@volter/world-core 3.0.161 → 3.0.163

package/src/derived-core.ts

@@ -1,3 +1,5 @@
+import { storageTenant } from './request-scope.ts';
+import { isWorldAccountName } from './world-account-name.ts';
 import { parseExactJson, compareExactNumbers, exactInteger, isExactIntegerValue } from './exact-json.ts';
 // THE DERIVED CORE — what a derived pack does for an operation it declares no handler for
 // (docs/contributing/architecture.md, "Protocol 3"). The generated surface says what the
@@ -20,7 +22,7 @@ import { openSessions, socketWrite, type SocketDecl, type SocketSession } from '
 import { liveAccess } from './live/access.ts';
 import type { LiveAccess, LiveDecl } from './live/types.ts';
 import { awaitWrite, awaitCondition, heldReadsWrite } from './held-reads.ts';
-import { MACHINE_POOL, poolFor, guardedMachinePool, type MachinePool, type MachineHttpReply, type LightPoolOptions } from './machines.ts';
+import { MACHINE_POOL, poolFor, guardedMachinePool, type MachinePool, type MachineHttpReply } from './machines.ts';
 import { askApplication, deliverEvents, type ApplicationAnswer, type ApplicationStandIn, type EventRender, type EventScheme, type EventsDecl, type EventValues } from './events.ts';
 import type { RateBudgetDeclaration } from './rateBudget.ts';
 import { handlerCrypto, hmac, ksuidFrom, lettersFrom, sha256, uuidFrom, type HandlerCrypto } from './signing.ts';
@@ -41,7 +43,7 @@ import type { SubjectFields } from './hash.ts';
 import { twinPublicBase, withRequestScopes } from './twin-fetch.ts';
 import { inVendorMove, isReadOnlyRequest, runAsVendorMove, writesRefused } from './request-scope.ts';
 import type { DerivedCall, DerivedCoreOutcome, DerivedHandler, DerivedOperation } from './derived.ts';
-import type { PackDescriptor } from './packRegistry.ts';
+import { getPack, type PackDescriptor } from './packRegistry.ts';
 import type { ScenarioDecision, ScenarioHandler } from './scenario.ts';
 import { bodyTextOf, checkJsonBody, takeParsedBody } from './derived.ts';
 
@@ -524,7 +526,7 @@ export type DerivedManifest = {
    *  an organization, a team, an account — and a caller reaches only its own tenant's, as a parent's children are
    *  reached under it. `field` holds it on each subject; `semantics/tenant.ts` names the caller's. The core scopes every
    *  read, list, update and delete by it and stamps it on every create, for each resource not `shared`. */
-  tenant?: { field: string };
+  tenant?: { field: string; storage?: 'namespaced' };
   /** The vendor's own lanes behind this manifest's API ("Other wires: lanes"), dispatched by the kernel before the
    *  vendor's own doors, clock and API (LanesDecl). */
   lanes?: LanesDecl;
@@ -744,13 +746,19 @@ function notFound(manifest: DerivedManifest, object: string, id: string, param?:
 
 // ── the tree ─────────────────────────────────────────────────────────────────────────────────
 
-export const storedType = (m: DerivedManifest, resource: string): string => m.resources[resource]?.storedAs ?? resource;
+const TENANT_TYPE = '::account:';
+const accountScope = (m: DerivedManifest): string | undefined => m.tenant?.storage === 'namespaced' ? storageTenant(m.service) : undefined;
+const scopeLabel = (m: DerivedManifest, label: string): string => { const account = accountScope(m); return account && account !== 'default' ? `account:${account}:${label}` : label; };
+export const storedType = (m: DerivedManifest, resource: string): string => {
+  const base = m.resources[resource]?.storedAs ?? resource, account = accountScope(m);
+  return account && account !== 'default' && !m.resources[resource]?.shared ? `${base}${TENANT_TYPE}${encodeURIComponent(account)}` : base;
+};
 
 // A service's resources by type, folded once per World state (the tree's stamp; any write moves it), not on every read:
 // a read of one resource type projected the service's whole tree, so a pack whose tree also holds many subjects of
 // other types (PlanetScale's SQL rows beside its management records) paid for all of them on each read. A read gets its
 // own copy of each resource, as twinResources hands out, with the vendor's own id/type/updatedAt a spread would drop.
-const typeIndexes = new WeakMap<object, Map<string, { stamp: string; byType: Map<string, Map<string, TwinResource>> }>>();
+const typeIndexes = new WeakMap<object, Map<string, { stamp: string; byType: Map<string, Map<string, TwinResource>>; typeByKey: Map<string, string> }>>();
 /** A service's resources of one type, each the reader's own copy: `twinResources` filtered by type, from an index
  *  that follows each write rather than projecting the whole tree per call. */
 export function resourcesOfType(service: string, type: string, root?: string): TwinResource[] {
@@ -764,8 +772,13 @@ export function resourcesOfType(service: string, type: string, root?: string): T
   if (held && delta) {
     // the index keeps the tree's order: a subject updated where it stands stays there, one new to the tree (or made
     // again after a delete) goes to the end in the order the tree holds it
-    for (const k of [...delta.removed, ...delta.appended]) held.byType.get(k.slice(0, k.indexOf(':')))?.delete(k);
+    for (const k of [...delta.removed, ...delta.appended]) {
+      const type = held.typeByKey.get(k);
+      if (type !== undefined) held.byType.get(type)?.delete(k);
+      held.typeByKey.delete(k);
+    }
     const byKey = new Map(delta.changed.map((r) => [`${r.type}:${r.id}`, r]));
+    for (const [k, r] of byKey) held.typeByKey.set(k, r.type);
     for (const [k, r] of byKey) if (!delta.appended.includes(k)) (held.byType.get(r.type) ?? held.byType.set(r.type, new Map()).get(r.type)!).set(k, r);
     for (const k of delta.appended) { const r = byKey.get(k)!; (held.byType.get(r.type) ?? held.byType.set(r.type, new Map()).get(r.type)!).set(k, r); }
     held.stamp = delta.stamp;
@@ -775,7 +788,7 @@ export function resourcesOfType(service: string, type: string, root?: string): T
     if (!held || held.stamp !== stamp) {
       const byType = new Map<string, Map<string, TwinResource>>();
       for (const r of twinResources(service, root)) (byType.get(r.type) ?? byType.set(r.type, new Map()).get(r.type)!).set(`${r.type}:${r.id}`, r);
-      held = { stamp, byType };
+      held = { stamp, byType, typeByKey: new Map([...byType].flatMap(([type, rows]) => [...rows.keys()].map(key => [key, type] as const))) };
       indexes.set(key, held);
     }
   }
@@ -785,7 +798,9 @@ export function resourcesOfType(service: string, type: string, root?: string): T
 function stored(m: DerivedManifest, resource: string, root?: string, opts: { withDeleted?: boolean } = {}): TwinResource[] {
   const type = storedType(m, resource);
   const when = Object.entries(m.resources[resource]?.readableWhen ?? {});
-  return resourcesOfType(m.service, type, root).filter((r) => (opts.withDeleted || r.deleted !== true) && when.every(([k, v]) => (r as Record<string, unknown>)[k] === v));
+  const rows = m.tenant?.storage === 'namespaced' && accountScope(m) === undefined && !m.resources[resource]?.shared
+    ? twinResources(m.service, root).filter(row => row.type === type || row.type.startsWith(`${type}${TENANT_TYPE}`)) : resourcesOfType(m.service, type, root);
+  return rows.filter((r) => (opts.withDeleted || r.deleted !== true) && when.every(([k, v]) => (r as Record<string, unknown>)[k] === v));
 }
 
 /** The subject an item operation names: the manifest's key over the path parameters, or the last one. */
@@ -821,7 +836,7 @@ function missingParent(m: DerivedManifest, resource: string, call: DerivedCall,
   const id = parentValue(parent, call.params);
   const where = Object.entries(parent.where ?? {}).map(([field, template]) => [field, String(fill(template, call.params))] as const);
   const found = (r: TwinResource): boolean => (where.length ? where.every(([field, v]) => String(parentField(r, field)) === v) : r.id === id)
-    && (!m.tenant || m.resources[parent.resource]?.shared || (r as Record<string, unknown>)[m.tenant.field] === tenant);
+    && (!m.tenant || m.tenant.storage === 'namespaced' || m.resources[parent.resource]?.shared || (r as Record<string, unknown>)[m.tenant.field] === tenant);
   return id !== undefined && stored(m, parent.resource, root, { withDeleted: parent.allowDeleted === true }).some(found) ? undefined : notFound(m, parent.resource, String(id), parent.param ?? parent.params?.at(-1));
 }
 
@@ -953,15 +968,90 @@ function worldSeed(service: string, root: string | undefined, at: string): Promi
   const pending = seeding.get(key);
   if (pending) return pending;
   const made = (async () => {
-    const value = Buffer.from(globalThis.crypto.getRandomValues(new Uint8Array(32))).toString('hex');
-    // the World's own bookkeeping, made on first use whatever the request: a read-only one lands it too (a vendor's move)
-    await runAsVendorMove(() => applyTwinWrite(service, { operation: 'world_seed.record', subjectType: SEED, subjectId: 'seed', fields: { value }, occurredAt: at, actor: { kind: 'system' } }, root));
+    // The action lock also joins first asks from several renderers/processes to the same seed.
+    const { value } = await runAsVendorMove(() => applyTwinWriteAtomic(service, snapshot => {
+      const existing = snapshot.find(row => row.type === SEED && row.id === 'seed');
+      if (typeof existing?.value === 'string') return { kind: 'skip', value: existing.value };
+      const value = Buffer.from(globalThis.crypto.getRandomValues(new Uint8Array(32))).toString('hex');
+      return { kind: 'write', value, write: { operation: 'world_seed.record', subjectType: SEED, subjectId: 'seed', fields: { value }, occurredAt: at, actor: { kind: 'system' } } };
+    }, root));
     return value;
   })().finally(() => seeding.delete(key));
   seeding.set(key, made);
   return made;
 }
 
+/** World-owned generated values use the same private seed and log as pack secrets. */
+export async function worldSecret(service: string, root: string, label: string, at = new Date().toISOString()): Promise<string> {
+  return hmac(await worldSeed(service, root, at), label, 'base64url');
+}
+
+/** The same retained account primitive for pack doors and private native twin fronts. */
+export async function worldAccount(service: string, root: string | undefined, id: unknown = 'default', at = worldNow(), provisioning = false): Promise<string> {
+  if (!isWorldAccountName(id)) throw new Error('Credential account must be a name of at most 128 letters, digits, dots, underscores or hyphens');
+  await applyTwinWriteAtomic(service, (snapshot) => {
+    const held = snapshot.find(row => row.type === '_world_account' && row.id === id);
+    return held ? { kind: 'skip', value: id } : { kind: 'write', value: id, write: { operation: 'world_account.create', subjectType: '_world_account', subjectId: id, fields: { name: id }, ...(provisioning ? { input: { activity: 'provisioning' } } : {}), occurredAt: at, actor: { kind: 'system' } } };
+  }, root);
+  return id;
+}
+
+type WorldOrganization = { id: string; label: string; members: string[] };
+type VendorNameRule = { max: number; lower?: boolean; allowed: RegExp; separator?: string; first?: RegExp };
+type NativeAccountLink = { resource: string; id: string };
+
+function nativeAccountLink(row: TwinResource | undefined, field?: string): NativeAccountLink | undefined {
+  if (!row || row.deleted === true) return undefined;
+  const fields = ownFields(row);
+  const value = field === undefined ? fields : fields[field];
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return undefined;
+  const link = value as Record<string, unknown>;
+  return typeof link.resource === 'string' && typeof link.id === 'string' ? { resource: link.resource, id: link.id } : undefined;
+}
+
+const sameAccountLink = (a: NativeAccountLink | undefined, b: NativeAccountLink | undefined): boolean =>
+  a?.resource === b?.resource && a?.id === b?.id;
+
+/** Native creation and reconstruction run outside the action lock; only the retained link is compared and written. */
+async function retainNativeAccountLink<T>(
+  service: string, root: string | undefined, at: string, call: DerivedCall,
+  type: string, id: string, field: string | undefined, resource: string,
+  make: () => Promise<string>, read: (link: NativeAccountLink) => Promise<T | undefined>,
+): Promise<T> {
+  for (;;) {
+    const before = nativeAccountLink(resourcesOfType(service, type, root).find((row) => row.id === id), field);
+    const held = before && await read(before);
+    if (held !== undefined) return held;
+    const made = { resource, id: await make() };
+    if (await read(made) === undefined) throw new Error(`Credential ${type}/${id}: native ${resource}/${made.id} is unavailable after creation`);
+    const { value } = await applyTwinWriteAtomic(service, (snapshot) => {
+      const current = nativeAccountLink(snapshot.find((row) => row.type === type && row.id === id), field);
+      if (!sameAccountLink(current, before)) return { kind: 'skip', value: current };
+      return {
+        kind: 'write', value: made,
+        write: {
+          operation: `${type.slice(1)}.link`, subjectType: type, subjectId: id,
+          fields: field === undefined ? made : { name: id, [field]: made },
+          ...provisioningInput(call), occurredAt: at, actor: { kind: 'system' },
+        },
+      };
+    }, root);
+    const linked = value && await read(value);
+    if (linked !== undefined) return linked;
+  }
+}
+
+function vendorName(label: string, rule: VendorNameRule, { suffixed = false, identity = label }: { suffixed?: boolean; identity?: string } = {}): string {
+  const allowed = new RegExp(rule.allowed.source, rule.allowed.flags.replace(/[gy]/g, ''));
+  const separator = rule.separator ?? '-';
+  if ([...separator].length !== 1 || !allowed.test(separator)) throw new Error('Credential name separator must be one allowed character');
+  const first = rule.first && new RegExp(rule.first.source, rule.first.flags.replace(/[gy]/g, ''));
+  let name = [...(rule.lower ? label.toLowerCase() : label)].map((letter) => allowed.test(letter) ? letter : separator).join('');
+  name = name.replace(new RegExp(`${escapeRe(separator)}+`, 'g'), separator);
+  if (first && !first.test(name[0] ?? '')) name = `w${separator}${name}`;
+  return name !== label || name.length > rule.max || suffixed ? `${name.slice(0, Math.max(0, rule.max - 9))}${separator}${sha256(identity).slice(0, 8)}` : name;
+}
+
 /** A World's signing key for a label (ctx.signingKey): made once from the platform's random source, then read; the
  *  making is one per service store and label in the process, as the seed's is. */
 const SIGNING_KEY = '_world_signing_key';
@@ -995,7 +1085,13 @@ function worldSigningKey(service: string, root: string | undefined, at: string,
   return made;
 }
 
-function mintId(m: DerivedManifest, resource: string, root?: string, at?: string, snapshot?: readonly TwinResource[]): string {
+/** Vendor ids remain unique across its accounts, including public links that carry an id instead of a key. */
+function mintRows(m: DerivedManifest, resource: string, root?: string, snapshot?: readonly TwinResource[]): readonly TwinResource[] {
+  const base = m.resources[resource]?.storedAs ?? resource;
+  if (m.tenant?.storage === 'namespaced') return (snapshot ?? twinResources(m.service, root)).filter(row => row.type === base || row.type.startsWith(`${base}${TENANT_TYPE}`));
+  return snapshot ? snapshot.filter(row => row.type === base) : resourcesOfType(m.service, base, root);
+}
+function mintId(m: DerivedManifest, resource: string, root: string | undefined, at: string, snapshot?: readonly TwinResource[]): string {
   if (!m.resources[resource]) throw new Error(`mint: ${resource} is not a resource ${m.vendor}'s manifest declares`);
   const prefix = m.resources[resource]!.idPrefix;
   const template = m.resources[resource]!.ids ?? m.ids.template;
@@ -1012,7 +1108,7 @@ function mintId(m: DerivedManifest, resource: string, root?: string, at?: string
   if (digits) {
     const width = Number(digits[1]);
     if (!Number.isInteger(width) || width < 1 || width > 77) throw new Error('mint: decimal width must be between 1 and 77');
-    const held = new Set((snapshot ? snapshot.filter((r) => r.type === storedType(m, resource)) : resourcesOfType(m.service, storedType(m, resource), root)).map((r) => r.id));
+    const held = new Set(mintRows(m, resource, root, snapshot).map((r) => r.id));
     const floor = 10n ** BigInt(width - 1);
     for (let n = held.size + 1; ; n++) {
       const id = String(floor + BigInt('0x' + sha256(`${m.service}:${resource}:${n}`)) % (9n * floor));
@@ -1031,7 +1127,7 @@ function mintId(m: DerivedManifest, resource: string, root?: string, at?: string
   const pattern = new RegExp(`^${escapeRe(String(fill(head!, { prefix })))}(\\d+)${escapeRe(String(fill(tail, { prefix })))}$`);
   let max = 0n;
   // the one type, from the index that follows writes (a scan of the whole World per create grew with it)
-  for (const r of (snapshot ? snapshot.filter((r) => r.type === storedType(m, resource)) : resourcesOfType(m.service, storedType(m, resource), root))) {
+  for (const r of mintRows(m, resource, root, snapshot)) {
     const hit = pattern.exec(r.id);
     if (hit && BigInt(hit[1]!) > max) max = BigInt(hit[1]!);
   }
@@ -1045,13 +1141,13 @@ function mintId(m: DerivedManifest, resource: string, root?: string, at?: string
 /** The last snowflake minted per vendor and World in this process: two mints before the first is written (a message
  *  and its attachment) must not meet. */
 const lastSnowflake = new Map<string, bigint>();
-function mintSnowflake(m: DerivedManifest, epoch: bigint, root?: string, at?: string, snapshot?: readonly TwinResource[]): string {
-  const ms = BigInt(Date.parse(at ?? '') || 0);
+function mintSnowflake(m: DerivedManifest, epoch: bigint, root: string | undefined, at: string, snapshot?: readonly TwinResource[]): string {
+  const ms = BigInt(Date.parse(at) || 0);
   const base = ms > epoch ? (ms - epoch) << 22n : 0n;
   let max = -1n;
   for (const [name, decl] of Object.entries(m.resources)) {
     if (!/^\{snowflake:\d+\}$/.test(decl.ids ?? m.ids.template)) continue;
-    for (const r of (snapshot ? snapshot.filter((r) => r.type === storedType(m, name)) : resourcesOfType(m.service, storedType(m, name), root))) if (/^\d+$/.test(r.id)) { const v = BigInt(r.id); if (v > max) max = v; }
+    for (const r of mintRows(m, name, root, snapshot)) if (/^\d+$/.test(r.id)) { const v = BigInt(r.id); if (v > max) max = v; }
   }
   const key = `${m.service}\0${root ?? ''}`;
   const last = lastSnowflake.get(key) ?? -1n;
@@ -1063,9 +1159,9 @@ function mintSnowflake(m: DerivedManifest, epoch: bigint, root?: string, at?: st
 
 /** The next KSUID for a resource (Clerk's and Svix's ids, `ksuidFrom`): the World's instant, then the type's mint
  *  count, so a frozen clock still lists them as made; past any the World already holds. */
-function mintKsuid(m: DerivedManifest, resource: string, at: string | undefined, root?: string, prefix = '', snapshot?: readonly TwinResource[], width = 27): string {
-  const held = new Set((snapshot ? snapshot.filter((r) => r.type === storedType(m, resource)) : resourcesOfType(m.service, storedType(m, resource), root)).map((r) => r.id));
-  const seconds = Math.floor((Date.parse(at ?? '') || 0) / 1000);
+function mintKsuid(m: DerivedManifest, resource: string, at: string, root: string | undefined, prefix: string, snapshot: readonly TwinResource[] | undefined, width: number): string {
+  const held = new Set(mintRows(m, resource, root, snapshot).map((r) => r.id));
+  const seconds = Math.floor((Date.parse(at) || 0) / 1000);
   for (let n = held.size + 1; ; n++) {
     const id = `${prefix}${ksuidFrom(seconds, n, `${m.service}:${resource}:${n}`, width)}`;
     if (!held.has(id)) return id;
@@ -1074,8 +1170,8 @@ function mintKsuid(m: DerivedManifest, resource: string, at: string | undefined,
 
 /** The next id of `count` lowercase letters for a resource, derived from the resource and the count before it, past
  *  any the World already holds. */
-function mintLetters(m: DerivedManifest, resource: string, count: number, root?: string, prefix = '', snapshot?: readonly TwinResource[]): string {
-  const held = new Set((snapshot ? snapshot.filter((r) => r.type === storedType(m, resource)) : resourcesOfType(m.service, storedType(m, resource), root)).map((r) => r.id));
+function mintLetters(m: DerivedManifest, resource: string, count: number, root: string | undefined, prefix: string, snapshot?: readonly TwinResource[]): string {
+  const held = new Set(mintRows(m, resource, root, snapshot).map((r) => r.id));
   for (let n = held.size + 1; ; n++) {
     const id = `${prefix}${lettersFrom(`${m.service}:${resource}:${n}`, count)}`;
     if (!held.has(id)) return id;
@@ -1084,8 +1180,8 @@ function mintLetters(m: DerivedManifest, resource: string, count: number, root?:
 
 /** The next hex id for a resource: N hex digits derived from the resource and the count before it, past any the World
  *  already holds (a Cloudflare id, 32). */
-function mintHex(m: DerivedManifest, resource: string, count: number, root?: string, prefix = '', snapshot?: readonly TwinResource[]): string {
-  const held = new Set((snapshot ? snapshot.filter((r) => r.type === storedType(m, resource)) : resourcesOfType(m.service, storedType(m, resource), root)).map((r) => r.id));
+function mintHex(m: DerivedManifest, resource: string, count: number, root: string | undefined, prefix: string, snapshot?: readonly TwinResource[]): string {
+  const held = new Set(mintRows(m, resource, root, snapshot).map((r) => r.id));
   for (let n = held.size + 1; ; n++) {
     const id = `${prefix}${sha256(`${m.service}:${resource}:${n}`).slice(0, count)}`;
     if (!held.has(id)) return id;
@@ -1095,8 +1191,7 @@ function mintHex(m: DerivedManifest, resource: string, count: number, root?: str
 /** The next UUID for a resource: a version-4-shaped UUID derived from the resource and the count before it, past any
  *  the World already holds. */
 function mintUuid(m: DerivedManifest, resource: string, root?: string, snapshot?: readonly TwinResource[]): string {
-  const type = storedType(m, resource);
-  const held = new Set((snapshot ? snapshot.filter((r) => r.type === type) : resourcesOfType(m.service, type, root)).map((r) => r.id));
+  const held = new Set(mintRows(m, resource, root, snapshot).map((r) => r.id));
   for (let n = held.size + 1; ; n++) {
     const id = uuidFrom(`${m.service}:${resource}:${n}`);
     if (!held.has(id)) return id;
@@ -1352,13 +1447,14 @@ async function finishWrite(m: DerivedManifest, call: DerivedCall, resource: stri
   // the managed database), at the write's moment
   const request = requestOfCall.get(call) ?? call.request;
   const context = (): Promise<SemanticsContext> => contextFor(m, { ...call, request: request.clone() }, { ...(scopeOfCall.get(call) ?? {}), ...(root !== undefined ? { root } : {}), clock: () => occurredAt });
-  if (m.onWrite) await m.onWrite({ operation, storedType: storedType(m, resource), body, ...(root !== undefined ? { root } : {}), occurredAt, request: request.clone(), context });
+  if (m.onWrite) await m.onWrite({ operation, storedType: m.resources[resource]?.storedAs ?? resource, body, ...(root !== undefined ? { root } : {}), occurredAt, request: request.clone(), context });
   if (m.events) {
-    const events = m.events;
-    const write = { operation, storedType: storedType(m, resource), body, ...(root !== undefined ? { root } : {}), occurredAt, request: request.clone() };
+    const endpoint = (kind: import('./events.ts').EndpointsDecl): import('./events.ts').EndpointsDecl => ({ ...kind, storedAs: storedType(m, kind.storedAs), ...(kind.joins ? { joins: Object.fromEntries(Object.entries(kind.joins).map(([name, join]) => [name, { ...join, storedAs: storedType(m, join.storedAs) }])) } : {}) });
+    const events = { ...m.events, ...(m.events.store ? { store: storedType(m, m.events.store) } : {}), endpoints: 'storedAs' in m.events.endpoints ? endpoint(m.events.endpoints) : m.events.endpoints.map(endpoint) };
+    const write = { operation, storedType: m.resources[resource]?.storedAs ?? resource, body, ...(root !== undefined ? { root } : {}), occurredAt, request: request.clone() };
     await deliverEvents(m.service, events, write, async (type) => (events.render ? events.render(await context(), write, type) : body), undefined, events.values ? async (type) => events.values!(await context(), write, type) : undefined);
   }
-  if (m.sockets?.length) socketWrite(m.service, root, { operation, storedType: storedType(m, resource), body, ...(root !== undefined ? { root } : {}), occurredAt, request: request.clone() });
+  if (m.sockets?.length) socketWrite(m.service, root, { operation, storedType: m.resources[resource]?.storedAs ?? resource, body, ...(root !== undefined ? { root } : {}), occurredAt, request: request.clone() });
   // a read held until the World writes (held-reads.ts) hears it
   heldReadsWrite(m.service, root, storedType(m, resource));
   // the subject's id as it stands after the write: the vendor's, when a live head minted one
@@ -1517,21 +1613,21 @@ function adoptedPath(m: DerivedManifest, call: DerivedCall, root?: string): Deri
 /** A call's fields with each declared reference that names an adopted subject by its local id moved to the adopted
  *  id. A call (a handler's operation) need not say which subject type it writes, so every reference the pack declares
  *  is tried: a field is rewritten only when its value is a local id the alias map holds for the reference's target. */
-function adoptedInCall(service: string, fields: Record<string, unknown>, root?: string): Record<string, unknown> {
-  const refs = packReferences(service);
+function adoptedInCall(m: DerivedManifest, fields: Record<string, unknown>, root?: string): Record<string, unknown> {
+  const service = m.service, refs = packReferences(service);
   if (refs.length === 0) return fields;
   const aliases = aliasesNow(service, root);
   if (aliases.size === 0) return fields;
   let out = fields;
   for (const ref of refs) {
     const local = ref.key(out as SubjectFields);
-    const adopted = local === undefined ? undefined : aliases.get(`${ref.to}:${local}`);
+    const adopted = local === undefined ? undefined : aliases.get(`${storedType(m, ref.to)}:${local}`);
     if (adopted !== undefined && adopted !== local) out = { ...out, ...ref.adopt(out as SubjectFields, adopted) };
   }
   return out;
 }
 async function boundaryParams(m: DerivedManifest, call: DerivedCall, root?: string): Promise<Record<string, unknown>> {
-  return adoptedInCall(m.service, await readParams(m, call.request, call.operation), root);
+  return adoptedInCall(m, await readParams(m, call.request, call.operation), root);
 }
 
 /** The refusal a subject's fields would draw from its resource's `unique` rules: another live subject (not `except`)
@@ -1726,7 +1822,7 @@ export async function serveCore(m: DerivedManifest, call: DerivedCall, scope: Co
   const parent = parentOfCall(decl, call);
   const parentId = parent ? parentValue(parent, call.params) : undefined;
   // the caller's tenant, when the vendor has tenancy and the resource is not shared by every tenant
-  const tenantField = m.tenant && !decl.shared ? m.tenant.field : undefined;
+  const tenantField = m.tenant?.storage !== 'namespaced' && m.tenant && !decl.shared ? m.tenant.field : undefined;
   const tenant = tenantField && scope.tenant ? await scope.tenant(await contextFor(m, { ...call, request: call.request.clone() }, scope)) : undefined;
   if (tenantField && tenant === undefined) return { unmodeled: `the caller names no tenant (semantics/tenant.ts) for ${resource}` };
   const orphan = missingParent(m, resource, call, root, tenant);
@@ -1917,6 +2013,20 @@ export type SemanticsContext = {
    *  random, and keeps as bookkeeping no door answers. The same label gives the same secret for the World's whole life,
    *  and no one can compute it from ids the World shows, as they can a value derived from them alone. */
   secret(label: string): Promise<string>;
+  /** Select an account at a pack's credential door. Packs retain their own vendor account/key semantics. */
+  account(field?: string): Promise<string>;
+  /** The selected organization's label and people from the World's organization registry. */
+  organization(): Promise<WorldOrganization>;
+  /** The selected deployment, or an empty string for the organization's own level. */
+  deployment(): string;
+  /** A vendor-safe label; retained links keep identity independent of names. */
+  vendorName(label: string, rule: VendorNameRule, options?: { suffixed?: boolean; identity?: string }): string;
+  /** Retain the native customer tenant for the selected organization. */
+  tenant(resource: string, make: (organization: WorldOrganization) => Promise<string>): Promise<Record<string, unknown>>;
+  /** Retain one native resource of this kind for the selected organization and deployment. */
+  deploymentObject(kind: string, resource: string, make: (deployment: string) => Promise<string>): Promise<Record<string, unknown>>;
+  /** Reconstruct a live native key, replacing its link when the vendor's reader refuses it. */
+  accountKey(purpose: string, resource: string, key: { make: () => Promise<string>; read: (row: Record<string, unknown>) => Promise<string | undefined> }): Promise<{ id: string; secret: string }>;
   /** The World's machine pool (machines.ts), as the pack's `machine-pool` door enrolled it; `none` when none was. */
   machines: MachinePool;
   /** A signing key pair for `label` (an issuer's ID tokens, a provider's JWTs, a CA's or a log's key), PEM: RSA 2048
@@ -1930,7 +2040,7 @@ export type SemanticsContext = {
   /** Allocate a stored occurrence and append its fields under one action lock. The optional field factory is pure. */
   create(resource: string, fields: Record<string, unknown> | ((id: string) => Record<string, unknown>), operation: string): Promise<Record<string, unknown>>;
   /** Create under declared unique keys and the action lock; a collision returns the existing own-field view without a write. */
-  createUnique(resource: string, fields: Record<string, unknown> | ((id: string) => Record<string, unknown>), operation: string, options?: { input: 'omit' }): Promise<{ created: boolean; row: Record<string, unknown> }>;
+  createUnique(resource: string, fields: Record<string, unknown> | ((id: string) => Record<string, unknown>), operation: string, options?: { input?: 'omit'; id?: string }): Promise<{ created: boolean; row: Record<string, unknown> }>;
   /** Decide an update from the current live stored row under the action lock; undefined leaves it unchanged. */
   change(resource: string, id: string, decide: (row: Record<string, unknown>) => Record<string, unknown> | undefined, operation: string, options?: { input: 'omit' }): Promise<Record<string, unknown> | undefined>;
   write(resource: string, id: string, fields: Record<string, unknown>, operation: string): Promise<Record<string, unknown>>;
@@ -2063,7 +2173,7 @@ export type HandlerContext = Omit<SemanticsContext, 'now' | 'core' | 'atomically
 };
 /** What a write hook reads: the writing call's context without its ways to write, so a hook that renders an event
  *  cannot write again (and run itself again). */
-export type WriteHookContext = Omit<HandlerContext, 'write' | 'batch' | 'create' | 'createUnique' | 'change' | 'issue' | 'record' | 'accumulate' | 'at' | 'over'>;
+export type WriteHookContext = Omit<HandlerContext, 'write' | 'batch' | 'create' | 'createUnique' | 'change' | 'issue' | 'record' | 'accumulate' | 'tenant' | 'deploymentObject' | 'accountKey' | 'at' | 'over'>;
 /** A derived pack's handler: one operation, by its operationId, over the contract's context. */
 export type Handler = (ctx: HandlerContext) => Promise<Response>;
 
@@ -2098,7 +2208,7 @@ export async function contextFor(m: DerivedManifest, call: DerivedCall, scope: C
   const raw = !parts && typeof body === 'string' && body !== '' ? await rawBody(call.request) : undefined;
   sentOf.set(call, { ...sentRequest(m, asAsked, parts ? Object.fromEntries(parts.filter((p) => p.filename === null).map((p) => [p.name, new TextDecoder().decode(p.body)])) : raw ?? body), ...(parts ? { parts } : {}), ...(raw ? { type: call.request.headers.get('content-type') ?? undefined } : {}) });
   // a handler reading the body itself sees the adopted id too (the boundary's one resolution, below)
-  if (body && typeof body === 'object' && !Array.isArray(body)) body = adoptedInCall(m.service, body as Record<string, unknown>, root);
+  if (body && typeof body === 'object' && !Array.isArray(body)) body = adoptedInCall(m, body as Record<string, unknown>, root);
   // every read of the body is of a copy, so the handler's own `call.request` and the core's answer (`core()`) each
   // still find it unread, whichever of them reads it first
   const pristine = call.request.clone();
@@ -2111,12 +2221,25 @@ export async function contextFor(m: DerivedManifest, call: DerivedCall, scope: C
   });
   const paths = expandPaths(m, params);
   const stateChecks: StateChecks = new Map();
+  const credentialDoor = m.descriptor?.credentialDoor ?? getPack(m.vendor)?.credentialDoor;
+  const credentialFields = body && typeof body === 'object' && !Array.isArray(body) ? body as Record<string, unknown> : {};
   const rawResources = new WeakMap<Record<string, unknown>, string>();
   const rawRow = (resource: string, row: TwinResource): Record<string, unknown> => {
     const name = m.resources[resource] ? resource : Object.keys(m.resources).find((name) => storedType(m, name) === row.type);
+    if (m.tenant?.storage === 'namespaced') {
+      const [base, encoded] = row.type.split(TENANT_TYPE);
+      const owner = m.resources[name ?? resource]?.shared && row[m.tenant.field] !== undefined ? row[m.tenant.field] : encoded ? decodeURIComponent(encoded) : 'default';
+      row = copyResource(row);
+      row.type = base!;
+      row[m.tenant.field] = owner;
+    }
     rawResources.set(row as Record<string, unknown>, name ?? resource);
     return row as Record<string, unknown>;
   };
+  const liveNativeRow = (link: NativeAccountLink): Record<string, unknown> | undefined => {
+    const row = context.row(link.resource, link.id);
+    return row && row.deleted !== true ? row : undefined;
+  };
   const context: SemanticsContext = {
     call,
     params,
@@ -2131,7 +2254,7 @@ export async function contextFor(m: DerivedManifest, call: DerivedCall, scope: C
     asVendor: (fn) => runAsVendorMove(fn),
     git: (name) => {
       if (!/^[A-Za-z0-9_.-]+(\/[A-Za-z0-9_.-]+)*$/.test(name) || name.split('/').some((seg) => seg === '.' || seg === '..')) throw new Error(`semantics: ${name} is not a git repository name`);
-      const plane = `${worldPaths(m.service, root).dir}/git`;
+      const plane = `${worldPaths(m.service, root).dir}/git${accountScope(m) && accountScope(m) !== 'default' ? `/accounts/${encodeURIComponent(accountScope(m)!)}` : ''}`;
       return { store: new GitObjectStore(getActiveBlobStore(), `${plane}/repos/${name}`), refs: new GitRefs(getActiveWorldStore(), `${plane}/repos/${name}`) };
     },
     mail: (route, mail, headers) => sendMail(route, mail, headers),
@@ -2168,16 +2291,50 @@ export async function contextFor(m: DerivedManifest, call: DerivedCall, scope: C
       return value;
     },
     occurredAt: at,
-    secret: async (label) => hmac(await worldSeed(m.service, root, at), label, 'base64url'),
+    secret: async (label) => hmac(await worldSeed(m.service, root, at), scopeLabel(m, label), 'base64url'),
+    account: async (field = credentialDoor?.account?.field ?? 'account') => {
+      return worldAccount(m.service, root, credentialFields[field] ?? 'default', at, call.request.headers.get('x-volter-world-activity') === 'provisioning');
+    },
+    organization: async () => {
+      const id = await context.account();
+      const row = projectOwnerResources('_world', root, { type: '_world_organization', id }).find((row) => row.type === '_world_organization' && row.id === id && row.deleted !== true);
+      return row ? { id, label: row.label as string, members: [...(row.members as string[])] } : { id, label: id, members: ['owner@world.test'] };
+    },
+    deployment: () => {
+      const id = credentialFields[credentialDoor?.deployment?.field ?? 'deployment'] ?? '';
+      if (id !== '' && !isWorldAccountName(id)) throw new Error('Credential deployment must be a name of at most 128 letters, digits, dots, underscores or hyphens');
+      return id;
+    },
+    vendorName,
+    tenant: async (resource, make) => {
+      const id = await context.account();
+      return retainNativeAccountLink(m.service, root, at, call, '_world_account', id, 'tenant', resource,
+        async () => make(await context.organization()), async (link) => liveNativeRow(link));
+    },
+    deploymentObject: async (kind, resource, make) => {
+      const organization = await context.account(), deployment = context.deployment();
+      return retainNativeAccountLink(m.service, root, at, call, '_world_deployment_object', `${organization}/${deployment}/${kind}`, undefined, resource,
+        () => make(deployment), async (link) => liveNativeRow(link));
+    },
+    accountKey: async (purpose, resource, key) => {
+      const organization = await context.account(), deployment = context.deployment();
+      return retainNativeAccountLink(m.service, root, at, call, '_world_account_key', `${organization}/${deployment}/${purpose}`, undefined, resource,
+        () => key.make(), async (link) => {
+          const row = liveNativeRow(link);
+          if (!row) return undefined;
+          const secret = await key.read(row);
+          return secret === undefined ? undefined : { id: link.id, secret };
+        });
+    },
     record: async (type, fields, id, operation) => {
       if (!type.startsWith('_')) throw new Error(`semantics: ${type} is not a bookkeeping type (bookkeeping types start with _)`);
       // a bookkeeping subject a resource counts (`counts` naming it: sentry's issue users) keeps that count as any
       // child does, the parent it left recounted too
-      const keeps = counted(m, type);
+      const keeps = counted(m, type), physicalType = storedType(m, type);
       if (id !== undefined) {
         const before = operation ? stateBeforeWrite(m, type, id, root) : undefined;
-        const prior = keeps ? resourcesOfType(m.service, type, root).find((r) => r.id === id) : undefined;
-        const { resource: row, result } = await applyTwinWrite(m.service, { operation: operation ?? `${type.slice(1)}.record`, subjectType: type, subjectId: id, fields, ...provisioningInput(call), occurredAt: at, actor: { kind: 'system' } }, root);
+        const prior = keeps ? resourcesOfType(m.service, physicalType, root).find((r) => r.id === id) : undefined;
+        const { resource: row, result } = await applyTwinWrite(m.service, { operation: operation ?? `${type.slice(1)}.record`, subjectType: physicalType, subjectId: id, fields, ...provisioningInput(call), occurredAt: at, actor: { kind: 'system' } }, root);
         if (operation) observeStateWrite(m, result, before, root, stateChecks);
         if (keeps) await keepCounts(m, call, type, row as unknown as Record<string, unknown>, params, root, at, prior && { ...prior } as Record<string, unknown>);
         return id;
@@ -2188,25 +2345,25 @@ export async function contextFor(m: DerivedManifest, call: DerivedCall, scope: C
           const prefix = `${type.slice(1)}_`;
           let max = 0n;
           for (const r of resources) {
-            if (r.type !== type) continue;
+            if (r.type !== physicalType) continue;
             const digits = r.id.startsWith(prefix) ? r.id.slice(prefix.length) : '';
             if (/^\d+$/.test(digits) && BigInt(digits) > max) max = BigInt(digits);
           }
           return `${prefix}${max + 1n}`;
         })();
-        return { kind: 'write', value: subject, write: { operation: operation ?? `${type.slice(1)}.record`, subjectType: type, subjectId: subject, fields, ...provisioningInput(call), occurredAt: at, actor: { kind: 'system' } } };
-      }, root, () => resourcesOfType(m.service, type, root));
+        return { kind: 'write', value: subject, write: { operation: operation ?? `${type.slice(1)}.record`, subjectType: physicalType, subjectId: subject, fields, ...provisioningInput(call), occurredAt: at, actor: { kind: 'system' } } };
+      }, root, () => resourcesOfType(m.service, physicalType, root));
       if (operation && result) observeStateWrite(m, result, undefined, root, stateChecks);
-      const made = keeps && value !== undefined ? resourcesOfType(m.service, type, root).find((r) => r.id === value) : undefined;
+      const made = keeps && value !== undefined ? resourcesOfType(m.service, physicalType, root).find((r) => r.id === value) : undefined;
       if (made) await keepCounts(m, call, type, made as unknown as Record<string, unknown>, params, root, at);
       return value;
     },
     get machines() {
-      const enrolled = resourcesOfType(m.service, MACHINE_POOL, root).find((r) => r.id === 'pool') as unknown as (LightPoolOptions & { kind?: MachinePool['kind']; httpReplies?: MachineHttpReply[] }) | undefined;
-      return guardedMachinePool(poolFor(m.service, root, enrolled?.kind ?? 'none', enrolled?.httpReplies, { images: enrolled?.images }), m.service, ['retrieve', 'list'].includes(call.operation.class) || (m.reads?.includes(call.operation.id) ?? false));
+      const enrolled = resourcesOfType(m.service, MACHINE_POOL, root).find((r) => r.id === 'pool') as unknown as { kind?: MachinePool['kind']; httpReplies?: MachineHttpReply[] } | undefined;
+      return guardedMachinePool(poolFor(m.service, root, enrolled?.kind ?? 'none', enrolled?.httpReplies), m.service, ['retrieve', 'list'].includes(call.operation.class) || (m.reads?.includes(call.operation.id) ?? false));
     },
-    signingKey: (label, alg) => worldSigningKey(m.service, root, at, label, alg ?? 'RS256'),
-    heldSigningKey: (label, alg) => heldWorldSigningKey(m.service, root, label, alg ?? 'RS256'),
+    signingKey: (label, alg) => worldSigningKey(m.service, root, at, scopeLabel(m, label), alg ?? 'RS256'),
+    heldSigningKey: (label, alg) => heldWorldSigningKey(m.service, root, scopeLabel(m, label), alg ?? 'RS256'),
     create: (resource, fields, operation) => atomicWrite(m, call, resource, (snapshot) => {
       const id = mintId(m, resource, root, at, snapshot);
       return { id, fields: typeof fields === 'function' ? fields(id) : fields };
@@ -2217,9 +2374,13 @@ export async function contextFor(m: DerivedManifest, call: DerivedCall, scope: C
       if (!rules?.length) throw new Error('createUnique requires declared unique keys');
       let existing: Record<string, unknown> | undefined;
       const row = await atomicWrite(m, call, resource, (snapshot) => {
-        const id = mintId(m, resource, root, at, snapshot);
+        const id = options?.id ?? mintId(m, resource, root, at, snapshot);
         const selected = typeof fields === 'function' ? fields(id) : fields;
-        const hit = snapshot.find((r) => r.type === storedType(m, resource) && r.deleted !== true && rules.some((rule) => rule.fields.every((f) => selected[f] !== undefined && view(m, resource, r)[f] === selected[f])));
+        const hit = snapshot.find((r) => {
+          if (r.type !== storedType(m, resource) || r.deleted === true) return false;
+          const fields = { [m.resources[resource]?.idAs ?? 'id']: r.id, ...ownFields(r) };
+          return rules.some((rule) => rule.fields.every((field) => selected[field] !== undefined && fields[field] === selected[field]));
+        });
         if (hit) { existing = view(m, resource, hit); return undefined; }
         return { id, fields: selected };
       }, operation, params, root, at, undefined, stateChecks, options?.input === 'omit');
@@ -2251,11 +2412,20 @@ export async function contextFor(m: DerivedManifest, call: DerivedCall, scope: C
     },
     writeDetailed: (resource, id, fields, operation) => writeDetailed(m, call, resource, id, fields, operation, params, root, at, stateChecks),
     resolve: (resource, id) => resolveSubjectId(m.service, storedType(m, resource), id, root),
-    storedType: (resource) => storedType(m, resource),
+    storedType: (resource) => m.resources[resource]?.storedAs ?? resource,
     ok: (fields) => Response.json({ ...(m.success ?? {}), ...fields }),
     row: (resource, id, opts) => { const row = stored(m, resource, root, opts).find((r) => r.id === id); return row ? rawRow(resource, row) : undefined; },
     rowsRaw: (resource, opts) => stored(m, resource, root, opts).map((row) => rawRow(resource, row)),
-    tree: () => twinResources(m.service, root) as Array<Record<string, unknown>>,
+    tree: () => {
+      const rows = twinResources(m.service, root);
+      if (m.tenant?.storage !== 'namespaced') return rows as Array<Record<string, unknown>>;
+      const account = accountScope(m);
+      return rows.filter(row => {
+        const [base, encoded] = row.type.split(TENANT_TYPE);
+        const name = Object.keys(m.resources).find(name => (m.resources[name]?.storedAs ?? name) === base) ?? base!;
+        return account === undefined || m.resources[name]?.shared || (encoded ? decodeURIComponent(encoded) : 'default') === account;
+      }).map(row => rawRow(row.type.split(TENANT_TYPE)[0]!, row));
+    },
     history: (resource, id) => subjectHistory(m.service, { type: storedType(m, resource), id }, root).map((e) => ({ ...(e.operation ? { operation: e.operation } : {}), ...(e.fields ? { fields: e.fields as Record<string, unknown> } : {}), ...(e.occurredAt ? { occurredAt: e.occurredAt } : {}) })),
     raw: (body, init = {}) => new Response(body, { status: init.status ?? 200, headers: init.headers ?? {} }),
     atomically: async (decide) => {
@@ -2309,17 +2479,17 @@ export async function contextFor(m: DerivedManifest, call: DerivedCall, scope: C
     engine: scope.database === undefined ? unboundDatabase(m.service) : managedDatabase(scope.database, { readOnly: scope.readOnly === true || isReadOnlyRequest(call.request) }),
     redis: (commands, options) => execRedisRun(commands, {
       root, occurredAt: at, service: m.service, readOnly: scope.readOnly === true || isReadOnlyRequest(call.request), dialect: options.dialect,
-      ...(options.database === undefined ? {} : { database: options.database }),
+      ...(accountScope(m) && accountScope(m) !== 'default' ? { database: scopeLabel(m, options.database ?? 'default') } : options.database === undefined ? {} : { database: options.database }),
       ...(options.transaction === undefined ? {} : { transaction: options.transaction }),
     }),
-    live: liveAccess({ rows: (type) => resourcesOfType(m.service, type, root) as unknown as Array<Record<string, unknown>>, blob: (key) => readResourceBlob(m.service, key, root) }, call.request),
+    live: liveAccess({ rows: (type) => stored(m, type, root).map(row => rawRow(type, row)), blob: (key) => readResourceBlob(m.service, scopeLabel(m, key), root) }, call.request),
     blobs: {
-      put: (key, bytes) => writeResourceBlob(m.service, key, bytes, root),
-      putStream: (key, body, accept) => writeResourceBlobStream(m.service, key, body, accept, root),
-      get: (key) => readResourceBlob(m.service, key, root),
-      remove: (key) => removeResourceBlob(m.service, key, root),
-      size: (key) => resourceBlobSize(m.service, key, root),
-      range: (key, start, endInclusive) => readResourceBlobRange(m.service, key, start, endInclusive, root),
+      put: (key, bytes) => writeResourceBlob(m.service, scopeLabel(m, key), bytes, root),
+      putStream: (key, body, accept) => writeResourceBlobStream(m.service, scopeLabel(m, key), body, accept, root),
+      get: (key) => readResourceBlob(m.service, scopeLabel(m, key), root),
+      remove: (key) => removeResourceBlob(m.service, scopeLabel(m, key), root),
+      size: (key) => resourceBlobSize(m.service, scopeLabel(m, key), root),
+      range: (key, start, endInclusive) => readResourceBlobRange(m.service, scopeLabel(m, key), start, endInclusive, root),
     },
     merge: (resource, prior, next) => mergeField(m.resources[resource]?.update, prior, next),
     conflict: (resource, fields, except) => {
@@ -2365,12 +2535,14 @@ const BATCH_REFUSED_READS = ['get', 'rows', 'tree', 'history', 'find', 'list', '
 /** The members that write, or wait on writes, or answer as another context: each lands the staged writes first. */
 const BATCH_LANDING_MEMBERS = ['create', 'createUnique', 'change', 'accumulate', 'writeDetailed', 'record', 'atomically', 'remove', 'issue', 'at', 'over', 'core', 'awaitWrite', 'awaitCondition',
   // a World's seed and signing keys are written when first asked (worldSeed, worldSigningKey, as a vendor's move)
-  'secret', 'signingKey'] as const;
+  'secret', 'signingKey', 'account', 'organization', 'tenant', 'deploymentObject', 'accountKey'] as const;
 
 /** `ctx.batch` over a context whose writes may be grouped (see `batchable`). */
 function bindBatch(m: DerivedManifest, call: DerivedCall, context: SemanticsContext, params: Record<string, unknown>, root: string | undefined, at: string,
   rawRow: (resource: string, row: TwinResource) => Record<string, unknown>): void {
   let staged: StagedWrite[] | undefined;
+  // A callback's native object must land before the helper writes its retained link.
+  let nativeAccountWrites = 0;
   // each staged subject as it will stand, by `type:id`, in the order first written
   const subjects = new Map<string, Subject>();
   const land = async (): Promise<void> => {
@@ -2384,7 +2556,13 @@ function bindBatch(m: DerivedManifest, call: DerivedCall, context: SemanticsCont
   for (const name of BATCH_LANDING_MEMBERS) {
     const plain = ctx[name];
     if (typeof plain !== 'function') continue;
-    ctx[name] = async (...args: unknown[]) => { await land(); return (plain as (...a: unknown[]) => unknown)(...args); };
+    ctx[name] = async (...args: unknown[]) => {
+      await land();
+      const native = name === 'tenant' || name === 'deploymentObject' || name === 'accountKey';
+      if (native) nativeAccountWrites++;
+      try { return await (plain as (...a: unknown[]) => unknown)(...args); }
+      finally { if (native) nativeAccountWrites--; }
+    };
   }
   for (const name of BATCH_REFUSED_READS) {
     const plain = ctx[name];
@@ -2397,7 +2575,7 @@ function bindBatch(m: DerivedManifest, call: DerivedCall, context: SemanticsCont
   const plainWrite = context.write, plainRow = context.row, plainRowsRaw = context.rowsRaw;
   context.write = async (resource, id, fields, operation) => {
     // a vendor's own move (ctx.asVendor) is the clock's write, recorded as the system's: it lands alone, in its place
-    if (!staged || inVendorMove()) { await land(); return plainWrite(resource, id, fields, operation); }
+    if (!staged || nativeAccountWrites > 0 || inVendorMove()) { await land(); return plainWrite(resource, id, fields, operation); }
     const type = storedType(m, resource), key = `${type}:${id}`;
     // the one subject, as the memoized tree holds it (readTreeMap would copy the whole tree on every staged write)
     const subject = foldLocalWrite(subjects.get(key) ?? heldSubject(m.service, type, id, root), type, id, fields as SubjectFields, at);
@@ -2614,7 +2792,7 @@ export function authRefusal(m: DerivedManifest, request: Request, root?: string)
   const held = m.auth.held;
   if (held && !held.standing?.includes(key)) {
     const hash = sha256(key);
-    const holds = resourcesOfType(m.service, held.storedAs, root).some((r) => r.deleted !== true && (r as Record<string, unknown>)[held.hashField] === hash && (held.unless === undefined || (r as Record<string, unknown>)[held.unless] !== true));
+    const holds = stored(m, held.storedAs, root).some((r) => r.deleted !== true && (r as Record<string, unknown>)[held.hashField] === hash && (held.unless === undefined || (r as Record<string, unknown>)[held.unless] !== true));
     if (!holds) return vendorError(errorManifest, invalid);
   }
   return undefined;
@@ -2691,7 +2869,7 @@ export function crossCutting(m: DerivedManifest, opts: CoreScope & { readOnly?:
     const url = new URL(request.url);
     const signature = hashFieldValue({ path: url.pathname + url.search, body: await bodyTextOf(request.clone()) });
     const id = `idem_${hex(key)}`;
-    const prior = twinResources(m.service, opts.root).find((r) => r.type === m.idempotency!.storedAs && r.id === id) as Record<string, unknown> | undefined;
+    const prior = twinResources(m.service, opts.root).find((r) => r.type === storedType(m, m.idempotency!.storedAs) && r.id === id) as Record<string, unknown> | undefined;
     if (prior) {
       if (m.idempotency.conflict && prior.requestHash !== undefined && prior.requestHash !== signature) return vendorError(m, m.idempotency.conflict);
       const answer = prior.response as { status: number; body?: unknown; text?: string; contentType?: string };
@@ -2704,7 +2882,7 @@ export function crossCutting(m: DerivedManifest, opts: CoreScope & { readOnly?:
     if (m.idempotency.onlySuccess && (response.status < 200 || response.status >= 300)) return response;
     const contentType = response.headers.get('content-type') ?? 'application/json';
     const text = await response.clone().text();
-    await applyTwinWrite(m.service, { operation: 'idempotency.record', subjectType: m.idempotency.storedAs, subjectId: id, fields: { response: { status: response.status, text, contentType }, requestHash: signature }, occurredAt: (opts.clock ?? worldNow)(), actor: { kind: 'system' } }, opts.root);
+    await applyTwinWrite(m.service, { operation: 'idempotency.record', subjectType: storedType(m, m.idempotency.storedAs), subjectId: id, fields: { response: { status: response.status, text, contentType }, requestHash: signature }, occurredAt: (opts.clock ?? worldNow)(), actor: { kind: 'system' } }, opts.root);
     return response;
   }
 }