@volter/world-runtime 3.0.101 → 3.0.102

package/dist/src/process-signal.mjs

@@ -20,10 +20,19 @@ export async function processBirth(pid) {
     } catch { return undefined; }
   }
   return new Promise(resolve => {
-    const child = spawn('ps', ['-o', 'pid=,lstart=', '-p', String(pid)], {
-      windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'],
-      env: { ...process.env, LC_ALL: 'C', LANG: 'C', TZ: 'UTC' },
-    });
+    // A probe that cannot run is a birth unknown, never a lifecycle failure: spawn throws synchronously where the
+    // process may not exec `ps` at all (setuid root on macOS, which a sandbox-exec profile refuses: EPERM), and reports
+    // other failures as 'error' (below). Either way the identity is the pid without a start time.
+    let child;
+    try {
+      child = spawn('ps', ['-o', 'pid=,lstart=', '-p', String(pid)], {
+        windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'],
+        env: { ...process.env, LC_ALL: 'C', LANG: 'C', TZ: 'UTC' },
+      });
+    } catch {
+      resolve(undefined);
+      return;
+    }
     let output = '', settled = false;
     const finish = value => { if (!settled) { settled = true; clearTimeout(timer); child.stdout.destroy(); resolve(value); } };
     // This is our still-held inspector, not a PID from a receipt.

package/dist/src/redis-backing.js

@@ -55,6 +55,33 @@ function listening(port) {
         socket.on('timeout', () => { socket.destroy(); resolve(false); });
     });
 }
+/** Whether the Redis answering on the port is this child (architecture D9): its own INFO server names its process_id, as
+ *  Redis's does. A port that answers as another process, or does not answer yet, is not this child's. */
+function redisServes(port, pid) {
+    return new Promise((resolve) => {
+        const socket = connect({ host: '127.0.0.1', port, timeout: 1000 });
+        let reply = '';
+        socket.once('connect', () => socket.write('*2\r\n$4\r\nINFO\r\n$6\r\nserver\r\n'));
+        socket.on('data', (chunk) => {
+            reply += chunk.toString('latin1');
+            // a bulk string: $<length>\r\n<body>\r\n
+            const head = /^\$(\d+)\r\n/.exec(reply);
+            if (!head) {
+                if (!reply.startsWith('$') || reply.includes('\r\n')) {
+                    socket.destroy();
+                    resolve(false);
+                }
+                return;
+            }
+            if (Buffer.byteLength(reply, 'latin1') < head[0].length + Number(head[1]) + 2)
+                return;
+            socket.destroy();
+            resolve(Number(/(?:^|\r\n)process_id:(\d+)\r\n/.exec(reply.slice(head[0].length))?.[1]) === pid);
+        });
+        socket.on('error', () => resolve(false));
+        socket.on('timeout', () => { socket.destroy(); resolve(false); });
+    });
+}
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 export async function redisTwinUp(services, dataDir, cli, launch = {}) {
     for (const service of services) {
@@ -99,7 +126,7 @@ export async function redisTwinUp(services, dataDir, cli, launch = {}) {
             publishProcessReceipt(spawnReceiptPath(pidFile), JSON.stringify(identity) + '\n');
             publishProcessReceipt(pidFile, `${held.child.pid}\n`);
             const deadline = Date.now() + READY_TIMEOUT_MS;
-            while (!(await listening(service.hostPort)) || !alive(held.child.pid)) {
+            while (!alive(held.child.pid) || !(await redisServes(service.hostPort, held.child.pid))) {
                 if (!alive(held.child.pid))
                     throw new Error(`redis exited before serving — see ${log}`);
                 launch.signal?.throwIfAborted();
@@ -129,7 +156,8 @@ export async function redisTwinStatus(services, dataDir) {
         const pidFile = pidPath(dataDir, service);
         if (!existsSync(pidFile))
             continue;
-        if (alive(Number(readFileSync(pidFile, 'utf8').trim())) && await listening(service.hostPort))
+        const pid = Number(readFileSync(pidFile, 'utf8').trim());
+        if (alive(pid) && await redisServes(service.hostPort, pid))
             ready += 1;
     }
     return ready;

package/dist/src/runtime.js

@@ -3056,7 +3056,7 @@ function canonicalDottedIpv4(host) {
 function parseCustomShareOrigin(handshake) {
     const raw = /^https?:\/\/(\[[0-9a-f:.]+\]|[a-z0-9.-]+)(?::([0-9]{1,5}))?\/?$/i.exec(handshake);
     if (!raw) {
-        throw new Error(`Custom tunnel VOLTER_SHARE_URL must be a strict http(s) origin without path, query, fragment, or backslashes: ${handshake}`);
+        throw new Error(`The URL a custom tunnel wrote to VOLTER_SHARE_URL_FILE must be a strict http(s) origin without path, query, fragment, or backslashes: ${handshake}`);
     }
     const rawHost = raw[1];
     const rawPort = raw[2];
@@ -3065,24 +3065,27 @@ function parseCustomShareOrigin(handshake) {
         parsed = new URL(handshake);
     }
     catch {
-        throw new Error(`Custom tunnel emitted an invalid VOLTER_SHARE_URL handshake: ${handshake}`);
+        throw new Error(`A custom tunnel wrote an invalid URL to VOLTER_SHARE_URL_FILE: ${handshake}`);
     }
     const normalizedHostname = parsed.hostname.replace(/^\[|\]$/g, '').toLowerCase();
     if (!rawHost.startsWith('[') && isIP(normalizedHostname) === 4
         && (!canonicalDottedIpv4(rawHost) || rawHost !== normalizedHostname)) {
-        throw new Error(`Custom tunnel VOLTER_SHARE_URL must use canonical dotted-decimal IPv4 syntax: ${handshake}`);
+        throw new Error(`The URL a custom tunnel wrote to VOLTER_SHARE_URL_FILE must use canonical dotted-decimal IPv4 syntax: ${handshake}`);
     }
     if (rawPort && rawPort.length > 1 && rawPort.startsWith('0')) {
-        throw new Error(`Custom tunnel VOLTER_SHARE_URL must use canonical decimal port syntax: ${handshake}`);
+        throw new Error(`The URL a custom tunnel wrote to VOLTER_SHARE_URL_FILE must use canonical decimal port syntax: ${handshake}`);
     }
     if ((parsed.protocol !== 'http:' && parsed.protocol !== 'https:') || parsed.username || parsed.password
         || parsed.pathname !== '/' || parsed.search || parsed.hash) {
-        throw new Error(`Custom tunnel VOLTER_SHARE_URL must be a credential-free http(s) origin: ${handshake}`);
+        throw new Error(`The URL a custom tunnel wrote to VOLTER_SHARE_URL_FILE must be a credential-free http(s) origin: ${handshake}`);
     }
     return parsed.origin;
 }
-async function waitForPublicUrl(child, logPath, timeoutMs, requireTryCloudflare) {
-    const urlPattern = /https?:\/\/[^\s"'<>]+/gi;
+/** The tunnel's public URL, from the tunnel's own answer and never its output (architecture D9). cloudflared's metrics
+ *  server answers GET /quicktunnel with {"hostname"} once the quick tunnel is registered (empty before); a custom command
+ *  writes its public URL to VOLTER_SHARE_URL_FILE, ending the line when it is complete, so a half-written URL is never
+ *  read. The process's log is for people. */
+async function waitForPublicUrl(child, source, logPath, timeoutMs) {
     let exited = false;
     let exitSummary = '';
     child.once('exit', (code, signal) => {
@@ -3095,26 +3098,35 @@ async function waitForPublicUrl(child, logPath, timeoutMs, requireTryCloudflare)
     });
     const started = Date.now();
     while (Date.now() - started < timeoutMs) {
-        const text = existsSync(logPath) ? readFileSync(logPath, 'utf8') : '';
-        if (requireTryCloudflare) {
-            for (const candidate of text.match(urlPattern) ?? []) {
-                const parsed = parseCloudflareQuickPublicUrl(candidate);
-                if (parsed)
+        if ('metricsPort' in source) {
+            try {
+                const answer = await fetch(`http://127.0.0.1:${source.metricsPort}/quicktunnel`, { signal: AbortSignal.timeout(1000) });
+                const hostname = answer.ok ? (await answer.json()).hostname : undefined;
+                if (typeof hostname === 'string' && hostname) {
+                    const parsed = parseCloudflareQuickPublicUrl(`https://${hostname}`);
+                    if (!parsed)
+                        throw new Error(`cloudflared answered /quicktunnel with ${JSON.stringify(hostname)}, not a trycloudflare.com hostname. Log: ${logPath}`);
                     return parsed;
+                }
+            }
+            catch (error) {
+                if (error instanceof Error && error.message.startsWith('cloudflared answered'))
+                    throw error;
+                // its metrics server not listening yet: asked again
             }
         }
         else {
-            const handshake = /^VOLTER_SHARE_URL=(\S+)\s*$/m.exec(text)?.[1];
-            if (handshake)
-                return parseCustomShareOrigin(handshake);
+            const text = existsSync(source.urlFile) ? readFileSync(source.urlFile, 'utf8') : '';
+            if (text.endsWith('\n'))
+                return parseCustomShareOrigin(text.trim());
         }
         if (exited)
-            throw new Error(`Tunnel process exited before printing a public URL (${exitSummary}). Log: ${logPath}`);
-        await new Promise((resolveWait) => setTimeout(resolveWait, 250));
+            throw new Error(`Tunnel process exited before answering its public URL (${exitSummary}). Log: ${logPath}`);
+        await new Promise((resolveWait) => setTimeout(resolveWait, 100));
     }
-    throw new Error(requireTryCloudflare
-        ? `Cloudflare tunnel did not print a trycloudflare.com https URL within ${timeoutMs}ms. Log: ${logPath}`
-        : `Custom tunnel did not print VOLTER_SHARE_URL=<http(s)-url> within ${timeoutMs}ms. Log: ${logPath}`);
+    throw new Error('metricsPort' in source
+        ? `cloudflared's metrics server did not answer a trycloudflare.com hostname at /quicktunnel within ${timeoutMs}ms. Log: ${logPath}`
+        : `Custom tunnel did not write its public URL, newline-terminated, to VOLTER_SHARE_URL_FILE within ${timeoutMs}ms. Log: ${logPath}`);
 }
 function sleep(ms) {
     return new Promise((resolveWait) => setTimeout(resolveWait, ms));
@@ -3284,12 +3296,19 @@ async function shareWorldReserved(name, options) {
     }
     const tunnel = shareCommand(options, service.url);
     const log = ownedPath(instance.dirs.logs, `${serviceId}.tunnel.log`);
-    // Each spawned tunnel owns one log generation. Truncating before spawn prevents a repeated
-    // share from accepting the previous process's URL handshake as the new process's endpoint.
+    // The public URL is the tunnel's own answer, never its output (architecture D9): cloudflared's metrics server
+    // answers /quicktunnel with the hostname it registered; a custom command writes its URL to VOLTER_SHARE_URL_FILE.
+    // Each spawned tunnel owns one generation of both, so a repeated share never takes the previous process's URL.
+    const source = tunnel.provider === 'cloudflare-quick'
+        ? { metricsPort: await allocatePort(new Set()) }
+        : { urlFile: ownedPath(instance.dirs.logs, `${serviceId}.tunnel.url`) };
+    if ('urlFile' in source)
+        rmSync(source.urlFile, { force: true });
+    const args = 'metricsPort' in source ? ['tunnel', '--metrics', `127.0.0.1:${source.metricsPort}`, ...tunnel.args.slice(1)] : tunnel.args;
     const out = openPrivateLog(log, 'w');
-    const child = spawn(tunnel.command, tunnel.args, { windowsHide: true,
+    const child = spawn(tunnel.command, args, { windowsHide: true,
         cwd: root,
-        env: withoutVaultSignIn(process.env),
+        env: { ...withoutVaultSignIn(process.env), ...('urlFile' in source ? { VOLTER_SHARE_URL_FILE: source.urlFile } : {}) },
         detached: true,
         stdio: ['ignore', out, out],
     });
@@ -3305,7 +3324,7 @@ async function shareWorldReserved(name, options) {
         if (!identity?.start)
             throw new Error('Tunnel birth capture failed; retiring held child');
         identities[identity.pid] = identity.start;
-        publicUrl = await waitForPublicUrl(child, log, options.timeoutMs ?? 20_000, tunnel.provider === 'cloudflare-quick');
+        publicUrl = await waitForPublicUrl(child, source, log, options.timeoutMs ?? 20_000);
         if (options.verifyPath !== false) {
             publicVerification = await verifyPublicUrl(publicUrl, options.verifyPath ?? '/health', options.timeoutMs ?? 90_000);
         }
@@ -3324,7 +3343,7 @@ async function shareWorldReserved(name, options) {
             provider: tunnel.provider,
             pid: child.pid ?? 0,
             log,
-            command: [tunnel.command, ...tunnel.args],
+            command: [tunnel.command, ...args],
             startedAt: new Date().toISOString(),
         };
         writePidsFromInstance(nextInstance, child.pid ? [child.pid] : []);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-runtime",
-  "version": "3.0.101",
+  "version": "3.0.102",
   "description": "World configs for twins: boot named local runtimes, allocate ports, generate world.env/instance.json, and run apps against fake-key twin worlds.",
   "keywords": [
     "twin",
@@ -69,14 +69,14 @@
     "node": ">=22.3"
   },
   "peerDependencies": {
-    "@volter/world-core": "3.0.101",
-    "@volter/world-console": "3.0.96"
+    "@volter/world-core": "3.0.102",
+    "@volter/world-console": "3.0.97"
   },
   "dependencies": {
     "@electric-sql/pglite": "0.5.8",
     "@electric-sql/pglite-pgvector": "0.0.9",
     "@volter/world-access": "3.0.1",
-    "@volter/world-core": "3.0.101",
+    "@volter/world-core": "3.0.102",
     "mongodb": "~6.20.0",
     "pg-gateway": "0.3.0-beta.4",
     "smol-toml": "^1.8.0",

package/src/process-signal.mjs

@@ -20,10 +20,19 @@ export async function processBirth(pid) {
     } catch { return undefined; }
   }
   return new Promise(resolve => {
-    const child = spawn('ps', ['-o', 'pid=,lstart=', '-p', String(pid)], {
-      windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'],
-      env: { ...process.env, LC_ALL: 'C', LANG: 'C', TZ: 'UTC' },
-    });
+    // A probe that cannot run is a birth unknown, never a lifecycle failure: spawn throws synchronously where the
+    // process may not exec `ps` at all (setuid root on macOS, which a sandbox-exec profile refuses: EPERM), and reports
+    // other failures as 'error' (below). Either way the identity is the pid without a start time.
+    let child;
+    try {
+      child = spawn('ps', ['-o', 'pid=,lstart=', '-p', String(pid)], {
+        windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'],
+        env: { ...process.env, LC_ALL: 'C', LANG: 'C', TZ: 'UTC' },
+      });
+    } catch {
+      resolve(undefined);
+      return;
+    }
     let output = '', settled = false;
     const finish = value => { if (!settled) { settled = true; clearTimeout(timer); child.stdout.destroy(); resolve(value); } };
     // This is our still-held inspector, not a PID from a receipt.

package/src/redis-backing.ts

@@ -54,6 +54,27 @@ function listening(port: number): Promise<boolean> {
   });
 }
 
+/** Whether the Redis answering on the port is this child (architecture D9): its own INFO server names its process_id, as
+ *  Redis's does. A port that answers as another process, or does not answer yet, is not this child's. */
+function redisServes(port: number, pid: number): Promise<boolean> {
+  return new Promise((resolve) => {
+    const socket = connect({ host: '127.0.0.1', port, timeout: 1000 });
+    let reply = '';
+    socket.once('connect', () => socket.write('*2\r\n$4\r\nINFO\r\n$6\r\nserver\r\n'));
+    socket.on('data', (chunk: Buffer) => {
+      reply += chunk.toString('latin1');
+      // a bulk string: $<length>\r\n<body>\r\n
+      const head = /^\$(\d+)\r\n/.exec(reply);
+      if (!head) { if (!reply.startsWith('$') || reply.includes('\r\n')) { socket.destroy(); resolve(false); } return; }
+      if (Buffer.byteLength(reply, 'latin1') < head[0].length + Number(head[1]) + 2) return;
+      socket.destroy();
+      resolve(Number(/(?:^|\r\n)process_id:(\d+)\r\n/.exec(reply.slice(head[0].length))?.[1]) === pid);
+    });
+    socket.on('error', () => resolve(false));
+    socket.on('timeout', () => { socket.destroy(); resolve(false); });
+  });
+}
+
 const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
 
 export async function redisTwinUp(services: InfraService[], dataDir: string, cli: string, launch: HostLaunch = {}): Promise<void> {
@@ -93,7 +114,7 @@ export async function redisTwinUp(services: InfraService[], dataDir: string, cli
       publishProcessReceipt(spawnReceiptPath(pidFile), JSON.stringify(identity) + '\n');
       publishProcessReceipt(pidFile, `${held.child.pid}\n`);
       const deadline = Date.now() + READY_TIMEOUT_MS;
-      while (!(await listening(service.hostPort)) || !alive(held.child.pid)) {
+      while (!alive(held.child.pid) || !(await redisServes(service.hostPort, held.child.pid))) {
         if (!alive(held.child.pid)) throw new Error(`redis exited before serving — see ${log}`);
         launch.signal?.throwIfAborted();
         if (Date.now() > deadline) throw new Error(`redis did not serve port ${service.hostPort} within ${READY_TIMEOUT_MS / 1000}s — see ${log}`);
@@ -116,7 +137,8 @@ export async function redisTwinStatus(services: InfraService[], dataDir: string)
   for (const service of services) {
     const pidFile = pidPath(dataDir, service);
     if (!existsSync(pidFile)) continue;
-    if (alive(Number(readFileSync(pidFile, 'utf8').trim())) && await listening(service.hostPort)) ready += 1;
+    const pid = Number(readFileSync(pidFile, 'utf8').trim());
+    if (alive(pid) && await redisServes(service.hostPort, pid)) ready += 1;
   }
   return ready;
 }

package/src/runtime.ts

@@ -2865,30 +2865,36 @@ function canonicalDottedIpv4(host: string): boolean {
 function parseCustomShareOrigin(handshake: string): string {
   const raw = /^https?:\/\/(\[[0-9a-f:.]+\]|[a-z0-9.-]+)(?::([0-9]{1,5}))?\/?$/i.exec(handshake);
   if (!raw) {
-    throw new Error(`Custom tunnel VOLTER_SHARE_URL must be a strict http(s) origin without path, query, fragment, or backslashes: ${handshake}`);
+    throw new Error(`The URL a custom tunnel wrote to VOLTER_SHARE_URL_FILE must be a strict http(s) origin without path, query, fragment, or backslashes: ${handshake}`);
   }
   const rawHost = raw[1]!;
   const rawPort = raw[2];
   let parsed: URL;
   try { parsed = new URL(handshake); }
-  catch { throw new Error(`Custom tunnel emitted an invalid VOLTER_SHARE_URL handshake: ${handshake}`); }
+  catch { throw new Error(`A custom tunnel wrote an invalid URL to VOLTER_SHARE_URL_FILE: ${handshake}`); }
   const normalizedHostname = parsed.hostname.replace(/^\[|\]$/g, '').toLowerCase();
   if (!rawHost.startsWith('[') && isIP(normalizedHostname) === 4
     && (!canonicalDottedIpv4(rawHost) || rawHost !== normalizedHostname)) {
-    throw new Error(`Custom tunnel VOLTER_SHARE_URL must use canonical dotted-decimal IPv4 syntax: ${handshake}`);
+    throw new Error(`The URL a custom tunnel wrote to VOLTER_SHARE_URL_FILE must use canonical dotted-decimal IPv4 syntax: ${handshake}`);
   }
   if (rawPort && rawPort.length > 1 && rawPort.startsWith('0')) {
-    throw new Error(`Custom tunnel VOLTER_SHARE_URL must use canonical decimal port syntax: ${handshake}`);
+    throw new Error(`The URL a custom tunnel wrote to VOLTER_SHARE_URL_FILE must use canonical decimal port syntax: ${handshake}`);
   }
   if ((parsed.protocol !== 'http:' && parsed.protocol !== 'https:') || parsed.username || parsed.password
     || parsed.pathname !== '/' || parsed.search || parsed.hash) {
-    throw new Error(`Custom tunnel VOLTER_SHARE_URL must be a credential-free http(s) origin: ${handshake}`);
+    throw new Error(`The URL a custom tunnel wrote to VOLTER_SHARE_URL_FILE must be a credential-free http(s) origin: ${handshake}`);
   }
   return parsed.origin;
 }
 
-async function waitForPublicUrl(child: ReturnType<typeof spawn>, logPath: string, timeoutMs: number, requireTryCloudflare: boolean): Promise<string> {
-  const urlPattern = /https?:\/\/[^\s"'<>]+/gi;
+/** Where a tunnel answers its public URL: cloudflared's metrics server, or the file a custom command writes. */
+type PublicUrlSource = { metricsPort: number } | { urlFile: string };
+
+/** The tunnel's public URL, from the tunnel's own answer and never its output (architecture D9). cloudflared's metrics
+ *  server answers GET /quicktunnel with {"hostname"} once the quick tunnel is registered (empty before); a custom command
+ *  writes its public URL to VOLTER_SHARE_URL_FILE, ending the line when it is complete, so a half-written URL is never
+ *  read. The process's log is for people. */
+async function waitForPublicUrl(child: ReturnType<typeof spawn>, source: PublicUrlSource, logPath: string, timeoutMs: number): Promise<string> {
   let exited = false;
   let exitSummary = '';
   child.once('exit', (code, signal) => {
@@ -2902,22 +2908,29 @@ async function waitForPublicUrl(child: ReturnType<typeof spawn>, logPath: string
 
   const started = Date.now();
   while (Date.now() - started < timeoutMs) {
-    const text = existsSync(logPath) ? readFileSync(logPath, 'utf8') : '';
-    if (requireTryCloudflare) {
-      for (const candidate of text.match(urlPattern) ?? []) {
-        const parsed = parseCloudflareQuickPublicUrl(candidate);
-        if (parsed) return parsed;
+    if ('metricsPort' in source) {
+      try {
+        const answer = await fetch(`http://127.0.0.1:${source.metricsPort}/quicktunnel`, { signal: AbortSignal.timeout(1000) });
+        const hostname = answer.ok ? ((await answer.json()) as { hostname?: unknown }).hostname : undefined;
+        if (typeof hostname === 'string' && hostname) {
+          const parsed = parseCloudflareQuickPublicUrl(`https://${hostname}`);
+          if (!parsed) throw new Error(`cloudflared answered /quicktunnel with ${JSON.stringify(hostname)}, not a trycloudflare.com hostname. Log: ${logPath}`);
+          return parsed;
+        }
+      } catch (error) {
+        if (error instanceof Error && error.message.startsWith('cloudflared answered')) throw error;
+        // its metrics server not listening yet: asked again
       }
     } else {
-      const handshake = /^VOLTER_SHARE_URL=(\S+)\s*$/m.exec(text)?.[1];
-      if (handshake) return parseCustomShareOrigin(handshake);
+      const text = existsSync(source.urlFile) ? readFileSync(source.urlFile, 'utf8') : '';
+      if (text.endsWith('\n')) return parseCustomShareOrigin(text.trim());
     }
-    if (exited) throw new Error(`Tunnel process exited before printing a public URL (${exitSummary}). Log: ${logPath}`);
-    await new Promise((resolveWait) => setTimeout(resolveWait, 250));
+    if (exited) throw new Error(`Tunnel process exited before answering its public URL (${exitSummary}). Log: ${logPath}`);
+    await new Promise((resolveWait) => setTimeout(resolveWait, 100));
   }
-  throw new Error(requireTryCloudflare
-    ? `Cloudflare tunnel did not print a trycloudflare.com https URL within ${timeoutMs}ms. Log: ${logPath}`
-    : `Custom tunnel did not print VOLTER_SHARE_URL=<http(s)-url> within ${timeoutMs}ms. Log: ${logPath}`);
+  throw new Error('metricsPort' in source
+    ? `cloudflared's metrics server did not answer a trycloudflare.com hostname at /quicktunnel within ${timeoutMs}ms. Log: ${logPath}`
+    : `Custom tunnel did not write its public URL, newline-terminated, to VOLTER_SHARE_URL_FILE within ${timeoutMs}ms. Log: ${logPath}`);
 }
 
 function sleep(ms: number): Promise<void> {
@@ -3090,12 +3103,18 @@ async function shareWorldReserved(name: string, options: ShareWorldOptions): Pro
 
   const tunnel = shareCommand(options, service.url);
   const log = ownedPath(instance.dirs.logs, `${serviceId}.tunnel.log`);
-  // Each spawned tunnel owns one log generation. Truncating before spawn prevents a repeated
-  // share from accepting the previous process's URL handshake as the new process's endpoint.
+  // The public URL is the tunnel's own answer, never its output (architecture D9): cloudflared's metrics server
+  // answers /quicktunnel with the hostname it registered; a custom command writes its URL to VOLTER_SHARE_URL_FILE.
+  // Each spawned tunnel owns one generation of both, so a repeated share never takes the previous process's URL.
+  const source: PublicUrlSource = tunnel.provider === 'cloudflare-quick'
+    ? { metricsPort: await allocatePort(new Set()) }
+    : { urlFile: ownedPath(instance.dirs.logs, `${serviceId}.tunnel.url`) };
+  if ('urlFile' in source) rmSync(source.urlFile, { force: true });
+  const args = 'metricsPort' in source ? ['tunnel', '--metrics', `127.0.0.1:${source.metricsPort}`, ...tunnel.args.slice(1)] : tunnel.args;
   const out = openPrivateLog(log, 'w');
-  const child = spawn(tunnel.command, tunnel.args, { windowsHide: true,
+  const child = spawn(tunnel.command, args, { windowsHide: true,
     cwd: root,
-    env: withoutVaultSignIn(process.env),
+    env: { ...withoutVaultSignIn(process.env), ...('urlFile' in source ? { VOLTER_SHARE_URL_FILE: source.urlFile } : {}) },
     detached: true,
     stdio: ['ignore', out, out],
   });
@@ -3111,7 +3130,7 @@ async function shareWorldReserved(name: string, options: ShareWorldOptions): Pro
     const identity = await birth;
     if (!identity?.start) throw new Error('Tunnel birth capture failed; retiring held child');
     identities[identity.pid] = identity.start;
-    publicUrl = await waitForPublicUrl(child, log, options.timeoutMs ?? 20_000, tunnel.provider === 'cloudflare-quick');
+    publicUrl = await waitForPublicUrl(child, source, log, options.timeoutMs ?? 20_000);
     if (options.verifyPath !== false) {
       publicVerification = await verifyPublicUrl(publicUrl, options.verifyPath ?? '/health', options.timeoutMs ?? 90_000);
     }
@@ -3129,7 +3148,7 @@ async function shareWorldReserved(name: string, options: ShareWorldOptions): Pro
       provider: tunnel.provider,
       pid: child.pid ?? 0,
       log,
-      command: [tunnel.command, ...tunnel.args],
+      command: [tunnel.command, ...args],
       startedAt: new Date().toISOString(),
     };
     writePidsFromInstance(nextInstance, child.pid ? [child.pid] : []);