@volter/world-core 3.0.38 → 3.0.39

package/dist/src/derived-core.js

@@ -1,3 +1,4 @@
+import { parseExactJson, compareExactNumbers, exactInteger, isExactIntegerValue } from "./exact-json.js";
 // THE DERIVED CORE — what a derived pack does for an operation it declares no handler for
 // (docs/contributing/architecture.md, "Protocol 3"). The generated surface says what the
 // vendor's operations are; the pack's manifest says the vendor facts no spec carries (how ids look,
@@ -14,20 +15,23 @@ import { GitRefs } from "./git/refs.js";
 import { worldNow } from "./world-clock.js";
 import { worldEnvValue } from "./world-env.js";
 import { openSessions, socketWrite } from "./sockets.js";
-import { MACHINE_POOL, poolFor } from "./machines.js";
-import { askApplication, deliverEvents, deliverToApplication } from "./events.js";
-import { handlerCrypto, hmac, lettersFrom, sha256, uuidFrom } from "./signing.js";
+import { awaitWrite, awaitCondition, heldReadsWrite } from "./held-reads.js";
+import { MACHINE_POOL, poolFor, guardedMachinePool } from "./machines.js";
+import { askApplication, deliverEvents } from "./events.js";
+import { handlerCrypto, hmac, ksuidFrom, lettersFrom, sha256, uuidFrom } from "./signing.js";
 import { hashFieldValue } from "./hash.js";
 import { readResourceBlob, removeResourceBlob, writeResourceBlob } from "./resource-blob.js";
 import { managedDatabase, unboundDatabase } from "./managed-database.js";
 import { execRedisRun } from "./redis/engine.js";
 import { sendMail } from "./smtp.js";
+import { ownField, parseBracketForm } from "./form.js";
+export { ownField, parseBracketForm } from "./form.js";
 import { multipartBoundary, multipartParts } from "./multipart.js";
-import { projectOwnerResources, resolveSubjectId, subjectAliases } from "./actions.js";
+import { listActions, projectOwnerResources, resolveSubjectId, subjectAliases } from "./actions.js";
 import { vendorFetch } from "./vendor-call.js";
 import { packReferences } from "./references.js";
 import { twinPublicBase, withRequestScopes } from "./twin-fetch.js";
-import { inVendorMove, isReadOnlyRequest, runAsVendorMove } from "./request-scope.js";
+import { inVendorMove, isReadOnlyRequest, runAsVendorMove, writesRefused } from "./request-scope.js";
 import { bodyTextOf, checkJsonBody, takeParsedBody } from "./derived.js";
 /** What a move to `to` stores in the field: a boolean field's value is a boolean, and a derived field's
  *  value is written by the move's effects (a state name is not a timestamp), so it stores nothing itself. */
@@ -44,7 +48,7 @@ export function stateOf(decl, value) {
             return d.state;
         if (w.equals !== undefined && value === w.equals)
             return d.state;
-        if (w.gt !== undefined && typeof value === 'number' && value > w.gt)
+        if (w.gt !== undefined && (typeof value === 'number' || isExactIntegerValue(value)) && compareExactNumbers(value, w.gt) > 0)
             return d.state;
         if (w.truthy !== undefined && Boolean(value) === w.truthy)
             return d.state;
@@ -68,13 +72,13 @@ export function strictFields(m, operation, body) {
         const { type } = field;
         const fits = value === null
             || (type === 'boolean' && typeof value === 'boolean')
-            || (type === 'integer' && Number.isInteger(value))
-            || (type === 'number' && typeof value === 'number')
+            || (type === 'integer' && isExactIntegerValue(value))
+            || (type === 'number' && (typeof value === 'number' || isExactIntegerValue(value)))
             || (type === 'string' && typeof value === 'string')
             || !['boolean', 'integer', 'number', 'string'].includes(type);
         if (!fits)
             return refuse(strict.type, { name, type: type === 'integer' ? 'an integer' : `a ${type}` });
-        if (typeof value === 'number' && ((field.minimum !== undefined && value < field.minimum) || (field.maximum !== undefined && value > field.maximum))) {
+        if ((typeof value === 'number' || isExactIntegerValue(value)) && ((field.minimum !== undefined && compareExactNumbers(value, field.minimum) < 0) || (field.maximum !== undefined && compareExactNumbers(value, field.maximum) > 0))) {
             return refuse(strict.range, { name, min: field.minimum ?? null, max: field.maximum ?? null });
         }
         fields[name] = value;
@@ -98,10 +102,10 @@ function validateBody(m, operation, body) {
             continue;
         }
         const types = field.type.split('|');
-        const fits = types.some((type) => type === 'null' ? value === null : type === 'integer' ? Number.isInteger(value) : type === 'array' ? Array.isArray(value) : type === 'object' ? value !== null && typeof value === 'object' && !Array.isArray(value) : type === 'string' ? typeof value === 'string' : type === 'number' ? typeof value === 'number' : type === 'boolean' ? typeof value === 'boolean' : true);
+        const fits = types.some((type) => type === 'null' ? value === null : type === 'integer' ? isExactIntegerValue(value) : type === 'array' ? Array.isArray(value) : type === 'object' ? value !== null && typeof value === 'object' && !Array.isArray(value) : type === 'string' ? typeof value === 'string' : type === 'number' ? typeof value === 'number' || isExactIntegerValue(value) : type === 'boolean' ? typeof value === 'boolean' : true);
         if (!fits)
             return refuse(rule.type, { name: field.name, type: field.type, input: value });
-        if (typeof value === 'number' && ((field.minimum !== undefined && value < field.minimum) || (field.maximum !== undefined && value > field.maximum)))
+        if ((typeof value === 'number' || isExactIntegerValue(value)) && ((field.minimum !== undefined && compareExactNumbers(value, field.minimum) < 0) || (field.maximum !== undefined && compareExactNumbers(value, field.maximum) > 0)))
             return refuse(rule.range, { name: field.name, min: field.minimum ?? null, max: field.maximum ?? null, input: value });
     }
     return undefined;
@@ -120,73 +124,6 @@ export function flagOf(m, value) {
         return false;
     return undefined;
 }
-/** A form body's bracket notation (`a[b][0][c]=v`, `expand[]=x`) as nested objects and arrays. A form carries only
- *  text: a field the operation's spec types as a number or a boolean (`scalars`, by bracket path, written by
- *  world-tooling's formScalarsOf) is read as one when its text is that literal; every other field stays the text sent
- *  (`metadata[order]=007`, `name=2024`). */
-/** A field set as the object's own, whatever its name (`__proto__`, `constructor` and `prototype` are data a caller
- *  may name: Stripe's metadata keys are the caller's), never through what the object inherits. */
-export function ownField(node, key, value) {
-    Object.defineProperty(node, key, { value, writable: true, enumerable: true, configurable: true });
-}
-/** A field the object holds as its own, never one it inherits (`constructor` is every object's). */
-const ownValue = (node, key) => (Object.hasOwn(node, key) ? node[key] : undefined);
-export function parseBracketForm(text, scalars) {
-    const out = {};
-    for (const [rawKey, raw] of new URLSearchParams(text)) {
-        const parts = rawKey.replace(/\]/g, '').split('[');
-        const kind = scalars && scalarAt(scalars, parts);
-        const value = kind === 'boolean' ? (raw === 'true' ? true : raw === 'false' ? false : raw)
-            : kind === 'integer' ? (/^-?\d+$/.test(raw) ? Number(raw) : raw)
-                : kind === 'number' ? (/^-?\d+(\.\d+)?$/.test(raw) ? Number(raw) : raw)
-                    : raw;
-        // every field is the node's own, read and written as such: a key naming an object's machinery (`__proto__[x]`,
-        // `constructor[prototype][x]`) is a field of that name, never a walk into what every object inherits
-        let node = out;
-        for (const [i, key] of parts.entries()) {
-            // an array holds its items by index (`a[]`, `a[0]`): a named key under one (`a[]=1&a[length]=-1`) has nowhere to
-            // go, as a key under text has none (`a=1&a[b]=2`): the first shape stands
-            if (Array.isArray(node) && key !== '' && !/^\d+$/.test(key))
-                break;
-            if (i === parts.length - 1) {
-                if (key === '') {
-                    if (Array.isArray(node))
-                        node.push(value);
-                }
-                else
-                    ownField(node, key, value);
-                break;
-            }
-            const next = parts[i + 1];
-            if (key === '')
-                break;
-            let child = ownValue(node, key);
-            if (child === undefined) {
-                child = next === '' || /^\d+$/.test(next) ? [] : {};
-                ownField(node, key, child);
-            }
-            if (child === null || typeof child !== 'object')
-                break;
-            node = child;
-        }
-    }
-    return out;
-}
-/** The type `scalars` gives a form key's parts: a segment is a property name, `[]` an array's item (an index or empty),
- *  `*` a map's key. */
-function scalarAt(scalars, parts) {
-    let paths = [''];
-    for (const [i, part] of parts.entries()) {
-        const segs = part === '' || /^\d+$/.test(part) ? ['[]', '*'] : [part, '*'];
-        paths = paths.flatMap((p) => segs.map((seg) => (i === 0 ? seg : `${p}.${seg}`)));
-        if (paths.length > 64)
-            paths = paths.filter((p) => Object.keys(scalars).some((k) => k === p || k.startsWith(`${p}.`)));
-    }
-    for (const p of paths)
-        if (scalars[p])
-            return scalars[p];
-    return undefined;
-}
 /** A request's parameters, its query's and its body's. With the manifest's `body.form.coerce`, a form's fields the
  *  operation's spec types as numbers or booleans are read as them (parseBracketForm); without an operation (a twin door)
  *  every form value is its text. */
@@ -194,7 +131,7 @@ export async function readParams(manifest, request, operation) {
     const url = new URL(request.url);
     const scalars = manifest.body.form?.coerce ? (operation?.scalars ?? {}) : undefined;
     const query = parseBracketForm(url.search.replace(/^\?/, ''), scalars);
-    if (request.method === 'GET' || request.method === 'HEAD')
+    if (request.method === 'GET' || request.method === 'HEAD' || (operation && bytesPayload(operation)))
         return query;
     const type = request.headers.get('content-type') ?? '';
     if (type.includes('multipart/form-data')) {
@@ -219,7 +156,7 @@ export async function readParams(manifest, request, operation) {
     }
     // NDJSON (`application/x-ndjson`) is lines of JSON, not a JSON document: the handler reads its text
     const media = (type.split(';')[0] ?? '').trim().toLowerCase();
-    const isJson = media.includes('json') && !media.includes('ndjson');
+    const isJson = media.includes('json') && !media.includes('ndjson') && !media.includes('connect+');
     // a form is a body labelled one (application/x-www-form-urlencoded); a body of any other type (an image, a video, an
     // octet-stream PUT to an upload URL, a text/plain SQL statement, an NDJSON batch) is no form: its parameters are the
     // query's, and the handler reads its text or bytes itself
@@ -235,7 +172,7 @@ export async function readParams(manifest, request, operation) {
     let body;
     if (asJson) {
         try {
-            body = JSON.parse(text);
+            body = parseExactJson(text);
         }
         catch {
             if (isJson)
@@ -353,27 +290,102 @@ function parentValue(parent, params) {
         return String(fill(parent.value ?? parent.params.map((p) => `{${p}}`).join('/'), params));
     return parent.param !== undefined ? params[parent.param] : undefined;
 }
+function parentField(row, path) {
+    if (row && typeof row === 'object' && Object.hasOwn(row, path))
+        return row[path];
+    let value = row;
+    for (const key of path.split('.'))
+        value = value && typeof value === 'object' ? value[key] : undefined;
+    return value;
+}
 function missingParent(m, resource, call, root) {
     const parent = m.resources[resource]?.parent;
     if (!parent)
         return undefined;
     const id = parentValue(parent, call.params);
     const where = Object.entries(parent.where ?? {}).map(([field, template]) => [field, String(fill(template, call.params))]);
-    const found = (r) => (where.length ? where.every(([field, v]) => String(r[field]) === v) : r.id === id);
+    const found = (r) => (where.length ? where.every(([field, v]) => String(parentField(r, field)) === v) : r.id === id);
     return id !== undefined && stored(m, parent.resource, root, { withDeleted: parent.allowDeleted === true }).some(found) ? undefined : notFound(m, parent.resource, String(id), parent.param ?? parent.params?.at(-1));
 }
 /** The vendor's view of a stored subject: its own fields, bookkeeping (`_`) left out. */
 /** A stored subject as the vendor's object: its id first (the subject's, unless the pack kept an id of its own), then
  *  the fields the pack wrote, bookkeeping (`_`) and the kernel's updatedAt left out. */
-export function render(r) {
-    return Object.fromEntries(Object.entries({ id: r.id, ...ownFields(r) }).filter(([k]) => !k.startsWith('_') && k !== 'updatedAt'));
+export function render(r, vendorUnderscored = []) {
+    return renderOwn({ id: r.id, ...ownFields(r) }, vendorUnderscored);
+}
+/** Filter an own-field view through the same declared vendor fields as a stored row. */
+function renderOwn(own, vendorUnderscored = []) {
+    return Object.fromEntries(Object.entries(own).filter(([k]) => !k.startsWith('_') || vendorUnderscored.includes(k)));
+}
+const viewOmissions = new WeakMap();
+// Precompute once at manifest binding: omitted fields, whether any exist, and their transitive containers through embeds.
+function prepareViewOmissions(m) {
+    const held = viewOmissions.get(m);
+    if (held)
+        return held;
+    const fields = new Map();
+    for (const [resource, decl] of Object.entries(m.resources)) {
+        if (decl.viewOmit?.length)
+            fields.set(resource, new Set(decl.viewOmit));
+    }
+    const affected = new Set(fields.keys());
+    const embeds = new Map();
+    if (fields.size) {
+        let changed = true;
+        while (changed) {
+            changed = false;
+            for (const [resource, decl] of Object.entries(m.resources)) {
+                if (!affected.has(resource) && Object.values(decl.embeds ?? {}).some((target) => affected.has(target))) {
+                    affected.add(resource);
+                    changed = true;
+                }
+            }
+        }
+        for (const resource of affected) {
+            embeds.set(resource, Object.entries(m.resources[resource]?.embeds ?? {}).filter(([, target]) => affected.has(target)));
+        }
+    }
+    const plan = { fields, affected, embeds };
+    viewOmissions.set(m, plan);
+    return plan;
+}
+/** The one response-omission mechanism, shared by stored, constructed and expanded resource views. */
+function omitView(m, resource, body, seen) {
+    const plan = viewOmissions.get(m) ?? prepareViewOmissions(m);
+    if (!resource || !plan.affected.has(resource))
+        return body;
+    const held = seen?.get(resource)?.get(body);
+    if (held)
+        return held;
+    const out = { ...body };
+    seen ??= new Map();
+    let visited = seen.get(resource);
+    if (!visited) {
+        visited = new WeakMap();
+        seen.set(resource, visited);
+    }
+    visited.set(body, out);
+    for (const field of plan.fields.get(resource) ?? [])
+        delete out[field];
+    for (const [field, target] of plan.embeds.get(resource) ?? []) {
+        const present = out[field];
+        if (Array.isArray(present)) {
+            out[field] = present.map((child) => child && typeof child === 'object' && !Array.isArray(child) ? omitView(m, target, child, seen) : child);
+        }
+        else if (present && typeof present === 'object') {
+            out[field] = omitView(m, target, present, seen);
+        }
+    }
+    return out;
 }
 /** A stored subject as the vendor answers it: its own fields, its id under the name the vendor gives it. */
 function view(m, resource, r) {
     const idAs = m.resources[resource]?.idAs;
+    const keep = m.resources[resource]?.vendorUnderscored ?? [];
+    const shown = omitView(m, resource, render(r, keep));
     if (!idAs)
-        return render(r);
-    const { id, ...rest } = render(r);
+        return shown;
+    const { id, ...rest } = shown;
     return { [idAs]: id, ...rest };
 }
 function now(m, at) {
@@ -447,33 +459,58 @@ function worldSigningKey(service, root, at, label, alg) {
     keying.set(key, made);
     return made;
 }
-function mintId(m, resource, root, at) {
+function mintId(m, resource, root, at, snapshot) {
     if (!m.resources[resource])
         throw new Error(`mint: ${resource} is not a resource ${m.vendor}'s manifest declares`);
     const prefix = m.resources[resource].idPrefix;
     const template = m.resources[resource].ids ?? m.ids.template;
     if (template === '{uuid}')
-        return mintUuid(m, resource, root);
+        return mintUuid(m, resource, root, snapshot);
     const snowflake = /^\{snowflake:(\d+)\}$/.exec(template);
     if (snowflake)
-        return mintSnowflake(m, BigInt(snowflake[1]), root, at);
-    // `{letters:N}` and `{hex:N}`, alone or after the resource's prefix (`{prefix}{letters:16}`: Fly's `vol_…`)
-    const letters = /^(\{prefix\})?\{letters:(\d+)\}$/.exec(template);
+        return mintSnowflake(m, BigInt(snowflake[1]), root, at, snapshot);
+    // `{letters:N}` and `{hex:N}`, alone, after the resource's prefix (`{prefix}{letters:16}`: Fly's `vol_…`), or after it
+    // and a separator (`{prefix}_{hex:48}`: OpenAI's `resp_67cc…`)
+    const letters = /^(?:\{prefix\}([_-]?))?\{letters:(\d+)\}$/.exec(template);
     if (letters)
-        return mintLetters(m, resource, Number(letters[2]), root, letters[1] ? prefix : '');
-    const hex = /^(\{prefix\})?\{hex:(\d+)\}$/.exec(template);
+        return mintLetters(m, resource, Number(letters[2]), root, letters[1] !== undefined ? `${prefix}${letters[1]}` : '', snapshot);
+    const hex = /^(?:\{prefix\}([_-]?))?\{hex:(\d+)\}$/.exec(template);
     if (hex)
-        return mintHex(m, resource, Number(hex[2]), root, hex[1] ? prefix : '');
+        return mintHex(m, resource, Number(hex[2]), root, hex[1] !== undefined ? `${prefix}${hex[1]}` : '', snapshot);
+    const digits = /^\{digits:(\d+)\}$/.exec(template);
+    if (digits) {
+        const width = Number(digits[1]);
+        if (!Number.isInteger(width) || width < 1 || width > 77)
+            throw new Error('mint: decimal width must be between 1 and 77');
+        const held = new Set((snapshot ? snapshot.filter((r) => r.type === storedType(m, resource)) : resourcesOfType(m.service, storedType(m, resource), root)).map((r) => r.id));
+        const floor = 10n ** BigInt(width - 1);
+        for (let n = held.size + 1;; n++) {
+            const id = String(floor + BigInt('0x' + sha256(`${m.service}:${resource}:${n}`)) % (9n * floor));
+            if (!held.has(id))
+                return id;
+            if (n - held.size > 9 * Number(floor))
+                throw new Error('mint: decimal id space exhausted');
+        }
+    }
+    // `{ksuid}` alone, after the prefix, or after it and a separator (`{prefix}_{ksuid}`: Clerk's `user_2…`)
+    // `{ksuid:N}` gives the id N characters (a vendor's own length: OpenAI's `proj_` 24, `chatcmpl-` 29), its order kept
+    const ksuid = /^(?:\{prefix\}([_-]?))?\{ksuid(?::(\d+))?\}$/.exec(template);
+    // narrower than 11 characters a KSUID no longer holds its instant and mint count, so neither order nor uniqueness
+    // within a second: such an id is minted otherwise ({letters:N}, {hex:N})
+    if (ksuid && ksuid[2] && Number(ksuid[2]) < 11)
+        throw new Error(`${m.service}: ${resource}'s id template ${template} is narrower than a KSUID's 11 ordered characters`);
+    if (ksuid)
+        return mintKsuid(m, resource, at, root, ksuid[1] !== undefined ? `${prefix}${ksuid[1]}` : '', snapshot, ksuid[2] ? Number(ksuid[2]) : 27);
     const [head, tail = ''] = template.split('{n}');
     const pattern = new RegExp(`^${escapeRe(String(fill(head, { prefix })))}(\\d+)${escapeRe(String(fill(tail, { prefix })))}$`);
-    let max = 0;
+    let max = 0n;
     // the one type, from the index that follows writes (a scan of the whole World per create grew with it)
-    for (const r of resourcesOfType(m.service, storedType(m, resource), root)) {
+    for (const r of (snapshot ? snapshot.filter((r) => r.type === storedType(m, resource)) : resourcesOfType(m.service, storedType(m, resource), root))) {
         const hit = pattern.exec(r.id);
-        if (hit)
-            max = Math.max(max, Number(hit[1]));
+        if (hit && BigInt(hit[1]) > max)
+            max = BigInt(hit[1]);
     }
-    return String(fill(template, { prefix, n: max + 1 }));
+    return String(fill(template, { prefix, n: String(max + 1n) }));
 }
 /** The next snowflake (Discord's, X's): the milliseconds since the vendor's epoch shifted left 22 bits, the low bits an
  *  increment. One space over every snowflake resource of the vendor, as its one generator's: the instant's first, or one
@@ -482,14 +519,14 @@ function mintId(m, resource, root, at) {
 /** The last snowflake minted per vendor and World in this process: two mints before the first is written (a message
  *  and its attachment) must not meet. */
 const lastSnowflake = new Map();
-function mintSnowflake(m, epoch, root, at) {
+function mintSnowflake(m, epoch, root, at, snapshot) {
     const ms = BigInt(Date.parse(at ?? '') || 0);
     const base = ms > epoch ? (ms - epoch) << 22n : 0n;
     let max = -1n;
     for (const [name, decl] of Object.entries(m.resources)) {
         if (!/^\{snowflake:\d+\}$/.test(decl.ids ?? m.ids.template))
             continue;
-        for (const r of resourcesOfType(m.service, storedType(m, name), root))
+        for (const r of (snapshot ? snapshot.filter((r) => r.type === storedType(m, name)) : resourcesOfType(m.service, storedType(m, name), root)))
             if (/^\d+$/.test(r.id)) {
                 const v = BigInt(r.id);
                 if (v > max)
@@ -503,10 +540,21 @@ function mintSnowflake(m, epoch, root, at) {
     lastSnowflake.set(key, id);
     return String(id);
 }
+/** The next KSUID for a resource (Clerk's and Svix's ids, `ksuidFrom`): the World's instant, then the type's mint
+ *  count, so a frozen clock still lists them as made; past any the World already holds. */
+function mintKsuid(m, resource, at, root, prefix = '', snapshot, width = 27) {
+    const held = new Set((snapshot ? snapshot.filter((r) => r.type === storedType(m, resource)) : resourcesOfType(m.service, storedType(m, resource), root)).map((r) => r.id));
+    const seconds = Math.floor((Date.parse(at ?? '') || 0) / 1000);
+    for (let n = held.size + 1;; n++) {
+        const id = `${prefix}${ksuidFrom(seconds, n, `${m.service}:${resource}:${n}`, width)}`;
+        if (!held.has(id))
+            return id;
+    }
+}
 /** The next id of `count` lowercase letters for a resource, derived from the resource and the count before it, past
  *  any the World already holds. */
-function mintLetters(m, resource, count, root, prefix = '') {
-    const held = new Set(resourcesOfType(m.service, storedType(m, resource), root).map((r) => r.id));
+function mintLetters(m, resource, count, root, prefix = '', snapshot) {
+    const held = new Set((snapshot ? snapshot.filter((r) => r.type === storedType(m, resource)) : resourcesOfType(m.service, storedType(m, resource), root)).map((r) => r.id));
     for (let n = held.size + 1;; n++) {
         const id = `${prefix}${lettersFrom(`${m.service}:${resource}:${n}`, count)}`;
         if (!held.has(id))
@@ -515,8 +563,8 @@ function mintLetters(m, resource, count, root, prefix = '') {
 }
 /** The next hex id for a resource: N hex digits derived from the resource and the count before it, past any the World
  *  already holds (a Cloudflare id, 32). */
-function mintHex(m, resource, count, root, prefix = '') {
-    const held = new Set(resourcesOfType(m.service, storedType(m, resource), root).map((r) => r.id));
+function mintHex(m, resource, count, root, prefix = '', snapshot) {
+    const held = new Set((snapshot ? snapshot.filter((r) => r.type === storedType(m, resource)) : resourcesOfType(m.service, storedType(m, resource), root)).map((r) => r.id));
     for (let n = held.size + 1;; n++) {
         const id = `${prefix}${sha256(`${m.service}:${resource}:${n}`).slice(0, count)}`;
         if (!held.has(id))
@@ -525,19 +573,35 @@ function mintHex(m, resource, count, root, prefix = '') {
 }
 /** The next UUID for a resource: a version-4-shaped UUID derived from the resource and the count before it, past any
  *  the World already holds. */
-function mintUuid(m, resource, root) {
+function mintUuid(m, resource, root, snapshot) {
     const type = storedType(m, resource);
-    const held = new Set(resourcesOfType(m.service, type, root).map((r) => r.id));
+    const held = new Set((snapshot ? snapshot.filter((r) => r.type === type) : resourcesOfType(m.service, type, root)).map((r) => r.id));
     for (let n = held.size + 1;; n++) {
         const id = uuidFrom(`${m.service}:${resource}:${n}`);
         if (!held.has(id))
             return id;
     }
 }
-function expand(m, resource, body, paths, root) {
+function expand(m, resource, body, paths, root, within = new Set()) {
+    body = omitView(m, resource, body);
     const embeds = m.resources[resource]?.embeds ?? {};
+    // the fields the vendor always embeds join the caller's paths; a resource already being embedded above is not embedded
+    // again inside itself (a cycle answers the id)
+    const always = within.has(resource) ? [] : (m.resources[resource]?.alwaysEmbedded ?? []);
+    const inner = new Set([...within, resource]);
     const out = { ...body };
-    for (const path of paths) {
+    const idKey = m.resources[resource]?.idAs ?? 'id';
+    const ownId = typeof body[idKey] === 'string' ? body[idKey] : undefined;
+    for (const [field, c] of within.has(resource) ? [] : Object.entries(m.resources[resource]?.collections ?? {})) {
+        if (!ownId)
+            continue;
+        const childPaths = paths.filter((p) => p.startsWith(`${field}.data.`)).map((p) => p.slice(field.length + 6));
+        const data = stored(m, c.resource, root).filter((r) => r[c.by] === ownId)
+            .map((r) => expand(m, c.resource, view(m, c.resource, r), childPaths, root, inner));
+        const fill = (v) => v === '{count}' ? data.length : typeof v === 'string' ? v.replaceAll('{id}', ownId) : v;
+        out[field] = { ...Object.fromEntries(Object.entries(c.list ?? {}).map(([k, v]) => [k, fill(v)])), data };
+    }
+    for (const path of [...new Set([...always, ...paths])]) {
         const [head, ...rest] = path.split('.');
         const target = embeds[head];
         const id = out[head];
@@ -545,15 +609,14 @@ function expand(m, resource, body, paths, root) {
             continue;
         // an object already embedded (an earlier path's) is walked further, not fetched again
         if (id && typeof id === 'object' && !Array.isArray(id)) {
-            if (rest.length)
-                out[head] = expand(m, target, id, [rest.join('.')], root);
+            out[head] = expand(m, target, id, rest.length ? [rest.join('.')] : [], root, inner);
             continue;
         }
         if (typeof id !== 'string')
             continue;
         const hit = stored(m, target, root).find((r) => r.id === id);
         if (hit)
-            out[head] = rest.length ? expand(m, target, view(m, target, hit), [rest.join('.')], root) : view(m, target, hit);
+            out[head] = expand(m, target, view(m, target, hit), rest.length ? [rest.join('.')] : [], root, inner);
     }
     return out;
 }
@@ -561,16 +624,17 @@ function expandPaths(m, params) {
     const raw = m.expandParam ? params[m.expandParam] : undefined;
     return Array.isArray(raw) ? raw.map(String) : typeof raw === 'string' ? [raw] : [];
 }
-async function write(m, call, resource, id, fields, operation, params, root, occurredAt) {
-    return (await writeDetailed(m, call, resource, id, fields, operation, params, root, occurredAt)).body;
+async function write(m, call, resource, id, fields, operation, params, root, occurredAt, checks) {
+    return (await writeDetailed(m, call, resource, id, fields, operation, params, root, occurredAt, checks)).body;
 }
 const sentOf = new WeakMap();
 /** The lane a vendor's router sent a request to (pack-fetch's laneRouter sets it). */
 export const LANE_HEADER = 'x-volter-lane';
 function sentRequest(m, call, body) {
     const url = new URL(call.request.url);
-    const named = [...(m.headers ?? []), ...(m.version ? [m.version.header] : [])];
-    const headers = Object.fromEntries(named.flatMap((h) => { const v = call.request.headers.get(h); return v === null ? [] : [[h.toLowerCase(), v]]; }));
+    const named = [...(m.headers ?? []), ...(m.version ? [m.version.header] : [])].map((h) => h.toLowerCase());
+    const recorded = (h) => named.some((n) => (n.endsWith('*') ? h.startsWith(n.slice(0, -1)) : h === n));
+    const headers = Object.fromEntries([...call.request.headers].filter(([h]) => recorded(h.toLowerCase())).map(([h, v]) => [h.toLowerCase(), v]));
     const lane = call.request.headers.get(LANE_HEADER) ?? undefined;
     const requestId = call.request.headers.get('x-twins-request-id') ?? undefined;
     const declared = new Set((call.operation.query ?? []).map((q) => q.name));
@@ -588,6 +652,9 @@ function sentRequest(m, call, body) {
 }
 /** What a write records of the call that made it: the surface operation and the request as it came, or which of the
  *  World's own doors made it (a door or a screen, the gap, the clock), which a perform never sends. */
+/** An operation whose body is its payload's bytes, one `blob` field: recorded as it came and never read as JSON
+ *  ("What the derived core records with a write"). */
+const bytesPayload = (op) => op.body?.length === 1 && op.body[0].type === 'blob';
 /** A body as it came: `{ $text }` when its bytes are UTF-8, else `{ $base64 }`. */
 async function rawBody(request) {
     const bytes = new Uint8Array(await request.clone().arrayBuffer());
@@ -624,13 +691,14 @@ function recordedInput(m, call, merged) {
         return { clock: true };
     if (id === 'unmatched')
         return { gap: true, ...asSent };
-    if ((m.doors ?? []).some((d) => d.id === id) || (m.screens ?? []).some((sc) => sc.id === id) || id === 'machine-pool' || id.startsWith('socket:'))
+    if ((m.doors ?? []).some((d) => d.id === id) || (m.screens ?? []).some((sc) => sc.id === id) || (m.accountSetup ?? []).some((a) => a.operation === id) || id === 'machine-pool' || id.startsWith('socket:'))
         return { door: id, ...asSent };
     return { operationId: id, ...asSent };
 }
 /** The scope each call is served in (serveCore, contextFor), for the contexts a write opens for its hooks. */
 const scopeOfCall = new WeakMap();
-async function writeDetailed(m, call, resource, id, fields, operation, params, root, occurredAt) {
+async function writeDetailed(m, call, resource, id, fields, operation, params, root, occurredAt, checks) {
+    const before = stateBeforeWrite(m, resource, id, root);
     const withFiles = async (input) => { const files = input.operationId ? await keptFiles(m, call, root) : undefined; return files ? { ...input, files } : input; };
     const { resource: row, result } = await applyTwinWrite(m.service, 
     // who made it: the login the pack's identity reads off the request, when it declares one, so a subject's
@@ -639,6 +707,31 @@ async function writeDetailed(m, call, resource, id, fields, operation, params, r
     inVendorMove()
         ? { operation, subjectType: storedType(m, resource), subjectId: id, fields, input: { clock: true }, occurredAt, actor: { kind: 'system' } }
         : { operation, subjectType: storedType(m, resource), subjectId: id, fields, input: await withFiles(recordedInput(m, call, params)), occurredAt, actor: { kind: 'agent', ...(m.identity ? { id: m.identity(call.request.headers.get('authorization'), root) } : {}) } }, root);
+    observeStateWrite(m, result, before, root, checks);
+    return finishWrite(m, call, resource, row, result, operation, params, root, occurredAt);
+}
+async function atomicWrite(m, call, resource, decide, operation, params, root, occurredAt, unchangedId, checks) {
+    const input = recordedInput(m, call, params);
+    const files = input.operationId ? await keptFiles(m, call, root) : undefined;
+    let before;
+    const committed = await applyTwinWriteAtomic(m.service, (snapshot) => {
+        const selected = decide(snapshot);
+        if (selected && transitionObserver)
+            before = snapshot.find((r) => r.type === storedType(m, resource) && r.id === selected.id);
+        return selected ? { kind: 'write', value: selected.id, write: {
+                operation, subjectType: storedType(m, resource), subjectId: selected.id, fields: selected.fields,
+                input: files ? { ...input, files } : input, occurredAt, actor: { kind: 'agent', ...(m.identity ? { id: m.identity(call.request.headers.get('authorization'), root) } : {}) },
+            } } : { kind: 'skip', value: undefined };
+    }, root);
+    if (!committed.result || !committed.value) {
+        const row = unchangedId ? stored(m, resource, root).find((r) => r.id === unchangedId) : undefined;
+        return row ? view(m, resource, row) : undefined;
+    }
+    observeStateWrite(m, committed.result, before, root, checks);
+    const row = resourcesOfType(m.service, storedType(m, resource), root).find((r) => r.id === resolveSubjectId(m.service, storedType(m, resource), committed.value, root));
+    return (await finishWrite(m, call, resource, row, committed.result, operation, params, root, occurredAt)).body;
+}
+async function finishWrite(m, call, resource, row, result, operation, params, root, occurredAt) {
     await keepCounts(m, call, resource, row, params, root, occurredAt);
     const body = view(m, resource, row);
     // the write's own context for its hooks, in the scope the call was served in (a walk's application answers, a tenant,
@@ -649,10 +742,12 @@ async function writeDetailed(m, call, resource, id, fields, operation, params, r
     if (m.events) {
         const events = m.events;
         const write = { operation, storedType: storedType(m, resource), body, ...(root !== undefined ? { root } : {}), occurredAt, request: call.request };
-        await deliverEvents(m.service, events, write, async (type) => (events.render ? events.render(await context(), write, type) : body), undefined, events.values ? async (type) => events.values(await context(), write, type) : undefined, (answer) => deliveryOutcome(m, answer, root));
+        await deliverEvents(m.service, events, write, async (type) => (events.render ? events.render(await context(), write, type) : body), undefined, events.values ? async (type) => events.values(await context(), write, type) : undefined);
     }
     if (m.sockets?.length)
         socketWrite(m.service, root, { operation, storedType: storedType(m, resource), body, ...(root !== undefined ? { root } : {}), occurredAt, request: call.request });
+    // a read held until the World writes (held-reads.ts) hears it
+    heldReadsWrite(m.service, root, storedType(m, resource));
     // the subject's id as it stands after the write: the vendor's, when a live head minted one
     return { body, id: result.externalId ?? row.id, ...(result.vendorData !== undefined ? { vendorData: result.vendorData } : {}) };
 }
@@ -664,15 +759,15 @@ async function keepCounts(m, call, resource, row, params, root, occurredAt) {
             if (storedType(m, c.of) !== storedType(m, resource) || row[c.by] === undefined || row[c.by] === null)
                 continue;
             const pid = String(row[c.by]);
-            const held = stored(m, parent, root).find((r) => r.id === pid);
+            const held = stored(m, parent, root).find((r) => String(c.parentKey ? ownFields(r)[c.parentKey] : r.id) === pid);
             if (!held)
                 continue;
             const n = stored(m, c.of, root).filter((r) => {
                 const x = r;
-                return String(x[c.by]) === pid && (c.present === undefined || (x[c.present] !== undefined && x[c.present] !== null));
+                return String(x[c.by]) === pid && (c.present === undefined || (x[c.present] !== undefined && x[c.present] !== null)) && Object.entries(c.unless ?? {}).every(([key, value]) => ownFields(r)[key] !== value);
             }).length + (c.plus ?? 0);
             if (held[field] !== n)
-                await writeDetailed(m, call, parent, pid, { [field]: n }, `${storedType(m, parent)}.counted`, params, root, occurredAt);
+                await writeDetailed(m, call, parent, String(held.id), { [field]: n }, `${storedType(m, parent)}.counted`, params, root, occurredAt);
         }
     }
 }
@@ -685,7 +780,7 @@ function decodeOffset(cursor) {
     if (typeof cursor !== 'string' || !cursor)
         return 0;
     try {
-        const o = JSON.parse(atob(cursor)).o;
+        const o = parseExactJson(atob(cursor)).o;
         return typeof o === 'number' && o >= 0 ? o : 0;
     }
     catch {
@@ -696,61 +791,68 @@ let transitionObserver;
 export function observeTransitions(observer) {
     transitionObserver = observer;
 }
+const stateCheckKey = (type, field) => JSON.stringify([type, field]);
+const stateValue = (row, field) => field.split('.').reduce((value, part) => value && typeof value === 'object' ? value[part] : undefined, row);
+function stateBeforeWrite(m, resource, id, root) {
+    if (!transitionObserver)
+        return undefined;
+    const type = storedType(m, resource);
+    const key = resolveSubjectId(m.service, type, id, root);
+    return resourcesOfType(m.service, type, root).find((row) => row.id === key);
+}
+/** Observe the committed entry, not a legality probe's display id. Only a move the machine checks
+ *  for this entry's actual states, operation and actor is reported; no serving depends on measurement. */
+function observeStateWrite(m, result, before, root, checks) {
+    if (!transitionObserver)
+        return;
+    const action = listActions(m.service, root).find((a) => a.id === result.actionId);
+    if (!action?.fields)
+        return;
+    const prior = before ? ownFields(before) : undefined;
+    const next = { ...prior, ...action.fields };
+    const decisions = new Map();
+    for (const [resource, decl] of Object.entries(m.resources)) {
+        if ((decl.storedAs ?? resource) !== action.subject.type)
+            continue;
+        for (const [field, machine] of Object.entries(decl.state ?? {})) {
+            if (!(field.split('.')[0] in action.fields))
+                continue;
+            const key = stateCheckKey(action.subject.type, field);
+            // Aliases of one stored field use the same consumed evidence on this one entry.
+            if (!decisions.has(key)) {
+                decisions.set(key, checks?.get(key) ?? []);
+                checks?.delete(key);
+            }
+            if (result.status === 'replayed')
+                continue;
+            const current = prior ? stateValue(prior, field) : undefined, target = stateOf(machine, stateValue(next, field));
+            const from = stateOf(machine, current);
+            const proof = decisions.get(key).find((c) => machine.transitions.includes(c.transition) && c.from === from && c.to === target);
+            // Initial-state and same-state moves still need an explicit check and a committed field write.
+            if ((!prior || from === target) && !proof)
+                continue;
+            const actor = proof?.actor ?? (action.actor?.kind === 'system' || action.input?.clock === true ? 'vendor' : 'api');
+            const operation = typeof action.input?.operationId === 'string' ? action.input.operationId : proof?.operation ?? (action.input?.clock === true ? 'clock' : action.operation ?? '');
+            transitionFor(field, machine, operation, current, target, action.subject.id, actor, { action, field, actor });
+        }
+    }
+}
 /** The transition a request asks for on one state field, or the vendor's refusal when none applies. */
 /** What a declared machine says to one move: the transition that allows it, or the refusal it gives (and
  *  nothing when it declares neither). The derived core and `legal` ask it; so does an engine that is not
  *  HTTP-shaped (a line protocol's session), so one machine rules every wire. */
-/** What a delivery's answer writes on its endpoint (the endpoint kind's `outcome`, architecture "Events and webhooks"):
- *  a success resets the failure count and writes its fields; a failure counts, and a run of them makes the declared
- *  move, asked of the endpoint's machine as the vendor's (a move the machine does not allow is not made). Read fresh
- *  and written in one move, since the answer arrives after the write's own and answers may arrive together. */
-async function deliveryOutcome(m, answer, root) {
-    const o = answer.kind.outcome;
-    const type = answer.kind.storedAs;
-    const ok = answer.status >= 200 && answer.status < 300;
-    // the read and the count are one move under the action lock, so two answers at once count twice
-    await runAsVendorMove(() => applyTwinWriteAtomic(m.service, (resources) => {
-        const row = resources.find((r) => r.type === type && String(r.id) === String(answer.row.id));
-        if (!row || row.deleted === true)
-            return { kind: 'skip', value: undefined };
-        const fields = {};
-        let operation = `${type}.delivered`;
-        if (ok) {
-            fields[o.failures] = 0;
-            const seconds = Math.floor((Date.parse(answer.occurredAt) || 0) / 1000);
-            for (const [k, v] of Object.entries(o.success ?? {}))
-                fields[k] = v === '$time.iso' ? answer.occurredAt : v === '$time.s' ? seconds : v;
-        }
-        else {
-            const failures = (Number(row[o.failures]) || 0) + 1;
-            fields[o.failures] = failures;
-            operation = `${type}.delivery-failed`;
-            const exempt = o.unless !== undefined && row[o.unless.field] === o.unless.equals;
-            if (o.move && o.after !== undefined && failures >= o.after && !exempt) {
-                const decl = Object.values(m.resources).find((r) => (r.storedAs ?? '') === type) ?? m.resources[type];
-                const machine = decl?.state?.[o.move.field];
-                const { move } = machine ? transitionFor(o.move.field, machine, o.move.operation, row[o.move.field], o.move.to, String(row.id), 'vendor') : {};
-                if (move) {
-                    fields[o.move.field] = o.move.to;
-                    operation = o.move.operation;
-                }
-            }
-        }
-        return { kind: 'write', value: undefined, write: { operation, subjectType: type, subjectId: String(row.id), fields, occurredAt: answer.occurredAt, actor: { kind: 'system' } } };
-    }, root));
-}
-export function transitionFor(field, decl, operationId, current, requested, id, actor = 'api') {
+export function transitionFor(field, decl, operationId, current, requested, id, actor = 'api', entry) {
     const now = stateOf(decl, current);
-    const candidates = decl.transitions.filter((t) => (t.actor ?? 'api') === actor && (t.operation ? t.operation === operationId : true) && (requested === undefined || (t.to ?? now) === String(requested)));
-    const move = candidates.find((t) => t.from === '*' || t.from.includes(now));
+    const candidates = decl.transitions.filter((t) => (t.actor ?? 'api') === actor && (t.operation ? t.operation === operationId : true) && (requested === undefined || (t.to ?? now) === String(requested) || (t.to === undefined && t.refusal !== undefined)));
+    const move = candidates.find((t) => !(t.to === undefined && t.refusal !== undefined) && (t.from === '*' || t.from.includes(now)));
     if (move) {
-        transitionObserver?.(decl, move, 'moved', now);
+        transitionObserver?.(decl, move, 'moved', now, entry);
         return { move };
     }
-    const refused = candidates.find((t) => t.refusals?.[now]) ?? candidates.find((t) => t.refusal);
+    const refused = candidates.find((t) => t.refusals?.[now]) ?? candidates.find((t) => t.refusal && (t.to !== undefined || t.from === '*' || t.from.includes(now)));
     const r = refused?.refusals?.[now] ?? refused?.refusal;
     if (refused && r)
-        transitionObserver?.(decl, refused, 'refused', now);
+        transitionObserver?.(decl, refused, 'refused', now, entry);
     if (r)
         return { refusal: { status: r.status, message: String(fill(r.message, { from: current, to: refused.to ?? now, field, id: id ?? '' })), ...(r.code ? { code: r.code } : {}) } };
     return {};
@@ -891,47 +993,52 @@ function arrangeRows(m, resource, params, input) {
     indexed.sort((a, b) => {
         const x = a.row[order.field];
         const y = b.row[order.field];
-        const byValue = !byText || typeof x === 'number' || typeof y === 'number' ? Number(x ?? 0) - Number(y ?? 0) : String(x ?? '').localeCompare(String(y ?? ''));
-        // ties by mint order (`file-twin-10` after `file-twin-9`), not by the ids' lexical order
-        const d = byValue || String(a.row.id).localeCompare(String(b.row.id), undefined, { numeric: true });
+        const byValue = !byText || typeof x === 'number' || typeof y === 'number' ? compareExactNumbers(x ?? 0, y ?? 0) : String(x ?? '').localeCompare(String(y ?? ''));
+        // ties (two made in one instant) by the order they were written: the rows come in the tree's order, which keeps each
+        // subject where it was first written, so this is the creation order whatever the id template (an ordered KSUID or
+        // count, or a hash-derived uuid, hex or letters id whose text says nothing of when it was made)
+        const d = byValue || a.i - b.i;
         return order.direction === 'desc' ? -d : d;
     });
     return indexed.map((x) => x.row);
 }
 /** A page of arranged rows, answered in the manifest's list envelope with its paging (cursors, pages, offsets). */
 function pageRows(m, op, call, params, rows, resource, root, paths) {
-    const size = m.list.limits?.[op.id] ?? m.list.limit;
-    const asked = params[m.list.limit.param];
+    const list = m.list;
+    if (!list)
+        return vendorError(m, m.gap ?? m.notFound);
+    const size = list.limits?.[op.id] ?? list.limit;
+    const asked = params[list.limit.param];
     const n = asked === undefined || asked === '' ? size.default : Number(asked);
     const limit = Number.isFinite(n) ? Math.min(size.max, Math.max(1, Math.trunc(n))) : size.default;
-    const after = m.list.after ? params[m.list.after] : undefined;
-    const before = m.list.before ? params[m.list.before] : undefined;
+    const after = list.after ? params[list.after] : undefined;
+    const before = list.before ? params[list.before] : undefined;
     let from = 0;
     let to;
     if (typeof before === 'string') {
         const at = rows.findIndex((r) => r.id === before);
-        to = at === -1 ? (m.list.unknownCursor === 'end' ? 0 : rows.length) : at;
+        to = at === -1 ? (list.unknownCursor === 'end' ? 0 : rows.length) : at;
         from = Math.max(0, to - limit);
     }
     else {
         if (typeof after === 'string') {
             const at = rows.findIndex((r) => r.id === after);
-            from = at === -1 ? (m.list.unknownCursor === 'end' ? rows.length : 0) : at + 1;
+            from = at === -1 ? (list.unknownCursor === 'end' ? rows.length : 0) : at + 1;
         }
         to = from + limit;
     }
-    const page = rows.slice(from, to).map((r) => (paths.length ? expand(m, resource, r, paths.filter((p) => p.startsWith('data.')).map((p) => p.slice(5)), root) : r));
+    const page = rows.slice(from, to).map((r) => expand(m, resource, r, paths.filter((p) => p.startsWith('data.')).map((p) => p.slice(5)), root));
     const hasMore = typeof before === 'string' ? from > 0 : to < rows.length;
     const url = op.path.replace(/\{[^}]+\}/g, (p) => call.params[p.slice(1, -1)] ?? p);
-    if (m.list.page) {
-        const n = Math.max(1, Math.floor(Number(params[m.list.page.param]) || 1));
-        const slice = rows.slice((n - 1) * limit, n * limit);
+    if (list.page) {
+        const n = Math.max(1, Math.floor(Number(params[list.page.param]) || 1));
+        const slice = rows.slice((n - 1) * limit, n * limit).map((r) => expand(m, resource, r, paths.filter((p) => p.startsWith('data.')).map((p) => p.slice(5)), root));
         const last = Math.max(1, Math.ceil(rows.length / limit));
         const headers = new Headers();
-        if (m.list.page.link && rows.length > limit) {
+        if (list.page.link && rows.length > limit) {
             const at = (k) => {
                 const u = new URL(call.request.url);
-                u.searchParams.set(m.list.page.param, String(k));
+                u.searchParams.set(list.page.param, String(k));
                 return u.toString();
             };
             const rels = [...(n > 1 ? [`<${at(n - 1)}>; rel="prev"`] : []), ...(n < last ? [`<${at(n + 1)}>; rel="next"`, `<${at(last)}>; rel="last"`] : []), ...(n > 1 ? [`<${at(1)}>; rel="first"`] : [])];
@@ -939,31 +1046,63 @@ function pageRows(m, op, call, params, rows, resource, root, paths) {
                 headers.set('link', rels.join(', '));
         }
         // `{total_count}` the count before paging, `{max_page}` the number of pages (none for an empty list: Polar's pagination)
-        return Response.json(fill(m.list.envelope, { data: slice, next_cursor: null, key: op.answers?.key ?? 'data', total_count: rows.length, max_page: Math.ceil(rows.length / limit) }), { headers });
+        return Response.json(fill(list.envelope, { data: slice, next_cursor: null, key: op.answers?.key ?? 'data', total_count: rows.length, max_page: Math.ceil(rows.length / limit) }), { headers });
     }
-    if (m.list.offset) {
-        const skip = Math.max(0, Math.trunc(Number(params[m.list.offset.param]) || 0));
+    if (list.offset) {
+        const skip = Math.max(0, Math.trunc(Number(params[list.offset.param]) || 0));
         const slice = rows.slice(skip, skip + limit);
         const key = op.answers?.key ?? 'data';
-        return Response.json({ ...(m.success ?? {}), [key]: slice, ...fill(m.list.envelopes?.[op.id] ?? m.list.envelope, { data: slice, total_count: rows.length, key }) });
+        return Response.json({ ...(m.success ?? {}), [key]: slice, ...fill(list.envelopes?.[op.id] ?? list.envelope, { data: slice, total_count: rows.length, key }) });
     }
-    if (m.list.cursor) {
-        const start = decodeOffset(params[m.list.cursor.param]);
+    if (list.cursor) {
+        if (list.cursor.encoding === 'offset-template') {
+            const cursor = list.cursor;
+            const names = [];
+            const pattern = '^' + cursor.template.split(/(\{offset\}|\{reverse\})/).map((part) => {
+                if (part === '{offset}' || part === '{reverse}') {
+                    names.push(part.slice(1, -1));
+                    return '(\\d+)';
+                }
+                return escapeRe(part);
+            }).join('') + '$';
+            if (names.filter((name) => name === 'offset').length !== 1 || names.filter((name) => name === 'reverse').length !== 1)
+                throw new Error('list: offset-template must name offset and reverse once');
+            const value = params[cursor.param];
+            const hit = typeof value === 'string' ? new RegExp(pattern).exec(value) : undefined;
+            if (value !== undefined && !hit)
+                return vendorError(m, { status: 400, message: 'Invalid cursor' });
+            const decoded = Object.fromEntries(names.map((name, i) => [name, Number(hit?.[i + 1] ?? 0)]));
+            if (!Number.isSafeInteger(decoded.offset) || ![0, 1].includes(decoded.reverse))
+                return vendorError(m, { status: 400, message: 'Invalid cursor' });
+            const start = decoded.reverse ? Math.max(0, decoded.offset - limit) : decoded.offset;
+            const slice = rows.slice(start, start + limit);
+            const link = (offset, reverse, rel, available) => {
+                const marker = cursor.template.replace('{offset}', String(offset)).replace('{reverse}', String(reverse));
+                const target = new URL(call.request.url);
+                target.searchParams.set(cursor.param, marker);
+                return `<${target.href}>; rel="${rel}"; ${cursor.link.results}="${available}"; ${cursor.link.cursor}="${marker}"`;
+            };
+            return Response.json(fill(list.envelope, { data: slice, key: op.answers?.key ?? 'data' }), { headers: {
+                    link: [link(start, 1, cursor.link.previous, start > 0), link(start + limit, 0, cursor.link.next, start + limit < rows.length)].join(', '),
+                } });
+        }
+        const start = decodeOffset(params[list.cursor.param]);
         const slice = rows.slice(start, start + limit);
         const next = start + limit < rows.length ? encodeOffset(start + limit) : '';
-        return Response.json({ ...(m.success ?? {}), ...fill(m.list.envelope, { data: slice, next_cursor: next, key: op.answers?.key ?? 'data' }), ...(op.answers?.key ? { [op.answers.key]: slice } : {}) });
+        return Response.json({ ...(m.success ?? {}), ...fill(list.envelope, { data: slice, next_cursor: next, key: op.answers?.key ?? 'data' }), ...(op.answers?.key ? { [op.answers.key]: slice } : {}) });
     }
-    return Response.json(fill(m.list.envelope, { data: page, has_more: hasMore, url, first_id: page[0]?.id ?? null, last_id: page.at(-1)?.id ?? null }));
+    return Response.json(fill(list.envelope, { data: page, has_more: hasMore, url, first_id: page[0]?.id ?? null, last_id: page.at(-1)?.id ?? null }));
 }
 /** Serve one operation from the manifest, or say why the core cannot. */
-/** A setting's fields as the vendor answers them: its own, without the kernel's bookkeeping or the parent it is kept
- *  under (a setting answers its values, not an identity). */
-function settingFields(own, parentField) {
-    return Object.fromEntries(Object.entries(own).filter(([k]) => !k.startsWith('_') && k !== 'deleted' && k !== parentField));
+/** A setting's fields as the vendor answers them: its own, without the kernel's bookkeeping (a `_` field the resource
+ *  does not declare the vendor's own, as view() and render() keep it) or the parent it is kept under (a setting answers
+ *  its values, not an identity). */
+function settingFields(own, parentField, vendorUnderscored = []) {
+    return Object.fromEntries(Object.entries(own).filter(([k]) => (!k.startsWith('_') || vendorUnderscored.includes(k)) && k !== 'deleted' && k !== parentField));
 }
 function settingView(m, resource, hit) {
     // ownFields: the kernel's id, type and updatedAt gone, a vendor's own of those names restored
-    return settingFields(ownFields(hit), m.resources[resource]?.parent?.field);
+    return settingFields(ownFields(hit), m.resources[resource]?.parent?.field, m.resources[resource]?.vendorUnderscored);
 }
 export async function serveCore(m, call, scope = {}) {
     const root = scope.root;
@@ -994,9 +1133,9 @@ export async function serveCore(m, call, scope = {}) {
     // the vendor's success status from its spec: 201 for most creates, 204 with no body where it answers nothing
     const status = op.successStatus ?? 200;
     const answer = (body) => ({
-        served: status === 204 ? new Response(null, { status }) : Response.json(envelope(m, op, paths.length ? expand(m, resource, body, paths, root) : body), { status }),
+        served: status === 204 ? new Response(null, { status }) : Response.json(envelope(m, op, expand(m, resource, body, paths, root)), { status }),
     });
-    const control = new Set([m.expandParam, m.list.limit.param, m.list.after, m.list.before, m.list.offset?.param, m.list.page?.param, m.list.cursor?.param].filter(Boolean));
+    const control = new Set([m.expandParam, m.list?.limit.param, m.list?.after, m.list?.before, m.list?.offset?.param, m.list?.page?.param, m.list?.cursor?.param].filter(Boolean));
     const data = Object.fromEntries(Object.entries(params).filter(([k]) => !control.has(k) && k !== 'id'));
     // a strict vendor refuses a body it does not declare before the core writes it (body.strict, as ctx.fields)
     if (m.body.strict && (op.class === 'create' || op.class === 'update')) {
@@ -1019,7 +1158,8 @@ export async function serveCore(m, call, scope = {}) {
             const under = { ...(parent ? { [parent.field]: parentId } : {}), ...(tenantField ? { [tenantField]: tenant } : {}) };
             if (decl.number) {
                 const siblings = stored(m, resource, root, { withDeleted: true }).filter(underParent);
-                under[decl.number.field] = 1 + siblings.reduce((n, r) => Math.max(n, Number(r[decl.number.field]) || 0), 0);
+                const next = siblings.reduce((n, r) => { const value = String(r[decl.number.field] ?? '0'); const held = /^-?\d+$/.test(value) ? BigInt(value) : 0n; return held > n ? held : n; }, 0n) + 1n;
+                under[decl.number.field] = exactInteger(String(next));
             }
             const made = { ...assigned, ...initial, ...under, ...data };
             const clash = conflictOf(m, resource, made, undefined, root);
@@ -1035,6 +1175,8 @@ export async function serveCore(m, call, scope = {}) {
             return hit ? answer(view(m, resource, hit)) : { served: notFound(m, resource, String(idParam), Object.keys(call.params).at(-1)) };
         }
         case 'list': {
+            if (!m.list)
+                return { unmodeled: 'no manifest list configuration' };
             const rows = stored(m, resource, root).filter(underParent).map((r) => view(m, resource, r));
             const arranged = arrangeRows(m, resource, params, rows);
             if (!Array.isArray(arranged))
@@ -1063,6 +1205,7 @@ export async function serveCore(m, call, scope = {}) {
             const current = view(m, resource, hit);
             const changes = { ...(op.class === 'update' ? data : {}) };
             let moved = false;
+            const stateChecks = new Map();
             for (const [field, sdecl] of Object.entries(decl.state ?? {})) {
                 const requested = op.class === 'update' ? data[field] : undefined;
                 if (op.class === 'update' && requested === undefined)
@@ -1075,6 +1218,8 @@ export async function serveCore(m, call, scope = {}) {
                         return { unmodeled: `no declared transition of ${field} to ${String(requested)} by ${op.id}` };
                     continue;
                 }
+                if (transitionObserver)
+                    stateChecks.set(stateCheckKey(storedType(m, resource), field), [{ transition: move, operation: op.id, from: stateOf(sdecl, current[field]), to: move.to ?? stateOf(sdecl, current[field]), actor: 'api' }]);
                 const stored = storedState(sdecl, move.to);
                 if (stored !== undefined)
                     changes[field] = stored;
@@ -1090,7 +1235,7 @@ export async function serveCore(m, call, scope = {}) {
             const clash = conflictOf(m, resource, { ...current, ...merged }, hit.id, root);
             if (clash)
                 return { served: vendorError(m, clash) };
-            return answer(await write(m, call, resource, hit.id, merged, `${storedType(m, resource)}.${op.class === 'update' ? 'update' : op.id}`, params, root, at));
+            return answer(await write(m, call, resource, hit.id, merged, `${storedType(m, resource)}.${op.class === 'update' ? 'update' : op.id}`, params, root, at, stateChecks));
         }
         case 'delete': {
             const hit = idParam ? stored(m, resource, root).find((r) => namedBy(decl, r, idParam) && underParent(r)) : undefined;
@@ -1132,20 +1277,26 @@ export async function contextFor(m, call, scope) {
     scopeOfCall.set(call, scope);
     const at = (scope.clock ?? worldNow)();
     // the guard's parse when it made one (taken once), else this context's own
-    const parsed = takeParsedBody(call.request);
-    const text = parsed ? '' : await bodyTextOf(call.request.clone()).catch(() => '');
+    // a body that is its payload's bytes (S3's PutObject) is never read as JSON, whatever its label
+    const payload = bytesPayload(call.operation);
+    const parsed = payload ? undefined : takeParsedBody(call.request);
+    const text = await bodyTextOf(call.request.clone()).catch(() => '');
     let body = parsed?.value;
     if (!parsed) {
-        try {
-            body = text ? JSON.parse(text) : undefined;
-        }
-        catch {
-            body = text;
+        if (payload)
+            body = text || undefined;
+        else {
+            try {
+                body = text ? parseExactJson(text) : undefined;
+            }
+            catch {
+                body = text;
+            }
         }
     }
     // the request as it came, before the core's parameter merge and alias adoption: what a write records, so a perform
     // can send it again (the real-system adapters, "What the derived core records with a write")
-    const boundary = multipartBoundary(call.request.headers.get('content-type'));
+    const boundary = payload ? null : multipartBoundary(call.request.headers.get('content-type'));
     const parts = boundary === null ? undefined : multipartParts(new Uint8Array(await call.request.clone().arrayBuffer()), boundary);
     // a body that is not JSON is recorded as it came, its type with it: text as text, bytes (a gzip the vendor's client
     // compressed itself, PostHog's `compression=gzip-js`) as base64
@@ -1157,8 +1308,21 @@ export async function contextFor(m, call, scope) {
     // every read of the body is of a copy, so the handler's own `call.request` and the core's answer (`core()`) each
     // still find it unread, whichever of them reads it first
     const pristine = call.request.clone();
-    const params = await boundaryParams(m, { ...call, request: call.request.clone() }, root);
+    const params = await boundaryParams(m, { ...call, request: call.request.clone() }, root).catch((error) => {
+        // An around context opens before the credential/JSON guard. Keep non-body parameters available to it without
+        // turning the guard's declared malformed-body refusal into a context-construction exception.
+        if (!(error instanceof SyntaxError) || error.message !== 'malformed JSON body')
+            throw error;
+        return boundaryParams(m, { ...call, request: new Request(call.request.url, { headers: call.request.headers }) }, root);
+    });
     const paths = expandPaths(m, params);
+    const stateChecks = new Map();
+    const rawResources = new WeakMap();
+    const rawRow = (resource, row) => {
+        const name = m.resources[resource] ? resource : Object.keys(m.resources).find((name) => storedType(m, name) === row.type);
+        rawResources.set(row, name ?? resource);
+        return row;
+    };
     return {
         call,
         params,
@@ -1168,7 +1332,6 @@ export async function contextFor(m, call, scope) {
         root,
         publicBase: twinPublicBase(call.request),
         scenario: scenarioDecisionOf(call.request),
-        deliver: (url, init) => deliverToApplication(url, init),
         ask: (url, init, within) => askApplication(url, init, within, scope.application),
         worldEnv: (name) => worldEnvValue(name),
         asVendor: (fn) => runAsVendorMove(fn),
@@ -1176,11 +1339,19 @@ export async function contextFor(m, call, scope) {
             if (!/^[A-Za-z0-9_.-]+(\/[A-Za-z0-9_.-]+)*$/.test(name) || name.split('/').some((seg) => seg === '.' || seg === '..'))
                 throw new Error(`semantics: ${name} is not a git repository name`);
             const plane = `${worldPaths(m.service, root).dir}/git`;
-            return { store: new GitObjectStore(getActiveBlobStore(), `${plane}/objects`), refs: new GitRefs(getActiveWorldStore(), `${plane}/repos/${name}`) };
+            return { store: new GitObjectStore(getActiveBlobStore(), `${plane}/repos/${name}`), refs: new GitRefs(getActiveWorldStore(), `${plane}/repos/${name}`) };
         },
         mail: (route, mail, headers) => sendMail(route, mail, headers),
         actor: m.identity ? m.identity(call.request.headers.get('authorization'), root) : undefined,
         now: () => now(m, at),
+        render: (row, resource) => {
+            const raw = rawResources.has(row);
+            const name = resource ?? rawResources.get(row);
+            const declared = name && (m.resources[name] ? name : Object.keys(m.resources).find((r) => storedType(m, r) === name));
+            const keep = declared ? m.resources[declared]?.vendorUnderscored ?? [] : [];
+            const shown = raw ? render(row, keep) : renderOwn(row, keep);
+            return omitView(m, declared || undefined, shown);
+        },
         get: (resource, id) => {
             const hit = stored(m, resource, root).find((r) => r.id === id);
             return hit ? view(m, resource, hit) : undefined;
@@ -1194,49 +1365,86 @@ export async function contextFor(m, call, scope) {
         rows: (resource) => stored(m, resource, root).map((r) => view(m, resource, r)),
         mint: (resource) => mintId(m, resource, root, at),
         sockets: (id) => openSessions(m.service, root, id),
+        awaitWrite: (resources, ms) => (scope.readOnly === true || isReadOnlyRequest(call.request) ? Promise.resolve(false) : awaitWrite(m.service, root, resources.map((r) => storedType(m, r)), ms, call.request.signal)),
+        awaitCondition: (resources, ms, pollMs, condition) => awaitCondition(m.service, root, resources.map((r) => storedType(m, r)), scope.readOnly === true || isReadOnlyRequest(call.request) ? 0 : ms, pollMs, condition, call.request.signal),
         issue: async (resource) => {
-            const id = mintId(m, resource, root, at);
             if (!resource.startsWith('_'))
                 throw new Error(`semantics: ${resource} is not a bookkeeping type (an issued id's type starts with _)`);
-            if (scope.readOnly !== true && !isReadOnlyRequest(call.request)) {
-                await applyTwinWrite(m.service, { operation: `${resource.slice(1)}.issue`, subjectType: storedType(m, resource), subjectId: id, fields: { issuedAt: at }, occurredAt: at, actor: { kind: 'system' } }, root);
-            }
-            return id;
+            if (scope.readOnly === true || isReadOnlyRequest(call.request))
+                return mintId(m, resource, root, at);
+            const { value } = await applyTwinWriteAtomic(m.service, (snapshot) => {
+                const id = mintId(m, resource, root, at, snapshot);
+                return { kind: 'write', value: id, write: { operation: `${resource.slice(1)}.issue`, subjectType: storedType(m, resource), subjectId: id, fields: { issuedAt: at }, occurredAt: at, actor: { kind: 'system' } } };
+            }, root);
+            return value;
         },
         occurredAt: at,
         secret: async (label) => hmac(await worldSeed(m.service, root, at), label, 'base64url'),
-        record: async (type, fields, id) => {
+        record: async (type, fields, id, operation) => {
             if (!type.startsWith('_'))
                 throw new Error(`semantics: ${type} is not a bookkeeping type (bookkeeping types start with _)`);
             if (id !== undefined) {
-                await applyTwinWrite(m.service, { operation: `${type.slice(1)}.record`, subjectType: type, subjectId: id, fields, occurredAt: at, actor: { kind: 'system' } }, root);
+                const before = operation ? stateBeforeWrite(m, type, id, root) : undefined;
+                const { result } = await applyTwinWrite(m.service, { operation: operation ?? `${type.slice(1)}.record`, subjectType: type, subjectId: id, fields, occurredAt: at, actor: { kind: 'system' } }, root);
+                if (operation)
+                    observeStateWrite(m, result, before, root, stateChecks);
                 return id;
             }
-            const { value } = await applyTwinWriteAtomic(m.service, (resources) => {
+            const { value, result } = await applyTwinWriteAtomic(m.service, (resources) => {
                 // Allocate and append under the same state lock: concurrent sign-ins must never share an issue id.
                 const subject = (() => {
                     const prefix = `${type.slice(1)}_`;
-                    let max = 0;
+                    let max = 0n;
                     for (const r of resources) {
                         if (r.type !== type)
                             continue;
-                        const n = r.id.startsWith(prefix) ? Number(r.id.slice(prefix.length)) : NaN;
-                        if (Number.isInteger(n) && n > max)
-                            max = n;
+                        const digits = r.id.startsWith(prefix) ? r.id.slice(prefix.length) : '';
+                        if (/^\d+$/.test(digits) && BigInt(digits) > max)
+                            max = BigInt(digits);
                     }
-                    return `${prefix}${max + 1}`;
+                    return `${prefix}${max + 1n}`;
                 })();
-                return { kind: 'write', value: subject, write: { operation: `${type.slice(1)}.record`, subjectType: type, subjectId: subject, fields, occurredAt: at, actor: { kind: 'system' } } };
+                return { kind: 'write', value: subject, write: { operation: operation ?? `${type.slice(1)}.record`, subjectType: type, subjectId: subject, fields, occurredAt: at, actor: { kind: 'system' } } };
             }, root, () => resourcesOfType(m.service, type, root));
+            if (operation && result)
+                observeStateWrite(m, result, undefined, root, stateChecks);
             return value;
         },
         get machines() {
             const enrolled = resourcesOfType(m.service, MACHINE_POOL, root).find((r) => r.id === 'pool');
-            return poolFor(m.service, root, enrolled?.kind ?? 'none');
+            return guardedMachinePool(poolFor(m.service, root, enrolled?.kind ?? 'none', enrolled?.httpReplies, { images: enrolled?.images }), m.service, ['retrieve', 'list'].includes(call.operation.class) || (m.reads?.includes(call.operation.id) ?? false));
         },
         signingKey: (label, alg) => worldSigningKey(m.service, root, at, label, alg ?? 'RS256'),
         heldSigningKey: (label, alg) => heldWorldSigningKey(m.service, root, label, alg ?? 'RS256'),
-        write: (resource, id, fields, operation) => write(m, call, resource, id, fields, operation, params, root, at),
+        create: (resource, fields, operation) => atomicWrite(m, call, resource, (snapshot) => {
+            const id = mintId(m, resource, root, at, snapshot);
+            return { id, fields: typeof fields === 'function' ? fields(id) : fields };
+        }, operation, params, root, at, undefined, stateChecks).then((row) => row),
+        createUnique: async (resource, fields, operation) => {
+            const rules = m.resources[resource]?.unique;
+            if (!rules?.length)
+                throw new Error('createUnique requires declared unique keys');
+            let existing;
+            const row = await atomicWrite(m, call, resource, (snapshot) => {
+                const id = mintId(m, resource, root, at, snapshot);
+                const selected = typeof fields === 'function' ? fields(id) : fields;
+                const hit = snapshot.find((r) => r.type === storedType(m, resource) && r.deleted !== true && rules.some((rule) => rule.fields.every((f) => selected[f] !== undefined && view(m, resource, r)[f] === selected[f])));
+                if (hit) {
+                    existing = view(m, resource, hit);
+                    return undefined;
+                }
+                return { id, fields: selected };
+            }, operation, params, root, at, undefined, stateChecks);
+            return existing ? { created: false, row: existing } : { created: true, row: row };
+        },
+        change: (resource, id, decide, operation) => atomicWrite(m, call, resource, (snapshot) => {
+            const row = snapshot.find((r) => r.type === storedType(m, resource) && r.id === id && r.deleted !== true);
+            if (!row)
+                return undefined;
+            const fields = decide(row);
+            return fields === undefined ? undefined : { id, fields };
+        }, operation, params, root, at, id, stateChecks),
+        write: (resource, id, fields, operation) => write(m, call, resource, id, fields, operation, params, root, at, stateChecks),
         accumulate: async (resource, id, deltas, operation) => {
             if (!resource.startsWith('_') || !m.resources[resource])
                 throw new Error('accumulate requires a declared bookkeeping resource');
@@ -1254,24 +1462,29 @@ export async function contextFor(m, call, scope) {
                 return { kind: 'write', value: undefined, write: { operation, subjectType: storedType(m, resource), subjectId: id, fields, occurredAt: at, actor: { kind: 'agent' } } };
             }, root);
         },
-        writeDetailed: (resource, id, fields, operation) => writeDetailed(m, call, resource, id, fields, operation, params, root, at),
+        writeDetailed: (resource, id, fields, operation) => writeDetailed(m, call, resource, id, fields, operation, params, root, at, stateChecks),
         resolve: (resource, id) => resolveSubjectId(m.service, storedType(m, resource), id, root),
         storedType: (resource) => storedType(m, resource),
         ok: (fields) => Response.json({ ...(m.success ?? {}), ...fields }),
-        row: (resource, id, opts) => stored(m, resource, root, opts).find((r) => r.id === id),
-        rowsRaw: (resource, opts) => stored(m, resource, root, opts),
+        row: (resource, id, opts) => { const row = stored(m, resource, root, opts).find((r) => r.id === id); return row ? rawRow(resource, row) : undefined; },
+        rowsRaw: (resource, opts) => stored(m, resource, root, opts).map((row) => rawRow(resource, row)),
         tree: () => twinResources(m.service, root),
         history: (resource, id) => subjectHistory(m.service, { type: storedType(m, resource), id }, root).map((e) => ({ ...(e.operation ? { operation: e.operation } : {}), ...(e.fields ? { fields: e.fields } : {}), ...(e.occurredAt ? { occurredAt: e.occurredAt } : {}) })),
         raw: (body, init = {}) => new Response(body, { status: init.status ?? 200, headers: init.headers ?? {} }),
         atomically: async (decide) => {
-            const { value } = await applyTwinWriteAtomic(m.service, (resources) => {
+            let before;
+            const { value, result } = await applyTwinWriteAtomic(m.service, (resources) => {
                 const rows = (resource) => resources.filter((r) => r.type === storedType(m, resource) && r.deleted !== true);
                 const d = decide(rows);
                 if (!d.write)
                     return { kind: 'skip', value: d.value };
                 const w = d.write;
+                if (transitionObserver)
+                    before = resources.find((r) => r.type === storedType(m, w.resource) && r.id === w.id);
                 return { kind: 'write', value: d.value, write: { operation: w.operation, subjectType: storedType(m, w.resource), subjectId: w.id, fields: w.fields, occurredAt: at, actor: { kind: 'agent' } } };
             }, root);
+            if (result)
+                observeStateWrite(m, result, before, root, stateChecks);
             return value;
         },
         legal: (resource, field, operationId, current, to, id, actor) => {
@@ -1279,29 +1492,35 @@ export async function contextFor(m, call, scope) {
             if (!decl)
                 throw new Error(`semantics: ${resource}.${field} is not a declared state field`);
             const { move, refusal } = transitionFor(field, decl, operationId, current, to, id ?? Object.values(call.params).at(-1), actor ?? 'api');
-            if (move)
+            if (move) {
+                if (transitionObserver) {
+                    const key = stateCheckKey(storedType(m, resource), field);
+                    stateChecks.set(key, [...(stateChecks.get(key) ?? []), { transition: move, operation: operationId, from: stateOf(decl, current), to: move.to ?? stateOf(decl, current), actor: actor ?? 'api' }]);
+                }
                 return undefined;
+            }
             if (refusal)
                 return refusal;
             throw new Error(`semantics: ${operationId} moves ${resource}.${field} from ${String(current)}${to ? ` to ${to}` : ''}, which the machine does not declare`);
         },
         refuse: (e) => vendorError(m, e),
+        gap: () => vendorError(m, m.gap ?? m.notFound),
         notFound: (resource, id, param) => notFound(m, resource, id, param),
         validate: () => validateBody(m, call.operation, body),
         reply: (body, status = 200) => Response.json(body, { status }),
         wrap: (body, extra = {}) => Response.json({ ...envelope(m, call.operation, body), ...extra }),
         sse: (events) => sse(m, events, call.operation.id),
-        expand: (resource, body, given) => ((given ?? paths).length ? expand(m, resource, body, given ?? paths, root) : body),
+        expand: (resource, body, given) => expand(m, resource, body, given ?? paths, root),
         at: (when) => contextFor(m, { ...call, request: new Request(call.request.url) }, { ...scope, clock: () => when }),
         crypto: handlerCrypto,
         flag: (value) => flagOf(m, value),
         fields: (body) => strictFields(m, call.operation, body),
-        vendorFetch: (url, init) => vendorFetch(url, init),
+        vendorFetch: (url, init) => vendorFetch(url, init, scope.application),
         parts: async () => {
             const boundary = multipartBoundary(call.request.headers.get('content-type'));
             return boundary === null ? [] : multipartParts(new Uint8Array(await call.request.clone().arrayBuffer()), boundary);
         },
-        engine: scope.database === undefined ? unboundDatabase(m.service) : managedDatabase(scope.database, { readOnly: scope.readOnly === true || isReadOnlyRequest(call.request), clock: at }),
+        engine: scope.database === undefined ? unboundDatabase(m.service) : managedDatabase(scope.database, { readOnly: scope.readOnly === true || isReadOnlyRequest(call.request) }),
         redis: (commands, options) => execRedisRun(commands, {
             root, occurredAt: at, service: m.service, readOnly: scope.readOnly === true || isReadOnlyRequest(call.request), dialect: options.dialect,
             ...(options.database === undefined ? {} : { database: options.database }),
@@ -1333,14 +1552,16 @@ export async function contextFor(m, call, scope) {
 }
 /** A pack's semantics handlers as the dispatch's handlers. */
 export function bindSemantics(m, handlers, scope = {}) {
+    prepareViewOmissions(m);
     return Object.fromEntries(Object.entries(handlers).map(([id, h]) => [id, async (call) => h(await contextFor(m, call, scope))]));
 }
 /** The derived core as the dispatch's core: it owns every operation on a resource the manifest declares. */
 export function coreFor(m, scope = {}) {
+    prepareViewOmissions(m);
     const crud = new Set(['create', 'retrieve', 'list', 'update', 'delete']);
     const owns = (o) => {
         const decl = o.resource !== undefined ? m.resources[o.resource] : undefined;
-        if (!decl || m.unmodeled?.includes(o.id))
+        if (!decl || m.unmodeled?.includes(o.id) || (o.class === 'list' && !m.list))
             return false;
         if (crud.has(o.class))
             return true;
@@ -1363,7 +1584,7 @@ function scenarioDecisionOf(request) {
     if (!raw)
         return undefined;
     try {
-        return JSON.parse(raw);
+        return parseExactJson(raw);
     }
     catch {
         return undefined;
@@ -1375,6 +1596,10 @@ export function authRefusal(m, request, root) {
     const url = new URL(request.url);
     if (m.auth.paths !== undefined && !new RegExp(m.auth.paths).test(url.pathname))
         return undefined;
+    const wire = m.auth.wires?.find((w) => new RegExp(w.paths).test(url.pathname));
+    const errorManifest = wire ? { ...m, error: wire.error } : m;
+    const invalid = wire?.invalid ?? m.auth.invalid;
+    const missing = wire?.missing ?? m.auth.missing;
     const sources = [{ header: m.auth.header, scheme: m.auth.scheme }, ...(m.auth.also ?? [])];
     const given = sources.map((s) => (s.query !== undefined ? url.searchParams.get(s.query) : s.header ? request.headers.get(s.header) : null)).some((v) => v !== null);
     if (!given && !m.auth.gateWhenAbsent)
@@ -1393,18 +1618,50 @@ export function authRefusal(m, request, root) {
     const key = sources.map(keyOf).find((k) => k !== '') ?? '';
     // no credential sent is `missing`; one sent in a form the vendor does not read is a key it does not know
     if (!key)
-        return vendorError(m, given ? m.auth.invalid : m.auth.missing);
+        return vendorError(errorManifest, given ? invalid : missing);
     if (m.auth.invalidKeys.includes(key) || (m.auth.keyFormat && !new RegExp(m.auth.keyFormat).test(key)))
-        return vendorError(m, m.auth.invalid);
+        return vendorError(errorManifest, invalid);
     const held = m.auth.held;
     if (held && !held.standing?.includes(key)) {
         const hash = sha256(key);
         const holds = resourcesOfType(m.service, held.storedAs, root).some((r) => r.deleted !== true && r[held.hashField] === hash && (held.unless === undefined || r[held.unless] !== true));
         if (!holds)
-            return vendorError(m, m.auth.invalid);
+            return vendorError(errorManifest, invalid);
     }
     return undefined;
 }
+/** The number of answers a World has given that carried a filled answer header (`answerHeaders`'s `{hex:N}`), kept in
+ *  the World's own directory beside its rate-budget ledger (bookkeeping, never a log entry): a fresh World counts from 1,
+ *  so two Worlds made alike answer the same values in the same order, and a resumed World counts on, never answering a
+ *  value the count holds again. A World with no root (an in-memory walk) counts in this process. */
+const answeredInMemory = new Map();
+function nextAnswer(service, root) {
+    const key = `${service}:${root ?? ''}`;
+    if (root === undefined) {
+        const n = (answeredInMemory.get(key) ?? 0) + 1;
+        answeredInMemory.set(key, n);
+        return n;
+    }
+    const store = getActiveWorldStore();
+    const path = `${worldPaths(service, root).dir}/answer-count`;
+    // a read-only request writes nothing, bookkeeping and its lock included, and reads the count without the lock: it
+    // counts on in this process past the kept count, so after a restart, or from another process serving the same World,
+    // the answers given to read-only requests since the last write may be given again
+    if (writesRefused()) {
+        const kept = Number(store.read(path) ?? '0') || 0;
+        const extra = (answeredInMemory.get(key) ?? 0) + 1;
+        answeredInMemory.set(key, extra);
+        return kept + extra;
+    }
+    // read and written under the count's lock, as the rate-budget ledger is: two writes from processes serving one World never
+    // take one number
+    return store.withLock(`${path}.lock`, () => {
+        const n = (Number(store.read(path) ?? '0') || 0) + (answeredInMemory.get(key) ?? 0) + 1;
+        answeredInMemory.delete(key);
+        store.writeAtomic(path, String(n));
+        return n;
+    });
+}
 export function crossCutting(m, opts = {}) {
     const finish = async (r, request) => {
         if (!m.origin || !(r.headers.get('content-type') ?? '').includes('json'))
@@ -1416,9 +1673,18 @@ export function crossCutting(m, opts = {}) {
         if (!m.answerHeaders)
             return r;
         const headers = new Headers(r.headers);
+        const world = `${m.service}:${opts.root ?? ''}`;
+        let seed;
+        const filled = (v) => v.replace(/\{hex:(\d+)\}/g, (_, w) => {
+            seed ??= `${world}:answer:${nextAnswer(m.service, opts.root)}`;
+            let hex = '';
+            for (let i = 0; hex.length < Number(w); i++)
+                hex += sha256(`${seed}:${i}`);
+            return hex.slice(0, Number(w));
+        });
         for (const [k, v] of Object.entries(m.answerHeaders))
             if (!headers.has(k))
-                headers.set(k, v);
+                headers.set(k, filled(v));
         return new Response(r.body, { status: r.status, statusText: r.statusText, headers });
     };
     return async (call, next) => finish(await guarded(call, next), call.request);
@@ -1438,7 +1704,7 @@ export function crossCutting(m, opts = {}) {
         // multipart or form: Cloudflare's asset and script uploads)
         const declared = call.operation.bodyEncoding;
         const labelled = request.headers.get('content-type') ?? '';
-        if ((labelled.includes('json') && !labelled.includes('ndjson')) || (m.body.json === 'always' && declared !== 'multipart' && declared !== 'form')) {
+        if (!bytesPayload(call.operation) && ((labelled.includes('json') && !labelled.includes('ndjson') && !labelled.includes('connect+')) || (m.body.json === 'always' && declared !== 'multipart' && declared !== 'form'))) {
             const ok = request.method === 'GET' || request.method === 'HEAD' ? true : await checkJsonBody(request.clone()).catch(() => true);
             if (!ok)
                 return vendorError(m, m.malformedBody ?? { status: 400, message: 'The request body could not be parsed as JSON.' });
@@ -1479,8 +1745,8 @@ export function crossCutting(m, opts = {}) {
  *  coming (another wire's mutation, a door, a screen) — and answered with the vendor's own read-only
  *  error; `GET /twin` advertises `requestScopes`. The pack's catch-up runs under `runAsVendorMove`
  *  (request-scope.ts), so time's moves still land when a read-only request is what arrives. */
-export function derivedRequestScopes(m, fetch) {
-    return withRequestScopes(fetch, { refuse: () => vendorError(m, m.readOnly) });
+export function derivedRequestScopes(m, fetch, readOnly = false) {
+    return withRequestScopes(fetch, { readOnly, refuse: () => vendorError(m, m.readOnly) });
 }
 /** A semantics context for a request no surface operation names: another wire's (GraphQL) resolvers
  *  get the same interface as a handler, named by the operation id the wire gives. */