@volter/world-core 3.0.38 → 3.0.39

package/src/derived-core.ts

@@ -1,3 +1,4 @@
+import { parseExactJson, compareExactNumbers, exactInteger, isExactIntegerValue } from './exact-json.ts';
 // THE DERIVED CORE — what a derived pack does for an operation it declares no handler for
 // (docs/contributing/architecture.md, "Protocol 3"). The generated surface says what the
 // vendor's operations are; the pack's manifest says the vendor facts no spec carries (how ids look,
@@ -15,23 +16,26 @@ import { GitRefs } from './git/refs.ts';
 import { worldNow } from './world-clock.ts';
 import { worldEnvValue } from './world-env.ts';
 import { openSessions, socketWrite, type SocketDecl, type SocketSession } from './sockets.ts';
-import { MACHINE_POOL, poolFor, type MachinePool } from './machines.ts';
-import { askApplication, deliverEvents, deliverToApplication, type ApplicationAnswer, type ApplicationStandIn, type DeliveryAnswer, type EventRender, type EventScheme, type EventsDecl, type EventValues } from './events.ts';
+import { awaitWrite, awaitCondition, heldReadsWrite } from './held-reads.ts';
+import { MACHINE_POOL, poolFor, guardedMachinePool, type MachinePool, type MachineHttpReply, type LightPoolOptions } from './machines.ts';
+import { askApplication, deliverEvents, type ApplicationAnswer, type ApplicationStandIn, type EventRender, type EventScheme, type EventsDecl, type EventValues } from './events.ts';
 import type { RateBudgetDeclaration } from './rateBudget.ts';
-import { handlerCrypto, hmac, lettersFrom, sha256, uuidFrom, type HandlerCrypto } from './signing.ts';
+import { handlerCrypto, hmac, ksuidFrom, lettersFrom, sha256, uuidFrom, type HandlerCrypto } from './signing.ts';
 import { hashFieldValue } from './hash.ts';
 import { readResourceBlob, removeResourceBlob, writeResourceBlob } from './resource-blob.ts';
 import { managedDatabase, unboundDatabase, type ManagedDatabase } from './managed-database.ts';
 import { execRedisRun, type RedisDialect, type RunItem } from './redis/engine.ts';
 import { sendMail, type Mail, type SmtpRoute } from './smtp.ts';
+import { ownField, parseBracketForm } from './form.ts';
+export { ownField, parseBracketForm } from './form.ts';
 import { multipartBoundary, multipartParts, type MultipartPart } from './multipart.ts';
 import type { CorsDecl } from './cors.ts';
-import { projectOwnerResources, resolveSubjectId, subjectAliases } from './actions.ts';
+import { listActions, projectOwnerResources, resolveSubjectId, subjectAliases, type TwinAction } from './actions.ts';
 import { vendorFetch } from './vendor-call.ts';
 import { packReferences } from './references.ts';
 import type { SubjectFields } from './hash.ts';
 import { twinPublicBase, withRequestScopes } from './twin-fetch.ts';
-import { inVendorMove, isReadOnlyRequest, runAsVendorMove } from './request-scope.ts';
+import { inVendorMove, isReadOnlyRequest, runAsVendorMove, writesRefused } from './request-scope.ts';
 import type { DerivedCall, DerivedCoreOutcome, DerivedHandler, DerivedOperation } from './derived.ts';
 import type { PackDescriptor } from './packRegistry.ts';
 import type { ScenarioDecision, ScenarioHandler } from './scenario.ts';
@@ -57,7 +61,8 @@ export type Transition = {
   operation?: string;
   actor?: Actor;
   from: string[] | '*';
-  /** the value it moves to; absent, the value stays (a guard that moves nothing) */
+  /** the value it moves to; absent, the value stays (a guard that moves nothing), and absent with a `refusal`, the
+   *  operation is refused in the `from` states (a move another transition allows from there is taken first) */
   to?: string;
   effects?: Record<string, FieldRule>;
   /** placeholders `{from}`, `{to}`, `{field}`, `{id}` */
@@ -92,7 +97,7 @@ export function stateOf(decl: StateField, value: unknown): string {
     const w = d.when;
     if (w.absent !== undefined && (value === undefined || value === null) === w.absent) return d.state;
     if (w.equals !== undefined && value === w.equals) return d.state;
-    if (w.gt !== undefined && typeof value === 'number' && value > w.gt) return d.state;
+    if (w.gt !== undefined && (typeof value === 'number' || isExactIntegerValue(value)) && compareExactNumbers(value, w.gt) > 0) return d.state;
     if (w.truthy !== undefined && Boolean(value) === w.truthy) return d.state;
   }
   return value === undefined || value === null ? String(decl.initial) : String(value);
@@ -106,8 +111,8 @@ export type ResourceDecl = {
    *  surface names by the schema its GET answers): keyed by the path's parameter, it answers `defaults` under what was
    *  written until first written, and an update merges into it, making it on first write */
   setting?: { defaults: Record<string, unknown> };
-  /** this resource's id template, when it is not the manifest's (`ids.template`): `{uuid}`, `{letters:20}` (twenty
-   *  lowercase letters, a Supabase project ref), `{snowflake:<epoch ms>}` (Discord's ids), or a `{prefix}`/`{n}`
+  /** this resource's id template, when it is not the manifest's (`ids.template`): `{uuid}`, `{ksuid}` (Clerk's), `{letters:20}` (twenty
+   *  lowercase letters, a Supabase project ref), `{digits:16}` (fixed-width decimal), `{snowflake:<epoch ms>}` (Discord's ids), or a `{prefix}`/`{n}`
    *  template */
   ids?: string;
   /** fields the server assigns on create */
@@ -117,6 +122,20 @@ export type ResourceDecl = {
   notState?: string[];
   /** id-holding fields a caller may ask to receive embedded, and the resource each holds */
   embeds?: Record<string, string>;
+  /** `embeds` fields the vendor answers embedded on every answer, asked or not (its schema gives the object with no id
+   *  alternative: Stripe's issuing card's `cardholder`): still stored as the id, hydrated from the current object */
+  alwaysEmbedded?: string[];
+  /** the vendor's own fields whose names begin with `_` (GitHub's `_links`, a HAL object's), which the vendor answers:
+   *  answered like any field, where every other `_` field is the pack's bookkeeping and never answered */
+  vendorUnderscored?: string[];
+  /** Stored fields omitted from vendor views, without renaming them in retained state. Raw rows and
+   *  ctx.own retain them for parent scope and semantics; get, rows, render and core answers omit them. */
+  viewOmit?: readonly string[];
+  /** fields the vendor answers as a list of the current children of another resource (Stripe's subscription `items`:
+   *  its subscription_items), built on every answer from the child rows whose `by` field holds this id, in the order
+   *  they were made, each through the child's own view and its embedding; never a stored copy. `list` is the list's own
+   *  fields around `data`, where `{id}` is this resource's id and `"{count}"` the children's number */
+  collections?: Record<string, { resource: string; by: string; list?: Record<string, unknown> }>;
   /** this resource's deletion answer, when it is not the manifest's (`vector_store.deleted`) */
   deleted?: unknown;
   /** a child addressed under its parent: the path parameter naming the parent, the stored field that
@@ -125,7 +144,10 @@ export type ResourceDecl = {
    *  that joins them into what `field` stores (`{owner}/{repo}`). `where` finds the parent by its stored
    *  fields when its stored id is not what the path names (a repository stored as `repo:7` with `owner`
    *  and `name`, addressed as `{owner}/{repo}`): each stored field against a template over the path. */
-  parent?: { param?: string; params?: string[]; value?: string; field: string; resource: string; allowDeleted?: boolean; where?: Record<string, string> };
+  parent?: { param?: string; params?: string[]; value?: string; field: string; resource: string; allowDeleted?: boolean; where?: Record<string, string>;
+    /** private fields a child observed under its parent keeps from the parent's parameters (`_jurisdiction:
+     *  '{jurisdiction}'`), where the child's own read names none and a later read under it needs one ("Refresh") */
+    keep?: Record<string, string> };
   /** a number the resource counts per parent (a repository's issue numbers, a thread's messages):
    *  the stored field, set on create to one past the highest among its siblings */
   number?: { field: string };
@@ -163,18 +185,33 @@ export type ResourceDecl = {
   /** fields that name a subject as its id does (an organization by its id or its slug): a path's id and `ctx.find`
    *  match either */
   alternateKeys?: string[];
+  /** fields that pair a subject a deploy settled with no vendor id with the vendor's copy a refresh observes (Slack's
+   *  `channel_join` message, made by `conversations.join` and answered by no id: its `subtype` and `user`), where the
+   *  `alternateKeys` do not; a subject missing one is never paired by them ("Refresh", adoption) */
+  adoptBy?: string[];
   /** the list's search parameter (`query`): a row matches on an `exact` field's whole value or a `partial` field's
    *  substring, case-insensitively */
   search?: { param: string; exact?: string[]; partial?: string[] };
   /** fields that count this subject's children (an App's `installations_count`): the live subjects of `of` whose `by`
-   *  holds this one's id, only those with `present` set when it is named, plus `plus` (a customer's
+   *  holds this one's id (or vendor `parentKey`), only those with `present` set when it is named and without
+   *  any matching `unless` field, plus `plus` (a customer's
    *  `next_invoice_sequence` is one past its numbered invoices). The kernel keeps each whenever a child is written. */
-  counts?: Record<string, { of: string; by: string; present?: string; plus?: number }>;
+  counts?: Record<string, { of: string; by: string; parentKey?: string; present?: string; unless?: Record<string, unknown>; plus?: number }>;
   /** how the vendor's state of this type is read back into a root (the real-system adapters, "Refresh"): the list that
    *  enumerates it (once per parent, under `parent`; `complete: false` when it is not the whole type; `items`, the answer's
    *  path to them, when the spec does not name the list it answers), the one read of a singleton, or `none` with why the
-   *  vendor offers no read-back. Every stored resource the vendor holds declares one. */
-  refresh?: { list: string; complete?: false; items?: string } | { get: string } | { none: string };
+   *  vendor offers no read-back. Every stored resource the vendor holds declares one. `{ get, known: true }`: the vendor
+   *  lists no whole type, so the World's own subjects of it are each read again by `get` (a 404 is one gone), and what
+   *  those reads observe anchors its children's lists; completeness is those subjects alone. */
+  /** `next`: where an answer names the next page's cursor (AWS's `NextToken`), sent back as `cursor` (the same name
+   *  unless said) in the query, or in the body of a list asked by POST (an RPC list: AWS JSON's `x-amz-target`); a
+   *  map of parameter to answer path where a page names several (S3's `key-marker` and `upload-id-marker`); `more`, the
+   *  answer's flag that another page follows (S3's `IsTruncated`). `headers`: fixed headers of the list, `{name}` filled
+   *  from the parent's parameters; `variants`: header sets each listed in turn, one type whole across them (R2's
+   *  jurisdictions). A blob read by an `operation` (a GET of the unit's surface, filled from the subject's fields and
+   *  its parent's parameters) keeps the bytes in the World's blobs, their key in `field`, and in `headersField` the
+   *  answer's headers `keepHeaders` names (a name ending `*` a prefix: `x-amz-meta-*`), both fields private. */
+  refresh?: ({ list: string; unpaginated?: true; keyed?: true; detail?: string; detailMerge?: string; detailWith?: Record<string, string>; complete?: false; items?: string; shape?: RefreshShape; next?: string | Record<string, string>; nextLink?: { header: string; rel: string; query: string; when?: Record<string, string> }; cursor?: string; more?: string } | { get: string; known?: true }) & { params?: Record<string, string>; headers?: Record<string, string>; variants?: ReadonlyArray<{ headers: Record<string, string> }>; blobs?: ReadonlyArray<{ path: string; key: string; resource?: string; fields?: Record<string, string> } | { operation: string; field: string; headers?: Record<string, string>; headersField?: string; keepHeaders?: string[] }>; query?: Record<string, string>; idAs?: string; graphql?: { query: string; variables?: Record<string, unknown>; items: string; pageInfo?: string; cursor?: string } } | { none: string };
   /** the other resources one create of this one makes, and where its answer names each's id (a JSON path) */
   companions?: Record<string, string>;
   /** the field telling a newer copy of a subject from an older (an `updated_at`): an ingested event older than the
@@ -191,7 +228,18 @@ export type IngestDecl = {
   object: string;
   /** event type → the resource it carries, where `events.types` read backwards and `<resource>.created|updated|deleted`
    *  do not say it */
-  types?: Record<string, { resource: string; deleted?: true }>;
+  types?: Record<string, {
+    resource: string; deleted?: true;
+    /** where this type carries its object, when not at `object` (GitHub's `issue`, `pull_request`, `comment`) */
+    object?: string;
+    /** the JSON path of the value the resource's `parent.field` holds, when the event names its parent beside the object
+     *  (GitHub's `repository.full_name`, the `{owner}/{repo}` its children are stored under) */
+    parent?: string;
+    /** where the object names the subject's id when not as the resource does (Resend's email events: `email_id`) */
+    id?: string;
+    /** the fields the event's type itself says (Resend's `email.delivered` is the email's `last_event: 'delivered'`) */
+    fields?: Record<string, unknown>;
+  }>;
   /** an event answered instead of folded (Slack's url_verification): the body fields it matches, and the answer, a
    *  `$body.<path>` read from the event or a literal */
   handshake?: { when: Record<string, string>; answer: string };
@@ -267,6 +315,8 @@ export type PerformHookArgs = {
 export type PerformHook = (args: PerformHookArgs) => Promise<import('./head.ts').PushOutcome>;
 
 export type DerivedManifest = {
+  /** Vendor data-plane hosts mapped to an already-running customer guest. */
+  machineRoutes?: ReadonlyArray<{ host: string; resource: string; where: Record<string, string>; name: string; port: number | string }>;
   /** The pack's descriptor, as data (docs/contributing/architecture.md, "The descriptor"), every field but `vendor`, which
    *  is the manifest's: the pack registers `packOf(manifest)`, so its index is a fixed file. A lane has none. */
   descriptor?: Omit<PackDescriptor, 'vendor'>;
@@ -287,6 +337,11 @@ export type DerivedManifest = {
   /** operations that only read though nothing in the spec says so (a POST that returns data):
    *  a read-only twin answers them */
   reads?: string[];
+  /** operations of the vendor's API that set an account up rather than use it: an operator registering an OAuth client
+   *  on the vendor's own admin routes, as a person makes settings on the vendor's site. Each is recorded as a door's
+   *  write is (the World's own), so a deploy never offers it to the vendor and the vendor-backed acceptance holds it as
+   *  what the account already has; `why` says who performs it and where */
+  accountSetup?: Array<{ operation: string; why: string }>;
   /** how the vendor writes an instant: Unix seconds, Unix milliseconds (Clerk's `created_at`), or ISO 8601 */
   time: 'unix' | 'unix-ms' | 'iso';
   /** the vendor's CORS, as its gateway answers a browser (cors.ts): the pack's fetch is served behind `withCors` */
@@ -311,7 +366,8 @@ export type DerivedManifest = {
    *  (`{value}` in its message is the header's value) */
   version?: { header: string; pattern: string; error: ErrorSpec };
   /** request headers that carry meaning to the vendor (a tenant header such as `Stripe-Account`): recorded with a write
-   *  so its perform sends them again (the real-system adapters, "What a pack declares"); `version.header` is too */
+   *  so its perform sends them again (the real-system adapters, "What a pack declares"); `version.header` is too. A name
+   *  ending `*` is a prefix: every header it begins (S3's `x-amz-meta-*`, an object's own metadata). */
   headers?: string[];
   /** the vendor's signed webhooks, folded into a root */
   ingest?: IngestDecl;
@@ -329,10 +385,11 @@ export type DerivedManifest = {
    *  derived request, which it composes (`send`) ("Protocols a request cannot express", architecture) */
   performs?: Record<string, PerformHook>;
   /** `withParam`: the error names the path parameter that held the unknown id */
-  notFound: { status: number; message: string; code?: string; kind?: string; withParam?: boolean };
+  notFound: { status: number; message: string; code?: string | number; kind?: string; withParam?: boolean };
   /** the list envelope (placeholders `{data}`, `{has_more}`, `{url}`, `{first_id}`, `{last_id}`),
-   *  its page size, its cursors, and where an unknown cursor starts: the first page or past the end */
-  list: {
+   *  its page size, its cursors, and where an unknown cursor starts: the first page or past the end.
+   *  Absent when the unit serves no stored list; the core does not own lists without this declaration. */
+  list?: {
     style: 'envelope';
     envelope: unknown;
     limit: { param: string; default: number; max: number };
@@ -341,8 +398,8 @@ export type DerivedManifest = {
     unknownCursor?: 'start' | 'end';
     /** an opaque cursor over positions (`{next_cursor}` in the envelope; empty on the last page),
      *  in place of id cursors: `base64-offset` is base64 of `{"o":<offset>}` */
-    cursor?: { param: string; encoding: 'base64-offset' };
-    /** numbered pages (1-based `page`, the size in `limit.param`), with the vendor's `Link` header
+    cursor?: { param: string; encoding: 'base64-offset' } | { param: string; encoding: 'offset-template'; template: string; link: { previous: string; next: string; results: string; cursor: string } };
+    /** numbered pages (1-based, the size in `limit.param`), with the vendor's `Link` header
      *  naming the first, previous, next and last pages (`link`); the envelope may name `{total_count}` and `{max_page}` */
     page?: { param: string; link: boolean };
     /** offset paging: `param` names how many items to skip; the page sits under the operation's envelope key beside the
@@ -384,14 +441,19 @@ export type DerivedManifest = {
     /** operations that check a credential of their own, not the account's (Cloudflare's asset upload reads its upload
      *  session's JWT from the same header): the gate leaves them to their handler */
     exempt?: string[];
+    /** ordered API-skin error wires, selected before scenario matching and ordinary routing */
+    wires?: Array<{ paths: string; error: DerivedManifest['error']; missing?: ErrorSpec; invalid?: ErrorSpec }>;
     /** the vendor checks the key before it routes: a path it does not have is refused a missing or invalid key first */
     beforeRouting?: boolean };
   /** the twin door that makes the next request answer the vendor's rate-limit refusal */
-  /** headers every answer carries (a request id) */
+  /** headers every answer carries (a request id); a value's `{hex:N}` is filled per answer, from the World's count of
+   *  answers (so a second World answers the same ids in the same order), unless the handler set the header itself */
   answerHeaders?: Record<string, string>;
   /** an origin the pack writes into URLs it mints, rewritten in every JSON answer to where this
    *  twin is reached for the request (twinPublicBase) */
   origin?: { placeholder: string };
+  /** Disclosed local connection fields, separate from vendor response schemas. */
+  worldFields?: Record<string, Record<string, { type: 'array' | 'object' | 'string' | 'number' | 'boolean'; why: string }>>;
   resources: Record<string, ResourceDecl>;
   /** Read-only cross-pack credential subjects of the same vendor (architecture A3); no root is exposed to handlers. */
   ownerReads?: ReadonlyArray<{ owner: string; resource: string }>;
@@ -438,9 +500,19 @@ export type DerivedManifest = {
    *  matched at the path's start: stripped before routing, so the operation it names is the one served. Its named groups
    *  (Jira's `/ex/jira/(?<cloudId>[^/]+)`) are the operation's parameters as well. */
   pathPrefix?: string;
+  /** A prefix the vendor serves as its own base path (Discord answers `/api` and `/api/v9` as `/api/v10`, the spec's), as
+   *  a regular expression matched at the path's start: put in place of the surface's base path before routing, so an
+   *  operation compiled under the spec's base answers each. Perform and refresh send the spec's base, as the SDK does. */
+  basePathAlias?: string;
   /** A pattern over the request's vendor host whose named groups are the operation's parameters (E2B's envd answers each
    *  sandbox at `49983-<sandboxID>.e2b.app`: `^\\d+-(?<sandboxID>[a-z0-9]+)\\.`). */
   hostParams?: string;
+  /** The vendor host a lane's calls go to when it carries the call's parameters (R2's `<account>.r2.cloudflarestorage.com`):
+   *  `{name}` filled from the call's parameters, `values` a parameter's literal in the host (the real-system adapters,
+   *  "Lanes"). Perform and refresh send to `https://<host><path>`. */
+  remoteHost?: { template: string; values?: Record<string, Record<string, string>> };
+  /** Named operation parameters from vendor routing headers (shared-host compute services). */
+  headerParams?: Record<string, string>;
   /** The persistent wires the vendor's clients hold open (sockets.ts: Discord's Gateway): each served at its path by
    *  the pack's `semantics/sockets.ts`, which the kernel offers every write after its webhooks. */
   sockets?: ReadonlyArray<SocketDecl>;
@@ -486,12 +558,12 @@ export function strictFields(m: DerivedManifest, operation: DerivedOperation, bo
     const { type } = field;
     const fits = value === null
       || (type === 'boolean' && typeof value === 'boolean')
-      || (type === 'integer' && Number.isInteger(value))
-      || (type === 'number' && typeof value === 'number')
+      || (type === 'integer' && isExactIntegerValue(value))
+      || (type === 'number' && (typeof value === 'number' || isExactIntegerValue(value)))
       || (type === 'string' && typeof value === 'string')
       || !['boolean', 'integer', 'number', 'string'].includes(type);
     if (!fits) return refuse(strict.type, { name, type: type === 'integer' ? 'an integer' : `a ${type}` });
-    if (typeof value === 'number' && ((field.minimum !== undefined && value < field.minimum) || (field.maximum !== undefined && value > field.maximum))) {
+    if ((typeof value === 'number' || isExactIntegerValue(value)) && ((field.minimum !== undefined && compareExactNumbers(value, field.minimum) < 0) || (field.maximum !== undefined && compareExactNumbers(value, field.maximum) > 0))) {
       return refuse(strict.range, { name, min: field.minimum ?? null, max: field.maximum ?? null });
     }
     fields[name] = value;
@@ -513,9 +585,9 @@ function validateBody(m: DerivedManifest, operation: DerivedOperation, body: unk
       continue;
     }
     const types = field.type.split('|');
-    const fits = types.some((type) => type === 'null' ? value === null : type === 'integer' ? Number.isInteger(value) : type === 'array' ? Array.isArray(value) : type === 'object' ? value !== null && typeof value === 'object' && !Array.isArray(value) : type === 'string' ? typeof value === 'string' : type === 'number' ? typeof value === 'number' : type === 'boolean' ? typeof value === 'boolean' : true);
+    const fits = types.some((type) => type === 'null' ? value === null : type === 'integer' ? isExactIntegerValue(value) : type === 'array' ? Array.isArray(value) : type === 'object' ? value !== null && typeof value === 'object' && !Array.isArray(value) : type === 'string' ? typeof value === 'string' : type === 'number' ? typeof value === 'number' || isExactIntegerValue(value) : type === 'boolean' ? typeof value === 'boolean' : true);
     if (!fits) return refuse(rule.type, { name: field.name, type: field.type, input: value });
-    if (typeof value === 'number' && ((field.minimum !== undefined && value < field.minimum) || (field.maximum !== undefined && value > field.maximum))) return refuse(rule.range, { name: field.name, min: field.minimum ?? null, max: field.maximum ?? null, input: value });
+    if ((typeof value === 'number' || isExactIntegerValue(value)) && ((field.minimum !== undefined && compareExactNumbers(value, field.minimum) < 0) || (field.maximum !== undefined && compareExactNumbers(value, field.maximum) > 0))) return refuse(rule.range, { name: field.name, min: field.minimum ?? null, max: field.maximum ?? null, input: value });
   }
   return undefined;
 }
@@ -531,64 +603,6 @@ export function flagOf(m: Pick<DerivedManifest, 'booleans'>, value: unknown): bo
   return undefined;
 }
 
-/** A form body's bracket notation (`a[b][0][c]=v`, `expand[]=x`) as nested objects and arrays. A form carries only
- *  text: a field the operation's spec types as a number or a boolean (`scalars`, by bracket path, written by
- *  world-tooling's formScalarsOf) is read as one when its text is that literal; every other field stays the text sent
- *  (`metadata[order]=007`, `name=2024`). */
-/** A field set as the object's own, whatever its name (`__proto__`, `constructor` and `prototype` are data a caller
- *  may name: Stripe's metadata keys are the caller's), never through what the object inherits. */
-export function ownField(node: Record<string, unknown> | unknown[], key: string, value: unknown): void {
-  Object.defineProperty(node, key, { value, writable: true, enumerable: true, configurable: true });
-}
-/** A field the object holds as its own, never one it inherits (`constructor` is every object's). */
-const ownValue = (node: Record<string, unknown> | unknown[], key: string): unknown => (Object.hasOwn(node, key) ? (node as Record<string, unknown>)[key] : undefined);
-
-export function parseBracketForm(text: string, scalars?: Readonly<Record<string, string | undefined>>): Record<string, unknown> {
-  const out: Record<string, unknown> = {};
-  for (const [rawKey, raw] of new URLSearchParams(text)) {
-    const parts = rawKey.replace(/\]/g, '').split('[');
-    const kind = scalars && scalarAt(scalars, parts);
-    const value: unknown = kind === 'boolean' ? (raw === 'true' ? true : raw === 'false' ? false : raw)
-      : kind === 'integer' ? (/^-?\d+$/.test(raw) ? Number(raw) : raw)
-      : kind === 'number' ? (/^-?\d+(\.\d+)?$/.test(raw) ? Number(raw) : raw)
-      : raw;
-    // every field is the node's own, read and written as such: a key naming an object's machinery (`__proto__[x]`,
-    // `constructor[prototype][x]`) is a field of that name, never a walk into what every object inherits
-    let node: Record<string, unknown> | unknown[] = out;
-    for (const [i, key] of parts.entries()) {
-      // an array holds its items by index (`a[]`, `a[0]`): a named key under one (`a[]=1&a[length]=-1`) has nowhere to
-      // go, as a key under text has none (`a=1&a[b]=2`): the first shape stands
-      if (Array.isArray(node) && key !== '' && !/^\d+$/.test(key)) break;
-      if (i === parts.length - 1) {
-        if (key === '') {
-          if (Array.isArray(node)) node.push(value);
-        } else ownField(node, key, value);
-        break;
-      }
-      const next = parts[i + 1]!;
-      if (key === '') break;
-      let child = ownValue(node, key);
-      if (child === undefined) { child = next === '' || /^\d+$/.test(next) ? [] : {}; ownField(node, key, child); }
-      if (child === null || typeof child !== 'object') break;
-      node = child as Record<string, unknown> | unknown[];
-    }
-  }
-  return out;
-}
-
-/** The type `scalars` gives a form key's parts: a segment is a property name, `[]` an array's item (an index or empty),
- *  `*` a map's key. */
-function scalarAt(scalars: Readonly<Record<string, string | undefined>>, parts: string[]): string | undefined {
-  let paths = [''];
-  for (const [i, part] of parts.entries()) {
-    const segs = part === '' || /^\d+$/.test(part) ? ['[]', '*'] : [part, '*'];
-    paths = paths.flatMap((p) => segs.map((seg) => (i === 0 ? seg : `${p}.${seg}`)));
-    if (paths.length > 64) paths = paths.filter((p) => Object.keys(scalars).some((k) => k === p || k.startsWith(`${p}.`)));
-  }
-  for (const p of paths) if (scalars[p]) return scalars[p];
-  return undefined;
-}
-
 /** A request's parameters, its query's and its body's. With the manifest's `body.form.coerce`, a form's fields the
  *  operation's spec types as numbers or booleans are read as them (parseBracketForm); without an operation (a twin door)
  *  every form value is its text. */
@@ -596,7 +610,7 @@ export async function readParams(manifest: DerivedManifest, request: Request, op
   const url = new URL(request.url);
   const scalars = manifest.body.form?.coerce ? (operation?.scalars ?? {}) : undefined;
   const query = parseBracketForm(url.search.replace(/^\?/, ''), scalars);
-  if (request.method === 'GET' || request.method === 'HEAD') return query;
+  if (request.method === 'GET' || request.method === 'HEAD' || (operation && bytesPayload(operation))) return query;
   const type = request.headers.get('content-type') ?? '';
   if (type.includes('multipart/form-data')) {
     // an upload: text fields as given, each file as its name, media type, size and content (its text), with its raw
@@ -620,7 +634,7 @@ export async function readParams(manifest: DerivedManifest, request: Request, op
   }
   // NDJSON (`application/x-ndjson`) is lines of JSON, not a JSON document: the handler reads its text
   const media = (type.split(';')[0] ?? '').trim().toLowerCase();
-  const isJson = media.includes('json') && !media.includes('ndjson');
+  const isJson = media.includes('json') && !media.includes('ndjson') && !media.includes('connect+');
   // a form is a body labelled one (application/x-www-form-urlencoded); a body of any other type (an image, a video, an
   // octet-stream PUT to an upload URL, a text/plain SQL statement, an NDJSON batch) is no form: its parameters are the
   // query's, and the handler reads its text or bytes itself
@@ -633,7 +647,7 @@ export async function readParams(manifest: DerivedManifest, request: Request, op
   // as a form only when it is labelled one (a sign-in page's own form, posted to the vendor's page), never a crash
   let body: unknown;
   if (asJson) {
-    try { body = JSON.parse(text); } catch {
+    try { body = parseExactJson(text); } catch {
       if (isJson) throw new SyntaxError('malformed JSON body');
       if (!isForm) return query;
       body = parseBracketForm(text, scalars);
@@ -744,27 +758,96 @@ function parentValue(parent: NonNullable<ResourceDecl['parent']>, params: Record
   return parent.param !== undefined ? params[parent.param] : undefined;
 }
 
+function parentField(row: unknown, path: string): unknown {
+  if (row && typeof row === 'object' && Object.hasOwn(row, path)) return (row as Record<string, unknown>)[path];
+  let value = row;
+  for (const key of path.split('.')) value = value && typeof value === 'object' ? (value as Record<string, unknown>)[key] : undefined;
+  return value;
+}
+
 function missingParent(m: DerivedManifest, resource: string, call: DerivedCall, root?: string): Response | undefined {
   const parent = m.resources[resource]?.parent;
   if (!parent) return undefined;
   const id = parentValue(parent, call.params);
   const where = Object.entries(parent.where ?? {}).map(([field, template]) => [field, String(fill(template, call.params))] as const);
-  const found = (r: TwinResource): boolean => (where.length ? where.every(([field, v]) => String((r as Record<string, unknown>)[field]) === v) : r.id === id);
+  const found = (r: TwinResource): boolean => (where.length ? where.every(([field, v]) => String(parentField(r, field)) === v) : r.id === id);
   return id !== undefined && stored(m, parent.resource, root, { withDeleted: parent.allowDeleted === true }).some(found) ? undefined : notFound(m, parent.resource, String(id), parent.param ?? parent.params?.at(-1));
 }
 
 /** The vendor's view of a stored subject: its own fields, bookkeeping (`_`) left out. */
 /** A stored subject as the vendor's object: its id first (the subject's, unless the pack kept an id of its own), then
  *  the fields the pack wrote, bookkeeping (`_`) and the kernel's updatedAt left out. */
-export function render(r: TwinResource): Record<string, unknown> {
-  return Object.fromEntries(Object.entries({ id: r.id, ...ownFields(r) }).filter(([k]) => !k.startsWith('_') && k !== 'updatedAt'));
+export function render(r: TwinResource, vendorUnderscored: readonly string[] = []): Record<string, unknown> {
+  return renderOwn({ id: r.id, ...ownFields(r) }, vendorUnderscored);
+}
+
+/** Filter an own-field view through the same declared vendor fields as a stored row. */
+function renderOwn(own: Record<string, unknown>, vendorUnderscored: readonly string[] = []): Record<string, unknown> {
+  return Object.fromEntries(Object.entries(own).filter(([k]) => !k.startsWith('_') || vendorUnderscored.includes(k)));
+}
+
+type ViewOmissions = { fields: Map<string, ReadonlySet<string>>; affected: Set<string>; embeds: Map<string, Array<[string, string]>> };
+const viewOmissions = new WeakMap<DerivedManifest, ViewOmissions>();
+// Precompute once at manifest binding: omitted fields, whether any exist, and their transitive containers through embeds.
+function prepareViewOmissions(m: DerivedManifest): ViewOmissions {
+  const held = viewOmissions.get(m);
+  if (held) return held;
+  const fields = new Map<string, ReadonlySet<string>>();
+  for (const [resource, decl] of Object.entries(m.resources)) {
+    if (decl.viewOmit?.length) fields.set(resource, new Set(decl.viewOmit));
+  }
+  const affected = new Set(fields.keys());
+  const embeds = new Map<string, Array<[string, string]>>();
+  if (fields.size) {
+    let changed = true;
+    while (changed) {
+      changed = false;
+      for (const [resource, decl] of Object.entries(m.resources)) {
+        if (!affected.has(resource) && Object.values(decl.embeds ?? {}).some((target) => affected.has(target))) {
+          affected.add(resource);
+          changed = true;
+        }
+      }
+    }
+    for (const resource of affected) {
+      embeds.set(resource, Object.entries(m.resources[resource]?.embeds ?? {}).filter(([, target]) => affected.has(target)));
+    }
+  }
+  const plan = { fields, affected, embeds };
+  viewOmissions.set(m, plan);
+  return plan;
+}
+
+/** The one response-omission mechanism, shared by stored, constructed and expanded resource views. */
+function omitView(m: DerivedManifest, resource: string | undefined, body: Record<string, unknown>, seen?: Map<string, WeakMap<object, Record<string, unknown>>>): Record<string, unknown> {
+  const plan = viewOmissions.get(m) ?? prepareViewOmissions(m);
+  if (!resource || !plan.affected.has(resource)) return body;
+  const held = seen?.get(resource)?.get(body);
+  if (held) return held;
+  const out = { ...body };
+  seen ??= new Map();
+  let visited = seen.get(resource);
+  if (!visited) { visited = new WeakMap(); seen.set(resource, visited); }
+  visited.set(body, out);
+  for (const field of plan.fields.get(resource) ?? []) delete out[field];
+  for (const [field, target] of plan.embeds.get(resource) ?? []) {
+    const present = out[field];
+    if (Array.isArray(present)) {
+      out[field] = present.map((child) => child && typeof child === 'object' && !Array.isArray(child) ? omitView(m, target, child, seen) : child);
+    } else if (present && typeof present === 'object') {
+      out[field] = omitView(m, target, present as Record<string, unknown>, seen);
+    }
+  }
+  return out;
 }
 
 /** A stored subject as the vendor answers it: its own fields, its id under the name the vendor gives it. */
 function view(m: DerivedManifest, resource: string, r: TwinResource): Record<string, unknown> {
   const idAs = m.resources[resource]?.idAs;
-  if (!idAs) return render(r);
-  const { id, ...rest } = render(r);
+  const keep = m.resources[resource]?.vendorUnderscored ?? [];
+  const shown = omitView(m, resource, render(r, keep));
+  if (!idAs) return shown;
+  const { id, ...rest } = shown;
   return { [idAs]: id, ...rest };
 }
 
@@ -774,7 +857,12 @@ function view(m: DerivedManifest, resource: string, r: TwinResource): Record<str
  *  vendor's own operation (or the pack's door), made in order against the twin by the runner `volter-world init` writes
  *  beside the copied data. An ordinary path is relative to the twin base. A call naming a browser uses the
  *  vendor's absolute URL and is exported separately as `browserSeed`, after the ordinary `seed` calls. */
-export type SeedCall = { browser?: string; method: string; path: string; body?: unknown; headers?: Record<string, string> };
+/** How a refresh list's answer items become subjects' fields where each is not one subject's object (architecture,
+ *  "Refresh"): `scalar`, a bare item is that field; `value` (with `keyed`), a scalar map value is that field and, with
+ *  `keyAs`, the map key is that field rather than the id; `spread`, an item expands into the array at `path`, each
+ *  element an object or a scalar named `as`, beside the item's fields `carry` names (field: path in the item). */
+export type RefreshShape = { scalar?: string; value?: string; keyAs?: string; spread?: { path: string; as?: string; carry?: Record<string, string> } };
+export type SeedCall = { browser?: string; method: string; path: string; body?: unknown; headers?: Record<string, string>; /** the instant the account made it, before the World's time: the call is made with the World clock frozen there */ at?: string };
 
 /** Where a call is answered: the World's root, its clock, and the managed Postgres the runtime binds to the pack
  *  (`database`, the descriptor's `managedDatabase`), which a handler reaches as `ctx.engine` — READ ONLY in every
@@ -856,27 +944,47 @@ function worldSigningKey(service: string, root: string | undefined, at: string,
   return made;
 }
 
-function mintId(m: DerivedManifest, resource: string, root?: string, at?: string): string {
+function mintId(m: DerivedManifest, resource: string, root?: string, at?: string, snapshot?: readonly TwinResource[]): string {
   if (!m.resources[resource]) throw new Error(`mint: ${resource} is not a resource ${m.vendor}'s manifest declares`);
   const prefix = m.resources[resource]!.idPrefix;
   const template = m.resources[resource]!.ids ?? m.ids.template;
-  if (template === '{uuid}') return mintUuid(m, resource, root);
+  if (template === '{uuid}') return mintUuid(m, resource, root, snapshot);
   const snowflake = /^\{snowflake:(\d+)\}$/.exec(template);
-  if (snowflake) return mintSnowflake(m, BigInt(snowflake[1]!), root, at);
-  // `{letters:N}` and `{hex:N}`, alone or after the resource's prefix (`{prefix}{letters:16}`: Fly's `vol_…`)
-  const letters = /^(\{prefix\})?\{letters:(\d+)\}$/.exec(template);
-  if (letters) return mintLetters(m, resource, Number(letters[2]), root, letters[1] ? prefix : '');
-  const hex = /^(\{prefix\})?\{hex:(\d+)\}$/.exec(template);
-  if (hex) return mintHex(m, resource, Number(hex[2]), root, hex[1] ? prefix : '');
+  if (snowflake) return mintSnowflake(m, BigInt(snowflake[1]!), root, at, snapshot);
+  // `{letters:N}` and `{hex:N}`, alone, after the resource's prefix (`{prefix}{letters:16}`: Fly's `vol_…`), or after it
+  // and a separator (`{prefix}_{hex:48}`: OpenAI's `resp_67cc…`)
+  const letters = /^(?:\{prefix\}([_-]?))?\{letters:(\d+)\}$/.exec(template);
+  if (letters) return mintLetters(m, resource, Number(letters[2]), root, letters[1] !== undefined ? `${prefix}${letters[1]}` : '', snapshot);
+  const hex = /^(?:\{prefix\}([_-]?))?\{hex:(\d+)\}$/.exec(template);
+  if (hex) return mintHex(m, resource, Number(hex[2]), root, hex[1] !== undefined ? `${prefix}${hex[1]}` : '', snapshot);
+  const digits = /^\{digits:(\d+)\}$/.exec(template);
+  if (digits) {
+    const width = Number(digits[1]);
+    if (!Number.isInteger(width) || width < 1 || width > 77) throw new Error('mint: decimal width must be between 1 and 77');
+    const held = new Set((snapshot ? snapshot.filter((r) => r.type === storedType(m, resource)) : resourcesOfType(m.service, storedType(m, resource), root)).map((r) => r.id));
+    const floor = 10n ** BigInt(width - 1);
+    for (let n = held.size + 1; ; n++) {
+      const id = String(floor + BigInt('0x' + sha256(`${m.service}:${resource}:${n}`)) % (9n * floor));
+      if (!held.has(id)) return id;
+      if (n - held.size > 9 * Number(floor)) throw new Error('mint: decimal id space exhausted');
+    }
+  }
+  // `{ksuid}` alone, after the prefix, or after it and a separator (`{prefix}_{ksuid}`: Clerk's `user_2…`)
+  // `{ksuid:N}` gives the id N characters (a vendor's own length: OpenAI's `proj_` 24, `chatcmpl-` 29), its order kept
+  const ksuid = /^(?:\{prefix\}([_-]?))?\{ksuid(?::(\d+))?\}$/.exec(template);
+  // narrower than 11 characters a KSUID no longer holds its instant and mint count, so neither order nor uniqueness
+  // within a second: such an id is minted otherwise ({letters:N}, {hex:N})
+  if (ksuid && ksuid[2] && Number(ksuid[2]) < 11) throw new Error(`${m.service}: ${resource}'s id template ${template} is narrower than a KSUID's 11 ordered characters`);
+  if (ksuid) return mintKsuid(m, resource, at, root, ksuid[1] !== undefined ? `${prefix}${ksuid[1]}` : '', snapshot, ksuid[2] ? Number(ksuid[2]) : 27);
   const [head, tail = ''] = template.split('{n}');
   const pattern = new RegExp(`^${escapeRe(String(fill(head!, { prefix })))}(\\d+)${escapeRe(String(fill(tail, { prefix })))}$`);
-  let max = 0;
+  let max = 0n;
   // the one type, from the index that follows writes (a scan of the whole World per create grew with it)
-  for (const r of resourcesOfType(m.service, storedType(m, resource), root)) {
+  for (const r of (snapshot ? snapshot.filter((r) => r.type === storedType(m, resource)) : resourcesOfType(m.service, storedType(m, resource), root))) {
     const hit = pattern.exec(r.id);
-    if (hit) max = Math.max(max, Number(hit[1]));
+    if (hit && BigInt(hit[1]!) > max) max = BigInt(hit[1]!);
   }
-  return String(fill(template, { prefix, n: max + 1 }));
+  return String(fill(template, { prefix, n: String(max + 1n) }));
 }
 
 /** The next snowflake (Discord's, X's): the milliseconds since the vendor's epoch shifted left 22 bits, the low bits an
@@ -886,13 +994,13 @@ function mintId(m: DerivedManifest, resource: string, root?: string, at?: string
 /** The last snowflake minted per vendor and World in this process: two mints before the first is written (a message
  *  and its attachment) must not meet. */
 const lastSnowflake = new Map<string, bigint>();
-function mintSnowflake(m: DerivedManifest, epoch: bigint, root?: string, at?: string): string {
+function mintSnowflake(m: DerivedManifest, epoch: bigint, root?: string, at?: string, snapshot?: readonly TwinResource[]): string {
   const ms = BigInt(Date.parse(at ?? '') || 0);
   const base = ms > epoch ? (ms - epoch) << 22n : 0n;
   let max = -1n;
   for (const [name, decl] of Object.entries(m.resources)) {
     if (!/^\{snowflake:\d+\}$/.test(decl.ids ?? m.ids.template)) continue;
-    for (const r of resourcesOfType(m.service, storedType(m, name), root)) if (/^\d+$/.test(r.id)) { const v = BigInt(r.id); if (v > max) max = v; }
+    for (const r of (snapshot ? snapshot.filter((r) => r.type === storedType(m, name)) : resourcesOfType(m.service, storedType(m, name), root))) if (/^\d+$/.test(r.id)) { const v = BigInt(r.id); if (v > max) max = v; }
   }
   const key = `${m.service}\0${root ?? ''}`;
   const last = lastSnowflake.get(key) ?? -1n;
@@ -902,10 +1010,21 @@ function mintSnowflake(m: DerivedManifest, epoch: bigint, root?: string, at?: st
   return String(id);
 }
 
+/** The next KSUID for a resource (Clerk's and Svix's ids, `ksuidFrom`): the World's instant, then the type's mint
+ *  count, so a frozen clock still lists them as made; past any the World already holds. */
+function mintKsuid(m: DerivedManifest, resource: string, at: string | undefined, root?: string, prefix = '', snapshot?: readonly TwinResource[], width = 27): string {
+  const held = new Set((snapshot ? snapshot.filter((r) => r.type === storedType(m, resource)) : resourcesOfType(m.service, storedType(m, resource), root)).map((r) => r.id));
+  const seconds = Math.floor((Date.parse(at ?? '') || 0) / 1000);
+  for (let n = held.size + 1; ; n++) {
+    const id = `${prefix}${ksuidFrom(seconds, n, `${m.service}:${resource}:${n}`, width)}`;
+    if (!held.has(id)) return id;
+  }
+}
+
 /** The next id of `count` lowercase letters for a resource, derived from the resource and the count before it, past
  *  any the World already holds. */
-function mintLetters(m: DerivedManifest, resource: string, count: number, root?: string, prefix = ''): string {
-  const held = new Set(resourcesOfType(m.service, storedType(m, resource), root).map((r) => r.id));
+function mintLetters(m: DerivedManifest, resource: string, count: number, root?: string, prefix = '', snapshot?: readonly TwinResource[]): string {
+  const held = new Set((snapshot ? snapshot.filter((r) => r.type === storedType(m, resource)) : resourcesOfType(m.service, storedType(m, resource), root)).map((r) => r.id));
   for (let n = held.size + 1; ; n++) {
     const id = `${prefix}${lettersFrom(`${m.service}:${resource}:${n}`, count)}`;
     if (!held.has(id)) return id;
@@ -914,8 +1033,8 @@ function mintLetters(m: DerivedManifest, resource: string, count: number, root?:
 
 /** The next hex id for a resource: N hex digits derived from the resource and the count before it, past any the World
  *  already holds (a Cloudflare id, 32). */
-function mintHex(m: DerivedManifest, resource: string, count: number, root?: string, prefix = ''): string {
-  const held = new Set(resourcesOfType(m.service, storedType(m, resource), root).map((r) => r.id));
+function mintHex(m: DerivedManifest, resource: string, count: number, root?: string, prefix = '', snapshot?: readonly TwinResource[]): string {
+  const held = new Set((snapshot ? snapshot.filter((r) => r.type === storedType(m, resource)) : resourcesOfType(m.service, storedType(m, resource), root)).map((r) => r.id));
   for (let n = held.size + 1; ; n++) {
     const id = `${prefix}${sha256(`${m.service}:${resource}:${n}`).slice(0, count)}`;
     if (!held.has(id)) return id;
@@ -924,28 +1043,43 @@ function mintHex(m: DerivedManifest, resource: string, count: number, root?: str
 
 /** The next UUID for a resource: a version-4-shaped UUID derived from the resource and the count before it, past any
  *  the World already holds. */
-function mintUuid(m: DerivedManifest, resource: string, root?: string): string {
+function mintUuid(m: DerivedManifest, resource: string, root?: string, snapshot?: readonly TwinResource[]): string {
   const type = storedType(m, resource);
-  const held = new Set(resourcesOfType(m.service, type, root).map((r) => r.id));
+  const held = new Set((snapshot ? snapshot.filter((r) => r.type === type) : resourcesOfType(m.service, type, root)).map((r) => r.id));
   for (let n = held.size + 1; ; n++) {
     const id = uuidFrom(`${m.service}:${resource}:${n}`);
     if (!held.has(id)) return id;
   }
 }
 
-function expand(m: DerivedManifest, resource: string, body: Record<string, unknown>, paths: string[], root?: string): Record<string, unknown> {
+function expand(m: DerivedManifest, resource: string, body: Record<string, unknown>, paths: string[], root?: string, within: ReadonlySet<string> = new Set()): Record<string, unknown> {
+  body = omitView(m, resource, body);
   const embeds = m.resources[resource]?.embeds ?? {};
+  // the fields the vendor always embeds join the caller's paths; a resource already being embedded above is not embedded
+  // again inside itself (a cycle answers the id)
+  const always = within.has(resource) ? [] : (m.resources[resource]?.alwaysEmbedded ?? []);
+  const inner = new Set([...within, resource]);
   const out = { ...body };
-  for (const path of paths) {
+  const idKey = m.resources[resource]?.idAs ?? 'id';
+  const ownId = typeof body[idKey] === 'string' ? body[idKey] as string : undefined;
+  for (const [field, c] of within.has(resource) ? [] : Object.entries(m.resources[resource]?.collections ?? {})) {
+    if (!ownId) continue;
+    const childPaths = paths.filter((p) => p.startsWith(`${field}.data.`)).map((p) => p.slice(field.length + 6));
+    const data = stored(m, c.resource, root).filter((r) => (r as Record<string, unknown>)[c.by] === ownId)
+      .map((r) => expand(m, c.resource, view(m, c.resource, r), childPaths, root, inner));
+    const fill = (v: unknown): unknown => v === '{count}' ? data.length : typeof v === 'string' ? v.replaceAll('{id}', ownId) : v;
+    out[field] = { ...Object.fromEntries(Object.entries(c.list ?? {}).map(([k, v]) => [k, fill(v)])), data };
+  }
+  for (const path of [...new Set([...always, ...paths])]) {
     const [head, ...rest] = path.split('.');
     const target = embeds[head!];
     const id = out[head!];
     if (!target) continue;
     // an object already embedded (an earlier path's) is walked further, not fetched again
-    if (id && typeof id === 'object' && !Array.isArray(id)) { if (rest.length) out[head!] = expand(m, target, id as Record<string, unknown>, [rest.join('.')], root); continue; }
+    if (id && typeof id === 'object' && !Array.isArray(id)) { out[head!] = expand(m, target, id as Record<string, unknown>, rest.length ? [rest.join('.')] : [], root, inner); continue; }
     if (typeof id !== 'string') continue;
     const hit = stored(m, target, root).find((r) => r.id === id);
-    if (hit) out[head!] = rest.length ? expand(m, target, view(m, target, hit), [rest.join('.')], root) : view(m, target, hit);
+    if (hit) out[head!] = expand(m, target, view(m, target, hit), rest.length ? [rest.join('.')] : [], root, inner);
   }
   return out;
 }
@@ -955,8 +1089,8 @@ function expandPaths(m: DerivedManifest, params: Record<string, unknown>): strin
   return Array.isArray(raw) ? raw.map(String) : typeof raw === 'string' ? [raw] : [];
 }
 
-async function write(m: DerivedManifest, call: DerivedCall, resource: string, id: string, fields: Record<string, unknown>, operation: string, params: Record<string, unknown>, root: string | undefined, occurredAt: string): Promise<Record<string, unknown>> {
-  return (await writeDetailed(m, call, resource, id, fields, operation, params, root, occurredAt)).body;
+async function write(m: DerivedManifest, call: DerivedCall, resource: string, id: string, fields: Record<string, unknown>, operation: string, params: Record<string, unknown>, root: string | undefined, occurredAt: string, checks?: StateChecks): Promise<Record<string, unknown>> {
+  return (await writeDetailed(m, call, resource, id, fields, operation, params, root, occurredAt, checks)).body;
 }
 
 /** The request a context was opened for, as it came (contextFor): its path parameters, the query names the operation
@@ -969,8 +1103,9 @@ const sentOf = new WeakMap<DerivedCall, SentRequest>();
 export const LANE_HEADER = 'x-volter-lane';
 function sentRequest(m: DerivedManifest, call: DerivedCall, body: unknown): SentRequest {
   const url = new URL(call.request.url);
-  const named = [...(m.headers ?? []), ...(m.version ? [m.version.header] : [])];
-  const headers = Object.fromEntries(named.flatMap((h) => { const v = call.request.headers.get(h); return v === null ? [] : [[h.toLowerCase(), v]]; }));
+  const named = [...(m.headers ?? []), ...(m.version ? [m.version.header] : [])].map((h) => h.toLowerCase());
+  const recorded = (h: string): boolean => named.some((n) => (n.endsWith('*') ? h.startsWith(n.slice(0, -1)) : h === n));
+  const headers = Object.fromEntries([...call.request.headers].filter(([h]) => recorded(h.toLowerCase())).map(([h, v]) => [h.toLowerCase(), v]));
   const lane = call.request.headers.get(LANE_HEADER) ?? undefined;
   const requestId = call.request.headers.get('x-twins-request-id') ?? undefined;
   const declared = new Set((call.operation.query ?? []).map((q) => q.name));
@@ -987,6 +1122,9 @@ function sentRequest(m: DerivedManifest, call: DerivedCall, body: unknown): Sent
 }
 /** What a write records of the call that made it: the surface operation and the request as it came, or which of the
  *  World's own doors made it (a door or a screen, the gap, the clock), which a perform never sends. */
+/** An operation whose body is its payload's bytes, one `blob` field: recorded as it came and never read as JSON
+ *  ("What the derived core records with a write"). */
+const bytesPayload = (op: DerivedCall['operation']): boolean => op.body?.length === 1 && op.body[0]!.type === 'blob';
 /** A body as it came: `{ $text }` when its bytes are UTF-8, else `{ $base64 }`. */
 async function rawBody(request: Request): Promise<{ $text: string } | { $base64: string }> {
   const bytes = new Uint8Array(await request.clone().arrayBuffer());
@@ -1017,14 +1155,15 @@ function recordedInput(m: DerivedManifest, call: DerivedCall, merged: Record<str
   }
   if (id === 'clock') return { clock: true };
   if (id === 'unmatched') return { gap: true, ...asSent };
-  if ((m.doors ?? []).some((d) => d.id === id) || (m.screens ?? []).some((sc) => sc.id === id) || id === 'machine-pool' || id.startsWith('socket:')) return { door: id, ...asSent };
+  if ((m.doors ?? []).some((d) => d.id === id) || (m.screens ?? []).some((sc) => sc.id === id) || (m.accountSetup ?? []).some((a) => a.operation === id) || id === 'machine-pool' || id.startsWith('socket:')) return { door: id, ...asSent };
   return { operationId: id, ...asSent };
 }
 
 /** The scope each call is served in (serveCore, contextFor), for the contexts a write opens for its hooks. */
 const scopeOfCall = new WeakMap<DerivedCall, CoreScope>();
 
-async function writeDetailed(m: DerivedManifest, call: DerivedCall, resource: string, id: string, fields: Record<string, unknown>, operation: string, params: Record<string, unknown>, root: string | undefined, occurredAt: string): Promise<{ body: Record<string, unknown>; id: string; vendorData?: unknown }> {
+async function writeDetailed(m: DerivedManifest, call: DerivedCall, resource: string, id: string, fields: Record<string, unknown>, operation: string, params: Record<string, unknown>, root: string | undefined, occurredAt: string, checks?: StateChecks): Promise<{ body: Record<string, unknown>; id: string; vendorData?: unknown }> {
+  const before = stateBeforeWrite(m, resource, id, root);
   const withFiles = async (input: Record<string, unknown>): Promise<Record<string, unknown>> => { const files = input.operationId ? await keptFiles(m, call, root) : undefined; return files ? { ...input, files } : input; };
   const { resource: row, result } = await applyTwinWrite(
     m.service,
@@ -1036,6 +1175,38 @@ async function writeDetailed(m: DerivedManifest, call: DerivedCall, resource: st
       : { operation, subjectType: storedType(m, resource), subjectId: id, fields, input: await withFiles(recordedInput(m, call, params)), occurredAt, actor: { kind: 'agent', ...(m.identity ? { id: m.identity(call.request.headers.get('authorization'), root) } : {}) } },
     root,
   );
+  observeStateWrite(m, result, before, root, checks);
+  return finishWrite(m, call, resource, row, result, operation, params, root, occurredAt);
+}
+
+async function atomicWrite(m: DerivedManifest, call: DerivedCall, resource: string,
+  decide: (snapshot: readonly TwinResource[]) => { id: string; fields: Record<string, unknown> } | undefined,
+  operation: string, params: Record<string, unknown>, root: string | undefined, occurredAt: string, unchangedId?: string, checks?: StateChecks,
+): Promise<Record<string, unknown> | undefined> {
+  const input = recordedInput(m, call, params);
+  const files = input.operationId ? await keptFiles(m, call, root) : undefined;
+  let before: TwinResource | undefined;
+  const committed = await applyTwinWriteAtomic(m.service, (snapshot) => {
+    const selected = decide(snapshot);
+    if (selected && transitionObserver) before = snapshot.find((r) => r.type === storedType(m, resource) && r.id === selected.id);
+    return selected ? { kind: 'write', value: selected.id, write: {
+      operation, subjectType: storedType(m, resource), subjectId: selected.id, fields: selected.fields,
+      input: files ? { ...input, files } : input, occurredAt, actor: { kind: 'agent' as const, ...(m.identity ? { id: m.identity(call.request.headers.get('authorization'), root) } : {}) },
+    } } : { kind: 'skip', value: undefined };
+  }, root);
+  if (!committed.result || !committed.value) {
+    const row = unchangedId ? stored(m, resource, root).find((r) => r.id === unchangedId) : undefined;
+    return row ? view(m, resource, row) : undefined;
+  }
+  observeStateWrite(m, committed.result, before, root, checks);
+  const row = resourcesOfType(m.service, storedType(m, resource), root).find((r) => r.id === resolveSubjectId(m.service, storedType(m, resource), committed.value!, root))!;
+  return (await finishWrite(m, call, resource, row, committed.result, operation, params, root, occurredAt)).body;
+}
+
+async function finishWrite(m: DerivedManifest, call: DerivedCall, resource: string, row: TwinResource,
+  result: { externalId?: string; vendorData?: unknown }, operation: string, params: Record<string, unknown>,
+  root: string | undefined, occurredAt: string,
+): Promise<{ body: Record<string, unknown>; id: string; vendorData?: unknown }> {
   await keepCounts(m, call, resource, row as unknown as Record<string, unknown>, params, root, occurredAt);
   const body = view(m, resource, row);
   // the write's own context for its hooks, in the scope the call was served in (a walk's application answers, a tenant,
@@ -1045,9 +1216,11 @@ async function writeDetailed(m: DerivedManifest, call: DerivedCall, resource: st
   if (m.events) {
     const events = m.events;
     const write = { operation, storedType: storedType(m, resource), body, ...(root !== undefined ? { root } : {}), occurredAt, request: call.request };
-    await deliverEvents(m.service, events, write, async (type) => (events.render ? events.render(await context(), write, type) : body), undefined, events.values ? async (type) => events.values!(await context(), write, type) : undefined, (answer) => deliveryOutcome(m, answer, root));
+    await deliverEvents(m.service, events, write, async (type) => (events.render ? events.render(await context(), write, type) : body), undefined, events.values ? async (type) => events.values!(await context(), write, type) : undefined);
   }
   if (m.sockets?.length) socketWrite(m.service, root, { operation, storedType: storedType(m, resource), body, ...(root !== undefined ? { root } : {}), occurredAt, request: call.request });
+  // a read held until the World writes (held-reads.ts) hears it
+  heldReadsWrite(m.service, root, storedType(m, resource));
   // the subject's id as it stands after the write: the vendor's, when a live head minted one
   return { body, id: result.externalId ?? row.id, ...(result.vendorData !== undefined ? { vendorData: result.vendorData } : {}) };
 }
@@ -1059,13 +1232,13 @@ async function keepCounts(m: DerivedManifest, call: DerivedCall, resource: strin
     for (const [field, c] of Object.entries(decl.counts ?? {})) {
       if (storedType(m, c.of) !== storedType(m, resource) || row[c.by] === undefined || row[c.by] === null) continue;
       const pid = String(row[c.by]);
-      const held = stored(m, parent, root).find((r) => r.id === pid) as Record<string, unknown> | undefined;
+      const held = stored(m, parent, root).find((r) => String(c.parentKey ? ownFields(r)[c.parentKey] : r.id) === pid) as Record<string, unknown> | undefined;
       if (!held) continue;
       const n = stored(m, c.of, root).filter((r) => {
         const x = r as Record<string, unknown>;
-        return String(x[c.by]) === pid && (c.present === undefined || (x[c.present] !== undefined && x[c.present] !== null));
+        return String(x[c.by]) === pid && (c.present === undefined || (x[c.present] !== undefined && x[c.present] !== null)) && Object.entries(c.unless ?? {}).every(([key, value]) => ownFields(r)[key] !== value);
       }).length + (c.plus ?? 0);
-      if (held[field] !== n) await writeDetailed(m, call, parent, pid, { [field]: n }, `${storedType(m, parent)}.counted`, params, root, occurredAt);
+      if (held[field] !== n) await writeDetailed(m, call, parent, String(held.id), { [field]: n }, `${storedType(m, parent)}.counted`, params, root, occurredAt);
     }
   }
 }
@@ -1079,7 +1252,7 @@ const encodeOffset = (o: number): string => btoa(JSON.stringify({ o }));
 function decodeOffset(cursor: unknown): number {
   if (typeof cursor !== 'string' || !cursor) return 0;
   try {
-    const o = (JSON.parse(atob(cursor)) as { o?: unknown }).o;
+    const o = (parseExactJson(atob(cursor)) as { o?: unknown }).o;
     return typeof o === 'number' && o >= 0 ? o : 0;
   } catch {
     return 0;
@@ -1091,58 +1264,65 @@ function decodeOffset(cursor: unknown): number {
 /** What a coverage measurement sees of a pack's declared state logic: each move a request made and each refusal a
  *  guard gave, by the transition that decided it. Nothing is observed unless a measurement installs an observer
  *  (scripts/life-coverage.ts); serving never depends on it. */
-export type TransitionObserver = (decl: StateField, transition: Transition, outcome: 'moved' | 'refused', from: string) => void;
+export type TransitionEntry = { action: TwinAction; field: string; actor: Actor };
+export type TransitionObserver = (decl: StateField, transition: Transition, outcome: 'moved' | 'refused', from: string, entry?: TransitionEntry) => void;
 let transitionObserver: TransitionObserver | undefined;
 export function observeTransitions(observer: TransitionObserver | undefined): void {
   transitionObserver = observer;
 }
 
+type StateCheck = { transition: Transition; operation: string; from: string; to: string; actor: Actor };
+type StateChecks = Map<string, StateCheck[]>;
+const stateCheckKey = (type: string, field: string): string => JSON.stringify([type, field]);
+const stateValue = (row: Record<string, unknown>, field: string): unknown => field.split('.').reduce<unknown>((value, part) => value && typeof value === 'object' ? (value as Record<string, unknown>)[part] : undefined, row);
+function stateBeforeWrite(m: DerivedManifest, resource: string, id: string, root?: string): TwinResource | undefined {
+  if (!transitionObserver) return undefined;
+  const type = storedType(m, resource);
+  const key = resolveSubjectId(m.service, type, id, root);
+  return resourcesOfType(m.service, type, root).find((row) => row.id === key);
+}
+
+/** Observe the committed entry, not a legality probe's display id. Only a move the machine checks
+ *  for this entry's actual states, operation and actor is reported; no serving depends on measurement. */
+function observeStateWrite(m: DerivedManifest, result: { actionId: string; status: 'performed' | 'replayed' }, before: TwinResource | undefined, root?: string, checks?: StateChecks): void {
+  if (!transitionObserver) return;
+  const action = listActions(m.service, root).find((a) => a.id === result.actionId);
+  if (!action?.fields) return;
+  const prior = before ? ownFields(before) : undefined;
+  const next = { ...prior, ...action.fields };
+  const decisions = new Map<string, StateCheck[]>();
+  for (const [resource, decl] of Object.entries(m.resources)) {
+    if ((decl.storedAs ?? resource) !== action.subject.type) continue;
+    for (const [field, machine] of Object.entries(decl.state ?? {})) {
+      if (!(field.split('.')[0]! in action.fields)) continue;
+      const key = stateCheckKey(action.subject.type, field);
+      // Aliases of one stored field use the same consumed evidence on this one entry.
+      if (!decisions.has(key)) { decisions.set(key, checks?.get(key) ?? []); checks?.delete(key); }
+      if (result.status === 'replayed') continue;
+      const current = prior ? stateValue(prior, field) : undefined, target = stateOf(machine, stateValue(next, field));
+      const from = stateOf(machine, current);
+      const proof = decisions.get(key)!.find((c) => machine.transitions.includes(c.transition) && c.from === from && c.to === target);
+      // Initial-state and same-state moves still need an explicit check and a committed field write.
+      if ((!prior || from === target) && !proof) continue;
+      const actor = proof?.actor ?? (action.actor?.kind === 'system' || action.input?.clock === true ? 'vendor' : 'api');
+      const operation = typeof action.input?.operationId === 'string' ? action.input.operationId : proof?.operation ?? (action.input?.clock === true ? 'clock' : action.operation ?? '');
+      transitionFor(field, machine, operation, current, target, action.subject.id, actor, { action, field, actor });
+    }
+  }
+}
+
 /** The transition a request asks for on one state field, or the vendor's refusal when none applies. */
 /** What a declared machine says to one move: the transition that allows it, or the refusal it gives (and
  *  nothing when it declares neither). The derived core and `legal` ask it; so does an engine that is not
  *  HTTP-shaped (a line protocol's session), so one machine rules every wire. */
-/** What a delivery's answer writes on its endpoint (the endpoint kind's `outcome`, architecture "Events and webhooks"):
- *  a success resets the failure count and writes its fields; a failure counts, and a run of them makes the declared
- *  move, asked of the endpoint's machine as the vendor's (a move the machine does not allow is not made). Read fresh
- *  and written in one move, since the answer arrives after the write's own and answers may arrive together. */
-async function deliveryOutcome(m: DerivedManifest, answer: DeliveryAnswer, root?: string): Promise<void> {
-  const o = answer.kind.outcome!;
-  const type = answer.kind.storedAs;
-  const ok = answer.status >= 200 && answer.status < 300;
-  // the read and the count are one move under the action lock, so two answers at once count twice
-  await runAsVendorMove(() => applyTwinWriteAtomic(m.service, (resources) => {
-    const row = (resources as unknown as Array<Record<string, unknown>>).find((r) => r.type === type && String(r.id) === String(answer.row.id));
-    if (!row || row.deleted === true) return { kind: 'skip', value: undefined };
-    const fields: Record<string, unknown> = {};
-    let operation = `${type}.delivered`;
-    if (ok) {
-      fields[o.failures] = 0;
-      const seconds = Math.floor((Date.parse(answer.occurredAt) || 0) / 1000);
-      for (const [k, v] of Object.entries(o.success ?? {})) fields[k] = v === '$time.iso' ? answer.occurredAt : v === '$time.s' ? seconds : v;
-    } else {
-      const failures = (Number(row[o.failures]) || 0) + 1;
-      fields[o.failures] = failures;
-      operation = `${type}.delivery-failed`;
-      const exempt = o.unless !== undefined && row[o.unless.field] === o.unless.equals;
-      if (o.move && o.after !== undefined && failures >= o.after && !exempt) {
-        const decl = Object.values(m.resources).find((r) => (r.storedAs ?? '') === type) ?? m.resources[type];
-        const machine = decl?.state?.[o.move.field];
-        const { move } = machine ? transitionFor(o.move.field, machine, o.move.operation, row[o.move.field], o.move.to, String(row.id), 'vendor') : {};
-        if (move) { fields[o.move.field] = o.move.to; operation = o.move.operation; }
-      }
-    }
-    return { kind: 'write', value: undefined, write: { operation, subjectType: type, subjectId: String(row.id), fields, occurredAt: answer.occurredAt, actor: { kind: 'system' } } };
-  }, root));
-}
-
-export function transitionFor(field: string, decl: StateField, operationId: string, current: unknown, requested: unknown, id?: string, actor: Actor = 'api'): { move?: Transition; refusal?: ErrorSpec } {
+export function transitionFor(field: string, decl: StateField, operationId: string, current: unknown, requested: unknown, id?: string, actor: Actor = 'api', entry?: TransitionEntry): { move?: Transition; refusal?: ErrorSpec } {
   const now = stateOf(decl, current);
-  const candidates = decl.transitions.filter((t) => (t.actor ?? 'api') === actor && (t.operation ? t.operation === operationId : true) && (requested === undefined || (t.to ?? now) === String(requested)));
-  const move = candidates.find((t) => t.from === '*' || t.from.includes(now));
-  if (move) { transitionObserver?.(decl, move, 'moved', now); return { move }; }
-  const refused = candidates.find((t) => t.refusals?.[now]) ?? candidates.find((t) => t.refusal);
+  const candidates = decl.transitions.filter((t) => (t.actor ?? 'api') === actor && (t.operation ? t.operation === operationId : true) && (requested === undefined || (t.to ?? now) === String(requested) || (t.to === undefined && t.refusal !== undefined)));
+  const move = candidates.find((t) => !(t.to === undefined && t.refusal !== undefined) && (t.from === '*' || t.from.includes(now)));
+  if (move) { transitionObserver?.(decl, move, 'moved', now, entry); return { move }; }
+  const refused = candidates.find((t) => t.refusals?.[now]) ?? candidates.find((t) => t.refusal && (t.to !== undefined || t.from === '*' || t.from.includes(now)));
   const r = refused?.refusals?.[now] ?? refused?.refusal;
-  if (refused && r) transitionObserver?.(decl, refused, 'refused', now);
+  if (refused && r) transitionObserver?.(decl, refused, 'refused', now, entry);
   if (r) return { refusal: { status: r.status, message: String(fill(r.message, { from: current, to: refused!.to ?? now, field, id: id ?? '' })), ...(r.code ? { code: r.code } : {}) } };
   return {};
 }
@@ -1277,9 +1457,11 @@ function arrangeRows(m: DerivedManifest, resource: string, params: Record<string
   const indexed = rows.map((row, i) => ({ row, i }));
   indexed.sort((a, b) => {
     const x = a.row[order.field]; const y = b.row[order.field];
-    const byValue = !byText || typeof x === 'number' || typeof y === 'number' ? Number(x ?? 0) - Number(y ?? 0) : String(x ?? '').localeCompare(String(y ?? ''));
-    // ties by mint order (`file-twin-10` after `file-twin-9`), not by the ids' lexical order
-    const d = byValue || String(a.row.id).localeCompare(String(b.row.id), undefined, { numeric: true });
+    const byValue = !byText || typeof x === 'number' || typeof y === 'number' ? compareExactNumbers(x ?? 0, y ?? 0) : String(x ?? '').localeCompare(String(y ?? ''));
+    // ties (two made in one instant) by the order they were written: the rows come in the tree's order, which keeps each
+    // subject where it was first written, so this is the creation order whatever the id template (an ordered KSUID or
+    // count, or a hash-derived uuid, hex or letters id whose text says nothing of when it was made)
+    const d = byValue || a.i - b.i;
     return order.direction === 'desc' ? -d : d;
   });
   return indexed.map((x) => x.row);
@@ -1287,70 +1469,98 @@ function arrangeRows(m: DerivedManifest, resource: string, params: Record<string
 
 /** A page of arranged rows, answered in the manifest's list envelope with its paging (cursors, pages, offsets). */
 function pageRows(m: DerivedManifest, op: DerivedOperation, call: DerivedCall, params: Record<string, unknown>, rows: Array<Record<string, unknown>>, resource: string, root: string | undefined, paths: string[]): Response {
-  const size = m.list.limits?.[op.id] ?? m.list.limit;
-  const asked = params[m.list.limit.param];
+  const list = m.list;
+  if (!list) return vendorError(m, m.gap ?? m.notFound);
+  const size = list.limits?.[op.id] ?? list.limit;
+  const asked = params[list.limit.param];
   const n = asked === undefined || asked === '' ? size.default : Number(asked);
   const limit = Number.isFinite(n) ? Math.min(size.max, Math.max(1, Math.trunc(n))) : size.default;
-  const after = m.list.after ? params[m.list.after] : undefined;
-  const before = m.list.before ? params[m.list.before] : undefined;
+  const after = list.after ? params[list.after] : undefined;
+  const before = list.before ? params[list.before] : undefined;
   let from = 0;
   let to: number;
   if (typeof before === 'string') {
     const at = rows.findIndex((r) => r.id === before);
-    to = at === -1 ? (m.list.unknownCursor === 'end' ? 0 : rows.length) : at;
+    to = at === -1 ? (list.unknownCursor === 'end' ? 0 : rows.length) : at;
     from = Math.max(0, to - limit);
   } else {
     if (typeof after === 'string') {
       const at = rows.findIndex((r) => r.id === after);
-      from = at === -1 ? (m.list.unknownCursor === 'end' ? rows.length : 0) : at + 1;
+      from = at === -1 ? (list.unknownCursor === 'end' ? rows.length : 0) : at + 1;
     }
     to = from + limit;
   }
-  const page = rows.slice(from, to).map((r) => (paths.length ? expand(m, resource, r, paths.filter((p) => p.startsWith('data.')).map((p) => p.slice(5)), root) : r));
+  const page = rows.slice(from, to).map((r) => expand(m, resource, r, paths.filter((p) => p.startsWith('data.')).map((p) => p.slice(5)), root));
   const hasMore = typeof before === 'string' ? from > 0 : to < rows.length;
   const url = op.path.replace(/\{[^}]+\}/g, (p) => call.params[p.slice(1, -1)] ?? p);
-  if (m.list.page) {
-    const n = Math.max(1, Math.floor(Number(params[m.list.page.param]) || 1));
-    const slice = rows.slice((n - 1) * limit, n * limit);
+  if (list.page) {
+    const n = Math.max(1, Math.floor(Number(params[list.page.param]) || 1));
+    const slice = rows.slice((n - 1) * limit, n * limit).map((r) => expand(m, resource, r, paths.filter((p) => p.startsWith('data.')).map((p) => p.slice(5)), root));
     const last = Math.max(1, Math.ceil(rows.length / limit));
     const headers = new Headers();
-    if (m.list.page.link && rows.length > limit) {
+    if (list.page.link && rows.length > limit) {
       const at = (k: number): string => {
         const u = new URL(call.request.url);
-        u.searchParams.set(m.list.page!.param, String(k));
+        u.searchParams.set(list.page!.param, String(k));
         return u.toString();
       };
       const rels = [...(n > 1 ? [`<${at(n - 1)}>; rel="prev"`] : []), ...(n < last ? [`<${at(n + 1)}>; rel="next"`, `<${at(last)}>; rel="last"`] : []), ...(n > 1 ? [`<${at(1)}>; rel="first"`] : [])];
       if (rels.length) headers.set('link', rels.join(', '));
     }
     // `{total_count}` the count before paging, `{max_page}` the number of pages (none for an empty list: Polar's pagination)
-    return Response.json(fill(m.list.envelope, { data: slice, next_cursor: null, key: op.answers?.key ?? 'data', total_count: rows.length, max_page: Math.ceil(rows.length / limit) }), { headers });
+    return Response.json(fill(list.envelope, { data: slice, next_cursor: null, key: op.answers?.key ?? 'data', total_count: rows.length, max_page: Math.ceil(rows.length / limit) }), { headers });
   }
-  if (m.list.offset) {
-    const skip = Math.max(0, Math.trunc(Number(params[m.list.offset.param]) || 0));
+  if (list.offset) {
+    const skip = Math.max(0, Math.trunc(Number(params[list.offset.param]) || 0));
     const slice = rows.slice(skip, skip + limit);
     const key = op.answers?.key ?? 'data';
-    return Response.json({ ...(m.success ?? {}), [key]: slice, ...(fill(m.list.envelopes?.[op.id] ?? m.list.envelope, { data: slice, total_count: rows.length, key }) as object) });
+    return Response.json({ ...(m.success ?? {}), [key]: slice, ...(fill(list.envelopes?.[op.id] ?? list.envelope, { data: slice, total_count: rows.length, key }) as object) });
   }
-  if (m.list.cursor) {
-    const start = decodeOffset(params[m.list.cursor.param]);
+  if (list.cursor) {
+    if (list.cursor.encoding === 'offset-template') {
+      const cursor = list.cursor;
+      const names: string[] = [];
+      const pattern = '^' + cursor.template.split(/(\{offset\}|\{reverse\})/).map((part) => {
+        if (part === '{offset}' || part === '{reverse}') { names.push(part.slice(1, -1)); return '(\\d+)'; }
+        return escapeRe(part);
+      }).join('') + '$';
+      if (names.filter((name) => name === 'offset').length !== 1 || names.filter((name) => name === 'reverse').length !== 1)
+        throw new Error('list: offset-template must name offset and reverse once');
+      const value = params[cursor.param];
+      const hit = typeof value === 'string' ? new RegExp(pattern).exec(value) : undefined;
+      if (value !== undefined && !hit) return vendorError(m, { status: 400, message: 'Invalid cursor' });
+      const decoded = Object.fromEntries(names.map((name, i) => [name, Number(hit?.[i + 1] ?? 0)]));
+      if (!Number.isSafeInteger(decoded.offset) || ![0, 1].includes(decoded.reverse!)) return vendorError(m, { status: 400, message: 'Invalid cursor' });
+      const start = decoded.reverse ? Math.max(0, decoded.offset! - limit) : decoded.offset!;
+      const slice = rows.slice(start, start + limit);
+      const link = (offset: number, reverse: number, rel: string, available: boolean): string => {
+        const marker = cursor.template.replace('{offset}', String(offset)).replace('{reverse}', String(reverse));
+        const target = new URL(call.request.url); target.searchParams.set(cursor.param, marker);
+        return `<${target.href}>; rel="${rel}"; ${cursor.link.results}="${available}"; ${cursor.link.cursor}="${marker}"`;
+      };
+      return Response.json(fill(list.envelope, { data: slice, key: op.answers?.key ?? 'data' }), { headers: {
+        link: [link(start, 1, cursor.link.previous, start > 0), link(start + limit, 0, cursor.link.next, start + limit < rows.length)].join(', '),
+      } });
+    }
+    const start = decodeOffset(params[list.cursor.param]);
     const slice = rows.slice(start, start + limit);
     const next = start + limit < rows.length ? encodeOffset(start + limit) : '';
-    return Response.json({ ...(m.success ?? {}), ...(fill(m.list.envelope, { data: slice, next_cursor: next, key: op.answers?.key ?? 'data' }) as object), ...(op.answers?.key ? { [op.answers.key]: slice } : {}) });
+    return Response.json({ ...(m.success ?? {}), ...(fill(list.envelope, { data: slice, next_cursor: next, key: op.answers?.key ?? 'data' }) as object), ...(op.answers?.key ? { [op.answers.key]: slice } : {}) });
   }
-  return Response.json(fill(m.list.envelope, { data: page, has_more: hasMore, url, first_id: page[0]?.id ?? null, last_id: page.at(-1)?.id ?? null }));
+  return Response.json(fill(list.envelope, { data: page, has_more: hasMore, url, first_id: page[0]?.id ?? null, last_id: page.at(-1)?.id ?? null }));
 
 }
 
 /** Serve one operation from the manifest, or say why the core cannot. */
-/** A setting's fields as the vendor answers them: its own, without the kernel's bookkeeping or the parent it is kept
- *  under (a setting answers its values, not an identity). */
-function settingFields(own: Record<string, unknown>, parentField?: string): Record<string, unknown> {
-  return Object.fromEntries(Object.entries(own).filter(([k]) => !k.startsWith('_') && k !== 'deleted' && k !== parentField));
+/** A setting's fields as the vendor answers them: its own, without the kernel's bookkeeping (a `_` field the resource
+ *  does not declare the vendor's own, as view() and render() keep it) or the parent it is kept under (a setting answers
+ *  its values, not an identity). */
+function settingFields(own: Record<string, unknown>, parentField?: string, vendorUnderscored: readonly string[] = []): Record<string, unknown> {
+  return Object.fromEntries(Object.entries(own).filter(([k]) => (!k.startsWith('_') || vendorUnderscored.includes(k)) && k !== 'deleted' && k !== parentField));
 }
 function settingView(m: DerivedManifest, resource: string, hit: TwinResource): Record<string, unknown> {
   // ownFields: the kernel's id, type and updatedAt gone, a vendor's own of those names restored
-  return settingFields(ownFields(hit), m.resources[resource]?.parent?.field);
+  return settingFields(ownFields(hit), m.resources[resource]?.parent?.field, m.resources[resource]?.vendorUnderscored);
 }
 
 export async function serveCore(m: DerivedManifest, call: DerivedCall, scope: CoreScope = {}): Promise<CoreOutcome> {
@@ -1379,9 +1589,10 @@ export async function serveCore(m: DerivedManifest, call: DerivedCall, scope: Co
   // the vendor's success status from its spec: 201 for most creates, 204 with no body where it answers nothing
   const status = op.successStatus ?? 200;
   const answer = (body: Record<string, unknown>) => ({
-    served: status === 204 ? new Response(null, { status }) : Response.json(envelope(m, op, paths.length ? expand(m, resource, body, paths, root) : body), { status }),
+    served: status === 204 ? new Response(null, { status }) : Response.json(envelope(m, op, expand(m, resource,
+      body, paths, root)), { status }),
   });
-  const control = new Set([m.expandParam, m.list.limit.param, m.list.after, m.list.before, m.list.offset?.param, m.list.page?.param, m.list.cursor?.param].filter(Boolean) as string[]);
+  const control = new Set([m.expandParam, m.list?.limit.param, m.list?.after, m.list?.before, m.list?.offset?.param, m.list?.page?.param, m.list?.cursor?.param].filter(Boolean) as string[]);
   const data = Object.fromEntries(Object.entries(params).filter(([k]) => !control.has(k) && k !== 'id'));
   // a strict vendor refuses a body it does not declare before the core writes it (body.strict, as ctx.fields)
   if (m.body.strict && (op.class === 'create' || op.class === 'update')) {
@@ -1401,7 +1612,8 @@ export async function serveCore(m: DerivedManifest, call: DerivedCall, scope: Co
       const under: Record<string, unknown> = { ...(parent ? { [parent.field]: parentId } : {}), ...(tenantField ? { [tenantField]: tenant } : {}) };
       if (decl.number) {
         const siblings = stored(m, resource, root, { withDeleted: true }).filter(underParent);
-        (under as Record<string, unknown>)[decl.number.field] = 1 + siblings.reduce((n, r) => Math.max(n, Number((r as Record<string, unknown>)[decl.number!.field]) || 0), 0);
+        const next = siblings.reduce((n, r) => { const value = String((r as Record<string, unknown>)[decl.number!.field] ?? '0'); const held = /^-?\d+$/.test(value) ? BigInt(value) : 0n; return held > n ? held : n; }, 0n) + 1n;
+        (under as Record<string, unknown>)[decl.number.field] = exactInteger(String(next));
       }
       const made = { ...assigned, ...initial, ...under, ...data };
       const clash = conflictOf(m, resource, made, undefined, root);
@@ -1415,6 +1627,7 @@ export async function serveCore(m: DerivedManifest, call: DerivedCall, scope: Co
       return hit ? answer(view(m, resource, hit)) : { served: notFound(m, resource, String(idParam), Object.keys(call.params).at(-1)) };
     }
     case 'list': {
+      if (!m.list) return { unmodeled: 'no manifest list configuration' };
       const rows = stored(m, resource, root).filter(underParent).map((r) => view(m, resource, r));
       const arranged = arrangeRows(m, resource, params, rows);
       if (!Array.isArray(arranged)) return { served: vendorError(m, arranged) };
@@ -1439,6 +1652,7 @@ export async function serveCore(m: DerivedManifest, call: DerivedCall, scope: Co
       const current = view(m, resource, hit);
       const changes: Record<string, unknown> = { ...(op.class === 'update' ? data : {}) };
       let moved = false;
+      const stateChecks: StateChecks = new Map();
       for (const [field, sdecl] of Object.entries(decl.state ?? {})) {
         const requested = op.class === 'update' ? data[field] : undefined;
         if (op.class === 'update' && requested === undefined) continue;
@@ -1448,6 +1662,7 @@ export async function serveCore(m: DerivedManifest, call: DerivedCall, scope: Co
           if (op.class === 'update') return { unmodeled: `no declared transition of ${field} to ${String(requested)} by ${op.id}` };
           continue;
         }
+        if (transitionObserver) stateChecks.set(stateCheckKey(storedType(m, resource), field), [{ transition: move, operation: op.id, from: stateOf(sdecl, current[field]), to: move.to ?? stateOf(sdecl, current[field]), actor: 'api' }]);
         const stored = storedState(sdecl, move.to);
         if (stored !== undefined) changes[field] = stored;
         for (const [k, rule] of Object.entries(move.effects ?? {})) changes[k] = applyRule(m, rule, hit.id, { ...current, ...changes }, at);
@@ -1458,7 +1673,7 @@ export async function serveCore(m: DerivedManifest, call: DerivedCall, scope: Co
       for (const [k, v] of Object.entries(changes)) merged[k] = mergeField(decl.update, current[k], v);
       const clash = conflictOf(m, resource, { ...current, ...merged }, hit.id, root);
       if (clash) return { served: vendorError(m, clash) };
-      return answer(await write(m, call, resource, hit.id, merged, `${storedType(m, resource)}.${op.class === 'update' ? 'update' : op.id}`, params, root, at));
+      return answer(await write(m, call, resource, hit.id, merged, `${storedType(m, resource)}.${op.class === 'update' ? 'update' : op.id}`, params, root, at, stateChecks));
     }
     case 'delete': {
       const hit = idParam ? stored(m, resource, root).find((r) => namedBy(decl, r, idParam) && underParent(r)) : undefined;
@@ -1512,14 +1727,11 @@ export type SemanticsContext = {
   /** What the World's scenario decided for this turn (a model vendor's answer: the handler matched, or the miss), on an
    *  operation the pack's `semantics/scenario.ts` names; undefined elsewhere, or when the World carries no scenario. */
   scenario: ScenarioDecision | undefined;
-  /** A message the vendor sends the application's own server that no declared event is (a push notification), through
-   *  the World's route and egress rule: the receiver's status, or 0 when refused or unreachable. */
-  deliver(url: string, init: RequestInit): Promise<number>;
   /** A message the vendor sends the application's server and decides by its answer, waited on for at most `within`
    *  milliseconds (a real-time authorization request): its status and body, or why there was none. */
   ask(url: string, init: RequestInit, within: number): Promise<ApplicationAnswer>;
   /** A git repository of the World, by the pack's name for it (the git plane, world-core git/): its objects in the
-   *  World's content-addressed object store (one per service), its refs in the World's store. Served over smart HTTP
+   *  World's repository-scoped content-addressed object store, its refs in the World's store. Served over smart HTTP
    *  (`git.serveSmartHttp`), read and written through the library's codecs. */
   git(name: string): { store: GitObjectStore; refs: GitRefs };
   /** A value the World set for its application (world-env.ts): what the app was given and the vendor must agree with (a
@@ -1534,6 +1746,8 @@ export type SemanticsContext = {
   /** who is calling, when the manifest says how to tell */
   actor: string | undefined;
   now(): unknown;
+  /** Render a stored row or vendor view using its resource declaration, retaining the stored subject id fallback. */
+  render(row: Record<string, unknown>, resource?: string): Record<string, unknown>;
   get(resource: string, id: string): Record<string, unknown> | undefined;
   /** One credential subject in a manifest-declared owner's World store. Ambiguous stores refuse the read. */
   ownerRow(owner: string, resource: string, id: string): Record<string, unknown> | undefined;
@@ -1544,6 +1758,11 @@ export type SemanticsContext = {
   issue(resource: string): Promise<string>;
   /** The vendor's open sessions of one of its sockets in this World (a request answered by a session: sockets.ts). */
   sockets(id: string): SocketSession[];
+  /** Hold this read until the World writes (held-reads.ts: HTTP long polling): true when a write of one of the named
+   *  resources lands in this World, false when `ms` pass or the client hangs up; at once false in a read-only World. */
+  awaitWrite(resources: ReadonlyArray<string>, ms: number): Promise<boolean>;
+  /** Observe a condition until it holds or the caller's timeout/cancellation, waking on writes and pollMs. */
+  awaitCondition(resources: ReadonlyArray<string>, ms: number, pollMs: number, condition: () => Promise<boolean>): Promise<boolean>;
   /** A secret for `label` (an app's client secret, a store's read token): an HMAC under a seed the World makes once, at
    *  random, and keeps as bookkeeping no door answers. The same label gives the same secret for the World's whole life,
    *  and no one can compute it from ids the World shows, as they can a value derived from them alone. */
@@ -1558,6 +1777,12 @@ export type SemanticsContext = {
   /** The signing key for `label` when the World has made it (`signingKey`), else undefined: for code that signs where it
    *  cannot wait (a cookie's token, read everywhere), after a front made the key before anything is answered. */
   heldSigningKey(label: string, alg?: 'RS256' | 'Ed25519'): { privatePem: string; publicPem: string } | undefined;
+  /** Allocate a stored occurrence and append its fields under one action lock. The optional field factory is pure. */
+  create(resource: string, fields: Record<string, unknown> | ((id: string) => Record<string, unknown>), operation: string): Promise<Record<string, unknown>>;
+  /** Create under declared unique keys and the action lock; a collision returns the existing own-field view without a write. */
+  createUnique(resource: string, fields: Record<string, unknown> | ((id: string) => Record<string, unknown>), operation: string): Promise<{ created: boolean; row: Record<string, unknown> }>;
+  /** Decide an update from the current live stored row under the action lock; undefined leaves it unchanged. */
+  change(resource: string, id: string, decide: (row: Record<string, unknown>) => Record<string, unknown> | undefined, operation: string): Promise<Record<string, unknown> | undefined>;
   write(resource: string, id: string, fields: Record<string, unknown>, operation: string): Promise<Record<string, unknown>>;
   /** Add numeric deltas to an existing bookkeeping row under the kernel's atomic write seam. */
   accumulate(resource: string, id: string, deltas: Record<string, number>, operation: string): Promise<void>;
@@ -1578,8 +1803,8 @@ export type SemanticsContext = {
   tree(): Array<Record<string, unknown>>;
   /** The writes that touched a subject, in order: its history. */
   history(resource: string, id: string): Array<{ operation?: string; fields?: Record<string, unknown>; occurredAt?: string }>;
-  /** Write a bookkeeping subject (a `_`-prefixed type the vendor never serves), minting its id when none is given. */
-  record(type: string, fields: Record<string, unknown>, id?: string): Promise<string>;
+  /** Write bookkeeping without the incoming request; an explicit operation observes its checked state move. Mint an id when none is given. */
+  record(type: string, fields: Record<string, unknown>, id?: string, operation?: string): Promise<string>;
   /** Decide a write from the tree as it stands and make it, with nothing written between the read
    *  and the write (a minted number, a first poll that moves a subject). `decide` returns the write,
    *  or nothing to write; the answer is its `value`. */
@@ -1592,6 +1817,8 @@ export type SemanticsContext = {
   /** Validate the request body's top-level derived schema under body.validation, before a write. */
   validate(): Response | undefined;
   refuse(e: ErrorSpec): Response;
+  /** Answer the manifest's declared unserved capability gap. */
+  gap(): Response;
   notFound(resource: string, id: string, param?: string): Response;
   reply(body: unknown, status?: number): Response;
   /** Answer in the vendor's success envelope under this operation's key (`{ ok: true, channel }`). */
@@ -1665,7 +1892,7 @@ export type HandlerContext = Omit<SemanticsContext, 'now' | 'core' | 'atomically
 };
 /** What a write hook reads: the writing call's context without its ways to write, so a hook that renders an event
  *  cannot write again (and run itself again). */
-export type WriteHookContext = Omit<HandlerContext, 'write' | 'record' | 'accumulate' | 'at' | 'over'>;
+export type WriteHookContext = Omit<HandlerContext, 'write' | 'create' | 'createUnique' | 'change' | 'issue' | 'record' | 'accumulate' | 'at' | 'over'>;
 /** A derived pack's handler: one operation, by its operationId, over the contract's context. */
 export type Handler = (ctx: HandlerContext) => Promise<Response>;
 
@@ -1677,13 +1904,15 @@ export async function contextFor(m: DerivedManifest, call: DerivedCall, scope: C
   scopeOfCall.set(call, scope);
   const at = (scope.clock ?? worldNow)();
   // the guard's parse when it made one (taken once), else this context's own
-  const parsed = takeParsedBody(call.request);
-  const text = parsed ? '' : await bodyTextOf(call.request.clone()).catch(() => '');
+  // a body that is its payload's bytes (S3's PutObject) is never read as JSON, whatever its label
+  const payload = bytesPayload(call.operation);
+  const parsed = payload ? undefined : takeParsedBody(call.request);
+  const text = await bodyTextOf(call.request.clone()).catch(() => '');
   let body: unknown = parsed?.value;
-  if (!parsed) { try { body = text ? JSON.parse(text) : undefined; } catch { body = text; } }
+  if (!parsed) { if (payload) body = text || undefined; else { try { body = text ? parseExactJson(text) : undefined; } catch { body = text; } } }
   // the request as it came, before the core's parameter merge and alias adoption: what a write records, so a perform
   // can send it again (the real-system adapters, "What the derived core records with a write")
-  const boundary = multipartBoundary(call.request.headers.get('content-type'));
+  const boundary = payload ? null : multipartBoundary(call.request.headers.get('content-type'));
   const parts = boundary === null ? undefined : multipartParts(new Uint8Array(await call.request.clone().arrayBuffer()), boundary);
   // a body that is not JSON is recorded as it came, its type with it: text as text, bytes (a gzip the vendor's client
   // compressed itself, PostHog's `compression=gzip-js`) as base64
@@ -1694,8 +1923,20 @@ export async function contextFor(m: DerivedManifest, call: DerivedCall, scope: C
   // every read of the body is of a copy, so the handler's own `call.request` and the core's answer (`core()`) each
   // still find it unread, whichever of them reads it first
   const pristine = call.request.clone();
-  const params = await boundaryParams(m, { ...call, request: call.request.clone() }, root);
+  const params = await boundaryParams(m, { ...call, request: call.request.clone() }, root).catch((error) => {
+    // An around context opens before the credential/JSON guard. Keep non-body parameters available to it without
+    // turning the guard's declared malformed-body refusal into a context-construction exception.
+    if (!(error instanceof SyntaxError) || error.message !== 'malformed JSON body') throw error;
+    return boundaryParams(m, { ...call, request: new Request(call.request.url, { headers: call.request.headers }) }, root);
+  });
   const paths = expandPaths(m, params);
+  const stateChecks: StateChecks = new Map();
+  const rawResources = new WeakMap<Record<string, unknown>, string>();
+  const rawRow = (resource: string, row: TwinResource): Record<string, unknown> => {
+    const name = m.resources[resource] ? resource : Object.keys(m.resources).find((name) => storedType(m, name) === row.type);
+    rawResources.set(row as Record<string, unknown>, name ?? resource);
+    return row as Record<string, unknown>;
+  };
   return {
     call,
     params,
@@ -1705,18 +1946,25 @@ export async function contextFor(m: DerivedManifest, call: DerivedCall, scope: C
     root,
     publicBase: twinPublicBase(call.request),
     scenario: scenarioDecisionOf(call.request),
-    deliver: (url, init) => deliverToApplication(url, init),
     ask: (url, init, within) => askApplication(url, init, within, scope.application),
     worldEnv: (name) => worldEnvValue(name),
     asVendor: (fn) => runAsVendorMove(fn),
     git: (name) => {
       if (!/^[A-Za-z0-9_.-]+(\/[A-Za-z0-9_.-]+)*$/.test(name) || name.split('/').some((seg) => seg === '.' || seg === '..')) throw new Error(`semantics: ${name} is not a git repository name`);
       const plane = `${worldPaths(m.service, root).dir}/git`;
-      return { store: new GitObjectStore(getActiveBlobStore(), `${plane}/objects`), refs: new GitRefs(getActiveWorldStore(), `${plane}/repos/${name}`) };
+      return { store: new GitObjectStore(getActiveBlobStore(), `${plane}/repos/${name}`), refs: new GitRefs(getActiveWorldStore(), `${plane}/repos/${name}`) };
     },
     mail: (route, mail, headers) => sendMail(route, mail, headers),
     actor: m.identity ? m.identity(call.request.headers.get('authorization'), root) : undefined,
     now: () => now(m, at),
+    render: (row, resource) => {
+      const raw = rawResources.has(row);
+      const name = resource ?? rawResources.get(row);
+      const declared = name && (m.resources[name] ? name : Object.keys(m.resources).find((r) => storedType(m, r) === name));
+      const keep = declared ? m.resources[declared]?.vendorUnderscored ?? [] : [];
+      const shown = raw ? render(row as TwinResource, keep) : renderOwn(row, keep);
+      return omitView(m, declared || undefined, shown);
+    },
     get: (resource, id) => {
       const hit = stored(m, resource, root).find((r) => r.id === id);
       return hit ? view(m, resource, hit) : undefined;
@@ -1729,45 +1977,74 @@ export async function contextFor(m: DerivedManifest, call: DerivedCall, scope: C
     rows: (resource) => stored(m, resource, root).map((r) => view(m, resource, r)),
     mint: (resource) => mintId(m, resource, root, at),
     sockets: (id) => openSessions(m.service, root, id),
+    awaitWrite: (resources, ms) => (scope.readOnly === true || isReadOnlyRequest(call.request) ? Promise.resolve(false) : awaitWrite(m.service, root, resources.map((r) => storedType(m, r)), ms, call.request.signal)),
+    awaitCondition: (resources, ms, pollMs, condition) => awaitCondition(m.service, root, resources.map((r) => storedType(m, r)), scope.readOnly === true || isReadOnlyRequest(call.request) ? 0 : ms, pollMs, condition, call.request.signal),
     issue: async (resource) => {
-      const id = mintId(m, resource, root, at);
       if (!resource.startsWith('_')) throw new Error(`semantics: ${resource} is not a bookkeeping type (an issued id's type starts with _)`);
-      if (scope.readOnly !== true && !isReadOnlyRequest(call.request)) {
-        await applyTwinWrite(m.service, { operation: `${resource.slice(1)}.issue`, subjectType: storedType(m, resource), subjectId: id, fields: { issuedAt: at }, occurredAt: at, actor: { kind: 'system' } }, root);
-      }
-      return id;
+      if (scope.readOnly === true || isReadOnlyRequest(call.request)) return mintId(m, resource, root, at);
+      const { value } = await applyTwinWriteAtomic(m.service, (snapshot) => {
+        const id = mintId(m, resource, root, at, snapshot);
+        return { kind: 'write', value: id, write: { operation: `${resource.slice(1)}.issue`, subjectType: storedType(m, resource), subjectId: id, fields: { issuedAt: at }, occurredAt: at, actor: { kind: 'system' } } };
+      }, root);
+      return value;
     },
     occurredAt: at,
     secret: async (label) => hmac(await worldSeed(m.service, root, at), label, 'base64url'),
-    record: async (type, fields, id) => {
+    record: async (type, fields, id, operation) => {
       if (!type.startsWith('_')) throw new Error(`semantics: ${type} is not a bookkeeping type (bookkeeping types start with _)`);
       if (id !== undefined) {
-        await applyTwinWrite(m.service, { operation: `${type.slice(1)}.record`, subjectType: type, subjectId: id, fields, occurredAt: at, actor: { kind: 'system' } }, root);
+        const before = operation ? stateBeforeWrite(m, type, id, root) : undefined;
+        const { result } = await applyTwinWrite(m.service, { operation: operation ?? `${type.slice(1)}.record`, subjectType: type, subjectId: id, fields, occurredAt: at, actor: { kind: 'system' } }, root);
+        if (operation) observeStateWrite(m, result, before, root, stateChecks);
         return id;
       }
-      const { value } = await applyTwinWriteAtomic(m.service, (resources) => {
+      const { value, result } = await applyTwinWriteAtomic(m.service, (resources) => {
         // Allocate and append under the same state lock: concurrent sign-ins must never share an issue id.
         const subject = (() => {
           const prefix = `${type.slice(1)}_`;
-          let max = 0;
+          let max = 0n;
           for (const r of resources) {
             if (r.type !== type) continue;
-            const n = r.id.startsWith(prefix) ? Number(r.id.slice(prefix.length)) : NaN;
-            if (Number.isInteger(n) && n > max) max = n;
+            const digits = r.id.startsWith(prefix) ? r.id.slice(prefix.length) : '';
+            if (/^\d+$/.test(digits) && BigInt(digits) > max) max = BigInt(digits);
           }
-          return `${prefix}${max + 1}`;
+          return `${prefix}${max + 1n}`;
         })();
-        return { kind: 'write', value: subject, write: { operation: `${type.slice(1)}.record`, subjectType: type, subjectId: subject, fields, occurredAt: at, actor: { kind: 'system' } } };
+        return { kind: 'write', value: subject, write: { operation: operation ?? `${type.slice(1)}.record`, subjectType: type, subjectId: subject, fields, occurredAt: at, actor: { kind: 'system' } } };
       }, root, () => resourcesOfType(m.service, type, root));
+      if (operation && result) observeStateWrite(m, result, undefined, root, stateChecks);
       return value;
     },
     get machines() {
-      const enrolled = resourcesOfType(m.service, MACHINE_POOL, root).find((r) => r.id === 'pool') as unknown as { kind?: MachinePool['kind'] } | undefined;
-      return poolFor(m.service, root, enrolled?.kind ?? 'none');
+      const enrolled = resourcesOfType(m.service, MACHINE_POOL, root).find((r) => r.id === 'pool') as unknown as (LightPoolOptions & { kind?: MachinePool['kind']; httpReplies?: MachineHttpReply[] }) | undefined;
+      return guardedMachinePool(poolFor(m.service, root, enrolled?.kind ?? 'none', enrolled?.httpReplies, { images: enrolled?.images }), m.service, ['retrieve', 'list'].includes(call.operation.class) || (m.reads?.includes(call.operation.id) ?? false));
     },
     signingKey: (label, alg) => worldSigningKey(m.service, root, at, label, alg ?? 'RS256'),
     heldSigningKey: (label, alg) => heldWorldSigningKey(m.service, root, label, alg ?? 'RS256'),
-    write: (resource, id, fields, operation) => write(m, call, resource, id, fields, operation, params, root, at),
+    create: (resource, fields, operation) => atomicWrite(m, call, resource, (snapshot) => {
+      const id = mintId(m, resource, root, at, snapshot);
+      return { id, fields: typeof fields === 'function' ? fields(id) : fields };
+    }, operation, params, root, at, undefined, stateChecks).then((row) => row!),
+    createUnique: async (resource, fields, operation) => {
+      const rules = m.resources[resource]?.unique;
+      if (!rules?.length) throw new Error('createUnique requires declared unique keys');
+      let existing: Record<string, unknown> | undefined;
+      const row = await atomicWrite(m, call, resource, (snapshot) => {
+        const id = mintId(m, resource, root, at, snapshot);
+        const selected = typeof fields === 'function' ? fields(id) : fields;
+        const hit = snapshot.find((r) => r.type === storedType(m, resource) && r.deleted !== true && rules.some((rule) => rule.fields.every((f) => selected[f] !== undefined && view(m, resource, r)[f] === selected[f])));
+        if (hit) { existing = view(m, resource, hit); return undefined; }
+        return { id, fields: selected };
+      }, operation, params, root, at, undefined, stateChecks);
+      return existing ? { created: false, row: existing } : { created: true, row: row! };
+    },
+    change: (resource, id, decide, operation) => atomicWrite(m, call, resource, (snapshot) => {
+      const row = snapshot.find((r) => r.type === storedType(m, resource) && r.id === id && r.deleted !== true);
+      if (!row) return undefined;
+      const fields = decide(row as Record<string, unknown>);
+      return fields === undefined ? undefined : { id, fields };
+    }, operation, params, root, at, id, stateChecks),
+    write: (resource, id, fields, operation) => write(m, call, resource, id, fields, operation, params, root, at, stateChecks),
     accumulate: async (resource, id, deltas, operation) => {
       if (!resource.startsWith('_') || !m.resources[resource]) throw new Error('accumulate requires a declared bookkeeping resource');
       await applyTwinWriteAtomic(m.service, (resources) => {
@@ -1782,54 +2059,64 @@ export async function contextFor(m: DerivedManifest, call: DerivedCall, scope: C
         return { kind: 'write', value: undefined, write: { operation, subjectType: storedType(m, resource), subjectId: id, fields, occurredAt: at, actor: { kind: 'agent' } } };
       }, root);
     },
-    writeDetailed: (resource, id, fields, operation) => writeDetailed(m, call, resource, id, fields, operation, params, root, at),
+    writeDetailed: (resource, id, fields, operation) => writeDetailed(m, call, resource, id, fields, operation, params, root, at, stateChecks),
     resolve: (resource, id) => resolveSubjectId(m.service, storedType(m, resource), id, root),
     storedType: (resource) => storedType(m, resource),
     ok: (fields) => Response.json({ ...(m.success ?? {}), ...fields }),
-    row: (resource, id, opts) => stored(m, resource, root, opts).find((r) => r.id === id) as Record<string, unknown> | undefined,
-    rowsRaw: (resource, opts) => stored(m, resource, root, opts) as Array<Record<string, unknown>>,
+    row: (resource, id, opts) => { const row = stored(m, resource, root, opts).find((r) => r.id === id); return row ? rawRow(resource, row) : undefined; },
+    rowsRaw: (resource, opts) => stored(m, resource, root, opts).map((row) => rawRow(resource, row)),
     tree: () => twinResources(m.service, root) as Array<Record<string, unknown>>,
     history: (resource, id) => subjectHistory(m.service, { type: storedType(m, resource), id }, root).map((e) => ({ ...(e.operation ? { operation: e.operation } : {}), ...(e.fields ? { fields: e.fields as Record<string, unknown> } : {}), ...(e.occurredAt ? { occurredAt: e.occurredAt } : {}) })),
     raw: (body, init = {}) => new Response(body, { status: init.status ?? 200, headers: init.headers ?? {} }),
     atomically: async (decide) => {
-      const { value } = await applyTwinWriteAtomic(
+      let before: TwinResource | undefined;
+      const { value, result } = await applyTwinWriteAtomic(
         m.service,
         (resources) => {
           const rows = (resource: string): Array<Record<string, unknown>> => resources.filter((r) => r.type === storedType(m, resource) && r.deleted !== true) as Array<Record<string, unknown>>;
           const d = decide(rows);
           if (!d.write) return { kind: 'skip', value: d.value };
           const w = d.write;
+          if (transitionObserver) before = resources.find((r) => r.type === storedType(m, w.resource) && r.id === w.id);
           return { kind: 'write', value: d.value, write: { operation: w.operation, subjectType: storedType(m, w.resource), subjectId: w.id, fields: w.fields, occurredAt: at, actor: { kind: 'agent' } } };
         },
         root,
       );
+      if (result) observeStateWrite(m, result, before, root, stateChecks);
       return value;
     },
     legal: (resource, field, operationId, current, to, id, actor) => {
       const decl = m.resources[resource]?.state?.[field];
       if (!decl) throw new Error(`semantics: ${resource}.${field} is not a declared state field`);
       const { move, refusal } = transitionFor(field, decl, operationId, current, to, id ?? Object.values(call.params).at(-1), actor ?? 'api');
-      if (move) return undefined;
+      if (move) {
+        if (transitionObserver) {
+          const key = stateCheckKey(storedType(m, resource), field);
+          stateChecks.set(key, [...(stateChecks.get(key) ?? []), { transition: move, operation: operationId, from: stateOf(decl, current), to: move.to ?? stateOf(decl, current), actor: actor ?? 'api' }]);
+        }
+        return undefined;
+      }
       if (refusal) return refusal;
       throw new Error(`semantics: ${operationId} moves ${resource}.${field} from ${String(current)}${to ? ` to ${to}` : ''}, which the machine does not declare`);
     },
     refuse: (e) => vendorError(m, e),
+    gap: () => vendorError(m, m.gap ?? m.notFound),
     notFound: (resource, id, param) => notFound(m, resource, id, param),
     validate: () => validateBody(m, call.operation, body),
     reply: (body, status = 200) => Response.json(body, { status }),
     wrap: (body, extra = {}) => Response.json({ ...envelope(m, call.operation, body), ...extra }),
     sse: (events) => sse(m, events, call.operation.id),
-    expand: (resource, body, given) => ((given ?? paths).length ? expand(m, resource, body, given ?? paths, root) : body),
+    expand: (resource, body, given) => expand(m, resource, body, given ?? paths, root),
     at: (when) => contextFor(m, { ...call, request: new Request(call.request.url) }, { ...scope, clock: () => when }),
     crypto: handlerCrypto,
     flag: (value) => flagOf(m, value),
     fields: (body) => strictFields(m, call.operation, body),
-    vendorFetch: (url, init) => vendorFetch(url, init),
+    vendorFetch: (url, init) => vendorFetch(url, init, scope.application),
     parts: async () => {
       const boundary = multipartBoundary(call.request.headers.get('content-type'));
       return boundary === null ? [] : multipartParts(new Uint8Array(await call.request.clone().arrayBuffer()), boundary);
     },
-    engine: scope.database === undefined ? unboundDatabase(m.service) : managedDatabase(scope.database, { readOnly: scope.readOnly === true || isReadOnlyRequest(call.request), clock: at }),
+    engine: scope.database === undefined ? unboundDatabase(m.service) : managedDatabase(scope.database, { readOnly: scope.readOnly === true || isReadOnlyRequest(call.request) }),
     redis: (commands, options) => execRedisRun(commands, {
       root, occurredAt: at, service: m.service, readOnly: scope.readOnly === true || isReadOnlyRequest(call.request), dialect: options.dialect,
       ...(options.database === undefined ? {} : { database: options.database }),
@@ -1862,15 +2149,17 @@ export async function contextFor(m: DerivedManifest, call: DerivedCall, scope: C
 
 /** A pack's semantics handlers as the dispatch's handlers. */
 export function bindSemantics(m: DerivedManifest, handlers: Record<string, Semantics>, scope: CoreScope = {}): Record<string, DerivedHandler> {
+  prepareViewOmissions(m);
   return Object.fromEntries(Object.entries(handlers).map(([id, h]) => [id, async (call: DerivedCall) => h(await contextFor(m, call, scope))]));
 }
 
 /** The derived core as the dispatch's core: it owns every operation on a resource the manifest declares. */
 export function coreFor(m: DerivedManifest, scope: CoreScope = {}): { owns: (o: DerivedOperation) => boolean; serve: (call: DerivedCall) => Promise<DerivedCoreOutcome> } {
+  prepareViewOmissions(m);
   const crud = new Set(['create', 'retrieve', 'list', 'update', 'delete']);
   const owns = (o: DerivedOperation): boolean => {
     const decl = o.resource !== undefined ? m.resources[o.resource] : undefined;
-    if (!decl || m.unmodeled?.includes(o.id)) return false;
+    if (!decl || m.unmodeled?.includes(o.id) || (o.class === 'list' && !m.list)) return false;
     if (crud.has(o.class)) return true;
     return o.class === 'action' && Object.values(decl.state ?? {}).some((f) => f.transitions.some((t) => t.operation === o.id));
   };
@@ -1892,13 +2181,17 @@ export const SCENARIO_DECISION_HEADER = 'x-volter-scenario-decision';
 function scenarioDecisionOf(request: Request): ScenarioDecision | undefined {
   const raw = request.headers.get(SCENARIO_DECISION_HEADER);
   if (!raw) return undefined;
-  try { return JSON.parse(raw) as ScenarioDecision; } catch { return undefined; }
+  try { return parseExactJson(raw) as ScenarioDecision; } catch { return undefined; }
 }
 
 export function authRefusal(m: DerivedManifest, request: Request, root?: string): Response | undefined {
   if (!m.auth) return undefined;
   const url = new URL(request.url);
   if (m.auth.paths !== undefined && !new RegExp(m.auth.paths).test(url.pathname)) return undefined;
+  const wire = m.auth.wires?.find((w) => new RegExp(w.paths).test(url.pathname));
+  const errorManifest = wire ? { ...m, error: wire.error } : m;
+  const invalid = wire?.invalid ?? m.auth.invalid;
+  const missing = wire?.missing ?? m.auth.missing;
   const sources = [{ header: m.auth.header, scheme: m.auth.scheme }, ...(m.auth.also ?? [])];
   const given = sources.map((s) => (s.query !== undefined ? url.searchParams.get(s.query) : s.header ? request.headers.get(s.header) : null)).some((v) => v !== null);
   if (!given && !m.auth.gateWhenAbsent) return undefined;
@@ -1912,17 +2205,41 @@ export function authRefusal(m: DerivedManifest, request: Request, root?: string)
   };
   const key = sources.map(keyOf).find((k) => k !== '') ?? '';
   // no credential sent is `missing`; one sent in a form the vendor does not read is a key it does not know
-  if (!key) return vendorError(m, given ? m.auth.invalid : m.auth.missing);
-  if (m.auth.invalidKeys.includes(key) || (m.auth.keyFormat && !new RegExp(m.auth.keyFormat).test(key))) return vendorError(m, m.auth.invalid);
+  if (!key) return vendorError(errorManifest, given ? invalid : missing);
+  if (m.auth.invalidKeys.includes(key) || (m.auth.keyFormat && !new RegExp(m.auth.keyFormat).test(key))) return vendorError(errorManifest, invalid);
   const held = m.auth.held;
   if (held && !held.standing?.includes(key)) {
     const hash = sha256(key);
     const holds = resourcesOfType(m.service, held.storedAs, root).some((r) => r.deleted !== true && (r as Record<string, unknown>)[held.hashField] === hash && (held.unless === undefined || (r as Record<string, unknown>)[held.unless] !== true));
-    if (!holds) return vendorError(m, m.auth.invalid);
+    if (!holds) return vendorError(errorManifest, invalid);
   }
   return undefined;
 }
 
+/** The number of answers a World has given that carried a filled answer header (`answerHeaders`'s `{hex:N}`), kept in
+ *  the World's own directory beside its rate-budget ledger (bookkeeping, never a log entry): a fresh World counts from 1,
+ *  so two Worlds made alike answer the same values in the same order, and a resumed World counts on, never answering a
+ *  value the count holds again. A World with no root (an in-memory walk) counts in this process. */
+const answeredInMemory = new Map<string, number>();
+function nextAnswer(service: string, root: string | undefined): number {
+  const key = `${service}:${root ?? ''}`;
+  if (root === undefined) { const n = (answeredInMemory.get(key) ?? 0) + 1; answeredInMemory.set(key, n); return n; }
+  const store = getActiveWorldStore();
+  const path = `${worldPaths(service, root).dir}/answer-count`;
+  // a read-only request writes nothing, bookkeeping and its lock included, and reads the count without the lock: it
+  // counts on in this process past the kept count, so after a restart, or from another process serving the same World,
+  // the answers given to read-only requests since the last write may be given again
+  if (writesRefused()) { const kept = Number(store.read(path) ?? '0') || 0; const extra = (answeredInMemory.get(key) ?? 0) + 1; answeredInMemory.set(key, extra); return kept + extra; }
+  // read and written under the count's lock, as the rate-budget ledger is: two writes from processes serving one World never
+  // take one number
+  return store.withLock(`${path}.lock`, () => {
+    const n = (Number(store.read(path) ?? '0') || 0) + (answeredInMemory.get(key) ?? 0) + 1;
+    answeredInMemory.delete(key);
+    store.writeAtomic(path, String(n));
+    return n;
+  });
+}
+
 export function crossCutting(m: DerivedManifest, opts: CoreScope & { readOnly?: boolean } = {}): (call: DerivedCall, next: () => Promise<Response>) => Promise<Response> {
   const finish = async (r: Response, request: Request): Promise<Response> => {
     if (!m.origin || !(r.headers.get('content-type') ?? '').includes('json')) return withHeaders(r);
@@ -1932,7 +2249,14 @@ export function crossCutting(m: DerivedManifest, opts: CoreScope & { readOnly?:
   const withHeaders = (r: Response): Response => {
     if (!m.answerHeaders) return r;
     const headers = new Headers(r.headers);
-    for (const [k, v] of Object.entries(m.answerHeaders)) if (!headers.has(k)) headers.set(k, v);
+    const world = `${m.service}:${opts.root ?? ''}`;
+    let seed: string | undefined;
+    const filled = (v: string): string => v.replace(/\{hex:(\d+)\}/g, (_, w: string) => {
+      seed ??= `${world}:answer:${nextAnswer(m.service, opts.root)}`;
+      let hex = ''; for (let i = 0; hex.length < Number(w); i++) hex += sha256(`${seed}:${i}`);
+      return hex.slice(0, Number(w));
+    });
+    for (const [k, v] of Object.entries(m.answerHeaders)) if (!headers.has(k)) headers.set(k, filled(v));
     return new Response(r.body, { status: r.status, statusText: r.statusText, headers });
   };
   return async (call, next) => finish(await guarded(call, next), call.request);
@@ -1950,7 +2274,7 @@ export function crossCutting(m: DerivedManifest, opts: CoreScope & { readOnly?:
     // multipart or form: Cloudflare's asset and script uploads)
     const declared = call.operation.bodyEncoding;
     const labelled = request.headers.get('content-type') ?? '';
-    if ((labelled.includes('json') && !labelled.includes('ndjson')) || (m.body.json === 'always' && declared !== 'multipart' && declared !== 'form')) {
+    if (!bytesPayload(call.operation) && ((labelled.includes('json') && !labelled.includes('ndjson') && !labelled.includes('connect+')) || (m.body.json === 'always' && declared !== 'multipart' && declared !== 'form'))) {
       const ok = request.method === 'GET' || request.method === 'HEAD' ? true : await checkJsonBody(request.clone()).catch(() => true);
       if (!ok) return vendorError(m, m.malformedBody ?? { status: 400, message: 'The request body could not be parsed as JSON.' });
     }
@@ -1986,8 +2310,8 @@ export function crossCutting(m: DerivedManifest, opts: CoreScope & { readOnly?:
  *  coming (another wire's mutation, a door, a screen) — and answered with the vendor's own read-only
  *  error; `GET /twin` advertises `requestScopes`. The pack's catch-up runs under `runAsVendorMove`
  *  (request-scope.ts), so time's moves still land when a read-only request is what arrives. */
-export function derivedRequestScopes<F extends (request: Request) => Promise<Response>>(m: DerivedManifest, fetch: F): F {
-  return withRequestScopes(fetch, { refuse: () => vendorError(m, m.readOnly) });
+export function derivedRequestScopes<F extends (request: Request) => Promise<Response>>(m: DerivedManifest, fetch: F, readOnly = false): F {
+  return withRequestScopes(fetch, { readOnly, refuse: () => vendorError(m, m.readOnly) });
 }
 
 /** A semantics context for a request no surface operation names: another wire's (GraphQL) resolvers