fix(dashboard): cancel a transfer once when its Cancel is double-clicked

A cancelled row stays clickable while it fades out, so a double-click ran the cancel twice: two abort requests for an upload, and for a guest session two "save your session" prompts.
fix(dashboard): word a transfer's time left in Traditional Chinese, Portuguese and Ukrainian
2026-11-13 20:12:57 -10:00 · 2026-10-25 19:48:54 -07:00 · 2026-10-25 19:48:25 -07:00 · 2026-10-25 19:47:44 -07:00 · 2026-10-25 19:46:53 -07:00 · 2026-10-25 19:45:04 -07:00
628 changed files with 9126 additions and 68721 deletions
@@ -47,13 +47,3 @@ jobs:
                  PUTER_TEST_AI_MOONSHOT_API_KEY: ${{ secrets.PUTER_TEST_AI_MOONSHOT_API_KEY }}
                  PUTER_TEST_AI_ZAI_API_KEY: ${{ secrets.PUTER_TEST_AI_ZAI_API_KEY }}
                  PUTER_TEST_AI_ELEVENLABS_API_KEY: ${{ secrets.PUTER_TEST_AI_ELEVENLABS_API_KEY }}
-
-            # Realtime conversations through the SDK against live OpenAI. Builds
-            # the SDK bundle these tests load itself, so it runs even when the
-            # step above fails; the tests skip themselves without the key.
-            - name: Run live realtime conversation tests
-              if: ${{ !cancelled() }}
-              run: npm run setupExtensions && (cd src/puter-js && npm run build) && npx vitest run --config src/puter-js/tests/api/vitest.config.ts src/puter-js/tests/api/realtime/convoLive.test.ts
-              env:
-                  CI: 'true'
-                  PUTER_TEST_AI_OPENAI_API_KEY: ${{ secrets.PUTER_TEST_AI_OPENAI_API_KEY }}
@@ -118,13 +118,9 @@ jobs:
      fail-fast: false
      matrix:
        include:
-          # The base branch lives in this repo; for a fork PR, the head
-          # repo's copy of it can be arbitrarily stale.
          - ref: ${{ github.base_ref }}
-            repository: ${{ github.repository }}
            artifact: base
          - ref: ${{ github.head_ref }}
-            repository: ${{ github.event.pull_request.head.repo.full_name }}
            artifact: pr

    steps:
@@ -133,7 +129,7 @@ jobs:
        uses: actions/checkout@v7
        with:
          ref: ${{ matrix.ref }}
-          repository: ${{ matrix.repository }}
+          repository: ${{ github.event.pull_request.head.repo.full_name }}

      - name: Set up Node.js
        if: needs.changes.outputs.puterjs == 'true'
@@ -201,6 +201,6 @@ Recipes are tested, copy-pasteable patterns for a task, one layer above the per-

 - **Reuse existing UI primitives before writing new ones.** Windows and dialogs are `UIWindow*` functions in [src/gui/src/UI/](src/gui/src/UI/); generic pieces already exist (`UIAlert`, `UIPrompt`, `UIContextMenu`, `UINotification`, `UIPopover`, widgets in [UI/Components/](src/gui/src/UI/Components/)). A new window should read like its neighbors: an async function taking an options object, composing an HTML string, wiring behavior with jQuery, delegating to `UIWindow(...)`.
 - **Match the visual language.** Use existing CSS classes (`button`, `button-primary`, window chrome, form styles) and copy the layout patterns of neighboring windows; new styles go in [src/gui/src/css/](src/gui/src/css/) following existing conventions. Verify anything positional (menus, overlays, z-index) on both desktop and mobile viewports.
- **i18n every user-facing string.** No hardcoded UI text — use `i18n('key')` and add the key to [src/gui/src/i18n/translations/en.js](src/gui/src/i18n/translations/en.js).
+- **i18n every user-facing string.** No hardcoded UI text — use `i18n('key')` and add the key to [src/gui/src/i18n/translations/en.js](src/gui/src/i18n/translations/en.js). Run `npm run check-translations` before opening the PR.
 - **Shared logic goes in helpers/services.** Reusable non-UI logic belongs in [src/gui/src/helpers/](src/gui/src/helpers/) or [src/gui/src/services/](src/gui/src/services/), not copy-pasted between windows.
 - **Tests.** Vitest is wired for the GUI (`src/**/*.test.js`; see [appOrder.test.js](src/gui/src/UI/Dashboard/appOrder.test.js) for the shape). Extract pure logic into functions and test those. Desktop behavior driven through puter.js (`puter.ui.*`) is covered by the Playwright harness in [src/puter-js/tests/e2e/](src/puter-js/tests/e2e/) — add a spec there when you change how the desktop renders SDK-driven UI.
@@ -73,12 +73,6 @@ COPY --from=build --chown=node:node /opt/puter .
 RUN mkdir -p /etc/puter /var/puter && \
    chown -R node:node /etc/puter /var/puter

-# Fix outdated HOME_URL in /etc/os-release (see issue #4329)
-# The base image may contain a reference to the old phoenix repository.
-RUN if [ -f /etc/os-release ]; then \
-      sed -i 's|HOME_URL="https://github.com/HeyPuter/phoenix"|HOME_URL="https://github.com/HeyPuter/puter"|' /etc/os-release; \
-    fi
-
 # Self-hosters mount their override at this exact path. The v2 loader
 # deep-merges it over config.default.json (see backend/index.ts).
 ENV PUTER_CONFIG_PATH=/etc/puter/config.json
@@ -93,4 +87,4 @@ USER node
 HEALTHCHECK --interval=30s --timeout=3s --start-period=30s --retries=3 \
    CMD wget --no-verbose --tries=1 --spider http://puter.localhost:4100/test || exit 1

-CMD ["node", "-r", "./dist/src/backend/telemetry.js", "./dist/src/backend/index.js"]
+CMD ["node", "-r", "./dist/src/backend/telemetry.js", "./dist/src/backend/index.js"]
@@ -350,9 +350,6 @@
    // not, a row past this is swept. Off by default; any value above 0 arms
    // the sweep.
    // "notificationRetentionDays": 14,
-    //
-    // Ms a live notification waits for open tabs to acknowledge it.
-    // "notificationAckTimeoutMs": 5000,

    // ── Alarms / alerting ───────────────────────────────────────────────
    // Where system alarms go. Severity is the routing decision — each
@@ -47,7 +47,7 @@ Both are supported ways to define an API. **Prefer a controller when you need fi

 Provider sign-in requires the account's authenticator or a recovery code when 2FA is enabled, including signup callbacks that resolve an existing account. The five-minute challenge uses the same single-use `/login/otp` and `/login/recovery-code` verification as password sign-in. The GUI carries it in a URL fragment and removes it before initialization. A session and successful popup-return proof are issued only after verification; cancelling retains the popup's signed retry context without marking it authenticated.

-Disabling 2FA through `/user-protected/disable-2fa` requires both password or OIDC revalidation and either the current six-digit authenticator `code` or an unused recovery code in `code`. Recovery codes are consumed atomically. Missing or incorrect codes leave the secret and remaining recovery codes intact. A team's requirement for 2FA still prevents disabling it.
+Disabling 2FA through `/user-protected/disable-2fa` requires both password or OIDC revalidation and the current six-digit authenticator `code`. Missing, malformed, or incorrect codes leave the secret and recovery codes intact. A team's requirement for 2FA still prevents disabling it.

 Email changes through `/user-protected/change-email` require the password or OIDC revalidation cookie, plus a six-digit `code` from the authenticator when 2FA is enabled. Missing or malformed codes return `400 bad_request`; incorrect codes return `401 code_mismatch`. Both include `factor: 'otp'`. Confirmation links are bound to that verified request. A 2FA-enabled account must request a new link if its existing link was issued without second-factor verification.

@@ -59,10 +59,6 @@ store:
  row — and the query seeks past it (`WHERE (col, id) > (?, ?) ORDER BY col,
  id`). Any SQL list gaining a cursor must have a deterministic `ORDER BY`
  ending in a unique tiebreaker (`id`).
- The notification catch-up (`GET /events/fetch`) holds two keysets in one
-  sealed cursor: the last `id` it returned, and the last `(replaced_at, id)`
-  among rows up to that id. Each is its own indexed read, merged into one
-  page, so a row replaced after a client read it comes back from that cursor.

 Cursors that carry a sort also pin it: a request that passes a cursor plus a
 conflicting sort is rejected with 400.
@@ -1,79 +0,0 @@
-# Browser push client
-
-Puter's desktop shows pushes through `/sw.js`. Core registers it, and shows Settings → Notifications, only when the `pushEnabled` gui param is `true`; core never sets it. A backend extension that delivers pushes sets it with `services.homepage.setGuiParam('pushEnabled', true)` and can load its own code into the worker with `services.homepage.registerServiceWorkerScript(path)`.
-
-Core subscribes the browser to a push service only when the server also publishes `pushWebPushKey` (see [Built-in Web Push client](#built-in-web-push-client)), and it has no `/push/*` routes of its own. The device, app, preference and subscription endpoints below come from that extension. On a deployment without one, such as most self-hosted servers, they answer core's plain 404 (`code: 'not_found'`), which `puter.notifications` reports as `push_unavailable` and the Notifications tab shows as unavailable. A device the extension can't find is `device_not_found`.
-
-## Push payload
-
-`sw.js` reads the push's JSON body. The message is its `puter` field, or `data.puter` for services that only carry string data, as an object or a JSON string:
-
-```ts
-{ uid?: string; title?: string; body?: string; icon?: string; group?: string;
-  target?: { app?: string; path?: string }; data?: unknown; channel?: string;
-  type?: 'challenge'; challenge?: string }
-```
-
-`uid` is the notification's uid, a later push with the same `group` replaces the one showing, and `target` and `data` reach the app when the user taps it.
-
-When the browser replaces the subscription (`pushsubscriptionchange`), `sw.js` posts `{ type: 'puter-push-subscription-changed' }` to every open window on Puter's origin. The worker has no token or session, so the page's push client registers the new subscription.
-
-## Receipts
-
-Before a notification is pushed, the server asks the open clients whether they received it live. It sends `notif.receipt` with `{ uid }` on the user's sockets for the app that sent it, or on the desktop's sockets for Puter's own notifications. The SDK remembers the uids its page received through `onNotification()`, `onPush()` or the desktop's feed, and answers once its page has that notification, or with `{ received: false }` when it never gets it. The server waits up to 5 seconds (`notificationAckTimeoutMs`).
-
-An answer carries `visibilityState`, `focused` and `showsOwn`, the last being whether the page shows the notification itself. A website page shows it itself when it is hidden or unfocused, has an `onPush()` handler and notification permission, and no other tab of the same site is focused. Inside the desktop, the desktop shows it, and an app's `onPush()` result is never shown as a browser notification.
-
- An answer from a page that is visible and focused, or that shows the notification itself, stops the push.
- Otherwise the notification is pushed. A website's pushes go only to the browsers that subscribed through its own worker, never to Puter's `/sw.js`. An app inside the desktop pushes through `/sw.js`, which shows the app's name and icon.
- A hidden desktop tab shows no banner, so answers only from hidden desktop tabs don't stop a push of Puter's own notifications.
- A client that can't answer, such as an older puter.js, holds the push back while it is connected.
-
-## Registering
-
-The registry is in [src/gui/src/helpers/pushClient.js](../src/gui/src/helpers/pushClient.js). A service script registers its client like this:
-
-```js
-service_script(async (api) => {
-    api.use()['push.registerPushClient']?.(client);
-});
-```
-
-`use(id)` throws when nothing is registered under `id`, so the form above also runs on a Puter version without the registry and does nothing there. Any script that runs after the GUI bundle can call `use()['push.registerPushClient']?.(client)` the same way. Registering again replaces the client. Registering dispatches `push-client-registered` on `window`, and an open Notifications tab redraws.
-
-With no client registered, the tab says push notifications aren't available in this browser.
-
-### Built-in Web Push client
-
-When the server also sets the `pushWebPushKey` gui param (a VAPID public key), core registers its own client ([webPushClient.js](../src/gui/src/helpers/webPushClient.js)) unless an extension registered one first. It uses `puter.notifications.enable()` / `disable()`, the same standard Web Push flow apps use on their own origins:
-
-1. `GET /push/web/key` for the key, then `pushManager.subscribe()` on the `/sw.js` registration.
-2. `POST /push/web/subscriptions { subscription }`. A subscription the server already has answers `{ status: 'active' }`. A new one answers `{ status: 'pending' }`, and the server sends it a push with `{ type: 'challenge', challenge }`.
-3. The worker shows that push and posts `{ type: 'puter-push-challenge', challenge }` to the origin's windows; the page sends it to `POST /push/web/subscriptions/verify`. The device is registered once the page hands the confirmation back.
-4. `DELETE /push/web/subscriptions { endpoint }` removes it.
-
-Apps on their own origin do the same through `push-sw.js`, which they import into their own worker. A subscription made with an app token is the app's: its pushes are that app's notifications only.
-
-## Interface
-
-```ts
-interface PushClient {
-    enable(): Promise<{ deviceUid: string }>;
-    disable(): Promise<void>;
-    status(): Promise<{
-        permission: 'default' | 'granted' | 'denied';
-        registered: boolean;
-        deviceUid?: string;
-    }>;
-}
-```
-
- `enable()` may ask for notification permission, so core calls it from a click: Turn on in the Notifications tab, Allow on a permission prompt that includes `notifications:push` while this browser is off, and the "Turn on notifications" button of the `/action/enable-push` popup and the matching desktop dialog (`UIEnablePushDialog`). Core also calls it without a click, from `helpers/pushSync.js`, when `Notification.permission` is already `granted`, `status()` reports the browser as not registered, the user has not turned push off in this browser, and an app holds `notifications:push`; the browser does not prompt then. The built-in client runs `puter.notifications.enable()`, which subscribes with the `/sw.js` registration and registers the browser through the Web Push flow above (`platform: 'webpush'`). It then resolves the `uid` of this browser's `webpush` device from `listDevices()`. It rejects when permission is refused or the browser wasn't registered.
- `disable()` runs `puter.notifications.disable()`, which sends `DELETE /push/web/subscriptions { endpoint }` and ends the browser's subscription. The tab calls it for Turn off, and for Remove on the device marked as this browser. Remove on any other device is `DELETE /push/devices/:uid`.
- `status()` reports the state without prompting. `permission` is `Notification.permission`. `registered` is true when this browser has a device registered for the signed-in user, and `deviceUid` is that device's `uid`.
-
-After `enable()` resolves, the tab calls `POST /push/devices/:uid/test` and asks the user whether a notification showed up.
-
-The tab also reads `GET /push/apps` and `GET`/`POST /push/preferences`.
-
-Core keeps its own record of a browser the user turned off, `puter.push.browser-off:<user uuid>` in `localStorage`, written by Turn off and by Remove on this browser's device, and cleared when `enable()` resolves. The silent registration above skips a browser with that record, so a device removed here stays removed while one removed from another device, or a new sign-in in a browser that already allows notifications, registers again.
@@ -12,17 +12,7 @@ Generates secrets, writes `.env` + `puter/config/config.json`, downloads `docker

 ## Requirements

- **Docker** with the `compose` plugin. This is the one thing you have to install
-  yourself — the installer checks for it and stops with an explanation rather
-  than installing it for you.
-  - **macOS / Windows:** [Docker Desktop](https://docs.docker.com/get-docker/).
-    Both ship the `compose` plugin.
-  - **Linux:** [Docker Engine](https://docs.docker.com/engine/install/) plus the
-    [`docker-compose-plugin`](https://docs.docker.com/compose/install/) package.
-  - Confirm before running anything else: `docker compose version` should print a
-    version, not `command not found`.
-  - If Docker is installed but the shell can't see it, make sure your user is in
-    the `docker` group (Linux) or that Docker Desktop is actually running.
+- **Docker** with the `compose` plugin.
 - A **domain** with DNS access — you need a wildcard record (`*.your-domain.com` → server IP). Puter routes by subdomain (`api.<domain>`, `site.<domain>`, `app.<domain>`).
 - Optional: **TLS certs** (or `certbot` to grab them — see Step 3).

@@ -667,14 +657,6 @@ Migrations re-apply idempotently across pulls. Volumes are preserved.

 ## Troubleshooting

-**`missing required command: docker` — the installer stops immediately.**
-Docker isn't on your `PATH` yet. Puter self-hosting is a Docker Compose stack, so
-nothing can run without it. Install [Docker Desktop](https://docs.docker.com/get-docker/)
-on macOS/Windows or [Docker Engine](https://docs.docker.com/engine/install/) plus
-`docker-compose-plugin` on Linux, then confirm `docker compose version` works in
-the same shell and re-run the installer. On Linux, a fresh Docker install usually
-needs a new login session before your user picks up the `docker` group.
-
 **Site loads but I get a 502 / "Bad Gateway" from Caddy.**
 The puter container failed to come up. `docker compose logs puter` will tell you which dependency rejected it (most often DB password mismatch between `.env` and `config.json`).

@@ -314,41 +314,6 @@ describe('thumbnails extension — handleThumbnailRead', () => {
        await server?.shutdown();
    });

-    it('keeps read URLs stable within an hour and rotates them at the next hour', async () => {
-        const key = mintedKey();
-        const signedAt = Date.UTC(2026, 9, 26, 10);
-        const read = async () => {
-            const entry: Record<string, unknown> = {
-                thumbnail: `s3://${BUCKET}/${key}`,
-            };
-            await handleThumbnailRead(entry, {
-                s3,
-                s3Presign,
-                bucketName: BUCKET,
-                bucketEndpoint: BUCKET_ENDPOINT,
-                fsEntry: server.stores.fsEntry,
-            });
-            return entry.thumbnail as string;
-        };
-        vi.useFakeTimers({ toFake: ['Date'] });
-        try {
-            vi.setSystemTime(signedAt + 1000);
-            const first = await read();
-            vi.setSystemTime(signedAt + 3599_000);
-            expect(await read()).toBe(first);
-            expect(new URL(first).searchParams.get('X-Amz-Date')).toBe(
-                '20261026T100000Z',
-            );
-            expect(new URL(first).searchParams.get('X-Amz-Expires')).toBe(
-                '604800',
-            );
-            vi.setSystemTime(signedAt + 3600_000);
-            expect(await read()).not.toBe(first);
-        } finally {
-            vi.useRealTimers();
-        }
-    });
-
    // Thumbnails stored before keys were bound to entries keep displaying.
    it.each([
        ['an entry-bound key', () => mintedKey()],
@@ -307,9 +307,6 @@ export const handleThumbnailRead = async (
    const thumb = entry.thumbnail;
    if (typeof thumb !== 'string' || !thumb) return;
    const presignClient = deps.s3Presign;
-    const signingDate = new Date(
-        Math.floor(Date.now() / 3_600_000) * 3_600_000,
-    );

    if (isStoragePointer(thumb, deps.bucketEndpoint)) {
        const key = resolveThumbnailKey(thumb);
@@ -322,7 +319,7 @@ export const handleThumbnailRead = async (
        entry.thumbnail = await getSignedUrl(
            presignClient,
            new GetObjectCommand({ Bucket: deps.bucketName, Key: key }),
-            { expiresIn: 604800, signingDate },
+            { expiresIn: 604800 },
        );
    } else if (thumb.startsWith('data')) {
        // Move an inline thumbnail into storage. The row only takes the new
@@ -376,7 +373,7 @@ export const handleThumbnailRead = async (
        entry.thumbnail = await getSignedUrl(
            presignClient,
            new GetObjectCommand({ Bucket: deps.bucketName, Key: key }),
-            { expiresIn: 604800, signingDate },
+            { expiresIn: 604800 },
        );
    }
 };
@@ -53,29 +53,9 @@ need() {
    command -v "$1" >/dev/null 2>&1 || die "missing required command: $1"
 }

-check_docker() {
-    if command -v docker >/dev/null 2>&1; then
-        return 0
-    fi
-    echo >&2 ""
-    echo >&2 "[puter-install] missing required command: docker"
-    echo >&2 ""
-    echo >&2 "Docker is required to run Puter self-hosted."
-    echo >&2 ""
-    echo >&2 "Installation instructions:"
-    echo >&2 "  - macOS (Apple Silicon & Intel): https://docs.docker.com/desktop/setup/install/mac-install/"
-    echo >&2 "    (Docker Desktop is recommended. Alternatives: OrbStack, Colima)"
-    echo >&2 "  - Linux: https://docs.docker.com/engine/install/"
-    echo >&2 "  - Windows: https://docs.docker.com/desktop/setup/install/windows-install/"
-    echo >&2 ""
-    echo >&2 "After installing Docker, make sure it's running and try again."
-    echo >&2 ""
-    exit 1
-}
-
 # ── Step 1: dependency check ────────────────────────────────────────
 log "checking dependencies"
-check_docker
+need docker
 need curl
 need openssl
 docker compose version >/dev/null 2>&1 \
@@ -54,6 +54,7 @@
    "dev": "npm start",
    "build": "npm run setupExtensions && npm run build:ts && cd src/gui && node ./build.js && cd ../puter-js && npm run build",
    "build:workerLib": "cd src/puter-js && npm run build && cd ../worker && npm run build",
+    "check-translations": "node tools/check-translations.js",
    "prepare": "husky",
    "build:ts": "tsc -p tsconfig.build.json && node ./tools/write-dist-package-json.mjs",
    "check:puterjs:types": "node tools/checkPuterjsTypes.mjs",
@@ -78,8 +79,7 @@
    "javascript-time-ago": "^2.5.11",
    "libphonenumber-js": "1.13.15",
    "miniflare": "^4.20260617.1",
-    "open": "^10.1.0",
-    "sharp": "^0.35.5"
+    "open": "^10.1.0"
  },
  "engines": {
    "node": ">=24.0.0"
@@ -108,25 +108,6 @@ describe('AbstractDatabaseClient — unimplemented surface', () => {
 });

 describe('AbstractDatabaseClient — replica-aware reads', () => {
-    it('avoids a primary read when the replica has rows in sequential mode', async () => {
-        const client = new FixtureDatabaseClient([{ id: 1 }], [{ id: 2 }]);
-        expect(
-            await client.tryHardRead('SELECT 1', [], { race: false }),
-        ).toEqual([{ id: 1 }]);
-        expect(client.preads).toEqual([]);
-    });
-
-    it.each([[], new Error('replica unavailable')])(
-        'falls back once in sequential mode',
-        async (replica) => {
-            const client = new FixtureDatabaseClient(replica, [{ id: 2 }]);
-            expect(
-                await client.tryHardRead('SELECT 1', [], { race: false }),
-            ).toEqual([{ id: 2 }]);
-            expect(client.preads).toEqual(['SELECT 1']);
-        },
-    );
-
    it('returns replica rows without waiting on the primary', async () => {
        const client = new FixtureDatabaseClient([{ id: 1 }], [{ id: 2 }]);
        await expect(client.tryHardRead('SELECT 1')).resolves.toEqual([
@@ -275,16 +256,6 @@ describe('AbstractDatabaseClient — SQL generation', () => {
        expect(postgres().timestampFromUnixSql()).toBe('to_timestamp(?)');
    });

-    it('reads a timestamp column back as unix seconds in each engine', () => {
-        expect(sqlite().unixSecondsSql('`t`')).toBe(
-            "CAST(strftime('%s', `t`) AS INTEGER)",
-        );
-        expect(mysql().unixSecondsSql('`t`')).toBe('UNIX_TIMESTAMP(`t`)');
-        expect(postgres().unixSecondsSql('`t`')).toBe(
-            'EXTRACT(EPOCH FROM `t`)::bigint',
-        );
-    });
-
    it('describes a stored timestamp the way each driver reads it back', () => {
        const seconds = Date.UTC(2026, 9, 11, 8, 5, 9) / 1000;
        expect(sqlite().timestampValue(seconds)).toBe('2026-10-11 08:05:09');
@@ -138,27 +138,25 @@ export class AbstractDatabaseClient extends PuterClient {

    /**
     * Like `read()`, but an empty or failed replica read falls back to the
-     * primary, so replication lag can't hide a row that was just written. By
-     * default the primary read starts alongside the replica one; `race: false`
-     * reads the primary only after the replica returns empty or fails. Without
-     * a replica this is a single `read()`.
+     * primary, so replication lag can't hide a row that was just written. The
+     * primary read starts alongside the replica one rather than after it.
+     * Without a replica this is a single `read()`.
     */
    @Span('db.tryHardRead', (query: string) => ({ 'db.statement': query }))
    async tryHardRead(
        query: string,
        params: unknown[] = [],
-        { race = true }: { race?: boolean } = {},
    ): Promise<Record<string, unknown>[]> {
        if (!this.hasReadReplica()) return this.read(query, params);

-        const primary = race ? settle(this.pread(query, params)) : null;
+        const primary = settle(this.pread(query, params));
        try {
            const rows = await this.replicaRead(query, params);
            if (rows.length > 0) return rows;
        } catch {
            // replica failed — fall through to primary
        }
-        const result = await (primary ?? settle(this.pread(query, params)));
+        const result = await primary;
        if ('error' in result) throw result.error;
        return result.value;
    }
@@ -388,19 +386,6 @@ export class AbstractDatabaseClient extends PuterClient {
        });
    }

-    /**
-     * A timestamp column as unix seconds, computed by the database: the mysql
-     * driver reads a stored UTC timestamp as local time, so parsing it in JS
-     * can be off by the server's UTC offset.
-     */
-    unixSecondsSql(column: string): string {
-        return this.case({
-            postgres: `EXTRACT(EPOCH FROM ${column})::bigint`,
-            mysql: `UNIX_TIMESTAMP(${column})`,
-            otherwise: `CAST(strftime('%s', ${column}) AS INTEGER)`,
-        });
-    }
-
    /**
     * What a read of a timestamp column holding `seconds` returns: sqlite gives
     * back the UTC text it stored, mysql2 and pg a `Date` read in node's time
@@ -217,8 +217,7 @@ export class MySQLDatabaseClient extends AbstractDatabaseClient {
        return this.configuration === Configuration.REPLICA;
    }

-    // No failover: `tryHardRead` falls back to the primary on an empty result
-    // or error (raced alongside by default, after the replica with `race: false`).
+    // No failover: `tryHardRead` already has a primary read in flight.
    protected override async replicaRead(
        query: string,
        params: unknown[],
@@ -27,7 +27,7 @@ import { DatabaseClientFactory } from './index.js';
 import { SqliteDatabaseClient } from './SqliteDatabaseClient.js';

 /** Highest schema version the migration table can reach. */
-const CURRENT_SCHEMA_VERSION = 95;
+const CURRENT_SCHEMA_VERSION = 91;

 /**
 * These suites migrate real files on disk. Idle they finish in well under a
@@ -673,38 +673,6 @@ describe('SqliteDatabaseClient — boot and migrations', { timeout: DISK_MIGRATI
        });
    });

-    it('adds kv_share_handles.notify from 0099, off for every existing share', async () => {
-        const dir = mkdtempSync(join(tmpdir(), 'puter-sqlite-notify-'));
-        const path = join(dir, 'puter.sqlite');
-        try {
-            const before = new SqliteDatabaseClient(
-                sqliteConfig({ inMemory: false, path, targetVersion: 94 }),
-            );
-            await before.onServerStart();
-            await before.write(
-                'INSERT INTO `kv_share_handles` (`handle`, `owner_user_id`, ' +
-                    '`grantee_user_id`, `app_uid`, `key_prefix`, `permission`, ' +
-                    '`created_at`) VALUES (?, 1, 1, ?, ?, ?, 0)',
-                ['kvh-before-notify', 'os-global', 'a:', 'kv-share:x'],
-            );
-            before.onServerShutdown();
-
-            const after = new SqliteDatabaseClient(
-                sqliteConfig({ inMemory: false, path }),
-            );
-            await after.onServerStart();
-            await expect(
-                after.read(
-                    'SELECT `notify` FROM `kv_share_handles` WHERE `handle` = ?',
-                    ['kvh-before-notify'],
-                ),
-            ).resolves.toEqual([{ notify: 0 }]);
-            after.onServerShutdown();
-        } finally {
-            rmSync(dir, { recursive: true, force: true });
-        }
-    });
-
    it('indexes notification.created_at for the retention sweep', async () => {
        const rows = await client.read('PRAGMA index_list(`notification`)');
        expect(rows.map((r) => String(r.name))).toContain(
@@ -712,18 +680,6 @@ describe('SqliteDatabaseClient — boot and migrations', { timeout: DISK_MIGRATI
        );
    });

-    it('indexes notification.replaced_at per mailbox slice for catch-up', async () => {
-        const columns = await client.read(
-            'PRAGMA index_info(`idx_notification_replaced`)',
-        );
-        expect(columns.map((c) => String(c.name))).toEqual([
-            'user_id',
-            'audience',
-            'app_uid',
-            'replaced_at',
-        ]);
-    });
-
    it('leaves an already-migrated database untouched on a second boot', async () => {
        const dir = mkdtempSync(join(tmpdir(), 'puter-sqlite-'));
        const path = join(dir, 'nested', 'puter.sqlite');
@@ -130,10 +130,6 @@ const AVAILABLE_MIGRATIONS: [number, string[]][] = [
    [88, ['0093_fsentries-parent-uid-index.sql']],
    [89, ['0094_deleted-apps.sql']],
    [90, ['0095_kv-share-handle-levels.sql']],
-    [91, ['0096_kv-share-handle-quota-indexes.sql']],
-    [92, ['0097_user-to-user-holder-permission-index.sql']],
-    [93, ['0098_notification-groups.sql']],
-    [94, ['0099_kv-share-handle-notify.sql']],
 ];

 export class SqliteDatabaseClient extends AbstractDatabaseClient {
@@ -1,72 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- Share-handle quota, listing and purge indexes. See
-- sqlite/0096_kv-share-handle-quota-indexes.sql for what each serves. No
-- per-file applied-state tracking, so every index is guarded and a replay does
-- nothing.
-
-DROP PROCEDURE IF EXISTS _puter_add_kv_share_handle_quota_indexes;
-DELIMITER //
-CREATE PROCEDURE _puter_add_kv_share_handle_quota_indexes()
-BEGIN
-  IF NOT EXISTS (
-    SELECT 1 FROM INFORMATION_SCHEMA.STATISTICS
-    WHERE TABLE_SCHEMA = DATABASE()
-      AND TABLE_NAME = 'kv_share_handles'
-      AND INDEX_NAME = 'idx_kv_share_handles_owner_live'
-  ) THEN
-    ALTER TABLE `kv_share_handles` ADD INDEX `idx_kv_share_handles_owner_live` (`owner_user_id`, `revoked_at`, `app_uid`);
-  END IF;
-  IF NOT EXISTS (
-    SELECT 1 FROM INFORMATION_SCHEMA.STATISTICS
-    WHERE TABLE_SCHEMA = DATABASE()
-      AND TABLE_NAME = 'kv_share_handles'
-      AND INDEX_NAME = 'idx_kv_share_handles_owner_app'
-  ) THEN
-    ALTER TABLE `kv_share_handles` ADD INDEX `idx_kv_share_handles_owner_app` (`owner_user_id`, `app_uid`, `id`);
-  END IF;
-  IF NOT EXISTS (
-    SELECT 1 FROM INFORMATION_SCHEMA.STATISTICS
-    WHERE TABLE_SCHEMA = DATABASE()
-      AND TABLE_NAME = 'kv_share_handles'
-      AND INDEX_NAME = 'idx_kv_share_handles_grantee_app'
-  ) THEN
-    ALTER TABLE `kv_share_handles` ADD INDEX `idx_kv_share_handles_grantee_app` (`grantee_user_id`, `app_uid`, `id`);
-  END IF;
-  IF NOT EXISTS (
-    SELECT 1 FROM INFORMATION_SCHEMA.STATISTICS
-    WHERE TABLE_SCHEMA = DATABASE()
-      AND TABLE_NAME = 'kv_share_handles'
-      AND INDEX_NAME = 'idx_kv_share_handles_pair'
-  ) THEN
-    ALTER TABLE `kv_share_handles` ADD INDEX `idx_kv_share_handles_pair` (`owner_user_id`, `grantee_user_id`, `revoked_at`);
-  END IF;
-  IF NOT EXISTS (
-    SELECT 1 FROM INFORMATION_SCHEMA.STATISTICS
-    WHERE TABLE_SCHEMA = DATABASE()
-      AND TABLE_NAME = 'kv_share_handles'
-      AND INDEX_NAME = 'idx_kv_share_handles_revoked'
-  ) THEN
-    ALTER TABLE `kv_share_handles` ADD INDEX `idx_kv_share_handles_revoked` (`revoked_at`);
-  END IF;
-END//
-DELIMITER ;
-
-CALL _puter_add_kv_share_handle_quota_indexes();
-
-DROP PROCEDURE IF EXISTS _puter_add_kv_share_handle_quota_indexes;
@@ -1,38 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- Lets a holder's grant check read only the permissions it names. Guarded, so
-- a replay does nothing.
-
-DROP PROCEDURE IF EXISTS _puter_add_u2u_holder_permission_index;
-DELIMITER //
-CREATE PROCEDURE _puter_add_u2u_holder_permission_index()
-BEGIN
-  IF NOT EXISTS (
-    SELECT 1 FROM INFORMATION_SCHEMA.STATISTICS
-    WHERE TABLE_SCHEMA = DATABASE()
-      AND TABLE_NAME = 'user_to_user_permissions'
-      AND INDEX_NAME = 'idx_user_to_user_permissions_holder_permission'
-  ) THEN
-    ALTER TABLE `user_to_user_permissions` ADD INDEX `idx_user_to_user_permissions_holder_permission` (`holder_user_id`, `permission`);
-  END IF;
-END//
-DELIMITER ;
-
-CALL _puter_add_u2u_holder_permission_index();
-
-DROP PROCEDURE IF EXISTS _puter_add_u2u_holder_permission_index;
@@ -1,53 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- `notification`.`group_key` and `replaced_at`. See
-- sqlite/0098_notification-groups.sql for the rationale. The key is a hex
-- digest, so ascii and compared byte for byte. No per-file applied-state
-- tracking, so every step is guarded and a replay does nothing.
-
-CALL _puter_add_col('notification', 'group_key', '`group_key` char(64) CHARACTER SET ascii COLLATE ascii_bin DEFAULT NULL');
-CALL _puter_add_col('notification', 'replaced_at', '`replaced_at` bigint DEFAULT NULL');
-
-DROP PROCEDURE IF EXISTS _puter_add_notification_group_indexes;
-DELIMITER //
-CREATE PROCEDURE _puter_add_notification_group_indexes()
-BEGIN
-  IF NOT EXISTS (
-    SELECT 1 FROM INFORMATION_SCHEMA.STATISTICS
-    WHERE TABLE_SCHEMA = DATABASE()
-      AND TABLE_NAME = 'notification'
-      AND INDEX_NAME = 'idx_notification_group'
-  ) THEN
-    ALTER TABLE `notification` ADD INDEX `idx_notification_group`
-      (`user_id`, `app_uid`, `group_key`);
-  END IF;
-  IF NOT EXISTS (
-    SELECT 1 FROM INFORMATION_SCHEMA.STATISTICS
-    WHERE TABLE_SCHEMA = DATABASE()
-      AND TABLE_NAME = 'notification'
-      AND INDEX_NAME = 'idx_notification_replaced'
-  ) THEN
-    ALTER TABLE `notification` ADD INDEX `idx_notification_replaced`
-      (`user_id`, `audience`, `app_uid`, `replaced_at`);
-  END IF;
-END//
-DELIMITER ;
-
-CALL _puter_add_notification_group_indexes();
-
-DROP PROCEDURE IF EXISTS _puter_add_notification_group_indexes;
@@ -1,23 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- Notifications through a share handle. See
-- sqlite/0099_kv-share-handle-notify.sql for the column. No per-file
-- applied-state tracking, so it goes through _puter_add_col and a replay does
-- nothing.
-
-CALL _puter_add_col('kv_share_handles', 'notify', '`notify` tinyint(1) NOT NULL DEFAULT 0');
@@ -1,35 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- Share-handle quota, listing and purge indexes. See
-- sqlite/0096_kv-share-handle-quota-indexes.sql for what each serves.
-- Idempotent via IF NOT EXISTS; there is no per-file applied-state tracking.
-
-CREATE INDEX IF NOT EXISTS idx_kv_share_handles_owner_live
-    ON kv_share_handles (owner_user_id, revoked_at, app_uid);
-
-CREATE INDEX IF NOT EXISTS idx_kv_share_handles_owner_app
-    ON kv_share_handles (owner_user_id, app_uid, id);
-
-CREATE INDEX IF NOT EXISTS idx_kv_share_handles_grantee_app
-    ON kv_share_handles (grantee_user_id, app_uid, id);
-
-CREATE INDEX IF NOT EXISTS idx_kv_share_handles_pair
-    ON kv_share_handles (owner_user_id, grantee_user_id, revoked_at);
-
-CREATE INDEX IF NOT EXISTS idx_kv_share_handles_revoked
-    ON kv_share_handles (revoked_at);
@@ -1,21 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- Lets a holder's grant check read only the permissions it names.
-
-CREATE INDEX IF NOT EXISTS idx_user_to_user_permissions_holder_permission
-    ON user_to_user_permissions (holder_user_id, permission);
@@ -1,29 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- notification.group_key and replaced_at. See
-- sqlite/0098_notification-groups.sql for the rationale. Idempotent via IF NOT
-- EXISTS.
-
-ALTER TABLE notification ADD COLUMN IF NOT EXISTS group_key varchar(64) DEFAULT NULL;
-ALTER TABLE notification ADD COLUMN IF NOT EXISTS replaced_at bigint DEFAULT NULL;
-
-CREATE INDEX IF NOT EXISTS idx_notification_group
-    ON notification (user_id, app_uid, group_key);
-
-CREATE INDEX IF NOT EXISTS idx_notification_replaced
-    ON notification (user_id, audience, app_uid, replaced_at);
@@ -1,22 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- Notifications through a share handle. See
-- sqlite/0099_kv-share-handle-notify.sql for the column. Idempotent via
-- IF NOT EXISTS; there is no per-file applied-state tracking.
-
-ALTER TABLE kv_share_handles ADD COLUMN IF NOT EXISTS notify smallint NOT NULL DEFAULT 0;
@@ -1,42 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- Indexes behind the share-handle quotas, the app-filtered listings and the
-- retention purge on `kv_share_handles`.
--
--   - owner_live  : the owner's live count, in total and per app, read off
--                   the index alone.
--   - owner_app   : the owner's listing narrowed to one app, in id order.
--   - grantee_app : the holder's listing narrowed to one app, in id order.
--   - pair        : live handles one owner holds out to one holder, counted at
--                   mint and walked on revoke and unshare.
--   - revoked     : retired rows past retention, for the purge.
-
-CREATE INDEX IF NOT EXISTS `idx_kv_share_handles_owner_live`
-    ON `kv_share_handles` (`owner_user_id`, `revoked_at`, `app_uid`);
-
-CREATE INDEX IF NOT EXISTS `idx_kv_share_handles_owner_app`
-    ON `kv_share_handles` (`owner_user_id`, `app_uid`, `id`);
-
-CREATE INDEX IF NOT EXISTS `idx_kv_share_handles_grantee_app`
-    ON `kv_share_handles` (`grantee_user_id`, `app_uid`, `id`);
-
-CREATE INDEX IF NOT EXISTS `idx_kv_share_handles_pair`
-    ON `kv_share_handles` (`owner_user_id`, `grantee_user_id`, `revoked_at`);
-
-CREATE INDEX IF NOT EXISTS `idx_kv_share_handles_revoked`
-    ON `kv_share_handles` (`revoked_at`);
@@ -1,21 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- Lets a holder's grant check read only the permissions it names.
-
-CREATE INDEX IF NOT EXISTS `idx_user_to_user_permissions_holder_permission`
-    ON `user_to_user_permissions` (`holder_user_id`, `permission`);
@@ -1,38 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- What app message groups need from `notification`:
--
--   - `group_key`   : a sha256 hex digest of an app message's `group`, so the
--                     notification a newer one replaces is found by index.
--                     Null on every other row, and on rows written before
--                     this, which therefore never match.
--   - `replaced_at` : epoch milliseconds of the last replacement, null for a
--                     row never replaced. Live and fetched copies carry it as
--                     their version, so a client can tell a replacement from a
--                     copy it already has. Indexed per mailbox slice, so a
--                     catch-up reads the rows replaced since its cursor
--                     without scanning the ones that never were.
-
-ALTER TABLE `notification` ADD COLUMN `group_key` TEXT DEFAULT NULL;
-ALTER TABLE `notification` ADD COLUMN `replaced_at` INTEGER DEFAULT NULL;
-
-CREATE INDEX IF NOT EXISTS `idx_notification_group`
-    ON `notification` (`user_id`, `app_uid`, `group_key`);
-
-CREATE INDEX IF NOT EXISTS `idx_notification_replaced`
-    ON `notification` (`user_id`, `audience`, `app_uid`, `replaced_at`);
@@ -1,23 +0,0 @@
-- Copyright (C) 2024-present Puter Technologies Inc.
--
-- This file is part of Puter.
--
-- Puter is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- Whether the two parties of a share may send each other notifications through
-- its handle. Off by default, so every existing share reads as not allowing
-- them.
-
-ALTER TABLE `kv_share_handles`
-    ADD COLUMN `notify` INTEGER NOT NULL DEFAULT 0;
@@ -534,8 +534,6 @@ export class DDBClient extends PuterClient {
            scanIndexForward?: boolean;
            beginsWith?: { key: string; value: string };
            select?: 'COUNT';
-            /** Attributes to return instead of the whole item. */
-            projection?: string[];
            filter?: {
                expression: string;
                values?: Record<string, unknown>;
@@ -576,10 +574,6 @@ export class DDBClient extends PuterClient {
            Object.assign(expressionAttributeValues, options.filter.values);
            Object.assign(expressionAttributeNames, options.filter.names);
        }
-        const projection = (options?.projection ?? []).map((name) => {
-            expressionAttributeNames[`#p_${name}`] = name;
-            return `#p_${name}`;
-        });

        const command = new QueryCommand({
            TableName: table,
@@ -594,9 +588,6 @@ export class DDBClient extends PuterClient {
                ? { FilterExpression: options.filter.expression }
                : {}),
            ...(options?.select ? { Select: options.select } : {}),
-            ...(projection.length > 0
-                ? { ProjectionExpression: projection.join(', ') }
-                : {}),
            ...(options?.scanIndexForward !== undefined
                ? { ScanIndexForward: options.scanIndexForward }
                : {}),
@@ -75,15 +75,6 @@ export type EventMap = {
    serverStart: Record<string, never>;
    serverPrepareShutdown: Record<string, never>;
    serverShutdown: Record<string, never>;
-    /**
-     * Emitted by a host extension that knows this server will restart soon.
-     * Long-lived connections ask their clients to reconnect; nothing is refused
-     * or closed, so a false alarm is harmless.
-     */
-    serverRestartAnnounced: {
-        /** How long until the server stops, when known. */
-        closeInMs?: number;
-    };

    // ---- AI ----
    'ai.prompt.validate': {
@@ -146,17 +137,6 @@ export type EventMap = {
    };
    'app.new-icon': { app_uid: string; data_url: string };
    'app.opened': { app_uid: string; user_id: number; ts: number };
-    /**
-     * A user removed an app: its grants and worker sessions are gone. With
-     * `deleteData`, the user asked for the app's data in their account to go
-     * too. Awaited by the emitter.
-     */
-    'app.uninstalled': {
-        userId: number;
-        userUuid: string;
-        appUid: string;
-        deleteData: boolean;
-    };
    'app.rename': {
        app_uid: string;
        old_name: string;
@@ -217,7 +197,7 @@ export type EventMap = {
         */
        is_temp?: boolean;
        ip?: string | null;
-        source?: 'oidc' | 'team_provision';
+        source?: 'oidc';
        req?: unknown;
        data?: unknown;
        abuse?: unknown;
@@ -277,7 +257,7 @@ export type EventMap = {
        ip?: string | null;
        fingerprint?: string | null;
        reputation?: number | null;
-        source?: 'oidc' | 'team_provision';
+        source?: 'oidc';
        requires_phone_verification: boolean;
        requires_card_verification: boolean;
        accepted: boolean;
@@ -409,9 +389,6 @@ export type EventMap = {
        new_username: string;
    };
    'user.email-changed': { user_id: number; new_email: string };
-    /** An account was suspended, or its suspension lifted. Local events. */
-    'user.suspended': { userId: number };
-    'user.unsuspended': { userId: number };
    // Fired after an account is torn down (self-serve, admin, or temp-user
    // logout cleanup). Listeners purge external state tied to the account —
    // e.g. the marketplace extension cancels the user's Stripe subscriptions.
@@ -558,28 +535,9 @@ export type EventMap = {
        appUid: string | null;
        value: Record<string, unknown>;
        createdAt: number;
-        /** An earlier notification replaced in place; `createdAt` is when. */
-        replaced?: true;
        /** Events handler runs behind whatever created it. */
        handlerDepth?: number;
    };
-    /**
-     * Every non-silent write or update, only on the node that wrote it. The
-     * value is the listener's own copy of what the socket carries.
-     */
-    'notif.written': {
-        userId: number;
-        uid: string;
-        type: string;
-        audience: string;
-        /** The row's app; null when it names none or an update could not tell. */
-        appUid: string | null;
-        value: Record<string, unknown>;
-        /** An earlier notification rewritten in place. */
-        updated?: true;
-        /** Names this one send, for a receipt asked about it. */
-        sendId: string;
-    };
    /**
     * One notification, addressed at whatever sockets each region holds for the
     * recipient. `outer.*` reaches peer regions and never sibling nodes, so
@@ -588,31 +546,9 @@ export type EventMap = {
     */
    'outer.notif.delivery': {
        userId: number;
-        wire: 'notif.message' | 'notif.unreads' | 'notif.ack' | 'notif.removed';
+        wire: 'notif.message' | 'notif.unreads' | 'notif.ack';
        response: unknown;
    };
-    /**
-     * How one live notification went, on the node that asked for its receipt:
-     * from the desktop's sockets, or with `appUid` the app's own.
-     */
-    'notif.delivery.settled': {
-        sendId?: string;
-        uid: string;
-        userId: number;
-        type: string;
-        /** The app whose own sockets were asked; absent for the desktop's. */
-        appUid?: string;
-        outcome: NotifDeliveryOutcome;
-        /** A socket in this region acknowledges the receipt. */
-        ackCapable: boolean;
-        /** No socket here is an older client that acknowledges nothing. */
-        everySocketAcks: boolean;
-        /** Every node here answered the ask, not just this one. */
-        complete: boolean;
-        /** A peer region holds a socket for the user. */
-        peerRegions: boolean;
-        responders: NotifDeliveryResponder[];
-    };

    // ---- Metering ----
    // Recurring charges are pure mechanism here: the metering service knows
@@ -729,13 +665,6 @@ export type EventMap = {
     * reason as the events generation bump: a per-process cache.
     */
    'outer.pubsub.share.ownerShared': { ownerUserId: number };
-    /**
-     * Share handles were retired or changed, so every process must drop its
-     * cached copy. `outer.pubsub.*` because the cache is a per-process map.
-     */
-    'outer.pubsub.kv.share.forget': { handles: string[] };
-    /** The same, for every cached handle one owner holds out. */
-    'outer.pubsub.kv.share.forgetOwner': { ownerUserId: number };
    'outer.fs.write-hash': { hash: string; uuid: string };
    /**
     * Cache keys the KV read cache must stop serving, because the entries
@@ -754,7 +683,6 @@ export type EventMap = {
    'outer.gui.item.renamed': GuiEvent;
    'outer.gui.notif.ack': GuiEvent<{ uid: string }>;
    'outer.gui.notif.message': GuiEvent<{ uid: string; notification: unknown }>;
-    'outer.gui.notif.removed': GuiEvent<{ uid: string }>;
    'outer.gui.notif.unreads': GuiEvent<{
        unreads: { uid: string; notification: unknown }[];
    }>;
@@ -762,7 +690,7 @@ export type EventMap = {
    // ---- Subdomains ----
    // `uid` is the row uuid — for `delete` it is the only surviving handle a
    // listener can use to find state keyed to the row after it is gone.
-    'subdomain.delete': { subdomain: string; uid?: string; userId: number };
+    'subdomain.delete': { subdomain: string; uid?: string };
    'subdomain.update': { subdomain: string; uid?: string };
    'site.htmlServed': {
        subdomain: string;
@@ -1021,10 +949,11 @@ export type EventKey = keyof EventMap & string;
 // Generates a wildcard for every non-final dot-separated prefix of K.
 export type WildcardPrefixes<K extends string> =
    K extends `${infer Head}.${infer Tail}`
-        ? | `${Head}.*`
-          | (Tail extends `${string}.${string}`
-                ? `${Head}.${WildcardPrefixes<Tail>}`
-                : never)
+        ?
+              | `${Head}.*`
+              | (Tail extends `${string}.${string}`
+                    ? `${Head}.${WildcardPrefixes<Tail>}`
+                    : never)
        : never;

 export type ListenKey = EventKey | WildcardPrefixes<EventKey>;
@@ -1033,22 +962,6 @@ export type MatchingEvents<P extends ListenKey> = P extends `${infer Prefix}.*`
    ? Extract<EventKey, `${Prefix}.${string}`>
    : P & EventKey;

-/** Acked, not acked, no socket anywhere, or sockets only in a peer region. */
-export type NotifDeliveryOutcome =
-    'received' | 'unreceived' | 'no-socket' | 'remote-only';
-
-/** One socket's receipt for a live notification. */
-export interface NotifDeliveryResponder {
-    visibilityState: 'visible' | 'hidden' | 'unknown';
-    /** The page's window has focus. Absent from older clients. */
-    focused?: boolean;
-    /**
-     * The page shows its own browser notification while hidden or unfocused.
-     * Absent from older clients.
-     */
-    showsOwn?: boolean;
-}
-
 export type EventMetadata = {
    from_outside?: boolean;
    /** Set by `emitAndWait` when a listener threw, so a verdict hook can refuse. */
@@ -23,7 +23,7 @@
 */

 import type { fetch as undiciFetch } from 'undici';
-import { describe, expect, it, vi } from 'vitest';
+import { describe, expect, it } from 'vitest';
 import type { IConfig } from '../../types.js';
 import {
    DispatcherInvokeTransport,
@@ -33,8 +33,6 @@ import {
    EVENTS_ERROR_HEADER,
    EVENTS_HANDLED_HEADER,
    EventsWorkerInvokerClient,
-    INVOKE_CONNECTIONS,
-    outcomeForStatus,
    type WorkerInvokeRequest,
 } from './EventsWorkerInvokerClient.js';

@@ -56,22 +54,14 @@ const stubFetch = (
    (async () =>
        new Response(null, { status, headers })) as unknown as FetchImpl;

-/**
- * A stub fetch that never answers until the abort signal fires, then rejects
- * with the signal's reason the way undici does.
- */
+/** A stub fetch that never answers until the abort signal fires. */
 const hangingFetch: FetchImpl = ((_url: string, init?: RequestInit) =>
    new Promise((_resolve, reject) => {
        init?.signal?.addEventListener('abort', () =>
-            reject(init.signal!.reason),
+            reject(new Error('This operation was aborted')),
        );
    })) as unknown as FetchImpl;

-/** A stub fetch that fails before any answer, as a refused connection does. */
-const refusedFetch: FetchImpl = (async () => {
-    throw new TypeError('fetch failed');
-}) as unknown as FetchImpl;
-
 /** A stub fetch that records the URL it was called with. */
 const capturingFetch = (
    calls: string[],
@@ -151,39 +141,13 @@ describe('DispatcherInvokeTransport', () => {
        });
    });

-    it('answers null and says so when the request times out', async () => {
+    it('answers null with an error when the request times out', async () => {
        const transport = new DispatcherInvokeTransport('http://dispatcher', 's', {
            fetchImpl: hangingFetch,
        });
        const result = await transport.send({ ...CALL, timeoutMs: 10 });
        expect(result.status).toBeNull();
-        expect(result.timedOut).toBe(true);
-    });
-
-    it('answers null without a timeout when the request fails outright', async () => {
-        const transport = new DispatcherInvokeTransport('http://dispatcher', 's', {
-            fetchImpl: refusedFetch,
-        });
-        expect(await transport.send(CALL)).toEqual({
-            status: null,
-            error: 'fetch failed',
-        });
-    });
-
-    it('reads a retry-after in seconds, and ignores a date', async () => {
-        const answer = (value: string) =>
-            new DispatcherInvokeTransport('http://dispatcher', 's', {
-                fetchImpl: stubFetch(500, {
-                    [EVENTS_HANDLED_HEADER]: '1',
-                    [EVENTS_ERROR_HEADER]: 'platform-error',
-                    'retry-after': value,
-                }),
-            }).send(CALL);
-
-        expect((await answer('30')).retryAfterMs).toBe(30_000);
-        expect(
-            (await answer('Wed, 21 Oct 2015 07:28:00 GMT')).retryAfterMs,
-        ).toBeUndefined();
+        expect(result.error).toMatch(/abort/i);
    });

    it('surfaces the runtime`s own error header alongside its status', async () => {
@@ -212,97 +176,6 @@ describe('DispatcherInvokeTransport', () => {
    });
 });

-describe('DispatcherInvokeTransport with every connection busy', () => {
-    /** A fetch that answers 200 to one call at a time, when told to. */
-    const heldFetch = () => {
-        const held: Array<{ answer: () => void; signal: AbortSignal }> = [];
-        const fetchImpl = ((_url: string, init: RequestInit) =>
-            new Promise((resolve, reject) => {
-                const signal = init.signal!;
-                signal.addEventListener('abort', () => reject(signal.reason));
-                held.push({
-                    signal,
-                    answer: () =>
-                        resolve(
-                            new Response(null, {
-                                status: 200,
-                                headers: { [EVENTS_HANDLED_HEADER]: '1' },
-                            }),
-                        ),
-                });
-            })) as unknown as FetchImpl;
-        return { fetchImpl, held };
-    };
-
-    /** Every connection taken by a call nobody has answered yet. */
-    const saturated = async () => {
-        const { fetchImpl, held } = heldFetch();
-        const transport = new DispatcherInvokeTransport(
-            'http://dispatcher',
-            's',
-            { fetchImpl },
-        );
-        const busy = Array.from({ length: INVOKE_CONNECTIONS }, () =>
-            transport.send(CALL),
-        );
-        await vi.waitFor(() => expect(held).toHaveLength(INVOKE_CONNECTIONS));
-        const answerAll = async () => {
-            for (const call of held) call.answer();
-            await Promise.all(busy);
-        };
-        return { transport, held, answerAll };
-    };
-
-    it('waits for a free connection, then gives the run its whole timeout', async () => {
-        const { transport, held, answerAll } = await saturated();
-
-        const waiting = transport.send({ ...CALL, timeoutMs: 400 });
-        await new Promise((resolve) => setTimeout(resolve, 150));
-        expect(held).toHaveLength(INVOKE_CONNECTIONS);
-
-        held[0].answer();
-        await vi.waitFor(() =>
-            expect(held).toHaveLength(INVOKE_CONNECTIONS + 1),
-        );
-        // Past 400 ms from when the call was made, not from when it got its
-        // connection.
-        await new Promise((resolve) => setTimeout(resolve, 300));
-        expect(held[INVOKE_CONNECTIONS].signal.aborted).toBe(false);
-
-        await answerAll();
-        await expect(waiting).resolves.toMatchObject({ status: 200 });
-    });
-
-    it('fails a call that never got a connection as Puter`s, not the handler`s', async () => {
-        const { transport, held, answerAll } = await saturated();
-
-        await expect(
-            transport.send({ ...CALL, timeoutMs: 40 }),
-        ).resolves.toEqual({
-            status: null,
-            error: 'no free connection to the events dispatcher',
-        });
-
-        const client = new EventsWorkerInvokerClient({
-            events: { invokeTimeoutMs: 40 },
-        } as unknown as IConfig);
-        client.setTransport(transport);
-        await expect(client.invoke(REQUEST)).resolves.toMatchObject({
-            outcome: 'unavailable',
-        });
-        expect(held).toHaveLength(INVOKE_CONNECTIONS);
-
-        // The slots come back once the calls holding them are answered.
-        await answerAll();
-        const after = transport.send(CALL);
-        await vi.waitFor(() =>
-            expect(held).toHaveLength(INVOKE_CONNECTIONS + 1),
-        );
-        held[INVOKE_CONNECTIONS].answer();
-        await expect(after).resolves.toMatchObject({ status: 200 });
-    });
-});
-
 const REQUEST: WorkerInvokeRequest = {
    script: 'evw-test',
    appUid: 'app-test',
@@ -402,7 +275,7 @@ describe('EventsWorkerInvokerClient deploy-on-miss', () => {

        expect(calls).toHaveLength(1);
        expect(result).toEqual({
-            outcome: 'unavailable',
+            outcome: 'retriable',
            status: null,
            error: 'deploy: stale',
        });
@@ -427,7 +300,7 @@ describe('EventsWorkerInvokerClient deploy-on-miss', () => {
        expect(handlerCalls).toBe(1);
        // The first send plus the one retry — never a third.
        expect(calls).toHaveLength(2);
-        expect(result.outcome).toBe('unavailable');
+        expect(result.outcome).toBe('retriable');
        expect(result.status).toBeNull();
    });

@@ -444,7 +317,7 @@ describe('EventsWorkerInvokerClient deploy-on-miss', () => {

        expect(calls).toHaveLength(1);
        expect(result).toEqual({
-            outcome: 'unavailable',
+            outcome: 'retriable',
            status: null,
            error: 'dispatcher: missing (404)',
        });
@@ -469,7 +342,7 @@ describe('EventsWorkerInvokerClient deploy-on-miss', () => {

        expect(handlerCalled).toBe(false);
        expect(result).toEqual({
-            outcome: 'unavailable',
+            outcome: 'retriable',
            status: null,
            error: 'dispatcher: forbidden (403)',
        });
@@ -529,205 +402,9 @@ describe('EventsWorkerInvokerClient deploy-on-miss', () => {
        expect(calls).toHaveLength(2);
        expect(deployCalls).toHaveLength(0);
        expect(result).toEqual({
-            outcome: 'unavailable',
+            outcome: 'retriable',
            status: null,
            error: 'dispatcher: deploy-timeout (503)',
        });
    });
-
-    describe('a script still bound to a rotated key', () => {
-        /** Answers `bad-key` until it sees the deployed header, then settles. */
-        const badKeyUntilDeployedFetch = (
-            headersSeen: Array<Record<string, string>>,
-        ): FetchImpl =>
-            (async (_url: string, init?: RequestInit) => {
-                const headers = (init?.headers ?? {}) as Record<string, string>;
-                headersSeen.push(headers);
-                return headers[EVENTS_DEPLOYED_HEADER] === '1'
-                    ? new Response(null, {
-                          status: 200,
-                          headers: { [EVENTS_HANDLED_HEADER]: '1' },
-                      })
-                    : new Response(null, {
-                          status: 500,
-                          headers: {
-                              [EVENTS_HANDLED_HEADER]: '1',
-                              [EVENTS_ERROR_HEADER]: 'bad-key',
-                          },
-                      });
-            }) as unknown as FetchImpl;
-
-        const clientWith = (fetchImpl: FetchImpl) => {
-            const client = makeClient();
-            client.setTransport(
-                new DispatcherInvokeTransport('http://dispatcher', 's', {
-                    fetchImpl,
-                }),
-            );
-            return client;
-        };
-
-        it('is redeployed, then retried once with the deployed header', async () => {
-            const headersSeen: Array<Record<string, string>> = [];
-            const client = clientWith(badKeyUntilDeployedFetch(headersSeen));
-            const deploys: Array<[string, string]> = [];
-            client.setMissHandler(async (appUid, script) => {
-                deploys.push([appUid, script]);
-                return 'deployed';
-            });
-
-            const result = await client.invoke(REQUEST);
-
-            expect(deploys).toEqual([[REQUEST.appUid, REQUEST.script]]);
-            expect(headersSeen).toHaveLength(2);
-            expect(headersSeen[1][EVENTS_DEPLOYED_HEADER]).toBe('1');
-            expect(result).toEqual({ outcome: 'settled', status: 200 });
-        });
-
-        it('backs off, uncounted, when the redeploy is throttled', async () => {
-            const headersSeen: Array<Record<string, string>> = [];
-            const client = clientWith(badKeyUntilDeployedFetch(headersSeen));
-            client.setMissHandler(async () => 'throttled');
-
-            const result = await client.invoke(REQUEST);
-
-            expect(headersSeen).toHaveLength(1);
-            expect(result).toEqual({
-                outcome: 'unavailable',
-                status: null,
-                error: 'deploy: throttled',
-            });
-        });
-
-        it('stops after the one retry when the old key is still being served', async () => {
-            const calls: unknown[] = [];
-            const client = clientWith((async () => {
-                calls.push(null);
-                return new Response(null, {
-                    status: 500,
-                    headers: {
-                        [EVENTS_HANDLED_HEADER]: '1',
-                        [EVENTS_ERROR_HEADER]: 'bad-key',
-                    },
-                });
-            }) as unknown as FetchImpl);
-            let deploys = 0;
-            client.setMissHandler(async () => {
-                deploys++;
-                return 'deployed';
-            });
-
-            const result = await client.invoke(REQUEST);
-
-            expect(deploys).toBe(1);
-            expect(calls).toHaveLength(2);
-            expect(result.outcome).toBe('unavailable');
-        });
-
-        it('deploys nothing for a handler`s own failure', async () => {
-            const client = clientWith(
-                stubFetch(500, {
-                    [EVENTS_HANDLED_HEADER]: '1',
-                    [EVENTS_ERROR_HEADER]: 'handler-threw',
-                }),
-            );
-            let deploys = 0;
-            client.setMissHandler(async () => {
-                deploys++;
-                return 'deployed';
-            });
-
-            expect((await client.invoke(REQUEST)).outcome).toBe('retriable');
-            expect(deploys).toBe(0);
-        });
-    });
-
-    it('reports a deploy that was throttled as Puter`s failure', async () => {
-        const client = makeClient();
-        client.setTransport(
-            new DispatcherInvokeTransport('http://dispatcher', 's', {
-                fetchImpl: alwaysMissingFetch([]),
-            }),
-        );
-        client.setMissHandler(async () => 'throttled');
-
-        expect((await client.invoke(REQUEST)).outcome).toBe('unavailable');
-    });
-});
-
-describe('whose failure an invocation was', () => {
-    const invokeWith = (fetchImpl: FetchImpl, timeoutMs?: number) => {
-        const client = new EventsWorkerInvokerClient({
-            events: timeoutMs ? { invokeTimeoutMs: timeoutMs } : {},
-        } as unknown as IConfig);
-        client.setTransport(
-            new DispatcherInvokeTransport('http://dispatcher', 's', {
-                fetchImpl,
-            }),
-        );
-        return client.invoke(REQUEST);
-    };
-
-    it('counts a run past the timeout against the handler', async () => {
-        expect((await invokeWith(hangingFetch, 10)).outcome).toBe('retriable');
-    });
-
-    it('puts a request that never got an answer on Puter', async () => {
-        expect((await invokeWith(refusedFetch)).outcome).toBe('unavailable');
-    });
-
-    it('puts an unmarked 5xx, 429 or 4xx on Puter', async () => {
-        for (const status of [500, 502, 429, 404]) {
-            const result = await invokeWith(stubFetch(status));
-            expect(result).toEqual({
-                outcome: 'unavailable',
-                status,
-                error: `unmarked ${status}`,
-            });
-        }
-    });
-
-    it('puts a handler failed by a Puter API call on Puter, with its wait', async () => {
-        const result = await invokeWith(
-            stubFetch(500, {
-                [EVENTS_HANDLED_HEADER]: '1',
-                [EVENTS_ERROR_HEADER]: 'platform-error',
-                'retry-after': '20',
-            }),
-        );
-        expect(result).toEqual({
-            outcome: 'unavailable',
-            status: 500,
-            error: 'platform-error',
-            retryAfterMs: 20_000,
-        });
-    });
-
-    it('answers unavailable with no dispatcher configured', async () => {
-        const result = await makeClient().invoke(REQUEST);
-        expect(result.outcome).toBe('unavailable');
-    });
-});
-
-describe('outcomeForStatus', () => {
-    it.each([
-        [200, true, undefined, 'settled'],
-        [204, false, undefined, 'settled'],
-        [400, true, 'handler-terminal', 'terminal'],
-        [404, true, 'unknown-handler', 'terminal'],
-        [500, true, 'handler-threw', 'retriable'],
-        [500, true, 'handler-broken', 'retriable'],
-        [429, true, undefined, 'retriable'],
-        [500, true, 'bad-key', 'unavailable'],
-        [500, true, 'no-token', 'unavailable'],
-        [500, true, 'platform-error', 'unavailable'],
-        [500, false, undefined, 'unavailable'],
-        [429, false, undefined, 'unavailable'],
-        [403, false, undefined, 'unavailable'],
-    ] as const)(
-        'reads %i (handled: %s, %s) as %s',
-        (status, handled, errorCode, expected) => {
-            expect(outcomeForStatus(status, handled, errorCode)).toBe(expected);
-        },
-    );
 });
@@ -68,23 +68,6 @@ export const EVENTS_HANDLED_HEADER = 'x-puter-events-handled';
 /** Machine-readable reason on the runtime's own failure answers. */
 export const EVENTS_ERROR_HEADER = 'x-puter-events-error';

-/**
- * The runtime's answer to a key it does not hold: the script was deployed under
- * a secret that has since rotated, and redeploying it binds the current key.
- */
-const BAD_KEY_ERROR = 'bad-key';
-
-/**
- * Runtime failure answers that are Puter's fault rather than the handler's: a
- * key the script no longer matches, no token to run as, or a handler that
- * failed because a Puter API call it made did.
- */
-const PLATFORM_ERROR_CODES = new Set([
-    BAD_KEY_ERROR,
-    'no-token',
-    'platform-error',
-]);
-
 /**
 * Set on the retry after this backend deploys a missing script itself, so the
 * dispatcher skips its own deploy-on-miss callback and negative cache and goes
@@ -123,19 +106,12 @@ export const EVENTS_INVOKE_TIMEOUT_MS = 30_000;

 /**
 * Connections held open to the dispatcher, so a busy fleet is not
- * re-handshaking. Also how many calls one transport makes at once: a call past
- * that waits for a free one before its invoke timeout starts.
+ * re-handshaking. The 30s invoke abort starts when a request is queued, not
+ * when it gets a connection, so a saturated pool shows up as timeouts.
 */
-export const INVOKE_CONNECTIONS = 256;
+const INVOKE_CONNECTIONS = 256;
 const INVOKE_KEEP_ALIVE_MS = 30_000;

-/**
- * A call waits at most this share of its invoke timeout for a connection, so
- * the wait and the run together stay inside the worker lease (twice the
- * timeout). Past it the call fails as Puter's, not the handler's.
- */
-const CONNECTION_WAIT_SHARE = 0.5;
-
 /** One invocation, as the events service hands it over. */
 export interface WorkerInvokeRequest {
    /** Script the app's current handler set deploys as. */
@@ -163,38 +139,27 @@ export interface EventsInvokeCall {
    deployed?: boolean;
 }

-/** What one attempt at delivering an invocation came back with. */
-export interface EventsInvokeAnswer {
-    /** `null` when no answer came back. */
-    status: number | null;
-    /** Set only when the answer provably came from the script. */
-    handled?: boolean;
-    error?: string;
-    /** Set only by the dispatcher transport, naming its own failure. */
-    dispatchReason?: string;
-    /** No answer within the invoke timeout. */
-    timedOut?: boolean;
-    /** From a `retry-after` header in seconds. */
-    retryAfterMs?: number;
-}
-
 /**
- * Delivers an invocation. `handled` is set only when the answer provably came
- * from the script, so an unmarked 4xx is not a handler's refusal.
+ * Delivers an invocation. `status` null means nothing ran (retriable);
+ * `handled` is set only when the answer provably came from the script, so an
+ * unmarked 4xx is not a handler's refusal.
 */
 export interface EventsInvokeTransport {
-    send(call: EventsInvokeCall): Promise<EventsInvokeAnswer>;
+    send(call: EventsInvokeCall): Promise<{
+        status: number | null;
+        handled?: boolean;
+        error?: string;
+        /** Set only by the dispatcher transport, naming its own failure. */
+        dispatchReason?: string;
+    }>;
 }

 /**
 * `settled`: handler accepted (2xx). `terminal`: handler refused (marked 4xx),
- * not retried. `retriable`: the handler failed or ran past the timeout.
- * `unavailable`: Puter could not start or finish the run (transport, dispatch
- * and deploy failures, unmarked answers, a Puter API failure inside the
- * handler); retried like `retriable` but never the handler's fault.
+ * not retried. `retriable`: no handler answer (5xx, 429, timeout, transport
+ * failure, unmarked 4xx).
 */
-export type WorkerInvokeOutcome =
-    'settled' | 'terminal' | 'retriable' | 'unavailable';
+export type WorkerInvokeOutcome = 'settled' | 'terminal' | 'retriable';

 export interface WorkerInvokeResult {
    outcome: WorkerInvokeOutcome;
@@ -202,8 +167,6 @@ export interface WorkerInvokeResult {
    status: number | null;
    /** Why it could not answer, when nothing did. */
    error?: string;
-    /** How long the answer asked to be left alone. */
-    retryAfterMs?: number;
 }

 const NO_TRANSPORT =
@@ -224,8 +187,8 @@ export class EventsWorkerInvokerClient extends PuterClient {
    /**
     * Deploys a script the dispatcher reports missing, in place of the
     * rehydrate callback — for the case where that callback lands on a backend
-     * other than this one — or one still bound to a rotated key. Set once;
-     * `invoke()` calls it at most once per delivery and never loops.
+     * other than this one. Set once; `invoke()` calls it at most once per
+     * delivery and never loops.
     */
    setMissHandler(handler: WorkerMissHandler): void {
        this.#missHandler = handler;
@@ -239,11 +202,7 @@ export class EventsWorkerInvokerClient extends PuterClient {
    async invoke(request: WorkerInvokeRequest): Promise<WorkerInvokeResult> {
        const transport = this.#pickTransport();
        if (!transport)
-            return {
-                outcome: 'unavailable',
-                status: null,
-                error: NO_TRANSPORT,
-            };
+            return { outcome: 'retriable', status: null, error: NO_TRANSPORT };

        const call: EventsInvokeCall = {
            script: request.script,
@@ -259,50 +218,48 @@ export class EventsWorkerInvokerClient extends PuterClient {
        };

        let result = await transport.send(call);
-        if (this.#missHandler && selfDeployable(result)) {
-            const outcome = await this.#missHandler(
-                request.appUid,
-                request.script,
-            );
-            if (outcome !== 'deployed')
-                return {
-                    outcome: 'unavailable',
-                    status: null,
-                    error: `deploy: ${outcome}`,
-                };
-            result = await transport.send({ ...call, deployed: true });
-        } else if (
-            result.status === null &&
-            result.dispatchReason &&
-            ALREADY_DEPLOYED_MISS_REASONS.has(result.dispatchReason)
-        ) {
-            // No deploy to trigger — just give propagation the one retry
-            // it usually needs, without spending an upload on it.
-            result = await transport.send({ ...call, deployed: true });
+        if (result.status === null && result.dispatchReason) {
+            if (
+                this.#missHandler &&
+                SELF_DEPLOYABLE_MISS_REASONS.has(result.dispatchReason)
+            ) {
+                const outcome = await this.#missHandler(
+                    request.appUid,
+                    request.script,
+                );
+                if (outcome !== 'deployed')
+                    return {
+                        outcome: 'retriable',
+                        status: null,
+                        error: `deploy: ${outcome}`,
+                    };
+                result = await transport.send({ ...call, deployed: true });
+            } else if (
+                ALREADY_DEPLOYED_MISS_REASONS.has(result.dispatchReason)
+            ) {
+                // No deploy to trigger — just give propagation the one retry
+                // it usually needs, without spending an upload on it.
+                result = await transport.send({ ...call, deployed: true });
+            }
        }

-        const { status, handled, error, timedOut, retryAfterMs } = result;
-        // Past the timeout the handler was most likely still running, which
-        // is its own doing; any other missing answer never reached it.
+        const { status, handled, error } = result;
        if (status === null)
-            return {
-                outcome: timedOut ? 'retriable' : 'unavailable',
-                status: null,
-                error,
-            };
+            return { outcome: 'retriable', status: null, error };

-        const outcome = outcomeForStatus(status, handled === true, error);
-        // An unmarked failure is not the handler's own answer; say so even
-        // when the transport did not, so the reason a delivery kept retrying
-        // shows up in the log rather than reading as an unexplained retry.
-        const unmarked = status >= 300 && !handled;
+        const outcome = outcomeForStatus(status, handled === true);
+        // An unmarked 4xx (429 aside — that one is always retriable) is not
+        // the handler's own answer; say so even when the transport did not,
+        // so the reason a delivery kept retrying shows up in the log rather
+        // than reading as an unexplained retry.
+        const unmarkedFourxx =
+            status !== 429 && status >= 400 && status < 500 && !handled;
        const reportedError =
-            error ?? (unmarked ? `unmarked ${status}` : undefined);
+            error ?? (unmarkedFourxx ? 'unmarked 4xx' : undefined);
        return {
            outcome,
            status,
            ...(reportedError ? { error: reportedError } : {}),
-            ...(retryAfterMs ? { retryAfterMs } : {}),
        };
    }

@@ -334,10 +291,6 @@ export class DispatcherInvokeTransport implements EventsInvokeTransport {
    readonly #secret: string;
    readonly #fetchImpl: typeof undiciFetch;
    #agent: Agent | null = null;
-    /** Calls holding a connection slot. */
-    #active = 0;
-    /** Calls waiting for one, longest-waiting first. */
-    readonly #waiting = new Set<() => void>();

    constructor(
        dispatcherUrl: string,
@@ -354,14 +307,12 @@ export class DispatcherInvokeTransport implements EventsInvokeTransport {
        this.#agent = null;
    }

-    async send(call: EventsInvokeCall): Promise<EventsInvokeAnswer> {
-        // No `timedOut`: the handler never got this call, so the wait is not
-        // its failure.
-        if (!(await this.#acquire(call.timeoutMs * CONNECTION_WAIT_SHARE)))
-            return {
-                status: null,
-                error: 'no free connection to the events dispatcher',
-            };
+    async send(call: EventsInvokeCall): Promise<{
+        status: number | null;
+        handled?: boolean;
+        error?: string;
+        dispatchReason?: string;
+    }> {
        try {
            // `new URL(path, base)` resolves an absolute path against the
            // base's origin, dropping any path prefix `base` already carries.
@@ -396,43 +347,19 @@ export class DispatcherInvokeTransport implements EventsInvokeTransport {
                    dispatchReason: dispatchError,
                };

-            return answerFrom(response);
+            const handled = response.headers.get(EVENTS_HANDLED_HEADER) === '1';
+            const errorHeader = response.headers.get(EVENTS_ERROR_HEADER);
+            return {
+                status: response.status,
+                handled,
+                ...(errorHeader ? { error: errorHeader } : {}),
+            };
        } catch (err) {
-            return failedAnswer(err);
-        } finally {
-            this.#release();
-        }
-    }
-
-    /** A connection slot, or false once `waitMs` passes without one. */
-    #acquire(waitMs: number): Promise<boolean> {
-        if (this.#active < INVOKE_CONNECTIONS) {
-            this.#active++;
-            return Promise.resolve(true);
-        }
-        return new Promise((resolve) => {
-            const granted = () => {
-                clearTimeout(timer);
-                resolve(true);
+            return {
+                status: null,
+                error: err instanceof Error ? err.message : String(err),
            };
-            const timer = setTimeout(() => {
-                this.#waiting.delete(granted);
-                resolve(false);
-            }, waitMs);
-            timer.unref?.();
-            this.#waiting.add(granted);
-        });
-    }
-
-    /** Hand the slot to the longest waiter, or give it back. */
-    #release(): void {
-        const next = this.#waiting.values().next().value;
-        if (next) {
-            this.#waiting.delete(next);
-            next();
-            return;
        }
-        this.#active--;
    }

    /** One pool per process, built on first use and closed with the server. */
@@ -446,61 +373,18 @@ export class DispatcherInvokeTransport implements EventsInvokeTransport {
    }
 }

-/** Whether deploying the script is what fixes this answer. */
-const selfDeployable = (result: EventsInvokeAnswer): boolean =>
-    result.status === null
-        ? result.dispatchReason !== undefined &&
-          SELF_DEPLOYABLE_MISS_REASONS.has(result.dispatchReason)
-        : result.handled === true && result.error === BAD_KEY_ERROR;
-
-/** What a script's answer says, read the same way by every transport. */
-export const answerFrom = (response: {
-    status: number;
-    headers: { get(name: string): string | null };
-}): EventsInvokeAnswer => {
-    const errorHeader = response.headers.get(EVENTS_ERROR_HEADER);
-    const retryAfterMs = parseRetryAfterMs(response.headers.get('retry-after'));
-    return {
-        status: response.status,
-        handled: response.headers.get(EVENTS_HANDLED_HEADER) === '1',
-        ...(errorHeader ? { error: errorHeader } : {}),
-        ...(retryAfterMs ? { retryAfterMs } : {}),
-    };
-};
-
-/** An attempt that threw before any answer came back. */
-export const failedAnswer = (err: unknown): EventsInvokeAnswer => ({
-    status: null,
-    error: err instanceof Error ? err.message : String(err),
-    // What `AbortSignal.timeout` rejects with.
-    ...((err as { name?: unknown } | null)?.name === 'TimeoutError'
-        ? { timedOut: true }
-        : {}),
-});
-
-/** Whole seconds only; an HTTP-date form reads as absent. */
-const parseRetryAfterMs = (value: string | null): number => {
-    const seconds = Number(value);
-    return value && Number.isFinite(seconds) && seconds > 0
-        ? seconds * 1000
-        : 0;
-};
-
 /**
- * 2xx took it regardless. Anything else not marked as the script's own answer
- * came from something between here and the handler. A marked answer is a
- * refusal when it is a 4xx other than 429, Puter's failure when the runtime
- * names one, and the handler's failure otherwise.
+ * 2xx took it regardless. 429 is always "not now". Any other 4xx is a refusal
+ * only when `handled` says the answer is provably the script's own — an
+ * unmarked 4xx came from something between here and the handler.
 */
 export const outcomeForStatus = (
    status: number,
    handled: boolean,
-    errorCode?: string,
 ): WorkerInvokeOutcome => {
    if (status >= 200 && status < 300) return 'settled';
-    if (!handled) return 'unavailable';
-    if (errorCode && PLATFORM_ERROR_CODES.has(errorCode)) return 'unavailable';
    if (status === 429) return 'retriable';
-    if (status >= 400 && status < 500) return 'terminal';
+    if (status >= 400 && status < 500)
+        return handled ? 'terminal' : 'retriable';
    return 'retriable';
 };
@@ -1,85 +0,0 @@
-/*
- * Copyright (C) 2024-present Puter Technologies Inc.
- *
- * This file is part of Puter.
- *
- * Puter is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published
- * by the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-import { afterAll, beforeAll, describe, expect, it } from 'vitest';
-import { setupPuterTestEnv, type PuterTestEnv } from '../../testUtil.js';
-
-describe('auth elevation cookies over HTTP', () => {
-    let env: PuterTestEnv;
-
-    beforeAll(async () => {
-        env = await setupPuterTestEnv();
-    }, 120_000);
-
-    afterAll(async () => {
-        await env?.shutdown();
-    });
-
-    it.each(['bearer', 'cookie'])(
-        'API host returns a usable token without setting cookies (%s auth)',
-        async (credential) => {
-            const { token, password, username } = env.users.user;
-            const res = await fetch(new URL('/auth/elevate', env.apiOrigin), {
-                method: 'POST',
-                headers: {
-                    'content-type': 'application/json',
-                    ...(credential === 'cookie'
-                        ? { cookie: `puter_auth_token=${token}` }
-                        : { authorization: `Bearer ${token}` }),
-                },
-                body: JSON.stringify({ password }),
-            });
-            expect(res.status).toBe(200);
-            expect(res.headers.get('set-cookie')).toBeNull();
-            const body = (await res.json()) as {
-                elevated: boolean;
-                token: string;
-            };
-            expect(body.elevated).toBe(true);
-            expect(typeof body.token).toBe('string');
-            const user = await env.server.stores.user.getByUsername(username);
-            const { verifyStepUpSession } =
-                await import('../../core/http/middleware/stepUpSession.js');
-            expect(
-                verifyStepUpSession(
-                    {
-                        headers: { 'x-puter-elevation': body.token },
-                        actor: { user: { uuid: user!.uuid } },
-                    } as never,
-                    { tokenService: env.server.services.token },
-                ),
-            ).toBe(true);
-        },
-    );
-
-    it('GUI host sets the elevation cookie and omits the raw token for cookie auth', async () => {
-        const { token, password } = env.users.user;
-        const res = await fetch(new URL('/auth/elevate', env.origin), {
-            method: 'POST',
-            headers: {
-                'content-type': 'application/json',
-                cookie: `puter_auth_token=${token}`,
-            },
-            body: JSON.stringify({ password }),
-        });
-        expect(res.status).toBe(200);
-        expect(res.headers.get('set-cookie')).toContain('puter_elevated=');
-        expect(await res.json()).toEqual({ elevated: true });
-    });
-});
@@ -42,10 +42,6 @@ import {
    adminOnlyGate,
    requireUserActorGate,
 } from '../../core/http/middleware/gates.js';
-import {
-    configureRateLimit,
-    listConfiguredRateLimitBackends,
-} from '../../core/http/middleware/rateLimit.js';
 import {
    ROUTES_METADATA_KEY,
    type CollectedRoute,
@@ -54,10 +50,7 @@ import {
 import { PuterServer } from '../../server.js';
 import { createSecret as otpCreateSecret } from '../../services/auth/OTPUtil.js';
 import { kvSharePermission } from '../../services/kvShare/kvShares.js';
-import {
-    FULL_API_ACCESS,
-    NOTIFICATIONS_PUSH_PERMISSION,
-} from '../../services/permission/consts.js';
+import { FULL_API_ACCESS } from '../../services/permission/consts.js';
 import { setupTestServer } from '../../testUtil.js';
 import { resetCardVerificationStatusCache } from '../../util/cardFallback.js';
 import { FS_READ_LIMIT } from '../fs/limits.js';
@@ -1757,40 +1750,6 @@ describe('AuthController.handleLoginOtp + handleLoginRecoveryCode', () => {
        ).rejects.toMatchObject({ statusCode: 400 });
    });

-    it('refuses the sign-in while the used-token store is down', async () => {
-        const { user, secret, otpToken } = await startOtpLogin();
-        const token = await otpToken();
-
-        const { default: backend } = listConfiguredRateLimitBackends();
-        configureRateLimit({
-            default: 'redis',
-            redis: {
-                multi: () => {
-                    throw new Error('store down');
-                },
-            },
-        });
-        const logged = vi.spyOn(console, 'error').mockImplementation(() => {});
-        const res = makeRes();
-        try {
-            await expect(
-                controller.handleLoginOtp(
-                    makeReq({ token, code: liveTotp(user.username, secret) }),
-                    res,
-                ),
-            ).rejects.toThrow('store down');
-        } finally {
-            logged.mockRestore();
-            configureRateLimit({
-                default: backend,
-                redis: server.clients.redis,
-                kv: server.stores.kv,
-                metering: server.services.metering,
-            });
-        }
-        expect(res.body).toBeUndefined();
-    });
-
    it('a wrong code leaves the token usable for a retry', async () => {
        const { user, secret, otpToken } = await startOtpLogin();
        const token = await otpToken();
@@ -2220,78 +2179,6 @@ describe('AuthController grant flows', () => {
        ).toContain(permission);
    });

-    it('grant-user-app: grants and revokes notifications:push for an app', async () => {
-        const app = await server.stores.app.create(
-            {
-                name: `tgp-${uuidv4()}`,
-                title: 'TestGrantPushApp',
-                index_url: 'https://example.test/index.html',
-            },
-            { ownerUserId: issuer.id },
-        );
-        const user = await server.stores.user.getById(issuer.id);
-        const appActor = makeActor({
-            user: user!,
-            app: { uid: app.uid, id: app.id },
-        });
-        const hasPush = () =>
-            server.services.permission.check(
-                appActor,
-                NOTIFICATIONS_PUSH_PERMISSION,
-            );
-        expect(await hasPush()).toBe(false);
-
-        // Anything past the bare permission names nothing a prompt describes.
-        await expect(
-            inCtx(issuerActor, () =>
-                controller.handleGrantUserApp(
-                    makeReq(
-                        {
-                            app_uid: app.uid,
-                            permission: `${NOTIFICATIONS_PUSH_PERMISSION}:extra`,
-                        },
-                        { actor: issuerActor },
-                    ),
-                    makeRes(),
-                ),
-            ),
-        ).rejects.toMatchObject({
-            statusCode: 400,
-            legacyCode: 'permission_not_grantable',
-        });
-        expect(await hasPush()).toBe(false);
-
-        const res = makeRes();
-        await inCtx(issuerActor, () =>
-            controller.handleGrantUserApp(
-                makeReq(
-                    {
-                        app_uid: app.uid,
-                        permission: NOTIFICATIONS_PUSH_PERMISSION,
-                    },
-                    { actor: issuerActor },
-                ),
-                res,
-            ),
-        );
-        expect(res.body).toEqual({});
-        expect(await hasPush()).toBe(true);
-
-        await inCtx(issuerActor, () =>
-            controller.handleRevokeUserApp(
-                makeReq(
-                    {
-                        app_uid: app.uid,
-                        permission: NOTIFICATIONS_PUSH_PERMISSION,
-                    },
-                    { actor: issuerActor },
-                ),
-                makeRes(),
-            ),
-        );
-        expect(await hasPush()).toBe(false);
-    });
-
    it('grant-user-app: resolves `origin` to the app when app_uid is omitted', async () => {
        // The GUI permission dialog and puter.perms.grantOrigin() identify
        // third-party sites by origin rather than app uid.
@@ -7725,46 +7612,6 @@ describe('AuthController permission revokes', () => {
        );
        expect(res.body).toEqual({});
    });
-
-    it('revoke-user-user: refuses a key-value share grant and leaves it standing', async () => {
-        const { actor: ownerActor, user: owner } = await makeUserAndActor();
-        const { user: holder } = await makeUserAndActor();
-        const permissions = ['kv-share', 'kv-share-read', 'kv-share-write'].map(
-            (root) => `${root}:${owner.uuid}:os-global:notes:${uuidv4()}`,
-        );
-        for (const permission of permissions)
-            await server.stores.permission.upsertUserUserPerm(
-                holder.id,
-                owner.id,
-                permission,
-                {},
-            );
-
-        for (const permission of permissions)
-            await expect(
-                inCtx(ownerActor, () =>
-                    controller.handleRevokeUserUser(
-                        makeReq(
-                            { target_username: holder.username, permission },
-                            { actor: ownerActor },
-                        ),
-                        makeRes(),
-                    ),
-                ),
-            ).rejects.toMatchObject({
-                statusCode: 400,
-                message: expect.stringContaining('puter.kv.unshare()'),
-            });
-        expect(
-            (
-                await server.stores.permission.findUserUserPermsByIssuer(
-                    holder.id,
-                    owner.id,
-                    permissions,
-                )
-            ).sort(),
-        ).toEqual([...permissions].sort());
-    });
 });

 // ── Permission checks + listing ────────────────────────────────────
@@ -7869,12 +7716,6 @@ describe('AuthController.handleCheckPermissions + handleListPermissions', () =>
                grant,
            ),
        );
-        // What launching the app records for the holder.
-        await server.services.permission.grantUserAppPermission(
-            holderActor,
-            app.uid,
-            'flag:app-is-authenticated',
-        );
        const appActor = makeActor({
            user: holderActor.user,
            app: { id: app.id, uid: app.uid },
@@ -9817,70 +9658,6 @@ describe('AuthController grant/revoke additional branches', () => {
        ).rejects.toMatchObject({ statusCode: 400 });
    });

-    it('revoke-user-app: 400 on `deleteData` without "*" or as a non-boolean', async () => {
-        const { actor } = await makeUserAndActor();
-        const app = await server.stores.app.create(
-            {
-                name: `tr-delete-data-${uuidv4()}`,
-                title: 'TestDeleteDataApp',
-                index_url: `https://tr-delete-data-${uuidv4()}.example.test/`,
-            },
-            { ownerUserId: actor.user.id },
-        );
-        for (const body of [
-            { permission: 'events:background', deleteData: true },
-            { permission: '*', deleteData: 'yes' },
-        ]) {
-            await expect(
-                controller.handleRevokeUserApp(
-                    makeReq({ app_uid: app.uid, ...body }, { actor }),
-                    makeRes(),
-                ),
-            ).rejects.toMatchObject({ statusCode: 400 });
-        }
-    });
-
-    it('revoke-user-app `*`: announces the uninstall, with `deleteData` as sent', async () => {
-        const { actor } = await makeUserAndActor();
-        const app = await server.stores.app.create(
-            {
-                name: `tr-uninstall-${uuidv4()}`,
-                title: 'TestUninstallApp',
-                index_url: `https://tr-uninstall-${uuidv4()}.example.test/`,
-            },
-            { ownerUserId: actor.user.id },
-        );
-        const seen: unknown[] = [];
-        const listener = (_key: string, data: unknown) => {
-            seen.push(data);
-        };
-        server.clients.event.on('app.uninstalled', listener);
-        try {
-            for (const deleteData of [undefined, true]) {
-                await inCtx(actor, () =>
-                    controller.handleRevokeUserApp(
-                        makeReq(
-                            { app_uid: app.uid, permission: '*', deleteData },
-                            { actor },
-                        ),
-                        makeRes(),
-                    ),
-                );
-            }
-        } finally {
-            server.clients.event.off('app.uninstalled', listener);
-        }
-        const expected = {
-            userId: actor.user.id,
-            userUuid: actor.user.uuid,
-            appUid: app.uid,
-        };
-        expect(seen).toEqual([
-            { ...expected, deleteData: false },
-            { ...expected, deleteData: true },
-        ]);
-    });
-
    it('revoke-user-app: 400 when permission is "*" but app_uid is missing', async () => {
        const { actor } = await makeUserAndActor();
        await expect(
@@ -3304,14 +3304,6 @@ export class AuthController extends PuterController {
                { legacyCode: 'bad_request' },
            );
        }
-        // Only unsharing retires the handle along with its grant; withdrawing
-        // the grant alone would leave the share listed and dead.
-        if (typeof permission === 'string' && isKvSharePermission(permission))
-            throw new HttpError(
-                400,
-                'Stop a key-value share with `puter.kv.unshare()` (`DELETE /kv/shares/:handle`)',
-                { legacyCode: 'bad_request' },
-            );
        await this.services.permission.revokeUserUserPermission(
            req.actor!,
            target_username,
@@ -3335,8 +3327,7 @@ export class AuthController extends PuterController {
    })
    async handleRevokeUserApp(req: Request, res: Response): Promise<void> {
        let { app_uid } = req.body ?? {};
-        const { origin, permission, permissions, meta, deleteData } =
-            req.body ?? {};
+        const { origin, permission, permissions, meta } = req.body ?? {};
        this.#validateAppPermissionParams({
            app_uid,
            origin,
@@ -3352,25 +3343,20 @@ export class AuthController extends PuterController {
                legacyCode: 'bad_request',
            });
        }
-        if (deleteData !== undefined && typeof deleteData !== 'boolean') {
-            throw new HttpError(400, '`deleteData` must be a boolean', {
-                legacyCode: 'bad_request',
-            });
-        }
-        if (deleteData && permission !== '*') {
-            throw new HttpError(
-                400,
-                '`deleteData` only applies when `permission` is "*"',
-                { legacyCode: 'bad_request' },
-            );
-        }
        // Deliberately not gated by the target's sharing flag: a user must
        // always be able to withdraw a grant, whatever the target now says.
        if (permission === '*') {
-            await this.services.auth.uninstallApp(req.actor!, app_uid, {
-                deleteData: deleteData === true,
-                meta: meta ?? undefined,
-            });
+            await this.services.permission.revokeUserAppAll(
+                req.actor!,
+                app_uid,
+                meta ?? undefined,
+            );
+            // Withdrawing everything also retires the workers the app deployed
+            // under this user; their tokens would otherwise act as the app.
+            await this.services.auth.deleteWorkerSessionsForApp(
+                req.actor!.user!.id as number,
+                app_uid,
+            );
        } else {
            for (const entry of list) {
                await this.services.permission.revokeUserAppPermission(
@@ -3818,9 +3804,8 @@ export class AuthController extends PuterController {

        let app = await this.stores.app.getByUid(app_uid);
        if (!app && resolvedFromOrigin) {
-            // Hosted-subdomain and custom-domain origins get the site owner
-            // stamped as the app's creator at bootstrap; external origins
-            // stay unowned.
+            // Hosted-subdomain origins get the site owner stamped as the
+            // app's creator at bootstrap; external origins stay unowned.
            // Canonical origin only, so alternate hosts share one row.
            const canonicalOrigin =
                this.services.auth.canonicalizeOrigin(origin);
@@ -3836,10 +3821,9 @@ export class AuthController extends PuterController {
            // An origin's uid is a deterministic uuidv5, so a deleted app
            // reappears here under the identical uid. Withdraw any cross-app
            // data grants left pointing at it before this new row can inherit
-            // consent the user gave its predecessor. Only `createFromOrigin`
-            // reuses a uid, here or wherever else an origin app is bootstrapped:
-            // `AppStore.create` mints a random uuid4, which no deleted app can
-            // ever hold again.
+            // consent the user gave its predecessor. Only *this* path can reuse
+            // a uid: `AppStore.create` mints a random uuid4, which no deleted
+            // app can ever hold again.
            //
            // Called directly rather than through `app.changed`: the token is
            // issued below, so this has to be able to stop that, and
@@ -3850,9 +3834,6 @@ export class AuthController extends PuterController {
                app_uid,
                'uid reused by a new app',
            );
-            // Key-value shares the predecessor left read as gone already,
-            // being older than this row; this only cleans them up.
-            this.services.kvShare.retireSharesOlderThanApp(app);
        }
        if (!app) {
            throw new HttpError(404, `App ${app_uid} does not exist`, {
@@ -4288,27 +4269,7 @@ export class AuthController extends PuterController {
            );
        }

-        const code = req.body?.code;
-        if (
-            user.otp_enabled &&
-            typeof code === 'string' &&
-            /^[A-Z0-9]{8}$/.test(code)
-        ) {
-            await this.#assertSecondFactorAttemptsRemain(user.uuid);
-            const consumed = await this.stores.user.consumeOtpRecoveryCode(
-                user.id,
-                hashRecoveryCode(code),
-            );
-            if (!consumed) {
-                await this.#recordSecondFactorFailure(user.uuid);
-                throw new HttpError(401, 'Incorrect code.', {
-                    legacyCode: 'code_mismatch',
-                    fields: { factor: 'otp' },
-                });
-            }
-        } else {
-            this.#requireAccountTwoFactor(user, code);
-        }
+        this.#requireAccountTwoFactor(user, req.body?.code);

        await this.stores.user.update(user.id, {
            otp_enabled: false,
@@ -4518,14 +4479,11 @@ export class AuthController extends PuterController {
        }

        const token = signStepUpToken(this.services.token, user as never);
-        const isApiHost = req.subdomains?.at(-1) === 'api';
-        if (!isApiHost) {
-            res.cookie(
-                STEP_UP_COOKIE_NAME,
-                token,
-                stepUpCookieOptions(this.config),
-            );
-        }
+        res.cookie(
+            STEP_UP_COOKIE_NAME,
+            token,
+            stepUpCookieOptions(this.config),
+        );

        // A browser reads its elevation back from the httpOnly cookie and never
        // needs the raw value; handing it to page JS would put the second factor
@@ -4534,9 +4492,7 @@ export class AuthController extends PuterController {
        // password/TOTP — this only avoids needless exposure, it isn't a gate.
        const cookieName = this.config.cookie_name ?? 'puter_token';
        const usedSessionCookie =
-            !isApiHost &&
-            !!req.token &&
-            req.token === req.cookies?.[cookieName];
+            !!req.token && req.token === req.cookies?.[cookieName];
        res.json(
            usedSessionCookie ? { elevated: true } : { elevated: true, token },
        );
@@ -4649,19 +4605,13 @@ export class AuthController extends PuterController {
        await checkRateLimit(`${scope}:${userUid}`, limit, window);
    }

-    /**
-     * An `otp-login` JWT completes one sign-in; a second redemption is refused.
-     * Fails closed: while the store can't say whether the token was used, the
-     * sign-in is refused rather than letting a captured token replay.
-     */
+    /** An `otp-login` JWT completes one sign-in; a second redemption is refused. */
    async #consumeOtpLoginToken(token: string): Promise<void> {
        const digest = crypto.createHash('sha256').update(token).digest('hex');
        const firstUse = await checkRateLimit(
            `login-otp-token-used:${digest}`,
            1,
            OTP_LOGIN_TOKEN_USED_WINDOW_MS,
-            undefined,
-            { failOpen: false },
        );
        if (!firstUse) {
            throw new HttpError(400, 'Invalid token.', {
@@ -1,89 +0,0 @@
-import { v4 as uuidv4 } from 'uuid';
-import { afterAll, beforeAll, describe, expect, it } from 'vitest';
-import { hashRecoveryCode } from '../../services/auth/OTPUtil.js';
-import {
-    createTestUser,
-    setupPuterTestEnv,
-    type PuterTestEnv,
-} from '../../testUtil.js';
-
-describe('2FA after signing in with a recovery code', () => {
-    let env: PuterTestEnv;
-    const password = 'lost-authenticator-password';
-
-    beforeAll(async () => {
-        env = await setupPuterTestEnv();
-    }, 120_000);
-    afterAll(async () => {
-        await env?.shutdown();
-    });
-
-    const post = (
-        path: string,
-        body: Record<string, unknown>,
-        cookie?: string,
-    ) =>
-        fetch(new URL(path, env.origin), {
-            method: 'POST',
-            headers: {
-                'content-type': 'application/json',
-                ...(cookie ? { cookie } : {}),
-            },
-            body: JSON.stringify(body),
-        });
-
-    it('allows an unused recovery code to disable 2FA after password revalidation', async () => {
-        const username = `lost2fa_${uuidv4().slice(0, 8)}`;
-        await createTestUser(env.server, { username, password });
-        const user = (await env.server.stores.user.getByUsername(username))!;
-        await env.server.stores.user.update(user.id, {
-            email: `${username}@example.com`,
-            email_confirmed: true,
-            otp_enabled: true,
-            otp_secret: 'TESTSECRETBASE32',
-            otp_recovery_codes: ['RECOVER1', 'RECOVER2', 'RECOVER3']
-                .map(hashRecoveryCode)
-                .join(','),
-        });
-
-        // Sign in with a recovery code: works, and yields a web session.
-        const login = await post('/login', { username, password });
-        expect(login.status).toBe(202);
-        const { otp_jwt_token } = await login.json();
-        const recovered = await post('/login/recovery-code', {
-            token: otp_jwt_token,
-            code: 'RECOVER1',
-        });
-        expect((await recovered.json()).next_step).toBe('complete');
-        const cookie = recovered.headers
-            .getSetCookie()
-            .find((value) => value.startsWith('puter_auth_token='))!
-            .split(';')[0]!;
-
-        const reused = await post(
-            '/user-protected/disable-2fa',
-            { password, code: 'RECOVER1' },
-            cookie,
-        );
-        expect(reused.status).toBe(401);
-        expect(
-            (await env.server.stores.user.getById(user.id, { force: true }))!
-                .otp_enabled,
-        ).toBeTruthy();
-
-        const disable = await post(
-            '/user-protected/disable-2fa',
-            { password, code: 'RECOVER2' },
-            cookie,
-        );
-        expect(disable.status).toBe(200);
-        expect(await disable.json()).toMatchObject({ success: true });
-
-        const after = await env.server.stores.user.getById(user.id, {
-            force: true,
-        });
-        expect(after!.otp_enabled).toBeFalsy();
-        expect(after!.otp_secret).toBeNull();
-        expect(after!.otp_recovery_codes).toBeNull();
-    });
-});
@@ -21,7 +21,7 @@
 import { EventEmitter } from 'node:events';
 import type { Request, RequestHandler, Response } from 'express';
 import { beforeEach, describe, expect, it } from 'vitest';
-import { Context, runWithContext } from '../../core/context.js';
+import { runWithContext } from '../../core/context.js';
 import { isHttpError } from '../../core/http/HttpError.js';
 import { configureRateLimit } from '../../core/http/middleware/rateLimit.js';
 import { DriverController } from './DriverController.js';
@@ -278,86 +278,6 @@ describe('DriverController — concurrent acquire/release', () => {
        expect(res2.body).toMatchObject({ success: true, result: 'pong' });
    });

-    // A driver that keeps working after the caller hangs up (async video
-    // polling) must keep counting against the cap until it settles.
-    it('holds the slot while the driver still works after a disconnect', async () => {
-        let finish = () => {};
-        const driver = {
-            ...makeSyntheticDriver(),
-            ping: () =>
-                new Promise<string>((resolve) => {
-                    finish = () => resolve('pong');
-                }),
-        };
-        const handler = captureCallHandler(buildController(driver));
-        const req = () =>
-            makeReq({ interface: 'test-iface', method: 'ping' }, 'working');
-
-        const res1 = new StubRes();
-        const first = callInScope(handler, req(), res1 as unknown as Response);
-        await new Promise((r) => setImmediate(r));
-        res1.emit('close');
-        await new Promise((r) => setImmediate(r));
-
-        await expect(
-            callInScope(handler, req(), new StubRes() as unknown as Response),
-        ).rejects.toSatisfy(
-            (e) =>
-                isHttpError(e) &&
-                (e as { statusCode: number }).statusCode === 429,
-        );
-
-        finish();
-        await first;
-        await new Promise((r) => setImmediate(r));
-        const res2 = new StubRes();
-        const second = callInScope(handler, req(), res2 as unknown as Response);
-        await new Promise((r) => setImmediate(r));
-        finish();
-        await second;
-        res2.emit('finish');
-        expect(res2.body).toMatchObject({ success: true, result: 'pong' });
-    });
-
-    it('holds the slot for work a driver keeps past its response', async () => {
-        let settleWork = () => {};
-        const driver = {
-            ...makeSyntheticDriver(),
-            ping: async () => {
-                Context.get('keepDriverSlot')?.(
-                    new Promise<void>((resolve) => {
-                        settleWork = resolve;
-                    }),
-                );
-                return 'pong';
-            },
-        };
-        const handler = captureCallHandler(buildController(driver));
-        const req = () =>
-            makeReq({ interface: 'test-iface', method: 'ping' }, 'kept');
-
-        const res1 = new StubRes();
-        await callInScope(handler, req(), res1 as unknown as Response);
-        res1.emit('finish');
-        await new Promise((r) => setImmediate(r));
-
-        await expect(
-            callInScope(handler, req(), new StubRes() as unknown as Response),
-        ).rejects.toSatisfy(
-            (e) =>
-                isHttpError(e) &&
-                (e as { statusCode: number }).statusCode === 429,
-        );
-
-        settleWork();
-        await new Promise((r) => setImmediate(r));
-        const res2 = new StubRes();
-        await callInScope(handler, req(), res2 as unknown as Response);
-        res2.emit('finish');
-        settleWork();
-        expect(res2.body).toMatchObject({ success: true, result: 'pong' });
-    });
-
    it('does not attach release listeners when the driver declares no concurrent config', async () => {
        // With no spec there is nothing to release, so the gate must not
        // wire `finish`/`close` release listeners. The client-disconnect
@@ -50,7 +50,6 @@ import { PermissionUtil } from '../../services/permission/permissionUtil.js';
 import type { WithLifecycle } from '../../types';
 import { withSpan } from '../../util/span.js';
 import { PuterController } from '../types.js';
-import { CallSlot } from './callSlot.js';

 type DriverInstance = WithLifecycle & Record<string, unknown>;

@@ -260,17 +259,6 @@ export class DriverController extends PuterController {
    // -- Handlers ----------------------------------------------------

    #handleCall = async (req: Request, res: Response): Promise<void> => {
-        const slot = new CallSlot();
-        const call = this.#call(req, res, slot);
-        slot.keep(call);
-        await call;
-    };
-
-    #call = async (
-        req: Request,
-        res: Response,
-        slot: CallSlot,
-    ): Promise<void> => {
        const {
            interface: ifaceName,
            method,
@@ -407,9 +395,10 @@ export class DriverController extends PuterController {

        // Per-method rate-limit and concurrent specs both live on the
        // driver's resolved meta. Rate-limit is single-shot; concurrent
-        // acquires a slot held until the response is done and the call's
-        // work has settled, so streamed responses hold it until the stream
-        // drains and work that continues after a disconnect still counts.
+        // acquires a slot that must be released when the response is done
+        // — we hook `res.finish` / `res.close` for that so streamed
+        // responses hold their slot until the stream drains, and aborted
+        // requests still give the slot back.
        const rateLimitSpec = resolvePerMethod(driverMeta?.rateLimit, method);
        if (
            !(await checkDriverRateLimit(req, ifaceName, method, rateLimitSpec))
@@ -441,8 +430,18 @@ export class DriverController extends PuterController {
                    legacyCode: 'too_many_requests',
                });
            }
-            slot.attach(handle, res);
-            Context.set('keepDriverSlot', (work) => slot.keep(work));
+            let released = false;
+            const release = () => {
+                if (released) return;
+                released = true;
+                void handle.release();
+            };
+            // If the handler throws before responding, the express error
+            // handler will eventually send a response — `finish` fires then,
+            // so we still release. `close` covers client aborts.
+            res.once('finish', release);
+            res.once('close', release);
+            if (res.destroyed || res.writableFinished) release();
        }

        // Stash the requested driver name in Context so multi-provider
@@ -1,73 +0,0 @@
-/*
- * Copyright (C) 2024-present Puter Technologies Inc.
- *
- * This file is part of Puter.
- *
- * Puter is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published
- * by the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-import { EventEmitter } from 'node:events';
-import type { Response } from 'express';
-import { afterEach, describe, expect, it, vi } from 'vitest';
-import { CallSlot } from './callSlot.js';
-
-const handle = () => ({
-    release: vi.fn(() => Promise.resolve()),
-    renew: vi.fn(() => Promise.resolve()),
-});
-
-const deferred = () => {
-    let resolve = () => {};
-    const promise = new Promise<void>((r) => {
-        resolve = r;
-    });
-    return { promise, resolve };
-};
-
-afterEach(() => {
-    vi.useRealTimers();
-});
-
-describe('CallSlot', () => {
-    it('renews a slot held by a long call and stops once it is released', async () => {
-        vi.useFakeTimers();
-        const slot = new CallSlot();
-        const slotHandle = handle();
-        const res = new EventEmitter();
-        const call = deferred();
-        slot.keep(call.promise);
-        slot.attach(slotHandle, res as unknown as Response);
-
-        res.emit('close');
-        await vi.advanceTimersByTimeAsync(25 * 60 * 1000);
-        expect(slotHandle.renew).toHaveBeenCalledTimes(2);
-        expect(slotHandle.release).not.toHaveBeenCalled();
-
-        call.resolve();
-        await vi.advanceTimersByTimeAsync(0);
-        expect(slotHandle.release).toHaveBeenCalledOnce();
-        await vi.advanceTimersByTimeAsync(25 * 60 * 1000);
-        expect(slotHandle.renew).toHaveBeenCalledTimes(2);
-    });
-
-    it('releases once the response is done if no work is outstanding', async () => {
-        const slot = new CallSlot();
-        const slotHandle = handle();
-        const res = new EventEmitter();
-        slot.attach(slotHandle, res as unknown as Response);
-        res.emit('finish');
-        expect(slotHandle.release).toHaveBeenCalledOnce();
-        expect(slotHandle.renew).not.toHaveBeenCalled();
-    });
-});
@@ -1,80 +0,0 @@
-/*
- * Copyright (C) 2024-present Puter Technologies Inc.
- *
- * This file is part of Puter.
- *
- * Puter is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published
- * by the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-import type { Response } from 'express';
-
-// Under the concurrency store's one-hour orphan TTL.
-const SLOT_RENEW_MS = 10 * 60 * 1000;
-
-interface SlotHandle {
-    release(): Promise<void>;
-    renew?(): Promise<void>;
-}
-
-/**
- * A driver call's concurrency slot, held until the response is done and the
- * call's work has settled, including work a driver carries on after the caller
- * hung up or was answered.
- */
-export class CallSlot {
-    #handle?: SlotHandle;
-    #work = new Set<Promise<unknown>>();
-    #responded = false;
-    #released = false;
-    #renew?: NodeJS.Timeout;
-
-    attach(handle: SlotHandle, res: Response): void {
-        this.#handle = handle;
-        const responded = () => {
-            this.#responded = true;
-            this.#maybeRelease();
-        };
-        res.once('finish', responded);
-        res.once('close', responded);
-        if (res.destroyed || res.writableFinished) responded();
-        if (!this.#released && this.#work.size > 0) this.#startRenewing();
-    }
-
-    keep(work: Promise<unknown>): void {
-        if (this.#released) return;
-        this.#work.add(work);
-        if (this.#handle) this.#startRenewing();
-        const settled = () => {
-            this.#work.delete(work);
-            this.#maybeRelease();
-        };
-        work.then(settled, settled);
-    }
-
-    #startRenewing(): void {
-        if (this.#renew) return;
-        this.#renew = setInterval(() => {
-            void this.#handle?.renew?.();
-        }, SLOT_RENEW_MS);
-        this.#renew.unref?.();
-    }
-
-    #maybeRelease(): void {
-        if (this.#released || !this.#handle) return;
-        if (!this.#responded || this.#work.size > 0) return;
-        this.#released = true;
-        clearInterval(this.#renew);
-        void this.#handle.release();
-    }
-}
@@ -104,24 +104,6 @@ export class EventsController extends PuterController {
        });
    }

-    /**
-     * POST /events/subscriptions/update — replace one subscription's `context`
-     * in place. An id the caller does not hold reads as absent.
-     */
-    @Post('/subscriptions/update', {
-        subdomain: 'api',
-        requireAuth: true,
-        allowAccessToken: true,
-    })
-    async update(req: Request, res: Response): Promise<void> {
-        const actor = this.#requireActor(req);
-        const { sub } = await this.services.events.updateDurable(
-            actor,
-            bodyRecord(req),
-        );
-        res.json(sub);
-    }
-
    /**
     * GET /events/fetch — what the caller missed, one page at a time.
     *
@@ -139,14 +139,14 @@ describe('the delivery budgets', () => {
    });

    it('pins the share-handle quotas by plan', () => {
-        expect(EVENTS_KV_HANDLES_PER_USER.limit).toBe(25_000);
-        expect(EVENTS_KV_HANDLES_PER_APP.limit).toBe(10_000);
+        expect(EVENTS_KV_HANDLES_PER_USER.limit).toBe(512);
+        expect(EVENTS_KV_HANDLES_PER_APP.limit).toBe(512);
        expect(
            limitFor(EVENTS_KV_HANDLES_PER_USER, DEFAULT_FREE_SUBSCRIPTION),
-        ).toBe(5_000);
+        ).toBe(200);
        expect(
            limitFor(EVENTS_KV_HANDLES_PER_APP, DEFAULT_FREE_SUBSCRIPTION),
-        ).toBe(2_000);
+        ).toBe(128);
    });

    it('keeps `single` well under broadcast — each one costs far more', () => {
@@ -93,18 +93,6 @@ export interface TieredQuota {
 */
 export const EVENTS_SESSION_SUBSCRIPTIONS_PER_SOCKET = 50;

-/**
- * Live subscriptions one user may hold through a share handle someone else
- * minted for them, across all of their connections.
- *
- * Those rows sit in the owner's keyspace, where each one costs a filter
- * evaluation on the owner's writes. The count also takes in connections that
- * dropped and haven't been reaped yet, so the cap sits far above what
- * reconnects leave behind. The owner's own rows through the handle don't
- * count.
- */
-export const EVENTS_SESSION_SUBSCRIPTIONS_PER_KV_HANDLE = 1000;
-
 /**
 * Durable subscriptions one account may hold, across every app.
 *
@@ -137,13 +125,6 @@ export const EVENTS_DURABLE_SUBSCRIPTIONS_MAX =
 */
 export const SUSPENDED_ROW_TTL_DAYS = 30;

-/**
- * Subscriptions stopped by a revoked grant that one account keeps for `list`.
- * They hold no quota slot, so past this the oldest are deleted when the account
- * subscribes again, keeping its rows bounded.
- */
-export const EVENTS_REVOKED_SUBSCRIPTIONS_KEPT = 500;
-
 /**
 * Subscribe calls per minute, per user.
 *
@@ -174,13 +155,6 @@ export const EVENTS_LIST_LIMIT = userWindow('events:list', 120);
 */
 export const EVENTS_ACK_LIMIT = userWindow('events:ack', 600);

-/**
- * How long a connected client holds a queued delivery before the events worker
- * may take it. A client that has no handler for it, or whose handler fails,
- * declines it at once; this only bounds one that never answers.
- */
-export const EVENTS_SOCKET_LEASE_MS = 15_000;
-
 /**
 * Share-handle mint + revoke calls per minute, per user.
 *
@@ -202,55 +176,20 @@ export const KV_SHARE_NOTICE_LIMIT = userWindow(
 /**
 * Live share handles one account may hold out at a time, across every app.
 *
- * A backstop above the per-app cap: every count reads a covering index, so the
- * bound is on standing grants, not query cost. A temporary account holds none:
- * the grant outlives the session that made it, and no account is left to take
- * it back.
+ * Each is a standing grant on part of the account's data, and revoking marks
+ * rather than deletes, so without a ceiling the rate limit alone lets the rows
+ * grow forever. A temporary account holds none: the grant outlives the session
+ * that made it, and no account is left to take it back.
 */
-export const EVENTS_KV_HANDLES_PER_USER = tiered(25_000, 5_000, 0);
+export const EVENTS_KV_HANDLES_PER_USER = tiered(512, 200, 0);

 /**
- * Live share handles one app may hold out for one account, so one namespace
- * cannot consume the whole account budget.
+ * Live share handles one app may hold out for one account.
+ *
+ * Separately bounded from the account cap so one namespace cannot consume the
+ * whole budget on free accounts.
 */
-export const EVENTS_KV_HANDLES_PER_APP = tiered(10_000, 2_000, 0);
-
-/**
- * Live share handles one owner may hold out to one holder, on every plan.
- * Bounds the rows a revoke or unshare walks to find the narrower handles inside
- * one.
- */
-export const EVENTS_KV_HANDLES_PER_HOLDER = 256;
-
-/**
- * Recipients one account may share with, per minute and per hour. A call spends
- * one per recipient that doesn't already hold the share, on top of the per-call
- * mint budget.
- */
-export const KV_SHARE_GRANT_LIMITS = [
-    userWindow('kvShare:grants:minute', 300),
-    userWindow('kvShare:grants:hour', 2_000, 60 * 60_000),
-] as const;
-
-/**
- * Recipients one account may name in share calls per minute, existing shares
- * included. Each one is looked up before the call knows whether it changes
- * anything, so a client that shares again on every load is bounded here.
- */
-export const KV_SHARE_LOOKUP_LIMIT = userWindow('kvShare:lookups', 1_200);
-
-/** Recipients one `POST /kv/shares` call may name. */
-export const KV_SHARE_BATCH_MAX = 50;
-
-/**
- * Notifications one party of a share may send the other through share handles,
- * per minute and per day, in one app. Keeps one share from spending the
- * recipient's whole notification allowance.
- */
-export const KV_SHARE_NOTIFY_LIMITS = [
-    userWindow('kvShare:notify:minute', 30),
-    userWindow('kvShare:notify:day', 500, 24 * 60 * 60_000),
-] as const;
+export const EVENTS_KV_HANDLES_PER_APP = tiered(512, 128, 0);

 // -- Handler surface -------------------------------------------------

@@ -348,11 +287,8 @@ export const EVENTS_KV_MATCHED_SUBSCRIPTIONS_PER_EVENT = tiered(512, 128, 128);
 */
 export const EVENTS_KV_FILTER_EVALUATIONS_PER_EVENT = tiered(2048, 512, 512);

-/**
- * Deliveries of one key-value change that carry its value inline, in the order
- * the fan-out serves them. Later ones carry the key alone.
- */
-export const EVENTS_KV_VALUE_DELIVERIES_PER_EVENT = 128;
+/** Omit all inline KV values when the matched audience exceeds this count. */
+export const EVENTS_KV_VALUE_OMIT_MATCHED_SUBSCRIPTIONS = 128;

 /**
 * Largest inline KV value in serialized bytes. Larger values are omitted;
@@ -444,9 +380,7 @@ export const EVENTS_REGION_PENDING_CEILING = 1_000_000;
 // a handler that answers "no" is not. Retrying on a fixed cadence turns one
 // broken deploy into a permanent load on whatever is failing, so the wait
 // doubles per attempt up to a ceiling, and a run of failures stops the
-// subscription rather than retrying it forever. A run Puter could not start or
-// finish backs off the same way but is not the handler's failure, so it never
-// counts toward that run.
+// subscription rather than retrying it forever.

 /** Wait before the first retry of a delivery a handler could not take. */
 export const EVENTS_RETRY_BASE_MS = 2_000;
@@ -455,7 +389,7 @@ export const EVENTS_RETRY_BASE_MS = 2_000;
 export const EVENTS_RETRY_MAX_MS = 5 * 60 * 1000;

 /**
- * Handler failures in a row before a subscription is suspended. Counted per
+ * Failures in a row before a subscription is suspended. Counted per
 * subscription and reset by the first delivery a handler takes, so an
 * occasional failure never accumulates into one.
 */
@@ -49,8 +49,6 @@ type Layers = ConstructorParameters<typeof EventsWorkerDeployer>[0];
 const makeLayers = (owners: Record<string, Owner | null>) => {
    const redis = new MockRedis.Cluster(['redis://localhost:7001']);
    const created: string[] = [];
-    /** Apps whose handler sources were read, once per read. */
-    const sourceReads: string[] = [];
    const layers = {
        config: {
            events: { workerRuntime: true, internalSecret: 'sekret' },
@@ -62,20 +60,16 @@ const makeLayers = (owners: Record<string, Owner | null>) => {
        clients: { redis },
        stores: {
            eventHandler: {
-                setForApp: async () => [{ name: 'h', sourceHash: SOURCE_HASH }],
-                allForApp: async (appUid: string) => {
-                    sourceReads.push(appUid);
-                    return [
-                        {
-                            appUid,
-                            name: 'h',
-                            source: 'async () => {}',
-                            sourceHash: SOURCE_HASH,
-                            createdAt: 0,
-                            updatedAt: 0,
-                        },
-                    ];
-                },
+                allForApp: async (appUid: string) => [
+                    {
+                        appUid,
+                        name: 'h',
+                        source: 'async () => {}',
+                        sourceHash: SOURCE_HASH,
+                        createdAt: 0,
+                        updatedAt: 0,
+                    },
+                ],
            },
            app: {
                getByUid: async (appUid: string) => {
@@ -110,12 +104,7 @@ const makeLayers = (owners: Record<string, Owner | null>) => {
            },
        },
    };
-    return {
-        layers: layers as unknown as Layers,
-        created,
-        redis,
-        sourceReads,
-    };
+    return { layers: layers as unknown as Layers, created, redis };
 };

 describe('EventsWorkerDeployer.ensure', () => {
@@ -138,10 +127,8 @@ describe('EventsWorkerDeployer.ensure', () => {
        expect(b).toBe('no-owner');
    });

-    it('refuses once the app has deployed past the hourly cap, before reading or building any source', async () => {
-        const { layers, redis, sourceReads, created } = makeLayers({
-            'app-c': { ownerUserId: 3 },
-        });
+    it('refuses once the app has deployed past the hourly cap', async () => {
+        const { layers, redis } = makeLayers({ 'app-c': { ownerUserId: 3 } });
        const deployer = new EventsWorkerDeployer(layers);
        const hour = new Date().toISOString().slice(0, 13);
        await redis.set(
@@ -150,24 +137,6 @@ describe('EventsWorkerDeployer.ensure', () => {
        );

        expect(await deployer.ensure('app-c', SCRIPT)).toBe('throttled');
-        expect(sourceReads).toEqual([]);
-        expect(created).toEqual([]);
-    });
-
-    it('answers a stale script without spending the hourly cap', async () => {
-        const { layers, redis, sourceReads } = makeLayers({
-            'app-e': { ownerUserId: 5 },
-        });
-        const deployer = new EventsWorkerDeployer(layers);
-        const stale = eventsWorkerScript(
-            handlerSetHash([{ name: 'h', sourceHash: 'b'.repeat(64) }]),
-            '',
-        );
-
-        expect(await deployer.ensure('app-e', stale)).toBe('stale');
-        expect(sourceReads).toEqual([]);
-        const hour = new Date().toISOString().slice(0, 13);
-        expect(await redis.get(`ev:deploys:{app-e}:${hour}`)).toBeNull();
    });

    it('deploys normally under the cap', async () => {
@@ -26,14 +26,10 @@ import {
    INTERNAL_ADMISSION_BYPASS,
    INTERNAL_DEPLOY_TARGET,
 } from '../../drivers/workers/WorkerDriver.js';
-import type {
-    EventsInvokeAnswer,
-    EventsInvokeCall,
-} from '../../clients/events/EventsWorkerInvokerClient.js';
+import type { EventsInvokeCall } from '../../clients/events/EventsWorkerInvokerClient.js';
 import {
+    EVENTS_HANDLED_HEADER,
    EVENTS_INVOKE_PATH,
-    answerFrom,
-    failedAnswer,
 } from '../../clients/events/EventsWorkerInvokerClient.js';
 import type { puterServices } from '../../services/index.js';
 import {
@@ -41,10 +37,7 @@ import {
    eventsWorkerScope,
    eventsWorkerScript,
 } from '../../services/events/workerRuntime.js';
-import {
-    generateEventsWorkerSource,
-    handlerSetHash,
-} from '../../services/events/workerSource.js';
+import { generateEventsWorkerSource } from '../../services/events/workerSource.js';
 import type { puterStores } from '../../stores/index.js';
 import type { IConfig, LayerInstances } from '../../types.js';
 import { EVENTS_WORKER_DEPLOYS_PER_HOUR } from './limits.js';
@@ -120,24 +113,20 @@ export class EventsWorkerDeployer {
        script: string,
    ): Promise<EventsDeployOutcome> {
        const { stores, drivers } = this.#layers;
-        const scope = eventsWorkerScope(this.#layers.config);

-        // Names and hashes are enough to tell a stale request, so the set's
-        // sources are read and built only once the throttle has let it through.
-        const set = await stores.eventHandler.setForApp(appUid);
-        if (set.length === 0) return 'no-handlers';
+        const handlers = await stores.eventHandler.allForApp(appUid);
+        if (handlers.length === 0) return 'no-handlers';
+
+        const generated = generateEventsWorkerSource(handlers);
        // Two apps that published byte-identical sets share one script, which
        // is sound: the source is the same, and everything per-app arrives with
        // the invocation. Whoever deploys first owns it.
-        if (eventsWorkerScript(handlerSetHash(set), scope) !== script)
-            return 'stale';
-
-        if (await this.#tooManyDeploysThisHour(appUid)) return 'throttled';
-
-        const handlers = await stores.eventHandler.allForApp(appUid);
-        const generated = generateEventsWorkerSource(handlers);
-        // The set can move between the two reads.
-        if (eventsWorkerScript(generated.setHash, scope) !== script)
+        if (
+            eventsWorkerScript(
+                generated.setHash,
+                eventsWorkerScope(this.#layers.config),
+            ) !== script
+        )
            return 'stale';
        if (generated.tooLarge) {
            console.error(
@@ -151,6 +140,8 @@ export class EventsWorkerDeployer {
                generated.broken.join(', '),
            );

+        if (await this.#tooManyDeploysThisHour(appUid)) return 'throttled';
+
        const owner = await this.#owner(appUid);
        if (!owner) return 'no-owner';

@@ -298,7 +289,11 @@ export class LocalEventsInvokeTransport {
        this.#deployer = deployer;
    }

-    async send(call: EventsInvokeCall): Promise<EventsInvokeAnswer> {
+    async send(call: EventsInvokeCall): Promise<{
+        status: number | null;
+        handled?: boolean;
+        error?: string;
+    }> {
        const request = (): Request =>
            new Request(
                `http://${call.script}.workers.puter.localhost${EVENTS_INVOKE_PATH}`,
@@ -328,7 +323,10 @@ export class LocalEventsInvokeTransport {
                return { status: null, error: 'script not resident' };
            return retried;
        } catch (err) {
-            return failedAnswer(err);
+            return {
+                status: null,
+                error: err instanceof Error ? err.message : String(err),
+            };
        }
    }

@@ -339,7 +337,7 @@ export class LocalEventsInvokeTransport {
    async #dispatch(
        request: Request,
        timeoutMs: number,
-    ): Promise<EventsInvokeAnswer | null> {
+    ): Promise<{ status: number; handled: boolean } | null> {
        let timer: ReturnType<typeof setTimeout> | undefined;
        const timeout = new Promise<'timeout'>((resolve) => {
            timer = setTimeout(() => resolve('timeout'), timeoutMs);
@@ -350,10 +348,12 @@ export class LocalEventsInvokeTransport {
                this.#services.localworkerservice.dispatchEventsWorker(request),
                timeout,
            ]);
-            if (response === 'timeout')
-                throw new DOMException('invocation timed out', 'TimeoutError');
+            if (response === 'timeout') throw new Error('invocation timed out');
            if (response === null) return null;
-            return answerFrom(response);
+            return {
+                status: response.status,
+                handled: response.headers.get(EVENTS_HANDLED_HEADER) === '1',
+            };
        } finally {
            clearTimeout(timer);
        }
@@ -1,80 +0,0 @@
-import { afterAll, beforeAll, describe, expect, it } from 'vitest';
-import { setupPuterTestEnv, type PuterTestEnv } from '../../testUtil.js';
-
-describe('recursive readdir with offset', () => {
-    let env: PuterTestEnv;
-
-    beforeAll(async () => {
-        env = await setupPuterTestEnv();
-    }, 120_000);
-
-    afterAll(async () => {
-        await env?.shutdown();
-    });
-
-    const post = async (path: string, token: string, body: unknown) =>
-        fetch(new URL(path, env.apiOrigin), {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                Authorization: `Bearer ${token}`,
-            },
-            body: JSON.stringify(body),
-        });
-
-    it('skips entries before applying the recursive page limit', async () => {
-        const { username, token } = env.users.user;
-        const base = `/${username}/Documents/rec-offset`;
-        for (const path of [base, `${base}/a`, `${base}/b`, `${base}/c`]) {
-            expect((await post('/fs/mkdir', token, { path })).status).toBe(200);
-        }
-
-        const list = async (body: Record<string, unknown>) => {
-            const response = await post('/fs/readdir', token, {
-                path: base,
-                recursive: true,
-                ...body,
-            });
-            expect(response.status).toBe(200);
-            const page = (await response.json()) as {
-                items: Array<{ name: string }>;
-            };
-            return page.items.map((item) => item.name);
-        };
-
-        expect(await list({ limit: 3 })).toEqual(['a', 'b', 'c']);
-        // Non-recursive honours offset.
-        const flat = await post('/fs/readdir', token, {
-            path: base,
-            limit: 1,
-            offset: 2,
-        });
-        expect(
-            ((await flat.json()) as Array<{ name: string }>).map((e) => e.name),
-        ).toEqual(['c']);
-        expect(await list({ limit: 1, offset: 2 })).toEqual(['c']);
-        expect(await list({ offset: 2 })).toEqual(['c']);
-        expect(await list({ offset: 20 })).toEqual([]);
-        expect(await list({ limit: 1, offset: 1, sortOrder: 'desc' })).toEqual([
-            'b',
-        ]);
-        const first = await post('/fs/readdir', token, {
-            path: base,
-            recursive: true,
-            limit: 1,
-            offset: 1,
-        });
-        const page = await first.json();
-        expect(page.items.map((item: { name: string }) => item.name)).toEqual([
-            'b',
-        ]);
-        expect(page.cursor).toBeTypeOf('string');
-        expect(await list({ limit: 1, cursor: page.cursor })).toEqual(['c']);
-        // A cursor wins over offset, and an invalid offset is ignored, as
-        // recursive listings did before they honoured offset.
-        expect(
-            await list({ limit: 1, cursor: page.cursor, offset: 1 }),
-        ).toEqual(['c']);
-        expect(await list({ limit: 1, offset: -1 })).toEqual(['a']);
-    });
-});
@@ -1335,7 +1335,6 @@ export class FSController extends PuterController {
                parent.path,
                {
                    limit,
-                    offset,
                    cursor:
                        typeof body.cursor === 'string'
                            ? body.cursor
@@ -1,114 +0,0 @@
-import { v4 as uuidv4 } from 'uuid';
-import { afterAll, beforeAll, describe, expect, it } from 'vitest';
-import { makeActor } from '../../core/actor.js';
-import { setupPuterTestEnv, type PuterTestEnv } from '../../testUtil.js';
-
-describe('/auth/check-app-acl', () => {
-    let env: PuterTestEnv;
-    beforeAll(async () => {
-        env = await setupPuterTestEnv();
-    }, 120_000);
-    afterAll(async () => {
-        await env?.shutdown();
-    });
-
-    const post = (path: string, body: unknown, token: string) =>
-        fetch(new URL(path, env.apiOrigin), {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                Authorization: `Bearer ${token}`,
-            },
-            body: JSON.stringify(body),
-        });
-
-    const makeDirAndApp = async () => {
-        const { username, token } = env.users.user;
-        const server = env.server;
-        const user = (await server.stores.user.getByUsername(username))!;
-        const path = `/${username}/Documents/cacl-${uuidv4()}`;
-        expect((await post('/fs/mkdir', { path }, token)).status).toBe(200);
-        const entry = (await server.stores.fsEntry.getEntryByPath(path))!;
-
-        const app = await (
-            server.stores.app.create as unknown as (
-                f: Record<string, unknown>,
-                o: { ownerUserId: number },
-            ) => Promise<{ uid: string; id: number }>
-        )(
-            {
-                name: `cacl-${uuidv4()}`,
-                title: 'Check app acl',
-                index_url: `https://cacl-${uuidv4()}.test/`,
-            },
-            { ownerUserId: user.id },
-        );
-        return { user, path, entry, app };
-    };
-
-    it('allows a granted file without poisoning the app permission cache', async () => {
-        const { token } = env.users.user;
-        const server = env.server;
-        const { user, path, entry, app } = await makeDirAndApp();
-
-        const grant = await post(
-            '/auth/grant-user-app',
-            { app_uid: app.uid, permission: `fs:${entry.uuid}:read` },
-            token,
-        );
-        expect(grant.status).toBe(200);
-
-        const res = await post(
-            '/auth/check-app-acl',
-            { subject: { path }, app: app.uid, mode: 'read' },
-            token,
-        );
-        expect(res.status).toBe(200);
-        expect(await res.json()).toEqual({ allowed: true });
-
-        const asApp = makeActor({ user, app: { uid: app.uid, id: app.id } });
-        const descriptor = () => server.services.acl.fsDescriptor(path);
-        expect(
-            await server.services.acl.check(asApp, descriptor(), 'read'),
-        ).toBe(true);
-    });
-
-    it('denies an app with no grant', async () => {
-        const { path, app } = await makeDirAndApp();
-        const res = await post(
-            '/auth/check-app-acl',
-            { subject: { path }, app: app.uid, mode: 'read' },
-            env.users.user.token,
-        );
-        expect(res.status).toBe(200);
-        expect(await res.json()).toEqual({ allowed: false });
-    });
-
-    it('refuses app and access tokens', async () => {
-        const { token, apiToken } = env.users.user;
-        const { path, entry, app } = await makeDirAndApp();
-        const grant = await post(
-            '/auth/grant-user-app',
-            { app_uid: app.uid, permission: `fs:${entry.uuid}:read` },
-            token,
-        );
-        expect(grant.status).toBe(200);
-
-        const minted = await post(
-            '/auth/get-user-app-token',
-            { app_uid: app.uid },
-            token,
-        );
-        expect(minted.status).toBe(200);
-        const appToken = ((await minted.json()) as { token: string }).token;
-
-        for (const credential of [appToken, apiToken]) {
-            const res = await post(
-                '/auth/check-app-acl',
-                { subject: { path }, app: app.uid, mode: 'read' },
-                credential,
-            );
-            expect(res.status).toBe(403);
-        }
-    });
-});
@@ -1,204 +0,0 @@
-/*
- * Copyright (C) 2024-present Puter Technologies Inc.
- *
- * This file is part of Puter.
- *
- * Puter is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published
- * by the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-import { randomUUID } from 'node:crypto';
-import { afterAll, beforeAll, describe, expect, it } from 'vitest';
-import { setupPuterTestEnv, type PuterTestEnv } from '../../testUtil.js';
-
-let env: PuterTestEnv;
-
-beforeAll(async () => {
-    env = await setupPuterTestEnv();
-}, 120_000);
-
-afterAll(async () => {
-    await env?.shutdown();
-});
-
-const post = (path: string, body: unknown) =>
-    fetch(new URL(path, env.apiOrigin), {
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/json',
-            Authorization: `Bearer ${env.users.user.token}`,
-        },
-        body: JSON.stringify(body),
-    });
-
-const write = (path: string, content: string) =>
-    post('/fs/write', {
-        fileMetadata: { path, size: content.length, contentType: 'text/plain' },
-        fileContent: content,
-    });
-
-const read = async (path: string) => {
-    const url = new URL('/read', env.apiOrigin);
-    url.searchParams.set('file', path);
-    const response = await fetch(url, {
-        headers: { Authorization: `Bearer ${env.users.user.token}` },
-    });
-    return response.text();
-};
-
-const makeDir = async (name: string) => {
-    const path = `/${env.users.user.username}/Documents/${name}-${randomUUID().slice(0, 8)}`;
-    expect((await post('/fs/mkdir', { path })).status).toBe(200);
-    return path;
-};
-
-describe('legacy /copy onto an existing file', () => {
-    it('replaces the file with overwrite', async () => {
-        const dir = await makeDir('copy-onto');
-        expect((await write(`${dir}/a.txt`, 'aaa')).status).toBe(200);
-        expect((await write(`${dir}/b.txt`, 'bbbbbb')).status).toBe(200);
-
-        const copy = await post('/copy', {
-            source: `${dir}/a.txt`,
-            destination: `${dir}/b.txt`,
-            overwrite: true,
-        });
-        expect(copy.status).toBe(200);
-        const [result] = (await copy.json()) as Array<{
-            copied: { name: string; path: string };
-            overwritten?: { name: string };
-        }>;
-        expect(result!.copied.name).toBe('b.txt');
-        expect(result!.overwritten?.name).toBe('b.txt');
-        expect(await read(`${dir}/b.txt`)).toBe('aaa');
-        expect(await read(`${dir}/a.txt`)).toBe('aaa');
-    });
-
-    it('refuses without overwrite and leaves the file alone', async () => {
-        const dir = await makeDir('copy-onto-refused');
-        await write(`${dir}/a.txt`, 'aaa');
-        await write(`${dir}/b.txt`, 'bbbbbb');
-
-        const copy = await post('/copy', {
-            source: `${dir}/a.txt`,
-            destination: `${dir}/b.txt`,
-        });
-        expect(copy.status).toBe(409);
-        expect(((await copy.json()) as { code: string }).code).toBe(
-            'item_with_same_name_exists',
-        );
-        expect(await read(`${dir}/b.txt`)).toBe('bbbbbb');
-    });
-
-    it('still copies into a directory destination under the same name', async () => {
-        const dir = await makeDir('copy-into');
-        await write(`${dir}/a.txt`, 'aaa');
-        expect((await post('/fs/mkdir', { path: `${dir}/sub` })).status).toBe(
-            200,
-        );
-
-        const copy = await post('/copy', {
-            source: `${dir}/a.txt`,
-            destination: `${dir}/sub`,
-        });
-        expect(copy.status).toBe(200);
-        expect(await read(`${dir}/sub/a.txt`)).toBe('aaa');
-    });
-
-    it('refuses to overwrite a file with itself', async () => {
-        const dir = await makeDir('copy-self');
-        await write(`${dir}/a.txt`, 'aaa');
-
-        for (const destination of [`${dir}/a.txt`, dir]) {
-            const copy = await post('/copy', {
-                source: `${dir}/a.txt`,
-                destination,
-                overwrite: true,
-            });
-            expect(copy.status).toBe(400);
-        }
-        expect(await read(`${dir}/a.txt`)).toBe('aaa');
-    });
-});
-
-describe('signed folder listing', () => {
-    const signedListing = async (path: string) => {
-        const signed = await post('/sign', {
-            items: [{ path, action: 'read' }],
-        });
-        expect(signed.status).toBe(200);
-        const readUrl = new URL(
-            (await signed.json()).signatures[0].read_url as string,
-        );
-        return fetch(
-            new URL(`${readUrl.pathname}${readUrl.search}`, env.apiOrigin),
-        );
-    };
-
-    it('lists every child of a folder larger than one query', async () => {
-        const dir = await makeDir('big');
-        const parent = (await env.server.stores.fsEntry.getEntryByPath(dir))!;
-        const total = 10_050;
-        const now = Math.floor(Date.now() / 1000);
-        for (let start = 0; start < total; start += 500) {
-            const rows: unknown[][] = [];
-            for (let i = start; i < Math.min(total, start + 500); i++) {
-                const name = `f${String(i).padStart(5, '0')}.txt`;
-                rows.push([
-                    randomUUID(),
-                    parent.userId,
-                    parent.id,
-                    parent.uuid,
-                    name,
-                    `${dir}/${name}`,
-                    0,
-                    now,
-                    now,
-                    now,
-                    0,
-                ]);
-            }
-            await env.server.clients.db.write(
-                `INSERT INTO fsentries (uuid, user_id, parent_id, parent_uid, name, path, is_dir, modified, created, accessed, size) VALUES ${rows.map(() => '(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)').join(', ')}`,
-                rows.flat(),
-            );
-        }
-
-        const response = await signedListing(dir);
-        expect(response.status).toBe(200);
-        expect(response.headers.get('content-type')).toMatch(
-            /^application\/json/,
-        );
-        const children = (await response.json()) as Array<{
-            fsentry_name: string;
-            write_url?: string;
-        }>;
-        expect(children).toHaveLength(total);
-        expect(children[0]!.fsentry_name).toBe('f00000.txt');
-        expect(children.at(-1)!.fsentry_name).toBe('f10049.txt');
-        expect(new Set(children.map((c) => c.fsentry_name)).size).toBe(total);
-        expect(children.some((c) => c.write_url)).toBe(false);
-    }, 120_000);
-
-    it('answers a small folder in one body', async () => {
-        const dir = await makeDir('small');
-        await write(`${dir}/one.txt`, '1');
-        const response = await signedListing(dir);
-        expect(response.status).toBe(200);
-        expect(response.headers.get('content-length')).not.toBeNull();
-        const children = (await response.json()) as Array<{
-            fsentry_name: string;
-        }>;
-        expect(children.map((c) => c.fsentry_name)).toEqual(['one.txt']);
-    });
-});
@@ -153,34 +153,6 @@ describe('legacy file downloads over HTTP', () => {
        },
    );

-    it.each(routes)(
-        'GET %s answers a ranged read of an empty file with an empty 200',
-        async (route) => {
-            const file = await writeFile(
-                `empty-${route.replace(/\W/g, '')}.bin`,
-                Buffer.alloc(0),
-            );
-            const ranged = await requestFor(route, file, {
-                headers: { Range: 'bytes=0-511' },
-            });
-            expect(ranged.status).toBe(200);
-            expect(await ranged.text()).toBe('');
-        },
-    );
-
-    it('GET /read answers byte_count on an empty file with an empty 200', async () => {
-        const file = await writeFile('empty-byte-count.bin', Buffer.alloc(0));
-        for (const query of ['byte_count=512', 'offset=0']) {
-            const url = new URL(`/read?${query}`, env.apiOrigin);
-            url.searchParams.set('file', file.path);
-            const response = await fetch(url, {
-                headers: { Authorization: `Bearer ${env.users.user.token}` },
-            });
-            expect(response.status).toBe(200);
-            expect(await response.text()).toBe('');
-        }
-    });
-
    // Storage hands over one chunk and then goes quiet, as a large object
    // does while the client is still reading.
    const stallReadsOf = (objectKey: string) => {
@@ -1,160 +0,0 @@
-import type { Request, RequestHandler, Response } from 'express';
-import { v4 as uuidv4 } from 'uuid';
-import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
-import type { Actor } from '../../core/actor.js';
-import { runWithContext } from '../../core/context.js';
-import { PuterRouter } from '../../core/http/PuterRouter.js';
-import { PuterServer } from '../../server.js';
-import { setupTestServer } from '../../testUtil.js';
-import type { LegacyFSController } from './LegacyFSController.js';
-
-const PNG_2X2 =
-    'iVBORw0KGgoAAAANSUhEUgAAAAIAAAACCAYAAABytg0kAAAACXBIWXMAAAPoAAAD6AG1e1JrAAAAEUlEQVR4nGP4z8DwH4QZYAwAR8oH+WdZbrcAAAAASUVORK5CYII=';
-
-let server: PuterServer;
-let handler: RequestHandler;
-type Driver = {
-    create: (a: Record<string, unknown>) => Promise<Record<string, unknown>>;
-};
-
-beforeAll(async () => {
-    server = await setupTestServer({
-        api_base_url: 'http://api.test.local',
-        static_hosting_domain: 'site.test',
-    } as unknown as Parameters<typeof setupTestServer>[0]);
-    await server.services.appIcon.ensureIconsDirectory();
-    const controller = server.controllers
-        .legacyFs as unknown as LegacyFSController;
-    const router = new PuterRouter();
-    controller.registerRoutes(router);
-    handler = router.routes.find(
-        (r) =>
-            r.path === '/get-launch-apps' &&
-            String(r.method).toLowerCase() === 'get',
-    )!.handler as RequestHandler;
-}, 60_000);
-
-afterAll(async () => {
-    await server?.shutdown();
-});
-
-const makeActor = async (): Promise<{ actor: Actor; id: number }> => {
-    const username = `v13-${Math.random().toString(36).slice(2, 10)}`;
-    const u = await server.stores.user.create({
-        username,
-        uuid: uuidv4(),
-        password: null,
-        email: `${username}@test.local`,
-        free_storage: 100 * 1024 * 1024,
-        requires_email_confirmation: false,
-    });
-    const r = (await server.stores.user.getById(u.id))!;
-    return {
-        id: r.id,
-        actor: {
-            user: {
-                id: r.id,
-                uuid: r.uuid,
-                username: r.username,
-                email: r.email ?? null,
-                email_confirmed: true,
-            },
-        } as unknown as Actor,
-    };
-};
-
-const createViaDriver = async (actor: Actor, icon: string) =>
-    runWithContext({ actor }, () =>
-        (server.drivers.apps as unknown as Driver).create({
-            object: {
-                name: `v13-${Math.random().toString(36).slice(2, 10)}`,
-                title: 'V',
-                index_url: `https://v13-${Math.random().toString(36).slice(2, 10)}.test/`,
-                icon,
-            },
-        }),
-    );
-
-const launchApps = async (actor: Actor, appUid: string, userId: number) => {
-    await server.clients.db.write(
-        'INSERT INTO `app_opens` (`app_uid`, `user_id`, `ts`) VALUES (?, ?, ?)',
-        [appUid, userId, Math.floor(Date.now() / 1000)],
-    );
-    let body: { recent: Array<Record<string, unknown>> } | undefined;
-    const res = {
-        json: (v: unknown) => {
-            body = v as typeof body;
-            return res;
-        },
-        status: () => res,
-        setHeader: () => res,
-    } as unknown as Response;
-    await handler(
-        {
-            query: { icon_size: '64' },
-            headers: {},
-            body: {},
-            actor,
-        } as unknown as Request,
-        res,
-        () => {},
-    );
-    return body!.recent.find((e) => e.uuid === appUid)!;
-};
-
-describe('/get-launch-apps recent icon, verified', () => {
-    it('a valid data-URL icon written through the driver is migrated to a short URL', async () => {
-        const { actor, id } = await makeActor();
-        const app = await createViaDriver(
-            actor,
-            `data:image/png;base64,${PNG_2X2}`,
-        );
-        await vi.waitFor(
-            async () => {
-                const row = await server.stores.app.getByUid(app.uid as string);
-                expect(String(row?.icon).slice(0, 80)).toMatch(
-                    /^https?:\/\/.*\/app-icon\/app-/,
-                );
-            },
-            { timeout: 10_000 },
-        );
-        const entry = await launchApps(actor, app.uid as string, id);
-        expect(String(entry.icon).length).toBeLessThan(200);
-        expect(entry.iconCdnUrl).toMatch(/-64\.png$/);
-    }, 30_000);
-
-    it('returns an icon endpoint when migration cannot decode the stored icon', async () => {
-        const { actor, id } = await makeActor();
-        // PNG signature passes the write-path sniff; sharp rejects the rest.
-        const corrupt = Buffer.concat([
-            Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]),
-            Buffer.alloc(1024 * 1024, 0x41),
-        ]).toString('base64');
-        const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
-        let app: Record<string, unknown>;
-        try {
-            app = await createViaDriver(
-                actor,
-                `data:image/png;base64,${corrupt}`,
-            );
-            // Give the background pipeline time to try and fail.
-            await vi.waitFor(
-                () =>
-                    expect(
-                        warn.mock.calls.some(
-                            ([m]) => m === '[app-icon] icon processing failed',
-                        ),
-                    ).toBe(true),
-                { timeout: 10_000 },
-            );
-        } finally {
-            warn.mockRestore();
-        }
-        const row = await server.stores.app.getByUid(app!.uid as string);
-        expect(String(row?.icon).startsWith('data:image/png')).toBe(true);
-        const entry = await launchApps(actor, app!.uid as string, id);
-        expect(entry.icon).toBe(
-            `http://api.test.local/app-icon/${app!.uid}/64`,
-        );
-    }, 30_000);
-});
@@ -5293,39 +5293,4 @@ describe('LegacyFSController GET /get-launch-apps', () => {

        expect(returned).toEqual(recentUids);
    });
-
-    it('skips the recent opens for recent=0 and keeps recommended', async () => {
-        const { actor, userId } = await makeUser();
-        const app = await makeHostedApp(userId, 'unregistered-skip');
-        await recordOpen(userId, app.uid);
-
-        const call = async (query: Record<string, unknown>) => {
-            const { res, captured } = makeRes();
-            await withActor(actor, async () => {
-                await getLaunchAppsHandler()(
-                    makeReq({ actor, query }),
-                    res,
-                    () => {
-                        throw new Error('handler called next() unexpectedly');
-                    },
-                );
-            });
-            return captured.body as {
-                recommended: unknown[];
-                recent: unknown[];
-            };
-        };
-        const full = await call({});
-        expect(full.recent.length).toBeGreaterThan(0);
-
-        const opens = vi.spyOn(server.stores.app, 'getRecentAppOpens');
-        try {
-            const skipped = await call({ recent: '0' });
-            expect(skipped.recent).toEqual([]);
-            expect(skipped.recommended).toEqual(full.recommended);
-            expect(opens).not.toHaveBeenCalled();
-        } finally {
-            opens.mockRestore();
-        }
-    });
 });
@@ -26,7 +26,6 @@ import {
    assertResolvedActor,
    isAccessTokenActor,
    isAppActor,
-    isPlainUserActor,
    makeActor,
 } from '../../core/actor.js';
 import { Context } from '../../core/context.js';
@@ -96,7 +95,6 @@ import {
    assertAccess,
    assertCanCreate,
    assertCanMoveInto,
-    contextBoundStream,
    emitGuiItemEvent,
    expandClientPath,
    findOverwriteTarget,
@@ -104,7 +102,6 @@ import {
    getString,
    type GuiItemEventName,
    loadLegacyAssociatedApps,
-    rangeForEntry,
    replacedByMove,
    resolveReadRange,
    resolveV1Selector,
@@ -384,9 +381,7 @@ export class LegacyFSController extends PuterController {

                let recent: unknown[] = [];
                const userId = req.actor?.user?.id;
-                // `recent=0`: a caller that only shows `recommended`.
-                const wantsRecent = req.query.recent !== '0';
-                if (userId && wantsRecent) {
+                if (userId) {
                    const recentUids = await this.stores.app.getRecentAppOpens(
                        userId,
                        { limit: 10 },
@@ -423,9 +418,9 @@ export class LegacyFSController extends PuterController {
                        return {
                            ...toAppSummary(app, {
                                config: this.config,
-                                apiBaseUrl: this.config.api_base_url,
                                iconSize,
                            }),
+                            icon: app.icon ?? null,
                            index_url: backingGone ? null : app.index_url,
                            ...(backingGone
                                ? { privateAccess: buildHostedBackingDenial() }
@@ -806,23 +801,10 @@ export class LegacyFSController extends PuterController {
            this.stores.fsEntry,
            body.source,
        );
-        const destination = await resolveV1Selector(
+        const destinationParent = await resolveV1Selector(
            this.stores.fsEntry,
            body.destination,
        );
-        // A file destination names the copy itself, replaced only with
-        // `overwrite`.
-        let newName = getString(body, 'new_name');
-        let destinationParent = destination;
-        if (!destination.isDir && !newName && destination.parentUid) {
-            const parent = await this.stores.fsEntry.getEntryByUuid(
-                destination.parentUid,
-            );
-            if (parent) {
-                destinationParent = parent;
-                newName = destination.name;
-            }
-        }

        await assertAccess(
            this.services.acl,
@@ -847,14 +829,14 @@ export class LegacyFSController extends PuterController {
            ? await findOverwriteTarget(
                  this.stores.fsEntry,
                  destinationParent,
-                  newName ?? source.name,
+                  getString(body, 'new_name') ?? source.name,
              )
            : null;

        const copy = await this.services.fs.copy(userId, {
            source,
            destinationParent,
-            newName,
+            newName: getString(body, 'new_name'),
            overwrite: overwriteRequested,
            dedupeName: getBoolean(body, 'dedupe_name', 'change_name') ?? false,
        });
@@ -1307,10 +1289,7 @@ export class LegacyFSController extends PuterController {
            });
        }

-        const range = rangeForEntry(
-            entry,
-            resolveReadRange(req.headers.range, query),
-        );
+        const range = resolveReadRange(req.headers.range, query);
        const download = await this.services.fs.readContent(entry, {
            range,
        });
@@ -1811,50 +1790,19 @@ export class LegacyFSController extends PuterController {
        // owner, so the layout it reveals is theirs to reveal, and the child
        // signatures expire; the paths are the only part that outlives them.
        if (entry.isDir) {
-            const signChild = (child: FSEntry) => {
+            const children = await this.services.fs.listDirectory(entry.uuid);
+            const signedChildren = children.map((child) => {
                const { write_url: _, ...rest } = signEntry(child, signingCfg, {
                    ttlSeconds: NON_OWNER_SIGNATURE_TTL_SECONDS,
                });
                return { ...rest, path: maskEntryPath(child) };
-            };
-            const pages = this.services.fs.listDirectoryPages(entry.uuid);
-            const first = await pages.next();
-            const firstPage = first.done ? [] : first.value;
-            const second = await pages.next();
-            if (second.done) {
-                res.json(firstPage.map(signChild));
-                return;
-            }
-
-            // Past one page the listing streams, so a large folder isn't held
-            // in memory whole. A failure partway cuts the response off.
-            const secondPage = second.value;
-            const serialize = (child: FSEntry) =>
-                JSON.stringify(signChild(child));
-            async function* allPages() {
-                yield firstPage;
-                yield secondPage;
-                yield* pages;
-            }
-            async function* body() {
-                let separator = '[';
-                for await (const page of allPages()) {
-                    if (page.length === 0) continue;
-                    yield separator + page.map(serialize).join(',');
-                    separator = ',';
-                }
-                yield separator === '[' ? '[]' : ']';
-            }
-            res.type('application/json');
-            await pipeToResponse(contextBoundStream(body()), res);
+            });
+            res.json(signedChildren);
            return;
        }

        // File: stream bytes with Range support.
-        const range = rangeForEntry(
-            entry,
-            resolveReadRange(req.headers.range, query),
-        );
+        const range = resolveReadRange(req.headers.range, query);
        const download = await this.services.fs.readContent(entry, {
            range,
        });
@@ -2044,11 +1992,6 @@ export class LegacyFSController extends PuterController {
     */
    checkAppAcl = async (req: Request, res: Response): Promise<void> => {
        const actor = this.#requireActor(req);
-        // Sessions only: for an app, this would be a window onto its neighbours' grants.
-        if (!isPlainUserActor(actor))
-            throw new HttpError(403, 'actor must be a user', {
-                legacyCode: 'forbidden',
-            });
        const body = asRecord(req.body);

        const subjectRef = body.subject;
@@ -2079,7 +2022,7 @@ export class LegacyFSController extends PuterController {
                legacyCode: 'subject_does_not_exist',
            });

-        let app: { uid: string; id: number } | null = null;
+        let app: { uid: string } | null = null;
        if (typeof appRef === 'string') {
            app =
                (await this.stores.app.getByUid(appRef)) ??
@@ -2093,7 +2036,7 @@ export class LegacyFSController extends PuterController {
        // Build an actor-under-user shape for the check.
        const actorForApp = makeActor({
            user: actor.user,
-            app: { uid: app.uid, id: app.id },
+            app: { uid: (app as { uid: string }).uid },
        });
        const allowed = await acl.check(actorForApp, descriptor, mode);
        res.json({ allowed });
@@ -2141,12 +2084,10 @@ export class LegacyFSController extends PuterController {
        // by default, so opt in by naming the downloader as who pays.
        req.egressActor = actor;

-        const range = rangeForEntry(
-            entry,
+        const range =
            typeof req.headers.range === 'string'
                ? req.headers.range
-                : undefined,
-        );
+                : undefined;
        const download = await this.services.fs.readContent(entry, {
            range,
        });
@@ -17,19 +17,15 @@
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */

-import { Writable } from 'node:stream';
 import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
-import { Context, runWithContext } from '../../core/context.js';
 import type { PuterServer } from '../../server.js';
 import { createTestUser, setupTestServer } from '../../testUtil.js';
 import {
    asRecord,
-    contextBoundStream,
    fsEntryMimeType,
    getBoolean,
    getString,
    loadLegacyAssociatedApps,
-    rangeForEntry,
    resolveReadRange,
    signEntry,
    signEntryThumbnail,
@@ -709,50 +705,3 @@ describe('resolveReadRange', () => {
        ).toThrow('Invalid byte_count');
    });
 });
-
-describe('rangeForEntry', () => {
-    it('drops the range for an empty file only', () => {
-        const entry = (size: number) => ({ size }) as FSEntry;
-        expect(rangeForEntry(entry(0), 'bytes=0-511')).toBeUndefined();
-        expect(rangeForEntry(entry(10), 'bytes=0-4')).toBe('bytes=0-4');
-    });
-});
-
-describe('contextBoundStream', () => {
-    it("reads every chunk in the caller's context", async () => {
-        // A sink slower than the source that completes writes from outside
-        // any request, so later chunks are asked for from its drain.
-        const pending: Array<() => void> = [];
-        const flush = runWithContext({}, () =>
-            setInterval(() => pending.splice(0).forEach((done) => done()), 5),
-        );
-        const sink = new Writable({
-            highWaterMark: 1,
-            write(_chunk, _encoding, done) {
-                pending.push(done);
-            },
-        });
-        const seen: unknown[] = [];
-        try {
-            await runWithContext({ actor: 'caller' as never }, async () => {
-                async function* chunks() {
-                    for (let i = 0; i < 40; i++) {
-                        await new Promise((resolve) => setTimeout(resolve, 1));
-                        seen.push(Context.get('actor'));
-                        yield 'x';
-                    }
-                }
-                await new Promise((resolve, reject) => {
-                    contextBoundStream(chunks())
-                        .pipe(sink)
-                        .on('finish', resolve)
-                        .on('error', reject);
-                });
-            });
-        } finally {
-            clearInterval(flush);
-        }
-        expect(seen).toHaveLength(40);
-        expect(seen.every((actor) => actor === 'caller')).toBe(true);
-    });
-});
@@ -17,9 +17,7 @@
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */

-import { AsyncResource } from 'node:async_hooks';
 import { posix as pathPosix } from 'node:path';
-import { Readable } from 'node:stream';
 import { contentType as contentTypeFromMime } from 'mime-types';
 import type { FSEntry } from '../../stores/fs/FSEntry.js';
 import type { FSEntryStore } from '../../stores/fs/FSEntryStore.js';
@@ -152,29 +150,6 @@ export function resolveReadRange(
    return undefined;
 }

-/**
- * A response body read from `chunks` for `pipeToResponse`. Each chunk is pulled
- * in the caller's async context, which share masking reads, not in whichever
- * socket event asked for more.
- */
-export function contextBoundStream(
-    chunks: AsyncGenerator<string, void, undefined>,
-): Readable {
-    const next = AsyncResource.bind(() => chunks.next());
-    const stop = AsyncResource.bind(() => chunks.return(undefined));
-    return Readable.from({
-        [Symbol.asyncIterator]: () => ({ next, return: stop }),
-    });
-}
-
-/** No range is satisfiable on an empty file, so it reads whole: empty, 200. */
-export function rangeForEntry(
-    entry: FSEntry,
-    range: string | undefined,
-): string | undefined {
-    return entry.size === 0 ? undefined : range;
-}
-
 // Accepts either `{ path }` or `{ uid }` or `{ id }` or `{ parent, name }`
 // from a legacy body field. Returns a resolved entry (throwing 404 if not
 // found or 400 if no usable ref is present).
@@ -17,9 +17,6 @@
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */

-import { mkdir, mkdtemp, writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import path from 'node:path';
 import type { Request, RequestHandler, Response } from 'express';
 import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
 import { v4 as uuidv4 } from 'uuid';
@@ -469,63 +466,3 @@ describe('HomepageController GET /show/*splat', () => {
        expect(html).toContain('/alice/Documents');
    });
 });
-
-// ── /sw.js ──────────────────────────────────────────────────────────
-
-describe('HomepageController GET /sw.js', () => {
-    const headersOf = (res: Response): Record<string, string> =>
-        Object.fromEntries(
-            (res.set as ReturnType<typeof vi.fn>).mock.calls.map(
-                ([key, value]) => [String(key).toLowerCase(), String(value)],
-            ),
-        );
-
-    it('serves the worker with root scope, as JavaScript, revalidated each time', async () => {
-        const root = await mkdtemp(path.join(tmpdir(), 'puter-sw-route-'));
-        await mkdir(path.join(root, 'dist'));
-        await writeFile(path.join(root, 'dist', 'sw.js'), '// worker\n');
-        const config = server.services.homepage.config as {
-            gui_assets_root?: string;
-            env?: string;
-        };
-        const prev = { root: config.gui_assets_root, env: config.env };
-        config.gui_assets_root = root;
-        config.env = 'prod';
-        const { res, captured } = makeRes();
-        try {
-            await callRoute('get', '/sw.js', makeReq({ path: '/sw.js' }), res);
-        } finally {
-            config.gui_assets_root = prev.root;
-            config.env = prev.env;
-        }
-        expect(captured.statusCode).toBe(200);
-        expect(captured.body).toBe('// worker\n');
-        expect(headersOf(res)).toMatchObject({
-            'content-type': 'text/javascript; charset=utf-8',
-            'cache-control': 'no-cache',
-            'service-worker-allowed': '/',
-        });
-    });
-
-    it('is a 404 when there is no worker to serve', async () => {
-        const config = server.services.homepage.config as {
-            gui_assets_root?: string;
-        };
-        const prev = config.gui_assets_root;
-        config.gui_assets_root = path.join(tmpdir(), 'no-such-gui-root');
-        const { res, captured } = makeRes();
-        try {
-            await callRoute('get', '/sw.js', makeReq({ path: '/sw.js' }), res);
-        } finally {
-            config.gui_assets_root = prev;
-        }
-        expect(captured.statusCode).toBe(404);
-    });
-
-    it('is registered for the root subdomain only', () => {
-        const route = router.routes.find(
-            (r) => r.method === 'get' && r.path === '/sw.js',
-        );
-        expect(route?.options.subdomain).toBe('');
-    });
-});
@@ -198,20 +198,6 @@ export class HomepageController extends PuterController {
            return sendShell(req, res, {}, launch);
        });

-        // -- /sw.js - the service worker, scoped to the whole origin --
-
-        router.get('/sw.js', { subdomain: '' }, async (_req, res) => {
-            const source = await homepage.serviceWorkerSource();
-            if (source === null) {
-                res.status(404).send('Not found');
-                return;
-            }
-            res.set('Content-Type', 'text/javascript; charset=utf-8');
-            res.set('Cache-Control', 'no-cache');
-            res.set('Service-Worker-Allowed', '/');
-            res.send(source);
-        });
-
        // -- Fallback static mount -----------------------------------
        // Serves lingering GUI assets (images, fonts, lib files, etc.)
        // out of <gui_assets_root>/src. Falls through to the 404 handler
@@ -198,7 +198,7 @@ describe('HostingController /delete-site', () => {
            );
            expect(emitSpy).toHaveBeenCalledWith(
                'subdomain.delete',
-                { subdomain: site.subdomain, uid: String(site.uuid), userId },
+                { subdomain: site.subdomain, uid: String(site.uuid) },
                {},
            );
        } finally {
@@ -34,16 +34,7 @@ import {
    type TestUserCredentials,
 } from '../../testUtil.js';
 import type { IConfig } from '../../types.js';
-import { claimRateLimit } from '../../core/http/middleware/rateLimit.js';
-import { seedKvShareHandles } from '../../services/kvShare/kvShareTestUtil.js';
-import { KV_GLOBAL_APP_KEY } from '../../stores/systemKv/SystemKVStore.js';
-import {
-    EVENTS_KV_HANDLE_LIMIT,
-    EVENTS_KV_HANDLES_PER_USER,
-    KV_SHARE_BATCH_MAX,
-    KV_SHARE_GRANT_LIMITS,
-    KV_SHARE_LOOKUP_LIMIT,
-} from '../events/limits.js';
+import { EVENTS_KV_HANDLE_LIMIT } from '../events/limits.js';

 const BOOT_TIMEOUT_MS = 120_000;

@@ -66,12 +57,9 @@ const call = (
 const resetBudgets = async (env: PuterTestEnv) => {
    for (const name of [env.users.user.username, env.users.other.username]) {
        const user = await env.server.stores.user.getByUsername(name);
-        for (const scope of [
-            EVENTS_KV_HANDLE_LIMIT.scope,
-            KV_SHARE_LOOKUP_LIMIT.scope,
-            ...KV_SHARE_GRANT_LIMITS.map((window) => window.scope),
-        ])
-            await env.server.clients.redis.del(`rate:${scope}:${user!.id}`);
+        await env.server.clients.redis.del(
+            `rate:${EVENTS_KV_HANDLE_LIMIT.scope}:${user!.id}`,
+        );
    }
 };

@@ -125,7 +113,6 @@ describe('/kv/shares', () => {
                'handle',
                'holder',
                'label',
-                'notify',
                'prefix',
            ].sort(),
        );
@@ -134,42 +121,6 @@ describe('/kv/shares', () => {
            appUid: null,
            holder: env.users.other.username,
            label: 'Groceries',
-            notify: false,
-        });
-    });
-
-    it('takes notify, keeps it on a re-share that leaves it out, and shows it to both sides', async () => {
-        const prefix = `notify-${uuidv4().slice(0, 8)}:`;
-        const on = await shareWithOther({ prefix, notify: true });
-        expect(on).toMatchObject({ prefix, notify: true });
-
-        const kept = await shareWithOther({ prefix, access: 'write' });
-        expect(kept).toMatchObject({ handle: on.handle, notify: true });
-
-        const listed = async (path: string, token: string) =>
-            (
-                (await (await req('GET', path, token)).json()) as {
-                    items: Array<Record<string, unknown>>;
-                }
-            ).items.find((row) => row.handle === on.handle);
-        expect(
-            await listed('/kv/shares?limit=200', env.users.user.token),
-        ).toMatchObject({ notify: true });
-        expect(
-            await listed('/kv/shares/with-me?limit=200', env.users.other.token),
-        ).toMatchObject({ notify: true });
-
-        const off = await shareWithOther({ prefix, notify: false });
-        expect(off).toMatchObject({ handle: on.handle, notify: false });
-
-        const refused = await req('POST', '/kv/shares', env.users.user.token, {
-            prefix,
-            recipient: env.users.other.username,
-            notify: 'yes',
-        });
-        expect(refused.status).toBe(400);
-        await expect(refused.json()).resolves.toMatchObject({
-            code: 'kv_share_notify_invalid',
        });
    });

@@ -208,7 +159,6 @@ describe('/kv/shares', () => {
            appUid: null,
            holder: env.users.other.username,
            label: 'Trip',
-            notify: false,
            createdAt: shared.createdAt,
            revokedAt: null,
            revokedBy: null,
@@ -230,7 +180,6 @@ describe('/kv/shares', () => {
            access: 'write',
            appUid: null,
            label: 'Trip',
-            notify: false,
            createdAt: shared.createdAt,
        });
        expect(withMeText).not.toContain(env.users.user.username);
@@ -344,481 +293,6 @@ describe('/kv/shares', () => {
        const res = await req('GET', '/kv/shares');
        expect(res.status).toBeGreaterThanOrEqual(400);
    });
-
-    describe('filtering a listing', () => {
-        type Page = { items: Array<Record<string, unknown>>; total?: number };
-        let appUid: string;
-        let inApp: Record<string, unknown>;
-        let global: Record<string, unknown>;
-
-        const page = async (path: string, token: string) => {
-            const res = await req('GET', path, token);
-            return { status: res.status, body: (await res.json()) as Page };
-        };
-        const handlesOf = (body: Page) => body.items.map((row) => row.handle);
-
-        const makeApp = async () => {
-            const owner = await env.server.stores.user.getByUsername(
-                env.users.user.username,
-            );
-            const name = `kv-http-${uuidv4().slice(0, 8)}`;
-            return env.server.stores.app.create(
-                {
-                    name,
-                    title: 'Listing App',
-                    index_url: `https://${name}.example.test/index.html`,
-                },
-                { ownerUserId: owner!.id },
-            );
-        };
-
-        /** The token the desktop launches the app with, for `token`'s user. */
-        const appToken = async (token: string, uid: string) => {
-            const res = await req('POST', '/auth/get-user-app-token', token, {
-                app_uid: uid,
-            });
-            expect(res.status).toBe(200);
-            return ((await res.json()) as { token: string }).token;
-        };
-
-        beforeAll(async () => {
-            await resetBudgets(env);
-            appUid = (await makeApp()).uid;
-            inApp = await shareWithOther({ appUid });
-            global = await shareWithOther();
-        });
-
-        it('lists every app`s shares for the account, or one app`s, or the app-less store`s with `null`', async () => {
-            for (const path of ['/kv/shares', '/kv/shares/with-me']) {
-                const token =
-                    path === '/kv/shares'
-                        ? env.users.user.token
-                        : env.users.other.token;
-                const all = await page(`${path}?limit=200`, token);
-                expect(handlesOf(all.body)).toEqual(
-                    expect.arrayContaining([inApp.handle, global.handle]),
-                );
-
-                const one = await page(
-                    `${path}?limit=200&appUid=${appUid}`,
-                    token,
-                );
-                expect(handlesOf(one.body)).toEqual([inApp.handle]);
-
-                const appLess = await page(
-                    `${path}?limit=200&appUid=null`,
-                    token,
-                );
-                expect(handlesOf(appLess.body)).toContain(global.handle);
-                expect(
-                    appLess.body.items.every((row) => row.appUid === null),
-                ).toBe(true);
-
-                const bad = await page(`${path}?appUid=not-an-app`, token);
-                expect(bad.status).toBe(400);
-            }
-        });
-
-        it('keeps an app to its own namespace, refusing any other it names', async () => {
-            const token = await appToken(env.users.other.token, appUid);
-            const own = await page('/kv/shares/with-me?limit=200', token);
-            expect(handlesOf(own.body)).toEqual([inApp.handle]);
-            const named = await page(
-                `/kv/shares/with-me?limit=200&appUid=${appUid}`,
-                token,
-            );
-            expect(handlesOf(named.body)).toEqual([inApp.handle]);
-
-            const otherApp = (await makeApp()).uid;
-            for (const appUidParam of ['null', otherApp]) {
-                const refused = await page(
-                    `/kv/shares/with-me?appUid=${appUidParam}`,
-                    token,
-                );
-                expect(refused.status).toBe(403);
-                expect(refused.body).toMatchObject({
-                    code: 'events_kv_handle_outside_namespace',
-                });
-            }
-        });
-
-        it('narrows what was shared out to live or revoked shares, all by default', async () => {
-            const gone = await shareWithOther({ appUid });
-            await req(
-                'DELETE',
-                `/kv/shares/${gone.handle}`,
-                env.users.user.token,
-            );
-            const at = async (state?: string) =>
-                page(
-                    `/kv/shares?limit=200&appUid=${appUid}` +
-                        (state ? `&state=${state}` : ''),
-                    env.users.user.token,
-                );
-
-            expect(handlesOf((await at()).body)).toEqual([
-                inApp.handle,
-                gone.handle,
-            ]);
-            expect(handlesOf((await at('all')).body)).toEqual([
-                inApp.handle,
-                gone.handle,
-            ]);
-            expect(handlesOf((await at('live')).body)).toEqual([inApp.handle]);
-            expect(handlesOf((await at('revoked')).body)).toEqual([
-                gone.handle,
-            ]);
-            const bad = await at('stopped');
-            expect(bad.status).toBe(400);
-        });
-    });
-
-    describe('with several recipients', () => {
-        let third: { username: string; uuid: string; id: number };
-        // Holds seeded rows, so no recipient's per-holder cap is what trips.
-        let filler: number;
-        let ownerId: number;
-
-        beforeAll(async () => {
-            const username = `kv-batch-${uuidv4().slice(0, 8)}`;
-            await createTestUser(env.server, {
-                username,
-                password: 'pw-test-1234',
-            });
-            const row = await env.server.stores.user.getByUsername(username);
-            third = { username, uuid: row!.uuid as string, id: row!.id! };
-            ownerId = (await env.server.stores.user.getByUsername(
-                env.users.user.username,
-            ))!.id!;
-            const fillerName = `kv-filler-${uuidv4().slice(0, 8)}`;
-            await createTestUser(env.server, {
-                username: fillerName,
-                password: 'pw-test-1234',
-            });
-            filler = (await env.server.stores.user.getByUsername(fillerName))!
-                .id!;
-        });
-
-        const shareMany = (body: Record<string, unknown>) =>
-            req('POST', '/kv/shares', env.users.user.token, {
-                prefix: `batch-${uuidv4().slice(0, 8)}:`,
-                ...body,
-            });
-
-        it('reports each recipient on its own item, in order', async () => {
-            const res = await shareMany({
-                recipients: [
-                    env.users.other.username,
-                    'nobody-by-this-name',
-                    env.users.user.username,
-                    '[email protected]',
-                    { uid: third.uuid },
-                ],
-                access: 'write',
-                label: 'Team list',
-            });
-            expect(res.status).toBe(200);
-            const { items } = (await res.json()) as {
-                items: Record<string, unknown>[];
-            };
-            expect(items).toHaveLength(5);
-            expect(items[0]).toMatchObject({
-                recipient: env.users.other.username,
-                handle: expect.any(String),
-                access: 'write',
-                holder: env.users.other.username,
-                label: 'Team list',
-                appUid: null,
-            });
-            expect(items[1]).toEqual({
-                recipient: 'nobody-by-this-name',
-                error: {
-                    message: expect.any(String),
-                    code: 'subject_does_not_exist',
-                },
-            });
-            expect(items[2]).toMatchObject({
-                error: { code: 'bad_request' },
-            });
-            expect(items[3]).toMatchObject({
-                error: { code: 'invalid_recipient' },
-            });
-            expect(items[4]).toMatchObject({
-                recipient: { uid: third.uuid },
-                holder: third.username,
-            });
-            expect(items[4].handle).not.toBe(items[0].handle);
-        });
-
-        it('answers a recipient named twice with the one share', async () => {
-            const res = await shareMany({
-                recipients: [third.username, { uid: third.uuid }],
-            });
-            const { items } = (await res.json()) as {
-                items: Record<string, unknown>[];
-            };
-            expect(items[0].handle).toEqual(expect.any(String));
-            expect(items[1].handle).toBe(items[0].handle);
-        });
-
-        it('refuses a malformed batch outright', async () => {
-            for (const body of [
-                { recipients: [] },
-                { recipients: 'alice' },
-                {
-                    recipients: Array.from(
-                        { length: KV_SHARE_BATCH_MAX + 1 },
-                        (_, i) => `user-${i}`,
-                    ),
-                },
-                {
-                    recipient: env.users.other.username,
-                    recipients: [env.users.other.username],
-                },
-            ]) {
-                const res = await shareMany(body);
-                expect(res.status).toBe(400);
-                await expect(res.json()).resolves.toMatchObject({
-                    code: 'bad_request',
-                });
-            }
-        });
-
-        it('refuses the whole batch when it would pass the account cap', async () => {
-            const prefix = `batch-cap-${uuidv4().slice(0, 8)}:`;
-            const existing = await shareMany({
-                prefix,
-                recipients: [env.users.other.username],
-            });
-            const [standing] = (
-                (await existing.json()) as { items: { handle: string }[] }
-            ).items;
-            try {
-                const { total } =
-                    await env.server.stores.kvShareHandle.countLiveForOwner(
-                        ownerId,
-                    );
-                // One slot left.
-                await seedKvShareHandles(env.server, {
-                    ownerUserId: ownerId,
-                    ownerUuid,
-                    granteeUserId: filler,
-                    count: EVENTS_KV_HANDLES_PER_USER.limit - total - 1,
-                    appUid: () => KV_GLOBAL_APP_KEY,
-                });
-
-                const refused = await shareMany({
-                    prefix: `batch-over-${uuidv4().slice(0, 8)}:`,
-                    recipients: [env.users.other.username, third.username],
-                });
-                expect(refused.status).toBe(409);
-                await expect(refused.json()).resolves.toMatchObject({
-                    code: 'events_kv_handle_limit_reached',
-                });
-                expect(
-                    (
-                        await env.server.stores.kvShareHandle.countLiveForOwner(
-                            ownerId,
-                        )
-                    ).total,
-                ).toBe(EVENTS_KV_HANDLES_PER_USER.limit - 1);
-
-                // The standing share takes no slot, so one new one still fits.
-                const fits = await shareMany({
-                    prefix,
-                    recipients: [env.users.other.username, third.username],
-                });
-                expect(fits.status).toBe(200);
-                const { items } = (await fits.json()) as {
-                    items: Record<string, unknown>[];
-                };
-                expect(items[0].handle).toBe(standing.handle);
-                expect(items[1]).toMatchObject({ holder: third.username });
-            } finally {
-                await env.server.clients.db.write(
-                    'DELETE FROM `kv_share_handles` WHERE `owner_user_id` = ?',
-                    [ownerId],
-                );
-            }
-        });
-
-        it('spends the grant budget per recipient, all or nothing', async () => {
-            const [minute] = KV_SHARE_GRANT_LIMITS;
-            await claimRateLimit(
-                `${minute.scope}:${ownerId}`,
-                minute.limit,
-                minute.window,
-                minute.limit - 1,
-            );
-            try {
-                const refused = await shareMany({
-                    recipients: [env.users.other.username, third.username],
-                });
-                expect(refused.status).toBe(429);
-                await expect(refused.json()).resolves.toMatchObject({
-                    code: 'too_many_requests',
-                });
-            } finally {
-                await resetBudgets(env);
-            }
-        });
-    });
-
-    describe('sharing again', () => {
-        let ownerId: number;
-        let third: string;
-
-        beforeAll(async () => {
-            third = `kv-again-${uuidv4().slice(0, 8)}`;
-            await createTestUser(env.server, {
-                username: third,
-                password: 'pw-test-1234',
-            });
-            ownerId = (await env.server.stores.user.getByUsername(
-                env.users.user.username,
-            ))!.id!;
-        });
-
-        const shareAt = (prefix: string, body: Record<string, unknown>) =>
-            req('POST', '/kv/shares', env.users.user.token, {
-                prefix,
-                ...body,
-            });
-
-        /** Leaves `left` units in one of the owner's windows. */
-        const drain = (
-            window: { scope: string; limit: number; window: number },
-            left = 0,
-        ) =>
-            claimRateLimit(
-                `${window.scope}:${ownerId}`,
-                window.limit,
-                window.window,
-                window.limit - left,
-            );
-
-        it('spends neither the mint nor the grant budget when every share stays as it is', async () => {
-            const prefix = `again-${uuidv4().slice(0, 8)}:`;
-            const recipients = [env.users.other.username, third];
-            const made = (await (
-                await shareAt(prefix, { recipients, label: 'Room' })
-            ).json()) as { items: Array<{ handle: string }> };
-            await drain(EVENTS_KV_HANDLE_LIMIT);
-            for (const window of KV_SHARE_GRANT_LIMITS) await drain(window);
-            try {
-                const again = await shareAt(prefix, {
-                    recipients: [...recipients, third],
-                });
-                expect(again.status).toBe(200);
-                const { items } = (await again.json()) as {
-                    items: Array<{ handle: string; label: string }>;
-                };
-                expect(items.map((item) => item.handle)).toEqual([
-                    made.items[0].handle,
-                    made.items[1].handle,
-                    made.items[1].handle,
-                ]);
-                expect(items[0].label).toBe('Room');
-
-                const single = await shareAt(prefix, {
-                    recipient: env.users.other.username,
-                    access: 'read',
-                });
-                expect(single.status).toBe(200);
-            } finally {
-                await resetBudgets(env);
-            }
-        });
-
-        it('spends the mint budget on a change, and grant units only on recipients without the share', async () => {
-            const prefix = `again-${uuidv4().slice(0, 8)}:`;
-            const other = env.users.other.username;
-            expect((await shareAt(prefix, { recipient: other })).status).toBe(
-                200,
-            );
-            for (const window of KV_SHARE_GRANT_LIMITS) await drain(window);
-            try {
-                // A level change on a standing share takes no grant unit.
-                const raised = await shareAt(prefix, {
-                    recipients: [other],
-                    access: 'write',
-                });
-                expect(raised.status).toBe(200);
-
-                // Naming an unknown user next to it costs what a new share
-                // would, so the window refuses both.
-                for (const extra of ['nobody-by-this-name', third]) {
-                    const refused = await shareAt(prefix, {
-                        recipients: [other, extra],
-                        access: 'write',
-                    });
-                    expect(refused.status).toBe(429);
-                }
-            } finally {
-                await resetBudgets(env);
-            }
-
-            await drain(EVENTS_KV_HANDLE_LIMIT);
-            try {
-                const lowered = await shareAt(prefix, {
-                    recipient: other,
-                    access: 'read',
-                });
-                expect(lowered.status).toBe(429);
-                await expect(lowered.json()).resolves.toMatchObject({
-                    code: 'too_many_requests',
-                });
-            } finally {
-                await resetBudgets(env);
-            }
-        });
-
-        it('counts turning notify on or off as a change', async () => {
-            const prefix = `again-${uuidv4().slice(0, 8)}:`;
-            const other = env.users.other.username;
-            expect((await shareAt(prefix, { recipient: other })).status).toBe(
-                200,
-            );
-            await drain(EVENTS_KV_HANDLE_LIMIT);
-            try {
-                expect(
-                    (await shareAt(prefix, { recipient: other })).status,
-                ).toBe(200);
-                expect(
-                    (
-                        await shareAt(prefix, {
-                            recipient: other,
-                            notify: true,
-                        })
-                    ).status,
-                ).toBe(429);
-            } finally {
-                await resetBudgets(env);
-            }
-        });
-
-        it('spends the lookup budget on every recipient named', async () => {
-            const prefix = `again-${uuidv4().slice(0, 8)}:`;
-            const other = env.users.other.username;
-            expect((await shareAt(prefix, { recipient: other })).status).toBe(
-                200,
-            );
-            await resetBudgets(env);
-            await drain(KV_SHARE_LOOKUP_LIMIT, 1);
-            try {
-                expect(
-                    (await shareAt(prefix, { recipient: other })).status,
-                ).toBe(200);
-                const refused = await shareAt(prefix, { recipient: other });
-                expect(refused.status).toBe(429);
-                await expect(refused.json()).resolves.toMatchObject({
-                    code: 'too_many_requests',
-                });
-            } finally {
-                await resetBudgets(env);
-            }
-        });
-    });
 });

 describe('/events/kv-handles beside /kv/shares', () => {
@@ -22,100 +22,27 @@ import type { Actor } from '../../core/actor.js';
 import { Controller, Delete, Get, Post } from '../../core/http/decorators.js';
 import { HttpError } from '../../core/http/HttpError.js';
 import { bodyRecord } from '../../core/http/requestBody.js';
-import {
-    assertShareableAppUid,
-    parseKvShareRecipient,
-} from '../../services/kvShare/kvShares.js';
-import type {
-    KvShareHandleListOptions,
-    KvShareOwnerListOptions,
-    KvShareOwnerListState,
-} from '../../stores/events/KvShareHandleStore.js';
-import {
-    KV_HANDLE_LIST_LIMIT_CAP,
-    KV_SHARE_OWNER_LIST_STATES,
-} from '../../stores/events/KvShareHandleStore.js';
+import { parseKvShareRecipient } from '../../services/kvShare/kvShares.js';
+import type { KvShareHandleListOptions } from '../../stores/events/KvShareHandleStore.js';
+import { KV_HANDLE_LIST_LIMIT_CAP } from '../../stores/events/KvShareHandleStore.js';
 import { KV_GLOBAL_APP_KEY } from '../../stores/systemKv/SystemKVStore.js';
 import { normalizeLimit } from '../../util/pagination.js';
-import type { KvShareView } from '../../services/kvShare/KvShareService.js';
-import { EVENTS_LIST_LIMIT, KV_SHARE_BATCH_MAX } from '../events/limits.js';
+import { EVENTS_LIST_LIMIT } from '../events/limits.js';
 import { PuterController } from '../types.js';

 /** The app-less namespace is no app, so the wire says `null` for it. */
 const publicAppUid = (appUid: string): string | null =>
    appUid === KV_GLOBAL_APP_KEY ? null : appUid;

-/**
- * The namespace a listing's `appUid` names, in the form responses use: an app
- * uid, or `null` for the app-less namespace.
- */
-const listAppUid = (value: unknown): string | undefined => {
-    if (value === undefined || value === '') return undefined;
-    if (typeof value !== 'string')
-        throw new HttpError(400, '`appUid` must be a string', {
-            legacyCode: 'bad_request',
-        });
-    return value === 'null' ? KV_GLOBAL_APP_KEY : assertShareableAppUid(value);
-};
-
-const badRequest = (message: string): HttpError =>
-    new HttpError(400, message, { legacyCode: 'bad_request' });
-
-/** A share as `POST /kv/shares` reports it. */
-const shareBody = (share: KvShareView) => ({
-    handle: share.handle,
-    prefix: share.prefix,
-    access: share.access,
-    appUid: publicAppUid(share.appUid),
-    holder: share.holderUsername,
-    label: share.label,
-    notify: share.notify,
-    createdAt: share.createdAt,
-});
-
-/** `recipients` when the body names it: 1 to `KV_SHARE_BATCH_MAX` entries. */
-const batchRecipients = (
-    body: Record<string, unknown>,
-): unknown[] | undefined => {
-    const { recipient, recipients } = body;
-    if (recipients === undefined) return undefined;
-    if (recipient !== undefined)
-        throw badRequest('Send either `recipient` or `recipients`, not both');
-    if (
-        !Array.isArray(recipients) ||
-        recipients.length === 0 ||
-        recipients.length > KV_SHARE_BATCH_MAX
-    )
-        throw badRequest(
-            `\`recipients\` must be an array of 1 to ${KV_SHARE_BATCH_MAX} recipients`,
-        );
-    return recipients;
-};
-
-const listState = (value: unknown): KvShareOwnerListState | undefined => {
-    if (value === undefined || value === '') return undefined;
-    if (!(KV_SHARE_OWNER_LIST_STATES as readonly unknown[]).includes(value))
-        throw new HttpError(400, '`state` must be `live`, `revoked` or `all`', {
-            legacyCode: 'bad_request',
-        });
-    return value as KvShareOwnerListState;
-};
-
 const pageOptions = (req: Request): KvShareHandleListOptions => {
    const query = (req.query ?? {}) as Record<string, unknown>;
    return {
        limit: normalizeLimit(query.limit, { cap: KV_HANDLE_LIST_LIMIT_CAP }),
        cursor: typeof query.cursor === 'string' ? query.cursor : undefined,
        includeTotal: query.includeTotal === 'true',
-        appUid: listAppUid(query.appUid),
    };
 };

-const ownerPageOptions = (req: Request): KvShareOwnerListOptions => ({
-    ...pageOptions(req),
-    state: listState((req.query ?? {}).state),
-});
-
 /**
 * Sharing a region of one account's key-value data with another account.
 *
@@ -129,8 +56,7 @@ export class KvShareController extends PuterController {
    /**
     * POST /kv/shares — share a region with another account, `read` unless the
     * body asks otherwise. Sharing the same region with the same account again
-     * changes its level, label or `notify` flag in place. `recipients` shares
-     * it with several at once and reports each one on its own item.
+     * changes its level or label in place.
     */
    @Post('/shares', {
        subdomain: 'api',
@@ -141,53 +67,29 @@ export class KvShareController extends PuterController {
    async share(req: Request, res: Response): Promise<void> {
        const actor = this.#requireActor(req);
        const body = bodyRecord(req);
-        const fields = {
-            prefix: body.prefix,
-            access: body.access,
-            appUid: body.appUid,
-            label: body.label,
-            notify: body.notify,
-        };
-        const recipients = batchRecipients(body);
-        if (recipients) {
-            const items = await this.services.kvShare.mintKvHandles(
-                actor,
-                { ...fields, recipients },
-                { defaultAccess: 'read' },
-            );
-            res.json({
-                items: items.map((item) =>
-                    item.share
-                        ? {
-                              recipient: item.recipient,
-                              ...shareBody(item.share),
-                          }
-                        : {
-                              recipient: item.recipient,
-                              error: {
-                                  message: item.error?.message ?? 'Not shared',
-                                  code:
-                                      item.error?.legacyCode ??
-                                      item.error?.code ??
-                                      'internal_error',
-                              },
-                          },
-                ),
-            });
-            return;
-        }
        const share = await this.services.kvShare.mintKvHandle(
            actor,
-            { ...fields, recipient: parseKvShareRecipient(body.recipient) },
+            {
+                prefix: body.prefix,
+                recipient: parseKvShareRecipient(body.recipient),
+                access: body.access,
+                appUid: body.appUid,
+                label: body.label,
+            },
            { defaultAccess: 'read' },
        );
-        res.json(shareBody(share));
+        res.json({
+            handle: share.handle,
+            prefix: share.prefix,
+            access: share.access,
+            appUid: publicAppUid(share.appUid),
+            holder: share.holderUsername,
+            label: share.label,
+            createdAt: share.createdAt,
+        });
    }

-    /**
-     * GET /kv/shares — what this account has shared out, retired included
-     * unless `state` narrows it.
-     */
+    /** GET /kv/shares — what this account has shared out, retired included. */
    @Get('/shares', {
        subdomain: 'api',
        requireAuth: true,
@@ -198,7 +100,7 @@ export class KvShareController extends PuterController {
        const actor = this.#requireActor(req);
        const page = await this.services.kvShare.listKvHandles(
            actor,
-            ownerPageOptions(req),
+            pageOptions(req),
        );
        res.json({
            items: page.items.map((row) => ({
@@ -208,7 +110,6 @@ export class KvShareController extends PuterController {
                appUid: publicAppUid(row.appUid),
                holder: row.holderUsername,
                label: row.label,
-                notify: row.notify,
                createdAt: row.createdAt,
                revokedAt: row.revokedAt,
                revokedBy: row.revokedBy,
@@ -237,7 +138,6 @@ export class KvShareController extends PuterController {
                access: row.access,
                appUid: publicAppUid(row.appUid),
                label: row.label,
-                notify: row.notify,
                createdAt: row.createdAt,
            })),
            ...(page.cursor ? { cursor: page.cursor } : {}),
@@ -21,9 +21,9 @@ import { afterAll, beforeAll, describe, expect, it } from 'vitest';
 import { setupPuterTestEnv, type PuterTestEnv } from '../../testUtil.js';

 /**
- * Route-level coverage for the notification endpoints the desktop calls over
- * HTTP, so this suite is what catches a route going missing or a gate turning
- * a legitimate dismiss or removal away.
+ * Route-level coverage for the notification endpoint. Dismissing is the only
+ * mark the desktop performs over HTTP, so this suite is what catches the route
+ * going missing or a gate turning a legitimate dismiss away.
 */
 describe('notification endpoints over HTTP', () => {
    let env: PuterTestEnv;
@@ -85,34 +85,4 @@ describe('notification endpoints over HTTP', () => {
        });
        expect(after?.acknowledged).toBeFalsy();
    });
-
-    it('removes a notification', async () => {
-        const owner = env.users.user;
-        const { userId, uid } = await seedNotification(owner.username);
-
-        const res = await post('/notif/delete', owner.token, { uid });
-
-        expect(res.status).toBe(200);
-        await expect(res.json()).resolves.toEqual({});
-        const after = await env.server.stores.notification.getByUid(uid, {
-            userId,
-        });
-        expect(after).toBeNull();
-    });
-
-    it('refuses an anonymous removal', async () => {
-        const { userId, uid } = await seedNotification(env.users.other.username);
-
-        const res = await fetch(new URL('/notif/delete', env.apiOrigin), {
-            method: 'POST',
-            headers: { 'content-type': 'application/json' },
-            body: JSON.stringify({ uid }),
-        });
-
-        expect(res.status).toBeGreaterThanOrEqual(400);
-        const after = await env.server.stores.notification.getByUid(uid, {
-            userId,
-        });
-        expect(after?.uid).toBe(uid);
-    });
 });
@@ -183,74 +183,3 @@ describe('NotificationController.markAck', () => {
        expect(after?.acknowledged).toBeFalsy();
    });
 });
-
-// ── /notif/delete ───────────────────────────────────────────────────
-
-describe('NotificationController.remove', () => {
-    it('deletes the underlying notification row', async () => {
-        const { actor, userId } = await makeUser();
-        const created = await server.stores.notification.create({
-            userId,
-            value: { title: 't' },
-        });
-
-        const { res, captured } = makeRes();
-        await controller.remove(
-            makeReq({ body: { uid: created.uid }, actor }),
-            res,
-        );
-
-        expect(captured.body).toEqual({});
-        const after = await server.stores.notification.getByUid(
-            created.uid as string,
-            { userId },
-        );
-        expect(after).toBeNull();
-    });
-
-    it('succeeds for a uid that names no row', async () => {
-        const { actor } = await makeUser();
-        const { res, captured } = makeRes();
-        await controller.remove(
-            makeReq({ body: { uid: 'no-such-uid' }, actor }),
-            res,
-        );
-        expect(captured.body).toEqual({});
-    });
-
-    it('rejects a missing uid with 400', async () => {
-        const { actor } = await makeUser();
-        const { res } = makeRes();
-        await expect(
-            controller.remove(makeReq({ body: {}, actor }), res),
-        ).rejects.toMatchObject({ statusCode: 400 });
-    });
-
-    it('throws 401 when there is no actor on the request', async () => {
-        const { res } = makeRes();
-        await expect(
-            controller.remove(makeReq({ body: { uid: 'whatever' } }), res),
-        ).rejects.toMatchObject({ statusCode: 401 });
-    });
-
-    it("does not delete another user's notification", async () => {
-        const a = await makeUser();
-        const b = await makeUser();
-        const created = await server.stores.notification.create({
-            userId: a.userId,
-            value: {},
-        });
-
-        const { res } = makeRes();
-        await controller.remove(
-            makeReq({ body: { uid: created.uid }, actor: b.actor }),
-            res,
-        );
-
-        const after = await server.stores.notification.getByUid(
-            created.uid as string,
-            { userId: a.userId },
-        );
-        expect(after?.uid).toBe(created.uid);
-    });
-});
@@ -20,44 +20,16 @@
 import type { Request, Response } from 'express';
 import { Controller, Post } from '../../core/http/decorators.js';
 import { HttpError } from '../../core/http/HttpError.js';
+import type { NotificationService } from '../../services/notification/NotificationService.js';
 import { PuterController } from '../types.js';

-/** Both routes fire per interaction; the ceiling catches a loop, not a user. */
-const MARK_ROUTE_OPTIONS = {
-    subdomain: 'api',
-    requireUserActor: true,
-    allowFullAccessToken: true,
-    rateLimit: {
-        scope: 'notification-mark',
-        limit: 300,
-        window: 60_000,
-        key: 'user',
-    },
-} as const;
-
-/** The uid and owner a mark names, or the 400/401 the request earns. */
-const markTarget = (req: Request): { uid: string; userId: number } => {
-    const uid = req.body?.uid;
-    if (typeof uid !== 'string' || uid.length === 0) {
-        throw new HttpError(400, '`uid` must be a non-empty string', {
-            legacyCode: 'bad_request',
-        });
-    }
-    const userId = req.actor?.user?.id;
-    if (!userId)
-        throw new HttpError(401, 'Unauthorized', {
-            legacyCode: 'unauthorized',
-        });
-    return { uid, userId };
-};
-
 /**
- * GUI-facing notification endpoints. Supplement the `puter-notifications`
- * driver (which handles reads via `/drivers/call`) with the mutations the puter
- * desktop client calls directly.
+ * GUI-facing notification endpoint. Supplements the `puter-notifications`
+ * driver (which handles CRUD via `/drivers/call`) with the one mutation route
+ * the puter desktop client calls directly.
 *
- * Each goes through the NotificationService, which tells the user's other open
- * tabs (`notif.ack`, `notif.removed`) so they update immediately.
+ * It emits `outer.gui.notif.ack` via the NotificationService so other open tabs
+ * for the same user see the state change immediately.
 */
@Controller('/notif')
 export class NotificationController extends PuterController {
@@ -65,21 +37,50 @@ export class NotificationController extends PuterController {
     * POST /notif/mark-ack — user dismissed a notification. Sets `acknowledged`
     * timestamp; pushes ack event to sockets.
     */
-    @Post('/mark-ack', MARK_ROUTE_OPTIONS)
+    @Post('/mark-ack', {
+        subdomain: 'api',
+        requireUserActor: true,
+        allowFullAccessToken: true,
+        // Fires per notification interaction, so the ceiling stays
+        // generous — it is here to catch a loop, not to pace a user.
+        rateLimit: {
+            scope: 'notification-mark',
+            limit: 300,
+            window: 60_000,
+            key: 'user',
+        },
+    })
    async markAck(req: Request, res: Response): Promise<void> {
-        const { uid, userId } = markTarget(req);
-        await this.services.notification.markAcknowledged(uid, userId);
-        res.json({});
-    }
+        const uid = req.body?.uid;
+        if (typeof uid !== 'string' || uid.length === 0) {
+            throw new HttpError(400, '`uid` must be a non-empty string', {
+                legacyCode: 'bad_request',
+            });
+        }
+        const userId = req.actor?.user?.id;
+        if (!userId)
+            throw new HttpError(401, 'Unauthorized', {
+                legacyCode: 'unauthorized',
+            });

-    /**
-     * POST /notif/delete — user removed a notification from their history. A
-     * uid naming none of their rows succeeds too: it is gone either way.
-     */
-    @Post('/delete', MARK_ROUTE_OPTIONS)
-    async remove(req: Request, res: Response): Promise<void> {
-        const { uid, userId } = markTarget(req);
-        await this.services.notification.remove(uid, userId);
+        const notifService = this.services.notification as unknown as
+            | NotificationService
+            | undefined;
+        if (notifService?.markAcknowledged) {
+            await notifService.markAcknowledged(uid, userId);
+        } else {
+            // Fallback: direct store call if service isn't wired
+            await (
+                this.stores as Record<string, unknown> as {
+                    notification: {
+                        markAcknowledged: (
+                            uid: string,
+                            userId: number,
+                        ) => Promise<boolean>;
+                    };
+                }
+            ).notification.markAcknowledged(uid, userId);
+        }
        res.json({});
    }
 }
@@ -511,31 +511,6 @@ describe('PuterAIController.openaiChatCompletions', () => {

        const completeArgs = completeSpy.mock.calls[0]![0];
        expect(completeArgs.provider).toBe('openai-completion');
-        expect(completeArgs.fallback).toBeUndefined();
-    });
-
-    it('forwards fallback: false so the driver stops at the first route', async () => {
-        const completeSpy = stubChatComplete({
-            message: { role: 'assistant', content: 'hi there' },
-            finish_reason: 'stop',
-            usage: { prompt_tokens: 4, completion_tokens: 2 },
-        });
-
-        const { res } = makeRes();
-        await controller.openaiChatCompletions(
-            makeReq({
-                body: {
-                    model: 'gpt-test',
-                    provider: 'openai-completion',
-                    fallback: false,
-                    messages: [{ role: 'user', content: 'hi' }],
-                },
-                actor: makeUserActor(),
-            }),
-            res,
-        );
-
-        expect(completeSpy.mock.calls[0]![0].fallback).toBe(false);
    });

    it('still pins OpenAI when the caller names no model, so the default model does not move', async () => {
@@ -448,7 +448,6 @@ export class PuterAIController extends PuterController {
                  }
                : {}),
            ...openaiCompatProvider(body),
-            ...(body.fallback === false ? { fallback: false } : {}),
        };

        const result = await this.#complete(res, completeArgs);
@@ -546,7 +545,8 @@ export class PuterAIController extends PuterController {
                        }
                    } else if (ev.type === 'usage') {
                        usageDetails = ev.usageDetails as
-                            UsageDetails | undefined;
+                            | UsageDetails
+                            | undefined;
                        finishReason = ev.finish_reason as string | undefined;
                    } else if (ev.type === 'error') {
                        res.write(
@@ -649,7 +649,6 @@ export class PuterAIController extends PuterController {
                : {}),
            ...(finiteMaxTokens(body.max_tokens) ?? {}),
            ...openaiCompatProvider(body),
-            ...(body.fallback === false ? { fallback: false } : {}),
        };

        const completionId = `cmpl-${randomId()}`;
@@ -695,7 +694,8 @@ export class PuterAIController extends PuterController {
                        sendChunk(ev.text);
                    } else if (ev.type === 'usage') {
                        usageDetails = ev.usageDetails as
-                            UsageDetails | undefined;
+                            | UsageDetails
+                            | undefined;
                        finishReason = ev.finish_reason as string | undefined;
                    } else if (ev.type === 'error') {
                        res.write(
@@ -749,7 +749,8 @@ export class PuterAIController extends PuterController {
                    text: extractTextContent(
                        (
                            messageResult.message as
-                                Record<string, unknown> | undefined
+                                | Record<string, unknown>
+                                | undefined
                        )?.content,
                    ),
                    index: 0,
@@ -868,7 +869,6 @@ export class PuterAIController extends PuterController {
                  }
                : {}),
            provider: providerName,
-            ...(body.fallback === false ? { fallback: false } : {}),
        };

        const responseId = generateId('resp');
@@ -324,18 +324,6 @@ describe('parseAnthropicRequest', () => {
        expect(args.provider).toBe('claude');
        expect(args.normalize).toBe(false);
        expect(args.streamToolInput).toBe(true);
-        expect(args.fallback).toBeUndefined();
-    });
-
-    it('forwards fallback: false and nothing else for fallback', () => {
-        expect(
-            parseAnthropicRequest({ messages: [], fallback: false }, headers)
-                .fallback,
-        ).toBe(false);
-        expect(
-            parseAnthropicRequest({ messages: [], fallback: 'no' }, headers)
-                .fallback,
-        ).toBeUndefined();
    });

    it('maps thinking, tool_choice, stop_sequences, top_p/top_k', () => {
@@ -431,7 +431,6 @@ export const parseAnthropicRequest = (
            : {}),
        ...(betas.length ? { anthropicBetas: betas } : {}),
        provider: toStringOrEmpty(body.provider) || 'claude',
-        ...(body.fallback === false ? { fallback: false } : {}),
    };
    // Silently ignored: metadata, service_tier, inference_geo, container,
    // fallbacks, diagnostics.
@@ -151,12 +151,6 @@ describe('StaticAssetsController client_libs_root', () => {

        const sentPutility = await callGetHandler(router, '/putility/v1');
        expect(sentPutility).toEqual({ filename: 'putility.js/v1.js', root });
-
-        for (const route of ['/push-sw.js', '/v2/push-sw.js']) {
-            expect(findRoute(router, 'get', route)?.options.subdomain).toBe('js');
-            const sentWorker = await callGetHandler(router, route);
-            expect(sentWorker).toEqual({ filename: 'puter.js/push-sw.js', root });
-        }
    });

    it('does not register the client_libs routes when the root is unset', () => {
@@ -192,11 +186,6 @@ describe('StaticAssetsController puterjs_root', () => {
        expect(v1.root).toBe(root);
        const bareV1 = await callGetHandler(router, '/v1');
        expect(bareV1.filename).toBe('puter.js');
-
-        for (const route of ['/push-sw.js', '/v2/push-sw.js']) {
-            const worker = await callGetHandler(router, route);
-            expect(worker).toEqual({ filename: 'push-sw.js', root });
-        }
    });

    it('serves puter.dev.js when present (dev webpack build)', async () => {
@@ -26,9 +26,9 @@ import type { PuterRouter } from '../../core/http/PuterRouter';
 /**
 * Static asset routes.
 *
- * /puter.js/v1, /puter.js/v2 → any subdomain /v1, /v2, /push-sw.js,
- * /putility/v1 → js subdomain /sdk/* → root subdomain — puter-js bundle
- * /dist/_, /src/_, /assets/* → root subdomain
+ * /puter.js/v1, /puter.js/v2 → any subdomain /v1, /v2, /putility/v1 → js
+ * subdomain /sdk/* → root subdomain — puter-js bundle /dist/_, /src/_,
+ * /assets/* → root subdomain
 *
 * Each block depends on its config root (`client_libs_root`, `gui_assets_root`,
 * `puterjs_root`). When unset, that block is skipped — deployments that don't
@@ -55,12 +55,6 @@ export class StaticAssetsController extends PuterController {
            router.get('/putility/v1', { subdomain: 'js' }, (_req, res) => {
                res.sendFile('putility.js/v1.js', { root });
            });
-            // `/v2/push-sw.js` is the path older docs gave.
-            for (const route of ['/push-sw.js', '/v2/push-sw.js']) {
-                router.get(route, { subdomain: 'js' }, (_req, res) => {
-                    res.sendFile('puter.js/push-sw.js', { root });
-                });
-            }
        }

        // puter-js SDK mount. GUI loads it at `/sdk/puter.dev.js`; the
@@ -106,11 +100,6 @@ export class StaticAssetsController extends PuterController {
                router.get('/v2', { subdomain: 'js' }, (_req, res) => {
                    res.sendFile(puterJsFile, { root: puterjsRoot });
                });
-                for (const route of ['/push-sw.js', '/v2/push-sw.js']) {
-                    router.get(route, { subdomain: 'js' }, (_req, res) => {
-                        res.sendFile('push-sw.js', { root: puterjsRoot });
-                    });
-                }
            }
        }

@@ -1,146 +0,0 @@
-/*
- * Copyright (C) 2024-present Puter Technologies Inc.
- *
- * This file is part of Puter.
- *
- * Puter is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published
- * by the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-import { randomUUID } from 'node:crypto';
-import { afterAll, beforeAll, describe, expect, it } from 'vitest';
-import { runWithContext } from '../../core/context.js';
-import {
-    setupPuterTestEnv,
-    TEST_OTHER_USER_CREDENTIALS,
-    TEST_USER_CREDENTIALS,
-    type PuterTestEnv,
-} from '../../testUtil.js';
-
-/** PROPFIND has no paging, so a folder must list whole however large. */
-describe('PROPFIND on a folder larger than one query', () => {
-    let env: PuterTestEnv;
-    const total = 10_050;
-    let dir: string;
-    let dirUuid: string;
-
-    beforeAll(async () => {
-        env = await setupPuterTestEnv();
-        const { username } = env.users.user;
-        dir = `/${username}/Documents/big-${randomUUID().slice(0, 8)}`;
-        const owner = (await env.server.stores.user.getByUsername(username))!;
-        const parent = (await env.server.stores.fsEntry.getEntryByPath(
-            `/${username}/Documents`,
-        ))!;
-        dirUuid = randomUUID();
-        const now = Math.floor(Date.now() / 1000);
-        const insert = (rows: unknown[][]) =>
-            env.server.clients.db.write(
-                `INSERT INTO fsentries (uuid, user_id, parent_id, parent_uid, name, path, is_dir, modified, created, accessed, size) VALUES ${rows.map(() => '(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)').join(', ')}`,
-                rows.flat(),
-            );
-        await insert([
-            [
-                dirUuid,
-                owner.id,
-                parent.id,
-                parent.uuid,
-                dir.split('/').at(-1),
-                dir,
-                1,
-                now,
-                now,
-                now,
-                0,
-            ],
-        ]);
-        const folder = (await env.server.stores.fsEntry.getEntryByPath(dir))!;
-        for (let start = 0; start < total; start += 500) {
-            const rows: unknown[][] = [];
-            for (let i = start; i < Math.min(total, start + 500); i++) {
-                const name = `f${String(i).padStart(5, '0')}.txt`;
-                rows.push([
-                    randomUUID(),
-                    owner.id,
-                    folder.id,
-                    folder.uuid,
-                    name,
-                    `${dir}/${name}`,
-                    0,
-                    now,
-                    now,
-                    now,
-                    0,
-                ]);
-            }
-            await insert(rows);
-        }
-
-        const actor = { user: owner };
-        await runWithContext({ actor: actor as never }, () =>
-            env.server.services.share.share(actor as never, {
-                uid: dirUuid,
-                recipient: { username: env.users.other.username },
-                mode: 'read',
-            }),
-        );
-    }, 180_000);
-
-    afterAll(async () => {
-        await env?.shutdown();
-    });
-
-    const propfind = async (
-        path: string,
-        credentials: { username: string; password: string },
-    ) => {
-        const port = new URL(env.apiOrigin).port;
-        const auth = Buffer.from(
-            `${credentials.username}:${credentials.password}`,
-        ).toString('base64');
-        const response = await fetch(
-            `http://dav.puter.localhost:${port}${encodeURI(path)}`,
-            {
-                method: 'PROPFIND',
-                headers: { Authorization: `Basic ${auth}`, Depth: '1' },
-            },
-        );
-        return { status: response.status, body: await response.text() };
-    };
-
-    const hrefsOf = (xml: string) =>
-        [...xml.matchAll(/<D:href>([^<]*)<\/D:href>/g)].map((m) => m[1]!);
-
-    it('lists every child', async () => {
-        const { status, body } = await propfind(dir, TEST_USER_CREDENTIALS);
-        expect(status).toBe(207);
-        expect(body.endsWith('</D:multistatus>')).toBe(true);
-        const hrefs = hrefsOf(body);
-        expect(hrefs).toHaveLength(1 + total);
-        expect(new Set(hrefs).size).toBe(1 + total);
-        expect(body).toContain(`${dir}/f10049.txt`);
-    }, 60_000);
-
-    it("masks every page of a share recipient's listing", async () => {
-        const masked = `/${env.users.user.username}/${dirUuid}/${dir.split('/').at(-1)}`;
-        const { status, body } = await propfind(
-            masked,
-            TEST_OTHER_USER_CREDENTIALS,
-        );
-        expect(status).toBe(207);
-        const hrefs = hrefsOf(body);
-        expect(hrefs).toHaveLength(1 + total);
-        expect(hrefs.every((href) => href.startsWith(masked))).toBe(true);
-        expect(body).not.toContain('/Documents/');
-    }, 60_000);
-});
@@ -24,7 +24,6 @@ import { posix as pathPosix } from 'node:path';
 import { pipeline } from 'node:stream/promises';
 import type { Actor } from '../../core/actor.js';
 import { HttpError } from '../../core/http/HttpError.js';
-import { pipeToResponse } from '../../core/http/pipeToResponse.js';
 import {
    assertNotSuspended,
    assertTeam2fa,
@@ -59,7 +58,6 @@ import {
 import { Context } from '../../core/context.js';
 import type { FSEntry } from '../../stores/fs/FSEntry.js';
 import {
-    contextBoundStream,
    emitGuiItemEvent,
    type GuiItemEventName,
 } from '../fs/legacyFsHelpers.js';
@@ -602,41 +600,19 @@ export class WebDAVController extends PuterController {
            propfindEntry(maskEntryPath(entry), entry, entry.isDir),
        ];

-        if (depth === '0' || !entry.isDir) {
-            this.#sendMultistatus(res, responses);
-            return;
-        }
-
-        const toXml = (children: FSEntry[]) =>
-            children
-                .map((child) =>
+        if (depth !== '0' && entry.isDir) {
+            const children = await this.services.fs.listDirectory(
+                entry.uuid,
+                {},
+            );
+            for (const child of children) {
+                responses.push(
                    propfindEntry(maskEntryPath(child), child, child.isDir),
-                )
-                .join('\n');
-        const pages = this.services.fs.listDirectoryPages(entry.uuid);
-        const first = await pages.next();
-        if (!first.done && first.value.length > 0)
-            responses.push(toXml(first.value));
-        const second = await pages.next();
-        if (second.done) {
-            this.#sendMultistatus(res, responses);
-            return;
+                );
+            }
        }

-        // Past one page the listing streams, so a large folder isn't held in
-        // memory whole. A failure partway cuts the response off.
-        const secondPage = second.value;
-        async function* body() {
-            yield `${MULTISTATUS_OPEN}${responses.join('\n')}`;
-            yield `\n${toXml(secondPage)}`;
-            for await (const page of pages)
-                if (page.length > 0) yield `\n${toXml(page)}`;
-            yield MULTISTATUS_CLOSE;
-        }
-        res.status(207).set({
-            'Content-Type': 'application/xml; charset=utf-8',
-        });
-        await pipeToResponse(contextBoundStream(body()), res);
+        this.#sendMultistatus(res, responses);
    }

    /**
@@ -1313,12 +1289,8 @@ function escapeXml(text: string): string {
        .replace(/'/g, '&#39;');
 }

-const MULTISTATUS_OPEN =
-    '<?xml version="1.0" encoding="utf-8"?>\n<D:multistatus xmlns:D="DAV:">\n';
-const MULTISTATUS_CLOSE = '\n</D:multistatus>';
-
 function wrapMultistatus(inner: string): string {
-    return `${MULTISTATUS_OPEN}${inner}${MULTISTATUS_CLOSE}`;
+    return `<?xml version="1.0" encoding="utf-8"?>\n<D:multistatus xmlns:D="DAV:">\n${inner}\n</D:multistatus>`;
 }

 /**
@@ -63,17 +63,10 @@ export interface KnownContextFields {
    driverName: string;
    /**
     * Aborts when the client disconnects before the response has finished (set
-     * by DriverController). Some drivers (Gemini, Replicate) stop early on it.
-     * Async video and image jobs keep polling and are metered after a
-     * disconnect, since the provider bills them either way.
+     * by DriverController). Long-running drivers poll it so work nobody will
+     * receive stops early and is never metered.
     */
    abortSignal: AbortSignal;
-    /**
-     * Keeps the call's concurrency slot until `work` settles (set by
-     * DriverController when the method is capped), for work that outlives the
-     * response.
-     */
-    keepDriverSlot: (work: Promise<unknown>) => void;
    /**
     * Aborts the chat driver's upstream request. A client disconnect doesn't
     * fire it: the upstream bills a request it has accepted either way, so the
@@ -87,11 +80,6 @@ export interface KnownContextFields {
     * different provider's translation of it.
     */
    strictUpstreamErrors: boolean;
-    /**
-     * Set while Puter files something into an account for it (mail delivery),
-     * so filesystem events never report that write as the request actor's own.
-     */
-    platformWrite: boolean;
 }

 // Every key of `KnownContextFields`, checked both ways by the compiler, so
@@ -102,10 +90,8 @@ const KNOWN_KEY_FLAGS: Record<keyof KnownContextFields, true> = {
    requestId: true,
    driverName: true,
    abortSignal: true,
-    keepDriverSlot: true,
    upstreamSignal: true,
    strictUpstreamErrors: true,
-    platformWrite: true,
 };
 const KNOWN_KEYS: ReadonlySet<string> = new Set(Object.keys(KNOWN_KEY_FLAGS));

@@ -1,163 +0,0 @@
-/*
- * Copyright (C) 2024-present Puter Technologies Inc.
- *
- * This file is part of Puter.
- *
- * Puter is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published
- * by the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-import { EventEmitter } from 'node:events';
-import type { NextFunction, Request, RequestHandler, Response } from 'express';
-import { describe, expect, it, vi } from 'vitest';
-import { isHttpError } from '../HttpError';
-import {
-    createLargeJsonBodyParser,
-    DEFAULT_JSON_LIMIT_BYTES,
-} from './largeJsonBody';
-
-const MiB = 1024 * 1024;
-
-// A complete request with no socket reads as already consumed to body-parser,
-// so the parsers call straight through, leaving any preset `body` in place.
-const makeReq = (
-    bytes: number | undefined,
-    user: string | null = 'u1',
-    body?: unknown,
-) =>
-    ({
-        complete: true,
-        body,
-        headers: {
-            'content-type': 'application/json',
-            ...(bytes === undefined ? {} : { 'content-length': String(bytes) }),
-            ...(user ? { authorization: user } : {}),
-        },
-    }) as unknown as Request;
-
-const makeRes = () => {
-    const res = new EventEmitter() as EventEmitter & {
-        setHeader: ReturnType<typeof vi.fn>;
-    };
-    res.setHeader = vi.fn();
-    return res;
-};
-
-const authProbe = vi.fn<RequestHandler>((req, _res, next) => {
-    if (req.headers.authorization) {
-        (req as { actor?: unknown }).actor = {
-            user: { uuid: req.headers.authorization },
-        };
-    }
-    next();
-});
-
-const run = (mw: RequestHandler, req: Request, res = makeRes()) =>
-    new Promise<{ err: unknown; res: ReturnType<typeof makeRes> }>(
-        (resolve) => {
-            mw(
-                req,
-                res as unknown as Response,
-                ((err?: unknown) => resolve({ err, res })) as NextFunction,
-            );
-        },
-    );
-
-const statusOf = (err: unknown) => (isHttpError(err) ? err.statusCode : err);
-
-describe('createLargeJsonBodyParser', () => {
-    const create = ({
-        budgetBytes = 200 * MiB,
-        perUserBytes = 128 * MiB,
-        accepts,
-    }: {
-        budgetBytes?: number;
-        perUserBytes?: number;
-        accepts?: (req: Request) => boolean;
-    } = {}) =>
-        createLargeJsonBodyParser({
-            authProbe,
-            limitBytes: 128 * MiB,
-            budgetBytes,
-            perUserBytes,
-            accepts,
-        });
-
-    it.each([
-        ['no Content-Length', undefined],
-        ['a body within the default limit', DEFAULT_JSON_LIMIT_BYTES],
-        ['a body over the large limit', 128 * MiB + 1],
-    ])('leaves %s to the global parser without probing', async (_, bytes) => {
-        authProbe.mockClear();
-        const { err } = await run(create(), makeReq(bytes));
-        expect(err).toBeUndefined();
-        expect(authProbe).not.toHaveBeenCalled();
-    });
-
-    it('leaves an unauthenticated large body to the global parser', async () => {
-        const mw = create({ budgetBytes: 60 * MiB });
-        const { err } = await run(mw, makeReq(60 * MiB, null));
-        expect(err).toBeUndefined();
-        // Nothing was charged, so a signed-in caller still fits.
-        expect((await run(mw, makeReq(60 * MiB))).err).toBeUndefined();
-    });
-
-    it('charges nothing for a client that left during the probe', async () => {
-        const mw = create({ budgetBytes: 60 * MiB });
-        const gone = Object.assign(makeRes(), { closed: true });
-        expect((await run(mw, makeReq(60 * MiB), gone)).err).toBeUndefined();
-        expect((await run(mw, makeReq(60 * MiB))).err).toBeUndefined();
-    });
-
-    it('refuses with 503 past the budget until a response closes', async () => {
-        const mw = create({ budgetBytes: 130 * MiB });
-        const first = await run(mw, makeReq(60 * MiB, 'u1'));
-        await run(mw, makeReq(60 * MiB, 'u2'));
-
-        const refused = await run(mw, makeReq(60 * MiB, 'u3'));
-        expect(statusOf(refused.err)).toBe(503);
-        // Load shedding is recorded, not paged.
-        expect(isHttpError(refused.err) && refused.err.alarmSeverity).toBe(
-            'info',
-        );
-        expect(refused.res.setHeader).toHaveBeenCalledWith('Retry-After', '5');
-
-        first.res.emit('close');
-        expect((await run(mw, makeReq(60 * MiB, 'u3'))).err).toBeUndefined();
-    });
-
-    it("refuses one user's bodies with 429 past their share", async () => {
-        const mw = create({ perUserBytes: 100 * MiB });
-        const first = await run(mw, makeReq(60 * MiB, 'u1'));
-
-        const refused = await run(mw, makeReq(60 * MiB, 'u1'));
-        expect(statusOf(refused.err)).toBe(429);
-        expect(refused.res.setHeader).toHaveBeenCalledWith('Retry-After', '5');
-        // Another user isn't held back by it.
-        expect((await run(mw, makeReq(60 * MiB, 'u2'))).err).toBeUndefined();
-
-        first.res.emit('close');
-        expect((await run(mw, makeReq(60 * MiB, 'u1'))).err).toBeUndefined();
-    });
-
-    it('refuses with 413 a parsed body `accepts` turns down', async () => {
-        const mw = create({
-            accepts: (req) => (req.body as { ok?: boolean }).ok === true,
-        });
-        const refused = await run(mw, makeReq(60 * MiB, 'u1', { ok: false }));
-        expect(statusOf(refused.err)).toBe(413);
-        expect(
-            (await run(mw, makeReq(60 * MiB, 'u2', { ok: true }))).err,
-        ).toBeUndefined();
-    });
-});
@@ -1,134 +0,0 @@
-/*
- * Copyright (C) 2024-present Puter Technologies Inc.
- *
- * This file is part of Puter.
- *
- * Puter is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published
- * by the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-import express, { type Request, type RequestHandler } from 'express';
-import { actorUid } from '../../actor';
-import { HttpError } from '../HttpError';
-
-/** The global JSON parser's limit, which applies before auth. */
-export const DEFAULT_JSON_LIMIT_BYTES = 50 * 1024 * 1024;
-
-interface LargeJsonBodyOptions {
-    /** The global auth probe; it skips requests that already carry an actor. */
-    authProbe: RequestHandler;
-    limitBytes: number;
-    /** Declared bytes of large bodies a process holds at once. */
-    budgetBytes: number;
-    /** Declared bytes of large bodies one user holds at once. */
-    perUserBytes: number;
-    /** Checked once the body is parsed; a body it refuses gets a 413. */
-    accepts?: (req: Request) => boolean;
-}
-
-/**
- * Parses JSON bodies over the default limit, up to `limitBytes`, once the
- * caller's header or cookie credential resolves. Unauthenticated requests and
- * requests without a Content-Length fall through to the global parser and its
- * limit.
- *
- * The parsed body lives as long as the request, so a body's bytes count against
- * both budgets until its response closes. Over the user's budget gets a 429,
- * over the process budget a 503.
- */
-export const createLargeJsonBodyParser = ({
-    authProbe,
-    limitBytes,
-    budgetBytes,
-    perUserBytes,
-    accepts,
-}: LargeJsonBodyOptions): RequestHandler => {
-    const json = express.json({ limit: limitBytes });
-    const textAsJson = express.json({
-        limit: limitBytes,
-        type: (req) =>
-            req.headers['content-type'] === 'text/plain;actually=json',
-    });
-    let inFlightBytes = 0;
-    const inFlightByUser = new Map<string, number>();
-
-    return (req, res, next) => {
-        const declared = Number(req.headers['content-length']);
-        if (!(declared > DEFAULT_JSON_LIMIT_BYTES && declared <= limitBytes)) {
-            next();
-            return;
-        }
-        void authProbe(req, res, () => {
-            // `res.closed`: the client left during the probe, so `close` has
-            // already fired and would never release a charge.
-            if (!req.actor || res.closed) {
-                next();
-                return;
-            }
-            const user = req.actor.user.uuid ?? actorUid(req.actor);
-            const userBytes = inFlightByUser.get(user) ?? 0;
-            if (userBytes + declared > perUserBytes) {
-                res.setHeader('Retry-After', '5');
-                next(
-                    new HttpError(
-                        429,
-                        'Too many large requests in progress for this account',
-                        { legacyCode: 'too_many_requests' },
-                    ),
-                );
-                return;
-            }
-            if (inFlightBytes + declared > budgetBytes) {
-                res.setHeader('Retry-After', '5');
-                next(
-                    new HttpError(503, 'Too many large requests in progress', {
-                        code: 'large_body_capacity',
-                        // Load shedding, not a fault: record it, don't page.
-                        alarmSeverity: 'info',
-                    }),
-                );
-                return;
-            }
-            inFlightBytes += declared;
-            inFlightByUser.set(user, userBytes + declared);
-            res.once('close', () => {
-                inFlightBytes -= declared;
-                const left = (inFlightByUser.get(user) ?? 0) - declared;
-                if (left > 0) inFlightByUser.set(user, left);
-                else inFlightByUser.delete(user);
-            });
-            json(req, res, (err?: unknown) => {
-                if (err) {
-                    next(err);
-                    return;
-                }
-                textAsJson(req, res, (err?: unknown) => {
-                    if (err) {
-                        next(err);
-                        return;
-                    }
-                    if (accepts && !accepts(req)) {
-                        // The same answer the default limit gives.
-                        next(
-                            new HttpError(413, 'request entity too large', {
-                                legacyCode: 'client_bad_request',
-                            }),
-                        );
-                        return;
-                    }
-                    next();
-                });
-            });
-        });
-    };
-};
@@ -476,8 +476,9 @@ function actorMatchesExpectedApp(
 }

 /**
- * Fresh authenticated identities replace the sticky public billing cookie when
- * the visitor switches accounts.
+ * Mirror of `resolvePrivateIdentity` for public hosted apps. Reads the sticky
+ * `puter.public.hosted.actor.token` cookie first, then the same
+ * session/bootstrap fallbacks.
 */
 export async function resolvePublicHostedIdentity(opts: {
    req: Request;
@@ -499,6 +500,37 @@ export async function resolvePublicHostedIdentity(opts: {
    const cookies = (req as Request & { cookies?: Record<string, string> })
        .cookies;

+    const { name: publicCookieNameV2, legacyName: publicCookieNameLegacy } =
+        HOSTED_ASSET_COOKIES.public;
+    const publicCookieToken =
+        (typeof cookies?.[publicCookieNameV2] === 'string'
+            ? cookies[publicCookieNameV2]
+            : null) ??
+        (typeof cookies?.[publicCookieNameLegacy] === 'string'
+            ? cookies[publicCookieNameLegacy]
+            : null);
+    if (publicCookieToken) {
+        try {
+            const claims = await authService.verifyHostedAssetToken(
+                'public',
+                publicCookieToken,
+                {
+                    appUid: expectedAppUid,
+                    subdomain: expectedSubdomain,
+                    host: expectedHost,
+                },
+            );
+            return {
+                source: 'public-cookie',
+                userUid: claims.userUid,
+                sessionUuid: claims.sessionUuid,
+                hasValidPublicCookie: true,
+            };
+        } catch {
+            /* fall through — v1-signed cookies land here and get re-minted */
+        }
+    }
+
    const existingActor = req.actor;
    if (
        existingActor?.user?.uuid &&
@@ -554,37 +586,6 @@ export async function resolvePublicHostedIdentity(opts: {
        }
    }

-    const { name: publicCookieNameV2, legacyName: publicCookieNameLegacy } =
-        HOSTED_ASSET_COOKIES.public;
-    const publicCookieToken =
-        (typeof cookies?.[publicCookieNameV2] === 'string'
-            ? cookies[publicCookieNameV2]
-            : null) ??
-        (typeof cookies?.[publicCookieNameLegacy] === 'string'
-            ? cookies[publicCookieNameLegacy]
-            : null);
-    if (publicCookieToken) {
-        try {
-            const claims = await authService.verifyHostedAssetToken(
-                'public',
-                publicCookieToken,
-                {
-                    appUid: expectedAppUid,
-                    subdomain: expectedSubdomain,
-                    host: expectedHost,
-                },
-            );
-            return {
-                source: 'public-cookie',
-                userUid: claims.userUid,
-                sessionUuid: claims.sessionUuid,
-                hasValidPublicCookie: true,
-            };
-        } catch {
-            /* fall through — v1-signed cookies land here and get re-minted */
-        }
-    }
-
    return { source: 'none' };
 }

@@ -2591,239 +2591,3 @@ describe('createPuterSiteMiddleware — private-app gate decisions', () => {
        },
    );
 });
-
-describe('public hosted asset billing identity', () => {
-    it.each(['actor', 'session', 'query'] as const)(
-        'replaces an older billing cookie with the current %s identity',
-        async (source) => {
-            const owner = await makeUserWithHome();
-            const previous = await makeUser();
-            const current = await makeUser();
-            const home = (await server.stores.fsEntry.getEntryByPath(
-                `/${owner.username}`,
-            ))!;
-            const sub = `switch-${uuidv4().slice(0, 8)}`;
-            const host = `${sub}.site.puter.localhost`;
-            await server.stores.subdomain.create({
-                userId: owner.id,
-                subdomain: sub,
-                rootDirId: home.id,
-            });
-            await writeFile(
-                owner.id,
-                `/${owner.username}/index.html`,
-                Buffer.from('hello'),
-            );
-            const app = await server.stores.app.create(
-                { name: sub, title: sub, index_url: `http://${host}/` },
-                { ownerUserId: owner.id },
-            );
-            const previousToken = await server.services.auth.getUserAppToken(
-                actorFor(previous),
-                app.uid,
-            );
-            const previousActor =
-                (await server.services.auth.authenticateFromToken(
-                    previousToken,
-                ))!;
-            const currentToken = await server.services.auth.getUserAppToken(
-                actorFor(current),
-                app.uid,
-            );
-            const oldCookie = await server.services.auth.createHostedAssetToken(
-                'public',
-                {
-                    appUid: app.uid,
-                    userUid: previous.uuid,
-                    sessionUuid: previousActor.session?.uid,
-                    subdomain: sub,
-                    host,
-                },
-            );
-            const cookieName = HOSTED_ASSET_COOKIES.public.name;
-            const req = makeReq({
-                hostname: host,
-                path: '/index.html',
-                cookies: {
-                    [cookieName]: oldCookie,
-                    ...(source === 'session' ? { session: currentToken } : {}),
-                },
-                query:
-                    source === 'query'
-                        ? { 'puter.auth.token': currentToken }
-                        : {},
-            });
-            if (source === 'actor')
-                req.actor =
-                    (await server.services.auth.authenticateFromToken(
-                        currentToken,
-                    ))!;
-            const { res, out } = makeRes();
-            await buildMiddleware({ cookie_name: 'session' })(
-                req,
-                res,
-                vi.fn(),
-            );
-            await new Promise<void>((resolve) => setImmediate(resolve));
-            expect(out.statusCode).toBe(200);
-            expect(req.egressActor?.user?.uuid).toBe(current.uuid);
-            const refreshed = out.cookies[cookieName];
-            expect(refreshed).toBeTruthy();
-            expect(
-                (
-                    await server.services.auth.verifyHostedAssetToken(
-                        'public',
-                        refreshed,
-                        { appUid: app.uid, host },
-                    )
-                ).userUid,
-            ).toBe(current.uuid);
-            const nextReq = makeReq({
-                hostname: host,
-                path: '/index.html',
-                cookies: { [cookieName]: refreshed },
-            });
-            await runMiddleware(buildMiddleware(), nextReq);
-            expect(nextReq.egressActor?.user?.uuid).toBe(current.uuid);
-        },
-    );
-
-    it('bills recognized visitors, reuses the parent session, and falls back to the owner', async () => {
-        const owner = await makeUserWithHome();
-        const visitor = await makeUser();
-        const home = (await server.stores.fsEntry.getEntryByPath(
-            `/${owner.username}`,
-        ))!;
-        const sub = `egress-${uuidv4().slice(0, 8)}`;
-        const host = `${sub}.site.puter.localhost`;
-        await server.stores.subdomain.create({
-            userId: owner.id,
-            subdomain: sub,
-            rootDirId: home.id,
-        });
-        await writeFile(
-            owner.id,
-            `/${owner.username}/index.html`,
-            Buffer.from('hello'),
-        );
-        const app = await server.stores.app.create(
-            { name: sub, title: sub, index_url: `http://${host}/` },
-            { ownerUserId: owner.id },
-        );
-        const token = await server.services.auth.getUserAppToken(
-            actorFor(visitor),
-            app.uid,
-        );
-        const authenticated =
-            await server.services.auth.authenticateFromToken(token);
-        const serve = async (query = {}, cookies = {}, headers = {}) => {
-            const req = makeReq({ hostname: host, path: '/index.html', query });
-            Object.assign(req, { cookies, headers });
-            const { res, out } = makeRes();
-            await buildMiddleware()(req, res, vi.fn());
-            await new Promise<void>((resolve) => setImmediate(resolve));
-            expect(out.statusCode).toBe(200);
-            return { req, out };
-        };
-        const create = vi.spyOn(server.stores.session, 'create');
-        try {
-            const first = await serve({ 'puter.auth.token': token });
-            expect(first.req.egressActor?.user?.uuid).toBe(visitor.uuid);
-            const cookieName = HOSTED_ASSET_COOKIES.public.name;
-            const cookie = first.out.cookies[cookieName];
-            expect(cookie).toBeTruthy();
-            const claims = await server.services.auth.verifyHostedAssetToken(
-                'public',
-                cookie,
-                { appUid: app.uid, host },
-            );
-            expect(claims.sessionUuid).toBe(authenticated?.session?.uid);
-            const next = await serve({}, { [cookieName]: cookie });
-            expect(next.req.egressActor?.user?.uuid).toBe(visitor.uuid);
-            expect(next.out.cookies).toEqual({});
-            const blockedCookies = await serve(
-                {},
-                {},
-                { referer: `http://${host}/?puter.auth.token=${token}` },
-            );
-            expect(blockedCookies.req.egressActor?.user?.uuid).toBe(
-                visitor.uuid,
-            );
-            expect(create).not.toHaveBeenCalled();
-            const anonymous = await serve();
-            expect(anonymous.req.egressActor?.user?.uuid).toBe(owner.uuid);
-            const invalid = await serve({}, { [cookieName]: 'invalid' });
-            expect(invalid.req.egressActor?.user?.uuid).toBe(owner.uuid);
-            await server.services.auth.revokeAllSessionsForUserId(visitor.id);
-            const revoked = await serve({}, { [cookieName]: cookie });
-            expect(revoked.req.egressActor?.user?.uuid).toBe(owner.uuid);
-        } finally {
-            create.mockRestore();
-        }
-    });
-});
-
-describe('site rooted in the owner tree, root moved to Trash', () => {
-    it('stops serving a trashed folder and resumes when restored', async () => {
-        const owner = await makeUserWithHome();
-        const dir = await server.services.fs.mkdir(owner.id, {
-            path: `/${owner.username}/Documents/site`,
-            createMissingParents: true,
-        });
-        const body = Buffer.from('<html>trashed</html>');
-        await server.services.fs.write(owner.id, {
-            fileMetadata: {
-                path: `/${owner.username}/Documents/site/index.html`,
-                size: body.byteLength,
-            },
-            fileContent: body,
-        });
-        const sub = `tr-${Math.random().toString(36).slice(2, 8)}`;
-        await server.stores.subdomain.create({
-            userId: owner.id,
-            subdomain: sub,
-            rootDirId: dir.id,
-        });
-        const serveIndex = async () => {
-            const mw = createPuterSiteMiddleware(hostingConfig, {
-                clients: server.clients,
-                stores: server.stores,
-                services: server.services,
-            });
-            const { res, out } = makeRes();
-            await mw(
-                makeReq({
-                    hostname: `${sub}.site.puter.localhost`,
-                    path: '/',
-                }),
-                res,
-                vi.fn(),
-            );
-            await new Promise<void>((resolve) => setImmediate(resolve));
-            return out;
-        };
-        expect((await serveIndex()).statusCode).toBe(200);
-
-        const trash = (await server.stores.fsEntry.getEntryByPath(
-            `/${owner.username}/Trash`,
-        ))!;
-        const entry = (await server.stores.fsEntry.getEntryById(dir.id))!;
-        await server.services.fs.move(owner.id, {
-            source: entry,
-            destinationParent: trash,
-        });
-        const moved = (await server.stores.fsEntry.getEntryById(dir.id))!;
-        expect(moved.path.startsWith(`/${owner.username}/Trash/`)).toBe(true);
-
-        const out = await serveIndex();
-        expect(out.statusCode).toBe(404);
-        const documents = (await server.stores.fsEntry.getEntryByPath(
-            `/${owner.username}/Documents`,
-        ))!;
-        await server.services.fs.move(owner.id, {
-            source: moved,
-            destinationParent: documents,
-        });
-        expect((await serveIndex()).statusCode).toBe(200);
-    });
-});
@@ -27,7 +27,6 @@ import { MANAGE_PERM_PREFIX } from '../../../services/permission/consts';
 import type { puterStores } from '../../../stores';
 import type { IConfig, LayerInstances } from '../../../types';
 import { awaitLater } from '../../../util/concurrency';
-import { isTrashedPath } from '../../../util/hostedAppBacking';
 import { makeActor } from '../../actor';
 import {
    buildAppCenterFallback,
@@ -110,6 +109,10 @@ const isServableEntryPath = (
    return !isWorkersSourcePath(relPath) && !isSiteConfigPath(relPath);
 };

+/** Inside some owner's top-level Trash, which is where Delete puts things. */
+const isTrashedPath = (path: string): boolean =>
+    /^\/[^/]+\/Trash(\/|$)/u.test(path);
+
 /**
 * Suggested value for `config.hosting_csp`. Not applied unless configured.
 *
@@ -330,7 +333,6 @@ export const createPuterSiteMiddleware = (

        const associatedApp = (await appLookup) as AppRow | null;

-        let hostedVisitorUid: string | undefined;
        const isPrivateApp = Boolean(associatedApp?.is_private);
        const privateApp = isPrivateApp ? associatedApp : null;

@@ -398,8 +400,6 @@ export const createPuterSiteMiddleware = (
                return;
            }

-            hostedVisitorUid = identity.userUid;
-
            // Entitlement check runs on every request — matching v1. The
            // sticky cookie is an identity shortcut, not an access cache;
            // the marketplace extension already caches access decisions
@@ -509,8 +509,11 @@ export const createPuterSiteMiddleware = (
            res.status(404).type('text/plain').send('Subdomain not found');
            return;
        } else {
-            // Remember the authenticated visitor for asset billing across
-            // requests that do not carry the original app token.
+            // Public hosted site. Mint the public hosted-actor cookie if
+            // we can identify the visitor — lets the hosted page make
+            // cross-origin requests as the actor without needing a
+            // host-scoped main session cookie. No-op for anonymous
+            // visitors.
            try {
                const identity = await resolvePublicHostedIdentity({
                    req,
@@ -523,7 +526,6 @@ export const createPuterSiteMiddleware = (
                    expectedSubdomain: subdomain,
                    expectedHost: host,
                });
-                hostedVisitorUid = identity.userUid;
                if (
                    identity.userUid &&
                    !(identity as { hasValidPublicCookie?: boolean })
@@ -572,7 +574,7 @@ export const createPuterSiteMiddleware = (
                .send(SUBDOMAIN_404);
            return;
        }
-        if (!rootEntry.isDir || isTrashedPath(rootEntry.path)) {
+        if (!rootEntry.isDir) {
            res.status(404)
                .type('text/html; charset=UTF-8')
                .send(SUBDOMAIN_404);
@@ -582,27 +584,37 @@ export const createPuterSiteMiddleware = (
        // A site rooted in someone else's directory stands on the `manage`
        // grant that authorized publishing it, and serves that whole subtree
        // with the ACL bypassed — so the grant is re-read on every request.
+        // Trash is its own check: a grant is keyed on the node, not its
+        // location, so it survives the owner deleting the directory. Sites
+        // rooted in their publisher's own tree skip all of this.
        if (rootEntry.userId !== site.user_id) {
            let stillPublishable = false;
-            try {
-                stillPublishable = await layers.services.acl.check(
-                    makeActor({
-                        user: {
-                            id: owner.id,
-                            uuid: owner.uuid,
-                            username: owner.username,
+            if (!isTrashedPath(rootEntry.path)) {
+                try {
+                    stillPublishable = await layers.services.acl.check(
+                        makeActor({
+                            user: {
+                                id: owner.id,
+                                uuid: owner.uuid,
+                                username: owner.username,
+                            },
+                        }),
+                        {
+                            path: rootEntry.path,
+                            resolveAncestors: () =>
+                                layers.services.fs.getAncestorChain(
+                                    rootEntry.path,
+                                ),
                        },
-                    }),
-                    {
-                        path: rootEntry.path,
-                        resolveAncestors: () =>
-                            layers.services.fs.getAncestorChain(rootEntry.path),
-                    },
-                    MANAGE_PERM_PREFIX,
-                );
-            } catch (e) {
-                // Fail closed — an unreadable grant is not a held one.
-                console.warn('[puter-site] publish grant recheck failed', e);
+                        MANAGE_PERM_PREFIX,
+                    );
+                } catch (e) {
+                    // Fail closed — an unreadable grant is not a held one.
+                    console.warn(
+                        '[puter-site] publish grant recheck failed',
+                        e,
+                    );
+                }
            }
            if (!stillPublishable) {
                res.status(404)
@@ -825,22 +837,7 @@ export const createPuterSiteMiddleware = (
        // hosting is unauthenticated by design, so most visitors are nobody in
        // particular. Set unconditionally because hosting subdomains are not
        // metered by default: this is what opts the response in.
-        let visitorActor = req.actor;
-        if (hostedVisitorUid && visitorActor?.user?.uuid !== hostedVisitorUid) {
-            try {
-                const visitor =
-                    await layers.stores.user.getByUuid(hostedVisitorUid);
-                if (visitor && !visitor.suspended) {
-                    visitorActor = makeActor({
-                        user: visitor,
-                        app: associatedApp ?? undefined,
-                    });
-                }
-            } catch {
-                // Unknown requesters are billed to the site owner.
-            }
-        }
-        req.egressActor = visitorActor ?? {
+        req.egressActor = req.actor ?? {
            user: {
                uuid: owner.uuid,
                id: owner.id,
@@ -84,10 +84,6 @@ export function sweepMemoryWindows() {
        )
            memoryWindows.delete(k);
    }
-    for (const [k, entry] of memoryCounters) {
-        if (entry.index < Math.floor(now / entry.windowMs) - 1)
-            memoryCounters.delete(k);
-    }
 }

 {
@@ -159,97 +155,6 @@ async function peekMemory(key, limit, windowMs) {
    return timestamps.length < limit;
 }

-// -- Counted claims --------------------------------------------------
-//
-// `claim` keeps a member per unit, which is fine for a few units and not for
-// thousands. The counted form keeps two counters per key, the current fixed
-// window and the one before it, and slides by weighting the previous one by
-// how much of it the window still covers. It can be off by a little at window
-// edges, and its buckets are separate from the other forms'.
-
-/** The sliding-window estimate from the two fixed windows it overlaps. */
-const slidingCount = (previous, current, now, windowMs) =>
-    previous * (1 - (now % windowMs) / windowMs) + current;
-
-/** How many of `units` a counted claim that left `used` spent may keep. */
-const countedAdmits = (used, limit, units) =>
-    units - Math.min(units, Math.max(0, Math.ceil(used - limit)));
-
-/** Key → `{ index, current, previous, windowMs }`, swept with the windows. */
-const memoryCounters = new Map();
-
-async function claimCountMemory(key, limit, windowMs, units) {
-    const now = Date.now();
-    const index = Math.floor(now / windowMs);
-    let entry = memoryCounters.get(key);
-    if (!entry) {
-        if (memoryCounters.size >= MEMORY_MAX_KEYS) {
-            memoryCounters.delete(memoryCounters.keys().next().value);
-        }
-        entry = { index, current: 0, previous: 0, windowMs };
-        memoryCounters.set(key, entry);
-    } else if (entry.index !== index) {
-        entry.previous = entry.index === index - 1 ? entry.current : 0;
-        entry.current = 0;
-        entry.index = index;
-    }
-    entry.windowMs = windowMs;
-    const used = slidingCount(entry.previous, entry.current, now, windowMs);
-    const admitted = countedAdmits(used + units, limit, units);
-    entry.current += admitted;
-    return admitted;
-}
-
-async function claimCountRedis(redis, key, limit, windowMs, units) {
-    const now = Date.now();
-    const index = Math.floor(now / windowMs);
-    // The hash tag keeps both windows in one slot, so one MULTI reads both.
-    const current = `ratec:{${key}}:${index}`;
-    const results = await redis
-        .multi()
-        .incrby(current, units)
-        .pexpire(current, 2 * windowMs)
-        .get(`ratec:{${key}}:${index - 1}`)
-        .exec();
-    const used = slidingCount(
-        Number(multiResult(results, 2) ?? 0),
-        Number(multiResult(results, 0)),
-        now,
-        windowMs,
-    );
-    const admitted = countedAdmits(used, limit, units);
-    if (admitted < units) await redis.decrby(current, units - admitted);
-    return admitted;
-}
-
-async function claimCountKv(kv, key, limit, windowMs, units) {
-    const now = Date.now();
-    const index = Math.floor(now / windowMs);
-    const current = `ratec:${key}:${index}`;
-    const [counted, previous] = await Promise.all([
-        kv.incr({
-            key: current,
-            pathAndAmountMap: { '': units },
-            expireAt: Math.ceil((now + 2 * windowMs) / 1000),
-        }),
-        kv.get({ key: `ratec:${key}:${index - 1}` }),
-    ]);
-    const used = slidingCount(
-        Number(previous.res ?? 0),
-        Number(counted.res),
-        now,
-        windowMs,
-    );
-    const admitted = countedAdmits(used, limit, units);
-    if (admitted < units) {
-        await kv.decr({
-            key: current,
-            pathAndAmountMap: { '': units - admitted },
-        });
-    }
-    return admitted;
-}
-
 // -- Redis backend ---------------------------------------------------

 // ioredis MULTI/EXEC reports per-command failures inside the exec() result
@@ -570,10 +475,6 @@ function instrumentBackendPair(name, pair) {
            withSpan('rate_limit.claim', attrs, () =>
                pair.claim(key, limit, windowMs, units),
            ),
-        count: (key, limit, windowMs, units) =>
-            withSpan('rate_limit.count', attrs, () =>
-                pair.count(key, limit, windowMs, units),
-            ),
        acquire: (key, limit) =>
            withSpan('rate_limit.acquire', attrs, () =>
                pair.acquire(key, limit),
@@ -585,7 +486,6 @@ const memoryBackendPair = instrumentBackendPair('memory', {
    rate: checkMemory,
    peek: peekMemory,
    claim: claimMemory,
-    count: claimCountMemory,
    acquire: acquireMemoryConcurrent,
 });

@@ -636,8 +536,6 @@ export function configureRateLimit({
                peekRedis(redis, key, limit, windowMs),
            claim: (key, limit, windowMs, units) =>
                claimRedis(redis, key, limit, windowMs, units),
-            count: (key, limit, windowMs, units) =>
-                claimCountRedis(redis, key, limit, windowMs, units),
            acquire: (key, limit) => acquireRedisConcurrent(redis, key, limit),
        });
    }
@@ -647,8 +545,6 @@ export function configureRateLimit({
            peek: (key, limit) => peekKv(kv, key, limit),
            claim: (key, limit, windowMs, units) =>
                claimKv(kv, key, limit, windowMs, units),
-            count: (key, limit, windowMs, units) =>
-                claimCountKv(kv, key, limit, windowMs, units),
            acquire: (key, limit) => acquireKvConcurrent(kv, key, limit),
        });
    }
@@ -978,32 +874,6 @@ export async function claimRateLimit(key, limit, windowMs, units, backend) {
    }
 }

-/**
- * `claimRateLimit` for budgets measured in many units per call: a claim costs
- * the same however many units it spends (see "Counted claims" above). Its
- * buckets are its own, so a key is only ever claimed one way. Fails open,
- * admitting every unit.
- */
-export async function claimCountedRateLimit(
-    key,
-    limit,
-    windowMs,
-    units,
-    backend,
-) {
-    if (!(units > 0)) return 0;
-    const bk = resolveBackend(backend);
-    try {
-        return await bk.count(key, limit, windowMs, units);
-    } catch (err) {
-        console.error(
-            '[rate-limit] imperative counted claim failed, failing open:',
-            err,
-        );
-        return units;
-    }
-}
-
 /**
 * Charge a route-shaped rate-limit spec from inside a handler.
 *
@@ -1179,8 +1049,8 @@ export function concurrencyGate(opts) {
 * Acquire a concurrent slot for a driver call. Mirrors `checkDriverRateLimit`
 * but returns an acquisition handle: caller MUST invoke `release()` on the
 * returned object exactly once, even on thrown errors — typically in a
- * `finally`. `renew()` keeps a long-held slot past the orphan TTL. `ok: false`
- * means the slot was full; callers should reject with 429 in that case.
+ * `finally`. `ok: false` means the slot was full; callers should reject with
+ * 429 in that case.
 *
 * `opts` is the resolved per-method spec from the driver's decorator (or
 * imperative `concurrent` field). Omitting `opts` (driver declares nothing)
@@ -1190,7 +1060,7 @@ export function concurrencyGate(opts) {
 */
 export async function acquireDriverConcurrent(req, ifaceName, method, opts) {
    if (!opts || typeof opts.limit !== 'number') {
-        return { ok: true, release: noop, renew: noop };
+        return { ok: true, release: noop };
    }
    const slot = await charge(
        req,
@@ -1202,7 +1072,8 @@ export async function acquireDriverConcurrent(req, ifaceName, method, opts) {
            label: '[concurrent] driver acquire',
        },
    );
-    if (!slot) return { ok: true, release: noop, renew: noop };
-    if (!slot.ok) return { ok: false, release: noop, renew: noop };
-    return guardSlot(slot, '[concurrent] driver');
+    if (!slot) return { ok: true, release: noop };
+    if (!slot.ok) return { ok: false, release: noop };
+    const { release } = guardSlot(slot, '[concurrent] driver');
+    return { ok: true, release };
 }
@@ -37,7 +37,6 @@ import {
    acquireDriverConcurrent,
    checkDriverRateLimit,
    checkRateLimit,
-    claimCountedRateLimit,
    claimRateLimit,
    concurrencyGate,
    consumeRouteRateLimit,
@@ -1488,13 +1487,6 @@ describe('rate + concurrent limiting — kv backend', () => {
        expect(await claimRateLimit(key, 5, 60_000, 1)).toBe(0);
    });

-    it('claims counted units, admitting only what fits', async () => {
-        const key = uniqueScope();
-        expect(await claimCountedRateLimit(key, 5, 60_000, 3)).toBe(3);
-        expect(await claimCountedRateLimit(key, 5, 60_000, 3)).toBe(2);
-        expect(await claimCountedRateLimit(key, 5, 60_000, 1)).toBe(0);
-    });
-
    it('claims against a full bucket as full while expired rows are unswept', async () => {
        const key = uniqueScope();
        await seedUnswept(`rate:${key}:`, 3);
@@ -2018,103 +2010,6 @@ describe('acquireConcurrent (imperative)', () => {
    });
 });

-describe('claimCountedRateLimit', () => {
-    const uniqueKey = () =>
-        `counted-${Math.random().toString(36).slice(2, 10)}`;
-    const WINDOW = 10_000;
-    /** The start of a fixed window, so nothing before it carries in. */
-    const windowStart = (n) => vi.setSystemTime(n * WINDOW);
-
-    afterEach(() => {
-        vi.useRealTimers();
-    });
-
-    describe.each([
-        ['memory', () => configureRateLimit()],
-        [
-            'redis',
-            () =>
-                configureRateLimit({
-                    default: 'redis',
-                    redis: new RedisMock(),
-                }),
-        ],
-    ])('%s backend', (_name, configure) => {
-        beforeEach(() => {
-            configure();
-            vi.useFakeTimers({ toFake: ['Date'] });
-            windowStart(1_000);
-        });
-
-        it('admits up to the limit and spends only what fits', async () => {
-            const key = uniqueKey();
-            expect(await claimCountedRateLimit(key, 5, WINDOW, 3)).toBe(3);
-            expect(await claimCountedRateLimit(key, 5, WINDOW, 3)).toBe(2);
-            expect(await claimCountedRateLimit(key, 5, WINDOW, 1)).toBe(0);
-        });
-
-        it('spends thousands of units in one claim', async () => {
-            const key = uniqueKey();
-            expect(
-                await claimCountedRateLimit(key, 15_000, WINDOW, 6_000),
-            ).toBe(6_000);
-            expect(
-                await claimCountedRateLimit(key, 15_000, WINDOW, 10_000),
-            ).toBe(9_000);
-        });
-
-        it('carries the previous window by how much of it is still inside', async () => {
-            const key = uniqueKey();
-            expect(await claimCountedRateLimit(key, 100, WINDOW, 100)).toBe(
-                100,
-            );
-            // A quarter into the next window, 75 of those still count.
-            vi.setSystemTime(1_001 * WINDOW + WINDOW / 4);
-            expect(await claimCountedRateLimit(key, 100, WINDOW, 50)).toBe(25);
-            // Two windows on, nothing carries.
-            windowStart(1_003);
-            expect(await claimCountedRateLimit(key, 100, WINDOW, 100)).toBe(
-                100,
-            );
-        });
-
-        it('keeps its buckets apart from claimRateLimit', async () => {
-            const key = uniqueKey();
-            expect(await claimCountedRateLimit(key, 2, WINDOW, 2)).toBe(2);
-            expect(await claimRateLimit(key, 2, WINDOW, 2)).toBe(2);
-        });
-    });
-
-    it('claims nothing for zero units', async () => {
-        const key = uniqueKey();
-        expect(await claimCountedRateLimit(key, 1, WINDOW, 0)).toBe(0);
-        expect(await claimCountedRateLimit(key, 1, WINDOW, 1)).toBe(1);
-    });
-
-    it('fails open, admitting every unit, when the backend throws', async () => {
-        const redis = new RedisMock();
-        redis.multi = () => {
-            throw new Error('redis down');
-        };
-        configureRateLimit({ default: 'redis', redis });
-        const spy = vi.spyOn(console, 'error').mockImplementation(() => {});
-        expect(await claimCountedRateLimit(uniqueKey(), 1, WINDOW, 4)).toBe(4);
-        spy.mockRestore();
-    });
-
-    it('drops a memory counter once its windows have passed', async () => {
-        configureRateLimit();
-        vi.useFakeTimers({ toFake: ['Date'] });
-        windowStart(2_000);
-        const key = uniqueKey();
-        expect(await claimCountedRateLimit(key, 1, WINDOW, 1)).toBe(1);
-        windowStart(2_002);
-        sweepMemoryWindows();
-        windowStart(2_000);
-        expect(await claimCountedRateLimit(key, 1, WINDOW, 1)).toBe(1);
-    });
-});
-
 describe('claimRateLimit', () => {
    const uniqueKey = () => `claim-${Math.random().toString(36).slice(2, 10)}`;

@@ -104,8 +104,6 @@ const default_user_permissions = {
    // is there; which app may is the per-app grant, which is what the user is
    // actually asked about.
    'events:background': {},
-    // Likewise, the per-app grant decides whose notifications go out as pushes.
-    'notifications:push': {},
 };

 module.exports = {
@@ -209,7 +209,6 @@ afterAll(async () => {
 const attemptsFor = async (
    model: string,
    thrown: unknown = new Error('upstream down'),
-    extra: { provider?: string; fallback?: boolean } = {},
 ) => {
    createMock.mockRejectedValue(thrown);
    let caught: HttpError | undefined;
@@ -218,7 +217,6 @@ const attemptsFor = async (
            driver.complete({
                model,
                messages: [{ role: 'user', content: 'hi' }],
-                ...extra,
            }),
        );
    } catch (e) {
@@ -888,59 +886,6 @@ describe('ChatCompletionDriver duplicate-model fallback', () => {
    });
 });

-describe('ChatCompletionDriver fallback opt-out', () => {
-    const SHARED = 'deepseek-v4-pro';
-
-    it('fails on the first route when the caller sets fallback: false', async () => {
-        const attempts = await attemptsFor(SHARED, undefined, {
-            fallback: false,
-        });
-
-        expect(attempts).toHaveLength(1);
-        expect(attempts[0]).toMatchObject({ provider: 'deepseek' });
-    });
-
-    it('tries only the pinned provider', async () => {
-        const attempts = await attemptsFor(SHARED, undefined, {
-            provider: 'openrouter',
-            fallback: false,
-        });
-
-        expect(attempts).toHaveLength(1);
-        expect(attempts[0]).toMatchObject({ provider: 'openrouter' });
-    });
-
-    it('rejects a pinned provider that has no route for the model', async () => {
-        createMock.mockClear();
-        await expect(
-            withTestActor(() =>
-                driver.complete({
-                    model: SHARED,
-                    provider: 'claude',
-                    fallback: false,
-                    messages: [{ role: 'user', content: 'hi' }],
-                }),
-            ),
-        ).rejects.toMatchObject({ statusCode: 400 });
-        expect(createMock).not.toHaveBeenCalled();
-    });
-
-    it('still marks the failed route for the next caller', async () => {
-        const [only] = await attemptsFor(SHARED, undefined, {
-            fallback: false,
-        });
-
-        expect(isRouteUnhealthy(only.provider, only.model)).toBe(true);
-    });
-
-    it('keeps the chain when fallback is true or unset', async () => {
-        expect(
-            await attemptsFor(SHARED, undefined, { fallback: true }),
-        ).toHaveLength(3);
-        expect(await attemptsFor(SHARED)).toHaveLength(3);
-    });
-});
-
 // Each attempt in a fallback chain is a whole completion at that model's
 // prices, so each one has to clear the credit gate on its own. The chain used
 // to re-check with a nominal 1-microcent amount, which any account with a
@@ -709,20 +709,6 @@ export class ChatCompletionDriver extends PuterDriver {
                legacyCode: 'bad_request',
            });
        }
-        // A pinned provider without a route for the model normally resolves
-        // to another vendor; with `fallback: false` that is the one thing the
-        // caller asked us not to do.
-        if (
-            args.fallback === false &&
-            intendedProvider &&
-            model.provider !== intendedProvider
-        ) {
-            throw new HttpError(
-                400,
-                `Model ${args.model} is not served by provider ${intendedProvider}`,
-                { legacyCode: 'bad_request' },
-            );
-        }

        args.messages = normalizeMediaParts(normalize_messages(args.messages));
        if (args.tools) {
@@ -830,9 +816,6 @@ export class ChatCompletionDriver extends PuterDriver {
        // where "done" is the stream draining rather than this method
        // returning.
        let hold: CreditHold = NO_CREDIT_HOLD;
-        // The gate's estimate for the current attempt: the message estimate
-        // plus whatever its provider reads back as prompt beyond the messages.
-        let attemptPromptTokenEstimate = promptTokenEstimate;
        // The current attempt's balance-bound output cap, if it had one.
        let fundsCap: number | undefined;
        // The cost factor the current attempt's charges are recorded at.
@@ -841,16 +824,12 @@ export class ChatCompletionDriver extends PuterDriver {
        // charge, so a rate change mid-request can't split the two.
        let pricingTime = new Date();
        if (!useFakeProvider) {
-            ({
-                hold,
-                fundsCap,
-                costFactor,
-                promptTokenEstimate: attemptPromptTokenEstimate,
-            } = await this.#applyCreditGate(actor, model, args, {
-                promptTokenEstimate,
-                requestedMaxTokens,
-                pricingTime,
-            }));
+            ({ hold, fundsCap, costFactor } = await this.#applyCreditGate(
+                actor,
+                model,
+                args,
+                { promptTokenEstimate, requestedMaxTokens, pricingTime },
+            ));
        }

        // First attempt
@@ -960,15 +939,8 @@ export class ChatCompletionDriver extends PuterDriver {
            const bucketKey = model.id;
            const tried = new Set([routeId(model.provider!, model.id)]);
            let lastError: Error | null = e as Error;
-            // With `fallback: false` the caller wants this route's answer or
-            // its error, not a bill for another provider's attempt.
-            const fallbackAllowed = args.fallback !== false;

-            while (
-                fallbackAllowed &&
-                lastError &&
-                attempts.length < MAX_ATTEMPTS
-            ) {
+            while (lastError && attempts.length < MAX_ATTEMPTS) {
                const fallback = this.#findFallback(bucketKey, tried);
                if (!fallback) break;

@@ -985,16 +957,12 @@ export class ChatCompletionDriver extends PuterDriver {
                // this one starts from nothing held.
                pricingTime = new Date();
                if (!useFakeProvider) {
-                    ({
-                        hold,
-                        fundsCap,
-                        costFactor,
-                        promptTokenEstimate: attemptPromptTokenEstimate,
-                    } = await this.#applyCreditGate(actor, fallback, args, {
-                        promptTokenEstimate,
-                        requestedMaxTokens,
-                        pricingTime,
-                    }));
+                    ({ hold, fundsCap, costFactor } =
+                        await this.#applyCreditGate(actor, fallback, args, {
+                            promptTokenEstimate,
+                            requestedMaxTokens,
+                            pricingTime,
+                        }));
                }

                tried.add(routeId(fallback.provider!, fallback.id));
@@ -1220,7 +1188,7 @@ export class ChatCompletionDriver extends PuterDriver {
                                actor,
                                chatStream,
                                model,
-                                promptTokenEstimate: attemptPromptTokenEstimate,
+                                promptTokenEstimate,
                                completionId,
                                username,
                                intendedProvider,
@@ -1464,16 +1432,10 @@ export class ChatCompletionDriver extends PuterDriver {
            /** The instant this attempt is priced at. */
            pricingTime: Date;
        },
-    ): Promise<{
-        hold: CreditHold;
-        fundsCap?: number;
-        costFactor: number;
-        /** The prompt estimate this attempt was priced on. */
-        promptTokenEstimate: number;
-    }> {
+    ): Promise<{ hold: CreditHold; fundsCap?: number; costFactor: number }> {
        const metering = this.services.metering;
-        const { requestedMaxTokens, pricingTime } = estimates;
-        let { promptTokenEstimate } = estimates;
+        const { promptTokenEstimate, requestedMaxTokens, pricingTime } =
+            estimates;
        // A provider can name its own cost keys for this request (Claude's
        // fast-mode rate card), cap its output, and size an extra reservation
        // the per-token math can't see (a web-search/advisor tool that could
@@ -1484,7 +1446,6 @@ export class ChatCompletionDriver extends PuterDriver {
            this.#providers[model.provider!]?.requestPricing?.(args, model, {
                promptTokenEstimate,
            }) ?? {};
-        promptTokenEstimate += pricing.additionalPromptTokens ?? 0;
        const { inputKey: defaultInputKey, outputKey: defaultOutputKey } =
            costKeys(model);
        const inputKey = pricing.inputKey ?? defaultInputKey;
@@ -1599,7 +1560,7 @@ export class ChatCompletionDriver extends PuterDriver {
            actor,
            Math.max(worstCaseCost, minimumCredits),
        );
-        return { hold, fundsCap, costFactor, promptTokenEstimate };
+        return { hold, fundsCap, costFactor };
    }

    /** The key `model`'s usage is recorded and cost-factored under. */
@@ -194,9 +194,7 @@ export class OpenAICompatProvider implements IChatProvider {
            await OpenAIUtil.process_input_messages(messages, {
                preserveToolCallOrder: this.preservesToolCallOrder(model),
                keepExtraContent: this.keepsToolCallExtraContent(model),
-                keepAssistantContent: this.preservesAssistantContent(model),
            }),
-            model,
        );

        const tools = args.tools
@@ -326,19 +324,8 @@ export class OpenAICompatProvider implements IChatProvider {
        return false;
    }

-    /**
-     * Whether a replayed assistant turn keeps its text beside hoisted tool
-     * calls.
-     */
-    protected preservesAssistantContent(_model: IChatModel): boolean {
-        return false;
-    }
-
    /** Last pass over the messages, after `process_input_messages`. */
-    protected prepareMessages(
-        messages: PuterMessage[],
-        _model: IChatModel,
-    ): PuterMessage[] {
+    protected prepareMessages(messages: PuterMessage[]): PuterMessage[] {
        return messages;
    }

@@ -809,11 +809,6 @@ describe('Alibaba official catalog', () => {
        expect(models.some((model) => model.id === 'qwen-image-fixture')).toBe(
            false,
        );
-        const fixture = models.find(
-            (model) => model.id === 'qwen-catalog-fixture',
-        )!;
-        expect(fixture.puterId).toBe('alibaba:qwen/qwen-catalog-fixture');
-        expect(modelLookupNames(models)).toContain('qwen-catalog-fixture');
        const plus = models.find((model) => model.id === 'qwen-plus')!;
        const original = ALIBABA_MODELS.find(
            (model) => model.id === 'qwen-plus',
@@ -914,115 +909,6 @@ describe('Alibaba official catalog', () => {
        expect(model.costs).toEqual({ tokens: 1_000_000 });
    });

-    it.each([
-        ['qwen3.9-plus-2027-01-01', 'alibaba:qwen/qwen3.9-plus-2027-01-01'],
-        ['kimi/kimi-k3', 'alibaba:kimi/kimi-k3'],
-        [
-            'deepseek-v4.1-flash-1017',
-            'alibaba:deepseek/deepseek-v4.1-flash-1017',
-        ],
-        ['glm-5.3-prime', 'alibaba:zhipu/glm-5.3-prime'],
-        ['decision-model-preview', 'alibaba:qwen/decision-model-preview'],
-    ])(
-        'gives uncurated model %s a puterId in the alibaba:<vendor>/<id> form',
-        (id, puterId) => {
-            const model = mapAlibabaCatalogModel({
-                model: id,
-                capabilities: ['TG'],
-            })!;
-            expect(model.puterId).toBe(puterId);
-        },
-    );
-
-    it('skips a vendor-prefixed spelling of a curated model', () => {
-        const model = mapAlibabaCatalogModel({
-            model: 'zhipu/glm-5.2',
-            capabilities: ['TG', 'Reasoning'],
-            inference_metadata: {
-                request_modality: ['Text'],
-                response_modality: ['Text'],
-            },
-        });
-        expect(model).toBeNull();
-    });
-
-    it.each([
-        [
-            'ASR',
-            {
-                capabilities: ['ASR'],
-                inference_metadata: {
-                    request_modality: ['Audio'],
-                    response_modality: ['Text'],
-                },
-            },
-        ],
-        [
-            'rerank',
-            {
-                capabilities: ['TR'],
-                inference_metadata: {
-                    request_modality: ['Text'],
-                    response_modality: ['Text'],
-                },
-            },
-        ],
-        [
-            'image generation',
-            {
-                capabilities: ['IG'],
-                inference_metadata: {
-                    request_modality: ['Text'],
-                    response_modality: ['Text', 'Image'],
-                },
-            },
-        ],
-        [
-            'realtime omni',
-            {
-                capabilities: ['Realtime-Omni'],
-                inference_metadata: {
-                    request_modality: ['Text', 'Image', 'Audio', 'Video'],
-                    response_modality: ['Text', 'Audio'],
-                },
-            },
-        ],
-        [
-            'TTS',
-            {
-                capabilities: ['TTS'],
-                inference_metadata: {
-                    request_modality: ['Audio'],
-                    response_modality: ['Text'],
-                },
-            },
-        ],
-    ])('rejects %s models that cannot serve chat completions', (_kind, raw) => {
-        expect(
-            mapAlibabaCatalogModel({
-                model: 'non-chat-fixture',
-                ...(raw as AlibabaApiModel),
-            }),
-        ).toBeNull();
-    });
-
-    it('admits a vision model', () => {
-        const model = mapAlibabaCatalogModel({
-            model: 'vision-fixture',
-            capabilities: ['VU'],
-            inference_metadata: {
-                request_modality: ['Text', 'Image'],
-                response_modality: ['Text'],
-            },
-        })!;
-        expect(model.modalities?.input).toEqual(['text', 'image']);
-    });
-
-    it('does not admit an uncurated entry without capability or modality data', () => {
-        expect(mapAlibabaCatalogModel({ model: 'mystery-model' })).toBeNull();
-        expect(mapAlibabaCatalogModel({ model: 'qwen-plus' })).not.toBeNull();
-    });
-
    it('refuses inference with unverified catalog prices', async () => {
        seedPages();
        const { provider } = makeProvider();
@@ -82,23 +82,6 @@ const positiveLimit = (value: unknown): number | undefined =>
        ? value
        : undefined;

-const chatCapabilities = ['TG', 'Reasoning', 'VU'];
-
-const curatedPuterIds = new Set(ALIBABA_MODELS.map((model) => model.puterId));
-
-const inferPuterId = (id: string): string => {
-    if (id.includes('/')) return `alibaba:${id}`;
-    const family = id.split('-')[0];
-    const sibling = ALIBABA_MODELS.find(
-        (model) => model.puterId && model.id.split('-')[0] === family,
-    );
-    // Unprefixed feed ids are Model Studio's own family unless a curated
-    // sibling points at a third-party org.
-    const org =
-        sibling?.puterId?.slice('alibaba:'.length).split('/')[0] ?? 'qwen';
-    return `alibaba:${org}/${id}`;
-};
-
 export const mapAlibabaCatalogModel = (
    raw: AlibabaApiModel,
    previous?: IChatModel,
@@ -107,25 +90,16 @@ export const mapAlibabaCatalogModel = (
    const id = raw.model.trim();
    const existing =
        previous ?? ALIBABA_MODELS.find((model) => model.id === id);
-    const input = raw.inference_metadata?.request_modality;
    const output = raw.inference_metadata?.response_modality;
+    if (output && !output.includes('Text')) return null;
    if (
-        raw.capabilities &&
-        !raw.capabilities.some((capability) =>
-            chatCapabilities.includes(capability),
+        !output &&
+        !existing &&
+        !raw.capabilities?.some((capability) =>
+            ['TG', 'Reasoning', 'VU'].includes(capability),
        )
    )
        return null;
-    if (input && !input.includes('Text')) return null;
-    if (output && !output.includes('Text')) return null;
-    if (!raw.capabilities && !input && !output && !existing) return null;
-    let puterId = existing?.puterId;
-    if (!puterId) {
-        puterId = inferPuterId(id);
-        // A feed entry spelling a curated model differently would duplicate
-        // the curated entry's puterId and list the model twice.
-        if (curatedPuterIds.has(puterId)) return null;
-    }
    const catalogPricing: AlibabaCatalogTier[] = (raw.prices ?? []).map(
        (tier) => {
            // Abbreviated ranges do not specify whether k means 1000 or 1024 tokens.
@@ -175,7 +149,6 @@ export const mapAlibabaCatalogModel = (
    return {
        ...existing,
        id,
-        puterId,
        name: raw.name ?? existing?.name ?? id,
        description: raw.description ?? existing?.description,
        aliases: existing?.aliases,
@@ -20,8 +20,8 @@
 /**
 * Integration test for the Moonshot provider.
 *
- * Uses `kimi-k2.6` (the cheapest current Kimi model) and `kimi-k3.1-pro`.
- * Skipped when `PUTER_TEST_AI_MOONSHOT_API_KEY` is unset.
+ * Uses `kimi-k2.6` (the cheapest current Kimi model). Skipped
+ * when `PUTER_TEST_AI_MOONSHOT_API_KEY` is unset.
 */

 import { describe, expect, it } from 'vitest';
@@ -59,36 +59,5 @@ describe.skipIf(skipUnlessEnv(ENV_VAR))(
                ?.content;
            expect(typeof text === 'string' && text.length > 0).toBe(true);
        });
-
-        it('returns a completion and cache usage from kimi-k3.1-pro', { timeout: INTEGRATION_TEST_TIMEOUT_MS }, async () => {
-            const provider = new MoonshotProvider(
-                { apiKey: optionalEnv(ENV_VAR)! },
-                makeMeteringStub(),
-            );
-
-            const result = (await withTestActor(() =>
-                provider.complete({
-                    model: 'kimi-k3.1-pro',
-                    messages: [
-                        { role: 'user', content: 'Say hi in one word.' },
-                    ],
-                    // Reasoning counts against the cap, so leave room for it.
-                    max_tokens: 2048,
-                    reasoning_effort: 'low',
-                }),
-            )) as {
-                message?: { content?: string };
-                usage?: Record<string, number>;
-            };
-
-            const text = result.message?.content;
-            expect(typeof text === 'string' && text.length > 0).toBe(true);
-            expect(result.usage).toMatchObject({
-                prompt_tokens: expect.any(Number),
-                completion_tokens: expect.any(Number),
-                cached_tokens: expect.any(Number),
-                cache_write_tokens: expect.any(Number),
-            });
-        });
    },
 );
@@ -20,15 +20,17 @@
 /**
 * Offline unit tests for MoonshotProvider.
 *
- * Boots a real PuterServer (in-memory sqlite + dynamo + s3 + mock redis) and
- * constructs MoonshotProvider directly against the live wired `MeteringService`
- * so the recording side is exercised end-to- end. Moonshot is OpenAI-compatible
- * so the OpenAI SDK is mocked at the module boundary; that's the real network
- * egress point. Image- inlining behaviour is covered by
- * `utils/inlineImages.test.ts`; here we stub `inlineHttpImageUrls` so http URLs
- * in vision messages don't trigger network fetches and only verify the provider
- * invokes it for vision-capable models. The companion integration test
- * (MoonshotProvider.integration.test.ts) exercises the real Moonshot endpoint.
+ * Boots a real PuterServer (in-memory sqlite + dynamo + s3 + mock
+ * redis) and constructs MoonshotProvider directly against the live
+ * wired `MeteringService` so the recording side is exercised end-to-
+ * end. Moonshot is OpenAI-compatible so the OpenAI SDK is mocked at
+ * the module boundary; that's the real network egress point. Image-
+ * inlining behaviour is covered by `utils/inlineImages.test.ts`; here we
+ * stub `inlineHttpImageUrls` so http URLs in vision messages don't
+ * trigger network fetches and only verify the provider invokes it
+ * for vision-capable models. The companion integration test
+ * (MoonshotProvider.integration.test.ts) exercises the real Moonshot
+ * endpoint.
 */

 import { Writable } from 'node:stream';
@@ -44,23 +46,14 @@ import {
    type MockInstance,
 } from 'vitest';

-import { ChatCompletionDriver } from '../../ChatCompletionDriver.js';
-import { clearUnhealthyRoutes } from '../../utils/providerHealth.js';
 import { SYSTEM_ACTOR } from '../../../../core/actor.js';
 import type { MeteringService } from '../../../../services/metering/MeteringService.js';
 import { PuterServer } from '../../../../server.js';
 import { setupTestServer } from '../../../../testUtil.js';
-import {
-    readStreamResult,
-    withTestActor,
-} from '../../../integrationTestUtil.js';
+import { withTestActor } from '../../../integrationTestUtil.js';
 import { AIChatStream } from '../../utils/Streaming.js';
 import { MOONSHOT_MODELS } from './models.js';
 import { MoonshotProvider } from './MoonshotProvider.js';
-import {
-    estimatePromptTokens,
-    estimateTextTokens,
-} from '../../utils/usageEstimate.js';
 import { modelLookupNames } from '../../utils/modelRouting.js';

 // ── OpenAI SDK mock ─────────────────────────────────────────────────
@@ -100,23 +93,10 @@ vi.mock('../../utils/inlineImages.js', () => ({
 // ── Test harness ────────────────────────────────────────────────────

 let server: PuterServer;
-let driver: ChatCompletionDriver;
 let recordSpy: MockInstance<MeteringService['utilRecordUsageObject']>;

 beforeAll(async () => {
    server = await setupTestServer();
-    driver = new ChatCompletionDriver(
-        {
-            providers: {
-                moonshot: { apiKey: 'test-key' },
-                ollama: { enabled: false },
-            },
-        } as never,
-        server.clients,
-        server.stores,
-        server.services,
-    );
-    await driver.onServerStart();
 });

 afterAll(async () => {
@@ -160,7 +140,6 @@ const makeCapturingChatStream = () => {
 };

 beforeEach(() => {
-    clearUnhealthyRoutes();
    createMock.mockReset();
    openAICtor.mockReset();
    inlineHttpImageUrlsMock.mockReset();
@@ -411,10 +390,7 @@ describe('MoonshotProvider image inlining', () => {
        await withTestActor(() =>
            provider.complete({
                model: 'kimi-k3', // kimi-k3 declares image input modality
-                messages: messages as unknown as {
-                    role: string;
-                    content: unknown;
-                }[],
+                messages: messages as unknown as { role: string; content: unknown }[],
            }),
        );

@@ -806,656 +782,3 @@ describe('MoonshotProvider.checkModeration', () => {
        );
    });
 });
-
-describe('Kimi K3.1 Pro', () => {
-    const models = ['kimi-k3.1-pro', 'kimi-k3.1-pro-highspeed'];
-    /** Catalog rates in µ¢ per token: $2/$10 for Pro, $4/$20 for Highspeed. */
-    const rates = (model: string) =>
-        model.endsWith('highspeed')
-            ? { input: 400, output: 2000 }
-            : { input: 200, output: 1000 };
-    const usage = {
-        prompt_tokens: 100,
-        completion_tokens: 10,
-        prompt_tokens_details: { cached_tokens: 20, cache_write_tokens: 50 },
-    };
-    const response = () => ({
-        choices: [
-            {
-                message: {
-                    role: 'assistant',
-                    content: 'answer',
-                    reasoning_content: 'reasoning',
-                },
-                finish_reason: 'stop',
-            },
-        ],
-        usage: structuredClone(usage),
-    });
-    const fund = (balance: number) =>
-        vi.spyOn(
-            server.services.metering,
-            'getUsageHeadroom',
-        ).mockResolvedValue({ balance, held: 0 });
-    const user = (content: string) => [{ role: 'user', content }];
-
-    it.each(models)(
-        'maps %s caps and reasoning without sampling parameters',
-        async (model) => {
-            const { provider } = makeProvider();
-            createMock.mockResolvedValueOnce(response());
-            await withTestActor(() =>
-                provider.complete({
-                    model,
-                    messages: user('hi'),
-                    max_tokens: 512,
-                    reasoning_effort: 'high',
-                    temperature: 0.2,
-                    top_p: 0.1,
-                }),
-            );
-            const sent = createMock.mock.calls[0]![0];
-            expect(sent).toMatchObject({
-                model,
-                max_completion_tokens: 512,
-                reasoning_effort: 'high',
-            });
-            expect(sent).not.toHaveProperty('max_tokens');
-            expect(sent).not.toHaveProperty('temperature');
-            expect(sent).not.toHaveProperty('top_p');
-        },
-    );
-
-    it('uses the upstream default output cap and leaves thinking to the model', async () => {
-        const { provider } = makeProvider();
-        createMock.mockResolvedValueOnce(response());
-        await withTestActor(() =>
-            provider.complete({ model: models[0]!, messages: user('hi') }),
-        );
-        const sent = createMock.mock.calls[0]![0];
-        expect(sent.max_completion_tokens).toBe(131072);
-        expect(sent).not.toHaveProperty('thinking');
-        expect(sent).not.toHaveProperty('reasoning_effort');
-    });
-
-    it.each(['low', 'max'] as const)(
-        'forwards %s reasoning effort',
-        async (effort) => {
-            const { provider } = makeProvider();
-            createMock.mockResolvedValueOnce(response());
-            await withTestActor(() =>
-                provider.complete({
-                    model: models[0]!,
-                    messages: user('hi'),
-                    reasoning_effort: effort,
-                }),
-            );
-            expect(createMock.mock.calls[0]![0].reasoning_effort).toBe(effort);
-        },
-    );
-
-    it('rejects an unsupported reasoning effort before inference', async () => {
-        const { provider } = makeProvider();
-        await expect(
-            withTestActor(() =>
-                provider.complete({
-                    model: models[0]!,
-                    messages: user('hi'),
-                    reasoning_effort: 'medium',
-                }),
-            ),
-        ).rejects.toMatchObject({ statusCode: 400 });
-        expect(createMock).not.toHaveBeenCalled();
-    });
-
-    it.each([
-        { options: { reasoning: { effort: 'low' } }, expected: 'low' },
-        { options: { reasoning: { effort: 'max' } }, expected: 'max' },
-        {
-            options: { reasoning: { effort: 'low' }, reasoning_effort: 'high' },
-            expected: 'high',
-        },
-        { options: {}, expected: undefined },
-    ])(
-        'sends the nested reasoning form through the driver: $options',
-        async ({ options, expected }) => {
-            createMock.mockResolvedValueOnce(response());
-            await withTestActor(() =>
-                driver.complete({
-                    model: models[0]!,
-                    provider: 'moonshotai',
-                    messages: user('hi'),
-                    ...options,
-                } as never),
-            );
-            expect(createMock).toHaveBeenCalledTimes(1);
-            expect(createMock.mock.calls[0]![0].reasoning_effort).toBe(
-                expected,
-            );
-        },
-    );
-
-    it.each(['medium', 'none'])(
-        'rejects the nested reasoning form %s through the driver',
-        async (effort) => {
-            await expect(
-                withTestActor(() =>
-                    driver.complete({
-                        model: models[0]!,
-                        provider: 'moonshotai',
-                        messages: user('hi'),
-                        reasoning: { effort },
-                    } as never),
-                ),
-            ).rejects.toMatchObject({
-                statusCode: 400,
-                legacyCode: 'bad_request',
-            });
-            expect(createMock).not.toHaveBeenCalled();
-        },
-    );
-
-    it('keeps K3 on max_tokens and bills its cache writes at the K3 write rate', async () => {
-        const { provider } = makeProvider();
-        createMock.mockResolvedValueOnce(response());
-        await withTestActor(() =>
-            provider.complete({
-                model: 'kimi-k3',
-                messages: user('hi'),
-                max_tokens: 512,
-            }),
-        );
-        const sent = createMock.mock.calls[0]![0];
-        expect(sent).toMatchObject({ model: 'kimi-k3', max_tokens: 512 });
-        expect(sent).not.toHaveProperty('max_completion_tokens');
-        expect(recordSpy).toHaveBeenCalledWith(
-            {
-                prompt_tokens: 30,
-                completion_tokens: 10,
-                cached_tokens: 20,
-                cache_write_tokens: 50,
-            },
-            expect.anything(),
-            'moonshotai:kimi-k3',
-            {
-                prompt_tokens: 30 * 300,
-                completion_tokens: 10 * 1500,
-                cached_tokens: 20 * 30,
-                cache_write_tokens: 50 * 300,
-            },
-        );
-    });
-
-    it.each(models)(
-        'meters cache reads, writes and uncached input separately for %s',
-        async (model) => {
-            const { provider } = makeProvider();
-            createMock.mockResolvedValueOnce(response());
-            const result = await withTestActor(() =>
-                provider.complete({ model, messages: user('hi') }),
-            );
-            const { input, output } = rates(model);
-            expect(recordSpy).toHaveBeenCalledWith(
-                {
-                    prompt_tokens: 30,
-                    completion_tokens: 10,
-                    cached_tokens: 20,
-                    cache_write_tokens: 50,
-                },
-                expect.anything(),
-                `moonshotai:${model}`,
-                {
-                    prompt_tokens: 30 * input,
-                    completion_tokens: 10 * output,
-                    cached_tokens: 20 * 20,
-                    cache_write_tokens: 50 * input,
-                },
-            );
-            expect(result).toMatchObject({
-                usageDetails: {
-                    inputTokens: 30,
-                    outputTokens: 10,
-                    cacheReadTokens: 20,
-                    cacheWrite5mTokens: 50,
-                },
-            });
-        },
-    );
-
-    it('preserves assistant reasoning, text and tool-call order on replay', async () => {
-        const { provider } = makeProvider();
-        const toolCalls = ['a', 'b'].map((id) => ({
-            id,
-            type: 'function',
-            function: { name: 'lookup', arguments: '{}' },
-        }));
-        const first = response();
-        Object.assign(first.choices[0]!.message, { tool_calls: toolCalls });
-        createMock.mockResolvedValueOnce(first);
-        const result = await withTestActor(() =>
-            provider.complete({ model: models[0]!, messages: user('hi') }),
-        );
-        createMock.mockResolvedValueOnce(response());
-        await withTestActor(() =>
-            provider.complete({
-                model: models[0]!,
-                messages: [(result as { message: unknown }).message],
-            }),
-        );
-        const replayed = createMock.mock.calls[1]![0].messages[0];
-        expect(replayed).toMatchObject({
-            role: 'assistant',
-            content: 'answer',
-            reasoning_content: 'reasoning',
-        });
-        expect(replayed).not.toHaveProperty('reasoning');
-        expect(replayed.tool_calls).toEqual(toolCalls);
-        createMock.mockResolvedValueOnce(response());
-        await withTestActor(() =>
-            provider.complete({
-                model: models[0]!,
-                messages: [
-                    {
-                        role: 'assistant',
-                        reasoning: 'reasoning',
-                        content: [
-                            { type: 'text', text: 'answer' },
-                            ...['a', 'b'].map((id) => ({
-                                type: 'tool_use',
-                                id,
-                                name: 'lookup',
-                                input: {},
-                            })),
-                        ],
-                    },
-                ],
-            }),
-        );
-        expect(createMock.mock.calls[2]![0].messages[0]).toEqual({
-            role: 'assistant',
-            reasoning_content: 'reasoning',
-            content: [{ type: 'text', text: 'answer' }],
-            tool_calls: toolCalls,
-        });
-    });
-
-    it('meters a stream from its final usage chunk', async () => {
-        const { provider } = makeProvider();
-        createMock.mockResolvedValueOnce(
-            asAsyncIterable([
-                { choices: [{ delta: { reasoning_content: 'reasoning' } }] },
-                { choices: [{ delta: { content: 'answer' } }] },
-                { choices: [], usage: structuredClone(usage) },
-            ]),
-        );
-        const result = await withTestActor(() =>
-            provider.complete({
-                model: models[0]!,
-                messages: user('hi'),
-                stream: true,
-            }),
-        );
-        const harness = makeCapturingChatStream();
-        await (
-            result as {
-                init_chat_stream: (p: { chatStream: unknown }) => Promise<void>;
-            }
-        ).init_chat_stream({ chatStream: harness.chatStream });
-        expect(createMock.mock.calls[0]![0].stream_options).toEqual({
-            include_usage: true,
-        });
-        expect(recordSpy).toHaveBeenCalledTimes(1);
-        expect(recordSpy.mock.calls[0]![0]).toEqual({
-            prompt_tokens: 30,
-            completion_tokens: 10,
-            cached_tokens: 20,
-            cache_write_tokens: 50,
-        });
-    });
-
-    it.each(models)(
-        'reserves the prompt at the input rate for %s',
-        async (model) => {
-            const { input, output } = rates(model);
-            fund(2_000_000_000);
-            const reserve = vi.spyOn(
-                server.services.metering,
-                'reserveCredits',
-            );
-            createMock.mockResolvedValueOnce({
-                choices: [
-                    {
-                        message: { role: 'assistant', content: 'ok' },
-                        finish_reason: 'stop',
-                    },
-                ],
-                usage: {
-                    prompt_tokens: 1_000_000,
-                    completion_tokens: 10,
-                    prompt_tokens_details: {
-                        cached_tokens: 100_000,
-                        cache_write_tokens: 900_000,
-                    },
-                },
-            });
-            await withTestActor(() =>
-                driver.complete({
-                    model,
-                    provider: 'moonshotai',
-                    messages: user('x'.repeat(8_000_000)),
-                    max_tokens: 10,
-                }),
-            );
-            expect(reserve).toHaveBeenCalledTimes(1);
-            expect(reserve.mock.calls[0]![1]).toBeGreaterThanOrEqual(
-                1_000_000 * input + 10 * output,
-            );
-            expect(reserve.mock.calls[0]![1]).toBeLessThan(
-                1_000_001 * input + 10 * output,
-            );
-            expect(recordSpy.mock.calls[0]![0]).toMatchObject({
-                prompt_tokens: 0,
-                completion_tokens: 10,
-                cached_tokens: 100_000,
-                cache_write_tokens: 900_000,
-            });
-        },
-    );
-
-    it.each(['kimi-k3', 'kimi-k2.6'])(
-        'keeps the existing reservation for %s',
-        async (model) => {
-            const entry = MOONSHOT_MODELS.find(
-                (candidate) => candidate.id === model,
-            )!;
-            fund(2_000_000_000);
-            const reserve = vi.spyOn(
-                server.services.metering,
-                'reserveCredits',
-            );
-            createMock.mockResolvedValueOnce(response());
-            await withTestActor(() =>
-                driver.complete({
-                    model,
-                    provider: 'moonshotai',
-                    messages: [
-                        {
-                            role: 'assistant',
-                            content: 'x'.repeat(8000),
-                            reasoning: 'thought '.repeat(90000),
-                        },
-                    ],
-                    max_tokens: 10,
-                }),
-            );
-            expect(reserve.mock.calls[0]![1]).toBe(
-                1000 * Number(entry.costs.prompt_tokens) +
-                    10 * Number(entry.costs.completion_tokens),
-            );
-        },
-    );
-
-    it.each(models)(
-        'rejects an underfunded request for %s before inference',
-        async (model) => {
-            // Short of the prompt alone at the input rate.
-            fund(model.endsWith('highspeed') ? 300_000_000 : 150_000_000);
-            await expect(
-                withTestActor(() =>
-                    driver.complete({
-                        model,
-                        provider: 'moonshotai',
-                        messages: user('x'.repeat(8_000_000)),
-                        max_tokens: 10,
-                    }),
-                ),
-            ).rejects.toMatchObject({ statusCode: 402 });
-            expect(createMock).not.toHaveBeenCalled();
-        },
-    );
-
-    it.each([null, ''])(
-        'round-trips tool-only assistant content %s through the driver',
-        async (content) => {
-            const toolCalls = [
-                {
-                    id: 'call_paris',
-                    type: 'function',
-                    function: {
-                        name: 'weather',
-                        arguments: '{"city":"Paris"}',
-                    },
-                },
-            ];
-            createMock.mockResolvedValueOnce({
-                choices: [
-                    {
-                        message: {
-                            role: 'assistant',
-                            content,
-                            reasoning_content: 'Check weather',
-                            tool_calls: toolCalls,
-                        },
-                        finish_reason: 'tool_calls',
-                    },
-                ],
-                usage: { prompt_tokens: 1, completion_tokens: 1 },
-            });
-            const first = await withTestActor(() =>
-                driver.complete({
-                    model: models[0]!,
-                    provider: 'moonshotai',
-                    messages: user('weather?'),
-                }),
-            );
-            createMock.mockResolvedValueOnce(response());
-            await withTestActor(() =>
-                driver.complete({
-                    model: models[0]!,
-                    provider: 'moonshotai',
-                    messages: [
-                        (first as { message: unknown }).message,
-                        {
-                            role: 'tool',
-                            tool_call_id: 'call_paris',
-                            content: 'sunny',
-                        },
-                    ],
-                }),
-            );
-            const assistant = createMock.mock.calls[1]![0].messages.find(
-                (message: { role: string }) => message.role === 'assistant',
-            );
-            expect(assistant).toMatchObject({
-                role: 'assistant',
-                content: null,
-                reasoning_content: 'Check weather',
-            });
-            expect(assistant).not.toHaveProperty('normalized');
-            expect(assistant.tool_calls).toEqual(toolCalls);
-            expect(
-                JSON.parse(assistant.tool_calls[0].function.arguments),
-            ).toEqual({ city: 'Paris' });
-        },
-    );
-
-    it.each([{ city: 'Paris' }, '{"city":"Paris"}'])(
-        'keeps native tool_use input %j through the driver',
-        async (input) => {
-            createMock.mockResolvedValueOnce(response());
-            await withTestActor(() =>
-                driver.complete({
-                    model: models[0]!,
-                    provider: 'moonshotai',
-                    messages: [
-                        {
-                            role: 'assistant',
-                            reasoning_content: 'Check weather',
-                            content: [
-                                {
-                                    type: 'tool_use',
-                                    id: 'call_paris',
-                                    name: 'weather',
-                                    input,
-                                },
-                            ],
-                        },
-                        {
-                            role: 'tool',
-                            tool_call_id: 'call_paris',
-                            content: 'sunny',
-                        },
-                    ],
-                }),
-            );
-            const assistant = createMock.mock.calls[0]![0].messages.find(
-                (message: { role: string }) => message.role === 'assistant',
-            );
-            expect(assistant.reasoning_content).toBe('Check weather');
-            expect(assistant.tool_calls[0].function.arguments).toBe(
-                '{"city":"Paris"}',
-            );
-        },
-    );
-
-    it.each(
-        models.flatMap((model) =>
-            ['reasoning', 'reasoning_content', 'both'].map((alias) => ({
-                model,
-                alias,
-            })),
-        ),
-    )(
-        'reserves replayed reasoning once with wire precedence: $model $alias',
-        async ({ model, alias }) => {
-            const text = 'reasoning '.repeat(90000);
-            const assistant = {
-                role: 'assistant',
-                content: 'answer',
-                ...(alias !== 'reasoning_content'
-                    ? { reasoning: alias === 'both' ? 'short' : text }
-                    : {}),
-                ...(alias !== 'reasoning' ? { reasoning_content: text } : {}),
-            };
-            const messages = [
-                ...user('hi'),
-                assistant,
-                ...user('continue'),
-            ];
-            const tokens =
-                estimatePromptTokens(messages) + estimateTextTokens(text);
-            const { input, output } = rates(model);
-            const headroom = fund(2_000_000_000);
-            const reserve = vi.spyOn(
-                server.services.metering,
-                'reserveCredits',
-            );
-            createMock.mockResolvedValueOnce(response());
-            await withTestActor(() =>
-                driver.complete({
-                    model,
-                    messages: structuredClone(messages),
-                    max_tokens: 10,
-                }),
-            );
-            expect(reserve.mock.calls[0]![1]).toBe(
-                tokens * input + 10 * output,
-            );
-            expect(
-                createMock.mock.calls[0]![0].messages[1].reasoning_content,
-            ).toBe(text);
-            headroom.mockResolvedValue({
-                balance: tokens * input - 1,
-                held: 0,
-            });
-            await expect(
-                withTestActor(() =>
-                    driver.complete({
-                        model,
-                        messages: structuredClone(messages),
-                        max_tokens: 10,
-                    }),
-                ),
-            ).rejects.toMatchObject({ statusCode: 402 });
-            expect(createMock).toHaveBeenCalledTimes(1);
-            expect(reserve).toHaveBeenCalledTimes(1);
-        },
-    );
-
-    it.each(models)(
-        'charges the estimate, replayed reasoning included, when a %s stream is interrupted',
-        async (model) => {
-            const reasoning = 'history '.repeat(1000);
-            const messages = [
-                {
-                    role: 'assistant',
-                    content: 'answer',
-                    reasoning: 'ignored alias',
-                    reasoning_content: reasoning,
-                },
-                ...user('hi'),
-            ];
-            const expectedInput =
-                estimatePromptTokens(messages) + estimateTextTokens(reasoning);
-            createMock.mockResolvedValueOnce(
-                (async function* () {
-                    yield {
-                        choices: [{ delta: { content: 'partial answer' } }],
-                    };
-                    throw new Error('upstream connection lost');
-                })(),
-            );
-            const result = await withTestActor(() =>
-                driver.complete({
-                    model,
-                    messages: structuredClone(messages),
-                    stream: true,
-                }),
-            );
-            const text = (await readStreamResult(result)).toString();
-            expect(text).toContain('upstream connection lost');
-            await vi.waitFor(() => expect(recordSpy).toHaveBeenCalledTimes(1));
-            expect(
-                createMock.mock.calls[0]![0].messages[0].reasoning_content,
-            ).toBe(reasoning);
-            expect(recordSpy.mock.calls[0]![0]).toHaveProperty(
-                'estimated_prompt_tokens',
-                expectedInput,
-            );
-            expect(recordSpy.mock.calls[0]![0]).toHaveProperty(
-                'estimated_completion_tokens',
-            );
-        },
-    );
-
-    it.each(models)(
-        'charges the estimate when a %s stream completes without a usage chunk',
-        async (model) => {
-            createMock.mockResolvedValueOnce(
-                asAsyncIterable([
-                    { choices: [{ delta: { content: 'answer' } }] },
-                    { choices: [{ delta: {}, finish_reason: 'stop' }] },
-                ]),
-            );
-            const result = await withTestActor(() =>
-                driver.complete({
-                    model,
-                    provider: 'moonshotai',
-                    messages: user('hi'),
-                    stream: true,
-                }),
-            );
-            const events = (await readStreamResult(result))
-                .toString()
-                .trim()
-                .split('\n')
-                .map((line) => JSON.parse(line));
-            expect(events.some((event) => event.type === 'error')).toBe(false);
-            await vi.waitFor(() => expect(recordSpy).toHaveBeenCalledTimes(1));
-            expect(recordSpy.mock.calls[0]![0]).toMatchObject({
-                estimated_prompt_tokens: expect.any(Number),
-                estimated_completion_tokens: expect.any(Number),
-            });
-        },
-    );
-});
@@ -18,39 +18,14 @@
 */

 import { OpenAI } from 'openai';
-import { HttpError } from '../../../../core/http/HttpError.js';
 import type { MeteringService } from '../../../../services/metering/MeteringService.js';
-import type {
-    IChatModel,
-    ICompleteArguments,
-    PuterMessage,
-} from '../../types.js';
-import { openAICompatParams } from '../../utils/openaiParams.js';
 import { sdkClientOptions } from '../../utils/sdkClient.js';
-import { estimateTextTokens } from '../../utils/usageEstimate.js';
 import {
    type ChatProviderConfig,
    OpenAICompatProvider,
 } from '../OpenAICompatProvider.js';
 import { MOONSHOT_MODELS } from './models.js';

-/**
- * The K3-series request shape: reasoning always on, capped by
- * `max_completion_tokens`.
- */
-const K31_MODEL_IDS = new Set(['kimi-k3.1-pro', 'kimi-k3.1-pro-highspeed']);
-const K31_REASONING_EFFORTS = ['low', 'high', 'max'];
-/** Moonshot's own output cap when the request names none. */
-const K31_DEFAULT_MAX_COMPLETION_TOKENS = 131_072;
-
-const isK31 = (model: IChatModel) => K31_MODEL_IDS.has(model.id);
-
-/** A replayed assistant turn's reasoning, under the wire key or Puter's. */
-const replayedReasoning = (message: PuterMessage): string | undefined => {
-    const reasoning = message.reasoning_content ?? message.reasoning;
-    return typeof reasoning === 'string' ? reasoning : undefined;
-};
-
 export class MoonshotProvider extends OpenAICompatProvider {
    constructor(config: ChatProviderConfig, meteringService: MeteringService) {
        super(meteringService, {
@@ -66,79 +41,4 @@ export class MoonshotProvider extends OpenAICompatProvider {
            inlineImages: 'vision',
        });
    }
-
-    /**
-     * K3.1 Pro reads replayed reasoning back as prompt, which the message
-     * estimate the credit gate works from doesn't count.
-     */
-    requestPricing(args: ICompleteArguments, model: IChatModel) {
-        if (!isK31(model)) return {};
-        const additionalPromptTokens = (args.messages ?? []).reduce(
-            (tokens, message) => {
-                if (message.role !== 'assistant') return tokens;
-                const reasoning = replayedReasoning(message);
-                return tokens + (reasoning ? estimateTextTokens(reasoning) : 0);
-            },
-            0,
-        );
-        return { additionalPromptTokens };
-    }
-
-    protected override preservesToolCallOrder(model: IChatModel) {
-        return isK31(model);
-    }
-
-    protected override preservesAssistantContent(model: IChatModel) {
-        return isK31(model);
-    }
-
-    /** K3.1 Pro wants a turn's reasoning back under `reasoning_content`, once. */
-    protected override prepareMessages(
-        messages: PuterMessage[],
-        model: IChatModel,
-    ) {
-        if (!isK31(model)) return messages;
-        return messages.map((message) => {
-            if (message.role !== 'assistant') return message;
-            const { reasoning, normalized: _normalized, ...rest } = message;
-            const replayed = replayedReasoning(message);
-            return replayed === undefined
-                ? rest
-                : { ...rest, reasoning_content: replayed };
-        });
-    }
-
-    protected override vendorParams(
-        params: Record<string, unknown>,
-        args: ICompleteArguments,
-        model: IChatModel,
-    ) {
-        if (!isK31(model)) return params;
-        const effort = args.reasoning_effort ?? args.reasoning?.effort;
-        if (effort !== undefined && !K31_REASONING_EFFORTS.includes(effort)) {
-            throw new HttpError(
-                400,
-                `reasoning_effort must be one of ${K31_REASONING_EFFORTS.join(', ')} for ${model.id}`,
-                { legacyCode: 'bad_request' },
-            );
-        }
-        // The K3 series deprecates `max_tokens` in favour of `max_completion_tokens`.
-        const { max_tokens, ...rest } = params;
-        return {
-            ...rest,
-            ...openAICompatParams(
-                { ...args, reasoning_effort: effort },
-                'chat',
-                {
-                    only: [
-                        'tool_choice',
-                        'response_format',
-                        'reasoning_effort',
-                    ],
-                },
-            ),
-            max_completion_tokens:
-                max_tokens ?? K31_DEFAULT_MAX_COMPLETION_TOKENS,
-        };
-    }
 }
@@ -20,53 +20,6 @@
 import type { IChatModel } from '../../types.js';

 export const MOONSHOT_MODELS: IChatModel[] = [
-    // -- Kimi K3.1 Pro ------------------------------------------------
-    {
-        puterId: 'moonshotai:moonshotai/kimi-k3.1-pro',
-        id: 'kimi-k3.1-pro',
-        name: 'Kimi K3.1 Pro',
-        aliases: ['moonshotai/kimi-k3.1-pro', 'moonshot/kimi-k3.1-pro'],
-        modalities: { input: ['text', 'image', 'video'], output: ['text'] },
-        costs_currency: 'usd-cents',
-        input_cost_key: 'prompt_tokens',
-        output_cost_key: 'completion_tokens',
-        costs: {
-            tokens: 1_000_000,
-            prompt_tokens: 200, // $2.00 per 1M
-            completion_tokens: 1000, // $10.00 per 1M
-            cached_tokens: 20, // $0.20 per 1M
-            cache_write_tokens: 200, // $2.00 per 1M
-        },
-        context: 1_048_576,
-        max_tokens: 1_048_576,
-        tool_call: true,
-        release_date: '2026-10-24',
-    },
-    {
-        puterId: 'moonshotai:moonshotai/kimi-k3.1-pro-highspeed',
-        id: 'kimi-k3.1-pro-highspeed',
-        name: 'Kimi K3.1 Pro Highspeed',
-        aliases: [
-            'moonshotai/kimi-k3.1-pro-highspeed',
-            'moonshot/kimi-k3.1-pro-highspeed',
-        ],
-        modalities: { input: ['text', 'image', 'video'], output: ['text'] },
-        costs_currency: 'usd-cents',
-        input_cost_key: 'prompt_tokens',
-        output_cost_key: 'completion_tokens',
-        costs: {
-            tokens: 1_000_000,
-            prompt_tokens: 400, // $4.00 per 1M
-            completion_tokens: 2000, // $20.00 per 1M
-            cached_tokens: 20, // $0.20 per 1M
-            cache_write_tokens: 400, // $4.00 per 1M
-        },
-        context: 1_048_576,
-        max_tokens: 1_048_576,
-        tool_call: true,
-        release_date: '2026-10-24',
-    },
-
    // -- Flagship ----------------------------------------------------
    {
        puterId: 'moonshotai:moonshotai/kimi-k3',
@@ -82,7 +35,6 @@ export const MOONSHOT_MODELS: IChatModel[] = [
            prompt_tokens: 300, // $3.00 per 1M
            completion_tokens: 1500, // $15.00 per 1M
            cached_tokens: 30, // $0.30 per 1M
-            cache_write_tokens: 300, // $3.00 per 1M
        },
        context: 1_048_576,
        max_tokens: 1_048_576,
@@ -177,7 +177,6 @@ describe('OpenAiChatProvider model catalog', () => {
        expect(ids).toContain('gpt-5.2-2025-12-11');
        expect(ids).toContain('gpt-6-astra');
        expect(ids).toContain('gpt-6.1-sol');
-        expect(ids).toContain('gpt-6.1-terra');
        expect(ids).toContain('gpt-6-sol');
        expect(ids).toContain('gpt-6-luna');
    });
@@ -349,33 +348,30 @@ describe('OpenAiChatProvider.complete request shape', () => {
        expect(args.safety_identifier).toBe('puter-u42');
    });

-    it.each([
-        'gpt-6-astra',
-        'gpt-6.1-sol',
-        'gpt-6.1-terra',
-        'gpt-6-sol',
-        'gpt-6-luna',
-    ])('resolves the namespaced %s alias', async (model) => {
-        const { provider } = makeProvider();
-        createMock.mockResolvedValueOnce(baseCompletion);
+    it.each(['gpt-6-astra', 'gpt-6.1-sol', 'gpt-6-sol', 'gpt-6-luna'])(
+        'resolves the namespaced %s alias',
+        async (model) => {
+            const { provider } = makeProvider();
+            createMock.mockResolvedValueOnce(baseCompletion);

-        await withTestActor(() =>
-            provider.complete({
-                model: `openai/${model}`,
-                messages: [{ role: 'user', content: 'hello' }],
-                reasoning_effort: 'low',
-            }),
-        );
+            await withTestActor(() =>
+                provider.complete({
+                    model: `openai/${model}`,
+                    messages: [{ role: 'user', content: 'hello' }],
+                    reasoning_effort: 'low',
+                }),
+            );

-        expect(createMock.mock.calls[0]![0].model).toBe(model);
-        expect(createMock.mock.calls[0]![0].reasoning_effort).toBe('low');
-        expect(recordSpy).toHaveBeenCalledWith(
-            expect.any(Object),
-            expect.anything(),
-            `openai:${model}`,
-            expect.any(Object),
-        );
-    });
+            expect(createMock.mock.calls[0]![0].model).toBe(model);
+            expect(createMock.mock.calls[0]![0].reasoning_effort).toBe('low');
+            expect(recordSpy).toHaveBeenCalledWith(
+                expect.any(Object),
+                expect.anything(),
+                `openai:${model}`,
+                expect.any(Object),
+            );
+        },
+    );

    it('omits parallel_tool_calls/tool_choice when no tool is sent (Chat Completions rejects them alone)', async () => {
        const { provider } = makeProvider();
@@ -224,7 +224,6 @@ describe('OpenAiResponsesChatProvider model catalog', () => {
    });

    it.each([
-        ['gpt-6.1-terra', '2026-06-01', '2026-10-26', 100, 5, 500],
        ['gpt-6.1-sol', '2026-04-30', '2026-09-29', 200, 10, 1000],
        ['gpt-6-sol', '2026-04-20', '2026-09-22', 200, 20, 1000],
        ['gpt-6-luna', '2026-05-18', '2026-09-22', 10, 1, 50],
@@ -245,7 +244,6 @@ describe('OpenAiResponsesChatProvider model catalog', () => {
                    tokens: 1_000_000,
                    prompt_tokens: input,
                    cached_tokens: cached,
-                    cache_write_tokens: input * 1.25,
                    completion_tokens: output,
                },
                context: 1_050_000,
@@ -334,7 +332,6 @@ describe('OpenAiResponsesChatProvider.complete request shape', () => {
        'gpt-6-luna',
        'gpt-6-astra',
        'gpt-6.1-sol',
-        'gpt-6.1-terra',
        'gpt-5.6',
        'openai/gpt-5.6',
        'openai/gpt-5.6-luna',
@@ -370,7 +367,7 @@ describe('OpenAiResponsesChatProvider.complete request shape', () => {
        },
    );

-    it.each(['gpt-5.6-luna', 'gpt-6-luna', 'gpt-6.1-terra'])(
+    it.each(['gpt-5.6-luna', 'gpt-6-luna'])(
        'preserves sampling with reasoning disabled for %s',
        async (model) => {
            const { provider } = makeProvider();
@@ -623,13 +620,7 @@ describe('OpenAiResponsesChatProvider.complete request shape', () => {
        expect(gpt41Args).not.toHaveProperty('verbosity');
    });

-    it.each([
-        'gpt-6-astra',
-        'gpt-6.1-sol',
-        'gpt-6.1-terra',
-        'gpt-6-sol',
-        'gpt-6-luna',
-    ])(
+    it.each(['gpt-6-astra', 'gpt-6.1-sol', 'gpt-6-sol', 'gpt-6-luna'])(
        'maps flat controls to Responses options for %s aliases',
        async (model) => {
            const { provider } = makeProvider();
@@ -869,51 +860,47 @@ describe('OpenAiResponsesChatProvider.complete non-stream output', () => {
        });
    });

-    it.each([
-        ['gpt-6-sol', 119],
-        ['gpt-6.1-terra', 59],
-    ] as const)(
-        'bills %s at long-context rates past 272K input tokens',
-        async (modelId, total) => {
-            const model = OPEN_AI_MODELS.find((m) => m.id === modelId)!;
-            const { provider } = makeProvider();
-            responsesCreateMock.mockResolvedValueOnce({
-                output: [{ role: 'assistant' }],
-                output_text: 'hi',
-                usage: {
-                    input_tokens: 300_000,
-                    output_tokens: 10_000,
-                    input_tokens_details: {
-                        cached_tokens: 50_000,
-                        cache_write_tokens: 20_000,
-                    },
+    it('bills the whole request at long-context rates past 272K input tokens', async () => {
+        const sol = OPEN_AI_MODELS.find((m) => m.id === 'gpt-6-sol')!;
+        const { provider } = makeProvider();
+        responsesCreateMock.mockResolvedValueOnce({
+            output: [{ role: 'assistant' }],
+            output_text: 'hi',
+            usage: {
+                input_tokens: 300_000,
+                output_tokens: 10_000,
+                input_tokens_details: {
+                    cached_tokens: 50_000,
+                    cache_write_tokens: 20_000,
                },
-            });
+            },
+        });

-            await withTestActor(() =>
-                provider.complete({
-                    model: modelId,
-                    messages: [{ role: 'user', content: 'hi' }],
-                }),
-            );
+        await withTestActor(() =>
+            provider.complete({
+                model: 'gpt-6-sol',
+                messages: [{ role: 'user', content: 'hi' }],
+            }),
+        );

-            const [, , , overrides] = recordSpy.mock.calls[0]!;
-            expect(overrides).toEqual({
-                prompt_tokens: 230_000 * Number(model.costs.prompt_tokens) * 2,
-                cached_tokens: 50_000 * Number(model.costs.cached_tokens) * 2,
-                cache_write_tokens:
-                    20_000 * Number(model.costs.cache_write_tokens) * 2,
-                completion_tokens:
-                    10_000 * Number(model.costs.completion_tokens) * 1.5,
-            });
-            const totalCents =
-                Object.values(overrides as Record<string, number>).reduce(
-                    (a, b) => a + b,
-                    0,
-                ) / 1_000_000;
-            expect(totalCents).toBeCloseTo(total);
-        },
-    );
+        const [, , , overrides] = recordSpy.mock.calls[0]!;
+        // $0.92 + $0.02 + $0.10 + $0.15 = $1.19, against $0.62 at the
+        // standard rates.
+        expect(overrides).toEqual({
+            prompt_tokens: 230_000 * Number(sol.costs.prompt_tokens) * 2,
+            cached_tokens: 50_000 * Number(sol.costs.cached_tokens) * 2,
+            cache_write_tokens:
+                20_000 * Number(sol.costs.cache_write_tokens) * 2,
+            completion_tokens:
+                10_000 * Number(sol.costs.completion_tokens) * 1.5,
+        });
+        const totalCents =
+            Object.values(overrides as Record<string, number>).reduce(
+                (a, b) => a + b,
+                0,
+            ) / 1_000_000;
+        expect(totalCents).toBeCloseTo(119);
+    });

    it('bills cached tokens at the input rate when the model prices no cache read', async () => {
        // gpt-5.4-pro is responses-API-only and its catalogue entry has no
@@ -31,31 +31,6 @@ const GPT_LONG_CONTEXT_PRICING = {

 // Hardcoded from https://models.dev/api.json
 export const OPEN_AI_MODELS: IChatModel[] = [
-    {
-        puterId: 'openai:openai/gpt-6.1-terra',
-        id: 'gpt-6.1-terra',
-        responsesSampling: 'reasoningDisabled',
-        modalities: { input: ['text', 'image'], output: ['text'] },
-        open_weights: false,
-        tool_call: true,
-        knowledge: '2026-06-01',
-        release_date: '2026-10-26',
-        aliases: ['openai/gpt-6.1-terra'],
-        costs_currency: 'usd-cents',
-        input_cost_key: 'prompt_tokens',
-        output_cost_key: 'completion_tokens',
-        costs: {
-            tokens: 1_000_000,
-            prompt_tokens: 100,
-            cached_tokens: 5,
-            cache_write_tokens: 100 * 1.25,
-            completion_tokens: 500,
-        },
-        long_context_pricing: GPT_LONG_CONTEXT_PRICING,
-        context: 1_050_000,
-        max_tokens: 128_000,
-        responses_api: true,
-    },
    {
        puterId: 'openai:openai/gpt-6.1-sol',
        id: 'gpt-6.1-sol',
@@ -175,11 +175,6 @@ export interface UsageDetails {
 export interface ICompleteArguments {
    messages: PuterMessage[];
    provider?: string;
-    /**
-     * `false` makes the first route's failure final instead of retrying the
-     * request on another provider that serves the same model.
-     */
-    fallback?: boolean;
    stream?: boolean;
    model: string;
    test_mode?: boolean;
@@ -243,7 +238,7 @@ export interface ICompleteArguments {
        'auto' | 'default' | 'flex' | 'scale' | 'priority' | undefined;
    max_tokens?: number;
    temperature?: number;
-    reasoning?: { effort: ReasoningEffort } | undefined;
+    reasoning?: { effort: 'low' | 'medium' | 'high' } | undefined;
    text?: { verbosity?: 'low' | 'medium' | 'high' | undefined } | undefined;
    reasoning_effort?: ReasoningEffort | undefined;
    verbosity?: 'low' | 'medium' | 'high' | undefined;
@@ -350,8 +345,6 @@ export interface IChatProvider {
        inputKey?: string;
        outputKey?: string;
        extraCost?: number;
-        /** Provider-specific prompt tokens outside message.content. */
-        additionalPromptTokens?: number;
        maxTokens?: number;
    };
    /**
@@ -170,12 +170,7 @@ const hoistToolUseBlocks = (
            type: 'function',
            function: {
                name: block.name,
-                // A replayed OpenAI-shaped call arrives with `input` already
-                // serialized; encoding it again sends a JSON string literal.
-                arguments:
-                    typeof block.input === 'string'
-                        ? block.input
-                        : JSON.stringify(block.input),
+                arguments: JSON.stringify(block.input),
            },
            ...(extraContent && block.extra_content
                ? { extra_content: block.extra_content }
@@ -195,22 +190,14 @@ const hoistToolUseBlocks = (
 * make changes in-place.
 *
 * @param {Message[]} messages - Array of normalized messages
- * @param {{
- *     preserveToolCallOrder?: boolean;
- *     keepExtraContent?: boolean;
- *     keepAssistantContent?: boolean;
- * }} [opts]
+ * @param {{ preserveToolCallOrder?: boolean; keepExtraContent?: boolean }} [opts]
 *   `preserveToolCallOrder` keeps a turn's tool calls in the order the model made
 *   them. `keepExtraContent` keeps each tool call's `extra_content`.
 * @returns {Message[]} - Array of messages in OpenAI format
 */
 export const process_input_messages = async (
    messages,
-    {
-        preserveToolCallOrder = false,
-        keepExtraContent = false,
-        keepAssistantContent = false,
-    } = {},
+    { preserveToolCallOrder = false, keepExtraContent = false } = {},
 ) => {
    for (const msg of messages) {
        if (!msg.content) continue;
@@ -233,12 +220,7 @@ export const process_input_messages = async (
                extraContent: keepExtraContent,
            })
        )
-            msg.content =
-                keepAssistantContent &&
-                msg.role === 'assistant' &&
-                content.length
-                    ? content
-                    : null;
+            msg.content = null;

        // coerce tool results
        // (we assume multiple tool results were already split into separate messages)
@@ -488,22 +470,11 @@ export const extractMeteredUsage = (usage) => {
 * @param {import('openai/resources/completions.mjs').CompletionUsage | undefined} usage
 */
 export const splitCachedPrompt = (usage) => {
-    const details = usage?.prompt_tokens_details;
-    const cachedTokens = details?.cached_tokens ?? 0;
-    // Moonshot counts the prompt tokens it wrote to its prefix cache here;
-    // they're billed at the model's write rate, not the plain prompt rate.
-    const writeTokens =
-        typeof details?.cache_write_tokens === 'number'
-            ? details.cache_write_tokens
-            : undefined;
+    const cachedTokens = usage?.prompt_tokens_details?.cached_tokens ?? 0;
    return {
-        prompt_tokens:
-            (usage?.prompt_tokens ?? 0) - cachedTokens - (writeTokens ?? 0),
+        prompt_tokens: (usage?.prompt_tokens ?? 0) - cachedTokens,
        completion_tokens: usage?.completion_tokens ?? 0,
        cached_tokens: cachedTokens,
-        ...(writeTokens !== undefined
-            ? { cache_write_tokens: writeTokens }
-            : {}),
    };
 };

@@ -331,29 +331,6 @@ describe('process_input_messages', () => {
        ]);
    });

-    it("keeps a replayed call's serialized arguments verbatim", async () => {
-        // An OpenAI-shaped `tool_calls` entry normalizes with its arguments
-        // still a JSON string.
-        const messages: Array<Record<string, unknown>> = [
-            {
-                role: 'assistant',
-                content: [
-                    {
-                        type: 'tool_use',
-                        id: 'call_1',
-                        name: 'lookup',
-                        input: '{"q":"puter"}',
-                    },
-                ],
-            },
-        ];
-
-        const [out] = (await process_input_messages(messages)) as Array<{
-            tool_calls: Array<{ function: { arguments: string } }>;
-        }>;
-        expect(out!.tool_calls[0]!.function.arguments).toBe('{"q":"puter"}');
-    });
-
    describe('tool call extra_content', () => {
        const turn = (): Array<Record<string, unknown>> => [
            {
@@ -795,28 +772,6 @@ describe('process_input_messages_responses_api', () => {
        expect(out!.content).toBeUndefined();
    });

-    it("keeps a replayed call's serialized arguments verbatim", async () => {
-        const messages: Array<Record<string, unknown>> = [
-            {
-                role: 'assistant',
-                content: [
-                    {
-                        type: 'tool_use',
-                        id: 'call_1',
-                        name: 'lookup',
-                        input: '{"q":"puter"}',
-                    },
-                ],
-            },
-        ];
-
-        const [out] = (await process_input_messages_responses_api(
-            messages,
-        )) as Array<Record<string, unknown>>;
-        expect(out!.type).toBe('function_call');
-        expect(out!.arguments).toBe('{"q":"puter"}');
-    });
-
    it('rewrites tool_result blocks into function_call_output', async () => {
        const messages: Array<Record<string, unknown>> = [
            {
@@ -933,35 +888,6 @@ describe('splitCachedPrompt', () => {
            cached_tokens: 0,
        });
    });
-
-    it('takes cache writes out of prompt_tokens under their own key', () => {
-        expect(
-            splitCachedPrompt({
-                prompt_tokens: 10,
-                completion_tokens: 5,
-                prompt_tokens_details: { cached_tokens: 3, cache_write_tokens: 4 },
-            }),
-        ).toEqual({
-            prompt_tokens: 3,
-            completion_tokens: 5,
-            cached_tokens: 3,
-            cache_write_tokens: 4,
-        });
-    });
-
-    it('leaves cache writes out when the upstream reports no count', () => {
-        expect(
-            splitCachedPrompt({
-                prompt_tokens: 10,
-                completion_tokens: 5,
-                prompt_tokens_details: { cached_tokens: 3, cache_write_tokens: null },
-            }),
-        ).toEqual({
-            prompt_tokens: 7,
-            completion_tokens: 5,
-            cached_tokens: 3,
-        });
-    });
 });

 // ── recorded usage costs ────────────────────────────────────────────
@@ -289,9 +289,6 @@ describe('clampReasoningEffort', () => {
        ['gpt-5.5', 'max', 'xhigh'],
        ['gpt-5', 'high', 'high'],
        ['gpt-6-astra-1', 'none', 'low'],
-        ...(['none', 'low', 'medium', 'high', 'xhigh', 'max'] as const).map(
-            (effort) => ['gpt-6.1-terra', effort, effort] as const,
-        ),
    ] as const)(
        'clamps %s requesting %s to %s',
        (modelId, requested, expected) => {
@@ -39,49 +39,9 @@ describe('estimateTextTokens', () => {
        const long = estimateTextTokens('hello world '.repeat(100));
        expect(long).toBeGreaterThan(short);
    });
-
-    it('counts words the way splitting on \\s+ does', () => {
-        const splitEstimate = (text: string) =>
-            Math.floor(
-                (text.length / 4 + text.split(/\s+/).length * (4 / 3)) / 2,
-            );
-        for (const text of [
-            'a',
-            ' a',
-            'a ',
-            '  a  b\t\nc  ',
-            'x y z w     　v',
-            'é ü 日本語 テキスト',
-            '\r\n\v\f',
-        ]) {
-            expect(estimateTextTokens(text), JSON.stringify(text)).toBe(
-                splitEstimate(text),
-            );
-        }
-    });
-
-    it('gives text past the scan budget the word density scanned so far', () => {
-        const text = 'ab cd '.repeat(1000);
-        const budget = { chars: 12, scannedChars: 0, scannedRuns: 0 };
-        // Uniform text extrapolates to the full count.
-        expect(estimateTextTokens(text, budget)).toBe(estimateTextTokens(text));
-        expect(budget.chars).toBe(0);
-        // A later part with no budget left takes the same density.
-        expect(estimateTextTokens(text, budget)).toBe(estimateTextTokens(text));
-    });
 });

 describe('estimatePromptTokens', () => {
-    it('scans a bounded amount of text per prompt', () => {
-        // Many parts, each under the budget alone, past it together; the
-        // unscanned ones are extrapolated, which is exact for uniform text.
-        const part = 'lorem ipsum dolor '.repeat(30_000);
-        const parts = Array.from({ length: 8 }, () => ({ text: part }));
-        expect(estimatePromptTokens([{ role: 'user', content: parts }])).toBe(
-            8 * estimateTextTokens(part),
-        );
-    });
-
    it('counts plain string content', () => {
        const tokens = estimatePromptTokens([
            { role: 'user', content: 'a fairly ordinary sentence to price' },
Author	SHA1	Message	Date
Nariman Jelveh	3dd8e599de	fix(dashboard): cancel a transfer once when its Cancel is double-clicked A cancelled row stays clickable while it fades out, so a double-click ran the cancel twice: two abort requests for an upload, and for a guest session two "save your session" prompts.	2026-10-25 19:48:54 -07:00
Nariman Jelveh	a62cf80bdf	fix(dashboard): word a transfer's time left in Traditional Chinese, Portuguese and Ukrainian The estimate passed Puter's language code straight to Intl, which rejects zhtw (leaving "About 9 left" with no unit) and reads br as Breton and ua as nothing. It now maps the code with intlLocale like the rest of the dashboard.	2026-10-25 19:48:25 -07:00
Nariman Jelveh	841d283135	fix(dashboard): name the upload a failed transfer row belongs to Every failed upload in the tray read "Failed to upload files", so with several running there was no telling which one failed. The row now says "Failed to upload report.pdf" or "Failed to upload 3 items".	2026-10-25 19:47:44 -07:00
Nariman Jelveh	c6350f1a7b	fix(dashboard): let a transfer's title wrap so long names keep their extension A row's title was one line cut at the end, so "Uploading quarterly- report-final-v2.pdf" lost its extension and most of its name in a 360px tray. It now runs to two lines, like the status under it.	2026-10-25 19:46:53 -07:00
Nariman Jelveh	fedc38faa5	fix(dashboard): announce transfer tray status to screen readers The tray's summary changed silently, so a screen reader user had no word that a transfer finished. The summary is now a status region.	2026-10-25 19:45:04 -07:00
Nariman Jelveh	2411a2baaf	fix(dashboard): title a finished upload "Uploaded" rather than "Uploading" A finished upload kept its "Uploading report.pdf" title beside its Done mark. The tray's complete() now takes the finished task's title, and the Files upload passes "Uploaded report.pdf" or "Uploaded 3 items".	2026-10-25 19:44:52 -07:00
Nariman Jelveh	81fb4ee84c	fix: keep one progress window per copy or move across conflict prompts Copy and move re-arm their progress timer after a conflict prompt, and the timer opened a second progress window even when one was already up. The first was then never closed: on the dashboard it stayed in the transfer tray as a running task that couldn't be cleared. The timer now leaves an open progress window alone.	2026-10-25 19:44:00 -07:00
Nariman Jelveh	24c2808a00	fix(dashboard): estimate a transfer's time left from its exact progress The tray rounded progress to whole percentages before estimating, so a slow upload whose percentage stood still for the 5s rate window lost its time-left text about a quarter of the time and underestimated the rest. The estimate now gets the uploader's hundredths; the bar and label still show whole percentages.	2026-10-25 19:40:17 -07:00
Nariman Jelveh	abc8b15d63	fix(dashboard): keep the Files selection bar clear of the transfer tray On phones the tray and select mode's action bar both docked at the bottom, so a running transfer hid every selection action. The tray now rises above the bar while it shows.	2026-10-25 19:39:38 -07:00
Nariman Jelveh	d767802c6a	fix(dashboard): stack the transfer tray under the dashboard's drawer, sheets and dialogs The tray sat on body above every window, so on phones it covered the open sidebar drawer, the Share and Properties sheets, and the drag cancel zone, and stayed bright and clickable over their scrims. It now mounts in .dashboard just under the drawer's scrim, and remounts if the dashboard it was in is re-rendered.	2026-10-25 19:38:09 -07:00
Nariman JelvehandClaude Opus 5.5	3cbc499324	feat(dashboard): show transfer progress in a non-blocking tray Uploads, copies and moves in the dashboard no longer open a modal. Each one adds a row to a tray in the bottom-right corner, and the rest of the dashboard stays usable while it runs. UIWindowProgress hands off to UIDashboardTransfer, which returns the same handle as before. The tray shows how many tasks are running and can be collapsed to that summary. Each row has its own Cancel button, a progress bar, and a time-left estimate. A finished upload shows Done for a few seconds. A failure stays until it is dismissed and opens a collapsed tray. The tray never takes focus, and it sits above app windows and the Files footer. With no modal left to sit under, UIAlert no longer needs to stay on top of dashboard overlays, so that change is reverted. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-10-25 19:24:45 -07:00
Nariman JelvehandClaude Opus 5.5	8ca6ecc9ca	feat(dashboard): redesign upload, copy, and move progress as dashboard modals In dashboard mode, progress for uploads, copies, and moves now shows in the same overlay card as the other dashboard dialogs instead of a UIWindow. UIWindowProgress hands off to UIDashboardProgressModal there, so the shared file helpers drive either one through the same handle. The card shows a titled header ("Uploading 3 items", "Copying", "Moving", "Deleting"), the current item or destination, an indeterminate bar until there is a percentage, and then a percentage with a smoothed time-left estimate. Uploads end on a brief done state. An error replaces the progress with a message and an OK button. While a transfer runs, only Cancel stops it: Escape and backdrop clicks do nothing. The dashboard's two upload paths now share uploadFiles. A UIAlert opened while a dashboard overlay is up now stays on top, so a conflict prompt raised mid-copy can still be answered. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-10-25 19:11:58 -07:00