\nassert.equal(sent.error, null);\nassert.ok(sent.data.id);\nconst saved = await resend.emails.get(sent.data.id);\nassert.equal(saved.error, null);\nassert.equal(saved.data.id, sent.data.id);\nassert.equal(saved.data.subject, email.subject);\nassert.equal(saved.data.text, email.text);\nassert.deepEqual(saved.data.to, email.to);\nwriteFileSync('last-email.json', JSON.stringify({ id: sent.data.id }) + '\\n');\nconsole.log('email sent and read back locally');\n"
   },
   "run": [

package/src/conformance.ts

@@ -72,9 +72,7 @@ async function credentialFields(server: Served, door: NonNullable<PackDescriptor
 }
 
 /** The files conformance reads from a unit: its manifest, its spec's record, its vendor's life and its decision table
- *  (a lane's journeys are its own `journeys/` or else its vendor's). A release publishes each (published()), and a
- *  pack's standing counts it in the form only when every unit holds them (twin-world's scripts/pack-standing.ts, by
- *  unitFilesMissing): the one list of both. */
+ *  (a lane's journeys are its own `journeys/` or else its vendor's). A release publishes each (published()). */
 export const UNIT_FILES = ['src/manifest.ts', 'spec/SOURCE.md', 'journeys/customer-life.json', 'journeys/decisions.json'] as const;
 
 /** The published package must carry every conformance input its units hold, including lanes. */
@@ -89,8 +87,6 @@ export function unpublishedUnitFiles(unit: string): string[] {
   }).map((f) => `${f} is absent from package.json files (conformance reads it)`);
 }
 
-/** Each of UNIT_FILES a unit lacks where conformance reads it: the manifest of every unit, the life at its vendor's root
- *  (lifeServed), the spec's record and the decision table of a unit with a spec (decided()). */
 const trackedJourneySources = new Map<string, string[]>();
 /** Table ownership follows one index snapshot per checkout/run. */
 function hasJourneySource(unit: string): boolean {
@@ -123,17 +119,6 @@ function hasJourneySource(unit: string): boolean {
   return source.some(path => path.startsWith(prefix));
 }
 
-export function unitFilesMissing(unit: string): string[] {
-  const vendor = existsSync(join(unit, 'package.json')) ? unit : dirname(unit);
-  const spec = hasOwnSurface(unit);
-  const at: Record<(typeof UNIT_FILES)[number], string | undefined> = {
-    'src/manifest.ts': unit,
-    'spec/SOURCE.md': spec ? unit : undefined,
-    'journeys/customer-life.json': vendor,
-    'journeys/decisions.json': spec ? (hasJourneySource(unit) ? unit : vendor) : undefined,
-  };
-  return UNIT_FILES.filter((f) => at[f] !== undefined && !existsSync(join(at[f]!, f))).map((f) => `${relative(unit, join(at[f]!, f))} is missing (conformance reads it)`);
-}
 /** A unit's fetch export: a pack's `create<Vendor>Fetch`, a lane's `create<Lane>LaneFetch`. */
 const fetchName = (dir: string): string => (existsSync(join(dir, 'package.json')) ? `create${pascal(basename(dir))}Fetch` : `create${pascal(basename(dir))}LaneFetch`);
 const manifestOf = async (unit: string): Promise<Manifest> => ((await import(join(unit, 'src', 'manifest.ts'))) as { manifest: Manifest }).manifest;
@@ -259,7 +244,7 @@ async function cited(pack: string): Promise<string[]> {
     const record = (readJson(join(unit, 'spec', 'sources.json')) ?? {}) as Record<string, SourceRecord>;
     for (const [url, quotes] of await citations(unit)) {
       const r = record[url];
-      if (!r) { out.push(`${nameOf(pack, unit)}: ${url} is cited and not recorded (bun <twin-world>/scripts/check-sources.ts ${nameOf(pack, unit)})`); continue; }
+      if (!r) { out.push(`${nameOf(pack, unit)}: ${url} is cited and not recorded (twin-standard check-sources ${nameOf(pack, unit)})`); continue; }
       if (!sourceHeld(url, r)) out.push(`${nameOf(pack, unit)}: ${url} did not answer with verified evidence when checked`);
       for (const q of quotes) if (r.quotes?.[q] !== true) out.push(`${nameOf(pack, unit)}: "${q.slice(0, 80)}" is not on ${url}`);
     }
@@ -747,8 +732,8 @@ async function clientCases(pack: string, scratch: string, consumer?: ConsumerRes
       Object.assign(issued, (await credentialFields(server, door, host)).outputs);
     }
     const job = join(scratch, 'client-job.json');
-    // a release carries its facts (generated/pack-facts.json, `twin-standard facts`); a source checkout does not, so its
-    // facts are compiled here, as that command compiles them, for the client the case runs
+    // a pack carries its facts (generated/pack-facts.json, `twin-standard facts`), in source and release alike; one that
+    // has none yet has them compiled here, as that command compiles them, for the client the case runs
     let packFacts = join(pack, 'generated', 'pack-facts.json');
     if (!existsSync(packFacts)) {
       const { compilePackFacts, renderPackFacts } = await import('./pack-facts.ts');

package/src/create-pack.ts

@@ -2,8 +2,9 @@
 // create-pack — the files of a Protocol 3 pack that nobody should write (the board's `create-pack` card;
 // docs/contributing/architecture.md, "Creating a pack"), and the brief an author writes the rest from.
 //
-//   bun scripts/create-pack.ts <dir> --init <vendor>     write every fixed file of a new pack that does not exist yet
-//   bun scripts/create-pack.ts <dir> --init <vendor> --lanes a,b
+//   twin-standard create <dir> --init <vendor> --package <@scope/name>
+//                                                        write every fixed file of a new pack that does not exist yet
+//   twin-standard create <dir> --init <vendor> --package <@scope/name> --lanes a,b
 //                                                        the same for a pack of lanes, one per API of the vendor, each
 //                                                        derived from its own spec (<dir>/<lane>/spec): each lane's
 //                                                        manifest, fetch, index and semantics, and the pack's server
@@ -12,11 +13,11 @@
 //                                                          index}.ts, src/semantics/{states,shared,doors}.ts,
 //                                                          journeys/{demand,first-use}.json): the author fills the manifest's
 //                                                          vendor facts, the descriptor's hosts and the families
-//   bun scripts/create-pack.ts <unit> --index            write src/semantics/index.ts, the handler map, and src/fetch.ts from the
+//   twin-standard create <unit> --index              write src/semantics/index.ts, the handler map, and src/fetch.ts from the
 //                                                          families' files (every exported function, by its name)
-//   bun scripts/create-pack.ts <unit> --index --building the same during construction; unfinished operations stay gaps,
+//   twin-standard create <unit> --index --building   the same during construction; unfinished operations stay gaps,
 //                                                          and implemented operations must match their decisions
-//   bun scripts/create-pack.ts <unit> --brief [--out f]  the author's brief: every operation the derived core does not
+//   twin-standard create <unit> --brief [--out f]    the author's brief: every operation the derived core does not
 //                                                          serve and no handler answers yet, by family, with what the
 //                                                          vendored spec says of it (summary, description, parameters,
 //                                                          the answers it documents and their examples), so a handler
@@ -69,7 +70,7 @@ export function handlerIndex(dir: string): string {
   const ids = existsSync(surfacePath) ? ((parseExactJson(readFileSync(surfacePath, 'utf8')) as { operations?: Array<{ id: string }> }).operations ?? []).map((o) => o.id) : [];
   // an index written before the derive has no operations to map, and every served call would fall to the gap (404): refuse
   // it rather than write an empty map (2026-09-30: six packs committed so)
-  if (!existsSync(surfacePath) && fams.length) throw new Error(`${dir}: no src/generated/surface.gen.json yet; derive the unit (scripts/derive-pack.ts) before --index`);
+  if (!existsSync(surfacePath) && fams.length) throw new Error(`${dir}: no src/generated/surface.gen.json yet; derive the unit (twin-standard derive) before --index`);
   const where = new Map(fams.flatMap((f) => f.handlers.map((h) => [h, f.family] as const)));
   const named = new Set([...new Set(ids)].map(handlerName));
   const stray = [...where.keys()].filter((h) => !named.has(h));
@@ -269,7 +270,7 @@ export async function brief(unit: string): Promise<string> {
       const s = spec.get(o.id);
       lines.push(`### ${o.id}${unmodeled.has(o.id) ? ' (unmodeled)' : ''}`, '', `\`${o.method.toUpperCase()} ${o.path}\` — ${o.class}${s?.summary ? `: ${oneLine(s.summary)}` : ''}`);
       // the citation a handler carries, ready to paste: by operationId where the spec names one, else by its JSON pointer,
-      // quoting the spec's own words (derive-pack refuses a quote the spec does not hold)
+      // quoting the spec's own words (the derivation refuses a quote the spec does not hold)
       const words = oneLine(s?.summary ?? s?.description ?? '').split(/(?<=\.)\s/)[0]!.replace(/"/g, '\\"');
       const cite = s && (s as { operationId?: string }).operationId === o.id ? `spec:${o.id}` : `spec:/paths/${o.path.replace(/~/g, '~0').replace(/\//g, '~1')}/${o.method.toLowerCase()}`;
       if (words) lines.push('', `Cite: \`// source: ${cite} "${words}"\``);
@@ -331,7 +332,7 @@ export function packIndexFile(dir: string, vendor: string): string {
 
 /** A pack's `src/server.ts` (a fixed file), the kernel's serve seam around its fetch, naming only what its unit has so
  *  it typechecks and a bundler follows every import: the plain seam (serveHttp, which takes the sockets a fetch carries
- *  itself: "Other wires"), or, for a unit whose spec is a proto, the gRPC seam over the schema derive-pack generated
+ *  itself: "Other wires"), or, for a unit whose spec is a proto, the gRPC seam over the schema the derivation generated
  *  (src/generated/proto.gen.json, imported by its literal path). `--init` writes the plain one, `--index` the gRPC one once
  *  the unit's proto is derived. */
 export function serverFile(vendor: string, grpc: boolean, wire = false, live = false): string {
@@ -436,7 +437,7 @@ export function initFiles(vendor: string): Record<string, string> {
     'src/semantics/states.ts': `// ${vendor}'s state machines and state rulings, each transition cited (architecture, "State").\nexport const states = {};\n`,
     'src/semantics/shared.ts': `// What every family of ${vendor} shares: its stored shapes, who is calling, and the vendor's answers.\nimport type { HandlerContext } from '@volter/world-core';\n\nexport type Row = Record<string, unknown>;\nexport type { HandlerContext };\n`,
     'src/semantics/doors.ts': `// The World's doors (architecture, "Doors, screens and the gap"): what the vendor's own pages do that its API does\n// not, each declared in the manifest's \`doors\` (its id, method and path under \`/_twin/\`) and answered here by the\n// export its id names, over the contract's context.\nimport type { HandlerContext } from '@volter/world-core';\n\nexport type { HandlerContext };\n`,
-    'src/manifest.ts': `// ${vendor}'s manifest: the vendor facts its spec does not carry (architecture, "Protocol 3"). The surface is generated\n// (./generated/surface.gen.json, from ../spec by derive-pack). Every line marked FILL is a vendor fact to state from\n// the vendor's pages, cited.\nimport type { DerivedManifest } from '@volter/world-core';\n\nexport const manifest: DerivedManifest = {\n  vendor: '${vendor}',\n  service: '${vendor}',\n  body: { json: 'always' },\n  ids: { template: '{uuid}' }, // FILL: the vendor's id form\n  time: 'iso', // FILL: iso, unix or unix-ms\n  error: { error: { message: '{message}', code: '{code}' } }, // FILL: the vendor's error body\n  readOnly: { status: 403, message: 'This twin was started read-only; writes are refused.' }, // FILL: the vendor's refusal\n  notFound: { status: 404, message: 'Not found' }, // FILL: the vendor's not-found\n  list: { style: 'envelope', envelope: { data: '{data}' }, limit: { param: 'limit', default: 20, max: 100 } }, // FILL: its paging\n  deleted: {},\n  resources: {}, // FILL: the resources the core serves (plain create, read, update, delete, list)\n  discovery: { twinOf: 'FILL: what the twin is of', stores: 'FILL: what it keeps' },\n  // the descriptor, as data (twin-world's architecture, "The descriptor"): the pack registers packOf(manifest)\n  descriptor: {\n    protocol: '3',\n    transport: 'rest',\n    archetype: 'crud',\n    bin: 'world-${vendor}',\n    resources: [], // FILL: the stored types\n    specSource: 'FILL: the vendored spec (spec/SOURCE.md)',\n    description: 'FILL: one line',\n    adoption: { sdks: [], envStems: [] }, // FILL: its npm clients, and each credential variable's stem (TRIPO for TRIPO_API_KEY: the suffix removed)\n    hosts: [], // FILL: the vendor's hosts\n    endpointEnvNone: 'FILL: the SDK\\'s base-URL variable (endpointEnv) or why none',\n  },\n};\n`,
+    'src/manifest.ts': `// ${vendor}'s manifest: the vendor facts its spec does not carry (architecture, "Protocol 3"). The surface is generated\n// (./generated/surface.gen.json, from ../spec by twin-standard derive). Every line marked FILL is a vendor fact to state from\n// the vendor's pages, cited.\nimport type { DerivedManifest } from '@volter/world-core';\n\nexport const manifest: DerivedManifest = {\n  vendor: '${vendor}',\n  service: '${vendor}',\n  body: { json: 'always' },\n  ids: { template: '{uuid}' }, // FILL: the vendor's id form\n  time: 'iso', // FILL: iso, unix or unix-ms\n  error: { error: { message: '{message}', code: '{code}' } }, // FILL: the vendor's error body\n  readOnly: { status: 403, message: 'This twin was started read-only; writes are refused.' }, // FILL: the vendor's refusal\n  notFound: { status: 404, message: 'Not found' }, // FILL: the vendor's not-found\n  list: { style: 'envelope', envelope: { data: '{data}' }, limit: { param: 'limit', default: 20, max: 100 } }, // FILL: its paging\n  deleted: {},\n  resources: {}, // FILL: the resources the core serves (plain create, read, update, delete, list)\n  discovery: { twinOf: 'FILL: what the twin is of', stores: 'FILL: what it keeps' },\n  // the descriptor, as data (twin-world's architecture, "The descriptor"): the pack registers packOf(manifest)\n  descriptor: {\n    protocol: '3',\n    transport: 'rest',\n    archetype: 'crud',\n    bin: 'world-${vendor}',\n    resources: [], // FILL: the stored types\n    specSource: 'FILL: the vendored spec (spec/SOURCE.md)',\n    description: 'FILL: one line',\n    adoption: { sdks: [], envStems: [] }, // FILL: its npm clients, and each credential variable's stem (TRIPO for TRIPO_API_KEY: the suffix removed)\n    hosts: [], // FILL: the vendor's hosts\n    endpointEnvNone: 'FILL: the SDK\\'s base-URL variable (endpointEnv) or why none',\n  },\n};\n`,
     'src/server.ts': serverFile(vendor, false),
     'src/cli.ts': cliFile(vendor),
     'src/index.ts': `// @volter/twin-${vendor} — the ${vendor} twin (Protocol 3). A fixed file: the descriptor is the manifest's.\nimport { packOf, registerPack } from '@volter/world-core';\nimport { manifest } from './manifest.ts';\n\nexport { create${Name}Fetch } from './fetch.ts';\nexport { create${Name}TwinServer } from './server.ts';\nexport { manifest };\n\n// The descriptor: twin-world's architecture, "The descriptor"; declared in manifest.ts.\nexport const pack = registerPack(packOf(manifest));\n`,
@@ -515,7 +516,7 @@ export async function fixedFiles(dir: string): Promise<Record<string, string>> {
   if (!vendor || !/^[a-z][a-z0-9-]*$/.test(vendor)) throw new Error('Pack manifest must declare its vendor identity independently of the npm package name');
   files['src/index.ts'] = packIndexFile(dir, vendor);
   if (!existsSync(join(dir, 'src', 'stream.ts'))) {
-    // a unit whose spec is a proto (derive-pack generated its schema) is served over gRPC: its serve seam in that form
+    // a unit whose spec is a proto (the derivation generated its schema) is served over gRPC: its serve seam in that form
     const lanesOnly = !hasOwnSurface(dir) && readdirSync(dir).some((n) => existsSync(join(dir, n, 'src', 'manifest.ts')));
     const grpc = !lanesOnly && existsSync(join(dir, 'src', 'generated', 'proto.gen.json'));
     // a unit that takes broadcasts over RTMP (its manifest's `live`) has the live forms --index writes, so they reproduce
@@ -529,7 +530,7 @@ export async function fixedFiles(dir: string): Promise<Record<string, string>> {
 export async function createPack(args: string[]): Promise<void> {
   const [unit, ...rest] = args;
   if (!unit || (!rest.includes('--index') && !rest.includes('--brief') && !rest.includes('--init'))) {
-    console.error('usage: bun scripts/create-pack.ts <dir> --init <vendor> | <unit> --index [--building] | --brief [--out <file>]');
+    console.error('usage: twin-standard create <dir> --init <vendor> --package <@scope/name> | <unit> --index [--building] | --brief [--out <file>]');
     process.exit(2);
   }
   if (rest.includes('--building') && (!rest.includes('--index') || rest.includes('--init') || rest.includes('--brief'))) {
@@ -598,7 +599,7 @@ export async function createPack(args: string[]): Promise<void> {
       console.log(`create-pack: wrote ${join(dir, 'src', 'index.ts')}`);
       // what the grade's typecheck compiles: a pack made before init wrote it gets it here
       if (!existsSync(join(dir, 'tsconfig.json'))) { writeFileSync(join(dir, 'tsconfig.json'), TSCONFIG); console.log(`create-pack: wrote ${join(dir, 'tsconfig.json')}`); }
-      // a unit whose spec is a proto (derive-pack generated its schema) is served over gRPC: its serve seam in that form,
+      // a unit whose spec is a proto (the derivation generated its schema) is served over gRPC: its serve seam in that form,
       // the one form a unit takes after --init (a server.ts of a wire of the pack's own, SMTP's, is never written over)
       if (!lanesOnly && existsSync(join(dir, 'src', 'generated', 'proto.gen.json'))) {
         const wire = existsSync(join(dir, 'src', 'stream.ts'));

package/src/derive.ts

@@ -5,7 +5,7 @@ import { parseExactJson, exactInteger } from '@volter/world-core/exact-json';
 // vendored spec (`<pack>/spec/openapi.json[.gz]`), builds the spec IR (./spec-ir.ts) and writes the pack's
 // `src/generated/`. Deterministic: a second run over the same spec writes the same bytes. Never hand-edit what it writes.
 //
-// Usage: twin-standard derive <pack dir> [--out <dir>]   (twin-world: bun scripts/derive-pack.ts <vendor>)
+// Usage: twin-standard derive <pack dir> [--out <dir>]
 
 import { parse as parseYaml } from 'yaml';
 import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
@@ -41,7 +41,7 @@ const PKG = unitAt(vendor).dir;
 const rfc = existsSync(join(PKG, 'spec')) ? readdirSync(join(PKG, 'spec')).find((f) => /^rfc\d+\.txt$/.test(f)) : undefined;
 const specPath = ['openapi.json.gz', 'openapi.json', 'openapi.yaml.gz', 'openapi.yaml', 'smithy.json.gz', 'smithy.json', 'discovery.json.gz', 'discovery.json', ...(rfc ? [rfc] : []), 'openapi', 'proto', 'commands', 'command-builders.json', 'client-ops.json'].map((f) => join(PKG, 'spec', f)).find((p) => existsSync(p));
 if (!specPath) {
-  console.error(`derive-pack: no spec at ${join(PKG, 'spec')}/openapi.{json,yaml}[.gz], smithy.json[.gz], rfcNNNN.txt, proto/, commands/, command-builders.json or client-ops.json`);
+  console.error(`derive: no spec at ${join(PKG, 'spec')}/openapi.{json,yaml}[.gz], smithy.json[.gz], rfcNNNN.txt, proto/, commands/, command-builders.json or client-ops.json`);
   process.exit(SOURCE_REFUSAL);
 }
 const rpcService = basename(specPath) === 'proto';
@@ -308,7 +308,7 @@ if (existsSync(manifestPath)) {
   }
   // a resource's refresh scope ("The real-system adapters", What a pack declares) names the list that enumerates it or
   // its retrieve, or says why the vendor offers no read-back; whether every stored resource declares one is
-  // pack-standing's report, not this build's
+  // not this build's to decide
   // (a resource the spec names is read by its own list or retrieve; one the manifest names apart from the spec's, an RPC
   // vendor's, by the list or read the scope names, with `items` where the answer holds them when the spec does not say)
   const specNamed = new Set(ir.resources.map((r) => r.name));

package/src/index.ts

@@ -4,7 +4,7 @@
 // of a submission — judges by the same standard at the version it pins. Changing a criterion is a release of this
 // package: a criterion's id never changes meaning, a changed criterion takes a new id and a new standard version.
 export { grade, STANDARDS, type CriterionGrade, type GradeOptions, type StandardGrade } from './grade.ts';
-export { conformance, decisionTableProblems, type ConformanceResult, UNIT_FILES, unitFilesMissing } from './conformance.ts';
+export { conformance, decisionTableProblems, type ConformanceResult, UNIT_FILES } from './conformance.ts';
 export { laneRootFailures, p3Gate, unitsOf } from './gate.ts';
 export { conformPublished, gatePublished, vendorOfPackage, type PublishedGate } from './published.ts';
 export { handlerName, protocol3, PLANNED, withCheckoutFiles } from './protocol-3.ts';

package/src/pack-facts.ts

@@ -8,7 +8,7 @@ export type PackFacts = {
   serverBacking?: { command: string };
   maxRequestBodySize?: number;
   adoption?: { sdks?: string[]; pypi?: string[]; scopes?: string[]; envStems?: string[]; worldIds?: string[]; tools?: Array<{ package: string; usage: 'build' | 'deployment' }>; configFiles?: Array<{ file: string; usage: 'application' | 'build' | 'deployment'; when?: string }> };
-  hosts?: Array<{ host?: string; suffix?: string; hostPattern?: string; pathPattern?: string; demandPathPattern?: string | false; key?: string; exclude?: true }>;
+  hosts?: Array<{ host?: string; suffix?: string; hostPattern?: string; pathPattern?: string; demandPathPattern?: string | false; key?: string; exclude?: true; basic?: string }>;
   hostsNone?: string;
   hostsClaimed?: { door: string; note: string };
   /** The subject types the twin projects (packRegistry `resources`) — invariant R2 at the resource
@@ -42,6 +42,8 @@ export type PackFacts = {
   managedDatabase?: { kind: 'postgres'; arg: string; user: string; database: string; clock: 'wall'; credentialField: string; note: string };
   /** Listeners the twin opens beside its main port (see TwinPack.sidePorts). */
   sidePorts?: Array<{ name: string; option: string; flag: string; path?: string; scheme?: string; note: string }>;
+  /** The vendor's own requests a World's generated seed makes (see TwinPack.seed). */
+  seed?: TwinPack['seed'];
   /** DERIVED, never declared: the pack's `create<Name>TwinServer` factory export — the
    *  `({port,root,readOnly}) => {port,stop}` contract the colocated host mounts
    *  (world-runtime/src/host.ts). Read off the module's own exports because the name is not
@@ -78,6 +80,7 @@ function validateHostRules(vendor: string, rules: NonNullable<PackFacts['hosts']
       try { new RegExp(rule.demandPathPattern); } catch (e) { throw new Error(`pack-facts: ${vendor} demandPathPattern does not compile: ${(e as Error).message}`); }
     }
     if (rule.exclude !== undefined && rule.exclude !== true) throw new Error(`pack-facts: ${vendor} host rule ${JSON.stringify(rule)} — exclude is \`true\` or absent, never a falsy flag`);
+    if (rule.basic !== undefined && (typeof rule.basic !== 'string' || !/^[^:\s]+$/.test(rule.basic) || rule.exclude)) throw new Error(`pack-facts: ${vendor} host rule ${JSON.stringify(rule)} — basic names a user (no colon, no space) on an included host`);
     const key = rule.key ?? vendor;
     // A foreign key is a WORLD identity too: `volter-world init` emits <KEY>_TWIN_URL only for the
     // ids in adoption.worldIds (covers.ts injectorVendorKeysFor), so a key not listed there would
@@ -221,6 +224,26 @@ export async function compilePackFacts(dirs: Array<{ vendor: string; dir: string
       }
       facts.sidePorts = pack.sidePorts;
     }
+    if (pack.seed !== undefined) {
+      // ADR 0033 §3: one door per kind of fact, each the vendor's own request at its own host; only a domain's DNS record
+      // is a `/_twin/` stand-in
+      const seed = pack.seed as Record<string, unknown>;
+      const door = (value: unknown, what: string, standIn = false): void => {
+        let url: URL;
+        try { url = new URL(String(value)); } catch { throw new Error(`pack-facts: ${vendor} seed ${what} "${String(value)}" is not a URL`); }
+        if (url.protocol !== 'https:') throw new Error(`pack-facts: ${vendor} seed ${what} is the vendor's own https request`);
+        if (!standIn && url.pathname.startsWith('/_twin/')) throw new Error(`pack-facts: ${vendor} seed ${what} is the vendor's own request, never a /_twin/ door`);
+      };
+      if (!seed || typeof seed !== 'object' || Array.isArray(seed) || Object.keys(seed).some((k) => k !== 'signUp' && k !== 'domain')) throw new Error(`pack-facts: ${vendor} seed is { signUp?, domain? }`);
+      if (seed.signUp !== undefined) door(seed.signUp, 'signUp');
+      if (seed.domain !== undefined) {
+        const domain = seed.domain as Record<string, unknown>;
+        if (!domain || typeof domain !== 'object' || Array.isArray(domain) || Object.keys(domain).sort().join() !== 'add,record,settles,verify') throw new Error(`pack-facts: ${vendor} seed.domain is { add, record, verify, settles }`);
+        door(domain.add, 'domain.add'); door(domain.verify, 'domain.verify'); door(domain.record, 'domain.record', true);
+        if (typeof domain.settles !== 'string' || !/^\d+[smhd]$/.test(domain.settles)) throw new Error(`pack-facts: ${vendor} seed.domain.settles is a World-clock time (10m)`);
+      }
+      facts.seed = pack.seed;
+    }
     // The serve factory is DERIVED from the module's exports (see PackFacts.serveExport);
     // a pack exporting SEVERAL factories must declare which one `cli.ts serve` boots — the
     // exports alone cannot reveal that judgment (linear defaults to its DERIVED server).
@@ -240,7 +263,7 @@ export async function compilePackFacts(dirs: Array<{ vendor: string; dir: string
     if (Object.keys(facts).length > 0) packs[vendor] = facts;
   }
   return {
-    '//': 'GENERATED by scripts/pack-facts.ts — current pack descriptors and explicit world-runtime server backings; no prior-artifact entries are retained.',
+    '//': 'GENERATED by twin-standard facts from the pack descriptor; no prior-artifact entries are retained.',
     packs: sortObject(packs),
     undeclared,
   };

package/src/protocol-3.ts

@@ -171,7 +171,7 @@ function noReport(unit: GradeUnit): string {
 /** An operation's family: the first segment of its path after a version (`/v1/organizations/{id}` is `organizations`), a
  *  dotted RPC method's first part (`chat.postMessage` is `chat`), a line command's name (architecture, "Pack layout"). */
 function familyOf(path: string): string {
-  // the interim rule ("What an author writes"), until derive-pack writes the spec's own grouping on each operation
+  // the interim rule ("What an author writes"), until the derivation writes the spec's own grouping on each operation
   const segs = path.split('/').filter((x) => x && !/^v?\d+(\.\d+)?$|^\d{4}-\d{2}-\d{2}$/.test(x) && !x.startsWith('{'));
   if (!segs.length) return 'operations'; // named in a header: every path is `/`
   const first = segs[0]!;
@@ -262,7 +262,7 @@ const criteria: Criterion[] = [
   },
   {
     id: 'derived-reproducible', section: 'form',
-    asks: 'derive-pack regenerates src/generated/ byte for byte',
+    asks: 'twin-standard derive regenerates src/generated/ byte for byte',
     check(unit) {
       const gen = join(unit.dir, 'src', 'generated');
       if (!existsSync(gen)) return fail('src/generated/ is missing');
@@ -279,9 +279,9 @@ const criteria: Criterion[] = [
       // the pack's own path and the scratch directory are this checkout's, not the pack's: the verdict names neither, so
       // a standing written from one checkout reads the same from any other
       if (run.status === null || run.signal !== null || run.error) return { pass: false, cacheable: false,
-        reason: `derive-pack interrupted: status=${run.status} signal=${run.signal} error=${run.error?.message ?? ''}` };
-      if (run.status !== 0) return { ...fail(`derive-pack refused: ${String(run.stderr || run.stdout).split(unit.dir).join('.').split(tmp).join('<out>').trim().split('\n').slice(-2).join(' ').slice(0, 200)}`), cacheable: run.status === 2 };
-      return changed.length ? fail(`derive-pack writes differently: ${changed.slice(0, 5).join(', ')}${changed.length > 5 ? ` and ${changed.length - 5} more` : ''}`) : pass(`${filesUnder(gen).length} files reproduced`);
+        reason: `derive interrupted: status=${run.status} signal=${run.signal} error=${run.error?.message ?? ''}` };
+      if (run.status !== 0) return { ...fail(`derive refused: ${String(run.stderr || run.stdout).split(unit.dir).join('.').split(tmp).join('<out>').trim().split('\n').slice(-2).join(' ').slice(0, 200)}`), cacheable: run.status === 2 };
+      return changed.length ? fail(`derive writes differently: ${changed.slice(0, 5).join(', ')}${changed.length > 5 ? ` and ${changed.length - 5} more` : ''}`) : pass(`${filesUnder(gen).length} files reproduced`);
     },
   },
   {

package/src/spec-ir-client.ts

@@ -6,7 +6,7 @@
 // `spec/`, Creating a pack, step 2): its method, its URL as the client
 // builds it (a label is the Python expression the client interpolates), the query keys it sends (literal, or the keys
 // of the dict it urlencodes) and its body's keys, each typed by the client's own annotation of the value (`null`
-// where the client does not say). A spec patch corrects the table as it corrects a JSON spec (derive-pack): what the
+// where the client does not say). A spec patch corrects the table as it corrects a JSON spec (twin-standard derive): what the
 // client builds as a raw string (a token's scopes) comes from the vendor's reference page that way.
 //
 // The calls at one method and path are one operation, their query and body keys together. The client says nothing

package/src/spec-ir-commands.ts

@@ -3,7 +3,7 @@
 // its group, the version it arrived in, its arity, its arguments, its flags and its reply's schema); a pack whose wire
 // carries Redis commands (Upstash's REST API: a command and its arguments in the path or the body) vendors the files of
 // the commands its vendor serves and derives its command surface from them, as a line protocol's surface is its RFC's
-// command table (spec-ir-lines.ts). A spec patch corrects the data as it corrects a JSON spec (derive-pack).
+// command table (spec-ir-lines.ts). A spec patch corrects the data as it corrects a JSON spec (twin-standard derive).
 
 export type CommandArgument = { name: string; type: string; optional?: boolean; multiple?: boolean; token?: string; arguments?: CommandArgument[] };
 /** A command: `id` as a client names it (`SET`, `CLIENT GETNAME` for a container's subcommand); `arity` as Redis gives

package/src/spec-ir-lines.ts

@@ -1,6 +1,6 @@
 // A line protocol's spec as data: the commands a client sends and the replies each may be answered,
 // read from the RFC's own table of them. The IR a byte-stream pack derives its surface from, as an HTTP
-// pack derives its from an OpenAPI document; a spec patch corrects it the same way (derive-pack).
+// pack derives its from an OpenAPI document; a spec patch corrects it the same way (twin-standard derive).
 //
 // SMTP's table is RFC 5321 §4.3.2 "Command-Reply Sequences": each command, then its intermediate (I),
 // success (S) and error (E) codes, where `I: 354 -> data -> S: 250` says what answers the lines that

package/src/spec-ir-proto.ts

@@ -161,7 +161,7 @@ export function parseProto(path: string, text: string): ProtoFile {
   return file;
 }
 
-/** The vendored tree (path → text) as data, so a spec patch corrects it as it corrects a JSON spec (derive-pack). */
+/** The vendored tree (path → text) as data, so a spec patch corrects it as it corrects a JSON spec (twin-standard derive). */
 export type ProtoSpec = { format: 'proto'; files: ProtoFile[] };
 export function readProtoFiles(files: Record<string, string>): ProtoSpec {
   return { format: 'proto', files: Object.entries(files).sort(([a], [b]) => a.localeCompare(b)).map(([path, text]) => parseProto(path, text)) };

package/src/spec-patches.ts

@@ -1,6 +1,6 @@
 // A pack's corrections to its vendor's spec (spec/patches.json): RFC 6902 operations (add, replace, remove, move, copy),
-// applied to the parsed spec so the vendored file stays the vendor's own bytes. derive-pack.ts applies them before the
-// IR; vendor-examples.ts reads the patched schemas, which are what the twin is derived from.
+// applied to the parsed spec so the vendored file stays the vendor's own bytes. the derivation applies them before the
+// IR; `twin-standard examples` reads the patched schemas, which are what the twin is derived from.
 
 export type SpecPatch = { op: string; path: string; from?: string; value?: unknown };
 

package/src/tools/judge-brief.ts

@@ -3,8 +3,7 @@
 // runtime). The verdict names its judge and the authors; the grade refuses one whose judge is an author
 // (packages/twin-standard/src/verdict.ts). One judging per pack: the verdict stands through later changes.
 //
-//   twin-standard judge-brief <vendor> --authors <author name>[,<agent>...]   (from the pack repository's root; twin-world's
-//   bun scripts/judge-brief.ts runs the same)
+//   twin-standard judge-brief <vendor> --authors <author name>[,<agent>...]   (from the pack repository's root)
 import { attributionName } from '../verdict.ts';
 import { createHash } from 'node:crypto';
 import { existsSync, readFileSync } from 'node:fs';

package/src/tools/life-coverage.ts

@@ -24,8 +24,8 @@
 // A walk that fails, and a file in scope (the pack's src/ on disk, its sharing lanes' too) that declares code yet
 // measures no line, stop the measurement: neither is a file with nothing to reach.
 //
-// Usage: twin-standard coverage <vendor> [--write | --out <file>] [--prune]   (from the pack repository's root; twin-world's
-//        bun scripts/life-coverage.ts runs the same)   (--prune removes the stale records)   (--write keeps journeys/coverage.json)
+// Usage: twin-standard coverage <vendor> [--write | --out <file>] [--prune]   (from the pack repository's root)
+//        (--prune removes the stale records)   (--write keeps journeys/coverage.json)
 import { spawnSync } from 'node:child_process';
 import ts from 'typescript';
 import { existsSync, mkdtempSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';

package/src/tools/packs-root.ts

@@ -1,8 +1,8 @@
 // Where the contributor's tools (walk, examples, coverage, judge-brief) find the pack they are given: a vendor's directory
 // under the pack repository they run from. A contributor runs them from their own repository's root (`twin-standard walk
-// <vendor>`), so that root is the working directory; twin-world's scripts, which find Volter's pack repository beside
-// their checkout, name it before loading a tool (setPacksRoot), and the kernel checkout a walk must measure
-// (setKernelCheckout). Each tool reads both once, when it loads.
+// <vendor>`), so that root is the working directory; a tool that runs another in a process of its own (run-tool.ts)
+// names it before loading the tool (setPacksRoot), with the kernel checkout a walk must measure (setKernelCheckout).
+// Each tool reads both once, when it loads.
 import { join } from 'node:path';
 
 let packs = process.cwd();

package/src/tools/score-pack.ts

@@ -12,8 +12,7 @@
 // This is source-journey evidence, not installed readiness or pack completion. pack-done owns completion and consumes
 // this report alongside the exact artifact's installed customer assessment in the one final run.
 //
-// Usage: twin-standard walk <vendor> [--write] [--report <path>]   (from the pack repository's root; twin-world's
-//        bun scripts/score-pack.ts <vendor> runs the same)
+// Usage: twin-standard walk <vendor> [--write] [--report <path>]   (from the pack repository's root)
 //   --write keeps journeys/score.json and journeys/coverage.json; --report writes the report and what it lacks for done
 //   to <path> as JSON and changes nothing in the checkout
 

package/src/tools/vendor-examples.ts

@@ -35,8 +35,7 @@
 // read for. `--sweep` prints, without changing done, every actor field (creator, user, *_by, ...) no `equals` pins and every
 // list no expect closes: advice for fixing a ruling as a class (its hits include lists a pinned text already fixes).
 //
-// Usage: twin-standard examples <vendor> [--sweep]   (from the pack repository's root; twin-world's
-//        bun scripts/vendor-examples.ts <vendor> runs the same)
+// Usage: twin-standard examples <vendor> [--sweep]   (from the pack repository's root)
 import { parseExactJson, exactInteger, isExactIntegerValue } from '@volter/world-core/exact-json';
 import { hasOwnSurface } from '../lanes.ts';
 import { archiveSource } from '../archive-source.ts';
@@ -95,7 +94,7 @@ function answerKeys(output: unknown, published: unknown, sent: unknown, placehol
   return mapped(output);
 }
 
-/** The schemas the twin serves: the vendor's, with the pack's spec patches (spec/patches.json) applied as derive-pack
+/** The schemas the twin serves: the vendor's, with the pack's spec patches (spec/patches.json) applied as the derivation
  *  applies them. A sample is checked against what the twin is derived from; the published examples themselves stay the
  *  vendor's bytes. */
 function served<T extends object>(pkg: string, doc: T): T {
@@ -376,7 +375,7 @@ function fromSpec(pkg: string, lane: string | undefined, model: SmithyModel | un
     }
     return out;
   }
-  // a spec vendored as published or gzipped, as derive-pack reads it
+  // a spec vendored as published or gzipped, as the derivation reads it
   const spec = ['openapi.json.gz', 'openapi.json', 'openapi.yaml.gz', 'openapi.yaml', 'discovery.json.gz', 'discovery.json'].map((f) => join(pkg, 'spec', f)).find((p) => existsSync(p));
   // a Protocol Buffers service publishes no examples in its .proto files: its examples are its documentation's alone
   if (!spec && existsSync(join(pkg, 'spec', 'proto'))) return [];
@@ -390,7 +389,7 @@ function fromSpec(pkg: string, lane: string | undefined, model: SmithyModel | un
   const text = spec ? (spec.endsWith('.gz') ? gunzipSync(readFileSync(spec)) : readFileSync(spec)).toString('utf8') : '';
   type Op = { operationId?: string; responses?: Record<string, Record<string, unknown>>; 'x-oaiMeta'?: { examples?: unknown } };
   type Doc = { paths: Record<string, Record<string, Op>>; components?: { examples?: Record<string, { value?: unknown }>; schemas?: Record<string, SpecSchema> }; definitions?: Record<string, SpecSchema> };
-  // a Google API Discovery document publishes no examples; it is read as the OpenAPI document derive-pack reads it as,
+  // a Google API Discovery document publishes no examples; it is read as the OpenAPI document the derivation reads it as,
   // its patches applied to the Discovery document first (spec-ir-discovery.ts)
   const discovery = spec !== undefined && /discovery\.json(\.gz)?$/.test(spec);
   const docs = (documents ? Object.values(documents.documents) : [discovery ? discoveryToOpenAPI(parseExactJson(text)) : /\.yaml(\.gz)?$/.test(spec!) ? parseExactJson(JSON.stringify(parseYaml(text, { intAsBigInt: true }), (_key, value) => typeof value === 'bigint' ? exactInteger(String(value)) : value)) : parseExactJson(text)]) as Doc[];

package/src/verdict.ts

@@ -1,7 +1,7 @@
 // A JUDGE'S INDEPENDENCE (the grade's outline-judged and life-judged, the published examples' verdict): a verdict rules
 // only when it names its judge (`judge.agent`) and the authors of what it judges (`authors`), and the judge is none of
 // them. The dispatcher stamps author names consistently; a judge started independently
-// (scripts/judge-brief.ts prints its brief) names its reviewer role (`judge.name`). One judging per pack: the
+// (`twin-standard judge-brief` prints its brief) names its reviewer role (`judge.name`). One judging per pack: the
 // verdict stands, and later changes to what it judged keep it (architecture, "Writing a life", Judge).
 
 /** Committed attribution names people or author roles, never execution identities. */

package/src/walk/behavior-journey.ts

@@ -14,7 +14,7 @@ import { createRequire } from 'node:module';
 import { gzipSync } from 'node:zlib';
 import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { databaseSession, type DatabaseSession, getActivePackAssets, getActiveWorldStore, LocalPackAssets, MemoryBlobStore, MemoryWorldStore, setActiveBlobStore, setActivePackAssets, setActiveWorldStore, setDeliveryObserver, setInProcessTwins, settleEventDeliveries, worldDoorMatcher, worldNow, type InProcessTwin, type TwinStream, type TwinStreamConnection } from '@volter/world-core/runtime';
+import { databaseSession, type DatabaseSession, getActivePackAssets, getActiveWorldStore, LocalPackAssets, MemoryBlobStore, MemoryWorldStore, setActiveBlobStore, setActivePackAssets, setActiveWorldStore, setDeliveryObserver, setInProcessMailServers, setInProcessTwins, settleEventDeliveries, worldDoorMatcher, worldNow, type InProcessTwin, type TwinStream, type TwinStreamConnection } from '@volter/world-core/runtime';
 import { createHostTable, type HostFacts } from '@volter/world-core/host-routing';
 import packFactsDocument from '@volter/world-core/generated/pack-facts.json' with { type: 'json' };
 import { type Captured, type GitStep, type Journey, type JourneyStep, type LineStep, type SocketStep, type SqlStep, type RespStep, type MysqlStep, type MongoStep, isMongo, isMysql, isResp, at, captureAt, echoFailures, expandFills, expectFailures, fill, fillJson, formBody, isGit, isLine, isSql, isSocket, isWait, jwtAuthorization, oauth1Authorization, presignedPath, sigv4Headers, waitMs } from './journey-kit.ts';
@@ -237,6 +237,17 @@ export async function walk(journey: Journey, root: string, collect: Failure[], o
     if (!companion || !keys.length) { collect.push({ step: '(setup)', beat: 'ADAPTER', detail: vendor === journey.vendor ? `the life's own vendor ${vendor} is no companion of it` : !companion ? `no create<Name>Fetch adapter for the companion ${vendor}` : `the companion ${vendor} declares no host rules (pack facts) a call could reach it by` }); return {}; }
     companions.push({ vendor, keys, fetch: companion(root, { application }), databaseDoor: companion.managedDatabaseDoor });
   }
+  // a companion that receives mail (an SMTP side port: gmail's, gmail.com's MX) is the mail server ctx.mail reaches for
+  // the domains its host rules claim, on its byte-stream door in process over this walk's World, as a World reaches its
+  // listener: the life declares the provider of every address it mails
+  const mailServers: Array<{ vendor: string; receives: (domain: string) => boolean; stream: TwinStream }> = [];
+  for (const c of companions) {
+    const sides = (walkFacts[c.vendor.split('/')[0]!] as { sidePorts?: Array<{ scheme?: string }> } | undefined)?.sidePorts ?? [];
+    if (!sides.some((side) => side.scheme === 'smtp')) continue;
+    const stream = await vendorStream(packsDir(), c.vendor, dependenciesDir());
+    if (!stream) { collect.push({ step: '(setup)', beat: 'ADAPTER', detail: `the companion ${c.vendor} receives mail on an smtp side port and exports no create<Name>TwinStream` }); return {}; }
+    mailServers.push({ vendor: c.vendor, receives: (domain) => c.keys.some((key) => walkHosts[key]!(domain, '/')), stream: stream(root, { application }) });
+  }
   const eventFields = new Map<string, Set<string>>();
   for (const vendor of [journey.vendor, ...companions.map((companion) => companion.vendor)]) {
     const directory = directoryFor(vendor);
@@ -735,6 +746,7 @@ export async function walk(journey: Journey, root: string, collect: Failure[], o
     ...companions.flatMap((c) => c.keys.map((key) => [key, c.fetch] as const)),
     ...ownKeys.map((key) => [key, twin] as const),
   ]));
+  const previousMailServers = setInProcessMailServers(mailServers);
   try {
   for (const step of journey.steps) {
     await settleEventDeliveries(root);
@@ -938,6 +950,7 @@ export async function walk(journey: Journey, root: string, collect: Failure[], o
       } finally {
         setDeliveryObserver(previousObserver);
         setInProcessTwins(previousTwins);
+        setInProcessMailServers(previousMailServers);
         try {
           if (sqlSession) await sqlSession.then((session) => session.end(), () => {});
         } finally {