@volter/world-runtime 2.0.31 → 2.0.33

package/dist/src/cli.js

@@ -111,10 +111,10 @@ function printHelp() {
                                                   # merged, occurredAt-ordered feed of the twins' action ledgers — one
                                                   # \`HH:MM:SS.mmm <service> <operation> <subjectId>\` line per action;
                                                   # follows until Ctrl-C (--no-follow: dump and exit; --json: raw JSONL;
-                                                  # --requests: also merge the opt-in request journals — reads/404s,
+                                                  # --requests: also merge the request journals — reads/404s,
                                                   # plus WHICH credential arrived in WHICH header/query param, named +
-                                                  # fingerprinted, never the value — written by twins under
-                                                  # VOLTER_TWIN_REQUEST_JOURNAL=1)
+                                                  # fingerprinted, never the value — kept by every twin and link
+                                                  # unless VOLTER_TWIN_REQUEST_JOURNAL=0)
   volter-world seed <world> [--entry <file>] [--cwd <dir>] [--json] [--root <repo>]
                                                   # pull from the placeholder remote: the seed entry runs with every twin's
                                                   # window open, so the defaults land as observed state (diff empty, nothing pending)

package/dist/src/served-world.d.ts

@@ -314,10 +314,11 @@ export declare class WorldDoors {
         origin: string;
     }>;
     private link;
-    /** Forward to the link's origin: the path under the link, the caller's headers with the World's
-     *  token removed and the sealed credential's headers replacing any of the same name. The vendor's
+    /** Forward to the link's origin: the path under the link, the caller's headers with every World
+     *  credential removed and the sealed credential's headers replacing any of the same name. The vendor's
      *  answer (status, headers, body) is streamed back as it arrives. */
     private forward;
+    private forwardSealed;
     /** The instant of the twin's last completed refresh (its marker's `observedAt`), when it has a root. */
     private observedAt;
     /** The world's own doors under `/-/<org>/<world>/`. */

package/dist/src/served-world.js

@@ -26,7 +26,7 @@ import { getActiveWorldStore, withAncestryLock, captureHistory, historyAtInstant
 // to `.volter/token` and `.volter/token.read` (0600).
 // One writer per world by construction: the doors run in this process, serialized per twin.
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, rmSync } from 'node:fs';
-import { assertSafeChangesetName, blobDigest, destinationOf, openSealedAt, getActiveBlobStore, loadCheck, mirrorShellUnder, readTwinRequestJournal, serveHttp, TWIN_PREFIX_HEADER, validateRemoteOrigin } from '@volter/world-core';
+import { assertSafeChangesetName, blobDigest, destinationOf, openSealedAt, getActiveBlobStore, journalTwinRequest, loadCheck, twinRequestJournalFailures, mirrorShellUnder, readTwinRequestJournal, serveHttp, twinRequestCredentials, TWIN_PREFIX_HEADER, validateRemoteOrigin } from '@volter/world-core';
 import { APP_READ_ENDPOINT_ENV } from "./init.js";
 import { grantOf, presentedSecrets, sameSecret, spentPasses, verifyPass } from '@volter/world-access';
 import { createHash } from 'node:crypto';
@@ -278,7 +278,8 @@ export async function serveWorld(name, opts = {}) {
     // doors answer 503.
     let consoleOrigin = null;
     // a pushed blob (a release video) is one PUT: bodies up to 1 GiB, past a vendor's own media limits
-    const server = await serveHttp({ hostname: host, port: opts.port ?? 0, maxRequestBodySize: 1024 * 1024 * 1024, fetch: (request) => consoleRedirect(request, consoleOrigin) ?? mounted.handle(request) });
+    // a front for the whole World: its twins and links keep their own journals (architecture: a multiplexing front journals nothing)
+    const server = await serveHttp({ hostname: host, port: opts.port ?? 0, maxRequestBodySize: 1024 * 1024 * 1024, twinRequestJournal: false, fetch: (request) => consoleRedirect(request, consoleOrigin) ?? mounted.handle(request) });
     const url = `http://${host}:${server.port}`;
     try {
         await mounted.boot(url);
@@ -850,7 +851,7 @@ export class WorldDoors {
             return foreign;
         const reads = request.method === 'GET' || request.method === 'HEAD';
         // A LINK: a path of this World that forwards to the vendor itself with the credential sealed beside
-        // the World (the World holds the key; its callers hold the World's token). Stateless, no log.
+        // the World (the World holds the key; its callers hold the World's token). Journaled as a twin's request is.
         // a person's browser opening a page at the twin's place (a navigation, or the frame the console shows it in)
         const page = request.method === 'GET' && ['document', 'iframe'].includes(request.headers.get('sec-fetch-dest') ?? '');
         const link = this.link(vendor);
@@ -934,10 +935,39 @@ export class WorldDoors {
         return held === null ? {} : JSON.parse(held);
     }
     link(name) { return this.links()[name] ?? null; }
-    /** Forward to the link's origin: the path under the link, the caller's headers with the World's
-     *  token removed and the sealed credential's headers replacing any of the same name. The vendor's
+    /** Forward to the link's origin: the path under the link, the caller's headers with every World
+     *  credential removed and the sealed credential's headers replacing any of the same name. The vendor's
      *  answer (status, headers, body) is streamed back as it arrives. */
     async forward(request, url, rest, name, origin) {
+        // what leaves for the vendor before the seal is applied: no World token in any header it can arrive
+        // under (an SDK's own `Authorization: Bearer` included), no cookie, no routing headers of this World
+        const caller = new Headers(request.headers);
+        for (const h of [TOKEN_HEADER, TWINS_KEY_HEADER, TWIN_PREFIX_HEADER, 'host', 'x-forwarded-host', 'x-forwarded-proto', 'cookie'])
+            caller.delete(h);
+        // a secret this World minted (`tok_…`, live, revoked or expired) or one that opens it never leaves
+        const authorization = caller.get('authorization');
+        const offered = authorization ? presentedSecrets(new Headers({ authorization }), { token: TOKEN_HEADER, twinsKey: TWINS_KEY_HEADER }) : [];
+        if (offered.some((p) => p.startsWith('tok_')) || (offered.length && grantOf(offered, null, this.issued())))
+            caller.delete('authorization');
+        // an opened seal keeps the audit a twin keeps: the same line in the same journal under the link's
+        // name, with the credential shape of what the caller sent on. As an audit device does, the request is
+        // written before the real credential is used, and a request whose audit cannot be written is refused.
+        const credentials = twinRequestCredentials(caller, url);
+        if (!journalTwinRequest(name, { phase: 'request', method: request.method, path: `/${rest}`, status: 0, credentials }, this.controlRoot(name))) {
+            return Response.json({ error: `the ${name} link's audit could not be written: nothing was sent` }, { status: 503 });
+        }
+        const startedAt = Date.now();
+        let status = 500;
+        try {
+            const answer = await this.forwardSealed(request, caller, url, rest, name, origin);
+            status = answer.status;
+            return answer;
+        }
+        finally {
+            journalTwinRequest(name, { method: request.method, path: `/${rest}`, status, ms: Date.now() - startedAt, credentials }, this.controlRoot(name));
+        }
+    }
+    async forwardSealed(request, caller, url, rest, name, origin) {
         const base = validateRemoteOrigin(origin);
         // opened for this link's origin only: a credential sealed for another destination, or for none, refuses
         let credential;
@@ -952,9 +982,7 @@ export class WorldDoors {
         const target = new URL(`${base.origin}/${rest}${url.search}`);
         if (target.origin !== base.origin)
             return Response.json({ error: 'the path left the link origin' }, { status: 400 });
-        const headers = new Headers(request.headers);
-        for (const h of [TOKEN_HEADER, TWINS_KEY_HEADER, TWIN_PREFIX_HEADER, 'host', 'x-forwarded-host', 'x-forwarded-proto', 'cookie'])
-            headers.delete(h);
+        const headers = new Headers(caller);
         for (const [k, v] of Object.entries(credential.headers))
             headers.set(k, v);
         const body = request.method === 'GET' || request.method === 'HEAD' ? undefined : await request.arrayBuffer();
@@ -1300,12 +1328,13 @@ export class WorldDoors {
         }
         if (kind === 'requests' && !name && request.method === 'GET') {
             // the world's request report (layer 8: Supabase's API report): the kernel's request journal per twin, summed over a period —
-            // requests by twin and status class, the response time's p50/p95, the top routes
+            // requests by twin (and by link, journaled the same way) and status class, the response time's p50/p95, the top routes
             const sinceMs = Number(url.searchParams.get('hours') ?? '24') * 3_600_000;
             const since = Date.now() - sinceMs;
             const twins = [];
-            for (const vendor of Object.keys(this.up().services)) {
-                const entries = readTwinRequestJournal(vendor, this.controlRoot(vendor)).filter((e) => !e.at || Date.parse(e.at) >= since);
+            for (const vendor of [...new Set([...Object.keys(this.up().services), ...Object.keys(this.links())])]) {
+                // a link's request entries (written before it forwards) are its audit, not traffic: its outcomes are counted
+                const entries = readTwinRequestJournal(vendor, this.controlRoot(vendor), { since }).filter((e) => e.phase !== 'request' && (!e.at || Date.parse(e.at) >= since));
                 const byStatus = {};
                 const routes = new Map();
                 const times = [];
@@ -1321,7 +1350,7 @@ export class WorldDoors {
                 const pct = (p) => (times.length ? times[Math.min(times.length - 1, Math.floor((p / 100) * times.length))] : null);
                 twins.push({ twin: vendor, requests: entries.length, byStatus, p50Ms: pct(50), p95Ms: pct(95), topRoutes: [...routes.entries()].sort((a, b) => b[1] - a[1]).slice(0, 10).map(([route, requests]) => ({ route, requests })) });
             }
-            return Response.json({ world: this.served, hours: sinceMs / 3_600_000, twins, requests: twins.reduce((n, t) => n + t.requests, 0) });
+            return Response.json({ world: this.served, hours: sinceMs / 3_600_000, twins, requests: twins.reduce((n, t) => n + t.requests, 0), journalFailures: twins.reduce((n, t) => n + twinRequestJournalFailures(t.twin, this.controlRoot(t.twin)), 0) });
         }
         if (kind === 'twins' && !name && request.method === 'GET') {
             // every twin of the world as a consumer sees it — the status door mapped over the world; what a

package/dist/src/tail.d.ts

@@ -6,9 +6,9 @@ export type TailWorldOptions = {
     follow?: boolean;
     /** Raw JSONL passthrough with the world service id injected as `service` (default: human lines). */
     json?: boolean;
-    /** Also merge each service's opt-in REQUEST journal into the feed (`requests.jsonl`, written
-     * by twins running under VOLTER_TWIN_REQUEST_JOURNAL=1 — shape-only `{at, method, path,
-     * status}` rows; control-plane/src/serve.ts). Reads are otherwise invisible here: an
+    /** Also merge each service's REQUEST journal into the feed (`requests.jsonl`, kept by every
+     * twin and link unless VOLTER_TWIN_REQUEST_JOURNAL=0 — shape-only `{at, method, path,
+     * status}` rows; world-core/src/serve.ts). Reads are otherwise invisible here: an
      * empty-catalog GET that 404s leaves no trace in an actions-only tail. */
     requests?: boolean;
     /** Poll interval while following (ledger appends are cross-process, so this polls rather than

package/dist/src/tail.js

@@ -6,8 +6,8 @@
 // this just watches what the twins already record. A ledger dir may not exist until a service
 // records its first action, so discovery re-runs on every poll and a missing ledger is a
 // notice, never an error.
-import { closeSync, existsSync, openSync, readSync, readdirSync, statSync } from 'node:fs';
-import { join } from 'node:path';
+import { closeSync, existsSync, openSync, readFileSync, readSync, readdirSync, statSync } from 'node:fs';
+import { basename, dirname, join } from 'node:path';
 import { stateDirName } from '@volter/world-core';
 import { statusWorld } from "./runtime.js";
 /** Every action ledger a world service currently owns. One world service can record actions
@@ -22,6 +22,15 @@ function serviceLedgers(dataDir, service, file = 'actions.jsonl') {
         .map((entry) => join(stateRoot, entry.name, file))
         .sort();
 }
+/** The World's links by name (`<root>/<state-dir>/links.json`, served-world.ts). */
+function linkNames(root) {
+    try {
+        return Object.keys(JSON.parse(readFileSync(join(root, stateDirName(), 'links.json'), 'utf8')));
+    }
+    catch {
+        return [];
+    }
+}
 /** Read the complete lines appended to `path` since the recorded offset, advancing the offset
  * only past the last newline — a half-written trailing line stays unconsumed until the writer
  * finishes it, so a poll can never emit a torn row. */
@@ -34,10 +43,24 @@ function readNewLines(path, offsets) {
     catch {
         return []; // vanished between discovery and read (e.g. a purge mid-tail) — next poll rediscovers
     }
-    if (size < offset)
-        offset = 0; // rewritten shorter (scrub/rebuild) — replay rather than silently skip
-    if (size === offset)
-        return [];
+    let closed = [];
+    if (size < offset) {
+        // a request journal that closed into its next segment (world-core serve.ts): what was appended there
+        // after the last poll is read from the segment first; any other shorter rewrite (scrub/rebuild) replays
+        const segment = newestSegment(path);
+        let closedSize = -1;
+        try {
+            closedSize = segment ? statSync(segment).size : -1;
+        }
+        catch { /* gone between list and stat */ }
+        if (segment && closedSize >= offset)
+            closed = readNewLines(segment, new Map([[segment, offset]]));
+        offset = 0;
+    }
+    if (size === offset) {
+        offsets.set(path, offset);
+        return closed;
+    }
     const fd = openSync(path, 'r');
     const buffer = Buffer.alloc(size - offset);
     try {
@@ -47,10 +70,29 @@ function readNewLines(path, offsets) {
         closeSync(fd);
     }
     const lastNewline = buffer.lastIndexOf(0x0a);
-    if (lastNewline < 0)
-        return [];
+    if (lastNewline < 0) {
+        offsets.set(path, offset);
+        return closed;
+    }
     offsets.set(path, offset + lastNewline + 1);
-    return buffer.subarray(0, lastNewline).toString('utf8').split('\n').filter((line) => line.trim() !== '');
+    return [...closed, ...buffer.subarray(0, lastNewline).toString('utf8').split('\n').filter((line) => line.trim() !== '')];
+}
+/** A journal's newest closed segment (`<file>.<n>`), or null. */
+function newestSegment(path) {
+    const dir = dirname(path);
+    const base = basename(path);
+    let best = 0;
+    try {
+        for (const name of readdirSync(dir)) {
+            const n = name.startsWith(`${base}.`) ? Number(name.slice(base.length + 1)) : NaN;
+            if (Number.isInteger(n) && n > best)
+                best = n;
+        }
+    }
+    catch {
+        return null;
+    }
+    return best ? `${path}.${best}` : null;
 }
 /** Local wall-clock `HH:MM:SS.mmm` — the operator is watching a live feed on this machine. */
 function formatOccurredAt(occurredAt) {
@@ -76,6 +118,9 @@ function formatEntry(entry, json) {
         const creds = (record.credentials ?? [])
             .map((c) => `${c.name ?? '?'}${c.in === 'query' ? '(query)' : ''}=${c.empty ? 'EMPTY' : `${c.scheme ? `${c.scheme} ` : ''}${(c.fp ?? '').replace(/^sha256:/, '').slice(0, 8)}`}`)
             .join(' ');
+        // a link's request entry, written before it forwards: the request on its way, its outcome follows
+        if (record.phase === 'request')
+            return `${formatOccurredAt(entryInstant(entry))} ${entry.service} → ${record.method ?? '?'} ${record.path ?? '?'}${creds ? ` [${creds}]` : ''}`;
         return `${formatOccurredAt(entryInstant(entry))} ${entry.service} ${record.method ?? '?'} ${record.path ?? '?'} ${record.status ?? '?'}${typeof record.ms === 'number' ? ` in ${record.ms}ms` : ''}${creds ? ` [${creds}]` : ''}`;
     }
     return `${formatOccurredAt(record.occurredAt)} ${entry.service} ${record.operation ?? record.op ?? '?'} ${record.subject?.id ?? '?'}`;
@@ -105,9 +150,11 @@ function sleep(ms, signal) {
 export async function tailWorldActions(name, options = {}) {
     const root = options.root ?? process.cwd();
     const instance = statusWorld(name, root);
-    const known = Object.keys(instance.services);
+    // a link (an opened seal) journals its requests as a twin does, under its own name
+    const links = linkNames(root);
+    const known = [...new Set([...Object.keys(instance.services), ...links])];
     for (const service of options.services ?? []) {
-        if (!instance.services[service]) {
+        if (!known.includes(service)) {
             throw new Error(`World ${name} has no service "${service}"; it has: ${known.join(', ')}`);
         }
     }
@@ -143,6 +190,8 @@ export async function tailWorldActions(name, options = {}) {
     };
     emit(collect());
     for (const service of services) {
+        if (links.includes(service) && !instance.services[service])
+            continue; // a link records requests, never actions
         if (serviceLedgers(instance.dirs.data, service).length === 0) {
             notice(`World ${name}: service "${service}" has no action ledger yet${follow
                 ? ' — watching; drive the app (or a vendor SDK) through the world to record actions'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-runtime",
-  "version": "2.0.31",
+  "version": "2.0.33",
   "description": "World configs for twins: boot named local runtimes, allocate ports, generate world.env/instance.json, and run apps against fake-key twin worlds.",
   "keywords": [
     "twin",
@@ -67,14 +67,14 @@
     "node": ">=22.3"
   },
   "peerDependencies": {
-    "@volter/world-core": "2.0.18",
-    "@volter/world-console": "2.0.10"
+    "@volter/world-core": "2.0.20",
+    "@volter/world-console": "2.0.12"
   },
   "dependencies": {
     "@electric-sql/pglite": "0.5.8",
     "@electric-sql/pglite-pgvector": "0.0.9",
     "@volter/world-access": "2.0.2",
-    "@volter/world-core": "2.0.18",
+    "@volter/world-core": "2.0.20",
     "pg-gateway": "0.3.0-beta.4",
     "smol-toml": "^1.8.0"
   },
@@ -84,6 +84,6 @@
     }
   },
   "optionalDependencies": {
-    "@volter/twin-mongodb": "0.1.18"
+    "@volter/twin-mongodb": "0.1.20"
   }
 }

package/src/cli.ts

@@ -112,10 +112,10 @@ function printHelp(): void {
                                                   # merged, occurredAt-ordered feed of the twins' action ledgers — one
                                                   # \`HH:MM:SS.mmm <service> <operation> <subjectId>\` line per action;
                                                   # follows until Ctrl-C (--no-follow: dump and exit; --json: raw JSONL;
-                                                  # --requests: also merge the opt-in request journals — reads/404s,
+                                                  # --requests: also merge the request journals — reads/404s,
                                                   # plus WHICH credential arrived in WHICH header/query param, named +
-                                                  # fingerprinted, never the value — written by twins under
-                                                  # VOLTER_TWIN_REQUEST_JOURNAL=1)
+                                                  # fingerprinted, never the value — kept by every twin and link
+                                                  # unless VOLTER_TWIN_REQUEST_JOURNAL=0)
   volter-world seed <world> [--entry <file>] [--cwd <dir>] [--json] [--root <repo>]
                                                   # pull from the placeholder remote: the seed entry runs with every twin's
                                                   # window open, so the defaults land as observed state (diff empty, nothing pending)

package/src/served-world.ts

@@ -26,7 +26,7 @@ import { getActiveWorldStore, withAncestryLock, captureHistory, historyAtInstant
 // to `.volter/token` and `.volter/token.read` (0600).
 // One writer per world by construction: the doors run in this process, serialized per twin.
 import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync , rmSync} from 'node:fs';
-import { assertSafeChangesetName, blobDigest, destinationOf, openSealedAt, getActiveBlobStore, loadCheck, mirrorShellUnder, readTwinRequestJournal, serveHttp, TWIN_PREFIX_HEADER, validateRemoteOrigin, type SealedCredential, type TwinStreamConnection, type TwinStreamSink } from '@volter/world-core';
+import { assertSafeChangesetName, blobDigest, destinationOf, openSealedAt, getActiveBlobStore, journalTwinRequest, loadCheck, twinRequestJournalFailures, mirrorShellUnder, readTwinRequestJournal, serveHttp, twinRequestCredentials, TWIN_PREFIX_HEADER, validateRemoteOrigin, type SealedCredential, type TwinStreamConnection, type TwinStreamSink } from '@volter/world-core';
 import { APP_READ_ENDPOINT_ENV } from './init.ts';
 import { grantOf, presentedSecrets, sameSecret, spentPasses, verifyPass, type TrustedIssuer, type WorldCredentials } from '@volter/world-access';
 import { createHash } from 'node:crypto';
@@ -252,7 +252,8 @@ export async function serveWorld(name: string, opts: { root?: string; port?: num
   // doors answer 503.
   let consoleOrigin: string | null = null;
   // a pushed blob (a release video) is one PUT: bodies up to 1 GiB, past a vendor's own media limits
-  const server = await serveHttp({ hostname: host, port: opts.port ?? 0, maxRequestBodySize: 1024 * 1024 * 1024, fetch: (request) => consoleRedirect(request, consoleOrigin) ?? mounted.handle(request) });
+  // a front for the whole World: its twins and links keep their own journals (architecture: a multiplexing front journals nothing)
+  const server = await serveHttp({ hostname: host, port: opts.port ?? 0, maxRequestBodySize: 1024 * 1024 * 1024, twinRequestJournal: false, fetch: (request) => consoleRedirect(request, consoleOrigin) ?? mounted.handle(request) });
   const url = `http://${host}:${server.port}`;
   try { await mounted.boot(url); } catch (error) { await server.stop(true); throw error; }
   // the console, when it is installed beside the World, on an origin of its own (console-apart.ts)
@@ -765,7 +766,7 @@ export class WorldDoors {
     if (foreign) return foreign;
     const reads = request.method === 'GET' || request.method === 'HEAD';
     // A LINK: a path of this World that forwards to the vendor itself with the credential sealed beside
-    // the World (the World holds the key; its callers hold the World's token). Stateless, no log.
+    // the World (the World holds the key; its callers hold the World's token). Journaled as a twin's request is.
     // a person's browser opening a page at the twin's place (a navigation, or the frame the console shows it in)
     const page = request.method === 'GET' && ['document', 'iframe'].includes(request.headers.get('sec-fetch-dest') ?? '');
     const link = this.link(vendor!);
@@ -835,10 +836,36 @@ export class WorldDoors {
   }
   private link(name: string): { origin: string } | null { return this.links()[name] ?? null; }
 
-  /** Forward to the link's origin: the path under the link, the caller's headers with the World's
-   *  token removed and the sealed credential's headers replacing any of the same name. The vendor's
+  /** Forward to the link's origin: the path under the link, the caller's headers with every World
+   *  credential removed and the sealed credential's headers replacing any of the same name. The vendor's
    *  answer (status, headers, body) is streamed back as it arrives. */
   private async forward(request: Request, url: URL, rest: string, name: string, origin: string): Promise<Response> {
+    // what leaves for the vendor before the seal is applied: no World token in any header it can arrive
+    // under (an SDK's own `Authorization: Bearer` included), no cookie, no routing headers of this World
+    const caller = new Headers(request.headers);
+    for (const h of [TOKEN_HEADER, TWINS_KEY_HEADER, TWIN_PREFIX_HEADER, 'host', 'x-forwarded-host', 'x-forwarded-proto', 'cookie']) caller.delete(h);
+    // a secret this World minted (`tok_…`, live, revoked or expired) or one that opens it never leaves
+    const authorization = caller.get('authorization');
+    const offered = authorization ? presentedSecrets(new Headers({ authorization }), { token: TOKEN_HEADER, twinsKey: TWINS_KEY_HEADER }) : [];
+    if (offered.some((p) => p.startsWith('tok_')) || (offered.length && grantOf(offered, null, this.issued()))) caller.delete('authorization');
+    // an opened seal keeps the audit a twin keeps: the same line in the same journal under the link's
+    // name, with the credential shape of what the caller sent on. As an audit device does, the request is
+    // written before the real credential is used, and a request whose audit cannot be written is refused.
+    const credentials = twinRequestCredentials(caller, url);
+    if (!journalTwinRequest(name, { phase: 'request', method: request.method, path: `/${rest}`, status: 0, credentials }, this.controlRoot(name))) {
+      return Response.json({ error: `the ${name} link's audit could not be written: nothing was sent` }, { status: 503 });
+    }
+    const startedAt = Date.now(); let status = 500;
+    try {
+      const answer = await this.forwardSealed(request, caller, url, rest, name, origin);
+      status = answer.status;
+      return answer;
+    } finally {
+      journalTwinRequest(name, { method: request.method, path: `/${rest}`, status, ms: Date.now() - startedAt, credentials }, this.controlRoot(name));
+    }
+  }
+
+  private async forwardSealed(request: Request, caller: Headers, url: URL, rest: string, name: string, origin: string): Promise<Response> {
     const base = validateRemoteOrigin(origin);
     // opened for this link's origin only: a credential sealed for another destination, or for none, refuses
     let credential: Awaited<ReturnType<typeof openSealedAt>>;
@@ -846,8 +873,7 @@ export class WorldDoors {
     if (credential === null) return Response.json({ error: `the ${name} link has no credential sealed` }, { status: 409 });
     const target = new URL(`${base.origin}/${rest}${url.search}`);
     if (target.origin !== base.origin) return Response.json({ error: 'the path left the link origin' }, { status: 400 });
-    const headers = new Headers(request.headers);
-    for (const h of [TOKEN_HEADER, TWINS_KEY_HEADER, TWIN_PREFIX_HEADER, 'host', 'x-forwarded-host', 'x-forwarded-proto', 'cookie']) headers.delete(h);
+    const headers = new Headers(caller);
     for (const [k, v] of Object.entries(credential.headers)) headers.set(k, v);
     const body = request.method === 'GET' || request.method === 'HEAD' ? undefined : await request.arrayBuffer();
     const controller = new AbortController();
@@ -1120,17 +1146,18 @@ export class WorldDoors {
     }
     if (kind === 'requests' && !name && request.method === 'GET') {
       // the world's request report (layer 8: Supabase's API report): the kernel's request journal per twin, summed over a period —
-      // requests by twin and status class, the response time's p50/p95, the top routes
+      // requests by twin (and by link, journaled the same way) and status class, the response time's p50/p95, the top routes
       const sinceMs = Number(url.searchParams.get('hours') ?? '24') * 3_600_000; const since = Date.now() - sinceMs;
       const twins: Array<{ twin: string; requests: number; byStatus: Record<string, number>; p50Ms: number | null; p95Ms: number | null; topRoutes: Array<{ route: string; requests: number }> }> = [];
-      for (const vendor of Object.keys(this.up().services)) {
-        const entries = readTwinRequestJournal(vendor, this.controlRoot(vendor)).filter((e) => !e.at || Date.parse(e.at) >= since);
+      for (const vendor of [...new Set([...Object.keys(this.up().services), ...Object.keys(this.links())])]) {
+        // a link's request entries (written before it forwards) are its audit, not traffic: its outcomes are counted
+        const entries = readTwinRequestJournal(vendor, this.controlRoot(vendor), { since }).filter((e) => e.phase !== 'request' && (!e.at || Date.parse(e.at) >= since));
         const byStatus: Record<string, number> = {}; const routes = new Map<string, number>(); const times: number[] = [];
         for (const e of entries) { const cls = `${String(e.status)[0]}xx`; byStatus[cls] = (byStatus[cls] ?? 0) + 1; const route = `${e.method} ${e.path.replace(/\/[0-9]+(?=\/|$)/g, '/{id}')}`; routes.set(route, (routes.get(route) ?? 0) + 1); if (typeof e.ms === 'number') times.push(e.ms); }
         times.sort((a, b) => a - b); const pct = (p: number): number | null => (times.length ? times[Math.min(times.length - 1, Math.floor((p / 100) * times.length))]! : null);
         twins.push({ twin: vendor, requests: entries.length, byStatus, p50Ms: pct(50), p95Ms: pct(95), topRoutes: [...routes.entries()].sort((a, b) => b[1] - a[1]).slice(0, 10).map(([route, requests]) => ({ route, requests })) });
       }
-      return Response.json({ world: this.served, hours: sinceMs / 3_600_000, twins, requests: twins.reduce((n, t) => n + t.requests, 0) });
+      return Response.json({ world: this.served, hours: sinceMs / 3_600_000, twins, requests: twins.reduce((n, t) => n + t.requests, 0), journalFailures: twins.reduce((n, t) => n + twinRequestJournalFailures(t.twin, this.controlRoot(t.twin)), 0) });
     }
     if (kind === 'twins' && !name && request.method === 'GET') {
       // every twin of the world as a consumer sees it — the status door mapped over the world; what a

package/src/tail.ts

@@ -6,8 +6,8 @@
 // this just watches what the twins already record. A ledger dir may not exist until a service
 // records its first action, so discovery re-runs on every poll and a missing ledger is a
 // notice, never an error.
-import { closeSync, existsSync, openSync, readSync, readdirSync, statSync } from 'node:fs';
-import { join } from 'node:path';
+import { closeSync, existsSync, openSync, readFileSync, readSync, readdirSync, statSync } from 'node:fs';
+import { basename, dirname, join } from 'node:path';
 import { stateDirName } from '@volter/world-core';
 import { statusWorld } from './runtime.ts';
 
@@ -40,9 +40,9 @@ export type TailWorldOptions = {
   follow?: boolean;
   /** Raw JSONL passthrough with the world service id injected as `service` (default: human lines). */
   json?: boolean;
-  /** Also merge each service's opt-in REQUEST journal into the feed (`requests.jsonl`, written
-   * by twins running under VOLTER_TWIN_REQUEST_JOURNAL=1 — shape-only `{at, method, path,
-   * status}` rows; control-plane/src/serve.ts). Reads are otherwise invisible here: an
+  /** Also merge each service's REQUEST journal into the feed (`requests.jsonl`, kept by every
+   * twin and link unless VOLTER_TWIN_REQUEST_JOURNAL=0 — shape-only `{at, method, path,
+   * status}` rows; world-core/src/serve.ts). Reads are otherwise invisible here: an
    * empty-catalog GET that 404s leaves no trace in an actions-only tail. */
   requests?: boolean;
   /** Poll interval while following (ledger appends are cross-process, so this polls rather than
@@ -68,6 +68,11 @@ function serviceLedgers(dataDir: string, service: string, file: 'actions.jsonl'
     .sort();
 }
 
+/** The World's links by name (`<root>/<state-dir>/links.json`, served-world.ts). */
+function linkNames(root: string): string[] {
+  try { return Object.keys(JSON.parse(readFileSync(join(root, stateDirName(), 'links.json'), 'utf8')) as Record<string, unknown>); } catch { return []; }
+}
+
 /** Read the complete lines appended to `path` since the recorded offset, advancing the offset
  * only past the last newline — a half-written trailing line stays unconsumed until the writer
  * finishes it, so a poll can never emit a torn row. */
@@ -79,8 +84,16 @@ function readNewLines(path: string, offsets: Map<string, number>): string[] {
   } catch {
     return []; // vanished between discovery and read (e.g. a purge mid-tail) — next poll rediscovers
   }
-  if (size < offset) offset = 0; // rewritten shorter (scrub/rebuild) — replay rather than silently skip
-  if (size === offset) return [];
+  let closed: string[] = [];
+  if (size < offset) {
+    // a request journal that closed into its next segment (world-core serve.ts): what was appended there
+    // after the last poll is read from the segment first; any other shorter rewrite (scrub/rebuild) replays
+    const segment = newestSegment(path);
+    let closedSize = -1; try { closedSize = segment ? statSync(segment).size : -1; } catch { /* gone between list and stat */ }
+    if (segment && closedSize >= offset) closed = readNewLines(segment, new Map([[segment, offset]]));
+    offset = 0;
+  }
+  if (size === offset) { offsets.set(path, offset); return closed; }
   const fd = openSync(path, 'r');
   const buffer = Buffer.alloc(size - offset);
   try {
@@ -89,9 +102,17 @@ function readNewLines(path: string, offsets: Map<string, number>): string[] {
     closeSync(fd);
   }
   const lastNewline = buffer.lastIndexOf(0x0a);
-  if (lastNewline < 0) return [];
+  if (lastNewline < 0) { offsets.set(path, offset); return closed; }
   offsets.set(path, offset + lastNewline + 1);
-  return buffer.subarray(0, lastNewline).toString('utf8').split('\n').filter((line) => line.trim() !== '');
+  return [...closed, ...buffer.subarray(0, lastNewline).toString('utf8').split('\n').filter((line) => line.trim() !== '')];
+}
+
+/** A journal's newest closed segment (`<file>.<n>`), or null. */
+function newestSegment(path: string): string | null {
+  const dir = dirname(path); const base = basename(path);
+  let best = 0;
+  try { for (const name of readdirSync(dir)) { const n = name.startsWith(`${base}.`) ? Number(name.slice(base.length + 1)) : NaN; if (Number.isInteger(n) && n > best) best = n; } } catch { return null; }
+  return best ? `${path}.${best}` : null;
 }
 
 /** Local wall-clock `HH:MM:SS.mmm` — the operator is watching a live feed on this machine. */
@@ -118,6 +139,8 @@ function formatEntry(entry: TailEntry, json: boolean): string {
     const creds = (record.credentials ?? [])
       .map((c) => `${c.name ?? '?'}${c.in === 'query' ? '(query)' : ''}=${c.empty ? 'EMPTY' : `${c.scheme ? `${c.scheme} ` : ''}${(c.fp ?? '').replace(/^sha256:/, '').slice(0, 8)}`}`)
       .join(' ');
+    // a link's request entry, written before it forwards: the request on its way, its outcome follows
+    if (record.phase === 'request') return `${formatOccurredAt(entryInstant(entry))} ${entry.service} → ${record.method ?? '?'} ${record.path ?? '?'}${creds ? ` [${creds}]` : ''}`;
     return `${formatOccurredAt(entryInstant(entry))} ${entry.service} ${record.method ?? '?'} ${record.path ?? '?'} ${record.status ?? '?'}${typeof record.ms === 'number' ? ` in ${record.ms}ms` : ''}${creds ? ` [${creds}]` : ''}`;
   }
   return `${formatOccurredAt(record.occurredAt)} ${entry.service} ${record.operation ?? record.op ?? '?'} ${record.subject?.id ?? '?'}`;
@@ -150,9 +173,11 @@ function sleep(ms: number, signal?: AbortSignal): Promise<void> {
 export async function tailWorldActions(name: string, options: TailWorldOptions = {}): Promise<void> {
   const root = options.root ?? process.cwd();
   const instance = statusWorld(name, root);
-  const known = Object.keys(instance.services);
+  // a link (an opened seal) journals its requests as a twin does, under its own name
+  const links = linkNames(root);
+  const known = [...new Set([...Object.keys(instance.services), ...links])];
   for (const service of options.services ?? []) {
-    if (!instance.services[service]) {
+    if (!known.includes(service)) {
       throw new Error(`World ${name} has no service "${service}"; it has: ${known.join(', ')}`);
     }
   }
@@ -189,6 +214,7 @@ export async function tailWorldActions(name: string, options: TailWorldOptions =
 
   emit(collect());
   for (const service of services) {
+    if (links.includes(service) && !instance.services[service]) continue; // a link records requests, never actions
     if (serviceLedgers(instance.dirs.data, service).length === 0) {
       notice(`World ${name}: service "${service}" has no action ledger yet${follow
         ? ' — watching; drive the app (or a vendor SDK) through the world to record actions'