@volter/world-core 2.0.37 → 3.0.1

package/src/derived-core.ts

@@ -8,21 +8,42 @@
 import { applyTwinWrite, applyTwinWriteAtomic, twinResources, type TwinResource } from './serve.ts';
 import { copyResource, ownFields, parentStamp, subjectHistory, treeChangesSince, treeStamp } from './log.ts';
 import { getActiveWorldStore } from './world-store.ts';
+import { getActiveBlobStore } from './blob-store.ts';
+import { worldPaths } from './storage.ts';
+import { GitObjectStore } from './git/objects.ts';
+import { GitRefs } from './git/refs.ts';
 import { worldNow } from './world-clock.ts';
-import { createHash } from 'node:crypto';
+import { worldEnvValue } from './world-env.ts';
+import { openSessions, socketWrite, type SocketDecl, type SocketSession } from './sockets.ts';
+import { MACHINE_POOL, poolFor, type MachinePool } from './machines.ts';
+import { askApplication, deliverEvents, deliverToApplication, type ApplicationAnswer, type DeliveryAnswer, type EventRender, type EventScheme, type EventsDecl, type EventValues } from './events.ts';
+import type { RateBudgetDeclaration } from './rateBudget.ts';
+import { handlerCrypto, hmac, lettersFrom, sha256, uuidFrom, type HandlerCrypto } from './signing.ts';
 import { hashFieldValue } from './hash.ts';
-import { resolveSubjectId, subjectAliases } from './actions.ts';
+import { readResourceBlob, removeResourceBlob, writeResourceBlob } from './resource-blob.ts';
+import { managedDatabase, unboundDatabase, type ManagedDatabase } from './managed-database.ts';
+import { execRedisRun, type RedisDialect, type RunItem } from './redis/engine.ts';
+import { sendMail, type Mail, type SmtpRoute } from './smtp.ts';
+import { multipartBoundary, multipartParts, type MultipartPart } from './multipart.ts';
+import type { CorsDecl } from './cors.ts';
+import { projectOwnerResources, resolveSubjectId, subjectAliases } from './actions.ts';
+import { vendorFetch } from './vendor-call.ts';
 import { packReferences } from './references.ts';
 import type { SubjectFields } from './hash.ts';
 import { twinPublicBase, withRequestScopes } from './twin-fetch.ts';
-import { isReadOnlyRequest } from './request-scope.ts';
+import { inVendorMove, isReadOnlyRequest, runAsVendorMove } from './request-scope.ts';
 import type { DerivedCall, DerivedCoreOutcome, DerivedHandler, DerivedOperation } from './derived.ts';
+import type { PackDescriptor } from './packRegistry.ts';
+import type { ScenarioDecision, ScenarioHandler } from './scenario.ts';
+import { bodyTextOf, checkJsonBody, takeParsedBody } from './derived.ts';
 
 // ── the manifest ─────────────────────────────────────────────────────────────────────────────
 
 /** How a stored field gets its value when the server assigns it. `now` is the world clock in the
  *  manifest's time format; `id` the subject's id; a `value` is stored as given. */
-export type FieldRule = { now: true } | { id: true } | { value: unknown } | { template: string };
+/** A field the server assigns: the World clock's now, the subject's id, a fixed value, or a template over the stored
+ *  fields (and `{id}`), base64-encoded when `encode` says (GitHub's `node_id`: `05:Label{id}` in base64). */
+export type FieldRule = { now: true } | { id: true } | { value: unknown } | { template: string; encode?: 'base64' };
 
 /** A move of one state field, as data. `operation` is the operationId that causes it (an update
  *  that requests `to` when absent); `from` the values it leaves; `effects` the other fields it writes;
@@ -40,7 +61,7 @@ export type Transition = {
   to?: string;
   effects?: Record<string, FieldRule>;
   /** placeholders `{from}`, `{to}`, `{field}`, `{id}` */
-  refusal?: { status: number; code?: string; message: string };
+  refusal?: { status: number; code?: string | number; message: string };
   /** a refusal of its own for a particular current value (an invoice already `paid`) */
   refusals?: Record<string, { status: number; code?: string; message: string }>;
   /** where the rule comes from: a docs URL, the SDK's types, or a recording */
@@ -81,6 +102,14 @@ export type ResourceDecl = {
   /** the tree's subject type, when it differs from the resource name */
   storedAs?: string;
   idPrefix: string;
+  /** a setting held once per parent at a path of its own (`/v1/projects/{ref}/config/auth`, GET and PATCH, which the
+   *  surface names by the schema its GET answers): keyed by the path's parameter, it answers `defaults` under what was
+   *  written until first written, and an update merges into it, making it on first write */
+  setting?: { defaults: Record<string, unknown> };
+  /** this resource's id template, when it is not the manifest's (`ids.template`): `{uuid}`, `{letters:20}` (twenty
+   *  lowercase letters, a Supabase project ref), `{snowflake:<epoch ms>}` (Discord's ids), or a `{prefix}`/`{n}`
+   *  template */
+  ids?: string;
   /** fields the server assigns on create */
   assigned?: Record<string, FieldRule>;
   state?: Record<string, StateField>;
@@ -100,14 +129,19 @@ export type ResourceDecl = {
   /** a number the resource counts per parent (a repository's issue numbers, a thread's messages):
    *  the stored field, set on create to one past the highest among its siblings */
   number?: { field: string };
-  /** how this resource renders a stored subject, when it differs from the pack's; it sees the subject's
-   *  address, which a stored shape may not carry */
-  view?: (body: Record<string, unknown>, subject: { id: string; type: string }) => Record<string, unknown>;
-  /** an update replaces the fields it names (`replace`) or merges nested objects into them (`merge`, the default) */
-  update?: 'merge' | 'replace';
+  /** the field the vendor's answer names a subject's id by, when it is not `id` (Daily's webhook `uuid`, Twilio's `sid`,
+   *  Asana's `gid`): the subject's id is answered under it, and no `id` */
+  idAs?: string;
+  /** an update replaces the fields it names (`replace`), merges a nested object one level into them with `''` removing
+   *  a key (`merge`, the default: Stripe's metadata), or merges nested objects at every level with `null` removing a key
+   *  (`deep`: Clerk's metadata, "a deep merge … remove metadata keys at any level by setting their value to null") */
+  update?: 'merge' | 'replace' | 'deep';
   /** the stored subject id when it is not the path's last parameter: a template over the path
    *  parameters (`{vector_store_id}::{file_id}`) */
   key?: string;
+  /** a resource every tenant shares (a catalogue the vendor keeps for all, its countries or currencies): the manifest's
+   *  `tenant` does not scope it */
+  shared?: boolean;
   /** only subjects whose stored fields match are readable (a resource stored for every call but
    *  answered only when asked to be kept) */
   readableWhen?: Record<string, unknown>;
@@ -117,9 +151,73 @@ export type ResourceDecl = {
   /** query parameters of the list operation that filter on the same-named field */
   filters?: string[];
   order?: { field: string; direction: 'asc' | 'desc' };
+  /** the list's ordering parameter (`order_by=-created_at`): `[+-]<field>` over `fields`, `default` when absent; any
+   *  other field is refused with `invalid` (`{fields}` in its message names them), never ignored */
+  orderBy?: { param: string; fields: string[]; default: string; invalid: ErrorSpec };
+  /** fields no two live subjects share (a permission's `key`; a membership's `organization_id` and `user_id` together):
+   *  a create or update that would make a second one is refused with `refusal`, by the core and by `ctx.conflict` */
+  unique?: Array<{ fields: string[]; refusal: ErrorSpec }>;
+  /** the subjects a delete takes with it (an organization's memberships and invitations): each resource whose `field`
+   *  holds the deleted subject's id, deleted first, each through the write path as its own delete (its events sent) */
+  cascade?: Array<{ resource: string; field: string }>;
+  /** fields that name a subject as its id does (an organization by its id or its slug): a path's id and `ctx.find`
+   *  match either */
+  alternateKeys?: string[];
+  /** the list's search parameter (`query`): a row matches on an `exact` field's whole value or a `partial` field's
+   *  substring, case-insensitively */
+  search?: { param: string; exact?: string[]; partial?: string[] };
+  /** fields that count this subject's children (an App's `installations_count`): the live subjects of `of` whose `by`
+   *  holds this one's id, only those with `present` set when it is named, plus `plus` (a customer's
+   *  `next_invoice_sequence` is one past its numbered invoices). The kernel keeps each whenever a child is written. */
+  counts?: Record<string, { of: string; by: string; present?: string; plus?: number }>;
+  /** how the vendor's state of this type is read back into a root (the real-system adapters, "Refresh"): the list that
+   *  enumerates it (once per parent, under `parent`; `complete: false` when it is not the whole type; `items`, the answer's
+   *  path to them, when the spec does not name the list it answers), the one read of a singleton, or `none` with why the
+   *  vendor offers no read-back. Every stored resource the vendor holds declares one. */
+  refresh?: { list: string; complete?: false; items?: string } | { get: string } | { none: string };
+  /** the other resources one create of this one makes, and where its answer names each's id (a JSON path) */
+  companions?: Record<string, string>;
+  /** the field telling a newer copy of a subject from an older (an `updated_at`): an ingested event older than the
+   *  root's copy folds nothing */
+  version?: string;
 };
 
-export type ErrorSpec = { status: number; message: string; code?: string; param?: string; kind?: string };
+/** How a vendor's signed webhooks are folded into a root (the real-system adapters, "Ingest"). */
+export type IngestDecl = {
+  scheme: EventScheme | ReadonlyArray<EventScheme>;
+  /** where the event names its type: a header, a body path, and a sub-action path joined to it with `.` */
+  type: { header?: string; body?: string; action?: string };
+  /** the JSON path of the event's object */
+  object: string;
+  /** event type → the resource it carries, where `events.types` read backwards and `<resource>.created|updated|deleted`
+   *  do not say it */
+  types?: Record<string, { resource: string; deleted?: true }>;
+  /** an event answered instead of folded (Slack's url_verification): the body fields it matches, and the answer, a
+   *  `$body.<path>` read from the event or a literal */
+  handshake?: { when: Record<string, string>; answer: string };
+};
+
+/** Which lane a request is the vendor's gateway's to send ("Other wires: lanes"), each condition it names holding: a
+ *  path under `path` (Supabase's `/rest/v1`), a host matching `host` (a regular expression: `^secretsmanager\.`), a
+ *  header starting with `header.prefix` (AWS's `x-amz-target: secretsmanager.`), and a host not in `exceptHosts`. */
+export type LaneRoute = {
+  lane: string; path?: string; host?: string; exceptHosts?: ReadonlyArray<string>;
+  /** a header starting with `prefix`, or, with `absent`, a request whose header does not (Clerk's Frontend API is asked
+   *  without a Backend API secret key) */
+  header?: { name: string; prefix: string; absent?: true };
+  /** where two of the vendor's APIs share one address: the route passes a path only the root's API serves (the lane's
+   *  surface does not), which is the root's */
+  unlessOnlyRoot?: true;
+};
+/** A vendor's lanes: its routes, first match first, the lane that takes what no route names (`default`), and the
+ *  gateway's CORS. A `/_twin/` door goes to the lane whose manifest declares it. */
+export type LanesDecl = { cors?: CorsDecl; routes: ReadonlyArray<LaneRoute>; default?: string };
+/** The manifest of a vendor whose every API is a lane (Cloudflare's API v4 and R2, AWS's services): no API of its own,
+ *  only what the vendor's front says — its discovery facts, its lanes and its descriptor. */
+export type VendorManifest = { vendor: string; discovery?: DerivedManifest['discovery']; lanes: LanesDecl; descriptor: Omit<PackDescriptor, 'vendor'>; ingest?: IngestDecl; rateBudget?: RateBudgetDeclaration };
+
+/** `code` as the vendor writes it: a string, or a number (Discord's JSON error codes are integers) */
+export type ErrorSpec = { status: number; message: string; code?: string | number; param?: string; kind?: string };
 
 /** A vendor screen a World serves (docs/contributing/architecture.md, "Screens"). A `flow` is a hosted
  *  page an application sends its user through, held to its documented round trip; a `workspace` is a
@@ -127,8 +225,12 @@ export type ErrorSpec = { status: number; message: string; code?: string; param?
  *  vendor's way, each a (screen, control) cell. */
 export type ScreenDecl = {
   id: string;
-  kind: 'flow' | 'workspace';
+  /** a hosted flow a person is sent through, a workspace they work in, or a content host serving what the vendor stores
+   *  (its CDN: an uploaded image, a video, a default avatar) */
+  kind: 'flow' | 'workspace' | 'content';
   host: string;
+  /** every other host the screen answers on (a sandbox's dashboard and production's, one page) */
+  hosts?: string[];
   path: string;
   demand: string;
   status: 'done' | 'todo';
@@ -138,11 +240,17 @@ export type ScreenDecl = {
 };
 
 export type DerivedManifest = {
+  /** The pack's descriptor, as data (docs/contributing/architecture.md, "The descriptor"), every field but `vendor`, which
+   *  is the manifest's: the pack registers `packOf(manifest)`, so its index is a fixed file. A lane has none. */
+  descriptor?: Omit<PackDescriptor, 'vendor'>;
   vendor: string;
   /** the kernel service the pack writes */
   service: string;
   /** `json: 'always'` reads a body as JSON whatever its content type (GitHub does) */
-  body: { form?: { coerce: boolean }; json?: 'always' };
+  /** `strict`: a vendor that refuses a body field its operation does not declare, a value of another type, or a number
+   *  outside the spec's bounds (a NestJS validation pipe: Supabase's "property x should not exist"), with its messages;
+   *  `{name}`, `{type}` (`a string`, `an integer`), `{min}` and `{max}` are filled. `ctx.fields` checks a body so. */
+  body: { form?: { coerce: boolean }; json?: 'always'; validation?: { operations?: ReadonlyArray<string>; status: number; missing: unknown; type: unknown; range: unknown }; strict?: { status: number; code?: string; unknown: string; type: string; range: string } };
   /** `acceptProvided`: a create that names its own `id` keeps it (a vendor that seeds by id). The template counts
    *  (`{prefix}_{n}`), or is `{uuid}` for a vendor whose ids are UUIDs: the next is derived from the resource and its
    *  count, so a World mints the same ids every run */
@@ -152,7 +260,16 @@ export type DerivedManifest = {
   /** operations that only read though nothing in the spec says so (a POST that returns data):
    *  a read-only twin answers them */
   reads?: string[];
-  time: 'unix' | 'iso';
+  /** how the vendor writes an instant: Unix seconds, Unix milliseconds (Clerk's `created_at`), or ISO 8601 */
+  time: 'unix' | 'unix-ms' | 'iso';
+  /** the vendor's CORS, as its gateway answers a browser (cors.ts): the pack's fetch is served behind `withCors` */
+  cors?: CorsDecl;
+  /** the HTTP status a vendor answers every error below `below` with, when its body names the error's own status
+   *  (storage-api: 400 for every error but a 500, the body's `statusCode` the error's: `{ status: 400, below: 500 }`) */
+  errorsAnsweredAs?: { status: number; below: number };
+  /** the texts the vendor reads as a boolean in a parameter, compared without case (Supabase: `true`, `1`, `yes`, `on`,
+   *  `y`, `enabled` and their opposites); absent, `true` and `false`. `ctx.flag` reads with them. */
+  booleans?: { truthy: string[]; falsy: string[] };
   /** the vendor's error body, with `{message}`, `{code}`, `{param}`, `{kind}` placeholders; a
    *  placeholder with no value is left out when `errorOmitsAbsent` */
   error: unknown;
@@ -166,6 +283,16 @@ export type DerivedManifest = {
   /** a request header that selects the vendor's API version, and the answer to a malformed one
    *  (`{value}` in its message is the header's value) */
   version?: { header: string; pattern: string; error: ErrorSpec };
+  /** request headers that carry meaning to the vendor (a tenant header such as `Stripe-Account`): recorded with a write
+   *  so its perform sends them again (the real-system adapters, "What a pack declares"); `version.header` is too */
+  headers?: string[];
+  /** the vendor's signed webhooks, folded into a root */
+  ingest?: IngestDecl;
+  /** the vendor's documented limits, charged by the executor on every live call (D8) */
+  rateBudget?: RateBudgetDeclaration;
+  /** a pack whose wire has no derived perform (a socket, a line protocol, a managed database): binding a root is refused
+   *  with this reason */
+  vendorBacked?: { none: string };
   /** `withParam`: the error names the path parameter that held the unknown id */
   notFound: { status: number; message: string; code?: string; kind?: string; withParam?: boolean };
   /** the list envelope (placeholders `{data}`, `{has_more}`, `{url}`, `{first_id}`, `{last_id}`),
@@ -181,7 +308,7 @@ export type DerivedManifest = {
      *  in place of id cursors: `base64-offset` is base64 of `{"o":<offset>}` */
     cursor?: { param: string; encoding: 'base64-offset' };
     /** numbered pages (1-based `page`, the size in `limit.param`), with the vendor's `Link` header
-     *  naming the first, previous, next and last pages */
+     *  naming the first, previous, next and last pages (`link`); the envelope may name `{total_count}` and `{max_page}` */
     page?: { param: string; link: boolean };
     /** offset paging: `param` names how many items to skip; the page sits under the operation's envelope key beside the
      *  envelope, whose `{total_count}` is the count before paging (Tremendous's `{ orders: [...], total_count }`) */
@@ -211,20 +338,93 @@ export type DerivedManifest = {
   idempotency?: { header: string; storedAs: string; conflict?: ErrorSpec; methods?: string[]; onlySuccess?: boolean };
   /** how the vendor reads its credential, and what it answers without one or with a key the twin
    *  reserves as invalid, or one of a shape the vendor never issues (`keyFormat`, a pattern every key it issues
-   *  matches: Resend's begin `re_`); a request that presents no such header at all is a trusted in-process call */
-  auth?: { header: string; scheme: string; missing: ErrorSpec; invalidKeys: string[]; keyFormat?: string; invalid: ErrorSpec; gateWhenAbsent: boolean };
+   *  matches: Resend's begin `re_`); a request that presents no such header at all is a trusted in-process call.
+   *  `held`: the key must be one the account holds, kept by its SHA-256 in a stored type's field (a token a Tokens page
+   *  made: `{ storedAs: '_access_token', hashField: 'sha256' }`), or one of the World's `standing` keys (the one its
+   *  seeds and init hand the app); any other is `invalid`. */
+  /** how the vendor reads its credential: the `header`, after its `scheme` (`''`: the header's whole value, an
+   *  `x-api-key`), or any of `also` (ElevenLabs' `xi-api-key` beside `Authorization`, Google's `?key=`); `paths` (a
+   *  regular expression) the paths it gates, every other passing ungated; a key the World issued is `held` by its hash */
+  auth?: { header: string; scheme: string; also?: Array<{ header?: string; scheme?: string; query?: string }>; paths?: string; missing: ErrorSpec; invalidKeys: string[]; keyFormat?: string; invalid: ErrorSpec; gateWhenAbsent: boolean; held?: { storedAs: string; hashField: string; standing?: string[]; /** a field set true on a key no longer held (OpenRouter's `disabled`) */ unless?: string };
+    /** operations that check a credential of their own, not the account's (Cloudflare's asset upload reads its upload
+     *  session's JWT from the same header): the gate leaves them to their handler */
+    exempt?: string[];
+    /** the vendor checks the key before it routes: a path it does not have is refused a missing or invalid key first */
+    beforeRouting?: boolean };
   /** the twin door that makes the next request answer the vendor's rate-limit refusal */
   /** headers every answer carries (a request id) */
   answerHeaders?: Record<string, string>;
   /** an origin the pack writes into URLs it mints, rewritten in every JSON answer to where this
    *  twin is reached for the request (twinPublicBase) */
   origin?: { placeholder: string };
-  /** while a pack moves, how its existing code renders a stored subject (named by its stored
-   *  type), so moved and unmoved operations answer the same shape */
-  view?: (storedType: string, body: Record<string, unknown>) => Record<string, unknown>;
   resources: Record<string, ResourceDecl>;
+  /** Read-only cross-pack credential subjects of the same vendor (architecture A3); no root is exposed to handlers. */
+  ownerReads?: ReadonlyArray<{ owner: string; resource: string }>;
   /** the vendor's screens this pack serves or owes (demand decides which exist) */
   screens?: ScreenDecl[];
+  /** The discovery door's facts (`GET /twin`): what the twin is of, what it stores, and how it is authenticated. */
+  discovery?: {
+    twinOf: string; stores: string; identity?: string; notes?: string;
+    /** a model vendor's: what its scenario scripts (the `on` keys and the `respond` shape), and a handler as an example */
+    behavior?: string; exampleHandler?: ScenarioHandler;
+  };
+  /** The World's doors (architecture, "Doors, screens and the gap"): each a method and a path under `/_twin/` (with
+   *  `{param}` segments), answered by the export of `semantics/doors.ts` its id names, over the contract's context. */
+  doors?: Array<{ id: string; method: string; path: string; note?: string }>;
+  /** The vendor's GraphQL API beside its REST one (`semantics/graphql.ts` over `generated/graphql-sdl.gen.json`): the
+   *  paths it is POSTed to, and the answer to a query selecting a field nothing models (`{field}`, `{type}`). */
+  graphql?: { paths: ReadonlyArray<string>; unmodeled: { message: string; type?: string; status?: number } };
+  /** The vendor's answer for a path nothing serves and an operation nothing models, `{method}` and `{path}` filled
+   *  (OpenAI's `Unknown request URL: {method} {path}`); the manifest's `notFound` when it names none. */
+  gap?: ErrorSpec;
+  /** The vendor's answer for a path its API serves under other methods than the request's (`405 Method not allowed:
+   *  {method} {path}`), `{method}` and `{path}` filled; the gap when it names none. */
+  wrongMethod?: ErrorSpec;
+  /** The content codings the vendor reads a request's body in (its Content-Encoding: Tinybird's "Gzip or Zstandard"
+   *  events) and answers in when the request accepts one (Accept-Encoding), and its answer for a body that does not
+   *  decode as its Content-Encoding says. The kernel decodes before routing and encodes the API's answer. */
+  encodings?: { request?: ReadonlyArray<'gzip' | 'zstd' | 'deflate' | 'br'>; response?: ReadonlyArray<'gzip'>; undecodable?: ErrorSpec };
+  /** The content type the vendor labels a JSON answer with, when it is not the runtime's (Clerk's exact
+   *  `application/json`, which @clerk/backend reads a body as JSON only on): every JSON answer relabelled. */
+  jsonContentType?: string;
+  /** The vendor's tenancy (architecture, "The derived core"): each stored subject belongs to the tenant it was made in —
+   *  an organization, a team, an account — and a caller reaches only its own tenant's, as a parent's children are
+   *  reached under it. `field` holds it on each subject; `semantics/tenant.ts` names the caller's. The core scopes every
+   *  read, list, update and delete by it and stamps it on every create, for each resource not `shared`. */
+  tenant?: { field: string };
+  /** The vendor's own lanes behind this manifest's API ("Other wires: lanes"), dispatched by the kernel before the
+   *  vendor's own doors, clock and API (LanesDecl). */
+  lanes?: LanesDecl;
+  /** A host whose first label is part of the path, as a regular expression over the request's vendor host whose first
+   *  capture is put in front of the path before routing (S3's virtual-hosted addressing: `<bucket>.<endpoint>/<key>` is
+   *  `/<bucket>/<key>`); the host itself is left as it came. */
+  pathFromHost?: string;
+  /** A prefix the vendor's hosts may put before a path (turbopuffer's region, `/aws-us-east-1`), as a regular expression
+   *  matched at the path's start: stripped before routing, so the operation it names is the one served. Its named groups
+   *  (Jira's `/ex/jira/(?<cloudId>[^/]+)`) are the operation's parameters as well. */
+  pathPrefix?: string;
+  /** A pattern over the request's vendor host whose named groups are the operation's parameters (E2B's envd answers each
+   *  sandbox at `49983-<sandboxID>.e2b.app`: `^\\d+-(?<sandboxID>[a-z0-9]+)\\.`). */
+  hostParams?: string;
+  /** The persistent wires the vendor's clients hold open (sockets.ts: Discord's Gateway): each served at its path by
+   *  the pack's `semantics/sockets.ts`, which the kernel offers every write after its webhooks. */
+  sockets?: ReadonlyArray<SocketDecl>;
+  /** The vendor speaks gRPC (architecture, "Other wires": gRPC): its server answers HTTP/2 and HTTP/1 on one port, each
+   *  rpc (by its proto unit's schema, `src/generated/proto.gen.json`) through the pack's own fetch. */
+  grpc?: true;
+  /** The vendor runs its customers' images (machines.ts: Fly's Machines): the kernel serves `POST /_twin/machine-pool`
+   *  and hands handlers the World's pool as `ctx.machines`. */
+  machines?: boolean;
+  /** A lane routed by host ("Other wires: lanes"): the hosts it serves, each exact or a suffix. The vendor's server sends
+   *  them here, and SHAPE judges the lane on them alone, never on a page or door of the vendor on another host. */
+  hosts?: ReadonlyArray<{ host?: string; suffix?: string }>;
+  /** The path parameters whose values span segments where the spec cannot say so (an OpenAPI path has no greedy label:
+   *  GitHub's `{ref}`, QStash's `{destination}`); a Smithy model's greedy labels are the surface's own `spanning`. */
+  spanning?: ReadonlyArray<string>;
+  /** The webhooks the vendor sends for its writes, as data the kernel renders, signs, delivers and records (events.ts);
+   *  `render` is the pack's `semantics/events.ts`, how the vendor renders an event's `data` when it is not the written
+   *  object. */
+  events?: EventsDecl & { render?: EventRender<WriteHookContext>; values?: EventValues<WriteHookContext> };
   /** called after every stored write with the rendered resource, its stored type and the kernel operation name */
   onWrite?: (write: {
     operation: string; storedType: string; body: Record<string, unknown>; root?: string; occurredAt: string; request: Request;
@@ -236,6 +436,66 @@ export type DerivedManifest = {
 
 // ── request parsing ──────────────────────────────────────────────────────────────────────────
 
+/** A body's fields as a strict vendor checks them (`ctx.fields`, the manifest's `body.strict`). Without `strict`, every
+ *  field passes. An object or array field is not typed here: its own shape is the handler's. */
+export function strictFields(m: DerivedManifest, operation: DerivedOperation, body: Record<string, unknown>): { fields: Record<string, unknown> } | { refused: Response } {
+  const strict = m.body.strict;
+  if (!strict) return { fields: { ...body } };
+  const declared = new Map((operation.body ?? []).map((f) => [f.name, f]));
+  const refuse = (template: string, values: Record<string, unknown>): { refused: Response } =>
+    ({ refused: vendorError(m, { status: strict.status, ...(strict.code ? { code: strict.code } : {}), message: String(fill(template, values)) }) });
+  const fields: Record<string, unknown> = {};
+  for (const [name, value] of Object.entries(body)) {
+    const field = declared.get(name);
+    if (!field) return refuse(strict.unknown, { name });
+    const { type } = field;
+    const fits = value === null
+      || (type === 'boolean' && typeof value === 'boolean')
+      || (type === 'integer' && Number.isInteger(value))
+      || (type === 'number' && typeof value === 'number')
+      || (type === 'string' && typeof value === 'string')
+      || !['boolean', 'integer', 'number', 'string'].includes(type);
+    if (!fits) return refuse(strict.type, { name, type: type === 'integer' ? 'an integer' : `a ${type}` });
+    if (typeof value === 'number' && ((field.minimum !== undefined && value < field.minimum) || (field.maximum !== undefined && value > field.maximum))) {
+      return refuse(strict.range, { name, min: field.minimum ?? null, max: field.maximum ?? null });
+    }
+    fields[name] = value;
+  }
+  return { fields };
+}
+
+/** Top-level schema checks with vendor-supplied response templates; unknown fields pass to semantics. */
+function validateBody(m: DerivedManifest, operation: DerivedOperation, body: unknown): Response | undefined {
+  const rule = m.body.validation;
+  if (!rule || (rule.operations && !rule.operations.includes(operation.id))) return undefined;
+  const refuse = (template: unknown, values: Record<string, unknown>): Response => Response.json(fill(template, values), { status: rule.status });
+  if (!body || typeof body !== 'object' || Array.isArray(body)) return refuse(rule.type, { name: '$body', type: 'object', input: body ?? null });
+  const values = body as Record<string, unknown>;
+  for (const field of operation.body ?? []) {
+    const value = values[field.name];
+    if (value === undefined) {
+      if (field.required) return refuse(rule.missing, { name: field.name, input: values });
+      continue;
+    }
+    const types = field.type.split('|');
+    const fits = types.some((type) => type === 'null' ? value === null : type === 'integer' ? Number.isInteger(value) : type === 'array' ? Array.isArray(value) : type === 'object' ? value !== null && typeof value === 'object' && !Array.isArray(value) : type === 'string' ? typeof value === 'string' : type === 'number' ? typeof value === 'number' : type === 'boolean' ? typeof value === 'boolean' : true);
+    if (!fits) return refuse(rule.type, { name: field.name, type: field.type, input: value });
+    if (typeof value === 'number' && ((field.minimum !== undefined && value < field.minimum) || (field.maximum !== undefined && value > field.maximum))) return refuse(rule.range, { name: field.name, min: field.minimum ?? null, max: field.maximum ?? null, input: value });
+  }
+  return undefined;
+}
+
+/** A value as the vendor reads a boolean (`ctx.flag`, the manifest's `booleans`). */
+export function flagOf(m: Pick<DerivedManifest, 'booleans'>, value: unknown): boolean | undefined {
+  if (typeof value === 'boolean') return value;
+  if (value === undefined || value === null) return undefined;
+  const text = String(value).toLowerCase();
+  const { truthy, falsy } = m.booleans ?? { truthy: ['true'], falsy: ['false'] };
+  if (truthy.some((t) => t.toLowerCase() === text)) return true;
+  if (falsy.some((f) => f.toLowerCase() === text)) return false;
+  return undefined;
+}
+
 /** A form body's bracket notation (`a[b][0][c]=v`, `expand[]=x`) as nested objects and arrays. A form carries only
  *  text: a field the operation's spec types as a number or a boolean (`scalars`, by bracket path, written by
  *  world-tooling's formScalarsOf) is read as one when its text is that literal; every other field stays the text sent
@@ -291,24 +551,31 @@ export async function readParams(manifest: DerivedManifest, request: Request, op
     // an upload: text fields as given, each file as its name, media type, size and content (its text), with its raw
     // `bytes` beside them for a pack that must tell an image or audio file from anything else; the bytes are not
     // enumerated, so a write's record of the request keeps the text alone
-    const form = await request.formData();
+    // read from its bytes (multipart.ts): a runtime's form parser drops a part with an empty field name
+    const boundary = multipartBoundary(type);
+    const parts = boundary === null ? [] : multipartParts(new Uint8Array(await request.arrayBuffer()), boundary);
     const out: Record<string, unknown> = { ...query };
-    for (const [key, value] of form.entries()) {
-      if (typeof value === 'string') {
-        out[key] = value;
+    for (const part of parts) {
+      if (part.filename === null) {
+        out[part.name] = new TextDecoder().decode(part.body);
         continue;
       }
-      const file = value as unknown as { name: string; type: string; size: number; arrayBuffer(): Promise<ArrayBuffer> };
-      const bytes = new Uint8Array(await file.arrayBuffer());
-      const parsed = { name: file.name, type: file.type, size: file.size, content: new TextDecoder().decode(bytes) };
-      out[key] = Object.defineProperty(parsed, 'bytes', { value: bytes, enumerable: false });
+      const bytes = part.body;
+      const parsed = { name: part.filename, type: part.type ?? '', size: bytes.byteLength, content: new TextDecoder().decode(bytes) };
+      out[part.name] = Object.defineProperty(parsed, 'bytes', { value: bytes, enumerable: false });
     }
     return out;
   }
-  const text = await request.text();
+  const text = await bodyTextOf(request);
   if (!text) return query;
-  const asJson = type.includes('json') || manifest.body.json === 'always';
-  const body: unknown = asJson ? JSON.parse(text) : parseBracketForm(text, scalars);
+  // NDJSON (`application/x-ndjson`) is lines of JSON, not a JSON document: the handler reads its text
+  const isJson = type.includes('json') && !type.includes('ndjson');
+  const asJson = isJson || manifest.body.json === 'always';
+  // `json: 'always'` reads a body labelled otherwise as JSON (GitHub reads curl -d's); a body that is not JSON is read
+  // as the form it is labelled, never a crash (a sign-in page's own form, posted to the vendor's page)
+  let body: unknown;
+  if (asJson) { try { body = JSON.parse(text); } catch { if (isJson) throw new SyntaxError('malformed JSON body'); body = parseBracketForm(text, scalars); } }
+  else body = parseBracketForm(text, scalars);
   // a body that is not an object (GitHub's set-labels takes a bare array) is the body, not fields
   return body && typeof body === 'object' && !Array.isArray(body) ? { ...query, ...(body as Record<string, unknown>) } : { ...query };
 }
@@ -325,7 +592,10 @@ function fill(template: unknown, values: Record<string, unknown>, omitAbsent = f
   }
   if (Array.isArray(template)) return template.map((t) => fill(t, values, omitAbsent)).filter((v) => v !== ABSENT);
   if (template && typeof template === 'object') {
-    return Object.fromEntries(Object.entries(template).map(([k, v]) => [k, fill(v, values, omitAbsent)] as const).filter(([, v]) => v !== ABSENT));
+    const entries = Object.entries(template).map(([k, v]) => [k, fill(v, values, omitAbsent)] as const).filter(([, v]) => v !== ABSENT);
+    // an object every one of whose placeholders was absent is absent itself (Clerk's `meta` with no parameter to name)
+    if (omitAbsent && entries.length === 0 && Object.keys(template).length > 0) return ABSENT;
+    return Object.fromEntries(entries);
   }
   return template;
 }
@@ -333,14 +603,16 @@ function fill(template: unknown, values: Record<string, unknown>, omitAbsent = f
 export function vendorError(manifest: DerivedManifest, e: ErrorSpec): Response {
   // the status as the answer's number, and as text for a vendor whose body spells it as a string (GitHub's "404")
   const values = { message: e.message, code: e.code ?? null, param: e.param ?? null, kind: e.kind ?? manifest.defaultKind ?? null, status: e.status, statusText: String(e.status) };
+  // the HTTP status, which a vendor may keep apart from the one its body names (errorsAnsweredAs)
+  const answered = manifest.errorsAnsweredAs && e.status < manifest.errorsAnsweredAs.below ? manifest.errorsAnsweredAs.status : e.status;
   // a vendor that answers its errors as a document, not JSON (S3's XML `<Error><Code>…`): the template is that text,
   // each value escaped into it
   if (typeof manifest.error === 'string') {
     const escape = (v: unknown): string => String(v ?? '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
     const body = manifest.error.replace(/\{(\w+)\}/g, (_, k: string) => escape(values[k as keyof typeof values]));
-    return new Response(body, { status: e.status, headers: { 'content-type': body.trimStart().startsWith('<') ? 'application/xml' : 'text/plain; charset=utf-8' } });
+    return new Response(body, { status: answered, headers: { 'content-type': body.trimStart().startsWith('<') ? 'application/xml' : 'text/plain; charset=utf-8' } });
   }
-  return Response.json(fill(manifest.error, values, manifest.errorOmitsAbsent ?? false), { status: e.status });
+  return Response.json(fill(manifest.error, values, manifest.errorOmitsAbsent ?? false), { status: answered });
 }
 
 function notFound(manifest: DerivedManifest, object: string, id: string, param?: string): Response {
@@ -354,7 +626,7 @@ function notFound(manifest: DerivedManifest, object: string, id: string, param?:
 
 // ── the tree ─────────────────────────────────────────────────────────────────────────────────
 
-const storedType = (m: DerivedManifest, resource: string): string => m.resources[resource]?.storedAs ?? resource;
+export const storedType = (m: DerivedManifest, resource: string): string => m.resources[resource]?.storedAs ?? resource;
 
 // A service's resources by type, folded once per World state (the tree's stamp; any write moves it), not on every read:
 // a read of one resource type projected the service's whole tree, so a pack whose tree also holds many subjects of
@@ -425,36 +697,112 @@ export function render(r: TwinResource): Record<string, unknown> {
   return Object.fromEntries(Object.entries({ id: r.id, ...ownFields(r) }).filter(([k]) => !k.startsWith('_') && k !== 'updatedAt'));
 }
 
+/** A stored subject as the vendor answers it: its own fields, its id under the name the vendor gives it. */
 function view(m: DerivedManifest, resource: string, r: TwinResource): Record<string, unknown> {
-  const own = m.resources[resource]?.view;
-  if (own) return own(render(r), { id: r.id, type: r.type });
-  if (!m.view) return render(r);
-  // a pack's view sees the stored row whole, and bookkeeping (`_`) never reaches the wire whatever it returns
-  return Object.fromEntries(Object.entries(m.view(storedType(m, resource), r as Record<string, unknown>)).filter(([k]) => !k.startsWith('_')));
+  const idAs = m.resources[resource]?.idAs;
+  if (!idAs) return render(r);
+  const { id, ...rest } = render(r);
+  return { [idAs]: id, ...rest };
 }
 
 /** Where the core runs: the World root it reads and writes, and its clock (the World's by default;
  *  a caller that pins an instant passes its own). */
-export type CoreScope = { root?: string; clock?: () => string };
+/** One call of a protocol-3 pack's default data (`src/semantics/seed.ts` exports `seed: SeedCall[]`): a request to the
+ *  vendor's own operation (or the pack's door), made in order against the twin by the runner `volter-world init` writes
+ *  beside the copied data. */
+export type SeedCall = { method: string; path: string; body?: unknown; headers?: Record<string, string> };
+
+/** Where a call is answered: the World's root, its clock, and the managed Postgres the runtime binds to the pack
+ *  (`database`, the descriptor's `managedDatabase`), which a handler reaches as `ctx.engine` — READ ONLY in every
+ *  transaction when the twin is (`readOnly`) or the request is (x-volter-read-only). */
+export type CoreScope = {
+  root?: string; clock?: () => string; database?: string; readOnly?: boolean;
+  /** `semantics/tenant.ts`: the tenant the caller acts in (the manifest's `tenant`), or undefined for none */
+  tenant?: (ctx: HandlerContext) => string | undefined | Promise<string | undefined>;
+};
 
 function now(m: DerivedManifest, at: string): unknown {
-  return m.time === 'unix' ? Math.floor(Date.parse(at) / 1000) : at;
+  return m.time === 'unix' ? Math.floor(Date.parse(at) / 1000) : m.time === 'unix-ms' ? Date.parse(at) : at;
 }
 
 function applyRule(m: DerivedManifest, rule: FieldRule, id: string, values: Record<string, unknown>, at: string): unknown {
   if ('now' in rule) return now(m, at);
   if ('id' in rule) return id;
   if ('value' in rule) return rule.value;
-  return fill(rule.template, { ...values, id });
+  const text = fill(rule.template, { ...values, id });
+  return rule.encode === 'base64' ? btoa(String.fromCharCode(...new TextEncoder().encode(String(text)))) : text;
 }
 
 const escapeRe = (s: string): string => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 
 /** The next id the manifest's template gives this resource: one past the highest it already minted. */
-function mintId(m: DerivedManifest, resource: string, root?: string): string {
+/** The World's seed for a service's secrets (ctx.secret): made once from the platform's random source, then read. The
+ *  making is one per service store in the process: two first calls at once share it, so no secret handed out under one
+ *  seed is lost to another written after it (a service's store is one process's). */
+const SEED = '_world_seed';
+const seeding = new Map<string, Promise<string>>();
+function worldSeed(service: string, root: string | undefined, at: string): Promise<string> {
+  const held = resourcesOfType(service, SEED, root).find((r) => r.id === 'seed') as Record<string, unknown> | undefined;
+  if (typeof held?.value === 'string') return Promise.resolve(held.value);
+  const key = `${root ?? ''}\u0000${service}`;
+  const pending = seeding.get(key);
+  if (pending) return pending;
+  const made = (async () => {
+    const value = Buffer.from(globalThis.crypto.getRandomValues(new Uint8Array(32))).toString('hex');
+    // the World's own bookkeeping, made on first use whatever the request: a read-only one lands it too (a vendor's move)
+    await runAsVendorMove(() => applyTwinWrite(service, { operation: 'world_seed.record', subjectType: SEED, subjectId: 'seed', fields: { value }, occurredAt: at, actor: { kind: 'system' } }, root));
+    return value;
+  })().finally(() => seeding.delete(key));
+  seeding.set(key, made);
+  return made;
+}
+
+/** A World's signing key for a label (ctx.signingKey): made once from the platform's random source, then read; the
+ *  making is one per service store and label in the process, as the seed's is. */
+const SIGNING_KEY = '_world_signing_key';
+const keying = new Map<string, Promise<{ privatePem: string; publicPem: string }>>();
+const pem = (kind: string, der: ArrayBuffer): string => `-----BEGIN ${kind}-----\n${Buffer.from(der).toString('base64').replace(/(.{64})/g, '$1\n').replace(/\n$/, '')}\n-----END ${kind}-----\n`;
+function heldWorldSigningKey(service: string, root: string | undefined, label: string, alg: 'RS256' | 'Ed25519'): { privatePem: string; publicPem: string } | undefined {
+  const id = alg === 'RS256' ? label : `${label}#${alg}`;
+  const held = resourcesOfType(service, SIGNING_KEY, root).find((r) => r.id === id) as Record<string, unknown> | undefined;
+  return typeof held?.privatePem === 'string' && typeof held.publicPem === 'string' ? { privatePem: held.privatePem, publicPem: held.publicPem } : undefined;
+}
+function worldSigningKey(service: string, root: string | undefined, at: string, label: string, alg: 'RS256' | 'Ed25519'): Promise<{ privatePem: string; publicPem: string }> {
+  // an RSA key keeps its label; another algorithm's is kept under the label and the algorithm, so one label never names two
+  const id = alg === 'RS256' ? label : `${label}#${alg}`;
+  const held = resourcesOfType(service, SIGNING_KEY, root).find((r) => r.id === id) as Record<string, unknown> | undefined;
+  if (typeof held?.privatePem === 'string' && typeof held.publicPem === 'string') return Promise.resolve({ privatePem: held.privatePem, publicPem: held.publicPem });
+  const key = `${root ?? ''}\u0000${service}\u0000${id}`;
+  const pending = keying.get(key);
+  if (pending) return pending;
+  const made = (async () => {
+    const pair = (alg === 'Ed25519'
+      ? await globalThis.crypto.subtle.generateKey({ name: 'Ed25519' }, true, ['sign', 'verify'])
+      : await globalThis.crypto.subtle.generateKey({ name: 'RSASSA-PKCS1-v1_5', modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]), hash: 'SHA-256' }, true, ['sign', 'verify'])) as CryptoKeyPair;
+    const fields = {
+      privatePem: pem('PRIVATE KEY', await globalThis.crypto.subtle.exportKey('pkcs8', pair.privateKey)),
+      publicPem: pem('PUBLIC KEY', await globalThis.crypto.subtle.exportKey('spki', pair.publicKey)),
+    };
+    await runAsVendorMove(() => applyTwinWrite(service, { operation: 'world_signing_key.record', subjectType: SIGNING_KEY, subjectId: id, fields, occurredAt: at, actor: { kind: 'system' } }, root));
+    return fields;
+  })().finally(() => keying.delete(key));
+  keying.set(key, made);
+  return made;
+}
+
+function mintId(m: DerivedManifest, resource: string, root?: string, at?: string): string {
+  if (!m.resources[resource]) throw new Error(`mint: ${resource} is not a resource ${m.vendor}'s manifest declares`);
   const prefix = m.resources[resource]!.idPrefix;
-  if (m.ids.template === '{uuid}') return mintUuid(m, resource, root);
-  const [head, tail = ''] = m.ids.template.split('{n}');
+  const template = m.resources[resource]!.ids ?? m.ids.template;
+  if (template === '{uuid}') return mintUuid(m, resource, root);
+  const snowflake = /^\{snowflake:(\d+)\}$/.exec(template);
+  if (snowflake) return mintSnowflake(m, BigInt(snowflake[1]!), root, at);
+  // `{letters:N}` and `{hex:N}`, alone or after the resource's prefix (`{prefix}{letters:16}`: Fly's `vol_…`)
+  const letters = /^(\{prefix\})?\{letters:(\d+)\}$/.exec(template);
+  if (letters) return mintLetters(m, resource, Number(letters[2]), root, letters[1] ? prefix : '');
+  const hex = /^(\{prefix\})?\{hex:(\d+)\}$/.exec(template);
+  if (hex) return mintHex(m, resource, Number(hex[2]), root, hex[1] ? prefix : '');
+  const [head, tail = ''] = template.split('{n}');
   const pattern = new RegExp(`^${escapeRe(String(fill(head!, { prefix })))}(\\d+)${escapeRe(String(fill(tail, { prefix })))}$`);
   let max = 0;
   // the one type, from the index that follows writes (a scan of the whole World per create grew with it)
@@ -462,7 +810,50 @@ function mintId(m: DerivedManifest, resource: string, root?: string): string {
     const hit = pattern.exec(r.id);
     if (hit) max = Math.max(max, Number(hit[1]));
   }
-  return String(fill(m.ids.template, { prefix, n: max + 1 }));
+  return String(fill(template, { prefix, n: max + 1 }));
+}
+
+/** The next snowflake (Discord's, X's): the milliseconds since the vendor's epoch shifted left 22 bits, the low bits an
+ *  increment. One space over every snowflake resource of the vendor, as its one generator's: the instant's first, or one
+ *  past the greatest the World holds when that is later (a frozen clock, or several ids in one millisecond), so ids
+ *  rise with time and never repeat. */
+/** The last snowflake minted per vendor and World in this process: two mints before the first is written (a message
+ *  and its attachment) must not meet. */
+const lastSnowflake = new Map<string, bigint>();
+function mintSnowflake(m: DerivedManifest, epoch: bigint, root?: string, at?: string): string {
+  const ms = BigInt(Date.parse(at ?? '') || 0);
+  const base = ms > epoch ? (ms - epoch) << 22n : 0n;
+  let max = -1n;
+  for (const [name, decl] of Object.entries(m.resources)) {
+    if (!/^\{snowflake:\d+\}$/.test(decl.ids ?? m.ids.template)) continue;
+    for (const r of resourcesOfType(m.service, storedType(m, name), root)) if (/^\d+$/.test(r.id)) { const v = BigInt(r.id); if (v > max) max = v; }
+  }
+  const key = `${m.service}\0${root ?? ''}`;
+  const last = lastSnowflake.get(key) ?? -1n;
+  const floor = max > last ? max : last;
+  const id = base > floor ? base : floor + 1n;
+  lastSnowflake.set(key, id);
+  return String(id);
+}
+
+/** The next id of `count` lowercase letters for a resource, derived from the resource and the count before it, past
+ *  any the World already holds. */
+function mintLetters(m: DerivedManifest, resource: string, count: number, root?: string, prefix = ''): string {
+  const held = new Set(resourcesOfType(m.service, storedType(m, resource), root).map((r) => r.id));
+  for (let n = held.size + 1; ; n++) {
+    const id = `${prefix}${lettersFrom(`${m.service}:${resource}:${n}`, count)}`;
+    if (!held.has(id)) return id;
+  }
+}
+
+/** The next hex id for a resource: N hex digits derived from the resource and the count before it, past any the World
+ *  already holds (a Cloudflare id, 32). */
+function mintHex(m: DerivedManifest, resource: string, count: number, root?: string, prefix = ''): string {
+  const held = new Set(resourcesOfType(m.service, storedType(m, resource), root).map((r) => r.id));
+  for (let n = held.size + 1; ; n++) {
+    const id = `${prefix}${sha256(`${m.service}:${resource}:${n}`).slice(0, count)}`;
+    if (!held.has(id)) return id;
+  }
 }
 
 /** The next UUID for a resource: a version-4-shaped UUID derived from the resource and the count before it, past any
@@ -471,8 +862,7 @@ function mintUuid(m: DerivedManifest, resource: string, root?: string): string {
   const type = storedType(m, resource);
   const held = new Set(resourcesOfType(m.service, type, root).map((r) => r.id));
   for (let n = held.size + 1; ; n++) {
-    const h = createHash('sha256').update(`${m.service}:${resource}:${n}`).digest('hex');
-    const id = `${h.slice(0, 8)}-${h.slice(8, 12)}-4${h.slice(13, 16)}-${'89ab'[parseInt(h[16]!, 16) % 4]}${h.slice(17, 20)}-${h.slice(20, 32)}`;
+    const id = uuidFrom(`${m.service}:${resource}:${n}`);
     if (!held.has(id)) return id;
   }
 }
@@ -484,7 +874,10 @@ function expand(m: DerivedManifest, resource: string, body: Record<string, unkno
     const [head, ...rest] = path.split('.');
     const target = embeds[head!];
     const id = out[head!];
-    if (!target || typeof id !== 'string') continue;
+    if (!target) continue;
+    // an object already embedded (an earlier path's) is walked further, not fetched again
+    if (id && typeof id === 'object' && !Array.isArray(id)) { if (rest.length) out[head!] = expand(m, target, id as Record<string, unknown>, [rest.join('.')], root); continue; }
+    if (typeof id !== 'string') continue;
     const hit = stored(m, target, root).find((r) => r.id === id);
     if (hit) out[head!] = rest.length ? expand(m, target, view(m, target, hit), [rest.join('.')], root) : view(m, target, hit);
   }
@@ -500,20 +893,112 @@ async function write(m: DerivedManifest, call: DerivedCall, resource: string, id
   return (await writeDetailed(m, call, resource, id, fields, operation, params, root, occurredAt)).body;
 }
 
+/** The request a context was opened for, as it came (contextFor): its path parameters, the query names the operation
+ *  declares (a repeated name as its values), its body before the core's merge and alias adoption with only the fields
+ *  the operation declares (a credential the caller put in the query or the body, Slack's `token`, is not the request's:
+ *  a perform carries the root's), the headers the manifest names, and the caller's own request id as provenance. */
+type SentRequest = { path: Record<string, string>; query: Record<string, string | string[]>; body: unknown; headers: Record<string, string>; lane?: string; requestId?: string; parts?: MultipartPart[]; type?: string };
+const sentOf = new WeakMap<DerivedCall, SentRequest>();
+/** The lane a vendor's router sent a request to (pack-fetch's laneRouter sets it). */
+export const LANE_HEADER = 'x-volter-lane';
+function sentRequest(m: DerivedManifest, call: DerivedCall, body: unknown): SentRequest {
+  const url = new URL(call.request.url);
+  const named = [...(m.headers ?? []), ...(m.version ? [m.version.header] : [])];
+  const headers = Object.fromEntries(named.flatMap((h) => { const v = call.request.headers.get(h); return v === null ? [] : [[h.toLowerCase(), v]]; }));
+  const lane = call.request.headers.get(LANE_HEADER) ?? undefined;
+  const requestId = call.request.headers.get('x-twins-request-id') ?? undefined;
+  const declared = new Set((call.operation.query ?? []).map((q) => q.name));
+  const query: Record<string, string | string[]> = {};
+  for (const name of new Set(url.searchParams.keys())) {
+    if (!declared.has(name)) continue;
+    const values = url.searchParams.getAll(name);
+    query[name] = values.length > 1 ? values : values[0]!;
+  }
+  const fields = new Set((call.operation.body ?? []).map((f) => f.name));
+  const asCame = body !== null && typeof body === 'object' && ('$text' in body || '$base64' in body);
+  const sentBody = fields.size && !asCame && body !== null && typeof body === 'object' && !Array.isArray(body) ? Object.fromEntries(Object.entries(body as Record<string, unknown>).filter(([k]) => fields.has(k))) : body;
+  return { path: { ...call.params }, query, body: sentBody, headers, ...(lane ? { lane } : {}), ...(requestId ? { requestId } : {}) };
+}
+/** What a write records of the call that made it: the surface operation and the request as it came, or which of the
+ *  World's own doors made it (a door or a screen, the gap, the clock), which a perform never sends. */
+/** A body as it came: `{ $text }` when its bytes are UTF-8, else `{ $base64 }`. */
+async function rawBody(request: Request): Promise<{ $text: string } | { $base64: string }> {
+  const bytes = new Uint8Array(await request.clone().arrayBuffer());
+  try { return { $text: new TextDecoder('utf-8', { fatal: true }).decode(bytes) }; } catch { return { $base64: Buffer.from(bytes).toString('base64') }; }
+}
+
+/** A multipart request's file parts, kept in the World's blob store by their bytes' digest (`files/<sha256>`): what a
+ *  write records of them (`input.files`), so a perform sends them again. */
+async function keptFiles(m: DerivedManifest, call: DerivedCall, root: string | undefined): Promise<Array<{ field: string; name: string; type: string | null; blob: string }> | undefined> {
+  const files = sentOf.get(call)?.parts?.filter((p) => p.filename !== null);
+  if (!files?.length) return undefined;
+  const out: Array<{ field: string; name: string; type: string | null; blob: string }> = [];
+  for (const f of files) {
+    const blob = `files/${hashFieldValue({ bytes: Buffer.from(f.body).toString('base64') })}`;
+    await writeResourceBlob(m.service, blob, f.body, root);
+    out.push({ field: f.name, name: f.filename!, type: f.type, blob });
+  }
+  return out;
+}
+
+function recordedInput(m: DerivedManifest, call: DerivedCall, merged: Record<string, unknown>): Record<string, unknown> {
+  const id = call.operation.id;
+  const sent = sentOf.get(call);
+  const asSent = sent ? { path: sent.path, query: sent.query, body: sent.body, headers: sent.headers, ...(sent.lane ? { lane: sent.lane } : {}), ...(sent.requestId ? { requestId: sent.requestId } : {}), ...(sent.type ? { contentType: sent.type } : {}) } : { path: call.params, body: merged };
+  if (id === 'graphql') {
+    const b = (sent?.body ?? {}) as { query?: unknown; variables?: unknown; operationName?: unknown };
+    return { graphql: { query: b.query, variables: b.variables ?? {}, ...(b.operationName ? { operationName: b.operationName } : {}) }, ...(sent?.lane ? { lane: sent.lane } : {}), headers: sent?.headers ?? {} };
+  }
+  if (id === 'clock') return { clock: true };
+  if (id === 'unmatched') return { gap: true, ...asSent };
+  if ((m.doors ?? []).some((d) => d.id === id) || (m.screens ?? []).some((sc) => sc.id === id) || id === 'machine-pool' || id.startsWith('socket:')) return { door: id, ...asSent };
+  return { operationId: id, ...asSent };
+}
+
 async function writeDetailed(m: DerivedManifest, call: DerivedCall, resource: string, id: string, fields: Record<string, unknown>, operation: string, params: Record<string, unknown>, root: string | undefined, occurredAt: string): Promise<{ body: Record<string, unknown>; id: string; vendorData?: unknown }> {
+  const withFiles = async (input: Record<string, unknown>): Promise<Record<string, unknown>> => { const files = input.operationId ? await keptFiles(m, call, root) : undefined; return files ? { ...input, files } : input; };
   const { resource: row, result } = await applyTwinWrite(
     m.service,
     // who made it: the login the pack's identity reads off the request, when it declares one, so a subject's
     // history can say who did each thing
-    { operation, subjectType: storedType(m, resource), subjectId: id, fields, input: { operationId: call.operation.id, params: call.params, body: params }, occurredAt, actor: { kind: 'agent', ...(m.identity ? { id: m.identity(call.request.headers.get('authorization'), root) } : {}) } },
+    // a vendor's own move (ctx.asVendor, the clock) is the World's, as the clock's writes are: no API call a head performs
+    inVendorMove()
+      ? { operation, subjectType: storedType(m, resource), subjectId: id, fields, input: { clock: true }, occurredAt, actor: { kind: 'system' } }
+      : { operation, subjectType: storedType(m, resource), subjectId: id, fields, input: await withFiles(recordedInput(m, call, params)), occurredAt, actor: { kind: 'agent', ...(m.identity ? { id: m.identity(call.request.headers.get('authorization'), root) } : {}) } },
     root,
   );
+  await keepCounts(m, call, resource, row as unknown as Record<string, unknown>, params, root, occurredAt);
   const body = view(m, resource, row);
-  if (m.onWrite) await m.onWrite({ operation, storedType: storedType(m, resource), body, ...(root !== undefined ? { root } : {}), occurredAt, request: call.request, context: () => contextFor(m, { ...call, request: call.request.clone() }, { ...(root !== undefined ? { root } : {}), clock: () => occurredAt }) });
+  const context = (): Promise<SemanticsContext> => contextFor(m, { ...call, request: call.request.clone() }, { ...(root !== undefined ? { root } : {}), clock: () => occurredAt });
+  if (m.onWrite) await m.onWrite({ operation, storedType: storedType(m, resource), body, ...(root !== undefined ? { root } : {}), occurredAt, request: call.request, context });
+  if (m.events) {
+    const events = m.events;
+    const write = { operation, storedType: storedType(m, resource), body, ...(root !== undefined ? { root } : {}), occurredAt, request: call.request };
+    await deliverEvents(m.service, events, write, async (type) => (events.render ? events.render(await context(), write, type) : body), undefined, events.values ? async (type) => events.values!(await context(), write, type) : undefined, (answer) => deliveryOutcome(m, answer, root));
+  }
+  if (m.sockets?.length) socketWrite(m.service, root, { operation, storedType: storedType(m, resource), body, ...(root !== undefined ? { root } : {}), occurredAt, request: call.request });
   // the subject's id as it stands after the write: the vendor's, when a live head minted one
   return { body, id: result.externalId ?? row.id, ...(result.vendorData !== undefined ? { vendorData: result.vendorData } : {}) };
 }
 
+/** The declared counts a written subject is a child in (a resource's `counts`), each kept on its parent: written when
+ *  the count moved, through the write path, so the parent's history says when. */
+async function keepCounts(m: DerivedManifest, call: DerivedCall, resource: string, row: Record<string, unknown>, params: Record<string, unknown>, root: string | undefined, occurredAt: string): Promise<void> {
+  for (const [parent, decl] of Object.entries(m.resources)) {
+    for (const [field, c] of Object.entries(decl.counts ?? {})) {
+      if (storedType(m, c.of) !== storedType(m, resource) || row[c.by] === undefined || row[c.by] === null) continue;
+      const pid = String(row[c.by]);
+      const held = stored(m, parent, root).find((r) => r.id === pid) as Record<string, unknown> | undefined;
+      if (!held) continue;
+      const n = stored(m, c.of, root).filter((r) => {
+        const x = r as Record<string, unknown>;
+        return String(x[c.by]) === pid && (c.present === undefined || (x[c.present] !== undefined && x[c.present] !== null));
+      }).length + (c.plus ?? 0);
+      if (held[field] !== n) await writeDetailed(m, call, parent, pid, { [field]: n }, `${storedType(m, parent)}.counted`, params, root, occurredAt);
+    }
+  }
+}
+
 /** An answer in the vendor's success envelope, under the operation's key, when the vendor has one. */
 function envelope(m: DerivedManifest, op: DerivedOperation, body: Record<string, unknown>): Record<string, unknown> {
   return m.success && op.answers?.key ? { ...m.success, [op.answers.key]: body } : body;
@@ -545,6 +1030,40 @@ export function observeTransitions(observer: TransitionObserver | undefined): vo
 /** What a declared machine says to one move: the transition that allows it, or the refusal it gives (and
  *  nothing when it declares neither). The derived core and `legal` ask it; so does an engine that is not
  *  HTTP-shaped (a line protocol's session), so one machine rules every wire. */
+/** What a delivery's answer writes on its endpoint (the endpoint kind's `outcome`, architecture "Events and webhooks"):
+ *  a success resets the failure count and writes its fields; a failure counts, and a run of them makes the declared
+ *  move, asked of the endpoint's machine as the vendor's (a move the machine does not allow is not made). Read fresh
+ *  and written in one move, since the answer arrives after the write's own and answers may arrive together. */
+async function deliveryOutcome(m: DerivedManifest, answer: DeliveryAnswer, root?: string): Promise<void> {
+  const o = answer.kind.outcome!;
+  const type = answer.kind.storedAs;
+  const ok = answer.status >= 200 && answer.status < 300;
+  // the read and the count are one move under the action lock, so two answers at once count twice
+  await runAsVendorMove(() => applyTwinWriteAtomic(m.service, (resources) => {
+    const row = (resources as unknown as Array<Record<string, unknown>>).find((r) => r.type === type && String(r.id) === String(answer.row.id));
+    if (!row || row.deleted === true) return { kind: 'skip', value: undefined };
+    const fields: Record<string, unknown> = {};
+    let operation = `${type}.delivered`;
+    if (ok) {
+      fields[o.failures] = 0;
+      const seconds = Math.floor((Date.parse(answer.occurredAt) || 0) / 1000);
+      for (const [k, v] of Object.entries(o.success ?? {})) fields[k] = v === '$time.iso' ? answer.occurredAt : v === '$time.s' ? seconds : v;
+    } else {
+      const failures = (Number(row[o.failures]) || 0) + 1;
+      fields[o.failures] = failures;
+      operation = `${type}.delivery-failed`;
+      const exempt = o.unless !== undefined && row[o.unless.field] === o.unless.equals;
+      if (o.move && o.after !== undefined && failures >= o.after && !exempt) {
+        const decl = Object.values(m.resources).find((r) => (r.storedAs ?? '') === type) ?? m.resources[type];
+        const machine = decl?.state?.[o.move.field];
+        const { move } = machine ? transitionFor(o.move.field, machine, o.move.operation, row[o.move.field], o.move.to, String(row.id), 'vendor') : {};
+        if (move) { fields[o.move.field] = o.move.to; operation = o.move.operation; }
+      }
+    }
+    return { kind: 'write', value: undefined, write: { operation, subjectType: type, subjectId: String(row.id), fields, occurredAt: answer.occurredAt, actor: { kind: 'system' } } };
+  }, root));
+}
+
 export function transitionFor(field: string, decl: StateField, operationId: string, current: unknown, requested: unknown, id?: string, actor: Actor = 'api'): { move?: Transition; refusal?: ErrorSpec } {
   const now = stateOf(decl, current);
   const candidates = decl.transitions.filter((t) => (t.actor ?? 'api') === actor && (t.operation ? t.operation === operationId : true) && (requested === undefined || (t.to ?? now) === String(requested)));
@@ -616,7 +1135,153 @@ async function boundaryParams(m: DerivedManifest, call: DerivedCall, root?: stri
   return adoptedInCall(m.service, await readParams(m, call.request, call.operation), root);
 }
 
+/** The refusal a subject's fields would draw from its resource's `unique` rules: another live subject (not `except`)
+ *  already holds every field of a rule, each field given. */
+function conflictOf(m: DerivedManifest, resource: string, fields: Record<string, unknown>, except: string | undefined, root: string | undefined): ErrorSpec | undefined {
+  for (const rule of m.resources[resource]?.unique ?? []) {
+    if (rule.fields.some((f) => fields[f] === undefined || fields[f] === null)) continue;
+    const held = stored(m, resource, root).some((r) => r.id !== except && rule.fields.every((f) => (r as Record<string, unknown>)[f] === fields[f]));
+    if (held) return rule.refusal;
+  }
+  return undefined;
+}
+
+/** A subject deleted through the write path, after every subject its resource's `cascade` takes with it (depth first). */
+async function removeSubject(m: DerivedManifest, call: DerivedCall, resource: string, id: string, params: Record<string, unknown>, root: string | undefined, at: string, operation?: string): Promise<void> {
+  for (const child of m.resources[resource]?.cascade ?? []) {
+    for (const row of stored(m, child.resource, root).filter((r) => (r as Record<string, unknown>)[child.field] === id)) {
+      await removeSubject(m, call, child.resource, String(row.id), params, root, at);
+    }
+  }
+  await write(m, call, resource, id, { deleted: true }, operation ?? `${storedType(m, resource)}.delete`, params, root, at);
+}
+
+/** Whether a key names a stored subject: its id, or one of the resource's alternate keys. */
+const namedBy = (decl: ResourceDecl | undefined, row: object, key: unknown): boolean =>
+  (row as { id?: unknown }).id === key || (decl?.alternateKeys ?? []).some((f) => key !== undefined && key !== null && (row as Record<string, unknown>)[f] === key);
+
+const isBag = (v: unknown): v is Record<string, unknown> => !!v && typeof v === 'object' && !Array.isArray(v);
+
+/** One field of an update, as the resource's `update` rule merges it into what is stored. */
+/** A bag with every `null` key removed, at every level (a deep merge's new branch: null removes a key "at any level"). */
+const withoutNulls = (bag: Record<string, unknown>): Record<string, unknown> =>
+  Object.fromEntries(Object.entries(bag).filter(([, v]) => v !== null).map(([k, v]) => [k, isBag(v) ? withoutNulls(v) : v]));
+
+export function mergeField(rule: ResourceDecl['update'], prior: unknown, next: unknown): unknown {
+  if (rule === 'deep' && isBag(next) && !isBag(prior)) return withoutNulls(next);
+  if (rule === 'replace' || !isBag(next) || !isBag(prior)) return next;
+  if (rule === 'deep') {
+    const out: Record<string, unknown> = { ...prior };
+    for (const [k, v] of Object.entries(next)) {
+      if (v === null) delete out[k];
+      else out[k] = isBag(v) && isBag(out[k]) ? mergeField('deep', out[k], v) : v;
+    }
+    return out;
+  }
+  return Object.fromEntries(Object.entries({ ...prior, ...next }).filter(([, value]) => value !== ''));
+}
+
+/** A list's rows as the resource declares them arranged for this call: its field filters, its search, its order (the
+ *  `orderBy` parameter's, else `order`, else newest first); a refusal when the call orders by a field it does not take. */
+function arrangeRows(m: DerivedManifest, resource: string, params: Record<string, unknown>, input: Array<Record<string, unknown>>): Array<Record<string, unknown>> | ErrorSpec {
+  const decl = m.resources[resource];
+  let rows = input;
+  for (const f of decl?.filters ?? []) if (params[f] !== undefined) rows = rows.filter((r) => String(r[f]) === String(params[f]));
+  const needle = decl?.search ? params[decl.search.param] : undefined;
+  if (decl?.search && typeof needle === 'string' && needle !== '') {
+    const q = needle.toLowerCase();
+    rows = rows.filter((r) => (decl.search!.exact ?? []).some((f) => String(r[f] ?? '').toLowerCase() === q) || (decl.search!.partial ?? []).some((f) => String(r[f] ?? '').toLowerCase().includes(q)));
+  }
+  let order: { field: string; direction: 'asc' | 'desc' } = decl?.order ?? { field: 'created', direction: 'desc' };
+  // a declared ordering parameter orders text by its text; without one, the order is numeric, as it always was
+  let byText = false;
+  if (decl?.orderBy) {
+    const asked = params[decl.orderBy.param];
+    const spec = typeof asked === 'string' && asked !== '' ? asked : decl.orderBy.default;
+    const field = spec.replace(/^[+-]/, '');
+    if (!decl.orderBy.fields.includes(field)) return { ...decl.orderBy.invalid, message: decl.orderBy.invalid.message.replace('{fields}', decl.orderBy.fields.join(', ')) };
+    order = { field, direction: spec.startsWith('-') ? 'desc' : 'asc' };
+    byText = true;
+  }
+  const indexed = rows.map((row, i) => ({ row, i }));
+  indexed.sort((a, b) => {
+    const x = a.row[order.field]; const y = b.row[order.field];
+    const byValue = !byText || typeof x === 'number' || typeof y === 'number' ? Number(x ?? 0) - Number(y ?? 0) : String(x ?? '').localeCompare(String(y ?? ''));
+    // ties by mint order (`file-twin-10` after `file-twin-9`), not by the ids' lexical order
+    const d = byValue || String(a.row.id).localeCompare(String(b.row.id), undefined, { numeric: true });
+    return order.direction === 'desc' ? -d : d;
+  });
+  return indexed.map((x) => x.row);
+}
+
+/** A page of arranged rows, answered in the manifest's list envelope with its paging (cursors, pages, offsets). */
+function pageRows(m: DerivedManifest, op: DerivedOperation, call: DerivedCall, params: Record<string, unknown>, rows: Array<Record<string, unknown>>, resource: string, root: string | undefined, paths: string[]): Response {
+  const size = m.list.limits?.[op.id] ?? m.list.limit;
+  const asked = params[m.list.limit.param];
+  const n = asked === undefined || asked === '' ? size.default : Number(asked);
+  const limit = Number.isFinite(n) ? Math.min(size.max, Math.max(1, Math.trunc(n))) : size.default;
+  const after = m.list.after ? params[m.list.after] : undefined;
+  const before = m.list.before ? params[m.list.before] : undefined;
+  let from = 0;
+  let to: number;
+  if (typeof before === 'string') {
+    const at = rows.findIndex((r) => r.id === before);
+    to = at === -1 ? (m.list.unknownCursor === 'end' ? 0 : rows.length) : at;
+    from = Math.max(0, to - limit);
+  } else {
+    if (typeof after === 'string') {
+      const at = rows.findIndex((r) => r.id === after);
+      from = at === -1 ? (m.list.unknownCursor === 'end' ? rows.length : 0) : at + 1;
+    }
+    to = from + limit;
+  }
+  const page = rows.slice(from, to).map((r) => (paths.length ? expand(m, resource, r, paths.filter((p) => p.startsWith('data.')).map((p) => p.slice(5)), root) : r));
+  const hasMore = typeof before === 'string' ? from > 0 : to < rows.length;
+  const url = op.path.replace(/\{[^}]+\}/g, (p) => call.params[p.slice(1, -1)] ?? p);
+  if (m.list.page) {
+    const n = Math.max(1, Math.floor(Number(params[m.list.page.param]) || 1));
+    const slice = rows.slice((n - 1) * limit, n * limit);
+    const last = Math.max(1, Math.ceil(rows.length / limit));
+    const headers = new Headers();
+    if (m.list.page.link && rows.length > limit) {
+      const at = (k: number): string => {
+        const u = new URL(call.request.url);
+        u.searchParams.set(m.list.page!.param, String(k));
+        return u.toString();
+      };
+      const rels = [...(n > 1 ? [`<${at(n - 1)}>; rel="prev"`] : []), ...(n < last ? [`<${at(n + 1)}>; rel="next"`, `<${at(last)}>; rel="last"`] : []), ...(n > 1 ? [`<${at(1)}>; rel="first"`] : [])];
+      if (rels.length) headers.set('link', rels.join(', '));
+    }
+    // `{total_count}` the count before paging, `{max_page}` the number of pages (none for an empty list: Polar's pagination)
+    return Response.json(fill(m.list.envelope, { data: slice, next_cursor: null, key: op.answers?.key ?? 'data', total_count: rows.length, max_page: Math.ceil(rows.length / limit) }), { headers });
+  }
+  if (m.list.offset) {
+    const skip = Math.max(0, Math.trunc(Number(params[m.list.offset.param]) || 0));
+    const slice = rows.slice(skip, skip + limit);
+    const key = op.answers?.key ?? 'data';
+    return Response.json({ ...(m.success ?? {}), [key]: slice, ...(fill(m.list.envelopes?.[op.id] ?? m.list.envelope, { data: slice, total_count: rows.length, key }) as object) });
+  }
+  if (m.list.cursor) {
+    const start = decodeOffset(params[m.list.cursor.param]);
+    const slice = rows.slice(start, start + limit);
+    const next = start + limit < rows.length ? encodeOffset(start + limit) : '';
+    return Response.json({ ...(m.success ?? {}), ...(fill(m.list.envelope, { data: slice, next_cursor: next, key: op.answers?.key ?? 'data' }) as object), ...(op.answers?.key ? { [op.answers.key]: slice } : {}) });
+  }
+  return Response.json(fill(m.list.envelope, { data: page, has_more: hasMore, url, first_id: page[0]?.id ?? null, last_id: page.at(-1)?.id ?? null }));
+
+}
+
 /** Serve one operation from the manifest, or say why the core cannot. */
+/** A setting's fields as the vendor answers them: its own, without the kernel's bookkeeping or the parent it is kept
+ *  under (a setting answers its values, not an identity). */
+function settingFields(own: Record<string, unknown>, parentField?: string): Record<string, unknown> {
+  return Object.fromEntries(Object.entries(own).filter(([k]) => !k.startsWith('_') && k !== 'deleted' && k !== parentField));
+}
+function settingView(m: DerivedManifest, resource: string, hit: TwinResource): Record<string, unknown> {
+  // ownFields: the kernel's id, type and updatedAt gone, a vendor's own of those names restored
+  return settingFields(ownFields(hit), m.resources[resource]?.parent?.field);
+}
+
 export async function serveCore(m: DerivedManifest, call: DerivedCall, scope: CoreScope = {}): Promise<CoreOutcome> {
   const root = scope.root;
   const at = (scope.clock ?? worldNow)();
@@ -632,7 +1297,12 @@ export async function serveCore(m: DerivedManifest, call: DerivedCall, scope: Co
   if (orphan) return { served: orphan };
   const parent = decl.parent;
   const parentId = parent ? parentValue(parent, call.params) : undefined;
-  const underParent = (r: TwinResource): boolean => !parent || (r as Record<string, unknown>)[parent.field] === parentId;
+  // the caller's tenant, when the vendor has tenancy and the resource is not shared by every tenant
+  const tenantField = m.tenant && !decl.shared ? m.tenant.field : undefined;
+  const tenant = tenantField && scope.tenant ? await scope.tenant(await contextFor(m, { ...call, request: call.request.clone() }, scope)) : undefined;
+  if (tenantField && tenant === undefined) return { unmodeled: `the caller names no tenant (semantics/tenant.ts) for ${resource}` };
+  const underParent = (r: TwinResource): boolean => (!parent || (r as Record<string, unknown>)[parent.field] === parentId)
+    && (!tenantField || (r as Record<string, unknown>)[tenantField] === tenant);
   const paths = expandPaths(m, params);
   // the vendor's success status from its spec: 201 for most creates, 204 with no body where it answers nothing
   const status = op.successStatus ?? 200;
@@ -641,90 +1311,58 @@ export async function serveCore(m: DerivedManifest, call: DerivedCall, scope: Co
   });
   const control = new Set([m.expandParam, m.list.limit.param, m.list.after, m.list.before, m.list.offset?.param].filter(Boolean) as string[]);
   const data = Object.fromEntries(Object.entries(params).filter(([k]) => !control.has(k) && k !== 'id'));
+  // a strict vendor refuses a body it does not declare before the core writes it (body.strict, as ctx.fields)
+  if (m.body.strict && (op.class === 'create' || op.class === 'update')) {
+    const queried = new Set((op.query ?? []).map((q) => q.name));
+    const checked = strictFields(m, op, Object.fromEntries(Object.entries(data).filter(([k]) => !queried.has(k) && !(k in call.params))));
+    if ('refused' in checked) return { served: checked.refused };
+  }
 
   switch (op.class) {
     case 'create': {
       for (const field of Object.keys(decl.state ?? {})) if (field in data) return { unmodeled: `create sets state field ${field}` };
       if (decl.key) return { unmodeled: 'a create under a composite key is a handler' };
       const provided = m.ids.acceptProvided && typeof params.id === 'string' && params.id ? params.id : undefined;
-      const id = provided ?? mintId(m, resource, root);
+      const id = provided ?? mintId(m, resource, root, at);
       const assigned = Object.fromEntries(Object.entries(decl.assigned ?? {}).map(([k, rule]) => [k, applyRule(m, rule, id, data, at)]));
       const initial = Object.fromEntries(Object.entries(decl.state ?? {}).map(([k, s]) => [k, s.initial]));
-      const under = parent ? { [parent.field]: parentId } : {};
+      const under: Record<string, unknown> = { ...(parent ? { [parent.field]: parentId } : {}), ...(tenantField ? { [tenantField]: tenant } : {}) };
       if (decl.number) {
-        const siblings = stored(m, resource, root, { withDeleted: true }).filter((r) => !parent || (r as Record<string, unknown>)[parent.field] === parentId);
+        const siblings = stored(m, resource, root, { withDeleted: true }).filter(underParent);
         (under as Record<string, unknown>)[decl.number.field] = 1 + siblings.reduce((n, r) => Math.max(n, Number((r as Record<string, unknown>)[decl.number!.field]) || 0), 0);
       }
-      return answer(await write(m, call, resource, id, { ...assigned, ...initial, ...under, ...data }, `${storedType(m, resource)}.create`, params, root, at));
+      const made = { ...assigned, ...initial, ...under, ...data };
+      const clash = conflictOf(m, resource, made, undefined, root);
+      if (clash) return { served: vendorError(m, clash) };
+      return answer(await write(m, call, resource, id, made, `${storedType(m, resource)}.create`, params, root, at));
     }
     case 'retrieve': {
-      const hit = idParam ? stored(m, resource, root).find((r) => r.id === idParam && underParent(r)) : undefined;
+      const hit = idParam ? stored(m, resource, root).find((r) => namedBy(decl, r, idParam) && underParent(r)) : undefined;
+      // a setting never written answers its defaults; one written answers them under what was written
+      if (decl.setting) return answer({ ...decl.setting.defaults, ...(hit ? settingView(m, resource, hit) : {}) });
       return hit ? answer(view(m, resource, hit)) : { served: notFound(m, resource, String(idParam), Object.keys(call.params).at(-1)) };
     }
     case 'list': {
-      let rows = stored(m, resource, root).filter(underParent).map((r) => view(m, resource, r));
-      for (const f of decl.filters ?? []) if (params[f] !== undefined) rows = rows.filter((r) => String(r[f]) === String(params[f]));
-      const order = decl.order ?? { field: 'created', direction: 'desc' as const };
-      rows.sort((a, b) => {
-        // ties by mint order (`file-twin-10` after `file-twin-9`), not by the ids' lexical order
-        const d = Number(a[order.field] ?? 0) - Number(b[order.field] ?? 0) || String(a.id).localeCompare(String(b.id), undefined, { numeric: true });
-        return order.direction === 'desc' ? -d : d;
-      });
-      const size = m.list.limits?.[op.id] ?? m.list.limit;
-      const asked = params[m.list.limit.param];
-      const n = asked === undefined || asked === '' ? size.default : Number(asked);
-      const limit = Number.isFinite(n) ? Math.min(size.max, Math.max(1, Math.trunc(n))) : size.default;
-      const after = m.list.after ? params[m.list.after] : undefined;
-      const before = m.list.before ? params[m.list.before] : undefined;
-      let from = 0;
-      let to: number;
-      if (typeof before === 'string') {
-        const at = rows.findIndex((r) => r.id === before);
-        to = at === -1 ? (m.list.unknownCursor === 'end' ? 0 : rows.length) : at;
-        from = Math.max(0, to - limit);
-      } else {
-        if (typeof after === 'string') {
-          const at = rows.findIndex((r) => r.id === after);
-          from = at === -1 ? (m.list.unknownCursor === 'end' ? rows.length : 0) : at + 1;
-        }
-        to = from + limit;
-      }
-      const page = rows.slice(from, to).map((r) => (paths.length ? expand(m, resource, r, paths.filter((p) => p.startsWith('data.')).map((p) => p.slice(5)), root) : r));
-      const hasMore = typeof before === 'string' ? from > 0 : to < rows.length;
-      const url = op.path.replace(/\{[^}]+\}/g, (p) => call.params[p.slice(1, -1)] ?? p);
-      if (m.list.page) {
-        const n = Math.max(1, Math.floor(Number(params[m.list.page.param]) || 1));
-        const slice = rows.slice((n - 1) * limit, n * limit);
-        const last = Math.max(1, Math.ceil(rows.length / limit));
-        const headers = new Headers();
-        if (m.list.page.link && rows.length > limit) {
-          const at = (k: number): string => {
-            const u = new URL(call.request.url);
-            u.searchParams.set(m.list.page!.param, String(k));
-            return u.toString();
-          };
-          const rels = [...(n > 1 ? [`<${at(n - 1)}>; rel="prev"`] : []), ...(n < last ? [`<${at(n + 1)}>; rel="next"`, `<${at(last)}>; rel="last"`] : []), ...(n > 1 ? [`<${at(1)}>; rel="first"`] : [])];
-          if (rels.length) headers.set('link', rels.join(', '));
-        }
-        return { served: Response.json(fill(m.list.envelope, { data: slice, next_cursor: null, key: op.answers?.key ?? 'data' }), { headers }) };
-      }
-      if (m.list.offset) {
-        const skip = Math.max(0, Math.trunc(Number(params[m.list.offset.param]) || 0));
-        const slice = rows.slice(skip, skip + limit);
-        const key = op.answers?.key ?? 'data';
-        return { served: Response.json({ ...(m.success ?? {}), [key]: slice, ...(fill(m.list.envelopes?.[op.id] ?? m.list.envelope, { data: slice, total_count: rows.length, key }) as object) }) };
-      }
-      if (m.list.cursor) {
-        const start = decodeOffset(params[m.list.cursor.param]);
-        const slice = rows.slice(start, start + limit);
-        const next = start + limit < rows.length ? encodeOffset(start + limit) : '';
-        return { served: Response.json({ ...(m.success ?? {}), ...(fill(m.list.envelope, { data: slice, next_cursor: next, key: op.answers?.key ?? 'data' }) as object), ...(op.answers?.key ? { [op.answers.key]: slice } : {}) }) };
-      }
-      return { served: Response.json(fill(m.list.envelope, { data: page, has_more: hasMore, url, first_id: page[0]?.id ?? null, last_id: page.at(-1)?.id ?? null })) };
+      const rows = stored(m, resource, root).filter(underParent).map((r) => view(m, resource, r));
+      const arranged = arrangeRows(m, resource, params, rows);
+      if (!Array.isArray(arranged)) return { served: vendorError(m, arranged) };
+      return { served: pageRows(m, op, call, params, arranged, resource, root, paths) };
     }
     case 'update':
     case 'action': {
-      const hit = idParam ? stored(m, resource, root).find((r) => r.id === idParam && underParent(r)) : undefined;
+      const hit = idParam ? stored(m, resource, root).find((r) => namedBy(decl, r, idParam) && underParent(r)) : undefined;
+      // a setting's update merges what is given over what it holds (its defaults until first written), making it
+      if (decl.setting && op.class === 'update' && idParam) {
+        const current = { ...decl.setting.defaults, ...(hit ? settingView(m, resource, hit) : {}) };
+        const merged: Record<string, unknown> = {};
+        for (const [k, v] of Object.entries(data)) merged[k] = mergeField(decl.update, current[k], v);
+        const under = { ...(parent ? { [parent.field]: parentId } : {}), ...(tenantField ? { [tenantField]: tenant } : {}) };
+        await write(m, call, resource, hit?.id ?? String(idParam), { ...under, ...merged }, `${storedType(m, resource)}.update`, params, root, at);
+        // a setting whose update the spec documents with no content answers none (a specification that omits a body
+        // elsewhere is not trusted this far: only a setting's update reads it)
+        if (op.emptySuccess) return { served: new Response(null, { status }) };
+        return answer({ ...current, ...merged });
+      }
       if (!hit) return { served: notFound(m, resource, String(idParam), Object.keys(call.params).at(-1)) };
       const current = view(m, resource, hit);
       const changes: Record<string, unknown> = { ...(op.class === 'update' ? data : {}) };
@@ -745,16 +1383,15 @@ export async function serveCore(m: DerivedManifest, call: DerivedCall, scope: Co
       }
       if (op.class === 'action' && !moved) return { unmodeled: `action ${op.id} declares no transition` };
       const merged: Record<string, unknown> = {};
-      for (const [k, v] of Object.entries(changes)) {
-        const prior = current[k];
-        merged[k] = decl.update !== 'replace' && v && typeof v === 'object' && !Array.isArray(v) && prior && typeof prior === 'object' && !Array.isArray(prior) ? Object.fromEntries(Object.entries({ ...(prior as object), ...(v as object) }).filter(([, value]) => value !== '')) : v;
-      }
+      for (const [k, v] of Object.entries(changes)) merged[k] = mergeField(decl.update, current[k], v);
+      const clash = conflictOf(m, resource, { ...current, ...merged }, hit.id, root);
+      if (clash) return { served: vendorError(m, clash) };
       return answer(await write(m, call, resource, hit.id, merged, `${storedType(m, resource)}.${op.class === 'update' ? 'update' : op.id}`, params, root, at));
     }
     case 'delete': {
-      const hit = idParam ? stored(m, resource, root).find((r) => r.id === idParam && underParent(r)) : undefined;
+      const hit = idParam ? stored(m, resource, root).find((r) => namedBy(decl, r, idParam) && underParent(r)) : undefined;
       if (!hit) return { served: notFound(m, resource, String(idParam), Object.keys(call.params).at(-1)) };
-      await write(m, call, resource, hit.id, { deleted: true }, `${storedType(m, resource)}.delete`, params, root, at);
+      await removeSubject(m, call, resource, hit.id, params, root, at);
       const shape = decl.deleted !== undefined ? decl.deleted : m.deleted;
       return { served: status === 204 || shape === null ? new Response(null, { status: 204 }) : Response.json(fill(shape, { id: hit.id, object: current(hit) }), { status }) };
     }
@@ -798,17 +1435,67 @@ export type SemanticsContext = {
   text: string;
   root: string | undefined;
   occurredAt: string;
+  /** The twin's own base URL as this request reached it (its links and redirects to its own pages carry it). */
+  publicBase: string;
+  /** What the World's scenario decided for this turn (a model vendor's answer: the handler matched, or the miss), on an
+   *  operation the pack's `semantics/scenario.ts` names; undefined elsewhere, or when the World carries no scenario. */
+  scenario: ScenarioDecision | undefined;
+  /** A message the vendor sends the application's own server that no declared event is (a push notification), through
+   *  the World's route and egress rule: the receiver's status, or 0 when refused or unreachable. */
+  deliver(url: string, init: RequestInit): Promise<number>;
+  /** A message the vendor sends the application's server and decides by its answer, waited on for at most `within`
+   *  milliseconds (a real-time authorization request): its status and body, or why there was none. */
+  ask(url: string, init: RequestInit, within: number): Promise<ApplicationAnswer>;
+  /** A git repository of the World, by the pack's name for it (the git plane, world-core git/): its objects in the
+   *  World's content-addressed object store (one per service), its refs in the World's store. Served over smart HTTP
+   *  (`git.serveSmartHttp`), read and written through the library's codecs. */
+  git(name: string): { store: GitObjectStore; refs: GitRefs };
+  /** A value the World set for its application (world-env.ts): what the app was given and the vendor must agree with (a
+   *  webhook signing secret the app verifies with), never the caller's own shell; undefined when the World sets none. */
+  worldEnv(name: string): string | undefined;
+  /** Runs `fn` as the vendor's own move, not the caller's: what time makes due (a renewal a read catches up) is
+   *  recorded with no caller, wherever a handler reaches it. */
+  asVendor<T>(fn: () => Promise<T>): Promise<T>;
+  /** A mail the vendor sends a person, over SMTP to the route its settings name (smtp.ts), under the World's egress rule;
+   *  throws when it cannot be delivered. */
+  mail(route: SmtpRoute, mail: Mail, headers?: Record<string, string>): Promise<void>;
   /** who is calling, when the manifest says how to tell */
   actor: string | undefined;
   now(): unknown;
   get(resource: string, id: string): Record<string, unknown> | undefined;
+  /** One credential subject in a manifest-declared owner's World store. Ambiguous stores refuse the read. */
+  ownerRow(owner: string, resource: string, id: string): Record<string, unknown> | undefined;
   rows(resource: string): Array<Record<string, unknown>>;
   mint(resource: string): string;
+  /** An id the vendor issues for what it does not keep (a completion's, a request's): minted, and its subject recorded,
+   *  so the next is another; a read-only request mints without recording. The resource is a declared bookkeeping type. */
+  issue(resource: string): Promise<string>;
+  /** The vendor's open sessions of one of its sockets in this World (a request answered by a session: sockets.ts). */
+  sockets(id: string): SocketSession[];
+  /** A secret for `label` (an app's client secret, a store's read token): an HMAC under a seed the World makes once, at
+   *  random, and keeps as bookkeeping no door answers. The same label gives the same secret for the World's whole life,
+   *  and no one can compute it from ids the World shows, as they can a value derived from them alone. */
+  secret(label: string): Promise<string>;
+  /** The World's machine pool (machines.ts), as the pack's `machine-pool` door enrolled it; `none` when none was. */
+  machines: MachinePool;
+  /** A signing key pair for `label` (an issuer's ID tokens, a provider's JWTs, a CA's or a log's key), PEM: RSA 2048
+   *  (the default) or Ed25519, made once, at random, when the label is first asked for, and kept as bookkeeping no door
+   *  answers, so what it signs verifies against the World's published key (ctx.crypto.jwks of the public half) and no
+   *  one can forge it from anything the pack or the World shows, as they can with a key written in the pack. */
+  signingKey(label: string, alg?: 'RS256' | 'Ed25519'): Promise<{ privatePem: string; publicPem: string }>;
+  /** The signing key for `label` when the World has made it (`signingKey`), else undefined: for code that signs where it
+   *  cannot wait (a cookie's token, read everywhere), after a front made the key before anything is answered. */
+  heldSigningKey(label: string, alg?: 'RS256' | 'Ed25519'): { privatePem: string; publicPem: string } | undefined;
   write(resource: string, id: string, fields: Record<string, unknown>, operation: string): Promise<Record<string, unknown>>;
+  /** Add numeric deltas to an existing bookkeeping row under the kernel's atomic write seam. */
+  accumulate(resource: string, id: string, deltas: Record<string, number>, operation: string): Promise<void>;
   /** `write`, with what a live vendor answered when the head performed it */
   writeDetailed(resource: string, id: string, fields: Record<string, unknown>, operation: string): Promise<{ body: Record<string, unknown>; id: string; vendorData?: unknown }>;
   /** The id a subject has now, for an id a caller may still use from before the vendor minted its own
    *  (a branch naming a message by the ts it minted locally). */
+  /** The tree's type a resource's rows are kept under (the manifest's `storedAs`, else its name): what an operation on
+   *  it is named by (`issuing_card.create`), as the vendor names the events it sends. */
+  storedType(resource: string): string;
   resolve(resource: string, id: string): string;
   /** Answer the vendor's success envelope around several fields (`{ ok: true, ts, channel, message }`). */
   ok(fields: Record<string, unknown>): Response;
@@ -830,6 +1517,8 @@ export type SemanticsContext = {
   /** Whether the machine lets `operationId` move `field` from `current` (to `to`): nothing when it
    *  does, the vendor's refusal when it does not. A move the machine does not declare throws. */
   legal(resource: string, field: string, operationId: string, current: unknown, to?: string, id?: string, actor?: Actor): ErrorSpec | undefined;
+  /** Validate the request body's top-level derived schema under body.validation, before a write. */
+  validate(): Response | undefined;
   refuse(e: ErrorSpec): Response;
   notFound(resource: string, id: string, param?: string): Response;
   reply(body: unknown, status?: number): Response;
@@ -837,7 +1526,7 @@ export type SemanticsContext = {
   wrap(body: Record<string, unknown>, extra?: Record<string, unknown>): Response;
   /** Answer as a server-sent event stream, framed as the manifest says. */
   sse(events: Array<{ event?: string; data: unknown }>): Response;
-  expand(resource: string, body: Record<string, unknown>): Record<string, unknown>;
+  expand(resource: string, body: Record<string, unknown>, paths?: string[]): Record<string, unknown>;
   /** This context at another moment of the World clock (ISO): a move time makes is written at the moment it fell due. */
   at(when: string): Promise<SemanticsContext>;
   /** This call's context over another manifest of the same service, at the same moment: a lane over its vendor's
@@ -847,6 +1536,47 @@ export type SemanticsContext = {
   core(): Promise<Response | undefined>;
   /** A stored row's own fields, as the vendor's object carries them (an `id`, `type` or `updatedAt` of its own restored). */
   own(row: Record<string, unknown>): Record<string, unknown>;
+  /** A handler's own rows (views) answered as the call's list: the resource's filters, search and order, then the
+   *  manifest's paging and envelope; the vendor's refusal when the call orders by a field the resource does not take. */
+  list(resource: string, rows: Array<Record<string, unknown>>): Response;
+  /** The vendor's refusal when these fields would make a second live subject where the resource's `unique` rules allow
+   *  one (`except`: the subject being updated), or nothing. */
+  conflict(resource: string, fields: Record<string, unknown>, except?: string): Response | undefined;
+  /** A subject deleted as the vendor deletes it: every subject its resource's `cascade` names deleted first, then it,
+   *  each through the write path (`operation` names the subject's own delete when it is not `<stored type>.delete`). */
+  remove(resource: string, id: string, operation?: string): Promise<void>;
+  /** The subject a key names, by its id (an alias the caller may still use resolved) or one of the resource's
+   *  `alternateKeys` (an organization by its slug), as the vendor serves it. */
+  find(resource: string, key: string): Record<string, unknown> | undefined;
+  /** A field's new value as the resource's `update` rule merges it into the stored one (`deep`: Clerk's metadata). */
+  merge(resource: string, prior: unknown, next: unknown): unknown;
+  /** What a handler signs and hashes with (signing.ts): JWTs with a pack's key, their verification, a JWKS, an HMAC and
+   *  a SHA-256, deterministic, so no pack reaches `node:crypto` itself. */
+  crypto: HandlerCrypto;
+  /** The World's managed Postgres (managed-database.ts): one transaction per batch, as a role with its settings, or a
+   *  script. A World that binds none refuses every use with the reason (EngineUnavailableError). */
+  engine: ManagedDatabase;
+  /** A vendor's Redis (the kernel's Redis library, redis/engine.ts): a request's commands run in order over this call's
+   *  tree and clock, in the pack's own service, under its wire's dialect, in one of its databases (`database`: its keys
+   *  and scripts apart from the others'); each answered `{result}` or `{error}`, and whether any wrote. A read-only
+   *  World raises ReadOnlyError at the first write. The wire around it (Upstash's REST envelope) is the pack's. */
+  redis(commands: string[][], options: { dialect: RedisDialect; database?: string }): Promise<{ items: RunItem[]; wrote: boolean }>;
+  /** Another vendor's own URL answered by the World's twin of it (vendor-call.ts): a vendor's call to another as part of
+   *  its behaviour (Clerk exchanging a Google sign-in's code). A vendor the World runs no twin of is refused
+   *  (VendorUnreachableError); nothing leaves the World. */
+  vendorFetch(url: string | URL, init?: RequestInit): Promise<Response>;
+  /** A multipart/form-data body's parts in order (multipart.ts: field name, filename, media type, bytes), a part with an
+   *  empty field name included; none for any other body. */
+  parts(): Promise<MultipartPart[]>;
+  /** The pack's resource blobs (an object's bytes), by key, on the World's branch: they branch with the World, and a
+   *  read falls back to an ancestor's. The row that names a blob is the pack's; the bytes are here. */
+  blobs: { put(key: string, bytes: Uint8Array): Promise<void>; get(key: string): Promise<Uint8Array | null>; remove(key: string): Promise<void> };
+  /** A body's fields checked against the operation's declared ones under the manifest's `body.strict`: the fields, or
+   *  the vendor's refusal of the first that is unknown, of another type or out of its bounds. */
+  fields(body: Record<string, unknown>): { fields: Record<string, unknown> } | { refused: Response };
+  /** A parameter as the vendor reads a boolean (the manifest's `booleans`): true, false, or undefined for a value that
+   *  is neither (absent, or text the vendor does not read as one). A boolean passes as itself. */
+  flag(value: unknown): boolean | undefined;
 };
 export type Semantics = (ctx: SemanticsContext) => Promise<Response>;
 
@@ -863,18 +1593,29 @@ export type HandlerContext = Omit<SemanticsContext, 'now' | 'core' | 'atomically
 };
 /** What a write hook reads: the writing call's context without its ways to write, so a hook that renders an event
  *  cannot write again (and run itself again). */
-export type WriteHookContext = Omit<HandlerContext, 'write' | 'record' | 'at' | 'over'>;
+export type WriteHookContext = Omit<HandlerContext, 'write' | 'record' | 'accumulate' | 'at' | 'over'>;
 /** A derived pack's handler: one operation, by its operationId, over the contract's context. */
 export type Handler = (ctx: HandlerContext) => Promise<Response>;
 
-async function contextFor(m: DerivedManifest, call: DerivedCall, scope: CoreScope): Promise<SemanticsContext> {
+/** The context the kernel opens for a call (a handler's, a door's, a screen's). Kernel-internal: packs are given it. */
+export async function contextFor(m: DerivedManifest, call: DerivedCall, scope: CoreScope): Promise<SemanticsContext> {
   const root = scope.root;
   const asAsked = call;
   call = adoptedPath(m, call, root);
   const at = (scope.clock ?? worldNow)();
-  const text = await call.request.clone().text().catch(() => '');
-  let body: unknown = undefined;
-  try { body = text ? JSON.parse(text) : undefined; } catch { body = text; }
+  // the guard's parse when it made one (taken once), else this context's own
+  const parsed = takeParsedBody(call.request);
+  const text = parsed ? '' : await bodyTextOf(call.request.clone()).catch(() => '');
+  let body: unknown = parsed?.value;
+  if (!parsed) { try { body = text ? JSON.parse(text) : undefined; } catch { body = text; } }
+  // the request as it came, before the core's parameter merge and alias adoption: what a write records, so a perform
+  // can send it again (the real-system adapters, "What the derived core records with a write")
+  const boundary = multipartBoundary(call.request.headers.get('content-type'));
+  const parts = boundary === null ? undefined : multipartParts(new Uint8Array(await call.request.clone().arrayBuffer()), boundary);
+  // a body that is not JSON is recorded as it came, its type with it: text as text, bytes (a gzip the vendor's client
+  // compressed itself, PostHog's `compression=gzip-js`) as base64
+  const raw = !parts && typeof body === 'string' && body !== '' ? await rawBody(call.request) : undefined;
+  sentOf.set(call, { ...sentRequest(m, asAsked, parts ? Object.fromEntries(parts.filter((p) => p.filename === null).map((p) => [p.name, new TextDecoder().decode(p.body)])) : raw ?? body), ...(parts ? { parts } : {}), ...(raw ? { type: call.request.headers.get('content-type') ?? undefined } : {}) });
   // a handler reading the body itself sees the adopted id too (the boundary's one resolution, below)
   if (body && typeof body === 'object' && !Array.isArray(body)) body = adoptedInCall(m.service, body as Record<string, unknown>, root);
   // every read of the body is of a copy, so the handler's own `call.request` and the core's answer (`core()`) each
@@ -890,17 +1631,65 @@ async function contextFor(m: DerivedManifest, call: DerivedCall, scope: CoreScop
     text,
     root,
     occurredAt: at,
+    publicBase: twinPublicBase(call.request),
+    scenario: scenarioDecisionOf(call.request),
+    deliver: (url, init) => deliverToApplication(url, init),
+    ask: (url, init, within) => askApplication(url, init, within),
+    worldEnv: (name) => worldEnvValue(name),
+    asVendor: (fn) => runAsVendorMove(fn),
+    git: (name) => {
+      if (!/^[A-Za-z0-9_.-]+(\/[A-Za-z0-9_.-]+)*$/.test(name) || name.split('/').some((seg) => seg === '.' || seg === '..')) throw new Error(`semantics: ${name} is not a git repository name`);
+      const plane = `${worldPaths(m.service, root).dir}/git`;
+      return { store: new GitObjectStore(getActiveBlobStore(), `${plane}/objects`), refs: new GitRefs(getActiveWorldStore(), `${plane}/repos/${name}`) };
+    },
+    mail: (route, mail, headers) => sendMail(route, mail, headers),
     actor: m.identity ? m.identity(call.request.headers.get('authorization'), root) : undefined,
     now: () => now(m, at),
     get: (resource, id) => {
       const hit = stored(m, resource, root).find((r) => r.id === id);
       return hit ? view(m, resource, hit) : undefined;
     },
+    ownerRow: (owner, resource, id) => {
+      if (!m.ownerReads?.some((r) => r.owner === owner && r.resource === resource)) throw new Error(`semantics: undeclared owner read ${owner}/${resource}`);
+      const row = projectOwnerResources(owner, root, { type: resource, id }).find((r) => r.type === resource && r.id === id);
+      return row ? { ...ownFields(row), ...(row.deleted === true ? { deleted: true } : {}) } : undefined;
+    },
     rows: (resource) => stored(m, resource, root).map((r) => view(m, resource, r)),
-    mint: (resource) => mintId(m, resource, root),
+    mint: (resource) => mintId(m, resource, root, at),
+    sockets: (id) => openSessions(m.service, root, id),
+    issue: async (resource) => {
+      const id = mintId(m, resource, root, at);
+      if (!resource.startsWith('_')) throw new Error(`semantics: ${resource} is not a bookkeeping type (an issued id's type starts with _)`);
+      if (scope.readOnly !== true && !isReadOnlyRequest(call.request)) {
+        await applyTwinWrite(m.service, { operation: `${resource.slice(1)}.issue`, subjectType: storedType(m, resource), subjectId: id, fields: { issuedAt: at }, occurredAt: at, actor: { kind: 'system' } }, root);
+      }
+      return id;
+    },
+    secret: async (label) => hmac(await worldSeed(m.service, root, at), label, 'base64url'),
+    get machines() {
+      const enrolled = resourcesOfType(m.service, MACHINE_POOL, root).find((r) => r.id === 'pool') as unknown as { kind?: MachinePool['kind'] } | undefined;
+      return poolFor(m.service, root, enrolled?.kind ?? 'none');
+    },
+    signingKey: (label, alg) => worldSigningKey(m.service, root, at, label, alg ?? 'RS256'),
+    heldSigningKey: (label, alg) => heldWorldSigningKey(m.service, root, label, alg ?? 'RS256'),
     write: (resource, id, fields, operation) => write(m, call, resource, id, fields, operation, params, root, at),
+    accumulate: async (resource, id, deltas, operation) => {
+      if (!resource.startsWith('_') || !m.resources[resource]) throw new Error('accumulate requires a declared bookkeeping resource');
+      await applyTwinWriteAtomic(m.service, (resources) => {
+        const prior = resources.find((row) => row.type === storedType(m, resource) && row.id === id && row.deleted !== true);
+        if (!prior) throw new Error('accumulate requires an existing bookkeeping row');
+        const fields: Record<string, number> = {};
+        for (const [field, delta] of Object.entries(deltas)) {
+          const value = prior[field];
+          if (typeof value !== 'number' || !Number.isFinite(value) || !Number.isFinite(delta) || !Number.isFinite(value + delta)) throw new Error('accumulate requires finite numeric fields and deltas');
+          fields[field] = value + delta;
+        }
+        return { kind: 'write', value: undefined, write: { operation, subjectType: storedType(m, resource), subjectId: id, fields, occurredAt: at, actor: { kind: 'agent' } } };
+      }, root);
+    },
     writeDetailed: (resource, id, fields, operation) => writeDetailed(m, call, resource, id, fields, operation, params, root, at),
     resolve: (resource, id) => resolveSubjectId(m.service, storedType(m, resource), id, root),
+    storedType: (resource) => storedType(m, resource),
     ok: (fields) => Response.json({ ...(m.success ?? {}), ...fields }),
     row: (resource, id, opts) => stored(m, resource, root, opts).find((r) => r.id === id) as Record<string, unknown> | undefined,
     rowsRaw: (resource, opts) => stored(m, resource, root, opts) as Array<Record<string, unknown>>,
@@ -908,7 +1697,14 @@ async function contextFor(m: DerivedManifest, call: DerivedCall, scope: CoreScop
     history: (resource, id) => subjectHistory(m.service, { type: storedType(m, resource), id }, root).map((e) => ({ ...(e.operation ? { operation: e.operation } : {}), ...(e.fields ? { fields: e.fields as Record<string, unknown> } : {}), ...(e.occurredAt ? { occurredAt: e.occurredAt } : {}) })),
     record: async (type, fields, id) => {
       if (!type.startsWith('_')) throw new Error(`semantics: ${type} is not a bookkeeping type (bookkeeping types start with _)`);
-      const subject = id ?? `${type.slice(1)}_${twinResources(m.service, root).filter((r) => r.type === type).length + 1}`;
+      // an id the caller does not give is the next past every one of this type the tree holds (as `{n}` ids are minted),
+      // never a count of the rows, which a removed row would make repeat
+      const subject = id ?? (() => {
+        const prefix = `${type.slice(1)}_`;
+        let max = 0;
+        for (const r of resourcesOfType(m.service, type, root)) { const n = r.id.startsWith(prefix) ? Number(r.id.slice(prefix.length)) : NaN; if (Number.isInteger(n) && n > max) max = n; }
+        return `${prefix}${max + 1}`;
+      })();
       await applyTwinWrite(m.service, { operation: `${type.slice(1)}.record`, subjectType: type, subjectId: subject, fields, occurredAt: at, actor: { kind: 'system' } }, root);
       return subject;
     },
@@ -937,11 +1733,45 @@ async function contextFor(m: DerivedManifest, call: DerivedCall, scope: CoreScop
     },
     refuse: (e) => vendorError(m, e),
     notFound: (resource, id, param) => notFound(m, resource, id, param),
+    validate: () => validateBody(m, call.operation, body),
     reply: (body, status = 200) => Response.json(body, { status }),
     wrap: (body, extra = {}) => Response.json({ ...envelope(m, call.operation, body), ...extra }),
     sse: (events) => sse(m, events, call.operation.id),
-    expand: (resource, body) => (paths.length ? expand(m, resource, body, paths, root) : body),
+    expand: (resource, body, given) => ((given ?? paths).length ? expand(m, resource, body, given ?? paths, root) : body),
     at: (when) => contextFor(m, { ...call, request: new Request(call.request.url) }, { ...scope, clock: () => when }),
+    crypto: handlerCrypto,
+    flag: (value) => flagOf(m, value),
+    fields: (body) => strictFields(m, call.operation, body),
+    vendorFetch: (url, init) => vendorFetch(url, init),
+    parts: async () => {
+      const boundary = multipartBoundary(call.request.headers.get('content-type'));
+      return boundary === null ? [] : multipartParts(new Uint8Array(await call.request.clone().arrayBuffer()), boundary);
+    },
+    engine: scope.database === undefined ? unboundDatabase(m.service) : managedDatabase(scope.database, { readOnly: scope.readOnly === true || isReadOnlyRequest(call.request), clock: at }),
+    redis: (commands, options) => execRedisRun(commands, {
+      root, occurredAt: at, service: m.service, readOnly: scope.readOnly === true || isReadOnlyRequest(call.request), dialect: options.dialect,
+      ...(options.database === undefined ? {} : { database: options.database }),
+    }),
+    blobs: {
+      put: (key, bytes) => writeResourceBlob(m.service, key, bytes, root),
+      get: (key) => readResourceBlob(m.service, key, root),
+      remove: (key) => removeResourceBlob(m.service, key, root),
+    },
+    merge: (resource, prior, next) => mergeField(m.resources[resource]?.update, prior, next),
+    conflict: (resource, fields, except) => {
+      const clash = conflictOf(m, resource, fields, except, root);
+      return clash ? vendorError(m, clash) : undefined;
+    },
+    remove: (resource, id, operation) => removeSubject(m, call, resource, id, params, root, at, operation),
+    find: (resource, key) => {
+      const id = resolveSubjectId(m.service, storedType(m, resource), key, root);
+      const hit = stored(m, resource, root).find((r) => r.id === id || namedBy(m.resources[resource], r, key));
+      return hit ? view(m, resource, hit) : undefined;
+    },
+    list: (resource, rows) => {
+      const arranged = arrangeRows(m, resource, params, rows);
+      return Array.isArray(arranged) ? pageRows(m, call.operation, call, params, arranged, resource, root, paths) : vendorError(m, arranged);
+    },
     over: (other) => contextFor(other, { ...asAsked, request: asAsked.request.clone() }, { ...scope, clock: () => at }),
     core: async () => { const out = await serveCore(m, { ...call, request: pristine.clone() }, { ...scope, clock: () => at }); return 'served' in out ? out.served : undefined; },
     own: (row) => ownFields(row as unknown as TwinResource),
@@ -971,6 +1801,46 @@ const hex = (s: string): string => Array.from(new TextEncoder().encode(s), (b) =
 
 /** Read-only refusal, API-version validation and idempotent replay, applied once around every
  *  operation a handler or the core serves. */
+/** The vendor's refusal of a request's credential under the manifest's `auth`, or undefined when it passes: what the
+ *  cross-cutting gate answers for an operation, and what a pack whose vendor checks the credential before routing (an
+ *  unknown path answers 401, as Supabase's recording shows) calls in front of its dispatch. */
+/** The header the kernel names a scenario's decision in, set by createPackFetch alone (it strips it from every request it
+ *  is sent). */
+export const SCENARIO_DECISION_HEADER = 'x-volter-scenario-decision';
+function scenarioDecisionOf(request: Request): ScenarioDecision | undefined {
+  const raw = request.headers.get(SCENARIO_DECISION_HEADER);
+  if (!raw) return undefined;
+  try { return JSON.parse(raw) as ScenarioDecision; } catch { return undefined; }
+}
+
+export function authRefusal(m: DerivedManifest, request: Request, root?: string): Response | undefined {
+  if (!m.auth) return undefined;
+  const url = new URL(request.url);
+  if (m.auth.paths !== undefined && !new RegExp(m.auth.paths).test(url.pathname)) return undefined;
+  const sources = [{ header: m.auth.header, scheme: m.auth.scheme }, ...(m.auth.also ?? [])];
+  const given = sources.map((s) => (s.query !== undefined ? url.searchParams.get(s.query) : s.header ? request.headers.get(s.header) : null)).some((v) => v !== null);
+  if (!given && !m.auth.gateWhenAbsent) return undefined;
+  const keyOf = (s: (typeof sources)[number]): string => {
+    if (s.query !== undefined) return (url.searchParams.get(s.query) ?? '').trim();
+    const raw = s.header ? request.headers.get(s.header) : null;
+    if (raw === null) return '';
+    if (!s.scheme) return raw.trim();
+    const scheme = `${s.scheme.toLowerCase()} `;
+    return raw.toLowerCase().startsWith(scheme) ? raw.slice(scheme.length).trim() : '';
+  };
+  const key = sources.map(keyOf).find((k) => k !== '') ?? '';
+  // no credential sent is `missing`; one sent in a form the vendor does not read is a key it does not know
+  if (!key) return vendorError(m, given ? m.auth.invalid : m.auth.missing);
+  if (m.auth.invalidKeys.includes(key) || (m.auth.keyFormat && !new RegExp(m.auth.keyFormat).test(key))) return vendorError(m, m.auth.invalid);
+  const held = m.auth.held;
+  if (held && !held.standing?.includes(key)) {
+    const hash = sha256(key);
+    const holds = resourcesOfType(m.service, held.storedAs, root).some((r) => r.deleted !== true && (r as Record<string, unknown>)[held.hashField] === hash && (held.unless === undefined || (r as Record<string, unknown>)[held.unless] !== true));
+    if (!holds) return vendorError(m, m.auth.invalid);
+  }
+  return undefined;
+}
+
 export function crossCutting(m: DerivedManifest, opts: CoreScope & { readOnly?: boolean } = {}): (call: DerivedCall, next: () => Promise<Response>) => Promise<Response> {
   const finish = async (r: Response, request: Request): Promise<Response> => {
     if (!m.origin || !(r.headers.get('content-type') ?? '').includes('json')) return withHeaders(r);
@@ -986,24 +1856,21 @@ export function crossCutting(m: DerivedManifest, opts: CoreScope & { readOnly?:
   return async (call, next) => finish(await guarded(call, next), call.request);
   async function guarded(call: DerivedCall, next: () => Promise<Response>): Promise<Response> {
     const { request } = call;
-    if (m.auth) {
-      const raw = request.headers.get(m.auth.header);
-      if (raw !== null || m.auth.gateWhenAbsent) {
-        const scheme = `${m.auth.scheme.toLowerCase()} `;
-        const key = raw && raw.toLowerCase().startsWith(scheme) ? raw.slice(scheme.length).trim() : '';
-        if (!key) return vendorError(m, m.auth.missing);
-        if (m.auth.invalidKeys.includes(key) || (m.auth.keyFormat && !new RegExp(m.auth.keyFormat).test(key))) return vendorError(m, m.auth.invalid);
-      }
-    }
+    const refused = m.auth?.exempt?.includes(call.operation.id) ? undefined : authRefusal(m, request, opts.root);
+    if (refused) return refused;
     // a read-only twin refuses writes: what the operation does, not the HTTP verb it came by (an RPC
     // wire POSTs its reads). A read-only REQUEST (x-volter-read-only, request-scope.ts) is refused the
     // same way, up front, on a writable twin.
     const readOnly = opts.readOnly || isReadOnlyRequest(request);
     if (readOnly && !['retrieve', 'list', 'computed'].includes(call.operation.class) && !m.reads?.includes(call.operation.id)) return vendorError(m, m.readOnly);
     // a body labelled JSON that does not parse is the vendor's refusal, never a crash of the twin
-    if ((request.headers.get('content-type') ?? '').includes('json') || m.body.json === 'always') {
-      const text = request.method === 'GET' || request.method === 'HEAD' ? '' : await request.clone().text().catch(() => '');
-      if (text) { try { JSON.parse(text); } catch { return vendorError(m, m.malformedBody ?? { status: 400, message: 'The request body could not be parsed as JSON.' }); } }
+    // (`json: 'always'` reads the vendor's JSON bodies whatever their label, never an operation its spec declares
+    // multipart or form: Cloudflare's asset and script uploads)
+    const declared = call.operation.bodyEncoding;
+    const labelled = request.headers.get('content-type') ?? '';
+    if ((labelled.includes('json') && !labelled.includes('ndjson')) || (m.body.json === 'always' && declared !== 'multipart' && declared !== 'form')) {
+      const ok = request.method === 'GET' || request.method === 'HEAD' ? true : await checkJsonBody(request.clone()).catch(() => true);
+      if (!ok) return vendorError(m, m.malformedBody ?? { status: 400, message: 'The request body could not be parsed as JSON.' });
     }
     if (m.version) {
       const value = request.headers.get(m.version.header);
@@ -1012,7 +1879,7 @@ export function crossCutting(m: DerivedManifest, opts: CoreScope & { readOnly?:
     const key = m.idempotency ? request.headers.get(m.idempotency.header) : null;
     if (!m.idempotency || !key || !(m.idempotency.methods ?? ['POST']).includes(request.method.toUpperCase())) return next();
     const url = new URL(request.url);
-    const signature = hashFieldValue({ path: url.pathname + url.search, body: await request.clone().text() });
+    const signature = hashFieldValue({ path: url.pathname + url.search, body: await bodyTextOf(request.clone()) });
     const id = `idem_${hex(key)}`;
     const prior = twinResources(m.service, opts.root).find((r) => r.type === m.idempotency!.storedAs && r.id === id) as Record<string, unknown> | undefined;
     if (prior) {