akanjs 3.0.0 → 3.0.1

package/CHANGELOG.md

@@ -1,5 +1,3664 @@
 # akanjs
 
+## 3.0.0
+
+### Minor Changes
+
+- ccf2ae2: A CSR dev page — `?csr=true`, `/__csr`, and every native dev build — updates in place on save instead of reloading.
+
+  - `akan start` serves the CSR page as a module registry: each module is its own factory, and a save sends only the
+    modules it changed. A component edit keeps hook and DOM state (React Fast Refresh), a store edit keeps the store,
+    and a build error shows the overlay and recovers without a reload.
+  - A page or layout edit swaps that route in place through `replacePages`: the page stack, history and stores stay,
+    and so does the state of the components under the edited page or layout. A `*.constant.ts`, an added or removed
+    route, a new npm dependency or a signal/dictionary change still reloads.
+  - `AKAN_DEV_CSR=artifact` brings back the single-file dev bundle, which reloads on every save. `akan build` and a
+    release mobile build are unchanged.
+  - HMR sockets now say what they are: a CSR page connects as `/_akan/hmr?client=csr` and gets `csr-update` instead of
+    the SSR `reload` and `rsc-refresh`, and a page that missed an update while disconnected reloads
+    when it reconnects.
+
+- ccf2ae2: A Windows desktop app can share its screen without the picker
+
+  `native.desktop.screenCapture: "auto"` in `akan.config.ts`, or `desktop.screenCapture` on one target, makes the
+  Windows app answer the page's `getDisplayMedia()` with the first screen at once, without the picker and without a user
+  gesture, for remote support on a screen nobody attends. It is Chromium's switch for automated media tests and covers
+  every media request, so leave it off in an app whose pages ask for a camera or a microphone. The default `"picker"`
+  keeps the picker; macOS and Linux ignore it.
+
+- ccf2ae2: A page a native shell serves reaches its API, and keeps its session, without the cookies it no longer has.
+
+  The shell serves the page from `app://localhost` (iOS, macOS, Linux) or `https://app.localhost` (Android, Windows),
+  which is cross-origin to the API and names neither its host nor its port, and WKWebView keeps no cookies for it.
+
+  - `CrossSiteGuard` admits those two origins instead of `capacitor://localhost`, `ionic://localhost` and
+    `http://localhost`, and every signal route answers `OPTIONS` for an allowlisted origin with the verbs it serves,
+    so a bearer header or a JSON body preflights without an ingress in front. Never with
+    `access-control-allow-credentials`: the `SameSite=None` cookie would let an allowed origin ride a browser session.
+  - `AKAN_PUBLIC_SERVER_URL` (http or https) names a CSR bundle's server — host, port and protocol, the websocket
+    URL following it. A cloud CSR bundle without it calls its cloud host on 443; SSR tabs and servers ignore it.
+  - A CSR client's session is the bearer token `fetch` sends: `getAuthToken()` reads it before the cookie jar and
+    `setAuth()` no longer copies it into a cookie. An `app://` page keeps its other cookies (theme,
+    `prepareUserId`, …) in a `localStorage` jar. The `CapacitorCookies` mirror is gone.
+  - `libs/shared`: a CSR client keeps each scope's refresh token (user, admin) in storage and sends it in the body,
+    which the server already accepted; sign-in, activation and refresh keep the rotated token, sign-out drops it, and one
+    refresh per scope runs at a time, since a second use of a rotated token reads as theft and ends every session.
+
+  **Breaking for a Capacitor build still in the field:** its `capacitor://localhost` origin is refused.
+
+- ccf2ae2: A native app can sign in through the system browser and hear the callback on every desktop OS.
+
+  - `akanjs/client/native` exports `authSession` and its `AuthSessionApi` type, the runtime's system-browser sign-in,
+    and `isNativeShell()`, true in any native shell; `isNativeApp()` stays iOS and Android only.
+  - `getServerOrigin()` in `akanjs/base` is the server's origin as a browser outside the page opens it. For a page the
+    native dev gateway served, that is the dev server (`http://localhost:<dev port>`), not the app origin the page
+    calls; otherwise it is the origin of `getEnv().serverHttpUri`.
+  - A native dev build on Android reverses the dev server's port as well as the gateway's, so a browser on the device
+    reaches it.
+  - A target with `deepLinks.schemes` ships `single-instance`. Windows and Linux open a link by starting the app again,
+    and the hand-over is how the link reaches the running app. A second launch of such an app now hands over and exits
+    instead of opening a second window, and a desktop debug build keeps the release app id, so it does the same while
+    the release app runs.
+  - In an app with basePaths whose only target names none, `start-*` and `build-*` without `--target` ask for a basePath
+    instead of opening the root, which has no CSR page.
+
+- ccf2ae2: A push for the page on screen is not shown in front, and `usePurchase` verifies with the app's own function.
+
+  - The push plugin's `setForegroundPresentation` takes `except: { key, values }`: a push whose `data[key]` is one of
+    `values` is not shown while the app is in front, and still arrives as `received`. The CSR frame keeps it set to
+    the page on screen, so the chat room being read does not banner its own messages; `data.url` may spell the page
+    with or without the locale and the target's basePath.
+  - `usePurchase({ verify })` checks a purchase with the app's function instead of `POST <url>/billing/verifyBilling`.
+    It gets the normalized proof and the transaction, whose `verification` carries the store's own; what it resolves
+    reaches `onPay`/`onSubscribe`, and `null`, `undefined` or `false` refuses. The finish flow is unchanged.
+
+- ccf2ae2: The app's websocket refuses a page from another site
+
+  A socket has no CORS, so a page on any site could open `/api/ws` on a server it reached — a desktop app's loopback
+  server through the user's own browser — and read every room it may subscribe to, riding the `SameSite=None` auth
+  cookie where there is one. The upgrade now runs `CrossSiteGuard`'s origin check, the one mutations and the dev HMR
+  socket already pass: a same-site page, the native shells (`app://localhost`, `https://app.localhost`), an origin in
+  `allowedOrigins` and a caller that sends no `Origin` connect as before, and any other origin is refused with 403.
+  `option.setCrossSite({ enabled: false })` turns it off with the rest of the gate.
+
+  **Breaking for a web client on another site that only read and subscribed:** its socket is refused until its origin is
+  in `allowedOrigins`, as its mutations already needed.
+
+- 8c31d54: The in-page chat guards the model's window, and answers a refusal for length by compacting once
+
+  Compaction used to watch one number: the transcript, estimated at four characters a token, against `compact.at`
+  (24k). It did not know the window, did not count the tools, the screen context or the instructions that ride every
+  turn, and read Hangul — nearer one character a token than four — as a fraction of what it costs. Measured on a
+  single live DeepSeek turn: the transcript estimate said 23 tokens where the provider counted 458. And when the
+  provider refused a prompt too long for its window, the turn simply failed.
+
+  **The relay now reports what it knows.** Every turn's `done` carries the provider's own count (`usage: { input,
+output }`, `input` the whole prompt) and what the adaptor knows about its model (`limits: { window, output }`).
+  The window is declared with `option.setLlm({ contextWindow })` — a table of models would be a claim about models
+  that ship after it. `LlmAdaptor` gains an optional `limits`; `AnthropicLlm` reports the answer ceiling it always
+  sends, `OpenaiLlm` sends none and so reports none.
+
+  **The session compacts on whichever trigger comes first.** `compact.at` stays, with its 24k default, as a ceiling
+  on what each turn costs — the relay resends the whole transcript every turn and the app pays for each one. Beside
+  it, once the window is known, a guard compacts when the prompt passes `window − answer ceiling (8,192 when
+unreported) − compact.buffer (13,000)`, measured by the provider's count of the last turn plus the estimate for
+  what arrived since. `{ at: Infinity }` leaves only the guard; `{ at: 0 }` still turns all of it off. The count is
+  kept on the assistant message (`ChatMessage.usage`), never sent, and dropped from what a compaction keeps.
+
+  **A refusal for length is answered once.** Adaptors build refusals through `LlmOverflow.refusal(host, status,
+reason)`, which reads each provider's own "prompt too long" sentence as `agent.error.contextOverflow` with the
+  `limit` it named. The relay flags it `overflow` on the wire; the session drops the empty draft, compacts, sends the
+  same turn again and remembers the window. A second refusal in the same send fails with the translated message.
+  An app's own adaptor that throws through `LlmOverflow.refusal` recovers the same way.
+
+  The chat header now reads `~31k / 107k tokens` — the estimate against whichever trigger is nearer — with the point
+  it compacts at in its tooltip.
+
+  ## Upgrading
+
+  Nothing is required. To turn the guard on, declare the window your model has:
+
+  ```ts
+  option.setLlm({
+    apiKey,
+    model: "deepseek-flash",
+    host: "https://api.deepseek.com",
+    contextWindow: 1_000_000,
+  });
+  ```
+
+  A backend of your own that speaks the turn wire (use-agentic `WIRE.md`) opts in by adding `usage` and `limits` to
+  its `done` event and `overflow: { limit? }` to a refusal for length; one that sends neither keeps working as before.
+  The usage, limits and overflow fields ride the streaming answer — which is what `httpRunner` negotiates — and are
+  not added to the relay's single-JSON `AgentTurn` answer.
+
+- 5f53462: A message carries the data the user pointed at
+
+  An in-page agent could be handed files but not data. What was on the screen reached the model only as the turn's
+  `ContextBlock`s, which are reassembled from the screen every turn — so a record named three turns ago is not in the
+  conversation any more, and there was nowhere to say _which_ record, or which field of it, somebody meant.
+
+  `ChatMessage.references` is that place, beside `attachments` and for the same reason: what a person referred to
+  while asking is part of the asking. A `MessageReference` names the host's own `refName`, the id, a label, and
+  optionally a dotted `path` into the document, and carries the `value` those resolved to.
+
+  Three properties are load-bearing and deliberate:
+
+  - **The value is a snapshot.** It is what the data was when the message was sent, never re-read later. Re-reading
+    would rewrite what the person was looking at when they spoke — and the common case is an agent that then edits
+    the very field it was pointed at, which would leave the reference showing the result with no record of what was
+    being changed from. `refName`/`refId`/`path` travel so a tool can read the current value when the answer needs it.
+  - **The value arrives masked, and nothing downstream can mask it again.** Masking needs the model class, which no
+    wire carries, so whichever model the host names when it stages a reference is the whole of the decision about
+    what leaves the browser.
+  - **It is bounded at 20,000 characters per reference, at both ends.** A reference is bulkier than a tool result and
+    outlives one: it rides every turn from the moment it is sent and is the last thing compaction folds, because
+    folding what the user pointed at is folding the question. `Reference.clipped` bounds it as it is staged, and
+    `AgentService.referenceLimit` bounds it again where nothing can route around it.
+
+  `AgentSession` holds the staging slot — `stage` / `staged` / `unstage(key)` / `clearStaged()` — rather than the
+  composer, which is where staged files live. The difference is not an inconsistency: a file only ever arrives from
+  the composer's own picker or drop zone, while a reference arrives from whichever component drew the data, reaching
+  the session it is already inside. Unstaging is keyed on `refName/refId#path`, never on an index, because what
+  orders the references of a message is its text.
+
+  The server folds them into the message text in one place (`AgentService.referenced`), under a heading that says the
+  values are a snapshot. Text is the one field every provider mapping already reads, so Anthropic, the OpenAI dialect
+  and the text-only default all carry references with no change between them and none of them can drop one quietly.
+  A string value prints as itself rather than as escaped JSON, which is the common case and the readable one.
+
+  Persistence keeps the pointer and drops the value, with a note saying so — a restored conversation re-reads what
+  was pointed at with a tool instead of guessing from the label, which is a better answer than a restored attachment
+  can give.
+
+- 5f53462: The composer can point at data, from the menu or from the screen
+
+  Builds the user-facing half of message references on top of the carrier. There are two entry points, and which one
+  applies depends on who knows the value.
+
+  `<Agent.Chat reference={[…]} />` takes a `ReferenceSource` per kind of document — `refName`, a `type` in
+  `st.expose`'s vocabulary, the app's own `search`, and a `resolve` — and the composer's `@` menu offers whole
+  documents from them. Which documents somebody may point at is the app's answer, so the source brings the query; the
+  framework brings the token, the masking and the snapshot. The token is written the moment a row is picked and the
+  value is staged when `resolve` lands, so a slow fetch never freezes the menu and one that fails leaves a pointer
+  rather than a chip that means nothing.
+
+  `useAgentReference()` is the other half, for a field _inside_ a document. The component drawing it already holds
+  the value, so it hands that over with no round trip — and it is the only thing that knows a rich-text field stored
+  as `field(Any)` reads as a paragraph rather than as the editor document it is stored as. It no-ops with a warning
+  outside a session, the call `AgentValue.publishable` already makes: a card carrying a reference button must not
+  cost a route its render.
+
+  **The token in the draft is what carries a reference; the chip only draws it.** Deleting the token by hand drops
+  the reference exactly as removing the chip does, because removing the chip removes the token. Nothing re-derives a
+  value from edited text, so a token pasted out of an earlier message travels as a pointer with a note — the same
+  shape a restored conversation produces.
+
+  Staging lives on the session rather than the composer, because `useAgentReference` is called from components the
+  composer cannot see. Writing the token is still the composer's, so the session holds the unwritten ones as state
+  and a chat acknowledges each by key: two chats on one session — a responsive app rendering a desktop and a mobile
+  composer — each hold their own draft and each need the token, which a queue somebody drains would have given to
+  whichever rendered first. `refer` warns instead of staging silently when no chat is mounted on that session, which
+  is the case where a card sits outside the `<Agent.Zone>` its chat is inside.
+
+  References also ride the parking queue, so one pointed at while a turn is running survives to the message it
+  opens; taking a parked message back restores its values, and anything pointed at since wins, because the parked
+  value is the older read of the same field.
+
+- 5f53462: A chat's transcript has a turn in it
+
+  `AgentSteps` is a new `_overrides.tsx` slot holding one agent turn: the messages between the user message that
+  opened it and the next one, plus `isRunning` for whether more are still coming. It is the grain a chat needs to
+  fold a turn's steps into a `details` and stand its final answer outside them — and the one boundary no per-message
+  slot can see, because neither message on either side of it knows it is at an edge.
+
+  The transcript now emits per turn rather than per message. A user message still stands alone as its own `Bubble`;
+  everything after it goes to one `AgentSteps` until the next user message, which also means a transcript whose head
+  is a compaction summary opens a turn of its own. The array handed over is what the turn _renders_ rather than what
+  it holds on the wire: a tool message whose results a call row already draws is gone, and one holding results no
+  call claims is narrowed to those, so an app folding a turn never re-derives the call/result pairing.
+
+  **The default adds nothing.** It draws the same flat bubbles into a Fragment, not a box, so it takes no
+  `className` and no existing layout can tell the component is there. `DefaultSteps` is exported from `akanjs/ui`
+  beside the other defaults, for a skin that wants to compose the one it is replacing.
+
+  `isRunning` is only ever true of the last turn of a transcript the session is working on. Without it the same
+  messages read the same whether the agent is mid-step or finished, and a scaffold cannot tell a live progress line
+  from a completed turn's header.
+
+- ccf2ae2: `akan build-desktop --installer` makes a Windows setup program
+
+  On Windows the build adds `<file>-<version>-<arch>-setup.exe`, made with NSIS (`winget install NSIS.NSIS`). It installs
+  for the current user under `%LOCALAPPDATA%\Programs\<app name>`, where the updates plugin swaps the app without an
+  administrator, with a Start menu shortcut and an uninstall entry. `/S` installs silently and `/RUN` starts the app
+  afterwards, and a PC without the WebView2 Runtime gets it. The program is not code-signed yet.
+
+  - What can fail without touching the installed app comes first: WebView2, then the new files, unpacked beside the
+    folder. Only then is a copy of the app running from the folder stopped, found by its path, and the folder swapped by
+    two renames. A swap that fails puts the old folder back, and with `/RUN` the app left in place starts again.
+
+  - The uninstaller lives beside the app folder (`<folder>.uninstall.exe`), not in the folder an update replaces, so
+    Settings › Apps can still remove an updated app. It finds the folder from the uninstall entry and removes it with
+    whatever updates left beside it (`.previous`, unpacked or failed releases) and itself, the launch-at-login entry and
+    the updates state; the server's data stays. An uninstaller that cannot be
+    written there (a `/D=` right under a drive root) fails the install.
+  - The Start menu shortcut and the app `/RUN` or the last page starts work in `%LOCALAPPDATA%`: Windows cannot rename a
+    folder some process works in, which is what applying an update does.
+  - `/RUN` starts the app after a silent install only; an interactive one offers it on its last page.
+  - Run again without `/D=`, it installs into the folder the uninstall entry names, so a reinstall replaces the copy
+    already installed wherever it was put, and a setup started while another one runs refuses to start.
+  - A silent install that cannot finish exits with 2: files it could not write (the script is long-path aware, and the
+    build warns when the deepest file nears 260 characters under `%LOCALAPPDATA%\Programs`), a WebView2 Runtime still
+    missing after its setup ran (an interactive install asks), or a `/D=` folder holding someone else's files.
+  - An update the app confirms sets the version Settings › Apps shows.
+
+- ccf2ae2: `akan.config.ts` reaches the native settings a store release needs, and an app keeps a different id on each store.
+
+  - `native.android.push` (channel, `smallIcon` relative to the app folder, `color`) and `native.ios.privacy` (the iOS
+    privacy manifest) pass through, per target too.
+  - `native.icon` takes `{ image, backgroundColor }` and `native.splash` the runtime's `{ image, backgroundColor,
+autoHide, timeout }`, besides a path.
+  - `appId` is a string or one per platform — `{ ios, android, default }` — for an app whose listings already carry
+    different ids. The app-link files serve each platform's own id.
+
+- ccf2ae2: An app and a lib ship native plugins of their own from a `native/` folder
+
+  A plugin the runtime has no builtin for sits in `apps/<app>/native/<id>/` (or `libs/<lib>/native/<id>/`), the folder
+  named after the id in its `native-plugin.json`. It is listed nowhere: every mobile and desktop target of the app
+  ships it, and its manifest says what runs on each platform. A lib's plugins reach only the apps that depend on it; an
+  app's own plugin wins an id a lib also uses, and two libs claiming one id stop the build. `akan sync`, `akan doctor`
+  and `akan quality scan` accept the folder.
+
+  The page API is written with `definePlugin` from `akanjs/client/native` (which also exports `defineWebPlugin`,
+  `createLiveValue`, `useLiveValue` and `usePluginEvent`), and the desktop part with `defineDesktopPlugin` from the new
+  `akanjs/native/desktop`. A `native/` folder is out of the scope of `no-throw-raw-error` (a plugin throws
+  `AkanNativeError`) and of `no-web-only-api-outside-webkit`. A plugin a target names by folder in `native.plugins` is now
+  granted by its id instead of its path, and ships once when it is also the app's own `native/<id>`. A desktop plugin's
+  `ctx.launch.exit(code)` after its setup ran past the launch phase's 3 s quits the app, since its window exists by then.
+
+- ccf2ae2: An installed app updates itself: a phone its web bundle over the air, a desktop app the whole app.
+
+  - `native.updates: { url, publicKey, channel?, readyTimeout? }` in `akan.config.ts`, per target too, the target's
+    fields winning. It brings the runtime's `updates` plugin. A channel left unnamed is the backend env the binary is
+    built for (`main`, `develop`, `debug`, …), so a `build-desktop` app (`debug` unless `--env` names another) takes
+    only the releases published for that env.
+  - The CSR frame confirms a release on trial once the first page is on screen, in every native shell (an unconfirmed
+    one is rolled back at the next launch). On a phone it also keeps the bundle current by itself: at start and on each
+    return to the front it looks for a newer one and downloads it, and it runs from the next cold start. A desktop
+    release is the whole app and a relaunch, so the app checks, downloads and applies it on its own schedule. A dev
+    build's pages are left alone. `akanjs/client/native` exports `updates`, `markReady` and `useUpdateState`.
+  - `akan update-keygen <app> [--platform]` makes the signing key of the app's id once and prints its public half.
+    `akan publish-update <app>` builds a release on this machine and signs it: the whole app for this computer's desktop
+    OS and CPU (with the app's server when `desktop.server` says so for the target, as for `build-desktop`), or the
+    web bundle for `--platform android|ios`. It writes the manifest and its files under `.akan/native/<target>/updates`,
+    to upload to `updates.url`, on the channel of its `--env` (`main` unless named). `--channel` names only the manifest
+    written, not the channel the release follows, so a pilot group gets a target whose `updates.channel` is the pilot's.
+  - The updates folder holds only what is uploaded, and whoever can reach `updates.url` reads it: the updater sends no
+    credentials, and a desktop release is the whole app, with the carried server's `private/` (the app's and its libs')
+    and its env file.
+  - `akan pack-update <app> --platform ios|android [--target] [--env] [--out]` writes an unsigned phone update instead,
+    for a signer that keeps the key elsewhere: `files/<sha256>`, `bundle.json` and `manifest.template.json`, the
+    manifest with `channel`, `sequence` and `bundle` left for the signer. `--against <store bundle.json>` also checks
+    the bundle runs in that store build, writes `compat.json`, and fails when it needs a new binary. The signing
+    contract is in the native runtime's architecture notes: fill the three fields, sign exactly the bytes you upload,
+    upload `files/` first.
+  - `publish-update` refuses a `--channel` outside the names `updates.channel` accepts (lowercase letters, digits, `.`,
+    `_`, `-`) before it builds, and numbers a release past the one its channel already has in the updates folder,
+    warning when this computer's clock is behind it. Apps compare against the time their own build was made, so keep the
+    building and the publishing computers' clocks in step.
+  - While a desktop release is on trial, `updates.check()` answers `available: false` for it and `updates.apply()`
+    rejects with `NOT_ALLOWED`: applying would replace the app a failed trial goes back to.
+  - A release of a desktop app that carries its server is confirmed only once that server answered ready and stayed up
+    for 5 s, and only while it is up; its trial clock (`readyTimeout`) starts then, so a server slow on its first run
+    (its new files being scanned) costs no rollback. A server that gives up, or is not up within 120 s of the start,
+    rolls the release back at once; the release stays downloaded for the next apply, and its third such failure
+    excludes it for good.
+  - A desktop release's manifest says whether it carries a server, and an installed app refuses one that differs from
+    itself before downloading anything (`check()` answers `available: false`, `download()` rejects with
+    `NOT_ALLOWED`), since either way its pages' backend would change place. `publish-update` refuses, before it builds,
+    a desktop release whose server presence differs from the channel's previous one: publish it on another channel
+    (`updates.channel`), or remove that `<channel>.json` from the output folder to start the channel over. Turning
+    `native.desktop.server` on or off for an app already installed takes a reinstall.
+  - On Windows an app started from its install folder (the installer, the Start menu, Explorer) applies and rolls back
+    updates: Windows renames no folder a process works in, so the app moves to its local data folder before the webview
+    starts, and the update helper and the app it starts work elsewhere.
+  - The update state and the unpacked releases live in the app's local data (`%LOCALAPPDATA%\<app id>\akan-native-updates`
+    on Windows), and plugins get that folder as `ctx.appLocalDataDir`.
+  - An app installed under another folder name (`/D=`, a renamed `.app`) takes updates; a download older than a
+    reinstalled build is dropped; a Windows swap that did not happen (a file stayed locked, the helper never ran) keeps
+    the release downloaded for the next apply until its third such failure excludes it. Reinstalling the app clears the
+    list of releases the earlier install refused.
+  - `publish-update` checks every target before anything builds — its `updates` settings, its native config, the
+    signing key on this computer, and whether its channel's previous release carries a server as it would — so a CI
+    without the key stops at once and a publish never releases only the first targets. It writes `<channel>.json`
+    together with its signature.
+    The channels `bundle`, `manifest.template` and `compat` are refused. `akan start` keeps `.akan/native`, where
+    releases wait to be uploaded, and the `bin` downloads in `.akan/cache/bin`.
+
+- ccf2ae2: An app image carries the server env of the environment it runs and no other.
+
+  - `env/env.server.ts` imports every environment's file, so `akan build` used to bundle all of them into `server.js`:
+    anyone holding the image of one environment could read the keys of every other. The backend build now keeps only
+    `env.server.<AKAN_PUBLIC_ENV>.ts`, the environment the generated Dockerfile fixes, and swaps each other
+    environment's file (`local`, `testing`, every branch) for exports that refuse to be read. Booting such an image under
+    another `AKAN_PUBLIC_ENV` stops with `env/env.server.<name>.ts is not in this build` instead of running on a
+    config it does not have. Nothing in `env/` needs to change.
+  - An app's generated `server.ts` no longer re-exports `env` from `env.server.testing.ts`, which put the testing env in
+    every image. Signal tests read it from the file. A script or test that imported `env` from an app's `server.ts`
+    imports `./env/env.server.testing` instead. A lib's `server.ts` still exports it, since each app's
+    `env.server.type.ts` spreads it as the lib's defaults.
+  - Keys that already shipped in an image stay readable in it. Rotate them.
+  - A build for a named `--env` (a mobile or desktop build) writes that env into the Dockerfile too, so the image boots
+    the environment its `server.js` carries.
+
+  **Breaking for an image started under another `AKAN_PUBLIC_ENV`, and for code importing `env` from an app's
+  `server.ts`:** the image stops at boot until it runs the environment it was built for, and the import moves to
+  `./env/env.server.testing`.
+
+- ccf2ae2: A desktop app nobody attends recovers its page, relaunches itself and opens as a kiosk
+
+  `native.desktop.recovery: "reload"`, for the app or one target, loads a page whose web process ended (a crash, a hang,
+  out of memory) again, once per end, instead of showing an error page after the second end, waiting longer after each
+  end in a row (1 s, doubling to a minute). It relaunches the app when the webview's browser process ends, where the app
+  used to quit: at once the first time, then after 1 s doubling to a minute while each relaunched app dies within a
+  minute, and after ten in a row it exits with code 1 instead of restarting for good.
+  `native.desktop.window: { fullscreen, skipTaskbar }` opens the main window borderless fullscreen and without a taskbar
+  button (Windows, Linux) from its first frame; a plugin's launch phase decides the same per launch with
+  `ctx.launch.setWindow`. `app.relaunch()` ends the app and starts it again in a new process on the desktop and Android,
+  and reloads the page on the web; one process starts one new app, however many windows or calls asked for it.
+  `native.android.autoplay: true` lets media play with sound without a tap first, as it already does on iOS and the
+  desktop.
+
+  An app relaunched by an update on Windows no longer quits the moment it starts when `akan start-desktop` had started
+  the one before it.
+
+- ccf2ae2: feat(native): Android back belongs to the page only while it has somewhere to go, a back swipe moves the page, and
+  memory warnings release hidden pages
+
+  - **`app.setBackEnabled({ enabled })`** (Android) tells the shell whether a listening page wants back right now. The
+    CSR frame reports it after every navigation: enabled while there is history, the keyboard is up, or the index is
+    still to come. At the index with nothing under it the shell no longer registers its back callback, so the system
+    shows its back-to-home animation and the app stays warm. Before, the page caught that back and called
+    `app.exit()`, which finished the task. A new listener starts enabled, so a page that never reports behaves as before.
+  - **`app` event `backProgress`** (Android 14+, `OnBackAnimationCallback`) carries `{ phase, progress, swipeEdge }` for
+    a back the page will take. The frame drives the current transition's spring with it: a `stack` or `bottomUp` page
+    follows the finger, a fade or `scaleOut` page moves half as far, and a cancelled swipe springs back. The commit
+    still arrives as `backButton`, and the back animation finishes from wherever the finger let go.
+  - **`app-state` event `memoryWarning`** `{ level: "moderate" | "critical" }`: iOS `didReceiveMemoryWarning`, Android
+    `onTrimMemory` (the `RUNNING_LOW` / `RUNNING_CRITICAL` levels Android 13 and earlier still send, `BACKGROUND` and
+    above) and `onLowMemory`. The frame releases its hidden pages on one; each mounts again when visited.
+  - The runtime's plugin host gained `setBackEnabled` and `setBackProgressListener`; the desktop `app` implementation
+    answers both as no-ops.
+
+  Checked on an Android 16 emulator: at a fresh index, back went to the system and the process survived. A left-edge
+  swipe on a stack page moved it by the finger (translateX ~76px mid-swipe) and snapped back on cancel; a committed swipe
+  went back through `router.back`. `am send-trim-memory RUNNING_CRITICAL` left only the current and previous pages. On an
+  iOS 26.5 simulator, Simulate Memory Warning reached the page, and killing the WebContent process reloaded the page onto
+  its restored stack.
+
+- c45ac6c: perf(server): stop rebuilding per-row and per-request state on the backend hot paths
+
+  A profile of the backend (`constant` → `signal`) found the database was 3% of a list query and JS
+  post-processing was the other 97%. On a 50-row `user` query: 14µs of SQL, then 236µs decoding rows and 221µs
+  hydrating them, allocating ~23 000 objects — about 460 per document returned. None of that was the query.
+
+  The same query now runs in **276–293µs and allocates ~3 100–3 900 objects**: −33% latency, −85% allocation.
+  Four changes, each measured independently.
+
+  **`hydrate()` no longer snapshots rows it does not have to.** Every row of every query was deep-cloned —
+  `JSON.parse(JSON.stringify(sanitizeJson(row)))`, 172µs of the 412µs — purely to back `isModified()`. That
+  method has two call sites in a real app, both inside `schema.pre("save")` hooks, and a save hook only ever
+  runs on a document that came from `create()` or the update path. `hydrate` takes a trailing
+  `{ track }` that **defaults to `true`**, so every caller outside the store — including the `Model(data)`
+  facade — keeps today's behaviour; only `find` and the projected read behind it opt out.
+
+  `isModified()` on an untracked document **throws** with a message naming the fix, rather than guessing.
+  Both guesses are silently wrong: `false` skips work that was needed, and `true` makes a
+  `if (!this.isModified("password"))` hook re-hash an already-hashed password. If you hit it, you are calling
+  it on a document that came straight out of a read — move the call into a save hook, or re-load through
+  `save()` / `update()`.
+
+  The snapshot stays a deep clone where it is taken. A lazy one would be wrong: `isModified()` compares against
+  state as of hydrate, and document chains mutate `this.status = …` directly, so there is no mutation hook to
+  defer to. The six per-document closures (`set`, `save`, `refresh`, `isModified`, `toJSON`, `toObject`) also
+  moved to one prototype per store; it extends the model's own document prototype, so chain methods and
+  `instanceof` are unaffected and the methods stay non-enumerable exactly as before.
+
+  **`ConstantField.getProps()` is memoized.** It rebuilt a 27-key object on every call, and the read paths ask
+  per field per row — in `decodeDocumentPayload`, again in `crystalize` via `BaseConstant.set()`, again in
+  `purify`. It is now built once per field and frozen; no caller mutated the result.
+
+  **`getDefault()` caches a plan, not a record.** `via()` already memoized it per class, but the database
+  adaptor called the standalone function per nested scalar value per row. Thunk defaults
+  (`default: () => dayjs()`), array defaults and nested-scalar defaults are still produced per call — only
+  values that were already shared before the cache existed are shared now. Caching the finished record would
+  have frozen `dayjs()` at boot and aliased one `[]` across every document filled from that model.
+
+  **Middlewares, guards and slice projections resolve once instead of per request.** `use(env)` takes no
+  context, so a middleware instance and its handler are a function of `(class, env)` and now live for the
+  process; a rejected setup is evicted so a transient failure does not poison the endpoint. Guards are already
+  required to be side-effect free and re-runnable — `revalidateWsRooms` re-runs them outside any request — so
+  one instance per class serves every call. `Logging`, which is registered by default, built two template
+  strings per request and discarded them unbuilt at the default log level; it now checks
+  `Logger.shouldLog("debug")` first (new public method, alongside the existing `isVerbose`).
+
+  **`WebRouter` stops rebuilding the merged manifest per request.** `#ensureRoute` took a `snapshot()` and then
+  merged the runtime manifest over it on every `/*` and `/__rsc` request — four copies of a structure that is
+  276KB of JSON for a small app. `RouteClientCache` now exposes a `revision` that bumps on every mutation of
+  `merged`, including a delta merge that leaves `generation` alone, and the merge is memoized against it. In
+  production the revision never moves after `seed`, so the manifest is built once; in dev a rebuild bumps it and
+  the next request pays for one copy. The cached object is still a copy, so an in-flight request keeps consuming
+  a stable manifest across an invalidate, exactly as the per-request snapshot guaranteed.
+
+  **`routeElementComposer` and `routeTreeBuilder` are no longer re-exported from `akanjs/server`.** They pull
+  React and the page module graph, and the only consumer is `rscWorker.tsx`, which imports them relatively in its
+  own process. Re-exporting them put React into every process touching the barrel — including a
+  `SERVER_MODE=batch` replica that renders nothing and any `init({ web: false })` server. The barrel import drops
+  from **44.0MiB / 28 338 objects to 38.8MiB / 24 640**. Import them at `akanjs/server/routeTreeBuilder` and
+  `akanjs/server/routeElementComposer` if you need them directly.
+
+  The DI container was measured too and left alone: 11 services, 11 signals, 26 adaptors, 8 database models and
+  7 scalars cost 3.7MiB and 27ms, which is 2.5% of process RSS. `diLifecycle.ts` is not where backend memory
+  goes — the module graph is.
+
+- 69f7178: feat(server): boot a subset of modules with `modules`
+
+  `new AkanApp("./server", { modules: ["article"] })` mounts only the named modules and the ones they reach; every
+  other module stays out of the container, so its service, signal, routes and scheduled jobs do not exist. Omitted
+  or empty keeps today's behaviour — every module whose service is enabled. This is what lets one codebase run as
+  several small processes, such as a batch worker that carries only its own domain.
+
+  Dependencies are followed, so you name entry points rather than the whole graph. The closure takes the services
+  and signals a module injects, and also its cascade edges: a `removeRef` target and a monomorphic `removeWith`
+  owner both fail `CascadeRunner.seal` when absent, so they are boot requirements the inject graph cannot see. A
+  polymorphic `refPath` candidate is left out, matching the existing rule that an unmounted one is a mount choice
+  rather than a typo. What was mounted is named at boot:
+
+  ```
+  [DiLifecycle] INFO  Mounting 3 of 12 module(s): article, file, user
+  ```
+
+  A name no module registered fails the boot instead of being ignored — a typo would otherwise drop a module
+  silently, which is the one failure the option exists to prevent. Selection narrows the enabled set rather than
+  replacing it, so it never turns on a module whose service is `enabled: false`.
+
+  The same selection is available as `AKAN_MODULES=article,file` for a deployment that decides the split, and as
+  `{ modules }` on `AkanServer` for an app that starts the server directly. `AkanApp` hands its own option down to
+  every child through that variable, since each replica builds its own container.
+
+  `DiLifecycle`'s constructor now takes `({ env, modules }, ...libs)` instead of `(env, serverMode, ...libs)`. The
+  `serverMode` argument was unused — schedule registration takes its own — so it went with the change.
+
+- 5f53462: refactor(server): remove the `@CacheMethod` decorator
+
+  It never hit: it called the model cache as `get(key)` / `set(key, …)` while that cache takes `(topic, key)`, and
+  nothing in the framework or its libs used it. Cache an endpoint's answer with `{ cache: <ms> }`, or hold state in a
+  service with `memory(...)`.
+
+- 5f53462: feat(constant): `cascade: "removeWithAny"` lets a cascade name any model as its owner
+
+  A polymorphic `removeWith` required its `refPath` to name an `enumOf`, so the one shape an enum cannot express
+  had no cascade at all: a child whose owner may be _any_ model in the app — a reaction, a comment, an attachment
+  that later models opt into. Listing the candidates in the child's own enum inverts the direction `removeWith`
+  exists for, where the owner never learns its children exist.
+
+  That declaration is now available, opt-in and priced, as a third cascade action:
+
+  ```ts
+  parent: field(ID, { refPath: "parentType", cascade: "removeWithAny" }),
+  parentType: field(String),   // holds the owner's refName
+  ```
+
+  The widening is the action, not a flag beside it — `removeWithAny` names the whole decision in one value, so it
+  cannot be declared apart from the direction it widens.
+
+  Every model's removal then sweeps the child by the removed model's own refName. The lookup is cheap — the
+  declaration auto-creates the same `{ removedAt, typeKey, fk }` index it always did, so a removal that owns
+  nothing is one index probe returning zero rows, not a table scan. The real price is bulk: a query-level removal
+  of _any_ model would be a removal whose wildcard children were never looked for, so **one wildcard edge anywhere
+  turns every cascade in the app back to one document at a time**. The boot log says so in one `info` line naming
+  the edges, because "why does this app remove everything per document" must be answerable without reading a
+  model file. An app that declares none keeps the fast path exactly as before.
+
+  Refused while the class is built: `removeWithAny` on a `refPath` that already names an `enumOf` (the enum
+  names the candidates and indexes better — keep one), a `typeKey` that is not a `String` (the sweep matches a
+  refName against that column, and a column that cannot hold one silently finds nothing, which is
+  indistinguishable from never having declared the cascade), and `removeWithAny` on a field with no `refPath`.
+  A wildcard owner is also exempt from the mount check a monomorphic owner fails at boot — it names no module to
+  mount.
+
+- ccf2ae2: feat(csr): every history entry is a page of its own, the stack keeps three hidden entries, and a dev server can swap
+  route modules in place
+
+  The CSR frame rendered one container per route pattern. A push to the route on screen (`/item?id=1` → `/item?id=2`)
+  re-rendered the same page with new arguments: nothing sat under it for a swipe back, and going back handed the
+  first entry the second one's state.
+
+  - **A page container is a history entry.** A push mounts a new page over the old one, which waits under it with its
+    state. A replace within one route keeps the entry, so the page updates in place. A `cache` route is still one page
+    for the whole session.
+  - **The stack keeps the three nearest entries below the one a swipe back reveals,** mounted and hidden (their effects
+    stopped), so going back shows each with its state. Older entries are released and mount again on back, with
+    their scroll restored.
+  - `window.history` entries carry `{ akanEntryId }`, and popstate matches on it (falling back to the href), so two
+    entries with one address are told apart.
+  - Frame slot targets are per entry too: `<slot>Content-<key>`, with the key in `pathContext.pageKey`. `Navbar`,
+    `TopInset`, `TopLeftAction` and `BottomInset` portal into their own page's target, and a page container is
+    `#pageContainer-<key>` with `data-path`.
+  - **`usePageLocation()`** (`akanjs/webkit`) is this page's own `{ pathname, params, searchParams }`. `st.use.*` follows
+    the page on screen, so a page being prepared read the previous page's `?filter=`. `Data.ListContainer` and
+    `Data.Dashboard` now seed from their own page.
+  - **`replacePages(context)`** (`akanjs/webkit`) rebuilds the route table from new route modules while history,
+    mounted pages and stores keep going. It resolves `false` when the set of modules changed, which needs a reload.
+    The table itself moved to `CsrRouteTable`, which `bootCsr` now boots.
+  - Same-route navigation now replays the enter animation and resets the spring after back, since both follow the
+    entry rather than the pathname.
+
+- ccf2ae2: feat(csr): the page stack outlives a reload, popstate lands on any entry, and the page under the current one pauses
+  in the background
+
+  - **A reload keeps the stack.** The router writes its entries (`href` + `akanEntryId`) to `sessionStorage` on every
+    settled navigation and reads them back at boot when the entry the tab reopened on is the one it was on. That
+    covers a reload and a WebView whose content process died and reloaded. Only the current and previous entries
+    mount; the rest are dormant until visited. Before this, back after a reload changed the address and left the
+    page where it was.
+  - **Popstate lands on the entry it names,** not only a neighbour. A long-press back menu or `history.go(-n)` jumps
+    there. An entry the stack never saw (from before a reload that kept no stack, or a hash the browser pushed)
+    replaces the current one, in place when the route is the same.
+  - A popstate whose `hasUAVisualTransition` is set (Safari's own swipe back) skips the frame's back animation, so the
+    page does not slide away twice.
+  - While the document is hidden (the app in the background), the page under the current one pauses its effects as
+    well. `RouteState.isBackgrounded` carries it.
+  - On a macOS desktop shell, ⌘[, ⌘← and the mouse back button go back; a text field keeps ⌘←. WebView2 and the browser
+    already do this themselves. `desktopPlatform()` is exported from `akanjs/client/native` beside `nativePlatform()`.
+  - `useHistory(locations, { idx, dormant })` takes a restored stack, and `setHistoryJump(idx)` moves several entries
+    at once.
+
+- ccf2ae2: A desktop app can carry the app's own server: with `native: { desktop: { server: true } }` in `akan.config.ts`, or
+  `desktop.server` on one target, `akan build-desktop`, `akan start-desktop --release` and `akan publish-update` put the
+  backend `akan build` made into the app, so it works on one computer with no backend elsewhere.
+
+  - The build stages what the backend build wrote into `apps/<app>/.akan/desktop/server` — `main.js`, `server.js`, the
+    chunks, `akan.build.json`, `private/`, and any `.node`, `.wasm` or file asset a bundled package brought — without the
+    Dockerfile, the RSC worker, the console, `csr/` and `public/`. Its packages install there first
+    (`bun install --production --prefer-offline`, without the RSC renderer and the drivers of every database mode but
+    `single`), before `akan build` runs, so a computer that cannot reach the registry or find them in Bun's cache stops at
+    once. The app needs `single` in `database.modes`; the command says so before it builds.
+  - The backend is built for the command's own `--env`, not the workspace's `AKAN_PUBLIC_ENV` (the root `.env` usually
+    names `local`), so `server.js` holds that environment's `env.server.<env>.ts` and no other.
+  - What it carries is readable in plain text by anyone with the app: `private/` (each lib's too, under
+    `private/libs/<lib>`), that `env.server.<env>.ts` and the server env defaults of the libs it uses (each lib's
+    `env.server.testing.ts`). Keep deployment secrets out of them. It has no `public/`, and its working
+    folder is its data folder: read a runtime file from the app folder (`AKAN_APP_DIR`, else the folder of `Bun.main`),
+    never from `process.cwd()`.
+  - At launch the shell starts it as a child on its own Bun (`BUN_BE_BUN`, with `.env`, `bunfig.toml` and
+    auto-install off) on a loopback port, and hands the page its URL as `PUBLIC_AKAN_SERVER_URL`. The port of the last
+    session comes first and a fresh one is picked only when it is taken, so an address registered somewhere usually
+    stays valid from one launch to the next. The window waits for it up to 8 s.
+  - It runs API only, `operationMode` edge, database mode `single`, SSR, CSR and MCP off, bound to 127.0.0.1 with every
+    other Host refused. Any program on the computer can still call that port, so guard its endpoints as a network
+    server's. It keeps its SQLite data, files, logs and a per-install JWT secret in the app data folder's
+    `server/`, and a debug build, which has the release app's id, in its own `server-debug/`. On Windows that folder is
+    `%LOCALAPPDATA%\<app id>\server`, not the Roaming folder a profile copies on every sign-in and an organisation may
+    put on a file share, where SQLite's WAL does not work. Bun's transpiler cache goes to
+    `<server data>/runtime/transpiler-cache`.
+  - It trusts the operating system's CAs (`--use-system-ca`), as the page does, and gets the proxy and CA variables
+    (`HTTP(S)_PROXY`, `NO_PROXY`, `NODE_EXTRA_CA_CERTS`, `SSL_CERT_FILE`, `NODE_USE_SYSTEM_CA`) and the desktop session's
+    (`DISPLAY`, `WAYLAND_DISPLAY`, the session bus, the audio server, `XDG_*`, and Windows' `ProgramFiles`, `ComSpec`,
+    `PATHEXT` and the like), so a `bin` tool reaches what the page reaches and can open the screen, the audio server or a
+    shell.
+  - `AkanApp` takes `BUN_BE_BUN` off `process.env` at boot and gives it back only to a spawn of its own executable (the
+    ops snapshot, which also gets the server's runtime flags), so a `bin` tool built with `bun build --compile` starts as
+    itself rather than as the Bun CLI. A child started with `Bun.spawn` and no `env` still gets the environment the
+    process started with, so pass `env: process.env`.
+  - A crash restarts it on the same port (1 s doubling to 30 s; the fifth in a row gives up with an alert). A server that
+    exits before its first ready starts again 250 ms later, on the same port while it is still free, so one that cannot
+    boot gives up while the window still waits for it and the window opens at once with the alert. A server
+    that cannot start at all (an unreadable `jwt.secret`, a data folder that cannot be made) still hands the page a
+    loopback URL and shows the same alert once the window is up, so the page never falls back to the backend its bundle
+    was built for. A restart that throws counts as one failure. Its standard error, and its standard output until it is
+    ready, also go to `server/runtime/logs/server-output.log`, where a server that fails before it listens leaves its
+    reason.
+  - Quitting the app stops it within its 1 s shutdown budget, inside the launcher's 1.5 s grace, and a server still
+    there after the grace is killed. On macOS and Linux it leads its own process group, and whatever it started ends
+    with it: the launcher ends the group when the app quits, and when the app was killed or crashed — even while the
+    server was still starting — the server sees its parent gone and ends the group itself, SIGTERM first and SIGKILL a
+    second later. A process started `detached` leaves the group. On Windows the job object ends them all with the app.
+  - It runs in one process: a `main.ts` or an env asking for a gateway and replicas (`replica`, `solo: false`,
+    `AKAN_SOLO=false`, `AKAN_REPLICA`, `AKAN_COMMAND_TYPE=start`) does not boot in the app, and says which.
+  - A native plugin follows the server with `ctx.server.state` and `ctx.server.onState` (`starting`, `up`,
+    `restarting`, `gaveUp`, `stopped`), and a page with the `app` plugin's `serverState` event, so an app nobody attends
+    can act on a server that gave up (`app.relaunch()`, say).
+  - `XAUTHORITY`, `PULSE_COOKIE`, `PULSE_RUNTIME_PATH` and `XDG_DATA_DIRS` reach it too. A second launch that hands
+    over to the first starts none. The single-instance plugin comes with it.
+  - `akan start-desktop` without `--release`, for such a target, follows this checkout's dev server already answering on
+    the app's dev port, or starts `akan start` in the same command and opens the app once it serves; it asks for one
+    target before it starts one, needs `single` as a release does, and stops at once when that dev server fails to boot
+    (a replica's crash loop included) instead of waiting it out. Ctrl+C or closing the app stops the app, then the dev
+    server it started, then the local database, one after another, and exits 130.
+  - `akan start-desktop --release` of such a target shows the carried server's lines at the level its logger wrote them.
+  - `AkanAppConfig.getProductionEnv()` is the env the image runs with; the Dockerfile's `ENV` lines come from it (same
+    keys and order, without the two blank lines the template used to leave).
+
+- ccf2ae2: A desktop app reads and sets the system volume and mute, and hears when they change
+
+  The `volume` native plugin (`native.plugins: ["volume"]` in `akan.config.ts`, `volume` from `akanjs/client/native`)
+  has `getVolume()`, `setVolume({ level })` and `setMuted({ muted })`, each answering `{ level, muted, settable }`, and
+  a `change` event whoever moved the volume. macOS drives the default output device through CoreAudio (an HDMI or
+  DisplayPort output takes no volume from the computer and answers `level: null`), Windows the default render endpoint
+  the taskbar slider moves, and Linux the default sink of PulseAudio or PipeWire through `pactl`, in any desktop
+  language, hearing changes again after the audio server restarts. A phone or the web answers `UNSUPPORTED`, and a Linux
+  box without an audio server `NOT_FOUND`.
+
+- ccf2ae2: `akan build-desktop --arch arm64|x64` picks the CPU a Windows or Linux desktop app runs on
+
+  A desktop app is still built on its own OS, now for either of its CPUs: the Rust library is built for that target,
+  the executable with `bun build --compile --target=bun-<os>-<arch>`, the carried server installs with
+  `bun install --cpu=<arch>` so its addons' prebuilt binaries are that CPU's, and each `bin` entry is that platform's.
+  The setup program and the AppImage name the CPU they hold. A macOS app is Apple silicon only: Intel Macs are not a
+  target, so `--arch x64` on macOS is refused.
+
+- ccf2ae2: A desktop build stops on a server addon that would not load on a user's computer
+
+  Before it copies the server, a desktop build reads every `.node` file in it by package. A package with no binary for the
+  target OS and CPU, a binary that links a library by an absolute path outside the system (a ROS install under `/opt`,
+  Homebrew's prefix) or names such an rpath, and a package with a `binding.gyp` that its install never compiled (Bun runs
+  no install script of an untrusted package: add it to `trustedDependencies`) are listed and stop the build, instead of
+  failing at the first `require` on the user's computer. An addon node-gyp compiled on the build machine only warns.
+
+- ccf2ae2: `bin` in `akan.config.ts` puts executables in a desktop app, and the build says what the image installs that the app does not
+
+  A desktop app ran whatever `ffmpeg` the user's computer had on its PATH, if any, and a Finder-launched app sees only
+  `/usr/bin:/bin:/usr/sbin:/sbin`. `bin` names an executable and, per platform (`darwin-arm64`, `win32-x64`, …), where it
+  comes from: a download with its `sha256` (an archive takes `file`, the executable inside it) or a path next to the
+  declaring `akan.config.ts`. `build-desktop` and `start-desktop` fetch the file for the computer they build on, check it,
+  and carry it in the app's `bin/`, which the app puts first on its PATH: the carried server's `spawn("ffmpeg")` runs
+  that file, and a native plugin finds it in `ctx.binDir`. A download is kept as `download` plus its URL's extension
+  (`.zip`, `.tar.xz`, `.exe`, …), never under a name the URL spells. Bun's own `spawn` without `env` reads the environment the app
+  started with, so a plugin passes `env: process.env` to run one by name. A lib's entries reach the apps that depend on
+  it, and an app's own entry of the same name wins. macOS builds sign every executable the app carries, in `bin/` and
+  in the carried server, found by its Mach-O header rather than its name, so one a package ships without an extension
+  passes Developer ID signing and notarization too. The image does not read `bin`: it still installs through `docker`.
+
+  `build-desktop` of a target that carries its server now warns when the image runs `docker` steps (or the app writes
+  its own Dockerfile) and the app carries no `bin`, since the carried server runs none of those steps.
+
+- ccf2ae2: `desktop.server: { omit }` carries the desktop app's server without packages only the image needs
+
+  `native: { desktop: { server: { omit: ["rclnodejs"] } } }` carries the server as `server: true` does, minus the named
+  packages and whatever only they pull in: an addon tied to the image's system (a ROS install), or code only a process
+  the desktop app never starts loads. The image's `package.json` keeps them, `externalLibs` included; the desktop
+  server's `package.json`, its `bun install --production` and the addon check do not see them. A package another
+  dependency still installs stops the build, naming the dependents, and the targets that carry one build's server must
+  omit the same packages.
+
+- ccf2ae2: A desktop app's server reads the files the user picks, with no copy and no path in the page
+
+  `filePicker.pickFiles({ forServer: true })` (also `pickDirectory` and `saveFile`; `filePicker` is now exported from
+  `akanjs/client/native`) copies nothing on the desktop, whatever the file's size: its FileRefs serve the originals,
+  and each result carries a grant. The server exchanges the grant with `NativeFile.resolve(grant, "read" | "write" |
+"folder")` from `akanjs/server`, or `NativeFile.resolveIn(folderGrant, relative)`. The carried server asks the shell
+  that showed the dialog over its IPC channel, so it reaches what the user picked and nothing else; a debug build
+  that carries its server does the same. Behind a dev build without one, `akan start` checks the grant's signature
+  instead, in `operationMode` local only. A phone or the web refuses `forServer`.
+
+  `resolveIn` judges a relative path by where it lands once the links on it are resolved — through its nearest existing
+  folder when the file is about to be written — so a link inside the granted folder cannot take it elsewhere, and a
+  dangling link is refused. A name that starts with two dots (`..cache/x`) is inside the folder, not above it.
+
+- 5f53462: fix(signal): an endpoint's `cache` is looked up after its guards, not ahead of the account
+
+  The `Cache` middleware sat ahead of every middleware a lib registers, `AccountMiddleware` among them, so on a hit it
+  ran the guards before anyone had resolved the caller — a guard reading the account saw none and refused a signed-in
+  caller the second time they asked. The lookup is now a step of the call itself: guards, then internal arguments,
+  then the cache, then the handler, inside the `timeout` deadline as before.
+
+  `Cache` is no longer exported from `akanjs/signal` and is no longer registered as a middleware, and
+  `SignalContext.checkGuards()` — which existed only for it — is gone. `{ cache: <ms> }` on an endpoint is unchanged.
+
+- ccf2ae2: Every builtin native plugin's page API is `akanjs/client/native/<plugin id>`
+
+  `akanjs/client/native` carries the plugins every page uses, and the rest — `window`, `screen`, `global-shortcut`,
+  `keep-awake`, `autostart`, `single-instance`, `screen-orientation`, `clipboard`, `network` and every other builtin — had
+  no path an app outside this repository could import, since the runtime's own package ships only inside akanjs. Each is
+  now `akanjs/client/native/<id>`, for example `import { appWindow } from "akanjs/client/native/window"`.
+
+- 2d8de1c: fix(service): `ServiceModel.getFilterServiceMethods` takes the filter's `FilterInfo` and builds what the runtime builds
+
+  **Breaking for a direct caller.** The static took a bare query function and guessed the trailing query option by its
+  shape, so it disagreed with the filter methods every booted model and service actually carries: `{ sample: 2 }` was
+  dropped instead of passed on, `{ sort: null, limit: null }` became a filter argument, omitted arguments were not
+  filled, and a filter whose query uses its `q` helper threw because no helper was passed.
+
+  It now takes the `FilterInfo` — `ServiceModel.getFilterServiceMethods(key, getFilterInfoByKey(Filter, key))` — and
+  reads arguments and options exactly as the runtime does, because the runtime now builds each model's and service's
+  filter methods through this same static. There is one implementation left. The returned table's type is unchanged.
+
+- ccf2ae2: `akan build-desktop --installer true` on Linux adds an AppImage
+
+  The app folder gains an `AppRun`, a `.desktop` entry naming the app's icon and its `deepLinks.schemes`, and a 256px icon,
+  and is packed with `mksquashfs` behind the AppImage type 2 runtime, pinned to a dated release and checked by its
+  digest. The AppImage needs only the WebKitGTK 4.1 and GTK 3 the folder already needs, and runs without FUSE through
+  `--appimage-extract-and-run`. It runs from a read-only image, so the updates plugin cannot replace it: an app with
+  `updates` is warned to publish a new AppImage for each release.
+
+- 5f53462: feat(document): a model loader remembers nothing unless it declares `cache`
+
+  `loader.byField` / `byArrayField` / `byQuery` built their `DataLoader` with the default `cache: true`, and a model's
+  loaders live as long as the process — so a key read once was answered from memory forever, however the document
+  changed. They now take an option after the default query, `{ cache }`: `false` by default, a number of milliseconds
+  to keep each key, or `true` for the life of the process. A failed load is never kept.
+
+  `DataLoader` itself now defaults to `cache: false` and accepts the same `boolean | number`.
+
+- ccf2ae2: A macOS desktop release can be downloaded: Developer ID signing, the hardened runtime, notarization and a dmg
+
+  `akan build-desktop` signs with a Developer ID when `AKAN_NATIVE_MACOS_IDENTITY` names one in a keychain, or
+  `AKAN_NATIVE_MACOS_CERTIFICATE` + `_CERTIFICATE_PASSWORD` a `.p12` (imported into a keychain made for the build and
+  deleted after it, for CI). Every Mach-O file is signed inside out with the hardened runtime and a secure timestamp, and
+  the executable gets Bun's JIT entitlements plus the camera's or microphone's when a usage text asks for them;
+  `native.desktop.entitlements` adds the app's own. With `AKAN_NATIVE_MACOS_NOTARY_KEY` + `_KEY_ID` + `_ISSUER` (an App
+  Store Connect API key) or `_NOTARY_PROFILE`, the app is notarized, stapled and checked with `spctl`.
+  `--installer true` on macOS adds a dmg with an Applications link, signed, notarized and stapled the same way.
+  `publish-update` signs a macOS release with the same identity, since the updater checks the installed app's signature.
+  A release that is not signed with a Developer ID, or not notarized, warns that Gatekeeper blocks a downloaded copy.
+
+- 69f7178: feat(mcp)!: expose every endpoint its guards admit, and mount `/mcp` by default
+
+  MCP exposure was opt-in per endpoint, per slice and per CRUD verb. It is now derived from the guards an endpoint
+  already declares, and `/mcp` is mounted unless `AKAN_MCP=false` says otherwise.
+
+  The old model asked the same question twice. `guards` is the authorization decision, and `McpDispatcher`
+  re-evaluates the account-scoped ones on every `tools/list` — so a second per-endpoint switch said nothing the
+  guards did not, while guaranteeing that every endpoint added later was invisible to agents until somebody
+  remembered to flag it. The framework's own OpenAPI document has no per-endpoint opt-in either: one env flag
+  publishes the whole HTTP surface, which is the same enumeration.
+
+  **The rule, applied globally with no way to configure it per endpoint or per app:**
+
+  - a real guard publishes
+  - **no `guards` at all is refused** — nobody decided who may reach it, and a catalogue entry is where that omission
+    would stop being invisible
+  - **a mutation whose only guard is `Public` is refused**, unchanged: `[Public]` is having none, spelled out
+  - an explicit `guards: [Public]` on a _read_ publishes. It is a decision someone wrote, the data is already served
+    anonymously over HTTP and in the OpenAPI document, and refusing it would break a public docs or search endpoint
+    while hiding nothing
+
+  Every structural refusal is unchanged: `pubsub`/`message`, an `Any` or `Upload` return, a file upload, a required
+  `Any` argument, and the three a prompt's flat string map cannot carry.
+
+  **Removed:** `mcp` on a signal option, on a slice option and on the signal's CRUD verb map — `McpOption` and
+  `McpSliceOption` are gone, and `mcp: { expose: true }` no longer typechecks. Delete it; nothing replaces it. The
+  `readOnly` / `destructive` / `idempotent` hints are now derived from the endpoint type and key rather than
+  overridable, which costs nothing a client trusts. `resource` is gone the same way: the generated reads are
+  addressable, a custom endpoint is not, and neither was ever configurable in practice.
+
+  `McpDocument.unguarded` is gone, subsumed by the refusal that now covers it. The `akan.mcp.missing-description`
+  and `akan.mcp.unguarded-exposure` quality-scan rules are gone with `McpScanner`: both found the exposure by
+  matching an `mcp: { expose: true }` literal in source, which no longer exists. The boot log already answered both
+  from the resolved catalogue, and it is now the only place that can.
+
+  **`GuardCls.scope` is required.** Unmarked meant `resource`, which is never evaluated for a listing — so with
+  exposure following the guards, one forgotten marker would list its endpoint's name and argument schema to every
+  caller and refuse only the call. There is no safe guess, so the author states it: `"account"` for a verdict that
+  reads the caller and nothing about the call, `"resource"` for one that needs the call's arguments.
+
+  **Upgrading:** delete every `mcp:` option from your signal files, and add `static scope: GuardScope = "account" |
+"resource"` to every guard class. Then read the boot log — `MCP catalogue: tools=…` followed by one line per
+  refusal — because with no opt-in to be missing, that log is the only explanation for a tool that is not there.
+  An endpoint you want an agent to reach needs real guards, which it needed anyway.
+
+  **Settings moved off `new AkanApp(...)`.** `AkanAppOptions.mcp` is gone; the server settings live on the option
+  chain in `lib/option.ts` — `option.setMcp({ enabled, readOnly, path, version, instructions, allowedOrigins,
+pageSize, language, auth })`. The old field is a type error on upgrade, which is the signal to move it.
+
+- 5f53462: fix(service): `memory()` is scoped to its owner and does what its options say
+
+  - A non-`Map` memory was keyed by its property name alone, so two services that each declared `token` shared one
+    value. It is now stored under the owner's refName, like a `Map` memory already was. Values written under the old
+    key are not read back.
+  - `get` / `set` were type-checked and then ignored at runtime. They now run: `get` turns the stored value (a `Map`'s
+    entry value) into what the code reads, and `set` is its inverse.
+  - A declared `default` is what a missing value reads as on Redis too; Redis answers a missing key with `null`, which
+    used to skip it.
+  - `local: true` on a `Map` gives a `Map`, not `null`.
+  - The declaration's `expireAt` was one fixed time computed when the class loaded. It is replaced by `ttl` in
+    milliseconds, applied to each write that names no `expireAt` of its own.
+  - `RedisCache` expires a hash field on its own. `PEXPIREAT` on the whole hash expired every entry with the last one
+    written; each field's expiry now lives in a sorted set beside the hash (portable to Redis before 7.4), expired
+    fields read as missing, and they are dropped on every write and every listing.
+
+- 3ebd8e1: feat(document): `updateById` / `removeById` on the model facade
+
+  The facade could already read one document by id (`findById`, `pickById`) but writing one meant spelling the id back
+  out as a query: `Model.updateOne({ id }, { … })`. It now carries the id-scoped pair directly.
+
+  ```ts
+  await this.Order.updateById(orderId, { status: "archived" });
+  await this.Order.updateById(
+    orderId,
+    { status: "archived" },
+    { upsert: true }
+  );
+  await this.Order.removeById(orderId);
+  ```
+
+  **These are the query-level writes narrowed to one id, not the document path.** They compile to the same single
+  atomic UPDATE as `updateOne` / `removeOne` — `removedAt IS NULL` ANDed in, counts returned rather than a document,
+  and **no hooks**, so no `_pre`/`_postUpdate`, no `_postRemove`, and no cascade. A model whose removal carries a side
+  effect or a `removeRef` / `removeWith` edge still goes through the service's `remove<Model>(id)`.
+
+  `updateById` takes the same trailing options as `updateOne`, so `{ upsert: true }` inserts with that id when nothing
+  matches. An `undefined` id is rejected by the query compiler rather than widening the write.
+
+- 326da07: fix(document): give a Model's `insight<Query>` a real return type, and declare `db.<Model>Insight`
+
+  Declaring a filter query generates `count<Query>` and `insight<Query>` on both the Model and the Service. On the
+  Service the insight was typed; on the Model it came back as `unknown`, because `into()` passed `unknown` where
+  `QueryMethodPart` expects the insight type — so `await this.adminModel.insightByAccountId(id)` had no fields and
+  any use of the result needed a cast.
+
+  `into()` now threads the insight through from the constant model it already receives, typed as the document shape
+  because `insight()` accumulates into a plain record rather than a hydrated document.
+
+  The generated `lib/db.ts` also declares an insight document class per model and exports the type, mirroring what it
+  already did for `Input`:
+
+  ```ts
+  class AdminInsight extends by(cnst.AdminInsight) {}
+  export type { AdminInsight };
+  ```
+
+  `DatabaseRegistry.buildModel` takes that class instead of the constant insight, so `db.<Model>Insight` annotates
+  the result on both sides:
+
+  ```ts
+  const insight: db.AdminInsight = await this.adminModel.insightByAccountId(
+    accountId
+  );
+  const count: number = await this.countByAccountId(accountId);
+  ```
+
+  Run `akan sync <app-or-lib>` to regenerate `lib/db.ts`. A hand-written `DatabaseRegistry.buildModel` call — test
+  fixtures, mostly — now needs a `by()`-wrapped insight; wrap it after the `ConstantRegistry.buildModel` call, since
+  `by()` resolves the refName from the registry.
+
+- ccf2ae2: A native platform section takes its own `indexPath`
+
+  `ios.indexPath`, `android.indexPath` and `desktop.indexPath` win over the section's (or the target's) `indexPath` on
+  that platform, so one target opens the phones on `/mobile` and the desktop app on `/` with no `--target`. It moves
+  both the dev build's first page and the `indexPath` a release bundle carries.
+
+- ccf2ae2: Mobile apps build and run on `@akanjs/native` instead of Capacitor.
+
+  The runtime ships inside `akanjs` (vendored, not published on its own), so an app installs nothing extra for it.
+  It generates each target's native projects under `.akan/native/<target>/build/<platform>` and loads the web
+  root it assembles in `.akan/native/<target>/web` from the production CSR build — nothing native is committed.
+
+  - **Configuration (`akan.config.ts`).** A `native` section, and each of its `targets`, takes `appName`, `appId`,
+    `fileName`, `version`, `buildNum`, `basePath`, `indexPath`, `icon`, `splash`, `permissions`, `plugins` (builtin
+    ids such as `iap`), `deepLinks`, `ios.{infoPlist, entitlements, files}` and
+    `android.{manifest, application, activity, googleServices, files}`; a target overrides the section field by field.
+    `files` maps where a file lands (a path in the iOS app bundle, `res/<type>/<file>` or `assets/<path>` on Android)
+    to its source. A Capacitor-era key fails, naming the keys the section takes.
+  - **Plugins declare, they do not edit projects.** `AkanPlugin.native` names the permission it serves and what the
+    target then needs: native plugins, usage texts, plist and entitlement entries, Android permissions and features.
+    It replaces `capacitor.configureNative`, `editIosAppDelegate` and `runtimePackages`. A release build names each
+    plugin's default permissions as its capabilities.
+  - **Commands.** `build-`, `start-` and `release-ios|android` go through the runtime. `start-*` follows `akan start`
+    (it refuses when no dev server answers), runs one target at a time and takes `--device` (and `--team`/`-T` on
+    iOS); `--release` runs a release build of its own bundle. `release-ios` takes `--team` and `--ad-hoc`;
+    `release-android` builds an `.aab` by default (`--assemble-type apk` for an `.apk`), signed from
+    `MYAPP_RELEASE_STORE_FILE`, `MYAPP_RELEASE_STORE_PASSWORD` and `MYAPP_RELEASE_KEY_ALIAS` (plus
+    `MYAPP_RELEASE_KEY_PASSWORD` when the key has its own), which it checks before anything builds. `build-*` take
+    `--debug`, and
+    `akan doctor --ios` adds the native toolchain checks.
+  - **Pages.** `akanjs/client/native` wraps the native plugins a page uses, and `isNativeApp()` is true only inside
+    a shell. `Device` reads the runtime's device plugin and safe-area variables, `storage` the shell's preferences,
+    and the new `secretStorage` keeps the JWT and refresh tokens in the OS credential store (cleared on the first
+    launch after a reinstall). `useCamera` is one hook — the native sheet asks camera or library and answers an
+    upright JPEG data URL — and `useGeoLocation` answers the flat native position. A native release bundle opened at
+    `/` starts on its target's home, and a target opened in a browser is a web device.
+
+  **Breaking, with a migration path.**
+
+  - Delete the app's `ios/`, `android/`, `mobile/` folders and `capacitor.config.*`: `akan sync`, `akan doctor` and
+    `akan quality scan` now refuse them in an app root and say why.
+  - Move Capacitor settings to the keys above; `google-services.json` goes to `native.android.googleServices`, and
+    `GoogleService-Info.plist` is no longer needed.
+  - Removed: `-g/--regenerate`, `--open`, `--allow-provisioning-updates`, `configure-app`, `codepush`,
+    `release-source`, `capacitor.base.config`, `useContact`, `useCodepush`, the native path of `useSpeech`, and every
+    `@capacitor/*`, `@capacitor-community/*`, `@capgo/*`, `capacitor-plugin-safe-area`, `cordova-plugin-purchase`
+    and `@trapezedev/project` dependency — `akanjs` no longer lists them as peers.
+  - `baseSt` drops `deviceToken`; the notification store owns it.
+
+- ccf2ae2: `native` in `akan.config.ts` replaces `mobile`, with each platform's settings in a section of its own
+
+  **Breaking:** `mobile` is gone with no fallback; a config that still has it, or a key that moved, stops and names the
+  new place. `native` and each of `native.targets` take the same fields, a target merging objects key by key and
+  replacing lists and every other value, and without `targets` the app has one target, `default`. The next `akan start`
+  removes the old `.akan/mobile`.
+
+  The agent guide `akan agent install` writes now covers native apps: the `native` section, the `start-*` / `build-*`
+  commands and updates, with the full contract in the `runtimeRule` guideline.
+
+  | Before                                                                             | Now                                                                                                                                   |
+  | ---------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
+  | `mobile`                                                                           | `native`                                                                                                                              |
+  | `mobile.native.X`, `targets.<t>.native.X` (`plugins`, `ios`, `android`, `desktop`) | `native.X`, `native.targets.<t>.X`                                                                                                    |
+  | `native.push.android`                                                              | `android.push`                                                                                                                        |
+  | `native.privacy`                                                                   | `ios.privacy`                                                                                                                         |
+  | `assets.icon`, `assets.splash`                                                     | `icon`, `splash`                                                                                                                      |
+  | `files["ios/<path>"]`                                                              | `ios.files["<path>"]`                                                                                                                 |
+  | `files["android/res/…"]`, `files["android/assets/…"]`                              | `android.files["res/…"]`, `android.files["assets/…"]`                                                                                 |
+  | `deepLinks.ios.teamId`                                                             | `ios.teamId`                                                                                                                          |
+  | `deepLinks.android.sha256CertFingerprints`                                         | `android.sha256CertFingerprints`                                                                                                      |
+  | `indexPath` on a target only                                                       | on `native` too, inherited by every target                                                                                            |
+  | root and target `plugins` joined, Android XML lists appended                       | the target's list replaces                                                                                                            |
+  | `.akan/mobile/<target>/native/<platform>`                                          | `.akan/native/<target>/build/<platform>`                                                                                              |
+  | `.akan/mobile/<target>/{dev,updates,web,bin}`                                      | `.akan/native/<target>/{dev,updates,web,bin}`                                                                                         |
+  | `AkanMobileConfig`, `AkanMobileTargetConfig`                                       | `AkanNativeAppConfig` (resolved: `AkanNativeAppResult`), `AkanNativeTarget`; `AkanNativeSettings` is what `native` and a target share |
+  | `AkanMobileUpdatesConfig`, `AkanMobileAppId`, `AkanMobileTargetDeepLinks`          | `AkanNativeUpdatesConfig`, `AkanNativeAppId`, `AkanNativeDeepLinks`                                                                   |
+  | `AkanMobileNativeConfig`                                                           | `AkanNativeIosConfig`, `AkanNativeAndroidConfig`, `AkanNativeDesktopConfig`                                                           |
+  | `AkanMobileTargetAssets`, `AkanMobileTargetFiles`                                  | removed: `icon`, `splash` and each platform's `files`                                                                                 |
+  | `MobilePermission`, `MobileEnv`, `AppConfigResult.mobile`                          | `NativePermission`, `NativeEnv`, `AppConfigResult.native`                                                                             |
+
+- ccf2ae2: feat(csr): only the current page publishes to the in-page agent, and a page can bind work to being looked at
+
+  A CSR page kept under the current one for a swipe back is mounted and live, so its `st.tool`s, resources, guides and
+  `st.use` keys used to sit in the agent's surface beside the current page's. The agent was offered a lever the user
+  could not see, and two pages declaring one name clashed.
+
+  - **`<AgentActivity active>`** (`use-agentic`) publishes what is registered below it only while `active`.
+    Registrations stay in place, so turning it back on re-publishes without a remount. A parked registration shadows
+    nothing and never clashes with a published one. Nested activities close with their parent. A registry kept outside
+    the surface reads the same gate through `useAgentGate()`. Under it are `AgenticSurface.gate(active, parent?)` and
+    `AgenticSurface.gated(gate)`, and the registration methods take the gate as an optional trailing argument.
+  - Every CSR page container renders one, open only for the current page. The store's live keys follow it, so
+    `readState` answers for the screen the user sees.
+  - The agent's screen targeting (`highlight`, a zone's `readScreen`, the cursor) skips anything under an `inert`,
+    `aria-hidden` or `hidden` ancestor, not only elements that carry one themselves.
+  - **`usePageFocusEffect(effect, deps)`** (`akanjs/webkit`) runs `effect` while the user is on the page and cleans it up
+    when they leave: after the entrance settles, and as soon as the page starts to go. It is for a camera, a poll or a
+    key binding that a live page under the current one must not keep running. **`usePageActivity()`** answers
+    `"current" | "prev" | "pending" | "hidden"`, and `current` outside a CSR stack.
+
+- ccf2ae2: Push notifications go to each device token over the service that issued it — APNs or FCM — and a tap opens its
+  page from the app's first frame.
+
+  - `akanjs/client/native` exports `push`: permission, `register()` answering `{ token, provider, platform }`,
+    `unregister`, foreground presentation, and the `token`, `received` and `action` events. A tap that launched the
+    app is held until the first listener, and `akanjs` routes it from boot: an `action` whose `data.url` is an app
+    path opens it, and a foreground notification shows as a banner.
+  - `akanjs/client/capacitor` is gone.
+
+  Libraries synced into a workspace:
+
+  - `libs/util`: `usePushNotification` takes the native `push` plugin in a shell and Firebase on the web, and
+    answers a `PushToken` of `{ token, platform, provider, deviceId }`, where `deviceId` is a random id kept per
+    installation (`getPushDeviceId()`). `PushNotificationServer` reads `pushNoti.firebase` and `pushNoti.apns`
+    (`teamId`, `keyId`, the `.p8` key's `privateKey`, `bundleId`, optional `environment`) and sends APNs itself
+    over HTTP/2 with an ES256 provider token; a token APNs or FCM reports gone is dropped. Topics are gone.
+  - `libs/shared`: `notiInfo.deviceTokens` holds one `DeviceToken` per installation (token, provider, platform,
+    `deviceId`, `updatedAt`), replaced on re-registration and removed on sign-out (`signoutUser(pushDeviceId)`).
+    An `all` notification fans out to active users in pages of 500 and honours each one's notification settings,
+    which the old topic send did not.
+
+  **Breaking.** Stored plain-string tokens are dropped on read and each device registers again on its next visit.
+  `addNotiDeviceTokenOfSelf` takes a `DeviceToken`, `subscribeToMegaphone` is gone, and a server sending to iOS
+  needs `pushNoti.apns`.
+
+- ccf2ae2: chore(deps): React 19.3 — `react`, `react-dom` and `react-server-dom-webpack` 19.3.0, `react-refresh` 0.19,
+  `scheduler` 0.28
+
+  19.3.0 ships the `pingSuspendedRoot` fix that `patches/react-dom@19.2.7.patch` carried, so the patch and the workspace
+  template's copy are gone. The vendor shims name 19.3's new exports: `ViewTransition` and `addTransitionType` from
+  `react`, `browser` from `react-dom`, and the whole `react-refresh/runtime` surface.
+
+  **For an existing workspace:** `akanjs` depends on `react` and `react-dom` 19.3.0 exactly, so move any workspace pin to
+  19.3.0 in the same install — two React copies break every hook. Drop `patchedDependencies["react-dom@19.2.7"]` from the
+  root `package.json` and delete `patches/react-dom@19.2.7.patch`.
+
+- 326da07: feat(document): query-level `remove`/`update` per filter, and rename `deleteMany` to `removeMany`
+
+  The model facade's `deleteMany(query)` and the store's `deleteManyByQuery(query)` never deleted anything: both
+  stamp `removedAt` in one atomic UPDATE, exactly like `remove(id)` does. The framework has no hard delete for a
+  model table at all — `DELETE FROM` appears only against the cache, `_akan_meta`, and the search mirror. They are
+  now `removeMany` and `removeManyByQuery`, so the name matches the write, and `delete` stays free to mean a real
+  `DELETE` if one is ever added. Rename the call sites; the behaviour is unchanged.
+
+  Filters now generate four query-level writes alongside the ten readers, on both the service and the model:
+
+  ```ts
+  await this.removeInCategory("news"); // every match
+  await this.removeOneInCategory("news"); // the newest match (createdAt desc)
+  await this.updateInCategory("news").set({ status: "archived" }); // every match
+  await this.updateOneInCategory("news").set({ status: "archived" });
+  ```
+
+  **The update pair is a chain.** The patch cannot trail the filter args — those may be optional, and no tuple type
+  puts a required element after an optional one — and leading it reads backwards. So it lands on a terminal `.set()`,
+  which mirrors the `UPDATE … SET …` the call compiles to. Building the chain runs no query; only `.set()` does.
+
+  These are query-level writes: one atomic UPDATE that **fires no hooks**, so no `_pre`/`_postRemove` and no cascade
+  run. Reach for them on a model that carries no removal side effect, and remove documents one at a time otherwise.
+  `removeOne`/`updateOne` hit the **newest** match: their subquery is ordered `createdAt` descending, the caller cannot
+  change that, and the result carries counts rather than an id. They are for "there is at most one of these", not for
+  claiming the next item off a queue.
+
+  Because filter methods are assigned after CRUD, a filter keyed after its own model would have silently replaced
+  the single-document `remove<Model>`/`update<Model>` with a hookless query-level one. That now throws while the
+  service is being resolved instead. Services also gained `__removeMany`, `__removeOne`, `__updateMany`, and
+  `__updateOne`, and the store gained `removeOneByQuery`.
+
+  On the **model facade**, `countDocuments(query)` is now `count(query)`; the old name still works and is marked
+  `@deprecated`. Its writes keep `Many`/`One` spelled out — `updateOne` / `updateMany` / `removeOne` / `removeMany` —
+  rather than following the short `find`/`findOne` pair: a bare `Model.update`/`Model.remove` would read like the
+  document-path `update(id)` and `doc.remove()` while quietly hitting every match.
+
+- 5f53462: feat(route): a route's head is JSX only, and analytics is the app's own component
+
+  **`.metadata()` is gone, along with the `metadata` / `generateMetadata` exports and the `AkanMetadata` type.** A route
+  had two ways to say the same thing — an object of `title` / `description` / `openGraph` / `twitter` / `alternates`
+  that the server translated into tags, and `.head()` taking the tags themselves — and could use only one of them per
+  module. Every app in the workspace already wrote `.head(<>…</>)`. Rewrite an object as the tags it produced:
+
+  ```tsx
+  .head(({ projectId }) => (
+    <>
+      <title>{`Project ${projectId}`}</title>
+      <meta name="description" content="Project workspace" />
+      <meta property="og:image" content="/og/project.png" />
+      <link rel="canonical" href="https://example.com/project" />
+    </>
+  ))
+  ```
+
+  A legacy route that still exports `metadata` or `generateMetadata` now fails the load as an unsupported export,
+  the same way any other stray export does. The hreflang alternates Akan adds per locale are unchanged; the only thing
+  that could suppress them was an `alternates.languages` object, so leave them out of the JSX.
+
+  **`.gaTrackingId()` and the `gaTrackingId` export / `System.Provider` prop are gone.** Which tags load, in which
+  environment and behind which consent banner are the app's decisions, and the framework's built-in `Gtag` made none
+  of them. Render a `"use client"` component that loads gtag.js from the root layout's `.render()` instead — the
+  routing guide has one. GA4's Enhanced measurement already counts the router's `history.pushState` navigations, so
+  the component only loads the tag.
+
+  The head-snapshot path used by the experimental partial commit (`AKAN_PUBLIC_RSC_PARTIAL_COMMIT=1` with
+  `rscPatchHeadSafe`) was fed only by the metadata object, so it now always falls back to a full navigation.
+
+- ccf2ae2: `AKAN_LISTEN_HOST` binds the server to one address instead of every interface, and `AKAN_ALLOWED_HOSTS`
+  (comma-separated `host:port`) refuses any request, socket upgrade and preflight included, whose `Host` header it
+  does not list, with 403. A page on a name that re-resolves to 127.0.0.1 (DNS rebinding) is same-origin with a
+  loopback server, and `CrossSiteGuard` reads `Origin` equal to `Host` as same-site; only the `Host` header, never
+  `x-forwarded-host`, still names that page's domain. Both apply to a solo server and to the gateway; a server behind
+  the gateway skips the check, since the Host it sees is the gateway's hop.
+
+  Both are meant for a server only its own computer calls, as the server a desktop app carries is. A server that renders
+  pages calls itself at `localhost:<PORT>` (SSR and its RSC worker), so a list that names only the public host refuses
+  those calls with 403: put `localhost:<PORT>` in `AKAN_ALLOWED_HOSTS` too, and keep `AKAN_LISTEN_HOST` on an address
+  that `localhost` reaches.
+
+  A CSR bundle reads `PUBLIC_AKAN_SERVER_URL` from the native shell's launch env (`__AKAN_NATIVE__.env`) ahead of the
+  built-in `AKAN_PUBLIC_SERVER_URL`, for a server whose port is known only when the app starts.
+
+- 69f7178: feat(signal): serve any app's signals to agents as an MCP server on `POST /mcp`
+
+  An endpoint already declares everything an agent tool needs — a name, typed arguments, a return model, guards, and
+  a dictionary entry saying what it is for in two languages. What was missing was the wire. Every `*.signal.ts` can
+  now be published as Model Context Protocol tools, resources, and prompts, with no per-endpoint adapter code.
+
+  Turn it on in an app's `main.ts` — `new AkanApp("./server", { mcp: { enabled: true } })`. Every field also has an
+  env spelling (`AKAN_MCP`, `AKAN_MCP_READONLY`, `AKAN_MCP_PATH`, `AKAN_MCP_INSTRUCTIONS`, `AKAN_MCP_ALLOWED_ORIGINS`,
+  `AKAN_MCP_LANGUAGE`, `AKAN_MCP_AUTH_SERVERS`, `AKAN_MCP_SCOPES`, `AKAN_MCP_RESOURCE`, …) because the gateway reaches
+  a child process through its environment; a value written in code wins over the env of the same name.
+
+  **Nothing is exposed until it says so, slices included.** A guard stops a call, but the _name and argument schema_
+  of something like `getAccessTokenByAdmin` are themselves worth hiding, and `tools/list` publishes both. Opt in per
+  endpoint with `query(cnst.X, { guards: [...], mcp: { expose: true } })`, per slice with `init({ guards: [...],
+mcp: { expose: true } })`, and per generated CRUD verb with `slice(srv.x, { guards: {…}, mcp: { get: true } }, …)`
+  — one flag per verb, never a blanket `true`.
+
+  **A tool runs the endpoint's own pipeline, not the service behind it.** `McpExecutionContext` extends the HTTP
+  one, so guards, middleware, internal args, `hidden`/`secret` masking, and serialization all still run: an agent
+  tool is exactly as safe as the endpoint it mirrors, and cannot be more permissive by construction.
+
+  **Refusals are fail-closed and survive opting in** — `pubsub` and `message` (their internal args read a socket an
+  MCP request does not have), an `Any` or `Upload` return, a file upload, a mutation with no real guards, and a
+  required `Any` argument. Each is named in the boot log beside `MCP catalogue: tools=… prompts=…`, along with every
+  entry published with no description and every one published with no guards at all. `akan quality scan` covers the
+  two shapes a source scanner can see, `akan.mcp.missing-description` and `akan.mcp.unguarded-exposure`, and the API
+  explorer badges each endpoint `MCP` / `MCP refused` from the same shared predicate.
+
+  **Three protocol revisions from one stateless handler**: the modern `2026-07-28` and the legacy `2025-11-25` /
+  `2025-06-18`. Supporting the legacy pair turned out to cost almost nothing once it was clear no session store was
+  needed, and dropping it would have disconnected every client shipping today.
+
+  Other pieces:
+
+  - **Resources.** Generated reads publish `akan://<model>/{id}`, `akan://<model>/light/{id}`, `akan://<model>/list`,
+    and `akan://<model>/list/<sliceKey>` alongside their tool. Those four shapes are the whole set — a custom
+    endpoint keeps its tool and is named in the boot log rather than given a template that would resolve to someone
+    else's endpoint.
+  - **`prompt()`**, a fifth endpoint kind: the one a _user_ invokes by name, which a client renders as a slash
+    command. Takes `.param()` and `.search()` only, returns `PromptMessage[]` built with `Msg.user` / `Msg.link` /
+    `Msg.resource` / `Msg.image` and friends. Also mounted as a plain HTTP `GET` whether or not MCP is enabled, so a
+    web UI can preview one — which is why it is in the OpenAPI document and why it must be guarded like any read.
+    An embedded payload is masked by the model you name (`{ model: cnst.LightTask }`), taking the model as an
+    argument so a `{ ...doc }` spread masks as correctly as a hydrated document.
+  - **`McpProgress.report(n, { total, message })`** streams progress from anywhere inside a call — a service, an
+    adapter, a loop several frames down — and is a no-op when nobody is reading, so the same code runs unchanged
+    over HTTP, over a websocket, and in tests.
+  - **Auth** is OAuth 2.0 protected-resource metadata plus a bearer check. A provably unusable token — expired, or
+    audienced elsewhere — is refused up front rather than degraded to anonymous, because an anonymous caller is told
+    a tool does not exist instead of being told to authenticate. A token carrying no `aud` is refused once
+    `AKAN_MCP_AUTH_SERVERS` names an issuer and accepted while none is: that is the confused-deputy case RFC 8707 is
+    a MUST for, whereas a first-party Akan token is already bound by app and environment.
+  - **Descriptions come from the dictionary you already wrote.** The words an agent reads to pick a tool are the
+    same `[en, ko]` pair the UI renders as a label, so an app that localizes well documents itself to agents for
+    free. Generated entries borrow the model's `.of()` and `.desc()`, since none of them has text of its own.
+  - `JsonSchemaBuilder` is now shared with the OpenAPI document via a `refPrefix` option rather than forked, and the
+    exposure predicate lives in `akanjs/common` so the server catalogue and the browser API explorer cannot disagree.
+  - `AgentCatalogue` (`akanjs/signal`) holds the audience-independent half — enumerating a signal registry, holding
+    one name per entry, and resolving dictionary text — so a second agent transport reuses it rather than forking
+    `McpDocument`.
+
+  Errors are reported as the caller's own where they are: a missing, unparseable, or undeclared argument and a
+  document that is not there come back as `isError` naming it, and only a real failure logs a stack. An endpoint
+  that did not opt in answers the same "unknown tool" as one that does not exist, and a guard's refusal never names
+  the guard — the difference between those answers is what would enumerate the private surface.
+
+- bf27773: feat(devkit): measure and enforce the server/client render split with `akan quality ssr`
+
+  Agent-written UI drifts client-side. The boundary conventions say which file role carries `"use client"`, but
+  nothing said how _little_ should sit behind it, so markup that could ship as HTML kept landing in the bundle.
+  `akan quality ssr` now reports the server render share per app and lib and flags the client code that should have
+  rendered on the server; `akan quality scan` includes both, and `--format json` carries an `ssrBalance` field.
+
+  **The share is measured in JSX elements, not files.** A file count cannot move: the module convention already fixes
+  `Zone`/`Template`/`Util` as client and `Unit`/`View` as server, so the ratio sits near 3:2 whatever an agent
+  writes. Element mass is what actually shifts when rendering moves across the boundary.
+
+  Six rules under a new `ssr` warning scope:
+
+  - `akan.ssr.unnecessary-use-client` — the directive is present but the file uses no hook, event handler, store, or
+    browser API.
+  - `akan.ssr.client-static-component` — a component inside a client file renders markup with zero client-only
+    capability.
+  - `akan.ssr.client-static-markup` — a large subtree wraps one or two interactive touches.
+  - `akan.ssr.client-mount-load` — a `useEffect(…, [])` loads server data the route could have fetched first.
+  - `akan.ssr.module-missing-server-view` — a module renders only from `Template`/`Zone`/`Util` and declares no
+    `Unit`/`View`.
+  - `akan.ssr.template-client-state` — a `Template` holds form state in `useState` instead of the store.
+
+  Three exemptions keep the rules from firing on code that has no server alternative, and each one exists because the
+  naive version was noisy in practice. A file importing a bare third-party package may need the directive for the
+  package's sake, not its own — without this, chart, swiper, markdown, and editor wrappers dominated the output.
+  `ui/<Folder>/index_.tsx` is the declared `lazy()` boundary. And only _mount-time_ loads count as findings: a
+  `fetch.*` inside an `onClick` is an interaction, and a poll inside `useInterval` has no server equivalent, so
+  neither is flagged.
+
+  The 50% server-share target is reported as a metric, not a warning. A scope can be legitimately client-heavy — a lib
+  of third-party wrappers will never reach it — and a threshold that fires on unfixable code trains agents to ignore
+  the tool, so the warnings stay individually actionable and the share stays a scoreboard.
+
+  Guidance ships with it: an **SSR First** section in the workspace `AGENTS.md` (and in the generated-workspace
+  template) covering the cost model, the rule table, and a ten-point server-side playbook — client shells that render
+  `children` untouched, `Tab`/`Tab.Panel` composition that keeps panel content server-rendered, `init`/`view`
+  state-sync instead of mount fetching, passing an unawaited `ClientInit` promise so `Load.*` streams it behind a
+  skeleton, named `ReactNode` slots, derived work on `Light<Model>`, server-side auth gating, and CSS variants in
+  place of client state. The same content is fetchable as the `ssrRule` guideline (`akan guideline show ssrRule`,
+  `get_guideline`) and mirrored into `.cursor/rules/ssr-first.mdc`.
+
+- 5f53462: `akan subspace upload-env <name>` sends one subspace's env to the cloud workspace it deploys from
+
+  A subspace's `env/` values were the one thing the mirror had no way to move. Push holds them back and pull
+  leaves them alone — deliberately, because the values belong to the repo that deploys — so getting a changed
+  value into a customer's deployment meant running `akan upload-env` from somewhere that had both the values and
+  that customer's `AKAN_WORKSPACE_ID`, which is nowhere: a workspace has every customer's values and exactly one
+  id, its own.
+
+  `SubspaceDeclaration` now carries an optional `workspaceId`, the cloud workspace that subspace deploys from,
+  and `akan subspace upload-env <name>` uploads against it. `akan.subspace.ts` is a workspace-only entry that no
+  push ever ships, so declaring every customer's id there puts none of them in a customer's repo.
+
+  What is uploaded is the slice a push ships — the declared apps, the libraries their closure pulls in, and those
+  apps' `secrets` globs — and nothing else. The whole workspace would be the simpler thing to send, and it is the
+  wrong one: an env archive is replaced whole on arrival, so one customer's cloud workspace would end up holding
+  every other customer's secrets. `CloudRunner.gatherEnvFiles` takes that scope and an archive path (the slice
+  lands in `local/env.<name>.tar`, never over the full `local/env.tar`), while the `akan:secrets` block it
+  maintains in the root `.gitignore` keeps being written from every app in the workspace — narrowing that file to
+  one slice would silently un-ignore every other app's secrets.
+
+  Because the upload replaces an archive in a repo you are not standing in, three things are refused rather than
+  guessed: a subspace with no `workspaceId`, a subspace declaring this workspace's own id (a slice uploaded there
+  would leave the workspace's next `download-env` short of every other app), and two subspaces declaring the same
+  id. The command asks for confirmation before it replaces anything, naming the subspace and the cloud workspace;
+  `-F, --force` skips the question, and with no terminal to ask in the command refuses instead of assuming yes.
+  (`-f` is already `--format` and `-y` already `--verify`.)
+
+  The direction is one-way on purpose. There is no `subspace download-env`: it would write a customer's values
+  over the workspace's own copies, and which of the two is right is not something a command can know.
+
+- 5f53462: The page shows what the agent is doing to it
+
+  An in-page agent's work used to be legible only in the transcript, and the transcript is behind a panel that is
+  closed as often as it is open. A form that fills itself, a tab that switches, a route that changes — each arrived
+  with nothing anywhere attributing it. Now the page itself says so, from the one signal that knows a call is
+  running rather than from a store action, which cannot tell the agent's write from the user's.
+
+  Two effects, both on by default. **The control a call was published from is ringed** where it stands, scrolled to
+  first when it is off screen — no app code, because the same `onChange={st.do.setTitleOnTask}` reference that earns
+  `data-akan-action` is what makes the control findable. And **a pointer travels to it and presses it**: the ring
+  answers _where_, the pointer answers _who_. It glides only when the hop is far enough to be worth following,
+  presses on arrival rather than on departure, and fades when the batch is over.
+
+  A call that reaches no control draws nothing, `navigate` included — the router is not an element.
+
+  The form patch fans out: `fill<Model>Form` rings one control per field it named, resolved through the same
+  `data-akan-state` the setter annotates, capped at five — a patch of twenty is a form being filled, not twenty
+  events.
+
+  `visual` on `Agent.Chat` and `Agent.Zone` turns it off (`false`) or turns one effect off
+  (`visual={{ cursor: false }}`). Nothing is ever waited on: a call starts the moment its event is handed over.
+
+  A tool a name several rows answer to rings nothing rather than guessing a row, a call an approval or a guard
+  turned back is never drawn, and a batch past four calls stops scrolling and keeps ringing.
+
+  `ToolRunner` gained an `activity` host channel and `AgentSession` an `onActivity` option, both carrying
+  `ToolActivity`. They are separate from `progress`, which only ever fires for a tool that chose to report — and a
+  tool that says nothing about itself is exactly the one whose effect arrives unexplained.
+
+  **`highlight` now waits for its scroll.** `ScreenFlash` — the extracted reveal-and-ring both effects share — fixes
+  a settle loop seeded with `NaN`, which made every first-frame comparison false and put the ring on at the moment
+  the smooth scroll _started_. On a long page it had already faded by the time the user's eye arrived.
+
+- ccf2ae2: The volume plugin reads and sets Android's media volume
+
+  On Android, `volume` from `akanjs/client/native` drives the media volume (STREAM_MUSIC), the one the volume keys move
+  while the app plays: `getVolume()`, `setVolume({ level })`, `setMuted({ muted })` and the `change` event behave as on
+  the desktop. Setting the level keeps the mute as it was (Android unmutes a stream whose volume changes), and a device
+  with a fixed volume answers `settable: false`. iOS still answers `UNSUPPORTED`.
+
+- ccf2ae2: `trustedDependencies` in `akan.config.ts` names the packages whose install scripts run where the app is installed
+
+  `bun install --production` skips every dependency's install and postinstall scripts unless the package is trusted, so
+  a native addon that builds itself at install time (one that ships no prebuilds) reached the image unbuilt and failed
+  at its first call. An app or a lib now lists those packages in `trustedDependencies`; the built `package.json`
+  carries the list, and both the image and a desktop app's server run their scripts. A lib's list reaches every app.
+
+- ccf2ae2: `usePurchase` sells through the native in-app purchase plugin: StoreKit 2 on iOS, Play Billing on Android.
+
+  - `usePurchase({ platform, productInfo, url, onPay, onSubscribe })` answers `{ isLoading, products,
+purchaseProduct, restorePurchases }`. `purchaseProduct(product | id, offerToken?)` resolves `"purchased"`,
+    `"pending"`, `"cancelled"` or `"unverified"`; a shell on a platform the app does not sell in asks the store
+    nothing, and the web sells nothing.
+  - A transaction is verified by `POST <url>/billing/verifyBilling` with `{ data }`, handed to `onPay` or
+    `onSubscribe`, and only then finished (a consumable consumed, anything else acknowledged). A refused
+    verification or a failing callback leaves it unfinished, so the store hands it over again; what the last launch
+    left unfinished is settled at mount, and one transaction is never credited twice.
+
+  **Breaking.** The hook's options and answer changed, and `cordova-plugin-purchase` is no longer a peer. iOS sends
+  the transaction's JWS alone as `receipt` (no app receipt, no `accountId`), so the verification server has to accept
+  the App Store Server API form in the same release.
+
+- 5f53462: Web push has one owner, and it draws once
+
+  `/firebase-messaging-sw.js` was a framework route that built the worker in memory from `env.client.ts` on every
+  request. It matched ahead of the static fallback, so an app's own `public/firebase-messaging-sw.js` was never
+  served and there was no way to turn it off — including the one the push plugin's `syncAssets` had already written
+  there, which meant editing that file changed nothing a browser ever saw. The route is gone. The plugin owns the
+  worker, `akan sync` writes it, and the static fallback serves it.
+
+  Because the plugin writes a file rather than answering a request, it now rewrites a worker whose body has changed
+  instead of skipping any file that exists — otherwise a fix here would never reach an app that had synced once. The
+  file opens with a banner; remove that line and sync leaves the file alone, which is how an app takes the worker
+  over.
+
+  The worker itself had four bugs, all of them the kind that only show up with a real device in hand:
+
+  - **It never activated on time.** With no `install`/`activate` handlers a visitor who already had a worker got the
+    new one on the visit _after_ their next one. It now calls `skipWaiting()` and `clients.claim()`.
+  - **One push arrived as two notifications.** firebase-js-sdk draws a payload carrying a `notification` block
+    itself and _then_ calls `onBackgroundMessage`, so drawing there unconditionally doubled it — visible as a
+    duplicate without a `tag`, and as a re-alert with one. The handler is now data-only.
+  - **Every click opened a new tab**, and a full reload rather than a route change. It now focuses an open window
+    and hands the path over; `openWindow` is the fallback, not the default.
+  - **A badge count in `data.badgeCount` went nowhere.** The worker applies it through `setAppBadge`, guarded —
+    Firefox and desktop Safari ship no such method and an unguarded call is a synchronous `TypeError`.
+
+  `AkanSyncContext` gained `readFile`, the pair of the `fileExists`/`writeFile` it already had, so a plugin can tell
+  what it is about to overwrite.
+
+  The app-side half ships in `libs/util`, which is where the worker and the hook now live. FCM hands a payload to
+  the page instead of the worker whenever a visible window client exists, and `usePushNotification` listened only in
+  the worker — so a push sent while the app was on screen was dropped outright, with FCM reporting the send as
+  delivered, which is what makes that one expensive to diagnose. The hook now installs `onMessage` and draws through
+  the worker's registration, receives the worker's click handover, and routes it through `router.enterDeepLink`.
+
+- ccf2ae2: A Windows desktop release is signed with Authenticode
+
+  With `AKAN_NATIVE_WINDOWS_CERTIFICATE` + `_CERTIFICATE_PASSWORD` (a `.pfx`), `AKAN_NATIVE_WINDOWS_THUMBPRINT` (a
+  certificate in the store) or `AKAN_NATIVE_WINDOWS_SIGN_COMMAND` (a JSON array run once per file with `{file}`, for Azure
+  Trusted Signing or a cloud HSM), `akan build-desktop` signs every PE file of the app — the executable, its DLL, the
+  server's addons and `bin` — SHA-256 with an RFC 3161 timestamp (`AKAN_NATIVE_WINDOWS_TIMESTAMP_URL`), and verifies them.
+  `--installer` signs the setup program and, through makensis's `!uninstfinalize`, the uninstaller it writes; the
+  settings reach the signer through the environment only. `publish-update` signs a Windows release the same way, and an
+  unsigned release build warns that SmartScreen flags a downloaded copy.
+
+### Patch Changes
+
+- ccf2ae2: A CSR page or layout whose async render throws says so, a cached page whose layout redirected renders again, and a
+  dev client module that imports a macro builds.
+
+  - An async render that rejected used to leave its layer blank with nothing in the console, since the promise's
+    failure was dropped. It is now logged with the stack and the layer it belongs to (`render of page 2 of
+/:lang/home failed: …`).
+  - `akan:debug:frame` takes `memory` besides `1`: the frame trace goes to `window.__AKAN_FRAME_TRACE__` (the last
+    2000 events) instead of the console. A native dev build mirrors each console call over the bridge, which slows the
+    frame enough to hide a timing bug; `memory` does not. Async page and layout renders add `layer.render`,
+    `layer.settle` and `layer.fail` events.
+  - A cached page whose layout redirected renders that layout again when it is back on screen. Signed out, a
+    layout that sends the person to the sign-in page kept its empty result, so the page stayed blank after the sign-in
+    brought them back (a native app opens its home first, so it always did). A render that issued a redirect while it
+    ran is now rerun the next time its page becomes current; `router.redirectCount()` is what it compares.
+  - `window.__AKAN_DUMP_FRAME__()` reports the frame's location, stack and phase and every recent async page and
+    layout render: settled or pending, still awaited, drawn. It records only the latest state, so it does not change
+    the timing a trace would.
+  - `akan start` no longer fails a dev client build with `ReferenceError: __akanMeta is not defined` when a file
+    imports a macro (`useClient.ts`'s `with { type: "macro" }`) whose modules read `import.meta` at the top level.
+    Bun applied the dev build's `import.meta` rewrite to the macro's modules too, and ran them where nothing declared
+    the rewritten name; such a file now has its macros run by a build of its own first.
+
+- ccf2ae2: A native dev build's API calls and sockets go through the dev gateway, so a phone on the same network — or the
+  simulator, the emulator and a desktop app — reaches `akan start` without a reversed port.
+
+  - A page the gateway served calls its own origin: `getEnv().serverHttpUri` is `<page origin><api prefix>` and the
+    websocket follows it, unless `AKAN_PUBLIC_SERVER_URL` names a server. A release build is unchanged.
+  - The iOS, Android and desktop hosts carry the method, the body and the request headers, `authorization`
+    included, to the gateway; the gateway relays the app's `<prefix><websocketPrefix>` socket. Android hands the
+    host no request body, so a call that carries one goes to the gateway's `http://localhost` origin directly and
+    the server answers its CORS.
+  - A desktop dev build opens the target's start page instead of `/`, and builds when the web root has no
+    `index.html` yet.
+  - `NativeWebDir` lists the web root in `/`-separated paths on Windows too.
+
+- 5f53462: A relation field renders the value it holds
+
+  `Field.Parent` / `ParentId` / `Children` / `ChildrenId` built their options out of the slice list alone, and that
+  list is loaded when the dropdown opens. A form filled by `edit<Model>` therefore rendered an empty control over a
+  value it was holding — and opening the dropdown did not always fix it, because a slice list is one `limit`-sized
+  window and the row the value points at can sit outside it.
+
+  `Select` was the immediate cause: a selected value with no matching option rendered nothing at all, `renderSelected`
+  included, so no amount of care in the caller could have painted it. It now renders the value it is given, which is
+  what a controlled component owes its parent — an enum that lost a member shows the stale value rather than a blank
+  field.
+
+  The four controls now merge what they hold into their options. A `Light`-valued control already carries the row, so
+  it needs no request and the value is right in the server render. An id-valued control carries no row at all, so a
+  missing one is read through the generated `light<Model>` endpoint and cached per `refName:id` — deliberately beside
+  the store rather than in it, because a model store is a singleton and resolving into it would overwrite whatever
+  listing of the same model the screen is already showing. A row that cannot be read — removed, or behind narrower
+  `get` guards than the slice the control lists from — is remembered as unreadable rather than retried, and the
+  control shows the id.
+
+  Four things came with it, all of them the same bug seen from another side:
+
+  - Opening the dropdown no longer invalidates the slice list. It refreshed on every open, replacing the rows any
+    `Load.Units` on the same page had put on screen; it now reuses what the store already loaded.
+  - `Field.ParentId` offered its options as bare ids, so `searchable` matched on the hex id while the option on
+    screen read as a name. Every control now labels its options — from `renderOption` when that returns a string,
+    otherwise from the model's own `labelOf`.
+  - `sortOption` was accepted by all four and applied by none.
+  - `Select` takes `loading`, and the controls pass the slice's loading flag, so an opened dropdown says it is
+    fetching instead of claiming there is nothing to pick.
+
+- ccf2ae2: fix: a gateway's replica takes the websocket relay on 127.0.0.1, from the gateway only
+
+  Behind the gateway a replica listens for relayed sockets on a TCP port of its own, and its ready message names
+  127.0.0.1, where the gateway dials. It bound that port on every interface; it now binds 127.0.0.1 only, whatever
+  `AKAN_LISTEN_HOST` names, and answers only the Host the gateway's hop carries, so a page on a name rebound to
+  127.0.0.1 is refused there too.
+
+- ccf2ae2: fix: a server whose parent dies while it boots exits instead of serving on
+
+  A replica (and a desktop app's carried server) listened for its parent's IPC channel closing only after its `init`
+  finished, and Bun drops that event for a listener added after a `message` listener, which the single-mode queue and
+  pub/sub add during `init`: a gateway or shell killed during boot left the server running, holding its port and its
+  database, with its cron jobs. It now listens before `init`, treats a channel already closed or a `ready` it could not
+  send as a parent gone, and ends its process group the same way it does after boot.
+
+- 5f53462: fix: a navigation to a route that is not there leaves the page alone
+
+  The RSC route answers a target that resolves to nothing with `0:null` under a 404 — a Flight payload whose root is
+  literally `null`. `fetchRscNavigationResponse` read the redirect and patch headers but never the status, so that
+  payload was decoded like any other and committed: the client replaced the whole document with an empty tree. Since
+  the tree is mounted by `hydrateRoot(document, …)`, everything went with it — the root layout, and whatever it holds,
+  an in-page agent's chat session included. A full document load never showed this, because that path renders a real
+  not-found page instead; only client navigation reached the empty one, so the same bad href behaved completely
+  differently depending on how it was followed.
+
+  The status is now read before the body reaches the decoder, and a not-found navigation is **refused rather than
+  committed**: nothing is rendered, history is never touched, and the page stays exactly where it was. It is
+  deliberately not converted into a document navigation either — that would land on the 404 this refusal exists to
+  avoid. `Router.navigation()` is the new report: it answers the navigation `push` / `replace` last started and
+  rejects when the route refused to move, which `push` itself cannot do because it returns before the payload for the
+  new route has even been asked for. `popstate` is the one exception and goes the other way — the address bar has
+  already moved, so refusing would leave the tree and the URL describing different pages, and a document navigation
+  there renders the real not-found page.
+
+  The in-page agent's `navigate` reads that report and answers the model with the miss instead of a move that did not
+  happen, so a guessed path costs one tool error on the screen the agent is still on rather than the session.
+
+- ccf2ae2: fix: a file `getBlob` serves never runs as a page of the API's origin
+
+  `libs/util`'s `getBlob` (`/api/localFile/getBlob/*`) sets no Content-Type of its own: Bun types the body by its
+  stored name and answers a Range with a 206, and the response goes out the way Bun sends a file, neither buffered nor
+  compressed. Every answer but a PDF's carries `Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline';
+sandbox` and `X-Content-Type-Options: nosniff`, so an uploaded `.html` or `.svg` opened from its URL runs no script on
+  the API's origin, which is also the origin of a desktop app's carried server. An `<img>` or `<video>` showing the file
+  is unaffected; a PDF is left out because a browser's viewer refuses a sandboxed document.
+
+- 69f7178: fix: make the admin panel's own controls work, and give the data surface a look
+
+  `Model.AdminPanel` is the one component an app mounts to get a model's whole admin surface, and most of what it
+  put on screen did nothing.
+
+  **The dashboard crashed the panel on every app that has no `summary` state.** `AdminPanel` always passed a
+  `renderDashboard`, and `ListContainer` read the tiles it needs through `st.use.summary()` — an app-level store key,
+  not a generated one — so the accessor was `undefined` and calling it took the route down. It now reads the key off
+  the state through `st.sel`, which is one hook whether or not the key exists, and `AdminPanel` defaults a dashboard
+  only when `summaryColumns` names something to put in it.
+
+  **A summary tile never rendered even where the state existed.** `AdminPanel` declared a `queryMap` prop and passed
+  `{}` in its place, and `Dashboard` skipped every column the map did not name. The map is forwarded, and it now
+  decides whether a tile _links_ to its filtered listing rather than whether the tile exists at all. The tile is also
+  no longer an `<a>` inside a `<button>`.
+
+  **The sort selector was permanently empty.** It read `fetch.<model>SortKeys`, which nothing defines, and labelled
+  the options with a dictionary key one level short of the real one. Sort keys now travel with the serialized signal
+  (`FetchSerializer` emits `filter.sortKeys`, which `FetchClient` already knew how to merge and register), the
+  selector reads `fetch.sortKeyMap`, and a label that misses the dictionary falls back to the humanized key instead of
+  printing `user.latest` at the reader.
+
+  **`query`, `init`, and `sort` were dead props.** The init effect called `init<Model>()` with no arguments at all.
+  It now fills every slice argument before the init form, which is the only order the generated action reads
+  correctly — passing the form into an unfilled positional slot made it the query.
+
+  Also: an `Export CSV` that emitted tab-separated JSX (`[object Object]` for any column with a renderer) is real,
+  escaped, BOM-prefixed CSV read from the column's `value`; a card column with no `.length` — every number, every
+  date — renders instead of silently vanishing; a table header with no dictionary entry reads `Created At` instead of
+  `user.createdAt`; an empty card list says so instead of rendering nothing; a table keeps its rows while refreshing
+  instead of flashing its empty state; and the toolbar, tiles, and cards are rebuilt on the semantic tokens with a
+  card/table toggle, so the panel looks like the rest of the framework.
+
+- 69f7178: feat!: `setAgentAccess` takes guard classes, not a policy function
+
+  Who may spend the LLM key through the `runAgentTurn` relay is an authorization decision, and this codebase spells
+  those as guard classes everywhere else. `AgentRelayAccess` now forwards to the guards an app names instead of
+  calling a bespoke `(context) => boolean` — so the relay reuses the same `srvkit/guards.ts` classes an endpoint's
+  own `guards: [...]` array takes, rather than making the app restate `!!context.get("account")` in a shape nothing
+  else in the framework understands.
+
+  ```ts
+  // before
+  option.setAgentAccess((context) => !!context.get("account"));
+  // after
+  option.setAgentAccess(SignedIn);
+  option.setAgentAccess([SignedIn, NotBanned]); // ANDed, as an endpoint's own array is
+  ```
+
+  `null` still clears what a library set, and with nothing named the call is still refused like `None`. The
+  `AgentRelayPolicy` type is gone. `AgentRelayAccess.scope` became a getter reporting whatever its delegates need,
+  so a resource-scoped guard cannot be evaluated argument-free by a catalogue that believed the old static
+  `"account"`. Guard instances are now cached by `guardOf` in `signal/guard.ts`, which `SignalContext` uses too —
+  one instance per class, built on first use rather than at registration.
+
+- 69f7178: feat: the in-page agent can ask the user instead of guessing
+
+  `askUser` is a fourth built-in on every turn, and the **session** owns it rather than the surface: the answer comes
+  from the conversation, not the screen, so it needs no declaration from the page and a zone agent asks inside its own
+  transcript. `AgentSession` parks the loop on `pendingQuestion` exactly as it parks on `pendingApproval`, and
+  `Agent.Chat` renders the question card above the composer — which is closed anyway while a turn runs, so the card is
+  the only way in.
+
+  `choices` offers a pick (`multiple` for several) and omitting them asks for free text. The card keeps a free-text row
+  either way, because the model wrote the options and only the user knows whether the right answer is among them.
+  Dismissing is the tool's **error** result rather than a silent empty answer, so a model that asked cannot read a
+  skipped question as consent; an aborted turn settles the same way. A question with no text is refused without ever
+  reaching the screen, and choices are trimmed and deduped because the answer is the option's own text — two identical
+  options cannot be told apart.
+
+  A settled ask renders as the exchange it was, question then answer, instead of as a `askUser` tool row: while the
+  question is pending only the card holds it, so the text is never on screen twice. A hook tool named `askUser` shadows
+  the built-in like any other, and the relay needed no change — the tool rides the same wire the surface's own do.
+
+- 5f53462: An attachment carrying both bytes and an address is read from the bytes
+
+  Both vision adaptors picked `url` over `data` — `AnthropicLlm.sourceOf` and the OpenAI dialect's image part — so a
+  host could not send an address for the screen and bytes for the model in one attachment. Sending both got the
+  address, and when that address was private the model answered about a picture nothing had fetched, with no error
+  anywhere. That is the one attachment failure that reports nothing, and the framework's own default storage backend
+  serves exactly such a path.
+
+  The order is now bytes first in both. Choosing the address does save the provider hop what the bytes weigh, so this
+  is not free — but a host that has a publicly reachable URL has no reason to also inline the bytes, while a host
+  that uploaded to private storage has every reason to send both. Being wrong the new way costs a larger request;
+  being wrong the old way cost a confident answer about nothing. A provider-reachable URL should still travel alone.
+
+- 5f53462: An attachment can carry the host's own handle on the file, and the composer's ceilings are the app's
+
+  `MessageAttachment.ref` is opaque to the framework, which only moves it — a file id, a storage key, whatever turns
+  the attachment back into something a tool can be handed. Without one, a host that stores its uploads keeps a map
+  beside the transcript keyed on name and size, which is the guess `Attachment.same` has to make and the one that is
+  wrong for two crops of one export; when both sides carry a `ref`, that is now the answer instead.
+
+  The per-file ceiling is measured on what `attach` produced rather than on the file that was picked, so a reader
+  that uploads and answers a `url` is no longer refused for a cost it does not incur. All three ceilings become
+  defaults behind `<Agent.Chat attachLimits={{ perFileBytes, perMessageBytes, perMessageCount }} />`, since what one
+  request can carry belongs to the configured provider.
+
+  A `url` the reader answers is handed to the provider as the address it will fetch, which is now documented on
+  `attach`: the default storage backend serves a path only the app can resolve, and a model given one answers about
+  a picture it never saw with nothing anywhere reporting a failure. Answer `data` when the provider cannot reach it.
+
+- 5f53462: An attachment an app built itself cannot kill the turn
+
+  `session.send([{ role: "user", text, attachments }])` lets a host assemble attachments directly, and until now
+  `MessageAttachment` was not exported from `akanjs/ui` — so the one path where the app writes the object was the one
+  path with no type to write it against, while the composer's own reader was typed. It is exported now.
+
+  Two places trusted that object's declared shape. `AgentService.isReadable` dereferenced `mimeType` unguarded, so a
+  missing one threw out of the relay and took the whole turn — every other attachment of the message with it — under
+  a `TypeError` that named nothing; it is now unreadable like any other type the provider cannot take, which routes
+  it through the note that names the file. The attachment chip did the same on the preview branch, where the throw
+  took the transcript's render down. Both now cost that one attachment and nothing else.
+
+  `field.hidden` is documented as the trap behind this: it is stripped from every endpoint response and hydration
+  writes `null` over the key, while the generated type still declares the field — so a client holds a deliberate
+  `null` behind a type that promises a value, and only `??` / `== null` catch it.
+
+- 5f53462: feat: the in-page agent issues independent tool calls in one turn instead of one per turn
+
+  A turn has always been able to carry several tool calls — the session collects every `toolCall` event, runs them in
+  order and posts them back as one `tool` message — but nothing asked the model to use it. A screen that needed ten
+  calls got ten turns, each paying a full model round trip and a resend of the whole transcript, and the turn cap
+  then parked the run on a "keep going?" card halfway through.
+
+  - `AgentService.preamble` is the framework's own half of the system prompt, ahead of whatever the app declared. It
+    asks for the batch — every call that does not need another call's result goes in the same turn, and a tool that
+    does the whole job in one call (a form's fill tool) beats one call per field — and it asks the model not to read
+    the screen back to confirm work it has just done, since the change report it was handed already says so. Both
+    sentences were measured against the provider: "approve these eight" went from 1.5 turns (with three runs in eight
+    doing nothing at all) to one turn in every run, and "read the screen, then approve what is pending" from 3.0
+    turns to its floor of 2.0 in every run. The read a fresh route needs after `navigate` is acquisition rather than
+    confirmation, and survived in every run of that scenario. It is composed in the service rather than in an adaptor
+    for the reason `explained` is — an adaptor that has to remember it is one that forgets.
+  - The turn cap defaults to 12 assistant turns instead of 8. A chain of ten calls could not finish under the old
+    default without the user answering a question first.
+  - `readState` and `highlight` declare `settle: false`, as `readScreen` already did. A settle is 120ms of DOM quiet
+    at the very least, and neither of them changes anything a resource holds, so ten reads paid a second and a bit
+    for a change report that is empty by construction.
+
+- 5f53462: feat: a tool the user answers, rendered in the chat by the app that declared it
+
+  `st.tool("collectContact").desc("…").card(({ submit, cancel }) => <Contact.Form …/>)` is a second way a tool chain
+  ends. Where `.exec()` runs a function, a card parks the call in the chat and renders the app's own component there;
+  what the form submits is the call's result, and cancelling is the error the model reads instead. A name and a phone
+  number, a date somebody has to look up, a signature — those are answers a model must not invent, and until now the
+  only surfaces a chat could park on were the approval gate and `askUser`'s question, neither of which carries a
+  shape.
+
+  `AgentSession` holds it as `pendingCard` beside `pendingApproval` and `pendingQuestion`, and `Agent.Chat` renders it
+  in the same place; `AgentToolCard` is an `_overrides.tsx` slot like the other two. The frame draws its own way out
+  even when the app's component does not, so a turn can never park on something the user cannot dismiss.
+
+  The call waits **outside** the tool queue, for the reason an approval does: a form parked in front of somebody is
+  not work, and holding the execution lock across it would freeze every other agent on the page behind one unanswered
+  card. The declared arguments are checked before the card is parked rather than while it renders — a throw inside the
+  host's tree would take the chat down, where a verdict reaches the model as something it can correct — and `confirm`
+  is not read for a card at all, because the card is already the asking. The screen is still snapshotted around the
+  wait, so a card that writes what it collected into a store reports what moved like any other call.
+
+- f882bbc: feat: the in-page chat is customizable per part, opens from the app's own control, and composes multi-line
+
+  **Eight slots replace what the chat renders, so a skin no longer means replacing the panel.** `AgentLauncher`,
+  `AgentBubble`, `AgentComposer`, `AgentApproval`, `AgentQuestion`, `AgentMenu`, `AgentMarkdown` and `AgentCode`
+  each bind in `_overrides.tsx` beside the existing `AgentChat`, and `akanjs/ui` exports every default next to them
+  (`DefaultBubble`, `DefaultComposer`, …) so a replacement composes the one it is replacing instead of
+  re-implementing the loop, the slash commands and the approval gate. `AgentCode` is the seam a highlighter binds
+  to — the markdown scanner now keeps the fence's language, which it used to drop. A component bound to
+  `AgentBubble` carries its own `memo`: the transcript re-renders on every streamed delta.
+
+  **The panel takes a controlled `open`/`onOpenChange` pair, so an app opens the chat from its own control.**
+  Conditional mounting was not a substitute — unmounting aborts the session and discards the conversation.
+  `launcher={false}` draws no launcher for an app that has its own entry point, `launcherClassName` /
+  `panelClassName` reach one surface each where `className` reaches both, `intro` replaces the empty-state line
+  (where starter questions go) and `header` adds controls beside the built-in clear and close.
+
+  **The composer is a textarea**: Enter sends, Shift+Enter writes a newline, and it grows to a few lines before it
+  scrolls. The vertical arrows still walk what was sent, but only from the first or last line — anywhere else the
+  caret belongs to the textarea. It resolves its field shell through the `input` recipe slot, so a recipe swap
+  reaches it like every other field.
+
+  **On a phone the panel is the whole screen**, a card from `sm:` up, and it lifts above the on-screen keyboard —
+  only `visualViewport` reports that inset, and a full-screen chat whose composer sits under the keyboard is one
+  nobody can type into.
+
+  `SessionContext`, `useAgent`, `agentSessionOf`, `ChatCommands` and the parts' prop types are exported too: an app
+  may not import `use-agentic`, and without them a replacement could not see the session an `Agent.Zone` handed down.
+
+- 5f53462: The in-page chat takes the next message while a turn is still running.
+
+  - Enter (or the Queue button that appears beside Stop) during a turn parks the message and sends it the moment the
+    turn ends, instead of doing nothing. One slot: a second send joins the first on a new line, so the model is
+    handed one user message. Staged files ride along, under the same per-message ceilings.
+  - The parked message shows on a card above the composer with two ways out — take it back into the composer to
+    change it, ahead of whatever was typed since, or drop it. The card is the `AgentQueued` slot, with `DefaultQueued`
+    and the `QueuedMessage` type exported beside the other chat parts.
+  - Stop hands a parked message back to the composer rather than opening the next turn with it, so Stop means stop.
+    `/new` drops it along with the conversation, the way it drops staged files. A `/prompt` parks like text; the
+    built-in commands never park, and a pending question still takes the composer as its answer.
+  - A spoken ask parked behind a turn is still the one answered out loud — and a second voice ask no longer re-reads
+    the previous answer while the new one is on its way, which it did whenever the transcript already held one.
+
+- 69f7178: feat: the agent chat answers slash commands of its own, and the composer remembers what was sent
+
+  **Five commands join the `/` menu the app's `prompt()` endpoints already appear in**: `/new` (`/clear`) starts a
+  new conversation, `/retry` sends the last message again, `/copy` puts the transcript on the clipboard, `/help`
+  lists the commands, and `/tools` lists what this screen published. An app writes none of them and cannot add one —
+  the extension point for a product's own command is a `prompt()` endpoint, which is guarded and server-side.
+
+  **A built-in wins a name collision with a prompt of the same name**, and a shadowed prompt is dropped from the menu
+  rather than listed twice. That is the mirror image of the tool rule, deliberately: a component's `st.tool` shadows a
+  built-in it means to replace, but no library's prompt may take `/new` away from the user who typed it. `/new` and
+  `/copy` are also dispatched ahead of the is-a-turn-running check, because mid-turn is exactly when they are reached
+  for — so `AgentSession.reset` now ends the turn it is clearing and waits for it to wind down. It used to return
+  silently while one was running, and clearing before the abort lands leaves the dying turn appending onto an empty
+  transcript.
+
+  **A command's output is a `local` message: rendered in the transcript, withheld from the wire.** The transcript
+  _is_ the model's history, so `/help` text appended plainly would come back on the next turn as something the
+  assistant believes it said. `session.note(text)` writes one, `session.report(error)` stays what a host-side failure
+  lands in, and `local` messages are left out of a `/copy` export — they are the chat talking to itself.
+
+  **`/copy` exists because nothing else keeps the transcript.** The relay is stateless and the conversation lives only
+  in that browser, so an export is the one path a wrong answer has to whoever could fix it; it carries the route and
+  the timestamp for that reason. **`session.retry()`** replays only the trailing user message and leaves everything
+  before it in place, so a prompt's own preamble is not sent twice.
+
+  **↑ and ↓ in the composer walk what was sent.** A single-line input has nothing of its own on the vertical arrows,
+  and the half-written draft they were walked away from comes back at the bottom of the walk — the other half of why
+  a turn that fails for a reason unrelated to the ask no longer means retyping it.
+
+- 5f53462: The composer says a file is being read
+
+  `useChatAttachments` now reports how many files are in the reader, and the composer draws a chip for each. The
+  built-in readers resolve in a tick and nothing was missing before; an `attach` that uploads takes seconds, and
+  since the per-file ceiling moved behind the reader that is now the shape an app is meant to write — so a large
+  photo was seconds of a panel that looked like it had dropped the file.
+
+- f882bbc: feat!: `st.tool`, `st.expose` and `st.useState` become one chain, and a declaration's type is its mask
+
+  **Breaking.** The three declarations an app writes for the in-page agent had three different shapes and two
+  options that did not carry their weight. They are now one shape — `<entry>(name, …) → .desc(text) → <terminal>`,
+  where the terminal call is the hook — and every option left is one the runtime reads. Migration guide:
+  `local/tool-migration.md`.
+
+  ```ts
+  st.tool("removeTask", { confirm: true })
+    .desc("Remove one task.")
+    .arg("taskId", ID)
+    .opt("force", Boolean)
+    .exec(fn);
+  st.expose("openNote", cnst.LightNote).desc("The note on screen.").value(note);
+  const [tab, setTab] = st
+    .useState("tab", String, { set: true })
+    .desc("Which tab.")
+    .init("all");
+  ```
+
+  **`.desc()` is required, and it is now load-bearing twice.** A model picks a tool by that sentence and by nothing
+  else, so a tool without one was a tool an agent could only guess at. It also replaces `shared: true`: a row
+  component registering fifty `removeTask` is fifty copies of one name _and one description_, which the surface now
+  reads as one declaration, while a second description arriving under a name already taken is two components that
+  collided and still warns. `shared` was an unverified claim whose only effect was suppressing that warning — a flag
+  that said "trust me" where the description already says the same thing, checkably.
+
+  **`effect` becomes `settle`, because only one of its three values ever did anything.** `"query"` skipped the wait
+  for the screen to settle before the call's effect was reported; `"state"` and `"mutation"` were indistinguishable
+  at runtime, were dropped before reaching the model, and coloured a badge. What is left is the fact the session
+  actually needs: `{ settle: false }` is a read that returns what is already there, and everything else is waited
+  out because a write may still be landing when `exec` resolves. `effect` also leaves `PublishedTool`, the relay
+  wire (`AgentWireTool`, `WIRE.md`) and the `/tools` dock badge.
+
+  **`.arg()` is required and `.opt()` is optional**, matching the filter builder's vocabulary, so an optional
+  argument is a different call rather than an options bag — and the `exec` parameter widens to `| null` only for
+  `.opt`.
+
+  **A readable value declares its type, and the type is the mask.** `st.expose(name, Type)` and
+  `st.useState(name, Type)` take a scalar, an enum, a model class, a one-level array of those, or `Any`. The type
+  typechecks what the component hands over — a model resolves to its state object, so a hydrated document and a
+  plain copy of one are equally accepted — and it decides how the value reads: a model strips its own `hidden`,
+  `secret` and `visual` fields by the model that was _named_ rather than by whatever class the value still carries,
+  and a `Date` leaves as an ISO string. That subsumes `mask:` and `serialize:`, both of which are gone; `Any` is the
+  escape hatch and passes the value untouched. A type nothing can read is reported on the console and left
+  unpublished rather than thrown, the same degradation an undescribable `.arg` already had. `.value()` also takes a
+  thunk, read when the agent reads, for a value assembled out of a ref the children fill in after the render.
+  `st.useState`'s `set` is now a boolean, since the write schema comes from the same type.
+
+- 5f53462: A stopped turn leaves no bubble that is still writing
+
+  `AgentSession` opens an assistant draft before the first token arrives, and Stop caught before that token left the
+  draft in the transcript forever. `Transcript` already drops an empty assistant message, so the wire and the
+  persisted history were both correct and the rendered array was the one place it survived — which is exactly the
+  array a bubble reads to decide it is still being written, so the pulsing dot never stopped. The turn's own settle
+  now drops it, using the predicate `Transcript` already applies. A turn a provider ends without saying anything
+  leaves nothing behind either, for the same reason.
+
+- 5f53462: An upload control reaches an agent, the way a relation picker already does
+
+  `useFileFieldTool(onChange, { read, label, max, min })` is the counterpart to `useRelationFieldTool` for the other
+  half of _"a relation is picked or uploaded"_: the control hands the files it is holding and gets
+  `load<Field>OptionsOn<Model>` — the name the relation picker already publishes, so one spelling serves a form that
+  draws both — plus the field's own `set<Field>On<Model>`, with `add`/`sub` besides on an array field. Before this an
+  agent could see an attached picture and read the form, and had no way to put one in the other.
+
+  The array pair is not the convenience it is for a list of ids elsewhere. A picker's candidates are the whole
+  resolvable set, so rewriting the array is always expressible; an upload control's are what this conversation
+  brought, and a field that already holds older files cannot be rewritten without ids the guard has never heard of.
+  `max` / `min` are passed rather than derived, since `arrDepth` says a value is a list and not how long a legal one
+  is, and they reach the description as well as the guard — a cap an agent can only learn by tripping the server is
+  the round trip the listing tool exists to spare it. `read` omitted publishes nothing, so a shared control can
+  forward an optional tray without every call site growing a tool that refuses every id.
+
+- f882bbc: Back a zone's transcript from a mounted `<Agent.History />` instead of a `persist` prop, so the zone can be
+  assembled by a server component.
+
+  A `SessionHistory` is functions, and a function cannot cross the server/client boundary as a prop — so
+  `persist={myStore}` made every ancestor up to whoever builds the session a client component, which for a zone is
+  the whole subtree. `<Agent.History load save clear onCompact />` is a leaf that attaches the store to the
+  enclosing session, in the shape `Agent.Guide` already uses, and renders nothing. `Agent.Zone`'s other props were
+  already serializable, so the zone and the chat inside it can now be server-rendered.
+
+  Restoring follows the rule an async `load` already followed: it lands only while nothing has happened to the
+  conversation yet. Mounting with the zone restores; mounting later saves from there on, and the store is never
+  asked for a transcript that would be discarded. `AgentSession.setHistory` / `setOnCompact` back it, for a session
+  an app built itself.
+
+  `setHistory` and `setOnCompact` return a detach that clears the slot only while their own value is still in it,
+  so a remount's cleanup cannot silently stop the saving of whoever attached after it. The store lives exactly as
+  long as the component; a host that wants it to outlive the view attaches it on the session itself.
+
+  Also documents that `open` without `onOpenChange` draws no close button — a fixed panel with nowhere to close to,
+  and the shape that keeps a controlled chat free of function props.
+
+- f882bbc: Hide `Agent.Dock` and `Agent.Context` in production.
+
+  Both are a developer inspector — they list every published tool, can run one by hand, and preview the turn snapshot. A layout that mounts them would have shown that to every visitor on `AKAN_PUBLIC_ENV=main`. They still render on local, debug, develop, and testing.
+
+- 5f53462: feat: the composer draws a pointer as the name it points at
+
+  Picking a row off the `@` menu used to leave `@[이번엔, 진짜입니다](mention:videoCut/6aae…)` sitting in the
+  composer — the token is what carries the reference onto the message, so it had to be in the text, and the text is
+  what a textarea draws. It is now drawn by a Lexical editor instead, where each pointer is one atomic node whose
+  label is what the person reads and whose `getTextContent()` is the token. The draft string the chat reasons about
+  is unchanged, pointers and all: `Reference.parse`, the `@` query, the chips, the wire and the server's own framing
+  all see exactly what they saw before, and the editor is one way of drawing it.
+
+  A pointer deletes in one backspace rather than a character of a label that would then name nothing, and every
+  offset the chat hands over — the caret a `session.refer` inserts at, the line a recall arrow belongs to — stays an
+  offset into that string.
+
+  It costs nothing where it is not used: the editor is its own chunk behind the chat's own, and `Agent.Chat` only
+  draws it where `reference` sources were declared. `mentions={false}` keeps the plain textarea, for an app that
+  overrides the composer or would rather see the tokens it is sending.
+
+  Lexical rather than a contenteditable of our own, because a Korean or Japanese IME composing into a contenteditable
+  that React also re-renders is the bug class the library exists to own.
+
+- 69f7178: feat: derive an agent surface from the store, annotate the DOM with it, and add a read-only insight query
+
+  The server half of agent support is the signal registry; this is the client half plus the layer-bypassing read. All
+  of it is derived — an app writes no declaration for any of it.
+
+  **`SerializedStore` and `StoreCatalogue`** describe one built store the way `SerializedSignal` describes a signal
+  registry: every key on `st.use` and every action on `st.do`, with argument schemas. Flat rather than grouped by
+  model, because that is what the store is — one namespace, where a key means the same thing to every reader.
+
+  The exposure default is the opposite of the MCP catalogue's, and deliberately: a key on `st.do` is the same call the
+  user's own click makes, under their own credential, with them watching, so an agent driving it cannot reach past what
+  the UI already permits. Every key is published unless something about it cannot be described, and each of those is
+  recorded as a refusal with the reason — a `hidden`/`secret` field setter (the masking boundary facing the other way),
+  a `Map` or relation field, a `FileList` upload, `selectModel` (it stores the list item it was handed, so an id would
+  leave a stub), and any action that declares arguments no endpoint or field describes.
+
+  Nothing re-derives a name rule. An action's arguments come from the endpoint it is named after — which is not luck
+  but the house rule that makes `st.do.X` read the same as `fetch.X` — or from the field metadata the setter was
+  generated from, or from the role the store recorded while it built the slice. Two things had to be added to make that
+  possible: arity is captured in `#mergeActions` (the `st.do` wrapper takes rest arguments, so `Function.length` is
+  zero for everything by the time anyone can ask), and `ACTION_OWNER_META` records which module declared each action,
+  which is what names the dictionary node its words are read from.
+
+  **`AgentBridge`** turns that into tools with JSON schemas, checks each argument against what it declared, dispatches
+  through `st.do`, masks reads, and keeps a transcript. It holds no model, provider, or key — an app wires whichever
+  agent it uses to `tools` / `call` / `read`. `Agent.Dock` in `akanjs/ui` renders the catalogue, the refusals and the
+  transcript, and can run a tool by hand; it is how you see what a page actually publishes.
+
+  Reads are masked because they have to be: `<model>Form` holds what the user just typed, credentials included, and an
+  in-page agent ships what it reads to a remote model. The mask is by the declared model rather than by the value's
+  class, since `immerify` copies a form into a plain object and the class is gone by then. `Msg.mask` moved to
+  `constant/mask.ts` so both audiences use one implementation.
+
+  **`data-akan-action` / `data-akan-state`** are emitted by the framework's own interactive primitives, with no app
+  code at all. `onChange={st.do.setNameOnUser}` — the house form for every model field — already carries everything an
+  annotation needs; it just had no way to be read off a function, and now it does. `Input` (every variant plus
+  `Checkbox`), `Select`, `Switch`, `Button`, and the `Field.*` fields all carry it. An inline arrow gets nothing,
+  because a closure the caller wrote says nothing about what it does. Accessibility trees, E2E selectors, and external
+  browser agents get the same names for free.
+
+  **`InsightQuery`** is one read-only SQL statement, for a question the domain endpoints cannot express. Read-only is
+  enforced four ways — the statement is wrapped as a derived table, where nothing but a query is legal in either
+  dialect; a pre-execution check runs on the statement with comments and string literals removed; forbidden keywords
+  are rejected rather than trusting that Postgres refuses a data-modifying CTE inside a subquery; and the `_doc` column
+  never crosses the boundary, since that is where every maskable field lives and an arbitrary SELECT names no model to
+  mask by. Rows are capped at 1000, which no caller can raise. The timeout bounds the wait, not the query —
+  `bun:sqlite` is synchronous and holds the loop, so the ceiling is what limits that case.
+
+  What the insight query costs is worth stating: it answers "how many, since when, grouped how" over base columns and
+  the search mirror, and it cannot read a domain field. Field-level reads go through the domain tools, which mask.
+
+  `libs/shared` exposes it as `runAdminSql` on the admin signal, guarded by `SuperAdmin` and returning the new
+  `insightRows` scalar. It is a `mutation` despite not being able to write, because a `query` is a GET that never sends
+  a body — the statement would have to travel in the URL, where it lands in every access log and hits the length limit
+  — and because a query's response is memoized per URL, which is wrong for an ad-hoc statement. It is not MCP-exposed:
+  the catalogue is built once at boot rather than per caller, so publishing it would tell every client that can reach
+  `/mcp` that an arbitrary-SQL tool exists.
+
+- 5f53462: `readScreen` names every image, and can carry its address
+
+  An `<img>` with no `alt` contributed nothing at all, so a card rendering a picture read exactly like a card
+  rendering nothing — and "this page shows no image" is the one answer the screen could not support. Every image now
+  stands as `[image: <alt>]` or `[image]`, and `readScreen({ images: true })` appends `(<src>)` for handing one to a
+  tool that takes a picture. It is off by default because a gallery is one long URL per thumbnail, and a `data:` URL
+  is never printed: that is the bytes themselves rather than somewhere to fetch them.
+
+- 69f7178: fix: refuse `runAgentTurn` until the app names an `AgentRelayAccess` guard
+
+  The relay used to allow every caller and warn at boot until an app decided. With no guard it now answers like
+  `None` — `Access denied by guard: AgentRelayAccess` — and boot is silent. Name one with
+  `option.setAgentAccess(...)` (or `AgentRelayAccess.use`) before the chat can spend the LLM key.
+
+- f882bbc: Open the in-page agent's session to the host: a custom transcript store, a narrowed built-in tool set, and the
+  types a replacement transport needs.
+
+  - `persist` now takes a `SessionHistory` (`{ load, save, clear }`) as well as the web-storage option, and all
+    three methods may answer asynchronously — a transcript can live on a server. A `load` still in flight when the
+    user sends the first message is dropped rather than merged, and saves are chained so a slow store cannot land
+    an older transcript last. `session.isRestoring` reports the in-flight load — a host that opens with a prompt of
+    its own waits for it, since sending on mount is a race the restore loses.
+  - `builtins` on `Agent.Chat` and `Agent.Zone` picks which of the runtime's own tools a session gets (`false` for
+    none, an array for exactly those). A withheld name answers the same "unknown tool" an unregistered one does.
+    This is the only way to drop `navigate` inside a zone, where a same-named hook tool is registered under its
+    scope prefix and never shadows the built-in.
+  - `Agent.Zone` takes a `session` the app built (and then does not abort it on unmount) and reports it through
+    `onSession`. `Agent.Chat` takes `chrome={false}` to drop the header bar and `defaultDraft` to open with text
+    in the composer; a panel controlled without an `onOpenChange` draws no close button instead of an inert one.
+  - `onCompact(replaced, summary)` reports a compaction's cut, for a host keeping its own summary watermark.
+  - `akanjs/ui` now exports `httpRunner`, `fetchRunner`, `AgentSession`, `AgentProvider` and the `AgentRunner` /
+    `RunnerRequest` / `RunnerEvent` / `ChatMessage` / `SessionHistory` / `PublishedTool` / `ContextBlock` types.
+
+- 5f53462: Two providers that read a picture ship, and `accepts` is answered per model
+
+  Everything the framework carries for an attachment ended at a text-only provider: one chat-completions
+  `LlmAdaptor` shipped and declared no `accepts`, so an image reached the model as a note saying it could not
+  be read, and any app wanting vision wrote the provider mapping itself — role alternation, tool-call placement,
+  streaming reassembly, SSE framing, none of it app-specific work.
+
+  `OpenaiLlm` speaks the chat-completions dialect against `https://api.openai.com/v1` and declares `{ image: true }`,
+  sending an image as a content part from either carrier. `AnthropicLlm` is the Messages API and declares
+  `{ image: true, document: true }`. That dialect now lives in `OpenaiDialect`, so a
+  protocol fix lands once; Anthropic shares nothing but the wire it maps from, its system prompt being a field
+  rather than a message, its tool calls and results content blocks, its results a _user_ turn, its roles strictly
+  alternating, and its `max_tokens` required. Both new adaptors require `model`: a default would age into a 404 and
+  would decide the vision claim on the app's behalf.
+
+  `option.setLlm({ accepts })` overrides what the configured model reads. An adaptor answers for an API and one API
+  serves models that differ, so the answer rides beside the `model` it is a fact about rather than in a capability
+  table the framework keeps — a table is a claim about models that ship after it, and a provider handed bytes it
+  cannot decode either refuses the turn or accepts it having seen nothing.
+
+  `option.setLlm({ maxTokens })` is the answer ceiling for an API that requires one. A fixed default is a hazard on
+  a model that reasons before it writes: the budget goes on thinking, the turn comes back empty with a length stop,
+  and that reads as the model refusing — so an empty answer is also named in the log with the current number.
+  Sampling knobs are deliberately absent from `LlmOption`, because `temperature` is a 400 rather than an ignored
+  field on some models and the role would have to guess its legality per model.
+
+  A mangled SSE frame now costs that frame instead of the whole answer, in both stream readers: throwing lost the
+  text already streamed over one unreadable line of a protocol the caller cannot fix.
+
+  Both match an exact image-type set (`jpeg`, `png`, `gif`, `webp`) rather than an `image/*` prefix, and name the
+  rest in the text. `accepts.image` is one boolean, so `AgentService.readable` passes every `image/*` through and the
+  composer's built-in reader base64s every `image/*` — an `AttachReader` answering `null` means "not mine" and falls
+  through to it — so an app cannot gate one either. An unsupported type is not one unread attachment: it is a block
+  the API refuses, so the whole turn dies on a vendor 400, and `image/heic` is the iPhone camera default.
+
+  `OpenaiLlm` is the default. Swap with `option.applyAdaptor(LlmAdaptorRole, AnthropicLlm)`.
+
+- 5f53462: An attached image shows up, and survives a reload with its handle
+
+  The attachment chip only drew a thumbnail for an inlined `data` attachment, so an image attached by `url` — the
+  shape the per-file ceiling exists to encourage, and the only shape a deployed app produces — rendered as a bare
+  name in the composer and in every bubble. It draws either carrier now.
+
+  `sessionHistory` dropped `ref` on the way to storage. The reason content is stripped is that web storage is a few
+  megabytes and a failed save is silent; an id is not content, and it is the one thing a restored conversation has
+  left to find the file again — without it a host is back to guessing from name and size, which is the guess `ref`
+  was added to retire.
+
+  `Chips` is exported as `AgentAttachments`, so a replaced `AgentBubble` draws the attachment row with the framework's
+  rule rather than a copy of it. And a compacted attachment now says its content is gone instead of only naming
+  itself, on the same principle as every other note here: a model told only `[attached photo.png]` answers about the
+  picture from its filename.
+
+- 69f7178: feat: akanjs/ui drives itself for an in-page agent
+
+  The framework's own components now publish the controls they draw, so an app gets a working agent surface for
+  list management, tabs, paging, forms, dialogs, and the app shell without writing a line. Names are the store
+  action's wherever one exists (`setSortOfTaskInOrg`, `removeTask`), so the tool an agent calls and the action the
+  button dispatches read the same.
+
+  - **`Data.ListContainer`**, and so every `Model.AdminPanel`: view mode, sort, page size, refresh, create, the two
+    exports, and the row and modal verbs — `edit`/`view`/`remove` by id, plus `submit`, `cancelEditOf`,
+    `closeViewOf`. It also opens a `<slice>.items` resource, which is where the id for a row verb comes from.
+  - **`Tab`**, **`Dialog`**, **`ScreenNavigator`** take a `namespace` prop and publish under it. Without one they
+    publish nothing: two tabs on one screen would otherwise answer to a single name, and the first to mount would
+    lose. `Tab`'s menu registry became a `Map` of menu to disabled, which also stopped the disabled-tab fallback
+    from landing on another disabled tab.
+  - **Paging** is one shared `usePageTool`, spoken by all three components that draw a pager.
+  - **`Layout.Sider`**, **`System.SelectLanguage`**, **`Link.Back`** publish the shell controls.
+
+  **Forms fill themselves, from two sides.** An app writes no `st.tool` for a form.
+
+  A form control handed its setter **by reference** — `onChange={st.do.setTitleOnTask}` — publishes
+  `setTitleOnTask` while it is on screen. That is the same reference that already earned `data-akan-action`, so the
+  agent's tool and the person's control are one function, and an inline arrow still publishes nothing. Scoping
+  publication to the control rather than to the model is what keeps an agent out of a field the template draws
+  nothing for.
+
+  `st.use.taskForm()` adds one more: `fillTaskForm(patch)`. It takes several fields in a single call, and it is the
+  only way to reach a list, a map, or an embedded object — their rows are written through
+  `writeOnTask("payments.3.name", value)`, an inline call that can carry no annotation. It is a patch, so a field
+  left out keeps what the person typed. Its schema is every writable field, because a declaration is mount-static;
+  the **guard** is where the screen gets its say, refusing a plain field whose control is not on screen and naming
+  the ones that are. A composite is let through, because nothing can see whether its rows rendered — the one place
+  left where an agent reaches a field the screen may not draw, and server guards still apply.
+
+  Neither side touches a relation (picked or uploaded, never typed), a base document field, or a `hidden`/`secret`
+  one **at any depth**: a read of those is masked, so publishing a writer would open the door its reader is barred
+  from. A rejected third shape is worth naming — a single `writeOnTask(path, value)` tool — because its `value`
+  could only be `Any`, which this framework's own MCP layer refuses for telling a model nothing, and a mistyped
+  `path` writes a new key into the form that ships on the next submit.
+
+  Nothing publishes a lever the screen does not have. A model with fewer than two sort keys draws no sort control
+  and has no `setSortOf<Model>`; a panel with no template draws no create button and has no `new<Model>`; a list
+  that fits on one page has no pager and no `setPageOf<Model>`. Callables go to the controls by reference, so
+  `data-akan-action` lands on them and `readScreen` names each control with the word its tool has.
+
+  Three gaps in the surface had to close first, all of them consequences of the surface being declaration-only.
+
+  **A conditional surface had no legal shape.** `.exec()` is a hook, so a component can never skip the declaration —
+  which left no way to publish a tool only when the screen renders its control. A falsy name now declares the tool
+  and publishes nothing: the callable still drives the click a person makes, and the agent never learns it exists.
+  `st.useState` and `st.expose` take a falsy name the same way. An unpublished callable carries no
+  `data-akan-action`, because that attribute names a tool an agent can reach and this one cannot. This is what lets
+  a list toolbar publish `setSortOfTask` only when it actually draws the sort control, instead of paying for the
+  tool in every turn's prompt on every screen.
+
+  **A value set only the render knows had no way in.** An `enumOf` class was already a complete argument type —
+  `.arg("mode", TaskStatus)` publishes the values, refuses anything off them, and narrows the `.exec` parameter to
+  the union — but a component cannot build one, because `enumOf` registers globally. A slice's sort keys or the
+  options a prop carried could only be described in prose and hoped for. `.arg(name, type, { oneOf })` takes the
+  list the render has and publishes and enforces it the same way. Neither reaches a set that fills in _after_ the
+  first render, since a declaration is mount-static; that belongs in the tool's `guard`, which is re-read per call
+  and can name the current values in its refusal — which is what `Tab` and the pagers do.
+
+  **A list inside an `Agent.Zone` was invisible to that zone's own agent.** `useScreenScope` opened its scope at the
+  root rather than under the scope it is mounted in, so `Load.Units` inside a zone registered `<slice>.items` at the
+  top. A zone view only sees keys in its own subtree, so the root agent could read the list and the zone agent
+  looking straight at it could not.
+
+- 69f7178: fix: an undescribable `st.tool` argument withdraws the tool instead of throwing during render
+
+  `.arg(name, type)` validated the type where it was written and threw for anything that was not a scalar or an
+  enum. That check runs during render, so a model class passed to one argument of one component tool aborted the
+  server render of the whole route — React fell back to client rendering with `st.tool takes scalar and enum
+arguments only.`, a message naming neither the tool, nor the argument, nor the type.
+
+  It now withdraws the tool the way a falsy name does — nothing is published, the callable still drives the click a
+  person makes, and the page renders — and reports it as
+  `st.tool("editProject") is not published: its "info" argument is the type PortfolioInfo, and st.tool takes scalar
+and enum arguments only.` `st.useState`'s `set` degrades to read-only on the same terms. This matches what the
+  surface already did everywhere else: `FormFields` drops a field it cannot describe, and MCP refuses an endpoint
+  and names it in the boot log. An agent-tooling concern should not be able to cost a route its server rendering.
+
+  Note that form fields were never able to trigger this: `useFormTools` and `useFieldTool` build their schemas from
+  an effect, which does not run during SSR. A regression test now server-renders a form over a model carrying an
+  embedded-scalar array field to keep it that way.
+
+- 5f53462: `st.tool` describes one array level of a scalar or an enum
+
+  `.arg("bodies", [String])` and `.opt("modes", [TaskStatus])` publish `{ type: "array", items }` and check every
+  element, with `oneOf` narrowing the elements rather than the list. It is the schema `fill<Model>Form` already
+  built for an array field, so the same shape reaching an agent through a form and not through a component tool was
+  an oversight — a tool that could not say "a list of these" taught the format in prose, and the app then owned a
+  parser for it.
+
+- 69f7178: fix!: publish only what a component declared to the in-page agent
+
+  This supersedes the store-derived in-page surface described in the earlier entries of this release: the store
+  catalogue keeps its state half, and its action half is gone.
+
+  An in-page agent stands in for the person looking at the screen, so what it may do is what that screen offers them
+  and nothing else. Deriving its tools from the store missed that by one level: liveness was per _store_, so a single
+  `st.use.me()` in a gating component published every method the admin module had ever declared — `setAdminPassword`
+  among them — and `readState` reached every key of that store rather than the keys the screen reads. Levers the
+  screen does not have are not reach, they are noise the model pays for on every turn.
+
+  **`st.tool` is the only way an action reaches an agent.** The store catalogue's whole action half is gone: endpoint
+  argument borrowing, generated form setters, slice actions, no-argument custom actions, the arity check against the
+  same-named endpoint, the JSON-schema build, the argument checking, `AgentBridge.call`, and its transcript. A store
+  method reaches an agent by being wired into one — `.exec((id) => st.do.removeX(id))` — which is also the shape that
+  hands the same callable to `onClick`, so the person and the agent press one handler. `remove*` still confirms by
+  default; the gate moved to `StToolBuilder` with everything else.
+
+  **Reading is per key, not per store.** `AgentBridge.read` gates on the key being subscribed in that view, so a
+  component reading `userList` says the screen shows a list and says nothing about the `userForm` beside it in the
+  same store. The catalogue keeps its state half, because a read has to be masked and only the store declares which
+  model masks it.
+
+  **`static agent` is gone.** It existed to trim an exposure nothing derives any more, so a store class now says
+  nothing about agents at all — which is the same rule as the tools. `st.use.x({ agent: false })` is how the
+  component that subscribes a value keeps it off the surface, and it is the component's call because the component
+  is what put the value on screen. Delete any `static agent` declaration; there is no replacement to write.
+
+  Base-store plumbing follows the same rule as any other key: `st.use.path({ agent: false })` and
+  `st.use.tryJwt({ agent: false })` keep routing and the caller's credential off the surface at the call site. The
+  route block still carries pathname, params, and searchParams. A screen that wants an agent to read a base key
+  opts it in — ThemeToggle subscribes `theme` without the opt-out.
+
+  **`Agent.Dock` reads the surface** rather than the store, so its tool list is what the page declared, and
+  `AgenticSurface` keeps the last 200 calls so the transcript now covers every tool instead of the store's own.
+
+- 5f53462: A turn the provider cut off says so, instead of passing as a finished one
+
+  `LlmTurnAnswer.stop` gains `"length"` — `finish_reason: "length"`, `stop_reason: "max_tokens"` — and it rides the
+  wire and the `AgentStop` enum to the browser. It is not one provider's quirk: every adaptor here reports it,
+  including the default, and only the shape of the union was hiding that.
+
+  Without it a truncated answer arrived as `stop: "end"` and the user read half a sentence as the whole reply. Worse
+  on an agent surface: a turn cut off mid tool call carries no complete call, so it ended the loop looking exactly
+  like a model that had decided it was done — a hang the transcript explained as a choice. The session now records
+  the turn as incomplete on the assistant message the user is reading, and closes any call the turn did make rather
+  than running it, since a batch the model was interrupted inside is half an intention.
+
+  The ceiling wins over the calls that did arrive, in both adaptors and on both the streamed and whole paths.
+
+- f882bbc: fix: `st.expose` / `st.useState` typed `String` or `Boolean` resolve to the scalar, not to a model state object
+
+  `AgentValueOf` matched a declaration's `FIELD_META` before its `CLIENT_VALUE`, and `via.ts` augments the global
+  `String`, `Boolean`, `Date` and `Map` constructors with `DatabaseConstantStatics` — which carries `FIELD_META`. So
+  those constructors read as model classes: `st.useState("tab", String, { set: true }).desc("…").init("all")` handed
+  back `GetStateObject<String>` instead of `string`, and the same for `Boolean`. `Date` escaped only because it is
+  special-cased above, and `Int` / `Float` / `ID` / `Any` are declared classes rather than augmented globals.
+
+  Only the value `st.useState` returns was wrong. `.value()` on `st.expose` kept accepting the literal, because a
+  string is assignable to `GetStateObject<String>` — which is exactly why nothing caught it: the runtime, the
+  schemas, and every `st.expose` call site were correct throughout.
+
+  A scalar is now matched by `refName`, above the model branch. A model carries no `refName`, so nothing about the
+  model path changes — a model still resolves to its state object and still takes a hydrated document or a plain
+  copy of one. `AgentValueOf` is pinned branch by branch in `AgentValue.test.ts`, and `StStateBuilder.test.tsx`
+  covers a `String` and a `Boolean` state end to end.
+
+  Anyone on `3.0.0-alpha.53` who worked around this with `as unknown as string` / `as unknown as boolean` on an
+  `st.useState` result can delete those casts.
+
+- 69f7178: feat: the in-page agent waits for the screen, aims its reads, points at things, and says what it is doing
+
+  **A tool that changes the screen now waits for the screen before it answers.** `router.push` returns while the RSC
+  payload for the new route is still in flight, so `navigate` used to report success onto a page that had not
+  rendered yet: the `readScreen` in the same turn read the page the user had just left, and the new route's tools were
+  not registered. `ScreenSettle.wait()` waits for DOM quiescence — bounded, and quiescence rather than a framework
+  signal because the client router hands its promise to nobody and a change may land in the store, in a refetch, or
+  in a streamed Suspense boundary. `navigate` awaits it, and `AgentSession` awaits it after every non-`query` tool
+  before taking the change report, so an optimistic action that commits a tick later is reported as what it did
+  rather than as the moment before it. Tools and state from a fresh route are still only listed from the next turn —
+  the catalogue is snapshotted when a turn starts — and the navigate result says so.
+
+  **`goBack` joins `navigate` as a global built-in.** It was briefly declared by `Link.Back`, which made it exist
+  only where a back link happened to be rendered — but history is not a control a page owns: every route has a
+  previous page, the browser's own gesture is always there, and a page that draws no back link is not a page you may
+  not leave. It refuses at call time when nothing is behind the current page instead of walking out of the app.
+
+  **`readScreen` takes a `section` and there is a new `highlight(target)`.** Both resolve a name the agent has
+  already seen rather than a selector it invented: a `data-akan-action` / `data-akan-state` annotation (the one
+  `readScreen` prints beside a control), an `Agent.Zone` or `useScreenScope` container, an element id, or a heading
+  by its own text — matched on letters and digits, so the slug an agent writes for a heading it read resolves. That
+  tolerance stops at headings: a heading is a landmark and scrolling to the wrong one costs nothing, while two
+  buttons reading "Save" are not the same control. Nothing hidden resolves at all, because a ring nobody can see
+  reads as a broken tool rather than as a miss. A name that resolves to nothing is the caller's mistake, with a
+  refusal that lists the sections actually on screen.
+
+  **A screen is only aimable if its names are printed**, which is what the first version got wrong: a page of twenty
+  `Scroll.Slide` sections answered "nothing on this screen carries a name", because `readScreen` printed the heading
+  text without its anchor and the truncation note stopped at a character count. Headings now carry `(#anchor)` when
+  they open an id'd or scoped container, and a truncated read ends with the headings below the cut — otherwise
+  everything past the 8000-character limit is unreachable, since nothing names it. `highlight` flashes **after the
+  scroll lands**: a smooth scroll across a long page outlasts a flash begun at the top, which is the same bug wearing
+  a different hat. `useScreenScope` now hands
+  back its scope path and `Load.Units` / `Load.View` / `Data.ListContainer` put it on the container they render, so
+  every list and detail view on an akan screen is addressable with no app code. `highlight` scrolls its target into
+  view and flashes it on the app's own primary token: it is the one built-in that exists for the _user's_ benefit,
+  because showing where a control is beats writing directions to it.
+
+  **A slow tool can say what it is doing.** `AgentProgress.report(message, { done, total })` is the browser twin of
+  `McpProgress.report` — reached through a module slot rather than a parameter, so work several frames down (a store
+  action, an upload loop, an adapter) reports without every signature growing a channel argument, and a no-op when
+  nobody is rendering it. The chat shows the report on that call's row until the row resolves. A session runs tool
+  calls one at a time, which is why the browser needs no `AsyncLocalStorage` to do this.
+
+  **The turn cap is a question instead of a dead end.** At `maxTurns` the session asks whether to keep going through
+  the same card `askUser` uses, and the answer rides as the user's own turn — so a steer typed instead of the
+  keep-going choice reaches the model as guidance rather than being swallowed. A host that renders no
+  `pendingQuestion` passes no `continueAsk` and keeps the old failure, because asking with nobody listening would
+  hang.
+
+- 69f7178: feat: the in-page agent waits out long work instead of polling it, and Stop reaches a tool that is still running
+
+  **An agent that started something slow had one way to learn it finished: ask again.** Every look is a full model
+  round trip, so a two-minute video generation burned the default eight-turn budget in about twenty seconds and read
+  to the user as check → wait → check → wait, forever. Two things change.
+
+  **A tool that awaits its own work now holds the turn, with no model round trip in between.** This always worked —
+  the session awaits `#execute` and `AgenticSurface.call` awaits `entry.run` — but nothing said so and nothing made
+  it safe, so apps wrote fire-and-forget tools and left the agent to poll. The shape is one `st.tool` whose `.exec`
+  awaits the store action that finishes the job; the change report that follows carries whatever landed while it
+  waited, so the model needs no second call to read the result.
+
+  **Stop now ends a turn parked inside a tool.** `AgentSession` passed its abort signal to the approval and question
+  cards and nowhere else, so a call that took two minutes held the loop for two minutes after the user pressed Stop,
+  with the chat still showing a turn in flight. Latent until now, and a certainty the moment a tool is allowed to
+  wait. The session races every call against the signal, and hands the signal to the tool through `AgentAbort` — the
+  module slot `AgentProgress` already is, for the same reason: work several frames down reads it without every
+  signature between here and there growing an argument, and a session runs tool calls one at a time. Honouring it is
+  optional, since the race lands whatever the tool does; what it buys is the tool's own cleanup, such as a timer that
+  would otherwise tick out its whole timeout with nobody left to answer. A tool that ignores it is left running
+  rather than cancelled — the work is usually a job a server is already doing, and throwing away a result that is
+  about to land helps nobody.
+
+  **`AgentAbort` and `AgentProgress` are re-exported from `akanjs/store`.** `AgentProgress` had no export path an app
+  could legally use, `use-agentic` being a third-party import from `apps/**` and `libs/**`, so the documented advice
+  to report progress from a slow tool was not followable. A tool that can neither report progress nor honour Stop is
+  exactly the tool this release exists to make writable.
+
+- 5f53462: An endpoint's declared `timeout` bounds the call, on both ends, instead of being read by nobody
+
+  `mutation(cnst.X, { timeout: 5 * 60 * 1000 })` could not work. The value had exactly one reader — the `Timeout`
+  middleware, which no app registers because it is opt-in — it was never serialized to the client, `FetchPolicy.timeout`
+  was accepted by the public type and dropped by `#makeHttpFn`, and `HttpClient` was constructed without one, so every
+  non-upload request was abandoned at the client's hard-coded 30 seconds and restored as `base.error.gatewayTimeout`.
+  Anything whose real work outlives half a minute — hardware provisioning, a firmware flow, an SSH round trip, an
+  external orchestration — was unreachable from a browser, and the declaration on the endpoint read as if it were
+  configured.
+
+  The declared value now travels. `FetchSerializer` puts it on the serialized endpoint and `fetch.<endpoint>()` makes
+  it that request's budget, a caller overrides it per call with `{ timeout }` (`false` waits as long as the runtime
+  will), and an app moves its own default with `fetch.instance.setTimeout(ms)` — precedence caller, endpoint,
+  client default, with an upload still bounded by nothing. Server side the middleware is registered by default and has
+  **no default of its own**: it stands aside for every endpoint that declared nothing, which is what makes registering
+  it safe, and what made the 5-second fallback it used to apply the reason it could not be. It now rejects with a 504
+  carrying `base.error.gatewayTimeout` rather than a bare `Error` that `SignalFailure` generalized to a 500, so both
+  sides of a deadline produce the sentence the dictionary already had, and it clears its timer — the loser of the race
+  was a pending timer per call, holding the event loop for the whole budget on a call that answered immediately.
+
+  What is still true, and is now written down: losing the race does not cancel the work. `Promise.race` cannot reach
+  into `next()`, so a handler that timed out runs to completion with nobody holding its result. A `timeout` bounds
+  what a caller waits for; an operation that must not half-happen needs its own idempotency.
+
+  `cache` had the same shape and got the same treatment. The `Cache` middleware was opt-in, ignored the declared
+  `cache` value for a hard-coded 60 seconds, and — had anyone registered it — would have cached every endpoint in
+  the app including mutations, under a key that names only the endpoint and its arguments, on a hit that skips
+  `next()` and therefore skips the guards. It is now registered by default, reads the declared value as its TTL,
+  runs `context.checkGuards()` before handing an entry over, and takes an entry only for a `query` that declares no
+  internal argument — internal arguments are how a call learns who is asking, so an endpoint that has them answers
+  per caller and a shared entry would be one caller's answer handed to the next. A `mutation` or a per-caller query
+  that declares `cache` is named once in the log instead of being silently ignored, and a cache backend that is down
+  is warned about rather than failing the call.
+
+  `Retry` is removed. Three attempts with a fixed backoff, on an endpoint whose failure it cannot classify, replays
+  whatever the first attempt already did — and it was unreferenced.
+
+- ccf2ae2: An app's or lib's typecheck no longer fails with TS7016 on `react-server-dom-webpack/client.node` once an install
+  links the package into `akanjs`: the SSR renderer references the ambient declarations it needs itself.
+- 5f53462: fix: scope the auth cookie and storage key to the app so two apps on one host stop clobbering each other
+
+  Cookies carry no port (RFC 6265), so every app served from `localhost` shared one jar. Under the global `jwt`
+  key each signin overwrote the neighbour's session, and the JWT's own `appName` check only turned the surviving
+  cookie into a credential that fails every guard — the other app fell back to anonymous, guard failures, and a
+  login wall.
+
+  The key is now `jwt:<appName>`, written by `setAuth` to both the cookie and client storage and read by
+  `getAccount`, `initAuth`, the SSR `fetchClient` credential, the websocket credential snapshot, and the CSR boot.
+  `authTokenKey()` and `getAuthToken()` are exported from `akanjs/client` (and `authTokenKey`, `readAuthToken`,
+  `isOwnAuthToken`, `isAuthTokenKey`, `cookieHeaderHasAuthToken`, `legacyAuthTokenKey` from `akanjs/common`) so an
+  app's own middleware reads the same key instead of spelling it out. Read the cookie through `getAuthToken()`
+  rather than `getCookie("jwt")`.
+
+  `initAuth` now checks the token's `appName`/`environment` before handing it to `fetch.setJwt`, which it never
+  did: a `?jwt=` for another app used to ride along on every request. A mismatch is ignored, and clears the cookie
+  when it came from this app's own key.
+
+  **Breaking, with a migration path.** Reads still fall back to a pre-scoping `jwt` cookie, but only when the
+  token's payload names this app — so an existing session survives the upgrade and a neighbour's leftover is never
+  adopted. Writes only ever use the scoped key and delete the legacy one. The fallback is temporary; once
+  deployments have rotated past it, the legacy read goes away and a stale session needs one re-login.
+
+- 69f7178: fix: a `Boolean` argument parses the text the wire actually carries
+
+  A query string carries text, so `.search("archived", Boolean)` handed `Boolean._parse("true")` a string and threw
+  `Invalid Boolean value: true` before the endpoint ran. The framework's own client sits on the other end of that —
+  `HttpClient.makeUrl` writes `String(value)` — so no caller could reach such an endpoint, hand-written URL or not.
+  `Int` and `Float` never had the problem because their `parseValue` is `Number(input)`, which absorbs a string;
+  `Boolean` was the one primitive that compared against `true` / `1` and nothing else.
+
+  The normalization lives on the primitive rather than in the search-arg branch, because text is what three separate
+  paths deliver: `URLSearchParams.get`, a path `.param()`, and every field of a `fileUpload` mutation's `FormData`.
+  One place to normalize is also one place to keep the accepted set from drifting apart.
+
+  `true` / `false` / `1` / `0` are accepted, trimmed and case-insensitive — `str(True)` from a Python client is
+  `"True"`, and a 500 is a poor answer to it. `""` and `"yes"` are still refused. An empty query value is a question
+  about nullable search args in general rather than about booleans: `Int` reads `""` as `0` today and `String` reads
+  it as a legitimate value, so answering it for one scalar alone makes the set less predictable, not more.
+
+  `serializeValue` takes the same spellings, since the client serializes an argument before `makeUrl` stringifies it
+  — a `<select>` value handed to a `Boolean` argument now normalizes on the way out instead of throwing.
+
+- 2d8de1c: feat: helpers the code cleanup made public
+
+  Consolidating duplicated helpers left a few new public names. Each is an addition; nothing was renamed or removed.
+
+  - `akanjs/common`: `isRecord(value)` (a type guard for an object that is neither `null` nor an array),
+    `round(value, digits = 3)` and `toError(reason)` (an `Error` as is, anything else wrapped in one).
+  - `akanjs/document`: the `SaveEventListener<Doc>` type, the listener `listenPre` / `listenPost` take.
+  - `akanjs/server`: `ProcessMetricsCollector.startReporting(report)`, which reports once and then on every memory-log
+    interval and returns the timer.
+  - Subpath exports `akanjs/server/artifact/routeSeedIndexStore` and `akanjs/server/artifact/routesManifestStore`, so a
+    published `@akanjs/devkit` can read and write those artifacts without loading the whole server barrel.
+
+- 5f53462: fix(cli): scaffolds name their guards, and the mobile and package commands do what they say
+
+  Guards and templates:
+
+  - The module scaffold's slice is `{ root: Admin, get: Public, cru: Admin }` when the workspace mounts libs/shared,
+    and `{ root: None, get: Public, cru: None }` — closed until you name a guard — when it does not; its sample slice
+    and the sample app's `inPublic` take `init({ guards: [Public] })`. `cru: Public` is gone.
+  - `akan add-mutation` / `add-slice` write `mutation(Boolean, { guards: [None] })` / `init({ guards: [None] })` and
+    import `None`, and their surface step returns a review note instead of stopping as unsupported.
+  - The sample app's `SignedIn` admits only a caller with an identity (`id`, or libs/shared's `self` / `me`); a guest
+    carries an account object too and used to pass. `CurrentUserId` reads the same three places, and the sample's
+    task fixtures sign a user in through libs/shared when it is installed. Its spec holds no assertions.
+  - Every scaffolded abstract has the current shape — a title, one sentence and `## Rules` — instead of six headings
+    of placeholder text: `create-module` writes `# <model> Abstract` with its guard and soft-removal rules,
+    `create-service` writes `# <service> Service Abstract` and `create-scalar` `# <scalar> Abstract`, each with a
+    placeholder sentence and two placeholder rules. The sample app's task, noti and workHistory abstracts state their
+    real invariants instead of describing the module layout. The dead `module/__model__.abstract.md` template is
+    removed.
+  - `create-crud-page` imports from the module's own client (`@libs/<lib>/client` for a lib module), and
+    `create-package` writes a tsconfig that extends the workspace root from any depth and references no missing file.
+  - `akan add-field --default now` (and every Date default) writes a thunk, `() => dayjs()`.
+
+  CLI and mobile:
+
+  - iOS usage-description keys map to Apple's real Info.plist keys (`NSPhotoLibraryAddUsageDescription`,
+    `NSPhotoLibraryUsageDescription`, both location-always keys) instead of `NS` + the option name.
+  - A non-main server's `assetlinks.json` also lists `<appId>.debug`, so a debug build's App Links can verify.
+  - `start-ios` takes `--no-allow-provisioning-updates` (short flag `-a`); every boolean option that defaults to
+    `true` now accepts `--no-<name>`.
+  - `akan update` installs `@akanjs/cli@<tag>`, the package that provides the `akan` binary.
+  - `sync-package` reads package dependencies again (the tsconfig paths start with `./pkgs/`).
+  - The quality scanner no longer recommends the nonexistent `akan compact`; `AbstractDoc.compactMinLines` is gone.
+  - `--role` lists `federation`, and `--since` names its units.
+
+- 8c31d54: fix: `akan code` says when compaction failed, leaves the Claude Code-sized buffer, and resolves its default model
+
+  **A failed compaction read as a successful one.** The engine reports a compaction that failed or was cancelled on
+  the same `compaction_end` event as one that worked, with `errorMessage` and `aborted` beside the reason. The wire
+  kept only the reason, so every end printed "Compacted the conversation" — including an automatic compaction that
+  had failed, which nobody else reports, leaving the next sign of it an overflow error turns later. The `compaction`
+  frame now carries `error` and `aborted`, and the transcript prints the engine's own sentence as a warning, or
+  "Compaction cancelled.". A failed `/compact` still reports once, through the caller it threw to.
+
+  **The buffer is 32,768 tokens, up from the engine's 16,384.** On a million-token window that moves the threshold
+  from 98.4% to 96.7% — where Claude Code compacts. The reserve is all the room the response at the threshold gets
+  (the request clamps its output to the window less the prompt less 4,096), so at 16k a reasoning model ran out
+  mid-thought there and the recovery re-sent a near-full window to retry. It is also the summary's output cap at 80%.
+  The small-window warning now reads the settings the session actually runs with rather than the engine's defaults.
+
+  **The default model is `deepseek/deepseek-flash`.** `deepseek-v4-flash` is gone from both the engine's catalogue
+  and DeepSeek's own model list, so the default resolved to nothing and `akan code` silently ran on whichever model
+  sorted first among those with a key.
+
+- ccf2ae2: fix: the server compresses only whole, modest bodies
+
+  `compressResponse` buffered and brotli- or gzip-compressed any body of a compressible type on the event loop, whatever
+  its size, and answered a `Range` request with the whole body compressed. It now leaves alone a request with a `Range`,
+  an answer that is partial (`206`, `Content-Range`) or not a success, and one whose `Content-Length` is over 4 MiB
+  (compressing blocks the loop about 6 ms per MiB with brotli, 12 with gzip). The gateway keeps an upstream's
+  `Content-Length` unless it had to drop the upstream's encoding, so the limit holds behind it too.
+
+- 5f53462: fix(console): a production `akan console` brings services up and starts no schedule
+
+  The `console.js` an `akan build` writes never marked its process as a console, so `server.start()` took the replica
+  branch: it registered every `interval` / `cron` / queue worker, ran every internal `init()`, and opened the log
+  transport — a second scheduler inside a running deployment. The shim now marks the process before it loads the
+  server, the same way `akan console` does in development, so a console runs service and adaptor `onInit` and nothing
+  the internals schedule.
+
+  `assertAkanConsoleAllowed()` was handed `server.env`, which carries neither `environment` nor `operationMode`, so it
+  effectively checked `NODE_ENV` alone. Called with no argument it now reads the deployment from `AKAN_PUBLIC_ENV` /
+  `AKAN_PUBLIC_OPERATION_MODE` (deriving the mode the way `getEnv()` does): a `main` environment, a `cloud` or `edge`
+  operation mode, or `NODE_ENV=production` refuses the console unless `AKAN_CONSOLE=1`.
+
+- 5f53462: fix(signal): the cross-site gate compares hosts, so a TLS-terminating proxy no longer refuses every mutation
+
+  An app reached through a Cloudflare tunnel — or any edge that terminates TLS and forwards no
+  `x-forwarded-proto` — answered `403 This request was not permitted.` to every mutation. The browser sends
+  `Origin: https://app.example.com`; the request reaches the server over plain HTTP, so the origin it computed for
+  itself was `http://app.example.com`, and the full-origin comparison made the app cross-site to itself.
+
+  `CrossSiteGuard.assertOrigin` now compares the `Origin` header's **host** against the host the request arrived on
+  (`x-forwarded-host`, else `Host`), which is the comparison `McpRouter` already made for the same reason. The CSRF
+  property is unchanged: the host is written by the browser from the URL it was told to open, so a page on another
+  site still arrives with this deployment's host and its own `Origin`. Only the scheme distinction is dropped — the
+  one part of an origin a proxy routinely loses — and what that costs is a page served over plaintext on the same
+  host, which is an attacker who already holds the name. An explicit `:443` in a forwarded host and its absence in
+  `Origin` now compare equal too.
+
+  A refusal logs the host it was measured against (`... (request host app.example.com)`), so a proxy misreporting
+  the host reads differently from a missing `allowedOrigins` entry and from an attack.
+
+- ccf2ae2: fix(dev): a CSR dev save reaches the open tabs before `app.js` is rewritten, and a tab opened in between boots once
+
+  A dev CSR save used to rewrite the whole `app.js` before telling the open tabs about the patch, although only a tab
+  that boots later needs it. The patch is now announced first and `app.js` follows. The manifest records which
+  generation `app.js` holds (`appGeneration`), and the server holds a booting tab's `app.js?g=N` for up to two seconds
+  until the file holds `N`, instead of booting it one generation behind and reloading it again. A build that died in
+  that gap leaves `app.js` behind; the next update rewrites it even when nothing else changed.
+
+- ccf2ae2: perf(dev): a CSR dev save is patched by the resident builder, without spawning a build worker
+
+  - The dev builder keeps the CSR registry's graph, manifest and module factories in memory and compiles a save itself.
+    A save no longer pays for a build worker's spawn and imports (about 130ms on minimal) or a pass over every module
+    file, and `app.js` is rebuilt from memory after the patch is announced.
+  - A save that needs a whole-app build still goes to a build worker, which exits and returns its memory: a first build,
+    a config or signal/dictionary change, a new npm module, and an import no recorded resolution answers.
+  - The builder works in two lanes. A save's codegen and CSR patch run in one, and the file watcher waits only for it;
+    build workers, route builds and client-entry discovery run in the other, where a batch queued behind another folds
+    into it. Consecutive saves no longer wait behind each other's pages and css builds, and css now builds before pages.
+  - `AKAN_DEV_CSR_PATCHER=off` sends every CSR save to a build worker as before. A builder that dies mid-patch turns the
+    patcher off until the dev server next replaces its builder and backend together (a config, signal or dictionary
+    change), and says so.
+
+- ccf2ae2: fix: a CSR page on another origin loads stored file URLs from the server
+
+  A file row keeps its URL relative to the server that wrote it (`/api/localFile/getBlob/...` with blob storage). A
+  native shell serves the page from `app://localhost` or `https://app.localhost`, so the relative URL resolved against
+  the app and the image never loaded. `resolveServerUrl` (`akanjs/client`) resolves an API-prefixed relative URL
+  against `serverHttpUri` when the page's origin is not the server's, and leaves every other URL alone. `CsrImage`
+  (so `Image` in a CSR bundle), agent attachments, and `libs/shared`'s editor images, videos, mention avatars, file
+  download links, file gallery and Excalidraw images use it; Excalidraw stores the URL relative again.
+
+- ccf2ae2: A CSR page renders when the app's root layout sits in a route group, inside the layouts that wrap it
+
+  - An app whose root layout is `page/(app)/_layout.tsx` rendered an empty `#root` on every CSR page — `?csr=true`,
+    `/__csr` and native builds — with nothing in the console: the CSR route table left a route group's layout out of the
+    root, so no route had a root layout, while the SSR route tree rendered the same pages fine.
+  - The CSR route table and the SSR route tree now place layouts through one rule: the root layout is the first root
+    boundary the page generator writes a `__root_layout` for, the one that carries `System.Provider`. Every layout below
+    it — `(app)/(public)/_layout.tsx`, a nested boundary such as a `(tab)` group's — wraps the pages. In CSR that is what
+    keeps a lock screen or a nav in `(public)/_layout.tsx` around the page instead of in the provider's hidden container.
+    SSR renders the same element tree as before; those layouts' route segments are now keyed as layouts, not roots.
+  - A route that still ends up with no root layout throws `[csr] no root layout for <path>` instead of rendering nothing.
+
+- ccf2ae2: fix(csr): an entry of the same route shows its own content, the first page is cached, and a page nobody sees stops
+  its effects
+
+  - **Same route, new entry, new content.** `/item?id=1` → `/item?id=2` kept showing the first entry: `RenderLayer`
+    resolved a route's async render once per mount. It now renders again when an argument the route declares with
+    `.param()` / `.search()` changes, layouts included, and keeps the previous result on screen until the new one lands.
+  - **The page a session opens on is cached** like any page reached later. The history it seeded never put it in
+    `cachedLocationMap`, so it unmounted two steps away.
+  - **Every page container but the current one is `inert` and `aria-hidden`,** frame slot targets included, so Tab focus,
+    a screen reader and the agent's `readScreen` no longer reach the page under the current one.
+  - **A page nobody sees keeps its state but stops its effects.** A cached page, and the page a transition-less switch
+    left (tab to tab) once it settled, render inside React's `<Activity mode="hidden">`: DOM and state stay, intervals
+    and subscriptions stop, and both come back with the page. The page under an animated transition stays live, since a
+    swipe back shows it.
+  - `idxMap` and `scrollMap` are keyed by the entry's `href` on both sides. `CSR.tsx` read them by pathname, so the page
+    under a query-string entry lost its stacking order.
+
+- 5f53462: `akan start` sizes its boot wave against the machine instead of always booting one app at a time.
+
+  - With no `--concurrency`, the wave is `min(apps, half the memory budget / ~1.8GB per app, cores / 4)` and never
+    below one, so a laptop boots its apps together while a small container still staggers them — which is the case
+    the old default of 1 existed for. 1.8GB is a cold boot's peak: the SSR registry's boot build adds a build worker
+    to every boot, and apps/akan's whole dev host peaks at about 1.76GB.
+  - The next wave starts once each app of the previous one serves and its builder's boot builds have settled — the SSR
+    registry's, and CSR's when `AKAN_DEV_CSR_REBUILD=1` arms it — or 30 seconds after it serves. The app shows as ready,
+    and `--open` opens it, as soon as it serves.
+  - The memory budget is the smaller of the host's RAM and `AKAN_MEMORY_LIMIT` / the cgroup limit. `os.freemem()` is
+    not consulted: it counts free pages rather than reclaimable ones and reports ~0.3GB on an idle 48GB laptop, which
+    would pin every machine to one app at a time.
+  - The session prints the wave size and what set it, so a boot that still waits app by app says why.
+  - `--concurrency <n>` is unchanged as an override and is clamped to the number of apps selected.
+
+- ccf2ae2: fix(dev): dev documents skip the browser's HTTP cache, the HMR socket answers only its own origin, and superseded server bundles are removed during a session
+
+  - Under `akan start`, SSR pages and the dev CSR shell are sent with `Cache-Control: no-store`, so going back to a
+    page no longer replays a document rendered by a build the server has moved past. `akan build` output is unchanged.
+  - `/_akan/hmr` refuses an upgrade from a page on another origin, by the rule mutations already follow (the serving
+    host, the native shells, and `allowedOrigins`): its messages carry build errors and the names of the files being
+    edited, which a `--share` visitor's page or another site open in the same browser could otherwise read.
+  - A render error's overlay clears once the page renders again, instead of staying on every tab until it reconnects.
+    The HMR socket's reconnect backoff starts over at the server's hello rather than when the socket opens, so a
+    gateway whose upstream keeps failing is no longer asked every 250ms.
+  - A pages build that changes server output no longer leaves the bundle before it in `.akan/artifact/server` for the
+    rest of the session (8MB on minimal, 21MB on apps/akan): each time the RSC worker takes a new bundle, the ones it
+    has moved past that are over a minute old are removed, so a burst of saves leaves its bundles only until the next
+    server-side save after it. A CSS change removes the stylesheets no tab can still link to the same way.
+  - `getAkanHmrPhase()` and `isAkanHmrApplying()` from `akanjs/common` are deprecated: nothing sets the phase any more,
+    so they always answer `null` and `false`.
+
+- ccf2ae2: fix: a dev build of the iOS, Android or desktop app waits for a page the dev server is still building
+
+  The native dev gateway served with Bun's default 10 s idle timeout, so the first request for a page the dev server
+  was still building (27 s for a small app on a Windows VM) was closed under the app, which then fell back to its
+  bundled files: a dev build carries none, and the window stayed blank until the next reload. The gateway now keeps
+  the request open until the dev server answers.
+
+- ccf2ae2: feat(dev): a dev save now says where its HMR latency went
+
+  - Each save carries epoch-ms marks from the file watcher to the page: the first fs event and the watcher's flush,
+    the builder picking the batch up, the build worker's spawn, start and imports, the update on disk, the send, the
+    backend's broadcast, and the page receiving and applying it. The page keeps the last 64 in `__AKAN_HMR_TRACES__`.
+  - `AKAN_DEV_WATCH_DEBOUNCE_MS` sets how long the watcher collects changes before it hands a batch over.
+
+- 69f7178: fix(dev): `akan start` is the dev server even when the environment says `NODE_ENV=production`
+
+  An ambient `NODE_ENV=production` turned every route of the dev server into a 500:
+
+  ```
+  [SSR] render failed scope=/en/: [SSR] route /:lang missing from production artifact — rebuild with `akan build` to include it
+  ```
+
+  `WebRouter` picked its mode from `NODE_ENV` alone, so it installed the production route cache — the one whose
+  `buildRoute` throws because `akan build` was supposed to have written a routes manifest already. A dev artifact
+  never has one, so nothing could render, and the same ambient value also sent the gateway's runtime directory to
+  `<workspace>/runtime` and baked production React into the dev bundles.
+
+  The value does not have to be exported to arrive: Bun auto-loads the workspace `.env`, so a `NODE_ENV=production`
+  line in a downloaded env file reaches the CLI while `env | grep NODE_ENV` in the shell stays empty. A CI image
+  default or a container base image does the same.
+
+  **The command now outranks the environment.** `akan start` pins `NODE_ENV=development` for the processes it
+  spawns and for the in-process builder that bakes the value into dev bundles; `AkanApp` resolves a child's
+  `NODE_ENV` from `AKAN_COMMAND_TYPE` before falling back to the inherited value; and `WebRouter` refuses the
+  production branch outright while dev-hosted, warning once that it did rather than failing every request. Running
+  a built artifact (`bun main.js`, Docker) is untouched — it carries no command type and keeps honouring
+  `NODE_ENV`.
+
+- 69f7178: fix(server): refuse the boot when two owners claim one `use` key or adaptor `refName`
+
+  Both registries were plain last-write-wins. A `use` key two libs both declared, or an adaptor `refName` two
+  classes both carried, silently kept the second: the first value was gone and the replaced adaptor's `onInit`
+  never ran. Neither left a trace, and an app whose `option.ts` shadowed a lib's key looked like it worked.
+
+  Registering either twice now fails `DiLifecycle` construction, naming the key and both claimants:
+
+  ```
+  [DI:adaptor] 1 duplicate registration(s):
+    • "imageStorage" is registered by service "article" and by service "gallery"
+  ```
+
+  The check is per key, not per registration. One adaptor class reached from two services is one adaptor and
+  passes; a predefined role rebound with `applyAdaptor` is one class and passes. Only two _different_ classes under
+  one `refName` clash — which is the case that used to defeat an override silently, because the collected class won
+  the map while the role kept pointing at the other one.
+
+  `AkanOption.getUses(env)` returns `[key, value][]` instead of a merged record, so a key declared twice inside one
+  option is caught the same way as one declared across two libs. Nothing outside the framework calls it.
+
+- 69f7178: fix(dictionary): restore the translate keys an extending dictionary inherits from the lib it extends
+
+  `ModelDictInfo` briefly carried an extra generic parameter, placed before `ErrorKey` and `EtcKey`. The three
+  positional lists that merge two dictionaries — `AnyModelDictInfo`, and both halves of `MergeTwoModelDicts` — were
+  not extended with it. Every parameter has a default, so supplying one too few is legal TypeScript: inference
+  shifted by one slot and the last parameter fell off the end into its default.
+
+  For an app dictionary built as `modelDictionary(["en", "ko"], ...setting.dictionaries)`, that meant:
+
+  - `EtcKey` (the `.translate()` keys) became `never` — `l("setting.updateSuccessMsg")` for a key the _lib_
+    declared stopped typechecking, in an app whose own source had not changed
+  - `ErrorKey` was read one slot early, so `${refName}.error.${ErrorKey}` was built from the translate keys instead
+
+  Only the types were wrong. `modelDictionary` returns the base instance and the extending chain mutates it, so
+  every entry was still there at runtime — which is why the failure surfaced only as a typecheck error in
+  downstream workspaces, and why re-declaring the key in the app (the obvious workaround) silenced it while
+  duplicating a translation the lib already owned.
+
+  Both a runtime test (an extending dictionary keeps the base's `translate`/`error` entries) and type assertions
+  over the merged `EtcKey` now cover it, and the positional lists carry a note that adding a parameter means adding
+  it in all three places.
+
+- f882bbc: Resolve a dictionary key whose enum value contains a dot, so `l("llmModel.gpt-5.6-terra")` returns its label
+  instead of the key itself.
+
+  Enum entries are stored under the value verbatim — `llmModel["gpt-5.6-terra"]` is one object key — but every
+  reader went through `pathGet`, which splits the whole key on `.` unconditionally. A value carrying a dot was read
+  as `llmModel → gpt-5 → 6-terra`, so it missed: `l()` and `l._()` rendered the raw key on screen (enum labels in
+  `Field` selects, the constant and signal doc pages), and `DictionaryLookup` returned `undefined`, dropping the
+  description from the MCP catalogue and the OpenAPI document. `<value>.desc` missed the same way. Nothing warned,
+  because `TransMessage` builds the key union as `` `${refName}.${value}` `` and typechecks it fine.
+
+  The three readers now use `pathGetLoose`, a new `akanjs/common` export that tries joined prefixes when a plain
+  segment walk finds nothing. It tries the shortest prefix first, so every key that resolved before resolves to the
+  same node — only keys that used to fall through to the fallback are newly found.
+
+- 2d8de1c: fix(ui): a disabled `Link` renders its `div` without the link-only props
+
+  With `disabled` (or no `href`), `Link` spread every remaining prop onto the `div` it renders, so `scrollToTop`,
+  `replace`, `activeClassName`, `activeExact` and `noCache` reached the DOM and React warned about each. They are now
+  dropped there; the caller's own attributes (`aria-*`, handlers, `data-*`) still reach the `div`.
+
+- 69f7178: feat(akan): serve the framework documentation over MCP from the docs app
+
+  `apps/akan` now exposes its own generated documentation corpus as MCP tools, so an agent working in an Akan
+  workspace can read the framework's docs instead of guessing at its APIs. Three tools, all `[Public]` — the same
+  markdown is already served anonymously at `/llms/pages`, so a guard there would protect nothing while making the
+  tools unusable to the agents they exist for:
+
+  - `listDocPages` — the whole index, optionally narrowed to one of the four sections.
+  - `searchDocPages` — every given word must match, ranked with title hits ahead of body mentions.
+  - `readDocPage` — one page in full as markdown, code examples included.
+
+  This is also the first app in the repo to serve a live `/mcp` catalogue, which is what makes the MCP boot log,
+  the wire, and the refusal paths exercised by something other than a test.
+
+  The corpus under `public/llms/pages` is stale relative to the docs routes — regenerate with
+  `bun apps/akan/script/generateLlms.ts` to pick up the MCP cheatsheet page and the mobile cheatsheets.
+
+- 5f53462: The recovered-form banner is the app's to size and to skin.
+
+  - `Model.EditModal` takes `draftBarClassName`, so a dense screen — an editor sitting right under its own header —
+    can trim the banner's padding and type without forking the shell.
+  - `DraftBar` is an override slot, bound like any other in a `page/**/_overrides.tsx` manifest. The shell keeps the
+    draft state and keeps publishing the restore and discard tools, so a replacement takes `state`, `savedAt`,
+    `onRestore` and `onDiscard` as props instead of reaching into the store under string keys.
+  - A draft the record has caught up with is dropped rather than offered back. A form that saves itself as the user
+    types moves `updatedAt` with its own save, so every reopen read as a conflict and asked the user to settle a
+    difference that was not there.
+  - `Model.Edit` forwards `draft` the way `Model.New` already did, so a form opened through it can turn recovery off
+    at all.
+
+- 22aa04f: fix(ui): keep a Modal opened from a Dropdown menu alive
+
+  `Dropdown` dismissed on any `mousedown` outside its own DOM subtree, but `Dialog/Modal` leaves that subtree
+  through `createPortal(document.body)`. A `Model.Edit` (or any Modal) rendered as a menu item therefore read
+  every click inside itself as an outside click: the menu closed, its content unmounted, and the modal it had
+  opened went with it — without an animation, and without running `onCancel`. Because `EditModal` derives its
+  openness from the store rather than local state, the `<model>Modal === "edit"` left behind then re-opened
+  the editor by itself the next time the menu mounted its content.
+
+  React context reaches through a portal where the DOM does not, so ownership is now explicit rather than
+  inferred from the DOM: `Dropdown` hands its content a scope, and a `Modal` stamps whichever scope rendered
+  it onto the roots it portals out (`data-akan-overlay`). A dismiss check then recognises the overlays it
+  owns — including ones opened by a nested scope — and ignores clicks inside them, while an overlay it does
+  not own dismisses it as any other outside click would.
+
+  Four changes:
+
+  - Dismiss checks ignore clicks inside an overlay the dismissing scope owns. A dropdown rendered _inside_ a
+    modal is unaffected, since that modal is not its own — it still dismisses on an ordinary click in it.
+  - The menu is hidden rather than unmounted once it has been opened, so an overlay a menu item opened
+    survives the menu closing.
+  - `EditModal` resets the modal it owns when it unmounts while open, whatever tore it down. The reset is
+    deferred one microtask so a remount in the same commit (a re-keyed list row) claims the modal back instead.
+  - A menu item marked `data-dropdown-keep-open` no longer closes the menu, so a switch or copy button inside
+    a menu stays usable.
+
+  Both `Data.ListContainer` and `Data.Item` put action lists straight into a `Dropdown`, so list and item
+  toolbars were affected the same way. An app-authored overlay that portals itself can join the same
+  bookkeeping by spreading `useOverlayLayerProps()` onto its portal roots.
+
+- 69f7178: fix(package): embed `use-agentic` into the akanjs build instead of depending on it
+
+  `use-agentic` is a workspace package, not a registry entry — it is not in `publishableAkanPackages` and
+  `release:build-packages` never builds it — so the `"use-agentic": "0.1.0"` line the dependency scanner wrote into
+  `pkgs/akanjs/package.json` pointed every consumer at something `bun install` cannot resolve.
+
+  The akanjs build now copies its source into `vendor/use-agentic` inside the dist and rewrites every
+  `from "use-agentic"` specifier to the relative path, in the shipped `.ts` sources and in the emitted `.d.ts` tree
+  alike — declarations for the embedded package are emitted into `types/vendor/use-agentic` by a second program, so
+  the published types resolve without the package existing anywhere. `PackageRunner` treats it as a bundled runtime
+  dependency the way `@akanjs/cli` already treats `@akanjs/devkit`, which keeps it out of both the dist and the
+  source `package.json` on every rebuild.
+
+  `@happy-dom/global-registrator` moved to an optional peer dependency alongside `@playwright/test` and `chance`,
+  the shape every other package the `test/` facet reaches already has. `test/registerDom.ts` is a value import, so
+  the scanner had promoted a test-only DOM shim into the runtime dependencies of every app that installs akanjs.
+
+  Nothing changes inside the monorepo: framework source keeps importing `"use-agentic"` and keeps resolving it
+  through the workspace. `GuideProps`, `ZoneProps`, and `AgentScopeProps` are now exported, because the `Agent`
+  namespace object cannot have its declaration emitted while the props it infers cannot be named (TS4023) — that
+  error had been failing `build-package akanjs` outright, since the release build runs the declaration emit with
+  `AKAN_BUILD_DECLARATION_DIAGNOSTICS=error`.
+
+- 69f7178: fix: the first field run's findings — request context, module identity, and an honest agent surface
+
+  Six fixes from running the in-page agent on a real product app, plus the one its own docs app hit.
+
+  **Server components see the request again.** The RSC worker wrapped a render in `requestStorage.run(...)` only,
+  and the flight stream pumps components after that scope has exited — every `getSelf()` read no cookies and
+  bounced authed pages to `/signin`. The worker now keeps a request fallback pushed until the render settles, the
+  same discipline `ssrFromRscRenderer` already used. The stack is global and last-push-wins across concurrent
+  renders; pumping the flight render inside the ALS scope itself is the follow-up that removes the caveat.
+
+  **`akanjs/fetch` is a vendor shared module.** It was bundled separately into the app and the vendored
+  `akanjs/store` chunk, so `FetchClient`'s static serialized-signal registry split in two and the agent catalogue
+  silently read the empty copy — every endpoint-named action refused as undescribed. The registry also moved to a
+  `globalThis` symbol (the anchoring the shared client proxy already had), so a future duplicated module instance
+  degrades to nothing instead of an empty surface.
+
+  **The relay's return scalar registers on the client graph.** `agentTurn` lived in `akanjs/signal`, which no
+  client bundle loads, so the chat's first probe of `fetch.runAgentTurn` threw `No scalar constant model for
+agentTurn`. The scalar now lives in `akanjs/fetch` and `FetchClient` itself force-registers it — Bun links a
+  barrel's `export *` modules lazily per used binding and its transpiler drops unused imports, so only a real call
+  survives to do that.
+
+  **`labelOf` reads the `text: "title"` role as the `Set` it is.** It asserted `readonly string[]` and called
+  `.find`, so every screen-context label on a search-indexed model threw.
+
+  **`akan build` relaunches itself once with the app env in place.** Bun macros snapshot `process.env` at process
+  start, so the env the build resolves and publishes later is invisible to them — and any hand-written
+  `@libs/<lib>/server` import (the sanctioned cross-lib entrypoint) puts that lib's env files, which read
+  `getEnv()` at module scope, into the `getSerializedSignal` macro graph. `AKAN_PUBLIC_APP_NAME` is the one
+  required key a workspace root `.env` cannot carry, so the CLI build now spawns itself again with it set and the
+  child does the real build — the `AKAN_PUBLIC_APP_NAME=<app> akan build <app>` workaround is built in. The
+  relaunch decision compares the env the process was **born** with, never the live `process.env`: the command
+  dispatcher writes the resolved app name into `process.env` before any command method runs, which satisfies
+  runtime readers but not macros — a guard reading the live value never fires (that inert shape is what alpha.19
+  shipped). A `Relaunching with AKAN_PUBLIC_APP_NAME=…` line in the build output is the observable proof. The
+  generated `sig`/`dict`/`srv`/`db` barrels also stopped walking parent _server_ barrels (they import the lib's
+  own `@libs/<lib>/lib/<facet>` modules after `akan sync`), and `FetchClient.from` resolves its origin tolerantly,
+  so a lib whose graph stays clean serializes with no env at all.
+
+  **The agent surface stops publishing two lies.** Form setters for the base document fields (`setIdOnX`,
+  `setCreatedAtOnX`, `setUpdatedAtOnX`, `setRemovedAtOnX`) are no longer tools — the server stamps those. And an
+  action named after an endpoint is published with the endpoint's schema only when it declares at least as many
+  parameters: one declaring fewer would silently drop the borrowed tail and read stale form state, which shipped a
+  resident SMS with the wrong unit number in the field run. Such an action is refused by name and warned once in
+  the console; trailing extras beyond the endpoint's arguments stay legal, which is the generated
+  `create<Model>(data, options?)` shape.
+
+- 2d8de1c: fix(ui): component, client and projection fixes from the framework bug sweep
+
+  - **A server-rendered `Link` to a `#hash` keeps the caller's props** — `target`, `onClick`, `aria-*`, `data-*` —
+    like every other `Link`.
+  - **`Input.TextArea` attaches `inputRef` to the textarea** instead of spreading it onto the DOM, where React warned
+    and the ref stayed empty.
+  - **`System.Reconnect` removes the disconnect listener it added**, so remounts no longer stack listeners that each
+    ping on every disconnect.
+  - **`Agent.Context` renders on every environment except `AKAN_PUBLIC_ENV=main`**, like `Agent.Dock`; a
+    shell-exported `NODE_ENV=develop` no longer hides it.
+  - **The `LoadingArea` override slot takes `Loading.Area`'s props**, so `<Loading.Area className>` typechecks and an
+    override can type its props.
+  - **`System.Root` is flagged as deprecated where it is used**, not only on its props type.
+  - **`useCodepush` no longer interrupts every release check with a debug `window.alert`.**
+  - **`storage.removeItem` falls back to `localStorage` when the native Preferences call rejects**, as `getItem` and
+    `setItem` already did.
+  - **A projected read of a row written before a field existed gets that field's default the way a full read does**:
+    an array gets its own fresh copy (pushing into it used to rewrite the model's default for every later document),
+    and a required nested scalar gets its default instead of `null`.
+  - **`logger.raw(msg)` writes the text as given**, like the static `Logger.raw`; it used to append a newline.
+
+- 2d8de1c: fix(server): a replica keeps a pubsub room while any of its sockets is still in it
+
+  With two or more replicas (or under `akan start`), the gateway forwards a room's publishes to every replica that
+  holds a socket in it. It tracked that membership per replica but applied each socket's unsubscribe to the whole
+  replica, so when one of several sockets on a replica left a room, every other socket there stopped receiving
+  publishes from the other replicas until the 30-second membership snapshot restored it. The gateway now removes a
+  replica from a room only when the last of its sockets in that room leaves, and a snapshot keeps what it knows about
+  the sockets of the rooms it confirms. A single-process deployment was never affected.
+
+- 2d8de1c: fix(server): the gateway's `sockets` metric stops counting sockets whose room a snapshot dropped
+
+  The `sockets` count on `/_akan/app/metrics` is the number of sockets the gateway knows to be in at least one pubsub
+  room. When a socket's unsubscribe never reached the gateway, the 30-second membership snapshot took the room away
+  from the replica but left the socket counted, and every such socket stayed in the metric until that replica
+  restarted. A room the snapshot no longer confirms now takes the sockets recorded in it along; a socket still in
+  another room stays counted. Delivery never read this count, and the metric's name and shape are unchanged.
+
+- f882bbc: Enforce `field(..., { immutable: true })` on the document write path instead of carrying it as decoration.
+
+  The option survived the v2 migration as metadata and nothing else. v1 handed it to mongoose, which enforced it;
+  the SQL document layer that replaced mongoose never picked it up, so the only readers left were the schema doc's
+  `immutable` pill and the devtools serializer. A field declared immutable was freely overwritten by
+  `doc.set(...).save()`, by `srv.update(id, patch)`, and by every query-level write — while `akan`'s own docs
+  promised "생성 후 수정할 수 없습니다".
+
+  `writeUpdatedDocument` is now the single gate: it compares each immutable field's prepared value against the row
+  it loaded and throws when they differ. That one choke point covers the whole document path — `.set()` then
+  `.save()`, a chain method assigning the field directly, and `update(id, patch)` — because all three land there.
+  `.set()` itself stays a plain in-memory assign, so the throw arrives at `save()`, where the write actually
+  happens; gating `.set()` too would have missed direct property assignment and gone silent on documents loaded
+  through a read query, which carry no snapshot to compare against.
+
+  The check runs before the save hooks, so the message names the field the caller changed rather than one a
+  `_preUpdate` derived from it, and it omits the values — an immutable field may also be `field.secret`.
+
+  Query-level writes are deliberately left open, mirroring the way mongoose exempts `bulkWrite`:
+  `updateOneByQuery` / `updateManyByQuery`, the generated `update<Filter>` / `remove<Filter>`, and
+  `updateById` / `removeById` compile straight to one SQL statement, fire no hooks, and read no existing row to
+  compare against. A caller reaching for that path has already stepped outside document semantics. `create` and an
+  upsert's insert are untouched, which is where an immutable field is meant to be set.
+
+  Re-saving an unchanged immutable field is not a change and does not throw, so `doc.save()` after editing anything
+  else keeps working — including on a row written before the field was declared, which reads back as the field's
+  default on both sides of the comparison.
+
+- 69f7178: feat: component-level in-page agent — a chat that reads the rendered screen and drives it
+
+  The agent surface work so far described what an app _can_ do (the store catalogue, the MCP catalogue); this ships
+  the half that knows what the _screen_ is doing and lets a user hand it the wheel. One mount —
+  `<Agent.Chat />` in a layout — is the whole integration.
+
+  **`use-agentic`** is the new framework-independent core: a mount-lifetime surface
+  (`registerTool`/`registerResource`/`openScope`/`registerGuide`, name stacks where the newest registration wins and
+  unregistering restores what it shadowed), hooks (`useAgentState`/`useAgentTool`/`useAgentResource`/`useAgentGuide`,
+  declarations mount-static and behavior always-latest), and `AgentSession` — the client-side conversation loop:
+  send → model turn → tool calls → approval gate → execute → report resource diffs → next turn. The loop lives in the
+  browser because the tools do; the server is one stateless turn relay that never executes anything. Failures land in
+  the transcript rather than being thrown past it. The wire is documented in `WIRE.md` so any backend can serve it.
+
+  **The screen context is derived, not declared — and it follows the rendered screen, not the bundle.**
+  `Load.Units`/`Load.View` register scopes and curated item lists as they mount (labels come from the `text: "title"`
+  search role), `StoreInstance` counts which state keys the mounted components are reading — `st.use`, `st.sel`, and
+  `st.ref` all count, the selector-based pair by running the selector once over a recording proxy — and a store's
+  catalogued actions and state are published only while one of its keys is live. `AgentContext` assembles route +
+  screen + live-state blocks per turn — primitives inline, everything else one masked `readState(key)` call away.
+  `remove*` names default to a confirm gate, and the framework adds two built-ins beside `readState`: `navigate`
+  (internal paths only, the same router `Link` rides) and `readScreen`, which serializes the rendered DOM into
+  compact text — headings, links, control values with their `data-akan-*` annotations — so "what does this page
+  say?" is answerable; the chat's own UI is skipped via `data-agent-ui` and a password value is never read.
+
+  **Exposure is the store author's to trim.** `static agent = false` keeps a whole store off the surface — the
+  framework's base store declares it, which also stops `readState` from reaching the `tryJwt` credential — and
+  `static agent = { exclude: [...] }` withholds named actions and state keys; `st.use.x({ agent: false })`
+  subscribes without counting toward liveness. Generated `set<Key>` conveniences are no longer published at all:
+  they carried no schema, so they listed as zero-argument levers that wrote `undefined`.
+
+  **`Agent.Chat`** is the user-facing half: launcher, transcript, composer, and the inline approval card, behind an
+  `ssr: false` lazy boundary so none of it touches the server HTML, and re-skinnable through the `AgentChat`
+  `_overrides.tsx` slot. Its default runner posts the wire to the app's own `runAgentTurn` route through
+  `httpRunner`, which negotiates streaming via `accept`: the relay answers `text/event-stream` — one `RunnerEvent`
+  per SSE `data:` line, assistant text arriving as it is generated — and a server that does not stream answers the
+  same JSON turn. The endpoint reads the request with `.with(Req)` and returns a raw `Response` for the SSE half;
+  `LlmAdaptor.chat` gained an optional `onDelta`, and an adapter that ignores it still answers whole. An app that
+  mounts no relay degrades to a transcript message. `ThemeToggle` now publishes the current `theme` and a
+  `setTheme` tool, so "switch to dark mode" works out of the box wherever it is mounted.
+  A tool call is **one row** that resolves in place — pending, then `✓`/`✕` with the result's error or change count
+  — rather than a badge on the assistant message and a second row for its result: the model needs both wire
+  messages, but the user watched one thing happen, and the name appearing twice read as a doubled call. The row
+  carries the call's arguments, because two searches are otherwise the same row twice.
+  `<Agent.Guide instructions="..." />` layers route-scoped guidance by render position: nested Guides concatenate,
+  navigation withdraws them. `prompt()` endpoints double as the chat's slash commands with no listing endpoint —
+  the client reads its own serialized signals, and the prompt's GET enforces its guards at call time.
+
+  **The relay is framework-embedded.** `runAgentTurn`, the `agentTurn` scalar, `AgentTurnStream`, and the
+  `AgentRelayAccess` guard ship with `akanjs` itself, registered the way the `base` module is — every app serves the
+  relay with no lib to mount, `AKAN_AGENT=false` takes it off, and a lib that still carries its own `agent` module
+  wins the refName so older workspaces keep working. `OpenaiLlm` (chat-completions REST, zero SDK dependencies)
+  is the predefined default behind a new `LlmAdaptorRole`; an app swaps providers in its `option.ts` with
+  `applyAdaptor(LlmAdaptorRole, OwnLlm)` — the same builder family as `applyMiddleware`, and the override mechanism
+  works for every predefined adaptor role. The endpoint stays outside MCP — its `Any` bodies are refused from the
+  catalogue — and `AgentRelayAccess` defaults to allow but now **warns at boot while no policy is registered**; a
+  policy that throws fails closed.
+
+  **An app configures its server in `lib/option.ts`, not through the environment and not in `main.ts`.** `AkanOption`
+  gained three setters, each read from every lib in mount order with the app's own last, so an app tightens what a
+  library declared without restating it. `setLlm({ apiKey, model, host })` — or `setLlm((options) => …)` to take the
+  key out of the app's own gitignored env object — reaches whichever adaptor holds `LlmAdaptorRole` as the
+  `llmOption` use, replacing the per-provider environment names; the settings belong to the role
+  rather than to one provider, so they survive a swap. `setAgentAccess(SignedIn)` names the guards
+  `AgentRelayAccess` forwards to, which `AgentRelayAccess.use` takes at boot. `setMcp({ … })` carries the MCP server
+  settings that `new AkanApp("./server", { mcp })` used to spell as child environment variables — the gateway there
+  only spawns children, while `option.ts` is already handed to the process that mounts `/mcp`, so `AkanAppOptions.mcp`
+  is gone. Every `AKAN_MCP_*` env spelling still works for a deployment configuring what the source does not, and an
+  option written in code still wins over the env of the same name.
+
+  **`<Agent.Zone id="comments">` runs a second agent over one section, in parallel with the root.** Zones are views
+  of the same surface, never walls: everything mounted inside — `st.use` subscriptions (liveness is now tagged with
+  the ambient scope), hook tools, guides — belongs to the zone's own conversation _and_ stays visible to the root
+  agent, so wrapping a section costs the root nothing. An `Agent.Chat` inside binds to the zone session
+  automatically, a zone's `readScreen` reads only its own `data-agent-zone` container, and guides follow the layout
+  cascade — ancestors and own, never a sibling's. The core grew `surface.view(path)` (`SurfaceView`), and
+  `AgentSession` now runs over any view.
+
+  **`persist` keeps the transcript across reloads.** Off by default; `<Agent.Chat persist />` stores settled
+  messages in sessionStorage (per-tab, gone when the tab closes), `{ storage: "local" }` outlives it, and each
+  `Agent.Zone persist` keys its own entry by scope path. Restores drop the assistant draft a reload cut short,
+  saves are debounced against streaming deltas, a versioned envelope discards stale wire shapes, only the newest 50
+  messages are kept, and a full or blocked storage never breaks the chat. The chat header gained a clear button
+  that empties both the transcript and the stored copy.
+
+- f882bbc: Intern the in-page agent's React contexts on `globalThis`, so a zone's tools reach the zone's session.
+
+  An akan build inlines `use-agentic` into every client bundle that reaches it — four of them in this repo's own
+  docs app — and a React context is identified by object identity. `AgenticSurface.shared` already survives that on
+  a `Symbol.for` key; `SurfaceContext`, `ScopeContext` and `SessionContext` did not. So the `ScopeContext.Provider`
+  an `Agent.Zone` rendered from one copy was invisible to the `st.tool` / `st.expose` / form tools reading it from
+  another: `useScopePath()` fell back to `[]`, every declared tool registered at the root scope, and the zone
+  session then filtered out all of them as belonging to a different view. The model was handed the built-ins and
+  answered `Unknown tool` for tools the screen had published — with nothing thrown and nothing logged.
+
+  All three now go through one `sharedContext` helper, and a test fails if any module in the package makes a
+  context the plain way: the plain call works in the monorepo, where there is one copy, and breaks only once
+  bundled, so using the feature cannot catch it.
+
+- f882bbc: Intern every framework React context on `globalThis`, so an override or a provider value cannot be lost to bundle
+  chunking.
+
+  An akan build inlines each reachable module into every client chunk that reaches it — `client/sharedContext.ts`
+  itself lands in two chunks of this repo's docs app — and a React context is identified by object identity. A
+  Provider mounted from one copy is invisible to a consumer holding another, which reads the context default
+  instead, silently.
+
+  `UiOverrideContext` was a plain `createContext`, so a route's `_overrides.tsx` bound its slots in the chunk
+  holding the generated provider while overridable components in other chunks kept rendering the framework default.
+  Nothing threw, and only _some_ slots were affected — which reads like a bug in the app's own component, not in
+  the framework. The same shape had already cost a zone agent every tool its screen declared.
+
+  All ten of the framework's contexts now go through `sharedContext`, which is exported from `akanjs/client` so an
+  app or lib can make its own the same way. A test fails if anything under `client/` or `ui/` calls `createContext`
+  directly: the plain call works in the monorepo, where there is one copy of every module, and breaks only once
+  bundled — so using the feature cannot catch it.
+
+- 5f53462: perf: hydrate a model from one compiled plan per class, and build a Date field's dayjs on first read
+
+  `new cnst.X(raw)` and `set()` used to re-read the field map, resolve `getProps()` and dispatch on the field kind
+  per field per instance, evaluated every default thunk before overwriting it, and wrapped every Date in a dayjs
+  object — ~300 bytes and eight getter calls each — whether or not anything read it. A 1000-row listing paid 3.5ms
+  and 1.7MB over the parsed JSON for that; it now pays 0.9ms and lands under the raw parse, because `HydrationPlan`
+  compiles the field map once per class and a Date field keeps a native `Date` under a symbol slot, with the `Dayjs`
+  its type promises built on first read and memoized per `Date`.
+
+  The accessors are on the prototype, so `Object.keys(model)` and `{ ...model }` no longer include Date fields.
+  `"createdAt" in model`, `for...in`, `JSON.stringify` (via `toJSON`), `plainFieldsOf` (`akanjs/common`),
+  `immerify` and `deepObjectify` all still do; copy a model with `new cnst.X().set(model)`. immer invokes the setter on
+  the draft, so store writes stay copy-on-write.
+
+  Two hydration passes that never produced anything are gone as well: the browser no longer `structuredClone`s
+  every query response — the request memo that copy protected exists only inside a request store — and
+  `fetch.initX` builds its `xList` / `xInsight` instances only for a caller that reads them, which a route passing
+  `xInit` down never did.
+
+- 22aa04f: fix(ui): stop a Model chunk from repainting the page it opened over
+
+  `lazy()` returned the React lazy component with no boundary of its own, so a chunk that resolved after
+  first paint suspended past it to the nearest boundary — the route. Opening a ticket modal or a `⋮` menu
+  therefore replaced the whole page with the route's loading fallback, once per fresh load, until the chunk
+  was cached. Portalling to `document.body` did not help: the React ancestor chain is unchanged.
+
+  `lazy()` takes `suspense?: boolean`, and only a flagged call site gets a `<Suspense>` of its own. The flag
+  is opt-in because a boundary also changes server rendering: under the default `renderMode: "stream"` its
+  subtree leaves the shell as `loading` and arrives later in the stream, which is right for an interaction
+  shell and wrong for a page body that SEO snapshots, prerendering and pre-hydration E2E read out of the
+  shell. Every existing call site keeps its exact code path.
+
+  The `Model` barrel turns it on for all fifteen exports, and gives `View` and `AdminPanel` a plain block
+  to hold their height while the chunk loads. Those two are the only ones that occupy space of their own:
+  the triggers wrap the caller's children, so a fixed block would put a slab where a small button belongs,
+  and the modals render `null` until opened, so a block would appear where nothing ever shows.
+
+  The fallback is a host element and has to be. The barrel carries no `"use client"`, so a client component
+  referenced from it resolves to `undefined` inside the thunk and the render throws "Element type is
+  invalid", taking the whole page segment under the layout with it. Marking the barrel `"use client"` is
+  worse still: `Model.*` becomes a real server→client boundary and apps that pass crystalized model
+  instances as props fail serialization at boot. Plain markup crosses neither line.
+
+  `LazyOption.loading` also starts working on the default path, having been reachable only through
+  `ssr: false` before.
+
+- 69f7178: fix(sync): hold libraries to the root layout allowlist, and check a library's own `page/` tree
+
+  `apps/<app>/base` was refused by `akan sync`, `akan doctor` and `akan quality scan`; `libs/<lib>/base` passed all
+  three. The rule lives in one file — `workspaceLayout.ts` exists precisely so the three tiers cannot disagree — but
+  the call sites read it behind `exec.type === "app"` / `for (const app of context.apps)` / `segments[0] === "apps"`,
+  so a library root was never compared to anything at all. A lib could carry a `base/`, a `helper.ts`, a stray
+  `script/`, and every command stayed green.
+
+  Libraries now answer to their own allowlist, and it is the app's minus what only an app can use: no `main.ts`, no
+  `capacitor.config.ts`, no `.akan` / `android` / `ios` / `mobile` / `script` / `secrets`, because a library is never
+  booted or packaged. `index.ts`, `README.md` and `tsconfig.spec.json` are added, since a library ships as a package.
+  `public/` and `private/` stay, because `syncAssets` symlinks them into each consuming app.
+
+  Three more places the same gate was one-sided:
+
+  - `akan doctor` walked `context.apps` only. It now walks libraries too and reports `lib-root-unknown-entry` beside
+    the existing `app-root-unknown-entry`.
+  - `akan quality scan` warned on an unexpected app root _file_ and nothing else — not a library root file, and not a
+    root _folder_ on either side, which is the shape `base/` actually takes. It now reports all four
+    (`akan.layout.{app,lib}-root-{file,folder}`). Its `lib/` facet rule kept its own copy of the allowlist and flagged
+    a `<model>.signal.test.ts` that `akan sync` explicitly permits; both now read the shared helper, and the rule is
+    renamed `akan.layout.lib-facet-file` so its name no longer collides with the library root it was never about.
+  - A library's `page/` folder was validated only once an app opted into it with `syncPageLibs`. An app checks route
+    filenames in `getPageKeys`, which a library has no equivalent of, so `libs/<lib>/page/Component.tsx` synced clean
+    in the library it belongs to and failed in somebody else's app. `akan sync <lib>` now reports it as a scan
+    violation, from the same rule `validatePageSourceFile` throws — split out as `getPageSourceFileViolation` so the
+    reason is available where throwing is the wrong answer.
+
+- 2d8de1c: fix(ui): mark `Link`'s `noCache` deprecated — it has never done anything
+
+  Neither renderer reads it: the server-rendered and CSR links navigate the same way with or without it, and
+  `router.push` / `replace` take no cache option to hand it to. The prop is still accepted, so nothing breaks, but
+  `<Link noCache>` now shows as deprecated in the editor. Drop it; to fetch a page fresh after a change, clear the
+  route cache with `clearRscNavigationCache()` from `akanjs/client`.
+
+- 5f53462: The LLM seam names a wire, not a vendor
+
+  Three provider classes shipped where there are only two wires, and the framework's own vocabulary had grown a
+  per-vendor shape that nothing outside the framework could extend: `agent.error.deepseekRequestFailed`,
+  `openaiRequestFailed` and `anthropicRequestFailed` were three dictionary keys an app-authored adaptor could never
+  add a fourth to, and `LlmOption` was a closed bag, so an adaptor needing a region or a project id had to open a
+  second config channel beside `setLlm`. `LlmAdaptorRole` and `applyAdaptor` were already the whole contract; what
+  was wrong was how much the framework claimed to know about who fills it.
+
+  **`DeepseekLlm` is gone and `OpenaiLlm` is the default.** They spoke the same wire through the same
+  `OpenaiDialect` and differed only in a host, a model name and a vision claim, so one host-pointed class covers
+  DeepSeek, Groq, Together, OpenRouter, Ollama and a self-hosted vLLM as well as OpenAI. **An app relying on the
+  old default must now name `model` and `host`** — `option.setLlm({ apiKey, model: "deepseek-v4-flash", host:
+"https://api.deepseek.com" })`. There is no default model, for the reason there never was one on `OpenaiLlm`: a
+  model name ages out of a catalogue into a 404 at the first turn.
+
+  **`OpenaiLlm` claims vision for its default host and nothing else.** OpenAI's own endpoint takes image parts, so
+  that is what it answers with no `host` set; a host the app named is a gateway the class knows nothing about, and
+  it is text-only until `option.setLlm({ accepts })` says otherwise. Handing bytes to a model that cannot decode
+  them kills the whole turn on a 400, where text-only degrades them to a note the model can repeat back — so the
+  safe direction is the default and the claim is declared, not guessed.
+
+  **One refusal key, `agent.error.llmRequestFailed`, carrying `{ provider, status, reason }`.** `provider` is the
+  hostname that refused rather than a brand name, because an adaptor pointed at a gateway would otherwise credit
+  OpenAI for that gateway's answer. An adaptor an app wrote reports through the same translated sentence the
+  shipped ones do.
+
+  **`setLlm` is generic, so `LlmOption` is a floor rather than the whole shape.** Whatever else it is handed
+  travels to the role untouched: an adaptor declares its own interface extending `LlmOption`, reads it back with
+  `use<MyLlmOption>()`, and its provider-specific settings ride the channel the built-in ones do.
+
+  Step-by-step migration: `akan guideline show workspaceRecipes` (or `get_guideline workspaceRecipes`),
+  Recipe 8.
+
+- 5f53462: A server-side loopback fetch follows the port the process was actually run with, so a container started with
+  `PORT=80` renders instead of failing every page with `base.error.serverUnreachable`.
+
+  - `getEnv().serverPort` fell back to a literal `8282` on the server side, and only `akan start` ever set
+    `AKAN_PUBLIC_SERVER_PORT`. A production image overriding the Dockerfile's `ENV PORT=8282` therefore bound one
+    port and pointed the RSC worker's `fetch.*` at another; the SSR render failed on every route, with no other
+    symptom than the transport error. When the origin resolves to `localhost` — the self-call — the port now comes
+    from `PORT`. A `SERVER_HOST` naming another host is not a self-call and keeps the explicit port, and
+    `AKAN_PUBLIC_SERVER_PORT` still outranks both.
+  - `AkanApp` publishes the port it resolved as `PORT` to the replica it runs in-process and to every child it
+    spawns, so `new AkanApp({ port })` reaches the tree the same way the env var does. In solo mode that is also
+    what makes the option bind: `AkanServer` reads `PORT`, so an explicitly configured port was previously ignored.
+  - `akan build` no longer publishes `AKAN_PUBLIC_CLIENT_PORT` / `AKAN_PUBLIC_SERVER_PORT` into the build process's
+    own env. Bundling `define`s every `AKAN_PUBLIC_*` into a literal, so with `PORT_OFFSET` set the builder's dev
+    port was baked into the artifact, where no deployment env could override it.
+
+- f882bbc: fix: a masked field carrying a `text` role is a compile error, not a failed boot
+
+  **`field.secret`, `field.hidden` and `resolve()` no longer accept a `text` role in their options.** The role puts a
+  plaintext copy of the value in the search mirror, so pairing it with masking publishes exactly what the masking
+  hides — the class build has always refused it. But the refusal fired during module evaluation, which means the
+  first sign of it was a backend that would not boot: three failed boots and then every route answering 503, with
+  typecheck and lint silent the whole time, because the option type was the same one plain `field` takes.
+
+  Removing `text` from those three option types moves the refusal to the call site, where the fix is obvious and the
+  editor shows it. The option type is a union, so the exclusion is distributive — a plain `Omit` over it would
+  collapse to the keys its members share.
+
+  **The class-build throw stays as the backstop** and now names the way out ("Drop the text role, or make the field
+  plain") instead of only what is wrong. It is still the only check that can catch the cross-file case, where a
+  scalar's own field carries a role and a parent in another file masks it — the excess-property check cannot see
+  an option object built elsewhere either.
+
+- 5f53462: fix(mcp): `AKAN_MCP=false` keeps `/mcp` off whatever an `option.ts` configures
+
+  `setMcp()` with an object read a missing `enabled` as `true`, so any `option.ts` that only configured the surface
+  switched it back on. `libs/shared` hands over its OAuth settings exactly that way, so every app mounting it served
+  `/mcp` under `AKAN_MCP=false`. An object without `enabled` now leaves the switch where it was, and the env switch only
+  ever narrows: `AKAN_MCP=false` (or `AKAN_PUBLIC_MCP=false`) turns the surface off even over an explicit `enabled: true`.
+
+- 5f53462: fix(service): a `memory(...)` value that is a scalar or model class round-trips on both caches
+
+  `memory(Map, { of: SomeScalarInput })` typechecked and serialized through the constant, then handed the
+  resulting object to a cache that holds a string, a number or a Buffer. The sqlite-backed `SolidCache` happens to
+  JSON anything else on its own, so it worked there; Redis passes the value to `hset`, which coerces it to
+  `"[object Object]"`. The same declaration meant two different things per deployment, and the failure only
+  surfaced on read — so apps hand-encoded JSON into a `String` memory to get a structured value back.
+
+  A value whose declared type is not a primitive scalar now travels as JSON text in both directions, decided by
+  the declaration rather than by the runtime value, so both adaptors store and return the same thing. A value that
+  arrives already parsed — a row written before this change, or `SolidCache`'s own `json` type — is still read
+  correctly.
+
+- ccf2ae2: `akan start-desktop`, `start-ios` and `start-android` print a page's log once, at the level it was logged, and say a
+  boot came up in one line
+
+  - A boot that comes up prints `cmdc ios ready · iPhone 16 · http://localhost:8283 · 12.4s` and nothing else; its steps
+    (prepare, build, install, launch) are debug. A boot that fails prints every step it took ahead of the error. A native
+    config warning still prints as it happens.
+  - A page line reads `WARN  [page:WsClient] WebSocket message process failed …`: stamped once by the CLI's logger, at
+    the page's own level, with no `[default]` label, no empty line after it, and a multi-line message kept together. A
+    page logger writes `[Name] message` at the console method of its level inside a native shell, and the desktop host
+    and iOS tag each line `[page<+><#window> <level>]` for the CLI to read back.
+  - Android forwards the page console through the bridge in a dev build too, so logcat carries each line at its level
+    and a `console.error("%s", …)` substitution the way the devtools show it; iOS writes os_log at the page's level. An
+    uncaught error forwards its message along with WebKit's frames, which carry none.
+  - Frame tracing (`[akan:frame:…]`) is opt-in (`?akanFrameDebug=1` or `localStorage["akan:debug:frame"] = "1"`) and
+    logs at debug, once per event; a mobile or desktop target no longer turns it on for every visibility change.
+  - Lines no page or host wrote (the simulator, WebKit) and where the host's pages come from are debug; `--verbose` shows
+    the former. `start-desktop` and friends ask a dev server whose builder idled out for its health, not its home page,
+    so they no longer report it missing while it wakes.
+
+- 5f53462: fix(service): a required nested scalar fills from its own field defaults instead of failing the write
+
+  `field(Coordinate)` on a model whose scalar carries a default for every one of its own fields still had to be
+  written `field(Coordinate, { default: () => new Coordinate() })`, or `create({ name })` threw
+  `Missing required field: location`. Every other layer already disagreed: `getDefault` recurses into a nested
+  scalar, `HydrationPlan` constructs one, and `sampleOf` fills one — only the SQL write path treated an absent
+  scalar as a missing value rather than a constructible one.
+
+  `prepareDocument` now applies the same rule `getDefault` does, in the same order — a parent-level `default`
+  first, then `nullable` (an optional nested scalar stays absent), then the scalar's own defaults. A **relation**
+  is unchanged and still fails closed: only the caller knows which row it names.
+
+  The read path had the matching hole. A row written before the field was declared carries no value for it, and a
+  scalar has no primitive `DEFAULT_VALUE` to fall back on, so `decodeDocumentPayload` handed back `null` — which
+  the next `save()` of that row rejected as `Field is not nullable`. It now constructs the same defaults, so an
+  existing row migrates by being saved.
+
+  Array defaults are copied per document rather than shared. A field with no declared default is given `[]` at the
+  class build, and both the store and `getDefault` handed that one array to every document filled from the model,
+  so a `doc.tags.push(...)` landed in the field default and in every document created after it. The constant layer
+  was already safe — `crystalize` copies an array on the way into an instance — and the document path now is too.
+
+- c45ac6c: fix(lint): stop `//!` markers from shipping to the browser
+
+  Bun's bundler classifies `//!` and `/*!` as legal comments — the `@license` / `@preserve` class it must preserve
+  for licence compliance — and keeps them through `minify: true`. Everything else goes: `//`, `/* */`, `//*`, `//?`,
+  and `// TODO:` are all stripped. But the workspace `AGENTS.md` prescribes `//!` as in-code marker 4, "disabled or
+  must-fix code", so the convention itself guaranteed that internal notes about broken and unfinished code shipped
+  verbatim to every visitor. A deployed app served eight of them in one chunk, including `//!env로 옮겨야함`,
+  `//!need to change`, and `//! Need to fix after bunjs migration`.
+
+  There is no bundler-side fix: `legalComments` is not a `Bun.build` option, and `Bun.Transpiler.transformSync`
+  preserves `//!` too. The source is the only place to stop it.
+
+  `no-bang-comment-in-client.grit` now bans the marker in browser-reachable code — `ui/`, `webkit/`, `common/`,
+  `page/**/*.tsx`, `*.constant.ts`, `*.store.ts`, and the five module component suffixes — while leaving it legal in
+  server, `srvkit/`, and CLI files, which never reach a bundle. The five existing occurrences in `akanjs` and the
+  libs became `// FIXME:`.
+
+  The rule anchors the marker to line start or to whitespace after code, so a literal like `"https://host//!path"`
+  does not trip it. Comments are trivia rather than nodes, so the diagnostic spans the module and a marker on a
+  file's very first line is invisible to the pattern — the one case the rule cannot see.
+
+  Rebuilding `apps/akan` takes the bundle from two `//!` comments to zero, with the third-party `/*!` licence
+  blocks left intact.
+
+- 2d8de1c: fix(oauth): read a Basic client credential whatever the scheme's case
+
+  `/oauth/token` and `/oauth/revoke` recognized HTTP Basic client authentication only when the scheme was spelled
+  `Basic`. RFC 7235 makes an auth scheme case-insensitive, so a client sending `basic` or `BASIC` was read as sending
+  no credential at all, and a confidential client was then refused. The scheme's case is the only thing that
+  loosened: the single space after it, the decoding of the two halves and the one-channel rule are unchanged, so a
+  lowercase `basic` header beside a `client_secret` in the body is now refused like a `Basic` one.
+
+- ccf2ae2: `akan start` replaces its backend one restart at a time, so saves in quick succession can no longer leave a second
+  gateway holding the port.
+
+  - A save whose restart came due while the previous one still waited for the old backend to exit used to signal the
+    same process again and then spawn a second backend beside the first. The host kept the one that lost the port,
+    restarted it on every save, and the untracked one went on answering. A restart that comes due now runs after the
+    one in flight, and a config or metadata recycle and `akan start`'s shutdown wait for it too.
+  - A gateway that cannot bind its port no longer reports itself ready while it waits for its replicas to exit.
+
+- 22aa04f: fix(ui): give Escape to the topmost overlay, and size the Select panel to its options
+
+  `Modal` was the only overlay that closed on Escape, and it listened on `window` per instance — so two
+  stacked dialogs both heard the same key and went down together. Escape now runs through one shared stack
+  (`useEscapeKey`) that hands the key to the surface opened last, and `BottomSheet` and `Popconfirm` are on
+  it too. A confirm popover inside a modal closes itself and leaves the modal standing.
+
+  `Select`'s open panel was a fixed `h-[270px]`, because `height` cannot ease to `auto` and the open/close
+  transition needed something to animate. A three-option list therefore rendered with ~100px of dead space
+  below it. The transition moves to `max-height`, which animates just as well and lets the panel end where
+  its options do, and the always-on scrollbar becomes `overflow-y-auto`.
+
+  Also: the dialog surface takes `outline-none`. Focus moves onto it when the dialog opens so the tab order
+  starts inside, but Chrome treats that programmatic focus as keyboard focus whenever the last interaction
+  was a key — or a click on a non-button trigger — and drew a ring around the whole surface. Controls inside
+  keep their own focus rings.
+
+  And `Tooltip`'s wrapper takes `w-fit`: `inline-flex` alone still stretches when the trigger is an item of a
+  column flex container, and the bubble's `left-1/2` then centred on that full width, far from the trigger.
+
+  `Dropdown`'s panel loses the `gap-2` between rows and the stray `pr-3`, which together padded a three-item
+  menu out to 132px of mostly empty space; rows now sit `gap-0.5` apart inside symmetric padding.
+
+- f882bbc: fix: a `_overrides.tsx` manifest reaches what the root layout renders, and what an overlay host renders for it
+
+  **The override provider was mounted inside the root-layout stream, so the two most common positions a component
+  is rendered from were beyond every manifest's reach.** Route rendering composes
+  `[...renderRootLayouts, ...renderLayouts]`, and the override render rode the second stream — so a root-boundary
+  layout wrapped the provider instead of sitting inside it. Anything such a layout renders beside `{children}` (an
+  agent chat, a dock, a shell control) resolved every slot to its framework default, and so did anything drawn
+  through the overlay host that layout mounts, which is where a portalled `Modal` renders. Both failed silently:
+  the provider was mounted, with the right slot map, one level too deep.
+
+  Root boundaries are `/`, `/:lang` and `/:lang/<basePath>`, and a route **group adds no path segment**, so
+  `page/_layout.tsx` and `page/(group)/_layout.tsx` are both root layouts — which is exactly where the framework's
+  own guidance says to mount `<Agent.Chat />`.
+
+  **Overrides now wrap the whole stack, root layouts included.** `renderRootLayouts` is composed as
+  `[...overrideRenders, ...rootLayoutStack]` and the CSR/mobile builder mirrors it. Nested manifests still stack in
+  node order, so the closest declaration wins; the recursion carries the override-free root-layout array, because
+  the root-boundary test counts its length. No route type or segment-identity change: overrides ride the stream the
+  client already labels `"root-layout"`.
+
+  The regression tests assert the **resolved output** of a route whose root layout — and, separately, whose
+  route-group layout — renders a slot-bound component. Asserting that the provider is an ancestor would not have
+  caught this: it was.
+
+- 2d8de1c: fix(release): the published packages no longer carry test-run files from `local/`
+
+  `akanjs` 3.0.0-beta.19 shipped 65 files (SQLite databases and logs, 820 KB) and `@akanjs/devkit` 2 from the
+  gitignored `local/` directory the test suites write into, because both builds copied the package directory whole.
+  `build-package` and `akanjs`'s own build now leave `local/` out, and `verify-akan-publish-packages` refuses a package
+  whose pack list still contains it.
+
+- 5f53462: `pathGet` reads every path `pathSet` can write
+
+  The two halves of the dotted-path vocabulary had drifted apart, and only the reading half was short. `pathSet`
+  parsed segments with `/[^.[\]]+/g` and read containers through a `Map` branch; `pathGet` did `path.split(".")` and
+  a bare property access. So `cutFrames[2].content` — the bracket spelling a form field hands `writeOn<Model>` — was
+  three segments to a write and one to a read, and a `field(Map, …)` entry could be written and never read back. The
+  failure is silent in both cases: `pathGet` answers with its fallback, which is `null`.
+
+  Both now share one definition, `toPathSegments`, so a path that writes and a path that reads cannot disagree about
+  what its segments are, and `pathGet` reads a `Map` entry the way `pathSet` writes one. A caller that named its own
+  separator keeps the plain split it has always had — under any separator but `.`, a `[0]` is part of a key rather
+  than an index.
+
+  The argument order is left alone and remains the trap it was: `pathGet(path, obj)` against `pathSet(obj, path,
+value)`. Flipping it would be caught by the typechecker rather than silently, and there are only two callers — but
+  `pathGetLoose` takes the same `(path, obj)` order as `pathGet`, so flipping one of the pair would replace a trap
+  between get and set with a trap between get and get. The reference documentation's own example had the arguments
+  backwards and is fixed here, which is the evidence that this one is worth deciding rather than leaving implicit.
+
+- c45ac6c: perf(build): precompress the CSS bundle, and serve brotli sidecars ahead of gzip
+
+  The compiled stylesheet went out uncompressed in production. `precompressArtifacts` only walked
+  `.akan/artifact/client`, so every JS chunk got a `.gz` sidecar while the CSS — written to
+  `.akan/artifact/styles` — got none, and `#fileResponse` fell through to streaming the raw file. Nothing was
+  wrong on the serving side: `#isCompressible` already accepts `text/css` and the sidecar lookup already ran.
+  The file simply was not there. On one deployed app that was 319KB on the wire per cold load, against 45KB
+  gzipped. The CSS is and always was minified — Lightning CSS runs in `prepareCssAsset` — so this is purely the
+  transfer encoding.
+
+  Sidecars are now written for `styles/` too, and a `.br` sidecar is written alongside every `.gz`.
+
+  Brotli is tried first and gzip remains the fallback, because browsers only advertise `br` on secure origins.
+  Quality is 11 for CSS and 9 for everything else: there is one CSS asset per basePath and it is the largest
+  single file an app ships, worth ~20% over gzip for ~0.2s, while spending 11 on several hundred JS chunks costs
+  ~12s of build time for a few hundred KB. Measured on `apps/akan`: 371 files, 14.5MB raw, 4.2MB gzip, 3.9MB
+  brotli, and the CSS bundle 103KB raw → 16.2KB gzip → 13.0KB brotli. The compress phase went from ~0.3s to
+  ~0.64s. Gzip sidecars moved to level 9, which is free at build time and was previously left at the default.
+
+  Encoding negotiation moved out of `WebRouter` and `AkanApp` into `resolveEncodedSidecar`. Both classes carried
+  their own copy of the gzip lookup plus `#acceptsGzip` / `#isCompressible`, and a gateway that disagrees with
+  its child about which encoding a request accepts serves a body the caller cannot decode. The shared version
+  also honours `q=0` as the refusal it is, and no longer treats a token merely starting with `br` as brotli.
+
+  **Anything caching in front of the app must pass `Vary: Accept-Encoding` through.** The header was already
+  set, but it only mattered when one encoding was on offer; with two, a proxy that drops or ignores it will
+  hand a brotli body to a client that asked for gzip. Artifacts now carry both sidecars, so a build's static
+  output grows by roughly the brotli total (3.9MB for `apps/akan`).
+
+- f882bbc: Keep a projected field at its declared type instead of guessing it from the value.
+
+  Reading with a `select` — which is also every read of a model that carries a `field.secret`, since those force the
+  projection path — decoded each column by looking at the string it came back as: a value starting with `{` or `[`
+  was `JSON.parse`d, everything else passed through. That is a guess about the field's type made from its data, so
+  the same `field(String)` answered as a string most of the time and as an object whenever a caller happened to
+  store JSON in it. `genImage.prompt` is `field.secret(String)`, so an agent-written prompt that was valid JSON
+  came back as an object and went out to the provider as one.
+
+  The cause is `json_extract`, which unwraps a JSON scalar into a SQL value and so erases the difference between
+  the string `'{"a":1}'` and the object it spells — and returns `0`/`1` for a boolean, which the same path handed
+  back as a number. Projection now selects with `->`, whose result is the value's JSON _text_, and parses that: the
+  type comes from what was stored rather than from what it looks like. Postgres already returned typed jsonb and is
+  left alone; only the heuristic that ran after it is gone.
+
+  The non-projection read path was never affected — it decodes against `FIELD_META` — so this only changes reads
+  that named a `select` or touched a model with a hidden or secret field.
+
+- 2d8de1c: fix(ui): `Refresh` handles pull-to-refresh itself, and `react-simple-pull-to-refresh` is no longer a peer
+
+  `Refresh` loaded `react-simple-pull-to-refresh` through a dynamic import, which the bundler resolves at build time,
+  so the optional peer was in fact required: a workspace that had not installed it failed its CSR build with
+  `Could not resolve: "react-simple-pull-to-refresh"`. `Refresh` now tracks the touch gesture itself — same props,
+  same spinner, refresh past 67px of pull, capped at 95px — and the package is gone from `akanjs`'s peer
+  dependencies. An app that installed it only for `Refresh` can remove it.
+
+- 2d8de1c: fix(signal): a `query` endpoint that declares a `.body()` argument is named in a warning at declaration
+
+  `fetch` sends a query as `GET` with its `.param` and `.search` arguments in the URL and no body, so a `.body()`
+  argument on a query never arrives over HTTP — a required one fails every call, an optional one is always `null` —
+  while an MCP call does deliver it. Behaviour is unchanged; `endpoint()` now logs one warning per such argument naming
+  the endpoint and the argument, and pointing at `.search()` or a mutation.
+
+- f882bbc: feat: `RecentTime` accepts a `relative` prop for customizing relative labels
+
+  Default `fromNow` is unchanged (`하루 전`). `"auto"` / `"always"` switch to `Intl.RelativeTimeFormat` (`어제` vs `1일 전`), and a function replaces the relative label entirely — `breakUnit` still decides when the absolute date takes over.
+
+- ccf2ae2: fix(dev): a page loaded while a save's pages build lands no longer renders without the client components it names
+
+  - `akan start` drops a route's client build when a save invalidates it mid-build. The request that was waiting for
+    that build rendered anyway, from a manifest missing the rows the build would have added, so the RSC payload carried
+    an error row and the page came up blank. The route now builds again at the new generation before it renders.
+
+- 2d8de1c: fix(server): run a route's head once per render, and not at all for a cached replay
+
+  The RSC worker resolved every matched route's head before deciding how to render, although only a partial-commit
+  patch decision ever reads it. A full render therefore ran the head twice, and a replay from the RSC result cache
+  ran it once, backend queries included. The head now runs for that decision only when partial commit is on, the
+  navigation is a patch candidate and the page declares `rscPatchHeadSafe`; otherwise it runs once, inside the
+  render. A replayed cached page runs no head at all, the same as its body: a head that would now throw `notFound()`
+  or `redirect()` no longer pre-empts a cached replay until the entry expires or is invalidated.
+
+- 5f53462: The API and websocket prefixes are configurable, and the browser follows them.
+
+  - `new AkanApp({ prefix, websocketPrefix })` in `main.ts` moves the replica's route table, the gateway's websocket
+    upgrade, `robots.txt`, the locale redirect's API bypass and the OpenAPI `servers` URL — and, through the SSR
+    bootstrap script, the `fetchClient` in every tab the server renders. `AkanApp` also accepts its options as the
+    sole argument now, so the server path no longer has to be spelled out to pass one.
+  - `api: { prefix, websocketPrefix }` in `akan.config.ts` is the build's answer, for the bundles a server never
+    gets to correct: a prebuilt CSR shell and a Capacitor bundle carry it inlined, and the generated Dockerfile
+    writes it as the image default.
+  - Resolution order is `globalThis.__AKAN_PREFIX__`, then `AKAN_API_PREFIX` / `AKAN_WS_PREFIX`, then
+    `AKAN_PUBLIC_API_PREFIX` / `AKAN_PUBLIC_WS_PREFIX`, then `/api` and `/ws`. `getApiPrefix()` / `getWsPrefix()`
+    from `akanjs/base` are the readers; `getEnv()` gains `apiPrefix` and `wsPrefix` beside them.
+  - A prefix is a path segment: a blank value or a bare `/` is refused, and so is one whose first segment is a
+    declared basePath, because either would silently trade the API's routes for the page routes or the reverse.
+    `setPrefix` / `setWebsocketPrefix` now throw after `init()`, where the route table is built, instead of being
+    quietly ignored.
+  - `BlobStorage` derives its default URL prefix from the same value. Blob URLs written before a move stay pointing
+    where they were written — they live on the rows that reference them.
+
+- 5f53462: fix: runtime defects the reference audit turned up
+
+  - `imageOptimizer` re-encodes only JPEG, PNG, WebP and AVIF; a static GIF (or TIFF) that no accepted format beats is
+    served as its own bytes instead of JPEG bytes labelled `image/gif`.
+  - `DataList.sort()` sorts a copy, so the list it was called on keeps a consistent id lookup.
+  - `fetch.view<Model>` exists whenever the model's `get` does, and `edit<Model>` when a create/update/remove endpoint
+    does too; a read-only model used to have neither, and one without `get` had a `view` that always threw.
+    `merge<Model>` still follows `update` alone.
+  - Path parameters are `encodeURIComponent`-ed, so a `/` or `?` in a value no longer reroutes the request.
+  - `ConstantRegistry.serialize` / `deserialize` handle a `Map` of a declared value type instead of throwing.
+  - `BlobStorage` takes `appName` from the deployment env; the server env it was reading has none, so local blobs
+    landed under `local/undefined/`.
+  - UI: `Field.Switch` no longer marks itself optional; `Field.TextList` checks each entry against
+    `minTextlength` / `maxTextlength` and caps the list at `maxlength`; `CsrLink` forwards its props and the caller's
+    `onClick`; `CsrImage` / `Image` pass `alt` through; `useBottomUpTrans` measures height; the safe-area colour falls
+    back to the default page state; `DataColumn.responsive` shows the column from `md` up.
+  - webkit: `useFetch` follows the promise it is handed now rather than only the first one — pass a stable promise, or
+    use `useFetchFn` — and `useCamera` no longer leaves an unhandled rejection in a browser without Capacitor.
+  - `Constant.Doc` and its diagram are translated.
+
+- 2d8de1c: fix(server): request, render and live-sync fixes from the server bug sweep
+
+  - **A multi-hop `x-forwarded-host` / `x-forwarded-proto` is read by its first value** wherever the server builds a
+    public URL — the host→basePath map, the locale redirect and the rendered alternates. `pub, lb:8080` used to be
+    taken whole, so the map never matched and redirects fell back to the internal origin.
+  - **A client-side navigation renders with the locale and public path a page load of the same URL gets**, so on a
+    sub-route host `usePage().path` no longer reads the internal basePath after a navigation.
+  - **Gateway-served immutable assets carry `X-Content-Type-Options: nosniff` and `Referrer-Policy`**, like every
+    response the web router sends. The gateway answers `/_akan/client|styles|fonts/*` itself under `akan start` and
+    with two or more replicas.
+  - **A respawned RSC worker whose init fails is replaced** instead of leaving every render queued behind it until
+    the process restarts.
+  - **A multi-field query loader keys each document unambiguously.** Values that concatenated alike (`x` + `yz` and
+    `xy` + `z`) shared a key, and both callers in the batch got the later document.
+  - **A live-sync room counts one join per socket.** A stray unsubscribe no longer drops a room other sockets are
+    still in, and a socket that subscribed to the same room twice no longer leaves it behind when it closes.
+  - **`/mcp` reads the bearer scheme case-insensitively and past repeated spaces** (RFC 7235, RFC 6750), so
+    `bearer <token>` is judged like `Bearer <token>` instead of passing as no credential.
+
+- 2d8de1c: fix(client): `router.push` / `replace` on the server warn that they do nothing, and name `router.redirect()`
+
+  Called during a server render, both only wrote an `info` line and returned — no navigation, no redirect — so a page
+  that meant to send the visitor elsewhere rendered in place with nothing louder than a log line at the default level.
+  They now log a warning that names `router.redirect()`, the call that answers a server render with a redirect. They
+  still do not throw, so a page that renders today keeps rendering.
+
+- 2d8de1c: fix(server): a backend finishes its shutdown and delivers its last log lines before it exits
+
+  - **The last log batch reaches the parent before a backend exits.** A message sent over IPC right before
+    `process.exit` is lost from 8 KB on, so in `AKAN_LOG_FORMAT=ndjson` the shutdown lines and any final error stack
+    never reached stdout. A backend now waits, up to one second, until that batch is delivered.
+  - **A second `stop()` waits for the shutdown already under way.** It used to return at once, so its caller exited
+    while the first shutdown was still closing services and the log transport — a second SIGINT, or every Ctrl-C
+    under a gateway, where the terminal's signal and the gateway's `shutdown` message arrive together.
+  - The ops snapshot route's 400 now states the id pattern it actually enforces (the first character must be a
+    letter or digit).
+  - An `AKAN_SUB_ROUTE_HOSTS` basePath that is ignored is warned about once per process instead of twice.
+  - The builder-ready log line no longer prints `buildId=undefined`.
+
+- f882bbc: Declare `client/sharedContext.ts` a client module, fixing a boot failure in 3.0.0-alpha.58.
+
+  Under the `react-server` exports condition `react` resolves to `react.react-server.js`, which exports no
+  `createContext` and no stateful hook. The new helper was the one module in `client/` and `ui/` calling
+  `createContext` without `"use client"`, so a server component importing anything from `akanjs/client` pulled it
+  into the react-server graph and the app died at boot with `Export named 'createContext' not found`. Neither
+  typecheck nor build reports it: both resolve `react` the ordinary way.
+
+  A test now fails if any module under `client/` or `ui/` imports a react binding the react-server condition does
+  not provide — `createContext`, `useState`, `useEffect`, `useLayoutEffect`, `useContext`, `useRef`, `useReducer`,
+  `useSyncExternalStore`, `useImperativeHandle` — without declaring the directive. `useMemo`, `useCallback`,
+  `useId`, `createElement` and `Fragment` are provided there and stay unflagged, so a server component keeps using
+  them.
+
+- f882bbc: Render a `Map` field in the API explorer instead of crashing the page.
+
+  A Map field's `modelRef` is the `Map` constructor itself — it belongs to no registry, and the value type lives in
+  `of`. `Signal.Object.Detail` handed that constructor to `ConstantRegistry.getModelName`, which threw
+  `No ref name for modelRef: function Map()`, so every model carrying one took down `<Signal.Doc.Zone />` on render.
+  It now labels the column `Map` and leaves the existing `⇒ <value type>` beside it.
+
+  The request and response examples had the same blind spot one layer down: they walked `Map[FIELD_META]`, which is
+  `undefined`, so an endpoint whose body or return carried a Map threw before the sample JSON was built. A Map now
+  serializes into the example as the string-keyed object it is on the wire — `{ "key": <value example> }`.
+
+- 2d8de1c: fix(signal): mark a slice's `.body()` deprecated — `fetch` never sends its argument
+
+  A slice is served as GET queries (its list and insight reads), and a GET carries no body: `fetch.*` sends only a
+  slice's `.param` and `.search` arguments. A required `.body` argument therefore failed every call with a
+  missing-value error, and an optional one always arrived as `null`. `.body()` still declares the argument exactly as
+  before, so nothing changes at runtime; the editor now shows it as deprecated. Declare the argument with `.search`
+  (or `.param`) instead.
+
+- 5f53462: fix: `Load.Units` rehydrates when a route change swaps its `init` for one with different query args
+
+  A slice's store is one global bucket keyed by the slice name, so `ticketListInProject` is shared by every project.
+  `Load.Units` latched hydration on a mount-scoped `useRef(false)` with `[]` effect deps, so the first `init` it saw
+  was the only one it ever read. Navigating between two routes that render the same slice with different args — a
+  project switch, an org switch, any `[id]` change under a shared tab layout — reuses the mounted instance, and the
+  latch made it keep rendering the previous route's rows: the page fetched the right data on the server and threw it
+  away on the client.
+
+  Hydration identity is now the init payload's `queryArgs`, matching what `Load.View` already does with the model
+  id: `loaded` is true only while the hydrated args still equal the ones `init` carries, and the memo and both
+  effects key off the same signature. Same args arriving again — a `router.refresh()`, a re-render — still hydrate
+  once, so client-side page, sort, and filter state is not clobbered.
+
+- 5f53462: A solo replica logs its boot at `info`, so a production container that runs the one traffic replica prints a line
+  instead of leaving stdout empty until something goes wrong.
+
+  `b42b7246` demoted that line to `debug` while trimming dev boot output. In a gateway deployment it costs nothing —
+  `AkanApp gateway is running on port …` is `info`, and `akan start` never takes the solo path — but
+  `AKAN_REPLICA=0,0,1`, which is what the chart deploys, has no gateway, and every other line a solo boot passes
+  through is `verbose`. With the image's `AKAN_LOG_TO_FILE=0` and canonical request lines off by default, a healthy
+  pod logged nothing at all: `kubectl logs` on a running container came back empty, and a crash looked the same as a
+  quiet boot.
+
+- 5f53462: `Loading.Spin` takes the color and the size the caller gives it, instead of pinning both to the icon
+
+  The spinner hard-coded `text-primary/70` and `text-xl` **on the icon**, while `className` landed on the wrapper
+  around it. So every `text-*` and every `size-*` a caller passed was a silent no-op — `cn` merged it into a class
+  list the icon never read — and the worst case was a filled surface: a `<Badge variant="info">` renders
+  `text-info-foreground`, the spinner inside it stayed `text-primary/70`, and green-on-cyan at L 70% against L 74%
+  is a 1.10:1 contrast that leaves the badge's text legible and the spinner invisible.
+
+  Both now sit on the wrapper. The icon is drawn at `1em` in `currentColor`, so color and size cascade into it, and
+  `className` — merged last — wins over either. `tone="current"` names no color at all, which is what a filled
+  surface needs: the spinner inherits whatever foreground the badge or the button already set. `tone` defaults to
+  `"primary"`, so nothing that exists renders differently, and `"muted"` is there for a secondary surface.
+
+  `size` also takes a number now, drawn as that many pixels, because the named steps were the only vocabulary and a
+  caller reaching past them wrote `size-[50px]` — a 50px empty box around a 20px icon. A custom `indicator` is left
+  alone by `tone` exactly as before: it carries its own color, and the rotation is the wrapper's.
+
+- ccf2ae2: feat(dev): SSR pages load their client code from a dev module registry
+
+  - Under `akan start`, an SSR page's `"use client"` code now comes from a module registry under
+    `.akan/artifact/ssr-dev`, the same machinery the dev CSR registry uses, instead of the route chunks. React and the
+    akanjs vendor facets stay the import map's, so the page keeps one React and one store registry. The route chunks and
+    the `client-refresh` that re-imported all of them are gone from dev; `akan build` is unchanged.
+  - A save patches the changed module in place with React Fast Refresh: state stays, and on minimal a component edit
+    shows in about 110ms instead of 900ms. Undoing an edit now shows too; with chunks the browser kept the module it had
+    already imported for that URL. A client module the RSC payload names that also exports constants re-runs in place.
+  - A save that changes nothing the server renders (a `"use client"` module that keeps its export names, or a module only
+    client code imports) keeps the page's build id and refetches no RSC payload. One that does — a component both sides
+    render, a constant — holds its client patch until that save's pages build lands, then sends the patch and the RSC
+    refresh together, so the page never runs new client code against old server props. A constant edit that reloads
+    waits for that build too, and a backend restarted by a server-only save renders from the latest pages build.
+  - The registry builds once in a build worker after the dev server boots, beside the builder's slow lane, and each route
+    build adds the entries its page names that the registry lacks; a page served before the registry exists waits for
+    it in the browser, in short holds. Route builds no longer bundle browser chunks in dev, which took about 240MB off
+    the builder's peak on apps/akan.
+  - Most saves are patched in the resident builder: a new file, a new import from a package something already resolved,
+    a moved or renamed file (a case-only rename, `Foo.tsx` to `Foo/index.tsx`, a file created beside a folder an import
+    resolved to), a deleted module brought back. A whole build in a build worker is left for a new npm package, a signal
+    save (its metadata is inlined into the client runtime; a dictionary save does not rebuild the SSR registry, which
+    inlines none), and a registry whose last whole build was cut short. A save that does not compile — a typo in an
+    import included — is reported by the builder at once, and the save that fixes it patches in about 120ms.
+  - A failed build keeps the registry the tabs and the next save read. Its error stays on the overlay, is shown to a tab
+    opened while it stands, and clears with the save that fixes it — for a route that failed on a shared module too,
+    which is built again once a newer build goes green. A broken file no page imports any more stops failing saves.
+  - A client module whose top level threw, or a store that throws at startup, recovers with the save that fixes it, and
+    the dev server's error page carries the HMR client, so it reloads once the fix lands. A pages bundle that builds but
+    throws while it loads shows its error while the RSC worker keeps serving the bundle it had.
+  - A tab that reconnects after a backend restart loads the patches it missed and refetches its payload instead of
+    reloading; one that reconnects to a new dev session (a new `akan start`, a config restart) reloads onto its registry.
+    A tab that booted beside the vendor file of the build before loads the newer one, so a new npm import in a leaf
+    component works without a manual refresh.
+  - A build worker exits with the builder that spawned it, and a boot build whose worker was killed is retried after 10
+    seconds. On Windows, registry writes retry a rename refused while a reader holds the file, and a build worker hashes
+    the same bundle config as the builder, so saves are not all handed to whole builds.
+
+- 2d8de1c: fix(server): a client-side navigation on a sub-route host stays inside that host's basePath
+
+  On a host mapped to a basePath (`subRoutes` or `AKAN_SUB_ROUTE_HOSTS`), a page load rewrites every path into that
+  basePath, so a path only another basePath serves is a 404 there. A client-side navigation (`<Link>`,
+  `router.push`) also tried the other basePaths and rendered their pages under the mapped host's domain: on the
+  `soft` host, `/en/admin` and `/en/office/admin` both showed `office`'s admin page. The navigation now resolves its
+  target exactly as a page load on that host does, so the two answer the same page, or both a 404. A host with no
+  basePath of its own (a debug host, `akan start` on localhost) still finds the basePath whose route matches.
+
+- 69f7178: fix(service): let `onInit` and `onDestroy` be declared sync
+
+  `Adaptor` and `Service` both declared the pair as `onInit(): Promise<void>`, so a hook with nothing to await was a
+  type error even though every call site already awaited it:
+
+  ```
+  Property 'onInit' in type 'SyncAdaptor' is not assignable to the same property in base type '… & Adaptor'.
+  ```
+
+  Both hooks — and the interceptor's pair, which is the same shape — now return `Promise<void> | void`, the same
+  spelling `_preRemove` and the DI's own `onDestroy` probe already use. `override async onInit()` is unchanged.
+
+  ```ts
+  export class Cursor extends adapt("cursor" as const, () => ({})) {
+    override onInit() {
+      this.watcher = watch(this.root);
+    }
+    override onDestroy() {
+      this.watcher?.close();
+    }
+  }
+  ```
+
+  The default no-op bodies stopped being `async` as part of the same change: `serve()`'s implementation returns the
+  raw class, and TypeScript checks each overload's return type against it in one direction or the other, so widening
+  the interface while the base stayed `async` left neither direction assignable and broke `serve` itself with TS2394.
+  The one observable consequence is that an un-overridden `onInit()` returns `undefined` rather than a resolved
+  promise — `await` reads both the same, but `.then()` on it does not.
+
+  `_libsOnInit` / `_libsOnDestroy` now wrap each hook call. A sync hook that throws used to escape the `.map` before
+  `Promise.all` was ever reached, stranding the promises the async hooks beside it had already started; the throw
+  now arrives as a rejection with every sibling still attached.
+
+- 5f53462: feat: the agent's pointer lives for the turn, and waits out the model's own thinking
+
+  The pointer's life was measured in the gap between **calls** — 1.4 seconds of quiet and it faded. But a model's
+  calls arrive with its own writing between them, which takes several seconds, so a turn of four calls was four
+  pointers: each one appeared, pressed, and vanished before the next arrived. The unit was wrong.
+
+  `AgentSession` now reports the boundary that matters. `onTurn(running)` fires once when a turn starts and once
+  when it settles, and only the conversation loop reports there: `compact` runs under the same internal flag and
+  drives nothing on screen, so a host drawing the agent at work would otherwise draw it for a summary nobody asked
+  to watch. Between the calls of one turn the pointer stays where it last landed and turns into a spinner, because a
+  pointer sitting perfectly still for four seconds reads as stuck rather than as waiting.
+
+  It still appears only at the first control it presses, and **a turn that drove no control draws no pointer at
+  all** — parking one in a corner for a turn that only answered a question would be the screen claiming something
+  that did not happen.
+
+  While a reveal scrolls the page to the next control, the pointer holds still the way a person's does and carries a
+  chevron pointing the way the view is travelling — stillness over a sliding page otherwise reads as a pointer that
+  has come loose rather than as the one doing the scrolling. The scroll budget is now spent per turn as well, instead
+  of per quiet second, which is what it was always guessing at.
+
+  **`navigate` draws again, but only on an element.** The link a navigation is going to, when exactly one visible
+  link goes there, is pressed before the route moves — which needs the call to wait, so `ToolRunner` now awaits the
+  `start` activity and `AgentSession.onActivity` may answer a promise. `AgentVisual` returns one for that call alone
+  and caps it at 600ms; everything else still draws while the call is already running. An off-screen link is left
+  alone, because scrolling to a link and then leaving the page it is on is two motions for one act. **Link presence
+  decides what is drawn, never what is allowed**: the agent may still navigate anywhere the user could type, and a
+  zone that must stay on one screen drops `navigate` through `builtins` as before.
+
+  `Router.routeOf(pathname)` is what compares the two addresses — the locale and base-path segments live on the
+  `<a href>` and never on the tool argument. It is `getPath` without the browser guard, which `getPath` only needs
+  for its own default argument.
+
+  **The pointer clears the control before it waits.** A spinner parked on the button it just pressed reads as one
+  stuck to it, and it covers the very change the press caused — a person clicks and takes the hand away. It drifts
+  just past the control's box, down and to the right unless the viewport edge is there, and spins from that spot.
+
+  **A control the screen is not actually showing is not pointed at, and the pointer goes rather than travelling to
+  it.** `checkVisibility` answers about an element alone, so one under a modal's backdrop, inside a drawer that has
+  slid off, or faded to nothing all pass it while being invisible to the user — and a pointer sent there lands on a
+  blank patch of overlay, which reads as the effect being broken rather than as the agent acting. The test is
+  `elementFromPoint` at the control's own centre, taken after the reveal has settled, with an ancestor counting as a
+  hit so a `<label>` wrapping its input is not mistaken for an occlusion.
+
+  **`agentAttrs(handler, key)` tells namesakes apart.** One tool serves a whole tab strip or a whole list, so every
+  control carrying it was interchangeable in the DOM and the no-guessing rule turned that into drawing nothing.
+  A key — in the same vocabulary the call's argument uses — lets the pointer pick the one the call named; short of
+  exactly one answer nothing is still drawn. `Tab.Menu` now passes its own `menu` key, so switching a tab is drawn
+  on the menu that was switched to.
+
+  `reveal` and `cursor` are now independent, as their names always claimed: `visual={{ reveal: false }}` keeps the
+  pointer and drops the ring, where before it dropped both.
+
+- 2d8de1c: fix(tunnel): a shared app keeps answering after its websockets close
+
+  A finished websocket stream closed its data socket, but the tunnel agent kept counting that socket as idle, so it
+  never opened a replacement. Every page reload closes its HMR socket, so an `akan start --share` tunnel with the
+  default four idle sockets stopped answering after about five reloads, until the control link reconnected. A
+  finished stream now retires its socket and the pool refills it.
+
+  A raw TCP stream also ended in a stack overflow (the stream and its socket closed each other in a loop), and it
+  forwarded a fast origin's output without waiting for the tunnel socket to drain. Neither path is opened by the
+  current wire protocol; both are fixed ahead of it.
+
+- 2d8de1c: fix(tunnel): a websocket stream the gateway resets gives its data socket back
+
+  When the gateway reset a tunnelled websocket, the agent closed the local websocket but left the data socket that
+  carried it open. The wire contract never returns a raw stream's socket to the pool, so the gateway could not use it
+  again, while the agent counted it as idle and opened no replacement: every reset shrank the working pool by one.
+  The agent now closes that data socket, as it already did when a websocket or TCP stream ends on its own side or the
+  gateway resets a TCP stream, and opens a fresh one in its place.
+
+- 2d8de1c: fix(tunnel): a tunnelled TCP stream half-closes instead of hanging up
+
+  The wire contract ends each direction of a stream on its own, but the agent's raw TCP stream treated the
+  gateway's `end` as the end of everything. It closed the connection to the local port outright, so whatever the
+  origin answered after the caller's end of input was lost, and bytes the caller sent after the origin finished its
+  own side were dropped too. The agent now shuts down only the direction that ended: the origin sees end of input and
+  can still answer, and the caller can keep sending after the origin's end. The data socket goes back once both
+  directions are done or the stream is reset. The local connection is dialled through `node:net`, because
+  `Bun.connect` stops reading once its write side is shut down (Bun 1.4). Wire version 1 opens no TCP stream yet, so
+  no running tunnel behaves differently today.
+
+- 2d8de1c: fix(tunnel): a tunnelled websocket stream's `run()` finishes however the stream ends
+
+  `TunnelWebsocketStream.run()` (`akanjs/server/tunnel`) resolved only when the local websocket closed or failed on
+  its own. When the stream was reset instead — by the gateway, by the gateway dropping the data socket under it, or by
+  the agent stopping — the promise never settled, unlike the http and tcp streams. It now resolves once on every path,
+  and a reset that arrives after the stream has already ended releases the data socket no second time. The agent
+  itself never awaited it, so a tunnel behaves the same.
+
+- 5f53462: fix: every store write marks the slice payloads stale, and `Load.View` refetches a replayed one
+
+  A write patches the lists and the model the store holds, but the RSC payload each of them was hydrated from still
+  carries the pre-write rows — and `rscCache` replays that payload verbatim when the user navigates back to a route
+  they already visited. So changing a ticket's status in one project, switching projects, and coming back showed the
+  status the page was first rendered with.
+
+  `staleAtOfOtherSlices` was the only guard against this and it was half-wired: it ran on `create<Model>` /
+  `create<Model>InForm` only, and it excluded the slice that issued the write. `update<Model>`,
+  `update<Model>InForm`, `merge<Model>`, `remove<Model>` and `set<Model>` — the last of which is where every custom
+  mutation endpoint commits its result — stamped nothing at all.
+
+  It is now `staleAtOfSlices`, stamped by all seven writes across every slice including the issuing one. The
+  exclusion bought nothing: the stamp starts no fetch, because `Load.Units` only re-checks staleness when a list
+  re-hydrates, and the slice that took the optimistic patch is exactly as far behind in its payload as its siblings.
+
+  `Load.View` had the same hole with no guard at all — view a model, edit it, view another, come back — and now
+  refetches through `view<Model>` when the payload it is re-hydrating from predates the last local write. It reads
+  `<refName>StaleAt`, the root slice's stamp, and does nothing on a model whose signal declares no slice.
+
+  Both checks compare a server-generated `initAt`/`viewAt` against a client-generated `staleAt`, so a badly skewed
+  client clock costs an extra refetch per navigation (clock ahead) or misses one (clock behind). That trade is
+  unchanged from the create path this generalizes.
+
+- f882bbc: Rename a zone's scope-prefixed tools onto what a provider's function-calling wire accepts.
+
+  A zone publishes `<id>.<name>`, which is legal for MCP but rejected by every OpenAI-compatible and Anthropic
+  function schema — those allow `[A-Za-z0-9_-]` only, up to 64 characters. The name went to the provider verbatim.
+  A validating provider answers 400; DeepSeek did not, and what happened instead was harder to find: the model
+  normalized the illegal name itself, called the bare tool, and the browser answered `Unknown tool` for a tool that
+  was published all along, spending a turn.
+
+  `AgentService.runTurn` now renames every tool name in the request — the published tools and the calls the
+  transcript still carries — and reads the answer back under the name the surface registered. A request whose names
+  already fit is handed on as the same object, so the root agent's turn is unchanged. `Agent.Context`'s Assemble
+  now lists the published tool names, which is where a prefix mismatch is visible in one glance.
+
 ## 2.4.2
 
 ### Minor Changes