@volter/world-runtime 3.0.30 → 3.0.32

package/src/served-world.ts

@@ -1,4 +1,4 @@
-import { getActiveWorldStore, withHistoryLocks, captureHistory, historyAtInstant, historyDigest, historyEntries, historyLength, readHistoryView, worldPaths, type HistoryReference } from '@volter/world-core/runtime';
+import { boardFrameKey, getActiveWorldStore, withHistoryLocks, captureHistory, historyAtInstant, historyDigest, historyEntries, historyLength, readHistoryView, worldPaths, type HistoryReference } from '@volter/world-core/runtime';
 // A SERVED WORLD (docs/reference/http-api.md#a-served-world): `volter world serve` puts a world at
 // `http://<host>:<port>/<org>/<world>/`. Each twin's vendor API is under its vendor id — the
 // addressed grammar RH2 depends on — and the world's own doors are under `/-/<org>/<world>/`:
@@ -13,7 +13,6 @@ import { getActiveWorldStore, withHistoryLocks, captureHistory, historyAtInstant
 //   POST deploy[/<name>]             perform landed entries against each root, by policy
 //   GET/PUT twins/<vendor>/root      the vendor's real account behind the twin (PUT null clears)
 //   PUT  twins/<vendor>/credential   seal the credential; GET answers only that one is sealed
-//   GET twins/<vendor>/people, POST twins/<vendor>/session   a browser views the vendor as a World's person
 //   POST twins/<vendor>/refresh      observe the root now
 // and what a person looks into it through (docs/contributing/architecture.md, "Viewing a World"):
 //   GET  map | timeline | diff       every twin and what it holds; the logs merged newest first; the changes since the base
@@ -32,9 +31,11 @@ import { getActiveWorldStore, withHistoryLocks, captureHistory, historyAtInstant
 // One writer per world by construction: the doors run in this process, serialized per twin.
 import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync , rmSync} from 'node:fs';
 import { CALLER_HEADER, callerForHeader, newTraceparent, parseTraceparent, traceparentForDelivery, readTwinRequestJournalFrom, type TwinRequestJournalCursor, assertSafeChangesetName, blobDigest, destinationOf, getActiveBlobStore, journalTwinRequest, loadCheck, twinRequestJournalFailures, openSealedAt, readTwinRequestJournal, serveHttp, twinRequestCredentials, TWIN_PREFIX_HEADER, TWIN_SITES_HEADER, siteLabel, siteUrlOf, ORIGINAL_PATH_HEADER, validateRemoteOrigin, type SealedCredential, type TwinStreamConnection, type TwinStreamSink, type BoardFrame } from '@volter/world-core/runtime';
-import { BROWSER_SESSION_HEADER, BROWSER_SESSION_PATH, stripBrowserSessionPermit, withBrowserSessionPermit, type DerivedManifest } from '@volter/world-core/runtime';
+import { resolveTwinHost, type HostPredicate } from '@volter/world-core/host-routing';
+import { assertBrowserName, validateBrowserState, cookieMatchesHost } from '@volter/world-core';
+import { worldBrowser, worldBrowsers, putWorldBrowser, deleteWorldBrowser, materializeBrowserFiles, browserLoad, putBrowserLoad, browserLoadId } from './browsers.ts';
 import { APP_READ_ENDPOINT_ENV } from './init.ts';
-import { packFacts } from './pack-facts.ts';
+import { packFacts, packHostRules } from './pack-facts.ts';
 import { grantOf, presentedSecrets, sameSecret, spentPasses, verifyPass, type TrustedIssuer, type WorldCredentials } from '@volter/world-access';
 import { createHash } from 'node:crypto';
 import { dirname, join, resolve } from 'node:path';
@@ -53,6 +54,16 @@ import { assertChangesetRules, type WorldChangesetRules, type WorldInstance } fr
 export const TOKEN_HEADER = 'x-volter-token';
 /** The header the injector carries a hosted World's token in (inject.cjs, VOLTER_TWINS_KEY). */
 export const TWINS_KEY_HEADER = 'x-twins-key';
+// Browser input policy; these caps bound accepted input, independently of infrastructure limits.
+const BROWSER_COUNT_LIMIT = 32;
+const BROWSER_STATE_BYTES_LIMIT = 1024 * 1024;
+/** This fact belongs to the World router, never to a caller. */
+function withoutBrowserHeader(request: Request): Request {
+  if (!request.headers.has('x-volter-world-browser')) return request;
+  const headers = new Headers(request.headers);
+  headers.delete('x-volter-world-browser');
+  return new Request(request, { headers });
+}
 class Booting extends Error { constructor() { super('the world is still booting'); } }
 
 /** fetch that waits out a world still booting: a refused connection is retried for `forMs`. */
@@ -91,7 +102,7 @@ export function boardFile(worldRoot: string): string { return join(worldRoot, st
 /** A board as the World keeps it: a frame or a section is named `<vendor>:<frame id>` or `<vendor>:section:<section id>`.
  *  The first board is everything the packs lay out; another holds what it includes, a section with its frames to come. */
 type SavedBoard = { id: string; name: string; include?: string[]; hidden?: string[]; placed?: Record<string, { x: number; y: number }>; /** each section's region and name, by a pack's group or `user:<id>`; a pack's group removed is `gone` */ sections?: Record<string, { x: number; y: number; w: number; h: number; name?: string; gone?: true }> };
-const BOARD_KEY = /^[a-z0-9-]+:[^\s]{1,300}$/;
+const BOARD_KEY = /^(?:[a-z0-9-]+|~browser:[a-z0-9-]+:[a-z0-9-]+):[^\s]{1,300}$/;
 /** The largest board document a World keeps. */
 const BOARD_BYTES = 256 * 1024;
 /** A board document from a request, or the reason it is refused: every field of its type, nothing else. */
@@ -120,7 +131,7 @@ function boardsOf(body: unknown): SavedBoard[] | string {
       for (const [k, v] of Object.entries(sections)) {
         const r = v as Record<string, unknown> | null;
         // a section is a pack's group (`<vendor>:section:<id>`) or one people drew (`user:<id>`), on the board's plane
-        if (!BOARD_KEY.test(k) || !(/^user:[a-z0-9]{1,32}$/.test(k) || /^[a-z0-9-]+:section:/.test(k)) || !r || typeof r !== 'object' || Object.keys(r).some((f) => !['x', 'y', 'w', 'h', 'name', 'gone'].includes(f))
+        if (!BOARD_KEY.test(k) || !(/^user:[a-z0-9]{1,32}$/.test(k) || /^(?:[a-z0-9-]+|~browser:[a-z0-9-]+:[a-z0-9-]+):section:/.test(k)) || !r || typeof r !== 'object' || Object.keys(r).some((f) => !['x', 'y', 'w', 'h', 'name', 'gone'].includes(f))
           || !['x', 'y'].every((f) => typeof r[f] === 'number' && Math.abs(r[f] as number) <= 1e7) || !['w', 'h'].every((f) => typeof r[f] === 'number' && (r[f] as number) >= 0 && (r[f] as number) <= 1e6)
           || (r.gone !== true && ((r.w as number) < 100 || (r.h as number) < 100))
           || (r.name !== undefined && (typeof r.name !== 'string' || !r.name.trim() || r.name.length > 80)) || (r.gone !== undefined && r.gone !== true)) return 'sections: { x, y, w, h, name?, gone? } by section name';
@@ -170,9 +181,8 @@ export type MountedWorld = { name: string; served: string; root: string; readonl
 /** What a content-plane pass, and the session it opens, carry: its scope; the control session that asked (the content
  *  session ends with it; none when the World's token asked); the person; the console that frames it; and whether it
  *  is this machine's own page (attributed to the machine). */
-type VendorSessionPass = { vendor: string; person: string | null; land: string; asker: string };
 type PagesGrant = { scope: 'read' | 'write'; session?: string; who?: string; framer?: string; local?: true; /** the hosted site it
- *  opens (a hostname this World's twins answer), not the content plane */ site?: string; /** a parent World's session that asked
+ *  opens (a hostname this World's twins answer), not the content plane */ site?: string; browser?: string; /** a parent World's session that asked
  *  for a branch's page, as an opaque mark: the branch keeps one content session per asker and caps passes by it, but
  *  cannot tell when it ends, so such a session lasts an hour */ asker?: string };
 type HeldSession = { scope: 'read' | 'write'; until: number; /** opened by this machine's own page (localSession) */ local?: true; who?: string; /** the platform whose pass opened it */ issuer?: string; /** the person's subject there */ sub?: string; /** the read key a shared link opened it with: it lasts only while that key does */ key?: string };
@@ -336,7 +346,7 @@ function streamEnv(id: string, protocol: string): Record<string, string> {
 
 /** What the doors need of a world: where each twin's state lives and which twins it has. A booted
  *  local instance is one; a hosted World describes itself. */
-export type WorldLayout = { dirs: { data: string }; services: Record<string, { url?: string; protocol?: unknown }> };
+export type WorldLayout = { dirs: { data: string }; envFile?: string; services: Record<string, { url?: string; protocol?: unknown }> };
 /** The host a world's doors run in: its layout, and how a request reaches a twin's wire — a local
  *  host forwards to the twin's own port, a hosted World calls the pack in-process. */
 export type DoorHost = {
@@ -453,7 +463,7 @@ export class WorldDoors {
    *  token: it uses the twins at its scope and nothing else. One per session that gave it a pass (every frame of a board
    *  shares it), kept in the World's store, ended with that session; framed only by the console that asked. */
   private onPages(url: URL): boolean { const at = this.host.pagesOrigin?.() ?? null; return at !== null && url.host === new URL(at).host; }
-  private readonly pagePasses = new Map<string, PagesGrant & { until: number; viewAs?: VendorSessionPass }>();
+  private readonly pagePasses = new Map<string, PagesGrant & { until: number }>();
   private pagesPath(): string { return join(this.worldRoot, stateDirName(), 'pages-sessions.json'); }
   private pagesHeld: Record<string, PagesGrant & { until: number }> | null = null;
   private pagesSessions(): Record<string, PagesGrant & { until: number }> {
@@ -492,14 +502,14 @@ export class WorldDoors {
     return pass ? `${at}/-/${this.served}/pages/open#${new URLSearchParams({ pass, land }).toString()}` : null;
   }
   /** A one-time pass (a minute long) for the content plane or a hosted site; null when its asker holds fifty unused. */
-  private mintPagesPass(scope: 'read' | 'write', grant: Omit<PagesGrant, 'scope'>, viewAs?: VendorSessionPass): string | null {
+  private mintPagesPass(scope: 'read' | 'write', grant: Omit<PagesGrant, 'scope'>): string | null {
     const now = Date.now();
     for (const [k, v] of this.pagePasses) if (v.until <= now) this.pagePasses.delete(k);
     const askerOf = (g: Omit<PagesGrant, 'scope'>): string => g.session ?? g.asker ?? g.framer ?? 'token';
     const asker = askerOf(grant);
     if ([...this.pagePasses.values()].filter((v) => askerOf(v) === asker).length >= 50 || this.pagePasses.size >= 5000) return null;
     const pass = mintToken('pass_');
-    this.pagePasses.set(pass, { ...grant, scope, until: now + 60_000, ...(viewAs ? { viewAs } : {}) });
+    this.pagePasses.set(pass, { ...grant, scope, until: now + 60_000 });
     return pass;
   }
   /** The hostname a hosted site address names (`{site}` template: `<label>--<world>--<org>.<suffix>`) among those this
@@ -507,27 +517,41 @@ export class WorldDoors {
   /** Whether an address has a hosted site's shape here (`<label>--<world>--<org>.<suffix>`), claimed or not. */
   private siteShaped(url: URL): boolean {
     const template = this.host.sitesTemplate?.() ?? null;
-    if (!template || !template.includes('{site}')) return false;
-    const after = new URL(template.replace('{site}', 'x')).host.slice(1);
-    return url.host.endsWith(after) && url.host.length > after.length;
+    if (!template) return false;
+    const flat = template.includes('{site}');
+    if (!flat && !template.includes('{host}')) return false;
+    const after = new URL(template.replace(flat ? '{site}' : '{host}', 'x')).host.slice(1);
+    if (!url.host.endsWith(after) || url.host.length <= after.length) return false;
+    const label = url.host.slice(0, -after.length);
+    return flat || (!label.includes('.') && label.includes('--'));
   }
-  private async hostedSiteOf(url: URL): Promise<string | null> {
+  private async hostedSiteOf(url: URL): Promise<{ site: string; browser?: string } | null> {
     if (!this.siteShaped(url)) return null;
-    const template = this.host.sitesTemplate?.() ?? null;
-    if (!template || !template.includes('{site}')) return null;
-    const after = new URL(template.replace('{site}', 'x')).host.slice(1);
-    if (!url.host.endsWith(after) || url.host.length <= after.length) return null;
-    const label = url.host.slice(0, -after.length);
-    for (const { hosts } of await this.claimedHosts(url.origin)) for (const h of hosts) if (siteLabel(h) === label) return h.toLowerCase();
+    const template = this.host.sitesTemplate!()!;
+    const claimed = await this.claimedHosts(url.origin);
+    for (const { hosts } of claimed) for (const site of hosts) {
+      const at = siteUrlOf(template, site);
+      if (at && new URL(at).host === url.host) return { site };
+    }
+    const browsers = worldBrowsers(this.up().dirs.data);
+    if (!browsers.length) return null;
+    const sites = await this.browserSites(url.origin, claimed);
+    for (const browser of browsers) {
+      for (const { hosts } of sites) for (const site of hosts) {
+        const at = siteUrlOf(template, site, browser.name);
+        if (at && new URL(at).host === url.host) return { site, browser: browser.name };
+      }
+    }
     return null;
   }
+
   private pagesCookie(url: URL): string { return url.protocol === 'https:' ? '__Host-volter_pages' : 'volter_pages'; }
-  private pageSession(request: Request, url: URL, site?: string): ({ id: string } & PagesGrant) | null {
+  private pageSession(request: Request, url: URL, site?: string, browser?: string): ({ id: string } & PagesGrant) | null {
     const id = new RegExp(`(?:^|;\\s*)${this.pagesCookie(url)}=([^;]+)`).exec(request.headers.get('cookie') ?? '')?.[1];
     const held = id && Object.hasOwn(this.pagesSessions(), id) ? this.pagesSessions()[id]! : undefined;
     if (!id || !held || held.until <= Date.now() || !this.pagesParentLive(held)) return null;
     // a session opens only where its pass was for: the content plane, or that one hosted site
-    if ((held.site ?? null) !== (site ?? null)) return null;
+    if ((held.site ?? null) !== (site ?? null) || held.browser !== browser) return null;
     const { until: _until, ...grant } = held;
     return { id, ...grant };
   }
@@ -538,17 +562,15 @@ export class WorldDoors {
     if (!cookies.length) return;
     out.delete('set-cookie');
     for (const c of cookies) {
-      if (/^\s*(?:__Host-)?volter_(?:world|pages)=/i.test(c)) continue;
+      if (/^\s*(?:__Host-)?volter_(?:world|pages|browser)=/i.test(c)) continue;
       out.append('set-cookie', `${c.replace(/;\s*(?:samesite=[^;]*|secure|partitioned|domain=[^;]*)\s*(?=;|$)/gi, '')}; SameSite=None; Secure; Partitioned`);
     }
   }
   /** What the content plane answers: its opening page and session, and the twins' pages; no door of the World. */
-  private async pagesPlane(request: Request, url: URL, /** a hosted site served here, not the content plane */ site?: string): Promise<Response> {
+  private async pagesPlane(request: Request, url: URL, /** a hosted site served here, not the content plane */ site?: string, browser?: string): Promise<Response> {
     const doors = `/-/${this.served}/pages/`;
-    const viewPath = url.pathname.startsWith(`/${this.served}/`) ? url.pathname.slice(`/${this.served}/`.length).split('/') : [];
-    const viewVendor = viewPath.length === 4 && viewPath[1] === '_twin' && viewPath[2] === 'view-as' && Object.hasOwn(this.up().services, viewPath[0]!) ? viewPath[0]! : null;
-    const door = viewVendor ? viewPath[3] : url.pathname.startsWith(doors) ? url.pathname.slice(doors.length) : null;
-    const opening = viewVendor ? `/${this.served}/${viewVendor}/_twin/view-as/` : doors;
+    const door = url.pathname.startsWith(doors) ? url.pathname.slice(doors.length) : null;
+    const opening = doors;
     const own = this.host.browserOrigin?.() ?? null;
     if (door === 'open' && request.method === 'GET') {
       // framed by this World's console, or its parent's (a comparison frames its branch's pages); the pages it opens are
@@ -564,8 +586,6 @@ export class WorldDoors {
   history.replaceState(null, '', location.pathname);
   const pass = carried.get('pass') || '';
   const land = carried.get('land') || '';
-  const viewAs = carried.get('viewAs') === '1';
-  const tell = (data) => { if (viewAs && parent !== window) parent.postMessage({ type: 'volter-view-as', pass, ...data }, ${JSON.stringify(own)}); };
   // resolved as the browser will (encoded dots too), on this origin and under this World
   let to = null;
   // a hosted site lands anywhere on it; the content plane only under this World
@@ -576,11 +596,9 @@ export class WorldDoors {
     .then(async (r) => {
       const opened = await r.json();
       if (!r.ok) throw new Error(opened.error || 'This World did not open.');
-      if (opened.viewAs) { tell({ viewed: opened.viewAs }); location.replace(opened.viewAs.land); }
-      else if (viewAs) throw new Error('This pass did not sign in to the vendor.');
-      else location.replace(to);
+      location.replace(to);
     })
-    .catch((e) => { document.body.textContent = e.message || 'This World did not answer.'; tell({ error: document.body.textContent }); });
+    .catch((e) => { document.body.textContent = e.message || 'This World did not answer.'; });
 })();
 `;
       return new Response(script, { headers: { 'content-type': 'text/javascript; charset=utf-8', 'cache-control': 'no-store' } });
@@ -591,17 +609,10 @@ export class WorldDoors {
       const given = this.pagePasses.get(pass);
       this.pagePasses.delete(pass);
       if (request.headers.get('sec-fetch-site') !== 'same-origin') return Response.json({ error: 'the content plane opens its session from its own page' }, { status: 403 });
-      if (!given || given.until <= Date.now() || !this.pagesParentLive(given) || (given.site ?? null) !== (site ?? null)) return Response.json({ error: 'that pass is used or expired: open the page again from the World' }, { status: 401 });
-      const { until: _until, viewAs, ...grant } = given;
-      if (viewAs) {
-        const held = this.pageSession(request, url);
-        if (!held) return Response.json({ error: 'Open a vendor page from this World first, then choose View as again.' }, { status: 403 });
-        if (viewVendor !== viewAs.vendor || !given.session || held.scope !== 'write' || held.session !== given.session) return Response.json({ error: 'View as belongs to the browser session that asked for it' }, { status: 403 });
-        return this.vendorSession(request, viewAs, given.until);
-      }
-      if (viewVendor) return Response.json({ error: 'this door takes only a View as pass' }, { status: 403 });
+      if (!given || given.until <= Date.now() || !this.pagesParentLive(given) || (given.site ?? null) !== (site ?? null) || given.browser !== browser) return Response.json({ error: 'that pass is used or expired: open the page again from the World' }, { status: 401 });
+      const { until: _until, ...grant } = given;
       // one content session per asker at a scope and framer: a board's frames opening together share it
-      const same = (x: PagesGrant): boolean => x.scope === grant.scope && x.session === grant.session && x.asker === grant.asker && x.framer === grant.framer && x.who === grant.who && x.site === grant.site;
+      const same = (x: PagesGrant): boolean => x.scope === grant.scope && x.session === grant.session && x.asker === grant.asker && x.framer === grant.framer && x.who === grant.who && x.site === grant.site && x.browser === grant.browser;
       const now = Date.now();
       const found = Object.entries(this.pagesSessions()).find(([, x]) => x.until > now && same(x))?.[0];
       const id = found ?? mintToken('pgs_');
@@ -613,21 +624,26 @@ export class WorldDoors {
     }
     // A HOSTED SITE: read with a session its World's own origin gave it a pass for (sites/go), never without
     if (site) {
-      const held = this.pageSession(request, url, site);
-      const back = own ? `${own}/-/${this.served}/sites/go?${new URLSearchParams({ host: site, land: `${url.pathname}${url.search}` }).toString()}` : null;
+      const held = this.pageSession(request, url, site, browser);
+      const back = own && !browser ? `${own}/-/${this.served}/sites/go?${new URLSearchParams({ host: site, land: `${url.pathname}${url.search}` }).toString()}` : null;
       if (!held) {
-        if (request.method === 'GET' && (request.headers.get('accept') ?? '').includes('text/html') && back) {
+        if (request.method === 'GET' && (request.headers.get('accept') ?? '').includes('text/html') && (browser || back)) {
           const shown = site.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
-          return new Response(`<!doctype html><meta charset="utf-8"><title>${shown}</title><body style="font:16px system-ui;margin:3em;color:#555"><p><b>${shown}</b> is a site in the World ${this.served}, shown to its people.</p><p><a href="${back.replace(/&/g, '&amp;')}">Open it from the World</a></p></body>`, { status: 401, headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store', 'referrer-policy': 'no-referrer' } });
+          const opening = browser ? "Open this site from the World's board." : `<a href="${back!.replace(/&/g, '&amp;')}">Open it from the World</a>`;
+          return new Response(`<!doctype html><meta charset="utf-8"><title>${shown}</title><body style="font:16px system-ui;margin:3em;color:#555"><p><b>${shown}</b> is a site in the World ${this.served}, shown to its people.</p><p>${opening}</p></body>`, { status: 401, headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store', 'referrer-policy': 'no-referrer' } });
         }
-        return Response.json({ error: `${site} is shown to ${this.served}'s people: open it from the World` }, { status: 401 });
+        return Response.json({ error: `${site} is shown to ${this.served}'s people: open it from the World${browser ? "'s board" : ''}` }, { status: 401 });
       }
       // read by the site's own pages, or a person's navigation to it: never by another page of the same domain (the
       // session's partition is the domain's, which every World's pages share)
       const fetchSite = request.headers.get('sec-fetch-site');
       const navigation = ['document', 'iframe'].includes(request.headers.get('sec-fetch-dest') ?? '');
-      if (fetchSite !== 'same-origin' && !(navigation && ['none', 'same-site'].includes(fetchSite ?? ''))) return Response.json({ error: `${site} is read by its own pages` }, { status: 403 });
-      const answer = await this.site(request, site);
+      if (fetchSite !== 'same-origin' && !((!browser || request.method === 'GET' || request.method === 'HEAD') && navigation && ['none', 'same-site'].includes(fetchSite ?? ''))) return Response.json({ error: `${site} is read by its own pages` }, { status: 403 });
+      if (browser) {
+        const loading = this.loadBrowser(request, url, site, browser);
+        if (loading) return loading;
+      }
+      const answer = await this.site(request, site, browser, held);
       const out = new Headers(answer.headers);
       out.append('content-security-policy', `frame-ancestors 'self'${held.framer ? ` ${held.framer}` : ''}`);
       this.keepCookiesHere(answer, out);
@@ -652,61 +668,6 @@ export class WorldDoors {
     return Response.json({ error: `this origin shows ${this.served}'s pages only` }, { status: 404 });
   }
 
-  /** A landing resolved as a browser resolves it, within this vendor's place only. */
-  private vendorLanding(vendor: string, land: unknown): string | null {
-    if (typeof land !== 'string' || !land.startsWith('/') || land.startsWith('//') || /[\\\s]/.test(land)) return null;
-    try {
-      const url = new URL(land, 'https://world.local');
-      const path = decodeURIComponent(url.pathname);
-      const base = `/${this.served}/${vendor}/`;
-      if (url.origin !== 'https://world.local' || !url.pathname.startsWith(base) || !path.startsWith(base)
-        || path.includes('\\') || path.split('/').some((p) => p === '.' || p === '..' || p.includes('%'))) return null;
-      return url.pathname + url.search + url.hash;
-    } catch { return null; }
-  }
-  /** The pack's declared browser session, never inferred from its vendor or a sign-in page. */
-  private async browserSessionOf(vendor: string): Promise<NonNullable<DerivedManifest['browserSession']> | null> {
-    const twin = this.host.twinFetch(vendor);
-    if (!twin || !this.host.pagesOrigin?.()) return null;
-    try {
-      const answer = await twin(new Request('http://world.local/twin', { headers: { [READ_ONLY_HEADER]: '1' } }));
-      const manifest = answer.ok ? await answer.json() as { browserSession?: unknown; drawsScreens?: boolean } : null;
-      if (!manifest?.drawsScreens) return null;
-      const session = manifest?.browserSession;
-      if (!session || typeof session !== 'object') return null;
-      const { cookie, scope } = session as { cookie?: unknown; scope?: unknown };
-      if (typeof cookie !== 'string' || !/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(cookie)
-        || /^(?:__Host-|(?:__Secure-)?volter_(?:world|pages)$)/i.test(cookie) || (scope !== undefined && typeof scope !== 'string')) return null;
-      return { cookie, ...(typeof scope === 'string' ? { scope } : {}) };
-    } catch { return null; }
-  }
-  private vendorPeople(vendor: string): Array<{ id: string; label: string; email: string }> {
-    return readTree(this.stateOf(vendor), this.controlRoot(vendor))
-      .filter((p) => p.type === '_person' && p.deleted !== true && typeof p.email === 'string')
-      .map((p) => ({ id: p.id, email: String(p.email), label: String(p.email) }));
-  }
-  /** The twin receives its own cookie and changes the session in its own process, over a host-only permit. */
-  private async vendorSession(request: Request, pass: VendorSessionPass, until: number): Promise<Response> {
-    const twin = this.host.twinFetch(pass.vendor);
-    if (!twin || !await this.browserSessionOf(pass.vendor) || !this.vendorLanding(pass.vendor, pass.land)) return Response.json({ error: 'that vendor session is unavailable' }, { status: 404 });
-    const person = pass.person === null ? null : this.vendorPeople(pass.vendor).find((p) => p.id === pass.person);
-    if (person === undefined) return Response.json({ error: 'that person is no longer in the World' }, { status: 404 });
-    const url = new URL(request.url);
-    const headers = new Headers({ [TWIN_PREFIX_HEADER]: `/${this.served}/${pass.vendor}`, 'x-forwarded-host': url.host, 'x-forwarded-proto': url.protocol.slice(0, -1) });
-    headers.set(CALLER_HEADER, callerForHeader(pass.asker));
-    headers.set('traceparent', traceparentForDelivery(request.headers.get('traceparent')) ?? newTraceparent());
-    const cookies = (request.headers.get('cookie') ?? '').split(/;\s*/).filter((c) => c && !/^(?:__Host-)?volter_(?:world|pages)=/.test(c));
-    if (cookies.length) headers.set('cookie', cookies.join('; '));
-    const answer = await withBrowserSessionPermit(this.stateOf(pass.vendor), this.controlRoot(pass.vendor), { person: pass.person, land: pass.land, until }, async (permit) => {
-      headers.set(BROWSER_SESSION_HEADER, permit);
-      return twin(new Request(`${url.origin}${BROWSER_SESSION_PATH}`, { method: 'POST', headers, redirect: 'manual' }));
-    });
-    if (answer.status !== 303) return answer;
-    const out = new Headers({ 'cache-control': 'no-store' });
-    this.keepCookiesHere(answer, out);
-    return Response.json({ viewAs: { vendor: pass.vendor, person: pass.person, label: person?.email ?? 'Signed out', land: pass.land } }, { headers: out });
-  }
-
   /** BROWSER SESSIONS: the session cookie carries an opaque id, never a token, so a leaked cookie is one session and
    *  not the World's write token; rotating the tokens ends every session. Kept in the World's store, so a restart
    *  keeps them; each lasts 30 days from its opening. */
@@ -1027,6 +988,68 @@ export class WorldDoors {
     return out;
   }
 
+  /** Browser sites include the pack's exact declared hosts, beside the dynamically claimed sites. */
+  private async browserSites(origin: string, listed?: Array<{ vendor: string; hosts: string[] }>): Promise<Array<{ vendor: string; hosts: string[] }>> {
+    const dynamic = listed ?? await this.claimedHosts(origin);
+    return Object.keys(this.up().services).map(vendor => ({ vendor, hosts: [...new Set([
+      ...(dynamic.find(d => d.vendor === vendor)?.hosts ?? []),
+      ...(packFacts()[vendor]?.hosts ?? []).flatMap(rule => typeof rule.host === 'string' && !rule.exclude ? [rule.host] : []),
+    ])] }));
+  }
+
+  private async browserRoutes(origin: string): Promise<{ sites: Array<{ vendor: string; hosts: string[] }>; rules: Record<string, HostPredicate>; map: Record<string, string>; claimed: Record<string, Set<string>> }> {
+    const listed = await this.claimedHosts(origin);
+    const facts = packFacts();
+    const map: Record<string, string> = Object.fromEntries(Object.keys(this.up().services).map(vendor => [vendor, vendor]));
+    const claimed: Record<string, Set<string>> = {};
+    // The proxy's static rule order is in the shared table; dynamic order is the same facts order.
+    for (const vendor of Object.keys(facts)) if (this.up().services[vendor]) {
+      map[vendor] = vendor;
+      for (const rule of facts[vendor]?.hosts ?? []) if (rule.key) map[rule.key] = vendor;
+      if (facts[vendor]?.hostsClaimed) claimed[vendor] = new Set(listed.find(row => row.vendor === vendor)?.hosts ?? []);
+    }
+    return { sites: await this.browserSites(origin, listed), rules: packHostRules(), map, claimed };
+  }
+
+  private loadBrowser(request: Request, url: URL, site: string, name: string): Response | null {
+    const browser = worldBrowser(this.up().dirs.data, name);
+    if (!browser) return Response.json({ error: `no browser ${name}` }, { status: 404 });
+    const marker = url.protocol === 'https:' ? '__Host-volter_browser' : 'volter_browser';
+    const id = new RegExp(`(?:^|;\\s*)${marker}=([^;]+)`).exec(request.headers.get('cookie') ?? '')?.[1];
+    const loadId = browserLoadId(browser.version, site);
+    const current = browserLoad(this.up().dirs.data, loadId);
+    const previous = browserLoad(this.up().dirs.data, id);
+    const carried = [current, previous].filter(load => load?.name === name && load.site === site);
+    if (id === loadId && current?.name === name && current.site === site && current.version === browser.version) return null;
+    if (request.method !== 'GET' || !['document', 'iframe'].includes(request.headers.get('sec-fetch-dest') ?? '')) return null;
+    const cookies = browser.state.cookies.filter(c => cookieMatchesHost(c, site));
+    const storage = browser.state.origins.find(o => new URL(o.origin).hostname === site)?.localStorage ?? [];
+    const headers = new Headers({ 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store', 'referrer-policy': 'no-referrer' });
+    const protectedCookie = (key: string): boolean => /^(?:__Host-)?volter_(?:world|pages|browser)$/.test(key);
+    const expired = new Map<string, { name: string; path: string }>();
+    for (const c of [...carried.flatMap(load => load!.cookies), ...cookies]) expired.set(JSON.stringify([c.name, c.path]), { name: c.name, path: c.path });
+    for (const part of (request.headers.get('cookie') ?? '').split(/;\s*/)) {
+      const key = part.split('=')[0]!;
+      if (/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(key)) expired.set(JSON.stringify([key, '/']), { name: key, path: '/' });
+    }
+    for (const c of expired.values()) {
+      if (protectedCookie(c.name)) continue;
+      for (const partition of ['', '; Partitioned']) headers.append('set-cookie', `${c.name}=; Path=${c.path}; Max-Age=0; Secure; SameSite=None${partition}`);
+    }
+    for (const c of cookies) {
+      if (/^(?:__Host-)?volter_(?:world|pages|browser)$/.test(c.name)) continue;
+      if (c.expires !== -1 && c.expires <= Date.parse(worldNow()) / 1000) continue;
+      headers.append('set-cookie', `${c.name}=${c.value}; Path=${c.path}${c.expires === -1 ? '' : `; Expires=${new Date(c.expires * 1000).toUTCString()}`}${c.httpOnly ? '; HttpOnly' : ''}; Secure; SameSite=None; Partitioned`);
+    }
+    putBrowserLoad(this.up().dirs.data, loadId, { name, site, version: browser.version, cookies: cookies.filter(c => !protectedCookie(c.name)).map(c => ({ name: c.name, path: c.path })) });
+    headers.append('set-cookie', `${marker}=${loadId}; Path=/; HttpOnly; Secure; SameSite=None; Partitioned`);
+    const script = `localStorage.clear(); for (const entry of ${JSON.stringify(storage).replace(/</g, '\\u003c')}) localStorage.setItem(entry.name, entry.value); location.replace(location.href);`;
+    const hash = createHash('sha256').update(script).digest('base64');
+    const framer = this.pageSession(request, url, site, name)?.framer;
+    headers.set('content-security-policy', `default-src 'none'; script-src 'sha256-${hash}'; base-uri 'none'; frame-ancestors 'self'${framer ? ` ${framer}` : ''}`);
+    return new Response(`<!doctype html><meta charset="utf-8"><title>Loading browser</title><script>${script}</script>`, { headers });
+  }
+
   /** What a twin asks an application (`ctx.ask`) that this World can answer truthfully, where no process routes it (a
    *  hosted World's isolate): a GET or HEAD of a URL whose hostname one of this World's twins answers (its hostsClaimed
    *  door: a Cloudflare twin's Worker route or custom domain) is that twin's answer, read as a browser reads the site
@@ -1050,22 +1073,48 @@ export class WorldDoors {
   /** A hostname one of this World's twins answers (its hostsClaimed door lists it), read as a browser reads it there:
    *  the request goes to that twin with the hostname as its original host, as the injector routes it inside the World.
    *  Reads only: the site is the twin's state as the World holds it, never a way to write it. */
-  async site(request: Request, host: string): Promise<Response> {
-    request = stripBrowserSessionPermit(request);
-    if (request.method !== 'GET' && request.method !== 'HEAD') return Response.json({ error: 'a site in a World is read: GET and HEAD' }, { status: 405 });
+  async site(request: Request, host: string, browser?: string, grant?: PagesGrant): Promise<Response> {
+    request = withoutBrowserHeader(request);
+    if (!browser && request.method !== 'GET' && request.method !== 'HEAD') return Response.json({ error: 'a site in a World is read: GET and HEAD' }, { status: 405 });
+    if (browser && !grant) return Response.json({ error: "open this browser site from the World's board" }, { status: 401 });
     const url = new URL(request.url);
-    for (const { vendor, hosts } of await this.claimedHosts(url.origin)) {
-      const twin = this.host.twinFetch(vendor);
-      if (!twin || !hosts.includes(host)) continue;
-      const headers = new Headers();
+    const routes = browser ? await this.browserRoutes(url.origin) : null;
+    let vendor: string | undefined;
+    if (routes) vendor = resolveTwinHost(routes.rules, host, routes.map, url.pathname, routes.claimed)?.origin;
+    else for (const row of await this.claimedHosts(url.origin)) {
+      if (!this.host.twinFetch(row.vendor) || !row.hosts.includes(host)) continue;
+      vendor = row.vendor;
+      break;
+    }
+    const twin = vendor ? this.host.twinFetch(vendor) : undefined;
+    if (vendor && twin) {
+      const reads = request.method === 'GET' || request.method === 'HEAD';
+      const enforced = browser && grant?.scope === 'read' && await this.enforcesRead(vendor, twin, url.origin);
+      if (browser && grant?.scope === 'read' && !reads && !enforced) return Response.json({ error: 'the read token opens only reads' }, { status: 403 });
+      const headers = browser ? new Headers(request.headers) : new Headers();
+      for (const key of [TOKEN_HEADER, TWINS_KEY_HEADER, CALLER_HEADER, ORIGINAL_PATH_HEADER, READ_ONLY_HEADER, 'host', TWIN_PREFIX_HEADER]) headers.delete(key);
       for (const name of ['accept', 'accept-language', 'if-none-match', 'range', 'user-agent']) { const v = request.headers.get(name); if (v !== null) headers.set(name, v); }
+      if (browser) {
+        const cookies = (request.headers.get('cookie') ?? '').split(/;\s*/).filter(c => !/^(?:__Host-)?volter_(?:world|pages|browser)=/.test(c));
+        if (cookies.length) headers.set('cookie', cookies.join('; '));
+        headers.set('x-volter-world-browser', browser);
+        const template = this.host.sitesTemplate?.();
+        if (template) headers.set(TWIN_SITES_HEADER, template);
+        headers.set('x-forwarded-host', url.host);
+        headers.set('x-forwarded-proto', url.protocol.slice(0, -1));
+      }
       headers.set('x-volter-twin-original-host', host);
-      headers.set(READ_ONLY_HEADER, '1');
-      const answer = await twin(new Request(`${url.origin}${url.pathname}${url.search}`, { method: request.method, headers, redirect: 'manual' }));
+      if (!browser || enforced) headers.set(READ_ONLY_HEADER, '1');
+      if (browser) {
+        if (grant?.who) headers.set(CALLER_HEADER, callerForHeader(grant.who));
+        headers.set('traceparent', traceparentForDelivery(request.headers.get('traceparent')) ?? newTraceparent());
+      }
+      const body = reads ? undefined : await request.arrayBuffer();
+      const answer = await twin(new Request(`${url.origin}${url.pathname}${url.search}`, { method: request.method, headers, ...(body === undefined ? {} : { body }), redirect: 'manual' }));
       // a redirect the site answers names its own hostname: in the World it stays under the World's origin
       const out = new Headers(answer.headers);
       const location = out.get('location');
-      if (location) { try { const to = new URL(location, `https://${host}`); if (to.hostname === host) out.set('location', `${to.pathname}${to.search}${to.hash}`); } catch { /* left as answered */ } }
+      if (location) { try { const to = new URL(location, `https://${host}`); if (to.hostname === host) out.set('location', `${to.pathname}${to.search}${to.hash}`); else if (browser && routes && resolveTwinHost(routes.rules, to.hostname, routes.map, to.pathname, routes.claimed) && routes.sites.some(row => row.hosts.includes(to.hostname))) { const at = this.host.sitesTemplate?.(); const next = at ? siteUrlOf(at, to.hostname, browser) : null; if (next) out.set('location', `${next}${to.pathname}${to.search}${to.hash}`); } } catch { /* left as answered */ } }
       return new Response(request.method === 'HEAD' ? null : answer.body, { status: answer.status, statusText: answer.statusText, headers: out });
     }
     // a person's browser is told in words (often the site is not there yet, or was not in a copy of the World as it was)
@@ -1077,7 +1126,7 @@ export class WorldDoors {
   }
 
   async handle(request: Request): Promise<Response> {
-    request = stripBrowserSessionPermit(request);
+    request = withoutBrowserHeader(request);
     try {
       if (!this.host.ready() && !new URL(request.url).pathname.startsWith('/-/ping')) return Response.json({ error: 'booting', world: this.served }, { status: 503, headers: { 'retry-after': '1' } });
       const url = new URL(request.url);
@@ -1085,7 +1134,7 @@ export class WorldDoors {
       if (url.pathname === '/-/ping') return Response.json({ ok: true, world: this.served, worlds: [this.served] });
       if (this.onPages(url)) return await this.pagesPlane(request, url);
       const hostedSite = await this.hostedSiteOf(url);
-      if (hostedSite) return await this.pagesPlane(request, url, hostedSite);
+      if (hostedSite) return await this.pagesPlane(request, url, hostedSite.site, hostedSite.browser);
       if (this.siteShaped(url)) return Response.json({ error: `no site of ${this.served} at ${url.host}` }, { status: 404 });
       if (url.pathname.startsWith(`/-/${this.served}/`)) return await this.door(request, url, url.pathname.slice(`/-/${this.served}/`.length));
       // the attach manifest (@volter/world-core/attach, VOLTER_WORLD=<this World's URL>): every twin at its
@@ -1125,16 +1174,16 @@ export class WorldDoors {
 
   /** A twin's workspaces as its discovery door lists them (`GET /twin`'s `screens`: each built workspace screen's id and
    *  path), which a person is shown at `/<served>/<vendor><path>`. Asked again after a minute, as `enforcesRead` is. */
-  private readonly workspaces = new Map<string, { screens: Array<{ id: string; path: string }>; at: number }>();
-  private async screensOf(vendor: string): Promise<Array<{ id: string; path: string }>> {
+  private readonly workspaces = new Map<string, { screens: Array<{ id: string; path: string; host?: string }>; at: number }>();
+  private async screensOf(vendor: string): Promise<Array<{ id: string; path: string; host?: string }>> {
     const known = this.workspaces.get(vendor);
     if (known !== undefined && Date.now() - known.at < 60_000) return known.screens;
-    let screens: Array<{ id: string; path: string }> = [];
+    let screens: Array<{ id: string; path: string; host?: string }> = [];
     const twin = this.host.twinFetch(vendor);
     try {
       const answer = twin ? await twin(new Request('http://world.local/twin', { headers: { [READ_ONLY_HEADER]: '1' } })) : null;
       const listed = answer?.ok ? ((await answer.json()) as { screens?: unknown }).screens : undefined;
-      if (Array.isArray(listed)) screens = listed.filter((x): x is { id: string; path: string } => typeof x?.id === 'string' && typeof x?.path === 'string').map(({ id, path }) => ({ id, path }));
+      if (Array.isArray(listed)) screens = listed.filter((x): x is { id: string; path: string; host?: string } => typeof x?.id === 'string' && typeof x?.path === 'string').map(({ id, path, host }) => ({ id, path, ...(typeof host === 'string' ? { host } : {}) }));
     } catch { screens = []; }
     this.workspaces.set(vendor, { screens, at: Date.now() });
     return screens;
@@ -1161,6 +1210,7 @@ export class WorldDoors {
 
   /** The vendor wire: `/<org>/<world>/<vendor>/<rest>` → the twin's own URL. */
   private async wire(request: Request, url: URL, rest: string): Promise<Response> {
+    request = withoutBrowserHeader(request);
     const [vendor, ...tail] = rest.split('/');
     const { scope, via } = this.credential(request);
     const manifestAsk = request.method === 'GET' && tail.join('/').replace(/\/+$/, '') === 'twin';
@@ -1205,7 +1255,6 @@ export class WorldDoors {
     // the request's trace: the caller's trace-id goes on (or a new one), under a parent-id the World mints, which the
     // request's log entries carry, so each entry is joined to its caller by an id no caller chose
     headers.delete(CALLER_HEADER);
-    headers.delete(BROWSER_SESSION_HEADER);
     // the address a request was signed for (a CLI's loopback bridge says it, @volter/world-core/http-bridge) is a
     // credential holder's word: a browser's session cannot name another, so a signature is checked on the path it reached
     if (via === 'session') { headers.delete(ORIGINAL_PATH_HEADER); headers.delete('x-volter-twin-original-host'); }
@@ -1243,9 +1292,9 @@ export class WorldDoors {
     // above): caches keep them apart
     out.append('vary', 'Sec-Fetch-Dest');
     const setCookies = answer.headers.getSetCookie();
-    if (setCookies.some((c) => /^\s*(?:__Host-)?volter_(?:world|pages)=/i.test(c))) {
+    if (setCookies.some((c) => /^\s*(?:__Host-)?volter_(?:world|pages|browser)=/i.test(c))) {
       out.delete('set-cookie');
-      for (const c of setCookies) if (!/^\s*(?:__Host-)?volter_(?:world|pages)=/i.test(c)) out.append('set-cookie', c);
+      for (const c of setCookies) if (!/^\s*(?:__Host-)?volter_(?:world|pages|browser)=/i.test(c)) out.append('set-cookie', c);
     }
     return new Response(answer.body, { status: answer.status, headers: out });
   }
@@ -1265,7 +1314,7 @@ export class WorldDoors {
     // what leaves for the vendor before the seal is applied: no World token in any header it can arrive
     // under (an SDK's own `Authorization: Bearer` included), no cookie, no routing headers of this World
     const caller = new Headers(request.headers);
-    for (const h of [TOKEN_HEADER, TWINS_KEY_HEADER, TWIN_PREFIX_HEADER, TWIN_SITES_HEADER, CALLER_HEADER, BROWSER_SESSION_HEADER, 'host', 'x-forwarded-host', 'x-forwarded-proto', 'cookie']) caller.delete(h);
+    for (const h of [TOKEN_HEADER, TWINS_KEY_HEADER, TWIN_PREFIX_HEADER, TWIN_SITES_HEADER, CALLER_HEADER, 'host', 'x-forwarded-host', 'x-forwarded-proto', 'cookie']) caller.delete(h);
     // a secret this World minted (`tok_…`, live, revoked or expired) or one that opens it never leaves
     const authorization = caller.get('authorization');
     const offered = authorization ? presentedSecrets(new Headers({ authorization }), { token: TOKEN_HEADER, twinsKey: TWINS_KEY_HEADER }) : [];
@@ -1393,19 +1442,29 @@ export class WorldDoors {
     if (kind === 'sites' && name === 'go' && request.method === 'GET') {
       const fetchSite = request.headers.get('sec-fetch-site');
       const dest = request.headers.get('sec-fetch-dest');
+      const browser = url.searchParams.get('browser') ?? undefined;
+      if (browser && fetchSite !== 'same-origin' && fetchSite !== 'none') return Response.json({ error: 'a browser site opens only from its World or a typed address (Sec-Fetch-Site: same-origin or none)' }, { status: 403 });
       // a person's navigation (from here, from the site's own page linking back, or typed in), or a frame of this World's
       // own console (its board, its comparison)
-      const navigated = dest === 'document' && ['same-origin', 'same-site', 'none'].includes(fetchSite ?? '');
-      const framed = dest === 'iframe' && fetchSite === 'same-origin';
+      const navigated = (request.method === 'GET' || request.method === 'HEAD') && dest === 'document' && ['same-origin', 'same-site', 'none'].includes(fetchSite ?? '');
+      const framed = fetchSite === 'same-origin' && dest === 'iframe';
       if (via === 'session' && !navigated && !framed) return Response.json({ error: "a hosted site opens on a person's navigation" }, { status: 403 });
       const template = this.host.sitesTemplate?.() ?? null;
       const hostname = (url.searchParams.get('host') ?? '').toLowerCase();
-      const claimed = (await this.claimedHosts(url.origin)).some(({ hosts }) => hosts.some((h) => h.toLowerCase() === hostname));
-      const at = template && claimed ? siteUrlOf(template, hostname) : null;
+      if (browser) {
+        try { assertBrowserName(browser); } catch (error) { return Response.json({ error: (error as Error).message }, { status: 400 }); }
+        if (!worldBrowser(this.up().dirs.data, browser)) return Response.json({ error: `no browser ${browser}` }, { status: 404 });
+      }
+      const claimed = (await (browser ? this.browserSites(url.origin) : this.claimedHosts(url.origin))).some(({ hosts }) => hosts.some((h) => h.toLowerCase() === hostname));
+      const at = template && claimed ? siteUrlOf(template, hostname, browser) : null;
+      if (browser && at && (await this.claimedHosts(url.origin)).some(row => row.hosts.some(site => {
+        const claimedAt = siteUrlOf(template!, site);
+        return claimedAt && new URL(claimedAt).host === new URL(at).host;
+      }))) return Response.json({ error: `browser ${browser}'s address for ${hostname} is owned by a claimed site` }, { status: 404 });
       if (!at) return Response.json({ error: `${hostname || 'that host'} is no site of ${this.served} shown here` }, { status: 404 });
       const asked = this.credential(request);
       const land = url.searchParams.get('land') ?? '/';
-      const passed = this.mintPagesPass('read', { site: hostname, ...(asked.session ? { session: asked.session } : {}), ...(asked.who ? { who: asked.who } : {}), ...(this.host.browserOrigin?.() ? { framer: this.host.browserOrigin!()! } : {}) });
+      const passed = this.mintPagesPass(browser ? scope : 'read', { site: hostname, ...(browser ? { browser } : {}), ...(asked.session ? { session: asked.session } : {}), ...(asked.who ? { who: asked.who } : {}), ...(this.host.browserOrigin?.() ? { framer: this.host.browserOrigin!()! } : {}) });
       if (!passed) return Response.json({ error: 'too many sites opened at once: try again in a minute' }, { status: 429 });
       return new Response(null, { status: 303, headers: { location: `${at}/-/${this.served}/pages/open#${new URLSearchParams({ pass: passed, land: land.startsWith('/') ? land : '/' }).toString()}`, 'cache-control': 'no-store', 'referrer-policy': 'no-referrer' } });
     }
@@ -1419,6 +1478,87 @@ export class WorldDoors {
     if (kind === 'keys') return this.keysDoor(request, name, scope, via, this.credential(request).session);
     if (scope === 'read' && request.method !== 'GET') return Response.json({ error: 'the read token opens only reads' }, { status: 403 });
 
+    if (kind === 'browsers') {
+      if (parts.length > 2) return Response.json({ error: 'no such browser door' }, { status: 404 });
+      const headers = { 'cache-control': 'no-store' };
+      if (!name) return request.method === 'GET'
+        ? Response.json({ browsers: worldBrowsers(this.up().dirs.data).map(b => b.name) }, { headers })
+        : Response.json({ error: 'list browsers with GET' }, { status: 405 });
+      try { assertBrowserName(name); } catch (error) { return Response.json({ error: (error as Error).message }, { status: 400 }); }
+      return this.serialized('browsers', async () => {
+        const data = this.host.reload().dirs.data;
+        if (request.method === 'GET') {
+          const b = worldBrowser(data, name);
+          return b ? Response.json(b.state, { headers }) : Response.json({ error: `no browser ${name}` }, { status: 404 });
+        }
+        if (request.method === 'DELETE') {
+          if (!worldBrowser(data, name)) return Response.json({ error: `no browser ${name}` }, { status: 404 });
+          deleteWorldBrowser(data, name);
+          if (this.up().envFile) materializeBrowserFiles(data, this.worldRoot, this.name, loadWorldConfig(this.configRef, this.worldRoot).config.id);
+          return new Response(null, { status: 204, headers });
+        }
+        if (request.method === 'PUT') {
+          if (!/^application\/json\b/i.test(request.headers.get('content-type') ?? '')) return Response.json({ error: 'browser state is application/json' }, { status: 415 });
+          if (!worldBrowser(data, name) && worldBrowsers(data).length >= BROWSER_COUNT_LIMIT) return Response.json({ error: `a World holds at most ${BROWSER_COUNT_LIMIT} browsers; delete one before adding another` }, { status: 409 });
+          const oversized = (): Response => Response.json({ error: `browser state PUT body is limited to ${BROWSER_STATE_BYTES_LIMIT} bytes (1 MiB)` }, { status: 413 });
+          const length = request.headers.get('content-length');
+          if (length && /^\d+$/.test(length) && Number(length) > BROWSER_STATE_BYTES_LIMIT) return oversized();
+          let state;
+          try {
+            const reader = request.body?.getReader();
+            const chunks: Uint8Array[] = [];
+            let bytes = 0;
+            if (reader) {
+              try {
+                for (;;) {
+                  const chunk = await reader.read();
+                  if (chunk.done) break;
+                  bytes += chunk.value.byteLength;
+                  if (bytes > BROWSER_STATE_BYTES_LIMIT) { await reader.cancel().catch(() => {}); return oversized(); }
+                  chunks.push(chunk.value);
+                }
+              } finally { reader.releaseLock(); }
+            }
+            const body = new Uint8Array(bytes);
+            let offset = 0;
+            for (const chunk of chunks) { body.set(chunk, offset); offset += chunk.byteLength; }
+            state = validateBrowserState(JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(body)));
+          } catch (error) { return Response.json({ error: (error as Error).message }, { status: 400 }); }
+          const template = this.host.sitesTemplate?.();
+          if (template) {
+            const sites = await this.browserSites(url.origin);
+            const claimed = await this.claimedHosts(url.origin);
+            const addresses = new Map<string, string>();
+            for (const { hosts } of claimed) for (const site of hosts) {
+              const at = siteUrlOf(template, site);
+              if (at) addresses.set(new URL(at).host, `claimed site ${site}`);
+            }
+            for (const other of worldBrowsers(data)) if (other.name !== name) for (const { hosts } of sites) for (const site of hosts) {
+              const at = siteUrlOf(template, site, other.name);
+              if (at) addresses.set(new URL(at).host, `browser ${other.name}, site ${site}`);
+            }
+            let fits = false;
+            for (const { hosts } of sites) for (const site of hosts) {
+              const at = siteUrlOf(template, site, name);
+              if (!at) continue;
+              fits = true;
+              const host = new URL(at).host;
+              const identity = `browser ${name}, site ${site}`;
+              if (addresses.has(host) && addresses.get(host) !== identity) return Response.json({ error: `${identity} collides with ${addresses.get(host)} at ${host}` }, { status: 400 });
+              addresses.set(host, identity);
+            }
+            if (!fits) return Response.json({ error: sites.some(row => row.hosts.length)
+              ? `no site of this World fits browser ${name} (DNS labels are at most 63 characters)`
+              : `this World has no declared or claimed exact-host site for browser ${name}` }, { status: 400 });
+          }
+          putWorldBrowser(data, name, state);
+          if (this.up().envFile) materializeBrowserFiles(data, this.worldRoot, this.name, loadWorldConfig(this.configRef, this.worldRoot).config.id);
+          return Response.json(state, { headers });
+        }
+        return Response.json({ error: 'browser state takes GET, PUT or DELETE' }, { status: 405 });
+      });
+    }
+
     if (kind === 'clock') return await this.clockDoor(request, name);
     if (kind === 'branches') return await this.branchesDoor(request, url, parts.slice(1), via);
     // each twin's history cut at an instant: where a branch "as of" that instant starts
@@ -1740,26 +1880,6 @@ export class WorldDoors {
       return Response.json({ world: this.served, twins });
     }
     if (kind === 'twins' && name) {
-      if (parts.length === 3 && (verb === 'people' || verb === 'session')) {
-        const session = Object.hasOwn(this.up().services, name) ? await this.browserSessionOf(name) : null;
-        if (verb === 'people' && request.method === 'GET') return Response.json({ viewAs: session !== null, people: session ? this.vendorPeople(name).map(({ id, label }) => ({ id, label })) : [] }, { headers: { 'cache-control': 'no-store' } });
-        if (verb === 'session' && request.method === 'POST') {
-          if (!session) return Response.json({ error: `${name} needs a declared browser session, a drawn screen and a content plane for View as` }, { status: 409 });
-          if (via !== 'session' || presentedSecrets(request.headers, { token: TOKEN_HEADER, twinsKey: TWINS_KEY_HEADER }).length || crossSite || site !== 'same-origin') return Response.json({ error: 'View as is opened from this World’s own page' }, { status: 403 });
-          const body = await request.json().catch(() => null) as { person?: unknown; land?: unknown } | null;
-          const land = this.vendorLanding(name, body?.land);
-          if (!body || (body.person !== null && typeof body.person !== 'string') || !land) return Response.json({ error: 'a session names a person (or null) and a path within that vendor' }, { status: 400 });
-          if (body.person !== null && !this.vendorPeople(name).some((p) => p.id === body.person)) return Response.json({ error: 'no such person in this World' }, { status: 404 });
-          const at = this.host.pagesOrigin?.();
-          if (!at) return Response.json({ error: 'View as needs this World’s content plane' }, { status: 409 });
-          const asked = this.credential(request);
-          if (!asked.session) return Response.json({ error: 'View as needs this World’s browser session' }, { status: 403 });
-          const pass = this.mintPagesPass('write', { session: asked.session, ...(asked.who ? { who: asked.who } : {}), ...(this.host.browserOrigin?.() ? { framer: this.host.browserOrigin!()! } : {}) }, { vendor: name, person: body.person, land, asker: this.callerOf(request)! });
-          if (!pass) return Response.json({ error: 'too many pages opened at once: try again in a minute' }, { status: 429 });
-          return Response.json({ url: `${at}/${this.served}/${name}/_twin/view-as/open#${new URLSearchParams({ pass, land, viewAs: '1' }).toString()}` }, { headers: { 'cache-control': 'no-store' } });
-        }
-      }
-
       if (verb === 'root' && request.method === 'GET') return Response.json({ twin: name, root: rootForControlRoot(this.controlRoot(name), name) ?? null, credential: sealedCredentialInfo(this.worldRoot, name) });
       if (verb === 'root' && request.method === 'PUT') {
         const body = (await request.json()) as RootConfig | null;
@@ -2030,7 +2150,11 @@ export class WorldDoors {
   private async boardChanges(url: URL, fork = false): Promise<Response> {
     const key = url.searchParams.get('frame') ?? '';
     if (!key) return Response.json({ error: 'board/changes?frame=<vendor>:<frame id>' }, { status: 400 });
-    const found = (await this.boardFrames(url, fork)).frames.find(({ frame }) => `${frame.vendor}:${frame.id}` === key);
+    const { frames } = await this.boardFrames(url, fork);
+    const first = worldBrowsers(this.up().dirs.data)[0]?.name;
+    const keyOf = (frame: (typeof frames)[number]['frame']): string => boardFrameKey({ vendor: frame.vendor, id: frame.id, ...(typeof frame.browser === 'string' ? { browser: frame.browser } : {}) });
+    const found = frames.find(({ frame }) => keyOf(frame) === key)
+      ?? frames.find(({ frame }) => frame.browser === first && `${frame.vendor}:${frame.id}` === key);
     if (!found) return Response.json({ error: `no frame ${key} on ${this.served}'s board` }, { status: 404 });
     const acts = new Map<string, { at: string; writes: number; entries: Array<{ op: string; operation?: string; subject: { type: string; id: string }; fields: Record<string, string> }> }>();
     for (const c of found.mine) {
@@ -2046,17 +2170,25 @@ export class WorldDoors {
   }
   /** Every twin's frames, where each opens here, and each with the changes not yet cut that are its own. */
   private async boardFrames(url: URL, fork = false): Promise<{ delta: ReturnType<typeof diffWorld>; frames: Array<{ frame: Record<string, unknown> & { vendor: string; id: string }; mine: Array<ReturnType<typeof diffWorld>['actions'][number]> }> }> {
-    const claimed = new Map((await this.claimedHosts(url.origin)).map(({ vendor, hosts }) => [vendor, new Set(hosts)]));
+    const listedHosts = await this.claimedHosts(url.origin);
+    const claimed = new Map(listedHosts.map(({ vendor, hosts }) => [vendor, new Set(hosts)]));
     const sitesAt = this.host.sitesTemplate?.() ?? null;
+    const browsers: Array<string | undefined> = worldBrowsers(this.up().dirs.data).map(b => b.name);
+    if (!browsers.length) browsers.push(undefined);
+    const browserHosts = browsers[0] ? new Map((await this.browserSites(url.origin, listedHosts)).map(({ vendor, hosts }) => [vendor, new Set(hosts)])) : claimed;
     // a site private to the World's people (a `{site}` template: a hosted World) opens through this World's own origin,
     // which hands its address a one-time read pass (sites/go); one on this machine opens at its address
-    const siteAt = (hostname: string, rest: string): string | null => {
+    const siteAt = (hostname: string, rest: string, browser?: string): string | null => {
       if (!sitesAt) return null;
-      const direct = siteUrlOf(sitesAt, hostname);
+      const direct = siteUrlOf(sitesAt, hostname, browser);
       if (!direct) return null;
-      if (sitesAt.includes('{host}')) return `${direct}${rest}`;
+      if (browser && [...claimed.values()].some(hosts => [...hosts].some(site => {
+        const claimedAt = siteUrlOf(sitesAt, site);
+        return claimedAt && new URL(claimedAt).host === new URL(direct).host;
+      }))) return null;
+      if (!browser && sitesAt.includes('{host}')) return `${direct}${rest}`;
       const own = this.host.browserOrigin?.() ?? null;
-      return own ? `${own}/-/${this.served}/sites/go?${new URLSearchParams({ host: hostname, land: rest }).toString()}` : null;
+      return own ? `${own}/-/${this.served}/sites/go?${new URLSearchParams({ host: hostname, ...(browser ? { browser } : {}), land: rest }).toString()}` : null;
     };
     // inherited history is the parent log: the branch's own ledger starts at its fork, even after a cut
     const delta = diffWorld(this.name, { root: this.worldRoot, ...(fork ? { base: 'world-boot' } : {}) });
@@ -2072,25 +2204,50 @@ export class WorldDoors {
       } catch { listed = []; }
       // a pack that lays out no board yet keeps its vendor's home on it (its root workspace, else its first unparameterized
       // one), whose changes are all of the vendor's
-      if (!listed.length) {
+      const fallback = !listed.length;
+      let homeHost: string | undefined;
+      if (fallback) {
         const screens = await this.screensOf(vendor);
         const home = screens.find((w) => w.path.replace(/\/+$/, '') === '') ?? screens.find((w) => !/[{<]/.test(w.path));
-        if (home) frames.push({ frame: { vendor, id: `home:${home.id}`, kind: 'home', title: vendor, section: { id: 'home', title: 'Home' }, url: home.path, at: { screen: home.path.startsWith('/') ? home.path : `/${home.path}` } }, mine: changes.filter((c) => c.service === vendor) });
+        homeHost = home?.host;
+        if (home) listed = [{ id: `home:${home.id}`, kind: 'home', title: vendor, section: { id: 'home', title: 'Home' }, url: home.path, covers: [], drawn: true }];
       }
       for (const f of listed) {
+        const covered = new Set(f.covers.map(c => `${c.type}:${c.id}`));
+        const mine = changes.filter(x => x.service === vendor && (fallback || covered.has(`${x.action.subject.type}:${x.action.subject.id}`)));
+        const add = (at: { site: string } | { screen: string } | null, browser?: string, unseen?: string): void => {
+          frames.push({ frame: { vendor, ...(browser ? { browser } : {}), id: f.id, kind: f.kind, title: f.title, section: f.section, url: f.url, at, ...(f.parent ? { parent: f.parent } : {}), ...(f.ours ? { ours: true } : {}), ...(unseen ? { unseen } : {}) }, mine });
+        };
+        let plain = false;
+        const openedBrowsers: Array<{ browser: string; at: string }> = [];
+        for (const browser of browsers) {
+          if (!browser) { plain = true; continue; }
+          let opened: string | null = null;
+          try {
+            const u = new URL(f.url, homeHost ? `https://${homeHost}` : undefined);
+            if (browserHosts.get(vendor)?.has(u.hostname.toLowerCase())) opened = siteAt(u.hostname.toLowerCase(), `${u.pathname}${u.search}`, browser);
+          } catch { /* this page has no site address */ }
+          if (opened) openedBrowsers.push({ browser, at: opened });
+          else plain = true;
+        }
+        for (const opened of openedBrowsers) add({ site: opened.at }, opened.browser);
+        if (!plain) continue;
         let at: { site: string } | { screen: string } | null = null;
-        // why a frame opens nowhere: its twin draws no page for it yet, or this host routes no sites
         let unseen: 'not-drawn' | 'sites-not-routed' | undefined;
         try {
           const u = new URL(f.url);
-          if (claimed.get(vendor)?.has(u.hostname.toLowerCase())) { const opened = siteAt(u.hostname.toLowerCase(), `${u.pathname}${u.search}`); at = opened ? { site: opened } : null; }
+          if (claimed.get(vendor)?.has(u.hostname.toLowerCase())) {
+            const opened = siteAt(u.hostname.toLowerCase(), `${u.pathname}${u.search}`);
+            if (opened) at = { site: opened };
+          }
           else if (f.drawn) at = { screen: `${u.pathname}${u.search}` };
           if (!at) unseen = claimed.get(vendor)?.has(u.hostname.toLowerCase()) ? 'sites-not-routed' : 'not-drawn';
-        } catch { at = null; unseen = 'not-drawn'; }
-        const covered = new Set(f.covers.map((c) => `${c.type}:${c.id}`));
-        frames.push({ frame: { vendor, id: f.id, kind: f.kind, title: f.title, section: f.section, url: f.url, at, ...(f.parent ? { parent: f.parent } : {}), ...(f.ours ? { ours: true } : {}), ...(unseen ? { unseen } : {}) }, mine: changes.filter((x) => x.service === vendor && covered.has(`${x.action.subject.type}:${x.action.subject.id}`)) });
+        } catch { if (fallback) at = { screen: f.url.startsWith('/') ? f.url : `/${f.url}` }; else unseen = 'not-drawn'; }
+        if (fallback) at = { screen: f.url.startsWith('/') ? f.url : `/${f.url}` };
+        add(at, undefined, unseen);
       }
     }
+    if (browsers[0]) frames.sort((a, b) => String(a.frame.browser ?? '').localeCompare(String(b.frame.browser ?? '')));
     return { delta, frames };
   }
   /** The boards as the World keeps them, and the version a save names: the default board when none was ever kept. */