@volter/world-core 2.0.0 → 2.0.2

package/dist/world-clock.cjs

@@ -0,0 +1,40 @@
+'use strict';
+// THE WORLD CLOCK'S FORM — the one home of how a clock file reads (dependency-free, side-effect free), shared by the
+// twins' worldNow() (src/world-clock.ts, reading through the active WorldStore) and the injector, which gives an
+// application process the same time (inject.cjs, WORLD TIME).
+//
+// A clock file holds one line in one of two forms:
+//   · FROZEN:  `<ISO-8601 instant>` — every read answers exactly that instant (scripted time: lives, seeds, a story);
+//   · RUNNING: `<ISO-8601 instant> from <ISO-8601 wall instant>` — the World's time was <instant> when the machine's was
+//     <wall instant>, and runs on at the machine's pace from there: a World serving an application moves time this way
+//     (`volter-world clock <world> shift <N s|m|h|d>`), since a frozen instant would stop the application's time.
+// No file: the machine's time.
+
+/** The clock a file's text states, or throws on text that states neither form. */
+function parseClock(raw) {
+  const text = String(raw ?? '').trim();
+  const m = /^(\S+)\s+from\s+(\S+)$/.exec(text);
+  if (m) {
+    const at = Date.parse(m[1]);
+    const since = Date.parse(m[2]);
+    if (!Number.isNaN(at) && !Number.isNaN(since)) return { kind: 'running', at, since };
+  } else {
+    const at = Date.parse(text);
+    if (!Number.isNaN(at)) return { kind: 'frozen', at };
+  }
+  throw new Error(`world clock: expected an ISO-8601 instant, or "<instant> from <instant>", got ${JSON.stringify(text.slice(0, 60))}`);
+}
+
+/** The World's time in ms for a parsed clock, at the machine's time `wallMs`. */
+function clockNowMs(clock, wallMs) {
+  return clock.kind === 'running' ? clock.at + (wallMs - clock.since) : clock.at;
+}
+
+/** A clock's text: frozen at `atMs`, or running from `atMs` as of the machine's `sinceMs`. */
+function formatClock(clock) {
+  return clock.kind === 'running'
+    ? `${new Date(clock.at).toISOString()} from ${new Date(clock.since).toISOString()}`
+    : new Date(clock.at).toISOString();
+}
+
+module.exports = { parseClock, clockNowMs, formatClock };

package/dist/world-clock.d.cts

@@ -0,0 +1,4 @@
+export type WorldClock = { kind: 'frozen'; at: number } | { kind: 'running'; at: number; since: number };
+export function parseClock(raw: string | null | undefined): WorldClock;
+export function clockNowMs(clock: WorldClock, wallMs: number): number;
+export function formatClock(clock: WorldClock): string;

package/generated/pack-facts.json

@@ -714,6 +714,9 @@
       "hosts": [
         {
           "host": "api.cohere.com"
+        },
+        {
+          "host": "api.cohere.ai"
         }
       ],
       "archetype": "generative",
@@ -728,7 +731,7 @@
         "embed_job",
         "token"
       ],
-      "endpointEnvNone": "neither official SDK reads a base-URL env var: cohere-ai@8.1.0 takes the override as the `baseUrl`/`environment` CONSTRUCTOR option and reads only CO_API_KEY from the environment (auth/BearerAuthProvider.js), and @ai-sdk/cohere@4.0.35 takes `options.baseURL` and reads only COHERE_API_KEY. Interception is host-based on api.cohere.com; inventing a COHERE_BASE_URL nothing reads would make `covers` claim a world it does not cover.",
+      "endpointEnvNone": "neither official SDK reads a base-URL env var: cohere-ai@8.1.0 takes the override as the `baseUrl`/`environment` CONSTRUCTOR option and reads only CO_API_KEY from the environment (auth/BearerAuthProvider.js), and @ai-sdk/cohere@4.0.35 takes `options.baseURL` and reads only COHERE_API_KEY. Interception is host-based on api.cohere.com and api.cohere.ai; inventing a COHERE_BASE_URL nothing reads would make `covers` claim a world it does not cover.",
       "serveExport": "createCohereTwinServer"
     },
     "currencyapi": {
@@ -963,6 +966,10 @@
           "host": "discord.com",
           "pathPattern": "^/api/"
         },
+        {
+          "host": "discord.com",
+          "pathPattern": "^/(oauth2/authorize|login)/?$"
+        },
         {
           "host": "gateway.discord.gg"
         },
@@ -1399,6 +1406,10 @@
           "host": "github.com",
           "pathPattern": "^/login/oauth/(authorize|access_token)$"
         },
+        {
+          "host": "github.com",
+          "pathPattern": "^/(login|session|sessions/two-factor(/app)?)$"
+        },
         {
           "host": "github.com",
           "pathPattern": "^/apps/[^/]+/installations/new$"
@@ -1470,6 +1481,37 @@
       "endpointEnvNone": "no Google Ads client exposes an HTTP base-URL override: google-ads-api builds the host into the request literally, google-ads-python's `endpoint` is a gRPC host:port for its transport channel, and Dub hardcodes the host in a raw fetch. Interception is host-based.",
       "serveExport": "createGoogleAdsTwinServer"
     },
+    "googlecalendar": {
+      "adoption": {
+        "sdks": [
+          "@googleapis/calendar"
+        ],
+        "pypi": [],
+        "envStems": [
+          "GOOGLECALENDAR"
+        ]
+      },
+      "hosts": [
+        {
+          "host": "www.googleapis.com",
+          "pathPattern": "^/(batch/)?calendar/v3(/|$)"
+        }
+      ],
+      "archetype": "crud",
+      "protocol": {
+        "declared": "2",
+        "major": 2,
+        "standing": "current"
+      },
+      "transport": "rest",
+      "resources": [
+        "Calendar",
+        "CalendarListEntry",
+        "Event"
+      ],
+      "endpointEnvNone": "@googleapis/calendar and googleapis read no base-URL variable: the root URL is the Discovery document's `https://www.googleapis.com/` unless the caller passes `rootUrl` (Inbox Zero reads its own GOOGLE_BASE_URL for that); interception is the host rule above.",
+      "serveExport": "createGooglecalendarTwinServer"
+    },
     "googlemaps": {
       "adoption": {
         "pypi": [
@@ -2148,6 +2190,27 @@
       ],
       "serveExport": "createMixpanelTwinServer"
     },
+    "mongodb": {
+      "adoption": {
+        "pypi": [],
+        "sdks": []
+      },
+      "hostsNone": "RAW-PROTOCOL pack — there is no host to map. MongoDB clients speak the wire protocol over a raw TCP socket to whatever host the connection string names, which the injector (http/fetch patching) cannot see; a World reaches this twin through the connection string itself (MONGO_URI and its kin), which World-managed infrastructure injects.",
+      "archetype": "crud",
+      "protocol": {
+        "declared": "2",
+        "major": 2,
+        "standing": "current"
+      },
+      "transport": "raw-tcp",
+      "resources": [
+        "collection",
+        "index",
+        "document"
+      ],
+      "endpointEnvNone": "no vendor base-URL variable: the application reads its own connection-string variable (MONGO_URI, MONGODB_URL, DATABASE_URL, …), and World-managed infrastructure (`volter-world init` → `volter-world-infra`) injects that variable pointing at this twin's listener.",
+      "serveExport": "createMongodbTwinServer"
+    },
     "moonshot": {
       "adoption": {
         "pypi": [],
@@ -2816,6 +2879,26 @@
       "endpointEnvNone": "reddit clients take no base-URL environment variable (snoowrap and PRAW build https://oauth.reddit.com and https://www.reddit.com URLs from constants or explicit constructor options), so a World reaches them through the hosts above; inventing a REDDIT_BASE_URL the app never reads would report coverage the app does not have.",
       "serveExport": "createRedditTwinServer"
     },
+    "redis": {
+      "adoption": {},
+      "hostsNone": "RAW-PROTOCOL pack — there is no host to map. Redis's protocol runs over a TCP socket the injector (which patches http/fetch) never sees, and a Redis has no vendor hostname: it is wherever the app's REDIS_URL points. The World points it here: init classifies REDIS_URL as managed infrastructure and the managed redis service is this twin.",
+      "archetype": "crud",
+      "protocol": {
+        "major": 1,
+        "standing": "deprecated"
+      },
+      "transport": "raw-tcp",
+      "resources": [
+        "key",
+        "field",
+        "member",
+        "scored",
+        "entry",
+        "script"
+      ],
+      "endpointEnvNone": "Redis clients read no base-URL env of their own: the app passes its REDIS_URL (or host/port) to ioredis or node-redis itself, and init emits that REDIS_URL for the managed redis service (world-runtime/src/init.ts), not as a twin endpoint env.",
+      "serveExport": "createRedisTwinServer"
+    },
     "replicate": {
       "adoption": {
         "pypi": [
@@ -3358,11 +3441,11 @@
         },
         {
           "host": "connect.stripe.com",
-          "pathPattern": "^/setup/"
+          "pathPattern": "^/setup/|^/oauth/(authorize|token|deauthorize)/?$"
         },
         {
           "host": "dashboard.stripe.com",
-          "pathPattern": "^/settings/public/?$"
+          "pathPattern": "^/settings/public/?$|^/(test/)?settings/connect(/onboarding-options/oauth)?/?$"
         },
         {
           "host": "verify.stripe.com",
@@ -3561,6 +3644,38 @@
       "endpointEnvNone": "the @tavily/core SDK exposes no base-URL env var — it reads only TAVILY_API_KEY/TAVILY_HTTP(S)_PROXY/TAVILY_ORG_ID/TAVILY_PROJECT from process.env; base-URL override is the constructor option apiBaseURL (dist/index.mjs post()/get(): `apiBaseURL || BASE_URL`), so interception is the hosts entry above.",
       "serveExport": "createTavilyTwinServer"
     },
+    "temporal": {
+      "adoption": {
+        "sdks": [
+          "@temporalio/client",
+          "@temporalio/worker",
+          "@temporalio/workflow",
+          "@temporalio/activity"
+        ],
+        "scopes": [
+          "@temporalio/"
+        ],
+        "pypi": [
+          "temporalio"
+        ],
+        "envStems": [
+          "TEMPORAL"
+        ]
+      },
+      "hostsNone": "RAW-PROTOCOL pack — there is no host to map. The Temporal SDKs dial the frontend address they are configured with (Connection.connect / NativeConnection.connect `address`, conventionally TEMPORAL_ADDRESS) over gRPC, which the http/fetch injector never sees. Interception is the app-read address: the World injects TEMPORAL_ADDRESS=<host>:<port> at this twin (APP_READ_ENDPOINT_ENV in world-runtime/src/init.ts).",
+      "archetype": "engine-control",
+      "protocol": {
+        "declared": "2",
+        "major": 2,
+        "standing": "current"
+      },
+      "transport": "raw-tcp",
+      "resources": [
+        "workflow-execution",
+        "namespace"
+      ],
+      "serveExport": "createTemporalTwinServer"
+    },
     "tiktok": {
       "adoption": {
         "sdks": [],
@@ -4154,11 +4269,11 @@
       "hosts": [
         {
           "host": "api.x.com",
-          "pathPattern": "^(?:/2/media/upload/?|/2/media/upload/initialize/?|/2/media/upload/[0-9]+/(?:append|finalize)/?|/2/tweets/?|/2/tweets/[^/]+/?|/2/tweets/search/recent/?|/2/users/(?!me/?$)[^/]+/?|/2/users/by/username/[^/]+/?|/2/users/[^/]+/mentions/?|/2/users/[^/]+/tweets/?|/2/users/[^/]+/timelines/reverse_chronological/?)$|^/_twin/"
+          "pathPattern": "^(?:/2/media/upload/?|/2/media/upload/initialize/?|/2/media/upload/[0-9]+/(?:append|finalize)/?|/2/tweets/?|/2/tweets/[^/]+/?|/2/tweets/search/recent/?|/2/users/(?!me/?$)[^/]+/?|/2/users/by/username/[^/]+/?|/2/users/[^/]+/mentions/?|/2/users/[^/]+/tweets/?|/2/users/[^/]+/timelines/reverse_chronological/?)$|^/_twin/(?!assets/consent\\.(?:js|css)$)"
         },
         {
           "host": "api.twitter.com",
-          "pathPattern": "^(?:/2/media/upload/?|/2/media/upload/initialize/?|/2/media/upload/[0-9]+/(?:append|finalize)/?|/2/tweets/?|/2/tweets/[^/]+/?|/2/tweets/search/recent/?|/2/users/(?!me/?$)[^/]+/?|/2/users/by/username/[^/]+/?|/2/users/[^/]+/mentions/?|/2/users/[^/]+/tweets/?|/2/users/[^/]+/timelines/reverse_chronological/?)$|^/_twin/"
+          "pathPattern": "^(?:/2/media/upload/?|/2/media/upload/initialize/?|/2/media/upload/[0-9]+/(?:append|finalize)/?|/2/tweets/?|/2/tweets/[^/]+/?|/2/tweets/search/recent/?|/2/users/(?!me/?$)[^/]+/?|/2/users/by/username/[^/]+/?|/2/users/[^/]+/mentions/?|/2/users/[^/]+/tweets/?|/2/users/[^/]+/timelines/reverse_chronological/?)$|^/_twin/(?!assets/consent\\.(?:js|css)$)"
         }
       ],
       "archetype": "crud",
@@ -4241,11 +4356,11 @@
         },
         {
           "host": "api.x.com",
-          "pathPattern": "^/2/(?:oauth2/(?:token|revoke)|users/me)/?$"
+          "pathPattern": "^/2/(?:oauth2/(?:token|revoke)|users/me)/?$|^/oauth/(?:request_token|authorize|authenticate|access_token)/?$|^/1\\.1/oauth/invalidate_token(?:\\.json)?/?$|^/_twin/assets/consent\\.(?:js|css)$"
         },
         {
           "host": "api.twitter.com",
-          "pathPattern": "^/2/(?:oauth2/(?:token|revoke)|users/me)/?$"
+          "pathPattern": "^/2/(?:oauth2/(?:token|revoke)|users/me)/?$|^/oauth/(?:request_token|authorize|authenticate|access_token)/?$|^/1\\.1/oauth/invalidate_token(?:\\.json)?/?$|^/_twin/assets/consent\\.(?:js|css)$"
         }
       ],
       "archetype": "crud",
@@ -4263,7 +4378,11 @@
         "access_token",
         "refresh_token",
         "grant",
-        "rate_window"
+        "rate_window",
+        "oauth1_app",
+        "oauth1_request_token",
+        "oauth1_token",
+        "oauth1_grant"
       ],
       "serveExport": "createXIdentityTwinServer"
     },

package/inject.cjs

@@ -678,7 +678,7 @@ function fakeClientRequest(origin, method, fullPath, headers, callback) {
 
 // --- unclaimed path on a twinned shared host: refuse LOUDLY, never mis-route -----------------
 // The Cal.com incident class: a host two vendors share (www.googleapis.com) is twinned, the
-// request's PATH belongs to neither twin (`/calendar/v3/*` — Google Calendar has no pack), and
+// request's PATH belongs to neither twin (`/drive/v3/*` — Google Drive has no pack; `/calendar/v3/*` was the case until the googlecalendar pack), and
 // the old catch-all matcher answered it from the WRONG pack with a vendor-shaped 404: fails open
 // AND plausible. The operator declared this host virtualized, so the traffic must not leak to the
 // real vendor either. The only honest outcome is a refusal that NAMES the situation.
@@ -1092,6 +1092,51 @@ function restore() {
 
 module.exports = { install, restore, readMap, resolveTwin, twinUrlVendor, twinnedHostVendors, unclaimedTwinnedHostPathMessage, appForwardHeaders, VENDOR_HOSTS };
 
+// WORLD TIME: an application process keeps the World's time, as its twins do (worldNow(), world-clock.ts). A World's
+// clock (TWIN_WORLD_CLOCK_FILE, one of world-clock.cjs's two forms) is read at most once a second, so a clock moved
+// while the application runs applies within a second; with no clock set, the process keeps the machine's time.
+// `Date` is the machine's own, wrapped so its `now()` and argument-less construction read the World's time; every other use
+// (a parsed date, `Date.UTC`, arithmetic, timers, `performance.now()`) is unchanged. The machine's own `Date.now` is
+// left under a global symbol, so the kernel's worldNow() applies a running clock's offset once in a process like this.
+// Without this, time moved in a World reaches its twins and not its application: a token the twins sign by the
+// World's time is refused by the application's (dub-stress findings row 107).
+function installWorldTime() {
+  const file = process.env.TWIN_WORLD_CLOCK_FILE;
+  if (!file || globalThis[Symbol.for('volter.machineDateNow')]) return;
+  const fs = require('fs');
+  const { parseClock, clockNowMs } = require('./world-clock.cjs');
+  const MachineDate = Date;
+  const machineNow = MachineDate.now.bind(MachineDate);
+  let held = { checkedAt: -Infinity, mtimeMs: -1, clock: null };
+  const clock = () => {
+    const wall = machineNow();
+    if (wall - held.checkedAt < 1000) return held.clock;
+    held.checkedAt = wall;
+    try {
+      const mtimeMs = fs.statSync(file).mtimeMs;
+      if (mtimeMs !== held.mtimeMs) held = { checkedAt: wall, mtimeMs, clock: parseClock(fs.readFileSync(file, 'utf8')) };
+    } catch (error) {
+      // no clock: the machine's time; a clock caught mid-write keeps the last one read until the next look
+      if (error && error.code === 'ENOENT') held = { checkedAt: wall, mtimeMs: -1, clock: null };
+    }
+    return held.clock;
+  };
+  const worldMs = () => { const c = clock(); return c ? clockNowMs(c, machineNow()) : machineNow(); };
+  // the machine's own Date, wrapped rather than subclassed, so identity holds everywhere: dates Node makes itself
+  // (a file's mtime, structuredClone, a worker's message) are `instanceof Date`, `d.constructor === Date` stays true,
+  // and Date.prototype is the machine's; only now() and argument-less construction read the World's time
+  const WorldDate = new Proxy(MachineDate, {
+    construct: (target, args, newTarget) => Reflect.construct(target, args.length ? args : [worldMs()], newTarget === WorldDate ? target : newTarget),
+    // called as a function, Date() answers the current time's string, as the machine's does
+    apply: () => new MachineDate(worldMs()).toString(),
+  });
+  Object.defineProperty(globalThis, Symbol.for('volter.machineDateNow'), { value: machineNow, enumerable: false });
+  MachineDate.now = worldMs;
+  Object.defineProperty(MachineDate.prototype, 'constructor', { value: WorldDate, writable: true, configurable: true, enumerable: false });
+  globalThis.Date = WorldDate;
+}
+
 // Auto-install as a preload (`--require`); strict refusal also applies without twin URLs.
 install();
+installWorldTime();
 installPrismaAdapterShim();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-core",
-  "version": "2.0.0",
+  "version": "2.0.2",
   "description": "The kernel of Volter World: one log per twin, branches as pointers, checkpoints, the fold that keeps a twin current, the head that performs a write against the vendor, references, and the git plane. A twin package builds on it; the runtime serves it.",
   "keywords": [
     "twin",
@@ -29,6 +29,8 @@
     "network-policy.d.cts",
     "app-route.cjs",
     "vendor-hosts.cjs",
+    "world-clock.cjs",
+    "world-clock.d.cts",
     "app-route.d.cts",
     "generated",
     "src",
@@ -73,10 +75,18 @@
       "default": "./app-route.cjs"
     },
     "./vendor-hosts": "./vendor-hosts.cjs",
+    "./world-clock": {
+      "types": "./world-clock.d.cts",
+      "default": "./world-clock.cjs"
+    },
     "./generated/pack-facts.json": "./generated/pack-facts.json",
     "./lifecycle": {
       "types": "./dist/src/lifecycle.d.ts",
       "default": "./dist/src/lifecycle.js"
+    },
+    "./redis": {
+      "types": "./dist/src/redis/index.d.ts",
+      "default": "./dist/src/redis/index.js"
     }
   },
   "scripts": {

package/src/actions.ts

@@ -17,11 +17,13 @@ import { randomUUID } from 'node:crypto';
 import { dirname, join } from 'node:path';
 import { canonicalJson, hashFieldValue, subjectKey } from './hash.ts';
 import type { SubjectFields } from './hash.ts';
-import { appendDurable, eventsLockPath, projectionLockPath, twinLog, withFileLock, worldPaths } from './storage.ts';
+import { appendDurable, eventsLockPath, ownerStoreRoots, projectionLockPath, twinLog, withFileLock, withoutIdentityClaim, worldPaths } from './storage.ts';
 import { landAsPlaceholder, placeholderPullActive } from './placeholder-remote.ts';
-import { aliasesFrom, dropCheckpoint, landedCopy, landedIds, parentEntries, readTree, type Receipt } from './log.ts';
+import { aliasesFrom, dropCheckpoint, landedCopy, landedIds, parentEntries, readTree, treeStamp, type Receipt } from './log.ts';
 import { WorldServiceEventSchema } from './schemas.ts';
+import { refuseReadOnlyWrite } from './request-scope.ts';
 import { getActiveWorldStore } from './world-store.ts';
+import { currentTraceparent } from './trace-context.ts';
 import type { WorldServiceEvent } from './types.ts';
 import type { TwinResource } from './serve.ts';
 
@@ -94,6 +96,9 @@ export type TwinAction = {
    * alone, with no dependence on actionId/pushId naming conventions.
    */
   correlationId?: string;
+  /** The W3C `traceparent` of the request that caused this action, when it carried a valid one
+   *  (trace-context.ts). Authoring metadata like correlationId: excluded from replay identity. */
+  traceparent?: string;
   /**
    * The action's MERGE BASE against the remote (runtime contract R14, non-fast-forward
    * rule): per touched subject, the observed mirror's remote ref (shadow.ts remoteRefs)
@@ -129,7 +134,10 @@ function withCorrelationId(action: TwinAction): TwinAction {
   // The wire's request id (the addressed service stamps every response with one and threads it
   // into the handler's async context) is the correlation when the caller supplies none — the
   // join from a request on the wire to the action rows it caused, with no pack involved.
-  return action.correlationId ? action : { ...action, correlationId: currentCorrelationId() ?? randomUUID() };
+  const correlated = action.correlationId ? action : { ...action, correlationId: currentCorrelationId() ?? randomUUID() };
+  // the request's W3C trace context (trace-context.ts) is stamped the same way, from the handler's async context
+  const traceparent = correlated.traceparent === undefined ? currentTraceparent() : undefined;
+  return traceparent ? { ...correlated, traceparent } : correlated;
 }
 
 /** Subjects a `set` action touches: its own subject, every projection resource, and every
@@ -200,7 +208,7 @@ function landIfPlaceholderPull(action: TwinAction, root?: string): TwinAction |
 }
 
 function replayBody(action: TwinAction): string {
-  const { correlationId: _correlationId, ...stampedBody } = action;
+  const { correlationId: _correlationId, traceparent: _traceparent, ...stampedBody } = action;
   // A confirmation is content-addressed by the observed event ids. Its timestamp is observation
   // metadata, just like the occurredAt/observedAt values that appendEvent ignores when replaying
   // one content-addressed event. Two reconcilers confirming the same bytes at different wall-clock
@@ -233,6 +241,7 @@ export function runWithCorrelationId<T>(id: string, fn: () => T): T { return cor
 export function currentCorrelationId(): string | undefined { return correlationScope().getStore(); }
 
 export function appendAction(action: TwinAction, root?: string): TwinAction {
+  refuseReadOnlyWrite(action.service); // a read-only request writes nothing (request-scope.ts)
   // Evaluate and append under the service projection and actions locks. A precondition is a
   // compare-and-set, not an advisory validation: checking outside either lock would let another
   // writer invalidate it before this action lands. The shadow basis is stamped under the same
@@ -252,6 +261,7 @@ export function appendAction(action: TwinAction, root?: string): TwinAction {
  *  atomic across processes (two concurrent identical writes converge to ONE action; distinct
  *  writes both land). A reused id with different content fails loudly. */
 export function appendActionIfAbsent(action: TwinAction, root?: string): { action: TwinAction; appended: boolean; placeholder?: true } {
+  refuseReadOnlyWrite(action.service);
   return withFileLock(projectionLock(action.service, root), () => withFileLock(actionsLock(action.service, root), () => {
     const identified = withCorrelationId(action);
     // An exact retry is already committed. Resolve it before re-evaluating author-time
@@ -285,6 +295,7 @@ export function appendActionIfAbsent(action: TwinAction, root?: string): { actio
  * the same ordinals, which is what serve-path determinism requires.
  */
 export function appendActionOccurrence(base: TwinAction, root?: string): { action: TwinAction; appended: boolean; placeholder?: true } {
+  refuseReadOnlyWrite(base.service);
   return withFileLock(projectionLock(base.service, root), () => withFileLock(actionsLock(base.service, root), () => {
     const stamped = occurrenceOf(base, actionIds(base.service, root), root);
     assertPreconditions(stamped, root);
@@ -345,6 +356,7 @@ export function decideAndAppendAction<T>(
     const resources = projectResources(service, root);
     const decision = decide(resources);
     if (decision.kind === 'skip') return { value: decision.value, appended: false };
+    refuseReadOnlyWrite(service); // a decision to write is the write a read-only request may not make
     if (decision.action.service !== service) {
       throw new Error(`Atomic action service mismatch: expected ${service}, got ${decision.action.service}`);
     }
@@ -439,6 +451,57 @@ export function projectResources(service: string, root?: string, opts: { until?:
   return readTree(service, root, opts);
 }
 
+/** A read of another pack's store that cannot choose: the subject it looks for (or, with none named, the store itself)
+ *  is held by more than one service of the World. A reader answers it as the vendor answers a credential it cannot
+ *  resolve; it is never a server error. */
+export class OwnerStoreAmbiguousError extends Error {
+  constructor(owner: string, roots: string[], subject?: { type: string; id: string }) {
+    super(`${subject ? `${subject.type} ${subject.id} of ` : ''}${owner}'s store is held by more than one service of this World (${roots.join(', ')}); a cross-pack read cannot choose between them`);
+    this.name = 'OwnerStoreAmbiguousError';
+  }
+}
+
+/** One owner store as a cross-pack reader sees it: its rows (frozen, shared by every read until the store changes) and
+ *  an index by `type:id`. Memoized per (owner, root) on the store's `treeStamp`, so a reader resolving a token on every
+ *  request folds and copies the owner's tree only when the owner has written since. */
+type OwnerIndex = { stamp: string; rows: readonly TwinResource[]; byKey: Map<string, TwinResource> };
+const ownerIndexes = new Map<string, OwnerIndex>();
+function ownerIndex(owner: string, root: string): OwnerIndex {
+  const key = `${owner}\0${root}`;
+  const stamp = treeStamp(owner, root);
+  const held = ownerIndexes.get(key);
+  if (held && held.stamp === stamp) return held;
+  const rows = readTree(owner, root).map((r) => Object.freeze(r));
+  const index: OwnerIndex = { stamp, rows: Object.freeze(rows), byKey: new Map(rows.map((r) => [`${r.type}:${r.id}`, r])) };
+  ownerIndexes.set(key, index);
+  return index;
+}
+
+/**
+ * ANOTHER pack's rows, read by contract (architecture A3: one vendor's store split across two packs, xidentity's tokens
+ * read by x, googleoauth's by googlecalendar; scripts/architecture.test.ts holds the declared reader-owner pairs): the
+ * owner's tree, from wherever the World keeps the owner's store (`ownerStoreRoots`). Read only: the rows are frozen and
+ * shared. It claims no journal identity (the twin answering is the reader).
+ *
+ * With `subject`, the store that holds that subject (the token a request presents): `[]` when none does, and
+ * `OwnerStoreAmbiguousError` only when more than one does, so a second service running the owning pack never breaks a
+ * lookup of what only one of them issued. Without it, the one store there is, and `OwnerStoreAmbiguousError` when the
+ * World holds two.
+ */
+export function projectOwnerResources(owner: string, root?: string, subject?: { type: string; id: string }): readonly TwinResource[] {
+  return withoutIdentityClaim(() => {
+    const roots = ownerStoreRoots(owner, root);
+    if (!subject) {
+      if (roots.length > 1) throw new OwnerStoreAmbiguousError(owner, roots);
+      return roots[0] ? ownerIndex(owner, roots[0]).rows : [];
+    }
+    const key = `${subject.type}:${subject.id}`;
+    const holding = roots.filter((r) => ownerIndex(owner, r).byKey.has(key));
+    if (holding.length > 1) throw new OwnerStoreAmbiguousError(owner, holding, subject);
+    return holding[0] ? ownerIndex(owner, holding[0]).rows : [];
+  });
+}
+
 /** The local → vendor id aliases the landed copies carry: a read by the id a caller was handed before
  *  its write was performed resolves to the row the vendor now owns. */
 export function subjectAliases(service: string, root?: string): Map<string, string> {
@@ -474,6 +537,7 @@ export function confirmAction(opts: {
   occurredAt: string;
   root?: string;
 }): { observedEventId: string; observedEventIds: string[] } {
+  refuseReadOnlyWrite(opts.service);
   // LANDING (log.ts): the entry is copied to the parent log with its receipt — no confirm row, no
   // suppression; the fold skips a branch entry the parent holds.
   const paths = worldPaths(opts.service, opts.root);
@@ -510,6 +574,7 @@ export type RevertOutcome =
  * Only `set` rows are revertable — reverting a revert or a confirm is a category error.
  */
 export function revertAction(opts: { service: string; actionId: string; occurredAt: string; root?: string }): RevertOutcome {
+  refuseReadOnlyWrite(opts.service);
   return withFileLock(projectionLock(opts.service, opts.root), () => withFileLock(actionsLock(opts.service, opts.root), (): RevertOutcome => {
     const all = listActions(opts.service, opts.root);
     const target = all.find((a) => a.id === opts.actionId);

package/src/blob-store.ts

@@ -23,6 +23,7 @@ import { closeSync, existsSync, mkdirSync, openSync, readdirSync, readFileSync,
 import { dirname, join } from 'node:path';
 import { volterHome } from './volter-home.ts';
 import { sharedBlobIndex } from './shared-blob-index.ts';
+import { refuseReadOnlyWrite, writesRefused } from './request-scope.ts';
 
 export interface BlobStore {
   /** Bytes at `key`, or null when absent. Never throws for a missing key. */
@@ -165,8 +166,21 @@ export function blobDigest(bytes: Uint8Array): string {
 // (or a test) swaps in its adapter for the scope of a request.
 let activeBlobStore: BlobStore = new FsBlobStore();
 
+/** The active store; under a read-only request's refusing scope (request-scope.ts), one that refuses
+ *  to store or remove bytes before any reach it, as the log's appenders refuse (a git push's objects,
+ *  an upload's body), while reads pass. */
 export function getActiveBlobStore(): BlobStore {
-  return activeBlobStore;
+  return writesRefused() ? readOnlyBlobs(activeBlobStore) : activeBlobStore;
+}
+function readOnlyBlobs(store: BlobStore): BlobStore {
+  return {
+    get: (key) => store.get(key),
+    exists: (key) => store.exists(key),
+    list: (prefix) => store.list(prefix),
+    size: (key) => store.size(key),
+    put: async () => { refuseReadOnlyWrite('blobs'); },
+    remove: async () => { refuseReadOnlyWrite('blobs'); },
+  };
 }
 
 export function setActiveBlobStore(store: BlobStore): BlobStore {

package/src/client-bundle.ts

@@ -5,9 +5,22 @@
 // is retried on the next call. Nothing here runs at module scope.
 import { existsSync, readFileSync } from 'node:fs';
 
+/** A file URL's path on this machine, without `node:url` (the modules that call it ride into browser
+ *  bundles): percent-escapes decoded, and without the slash `URL.pathname` puts before a Windows drive
+ *  (`/C:/…`), which no file API opens. `new URL('../client/x.css', import.meta.url).pathname` is this. */
+export function filePathOf(url: URL): string {
+  const path = decodeURIComponent(url.pathname);
+  return /^\/[A-Za-z]:\//.test(path) ? path.slice(1) : path;
+}
+
 const bundles = new Map<string, Promise<string>>();
 type BunBuild = { build: (o: { entrypoints: string[]; target: 'browser'; minify: boolean }) => Promise<{ success: boolean; logs: Array<{ message: string }>; outputs: Array<{ text: () => Promise<string> }> }> };
 
+/** A browser has no `process`. A client that imports shared helpers from its pack's server-side module can pull Node
+ *  code into its bundle (util.deprecate, crypto shims) that reads it; without a shim the page throws before it renders
+ *  (newer Bun no longer adds one to a browser build). A minimal one, the page's own, before the bundle. */
+const PROCESS_SHIM = 'globalThis.process=globalThis.process||{env:{NODE_ENV:"production"},browser:true,argv:[],versions:{},platform:"browser",emit:function(){return false},on:function(){},nextTick:function(f){var a=[].slice.call(arguments,1);queueMicrotask(function(){f.apply(null,a)})}};\n';
+
 export function bundleClient(entry: string): Promise<string> {
   let pending = bundles.get(entry);
   if (!pending) {
@@ -15,12 +28,12 @@ export function bundleClient(entry: string): Promise<string> {
     pending = (bun && typeof bun.build === 'function'
       ? (bun as BunBuild).build({ entrypoints: [entry], target: 'browser', minify: true }).then(async (result) => {
           if (!result.success) throw new Error(result.logs.map((l) => l.message).join('\n') || `client build failed: ${entry}`);
-          return result.outputs[0]!.text();
+          return PROCESS_SHIM + await result.outputs[0]!.text();
         })
       : Promise.resolve().then(() => {
           const prebuilt = entry.replace(/\.tsx?$/, '.bundle.js');
           if (!existsSync(prebuilt)) throw new Error(`client bundle missing at ${prebuilt} — the package's \`build\` writes it (scripts/publish/build.mjs); Node serves the prebuilt client`);
-          return readFileSync(prebuilt, 'utf8');
+          return PROCESS_SHIM + readFileSync(prebuilt, 'utf8');
         }))
       .catch((error) => { bundles.delete(entry); throw error; });
     bundles.set(entry, pending);

package/src/derived-core.ts

@@ -14,7 +14,8 @@ import { hashFieldValue } from './hash.ts';
 import { resolveSubjectId, subjectAliases } from './actions.ts';
 import { packReferences } from './references.ts';
 import type { SubjectFields } from './hash.ts';
-import { twinPublicBase } from './twin-fetch.ts';
+import { twinPublicBase, withRequestScopes } from './twin-fetch.ts';
+import { isReadOnlyRequest } from './request-scope.ts';
 import type { DerivedCall, DerivedCoreOutcome, DerivedHandler, DerivedOperation } from './derived.ts';
 
 // ── the manifest ─────────────────────────────────────────────────────────────────────────────
@@ -965,8 +966,10 @@ export function crossCutting(m: DerivedManifest, opts: CoreScope & { readOnly?:
       }
     }
     // a read-only twin refuses writes: what the operation does, not the HTTP verb it came by (an RPC
-    // wire POSTs its reads)
-    if (opts.readOnly && !['retrieve', 'list', 'computed'].includes(call.operation.class) && !m.reads?.includes(call.operation.id)) return vendorError(m, m.readOnly);
+    // wire POSTs its reads). A read-only REQUEST (x-volter-read-only, request-scope.ts) is refused the
+    // same way, up front, on a writable twin.
+    const readOnly = opts.readOnly || isReadOnlyRequest(request);
+    if (readOnly && !['retrieve', 'list', 'computed'].includes(call.operation.class) && !m.reads?.includes(call.operation.id)) return vendorError(m, m.readOnly);
     // a body labelled JSON that does not parse is the vendor's refusal, never a crash of the twin
     if ((request.headers.get('content-type') ?? '').includes('json') || m.body.json === 'always') {
       const text = request.method === 'GET' || request.method === 'HEAD' ? '' : await request.clone().text().catch(() => '');
@@ -988,6 +991,8 @@ export function crossCutting(m: DerivedManifest, opts: CoreScope & { readOnly?:
       // a streamed answer replays as the stream it was; a record kept before text was kept replays its JSON
       return answer.text !== undefined ? new Response(answer.text, { status: answer.status, headers: { 'content-type': answer.contentType ?? 'application/json' } }) : Response.json(answer.body, { status: answer.status });
     }
+    // a read-only request replays a stored answer but records none: recording is a write
+    if (readOnly) return next();
     const response = await next();
     if (m.idempotency.onlySuccess && (response.status < 200 || response.status >= 300)) return response;
     const contentType = response.headers.get('content-type') ?? 'application/json';
@@ -997,6 +1002,15 @@ export function crossCutting(m: DerivedManifest, opts: CoreScope & { readOnly?:
   }
 }
 
+/** A derived pack's whole fetch behind the kernel's read scope (twin-fetch.ts withRequestScopes): a
+ *  read-only request's writes are refused at the write seam — the ones `crossCutting` cannot see
+ *  coming (another wire's mutation, a door, a screen) — and answered with the vendor's own read-only
+ *  error; `GET /twin` advertises `requestScopes`. The pack's catch-up runs under `runAsVendorMove`
+ *  (request-scope.ts), so time's moves still land when a read-only request is what arrives. */
+export function derivedRequestScopes<F extends (request: Request) => Promise<Response>>(m: DerivedManifest, fetch: F): F {
+  return withRequestScopes(fetch, { refuse: () => vendorError(m, m.readOnly) });
+}
+
 /** A semantics context for a request no surface operation names: another wire's (GraphQL) resolvers
  *  get the same interface as a handler, named by the operation id the wire gives. */
 export function semanticsContext(m: DerivedManifest, request: Request, operation: DerivedOperation, scope: CoreScope = {}): Promise<SemanticsContext> {