@volter/world-runtime 3.0.162 → 3.0.164

package/dist/src/runtime.js

@@ -1,18 +1,17 @@
 import { errorMessage } from "./error-message.js";
-import { materializeBrowserFiles, clearBrowserFiles } from "./browsers.js";
+import { materializeWorldBrowserFiles } from "./browser-files.js";
 import { claimEnvOutput, publishEnvOutput } from "./env-output.js";
 import { offSignal } from "./signals.js";
 import { parallelStartup } from "./startup.js";
 import { waitForHostReady } from "./host-ready.js";
 import { assertWorldStateRemovable, removeWorldState } from "./ancestry.js";
 import { packCli, packEntry } from "./catalog.js";
-import { vendorOfPackModule } from '@volter/world-core/runtime';
+import { vendorOfPackModule } from '@volter/world-core/runtime-state';
 import { spawn, spawnSync } from 'node:child_process';
 import { get as httpGet } from 'node:http';
 import { siblingScript } from "./sibling.js";
 import { commandLifetime, commandProcessGroup, CommandRetirementError } from "./command-lifetime.js";
-import { superviseWorldRun } from "./run-task.js";
-import { processStarts, survivingOwnedGroups } from "./process-groups.js";
+import { processStarts, survivingOwnedGroups, setWorldEventsFile, worldEvent } from "./process-groups.js";
 import { spawnIdentity, signalOwnedProcess, signalChild, signalHeldChild, processBirth, childIdentity } from './process-signal.mjs';
 import { readGuestProcesses, releaseGuestProcesses } from './guest-processes.mjs';
 import { randomUUID, createHash } from 'node:crypto';
@@ -25,10 +24,10 @@ import { basename, delimiter, dirname, join, relative, resolve, sep } from 'node
 import { packFacts } from "./pack-facts.js";
 import { assertOwnedRealPath, ownedPath } from "./owned-path.js";
 import { isEnvironmentName } from "./schema.js";
-import { infraConnections, parseInfraDefinition } from "./pglite-backing.js";
+import { infraConnections, parseInfraDefinition } from "./infra-definition.js";
 import { describeServiceEnd, readServiceEnd } from "./service-exit.js";
 import { Socket } from 'node:net';
-import { beginPlaceholderPull, endPlaceholderPull, placeholderPullActive, getActiveWorldStore, withFileLock, stateDirName, PROTOCOL_VERSION, PROTOCOL_MAJOR, protocolStanding, WORLD_BOOT_PATH, WORLD_DATA_ENV, WORLD_ENV_NAMES_ENV } from '@volter/world-core/runtime';
+import { beginPlaceholderPull, endPlaceholderPull, placeholderPullActive, getActiveWorldStore, removeCarriedLocks, withFileLock, stateDirName, PROTOCOL_VERSION, PROTOCOL_MAJOR, protocolStanding, WORLD_BOOT_PATH, WORLD_DATA_ENV, WORLD_ENV_NAMES_ENV } from '@volter/world-core/runtime-state';
 import { loadWorldConfig } from "./configs.js";
 import { createWorldNetworkPolicy, parseWorldNetworkPolicy, normalizeWorldNetwork, intersectWorldNetwork, WORLD_NETWORK_POLICY_ENV } from '@volter/world-core/network-policy';
 import { overlayPackFactsFile, resolveServicePackage } from "./catalog.js";
@@ -36,10 +35,10 @@ import { fakeEnvValue } from "./fixture-env.js";
 import { APP_URL_ENV, ISSUE_ENV_PREFIX, MINT_ENV } from "./schema.js";
 import { readAppUrl } from "./app-url.js";
 import { inertInjectEnvWarnings } from "./inject-map.js";
-import { activeVendorMap, ensureCa, hostHasRawEgress, opensslAvailable, proxyEnvFor, startRedirectProxy, tearDownCa } from "./redirect-proxy.js";
+import { activeVendorMap, ensureCa, hostHasRawEgress, opensslAvailable, proxyEnvFor, tearDownCa } from "./proxy-env.js";
 import { CaTrustError, sessionTrustEnv } from "./ca-trust.js";
 import { checkedOwner, CONSUMER_HEARTBEAT_MS, createConsumer, refreshConsumer, releaseConsumer, removeConsumerRecord, worldConsumers, consumerProcessState } from "./consumers.js";
-import { assertLifecycleStartable, beginWorldLifecycle, handoffWorldLifecycle, recordWorldLifecycleEvent, releaseWorldLifecycle, retainWorldLifecycleForCleanup, hasWorldLifecycle, isWorldLifecycleRunning, lifecycleLogPath, releaseAbandonedWorldLifecycle, exitedWorldLifecyclePids } from "./lifecycle-record.js";
+import { assertLifecycleStartable, beginWorldLifecycle, handoffWorldLifecycle, recordWorldLifecycleEvent, releaseWorldLifecycle, retainWorldLifecycleForCleanup, hasWorldLifecycle, isWorldLifecycleRunning, describeWorldLifecycle, lifecycleLogPath, releaseAbandonedWorldLifecycle, exitedWorldLifecyclePids } from "./lifecycle-record.js";
 // Births captured at actual spawn; retries never remeasure a retained PID.
 const spawnedIdentities = new Map();
 const spawnedChildren = new Map();
@@ -130,13 +129,17 @@ async function confirmOwnPort(port, boot, ended, twin, what, log) {
     if (answered && typeof answered.boot === 'string') {
         if (answered.boot === boot.bootId)
             return;
-        throw new Error(`${what}: its port is answered by a twin of another World boot (${answered.boot}), not this one; a leftover World holds the port. Stop it (\`volter-world list\`, then \`down\`) and retry.\nLog: ${log}`);
+        throw foreignBoot(what, answered.boot, log);
     }
     // Whether the service has already ended, read now: one turn of the event loop, not a wait for it to fail.
     const endedNow = ended ? await Promise.race([ended.then(() => true), new Promise((resolveNow) => setImmediate(() => resolveNow(false)))]) : false;
     if (endedNow)
         throw new Error(`${what} ended right after its port first answered, so another process probably holds the port: the service ${endedAccount(log)}\nLog: ${log}`);
 }
+/** A port answered by a twin of another World boot: a leftover World holds it. */
+function foreignBoot(what, answered, log) {
+    return new Error(`${what}: its port is answered by a twin of another World boot (${answered}), not this one; a leftover World holds the port. Stop it (\`volter-world list\`, then \`down\`) and retry.\nLog: ${log}`);
+}
 /** What the server on a loopback port says its World boot is (WORLD_BOOT_PATH), or null. A direct loopback request:
  *  never through a proxy an activated shell's environment names. */
 function worldBootOf(port, abort) {
@@ -806,17 +809,17 @@ async function waitForTcp(port, timeoutMs = 15_000, abort) {
     }
     throw new Error(`Service on port ${port} did not become reachable`);
 }
-function readPids(path) {
+function readPids(path, receipts = readGuestProcesses(dirname(path))) {
     const held = getActiveWorldStore().read(path);
-    const guests = readGuestProcesses(dirname(path)).map(receipt => receipt.record.pid);
+    const guests = receipts.map(receipt => receipt.record.pid);
     return [...new Set([...(held ?? '')
                 .split(/\r?\n/)
                 .map((line) => Number(line.trim()))
                 .filter((pid) => Number.isInteger(pid) && pid > 0), ...guests])];
 }
-function livePids(pids) {
+function livePids(pids, listing) {
     // A recorded leader may have exited while its detached descendants still run.
-    return survivingOwnedGroups(pids);
+    return survivingOwnedGroups(pids, listing);
 }
 function tunnelPids(instance) {
     return Object.values(instance.services)
@@ -853,7 +856,7 @@ function writeOwnedPids(root, name, pids, fresh = [], births = heldStarts()) {
 function identityPath(root, name) {
     return join(instanceDir(root, name), 'pids.identity');
 }
-function readIdentities(root, name) {
+function readIdentities(root, name, receipts = readGuestProcesses(instanceDir(root, name)), onConflict) {
     let known = {};
     try {
         const value = JSON.parse(getActiveWorldStore().read(identityPath(root, name)) ?? '{}');
@@ -862,13 +865,18 @@ function readIdentities(root, name) {
     }
     catch { /* Guest receipts below remain independently authoritative. */ }
     const births = new Map();
-    for (const { record } of readGuestProcesses(instanceDir(root, name))) {
-        if (births.has(record.pid) && births.get(record.pid) !== record.start)
-            throw new Error('Conflicting guest spawn identities; ownership retained');
+    const conflicts = new Set();
+    for (const { record } of receipts) {
+        if (births.has(record.pid) && births.get(record.pid) !== record.start) {
+            if (!onConflict)
+                throw new Error('Conflicting guest spawn identities; ownership retained');
+            conflicts.add(record.pid);
+            onConflict(record.pid);
+        }
         births.set(record.pid, record.start);
     }
     for (const [pid, start] of births) {
-        if (start)
+        if (start && !conflicts.has(pid))
             known[pid] = start;
         else
             delete known[pid];
@@ -1084,9 +1092,9 @@ async function runExternalCommand(command, cwd, serviceId, phase, env = process.
 /** Run an external service's `up` command, STREAMING its stdout+stderr to the service log as it runs
  * (instead of buffering through spawnSync's 1MB cap, which a large DB restore would overflow). Returns
  * the combined output so `discover` can read it. Throws with a bounded tail on nonzero exit. */
-async function runExternalUp(command, cwd, serviceId, env, logPath, abort, progress) {
+async function runExternalUp(command, cwd, serviceId, env, logPath, abort, progress, verified) {
     if (ownInfrastructureUp(command))
-        return runOwnInfrastructureUp(command, serviceId, env, logPath, abort, progress);
+        return runOwnInfrastructureUp(command, serviceId, env, logPath, abort, progress, verified);
     const [bin, ...args] = ownCommand(command);
     if (!bin)
         throw new Error(`External service "${serviceId}": up command is empty`);
@@ -1176,13 +1184,14 @@ async function runOwnInfrastructureStatus(serviceId, phase, env, abort, timeoutM
         abort?.removeEventListener('abort', onAbort);
     }
 }
-async function runOwnInfrastructureUp(command, serviceId, env, logPath, abort, progress) {
+async function runOwnInfrastructureUp(command, serviceId, env, logPath, abort, progress, verified) {
     writeFileSync(logPath, `$ ${command.join(' ')}\n`, { mode: 0o600 });
     chmodSync(logPath, 0o600);
     const out = openPrivateLog(logPath, 'a');
     const chunks = [];
     try {
         abort?.throwIfAborted();
+        const importing = Date.now();
         const { runInfrastructure } = await import("./infra.js");
         // Its phase lines (backing chosen, host spawned, serving) are the boot's progress too.
         const write = (text) => {
@@ -1192,7 +1201,9 @@ async function runOwnInfrastructureUp(command, serviceId, env, logPath, abort, p
                 if (line.startsWith('managed infrastructure'))
                     progress?.(`${serviceId}: ${line}`);
         };
-        const code = await runInfrastructure(command[1], env, { out: write, err: write }, abort);
+        // Its module's load, said with the line's own time (S2, Twenty's World up): what of the start before the backing's line was this.
+        write(`managed infrastructure: its module loaded in ${Date.now() - importing} ms\n`);
+        const code = await runInfrastructure(command[1], env, { out: write, err: write, ...(verified ? { verified: (status) => { verified.status = status; } } : {}) }, abort);
         abort?.throwIfAborted();
         if (code !== 0) {
             const detail = chunks.join('').trim().split('\n').slice(-40).join('\n');
@@ -1216,7 +1227,7 @@ function resolveReadyProbe(ready, svc) {
         .split('${port}').join(String(svc.port));
     return { ...ready, httpUrl };
 }
-async function awaitReadiness(ready, cwd, serviceId, env = process.env, abort) {
+async function awaitReadiness(ready, cwd, serviceId, env = process.env, abort, passing) {
     if (!ready)
         return 'no readiness declared';
     const timeoutMs = ready.timeoutMs ?? 60_000;
@@ -1232,7 +1243,9 @@ async function awaitReadiness(ready, cwd, serviceId, env = process.env, abort) {
                 throw new Error(`Service "${serviceId}": readiness command \`${ready.command}\` not found on PATH`);
             }
             try {
-                await runExternalCommand([ready.command, ...(ready.args ?? [])], cwd, serviceId, 'readiness', env, abort, Math.max(1, timeoutMs - (Date.now() - started)));
+                const output = await runExternalCommand([ready.command, ...(ready.args ?? [])], cwd, serviceId, 'readiness', env, abort, Math.max(1, timeoutMs - (Date.now() - started)));
+                if (passing)
+                    Object.assign(passing, output);
                 return passed(`\`${[ready.command, ...(ready.args ?? [])].join(' ')}\` exited 0`);
             }
             catch (error) {
@@ -1289,15 +1302,39 @@ async function startExternalService(service, paths, worldEnv, stripEnv, boot) {
     // Publish the declared teardown before an external command can create state.
     boot?.external({ id: service.id, type: 'external', command: [...external.up], pid: 0, log, env: {},
         external: { down: [...external.down], cwd, discoveredEnv: { ...(service.env ?? {}) } } });
-    const upOutput = await runExternalUp(external.up, cwd, service.id, env, log, boot?.signal, boot?.progress);
+    const verified = {};
+    const upOutput = await runExternalUp(external.up, cwd, service.id, env, log, boot?.signal, boot?.progress, verified);
     boot?.progress(`${service.id}: up returned`);
     // 2. readiness — Docker-backed externals take seconds to boot.
-    const readiness = await awaitReadiness(external.readyWhen, cwd, service.id, env, boot?.signal);
+    const passing = {};
+    // The runtime's own infrastructure, every service twin-served or its PostgreSQL native (no MongoDB native), proves in
+    // its `up` what its `status` would, status's proofs asked again at hand-over though not its choice of backing (infra.ts
+    // handOver: twin-backing.ts twinBackingHeld, each port
+    // served by the child it started; native-postgres-backing.ts nativePostgresStatus, the postmaster's ownership, live
+    // group, identity and answering port; Cal's status run took 70 ms, c670b965 run 2, on the mini, in a browser tab; S2
+    // R46). Its up hands over the status it would print, so the probe,
+    // when it is that same `status`, is not run again (LibreChat: the status run took 206 ms before it connected, e946aa4c
+    // lap 060250 run 2, on the mini, in a browser tab; S2 R45). Any other probe, or a backing up does not prove, is
+    // probed as before.
+    const probed = external.readyWhen?.command === undefined ? undefined : [external.readyWhen.command, ...(external.readyWhen.args ?? [])];
+    const upProved = verified.status !== undefined && probed !== undefined && ownInfrastructureStatus(probed);
+    if (upProved) {
+        passing.stdout = verified.status;
+        passing.stderr = '';
+    }
+    const readiness = upProved ? 'proved by its own up, as its status would' : await awaitReadiness(external.readyWhen, cwd, service.id, env, boot?.signal, passing);
     boot?.progress(`${service.id}: ready (${readiness})`);
     // 3. status — discover connection info (optional; may reuse up output instead).
     let statusOutput = '';
     if (external.status) {
-        const statusResult = await runExternalCommand(external.status, cwd, service.id, 'status', env, boot?.signal);
+        // The runtime's own infrastructure probes its readiness with the very status command it then reads (init declares
+        // both as `volter-world-infra status`): the probe that just passed is that read, taken a moment ago in this
+        // process, so it is not run again (S2 R17: LibreChat's second run of it, 190 ms of up after its infrastructure
+        // was ready). Any other status command, or a probe that is not the same command, is run as before.
+        const probe = external.readyWhen?.command === undefined ? undefined : [external.readyWhen.command, ...(external.readyWhen.args ?? [])];
+        const same = probe !== undefined && passing.stdout !== undefined && ownInfrastructureStatus(external.status)
+            && probe.length === external.status.length && probe.every((part, index) => part === external.status[index]);
+        const statusResult = same ? { stdout: passing.stdout, stderr: passing.stderr ?? '' } : await runExternalCommand(external.status, cwd, service.id, 'status', env, boot?.signal);
         statusOutput = statusResult.stdout || statusResult.stderr;
         appendFileSync(log, `\n$ ${external.status.join(' ')}\n${statusOutput}`);
         boot?.progress(`${service.id}: status read`);
@@ -1640,9 +1677,12 @@ const ISSUE_TIMEOUT_MS = 15_000;
 /** A twin's issued credential (its `issues`, copied from its pack's credentialDoor by init): once it is up, the door is
  *  asked for one and each pending name of that service is set to it. A twin that answers no credential, or has no
  *  door, leaves the names unset and says so, rather than handing the application a fixture the twin would refuse. */
-async function issueCredentials(service, started, env, pending, unissued, controlRoot) {
+async function issueCredentials(service, started, env, pending, unissued, controlRoot, times) {
     const direct = new Set([...pending].filter(([, id]) => id === `${service.id}@direct`).map(([name]) => name));
     const wanted = [...pending].filter(([name, id]) => id === service.id || direct.has(name)).map(([name]) => name);
+    if (times) {
+        times.names = wanted.length;
+    }
     if (wanted.length === 0)
         return;
     for (const name of wanted)
@@ -1653,6 +1693,8 @@ async function issueCredentials(service, started, env, pending, unissued, contro
         door = packFacts()[service.id]?.credentialDoor ?? door;
     }
     catch { /* no artifact: the saved copy */ }
+    if (times)
+        times.door = performance.now();
     try {
         if (!door)
             throw new Error('its service names no credential door');
@@ -1664,130 +1706,148 @@ async function issueCredentials(service, started, env, pending, unissued, contro
             beginPlaceholderPull(service.id, controlRoot);
         let answer;
         try {
+            if (times)
+                times.sent = performance.now();
             const res = await fetch(new URL(door.path, started.url), { method: 'POST', headers: { 'content-type': 'application/json', 'x-volter-world-activity': 'provisioning' }, body: JSON.stringify(door.body), signal: AbortSignal.timeout(ISSUE_TIMEOUT_MS) });
+            if (times)
+                times.headers = performance.now();
+            // What the door answered is said with its status: a twin's own error is the only reading of why it issued
+            // nothing, and it is otherwise in a log of the twin's host that the caller of `up` may never see.
             if (!res.ok)
-                throw new Error(`answered ${res.status}`);
+                throw new Error(`answered ${res.status}: ${(await res.text().catch(() => '')).replace(/\s+/g, ' ').slice(0, 400) || 'no body'}`);
             answer = (await res.json());
+            if (times)
+                times.answered = performance.now();
         }
         finally {
             if (!enclosingSeed)
                 endPlaceholderPull(service.id, controlRoot);
         }
+        // EACH NAME IS FILLED ON ITS OWN. A door answers several things (a key, a sign-in's files); a part it could not
+        // make, or a name whose part is not in the answer, leaves THAT name unset and said, and the others are given.
+        // One throw here used to unset every name of the service, the key among them.
         for (const name of wanted) {
-            const spec = door.fill[name] ?? '';
-            if (spec.startsWith('directory:') || spec.startsWith('file:')) {
-                if (direct.has(name))
-                    throw new Error(`cannot give ${name}'s filesystem credential a direct URL`);
-                if (!isEnvironmentName(name) || !/^[a-z0-9][a-z0-9._-]*$/.test(service.id))
-                    throw new Error('Invalid credential destination name');
-                if (!env.VOLTER_WORLD_INSTANCE)
-                    throw new Error('World credential custody is unknown');
-                const instance = realpathSync(dirname(env.VOLTER_WORLD_INSTANCE));
-                const custody = ownedPath(instance, 'credentials');
-                const artifact = `${service.id}-${name.toLowerCase()}`;
-                const isDirectory = spec.startsWith('directory:');
-                const field = spec.slice(spec.indexOf(':') + 1), value = answer[field];
-                if (value === undefined || value === null)
-                    throw new Error(`answered no ${field}`);
-                if (isDirectory && (typeof value !== 'object' || Array.isArray(value) || Object.keys(value).length === 0))
-                    throw new Error('Invalid credential directory');
-                const entries = isDirectory ? Object.entries(value) : [[`${artifact}.json`, value]];
-                const files = entries.map(([file, contents]) => {
-                    if (isDirectory && (!file || file.includes('\\') || file.split('/').some(part => !/^[A-Za-z0-9._-]+$/.test(part) || part === '.' || part === '..')))
-                        throw new Error('Invalid World-owned path');
-                    return { path: ownedPath(custody, isDirectory ? `${artifact}/${file}` : file), contents };
-                });
-                const directories = new Set([custody]);
-                for (const { path } of files) {
-                    let parent = dirname(path);
-                    while (parent !== custody) {
-                        directories.add(parent);
-                        parent = dirname(parent);
+            try {
+                const spec = door.fill[name] ?? '';
+                if (spec.startsWith('directory:') || spec.startsWith('file:')) {
+                    if (direct.has(name))
+                        throw new Error(`cannot give ${name}'s filesystem credential a direct URL`);
+                    if (!isEnvironmentName(name) || !/^[a-z0-9][a-z0-9._-]*$/.test(service.id))
+                        throw new Error('Invalid credential destination name');
+                    if (!env.VOLTER_WORLD_INSTANCE)
+                        throw new Error('World credential custody is unknown');
+                    const instance = realpathSync(dirname(env.VOLTER_WORLD_INSTANCE));
+                    const custody = ownedPath(instance, 'credentials');
+                    const artifact = `${service.id}-${name.toLowerCase()}`;
+                    const isDirectory = spec.startsWith('directory:');
+                    const field = spec.slice(spec.indexOf(':') + 1), value = answer[field];
+                    if (value === undefined || value === null)
+                        throw new Error(`answered no ${field}`);
+                    if (isDirectory && (typeof value !== 'object' || Array.isArray(value) || Object.keys(value).length === 0))
+                        throw new Error('Invalid credential directory');
+                    const entries = isDirectory ? Object.entries(value) : [[`${artifact}.json`, value]];
+                    const files = entries.map(([file, contents]) => {
+                        if (isDirectory && (!file || file.includes('\\') || file.split('/').some(part => !/^[A-Za-z0-9._-]+$/.test(part) || part === '.' || part === '..')))
+                            throw new Error('Invalid World-owned path');
+                        return { path: ownedPath(custody, isDirectory ? `${artifact}/${file}` : file), contents };
+                    });
+                    const directories = new Set([custody]);
+                    for (const { path } of files) {
+                        let parent = dirname(path);
+                        while (parent !== custody) {
+                            directories.add(parent);
+                            parent = dirname(parent);
+                        }
+                        const stat = lstatSync(path, { throwIfNoEntry: false });
+                        if (stat && (!stat.isFile() || stat.nlink !== 1))
+                            throw new Error('Invalid World-owned path');
                     }
-                    const stat = lstatSync(path, { throwIfNoEntry: false });
-                    if (stat && (!stat.isFile() || stat.nlink !== 1))
-                        throw new Error('Invalid World-owned path');
-                }
-                // Validate every destination and parent before creating or changing any custody artifact.
-                for (const dir of directories) {
-                    ownedPath(instance, relative(instance, dir));
-                    const stat = lstatSync(dir, { throwIfNoEntry: false });
-                    if (stat && !stat.isDirectory())
-                        throw new Error('Invalid World-owned path');
-                }
-                for (const dir of [...directories].sort((a, b) => a.length - b.length)) {
-                    if (!existsSync(dir))
-                        mkdirSync(dir, { mode: 0o700 });
-                    assertOwnedRealPath(custody, dir);
-                    chmodSync(dir, 0o700);
-                }
-                for (const { path, contents } of files) {
-                    ownedPath(custody, relative(custody, path));
-                    assertOwnedRealPath(custody, dirname(path));
-                    const fd = openSync(path, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_NOFOLLOW, 0o600);
-                    let opened;
-                    try {
-                        const stat = fstatSync(fd);
-                        if (!stat.isFile() || stat.nlink !== 1)
+                    // Validate every destination and parent before creating or changing any custody artifact.
+                    for (const dir of directories) {
+                        ownedPath(instance, relative(instance, dir));
+                        const stat = lstatSync(dir, { throwIfNoEntry: false });
+                        if (stat && !stat.isDirectory())
                             throw new Error('Invalid World-owned path');
-                        opened = stat;
-                        fchmodSync(fd, 0o600);
-                        assertOwnedRealPath(custody, dirname(path));
-                        ftruncateSync(fd, 0);
-                        writeFileSync(fd, typeof contents === 'string' ? contents : `${JSON.stringify(contents, null, 2)}\n`);
                     }
-                    finally {
-                        closeSync(fd);
-                        let realFile;
+                    for (const dir of [...directories].sort((a, b) => a.length - b.length)) {
+                        if (!existsSync(dir))
+                            mkdirSync(dir, { mode: 0o700 });
+                        assertOwnedRealPath(custody, dir);
+                        chmodSync(dir, 0o700);
+                    }
+                    for (const { path, contents } of files) {
+                        ownedPath(custody, relative(custody, path));
+                        assertOwnedRealPath(custody, dirname(path));
+                        const fd = openSync(path, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_NOFOLLOW, 0o600);
+                        let opened;
                         try {
-                            realFile = realpathSync(path);
-                            const current = statSync(realFile);
-                            if (!opened || current.dev !== opened.dev || current.ino !== opened.ino)
+                            const stat = fstatSync(fd);
+                            if (!stat.isFile() || stat.nlink !== 1)
                                 throw new Error('Invalid World-owned path');
-                            assertOwnedRealPath(custody, realFile);
+                            opened = stat;
+                            fchmodSync(fd, 0o600);
+                            assertOwnedRealPath(custody, dirname(path));
+                            ftruncateSync(fd, 0);
+                            writeFileSync(fd, typeof contents === 'string' ? contents : `${JSON.stringify(contents, null, 2)}\n`);
                         }
-                        catch (error) {
-                            // Remove only the file whose descriptor we opened; a raced replacement is not ours to delete.
-                            const current = realFile ? lstatSync(realFile, { throwIfNoEntry: false }) : undefined;
-                            if (opened && current?.dev === opened.dev && current.ino === opened.ino)
-                                rmSync(realFile, { force: true });
-                            throw error;
+                        finally {
+                            closeSync(fd);
+                            let realFile;
+                            try {
+                                realFile = realpathSync(path);
+                                const current = statSync(realFile);
+                                if (!opened || current.dev !== opened.dev || current.ino !== opened.ino)
+                                    throw new Error('Invalid World-owned path');
+                                assertOwnedRealPath(custody, realFile);
+                            }
+                            catch (error) {
+                                // Remove only the file whose descriptor we opened; a raced replacement is not ours to delete.
+                                const current = realFile ? lstatSync(realFile, { throwIfNoEntry: false }) : undefined;
+                                if (opened && current?.dev === opened.dev && current.ino === opened.ino)
+                                    rmSync(realFile, { force: true });
+                                throw error;
+                            }
                         }
                     }
+                    env[name] = isDirectory ? ownedPath(custody, artifact) : files[0].path;
+                    continue;
                 }
-                env[name] = isDirectory ? ownedPath(custody, artifact) : files[0].path;
-                continue;
-            }
-            // `side:<side>:<field>`: a URL the twin issues for one of its side ports (a native wire beside its HTTP API, the
-            // PlanetScale twin's MySQL), its authority the side's listener as this boot placed it
-            if (spec.startsWith('side:')) {
-                const [, side, field] = spec.split(':');
-                const value = answer[field ?? ''];
+                // `side:<side>:<field>`: a URL the twin issues for one of its side ports (a native wire beside its HTTP API, the
+                // PlanetScale twin's MySQL), its authority the side's listener as this boot placed it
+                if (spec.startsWith('side:')) {
+                    const [, side, field] = spec.split(':');
+                    const value = answer[field ?? ''];
+                    if (typeof value !== 'string')
+                        throw new Error(`answered no ${field}`);
+                    const at = side ? started.sides?.[side]?.url : undefined;
+                    if (!at)
+                        throw new Error(`it serves no ${side} side port`);
+                    const issued = new URL(value);
+                    issued.host = new URL(at).host;
+                    env[name] = issued.toString();
+                    continue;
+                }
+                const field = spec;
+                const value = answer[field];
                 if (typeof value !== 'string')
                     throw new Error(`answered no ${field}`);
-                const at = side ? started.sides?.[side]?.url : undefined;
-                if (!at)
-                    throw new Error(`it serves no ${side} side port`);
-                const issued = new URL(value);
-                issued.host = new URL(at).host;
-                env[name] = issued.toString();
-                continue;
+                if (direct.has(name)) {
+                    const issued = new URL(value);
+                    if (!['http:', 'https:'].includes(issued.protocol))
+                        throw new Error(`cannot route ${name}'s non-HTTP URL directly`);
+                    const endpoint = new URL(started.url);
+                    issued.protocol = endpoint.protocol;
+                    issued.host = endpoint.host;
+                    env[name] = issued.toString();
+                }
+                else
+                    env[name] = value;
             }
-            const field = spec;
-            const value = answer[field];
-            if (typeof value !== 'string')
-                throw new Error(`answered no ${field}`);
-            if (direct.has(name)) {
-                const issued = new URL(value);
-                if (!['http:', 'https:'].includes(issued.protocol))
-                    throw new Error(`cannot route ${name}'s non-HTTP URL directly`);
-                const endpoint = new URL(started.url);
-                issued.protocol = endpoint.protocol;
-                issued.host = endpoint.host;
-                env[name] = issued.toString();
+            catch (error) {
+                process.stderr.write(`volter-world: ${service.id} did not issue ${name} (${errorMessage(error)}${typeof answer.codex_unavailable === 'string' ? `; the twin says: ${answer.codex_unavailable.slice(0, 300)}` : ''}); left unset\n`);
+                delete env[name];
+                unissued.add(name);
             }
-            else
-                env[name] = value;
         }
         if (started.url) {
             const endpoint = new URL(started.url);
@@ -1803,6 +1863,8 @@ async function issueCredentials(service, started, env, pending, unissued, contro
             unissued.add(name);
         }
     }
+    if (times)
+        times.filled = performance.now();
 }
 function materializeConfig(config, root) {
     const services = config.services.map((service) => {
@@ -1837,6 +1899,23 @@ function versionSatisfies(actual, pin) {
         return am === pm && (an ?? 0) >= (pn ?? 0);
     return actual === pin;
 }
+/** Where the host's start went, from its receipt, for the receipt's progress line (S2 R38): when its own modules were
+ *  loaded, when its twins' factories returned (the slowest named) and when it published, each after its spawn, and how
+ *  long after publication the receipt was read. A host that says none of it adds nothing. */
+function hostStartAccount(times, spawnedAt, readAt) {
+    const after = (time) => `+${Math.max(0, time - spawnedAt)} ms`;
+    const parts = [];
+    if (times.at !== undefined)
+        parts.push(`${Math.max(0, readAt - times.at)} ms after the host published it`);
+    if (times.began !== undefined)
+        parts.push(`the host's own modules loaded ${after(times.began)} after its spawn`);
+    const started = Object.entries(times.started ?? {}).sort((a, b) => a[1] - b[1]);
+    if (started.length)
+        parts.push(`its twins returned ${after(started[0][1])} to ${after(started.at(-1)[1])} (slowest ${started.at(-1)[0]})`);
+    if (times.at !== undefined && (times.began !== undefined || started.length))
+        parts.push(`published ${after(times.at)}`);
+    return parts.length ? `, ${parts.join('; ')}` : '';
+}
 /**
  * Boot every `colocate`-declaring service inside ONE `volter-world-host` child (see src/host.ts —
  * 'colocated' maps to the host's 'shared' mode, 'worker' to one Worker thread per twin). The
@@ -1856,21 +1935,33 @@ async function startColocatedServices(config, colocated, isolation, worldEnv, pa
     const readyFile = join(paths.instance, `host-ready-${boot.bootId}.json`);
     const args = [hostCli, '--isolation', isolation === 'colocated' ? 'shared' : 'worker', '--ready-file', readyFile];
     const allocated = [];
-    for (const service of colocated) {
-        const port = service.port === undefined || service.port === 'auto' ? await allocatePort(allocatedPorts) : service.port;
+    // Every twin's port and side ports are probed together, not one after another: a probe is a listen and a close
+    // on IPv4 and IPv6, ~25 ms each in a tab, and Dub's fourteen twins and their sides held sixteen of them in turn
+    // (S2 R16: 406 ms of its 1,871 ms up before the host was spawned). Concurrent probes hold distinct ports while
+    // open, and `allocatedPorts` is checked and added to synchronously after each probe, so no port is given twice;
+    // a declared port is in it before any automatic one is chosen, as before. Which twin gets which automatic port
+    // is not part of any contract.
+    // Relative module paths resolve from the world root (import() inside the host would
+    // otherwise resolve them against the runtime's own source directory).
+    const moduleOf = (service) => {
+        const declared = service.colocate.module;
+        return declared.startsWith('.') ? resolve(paths.root, declared) : declared;
+    };
+    const probed = await Promise.all(colocated.map(async (service) => ({
+        port: service.port === undefined || service.port === 'auto' ? await allocatePort(allocatedPorts) : service.port,
+        sides: await sidePortsFor(vendorOfModule(moduleOf(service), service.id), [], allocatedPorts),
+    })));
+    for (const [index, service] of colocated.entries()) {
+        const { port, sides } = probed[index];
         const serviceDataDir = ownedPath(paths.data, service.id);
         mkdirSync(serviceDataDir, { recursive: true });
-        // Relative module paths resolve from the world root (import() inside the host would
-        // otherwise resolve them against the runtime's own source directory).
-        const declared = service.colocate.module;
-        const module = declared.startsWith('.') ? resolve(paths.root, declared) : declared;
+        const module = moduleOf(service);
         // R17 — the lockfile check, BEFORE the host boots: what this module's own package.json says
         // it is, against the pin the world config carries; and R16 — the protocol standing the
         // catalog recorded for the package (pack-facts), refused two majors back, warned one back.
         const mounted = lockfileCheck(service, module);
         const scenario = service.colocate.scenarioPath;
         const binding = managedDatabaseFor(vendorOfModule(module, service.id), worldEnv.VOLTER_WORLD_CONFIG, config.env ?? {});
-        const sides = await sidePortsFor(vendorOfModule(module, service.id), [], allocatedPorts);
         args.push('--spec', [service.id, module, service.colocate.export, String(port), serviceDataDir, ...(scenario ? [`scenario=${scenario.startsWith('/') ? scenario : resolve(paths.root, scenario)}`] : []), ...(binding !== undefined ? [`database=${binding.url}`] : []), ...sides.map((side) => `side.${side.option}=${side.port}`)].join('|'));
         allocated.push({ service, port, mounted, sides });
     }
@@ -1886,6 +1977,7 @@ async function startColocatedServices(config, colocated, isolation, worldEnv, pa
             delete env[key];
     dropUnissued(env);
     env.VOLTER_WORLD_BOOT_ID = boot.bootId;
+    const spawnedAt = Date.now();
     // Under the same exit recorder as a process service, so the host's end (and every twin it holds) is in host.log.
     const { child, ended, identity } = spawnRecorded('host', process.execPath, args, paths.root, env, log, boot);
     child.once('error', error => boot.fail(error));
@@ -1922,7 +2014,7 @@ async function startColocatedServices(config, colocated, isolation, worldEnv, pa
     });
     const ready = (async () => {
         const hostTimeoutMs = allocated.reduce((timeout, { service }) => Math.max(timeout, typeof service.ready === 'object' ? service.ready.timeoutMs ?? 15_000 : 15_000), 15_000);
-        await untilReadyOrEnded((abort) => waitForHostReady(readyFile, boot.bootId, new Map(allocated.map(({ service, port }) => [service.id, port])), hostTimeoutMs, abort, () => { try {
+        const hostTimes = await untilReadyOrEnded((abort) => waitForHostReady(readyFile, boot.bootId, new Map(allocated.map(({ service, port }) => [service.id, port])), hostTimeoutMs, abort, () => { try {
             return statSync(log).size;
         }
         catch {
@@ -1936,8 +2028,35 @@ async function startColocatedServices(config, colocated, isolation, worldEnv, pa
             catch { /* best effort cleanup */ }
             throw new Error(`Co-located host failed to complete startup (isolation=${isolation}): ${errorMessage(error)}\nLog: ${log}`);
         });
-        boot.progress('co-located host: its all-started receipt is read');
+        boot.progress(`co-located host: its all-started receipt is read${hostStartAccount(hostTimes, spawnedAt, Date.now())}`);
+        // The host's receipt (this boot, every requested port) is published only
+        // after every factory bound its own port; a port another process held fails
+        // its bind and leaves no receipt. The receipt is the host's ownership proof
+        // for each port (ADR 0014). A port that answers with another boot's identity
+        // is still refused.
+        // So each port is asked its boot at once: this boot's answer is the port's reachability and its ownership in one
+        // connection. Another boot's answer is refused at once, as confirmation refuses it; a port that answers no
+        // boot is waited for and confirmed as before.
+        // A twin the host's receipt names a byte stream (host.ts servesByteStream) is not asked: it would answer the request
+        // in its own protocol, after its own greeting work (Rallly's SMTP relay answered 57 ms after the request, holding
+        // host-ready: e946aa4c run 3, on the mini, World 3.0.2197; S2 R38), and then be asked again by confirmation. Its
+        // admission is its TCP answer and its host still running, as a port with no boot identity's is: another holder of
+        // its port fails its bind, so no receipt.
+        const streams = new Set(hostTimes.streams ?? []);
         await parallelStartup(allocated, async ({ service, port }) => {
+            const byteStream = streams.has(service.id);
+            const answered = byteStream ? null : await worldBootOf(port, boot.signal);
+            if (answered && typeof answered.boot === 'string') {
+                if (answered.boot === boot.bootId)
+                    return;
+                if (undeadPids([child.pid]).length)
+                    recordWorldStop([log], 'world.service.stop', 'up (port not its own)', 'SIGTERM');
+                try {
+                    await signalHeldChild(child, 'SIGTERM', true, identity);
+                }
+                catch { /* best effort cleanup */ }
+                throw foreignBoot(`Co-located twin "${service.id}"`, answered.boot, log);
+            }
             const bindTimeoutMs = typeof service.ready === 'object' && service.ready.timeoutMs !== undefined ? Math.max(service.ready.timeoutMs, 15_000) : 15_000;
             await untilReadyOrEnded((abort) => waitForTcp(port, bindTimeoutMs, abort), ended, boot, 'the co-located host', log).catch(async (error) => {
                 if (undeadPids([child.pid]).length)
@@ -1948,14 +2067,7 @@ async function startColocatedServices(config, colocated, isolation, worldEnv, pa
                 catch { /* best effort cleanup */ }
                 throw new Error(`Co-located twin "${service.id}" failed to start (host isolation=${isolation}): ${errorMessage(error)}\nLog: ${log}`);
             });
-        });
-        // The host's receipt (this boot, every requested port) is published only
-        // after every factory bound its own port; a port another process held fails
-        // its bind and leaves no receipt. The receipt is the host's ownership proof
-        // for each port (ADR 0014). A port that answers with another boot's identity
-        // is still refused.
-        await parallelStartup(allocated, async ({ service, port }) => {
-            await confirmOwnPort(port, boot, ended, true, `Co-located twin "${service.id}"`, log).catch(async (error) => {
+            await confirmOwnPort(port, boot, ended, !byteStream, `Co-located twin "${service.id}"`, log).catch(async (error) => {
                 if (undeadPids([child.pid]).length)
                     recordWorldStop([log], 'world.service.stop', 'up (port not its own)', 'SIGTERM');
                 try {
@@ -1975,9 +2087,51 @@ async function startColocatedServices(config, colocated, isolation, worldEnv, pa
     ready.catch(() => undefined);
     return { services, ready };
 }
+/** How late this process's event loop ran while `up` worked (S2 R45): a 10 ms tick, unref'd, on the monotonic clock.
+ *  A tick 2 ms or more late adds its lateness to the total (less is timer jitter, not counted); the longest is kept; a
+ *  stall is a tick 10 ms or more late, and the three longest are kept with when, after up began, each began (to within
+ *  the 10 ms tick). LibreChat's up showed three windows of 206-263 ms with no work of the runtime's in its trace
+ *  (e946aa4c lap 060250 run 2, on the mini, in a browser tab): this says whether its loop was stalled in them or working. */
+function eventLoopLag() {
+    const TICK_MS = 10;
+    const JITTER_MS = 2;
+    const started = performance.now();
+    let expected = started + TICK_MS;
+    let total = 0;
+    let longest = 0;
+    const stalls = [];
+    const timer = setInterval(() => {
+        const now = performance.now();
+        const late = now - expected;
+        expected = now + TICK_MS;
+        if (late < JITTER_MS)
+            return;
+        total += late;
+        longest = Math.max(longest, late);
+        if (late < TICK_MS)
+            return;
+        stalls.push({ at: now - late - started, ms: late });
+        stalls.sort((a, b) => b.ms - a.ms);
+        stalls.length = Math.min(stalls.length, 3);
+    }, TICK_MS);
+    timer.unref?.();
+    return {
+        account: () => `runtime event loop ${Math.round(total)} ms late in all (ticks 2 ms or more late), longest ${Math.round(longest)} ms${stalls.length ? `; stalls ${stalls.map((stall) => `${Math.round(stall.ms)} ms at +${(stall.at / 1000).toFixed(2)} s`).join(', ')} (starts ±10 ms)` : ''}`,
+        stop: () => clearInterval(timer),
+    };
+}
 export async function upWorld(configId, options = {}, abort) {
-    abort?.throwIfAborted();
     const upStarted = Date.now();
+    const lag = eventLoopLag();
+    try {
+        return await upWorldRecorded(configId, options, abort, upStarted, lag);
+    }
+    finally {
+        lag.stop();
+    }
+}
+async function upWorldRecorded(configId, options, abort, upStarted, lag) {
+    abort?.throwIfAborted();
     const root = resolve(options.root ?? process.cwd());
     const found = loadWorldConfig(configId, root);
     // the facts of the World's installed packs, over the kernel's, for this process and (through the instance file) its own
@@ -1985,7 +2139,10 @@ export async function upWorld(configId, options = {}, abort) {
     for (const file of packFactsPaths)
         overlayPackFactsFile(file);
     // and this process's injector host rules, which `up`'s inert-injectEnv warning reads, know them too
-    createRequire(import.meta.url)('@volter/world-core/pack-facts').extendPackFacts(packFactsPaths);
+    // An empty overlay changes no facts. Leave built-in host rules at their first use
+    // instead of loading and rebuilding a second facts/host table on every empty up.
+    if (packFactsPaths.length)
+        createRequire(import.meta.url)('@volter/world-core/pack-facts').extendPackFacts(packFactsPaths);
     const loaded = { path: found.path, config: materializeConfig(found.config, root) };
     const name = options.name ?? loaded.config.id;
     const mode = options.mode ?? 'local';
@@ -2071,6 +2228,8 @@ export async function upWorld(configId, options = {}, abort) {
     // the lockfile adds the cross-process exclusion, and an in-process lock holder always releases
     // before its first await, so withFileLock's synchronous contender wait can never deadlock the
     // event loop against a holder in the same process.
+    // The claim's start: a kept state's lock file older than it is its last life's (removeCarriedLocks, S2 K4).
+    const claimStartedAt = Date.now();
     try {
         withFileLock(instanceLockFile(root, name), () => {
             assertProxyOwnershipResolved(root, name);
@@ -2160,6 +2319,9 @@ export async function upWorld(configId, options = {}, abort) {
                     for (const entry of existsSync(instance) ? readdirSync(instance) : [])
                         if (!KEEP.includes(entry))
                             rmSync(join(instance, entry), { recursive: true, force: true });
+                    // The kept state's lock files with no readable holder record are its last life's, and no one's: removed now,
+                    // under this boot's claim, before any process of it waits on one (S2 K4; world-store.ts removeCarriedLocks).
+                    removeCarriedLocks(KEEP.map(entry => join(instance, entry)).filter(path => existsSync(path)), { stateDir: stateDirName(), before: claimStartedAt });
                 }
                 else
                     removeWorldState(root, instance, () => rmSync(instance, { recursive: true, force: true }));
@@ -2315,11 +2477,52 @@ export async function upWorld(configId, options = {}, abort) {
                     await host.ready;
                     if (colocated.length)
                         boot.progress('co-located host ready: receipt read, every port admitted as its own');
-                    for (const started of host.services) {
+                    // Every twin is asked for its credentials at once, and each ask's time is said: thirteen twins took 4.7 s
+                    // of one World's up and fourteen took 0.2 s of another's, and the one line after them said only that all had.
+                    // Asked in turn they were the tail of up (S2 R17: LibreChat's three, 426 ms, after its infrastructure was
+                    // ready). Each ask fills a copy of the environment as it stood before any ask; the copies' changes are then
+                    // applied in declaration order, so the environment, its file and up's return are what asking in turn made:
+                    // a twin's names are its own (`pending` is split by service before the first await), and no ask reads
+                    // another's answer. One difference: where one ask fails, the others still run to their end and write their
+                    // custody files, where asking in turn stopped at the first failure; up fails either way.
+                    const before = { ...env };
+                    // Each ask's own steps, from one origin (S2, the twins' credentials: Twenty's thirteen took 388-500 ms each and
+                    // Dub's fourteen 72-90 ms): queued (its turn of the map), its door read, sent, the status, the body, every name
+                    // filled. Asks sent together and answered together late say the host or the tab was busy; one long between its
+                    // own sent and status says that twin's door.
+                    const origin = performance.now();
+                    const steps = [];
+                    const asks = await Promise.all(host.services.map(async (started) => {
                         const declared = colocated.find((s) => s.id === started.id);
-                        if (declared)
-                            await issueCredentials(declared, started, env, issuing, unissued, ownedPath(data, started.id));
+                        if (!declared)
+                            return undefined;
+                        const began = performance.now();
+                        const times = { ...(declared.package ? { twin: declared.package } : {}) };
+                        steps.push({ id: started.id, queued: began, times });
+                        const own = { ...before };
+                        await issueCredentials(declared, started, own, issuing, unissued, ownedPath(data, started.id), times);
+                        return { id: started.id, ms: Math.round(performance.now() - began), own };
+                    }));
+                    const at = (time) => time === undefined ? '-' : `+${Math.round(time - origin)}`;
+                    const named = steps.filter((step) => (step.times.names ?? 0) > 0);
+                    if (named.length)
+                        boot.progress(`co-located twins: each credential ask's steps, ms from the asks' start (queued/door/sent/status/body/filled): ${named
+                            .sort((left, right) => (right.times.filled ?? 0) - (left.times.filled ?? 0))
+                            .map(({ id, queued, times }) => `${id}${times.twin ? ` (${times.twin})` : ''} ${at(queued)}/${at(times.door)}/${at(times.sent)}/${at(times.headers)}/${at(times.answered)}/${at(times.filled)}`).join('; ')}`);
+                    const asked = [];
+                    for (const ask of asks) {
+                        if (!ask)
+                            continue;
+                        for (const [key, value] of Object.entries(ask.own))
+                            if (before[key] !== value)
+                                env[key] = value;
+                        for (const key of Object.keys(before))
+                            if (!Object.hasOwn(ask.own, key))
+                                delete env[key];
+                        asked.push({ id: ask.id, ms: ask.ms });
                     }
+                    if (asked.length)
+                        boot.progress(`co-located twins: each asked for its credentials at once, slowest first: ${[...asked].sort((left, right) => right.ms - left.ms).slice(0, 6).map((each) => `${each.id} ${each.ms} ms`).join(', ')}; ${asked.length} asked, ${Math.max(...asked.map((each) => each.ms))} ms the longest`);
                     writeProxyEnv(root, name, env);
                     if (colocated.length)
                         boot.progress('co-located twins: credentials issued, proxy environment written');
@@ -2345,11 +2548,13 @@ export async function upWorld(configId, options = {}, abort) {
             // possible) or the proxy daemon fails/times out, refuse rather than let unmodified CLIs bypass
             // the twins undetected.
             const attemptProxy = () => {
-                if (proxyForServices || (Object.keys(activeVendorMap(env)).length === 0 && env[WORLD_NETWORK_POLICY_ENV] === undefined))
+                if (proxyForServices)
                     return;
                 // a host with no raw sockets (a browser tab) has nothing for the proxy to intercept; the injector holds the policy
                 if (!hostHasRawEgress())
                     return;
+                if (Object.keys(activeVendorMap(env)).length === 0 && env[WORLD_NETWORK_POLICY_ENV] === undefined)
+                    return;
                 if (!opensslAvailable()) {
                     if (mode === 'sealed' || loaded.config.network !== undefined) {
                         throw new Error(`world "${name}" requires its network policy proxy, but openssl is unavailable; refusing to start. Install openssl.`);
@@ -2426,12 +2631,12 @@ export async function upWorld(configId, options = {}, abort) {
             delete worldInstance.previousEnvOutput;
             saveWorldInstance(worldInstance);
             boot.progress(`environment written: ${envFile}`);
-            materializeBrowserFiles(data, root, name, loaded.config.id);
+            await materializeWorldBrowserFiles(data, root, name, loaded.config.id);
             writePidsFromInstance(worldInstance, Object.values(worldInstance.services).map((service) => service.pid).filter((pid) => pid > 0));
             saveWorldInstance(worldInstance);
             const servicePids = [...new Set(Object.values(services).map((service) => service.pid).filter((pid) => pid > 0))];
             handoffWorldLifecycle(root, name, servicePids);
-            boot.progress('returning: the World is up');
+            boot.progress(`returning: the World is up; ${lag.account()}`);
             if (mode === 'share') {
                 try {
                     return await shareWorldServices(name, { root, ...(options.share ?? {}) });
@@ -2710,6 +2915,7 @@ export async function downWorld(name, root = process.cwd(), options = {}) {
     assertSafeWorldName(name);
     const resolvedRoot = resolve(root);
     const token = randomUUID();
+    const ownershipErrors = [];
     // Like boot's claim: a short synchronous lock protects an async lifecycle transition.
     // Do not hold a filesystem lock while external shutdown or the grace period waits.
     withFileLock(instanceLockFile(resolvedRoot, name), () => withFileLock(`${sharingClaimFile(resolvedRoot, name)}.lock`, () => {
@@ -2726,8 +2932,12 @@ export async function downWorld(name, root = process.cwd(), options = {}) {
                 throw new Error(`World ownership mismatch: ${name}`);
             }
         }
-        assertProxyOwnershipResolved(resolvedRoot, name);
-        const prior = existsSync(instanceFile(resolvedRoot, name)) ? readWorldInstance(name, resolvedRoot, true) : undefined;
+        // Unresolved startup evidence prevents finalization, not retirement of known children.
+        let prior;
+        try {
+            prior = readWorldInstance(name, resolvedRoot, true);
+        }
+        catch { /* diagnosed after owned children retire */ }
         if (prior?.resources && !prior.lifecycle)
             throw new Error(`World "${name}" belongs to a legacy runtime; use its pinned runtime for teardown before migration`);
         if (options.purge)
@@ -2746,11 +2956,20 @@ export async function downWorld(name, root = process.cwd(), options = {}) {
                 throw new Error(`World "${name}" is being shared or has an unreadable sharing claim; retry after sharing finishes`);
             rmSync(sharePath); // explicit down may reclaim a provably stale sharing claim
         }
-        retainWorldLifecycleForCleanup(resolvedRoot, name);
+        retainWorldLifecycleForCleanup(resolvedRoot, name, error => { ownershipErrors.push(`Lifecycle ownership unreadable; retained: ${errorMessage(error)}`); });
         writeTextAtomic(stoppingFile(resolvedRoot, name), JSON.stringify({ pid: process.pid, at: new Date().toISOString(), token }));
     }));
     try {
-        return await downWorldClaimed(name, resolvedRoot, options);
+        // The down's own signals and its whole time are said in the World's log (process-groups.mjs, worldEvent).
+        const downAsked = Date.now();
+        setWorldEventsFile(worldEventsPath(join(instanceDir(resolvedRoot, name), 'logs')));
+        try {
+            return await downWorldClaimed(name, resolvedRoot, options, ownershipErrors);
+        }
+        finally {
+            worldEvent({ event: 'world.down', world: name, ms: Date.now() - downAsked });
+            setWorldEventsFile(undefined);
+        }
     }
     finally {
         withFileLock(instanceLockFile(resolvedRoot, name), () => {
@@ -2760,16 +2979,26 @@ export async function downWorld(name, root = process.cwd(), options = {}) {
         });
     }
 }
-async function downWorldClaimed(name, root, options) {
+async function downWorldClaimed(name, root, options, externalErrors = []) {
+    const clearBrowserFiles = options.purge ? (await import("./browsers.js")).clearBrowserFiles : undefined;
     assertSafeWorldName(name);
     const resolvedRoot = resolve(root);
     const dir = instanceDir(resolvedRoot, name);
     const pidsFile = join(dir, 'pids');
-    const before = existsSync(instanceFile(resolvedRoot, name)) ? readFileSync(instanceFile(resolvedRoot, name), 'utf8') : undefined;
+    let before;
+    try {
+        before = getActiveWorldStore().read(instanceFile(resolvedRoot, name)) ?? undefined;
+    }
+    catch (error) {
+        externalErrors.push(`World instance unreadable; retained: ${errorMessage(error)}`);
+    }
     // A retry must not retain an earlier success receipt while teardown is in progress.
     rmSync(join(dir, 'stopped.json'), { force: true });
-    // Tear down the ambient-redirect proxy + its session CA FIRST, so the trusted CA never outlives
-    // the world (it was only ever trusted via per-shell env, never system-wide).
+    const guestError = (error) => {
+        const message = errorMessage(error);
+        if (!externalErrors.includes(message))
+            externalErrors.push(message);
+    };
     let instance;
     try {
         instance = readWorldInstance(name, resolvedRoot);
@@ -2779,51 +3008,76 @@ async function downWorldClaimed(name, root, options) {
     catch {
         instance = undefined;
     }
-    readGuestProcesses(dir, instance?.instance); // missing World metadata never erases guest ownership
-    // Nothing to tear down when the metadata is gone and every process the lifecycle recorded has exited.
-    if (!instance && before === undefined && releaseAbandonedWorldLifecycle(resolvedRoot, name)) {
-        return { name, stopped: [], escalated: [], externalStopped: [], externalErrors: [] };
+    // Read independent process records even when a guest receipt or instance is unreadable.
+    const readGuests = () => {
+        try {
+            return readGuestProcesses(dir, instance?.instance, guestError);
+        }
+        catch (error) {
+            guestError(error);
+            return [];
+        }
+    };
+    const guests = readGuests();
+    let proxyBefore = null;
+    try {
+        proxyBefore = getActiveWorldStore().read(proxyStateFile(resolvedRoot, name));
     }
-    if (!instance && (before !== undefined || hasWorldLifecycle(resolvedRoot, name))) {
-        return { name, stopped: [], escalated: [], externalStopped: [],
-            externalErrors: ['World instance or external teardown metadata missing or unreadable; cleanup refused; lifecycle evidence retained'] };
+    catch (error) {
+        externalErrors.push(`Proxy process record unreadable; retained: ${errorMessage(error)}`);
     }
     const proxyState = readProxyState(resolvedRoot, name);
-    const proxyPid = proxyState?.pid;
-    await stopWorldProxy(resolvedRoot, name, spawnedChildren);
+    const proxyPid = proxyState && Number.isInteger(proxyState.pid) && proxyState.pid > 0 ? proxyState.pid : undefined;
+    if (proxyBefore !== null && (!proxyPid || (proxyState?.birth !== undefined && (typeof proxyState.birth !== 'string' || !proxyState.birth)))) {
+        externalErrors.push('Proxy process record unreadable; ownership retained');
+    }
     const foregroundPid = instance?.lastRun?.state !== 'completed' ? instance?.lastRun?.consumerPid : undefined;
     const holderPid = instance?.lifecycle?.holderPid ?? instance?.resources?.holderPid;
-    const recordedPids = [...new Set([...readPids(pidsFile), ...(foregroundPid ? [foregroundPid] : []), ...(proxyPid ? [proxyPid] : [])])].filter(pid => pid !== holderPid);
-    const identities = readIdentities(resolvedRoot, name);
-    if (proxyState?.birth)
-        identities[proxyState.pid] = proxyState.birth;
+    let filePids = [];
+    try {
+        filePids = readPids(pidsFile, guests);
+    }
+    catch (error) {
+        externalErrors.push(`World PID record unreadable; retained: ${errorMessage(error)}`);
+    }
+    const recordedPids = [...new Set([...(proxyPid ? [proxyPid] : []), ...filePids, ...(foregroundPid ? [foregroundPid] : []), ...(holderPid ? [holderPid] : [])])].filter(pid => Number.isInteger(pid) && pid > 0);
+    const conflicts = new Set();
+    const conflictingIdentity = (pid) => {
+        if (conflicts.has(pid))
+            return;
+        conflicts.add(pid);
+        externalErrors.push(`Conflicting spawn identities for pid ${pid}; not signalled; ownership retained`);
+    };
+    const identities = readIdentities(resolvedRoot, name, guests, conflictingIdentity);
+    if (proxyPid && typeof proxyState?.birth === 'string' && proxyState.birth) {
+        if (identities[proxyPid] && identities[proxyPid] !== proxyState.birth)
+            conflictingIdentity(proxyPid);
+        else
+            identities[proxyPid] = proxyState.birth;
+    }
     const foreign = (await Promise.all(recordedPids.map(async (pid) => {
         const now = identities[pid] ? await processBirth(pid) : undefined;
         return now && now !== identities[pid] ? { pid, recorded: identities[pid], now } : undefined;
     }))).filter((entry) => !!entry);
-    const pids = recordedPids.filter((pid) => !foreign.some((entry) => entry.pid === pid));
+    const pids = recordedPids.filter((pid) => pid !== holderPid && !conflicts.has(pid) && !foreign.some((entry) => entry.pid === pid));
     const processServices = Object.values(instance?.services ?? {}).filter((service) => service.type !== 'external' && service.log);
     // Only a service still alive is stopped by this `down`; a dead one's end was not the World's.
     const stillAlive = undeadPids(processServices.map((service) => service.pid).filter((pid) => pids.includes(pid)));
     recordWorldStop(processServices.filter((service) => stillAlive.includes(service.pid)).map((service) => service.log), 'world.service.stop', 'down', 'SIGTERM');
     const stopped = await signalPids(pids, 'SIGTERM', identities, spawnedChildren);
-    // Stop self-managed externals via their declared `down` command. A missing instance is
-    // safe only without retained lifecycle ownership, checked before any signals above.
+    // Missing external metadata remains a finalization error after known children retire.
     let externalStopped = [];
-    let externalErrors = [];
     let unavailable = [];
-    try {
-        if (!instance)
-            throw new Error('World instance unavailable');
-        const result = await teardownExternalServices(instance);
-        externalStopped = result.stopped;
-        externalErrors = result.errors;
-        unavailable = result.unavailable;
-    }
-    catch {
-        // no instance.json (never fully came up) — only owned processes needed stopping.
-        if (before !== undefined)
-            externalErrors.push('World instance or external teardown metadata unreadable; cleanup refused');
+    if (instance) {
+        try {
+            const result = await teardownExternalServices(instance);
+            externalStopped = result.stopped;
+            externalErrors.push(...result.errors);
+            unavailable = result.unavailable;
+        }
+        catch (error) {
+            externalErrors.push(errorMessage(error));
+        }
     }
     // Escalate AFTER the external teardown so externals never wait on the grace, and
     // poll the full pids list rather than `stopped`: a pid whose SIGTERM errored is almost always
@@ -2832,7 +3086,10 @@ async function downWorldClaimed(name, root, options) {
     recordWorldStop(processServices.filter((service) => escalated.includes(service.pid)).map((service) => service.log), 'world.service.killed', 'down', 'SIGKILL');
     // A launch which had already entered its spawn seam may publish while TERM is delivered.
     // Once services/agents retire, join every late receipt before certifying this generation stopped.
-    const lateGuests = readGuestProcesses(dir, instance?.instance).filter(receipt => !pids.includes(receipt.record.pid));
+    const settlingGuests = readGuests();
+    readIdentities(resolvedRoot, name, settlingGuests, conflictingIdentity);
+    const lateGuests = settlingGuests.filter(({ record }) => !conflicts.has(record.pid)
+        && (!recordedPids.includes(record.pid) || identities[record.pid] !== record.start));
     try {
         await retireOwnedProcessGroups(lateGuests.map(receipt => receipt.record), options.graceMs ?? DOWN_GRACE_MS_DEFAULT);
     }
@@ -2840,7 +3097,7 @@ async function downWorldClaimed(name, root, options) {
         externalErrors.push(errorMessage(error));
     }
     pids.push(...lateGuests.map(receipt => receipt.record.pid));
-    if (holderPid && !externalErrors.length && !undeadPids(pids).length) {
+    if (holderPid && recordedPids.includes(holderPid) && !conflicts.has(holderPid) && !foreign.some(entry => entry.pid === holderPid)) {
         pids.push(holderPid);
         stopped.push(...await signalPids([holderPid], 'SIGTERM', identities, spawnedChildren));
         escalated.push(...await killSurvivorsAfterGrace([holderPid], options.graceMs ?? DOWN_GRACE_MS_DEFAULT, identities, spawnedChildren));
@@ -2851,21 +3108,43 @@ async function downWorldClaimed(name, root, options) {
         const notSignalled = foreign.map((entry) => `pid ${entry.pid} now names another process (started ${entry.now}; the World's started ${entry.recorded}); not signalled`);
         const result = { name, stopped, escalated, externalStopped, externalErrors, ...(notSignalled.length ? { notSignalled } : {}) };
         const path = instanceFile(resolvedRoot, name);
-        const current = existsSync(path) ? readFileSync(path, 'utf8') : undefined;
+        let current;
+        try {
+            current = getActiveWorldStore().read(path) ?? undefined;
+        }
+        catch (error) {
+            externalErrors.push(`World generation unreadable; finalization refused: ${errorMessage(error)}`);
+            return result;
+        }
         if (current !== before || existsSync(bootingFile(resolvedRoot, name))) {
             externalErrors.push('World generation changed or is booting; finalization refused');
             return result;
         }
-        if (existsSync(proxyStateFile(resolvedRoot, name)) || existsSync(sharingClaimFile(resolvedRoot, name))) {
+        let currentProxy;
+        try {
+            currentProxy = getActiveWorldStore().read(proxyStateFile(resolvedRoot, name));
+        }
+        catch (error) {
+            externalErrors.push(`Proxy record unreadable; finalization refused: ${errorMessage(error)}`);
+            return result;
+        }
+        if ((currentProxy !== null && currentProxy !== proxyBefore) || existsSync(sharingClaimFile(resolvedRoot, name))) {
             externalErrors.push('Proxy or sharing lifecycle changed during teardown; cleanup refused');
             return result;
         }
-        const guestReceipts = readGuestProcesses(dir, instance?.instance);
+        if (existsSync(proxyStartingFile(resolvedRoot, name))) {
+            externalErrors.push(`World "${name}" has unresolved proxy startup ownership; recorded children retired where identity verified; lifecycle and instance retained. Inspect: ${proxyStartingFile(resolvedRoot, name)}`);
+        }
+        const guestReceipts = readGuests();
         const surviving = undeadPids([...pids, ...guestReceipts.map(receipt => receipt.record.pid)]);
         if (surviving.length)
             externalErrors.push(`World processes still alive or uninspectable after teardown: ${surviving.join(', ')}; cleanup refused`);
         if (guestReceipts.some(receipt => foreign.some(entry => entry.pid === receipt.record.pid)))
             externalErrors.push('Guest spawn identity changed; receipt retained and cleanup refused');
+        if (!instance && (before !== undefined || hasWorldLifecycle(resolvedRoot, name))
+            && !(before === undefined && !externalErrors.length && releaseAbandonedWorldLifecycle(resolvedRoot, name))) {
+            externalErrors.push('World instance or external teardown metadata missing or unreadable; cleanup refused; lifecycle evidence retained');
+        }
         let externalAbandoned;
         if (options.purge && instance && externalErrors.length && externalErrors.length === unavailable.length && !foreign.length) {
             const inventory = exitedWorldLifecyclePids(resolvedRoot, name, instance.createdAt);
@@ -2880,6 +3159,8 @@ async function downWorldClaimed(name, root, options) {
         }
         if (externalErrors.length)
             return result;
+        // Keep proxy state and session trust until its recorded processes have exited.
+        clearWorldProxyFiles(resolvedRoot, name);
         releaseGuestProcesses(guestReceipts);
         rmSync(pidsFile, { force: true });
         if (before) {
@@ -2899,7 +3180,9 @@ async function downWorldClaimed(name, root, options) {
 }
 export function statusWorld(name, root = process.cwd(), options = {}) {
     const worldInstance = readWorldInstance(name, resolve(root), options.readOnly);
-    const live = ownedPids(resolve(root), name, livePids(readPids(worldInstance.pidsFile)));
+    // One status, one reading of the process table: its questions below are about the same moment.
+    const listing = {};
+    const live = ownedPids(resolve(root), name, livePids(readPids(worldInstance.pidsFile), listing));
     const externalOnly = Object.values(worldInstance.services).every(service => service.type === 'external');
     const recorded = externalOnly && !existsSync(stoppingFile(root, name)) && !existsSync(join(instanceDir(root, name), 'stopped.json'))
         && isWorldLifecycleRunning(root, name, worldInstance.createdAt);
@@ -2907,9 +3190,9 @@ export function statusWorld(name, root = process.cwd(), options = {}) {
     // read; a service's own state is judged by its process group, so a dead service reads as dead beside a live daemon.
     const owned = Object.values(worldInstance.services).filter((service) => service.type !== 'external' && service.pid);
     const ownPids = ownedPids(resolve(root), name, owned.map((service) => service.pid));
-    const leaders = livePids(ownPids);
+    const leaders = livePids(ownPids, listing);
     // `light` (a listing of every World) skips the process-table scan: a lingering group then reads as stopped.
-    const groups = ownPids.length && !options.light ? survivingOwnedGroups(ownPids) : [];
+    const groups = ownPids.length && !options.light ? survivingOwnedGroups(ownPids, listing) : [];
     const serviceStates = {};
     for (const service of Object.values(worldInstance.services)) {
         serviceStates[service.id] = service.type === 'external' ? 'external'
@@ -3771,7 +4054,7 @@ export async function runWorld(configId, command, options = {}) {
     if (command.length === 0)
         throw new Error('Missing command after --');
     if (!options.keep)
-        return superviseWorldRun(configId, command, options);
+        return (await import("./run-task.js")).superviseWorldRun(configId, command, options);
     return runWorldOwned(configId, command, options);
 }
 /** Internal task entry. The lifetime owner exists before admission/startup. Cancellation during
@@ -3878,13 +4161,13 @@ export function listWorlds(root = process.cwd()) {
     })
         .sort((a, b) => a.name.localeCompare(b.name));
 }
-function worldAttachedCommandEnv(name, root, verbose = false) {
-    const status = statusWorld(name, root);
+function worldAttachedCommandEnv(name, root, verbose = false, instance) {
+    const status = instance ?? statusWorld(name, root);
     const sealed = status.env.VOLTER_WORLD_MODE === 'sealed' || status.env[WORLD_NETWORK_POLICY_ENV] !== undefined;
     const baseEnv = { ...admittedEnv(stripEnvOf(status.env)), ...status.env };
     let proxyEnv = {};
     try {
-        const proxy = ensureWorldProxy(name, root, [admittedEnv(stripEnvOf(status.env)), status.env]);
+        const proxy = ensureWorldProxyForCommand(name, root, [admittedEnv(stripEnvOf(status.env)), status.env], instance);
         if (proxy?.url) {
             proxyEnv = proxy.env;
             // a host with no raw sockets (a browser tab) runs no proxy: the injector holds the policy there, as at `up`
@@ -3996,7 +4279,7 @@ export async function attachWorld(name, command, root = process.cwd(), options =
     assertSafeWorldName(name);
     const resolvedRoot = resolve(root);
     checkedOwner(options.owner);
-    const attached = worldAttachedCommandEnv(name, resolvedRoot, options.verbose);
+    const attached = worldAttachedCommandEnv(name, resolvedRoot, options.verbose, options.instance);
     const record = withFileLock(instanceLockFile(resolvedRoot, name), () => {
         if (existsSync(stoppingFile(resolvedRoot, name)) || existsSync(bootingFile(resolvedRoot, name))) {
             throw new Error(`World "${name}" is changing lifecycle; retry after it finishes`);
@@ -4004,7 +4287,7 @@ export async function attachWorld(name, command, root = process.cwd(), options =
         const current = statusWorld(name, resolvedRoot);
         // Which of the two it was, with what was read: "stopped" and "another instance" are different repairs.
         if (!current.running)
-            throw new Error(`World "${name}" is not running while attaching: none of its recorded processes is live and its own (recorded pids ${readPids(current.pidsFile).join(', ') || 'none'}; live and its own: none)`);
+            throw new Error(`World "${name}" is not running while attaching: none of its recorded processes is live and its own (recorded pids ${readPids(current.pidsFile).join(', ') || 'none'}; live and its own: none); ${describeWorldLifecycle(resolvedRoot, name, current.createdAt)})`);
         if (current.createdAt !== attached.instance.createdAt)
             throw new Error(`World "${name}" changed while attaching: its instance was created ${attached.instance.createdAt} when the command's environment was read and ${current.createdAt} now`);
         // Attaching to a World whose services died is allowed (a command may not need them), but never silent.
@@ -4016,7 +4299,7 @@ export async function attachWorld(name, command, root = process.cwd(), options =
             process.stderr.write(`World "${name}": service ${id} is not running${end ? `: it ${describeServiceEnd(end)}` : ''}${service?.log ? `\n  log: ${service.log}` : ''}\n`);
         }
         return createConsumer(resolvedRoot, name, current.createdAt, 'attach', options.owner ?? current.lifecycle?.owner ?? current.resources?.owner, { completionRequired: true });
-    });
+    }, { operation: 'instance attach' });
     let timer;
     let retired = true;
     try {
@@ -4214,6 +4497,7 @@ export async function shellWorld(name, root = process.cwd()) {
     }
     else if (opensslAvailable()) {
         try {
+            const { startRedirectProxy } = await import("./redirect-proxy.js");
             proxy = await startRedirectProxy({ env, trustEnv: [admittedEnv(stripEnvOf(env)), env], tlsDir: tlsDir(resolvedRoot, name) });
             Object.assign(env, proxy.proxyEnv());
             process.stderr.write(`world '${name}' active in a subshell — vendor calls hit the twins (ambient proxy ${proxy.url}). type 'exit' to leave.\n`);
@@ -4257,6 +4541,9 @@ function proxyDaemonDeadlineMs() {
  * reuses a live daemon. Returns its proxy env, or null if openssl is missing (env-only fallback). The
  * daemon is recorded in `proxy.json` and stopped by `down`. */
 export function ensureWorldProxy(name, root = process.cwd(), caller = process.env) {
+    return ensureWorldProxyForCommand(name, root, caller);
+}
+function ensureWorldProxyForCommand(name, root, caller, instance) {
     assertSafeWorldName(name);
     const resolvedRoot = resolve(root);
     return withFileLock(instanceLockFile(resolvedRoot, name), () => {
@@ -4265,7 +4552,7 @@ export function ensureWorldProxy(name, root = process.cwd(), caller = process.en
             throw new Error(`World "${name}" is being stopped`);
         if (liveBootingClaim(bootingFile(resolvedRoot, name)))
             throw new Error(`World "${name}" is being booted`);
-        if (!statusWorld(name, resolvedRoot, { readOnly: true }).running)
+        if (!instance && !statusWorld(name, resolvedRoot, { readOnly: true }).running)
             throw new Error(`World "${name}" is not running`);
         return ensureWorldProxyUnlocked(name, resolvedRoot, caller);
     });
@@ -4483,6 +4770,7 @@ export async function runProxyDaemon(name, root = process.cwd(), envFile) {
             throw new Error(`World "${name}" is not running`);
         env = { ...admittedEnv(stripEnvOf(status.env)), ...status.env };
     }
+    const { startRedirectProxy } = await import("./redirect-proxy.js");
     const proxy = await startRedirectProxy({ env, envLoader, tlsDir: tlsDir(resolvedRoot, name), note: (line) => process.stderr.write(`${line}\n`) });
     const identity = await spawnIdentity(process.pid);
     if (!identity.start) {
@@ -4516,8 +4804,8 @@ export async function runProxyDaemon(name, root = process.cwd(), envFile) {
     process.on('SIGTERM', stop);
     process.on('SIGINT', stop);
 }
-/** Stop a world's ambient-redirect proxy daemon (if any) and drop its session CA. Best-effort —
- * called from `downWorld` so the trusted CA never outlives the world. */
+/** Failed boot's proxy retirement; normal down retires it with the other recorded children
+ * and clears session trust only after confirming exit. */
 async function stopWorldProxy(root, name, handles) {
     const state = readProxyState(root, name);
     if (state && isAlive(state.pid)) {
@@ -4532,14 +4820,11 @@ async function stopWorldProxy(root, name, handles) {
             await signalOwnedProcess(identity, 'SIGTERM');
         }
     }
-    try {
-        rmSync(proxyStateFile(root, name), { force: true });
-    }
-    catch { /* ignore */ }
-    try {
-        rmSync(proxyEnvFile(root, name), { force: true });
-    }
-    catch { /* ignore */ }
+    clearWorldProxyFiles(root, name);
+}
+function clearWorldProxyFiles(root, name) {
+    rmSync(proxyStateFile(root, name), { force: true });
+    rmSync(proxyEnvFile(root, name), { force: true });
     tearDownCa(tlsDir(root, name));
 }
 /**