@volter/world-runtime 3.0.99 → 3.0.101

package/dist/src/cli-commands.js

@@ -57,7 +57,7 @@ function printHelp() {
                                                   # emission. Exit 0 = ready to \`up\`; exit 1 = the honest worklist.
                                                   # Deterministic: same repo + same pack catalog => identical bytes.
                                                   # init DIAGNOSES; it never boots — it prints the exact next commands
-  volter-world up <config> --env-out=<path> [--owner <label>] [--name <name>] [--mode local|share|sealed] [--isolation process|colocated|worker] [--keep-state] [--json] [--root <repo>]
+  volter-world up <config> --env-out=<path> [--owner <label>] [--name <name>] [--mode local|share|sealed] [--isolation process|colocated|worker] [--keep-state] [--app-url <url>] [--json] [--root <repo>]
   volter-world outdated <world> [--json]            — each mounted twin: pinned / mounted / catalog-current version and protocol standing (R17)
   volter-world audit <world> [--json]               — each mounted twin's grade, as the catalog records it (R17)
   volter-world down <name> [--grace-ms <ms>] [--purge] [--if-instance <token>] [--root <repo>]   # SIGTERM, then SIGKILL survivors after the grace (default 5000ms)

package/dist/src/configs.js

@@ -34,7 +34,7 @@ const LEGACY_NESTED = {
     bare: new Set(['name']), resources: new Set(['memoryMiB', 'writableStorageMiB']), catalog: new Set(['sha', 'protocol']),
     root: new Set(['url', 'deploy', 'refresh', 'scope']), refresh: new Set(['every', 'webhook']),
     external: new Set(['up', 'status', 'down', 'discover', 'readyWhen']), discover: new Set(['as', 'source', 'jsonPath', 'pattern']),
-    ready: new Set(['command', 'args', 'httpUrl', 'stdoutMatch', 'timeoutMs', 'intervalMs']), colocate: new Set(['module', 'export', 'scenarioPath']),
+    ready: new Set(['command', 'args', 'httpUrl', 'timeoutMs', 'intervalMs']), colocate: new Set(['module', 'export', 'scenarioPath']),
     share: new Set(['provider', 'command', 'args', 'ephemeral', 'services']), shareService: new Set(['id', 'verifyPath']),
 };
 function unknownKeys(value, known, allowComments = false) {

package/dist/src/mongodb-backing.d.ts

@@ -1,7 +1,8 @@
 import type { HostLaunch, InfraService } from './pglite-backing.js';
 /** PATH is the binary contract, as for the native PostgreSQL example and LiveKit. No acquisition at boot. */
 export declare function mongodbArgv(service: InfraService, data: string): string[];
-/** MongoDB's structured record comes from this child, not a listener already holding the port. */
-export declare function mongodbListening(log: string, port: number): boolean;
+/** Whether the server answering MongoDB's protocol on the port is this child: its own serverStatus names its pid. A
+ *  listener that is not answering yet, or another process's server on the port, is not. */
+export declare function mongodbServes(service: InfraService, pid: number): Promise<boolean>;
 /** Ping the server; initialize only an explicitly declared one-member set and await its primary. */
 export declare function mongodbReady(service: InfraService, launch: HostLaunch, deadline: number, initialize?: boolean): Promise<void>;

package/dist/src/mongodb-backing.js

@@ -3,17 +3,22 @@ export function mongodbArgv(service, data) {
     return ['mongod', '--bind_ip', '127.0.0.1', '--port', String(service.hostPort), '--dbpath', data,
         ...(service.replicaSet ? ['--replSet', service.replicaSet] : [])];
 }
-/** MongoDB's structured record comes from this child, not a listener already holding the port. */
-export function mongodbListening(log, port) {
-    return log.split('\n').some((line) => {
-        try {
-            const record = JSON.parse(line);
-            return record.id === 23016 && record.msg === 'Waiting for connections' && record.attr?.port === port;
-        }
-        catch {
-            return false;
-        } // Non-JSON log lines are not the structured readiness record.
-    });
+/** Whether the server answering MongoDB's protocol on the port is this child: its own serverStatus names its pid. A
+ *  listener that is not answering yet, or another process's server on the port, is not. */
+export async function mongodbServes(service, pid) {
+    const { MongoClient } = await import('mongodb');
+    const client = new MongoClient(`mongodb://127.0.0.1:${service.hostPort}`, { directConnection: true, timeoutMS: 1000, serverSelectionTimeoutMS: 1000 });
+    try {
+        await client.connect();
+        const status = await client.db('admin').command({ serverStatus: 1 });
+        return Number(status.pid) === pid;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        await client.close().catch(() => undefined);
+    }
 }
 /** Ping the server; initialize only an explicitly declared one-member set and await its primary. */
 export async function mongodbReady(service, launch, deadline, initialize = true) {

package/dist/src/pglite-backing.js

@@ -12,7 +12,8 @@
 // services only. A definition declaring mysql without a container runtime is
 // refused with the kinds named, never half-booted. Redis never reaches it: every
 // redis service is the redis twin's (redis-backing.ts).
-import { appendFileSync, closeSync, cpSync, existsSync, mkdirSync, openSync, readdirSync, readFileSync, renameSync, rmdirSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { appendFileSync, closeSync, cpSync, existsSync, mkdirSync, openSync, readdirSync, readFileSync, renameSync, rmdirSync, rmSync, writeFileSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
 import { connect } from 'node:net';
 import { dirname, join } from 'node:path';
 import { spawn } from 'node:child_process';
@@ -22,7 +23,7 @@ import { publishProcessReceipt, readProcessReceipt, readSpawnReceipt, spawnRecei
 import { errorMessage } from "./error-message.js";
 import { fileURLToPath } from 'node:url';
 import { parse } from 'yaml';
-import { mongodbArgv, mongodbListening, mongodbReady } from "./mongodb-backing.js";
+import { mongodbArgv, mongodbReady, mongodbServes } from "./mongodb-backing.js";
 /** Read the generated definition's loopback port mappings. MongoDB may explicitly request
  *  one replica-set member through its Compose-compatible command; other mongod options are refused. */
 export function parseInfraDefinition(text) {
@@ -149,13 +150,52 @@ const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 export function unsupportedKinds(services) {
     return [...new Set(services.filter((s) => CONTAINERLESS[s.kind] === undefined).map((s) => s.kind))];
 }
-/** The line each host prints once ITS OWN listener is bound: readiness is taken from the child, never
- *  from a connect to the port, which any other process holding the port would answer. */
-function readyLine(port) {
-    return `serving postgres wire protocol on 127.0.0.1:${port}`;
+/**
+ * What `up` means for a managed database (architecture, managed infrastructure): it answers its own protocol on its
+ * port, as pg_isready and a compose healthcheck ask, and the answer is this host's. Readiness never reads a log line.
+ * The PGlite host writes its own listener receipt once its socket is bound ({version, pid, port, boot}, pglite-host.mjs
+ * --listening-file); MongoDB's server names its own pid in serverStatus. The log is for people.
+ */
+function listeningReceiptPath(pidFile) {
+    return pidFile.replace(/\.pid$/, '.listening.json');
+}
+function listeningReceipt(path) {
+    let text;
+    try {
+        text = readFileSync(path, 'utf8');
+    }
+    catch {
+        return undefined;
+    }
+    try {
+        const value = JSON.parse(text);
+        if (value.version !== 1 || !Number.isSafeInteger(value.pid) || !Number.isSafeInteger(value.port))
+            return undefined;
+        return { pid: value.pid, port: value.port, boot: typeof value.boot === 'string' ? value.boot : null };
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Postgres's own first exchange: an SSLRequest answered with one byte, 'N' or 'S' (pg_isready's question). */
+function postgresAnswers(port) {
+    return new Promise((resolve) => {
+        const socket = connect({ host: '127.0.0.1', port, timeout: 1000 });
+        socket.once('connect', () => socket.write(Buffer.from([0, 0, 0, 8, 0x04, 0xd2, 0x16, 0x2f])));
+        socket.once('data', (chunk) => { socket.destroy(); resolve(chunk[0] === 0x4e || chunk[0] === 0x53); });
+        socket.on('error', () => resolve(false));
+        socket.on('timeout', () => { socket.destroy(); resolve(false); });
+    });
 }
-function logSince(log, offset) {
-    return readFileSync(log).subarray(offset).toString('utf8');
+/** Whether this host serves: its own receipt names it on the port (for this boot, when one is given), and the port
+ *  answers the service's protocol. */
+async function hostServes(service, pidFile, pid, boot) {
+    if (service.kind === 'mongodb')
+        return mongodbServes(service, pid);
+    const receipt = listeningReceipt(listeningReceiptPath(pidFile));
+    if (!receipt || receipt.pid !== pid || receipt.port !== service.hostPort || (boot !== undefined && receipt.boot !== boot))
+        return false;
+    return postgresAnswers(service.hostPort);
 }
 /**
  * A World's PostgreSQL cluster prepared before its first boot (architecture, managed infrastructure; ADR 0018).
@@ -274,8 +314,10 @@ export async function pgliteUp(services, dataDir, launch = {}) {
                 appendFileSync(log, `${placed.note}\n`);
                 launch.note?.(placed.note);
             }
-            const offset = existsSync(log) ? statSync(log).size : 0;
-            const [command, ...args] = placed.placed ? [...argv, '--prepared'] : argv;
+            // This boot's token, which the host writes into its listener receipt; an earlier receipt is never this one's.
+            const boot = randomUUID();
+            rmSync(listeningReceiptPath(pidFile), { force: true });
+            const [command, ...args] = [...(placed.placed ? [...argv, '--prepared'] : argv), ...(service.kind === 'postgres' ? ['--listening-file', listeningReceiptPath(pidFile), '--boot', boot] : [])];
             // a real fd, not a pipe: the host must outlive this process untethered
             const logFd = openSync(log, 'a');
             const child = spawn(command, args, {
@@ -305,10 +347,10 @@ export async function pgliteUp(services, dataDir, launch = {}) {
             publishProcessReceipt(pidFile, `${child.pid}\n`);
             launch.note?.(`${name} spawned`);
             const deadline = Date.now() + READY_TIMEOUT_MS;
-            const line = readyLine(service.hostPort);
-            // ready when OUR child says its listener is bound (a squatter that took the port after the check
-            // above makes the child fail its bind and exit, never print this) and the port answers
-            while (!(alive(child.pid) && (service.kind === 'mongodb' ? mongodbListening(logSince(log, offset), service.hostPort) : logSince(log, offset).includes(line)) && await listening(service.hostPort))) {
+            // Ready when the port answers the service's protocol and the answer is this child's: its own receipt (PGlite)
+            // or its own serverStatus (MongoDB). A squatter that took the port after the check above makes the child fail
+            // its bind and exit, and never answers as this child.
+            while (!(alive(child.pid) && await hostServes(service, pidFile, child.pid, service.kind === 'postgres' ? boot : undefined))) {
                 if (spawnError)
                     throw spawnError;
                 if (!alive(child.pid))
@@ -317,7 +359,6 @@ export async function pgliteUp(services, dataDir, launch = {}) {
                     throw new Error(`${name} did not serve port ${service.hostPort} within ${READY_TIMEOUT_MS / 1000}s — see ${log}`);
                 // an aborted boot (Ctrl-C during up) stops waiting; the catch below ends what this up started
                 launch.signal?.throwIfAborted();
-                // the ready line is a small log read, and the port is asked only once it is there
                 await sleep(25);
             }
             launch.note?.(`${name} serving on 127.0.0.1:${service.hostPort}`);
@@ -349,7 +390,7 @@ export async function pgliteStatus(services, dataDir) {
         const ownership = hostOwnership(pidFile);
         if (ownership.errors.length)
             throw new AggregateError(ownership.errors, 'Managed infrastructure ownership uncertain; retry down');
-        if (!ownership.readyReceipt || !ownership.pid || !alive(ownership.pid) || !(await listening(service.hostPort)))
+        if (!ownership.readyReceipt || !ownership.pid || !alive(ownership.pid) || !(await hostServes(service, pidFile, ownership.pid)))
             continue;
         if (ownership.identity)
             await verifySpawnIdentity(ownership.identity);

package/dist/src/pglite-host.mjs

@@ -63,7 +63,7 @@
 // Randomness remains the host's own; no database schema objects are installed.
 import { errorMessage } from './error-message.mjs';
 import net from 'node:net';
-import { mkdirSync, readFileSync } from 'node:fs';
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import clockForm from '@volter/world-core/world-clock';
 import { fromNodeSocket } from 'pg-gateway/node';
 import { BackendError } from 'pg-gateway';
@@ -122,6 +122,12 @@ function arg(name) {
 // path a serving host takes, close it cleanly and exit without listening. The World's image build runs it on the
 // host so the tab opens an existing cluster (pglite-backing.ts, pglitePrepare).
 const preparing = process.argv.includes('--prepare');
+// --listening-file <path> --boot <token>: once the listener is bound, the host writes its own receipt there
+// ({version, pid, port, boot}); the backing reads it as this host's ownership of the port (pglite-backing.ts). Readiness
+// is the port answering Postgres's own protocol; the stdout line is for people only.
+const optional = (name) => { const index = process.argv.indexOf(name); return index >= 0 ? process.argv[index + 1] : undefined; };
+const listeningFile = optional('--listening-file');
+const bootToken = optional('--boot');
 // --prepared: the data directory is a cluster `--prepare` made for this declared identity (pglite-backing.ts checks
 // its stamp before passing this), so the declared database and role exist and the maintenance open is skipped.
 const prepared = process.argv.includes('--prepared');
@@ -649,6 +655,11 @@ if (preparing) void dbReady.then(async (db) => {
 else void dbReady.then(() => {
   clearInterval(initKeepAlive);
   server.listen(port, '127.0.0.1', () => {
+    if (listeningFile) {
+      const temporary = `${listeningFile}.${process.pid}.tmp`;
+      writeFileSync(temporary, `${JSON.stringify({ version: 1, pid: process.pid, port, boot: bootToken ?? null })}\n`, { mode: 0o600 });
+      renameSync(temporary, listeningFile);
+    }
     process.stdout.write(`pglite-host serving postgres wire protocol on 127.0.0.1:${port}\n`);
   });
 });

package/dist/src/redis-backing.js

@@ -105,7 +105,7 @@ export async function redisTwinUp(services, dataDir, cli, launch = {}) {
                 launch.signal?.throwIfAborted();
                 if (Date.now() > deadline)
                     throw new Error(`redis did not serve port ${service.hostPort} within ${READY_TIMEOUT_MS / 1000}s — see ${log}`);
-                await sleep(200);
+                await sleep(25);
             }
             launch.signal?.throwIfAborted();
             held.child.unref();

package/dist/src/runtime.js

@@ -26,7 +26,7 @@ import { packFacts } from "./pack-facts.js";
 import { assertOwnedRealPath, ownedPath } from "./owned-path.js";
 import { isEnvironmentName } from "./schema.js";
 import { infraConnections, parseInfraDefinition } from "./pglite-backing.js";
-import { describeServiceEnd, readServiceEnd, serviceOutput } from "./service-exit.js";
+import { describeServiceEnd, readServiceEnd } from "./service-exit.js";
 import { Socket } from 'node:net';
 import { getActiveWorldStore, withFileLock, stateDirName, PROTOCOL_VERSION, PROTOCOL_MAJOR, protocolStanding, WORLD_BOOT_PATH, WORLD_DATA_ENV, WORLD_ENV_NAMES_ENV } from '@volter/world-core/runtime';
 import { loadWorldConfig } from "./configs.js";
@@ -57,25 +57,6 @@ function retainSpawn(child) {
 function heldStarts() {
     return Object.fromEntries([...spawnedIdentities].map(([pid, identity]) => [pid, identity.start]));
 }
-/** The latest `limit` bytes of a service log, reaching into its one rotation (`<log>.1`) when the current file is
- *  shorter: a readiness line printed just before a rotation is still found, and a poll never reads 64 MiB files. */
-function readServiceText(log, limit = 4 * 1024 * 1024) {
-    const tailOfFile = (path, bytes) => {
-        if (bytes <= 0 || !existsSync(path))
-            return '';
-        const fd = openSync(path, 'r');
-        try {
-            const size = fstatSync(fd).size, start = Math.max(0, size - bytes), buffer = Buffer.alloc(size - start);
-            readSync(fd, buffer, 0, buffer.length, start);
-            return buffer.toString('utf8');
-        }
-        finally {
-            closeSync(fd);
-        }
-    };
-    const current = tailOfFile(log, limit);
-    return `${tailOfFile(`${log}.1`, limit - Buffer.byteLength(current))}${current}`;
-}
 /** The World's events file: every service's start and end, and the World's own stops, one JSON line each. */
 export function worldEventsPath(logs) {
     return join(logs, 'events.jsonl');
@@ -136,46 +117,25 @@ async function untilReadyOrEnded(wait, ended, boot, what, log) {
         });
     });
 }
-/** That the process answering a service's port is the service. allocatePort closes its probe before the service
- *  binds, so another process can take the port and answer the first connect; the service then fails to bind and ends
- *  at once, which a short settle catches for any program. A World twin also answers WORLD_BOOT_PATH with the boot it
- *  belongs to, so a leftover World's twin on the port is named exactly; a server that does not answer the path (a
- *  twin from before it, a program that is not a twin) is accepted on the settle alone. When the settle guards this
- *  port alone (`early`), a twin's answer with this boot's id ends it early: a server of this boot holds the port, and
- *  every port this boot assigns is kept apart from its siblings', so short of the kernel handing the just-probed port
- *  to another of this boot's port-0 listeners, that server is the service just started. A settle standing for several
- *  ports runs in full unless an all-started receipt permits each port's own early identity confirmation.
- *  Programs that are not twins are never asked. A shared settle keeps legacy co-located ports within one guard. */
-async function confirmOwnPort(port, boot, ended, twin, what, log, early = false, sharedSettle) {
-    // A twin is asked at once, raced with the settle: a server slow to answer costs no more than the settle did.
+/** That the process answering a service's port is the service, decided by an answer and never by a timed settle
+ *  (architecture D9). A World twin answers WORLD_BOOT_PATH with the boot it belongs to: this boot's id is the proof; another
+ *  boot's is a leftover World on the port, refused by name. A program that answers no boot identity (one that is not a
+ *  twin) is the service when it is still running once its port answers: another process holding the port makes the
+ *  service's own bind fail, which ends it, and its end is named. A co-located host's twins are vouched for by its
+ *  all-started receipt first (ADR 0012, ADR 0014). */
+async function confirmOwnPort(port, boot, ended, twin, what, log) {
     boot.signal.throwIfAborted();
-    const answer = twin ? worldBootOf(port, boot.signal) : Promise.resolve(null);
-    const own = early && twin ? answer.then((a) => (a && a.boot === boot.bootId ? 'own' : new Promise(() => undefined))) : new Promise(() => undefined);
-    // `ended` absent: the process was already settled (a co-located host settles once for all its twins).
-    if (ended) {
-        let timer;
-        let settled;
-        try {
-            const settle = sharedSettle ?? new Promise((resolveAlive) => { timer = setTimeout(() => resolveAlive('alive'), 300); });
-            settled = await Promise.race([own, ended.then(() => 'ended'), settle]);
-        }
-        finally {
-            if (timer !== undefined)
-                clearTimeout(timer);
-        }
-        boot.signal.throwIfAborted();
-        if (settled === 'own')
-            return;
-        if (settled === 'ended')
-            throw new Error(`${what} ended right after its port first answered, so another process probably holds the port: the service ${endedAccount(log)}\nLog: ${log}`);
-    }
-    if (!twin)
-        return;
-    const answered = await answer;
+    const answered = twin ? await worldBootOf(port, boot.signal) : null;
     boot.signal.throwIfAborted();
-    if (answered && typeof answered.boot === 'string' && answered.boot !== boot.bootId) {
+    if (answered && typeof answered.boot === 'string') {
+        if (answered.boot === boot.bootId)
+            return;
         throw new Error(`${what}: its port is answered by a twin of another World boot (${answered.boot}), not this one; a leftover World holds the port. Stop it (\`volter-world list\`, then \`down\`) and retry.\nLog: ${log}`);
     }
+    // Whether the service has already ended, read now: one turn of the event loop, not a wait for it to fail.
+    const endedNow = ended ? await Promise.race([ended.then(() => true), new Promise((resolveNow) => setImmediate(() => resolveNow(false)))]) : false;
+    if (endedNow)
+        throw new Error(`${what} ended right after its port first answered, so another process probably holds the port: the service ${endedAccount(log)}\nLog: ${log}`);
 }
 /** What the server on a loopback port says its World boot is (WORLD_BOOT_PATH), or null. A direct loopback request:
  *  never through a proxy an activated shell's environment names. */
@@ -1237,7 +1197,7 @@ async function runOwnInfrastructureUp(command, serviceId, env, logPath, abort, p
 }
 /** Resolve `${url}`/`${host}`/`${port}` in a readiness probe's httpUrl against an owned loopback
  * service's allocated port (process/twin readiness — the port is auto-assigned, so it can't be a
- * literal in the config). Other probe kinds (command/stdoutMatch) are returned unchanged. */
+ * literal in the config). A command probe is returned unchanged. */
 function resolveReadyProbe(ready, svc) {
     if (ready.httpUrl === undefined)
         return ready;
@@ -1247,7 +1207,7 @@ function resolveReadyProbe(ready, svc) {
         .split('${port}').join(String(svc.port));
     return { ...ready, httpUrl };
 }
-async function awaitReadiness(ready, logPath, cwd, serviceId, env = process.env, abort) {
+async function awaitReadiness(ready, cwd, serviceId, env = process.env, abort) {
     if (!ready)
         return 'no readiness declared';
     const timeoutMs = ready.timeoutMs ?? 60_000;
@@ -1283,12 +1243,6 @@ async function awaitReadiness(ready, logPath, cwd, serviceId, env = process.env,
                 lastError = errorMessage(error);
             }
         }
-        else if (ready.stdoutMatch !== undefined) {
-            const text = serviceOutput(readServiceText(logPath));
-            if (new RegExp(ready.stdoutMatch).test(text))
-                return passed(`the log matched /${ready.stdoutMatch}/`);
-            lastError = `pattern /${ready.stdoutMatch}/ not yet in service log`;
-        }
         // A service that is nearly ready is seen at once; one that is slow is asked at most every intervalMs.
         await sleep(Math.min(intervalMs, 25 * 2 ** attempt));
         attempt += 1;
@@ -1329,7 +1283,7 @@ async function startExternalService(service, paths, worldEnv, stripEnv, boot) {
     const upOutput = await runExternalUp(external.up, cwd, service.id, env, log, boot?.signal, boot?.progress);
     boot?.progress(`${service.id}: up returned`);
     // 2. readiness — Docker-backed externals take seconds to boot.
-    const readiness = await awaitReadiness(external.readyWhen, log, cwd, service.id, env, boot?.signal);
+    const readiness = await awaitReadiness(external.readyWhen, cwd, service.id, env, boot?.signal);
     boot?.progress(`${service.id}: ready (${readiness})`);
     // 3. status — discover connection info (optional; may reuse up output instead).
     let statusOutput = '';
@@ -1465,7 +1419,7 @@ async function startService(config, service, worldEnv, paths, allocatedPorts, bo
         throw new Error(`Service "${service.id}" failed to start: ${errorMessage(error)}\nLog: ${log}`);
     });
     boot.progress(`${service.id}: port ${port} answers`);
-    await confirmOwnPort(port, boot, ended, (service.type ?? 'twin') === 'twin', `Service "${service.id}"`, log, true).catch(async (error) => {
+    await confirmOwnPort(port, boot, ended, (service.type ?? 'twin') === 'twin', `Service "${service.id}"`, log).catch(async (error) => {
         if (undeadPids([child.pid]).length)
             recordWorldStop([log], 'world.service.stop', 'up (port not its own)', 'SIGTERM');
         try {
@@ -1481,10 +1435,10 @@ async function startService(config, service, worldEnv, paths, allocatedPorts, bo
     const host = '127.0.0.1';
     const url = `http://${host}:${port}`;
     boot.progress(`${service.id}: port ${port} is its own`);
-    // Optional readiness probe beyond TCP (httpUrl/command/stdoutMatch): a process can bind its port
+    // Optional readiness probe beyond TCP (httpUrl/command): a process can bind its port
     // before it is actually serving, so this makes `up` wait until the service truly responds.
     if (service.ready && service.ready !== 'tcp') {
-        const readiness = await untilReadyOrEnded((abort) => awaitReadiness(resolveReadyProbe(service.ready, { host, port, url }), log, cwd, service.id, env, abort), ended, boot, 'the service', log).catch(async (error) => {
+        const readiness = await untilReadyOrEnded((abort) => awaitReadiness(resolveReadyProbe(service.ready, { host, port, url }), cwd, service.id, env, abort), ended, boot, 'the service', log).catch(async (error) => {
             if (undeadPids([child.pid]).length)
                 recordWorldStop([log], 'world.service.stop', 'up (startup failed)', 'SIGTERM');
             try {
@@ -1960,11 +1914,10 @@ async function startColocatedServices(config, colocated, isolation, worldEnv, pa
         // The host's receipt (this boot, every requested port) is published only
         // after every factory bound its own port; a port another process held fails
         // its bind and leaves no receipt. The receipt is the host's ownership proof
-        // for each port, so no twin waits out a settle (ADR 0014). A port that
-        // answers with another boot's identity is still refused.
-        const hostSettle = Promise.resolve('alive');
+        // for each port (ADR 0014). A port that answers with another boot's identity
+        // is still refused.
         await parallelStartup(allocated, async ({ service, port }) => {
-            await confirmOwnPort(port, boot, ended, true, `Co-located twin "${service.id}"`, log, true, hostSettle).catch(async (error) => {
+            await confirmOwnPort(port, boot, ended, true, `Co-located twin "${service.id}"`, log).catch(async (error) => {
                 if (undeadPids([child.pid]).length)
                     recordWorldStop([log], 'world.service.stop', 'up (port not its own)', 'SIGTERM');
                 try {
@@ -3503,8 +3456,8 @@ const DOCTOR_EXTERNAL_PROBE_TIMEOUT_MS = 3_000;
 /** Run an external service's declared readiness probe exactly ONCE (unlike `awaitReadiness`, which
  * polls until it passes or times out — appropriate at boot, wrong for a doctor health check, which
  * must report the CURRENT state, not wait for it to become healthy). Reuses the same probe shapes
- * (`command`/`httpUrl`/`stdoutMatch`) declared in config for the boot-time `readyWhen`. */
-async function probeExternalOnce(ready, cwd, env, logPath) {
+ * (`command`/`httpUrl`) declared in config for the boot-time `readyWhen`. */
+async function probeExternalOnce(ready, cwd, env) {
     if (ready.command !== undefined) {
         if (!commandExists(ready.command)) {
             return { ok: false, message: `readiness command \`${ready.command}\` not found on PATH` };
@@ -3529,13 +3482,7 @@ async function probeExternalOnce(ready, cwd, env, logPath) {
             return { ok: false, message: `probe failed: ${errorMessage(error)}` };
         }
     }
-    if (ready.stdoutMatch !== undefined) {
-        const text = serviceOutput(readServiceText(logPath));
-        if (new RegExp(ready.stdoutMatch).test(text))
-            return { ok: true, message: 'probe ok (stdoutMatch)' };
-        return { ok: false, message: `probe pattern /${ready.stdoutMatch}/ not found in log` };
-    }
-    return { ok: false, message: 'malformed readiness probe (no command/httpUrl/stdoutMatch)' };
+    return { ok: false, message: 'malformed readiness probe (no command/httpUrl)' };
 }
 /** A stopped service's own account for doctor: how it ended, its last output, and where its whole log is. */
 function stoppedServiceReport(pid, log) {
@@ -3599,7 +3546,7 @@ export async function doctorWorld(name, options = {}) {
             const probeCwd = service.external?.cwd ?? root;
             const probeEnv = { ...admittedEnv(stripEnvOf(instance.env ?? {})), ...(instance.env ?? {}), ...(service.external?.discoveredEnv ?? {}) };
             if (configuredExternal?.readyWhen) {
-                const probe = await probeExternalOnce(configuredExternal.readyWhen, probeCwd, probeEnv, service.log);
+                const probe = await probeExternalOnce(configuredExternal.readyWhen, probeCwd, probeEnv);
                 checks.push({ id: `service:${service.id}:external`, ok: probe.ok, message: `${discoveredMessage}; ${probe.message}` });
             }
             else if (configuredExternal?.status) {
@@ -3637,12 +3584,11 @@ export async function doctorWorld(name, options = {}) {
             checks.push({ id: `service:${service.id}:tcp`, ok: true, message: service.url });
             // A port that accepts is not a service that answers (a stuck event loop still completes the handshake): the
             // readiness probe the service declared is run again, as it was at boot.
-            // A log pattern matched at boot matches forever, so it cannot tell a hung service: only a probe that asks is re-run,
-            // in the service's own cwd and with its PORT, as at boot.
+            // The probe is re-run in the service's own cwd and with its PORT, as at boot.
             const configured = externalProbeConfig?.services.find((candidate) => candidate.id === service.id);
             const declared = configured?.ready;
-            if (pidLive && declared && declared !== 'tcp' && declared.stdoutMatch === undefined) {
-                const probe = await probeExternalOnce(resolveReadyProbe(declared, { host: '127.0.0.1', port: service.port, url: service.url }), configured?.cwd ? resolve(root, configured.cwd) : root, { ...admittedEnv(stripEnvOf(instance.env ?? {})), ...(instance.env ?? {}), ...(configured?.env ?? {}), PORT: String(service.port) }, service.log);
+            if (pidLive && declared && declared !== 'tcp') {
+                const probe = await probeExternalOnce(resolveReadyProbe(declared, { host: '127.0.0.1', port: service.port, url: service.url }), configured?.cwd ? resolve(root, configured.cwd) : root, { ...admittedEnv(stripEnvOf(instance.env ?? {})), ...(instance.env ?? {}), ...(configured?.env ?? {}), PORT: String(service.port) });
                 checks.push({ id: `service:${service.id}:ready`, ok: probe.ok,
                     message: probe.ok ? probe.message : `its port accepts but its declared readiness probe fails (${probe.message}): the service is up but not answering\n      log: ${service.log}` });
             }

package/dist/src/schema.d.ts

@@ -118,16 +118,15 @@ export type WorldExternalDiscover = {
     pattern?: string;
 };
 /**
- * Optional readiness probe, polled after `up` until it passes or `timeoutMs` elapses. Exactly one of:
- *  - `command`/`args`: a command that must exit 0,
- *  - `httpUrl`: an HTTP(S) URL that must return a 2xx/3xx response,
- *  - `stdoutMatch`: a regex that must appear in the `up` command's captured stdout/stderr log.
+ * Optional readiness probe, polled after `up` until it passes or `timeoutMs` elapses: the service answering its own
+ * protocol (architecture D9). Exactly one of:
+ *  - `command`/`args`: a command that asks the service and exits 0 when it answers,
+ *  - `httpUrl`: an HTTP(S) URL that must return a 2xx/3xx response.
  */
 export type WorldExternalReadyWhen = {
     command?: string;
     args?: string[];
     httpUrl?: string;
-    stdoutMatch?: string;
     timeoutMs?: number;
     intervalMs?: number;
 };
@@ -252,7 +251,6 @@ export type WorldServiceConfig = {
      * service truly serves, so `up` returning means "ready" (no post-up re-polling needed):
      *   - `{ httpUrl }`  — poll until 2xx/3xx. `${url}`/`${host}`/`${port}` resolve to the allocated port.
      *   - `{ command, args }` — poll until the command exits 0 (runs with the service env, incl. `PORT`).
-     *   - `{ stdoutMatch }` — poll until a regex matches the service's stdout/stderr log.
      * 'external' services use `external.readyWhen` instead.
      */
     ready?: 'tcp' | WorldExternalReadyWhen;

package/dist/src/schema.js

@@ -31,17 +31,16 @@ function assertValidRegex(pattern, what, path) {
     }
 }
 /** Shared validator for a readiness probe — used by both `external.readyWhen` and a process/twin
- * service's `ready` object. Exactly one of command/httpUrl/stdoutMatch, correct types, and any
- * stdoutMatch regex must compile (so a typo fails at config time, not mid-boot). */
+ * service's `ready` object. Exactly one of command/httpUrl, with correct types. */
 function assertReadyWhen(ready, what, path) {
     if (!ready || typeof ready !== 'object' || Array.isArray(ready)) {
         throw new Error(`${what} must be an object in ${path}`);
     }
-    assertKeys(ready, ['command', 'args', 'httpUrl', 'stdoutMatch', 'timeoutMs', 'intervalMs'], what, path);
+    assertKeys(ready, ['command', 'args', 'httpUrl', 'timeoutMs', 'intervalMs'], what, path);
     const r = ready;
-    const probes = [r.command !== undefined, r.httpUrl !== undefined, r.stdoutMatch !== undefined].filter(Boolean).length;
+    const probes = [r.command !== undefined, r.httpUrl !== undefined].filter(Boolean).length;
     if (probes !== 1) {
-        throw new Error(`${what} must set exactly one of command/httpUrl/stdoutMatch in ${path}`);
+        throw new Error(`${what} must set exactly one of command/httpUrl in ${path}`);
     }
     if (r.command !== undefined && typeof r.command !== 'string')
         throw new Error(`${what}.command must be a string in ${path}`);
@@ -51,11 +50,6 @@ function assertReadyWhen(ready, what, path) {
         throw new Error(`${what}.args requires command in ${path}`);
     if (r.httpUrl !== undefined && typeof r.httpUrl !== 'string')
         throw new Error(`${what}.httpUrl must be a string in ${path}`);
-    if (r.stdoutMatch !== undefined) {
-        if (typeof r.stdoutMatch !== 'string')
-            throw new Error(`${what}.stdoutMatch must be a string in ${path}`);
-        assertValidRegex(r.stdoutMatch, `${what}.stdoutMatch`, path);
-    }
     for (const key of ['timeoutMs', 'intervalMs']) {
         if (r[key] !== undefined && (!Number.isInteger(r[key]) || r[key] <= 0))
             throw new Error(`${what}.${key} must be a positive integer in ${path}`);

package/dist/src/service-exit.d.ts

@@ -24,9 +24,6 @@ export type ServiceEnd = {
     /** The service's own last lines of output in its last run, oldest first. */
     lastOutput: string[];
 };
-/** A log's text as the service wrote it, without the recorder's records: what a `stdoutMatch` readiness pattern is
- *  matched against. */
-export declare function serviceOutput(text: string): string;
 /** The last run's end in a service log: its start, its exit record (absent while it runs, or when its parent was killed
  *  with it), and the output it wrote last. Undefined for a log the parent never wrote to (a co-located twin's host log),
  *  which has no runs to tell apart. A run is bounded by its start record or, for a spawn that failed before starting

package/dist/src/service-exit.js

@@ -74,11 +74,6 @@ function split(line) {
         return { output: line };
     }
 }
-/** A log's text as the service wrote it, without the recorder's records: what a `stdoutMatch` readiness pattern is
- *  matched against. */
-export function serviceOutput(text) {
-    return text.includes(MARK) ? text.split('\n').map((line) => split(line).output).join('\n') : text;
-}
 /** The last run's end in a service log: its start, its exit record (absent while it runs, or when its parent was killed
  *  with it), and the output it wrote last. Undefined for a log the parent never wrote to (a co-located twin's host log),
  *  which has no runs to tell apart. A run is bounded by its start record or, for a spawn that failed before starting

package/dist/src/up-cli.js

@@ -23,7 +23,18 @@ export async function upCommand(subject, rest, root) {
     // --keep-state: boot over the state the World's directory already holds (a World carried somewhere else, e.g. a
     // browser tab's image, comes up over its data instead of starting empty, as a fresh `up` does)
     const keepState = rest.includes('--keep-state');
+    // --app-url: where the booter serves the app, recorded as `volter-world app-url --set` records it, once the World is
+    // up and in this process: a booter that knows the address before the app listens (a browser tab's preview origin)
+    // saves a whole command between up and the app's start.
+    const appUrl = optionValue(rest, '--app-url') || undefined;
+    if (appUrl !== undefined && !(URL.canParse(appUrl) && /^https?:$/.test(new URL(appUrl).protocol)))
+        throw new Error(`volter-world up: --app-url "${appUrl}" must be an http(s) URL`);
     const instance = await superviseWorldUp(subject, { name, root, mode, envFile, forceEnvOutput: rest.includes('--force'), owner: ownerOption(rest), ...(isolation ? { isolation } : {}), ...(keepState ? { keepState: true } : {}) });
+    if (appUrl !== undefined) {
+        const { setAppUrl } = await import("./app-url.js");
+        setAppUrl(instance.name, appUrl, { root });
+        process.stderr.write(`volter-world up ${instance.name}: app url recorded: ${appUrl}\n`);
+    }
     if (rest.includes('--json'))
         process.stdout.write(JSON.stringify(instance, null, 2) + '\n');
     else

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-runtime",
-  "version": "3.0.99",
+  "version": "3.0.101",
   "description": "World configs for twins: boot named local runtimes, allocate ports, generate world.env/instance.json, and run apps against fake-key twin worlds.",
   "keywords": [
     "twin",
@@ -69,14 +69,14 @@
     "node": ">=22.3"
   },
   "peerDependencies": {
-    "@volter/world-core": "3.0.99",
-    "@volter/world-console": "3.0.94"
+    "@volter/world-core": "3.0.101",
+    "@volter/world-console": "3.0.96"
   },
   "dependencies": {
     "@electric-sql/pglite": "0.5.8",
     "@electric-sql/pglite-pgvector": "0.0.9",
     "@volter/world-access": "3.0.1",
-    "@volter/world-core": "3.0.99",
+    "@volter/world-core": "3.0.101",
     "mongodb": "~6.20.0",
     "pg-gateway": "0.3.0-beta.4",
     "smol-toml": "^1.8.0",

package/src/cli-commands.ts

@@ -61,7 +61,7 @@ function printHelp(): void {
                                                   # emission. Exit 0 = ready to \`up\`; exit 1 = the honest worklist.
                                                   # Deterministic: same repo + same pack catalog => identical bytes.
                                                   # init DIAGNOSES; it never boots — it prints the exact next commands
-  volter-world up <config> --env-out=<path> [--owner <label>] [--name <name>] [--mode local|share|sealed] [--isolation process|colocated|worker] [--keep-state] [--json] [--root <repo>]
+  volter-world up <config> --env-out=<path> [--owner <label>] [--name <name>] [--mode local|share|sealed] [--isolation process|colocated|worker] [--keep-state] [--app-url <url>] [--json] [--root <repo>]
   volter-world outdated <world> [--json]            — each mounted twin: pinned / mounted / catalog-current version and protocol standing (R17)
   volter-world audit <world> [--json]               — each mounted twin's grade, as the catalog records it (R17)
   volter-world down <name> [--grace-ms <ms>] [--purge] [--if-instance <token>] [--root <repo>]   # SIGTERM, then SIGKILL survivors after the grace (default 5000ms)

package/src/configs.ts

@@ -38,7 +38,7 @@ const LEGACY_NESTED = {
   bare: new Set(['name']), resources: new Set(['memoryMiB', 'writableStorageMiB']), catalog: new Set(['sha', 'protocol']),
   root: new Set(['url', 'deploy', 'refresh', 'scope']), refresh: new Set(['every', 'webhook']),
   external: new Set(['up', 'status', 'down', 'discover', 'readyWhen']), discover: new Set(['as', 'source', 'jsonPath', 'pattern']),
-  ready: new Set(['command', 'args', 'httpUrl', 'stdoutMatch', 'timeoutMs', 'intervalMs']), colocate: new Set(['module', 'export', 'scenarioPath']),
+  ready: new Set(['command', 'args', 'httpUrl', 'timeoutMs', 'intervalMs']), colocate: new Set(['module', 'export', 'scenarioPath']),
   share: new Set(['provider', 'command', 'args', 'ephemeral', 'services']), shareService: new Set(['id', 'verifyPath']),
 } as const;
 

package/src/mongodb-backing.ts

@@ -8,14 +8,16 @@ export function mongodbArgv(service: InfraService, data: string): string[] {
     ...(service.replicaSet ? ['--replSet', service.replicaSet] : [])];
 }
 
-/** MongoDB's structured record comes from this child, not a listener already holding the port. */
-export function mongodbListening(log: string, port: number): boolean {
-  return log.split('\n').some((line) => {
-    try {
-      const record = JSON.parse(line);
-      return record.id === 23016 && record.msg === 'Waiting for connections' && record.attr?.port === port;
-    } catch { return false; } // Non-JSON log lines are not the structured readiness record.
-  });
+/** Whether the server answering MongoDB's protocol on the port is this child: its own serverStatus names its pid. A
+ *  listener that is not answering yet, or another process's server on the port, is not. */
+export async function mongodbServes(service: InfraService, pid: number): Promise<boolean> {
+  const { MongoClient } = await import('mongodb');
+  const client = new MongoClient(`mongodb://127.0.0.1:${service.hostPort}`, { directConnection: true, timeoutMS: 1000, serverSelectionTimeoutMS: 1000 });
+  try {
+    await client.connect();
+    const status = await client.db('admin').command({ serverStatus: 1 });
+    return Number(status.pid) === pid;
+  } catch { return false; } finally { await client.close().catch(() => undefined); }
 }
 
 /** Ping the server; initialize only an explicitly declared one-member set and await its primary. */

package/src/pglite-backing.ts

@@ -12,7 +12,8 @@
 // services only. A definition declaring mysql without a container runtime is
 // refused with the kinds named, never half-booted. Redis never reaches it: every
 // redis service is the redis twin's (redis-backing.ts).
-import { appendFileSync, closeSync, cpSync, existsSync, mkdirSync, openSync, readdirSync, readFileSync, renameSync, rmdirSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { appendFileSync, closeSync, cpSync, existsSync, mkdirSync, openSync, readdirSync, readFileSync, renameSync, rmdirSync, rmSync, writeFileSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
 import { connect } from 'node:net';
 import { dirname, join } from 'node:path';
 import { spawn, type ChildProcess } from 'node:child_process';
@@ -22,7 +23,7 @@ import { publishProcessReceipt, readProcessReceipt, readSpawnReceipt, spawnRecei
 import { errorMessage } from './error-message.ts';
 import { fileURLToPath } from 'node:url';
 import { parse } from 'yaml';
-import { mongodbArgv, mongodbListening, mongodbReady } from './mongodb-backing.ts';
+import { mongodbArgv, mongodbReady, mongodbServes } from './mongodb-backing.ts';
 
 export interface InfraService { kind: string; hostPort: number; replicaSet?: string; postgres?: { user: string; database: string; password?: string } }
 
@@ -154,14 +155,44 @@ export function unsupportedKinds(services: InfraService[]): string[] {
   return [...new Set(services.filter((s) => CONTAINERLESS[s.kind] === undefined).map((s) => s.kind))];
 }
 
-/** The line each host prints once ITS OWN listener is bound: readiness is taken from the child, never
- *  from a connect to the port, which any other process holding the port would answer. */
-function readyLine(port: number): string {
-  return `serving postgres wire protocol on 127.0.0.1:${port}`;
+/**
+ * What `up` means for a managed database (architecture, managed infrastructure): it answers its own protocol on its
+ * port, as pg_isready and a compose healthcheck ask, and the answer is this host's. Readiness never reads a log line.
+ * The PGlite host writes its own listener receipt once its socket is bound ({version, pid, port, boot}, pglite-host.mjs
+ * --listening-file); MongoDB's server names its own pid in serverStatus. The log is for people.
+ */
+function listeningReceiptPath(pidFile: string): string {
+  return pidFile.replace(/\.pid$/, '.listening.json');
+}
+
+function listeningReceipt(path: string): { pid: number; port: number; boot: string | null } | undefined {
+  let text: string;
+  try { text = readFileSync(path, 'utf8'); } catch { return undefined; }
+  try {
+    const value = JSON.parse(text) as { version?: unknown; pid?: unknown; port?: unknown; boot?: unknown };
+    if (value.version !== 1 || !Number.isSafeInteger(value.pid) || !Number.isSafeInteger(value.port)) return undefined;
+    return { pid: value.pid as number, port: value.port as number, boot: typeof value.boot === 'string' ? value.boot : null };
+  } catch { return undefined; }
+}
+
+/** Postgres's own first exchange: an SSLRequest answered with one byte, 'N' or 'S' (pg_isready's question). */
+function postgresAnswers(port: number): Promise<boolean> {
+  return new Promise((resolve) => {
+    const socket = connect({ host: '127.0.0.1', port, timeout: 1000 });
+    socket.once('connect', () => socket.write(Buffer.from([0, 0, 0, 8, 0x04, 0xd2, 0x16, 0x2f])));
+    socket.once('data', (chunk: Buffer) => { socket.destroy(); resolve(chunk[0] === 0x4e || chunk[0] === 0x53); });
+    socket.on('error', () => resolve(false));
+    socket.on('timeout', () => { socket.destroy(); resolve(false); });
+  });
 }
 
-function logSince(log: string, offset: number): string {
-  return readFileSync(log).subarray(offset).toString('utf8');
+/** Whether this host serves: its own receipt names it on the port (for this boot, when one is given), and the port
+ *  answers the service's protocol. */
+async function hostServes(service: InfraService, pidFile: string, pid: number, boot?: string): Promise<boolean> {
+  if (service.kind === 'mongodb') return mongodbServes(service, pid);
+  const receipt = listeningReceipt(listeningReceiptPath(pidFile));
+  if (!receipt || receipt.pid !== pid || receipt.port !== service.hostPort || (boot !== undefined && receipt.boot !== boot)) return false;
+  return postgresAnswers(service.hostPort);
 }
 
 /**
@@ -272,8 +303,10 @@ export async function pgliteUp(services: InfraService[], dataDir: string, launch
       mkdirSync(serviceData, { recursive: true });
       mkdirSync(dirname(log), { recursive: true });
       if (placed.note) { appendFileSync(log, `${placed.note}\n`); launch.note?.(placed.note); }
-      const offset = existsSync(log) ? statSync(log).size : 0;
-      const [command, ...args] = placed.placed ? [...argv, '--prepared'] : argv;
+      // This boot's token, which the host writes into its listener receipt; an earlier receipt is never this one's.
+      const boot = randomUUID();
+      rmSync(listeningReceiptPath(pidFile), { force: true });
+      const [command, ...args] = [...(placed.placed ? [...argv, '--prepared'] : argv), ...(service.kind === 'postgres' ? ['--listening-file', listeningReceiptPath(pidFile), '--boot', boot] : [])];
       // a real fd, not a pipe: the host must outlive this process untethered
       const logFd = openSync(log, 'a');
       const child = spawn(command!, args, {
@@ -300,16 +333,15 @@ export async function pgliteUp(services: InfraService[], dataDir: string, launch
       publishProcessReceipt(pidFile, `${child.pid}\n`);
       launch.note?.(`${name} spawned`);
       const deadline = Date.now() + READY_TIMEOUT_MS;
-      const line = readyLine(service.hostPort);
-      // ready when OUR child says its listener is bound (a squatter that took the port after the check
-      // above makes the child fail its bind and exit, never print this) and the port answers
-      while (!(alive(child.pid!) && (service.kind === 'mongodb' ? mongodbListening(logSince(log, offset), service.hostPort) : logSince(log, offset).includes(line)) && await listening(service.hostPort))) {
+      // Ready when the port answers the service's protocol and the answer is this child's: its own receipt (PGlite)
+      // or its own serverStatus (MongoDB). A squatter that took the port after the check above makes the child fail
+      // its bind and exit, and never answers as this child.
+      while (!(alive(child.pid!) && await hostServes(service, pidFile, child.pid!, service.kind === 'postgres' ? boot : undefined))) {
         if (spawnError) throw spawnError;
         if (!alive(child.pid!)) throw new Error(`${name} exited before serving — see ${log}`);
         if (Date.now() > deadline) throw new Error(`${name} did not serve port ${service.hostPort} within ${READY_TIMEOUT_MS / 1000}s — see ${log}`);
         // an aborted boot (Ctrl-C during up) stops waiting; the catch below ends what this up started
         launch.signal?.throwIfAborted();
-        // the ready line is a small log read, and the port is asked only once it is there
         await sleep(25);
       }
       launch.note?.(`${name} serving on 127.0.0.1:${service.hostPort}`);
@@ -333,7 +365,7 @@ export async function pgliteStatus(services: InfraService[], dataDir: string): P
     const pidFile = pidPath(dataDir, service.kind);
     const ownership = hostOwnership(pidFile);
     if (ownership.errors.length) throw new AggregateError(ownership.errors, 'Managed infrastructure ownership uncertain; retry down');
-    if (!ownership.readyReceipt || !ownership.pid || !alive(ownership.pid) || !(await listening(service.hostPort))) continue;
+    if (!ownership.readyReceipt || !ownership.pid || !alive(ownership.pid) || !(await hostServes(service, pidFile, ownership.pid))) continue;
     if (ownership.identity) await verifySpawnIdentity(ownership.identity);
     if (service.kind === 'mongodb') {
       await mongodbReady(service, {}, Date.now() + READY_TIMEOUT_MS, false);

package/src/pglite-host.mjs

@@ -63,7 +63,7 @@
 // Randomness remains the host's own; no database schema objects are installed.
 import { errorMessage } from './error-message.mjs';
 import net from 'node:net';
-import { mkdirSync, readFileSync } from 'node:fs';
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import clockForm from '@volter/world-core/world-clock';
 import { fromNodeSocket } from 'pg-gateway/node';
 import { BackendError } from 'pg-gateway';
@@ -122,6 +122,12 @@ function arg(name) {
 // path a serving host takes, close it cleanly and exit without listening. The World's image build runs it on the
 // host so the tab opens an existing cluster (pglite-backing.ts, pglitePrepare).
 const preparing = process.argv.includes('--prepare');
+// --listening-file <path> --boot <token>: once the listener is bound, the host writes its own receipt there
+// ({version, pid, port, boot}); the backing reads it as this host's ownership of the port (pglite-backing.ts). Readiness
+// is the port answering Postgres's own protocol; the stdout line is for people only.
+const optional = (name) => { const index = process.argv.indexOf(name); return index >= 0 ? process.argv[index + 1] : undefined; };
+const listeningFile = optional('--listening-file');
+const bootToken = optional('--boot');
 // --prepared: the data directory is a cluster `--prepare` made for this declared identity (pglite-backing.ts checks
 // its stamp before passing this), so the declared database and role exist and the maintenance open is skipped.
 const prepared = process.argv.includes('--prepared');
@@ -649,6 +655,11 @@ if (preparing) void dbReady.then(async (db) => {
 else void dbReady.then(() => {
   clearInterval(initKeepAlive);
   server.listen(port, '127.0.0.1', () => {
+    if (listeningFile) {
+      const temporary = `${listeningFile}.${process.pid}.tmp`;
+      writeFileSync(temporary, `${JSON.stringify({ version: 1, pid: process.pid, port, boot: bootToken ?? null })}\n`, { mode: 0o600 });
+      renameSync(temporary, listeningFile);
+    }
     process.stdout.write(`pglite-host serving postgres wire protocol on 127.0.0.1:${port}\n`);
   });
 });

package/src/redis-backing.ts

@@ -97,7 +97,7 @@ export async function redisTwinUp(services: InfraService[], dataDir: string, cli
         if (!alive(held.child.pid)) throw new Error(`redis exited before serving — see ${log}`);
         launch.signal?.throwIfAborted();
         if (Date.now() > deadline) throw new Error(`redis did not serve port ${service.hostPort} within ${READY_TIMEOUT_MS / 1000}s — see ${log}`);
-        await sleep(200);
+        await sleep(25);
       }
       launch.signal?.throwIfAborted();
       held.child.unref();

package/src/runtime.ts

@@ -28,7 +28,7 @@ import { packFacts } from './pack-facts.ts';
 import { assertOwnedRealPath, ownedPath } from './owned-path.ts';
 import { isEnvironmentName } from './schema.ts';
 import { infraConnections, parseInfraDefinition } from './pglite-backing.ts';
-import { describeServiceEnd, readServiceEnd, serviceOutput } from './service-exit.ts';
+import { describeServiceEnd, readServiceEnd } from './service-exit.ts';
 import { Socket } from 'node:net';
 import { getActiveWorldStore, withFileLock, stateDirName, PROTOCOL_VERSION, PROTOCOL_MAJOR, protocolStanding, WORLD_BOOT_PATH, WORLD_DATA_ENV, WORLD_ENV_NAMES_ENV } from '@volter/world-core/runtime';
 import { loadWorldConfig } from './configs.ts';
@@ -60,22 +60,6 @@ function heldStarts(): Record<string, string | undefined> {
   return Object.fromEntries([...spawnedIdentities].map(([pid, identity]) => [pid, identity.start]));
 }
 
-/** The latest `limit` bytes of a service log, reaching into its one rotation (`<log>.1`) when the current file is
- *  shorter: a readiness line printed just before a rotation is still found, and a poll never reads 64 MiB files. */
-function readServiceText(log: string, limit = 4 * 1024 * 1024): string {
-  const tailOfFile = (path: string, bytes: number): string => {
-    if (bytes <= 0 || !existsSync(path)) return '';
-    const fd = openSync(path, 'r');
-    try {
-      const size = fstatSync(fd).size, start = Math.max(0, size - bytes), buffer = Buffer.alloc(size - start);
-      readSync(fd, buffer, 0, buffer.length, start);
-      return buffer.toString('utf8');
-    } finally { closeSync(fd); }
-  };
-  const current = tailOfFile(log, limit);
-  return `${tailOfFile(`${log}.1`, limit - Buffer.byteLength(current))}${current}`;
-}
-
 /** The World's events file: every service's start and end, and the World's own stops, one JSON line each. */
 export function worldEventsPath(logs: string): string {
   return join(logs, 'events.jsonl');
@@ -127,39 +111,23 @@ async function untilReadyOrEnded<T>(wait: (abort: AbortSignal) => Promise<T>, en
   });
 }
 
-/** That the process answering a service's port is the service. allocatePort closes its probe before the service
- *  binds, so another process can take the port and answer the first connect; the service then fails to bind and ends
- *  at once, which a short settle catches for any program. A World twin also answers WORLD_BOOT_PATH with the boot it
- *  belongs to, so a leftover World's twin on the port is named exactly; a server that does not answer the path (a
- *  twin from before it, a program that is not a twin) is accepted on the settle alone. When the settle guards this
- *  port alone (`early`), a twin's answer with this boot's id ends it early: a server of this boot holds the port, and
- *  every port this boot assigns is kept apart from its siblings', so short of the kernel handing the just-probed port
- *  to another of this boot's port-0 listeners, that server is the service just started. A settle standing for several
- *  ports runs in full unless an all-started receipt permits each port's own early identity confirmation.
- *  Programs that are not twins are never asked. A shared settle keeps legacy co-located ports within one guard. */
-async function confirmOwnPort(port: number, boot: BootContext, ended: Promise<void> | undefined, twin: boolean, what: string, log: string, early = false, sharedSettle?: Promise<'alive'>): Promise<void> {
-  // A twin is asked at once, raced with the settle: a server slow to answer costs no more than the settle did.
+/** That the process answering a service's port is the service, decided by an answer and never by a timed settle
+ *  (architecture D9). A World twin answers WORLD_BOOT_PATH with the boot it belongs to: this boot's id is the proof; another
+ *  boot's is a leftover World on the port, refused by name. A program that answers no boot identity (one that is not a
+ *  twin) is the service when it is still running once its port answers: another process holding the port makes the
+ *  service's own bind fail, which ends it, and its end is named. A co-located host's twins are vouched for by its
+ *  all-started receipt first (ADR 0012, ADR 0014). */
+async function confirmOwnPort(port: number, boot: BootContext, ended: Promise<void> | undefined, twin: boolean, what: string, log: string): Promise<void> {
   boot.signal.throwIfAborted();
-  const answer = twin ? worldBootOf(port, boot.signal) : Promise.resolve(null);
-  const own = early && twin ? answer.then((a) => (a && a.boot === boot.bootId ? 'own' as const : new Promise<never>(() => undefined))) : new Promise<never>(() => undefined);
-  // `ended` absent: the process was already settled (a co-located host settles once for all its twins).
-  if (ended) {
-    let timer: ReturnType<typeof setTimeout> | undefined;
-    let settled: 'own' | 'ended' | 'alive';
-    try {
-      const settle = sharedSettle ?? new Promise<'alive'>((resolveAlive) => { timer = setTimeout(() => resolveAlive('alive'), 300); });
-      settled = await Promise.race([own, ended.then(() => 'ended' as const), settle]);
-    } finally { if (timer !== undefined) clearTimeout(timer); }
-    boot.signal.throwIfAborted();
-    if (settled === 'own') return;
-    if (settled === 'ended') throw new Error(`${what} ended right after its port first answered, so another process probably holds the port: the service ${endedAccount(log)}\nLog: ${log}`);
-  }
-  if (!twin) return;
-  const answered = await answer;
+  const answered = twin ? await worldBootOf(port, boot.signal) : null;
   boot.signal.throwIfAborted();
-  if (answered && typeof answered.boot === 'string' && answered.boot !== boot.bootId) {
+  if (answered && typeof answered.boot === 'string') {
+    if (answered.boot === boot.bootId) return;
     throw new Error(`${what}: its port is answered by a twin of another World boot (${answered.boot}), not this one; a leftover World holds the port. Stop it (\`volter-world list\`, then \`down\`) and retry.\nLog: ${log}`);
   }
+  // Whether the service has already ended, read now: one turn of the event loop, not a wait for it to fail.
+  const endedNow = ended ? await Promise.race([ended.then(() => true), new Promise<boolean>((resolveNow) => setImmediate(() => resolveNow(false)))]) : false;
+  if (endedNow) throw new Error(`${what} ended right after its port first answered, so another process probably holds the port: the service ${endedAccount(log)}\nLog: ${log}`);
 }
 
 /** What the server on a loopback port says its World boot is (WORLD_BOOT_PATH), or null. A direct loopback request:
@@ -1203,7 +1171,7 @@ async function runOwnInfrastructureUp(command: string[], serviceId: string, env:
 
 /** Resolve `${url}`/`${host}`/`${port}` in a readiness probe's httpUrl against an owned loopback
  * service's allocated port (process/twin readiness — the port is auto-assigned, so it can't be a
- * literal in the config). Other probe kinds (command/stdoutMatch) are returned unchanged. */
+ * literal in the config). A command probe is returned unchanged. */
 function resolveReadyProbe(ready: WorldExternalReadyWhen, svc: { host: string; port: number; url: string }): WorldExternalReadyWhen {
   if (ready.httpUrl === undefined) return ready;
   const httpUrl = ready.httpUrl
@@ -1215,7 +1183,6 @@ function resolveReadyProbe(ready: WorldExternalReadyWhen, svc: { host: string; p
 
 async function awaitReadiness(
   ready: WorldExternalReadyWhen | undefined,
-  logPath: string,
   cwd: string,
   serviceId: string,
   env: NodeJS.ProcessEnv = process.env,
@@ -1244,10 +1211,6 @@ async function awaitReadiness(
       } catch (error) {
         lastError = errorMessage(error);
       }
-    } else if (ready.stdoutMatch !== undefined) {
-      const text = serviceOutput(readServiceText(logPath));
-      if (new RegExp(ready.stdoutMatch).test(text)) return passed(`the log matched /${ready.stdoutMatch}/`);
-      lastError = `pattern /${ready.stdoutMatch}/ not yet in service log`;
     }
     // A service that is nearly ready is seen at once; one that is slow is asked at most every intervalMs.
     await sleep(Math.min(intervalMs, 25 * 2 ** attempt));
@@ -1302,7 +1265,7 @@ async function startExternalService(
   boot?.progress(`${service.id}: up returned`);
 
   // 2. readiness — Docker-backed externals take seconds to boot.
-  const readiness = await awaitReadiness(external.readyWhen, log, cwd, service.id, env, boot?.signal);
+  const readiness = await awaitReadiness(external.readyWhen, cwd, service.id, env, boot?.signal);
   boot?.progress(`${service.id}: ready (${readiness})`);
 
   // 3. status — discover connection info (optional; may reuse up output instead).
@@ -1455,7 +1418,7 @@ async function startService(
   });
   boot.progress(`${service.id}: port ${port} answers`);
 
-  await confirmOwnPort(port, boot, ended, (service.type ?? 'twin') === 'twin', `Service "${service.id}"`, log, true).catch(async (error) => {
+  await confirmOwnPort(port, boot, ended, (service.type ?? 'twin') === 'twin', `Service "${service.id}"`, log).catch(async (error) => {
     if (undeadPids([child.pid!]).length) recordWorldStop([log], 'world.service.stop', 'up (port not its own)', 'SIGTERM');
     try { await signalHeldChild(child, 'SIGTERM', true, identity); } catch { /* best effort cleanup */ }
     throw error;
@@ -1471,10 +1434,10 @@ async function startService(
   const url = `http://${host}:${port}`;
   boot.progress(`${service.id}: port ${port} is its own`);
 
-  // Optional readiness probe beyond TCP (httpUrl/command/stdoutMatch): a process can bind its port
+  // Optional readiness probe beyond TCP (httpUrl/command): a process can bind its port
   // before it is actually serving, so this makes `up` wait until the service truly responds.
   if (service.ready && service.ready !== 'tcp') {
-    const readiness = await untilReadyOrEnded((abort) => awaitReadiness(resolveReadyProbe(service.ready as Exclude<typeof service.ready, 'tcp' | undefined>, { host, port, url }), log, cwd, service.id, env, abort), ended, boot, 'the service', log).catch(async (error) => {
+    const readiness = await untilReadyOrEnded((abort) => awaitReadiness(resolveReadyProbe(service.ready as Exclude<typeof service.ready, 'tcp' | undefined>, { host, port, url }), cwd, service.id, env, abort), ended, boot, 'the service', log).catch(async (error) => {
       if (undeadPids([child.pid!]).length) recordWorldStop([log], 'world.service.stop', 'up (startup failed)', 'SIGTERM');
       try { await signalHeldChild(child, 'SIGTERM', true, identity); } catch { /* best effort cleanup */ }
       throw new Error(`Service "${service.id}" failed its readiness probe: ${errorMessage(error)}\nLog: ${log}`);
@@ -1882,11 +1845,10 @@ async function startColocatedServices(
     // The host's receipt (this boot, every requested port) is published only
     // after every factory bound its own port; a port another process held fails
     // its bind and leaves no receipt. The receipt is the host's ownership proof
-    // for each port, so no twin waits out a settle (ADR 0014). A port that
-    // answers with another boot's identity is still refused.
-    const hostSettle = Promise.resolve('alive' as const);
+    // for each port (ADR 0014). A port that answers with another boot's identity
+    // is still refused.
     await parallelStartup(allocated, async ({ service, port }) => {
-      await confirmOwnPort(port, boot, ended, true, `Co-located twin "${service.id}"`, log, true, hostSettle).catch(async (error) => {
+      await confirmOwnPort(port, boot, ended, true, `Co-located twin "${service.id}"`, log).catch(async (error) => {
         if (undeadPids([child.pid!]).length) recordWorldStop([log], 'world.service.stop', 'up (port not its own)', 'SIGTERM');
         try { await signalHeldChild(child, 'SIGTERM', true, identity); } catch { /* best effort cleanup */ }
         throw error;
@@ -3299,12 +3261,11 @@ const DOCTOR_EXTERNAL_PROBE_TIMEOUT_MS = 3_000;
 /** Run an external service's declared readiness probe exactly ONCE (unlike `awaitReadiness`, which
  * polls until it passes or times out — appropriate at boot, wrong for a doctor health check, which
  * must report the CURRENT state, not wait for it to become healthy). Reuses the same probe shapes
- * (`command`/`httpUrl`/`stdoutMatch`) declared in config for the boot-time `readyWhen`. */
+ * (`command`/`httpUrl`) declared in config for the boot-time `readyWhen`. */
 async function probeExternalOnce(
   ready: WorldExternalReadyWhen,
   cwd: string,
   env: NodeJS.ProcessEnv,
-  logPath: string,
 ): Promise<{ ok: boolean; message: string }> {
   if (ready.command !== undefined) {
     if (!commandExists(ready.command)) {
@@ -3327,12 +3288,7 @@ async function probeExternalOnce(
       return { ok: false, message: `probe failed: ${errorMessage(error)}` };
     }
   }
-  if (ready.stdoutMatch !== undefined) {
-    const text = serviceOutput(readServiceText(logPath));
-    if (new RegExp(ready.stdoutMatch).test(text)) return { ok: true, message: 'probe ok (stdoutMatch)' };
-    return { ok: false, message: `probe pattern /${ready.stdoutMatch}/ not found in log` };
-  }
-  return { ok: false, message: 'malformed readiness probe (no command/httpUrl/stdoutMatch)' };
+  return { ok: false, message: 'malformed readiness probe (no command/httpUrl)' };
 }
 
 /** A stopped service's own account for doctor: how it ended, its last output, and where its whole log is. */
@@ -3402,7 +3358,7 @@ export async function doctorWorld(name: string, options: { root?: string; verify
       const probeCwd = service.external?.cwd ?? root;
       const probeEnv = { ...admittedEnv(stripEnvOf(instance.env ?? {})), ...(instance.env ?? {}), ...(service.external?.discoveredEnv ?? {}) };
       if (configuredExternal?.readyWhen) {
-        const probe = await probeExternalOnce(configuredExternal.readyWhen, probeCwd, probeEnv, service.log);
+        const probe = await probeExternalOnce(configuredExternal.readyWhen, probeCwd, probeEnv);
         checks.push({ id: `service:${service.id}:external`, ok: probe.ok, message: `${discoveredMessage}; ${probe.message}` });
       } else if (configuredExternal?.status) {
         try {
@@ -3437,13 +3393,12 @@ export async function doctorWorld(name: string, options: { root?: string; verify
       checks.push({ id: `service:${service.id}:tcp`, ok: true, message: service.url! });
       // A port that accepts is not a service that answers (a stuck event loop still completes the handshake): the
       // readiness probe the service declared is run again, as it was at boot.
-      // A log pattern matched at boot matches forever, so it cannot tell a hung service: only a probe that asks is re-run,
-      // in the service's own cwd and with its PORT, as at boot.
+      // The probe is re-run in the service's own cwd and with its PORT, as at boot.
       const configured = externalProbeConfig?.services.find((candidate) => candidate.id === service.id);
       const declared = configured?.ready;
-      if (pidLive && declared && declared !== 'tcp' && declared.stdoutMatch === undefined) {
+      if (pidLive && declared && declared !== 'tcp') {
         const probe = await probeExternalOnce(resolveReadyProbe(declared, { host: '127.0.0.1', port: service.port!, url: service.url! }), configured?.cwd ? resolve(root, configured.cwd) : root,
-          { ...admittedEnv(stripEnvOf(instance.env ?? {})), ...(instance.env ?? {}), ...(configured?.env ?? {}), PORT: String(service.port) }, service.log);
+          { ...admittedEnv(stripEnvOf(instance.env ?? {})), ...(instance.env ?? {}), ...(configured?.env ?? {}), PORT: String(service.port) });
         checks.push({ id: `service:${service.id}:ready`, ok: probe.ok,
           message: probe.ok ? probe.message : `its port accepts but its declared readiness probe fails (${probe.message}): the service is up but not answering\n      log: ${service.log}` });
       }

package/src/schema.ts

@@ -97,16 +97,15 @@ export type WorldExternalDiscover = {
 };
 
 /**
- * Optional readiness probe, polled after `up` until it passes or `timeoutMs` elapses. Exactly one of:
- *  - `command`/`args`: a command that must exit 0,
- *  - `httpUrl`: an HTTP(S) URL that must return a 2xx/3xx response,
- *  - `stdoutMatch`: a regex that must appear in the `up` command's captured stdout/stderr log.
+ * Optional readiness probe, polled after `up` until it passes or `timeoutMs` elapses: the service answering its own
+ * protocol (architecture D9). Exactly one of:
+ *  - `command`/`args`: a command that asks the service and exits 0 when it answers,
+ *  - `httpUrl`: an HTTP(S) URL that must return a 2xx/3xx response.
  */
 export type WorldExternalReadyWhen = {
   command?: string;
   args?: string[];
   httpUrl?: string;
-  stdoutMatch?: string;
   timeoutMs?: number;
   intervalMs?: number;
 };
@@ -224,7 +223,6 @@ export type WorldServiceConfig = {
    * service truly serves, so `up` returning means "ready" (no post-up re-polling needed):
    *   - `{ httpUrl }`  — poll until 2xx/3xx. `${url}`/`${host}`/`${port}` resolve to the allocated port.
    *   - `{ command, args }` — poll until the command exits 0 (runs with the service env, incl. `PORT`).
-   *   - `{ stdoutMatch }` — poll until a regex matches the service's stdout/stderr log.
    * 'external' services use `external.readyWhen` instead.
    */
   ready?: 'tcp' | WorldExternalReadyWhen;
@@ -461,26 +459,21 @@ function assertValidRegex(pattern: string, what: string, path: string): void {
 }
 
 /** Shared validator for a readiness probe — used by both `external.readyWhen` and a process/twin
- * service's `ready` object. Exactly one of command/httpUrl/stdoutMatch, correct types, and any
- * stdoutMatch regex must compile (so a typo fails at config time, not mid-boot). */
+ * service's `ready` object. Exactly one of command/httpUrl, with correct types. */
 function assertReadyWhen(ready: unknown, what: string, path: string): void {
   if (!ready || typeof ready !== 'object' || Array.isArray(ready)) {
     throw new Error(`${what} must be an object in ${path}`);
   }
-  assertKeys(ready as Record<string, unknown>, ['command', 'args', 'httpUrl', 'stdoutMatch', 'timeoutMs', 'intervalMs'], what, path);
+  assertKeys(ready as Record<string, unknown>, ['command', 'args', 'httpUrl', 'timeoutMs', 'intervalMs'], what, path);
   const r = ready as WorldExternalReadyWhen;
-  const probes = [r.command !== undefined, r.httpUrl !== undefined, r.stdoutMatch !== undefined].filter(Boolean).length;
+  const probes = [r.command !== undefined, r.httpUrl !== undefined].filter(Boolean).length;
   if (probes !== 1) {
-    throw new Error(`${what} must set exactly one of command/httpUrl/stdoutMatch in ${path}`);
+    throw new Error(`${what} must set exactly one of command/httpUrl in ${path}`);
   }
   if (r.command !== undefined && typeof r.command !== 'string') throw new Error(`${what}.command must be a string in ${path}`);
   if (r.args !== undefined && (!Array.isArray(r.args) || r.args.some((arg) => typeof arg !== 'string'))) throw new Error(`${what}.args must be a string array in ${path}`);
   if (r.args !== undefined && r.command === undefined) throw new Error(`${what}.args requires command in ${path}`);
   if (r.httpUrl !== undefined && typeof r.httpUrl !== 'string') throw new Error(`${what}.httpUrl must be a string in ${path}`);
-  if (r.stdoutMatch !== undefined) {
-    if (typeof r.stdoutMatch !== 'string') throw new Error(`${what}.stdoutMatch must be a string in ${path}`);
-    assertValidRegex(r.stdoutMatch, `${what}.stdoutMatch`, path);
-  }
   for (const key of ['timeoutMs', 'intervalMs'] as const) {
     if (r[key] !== undefined && (!Number.isInteger(r[key]) || r[key]! <= 0)) throw new Error(`${what}.${key} must be a positive integer in ${path}`);
   }

package/src/service-exit.ts

@@ -83,12 +83,6 @@ function split(line: string): { output: string; record?: { event?: unknown; at?:
   try { return { output: line.slice(0, at), record: JSON.parse(line.slice(at)) as { event?: unknown; at?: unknown } }; } catch { return { output: line }; }
 }
 
-/** A log's text as the service wrote it, without the recorder's records: what a `stdoutMatch` readiness pattern is
- *  matched against. */
-export function serviceOutput(text: string): string {
-  return text.includes(MARK) ? text.split('\n').map((line) => split(line).output).join('\n') : text;
-}
-
 /** The last run's end in a service log: its start, its exit record (absent while it runs, or when its parent was killed
  *  with it), and the output it wrote last. Undefined for a log the parent never wrote to (a co-located twin's host log),
  *  which has no runs to tell apart. A run is bounded by its start record or, for a spawn that failed before starting

package/src/up-cli.ts

@@ -22,7 +22,17 @@ export async function upCommand(subject: string | undefined, rest: string[], roo
   // --keep-state: boot over the state the World's directory already holds (a World carried somewhere else, e.g. a
   // browser tab's image, comes up over its data instead of starting empty, as a fresh `up` does)
   const keepState = rest.includes('--keep-state');
+  // --app-url: where the booter serves the app, recorded as `volter-world app-url --set` records it, once the World is
+  // up and in this process: a booter that knows the address before the app listens (a browser tab's preview origin)
+  // saves a whole command between up and the app's start.
+  const appUrl = optionValue(rest, '--app-url') || undefined;
+  if (appUrl !== undefined && !(URL.canParse(appUrl) && /^https?:$/.test(new URL(appUrl).protocol))) throw new Error(`volter-world up: --app-url "${appUrl}" must be an http(s) URL`);
   const instance = await superviseWorldUp(subject, { name, root, mode, envFile, forceEnvOutput: rest.includes('--force'), owner: ownerOption(rest), ...(isolation ? { isolation } : {}), ...(keepState ? { keepState: true } : {}) });
+  if (appUrl !== undefined) {
+    const { setAppUrl } = await import('./app-url.ts');
+    setAppUrl(instance.name, appUrl, { root });
+    process.stderr.write(`volter-world up ${instance.name}: app url recorded: ${appUrl}\n`);
+  }
   if (rest.includes('--json')) process.stdout.write(JSON.stringify(instance, null, 2) + '\n');
   else printReady(instance);
 }