@volter/world-runtime 3.0.37 → 3.0.39

package/known-external-services.json

@@ -19,11 +19,11 @@
     },
     "@daily-co/daily-js": {
       "disposition": "demanded",
-      "reason": "vendor daily (daily.co), its call client (the call machine from c.daily.co, signalling on gs.daily.co, WebRTC media): the daily pack serves Daily's REST API and a room's page, not the call, so the call client is a coverage gap (§9 of twin-daily, 2026-09-28)"
+      "reason": "vendor daily (daily.co), its call client (the call machine from c.daily.co, signalling on gs.daily.co, WebRTC media): the Daily REST spec does not describe call-client media or signalling, so this SDK remains an uncovered wire"
     },
     "@daily-co/daily-react": {
       "disposition": "demanded",
-      "reason": "vendor daily (daily.co), React hooks over its call client (@daily-co/daily-js): the daily pack serves Daily's REST API and a room's page, not the call, so the call client is a coverage gap (§9 of twin-daily, 2026-09-28)"
+      "reason": "vendor daily (daily.co), React hooks over its call client (@daily-co/daily-js): the Daily REST spec does not describe call-client media or signalling, so this SDK remains an uncovered wire"
     },
     "@azure/communication-email": {
       "disposition": "demanded",
@@ -193,10 +193,6 @@
       "disposition": "demanded",
       "reason": "vendor matrix, pack demanded by census 2026-08-31 (×1)"
     },
-    "node-telegram-bot-api": {
-      "disposition": "demanded",
-      "reason": "vendor telegram, pack demanded by census 2026-08-31 (×2); already curated in covers.ts UNKNOWN_DEP_KNOWN_SERVICES"
-    },
     "npm-registry@npm.jsr.io": {
       "disposition": "acknowledged",
       "reason": "acknowledged: registry destination — the npm-registry twin deliberately owns npmjs + GitHub only (census 2026-08-31, ×2)"
@@ -217,10 +213,6 @@
       "disposition": "demanded",
       "reason": "vendor shopify, well-known service client with no twin pack (curated in covers.ts UNKNOWN_DEP_KNOWN_SERVICES)"
     },
-    "telegraf": {
-      "disposition": "demanded",
-      "reason": "vendor telegram, pack demanded by census 2026-08-31 (×1); already curated in covers.ts UNKNOWN_DEP_KNOWN_SERVICES"
-    },
     "twenty-client-sdk": {
       "disposition": "demanded",
       "reason": "vendor twenty, pack demanded by census 2026-08-31 (×1)"
@@ -925,6 +917,7 @@
     }
   },
   "notExternal": {
+    "@chat-adapter/state-memory": "Chat SDK local in-memory state adapter, no external connection: @chat-adapter/state-memory 4.39.0 dist/index.js stores subscriptions in Set and locks, cache and queues in Map; https://chat-sdk.dev/adapters/official/memory",
     "@agentclientprotocol/sdk": "Agent Client Protocol library, not a vendor",
     "@ai-sdk/devtools": "local dev-tools UI for the AI SDK",
     "@ai-sdk/langchain": "LangChain interop adapter, not a service",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-runtime",
-  "version": "3.0.37",
+  "version": "3.0.39",
   "description": "World configs for twins: boot named local runtimes, allocate ports, generate world.env/instance.json, and run apps against fake-key twin worlds.",
   "keywords": [
     "twin",
@@ -41,7 +41,9 @@
     ".": {
       "types": "./dist/src/index.d.ts",
       "default": "./dist/src/index.js"
-    }
+    },
+    "./src/pglite-host.mjs": "./src/pglite-host.mjs",
+    "./browser-routes": "./src/browser-routes.cjs"
   },
   "bin": {
     "volter-world": "dist/src/cli.js",
@@ -60,7 +62,6 @@
   "devDependencies": {
     "@types/bun": "^1.2.20",
     "@types/node": "^24.0.0",
-    "mongodb": "~6.20.0",
     "pg": "8.16.3",
     "typescript": "^5.9.0"
   },
@@ -68,17 +69,21 @@
     "node": ">=22.3"
   },
   "peerDependencies": {
-    "@volter/world-core": "3.0.37",
-    "@volter/world-console": "3.0.32"
+    "@volter/world-core": "3.0.39",
+    "@volter/world-console": "3.0.34"
   },
   "dependencies": {
     "@electric-sql/pglite": "0.5.8",
     "@electric-sql/pglite-pgvector": "0.0.9",
     "@volter/world-access": "3.0.1",
-    "@volter/world-core": "3.0.37",
+    "@volter/world-core": "3.0.39",
+    "mongodb": "~6.20.0",
     "pg-gateway": "0.3.0-beta.4",
     "smol-toml": "^1.8.0",
-    "yaml": "2.9.0"
+    "yaml": "2.9.0",
+    "@volter/browser-host-node": "0.1.84",
+    "@volter/browser-sandboxes": "0.1.84",
+    "@volter/browser-runtime": "0.1.104"
   },
   "peerDependenciesMeta": {
     "@volter/world-console": {

package/src/actions-runner-cli.ts

@@ -8,9 +8,9 @@ import { mkdirSync } from 'node:fs';
 import { runQueued } from './actions-runner.ts';
 
 const args = process.argv.slice(2);
-const github = optionValue(args, '--github') ?? process.env.GITHUB_API_URL;
-const token = optionValue(args, '--token') ?? process.env.GITHUB_TOKEN;
-const work = optionValue(args, '--work') ?? '.volter/actions-runner';
+const github = optionValue(args, '--github') || process.env.GITHUB_API_URL;
+const token = optionValue(args, '--token') || process.env.GITHUB_TOKEN;
+const work = optionValue(args, '--work', '.volter/actions-runner');
 if (!github || !token) {
   process.stderr.write('usage: volter-world-actions-runner --github <url> --token <token> [--work <dir>] [--once]\n');
   process.exit(2);

package/src/actions-runner.ts

@@ -7,6 +7,7 @@
 //
 // What it does not do (named, so a workflow that needs them fails plainly): matrices beyond their first combination,
 // services and containers, composite and JavaScript actions from the marketplace, reusable workflows, concurrency groups.
+import { errorMessage } from './error-message.ts';
 import { spawn } from 'node:child_process';
 import { appendFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
@@ -222,7 +223,7 @@ export async function runOnce(opts: ActionsRunnerOptions, repo: string, run: Row
       if (failed) conclusion = 'failure';
     }
   } catch (error) {
-    log(`run ${repo}#${id}: ${(error as Error).message}`);
+    log(`run ${repo}#${id}: ${errorMessage(error)}`);
     conclusion = 'failure';
   } finally {
     await api(opts, 'POST', `/_twin/repos/${repo}/actions/runs/${id}/complete`, { conclusion });

package/src/app-url.ts

@@ -19,6 +19,7 @@
 // once, at the caller's request, and stores what it saw. The record lives in the instance dir, so
 // a re-`up` (which wipes the dir) or `down --purge` clears it: a recorded URL never outlives the
 // instance it described.
+import { errorMessage } from './error-message.ts';
 import { existsSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { withFileLock } from '@volter/world-core/runtime';
 import { join } from 'node:path';
@@ -223,7 +224,7 @@ export function addAppHosts(name: string, hosts: string[], options: { root?: str
 function listeningTcpPorts(pid: number): number[] {
   const result = spawnSync('lsof', ['-a', '-p', String(pid), '-iTCP', '-sTCP:LISTEN', '-P', '-n', '-Fn'], { windowsHide: true, encoding: 'utf8' });
   if (result.error) {
-    throw new Error(`volter-world app-url: \`lsof\` is unavailable (${result.error.message}) — pass the port, or --set the URL directly`);
+    throw new Error(`volter-world app-url: \`lsof\` is unavailable (${errorMessage(result.error)}) — pass the port, or --set the URL directly`);
   }
   const ports = new Set<number>();
   for (const line of (result.stdout ?? '').split('\n')) {

package/src/backings.ts

@@ -1,15 +1,20 @@
+import { fileURLToPath } from 'node:url';
 import type { WorldServiceConfig } from './schema.ts';
 
 export type ServerBackingFacts = {
   serverBacking: { command: string };
+  maxRequestBodySize?: number;
   adoption: { sdks: string[]; pypi: string[]; envStems: string[] };
   hostsNone: string;
   endpointEnv: { name: string; templates: Record<string, string>; note: string };
 };
 
 /**
+ * MongoDB is declared infrastructure, not an API service in this table: its native server uses
+ * mongodb-backing.ts through the same managed lifecycle as Postgres (pglite-backing.ts).
+ *
  * A vendor whose open-source server a World runs as its service instead of a twin (architecture, "A vendor's own
- * server as a backing"): the media plane no pack can hold as data. The service is the vendor's own binary on an 'auto'
+ * server as a backing"): the wire or media plane no pack can hold as data. The service is the vendor's own binary on an 'auto'
  * port, loopback only; the application's key and secret are the ones the server is started with, so its SDK signs
  * what the server verifies. What the server does not do on its own (LiveKit's egress, a separate service) the
  * service's note names.
@@ -19,6 +24,31 @@ export const VENDOR_SERVER_BACKINGS: Record<string, { service: WorldServiceConfi
   // livekit-server wants a secret of at least 32 characters
   const secret = 'twin-livekit-secret-for-the-worlds-own-server';
   return {
+    temporal: {
+      service: {
+        '//': 'Temporal CLI development server on PATH, loopback only, SQLite in World state. No cluster, Cloud, TLS, World clock or branching; reset clears workflow history. See cookbook/temporal-backing.',
+        id: 'temporal', type: 'process', command: 'node',
+        args: [fileURLToPath(new URL('./temporal-backing.mjs', import.meta.url))],
+        port: 'auto', portArg: false, controlPlane: true, branchState: 'unsupported',
+        // Existing service readiness budgets, no new timeout. Native dev-server checkout took 0.84 s
+        // on 6e0123e + backing error handling changes with Node 23.9.0; SDK consumer only in this World, host not isolated.
+        // Reproduce: cookbook/temporal-backing/README.md, timed checkout and reset commands.
+        ready: { command: 'node', args: [fileURLToPath(new URL('./temporal-backing.mjs', import.meta.url)), '--health'] },
+        injectEnvTemplates: {
+          TEMPORAL_ADDRESS: '${host}:${port}', TEMPORAL_NAMESPACE: 'default', TEMPORAL_TLS: 'false', TEMPORAL_API_KEY: '',
+        },
+      },
+      env: { TEMPORAL_NAMESPACE: 'default', TEMPORAL_TLS: 'false', TEMPORAL_API_KEY: '' },
+      facts: {
+        serverBacking: { command: 'temporal' },
+        adoption: { sdks: ['@temporalio/client', '@temporalio/worker', '@temporalio/workflow', 'nestjs-temporal-core'],
+          pypi: ['temporalio'], envStems: ['TEMPORAL'] },
+        hostsNone: 'The World runs the vendor development server at its declared loopback gRPC endpoint.',
+        endpointEnv: { name: 'TEMPORAL_ADDRESS', templates: {
+          TEMPORAL_ADDRESS: '${host}:${port}', TEMPORAL_NAMESPACE: 'default', TEMPORAL_TLS: 'false', TEMPORAL_API_KEY: '',
+        }, note: 'The local development server creates default; no TLS or Cloud API key.' },
+      },
+    },
     livekit: {
       service: {
         '//': 'LiveKit\'s own server (livekit-server, Apache-2.0; `brew install livekit` or LiveKit\'s install script puts it '
@@ -27,11 +57,11 @@ export const VENDOR_SERVER_BACKINGS: Record<string, { service: WorldServiceConfi
           + `"webhook: {api_key: ${key}, urls: [<the app's webhook URL>]}" to args.`,
         id: 'livekit',
         type: 'twin',
-        command: 'livekit-server',
-        // media on the loopback address over UDP from LiveKit's default range; ICE over TCP off (its fixed 7881 would
-        // collide with a second server)
-        args: ['--bind', '127.0.0.1', '--node-ip', '127.0.0.1', '--keys', `${key}: ${secret}`, '--rtc.tcp_port', '0'],
+        command: 'node',
+        // The wrapper supplies a local TURN relay using UDP at the allocated HTTP port.
+        args: [fileURLToPath(new URL('./livekit-backing.mjs', import.meta.url)), '--keys', `${key}: ${secret}`],
         port: 'auto',
+        portArg: false,
         rootArg: false,
         controlPlane: true,
         ready: { httpUrl: '${url}/' },
@@ -43,9 +73,11 @@ export const VENDOR_SERVER_BACKINGS: Record<string, { service: WorldServiceConfi
       },
       env: { LIVEKIT_API_KEY: key, LIVEKIT_API_SECRET: secret },
       facts: {
-        // Current consumers: RH2's package.json and server SDK imports; LiveKit's server is the backing, not a pack.
+        // LiveKit's client and server SDKs use its own server as the backing.
         serverBacking: { command: 'livekit-server' },
-        adoption: { sdks: ['livekit-client', 'livekit-server-sdk', '@livekit/rtc-node'], pypi: ['livekit', 'livekit-agents', 'livekit-api'], envStems: ['LIVEKIT'] },
+        adoption: { sdks: ['livekit-client', 'livekit-server-sdk', '@livekit/rtc-node', '@livekit/react-native',
+          '@livekit/react-native-expo-plugin', '@livekit/react-native-webrtc'],
+          pypi: ['livekit', 'livekit-agents', 'livekit-api'], envStems: ['LIVEKIT'] },
         hostsNone: 'The World runs the vendor server on its declared endpoint; SDKs read LIVEKIT_URL.',
         endpointEnv: { name: 'LIVEKIT_URL', templates: { LIVEKIT_URL: 'ws://${host}:${port}', LIVEKIT_API_KEY: key, LIVEKIT_API_SECRET: secret }, note: 'Credentials and URL are the same ones the World starts its LiveKit server with.' },
       },
@@ -53,3 +85,29 @@ export const VENDOR_SERVER_BACKINGS: Record<string, { service: WorldServiceConfi
   };
 })();
 
+/** Declare a backing's application-owned env stems as service bindings; omitted stems use the vendor's defaults. */
+export function serverBackingService(vendor: string, declaration: { envStems?: readonly string[]; service?: WorldServiceConfig } = {}): WorldServiceConfig {
+  const backing = VENDOR_SERVER_BACKINGS[vendor];
+  // Native infrastructure supplies its already-declared lifecycle rather than an API service from the table.
+  const service = declaration.service ?? backing?.service;
+  if (!service) throw new Error(`No server backing declared for ${vendor}`);
+  const base = backing?.facts.adoption.envStems[0] ?? vendor.toUpperCase();
+  const stems = declaration.envStems ?? backing?.facts.adoption.envStems ?? [base];
+  if (!stems.length || stems.some((stem) => !/^[A-Z][A-Z0-9_]*$/.test(stem))) throw new Error('Server backing env stems must be nonempty uppercase env names');
+  const unique = [...new Set(stems)];
+  const bindingName = (name: string, stem: string): string => {
+    if (!name.startsWith(`${base}_`)) throw new Error(`Server backing ${vendor} binding ${name} has no vendor stem`);
+    return `${stem}${name.slice(base.length)}`;
+  };
+  const injectEnvTemplates = Object.fromEntries(unique.flatMap((stem) =>
+    Object.entries(service.injectEnvTemplates ?? {}).map(([name, value]) => [bindingName(name, stem), value])));
+  const external = service.external === undefined ? undefined : {
+    ...service.external,
+    ...(service.external.discover === undefined ? {} : { discover: unique.flatMap((stem) => service.external!.discover!.map((mapping) => {
+      const as = bindingName(mapping.as, stem);
+      // The producer keeps its own keys; only the application binding gets the declared stem.
+      return { ...mapping, as };
+    })) }),
+  };
+  return { ...service, ...(external ? { external } : { injectEnvTemplates }) };
+}

package/src/branch.ts

@@ -3,17 +3,19 @@
 // `branch <world> <name>` boots a new world from the base's config and forks every twin's mirror
 // into it (core's `forkTwin`: a POINTER to the base at its current position — the base's whole
 // history, its own entries included, is the branch's parent; nothing is copied). A managed database (containerless
-// Postgres) keeps no history, so it is the one thing copied: the stopped base's data, as of now. Two branches of one
+// Postgres and MongoDB) keeps no history, so it is the one thing copied: the stopped base's data, as of now. Two branches of one
 // base running at once share the database port its definition names; run one at a time (the SDK does). `checkout <name>`
 // brings a stopped world back up from its own instance record, state intact.
+import { runInfrastructure } from './infra.ts';
 import { cpSync, existsSync, readdirSync, readFileSync, rmSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { captureHistory, historyAtInstant, forkTwin, stateGeneration, withHistoryLocks, worldPaths, worldStateRoot } from '@volter/world-core/runtime';
 import { inheritWorldBrowsers, materializeBrowserFiles } from './browsers.ts';
-import { downWorld, saveWorldInstance, statusWorld, upWorld } from './runtime.ts';
+import { externalServiceEnv, downWorld, recordedWorldNetwork, saveWorldInstance, readWorldBootRecord, statusWorld, upWorld } from './runtime.ts';
 import type { WorldInstance } from './schema.ts';
-import { parseInfraDefinition, pgliteDown, pgliteUp } from './pglite-backing.ts';
+import { loadWorldConfig } from './configs.ts';
+import { containerlessDataDirectory, parseInfraDefinition, pgliteDown, pgliteUp } from './pglite-backing.ts';
 import { redisTwinCli, redisTwinDown, redisTwinUp } from './redis-backing.ts';
 
 export type BranchOptions = { root?: string; envFile?: string; forceEnvOutput?: boolean; now?: Date; /** branch from a point in the base's history: an instant, or a position per twin (contract "Just like Neon", 3) */ at?: { instant?: string; positions?: Record<string, number>; views?: Record<string, string> } };
@@ -27,7 +29,11 @@ function stateServices(controlRoot: string): string[] {
 /** A new world over the base's mirrors. */
 export async function branchWorld(base: string, name: string, options: BranchOptions = {}): Promise<{ instance: WorldInstance; forked: Record<string, string[]> }> {
   const root = resolve(options.root ?? process.cwd());
-  const from = statusWorld(base, root);
+  const from = readWorldBootRecord(base, root);
+  const { config } = loadWorldConfig(existsSync(from.configPath) ? from.configPath : from.config, root);
+  const unsupported = [...new Set([...config.services, ...Object.values(from.services)]
+    .filter((service) => service.branchState === 'unsupported').map((service) => service.id))];
+  if (unsupported.length) throw new Error(`volter-world branch: services do not support carrying state to a branch: ${unsupported.join(', ')}; retain the original World or reset it explicitly`);
   if (name === base) throw new Error(`volter-world branch: the branch needs a name other than the base's ("${base}")`);
   const envFile = options.envFile ?? join(dirname(from.envFile), `${name}.world.env`);
   const at = (options.now ?? new Date()).toISOString();
@@ -50,25 +56,9 @@ export async function branchWorld(base: string, name: string, options: BranchOpt
     throw new Error(`volter-world branch: ${base} has a managed database, which keeps no history to branch from at an instant or position; branch from its current state`);
   }
   refuseLiveDatabases(from, databases);
-  // a branch that fails to boot (a twin whose mounted version breaks the config's pin) leaves no half-made branch behind:
-  // its record without a fork would check out later as an empty World
-  const existed = (() => { try { statusWorld(name, root); return true; } catch { return false; } })();
-  const began = Date.now();
-  let instance: WorldInstance;
-  try {
-    instance = await upWorld(existsSync(from.configPath) ? from.configPath : from.config, { name, root, mode: from.mode, envFile, forceEnvOutput: options.forceEnvOutput });
-  } catch (error) {
-    // only a record made during this call is ours to remove, and it is removed by its own createdAt, as the fork's
-    // cleanup below does: a concurrent `branch` of the same name that recorded first keeps its World
-    let recorded: string | null = null;
-    if (!existed) { try { const made = statusWorld(name, root).createdAt; if (Date.parse(made) >= began) recorded = made; } catch { /* the boot recorded nothing */ } }
-    if (recorded) {
-      try { await downWorld(name, root, { purge: true, expectedCreatedAt: recorded }); } catch (cleanup) {
-        throw new Error(`${error instanceof Error ? error.message : String(error)} (and the half-made branch ${name} could not be removed: ${cleanup instanceof Error ? cleanup.message : String(cleanup)})`);
-      }
-    }
-    throw error;
-  }
+  // up owns rollback. If boot throws, retain its diagnostics: a name/time lookup cannot prove
+  // that a partial record belongs to this invocation, especially under a frozen World clock.
+  const instance = await upWorld(existsSync(from.configPath) ? from.configPath : from.config, { name, root, mode: from.mode, owner: from.lifecycle?.owner ?? from.resources?.owner, networkCeiling: recordedWorldNetwork(from), envFile, forceEnvOutput: options.forceEnvOutput });
   const forked: Record<string, string[]> = {};
   try {
     // the branch's origin is its base's, or none: never one a stopped World of the same name left
@@ -85,24 +75,30 @@ export async function branchWorld(base: string, name: string, options: BranchOpt
     materializeBrowserFiles(instance.dirs.data, root, name, instance.config);
     await branchManagedDatabases(from, instance, databases);
   } catch (error) {
-    await downWorld(name, root, { purge: true, expectedCreatedAt: instance.createdAt });
+    try { await downWorld(name, root, { purge: true, expectedInstance: instance.instance }); }
+    catch (cleanup) { throw new AggregateError([error, cleanup], 'Copied database startup and branch cleanup failed'); }
     throw error;
   }
   return { instance, forked };
 }
 
-/** The base's containerless managed databases: each PGlite `pglite-<kind>-data` and the MongoDB twin's
- *  `twin-mongodb-data` (pglite-backing.ts), and the redis twin's `redis-twin` tree (redis-backing.ts). A stopped World's
+/** The base's containerless managed databases: each PGlite `pglite-<kind>-data`, MongoDB's
+ *  `mongod-mongodb-data` (pglite-backing.ts), the redis twin's `redis-twin` tree (redis-backing.ts), and native PostgreSQL. A stopped World's
  *  hosts leave no pid file; a docker-backed World keeps its data under the container's volume, which a branch does not
  *  carry. */
 function managedDatabases(from: WorldInstance): string[] {
   const data = from.dirs.data;
   if (!existsSync(data)) return [];
-  return readdirSync(data).filter((n) => /^pglite-[a-z0-9_-]+-data$/.test(n) || n === 'twin-mongodb-data' || n === 'redis-twin');
+  const known = (name: string) => /^pglite-[a-z0-9_-]+-data$/.test(name) || name === 'mongod-mongodb-data' || name === 'native-postgres-data';
+  if (readdirSync(data).some(name => name.endsWith('-data') && !known(name) && !from.services[name])) {
+    throw new Error('volter-world branch: unrecognised storage; retain the original World');
+  }
+  return readdirSync(data).filter((n) => /^pglite-[a-z0-9_-]+-data$/.test(n) || n === 'mongod-mongodb-data' || n === 'redis-twin' || n === 'native-postgres-data');
 }
 
 /** The pid files of the hosts serving one managed database directory. */
 function hostPidFiles(data: string, db: string): string[] {
+  if (db === 'native-postgres-data') return [join(data, 'native-postgres.owner.json')];
   if (db === 'redis-twin') return readdirSync(data).filter((n) => /^redis-twin-\d+\.pid$/.test(n)).map((n) => join(data, n));
   return [join(data, `${db.slice(0, -'-data'.length)}.pid`)];
 }
@@ -112,7 +108,8 @@ function hostPidFiles(data: string, db: string): string[] {
 function refuseLiveDatabases(from: WorldInstance, dbs: string[]): void {
   for (const db of dbs) {
     for (const pidFile of hostPidFiles(from.dirs.data, db)) {
-      const pid = existsSync(pidFile) ? Number(readFileSync(pidFile, 'utf8').trim()) : NaN;
+      const recorded = existsSync(pidFile) ? readFileSync(pidFile, 'utf8').trim() : '';
+      const pid = db === 'native-postgres-data' && recorded ? JSON.parse(recorded).pid : Number(recorded);
       let live = false;
       if (Number.isInteger(pid) && pid > 0) { try { process.kill(pid, 0); live = true; } catch { live = false; } }
       if (live) throw new Error(`volter-world branch: ${from.name}'s managed ${db} is running (pid ${pid}); stop ${from.name} first so its database can be copied into the branch consistently`);
@@ -120,16 +117,58 @@ function refuseLiveDatabases(from: WorldInstance, dbs: string[]): void {
   }
 }
 
+/** Compare actual cold-storage formats, not the edited config's requested backing. */
+function requireMatchingBackings(source: string[], child: string[]): void {
+  const kinds = {
+    postgres: ['native-postgres-data', 'pglite-postgres-data'],
+    mongodb: ['mongod-mongodb-data'],
+  };
+  for (const [kind, formats] of Object.entries(kinds)) {
+    const from = source.filter(directory => formats.includes(directory));
+    if (!from.length) continue;
+    const to = child.filter(directory => formats.includes(directory));
+    if (from.length !== 1 || to.length !== 1 || from[0] !== to[0]) {
+      throw new Error(`volter-world branch: ${kind} source backing ${from.join(', ')} differs from child backing ${to.join(', ') || 'none'}; refusing to copy database bytes`);
+    }
+  }
+  for (const directory of source) {
+    if (!child.includes(directory)) throw new Error(`volter-world branch: source backing ${directory} differs from child backing ${child.join(', ') || 'none'}; refusing to copy database bytes`);
+  }
+}
+
 /** The branch's managed databases as the base holds them: the branch's own, just booted empty by `up`, are stopped,
  *  replaced by a copy of the base's data, and started again, so a branch of a migrated and seeded World serves that
  *  data, as its twins serve the base's history. */
 async function branchManagedDatabases(from: WorldInstance, instance: WorldInstance, dbs: string[]): Promise<void> {
   if (!dbs.length) return;
+  requireMatchingBackings(dbs, managedDatabases(instance));
   const definition = join(dirname(instance.configPath), 'world.infrastructure.yml');
-  if (!existsSync(definition)) return;
+  if (!existsSync(definition)) throw new Error('volter-world branch: source has managed database bytes but child has no infrastructure definition; refusing to copy');
   const services = parseInfraDefinition(readFileSync(definition, 'utf8'));
   const redis = services.filter((s) => s.kind === 'redis');
-  const hosted = services.filter((s) => s.kind !== 'redis');
+  const hosted = services.filter((service) => {
+    const directory = containerlessDataDirectory(service.kind);
+    if (directory === undefined || !dbs.includes(directory)) return false;
+    if (!existsSync(join(instance.dirs.data, directory))) {
+      throw new Error(`volter-world branch: ${service.kind}'s copied state belongs to a different backing than the branch booted; refusing to replace its database`);
+    }
+    return true;
+  });
+  const config = loadWorldConfig(instance.configPath, instance.root).config;
+  const infrastructure = config.services.find((service) => service.type === 'external' && (service.external?.up[0] === 'volter-world-infra' || service.id === 'infrastructure'));
+  if (!infrastructure) throw new Error(`volter-world branch: ${instance.name}'s managed databases have no declared infrastructure service`);
+  const launch = { env: externalServiceEnv(infrastructure, instance.dirs, instance.env, config.stripEnv) };
+  if (dbs.includes('native-postgres-data')) {
+    const io = { out: (text: string) => process.stdout.write(text), err: (text: string) => process.stderr.write(text) };
+    if (await runInfrastructure('down', launch.env, io) !== 0) throw new Error('managed native database branch could not stop its new backing');
+    for (const db of dbs) {
+      const to = join(instance.dirs.data, db);
+      rmSync(to, { recursive: true, force: true });
+      cpSync(join(from.dirs.data, db), to, { recursive: true });
+    }
+    if (await runInfrastructure('up', launch.env, io) !== 0) throw new Error('managed native database branch could not resume its copied backing');
+    return;
+  }
   const redisCli = dbs.includes('redis-twin') && redis.length ? redisTwinCli([dirname(fileURLToPath(import.meta.url)), dirname(instance.configPath)]) : undefined;
   await pgliteDown(hosted, instance.dirs.data);
   if (redisCli) await redisTwinDown(redis, instance.dirs.data);
@@ -139,13 +178,13 @@ async function branchManagedDatabases(from: WorldInstance, instance: WorldInstan
     rmSync(to, { recursive: true, force: true });
     cpSync(join(from.dirs.data, db), to, { recursive: true });
   }
-  if (dbs.some((db) => db !== 'redis-twin')) await pgliteUp(hosted, instance.dirs.data);
-  if (redisCli) await redisTwinUp(redis, instance.dirs.data, redisCli);
+  if (hosted.length) await pgliteUp(hosted, instance.dirs.data, launch);
+  if (redisCli) await redisTwinUp(redis, instance.dirs.data, redisCli, launch);
 }
 
 /** A stopped world back up, from its own record. */
 export async function checkoutWorld(name: string, options: { root?: string } = {}): Promise<WorldInstance> {
   const root = resolve(options.root ?? process.cwd());
-  const was = statusWorld(name, root);
-  return upWorld(existsSync(was.configPath) ? was.configPath : was.config, { name, root, mode: was.mode, envFile: was.envFile, keepState: true });
+  const was = readWorldBootRecord(name, root);
+  return upWorld(existsSync(was.configPath) ? was.configPath : was.config, { name, root, mode: was.mode, owner: was.lifecycle?.owner ?? was.resources?.owner, envFile: was.envFile, keepState: true });
 }

package/src/browser-routes.cjs

@@ -0,0 +1,59 @@
+// Bind an existing browser page to a World-attached HTTP transport. A namespace gives the World its own page and cookie
+// paths on that page's origin; vendor URLs remain the wire targets. Published external JavaScript is never rewritten.
+exports.installWorldBrowserRoutes = async function (router, transport, { namespace, origin, onExchange, context = false } = {}) {
+  if (namespace && (!/^\/[A-Za-z0-9._~/-]+$/.test(namespace) || !origin)) throw new Error('A World page needs a path namespace and its browser origin');
+  const base = namespace?.replace(/\/$/, '');
+  const forward = async route => {
+    try {
+      const request = route.request();
+      if (context && namespace) {
+        let documentUrl;
+        try { documentUrl = request.frame().page().url(); } catch {}
+        const ownPath = `${origin}${base}/`;
+        if (!request.url().startsWith(ownPath) && !documentUrl?.startsWith(ownPath)) return route.fallback();
+      }
+      let url = new URL(request.url()), method = request.method(), response;
+      let prefix;
+      if (namespace && url.origin === origin && url.pathname.startsWith(base + '/')) {
+        const rest = url.pathname.slice(base.length + 1), at = rest.indexOf('/');
+        const host = at < 0 ? rest : rest.slice(0, at);
+        prefix = `${base}/${host}`;
+        url = new URL(`https://${host}${at < 0 ? '/' : rest.slice(at)}${url.search}`);
+      }
+      if (namespace && !prefix) prefix = `${base}/${url.host}`;
+      // Complete wire headers stay opaque: the abbreviated request header view omits authentication headers.
+      const headers = await request.allHeaders();
+      if (prefix) headers['x-forwarded-prefix'] = prefix;
+      const visited = new Set();
+      for (;;) {
+        if (visited.has(url.href)) throw new Error('World browser redirect loop');
+        visited.add(url.href);
+        response = await route.fetch({ url: transport + '/?url=' + encodeURIComponent(url.href), method, headers, maxRedirects: 0, timeout: 1000 });
+        const status = response.status(), location = response.headers().location;
+        onExchange?.({ method, path: url.pathname, status });
+        if (![301, 302, 303, 307, 308].includes(status) || !location) break;
+        const next = new URL(location, url);
+        // Chrome owns the application's HTTP loopback callback.
+        if (next.protocol !== 'https:') break;
+        if (next.origin !== url.origin) {
+          for (const name of Object.keys(headers)) if (/^(authorization|cookie|proxy-authorization|x-volter-twin-|x-forwarded-prefix)/i.test(name)) delete headers[name];
+        }
+        if (status === 303 || ([301, 302].includes(status) && method === 'POST')) method = 'GET';
+        url = next;
+      }
+      if (namespace && /text\/html/i.test(response.headers()['content-type'] ?? '')) {
+        // Input values are protocol data (OAuth redirect_uri, state and code). Keep them byte-for-byte. Links and inline
+        // scripts name browser destinations, mapped to this World's page; external script bytes remain as published.
+        const body = (await response.text()).split(/(<input\b[^>]*>)/gi).map(part => /^<input\b/i.test(part) ? part : part.replace(/https:\/\/([A-Za-z0-9.-]+(?::\d+)?)(?=[/\s"'&<]|$)/g, (_, host) => `${origin}${base}/${host}`)).join('');
+        const outHeaders = { ...response.headers() };
+        delete outHeaders['content-length'];
+        await route.fulfill({ response, headers: outHeaders, body });
+      } else await route.fulfill({ response });
+    } catch (error) {
+      onExchange?.({ error: error.message });
+      await route.abort('blockedbyclient').catch(() => {});
+    }
+  };
+  await router.route('https://**/*', forward);
+  return { message: 'World routing installed on auth tab', namespace: base ?? null, dispose: () => router.unroute('https://**/*', forward) };
+};

package/src/ca-trust.ts

@@ -1,3 +1,4 @@
+import { errorMessage } from './error-message.ts';
 import { createHash, randomUUID, X509Certificate } from 'node:crypto';
 import { existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'node:fs';
 import { dirname, join } from 'node:path';
@@ -21,7 +22,7 @@ export function sessionTrustEnv(caCertPath: string, inputs: CaTrustInputs = proc
       files.set(path, pem);
       return pem;
     }
-    catch (error) { throw new CaTrustError(`Cannot read configured CA file ${path}: ${String(error)}`); }
+    catch (error) { throw new CaTrustError(`Cannot read configured CA file ${path}: ${errorMessage(error)}`); }
   };
   const session = read(caCertPath);
   const extra = callers.flatMap(caller => caller.NODE_EXTRA_CA_CERTS ? [read(caller.NODE_EXTRA_CA_CERTS)] : []).join('\n');
@@ -41,8 +42,8 @@ export function sessionTrustEnv(caCertPath: string, inputs: CaTrustInputs = proc
       }
     } catch (error) {
       try { rmSync(temporary, { force: true }); }
-      catch (cleanupError) { throw new CaTrustError(`Cannot materialize session trust bundle: ${String(error)}; cleanup: ${String(cleanupError)}`); }
-      throw new CaTrustError(`Cannot materialize session trust bundle: ${String(error)}`);
+      catch (cleanupError) { throw new CaTrustError(`Cannot materialize session trust bundle: ${errorMessage(error)}; cleanup: ${errorMessage(cleanupError)}`); }
+      throw new CaTrustError(`Cannot materialize session trust bundle: ${errorMessage(error)}`);
     }
     return path;
   };

package/src/changeset.ts

@@ -1,3 +1,4 @@
+import { errorMessage } from './error-message.ts';
 import { worldChangesetRules } from './configs.ts';
 import { blobDigest, captureHistory, captureParentHistory, getActiveBlobStore, getActiveWorldStore, originHead, withHistoryLocks, worldPaths, type HistoryReference } from '@volter/world-core/runtime';
 // `volter-world mark` / `diff` / `changeset` — the WORLD-side verbs over the changeset
@@ -66,7 +67,7 @@ function requireWorld(name: string, root: string): WorldInstance {
   try {
     return statusWorld(name, root);
   } catch (error) {
-    if (!/World instance not found/.test(String((error as Error).message))) throw error;
+    if (!/World instance not found/.test(String(errorMessage(error)))) throw error;
     const known = listWorlds(root).map((world) => world.name);
     throw new Error(`World "${name}" not found in ${root}${known.length ? ` (known worlds: ${known.join(', ')})` : ' (no worlds here)'} — start it with \`volter world up\` in the app's folder (the operator's own: \`volter-world up <config> --env-out <path> --name ${name}\`)`);
   }
@@ -553,7 +554,7 @@ export async function pushWorldChangeset(name: string, options: PushWorldOptions
   if (isPathRemote(url)) {
     try { const target = localWorld(url);
       const receipts = await landChangeset(target.name, target.root, target.instance, located.changeset, expect); const position = Object.fromEntries([...new Set(located.changeset.actions.map((a) => a.service))].map((twin) => { const st = located.changeset.actions.find((e) => e.service === twin)?.stateService ?? twin; return [twin, wholeLog(st, join(target.instance.dirs.data, twin)).length]; })); const snapshots = Object.fromEntries(Object.keys(position).map(twin => { const state = located.changeset.actions.find(a => a.service === twin)?.stateService ?? twin; const head = captureHistory(state, join(target.instance.dirs.data, twin)); return [twin, { view: head.view, position: head.position }]; })); body = { receipts, position, snapshots }; res = { ok: true, status: 200 }; }
-    catch (error) { body = { error: error instanceof Error ? error.message : String(error) }; res = { ok: false, status: 409 }; }
+    catch (error) { body = { error: errorMessage(error) }; res = { ok: false, status: 409 }; }
   } else {
     // the client's position on each twin rides along (its fetch cursor): the door refuses when origin moved past it
     const answer = await fetchReady(`${url}/-/${namespace}/push`, { method: 'POST', headers: { [TOKEN_HEADER]: options.key, 'content-type': 'application/json' }, body: JSON.stringify({ changeset: located.changeset, expect }) });
@@ -603,7 +604,7 @@ export async function pushWorldChangeset(name: string, options: PushWorldOptions
   // the remote's record of who pushed it and who owns it, kept on this copy too (outside the hash)
   const changeset = { ...withApplication(located.changeset, application), ...(body.owner && !located.changeset.owner ? { owner: body.owner } : {}), ...(body.pushedBy ? { pushedBy: body.pushedBy } : {}) };
   writeChangesetFile(located.path, changeset);
-  const unsent = namedFailure ? `records the landed entries name did not reach the origin (${namedFailure instanceof Error ? namedFailure.message : String(namedFailure)}); the next push from this branch that touches ${twins.map(([t]) => t).join(', ')} sends them` : undefined;
+  const unsent = namedFailure ? `records the landed entries name did not reach the origin (${errorMessage(namedFailure)}); the next push from this branch that touches ${twins.map(([t]) => t).join(', ')} sends them` : undefined;
   return { ...(unsent ? { unsent } : {}), application, changeset, world: located.world, path: located.path, remote: { url, namespace } };
 }