@volter/world-runtime 3.0.166 → 3.0.168

package/src/runtime.ts

@@ -1,9 +1,11 @@
+import { isScalarCredentialField, withCurrentCredentialDoor } from './credential-door.ts';
 import { errorMessage } from './error-message.ts';
+import { recorderEnvironment, recordedApplicationEnvironment } from './service-environment.ts';
 import { materializeWorldBrowserFiles } from './browser-files.ts';
 import { claimEnvOutput, publishEnvOutput } from './env-output.ts';
 import { offSignal } from './signals.ts';
 import { parallelStartup } from './startup.ts';
-import { type HostReadyTimes, waitForHostReady } from './host-ready.ts';
+import { startedTwins, type HostReadyTimes, waitForHostReady } from './host-ready.ts';
 import { assertWorldStateRemovable, removeWorldState } from './ancestry.ts';
 import { packCli, packEntry } from './catalog.ts';
 import { vendorOfPackModule } from '@volter/world-core/runtime-state';
@@ -34,7 +36,7 @@ import { loadWorldConfig } from './configs.ts';
 import { createWorldNetworkPolicy, parseWorldNetworkPolicy, normalizeWorldNetwork, intersectWorldNetwork, type WorldNetwork, WORLD_NETWORK_POLICY_ENV } from '@volter/world-core/network-policy';
 import { overlayPackFactsFile, resolveServicePackage } from './catalog.ts';
 import { fakeEnvValue } from './fixture-env.ts';
-import { APP_URL_ENV, ISSUE_ENV_PREFIX, MINT_ENV } from './schema.ts';
+import { APP_URL_ENV, ISSUE_ENV_PREFIX, MINT_ENV, assertRequiredCredentialBindings } from './schema.ts';
 import { readAppUrl } from './app-url.ts';
 import { inertInjectEnvWarnings } from './inject-map.ts';
 import { activeVendorMap, ensureCa, hostHasRawEgress, opensslAvailable, proxyEnvFor, tearDownCa } from './proxy-env.ts';
@@ -69,13 +71,13 @@ export function worldEventsPath(logs: string): string {
  *  its output straight to `log` (capped, time-marked), its start and end are recorded there and in the World's events
  *  file, and it is handed a directory of its own for the log files it writes itself (VOLTER_WORLD_SERVICE_LOG_DIR).
  *  `ended` settles when the recorder exits, right after the service ends and its exit record is written. */
-function spawnRecorded(serviceId: string, command: string, args: string[], cwd: string, env: NodeJS.ProcessEnv, log: string, boot: BootContext): { child: ReturnType<typeof spawn>; ended: Promise<void>; identity: Promise<SpawnIdentity | undefined> } {
+function spawnRecorded(serviceId: string, command: string, args: string[], cwd: string, env: NodeJS.ProcessEnv, log: string, boot: BootContext, required?: RequiredCredentialClaims): { child: ReturnType<typeof spawn>; ended: Promise<void>; identity: Promise<SpawnIdentity | undefined> } {
   const logDir = ownedPath(dirname(log), `${basename(log).replace(/\.log$/, '')}.d`);
+  const recorderEnv = recorderEnvironment(env, serviceId, log, logDir, worldEventsPath(dirname(log)));
+  // The recorder adds and removes its own names. Validate the same final child environment before opening a log or spawning.
+  if (required !== undefined) assertRequiredCredentials(required, recordedApplicationEnvironment(recorderEnv), `service ${serviceId}'s recorded application environment`);
   mkdirSync(logDir, { recursive: true, mode: 0o700 });
   const out = openPrivateLog(log, 'a'); // the service's output and the recorder's records, appended
-  const recorderEnv: NodeJS.ProcessEnv = { ...env, VOLTER_WORLD_SERVICE_ID: serviceId, VOLTER_WORLD_SERVICE_LOG: log,
-    VOLTER_WORLD_SERVICE_LOG_DIR: logDir, VOLTER_WORLD_EVENTS: worldEventsPath(dirname(log)) };
-  if (recorderEnv.NODE_OPTIONS !== undefined) { recorderEnv.VOLTER_WORLD_SERVICE_NODE_OPTIONS = recorderEnv.NODE_OPTIONS; delete recorderEnv.NODE_OPTIONS; }
   const child = spawn(process.execPath, [siblingScript(import.meta.url, 'service-recorder'), command, ...args], { windowsHide: true,
     cwd,
     env: recorderEnv,
@@ -614,9 +616,12 @@ function networkOf(name: string, own: WorldNetwork | undefined, recorded: WorldN
   return { [WORLD_NETWORK_POLICY_ENV]: JSON.stringify(createWorldNetworkPolicy(name, network)) };
 }
 
-/** Strip the publication envelope before combining permissions (the config shape admits only these keys). */
+/** Strip the publication envelope before combining permissions (the config shape admits only these keys). Every
+ *  permission the policy carries stays: a dropped `writes` or `publicReads` would read as the default when combined,
+ *  and a build World inside a closed one would read the public build origins its parent may not (sealing never widens). */
 function networkPermission(policy: WorldNetwork): WorldNetwork {
-  return { egress: policy.egress, phase: policy.phase, passthrough: policy.passthrough, ...(policy.ownLoopback === false ? { ownLoopback: false } : {}) };
+  return { egress: policy.egress, ...(policy.writes !== undefined ? { writes: policy.writes } : {}), phase: policy.phase, passthrough: policy.passthrough,
+    ...(policy.publicReads !== undefined ? { publicReads: policy.publicReads } : {}), ...(policy.ownLoopback === false ? { ownLoopback: false } : {}) };
 }
 
 /** The boot permission, never a fallback to a mutable config. */
@@ -724,7 +729,13 @@ function readWorldBootRecordLocked(name: string, root: string): WorldInstance {
   } catch { throw new Error(`World boot record is incomplete or invalid: ${path}\nFrom the app directory, inspect: volter-world doctor ${name} --root .\nComplete teardown with the owning runtime: volter-world down ${name} --root .\nRetain the startup diagnostics and any history. Only a disposable instance with no state to keep may be removed with down --purge; resume never discards it automatically.`); }
 }
 
-export function admittedEnv(strip: string[] | undefined, env: NodeJS.ProcessEnv = process.env): Record<string, string> {
+/** What Windows itself needs in every process: without these, Winsock and DLL loading fail, the temp directory falls
+ *  back to C:\Windows\Temp and tools lose their profile folders. They hold no caller credential, so a strip (even
+ *  `*`) never removes them on win32. Windows names are case-insensitive. */
+const WINDOWS_BASELINE_ENV = new Set(['systemroot', 'windir', 'systemdrive', 'comspec', 'pathext', 'temp', 'tmp', 'userprofile',
+  'appdata', 'localappdata', 'programdata', 'programfiles', 'programfiles(x86)', 'programw6432', 'commonprogramfiles',
+  'commonprogramfiles(x86)', 'commonprogramw6432', 'homedrive', 'homepath', 'os', 'processor_architecture', 'number_of_processors']);
+export function admittedEnv(strip: string[] | undefined, env: NodeJS.ProcessEnv = process.env, platform: NodeJS.Platform = process.platform): Record<string, string> {
   const out: Record<string, string> = {};
   const rules = (strip ?? []).map((s): { prefix: string } | { name: string } => (s.endsWith('*') ? { prefix: s.slice(0, -1) } : { name: s }));
   for (const [k, v] of Object.entries(env)) {
@@ -732,6 +743,7 @@ export function admittedEnv(strip: string[] | undefined, env: NodeJS.ProcessEnv
     // Permission is published by the attached instance, never inherited from
     // whichever World happened to launch this operator process.
     if (k === WORLD_NETWORK_POLICY_ENV) continue;
+    if (platform === 'win32' && WINDOWS_BASELINE_ENV.has(k.toLowerCase())) { out[k] = v; continue; }
     if (rules.some((r) => ('prefix' in r ? k.startsWith(r.prefix) : k === r.name))) continue;
     out[k] = v;
   }
@@ -769,6 +781,7 @@ function serviceProcessEnv(
   service: WorldServiceConfig,
   worldEnv: Record<string, string>,
   port: number,
+  twin = service.type === 'twin',
 ): Record<string, string> {
   const env: Record<string, string> = {
     ...admittedEnv(config.stripEnv),
@@ -782,6 +795,12 @@ function serviceProcessEnv(
     for (const key of CONTROL_PLANE_EGRESS_ENV) delete env[key];
   }
   dropUnissued(env);
+  // NODE_ENV is the application's mode: a twin is the World's own server, run as built (React's production server build
+  // crashes Bun 1.3.11 at load, so Twenty's NODE_ENV=production stopped every twin with screens); a service's own env
+  // may still set it
+  // a twin is a service that runs a pack: declared `type: 'twin'`, or untyped and spawning a pack's module (never an
+  // untyped command of the application's)
+  if (twin) delete env.NODE_ENV;
   const out: Record<string, string> = { ...env, ...(service.env ?? {}) };
   // the application's own origin: the World's own application service is reached where it listens (the URL
   // `volter-world app-url` answers for it); any other service never reads it, and a command resolves it at attach
@@ -1273,6 +1292,7 @@ async function startExternalService(
   service: WorldServiceConfig,
   paths: { root: string; logs: string },
   worldEnv: Record<string, string>,
+  required: RequiredCredentialClaims,
   stripEnv?: string[],
   boot?: BootContext,
 ): Promise<WorldServiceInstance> {
@@ -1281,6 +1301,7 @@ async function startExternalService(
   const log = ownedPath(paths.logs, `${service.id}.log`);
   const cwd = service.cwd ? resolve(paths.root, service.cwd) : paths.root;
   const env = externalServiceEnv(service, paths, worldEnv, stripEnv);
+  if (!ownInfrastructureService(service)) assertRequiredCredentials(required, env, `external service ${service.id}`);
 
   // 1. up — start the self-managed stack, STREAMING its output to the service log (no 1MB cap).
   if (!external.up[0] || !commandExists(external.up[0])) {
@@ -1411,8 +1432,11 @@ async function startService(
   paths: { root: string; instance: string; logs: string; data: string },
   allocatedPorts: Set<number>,
   boot: BootContext,
+  required: RequiredCredentialClaims,
 ): Promise<WorldServiceInstance> {
-  if (service.type === 'external') return startExternalService(service, paths, worldEnv, config.stripEnv, boot);
+  if ((service.type ?? 'twin') !== 'twin' && !ownInfrastructureService(service))
+    assertRequiredCredentials(required, worldEnv, `service ${service.id}`);
+  if (service.type === 'external') return startExternalService(service, paths, worldEnv, required, config.stripEnv, boot);
   if (!service.command) throw new Error(`Service "${service.id}" must define command`);
   const port = service.port === undefined || service.port === 'auto' ? await allocatePort(allocatedPorts) : service.port;
   const serviceDataDir = ownedPath(paths.data, service.id);
@@ -1433,7 +1457,7 @@ async function startService(
   if (service.rootArg !== false) args.push(service.rootArg ?? '--root', serviceDataDir);
 
   const log = ownedPath(paths.logs, `${service.id}.log`);
-  const env = serviceProcessEnv(config, service, worldEnv, port);
+  const env = serviceProcessEnv(config, service, worldEnv, port, service.type === 'twin' || (service.type === undefined && spawnedModule !== undefined));
   const cwd = service.cwd ? resolve(paths.root, service.cwd) : paths.root;
 
   // Augment NODE_OPTIONS with declared extra preloads, so a service can add an app-local preload
@@ -1447,7 +1471,9 @@ async function startService(
   // The service runs under the service recorder, which outlives it to write its end into its own log: `up`
   // returns once the World is ready, so nothing else is left to see a service stop.
   env.VOLTER_WORLD_BOOT_ID = boot.bootId;
-  const { child, ended, identity } = spawnRecorded(service.id, service.command, args, cwd, env, log, boot);
+  if ((service.type ?? 'twin') !== 'twin' && !ownInfrastructureService(service))
+    assertRequiredCredentials(required, env, `service ${service.id}'s effective environment`);
+  const { child, ended, identity } = spawnRecorded(service.id, service.command, args, cwd, env, log, boot, (service.type ?? 'twin') === 'twin' ? undefined : required);
   child.once('error', error => boot.fail(error));
   child.unref();
   await trackBootingChild(child, boot, identity);
@@ -1497,7 +1523,8 @@ async function startService(
 
   // Optional readiness probe beyond TCP (httpUrl/command): a process can bind its port
   // before it is actually serving, so this makes `up` wait until the service truly responds.
-  if (service.ready && service.ready !== 'tcp') {
+  // `ready: { timeoutMs }` with neither is TCP readiness with its own budget: the bind wait above has used it.
+  if (service.ready && service.ready !== 'tcp' && (service.ready.command !== undefined || service.ready.httpUrl !== undefined)) {
     const readiness = await untilReadyOrEnded((abort) => awaitReadiness(resolveReadyProbe(service.ready as Exclude<typeof service.ready, 'tcp' | undefined>, { host, port, url }), cwd, service.id, env, abort), ended, boot, 'the service', log).catch(async (error) => {
       if (undeadPids([child.pid!]).length) recordWorldStop([log], 'world.service.stop', 'up (startup failed)', 'SIGTERM');
       try { await signalHeldChild(child, 'SIGTERM', true, identity); } catch { /* best effort cleanup */ }
@@ -1645,6 +1672,87 @@ function takeIssued(env: Record<string, string>): Map<string, string> {
  *  own store, in milliseconds; this bounds a hung twin, not a slow one). */
 const ISSUE_TIMEOUT_MS = 15_000;
 
+/** Each required name belongs to this boot and gains a value only from its owner's scalar door response. */
+type RequiredCredentialClaims = Map<string, { service: string; value: string | undefined }>;
+
+function requiredCredentialClaims(config: WorldConfig): RequiredCredentialClaims {
+  const required: RequiredCredentialClaims = new Map();
+  for (const service of config.services) for (const name of service.issues?.required ?? [])
+    required.set(name, { service: service.id, value: undefined });
+  return required;
+}
+
+/** Bind names and owners to the actual values retained in instance.env; the hash is not vendor authentication. */
+function requiredCredentialValuesDigest(required: RequiredCredentialClaims): string {
+  const rows = [...required.keys()].sort().map(name => {
+    const claim = required.get(name)!;
+    if (claim.value === undefined) throw new Error(`${name}: no issued value exists to retain`);
+    return [name, claim.service, claim.value];
+  });
+  return createHash('sha256').update(JSON.stringify(rows)).digest('hex');
+}
+
+/** New boots retain their required owners even if source config later changes; legacy optional records gain no proof. */
+function recordedRequiredCredentialClaims(instance: WorldInstance): RequiredCredentialClaims {
+  const required: RequiredCredentialClaims = new Map();
+  if (!Object.hasOwn(instance, 'requiredCredentials')) throw new Error('World boot has no retained credential requirement declaration; finish teardown with its owning runtime and boot with this runtime before attachment');
+  const raw: unknown = instance.requiredCredentials;
+  if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) throw new Error('World required credential record is invalid');
+  const record = raw as Record<string, unknown>;
+  if (Object.keys(record).some(key => !['version', 'owners', 'valuesSha256'].includes(key))
+    || !Object.hasOwn(record, 'version') || record.version !== 1 || !Object.hasOwn(record, 'owners') || record.owners === null
+    || typeof record.owners !== 'object' || Array.isArray(record.owners))
+    throw new Error('World required credential record has an unsupported version or shape');
+  if (!instance.env || typeof instance.env !== 'object' || Array.isArray(instance.env)
+    || !instance.services || typeof instance.services !== 'object' || Array.isArray(instance.services))
+    throw new Error('World required credential record lacks its retained environment or services');
+  for (const [name, owner] of Object.entries(record.owners as Record<string, unknown>)) {
+    if (!isEnvironmentName(name) || typeof owner !== 'string' || !owner || !Object.hasOwn(instance.services, owner))
+      throw new Error(`World required credential owner is invalid for ${name}`);
+    const service = instance.services[owner];
+    if (!service || service.id !== owner || service.type !== 'twin') throw new Error(`World required credential ${name} names no twin owner`);
+    const value = instance.env[name];
+    if (!Object.hasOwn(instance.env, name) || typeof value !== 'string'
+      || value.startsWith(ISSUE_ENV_PREFIX) || value === APP_URL_ENV)
+      throw new Error(`World required credential ${name} has no retained scalar value`);
+    required.set(name, { service: owner, value });
+  }
+  if (!Object.hasOwn(record, 'valuesSha256')) {
+    if (required.size) throw new Error('World required credential issuance has not completed; refusing attachment');
+    return required;
+  }
+  if (typeof record.valuesSha256 !== 'string' || !/^[0-9a-f]{64}$/.test(record.valuesSha256)
+    || record.valuesSha256 !== requiredCredentialValuesDigest(required))
+    throw new Error('World required credential names, owners or retained values changed; refusing attachment');
+  return required;
+}
+
+/** Capture the validated boot's values before an owned executor applies its own environment layers. */
+export function worldRequiredCredentialGate(instance: WorldInstance): (env: NodeJS.ProcessEnv, boundary: string) => void {
+  const required = recordedRequiredCredentialClaims(instance);
+  return (env, boundary) => assertRequiredCredentials(required, env, boundary);
+}
+
+/** These transports do not carry required ownership/value authority; refuse instead of exporting an optional-only rendering. */
+export function refuseRequiredCredentialTransport(instance: WorldInstance, transport: string, code?: 'WORLD_MACHINE_CAPABILITY_GAP'): void {
+  const required = recordedRequiredCredentialClaims(instance);
+  if (required.size) {
+    const error = new Error(`World ${instance.name}: ${transport} does not carry required credential bindings (${[...required.keys()].join(', ')}); use local env attachment`);
+    throw code ? Object.assign(error, { code }) : error;
+  }
+}
+
+/** Check the actual response value, then the environment this boundary will use; never print credential values. */
+function assertRequiredCredentials(required: RequiredCredentialClaims, env: NodeJS.ProcessEnv, boundary: string): void {
+  const failures: Error[] = [];
+  for (const [name, claim] of required) {
+    if (claim.value === undefined) failures.push(new Error(`${name}: ${claim.service} has not issued its required scalar credential`));
+    else if (!Object.hasOwn(env, name) || env[name] !== claim.value)
+      failures.push(new Error(`${name}: its issued value is missing or overridden at ${boundary}`));
+  }
+  if (failures.length) throw new AggregateError(failures, `World required credential gate refused at ${boundary}: ${failures.map(reason => errorMessage(reason)).join('; ')}`);
+}
+
 /** Where one credential ask's time went (S2, the twins' credentials): performance.now() at each step, read by the caller
  *  against its own origin. `door` is the pack's door read, `sent` the request handed to fetch, `headers` its answer's
  *  status, `answered` its body parsed, `filled` every name set or said unset. Door→sent and answered→filled include synchronous placeholder-pull
@@ -1653,22 +1761,33 @@ type CredentialAskTimes = { twin?: string; names?: number; door?: number; sent?:
 
 /** A twin's issued credential (its `issues`, copied from its pack's credentialDoor by init): once it is up, the door is
  *  asked for one and each pending name of that service is set to it. A twin that answers no credential, or has no
- *  door, leaves the names unset and says so, rather than handing the application a fixture the twin would refuse. */
-async function issueCredentials(service: WorldServiceConfig, started: WorldServiceInstance, env: Record<string, string>, pending: Map<string, string>, unissued: Set<string>, controlRoot: string, times?: CredentialAskTimes): Promise<void> {
+ *  door, leaves optional names unset and says so. Required scalar names fail the boot with their original reasons. */
+async function issueCredentials(service: WorldServiceConfig, started: WorldServiceInstance, env: Record<string, string>, pending: Map<string, string>, unissued: Set<string>, controlRoot: string, claims: RequiredCredentialClaims, fresh: boolean, times?: CredentialAskTimes): Promise<void> {
   const direct = new Set([...pending].filter(([, id]) => id === `${service.id}@direct`).map(([name]) => name));
   const wanted = [...pending].filter(([name, id]) => id === service.id || direct.has(name)).map(([name]) => name);
   if (times) { times.names = wanted.length; }
+  const required = new Set(service.issues?.required ?? []);
+  const failures: Error[] = [];
+  for (const name of required) {
+    if (!wanted.includes(name) || direct.has(name) || claims.get(name)?.service !== service.id)
+      failures.push(new Error(`${name}: its exact $issue:${service.id} scalar request is absent at issuance`));
+  }
+  if (failures.length) throw new AggregateError(failures, `World service ${service.id}: required credential requests refused: ${failures.map(reason => errorMessage(reason)).join('; ')}`);
   if (wanted.length === 0) return;
   for (const name of wanted) pending.delete(name);
-  // the pack's door as it stands now (a door the pack fixed since the World was made reaches it), else the saved copy
-  let door = service.issues;
-  try { door = packFacts()[service.id]?.credentialDoor ?? door; } catch { /* no artifact: the saved copy */ }
+  // Revalidate aliases at the actual issuance boundary. A missing current pack door cannot revive a saved issuer.
+  const door = (service.type ?? 'twin') === 'twin'
+    ? withCurrentCredentialDoor(service, packFacts()[service.id]?.credentialDoor).issues : service.issues;
   if (times) times.door = performance.now();
   try {
     if (!door) throw new Error('its service names no credential door');
     if (!started.url) throw new Error('it has no URL to ask');
-    // A boot's identity is existing account state, not an application write to deploy.
-    const enclosingSeed = placeholderPullActive(service.id, controlRoot);
+    // A boot's identity is existing account state, not an application write to deploy: asked inside the twin's
+    // placeholder-pull window, as the seed is (architecture, the descriptor's credentialDoor), on a fresh World's first
+    // issuance only: a resumed World's door answers what it issued before, and its branch keeps its own writes; a twin
+    // with a root is not seeded, and its door's writes stay its own
+    const seeds = fresh && !(service as { root?: unknown }).root;
+    const enclosingSeed = !seeds || placeholderPullActive(service.id, controlRoot);
     if (!enclosingSeed) beginPlaceholderPull(service.id, controlRoot);
     let answer: Record<string, unknown>;
     try {
@@ -1769,7 +1888,11 @@ async function issueCredentials(service: WorldServiceConfig, started: WorldServi
         continue;
       }
       const field = spec;
+      if (required.has(name) && (!isScalarCredentialField(field) || answer === null || typeof answer !== 'object'
+        || Array.isArray(answer) || !Object.hasOwn(answer, field))) throw new Error(`answered no own scalar ${field}`);
       const value = answer[field];
+      if (required.has(name) && typeof value === 'string' && (value.startsWith(ISSUE_ENV_PREFIX) || value === APP_URL_ENV))
+        throw new Error(`answered an interpreted environment marker for ${field}`);
       if (typeof value !== 'string') throw new Error(`answered no ${field}`);
       if (direct.has(name)) {
         const issued = new URL(value);
@@ -1779,9 +1902,19 @@ async function issueCredentials(service: WorldServiceConfig, started: WorldServi
         issued.host = endpoint.host;
         env[name] = issued.toString();
       } else env[name] = value;
+      if (required.has(name)) {
+        const claim = claims.get(name);
+        if (!claim || claim.service !== service.id) throw new Error('its required credential owner changed');
+        claim.value = value;
+      }
       } catch (error) {
-        process.stderr.write(`volter-world: ${service.id} did not issue ${name} (${errorMessage(error)}${typeof answer.codex_unavailable === 'string' ? `; the twin says: ${answer.codex_unavailable.slice(0, 300)}` : ''}); left unset\n`);
+        process.stderr.write(`volter-world: ${service.id} did not issue ${name} (${errorMessage(error)}${typeof answer?.codex_unavailable === 'string' ? `; the twin says: ${answer.codex_unavailable.slice(0, 300)}` : ''}); left unset\n`);
         delete env[name]; unissued.add(name);
+        if (required.has(name)) {
+          const claim = claims.get(name);
+          if (claim) claim.value = undefined;
+          failures.push(new Error(`${name}: ${service.id} did not issue its required credential (${errorMessage(error)})`, { cause: error }));
+        }
       }
     }
     if (started.url) {
@@ -1793,8 +1926,14 @@ async function issueCredentials(service: WorldServiceConfig, started: WorldServi
   } catch (error) {
     process.stderr.write(`volter-world: ${service.id} did not issue ${wanted.join(', ')} (${errorMessage(error)}); left unset\n`);
     for (const name of wanted) { delete env[name]; unissued.add(name); }
+    for (const name of required) {
+      const claim = claims.get(name);
+      if (claim) claim.value = undefined;
+      failures.push(new Error(`${name}: ${service.id}'s required credential ask failed (${errorMessage(error)})`, { cause: error }));
+    }
   }
   if (times) times.filled = performance.now();
+  if (failures.length) throw new AggregateError(failures, `World service ${service.id}: required credential issuance refused: ${failures.map(reason => errorMessage(reason)).join('; ')}`);
 }
 
 function materializeConfig(config: WorldConfig, root: string): WorldConfig {
@@ -1906,6 +2045,8 @@ async function startColocatedServices(
   // the twins never read the application's own origin, nor a credential not yet issued
   for (const [key, value] of Object.entries(env)) if (value === APP_URL_ENV) delete env[key];
   dropUnissued(env);
+  // the colocated twins' host runs the World's own servers: the application's NODE_ENV is not theirs (serviceProcessEnv)
+  delete env.NODE_ENV;
   env.VOLTER_WORLD_BOOT_ID = boot.bootId;
   const spawnedAt = Date.now();
   // Under the same exit recorder as a process service, so the host's end (and every twin it holds) is in host.log.
@@ -1946,7 +2087,7 @@ async function startColocatedServices(
   });
   const ready = (async (): Promise<void> => {
     const hostTimeoutMs = allocated.reduce((timeout, { service }) => Math.max(timeout, typeof service.ready === 'object' ? service.ready.timeoutMs ?? 15_000 : 15_000), 15_000);
-    const hostTimes = await untilReadyOrEnded((abort) => waitForHostReady(readyFile, boot.bootId, new Map(allocated.map(({ service, port }) => [service.id, port])), hostTimeoutMs, abort, () => { try { return statSync(log).size; } catch { return 0; } }), ended, boot, 'the co-located host', log).catch(async (error) => {
+    const hostTimes = await untilReadyOrEnded((abort) => waitForHostReady(readyFile, boot.bootId, new Map(allocated.map(({ service, port }) => [service.id, port])), hostTimeoutMs, abort, () => startedTwins(log)), ended, boot, 'the co-located host', log).catch(async (error) => {
       if (undeadPids([child.pid!]).length) recordWorldStop([log], 'world.service.stop', 'up (host startup incomplete)', 'SIGTERM');
       try { await signalHeldChild(child, 'SIGTERM', true, identity); } catch { /* best effort cleanup */ }
       throw new Error(`Co-located host failed to complete startup (isolation=${isolation}): ${errorMessage(error)}\nLog: ${log}`);
@@ -2051,6 +2192,11 @@ async function upWorldRecorded(configId: string, options: UpWorldOptions, abort:
   // instead of loading and rebuilding a second facts/host table on every empty up.
   if (packFactsPaths.length) createRequire(import.meta.url)('@volter/world-core/pack-facts').extendPackFacts(packFactsPaths);
   const loaded = { path: found.path, config: materializeConfig(found.config, root) };
+  // Before any output claim or lifecycle write, every saved alias fits the actual current pack.
+  loaded.config.services = loaded.config.services.map(service => (service.type ?? 'twin') === 'twin'
+    ? withCurrentCredentialDoor(service, packFacts()[service.id]?.credentialDoor) : service);
+  assertRequiredCredentialBindings(loaded.config, found.path);
+  const required = requiredCredentialClaims(loaded.config);
   const name = options.name ?? loaded.config.id;
   const mode = options.mode ?? 'local';
   assertSafeWorldName(name);
@@ -2155,7 +2301,6 @@ async function upWorldRecorded(configId: string, options: UpWorldOptions, abort:
       // Verified teardown is independent of record shape. A fresh boot discards incomplete metadata.
       if (existsSync(instanceFile)) {
         let prior: WorldInstance | undefined;
-        if (options.keepState) prior = readWorldBootRecordLocked(name, root);
         const priorRaw = readFileSync(instanceFile, 'utf8');
         const receiptPath = join(instance, 'stopped.json');
         const receipt = existsSync(receiptPath) ? JSON.parse(readFileSync(receiptPath, 'utf8')) : undefined;
@@ -2163,6 +2308,13 @@ async function upWorldRecorded(configId: string, options: UpWorldOptions, abort:
           || !Number.isFinite(Date.parse(receipt.stoppedAt))) {
           throw new Error(`World "${name}" has no verified teardown receipt for its prior instance; use its owning runtime to complete cleanup before replacement`);
         }
+        // a resume reads the record its last boot completed; a boot that failed and was rolled back (the receipt above)
+        // completed none, and the resume writes a complete one over the kept state (architecture, the boot record)
+        let priorIncomplete = false;
+        if (options.keepState) {
+          try { prior = readWorldBootRecordLocked(name, root); }
+          catch { priorIncomplete = true; }
+        }
         if (!prior) { try { prior = JSON.parse(priorRaw) as WorldInstance; } catch { /* fresh boot needs no retained shape */ } }
         if (prior) {
           // A readable ceiling remains useful even when unrelated metadata is incomplete.
@@ -2175,7 +2327,7 @@ async function upWorldRecorded(configId: string, options: UpWorldOptions, abort:
             }
             const ceiling = recordedWorldNetwork(permissionRecord);
             if (ceiling !== undefined) carriedNetwork = carriedNetwork === undefined ? ceiling : intersectWorldNetwork(carriedNetwork, ceiling);
-          } catch { if (options.keepState) throw new Error(`World boot record is incomplete or invalid: ${instanceFile}`); }
+          } catch { if (options.keepState && !priorIncomplete) throw new Error(`World boot record is incomplete or invalid: ${instanceFile}`); }
         }
         // the origin belongs to the World, not to its running state (git: a remote outlives every checkout): an up of the
         // same config carries the one the last left while world.json's `origin` remote still names it (`remote remove`
@@ -2277,7 +2429,10 @@ async function upWorldRecorded(configId: string, options: UpWorldOptions, abort:
     const unissued = new Set<string>();
     writeProxyEnv(root, name, env);
 
+    const requiredCredentials: NonNullable<WorldInstance['requiredCredentials']> = { version: 1,
+      owners: Object.fromEntries([...required].map(([name, claim]) => [name, claim.service])) };
     const worldInstance: WorldInstance = {
+      requiredCredentials,
       name, instance: instanceToken, config: loaded.config.id, configPath: loaded.path, root, createdAt, mode,
       dirs: { instance, logs, data }, services, env, envFile, pidsFile,
       ...(envOutputClaim.contents === undefined ? {} : { previousEnvOutput: { path: envFile, sha256: createHash('sha256').update(envOutputClaim.contents).digest('hex') } }),
@@ -2352,14 +2507,15 @@ async function upWorldRecorded(configId: string, options: UpWorldOptions, abort:
           // own sent and status says that twin's door.
           const origin = performance.now();
           const steps: Array<{ id: string; queued: number; times: CredentialAskTimes }> = [];
-          const asks = await Promise.all(host.services.map(async (started) => {
+          // A descriptor refusal still settles every owned ask before rollback can retire its custody.
+          const asks = await Promise.allSettled(host.services.map(async (started) => {
             const declared = colocated.find((s) => s.id === started.id);
             if (!declared) return undefined;
             const began = performance.now();
             const times: CredentialAskTimes = { ...(declared.package ? { twin: declared.package } : {}) };
             steps.push({ id: started.id, queued: began, times });
             const own: Record<string, string> = { ...before };
-            await issueCredentials(declared, started, own, issuing, unissued, ownedPath(data, started.id), times);
+            await issueCredentials(declared, started, own, issuing, unissued, ownedPath(data, started.id), required, !options.keepState, times);
             return { id: started.id, ms: Math.round(performance.now() - began), own };
           }));
           const at = (time: number | undefined): string => time === undefined ? '-' : `+${Math.round(time - origin)}`;
@@ -2368,13 +2524,17 @@ async function upWorldRecorded(configId: string, options: UpWorldOptions, abort:
             .sort((left, right) => (right.times.filled ?? 0) - (left.times.filled ?? 0))
             .map(({ id, queued, times }) => `${id}${times.twin ? ` (${times.twin})` : ''} ${at(queued)}/${at(times.door)}/${at(times.sent)}/${at(times.headers)}/${at(times.answered)}/${at(times.filled)}`).join('; ')}`);
           const asked: Array<{ id: string; ms: number }> = [];
-          for (const ask of asks) {
+          const failures: unknown[] = [];
+          for (const result of asks) {
+            if (result.status === 'rejected') { failures.push(result.reason); continue; }
+            const ask = result.value;
             if (!ask) continue;
             for (const [key, value] of Object.entries(ask.own)) if (before[key] !== value) env[key] = value;
             for (const key of Object.keys(before)) if (!Object.hasOwn(ask.own, key)) delete env[key];
             asked.push({ id: ask.id, ms: ask.ms });
           }
           if (asked.length) boot.progress(`co-located twins: each asked for its credentials at once, slowest first: ${[...asked].sort((left, right) => right.ms - left.ms).slice(0, 6).map((each) => `${each.id} ${each.ms} ms`).join(', ')}; ${asked.length} asked, ${Math.max(...asked.map((each) => each.ms))} ms the longest`);
+          if (failures.length) throw new AggregateError(failures, `World credential issuance refused: ${failures.map(reason => errorMessage(reason)).join('; ')}`);
           writeProxyEnv(root, name, env);
           if (colocated.length) boot.progress('co-located twins: credentials issued, proxy environment written');
         };
@@ -2387,7 +2547,7 @@ async function upWorldRecorded(configId: string, options: UpWorldOptions, abort:
       for (const service of loaded.config.services) {
         if (services[service.id] || !ownInfrastructureService(service)) continue;
         boot.progress(`${service.id}: starting beside the host (the runtime's own infrastructure)`);
-        const starting = startService(loaded.config, service, { ...env }, { root, instance, logs, data }, allocatedPorts, boot);
+        const starting = startService(loaded.config, service, { ...env }, { root, instance, logs, data }, allocatedPorts, boot, required);
         starting.catch((error: unknown) => boot.fail(error instanceof Error ? error : new Error(errorMessage(error))));
         early.set(service.id, starting);
       }
@@ -2429,18 +2589,20 @@ async function upWorldRecorded(configId: string, options: UpWorldOptions, abort:
         attemptProxy();
         boot.signal.throwIfAborted();
         if (!starting) boot.progress(`${service.id}: starting (${service.type ?? 'twin'})`);
-        const started = await (starting ?? startService(loaded.config, service, env, { root, instance, logs, data }, allocatedPorts, boot));
+        const started = await (starting ?? startService(loaded.config, service, env, { root, instance, logs, data }, allocatedPorts, boot, required));
         // An early start published its teardown when it began; its record moves to its declared position.
         if (starting) delete services[service.id];
         recordService(started);
         recordPidsSoFar();
         Object.assign(env, started.env);
-        await issueCredentials(service, started, env, issuing, unissued, ownedPath(data, started.id));
+        await issueCredentials(service, started, env, issuing, unissued, ownedPath(data, started.id), required, !options.keepState);
         writeProxyEnv(root, name, env);
         boot.progress(`${service.id}: started, its environment merged`);
       }
       if (colocatedReady) await colocatedReady();
-      detachBootSignals();
+      // An abort records its reason while the final owned credential asks settle. No later service may remain
+      // to observe it, so completion itself must reject it before publishing a successful environment.
+      boot.signal.throwIfAborted();
       // a name a service of no twin in this World issues (a config edited after init) is left unset, and said
       if (issuing.size > 0) process.stderr.write(`volter-world: nothing in this World issues ${[...issuing].map(([n, id]) => `${n} ($issue:${id})`).join(', ')}; left unset\n`);
       for (const [name] of issuing) unissued.add(name);
@@ -2450,6 +2612,7 @@ async function upWorldRecorded(configId: string, options: UpWorldOptions, abort:
       // next service" never fires when there is no next service (TWIN-64) — the single-twin sealed
       // config test below exercises exactly this.
       attemptProxy();
+      assertRequiredCredentials(required, env, 'World environment publication');
       // Inert-injectEnv check (LibreChat blind-adoption finding): an injectEnv like AWS_TWIN_URL
       // lands in the world env, LOOKS wired, and does nothing — the injector reads no such vendor.
       // Warn loudly at `up`, when the operator is watching, instead of letting the disagreement
@@ -2458,6 +2621,12 @@ async function upWorldRecorded(configId: string, options: UpWorldOptions, abort:
         process.stderr.write(`${warning}\n`);
       }
 
+      // This can await the browser materializer's import. Keep boot cancellation attached through that work,
+      // and do not persist completed credential claims or publish the environment until it has finished.
+      await materializeWorldBrowserFiles(data, root, name, loaded.config.id);
+      boot.signal.throwIfAborted();
+      assertRequiredCredentials(required, env, 'World environment publication');
+      requiredCredentials.valuesSha256 = requiredCredentialValuesDigest(required);
       mkdirSync(dirname(envFile), { recursive: true });
       // Config env and discovered credentials: a file this writes is owner-only; a file the caller already made keeps
       // the mode the caller chose (a shared env file may be read under another uid).
@@ -2468,11 +2637,12 @@ async function upWorldRecorded(configId: string, options: UpWorldOptions, abort:
       delete worldInstance.previousEnvOutput;
       saveWorldInstance(worldInstance);
       boot.progress(`environment written: ${envFile}`);
-      await materializeWorldBrowserFiles(data, root, name, loaded.config.id);
       writePidsFromInstance(worldInstance, Object.values(worldInstance.services).map((service) => service.pid).filter((pid) => pid > 0));
       saveWorldInstance(worldInstance);
       const servicePids = [...new Set(Object.values(services).map((service) => service.pid).filter((pid) => pid > 0))];
+      boot.signal.throwIfAborted();
       handoffWorldLifecycle(root, name, servicePids);
+      detachBootSignals();
       boot.progress(`returning: the World is up; ${lag.account()}`);
       if (mode === 'share') {
         try {
@@ -2692,6 +2862,24 @@ function killHeldSurvivorsSync(child: ReturnType<typeof spawn>, graceMs: number)
  *    purge leaves that lock alone; its owner's finally releases it, so waiting claimants never
  *    enter through a replacement lock while the original is still held.
  */
+/** A purged World's env output outside its folder (architecture, "World environment exports are outputs"): removed with
+ *  the record that proved it the World's own, when it still holds exactly the World's exports as a single-link regular
+ *  file and no other World of the root records that path; anything else stays. */
+function purgeEnvOutput(root: string, name: string, purged: string, instance: WorldInstance): void {
+  const path = typeof instance.envFile === 'string' ? resolve(instance.envFile) : undefined;
+  if (!path || !relative(purged, path).startsWith('..')) return;
+  const others = existsSync(worldBaseDir(root)) ? readdirSync(worldBaseDir(root)).filter((world) => world !== name && /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(world)) : [];
+  const shared = others.some((world) => {
+    try { return resolve((JSON.parse(readFileSync(join(instanceDir(root, world), 'instance.json'), 'utf8')) as WorldInstance).envFile) === path; } catch { return false; }
+  });
+  if (shared) return;
+  try {
+    const named = lstatSync(path);
+    if (!named.isFile() || named.nlink !== 1 || !readFileSync(path).equals(Buffer.from(envFileContents(instance.env)))) return;
+    rmSync(path);
+  } catch { /* no output, or one the World cannot read: it stays */ }
+}
+
 function purgeInstanceDir(root: string, name: string): string {
   assertSafeWorldName(name);
   const base = worldBaseDir(root);
@@ -2922,6 +3110,7 @@ async function downWorldClaimed(
     if (!options.purge) return result;
     const purged = purgeInstanceDir(resolvedRoot, name);
     if (purged && instance) clearBrowserFiles!(instance.dirs.data, resolvedRoot);
+    if (purged && instance) purgeEnvOutput(resolvedRoot, name, purged, instance);
     return { ...result, ...(externalAbandoned ? { externalAbandoned } : {}), purged };
   }));
 }
@@ -3597,6 +3786,14 @@ export async function doctorWorld(name: string, options: { root?: string; verify
   checks.push({ id: 'startup', ok: missingServices.length === 0, message: missingServices.length
     ? `startup incomplete: no ready service record for ${missingServices.join(', ')}; retained state requires normal teardown before resume`
     : 'declared boot services have instance records' });
+  // a vendor-backed root whose vendor rotated its refresh token while the seal failed (world-core head.ts
+  // unsealedMarkerOf): it renews only inside the process that held the new one, so a person must seal it again
+  const credentialDir = join(root, stateDirName(), 'credentials');
+  for (const file of existsSync(credentialDir) ? readdirSync(credentialDir).filter((f) => f.endsWith('.unsealed.json')).sort() : []) {
+    let said = '';
+    try { const r = JSON.parse(readFileSync(join(credentialDir, file), 'utf8')) as { field?: string; at?: string; cause?: string }; said = `: ${r.field ?? 'a field'} rotated at ${r.at ?? '?'} was not sealed (${r.cause ?? 'no cause recorded'})`; } catch { /* the marker's presence is the finding */ }
+    checks.push({ id: `root-${file.replace(/\.unsealed\.json$/, '')}`, ok: false, message: `the root's credential lost a rotation${said}; seal it again before its process ends` });
+  }
 
   if (instance.lifecycle) {
     checks.push({ id: 'lifecycle', ok: hasWorldLifecycle(root, name) && existsSync(instance.lifecycle.log),
@@ -3888,8 +4085,9 @@ export function listWorlds(root = process.cwd()): Array<{ name: string; running:
     .sort((a, b) => a.name.localeCompare(b.name));
 }
 
-function worldAttachedCommandEnv(name: string, root: string, verbose = false, instance?: WorldInstance): { instance: WorldInstance; env: NodeJS.ProcessEnv } {
+function worldAttachedCommandEnv(name: string, root: string, verbose = false, instance?: WorldInstance): { instance: WorldInstance; env: NodeJS.ProcessEnv; required: RequiredCredentialClaims } {
   const status = instance ?? statusWorld(name, root);
+  const required = recordedRequiredCredentialClaims(status);
   const sealed = status.env.VOLTER_WORLD_MODE === 'sealed' || status.env[WORLD_NETWORK_POLICY_ENV] !== undefined;
   const baseEnv = { ...admittedEnv(stripEnvOf(status.env)), ...status.env };
   let proxyEnv: Record<string, string> = {};
@@ -3904,8 +4102,10 @@ function worldAttachedCommandEnv(name: string, root: string, verbose = false, in
     if (sealed && hostHasRawEgress()) throw new Error(`world "${name}" requires its network policy proxy: attachment proxy failed; refusing to run the command (${errorMessage(error)})`);
     // Keep env-only redirect if the ambient proxy cannot start.
   }
-  return { instance: status, env: withAppUrl(name, root, { ...baseEnv, ...proxyEnv, VOLTER_WORLD: name,
-    VOLTER_TWIN_INJECT_QUIET: verbose ? '0' : baseEnv.VOLTER_TWIN_INJECT_QUIET ?? '1' }) };
+  const env = withAppUrl(name, root, { ...baseEnv, ...proxyEnv, VOLTER_WORLD: name,
+    VOLTER_TWIN_INJECT_QUIET: verbose ? '0' : baseEnv.VOLTER_TWIN_INJECT_QUIET ?? '1' });
+  assertRequiredCredentials(required, env, 'command attachment');
+  return { instance: status, env, required };
 }
 
 /** The env with each `$app-url` value made the application URL its booter recorded. Unrecorded, the name is left
@@ -3929,10 +4129,12 @@ export function withAppUrl<E extends Record<string, string | undefined>>(name: s
 export function runWithWorldEnv(name: string, command: string[], root = process.cwd(), options: { cwd?: string; verbose?: boolean; env?: Record<string, string> } = {}): Promise<number> {
   if (command.length === 0) throw new Error('Missing command after --');
   const attached = worldAttachedCommandEnv(name, root, options.verbose);
+  const env = { ...attached.env, ...(options.env ?? {}) };
+  assertRequiredCredentials(attached.required, env, 'SDK command environment');
   return new Promise((resolveExit) => {
     const child = spawn(command[0]!, command.slice(1), { windowsHide: true,
       cwd: resolve(options.cwd ?? root),
-      env: { ...attached.env, ...(options.env ?? {}) },
+      env,
       stdio: 'inherit',
     });
     const forward = (signal: NodeJS.Signals) => {
@@ -3998,6 +4200,8 @@ export async function attachWorld(name: string, command: string[], root = proces
     // Which of the two it was, with what was read: "stopped" and "another instance" are different repairs.
     if (!current.running) throw new Error(`World "${name}" is not running while attaching: none of its recorded processes is live and its own (recorded pids ${readPids(current.pidsFile).join(', ') || 'none'}; live and its own: none); ${describeWorldLifecycle(resolvedRoot, name, current.createdAt)})`);
     if (current.createdAt !== attached.instance.createdAt) throw new Error(`World "${name}" changed while attaching: its instance was created ${attached.instance.createdAt} when the command's environment was read and ${current.createdAt} now`);
+    // A supplied instance is a snapshot, not authority to erase the current boot's required bindings.
+    assertRequiredCredentials(recordedRequiredCredentialClaims(current), attached.env, 'registered command attachment');
     // Attaching to a World whose services died is allowed (a command may not need them), but never silent.
     for (const [id, state] of Object.entries(current.serviceStates)) {
       if (state === 'running' || state === 'external') continue;
@@ -4139,13 +4343,21 @@ async function runWithWorldEnvLogged(name: string, command: string[], root: stri
  * TLS-proxy env (HTTPS_PROXY + the CA-trust vars) is layered in by `shellWorld` once the proxy is up,
  * since starting a server is async; this pure helper stays synchronous + side-effect-free for tests. */
 export function worldShellEnv(name: string, root = process.cwd()): { shell: string; cwd: string; env: Record<string, string> } {
+  const { shell, cwd, env } = worldShellContext(name, root);
+  return { shell, cwd, env };
+}
+
+/** Keep the boot's required proof with the shell environment until its proxy transformations have finished. */
+function worldShellContext(name: string, root: string): { shell: string; cwd: string; env: Record<string, string>; required: RequiredCredentialClaims } {
   const status = statusWorld(name, root);
   if (!status.running) throw new Error(`World "${name}" is not running — run: volter-world up <config> --env-out <path> --name ${name}`);
-  return {
-    shell: status.env.SHELL || admittedEnv(stripEnvOf(status.env)).SHELL || '/bin/bash',
-    cwd: resolve(root),
-    env: withAppUrl(name, root, { ...admittedEnv(stripEnvOf(status.env)), ...status.env, VOLTER_WORLD: name } as Record<string, string>),
-  };
+  const required = recordedRequiredCredentialClaims(status);
+  const env = withAppUrl(name, root, { ...admittedEnv(stripEnvOf(status.env)), ...status.env, VOLTER_WORLD: name } as Record<string, string>);
+  assertRequiredCredentials(required, env, 'shell environment');
+  // Windows has no /bin/bash: its shell is the one ComSpec names (cmd.exe), kept by the Windows baseline (admittedEnv).
+  const inherited = admittedEnv(stripEnvOf(status.env));
+  const fallback = process.platform === 'win32' ? (inherited.ComSpec ?? inherited.COMSPEC ?? process.env.ComSpec ?? 'cmd.exe') : '/bin/bash';
+  return { shell: status.env.SHELL || inherited.SHELL || fallback, cwd: resolve(root), env, required };
 }
 
 /** Drop into an interactive subshell with the world active — the contained sibling of `activate`
@@ -4155,7 +4367,7 @@ export function worldShellEnv(name: string, root = process.cwd()): { shell: stri
  * land in the twins; `exit` restores normal (the proxy + its session CA are torn down). The CA is
  * trusted ONLY via this subshell's env — never installed system-wide. See docs/guides/route-a-cli-through-the-world.md. */
 export async function shellWorld(name: string, root = process.cwd()): Promise<number> {
-  const { shell, cwd, env } = worldShellEnv(name, root);
+  const { shell, cwd, env, required } = worldShellContext(name, root);
   const resolvedRoot = resolve(root);
   let proxy: Awaited<ReturnType<typeof startRedirectProxy>> | null = null;
   const sealed = env.VOLTER_WORLD_MODE === 'sealed' || env[WORLD_NETWORK_POLICY_ENV] !== undefined;
@@ -4176,13 +4388,25 @@ export async function shellWorld(name: string, root = process.cwd()): Promise<nu
     if (sealed) throw new Error(`world "${name}" requires its network policy proxy: openssl is unavailable; refusing to open a shell`);
     process.stderr.write(`world '${name}' active in a subshell — vendor calls hit the twins (env-only; install openssl for ambient https redirect). type 'exit' to leave.\n`);
   }
+  let failed = false;
+  let failure: unknown;
   try {
+    assertRequiredCredentials(required, env, 'interactive shell');
     const result = spawnSync(shell, ['-i'], { windowsHide: true, cwd, env, stdio: 'inherit' });
-    return result.status ?? 0;
+    if (result.error) throw result.error;
+    if (result.signal) throw new Error(`World shell ended by ${result.signal}`);
+    if (result.status === null) throw new Error('World shell returned no exit status');
+    return result.status;
+  } catch (error) {
+    failed = true; failure = error;
+    throw error;
   } finally {
     if (proxy) {
-      await proxy.close();
-      tearDownCa(tlsDir(resolvedRoot, name));
+      try { await proxy.close(); tearDownCa(tlsDir(resolvedRoot, name)); }
+      catch (cleanup) {
+        if (failed) throw new AggregateError([failure, cleanup], `World shell failed (${errorMessage(failure)}); proxy cleanup also failed (${errorMessage(cleanup)})`, { cause: failure });
+        throw cleanup;
+      }
     }
   }
 }
@@ -4446,6 +4670,7 @@ function clearWorldProxyFiles(root: string, name: string): void {
  */
 export function activateScript(name: string, root = process.cwd()): string {
   const status = statusWorld(name, root);
+  const required = recordedRequiredCredentialClaims(status);
   if (!status.running) throw new Error(`World "${name}" is not running — run: volter-world up <config> --env-out <path> --name ${name}`);
   const baseEnv = status.env ?? {};
   // Bring up the ambient redirect proxy (best-effort) and fold its env in so the activated shell
@@ -4465,6 +4690,8 @@ export function activateScript(name: string, root = process.cwd()): string {
     // openssl missing or daemon failed — keep env-only redirect; never fabricate proxy success.
   }
   env = withAppUrl(name, root, env);
+  // Exports follow the bookkeeping assignments; the final prompt assignment is the one later value change.
+  assertRequiredCredentials(required, { ...env, PS1: `(world:${name}) ${env.PS1 ?? ''}` }, 'shell activation including its prompt');
   const keys = Object.keys(env).sort();
   const lines: string[] = [
     `# volter-world activate ${name} — run:  eval "$(volter-world activate ${name})"`,