@volter/world-runtime 3.0.162 → 3.0.164

package/src/runtime.ts

@@ -1,18 +1,17 @@
 import { errorMessage } from './error-message.ts';
-import { materializeBrowserFiles, clearBrowserFiles } from './browsers.ts';
+import { materializeWorldBrowserFiles } from './browser-files.ts';
 import { claimEnvOutput, publishEnvOutput } from './env-output.ts';
 import { offSignal } from './signals.ts';
 import { parallelStartup } from './startup.ts';
-import { waitForHostReady } from './host-ready.ts';
+import { type HostReadyTimes, waitForHostReady } from './host-ready.ts';
 import { assertWorldStateRemovable, removeWorldState } from './ancestry.ts';
 import { packCli, packEntry } from './catalog.ts';
-import { vendorOfPackModule } from '@volter/world-core/runtime';
+import { vendorOfPackModule } from '@volter/world-core/runtime-state';
 import { spawn, spawnSync } from 'node:child_process';
 import { get as httpGet, type ClientRequest } from 'node:http';
 import { siblingScript } from './sibling.ts';
 import { commandLifetime, commandProcessGroup, CommandRetirementError } from './command-lifetime.ts';
-import { superviseWorldRun } from './run-task.ts';
-import { processStarts, survivingOwnedGroups } from './process-groups.ts';
+import { processStarts, survivingOwnedGroups, setWorldEventsFile, worldEvent, type ProcessListing } from './process-groups.ts';
 import { spawnIdentity, signalOwnedProcess, signalChild, signalHeldChild, processBirth, childIdentity } from './process-signal.mjs';
 import type { SpawnIdentity } from './process-receipt.ts';
 import { readGuestProcesses, releaseGuestProcesses } from './guest-processes.mjs';
@@ -27,10 +26,10 @@ import { basename, delimiter, dirname, join, relative, resolve, sep } from 'node
 import { packFacts } from './pack-facts.ts';
 import { assertOwnedRealPath, ownedPath } from './owned-path.ts';
 import { isEnvironmentName } from './schema.ts';
-import { infraConnections, parseInfraDefinition } from './pglite-backing.ts';
+import { infraConnections, parseInfraDefinition } from './infra-definition.ts';
 import { describeServiceEnd, readServiceEnd } from './service-exit.ts';
 import { Socket } from 'node:net';
-import { beginPlaceholderPull, endPlaceholderPull, placeholderPullActive, getActiveWorldStore, withFileLock, stateDirName, PROTOCOL_VERSION, PROTOCOL_MAJOR, protocolStanding, WORLD_BOOT_PATH, WORLD_DATA_ENV, WORLD_ENV_NAMES_ENV } from '@volter/world-core/runtime';
+import { beginPlaceholderPull, endPlaceholderPull, placeholderPullActive, getActiveWorldStore, removeCarriedLocks, withFileLock, stateDirName, PROTOCOL_VERSION, PROTOCOL_MAJOR, protocolStanding, WORLD_BOOT_PATH, WORLD_DATA_ENV, WORLD_ENV_NAMES_ENV } from '@volter/world-core/runtime-state';
 import { loadWorldConfig } from './configs.ts';
 import { createWorldNetworkPolicy, parseWorldNetworkPolicy, normalizeWorldNetwork, intersectWorldNetwork, type WorldNetwork, WORLD_NETWORK_POLICY_ENV } from '@volter/world-core/network-policy';
 import { overlayPackFactsFile, resolveServicePackage } from './catalog.ts';
@@ -38,11 +37,12 @@ import { fakeEnvValue } from './fixture-env.ts';
 import { APP_URL_ENV, ISSUE_ENV_PREFIX, MINT_ENV } from './schema.ts';
 import { readAppUrl } from './app-url.ts';
 import { inertInjectEnvWarnings } from './inject-map.ts';
-import { activeVendorMap, ensureCa, hostHasRawEgress, opensslAvailable, proxyEnvFor, startRedirectProxy, tearDownCa } from './redirect-proxy.ts';
+import { activeVendorMap, ensureCa, hostHasRawEgress, opensslAvailable, proxyEnvFor, tearDownCa } from './proxy-env.ts';
+import type { startRedirectProxy } from './redirect-proxy.ts';
 import { CaTrustError, sessionTrustEnv, type CaTrustInputs } from './ca-trust.ts';
 import type { WorldConfig, WorldExternalReadyWhen, WorldInstance, WorldIsolation, WorldMode, WorldRunOutcome, WorldRunRecord, WorldServiceConfig, WorldServiceInstance } from './schema.ts';
 import { checkedOwner, CONSUMER_HEARTBEAT_MS, createConsumer, refreshConsumer, releaseConsumer, removeConsumerRecord, worldConsumers, consumerProcessState } from './consumers.ts';
-import { assertLifecycleStartable, beginWorldLifecycle, handoffWorldLifecycle, recordWorldLifecycleEvent, releaseWorldLifecycle, retainWorldLifecycleForCleanup, hasWorldLifecycle, isWorldLifecycleRunning, lifecycleLogPath, releaseAbandonedWorldLifecycle, exitedWorldLifecyclePids } from './lifecycle-record.ts';
+import { assertLifecycleStartable, beginWorldLifecycle, handoffWorldLifecycle, recordWorldLifecycleEvent, releaseWorldLifecycle, retainWorldLifecycleForCleanup, hasWorldLifecycle, isWorldLifecycleRunning, describeWorldLifecycle, lifecycleLogPath, releaseAbandonedWorldLifecycle, exitedWorldLifecyclePids } from './lifecycle-record.ts';
 
 // Births captured at actual spawn; retries never remeasure a retained PID.
 const spawnedIdentities = new Map<number, SpawnIdentity>();
@@ -123,13 +123,18 @@ async function confirmOwnPort(port: number, boot: BootContext, ended: Promise<vo
   boot.signal.throwIfAborted();
   if (answered && typeof answered.boot === 'string') {
     if (answered.boot === boot.bootId) return;
-    throw new Error(`${what}: its port is answered by a twin of another World boot (${answered.boot}), not this one; a leftover World holds the port. Stop it (\`volter-world list\`, then \`down\`) and retry.\nLog: ${log}`);
+    throw foreignBoot(what, answered.boot, log);
   }
   // Whether the service has already ended, read now: one turn of the event loop, not a wait for it to fail.
   const endedNow = ended ? await Promise.race([ended.then(() => true), new Promise<boolean>((resolveNow) => setImmediate(() => resolveNow(false)))]) : false;
   if (endedNow) throw new Error(`${what} ended right after its port first answered, so another process probably holds the port: the service ${endedAccount(log)}\nLog: ${log}`);
 }
 
+/** A port answered by a twin of another World boot: a leftover World holds it. */
+function foreignBoot(what: string, answered: string, log: string): Error {
+  return new Error(`${what}: its port is answered by a twin of another World boot (${answered}), not this one; a leftover World holds the port. Stop it (\`volter-world list\`, then \`down\`) and retry.\nLog: ${log}`);
+}
+
 /** What the server on a loopback port says its World boot is (WORLD_BOOT_PATH), or null. A direct loopback request:
  *  never through a proxy an activated shell's environment names. */
 function worldBootOf(port: number, abort: AbortSignal): Promise<{ boot?: unknown } | null> {
@@ -812,18 +817,18 @@ async function waitForTcp(port: number, timeoutMs = 15_000, abort?: AbortSignal)
   throw new Error(`Service on port ${port} did not become reachable`);
 }
 
-function readPids(path: string): number[] {
+function readPids(path: string, receipts = readGuestProcesses(dirname(path))): number[] {
   const held = getActiveWorldStore().read(path);
-  const guests = readGuestProcesses(dirname(path)).map(receipt => receipt.record.pid);
+  const guests = receipts.map(receipt => receipt.record.pid);
   return [...new Set([...(held ?? '')
     .split(/\r?\n/)
     .map((line) => Number(line.trim()))
     .filter((pid) => Number.isInteger(pid) && pid > 0), ...guests])];
 }
 
-function livePids(pids: number[]): number[] {
+function livePids(pids: number[], listing?: ProcessListing): number[] {
   // A recorded leader may have exited while its detached descendants still run.
-  return survivingOwnedGroups(pids);
+  return survivingOwnedGroups(pids, listing);
 }
 
 function tunnelPids(instance: WorldInstance): number[] {
@@ -865,18 +870,23 @@ function writeOwnedPids(root: string, name: string, pids: number[], fresh: numbe
 function identityPath(root: string, name: string): string {
   return join(instanceDir(root, name), 'pids.identity');
 }
-function readIdentities(root: string, name: string): Record<string, string> {
+function readIdentities(root: string, name: string, receipts = readGuestProcesses(instanceDir(root, name)), onConflict?: (pid: number) => void): Record<string, string> {
   let known: Record<string, string> = {};
   try {
     const value = JSON.parse(getActiveWorldStore().read(identityPath(root, name)) ?? '{}');
     if (value && typeof value === 'object' && !Array.isArray(value)) known = Object.fromEntries(Object.entries(value).filter(([pid, start]) => Number.isInteger(Number(pid)) && Number(pid) > 0 && typeof start === 'string' && start.length > 0)) as Record<string, string>;
   } catch { /* Guest receipts below remain independently authoritative. */ }
   const births = new Map<number, string | undefined>();
-  for (const { record } of readGuestProcesses(instanceDir(root, name))) {
-    if (births.has(record.pid) && births.get(record.pid) !== record.start) throw new Error('Conflicting guest spawn identities; ownership retained');
+  const conflicts = new Set<number>();
+  for (const { record } of receipts) {
+    if (births.has(record.pid) && births.get(record.pid) !== record.start) {
+      if (!onConflict) throw new Error('Conflicting guest spawn identities; ownership retained');
+      conflicts.add(record.pid);
+      onConflict(record.pid);
+    }
     births.set(record.pid, record.start);
   }
-  for (const [pid, start] of births) { if (start) known[pid] = start; else delete known[pid]; }
+  for (const [pid, start] of births) { if (start && !conflicts.has(pid)) known[pid] = start; else delete known[pid]; }
   return known;
 }
 function recordIdentities(root: string, name: string, pids: number[], fresh: number[] = [], births = heldStarts()): void {
@@ -1072,8 +1082,9 @@ async function runExternalUp(
   logPath: string,
   abort?: AbortSignal,
   progress?: (what: string) => void,
+  verified?: { status?: string },
 ): Promise<string> {
-  if (ownInfrastructureUp(command)) return runOwnInfrastructureUp(command, serviceId, env, logPath, abort, progress);
+  if (ownInfrastructureUp(command)) return runOwnInfrastructureUp(command, serviceId, env, logPath, abort, progress, verified);
   const [bin, ...args] = ownCommand(command);
   if (!bin) throw new Error(`External service "${serviceId}": up command is empty`);
   if (!commandExists(bin)) {
@@ -1153,20 +1164,23 @@ async function runOwnInfrastructureStatus(serviceId: string, phase: string, env:
   } finally { clearTimeout(timer); abort?.removeEventListener('abort', onAbort); }
 }
 
-async function runOwnInfrastructureUp(command: string[], serviceId: string, env: NodeJS.ProcessEnv, logPath: string, abort?: AbortSignal, progress?: (what: string) => void): Promise<string> {
+async function runOwnInfrastructureUp(command: string[], serviceId: string, env: NodeJS.ProcessEnv, logPath: string, abort?: AbortSignal, progress?: (what: string) => void, verified?: { status?: string }): Promise<string> {
   writeFileSync(logPath, `$ ${command.join(' ')}\n`, { mode: 0o600 });
   chmodSync(logPath, 0o600);
   const out = openPrivateLog(logPath, 'a');
   const chunks: string[] = [];
   try {
     abort?.throwIfAborted();
+    const importing = Date.now();
     const { runInfrastructure } = await import('./infra.ts');
     // Its phase lines (backing chosen, host spawned, serving) are the boot's progress too.
     const write = (text: string) => {
       chunks.push(text); writeSync(out, text);
       for (const line of text.split('\n')) if (line.startsWith('managed infrastructure')) progress?.(`${serviceId}: ${line}`);
     };
-    const code = await runInfrastructure(command[1]!, env, { out: write, err: write }, abort);
+    // Its module's load, said with the line's own time (S2, Twenty's World up): what of the start before the backing's line was this.
+    write(`managed infrastructure: its module loaded in ${Date.now() - importing} ms\n`);
+    const code = await runInfrastructure(command[1]!, env, { out: write, err: write, ...(verified ? { verified: (status: string) => { verified.status = status; } } : {}) }, abort);
     abort?.throwIfAborted();
     if (code !== 0) {
       const detail = chunks.join('').trim().split('\n').slice(-40).join('\n');
@@ -1196,6 +1210,7 @@ async function awaitReadiness(
   serviceId: string,
   env: NodeJS.ProcessEnv = process.env,
   abort?: AbortSignal,
+  passing?: { stdout?: string; stderr?: string },
 ): Promise<string> {
   if (!ready) return 'no readiness declared';
   const timeoutMs = ready.timeoutMs ?? 60_000;
@@ -1210,7 +1225,11 @@ async function awaitReadiness(
       if (!commandExists(ready.command)) {
         throw new Error(`Service "${serviceId}": readiness command \`${ready.command}\` not found on PATH`);
       }
-      try { await runExternalCommand([ready.command, ...(ready.args ?? [])], cwd, serviceId, 'readiness', env, abort, Math.max(1, timeoutMs - (Date.now() - started))); return passed(`\`${[ready.command, ...(ready.args ?? [])].join(' ')}\` exited 0`); }
+      try {
+        const output = await runExternalCommand([ready.command, ...(ready.args ?? [])], cwd, serviceId, 'readiness', env, abort, Math.max(1, timeoutMs - (Date.now() - started)));
+        if (passing) Object.assign(passing, output);
+        return passed(`\`${[ready.command, ...(ready.args ?? [])].join(' ')}\` exited 0`);
+      }
       catch (error) { if (error instanceof CommandRetirementError) throw error; lastError = errorMessage(error); }
     } else if (ready.httpUrl !== undefined) {
       try {
@@ -1270,17 +1289,38 @@ async function startExternalService(
   // Publish the declared teardown before an external command can create state.
   boot?.external({ id: service.id, type: 'external', command: [...external.up], pid: 0, log, env: {},
     external: { down: [...external.down], cwd, discoveredEnv: { ...(service.env ?? {}) } } });
-  const upOutput = await runExternalUp(external.up, cwd, service.id, env, log, boot?.signal, boot?.progress);
+  const verified: { status?: string } = {};
+  const upOutput = await runExternalUp(external.up, cwd, service.id, env, log, boot?.signal, boot?.progress, verified);
   boot?.progress(`${service.id}: up returned`);
 
   // 2. readiness — Docker-backed externals take seconds to boot.
-  const readiness = await awaitReadiness(external.readyWhen, cwd, service.id, env, boot?.signal);
+  const passing: { stdout?: string; stderr?: string } = {};
+  // The runtime's own infrastructure, every service twin-served or its PostgreSQL native (no MongoDB native), proves in
+  // its `up` what its `status` would, status's proofs asked again at hand-over though not its choice of backing (infra.ts
+  // handOver: twin-backing.ts twinBackingHeld, each port
+  // served by the child it started; native-postgres-backing.ts nativePostgresStatus, the postmaster's ownership, live
+  // group, identity and answering port; Cal's status run took 70 ms, c670b965 run 2, on the mini, in a browser tab; S2
+  // R46). Its up hands over the status it would print, so the probe,
+  // when it is that same `status`, is not run again (LibreChat: the status run took 206 ms before it connected, e946aa4c
+  // lap 060250 run 2, on the mini, in a browser tab; S2 R45). Any other probe, or a backing up does not prove, is
+  // probed as before.
+  const probed = external.readyWhen?.command === undefined ? undefined : [external.readyWhen.command, ...(external.readyWhen.args ?? [])];
+  const upProved = verified.status !== undefined && probed !== undefined && ownInfrastructureStatus(probed);
+  if (upProved) { passing.stdout = verified.status; passing.stderr = ''; }
+  const readiness = upProved ? 'proved by its own up, as its status would' : await awaitReadiness(external.readyWhen, cwd, service.id, env, boot?.signal, passing);
   boot?.progress(`${service.id}: ready (${readiness})`);
 
   // 3. status — discover connection info (optional; may reuse up output instead).
   let statusOutput = '';
   if (external.status) {
-    const statusResult = await runExternalCommand(external.status, cwd, service.id, 'status', env, boot?.signal);
+    // The runtime's own infrastructure probes its readiness with the very status command it then reads (init declares
+    // both as `volter-world-infra status`): the probe that just passed is that read, taken a moment ago in this
+    // process, so it is not run again (S2 R17: LibreChat's second run of it, 190 ms of up after its infrastructure
+    // was ready). Any other status command, or a probe that is not the same command, is run as before.
+    const probe = external.readyWhen?.command === undefined ? undefined : [external.readyWhen.command, ...(external.readyWhen.args ?? [])];
+    const same = probe !== undefined && passing.stdout !== undefined && ownInfrastructureStatus(external.status)
+      && probe.length === external.status.length && probe.every((part, index) => part === external.status![index]);
+    const statusResult = same ? { stdout: passing.stdout!, stderr: passing.stderr ?? '' } : await runExternalCommand(external.status, cwd, service.id, 'status', env, boot?.signal);
     statusOutput = statusResult.stdout || statusResult.stderr;
     appendFileSync(log, `\n$ ${external.status.join(' ')}\n${statusOutput}`);
     boot?.progress(`${service.id}: status read`);
@@ -1605,17 +1645,25 @@ function takeIssued(env: Record<string, string>): Map<string, string> {
  *  own store, in milliseconds; this bounds a hung twin, not a slow one). */
 const ISSUE_TIMEOUT_MS = 15_000;
 
+/** Where one credential ask's time went (S2, the twins' credentials): performance.now() at each step, read by the caller
+ *  against its own origin. `door` is the pack's door read, `sent` the request handed to fetch, `headers` its answer's
+ *  status, `answered` its body parsed, `filled` every name set or said unset. Door→sent and answered→filled include synchronous placeholder-pull
+ *  and custody file work; only sent→status isolates the twin door. */
+type CredentialAskTimes = { twin?: string; names?: number; door?: number; sent?: number; headers?: number; answered?: number; filled?: number };
+
 /** A twin's issued credential (its `issues`, copied from its pack's credentialDoor by init): once it is up, the door is
  *  asked for one and each pending name of that service is set to it. A twin that answers no credential, or has no
  *  door, leaves the names unset and says so, rather than handing the application a fixture the twin would refuse. */
-async function issueCredentials(service: WorldServiceConfig, started: WorldServiceInstance, env: Record<string, string>, pending: Map<string, string>, unissued: Set<string>, controlRoot: string): Promise<void> {
+async function issueCredentials(service: WorldServiceConfig, started: WorldServiceInstance, env: Record<string, string>, pending: Map<string, string>, unissued: Set<string>, controlRoot: string, times?: CredentialAskTimes): Promise<void> {
   const direct = new Set([...pending].filter(([, id]) => id === `${service.id}@direct`).map(([name]) => name));
   const wanted = [...pending].filter(([name, id]) => id === service.id || direct.has(name)).map(([name]) => name);
+  if (times) { times.names = wanted.length; }
   if (wanted.length === 0) return;
   for (const name of wanted) pending.delete(name);
   // the pack's door as it stands now (a door the pack fixed since the World was made reaches it), else the saved copy
   let door = service.issues;
   try { door = packFacts()[service.id]?.credentialDoor ?? door; } catch { /* no artifact: the saved copy */ }
+  if (times) times.door = performance.now();
   try {
     if (!door) throw new Error('its service names no credential door');
     if (!started.url) throw new Error('it has no URL to ask');
@@ -1624,13 +1672,22 @@ async function issueCredentials(service: WorldServiceConfig, started: WorldServi
     if (!enclosingSeed) beginPlaceholderPull(service.id, controlRoot);
     let answer: Record<string, unknown>;
     try {
+      if (times) times.sent = performance.now();
       const res = await fetch(new URL(door.path, started.url), { method: 'POST', headers: { 'content-type': 'application/json', 'x-volter-world-activity': 'provisioning' }, body: JSON.stringify(door.body), signal: AbortSignal.timeout(ISSUE_TIMEOUT_MS) });
-      if (!res.ok) throw new Error(`answered ${res.status}`);
+      if (times) times.headers = performance.now();
+      // What the door answered is said with its status: a twin's own error is the only reading of why it issued
+      // nothing, and it is otherwise in a log of the twin's host that the caller of `up` may never see.
+      if (!res.ok) throw new Error(`answered ${res.status}: ${(await res.text().catch(() => '')).replace(/\s+/g, ' ').slice(0, 400) || 'no body'}`);
       answer = (await res.json()) as Record<string, unknown>;
+      if (times) times.answered = performance.now();
     } finally {
       if (!enclosingSeed) endPlaceholderPull(service.id, controlRoot);
     }
+    // EACH NAME IS FILLED ON ITS OWN. A door answers several things (a key, a sign-in's files); a part it could not
+    // make, or a name whose part is not in the answer, leaves THAT name unset and said, and the others are given.
+    // One throw here used to unset every name of the service, the key among them.
     for (const name of wanted) {
+      try {
       const spec = door.fill[name] ?? '';
       if (spec.startsWith('directory:') || spec.startsWith('file:')) {
         if (direct.has(name)) throw new Error(`cannot give ${name}'s filesystem credential a direct URL`);
@@ -1722,6 +1779,10 @@ async function issueCredentials(service: WorldServiceConfig, started: WorldServi
         issued.host = endpoint.host;
         env[name] = issued.toString();
       } else env[name] = value;
+      } catch (error) {
+        process.stderr.write(`volter-world: ${service.id} did not issue ${name} (${errorMessage(error)}${typeof answer.codex_unavailable === 'string' ? `; the twin says: ${answer.codex_unavailable.slice(0, 300)}` : ''}); left unset\n`);
+        delete env[name]; unissued.add(name);
+      }
     }
     if (started.url) {
       const endpoint = new URL(started.url);
@@ -1733,6 +1794,7 @@ async function issueCredentials(service: WorldServiceConfig, started: WorldServi
     process.stderr.write(`volter-world: ${service.id} did not issue ${wanted.join(', ')} (${errorMessage(error)}); left unset\n`);
     for (const name of wanted) { delete env[name]; unissued.add(name); }
   }
+  if (times) times.filled = performance.now();
 }
 
 function materializeConfig(config: WorldConfig, root: string): WorldConfig {
@@ -1765,6 +1827,20 @@ function versionSatisfies(actual: string, pin: string): boolean {
   return actual === pin;
 }
 
+/** Where the host's start went, from its receipt, for the receipt's progress line (S2 R38): when its own modules were
+ *  loaded, when its twins' factories returned (the slowest named) and when it published, each after its spawn, and how
+ *  long after publication the receipt was read. A host that says none of it adds nothing. */
+function hostStartAccount(times: HostReadyTimes, spawnedAt: number, readAt: number): string {
+  const after = (time: number): string => `+${Math.max(0, time - spawnedAt)} ms`;
+  const parts: string[] = [];
+  if (times.at !== undefined) parts.push(`${Math.max(0, readAt - times.at)} ms after the host published it`);
+  if (times.began !== undefined) parts.push(`the host's own modules loaded ${after(times.began)} after its spawn`);
+  const started = Object.entries(times.started ?? {}).sort((a, b) => a[1] - b[1]);
+  if (started.length) parts.push(`its twins returned ${after(started[0]![1])} to ${after(started.at(-1)![1])} (slowest ${started.at(-1)![0]})`);
+  if (times.at !== undefined && (times.began !== undefined || started.length)) parts.push(`published ${after(times.at)}`);
+  return parts.length ? `, ${parts.join('; ')}` : '';
+}
+
 /**
  * Boot every `colocate`-declaring service inside ONE `volter-world-host` child (see src/host.ts —
  * 'colocated' maps to the host's 'shared' mode, 'worker' to one Worker thread per twin). The
@@ -1791,21 +1867,33 @@ async function startColocatedServices(
   const readyFile = join(paths.instance, `host-ready-${boot.bootId}.json`);
   const args: string[] = [hostCli, '--isolation', isolation === 'colocated' ? 'shared' : 'worker', '--ready-file', readyFile];
   const allocated: Array<{ service: WorldServiceConfig; port: number; mounted: MountedPackage; sides: Awaited<ReturnType<typeof sidePortsFor>> }> = [];
-  for (const service of colocated) {
-    const port = service.port === undefined || service.port === 'auto' ? await allocatePort(allocatedPorts) : service.port;
+  // Every twin's port and side ports are probed together, not one after another: a probe is a listen and a close
+  // on IPv4 and IPv6, ~25 ms each in a tab, and Dub's fourteen twins and their sides held sixteen of them in turn
+  // (S2 R16: 406 ms of its 1,871 ms up before the host was spawned). Concurrent probes hold distinct ports while
+  // open, and `allocatedPorts` is checked and added to synchronously after each probe, so no port is given twice;
+  // a declared port is in it before any automatic one is chosen, as before. Which twin gets which automatic port
+  // is not part of any contract.
+  // Relative module paths resolve from the world root (import() inside the host would
+  // otherwise resolve them against the runtime's own source directory).
+  const moduleOf = (service: WorldServiceConfig): string => {
+    const declared = service.colocate!.module!;
+    return declared.startsWith('.') ? resolve(paths.root, declared) : declared;
+  };
+  const probed = await Promise.all(colocated.map(async (service) => ({
+    port: service.port === undefined || service.port === 'auto' ? await allocatePort(allocatedPorts) : service.port,
+    sides: await sidePortsFor(vendorOfModule(moduleOf(service), service.id), [], allocatedPorts),
+  })));
+  for (const [index, service] of colocated.entries()) {
+    const { port, sides } = probed[index]!;
     const serviceDataDir = ownedPath(paths.data, service.id);
     mkdirSync(serviceDataDir, { recursive: true });
-    // Relative module paths resolve from the world root (import() inside the host would
-    // otherwise resolve them against the runtime's own source directory).
-    const declared = service.colocate!.module!;
-    const module = declared.startsWith('.') ? resolve(paths.root, declared) : declared;
+    const module = moduleOf(service);
     // R17 — the lockfile check, BEFORE the host boots: what this module's own package.json says
     // it is, against the pin the world config carries; and R16 — the protocol standing the
     // catalog recorded for the package (pack-facts), refused two majors back, warned one back.
     const mounted = lockfileCheck(service, module);
     const scenario = service.colocate!.scenarioPath;
     const binding = managedDatabaseFor(vendorOfModule(module, service.id), worldEnv.VOLTER_WORLD_CONFIG, config.env ?? {});
-    const sides = await sidePortsFor(vendorOfModule(module, service.id), [], allocatedPorts);
     args.push('--spec', [service.id, module, service.colocate!.export, String(port), serviceDataDir, ...(scenario ? [`scenario=${scenario.startsWith('/') ? scenario : resolve(paths.root, scenario)}`] : []), ...(binding !== undefined ? [`database=${binding.url}`] : []), ...sides.map((side) => `side.${side.option}=${side.port}`)].join('|'));
     allocated.push({ service, port, mounted, sides });
   }
@@ -1819,6 +1907,7 @@ async function startColocatedServices(
   for (const [key, value] of Object.entries(env)) if (value === APP_URL_ENV) delete env[key];
   dropUnissued(env);
   env.VOLTER_WORLD_BOOT_ID = boot.bootId;
+  const spawnedAt = Date.now();
   // Under the same exit recorder as a process service, so the host's end (and every twin it holds) is in host.log.
   const { child, ended, identity } = spawnRecorded('host', process.execPath, args, paths.root, env, log, boot);
   child.once('error', error => boot.fail(error));
@@ -1857,27 +1946,42 @@ async function startColocatedServices(
   });
   const ready = (async (): Promise<void> => {
     const hostTimeoutMs = allocated.reduce((timeout, { service }) => Math.max(timeout, typeof service.ready === 'object' ? service.ready.timeoutMs ?? 15_000 : 15_000), 15_000);
-    await untilReadyOrEnded((abort) => waitForHostReady(readyFile, boot.bootId, new Map(allocated.map(({ service, port }) => [service.id, port])), hostTimeoutMs, abort, () => { try { return statSync(log).size; } catch { return 0; } }), ended, boot, 'the co-located host', log).catch(async (error) => {
+    const hostTimes = await untilReadyOrEnded((abort) => waitForHostReady(readyFile, boot.bootId, new Map(allocated.map(({ service, port }) => [service.id, port])), hostTimeoutMs, abort, () => { try { return statSync(log).size; } catch { return 0; } }), ended, boot, 'the co-located host', log).catch(async (error) => {
       if (undeadPids([child.pid!]).length) recordWorldStop([log], 'world.service.stop', 'up (host startup incomplete)', 'SIGTERM');
       try { await signalHeldChild(child, 'SIGTERM', true, identity); } catch { /* best effort cleanup */ }
       throw new Error(`Co-located host failed to complete startup (isolation=${isolation}): ${errorMessage(error)}\nLog: ${log}`);
     });
-    boot.progress('co-located host: its all-started receipt is read');
+    boot.progress(`co-located host: its all-started receipt is read${hostStartAccount(hostTimes, spawnedAt, Date.now())}`);
+    // The host's receipt (this boot, every requested port) is published only
+    // after every factory bound its own port; a port another process held fails
+    // its bind and leaves no receipt. The receipt is the host's ownership proof
+    // for each port (ADR 0014). A port that answers with another boot's identity
+    // is still refused.
+    // So each port is asked its boot at once: this boot's answer is the port's reachability and its ownership in one
+    // connection. Another boot's answer is refused at once, as confirmation refuses it; a port that answers no
+    // boot is waited for and confirmed as before.
+    // A twin the host's receipt names a byte stream (host.ts servesByteStream) is not asked: it would answer the request
+    // in its own protocol, after its own greeting work (Rallly's SMTP relay answered 57 ms after the request, holding
+    // host-ready: e946aa4c run 3, on the mini, World 3.0.2197; S2 R38), and then be asked again by confirmation. Its
+    // admission is its TCP answer and its host still running, as a port with no boot identity's is: another holder of
+    // its port fails its bind, so no receipt.
+    const streams = new Set(hostTimes.streams ?? []);
     await parallelStartup(allocated, async ({ service, port }) => {
+      const byteStream = streams.has(service.id);
+      const answered = byteStream ? null : await worldBootOf(port, boot.signal);
+      if (answered && typeof answered.boot === 'string') {
+        if (answered.boot === boot.bootId) return;
+        if (undeadPids([child.pid!]).length) recordWorldStop([log], 'world.service.stop', 'up (port not its own)', 'SIGTERM');
+        try { await signalHeldChild(child, 'SIGTERM', true, identity); } catch { /* best effort cleanup */ }
+        throw foreignBoot(`Co-located twin "${service.id}"`, answered.boot, log);
+      }
       const bindTimeoutMs = typeof service.ready === 'object' && service.ready.timeoutMs !== undefined ? Math.max(service.ready.timeoutMs, 15_000) : 15_000;
       await untilReadyOrEnded((abort) => waitForTcp(port, bindTimeoutMs, abort), ended, boot, 'the co-located host', log).catch(async (error) => {
         if (undeadPids([child.pid!]).length) recordWorldStop([log], 'world.service.stop', 'up (startup failed)', 'SIGTERM');
         try { await signalHeldChild(child, 'SIGTERM', true, identity); } catch { /* best effort cleanup */ }
         throw new Error(`Co-located twin "${service.id}" failed to start (host isolation=${isolation}): ${errorMessage(error)}\nLog: ${log}`);
       });
-    });
-    // The host's receipt (this boot, every requested port) is published only
-    // after every factory bound its own port; a port another process held fails
-    // its bind and leaves no receipt. The receipt is the host's ownership proof
-    // for each port (ADR 0014). A port that answers with another boot's identity
-    // is still refused.
-    await parallelStartup(allocated, async ({ service, port }) => {
-      await confirmOwnPort(port, boot, ended, true, `Co-located twin "${service.id}"`, log).catch(async (error) => {
+      await confirmOwnPort(port, boot, ended, !byteStream, `Co-located twin "${service.id}"`, log).catch(async (error) => {
         if (undeadPids([child.pid!]).length) recordWorldStop([log], 'world.service.stop', 'up (port not its own)', 'SIGTERM');
         try { await signalHeldChild(child, 'SIGTERM', true, identity); } catch { /* best effort cleanup */ }
         throw error;
@@ -1896,16 +2000,56 @@ async function startColocatedServices(
   return { services, ready };
 }
 
+/** How late this process's event loop ran while `up` worked (S2 R45): a 10 ms tick, unref'd, on the monotonic clock.
+ *  A tick 2 ms or more late adds its lateness to the total (less is timer jitter, not counted); the longest is kept; a
+ *  stall is a tick 10 ms or more late, and the three longest are kept with when, after up began, each began (to within
+ *  the 10 ms tick). LibreChat's up showed three windows of 206-263 ms with no work of the runtime's in its trace
+ *  (e946aa4c lap 060250 run 2, on the mini, in a browser tab): this says whether its loop was stalled in them or working. */
+function eventLoopLag(): { account: () => string; stop: () => void } {
+  const TICK_MS = 10;
+  const JITTER_MS = 2;
+  const started = performance.now();
+  let expected = started + TICK_MS;
+  let total = 0;
+  let longest = 0;
+  const stalls: Array<{ at: number; ms: number }> = [];
+  const timer = setInterval(() => {
+    const now = performance.now();
+    const late = now - expected;
+    expected = now + TICK_MS;
+    if (late < JITTER_MS) return;
+    total += late;
+    longest = Math.max(longest, late);
+    if (late < TICK_MS) return;
+    stalls.push({ at: now - late - started, ms: late });
+    stalls.sort((a, b) => b.ms - a.ms);
+    stalls.length = Math.min(stalls.length, 3);
+  }, TICK_MS);
+  timer.unref?.();
+  return {
+    account: () => `runtime event loop ${Math.round(total)} ms late in all (ticks 2 ms or more late), longest ${Math.round(longest)} ms${stalls.length ? `; stalls ${stalls.map((stall) => `${Math.round(stall.ms)} ms at +${(stall.at / 1000).toFixed(2)} s`).join(', ')} (starts ±10 ms)` : ''}`,
+    stop: () => clearInterval(timer),
+  };
+}
+
 export async function upWorld(configId: string, options: UpWorldOptions = {}, abort?: AbortSignal): Promise<WorldInstance> {
-  abort?.throwIfAborted();
   const upStarted = Date.now();
+  const lag = eventLoopLag();
+  try { return await upWorldRecorded(configId, options, abort, upStarted, lag); }
+  finally { lag.stop(); }
+}
+
+async function upWorldRecorded(configId: string, options: UpWorldOptions, abort: AbortSignal | undefined, upStarted: number, lag: { account: () => string }): Promise<WorldInstance> {
+  abort?.throwIfAborted();
   const root = resolve(options.root ?? process.cwd());
   const found = loadWorldConfig(configId, root);
   // the facts of the World's installed packs, over the kernel's, for this process and (through the instance file) its own
   const packFactsPaths = packFactsFiles(found.config, root);
   for (const file of packFactsPaths) overlayPackFactsFile(file);
   // and this process's injector host rules, which `up`'s inert-injectEnv warning reads, know them too
-  createRequire(import.meta.url)('@volter/world-core/pack-facts').extendPackFacts(packFactsPaths);
+  // An empty overlay changes no facts. Leave built-in host rules at their first use
+  // instead of loading and rebuilding a second facts/host table on every empty up.
+  if (packFactsPaths.length) createRequire(import.meta.url)('@volter/world-core/pack-facts').extendPackFacts(packFactsPaths);
   const loaded = { path: found.path, config: materializeConfig(found.config, root) };
   const name = options.name ?? loaded.config.id;
   const mode = options.mode ?? 'local';
@@ -1987,6 +2131,8 @@ export async function upWorld(configId: string, options: UpWorldOptions = {}, ab
   // the lockfile adds the cross-process exclusion, and an in-process lock holder always releases
   // before its first await, so withFileLock's synchronous contender wait can never deadlock the
   // event loop against a holder in the same process.
+  // The claim's start: a kept state's lock file older than it is its last life's (removeCarriedLocks, S2 K4).
+  const claimStartedAt = Date.now();
   try {
     withFileLock(instanceLockFile(root, name), () => {
       assertProxyOwnershipResolved(root, name);
@@ -2054,6 +2200,9 @@ export async function upWorld(configId: string, options: UpWorldOptions = {}, ab
         if (options.keepState) {
           const KEEP = ['data', 'clock', 'marks', 'changesets', 'episodes', 'browser-records', 'browser-loads'];
           for (const entry of existsSync(instance) ? readdirSync(instance) : []) if (!KEEP.includes(entry)) rmSync(join(instance, entry), { recursive: true, force: true });
+          // The kept state's lock files with no readable holder record are its last life's, and no one's: removed now,
+          // under this boot's claim, before any process of it waits on one (S2 K4; world-store.ts removeCarriedLocks).
+          removeCarriedLocks(KEEP.map(entry => join(instance, entry)).filter(path => existsSync(path)), { stateDir: stateDirName(), before: claimStartedAt });
         } else removeWorldState(root, instance, () => rmSync(instance, { recursive: true, force: true }));
       } catch (error) {
         // The claim failed; the logs go back where they were rather than wait aside for the next boot to discard.
@@ -2188,10 +2337,44 @@ export async function upWorld(configId: string, options: UpWorldOptions = {}, ab
         colocatedReady = async () => {
           await host.ready;
           if (colocated.length) boot.progress('co-located host ready: receipt read, every port admitted as its own');
-          for (const started of host.services) {
+          // Every twin is asked for its credentials at once, and each ask's time is said: thirteen twins took 4.7 s
+          // of one World's up and fourteen took 0.2 s of another's, and the one line after them said only that all had.
+          // Asked in turn they were the tail of up (S2 R17: LibreChat's three, 426 ms, after its infrastructure was
+          // ready). Each ask fills a copy of the environment as it stood before any ask; the copies' changes are then
+          // applied in declaration order, so the environment, its file and up's return are what asking in turn made:
+          // a twin's names are its own (`pending` is split by service before the first await), and no ask reads
+          // another's answer. One difference: where one ask fails, the others still run to their end and write their
+          // custody files, where asking in turn stopped at the first failure; up fails either way.
+          const before = { ...env };
+          // Each ask's own steps, from one origin (S2, the twins' credentials: Twenty's thirteen took 388-500 ms each and
+          // Dub's fourteen 72-90 ms): queued (its turn of the map), its door read, sent, the status, the body, every name
+          // filled. Asks sent together and answered together late say the host or the tab was busy; one long between its
+          // own sent and status says that twin's door.
+          const origin = performance.now();
+          const steps: Array<{ id: string; queued: number; times: CredentialAskTimes }> = [];
+          const asks = await Promise.all(host.services.map(async (started) => {
             const declared = colocated.find((s) => s.id === started.id);
-            if (declared) await issueCredentials(declared, started, env, issuing, unissued, ownedPath(data, started.id));
+            if (!declared) return undefined;
+            const began = performance.now();
+            const times: CredentialAskTimes = { ...(declared.package ? { twin: declared.package } : {}) };
+            steps.push({ id: started.id, queued: began, times });
+            const own: Record<string, string> = { ...before };
+            await issueCredentials(declared, started, own, issuing, unissued, ownedPath(data, started.id), times);
+            return { id: started.id, ms: Math.round(performance.now() - began), own };
+          }));
+          const at = (time: number | undefined): string => time === undefined ? '-' : `+${Math.round(time - origin)}`;
+          const named = steps.filter((step) => (step.times.names ?? 0) > 0);
+          if (named.length) boot.progress(`co-located twins: each credential ask's steps, ms from the asks' start (queued/door/sent/status/body/filled): ${named
+            .sort((left, right) => (right.times.filled ?? 0) - (left.times.filled ?? 0))
+            .map(({ id, queued, times }) => `${id}${times.twin ? ` (${times.twin})` : ''} ${at(queued)}/${at(times.door)}/${at(times.sent)}/${at(times.headers)}/${at(times.answered)}/${at(times.filled)}`).join('; ')}`);
+          const asked: Array<{ id: string; ms: number }> = [];
+          for (const ask of asks) {
+            if (!ask) continue;
+            for (const [key, value] of Object.entries(ask.own)) if (before[key] !== value) env[key] = value;
+            for (const key of Object.keys(before)) if (!Object.hasOwn(ask.own, key)) delete env[key];
+            asked.push({ id: ask.id, ms: ask.ms });
           }
+          if (asked.length) boot.progress(`co-located twins: each asked for its credentials at once, slowest first: ${[...asked].sort((left, right) => right.ms - left.ms).slice(0, 6).map((each) => `${each.id} ${each.ms} ms`).join(', ')}; ${asked.length} asked, ${Math.max(...asked.map((each) => each.ms))} ms the longest`);
           writeProxyEnv(root, name, env);
           if (colocated.length) boot.progress('co-located twins: credentials issued, proxy environment written');
         };
@@ -2215,9 +2398,10 @@ export async function upWorld(configId: string, options: UpWorldOptions = {}, ab
       // possible) or the proxy daemon fails/times out, refuse rather than let unmodified CLIs bypass
       // the twins undetected.
       const attemptProxy = (): void => {
-        if (proxyForServices || (Object.keys(activeVendorMap(env)).length === 0 && env[WORLD_NETWORK_POLICY_ENV] === undefined)) return;
+        if (proxyForServices) return;
         // a host with no raw sockets (a browser tab) has nothing for the proxy to intercept; the injector holds the policy
         if (!hostHasRawEgress()) return;
+        if (Object.keys(activeVendorMap(env)).length === 0 && env[WORLD_NETWORK_POLICY_ENV] === undefined) return;
         if (!opensslAvailable()) {
           if (mode === 'sealed' || loaded.config.network !== undefined) {
             throw new Error(
@@ -2284,12 +2468,12 @@ export async function upWorld(configId: string, options: UpWorldOptions = {}, ab
       delete worldInstance.previousEnvOutput;
       saveWorldInstance(worldInstance);
       boot.progress(`environment written: ${envFile}`);
-      materializeBrowserFiles(data, root, name, loaded.config.id);
+      await materializeWorldBrowserFiles(data, root, name, loaded.config.id);
       writePidsFromInstance(worldInstance, Object.values(worldInstance.services).map((service) => service.pid).filter((pid) => pid > 0));
       saveWorldInstance(worldInstance);
       const servicePids = [...new Set(Object.values(services).map((service) => service.pid).filter((pid) => pid > 0))];
       handoffWorldLifecycle(root, name, servicePids);
-      boot.progress('returning: the World is up');
+      boot.progress(`returning: the World is up; ${lag.account()}`);
       if (mode === 'share') {
         try {
           return await shareWorldServices(name, { root, ...(options.share ?? {}) });
@@ -2532,6 +2716,7 @@ export async function downWorld(
   assertSafeWorldName(name);
   const resolvedRoot = resolve(root);
   const token = randomUUID();
+  const ownershipErrors: string[] = [];
   // Like boot's claim: a short synchronous lock protects an async lifecycle transition.
   // Do not hold a filesystem lock while external shutdown or the grace period waits.
   withFileLock(instanceLockFile(resolvedRoot, name), () => withFileLock(`${sharingClaimFile(resolvedRoot, name)}.lock`, () => {
@@ -2544,8 +2729,9 @@ export async function downWorld(
           || recorded.instance !== options.expectedInstance) throw new Error();
       } catch { throw new Error(`World ownership mismatch: ${name}`); }
     }
-    assertProxyOwnershipResolved(resolvedRoot, name);
-    const prior = existsSync(instanceFile(resolvedRoot, name)) ? readWorldInstance(name, resolvedRoot, true) : undefined;
+    // Unresolved startup evidence prevents finalization, not retirement of known children.
+    let prior: WorldInstance | undefined;
+    try { prior = readWorldInstance(name, resolvedRoot, true); } catch { /* diagnosed after owned children retire */ }
     if (prior?.resources && !prior.lifecycle) throw new Error(`World "${name}" belongs to a legacy runtime; use its pinned runtime for teardown before migration`);
     if (options.purge) assertWorldStateRemovable(resolvedRoot, instanceDir(resolvedRoot, name));
     prepareBootForDown(resolvedRoot, name);
@@ -2560,11 +2746,15 @@ export async function downWorld(
       if (!sharing || sharingClaimAlive(sharing)) throw new Error(`World "${name}" is being shared or has an unreadable sharing claim; retry after sharing finishes`);
       rmSync(sharePath); // explicit down may reclaim a provably stale sharing claim
     }
-    retainWorldLifecycleForCleanup(resolvedRoot, name);
+    retainWorldLifecycleForCleanup(resolvedRoot, name, error => { ownershipErrors.push(`Lifecycle ownership unreadable; retained: ${errorMessage(error)}`); });
     writeTextAtomic(stoppingFile(resolvedRoot, name), JSON.stringify({ pid: process.pid, at: new Date().toISOString(), token }));
   }));
   try {
-    return await downWorldClaimed(name, resolvedRoot, options);
+    // The down's own signals and its whole time are said in the World's log (process-groups.mjs, worldEvent).
+    const downAsked = Date.now();
+    setWorldEventsFile(worldEventsPath(join(instanceDir(resolvedRoot, name), 'logs')));
+    try { return await downWorldClaimed(name, resolvedRoot, options, ownershipErrors); }
+    finally { worldEvent({ event: 'world.down', world: name, ms: Date.now() - downAsked }); setWorldEventsFile(undefined); }
   } finally {
     withFileLock(instanceLockFile(resolvedRoot, name), () => {
       const path = stoppingFile(resolvedRoot, name);
@@ -2577,16 +2767,22 @@ async function downWorldClaimed(
   name: string,
   root: string,
   options: { graceMs?: number; purge?: boolean },
+  externalErrors: string[] = [],
 ): Promise<{ name: string; stopped: number[]; escalated: number[]; externalStopped: string[]; externalErrors: string[]; externalAbandoned?: string[]; notSignalled?: string[]; purged?: string }> {
+  const clearBrowserFiles = options.purge ? (await import('./browsers.ts')).clearBrowserFiles : undefined;
   assertSafeWorldName(name);
   const resolvedRoot = resolve(root);
   const dir = instanceDir(resolvedRoot, name);
   const pidsFile = join(dir, 'pids');
-  const before = existsSync(instanceFile(resolvedRoot, name)) ? readFileSync(instanceFile(resolvedRoot, name), 'utf8') : undefined;
+  let before: string | undefined;
+  try { before = getActiveWorldStore().read(instanceFile(resolvedRoot, name)) ?? undefined; }
+  catch (error) { externalErrors.push(`World instance unreadable; retained: ${errorMessage(error)}`); }
   // A retry must not retain an earlier success receipt while teardown is in progress.
   rmSync(join(dir, 'stopped.json'), { force: true });
-  // Tear down the ambient-redirect proxy + its session CA FIRST, so the trusted CA never outlives
-  // the world (it was only ever trusted via per-shell env, never system-wide).
+  const guestError = (error: unknown) => {
+    const message = errorMessage(error);
+    if (!externalErrors.includes(message)) externalErrors.push(message);
+  };
   let instance: WorldInstance | undefined;
   try {
     instance = readWorldInstance(name, resolvedRoot);
@@ -2594,48 +2790,58 @@ async function downWorldClaimed(
   } catch {
     instance = undefined;
   }
-  readGuestProcesses(dir, instance?.instance); // missing World metadata never erases guest ownership
-  // Nothing to tear down when the metadata is gone and every process the lifecycle recorded has exited.
-  if (!instance && before === undefined && releaseAbandonedWorldLifecycle(resolvedRoot, name)) {
-    return { name, stopped: [], escalated: [], externalStopped: [], externalErrors: [] };
-  }
-  if (!instance && (before !== undefined || hasWorldLifecycle(resolvedRoot, name))) {
-    return { name, stopped: [], escalated: [], externalStopped: [],
-      externalErrors: ['World instance or external teardown metadata missing or unreadable; cleanup refused; lifecycle evidence retained'] };
-  }
+  // Read independent process records even when a guest receipt or instance is unreadable.
+  const readGuests = () => {
+    try { return readGuestProcesses(dir, instance?.instance, guestError); }
+    catch (error) { guestError(error); return []; }
+  };
+  const guests = readGuests();
+  let proxyBefore: string | null = null;
+  try { proxyBefore = getActiveWorldStore().read(proxyStateFile(resolvedRoot, name)); }
+  catch (error) { externalErrors.push(`Proxy process record unreadable; retained: ${errorMessage(error)}`); }
   const proxyState = readProxyState(resolvedRoot, name);
-  const proxyPid = proxyState?.pid;
-  await stopWorldProxy(resolvedRoot, name, spawnedChildren);
+  const proxyPid = proxyState && Number.isInteger(proxyState.pid) && proxyState.pid > 0 ? proxyState.pid : undefined;
+  if (proxyBefore !== null && (!proxyPid || (proxyState?.birth !== undefined && (typeof proxyState.birth !== 'string' || !proxyState.birth)))) {
+    externalErrors.push('Proxy process record unreadable; ownership retained');
+  }
   const foregroundPid = instance?.lastRun?.state !== 'completed' ? instance?.lastRun?.consumerPid : undefined;
   const holderPid = instance?.lifecycle?.holderPid ?? instance?.resources?.holderPid;
-  const recordedPids = [...new Set([...readPids(pidsFile), ...(foregroundPid ? [foregroundPid] : []), ...(proxyPid ? [proxyPid] : [])])].filter(pid => pid !== holderPid);
-  const identities = readIdentities(resolvedRoot, name);
-  if (proxyState?.birth) identities[proxyState.pid] = proxyState.birth;
+  let filePids: number[] = [];
+  try { filePids = readPids(pidsFile, guests); }
+  catch (error) { externalErrors.push(`World PID record unreadable; retained: ${errorMessage(error)}`); }
+  const recordedPids = [...new Set([...(proxyPid ? [proxyPid] : []), ...filePids, ...(foregroundPid ? [foregroundPid] : []), ...(holderPid ? [holderPid] : [])])].filter(pid => Number.isInteger(pid) && pid > 0);
+  const conflicts = new Set<number>();
+  const conflictingIdentity = (pid: number) => {
+    if (conflicts.has(pid)) return;
+    conflicts.add(pid);
+    externalErrors.push(`Conflicting spawn identities for pid ${pid}; not signalled; ownership retained`);
+  };
+  const identities = readIdentities(resolvedRoot, name, guests, conflictingIdentity);
+  if (proxyPid && typeof proxyState?.birth === 'string' && proxyState.birth) {
+    if (identities[proxyPid] && identities[proxyPid] !== proxyState.birth) conflictingIdentity(proxyPid);
+    else identities[proxyPid] = proxyState.birth;
+  }
   const foreign = (await Promise.all(recordedPids.map(async pid => {
     const now = identities[pid] ? await processBirth(pid) : undefined;
     return now && now !== identities[pid] ? { pid, recorded: identities[pid]!, now } : undefined;
   }))).filter((entry): entry is { pid: number; recorded: string; now: string } => !!entry);
-  const pids = recordedPids.filter((pid) => !foreign.some((entry) => entry.pid === pid));
+  const pids = recordedPids.filter((pid) => pid !== holderPid && !conflicts.has(pid) && !foreign.some((entry) => entry.pid === pid));
   const processServices = Object.values(instance?.services ?? {}).filter((service) => service.type !== 'external' && service.log);
   // Only a service still alive is stopped by this `down`; a dead one's end was not the World's.
   const stillAlive = undeadPids(processServices.map((service) => service.pid).filter((pid) => pids.includes(pid)));
   recordWorldStop(processServices.filter((service) => stillAlive.includes(service.pid)).map((service) => service.log), 'world.service.stop', 'down', 'SIGTERM');
   const stopped = await signalPids(pids, 'SIGTERM', identities, spawnedChildren);
 
-  // Stop self-managed externals via their declared `down` command. A missing instance is
-  // safe only without retained lifecycle ownership, checked before any signals above.
+  // Missing external metadata remains a finalization error after known children retire.
   let externalStopped: string[] = [];
-  let externalErrors: string[] = [];
   let unavailable: string[] = [];
-  try {
-    if (!instance) throw new Error('World instance unavailable');
-    const result = await teardownExternalServices(instance);
-    externalStopped = result.stopped;
-    externalErrors = result.errors;
-    unavailable = result.unavailable;
-  } catch {
-    // no instance.json (never fully came up) — only owned processes needed stopping.
-    if (before !== undefined) externalErrors.push('World instance or external teardown metadata unreadable; cleanup refused');
+  if (instance) {
+    try {
+      const result = await teardownExternalServices(instance);
+      externalStopped = result.stopped;
+      externalErrors.push(...result.errors);
+      unavailable = result.unavailable;
+    } catch (error) { externalErrors.push(errorMessage(error)); }
   }
 
   // Escalate AFTER the external teardown so externals never wait on the grace, and
@@ -2645,11 +2851,14 @@ async function downWorldClaimed(
   recordWorldStop(processServices.filter((service) => escalated.includes(service.pid)).map((service) => service.log), 'world.service.killed', 'down', 'SIGKILL');
   // A launch which had already entered its spawn seam may publish while TERM is delivered.
   // Once services/agents retire, join every late receipt before certifying this generation stopped.
-  const lateGuests = readGuestProcesses(dir, instance?.instance).filter(receipt => !pids.includes(receipt.record.pid));
+  const settlingGuests = readGuests();
+  readIdentities(resolvedRoot, name, settlingGuests, conflictingIdentity);
+  const lateGuests = settlingGuests.filter(({ record }) => !conflicts.has(record.pid)
+    && (!recordedPids.includes(record.pid) || identities[record.pid] !== record.start));
   try { await retireOwnedProcessGroups(lateGuests.map(receipt => receipt.record), options.graceMs ?? DOWN_GRACE_MS_DEFAULT); }
   catch (error) { externalErrors.push(errorMessage(error)); }
   pids.push(...lateGuests.map(receipt => receipt.record.pid));
-  if (holderPid && !externalErrors.length && !undeadPids(pids).length) {
+  if (holderPid && recordedPids.includes(holderPid) && !conflicts.has(holderPid) && !foreign.some(entry => entry.pid === holderPid)) {
     pids.push(holderPid);
     stopped.push(...await signalPids([holderPid], 'SIGTERM', identities, spawnedChildren));
     escalated.push(...await killSurvivorsAfterGrace([holderPid], options.graceMs ?? DOWN_GRACE_MS_DEFAULT, identities, spawnedChildren));
@@ -2661,19 +2870,31 @@ async function downWorldClaimed(
     const notSignalled = foreign.map((entry) => `pid ${entry.pid} now names another process (started ${entry.now}; the World's started ${entry.recorded}); not signalled`);
     const result = { name, stopped, escalated, externalStopped, externalErrors, ...(notSignalled.length ? { notSignalled } : {}) };
     const path = instanceFile(resolvedRoot, name);
-    const current = existsSync(path) ? readFileSync(path, 'utf8') : undefined;
+    let current: string | undefined;
+    try { current = getActiveWorldStore().read(path) ?? undefined; }
+    catch (error) { externalErrors.push(`World generation unreadable; finalization refused: ${errorMessage(error)}`); return result; }
     if (current !== before || existsSync(bootingFile(resolvedRoot, name))) {
       externalErrors.push('World generation changed or is booting; finalization refused');
       return result;
     }
-    if (existsSync(proxyStateFile(resolvedRoot, name)) || existsSync(sharingClaimFile(resolvedRoot, name))) {
+    let currentProxy: string | null;
+    try { currentProxy = getActiveWorldStore().read(proxyStateFile(resolvedRoot, name)); }
+    catch (error) { externalErrors.push(`Proxy record unreadable; finalization refused: ${errorMessage(error)}`); return result; }
+    if ((currentProxy !== null && currentProxy !== proxyBefore) || existsSync(sharingClaimFile(resolvedRoot, name))) {
       externalErrors.push('Proxy or sharing lifecycle changed during teardown; cleanup refused');
       return result;
     }
-    const guestReceipts = readGuestProcesses(dir, instance?.instance);
+    if (existsSync(proxyStartingFile(resolvedRoot, name))) {
+      externalErrors.push(`World "${name}" has unresolved proxy startup ownership; recorded children retired where identity verified; lifecycle and instance retained. Inspect: ${proxyStartingFile(resolvedRoot, name)}`);
+    }
+    const guestReceipts = readGuests();
     const surviving = undeadPids([...pids, ...guestReceipts.map(receipt => receipt.record.pid)]);
     if (surviving.length) externalErrors.push(`World processes still alive or uninspectable after teardown: ${surviving.join(', ')}; cleanup refused`);
     if (guestReceipts.some(receipt => foreign.some(entry => entry.pid === receipt.record.pid))) externalErrors.push('Guest spawn identity changed; receipt retained and cleanup refused');
+    if (!instance && (before !== undefined || hasWorldLifecycle(resolvedRoot, name))
+      && !(before === undefined && !externalErrors.length && releaseAbandonedWorldLifecycle(resolvedRoot, name))) {
+      externalErrors.push('World instance or external teardown metadata missing or unreadable; cleanup refused; lifecycle evidence retained');
+    }
     let externalAbandoned: string[] | undefined;
     if (options.purge && instance && externalErrors.length && externalErrors.length === unavailable.length && !foreign.length) {
       const inventory = exitedWorldLifecyclePids(resolvedRoot, name, instance.createdAt);
@@ -2687,6 +2908,8 @@ async function downWorldClaimed(
       }
     }
     if (externalErrors.length) return result;
+    // Keep proxy state and session trust until its recorded processes have exited.
+    clearWorldProxyFiles(resolvedRoot, name);
     releaseGuestProcesses(guestReceipts);
     rmSync(pidsFile, { force: true });
     if (before) {
@@ -2698,7 +2921,7 @@ async function downWorldClaimed(
     releaseWorldLifecycle(resolvedRoot, name, externalAbandoned ? 'recorded processes exited; explicit purge surrendered state; ownership released' : undefined);
     if (!options.purge) return result;
     const purged = purgeInstanceDir(resolvedRoot, name);
-    if (purged && instance) clearBrowserFiles(instance.dirs.data, resolvedRoot);
+    if (purged && instance) clearBrowserFiles!(instance.dirs.data, resolvedRoot);
     return { ...result, ...(externalAbandoned ? { externalAbandoned } : {}), purged };
   }));
 }
@@ -2708,7 +2931,9 @@ async function downWorldClaimed(
 export type ServiceState = 'running' | 'stopped' | 'lingering' | 'gave-up' | 'external';
 export function statusWorld(name: string, root = process.cwd(), options: { readOnly?: boolean; light?: boolean } = {}): WorldInstance & { running: boolean; livePids: number[]; serviceStates: Record<string, ServiceState>; degraded: boolean } {
   const worldInstance = readWorldInstance(name, resolve(root), options.readOnly);
-  const live = ownedPids(resolve(root), name, livePids(readPids(worldInstance.pidsFile)));
+  // One status, one reading of the process table: its questions below are about the same moment.
+  const listing: ProcessListing = {};
+  const live = ownedPids(resolve(root), name, livePids(readPids(worldInstance.pidsFile), listing));
   const externalOnly = Object.values(worldInstance.services).every(service => service.type === 'external');
   const recorded = externalOnly && !existsSync(stoppingFile(root, name)) && !existsSync(join(instanceDir(root, name), 'stopped.json'))
     && isWorldLifecycleRunning(root, name, worldInstance.createdAt);
@@ -2716,9 +2941,9 @@ export function statusWorld(name: string, root = process.cwd(), options: { readO
   // read; a service's own state is judged by its process group, so a dead service reads as dead beside a live daemon.
   const owned = Object.values(worldInstance.services).filter((service) => service.type !== 'external' && service.pid);
   const ownPids = ownedPids(resolve(root), name, owned.map((service) => service.pid));
-  const leaders = livePids(ownPids);
+  const leaders = livePids(ownPids, listing);
   // `light` (a listing of every World) skips the process-table scan: a lingering group then reads as stopped.
-  const groups = ownPids.length && !options.light ? survivingOwnedGroups(ownPids) : [];
+  const groups = ownPids.length && !options.light ? survivingOwnedGroups(ownPids, listing) : [];
   const serviceStates: Record<string, ServiceState> = {};
   for (const service of Object.values(worldInstance.services)) {
     serviceStates[service.id] = service.type === 'external' ? 'external'
@@ -3571,7 +3796,7 @@ export function urlWorld(name: string, options: { service?: string; root?: strin
 
 export async function runWorld(configId: string, command: string[], options: RunWorldOptions = {}): Promise<{ instance: WorldInstance; exitCode: number; outcome: WorldRunOutcome }> {
   if (command.length === 0) throw new Error('Missing command after --');
-  if (!options.keep) return superviseWorldRun(configId, command, options);
+  if (!options.keep) return (await import('./run-task.ts')).superviseWorldRun(configId, command, options);
   return runWorldOwned(configId, command, options);
 }
 
@@ -3663,13 +3888,13 @@ export function listWorlds(root = process.cwd()): Array<{ name: string; running:
     .sort((a, b) => a.name.localeCompare(b.name));
 }
 
-function worldAttachedCommandEnv(name: string, root: string, verbose = false): { instance: ReturnType<typeof statusWorld>; env: NodeJS.ProcessEnv } {
-  const status = statusWorld(name, root);
+function worldAttachedCommandEnv(name: string, root: string, verbose = false, instance?: WorldInstance): { instance: WorldInstance; env: NodeJS.ProcessEnv } {
+  const status = instance ?? statusWorld(name, root);
   const sealed = status.env.VOLTER_WORLD_MODE === 'sealed' || status.env[WORLD_NETWORK_POLICY_ENV] !== undefined;
   const baseEnv = { ...admittedEnv(stripEnvOf(status.env)), ...status.env };
   let proxyEnv: Record<string, string> = {};
   try {
-    const proxy = ensureWorldProxy(name, root, [admittedEnv(stripEnvOf(status.env)), status.env]);
+    const proxy = ensureWorldProxyForCommand(name, root, [admittedEnv(stripEnvOf(status.env)), status.env], instance);
     if (proxy?.url) {
       proxyEnv = proxy.env;
     // a host with no raw sockets (a browser tab) runs no proxy: the injector holds the policy there, as at `up`
@@ -3759,19 +3984,19 @@ export function retireWorldConsumers(name: string, root = process.cwd(), options
   });
 }
 
-export async function attachWorld(name: string, command: string[], root = process.cwd(), options: { cwd?: string; owner?: string; verbose?: boolean } = {}): Promise<number> {
+export async function attachWorld(name: string, command: string[], root = process.cwd(), options: { cwd?: string; owner?: string; verbose?: boolean; instance?: WorldInstance } = {}): Promise<number> {
   if (command.length === 0) throw new Error('Missing command after --');
   assertSafeWorldName(name);
   const resolvedRoot = resolve(root);
   checkedOwner(options.owner);
-  const attached = worldAttachedCommandEnv(name, resolvedRoot, options.verbose);
+  const attached = worldAttachedCommandEnv(name, resolvedRoot, options.verbose, options.instance);
   const record = withFileLock(instanceLockFile(resolvedRoot, name), () => {
     if (existsSync(stoppingFile(resolvedRoot, name)) || existsSync(bootingFile(resolvedRoot, name))) {
       throw new Error(`World "${name}" is changing lifecycle; retry after it finishes`);
     }
     const current = statusWorld(name, resolvedRoot);
     // Which of the two it was, with what was read: "stopped" and "another instance" are different repairs.
-    if (!current.running) throw new Error(`World "${name}" is not running while attaching: none of its recorded processes is live and its own (recorded pids ${readPids(current.pidsFile).join(', ') || 'none'}; live and its own: none)`);
+    if (!current.running) throw new Error(`World "${name}" is not running while attaching: none of its recorded processes is live and its own (recorded pids ${readPids(current.pidsFile).join(', ') || 'none'}; live and its own: none); ${describeWorldLifecycle(resolvedRoot, name, current.createdAt)})`);
     if (current.createdAt !== attached.instance.createdAt) throw new Error(`World "${name}" changed while attaching: its instance was created ${attached.instance.createdAt} when the command's environment was read and ${current.createdAt} now`);
     // Attaching to a World whose services died is allowed (a command may not need them), but never silent.
     for (const [id, state] of Object.entries(current.serviceStates)) {
@@ -3781,7 +4006,7 @@ export async function attachWorld(name: string, command: string[], root = proces
       process.stderr.write(`World "${name}": service ${id} is not running${end ? `: it ${describeServiceEnd(end)}` : ''}${service?.log ? `\n  log: ${service.log}` : ''}\n`);
     }
     return createConsumer(resolvedRoot, name, current.createdAt, 'attach', options.owner ?? current.lifecycle?.owner ?? current.resources?.owner, { completionRequired: true });
-  });
+  }, { operation: 'instance attach' });
   let timer: ReturnType<typeof setInterval> | undefined;
   let retired = true;
   try {
@@ -3938,6 +4163,7 @@ export async function shellWorld(name: string, root = process.cwd()): Promise<nu
     process.stderr.write(`world '${name}' active in a subshell — vendor calls hit the twins (this host opens no raw sockets; the injector holds the network policy). type 'exit' to leave.\n`);
   } else if (opensslAvailable()) {
     try {
+      const { startRedirectProxy } = await import('./redirect-proxy.ts');
       proxy = await startRedirectProxy({ env, trustEnv: [admittedEnv(stripEnvOf(env)), env], tlsDir: tlsDir(resolvedRoot, name) });
       Object.assign(env, proxy.proxyEnv());
       process.stderr.write(`world '${name}' active in a subshell — vendor calls hit the twins (ambient proxy ${proxy.url}). type 'exit' to leave.\n`);
@@ -3976,13 +4202,17 @@ function proxyDaemonDeadlineMs(): number {
  * reuses a live daemon. Returns its proxy env, or null if openssl is missing (env-only fallback). The
  * daemon is recorded in `proxy.json` and stopped by `down`. */
 export function ensureWorldProxy(name: string, root = process.cwd(), caller: CaTrustInputs = process.env): { url: string; caCertPath: string; env: Record<string, string> } | null {
+  return ensureWorldProxyForCommand(name, root, caller);
+}
+
+function ensureWorldProxyForCommand(name: string, root: string, caller: CaTrustInputs, instance?: WorldInstance): { url: string; caCertPath: string; env: Record<string, string> } | null {
   assertSafeWorldName(name);
   const resolvedRoot = resolve(root);
   return withFileLock(instanceLockFile(resolvedRoot, name), () => {
     assertProxyOwnershipResolved(resolvedRoot, name);
     if (liveBootingClaim(stoppingFile(resolvedRoot, name))) throw new Error(`World "${name}" is being stopped`);
     if (liveBootingClaim(bootingFile(resolvedRoot, name))) throw new Error(`World "${name}" is being booted`);
-    if (!statusWorld(name, resolvedRoot, { readOnly: true }).running) throw new Error(`World "${name}" is not running`);
+    if (!instance && !statusWorld(name, resolvedRoot, { readOnly: true }).running) throw new Error(`World "${name}" is not running`);
     return ensureWorldProxyUnlocked(name, resolvedRoot, caller);
   });
 }
@@ -4153,6 +4383,7 @@ export async function runProxyDaemon(name: string, root = process.cwd(), envFile
     if (!status.running) throw new Error(`World "${name}" is not running`);
     env = { ...admittedEnv(stripEnvOf(status.env)), ...status.env };
   }
+  const { startRedirectProxy } = await import('./redirect-proxy.ts');
   const proxy = await startRedirectProxy({ env, envLoader, tlsDir: tlsDir(resolvedRoot, name), note: (line) => process.stderr.write(`${line}\n`) });
   const identity = await spawnIdentity(process.pid);
   if (!identity.start) { await proxy.close(); throw new Error('Proxy birth capture failed'); }
@@ -4175,8 +4406,8 @@ export async function runProxyDaemon(name: string, root = process.cwd(), envFile
   process.on('SIGINT', stop);
 }
 
-/** Stop a world's ambient-redirect proxy daemon (if any) and drop its session CA. Best-effort —
- * called from `downWorld` so the trusted CA never outlives the world. */
+/** Failed boot's proxy retirement; normal down retires it with the other recorded children
+ * and clears session trust only after confirming exit. */
 async function stopWorldProxy(root: string, name: string, handles?: Map<number, ReturnType<typeof spawn>>): Promise<void> {
   const state = readProxyState(root, name);
   if (state && isAlive(state.pid)) {
@@ -4189,8 +4420,12 @@ async function stopWorldProxy(root: string, name: string, handles?: Map<number,
       await signalOwnedProcess(identity, 'SIGTERM');
     }
   }
-  try { rmSync(proxyStateFile(root, name), { force: true }); } catch { /* ignore */ }
-  try { rmSync(proxyEnvFile(root, name), { force: true }); } catch { /* ignore */ }
+  clearWorldProxyFiles(root, name);
+}
+
+function clearWorldProxyFiles(root: string, name: string): void {
+  rmSync(proxyStateFile(root, name), { force: true });
+  rmSync(proxyEnvFile(root, name), { force: true });
   tearDownCa(tlsDir(root, name));
 }