@volter/world-runtime 2.0.39 → 2.0.41

package/dist/src/branch.js

@@ -84,10 +84,12 @@ export async function branchWorld(base, name, options = {}) {
     }
     const forked = {};
     try {
-        if (from.origin) {
+        // the branch's origin is its base's, or none: never one a stopped World of the same name left
+        if (from.origin)
             instance.origin = { ...from.origin };
-            saveWorldInstance(instance);
-        }
+        else
+            delete instance.origin;
+        saveWorldInstance(instance);
         for (const { service, fromRoot, states } of source) {
             const toRoot = join(instance.dirs.data, service);
             for (const { state, generation, view, position: pos } of states) {

package/dist/src/origin.js

@@ -8,6 +8,7 @@ import { join, resolve } from 'node:path';
 import { getActiveWorldStore, readBranchMeta, withAncestryLock, writeBranchMeta } from '@volter/world-core';
 import { saveWorldInstance, statusWorld } from "./runtime.js";
 import { fetchReady, isPathRemote, localWorld, TOKEN_HEADER } from "./served-world.js";
+import { loadWorldConfig, writeWorldConfig } from "./configs.js";
 function originOf(instance, options) {
     const url = options.url ?? instance.origin?.url;
     const namespace = options.namespace ?? instance.origin?.namespace;
@@ -132,6 +133,20 @@ export async function fetchFromOrigin(name, options) {
         });
     }
     saveWorldInstance({ ...instance, origin: { ...origin, ...(options.full ? { clonedAt: at_ } : instance.origin?.clonedAt ? { clonedAt: instance.origin.clonedAt } : {}), fetchedAt: at_ } });
+    // a clone names its remote where `volter remote add` does (world.json, as git config holds a remote): one record of
+    // it, which every restart carries (runtime's namesOrigin) and `remote remove` ends. Only the World the config is
+    // for writes it: a runtime branch boots from its base's config, whose remote stays the base's
+    if (options.full && instance.name === instance.config) {
+        try {
+            const { path: configPath, config } = loadWorldConfig(instance.configPath, root);
+            const named = isPathRemote(origin.url) ? origin.url : `${origin.url}/${origin.namespace}`;
+            if (config.remotes?.origin !== named)
+                writeWorldConfig(configPath, { ...config, remotes: { ...(config.remotes ?? {}), origin: named } });
+        }
+        catch (error) {
+            console.error(`[origin] ${name}: the remote was not named in its config: ${error.message}`);
+        }
+    }
     return { world: name, origin, full: options.full ?? false, appended, behind, snapshots };
 }
 export function worldOrigin(name, root) {

package/dist/src/runtime.js

@@ -728,6 +728,22 @@ function writePidsFromInstance(instance, fresh = []) {
         ].filter((pid) => Number.isInteger(pid) && pid > 0))];
     writeOwnedPids(instance.root, instance.name, pids, fresh);
 }
+/** Whether a world.json remote (`https://<host>/<org>/<world>`, or a world's directory, relative to the World's root) is
+ *  the recorded origin, read as the CLI's parseOriginUrl reads it (the URL's origin, then its two path parts). */
+function namesOrigin(remote, origin, worldRoot) {
+    if (!remote)
+        return false;
+    if (!/^[a-z][a-z0-9+.-]*:\/\//i.test(remote))
+        return resolve(worldRoot, remote) === resolve(worldRoot, origin.url);
+    try {
+        const parsed = new URL(remote);
+        const parts = parsed.pathname.split('/').filter(Boolean);
+        return parts.length === 2 && parsed.origin === new URL(origin.url).origin && parts.join('/') === origin.namespace;
+    }
+    catch {
+        return false;
+    }
+}
 export function saveWorldInstance(instance) {
     writeTextAtomic(instanceFile(instance.root, instance.name), `${JSON.stringify(instance, null, 2)}\n`);
 }
@@ -1483,6 +1499,7 @@ export async function upWorld(configId, options = {}, abort) {
     const pidsFile = join(instance, 'pids');
     const envFile = resolve(root, options.envFile ?? join(instance, 'world.env'));
     const instanceFile = join(instance, 'instance.json');
+    let carriedOrigin;
     const priorOutputInstance = existsSync(instanceFile) ? JSON.parse(readFileSync(instanceFile, 'utf8')) : undefined;
     const priorOutput = priorOutputInstance?.name === name && resolve(priorOutputInstance.root) === root
         ? { path: resolve(priorOutputInstance.envFile), contents: envFileContents(priorOutputInstance.env) } : undefined;
@@ -1536,6 +1553,14 @@ export async function upWorld(configId, options = {}, abort) {
                     || !Number.isFinite(Date.parse(receipt.stoppedAt))) {
                     throw new Error(`World "${name}" has no verified teardown receipt for its prior instance; use its owning runtime to complete cleanup before replacement`);
                 }
+                // the origin belongs to the World, not to its running state (git: a remote outlives every checkout): an up of the
+                // same config carries the one the last left while world.json's `origin` remote still names it (`remote remove`
+                // ends it there; an instance under another World's config, a runtime branch, has only its own record); its cursors
+                // only when its state (the mirror they count) is kept, as reset drops them
+                if (prior.origin && prior.config === loaded.config.id && (name !== loaded.config.id || namesOrigin(loaded.config.remotes?.origin, prior.origin, root))) {
+                    carriedOrigin = options.keepState ? prior.origin
+                        : { url: prior.origin.url, namespace: prior.origin.namespace, ...(prior.origin.clonedAt ? { clonedAt: prior.origin.clonedAt } : {}) };
+                }
             }
             assertLifecycleStartable(root, name);
             beginWorldLifecycle(root, name, createdAt, options.owner);
@@ -1643,6 +1668,7 @@ export async function upWorld(configId, options = {}, abort) {
             ...(loaded.config.actors ? { actors: loaded.config.actors } : {}),
             ...(loaded.config.fixtures ? { fixtures: loaded.config.fixtures } : {}),
             lifecycle: { owner: options.owner, log: lifecycleLogPath(root, name) },
+            ...(carriedOrigin ? { origin: carriedOrigin } : {}),
         };
         saveWorldInstance(worldInstance);
         const cancelled = new AbortController();

package/dist/src/served-world.d.ts

@@ -268,6 +268,14 @@ export declare class WorldDoors {
     /** What this World issued, for world-access to decide a grant against: its two tokens, its named keys, its sessions. */
     private issued;
     private credential;
+    /** Each changeset's actions' receipts, from the landed copies on each twin's log: a deploy appends one per entry it
+     *  performed, and a push one per entry it landed at the remote (`landed` while the remote waits, beside the
+     *  changeset's own `applied`). */
+    private deployedOf;
+    /** Who made a request, as this World names it: `key:<name>` for a named key, `person:<who>` for a browser's session
+     *  (`person` when it names no one), `token` / `token:read` for the World's own tokens; null when it presented nothing
+     *  this World issued. */
+    private callerOf;
     /** The session cookie's name where `url` reached this World, or null where a session opens nothing:
      *  on the World's own origin a host-only cookie (`__Host-` over https); without an origin of its own,
      *  the path-scoped cookie a shared origin has always carried. */
@@ -352,6 +360,10 @@ export declare class WorldDoors {
      *  twin, then position. The World keeps no order across twins finer than its clock, and this claims
      *  none. `before` is the cursor the previous page answered; `twin` and `trace` narrow it. */
     private timeline;
+    /** Each twin's callers by the World's span, from its request journal: its newest CALLER_SEGMENTS once, then from
+     *  where the last read stopped (readTwinRequestJournalFrom follows a rotation). The newest CALLERS_KEPT are kept. */
+    private readonly callersByTwin;
+    private callersOf;
     /** Each twin's timeline rows, kept until its logs change: a poll of an unchanged World reads no log
      *  (a twin is read again only when the size or time of its parent log, branch log or branch record
      *  moved), and the merged order is sorted again only when a twin was. */

package/dist/src/served-world.js

@@ -26,7 +26,7 @@ import { getActiveWorldStore, withAncestryLock, captureHistory, historyAtInstant
 // to `.volter/token` and `.volter/token.read` (0600).
 // One writer per world by construction: the doors run in this process, serialized per twin.
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, rmSync } from 'node:fs';
-import { assertSafeChangesetName, blobDigest, destinationOf, openSealedAt, getActiveBlobStore, journalTwinRequest, loadCheck, twinRequestJournalFailures, mirrorShellUnder, readTwinRequestJournal, serveHttp, twinRequestCredentials, TWIN_PREFIX_HEADER, validateRemoteOrigin } from '@volter/world-core';
+import { CALLER_HEADER, newTraceparent, parseTraceparent, traceparentForDelivery, readTwinRequestJournalFrom, assertSafeChangesetName, blobDigest, destinationOf, openSealedAt, getActiveBlobStore, journalTwinRequest, loadCheck, twinRequestJournalFailures, mirrorShellUnder, readTwinRequestJournal, serveHttp, twinRequestCredentials, TWIN_PREFIX_HEADER, validateRemoteOrigin } from '@volter/world-core';
 import { APP_READ_ENDPOINT_ENV } from "./init.js";
 import { grantOf, presentedSecrets, sameSecret, spentPasses, verifyPass } from '@volter/world-access';
 import { createHash } from 'node:crypto';
@@ -369,6 +369,11 @@ function traceIdOf(traceparent) {
     const m = typeof traceparent === 'string' ? /^[0-9a-f]{2}-([0-9a-f]{32})-[0-9a-f]{16}-[0-9a-f]{2}$/.exec(traceparent) : null;
     return m && !/^0+$/.test(m[1]) ? m[1] : null;
 }
+const CALLERS_KEPT = 50_000;
+/** The closed journal segments a World reads for callers when it first answers a timeline (~1 MB each): older entries show no caller. */
+const CALLER_SEGMENTS = 8;
+/** A W3C traceparent's parent-id (the span the World minted for the request), or null. */
+function spanOf(traceparent) { return parseTraceparent(traceparent)?.parentId ?? null; }
 /** Timeline order, newest first: by the entry's instant, then twin, then position. */
 function newerFirst(a, b) {
     return b.at.localeCompare(a.at) || b.twin.localeCompare(a.twin) || b.position - a.position;
@@ -653,6 +658,49 @@ export class WorldDoors {
             return { scope: grant.scope, via: 'session', token: null, session: grant.session, ...(grant.who ? { who: grant.who } : {}) };
         return { scope: grant.scope, via: grant.via === 'key' ? 'key' : 'token', token: grant.presented ?? null };
     }
+    /** Each changeset's actions' receipts, from the landed copies on each twin's log: a deploy appends one per entry it
+     *  performed, and a push one per entry it landed at the remote (`landed` while the remote waits, beside the
+     *  changeset's own `applied`). */
+    deployedOf(changesets) {
+        // by the state each action was written in (a twin may hold several), and a settled receipt wins over a provisional
+        // `landed` one whichever comes later in the log (a push's local copy, then the remote's deploy fetched in)
+        const landed = new Map();
+        const of = (service, state) => {
+            const at = `${service}\u0000${state}`;
+            let held = landed.get(at);
+            if (!held) {
+                held = new Map();
+                if (this.up().services[service]) {
+                    for (const e of parentEntries(state, this.controlRoot(service))) {
+                        if (!e.landsId || !e.receipt)
+                            continue;
+                        const before = held.get(e.landsId);
+                        if (!before || before.status === 'landed' || e.receipt.status !== 'landed')
+                            held.set(e.landsId, e.receipt);
+                    }
+                }
+                landed.set(at, held);
+            }
+            return held;
+        };
+        return changesets.map((c) => c.actions.flatMap((a) => { const r = of(a.service, a.stateService ?? this.stateOf(a.service)).get(a.action.id); return r ? [{ service: a.service, actionId: a.action.id, ...r }] : []; }));
+    }
+    /** Who made a request, as this World names it: `key:<name>` for a named key, `person:<who>` for a browser's session
+     *  (`person` when it names no one), `token` / `token:read` for the World's own tokens; null when it presented nothing
+     *  this World issued. */
+    callerOf(request) {
+        const cred = this.credential(request);
+        if (cred.scope === null)
+            return null;
+        if (cred.via === 'session')
+            return cred.who ? `person:${cred.who}` : 'person';
+        if (cred.via === 'key') {
+            const token = cred.token;
+            const held = token ? this.keys().find((k) => sameSecret(keyHash(token), k.hash)) : undefined;
+            return held ? `key:${held.name}` : 'key';
+        }
+        return cred.scope === 'read' ? 'token:read' : 'token';
+    }
     /** The session cookie's name where `url` reached this World, or null where a session opens nothing:
      *  on the World's own origin a host-only cookie (`__Host-` over https); without an origin of its own,
      *  the path-scoped cookie a shared origin has always carried. */
@@ -872,6 +920,14 @@ export class WorldDoors {
         headers.delete(TOKEN_HEADER);
         headers.delete(TWINS_KEY_HEADER);
         headers.delete('host');
+        // who made it is the World's word, never the caller's: the twin's request journal records it. The World is a hop of
+        // the request's trace: the caller's trace-id goes on (or a new one), under a parent-id the World mints, which the
+        // request's log entries carry, so each entry is joined to its caller by an id no caller chose
+        headers.delete(CALLER_HEADER);
+        const who = this.callerOf(request);
+        if (who)
+            headers.set(CALLER_HEADER, who);
+        headers.set('traceparent', traceparentForDelivery(headers.get('traceparent')) ?? newTraceparent());
         // at a twin that enforces the read scope, every request of the read token is marked read-only (a GET
         // that would write for its caller is refused too); at any other, its GET passes as it always has
         if (enforced)
@@ -942,7 +998,7 @@ export class WorldDoors {
         // what leaves for the vendor before the seal is applied: no World token in any header it can arrive
         // under (an SDK's own `Authorization: Bearer` included), no cookie, no routing headers of this World
         const caller = new Headers(request.headers);
-        for (const h of [TOKEN_HEADER, TWINS_KEY_HEADER, TWIN_PREFIX_HEADER, 'host', 'x-forwarded-host', 'x-forwarded-proto', 'cookie'])
+        for (const h of [TOKEN_HEADER, TWINS_KEY_HEADER, TWIN_PREFIX_HEADER, CALLER_HEADER, 'host', 'x-forwarded-host', 'x-forwarded-proto', 'cookie'])
             caller.delete(h);
         // a secret this World minted (`tok_…`, live, revoked or expired) or one that opens it never leaves
         const authorization = caller.get('authorization');
@@ -953,7 +1009,10 @@ export class WorldDoors {
         // name, with the credential shape of what the caller sent on. As an audit device does, the request is
         // written before the real credential is used, and a request whose audit cannot be written is refused.
         const credentials = twinRequestCredentials(caller, url);
-        if (!journalTwinRequest(name, { phase: 'request', method: request.method, path: `/${rest}`, status: 0, credentials }, this.controlRoot(name))) {
+        const who = this.callerOf(request);
+        const trace = parseTraceparent(request.headers.get('traceparent'))?.traceId;
+        const by = { ...(who ? { caller: who } : {}), ...(trace ? { trace } : {}) };
+        if (!journalTwinRequest(name, { phase: 'request', method: request.method, path: `/${rest}`, status: 0, credentials, ...by }, this.controlRoot(name))) {
             return Response.json({ error: `the ${name} link's audit could not be written: nothing was sent` }, { status: 503 });
         }
         const startedAt = Date.now();
@@ -964,7 +1023,7 @@ export class WorldDoors {
             return answer;
         }
         finally {
-            journalTwinRequest(name, { method: request.method, path: `/${rest}`, status, ms: Date.now() - startedAt, credentials }, this.controlRoot(name));
+            journalTwinRequest(name, { method: request.method, path: `/${rest}`, status, ms: Date.now() - startedAt, credentials, ...by }, this.controlRoot(name));
         }
     }
     async forwardSealed(request, caller, url, rest, name, origin) {
@@ -1166,9 +1225,11 @@ export class WorldDoors {
             // with the body's hash as it stands, so a reader sees an approval or a verification made on other bytes as stale
             if (name) {
                 const l = findWorldChangeset(name, { root: this.worldRoot, world: this.name });
-                return Response.json({ ...l.changeset, currentHash: changesetContentHash(l.changeset) });
+                return Response.json({ ...l.changeset, currentHash: changesetContentHash(l.changeset), deployed: this.deployedOf([l.changeset])[0] });
             }
-            return Response.json({ changesets: listWorldChangesets({ root: this.worldRoot, world: this.name }).map((l) => ({ ...l.changeset, currentHash: changesetContentHash(l.changeset) })) });
+            const all = listWorldChangesets({ root: this.worldRoot, world: this.name }).map((l) => l.changeset);
+            const deployed = this.deployedOf(all);
+            return Response.json({ changesets: all.map((c, i) => ({ ...c, currentHash: changesetContentHash(c), deployed: deployed[i] })) });
         }
         if (kind === 'changesets' && name && verb === 'verify' && request.method === 'POST') {
             const outcome = await this.serialized('changesets', () => verifyWorldChangeset(name, { root: this.worldRoot, world: this.name, ephemeral: true }));
@@ -1705,7 +1766,33 @@ export class WorldDoors {
         const shown = page.slice(0, limit);
         const last = shown[shown.length - 1];
         const next = more && last ? Buffer.from(JSON.stringify([last.entry.occurredAt, last.twin, last.position])).toString('base64url') : null;
-        return Response.json({ world: this.served, entries: shown, next });
+        // who made each entry: the request it was written in (the World's span on it) as the twin's journal recorded it
+        const entries = shown.map((r) => { const by = this.callersOf(r.twin).get(spanOf(r.entry.traceparent) ?? ''); return by ? { ...r, caller: by } : r; });
+        return Response.json({ world: this.served, entries, next });
+    }
+    /** Each twin's callers by the World's span, from its request journal: its newest CALLER_SEGMENTS once, then from
+     *  where the last read stopped (readTwinRequestJournalFrom follows a rotation). The newest CALLERS_KEPT are kept. */
+    callersByTwin = new Map();
+    callersOf(twin) {
+        const root = this.controlRoot(twin);
+        let held = this.callersByTwin.get(twin);
+        if (!held || held.root !== root) {
+            held = { root, cursor: null, callers: new Map() };
+            this.callersByTwin.set(twin, held);
+        }
+        const read = readTwinRequestJournalFrom(twin, root, held.cursor, { segments: CALLER_SEGMENTS });
+        for (const e of read.entries)
+            if (e.span && e.caller) {
+                held.callers.delete(e.span);
+                held.callers.set(e.span, e.caller);
+            }
+        held.cursor = read.cursor;
+        for (const span of held.callers.keys()) {
+            if (held.callers.size <= CALLERS_KEPT)
+                break;
+            held.callers.delete(span);
+        }
+        return held.callers;
     }
     /** Each twin's timeline rows, kept until its logs change: a poll of an unchanged World reads no log
      *  (a twin is read again only when the size or time of its parent log, branch log or branch record

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-runtime",
-  "version": "2.0.39",
+  "version": "2.0.41",
   "description": "World configs for twins: boot named local runtimes, allocate ports, generate world.env/instance.json, and run apps against fake-key twin worlds.",
   "keywords": [
     "twin",
@@ -67,14 +67,14 @@
     "node": ">=22.3"
   },
   "peerDependencies": {
-    "@volter/world-core": "2.0.21",
+    "@volter/world-core": "2.0.23",
     "@volter/world-console": "2.0.13"
   },
   "dependencies": {
     "@electric-sql/pglite": "0.5.8",
     "@electric-sql/pglite-pgvector": "0.0.9",
     "@volter/world-access": "2.0.2",
-    "@volter/world-core": "2.0.21",
+    "@volter/world-core": "2.0.23",
     "pg-gateway": "0.3.0-beta.4",
     "smol-toml": "^1.8.0"
   },
@@ -84,6 +84,6 @@
     }
   },
   "optionalDependencies": {
-    "@volter/twin-mongodb": "0.1.21"
+    "@volter/twin-mongodb": "0.1.23"
   }
 }

package/src/branch.ts

@@ -69,7 +69,9 @@ export async function branchWorld(base: string, name: string, options: BranchOpt
   }
   const forked: Record<string, string[]> = {};
   try {
-    if (from.origin) { instance.origin = { ...from.origin }; saveWorldInstance(instance); }
+    // the branch's origin is its base's, or none: never one a stopped World of the same name left
+    if (from.origin) instance.origin = { ...from.origin }; else delete instance.origin;
+    saveWorldInstance(instance);
     for (const { service, fromRoot, states } of source) {
       const toRoot = join(instance.dirs.data, service);
       for (const { state, generation, view, position: pos } of states) {

package/src/origin.ts

@@ -9,6 +9,7 @@ import { appendOriginEntry, appendParentEntry, branchEntries, getActiveWorldStor
 import { saveWorldInstance, statusWorld } from './runtime.ts';
 import type { WorldInstance } from './schema.ts';
 import { fetchReady, isPathRemote, localWorld, TOKEN_HEADER } from './served-world.ts';
+import { loadWorldConfig, writeWorldConfig } from './configs.ts';
 
 export type FetchOptions = { root?: string; url?: string; namespace?: string; key: string; full?: boolean; services?: string[]; views?: Record<string, HistoryReference>; now?: Date };
 export type FetchOutcome = {
@@ -126,6 +127,16 @@ export async function fetchFromOrigin(name: string, options: FetchOptions): Prom
 
   }
   saveWorldInstance({ ...instance, origin: { ...origin, ...(options.full ? { clonedAt: at_ } : instance.origin?.clonedAt ? { clonedAt: instance.origin.clonedAt } : {}), fetchedAt: at_ } });
+  // a clone names its remote where `volter remote add` does (world.json, as git config holds a remote): one record of
+  // it, which every restart carries (runtime's namesOrigin) and `remote remove` ends. Only the World the config is
+  // for writes it: a runtime branch boots from its base's config, whose remote stays the base's
+  if (options.full && instance.name === instance.config) {
+    try {
+      const { path: configPath, config } = loadWorldConfig(instance.configPath, root);
+      const named = isPathRemote(origin.url) ? origin.url : `${origin.url}/${origin.namespace}`;
+      if (config.remotes?.origin !== named) writeWorldConfig(configPath, { ...config, remotes: { ...(config.remotes ?? {}), origin: named } });
+    } catch (error) { console.error(`[origin] ${name}: the remote was not named in its config: ${(error as Error).message}`); }
+  }
   return { world: name, origin, full: options.full ?? false, appended, behind, snapshots };
 }
 

package/src/runtime.ts

@@ -757,6 +757,17 @@ function writePidsFromInstance(instance: WorldInstance, fresh: number[] = []): v
   writeOwnedPids(instance.root, instance.name, pids, fresh);
 }
 
+/** Whether a world.json remote (`https://<host>/<org>/<world>`, or a world's directory, relative to the World's root) is
+ *  the recorded origin, read as the CLI's parseOriginUrl reads it (the URL's origin, then its two path parts). */
+function namesOrigin(remote: string | undefined, origin: { url: string; namespace: string }, worldRoot: string): boolean {
+  if (!remote) return false;
+  if (!/^[a-z][a-z0-9+.-]*:\/\//i.test(remote)) return resolve(worldRoot, remote) === resolve(worldRoot, origin.url);
+  try {
+    const parsed = new URL(remote); const parts = parsed.pathname.split('/').filter(Boolean);
+    return parts.length === 2 && parsed.origin === new URL(origin.url).origin && parts.join('/') === origin.namespace;
+  } catch { return false; }
+}
+
 export function saveWorldInstance(instance: WorldInstance): void {
   writeTextAtomic(instanceFile(instance.root, instance.name), `${JSON.stringify(instance, null, 2)}\n`);
 }
@@ -1483,6 +1494,7 @@ export async function upWorld(configId: string, options: UpWorldOptions = {}, ab
   const pidsFile = join(instance, 'pids');
   const envFile = resolve(root, options.envFile ?? join(instance, 'world.env'));
   const instanceFile = join(instance, 'instance.json');
+  let carriedOrigin: WorldInstance['origin'] | undefined;
   const priorOutputInstance = existsSync(instanceFile) ? JSON.parse(readFileSync(instanceFile, 'utf8')) as WorldInstance : undefined;
   const priorOutput = priorOutputInstance?.name === name && resolve(priorOutputInstance.root) === root
     ? { path: resolve(priorOutputInstance.envFile), contents: envFileContents(priorOutputInstance.env) } : undefined;
@@ -1537,6 +1549,14 @@ export async function upWorld(configId: string, options: UpWorldOptions = {}, ab
           || !Number.isFinite(Date.parse(receipt.stoppedAt))) {
           throw new Error(`World "${name}" has no verified teardown receipt for its prior instance; use its owning runtime to complete cleanup before replacement`);
         }
+        // the origin belongs to the World, not to its running state (git: a remote outlives every checkout): an up of the
+        // same config carries the one the last left while world.json's `origin` remote still names it (`remote remove`
+        // ends it there; an instance under another World's config, a runtime branch, has only its own record); its cursors
+        // only when its state (the mirror they count) is kept, as reset drops them
+        if (prior.origin && prior.config === loaded.config.id && (name !== loaded.config.id || namesOrigin(loaded.config.remotes?.origin, prior.origin, root))) {
+          carriedOrigin = options.keepState ? prior.origin
+            : { url: prior.origin.url, namespace: prior.origin.namespace, ...(prior.origin.clonedAt ? { clonedAt: prior.origin.clonedAt } : {}) };
+        }
       }
       assertLifecycleStartable(root, name);
       beginWorldLifecycle(root, name, createdAt, options.owner);
@@ -1622,6 +1642,7 @@ export async function upWorld(configId: string, options: UpWorldOptions = {}, ab
       ...(loaded.config.actors ? { actors: loaded.config.actors } : {}),
       ...(loaded.config.fixtures ? { fixtures: loaded.config.fixtures } : {}),
       lifecycle: { owner: options.owner, log: lifecycleLogPath(root, name) },
+      ...(carriedOrigin ? { origin: carriedOrigin } : {}),
     };
     saveWorldInstance(worldInstance);
     const cancelled = new AbortController();

package/src/served-world.ts

@@ -26,7 +26,7 @@ import { getActiveWorldStore, withAncestryLock, captureHistory, historyAtInstant
 // to `.volter/token` and `.volter/token.read` (0600).
 // One writer per world by construction: the doors run in this process, serialized per twin.
 import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync , rmSync} from 'node:fs';
-import { assertSafeChangesetName, blobDigest, destinationOf, openSealedAt, getActiveBlobStore, journalTwinRequest, loadCheck, twinRequestJournalFailures, mirrorShellUnder, readTwinRequestJournal, serveHttp, twinRequestCredentials, TWIN_PREFIX_HEADER, validateRemoteOrigin, type SealedCredential, type TwinStreamConnection, type TwinStreamSink } from '@volter/world-core';
+import { CALLER_HEADER, newTraceparent, parseTraceparent, traceparentForDelivery, readTwinRequestJournalFrom, type TwinRequestJournalCursor, assertSafeChangesetName, blobDigest, destinationOf, openSealedAt, getActiveBlobStore, journalTwinRequest, loadCheck, twinRequestJournalFailures, mirrorShellUnder, readTwinRequestJournal, serveHttp, twinRequestCredentials, TWIN_PREFIX_HEADER, validateRemoteOrigin, type SealedCredential, type TwinStreamConnection, type TwinStreamSink } from '@volter/world-core';
 import { APP_READ_ENDPOINT_ENV } from './init.ts';
 import { grantOf, presentedSecrets, sameSecret, spentPasses, verifyPass, type TrustedIssuer, type WorldCredentials } from '@volter/world-access';
 import { createHash } from 'node:crypto';
@@ -380,6 +380,11 @@ function traceIdOf(traceparent: unknown): string | null {
   return m && !/^0+$/.test(m[1]!) ? m[1]! : null;
 }
 type TimelineRow = { twin: string; position: number; entry: Entry };
+const CALLERS_KEPT = 50_000;
+/** The closed journal segments a World reads for callers when it first answers a timeline (~1 MB each): older entries show no caller. */
+const CALLER_SEGMENTS = 8;
+/** A W3C traceparent's parent-id (the span the World minted for the request), or null. */
+function spanOf(traceparent: unknown): string | null { return parseTraceparent(traceparent)?.parentId ?? null; }
 /** Timeline order, newest first: by the entry's instant, then twin, then position. */
 function newerFirst(a: { at: string; twin: string; position: number }, b: { at: string; twin: string; position: number }): number {
   return b.at.localeCompare(a.at) || b.twin.localeCompare(a.twin) || b.position - a.position;
@@ -590,6 +595,42 @@ export class WorldDoors {
     if (grant.via === 'session') return { scope: grant.scope, via: 'session', token: null, session: grant.session!, ...(grant.who ? { who: grant.who } : {}) };
     return { scope: grant.scope, via: grant.via === 'key' ? 'key' : 'token', token: grant.presented ?? null };
   }
+  /** Each changeset's actions' receipts, from the landed copies on each twin's log: a deploy appends one per entry it
+   *  performed, and a push one per entry it landed at the remote (`landed` while the remote waits, beside the
+   *  changeset's own `applied`). */
+  private deployedOf(changesets: Changeset[]): Array<Array<{ service: string; actionId: string } & Receipt>> {
+    // by the state each action was written in (a twin may hold several), and a settled receipt wins over a provisional
+    // `landed` one whichever comes later in the log (a push's local copy, then the remote's deploy fetched in)
+    const landed = new Map<string, Map<string, Receipt>>();
+    const of = (service: string, state: string): Map<string, Receipt> => {
+      const at = `${service}\u0000${state}`;
+      let held = landed.get(at);
+      if (!held) {
+        held = new Map();
+        if (this.up().services[service]) {
+          for (const e of parentEntries(state, this.controlRoot(service))) {
+            if (!e.landsId || !e.receipt) continue;
+            const before = held.get(e.landsId);
+            if (!before || before.status === 'landed' || e.receipt.status !== 'landed') held.set(e.landsId, e.receipt);
+          }
+        }
+        landed.set(at, held);
+      }
+      return held;
+    };
+    return changesets.map((c) => c.actions.flatMap((a) => { const r = of(a.service, a.stateService ?? this.stateOf(a.service)).get(a.action.id); return r ? [{ service: a.service, actionId: a.action.id, ...r }] : []; }));
+  }
+
+  /** Who made a request, as this World names it: `key:<name>` for a named key, `person:<who>` for a browser's session
+   *  (`person` when it names no one), `token` / `token:read` for the World's own tokens; null when it presented nothing
+   *  this World issued. */
+  private callerOf(request: Request): string | null {
+    const cred = this.credential(request);
+    if (cred.scope === null) return null;
+    if (cred.via === 'session') return cred.who ? `person:${cred.who}` : 'person';
+    if (cred.via === 'key') { const token = cred.token; const held = token ? this.keys().find((k) => sameSecret(keyHash(token), k.hash)) : undefined; return held ? `key:${held.name}` : 'key'; }
+    return cred.scope === 'read' ? 'token:read' : 'token';
+  }
   /** The session cookie's name where `url` reached this World, or null where a session opens nothing:
    *  on the World's own origin a host-only cookie (`__Host-` over https); without an origin of its own,
    *  the path-scoped cookie a shared origin has always carried. */
@@ -781,6 +822,12 @@ export class WorldDoors {
     const enforced = scope === 'read' && (await this.enforcesRead(vendor!, twin, url.origin));
     if (scope === 'read' && !reads && !enforced) return Response.json({ error: 'the read token opens only reads' }, { status: 403 });
     const headers = new Headers(request.headers); headers.delete(TOKEN_HEADER); headers.delete(TWINS_KEY_HEADER); headers.delete('host');
+    // who made it is the World's word, never the caller's: the twin's request journal records it. The World is a hop of
+    // the request's trace: the caller's trace-id goes on (or a new one), under a parent-id the World mints, which the
+    // request's log entries carry, so each entry is joined to its caller by an id no caller chose
+    headers.delete(CALLER_HEADER);
+    const who = this.callerOf(request); if (who) headers.set(CALLER_HEADER, who);
+    headers.set('traceparent', traceparentForDelivery(headers.get('traceparent')) ?? newTraceparent());
     // at a twin that enforces the read scope, every request of the read token is marked read-only (a GET
     // that would write for its caller is refused too); at any other, its GET passes as it always has
     if (enforced) headers.set(READ_ONLY_HEADER, '1');
@@ -843,7 +890,7 @@ export class WorldDoors {
     // what leaves for the vendor before the seal is applied: no World token in any header it can arrive
     // under (an SDK's own `Authorization: Bearer` included), no cookie, no routing headers of this World
     const caller = new Headers(request.headers);
-    for (const h of [TOKEN_HEADER, TWINS_KEY_HEADER, TWIN_PREFIX_HEADER, 'host', 'x-forwarded-host', 'x-forwarded-proto', 'cookie']) caller.delete(h);
+    for (const h of [TOKEN_HEADER, TWINS_KEY_HEADER, TWIN_PREFIX_HEADER, CALLER_HEADER, 'host', 'x-forwarded-host', 'x-forwarded-proto', 'cookie']) caller.delete(h);
     // a secret this World minted (`tok_…`, live, revoked or expired) or one that opens it never leaves
     const authorization = caller.get('authorization');
     const offered = authorization ? presentedSecrets(new Headers({ authorization }), { token: TOKEN_HEADER, twinsKey: TWINS_KEY_HEADER }) : [];
@@ -852,7 +899,9 @@ export class WorldDoors {
     // name, with the credential shape of what the caller sent on. As an audit device does, the request is
     // written before the real credential is used, and a request whose audit cannot be written is refused.
     const credentials = twinRequestCredentials(caller, url);
-    if (!journalTwinRequest(name, { phase: 'request', method: request.method, path: `/${rest}`, status: 0, credentials }, this.controlRoot(name))) {
+    const who = this.callerOf(request); const trace = parseTraceparent(request.headers.get('traceparent'))?.traceId;
+    const by = { ...(who ? { caller: who } : {}), ...(trace ? { trace } : {}) };
+    if (!journalTwinRequest(name, { phase: 'request', method: request.method, path: `/${rest}`, status: 0, credentials, ...by }, this.controlRoot(name))) {
       return Response.json({ error: `the ${name} link's audit could not be written: nothing was sent` }, { status: 503 });
     }
     const startedAt = Date.now(); let status = 500;
@@ -861,7 +910,7 @@ export class WorldDoors {
       status = answer.status;
       return answer;
     } finally {
-      journalTwinRequest(name, { method: request.method, path: `/${rest}`, status, ms: Date.now() - startedAt, credentials }, this.controlRoot(name));
+      journalTwinRequest(name, { method: request.method, path: `/${rest}`, status, ms: Date.now() - startedAt, credentials, ...by }, this.controlRoot(name));
     }
   }
 
@@ -1017,8 +1066,10 @@ export class WorldDoors {
     }
     if (kind === 'changesets' && request.method === 'GET') {
       // with the body's hash as it stands, so a reader sees an approval or a verification made on other bytes as stale
-      if (name) { const l = findWorldChangeset(name, { root: this.worldRoot, world: this.name }); return Response.json({ ...l.changeset, currentHash: changesetContentHash(l.changeset) }); }
-      return Response.json({ changesets: listWorldChangesets({ root: this.worldRoot, world: this.name }).map((l) => ({ ...l.changeset, currentHash: changesetContentHash(l.changeset) })) });
+      if (name) { const l = findWorldChangeset(name, { root: this.worldRoot, world: this.name }); return Response.json({ ...l.changeset, currentHash: changesetContentHash(l.changeset), deployed: this.deployedOf([l.changeset])[0] }); }
+      const all = listWorldChangesets({ root: this.worldRoot, world: this.name }).map((l) => l.changeset);
+      const deployed = this.deployedOf(all);
+      return Response.json({ changesets: all.map((c, i) => ({ ...c, currentHash: changesetContentHash(c), deployed: deployed[i] })) });
     }
     if (kind === 'changesets' && name && verb === 'verify' && request.method === 'POST') {
       const outcome = await this.serialized('changesets', () => verifyWorldChangeset(name, { root: this.worldRoot, world: this.name, ephemeral: true }));
@@ -1442,7 +1493,23 @@ export class WorldDoors {
     const more = page.length > limit; const shown = page.slice(0, limit);
     const last = shown[shown.length - 1];
     const next = more && last ? Buffer.from(JSON.stringify([last.entry.occurredAt, last.twin, last.position])).toString('base64url') : null;
-    return Response.json({ world: this.served, entries: shown, next });
+    // who made each entry: the request it was written in (the World's span on it) as the twin's journal recorded it
+    const entries = shown.map((r) => { const by = this.callersOf(r.twin).get(spanOf(r.entry.traceparent) ?? ''); return by ? { ...r, caller: by } : r; });
+    return Response.json({ world: this.served, entries, next });
+  }
+
+  /** Each twin's callers by the World's span, from its request journal: its newest CALLER_SEGMENTS once, then from
+   *  where the last read stopped (readTwinRequestJournalFrom follows a rotation). The newest CALLERS_KEPT are kept. */
+  private readonly callersByTwin = new Map<string, { root: string; cursor: TwinRequestJournalCursor | null; callers: Map<string, string> }>();
+  private callersOf(twin: string): Map<string, string> {
+    const root = this.controlRoot(twin);
+    let held = this.callersByTwin.get(twin);
+    if (!held || held.root !== root) { held = { root, cursor: null, callers: new Map() }; this.callersByTwin.set(twin, held); }
+    const read = readTwinRequestJournalFrom(twin, root, held.cursor, { segments: CALLER_SEGMENTS });
+    for (const e of read.entries) if (e.span && e.caller) { held.callers.delete(e.span); held.callers.set(e.span, e.caller); }
+    held.cursor = read.cursor;
+    for (const span of held.callers.keys()) { if (held.callers.size <= CALLERS_KEPT) break; held.callers.delete(span); }
+    return held.callers;
   }
 
   /** Each twin's timeline rows, kept until its logs change: a poll of an unchanged World reads no log