From 8e8a37e683eed9262fe6d19d236fa1b2c5c85b52 Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Sun, 27 Sep 2026 22:40:16 -0700
Subject: [PATCH 01/49] ci: re-arm release-merge on every check-producing
 workflow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Re-sync release-merge.yml from the CLDMV/.github v4.29.2 template.

The merge gate waits on every check-run on the release PR's head, but
workflow_run only listed the CI workflow, so an approval given before
CodeQL (or any other non-CI check) finished left the release PR stuck
approved and green with nothing re-firing the merge check — exactly what
happened to CLDMV/.github PR #322. The trigger now lists every workflow
in the standard v4 set that puts a check on a release-PR head, and
`branches: [next, hotfixes]` stops feature-branch runs from waking it.

Refs CLDMV/.github#318
---
 .github/workflows/release-merge.yml | 41 ++++++++++++++++++++++-------
 1 file changed, 32 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/release-merge.yml b/.github/workflows/release-merge.yml
index 7c83e02a2..106ab85a4 100644
--- a/.github/workflows/release-merge.yml
+++ b/.github/workflows/release-merge.yml
@@ -30,13 +30,17 @@
 # merge check, because check_suite silently never fired for that case at all.
 # `workflow_run` is GitHub's documented replacement for exactly this pattern.
 #
-# IMPORTANT: `workflows:` below must list the exact `name:` of THIS repo's own
-# ci.yml (matched by literal workflow name, not filename) — update it if you
-# renamed that workflow. If more than one top-level workflow in your repo can
-# plausibly be the last to finish (e.g. a separately-scheduled CodeQL run that
-# sometimes outlasts ci.yml), list all of them; a workflow that finishes and
-# isn't listed here won't re-arm the merge check, though the manual
-# workflow_dispatch fallback below always will.
+# IMPORTANT: the merge gate waits on EVERY check-run on the release PR's head
+# commit, from any workflow — so `workflows:` below must name every workflow in
+# your repo that puts a check on that commit, not just ci.yml. Only the one that
+# finishes LAST can see a fully green head; if it isn't listed, nothing re-fires
+# and the PR sits approved + green until you dispatch this workflow by hand.
+# CodeQL in particular routinely outlasts ci.yml (CLDMV/.github PR #322 stuck
+# exactly this way). The list below covers the standard v4 template set by their
+# template `name:`s — names are matched literally (not by filename), so fix any
+# you renamed, and add any extra PR-triggered workflow your repo has. Listing a
+# workflow your repo doesn't have is harmless. `branches:` limits re-fires to
+# runs on the integration branches, so feature-branch CI doesn't wake this up.
 #
 # Thin caller: all logic lives in the reusable, pinned at @v4.
 # NOTE: pull_request_review / workflow_run events run the copy of this file on
@@ -46,13 +50,32 @@ name: 🚦 Release Merge (v4)
 on:
     pull_request_review:
         types: [submitted] # your approval arms it
-    workflow_run:
-        workflows: ["🧪 CI Tests & Build"] # ← match your ci.yml's `name:` — see #318
+    workflow_run: # re-evaluate as each check-producing workflow finishes — see #318
+        workflows: # ← must match your workflows' `name:`s — see IMPORTANT above
+            - "🧪 CI Tests & Build"
+            - "🔍 CodeQL"
+            - "🔒 Dependency Review"
+            - "📊 Bundle Size"
+            - "🚀 Next Release (v4)"
+            - "🚑 Hotfixes Release (v4)"
+            - "🌿 Branch Retention"
+            - "🏷️ PR Labeler"
+            - "🏷️ PR Title Normalizer"
+            - "👋 Welcome Contributor"
+            - "🔀 Hotfix PR Redirector (v4)"
+            - "🚀 Member Auto-Enable Auto-Merge"
+            - "🤖 Dependabot Auto-Merge"
+            - "🔁 Dependabot Auto-Recreate"
+            - "📜 CLA"
+            - "📥 PR Notify"
         types: [completed]
+        branches: [next, hotfixes]
     workflow_dispatch: # manual re-evaluation
 
 # Serialize per repo: each run re-resolves the release PR + re-gates the head,
 # so queue (don't cancel) to avoid racing a merge that's already in flight.
+# GitHub keeps one pending run per group and a newer arrival replaces it — that
+# is harmless, since every run re-reads approval + check state from the API.
 concurrency:
     group: release-merge-${{ github.repository }}
     cancel-in-progress: false

From 0c31d5c2460b2c9e0e221114f3b71f55dd629e56 Mon Sep 17 00:00:00 2001
From: "cldmv-bot[bot]" <230771808+cldmv-bot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 05:45:59 +0000
Subject: [PATCH 02/49] chore: bump version to 3.21.1

---
 package-lock.json | 4 ++--
 package.json      | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index c478acad4..ae5776303 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "@cldmv/slothlet",
-	"version": "3.21.0",
+	"version": "3.21.1",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@cldmv/slothlet",
-			"version": "3.21.0",
+			"version": "3.21.1",
 			"license": "Apache-2.0",
 			"bin": {
 				"slothlet": "bin/slothlet.mjs"
diff --git a/package.json b/package.json
index e5fe4f5ae..3822180e3 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@cldmv/slothlet",
-	"version": "3.21.0",
+	"version": "3.21.1",
 	"moduleVersions": {
 		"lazy": "3.0.0",
 		"eager": "3.0.0",

From 44b285eb7a5a5f5878e5a860c93e8843f5ed0e4f Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Sun, 27 Sep 2026 23:09:27 -0700
Subject: [PATCH 03/49] fix(api): remove() no longer throws on a module's
 frozen or sealed exports

api.slothlet.api.remove() aborted with "Cannot delete property" when the
removed module exported a frozen/sealed object (e.g. a constant table),
leaving stale leaves on the api and an invalidated function leaf that a
re-add of the same moduleID did not restore.

A wrapper over such an export now reports a non-deletable key the way the
object itself does (the deleteProperty trap returns false), and deletePath()
detaches with Reflect.deleteProperty so that answer no longer aborts the
removal. A user `delete` through the wrapper keeps the object's own
semantics: a strict-mode TypeError for a frozen key, a normal delete
otherwise.

Fixes #485
---
 src/lib/handlers/api-manager.mjs              |  15 +-
 src/lib/handlers/unified-wrapper.mjs          |   9 +-
 ...nager-remove-frozen-export.test.vitest.mjs | 154 ++++++++++++++++++
 types/src/lib/handlers/api-manager.d.mts.map  |   2 +-
 .../lib/handlers/unified-wrapper.d.mts.map    |   2 +-
 5 files changed, 173 insertions(+), 9 deletions(-)
 create mode 100644 tests/vitests/suites/api-manager/api-manager-remove-frozen-export.test.vitest.mjs

diff --git a/src/lib/handlers/api-manager.mjs b/src/lib/handlers/api-manager.mjs
index fb216bcf5..857bcba5c 100644
--- a/src/lib/handlers/api-manager.mjs
+++ b/src/lib/handlers/api-manager.mjs
@@ -1499,12 +1499,18 @@ export class ApiManager extends ComponentBase {
 			// impl is a function, or an absent impl) is a defensive shape guard not exercised here.
 			/* v8 ignore else */
 			if (wrapper.____slothletInternal.impl && typeof wrapper.____slothletInternal.impl === "object") {
-				delete wrapper.____slothletInternal.impl[finalKey];
+				// The impl can be the module's own frozen/sealed export (#485). Reflect.deleteProperty
+				// reports a non-configurable key with `false` instead of throwing; the key then stays on
+				// the module's object, and the wrapper is invalidated when its own path is removed.
+				Reflect.deleteProperty(wrapper.____slothletInternal.impl, finalKey);
 			}
 		}
 
-		// Also delete the property from the object/proxy itself
-		delete current[finalKey];
+		// Also delete the property from the object/proxy itself. A wrapper over a module's frozen/sealed
+		// export reports the key as non-deletable (`false`); Reflect.deleteProperty takes that answer
+		// instead of throwing, so one frozen constant table cannot abort the rest of the removal (#485).
+		// The removed node's wrapper is invalidated below regardless.
+		Reflect.deleteProperty(current, finalKey);
 
 		// AFTER deletion, clean up wrapper state for removed proxy
 		// removedImpl from deletePath is always an object or function; the FALSE branch is unreachable.
@@ -1555,7 +1561,8 @@ export class ApiManager extends ComponentBase {
 			const { parent, key } = stack[i];
 			const value = parent[key];
 			if (value && (typeof value === "object" || typeof value === "function") && Object.keys(value).length === 0) {
-				delete parent[key];
+				// Same as the detach above: a frozen parent answers `false` rather than throwing (#485).
+				Reflect.deleteProperty(parent, key);
 			}
 		}
 
diff --git a/src/lib/handlers/unified-wrapper.mjs b/src/lib/handlers/unified-wrapper.mjs
index 79ba73ae2..e3498c924 100644
--- a/src/lib/handlers/unified-wrapper.mjs
+++ b/src/lib/handlers/unified-wrapper.mjs
@@ -4962,19 +4962,22 @@ export class UnifiedWrapper extends ComponentBase {
 				}
 			}
 
-			// Remove from _impl if it's an object
+			// Remove from _impl if it's an object. The impl can be the module's own frozen/sealed export
+			// (#485): report a non-deletable key the way the object itself would — `false`, which a
+			// strict-mode `delete` turns into the same TypeError a direct delete on that object throws.
+			let deleted = true;
 			if (
 				wrapper.____slothletInternal.impl &&
 				typeof wrapper.____slothletInternal.impl === "object" &&
 				prop in wrapper.____slothletInternal.impl
 			) {
-				delete wrapper.____slothletInternal.impl[prop];
+				deleted = Reflect.deleteProperty(wrapper.____slothletInternal.impl, prop);
 			}
 
 			// Remove from proxy target
 			delete target[prop];
 
-			return true;
+			return deleted;
 		};
 
 		/**
diff --git a/tests/vitests/suites/api-manager/api-manager-remove-frozen-export.test.vitest.mjs b/tests/vitests/suites/api-manager/api-manager-remove-frozen-export.test.vitest.mjs
new file mode 100644
index 000000000..03d55f7ec
--- /dev/null
+++ b/tests/vitests/suites/api-manager/api-manager-remove-frozen-export.test.vitest.mjs
@@ -0,0 +1,154 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/api-manager/api-manager-remove-frozen-export.test.vitest.mjs
+ *	@Date: 2026-09-27 21:37:01 -07:00 (1790570221)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-27 21:53:07 -07:00 (1790571187)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Regression (#485): removing a module whose export tree contains a frozen plain object
+ * (the common idiom for an exported constant table) must not mutate that object. `deletePath()` fell
+ * through to a native `delete` on the consumer's own object, which throws in strict mode when the object
+ * is frozen — aborting the removal partway and leaving stale leaves on the api plus an invalidated
+ * function leaf that a re-add of the same moduleID did not restore.
+ *
+ * @module tests/vitests/suites/api-manager/api-manager-remove-frozen-export
+ */
+
+import { describe, it, expect, afterEach } from "vitest";
+import { mkdir, writeFile, rm } from "node:fs/promises";
+import { join } from "node:path";
+import slothlet from "@cldmv/slothlet";
+import { makeTestTmpDir } from "../../setup/test-fixtures-tmp.mjs";
+
+/**
+ * Write a fixture module, creating its folder.
+ * @param {string} dir - Folder to write into.
+ * @param {string} name - File name.
+ * @param {string} code - Module source.
+ * @returns {Promise<void>}
+ */
+async function writeModule(dir, name, code) {
+	await mkdir(dir, { recursive: true });
+	await writeFile(join(dir, name), code);
+}
+
+// The module keeps a handle on its own frozen objects so the test can prove they were left untouched.
+const FROZEN_ERRORS = `
+const CODES = Object.freeze({ NOT_FOUND: "not-found", CONFLICT: "conflict" });
+export const errors = Object.freeze({ CODES, isStoreError: (err) => !!err });
+globalThis.__slothletFrozenProbe ??= [];
+globalThis.__slothletFrozenProbe.push({ CODES, errors });
+`;
+
+const SEALED = `
+export const limits = Object.seal({ max: 10, min: 1 });
+export const fixed = {};
+Object.defineProperty(fixed, "answer", { value: 42, enumerable: true, configurable: false });
+`;
+
+describe.each([{ mode: "eager" }, { mode: "lazy" }])("api-manager — remove a module exporting frozen objects ($mode)", ({ mode }) => {
+	let api;
+	const dirs = [];
+
+	afterEach(async () => {
+		if (api?.shutdown) await api.shutdown().catch(() => {});
+		api = null;
+		delete globalThis.__slothletFrozenProbe;
+		for (const d of dirs.splice(0)) await rm(d, { recursive: true, force: true });
+	});
+
+	it("removes a frozen nested plain-object export without throwing or mutating it", async () => {
+		const root = await makeTestTmpDir(`remove-frozen-${mode}`);
+		dirs.push(root);
+		const store = join(root, "store");
+		await writeModule(store, "errors.mjs", FROZEN_ERRORS);
+
+		api = await slothlet({ mode, silent: true });
+		await api.slothlet.api.add(["store"], store, { moduleID: "m" });
+		expect(api.store.errors.CODES.NOT_FOUND).toBe("not-found");
+		expect(await api.store.errors.isStoreError(new Error("x"))).toBe(true);
+
+		await expect(api.slothlet.api.remove("m")).resolves.not.toThrow();
+
+		// The whole module is detached — nothing stale stays reachable.
+		expect(api.store).toBeUndefined();
+
+		// The module's own frozen objects are untouched.
+		for (const { CODES, errors } of globalThis.__slothletFrozenProbe) {
+			expect(CODES).toEqual({ NOT_FOUND: "not-found", CONFLICT: "conflict" });
+			expect(Object.isFrozen(CODES)).toBe(true);
+			expect(typeof errors.isStoreError).toBe("function");
+		}
+
+		// Re-adding the same moduleID restores a fully working module.
+		await api.slothlet.api.add(["store"], store, { moduleID: "m" });
+		expect(api.store.errors.CODES.NOT_FOUND).toBe("not-found");
+		expect(api.store.errors.CODES.CONFLICT).toBe("conflict");
+		expect(await api.store.errors.isStoreError(new Error("x"))).toBe(true);
+	});
+
+	it("removes sealed and non-configurable exports", async () => {
+		const root = await makeTestTmpDir(`remove-sealed-${mode}`);
+		dirs.push(root);
+		const cfg = join(root, "cfg");
+		await writeModule(cfg, "values.mjs", SEALED);
+
+		api = await slothlet({ mode, silent: true });
+		await api.slothlet.api.add(["cfg"], cfg, { moduleID: "sealed" });
+		expect(api.cfg.values.limits.max).toBe(10);
+		expect(api.cfg.values.fixed.answer).toBe(42);
+
+		await expect(api.slothlet.api.remove("sealed")).resolves.not.toThrow();
+		expect(api.cfg).toBeUndefined();
+	});
+
+	it("a user `delete` through the wrapper behaves like the underlying object", async () => {
+		const root = await makeTestTmpDir(`delete-frozen-${mode}`);
+		dirs.push(root);
+		const store = join(root, "store");
+		await writeModule(store, "errors.mjs", FROZEN_ERRORS);
+		await writeModule(store, "table.mjs", `export const table = { a: 1, b: 2 };`);
+
+		api = await slothlet({ mode, silent: true });
+		await api.slothlet.api.add(["store"], store, { moduleID: "m" });
+
+		// Frozen: the same strict-mode TypeError a direct delete on the frozen object throws, value kept.
+		const codes = api.store.errors.CODES;
+		expect(() => {
+			"use strict";
+			delete codes.NOT_FOUND;
+		}).toThrow(TypeError);
+		expect(api.store.errors.CODES.NOT_FOUND).toBe("not-found");
+
+		// Mutable: the delete goes through.
+		const table = api.store.table;
+		expect(table.a).toBe(1);
+		delete table.a;
+		expect(table.a).toBeUndefined();
+		expect(table.b).toBe(2);
+	});
+
+	it("keeps sibling modules when a frozen-export module is removed", async () => {
+		const root = await makeTestTmpDir(`remove-frozen-sib-${mode}`);
+		dirs.push(root);
+		const store = join(root, "store");
+		const other = join(root, "other");
+		await writeModule(store, "errors.mjs", FROZEN_ERRORS);
+		await writeModule(other, "ping.mjs", "export function ping() { return 'pong'; }");
+
+		api = await slothlet({ mode, silent: true });
+		await api.slothlet.api.add(["store"], store, { moduleID: "m" });
+		await api.slothlet.api.add(["other"], other, { moduleID: "o" });
+
+		await api.slothlet.api.remove("m");
+		expect(api.store).toBeUndefined();
+		expect(await api.other.ping()).toBe("pong");
+	});
+});
diff --git a/types/src/lib/handlers/api-manager.d.mts.map b/types/src/lib/handlers/api-manager.d.mts.map
index 6987b343e..faa30e3f3 100644
--- a/types/src/lib/handlers/api-manager.d.mts.map
+++ b/types/src/lib/handlers/api-manager.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"api-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/api-manager.mjs"],"names":[],"mappings":"AAgFA;;;;;;;;;;;;;;GAcG;AACH;IACC,gCAAuC;IAEvC;;;;;;;;;;;OAWG;IACH,sBAVW,MAAM,EAuBhB;IAXA,sIAAsI;IACtI,OADW;QAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,MAAM,GAAC,IAAI,CAAC;QAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;KAAE,CAUjI;IAGF;;;;;;;;;;;;;;;;;;OAkBG;IACH,yBA+GC;IAED;;;;;;;;;;;;;;OAcG;IACH,oBA4CC;IAED;;;;;;;;;;;;;;OAcG;IACH,0BA4BC;IAED;;;;;;;;;;;;OAYG;IACH,6BAIC;IAED;;;;;;;;;;;;OAYG;IACH,uBASC;IAED;;;;;;;;;;;;;OAaG;IACH,yBAkCC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,iCAbW,MAAM,SACN,OAAO,iBACP,MAAM,GAAC,IAAI,GACT,IAAI,CAqHhB;IAED;;;;;;;;;;;;;OAaG;IACH,uBAEC;IAED;;;;;;;;;;;;;;OAcG;IACH,oBAoVC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,8BAiCC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,sCAmBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,uBAyGC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,uBA6MC;IAED;;;;;;;;;;;;OAYG;IACH,mBAiHC;IACD;;;;;;;;;;;;OAYG;IACH,uBAsEC;IA6CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkDG;IACH,wBAhDG;QAAuB,OAAO,EAAtB,MAAM;QACmD,UAAU,EAAnE,MAAM,GAAC,MAAM,EAAE,cAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;QACf,OAAO;KAChD,GAAU,OAAO,CAAC,MAAM,GAAC,MAAM,EAAE,CAAC,CAu+BpC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,yEATG;QAAqB,QAAQ,EAArB,MAAM;QACO,aAAa,EAA1B,MAAM;QACO,cAAc,EAA3B,MAAM;KACd,GAAU,OAAO,CAAC,IAAI,CAAC,CAgDzB;IA8BD;;;;;;;;;;;OAWG;IACH,mCAeC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,mCA1BW,MAAM,YAEd;QAAyB,aAAa;QAGZ,aAAa;KACvC,GAAU,OAAO,CAAC,OAAO,CAAC,CA+nB5B;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,2BAdG;QAAwB,OAAO,EAAtB,MAAM,OAAA;QACS,QAAQ,EAAvB,MAAM,OAAA;KACf,GAAU,OAAO,CAAC,IAAI,CAAC,CAuCzB;IAED;;;;;;;;;;OAUG;IACH,0BA0EC;IAED;;;;;;;;;;;;;;OAcG;IACH,yBAsFC;IAED;;;;;;;;;;;;;OAaG;IACH,4BA0FC;IAED;;;;;;;;OAQG;IACH,iCAyDC;IAED;;;;;OAKG;IACH,iCAeC;IAED;;;;;;;;;;;;;OAaG;IACH,wBAoUC;;CACD;8BArmI6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"api-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/api-manager.mjs"],"names":[],"mappings":"AAgFA;;;;;;;;;;;;;;GAcG;AACH;IACC,gCAAuC;IAEvC;;;;;;;;;;;OAWG;IACH,sBAVW,MAAM,EAuBhB;IAXA,sIAAsI;IACtI,OADW;QAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,MAAM,GAAC,IAAI,CAAC;QAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;KAAE,CAUjI;IAGF;;;;;;;;;;;;;;;;;;OAkBG;IACH,yBA+GC;IAED;;;;;;;;;;;;;;OAcG;IACH,oBA4CC;IAED;;;;;;;;;;;;;;OAcG;IACH,0BA4BC;IAED;;;;;;;;;;;;OAYG;IACH,6BAIC;IAED;;;;;;;;;;;;OAYG;IACH,uBASC;IAED;;;;;;;;;;;;;OAaG;IACH,yBAkCC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,iCAbW,MAAM,SACN,OAAO,iBACP,MAAM,GAAC,IAAI,GACT,IAAI,CAqHhB;IAED;;;;;;;;;;;;;OAaG;IACH,uBAEC;IAED;;;;;;;;;;;;;;OAcG;IACH,oBAoVC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,8BAiCC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,sCAmBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,uBAyGC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,uBA6MC;IAED;;;;;;;;;;;;OAYG;IACH,mBAwHC;IACD;;;;;;;;;;;;OAYG;IACH,uBAsEC;IA6CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkDG;IACH,wBAhDG;QAAuB,OAAO,EAAtB,MAAM;QACmD,UAAU,EAAnE,MAAM,GAAC,MAAM,EAAE,cAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;QACf,OAAO;KAChD,GAAU,OAAO,CAAC,MAAM,GAAC,MAAM,EAAE,CAAC,CAu+BpC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,yEATG;QAAqB,QAAQ,EAArB,MAAM;QACO,aAAa,EAA1B,MAAM;QACO,cAAc,EAA3B,MAAM;KACd,GAAU,OAAO,CAAC,IAAI,CAAC,CAgDzB;IA8BD;;;;;;;;;;;OAWG;IACH,mCAeC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,mCA1BW,MAAM,YAEd;QAAyB,aAAa;QAGZ,aAAa;KACvC,GAAU,OAAO,CAAC,OAAO,CAAC,CA+nB5B;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,2BAdG;QAAwB,OAAO,EAAtB,MAAM,OAAA;QACS,QAAQ,EAAvB,MAAM,OAAA;KACf,GAAU,OAAO,CAAC,IAAI,CAAC,CAuCzB;IAED;;;;;;;;;;OAUG;IACH,0BA0EC;IAED;;;;;;;;;;;;;;OAcG;IACH,yBAsFC;IAED;;;;;;;;;;;;;OAaG;IACH,4BA0FC;IAED;;;;;;;;OAQG;IACH,iCAyDC;IAED;;;;;OAKG;IACH,iCAeC;IAED;;;;;;;;;;;;;OAaG;IACH,wBAoUC;;CACD;8BA5mI6B,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/lib/handlers/unified-wrapper.d.mts.map b/types/src/lib/handlers/unified-wrapper.d.mts.map
index 18cdec8b7..ecabaa419 100644
--- a/types/src/lib/handlers/unified-wrapper.d.mts.map
+++ b/types/src/lib/handlers/unified-wrapper.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"unified-wrapper.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/unified-wrapper.mjs"],"names":[],"mappings":"AA0xBA;;;;;;;;;;;;;;;;;;GAkBG;AACH,4CAhBW,MAAM,GAAC,MAAM,GACX,OAAO,CAkBnB;AA+vID;;;;;;;;;;;GAWG;AACH,sCAPW,OAAO,GACL,cAAc,GAAC,IAAI,CAkB/B;AAxzID;;;;;;;;GAQG;AACH,iCAHU,GAAG,CAAC,MAAM,CAAC,CAG2F;;;;;AAuEhH;;;;;;;;;;GAUG;AACH;IAiTC;;;;;;;;;;;;;;;;OAgBG;IACH,0BAsCC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,gCAiEC;IAnaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,sBAjCW,MAAM,uJAEd;QAAwB,IAAI,EAApB,MAAM;QACU,OAAO,EAAvB,MAAM;QACyB,WAAW;QACvB,eAAe;QAChB,UAAU;QACV,mBAAmB;QACpB,QAAQ;QACR,QAAQ;QACR,YAAY;QACE,cAAc;QAI3B,eAAe;KAMzC,EA4MF;IAnPD;;;;;;;;;;;OAWG;IACH,4BAFa,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAC,SAAS,CAKzC;IAsOD;;;;;;;;;;OAUG;IACH,uEAHa,GAAC,CA+Bb;IAED;;;;OAIG;IACH,qBAHa,WAAS,MAAM,GAAC,IAAI,CAKhC;IAiJD;;;;;;;;;;;OAWG;IACH,sBAiCC;IAED;;;;;;;;;;;;OAYG;IACH,mBAgDC;IAED;;;;;;;;;OASG;IACH,qBAsDC;IAED;;;;OAIG;IACH,uBA4GC;IAED;;;;;;;;;OASG;IACH,qBAEC;IAED;;;;;;;;;OASG;IACH,sBAiBC;IAED;;;;;;;;;;OAUG;IACH,6BA4gBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BAgOC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BA43BC;IAED;;;;;;OAMG;IACH,uCAmwDC;;CACD;8BApgK6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"unified-wrapper.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/unified-wrapper.mjs"],"names":[],"mappings":"AA0xBA;;;;;;;;;;;;;;;;;;GAkBG;AACH,4CAhBW,MAAM,GAAC,MAAM,GACX,OAAO,CAkBnB;AAkwID;;;;;;;;;;;GAWG;AACH,sCAPW,OAAO,GACL,cAAc,GAAC,IAAI,CAkB/B;AA3zID;;;;;;;;GAQG;AACH,iCAHU,GAAG,CAAC,MAAM,CAAC,CAG2F;;;;;AAuEhH;;;;;;;;;;GAUG;AACH;IAiTC;;;;;;;;;;;;;;;;OAgBG;IACH,0BAsCC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,gCAiEC;IAnaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,sBAjCW,MAAM,uJAEd;QAAwB,IAAI,EAApB,MAAM;QACU,OAAO,EAAvB,MAAM;QACyB,WAAW;QACvB,eAAe;QAChB,UAAU;QACV,mBAAmB;QACpB,QAAQ;QACR,QAAQ;QACR,YAAY;QACE,cAAc;QAI3B,eAAe;KAMzC,EA4MF;IAnPD;;;;;;;;;;;OAWG;IACH,4BAFa,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAC,SAAS,CAKzC;IAsOD;;;;;;;;;;OAUG;IACH,uEAHa,GAAC,CA+Bb;IAED;;;;OAIG;IACH,qBAHa,WAAS,MAAM,GAAC,IAAI,CAKhC;IAiJD;;;;;;;;;;;OAWG;IACH,sBAiCC;IAED;;;;;;;;;;;;OAYG;IACH,mBAgDC;IAED;;;;;;;;;OASG;IACH,qBAsDC;IAED;;;;OAIG;IACH,uBA4GC;IAED;;;;;;;;;OASG;IACH,qBAEC;IAED;;;;;;;;;OASG;IACH,sBAiBC;IAED;;;;;;;;;;OAUG;IACH,6BA4gBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BAgOC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BA43BC;IAED;;;;;;OAMG;IACH,uCAswDC;;CACD;8BAvgK6B,2BAA2B"}
\ No newline at end of file

From a281499cead929c368beb5e830b8728f683d526b Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Sun, 27 Sep 2026 23:23:26 -0700
Subject: [PATCH 04/49] chore(tools): make analyze and i18n:check skip
 gitignored paths

Both scanners walked the tree with hand-rolled readdir loops that never
consulted .gitignore: analyze recursed into every folder (including nested
node_modules fixtures) and filtered a hard-coded list afterwards, and
i18n:check skipped only node_modules/.git. A gitignored file inside a
scanned folder (a .slothlet-cache/ under api_tests, a "* copy.mjs") was
reported as missing its file header.

A shared tools/lib/gitignore.mjs builds a matcher from the root .gitignore
with the `ignore` package (the matcher @cldmv/fix-headers already uses).
Both walkers now skip ignored entries and prune ignored or excluded
directories before descending into them. Output on the current tree is
unchanged.
---
 package-lock.json                 | 27 +++++++--------
 package.json                      |  1 +
 tools/ci/check-i18n-languages.mjs |  4 +++
 tools/dev/analyze-errors.mjs      | 26 +++++++++------
 tools/lib/gitignore.mjs           | 55 +++++++++++++++++++++++++++++++
 5 files changed, 90 insertions(+), 23 deletions(-)
 create mode 100644 tools/lib/gitignore.mjs

diff --git a/package-lock.json b/package-lock.json
index ae5776303..76e7c246b 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -31,6 +31,7 @@
 				"eslint": "^10.7.0",
 				"estree-walker": "^3.0.3",
 				"globals": "^17.7.0",
+				"ignore": "^7.0.10",
 				"jsdoc": "^4.0.5",
 				"jsdoc-to-markdown": "^9.1.3",
 				"jsdoc2md": "^1.0.0",
@@ -186,16 +187,6 @@
 				"vitest": ">=1.0.0"
 			}
 		},
-		"node_modules/@cldmv/fix-headers/node_modules/ignore": {
-			"version": "7.0.5",
-			"resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.5.tgz",
-			"integrity": "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==",
-			"dev": true,
-			"license": "MIT",
-			"engines": {
-				"node": ">= 4"
-			}
-		},
 		"node_modules/@cldmv/vitest-runner": {
 			"version": "1.2.0",
 			"resolved": "https://registry.npmjs.org/@cldmv/vitest-runner/-/vitest-runner-1.2.0.tgz",
@@ -2442,6 +2433,16 @@
 				"url": "https://opencollective.com/eslint"
 			}
 		},
+		"node_modules/eslint/node_modules/ignore": {
+			"version": "5.3.2",
+			"resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz",
+			"integrity": "sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==",
+			"dev": true,
+			"license": "MIT",
+			"engines": {
+				"node": ">= 4"
+			}
+		},
 		"node_modules/espree": {
 			"version": "11.2.0",
 			"resolved": "https://registry.npmjs.org/espree/-/espree-11.2.0.tgz",
@@ -2953,9 +2954,9 @@
 			"license": "MIT"
 		},
 		"node_modules/ignore": {
-			"version": "5.3.2",
-			"resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz",
-			"integrity": "sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==",
+			"version": "7.0.10",
+			"resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.10.tgz",
+			"integrity": "sha512-HpbUakT7xp5miBUywCHf36ZEuAJNklBJDDsGpUIjMzOSmM8ELSfA9Sa/QDPeNeqeoN31u+UTCkL4klCOVvRm4Q==",
 			"dev": true,
 			"license": "MIT",
 			"engines": {
diff --git a/package.json b/package.json
index 3822180e3..4e302c78e 100644
--- a/package.json
+++ b/package.json
@@ -332,6 +332,7 @@
 		"eslint": "^10.7.0",
 		"estree-walker": "^3.0.3",
 		"globals": "^17.7.0",
+		"ignore": "^7.0.10",
 		"jsdoc": "^4.0.5",
 		"jsdoc-to-markdown": "^9.1.3",
 		"jsdoc2md": "^1.0.0",
diff --git a/tools/ci/check-i18n-languages.mjs b/tools/ci/check-i18n-languages.mjs
index 865f94c72..25c42b3ef 100644
--- a/tools/ci/check-i18n-languages.mjs
+++ b/tools/ci/check-i18n-languages.mjs
@@ -14,6 +14,7 @@
 import { readdirSync, readFileSync } from "fs";
 import { dirname, extname, join, basename } from "path";
 import { fileURLToPath } from "url";
+import { loadGitignore } from "../lib/gitignore.mjs";
 
 /**
  * Safely parse a JSON file.
@@ -166,6 +167,7 @@ function findLatinRuns(value, tokenAllowlist) {
  */
 function loadUsedCodeTokens(repoRoot) {
 	const tokens = new Set();
+	const isGitignored = loadGitignore(repoRoot);
 	const walk = (dir) => {
 		let entries;
 		try {
@@ -176,6 +178,8 @@ function loadUsedCodeTokens(repoRoot) {
 		for (const entry of entries) {
 			if (entry.name === "node_modules" || entry.name === ".git") continue;
 			const full = join(dir, entry.name);
+			// Skip gitignored paths (scratch, caches, build output); an ignored directory is not descended.
+			if (isGitignored(full, entry.isDirectory())) continue;
 			if (entry.isDirectory()) {
 				walk(full);
 			} else if (entry.isFile() && /\.(mjs|cjs|js)$/.test(entry.name)) {
diff --git a/tools/dev/analyze-errors.mjs b/tools/dev/analyze-errors.mjs
index 68bed3d53..b5837cf69 100644
--- a/tools/dev/analyze-errors.mjs
+++ b/tools/dev/analyze-errors.mjs
@@ -50,12 +50,15 @@ import { fileURLToPath } from "node:url";
 import { exec } from "node:child_process";
 import { promisify } from "node:util";
 import { FILE_HEADER_CHECK_FOLDERS, FILE_HEADER_IGNORE_FOLDERS, FILE_HEADER_EXTENSIONS } from "../lib/header-config.mjs";
+import { loadGitignore } from "../lib/gitignore.mjs";
 
 const execAsync = promisify(exec);
 
 const __dirname = fileURLToPath(new URL(".", import.meta.url));
 const rootDir = join(__dirname, "../..");
 const srcDir = join(rootDir, "src");
+// Every walk below skips what the project's .gitignore excludes (scratch, caches, build output).
+const isGitignored = loadGitignore(rootDir);
 
 // CLI args
 const limitArg = process.argv.find((arg) => arg.startsWith("--limit="));
@@ -92,18 +95,23 @@ function shouldIgnorePath(filePath, ignoreFolders) {
 }
 
 /**
- * Recursively find all .mjs files
+ * Recursively find all .mjs files. Gitignored entries are skipped, and an ignored directory is
+ * pruned before it is descended into.
  * @internal
  */
-async function findMjsFiles(dir, files = [], extensions = [".mjs"]) {
+async function findMjsFiles(dir, files = [], extensions = [".mjs"], skipPath = () => false) {
 	const entries = await readdir(dir);
 
 	for (const entry of entries) {
 		const fullPath = join(dir, entry);
 		const stats = await stat(fullPath);
+		const isDirectory = stats.isDirectory();
 
-		if (stats.isDirectory()) {
-			await findMjsFiles(fullPath, files, extensions);
+		if (isGitignored(fullPath, isDirectory) || skipPath(fullPath)) {
+			continue;
+		}
+		if (isDirectory) {
+			await findMjsFiles(fullPath, files, extensions, skipPath);
 		} else if (extensions.some((ext) => entry.endsWith(ext))) {
 			files.push(fullPath);
 		}
@@ -130,18 +138,16 @@ async function findMjsFilesInFolders(folderConfigs, ignoreFolders, extensions =
 			}
 
 			if (config.recursive) {
-				// Recursive search
-				const files = await findMjsFiles(folderPath, [], extensions);
-				// Filter out ignored paths
-				const filteredFiles = files.filter((file) => !shouldIgnorePath(file, ignoreFolders));
-				allFiles.push(...filteredFiles);
+				// Recursive search — ignored folders are pruned during the walk, not filtered afterwards.
+				const files = await findMjsFiles(folderPath, [], extensions, (path) => shouldIgnorePath(path, ignoreFolders));
+				allFiles.push(...files);
 			} else {
 				// Non-recursive - only get direct .mjs files
 				const entries = await readdir(folderPath);
 				for (const entry of entries) {
 					if (extensions.some((ext) => entry.endsWith(ext))) {
 						const fullPath = join(folderPath, entry);
-						if (!shouldIgnorePath(fullPath, ignoreFolders)) {
+						if (!shouldIgnorePath(fullPath, ignoreFolders) && !isGitignored(fullPath)) {
 							allFiles.push(fullPath);
 						}
 					}
diff --git a/tools/lib/gitignore.mjs b/tools/lib/gitignore.mjs
new file mode 100644
index 000000000..f742a352f
--- /dev/null
+++ b/tools/lib/gitignore.mjs
@@ -0,0 +1,55 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tools/lib/gitignore.mjs
+ *	@Date: 2026-09-27 23:12:05 -07:00 (1790575925)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-27 23:22:33 -07:00 (1790576553)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview `.gitignore` matching for the repo's own file scanners.
+ *
+ * @description
+ * The dev/CI scanners (`tools/dev/analyze-errors.mjs`, `tools/ci/check-i18n-languages.mjs`) walk the
+ * source tree themselves. This lets them skip whatever the project's `.gitignore` excludes — scratch,
+ * caches, build output — and prune an ignored directory before descending into it, instead of each
+ * scanner keeping its own hard-coded list. Matching uses the `ignore` package, the same matcher
+ * `@cldmv/fix-headers` uses, so all the header/quality tools agree on what is ignored.
+ *
+ * @module tools/lib/gitignore
+ */
+
+import { readFileSync } from "node:fs";
+import { join, relative, sep } from "node:path";
+import ignore from "ignore";
+
+/**
+ * Build a predicate that reports whether a path is excluded by `<rootDir>/.gitignore`.
+ * A missing `.gitignore` yields a predicate that ignores nothing.
+ * @param {string} rootDir - Absolute repository root (where `.gitignore` lives).
+ * @returns {(absPath: string, isDirectory?: boolean) => boolean} True when the path is gitignored.
+ * Pass `isDirectory: true` for a folder so directory-only patterns (`tmp/`) match it.
+ * @example
+ * const isIgnored = loadGitignore(rootDir);
+ * isIgnored(join(rootDir, "tmp"), true); // true
+ */
+export function loadGitignore(rootDir) {
+	let content;
+	try {
+		content = readFileSync(join(rootDir, ".gitignore"), "utf8");
+	} catch {
+		return () => false;
+	}
+	const matcher = ignore().add(content);
+	return (absPath, isDirectory = false) => {
+		const rel = relative(rootDir, absPath).split(sep).join("/");
+		// Paths outside the root (or the root itself) are never matched — `ignore` rejects them.
+		if (rel.length === 0 || rel.startsWith("..")) return false;
+		return matcher.ignores(isDirectory ? `${rel}/` : rel);
+	};
+}

From b8c93214af567c72bfd019e0ca832b5c7afd898e Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Sun, 27 Sep 2026 23:26:15 -0700
Subject: [PATCH 05/49] fix(package): stop shipping the rolldown native binding
 to consumers

@rolldown/binding-linux-x64-gnu was declared in optionalDependencies as a
workaround for npm's optional-dependency lockfile bug (npm/cli#4828), so
every consumer installed a 20 MB Linux bundler binary slothlet never uses.

The lockfile already records every platform's binding as rolldown's own
optional dependency, and a clean `npm ci` still installs the Linux binding
and loads rolldown for vitest without the direct entry. Moving it to
devDependencies instead would break `npm install` on non-Linux dev machines
(EBADPLATFORM), so the entry is removed outright, along with the Dependabot
ignore rule that only existed to pin it.

Fixes #461
---
 .github/dependabot.yml | 6 ------
 package-lock.json      | 5 ++---
 package.json           | 3 ---
 3 files changed, 2 insertions(+), 12 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 6134ebd1a..e7ef847ae 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -67,12 +67,6 @@ updates:
       open-pull-requests-limit: 5
       commit-message:
           prefix: "deps"
-      ignore:
-          # ABI-locked rolldown native binding (npm #4828 workaround): it must track the exact
-          # rolldown version vite ships (vite exact-pins rolldown, e.g. 1.0.3), not be bumped
-          # independently. The #149 bump to 1.1.0 had no rolldown consumer and shipped an unused
-          # ~21MB duplicate; keep this pinned in lockstep with vite's rolldown instead.
-          - dependency-name: "@rolldown/binding-linux-x64-gnu"
       groups:
           # vitest and @vitest/coverage-v8 (and other @vitest/* packages) peer
           # each other EXACTLY, so a partial bump (e.g. vitest to 5.0.0 while
diff --git a/package-lock.json b/package-lock.json
index ae5776303..11f816dd2 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -48,9 +48,6 @@
 				"type": "github",
 				"url": "https://github.com/sponsors/shinrai"
 			},
-			"optionalDependencies": {
-				"@rolldown/binding-linux-x64-gnu": "1.1.3"
-			},
 			"peerDependencies": {
 				"@cldmv/slothlet-i18n": "^3.11.0",
 				"@cldmv/slothlet-types": "^3.11.0",
@@ -1304,6 +1301,7 @@
 			"cpu": [
 				"x64"
 			],
+			"dev": true,
 			"libc": [
 				"glibc"
 			],
@@ -1312,6 +1310,7 @@
 			"os": [
 				"linux"
 			],
+			"peer": true,
 			"engines": {
 				"node": "^20.19.0 || >=22.12.0"
 			}
diff --git a/package.json b/package.json
index 3822180e3..721f56c38 100644
--- a/package.json
+++ b/package.json
@@ -342,9 +342,6 @@
 		"typescript": "^6.0.3",
 		"vitest": "^5.0.0"
 	},
-	"optionalDependencies": {
-		"@rolldown/binding-linux-x64-gnu": "1.1.3"
-	},
 	"repository": {
 		"type": "git",
 		"url": "git+https://github.com/CLDMV/slothlet.git"

From 99993042cbea3be71176a50a24f7778110e0fb91 Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Mon, 28 Sep 2026 00:17:48 -0700
Subject: [PATCH 06/49] ci: measure the published JS files in the bundle-size
 workflow

dist_paths was dist/**, which counted 12 i18n language JSON files (11 of them excluded from the package) and missed the published entry points index.mjs, index.cjs, devcheck.mjs and bin/slothlet.mjs. Match exactly the 62 JS files npm pack publishes, with a leading * on every pattern because the v4.29.2 measure action matches nothing for a bare top-level file and double-counts files across differently-rooted patterns.
---
 .github/workflows/bundle-size.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/bundle-size.yml b/.github/workflows/bundle-size.yml
index e0ec52086..215ea0646 100644
--- a/.github/workflows/bundle-size.yml
+++ b/.github/workflows/bundle-size.yml
@@ -35,7 +35,8 @@ jobs:
         uses: CLDMV/.github/.github/workflows/reusable-bundle-size.yml@v4
         with:
             build_command: "npm run build:ci"
-            dist_paths: "dist/**"
+            # Every pattern starts with `*` on purpose: the v4.29.2 measure action matches nothing for a bare top-level file and double-counts files when patterns have different roots.
+            dist_paths: "*.mjs,*.cjs,*dist/**/*.mjs,*bin/**"
             # warning_pct: 5
             # warning_bytes: 500
             # comment_mode: "update"

From 9d9dca349e1c121d2ceb58a27cadebe6ad862303 Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:28:01 -0700
Subject: [PATCH 07/49] fix(unified-wrapper): land object/function writes
 through a live view on the underlying object

A wrap-on-set view (`self.X = obj`, including one hung off an
api.slothlet.api.add()-mounted leaf) forwarded primitive writes to the
live impl but stored object- and function-valued writes on the wrapper
itself. The underlying object never saw them, and the wrapper then
shadowed that key, so later raw updates were invisible through the view.

- setTrap: on a deferChildAdopt (wrap-on-set) wrapper, object/function
  writes now Reflect.set onto the live impl, drop any cached own
  property at that key, and propagate a refused write (frozen/sealed
  impl) as a TypeError, the same as the primitive path.
- getTrap: on the same wrappers, an own property is treated as a cache
  of impl[prop] and dropped when the impl has moved on (a cached child
  wrapper fronting a replaced value, or a primitive accessor whose key
  now holds an object), so reads re-resolve and re-wrap from impl.

Ordinary namespaces and EventEmitter-derived module exports keep the
documented userAssigned wrap-on-set behaviour (O15). Docs state the
two-way contract for all value types.

Fixes #495
---
 api_tests/api_test_live_view/store.mjs        |  96 +++++
 api_tests/api_test_live_view/untrusted.mjs    |  30 ++
 .../api_test_live_view_device/session.mjs     |  81 ++++
 docs/API-RULES/API-MUTATION-CONDITIONS.md     |   3 +-
 docs/CONTEXT-PROPAGATION.md                   |  25 ++
 src/lib/handlers/unified-wrapper.mjs          |  33 ++
 ...d-wrapper-live-view-writes.test.vitest.mjs | 361 ++++++++++++++++++
 .../lib/handlers/unified-wrapper.d.mts.map    |   2 +-
 8 files changed, 629 insertions(+), 2 deletions(-)
 create mode 100644 api_tests/api_test_live_view/store.mjs
 create mode 100644 api_tests/api_test_live_view/untrusted.mjs
 create mode 100644 api_tests/api_test_live_view_device/session.mjs
 create mode 100644 tests/vitests/suites/handlers/unified-wrapper-live-view-writes.test.vitest.mjs

diff --git a/api_tests/api_test_live_view/store.mjs b/api_tests/api_test_live_view/store.mjs
new file mode 100644
index 000000000..b2218ffee
--- /dev/null
+++ b/api_tests/api_test_live_view/store.mjs
@@ -0,0 +1,96 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_live_view/store.mjs
+ *	@Date: 2026-09-28T06:11:59-07:00 (1790601119)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 06:11:59 -07:00 (1790601119)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Live-view write fixture (#495). Exposed as `self.store.*`. `assign` grafts a
+ * module-held object onto `self.store.x` via wrap-on-set; `features` and `dispatchRaw` read the
+ * module's own private reference (never the view), so a test can assert that an object- or
+ * function-valued write made THROUGH the view actually landed on the underlying object.
+ * @module api_test_live_view.store
+ * @memberof module:api_test_live_view
+ */
+
+import { self } from "@cldmv/slothlet/runtime";
+
+/** @type {object|null} The module's private reference to the object it published. */
+let held = null;
+
+/**
+ * Builds the shared live-view test shape.
+ * @returns {object} A fresh connection-like object.
+ */
+function buildShape() {
+	return {
+		n: 1,
+		deviceFeatures: [],
+		nested: { inner: {} },
+		onUnhandledPacket: null,
+		/**
+		 * Invokes the currently assigned `onUnhandledPacket` handler with `this` bound to the real object.
+		 * @param {string} packet - Packet payload.
+		 * @returns {unknown} The handler's result, or `"unhandled"` when none is set.
+		 */
+		dispatch(packet) {
+			return typeof this.onUnhandledPacket === "function" ? this.onUnhandledPacket(packet) : "unhandled";
+		}
+	};
+}
+
+/**
+ * Builds a fresh object, keeps a private reference to it, and publishes it at `self.store.x`.
+ * @returns {object} The raw object that was assigned.
+ * @example
+ * const held = await api.store.assign();
+ * api.store.x.deviceFeatures = ["cmd"];
+ * held.deviceFeatures; // ["cmd"]
+ */
+export function assign() {
+	held = buildShape();
+	self.store.x = held;
+	return held;
+}
+
+/**
+ * Reads `deviceFeatures` from the module's own private reference.
+ * @returns {unknown} The current value of `held.deviceFeatures`.
+ */
+export function features() {
+	return held.deviceFeatures;
+}
+
+/**
+ * Invokes `dispatch` on the module's own private reference.
+ * @param {string} packet - Packet payload.
+ * @returns {unknown} The handler's result.
+ */
+export function dispatchRaw(packet) {
+	return held.dispatch(packet);
+}
+
+/**
+ * Writes `deviceFeatures` through the view from inside the owning module.
+ * @param {unknown} value - Value to assign.
+ * @returns {unknown} The value read back through the view.
+ */
+export function setFeaturesViaSelf(value) {
+	self.store.x.deviceFeatures = value;
+	return self.store.x.deviceFeatures;
+}
+
+/**
+ * Reads `self.store.x.nested.inner.c.a` through the view from inside the owning module.
+ * @returns {unknown} The value served through the view.
+ */
+export function peek() {
+	return self.store.x.nested.inner.c.a;
+}
diff --git a/api_tests/api_test_live_view/untrusted.mjs b/api_tests/api_test_live_view/untrusted.mjs
new file mode 100644
index 000000000..b16b75adc
--- /dev/null
+++ b/api_tests/api_test_live_view/untrusted.mjs
@@ -0,0 +1,30 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_live_view/untrusted.mjs
+ *	@Date: 2026-09-28T06:11:59-07:00 (1790601119)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 06:11:59 -07:00 (1790601119)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Caller-identity fixture for the live-view write tests (#495). A permission rule
+ * denies `untrusted.**` against `store.**`, so `peek` must be refused even for a value that was
+ * written through the view rather than present at assignment time.
+ * @module api_test_live_view.untrusted
+ * @memberof module:api_test_live_view
+ */
+
+import { self } from "@cldmv/slothlet/runtime";
+
+/**
+ * Reads `self.store.x.nested.inner.c.a` through the view.
+ * @returns {unknown} The value served through the view (when permitted).
+ */
+export function peek() {
+	return self.store.x.nested.inner.c.a;
+}
diff --git a/api_tests/api_test_live_view_device/session.mjs b/api_tests/api_test_live_view_device/session.mjs
new file mode 100644
index 000000000..59addd27c
--- /dev/null
+++ b/api_tests/api_test_live_view_device/session.mjs
@@ -0,0 +1,81 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_live_view_device/session.mjs
+ *	@Date: 2026-09-28T06:11:59-07:00 (1790601119)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 06:11:59 -07:00 (1790601119)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Live-view write fixture for an `api.slothlet.api.add()`-mounted leaf (#495).
+ * Mounted with `api.slothlet.api.add("devices.d1", …)`, so it is reachable as
+ * `api.devices.d1.session.*`. `open` publishes a module-held connection object at
+ * `self.devices.d1.connection` (the droidsock `device.connection` pattern); `features` and
+ * `dispatchRaw` read the module's own private reference, never the view.
+ * @module api_test_live_view_device.session
+ * @memberof module:api_test_live_view_device
+ */
+
+import { self } from "@cldmv/slothlet/runtime";
+
+/** @type {object|null} The module's private reference to the published connection. */
+let connection = null;
+
+/**
+ * Opens a connection object, keeps a private reference, and publishes it on the mounted leaf.
+ * @returns {object} The raw connection object.
+ * @example
+ * const conn = await api.devices.d1.session.open();
+ * api.devices.d1.connection.deviceFeatures = ["cmd"];
+ * conn.deviceFeatures; // ["cmd"]
+ */
+export function open() {
+	connection = {
+		n: 1,
+		deviceFeatures: [],
+		nested: { inner: {} },
+		onUnhandledPacket: null,
+		/**
+		 * Invokes the currently assigned `onUnhandledPacket` handler with `this` bound to the real object.
+		 * @param {string} packet - Packet payload.
+		 * @returns {unknown} The handler's result, or `"unhandled"` when none is set.
+		 */
+		dispatch(packet) {
+			return typeof this.onUnhandledPacket === "function" ? this.onUnhandledPacket(packet) : "unhandled";
+		}
+	};
+	self.devices.d1.connection = connection;
+	return connection;
+}
+
+/**
+ * Reads `deviceFeatures` from the module's own private connection reference.
+ * @returns {unknown} The current value of `connection.deviceFeatures`.
+ */
+export function features() {
+	return connection.deviceFeatures;
+}
+
+/**
+ * Invokes `dispatch` on the module's own private connection reference.
+ * @param {string} packet - Packet payload.
+ * @returns {unknown} The handler's result.
+ */
+export function dispatchRaw(packet) {
+	return connection.dispatch(packet);
+}
+
+/**
+ * Writes `deviceFeatures` through the view from inside the owning module.
+ * @param {unknown} value - Value to assign.
+ * @returns {unknown} The value read back through the view.
+ */
+export function setFeaturesViaSelf(value) {
+	self.devices.d1.connection.deviceFeatures = value;
+	return self.devices.d1.connection.deviceFeatures;
+}
diff --git a/docs/API-RULES/API-MUTATION-CONDITIONS.md b/docs/API-RULES/API-MUTATION-CONDITIONS.md
index 4e76ac851..beb7faf89 100644
--- a/docs/API-RULES/API-MUTATION-CONDITIONS.md
+++ b/docs/API-RULES/API-MUTATION-CONDITIONS.md
@@ -53,10 +53,11 @@ if (next === undefined) {
 
 **Pattern**: A runtime top-level write wraps callable/object values through `UnifiedWrapper` (flagged `userAssigned`); primitives are stored raw.
 
-**Source(s)**: `src/lib/handlers/api-manager.mjs:573-586` · `src/lib/handlers/unified-wrapper.mjs:4652-4699` (set-trap)
+**Source(s)**: `src/lib/handlers/api-manager.mjs:573-586` · `src/lib/handlers/unified-wrapper.mjs:4789-4928` (set-trap) · `:3834-3850` (live-view read revalidation)
 
 **Trigger**: `typeof value === "function" || (value !== null && typeof value === "object")`
 **Result**: wrapped proxy stored (see O15 for reload survival); primitive stored directly.
+**Live view writes**: the wrapped proxy is a two-way view onto the assigned object. A later write _through_ that view, of any value type (primitive, object, array or function), is applied to the underlying object with `Reflect.set` and served back wrapped from it on read. It is never stored on the view, so it cannot shadow a later raw update of the same key (#495). A write the underlying object refuses (frozen or sealed) throws `TypeError`. Only the top-level assignment onto a namespace is wrapped onto that namespace and tagged `userAssigned`.
 
 ---
 
diff --git a/docs/CONTEXT-PROPAGATION.md b/docs/CONTEXT-PROPAGATION.md
index 938068aab..ff43b996d 100644
--- a/docs/CONTEXT-PROPAGATION.md
+++ b/docs/CONTEXT-PROPAGATION.md
@@ -129,6 +129,31 @@ Two rules apply:
 - **Owner-scoped writes.** A module's writes are restricted to its own mount-point subtree. A module mounted at `api.lib.config` can write `self.lib.config.*` but not `self.lib.ssh.*` or any other top-level namespace. External code (no module-bound caller) and base-module code own the whole tree and can write anywhere. The error code on violation is `LOOSE_SET_NOT_OWNED`.
 - **Wrap-on-set for callables and objects.** When the assigned value is a function or object, it gets a `UnifiedWrapper` (the same wrapper construction `api.slothlet.api.add()` uses). Primitives stay as-is. **Limitation:** hook / permission / lifecycle integration on synthetic wrappers from `self.X = …` is incomplete — for fully lifecycle-integrated mounts, use `api.slothlet.api.add()`.
 
+The wrapper is a **live, two-way view** onto the assigned object, not a copy. This holds wherever the assignment lands, including on a leaf mounted with `api.slothlet.api.add()`, and in both eager and lazy mode:
+
+- A raw write to the original object is visible through the view.
+- A write through the view lands on the original object. This covers every value type: primitives, objects, arrays and functions, at any depth. The value is stored on the underlying object and served back wrapped from it on read. The view never keeps its own copy, so a later raw update of the same key is visible through the view too.
+
+```javascript
+// Inside a module mounted at api.devices.d1:
+const connection = { deviceFeatures: [], onUnhandledPacket: null };
+self.devices.d1.connection = connection;
+
+// Anywhere else:
+api.devices.d1.connection.deviceFeatures = ["cmd"];
+connection.deviceFeatures; // ["cmd"] (the same array)
+
+api.devices.d1.connection.onUnhandledPacket = (packet) => handle(packet);
+typeof connection.onUnhandledPacket; // "function"
+
+connection.deviceFeatures = ["later"];
+[...api.devices.d1.connection.deviceFeatures]; // ["later"]
+```
+
+The view is not identical to the object (`api.devices.d1.connection !== connection`), because it is a wrapper. `instanceof`, method calls (which run with the real object as `this`) and native objects such as `EventEmitter` and `net.Socket` all behave as they do on the original. Values read through the view are still read-gated by [permissions](PERMISSIONS.md), including values that were written through the view. A write that the underlying object refuses, for example because it is frozen, throws a `TypeError` just like a direct assignment in strict mode.
+
+This applies only to the assigned object and everything beneath it. Assigning a new key directly on an ordinary module namespace (`api.store.extra = {…}`) still stores a wrapped override on that namespace, as described above.
+
 This was fixed in v3.5.0. Before that, `self.X = …` was silently dropped (proxy default-set onto an empty literal target).
 
 ---
diff --git a/src/lib/handlers/unified-wrapper.mjs b/src/lib/handlers/unified-wrapper.mjs
index 79ba73ae2..036fff544 100644
--- a/src/lib/handlers/unified-wrapper.mjs
+++ b/src/lib/handlers/unified-wrapper.mjs
@@ -3830,6 +3830,24 @@ export class UnifiedWrapper extends ComponentBase {
 			// Return these children directly instead of creating waiting proxy.
 			// No reserved-name re-check here: every framework name either returned from its own handler
 			// above or was filtered by `isInternalProp`, so anything still in flight is a module member.
+			//
+			// On a wrap-on-set LIVE VIEW (`deferChildAdopt`) an own property is only a cache of
+			// `impl[prop]` (#495). Drop it when the underlying object has since moved on, so the read
+			// below re-resolves from impl instead of serving a stale child: a cached child wrapper
+			// fronting a value the key no longer holds, or a primitive live accessor whose key now holds
+			// an object (the accessor would hand that object back raw, unwrapped).
+			if (wrapper.____slothletInternal.deferChildAdopt && hasOwn(wrapper, prop)) {
+				const liveImpl = wrapper.____slothletInternal.impl;
+				if (liveImpl !== null && (typeof liveImpl === "object" || typeof liveImpl === "function") && prop in liveImpl) {
+					const cachedDesc = Object.getOwnPropertyDescriptor(wrapper, prop);
+					const current = liveImpl[prop];
+					const stale =
+						typeof cachedDesc.get === "function"
+							? current !== null && (typeof current === "object" || typeof current === "function")
+							: cachedDesc.value !== current && resolveWrapper(cachedDesc.value)?.____slothletInternal.impl !== current;
+					if (stale) delete wrapper[prop];
+				}
+			}
 			if (hasOwn(wrapper, prop)) {
 				// CRITICAL: In replace mode, check if property should exist at all
 				if (wrapper.____slothletInternal.state.collisionMode === "replace" && (prop === "power" || prop === "add")) {
@@ -4837,6 +4855,21 @@ export class UnifiedWrapper extends ComponentBase {
 						}
 						return true;
 					}
+				} else if (wrapper.____slothletInternal.deferChildAdopt) {
+					// Object/function write against a wrap-on-set LIVE VIEW (#495): land it on the live
+					// impl exactly like the primitive branch above, rather than wrap-on-set onto the
+					// wrapper. getTrap then serves it back lazily wrapped FROM impl, so the underlying
+					// object sees the write and the view never shadows a later raw update of the key.
+					// Any own property cached at this key (a child wrapper from an earlier read) is
+					// dropped so the next read re-resolves from impl. Scoped to `deferChildAdopt` only:
+					// an EventEmitter-derived module export is not a wrap-on-set view, and its
+					// object writes stay userAssigned wrapper overrides that survive reload (O15).
+					const liveImpl = wrapper.____slothletInternal.impl;
+					if (liveImpl !== null && (typeof liveImpl === "object" || typeof liveImpl === "function")) {
+						if (!Reflect.set(liveImpl, prop, value)) return false;
+						if (hasOwn(wrapper, prop)) delete wrapper[prop];
+						return true;
+					}
 				}
 
 				// Delete property first if it exists (to allow reassignment)
diff --git a/tests/vitests/suites/handlers/unified-wrapper-live-view-writes.test.vitest.mjs b/tests/vitests/suites/handlers/unified-wrapper-live-view-writes.test.vitest.mjs
new file mode 100644
index 000000000..d9cebc6ee
--- /dev/null
+++ b/tests/vitests/suites/handlers/unified-wrapper-live-view-writes.test.vitest.mjs
@@ -0,0 +1,361 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/handlers/unified-wrapper-live-view-writes.test.vitest.mjs
+ *	@Date: 2026-09-28T06:11:59-07:00 (1790601119)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 06:11:59 -07:00 (1790601119)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Regression coverage for #495 — object- and function-valued writes through a live
+ * view (a wrap-on-set graft, including one hung off an `api.slothlet.api.add()`-mounted leaf) must
+ * land on the underlying object exactly like primitive writes already do (#340), be served back
+ * wrapped from that object on read, and never shadow later updates made to the underlying object.
+ *
+ * Every behavioural case runs through both routes and both modes:
+ *  - `self.store.x = held` wrap-on-set from a base module (`api.store.x` is the view)
+ *  - `self.devices.d1.connection = conn` from a module mounted via `api.slothlet.api.add("devices.d1", …)`
+ *    (`api.devices.d1.connection` is the view — the droidsock `device.connection` case)
+ */
+import { describe, it, expect, afterEach } from "vitest";
+import { EventEmitter } from "node:events";
+import net from "node:net";
+import slothlet from "../../../../index.mjs";
+import { resolveWrapper } from "#handlers/unified-wrapper";
+
+const BASE = new URL("../../../../api_tests/api_test_live_view", import.meta.url).pathname;
+const DEVICE_DIR = new URL("../../../../api_tests/api_test_live_view_device", import.meta.url).pathname;
+
+/**
+ * Route descriptors. `setup` returns the raw object the module holds privately, a `view()` getter
+ * that re-reads the view through the api every time, and the module's own raw-reference readers.
+ */
+const ROUTES = {
+	"wrap-on-set (self.X = obj)": {
+		async setup(api) {
+			const raw = await api.store.assign();
+			return {
+				raw,
+				view: () => api.store.x,
+				features: () => api.store.features(),
+				dispatchRaw: (packet) => api.store.dispatchRaw(packet),
+				setFeaturesViaSelf: (value) => api.store.setFeaturesViaSelf(value)
+			};
+		}
+	},
+	"api.add()-mounted leaf": {
+		async setup(api) {
+			await api.slothlet.api.add("devices.d1", DEVICE_DIR, { moduleID: "device-d1" });
+			const raw = await api.devices.d1.session.open();
+			return {
+				raw,
+				view: () => api.devices.d1.connection,
+				features: () => api.devices.d1.session.features(),
+				dispatchRaw: (packet) => api.devices.d1.session.dispatchRaw(packet),
+				setFeaturesViaSelf: (value) => api.devices.d1.session.setFeaturesViaSelf(value)
+			};
+		}
+	}
+};
+
+describe.each(["eager", "lazy"])("UnifiedWrapper > live view object/function writes (#495) [%s]", (mode) => {
+	let api;
+
+	afterEach(async () => {
+		if (api) await api.shutdown();
+		api = null;
+	});
+
+	describe.each(Object.keys(ROUTES))("%s", (routeName) => {
+		const route = ROUTES[routeName];
+
+		const boot = async (extra = {}) => {
+			api = await slothlet({ base: BASE, mode, permissions: { defaultPolicy: "allow" }, ...extra });
+			return route.setup(api);
+		};
+
+		it("an object write through the view reaches the underlying object", async () => {
+			const { raw, view, features } = await boot();
+			const cmds = ["cmd"];
+
+			view().deviceFeatures = cmds;
+
+			expect(raw.deviceFeatures).toBe(cmds);
+			expect(raw.deviceFeatures).toEqual(["cmd"]);
+			// The module's own method reading its private reference sees the write (droidsock deviceFeatures).
+			expect(await features()).toEqual(["cmd"]);
+			// Served back through the view, wrapped from the underlying object.
+			expect([...view().deviceFeatures]).toEqual(["cmd"]);
+			expect(view().deviceFeatures.length).toBe(1);
+			expect(resolveWrapper(view().deviceFeatures)).not.toBeNull();
+		});
+
+		it("a write made from inside the owning module through self reaches the underlying object", async () => {
+			const { raw, setFeaturesViaSelf } = await boot();
+
+			const readBack = await setFeaturesViaSelf(["from-self"]);
+
+			expect([...readBack]).toEqual(["from-self"]);
+			expect(raw.deviceFeatures).toEqual(["from-self"]);
+		});
+
+		it("a nested object write through the view reaches the underlying object", async () => {
+			const { raw, view } = await boot();
+
+			view().nested.inner.c = { a: 1 };
+
+			expect(raw.nested.inner.c).toEqual({ a: 1 });
+			expect(view().nested.inner.c.a).toBe(1);
+
+			// And a primitive write below the written object is still two-way.
+			view().nested.inner.c.a = 2;
+			expect(raw.nested.inner.c.a).toBe(2);
+		});
+
+		it("a function write through the view reaches the underlying object and is callable from either side", async () => {
+			const { raw, view, dispatchRaw } = await boot();
+			const handler = (packet) => `got:${packet}`;
+
+			view().onUnhandledPacket = handler;
+
+			expect(raw.onUnhandledPacket).toBe(handler);
+			expect(raw.dispatch("a")).toBe("got:a");
+			expect(await dispatchRaw("b")).toBe("got:b");
+			expect(await view().onUnhandledPacket("c")).toBe("got:c");
+			expect(await view().dispatch("d")).toBe("got:d");
+		});
+
+		it("a later update of the key on the underlying object stays visible through the view (no shadowing)", async () => {
+			const { raw, view, features } = await boot();
+
+			view().deviceFeatures = ["cmd"];
+			expect([...view().deviceFeatures]).toEqual(["cmd"]);
+
+			raw.deviceFeatures = ["later"];
+			expect([...view().deviceFeatures]).toEqual(["later"]);
+			expect(await features()).toEqual(["later"]);
+
+			// A cached nested child read earlier is not served stale after the raw object replaces it.
+			expect(view().nested.inner).toBeDefined();
+			raw.nested = { inner: { fresh: true } };
+			expect(view().nested.inner.fresh).toBe(true);
+
+			// A function replaced on the raw side is the one called through the view.
+			view().onUnhandledPacket = () => "first";
+			expect(await view().onUnhandledPacket()).toBe("first");
+			raw.onUnhandledPacket = () => "second";
+			expect(await view().onUnhandledPacket()).toBe("second");
+		});
+
+		it("a key can switch between primitive and object values in either direction", async () => {
+			const { raw, view } = await boot();
+
+			view().n = 10;
+			expect(raw.n).toBe(10);
+			raw.n = 11;
+			expect(view().n).toBe(11);
+
+			// primitive → object through the view
+			view().n = { deep: 1 };
+			expect(raw.n).toEqual({ deep: 1 });
+			expect(view().n.deep).toBe(1);
+			expect(resolveWrapper(view().n)).not.toBeNull();
+
+			// object → primitive through the view
+			view().n = 12;
+			expect(raw.n).toBe(12);
+			expect(view().n).toBe(12);
+
+			// primitive → object on the raw side, after the view has a live primitive accessor for the key
+			raw.n = { deep: 2 };
+			expect(view().n.deep).toBe(2);
+			expect(resolveWrapper(view().n)).not.toBeNull();
+		});
+
+		it("an EventEmitter written through the view stays the real instance and works through the view", async () => {
+			const { raw, view } = await boot();
+			const emitter = new EventEmitter();
+
+			view().events = emitter;
+
+			expect(raw.events).toBe(emitter);
+			expect(view().events instanceof EventEmitter).toBe(true);
+			let fired = null;
+			view().events.on("ping", (value) => {
+				fired = value;
+			});
+			emitter.emit("ping", 7);
+			expect(fired).toBe(7);
+		});
+
+		it("a connected net.Socket written through the view keeps working native methods through the view", async () => {
+			const { raw, view } = await boot();
+			// Echo server: replies only after the client writes, so the client's listeners (attached
+			// through the view) are guaranteed to be in place before any data arrives.
+			const server = net.createServer((conn) => {
+				conn.on("error", () => {});
+				conn.on("data", (chunk) => conn.end(`echo:${chunk.toString()}`));
+			});
+			await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+			const socket = new net.Socket();
+			socket.on("error", () => {});
+			try {
+				await new Promise((resolve, reject) => {
+					socket.once("error", reject);
+					socket.connect(server.address().port, "127.0.0.1", resolve);
+				});
+
+				view().socket = socket;
+
+				expect(raw.socket).toBe(socket);
+				expect(view().socket instanceof net.Socket).toBe(true);
+				const received = await new Promise((resolve) => {
+					let data = "";
+					view().socket.on("data", (chunk) => {
+						data += chunk.toString();
+					});
+					view().socket.on("end", () => resolve(data));
+					// A native stream method called through the view (needs the real socket as `this`).
+					view().socket.write("ping");
+				});
+				expect(received).toBe("echo:ping");
+			} finally {
+				socket.destroy();
+				await new Promise((resolve) => server.close(resolve));
+			}
+		});
+	});
+});
+
+describe("UnifiedWrapper > live view object/function writes (#495) — permissions, ownership, reload", () => {
+	let api;
+
+	afterEach(async () => {
+		if (api) await api.shutdown();
+		api = null;
+	});
+
+	it("read gating still applies to a value that was written through the view", async () => {
+		api = await slothlet({
+			base: BASE,
+			mode: "eager",
+			permissions: {
+				defaultPolicy: "allow",
+				readGating: true,
+				rules: [{ caller: "untrusted.**", target: "store.**", effect: "deny" }]
+			}
+		});
+		const raw = await api.store.assign();
+
+		api.store.x.nested.inner.c = { a: 42 };
+		expect(raw.nested.inner.c).toEqual({ a: 42 });
+
+		// The owning module reads it back through the view.
+		expect(await api.store.peek()).toBe(42);
+
+		// A caller denied against store.** is refused on the written value too.
+		await expect(async () => api.untrusted.peek()).rejects.toThrow(/PERMISSION_DENIED/);
+	});
+
+	it("an object write against a frozen underlying object throws instead of silently reporting success", async () => {
+		api = await slothlet({ base: BASE, mode: "eager", permissions: { defaultPolicy: "allow" } });
+		const raw = await api.store.assign();
+		const before = raw.deviceFeatures;
+		Object.freeze(raw);
+
+		// Reflect.set fails (returns false) on the frozen object; the set trap must propagate that
+		// so the strict-mode assignment throws, exactly like the primitive-write path (#340).
+		expect(() => {
+			api.store.x.deviceFeatures = ["cmd"];
+		}).toThrow(TypeError);
+		expect(raw.deviceFeatures).toBe(before);
+	});
+
+	it("a write through a stale view of a removed module does not reach the old underlying object", async () => {
+		api = await slothlet({ base: BASE, mode: "eager", permissions: { defaultPolicy: "allow" } });
+		await api.slothlet.api.add("devices.d1", DEVICE_DIR, { moduleID: "device-d1" });
+		const conn = await api.devices.d1.session.open();
+		const staleView = api.devices.d1.connection;
+
+		await api.slothlet.api.remove("device-d1");
+
+		// Removal invalidates the view and drops its live impl; a write through a retained stale
+		// reference must not silently mutate the object the removed module used to publish.
+		expect(resolveWrapper(staleView).____slothletInternal.impl).toBeNull();
+		expect(() => {
+			staleView.deviceFeatures = ["late"];
+		}).not.toThrow();
+		expect(conn.deviceFeatures).toEqual([]);
+		expect(staleView.deviceFeatures).toBeUndefined();
+	});
+
+	it("a child adopted onto the view by an internal eager re-adopt is still served after adoption moved it off impl", async () => {
+		api = await slothlet({ base: BASE, mode: "eager", permissions: { defaultPolicy: "allow" } });
+		await api.store.assign();
+		const xWrapper = resolveWrapper(api.store.x);
+
+		// ___setImpl -> _applyNewImpl -> ___adoptImplChildren (the collision/reload reuse path) adopts
+		// `child` onto the wrapper and deletes it from the (cloned) impl. The live-view read
+		// revalidation must only drop a cached child when impl still HAS the key with a different
+		// value — never because adoption moved the key off impl.
+		xWrapper.___setImpl({ y: 1, child: { k: 1 } }, null, true);
+		expect("child" in xWrapper.____slothletInternal.impl).toBe(false);
+		expect(api.store.x.child.k).toBe(1);
+	});
+
+	it("an object write onto an ORDINARY (non-live) namespace still stores a userAssigned wrapper on the namespace", async () => {
+		api = await slothlet({ base: BASE, mode: "eager", permissions: { defaultPolicy: "allow" } });
+
+		const extra = { a: 1 };
+		api.store.extra = extra;
+
+		// Not a live view: the value is wrap-on-set onto the namespace wrapper, tagged userAssigned.
+		const extraWrapper = resolveWrapper(api.store.extra);
+		expect(extraWrapper).not.toBeNull();
+		expect(extraWrapper.____slothletInternal.userAssigned).toBe(true);
+		expect(api.store.extra.a).toBe(1);
+	});
+
+	it("the view assigned on an api.add()-mounted leaf keeps its writes, and stays two-way, across a reload of that module", async () => {
+		api = await slothlet({ base: BASE, mode: "eager", permissions: { defaultPolicy: "allow" } });
+		await api.slothlet.api.add("devices.d1", DEVICE_DIR, { moduleID: "device-d1" });
+		const conn = await api.devices.d1.session.open();
+
+		api.devices.d1.connection.deviceFeatures = ["cmd"];
+		const handler = () => "handled";
+		api.devices.d1.connection.onUnhandledPacket = handler;
+
+		await api.slothlet.api.reload("device-d1");
+
+		// The userAssigned `connection` view survives the reload (O15) and still fronts the same object.
+		expect(resolveWrapper(api.devices.d1.connection).____slothletInternal.userAssigned).toBe(true);
+		expect([...api.devices.d1.connection.deviceFeatures]).toEqual(["cmd"]);
+		expect(await api.devices.d1.connection.onUnhandledPacket()).toBe("handled");
+		expect(conn.deviceFeatures).toEqual(["cmd"]);
+
+		// Still two-way after the reload.
+		api.devices.d1.connection.deviceFeatures = ["after-reload"];
+		expect(conn.deviceFeatures).toEqual(["after-reload"]);
+		conn.deviceFeatures = ["raw-after-reload"];
+		expect([...api.devices.d1.connection.deviceFeatures]).toEqual(["raw-after-reload"]);
+	});
+
+	it("the wrap-on-set view keeps its writes across a selective reload of its owning module", async () => {
+		api = await slothlet({ base: BASE, mode: "eager", permissions: { defaultPolicy: "allow" } });
+		const raw = await api.store.assign();
+
+		api.store.x.deviceFeatures = ["cmd"];
+
+		await api.slothlet.api.reload("store");
+
+		expect(resolveWrapper(api.store.x).____slothletInternal.userAssigned).toBe(true);
+		expect([...api.store.x.deviceFeatures]).toEqual(["cmd"]);
+		api.store.x.deviceFeatures = ["after-reload"];
+		expect(raw.deviceFeatures).toEqual(["after-reload"]);
+	});
+});
diff --git a/types/src/lib/handlers/unified-wrapper.d.mts.map b/types/src/lib/handlers/unified-wrapper.d.mts.map
index 18cdec8b7..3dd243a01 100644
--- a/types/src/lib/handlers/unified-wrapper.d.mts.map
+++ b/types/src/lib/handlers/unified-wrapper.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"unified-wrapper.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/unified-wrapper.mjs"],"names":[],"mappings":"AA0xBA;;;;;;;;;;;;;;;;;;GAkBG;AACH,4CAhBW,MAAM,GAAC,MAAM,GACX,OAAO,CAkBnB;AA+vID;;;;;;;;;;;GAWG;AACH,sCAPW,OAAO,GACL,cAAc,GAAC,IAAI,CAkB/B;AAxzID;;;;;;;;GAQG;AACH,iCAHU,GAAG,CAAC,MAAM,CAAC,CAG2F;;;;;AAuEhH;;;;;;;;;;GAUG;AACH;IAiTC;;;;;;;;;;;;;;;;OAgBG;IACH,0BAsCC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,gCAiEC;IAnaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,sBAjCW,MAAM,uJAEd;QAAwB,IAAI,EAApB,MAAM;QACU,OAAO,EAAvB,MAAM;QACyB,WAAW;QACvB,eAAe;QAChB,UAAU;QACV,mBAAmB;QACpB,QAAQ;QACR,QAAQ;QACR,YAAY;QACE,cAAc;QAI3B,eAAe;KAMzC,EA4MF;IAnPD;;;;;;;;;;;OAWG;IACH,4BAFa,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAC,SAAS,CAKzC;IAsOD;;;;;;;;;;OAUG;IACH,uEAHa,GAAC,CA+Bb;IAED;;;;OAIG;IACH,qBAHa,WAAS,MAAM,GAAC,IAAI,CAKhC;IAiJD;;;;;;;;;;;OAWG;IACH,sBAiCC;IAED;;;;;;;;;;;;OAYG;IACH,mBAgDC;IAED;;;;;;;;;OASG;IACH,qBAsDC;IAED;;;;OAIG;IACH,uBA4GC;IAED;;;;;;;;;OASG;IACH,qBAEC;IAED;;;;;;;;;OASG;IACH,sBAiBC;IAED;;;;;;;;;;OAUG;IACH,6BA4gBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BAgOC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BA43BC;IAED;;;;;;OAMG;IACH,uCAmwDC;;CACD;8BApgK6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"unified-wrapper.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/unified-wrapper.mjs"],"names":[],"mappings":"AA0xBA;;;;;;;;;;;;;;;;;;GAkBG;AACH,4CAhBW,MAAM,GAAC,MAAM,GACX,OAAO,CAkBnB;AAgyID;;;;;;;;;;;GAWG;AACH,sCAPW,OAAO,GACL,cAAc,GAAC,IAAI,CAkB/B;AAz1ID;;;;;;;;GAQG;AACH,iCAHU,GAAG,CAAC,MAAM,CAAC,CAG2F;;;;;AAuEhH;;;;;;;;;;GAUG;AACH;IAiTC;;;;;;;;;;;;;;;;OAgBG;IACH,0BAsCC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,gCAiEC;IAnaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,sBAjCW,MAAM,uJAEd;QAAwB,IAAI,EAApB,MAAM;QACU,OAAO,EAAvB,MAAM;QACyB,WAAW;QACvB,eAAe;QAChB,UAAU;QACV,mBAAmB;QACpB,QAAQ;QACR,QAAQ;QACR,YAAY;QACE,cAAc;QAI3B,eAAe;KAMzC,EA4MF;IAnPD;;;;;;;;;;;OAWG;IACH,4BAFa,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAC,SAAS,CAKzC;IAsOD;;;;;;;;;;OAUG;IACH,uEAHa,GAAC,CA+Bb;IAED;;;;OAIG;IACH,qBAHa,WAAS,MAAM,GAAC,IAAI,CAKhC;IAiJD;;;;;;;;;;;OAWG;IACH,sBAiCC;IAED;;;;;;;;;;;;OAYG;IACH,mBAgDC;IAED;;;;;;;;;OASG;IACH,qBAsDC;IAED;;;;OAIG;IACH,uBA4GC;IAED;;;;;;;;;OASG;IACH,qBAEC;IAED;;;;;;;;;OASG;IACH,sBAiBC;IAED;;;;;;;;;;OAUG;IACH,6BA4gBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BAgOC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BA43BC;IAED;;;;;;OAMG;IACH,uCAoyDC;;CACD;8BAriK6B,2BAA2B"}
\ No newline at end of file

From 0a5e031e7b3c4e51250a5844418b2f36aaefc1e3 Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Mon, 28 Sep 2026 10:08:18 -0700
Subject: [PATCH 08/49] fix(typescript): ship strict mode's type-generation
 worker in the package

`typescript: { mode: "strict" }` forks a worker to generate the api's
declaration file, but the worker lived in tools/build/ and imported
../../src/..., and neither tools/ nor src/ is in package.json `files`.
Strict mode could only work inside this repository; from an npm install
it failed with MODULE_NOT_FOUND for tools/build/generate-types-worker.mjs.

The worker now lives in src/lib/processors/type-generation-worker.mjs,
ships as dist/lib/processors/, and imports only @cldmv/slothlet
self-references, so it resolves to src/ under the slothlet-dev condition
and to dist/ when installed. The loader resolves it with
typeGenerationWorkerPath() on the Node-only strict path (path/url are
null in browser mode, and the literal new URL("./x", import.meta.url)
form makes vite load the worker into the current process).

The worker's logic is exported (runTypeGeneration, runIfEntry) and only
runs when the file is the process's entry script, so importing it never
starts a build or exits the importer, and tests drive it in-process.
A missing SLOTHLET_CONFIG raises TS_TYPE_GENERATION_WORKER_NO_CONFIG.

Fixes #500
---
 src/lib/i18n/languages/de-de.json             |   4 +-
 src/lib/i18n/languages/en-gb.json             |   4 +-
 src/lib/i18n/languages/en-us.json             |   4 +-
 src/lib/i18n/languages/es-es.json             |   4 +-
 src/lib/i18n/languages/es-mx.json             |   4 +-
 src/lib/i18n/languages/fr-fr.json             |   4 +-
 src/lib/i18n/languages/hi-in.json             |   4 +-
 src/lib/i18n/languages/ja-jp.json             |   6 +-
 src/lib/i18n/languages/ko-kr.json             |   4 +-
 src/lib/i18n/languages/pt-br.json             |   4 +-
 src/lib/i18n/languages/ru-ru.json             |   4 +-
 src/lib/i18n/languages/zh-cn.json             |   4 +-
 src/lib/processors/loader.mjs                 |  22 ++-
 src/lib/processors/type-generation-worker.mjs |  85 ++++++++++
 ...cript-strict-mode-packaged.test.vitest.mjs | 154 ++++++++++++++++++
 tools/build/generate-types-worker.mjs         |  69 --------
 tools/ci/i18n-latin-tokens-accepted.json      |  19 ++-
 types/src/lib/processors/loader.d.mts         |  12 ++
 types/src/lib/processors/loader.d.mts.map     |   2 +-
 .../processors/type-generation-worker.d.mts   |  31 ++++
 .../type-generation-worker.d.mts.map          |   1 +
 21 files changed, 356 insertions(+), 89 deletions(-)
 create mode 100644 src/lib/processors/type-generation-worker.mjs
 create mode 100644 tests/vitests/suites/typescript/typescript-strict-mode-packaged.test.vitest.mjs
 delete mode 100644 tools/build/generate-types-worker.mjs
 create mode 100644 types/src/lib/processors/type-generation-worker.d.mts
 create mode 100644 types/src/lib/processors/type-generation-worker.d.mts.map

diff --git a/src/lib/i18n/languages/de-de.json b/src/lib/i18n/languages/de-de.json
index 7df022983..929bd3f54 100644
--- a/src/lib/i18n/languages/de-de.json
+++ b/src/lib/i18n/languages/de-de.json
@@ -353,7 +353,9 @@
 		"TS_TYPE_GENERATION_FAILED": "Typ-Generierung fehlgeschlagen: {error}",
 		"HINT_TS_TYPE_GENERATION_FAILED": "Der Kindprozess, der die TypeScript-Deklarationen generiert, ist auf einen Fehler gestoßen. Prüfen Sie die Fehlermeldung auf Details und stellen Sie sicher, dass die TypeScript-Quelldateien gültig sind.",
 		"TS_TYPE_GENERATION_FORK_FAILED": "Fehler beim Forken des Typ-Generierungs-Prozesses: {error}",
-		"HINT_TS_TYPE_GENERATION_FORK_FAILED": "Der Worker-Prozess zur Typ-Generierung konnte nicht gestartet werden. Stellen Sie sicher, dass Node.js Berechtigungen zum Forken von Kindprozessen hat und das Script tools/build/generate-types-worker.mjs existiert.",
+		"HINT_TS_TYPE_GENERATION_FORK_FAILED": "Der Worker-Prozess zur Typ-Generierung konnte nicht gestartet werden. Stellen Sie sicher, dass Node.js Berechtigungen zum Forken von Kindprozessen hat und das Script lib/processors/type-generation-worker.mjs existiert.",
+		"TS_TYPE_GENERATION_WORKER_NO_CONFIG": "Der Worker zur Typ-Generierung wurde ohne seine Konfiguration gestartet (SLOTHLET_CONFIG ist nicht gesetzt).",
+		"HINT_TS_TYPE_GENERATION_WORKER_NO_CONFIG": "Dieser Worker wird vom strikten TypeScript-Modus mit seiner Konfiguration in der Umgebungsvariable SLOTHLET_CONFIG gestartet. Lassen Sie slothlet ihn forken, statt die Datei direkt auszuführen.",
 		"TS_TYPE_GENERATION_PROCESS_EXITED": "Prozess zur Typ-Generierung mit Code {code} beendet: {output}",
 		"HINT_TS_TYPE_GENERATION_PROCESS_EXITED": "Der Kindprozess zur Typ-Generierung wurde mit einem Nicht-Null-Code beendet. Prüfen Sie die Ausgabe auf Compiler-Fehler und stellen Sie sicher, dass die TypeScript-Quellen gültig sind.",
 		"TS_TYPE_CHECK_ERRORS": "TypeScript-Typfehler in '{filePath}' gefunden:\n{errors}",
diff --git a/src/lib/i18n/languages/en-gb.json b/src/lib/i18n/languages/en-gb.json
index 69a6f5193..1c491eefe 100644
--- a/src/lib/i18n/languages/en-gb.json
+++ b/src/lib/i18n/languages/en-gb.json
@@ -353,7 +353,9 @@
 		"TS_TYPE_GENERATION_FAILED": "Type generation failed: {error}",
 		"HINT_TS_TYPE_GENERATION_FAILED": "The child process that generates TypeScript declarations encountered an error. Check the error message for details and ensure the TypeScript source files are valid.",
 		"TS_TYPE_GENERATION_FORK_FAILED": "Failed to fork the type generation process: {error}",
-		"HINT_TS_TYPE_GENERATION_FORK_FAILED": "The type generation worker process could not be started. Ensure Node.js has permission to fork child processes and that the tools/build/generate-types-worker.mjs script exists.",
+		"HINT_TS_TYPE_GENERATION_FORK_FAILED": "The type generation worker process could not be started. Ensure Node.js has permission to fork child processes and that the lib/processors/type-generation-worker.mjs script exists.",
+		"TS_TYPE_GENERATION_WORKER_NO_CONFIG": "The type generation worker was started without its configuration (SLOTHLET_CONFIG is not set).",
+		"HINT_TS_TYPE_GENERATION_WORKER_NO_CONFIG": "This worker is started by strict TypeScript mode with its configuration in the SLOTHLET_CONFIG environment variable. Let slothlet fork it rather than running the file directly.",
 		"TS_TYPE_GENERATION_PROCESS_EXITED": "Type generation process exited with code {code}: {output}",
 		"HINT_TS_TYPE_GENERATION_PROCESS_EXITED": "The type generation child process exited with a non-zero code. Check the output for compiler errors and verify the TypeScript sources are valid.",
 		"TS_TYPE_CHECK_ERRORS": "TypeScript type errors found in '{filePath}':\n{errors}",
diff --git a/src/lib/i18n/languages/en-us.json b/src/lib/i18n/languages/en-us.json
index ee411e401..3abf3df9c 100644
--- a/src/lib/i18n/languages/en-us.json
+++ b/src/lib/i18n/languages/en-us.json
@@ -353,7 +353,9 @@
 		"TS_TYPE_GENERATION_FAILED": "Type generation failed: {error}",
 		"HINT_TS_TYPE_GENERATION_FAILED": "The child process that generates TypeScript declarations encountered an error. Check the error message for details and ensure the TypeScript source files are valid.",
 		"TS_TYPE_GENERATION_FORK_FAILED": "Failed to fork the type generation process: {error}",
-		"HINT_TS_TYPE_GENERATION_FORK_FAILED": "The type generation worker process could not be started. Ensure Node.js has permission to fork child processes and that the tools/build/generate-types-worker.mjs script exists.",
+		"HINT_TS_TYPE_GENERATION_FORK_FAILED": "The type generation worker process could not be started. Ensure Node.js has permission to fork child processes and that the lib/processors/type-generation-worker.mjs script exists.",
+		"TS_TYPE_GENERATION_WORKER_NO_CONFIG": "The type generation worker was started without its configuration (SLOTHLET_CONFIG is not set).",
+		"HINT_TS_TYPE_GENERATION_WORKER_NO_CONFIG": "This worker is started by strict TypeScript mode with its configuration in the SLOTHLET_CONFIG environment variable. Let slothlet fork it rather than running the file directly.",
 		"TS_TYPE_GENERATION_PROCESS_EXITED": "Type generation process exited with code {code}: {output}",
 		"HINT_TS_TYPE_GENERATION_PROCESS_EXITED": "The type generation child process exited with a non-zero code. Check the output for compiler errors and verify the TypeScript sources are valid.",
 		"TS_TYPE_CHECK_ERRORS": "TypeScript type errors found in '{filePath}':\n{errors}",
diff --git a/src/lib/i18n/languages/es-es.json b/src/lib/i18n/languages/es-es.json
index 1c53dc7f7..e66ad48e4 100644
--- a/src/lib/i18n/languages/es-es.json
+++ b/src/lib/i18n/languages/es-es.json
@@ -353,7 +353,9 @@
 		"TS_TYPE_GENERATION_FAILED": "La generación de tipos falló: {error}",
 		"HINT_TS_TYPE_GENERATION_FAILED": "El proceso hijo que genera las declaraciones de TypeScript encontró un error. Comprueba el mensaje de error para más detalles y asegúrate de que los ficheros fuente de TypeScript son válidos.",
 		"TS_TYPE_GENERATION_FORK_FAILED": "Error al bifurcar (fork) el proceso de generación de tipos: {error}",
-		"HINT_TS_TYPE_GENERATION_FORK_FAILED": "El proceso trabajador de generación de tipos no pudo iniciarse. Asegúrate de que Node.js tiene permiso para bifurcar procesos hijos y que el script tools/build/generate-types-worker.mjs existe.",
+		"HINT_TS_TYPE_GENERATION_FORK_FAILED": "El proceso trabajador de generación de tipos no pudo iniciarse. Asegúrate de que Node.js tiene permiso para bifurcar procesos hijos y que el script lib/processors/type-generation-worker.mjs existe.",
+		"TS_TYPE_GENERATION_WORKER_NO_CONFIG": "El trabajador de generación de tipos se inició sin su configuración (SLOTHLET_CONFIG no está definida).",
+		"HINT_TS_TYPE_GENERATION_WORKER_NO_CONFIG": "El modo estricto de TypeScript inicia este trabajador con su configuración en la variable de entorno SLOTHLET_CONFIG. Deja que slothlet lo bifurque en lugar de ejecutar el archivo directamente.",
 		"TS_TYPE_GENERATION_PROCESS_EXITED": "El proceso de generación de tipos terminó con el código {code}: {output}",
 		"HINT_TS_TYPE_GENERATION_PROCESS_EXITED": "El proceso hijo de generación de tipos terminó con un código distinto de cero. Comprueba la salida en busca de errores del compilador y verifica que las fuentes de TypeScript son válidas.",
 		"TS_TYPE_CHECK_ERRORS": "Errores de tipo TypeScript encontrados en '{filePath}':\n{errors}",
diff --git a/src/lib/i18n/languages/es-mx.json b/src/lib/i18n/languages/es-mx.json
index 3d5a215ea..ebc73f8e7 100644
--- a/src/lib/i18n/languages/es-mx.json
+++ b/src/lib/i18n/languages/es-mx.json
@@ -353,7 +353,9 @@
 		"TS_TYPE_GENERATION_FAILED": "La generación de tipos falló: {error}",
 		"HINT_TS_TYPE_GENERATION_FAILED": "El proceso hijo que genera las declaraciones de TypeScript encontró un error. Compruebe el mensaje de error para más detalles y asegúrese de que los archivos fuente de TypeScript son válidos.",
 		"TS_TYPE_GENERATION_FORK_FAILED": "Error al bifurcar (fork) el proceso de generación de tipos: {error}",
-		"HINT_TS_TYPE_GENERATION_FORK_FAILED": "El proceso trabajador de generación de tipos no pudo iniciarse. Asegúrese de que Node.js tiene permiso para bifurcar procesos hijos y que el script tools/build/generate-types-worker.mjs existe.",
+		"HINT_TS_TYPE_GENERATION_FORK_FAILED": "El proceso trabajador de generación de tipos no pudo iniciarse. Asegúrese de que Node.js tiene permiso para bifurcar procesos hijos y que el script lib/processors/type-generation-worker.mjs existe.",
+		"TS_TYPE_GENERATION_WORKER_NO_CONFIG": "El trabajador de generación de tipos se inició sin su configuración (SLOTHLET_CONFIG no está definida).",
+		"HINT_TS_TYPE_GENERATION_WORKER_NO_CONFIG": "El modo estricto de TypeScript inicia este trabajador con su configuración en la variable de entorno SLOTHLET_CONFIG. Deje que slothlet lo bifurque en lugar de ejecutar el archivo directamente.",
 		"TS_TYPE_GENERATION_PROCESS_EXITED": "El proceso de generación de tipos terminó con el código {code}: {output}",
 		"HINT_TS_TYPE_GENERATION_PROCESS_EXITED": "El proceso hijo de generación de tipos terminó con un código distinto de cero. Compruebe la salida en busca de errores del compilador y verifique que las fuentes de TypeScript son válidas.",
 		"TS_TYPE_CHECK_ERRORS": "Errores de tipo TypeScript encontrados en '{filePath}':\n{errors}",
diff --git a/src/lib/i18n/languages/fr-fr.json b/src/lib/i18n/languages/fr-fr.json
index fe61708ee..7703c24a9 100644
--- a/src/lib/i18n/languages/fr-fr.json
+++ b/src/lib/i18n/languages/fr-fr.json
@@ -353,7 +353,9 @@
 		"TS_TYPE_GENERATION_FAILED": "La génération de types a échoué : {error}",
 		"HINT_TS_TYPE_GENERATION_FAILED": "Le processus enfant qui génère les déclarations TypeScript a rencontré une erreur. Vérifiez le message d'erreur pour les détails et assurez-vous que les fichiers sources TypeScript sont valides.",
 		"TS_TYPE_GENERATION_FORK_FAILED": "Échec du fork du processus de génération de types : {error}",
-		"HINT_TS_TYPE_GENERATION_FORK_FAILED": "Le processus travailleur de génération de types n'a pas pu être démarré. Assurez-vous que Node.js a la permission de forker des processus enfants et que le script tools/build/generate-types-worker.mjs existe.",
+		"HINT_TS_TYPE_GENERATION_FORK_FAILED": "Le processus travailleur de génération de types n'a pas pu être démarré. Assurez-vous que Node.js a la permission de forker des processus enfants et que le script lib/processors/type-generation-worker.mjs existe.",
+		"TS_TYPE_GENERATION_WORKER_NO_CONFIG": "Le travailleur de génération de types a été démarré sans sa configuration (SLOTHLET_CONFIG n'est pas définie).",
+		"HINT_TS_TYPE_GENERATION_WORKER_NO_CONFIG": "Ce travailleur est démarré par le mode TypeScript strict avec sa configuration dans la variable d'environnement SLOTHLET_CONFIG. Laissez slothlet le forker plutôt que d'exécuter le fichier directement.",
 		"TS_TYPE_GENERATION_PROCESS_EXITED": "Le processus de génération de types s'est arrêté avec le code {code} : {output}",
 		"HINT_TS_TYPE_GENERATION_PROCESS_EXITED": "Le processus enfant de génération de types s'est arrêté avec un code non nul. Vérifiez la sortie pour les erreurs de compilation et vérifiez que les sources TypeScript sont valides.",
 		"TS_TYPE_CHECK_ERRORS": "Erreurs de type TypeScript trouvées dans '{filePath}' :\n{errors}",
diff --git a/src/lib/i18n/languages/hi-in.json b/src/lib/i18n/languages/hi-in.json
index 7d55ab82b..9767e62cb 100644
--- a/src/lib/i18n/languages/hi-in.json
+++ b/src/lib/i18n/languages/hi-in.json
@@ -353,7 +353,9 @@
 		"TS_TYPE_GENERATION_FAILED": "प्रकार पीढ़ी विफल: {error}",
 		"HINT_TS_TYPE_GENERATION_FAILED": "टाइपस्क्रिप्ट घोषणाएं उत्पन्न करने वाली चाइल्ड प्रोसेस में त्रुटि हुई। विवरण के लिए त्रुटि संदेश की जांच करें और सुनिश्चित करें कि टाइपस्क्रिप्ट स्रोत फ़ाइलें मान्य हैं।",
 		"TS_TYPE_GENERATION_FORK_FAILED": "प्रकार पीढ़ी प्रोसेस को फोर्क (fork) करने में विफल: {error}",
-		"HINT_TS_TYPE_GENERATION_FORK_FAILED": "प्रकार पीढ़ी वर्कर प्रोसेस शुरू नहीं किया जा सका। सुनिश्चित करें कि Node.js के पास चाइल्ड प्रोसेस फोर्क करने की अनुमति है और tools/build/generate-types-worker.mjs स्क्रिप्ट मौजूद है।",
+		"HINT_TS_TYPE_GENERATION_FORK_FAILED": "प्रकार पीढ़ी वर्कर प्रोसेस शुरू नहीं किया जा सका। सुनिश्चित करें कि Node.js के पास चाइल्ड प्रोसेस फोर्क करने की अनुमति है और lib/processors/type-generation-worker.mjs स्क्रिप्ट मौजूद है।",
+		"TS_TYPE_GENERATION_WORKER_NO_CONFIG": "प्रकार पीढ़ी वर्कर अपने कॉन्फ़िगरेशन के बिना शुरू किया गया (SLOTHLET_CONFIG सेट नहीं है)।",
+		"HINT_TS_TYPE_GENERATION_WORKER_NO_CONFIG": "यह वर्कर TypeScript strict मोड द्वारा SLOTHLET_CONFIG पर्यावरण चर में कॉन्फ़िगरेशन के साथ शुरू किया जाता है। फ़ाइल को सीधे चलाने के बजाय slothlet को इसे फोर्क करने दें।",
 		"TS_TYPE_GENERATION_PROCESS_EXITED": "प्रकार पीढ़ी प्रोसेस कोड {code} के साथ बाहर निकला: {output}",
 		"HINT_TS_TYPE_GENERATION_PROCESS_EXITED": "प्रकार पीढ़ी चाइल्ड प्रोसेस गैर-शून्य कोड के साथ समाप्त हुई। कंपाइलर त्रुटियों के लिए आउटपुट की जांच करें और सत्यापित करें कि टाइपस्क्रिप्ट स्रोत मान्य हैं।",
 		"TS_TYPE_CHECK_ERRORS": "'{filePath}' में टाइपस्क्रिप्ट प्रकार त्रुटियाँ मिलीं:\n{errors}",
diff --git a/src/lib/i18n/languages/ja-jp.json b/src/lib/i18n/languages/ja-jp.json
index 68b4d80f7..31180ee05 100644
--- a/src/lib/i18n/languages/ja-jp.json
+++ b/src/lib/i18n/languages/ja-jp.json
@@ -352,8 +352,10 @@
 		"HINT_TS_STRICT_REQUIRES_INTERFACE_NAME": "'types' 構成に 'interfaceName' を追加してください (例: types: { output: './types/api.d.ts', interfaceName: 'MyAPI' })。",
 		"TS_TYPE_GENERATION_FAILED": "型生成に失敗しました: {error}",
 		"HINT_TS_TYPE_GENERATION_FAILED": "TypeScript 宣言を生成する子プロセスでエラーが発生しました。エラーメッセージで詳細を確認し、TypeScript ソースファイルが有効であることを確認してください。",
-		"TS_TYPE_GENERATION_FORK_FAILED": "型生成ワーカープロセスを開始できませんでした。 Node.js に子プロセスをフォークする権限があること、および tools/build/generate-types-worker.mjs スクリプトが存在することを確認してください。",
-		"HINT_TS_TYPE_GENERATION_FORK_FAILED": "Node.js がプロセスをフォークできること、および tools/build/generate-types-worker.mjs が存在することを確認してください。",
+		"TS_TYPE_GENERATION_FORK_FAILED": "型生成ワーカープロセスを開始できませんでした。 Node.js に子プロセスをフォークする権限があること、および lib/processors/type-generation-worker.mjs スクリプトが存在することを確認してください。",
+		"HINT_TS_TYPE_GENERATION_FORK_FAILED": "Node.js がプロセスをフォークできること、および lib/processors/type-generation-worker.mjs が存在することを確認してください。",
+		"TS_TYPE_GENERATION_WORKER_NO_CONFIG": "型生成ワーカーが設定なしで起動されました（SLOTHLET_CONFIG が設定されていません）。",
+		"HINT_TS_TYPE_GENERATION_WORKER_NO_CONFIG": "このワーカーは TypeScript の strict モードが SLOTHLET_CONFIG 環境変数に設定を入れて起動します。ファイルを直接実行せず、slothlet にフォークさせてください。",
 		"TS_TYPE_GENERATION_PROCESS_EXITED": "型生成プロセスがコード {code} で終了しました: {output}",
 		"HINT_TS_TYPE_GENERATION_PROCESS_EXITED": "型生成子プロセスがゼロ以外のコードで終了しました。コンパイラエラーがないか出力を確認し、TypeScript ソースが有効であることを検証してください。",
 		"TS_TYPE_CHECK_ERRORS": "'{filePath}' で TypeScript の型エラーが見つかりました:\n{errors}",
diff --git a/src/lib/i18n/languages/ko-kr.json b/src/lib/i18n/languages/ko-kr.json
index 65938385b..2c03edd90 100644
--- a/src/lib/i18n/languages/ko-kr.json
+++ b/src/lib/i18n/languages/ko-kr.json
@@ -353,7 +353,9 @@
 		"TS_TYPE_GENERATION_FAILED": "타입 생성 실패: {error}",
 		"HINT_TS_TYPE_GENERATION_FAILED": "TypeScript 선언을 생성하는 하위 프로세스에서 오류가 발생했습니다. 오류 메시지에서 세부 정보를 확인하고 TypeScript 소스 파일이 유효한지 확인하십시오.",
 		"TS_TYPE_GENERATION_FORK_FAILED": "타입 생성 프로세스 분기(fork) 실패: {error}",
-		"HINT_TS_TYPE_GENERATION_FORK_FAILED": "타입 생성 워커 프로세스를 시작할 수 없습니다. Node.js에 하위 프로세스 분기 권한이 있는지, tools/build/generate-types-worker.mjs 스크립트가 존재하는지 확인하십시오.",
+		"HINT_TS_TYPE_GENERATION_FORK_FAILED": "타입 생성 워커 프로세스를 시작할 수 없습니다. Node.js에 하위 프로세스 분기 권한이 있는지, lib/processors/type-generation-worker.mjs 스크립트가 존재하는지 확인하십시오.",
+		"TS_TYPE_GENERATION_WORKER_NO_CONFIG": "타입 생성 워커가 구성 없이 시작되었습니다 (SLOTHLET_CONFIG가 설정되지 않음).",
+		"HINT_TS_TYPE_GENERATION_WORKER_NO_CONFIG": "이 워커는 TypeScript strict 모드가 SLOTHLET_CONFIG 환경 변수에 구성을 담아 시작합니다. 파일을 직접 실행하지 말고 slothlet이 포크하도록 하십시오.",
 		"TS_TYPE_GENERATION_PROCESS_EXITED": "타입 생성 프로세스가 종료 코드 {code}로 종료됨: {output}",
 		"HINT_TS_TYPE_GENERATION_PROCESS_EXITED": "타입 생성 하위 프로세스가 0이 아닌 코드로 종료되었습니다. 컴파일러 오류가 있는지 출력을 확인하고 TypeScript 소스가 유효한지 확인하십시오.",
 		"TS_TYPE_CHECK_ERRORS": "'{filePath}'에서 TypeScript 타입 오류 발견:\n{errors}",
diff --git a/src/lib/i18n/languages/pt-br.json b/src/lib/i18n/languages/pt-br.json
index d0bf1e936..9589f562c 100644
--- a/src/lib/i18n/languages/pt-br.json
+++ b/src/lib/i18n/languages/pt-br.json
@@ -353,7 +353,9 @@
 		"TS_TYPE_GENERATION_FAILED": "Falha na geração de tipos: {error}",
 		"HINT_TS_TYPE_GENERATION_FAILED": "O processo filho que gera as declarações do TypeScript encontrou um erro. Verifique a mensagem de erro para obter detalhes e certifique-se de que os arquivos de origem do TypeScript são válidos.",
 		"TS_TYPE_GENERATION_FORK_FAILED": "Falha ao criar (fork) o processo de geração de tipos: {error}",
-		"HINT_TS_TYPE_GENERATION_FORK_FAILED": "O processo de execução da geração de tipos não pôde ser iniciado. Certifique-se de que o Node.js tenha permissão para criar processos filhos e que o script tools/build/generate-types-worker.mjs exista.",
+		"HINT_TS_TYPE_GENERATION_FORK_FAILED": "O processo de execução da geração de tipos não pôde ser iniciado. Certifique-se de que o Node.js tenha permissão para criar processos filhos e que o script lib/processors/type-generation-worker.mjs exista.",
+		"TS_TYPE_GENERATION_WORKER_NO_CONFIG": "O worker de geração de tipos foi iniciado sem sua configuração (SLOTHLET_CONFIG não está definida).",
+		"HINT_TS_TYPE_GENERATION_WORKER_NO_CONFIG": "Este worker é iniciado pelo modo estrito do TypeScript com sua configuração na variável de ambiente SLOTHLET_CONFIG. Deixe o slothlet criá-lo em vez de executar o arquivo diretamente.",
 		"TS_TYPE_GENERATION_PROCESS_EXITED": "O processo de geração de tipos saiu com o código {code}: {output}",
 		"HINT_TS_TYPE_GENERATION_PROCESS_EXITED": "O processo filho de geração de tipos saiu com um código diferente de zero. Verifique a saída em busca de erros do compilador e verifique se as fontes do TypeScript são válidas.",
 		"TS_TYPE_CHECK_ERRORS": "Erros de tipo TypeScript encontrados em '{filePath}':\n{errors}",
diff --git a/src/lib/i18n/languages/ru-ru.json b/src/lib/i18n/languages/ru-ru.json
index a7a6164cb..e61d7ecbb 100644
--- a/src/lib/i18n/languages/ru-ru.json
+++ b/src/lib/i18n/languages/ru-ru.json
@@ -353,7 +353,9 @@
 		"TS_TYPE_GENERATION_FAILED": "Ошибка генерации типов: {error}",
 		"HINT_TS_TYPE_GENERATION_FAILED": "Дочерний процесс генерации типов завершился с ошибкой. Проверьте вывод.",
 		"TS_TYPE_GENERATION_FORK_FAILED": "Не удалось форкнуть процесс генерации типов: {error}",
-		"HINT_TS_TYPE_GENERATION_FORK_FAILED": "Убедитесь, что Node.js может форкать процессы и существует tools/build/generate-types-worker.mjs.",
+		"HINT_TS_TYPE_GENERATION_FORK_FAILED": "Убедитесь, что Node.js может форкать процессы и существует lib/processors/type-generation-worker.mjs.",
+		"TS_TYPE_GENERATION_WORKER_NO_CONFIG": "Процесс генерации типов запущен без конфигурации (SLOTHLET_CONFIG не задана).",
+		"HINT_TS_TYPE_GENERATION_WORKER_NO_CONFIG": "Этот процесс запускается строгим режимом TypeScript с конфигурацией в переменной окружения SLOTHLET_CONFIG. Позвольте slothlet запустить его, а не выполняйте файл напрямую.",
 		"TS_TYPE_GENERATION_PROCESS_EXITED": "Процесс генерации типов завершился с кодом {code}: {output}",
 		"HINT_TS_TYPE_GENERATION_PROCESS_EXITED": "Проверьте вывод дочернего процесса на ошибки компилятора.",
 		"TS_TYPE_CHECK_ERRORS": "Ошибки типов TypeScript в '{filePath}':\n{errors}",
diff --git a/src/lib/i18n/languages/zh-cn.json b/src/lib/i18n/languages/zh-cn.json
index b08e38797..48190e840 100644
--- a/src/lib/i18n/languages/zh-cn.json
+++ b/src/lib/i18n/languages/zh-cn.json
@@ -353,7 +353,9 @@
 		"TS_TYPE_GENERATION_FAILED": "类型生成失败：{error}",
 		"HINT_TS_TYPE_GENERATION_FAILED": "生成 TypeScript 声明的子进程遇到错误。请检查错误信息并确保 TypeScript 源文件有效。",
 		"TS_TYPE_GENERATION_FORK_FAILED": "无法派生类型生成进程：{error}",
-		"HINT_TS_TYPE_GENERATION_FORK_FAILED": "类型生成工作进程无法启动。请确保 Node.js 有权限派生子进程，并且存在 tools/build/generate-types-worker.mjs 脚本。",
+		"HINT_TS_TYPE_GENERATION_FORK_FAILED": "类型生成工作进程无法启动。请确保 Node.js 有权限派生子进程，并且存在 lib/processors/type-generation-worker.mjs 脚本。",
+		"TS_TYPE_GENERATION_WORKER_NO_CONFIG": "类型生成工作进程在没有配置的情况下启动（未设置 SLOTHLET_CONFIG）。",
+		"HINT_TS_TYPE_GENERATION_WORKER_NO_CONFIG": "此工作进程由 TypeScript strict 模式启动，其配置位于 SLOTHLET_CONFIG 环境变量中。请让 slothlet 派生它，而不是直接运行该文件。",
 		"TS_TYPE_GENERATION_PROCESS_EXITED": "类型生成进程以代码 {code} 退出：{output}",
 		"HINT_TS_TYPE_GENERATION_PROCESS_EXITED": "类型生成子进程以非零代码退出。检查输出中的编译器错误并验证 TypeScript 源是否有效。",
 		"TS_TYPE_CHECK_ERRORS": "在 '{filePath}' 中发现 TypeScript 类型错误：\n{errors}",
diff --git a/src/lib/processors/loader.mjs b/src/lib/processors/loader.mjs
index 12acab40c..2e9fb26c3 100644
--- a/src/lib/processors/loader.mjs
+++ b/src/lib/processors/loader.mjs
@@ -131,6 +131,21 @@ function compileHidden(globs) {
  * @extends ComponentBase
  * @package
  */
+/**
+ * Absolute path of the worker strict TypeScript mode forks to generate the api's declaration file. It
+ * lives next to this module, so it ships wherever the loader does (`dist/lib/processors/` when
+ * installed) (#500). Resolved on call, from the Node-only strict-mode path: `path`/`url` are `null`
+ * in browser mode, and the literal `new URL("./…", import.meta.url)` form is avoided because bundlers
+ * and vite treat it as a module reference and load the worker into the current process.
+ * @returns {string} Absolute path of `type-generation-worker.mjs`.
+ * @internal
+ * @example
+ * fork(typeGenerationWorkerPath(), [], { stdio: ["pipe", "pipe", "pipe", "ipc"] });
+ */
+export function typeGenerationWorkerPath() {
+	return path.join(path.dirname(url.fileURLToPath(import.meta.url)), "type-generation-worker.mjs");
+}
+
 export class Loader extends ComponentBase {
 	static slothletProperty = "loader";
 
@@ -186,12 +201,9 @@ export class Loader extends ComponentBase {
 					// Generate types if not already generated for this instance
 					if (!this.slothlet._typesGenerated) {
 						const { fork } = await import("child_process");
-						const path = await import("path");
-						const { fileURLToPath } = await import("url");
 
-						// Get the path to the type generation script (in tools/ not src/tools/)
-						const __dirname = path.dirname(fileURLToPath(import.meta.url));
-						const scriptPath = path.resolve(__dirname, "../../../tools/build/generate-types-worker.mjs");
+						// The worker ships next to this file (src/lib/processors → dist/lib/processors).
+						const scriptPath = typeGenerationWorkerPath();
 
 						// Prepare config for child process
 						// Note: Child process needs 'dir' not 'root', and should use eager mode
diff --git a/src/lib/processors/type-generation-worker.mjs b/src/lib/processors/type-generation-worker.mjs
new file mode 100644
index 000000000..21456d773
--- /dev/null
+++ b/src/lib/processors/type-generation-worker.mjs
@@ -0,0 +1,85 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /src/lib/processors/type-generation-worker.mjs
+ *	@Date: 2026-02-14T18:14:33-08:00 (1771121673)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-03-01 20:22:18 -08:00 (1772425338)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Worker for strict TypeScript mode's type generation.
+ * @module @cldmv/slothlet/processors/type-generation-worker
+ * @internal
+ *
+ * @description
+ * Strict mode forks this file (see `typeGenerationWorkerPath()` in `loader.mjs`) to build an eager,
+ * fast-mode instance of the api and write its declaration file in a separate process, so the build
+ * never shares a module cache with the instance being loaded. The config arrives in the
+ * `SLOTHLET_CONFIG` environment variable, and the result goes back to the parent over IPC as
+ * `{ type: "success" }` or `{ type: "error", error }`.
+ *
+ * It ships in `dist/lib/processors/` and imports only `@cldmv/slothlet` self-references, which
+ * resolve to `src/` under the `slothlet-dev` condition and to `dist/` in an installed package (#500).
+ * Importing the module does nothing; only running it as the process's entry script starts a build.
+ */
+
+import { fileURLToPath } from "node:url";
+import { resolve } from "node:path";
+import slothlet from "@cldmv/slothlet";
+import { generateTypes } from "@cldmv/slothlet/processors/type-generator";
+import { SlothletError } from "@cldmv/slothlet/errors";
+
+/**
+ * Build the api described by `configJson` and write its declaration file.
+ * @param {string|undefined} configJson - The serialized worker config (`SLOTHLET_CONFIG`): the
+ *   slothlet config for an eager, fast-mode instance plus `types` (`{ output, interfaceName, ... }`).
+ * @param {((message: {type: string, error?: string}) => void)|undefined} send - IPC sender to the
+ *   parent (`process.send` in the fork); `undefined` when there is no IPC channel.
+ * @returns {Promise<number>} The process exit code: `0` on success, `1` on failure.
+ * @example
+ * const code = await runTypeGeneration(process.env.SLOTHLET_CONFIG, process.send?.bind(process));
+ */
+export async function runTypeGeneration(configJson, send) {
+	let api = null;
+	try {
+		if (!configJson) {
+			throw new SlothletError("TS_TYPE_GENERATION_WORKER_NO_CONFIG", {}, null, { validationError: true });
+		}
+		const config = JSON.parse(configJson);
+		api = await slothlet(config);
+		await generateTypes(api, config.types);
+		send?.({ type: "success" });
+		return 0;
+	} catch (error) {
+		send?.({ type: "error", error: error.message });
+		return 1;
+	} finally {
+		await api?.slothlet.shutdown();
+	}
+}
+
+/**
+ * Run the type generation and hand its exit code to `exit`, but only when `argv1` is this file —
+ * i.e. when the module is the process's entry script (the strict-mode fork). Any other import is a
+ * no-op.
+ * @param {string|undefined} argv1 - The entry script path (`process.argv[1]`).
+ * @param {string|undefined} configJson - The serialized worker config (`SLOTHLET_CONFIG`).
+ * @param {((message: {type: string, error?: string}) => void)|undefined} send - IPC sender to the parent.
+ * @param {(code: number) => void} exit - Called with the exit code.
+ * @returns {Promise<void>|null} The pending run, or `null` when this module is not the entry script.
+ * @example
+ * runIfEntry(process.argv[1], process.env.SLOTHLET_CONFIG, process.send?.bind(process), process.exit.bind(process));
+ */
+export function runIfEntry(argv1, configJson, send, exit) {
+	if (!argv1 || resolve(argv1) !== fileURLToPath(import.meta.url)) {
+		return null;
+	}
+	return runTypeGeneration(configJson, send).then(exit);
+}
+
+runIfEntry(process.argv[1], process.env.SLOTHLET_CONFIG, process.send?.bind(process), process.exit.bind(process));
diff --git a/tests/vitests/suites/typescript/typescript-strict-mode-packaged.test.vitest.mjs b/tests/vitests/suites/typescript/typescript-strict-mode-packaged.test.vitest.mjs
new file mode 100644
index 000000000..f6c2a01f9
--- /dev/null
+++ b/tests/vitests/suites/typescript/typescript-strict-mode-packaged.test.vitest.mjs
@@ -0,0 +1,154 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/typescript/typescript-strict-mode-packaged.test.vitest.mjs
+ *	@Date: 2026-09-28 09:44:57 -07:00 (1790613897)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 09:53:16 -07:00 (1790614396)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Regression (#500): strict TypeScript mode forks a type-generation worker, and that worker
+ * must ship in the published package. It lived in `tools/build/` and imported `../../src/...`; neither
+ * `tools/` nor `src/` is in `package.json` `files`, so strict mode could only work inside this repo.
+ *
+ * The worker must sit inside the source tree the build copies into `dist/` (`src/lib/...` →
+ * `dist/lib/...`), and import only Node builtins or `@cldmv/slothlet` self-references, which resolve
+ * to `src/` under the `slothlet-dev` condition and to `dist/` in an installed package.
+ *
+ * @module tests/vitests/suites/typescript/typescript-strict-mode-packaged
+ */
+
+import { describe, it, expect, afterAll } from "vitest";
+import { readFileSync, existsSync } from "node:fs";
+import { mkdir, writeFile, rm } from "node:fs/promises";
+import { builtinModules } from "node:module";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { typeGenerationWorkerPath } from "@cldmv/slothlet/processors/loader";
+import { runTypeGeneration, runIfEntry } from "@cldmv/slothlet/processors/type-generation-worker";
+import { makeTestTmpDir } from "../../setup/test-fixtures-tmp.mjs";
+
+const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../../..");
+const LIB_ROOT = path.join(REPO_ROOT, "src", "lib");
+
+describe("strict mode type-generation worker ships with the package (#500)", () => {
+	it("forks a worker inside the lib tree the build copies into dist/", () => {
+		const workerPath = typeGenerationWorkerPath();
+		expect(existsSync(workerPath)).toBe(true);
+		const relative = path.relative(LIB_ROOT, workerPath);
+		expect(relative.startsWith("..") || path.isAbsolute(relative)).toBe(false);
+	});
+
+	it("imports only Node builtins and @cldmv/slothlet self-references", () => {
+		const source = readFileSync(typeGenerationWorkerPath(), "utf8");
+		const specifiers = [...source.matchAll(/^\s*import\s+(?:[^"']*?\s+from\s+)?["']([^"']+)["']/gm)].map((m) => m[1]);
+		expect(specifiers.length).toBeGreaterThan(0);
+		const builtins = new Set([...builtinModules, ...builtinModules.map((name) => `node:${name}`)]);
+		const unpublished = specifiers.filter((spec) => !builtins.has(spec) && !spec.startsWith("@cldmv/slothlet"));
+		expect(unpublished).toEqual([]);
+	});
+
+	it("does nothing when imported rather than run as the process's entry script", async () => {
+		// Importing the worker (a bundler following the reference, a test, a tool scanning the package)
+		// must not start a build or call process.exit on the importer.
+		const before = process.exitCode;
+		await import(typeGenerationWorkerPath());
+		expect(process.exitCode).toBe(before);
+	});
+
+	it("is inside the published file list", () => {
+		const pkg = JSON.parse(readFileSync(path.join(REPO_ROOT, "package.json"), "utf8"));
+		expect(pkg.files).toContain("dist/");
+	});
+});
+
+describe("type-generation worker, driven in-process (#500)", () => {
+	const roots = [];
+
+	afterAll(async () => {
+		await Promise.allSettled(roots.map((root) => rm(root, { recursive: true, force: true })));
+	});
+
+	/**
+	 * A tmp api folder with one leaf, plus the worker config that builds it.
+	 * @returns {Promise<{configJson: string, output: string}>}
+	 */
+	async function workerFixture() {
+		const root = await makeTestTmpDir("type-generation-worker");
+		roots.push(root);
+		const apiDir = path.join(root, "api");
+		await mkdir(apiDir, { recursive: true });
+		await writeFile(
+			path.join(apiDir, "math.mjs"),
+			"/** @param {number} a @param {number} b @returns {number} */\nexport function add(a, b) { return a + b; }\n",
+			"utf8"
+		);
+		const output = path.join(root, "types", "api.d.ts");
+		const configJson = JSON.stringify({
+			base: apiDir,
+			mode: "eager",
+			silent: true,
+			typescript: { enabled: true, mode: "fast" },
+			types: { output, interfaceName: "WorkerApi" }
+		});
+		return { configJson, output };
+	}
+
+	it("builds the api, writes the declaration, and reports success", async () => {
+		const { configJson, output } = await workerFixture();
+		const messages = [];
+		const code = await runTypeGeneration(configJson, (message) => messages.push(message));
+		expect(code).toBe(0);
+		expect(messages).toEqual([{ type: "success" }]);
+		expect(readFileSync(output, "utf8")).toContain("interface WorkerApi");
+	});
+
+	it("reports an error and exit code 1 when SLOTHLET_CONFIG is missing", async () => {
+		const messages = [];
+		const code = await runTypeGeneration(undefined, (message) => messages.push(message));
+		expect(code).toBe(1);
+		expect(messages).toHaveLength(1);
+		expect(messages[0].type).toBe("error");
+		expect(messages[0].error).toMatch(/SLOTHLET_CONFIG/);
+	});
+
+	it("reports an error and exit code 1 when type generation fails", async () => {
+		const { configJson } = await workerFixture();
+		const broken = JSON.parse(configJson);
+		delete broken.types.output;
+		const messages = [];
+		const code = await runTypeGeneration(JSON.stringify(broken), (message) => messages.push(message));
+		expect(code).toBe(1);
+		expect(messages[0].type).toBe("error");
+	});
+
+	it("works without an IPC channel", async () => {
+		const { configJson } = await workerFixture();
+		await expect(runTypeGeneration(configJson, undefined)).resolves.toBe(0);
+		await expect(runTypeGeneration(undefined, undefined)).resolves.toBe(1);
+	});
+
+	it("runs only when the worker is the process's entry script", async () => {
+		const exits = [];
+		expect(runIfEntry(undefined, "{}", undefined, (code) => exits.push(code))).toBeNull();
+		expect(runIfEntry(path.join(REPO_ROOT, "index.mjs"), "{}", undefined, (code) => exits.push(code))).toBeNull();
+		expect(exits).toEqual([]);
+
+		const { configJson, output } = await workerFixture();
+		const messages = [];
+		await runIfEntry(
+			typeGenerationWorkerPath(),
+			configJson,
+			(message) => messages.push(message),
+			(code) => exits.push(code)
+		);
+		expect(exits).toEqual([0]);
+		expect(messages).toEqual([{ type: "success" }]);
+		expect(readFileSync(output, "utf8")).toContain("interface WorkerApi");
+	});
+});
diff --git a/tools/build/generate-types-worker.mjs b/tools/build/generate-types-worker.mjs
deleted file mode 100644
index 4b2955e9d..000000000
--- a/tools/build/generate-types-worker.mjs
+++ /dev/null
@@ -1,69 +0,0 @@
-#!/usr/bin/env node
-/**
- *	@Project: @cldmv/slothlet
- *	@Filename: /tools/build/generate-types-worker.mjs
- *	@Date: 2026-02-14T18:14:33-08:00 (1771121673)
- *	@Author: Nate Corcoran <CLDMV>
- *	@Email: <Shinrai@users.noreply.github.com>
- *	-----
- *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
- *	@Last modified time: 2026-03-01 20:22:18 -08:00 (1772425338)
- *	-----
- *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
- */
-
-/**
- * Worker script for generating TypeScript declaration files
- * This runs in a forked child process to avoid module cache conflicts
- */
-
-import slothlet from "../../index.mjs";
-import { generateTypes } from "../../src/lib/processors/type-generator.mjs";
-
-async function main() {
-	try {
-		// Get config from environment
-		const configJson = process.env.SLOTHLET_CONFIG;
-		if (!configJson) {
-			throw new Error("SLOTHLET_CONFIG environment variable not set");
-		}
-
-		const config = JSON.parse(configJson);
-
-		// Load API in eager mode with fast TypeScript mode
-		const api = await slothlet(config);
-
-		try {
-			// Generate types from loaded API
-			await generateTypes(api, config.types);
-
-			// Send success message to parent
-			if (process.send) {
-				process.send({ type: "success" });
-			}
-
-			// Shutdown cleanly
-			await api.slothlet.shutdown();
-
-			process.exit(0);
-		} catch (error) {
-			// Send error message to parent
-			if (process.send) {
-				process.send({ type: "error", error: error.message });
-			}
-
-			await api.slothlet.shutdown();
-			process.exit(1);
-		}
-	} catch (error) {
-		console.error("Type generation worker failed:", error);
-
-		if (process.send) {
-			process.send({ type: "error", error: error.message });
-		}
-
-		process.exit(1);
-	}
-}
-
-main();
diff --git a/tools/ci/i18n-latin-tokens-accepted.json b/tools/ci/i18n-latin-tokens-accepted.json
index a4e1f8dc3..464d84371 100644
--- a/tools/ci/i18n-latin-tokens-accepted.json
+++ b/tools/ci/i18n-latin-tokens-accepted.json
@@ -185,7 +185,19 @@
 			"Hook",
 			"data"
 		],
-		"external_tooling_paths": ["npm", "install", "tools", "cldmv", "worker", "ALS"],
+		"external_tooling_paths": [
+			"npm",
+			"install",
+			"tools",
+			"cldmv",
+			"worker",
+			"ALS",
+			"lib",
+			"processors",
+			"generation",
+			"SLOTHLET",
+			"CONFIG"
+		],
 		"fixture_or_example_names": ["math", "auth", "synthetic", "syntheticName"],
 		"misc_remaining_debug_abbreviations": [
 			"IN",
@@ -440,6 +452,11 @@
 		"cldmv",
 		"worker",
 		"ALS",
+		"lib",
+		"processors",
+		"generation",
+		"SLOTHLET",
+		"CONFIG",
 		"math",
 		"auth",
 		"synthetic",
diff --git a/types/src/lib/processors/loader.d.mts b/types/src/lib/processors/loader.d.mts
index 86e5710d0..660415ef5 100644
--- a/types/src/lib/processors/loader.d.mts
+++ b/types/src/lib/processors/loader.d.mts
@@ -28,6 +28,18 @@ export function warnIfCoverageWithoutImporter(config: object, { worker, external
  * @extends ComponentBase
  * @package
  */
+/**
+ * Absolute path of the worker strict TypeScript mode forks to generate the api's declaration file. It
+ * lives next to this module, so it ships wherever the loader does (`dist/lib/processors/` when
+ * installed) (#500). Resolved on call, from the Node-only strict-mode path: `path`/`url` are `null`
+ * in browser mode, and the literal `new URL("./…", import.meta.url)` form is avoided because bundlers
+ * and vite treat it as a module reference and load the worker into the current process.
+ * @returns {string} Absolute path of `type-generation-worker.mjs`.
+ * @internal
+ * @example
+ * fork(typeGenerationWorkerPath(), [], { stdio: ["pipe", "pipe", "pipe", "ipc"] });
+ */
+export function typeGenerationWorkerPath(): string;
 export class Loader extends ComponentBase {
     static slothletProperty: string;
     /**
diff --git a/types/src/lib/processors/loader.d.mts.map b/types/src/lib/processors/loader.d.mts.map
index d17743c75..7c73d7f1a 100644
--- a/types/src/lib/processors/loader.d.mts.map
+++ b/types/src/lib/processors/loader.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"loader.d.mts","sourceRoot":"","sources":["../../../../src/lib/processors/loader.mjs"],"names":[],"mappings":"AA4DA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,sDAjBW,MAAM,6BAEd;IAAqC,MAAM,GAAnC,MAAM,GAAC,SAAS;IACI,YAAY;CAExC,GAAU,OAAO,CAmBnB;AAwCD;;;;;GAKG;AACH;IACC,gCAAmC;IAEnC;;;;OAIG;IACH,sBAHW,MAAM,EAKhB;IAED;;;;;;;;OAQG;IACH,4BAPW,MAAM,eACN,MAAM,aACN,MAAM,cACN,MAAM,GAAC,IAAI,GACT,OAAO,CAAC,MAAM,CAAC,CA0M3B;IAyED;;;;;;;;;;;;;;OAcG;IACH,0BAbW,MAAM,YAEd;QAA0B,UAAU;QACX,YAAY;QACZ,QAAQ;QACD,UAAU;QACM,MAAM;QAE5B,iBAAiB;QAClB,OAAO;KAChC,GAAU,OAAO,CAAC,MAAM,CAAC,CAqJ3B;IA8PD;;;;;OAKG;IACH,8BAJW,MAAM,GACJ,MAAM,CA+ClB;;CACD;8BAp2B6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"loader.d.mts","sourceRoot":"","sources":["../../../../src/lib/processors/loader.mjs"],"names":[],"mappings":"AA4DA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,sDAjBW,MAAM,6BAEd;IAAqC,MAAM,GAAnC,MAAM,GAAC,SAAS;IACI,YAAY;CAExC,GAAU,OAAO,CAmBnB;AAwCD;;;;;GAKG;AACH;;;;;;;;;;GAUG;AACH,4CALa,MAAM,CAOlB;AAED;IACC,gCAAmC;IAEnC;;;;OAIG;IACH,sBAHW,MAAM,EAKhB;IAED;;;;;;;;OAQG;IACH,4BAPW,MAAM,eACN,MAAM,aACN,MAAM,cACN,MAAM,GAAC,IAAI,GACT,OAAO,CAAC,MAAM,CAAC,CAuM3B;IAyED;;;;;;;;;;;;;;OAcG;IACH,0BAbW,MAAM,YAEd;QAA0B,UAAU;QACX,YAAY;QACZ,QAAQ;QACD,UAAU;QACM,MAAM;QAE5B,iBAAiB;QAClB,OAAO;KAChC,GAAU,OAAO,CAAC,MAAM,CAAC,CAqJ3B;IA8PD;;;;;OAKG;IACH,8BAJW,MAAM,GACJ,MAAM,CA+ClB;;CACD;8BAh3B6B,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/lib/processors/type-generation-worker.d.mts b/types/src/lib/processors/type-generation-worker.d.mts
new file mode 100644
index 000000000..86e32337e
--- /dev/null
+++ b/types/src/lib/processors/type-generation-worker.d.mts
@@ -0,0 +1,31 @@
+/**
+ * Build the api described by `configJson` and write its declaration file.
+ * @param {string|undefined} configJson - The serialized worker config (`SLOTHLET_CONFIG`): the
+ *   slothlet config for an eager, fast-mode instance plus `types` (`{ output, interfaceName, ... }`).
+ * @param {((message: {type: string, error?: string}) => void)|undefined} send - IPC sender to the
+ *   parent (`process.send` in the fork); `undefined` when there is no IPC channel.
+ * @returns {Promise<number>} The process exit code: `0` on success, `1` on failure.
+ * @example
+ * const code = await runTypeGeneration(process.env.SLOTHLET_CONFIG, process.send?.bind(process));
+ */
+export function runTypeGeneration(configJson: string | undefined, send: ((message: {
+    type: string;
+    error?: string;
+}) => void) | undefined): Promise<number>;
+/**
+ * Run the type generation and hand its exit code to `exit`, but only when `argv1` is this file —
+ * i.e. when the module is the process's entry script (the strict-mode fork). Any other import is a
+ * no-op.
+ * @param {string|undefined} argv1 - The entry script path (`process.argv[1]`).
+ * @param {string|undefined} configJson - The serialized worker config (`SLOTHLET_CONFIG`).
+ * @param {((message: {type: string, error?: string}) => void)|undefined} send - IPC sender to the parent.
+ * @param {(code: number) => void} exit - Called with the exit code.
+ * @returns {Promise<void>|null} The pending run, or `null` when this module is not the entry script.
+ * @example
+ * runIfEntry(process.argv[1], process.env.SLOTHLET_CONFIG, process.send?.bind(process), process.exit.bind(process));
+ */
+export function runIfEntry(argv1: string | undefined, configJson: string | undefined, send: ((message: {
+    type: string;
+    error?: string;
+}) => void) | undefined, exit: (code: number) => void): Promise<void> | null;
+//# sourceMappingURL=type-generation-worker.d.mts.map
\ No newline at end of file
diff --git a/types/src/lib/processors/type-generation-worker.d.mts.map b/types/src/lib/processors/type-generation-worker.d.mts.map
new file mode 100644
index 000000000..74e95e5dc
--- /dev/null
+++ b/types/src/lib/processors/type-generation-worker.d.mts.map
@@ -0,0 +1 @@
+{"version":3,"file":"type-generation-worker.d.mts","sourceRoot":"","sources":["../../../../src/lib/processors/type-generation-worker.mjs"],"names":[],"mappings":"AAoCA;;;;;;;;;GASG;AACH,8CARW,MAAM,GAAC,SAAS,QAEhB,CAAC,CAAC,OAAO,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAC,KAAK,IAAI,CAAC,GAAC,SAAS,GAE3D,OAAO,CAAC,MAAM,CAAC,CAqB3B;AAED;;;;;;;;;;;GAWG;AACH,kCARW,MAAM,GAAC,SAAS,cAChB,MAAM,GAAC,SAAS,QAChB,CAAC,CAAC,OAAO,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAC,KAAK,IAAI,CAAC,GAAC,SAAS,QAC7D,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GACpB,OAAO,CAAC,IAAI,CAAC,GAAC,IAAI,CAS9B"}
\ No newline at end of file

From a1bd77c31cfbbfc43e8732613b641b529913bf49 Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Mon, 28 Sep 2026 11:11:14 -0700
Subject: [PATCH 09/49] fix(context): route patched once through the emitter's
 own on/removeListener

With the EventEmitter context patch enabled, stream.once("data") never
fired: the patched once/prependOnceListener attached through the saved
base EventEmitter.prototype.on/prependListener and detached through the
saved base removeListener, bypassing subclass overrides. Readable relies
on its on() override to resume() a paused stream for "data" (and to arm
readableListening for "readable"), so a server-side socket's
once("data") and events.once(socket, "data") hung while on("data")
worked.

Attach and detach through this.on / this.prependListener /
this.removeListener, as native once does. The once-wrapper already
carries the _slothletOriginal marker, so the patched on/removeListener
pass it through without re-wrapping, keeping the v3.8.0 once +
removeListener double-wrap fix intact.

Fixes #503
---
 src/lib/helpers/eventemitter-context.mjs      |  62 ++---
 ...mitter-once-stream-flowing.test.vitest.mjs | 257 ++++++++++++++++++
 .../helpers/eventemitter-context.d.mts.map    |   2 +-
 3 files changed, 287 insertions(+), 34 deletions(-)
 create mode 100644 tests/vitests/suites/context/eventemitter-once-stream-flowing.test.vitest.mjs

diff --git a/src/lib/helpers/eventemitter-context.mjs b/src/lib/helpers/eventemitter-context.mjs
index 3f4e4fa17..c3a06b9e3 100644
--- a/src/lib/helpers/eventemitter-context.mjs
+++ b/src/lib/helpers/eventemitter-context.mjs
@@ -397,11 +397,21 @@ function runtime_patchOn() {
  * timer fires ~5s after handshake → `socket.destroy` → reconnect loop
  * every 5–8s.
  *
- * Fix: implement once semantics directly — attach via the saved-original
- * `on` (skips the patched-on double-wrap), auto-cleanup via the saved-
- * original `removeListener` (skips the patched-removeListener re-entry),
- * and set `.listener = userFn` on the wrapper to mirror Node's contract
- * for libraries that introspect `rawListeners()[i].listener`.
+ * Fix: implement once semantics directly and set `.listener = userFn` on
+ * the wrapper to mirror Node's contract for libraries that introspect
+ * `rawListeners()[i].listener`.
+ *
+ * Attach and detach exactly as native `once` does — through `this.on` and
+ * `this.removeListener`, NOT the saved base-prototype methods (#503). A
+ * subclass may override `on`/`removeListener` with side effects the event
+ * depends on: `Readable.prototype.on("data")` calls `resume()` to start the
+ * flow, and `Readable.prototype.on("readable")` arms `readableListening`.
+ * Calling the base `EventEmitter.prototype.on` directly attached the
+ * listener but skipped `resume()`, so `socket.once("data")` never fired.
+ * Dispatching through `this.on` is safe from the double-wrap above because
+ * `runtime_onceWrapper` carries `_slothletOriginal`: the patched `on` and
+ * `removeListener` see the marker and pass it straight to the original
+ * without wrapping or tracking it again.
  *
  * @private
  */
@@ -409,16 +419,6 @@ function runtime_patchOnce() {
 	const original = EventEmitter.prototype.once;
 	originalMethods.set("once", original);
 
-	// Capture the saved-original `on` and `removeListener` at patch time.
-	// `on` is patched before `once` (see enableEventEmitterPatching ordering)
-	// so originalMethods.get("on") is always populated; the ?? fallback only
-	// fires if the patch order changes in the future. `removeListener` is
-	// patched AFTER `once`, so the fallback to the current prototype value
-	// (still the unpatched native at this point) is the normal path there.
-	/* v8 ignore next */
-	const originalOn = originalMethods.get("on") ?? EventEmitter.prototype.on;
-	const originalRemove = originalMethods.get("removeListener") ?? EventEmitter.prototype.removeListener;
-
 	EventEmitter.prototype.once = function (event, listener) {
 		// Track this emitter if created in slothlet context
 		runtime_maybeTrackEmitter(this);
@@ -430,11 +430,12 @@ function runtime_patchOnce() {
 		const wrapped = runtime_wrapEventListener(listener);
 		const self = this;
 
-		// Once-wrapper: detach via saved-original removeListener (no re-entry
-		// into the patched path), then drop our tracking entry, then call the
-		// user's wrapped fn. Identity-based untrack matches mixed on+once.
+		// Once-wrapper: detach through the emitter's own removeListener (as
+		// native once does, so subclass overrides run), then drop our tracking
+		// entry, then call the user's wrapped fn. Identity-based untrack
+		// matches mixed on+once.
 		const runtime_onceWrapper = function (...args) {
-			originalRemove.call(self, event, runtime_onceWrapper);
+			self.removeListener(event, runtime_onceWrapper);
 			runtime_untrackSpecificWrapper(self, event, listener, runtime_onceWrapper);
 			return wrapped.apply(this, args);
 		};
@@ -445,8 +446,9 @@ function runtime_patchOnce() {
 		runtime_onceWrapper.listener = listener;
 
 		runtime_trackListener(this, event, listener, runtime_onceWrapper);
-		// Attach via saved-original `on` to avoid the patched-on double-wrap.
-		return originalOn.call(this, event, runtime_onceWrapper);
+		// Attach through the emitter's own `on` so subclass overrides run (#503);
+		// the `_slothletOriginal` marker stops the patched `on` from re-wrapping.
+		return this.on(event, runtime_onceWrapper);
 	};
 }
 
@@ -478,8 +480,9 @@ function runtime_patchPrependListener() {
  * Same delegation pitfall as `runtime_patchOnce` — native
  * `prependOnceListener` internally calls `this.prependListener(...)` which
  * routes through the patched prototype and double-wraps. Same fix shape:
- * attach via saved-original `prependListener`, auto-cleanup via saved-
- * original `removeListener`, set `.listener = userFn`.
+ * attach through `this.prependListener`, auto-cleanup through
+ * `this.removeListener` (both see the `_slothletOriginal` marker and pass the
+ * wrapper through unwrapped), set `.listener = userFn`.
  *
  * @private
  */
@@ -487,13 +490,6 @@ function runtime_patchPrependOnceListener() {
 	const original = EventEmitter.prototype.prependOnceListener;
 	originalMethods.set("prependOnceListener", original);
 
-	// `prependListener` is patched before `prependOnceListener` in
-	// enableEventEmitterPatching, so the ?? fallback is unreachable in the
-	// normal patch order; it only fires if the patch order changes.
-	/* v8 ignore next */
-	const originalPrepend = originalMethods.get("prependListener") ?? EventEmitter.prototype.prependListener;
-	const originalRemove = originalMethods.get("removeListener") ?? EventEmitter.prototype.removeListener;
-
 	EventEmitter.prototype.prependOnceListener = function (event, listener) {
 		// Track this emitter if created in slothlet context
 		runtime_maybeTrackEmitter(this);
@@ -506,7 +502,7 @@ function runtime_patchPrependOnceListener() {
 		const self = this;
 
 		const runtime_onceWrapper = function (...args) {
-			originalRemove.call(self, event, runtime_onceWrapper);
+			self.removeListener(event, runtime_onceWrapper);
 			runtime_untrackSpecificWrapper(self, event, listener, runtime_onceWrapper);
 			return wrapped.apply(this, args);
 		};
@@ -516,8 +512,8 @@ function runtime_patchPrependOnceListener() {
 		runtime_onceWrapper.listener = listener;
 
 		runtime_trackListener(this, event, listener, runtime_onceWrapper);
-		// Attach via saved-original `prependListener` to avoid double-wrap.
-		return originalPrepend.call(this, event, runtime_onceWrapper);
+		// Attach through the emitter's own `prependListener`, as native does (#503).
+		return this.prependListener(event, runtime_onceWrapper);
 	};
 }
 
diff --git a/tests/vitests/suites/context/eventemitter-once-stream-flowing.test.vitest.mjs b/tests/vitests/suites/context/eventemitter-once-stream-flowing.test.vitest.mjs
new file mode 100644
index 000000000..eb16783f3
--- /dev/null
+++ b/tests/vitests/suites/context/eventemitter-once-stream-flowing.test.vitest.mjs
@@ -0,0 +1,257 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/context/eventemitter-once-stream-flowing.test.vitest.mjs
+ *	@Date: 2026-09-28T10:14:31-07:00 (1790615671)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 10:14:31 -07:00 (1790615671)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview `once` must dispatch through the emitter's own `on` / `removeListener` (#503).
+ *
+ * @description
+ * Native `EventEmitter.prototype.once` attaches with `this.on(...)` and detaches with
+ * `this.removeListener(...)`, so a subclass override of either runs. `Readable` relies on that:
+ * `Readable.prototype.on("data")` is what calls `resume()` and switches a paused stream into flowing
+ * mode, and `Readable.prototype.on("readable")` is what arms `readableListening`.
+ *
+ * The patched `once` / `prependOnceListener` in `src/lib/helpers/eventemitter-context.mjs` used to
+ * attach through the saved base `EventEmitter.prototype.on` / `prependListener` and detach through
+ * the saved base `removeListener`, skipping every subclass override. The listener was attached, but
+ * a paused stream never started flowing — `socket.once("data")` and `events.once(socket, "data")`
+ * never fired while `socket.on("data")` did.
+ *
+ * These tests pin the native dispatch, and re-check that the fix did not undo the v3.8.0
+ * once/removeListener double-wrap fix (the once-wrapper is not wrapped a second time by the
+ * patched `on`) or the context capture that is the reason the patch exists.
+ *
+ * @module tests/vitests/suites/context/eventemitter-once-stream-flowing.test.vitest
+ */
+
+import { describe, it, expect, beforeAll, afterAll } from "vitest";
+import { EventEmitter, once as eventsOnce } from "node:events";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { Readable } from "node:stream";
+import net from "node:net";
+import slothlet from "@cldmv/slothlet";
+import { TEST_DIRS } from "../../setup/vitest-helper.mjs";
+
+/**
+ * Race a promise against a timeout so a listener that never fires fails the test instead of hanging it.
+ * @param {Promise<*>} promise - Promise expected to settle.
+ * @param {number} [ms=2000] - Timeout in milliseconds.
+ * @returns {Promise<*>} The promise's value, or the string "timeout".
+ */
+function withTimeout(promise, ms = 2000) {
+	let timer;
+	const timeout = new Promise((resolve) => {
+		timer = setTimeout(() => resolve("timeout"), ms);
+	});
+	return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
+}
+
+/**
+ * Open a loopback TCP server, connect a client that writes `payload`, and hand the server-side
+ * socket to `onConnection`. Resolves with whatever `onConnection` resolves with.
+ * @param {(conn: net.Socket) => Promise<*>} onConnection - Registers the listener under test.
+ * @param {string} [payload="hello"] - Bytes the client writes.
+ * @returns {Promise<*>} The value `onConnection` resolves with, or "timeout".
+ */
+async function serverSide(onConnection, payload = "hello") {
+	const server = net.createServer();
+	const sockets = [];
+	try {
+		const result = new Promise((resolve) => {
+			server.on("connection", (conn) => {
+				sockets.push(conn);
+				resolve(onConnection(conn));
+			});
+		});
+		await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+		const client = net.connect(server.address().port, "127.0.0.1", () => client.write(payload));
+		client.on("error", () => {});
+		sockets.push(client);
+		return await withTimeout(result);
+	} finally {
+		for (const s of sockets) s.destroy();
+		await new Promise((resolve) => server.close(() => resolve()));
+	}
+}
+
+describe("EventEmitter — once dispatches through the emitter's own on/removeListener (#503)", () => {
+	let api;
+	beforeAll(async () => {
+		api = await slothlet({
+			base: TEST_DIRS.API_TEST,
+			mode: "eager",
+			runtime: "async",
+			silent: true
+		});
+	});
+	afterAll(async () => {
+		await api?.shutdown?.();
+	});
+
+	// ─── Streams: once("data") must start the flow ──────────────────────────
+
+	it("Readable.once('data') resumes a paused stream and fires", async () => {
+		const stream = new Readable({ read() {} });
+		stream.push("chunk");
+
+		const got = await withTimeout(new Promise((resolve) => stream.once("data", (d) => resolve(String(d)))));
+
+		expect(got).toBe("chunk");
+		expect(stream.readableFlowing).toBe(true);
+		expect(stream.listenerCount("data")).toBe(0);
+		stream.destroy();
+	});
+
+	it("Readable.once('readable') fires and detaches", async () => {
+		const stream = new Readable({ read() {} });
+		stream.push("chunk");
+
+		const got = await withTimeout(new Promise((resolve) => stream.once("readable", () => resolve(String(stream.read())))));
+
+		expect(got).toBe("chunk");
+		expect(stream.listenerCount("readable")).toBe(0);
+		stream.destroy();
+	});
+
+	it("server-side net.Socket once('data') fires with the client's bytes", async () => {
+		const got = await serverSide((conn) => new Promise((resolve) => conn.once("data", (d) => resolve(String(d)))));
+		expect(got).toBe("hello");
+	});
+
+	it("events.once(socket, 'data') resolves", async () => {
+		const got = await serverSide(async (conn) => {
+			const [d] = await eventsOnce(conn, "data");
+			return String(d);
+		});
+		expect(got).toBe("hello");
+	});
+
+	it("on('data') on a server-side socket is unchanged", async () => {
+		const got = await serverSide((conn) => new Promise((resolve) => conn.on("data", (d) => resolve(String(d)))));
+		expect(got).toBe("hello");
+	});
+
+	// ─── Subclass overrides are honoured, exactly like native once ──────────
+
+	it("once / prependOnceListener call the subclass's on / prependListener / removeListener", () => {
+		const calls = [];
+		class Recording extends EventEmitter {
+			on(event, fn) {
+				calls.push(`on:${String(event)}`);
+				return super.on(event, fn);
+			}
+			prependListener(event, fn) {
+				calls.push(`prependListener:${String(event)}`);
+				return super.prependListener(event, fn);
+			}
+			removeListener(event, fn) {
+				calls.push(`removeListener:${String(event)}`);
+				return super.removeListener(event, fn);
+			}
+		}
+
+		const emitter = new Recording();
+		let a = 0;
+		let b = 0;
+		emitter.once("a", () => a++);
+		emitter.prependOnceListener("b", () => b++);
+		emitter.emit("a");
+		emitter.emit("a");
+		emitter.emit("b");
+		emitter.emit("b");
+
+		expect(a).toBe(1);
+		expect(b).toBe(1);
+		expect(calls).toEqual(["on:a", "prependListener:b", "removeListener:a", "removeListener:b"]);
+		expect(emitter.listenerCount("a")).toBe(0);
+		expect(emitter.listenerCount("b")).toBe(0);
+	});
+
+	// ─── Plain EventEmitter: once semantics and no double-wrap ──────────────
+
+	it("plain EventEmitter once fires exactly once and leaves a single, introspectable wrapper", () => {
+		const emitter = new EventEmitter();
+		let calls = 0;
+		const fn = () => calls++;
+
+		emitter.once("e", fn);
+		const raw = emitter.rawListeners("e");
+		// Routing the attach through the patched `on` must not wrap the once-wrapper again.
+		expect(raw).toHaveLength(1);
+		expect(raw[0].listener).toBe(fn);
+
+		emitter.emit("e");
+		emitter.emit("e");
+		expect(calls).toBe(1);
+		expect(emitter.listenerCount("e")).toBe(0);
+	});
+
+	it("removeListener of a once-listener before it fires detaches it", () => {
+		const emitter = new EventEmitter();
+		let calls = 0;
+		const fn = () => calls++;
+
+		emitter.once("e", fn);
+		emitter.prependOnceListener("e", fn);
+		expect(emitter.listenerCount("e")).toBe(2);
+
+		emitter.removeListener("e", fn);
+		emitter.removeListener("e", fn);
+		emitter.emit("e");
+
+		expect(calls).toBe(0);
+		expect(emitter.listenerCount("e")).toBe(0);
+	});
+
+	it("once and on for the same function coexist: once detaches only itself", () => {
+		const emitter = new EventEmitter();
+		let calls = 0;
+		const fn = () => calls++;
+
+		emitter.on("e", fn);
+		emitter.once("e", fn);
+		emitter.emit("e");
+		expect(calls).toBe(2);
+		expect(emitter.listenerCount("e")).toBe(1);
+
+		emitter.emit("e");
+		expect(calls).toBe(3);
+
+		emitter.removeListener("e", fn);
+		expect(emitter.listenerCount("e")).toBe(0);
+	});
+
+	it("events.once on a plain EventEmitter resolves with the emitted args", async () => {
+		const emitter = new EventEmitter();
+		setImmediate(() => emitter.emit("ready", 1, 2));
+		const args = await withTimeout(eventsOnce(emitter, "ready"));
+		expect(args).toEqual([1, 2]);
+		expect(emitter.listenerCount("ready")).toBe(0);
+	});
+
+	// ─── The patch's purpose survives: once listeners still capture context ──
+
+	it("a once listener still runs in the async context it was registered in", () => {
+		const als = new AsyncLocalStorage();
+		const emitter = new EventEmitter();
+		let seen = "unset";
+
+		als.run("registered", () => {
+			emitter.once("e", () => {
+				seen = als.getStore();
+			});
+		});
+		als.run("emitted", () => emitter.emit("e"));
+
+		expect(seen).toBe("registered");
+	});
+});
diff --git a/types/src/lib/helpers/eventemitter-context.d.mts.map b/types/src/lib/helpers/eventemitter-context.d.mts.map
index d2c6cae43..0d24139ae 100644
--- a/types/src/lib/helpers/eventemitter-context.d.mts.map
+++ b/types/src/lib/helpers/eventemitter-context.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"eventemitter-context.d.mts","sourceRoot":"","sources":["../../../../src/lib/helpers/eventemitter-context.mjs"],"names":[],"mappings":"AAyCA;;;;;GAKG;AACH,8DAEC;AAyiBD;;;;;;GAMG;AACH,mDAiBC;AAED;;;;;GAKG;AACH,oDAsBC;AAED;;;;;;GAMG;AACH,qDAyBC"}
\ No newline at end of file
+{"version":3,"file":"eventemitter-context.d.mts","sourceRoot":"","sources":["../../../../src/lib/helpers/eventemitter-context.mjs"],"names":[],"mappings":"AAyCA;;;;;GAKG;AACH,8DAEC;AAqiBD;;;;;;GAMG;AACH,mDAiBC;AAED;;;;;GAKG;AACH,oDAsBC;AAED;;;;;;GAMG;AACH,qDAyBC"}
\ No newline at end of file

From fbd6862cd8754cb55d8b95ed0ffe22952c37f38d Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Mon, 28 Sep 2026 11:26:15 -0700
Subject: [PATCH 10/49] docs(typescript): use jsdoc-parseable callback types in
 the type-generation worker

jsdoc's type parser rejects TypeScript arrow-function types, so docs:build failed on the worker's `send`/`exit` params. They now reference @callback typedefs (WorkerMessageSender, WorkerExit); docs/generated/API.md is regenerated.
---
 docs/generated/API.md                         |  4 +-
 src/lib/processors/type-generation-worker.mjs | 22 +++++++++--
 .../processors/type-generation-worker.d.mts   | 39 +++++++++++++------
 .../type-generation-worker.d.mts.map          |  2 +-
 4 files changed, 49 insertions(+), 18 deletions(-)

diff --git a/docs/generated/API.md b/docs/generated/API.md
index 06a802cae..a1ee10e6e 100644
--- a/docs/generated/API.md
+++ b/docs/generated/API.md
@@ -3267,7 +3267,7 @@ api.slothlet.permissions.control.readGating(true);  // resume
 
 #### api.slothlet.permissions.control.seal() ⇒ <code>void</code>
 
-Seal the permission control surface (one-way, no unseal). After sealing, <code>enable</code>/<code>disable</code>, <code>addRule</code>/<code>removeRule</code>, and <code>readGating</code> throw <code>PERMISSION_SEALED</code>. Enforcement continues to evaluate and <code>shutdown()</code> still works. Idempotent.
+Seal the permission control surface (one-way, no unseal). After sealing, <code>enable</code>/<code>disable</code>, <code>addRule</code>/<code>removeRule</code>, <code>readGating</code>, and <code>principal.register</code>/<code>principal.unregister</code> throw <code>PERMISSION_SEALED</code>. Enforcement continues to evaluate, <code>principal.invalidate</code> and <code>shutdown()</code> still work. Idempotent.
 
 **Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
 
@@ -3713,7 +3713,7 @@ await api.slothlet.shutdown();
 | <a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-metadata"></a>slothlet.metadata | <code>object</code> | Module metadata accessor. |
 | <a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-owner"></a>slothlet.owner | <code>object</code> | Direct path ownership accessor (shorthand for `slothlet.ownership`). |
 | <a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-ownership"></a>slothlet.ownership | <code>object</code> | Module ownership registry. |
-| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-permissions"></a>slothlet.permissions | <code>object</code> | Permission system surface — present whenever a `permissions` block is configured. Rule registration (`addRule`/`removeRule`), self/global introspection (`self.*`, `global.*`), and runtime control (`control.*`) live here. Only the `control` sub-namespace is typed in this typedef; the rule-management methods are documented in <a href="../docs/PERMISSIONS.md">`docs/PERMISSIONS.md`</a>. |
+| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-permissions"></a>slothlet.permissions | <code>object</code> | Permission system surface — present whenever a `permissions` block is configured. Rule registration (`addRule`/`removeRule`), principal resolvers (`principal.*`), self/global introspection (`self.*`, `global.*`), and runtime control (`control.*`) live here. Only the `control` sub-namespace is typed in this typedef; the rule-management methods are documented in <a href="../docs/PERMISSIONS.md">`docs/PERMISSIONS.md`</a>. |
 | <a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-permissions-control"></a>slothlet.permissions.control | <code>object</code> | Runtime control over permission enforcement. |
 | <a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-permissions-control-enabled"></a>slothlet.permissions.control.enabled | <code>boolean</code> | Current permission-enforcement state. Exposed as a getter so descriptor-based reads remain permission-gated. %%sig: boolean%% %%example: // ESM usage via slothlet API\|import slothlet from "@cldmv/slothlet";\|const api = await slothlet({ base: './api', permissions: { defaultPolicy: 'allow' } });\|const on = api.slothlet.permissions.control.enabled;%% |
 | <a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-permissions-control-readGatingEnabled"></a>slothlet.permissions.control.readGatingEnabled | <code>boolean</code> | Current read-level gating state. `true` when terminal data-value property reads are permission-gated. Exposed as a getter so descriptor-based reads remain permission-gated. %%sig: boolean%% %%example: // ESM usage via slothlet API\|import slothlet from "@cldmv/slothlet";\|const api = await slothlet({ base: './api', permissions: { defaultPolicy: 'allow' } });\|const gated = api.slothlet.permissions.control.readGatingEnabled;%% |
diff --git a/src/lib/processors/type-generation-worker.mjs b/src/lib/processors/type-generation-worker.mjs
index 21456d773..84ed65486 100644
--- a/src/lib/processors/type-generation-worker.mjs
+++ b/src/lib/processors/type-generation-worker.mjs
@@ -34,12 +34,26 @@ import slothlet from "@cldmv/slothlet";
 import { generateTypes } from "@cldmv/slothlet/processors/type-generator";
 import { SlothletError } from "@cldmv/slothlet/errors";
 
+/**
+ * IPC sender to the parent process (`process.send` in the fork).
+ * @callback WorkerMessageSender
+ * @param {{type: string, error: (string|undefined)}} message - `{ type: "success" }` or `{ type: "error", error }`.
+ * @returns {void}
+ */
+
+/**
+ * Receives the worker's exit code (`process.exit` in the fork).
+ * @callback WorkerExit
+ * @param {number} code - `0` on success, `1` on failure.
+ * @returns {void}
+ */
+
 /**
  * Build the api described by `configJson` and write its declaration file.
  * @param {string|undefined} configJson - The serialized worker config (`SLOTHLET_CONFIG`): the
  *   slothlet config for an eager, fast-mode instance plus `types` (`{ output, interfaceName, ... }`).
- * @param {((message: {type: string, error?: string}) => void)|undefined} send - IPC sender to the
- *   parent (`process.send` in the fork); `undefined` when there is no IPC channel.
+ * @param {WorkerMessageSender|undefined} send - IPC sender to the parent (`process.send` in the
+ *   fork); `undefined` when there is no IPC channel.
  * @returns {Promise<number>} The process exit code: `0` on success, `1` on failure.
  * @example
  * const code = await runTypeGeneration(process.env.SLOTHLET_CONFIG, process.send?.bind(process));
@@ -69,8 +83,8 @@ export async function runTypeGeneration(configJson, send) {
  * no-op.
  * @param {string|undefined} argv1 - The entry script path (`process.argv[1]`).
  * @param {string|undefined} configJson - The serialized worker config (`SLOTHLET_CONFIG`).
- * @param {((message: {type: string, error?: string}) => void)|undefined} send - IPC sender to the parent.
- * @param {(code: number) => void} exit - Called with the exit code.
+ * @param {WorkerMessageSender|undefined} send - IPC sender to the parent.
+ * @param {WorkerExit} exit - Called with the exit code.
  * @returns {Promise<void>|null} The pending run, or `null` when this module is not the entry script.
  * @example
  * runIfEntry(process.argv[1], process.env.SLOTHLET_CONFIG, process.send?.bind(process), process.exit.bind(process));
diff --git a/types/src/lib/processors/type-generation-worker.d.mts b/types/src/lib/processors/type-generation-worker.d.mts
index 86e32337e..c0dcea8f2 100644
--- a/types/src/lib/processors/type-generation-worker.d.mts
+++ b/types/src/lib/processors/type-generation-worker.d.mts
@@ -1,31 +1,48 @@
+/**
+ * IPC sender to the parent process (`process.send` in the fork).
+ * @callback WorkerMessageSender
+ * @param {{type: string, error: (string|undefined)}} message - `{ type: "success" }` or `{ type: "error", error }`.
+ * @returns {void}
+ */
+/**
+ * Receives the worker's exit code (`process.exit` in the fork).
+ * @callback WorkerExit
+ * @param {number} code - `0` on success, `1` on failure.
+ * @returns {void}
+ */
 /**
  * Build the api described by `configJson` and write its declaration file.
  * @param {string|undefined} configJson - The serialized worker config (`SLOTHLET_CONFIG`): the
  *   slothlet config for an eager, fast-mode instance plus `types` (`{ output, interfaceName, ... }`).
- * @param {((message: {type: string, error?: string}) => void)|undefined} send - IPC sender to the
- *   parent (`process.send` in the fork); `undefined` when there is no IPC channel.
+ * @param {WorkerMessageSender|undefined} send - IPC sender to the parent (`process.send` in the
+ *   fork); `undefined` when there is no IPC channel.
  * @returns {Promise<number>} The process exit code: `0` on success, `1` on failure.
  * @example
  * const code = await runTypeGeneration(process.env.SLOTHLET_CONFIG, process.send?.bind(process));
  */
-export function runTypeGeneration(configJson: string | undefined, send: ((message: {
-    type: string;
-    error?: string;
-}) => void) | undefined): Promise<number>;
+export function runTypeGeneration(configJson: string | undefined, send: WorkerMessageSender | undefined): Promise<number>;
 /**
  * Run the type generation and hand its exit code to `exit`, but only when `argv1` is this file —
  * i.e. when the module is the process's entry script (the strict-mode fork). Any other import is a
  * no-op.
  * @param {string|undefined} argv1 - The entry script path (`process.argv[1]`).
  * @param {string|undefined} configJson - The serialized worker config (`SLOTHLET_CONFIG`).
- * @param {((message: {type: string, error?: string}) => void)|undefined} send - IPC sender to the parent.
- * @param {(code: number) => void} exit - Called with the exit code.
+ * @param {WorkerMessageSender|undefined} send - IPC sender to the parent.
+ * @param {WorkerExit} exit - Called with the exit code.
  * @returns {Promise<void>|null} The pending run, or `null` when this module is not the entry script.
  * @example
  * runIfEntry(process.argv[1], process.env.SLOTHLET_CONFIG, process.send?.bind(process), process.exit.bind(process));
  */
-export function runIfEntry(argv1: string | undefined, configJson: string | undefined, send: ((message: {
+export function runIfEntry(argv1: string | undefined, configJson: string | undefined, send: WorkerMessageSender | undefined, exit: WorkerExit): Promise<void> | null;
+/**
+ * IPC sender to the parent process (`process.send` in the fork).
+ */
+export type WorkerMessageSender = (message: {
     type: string;
-    error?: string;
-}) => void) | undefined, exit: (code: number) => void): Promise<void> | null;
+    error: (string | undefined);
+}) => void;
+/**
+ * Receives the worker's exit code (`process.exit` in the fork).
+ */
+export type WorkerExit = (code: number) => void;
 //# sourceMappingURL=type-generation-worker.d.mts.map
\ No newline at end of file
diff --git a/types/src/lib/processors/type-generation-worker.d.mts.map b/types/src/lib/processors/type-generation-worker.d.mts.map
index 74e95e5dc..0c8592893 100644
--- a/types/src/lib/processors/type-generation-worker.d.mts.map
+++ b/types/src/lib/processors/type-generation-worker.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"type-generation-worker.d.mts","sourceRoot":"","sources":["../../../../src/lib/processors/type-generation-worker.mjs"],"names":[],"mappings":"AAoCA;;;;;;;;;GASG;AACH,8CARW,MAAM,GAAC,SAAS,QAEhB,CAAC,CAAC,OAAO,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAC,KAAK,IAAI,CAAC,GAAC,SAAS,GAE3D,OAAO,CAAC,MAAM,CAAC,CAqB3B;AAED;;;;;;;;;;;GAWG;AACH,kCARW,MAAM,GAAC,SAAS,cAChB,MAAM,GAAC,SAAS,QAChB,CAAC,CAAC,OAAO,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAC,KAAK,IAAI,CAAC,GAAC,SAAS,QAC7D,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GACpB,OAAO,CAAC,IAAI,CAAC,GAAC,IAAI,CAS9B"}
\ No newline at end of file
+{"version":3,"file":"type-generation-worker.d.mts","sourceRoot":"","sources":["../../../../src/lib/processors/type-generation-worker.mjs"],"names":[],"mappings":"AAoCA;;;;;GAKG;AAEH;;;;;GAKG;AAEH;;;;;;;;;GASG;AACH,8CARW,MAAM,GAAC,SAAS,QAEhB,mBAAmB,GAAC,SAAS,GAE3B,OAAO,CAAC,MAAM,CAAC,CAqB3B;AAED;;;;;;;;;;;GAWG;AACH,kCARW,MAAM,GAAC,SAAS,cAChB,MAAM,GAAC,SAAS,QAChB,mBAAmB,GAAC,SAAS,QAC7B,UAAU,GACR,OAAO,CAAC,IAAI,CAAC,GAAC,IAAI,CAS9B;;;;4CAzDU;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,CAAC,MAAM,GAAC,SAAS,CAAC,CAAA;CAAC,KACvC,IAAI;;;;gCAMN,MAAM,KACJ,IAAI"}
\ No newline at end of file

From a7c1fe5ece112fa1b790ff9d0544ff04e9297e0f Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Mon, 28 Sep 2026 11:54:47 -0700
Subject: [PATCH 11/49] test: assert resolve-from-caller returns the test
 file's directory, not a path containing "slothlet"

The slothletIndex === -1 case checked expect(result).toContain("slothlet"),
which tests the checkout's folder name: it failed in every clone outside a
"slothlet" folder (the full-suite runs for #501 and #505) and would pass for
a wrong directory whose path contains the word. Assert the real expectation,
the directory holding the test file.

Fixes #506
---
 .../suites/helpers/resolve-from-caller.test.vitest.mjs       | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/tests/vitests/suites/helpers/resolve-from-caller.test.vitest.mjs b/tests/vitests/suites/helpers/resolve-from-caller.test.vitest.mjs
index ab52a72a1..ee326ac9a 100644
--- a/tests/vitests/suites/helpers/resolve-from-caller.test.vitest.mjs
+++ b/tests/vitests/suites/helpers/resolve-from-caller.test.vitest.mjs
@@ -65,8 +65,9 @@ describe("Resolver.resolvePathFromCaller", () => {
 		const result = resolver.resolvePathFromCaller(".");
 		expect(typeof result).toBe("string");
 		expect(result.length).toBeGreaterThan(0);
-		// The resolved "." should point to a directory that contains this test file
-		expect(result).toContain("slothlet");
+		// The resolved "." is the directory that contains this test file. (Asserting on the
+		// checkout path's text instead fails in any clone not under a "slothlet" folder, #506.)
+		expect(result).toBe(__dirname);
 	});
 
 	// ─── Caller-dir resolution succeeds (lines 193-194) ────────────────────

From b0c5ef799d38236ea6ed67c7e6fd3f1b3b10cab3 Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Mon, 28 Sep 2026 07:10:23 -0700
Subject: [PATCH 12/49] feat(typegen): type the composed api, self, and
 slothlet() from each node's module origin
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Typegen guessed each api node's type by matching the last path segment
against a file's ESM export syntax, so CommonJS leaves, default exports,
flattened and hoisted members, object-leaf methods and non-function values
came out as `any` or were missing, and the generated `declare const self`
was module-scoped and could not type an imported `self`.

The builder now records where each node came from. Ownership entries carry
an `exportPath` next to `filePath` — the access path within the file's
module namespace (`["add"]`, `["default"]`, `["default", "member"]`) —
captured from the loaded namespace before processModuleForAPI() merges its
exports, and derived for child wrappers as they are created, in eager mode,
lazy materialization, reload and api.slothlet.api.add() mounts alike.
`ownership.getOrigin(apiPath)` reads it back.

The type generator reads those origins from the composed instance and
emits `typeof import("<leaf>")[...]` for every member, so TypeScript types
each leaf straight from its source, whatever the format (.mjs JSDoc, .cjs
module.exports, .ts/.mts). Callable namespaces intersect the function with
their members; nodes with no module origin are `unknown`, with a comment.
The signature-copying machinery is gone and typegen no longer needs the
`typescript` package.

`@cldmv/slothlet/runtime` exports a `SlothletSelf` type anchor and types
`self` as it. The generated declaration extends it with the api and the
framework surface, and `slothlet()` is `<T = SlothletSelf>(...) =>
Promise<SlothletAPI & T>`, so an imported `self` and an awaited
`slothlet()` are both typed with no annotation. `augmentRuntime: false`
(`--no-augment-runtime`, or `slothlet.typegen.augmentRuntime` in
package.json) opts out.

Refs #484
---
 api_tests/api_test_typegen_mixed/bulb.mts     |  32 ++
 api_tests/api_test_typegen_mixed/greet.mjs    |  26 +
 api_tests/api_test_typegen_mixed/logger.mjs   |  39 ++
 api_tests/api_test_typegen_mixed/math.mjs     |  37 ++
 api_tests/api_test_typegen_mixed/parity.cjs   |  26 +
 api_tests/api_test_typegen_mixed/settings.mjs |  29 +
 api_tests/api_test_typegen_mixed/text.cjs     |  39 ++
 .../tuning/defaults.mjs                       |  20 +
 .../api_test_typegen_mixed/tuning/tuning.mjs  |  30 +
 .../widgets/widgets.mjs                       |  35 ++
 bin/slothlet.mjs                              |  21 +-
 docs/TYPESCRIPT.md                            |  54 +-
 index.mjs                                     |  14 +-
 src/lib/builders/modes-processor.mjs          |  34 +-
 src/lib/handlers/ownership.mjs                | 392 ++++++++++++-
 src/lib/handlers/unified-wrapper.mjs          |  63 +++
 src/lib/helpers/modes-utils.mjs               |  11 +-
 src/lib/i18n/languages/de-de.json             |   2 -
 src/lib/i18n/languages/en-gb.json             |   2 -
 src/lib/i18n/languages/en-us.json             |   2 -
 src/lib/i18n/languages/es-es.json             |   2 -
 src/lib/i18n/languages/es-mx.json             |   2 -
 src/lib/i18n/languages/fr-fr.json             |   2 -
 src/lib/i18n/languages/hi-in.json             |   2 -
 src/lib/i18n/languages/ja-jp.json             |   2 -
 src/lib/i18n/languages/ko-kr.json             |   2 -
 src/lib/i18n/languages/pt-br.json             |   2 -
 src/lib/i18n/languages/ru-ru.json             |   2 -
 src/lib/i18n/languages/zh-cn.json             |   2 -
 src/lib/processors/flatten.mjs                |  56 +-
 src/lib/processors/type-generator.mjs         | 520 ++++++++----------
 src/lib/runtime/runtime.mjs                   |  25 +-
 src/lib/typegen/typegen.mjs                   |  20 +-
 src/slothlet.mjs                              |  18 +-
 tests/validate-typestubs.mjs                  |  73 ++-
 .../typegen/typegen-cli.test.vitest.mjs       |  39 +-
 .../typegen/typegen-origin.test.vitest.mjs    | 357 ++++++++++++
 .../typegen-programmatic.test.vitest.mjs      | 165 ++++--
 .../typescript/type-generator.test.vitest.mjs | 269 +++++----
 .../typescript-strict-mode.test.vitest.mjs    |   5 +-
 types/index.d.mts                             |  20 +-
 types/index.d.mts.map                         |   2 +-
 .../lib/builders/modes-processor.d.mts.map    |   2 +-
 types/src/lib/handlers/ownership.d.mts        | 171 +++++-
 types/src/lib/handlers/ownership.d.mts.map    |   2 +-
 types/src/lib/handlers/unified-wrapper.d.mts  |   6 +-
 .../lib/handlers/unified-wrapper.d.mts.map    |   2 +-
 types/src/lib/helpers/modes-utils.d.mts.map   |   2 +-
 types/src/lib/processors/flatten.d.mts        |  13 +-
 types/src/lib/processors/flatten.d.mts.map    |   2 +-
 types/src/lib/processors/type-generator.d.mts |  17 +-
 .../lib/processors/type-generator.d.mts.map   |   2 +-
 types/src/lib/runtime/runtime.d.mts           |  25 +-
 types/src/lib/runtime/runtime.d.mts.map       |   2 +-
 types/src/lib/typegen/typegen.d.mts           |   4 +
 types/src/lib/typegen/typegen.d.mts.map       |   2 +-
 types/src/slothlet.d.mts                      |   7 +-
 types/src/slothlet.d.mts.map                  |   2 +-
 58 files changed, 2185 insertions(+), 571 deletions(-)
 create mode 100644 api_tests/api_test_typegen_mixed/bulb.mts
 create mode 100644 api_tests/api_test_typegen_mixed/greet.mjs
 create mode 100644 api_tests/api_test_typegen_mixed/logger.mjs
 create mode 100644 api_tests/api_test_typegen_mixed/math.mjs
 create mode 100644 api_tests/api_test_typegen_mixed/parity.cjs
 create mode 100644 api_tests/api_test_typegen_mixed/settings.mjs
 create mode 100644 api_tests/api_test_typegen_mixed/text.cjs
 create mode 100644 api_tests/api_test_typegen_mixed/tuning/defaults.mjs
 create mode 100644 api_tests/api_test_typegen_mixed/tuning/tuning.mjs
 create mode 100644 api_tests/api_test_typegen_mixed/widgets/widgets.mjs
 create mode 100644 tests/vitests/suites/typegen/typegen-origin.test.vitest.mjs

diff --git a/api_tests/api_test_typegen_mixed/bulb.mts b/api_tests/api_test_typegen_mixed/bulb.mts
new file mode 100644
index 000000000..02ec6b4c4
--- /dev/null
+++ b/api_tests/api_test_typegen_mixed/bulb.mts
@@ -0,0 +1,32 @@
+/**
+ * @fileoverview TypeScript leaf: an interface-annotated object leaf and a function returning a
+ * `node:events` type (typegen mixed-tree fixture, #484).
+ * @module api_test_typegen_mixed.bulb
+ */
+import { EventEmitter } from "node:events";
+
+/** Shape of a bulb's controls. */
+export interface BulbApi {
+	brightness: {
+		get(): number;
+		set(level: number): void;
+	};
+}
+
+let level = 50;
+
+/** Brightness control, typed through the `BulbApi` interface. */
+export const brightness: BulbApi["brightness"] = {
+	get: () => level,
+	set: (next: number) => {
+		level = next;
+	}
+};
+
+/**
+ * Create an event source for bulb changes.
+ * @returns A fresh emitter.
+ */
+export function events(): EventEmitter {
+	return new EventEmitter();
+}
diff --git a/api_tests/api_test_typegen_mixed/greet.mjs b/api_tests/api_test_typegen_mixed/greet.mjs
new file mode 100644
index 000000000..cdff3495a
--- /dev/null
+++ b/api_tests/api_test_typegen_mixed/greet.mjs
@@ -0,0 +1,26 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_typegen_mixed/greet.mjs
+ *	@Date: 2026-09-28 00:01:45 -07:00 (1790578905)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 00:49:32 -07:00 (1790581772)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview A default-export function (typegen mixed-tree fixture, #484).
+ * @module api_test_typegen_mixed.greet
+ */
+
+/**
+ * Greet someone by name.
+ * @param {string} name - Who to greet.
+ * @returns {string} The greeting.
+ */
+export default function greet(name) {
+	return `Hello, ${name}`;
+}
diff --git a/api_tests/api_test_typegen_mixed/logger.mjs b/api_tests/api_test_typegen_mixed/logger.mjs
new file mode 100644
index 000000000..a89917a8c
--- /dev/null
+++ b/api_tests/api_test_typegen_mixed/logger.mjs
@@ -0,0 +1,39 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_typegen_mixed/logger.mjs
+ *	@Date: 2026-09-28 00:01:45 -07:00 (1790578905)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 00:49:33 -07:00 (1790581773)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Callable container: a default function with named members merged onto it
+ * (typegen mixed-tree fixture, #484).
+ * @module api_test_typegen_mixed.logger
+ */
+
+/**
+ * Log a message.
+ * @param {string} message - Message to log.
+ * @returns {string} The formatted line.
+ */
+export default function logger(message) {
+	return `[log] ${message}`;
+}
+
+/**
+ * Log an informational message.
+ * @param {string} message - Message to log.
+ * @returns {string} The formatted line.
+ */
+export function info(message) {
+	return `[info] ${message}`;
+}
+
+/** Numeric log level. */
+export const LEVEL = 2;
diff --git a/api_tests/api_test_typegen_mixed/math.mjs b/api_tests/api_test_typegen_mixed/math.mjs
new file mode 100644
index 000000000..384df0a02
--- /dev/null
+++ b/api_tests/api_test_typegen_mixed/math.mjs
@@ -0,0 +1,37 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_typegen_mixed/math.mjs
+ *	@Date: 2026-09-28 00:01:45 -07:00 (1790578905)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 00:49:33 -07:00 (1790581773)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Named-export functions typed with JSDoc (typegen mixed-tree fixture, #484).
+ * @module api_test_typegen_mixed.math
+ */
+
+/**
+ * Add two numbers.
+ * @param {number} a - First addend.
+ * @param {number} b - Second addend.
+ * @returns {number} The sum.
+ */
+export function add(a, b) {
+	return a + b;
+}
+
+/**
+ * Repeat a string.
+ * @param {string} text - Text to repeat.
+ * @param {number} [times=2] - Repeat count.
+ * @returns {string} The repeated text.
+ */
+export function repeat(text, times = 2) {
+	return text.repeat(times);
+}
diff --git a/api_tests/api_test_typegen_mixed/parity.cjs b/api_tests/api_test_typegen_mixed/parity.cjs
new file mode 100644
index 000000000..cb3f47247
--- /dev/null
+++ b/api_tests/api_test_typegen_mixed/parity.cjs
@@ -0,0 +1,26 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_typegen_mixed/parity.cjs
+ *	@Date: 2026-09-28 00:01:45 -07:00 (1790578905)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 00:49:33 -07:00 (1790581773)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview CommonJS function export via `module.exports = function` (typegen mixed-tree fixture, #484).
+ * @module api_test_typegen_mixed.parity
+ */
+
+/**
+ * Whether a number is even.
+ * @param {number} n - Number to test.
+ * @returns {boolean} True when even.
+ */
+module.exports = function parity(n) {
+	return n % 2 === 0;
+};
diff --git a/api_tests/api_test_typegen_mixed/settings.mjs b/api_tests/api_test_typegen_mixed/settings.mjs
new file mode 100644
index 000000000..623f78495
--- /dev/null
+++ b/api_tests/api_test_typegen_mixed/settings.mjs
@@ -0,0 +1,29 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_typegen_mixed/settings.mjs
+ *	@Date: 2026-09-28 00:01:45 -07:00 (1790578905)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 00:49:33 -07:00 (1790581773)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Non-function exports: a frozen constant object and a primitive (typegen mixed-tree fixture, #484).
+ * @module api_test_typegen_mixed.settings
+ */
+
+/**
+ * Retry limits.
+ * @type {Readonly<{ maxRetries: number, mode: "strict" | "lenient" }>}
+ */
+export const LIMITS = Object.freeze({ maxRetries: 3, mode: "strict" });
+
+/**
+ * Settings schema version.
+ * @type {string}
+ */
+export const VERSION = "1.2.0";
diff --git a/api_tests/api_test_typegen_mixed/text.cjs b/api_tests/api_test_typegen_mixed/text.cjs
new file mode 100644
index 000000000..c1338990c
--- /dev/null
+++ b/api_tests/api_test_typegen_mixed/text.cjs
@@ -0,0 +1,39 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_typegen_mixed/text.cjs
+ *	@Date: 2026-09-28 00:01:45 -07:00 (1790578905)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 00:49:33 -07:00 (1790581773)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview CommonJS object export: a function and an object leaf (typegen mixed-tree fixture, #484).
+ * @module api_test_typegen_mixed.text
+ */
+
+/**
+ * Upper-case a string.
+ * @param {string} value - Text to shout.
+ * @returns {string} The upper-cased text.
+ */
+function shout(value) {
+	return value.toUpperCase();
+}
+
+const stats = {
+	/**
+	 * Count the words in a string.
+	 * @param {string} value - Text to count.
+	 * @returns {number} Word count.
+	 */
+	words(value) {
+		return value.split(/\s+/).filter(Boolean).length;
+	}
+};
+
+module.exports = { shout, stats };
diff --git a/api_tests/api_test_typegen_mixed/tuning/defaults.mjs b/api_tests/api_test_typegen_mixed/tuning/defaults.mjs
new file mode 100644
index 000000000..dcb693a9b
--- /dev/null
+++ b/api_tests/api_test_typegen_mixed/tuning/defaults.mjs
@@ -0,0 +1,20 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_typegen_mixed/tuning/defaults.mjs
+ *	@Date: 2026-09-28 05:49:33 -07:00 (1790599773)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 05:58:46 -07:00 (1790600326)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Sibling of the self-named tuning file (typegen mixed-tree fixture, #484).
+ * @module api_test_typegen_mixed.tuning.defaults
+ */
+
+/** Default gain. */
+export const DEFAULT_GAIN = 2;
diff --git a/api_tests/api_test_typegen_mixed/tuning/tuning.mjs b/api_tests/api_test_typegen_mixed/tuning/tuning.mjs
new file mode 100644
index 000000000..7b74dadca
--- /dev/null
+++ b/api_tests/api_test_typegen_mixed/tuning/tuning.mjs
@@ -0,0 +1,30 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_typegen_mixed/tuning/tuning.mjs
+ *	@Date: 2026-09-28 05:49:33 -07:00 (1790599773)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 05:58:46 -07:00 (1790600326)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Self-named file in a folder with a sibling file: its named exports — including a
+ * primitive — merge into the folder namespace alongside the sibling's (typegen mixed-tree fixture, #484).
+ * @module api_test_typegen_mixed.tuning
+ */
+
+/**
+ * Scale a value by the tuning step.
+ * @param {number} value - Value to scale.
+ * @returns {number} The scaled value.
+ */
+export function tune(value) {
+	return value * TUNE_STEP;
+}
+
+/** Tuning step size. */
+export const TUNE_STEP = 5;
diff --git a/api_tests/api_test_typegen_mixed/widgets/widgets.mjs b/api_tests/api_test_typegen_mixed/widgets/widgets.mjs
new file mode 100644
index 000000000..bb29a79f8
--- /dev/null
+++ b/api_tests/api_test_typegen_mixed/widgets/widgets.mjs
@@ -0,0 +1,35 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_typegen_mixed/widgets/widgets.mjs
+ *	@Date: 2026-09-28 00:01:45 -07:00 (1790578905)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 00:49:33 -07:00 (1790581773)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Self-named file inside its own folder — flattens into the folder namespace
+ * (typegen mixed-tree fixture, #484).
+ * @module api_test_typegen_mixed.widgets
+ */
+
+/**
+ * Create a widget.
+ * @param {string} name - Widget name.
+ * @returns {{ id: number, name: string }} The widget.
+ */
+export function create(name) {
+	return { id: name.length, name };
+}
+
+/**
+ * Count widgets.
+ * @returns {number} Always zero in this fixture.
+ */
+export function count() {
+	return 0;
+}
diff --git a/bin/slothlet.mjs b/bin/slothlet.mjs
index 167facd91..aaae6e335 100755
--- a/bin/slothlet.mjs
+++ b/bin/slothlet.mjs
@@ -81,14 +81,16 @@ function printTypegenHelp() {
        slothlet typegen        # reads from "slothlet.typegen" in package.json
 
 Generates a TypeScript .d.ts file describing the API loaded from <dir>.
-The file declares an interface named <interfaceName> and a 'self' constant of
-that interface type, so '.ts' modules in your API can use 'self.*' with full
-autocomplete and type-checking.
+The file declares an interface named <interfaceName> and extends 'SlothletSelf'
+from '@cldmv/slothlet/runtime' with it, so every module that imports 'self'
+(.ts, .mts, or JSDoc-checked .mjs/.cjs) gets full autocomplete and
+type-checking on 'self.*'. Include the generated file in your tsconfig.
 
 Options:
   -d, --dir <path>              Path to the API directory
   -o, --output <path>           Output path for the generated .d.ts
   -n, --interface-name <name>   Name of the generated TypeScript interface
+      --no-augment-runtime      Don't type 'self' from this declaration
   -h, --help                    Show this help
 
 Resolution order (per option): flag → positional → package.json's "slothlet.typegen".
@@ -147,7 +149,7 @@ async function runTypegen(args) {
  * Parse typegen flags and positional args. Throws on flag-without-value.
  * Unknown long flags throw; unknown positional args are stored but later checks decide what to do.
  * @param {string[]} args
- * @returns {{dir?: string, output?: string, interfaceName?: string}}
+ * @returns {{dir?: string, output?: string, interfaceName?: string, augmentRuntime?: boolean}}
  * @private
  */
 function parseTypegenArgs(args) {
@@ -161,6 +163,8 @@ function parseTypegenArgs(args) {
 			opts.output = requireValue(args, ++i, arg);
 		} else if (arg === "-n" || arg === "--interface-name") {
 			opts.interfaceName = requireValue(args, ++i, arg);
+		} else if (arg === "--no-augment-runtime") {
+			opts.augmentRuntime = false;
 		} else if (arg.startsWith("-")) {
 			throw new Error(`unknown option '${arg}'`);
 		} else {
@@ -192,12 +196,12 @@ function requireValue(args, idx, flagName) {
 /**
  * Fill missing options from `package.json` → `slothlet.typegen`. Missing or
  * unparseable package.json is treated as an empty source (no error).
- * @param {{dir?: string, output?: string, interfaceName?: string}} opts
- * @returns {{dir?: string, output?: string, interfaceName?: string}}
+ * @param {{dir?: string, output?: string, interfaceName?: string, augmentRuntime?: boolean}} opts
+ * @returns {{dir?: string, output?: string, interfaceName?: string, augmentRuntime?: boolean}}
  * @private
  */
 function mergeWithPackageJson(opts) {
-	if (opts.dir && opts.output && opts.interfaceName) return opts;
+	if (opts.dir && opts.output && opts.interfaceName && opts.augmentRuntime !== undefined) return opts;
 
 	const pkgPath = path.resolve(process.cwd(), "package.json");
 	if (!fs.existsSync(pkgPath)) return opts;
@@ -213,6 +217,7 @@ function mergeWithPackageJson(opts) {
 	return {
 		dir: opts.dir ?? fromPkg.dir,
 		output: opts.output ?? fromPkg.output,
-		interfaceName: opts.interfaceName ?? fromPkg.interfaceName
+		interfaceName: opts.interfaceName ?? fromPkg.interfaceName,
+		augmentRuntime: opts.augmentRuntime ?? fromPkg.augmentRuntime
 	};
 }
diff --git a/docs/TYPESCRIPT.md b/docs/TYPESCRIPT.md
index 0cbcdf5fc..0d2a76745 100644
--- a/docs/TYPESCRIPT.md
+++ b/docs/TYPESCRIPT.md
@@ -228,27 +228,51 @@ The `.d.ts` file is generated **before** modules are loaded, so TypeScript files
 
 ### Example Generated Output
 
-For an API directory containing `math.ts` and `string.ts`:
+For an API directory containing:
 
+```text
+api/
+├── math.ts            export function add(a: number, b: number): number
+├── logger.mjs         export default function logger(msg) + export function info(msg)
+├── parity.cjs         module.exports = function parity(n) { … }
+└── text.cjs           module.exports = { shout, stats }
+```
+
+the generated file references each export slothlet placed at each path:
+
+<!-- prettier-ignore -->
 ```typescript
 // types/api.d.ts (generated)
+import type { SlothletAPI } from "@cldmv/slothlet";
+
 export interface MyAPI {
 	math: {
-		add(a: number, b: number): number;
-		subtract(a: number, b: number): number;
-		multiply(a: number, b: number): number;
+		add: typeof import("../api/math.js")["add"];
 	};
-	string: {
-		capitalize(str: string): string;
-		lowercase(str: string): string;
-		uppercase(str: string): string;
+	logger: typeof import("../api/logger.mjs")["default"] & {
+		info: typeof import("../api/logger.mjs")["info"];
 	};
+	parity: typeof import("../api/parity.cjs");
+	text: typeof import("../api/text.cjs");
 }
 
-declare const self: MyAPI;
+declare module "@cldmv/slothlet/runtime" {
+	interface SlothletSelf extends MyAPI {}
+	interface SlothletSelf extends SlothletAPI {}
+}
 ```
 
-> **Both JavaScript and TypeScript leaves are typed faithfully.** Signatures are resolved through the TypeScript checker. A JavaScript leaf documented with JSDoc — `@param {string} name`, `@returns {Promise<User>}`, object shapes from a `@param {object} opts` tag plus its dotted `opts.id` sub-tags, optional params, unions, and generics — is emitted with those real types, not `any`. A TypeScript leaf is typed from its annotations — in a `.ts` / `.mts` file JSDoc _type_ tags are ignored, exactly as `tsc` ignores them, so annotate the types there — and any local `interface` / `type` / `enum` it references is emitted alongside the declaration (via TypeScript's own declaration emitter) so the output compiles standalone.
+| Composed node                                                                              | Generated type                                                          |
+| ------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------- |
+| A named export (`export function add`)                                                     | `typeof import("<leaf>")["add"]`                                        |
+| A default export                                                                           | `typeof import("<leaf>")["default"]`                                    |
+| A member of an exported object                                                             | `typeof import("<leaf>")["obj"]["member"]`                              |
+| A CommonJS `module.exports` / one of its members                                           | `typeof import("<leaf>.cjs")` / `typeof import("<leaf>.cjs")["member"]` |
+| A namespace slothlet composed (a folder, a file's named exports)                           | an object type of its members                                           |
+| A callable namespace (a default function with named exports merged onto it)                | the function's type `&` an object of the merged members                 |
+| A member with no module origin (a runtime `self.X = value`, in-memory `api.add()` exports) | `unknown`, with a comment saying why                                    |
+
+> **Every leaf is typed by its own source.** Each member is `typeof import(...)` of the export slothlet actually placed there, so TypeScript reads the leaf's own types — JSDoc in `.mjs` / `.cjs`, annotations in `.ts` / `.mts` (including types it imports, such as `node:events`), frozen constants, object leaves typed through an interface. The origin comes from composition itself (slothlet records which export produced each api node), so flattened, hoisted, and merged members are typed correctly too. Specifiers are relative to the generated file and use each leaf's runtime extension (`.ts` → `.js`, `.mts` → `.mjs`), which resolves under both `NodeNext` and `Bundler`. Because JavaScript leaves are referenced directly, the program that includes the declaration needs `allowJs: true`.
 
 ### Runtime Imports (`self`, `context`, `instanceID`)
 
@@ -265,7 +289,7 @@ export function fullReport(name: string) {
 }
 ```
 
-The generated `.d.ts` additionally includes `declare const self: InterfaceName` whenever `types.interfaceName` is set, which gives `self` full autocomplete and type-checking against your API shape. `context` and `instanceID` are typed by the runtime module's own `.d.ts` (no extra config needed).
+`self` is declared as `SlothletSelf`, an empty class exported by `@cldmv/slothlet/runtime`. The generated `.d.ts` extends that class with the generated interface (and with `SlothletAPI`, since `self.slothlet.*` is the same framework surface as `api.slothlet.*`), which gives `self` full autocomplete and type-checking against your API shape in every leaf that imports it — `.ts`, `.mts`, and JSDoc-checked `.mjs` / `.cjs` alike. The same anchor types the consumer side: `slothlet()` resolves to `SlothletAPI & T`, where `T` defaults to `SlothletSelf`, so `const api = await slothlet({ base: "./api" })` is typed with no annotation. A program that loads more than one api passes its interface explicitly (`slothlet<OtherApi>({ base: "./other" })`) and generates the other declarations with `augmentRuntime: false` (`--no-augment-runtime`). `context` and `instanceID` are typed by the runtime module's own `.d.ts` (no extra config needed).
 
 See [CONTEXT-PROPAGATION.md](CONTEXT-PROPAGATION.md) for what `context` and `instanceID` carry and how they propagate across calls.
 
@@ -349,11 +373,11 @@ const { filePath, content } = await generateTypes({
 console.log(`Wrote ${filePath} (${content.length} bytes)`);
 ```
 
-`generateTypes()` loads the API in eager + fast TypeScript mode internally, walks the resulting structure, extracts type info from your source files via the TypeScript compiler API, writes the `.d.ts`, and shuts the loaded instance down before returning. If `dir`, `output`, or `interfaceName` is missing or empty, it throws `SlothletError("INVALID_CONFIG")` — the same error class everything else uses.
+`generateTypes()` loads the API in eager + fast TypeScript mode internally, walks the composed structure, references each node's originating export (see [Example Generated Output](#example-generated-output)), writes the `.d.ts`, and shuts the loaded instance down before returning. It does not need the `typescript` package. If `dir`, `output`, or `interfaceName` is missing or empty, it throws `SlothletError("INVALID_CONFIG")` — the same error class everything else uses.
 
 ### What the output looks like
 
-The generated file matches what strict mode emits — see [Example Generated Output](#example-generated-output) above. Concretely: a top-level `interface`, a `declare const self: <Interface>`, and JSDoc comments preserved from your sources.
+The generated file matches what strict mode emits — see [Example Generated Output](#example-generated-output) above. Concretely: a top-level `interface` whose members are `typeof import(...)` references to your leaves, and a `declare module "@cldmv/slothlet/runtime"` block that extends `SlothletSelf` (omitted with `augmentRuntime: false`).
 
 ### Editor / build wiring tips
 
@@ -427,7 +451,7 @@ SlothletError: TypeScript strict mode requires 'types.interfaceName' to be confi
 
 - **No `.tsx` support.** Only `.ts` and `.mts` files are handled. JSX is not supported.
 - **Fast mode does not type-check.** Type errors are silently ignored. Use strict mode if you need type validation.
-- **Type generation reads from API metadata.** Function signatures in the `.d.ts` are extracted from TypeScript source files using the TypeScript Compiler API. Plain JavaScript files get generic signatures in the generated declaration.
-- **`self` is a runtime concept.** The `declare const self: InterfaceName` in the generated `.d.ts` provides type information only. The actual `self` value at runtime is the Slothlet proxy, imported via `import { self } from "@cldmv/slothlet/runtime"` and resolved per-instance through the module context system.
+- **Type generation reads the composed api.** Each member of the `.d.ts` references the export slothlet placed at that path; a member with no module origin (assigned at runtime, or mounted from in-memory `api.add()` exports) is typed `unknown`. JavaScript leaves are referenced directly, so compile the declaration with `allowJs: true`.
+- **`self` is a runtime concept.** The `SlothletSelf` augmentation in the generated `.d.ts` provides type information only. The actual `self` value at runtime is the Slothlet proxy, imported via `import { self } from "@cldmv/slothlet/runtime"` and resolved per-instance through the module context system.
 - **Generated `.d.ts` is not automatically deleted.** Slothlet does not clean up generated files after shutdown. Manage the file lifecycle yourself or use a temp directory.
 - **Transformed TS is cached on disk.** Slothlet writes transformed `.ts`/`.mts` output to `<project>/.slothlet-cache/<pid>-<instanceID>/<hash>.mjs` so Node's resolver can anchor bare-specifier imports (e.g. `@cldmv/slothlet/runtime`). Relative specifiers in the transformed output are anchored at the original source directory — relative imports of plain `.mjs` / `.cjs` / `.js` files become absolute `file://` URLs, and relative imports of other `.ts` / `.mts` modules are transpiled and linked to their own cache files (import cycles included). The current instance's directory is removed on `shutdown()`. On the first TS load each process also passively sweeps sibling directories whose `<pid>` prefix no longer matches a live process (probed via signal 0 — nothing is killed), preventing orphans from accumulating when a process exits without calling `shutdown()` (SIGKILL, OOM, crash, etc.). Add `.slothlet-cache/` to your `.gitignore`.
diff --git a/index.mjs b/index.mjs
index ec7d97a93..d81cbaa95 100644
--- a/index.mjs
+++ b/index.mjs
@@ -104,14 +104,26 @@ const devcheckPromise = __isNode
 		})()
 	: Promise.resolve();
 
+/**
+ * The framework surface of a composed api: `api.slothlet.*`, `api.shutdown()`, `api.destroy()`.
+ * `slothlet typegen` output extends `SlothletSelf` with it, so `self.slothlet.*` is typed too.
+ * @typedef {import("./src/slothlet.mjs").SlothletAPI} SlothletAPI
+ */
+
 /**
  * Creates a slothlet API instance with live-binding context and AsyncLocalStorage support.
  * Automatically wraps all API functions with context isolation for multi-instance support.
+ *
+ * The resolved api is typed as `SlothletAPI & T`. `T` defaults to `SlothletSelf` from
+ * `@cldmv/slothlet/runtime`, which a `slothlet typegen` declaration extends with the project's api —
+ * so a project with generated types gets a typed api with no annotation. A program that loads more
+ * than one api passes the interface explicitly: `slothlet<OtherApi>({ base: "./other" })`.
  * @public
  * @async
  *
+ * @template {object} [T=import("./src/lib/runtime/runtime.mjs").SlothletSelf]
  * @param {import("./src/slothlet.mjs").SlothletOptions} [options={}] - Configuration options for the slothlet instance. See {@link SlothletOptions} for the full set.
- * @returns {Promise<import("./src/slothlet.mjs").SlothletAPI>} The bound API object with management methods
+ * @returns {Promise<import("./src/slothlet.mjs").SlothletAPI & T>} The bound API object with management methods
  *
  * @example // ESM
  * import slothlet from "@cldmv/slothlet";
diff --git a/src/lib/builders/modes-processor.mjs b/src/lib/builders/modes-processor.mjs
index 2f874cb58..2d22e312e 100644
--- a/src/lib/builders/modes-processor.mjs
+++ b/src/lib/builders/modes-processor.mjs
@@ -451,11 +451,21 @@ export class ModesProcessor extends ComponentBase {
 				// Synthetic / in-memory leaf (#117): exports are supplied directly on the file
 				// entry, so skip the disk load + extractExports. Everything downstream (flatten,
 				// wrap, assign) operates on the same `{ default?, ...named }` shape a file produces.
-				const exports = file.synthetic
-					? file.exports
-					: this.slothlet.processors.loader.extractExports(
-							await this.slothlet.processors.loader.loadModule(file.path, this.slothlet.instanceID, moduleID, cacheBust)
-						);
+				let exports;
+				if (file.synthetic) {
+					exports = file.exports;
+				} else {
+					const loadedNamespace = await this.slothlet.processors.loader.loadModule(
+						file.path,
+						this.slothlet.instanceID,
+						moduleID,
+						cacheBust
+					);
+					// Index where each exported value sits in the namespace, so every wrapper built from this
+					// file can record its module origin (#484).
+					this.slothlet.handlers.ownership?.indexModuleExports(file.path, loadedNamespace);
+					exports = this.slothlet.processors.loader.extractExports(loadedNamespace);
+				}
 				const moduleName = this.slothlet.helpers.sanitize.sanitizePropertyName(file.name);
 				const moduleKeys = Object.keys(exports).filter((k) => k !== "default");
 				const analysis = {
@@ -515,12 +525,16 @@ export class ModesProcessor extends ComponentBase {
 			if (isRootContributor) {
 				// Build the function with named exports attached
 				const defaultFunc = this.slothlet.helpers.modesUtils.ensureNamedExportFunction(mod.default, moduleName);
+				const rootMembers = {};
 				for (const key of moduleKeys) {
 					if (!this.slothlet.processors.flatten.shouldAttachNamedExport(key, mod[key], defaultFunc, mod.default)) {
 						continue;
 					}
 					defaultFunc[key] = mod[key];
+					rootMembers[key] = [key];
 				}
+				// The attached named exports' origins, for the callable's children (#484).
+				this.slothlet.handlers.ownership?.recordComposedContent(file.path, defaultFunc, rootMembers, ["default"]);
 				// Track root-level default function exports for post-processing
 				rootContributors.push({ moduleName, file, defaultFunc });
 				continue; // Skip normal processing for root contributors
@@ -548,7 +562,7 @@ export class ModesProcessor extends ComponentBase {
 				const effectiveCategoryName = categoryName || moduleName;
 
 				// Build module content based on decision (C08-C09b + AddApi + collision handling)
-				let { moduleContent } = this.slothlet.processors.flatten.processModuleForAPI({
+				let { moduleContent, origins: moduleOrigins } = this.slothlet.processors.flatten.processModuleForAPI({
 					mod,
 					decision,
 					moduleName,
@@ -564,6 +578,11 @@ export class ModesProcessor extends ComponentBase {
 					// (#372/#373 review, suppressed finding).
 					collisionModeOverride: modes_effectiveCollisionMode
 				});
+				// Where the composed content and each key it gathered came from (#484). A synthetic
+				// in-memory file has no module origin and is never indexed, so this is a no-op for it.
+				if (!file.synthetic) {
+					this.slothlet.handlers.ownership?.recordComposedContent(file.path, moduleContent, moduleOrigins.members, moduleOrigins.self);
+				}
 				// Special case: folder/folder.mjs pattern (only for nested, not root). Depth — not the
 				// presence of a prefix — is what scopes it: an api.add() build carries its mount prefix at
 				// EVERY level, and suppressing the hoist for all of them composed the same directory to a
@@ -1529,6 +1548,7 @@ export class ModesProcessor extends ComponentBase {
 								filenameMatches: filenameMatchesFolder
 							});
 							const mod = await this.slothlet.processors.loader.loadModule(file.path, this.slothlet.instanceID, moduleID, cacheBust);
+							this.slothlet.handlers.ownership?.indexModuleExports(file.path, mod);
 							const exports = this.slothlet.processors.loader.extractExports(mod);
 							const moduleKeys = Object.keys(exports).filter((k) => k !== "default");
 							const analysis = {
@@ -2164,6 +2184,7 @@ export class ModesProcessor extends ComponentBase {
 				const filenameMatchesFolder = moduleName === categoryName;
 				if (isGeneric || filenameMatchesFolder) {
 					const mod = await this.slothlet.processors.loader.loadModule(file.path, this.slothlet.instanceID, moduleID, cacheBust);
+					this.slothlet.handlers.ownership?.indexModuleExports(file.path, mod);
 					const exports = this.slothlet.processors.loader.extractExports(mod);
 					const moduleKeys = Object.keys(exports).filter((k) => k !== "default");
 					const analysis = {
@@ -2283,6 +2304,7 @@ export class ModesProcessor extends ComponentBase {
 										source: "lazy-materialization",
 										moduleID: moduleID,
 										filePath: file.path,
+										exportPath: this.slothlet.handlers.ownership?.resolveExportPath(file.path, value) ?? null,
 										// sourceFolder is always passed by every call site; config?.dir fallback is never evaluated.
 										/* v8 ignore next */
 										sourceFolder: sourceFolder || this.slothlet.config?.dir
diff --git a/src/lib/handlers/ownership.mjs b/src/lib/handlers/ownership.mjs
index 0d37f62a9..dfb76d0fa 100644
--- a/src/lib/handlers/ownership.mjs
+++ b/src/lib/handlers/ownership.mjs
@@ -69,6 +69,89 @@ const REGISTRATION_SOURCE_CONFIRM = "subtree-confirm";
  */
 const REGISTRATION_SOURCE_AUTHORITATIVE = "core";
 
+/**
+ * Whether a value can key a WeakMap (an object or function).
+ * @param {*} value - Value to test.
+ * @returns {boolean} True for a non-null object or a function.
+ * @private
+ */
+function isIndexable(value) {
+	return (typeof value === "object" && value !== null) || typeof value === "function";
+}
+
+/**
+ * Own enumerable string keys of `value` whose descriptor is a plain data property — an accessor is
+ * skipped so indexing a module's exports never runs user getter code.
+ * @param {object|Function} value - Value whose keys to list.
+ * @returns {string[]} Data-property keys.
+ * @private
+ */
+function ownDataKeys(value) {
+	const keys = [];
+	for (const key of Reflect.ownKeys(value)) {
+		if (typeof key !== "string") continue;
+		try {
+			const descriptor = Object.getOwnPropertyDescriptor(value, key);
+			if (descriptor && descriptor.enumerable && "value" in descriptor) keys.push(key);
+		} catch {
+			// A namespace binding still in its temporal dead zone throws on inspection — skip it.
+		}
+	}
+	return keys;
+}
+
+/**
+ * Enumerable own string keys of a module namespace, tolerating a binding still in its temporal dead
+ * zone (inspecting one throws during a circular import).
+ * @param {object} mod - Module namespace.
+ * @returns {string[]} Binding names.
+ * @private
+ */
+function namespaceKeys(mod) {
+	const keys = [];
+	for (const key of Reflect.ownKeys(mod)) {
+		if (typeof key !== "string") continue;
+		try {
+			if (Object.getOwnPropertyDescriptor(mod, key)?.enumerable) keys.push(key);
+		} catch {
+			// Temporal-dead-zone binding — skip it.
+		}
+	}
+	return keys;
+}
+
+/**
+ * Read one module-namespace binding, tolerating a binding still in its temporal dead zone.
+ * @param {object} mod - Module namespace.
+ * @param {string} key - Binding name.
+ * @returns {*} The bound value, or `undefined` when unreadable.
+ * @private
+ */
+function readBinding(mod, key) {
+	try {
+		return mod[key];
+	} catch {
+		return undefined;
+	}
+}
+
+/**
+ * Read an own data property without invoking a getter, tolerating a binding still in its temporal
+ * dead zone (a module namespace read during a circular import throws on access).
+ * @param {object|Function} value - Object to read from.
+ * @param {string} key - Property key.
+ * @returns {*} The property value, or `undefined` when unreadable or an accessor.
+ * @private
+ */
+function readOwnData(value, key) {
+	try {
+		const descriptor = Object.getOwnPropertyDescriptor(value, key);
+		return descriptor && "value" in descriptor ? descriptor.value : undefined;
+	} catch {
+		return undefined;
+	}
+}
+
 /**
  * Read `proxy[key]` for a bookkeeping walk without starting a lazy child's materialization (#462).
  *
@@ -126,6 +209,258 @@ export class OwnershipManager extends ComponentBase {
 		this.pathToModule = new Map(); // apiPath → Array<{moduleID, source, timestamp, value}>
 		this._unregisteredModules = new Set(); // moduleIDs that have been explicitly unregistered
 		this.moduleEndpoints = new Map(); // moduleID → mount endpoint (e.g. ".", "lib.config")
+		// filePath → { values: WeakMap<value, exportPath>, members: WeakMap<value, {key: exportPath}> } —
+		// where each value a loaded file exported sits inside that file's module namespace (#484).
+		this.exportIndex = new Map();
+		// clone → the value it was cloned from, so an origin lookup sees through an eager-mode clone.
+		this.cloneSources = new WeakMap();
+	}
+
+	/**
+	 * Index where each value of a freshly loaded module sits in that module's namespace (#484).
+	 * @param {string} filePath - Absolute path of the loaded file.
+	 * @param {object} mod - The module namespace as loaded (`import()` result, or the CJS loader's
+	 *   `{ default: module.exports, ...ownKeys }` namespace).
+	 * @returns {void}
+	 * @public
+	 *
+	 * @description
+	 * Wrappers built from this file later look their impl up here to learn their `exportPath` — the
+	 * access path within the namespace that produced the value (`["add"]`, `["default"]`,
+	 * `["default", "member"]`). A named export wins over the same value reached through `default`.
+	 * For a CommonJS module every path is rooted at `["default"]` (`module.exports`), since the
+	 * named keys a CommonJS namespace carries are copies of `module.exports`' own keys.
+	 *
+	 * @example
+	 * ownership.indexModuleExports("/abs/api/math.mjs", await import("/abs/api/math.mjs"));
+	 */
+	indexModuleExports(filePath, mod) {
+		if (typeof filePath !== "string" || !filePath || !isIndexable(mod)) return;
+		// Merge into an existing entry rather than replace it: the same file loaded again (a reload, or
+		// a second mount of it) yields new value identities, while wrappers from an earlier load may
+		// still be looked up against the earlier ones.
+		const isCommonJS = filePath.endsWith(".cjs") || Object.prototype.hasOwnProperty.call(mod, "module.exports");
+		let entry = this.exportIndex.get(filePath);
+		if (!entry) {
+			entry = { values: new WeakMap(), members: new WeakMap(), keys: new Map(), commonJS: isCommonJS };
+			this.exportIndex.set(filePath, entry);
+		}
+		// Top-level keys by NAME, with the value each held, for a value that has no identity to look up (a
+		// primitive — objects and functions resolve through the WeakMaps above, so they are not held here).
+		// The latest load of the file wins (a reload can change a primitive's value); within one load a named
+		// binding is recorded before, and wins over, a default-object member of the same name.
+		const keysThisLoad = new Set();
+		const setKey = (key, value, exportPath) => {
+			if (isIndexable(value) || keysThisLoad.has(key)) return;
+			keysThisLoad.add(key);
+			entry.keys.set(key, { value, exportPath });
+		};
+		const setPath = (value, exportPath) => {
+			if (isIndexable(value) && !entry.values.has(value)) entry.values.set(value, exportPath);
+		};
+		// The namespace's own bindings are read through `[[Get]]`: a real ESM namespace exposes them as
+		// data properties, but a loader-provided namespace (a test runner's module runner, a custom
+		// `config.import`) may expose each binding as an accessor. Members BELOW the namespace are read
+		// as plain data only, so indexing never runs a module's own getter code.
+		const namedKeys = isCommonJS ? [] : namespaceKeys(mod).filter((key) => key !== "default" && key !== "module.exports");
+		for (const key of namedKeys) {
+			const value = readBinding(mod, key);
+			setPath(value, [key]);
+			setKey(key, value, [key]);
+		}
+		const defaultValue = readBinding(mod, "default");
+		setPath(defaultValue, ["default"]);
+		if (isIndexable(defaultValue)) {
+			for (const key of ownDataKeys(defaultValue)) {
+				const value = readOwnData(defaultValue, key);
+				setPath(value, ["default", key]);
+				setKey(key, value, ["default", key]);
+			}
+		}
+		for (const key of namedKeys) {
+			const value = readBinding(mod, key);
+			if (!isIndexable(value)) continue;
+			for (const member of ownDataKeys(value)) setPath(readOwnData(value, member), [key, member]);
+		}
+	}
+
+	/**
+	 * Whether `filePath` was loaded as a CommonJS module (its exports are `module.exports`) (#484).
+	 * @param {string} filePath - Absolute path of a loaded file.
+	 * @returns {boolean} True for a CommonJS module; false for ES modules and files never indexed.
+	 * @public
+	 *
+	 * @example
+	 * ownership.isCommonJSModule("/abs/api/text.cjs"); // true
+	 */
+	isCommonJSModule(filePath) {
+		return this.exportIndex.get(filePath)?.commonJS === true;
+	}
+
+	/**
+	 * Record the per-key origins of a value composed from a module's exports (#484).
+	 * @param {string} filePath - Absolute path of the file the content was built from.
+	 * @param {object|Function} content - The composed content (a fresh namespace object, or a default
+	 *   export the named exports were attached onto).
+	 * @param {Object<string, string[]>|null} members - Composed key → the exportPath it came from.
+	 * @param {string[]|null} [self=null] - The content's own exportPath, when it is itself an export.
+	 * @returns {void}
+	 * @public
+	 *
+	 * @description
+	 * Flattening merges a module's default and named exports into one content value, so a key's
+	 * position under that content no longer tells where it came from. Recording the map lets a
+	 * wrapper built from the content hand each child — including a primitive child, which has no
+	 * identity to look up — its real exportPath.
+	 *
+	 * @example
+	 * ownership.recordComposedContent(file, content, { add: ["add"], VERSION: ["VERSION"] });
+	 */
+	recordComposedContent(filePath, content, members, self = null) {
+		if (typeof filePath !== "string" || !isIndexable(content)) return;
+		const entry = this.exportIndex.get(filePath);
+		if (!entry) return;
+		if (self && !entry.values.has(content)) entry.values.set(content, self);
+		if (members && Object.keys(members).length > 0) {
+			entry.members.set(content, { ...(entry.members.get(content) || {}), ...members });
+		}
+	}
+
+	/**
+	 * Remember that `clone` was cloned from `original`, so an origin lookup sees through the clone.
+	 * @param {*} clone - The clone.
+	 * @param {*} original - The value it was cloned from.
+	 * @returns {void}
+	 * @public
+	 *
+	 * @example
+	 * ownership.noteClone(copy, exported);
+	 */
+	noteClone(clone, original) {
+		if (clone !== original && isIndexable(clone) && isIndexable(original)) this.cloneSources.set(clone, original);
+	}
+
+	/**
+	 * Look up where `value` sits in the module namespace of `filePath` (#484).
+	 * @param {string|null} filePath - File the value was loaded from.
+	 * @param {*} value - The value (or an eager-mode clone of it).
+	 * @returns {string[]|null} The exportPath, or `null` when the value is not a known export of that file.
+	 * @public
+	 *
+	 * @example
+	 * ownership.resolveExportPath("/abs/api/math.mjs", addFn); // ["add"]
+	 */
+	resolveExportPath(filePath, value) {
+		const found = this.#lookupIndexed(filePath, value, "values");
+		return found ? [...found] : null;
+	}
+
+	/**
+	 * Look up an export of `filePath` by the NAME it was placed under, confirmed by value (#484).
+	 * @param {string|null} filePath - File the value was loaded from.
+	 * @param {string} key - The key the value sits under in the composed api.
+	 * @param {*} value - The value itself; must be the value that export held (`Object.is`).
+	 * @returns {string[]|null} The exportPath, or `null` when `filePath` has no export of that name
+	 *   holding that value.
+	 * @public
+	 *
+	 * @description
+	 * For a value with no identity to look up — a primitive — merged into a namespace that several
+	 * files compose (a folder whose files flatten into it), where no per-key map was recorded for the
+	 * namespace itself. The value check keeps a same-named but different value from borrowing the path.
+	 *
+	 * @example
+	 * ownership.resolveExportPathByKey("/abs/api/tuning/tuning.mjs", "TUNE_STEP", 5); // ["TUNE_STEP"]
+	 */
+	resolveExportPathByKey(filePath, key, value) {
+		if (typeof filePath !== "string") return null;
+		const found = this.exportIndex.get(filePath)?.keys.get(key);
+		return found && Object.is(found.value, value) ? [...found.exportPath] : null;
+	}
+
+	/**
+	 * Look up the per-key origins recorded for a composed content value (#484).
+	 * @param {string|null} filePath - File the content was built from.
+	 * @param {*} value - The content (or an eager-mode clone of it).
+	 * @returns {Object<string, string[]>|null} Composed key → exportPath, or `null`.
+	 * @public
+	 *
+	 * @example
+	 * ownership.resolveMemberExportPaths(file, content); // { add: ["add"] }
+	 */
+	resolveMemberExportPaths(filePath, value) {
+		return this.#lookupIndexed(filePath, value, "members") ?? null;
+	}
+
+	/**
+	 * Shared lookup for {@link OwnershipManager#resolveExportPath} / {@link OwnershipManager#resolveMemberExportPaths}.
+	 * @param {string|null} filePath - File the value came from.
+	 * @param {*} value - Value to look up; clone links are followed back to the original.
+	 * @param {"values"|"members"} table - Which index table to read.
+	 * @returns {*} The indexed entry, or `undefined`.
+	 * @private
+	 */
+	#lookupIndexed(filePath, value, table) {
+		if (typeof filePath !== "string") return undefined;
+		const entry = this.exportIndex.get(filePath);
+		if (!entry) return undefined;
+		let current = value;
+		const seen = new Set();
+		while (isIndexable(current) && !seen.has(current)) {
+			const found = entry[table].get(current);
+			if (found) return found;
+			seen.add(current);
+			current = this.cloneSources.get(current);
+		}
+		return undefined;
+	}
+
+	/**
+	 * Read where the value currently at `apiPath` came from (#484).
+	 * @param {string} apiPath - API path to look up.
+	 * @returns {{moduleID: string, filePath: (string|null), exportPath: (string[]|null), members: (Object<string, string[]>|null)}|null}
+	 *   The current owner's origin, or `null` when nothing owns the path.
+	 * @public
+	 *
+	 * @description
+	 * `exportPath` is the access path within `filePath`'s module namespace that produced the value;
+	 * `null` when the value has no module origin (a runtime `self.X = value`, a synthetic in-memory
+	 * `api.add()`, a namespace container slothlet created). `members` carries per-key origins for a
+	 * value composed from several exports.
+	 *
+	 * @example
+	 * ownership.getOrigin("math.add"); // { moduleID, filePath: "/abs/api/math.mjs", exportPath: ["add"], members: null }
+	 */
+	getOrigin(apiPath) {
+		const owner = this.getCurrentOwner(apiPath);
+		if (!owner) return null;
+		return {
+			moduleID: owner.moduleID,
+			filePath: owner.filePath ?? null,
+			exportPath: owner.exportPath ? [...owner.exportPath] : null,
+			members: owner.memberExportPaths ?? null
+		};
+	}
+
+	/**
+	 * Refresh the origin recorded for a module's entry at `apiPath` without touching its position,
+	 * source, or collision state — for a wrapper whose impl arrived after it was registered (lazy
+	 * materialization, hot reload).
+	 * @param {string} moduleID - Module whose entry to refresh.
+	 * @param {string} apiPath - API path of the entry.
+	 * @param {{filePath?: (string|null), exportPath?: (string[]|null), memberExportPaths?: (Object|null)}} origin - New origin.
+	 * @returns {void}
+	 * @public
+	 *
+	 * @example
+	 * ownership.refreshOrigin("base", "math.add", { filePath, exportPath: ["add"] });
+	 */
+	refreshOrigin(moduleID, apiPath, origin) {
+		const entry = this.pathToModule.get(apiPath)?.find((candidate) => candidate.moduleID === moduleID);
+		if (!entry || !origin?.exportPath) return;
+		if (origin.filePath) entry.filePath = origin.filePath;
+		entry.exportPath = origin.exportPath;
+		entry.memberExportPaths = origin.memberExportPaths ?? null;
 	}
 
 	/**
@@ -166,10 +501,25 @@ export class OwnershipManager extends ComponentBase {
 	 * @param {string} [options.collisionMode="error"] - Collision mode: skip, warn, error, merge, replace
 	 * @param {Object} [options.config] - Config object for silent mode check
 	 * @param {string} [options.filePath=null] - File path of the module source (for metadata tracking)
+	 * @param {string[]|null} [options.exportPath=null] - Access path within `filePath`'s module namespace
+	 *   that produced `value` (`["add"]`, `["default"]`, `["default", "member"]`); `null` when the value
+	 *   has no module origin (#484).
+	 * @param {Object<string, string[]>|null} [options.memberExportPaths=null] - Per-key exportPaths for a
+	 *   value composed from several exports (#484).
 	 * @returns {Object|null} Registration entry or null if skipped
 	 * @public
 	 */
-	register({ moduleID, apiPath, value, source = "core", collisionMode = "error", config = null, filePath = null }) {
+	register({
+		moduleID,
+		apiPath,
+		value,
+		source = "core",
+		collisionMode = "error",
+		config = null,
+		filePath = null,
+		exportPath = null,
+		memberExportPaths = null
+	}) {
 		// Validate inputs
 		if (!moduleID || typeof moduleID !== "string") {
 			throw new this.SlothletError("OWNERSHIP_INVALID_MODULE_ID", { moduleID }, null, { validationError: true });
@@ -242,6 +592,17 @@ export class OwnershipManager extends ComponentBase {
 			if (value !== undefined) {
 				existingEntry.value = value;
 			}
+			// The origin (#484) is a (filePath, exportPath) pair: a registration from a DIFFERENT file
+			// replaces both together (a stale exportPath must never pair with a new file), while a
+			// same-file registration that carries no exportPath — a value-less namespace/marker touch —
+			// never downgrades one already recorded, exactly like `value` above.
+			if (filePath !== null && filePath !== existingEntry.filePath) {
+				existingEntry.exportPath = exportPath;
+				existingEntry.memberExportPaths = memberExportPaths;
+			} else {
+				if (exportPath !== null) existingEntry.exportPath = exportPath;
+				if (memberExportPaths !== null) existingEntry.memberExportPaths = memberExportPaths;
+			}
 			if (filePath !== null) {
 				existingEntry.filePath = filePath;
 			}
@@ -356,6 +717,8 @@ export class OwnershipManager extends ComponentBase {
 			timestamp: Date.now(),
 			value,
 			filePath,
+			exportPath,
+			memberExportPaths,
 			isMergeLoss
 		};
 
@@ -726,7 +1089,7 @@ export class OwnershipManager extends ComponentBase {
 	/**
 	 * Snapshot the entries moduleID currently owns, keyed by apiPath, for later restoration
 	 * @param {string} moduleID - Module identifier to snapshot.
-	 * @returns {Map<string, {value: *, filePath: (string|null), source: string, isMergeLoss: boolean}>}
+	 * @returns {Map<string, {value: *, filePath: (string|null), exportPath: (string[]|null), memberExportPaths: (Object|null), source: string, isMergeLoss: boolean}>}
 	 *   One entry per apiPath the module currently owns, capturing exactly the fields a duplicate
 	 *   registration can overwrite.
 	 * @public
@@ -749,7 +1112,14 @@ export class OwnershipManager extends ComponentBase {
 			// (reproducing it would require hand-corrupting the internal maps — a tautology, not a test).
 			/* v8 ignore next */
 			if (!entry) continue;
-			snapshot.set(path, { value: entry.value, filePath: entry.filePath, source: entry.source, isMergeLoss: entry.isMergeLoss });
+			snapshot.set(path, {
+				value: entry.value,
+				filePath: entry.filePath,
+				exportPath: entry.exportPath ?? null,
+				memberExportPaths: entry.memberExportPaths ?? null,
+				source: entry.source,
+				isMergeLoss: entry.isMergeLoss
+			});
 		}
 		return snapshot;
 	}
@@ -759,7 +1129,7 @@ export class OwnershipManager extends ComponentBase {
 	 * overwrite without changing its position in the ownership stack
 	 * @param {string} moduleID - Module identifier.
 	 * @param {string} apiPath - API path whose entry to restore.
-	 * @param {{value: *, filePath: (string|null), source: string, isMergeLoss: boolean}} snapshot -
+	 * @param {{value: *, filePath: (string|null), exportPath?: (string[]|null), memberExportPaths?: (Object|null), source: string, isMergeLoss: boolean}} snapshot -
 	 *   Prior field values, from {@link OwnershipManager#snapshotModuleEntries}.
 	 * @returns {void}
 	 * @public
@@ -772,6 +1142,8 @@ export class OwnershipManager extends ComponentBase {
 		if (!entry) return;
 		entry.value = snapshot.value;
 		entry.filePath = snapshot.filePath;
+		entry.exportPath = snapshot.exportPath ?? null;
+		entry.memberExportPaths = snapshot.memberExportPaths ?? null;
 		entry.source = snapshot.source;
 		entry.isMergeLoss = snapshot.isMergeLoss;
 	}
@@ -781,7 +1153,7 @@ export class OwnershipManager extends ComponentBase {
 	 * {@link OwnershipManager#snapshotModuleEntries}, for an internal candidate's own revert.
 	 * @param {string} apiPath - Full api path the candidate is about to (re-)contribute to.
 	 * @param {string} moduleID - Module identifier making the contribution.
-	 * @returns {{value: *, filePath: (string|null), source: string, isMergeLoss: boolean}|undefined}
+	 * @returns {{value: *, filePath: (string|null), exportPath: (string[]|null), memberExportPaths: (Object|null), source: string, isMergeLoss: boolean}|undefined}
 	 *   The prior entry's snapshot, or `undefined` if none exists yet.
 	 * @public
 	 *
@@ -808,7 +1180,14 @@ export class OwnershipManager extends ComponentBase {
 	snapshotPathEntry(apiPath, moduleID) {
 		const entry = this.pathToModule.get(apiPath)?.find((candidate) => candidate.moduleID === moduleID);
 		if (!entry) return undefined;
-		return { value: entry.value, filePath: entry.filePath, source: entry.source, isMergeLoss: entry.isMergeLoss };
+		return {
+			value: entry.value,
+			filePath: entry.filePath,
+			exportPath: entry.exportPath ?? null,
+			memberExportPaths: entry.memberExportPaths ?? null,
+			source: entry.source,
+			isMergeLoss: entry.isMergeLoss
+		};
 	}
 
 	/**
@@ -939,6 +1318,7 @@ export class OwnershipManager extends ComponentBase {
 		this.pathToModule.clear();
 		this._unregisteredModules.clear();
 		this.moduleEndpoints.clear();
+		this.exportIndex.clear();
 	}
 
 	/**
diff --git a/src/lib/handlers/unified-wrapper.mjs b/src/lib/handlers/unified-wrapper.mjs
index bcce9458d..44a96b74d 100644
--- a/src/lib/handlers/unified-wrapper.mjs
+++ b/src/lib/handlers/unified-wrapper.mjs
@@ -909,6 +909,9 @@ export class UnifiedWrapper extends ComponentBase {
 	 * @param {boolean} [options.isCallable=false] - Whether the wrapper should be callable
 	 * @param {boolean} [options.materializeOnCreate=false] - Whether to materialize on creation
 	 * @param {string} [options.filePath=null] - File path of the module source
+	 * @param {string[]|null} [options.exportPath] - Access path within `filePath`'s module namespace
+	 *   that produced `initialImpl` (#484). When omitted it is looked up from the ownership export index
+	 *   by `initialImpl`'s identity; `null` records "no module origin".
 	 * @param {string} [options.moduleID=null] - Module identifier
 	 * @param {string} [options.sourceFolder=null] - Source folder for metadata
 	 * @param {WeakSet<object>|null} [options.__adoptVisited=null] - Internal: one-shot cycle-guard set
@@ -943,6 +946,7 @@ export class UnifiedWrapper extends ComponentBase {
 			isCallable,
 			materializeOnCreate = false,
 			filePath = null,
+			exportPath = undefined,
 			moduleID = null,
 			sourceFolder = null,
 			// One-shot cycle-guard set threaded through the eager child-adoption recursion so a
@@ -979,6 +983,22 @@ export class UnifiedWrapper extends ComponentBase {
 		internal.isCallableLocked = isCallableLocked;
 		internal.moduleID = moduleID;
 		internal.filePath = filePath;
+		// Where initialImpl sits in filePath's module namespace (#484) — resolved before the clone below,
+		// against the value the module actually exported. Read by typegen through the ownership record.
+		// A primitive has no identity to look up; a module leaf built straight from one export (a folder
+		// namespace's per-export wrappers) is found by the export's name — its apiPath's last segment —
+		// confirmed by value.
+		const originIndex = slothlet.handlers?.ownership;
+		const isPrimitiveImpl =
+			initialImpl !== null && initialImpl !== undefined && typeof initialImpl !== "object" && typeof initialImpl !== "function";
+		const ownKey = typeof apiPath === "string" ? apiPath.slice(apiPath.lastIndexOf(".") + 1) : null;
+		internal.exportPath =
+			exportPath !== undefined
+				? exportPath
+				: (originIndex?.resolveExportPath(filePath, initialImpl) ??
+					(isPrimitiveImpl && ownKey ? originIndex?.resolveExportPathByKey(filePath, ownKey, initialImpl) : null) ??
+					null);
+		internal.memberExportPaths = originIndex?.resolveMemberExportPaths(filePath, initialImpl) ?? null;
 		internal.sourceFolder = sourceFolder;
 		// Cycle-guard set for this adopt traversal (see the constructor's __adoptVisited note, #330).
 		internal.adoptVisited = __adoptVisited;
@@ -1072,6 +1092,8 @@ export class UnifiedWrapper extends ComponentBase {
 				source: "initial",
 				moduleID,
 				filePath,
+				exportPath: internal.exportPath,
+				memberExportPaths: internal.memberExportPaths,
 				// sourceFolder is always provided by the caller; the config.dir fallback is never reached.
 				/* v8 ignore next */
 				sourceFolder: sourceFolder || slothlet.config?.dir
@@ -1333,6 +1355,15 @@ export class UnifiedWrapper extends ComponentBase {
 	 * @private
 	 */
 	_applyNewImpl(newImpl, forceReuseChildren = false) {
+		// Refresh the impl's module origin (#484) from the value as exported, before it is cloned. A new
+		// impl that is not a known export of this wrapper's file keeps the origin already recorded.
+		const originIndex = this.slothlet.handlers?.ownership;
+		const newExportPath = originIndex?.resolveExportPath(this.____slothletInternal.filePath, newImpl) ?? null;
+		if (newExportPath) {
+			this.____slothletInternal.exportPath = newExportPath;
+			this.____slothletInternal.memberExportPaths =
+				originIndex.resolveMemberExportPaths(this.____slothletInternal.filePath, newImpl) ?? null;
+		}
 		// Clone to protect API cache from ___adoptImplChildren's delete operations.
 		// See static _cloneImpl() for full rationale.
 		this.____slothletInternal.impl = UnifiedWrapper._cloneImpl(newImpl);
@@ -1415,6 +1446,8 @@ export class UnifiedWrapper extends ComponentBase {
 				source: "hot-reload",
 				moduleID: extractedModuleId,
 				filePath: wrapperMetadata?.filePath,
+				exportPath: this.____slothletInternal.exportPath ?? null,
+				memberExportPaths: this.____slothletInternal.memberExportPaths ?? null,
 				sourceFolder: wrapperMetadata?.sourceFolder
 			});
 		}
@@ -2317,6 +2350,8 @@ export class UnifiedWrapper extends ComponentBase {
 				const descriptors = Object.getOwnPropertyDescriptors(childImpl);
 				childImpl = Object.create(Object.getPrototypeOf(childImpl), descriptors);
 			}
+			// Let an origin lookup against the clone resolve to the exported original (#484).
+			this.slothlet.handlers?.ownership?.noteClone(childImpl, value);
 		}
 
 		// Get parent wrapper's metadata to inherit filePath and moduleID
@@ -2398,6 +2433,33 @@ export class UnifiedWrapper extends ComponentBase {
 
 		const childSourceFolder = childExistingMetadata?.sourceFolder || parentMetadata?.sourceFolder || null;
 
+		// The child's module origin (#484). A child read from the parent's own file is located the same
+		// way the parent was: the parent's composed-key map first (a flattened namespace records where
+		// each key came from), then the child value's identity in that file's export index, then — for a
+		// member of an exported object — the parent's own exportPath extended by the key. A child from a
+		// different file (a folder namespace's per-file children) is located by identity in its own file.
+		// Last, for a child of a namespace that is not itself an export: the export of the child's file
+		// with that name, confirmed by value — the only route for a primitive such a namespace gathered
+		// from one of several files, which has no identity and no recorded per-key map.
+		const parentInternal = this.____slothletInternal;
+		const originIndex = this.slothlet.handlers?.ownership;
+		const sameFileAsParent = Boolean(childFilePath) && childFilePath === parentInternal.filePath;
+		const keyName = typeof key === "symbol" ? null : key;
+		let childExportPath = null;
+		if (childFilePath && keyName !== null) {
+			const recordedMember = sameFileAsParent ? parentInternal.memberExportPaths?.[keyName] : undefined;
+			if (recordedMember) {
+				childExportPath = [...recordedMember];
+			} else if (sameFileAsParent && parentInternal.exportPath) {
+				childExportPath = originIndex?.resolveExportPath(childFilePath, value) ?? [...parentInternal.exportPath, keyName];
+			} else {
+				childExportPath =
+					originIndex?.resolveExportPath(childFilePath, value) ??
+					originIndex?.resolveExportPathByKey(childFilePath, keyName, value) ??
+					null;
+			}
+		}
+
 		// Mark this value as on the descent path while its subtree is built, then unmark — so the
 		// same reference reached again THROUGH this subtree (a cycle) bails, but a sibling reuse does
 		// not. `finally` guarantees the unmark even if construction throws (#330).
@@ -2417,6 +2479,7 @@ export class UnifiedWrapper extends ComponentBase {
 				initialImpl: childImpl,
 				isCallable: typeof childImpl === "function",
 				filePath: childFilePath,
+				exportPath: childExportPath,
 				moduleID: childModuleId,
 				sourceFolder: childSourceFolder,
 				// Thread the cycle-guard set so a cycle spanning this parent → descendant is detected (#330).
diff --git a/src/lib/helpers/modes-utils.mjs b/src/lib/helpers/modes-utils.mjs
index ea11c28dd..8f6aac078 100644
--- a/src/lib/helpers/modes-utils.mjs
+++ b/src/lib/helpers/modes-utils.mjs
@@ -55,11 +55,12 @@ export class ModesUtils extends ComponentBase {
 		if (!value || typeof value !== "object") {
 			return value;
 		}
-		if (Array.isArray(value)) {
-			return value.slice();
-		}
-		const descriptors = Object.getOwnPropertyDescriptors(value);
-		return Object.create(Object.getPrototypeOf(value), descriptors);
+		const clone = Array.isArray(value)
+			? value.slice()
+			: Object.create(Object.getPrototypeOf(value), Object.getOwnPropertyDescriptors(value));
+		// Let an origin lookup against the clone resolve to the exported original (#484).
+		this.slothlet?.handlers?.ownership?.noteClone(clone, value);
+		return clone;
 	}
 
 	/**
diff --git a/src/lib/i18n/languages/de-de.json b/src/lib/i18n/languages/de-de.json
index 929bd3f54..a31caba44 100644
--- a/src/lib/i18n/languages/de-de.json
+++ b/src/lib/i18n/languages/de-de.json
@@ -344,8 +344,6 @@
 		"HINT_TYPESCRIPT_ESBUILD_NOT_INSTALLED": "Installieren Sie es mit: npm install esbuild",
 		"TYPESCRIPT_TSC_NOT_INSTALLED": "Der TypeScript {mode} Modus erfordert die Installation von 'typescript'.",
 		"HINT_TYPESCRIPT_TSC_NOT_INSTALLED": "Installieren Sie es mit: npm install typescript",
-		"TYPESCRIPT_NOT_INSTALLED": "Die Typ-Generierung ({feature}) erfordert die Installation von 'typescript'.",
-		"HINT_TYPESCRIPT_NOT_INSTALLED": "Tipp: Für die Typgenerierung installieren Sie: npm install typescript",
 		"TS_STRICT_REQUIRES_OUTPUT": "Der TypeScript Strict-Modus erfordert die Konfiguration von 'types.output' in Ihrer TypeScript-Konfiguration.",
 		"HINT_TS_STRICT_REQUIRES_OUTPUT": "Fügen Sie 'types: { output: './types/api.d.ts', interfaceName: 'MeineAPI' }' zu Ihrer TypeScript-Konfiguration hinzu.",
 		"TS_STRICT_REQUIRES_INTERFACE_NAME": "Der TypeScript Strict-Modus erfordert die Konfiguration von 'types.interfaceName' in Ihrer TypeScript-Konfiguration.",
diff --git a/src/lib/i18n/languages/en-gb.json b/src/lib/i18n/languages/en-gb.json
index 1c491eefe..9b41963b5 100644
--- a/src/lib/i18n/languages/en-gb.json
+++ b/src/lib/i18n/languages/en-gb.json
@@ -344,8 +344,6 @@
 		"HINT_TYPESCRIPT_ESBUILD_NOT_INSTALLED": "Install it with: npm install esbuild",
 		"TYPESCRIPT_TSC_NOT_INSTALLED": "TypeScript {mode} mode requires 'typescript' to be installed.",
 		"HINT_TYPESCRIPT_TSC_NOT_INSTALLED": "Install it with: npm install typescript",
-		"TYPESCRIPT_NOT_INSTALLED": "Type generation ({feature}) requires 'typescript' to be installed.",
-		"HINT_TYPESCRIPT_NOT_INSTALLED": "Tip: For type generation, install: npm install typescript",
 		"TS_STRICT_REQUIRES_OUTPUT": "TypeScript strict mode requires 'types.output' to be configured in your typescript config.",
 		"HINT_TS_STRICT_REQUIRES_OUTPUT": "Add 'types: { output: './types/api.d.ts', interfaceName: 'MyAPI' }' to your typescript configuration.",
 		"TS_STRICT_REQUIRES_INTERFACE_NAME": "TypeScript strict mode requires 'types.interfaceName' to be configured in your typescript config.",
diff --git a/src/lib/i18n/languages/en-us.json b/src/lib/i18n/languages/en-us.json
index 3abf3df9c..df6823976 100644
--- a/src/lib/i18n/languages/en-us.json
+++ b/src/lib/i18n/languages/en-us.json
@@ -344,8 +344,6 @@
 		"HINT_TYPESCRIPT_ESBUILD_NOT_INSTALLED": "Install it with: npm install esbuild",
 		"TYPESCRIPT_TSC_NOT_INSTALLED": "TypeScript {mode} mode requires 'typescript' to be installed.",
 		"HINT_TYPESCRIPT_TSC_NOT_INSTALLED": "Install it with: npm install typescript",
-		"TYPESCRIPT_NOT_INSTALLED": "Type generation ({feature}) requires 'typescript' to be installed.",
-		"HINT_TYPESCRIPT_NOT_INSTALLED": "Install it with: npm install typescript",
 		"TS_STRICT_REQUIRES_OUTPUT": "TypeScript strict mode requires 'types.output' to be configured in your typescript config.",
 		"HINT_TS_STRICT_REQUIRES_OUTPUT": "Add 'types: { output: './types/api.d.ts', interfaceName: 'MyAPI' }' to your typescript configuration.",
 		"TS_STRICT_REQUIRES_INTERFACE_NAME": "TypeScript strict mode requires 'types.interfaceName' to be configured in your typescript config.",
diff --git a/src/lib/i18n/languages/es-es.json b/src/lib/i18n/languages/es-es.json
index e66ad48e4..471f0f51a 100644
--- a/src/lib/i18n/languages/es-es.json
+++ b/src/lib/i18n/languages/es-es.json
@@ -344,8 +344,6 @@
 		"HINT_TYPESCRIPT_ESBUILD_NOT_INSTALLED": "Instálalo con: npm install esbuild",
 		"TYPESCRIPT_TSC_NOT_INSTALLED": "El modo TypeScript {mode} requiere que 'typescript' esté instalado.",
 		"HINT_TYPESCRIPT_TSC_NOT_INSTALLED": "Instálalo con: npm install typescript",
-		"TYPESCRIPT_NOT_INSTALLED": "La generación de tipos ({feature}) requiere que 'typescript' esté instalado.",
-		"HINT_TYPESCRIPT_NOT_INSTALLED": "Consejo: Para la generación de tipos, instala: npm install typescript",
 		"TS_STRICT_REQUIRES_OUTPUT": "El modo estricto de TypeScript requiere que 'types.output' esté configurado en tu configuración de typescript.",
 		"HINT_TS_STRICT_REQUIRES_OUTPUT": "Añade 'types: { output: './types/api.d.ts', interfaceName: 'MyAPI' }' a tu configuración de typescript.",
 		"TS_STRICT_REQUIRES_INTERFACE_NAME": "El modo estricto de TypeScript requiere que 'types.interfaceName' esté configurado en tu configuración de typescript.",
diff --git a/src/lib/i18n/languages/es-mx.json b/src/lib/i18n/languages/es-mx.json
index ebc73f8e7..3ff6d35ed 100644
--- a/src/lib/i18n/languages/es-mx.json
+++ b/src/lib/i18n/languages/es-mx.json
@@ -344,8 +344,6 @@
 		"HINT_TYPESCRIPT_ESBUILD_NOT_INSTALLED": "Instálelo con: npm install esbuild",
 		"TYPESCRIPT_TSC_NOT_INSTALLED": "El modo TypeScript {mode} requiere que 'typescript' esté instalado.",
 		"HINT_TYPESCRIPT_TSC_NOT_INSTALLED": "Instálelo con: npm install typescript",
-		"TYPESCRIPT_NOT_INSTALLED": "La generación de tipos ({feature}) requiere que 'typescript' esté instalado.",
-		"HINT_TYPESCRIPT_NOT_INSTALLED": "Consejo: Para la generación de tipos, instale: npm install typescript",
 		"TS_STRICT_REQUIRES_OUTPUT": "El modo estricto de TypeScript requiere que 'types.output' esté configurado en su configuración de typescript.",
 		"HINT_TS_STRICT_REQUIRES_OUTPUT": "Añada 'types: { output: './types/api.d.ts', interfaceName: 'MyAPI' }' a su configuración de typescript.",
 		"TS_STRICT_REQUIRES_INTERFACE_NAME": "El modo estricto de TypeScript requiere que 'types.interfaceName' esté configurado en su configuración de typescript.",
diff --git a/src/lib/i18n/languages/fr-fr.json b/src/lib/i18n/languages/fr-fr.json
index 7703c24a9..51c5390f2 100644
--- a/src/lib/i18n/languages/fr-fr.json
+++ b/src/lib/i18n/languages/fr-fr.json
@@ -344,8 +344,6 @@
 		"HINT_TYPESCRIPT_ESBUILD_NOT_INSTALLED": "Installez-le avec : npm install esbuild",
 		"TYPESCRIPT_TSC_NOT_INSTALLED": "Le mode TypeScript {mode} nécessite l'installation de 'typescript'.",
 		"HINT_TYPESCRIPT_TSC_NOT_INSTALLED": "Installez-le avec : npm install typescript",
-		"TYPESCRIPT_NOT_INSTALLED": "La génération de types ({feature}) nécessite l'installation de 'typescript'.",
-		"HINT_TYPESCRIPT_NOT_INSTALLED": "Conseil : pour la génération de types, installez : npm install typescript",
 		"TS_STRICT_REQUIRES_OUTPUT": "Le mode strict de TypeScript nécessite la configuration de 'types.output' dans votre configuration typescript.",
 		"HINT_TS_STRICT_REQUIRES_OUTPUT": "Ajoutez 'types: { output: './types/api.d.ts', interfaceName: 'MonAPI' }' à votre configuration typescript.",
 		"TS_STRICT_REQUIRES_INTERFACE_NAME": "Le mode strict de TypeScript nécessite la configuration de 'types.interfaceName' dans votre configuration typescript.",
diff --git a/src/lib/i18n/languages/hi-in.json b/src/lib/i18n/languages/hi-in.json
index 9767e62cb..e18ff3626 100644
--- a/src/lib/i18n/languages/hi-in.json
+++ b/src/lib/i18n/languages/hi-in.json
@@ -344,8 +344,6 @@
 		"HINT_TYPESCRIPT_ESBUILD_NOT_INSTALLED": "इसे इसके साथ स्थापित करें: npm install esbuild",
 		"TYPESCRIPT_TSC_NOT_INSTALLED": "TypeScript {mode} मोड के लिए 'typescript' स्थापित होना आवश्यक है।",
 		"HINT_TYPESCRIPT_TSC_NOT_INSTALLED": "इसे इसके साथ स्थापित करें: npm install typescript",
-		"TYPESCRIPT_NOT_INSTALLED": "प्रकार पीढ़ी ({feature}) के लिए 'typescript' स्थापित होना आवश्यक है।",
-		"HINT_TYPESCRIPT_NOT_INSTALLED": "टिप: प्रकार पीढ़ी के लिए इंस्टॉल करें: npm install typescript",
 		"TS_STRICT_REQUIRES_OUTPUT": "TypeScript strict मोड के लिए आपके typescript कॉन्फ़िगरेशन में 'types.output' कॉन्फ़िगर होना आवश्यक है।",
 		"HINT_TS_STRICT_REQUIRES_OUTPUT": "अपने typescript कॉन्फ़िगरेशन में 'types: { output: './types/api.d.ts', interfaceName: 'MyAPI' }' जोड़ें।",
 		"TS_STRICT_REQUIRES_INTERFACE_NAME": "TypeScript strict मोड के लिए आपके typescript कॉन्फ़िगरेशन में 'types.interfaceName' कॉन्फ़िगर होना आवश्यक है।",
diff --git a/src/lib/i18n/languages/ja-jp.json b/src/lib/i18n/languages/ja-jp.json
index 31180ee05..6c4ef3529 100644
--- a/src/lib/i18n/languages/ja-jp.json
+++ b/src/lib/i18n/languages/ja-jp.json
@@ -344,8 +344,6 @@
 		"HINT_TYPESCRIPT_ESBUILD_NOT_INSTALLED": "インストール方法: npm install esbuild",
 		"TYPESCRIPT_TSC_NOT_INSTALLED": "TypeScript の {mode} モードには 'typescript' のインストールが必要です。",
 		"HINT_TYPESCRIPT_TSC_NOT_INSTALLED": "インストール方法: npm install typescript",
-		"TYPESCRIPT_NOT_INSTALLED": "型生成 ({feature}) には 'typescript' のインストールが必要です。",
-		"HINT_TYPESCRIPT_NOT_INSTALLED": "ヒント: 型生成のために次をインストールしてください: npm install typescript",
 		"TS_STRICT_REQUIRES_OUTPUT": "TypeScript の strict モードでは、構成の typescript セクションで 'types.output' を設定する必要があります。",
 		"HINT_TS_STRICT_REQUIRES_OUTPUT": "typescript 構成に 'types: { output: './types/api.d.ts', interfaceName: 'MyAPI' }' を追加してください。",
 		"TS_STRICT_REQUIRES_INTERFACE_NAME": "TypeScript の strict モードでは、構成の typescript セクションで 'types.interfaceName' を設定する必要があります。",
diff --git a/src/lib/i18n/languages/ko-kr.json b/src/lib/i18n/languages/ko-kr.json
index 2c03edd90..ae635bf6c 100644
--- a/src/lib/i18n/languages/ko-kr.json
+++ b/src/lib/i18n/languages/ko-kr.json
@@ -344,8 +344,6 @@
 		"HINT_TYPESCRIPT_ESBUILD_NOT_INSTALLED": "설치 명령: npm install esbuild",
 		"TYPESCRIPT_TSC_NOT_INSTALLED": "TypeScript {mode} 모드에는 'typescript' 설치가 필요합니다.",
 		"HINT_TYPESCRIPT_TSC_NOT_INSTALLED": "설치 명령: npm install typescript",
-		"TYPESCRIPT_NOT_INSTALLED": "타입 생성({feature})에는 'typescript' 설치가 필요합니다.",
-		"HINT_TYPESCRIPT_NOT_INSTALLED": "힌트: 타입 생성용으로 다음을 설치하십시오: npm install typescript",
 		"TS_STRICT_REQUIRES_OUTPUT": "TypeScript 엄격(strict) 모드에는 typescript 설정에 'types.output' 설정이 필요합니다.",
 		"HINT_TS_STRICT_REQUIRES_OUTPUT": "typescript 설정에 'types: { output: './types/api.d.ts', interfaceName: 'MyAPI' }'를 추가하십시오.",
 		"TS_STRICT_REQUIRES_INTERFACE_NAME": "TypeScript 엄격 모드에는 typescript 설정에 'types.interfaceName' 설정이 필요합니다.",
diff --git a/src/lib/i18n/languages/pt-br.json b/src/lib/i18n/languages/pt-br.json
index 9589f562c..2f3debc41 100644
--- a/src/lib/i18n/languages/pt-br.json
+++ b/src/lib/i18n/languages/pt-br.json
@@ -344,8 +344,6 @@
 		"HINT_TYPESCRIPT_ESBUILD_NOT_INSTALLED": "Instale-o com: npm install esbuild",
 		"TYPESCRIPT_TSC_NOT_INSTALLED": "O modo TypeScript {mode} requer que o 'typescript' esteja instalado.",
 		"HINT_TYPESCRIPT_TSC_NOT_INSTALLED": "Instale-o com: npm install typescript",
-		"TYPESCRIPT_NOT_INSTALLED": "A geração de tipos ({feature}) requer que o 'typescript' esteja instalado.",
-		"HINT_TYPESCRIPT_NOT_INSTALLED": "Dica: para gerar tipos, instale: npm install typescript",
 		"TS_STRICT_REQUIRES_OUTPUT": "O modo estrito do TypeScript requer que 'types.output' seja configurado em sua configuração typescript.",
 		"HINT_TS_STRICT_REQUIRES_OUTPUT": "Adicione 'types: { output: './types/api.d.ts', interfaceName: 'MyAPI' }' à sua configuração typescript.",
 		"TS_STRICT_REQUIRES_INTERFACE_NAME": "O modo estrito do TypeScript requer que 'types.interfaceName' seja configurado em sua configuração typescript.",
diff --git a/src/lib/i18n/languages/ru-ru.json b/src/lib/i18n/languages/ru-ru.json
index e61d7ecbb..6db47c2fd 100644
--- a/src/lib/i18n/languages/ru-ru.json
+++ b/src/lib/i18n/languages/ru-ru.json
@@ -344,8 +344,6 @@
 		"HINT_TYPESCRIPT_ESBUILD_NOT_INSTALLED": "Установите: npm install esbuild",
 		"TYPESCRIPT_TSC_NOT_INSTALLED": "Для режима TypeScript {mode} требуется 'typescript'.",
 		"HINT_TYPESCRIPT_TSC_NOT_INSTALLED": "Установите: npm install typescript",
-		"TYPESCRIPT_NOT_INSTALLED": "Генерация типов ({feature}) требует 'typescript'.",
-		"HINT_TYPESCRIPT_NOT_INSTALLED": "Подсказка: для генерации типов установите: npm install typescript",
 		"TS_STRICT_REQUIRES_OUTPUT": "Режим TS strict требует настройки 'types.output' в конфигурации.",
 		"HINT_TS_STRICT_REQUIRES_OUTPUT": "Добавьте 'types: { output: './types/api.d.ts', interfaceName: 'MyAPI' }'.",
 		"TS_STRICT_REQUIRES_INTERFACE_NAME": "TS strict требует 'types.interfaceName'.",
diff --git a/src/lib/i18n/languages/zh-cn.json b/src/lib/i18n/languages/zh-cn.json
index 48190e840..aecb9d3e5 100644
--- a/src/lib/i18n/languages/zh-cn.json
+++ b/src/lib/i18n/languages/zh-cn.json
@@ -344,8 +344,6 @@
 		"HINT_TYPESCRIPT_ESBUILD_NOT_INSTALLED": "请安装：npm install esbuild",
 		"TYPESCRIPT_TSC_NOT_INSTALLED": "TypeScript {mode} 模式需要安装 'typescript'。",
 		"HINT_TYPESCRIPT_TSC_NOT_INSTALLED": "请安装：npm install typescript",
-		"TYPESCRIPT_NOT_INSTALLED": "类型生成（{feature}）需要安装 'typescript'。",
-		"HINT_TYPESCRIPT_NOT_INSTALLED": "提示：要生成类型，请安装：npm install typescript",
 		"TS_STRICT_REQUIRES_OUTPUT": "TypeScript 严格模式要求在您的 TypeScript 配置中配置 'types.output'。",
 		"HINT_TS_STRICT_REQUIRES_OUTPUT": "在您的 TypeScript 配置中添加 'types: { output: './types/api.d.ts', interfaceName: 'MyAPI' }'。",
 		"TS_STRICT_REQUIRES_INTERFACE_NAME": "TypeScript 严格模式要求在您的 TypeScript 配置中配置 'types.interfaceName'。",
diff --git a/src/lib/processors/flatten.mjs b/src/lib/processors/flatten.mjs
index bdb8fda38..1f7f5ac04 100644
--- a/src/lib/processors/flatten.mjs
+++ b/src/lib/processors/flatten.mjs
@@ -243,7 +243,12 @@ export class Flatten extends ComponentBase {
 	 * @param {string|null} [options.collisionModeOverride=null] - Caller's per-call override (e.g.
 	 *   `api.add({ forceOverwrite: true })`), preferred over `collisionContext`'s config default for
 	 *   the function-default-vs-named-export merge decision below.
-	 * @returns {{ moduleContent: object|Function }} Built module content ready for wrapping/assignment.
+	 * @returns {{ moduleContent: object|Function, origins: {self: (string[]|null), members: Object<string, string[]>} }}
+	 *   Built module content ready for wrapping/assignment, plus where it came from (#484): `self` is the
+	 *   content's own exportPath when it IS one export (`["default"]`, `["add"]`), `null` when it is a
+	 *   fresh object composed here; `members` maps each key this step placed onto the content to the
+	 *   exportPath it was read from. Keys the content already carried (a default object's own members)
+	 *   are not listed — they are located under `self`.
 	 * @public
 	 */
 	processModuleForAPI(options) {
@@ -270,40 +275,54 @@ export class Flatten extends ComponentBase {
 			(file && file.fullName && ["addapi.mjs", "addapi.cjs", "addapi.js", "addapi.ts"].includes(file.fullName.toLowerCase()));
 		if (isAddapiFile && analysis.hasDefault && moduleKeys.length > 0) {
 			const moduleContent = mod.default;
+			const members = {};
 			for (const key of moduleKeys) {
 				moduleContent[key] = mod[key];
+				members[key] = [key];
 			}
-			return { moduleContent };
+			return { moduleContent, origins: { self: ["default"], members } };
 		}
 
 		// Rule 7 (F02, F03) - C08: Auto-flattening (single named export matching module name)
 		if (decision.useAutoFlattening) {
-			return { moduleContent: mod[moduleName] };
+			return { moduleContent: mod[moduleName], origins: { self: [moduleName], members: {} } };
 		}
 
 		// Rule 1 (F01) - C09: Flatten to root/category — merge all exports into one flat content object for caller to assign
 		if (decision.flattenToRoot || decision.flattenToCategory) {
 			if (mod.default && moduleKeys.length === 0) {
-				return { moduleContent: mod.default };
+				return { moduleContent: mod.default, origins: { self: ["default"], members: {} } };
 			}
 			if (mod.default && moduleKeys.length > 0) {
-				const moduleContent = typeof mod.default === "function" ? mod.default : { ...mod.default };
+				const isFunctionDefault = typeof mod.default === "function";
+				const moduleContent = isFunctionDefault ? mod.default : { ...mod.default };
+				const members = {};
+				if (!isFunctionDefault) {
+					// The spread copied the default object's own members onto a fresh object.
+					for (const key of Object.keys(mod.default)) members[key] = ["default", key];
+				}
 				for (const key of moduleKeys) {
 					moduleContent[key] = mod[key];
+					members[key] = [key];
 				}
-				return { moduleContent };
+				return { moduleContent, origins: { self: isFunctionDefault ? ["default"] : null, members } };
 			}
 			// Only named exports: expose each directly (caller merges to parent)
 			const moduleContent = {};
+			const members = {};
 			for (const key of moduleKeys) {
 				moduleContent[key] = mod[key];
+				members[key] = [key];
 			}
-			return { moduleContent };
+			return { moduleContent, origins: { self: null, members } };
 		}
 
 		// Rule 6 - C09a: Self-referential non-function — use the named export that is itself (or full mod)
 		if (isSelfReferential) {
-			return { moduleContent: mod[moduleName] || mod };
+			if (mod[moduleName]) return { moduleContent: mod[moduleName], origins: { self: [moduleName], members: {} } };
+			const members = {};
+			for (const key of Object.keys(mod)) members[key] = [key];
+			return { moduleContent: mod, origins: { self: null, members } };
 		}
 
 		// Hybrid pattern: default + named exports
@@ -311,6 +330,7 @@ export class Flatten extends ComponentBase {
 			if (typeof mod.default === "function") {
 				// Default is a function: attach named exports as properties (e.g. logger(), logger.info())
 				const moduleContent = this.slothlet.helpers.modesUtils.ensureNamedExportFunction(mod.default, propertyName);
+				const members = {};
 				const collisionConfig = this.slothlet.config.api?.collision || this.slothlet.config.collision;
 				// Per-call override (e.g. api.add({ forceOverwrite: true })) takes priority over the
 				// config default, matching every other collision decision in this same build
@@ -344,13 +364,15 @@ export class Flatten extends ComponentBase {
 						// collisionMode "replace" / "merge-replace" — fall through to assignment
 					}
 					moduleContent[key] = mod[key];
+					members[key] = [key];
 				}
-				return { moduleContent };
+				return { moduleContent, origins: { self: ["default"], members } };
 			}
 			if (typeof mod.default === "object" && mod.default !== null) {
 				// Default is an object: use it directly and merge named exports. Same-name conflicts
 				// are resolved by collisionMode, consistent with the function-default branch above (#421).
 				const moduleContent = mod.default;
+				const members = {};
 				const collisionConfig = this.slothlet.config.api?.collision || this.slothlet.config.collision;
 				const collisionMode = collisionModeOverride || (collisionContext === "initial" ? collisionConfig.initial : collisionConfig.api);
 				for (const key of moduleKeys) {
@@ -381,28 +403,36 @@ export class Flatten extends ComponentBase {
 						// collisionMode "replace" / "merge-replace" — fall through to assignment
 					}
 					moduleContent[key] = mod[key];
+					members[key] = [key];
 				}
-				return { moduleContent };
+				return { moduleContent, origins: { self: ["default"], members } };
 			}
 			// Default is a primitive: wrap in a namespace object
 			const moduleContent = { default: mod.default };
+			const members = { default: ["default"] };
 			for (const key of moduleKeys) {
 				moduleContent[key] = mod[key];
+				members[key] = [key];
 			}
-			return { moduleContent };
+			return { moduleContent, origins: { self: null, members } };
 		}
 
 		// Rule 1 (F01), Rule 2 - C09b: Traditional namespace preservation — only default export, use it directly
 		if (mod.default && moduleKeys.length === 0) {
-			return { moduleContent: this.slothlet.helpers.modesUtils.ensureNamedExportFunction(mod.default, propertyName) };
+			return {
+				moduleContent: this.slothlet.helpers.modesUtils.ensureNamedExportFunction(mod.default, propertyName),
+				origins: { self: ["default"], members: {} }
+			};
 		}
 
 		// Fallback: named-only exports (no default — all truthy-default paths return above)
 		const moduleContent = {};
+		const members = {};
 		for (const key of moduleKeys) {
 			moduleContent[key] = mod[key];
+			members[key] = [key];
 		}
-		return { moduleContent };
+		return { moduleContent, origins: { self: null, members } };
 	}
 
 	/**
diff --git a/src/lib/processors/type-generator.mjs b/src/lib/processors/type-generator.mjs
index 675a9bd65..a9c0598de 100644
--- a/src/lib/processors/type-generator.mjs
+++ b/src/lib/processors/type-generator.mjs
@@ -20,43 +20,45 @@
 import fs from "fs";
 import path from "path";
 import { SlothletError } from "@cldmv/slothlet/errors";
+import { resolveWrapper } from "#handlers/unified-wrapper";
 
-let typescriptInstance = null;
+/**
+ * Root keys the framework owns: typed by `SlothletAPI` (extended below), never by the generated interface.
+ * @type {Set<string>}
+ * @private
+ */
+const FRAMEWORK_ROOT_KEYS = new Set(["slothlet", "shutdown", "destroy"]);
 
 /**
- * Lazy-load TypeScript compiler to avoid requiring installation when not using type generation
- * @returns {Promise<object>} typescript module
- * @throws {SlothletError} TYPESCRIPT_NOT_INSTALLED if typescript is not installed
+ * Identifier test for an unquoted interface member name.
+ * @type {RegExp}
  * @private
  */
-async function getTypeScript() {
-	if (!typescriptInstance) {
-		try {
-			typescriptInstance = await import("typescript");
-			// unreachable via tests: typescript is a devDependency always present during testing.
-			// The catch only fires in end-user environments where typescript is not installed.
-			/* v8 ignore start */
-		} catch (error) {
-			throw new SlothletError("TYPESCRIPT_NOT_INSTALLED", { feature: "type-generation" }, error);
-		}
-		/* v8 ignore stop */
-	}
-	return typescriptInstance;
-}
+const IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
 
 /**
  * Generate TypeScript declaration file for a Slothlet API
- * @param {object} api - The loaded Slothlet API
+ * @param {object} api - The loaded Slothlet API (a live, composed instance)
  * @param {object} options - Generation options
  * @param {string} options.output - Output file path for .d.ts
  * @param {string} options.interfaceName - Name of the interface to generate
- * @param {boolean} [options.includeDocumentation=true] - Include JSDoc comments
+ * @param {boolean} [options.includeDocumentation=true] - Include the per-member comments that explain an
+ *   `unknown` member (a member with no module origin). Accepted for compatibility; the explanation is
+ *   always emitted, since an unexplained `unknown` is a worse surprise than one extra comment line.
+ * @param {boolean} [options.augmentRuntime=true] - Extend `SlothletSelf` from `@cldmv/slothlet/runtime`
+ *   with the generated interface, so an imported `self` is typed as the api. Turn it off when several
+ *   generated interfaces live in one TypeScript program and only one of them should type `self`.
  * @returns {Promise<{output: string, filePath: string}>} Generated declaration and output path
  * @public
+ *
+ * @description
+ * Every member references the export slothlet actually placed there — `typeof import("<leaf>")["k"]` —
+ * read from the ownership records' module origin (#484), so the declaration carries each leaf's own
+ * type (JSDoc, TypeScript, CommonJS alike) instead of a signature guessed from its file's syntax. A
+ * namespace becomes a nested object of its members; a callable namespace intersects its function's
+ * type with the members merged onto it; a member with no module origin is `unknown`, with a comment.
  */
 export async function generateTypes(api, options) {
-	const ts = await getTypeScript();
-
 	if (!options.output) {
 		throw new SlothletError("INVALID_CONFIG", {
 			option: "types.output",
@@ -77,30 +79,19 @@ export async function generateTypes(api, options) {
 		});
 	}
 
-	// Traverse the API and extract structure
-	const nodes = traverseAPI(api);
-
-	// Extract type information from the backing source files. A single TypeScript Program over every
-	// file gives a real type checker, so JSDoc `@param {T}` / `@returns {T}` — including `@param
-	// {object} o` with dotted `o.prop` shapes, optional params, unions, and generics — resolve to
-	// proper, valid TypeScript the way the type checker reads JSDoc annotations, rather than the
-	// raw-text guesswork a bare `createSourceFile` parse produced. (Types are read, not checked —
-	// the Program runs with `checkJs: false`; it reflects JSDoc, it does not type-check the sources.) (#213)
-	const filePaths = [...new Set(nodes.map((node) => node.metadata?.filePath).filter(Boolean))];
-	const { byFile: exportsByFile, localTypes } = extractTypeInfo(filePaths, ts);
-	for (const node of nodes) {
-		if (node.metadata?.filePath) {
-			node.typeInfo = exportsByFile.get(node.metadata.filePath);
-		}
-	}
-
-	// Generate declaration content
-	const declaration = generateDeclaration(nodes, options, localTypes);
-
-	// Write to file
 	const outputPath = path.resolve(options.output);
 	const outputDir = path.dirname(outputPath);
 
+	const context = {
+		ownership: findOwnership(api),
+		routineNames: findRoutineNames(api),
+		outputDir
+	};
+
+	// Describe the api, then render it.
+	const members = describeMembers(api, "", context, new Set());
+	const declaration = generateDeclaration(members, options);
+
 	// Ensure the output directory exists. mkdir with recursive:true is idempotent
 	// and never throws when the directory already exists, so no existsSync pre-check
 	// is needed (avoids a TOCTOU window / CWE-367).
@@ -115,211 +106,223 @@ export async function generateTypes(api, options) {
 }
 
 /**
- * Traverse API structure and collect nodes
- * @param {object} api - The API to traverse
- * @param {string[]} [currentPath=[]] - Current path in traversal
- * @param {Set} [visited=new Set()] - Visited objects to prevent cycles
- * @returns {object[]} Array of API nodes
+ * Find the ownership records behind a composed api by resolving any of its wrapper-backed members.
+ * @param {*} api - The composed api.
+ * @returns {object|null} The instance's `OwnershipManager`, or `null` for a value slothlet did not compose.
  * @private
  */
-function traverseAPI(api, currentPath = [], visited = new Set()) {
-	const nodes = [];
+function findOwnership(api) {
+	const inner = findInstance(api);
+	return inner?.handlers?.ownership ?? null;
+}
 
-	if (!api || typeof api !== "object") {
-		return nodes;
+/**
+ * Find the Slothlet instance behind a composed api (through the first wrapper-backed member).
+ * @param {*} api - The composed api.
+ * @returns {object|null} The instance, or `null`.
+ * @private
+ */
+function findInstance(api) {
+	if (!api || (typeof api !== "object" && typeof api !== "function")) return null;
+	for (const key of Object.keys(api)) {
+		if (FRAMEWORK_ROOT_KEYS.has(key)) continue;
+		const wrapper = resolveWrapper(api[key]);
+		if (wrapper?.slothlet) return wrapper.slothlet;
 	}
+	return null;
+}
 
-	// Prevent infinite loops from circular references
-	if (visited.has(api)) {
-		return nodes;
-	}
-	visited.add(api);
+/**
+ * The instance's configured routine names — their root slots hold the framework's routine cascade.
+ * @param {*} api - The composed api.
+ * @returns {Set<string>} Routine names (empty when unknown).
+ * @private
+ */
+function findRoutineNames(api) {
+	const routines = findInstance(api)?.config?.routines;
+	return new Set(Array.isArray(routines) ? routines.map((routine) => routine?.name).filter(Boolean) : []);
+}
 
-	for (const [key, value] of Object.entries(api)) {
-		// Skip internal properties and Slothlet system properties
-		if (key.startsWith("_") || key.startsWith("__") || key === "slothlet" || key === "shutdown" || key === "destroy") {
-			continue;
+/**
+ * Describe the members of one api level.
+ * @param {*} value - The level (the root api, or a namespace).
+ * @param {string} apiPath - Dotted path of `value` ("" at the root).
+ * @param {object} context - Shared generation state (`ownership`, `routineNames`, `outputDir`).
+ * @param {Set<*>} ancestors - Values on the current descent path (cycle guard).
+ * @returns {Array<{key: string, type: string, comment: (string|null)}>} One entry per member.
+ * @private
+ */
+function describeMembers(value, apiPath, context, ancestors) {
+	if (!value || (typeof value !== "object" && typeof value !== "function")) {
+		return [];
+	}
+	if (ancestors.has(value)) return [];
+	ancestors.add(value);
+	try {
+		const members = [];
+		for (const key of Object.keys(value)) {
+			// Skip internal properties and the framework's own root surface (typed by SlothletAPI).
+			if (key.startsWith("_") || (apiPath === "" && FRAMEWORK_ROOT_KEYS.has(key))) {
+				continue;
+			}
+			const childPath = apiPath ? `${apiPath}.${key}` : key;
+			members.push({ key, ...describeNode(value[key], childPath, context, ancestors) });
 		}
+		return members;
+	} finally {
+		ancestors.delete(value);
+	}
+}
 
-		const nodePath = [...currentPath, key];
-		const metadata = value?.__metadata;
-
-		if (typeof value === "function") {
-			nodes.push({
-				type: "function",
-				path: nodePath,
-				value,
-				metadata
-			});
-		} else if (typeof value === "object" && value !== null) {
-			nodes.push({
-				type: "object",
-				path: nodePath,
-				value,
-				metadata
-			});
-
-			// Recursively traverse nested objects
-			const childNodes = traverseAPI(value, nodePath, visited);
-			nodes.push(...childNodes);
+/**
+ * Describe one api node as a TypeScript type expression.
+ * @param {*} value - The node's live value.
+ * @param {string} apiPath - Dotted api path of the node.
+ * @param {object} context - Shared generation state.
+ * @param {Set<*>} ancestors - Cycle guard.
+ * @returns {{type: string, comment: (string|null)}} The type, plus a comment when it needs one.
+ * @private
+ */
+function describeNode(value, apiPath, context, ancestors) {
+	const origin = context.ownership?.getOrigin(apiPath) ?? null;
+	const base = originType(origin, context);
+	const isComposite = (typeof value === "object" && value !== null) || typeof value === "function";
+
+	if (!base) {
+		// The root slot of a configured routine holds the framework's routine cascade: it forwards its
+		// arguments to every contribution and resolves to their result(s).
+		if (apiPath.indexOf(".") === -1 && typeof value === "function" && context.routineNames.has(apiPath)) {
+			return { type: "(...args: unknown[]) => Promise<unknown>", comment: `Routine cascade: runs every \`${apiPath}\` contribution.` };
 		}
+		const children = isComposite ? describeMembers(value, apiPath, context, ancestors) : [];
+		if (children.length > 0) {
+			const comment = typeof value === "function" ? "Callable with no module origin: only its members are typed." : null;
+			return { type: renderObject(children, 1), comment };
+		}
+		return { type: "unknown", comment: noOriginReason(origin) };
 	}
 
-	return nodes;
+	// A member the base type already describes (it is that export's own property) is not repeated;
+	// the rest — members merged onto an export from elsewhere — are added to it.
+	const children = isComposite ? describeMembers(value, apiPath, context, ancestors) : [];
+	const extra = children.filter((child) => !isCoveredBy(origin, context.ownership.getOrigin(`${apiPath}.${child.key}`)));
+	if (extra.length === 0) {
+		return { type: base, comment: null };
+	}
+	if (typeof value === "function") {
+		return { type: `${base} & ${renderObject(extra, 1)}`, comment: null };
+	}
+	// A plain object export whose members were partly replaced or extended: drop the replaced keys from
+	// the export's type so the placed values win, rather than intersecting two conflicting types.
+	const omitted = extra.map((child) => JSON.stringify(child.key)).join(" | ");
+	return { type: `Omit<${base}, ${omitted}> & ${renderObject(extra, 1)}`, comment: null };
 }
 
 /**
- * Extract exported-function type info for a set of source files using a single TypeScript Program, so
- * the type checker resolves JSDoc types the way `tsc` reads JSDoc annotations. Returns a Map of
- * `filePath → { exports: [{ name, type, signature }] }`; a file that cannot be parsed contributes an
- * empty export list rather than failing the whole run.
- *
- * @param {string[]} filePaths - Absolute source-file paths backing the API nodes.
- * @param {object} ts - TypeScript compiler instance.
- * @returns {{byFile: Map<string, {exports: object[]}>, localTypes: Map<string, string>}} Per-file
- *   extracted export signatures, plus the referenced local named-type declarations to emit.
+ * Whether a child's origin is exactly the parent export's own property of the same name.
+ * @param {object} parentOrigin - The parent node's origin (with an exportPath).
+ * @param {object|null} childOrigin - The child's origin.
+ * @returns {boolean} True when the parent's type already describes the child.
  * @private
  */
-function extractTypeInfo(filePaths, ts) {
-	const byFile = new Map();
-	const program = ts.createProgram(filePaths, {
-		allowJs: true,
-		checkJs: false,
-		// Enable declaration emit so TypeScript's OWN emitter can produce the referenced local type
-		// declarations below — the faithful source for their exact ambient form (`declare enum`, filled
-		// enum initializers, kept/stripped `export`) that a raw source-text paste gets wrong. Emit is
-		// captured in memory via a custom writer; nothing is written to disk.
-		declaration: true,
-		emitDeclarationOnly: true,
-		skipLibCheck: true,
-		target: ts.ScriptTarget.Latest,
-		module: ts.ModuleKind.ESNext,
-		moduleResolution: ts.ModuleResolutionKind.Bundler
-	});
-	const checker = program.getTypeChecker();
-	const isExported = (node) => node.modifiers?.some((m) => m.kind === ts.SyntaxKind.ExportKeyword);
-
-	// Catalog every local named type (interface / type alias / enum) by reading TypeScript's own
-	// declaration-emit output — so each carries exactly the form `tsc` would write. A `.ts` leaf can
-	// reference such a type in a signature, and the checker prints it by name; that name must be
-	// emitted into the generated declaration or it resolves to nothing and the .d.ts fails to compile.
-	// Keyed by name; a same-name type from a later file overwrites (a rare cross-file clash, documented).
-	const candidates = new Map();
-	program.emit(
-		undefined,
-		(____fileName, text) => {
-			const dts = ts.createSourceFile("emitted.d.ts", text, ts.ScriptTarget.Latest, false, ts.ScriptKind.TS);
-			for (const stmt of dts.statements) {
-				// Interface / type-alias / enum declarations always carry a name.
-				if (ts.isInterfaceDeclaration(stmt) || ts.isTypeAliasDeclaration(stmt) || ts.isEnumDeclaration(stmt)) {
-					candidates.set(stmt.name.text, stmt.getText(dts));
-				}
-			}
-		},
-		undefined,
-		true
-	);
+function isCoveredBy(parentOrigin, childOrigin) {
+	if (!childOrigin?.exportPath || childOrigin.filePath !== parentOrigin.filePath) return false;
+	const parentPath = parentOrigin.exportPath;
+	const childPath = childOrigin.exportPath;
+	return childPath.length === parentPath.length + 1 && parentPath.every((segment, index) => segment === childPath[index]);
+}
 
-	for (const filePath of filePaths) {
-		const exportsForFile = [];
-		try {
-			const visit = (node) => {
-				// export function foo(...) { ... }
-				if (ts.isFunctionDeclaration(node) && node.name && isExported(node)) {
-					exportsForFile.push({ name: node.name.text, type: "function", signature: signatureText(node, checker, ts) });
-					// export const foo = (...) => ... | function (...) { ... }
-				} else if (ts.isVariableStatement(node) && isExported(node)) {
-					for (const decl of node.declarationList.declarations) {
-						const init = decl.initializer;
-						if (ts.isIdentifier(decl.name) && init && (ts.isArrowFunction(init) || ts.isFunctionExpression(init))) {
-							exportsForFile.push({ name: decl.name.text, type: "function", signature: signatureText(init, checker, ts) });
-						}
-					}
-				}
-				ts.forEachChild(node, visit);
-			};
-			// getSourceFile can return undefined (path unreadable or not included as a source file).
-			// Skip it explicitly so a missing file is a no-op, not a swallowed visit(undefined) throw.
-			const sourceFile = program.getSourceFile(filePath);
-			if (sourceFile) {
-				visit(sourceFile);
-			}
-		} catch (____error) {
-			// Unparseable / unresolvable file — contribute no signatures rather than fail the run.
-		}
-		byFile.set(filePath, { exports: exportsForFile });
+/**
+ * Explain why a node is typed `unknown`.
+ * @param {object|null} origin - The node's ownership origin, if any.
+ * @returns {string} The explanation.
+ * @private
+ */
+function noOriginReason(origin) {
+	if (!origin) {
+		return "No module origin: slothlet holds no ownership record for this member.";
 	}
-
-	const localTypes = collectReferencedLocalTypes(candidates, byFile);
-	return { byFile, localTypes };
+	return "No module origin: not an export of a module file (a runtime assignment, in-memory api.add() exports, or a slothlet-created value).";
 }
 
 /**
- * Compute the transitive set of local named-type declarations the generated signatures reference, so
- * they can be emitted alongside the interface and the declaration compiles standalone. A type is
- * referenced when its name appears (whole-word) in any signature, or in the declaration text of an
- * already-referenced type. Matching is purely lexical over the finite set of local type names —
- * never a type-graph walk, which recursive generics could instantiate without bound — so the closure
- * always terminates; over-inclusion would only add an unused-but-valid declaration.
- *
- * @param {Map<string, string>} candidates - Every local named type: name → its declaration text.
- * @param {Map<string, {exports: object[]}>} byFile - Per-file extracted signatures.
- * @returns {Map<string, string>} Referenced local types (name → declaration text), dependency-closed.
+ * The `typeof import(...)` type of a node's originating export.
+ * @param {object|null} origin - Ownership origin (`filePath` + `exportPath`).
+ * @param {object} context - Shared generation state (`outputDir`, `ownership`).
+ * @returns {string|null} The type expression, or `null` when the node has no module origin.
  * @private
  */
-function collectReferencedLocalTypes(candidates, byFile) {
-	const referenced = new Map();
-	if (candidates.size === 0) return referenced;
-
-	const wholeWord = (name) => new RegExp(`\\b${name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`);
-	const signatureBlob = [];
-	for (const { exports } of byFile.values()) {
-		for (const e of exports) signatureBlob.push(e.signature);
+function originType(origin, context) {
+	if (!origin?.exportPath || !origin.filePath) return null;
+	let segments = origin.exportPath;
+	// A CommonJS module's exports ARE `module.exports`; the loader exposes that object as `default`, but
+	// TypeScript types `import("x.cjs")` itself as `module.exports` (its `["default"]` is not the same
+	// type under NodeNext or Bundler), so the leading `default` segment is dropped.
+	if (segments[0] === "default" && context.ownership.isCommonJSModule(origin.filePath)) {
+		segments = segments.slice(1);
 	}
-	const haystack = signatureBlob.join("\n");
+	const access = segments.map((segment) => `[${JSON.stringify(segment)}]`).join("");
+	return `typeof import(${JSON.stringify(importSpecifier(origin.filePath, context.outputDir))})${access}`;
+}
 
-	const consider = (name) => {
-		if (referenced.has(name)) return;
-		const text = candidates.get(name);
-		referenced.set(name, text);
-		// Pull in any other local type this declaration itself references (transitive closure).
-		for (const other of candidates.keys()) {
-			if (wholeWord(other).test(text)) consider(other);
-		}
-	};
+/**
+ * A relative import specifier from the generated file's directory to a leaf file, with the extension a
+ * TypeScript import names at runtime (`.ts`→`.js`, `.mts`→`.mjs`, `.cts`→`.cjs`), so NodeNext and
+ * Bundler resolution both find the source.
+ * @param {string} filePath - Absolute leaf path.
+ * @param {string} outputDir - Absolute directory of the generated file.
+ * @returns {string} POSIX relative specifier starting with `./` or `../`.
+ * @private
+ */
+function importSpecifier(filePath, outputDir) {
+	let relative = path.relative(outputDir, filePath).split(path.sep).join("/");
+	if (!relative.startsWith(".")) relative = `./${relative}`;
+	return relative.replace(/\.(m|c)?ts$/, (____match, kind) => `.${kind ?? ""}js`).replace(/\.tsx$/, ".jsx");
+}
 
-	for (const name of candidates.keys()) {
-		if (wholeWord(name).test(haystack)) consider(name);
-	}
-	return referenced;
+/**
+ * Render members as an object type literal.
+ * @param {Array<{key: string, type: string, comment: (string|null)}>} members - Members to render.
+ * @param {number} indent - Indentation depth of the members.
+ * @returns {string} The object type (`{ ... }`).
+ * @private
+ */
+function renderObject(members, indent) {
+	const lines = ["{"];
+	renderMembers(members, indent, lines);
+	lines.push(`${"\t".repeat(indent - 1)}}`);
+	return lines.join("\n");
 }
 
 /**
- * Render a function/arrow/function-expression node's call signature as TypeScript text
- * (`(params): returnType`) via the type checker, so JSDoc-declared types are reflected exactly as
- * `tsc` resolves them (object shapes from dotted `@param` tags, optional params, unions, generics).
- *
- * @param {object} fnNode - A function declaration, arrow function, or function expression node.
- * @param {object} checker - The Program's type checker.
- * @param {object} ts - TypeScript compiler instance.
- * @returns {string} The call signature, e.g. `(name: string, times: number): string`.
+ * Append rendered members to `lines`, nesting object types one level deeper.
+ * @param {Array<{key: string, type: string, comment: (string|null)}>} members - Members to render.
+ * @param {number} indent - Indentation depth.
+ * @param {string[]} lines - Output lines.
+ * @returns {void}
  * @private
  */
-function signatureText(fnNode, checker, ts) {
-	const signature = checker.getSignatureFromDeclaration(fnNode);
-	return checker.signatureToString(signature, fnNode, ts.TypeFormatFlags.NoTruncation);
+function renderMembers(members, indent, lines) {
+	const pad = "\t".repeat(indent);
+	for (const { key, type, comment } of members) {
+		if (comment) lines.push(`${pad}/** ${comment} */`);
+		const name = IDENTIFIER.test(key) ? key : JSON.stringify(key);
+		// Nested object literals were rendered at depth 1; re-indent them to this member's depth.
+		const reindented = type.split("\n").join(`\n${pad}`);
+		lines.push(`${pad}${name}: ${reindented};`);
+	}
 }
 
 /**
  * Generate TypeScript declaration file content
- * @param {object[]} nodes - API nodes
+ * @param {Array<{key: string, type: string, comment: (string|null)}>} members - Root members.
  * @param {object} options - Generation options
- * @param {Map<string, string>} localTypes - Referenced local named-type declarations to emit.
  * @returns {string} Declaration file content
  * @private
  */
-function generateDeclaration(nodes, options, localTypes) {
+function generateDeclaration(members, options) {
 	const interfaceName = options.interfaceName;
+	const augment = options.augmentRuntime !== false;
 	const lines = [];
 
 	lines.push("/**");
@@ -328,96 +331,31 @@ function generateDeclaration(nodes, options, localTypes) {
 	lines.push(" */");
 	lines.push("");
 
-	// Emit the local named types the signatures reference (from `.ts` leaves) so the interface's
-	// by-name references resolve and the declaration compiles standalone. Type/interface/enum
-	// declarations hoist, so emitting them ahead of the interface is order-independent.
-	if (localTypes.size > 0) {
-		for (const text of localTypes.values()) {
-			lines.push(text);
-		}
+	if (augment) {
+		lines.push(`import type { SlothletAPI } from "@cldmv/slothlet";`);
 		lines.push("");
 	}
 
-	// Build nested structure
-	const structure = {};
-
-	for (const node of nodes) {
-		if (node.type === "function") {
-			// Match by the function's own name (last path segment) so that when multiple
-			// functions share the same source file, each gets its own signature rather
-			// than an unrelated export's signature.
-			const fnName = node.path[node.path.length - 1];
-			const exportInfo = node.typeInfo?.exports?.find((e) => e.name === fnName);
-			// If no matching export found (renamed key, no filePath, or parse failure)
-			// use a safe generic signature rather than borrowing a wrong one.
-			const signature = exportInfo?.signature ?? "(...args: any[]): any";
-			setNestedProperty(structure, node.path, { type: "function", signature });
-		}
-		// Skip intermediate "object" nodes - they're just containers for nested properties
-		// The structure will be built implicitly as we set nested function properties
-	}
-
-	// Generate interface
 	lines.push(`export interface ${interfaceName} {`);
-	generateInterfaceContent(structure, lines, 1);
+	renderMembers(members, 1, lines);
 	lines.push("}");
 	lines.push("");
 
-	// Generate self declaration for TypeScript files to use
-	lines.push(`declare const self: ${interfaceName};`);
-	lines.push("");
-
-	return lines.join("\n");
-}
-
-/**
- * Set nested property in structure
- * @param {object} obj - Object to set property in
- * @param {string[]} path - Property path
- * @param {*} value - Value to set
- * @private
- */
-function setNestedProperty(obj, path, value) {
-	let current = obj;
-
-	for (let i = 0; i < path.length - 1; i++) {
-		const key = path[i];
-		if (!current[key]) {
-			current[key] = {};
-		}
-		current = current[key];
+	// Type `self` for every leaf that imports it (#484). `self` is declared as the empty
+	// `SlothletSelf` class in `@cldmv/slothlet/runtime`; an interface of the same name merges into
+	// that class, so extending it here gives `self.*` the api's full shape in .ts, .mts and
+	// JSDoc-checked .mjs/.cjs leaves alike. (A `declare const self` in this file would be scoped to
+	// this module — the file has top-level exports — and could not retype an imported binding.)
+	// `self` is the same bound api `slothlet()` returns, so it also carries the framework surface
+	// (`self.slothlet.*`, `self.shutdown()`), which `SlothletAPI` describes. The two heritage clauses
+	// merge into one `SlothletSelf` that extends both.
+	if (augment) {
+		lines.push(`declare module "@cldmv/slothlet/runtime" {`);
+		lines.push(`\tinterface SlothletSelf extends ${interfaceName} {}`);
+		lines.push(`\tinterface SlothletSelf extends SlothletAPI {}`);
+		lines.push("}");
+		lines.push("");
 	}
 
-	const lastKey = path[path.length - 1];
-	current[lastKey] = value;
-}
-
-/**
- * Generate interface content recursively
- * @param {object} structure - Nested structure
- * @param {string[]} lines - Output lines
- * @param {number} indent - Indentation level
- * @private
- */
-function generateInterfaceContent(structure, lines, indent) {
-	const indentation = "\t".repeat(indent);
-
-	for (const [key, value] of Object.entries(structure)) {
-		// The else-if and else branches are never reached in tests (transformer only emits "function" entries); IF FALSE unreachable.
-		/* v8 ignore next */
-		if (value.type === "function") {
-			lines.push(`${indentation}${key}${value.signature};`);
-			// The transformer only emits "function" entries and nested objects;
-			// the else-if false branch (primitive/null value) and else body are never reached in tests.
-			/* v8 ignore start */
-		} else if (typeof value === "object" && value !== null) {
-			// Intermediate container object — recurse into it
-			lines.push(`${indentation}${key}: {`);
-			generateInterfaceContent(value, lines, indent + 1);
-			lines.push(`${indentation}};`);
-		} else {
-			// Primitive value type — never produced by transformer; defensive guard only.
-		}
-		/* v8 ignore stop */
-	}
+	return lines.join("\n");
 }
diff --git a/src/lib/runtime/runtime.mjs b/src/lib/runtime/runtime.mjs
index aef2769bf..66f88f5f2 100644
--- a/src/lib/runtime/runtime.mjs
+++ b/src/lib/runtime/runtime.mjs
@@ -25,7 +25,7 @@
  *
  * | Export | Type | Description |
  * | --- | --- | --- |
- * | `self` | `object` | Live reference to the full Slothlet API proxy. Use to call sibling modules without import cycles. |
+ * | `self` | `SlothletSelf` | Live reference to the full Slothlet API proxy. Use to call sibling modules without import cycles. Typed by extending `SlothletSelf` (see `slothlet typegen`). |
  * | `context` | `object` | The current ambient context object. Seeded at startup via `config.context` and persists across calls. `api.slothlet.context.run()` / `.scope()` can override it for the duration of a single call. Readable and writable. |
  * | `instanceID` | `string` | Unique identifier of the active Slothlet instance. |
  *
@@ -64,12 +64,33 @@ function getCurrentRuntime() {
 	return asyncRuntimeModule;
 }
 
+/**
+ * Type anchor for {@link self}. It has no runtime behavior and is never instantiated.
+ *
+ * `self` is typed as `SlothletSelf`, and TypeScript merges an interface of the same name into a
+ * class, so a project types `self` for its whole api by extending this class from a module
+ * augmentation. `slothlet typegen` emits exactly that:
+ * ```ts
+ * declare module "@cldmv/slothlet/runtime" {
+ * 	interface SlothletSelf extends MyApi {}
+ * }
+ * ```
+ *
+ * @memberof module:@cldmv/slothlet/runtime
+ * @example
+ * // api.d.ts (generated by `slothlet typegen -n MyApi`) extends SlothletSelf, so in any leaf:
+ * import { self } from "@cldmv/slothlet/runtime";
+ * await self.math.add(1, 2); // typed from MyApi
+ */
+export class SlothletSelf {}
+
 /**
  * Live binding to the current API instance. Resolves to the running Slothlet proxy,
  * giving API modules access to all other API methods without import cycles.
+ * Typed as {@link SlothletSelf}, which generated api types extend.
  *
  * @memberof module:@cldmv/slothlet/runtime
- * @type {object}
+ * @type {SlothletSelf}
  * @example
  * import { self } from "@cldmv/slothlet/runtime";
  * // Inside an API function:
diff --git a/src/lib/typegen/typegen.mjs b/src/lib/typegen/typegen.mjs
index 62af3924f..d40020054 100644
--- a/src/lib/typegen/typegen.mjs
+++ b/src/lib/typegen/typegen.mjs
@@ -50,6 +50,9 @@ import { SlothletError } from "@cldmv/slothlet/errors";
  * @param {string} options.interfaceName - Name of the generated TypeScript interface (e.g. `"MyApi"`).
  * @param {boolean|string|object} [options.typescript] - Override TypeScript loader config. Same union accepted by `slothlet({ typescript })`: pass `true` (default mode), `"fast"` / `"strict"`, or an object like `{ mode: "fast" }`. Defaults to `{ mode: "fast" }` when omitted.
  * @param {boolean} [options.includeDocumentation=true] - Include JSDoc comments in the generated declaration.
+ * @param {boolean} [options.augmentRuntime=true] - Extend `SlothletSelf` from `@cldmv/slothlet/runtime` with the
+ *   generated interface, so leaves that import `self` get the api's types. Set `false` when another generated
+ *   declaration in the same TypeScript program should type `self` instead.
  * @returns {Promise<{filePath: string, content: string}>} Absolute path written and the declaration content.
  * @throws {SlothletError} `INVALID_CONFIG` when `dir`, `output`, or `interfaceName` is missing or not a string.
  * @public
@@ -85,6 +88,20 @@ export async function generateTypes(options = {}) {
 	assertOption(options.dir, "dir");
 	assertOption(options.output, "output");
 	assertOption(options.interfaceName, "interfaceName");
+	if (options.augmentRuntime !== undefined && typeof options.augmentRuntime !== "boolean") {
+		throw new SlothletError(
+			"INVALID_CONFIG",
+			{
+				option: "typegen.augmentRuntime",
+				expected: "boolean",
+				value: options.augmentRuntime,
+				hint: "Pass augmentRuntime: false to leave `self` untyped by this declaration, or omit it.",
+				validationError: true
+			},
+			null,
+			{ validationError: true }
+		);
+	}
 
 	const api = await slothlet({
 		base: path.resolve(options.dir),
@@ -96,7 +113,8 @@ export async function generateTypes(options = {}) {
 		const result = await writeDeclarationFile(api, {
 			output: path.resolve(options.output),
 			interfaceName: options.interfaceName,
-			includeDocumentation: options.includeDocumentation ?? true
+			includeDocumentation: options.includeDocumentation ?? true,
+			augmentRuntime: options.augmentRuntime ?? true
 		});
 		return { filePath: result.filePath, content: result.output };
 	} finally {
diff --git a/src/slothlet.mjs b/src/slothlet.mjs
index 14e357fed..83e53f0b6 100644
--- a/src/slothlet.mjs
+++ b/src/slothlet.mjs
@@ -461,6 +461,9 @@ class Slothlet {
 					value: implValue,
 					source: data.source,
 					filePath: data.filePath,
+					// Where the value sits in its file's module namespace (#484), resolved by the wrapper.
+					exportPath: data.exportPath ?? null,
+					memberExportPaths: data.memberExportPaths ?? null,
 					collisionMode: collisionMode
 				});
 				// #398: ownership has now decided placement — surface the PUBLIC, post-placement
@@ -518,8 +521,18 @@ class Slothlet {
 						value: implValue,
 						source: data.source,
 						filePath: data.filePath,
+						exportPath: data.exportPath ?? null,
+						memberExportPaths: data.memberExportPaths ?? null,
 						collisionMode: collisionMode
 					});
+				} else {
+					// Same owner, new impl (a lazy leaf materializing, a hot reload): the entry stays put, but
+					// its module origin follows the impl that actually arrived (#484).
+					this.handlers.ownership.refreshOrigin(data.moduleID, data.apiPath, {
+						filePath: data.filePath,
+						exportPath: data.exportPath ?? null,
+						memberExportPaths: data.memberExportPaths ?? null
+					});
 				}
 				// #398: surface the PUBLIC, post-placement impl:changed — only when this contribution is
 				// the placed owner of the path (a change to a shadowed/merge-lost contribution is not a
@@ -1450,8 +1463,11 @@ class Slothlet {
  * API instance with its own component graph, context store, and lifecycle.
  * @alias module:@cldmv/slothlet
  * @async
+ * @template {object} [T=import("./lib/runtime/runtime.mjs").SlothletSelf] - The loaded api's own shape.
+ *   Defaults to `SlothletSelf`, which a `slothlet typegen` declaration extends with the project's api;
+ *   pass another interface (`slothlet<OtherApi>(...)`) when a program loads more than one api.
  * @param {SlothletOptions} config - Configuration options
- * @returns {Promise<SlothletAPI>} Fully loaded, proxy-based API object
+ * @returns {Promise<SlothletAPI & T>} Fully loaded, proxy-based API object
  * @public
  * @example
  * // Minimal usage
diff --git a/tests/validate-typestubs.mjs b/tests/validate-typestubs.mjs
index 2cefe6eae..77999281d 100644
--- a/tests/validate-typestubs.mjs
+++ b/tests/validate-typestubs.mjs
@@ -67,16 +67,59 @@ async function check() {
 export default check;
 `;
 
+// A project's typed api through the stubs (#484): `slothlet typegen` writes a declaration whose members
+// reference the project's own leaves and which extends `SlothletSelf`, so an imported `self` and an
+// awaited `slothlet()` are both typed — with no annotation — once the satellite is installed.
+const TYPED_LEAF = `/**
+ * @param {number} a
+ * @param {number} b
+ * @returns {number}
+ */
+export function add(a, b) {
+	return a + b;
+}
+`;
+
+const TYPED_CONSUMER = `
+import { self } from "@cldmv/slothlet/runtime";
+import slothlet from "@cldmv/slothlet";
+
+export const viaSelf: number = self.math.add(1, 2);
+export const reload: Function = self.slothlet.api.reload;
+// @ts-expect-error wrong argument type
+self.math.add("1", 2);
+// @ts-expect-error missing member
+self.math.subtract(1, 2);
+
+export async function viaApi(): Promise<number> {
+	const api = await slothlet({ base: "./api" });
+	const sum: number = api.math.add(1, 2);
+	await api.slothlet.shutdown();
+	// @ts-expect-error wrong argument type
+	api.math.add("1", 2);
+	// @ts-expect-error missing member
+	api.nope();
+	return sum;
+}
+`;
+
 // Validate under both the lax (bundler) and the strict ESM (nodenext) resolvers — nodenext is the
 // common case for ESM-only consumers and is far pickier about subpath exports and conditions.
 const RESOLUTIONS = ["bundler", "nodenext"];
 
-/** Run tsc on a single file under a given moduleResolution (production/default condition). @returns {{ok:boolean, out:string}} */
-function tsc(testFile, resolution) {
+/**
+ * Run tsc on one or more files under a given moduleResolution (production/default condition).
+ * @param {string|string[]} testFiles - File(s) to compile together.
+ * @param {string} resolution - `bundler` or `nodenext`.
+ * @param {string} [extraFlags=""] - Additional compiler flags (e.g. `--allowJs`).
+ * @returns {{ok:boolean, out:string}}
+ */
+function tsc(testFiles, resolution, extraFlags = "") {
 	const moduleFlag = resolution === "nodenext" ? "nodenext" : "esnext";
+	const files = (Array.isArray(testFiles) ? testFiles : [testFiles]).map((file) => `"${file}"`).join(" ");
 	try {
 		const out = execSync(
-			`npx tsc --noEmit --strict --moduleResolution ${resolution} --module ${moduleFlag} --target es2022 "${testFile}"`,
+			`npx tsc --noEmit --strict --moduleResolution ${resolution} --module ${moduleFlag} --target es2022 ${extraFlags} ${files}`,
 			{ stdio: "pipe", encoding: "utf8", cwd: projectRoot }
 		);
 		return { ok: true, out };
@@ -137,6 +180,30 @@ function main() {
 			}
 		}
 
+		// 1d) Typed `self` + typed `slothlet()` through the stubs (#484): generate a declaration with the
+		// real `slothlet typegen` CLI for a one-leaf api, then check a consumer that imports `self` and
+		// awaits `slothlet()` — positive calls type-check and every @ts-expect-error line is an error.
+		const typedDir = join(tmpDir, "typed");
+		mkdirSync(join(typedDir, "api"), { recursive: true });
+		writeFileSync(join(typedDir, "api", "math.mjs"), TYPED_LEAF, "utf8");
+		const typedDeclaration = join(typedDir, "api.d.mts");
+		execFileSync(
+			"node",
+			[join(projectRoot, "bin", "slothlet.mjs"), "typegen", "-d", join(typedDir, "api"), "-o", typedDeclaration, "-n", "ConsumerApi"],
+			{ stdio: "pipe", cwd: typedDir }
+		);
+		const typedConsumer = join(typedDir, "consumer.mts");
+		writeFileSync(typedConsumer, TYPED_CONSUMER, "utf8");
+		for (const res of RESOLUTIONS) {
+			const typed = tsc([typedDeclaration, typedConsumer], res, "--allowJs");
+			if (typed.ok) {
+				console.log(`✅ [${res}] typegen declaration types \`self\` and the slothlet() result through the stubs`);
+			} else {
+				failed = true;
+				console.error(`❌ [${res}] expected the typed self/api consumer to type-check through the stubs:\n` + typed.out);
+			}
+		}
+
 		// 1c) An internal-only subpath NOT carried by the satellite ships a self-contained declaration
 		// instead of a re-export (build-typestubs.mjs). Verify one of those — ./modes/eager, whose
 		// declaration imports the package-internal #factories/component-base — actually type-checks
diff --git a/tests/vitests/suites/typegen/typegen-cli.test.vitest.mjs b/tests/vitests/suites/typegen/typegen-cli.test.vitest.mjs
index 69bccae03..41c113d52 100644
--- a/tests/vitests/suites/typegen/typegen-cli.test.vitest.mjs
+++ b/tests/vitests/suites/typegen/typegen-cli.test.vitest.mjs
@@ -135,7 +135,7 @@ describe("slothlet CLI", () => {
 			expect(existsSync(out)).toBe(true);
 			const content = await readFile(out, "utf8");
 			expect(content).toContain("interface PositionalApi");
-			expect(content).toContain("declare const self");
+			expect(content).toContain("interface SlothletSelf extends PositionalApi {}");
 		});
 	});
 
@@ -265,6 +265,43 @@ describe("slothlet CLI", () => {
 			expect(stderr).toMatch(/requires a value/i);
 		});
 	});
+
+	describe("typegen self typing (#484)", () => {
+		it("extends SlothletSelf by default", async () => {
+			const tmp = await freshTempDir();
+			const out = path.join(tmp, "api.d.ts");
+			const { code } = await runCli(["typegen", "-d", API_FIXTURE, "-o", out, "-n", "SelfApi"]);
+			expect(code).toBe(0);
+			const content = await readFile(out, "utf8");
+			expect(content).toContain('declare module "@cldmv/slothlet/runtime" {');
+			expect(content).toContain("interface SlothletSelf extends SelfApi {}");
+		});
+
+		it("--no-augment-runtime leaves SlothletSelf alone", async () => {
+			const tmp = await freshTempDir();
+			const out = path.join(tmp, "api.d.ts");
+			const { code } = await runCli(["typegen", "-d", API_FIXTURE, "-o", out, "-n", "NoSelfApi", "--no-augment-runtime"]);
+			expect(code).toBe(0);
+			const content = await readFile(out, "utf8");
+			expect(content).toContain("interface NoSelfApi");
+			expect(content).not.toContain("SlothletSelf");
+		});
+
+		it("reads augmentRuntime from package.json even when the other options come from flags", async () => {
+			const tmp = await freshTempDir();
+			const out = path.join(tmp, "api.d.ts");
+			await writeFile(
+				path.join(tmp, "package.json"),
+				JSON.stringify({ name: "tmp-cli-fixture", slothlet: { typegen: { augmentRuntime: false } } }),
+				"utf8"
+			);
+			const { code } = await runCli(["typegen", "-d", API_FIXTURE, "-o", out, "-n", "PkgNoSelfApi"], { cwd: tmp });
+			expect(code).toBe(0);
+			const content = await readFile(out, "utf8");
+			expect(content).toContain("interface PkgNoSelfApi");
+			expect(content).not.toContain("SlothletSelf");
+		});
+	});
 });
 
 function escapeRegex(s) {
diff --git a/tests/vitests/suites/typegen/typegen-origin.test.vitest.mjs b/tests/vitests/suites/typegen/typegen-origin.test.vitest.mjs
new file mode 100644
index 000000000..6c5f15361
--- /dev/null
+++ b/tests/vitests/suites/typegen/typegen-origin.test.vitest.mjs
@@ -0,0 +1,357 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/typegen/typegen-origin.test.vitest.mjs
+ *	@Date: 2026-09-28 00:19:50 -07:00 (1790579990)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 00:53:46 -07:00 (1790582026)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Typegen types the api slothlet actually composes (#484).
+ *
+ * Every member of a generated declaration must reference the export slothlet placed at that path —
+ * `typeof import("<leaf>")["k"]` — read from the module origin the ownership records carry, so a
+ * tree mixing `.mjs`, `.cjs` and `.mts` leaves (named, default, CommonJS, flattened, callable
+ * namespaces, object leaves, non-function values) is typed exactly. The acceptance checks compile a
+ * probe that imports `self` from `@cldmv/slothlet/runtime` and awaits `slothlet()` against the
+ * generated file, under both NodeNext and Bundler resolution with `allowJs`, asserting the positive
+ * calls type-check and every `@ts-expect-error` line really is an error.
+ */
+import { describe, it, expect, afterAll, vi } from "vitest";
+import { mkdir, writeFile, readFile, rm } from "node:fs/promises";
+import path from "node:path";
+import ts from "typescript";
+import slothlet from "@cldmv/slothlet";
+import { generateTypes } from "@cldmv/slothlet/typegen";
+import { generateTypes as generateFromInstance } from "@cldmv/slothlet/processors/type-generator";
+import { resolveWrapper } from "#handlers/unified-wrapper";
+import { makeTestTmpDir } from "../../setup/test-fixtures-tmp.mjs";
+
+// Each compile builds a full TypeScript program over slothlet's own declarations with lib checking on
+// (the generated file is itself a .d.mts, so skipLibCheck would skip exactly what is under test).
+vi.setConfig({ testTimeout: 120000, hookTimeout: 120000 });
+
+const FIXTURE = path.resolve("api_tests/api_test_typegen_mixed");
+
+const tempRoots = [];
+
+afterAll(async () => {
+	await Promise.allSettled(tempRoots.map((root) => rm(root, { recursive: true, force: true })));
+});
+
+/**
+ * Create a scratch directory inside the package (so `@cldmv/slothlet` self-resolves from it).
+ * @returns {Promise<string>} Absolute directory path.
+ */
+async function freshTempDir() {
+	const root = await makeTestTmpDir("typegen-origin");
+	tempRoots.push(root);
+	return root;
+}
+
+/**
+ * Compile files and return every diagnostic outside `node_modules`, formatted.
+ * @param {string[]} files - Root files of the program.
+ * @param {"nodenext"|"bundler"} resolution - Module resolution strategy.
+ * @returns {string[]} Formatted diagnostics (empty = the program type-checks).
+ */
+function compile(files, resolution) {
+	const nodeNext = resolution === "nodenext";
+	const program = ts.createProgram(files, {
+		noEmit: true,
+		strict: true,
+		allowJs: true,
+		skipLibCheck: false,
+		target: ts.ScriptTarget.ES2022,
+		module: nodeNext ? ts.ModuleKind.NodeNext : ts.ModuleKind.ESNext,
+		moduleResolution: nodeNext ? ts.ModuleResolutionKind.NodeNext : ts.ModuleResolutionKind.Bundler,
+		// Resolve @cldmv/slothlet(/runtime) to this checkout's own declarations (types/src/…).
+		customConditions: ["slothlet-dev"],
+		types: ["node"]
+	});
+	return ts
+		.getPreEmitDiagnostics(program)
+		.filter((d) => !d.file || !d.file.fileName.includes(`${path.sep}node_modules${path.sep}`))
+		.map((d) => {
+			const text = ts.flattenDiagnosticMessageText(d.messageText, "\n");
+			if (!d.file || d.start === undefined) return text;
+			const { line } = d.file.getLineAndCharacterOfPosition(d.start);
+			return `${path.basename(d.file.fileName)}:${line + 1} ${text}`;
+		});
+}
+
+/** A TypeScript probe exercising every leaf shape of the mixed fixture through `self` and `slothlet()`. */
+const TS_PROBE = `import { self } from "@cldmv/slothlet/runtime";
+import slothlet from "@cldmv/slothlet";
+import type { EventEmitter } from "node:events";
+
+export function useSelf() {
+	const sum: number = self.math.add(1, 2);
+	const repeated: string = self.math.repeat("a", 3);
+	const greeting: string = self.greet("x");
+	const retries: number = self.settings.LIMITS.maxRetries;
+	const mode: "strict" | "lenient" = self.settings.LIMITS.mode;
+	const version: string = self.settings.VERSION;
+	const shouted: string = self.text.shout("x");
+	const words: number = self.text.stats.words("a b");
+	const even: boolean = self.parity(2);
+	const level: number = self.bulb.brightness.get();
+	self.bulb.brightness.set(3);
+	const events: EventEmitter = self.bulb.events();
+	const widget: { id: number; name: string } = self.widgets.create("w");
+	const widgetCount: number = self.widgets.count();
+	const logged: string = self.logger("m");
+	const info: string = self.logger.info("m");
+	const logLevel: number = self.logger.LEVEL;
+	const step: 5 = self.tuning.TUNE_STEP;
+	const gain: 2 = self.tuning.defaults.DEFAULT_GAIN;
+	const cascade: Promise<unknown> = self.initialize();
+	const reload: Function = self.slothlet.api.reload;
+
+	// @ts-expect-error named export: wrong argument type
+	self.math.add("1", 2);
+	// @ts-expect-error missing member
+	self.math.subtract(1, 2);
+	// @ts-expect-error default export: wrong argument type
+	self.greet(1);
+	// @ts-expect-error CommonJS module.exports = function: wrong argument type
+	self.parity("2");
+	// @ts-expect-error CommonJS object export member: wrong argument type
+	self.text.shout(1);
+	// @ts-expect-error CommonJS nested object leaf: wrong argument type
+	self.text.stats.words(1);
+	// @ts-expect-error interface-annotated object leaf: wrong argument type
+	self.bulb.brightness.set("bright");
+	// @ts-expect-error frozen constant is readonly
+	self.settings.LIMITS.maxRetries = 4;
+	// @ts-expect-error callable namespace: wrong argument type
+	self.logger(1);
+	// @ts-expect-error callable namespace member: wrong argument type
+	self.logger.info(2);
+	// @ts-expect-error flattened self-named file: wrong argument type
+	self.widgets.create(3);
+	// @ts-expect-error folder-namespace primitive is its literal export type
+	const wrongStep: string = self.tuning.TUNE_STEP;
+	// @ts-expect-error missing namespace
+	self.nope.call();
+
+	return { sum, repeated, greeting, retries, mode, version, shouted, words, even, level, events, widget, widgetCount, logged, info, logLevel, step, gain, wrongStep, cascade, reload };
+}
+
+export async function useApi() {
+	const api = await slothlet({ base: "./api" });
+	const sum: number = api.math.add(1, 2);
+	const even: boolean = api.parity(4);
+	await api.slothlet.shutdown();
+	// @ts-expect-error wrong argument type through the consumer api
+	api.math.add("1", 2);
+	// @ts-expect-error missing member on the consumer api
+	api.nope();
+	return { sum, even };
+}
+`;
+
+/** The same checks from a JSDoc-checked `.mjs` leaf. */
+const JS_PROBE = `// @ts-check
+import { self } from "@cldmv/slothlet/runtime";
+
+export function useSelfFromJs() {
+	/** @type {number} */
+	const sum = self.math.add(1, 2);
+	/** @type {string} */
+	const shouted = self.text.shout("x");
+	/** @type {boolean} */
+	const even = self.parity(2);
+	// @ts-expect-error wrong argument type
+	self.math.add("1", 2);
+	// @ts-expect-error missing member
+	self.text.whisper("x");
+	return { sum, shouted, even };
+}
+`;
+
+describe("typegen types the composed api from each node's module origin (#484)", () => {
+	it("records each node's exportPath in the ownership records", async () => {
+		const api = await slothlet({ base: FIXTURE, mode: "eager", typescript: { mode: "fast" }, silent: true });
+		try {
+			const ownership = resolveWrapper(api.math).slothlet.handlers.ownership;
+			const origin = (apiPath) => {
+				const found = ownership.getOrigin(apiPath);
+				return found && { file: path.relative(FIXTURE, found.filePath).split(path.sep).join("/"), exportPath: found.exportPath };
+			};
+			expect(origin("math.add")).toEqual({ file: "math.mjs", exportPath: ["add"] });
+			expect(origin("greet")).toEqual({ file: "greet.mjs", exportPath: ["default"] });
+			expect(origin("settings.LIMITS")).toEqual({ file: "settings.mjs", exportPath: ["LIMITS"] });
+			expect(origin("settings.LIMITS.maxRetries")).toEqual({ file: "settings.mjs", exportPath: ["LIMITS", "maxRetries"] });
+			expect(origin("settings.VERSION")).toEqual({ file: "settings.mjs", exportPath: ["VERSION"] });
+			// CommonJS: the loader exposes module.exports as `default`.
+			expect(origin("text")).toEqual({ file: "text.cjs", exportPath: ["default"] });
+			expect(origin("text.shout")).toEqual({ file: "text.cjs", exportPath: ["default", "shout"] });
+			expect(origin("text.stats.words")).toEqual({ file: "text.cjs", exportPath: ["default", "stats", "words"] });
+			expect(origin("parity")).toEqual({ file: "parity.cjs", exportPath: ["default"] });
+			expect(origin("bulb.brightness")).toEqual({ file: "bulb.mts", exportPath: ["brightness"] });
+			expect(origin("bulb.brightness.set")).toEqual({ file: "bulb.mts", exportPath: ["brightness", "set"] });
+			// Self-named file flattened into its folder namespace.
+			expect(origin("widgets.create")).toEqual({ file: "widgets/widgets.mjs", exportPath: ["create"] });
+			// Callable namespace: the default function, with the named exports merged onto it.
+			expect(origin("logger")).toEqual({ file: "logger.mjs", exportPath: ["default"] });
+			expect(origin("logger.info")).toEqual({ file: "logger.mjs", exportPath: ["info"] });
+			expect(origin("logger.LEVEL")).toEqual({ file: "logger.mjs", exportPath: ["LEVEL"] });
+			// A primitive merged into a folder namespace that several files compose — it has no identity to
+			// look up and the folder namespace records no per-key map, so it is located by its own file.
+			expect(origin("tuning.TUNE_STEP")).toEqual({ file: "tuning/tuning.mjs", exportPath: ["TUNE_STEP"] });
+			expect(origin("tuning.defaults.DEFAULT_GAIN")).toEqual({ file: "tuning/defaults.mjs", exportPath: ["DEFAULT_GAIN"] });
+			// A namespace slothlet composed from several named exports is not itself an export.
+			expect(origin("math").exportPath).toBeNull();
+		} finally {
+			await api.slothlet.shutdown();
+		}
+	});
+
+	it("keeps a primitive's origin in a multi-file namespace when a reload changes its value", async () => {
+		const root = await freshTempDir();
+		const tuning = path.join(root, "api", "tuning");
+		await mkdir(tuning, { recursive: true });
+		const writeTuning = (step) =>
+			writeFile(
+				path.join(tuning, "tuning.mjs"),
+				`export function tune(v) { return v * TUNE_STEP; }\nexport const TUNE_STEP = ${step};\n`,
+				"utf8"
+			);
+		await writeTuning(5);
+		await writeFile(path.join(tuning, "defaults.mjs"), "export const DEFAULT_GAIN = 2;\n", "utf8");
+
+		const api = await slothlet({ base: path.join(root, "api"), mode: "eager", silent: true });
+		try {
+			const ownership = resolveWrapper(api.tuning).slothlet.handlers.ownership;
+			expect(api.tuning.TUNE_STEP).toBe(5);
+			expect(ownership.getOrigin("tuning.TUNE_STEP")?.exportPath).toEqual(["TUNE_STEP"]);
+
+			// The primitive's value changes on disk; after the reload it must still resolve to its export.
+			// A full reload rebuilds the ownership records; a scoped reload keeps them and re-indexes the file.
+			await writeTuning(7);
+			await api.slothlet.api.reload("tuning");
+			expect(api.tuning.TUNE_STEP).toBe(7);
+			expect(ownership.getOrigin("tuning.TUNE_STEP")?.exportPath).toEqual(["TUNE_STEP"]);
+
+			await writeTuning(9);
+			await api.slothlet.reload();
+			expect(api.tuning.TUNE_STEP).toBe(9);
+			expect(ownership.getOrigin("tuning.TUNE_STEP")?.exportPath).toEqual(["TUNE_STEP"]);
+		} finally {
+			await api.slothlet.shutdown();
+		}
+	});
+
+	it("emits typeof-import references to the real exports, mapping extensions and CommonJS roots", async () => {
+		const tmp = await freshTempDir();
+		const output = path.join(tmp, "types", "api.d.mts");
+		const { content } = await generateTypes({ dir: FIXTURE, output, interfaceName: "MixedApi" });
+		const spec = (file) => JSON.stringify(path.relative(path.dirname(output), path.join(FIXTURE, file)).split(path.sep).join("/"));
+
+		expect(content).toContain(`add: typeof import(${spec("math.mjs")})["add"];`);
+		expect(content).toContain(`greet: typeof import(${spec("greet.mjs")})["default"];`);
+		expect(content).toContain(`LIMITS: typeof import(${spec("settings.mjs")})["LIMITS"];`);
+		// CommonJS: `import("x.cjs")` IS module.exports, so the loader's `default` segment is dropped.
+		expect(content).toContain(`text: typeof import(${spec("text.cjs")});`);
+		expect(content).toContain(`parity: typeof import(${spec("parity.cjs")});`);
+		// .mts leaves are imported by their runtime extension.
+		expect(content).toContain(`brightness: typeof import(${spec("bulb.mjs")})["brightness"];`);
+		expect(content).not.toContain("bulb.mts");
+		// Callable namespace: the default function intersected with the members merged onto it.
+		expect(content).toContain(`logger: typeof import(${spec("logger.mjs")})["default"] & {`);
+		expect(content).toContain(`info: typeof import(${spec("logger.mjs")})["info"];`);
+		expect(content).toContain(`create: typeof import(${spec("widgets/widgets.mjs")})["create"];`);
+		expect(content).toContain(`TUNE_STEP: typeof import(${spec("tuning/tuning.mjs")})["TUNE_STEP"];`);
+		expect(content).not.toContain("unknown;");
+		// Nothing falls back to an untyped signature.
+		expect(content).not.toMatch(/\bany\b/);
+		expect(content).toContain('import type { SlothletAPI } from "@cldmv/slothlet";');
+		expect(content).toContain("interface SlothletSelf extends MixedApi {}");
+		expect(content).toContain("interface SlothletSelf extends SlothletAPI {}");
+	});
+
+	for (const resolution of ["nodenext", "bundler"]) {
+		it(`types self and the slothlet() result under ${resolution} resolution`, async () => {
+			const tmp = await freshTempDir();
+			const output = path.join(tmp, "types", "api.d.mts");
+			await generateTypes({ dir: FIXTURE, output, interfaceName: "MixedApi" });
+			const tsProbe = path.join(tmp, "probe.mts");
+			const jsProbe = path.join(tmp, "probe.mjs");
+			await writeFile(tsProbe, TS_PROBE, "utf8");
+			await writeFile(jsProbe, JS_PROBE, "utf8");
+
+			expect(compile([output, tsProbe, jsProbe], resolution)).toEqual([]);
+			// Control: without the generated declaration `self` is the bare anchor, so the same probe fails —
+			// the zero above is the declaration's doing, not an `any` letting everything through.
+			expect(compile([tsProbe], resolution).length).toBeGreaterThan(0);
+		});
+	}
+
+	it("types a folder mounted at runtime with api.slothlet.api.add()", async () => {
+		const tmp = await freshTempDir();
+		const output = path.join(tmp, "mounted.d.mts");
+		const api = await slothlet({
+			base: path.join(FIXTURE, "widgets"),
+			mode: "eager",
+			typescript: { mode: "fast" },
+			silent: true
+		});
+		try {
+			await api.slothlet.api.add("plugins.mixed", FIXTURE);
+			const { output: content } = await generateFromInstance(api, { output, interfaceName: "MountedApi" });
+			const spec = (file) => JSON.stringify(path.relative(tmp, path.join(FIXTURE, file)).split(path.sep).join("/"));
+			expect(content).toContain(`add: typeof import(${spec("math.mjs")})["add"];`);
+			expect(content).toContain(`parity: typeof import(${spec("parity.cjs")});`);
+
+			const probe = path.join(tmp, "mounted-probe.mts");
+			await writeFile(
+				probe,
+				[
+					'import { self } from "@cldmv/slothlet/runtime";',
+					"export const sum: number = self.plugins.mixed.math.add(1, 2);",
+					"export const even: boolean = self.plugins.mixed.parity(2);",
+					"export const created: { id: number; name: string } = self.widgets.create('w');",
+					"// @ts-expect-error mounted leaf: wrong argument type",
+					'self.plugins.mixed.math.add("1", 2);',
+					"// @ts-expect-error not mounted",
+					"self.plugins.other.call();",
+					""
+				].join("\n"),
+				"utf8"
+			);
+			expect(compile([output, probe], "nodenext")).toEqual([]);
+		} finally {
+			await api.slothlet.shutdown();
+		}
+	});
+
+	it("types a member with no module origin as unknown and says why", async () => {
+		const tmp = await freshTempDir();
+		const output = path.join(tmp, "no-origin.d.mts");
+		const api = await slothlet({ base: path.join(FIXTURE, "widgets"), mode: "eager", silent: true });
+		try {
+			await api.slothlet.api.add("services", { exports: { now: () => Date.now() } });
+			const { output: content } = await generateFromInstance(api, { output, interfaceName: "NoOriginApi" });
+			expect(content).toMatch(/\/\*\* No module origin: [^\n]*\*\/\n\t\tnow: unknown;/);
+			expect(content).not.toMatch(/\bany\b/);
+		} finally {
+			await api.slothlet.shutdown();
+		}
+	});
+
+	it("leaves SlothletAPI out when the runtime augmentation is off", async () => {
+		const tmp = await freshTempDir();
+		const output = path.join(tmp, "plain.d.mts");
+		await generateTypes({ dir: path.join(FIXTURE, "widgets"), output, interfaceName: "PlainApi", augmentRuntime: false });
+		const content = await readFile(output, "utf8");
+		expect(content).toContain("export interface PlainApi {");
+		expect(content).not.toContain("SlothletAPI");
+		expect(content).not.toContain("SlothletSelf");
+	});
+});
diff --git a/tests/vitests/suites/typegen/typegen-programmatic.test.vitest.mjs b/tests/vitests/suites/typegen/typegen-programmatic.test.vitest.mjs
index bf5d5be5d..60639d3a4 100644
--- a/tests/vitests/suites/typegen/typegen-programmatic.test.vitest.mjs
+++ b/tests/vitests/suites/typegen/typegen-programmatic.test.vitest.mjs
@@ -64,7 +64,7 @@ describe("typegen programmatic API", () => {
 
 		const content = await readFile(output, "utf8");
 		expect(content).toContain("interface RuntimeApi");
-		expect(content).toContain("declare const self");
+		expect(content).toContain("interface SlothletSelf extends RuntimeApi {}");
 		expect(content).toContain("RuntimeApi");
 		// All three fixture modules should appear somewhere in the declaration.
 		expect(content).toMatch(/\bfoo\b/);
@@ -119,12 +119,13 @@ describe("typegen programmatic API", () => {
 	});
 });
 
-// #213 — JSDoc `@param {T}` / `@returns {T}` types must be reflected into the generated signatures as
-// PROPER, valid TypeScript. A normal slothlet module is plain `.mjs` with JSDoc-only types, and the
-// generator previously read only inline annotation nodes, so every signature came out `any`. The fix
-// resolves types through a real TypeScript Program + checker, so object shapes, optionals, unions, and
-// generics come through. The acceptance test type-checks the generated `.d.ts` itself — the whole point
-// of typegen is a declaration a consumer can run `tsc` against.
+// #213 — JSDoc `@param {T}` / `@returns {T}` types must reach the generated declaration as PROPER,
+// valid TypeScript. A normal slothlet module is plain `.mjs` with JSDoc-only types, and the generator
+// once read only inline annotation nodes, so every signature came out `any`. The declaration now
+// references each leaf's own export (#484), so TypeScript reads the JSDoc / annotations directly. The
+// acceptance check compiles a probe against the generated declaration: calls that must type-check, plus
+// `@ts-expect-error` lines proving each type is real — the whole point of typegen is a declaration a
+// consumer can run `tsc` against.
 describe("typegen JSDoc type reflection (#213)", () => {
 	async function generateFromApi(files) {
 		const tmp = await freshTempDir();
@@ -138,33 +139,50 @@ describe("typegen JSDoc type reflection (#213)", () => {
 		return { content, outPath };
 	}
 
-	// Compile the generated declaration under strict mode and return the diagnostic messages (empty =
-	// valid, usable TypeScript). This is what actually proves "proper types" — a string match does not.
-	function declarationDiagnostics(dtsPath) {
-		const program = ts.createProgram([dtsPath], {
+	// Compile a probe that imports `self` against the generated declaration, under strict mode with
+	// `allowJs` (the declaration references the `.mjs` leaves directly) and the `slothlet-dev` condition
+	// (so `@cldmv/slothlet/runtime` resolves to this checkout's declarations). Returns every diagnostic
+	// outside node_modules — empty means the calls type-check AND every `@ts-expect-error` line is a real
+	// error (an unused one is itself a diagnostic). skipLibCheck stays off: the generated file is a .d.mts.
+	async function probeDiagnostics(dtsPath, probeSource) {
+		const probePath = path.join(path.dirname(dtsPath), "probe.mts");
+		await writeFile(probePath, `import { self } from "@cldmv/slothlet/runtime";\n${probeSource}`, "utf8");
+		const program = ts.createProgram([dtsPath, probePath], {
 			noEmit: true,
-			// Fully check the generated declaration itself — skipLibCheck:true would skip semantic
-			// checking of every .d.ts (ours included), so a broken declaration could still read as []
-			// and defeat the acceptance test. Lib-file noise is excluded by filtering to dtsPath below.
 			skipLibCheck: false,
 			strict: true,
-			target: ts.ScriptTarget.Latest,
-			moduleResolution: ts.ModuleResolutionKind.Bundler
+			allowJs: true,
+			target: ts.ScriptTarget.ES2022,
+			module: ts.ModuleKind.ESNext,
+			moduleResolution: ts.ModuleResolutionKind.Bundler,
+			customConditions: ["slothlet-dev"],
+			types: ["node"]
 		});
-		const resolved = path.resolve(dtsPath);
 		return ts
 			.getPreEmitDiagnostics(program)
-			.filter((d) => !d.file || path.resolve(d.file.fileName) === resolved)
+			.filter((d) => !d.file || !d.file.fileName.includes(`${path.sep}node_modules${path.sep}`))
 			.map((d) => ts.flattenDiagnosticMessageText(d.messageText, "\n"));
 	}
 
 	it("reflects primitive @param / @returns types, and the declaration compiles", async () => {
-		const { content, outPath } = await generateFromApi({
+		const { outPath } = await generateFromApi({
 			"greet.mjs":
 				"/**\n * @param {string} name\n * @param {number} times\n * @returns {string}\n */\nexport function greet(name, times) {\n\treturn name.repeat(times);\n}\n"
 		});
-		expect(content).toContain("greet(name: string, times: number): string");
-		expect(declarationDiagnostics(outPath)).toEqual([]);
+		const diagnostics = await probeDiagnostics(
+			outPath,
+			[
+				'export const greeting: string = self.greet("hi", 2);',
+				"// @ts-expect-error name is a string",
+				"self.greet(1, 2);",
+				"// @ts-expect-error times is a number",
+				'self.greet("hi", "2");',
+				"// @ts-expect-error returns a string",
+				'export const wrong: number = self.greet("hi", 2);',
+				""
+			].join("\n")
+		);
+		expect(diagnostics).toEqual([]);
 	});
 
 	it("resolves object params (dotted @param), optionals, unions, arrays, generics, and const-arrow exports into valid TS", async () => {
@@ -178,50 +196,85 @@ describe("typegen JSDoc type reflection (#213)", () => {
 			"misc.mjs":
 				'/**\n * @param {boolean} flag\n * @returns {number}\n */\nexport const toNum = (flag) => (flag ? 1 : 0);\nexport const LABEL = "x";\n'
 		});
-		// The compiled declaration is valid TypeScript — the real regression guard (raw JSDoc used to leak
-		// in and break compilation).
-		expect(declarationDiagnostics(outPath)).toEqual([]);
 		expect(content).not.toMatch(/@param/); // no raw JSDoc leaked into the output
-		// object shape resolved from the dotted @param tags (not `any`, not comment text)
-		expect(content).toMatch(/build\(opts:\s*\{[^}]*name:\s*string/);
-		expect(content).toMatch(/count\?:\s*number/); // optional sub-property
-		expect(content).toMatch(/suffix\?:\s*string/); // bracket-optional param
-		expect(content).toContain("lookup(id: string | number, tags: string[]): Promise<{ ok: boolean; }>");
-		expect(content).toContain("toNum(flag: boolean): number"); // const-arrow export
+		const diagnostics = await probeDiagnostics(
+			outPath,
+			[
+				// object shape resolved from the dotted @param tags; optional sub-property and optional param
+				'export const built: string = self.build({ name: "n" });',
+				'export const builtFull: string = self.build({ name: "n", count: 2 }, "-s");',
+				"// @ts-expect-error opts.name is required",
+				"self.build({ count: 2 });",
+				"// @ts-expect-error opts.count is a number",
+				'self.build({ name: "n", count: "2" });',
+				"// @ts-expect-error suffix is a string",
+				'self.build({ name: "n" }, 3);',
+				// union + array params, generic return
+				'export const found: Promise<{ ok: boolean }> = self.lookup("a", ["x"]);',
+				"export const foundByNumber: Promise<{ ok: boolean }> = self.lookup(1, []);",
+				"// @ts-expect-error id is string | number",
+				'self.lookup(true, ["x"]);',
+				"// @ts-expect-error tags is string[]",
+				'self.lookup("a", [1]);',
+				"// @ts-expect-error the generic resolves to Promise<{ ok: boolean }>",
+				'export const wrongGeneric: Promise<{ ok: string }> = self.lookup("a", []);',
+				// const-arrow export
+				"export const asNumber: number = self.misc.toNum(true);",
+				"// @ts-expect-error flag is a boolean",
+				'self.misc.toNum("yes");',
+				""
+			].join("\n")
+		);
+		expect(diagnostics).toEqual([]);
 	});
 
-	it("falls back to a valid signature when a function has no JSDoc types", async () => {
-		const { content, outPath } = await generateFromApi({
+	it("falls back to accepting any arguments when a function has no JSDoc types", async () => {
+		const { outPath } = await generateFromApi({
 			"bare.mjs": "export function bare(a, b) {\n\treturn `${a}${b}`;\n}\n"
 		});
-		expect(content).toMatch(/bare\(a: any, b: any\):/); // untyped params → any (still valid)
-		expect(declarationDiagnostics(outPath)).toEqual([]);
+		// untyped params → any: calls with arbitrary argument types compile
+		const diagnostics = await probeDiagnostics(
+			outPath,
+			[
+				'self.bare(1, "x");',
+				"self.bare({}, [true]);",
+				"self.bare(null, undefined);",
+				// …while self itself is typed (not `any`): an unknown member is still an error
+				"// @ts-expect-error missing member",
+				"self.nope();",
+				""
+			].join("\n")
+		);
+		expect(diagnostics).toEqual([]);
 	});
 
-	// A TypeScript leaf can reference a LOCAL named type (interface / type alias / enum) declared in
-	// the same file. The checker prints that type by name, so the generated declaration referenced an
-	// undefined name and failed to compile until the generator learned to emit the referenced local
-	// type declarations alongside the interface.
-	it("emits referenced local named types from a TypeScript leaf so the declaration compiles", async () => {
-		const { content, outPath } = await generateFromApi({
-			// `Meta` is referenced only *inside* `Shape` (never in a signature) — it must still be pulled
-			// in transitively. `Unused` is referenced by nothing and must NOT appear.
+	// A TypeScript leaf can reference a LOCAL named type (interface / type alias / enum) declared in the
+	// same file. The declaration references the leaf's export, so TypeScript resolves those local types
+	// in the leaf itself — including ones reached only transitively (Meta, through Shape).
+	it("resolves referenced local named types from a TypeScript leaf so the declaration compiles", async () => {
+		const { outPath } = await generateFromApi({
+			// `Meta` is referenced only *inside* `Shape` (never in a signature). `Unused` is referenced by nothing.
 			"geo.mts":
 				'interface Point {\n\tx: number;\n\ty: number;\n\tlabel?: string;\n}\ninterface Meta {\n\ttag: string;\n}\ntype Shape = { origin: Point; kind: "box" | "circle"; meta: Meta };\nenum Unit {\n\tPx,\n\tEm\n}\ninterface Unused {\n\tz: number;\n}\nexport function build(p: Point, s: Shape): { shape: Shape; ok: boolean } {\n\treturn { shape: s, ok: p.x > 0 };\n}\nexport function ids(unit: Unit): Point[] {\n\treturn [];\n}\n'
 		});
-		// Directly-referenced local types are emitted…
-		expect(content).toMatch(/interface Point/);
-		expect(content).toMatch(/type Shape/);
-		expect(content).toMatch(/enum Unit/);
-		// …and so are ones referenced only transitively (Meta, reached through Shape).
-		expect(content).toMatch(/interface Meta/);
-		// And the signatures still reference them by name.
-		expect(content).toMatch(/build\(p: Point, s: Shape\)/);
-		expect(content).toMatch(/ids\(unit: Unit\): Point\[\]/);
-		// A local type nothing references is NOT dragged in.
-		expect(content).not.toMatch(/interface Unused/);
-		// The whole declaration compiles under the strict acceptance check — the real regression guard
-		// (an undefined `Point` / `Shape` / `Unit` / `Meta` used to make tsc report "Cannot find name").
-		expect(declarationDiagnostics(outPath)).toEqual([]);
+		const diagnostics = await probeDiagnostics(
+			outPath,
+			[
+				"const point = { x: 1, y: 2 };",
+				'const shape = { origin: point, kind: "box" as const, meta: { tag: "t" } };',
+				"export const result: { shape: { kind: string }; ok: boolean } = self.geo.build(point, shape);",
+				"export const points: { x: number; y: number; label?: string }[] = self.geo.ids(0);",
+				"// @ts-expect-error Point requires y",
+				"self.geo.build({ x: 1 }, shape);",
+				'// @ts-expect-error Shape.kind is "box" | "circle"',
+				'self.geo.build(point, { ...shape, kind: "triangle" });',
+				"// @ts-expect-error Meta (reached through Shape) requires tag",
+				"self.geo.build(point, { ...shape, meta: {} });",
+				"// @ts-expect-error Unit is an enum, not a string",
+				'self.geo.ids("px");',
+				""
+			].join("\n")
+		);
+		expect(diagnostics).toEqual([]);
 	});
 });
diff --git a/tests/vitests/suites/typescript/type-generator.test.vitest.mjs b/tests/vitests/suites/typescript/type-generator.test.vitest.mjs
index d37bcf283..c11ff6e53 100644
--- a/tests/vitests/suites/typescript/type-generator.test.vitest.mjs
+++ b/tests/vitests/suites/typescript/type-generator.test.vitest.mjs
@@ -20,11 +20,18 @@
  * `src/lib/processors/type-generator.mjs`.
  */
 
-import { describe, it, expect, afterEach } from "vitest";
+import { describe, it, expect, afterEach, afterAll, vi } from "vitest";
 import fs from "fs";
 import path from "path";
+import ts from "typescript";
+import slothlet from "@cldmv/slothlet";
 import { generateTypes } from "@cldmv/slothlet/processors/type-generator";
 import { withSuppressedSlothletErrorOutput } from "../../setup/vitest-helper.mjs";
+import { makeTestTmpDir } from "../../setup/test-fixtures-tmp.mjs";
+
+// The real-instance cases compile a probe against the generated declaration (a full TypeScript program
+// over slothlet's own declarations), which runs well past vitest's default budget under load.
+vi.setConfig({ testTimeout: 120000, hookTimeout: 120000 });
 
 // ---------------------------------------------------------------------------
 // Shared fixtures
@@ -76,6 +83,68 @@ function buildMockAPI() {
 	};
 }
 
+// ---------------------------------------------------------------------------
+// Real-instance helpers (a composed api built from a small fixture written to a test tmp dir)
+// ---------------------------------------------------------------------------
+
+const fixtureRoots = [];
+
+afterAll(() => {
+	for (const root of fixtureRoots) fs.rmSync(root, { recursive: true, force: true });
+});
+
+/**
+ * Write `files` into `<tmp>/api`, compose them with slothlet (eager), and generate types for that live
+ * instance into `<tmp>/api.d.mts`.
+ * @param {Record<string, string>} files - File name → source.
+ * @param {string} [interfaceName="TestAPI"] - Generated interface name.
+ * @returns {Promise<{output: string, outputPath: string}>} The declaration and where it was written.
+ */
+async function generateForFixture(files, interfaceName = "TestAPI") {
+	const root = await makeTestTmpDir("type-generator");
+	fixtureRoots.push(root);
+	const apiDir = path.join(root, "api");
+	fs.mkdirSync(apiDir, { recursive: true });
+	for (const [name, source] of Object.entries(files)) {
+		fs.writeFileSync(path.join(apiDir, name), source, "utf8");
+	}
+	const outputPath = path.join(root, "api.d.mts");
+	const api = await slothlet({ base: apiDir, mode: "eager", silent: true });
+	try {
+		const { output } = await generateTypes(api, { output: outputPath, interfaceName });
+		return { output, outputPath };
+	} finally {
+		await api.slothlet.shutdown();
+	}
+}
+
+/**
+ * Compile a probe (importing `self`) against a generated declaration and return every diagnostic outside
+ * node_modules. Empty means the probe's calls type-check and each `@ts-expect-error` line is a real error.
+ * @param {string} dtsPath - Generated declaration.
+ * @param {string[]} probeLines - Probe body lines (after the `self` import).
+ * @returns {Promise<string[]>} Diagnostic messages.
+ */
+async function probeDiagnostics(dtsPath, probeLines) {
+	const probePath = path.join(path.dirname(dtsPath), "probe.mts");
+	fs.writeFileSync(probePath, ['import { self } from "@cldmv/slothlet/runtime";', ...probeLines, ""].join("\n"), "utf8");
+	const program = ts.createProgram([dtsPath, probePath], {
+		noEmit: true,
+		skipLibCheck: false,
+		strict: true,
+		allowJs: true,
+		target: ts.ScriptTarget.ES2022,
+		module: ts.ModuleKind.NodeNext,
+		moduleResolution: ts.ModuleResolutionKind.NodeNext,
+		customConditions: ["slothlet-dev"],
+		types: ["node"]
+	});
+	return ts
+		.getPreEmitDiagnostics(program)
+		.filter((d) => !d.file || !d.file.fileName.includes(`${path.sep}node_modules${path.sep}`))
+		.map((d) => ts.flattenDiagnosticMessageText(d.messageText, "\n"));
+}
+
 // ---------------------------------------------------------------------------
 // Tmp directory helpers
 // ---------------------------------------------------------------------------
@@ -179,7 +248,7 @@ describe("generateTypes – direct unit tests", () => {
 			expect(output).toContain("export interface MySlothletAPI");
 		});
 
-		it("should include the 'declare const self' line", async () => {
+		it("should extend SlothletSelf from @cldmv/slothlet/runtime with the interface", async () => {
 			const outputPath = nextOutputPath();
 
 			const { output } = await generateTypes(buildMockAPI(), {
@@ -187,7 +256,9 @@ describe("generateTypes – direct unit tests", () => {
 				interfaceName: "MySlothletAPI"
 			});
 
-			expect(output).toContain("declare const self: MySlothletAPI");
+			expect(output).toContain('declare module "@cldmv/slothlet/runtime" {');
+			expect(output).toContain("interface SlothletSelf extends MySlothletAPI {}");
+			expect(output).not.toContain("declare const self");
 		});
 
 		it("should include a @generated header comment", async () => {
@@ -262,7 +333,7 @@ describe("generateTypes – direct unit tests", () => {
 			);
 
 			expect(output).toContain("export interface EmptyAPI");
-			expect(output).toContain("declare const self: EmptyAPI");
+			expect(output).toContain("interface SlothletSelf extends EmptyAPI {}");
 		});
 
 		it("should skip API keys starting with _ (private/internal)", async () => {
@@ -303,8 +374,7 @@ describe("generateTypes – direct unit tests", () => {
 		});
 
 		it("should handle functions with no __metadata (no filePath) without throwing", async () => {
-			// traverseAPI still collects these nodes; extractTypesFromFile is skipped.
-			// The function now appears with a generic (...args: any[]): any signature.
+			// traverseAPI still collects these nodes; a node slothlet did not compose has no module origin.
 			function plainFn() {}
 
 			const apiNoMeta = { plainFn };
@@ -317,8 +387,8 @@ describe("generateTypes – direct unit tests", () => {
 
 			// Generation must complete without error.
 			expect(output).toContain("export interface TestAPI");
-			// No filePath — falls back to generic signature.
-			expect(output).toContain("plainFn(...args: any[]): any");
+			// No module origin — typed unknown, with the explanatory comment.
+			expect(output).toMatch(/\/\*\* No module origin: [^\n]*\*\/\n\tplainFn: unknown;/);
 		});
 
 		it("should not recurse into circular references in the API", async () => {
@@ -331,9 +401,9 @@ describe("generateTypes – direct unit tests", () => {
 			await expect(generateTypes(circular, { output: outputPath, interfaceName: "TestAPI" })).resolves.not.toThrow();
 		});
 
-		it("should use generic signature when __metadata.filePath does not exist (catch branch)", async () => {
-			// Points to a file that doesn't exist — fs.readFileSync throws, catch returns { exports: [] }.
-			// No name match is possible so the function gets (...args: any[]): any.
+		it("should emit unknown when __metadata.filePath does not exist", async () => {
+			// Points to a file that doesn't exist — the path in __metadata is not a module origin, so the
+			// function is typed unknown rather than from any file, and generation does not throw.
 			function ghostFn() {}
 			ghostFn.__metadata = { filePath: "/nonexistent/path/that/does/not/exist.ts" };
 
@@ -348,8 +418,8 @@ describe("generateTypes – direct unit tests", () => {
 			);
 
 			expect(output).toContain("export interface TestAPI");
-			// ghostFn has no extracted exports (catch returned []) so falls back to generic.
-			expect(output).toContain("ghostFn(...args: any[]): any");
+			expect(output).toMatch(/\/\*\* No module origin: [^\n]*\*\/\n\tghostFn: unknown;/);
+			expect(output).not.toContain("does/not/exist");
 		});
 
 		it("should use 'any' fallback for untyped function parameters and return types", async () => {
@@ -404,43 +474,37 @@ describe("generateTypes – direct unit tests", () => {
 		/** Absolute path to the arrow-functions.ts API fixture. */
 		const arrowFilePath = path.resolve("api_tests/api_test_typescript_typegen/arrow-functions.ts");
 
-		it("should extract signatures from arrow function exports (export const fn = (...) => ...)", async () => {
-			function double(x) {
-				return x * 2;
-			}
-			double.__metadata = { filePath: arrowFilePath };
-
-			const outputPath = nextOutputPath();
-			const { output } = await generateTypes(
-				{ double },
-				{
-					output: outputPath,
-					interfaceName: "TestAPI"
-				}
-			);
+		it("should type arrow function exports (export const fn = (...) => ...)", async () => {
+			const { output, outputPath } = await generateForFixture({
+				"arrows.mjs":
+					"/**\n * @param {number} x\n * @returns {number}\n */\nexport const double = (x) => x * 2;\n\n/**\n * @param {boolean} value\n * @returns {boolean}\n */\nexport const negate = function (value) {\n\treturn !value;\n};\n"
+			});
 
-			// Arrow export `double` has a typed signature — must appear in the interface
-			expect(output).toContain("double");
-			expect(output).toContain("number");
+			// Arrow export `double` references its own export — and that export's type is number → number.
+			expect(output).toMatch(/double: typeof import\("\.\/api\/arrows\.mjs"\)\["double"\];/);
+			expect(
+				await probeDiagnostics(outputPath, [
+					"export const doubled: number = self.arrows.double(2);",
+					"// @ts-expect-error x is a number",
+					'self.arrows.double("2");'
+				])
+			).toEqual([]);
 		});
 
-		it("should extract signatures from function expression exports (export const fn = function(...))", async () => {
-			function negate(value) {
-				return !value;
-			}
-			negate.__metadata = { filePath: arrowFilePath };
-
-			const outputPath = nextOutputPath();
-			const { output } = await generateTypes(
-				{ negate },
-				{
-					output: outputPath,
-					interfaceName: "TestAPI"
-				}
-			);
+		it("should type function expression exports (export const fn = function(...))", async () => {
+			const { output, outputPath } = await generateForFixture({
+				"arrows.mjs":
+					"/**\n * @param {number} x\n * @returns {number}\n */\nexport const double = (x) => x * 2;\n\n/**\n * @param {boolean} value\n * @returns {boolean}\n */\nexport const negate = function (value) {\n\treturn !value;\n};\n"
+			});
 
-			expect(output).toContain("negate");
-			expect(output).toContain("boolean");
+			expect(output).toMatch(/negate: typeof import\("\.\/api\/arrows\.mjs"\)\["negate"\];/);
+			expect(
+				await probeDiagnostics(outputPath, [
+					"export const negated: boolean = self.arrows.negate(true);",
+					"// @ts-expect-error value is a boolean",
+					"self.arrows.negate(1);"
+				])
+			).toEqual([]);
 		});
 
 		it("should include all arrow-function exports from a file alongside function declarations", async () => {
@@ -475,52 +539,33 @@ describe("generateTypes – direct unit tests", () => {
 	});
 
 	describe("Correct name-based signature matching", () => {
-		it("should assign each function its own signature, not the first export's", async () => {
-			// math.ts exports: add(a, b): number   subtract(a, b): number   multiply(a, b): number
-			// Previously the generator used exports[0] for all — every function got add's signature.
-			function mockAdd(a, b) {
-				return a + b;
-			}
-			mockAdd.__metadata = { filePath: mathFilePath };
-
-			function mockSubtract(a, b) {
-				return a - b;
-			}
-			mockSubtract.__metadata = { filePath: mathFilePath };
-
-			function mockMultiply(a, b) {
-				return a * b;
-			}
-			mockMultiply.__metadata = { filePath: mathFilePath };
-
-			const outputPath = nextOutputPath();
-			const { output } = await generateTypes(
-				{ add: mockAdd, subtract: mockSubtract, multiply: mockMultiply },
-				{
-					output: outputPath,
-					interfaceName: "MathAPI"
-				}
-			);
-
-			// All three names must appear
-			expect(output).toContain("add");
-			expect(output).toContain("subtract");
-			expect(output).toContain("multiply");
-
-			// Each must have the correct signature — math.ts uses `number` everywhere
-			// Previously subtract and multiply would get add's signature; now each matches by name
-			const addLine = output.split("\n").find((l) => l.includes("add("));
-			const subtractLine = output.split("\n").find((l) => l.includes("subtract("));
-			const multiplyLine = output.split("\n").find((l) => l.includes("multiply("));
+		it("should assign each function its own type, not the first export's", async () => {
+			// Three exports of one file with three different signatures: each api member must reference
+			// its own export — previously every function could inherit the first export's signature.
+			const { output, outputPath } = await generateForFixture({
+				"calc.mjs":
+					"/**\n * @param {number} a\n * @param {number} b\n * @returns {number}\n */\nexport function add(a, b) {\n\treturn a + b;\n}\n\n/**\n * @param {string} text\n * @returns {string}\n */\nexport function label(text) {\n\treturn text;\n}\n\n/**\n * @param {boolean} on\n * @returns {boolean}\n */\nexport function toggle(on) {\n\treturn !on;\n}\n"
+			});
 
-			expect(addLine).toContain("add(");
-			expect(subtractLine).toContain("subtract(");
-			expect(multiplyLine).toContain("multiply(");
+			expect(output).toMatch(/add: typeof import\("\.\/api\/calc\.mjs"\)\["add"\];/);
+			expect(output).toMatch(/label: typeof import\("\.\/api\/calc\.mjs"\)\["label"\];/);
+			expect(output).toMatch(/toggle: typeof import\("\.\/api\/calc\.mjs"\)\["toggle"\];/);
+			expect(
+				await probeDiagnostics(outputPath, [
+					"export const sum: number = self.calc.add(1, 2);",
+					'export const text: string = self.calc.label("x");',
+					"export const flipped: boolean = self.calc.toggle(true);",
+					"// @ts-expect-error label takes a string, not add's numbers",
+					"self.calc.label(1);",
+					"// @ts-expect-error toggle takes a boolean",
+					'self.calc.toggle("on");'
+				])
+			).toEqual([]);
 		});
 
-		it("should use a generic (...args: any[]): any signature when no export name matches the API key", async () => {
-			// API exposes the function as 'sum' but math.ts only exports 'add', 'subtract', 'multiply'.
-			// Should not steal add's signature — must fall back to the safe generic.
+		it("should emit unknown when the api key has no module origin, not borrow another export's type", async () => {
+			// API exposes the function as 'sum', and it carries a filePath to math.ts — but a node slothlet
+			// did not compose has no module origin, so nothing is matched by name against that file.
 			function sum(a, b) {
 				return a + b;
 			}
@@ -535,36 +580,36 @@ describe("generateTypes – direct unit tests", () => {
 				}
 			);
 
-			// Must appear with the safe generic signature, not add's (a: number, b: number): number
-			expect(output).toContain("sum(...args: any[]): any");
-			// Must NOT have stolen add's typed signature
-			expect(output).not.toContain("sum(a: number");
+			// Typed unknown with the explanatory comment, never another export's type.
+			expect(output).toMatch(/\/\*\* No module origin: [^\n]*\*\/\n\tsum: unknown;/);
+			expect(output).not.toContain("typeof import");
 		});
 	});
 });
 
-// ─── traverseAPI — primitive value (L141 arm1: else-if skipped) ──────────────
-
-describe("traverseAPI — primitive value in API skipped by both branches (L141 arm1)", () => {
-	it("does not include primitive values (number) in generated output", async () => {
-		// traverseAPI: `typeof value === "function"` → false, `typeof value === "object"` → false
-		// → neither branch fires for the primitive → arm1 of L141 else-if is hit
-		const apiWithPrimitive = {
-			count: 42,
-			label: "hello",
-			flag: true
-		};
+// ─── traverseAPI — primitive values are typed from their export ──────────────
 
-		const outputPath = nextOutputPath();
-		const { output } = await generateTypes(apiWithPrimitive, {
-			output: outputPath,
-			interfaceName: "PrimitiveAPI"
-		});
+describe("traverseAPI — primitive value in API typed from its export", () => {
+	it("types primitive values (number) from their export in generated output", async () => {
+		const { output, outputPath } = await generateForFixture(
+			{
+				"counts.mjs": 'export const count = 42;\nexport const label = "hello";\nexport const flag = true;\n'
+			},
+			"PrimitiveAPI"
+		);
 
-		// Primitives are silently skipped — they don't appear in the interface
 		expect(output).toContain("export interface PrimitiveAPI");
-		expect(output).not.toContain("count");
-		expect(output).not.toContain("label");
+		expect(output).toMatch(/count: typeof import\("\.\/api\/counts\.mjs"\)\["count"\];/);
+		expect(output).toMatch(/label: typeof import\("\.\/api\/counts\.mjs"\)\["label"\];/);
+		expect(output).toMatch(/flag: typeof import\("\.\/api\/counts\.mjs"\)\["flag"\];/);
+		expect(
+			await probeDiagnostics(outputPath, [
+				"export const count: 42 = self.counts.count;",
+				'export const label: "hello" = self.counts.label;',
+				"// @ts-expect-error count is the number literal 42",
+				"export const wrong: string = self.counts.count;"
+			])
+		).toEqual([]);
 	});
 });
 
diff --git a/tests/vitests/suites/typescript/typescript-strict-mode.test.vitest.mjs b/tests/vitests/suites/typescript/typescript-strict-mode.test.vitest.mjs
index 15165877f..06da8d994 100644
--- a/tests/vitests/suites/typescript/typescript-strict-mode.test.vitest.mjs
+++ b/tests/vitests/suites/typescript/typescript-strict-mode.test.vitest.mjs
@@ -159,7 +159,7 @@ describe("TypeScript Strict Mode with Type Generation", () => {
 			expect(content).toContain("capitalize");
 		});
 
-		it("should declare self constant with interface type", async () => {
+		it("should type self by extending SlothletSelf with the interface", async () => {
 			api = await slothlet({
 				base: "./api_tests/api_test_typescript",
 				typescript: {
@@ -172,7 +172,8 @@ describe("TypeScript Strict Mode with Type Generation", () => {
 			});
 
 			const content = fs.readFileSync(outputPath, "utf8");
-			expect(content).toContain("declare const self: TestAPI");
+			expect(content).toContain('declare module "@cldmv/slothlet/runtime"');
+			expect(content).toContain("interface SlothletSelf extends TestAPI {}");
 		});
 	});
 
diff --git a/types/index.d.mts b/types/index.d.mts
index bd6a42882..34ea12155 100644
--- a/types/index.d.mts
+++ b/types/index.d.mts
@@ -1,12 +1,28 @@
 export default slothlet;
+/**
+ * The framework surface of a composed api: `api.slothlet.*`, `api.shutdown()`, `api.destroy()`.
+ * `slothlet typegen` output extends `SlothletSelf` with it, so `self.slothlet.*` is typed too.
+ */
+export type SlothletAPI = import("./src/slothlet.mjs").SlothletAPI;
+/**
+ * The framework surface of a composed api: `api.slothlet.*`, `api.shutdown()`, `api.destroy()`.
+ * `slothlet typegen` output extends `SlothletSelf` with it, so `self.slothlet.*` is typed too.
+ * @typedef {import("./src/slothlet.mjs").SlothletAPI} SlothletAPI
+ */
 /**
  * Creates a slothlet API instance with live-binding context and AsyncLocalStorage support.
  * Automatically wraps all API functions with context isolation for multi-instance support.
+ *
+ * The resolved api is typed as `SlothletAPI & T`. `T` defaults to `SlothletSelf` from
+ * `@cldmv/slothlet/runtime`, which a `slothlet typegen` declaration extends with the project's api —
+ * so a project with generated types gets a typed api with no annotation. A program that loads more
+ * than one api passes the interface explicitly: `slothlet<OtherApi>({ base: "./other" })`.
  * @public
  * @async
  *
+ * @template {object} [T=import("./src/lib/runtime/runtime.mjs").SlothletSelf]
  * @param {import("./src/slothlet.mjs").SlothletOptions} [options={}] - Configuration options for the slothlet instance. See {@link SlothletOptions} for the full set.
- * @returns {Promise<import("./src/slothlet.mjs").SlothletAPI>} The bound API object with management methods
+ * @returns {Promise<import("./src/slothlet.mjs").SlothletAPI & T>} The bound API object with management methods
  *
  * @example // ESM
  * import slothlet from "@cldmv/slothlet";
@@ -14,7 +30,7 @@ export default slothlet;
  * const result = await api.math.add(2, 3); // 5
  *
  */
-export function slothlet(options?: import("./src/slothlet.mjs").SlothletOptions): Promise<import("./src/slothlet.mjs").SlothletAPI>;
+export function slothlet<T extends object = import("./src/lib/runtime/runtime.mjs").SlothletSelf>(options?: import("./src/slothlet.mjs").SlothletOptions): Promise<import("./src/slothlet.mjs").SlothletAPI & T>;
 export namespace slothlet {
     let defaults: Readonly<{
         routines: readonly (Readonly<{
diff --git a/types/index.d.mts.map b/types/index.d.mts.map
index be3f1197d..79009d5b6 100644
--- a/types/index.d.mts.map
+++ b/types/index.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../index.mjs"],"names":[],"mappings":";AA0GA;;;;;;;;;;;;;;GAcG;AACH,mCATW,OAAO,oBAAoB,EAAE,eAAe,GAC1C,OAAO,CAAC,OAAO,oBAAoB,EAAE,WAAW,CAAC,CAkB7D"}
\ No newline at end of file
+{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../index.mjs"],"names":[],"mappings":";;;;;0BA6Ga,OAAO,oBAAoB,EAAE,WAAW;AAHrD;;;;GAIG;AAEH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,yBAVuB,CAAC,SAAX,MAAQ,mEACV,OAAO,oBAAoB,EAAE,eAAe,GAC1C,OAAO,CAAC,OAAO,oBAAoB,EAAE,WAAW,GAAG,CAAC,CAAC,CAkBjE"}
\ No newline at end of file
diff --git a/types/src/lib/builders/modes-processor.d.mts.map b/types/src/lib/builders/modes-processor.d.mts.map
index 8530f6c7c..342a9bf38 100644
--- a/types/src/lib/builders/modes-processor.d.mts.map
+++ b/types/src/lib/builders/modes-processor.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"modes-processor.d.mts","sourceRoot":"","sources":["../../../../src/lib/builders/modes-processor.mjs"],"names":[],"mappings":"AA8BA;;;;;;GAMG;AAKH;IACC,gCAA2C;IAC3C;;;;OAIG;IACH,sBAFW,MAAM,EAIhB;IAmLD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,kBAlBW,MAAM,SACN,KAAK,CAAC,MAAM,CAAC,aACb;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE;YAAC,KAAK,QAAQ;YAAC,WAAW,QAAO;SAAC,CAAA;KAAC,gBAC3E,MAAM,QACN,MAAM,UACN,OAAO,aACP,OAAO,qBACP,OAAO,kBACP,MAAM,qBACN,MAAM,aACN,MAAM,GAAC,IAAI,iBACX,MAAM,GAAC,IAAI,cACX,MAAM,GAAC,IAAI,0BACX,MAAM,GAAC,IAAI,eACX,OAAO,GACL,OAAO,CAAC,WAAS,IAAI,CAAC,CA2zDlC;IACD;;;;;;;;;;;;OAYG;IACH,0CAXW,MAAM,WACN,MAAM,aACN,MAAM,iBACN,MAAM,cACN,GAAC,4BACD,MAAM,kBACN,MAAM,qBACN,MAAM,oBAqahB;IACD;;;;;;;;OAQG;IACH,iCAPW,MAAM,gBACN,WAAS,IAAI,QAEb,MAAM,GACJ,OAAO,CAAC,MAAM,WAAS,CAAC,CAoBpC;;CACD;8BAl+E6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"modes-processor.d.mts","sourceRoot":"","sources":["../../../../src/lib/builders/modes-processor.mjs"],"names":[],"mappings":"AA8BA;;;;;;GAMG;AAKH;IACC,gCAA2C;IAC3C;;;;OAIG;IACH,sBAFW,MAAM,EAIhB;IAmLD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,kBAlBW,MAAM,SACN,KAAK,CAAC,MAAM,CAAC,aACb;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE;YAAC,KAAK,QAAQ;YAAC,WAAW,QAAO;SAAC,CAAA;KAAC,gBAC3E,MAAM,QACN,MAAM,UACN,OAAO,aACP,OAAO,qBACP,OAAO,kBACP,MAAM,qBACN,MAAM,aACN,MAAM,GAAC,IAAI,iBACX,MAAM,GAAC,IAAI,cACX,MAAM,GAAC,IAAI,0BACX,MAAM,GAAC,IAAI,eACX,OAAO,GACL,OAAO,CAAC,WAAS,IAAI,CAAC,CA+0DlC;IACD;;;;;;;;;;;;OAYG;IACH,0CAXW,MAAM,WACN,MAAM,aACN,MAAM,iBACN,MAAM,cACN,GAAC,4BACD,MAAM,kBACN,MAAM,qBACN,MAAM,oBAuahB;IACD;;;;;;;;OAQG;IACH,iCAPW,MAAM,gBACN,WAAS,IAAI,QAEb,MAAM,GACJ,OAAO,CAAC,MAAM,WAAS,CAAC,CAoBpC;;CACD;8BAx/E6B,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/lib/handlers/ownership.d.mts b/types/src/lib/handlers/ownership.d.mts
index 53b913fd5..75d90199f 100644
--- a/types/src/lib/handlers/ownership.d.mts
+++ b/types/src/lib/handlers/ownership.d.mts
@@ -21,6 +21,154 @@ export class OwnershipManager extends ComponentBase {
     pathToModule: Map<any, any>;
     _unregisteredModules: Set<any>;
     moduleEndpoints: Map<any, any>;
+    exportIndex: Map<any, any>;
+    cloneSources: WeakMap<object, any>;
+    /**
+     * Index where each value of a freshly loaded module sits in that module's namespace (#484).
+     * @param {string} filePath - Absolute path of the loaded file.
+     * @param {object} mod - The module namespace as loaded (`import()` result, or the CJS loader's
+     *   `{ default: module.exports, ...ownKeys }` namespace).
+     * @returns {void}
+     * @public
+     *
+     * @description
+     * Wrappers built from this file later look their impl up here to learn their `exportPath` — the
+     * access path within the namespace that produced the value (`["add"]`, `["default"]`,
+     * `["default", "member"]`). A named export wins over the same value reached through `default`.
+     * For a CommonJS module every path is rooted at `["default"]` (`module.exports`), since the
+     * named keys a CommonJS namespace carries are copies of `module.exports`' own keys.
+     *
+     * @example
+     * ownership.indexModuleExports("/abs/api/math.mjs", await import("/abs/api/math.mjs"));
+     */
+    public indexModuleExports(filePath: string, mod: object): void;
+    /**
+     * Whether `filePath` was loaded as a CommonJS module (its exports are `module.exports`) (#484).
+     * @param {string} filePath - Absolute path of a loaded file.
+     * @returns {boolean} True for a CommonJS module; false for ES modules and files never indexed.
+     * @public
+     *
+     * @example
+     * ownership.isCommonJSModule("/abs/api/text.cjs"); // true
+     */
+    public isCommonJSModule(filePath: string): boolean;
+    /**
+     * Record the per-key origins of a value composed from a module's exports (#484).
+     * @param {string} filePath - Absolute path of the file the content was built from.
+     * @param {object|Function} content - The composed content (a fresh namespace object, or a default
+     *   export the named exports were attached onto).
+     * @param {Object<string, string[]>|null} members - Composed key → the exportPath it came from.
+     * @param {string[]|null} [self=null] - The content's own exportPath, when it is itself an export.
+     * @returns {void}
+     * @public
+     *
+     * @description
+     * Flattening merges a module's default and named exports into one content value, so a key's
+     * position under that content no longer tells where it came from. Recording the map lets a
+     * wrapper built from the content hand each child — including a primitive child, which has no
+     * identity to look up — its real exportPath.
+     *
+     * @example
+     * ownership.recordComposedContent(file, content, { add: ["add"], VERSION: ["VERSION"] });
+     */
+    public recordComposedContent(filePath: string, content: object | Function, members: {
+        [x: string]: string[];
+    } | null, self?: string[] | null): void;
+    /**
+     * Remember that `clone` was cloned from `original`, so an origin lookup sees through the clone.
+     * @param {*} clone - The clone.
+     * @param {*} original - The value it was cloned from.
+     * @returns {void}
+     * @public
+     *
+     * @example
+     * ownership.noteClone(copy, exported);
+     */
+    public noteClone(clone: any, original: any): void;
+    /**
+     * Look up where `value` sits in the module namespace of `filePath` (#484).
+     * @param {string|null} filePath - File the value was loaded from.
+     * @param {*} value - The value (or an eager-mode clone of it).
+     * @returns {string[]|null} The exportPath, or `null` when the value is not a known export of that file.
+     * @public
+     *
+     * @example
+     * ownership.resolveExportPath("/abs/api/math.mjs", addFn); // ["add"]
+     */
+    public resolveExportPath(filePath: string | null, value: any): string[] | null;
+    /**
+     * Look up an export of `filePath` by the NAME it was placed under, confirmed by value (#484).
+     * @param {string|null} filePath - File the value was loaded from.
+     * @param {string} key - The key the value sits under in the composed api.
+     * @param {*} value - The value itself; must be the value that export held (`Object.is`).
+     * @returns {string[]|null} The exportPath, or `null` when `filePath` has no export of that name
+     *   holding that value.
+     * @public
+     *
+     * @description
+     * For a value with no identity to look up — a primitive — merged into a namespace that several
+     * files compose (a folder whose files flatten into it), where no per-key map was recorded for the
+     * namespace itself. The value check keeps a same-named but different value from borrowing the path.
+     *
+     * @example
+     * ownership.resolveExportPathByKey("/abs/api/tuning/tuning.mjs", "TUNE_STEP", 5); // ["TUNE_STEP"]
+     */
+    public resolveExportPathByKey(filePath: string | null, key: string, value: any): string[] | null;
+    /**
+     * Look up the per-key origins recorded for a composed content value (#484).
+     * @param {string|null} filePath - File the content was built from.
+     * @param {*} value - The content (or an eager-mode clone of it).
+     * @returns {Object<string, string[]>|null} Composed key → exportPath, or `null`.
+     * @public
+     *
+     * @example
+     * ownership.resolveMemberExportPaths(file, content); // { add: ["add"] }
+     */
+    public resolveMemberExportPaths(filePath: string | null, value: any): {
+        [x: string]: string[];
+    } | null;
+    /**
+     * Read where the value currently at `apiPath` came from (#484).
+     * @param {string} apiPath - API path to look up.
+     * @returns {{moduleID: string, filePath: (string|null), exportPath: (string[]|null), members: (Object<string, string[]>|null)}|null}
+     *   The current owner's origin, or `null` when nothing owns the path.
+     * @public
+     *
+     * @description
+     * `exportPath` is the access path within `filePath`'s module namespace that produced the value;
+     * `null` when the value has no module origin (a runtime `self.X = value`, a synthetic in-memory
+     * `api.add()`, a namespace container slothlet created). `members` carries per-key origins for a
+     * value composed from several exports.
+     *
+     * @example
+     * ownership.getOrigin("math.add"); // { moduleID, filePath: "/abs/api/math.mjs", exportPath: ["add"], members: null }
+     */
+    public getOrigin(apiPath: string): {
+        moduleID: string;
+        filePath: (string | null);
+        exportPath: (string[] | null);
+        members: ({
+            [x: string]: string[];
+        } | null);
+    } | null;
+    /**
+     * Refresh the origin recorded for a module's entry at `apiPath` without touching its position,
+     * source, or collision state — for a wrapper whose impl arrived after it was registered (lazy
+     * materialization, hot reload).
+     * @param {string} moduleID - Module whose entry to refresh.
+     * @param {string} apiPath - API path of the entry.
+     * @param {{filePath?: (string|null), exportPath?: (string[]|null), memberExportPaths?: (Object|null)}} origin - New origin.
+     * @returns {void}
+     * @public
+     *
+     * @example
+     * ownership.refreshOrigin("base", "math.add", { filePath, exportPath: ["add"] });
+     */
+    public refreshOrigin(moduleID: string, apiPath: string, origin: {
+        filePath?: (string | null);
+        exportPath?: (string[] | null);
+        memberExportPaths?: (Object | null);
+    }): void;
     /**
      * Record a module's mount endpoint (the apiPath it was loaded/added at).
      * This is the module's ownership root — the subtree it is allowed to write
@@ -48,10 +196,15 @@ export class OwnershipManager extends ComponentBase {
      * @param {string} [options.collisionMode="error"] - Collision mode: skip, warn, error, merge, replace
      * @param {Object} [options.config] - Config object for silent mode check
      * @param {string} [options.filePath=null] - File path of the module source (for metadata tracking)
+     * @param {string[]|null} [options.exportPath=null] - Access path within `filePath`'s module namespace
+     *   that produced `value` (`["add"]`, `["default"]`, `["default", "member"]`); `null` when the value
+     *   has no module origin (#484).
+     * @param {Object<string, string[]>|null} [options.memberExportPaths=null] - Per-key exportPaths for a
+     *   value composed from several exports (#484).
      * @returns {Object|null} Registration entry or null if skipped
      * @public
      */
-    public register({ moduleID, apiPath, value, source, collisionMode, config, filePath }: {
+    public register({ moduleID, apiPath, value, source, collisionMode, config, filePath, exportPath, memberExportPaths }: {
         moduleID: string;
         apiPath: string;
         value: any;
@@ -59,6 +212,10 @@ export class OwnershipManager extends ComponentBase {
         collisionMode?: string | undefined;
         config?: Object | undefined;
         filePath?: string | undefined;
+        exportPath?: string[] | null | undefined;
+        memberExportPaths?: {
+            [x: string]: string[];
+        } | null | undefined;
     }): Object | null;
     /**
      * @param {string} moduleID - Module to unregister.
@@ -209,7 +366,7 @@ export class OwnershipManager extends ComponentBase {
     /**
      * Snapshot the entries moduleID currently owns, keyed by apiPath, for later restoration
      * @param {string} moduleID - Module identifier to snapshot.
-     * @returns {Map<string, {value: *, filePath: (string|null), source: string, isMergeLoss: boolean}>}
+     * @returns {Map<string, {value: *, filePath: (string|null), exportPath: (string[]|null), memberExportPaths: (Object|null), source: string, isMergeLoss: boolean}>}
      *   One entry per apiPath the module currently owns, capturing exactly the fields a duplicate
      *   registration can overwrite.
      * @public
@@ -225,6 +382,8 @@ export class OwnershipManager extends ComponentBase {
     public snapshotModuleEntries(moduleID: string): Map<string, {
         value: any;
         filePath: (string | null);
+        exportPath: (string[] | null);
+        memberExportPaths: (Object | null);
         source: string;
         isMergeLoss: boolean;
     }>;
@@ -233,7 +392,7 @@ export class OwnershipManager extends ComponentBase {
      * overwrite without changing its position in the ownership stack
      * @param {string} moduleID - Module identifier.
      * @param {string} apiPath - API path whose entry to restore.
-     * @param {{value: *, filePath: (string|null), source: string, isMergeLoss: boolean}} snapshot -
+     * @param {{value: *, filePath: (string|null), exportPath?: (string[]|null), memberExportPaths?: (Object|null), source: string, isMergeLoss: boolean}} snapshot -
      *   Prior field values, from {@link OwnershipManager#snapshotModuleEntries}.
      * @returns {void}
      * @public
@@ -244,6 +403,8 @@ export class OwnershipManager extends ComponentBase {
     public restoreEntry(moduleID: string, apiPath: string, snapshot: {
         value: any;
         filePath: (string | null);
+        exportPath?: (string[] | null);
+        memberExportPaths?: (Object | null);
         source: string;
         isMergeLoss: boolean;
     }): void;
@@ -252,7 +413,7 @@ export class OwnershipManager extends ComponentBase {
      * {@link OwnershipManager#snapshotModuleEntries}, for an internal candidate's own revert.
      * @param {string} apiPath - Full api path the candidate is about to (re-)contribute to.
      * @param {string} moduleID - Module identifier making the contribution.
-     * @returns {{value: *, filePath: (string|null), source: string, isMergeLoss: boolean}|undefined}
+     * @returns {{value: *, filePath: (string|null), exportPath: (string[]|null), memberExportPaths: (Object|null), source: string, isMergeLoss: boolean}|undefined}
      *   The prior entry's snapshot, or `undefined` if none exists yet.
      * @public
      *
@@ -279,6 +440,8 @@ export class OwnershipManager extends ComponentBase {
     public snapshotPathEntry(apiPath: string, moduleID: string): {
         value: any;
         filePath: (string | null);
+        exportPath: (string[] | null);
+        memberExportPaths: (Object | null);
         source: string;
         isMergeLoss: boolean;
     } | undefined;
diff --git a/types/src/lib/handlers/ownership.d.mts.map b/types/src/lib/handlers/ownership.d.mts.map
index 53967c2f7..4e2066e76 100644
--- a/types/src/lib/handlers/ownership.d.mts.map
+++ b/types/src/lib/handlers/ownership.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"ownership.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/ownership.mjs"],"names":[],"mappings":"AAsGA;;;;;GAKG;AAEH;;;;;GAKG;AACH;IACC,gCAAsC;IAEtC;;;OAGG;IACH,sBAFW,MAAM,EAQhB;IAJA,4BAA6B;IAC7B,4BAA6B;IAC7B,+BAAqC;IACrC,+BAAgC;IAGjC;;;;;;;;OAQG;IACH,mCALW,MAAM,YACN,MAAM,GACJ,IAAI,CAUhB;IAED;;;;;OAKG;IACH,mCAJW,MAAM,GACJ,MAAM,GAAC,SAAS,CAK5B;IAED;;;;;;;;;;;;OAYG;IACH,uFAVG;QAAwB,QAAQ,EAAxB,MAAM;QACU,OAAO,EAAvB,MAAM;QACK,KAAK,EAAhB,GAAC;QACgB,MAAM;QACN,aAAa;QACb,MAAM;QACN,QAAQ;KACjC,GAAU,MAAM,GAAC,IAAI,CAmMvB;IA2BD;;;;;;;;;;OAUG;IACH,4BAVW,MAAM,GACJ,gBAAgB,CAuC5B;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,kCAtBW,MAAM,GACJ,IAAI,CAwBhB;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,mCApBW,MAAM,GACJ,IAAI,CAqBhB;IAED;;;;;;;;;;;;;OAaG;IACH,2BAbW,MAAM,aACN,MAAM,GAAC,IAAI,GACT;QAAE,MAAM,EAAE,QAAQ,GAAC,MAAM,GAAC,SAAS,CAAC;QAAC,eAAe,EAAE,MAAM,GAAC,IAAI,CAAC;QAC5E,eAAe,EAAE,MAAM,GAAC,IAAI,CAAA;KAAE,CAgDhC;IAED;;;;;OAKG;IACH,gCAJW,MAAM,GACJ,MAAM,GAAC,IAAI,CAevB;IAED;;;;;OAKG;IACH,gCAJW,MAAM,GACJ,GAAC,CAkBb;IAED;;;;;OAKG;IACH,gCAJW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAKzB;IAED;;;;;OAKG;IACH,+BAJW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAKzB;IAED;;;;;;OAMG;IACH,0BALW,MAAM,WACN,MAAM,GACJ,OAAO,CAMnB;IAED;;;;OAIG;IACH,yBAHa,MAAM,CAkBlB;IAED;;;;;OAKG;IACH,iCAJW,MAAM,GACJ,GAAG,CAAC,MAAM,CAAC,GAAC,IAAI,CAS5B;IAED;;;;;;;;;;;;;;;OAeG;IACH,4BAdW,MAAM,YACN,MAAM,QACN,MAAM,2BAEJ,IAAI,CA+DhB;IAED;;;;;;;;;;;;;;;OAeG;IACH,uCAdW,MAAM,GACJ,GAAG,CAAC,MAAM,EAAE;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,CAAC,CA0BlG;IAED;;;;;;;;;;;;OAYG;IACH,8BAVW,MAAM,WACN,MAAM,YACN;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,GAEvE,IAAI,CAahB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,kCA1BW,MAAM,YACN,MAAM,GACJ;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,GAAC,SAAS,CA4B/F;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,qCA5BW,MAAM,YACN,MAAM,QACN,MAAM,gBACN,GAAG,CAAC,MAAM,EAAE;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAC,CAAC,2BAI9D,IAAI,CAmEhB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,wCA3BW,MAAM,gBACN,GAAG,CAAC,MAAM,EAAE;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,CAAC,GAGpF,IAAI,CAgChB;IAED;;;OAGG;IACH,qBAKC;IAED;;;;OAIG;IACH,sBAHa,MAAM,CAQlB;IAED;;;;OAIG;IACH,0BAHW,MAAM,QAgBhB;;CACD;;;;;;;;aAr2Ba,MAAM,EAAE;;;;gBACR,MAAM,EAAE;;8BAxFQ,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"ownership.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/ownership.mjs"],"names":[],"mappings":"AAyLA;;;;;GAKG;AAEH;;;;;GAKG;AACH;IACC,gCAAsC;IAEtC;;;OAGG;IACH,sBAFW,MAAM,EAahB;IATA,4BAA6B;IAC7B,4BAA6B;IAC7B,+BAAqC;IACrC,+BAAgC;IAGhC,2BAA4B;IAE5B,mCAAiC;IAGlC;;;;;;;;;;;;;;;;;OAiBG;IACH,oCAhBW,MAAM,OACN,MAAM,GAEJ,IAAI,CA6DhB;IAED;;;;;;;;OAQG;IACH,kCAPW,MAAM,GACJ,OAAO,CAQnB;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,uCAjBW,MAAM,WACN,MAAM,WAAS,WAEf;YAAO,MAAM,GAAE,MAAM,EAAE;KAAC,GAAC,IAAI,SAC7B,MAAM,EAAE,GAAC,IAAI,GACX,IAAI,CAoBhB;IAED;;;;;;;;;OASG;IACH,wBARW,GAAC,YACD,GAAC,GACC,IAAI,CAQhB;IAED;;;;;;;;;OASG;IACH,mCARW,MAAM,GAAC,IAAI,SACX,GAAC,GACC,MAAM,EAAE,GAAC,IAAI,CASzB;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,wCAfW,MAAM,GAAC,IAAI,OACX,MAAM,SACN,GAAC,GACC,MAAM,EAAE,GAAC,IAAI,CAgBzB;IAED;;;;;;;;;OASG;IACH,0CARW,MAAM,GAAC,IAAI,SACX,GAAC,GACC;YAAO,MAAM,GAAE,MAAM,EAAE;KAAC,GAAC,IAAI,CAQzC;IAyBD;;;;;;;;;;;;;;;OAeG;IACH,0BAdW,MAAM,GACJ;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,UAAU,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;QAAC,OAAO,EAAE,CAAC;gBAAO,MAAM,GAAE,MAAM,EAAE;SAAC,GAAC,IAAI,CAAC,CAAA;KAAC,GAAC,IAAI,CAsBnI;IAED;;;;;;;;;;;;OAYG;IACH,+BATW,MAAM,WACN,MAAM,UACN;QAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;QAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAA;KAAC,GACzF,IAAI,CAYhB;IAED;;;;;;;;OAQG;IACH,mCALW,MAAM,YACN,MAAM,GACJ,IAAI,CAUhB;IAED;;;;;OAKG;IACH,mCAJW,MAAM,GACJ,MAAM,GAAC,SAAS,CAK5B;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,sHAfG;QAAwB,QAAQ,EAAxB,MAAM;QACU,OAAO,EAAvB,MAAM;QACK,KAAK,EAAhB,GAAC;QACgB,MAAM;QACN,aAAa;QACb,MAAM;QACN,QAAQ;QACD,UAAU;QAGM,iBAAiB;;;KAEjE,GAAU,MAAM,GAAC,IAAI,CA0NvB;IA2BD;;;;;;;;;;OAUG;IACH,4BAVW,MAAM,GACJ,gBAAgB,CAuC5B;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,kCAtBW,MAAM,GACJ,IAAI,CAwBhB;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,mCApBW,MAAM,GACJ,IAAI,CAqBhB;IAED;;;;;;;;;;;;;OAaG;IACH,2BAbW,MAAM,aACN,MAAM,GAAC,IAAI,GACT;QAAE,MAAM,EAAE,QAAQ,GAAC,MAAM,GAAC,SAAS,CAAC;QAAC,eAAe,EAAE,MAAM,GAAC,IAAI,CAAC;QAC5E,eAAe,EAAE,MAAM,GAAC,IAAI,CAAA;KAAE,CAgDhC;IAED;;;;;OAKG;IACH,gCAJW,MAAM,GACJ,MAAM,GAAC,IAAI,CAevB;IAED;;;;;OAKG;IACH,gCAJW,MAAM,GACJ,GAAC,CAkBb;IAED;;;;;OAKG;IACH,gCAJW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAKzB;IAED;;;;;OAKG;IACH,+BAJW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAKzB;IAED;;;;;;OAMG;IACH,0BALW,MAAM,WACN,MAAM,GACJ,OAAO,CAMnB;IAED;;;;OAIG;IACH,yBAHa,MAAM,CAkBlB;IAED;;;;;OAKG;IACH,iCAJW,MAAM,GACJ,GAAG,CAAC,MAAM,CAAC,GAAC,IAAI,CAS5B;IAED;;;;;;;;;;;;;;;OAeG;IACH,4BAdW,MAAM,YACN,MAAM,QACN,MAAM,2BAEJ,IAAI,CA+DhB;IAED;;;;;;;;;;;;;;;OAeG;IACH,uCAdW,MAAM,GACJ,GAAG,CAAC,MAAM,EAAE;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,UAAU,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;QAAC,iBAAiB,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,CAAC,CAiCjK;IAED;;;;;;;;;;;;OAYG;IACH,8BAVW,MAAM,WACN,MAAM,YACN;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;QAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,GAExI,IAAI,CAehB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,kCA1BW,MAAM,YACN,MAAM,GACJ;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,UAAU,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;QAAC,iBAAiB,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,GAAC,SAAS,CAmC9J;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,qCA5BW,MAAM,YACN,MAAM,QACN,MAAM,gBACN,GAAG,CAAC,MAAM,EAAE;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAC,CAAC,2BAI9D,IAAI,CAmEhB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,wCA3BW,MAAM,gBACN,GAAG,CAAC,MAAM,EAAE;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,CAAC,GAGpF,IAAI,CAgChB;IAED;;;OAGG;IACH,qBAMC;IAED;;;;OAIG;IACH,sBAHa,MAAM,CAQlB;IAED;;;;OAIG;IACH,0BAHW,MAAM,QAgBhB;;CACD;;;;;;;;aA9oCa,MAAM,EAAE;;;;gBACR,MAAM,EAAE;;8BA3KQ,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/lib/handlers/unified-wrapper.d.mts b/types/src/lib/handlers/unified-wrapper.d.mts
index 44de09ab7..8acf98b9b 100644
--- a/types/src/lib/handlers/unified-wrapper.d.mts
+++ b/types/src/lib/handlers/unified-wrapper.d.mts
@@ -105,6 +105,9 @@ export class UnifiedWrapper extends ComponentBase {
      * @param {boolean} [options.isCallable=false] - Whether the wrapper should be callable
      * @param {boolean} [options.materializeOnCreate=false] - Whether to materialize on creation
      * @param {string} [options.filePath=null] - File path of the module source
+     * @param {string[]|null} [options.exportPath] - Access path within `filePath`'s module namespace
+     *   that produced `initialImpl` (#484). When omitted it is looked up from the ownership export index
+     *   by `initialImpl`'s identity; `null` records "no module origin".
      * @param {string} [options.moduleID=null] - Module identifier
      * @param {string} [options.sourceFolder=null] - Source folder for metadata
      * @param {WeakSet<object>|null} [options.__adoptVisited=null] - Internal: one-shot cycle-guard set
@@ -129,7 +132,7 @@ export class UnifiedWrapper extends ComponentBase {
      * 	materializeFunc: async () => import("./math.mjs")
      * });
      */
-    constructor(slothlet: Object, { mode, apiPath, initialImpl, materializeFunc, isCallable, materializeOnCreate, filePath, moduleID, sourceFolder, __adoptVisited, deferChildAdopt }: {
+    constructor(slothlet: Object, { mode, apiPath, initialImpl, materializeFunc, isCallable, materializeOnCreate, filePath, exportPath, moduleID, sourceFolder, __adoptVisited, deferChildAdopt }: {
         mode: string;
         apiPath: string;
         initialImpl?: Object | Function | null | undefined;
@@ -137,6 +140,7 @@ export class UnifiedWrapper extends ComponentBase {
         isCallable?: boolean | undefined;
         materializeOnCreate?: boolean | undefined;
         filePath?: string | undefined;
+        exportPath?: string[] | null | undefined;
         moduleID?: string | undefined;
         sourceFolder?: string | undefined;
         __adoptVisited?: WeakSet<object> | null | undefined;
diff --git a/types/src/lib/handlers/unified-wrapper.d.mts.map b/types/src/lib/handlers/unified-wrapper.d.mts.map
index 26ceee82a..b608810a1 100644
--- a/types/src/lib/handlers/unified-wrapper.d.mts.map
+++ b/types/src/lib/handlers/unified-wrapper.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"unified-wrapper.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/unified-wrapper.mjs"],"names":[],"mappings":"AA0xBA;;;;;;;;;;;;;;;;;;GAkBG;AACH,4CAhBW,MAAM,GAAC,MAAM,GACX,OAAO,CAkBnB;AAmyID;;;;;;;;;;;GAWG;AACH,sCAPW,OAAO,GACL,cAAc,GAAC,IAAI,CAkB/B;AA51ID;;;;;;;;GAQG;AACH,iCAHU,GAAG,CAAC,MAAM,CAAC,CAG2F;;;;;AAuEhH;;;;;;;;;;GAUG;AACH;IAiTC;;;;;;;;;;;;;;;;OAgBG;IACH,0BAsCC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,gCAiEC;IAnaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,sBAjCW,MAAM,uJAEd;QAAwB,IAAI,EAApB,MAAM;QACU,OAAO,EAAvB,MAAM;QACyB,WAAW;QACvB,eAAe;QAChB,UAAU;QACV,mBAAmB;QACpB,QAAQ;QACR,QAAQ;QACR,YAAY;QACE,cAAc;QAI3B,eAAe;KAMzC,EA4MF;IAnPD;;;;;;;;;;;OAWG;IACH,4BAFa,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAC,SAAS,CAKzC;IAsOD;;;;;;;;;;OAUG;IACH,uEAHa,GAAC,CA+Bb;IAED;;;;OAIG;IACH,qBAHa,WAAS,MAAM,GAAC,IAAI,CAKhC;IAiJD;;;;;;;;;;;OAWG;IACH,sBAiCC;IAED;;;;;;;;;;;;OAYG;IACH,mBAgDC;IAED;;;;;;;;;OASG;IACH,qBAsDC;IAED;;;;OAIG;IACH,uBA4GC;IAED;;;;;;;;;OASG;IACH,qBAEC;IAED;;;;;;;;;OASG;IACH,sBAiBC;IAED;;;;;;;;;;OAUG;IACH,6BA4gBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BAgOC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BA43BC;IAED;;;;;;OAMG;IACH,uCAuyDC;;CACD;8BAxiK6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"unified-wrapper.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/unified-wrapper.mjs"],"names":[],"mappings":"AA0xBA;;;;;;;;;;;;;;;;;;GAkBG;AACH,4CAhBW,MAAM,GAAC,MAAM,GACX,OAAO,CAkBnB;AAi0ID;;;;;;;;;;;GAWG;AACH,sCAPW,OAAO,GACL,cAAc,GAAC,IAAI,CAkB/B;AA13ID;;;;;;;;GAQG;AACH,iCAHU,GAAG,CAAC,MAAM,CAAC,CAG2F;;;;;AAuEhH;;;;;;;;;;GAUG;AACH;IAuUC;;;;;;;;;;;;;;;;OAgBG;IACH,0BAsCC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,gCAiEC;IAzbD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,sBApCW,MAAM,mKAEd;QAAwB,IAAI,EAApB,MAAM;QACU,OAAO,EAAvB,MAAM;QACyB,WAAW;QACvB,eAAe;QAChB,UAAU;QACV,mBAAmB;QACpB,QAAQ;QACD,UAAU;QAGjB,QAAQ;QACR,YAAY;QACE,cAAc;QAI3B,eAAe;KAMzC,EA+NF;IAzQD;;;;;;;;;;;OAWG;IACH,4BAFa,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAC,SAAS,CAKzC;IA4PD;;;;;;;;;;OAUG;IACH,uEAHa,GAAC,CA+Bb;IAED;;;;OAIG;IACH,qBAHa,WAAS,MAAM,GAAC,IAAI,CAKhC;IAiJD;;;;;;;;;;;OAWG;IACH,sBA0CC;IAED;;;;;;;;;;;;OAYG;IACH,mBAkDC;IAED;;;;;;;;;OASG;IACH,qBAsDC;IAED;;;;OAIG;IACH,uBA4GC;IAED;;;;;;;;;OASG;IACH,qBAEC;IAED;;;;;;;;;OASG;IACH,sBAiBC;IAED;;;;;;;;;;OAUG;IACH,6BA4gBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BA8PC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BA43BC;IAED;;;;;;OAMG;IACH,uCAswDC;;CACD;8BAtkK6B,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/lib/helpers/modes-utils.d.mts.map b/types/src/lib/helpers/modes-utils.d.mts.map
index d3fe27b81..2bf409511 100644
--- a/types/src/lib/helpers/modes-utils.d.mts.map
+++ b/types/src/lib/helpers/modes-utils.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"modes-utils.d.mts","sourceRoot":"","sources":["../../../../src/lib/helpers/modes-utils.mjs"],"names":[],"mappings":"AAqBA;;;GAGG;AACH;IACC,gCAAuC;IAEvC;;;;;;;;OAQG;IACH,4EAIC;IAED;;;;;;OAMG;IACH,+BALW,OAAO,QACP,MAAM,GACJ,OAAO,CAenB;IAED;;;;;;OAMG;IACH,yCALW,MAAM,qBACN,MAAM,GACJ,MAAM,CAKlB;CACD;8BAvD6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"modes-utils.d.mts","sourceRoot":"","sources":["../../../../src/lib/helpers/modes-utils.mjs"],"names":[],"mappings":"AAqBA;;;GAGG;AACH;IACC,gCAAuC;IAEvC;;;;;;;;OAQG;IACH,4EAIC;IAED;;;;;;OAMG;IACH,+BALW,OAAO,QACP,MAAM,GACJ,OAAO,CAgBnB;IAED;;;;;;OAMG;IACH,yCALW,MAAM,qBACN,MAAM,GACJ,MAAM,CAKlB;CACD;8BAxD6B,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/lib/processors/flatten.d.mts b/types/src/lib/processors/flatten.d.mts
index 92cef5f05..c85e337fb 100644
--- a/types/src/lib/processors/flatten.d.mts
+++ b/types/src/lib/processors/flatten.d.mts
@@ -59,7 +59,12 @@ export class Flatten extends ComponentBase {
      * @param {string|null} [options.collisionModeOverride=null] - Caller's per-call override (e.g.
      *   `api.add({ forceOverwrite: true })`), preferred over `collisionContext`'s config default for
      *   the function-default-vs-named-export merge decision below.
-     * @returns {{ moduleContent: object|Function }} Built module content ready for wrapping/assignment.
+     * @returns {{ moduleContent: object|Function, origins: {self: (string[]|null), members: Object<string, string[]>} }}
+     *   Built module content ready for wrapping/assignment, plus where it came from (#484): `self` is the
+     *   content's own exportPath when it IS one export (`["default"]`, `["add"]`), `null` when it is a
+     *   fresh object composed here; `members` maps each key this step placed onto the content to the
+     *   exportPath it was read from. Keys the content already carried (a default object's own members)
+     *   are not listed — they are located under `self`.
      * @public
      */
     public processModuleForAPI(options: {
@@ -75,6 +80,12 @@ export class Flatten extends ComponentBase {
         collisionModeOverride?: string | null | undefined;
     }): {
         moduleContent: object | Function;
+        origins: {
+            self: (string[] | null);
+            members: {
+                [x: string]: string[];
+            };
+        };
     };
     /**
      * Build category-level flattening decisions.
diff --git a/types/src/lib/processors/flatten.d.mts.map b/types/src/lib/processors/flatten.d.mts.map
index 3d1982758..fb5f44bc2 100644
--- a/types/src/lib/processors/flatten.d.mts.map
+++ b/types/src/lib/processors/flatten.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"flatten.d.mts","sourceRoot":"","sources":["../../../../src/lib/processors/flatten.mjs"],"names":[],"mappings":"AA8BA;;;;;GAKG;AAMH;IACC,gCAAoC;IAEpC;;;OAGG;IACH,sBAFW,MAAM,EAIhB;IA4DD;;;;;;;;;;;;;OAaG;IACH,sCAVG;QAAwB,GAAG,EAAnB,MAAM;QACU,UAAU,EAA1B,MAAM;QACU,YAAY,EAA5B,MAAM;QACU,QAAQ,EAAxB,MAAM;QACW,mBAAmB,EAApC,OAAO;QACW,UAAU,EAA5B,MAAM,EAAE;QACU,CAAC;KAC3B,GAAU,OAAO,CAAC,MAAM,CAAC,CAiG3B;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,oCAfG;QAA0B,GAAG,EAArB,MAAM;QACY,QAAQ,EAA1B,MAAM;QACY,UAAU,EAA5B,MAAM;QACY,YAAY,EAA9B,MAAM;QACY,UAAU,EAA5B,MAAM,EAAE;QACU,QAAQ,EAA1B,MAAM;QACa,IAAI;QACJ,gBAAgB;QAChB,aAAa;QACV,qBAAqB;KAGnD,GAAU;QAAE,aAAa,EAAE,MAAM,WAAS,CAAA;KAAE,CAgK9C;IAED;;;;;;;;;;;;;;;OAeG;IACH,uCAZG;QAAwB,YAAY,EAA5B,MAAM;QACU,GAAG,EAAnB,MAAM;QACU,UAAU,EAA1B,MAAM;QACU,YAAY,EAA5B,MAAM;QACU,QAAQ,EAAxB,MAAM;QACY,UAAU,EAA5B,MAAM,EAAE;QACQ,YAAY,EAA5B,MAAM;QACa,WAAW,EAA9B,OAAO,EAAE;QACS,CAAC;KAC3B,GAAU,OAAO,CAAC,MAAM,CAAC,CAiJ3B;IAED;;;;;;;;;;;;OAYG;IACH,oCAPW,MAAM,SACN,OAAO,qDAGL,OAAO,CAiBnB;;CACD;8BAvjB6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"flatten.d.mts","sourceRoot":"","sources":["../../../../src/lib/processors/flatten.mjs"],"names":[],"mappings":"AA8BA;;;;;GAKG;AAMH;IACC,gCAAoC;IAEpC;;;OAGG;IACH,sBAFW,MAAM,EAIhB;IA4DD;;;;;;;;;;;;;OAaG;IACH,sCAVG;QAAwB,GAAG,EAAnB,MAAM;QACU,UAAU,EAA1B,MAAM;QACU,YAAY,EAA5B,MAAM;QACU,QAAQ,EAAxB,MAAM;QACW,mBAAmB,EAApC,OAAO;QACW,UAAU,EAA5B,MAAM,EAAE;QACU,CAAC;KAC3B,GAAU,OAAO,CAAC,MAAM,CAAC,CAiG3B;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,oCApBG;QAA0B,GAAG,EAArB,MAAM;QACY,QAAQ,EAA1B,MAAM;QACY,UAAU,EAA5B,MAAM;QACY,YAAY,EAA9B,MAAM;QACY,UAAU,EAA5B,MAAM,EAAE;QACU,QAAQ,EAA1B,MAAM;QACa,IAAI;QACJ,gBAAgB;QAChB,aAAa;QACV,qBAAqB;KAGnD,GAAU;QAAE,aAAa,EAAE,MAAM,WAAS,CAAC;QAAC,OAAO,EAAE;YAAC,IAAI,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;YAAC,OAAO,EAAE;oBAAO,MAAM,GAAE,MAAM,EAAE;aAAC,CAAA;SAAC,CAAA;KAAE,CA8LnH;IAED;;;;;;;;;;;;;;;OAeG;IACH,uCAZG;QAAwB,YAAY,EAA5B,MAAM;QACU,GAAG,EAAnB,MAAM;QACU,UAAU,EAA1B,MAAM;QACU,YAAY,EAA5B,MAAM;QACU,QAAQ,EAAxB,MAAM;QACY,UAAU,EAA5B,MAAM,EAAE;QACQ,YAAY,EAA5B,MAAM;QACa,WAAW,EAA9B,OAAO,EAAE;QACS,CAAC;KAC3B,GAAU,OAAO,CAAC,MAAM,CAAC,CAiJ3B;IAED;;;;;;;;;;;;OAYG;IACH,oCAPW,MAAM,SACN,OAAO,qDAGL,OAAO,CAiBnB;;CACD;8BArlB6B,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/lib/processors/type-generator.d.mts b/types/src/lib/processors/type-generator.d.mts
index 67e8ad66b..b57839cd1 100644
--- a/types/src/lib/processors/type-generator.d.mts
+++ b/types/src/lib/processors/type-generator.d.mts
@@ -1,17 +1,30 @@
 /**
  * Generate TypeScript declaration file for a Slothlet API
- * @param {object} api - The loaded Slothlet API
+ * @param {object} api - The loaded Slothlet API (a live, composed instance)
  * @param {object} options - Generation options
  * @param {string} options.output - Output file path for .d.ts
  * @param {string} options.interfaceName - Name of the interface to generate
- * @param {boolean} [options.includeDocumentation=true] - Include JSDoc comments
+ * @param {boolean} [options.includeDocumentation=true] - Include the per-member comments that explain an
+ *   `unknown` member (a member with no module origin). Accepted for compatibility; the explanation is
+ *   always emitted, since an unexplained `unknown` is a worse surprise than one extra comment line.
+ * @param {boolean} [options.augmentRuntime=true] - Extend `SlothletSelf` from `@cldmv/slothlet/runtime`
+ *   with the generated interface, so an imported `self` is typed as the api. Turn it off when several
+ *   generated interfaces live in one TypeScript program and only one of them should type `self`.
  * @returns {Promise<{output: string, filePath: string}>} Generated declaration and output path
  * @public
+ *
+ * @description
+ * Every member references the export slothlet actually placed there — `typeof import("<leaf>")["k"]` —
+ * read from the ownership records' module origin (#484), so the declaration carries each leaf's own
+ * type (JSDoc, TypeScript, CommonJS alike) instead of a signature guessed from its file's syntax. A
+ * namespace becomes a nested object of its members; a callable namespace intersects its function's
+ * type with the members merged onto it; a member with no module origin is `unknown`, with a comment.
  */
 export function generateTypes(api: object, options: {
     output: string;
     interfaceName: string;
     includeDocumentation?: boolean | undefined;
+    augmentRuntime?: boolean | undefined;
 }): Promise<{
     output: string;
     filePath: string;
diff --git a/types/src/lib/processors/type-generator.d.mts.map b/types/src/lib/processors/type-generator.d.mts.map
index b5f93faf8..923f41738 100644
--- a/types/src/lib/processors/type-generator.d.mts.map
+++ b/types/src/lib/processors/type-generator.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"type-generator.d.mts","sourceRoot":"","sources":["../../../../src/lib/processors/type-generator.mjs"],"names":[],"mappings":"AA8CA;;;;;;;;;GASG;AACH,mCARW,MAAM,WAEd;IAAwB,MAAM,EAAtB,MAAM;IACU,aAAa,EAA7B,MAAM;IACY,oBAAoB;CAC9C,GAAU,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAC,CAAC,CA6DvD"}
\ No newline at end of file
+{"version":3,"file":"type-generator.d.mts","sourceRoot":"","sources":["../../../../src/lib/processors/type-generator.mjs"],"names":[],"mappings":"AAsCA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,mCApBW,MAAM,WAEd;IAAwB,MAAM,EAAtB,MAAM;IACU,aAAa,EAA7B,MAAM;IACY,oBAAoB;IAGpB,cAAc;CAGxC,GAAU,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAC,CAAC,CAuDvD"}
\ No newline at end of file
diff --git a/types/src/lib/runtime/runtime.d.mts b/types/src/lib/runtime/runtime.d.mts
index 22394a044..f0f131843 100644
--- a/types/src/lib/runtime/runtime.d.mts
+++ b/types/src/lib/runtime/runtime.d.mts
@@ -1,15 +1,36 @@
+/**
+ * Type anchor for {@link self}. It has no runtime behavior and is never instantiated.
+ *
+ * `self` is typed as `SlothletSelf`, and TypeScript merges an interface of the same name into a
+ * class, so a project types `self` for its whole api by extending this class from a module
+ * augmentation. `slothlet typegen` emits exactly that:
+ * ```ts
+ * declare module "@cldmv/slothlet/runtime" {
+ * 	interface SlothletSelf extends MyApi {}
+ * }
+ * ```
+ *
+ * @memberof module:@cldmv/slothlet/runtime
+ * @example
+ * // api.d.ts (generated by `slothlet typegen -n MyApi`) extends SlothletSelf, so in any leaf:
+ * import { self } from "@cldmv/slothlet/runtime";
+ * await self.math.add(1, 2); // typed from MyApi
+ */
+export class SlothletSelf {
+}
 /**
  * Live binding to the current API instance. Resolves to the running Slothlet proxy,
  * giving API modules access to all other API methods without import cycles.
+ * Typed as {@link SlothletSelf}, which generated api types extend.
  *
  * @memberof module:@cldmv/slothlet/runtime
- * @type {object}
+ * @type {SlothletSelf}
  * @example
  * import { self } from "@cldmv/slothlet/runtime";
  * // Inside an API function:
  * const result = await self.math.add(1, 2);
  */
-export const self: object;
+export const self: SlothletSelf;
 /**
  * The current ambient context object. Seeded at instance startup via `config.context` and
  * persists for the lifetime of the instance. `api.slothlet.context.run()` and `.scope()` can
diff --git a/types/src/lib/runtime/runtime.d.mts.map b/types/src/lib/runtime/runtime.d.mts.map
index 2eaaadad9..39199aefe 100644
--- a/types/src/lib/runtime/runtime.d.mts.map
+++ b/types/src/lib/runtime/runtime.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"runtime.d.mts","sourceRoot":"","sources":["../../../../src/lib/runtime/runtime.mjs"],"names":[],"mappings":"AAkEA;;;;;;;;;;GAUG;AACH,mBANU,MAAM,CAwCd;AAEF;;;;;;;;;;;;;;GAcG;AACH,sBARU,MAAM,CAiCd;AAEF;;;;;;;;;GASG;AACH,yBALU,MAAM,CAiBd"}
\ No newline at end of file
+{"version":3,"file":"runtime.d.mts","sourceRoot":"","sources":["../../../../src/lib/runtime/runtime.mjs"],"names":[],"mappings":"AAkEA;;;;;;;;;;;;;;;;;GAiBG;AACH;CAA4B;AAE5B;;;;;;;;;;;GAWG;AACH,mBANU,YAAY,CAwCpB;AAEF;;;;;;;;;;;;;;GAcG;AACH,sBARU,MAAM,CAiCd;AAEF;;;;;;;;;GASG;AACH,yBALU,MAAM,CAiBd"}
\ No newline at end of file
diff --git a/types/src/lib/typegen/typegen.d.mts b/types/src/lib/typegen/typegen.d.mts
index f704ad02c..2327927e0 100644
--- a/types/src/lib/typegen/typegen.d.mts
+++ b/types/src/lib/typegen/typegen.d.mts
@@ -11,6 +11,9 @@
  * @param {string} options.interfaceName - Name of the generated TypeScript interface (e.g. `"MyApi"`).
  * @param {boolean|string|object} [options.typescript] - Override TypeScript loader config. Same union accepted by `slothlet({ typescript })`: pass `true` (default mode), `"fast"` / `"strict"`, or an object like `{ mode: "fast" }`. Defaults to `{ mode: "fast" }` when omitted.
  * @param {boolean} [options.includeDocumentation=true] - Include JSDoc comments in the generated declaration.
+ * @param {boolean} [options.augmentRuntime=true] - Extend `SlothletSelf` from `@cldmv/slothlet/runtime` with the
+ *   generated interface, so leaves that import `self` get the api's types. Set `false` when another generated
+ *   declaration in the same TypeScript program should type `self` instead.
  * @returns {Promise<{filePath: string, content: string}>} Absolute path written and the declaration content.
  * @throws {SlothletError} `INVALID_CONFIG` when `dir`, `output`, or `interfaceName` is missing or not a string.
  * @public
@@ -30,6 +33,7 @@ export function generateTypes(options?: {
     interfaceName: string;
     typescript?: string | boolean | object | undefined;
     includeDocumentation?: boolean | undefined;
+    augmentRuntime?: boolean | undefined;
 }): Promise<{
     filePath: string;
     content: string;
diff --git a/types/src/lib/typegen/typegen.d.mts.map b/types/src/lib/typegen/typegen.d.mts.map
index 868c62da7..6184c9e42 100644
--- a/types/src/lib/typegen/typegen.d.mts.map
+++ b/types/src/lib/typegen/typegen.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"typegen.d.mts","sourceRoot":"","sources":["../../../../src/lib/typegen/typegen.mjs"],"names":[],"mappings":"AAuCA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wCAlBG;IAAwB,GAAG,EAAnB,MAAM;IACU,MAAM,EAAtB,MAAM;IACU,aAAa,EAA7B,MAAM;IAC0B,UAAU;IACxB,oBAAoB;CAC9C,GAAU,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAAC,CAoDxD"}
\ No newline at end of file
+{"version":3,"file":"typegen.d.mts","sourceRoot":"","sources":["../../../../src/lib/typegen/typegen.mjs"],"names":[],"mappings":"AAuCA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wCArBG;IAAwB,GAAG,EAAnB,MAAM;IACU,MAAM,EAAtB,MAAM;IACU,aAAa,EAA7B,MAAM;IAC0B,UAAU;IACxB,oBAAoB;IACpB,cAAc;CAGxC,GAAU,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAAC,CAmExD"}
\ No newline at end of file
diff --git a/types/src/slothlet.d.mts b/types/src/slothlet.d.mts
index ac5448050..39a6f720a 100644
--- a/types/src/slothlet.d.mts
+++ b/types/src/slothlet.d.mts
@@ -4,8 +4,11 @@
  * API instance with its own component graph, context store, and lifecycle.
  * @alias module:@cldmv/slothlet
  * @async
+ * @template {object} [T=import("./lib/runtime/runtime.mjs").SlothletSelf] - The loaded api's own shape.
+ *   Defaults to `SlothletSelf`, which a `slothlet typegen` declaration extends with the project's api;
+ *   pass another interface (`slothlet<OtherApi>(...)`) when a program loads more than one api.
  * @param {SlothletOptions} config - Configuration options
- * @returns {Promise<SlothletAPI>} Fully loaded, proxy-based API object
+ * @returns {Promise<SlothletAPI & T>} Fully loaded, proxy-based API object
  * @public
  * @example
  * // Minimal usage
@@ -37,7 +40,7 @@
  *   api: { collision: { initial: "merge", api: "error" } }
  * });
  */
-export function slothlet(config: SlothletOptions): Promise<SlothletAPI>;
+export function slothlet<T extends object = import("./lib/runtime/runtime.mjs").SlothletSelf>(config: SlothletOptions): Promise<SlothletAPI & T>;
 export namespace slothlet {
     let defaults: Readonly<{
         routines: ReadonlyArray<{
diff --git a/types/src/slothlet.d.mts.map b/types/src/slothlet.d.mts.map
index e7bb78d91..4b2d3e7e3 100644
--- a/types/src/slothlet.d.mts.map
+++ b/types/src/slothlet.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"slothlet.d.mts","sourceRoot":"","sources":["../../src/slothlet.mjs"],"names":[],"mappings":"AAs6CA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,iCAjCW,eAAe,GACb,OAAO,CAAC,WAAW,CAAC,CAsChC;;kBASS,QAAQ,CAAC;QAAC,QAAQ,EAAE,aAAa,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAC,CAAC,CAAC;QAAC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;KAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAgD3F,SAAS,GAAC,MAAM;;;;;;;;;;;;qBAEP,MAAM;iBAAO,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAgBhB,MAAM;eAAS,CAAC,QAAQ,GAAC,SAAS,GAAC,UAAU,GAAC,SAAS,CAAC;oBAAc,OAAO;gBAAU,CAAC,OAAO,GAAC,OAAO,CAAC;kBAAY,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAevI,KAAK,CAAC;YAAC,IAAI,EAAC,MAAM,CAAC;YAAA,IAAI,EAAC,MAAM,CAAC;YAAA,QAAQ,EAAC,MAAM,CAAA;SAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aA8BxD,MAAY,IAAI;;;;cAChB,MAAY,IAAI;;;;cAE3B;QAAgE,GAAG,EAAxD,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAC,SAAS,CAAC,CAAC;QACzB,GAAG,EAC/B;YAAkC,GAAG;YACH,MAAM;YACN,MAAM;YACN,MAAM;YACR,OAAO,EACvC;gBAA0C,QAAQ;gBACR,IAAI;gBACJ,SAAS;gBACT,UAAU;gBACV,YAAY;gBACZ,aAAa;gBACb,iBAAiB;gBACjB,mBAAmB;gBACnB,cAAc;aACxD;SAAA;QAA4B,OAAO,EACnC;YAAsC,GAAG;YACO,OAAO,EAA5C,MAAY,MAAM;YACS,GAAG;YACH,KAAK;YACL,GAAG;SACzC;QAA6B,IAAI;;;;;;;;6BAEV,MAAM;;;;yCACN,MAAM,EAAE;;;;;;;;;;;;;;;;;4BAIR,MAAM;;;;kCACN,MAAM;;;;;;;;6BAEN,MAAM;;;;;;;;;;;;;;;;;qCAIN,eAAe;;QACV,IAAI,EAChC;YAAmC,KAAK;YACL,OAAO;YACP,cAAc;YACd,MAAM;YACN,aAAa;YACb,IAAI;YACJ,GAAG;YACH,EAAE;YACJ,GAAG,EACpC;gBAAsC,OAAO,EAAlC,OAAO;gBACqB,MAAM;gBACN,OAAO;aAC9C;YAAmC,MAAM;YACN,kBAAkB;SACrD;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,EAAE;SAC1C;QAA4B,WAAW,EACvC;YAAoD,GAAG,EAA5C,MAAY,MAAM;YACY,YAAY,EAA1C,OAAO;YAC0C,IAAI,EAArD,MAAY,OAAO,CAAE,IAAI,CAAC;SACrC;QAA4B,QAAQ,EACpC;YAAsD,MAAM,EAAjD,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,MAAM;YACN,SAAS;YACM,IAAI,EAA/C,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,SAAS;SAChD;QAA4B,KAAK,EACjC;YAAoC,GAAG;SACvC;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,UAAU;SAClD;QAA4B,WAAW,EACvC;YAAwC,OAAO,EAC/C;gBAAiD,OAAO,EAA7C,OAAO;gBACwC,MAAM,EAArD,MAAY,IAAI;gBAC+B,OAAO,EAAtD,MAAY,IAAI;gBACsB,iBAAiB,EAAvD,OAAO;gBAC+C,UAAU,EAAhE,CAAS,IAAO,EAAP,OAAO,KAAG,IAAI;gBACwB,IAAI,EAAnD,MAAY,IAAI;gBACsB,MAAM,EAA5C,OAAO;aAClB;SAAA;QAA4B,UAAU,EACtC;YAAyC,IAAI;YACJ,UAAU;YACV,UAAU;YACV,kBAAkB;YAClB,kBAAkB;SAC3D;QAA8B,UAAU;QACV,IAAI;QACL,SAAS;QACR,MAAM;QACN,GAAG;QACH,KAAK;QACa,QAAQ,EAA7C,MAAY,OAAO,CAAE,IAAI,CAAC;KACvC;;gCAplD6D,wBAAwB"}
\ No newline at end of file
+{"version":3,"file":"slothlet.d.mts","sourceRoot":"","sources":["../../src/slothlet.mjs"],"names":[],"mappings":"AAm7CA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,yBApCuB,CAAC,SAAX,MAAQ,6DAGV,eAAe,GACb,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,CAsCpC;;kBASS,QAAQ,CAAC;QAAC,QAAQ,EAAE,aAAa,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAC,CAAC,CAAC;QAAC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;KAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAgD3F,SAAS,GAAC,MAAM;;;;;;;;;;;;qBAEP,MAAM;iBAAO,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAgBhB,MAAM;eAAS,CAAC,QAAQ,GAAC,SAAS,GAAC,UAAU,GAAC,SAAS,CAAC;oBAAc,OAAO;gBAAU,CAAC,OAAO,GAAC,OAAO,CAAC;kBAAY,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAevI,KAAK,CAAC;YAAC,IAAI,EAAC,MAAM,CAAC;YAAA,IAAI,EAAC,MAAM,CAAC;YAAA,QAAQ,EAAC,MAAM,CAAA;SAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aA8BxD,MAAY,IAAI;;;;cAChB,MAAY,IAAI;;;;cAE3B;QAAgE,GAAG,EAAxD,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAC,SAAS,CAAC,CAAC;QACzB,GAAG,EAC/B;YAAkC,GAAG;YACH,MAAM;YACN,MAAM;YACN,MAAM;YACR,OAAO,EACvC;gBAA0C,QAAQ;gBACR,IAAI;gBACJ,SAAS;gBACT,UAAU;gBACV,YAAY;gBACZ,aAAa;gBACb,iBAAiB;gBACjB,mBAAmB;gBACnB,cAAc;aACxD;SAAA;QAA4B,OAAO,EACnC;YAAsC,GAAG;YACO,OAAO,EAA5C,MAAY,MAAM;YACS,GAAG;YACH,KAAK;YACL,GAAG;SACzC;QAA6B,IAAI;;;;;;;;6BAEV,MAAM;;;;yCACN,MAAM,EAAE;;;;;;;;;;;;;;;;;4BAIR,MAAM;;;;kCACN,MAAM;;;;;;;;6BAEN,MAAM;;;;;;;;;;;;;;;;;qCAIN,eAAe;;QACV,IAAI,EAChC;YAAmC,KAAK;YACL,OAAO;YACP,cAAc;YACd,MAAM;YACN,aAAa;YACb,IAAI;YACJ,GAAG;YACH,EAAE;YACJ,GAAG,EACpC;gBAAsC,OAAO,EAAlC,OAAO;gBACqB,MAAM;gBACN,OAAO;aAC9C;YAAmC,MAAM;YACN,kBAAkB;SACrD;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,EAAE;SAC1C;QAA4B,WAAW,EACvC;YAAoD,GAAG,EAA5C,MAAY,MAAM;YACY,YAAY,EAA1C,OAAO;YAC0C,IAAI,EAArD,MAAY,OAAO,CAAE,IAAI,CAAC;SACrC;QAA4B,QAAQ,EACpC;YAAsD,MAAM,EAAjD,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,MAAM;YACN,SAAS;YACM,IAAI,EAA/C,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,SAAS;SAChD;QAA4B,KAAK,EACjC;YAAoC,GAAG;SACvC;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,UAAU;SAClD;QAA4B,WAAW,EACvC;YAAwC,OAAO,EAC/C;gBAAiD,OAAO,EAA7C,OAAO;gBACwC,MAAM,EAArD,MAAY,IAAI;gBAC+B,OAAO,EAAtD,MAAY,IAAI;gBACsB,iBAAiB,EAAvD,OAAO;gBAC+C,UAAU,EAAhE,CAAS,IAAO,EAAP,OAAO,KAAG,IAAI;gBACwB,IAAI,EAAnD,MAAY,IAAI;gBACsB,MAAM,EAA5C,OAAO;aAClB;SAAA;QAA4B,UAAU,EACtC;YAAyC,IAAI;YACJ,UAAU;YACV,UAAU;YACV,kBAAkB;YAClB,kBAAkB;SAC3D;QAA8B,UAAU;QACV,IAAI;QACL,SAAS;QACR,MAAM;QACN,GAAG;QACH,KAAK;QACa,QAAQ,EAA7C,MAAY,OAAO,CAAE,IAAI,CAAC;KACvC;;gCApmD6D,wBAAwB"}
\ No newline at end of file

From 3f0a8e8d07b71d3f19009aa8bfa9ea193a9d41b8 Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Mon, 28 Sep 2026 11:46:57 -0700
Subject: [PATCH 13/49] fix(wrapper): don't adopt a function's non-enumerable
 own properties as api children

Eager adoption iterated Reflect.ownKeys(impl) and skipped only `length`,
`name` and `prototype` on a function impl, so any other non-enumerable
own property became an enumerable child endpoint. On Node 22 every
sloppy-mode (CommonJS) function carries own, non-enumerable `arguments`
and `caller`, so a `module.exports = function` leaf reported
Object.keys(api.x) as ["arguments", "caller"], and typegen emitted them
as `unknown` members (CI's Node 22 job). A module's own
Object.defineProperty(fn, k, { enumerable: false }) was adopted the same
way on every Node version.

Adoption now follows the get trap's rule (#304): only a function's own
enumerable properties are children. The values stay readable.
---
 docs/generated/API.md                         | 3480 +----------------
 src/lib/handlers/unified-wrapper.mjs          |    8 +
 ...-wrapper-function-own-keys.test.vitest.mjs |   91 +
 .../lib/handlers/unified-wrapper.d.mts.map    |    2 +-
 4 files changed, 105 insertions(+), 3476 deletions(-)
 create mode 100644 tests/vitests/suites/handlers/unified-wrapper-function-own-keys.test.vitest.mjs

diff --git a/docs/generated/API.md b/docs/generated/API.md
index a1ee10e6e..21434c21b 100644
--- a/docs/generated/API.md
+++ b/docs/generated/API.md
@@ -19,106 +19,7 @@
 
 **Structure**
 
-[@cldmv/slothlet(config)](#at_cldmv_slash_slothlet) ⇒ <code>Promise.&lt;SlothletAPI&gt;</code>
-  * [.destroy()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_destroy)
-  * [.shutdown()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_shutdown)
-  * .slothlet ⇒ <code>object</code>
-    * .env ⇒ <code>Readonly.&lt;Record.&lt;string, (string|undefined)&gt;&gt;</code>
-    * .api ⇒ <code>object</code>
-      * [.add()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-api-add)
-      * [.reload()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-api-reload)
-      * [.remove()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-api-remove)
-      * [.leaves()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-api-leaves)
-      * .modules ⇒ <code>object</code>
-        * [.discover()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-api-modules-discover)
-        * [.sort()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-api-modules-sort)
-        * [.addModule()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-api-modules-addModule)
-        * [.addModules()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-api-modules-addModules)
-        * [.removeModule()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-api-modules-removeModule)
-        * [.addDiscovered()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-api-modules-addDiscovered)
-        * [.getDiscoveryCache()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-api-modules-getDiscoveryCache)
-        * [.clearDiscoveryCache()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-api-modules-clearDiscoveryCache)
-        * [.getStaleMounts()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-api-modules-getStaleMounts)
-    * .context ⇒ <code>object</code>
-      * [.get()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-context-get)
-      * [.inspect()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-context-inspect)
-      * [.run()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-context-run)
-      * [.scope()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-context-scope)
-      * [.set()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-context-set)
-    * \[.diag\] ⇒ <code>object</code>
-      * \[.caches\] ⇒ <code>object</code>
-        * [\[.get\]()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-diag-caches-get)
-        * [\[.getAllModuleIDs\]()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-diag-caches-getAllModuleIDs)
-        * [\[.has\]()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-diag-caches-has)
-      * \[.context\] ⇒ <code>object</code>
-      * [\[.describe\]()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-diag-describe)
-      * [\[.getAPI\]()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-diag-getAPI)
-      * [\[.getOwnership\]()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-diag-getOwnership)
-      * \[.hook\] ⇒ <code>object</code>
-      * [\[.inspect\]()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-diag-inspect)
-      * \[.owner\] ⇒ <code>object</code>
-        * [\[.get\]()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-diag-owner-get)
-      * \[.reference\] ⇒ <code>object</code>
-      * [\[.SlothletWarning\]()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-diag-SlothletWarning)
-    * .hook ⇒ <code>object</code>
-      * [.clear()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-hook-clear)
-      * [.disable()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-hook-disable)
-      * [.disablePattern()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-hook-disablePattern)
-      * [.enable()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-hook-enable)
-      * [.enablePattern()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-hook-enablePattern)
-      * [.list()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-hook-list)
-      * [.off()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-hook-off)
-      * [.on()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-hook-on)
-      * .pin ⇒ <code>object</code>
-        * .enabled ⇒ <code>boolean</code>
-        * [.enable()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-hook-pin-enable)
-        * [.disable()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-hook-pin-disable)
-      * [.remove()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-hook-remove)
-      * [.resetPatternFilter()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-hook-resetPatternFilter)
-    * .lifecycle ⇒ <code>object</code>
-      * [.off()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-lifecycle-off)
-      * [.on()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-lifecycle-on)
-    * .materialize ⇒ <code>object</code>
-      * [.get()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-materialize-get)
-      * .materialized ⇒ <code>boolean</code>
-      * [.wait()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-materialize-wait)
-    * .metadata ⇒ <code>object</code>
-      * [.caller()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-metadata-caller)
-      * [.get()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-metadata-get)
-      * [.remove()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-metadata-remove)
-      * [.getFor()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-metadata-getFor)
-      * [.removeFor()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-metadata-removeFor)
-      * [.self()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-metadata-self)
-      * [.set()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-metadata-set)
-      * [.setFor()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-metadata-setFor)
-      * [.setGlobal()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-metadata-setGlobal)
-    * .owner ⇒ <code>object</code>
-      * [.get()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-owner-get)
-    * .ownership ⇒ <code>object</code>
-      * [.get()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-ownership-get)
-      * [.unregister()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-ownership-unregister)
-    * .permissions ⇒ <code>object</code>
-      * .control ⇒ <code>object</code>
-        * .enabled ⇒ <code>boolean</code>
-        * [.enable()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-permissions-control-enable)
-        * [.disable()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-permissions-control-disable)
-        * .readGatingEnabled ⇒ <code>boolean</code>
-        * [.readGating()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-permissions-control-readGating)
-        * [.seal()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-permissions-control-seal)
-        * .sealed ⇒ <code>boolean</code>
-    * .versioning ⇒ <code>object</code>
-      * [.list()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-versioning-list)
-      * [.setDefault()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-versioning-setDefault)
-      * [.unregister()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-versioning-unregister)
-      * [.getVersionMetadata()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-versioning-getVersionMetadata)
-      * [.setVersionMetadata()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-versioning-setVersionMetadata)
-    * [.lockCaller()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-lockCaller)
-    * [.bind()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-bind)
-    * \[.reference\] ⇒ <code>object</code>
-    * [.reload()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-reload)
-    * [.run()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-run)
-    * [.scope()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-scope)
-    * [.shutdown()](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-shutdown)
+[@cldmv/slothlet(config)](#at_cldmv_slash_slothlet) ⇒ <code>Object</code>
 
 [@cldmv/slothlet/runtime](#at_cldmv_slash_slothlet_slash_runtime)
 
@@ -187,7 +88,7 @@ await api.slothlet.shutdown();
 
 <a id="at_cldmv_slash_slothlet"></a>
 
-### @cldmv/slothlet(config) ⇒ <code>Promise.&lt;SlothletAPI&gt;</code>
+### @cldmv/slothlet(config) ⇒ <code>Object</code>
 > <p><strong style="font-size: 1.1em;"><p>Create a new Slothlet instance and load an API from a directory.
 > This is the sole public entry point for slothlet. Each call produces an independent
 > API instance with its own component graph, context store, and lifecycle.</p></strong></p>
@@ -200,7 +101,7 @@ await api.slothlet.shutdown();
 
 **Returns**:
 
-- <code>Promise.&lt;SlothletAPI&gt;</code> <p>Fully loaded, proxy-based API object</p>
+- <code>Object</code> <p>Fully loaded, proxy-based API object</p>
 
 
 **Example**
@@ -351,3377 +252,6 @@ Only relevant when modules are registered via <code>api.slothlet.api.add()</code
 | <a id="typedef_module_at_cldmv_slash_slothlet_SlothletOptions_prop_typescript"></a>[typescript] | <code>boolean \| "fast" \| "strict" \| object</code> | <code>false</code> | TypeScript support. <ul> <li>`false` — disabled (default).</li> <li>`true` or `"fast"` — esbuild transpilation, no type checking.</li> <li>`"strict"` — tsc compilation with type checking and `.d.ts` generation. See <a href="docs/TYPESCRIPT.md">TYPESCRIPT.md</a> for the full configuration reference.</li> </ul> |
 
 
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI"></a>
-
-### SlothletAPI : <code>object</code>
-<p>Bound API object returned by <code>slothlet()</code>.
-The root contains all loaded module exports plus the reserved <code>slothlet</code> namespace.</p>
-
-**Kind**: typedef  
-**Scope**: inner
-
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_destroy"></a>
-
-#### api.destroy() ⇒ <code>void</code>
-
-Like <code>shutdown()</code> but additionally invokes registered destroy hooks before teardown.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-**Returns**: <code>void</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-await api.destroy();
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api' });
-  await api.destroy();
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api' });
-  await api.destroy();
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api' });
-await api.destroy();
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_shutdown"></a>
-
-#### api.shutdown() ⇒ <code>void</code>
-
-Convenience alias for <code>slothlet.shutdown()</code>. Shuts down the instance and invokes any user-provided shutdown hook first.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-**Returns**: <code>void</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-await api.shutdown();
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api' });
-  await api.shutdown();
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api' });
-  await api.shutdown();
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api' });
-await api.shutdown();
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-api-add"></a>
-
-#### api.slothlet.api.add(apiPath, folderPath, [options]) ⇒ <code>Promise.&lt;void&gt;</code>
-
-Mount a new API module at runtime.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| apiPath | <code>string</code> |  |
-| folderPath | <code>string</code> |  |
-| [options] | <code>Object</code> |  |
-
-**Returns**: <code>Promise.&lt;void&gt;</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-await api.slothlet.api.add('utils.math', './api/utils/math');
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api' });
-  await api.slothlet.api.add('utils.math', './api/utils/math');
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api' });
-  await api.slothlet.api.add('utils.math', './api/utils/math');
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api' });
-await api.slothlet.api.add('utils.math', './api/utils/math');
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-api-reload"></a>
-
-#### api.slothlet.api.reload([pathOrModuleId], [options]) ⇒ <code>Promise.&lt;void&gt;</code>
-
-Hot-reload a specific module or directory path.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| [pathOrModuleId] | <code>string\|null</code> |  |
-| [options] | <code>Object</code> |  |
-
-**Returns**: <code>Promise.&lt;void&gt;</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-// Reload a specific module
-await api.slothlet.api.reload('utils.math');
-// Reload everything
-await api.slothlet.api.reload();
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api' });
-  // Reload a specific module
-  await api.slothlet.api.reload('utils.math');
-  // Reload everything
-  await api.slothlet.api.reload();
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api' });
-  // Reload a specific module
-  await api.slothlet.api.reload('utils.math');
-  // Reload everything
-  await api.slothlet.api.reload();
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api' });
-// Reload a specific module
-await api.slothlet.api.reload('utils.math');
-// Reload everything
-await api.slothlet.api.reload();
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-api-remove"></a>
-
-#### api.slothlet.api.remove(pathOrModuleId, apiPath?) ⇒ <code>Promise.&lt;boolean&gt;</code>
-
-Unmount an API module at runtime. <code>remove(id)</code> removes every path the module owns; <code>remove(apiPath)</code> removes that path's whole subtree; the two-argument <code>remove(moduleID, apiPath)</code> removes only that module's single node at the path, leaving sibling modules sharing the mount and the module's other mounts intact. Resolves to whether anything was removed.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| pathOrModuleId | <code>string</code> |  |
-| apiPath? | <code>string</code> |  |
-
-**Returns**: <code>Promise.&lt;boolean&gt;</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-await api.slothlet.api.remove('utils.math');
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api' });
-  await api.slothlet.api.remove('utils.math');
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api' });
-  await api.slothlet.api.remove('utils.math');
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api' });
-await api.slothlet.api.remove('utils.math');
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-api-leaves"></a>
-
-#### api.slothlet.api.leaves(key, [options]) ⇒ <code>Promise.&lt;string[]|Array.&lt;{path: string, kind: &quot;function&quot;|&quot;namespace&quot;|&quot;data&quot;}&gt;&gt;</code>
-
-Enumerate the api paths a module owns, read from the loader's ownership records. Pass a moduleID, a mount endpoint, any owned path, or <code>&quot;.&quot;</code> for the base load; <code>{ details: true }</code> returns every owned path tagged with its kind instead of the callable paths alone. The answer is scoped to the caller — module-private members the caller could not read are omitted; <code>{ includePrivate: true }</code> (host-only) returns the unredacted list, and a module caller passing it is refused with PERMISSION_DENIED.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| key | <code>string</code> |  |
-| [options] | <code>Object</code> |  |
-
-**Returns**: <code>Promise.&lt;string[]|Array.&lt;{path: string, kind: &quot;function&quot;|&quot;namespace&quot;|&quot;data&quot;}&gt;&gt;</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-const moduleID = await api.slothlet.api.add('shop', './ext/shop/api');
-await api.slothlet.api.leaves(moduleID);
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api' });
-  await api.slothlet.api.leaves('shop', { details: true });
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api' });
-  await api.slothlet.api.leaves('shop');
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api' });
-await api.slothlet.api.leaves('shop');
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-api-modules-discover"></a>
-
-#### api.slothlet.api.modules.discover([options]) ⇒ <code>Promise.&lt;DiscoverResult[]&gt;</code>
-
-Walk the filesystem for slothlet modules; replace the per-instance discovery cache and return the fresh results.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| [options] | <code>Object</code> |  |
-
-**Returns**: <code>Promise.&lt;DiscoverResult[]&gt;</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-const found = await api.slothlet.api.modules.discover({ scanRoot: process.cwd(), prefix: &quot;@cldmv/packrat-driver-&quot; });
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-api-modules-sort"></a>
-
-#### api.slothlet.api.modules.sort(results, [comparator]) ⇒ <code>DiscoverResult[]</code>
-
-Pure sort; default comparator is <code>priority</code> desc with <code>packageName</code> asc tiebreak. Pass a custom comparator to override.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| results | <code>DiscoverResult[]</code> |  |
-| [comparator] | <code>function</code> |  |
-
-**Returns**: <code>DiscoverResult[]</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-const ordered = api.slothlet.api.modules.sort(await api.slothlet.api.modules.discover());
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-api-modules-addModule"></a>
-
-#### api.slothlet.api.modules.addModule(nameOrResult, [options]) ⇒ <code>Promise.&lt;MountResult&gt;</code>
-
-Mount one module by package name (cache lookup) or by DiscoverResult directly. Lazy-triggers <code>discover()</code> when the cache is empty.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| nameOrResult | <code>string\|DiscoverResult</code> |  |
-| [options] | <code>Object</code> |  |
-
-**Returns**: <code>Promise.&lt;MountResult&gt;</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-await api.slothlet.api.modules.addModule(&quot;@cldmv/packrat-driver-opensearch&quot;);
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-api-modules-addModules"></a>
-
-#### api.slothlet.api.modules.addModules(items, [options]) ⇒ <code>Promise.&lt;MountResult[]|Object&gt;</code>
-
-Batch mount a list of modules. Accepts a heterogeneous <code>Array&lt;string | DiscoverResult&gt;</code>. Supports <code>onFailure: &quot;throw&quot; | &quot;rollback&quot; | &quot;best-effort&quot;</code> and <code>concurrency</code> for parallel batches; under <code>best-effort</code> returns the <code>{ mounted, failed }</code> aggregate instead of a plain array.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| items | <code>Array.&lt;string\|DiscoverResult&gt;</code> |  |
-| [options] | <code>Object</code> |  |
-
-**Returns**: <code>Promise.&lt;MountResult[]|Object&gt;</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-await api.slothlet.api.modules.addModules([&quot;@org/a&quot;, &quot;@org/b&quot;], { onFailure: &quot;best-effort&quot;, concurrency: 4 });
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-api-modules-removeModule"></a>
-
-#### api.slothlet.api.modules.removeModule(name, [options]) ⇒ <code>Promise.&lt;void&gt;</code>
-
-Unmount a previously-mounted module.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| name | <code>string</code> |  |
-| [options] | <code>Object</code> |  |
-
-**Returns**: <code>Promise.&lt;void&gt;</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-await api.slothlet.api.modules.removeModule(&quot;@cldmv/packrat-driver-opensearch&quot;);
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-api-modules-addDiscovered"></a>
-
-#### api.slothlet.api.modules.addDiscovered([options]) ⇒ <code>Promise.&lt;MountResult[]&gt;</code>
-
-One-shot convenience: chains <code>discover()</code> → <code>sort()</code> → <code>addModules()</code> for the most common boot-time flow.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| [options] | <code>Object</code> |  |
-
-**Returns**: <code>Promise.&lt;MountResult[]&gt;</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-await api.slothlet.api.modules.addDiscovered({ scanRoot: process.cwd(), prefix: &quot;@cldmv/packrat-driver-&quot; });
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-api-modules-getDiscoveryCache"></a>
-
-#### api.slothlet.api.modules.getDiscoveryCache() ⇒ <code>DiscoverResult[]</code>
-
-Snapshot of the current discovery cache. Returns the same <code>DiscoverResult[]</code> shape <code>discover()</code> produces.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-**Returns**: <code>DiscoverResult[]</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-const cached = api.slothlet.api.modules.getDiscoveryCache();
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-api-modules-clearDiscoveryCache"></a>
-
-#### api.slothlet.api.modules.clearDiscoveryCache() ⇒ <code>void</code>
-
-Empty the discovery cache (does NOT unmount anything already mounted).
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-**Returns**: <code>void</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-api.slothlet.api.modules.clearDiscoveryCache();
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-api-modules-getStaleMounts"></a>
-
-#### api.slothlet.api.modules.getStaleMounts() ⇒ <code>MountResult[]</code>
-
-Reconciliation aid: returns mounts whose <code>${packageName}@${version}</code> no longer appears in the discovery cache. Useful for hot-reload prune logic.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-**Returns**: <code>MountResult[]</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-const stale = api.slothlet.api.modules.getStaleMounts();
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-context-get"></a>
-
-#### api.slothlet.context.get([key]) ⇒ <code>*</code>
-
-Get a value from the current per-request context store.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| [key] | <code>string</code> |  |
-
-**Returns**: <code>*</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-await api.slothlet.context.run({ userId: 42 }, async () =&gt; {
-  const userId = api.slothlet.context.get('userId'); // 42
-});
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api' });
-  await api.slothlet.context.run({ userId: 42 }, async () =&gt; {
-    const userId = api.slothlet.context.get('userId'); // 42
-  });
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api' });
-  await api.slothlet.context.run({ userId: 42 }, async () =&gt; {
-    const userId = api.slothlet.context.get('userId'); // 42
-  });
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api' });
-await api.slothlet.context.run({ userId: 42 }, async () =&gt; {
-  const userId = api.slothlet.context.get('userId'); // 42
-});
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-context-inspect"></a>
-
-#### api.slothlet.context.inspect() ⇒ <code>Object</code>
-
-Return a snapshot of the current context state (for debugging).
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-**Returns**: <code>Object</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-await api.slothlet.context.run({ userId: 42 }, async () =&gt; {
-  const snapshot = api.slothlet.context.inspect();
-  // { data: { userId: 42 }, ... }
-});
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api' });
-  await api.slothlet.context.run({ userId: 42 }, async () =&gt; {
-    const snapshot = api.slothlet.context.inspect();
-    // { data: { userId: 42 }, ... }
-  });
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api' });
-  await api.slothlet.context.run({ userId: 42 }, async () =&gt; {
-    const snapshot = api.slothlet.context.inspect();
-    // { data: { userId: 42 }, ... }
-  });
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api' });
-await api.slothlet.context.run({ userId: 42 }, async () =&gt; {
-  const snapshot = api.slothlet.context.inspect();
-  // { data: { userId: 42 }, ... }
-});
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-context-run"></a>
-
-#### api.slothlet.context.run(contextData, callback, args) ⇒ <code>*</code>
-
-Execute a callback with isolated context data merged in.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| contextData | <code>Object</code> |  |
-| callback | <code>function</code> |  |
-| args | <code>*</code> |  |
-
-**Returns**: <code>*</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-const result = await api.slothlet.context.run({ userId: 42 }, async () =&gt; {
-  return api.myModule.getUser(); // sees context.userId = 42
-});
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api' });
-  const result = await api.slothlet.context.run({ userId: 42 }, async () =&gt; {
-    return api.myModule.getUser(); // sees context.userId = 42
-  });
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api' });
-  const result = await api.slothlet.context.run({ userId: 42 }, async () =&gt; {
-    return api.myModule.getUser(); // sees context.userId = 42
-  });
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api' });
-const result = await api.slothlet.context.run({ userId: 42 }, async () =&gt; {
-  return api.myModule.getUser(); // sees context.userId = 42
-});
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-context-scope"></a>
-
-#### api.slothlet.context.scope(options) ⇒ <code>*</code>
-
-Execute a function with structured context options (<code>context</code>, <code>fn</code>, <code>args</code>, <code>merge</code>, <code>isolation</code>).
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| options | <code>Object</code> |  |
-
-**Returns**: <code>*</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-const result = await api.slothlet.context.scope({
-  context: { userId: 42 },
-  fn: async () =&gt; api.myModule.getUser()
-});
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api' });
-  const result = await api.slothlet.context.scope({
-    context: { userId: 42 },
-    fn: async () =&gt; api.myModule.getUser()
-  });
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api' });
-  const result = await api.slothlet.context.scope({
-    context: { userId: 42 },
-    fn: async () =&gt; api.myModule.getUser()
-  });
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api' });
-const result = await api.slothlet.context.scope({
-  context: { userId: 42 },
-  fn: async () =&gt; api.myModule.getUser()
-});
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-context-set"></a>
-
-#### api.slothlet.context.set(key, value) ⇒ <code>void</code>
-
-Set a value in the current per-request context store.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| key | <code>string</code> |  |
-| value | <code>*</code> |  |
-
-**Returns**: <code>void</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-await api.slothlet.context.run({}, async () =&gt; {
-  api.slothlet.context.set('traceId', 'abc-123');
-});
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api' });
-  await api.slothlet.context.run({}, async () =&gt; {
-    api.slothlet.context.set('traceId', 'abc-123');
-  });
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api' });
-  await api.slothlet.context.run({}, async () =&gt; {
-    api.slothlet.context.set('traceId', 'abc-123');
-  });
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api' });
-await api.slothlet.context.run({}, async () =&gt; {
-  api.slothlet.context.set('traceId', 'abc-123');
-});
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-diag-caches-get"></a>
-
-#### api.slothlet.diag.caches.get() ⇒ <code>Object</code>
-
-Get full cache diagnostic data (<code>{ totalCaches, caches[] }</code>). Only available when <code>diagnostics: true</code>.
-
-> **Requires**: `diagnostics: true` in config
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-**Returns**: <code>Object</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api', diagnostics: true });
-const cacheData = api.slothlet.diag.caches.get();
-// { totalCaches: 2, caches: [...] }
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api', diagnostics: true });
-  const cacheData = api.slothlet.diag.caches.get();
-  // { totalCaches: 2, caches: [...] }
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api', diagnostics: true });
-  const cacheData = api.slothlet.diag.caches.get();
-  // { totalCaches: 2, caches: [...] }
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api', diagnostics: true });
-const cacheData = api.slothlet.diag.caches.get();
-// { totalCaches: 2, caches: [...] }
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-diag-caches-getAllModuleIDs"></a>
-
-#### api.slothlet.diag.caches.getAllModuleIDs() ⇒ <code>string[]</code>
-
-Return all moduleIDs currently in cache. Only available when <code>diagnostics: true</code>.
-
-> **Requires**: `diagnostics: true` in config
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-**Returns**: <code>string[]</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api', diagnostics: true });
-const ids = api.slothlet.diag.caches.getAllModuleIDs();
-// ['utils/math.mjs', 'utils/strings.mjs']
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api', diagnostics: true });
-  const ids = api.slothlet.diag.caches.getAllModuleIDs();
-  // ['utils/math.mjs', 'utils/strings.mjs']
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api', diagnostics: true });
-  const ids = api.slothlet.diag.caches.getAllModuleIDs();
-  // ['utils/math.mjs', 'utils/strings.mjs']
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api', diagnostics: true });
-const ids = api.slothlet.diag.caches.getAllModuleIDs();
-// ['utils/math.mjs', 'utils/strings.mjs']
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-diag-caches-has"></a>
-
-#### api.slothlet.diag.caches.has(moduleID) ⇒ <code>boolean</code>
-
-Check whether a cache entry exists for a given moduleID. Only available when <code>diagnostics: true</code>.
-
-> **Requires**: `diagnostics: true` in config
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| moduleID | <code>string</code> |  |
-
-**Returns**: <code>boolean</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api', diagnostics: true });
-const exists = api.slothlet.diag.caches.has('utils/math.mjs'); // true or false
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api', diagnostics: true });
-  const exists = api.slothlet.diag.caches.has('utils/math.mjs'); // true or false
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api', diagnostics: true });
-  const exists = api.slothlet.diag.caches.has('utils/math.mjs'); // true or false
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api', diagnostics: true });
-const exists = api.slothlet.diag.caches.has('utils/math.mjs'); // true or false
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-diag-describe"></a>
-
-#### api.slothlet.diag.describe([showAll]) ⇒ <code>*</code>
-
-Describe API structure. Pass <code>true</code> to return the full API object; omit for top-level keys only. Only available when <code>diagnostics: true</code>.
-
-> **Requires**: `diagnostics: true` in config
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| [showAll] | <code>boolean</code> |  |
-
-**Returns**: <code>*</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api', diagnostics: true });
-const keys = api.slothlet.diag.describe();
-const full = api.slothlet.diag.describe(true);
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api', diagnostics: true });
-  const keys = api.slothlet.diag.describe();
-  const full = api.slothlet.diag.describe(true);
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api', diagnostics: true });
-  const keys = api.slothlet.diag.describe();
-  const full = api.slothlet.diag.describe(true);
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api', diagnostics: true });
-const keys = api.slothlet.diag.describe();
-const full = api.slothlet.diag.describe(true);
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-diag-getAPI"></a>
-
-#### api.slothlet.diag.getAPI() ⇒ <code>Object</code>
-
-Return the live bound API proxy object. Only available when <code>diagnostics: true</code>.
-
-> **Requires**: `diagnostics: true` in config
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-**Returns**: <code>Object</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api', diagnostics: true });
-const proxy = api.slothlet.diag.getAPI(); // the live bound API proxy
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api', diagnostics: true });
-  const proxy = api.slothlet.diag.getAPI(); // the live bound API proxy
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api', diagnostics: true });
-  const proxy = api.slothlet.diag.getAPI(); // the live bound API proxy
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api', diagnostics: true });
-const proxy = api.slothlet.diag.getAPI(); // the live bound API proxy
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-diag-getOwnership"></a>
-
-#### api.slothlet.diag.getOwnership() ⇒ <code>Object</code>
-
-Return ownership diagnostics for all registered API paths. Only available when <code>diagnostics: true</code>.
-
-> **Requires**: `diagnostics: true` in config
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-**Returns**: <code>Object</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api', diagnostics: true });
-const ownership = api.slothlet.diag.getOwnership();
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api', diagnostics: true });
-  const ownership = api.slothlet.diag.getOwnership();
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api', diagnostics: true });
-  const ownership = api.slothlet.diag.getOwnership();
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api', diagnostics: true });
-const ownership = api.slothlet.diag.getOwnership();
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-diag-inspect"></a>
-
-#### api.slothlet.diag.inspect() ⇒ <code>Object</code>
-
-Return a full diagnostic snapshot of current instance state. Only available when <code>diagnostics: true</code>.
-
-> **Requires**: `diagnostics: true` in config
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-**Returns**: <code>Object</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api', diagnostics: true });
-const snapshot = api.slothlet.diag.inspect();
-console.log(snapshot.modules, snapshot.hooks);
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api', diagnostics: true });
-  const snapshot = api.slothlet.diag.inspect();
-  console.log(snapshot.modules, snapshot.hooks);
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api', diagnostics: true });
-  const snapshot = api.slothlet.diag.inspect();
-  console.log(snapshot.modules, snapshot.hooks);
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api', diagnostics: true });
-const snapshot = api.slothlet.diag.inspect();
-console.log(snapshot.modules, snapshot.hooks);
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-diag-owner-get"></a>
-
-#### api.slothlet.diag.owner.get(apiPath) ⇒ <code>string[]</code>
-
-Get the owning moduleIDs for a specific API path. Only available when <code>diagnostics: true</code>.
-
-> **Requires**: `diagnostics: true` in config
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| apiPath | <code>string</code> |  |
-
-**Returns**: <code>string[]</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api', diagnostics: true });
-const owners = api.slothlet.diag.owner.get('math.add');
-// ['utils/math.mjs']
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api', diagnostics: true });
-  const owners = api.slothlet.diag.owner.get('math.add');
-  // ['utils/math.mjs']
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api', diagnostics: true });
-  const owners = api.slothlet.diag.owner.get('math.add');
-  // ['utils/math.mjs']
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api', diagnostics: true });
-const owners = api.slothlet.diag.owner.get('math.add');
-// ['utils/math.mjs']
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-diag-SlothletWarning"></a>
-
-#### api.slothlet.diag.SlothletWarning() ⇒ <code>SlothletWarning</code>
-
-The <code>SlothletWarning</code> class — access <code>.captured</code> for warnings emitted during tests. Only available when <code>diagnostics: true</code>.
-
-> **Requires**: `diagnostics: true` in config
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-**Returns**: <code>SlothletWarning</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api', diagnostics: true });
-const SlothletWarning = api.slothlet.diag.SlothletWarning;
-console.log(SlothletWarning.captured); // array of captured warnings
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api', diagnostics: true });
-  const SlothletWarning = api.slothlet.diag.SlothletWarning;
-  console.log(SlothletWarning.captured); // array of captured warnings
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api', diagnostics: true });
-  const SlothletWarning = api.slothlet.diag.SlothletWarning;
-  console.log(SlothletWarning.captured); // array of captured warnings
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api', diagnostics: true });
-const SlothletWarning = api.slothlet.diag.SlothletWarning;
-console.log(SlothletWarning.captured); // array of captured warnings
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-hook-clear"></a>
-
-#### api.slothlet.hook.clear([filter]) ⇒ <code>void</code>
-
-Alias for <code>remove()</code>.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| [filter] | <code>Object</code> |  |
-
-**Returns**: <code>void</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api', hook: true });
-api.slothlet.hook.clear({ type: 'before' });
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api', hook: true });
-  api.slothlet.hook.clear({ type: 'before' });
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api', hook: true });
-  api.slothlet.hook.clear({ type: 'before' });
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api', hook: true });
-api.slothlet.hook.clear({ type: 'before' });
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-hook-disable"></a>
-
-#### api.slothlet.hook.disable([filter]) ⇒ <code>void</code>
-
-Disable hooks matching a filter (empty = disable all).
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| [filter] | <code>Object</code> |  |
-
-**Returns**: <code>void</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api', hook: true });
-api.slothlet.hook.disable(); // disable all
-api.slothlet.hook.disable({ type: 'before' }); // disable only before hooks
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api', hook: true });
-  api.slothlet.hook.disable(); // disable all
-  api.slothlet.hook.disable({ type: 'before' }); // disable only before hooks
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api', hook: true });
-  api.slothlet.hook.disable(); // disable all
-  api.slothlet.hook.disable({ type: 'before' }); // disable only before hooks
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api', hook: true });
-api.slothlet.hook.disable(); // disable all
-api.slothlet.hook.disable({ type: 'before' }); // disable only before hooks
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-hook-disablePattern"></a>
-
-#### api.slothlet.hook.disablePattern(pattern) ⇒ <code>number</code>
-
-Remove a path pattern from the runtime global path filter; when the last pattern is removed the filter deactivates and hooks apply to every path again.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| pattern | <code>string</code> |  |
-
-**Returns**: <code>number</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api', hook: true });
-api.slothlet.hook.enablePattern('database.<em>');
-api.slothlet.hook.disablePattern('database.</em>'); // stop restricting
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api', hook: true });
-  api.slothlet.hook.disablePattern('database.<em>');
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api', hook: true });
-  api.slothlet.hook.disablePattern('database.</em>');
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api', hook: true });
-api.slothlet.hook.disablePattern('database.*');
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-hook-enable"></a>
-
-#### api.slothlet.hook.enable([filter]) ⇒ <code>void</code>
-
-Enable hooks matching a filter (empty = enable all).
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| [filter] | <code>Object</code> |  |
-
-**Returns**: <code>void</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api', hook: true });
-api.slothlet.hook.disable();
-// later...
-api.slothlet.hook.enable(); // re-enable all
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api', hook: true });
-  api.slothlet.hook.disable();
-  // later...
-  api.slothlet.hook.enable(); // re-enable all
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api', hook: true });
-  api.slothlet.hook.disable();
-  // later...
-  api.slothlet.hook.enable(); // re-enable all
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api', hook: true });
-api.slothlet.hook.disable();
-// later...
-api.slothlet.hook.enable(); // re-enable all
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-hook-enablePattern"></a>
-
-#### api.slothlet.hook.enablePattern(pattern) ⇒ <code>number</code>
-
-Restrict hook execution to an API path pattern at runtime (global path filter; the runtime form of <code>hook.pattern</code>). Distinct from enable/disable, which toggle individual registered hooks.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| pattern | <code>string</code> |  |
-
-**Returns**: <code>number</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api', hook: true });
-api.slothlet.hook.enablePattern('database.<em>'); // only intercept database.</em> paths
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api', hook: true });
-  api.slothlet.hook.enablePattern('database.<em>');
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api', hook: true });
-  api.slothlet.hook.enablePattern('database.</em>');
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api', hook: true });
-api.slothlet.hook.enablePattern('database.*');
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-hook-list"></a>
-
-#### api.slothlet.hook.list([filter]) ⇒ <code>Object[]</code>
-
-List registered hooks matching a filter.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| [filter] | <code>Object</code> |  |
-
-**Returns**: <code>Object[]</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api', hook: true });
-const allHooks = api.slothlet.hook.list();
-const beforeHooks = api.slothlet.hook.list({ type: 'before' });
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api', hook: true });
-  const allHooks = api.slothlet.hook.list();
-  const beforeHooks = api.slothlet.hook.list({ type: 'before' });
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api', hook: true });
-  const allHooks = api.slothlet.hook.list();
-  const beforeHooks = api.slothlet.hook.list({ type: 'before' });
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api', hook: true });
-const allHooks = api.slothlet.hook.list();
-const beforeHooks = api.slothlet.hook.list({ type: 'before' });
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-hook-off"></a>
-
-#### api.slothlet.hook.off(idOrFilter) ⇒ <code>void</code>
-
-Remove hooks by ID or filter object (v2 alias for <code>remove()</code>).
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| idOrFilter | <code>string\|Object</code> |  |
-
-**Returns**: <code>void</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api', hook: true });
-const hookId = api.slothlet.hook.on('math.<em>:before', handler);
-api.slothlet.hook.off(hookId); // remove by ID
-api.slothlet.hook.off({ type: 'after' }); // remove by filter
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api', hook: true });
-  const hookId = api.slothlet.hook.on('math.</em>:before', handler);
-  api.slothlet.hook.off(hookId); // remove by ID
-  api.slothlet.hook.off({ type: 'after' }); // remove by filter
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api', hook: true });
-  const hookId = api.slothlet.hook.on('math.<em>:before', handler);
-  api.slothlet.hook.off(hookId); // remove by ID
-  api.slothlet.hook.off({ type: 'after' }); // remove by filter
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api', hook: true });
-const hookId = api.slothlet.hook.on('math.</em>:before', handler);
-api.slothlet.hook.off(hookId); // remove by ID
-api.slothlet.hook.off({ type: 'after' }); // remove by filter
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-hook-on"></a>
-
-#### api.slothlet.hook.on(typePattern, handler, [options]) ⇒ <code>string</code>
-
-Register a hook handler for a path-then-type pattern (e.g. <code>&quot;math.*:before&quot;</code>; the legacy <code>&quot;before:math.*&quot;</code> form is deprecated).
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| typePattern | <code>string</code> |  |
-| handler | <code>function</code> |  |
-| [options] | <code>Object</code> |  |
-
-**Returns**: <code>string</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api', hook: true });
-const hookId = api.slothlet.hook.on('math.<em>:before', ({ args }) =&gt; {
-  console.log('math called with', args);
-});
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api', hook: true });
-  const hookId = api.slothlet.hook.on('math.</em>:before', ({ args }) =&gt; {
-    console.log('math called with', args);
-  });
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api', hook: true });
-  const hookId = api.slothlet.hook.on('math.<em>:before', ({ args }) =&gt; {
-    console.log('math called with', args);
-  });
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api', hook: true });
-const hookId = api.slothlet.hook.on('math.</em>:before', ({ args }) =&gt; {
-  console.log('math called with', args);
-});
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-hook-pin-enable"></a>
-
-#### api.slothlet.hook.pin.enable() ⇒ <code>boolean</code>
-
-Enforce hook pinning: a module hook's <code>lockCaller: false</code> is ignored (force-pinned). Host-only.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-**Returns**: <code>boolean</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api', hook: true });
-api.slothlet.hook.pin.enable(); // force-pin module hooks (host only)
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-hook-pin-disable"></a>
-
-#### api.slothlet.hook.pin.disable() ⇒ <code>boolean</code>
-
-Stop enforcing hook pinning: permit a per-registration <code>lockCaller: false</code> on module hooks. Host-only.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-**Returns**: <code>boolean</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api', hook: true });
-api.slothlet.hook.pin.disable(); // permit unpinned module hooks (host only)
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-hook-remove"></a>
-
-#### api.slothlet.hook.remove([filter]) ⇒ <code>void</code>
-
-Remove hooks matching a filter (<code>id</code>, <code>type</code>, <code>pattern</code>).
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| [filter] | <code>Object</code> |  |
-
-**Returns**: <code>void</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api', hook: true });
-api.slothlet.hook.remove({ type: 'before', pattern: 'math.<em>' });
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api', hook: true });
-  api.slothlet.hook.remove({ type: 'before', pattern: 'math.</em>' });
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api', hook: true });
-  api.slothlet.hook.remove({ type: 'before', pattern: 'math.<em>' });
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api', hook: true });
-api.slothlet.hook.remove({ type: 'before', pattern: 'math.</em>' });
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-hook-resetPatternFilter"></a>
-
-#### api.slothlet.hook.resetPatternFilter() ⇒ <code>void</code>
-
-Reset the runtime global path filter back to the configured <code>hook.pattern</code> default (fully unrestricted if that default was <code>&quot;**&quot;</code>).
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-**Returns**: <code>void</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api', hook: 'database.<em>' });
-api.slothlet.hook.enablePattern('cache.</em>');
-api.slothlet.hook.resetPatternFilter(); // back to database.* only
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api', hook: 'database.<em>' });
-  api.slothlet.hook.resetPatternFilter();
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api', hook: 'database.</em>' });
-  api.slothlet.hook.resetPatternFilter();
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api', hook: 'database.*' });
-api.slothlet.hook.resetPatternFilter();
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-lifecycle-off"></a>
-
-#### api.slothlet.lifecycle.off(event, handler) ⇒ <code>void</code>
-
-Unsubscribe a handler from a lifecycle event.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| event | <code>string</code> |  |
-| handler | <code>function</code> |  |
-
-**Returns**: <code>void</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-const handler = () =&gt; console.log('shutdown');
-api.slothlet.lifecycle.on('shutdown', handler);
-api.slothlet.lifecycle.off('shutdown', handler);
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api' });
-  const handler = () =&gt; console.log('shutdown');
-  api.slothlet.lifecycle.on('shutdown', handler);
-  api.slothlet.lifecycle.off('shutdown', handler);
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api' });
-  const handler = () =&gt; console.log('shutdown');
-  api.slothlet.lifecycle.on('shutdown', handler);
-  api.slothlet.lifecycle.off('shutdown', handler);
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api' });
-const handler = () =&gt; console.log('shutdown');
-api.slothlet.lifecycle.on('shutdown', handler);
-api.slothlet.lifecycle.off('shutdown', handler);
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-lifecycle-on"></a>
-
-#### api.slothlet.lifecycle.on(event, handler) ⇒ <code>void</code>
-
-Subscribe to a lifecycle event (e.g. <code>&quot;materialized:complete&quot;</code>).
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| event | <code>string</code> |  |
-| handler | <code>function</code> |  |
-
-**Returns**: <code>void</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-api.slothlet.lifecycle.on('shutdown', () =&gt; {
-  console.log('Slothlet is shutting down');
-});
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api' });
-  api.slothlet.lifecycle.on('shutdown', () =&gt; {
-    console.log('Slothlet is shutting down');
-  });
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api' });
-  api.slothlet.lifecycle.on('shutdown', () =&gt; {
-    console.log('Slothlet is shutting down');
-  });
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api' });
-api.slothlet.lifecycle.on('shutdown', () =&gt; {
-  console.log('Slothlet is shutting down');
-});
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-materialize-get"></a>
-
-#### api.slothlet.materialize.get() ⇒ <code>Object</code>
-
-Get current materialization statistics (<code>{ total, materialized, remaining, percentage }</code>).
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-**Returns**: <code>Object</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api', mode: 'lazy' });
-const stats = api.slothlet.materialize.get();
-// { total: 5, materialized: 3, remaining: 2, percentage: 60 }
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api', mode: 'lazy' });
-  const stats = api.slothlet.materialize.get();
-  // { total: 5, materialized: 3, remaining: 2, percentage: 60 }
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api', mode: 'lazy' });
-  const stats = api.slothlet.materialize.get();
-  // { total: 5, materialized: 3, remaining: 2, percentage: 60 }
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api', mode: 'lazy' });
-const stats = api.slothlet.materialize.get();
-// { total: 5, materialized: 3, remaining: 2, percentage: 60 }
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-materialize-wait"></a>
-
-#### api.slothlet.materialize.wait() ⇒ <code>Promise.&lt;void&gt;</code>
-
-Returns a Promise that resolves when all lazy folders are fully materialized.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-**Returns**: <code>Promise.&lt;void&gt;</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api', mode: 'lazy' });
-await api.slothlet.materialize.wait(); // resolves when all lazy modules are loaded
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api', mode: 'lazy' });
-  await api.slothlet.materialize.wait(); // resolves when all lazy modules are loaded
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api', mode: 'lazy' });
-  await api.slothlet.materialize.wait(); // resolves when all lazy modules are loaded
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api', mode: 'lazy' });
-await api.slothlet.materialize.wait(); // resolves when all lazy modules are loaded
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-metadata-caller"></a>
-
-#### api.slothlet.metadata.caller() ⇒ <code>Object|null</code>
-
-Get metadata for the function that invoked the current one (runtime-injected).
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-**Returns**: <code>Object|null</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-// Inside an API module, get metadata of the calling function:
-const callerMeta = api.slothlet.metadata.caller(); // null if no caller
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api' });
-  // Inside an API module, get metadata of the calling function:
-  const callerMeta = api.slothlet.metadata.caller(); // null if no caller
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api' });
-  // Inside an API module, get metadata of the calling function:
-  const callerMeta = api.slothlet.metadata.caller(); // null if no caller
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api' });
-// Inside an API module, get metadata of the calling function:
-const callerMeta = api.slothlet.metadata.caller(); // null if no caller
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-metadata-get"></a>
-
-#### api.slothlet.metadata.get(fn) ⇒ <code>Object</code>
-
-Get metadata for a specific function reference.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| fn | <code>function</code> |  |
-
-**Returns**: <code>Object</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-api.slothlet.metadata.set(api.math.add, 'label', 'Addition');
-const meta = api.slothlet.metadata.get(api.math.add);
-// { label: 'Addition' }
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api' });
-  api.slothlet.metadata.set(api.math.add, 'label', 'Addition');
-  const meta = api.slothlet.metadata.get(api.math.add);
-  // { label: 'Addition' }
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api' });
-  api.slothlet.metadata.set(api.math.add, 'label', 'Addition');
-  const meta = api.slothlet.metadata.get(api.math.add);
-  // { label: 'Addition' }
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api' });
-api.slothlet.metadata.set(api.math.add, 'label', 'Addition');
-const meta = api.slothlet.metadata.get(api.math.add);
-// { label: 'Addition' }
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-metadata-remove"></a>
-
-#### api.slothlet.metadata.remove(fn, [key]) ⇒ <code>void</code>
-
-Remove per-function metadata (all keys or a specific key).
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| fn | <code>function</code> |  |
-| [key] | <code>string</code> |  |
-
-**Returns**: <code>void</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-api.slothlet.metadata.set(api.math.add, 'label', 'Addition');
-api.slothlet.metadata.remove(api.math.add, 'label'); // remove key
-api.slothlet.metadata.remove(api.math.add); // remove all
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api' });
-  api.slothlet.metadata.set(api.math.add, 'label', 'Addition');
-  api.slothlet.metadata.remove(api.math.add, 'label'); // remove key
-  api.slothlet.metadata.remove(api.math.add); // remove all
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api' });
-  api.slothlet.metadata.set(api.math.add, 'label', 'Addition');
-  api.slothlet.metadata.remove(api.math.add, 'label'); // remove key
-  api.slothlet.metadata.remove(api.math.add); // remove all
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api' });
-api.slothlet.metadata.set(api.math.add, 'label', 'Addition');
-api.slothlet.metadata.remove(api.math.add, 'label'); // remove key
-api.slothlet.metadata.remove(api.math.add); // remove all
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-metadata-getFor"></a>
-
-#### api.slothlet.metadata.getFor(pathOrModuleId) ⇒ <code>Object</code>
-
-Get merged user metadata for an API path or moduleID. Walks root-to-leaf so descendants inherit ancestor entries automatically. Returns an empty object when no metadata is registered for the path. The returned object is not frozen — callers MUST NOT mutate it, since modifications would affect the live metadata store. Used internally by the module discovery system to round-trip the per-module manifest stored at the mount point under the <code>_module</code> key.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| pathOrModuleId | <code>string</code> |  |
-
-**Returns**: <code>Object</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-await api.slothlet.api.modules.addDiscovered({ scanRoot: process.cwd() });
-const meta = api.slothlet.metadata.getFor('drivers.opensearch');
-console.log(meta._module?.manifest); // { schemaVersion: 1, name: '@org/foo', version: '1.4.2', ... }
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-metadata-removeFor"></a>
-
-#### api.slothlet.metadata.removeFor(pathOrModuleId, [key]) ⇒ <code>void</code>
-
-Remove path-level metadata for a given API path or moduleID.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| pathOrModuleId | <code>string</code> |  |
-| [key] | <code>string\|Array.&lt;string&gt;</code> |  |
-
-**Returns**: <code>void</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-api.slothlet.metadata.removeFor('math', 'label'); // remove 'label' from all math functions
-api.slothlet.metadata.removeFor('math'); // remove all metadata
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api' });
-  api.slothlet.metadata.removeFor('math', 'label'); // remove 'label' from all math functions
-  api.slothlet.metadata.removeFor('math'); // remove all metadata
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api' });
-  api.slothlet.metadata.removeFor('math', 'label'); // remove 'label' from all math functions
-  api.slothlet.metadata.removeFor('math'); // remove all metadata
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api' });
-api.slothlet.metadata.removeFor('math', 'label'); // remove 'label' from all math functions
-api.slothlet.metadata.removeFor('math'); // remove all metadata
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-metadata-self"></a>
-
-#### api.slothlet.metadata.self() ⇒ <code>Object|null</code>
-
-Get metadata for the currently-executing API function (runtime-injected).
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-**Returns**: <code>Object|null</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-api.slothlet.metadata.set(api.math.add, 'label', 'Addition');
-// Inside api.math.add, get its own metadata:
-const ownMeta = api.slothlet.metadata.self(); // { label: 'Addition' }
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api' });
-  api.slothlet.metadata.set(api.math.add, 'label', 'Addition');
-  // Inside api.math.add, get its own metadata:
-  const ownMeta = api.slothlet.metadata.self(); // { label: 'Addition' }
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api' });
-  api.slothlet.metadata.set(api.math.add, 'label', 'Addition');
-  // Inside api.math.add, get its own metadata:
-  const ownMeta = api.slothlet.metadata.self(); // { label: 'Addition' }
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api' });
-api.slothlet.metadata.set(api.math.add, 'label', 'Addition');
-// Inside api.math.add, get its own metadata:
-const ownMeta = api.slothlet.metadata.self(); // { label: 'Addition' }
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-metadata-set"></a>
-
-#### api.slothlet.metadata.set(fn, key, value) ⇒ <code>void</code>
-
-Set per-function metadata by direct function reference.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| fn | <code>function</code> |  |
-| key | <code>string</code> |  |
-| value | <code>*</code> |  |
-
-**Returns**: <code>void</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-api.slothlet.metadata.set(api.math.add, 'label', 'Addition');
-api.slothlet.metadata.set(api.math.add, 'tags', ['math', 'util']);
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api' });
-  api.slothlet.metadata.set(api.math.add, 'label', 'Addition');
-  api.slothlet.metadata.set(api.math.add, 'tags', ['math', 'util']);
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api' });
-  api.slothlet.metadata.set(api.math.add, 'label', 'Addition');
-  api.slothlet.metadata.set(api.math.add, 'tags', ['math', 'util']);
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api' });
-api.slothlet.metadata.set(api.math.add, 'label', 'Addition');
-api.slothlet.metadata.set(api.math.add, 'tags', ['math', 'util']);
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-metadata-setFor"></a>
-
-#### api.slothlet.metadata.setFor(pathOrModuleId, keyOrObj, [value]) ⇒ <code>void</code>
-
-Set metadata for all functions reachable under an API path or moduleID.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| pathOrModuleId | <code>string</code> |  |
-| keyOrObj | <code>string\|Object</code> |  |
-| [value] | <code>*</code> |  |
-
-**Returns**: <code>void</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-api.slothlet.metadata.setFor('math', 'category', 'utilities');
-api.slothlet.metadata.setFor('math', { category: 'utils', version: '1.0' });
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api' });
-  api.slothlet.metadata.setFor('math', 'category', 'utilities');
-  api.slothlet.metadata.setFor('math', { category: 'utils', version: '1.0' });
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api' });
-  api.slothlet.metadata.setFor('math', 'category', 'utilities');
-  api.slothlet.metadata.setFor('math', { category: 'utils', version: '1.0' });
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api' });
-api.slothlet.metadata.setFor('math', 'category', 'utilities');
-api.slothlet.metadata.setFor('math', { category: 'utils', version: '1.0' });
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-metadata-setGlobal"></a>
-
-#### api.slothlet.metadata.setGlobal(key, value) ⇒ <code>void</code>
-
-Set global metadata applied to every function in the instance.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| key | <code>string</code> |  |
-| value | <code>*</code> |  |
-
-**Returns**: <code>void</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-api.slothlet.metadata.setGlobal('version', '2.0');
-// Every function now has metadata: { version: '2.0' }
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api' });
-  api.slothlet.metadata.setGlobal('version', '2.0');
-  // Every function now has metadata: { version: '2.0' }
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api' });
-  api.slothlet.metadata.setGlobal('version', '2.0');
-  // Every function now has metadata: { version: '2.0' }
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api' });
-api.slothlet.metadata.setGlobal('version', '2.0');
-// Every function now has metadata: { version: '2.0' }
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-owner-get"></a>
-
-#### api.slothlet.owner.get(apiPath) ⇒ <code>Object</code>
-
-Get ownership info for a specific API path.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| apiPath | <code>string</code> |  |
-
-**Returns**: <code>Object</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-const info = api.slothlet.owner.get('math.add');
-// { path: 'math.add', owners: Set { 'utils/math.mjs' } }
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api' });
-  const info = api.slothlet.owner.get('math.add');
-  // { path: 'math.add', owners: Set { 'utils/math.mjs' } }
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api' });
-  const info = api.slothlet.owner.get('math.add');
-  // { path: 'math.add', owners: Set { 'utils/math.mjs' } }
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api' });
-const info = api.slothlet.owner.get('math.add');
-// { path: 'math.add', owners: Set { 'utils/math.mjs' } }
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-ownership-get"></a>
-
-#### api.slothlet.ownership.get(apiPath) ⇒ <code>Set.&lt;string&gt;</code>
-
-Get the set of moduleIDs that own a given API path.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| apiPath | <code>string</code> |  |
-
-**Returns**: <code>Set.&lt;string&gt;</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-const owners = api.slothlet.ownership.get('math.add');
-// Set { 'utils/math.mjs' }
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api' });
-  const owners = api.slothlet.ownership.get('math.add');
-  // Set { 'utils/math.mjs' }
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api' });
-  const owners = api.slothlet.ownership.get('math.add');
-  // Set { 'utils/math.mjs' }
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api' });
-const owners = api.slothlet.ownership.get('math.add');
-// Set { 'utils/math.mjs' }
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-ownership-unregister"></a>
-
-#### api.slothlet.ownership.unregister(moduleID) ⇒ <code>void</code>
-
-Unregister a module from all ownership records.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| moduleID | <code>string</code> |  |
-
-**Returns**: <code>void</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-await api.slothlet.api.remove('math');
-api.slothlet.ownership.unregister('utils/math.mjs');
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api' });
-  await api.slothlet.api.remove('math');
-  api.slothlet.ownership.unregister('utils/math.mjs');
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api' });
-  await api.slothlet.api.remove('math');
-  api.slothlet.ownership.unregister('utils/math.mjs');
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api' });
-await api.slothlet.api.remove('math');
-api.slothlet.ownership.unregister('utils/math.mjs');
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-permissions-control-enable"></a>
-
-#### api.slothlet.permissions.control.enable() ⇒ <code>void</code>
-
-Enable permission enforcement globally.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-**Returns**: <code>void</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api', permissions: { defaultPolicy: 'allow' } });
-api.slothlet.permissions.control.enable();
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-permissions-control-disable"></a>
-
-#### api.slothlet.permissions.control.disable() ⇒ <code>void</code>
-
-Disable permission enforcement globally (all calls allowed).
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-**Returns**: <code>void</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api', permissions: { defaultPolicy: 'deny' } });
-api.slothlet.permissions.control.disable();
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-permissions-control-readGating"></a>
-
-#### api.slothlet.permissions.control.readGating(value) ⇒ <code>void</code>
-
-Enable or disable read-level permission gating at runtime. Throws <code>INVALID_ARGUMENT</code> for a non-boolean argument.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| value | <code>boolean</code> |  |
-
-**Returns**: <code>void</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api', permissions: { defaultPolicy: 'allow' } });
-api.slothlet.permissions.control.readGating(false); // stop gating reads
-api.slothlet.permissions.control.readGating(true);  // resume
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-permissions-control-seal"></a>
-
-#### api.slothlet.permissions.control.seal() ⇒ <code>void</code>
-
-Seal the permission control surface (one-way, no unseal). After sealing, <code>enable</code>/<code>disable</code>, <code>addRule</code>/<code>removeRule</code>, <code>readGating</code>, and <code>principal.register</code>/<code>principal.unregister</code> throw <code>PERMISSION_SEALED</code>. Enforcement continues to evaluate, <code>principal.invalidate</code> and <code>shutdown()</code> still work. Idempotent.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-**Returns**: <code>void</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api', permissions: { defaultPolicy: 'allow' } });
-api.slothlet.permissions.control.seal();
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-versioning-list"></a>
-
-#### api.slothlet.versioning.list(logicalPath) ⇒ <code>{versions: object, default: string|null}|undefined</code>
-
-List all registered versions for a logical API path. Returns <code>undefined</code> if the path has no registered versions or if versioning has not yet been used.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| logicalPath | <code>string</code> |  |
-
-**Returns**: <code>{versions: object, default: string|null}|undefined</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api', versionDispatcher: &quot;version&quot; });
-await api.slothlet.api.add('auth', './api/v1', {}, { version: 'v1', default: true });
-const info = api.slothlet.versioning.list('auth');
-if (info) console.log(info.default); // &quot;v1&quot;
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-versioning-setDefault"></a>
-
-#### api.slothlet.versioning.setDefault(logicalPath, versionTag) ⇒ <code>void</code>
-
-Override the default version for a logical API path at runtime. If no versions are registered for the path, this call has no effect until versioning data exists.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| logicalPath | <code>string</code> |  |
-| versionTag | <code>string</code> |  |
-
-**Returns**: <code>void</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api', versionDispatcher: &quot;version&quot; });
-await api.slothlet.api.add('auth', './api/v1', {}, { version: 'v1' });
-await api.slothlet.api.add('auth', './api/v2', {}, { version: 'v2' });
-api.slothlet.versioning.setDefault('auth', 'v1');
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-versioning-unregister"></a>
-
-#### api.slothlet.versioning.unregister(logicalPath, versionTag) ⇒ <code>Promise.&lt;boolean&gt;</code>
-
-Unregister a specific version from a logical API path. Removes the versioned namespace (<code>vX.path</code>) and updates or tears down the dispatcher. If the logical path/version is not registered, this resolves without removing anything.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| logicalPath | <code>string</code> |  |
-| versionTag | <code>string</code> |  |
-
-**Returns**: <code>Promise.&lt;boolean&gt;</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api', versionDispatcher: &quot;version&quot; });
-await api.slothlet.api.add('auth', './api/v1', {}, { version: 'v1' });
-await api.slothlet.api.add('auth', './api/v2', {}, { version: 'v2' });
-const removed = await api.slothlet.versioning.unregister('auth', 'v2'); // true
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-versioning-getVersionMetadata"></a>
-
-#### api.slothlet.versioning.getVersionMetadata(logicalPath, versionTag) ⇒ <code>object|undefined</code>
-
-Retrieve the VersionManager-only metadata stored at registration time via <code>versionConfig.metadata</code>. Returns <code>undefined</code> if the path or version is not registered, or if versioning has not yet been used.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| logicalPath | <code>string</code> |  |
-| versionTag | <code>string</code> |  |
-
-**Returns**: <code>object|undefined</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api', versionDispatcher: &quot;version&quot; });
-await api.slothlet.api.add('auth', './api/v1', {}, { version: 'v1', metadata: { stable: true } });
-const meta = api.slothlet.versioning.getVersionMetadata('auth', 'v1'); // { stable: true, version: 'v1', logicalPath: 'auth' }
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-versioning-setVersionMetadata"></a>
-
-#### api.slothlet.versioning.setVersionMetadata(logicalPath, versionTag, patch) ⇒ <code>void</code>
-
-Patch (merge) the VersionManager-only metadata for a registered version at runtime. The injected <code>version</code> and <code>logicalPath</code> keys always win over supplied patch fields. Throws <code>VERSION_NOT_FOUND</code> if the path or version is not registered.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| logicalPath | <code>string</code> |  |
-| versionTag | <code>string</code> |  |
-| patch | <code>object</code> |  |
-
-**Returns**: <code>void</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api', versionDispatcher: &quot;version&quot; });
-await api.slothlet.api.add('auth', './api/v1', {}, { version: 'v1' });
-api.slothlet.versioning.setVersionMetadata('auth', 'v1', { stable: true });
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-lockCaller"></a>
-
-#### api.slothlet.lockCaller(fn) ⇒ <code>function</code>
-
-Freeze the registering module's caller identity onto a callback. The returned wrapper overrides only the caller identity when invoked; request-scoped context stays live. In <strong>async</strong> runtime mode the pinned identity propagates through <code>AsyncLocalStorage</code> for the callback's full async lifetime. In <strong>live</strong> runtime mode identity is pinned only for the synchronous portion — once <code>fn</code> returns its promise the live context is restored, so an async callback that <code>await</code>s before calling <code>self.*</code> resumes with no slothlet caller at all (an identity check sees <code>unknown</code>); use async runtime mode for async hooks (e.g. Fastify <code>addHook</code>) that must keep identity past the first <code>await</code>.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| fn | <code>function</code> |  |
-
-**Returns**: <code>function</code>
-
-**Example**
-```javascript
-// Inside a module's init()
-server.addHook(&quot;onRequest&quot;, self.slothlet.lockCaller(handler));
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-bind"></a>
-
-#### api.slothlet.bind(fn) ⇒ <code>function</code>
-
-Freeze the entire async context onto a callback at registration time (convenience re-export of <code>AsyncResource.bind</code>). Unlike <code>lockCaller</code>, which overrides only caller identity and leaves request-scoped context live, <code>bind</code> freezes every <code>AsyncLocalStorage</code>, including slothlet's caller and context. Meaningful in async runtime mode; degrades to non-slothlet ALS context in live mode.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| fn | <code>function</code> |  |
-
-**Returns**: <code>function</code>
-
-**Example**
-```javascript
-// Inside a module's init()
-server.addHook(&quot;onRequest&quot;, self.slothlet.bind(handler));
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-reload"></a>
-
-#### api.slothlet.reload([options]) ⇒ <code>Promise.&lt;void&gt;</code>
-
-Reload the entire instance (re-scans the directory and recreates all module references). Accepts <code>{ keepInstanceID: boolean }</code>.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| [options] | <code>Object</code> |  |
-
-**Returns**: <code>Promise.&lt;void&gt;</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-await api.slothlet.reload(); // full reload
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api' });
-  await api.slothlet.reload(); // full reload
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api' });
-  await api.slothlet.reload(); // full reload
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api' });
-await api.slothlet.reload(); // full reload
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-run"></a>
-
-#### api.slothlet.run(contextData, callback, args) ⇒ <code>*</code>
-
-Execute a callback with isolated per-request context data. Convenience alias for <code>slothlet.context.run()</code>.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| contextData | <code>Object</code> |  |
-| callback | <code>function</code> |  |
-| args | <code>*</code> |  |
-
-**Returns**: <code>*</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-const result = await api.slothlet.run({ userId: 42 }, async () =&gt; {
-  return api.myModule.getUser();
-});
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api' });
-  const result = await api.slothlet.run({ userId: 42 }, async () =&gt; {
-    return api.myModule.getUser();
-  });
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api' });
-  const result = await api.slothlet.run({ userId: 42 }, async () =&gt; {
-    return api.myModule.getUser();
-  });
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api' });
-const result = await api.slothlet.run({ userId: 42 }, async () =&gt; {
-  return api.myModule.getUser();
-});
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-scope"></a>
-
-#### api.slothlet.scope(options) ⇒ <code>*</code>
-
-Execute a function with full structured per-request context options. Convenience alias for <code>slothlet.context.scope()</code>.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| options | <code>Object</code> |  |
-
-**Returns**: <code>*</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-const result = await api.slothlet.scope({
-  context: { userId: 42 },
-  fn: async () =&gt; api.myModule.getUser()
-});
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api' });
-  const result = await api.slothlet.scope({
-    context: { userId: 42 },
-    fn: async () =&gt; api.myModule.getUser()
-  });
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api' });
-  const result = await api.slothlet.scope({
-    context: { userId: 42 },
-    fn: async () =&gt; api.myModule.getUser()
-  });
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api' });
-const result = await api.slothlet.scope({
-  context: { userId: 42 },
-  fn: async () =&gt; api.myModule.getUser()
-});
-```
-
-* * *
-
-<a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-shutdown"></a>
-
-#### api.slothlet.shutdown() ⇒ <code>Promise.&lt;void&gt;</code>
-
-Shut down the instance and release all resources.
-
-**Kind**: function property of [<code>SlothletAPI</code>](#typedef_module_at_cldmv_slash_slothlet_SlothletAPI)
-
-**Returns**: <code>Promise.&lt;void&gt;</code>
-
-**Example**
-```javascript
-// ESM usage via slothlet API
-import slothlet from &quot;@cldmv/slothlet&quot;;
-const api = await slothlet({ base: './api' });
-await api.slothlet.shutdown();
-```
-
-**Example**
-```javascript
-// ESM usage via slothlet API (inside async function)
-async function example() {
-  const { default: slothlet } = await import(&quot;@cldmv/slothlet&quot;);
-  const api = await slothlet({ base: './api' });
-  await api.slothlet.shutdown();
-}
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (top-level)
-let slothlet;
-(async () =&gt; {
-  ({ slothlet } = await import(&quot;@cldmv/slothlet&quot;));
-  const api = await slothlet({ base: './api' });
-  await api.slothlet.shutdown();
-})();
-```
-
-**Example**
-```javascript
-// CJS usage via slothlet API (inside async function)
-const slothlet = require(&quot;@cldmv/slothlet&quot;);
-const api = await slothlet({ base: './api' });
-await api.slothlet.shutdown();
-```
-
-* * *
-
-
-| Property | Type | Description |
-| --- | --- | --- |
-| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet"></a>slothlet | <code>object</code> | Built-in control namespace. All framework internals live here to avoid collisions with loaded modules. |
-| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-env"></a>slothlet.env | <code>Readonly.<Record.<string, (string|undefined)>></code> | Frozen snapshot of `process.env` captured once at instance creation (before any module lifecycle runs). Immutable for the lifetime of the instance — reloads do NOT refresh it. When `env.include` is configured, only the listed keys are captured; otherwise, the full environment is snapshotted. |
-| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-api"></a>slothlet.api | <code>object</code> | Runtime API mutation methods — availability controlled by `api.mutations` config option. |
-| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-api-modules"></a>slothlet.api.modules | <code>object</code> | Module discovery + mount sub-namespace. Composes subsystems shipped as separate npm packages (each with a `slothlet.module.json` manifest) into this api tree at runtime. Each method is typed as `Function` here; the detailed parameter / return shapes (`DiscoverOptions`, `DiscoverResult`, `AddModuleOptions`, `AddModulesOptions`, `MountResult`, `FailureEntry`) live in <a href="../docs/MODULE-DISCOVERY.md">`docs/MODULE-DISCOVERY.md`</a>, which also covers multi-version routing, error codes, and the `modules:*` lifecycle events. |
-| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-context"></a>slothlet.context | <code>object</code> | Per-request context helpers. |
-| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-diag"></a>[slothlet.diag] | <code>object</code> | Diagnostics namespace — only present when `diagnostics: true`. Do not enable in production. |
-| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-diag-caches"></a>[slothlet.diag.caches] | <code>object</code> | Cache diagnostics sub-namespace. |
-| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-diag-context"></a>[slothlet.diag.context] | <code>object</code> | The `context` config value as passed to `slothlet()`. |
-| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-diag-hook"></a>[slothlet.diag.hook] | <code>object</code> | Hook system diagnostics sub-namespace (present only when hooks are enabled). |
-| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-diag-owner"></a>[slothlet.diag.owner] | <code>object</code> | Ownership sub-namespace for diagnostics. |
-| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-diag-reference"></a>[slothlet.diag.reference] | <code>object</code> | The `reference` config value as passed to `slothlet()`. |
-| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-hook"></a>slothlet.hook | <code>object</code> | Hook registration surface — only present when the `hook` option is enabled. |
-| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-hook-pin"></a>slothlet.hook.pin | <code>object</code> | Host-only runtime control over hook-pinning enforcement (mirrors `permissions.control`). "Host-only" is enforced by the built-in `slothlet.hook.**` permission deny baseline, so it only holds when the permission system is enabled — without permissions a module reaching the hook surface can toggle it. Force-pinning makes a module hook always run under its registering module's identity; an unpinned module hook is a permission-bypass vector. Enabled by default (config `hook.pin`). |
-| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-hook-pin-enabled"></a>slothlet.hook.pin.enabled | <code>boolean</code> | Whether hook pinning is currently enforced (true = module hooks are force-pinned, the default). %%sig: boolean%% %%example: // ESM usage via slothlet API\|import slothlet from "@cldmv/slothlet";\|const api = await slothlet({ base: './api', hook: true });\|const enforced = api.slothlet.hook.pin.enabled;%% |
-| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-lifecycle"></a>slothlet.lifecycle | <code>object</code> | Lifecycle event emitter. |
-| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-materialize"></a>slothlet.materialize | <code>object</code> | Lazy materialization tracking (meaningful only when `mode: "lazy"`). |
-| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-materialize-materialized"></a>slothlet.materialize.materialized | <code>boolean</code> | `true` once all lazy folders have been fully loaded. |
-| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-metadata"></a>slothlet.metadata | <code>object</code> | Module metadata accessor. |
-| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-owner"></a>slothlet.owner | <code>object</code> | Direct path ownership accessor (shorthand for `slothlet.ownership`). |
-| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-ownership"></a>slothlet.ownership | <code>object</code> | Module ownership registry. |
-| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-permissions"></a>slothlet.permissions | <code>object</code> | Permission system surface — present whenever a `permissions` block is configured. Rule registration (`addRule`/`removeRule`), principal resolvers (`principal.*`), self/global introspection (`self.*`, `global.*`), and runtime control (`control.*`) live here. Only the `control` sub-namespace is typed in this typedef; the rule-management methods are documented in <a href="../docs/PERMISSIONS.md">`docs/PERMISSIONS.md`</a>. |
-| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-permissions-control"></a>slothlet.permissions.control | <code>object</code> | Runtime control over permission enforcement. |
-| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-permissions-control-enabled"></a>slothlet.permissions.control.enabled | <code>boolean</code> | Current permission-enforcement state. Exposed as a getter so descriptor-based reads remain permission-gated. %%sig: boolean%% %%example: // ESM usage via slothlet API\|import slothlet from "@cldmv/slothlet";\|const api = await slothlet({ base: './api', permissions: { defaultPolicy: 'allow' } });\|const on = api.slothlet.permissions.control.enabled;%% |
-| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-permissions-control-readGatingEnabled"></a>slothlet.permissions.control.readGatingEnabled | <code>boolean</code> | Current read-level gating state. `true` when terminal data-value property reads are permission-gated. Exposed as a getter so descriptor-based reads remain permission-gated. %%sig: boolean%% %%example: // ESM usage via slothlet API\|import slothlet from "@cldmv/slothlet";\|const api = await slothlet({ base: './api', permissions: { defaultPolicy: 'allow' } });\|const gated = api.slothlet.permissions.control.readGatingEnabled;%% |
-| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-permissions-control-sealed"></a>slothlet.permissions.control.sealed | <code>boolean</code> | Whether the permission control surface has been sealed. Exposed as a getter so descriptor-based reads remain permission-gated. %%sig: boolean%% %%example: // ESM usage via slothlet API\|import slothlet from "@cldmv/slothlet";\|const api = await slothlet({ base: './api', permissions: { defaultPolicy: 'allow' } });\|const sealed = api.slothlet.permissions.control.sealed;%% |
-| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-versioning"></a>slothlet.versioning | <code>object</code> | Runtime version management API. This namespace is always present on `api.slothlet`; before any module has been registered via `api.slothlet.api.add()` with a `versionConfig` argument, its methods return `undefined` where documented or otherwise have no effect until versioning data exists. |
-| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletAPI_prop_slothlet-reference"></a>[slothlet.reference] | <code>object</code> | The `reference` object from config, merged onto the root API and accessible here. |
-
-
 * * *
 
 
@@ -3743,8 +273,8 @@ await api.slothlet.shutdown();
 > <tbody>
 > <tr>
 > <td><code>self</code></td>
-> <td><code>object</code></td>
-> <td>Live reference to the full Slothlet API proxy. Use to call sibling modules without import cycles.</td>
+> <td><code>SlothletSelf</code></td>
+> <td>Live reference to the full Slothlet API proxy. Use to call sibling modules without import cycles. Typed by extending <code>SlothletSelf</code> (see <code>slothlet typegen</code>).</td>
 > </tr>
 > <tr>
 > <td><code>context</code></td>
diff --git a/src/lib/handlers/unified-wrapper.mjs b/src/lib/handlers/unified-wrapper.mjs
index 44a96b74d..d1ca9770a 100644
--- a/src/lib/handlers/unified-wrapper.mjs
+++ b/src/lib/handlers/unified-wrapper.mjs
@@ -1864,6 +1864,14 @@ export class UnifiedWrapper extends ComponentBase {
 				continue;
 			}
 			/* v8 ignore stop */
+			// A function's non-enumerable own properties are its own surface, not child endpoints — the
+			// same rule the get trap applies (#304). Beyond `length`/`name`/`prototype` (skipped above),
+			// this covers a module's own `Object.defineProperty(fn, k, { enumerable: false })` and the own
+			// `arguments`/`caller` every sloppy-mode (CommonJS) function carries on Node 22; adopting them
+			// made them enumerable api children that `Object.keys()` and typegen reported.
+			if (typeof this.____slothletInternal.impl === "function" && !descriptor.enumerable) {
+				continue;
+			}
 			const value = this.____slothletInternal.impl[key];
 			// A value that IS the impl itself (circular reference) never appears in module exports; this guard is unreachable.
 			/* v8 ignore start */
diff --git a/tests/vitests/suites/handlers/unified-wrapper-function-own-keys.test.vitest.mjs b/tests/vitests/suites/handlers/unified-wrapper-function-own-keys.test.vitest.mjs
new file mode 100644
index 000000000..caf091c5b
--- /dev/null
+++ b/tests/vitests/suites/handlers/unified-wrapper-function-own-keys.test.vitest.mjs
@@ -0,0 +1,91 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/handlers/unified-wrapper-function-own-keys.test.vitest.mjs
+ *	@Date: 2026-09-28 10:39:19 -07:00 (1790617159)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 11:39:06 -07:00 (1790620746)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Regression: eager adoption turned a function leaf's NON-enumerable own properties into
+ * enumerable api children. Adoption iterated `Reflect.ownKeys(impl)` and skipped only `length`, `name`
+ * and `prototype`, so any other non-enumerable own property became a child endpoint that
+ * `Object.keys()` reports. On Node 22 every sloppy-mode function (all CommonJS) carries own,
+ * non-enumerable `arguments` and `caller` properties, so a `module.exports = function` leaf surfaced
+ * `Object.keys(api.tools.count)` → `["arguments", "caller"]` in eager mode (Node 24+ no longer has
+ * them, which hid it locally; typegen then emitted them as `unknown` members on CI's Node 22 job).
+ *
+ * The rule matches the get trap's (#304): only a function's own ENUMERABLE properties are children.
+ *
+ * @module tests/vitests/suites/handlers/unified-wrapper-function-own-keys
+ */
+
+import { describe, it, expect, afterEach } from "vitest";
+import { mkdir, writeFile, rm } from "node:fs/promises";
+import { join } from "node:path";
+import slothlet from "@cldmv/slothlet";
+import { makeTestTmpDir } from "../../setup/test-fixtures-tmp.mjs";
+
+/**
+ * Write the fixture tree: a function leaf with a non-enumerable and an enumerable own property, and a
+ * sloppy-mode CommonJS function leaf.
+ * @returns {Promise<string>} The api base directory.
+ */
+async function writeFixture() {
+	const root = await makeTestTmpDir("fn-own-keys");
+	const tools = join(root, "api", "tools");
+	await mkdir(tools, { recursive: true });
+	await writeFile(
+		join(tools, "tag.mjs"),
+		[
+			"export function tag(value) { return `#${value}`; }",
+			'Object.defineProperty(tag, "hidden", { value: "internal", enumerable: false, writable: false, configurable: true });',
+			'tag.visible = "public";',
+			""
+		].join("\n"),
+		"utf8"
+	);
+	await writeFile(join(tools, "count.cjs"), "module.exports = function count(s) { return s.length; };\n", "utf8");
+	return join(root, "api");
+}
+
+describe.each([{ mode: "eager" }, { mode: "lazy" }])("function leaf own keys ($mode)", ({ mode }) => {
+	let api;
+	let base;
+
+	afterEach(async () => {
+		if (api?.shutdown) await api.shutdown().catch(() => {});
+		api = null;
+		if (base) await rm(join(base, ".."), { recursive: true, force: true });
+		base = null;
+	});
+
+	it("does not adopt a function's non-enumerable own property as an api child", async () => {
+		base = await writeFixture();
+		api = await slothlet({ base, mode, silent: true });
+		expect(await api.tools.tag("x")).toBe("#x");
+		expect(Object.keys(api.tools.tag)).not.toContain("hidden");
+		// Still readable, exactly as on the function itself.
+		expect(api.tools.tag.hidden).toBe("internal");
+	});
+
+	it("still adopts a function's enumerable own property", async () => {
+		base = await writeFixture();
+		api = await slothlet({ base, mode, silent: true });
+		expect(await api.tools.tag("x")).toBe("#x");
+		expect(Object.keys(api.tools.tag)).toContain("visible");
+		expect(api.tools.tag.visible).toBe("public");
+	});
+
+	it("gives a sloppy-mode CommonJS function leaf no extra keys", async () => {
+		base = await writeFixture();
+		api = await slothlet({ base, mode, silent: true });
+		expect(await api.tools.count("abc")).toBe(3);
+		expect(Object.keys(api.tools.count)).toEqual([]);
+	});
+});
diff --git a/types/src/lib/handlers/unified-wrapper.d.mts.map b/types/src/lib/handlers/unified-wrapper.d.mts.map
index b608810a1..f90d04420 100644
--- a/types/src/lib/handlers/unified-wrapper.d.mts.map
+++ b/types/src/lib/handlers/unified-wrapper.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"unified-wrapper.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/unified-wrapper.mjs"],"names":[],"mappings":"AA0xBA;;;;;;;;;;;;;;;;;;GAkBG;AACH,4CAhBW,MAAM,GAAC,MAAM,GACX,OAAO,CAkBnB;AAi0ID;;;;;;;;;;;GAWG;AACH,sCAPW,OAAO,GACL,cAAc,GAAC,IAAI,CAkB/B;AA13ID;;;;;;;;GAQG;AACH,iCAHU,GAAG,CAAC,MAAM,CAAC,CAG2F;;;;;AAuEhH;;;;;;;;;;GAUG;AACH;IAuUC;;;;;;;;;;;;;;;;OAgBG;IACH,0BAsCC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,gCAiEC;IAzbD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,sBApCW,MAAM,mKAEd;QAAwB,IAAI,EAApB,MAAM;QACU,OAAO,EAAvB,MAAM;QACyB,WAAW;QACvB,eAAe;QAChB,UAAU;QACV,mBAAmB;QACpB,QAAQ;QACD,UAAU;QAGjB,QAAQ;QACR,YAAY;QACE,cAAc;QAI3B,eAAe;KAMzC,EA+NF;IAzQD;;;;;;;;;;;OAWG;IACH,4BAFa,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAC,SAAS,CAKzC;IA4PD;;;;;;;;;;OAUG;IACH,uEAHa,GAAC,CA+Bb;IAED;;;;OAIG;IACH,qBAHa,WAAS,MAAM,GAAC,IAAI,CAKhC;IAiJD;;;;;;;;;;;OAWG;IACH,sBA0CC;IAED;;;;;;;;;;;;OAYG;IACH,mBAkDC;IAED;;;;;;;;;OASG;IACH,qBAsDC;IAED;;;;OAIG;IACH,uBA4GC;IAED;;;;;;;;;OASG;IACH,qBAEC;IAED;;;;;;;;;OASG;IACH,sBAiBC;IAED;;;;;;;;;;OAUG;IACH,6BA4gBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BA8PC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BA43BC;IAED;;;;;;OAMG;IACH,uCAswDC;;CACD;8BAtkK6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"unified-wrapper.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/unified-wrapper.mjs"],"names":[],"mappings":"AA0xBA;;;;;;;;;;;;;;;;;;GAkBG;AACH,4CAhBW,MAAM,GAAC,MAAM,GACX,OAAO,CAkBnB;AA02ID;;;;;;;;;;;GAWG;AACH,sCAPW,OAAO,GACL,cAAc,GAAC,IAAI,CAkB/B;AAn6ID;;;;;;;;GAQG;AACH,iCAHU,GAAG,CAAC,MAAM,CAAC,CAG2F;;;;;AAuEhH;;;;;;;;;;GAUG;AACH;IAuUC;;;;;;;;;;;;;;;;OAgBG;IACH,0BAsCC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,gCAiEC;IAzbD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,sBApCW,MAAM,mKAEd;QAAwB,IAAI,EAApB,MAAM;QACU,OAAO,EAAvB,MAAM;QACyB,WAAW;QACvB,eAAe;QAChB,UAAU;QACV,mBAAmB;QACpB,QAAQ;QACD,UAAU;QAGjB,QAAQ;QACR,YAAY;QACE,cAAc;QAI3B,eAAe;KAMzC,EA+NF;IAzQD;;;;;;;;;;;OAWG;IACH,4BAFa,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAC,SAAS,CAKzC;IA4PD;;;;;;;;;;OAUG;IACH,uEAHa,GAAC,CA+Bb;IAED;;;;OAIG;IACH,qBAHa,WAAS,MAAM,GAAC,IAAI,CAKhC;IAiJD;;;;;;;;;;;OAWG;IACH,sBA0CC;IAED;;;;;;;;;;;;OAYG;IACH,mBAkDC;IAED;;;;;;;;;OASG;IACH,qBAsDC;IAED;;;;OAIG;IACH,uBA4GC;IAED;;;;;;;;;OASG;IACH,qBAEC;IAED;;;;;;;;;OASG;IACH,sBAiBC;IAED;;;;;;;;;;OAUG;IACH,6BAohBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BA8PC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BA43BC;IAED;;;;;;OAMG;IACH,uCAuyDC;;CACD;8BA/mK6B,2BAA2B"}
\ No newline at end of file

From d2ac48c27ab6689e6b6b8ec8af86ddcb6a2d7c8b Mon Sep 17 00:00:00 2001
From: "cldmv-bot[bot]" <230771808+cldmv-bot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 19:27:03 +0000
Subject: [PATCH 14/49] chore: bump version to 3.22.0

---
 package-lock.json | 4 ++--
 package.json      | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index b9d6961ba..e1dc8d79a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "@cldmv/slothlet",
-	"version": "3.21.1",
+	"version": "3.22.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@cldmv/slothlet",
-			"version": "3.21.1",
+			"version": "3.22.0",
 			"license": "Apache-2.0",
 			"bin": {
 				"slothlet": "bin/slothlet.mjs"
diff --git a/package.json b/package.json
index 446c8b530..688ca6631 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@cldmv/slothlet",
-	"version": "3.21.1",
+	"version": "3.22.0",
 	"moduleVersions": {
 		"lazy": "3.0.0",
 		"eager": "3.0.0",

From aba22f8995f58954f9ba2db37c78d3ecd427a0db Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Mon, 28 Sep 2026 13:54:22 -0700
Subject: [PATCH 15/49] =?UTF-8?q?feat(permissions):=20add=20global.checkCa?=
 =?UTF-8?q?ll=20=E2=80=94=20call-gate=20query=20with=20args,=20principals,?=
 =?UTF-8?q?=20and=20audit?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A trusted boundary layer (slothlet-vine) that forwards a remote module's
call has to answer, on the serving side, the question the call gate would
answer for a live call: "may caller X call target Y with these args".
`global.checkAccess` cannot: it is a silent query that forwards null call
metadata (so an args-based condition never sees the resource named in the
call), never resolves a stale `requires` principal, emits no audit event,
and treats a caller with no source file as the host.

`api.slothlet.permissions.global.checkCall(callerPath, targetPath, args)`
is the call-side twin of `event.resolveLevel`:

- Forwards `callMeta = { args, target }` to function conditions — the
  exact shape `enforcePermission` builds — and evaluates against the
  ambient `context.run()` context, like checkAccess/resolveLevel.
- Mirrors the promoted call gate for principals (#459): scans for stale
  `requires` principals, resolves them, then enforces with principal
  grace. Only that path returns a Promise; the fast path is synchronous.
- The supplied caller is a module without a source file: the self-call
  bypass never applies, and a module-private (`_`-prefixed) target is
  denied outright rather than judged by `permissions.private.host`. This
  is expressed explicitly — a new `moduleCaller` enforcement option
  threaded to #resolveAccess's private-name branch — instead of faking a
  file path. checkAccess's behaviour (null callMeta, host semantics for a
  null caller file) is unchanged.
- Emits the audit lifecycle events the real gate emits, with an extra
  `via: "checkCall"` payload field (spread onto the decision record, so
  a cached record is never mutated) so a probing peer is visible and
  distinguishable from a real call.
- Answers `true` when enforcement is disabled, like checkAccess.
- Validates inputs like the neighbouring APIs: INVALID_ARGUMENT for a
  non-string/empty caller or target and for a non-array `args`;
  `undefined`/`null` args mean `[]`. No new i18n codes were needed.

Host-only gating: resolveLevel is kept off modules by the built-in
`slothlet.event.**` deny, whereas `global.checkAccess` is merely gatable
(no built-in deny — a module reaches it under an allow default, as the
existing gating suite and the `gatedInternalRoute` fixture rely on).
Those differ, and the stricter one is right for checkCall: a module that
could ask on another identity's behalf would learn that identity's rule
outcomes, and the audit trail would misattribute the probe. So checkCall
gets a built-in `{ caller: "**", target:
"slothlet.permissions.global.checkCall", effect: "deny" }`, on the exact
target so an instance rule on that same target (equal specificity, higher
layer) is how the host grants it to a trusted boundary module. checkAccess
keeps its current reachability — tightening it is out of scope here.

Tests cover, across the eager/lazy × async/live × hooks matrix: parity
with checkAccess for unconditional rules, args- and target-based
conditions (and that checkAccess still passes null), ambient context,
the stale-principal Promise path vs the fresh sync path, private-target
denial under both host policies, no self-call bypass, audit payloads
under default and verbose audit, disabled enforcement, host-only refusal
plus the exact-target grant, and input validation; plus a direct
PermissionManager describe for the `moduleCaller` / `via` options and
the cache-record immutability. `types/` and `docs/generated/` are left
for the release build, which is where this repo regenerates them.

Fixes #508
---
 .../callers/check-call-caller.mjs             |  48 ++
 docs/EVENTS.md                                |   2 +-
 docs/PERMISSIONS-CONDITIONS.md                |   3 +-
 docs/PERMISSIONS.md                           |  45 +-
 src/lib/builders/api_builder.mjs              |  37 ++
 src/lib/handlers/permission-manager.mjs       | 127 ++++-
 ...missions-global-check-call.test.vitest.mjs | 442 ++++++++++++++++++
 7 files changed, 687 insertions(+), 17 deletions(-)
 create mode 100644 api_tests/api_test_permissions/callers/check-call-caller.mjs
 create mode 100644 tests/vitests/suites/permissions/permissions-global-check-call.test.vitest.mjs

diff --git a/api_tests/api_test_permissions/callers/check-call-caller.mjs b/api_tests/api_test_permissions/callers/check-call-caller.mjs
new file mode 100644
index 000000000..1b6734556
--- /dev/null
+++ b/api_tests/api_test_permissions/callers/check-call-caller.mjs
@@ -0,0 +1,48 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_permissions/callers/check-call-caller.mjs
+ *	@Date: 2026-09-28 12:00:00 -07:00 (1790622000)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 12:00:00 -07:00 (1790622000)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+import { self } from "@cldmv/slothlet/runtime";
+
+/**
+ * Attempt the host-only `permissions.global.checkCall` from a MODULE context (#508), so a test can
+ * assert a module caller is REFUSED rather than answered — and, when the host has granted it, that
+ * the answer comes through. Returns the outcome instead of throwing.
+ * @param {string} callerPath - Identity to ask about.
+ * @param {string} targetPath - Target api path.
+ * @param {Array<*>} [args] - Arguments of the call being asked about.
+ * @returns {Promise<{ ok: boolean, allowed?: boolean, code?: string }>} `ok:true` + the decision when
+ *   permitted; otherwise `ok:false` + the error code.
+ */
+export async function attempt(callerPath, targetPath, args) {
+	try {
+		return { ok: true, allowed: await self.slothlet.permissions.global.checkCall(callerPath, targetPath, args) };
+	} catch (error) {
+		return { ok: false, code: error.code || error.name };
+	}
+}
+
+/**
+ * The gatable sibling, for contrast: `global.checkAccess` carries no built-in deny, so under an
+ * allow default a module reaches it. Returns the outcome instead of throwing.
+ * @param {string} callerPath - Identity to ask about.
+ * @param {string} targetPath - Target api path.
+ * @returns {Promise<{ ok: boolean, allowed?: boolean, code?: string }>} `ok:true` + the decision when
+ *   permitted; otherwise `ok:false` + the error code.
+ */
+export async function attemptAccess(callerPath, targetPath) {
+	try {
+		return { ok: true, allowed: await self.slothlet.permissions.global.checkAccess(callerPath, targetPath) };
+	} catch (error) {
+		return { ok: false, code: error.code || error.name };
+	}
+}
diff --git a/docs/EVENTS.md b/docs/EVENTS.md
index 60049fa65..ed1ae7d6a 100644
--- a/docs/EVENTS.md
+++ b/docs/EVENTS.md
@@ -70,7 +70,7 @@ A **host** subscription — one made with no module caller in context (the compo
 
 `resolveLevel(subscriberPath, event)` answers the delivery level a **supplied** subscriber identity would be granted for an event — `deny` / `notify` / `allow` — without registering anything. It is the inverse of `on`: `on` derives the subscriber from the live caller and never trusts a supplied identity, whereas `resolveLevel` is answered _for_ an identity the caller names. Because it lets one caller ask about another identity, it is **host-only** — reachable only from the composing host (or a `run()` / `scope()` descended from it), gated exactly like `rules.*` by the built-in `slothlet.event.**` deny. A `null` `subscriberPath` is a host subscription and always resolves `allow`.
 
-The motivating consumer is a cross-boundary event-forwarding layer such as [`@cldmv/slothlet-vine`](https://github.com/CLDMV/slothlet-vine). Slothlet stays boundary-agnostic; a forwarding layer that carries an instance's events to a subscriber living in _another_ instance must enforce that remote subscriber's level on the **trusted (serving) side**, stripping the domain payload before it crosses to an instance that cannot be trusted to withhold it. `resolveLevel` is how the trusted side resolves that remote subscriber's level; the boundary layer then delivers a trigger-only or trigger-plus-payload frame accordingly, and never re-implements the policy itself.
+The motivating consumer is a cross-boundary event-forwarding layer such as [`@cldmv/slothlet-vine`](https://github.com/CLDMV/slothlet-vine). Slothlet stays boundary-agnostic; a forwarding layer that carries an instance's events to a subscriber living in _another_ instance must enforce that remote subscriber's level on the **trusted (serving) side**, stripping the domain payload before it crosses to an instance that cannot be trusted to withhold it. `resolveLevel` is how the trusted side resolves that remote subscriber's level; the boundary layer then delivers a trigger-only or trigger-plus-payload frame accordingly, and never re-implements the policy itself. Its call-side twin is [`permissions.global.checkCall(caller, target, args)`](PERMISSIONS.md#checkcall-vs-checkaccess), which answers — for a supplied caller identity — whether the call gate would allow a specific call, host-only in the same way.
 
 ```javascript
 // On the serving instance, a forwarding layer resolves a remote subscriber's level, then strips before crossing:
diff --git a/docs/PERMISSIONS-CONDITIONS.md b/docs/PERMISSIONS-CONDITIONS.md
index 3e27e81de..d686076bb 100644
--- a/docs/PERMISSIONS-CONDITIONS.md
+++ b/docs/PERMISSIONS-CONDITIONS.md
@@ -112,7 +112,7 @@ At a **call** or **construct** gate the function condition also receives a secon
 }
 ```
 
-`callMeta` is provided at the **call** gate (`self.x.leaf(...)`), the **construct** gate (`new self.x.Foo(...)`), and when a **captured reference** (`const f = self.x.leaf; f(...)`) is later invoked — all three see the invocation's real arguments. It is **`null`** everywhere else a condition is evaluated: terminal-value **reads**, **hook** gating, **event** delivery, the internal `slothlet.*` control surface, and silent queries (`permissions.global.checkAccess`, `permissions.self.access`, `matchesCondition`). Because `target` is the concrete leaf (never the rule's glob), one `**`-globbed rule can branch on exactly which leaf was called.
+`callMeta` is provided at the **call** gate (`self.x.leaf(...)`), the **construct** gate (`new self.x.Foo(...)`), and when a **captured reference** (`const f = self.x.leaf; f(...)`) is later invoked — all three see the invocation's real arguments. It is **`null`** everywhere else a condition is evaluated: terminal-value **reads**, **hook** gating, **event** delivery, the internal `slothlet.*` control surface, and silent queries (`permissions.global.checkAccess`, `permissions.self.access`, `matchesCondition`). The one query that is _not_ silent is the host-only [`permissions.global.checkCall(caller, target, args)`](./PERMISSIONS.md#checkcall-vs-checkaccess): it is handed the arguments of the call being asked about and forwards `{ args, target }` exactly as the call gate does, so a condition sees the same second argument whether the call is real or queried. Because `target` is the concrete leaf (never the rule's glob), one `**`-globbed rule can branch on exactly which leaf was called.
 
 **Write `callMeta`-reading conditions defensively.** Since `callMeta` can be `null`, guard the access — `(ctx, meta) => meta?.args?.[0] === id` — or scope the rule to a `target` that only ever gates at a call/construct site. A condition that throws (including a `TypeError` from reading `args` on a `null` `callMeta`) is caught and treated as a non-match, never an implicit allow.
 
@@ -177,6 +177,7 @@ An empty array `[]` is rejected at `addRule()` time.
 | Function condition at a call/construct gate              | Receives `(ctx, { args, target })` — the call's arguments and the concrete target path           |
 | Function condition on a captured reference invoked later | Also receives the real `{ args, target }` of that invocation                                     |
 | Function condition off the call/construct path           | Second argument is `null` (reads, hooks, events, control surface, silent queries)                |
+| Function condition queried via `global.checkCall`        | Receives `(ctx, { args, target })` with the supplied `args` — the call-gate query is not silent  |
 | Function condition returns a Promise / thenable          | Non-match; rejection absorbed; `DEBUG_PERMISSION_CONDITION_THENABLE` emitted                     |
 | Rule declares `requires`                                 | Second argument carries `principals`; rule does not match unless every principal is current      |
 
diff --git a/docs/PERMISSIONS.md b/docs/PERMISSIONS.md
index af14fd6d4..e91cf2924 100644
--- a/docs/PERMISSIONS.md
+++ b/docs/PERMISSIONS.md
@@ -648,13 +648,44 @@ Scoped to the calling module via its context. A module can always introspect its
 
 ### `global.*` — Gatable Diagnostics
 
-Cross-module inspection. Can be independently denied with a single rule on `slothlet.permissions.global.**`.
+Cross-module inspection. Can be independently denied with a single rule on `slothlet.permissions.global.**`. The one exception is `checkCall`, which is **host-only by default** (see [`checkCall` vs `checkAccess`](#checkcall-vs-checkaccess)).
 
-| Method                               | Description                                                                          |
-| ------------------------------------ | ------------------------------------------------------------------------------------ |
-| `global.checkAccess(caller, target)` | Check if an arbitrary `caller` path is allowed to reach `target`. Returns `boolean`. |
-| `global.rulesForPath(path)`          | List all rules matching a given target path.                                         |
-| `global.rulesByModule(moduleID)`     | List all rules owned by a given module.                                              |
+| Method                                    | Description                                                                                                                                                                                                                                                                                                            |
+| ----------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `global.checkAccess(caller, target)`      | Silent query: check if an arbitrary `caller` path is allowed to reach `target`. Function conditions receive `null` call metadata; nothing is audited. Returns `boolean`.                                                                                                                                               |
+| `global.checkCall(caller, target, args?)` | Call-gate query: would `caller` be allowed to **call** `target` with `args`, judged exactly as the real call gate judges it — audited, `{ args, target }` forwarded to conditions, stale principals resolved. Returns `boolean`, or `Promise<boolean>` only when a principal had to be resolved. Host-only by default. |
+| `global.rulesForPath(path)`               | List all rules matching a given target path.                                                                                                                                                                                                                                                                           |
+| `global.rulesByModule(moduleID)`          | List all rules owned by a given module.                                                                                                                                                                                                                                                                                |
+
+#### `checkCall` vs `checkAccess`
+
+`checkAccess` is a **silent** query: it resolves the rule set for a caller→target pair and nothing else — no arguments, no audit trail, and a null caller identity is treated as the host. That is the right tool for diagnostics, but it cannot answer the question a trusted boundary layer (such as [`@cldmv/slothlet-vine`](https://github.com/CLDMV/slothlet-vine)) has to answer on the serving side before it forwards a remote module's call: _would the call gate let this caller make this exact call?_ `checkCall` is that question — the call-side twin of [`event.resolveLevel`](EVENTS.md#resolving-a-level-without-subscribing), which answers the same "for a supplied identity" question on the event side.
+
+```javascript
+// Host (serving) side: a remote peer identified as "client.app" wants to call project.files.list("p7").
+const ok = await api.slothlet.permissions.global.checkCall("client.app", "project.files.list", ["p7"]);
+if (!ok) throw new Error("refused");
+```
+
+What it does differently, point by point:
+
+- **Call metadata.** Function conditions receive `callMeta = { args, target }` — the same shape the real call gate builds — so a rule that authorizes on the resource named in the call (`(ctx, { args }) => args[0] === ctx.projectId`) answers correctly. `args` defaults to `[]` when omitted; `checkAccess` forwards `null` (see [Second argument: call metadata](PERMISSIONS-CONDITIONS.md#second-argument-call-metadata-callmeta)).
+- **Ambient context.** Conditions are evaluated against the current `context.run()` context, as `checkAccess` and `resolveLevel` are.
+- **Principals.** A `requires` rule whose principal is stale for the current identity is resolved first and the decision re-evaluated, exactly as a promoted call is (see [Principals](#principals)). That is the **only** case in which `checkCall` returns a `Promise<boolean>`; when every required principal is current — or no rule requires one — it answers synchronously. Always `await` it if the rule set may carry `requires` rules.
+- **The caller is a module without a source file.** The [self-call bypass](#evaluation-order) never applies, and a [module-private](#module-private-exports) (`_`-prefixed) target is **denied** outright — it is not judged by the `permissions.private.host` policy, which is what a null caller identity means to `checkAccess`. A supplied identity is a module, never the host.
+- **Audited.** The decision emits the same lifecycle events a real call would — `permission:denied` always, `permission:allowed` / `permission:default` under `audit: "verbose"` — with `via: "checkCall"` in the payload, so a probing peer is visible in the audit trail and distinguishable from a real call. `checkAccess` emits nothing.
+- **Disabled enforcement** answers `true`, like `checkAccess`.
+- **Host-only.** A built-in rule denies modules the query, exactly as `event.resolveLevel` is kept off modules by the `slothlet.event.**` deny — a module that could ask on another identity's behalf would learn that identity's rule outcomes, and the audit trail would misattribute the probe. Since the built-in targets the exact path, an instance rule on the same exact target outranks it (equal specificity, higher layer), which is how the host grants it to a trusted boundary module:
+
+```javascript
+// Built-in rule registered for every instance:
+{ caller: "**", target: "slothlet.permissions.global.checkCall", effect: "deny" }
+
+// Host grant for a trusted boundary module:
+{ caller: "vine.**", target: "slothlet.permissions.global.checkCall", effect: "allow" }
+```
+
+`checkCall` throws `INVALID_ARGUMENT` for a non-string or empty `caller` / `target`, or an `args` that is neither an array nor `null`/`undefined`.
 
 ### `control.*` — Global Toggles (Deny-by-Default)
 
@@ -719,6 +750,8 @@ The `PermissionManager` emits lifecycle events for enforcement decisions:
 | `permission:allowed`     | `{ caller, target, rule, conditionMatched, timestamp }` | A call was explicitly allowed by a rule | `audit: "verbose"` only |
 | `permission:default`     | `{ caller, target, policy, timestamp }`                 | No rule matched; default policy applied | `audit: "verbose"` only |
 
+A decision reached through [`global.checkCall`](#checkcall-vs-checkaccess) emits the same events with an extra `via: "checkCall"` field in the payload, so an audit consumer can tell a query from the gate of a real call.
+
 The `conditionMatched` field in `permission:allowed` and `permission:denied` payloads is `true` when the winning rule had a `condition` field, `false` otherwise.
 
 Subscribe via the lifecycle system:
diff --git a/src/lib/builders/api_builder.mjs b/src/lib/builders/api_builder.mjs
index 85ad23832..e5b857ede 100644
--- a/src/lib/builders/api_builder.mjs
+++ b/src/lib/builders/api_builder.mjs
@@ -3101,6 +3101,43 @@ export class ApiBuilder extends ComponentBase {
 						return slothlet.handlers.permissionManager.checkAccess(caller, target, null, null, runtimeContext);
 					},
 
+					/**
+					 * Would `caller` be allowed to CALL `target` with `args`? The call-gate twin of
+					 * `event.resolveLevel` (#508): it evaluates exactly what the real call gate evaluates for a
+					 * supplied caller identity — function conditions receive `{ args, target }`, a stale
+					 * `requires` principal is resolved first (the only case that returns a Promise), the caller
+					 * is treated as a module with no source file (no self-call bypass; a module-private target
+					 * is denied), and audit events emit with `via: "checkCall"`. Conditions are evaluated
+					 * against the ambient `context.run()` context, like `checkAccess`. Answers `true` when
+					 * enforcement is disabled.
+					 *
+					 * Host-only: a built-in rule denies modules `slothlet.permissions.global.checkCall`; the host
+					 * grants it to a trusted boundary layer with an instance rule on that exact target.
+					 *
+					 * @param {string} caller - Caller API path (non-empty).
+					 * @param {string} target - Target API path (non-empty).
+					 * @param {Array<*>} [args=[]] - The arguments of the call being asked about.
+					 * @returns {boolean|Promise<boolean>} True if the call would be allowed; a Promise only when a stale principal had to be resolved.
+					 * @throws {SlothletError} INVALID_ARGUMENT for a non-string / empty `caller` or `target`, or a non-array `args`.
+					 * @public
+					 * @example
+					 * const ok = await api.slothlet.permissions.global.checkCall("client.app", "project.files.list", ["p1"]);
+					 */
+					checkCall: function slothlet_permissions_global_checkCall(caller, target, args) {
+						// Check if permission manager is available
+						const permissionManager = slothlet.handlers?.permissionManager;
+						/* v8 ignore start */
+						if (!permissionManager?.checkCall) {
+							throw new slothlet.SlothletError("PERMISSION_MANAGER_NOT_AVAILABLE", {
+								validationError: true
+							});
+						}
+						/* v8 ignore stop */
+
+						const runtimeContext = slothlet.contextManager?.tryGetContext?.()?.context ?? null;
+						return slothlet.handlers.permissionManager.checkCall(caller, target, args, runtimeContext);
+					},
+
 					/**
 					 * List all rules that match a given target path.
 					 *
diff --git a/src/lib/handlers/permission-manager.mjs b/src/lib/handlers/permission-manager.mjs
index 73a949554..2033d4d55 100644
--- a/src/lib/handlers/permission-manager.mjs
+++ b/src/lib/handlers/permission-manager.mjs
@@ -69,6 +69,15 @@ const HOOK_TARGET_TYPES = new Set(["before", "after", "always", "error", "hook"]
  */
 const RULE_LAYER_RANK = Object.freeze({ builtin: 0, manifest: 1, instance: 2, runtime: 3 });
 
+/**
+ * Enforcement options for the call-gate query {@link PermissionManager#checkCall} (#508): the supplied
+ * caller is a module (never the host), the audit payload names the query as its origin, and — as for a
+ * promoted call whose stale-principal scan has just run — principals count as current under grace.
+ * @type {Readonly<{ moduleCaller: true, via: "checkCall", principalGrace: true }>}
+ * @private
+ */
+const CHECK_CALL_OPTIONS = Object.freeze({ moduleCaller: true, via: "checkCall", principalGrace: true });
+
 /**
  * Resolve a rule's precedence layer from an explicit layer or the owning module id.
  * @param {string|null} layer - Explicit layer ("builtin"|"manifest"|"instance"|"runtime"), or null to derive.
@@ -132,10 +141,11 @@ function runtime_sameModuleDir(callerFilePath, targetFilePath) {
  * authorize on the resource named in the call itself, not just ambient context (#455).
  *
  * Provided only at the call and construct enforcement gates — where the invocation's arguments
- * exist. Read gating, hook gating, event delivery, the internal `slothlet.*` control surface, and
- * silent queries evaluate conditions with `callMeta === null`, so a function condition that reads
- * `callMeta.args` must guard for its absence (or the rule must only match targets that always gate
- * at a call/construct site).
+ * exist — and by the call-gate query {@link PermissionManager#checkCall} (#508), which is handed the
+ * arguments it should evaluate against. Read gating, hook gating, event delivery, the internal
+ * `slothlet.*` control surface, and silent queries evaluate conditions with `callMeta === null`, so a
+ * function condition that reads `callMeta.args` must guard for its absence (or the rule must only
+ * match targets that always gate at a call/construct site).
  *
  * @typedef {object} PermissionCallMeta
  * @property {Array<*>|null} args - Arguments the target leaf was called/constructed with, or null.
@@ -390,6 +400,15 @@ export class PermissionManager extends ComponentBase {
 		// grants it to the modules that should define principals, exactly like any other rule.
 		this.addRule({ caller: "**", target: "slothlet.permissions.principal.**", effect: "deny" }, "__builtin__");
 
+		// Call-gate query (#508): `global.checkCall` answers "may caller X call target Y with these args"
+		// for a SUPPLIED caller identity, exactly like `event.resolveLevel` answers for a supplied
+		// subscriber — so it is host-only by the same mechanism (a built-in deny), not merely gatable like
+		// the rest of `global.*`. A module that could ask on another module's behalf would learn that
+		// module's rule outcomes, and the query's audit trail would attribute the probe to the wrong
+		// identity. The host grants it to a trusted boundary layer with an instance rule of equal
+		// specificity (an exact target, `slothlet.permissions.global.checkCall`), which outranks this one.
+		this.addRule({ caller: "**", target: "slothlet.permissions.global.checkCall", effect: "deny" }, "__builtin__");
+
 		// Built-in hook-management baseline (enforced only when permissions are enabled): modules may
 		// inspect and register hooks (`list`, `on`) but may NOT tamper with other modules' hooks via the
 		// global-effect methods (remove/off/clear, enable/disable, enablePattern/disablePattern/reset).
@@ -1328,9 +1347,14 @@ export class PermissionManager extends ComponentBase {
 	 * @param {PermissionCallMeta|null} [callMeta=null] - Call/construct metadata (#455): `{ args, target }`
 	 *   from the invocation, forwarded to function conditions as their second argument. Null for reads,
 	 *   hooks, the internal control surface, and silent queries.
-	 * @param {{ principalGrace?: boolean }|null} [options=null] - Enforcement options.
+	 * @param {{ principalGrace?: boolean, moduleCaller?: boolean, via?: string }|null} [options=null] - Enforcement options.
 	 * @param {boolean} [options.principalGrace=false] - Accept a principal whose epoch is current even if its
 	 *   `maxAge` has elapsed (#459). Set only by a promoted call re-enforcing right after its resolve.
+	 * @param {boolean} [options.moduleCaller=false] - The caller is a module even though no source file is
+	 *   known for it (#508). A module-private target is then denied outright instead of being judged by
+	 *   the `permissions.private.host` policy, which is what a null `callerFilePath` otherwise means.
+	 * @param {string} [options.via] - Origin marker added to the audit payload (`via: "checkCall"`), so an
+	 *   audit consumer can tell a query from the gate of a real call.
 	 * @returns {boolean} True if access is allowed.
 	 * @example
 	 * if (!pm.enforceAccess("payments.charge", "db.write", "/src/pay.mjs", "/src/db.mjs")) {
@@ -1354,16 +1378,96 @@ export class PermissionManager extends ComponentBase {
 		this.#principalGrace = options?.principalGrace === true;
 		let result;
 		try {
-			result = this.#resolveAccess(callerPath, targetPath, callerFilePath, targetFilePath, runtimeContext, true, callMeta);
+			result = this.#resolveAccess(
+				callerPath,
+				targetPath,
+				callerFilePath,
+				targetFilePath,
+				runtimeContext,
+				true,
+				callMeta,
+				options?.moduleCaller === true
+			);
 		} finally {
 			this.#principalGrace = priorGrace;
 		}
 		if (result.event) {
-			this.#emitAuditEvent(result.event, result.payload);
+			// The decision record may be the cached entry itself — spread rather than mutate it.
+			const via = typeof options?.via === "string" ? options.via : null;
+			this.#emitAuditEvent(result.event, via ? { ...result.payload, via } : result.payload);
 		}
 		return result.allowed;
 	}
 
+	/**
+	 * Call-gate query (#508): would `callerPath` be allowed to CALL `targetPath` with `args`? The
+	 * audited, argument-aware twin of {@link checkAccess} — it evaluates exactly what the real call gate
+	 * evaluates, for a supplied caller identity, without invoking anything.
+	 *
+	 * - Function conditions receive `callMeta = { args, target: targetPath }`, the shape the call gate
+	 *   builds, so a rule that authorizes on the resource named in the call answers correctly.
+	 * - The caller is a MODULE with no source file: the self-call bypass never applies, and a
+	 *   module-private (`_`-prefixed) target is denied outright rather than judged by the
+	 *   `permissions.private.host` policy.
+	 * - A `requires` rule whose principal is stale is resolved first and the decision re-evaluated
+	 *   with principal grace, mirroring a promoted call (#459). Only then is the result a Promise; the
+	 *   fast path (nothing stale) answers synchronously.
+	 * - Audit events emit as for a real call (`permission:denied` always, `allowed`/`default` under
+	 *   `audit: "verbose"`), with `via: "checkCall"` in the payload so a probing peer is visible.
+	 * - Disabled enforcement answers `true`, like {@link checkAccess}.
+	 *
+	 * @param {string} callerPath - The supplied caller's api path (non-empty).
+	 * @param {string} targetPath - The target api path being called (non-empty).
+	 * @param {Array<*>} [args=[]] - The arguments of the call being asked about; omit for an argument-less call.
+	 * @param {object|null} [runtimeContext=null] - Per-request ALS context for condition evaluation.
+	 * @returns {boolean|Promise<boolean>} The gate's decision; a Promise only when a stale principal had to be resolved.
+	 * @throws {SlothletError} INVALID_ARGUMENT when `callerPath` / `targetPath` is not a non-empty string
+	 *   or `args` is neither an array nor null/undefined.
+	 * @example
+	 * const ok = pm.checkCall("client.app", "project.files.list", ["p1"], { user: "u1" });
+	 * if (ok instanceof Promise) await ok;
+	 */
+	checkCall(callerPath, targetPath, args = [], runtimeContext = null) {
+		if (typeof callerPath !== "string" || callerPath.length === 0) {
+			throw new this.SlothletError("INVALID_ARGUMENT", {
+				argument: "callerPath",
+				expected: "a non-empty string",
+				received: typeof callerPath,
+				validationError: true
+			});
+		}
+		if (typeof targetPath !== "string" || targetPath.length === 0) {
+			throw new this.SlothletError("INVALID_ARGUMENT", {
+				argument: "targetPath",
+				expected: "a non-empty string",
+				received: typeof targetPath,
+				validationError: true
+			});
+		}
+		// `null`/`undefined` both mean "no arguments", as on every other optional bag in the api.
+		const callArgs = args == null ? [] : args;
+		if (!Array.isArray(callArgs)) {
+			throw new this.SlothletError("INVALID_ARGUMENT", {
+				argument: "args",
+				expected: "an array",
+				received: typeof callArgs,
+				validationError: true
+			});
+		}
+
+		const callMeta = { args: callArgs, target: targetPath };
+		// Scan-then-enforce, as the promoted call gate does (#459): a stale principal is resolved first,
+		// and the enforcement after the scan runs with principal grace so a `maxAge` expiring between the
+		// two clock reads cannot flip the verdict.
+		const stale = this.stalePrincipals(callerPath, targetPath, null, null, runtimeContext);
+		if (stale.length > 0) {
+			return this.resolvePrincipals(stale).then(() =>
+				this.enforceAccess(callerPath, targetPath, null, null, runtimeContext, callMeta, CHECK_CALL_OPTIONS)
+			);
+		}
+		return this.enforceAccess(callerPath, targetPath, null, null, runtimeContext, callMeta, CHECK_CALL_OPTIONS);
+	}
+
 	/**
 	 * Enforce whether a caller may register or fire a hook of `hookType` on `hookPath`.
 	 *
@@ -1878,10 +1982,13 @@ export class PermissionManager extends ComponentBase {
 	 * @param {PermissionCallMeta|null} callMeta - Call/construct metadata (#455) forwarded to function
 	 *   conditions; `null` off the call/construct path. Never affects caching: a call whose args a
 	 *   condition reads is a condition-bearing rule, which already bypasses the cache.
+	 * @param {boolean} [moduleCaller=false] - The caller is a module with no known source file (#508), so a
+	 *   module-private target is denied instead of judged by the host policy. Decided before the cache,
+	 *   so it never affects caching either.
 	 * @returns {{ allowed: boolean, event: string|null, payload: object|null, hasConditionalRules?: boolean }} Decision record.
 	 * @private
 	 */
-	#resolveAccess(callerPath, targetPath, callerFilePath, targetFilePath, runtimeContext, useCache, callMeta) {
+	#resolveAccess(callerPath, targetPath, callerFilePath, targetFilePath, runtimeContext, useCache, callMeta, moduleCaller = false) {
 		// Global toggle: when disabled, everything is allowed (no event to emit).
 		// Exception: slothlet.permissions.control.** is always subject to rule evaluation
 		// regardless of enabled state, so the built-in deny rule protects the toggle surface.
@@ -1922,7 +2029,9 @@ export class PermissionManager extends ComponentBase {
 			}
 			// No caller identity = the host (module callers always carry a file path at the
 			// enforcement sites). The host obeys the configured policy — secure default deny.
-			if (!callerFilePath && this.#privateHost === "allow") {
+			// A caller declared a module without a file (#508: the call-gate query answers for a
+			// supplied module identity) is never the host, so the host policy does not apply to it.
+			if (!callerFilePath && !moduleCaller && this.#privateHost === "allow") {
 				return {
 					allowed: true,
 					event: "permission:private-host-allow",
diff --git a/tests/vitests/suites/permissions/permissions-global-check-call.test.vitest.mjs b/tests/vitests/suites/permissions/permissions-global-check-call.test.vitest.mjs
new file mode 100644
index 000000000..beeec524a
--- /dev/null
+++ b/tests/vitests/suites/permissions/permissions-global-check-call.test.vitest.mjs
@@ -0,0 +1,442 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/permissions/permissions-global-check-call.test.vitest.mjs
+ *	@Date: 2026-09-28 12:00:00 -07:00 (1790622000)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 12:00:00 -07:00 (1790622000)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview `api.slothlet.permissions.global.checkCall(callerPath, targetPath, args)` (#508) — the
+ * host-only call-gate query, the call-side twin of `event.resolveLevel`: would a SUPPLIED caller
+ * identity be allowed to call a target with these arguments, judged exactly as the real call gate
+ * judges it.
+ *
+ * @description
+ * Exercises: parity with `checkAccess` for unconditional rules; function conditions receiving the
+ * call's `{ args, target }` (which `checkAccess` never forwards); ambient `context.run()` context;
+ * the stale-principal path (a Promise, resolved and re-evaluated with grace) versus the fresh path
+ * (synchronous); a module-private target denied regardless of the host policy; the self-call bypass
+ * never applying to a file-less caller; audit events emitted with `via: "checkCall"`; disabled
+ * enforcement answering `true`; host-only gating (a module caller is refused, an exact instance
+ * grant opens it); and argument validation — across the eager/lazy × async/live matrix. A second
+ * describe drives the PermissionManager directly for the `moduleCaller` / `via` enforcement options.
+ *
+ * @module tests/vitests/suites/permissions/permissions-global-check-call.test.vitest
+ */
+
+import { describe, it, expect, afterEach, vi } from "vitest";
+import slothlet from "@cldmv/slothlet";
+import { PermissionManager } from "#handlers/permission-manager";
+import { SlothletError } from "@cldmv/slothlet/errors";
+import { getMatrixConfigs, TEST_DIRS } from "../../setup/vitest-helper.mjs";
+
+const BASE = TEST_DIRS.API_TEST_PERMISSIONS;
+const PRIVATE = new URL("../../../../api_tests/api_test_private", import.meta.url).pathname;
+
+/**
+ * Let a lifecycle emit's listener notification settle before asserting on what it collected.
+ * @returns {Promise<void>}
+ */
+const settle = () => new Promise((resolve) => setTimeout(resolve, 0));
+
+describe.each(getMatrixConfigs())("Permissions > global.checkCall (#508) > $name", ({ config }) => {
+	let api;
+
+	afterEach(async () => {
+		if (api) await api.shutdown();
+		api = null;
+	});
+
+	/**
+	 * Compose the permissions fixture with the given permission config.
+	 * @param {object} permissions - `config.permissions`.
+	 * @param {string} [base=BASE] - Fixture directory.
+	 * @returns {Promise<object>} Bound api.
+	 */
+	const build = async (permissions, base = BASE) => slothlet({ ...config, base, permissions });
+
+	/**
+	 * Collect the permission audit events an instance emits.
+	 * @param {object} instance - Bound api.
+	 * @returns {Array<{ event: string, payload: object }>} Live list of `{ event, payload }` records.
+	 */
+	const collectAudit = (instance) => {
+		const seen = [];
+		for (const event of ["permission:denied", "permission:allowed", "permission:default"]) {
+			instance.slothlet.lifecycle.on(event, (payload) => seen.push({ event, payload }));
+		}
+		return seen;
+	};
+
+	// ── Parity with checkAccess ──────────────────────────────────────────────────
+
+	it("agrees with checkAccess for rules without conditions, synchronously", async () => {
+		api = await build({
+			defaultPolicy: "allow",
+			rules: [{ caller: "untrusted.**", target: "admin.**", effect: "deny" }]
+		});
+		const { checkCall, checkAccess } = api.slothlet.permissions.global;
+
+		for (const [caller, target] of [
+			["payments.charge", "db.read"],
+			["untrusted.plugin", "admin.manage"],
+			["untrusted.plugin", "db.read"]
+		]) {
+			const viaCall = checkCall(caller, target, []);
+			expect(viaCall, `${caller} → ${target} answers synchronously`).toBeTypeOf("boolean");
+			expect(viaCall, `${caller} → ${target} agrees with checkAccess`).toBe(checkAccess(caller, target));
+		}
+	});
+
+	// ── callMeta: args + concrete target ─────────────────────────────────────────
+
+	it("forwards { args, target } to function conditions — which checkAccess never sees", async () => {
+		const seen = [];
+		api = await build({
+			defaultPolicy: "deny",
+			rules: [
+				{
+					caller: "callers.**",
+					target: "payments.charge.process",
+					effect: "allow",
+					condition: (ctx, meta) => {
+						seen.push(meta);
+						return meta?.args?.[0] >= 100;
+					}
+				}
+			]
+		});
+		const { checkCall, checkAccess } = api.slothlet.permissions.global;
+
+		expect(checkCall("callers.paymentsCaller", "payments.charge.process", [100])).toBe(true);
+		expect(seen.at(-1)).toEqual({ args: [100], target: "payments.charge.process" });
+
+		// Denied purely because the condition read the supplied args.
+		expect(checkCall("callers.paymentsCaller", "payments.charge.process", [50])).toBe(false);
+		expect(seen.at(-1)).toEqual({ args: [50], target: "payments.charge.process" });
+
+		// Omitted args are an empty argument list, still a real callMeta.
+		expect(checkCall("callers.paymentsCaller", "payments.charge.process")).toBe(false);
+		expect(seen.at(-1)).toEqual({ args: [], target: "payments.charge.process" });
+
+		// checkAccess is the silent query: its function conditions receive null callMeta (unchanged).
+		expect(checkAccess("callers.paymentsCaller", "payments.charge.process")).toBe(false);
+		expect(seen.at(-1)).toBeNull();
+	});
+
+	it("callMeta.target is the concrete target so one globbed rule can branch per target", async () => {
+		api = await build({
+			defaultPolicy: "deny",
+			rules: [
+				{
+					caller: "callers.**",
+					target: "payments.**",
+					effect: "allow",
+					condition: (ctx, meta) => meta?.target === "payments.charge.process"
+				}
+			]
+		});
+		const { checkCall } = api.slothlet.permissions.global;
+
+		expect(checkCall("callers.paymentsCaller", "payments.charge.process", [1])).toBe(true);
+		expect(checkCall("callers.paymentsCaller", "payments.webhook.handleWebhook", [{ type: "ping" }])).toBe(false);
+	});
+
+	// ── Ambient context ──────────────────────────────────────────────────────────
+
+	it("evaluates conditions against the ambient context.run() context, combined with the args", async () => {
+		api = await build({
+			defaultPolicy: "deny",
+			rules: [
+				{
+					caller: "callers.**",
+					target: "payments.charge.process",
+					effect: "allow",
+					condition: (ctx, meta) => ctx.role === "admin" && meta?.args?.[0] === 100
+				}
+			]
+		});
+		const { checkCall } = api.slothlet.permissions.global;
+		const ask = (amount) => checkCall("callers.paymentsCaller", "payments.charge.process", [amount]);
+
+		expect(await api.slothlet.context.run({ role: "admin" }, () => ask(100)), "right role, right args").toBe(true);
+		expect(await api.slothlet.context.run({ role: "admin" }, () => ask(999)), "right role, wrong args").toBe(false);
+		expect(await api.slothlet.context.run({ role: "guest" }, () => ask(100)), "wrong role").toBe(false);
+		expect(ask(100), "no ambient context").toBe(false);
+	});
+
+	// ── Principals: stale → Promise, fresh → sync ────────────────────────────────
+
+	it("resolves a stale required principal first (a Promise) and answers synchronously once it is current", async () => {
+		api = await build({
+			defaultPolicy: "deny",
+			rules: [
+				{
+					caller: "client.**",
+					target: "project.files.list",
+					effect: "allow",
+					requires: ["roles"],
+					condition: (ctx, { args, principals }) => principals.roles.projects[args[0]]?.includes("read") === true
+				}
+			]
+		});
+		const resolve = vi.fn(async (user) => ({ projects: user === "u1" ? { p1: ["read"] } : {} }));
+		api.slothlet.permissions.principal.register("roles", { key: (ctx) => ctx.user, resolve });
+		const { checkCall } = api.slothlet.permissions.global;
+		const ask = (project) => checkCall("client.app", "project.files.list", [project]);
+
+		// First query for this identity: the principal is stale, so the answer is deferred behind its resolve.
+		let first;
+		let second;
+		let third;
+		await api.slothlet.context.run({ user: "u1" }, async () => {
+			first = ask("p1");
+			expect(first).toBeInstanceOf(Promise);
+			expect(await first).toBe(true);
+			// Now current: the fast path answers synchronously, for both verdicts.
+			second = ask("p1");
+			third = ask("p2");
+		});
+		expect(second).toBe(true);
+		expect(third).toBe(false);
+		expect(resolve).toHaveBeenCalledTimes(1);
+
+		// Another identity with no grant: still a Promise (its facts are stale), resolving — not rejecting — to false.
+		let other;
+		await api.slothlet.context.run({ user: "u2" }, async () => {
+			other = ask("p1");
+			expect(other).toBeInstanceOf(Promise);
+			await expect(other).resolves.toBe(false);
+		});
+		expect(resolve).toHaveBeenCalledTimes(2);
+	});
+
+	// ── Module-private targets + no self-call bypass ─────────────────────────────
+
+	it("denies a module-private target outright — even under private.host allow, where checkAccess judges as the host", async () => {
+		api = await build({ defaultPolicy: "allow", rules: [], private: { host: "allow" } }, PRIVATE);
+		const audit = collectAudit(api);
+		const { checkCall, checkAccess } = api.slothlet.permissions.global;
+
+		expect(checkCall("reporting.peek", "billing.internals._scale", [100])).toBe(false);
+		expect(checkCall("reporting.peek", "billing.internals.__rate")).toBe(false);
+		// The supplied caller is a module without a file: the host policy does not apply to it. The
+		// silent query has no caller identity at all and IS judged as the host (existing behaviour).
+		expect(checkAccess("reporting.peek", "billing.internals._scale")).toBe(true);
+
+		await settle();
+		expect(audit).toContainEqual({
+			event: "permission:denied",
+			payload: expect.objectContaining({ caller: "reporting.peek", target: "billing.internals._scale", via: "checkCall" })
+		});
+	});
+
+	it("denies a module-private target under the default host policy too", async () => {
+		api = await build({ defaultPolicy: "allow", rules: [] }, PRIVATE);
+		expect(api.slothlet.permissions.global.checkCall("reporting.peek", "billing.internals._scale", [100])).toBe(false);
+	});
+
+	it("never applies the self-call bypass: the supplied caller has no source file", async () => {
+		api = await build({ defaultPolicy: "deny", rules: [] });
+		const { checkCall } = api.slothlet.permissions.global;
+
+		// The real gate lets a same-file call through (callSelf → identity live in self-caller.mjs)...
+		expect((await api.callers.selfCaller.callSelf()).ok).toBe(true);
+		// ...but the query cannot know the caller's file, so under a deny default the answer is no.
+		expect(checkCall("callers.selfCaller.callSelf", "callers.selfCaller.identity", [])).toBe(false);
+		expect(checkCall("payments.charge.process", "payments.charge.process", [])).toBe(false);
+	});
+
+	// ── Audit ────────────────────────────────────────────────────────────────────
+
+	it("emits the audit lifecycle events as a real call would, tagged via: 'checkCall'", async () => {
+		api = await build({
+			defaultPolicy: "allow",
+			audit: "verbose",
+			rules: [
+				{ caller: "untrusted.**", target: "admin.**", effect: "deny" },
+				{ caller: "payments.**", target: "db.**", effect: "allow" }
+			]
+		});
+		const audit = collectAudit(api);
+		const { checkCall, checkAccess } = api.slothlet.permissions.global;
+
+		expect(checkCall("untrusted.plugin", "admin.manage", ["x"])).toBe(false);
+		expect(checkCall("payments.charge", "db.read", [])).toBe(true);
+		expect(checkCall("cache.store", "widgets.render")).toBe(true);
+		await settle();
+
+		expect(audit.map((entry) => entry.event)).toEqual(["permission:denied", "permission:allowed", "permission:default"]);
+		expect(audit[0].payload).toMatchObject({
+			caller: "untrusted.plugin",
+			target: "admin.manage",
+			via: "checkCall",
+			rule: expect.objectContaining({ caller: "untrusted.**", target: "admin.**", effect: "deny" }),
+			conditionMatched: false
+		});
+		expect(audit[1].payload).toMatchObject({ caller: "payments.charge", target: "db.read", via: "checkCall" });
+		expect(audit[2].payload).toMatchObject({ caller: "cache.store", target: "widgets.render", via: "checkCall", policy: "allow" });
+		for (const { payload } of audit) expect(payload.timestamp).toBeTypeOf("number");
+
+		// The silent query stays silent.
+		checkAccess("untrusted.plugin", "admin.manage");
+		checkAccess("payments.charge", "db.read");
+		await settle();
+		expect(audit).toHaveLength(3);
+	});
+
+	it("emits permission:denied under the default audit level and nothing for an allow", async () => {
+		api = await build({
+			defaultPolicy: "allow",
+			rules: [{ caller: "untrusted.**", target: "admin.**", effect: "deny" }]
+		});
+		const audit = collectAudit(api);
+		const { checkCall } = api.slothlet.permissions.global;
+
+		expect(checkCall("payments.charge", "db.read")).toBe(true);
+		expect(checkCall("untrusted.plugin", "admin.manage")).toBe(false);
+		await settle();
+
+		expect(audit).toHaveLength(1);
+		expect(audit[0]).toMatchObject({ event: "permission:denied", payload: { via: "checkCall" } });
+	});
+
+	// ── Disabled enforcement ─────────────────────────────────────────────────────
+
+	it("answers true, silently, when the permission system is disabled", async () => {
+		// No permissions config → the manager is constructed but not enabled (as for checkAccess).
+		api = await slothlet({ ...config, base: BASE });
+		const audit = collectAudit(api);
+		expect(api.slothlet.permissions.global.checkCall("untrusted.plugin", "admin.manage", ["x"])).toBe(true);
+		await settle();
+		expect(audit).toHaveLength(0);
+		await api.shutdown();
+
+		// Explicitly disabled with a deny default and a deny rule: still true.
+		api = await build({
+			enabled: false,
+			defaultPolicy: "deny",
+			rules: [{ caller: "untrusted.**", target: "admin.**", effect: "deny" }]
+		});
+		expect(api.slothlet.permissions.global.checkCall("untrusted.plugin", "admin.manage")).toBe(true);
+	});
+
+	// ── Host-only ────────────────────────────────────────────────────────────────
+
+	it("is host-only: a module caller is refused (PERMISSION_DENIED) by a built-in rule, unlike the gatable checkAccess", async () => {
+		api = await build({ defaultPolicy: "allow", rules: [] });
+
+		const call = await api.callers.checkCallCaller.attempt("payments.charge", "db.read", []);
+		expect(call).toEqual({ ok: false, code: "PERMISSION_DENIED" });
+
+		// checkAccess carries no built-in deny — under an allow default a module reaches it (unchanged).
+		const access = await api.callers.checkCallCaller.attemptAccess("payments.charge", "db.read");
+		expect(access).toEqual({ ok: true, allowed: true });
+
+		// The built-in rule is visible through the diagnostics surface, like the control.** deny.
+		const rules = api.slothlet.permissions.global.rulesForPath("slothlet.permissions.global.checkCall");
+		expect(
+			rules.find((r) => r.caller === "**" && r.effect === "deny" && r.target === "slothlet.permissions.global.checkCall")
+		).toBeDefined();
+	});
+
+	it("the host can grant checkCall to a trusted module with an instance rule on the exact target", async () => {
+		api = await build({
+			defaultPolicy: "allow",
+			rules: [
+				{ caller: "callers.checkCallCaller.**", target: "slothlet.permissions.global.checkCall", effect: "allow" },
+				{ caller: "untrusted.**", target: "admin.**", effect: "deny" }
+			]
+		});
+
+		expect(await api.callers.checkCallCaller.attempt("payments.charge", "db.read", [])).toEqual({ ok: true, allowed: true });
+		expect(await api.callers.checkCallCaller.attempt("untrusted.plugin", "admin.manage", [])).toEqual({ ok: true, allowed: false });
+	});
+
+	// ── Validation ───────────────────────────────────────────────────────────────
+
+	it("throws INVALID_ARGUMENT for a non-string or empty caller/target and a non-array args", async () => {
+		api = await build({ defaultPolicy: "allow", rules: [] });
+		const { checkCall } = api.slothlet.permissions.global;
+
+		expect(() => checkCall(7, "db.read", [])).toThrow(/INVALID_ARGUMENT/);
+		expect(() => checkCall("", "db.read", [])).toThrow(/INVALID_ARGUMENT/);
+		expect(() => checkCall("payments.charge", null, [])).toThrow(/INVALID_ARGUMENT/);
+		expect(() => checkCall("payments.charge", "", [])).toThrow(/INVALID_ARGUMENT/);
+		expect(() => checkCall("payments.charge", "db.read", "x")).toThrow(/INVALID_ARGUMENT/);
+		expect(() => checkCall("payments.charge", "db.read", { 0: "x" })).toThrow(/INVALID_ARGUMENT/);
+
+		// Omitted, undefined, and null args all mean "no arguments".
+		expect(checkCall("payments.charge", "db.read")).toBe(true);
+		expect(checkCall("payments.charge", "db.read", undefined)).toBe(true);
+		expect(checkCall("payments.charge", "db.read", null)).toBe(true);
+	});
+});
+
+describe("PermissionManager > checkCall enforcement options (#508)", () => {
+	let manager = null;
+
+	afterEach(async () => {
+		if (manager) await manager.shutdown();
+		manager = null;
+	});
+
+	/**
+	 * Build a standalone manager.
+	 * @param {object[]} rules - Config rules.
+	 * @param {object} [extra] - Extra permission config.
+	 * @returns {{ manager: PermissionManager, lifecycle: { emit: import("vitest").Mock } }} The manager and its lifecycle spy.
+	 */
+	const makeManager = (rules = [], extra = {}) => {
+		const lifecycle = { emit: vi.fn() };
+		const instance = new PermissionManager({
+			config: { permissions: { enabled: true, defaultPolicy: "deny", rules, ...extra } },
+			handlers: { lifecycle },
+			debug: () => {},
+			SlothletError
+		});
+		return { manager: instance, lifecycle };
+	};
+
+	it("enforceAccess({ moduleCaller: true }) denies a private target the host policy would allow, and tags the audit with via", () => {
+		let lifecycle;
+		({ manager, lifecycle } = makeManager([], { private: { host: "allow" } }));
+
+		// No caller file at all = the host, which the policy opens...
+		expect(manager.enforceAccess("reporting.peek", "billing.internals._scale", null, null, null, null)).toBe(true);
+		expect(lifecycle.emit).not.toHaveBeenCalledWith("permission:denied", expect.anything());
+		// ...but a caller declared a file-less MODULE is never the host.
+		expect(
+			manager.enforceAccess("reporting.peek", "billing.internals._scale", null, null, null, null, { moduleCaller: true, via: "probe" })
+		).toBe(false);
+		expect(lifecycle.emit).toHaveBeenCalledWith(
+			"permission:denied",
+			expect.objectContaining({ caller: "reporting.peek", target: "billing.internals._scale", via: "probe" })
+		);
+	});
+
+	it("does not mutate a cached decision record when tagging the audit payload", () => {
+		let lifecycle;
+		({ manager, lifecycle } = makeManager([{ caller: "a.**", target: "b.**", effect: "deny" }]));
+
+		// First enforcement caches the decision; the tagged emit must spread, not write `via` into the cache.
+		expect(manager.checkCall("a.x", "b.y", [])).toBe(false);
+		expect(lifecycle.emit).toHaveBeenLastCalledWith("permission:denied", expect.objectContaining({ via: "checkCall" }));
+		expect(manager.enforceAccess("a.x", "b.y")).toBe(false);
+		expect(lifecycle.emit).toHaveBeenLastCalledWith("permission:denied", expect.not.objectContaining({ via: expect.anything() }));
+	});
+
+	it("answers a private target synchronously even when a requires rule would otherwise need a resolve", () => {
+		({ manager } = makeManager([{ caller: "**", target: "**", effect: "allow", requires: ["roles"] }]));
+		manager.registerPrincipal("roles", { key: (ctx) => ctx.user, resolve: async () => ({}) });
+
+		// Privacy is decided before rules, so the stale scan short-circuits and no Promise is produced.
+		expect(manager.checkCall("reporting.peek", "billing.internals._scale", [], { user: "u1" })).toBe(false);
+	});
+});

From 7654b712ad28273e2a9136d533b14dfe6de05ca4 Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Mon, 28 Sep 2026 17:05:22 -0700
Subject: [PATCH 16/49] fix(events): evaluate event-rule conditions against the
 user context
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A conditional event rule's condition received the whole async-context
store ({ instanceID, context: { … }, currentWrapper, … }), while a call
rule's condition receives the user context that context.run() set. The
same condition therefore behaved differently depending on which rule type
it was attached to: an object condition like { tenant: "a" } never
deep-matched on an event rule, and a function condition had to read
ctx.context.* instead of ctx.* — contrary to docs/EVENTS.md, which
promises event rules take the same condition shape as permission rules.

Both event-side resolution sites in EventManager — resolveLevel() and the
per-emit re-resolution of a subscriber — now pass
tryGetContext()?.context, matching every call-side site in api_builder.
The requires-principal path reads the same runtime context, so principal
key resolvers on event rules now see the user context too.

Behavior change: an event-rule condition that worked around the bug by
reading ctx.context.* must now read ctx.* directly.

The event-manager unit test's tryGetContext mock returned a bare user
context in place of the store; it now returns the real store shape and
keeps the same expectation. New tests cover object and function
conditions through resolveLevel, parity with an identical call-rule
condition checked through global.checkAccess in the same scope, and the
per-emit path under the emitter's context.run().

Fixes #511
---
 docs/EVENTS.md                                |  2 +-
 src/lib/handlers/event-manager.mjs            |  7 +-
 .../events/event-manager-unit.test.vitest.mjs |  3 +-
 ...ent-rule-condition-context.test.vitest.mjs | 98 +++++++++++++++++++
 4 files changed, 106 insertions(+), 4 deletions(-)
 create mode 100644 tests/vitests/suites/permissions/event-rule-condition-context.test.vitest.mjs

diff --git a/docs/EVENTS.md b/docs/EVENTS.md
index 60049fa65..0d9bde84f 100644
--- a/docs/EVENTS.md
+++ b/docs/EVENTS.md
@@ -104,7 +104,7 @@ const api = await slothlet({
 - `caller` — a glob matched against the **subscriber's** api path.
 - `event` — a glob matched against the **event name**.
 - `effect` — `deny` | `notify` | `allow`.
-- `condition` — optional, the same condition shape permission rules accept (see [PERMISSIONS-CONDITIONS.md](PERMISSIONS-CONDITIONS.md)); a subscriber's level is re-resolved per emit when any event rule is conditional.
+- `condition` — optional, the same condition shape permission rules accept (see [PERMISSIONS-CONDITIONS.md](PERMISSIONS-CONDITIONS.md)), evaluated against the same `ctx`: the `context.run()` context in effect where the level is resolved (the caller of `resolveLevel`, or the emitter at emit time). Function conditions receive `null` call metadata — an emit has no call arguments. A subscriber's level is re-resolved per emit when any event rule is conditional.
 
 `default` overrides the built-in base level (`notify`) for subscribers that match no rule.
 
diff --git a/src/lib/handlers/event-manager.mjs b/src/lib/handlers/event-manager.mjs
index a4ac6674e..b47a56253 100644
--- a/src/lib/handlers/event-manager.mjs
+++ b/src/lib/handlers/event-manager.mjs
@@ -254,7 +254,9 @@ export class EventManager extends ComponentBase {
 		const pm = this.#permissions;
 		// No permission manager → ungated (full payload), matching #levelFor and on().
 		if (!pm) return "allow";
-		const runtimeContext = this.slothlet.contextManager?.tryGetContext?.() ?? null;
+		// The USER context (`context.run()`'s), not the whole async-context store — event-rule conditions
+		// see the same `ctx` as call-rule conditions (#511).
+		const runtimeContext = this.slothlet.contextManager?.tryGetContext?.()?.context ?? null;
 		return pm.resolveEventLevel(subscriberPath, event, runtimeContext);
 	}
 
@@ -279,7 +281,8 @@ export class EventManager extends ComponentBase {
 			return sub.level;
 		}
 
-		const runtimeContext = this.slothlet.contextManager?.tryGetContext?.() ?? null;
+		// The emitter's USER context, as in resolveLevel (#511).
+		const runtimeContext = this.slothlet.contextManager?.tryGetContext?.()?.context ?? null;
 		const level = pm.resolveEventLevel(sub.subscriberPath, event, runtimeContext);
 		// Only memoize the stable (non-conditional) case; conditional levels are recomputed each emit.
 		sub.level = conditional ? null : level;
diff --git a/tests/vitests/suites/events/event-manager-unit.test.vitest.mjs b/tests/vitests/suites/events/event-manager-unit.test.vitest.mjs
index c19fd1251..fab89d2bb 100644
--- a/tests/vitests/suites/events/event-manager-unit.test.vitest.mjs
+++ b/tests/vitests/suites/events/event-manager-unit.test.vitest.mjs
@@ -298,7 +298,8 @@ describe("EventManager.resolveLevel — validation and delegation", () => {
 			return subscriberPath === "reporting.dash" ? "allow" : "notify";
 		});
 		const slothlet = makeSlothlet({ pm });
-		slothlet.contextManager.tryGetContext = () => ({ tenant: "acme" });
+		// tryGetContext() returns the async-context STORE; its `context` is the user context a condition sees (#511).
+		slothlet.contextManager.tryGetContext = () => ({ instanceID: "inst-1", context: { tenant: "acme" } });
 		const em = new EventManager(slothlet);
 		expect(em.resolveLevel("reporting.dash", "orders.created")).toBe("allow");
 		expect(em.resolveLevel("other.mod", "orders.created")).toBe("notify");
diff --git a/tests/vitests/suites/permissions/event-rule-condition-context.test.vitest.mjs b/tests/vitests/suites/permissions/event-rule-condition-context.test.vitest.mjs
new file mode 100644
index 000000000..b8e38f3d6
--- /dev/null
+++ b/tests/vitests/suites/permissions/event-rule-condition-context.test.vitest.mjs
@@ -0,0 +1,98 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/permissions/event-rule-condition-context.test.vitest.mjs
+ *
+ * Event-rule conditions see the same `ctx` as call-rule conditions (#511): the user context set by
+ * `context.run()`, not the whole async-context store. Covers both event-side resolution sites — the
+ * host `event.resolveLevel()` query and the per-emit re-resolution of a subscriber when a conditional
+ * event rule is present — for object (deep-match) and function conditions, and pins parity with a
+ * call rule carrying the identical condition, checked through `global.checkAccess` in the same scope.
+ */
+import { describe, it, expect, afterEach } from "vitest";
+import slothlet from "@cldmv/slothlet";
+import { TEST_DIRS } from "../../setup/vitest-helper.mjs";
+
+const BASE = TEST_DIRS.API_TEST_EVENTS;
+
+describe("event-rule conditions receive the user context (#511)", () => {
+	let api;
+
+	afterEach(async () => {
+		if (api) await api.shutdown();
+		api = null;
+	});
+
+	it("an object condition deep-matches the context.run() context in event.resolveLevel", async () => {
+		api = await slothlet({
+			base: BASE,
+			permissions: {
+				defaultPolicy: "allow",
+				events: {
+					default: "notify",
+					rules: [{ caller: "remote.renderer", event: "cond.*", effect: "allow", condition: { tenant: "tenant-a" } }]
+				}
+			}
+		});
+		const inScope = await api.slothlet.context.run({ tenant: "tenant-a" }, () =>
+			api.slothlet.event.resolveLevel("remote.renderer", "cond.data")
+		);
+		expect(inScope).toBe("allow");
+		const otherTenant = await api.slothlet.context.run({ tenant: "tenant-b" }, () =>
+			api.slothlet.event.resolveLevel("remote.renderer", "cond.data")
+		);
+		expect(otherTenant).toBe("notify");
+		expect(api.slothlet.event.resolveLevel("remote.renderer", "cond.data")).toBe("notify");
+	});
+
+	it("a function condition reads ctx.actor directly, exactly as the same condition on a call rule does", async () => {
+		const condition = (ctx) => ctx?.actor?.id === "u1";
+		api = await slothlet({
+			base: BASE,
+			permissions: {
+				defaultPolicy: "deny",
+				rules: [{ caller: "remote.renderer", target: "probe.**", effect: "allow", condition }],
+				events: {
+					default: "notify",
+					rules: [{ caller: "remote.renderer", event: "cond.*", effect: "allow", condition }]
+				}
+			}
+		});
+		const asU1 = await api.slothlet.context.run({ actor: { id: "u1" } }, () => ({
+			event: api.slothlet.event.resolveLevel("remote.renderer", "cond.data"),
+			call: api.slothlet.permissions.global.checkAccess("remote.renderer", "probe.anything")
+		}));
+		expect(asU1).toEqual({ event: "allow", call: true });
+		const asU2 = await api.slothlet.context.run({ actor: { id: "u2" } }, () => ({
+			event: api.slothlet.event.resolveLevel("remote.renderer", "cond.data"),
+			call: api.slothlet.permissions.global.checkAccess("remote.renderer", "probe.anything")
+		}));
+		expect(asU2).toEqual({ event: "notify", call: false });
+	});
+
+	it("the per-emit re-resolution of a subscriber sees the emitter's context.run() context", async () => {
+		api = await slothlet({
+			base: BASE,
+			permissions: {
+				defaultPolicy: "allow",
+				events: {
+					default: "notify",
+					rules: [{ caller: "subscriber.**", event: "cond.*", effect: "allow", condition: { tenant: "tenant-a" } }]
+				}
+			}
+		});
+		// Subscribed outside any context: the conditional rule does not match, so the grant is the default.
+		expect(await api.subscriber.subscribe("cond.data")).toBe("notify");
+		api.subscriber.drain();
+
+		// Emitted inside the matching context: the level is re-resolved per emit (the pool is conditional),
+		// the condition sees `{ tenant: "tenant-a" }`, and the payload is delivered.
+		await api.slothlet.context.run({ tenant: "tenant-a" }, () => api.slothlet.event.emit("cond.data", { n: 1 }));
+		// Emitted inside a non-matching context: trigger-only.
+		await api.slothlet.context.run({ tenant: "tenant-b" }, () => api.slothlet.event.emit("cond.data", { n: 2 }));
+
+		const deliveries = await api.subscriber.drain();
+		expect(deliveries).toHaveLength(2);
+		expect(deliveries[0].payload).toEqual({ n: 1 });
+		expect(deliveries[1].payload).not.toEqual({ n: 2 });
+	});
+});

From cad818dd243036149977d19e33d134f112613eb1 Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Mon, 28 Sep 2026 13:51:18 -0700
Subject: [PATCH 17/49] fix(typescript): honour module, strict, compilerOptions
 and sourcemap options

normalizeTypeScript() dropped `module`, `strict` and `compilerOptions` from
the object form, so strict mode's loader always read undefined and
transformTypeScriptStrict() fell back to fixed defaults. They are now carried
through normalization, type-validated alongside `target` and `sourcemap`
(strings / booleans / a plain object; anything else raises INVALID_CONFIG),
and documented in docs/TYPESCRIPT.md as strict-mode options.
`compilerOptions` is accepted in tsconfig.json form and converted with
ts.convertCompilerOptionsFromJson, so string values such as
`module: "commonjs"` work; an unknown option or invalid value raises
INVALID_CONFIG.

`sourcemap` had no effect: fast mode passed it to esbuild.transform() but
returned only result.code, discarding the separate result.map, and strict
mode never received it. Both paths now emit an inline source map whose
`sources` entry is the leaf's absolute path (esbuild `sourcefile`; tsc's
relative source rewritten), so `--enable-source-maps` maps stack frames from
the .slothlet-cache copy back to the .ts source. The cache file name hashes
the transpiled code, which now includes the map, so mapped and unmapped
output never share a cache file.

The new strict-mode options suite boots strict mode per test and is added to
SOLO_RUN_PATTERNS next to typescript-strict-mode.

Fixes #499
---
 docs/TYPESCRIPT.md                            |  49 ++++-
 src/lib/helpers/config.mjs                    |  50 ++++-
 src/lib/processors/loader.mjs                 |   3 +-
 src/lib/processors/typescript.mjs             |  76 +++++++-
 tests/vitests/run-all-vitest.mjs              |   3 +
 ...pescript-options-sourcemap.test.vitest.mjs | 165 +++++++++++++++++
 .../typescript-options-strict.test.vitest.mjs | 172 ++++++++++++++++++
 ...escript-options-validation.test.vitest.mjs | 110 +++++++++++
 types/src/lib/helpers/config.d.mts            |   1 +
 types/src/lib/helpers/config.d.mts.map        |   2 +-
 types/src/lib/processors/loader.d.mts.map     |   2 +-
 types/src/lib/processors/typescript.d.mts     |  11 +-
 types/src/lib/processors/typescript.d.mts.map |   2 +-
 13 files changed, 630 insertions(+), 16 deletions(-)
 create mode 100644 tests/vitests/suites/typescript/typescript-options-sourcemap.test.vitest.mjs
 create mode 100644 tests/vitests/suites/typescript/typescript-options-strict.test.vitest.mjs
 create mode 100644 tests/vitests/suites/typescript/typescript-options-validation.test.vitest.mjs

diff --git a/docs/TYPESCRIPT.md b/docs/TYPESCRIPT.md
index 0d2a76745..1c7f0e999 100644
--- a/docs/TYPESCRIPT.md
+++ b/docs/TYPESCRIPT.md
@@ -146,7 +146,10 @@ typescript: "strict"; // Strict mode (tsc)
 typescript: {
     mode: "fast" | "strict",   // Required. Defaults to "fast" if omitted
     target: "es2020",          // ECMAScript target. Default: "es2020"
-    sourcemap: false,          // Generate source maps. Default: false
+    sourcemap: false,          // Inline source maps. Default: false
+    module: "esnext",          // Strict mode only. Module kind for the type check. Default: "esnext"
+    strict: true,              // Strict mode only. tsc's strict checking. Default: true
+    compilerOptions: {},       // Strict mode only. Extra tsc compiler options (tsconfig.json form)
     types: {                   // Type generation. Strict mode only.
         output: "./types/api.d.ts",   // Required. Path to write the .d.ts file
         interfaceName: "MyAPI"        // Required. Name of the generated interface
@@ -160,7 +163,35 @@ Accepts any valid ECMAScript target string: `"es2015"`, `"es2017"`, `"es2018"`,
 
 #### `sourcemap`
 
-When `true`, source maps are generated and inlined. Useful for debugging in development. Default: `false`.
+When `true`, each transpiled module carries an inline source map whose `sources` entry is the absolute path of the `.ts` file. Transpiled modules are loaded from a cache directory (`.slothlet-cache/`), so without a map, stack frames point at the cached copy; with a map and Node's `--enable-source-maps` flag (or any tool that reads inline maps, such as a debugger), they point at the original `.ts` source. Applies to both fast and strict mode. Default: `false`.
+
+```bash
+node --enable-source-maps app.mjs
+```
+
+#### `module`
+
+Strict mode only. The module kind tsc checks and emits against: `"esnext"`, `"es2022"`, `"es2020"`, `"es2015"`, `"node16"`, `"nodenext"`, and so on. Default: `"esnext"`. Slothlet loads the output as an ES module, so pick an ES module kind; a CommonJS module kind is useful only to have the type check flag ESM-only syntax such as `import.meta`.
+
+#### `strict`
+
+Strict mode only. Sets tsc's `strict` flag (`noImplicitAny`, `strictNullChecks`, and the rest of the strict family). Default: `true`. Set `strict: false` to type-check with the strict family off.
+
+#### `compilerOptions`
+
+Strict mode only. Extra tsc compiler options, written as in the `compilerOptions` block of a `tsconfig.json` (string values such as `module: "commonjs"` are accepted), applied on top of the options above. Relative paths resolve against the current working directory. An unknown option or an invalid value throws `INVALID_CONFIG`.
+
+```javascript
+typescript: {
+    mode: "strict",
+    types: { output: "./types/api.d.ts", interfaceName: "MyAPI" },
+    compilerOptions: { noUnusedLocals: true, noUnusedParameters: true }
+}
+```
+
+#### Validation
+
+`target` and `module` must be strings, `sourcemap` and `strict` booleans, and `compilerOptions` a plain object. Any other value throws `INVALID_CONFIG` when `slothlet()` is called.
 
 ---
 
@@ -203,6 +234,20 @@ const api = await slothlet({
 
 Strict mode is slower than fast mode due to full compilation. It is well-suited for production validation, CI checks, or anywhere you want to catch type errors at startup.
 
+How strict the check is can be tuned with [`strict`](#strict), [`module`](#module), and [`compilerOptions`](#compileroptions):
+
+```javascript
+const api = await slothlet({
+	dir: "./api",
+	typescript: {
+		mode: "strict",
+		strict: true,
+		compilerOptions: { noUnusedLocals: true },
+		types: { output: "./types/api.d.ts", interfaceName: "MyAPI" }
+	}
+});
+```
+
 ---
 
 ## Type Generation (.d.ts)
diff --git a/src/lib/helpers/config.mjs b/src/lib/helpers/config.mjs
index ffab01551..b1805d687 100644
--- a/src/lib/helpers/config.mjs
+++ b/src/lib/helpers/config.mjs
@@ -736,12 +736,25 @@ export class Config extends ComponentBase {
 		// Object configuration
 		if (typeof typescript === "object") {
 			const mode = typescript.mode === "strict" ? "strict" : "fast";
+			this.#validateTypeScriptOption("target", typescript.target, "string", 'a string such as "es2020"');
+			this.#validateTypeScriptOption("sourcemap", typescript.sourcemap, "boolean", "a boolean");
+			this.#validateTypeScriptOption("module", typescript.module, "string", 'a string such as "esnext"');
+			this.#validateTypeScriptOption("strict", typescript.strict, "boolean", "a boolean");
+			this.#validateTypeScriptOption(
+				"compilerOptions",
+				typescript.compilerOptions,
+				"plain-object",
+				"a plain object of tsconfig.json compilerOptions"
+			);
 			return {
 				enabled: true,
 				mode,
 				types: typescript.types || null,
 				target: typescript.target || "es2020",
-				sourcemap: typescript.sourcemap || false
+				sourcemap: typescript.sourcemap || false,
+				module: typescript.module ?? null,
+				strict: typescript.strict ?? null,
+				compilerOptions: typescript.compilerOptions ?? null
 			};
 		}
 
@@ -749,6 +762,41 @@ export class Config extends ComponentBase {
 		return null;
 	}
 
+	/**
+	 * Validate the type of one `typescript` object-form option. `undefined` and `null` mean
+	 * "not set" and always pass.
+	 * @param {string} name - Option name under `typescript` (e.g. `"strict"`).
+	 * @param {unknown} value - The raw option value.
+	 * @param {"string"|"boolean"|"plain-object"} kind - Required kind of value.
+	 * @param {string} expected - Human-readable description of the accepted values.
+	 * @returns {void}
+	 * @throws {SlothletError} INVALID_CONFIG when the value is set and is not of the required kind.
+	 * @private
+	 */
+	#validateTypeScriptOption(name, value, kind, expected) {
+		if (value === undefined || value === null) return;
+		let valid;
+		if (kind === "plain-object") {
+			const proto = typeof value === "object" ? Object.getPrototypeOf(value) : undefined;
+			valid = typeof value === "object" && (proto === Object.prototype || proto === null);
+		} else {
+			valid = typeof value === kind;
+		}
+		if (valid) return;
+		throw new this.SlothletError(
+			"INVALID_CONFIG",
+			{
+				option: `typescript.${name}`,
+				value: Array.isArray(value) ? "array" : typeof value === "object" ? (value.constructor?.name ?? "object") : typeof value,
+				expected,
+				hint: "HINT_INVALID_CONFIG",
+				validationError: true
+			},
+			null,
+			{ validationError: true }
+		);
+	}
+
 	/**
 	 * Normalize env snapshot configuration.
 	 *
diff --git a/src/lib/processors/loader.mjs b/src/lib/processors/loader.mjs
index 2e9fb26c3..fe35e5a6b 100644
--- a/src/lib/processors/loader.mjs
+++ b/src/lib/processors/loader.mjs
@@ -278,7 +278,8 @@ export class Loader extends ComponentBase {
 							module: typescriptConfig.module,
 							strict: typescriptConfig.strict,
 							typeDefinitionPath: typescriptConfig.types.output,
-							compilerOptions: typescriptConfig.compilerOptions
+							compilerOptions: typescriptConfig.compilerOptions,
+							sourcemap: typescriptConfig.sourcemap
 						});
 						// Check for type errors
 						if (result.diagnostics && result.diagnostics.length > 0) {
diff --git a/src/lib/processors/typescript.mjs b/src/lib/processors/typescript.mjs
index 6f5cee6bf..774d0664b 100644
--- a/src/lib/processors/typescript.mjs
+++ b/src/lib/processors/typescript.mjs
@@ -77,7 +77,8 @@ async function getTypeScript() {
  * @param {object} [options={}] - esbuild transform options
  * @param {string} [options.target] - ECMAScript target version (default: "es2020")
  * @param {string} [options.format] - Module format (default: "esm")
- * @param {boolean} [options.sourcemap] - Generate source maps (default: false)
+ * @param {boolean} [options.sourcemap] - Append an inline source map whose `sources` names the
+ *   absolute path of `filePath`, so the cached output maps back to the `.ts` source (default: false)
  * @returns {Promise<string>} Transformed JavaScript code
  * @throws {SlothletError} If transformation fails
  * @public
@@ -85,13 +86,17 @@ async function getTypeScript() {
 export async function transformTypeScript(filePath, options = {}) {
 	const esbuild = await getEsbuild(); // Lazy load - only when actually needed
 	const code = fs.readFileSync(filePath, "utf8");
+	const { sourcemap, ...rest } = options;
 
 	const result = await esbuild.transform(code, {
 		loader: "ts",
-		format: options.format || "esm",
-		target: options.target || "es2020",
-		sourcemap: options.sourcemap || false,
-		...options
+		format: "esm",
+		target: "es2020",
+		...rest,
+		// The transpiled output is loaded from a cache file, not from `filePath`, so the map is
+		// inlined (a separate `result.map` would be discarded) and names the source by its
+		// absolute path so it resolves from the cache directory.
+		...(sourcemap && { sourcemap: "inline", sourcefile: path.resolve(filePath) })
 	});
 
 	return result.code;
@@ -842,7 +847,13 @@ async function writeTransformedGraph(absolutePath, code, cacheDir, transform) {
  * @param {boolean} [options.strict] - Enable strict type checking (default: true)
  * @param {boolean} [options.skipTypeCheck] - Skip type checking and only transform (default: false)
  * @param {string} [options.typeDefinitionPath] - Path to .d.ts file for type checking
+ * @param {boolean} [options.sourcemap] - Append an inline source map whose `sources` names the
+ *   absolute path of `filePath` (default: false)
+ * @param {object} [options.compilerOptions] - Extra compiler options in tsconfig.json form
+ *   (`{ noUnusedLocals: true, module: "commonjs" }`), applied over the options above. Relative
+ *   paths resolve against the current working directory.
  * @returns {Promise<{code: string, diagnostics: object[]}>} Transformed code and type diagnostics
+ * @throws {SlothletError} INVALID_CONFIG when `options.compilerOptions` holds an unknown option or an invalid value
  * @throws {SlothletError} If transformation fails
  * @public
  */
@@ -897,7 +908,7 @@ export async function transformTypeScriptStrict(filePath, options = {}) {
 			typeRoots: [path.dirname(options.typeDefinitionPath)],
 			types: [path.basename(options.typeDefinitionPath, ".d.ts")]
 		}),
-		...options.compilerOptions
+		...convertCompilerOptions(ts, options.compilerOptions)
 	};
 
 	// Perform type checking using Program API if not skipped
@@ -927,16 +938,65 @@ export async function transformTypeScriptStrict(filePath, options = {}) {
 
 	// Transform using transpileModule (fast, doesn't require full type checking)
 	const result = ts.transpileModule(code, {
-		compilerOptions,
+		compilerOptions: options.sourcemap
+			? { ...compilerOptions, sourceMap: false, inlineSourceMap: true, inlineSources: true }
+			: compilerOptions,
 		fileName: filePath
 	});
 
 	return {
-		code: result.outputText,
+		code: options.sourcemap ? withAbsoluteMapSource(result.outputText, path.resolve(filePath)) : result.outputText,
 		diagnostics
 	};
 }
 
+/**
+ * Convert user-supplied compiler options from tsconfig.json form (string enum values such as
+ * `module: "commonjs"`) to the form the compiler API takes.
+ * @param {object} ts - TypeScript module instance
+ * @param {object|null|undefined} compilerOptions - Options in tsconfig.json form
+ * @returns {object} Converted options (empty when none were given)
+ * @throws {SlothletError} INVALID_CONFIG when an option is unknown or has an invalid value
+ * @private
+ */
+function convertCompilerOptions(ts, compilerOptions) {
+	if (!compilerOptions) return {};
+	const { options, errors } = ts.convertCompilerOptionsFromJson(compilerOptions, process.cwd());
+	if (errors.length > 0) {
+		throw new SlothletError(
+			"INVALID_CONFIG",
+			{
+				option: "typescript.compilerOptions",
+				value: errors.map((error) => ts.flattenDiagnosticMessageText(error.messageText, " ")).join(" "),
+				expected: "valid tsconfig.json compilerOptions",
+				hint: "HINT_INVALID_CONFIG",
+				validationError: true
+			},
+			null,
+			{ validationError: true }
+		);
+	}
+	return options;
+}
+
+/**
+ * Point the inline source map tsc appended to `code` at the source's absolute path. tsc names the
+ * source relative to the output file, which does not resolve from the cache directory the output
+ * is loaded from.
+ * @param {string} code - tsc output ending in an inline `sourceMappingURL` comment
+ * @param {string} absolutePath - Absolute path of the `.ts` source
+ * @returns {string} `code` with the map's `sources` replaced by `[absolutePath]`
+ * @private
+ */
+function withAbsoluteMapSource(code, absolutePath) {
+	const marker = "//# sourceMappingURL=data:application/json;base64,";
+	const index = code.lastIndexOf(marker);
+	const map = JSON.parse(Buffer.from(code.slice(index + marker.length).trim(), "base64").toString("utf8"));
+	map.sources = [absolutePath];
+	delete map.sourceRoot;
+	return code.slice(0, index) + marker + Buffer.from(JSON.stringify(map), "utf8").toString("base64");
+}
+
 /**
  * Format TypeScript diagnostics into readable error messages
  * @param {object[]} diagnostics - TypeScript diagnostic objects
diff --git a/tests/vitests/run-all-vitest.mjs b/tests/vitests/run-all-vitest.mjs
index e141834db..936fa4a94 100644
--- a/tests/vitests/run-all-vitest.mjs
+++ b/tests/vitests/run-all-vitest.mjs
@@ -135,6 +135,9 @@ const SOLO_RUN_PATTERNS = [
 	// the other workers and exceeds vitest's 10s hook timeout (passes 13/13 in isolation), so it
 	// runs solo like the other resource-heavy files.
 	"tests/vitests/suites/typescript/typescript-strict-mode.test.vitest.mjs",
+	// typescript-options-strict boots strict mode (a forked tsc type-generation pass plus the type
+	// check) once per test, for the same reason as typescript-strict-mode above.
+	"tests/vitests/suites/typescript/typescript-options-strict.test.vitest.mjs",
 	// typegen-programmatic runs generateTypes per test — two `ts.Program`s (checker + declaration
 	// emit) plus a `tsc` compile of the output in the acceptance check. Under a full parallel run
 	// those tsc passes are starved by the other workers and blow past the test timeout (each takes
diff --git a/tests/vitests/suites/typescript/typescript-options-sourcemap.test.vitest.mjs b/tests/vitests/suites/typescript/typescript-options-sourcemap.test.vitest.mjs
new file mode 100644
index 000000000..cb95d854e
--- /dev/null
+++ b/tests/vitests/suites/typescript/typescript-options-sourcemap.test.vitest.mjs
@@ -0,0 +1,165 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/typescript/typescript-options-sourcemap.test.vitest.mjs
+ *	@Date: 2026-09-28T00:00:00-07:00 (1790578800)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 00:00:00 -07:00 (1790578800)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview The `typescript.sourcemap` option (#499).
+ *
+ * @description
+ * `sourcemap: true` must produce transpiled output that carries an INLINE source map whose
+ * `sources` names the original `.ts` file by its absolute path — in fast mode (esbuild) and in
+ * strict mode's transform path (tsc) — so that `node --enable-source-maps` maps stack frames
+ * from the `.slothlet-cache/` copy back to the `.ts` source. With `sourcemap` off, no map is
+ * emitted, and the two outputs hash to different cache files so one is never served for the other.
+ *
+ * @module tests/vitests/suites/typescript/typescript-options-sourcemap.test.vitest
+ */
+
+import { describe, it, expect, beforeAll, afterAll } from "vitest";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { writeFile, rm, mkdir } from "node:fs/promises";
+import { transformTypeScript, transformTypeScriptStrict, writeTransformedToCache } from "@cldmv/slothlet/processors/typescript";
+import { writeFileSync } from "node:fs";
+import { makeTestTmpDir } from "../../setup/test-fixtures-tmp.mjs";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = path.resolve(__dirname, "../../../..");
+
+const INLINE_MAP_RE = /\/\/# sourceMappingURL=data:application\/json;base64,([A-Za-z0-9+/=]+)\s*$/;
+
+/**
+ * Decode the inline source map appended to transpiled output.
+ * @param {string} code - Transpiled JavaScript.
+ * @returns {object|null} The parsed source map, or `null` when none is inlined.
+ */
+function inlineMap(code) {
+	const match = INLINE_MAP_RE.exec(code);
+	return match ? JSON.parse(Buffer.from(match[1], "base64").toString("utf8")) : null;
+}
+
+const LEAF_SOURCE = [
+	"export function boom(label: string): never {",
+	"\tconst message: string = `boom-499:${label}`;",
+	"\tthrow new Error(message);",
+	"}",
+	""
+].join("\n");
+
+let root;
+let leafPath;
+
+beforeAll(async () => {
+	root = await makeTestTmpDir("ts-options-sourcemap");
+	leafPath = path.join(root, "api", "boom.ts");
+	await mkdir(path.dirname(leafPath), { recursive: true });
+	await writeFile(leafPath, LEAF_SOURCE, "utf8");
+});
+
+afterAll(async () => {
+	if (root) await rm(root, { recursive: true, force: true });
+});
+
+describe("fast mode (esbuild) sourcemap", () => {
+	it("emits an inline source map naming the absolute .ts path when sourcemap is true", async () => {
+		const code = await transformTypeScript(leafPath, { sourcemap: true });
+		const map = inlineMap(code);
+		expect(map).not.toBeNull();
+		expect(map.sources).toEqual([leafPath]);
+	});
+
+	it("emits no source map when sourcemap is false or omitted", async () => {
+		expect(inlineMap(await transformTypeScript(leafPath, { sourcemap: false }))).toBeNull();
+		expect(inlineMap(await transformTypeScript(leafPath))).toBeNull();
+	});
+});
+
+describe("strict mode (tsc) sourcemap", () => {
+	it("emits an inline source map naming the absolute .ts path when sourcemap is true", async () => {
+		const { code } = await transformTypeScriptStrict(leafPath, { sourcemap: true, skipTypeCheck: true });
+		const map = inlineMap(code);
+		expect(map).not.toBeNull();
+		expect(map.sources).toEqual([leafPath]);
+	});
+
+	it("emits no source map when sourcemap is omitted", async () => {
+		const { code } = await transformTypeScriptStrict(leafPath, { skipTypeCheck: true });
+		expect(inlineMap(code)).toBeNull();
+	});
+});
+
+describe("transform cache keys", () => {
+	it("writes mapped and unmapped output to different cache files", async () => {
+		const instanceID = `ts-options-sourcemap-${process.pid}`;
+		const withMap = await transformTypeScript(leafPath, { sourcemap: true });
+		const withoutMap = await transformTypeScript(leafPath, { sourcemap: false });
+		const a = await writeTransformedToCache(leafPath, withMap, instanceID);
+		const b = await writeTransformedToCache(leafPath, withoutMap, instanceID);
+		try {
+			expect(a.url).not.toBe(b.url);
+		} finally {
+			await rm(a.cacheDir, { recursive: true, force: true });
+		}
+	});
+});
+
+describe("stack traces under --enable-source-maps", () => {
+	/**
+	 * Boot slothlet in a child process against the fixture and return the stack of the error
+	 * thrown by the `.ts` leaf.
+	 * @param {object} typescript - The `typescript` config to boot with.
+	 * @returns {string} The child's stdout (the error stack).
+	 */
+	function stackFromChild(typescript) {
+		const script = [
+			`import slothlet from ${JSON.stringify(pathToFileURL(path.join(REPO_ROOT, "index.mjs")).href)};`,
+			`const api = await slothlet({ dir: ${JSON.stringify(path.dirname(leafPath))}, mode: "eager", silent: true, typescript: ${JSON.stringify(typescript)} });`,
+			`try { await api.boom("x"); } catch (error) { process.stdout.write(String(error.stack)); }`,
+			`await api.slothlet.shutdown();`
+		].join("\n");
+		// A script file rather than `-e`: strict mode forks its type-generation worker with the
+		// parent's execArgv, and `--input-type` is rejected for a file entry point.
+		const scriptPath = path.join(root, `child-${typescript.mode}-${Date.now()}.mjs`);
+		writeFileSync(scriptPath, script, "utf8");
+		const result = spawnSync(process.execPath, ["--enable-source-maps", scriptPath], {
+			cwd: REPO_ROOT,
+			env: process.env,
+			encoding: "utf8",
+			timeout: 90000
+		});
+		expect(result.status, result.stderr).toBe(0);
+		return result.stdout;
+	}
+
+	it("points the throwing frame at the .ts source when sourcemap is true (fast mode)", () => {
+		const stack = stackFromChild({ mode: "fast", sourcemap: true });
+		expect(stack).toContain("boom-499:x");
+		expect(stack).toContain(`${leafPath}:3`);
+	}, 60000);
+
+	it("points the throwing frame at the .ts source when sourcemap is true (strict mode)", () => {
+		const stack = stackFromChild({
+			mode: "strict",
+			sourcemap: true,
+			types: { output: path.join(root, "strict-stack.d.ts"), interfaceName: "StackAPI" }
+		});
+		expect(stack).toContain("boom-499:x");
+		expect(stack).toContain(`${leafPath}:3`);
+	}, 90000);
+
+	it("points the throwing frame at the cache copy when sourcemap is off", () => {
+		const stack = stackFromChild({ mode: "fast" });
+		expect(stack).toContain("boom-499:x");
+		expect(stack).not.toContain(leafPath);
+	}, 60000);
+});
diff --git a/tests/vitests/suites/typescript/typescript-options-strict.test.vitest.mjs b/tests/vitests/suites/typescript/typescript-options-strict.test.vitest.mjs
new file mode 100644
index 000000000..e9dc027b2
--- /dev/null
+++ b/tests/vitests/suites/typescript/typescript-options-strict.test.vitest.mjs
@@ -0,0 +1,172 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/typescript/typescript-options-strict.test.vitest.mjs
+ *	@Date: 2026-09-28T00:00:00-07:00 (1790578800)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 00:00:00 -07:00 (1790578800)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Strict mode honours `typescript.strict`, `typescript.module` and
+ * `typescript.compilerOptions` (#499).
+ *
+ * @description
+ * Each option is driven through the real `slothlet({...})` config path and proven to reach the
+ * type check by a leaf whose diagnostics depend on it:
+ *
+ * - `strict: false` — an implicit-`any` parameter (TS7006) is rejected by default and accepted
+ *   once strict checking is turned off.
+ * - `compilerOptions: { noUnusedLocals: true }` — an unused local (TS6133) passes by default and
+ *   is rejected once the flag is set.
+ * - `module: "commonjs"` (and the tsconfig-style `compilerOptions: { module: "commonjs" }`) —
+ *   `import.meta` (TS1343) passes under the default ESNext module and is rejected under CommonJS.
+ *
+ * Every boot forks strict mode's type-generation pass, so the file runs solo
+ * (SOLO_RUN_PATTERNS in run-all-vitest.mjs) with a generous timeout.
+ *
+ * @module tests/vitests/suites/typescript/typescript-options-strict.test.vitest
+ */
+
+import { describe, it, expect, beforeAll, afterAll, afterEach, vi } from "vitest";
+import path from "node:path";
+import { mkdir, writeFile, rm } from "node:fs/promises";
+import slothlet from "../../../../index.mjs";
+import { makeTestTmpDir } from "../../setup/test-fixtures-tmp.mjs";
+import { withSuppressedSlothletErrorOutput } from "../../setup/vitest-helper.mjs";
+
+vi.setConfig({ testTimeout: 90000, hookTimeout: 90000 });
+
+let root;
+let api;
+
+/**
+ * Write a one-leaf API directory under the test root.
+ * @param {string} name - Directory name.
+ * @param {string} leaf - Leaf name; the file `<leaf>.ts` exports a function of the same name, so
+ *   it flattens to `api.<leaf>`.
+ * @param {string} source - TypeScript source of the leaf.
+ * @returns {Promise<string>} The API directory.
+ */
+async function apiDir(name, leaf, source) {
+	const dir = path.join(root, name);
+	await mkdir(dir, { recursive: true });
+	await writeFile(path.join(dir, `${leaf}.ts`), source, "utf8");
+	return dir;
+}
+
+/**
+ * Boot slothlet in strict TypeScript mode.
+ * @param {string} dir - API directory.
+ * @param {object} [options] - Extra `typescript` options.
+ * @returns {Promise<object>} The api.
+ */
+async function boot(dir, options = {}) {
+	api = await slothlet({
+		dir,
+		mode: "eager",
+		silent: true,
+		typescript: {
+			mode: "strict",
+			types: { output: path.join(root, `${path.basename(dir)}-${Date.now()}.d.ts`), interfaceName: "OptionsAPI" },
+			...options
+		}
+	});
+	return api;
+}
+
+/**
+ * Assert that booting rejects with an error whose message names the given error code and detail.
+ * An eager boot wraps a leaf's load failure in MODULE_IMPORT_FAILED, so the inner code is matched
+ * in the message rather than on `error.code`.
+ * @param {string} dir - API directory.
+ * @param {object} options - Extra `typescript` options.
+ * @param {string} code - Expected SlothletError code.
+ * @param {string} detail - Text the message must also contain (e.g. the TypeScript diagnostic).
+ * @returns {Promise<void>}
+ */
+async function expectBootRejects(dir, options, code, detail) {
+	await withSuppressedSlothletErrorOutput(async () => {
+		const error = await boot(dir, options).then(
+			() => null,
+			(err) => err
+		);
+		expect(error).not.toBeNull();
+		expect(error.message).toContain(code);
+		expect(error.message).toContain(detail);
+	});
+}
+
+let implicitAnyDir;
+let unusedLocalDir;
+let importMetaDir;
+
+beforeAll(async () => {
+	root = await makeTestTmpDir("ts-options-strict");
+	implicitAnyDir = await apiDir("implicit-any", "echo", "export function echo(value) {\n\treturn value;\n}\n");
+	unusedLocalDir = await apiDir(
+		"unused-local",
+		"double",
+		"export function double(value: number): number {\n\tconst unused = 1;\n\treturn value * 2;\n}\n"
+	);
+	importMetaDir = await apiDir("import-meta", "where", "export function where(): string {\n\treturn import.meta.url;\n}\n");
+});
+
+afterEach(async () => {
+	if (api?.slothlet?.shutdown) await api.slothlet.shutdown().catch(() => {});
+	api = null;
+});
+
+afterAll(async () => {
+	if (root) await rm(root, { recursive: true, force: true });
+});
+
+describe("typescript.strict", () => {
+	it("rejects an implicit-any parameter by default", async () => {
+		await expectBootRejects(implicitAnyDir, {}, "TS_TYPE_CHECK_ERRORS", "implicitly has an 'any' type");
+	});
+
+	it("accepts an implicit-any parameter with strict: false", async () => {
+		await boot(implicitAnyDir, { strict: false });
+		expect(await api.echo(7)).toBe(7);
+	});
+});
+
+describe("typescript.compilerOptions", () => {
+	it("accepts an unused local by default", async () => {
+		await boot(unusedLocalDir);
+		expect(await api.double(4)).toBe(8);
+	});
+
+	it("rejects an unused local with compilerOptions.noUnusedLocals", async () => {
+		await expectBootRejects(unusedLocalDir, { compilerOptions: { noUnusedLocals: true } }, "TS_TYPE_CHECK_ERRORS", "'unused' is declared");
+	});
+
+	it('applies tsconfig-style string values (compilerOptions.module: "commonjs" rejects import.meta)', async () => {
+		await expectBootRejects(importMetaDir, { compilerOptions: { module: "commonjs" } }, "TS_TYPE_CHECK_ERRORS", "import.meta");
+	});
+
+	it("rejects an unknown compiler option with INVALID_CONFIG", async () => {
+		await expectBootRejects(
+			unusedLocalDir,
+			{ compilerOptions: { notARealCompilerOption: true } },
+			"INVALID_CONFIG",
+			"notARealCompilerOption"
+		);
+	});
+});
+
+describe("typescript.module", () => {
+	it("accepts import.meta under the default module", async () => {
+		await boot(importMetaDir);
+		expect(await api.where()).toMatch(/^file:/);
+	});
+
+	it('rejects import.meta with module: "commonjs"', async () => {
+		await expectBootRejects(importMetaDir, { module: "commonjs" }, "TS_TYPE_CHECK_ERRORS", "import.meta");
+	});
+});
diff --git a/tests/vitests/suites/typescript/typescript-options-validation.test.vitest.mjs b/tests/vitests/suites/typescript/typescript-options-validation.test.vitest.mjs
new file mode 100644
index 000000000..f4a9c8de1
--- /dev/null
+++ b/tests/vitests/suites/typescript/typescript-options-validation.test.vitest.mjs
@@ -0,0 +1,110 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/typescript/typescript-options-validation.test.vitest.mjs
+ *	@Date: 2026-09-28T00:00:00-07:00 (1790578800)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 00:00:00 -07:00 (1790578800)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Normalization and validation of the `typescript` options object (#499).
+ *
+ * @description
+ * `normalizeTypeScript()` must carry every documented option — `target`, `sourcemap`, and the
+ * strict-mode options `module`, `strict`, `compilerOptions` — through to the normalized config,
+ * and reject a value of the wrong type with INVALID_CONFIG (both directly and through the real
+ * `slothlet({...})` config path).
+ *
+ * @module tests/vitests/suites/typescript/typescript-options-validation.test.vitest
+ */
+
+import { describe, it, expect, vi, afterEach } from "vitest";
+import { Config } from "@cldmv/slothlet/helpers/config";
+import { SlothletError, SlothletWarning } from "@cldmv/slothlet/errors";
+import slothlet from "../../../../index.mjs";
+import { withSuppressedSlothletErrorOutput } from "../../setup/vitest-helper.mjs";
+
+/**
+ * Minimal mock slothlet satisfying Config's ComponentBase requirements.
+ * @returns {object} Mock slothlet instance.
+ */
+function makeMock() {
+	return {
+		config: {},
+		debug: vi.fn(),
+		SlothletError,
+		SlothletWarning,
+		helpers: { resolver: { resolvePathFromCaller: (dir) => dir } }
+	};
+}
+
+let api;
+afterEach(async () => {
+	if (api?.slothlet?.shutdown) await api.slothlet.shutdown().catch(() => {});
+	api = null;
+});
+
+describe("normalizeTypeScript — option pass-through", () => {
+	it("carries module, strict and compilerOptions through the object form", () => {
+		const cfg = new Config(makeMock());
+		const compilerOptions = { noUnusedLocals: true };
+		const result = cfg.normalizeTypeScript({ mode: "strict", module: "esnext", strict: false, compilerOptions });
+		expect(result).toMatchObject({ enabled: true, mode: "strict", module: "esnext", strict: false, compilerOptions });
+	});
+
+	it("keeps sourcemap: true", () => {
+		const cfg = new Config(makeMock());
+		expect(cfg.normalizeTypeScript({ mode: "fast", sourcemap: true })).toMatchObject({ sourcemap: true });
+	});
+
+	it("is idempotent on an already-normalized config", () => {
+		const cfg = new Config(makeMock());
+		const once = cfg.normalizeTypeScript({ mode: "strict", module: "esnext", strict: false, compilerOptions: { noUnusedLocals: true } });
+		expect(cfg.normalizeTypeScript(once)).toEqual(once);
+	});
+});
+
+describe("normalizeTypeScript — INVALID_CONFIG", () => {
+	const cases = [
+		["target", 2020],
+		["module", 99],
+		["strict", "no"],
+		["sourcemap", "inline"],
+		["compilerOptions", "noUnusedLocals"],
+		["compilerOptions", ["noUnusedLocals"]],
+		["compilerOptions", new Map()]
+	];
+
+	it.each(cases)("rejects typescript.%s = %o", (option, value) => {
+		const cfg = new Config(makeMock());
+		expect(() => cfg.normalizeTypeScript({ mode: "strict", [option]: value })).toThrow(expect.objectContaining({ code: "INVALID_CONFIG" }));
+	});
+
+	it.each([
+		["an array", ["x"], "array"],
+		["a class instance", new Map(), "Map"],
+		["a null-prototype object", Object.create(null), "object"],
+		["a number", 1, "number"]
+	])("reports %s as %o in the error", (_label, value, reported) => {
+		const cfg = new Config(makeMock());
+		expect(() => cfg.normalizeTypeScript({ mode: "strict", strict: value })).toThrow(
+			expect.objectContaining({
+				code: "INVALID_CONFIG",
+				context: expect.objectContaining({ option: "typescript.strict", value: reported })
+			})
+		);
+	});
+
+	it("rejects an invalid option through slothlet()", async () => {
+		await withSuppressedSlothletErrorOutput(async () => {
+			await expect(
+				slothlet({ dir: "./api_tests/api_test_typescript", silent: true, typescript: { mode: "fast", strict: "yes" } })
+			).rejects.toMatchObject({ code: "INVALID_CONFIG" });
+		});
+	});
+});
diff --git a/types/src/lib/helpers/config.d.mts b/types/src/lib/helpers/config.d.mts
index 9d8858b00..ef3f9ab26 100644
--- a/types/src/lib/helpers/config.d.mts
+++ b/types/src/lib/helpers/config.d.mts
@@ -319,6 +319,7 @@ export class Config extends ComponentBase {
      * // => { defaultPolicy: "deny", enabled: true, audit: "default", readGating: true, rules: [...] }
      */
     normalizePermissions(permissions?: object | null): object | null;
+    #private;
 }
 import { ComponentBase } from "#factories/component-base";
 //# sourceMappingURL=config.d.mts.map
\ No newline at end of file
diff --git a/types/src/lib/helpers/config.d.mts.map b/types/src/lib/helpers/config.d.mts.map
index 028f79721..580cbde93 100644
--- a/types/src/lib/helpers/config.d.mts.map
+++ b/types/src/lib/helpers/config.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"config.d.mts","sourceRoot":"","sources":["../../../../src/lib/helpers/config.mjs"],"names":[],"mappings":"AAwEA;;;;;;;;;;;;;;;;;GAiBG;AACH,2CAJW,OAAO,GAAC,MAAM,GAAC,MAAM,GACnB;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;IAAC,cAAc,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,OAAO,CAAA;CAAC,CAqB7F;AAED;;;;;GAKG;AACH;IACC,gCAAmC;IAEnC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,qCAxBW,MAAM,GAAC,MAAM,GACX,MAAM,CAiDlB;IAED;;;;;OAKG;IACH,iCAJW,MAAM,GACJ,MAAM,CAsBlB;IAED;;;;;OAKG;IACH,2BAJW,MAAM,GACJ,MAAM,CAsBlB;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,qCAnBW,MAAM,GACJ,MAAM,CAyClB;IAED;;;;;OAKG;IACH,6BAJW,OAAO,GAAC,MAAM,GACZ,MAAM,CAoElB;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,oCATW,GAAC,0BACC,SAAS,GAAC,MAAM,CAoB5B;IAED;;;;;;;;;;;;;;OAcG;IACH,4BAJW,OAAO,GAAC,MAAM,GAAC,MAAM,GACnB;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,cAAc,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,OAAO,CAAA;KAAC,CAK7F;IAED;;;;;;OAMG;IACH,gCALW,MAAM,GACJ,MAAM,CAuQlB;IAED;;;;;;;;;;;OAWG;IACH,6CARW,MAAM,EAAE,GAAC,SAAS,UAClB,OAAO,GACL,GAAG,CAAC,MAAM,CAAC,CA8BvB;IAED;;;;;OAKG;IACH,uCAJW,OAAO,GAAC,MAAM,GAAC,MAAM,GACnB,MAAM,GAAC,IAAI,CAsCvB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,yBArBW,MAAM,GAAC,IAAI,GAAC,SAAS,GAEnB;QAAE,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,GAAC,IAAI,CA4BtC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,qCAbW,MAAM,GAAC,IAAI,GAAC,SAAS,GACnB,MAAM,GAAC,IAAI,CAqEvB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6CG;IACH,mCApBW,SAAS,GAAC,IAAI,GAAC,KAAK,CAAC,MAAM,GAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAC,CAAC,GAChH,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,GAAC,SAAS,GAAC,UAAU,GAAC,SAAS,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,OAAO,GAAC,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAC,CAAC,CAiO9I;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,mCAvBW,MAAM,GAAC,IAAI,GAiBT,MAAM,GAAC,IAAI,CAgQvB;CACD;8BA92C6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"config.d.mts","sourceRoot":"","sources":["../../../../src/lib/helpers/config.mjs"],"names":[],"mappings":"AAwEA;;;;;;;;;;;;;;;;;GAiBG;AACH,2CAJW,OAAO,GAAC,MAAM,GAAC,MAAM,GACnB;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;IAAC,cAAc,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,OAAO,CAAA;CAAC,CAqB7F;AAED;;;;;GAKG;AACH;IACC,gCAAmC;IAEnC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,qCAxBW,MAAM,GAAC,MAAM,GACX,MAAM,CAiDlB;IAED;;;;;OAKG;IACH,iCAJW,MAAM,GACJ,MAAM,CAsBlB;IAED;;;;;OAKG;IACH,2BAJW,MAAM,GACJ,MAAM,CAsBlB;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,qCAnBW,MAAM,GACJ,MAAM,CAyClB;IAED;;;;;OAKG;IACH,6BAJW,OAAO,GAAC,MAAM,GACZ,MAAM,CAoElB;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,oCATW,GAAC,0BACC,SAAS,GAAC,MAAM,CAoB5B;IAED;;;;;;;;;;;;;;OAcG;IACH,4BAJW,OAAO,GAAC,MAAM,GAAC,MAAM,GACnB;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,cAAc,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,OAAO,CAAA;KAAC,CAK7F;IAED;;;;;;OAMG;IACH,gCALW,MAAM,GACJ,MAAM,CAuQlB;IAED;;;;;;;;;;;OAWG;IACH,6CARW,MAAM,EAAE,GAAC,SAAS,UAClB,OAAO,GACL,GAAG,CAAC,MAAM,CAAC,CA8BvB;IAED;;;;;OAKG;IACH,uCAJW,OAAO,GAAC,MAAM,GAAC,MAAM,GACnB,MAAM,GAAC,IAAI,CAmDvB;IAqCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,yBArBW,MAAM,GAAC,IAAI,GAAC,SAAS,GAEnB;QAAE,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,GAAC,IAAI,CA4BtC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,qCAbW,MAAM,GAAC,IAAI,GAAC,SAAS,GACnB,MAAM,GAAC,IAAI,CAqEvB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6CG;IACH,mCApBW,SAAS,GAAC,IAAI,GAAC,KAAK,CAAC,MAAM,GAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAC,CAAC,GAChH,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,GAAC,SAAS,GAAC,UAAU,GAAC,SAAS,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,OAAO,GAAC,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAC,CAAC,CAiO9I;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,mCAvBW,MAAM,GAAC,IAAI,GAiBT,MAAM,GAAC,IAAI,CAgQvB;;CACD;8BA95C6B,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/lib/processors/loader.d.mts.map b/types/src/lib/processors/loader.d.mts.map
index 7c73d7f1a..82614ac2d 100644
--- a/types/src/lib/processors/loader.d.mts.map
+++ b/types/src/lib/processors/loader.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"loader.d.mts","sourceRoot":"","sources":["../../../../src/lib/processors/loader.mjs"],"names":[],"mappings":"AA4DA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,sDAjBW,MAAM,6BAEd;IAAqC,MAAM,GAAnC,MAAM,GAAC,SAAS;IACI,YAAY;CAExC,GAAU,OAAO,CAmBnB;AAwCD;;;;;GAKG;AACH;;;;;;;;;;GAUG;AACH,4CALa,MAAM,CAOlB;AAED;IACC,gCAAmC;IAEnC;;;;OAIG;IACH,sBAHW,MAAM,EAKhB;IAED;;;;;;;;OAQG;IACH,4BAPW,MAAM,eACN,MAAM,aACN,MAAM,cACN,MAAM,GAAC,IAAI,GACT,OAAO,CAAC,MAAM,CAAC,CAuM3B;IAyED;;;;;;;;;;;;;;OAcG;IACH,0BAbW,MAAM,YAEd;QAA0B,UAAU;QACX,YAAY;QACZ,QAAQ;QACD,UAAU;QACM,MAAM;QAE5B,iBAAiB;QAClB,OAAO;KAChC,GAAU,OAAO,CAAC,MAAM,CAAC,CAqJ3B;IA8PD;;;;;OAKG;IACH,8BAJW,MAAM,GACJ,MAAM,CA+ClB;;CACD;8BAh3B6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"loader.d.mts","sourceRoot":"","sources":["../../../../src/lib/processors/loader.mjs"],"names":[],"mappings":"AA4DA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,sDAjBW,MAAM,6BAEd;IAAqC,MAAM,GAAnC,MAAM,GAAC,SAAS;IACI,YAAY;CAExC,GAAU,OAAO,CAmBnB;AAwCD;;;;;GAKG;AACH;;;;;;;;;;GAUG;AACH,4CALa,MAAM,CAOlB;AAED;IACC,gCAAmC;IAEnC;;;;OAIG;IACH,sBAHW,MAAM,EAKhB;IAED;;;;;;;;OAQG;IACH,4BAPW,MAAM,eACN,MAAM,aACN,MAAM,cACN,MAAM,GAAC,IAAI,GACT,OAAO,CAAC,MAAM,CAAC,CAwM3B;IAyED;;;;;;;;;;;;;;OAcG;IACH,0BAbW,MAAM,YAEd;QAA0B,UAAU;QACX,YAAY;QACZ,QAAQ;QACD,UAAU;QACM,MAAM;QAE5B,iBAAiB;QAClB,OAAO;KAChC,GAAU,OAAO,CAAC,MAAM,CAAC,CAqJ3B;IA8PD;;;;;OAKG;IACH,8BAJW,MAAM,GACJ,MAAM,CA+ClB;;CACD;8BAj3B6B,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/lib/processors/typescript.d.mts b/types/src/lib/processors/typescript.d.mts
index 598f414eb..5fe5f7700 100644
--- a/types/src/lib/processors/typescript.d.mts
+++ b/types/src/lib/processors/typescript.d.mts
@@ -4,7 +4,8 @@
  * @param {object} [options={}] - esbuild transform options
  * @param {string} [options.target] - ECMAScript target version (default: "es2020")
  * @param {string} [options.format] - Module format (default: "esm")
- * @param {boolean} [options.sourcemap] - Generate source maps (default: false)
+ * @param {boolean} [options.sourcemap] - Append an inline source map whose `sources` names the
+ *   absolute path of `filePath`, so the cached output maps back to the `.ts` source (default: false)
  * @returns {Promise<string>} Transformed JavaScript code
  * @throws {SlothletError} If transformation fails
  * @public
@@ -174,7 +175,13 @@ export function writeTransformedToCache(originalPath: string, code: string, inst
  * @param {boolean} [options.strict] - Enable strict type checking (default: true)
  * @param {boolean} [options.skipTypeCheck] - Skip type checking and only transform (default: false)
  * @param {string} [options.typeDefinitionPath] - Path to .d.ts file for type checking
+ * @param {boolean} [options.sourcemap] - Append an inline source map whose `sources` names the
+ *   absolute path of `filePath` (default: false)
+ * @param {object} [options.compilerOptions] - Extra compiler options in tsconfig.json form
+ *   (`{ noUnusedLocals: true, module: "commonjs" }`), applied over the options above. Relative
+ *   paths resolve against the current working directory.
  * @returns {Promise<{code: string, diagnostics: object[]}>} Transformed code and type diagnostics
+ * @throws {SlothletError} INVALID_CONFIG when `options.compilerOptions` holds an unknown option or an invalid value
  * @throws {SlothletError} If transformation fails
  * @public
  */
@@ -184,6 +191,8 @@ export function transformTypeScriptStrict(filePath: string, options?: {
     strict?: boolean | undefined;
     skipTypeCheck?: boolean | undefined;
     typeDefinitionPath?: string | undefined;
+    sourcemap?: boolean | undefined;
+    compilerOptions?: object | undefined;
 }): Promise<{
     code: string;
     diagnostics: object[];
diff --git a/types/src/lib/processors/typescript.d.mts.map b/types/src/lib/processors/typescript.d.mts.map
index e2bd8bf37..0b27ef3d5 100644
--- a/types/src/lib/processors/typescript.d.mts.map
+++ b/types/src/lib/processors/typescript.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"typescript.d.mts","sourceRoot":"","sources":["../../../../src/lib/processors/typescript.mjs"],"names":[],"mappings":"AAyEA;;;;;;;;;;GAUG;AACH,8CATW,MAAM,YAEd;IAAyB,MAAM;IACN,MAAM;IACL,SAAS;CACnC,GAAU,OAAO,CAAC,MAAM,CAAC,CAiB3B;AAED;;;;;GAKG;AACH,oCAJW,MAAM,GACJ,MAAM,CAQlB;AA6HD;;;;;;;;;;;;;GAaG;AACH,2CAHa,OAAO,CAAC,IAAI,CAAC,CAyCzB;AAED;;;;;;;;GAQG;AACH,6CAHa,OAAO,CAAC,OAAO,CAAC,CAiB5B;AA+CD;;;;;;;;;;;GAWG;AACH,kDAJW,MAAM,GACJ;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CA4B3C;AA+CD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,6CAJW,MAAM,GACJ,UAAU,CA2EtB;AAmDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,gDATW,MAAM,cACN,MAAM,YACN,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,MAAM,GAInE,MAAM,CA4ClB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,sDARW,MAAM,QACN,MAAM,cACN,MAAM,cACN,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GAEnC,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAC,CAAC,CAwBpD;AA4GD;;;;;;;;;;;;GAYG;AACH,oDAXW,MAAM,YAEd;IAAyB,MAAM;IACN,MAAM;IACL,MAAM;IACN,aAAa;IACd,kBAAkB;CAC3C,GAAU,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAA;CAAC,CAAC,CA6F1D;AAED;;;;;;GAMG;AACH,+CALW,MAAM,EAAE,MACR,MAAM,GACJ,MAAM,EAAE,CAapB"}
\ No newline at end of file
+{"version":3,"file":"typescript.d.mts","sourceRoot":"","sources":["../../../../src/lib/processors/typescript.mjs"],"names":[],"mappings":"AAyEA;;;;;;;;;;;GAWG;AACH,8CAVW,MAAM,YAEd;IAAyB,MAAM;IACN,MAAM;IACL,SAAS;CAEnC,GAAU,OAAO,CAAC,MAAM,CAAC,CAqB3B;AAED;;;;;GAKG;AACH,oCAJW,MAAM,GACJ,MAAM,CAQlB;AA6HD;;;;;;;;;;;;;GAaG;AACH,2CAHa,OAAO,CAAC,IAAI,CAAC,CAyCzB;AAED;;;;;;;;GAQG;AACH,6CAHa,OAAO,CAAC,OAAO,CAAC,CAiB5B;AA+CD;;;;;;;;;;;GAWG;AACH,kDAJW,MAAM,GACJ;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CA4B3C;AA+CD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,6CAJW,MAAM,GACJ,UAAU,CA2EtB;AAmDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,gDATW,MAAM,cACN,MAAM,YACN,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,MAAM,GAInE,MAAM,CA4ClB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,sDARW,MAAM,QACN,MAAM,cACN,MAAM,cACN,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GAEnC,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAC,CAAC,CAwBpD;AA4GD;;;;;;;;;;;;;;;;;;GAkBG;AACH,oDAjBW,MAAM,YAEd;IAAyB,MAAM;IACN,MAAM;IACL,MAAM;IACN,aAAa;IACd,kBAAkB;IACjB,SAAS;IAEV,eAAe;CAGxC,GAAU,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAA;CAAC,CAAC,CAgG1D;AAiDD;;;;;;GAMG;AACH,+CALW,MAAM,EAAE,MACR,MAAM,GACJ,MAAM,EAAE,CAapB"}
\ No newline at end of file

From 5620bfd21ccc80d60b83b98709a9137d710f0c9a Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Mon, 28 Sep 2026 14:08:30 -0700
Subject: [PATCH 18/49] feat(permissions): add slothlet.lockCaller.caller to
 pin the calling module onto a callback

lockCaller pins the leaf that calls it, so a service that accepts a callback on
behalf of whoever called it (a scheduler's every(), a registry) could only pin
itself and the callback ran as the service. self.slothlet.lockCaller.caller(fn)
pins the current leaf's caller instead: the identity metadata.caller() reports,
resolved through a shared Metadata#callerWrapper() so the two cannot diverge.

Acting as your caller is a privilege, so slothlet.lockCaller.caller is its own
api path with a built-in deny for every module; the host grants it, e.g.
{ caller: "scheduler.**", target: "slothlet.lockCaller.caller", effect: "allow" }.
The exact-path built-in allow on slothlet.lockCaller does not cover it. The
check runs on the route and again inside the function, since the function is
handed out as a plain value.

When the leaf was called from outside any module, the callback is pinned to no
module caller and runs as the host (metadata.caller() is null inside it). Both
context managers gain an asHost flag on runInContext: async clears both
wrappers and marks the execution store trusted-root; live clears the shared
fields and tracks the held call as suspended so a concurrently resumed module
call is resolved from its stack rather than trusting the null field.

Otherwise it matches lockCaller: captured at call time, errors propagate
unchanged, this/args forwarded, _slothletOriginal set, and instanceID and
contextManager resolved live across reload(). lockCaller itself is unchanged.

Fixes #477
---
 .../client/app.mjs                            | 174 ++++++++
 .../roles/registry.mjs                        |  51 +++
 .../scheduler/service.mjs                     | 126 ++++++
 .../target/probe.mjs                          |  55 +++
 docs/HOOKS.md                                 |  27 +-
 docs/PERMISSIONS.md                           |  12 +
 src/lib/builders/api_builder.mjs              |  76 ++++
 src/lib/handlers/context-async.mjs            |  17 +-
 src/lib/handlers/context-live.mjs             |  25 +-
 src/lib/handlers/metadata.mjs                 |  20 +-
 src/lib/handlers/permission-manager.mjs       |   8 +
 src/slothlet.mjs                              |   2 +-
 tests/vitests/setup/vitest-helper.mjs         |   1 +
 .../lock-caller-caller.test.vitest.mjs        | 399 ++++++++++++++++++
 types/src/lib/builders/api_builder.d.mts.map  |   2 +-
 types/src/lib/handlers/context-async.d.mts    |   6 +-
 .../src/lib/handlers/context-async.d.mts.map  |   2 +-
 types/src/lib/handlers/context-live.d.mts     |   6 +-
 types/src/lib/handlers/context-live.d.mts.map |   2 +-
 types/src/lib/handlers/metadata.d.mts         |  12 +
 types/src/lib/handlers/metadata.d.mts.map     |   2 +-
 .../lib/handlers/permission-manager.d.mts.map |   2 +-
 22 files changed, 1010 insertions(+), 17 deletions(-)
 create mode 100644 api_tests/api_test_lock_caller_caller/client/app.mjs
 create mode 100644 api_tests/api_test_lock_caller_caller/roles/registry.mjs
 create mode 100644 api_tests/api_test_lock_caller_caller/scheduler/service.mjs
 create mode 100644 api_tests/api_test_lock_caller_caller/target/probe.mjs
 create mode 100644 tests/vitests/suites/permissions/lock-caller-caller.test.vitest.mjs

diff --git a/api_tests/api_test_lock_caller_caller/client/app.mjs b/api_tests/api_test_lock_caller_caller/client/app.mjs
new file mode 100644
index 000000000..12473315f
--- /dev/null
+++ b/api_tests/api_test_lock_caller_caller/client/app.mjs
@@ -0,0 +1,174 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_lock_caller_caller/client/app.mjs
+ *	@Date: 2026-09-28 00:00:00 -07:00 (1790578800)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 00:00:00 -07:00 (1790578800)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Client module for the `lockCaller.caller()` tests (#477). Schedules jobs on the
+ * scheduler service; each job calls a probe target, so the target sees whichever identity the job
+ * runs as.
+ *
+ * @module api_tests/api_test_lock_caller_caller/client/app
+ */
+
+import { self } from "@cldmv/slothlet/runtime";
+
+/**
+ * Schedule a job that reports who the target sees calling it, pinned to this client.
+ * @returns {number} Stored job count.
+ * @public
+ * @example
+ * api.client.app.scheduleWhoami();
+ */
+export function scheduleWhoami() {
+	return self.scheduler.service.every(() => self.target.probe.whoami());
+}
+
+/**
+ * Same job, but the scheduler pins itself (`lockCaller`), for comparison.
+ * @returns {number} Stored job count.
+ * @public
+ * @example
+ * api.client.app.scheduleWhoamiAsService();
+ */
+export function scheduleWhoamiAsService() {
+	return self.scheduler.service.everyAsSelf(() => self.target.probe.whoami());
+}
+
+/**
+ * Schedule a job that calls the client-only guarded route.
+ * @returns {number} Stored job count.
+ * @public
+ * @example
+ * api.client.app.scheduleGuarded();
+ */
+export function scheduleGuarded() {
+	return self.scheduler.service.every(() => self.target.probe.guarded());
+}
+
+/**
+ * Schedule the guarded job with the scheduler pinning itself, for comparison.
+ * @returns {number} Stored job count.
+ * @public
+ * @example
+ * api.client.app.scheduleGuardedAsService();
+ */
+export function scheduleGuardedAsService() {
+	return self.scheduler.service.everyAsSelf(() => self.target.probe.guarded());
+}
+
+/**
+ * Schedule an async job that awaits a timer before reporting who the target sees.
+ * @returns {number} Stored job count.
+ * @public
+ * @example
+ * api.client.app.scheduleAsyncWhoami();
+ */
+export function scheduleAsyncWhoami() {
+	return self.scheduler.service.every(async () => {
+		await new Promise((resolve) => setTimeout(resolve, 0));
+		return self.target.probe.whoami();
+	});
+}
+
+/**
+ * Schedule a job that throws a TypeError.
+ * @returns {number} Stored job count.
+ * @public
+ * @example
+ * api.client.app.scheduleThrow();
+ */
+export function scheduleThrow() {
+	return self.scheduler.service.every(() => {
+		throw new TypeError("job-boom");
+	});
+}
+
+/**
+ * Schedule a job that returns its own `this` and arguments.
+ * @returns {number} Stored job count.
+ * @public
+ * @example
+ * api.client.app.scheduleThisAndArgs();
+ */
+export function scheduleThisAndArgs() {
+	return self.scheduler.service.every(function thisAndArgs(...args) {
+		return { self: this, args };
+	});
+}
+
+/**
+ * Schedule a job that calls the principal-gated route for the project it is fired with.
+ * @returns {number} Stored job count.
+ * @public
+ * @example
+ * api.client.app.scheduleFiles();
+ */
+export function scheduleFiles() {
+	return self.scheduler.service.every((projectId) => self.target.probe.files(projectId));
+}
+
+/**
+ * Call the principal-gated route directly as this client.
+ * @param {string} projectId - Project id.
+ * @returns {{projectId: string}} The project marker.
+ * @public
+ * @example
+ * api.client.app.readFiles("p1");
+ */
+export function readFiles(projectId) {
+	return self.target.probe.files(projectId);
+}
+
+/**
+ * The principal-gated job with the scheduler pinning itself, for comparison.
+ * @returns {number} Stored job count.
+ * @public
+ * @example
+ * api.client.app.scheduleFilesAsService();
+ */
+export function scheduleFilesAsService() {
+	return self.scheduler.service.everyAsSelf((projectId) => self.target.probe.files(projectId));
+}
+
+/**
+ * Ask the scheduler for a pinned wrapper and hand back both it and the original callback.
+ * @returns {{wrapper: Function, original: Function}} The wrapper and the callback it pins.
+ * @public
+ * @example
+ * api.client.app.pinThroughScheduler();
+ */
+export function pinThroughScheduler() {
+	const original = () => "original";
+	return { wrapper: self.scheduler.service.pin(original), original };
+}
+
+/**
+ * Call `lockCaller.caller` directly from this (ungranted) client.
+ * @returns {Function} The pinned wrapper (only when granted).
+ * @public
+ * @example
+ * api.client.app.pinDirectly();
+ */
+export function pinDirectly() {
+	return self.slothlet.lockCaller.caller(() => 0);
+}
+
+/**
+ * Fire the scheduler from inside this client, so the client is the ambient identity.
+ * @returns {Promise<Array<*>>} The jobs' results.
+ * @public
+ * @example
+ * await api.client.app.fireFromClient();
+ */
+export function fireFromClient() {
+	return self.scheduler.service.fire();
+}
diff --git a/api_tests/api_test_lock_caller_caller/roles/registry.mjs b/api_tests/api_test_lock_caller_caller/roles/registry.mjs
new file mode 100644
index 000000000..8a075a906
--- /dev/null
+++ b/api_tests/api_test_lock_caller_caller/roles/registry.mjs
@@ -0,0 +1,51 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_lock_caller_caller/roles/registry.mjs
+ *	@Date: 2026-09-28 00:00:00 -07:00 (1790578800)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 00:00:00 -07:00 (1790578800)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Owner of the "roles" principal (#459) for the `lockCaller.caller()` tests (#477).
+ * Grants are per user, per project.
+ *
+ * @module api_tests/api_test_lock_caller_caller/roles/registry
+ */
+
+import { self } from "@cldmv/slothlet/runtime";
+
+const grants = new Map();
+
+/**
+ * Register the "roles" principal, keyed by `ctx.user`.
+ * @returns {void}
+ * @public
+ * @example
+ * api.roles.registry.setup();
+ */
+export function setup() {
+	self.slothlet.permissions.principal.register("roles", {
+		key: (ctx) => ctx.user,
+		resolve: async (user) => ({ projects: { ...(grants.get(user) ?? {}) } })
+	});
+}
+
+/**
+ * Grant a user permissions on a project.
+ * @param {string} user - User id.
+ * @param {string} projectId - Project id.
+ * @param {string[]} perms - Permissions.
+ * @returns {void}
+ * @public
+ * @example
+ * api.roles.registry.grant("u1", "p1", ["read"]);
+ */
+export function grant(user, projectId, perms) {
+	grants.set(user, { ...(grants.get(user) ?? {}), [projectId]: perms });
+}
diff --git a/api_tests/api_test_lock_caller_caller/scheduler/service.mjs b/api_tests/api_test_lock_caller_caller/scheduler/service.mjs
new file mode 100644
index 000000000..8faa6f7d1
--- /dev/null
+++ b/api_tests/api_test_lock_caller_caller/scheduler/service.mjs
@@ -0,0 +1,126 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_lock_caller_caller/scheduler/service.mjs
+ *	@Date: 2026-09-28 00:00:00 -07:00 (1790578800)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 00:00:00 -07:00 (1790578800)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Scheduler-style service for the `lockCaller.caller()` tests (#477).
+ *
+ * @description
+ * Accepts callbacks on behalf of whoever calls it and runs them later from {@link fire}. `every`
+ * pins the CALLER of `every` onto the job (`self.slothlet.lockCaller.caller`); `everyAsSelf` pins the
+ * service itself (`self.slothlet.lockCaller`) for comparison.
+ *
+ * @module api_tests/api_test_lock_caller_caller/scheduler/service
+ */
+
+import { self } from "@cldmv/slothlet/runtime";
+
+let jobs = [];
+
+/**
+ * Store a job pinned to the identity of whoever called this leaf.
+ * @param {Function} job - Callback to run on {@link fire}.
+ * @returns {number} The number of stored jobs.
+ * @public
+ * @example
+ * api.scheduler.service.every(() => 1);
+ */
+export function every(job) {
+	jobs.push(self.slothlet.lockCaller.caller(job));
+	return jobs.length;
+}
+
+/**
+ * Store a job pinned to this service (plain `lockCaller`).
+ * @param {Function} job - Callback to run on {@link fire}.
+ * @returns {number} The number of stored jobs.
+ * @public
+ * @example
+ * api.scheduler.service.everyAsSelf(() => 1);
+ */
+export function everyAsSelf(job) {
+	jobs.push(self.slothlet.lockCaller(job));
+	return jobs.length;
+}
+
+/**
+ * Return the `lockCaller.caller()` wrapper for `job` without storing it.
+ * @param {Function} job - Callback to pin.
+ * @returns {Function} The pinned wrapper.
+ * @public
+ * @example
+ * api.scheduler.service.pin(() => 1);
+ */
+export function pin(job) {
+	return self.slothlet.lockCaller.caller(job);
+}
+
+/**
+ * Run every stored job, sequentially, forwarding `args`.
+ * @param {...*} args - Arguments forwarded to each job.
+ * @returns {Promise<Array<*>>} Each job's (awaited) result.
+ * @public
+ * @example
+ * await api.scheduler.service.fire();
+ */
+export async function fire(...args) {
+	const results = [];
+	for (const job of jobs) results.push(await job(...args));
+	return results;
+}
+
+/**
+ * Run every stored job concurrently, forwarding `args`.
+ * @param {...*} args - Arguments forwarded to each job.
+ * @returns {Promise<Array<*>>} Each job's result.
+ * @public
+ * @example
+ * await api.scheduler.service.fireAll();
+ */
+export function fireAll(...args) {
+	return Promise.all(jobs.map((job) => job(...args)));
+}
+
+/**
+ * Run every stored job synchronously with an explicit `this`, returning the raw results.
+ * @param {*} thisArg - `this` binding for each job.
+ * @param {...*} args - Arguments forwarded to each job.
+ * @returns {Array<*>} Each job's result.
+ * @public
+ * @example
+ * api.scheduler.service.fireWith({ tag: 1 });
+ */
+export function fireWith(thisArg, ...args) {
+	return jobs.map((job) => job.apply(thisArg, args));
+}
+
+/**
+ * The raw stored job wrappers (for metadata inspection).
+ * @returns {Function[]} The stored wrappers.
+ * @public
+ * @example
+ * api.scheduler.service.list();
+ */
+export function list() {
+	return [...jobs];
+}
+
+/**
+ * Drop every stored job.
+ * @returns {void}
+ * @public
+ * @example
+ * api.scheduler.service.clear();
+ */
+export function clear() {
+	jobs = [];
+}
diff --git a/api_tests/api_test_lock_caller_caller/target/probe.mjs b/api_tests/api_test_lock_caller_caller/target/probe.mjs
new file mode 100644
index 000000000..e9789449e
--- /dev/null
+++ b/api_tests/api_test_lock_caller_caller/target/probe.mjs
@@ -0,0 +1,55 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_lock_caller_caller/target/probe.mjs
+ *	@Date: 2026-09-28 00:00:00 -07:00 (1790578800)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 00:00:00 -07:00 (1790578800)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Probe targets for the `lockCaller.caller()` tests (#477): report who called them, and
+ * permission-gated routes keyed to the caller.
+ *
+ * @module api_tests/api_test_lock_caller_caller/target/probe
+ */
+
+import { self } from "@cldmv/slothlet/runtime";
+
+/**
+ * Report the api path of the module that called this leaf.
+ * @returns {string|null} The caller's api path, or null when called from the host.
+ * @public
+ * @example
+ * api.target.probe.whoami(); // null (host)
+ */
+export function whoami() {
+	return self.slothlet.metadata.caller()?.apiPath ?? null;
+}
+
+/**
+ * Permission-gated route: rules allow it for the client and deny it for the scheduler.
+ * @returns {string} A constant marker.
+ * @public
+ * @example
+ * api.target.probe.guarded();
+ */
+export function guarded() {
+	return "guarded-ok";
+}
+
+/**
+ * Principal-gated route (#459): allowed for the client when its roles grant "read" on `projectId`.
+ * @param {string} projectId - Project id.
+ * @returns {{projectId: string}} The project marker.
+ * @public
+ * @example
+ * api.target.probe.files("p1");
+ */
+export function files(projectId) {
+	return { projectId };
+}
diff --git a/docs/HOOKS.md b/docs/HOOKS.md
index 83f2b4e51..c3683f5db 100644
--- a/docs/HOOKS.md
+++ b/docs/HOOKS.md
@@ -746,6 +746,31 @@ server.addHook(
 - Called with no active context (no module wrapper to capture), `lockCaller` is a no-op passthrough — it is meaningful only when called from inside a module.
 - **Runtime mode matters for async callbacks.** In **async** runtime mode the pinned identity propagates through `AsyncLocalStorage`, so `self.*` calls after an `await` still resolve to the registering module. In **live** runtime mode the caller is pinned only for the **synchronous** portion of the callback — the live context manager restores the previous wrapper as soon as the callback returns its promise. Once the synchronous `runInContext()` stack has unwound there may be **no slothlet caller at all**, so an `async` callback that `await`s before calling `self.*` resumes with whatever context is then active — typically none, and an identity probe sees `unknown`. Live mode keeps no per-async-task context; use **async** runtime mode for `async` hooks (like the example above) that must keep locked identity past their first `await`. `bind` is **not** an escape hatch here — it has the same live-mode limitation (see below); async runtime mode is the only fix.
 
+### `self.slothlet.lockCaller.caller(fn)` — pin the leaf's caller
+
+`lockCaller` pins the leaf that calls it. A service that accepts a callback on behalf of whoever called it — a scheduler's `every(interval, fn)`, a registry — can therefore only pin **itself**, and the callback runs as the service rather than the module that handed it over. `lockCaller.caller` pins the current leaf's **caller** instead: exactly the identity `self.slothlet.metadata.caller()` reports at that moment.
+
+```javascript
+// scheduler/service.mjs
+import { self } from "@cldmv/slothlet/runtime";
+
+export function every(ms, job) {
+	// Runs each job as the module that called every(), not as the scheduler.
+	setInterval(self.slothlet.lockCaller.caller(job), ms);
+}
+```
+
+```javascript
+// client/app.mjs — the job runs as client.app.*, so rules keyed to the client apply inside it.
+self.scheduler.service.every(60_000, () => self.reports.refresh());
+```
+
+- **It is a privilege.** Acting as your caller is not something a module may do by default: `slothlet.lockCaller.caller` is its own api path, denied to every module by a built-in rule. The host grants it to the services that run callbacks on their callers' behalf — `{ caller: "scheduler.**", target: "slothlet.lockCaller.caller", effect: "allow" }`. See [Permissions](PERMISSIONS.md#other-slothlet-routes-are-gated-too). The check runs when the wrapper is created.
+- **No module caller → runs as the host.** When the leaf was itself called from outside any module (the host, a transport edge), the callback is pinned to "no module caller": it runs as the host, and `metadata.caller()` returns `null` inside it. This is a real pin, not a passthrough of `fn`, and it does not throw. Because a host-pinned callback carries the host's exemption from rules, grant `lockCaller.caller` only to modules trusted to act for any caller, the host included.
+- **Otherwise identical to `lockCaller`**: the identity is captured once, at call time, and cannot be changed afterwards; `this` and arguments are forwarded; errors thrown by `fn` propagate unchanged; the wrapper exposes `_slothletOriginal`; a callback held across `reload()` runs against the current instance.
+- **Principals compose.** Calls made inside the callback are enforced for the pinned identity, so rules keyed to the caller — including [`requires` principals](PERMISSIONS.md#principals) — resolve exactly as they would for a direct call from that caller.
+- **Runtime mode** carries the same caveat as `lockCaller`: in **async** runtime mode the pinned identity propagates through `AsyncLocalStorage` across every `await`. In **live** runtime mode there is one identity slot per instance, so while an `async` callback is parked at an `await` alongside other suspended calls (for example the service that fired it and is awaiting it), its resumed calls are attributed from the call stack and can resolve to an awaiting module frame instead of the pin. That fails closed — never to the host — but it is not the pin; use async runtime mode for `async` callbacks that must keep the pinned caller past an `await`.
+
 ### `self.slothlet.bind(fn)` — freeze the whole async context
 
 `bind` is a convenience re-export of Node's `AsyncResource.bind`. Unlike `lockCaller`, it freezes the **entire** async context captured at registration time — every `AsyncLocalStorage`, including slothlet's caller and request context:
@@ -758,7 +783,7 @@ Reach for `lockCaller` when you want the caller pinned but request-scoped contex
 
 Both utilities share the same live-mode limitation: `AsyncResource.bind` only meaningfully captures slothlet's caller/context in **async** runtime mode. In live mode the slothlet store is kept off the `AsyncLocalStorage`, so `bind` degrades to binding whatever other async context exists and does **not** preserve slothlet caller identity past an `await`. `bind` is therefore not a workaround for the live-mode `lockCaller` caveat above — if an `async` callback must keep slothlet identity across awaits, run the instance in **async** runtime mode.
 
-> `slothlet.lockCaller` and `slothlet.bind` are permission-gated routes like every other `slothlet.*` member — see [Permissions](PERMISSIONS.md#other-slothlet-routes-are-gated-too).
+> `slothlet.lockCaller`, `slothlet.lockCaller.caller`, and `slothlet.bind` are permission-gated routes like every other `slothlet.*` member — see [Permissions](PERMISSIONS.md#other-slothlet-routes-are-gated-too). `lockCaller.caller` is denied to modules by default.
 
 ---
 
diff --git a/docs/PERMISSIONS.md b/docs/PERMISSIONS.md
index e91cf2924..e578e342a 100644
--- a/docs/PERMISSIONS.md
+++ b/docs/PERMISSIONS.md
@@ -727,6 +727,18 @@ The entire `slothlet` namespace is wrapped by an internal route proxy, so every
 
 A more specific user rule can still deny them for a particular module if needed. The whole point of `lockCaller` is downstream of this: the callback it returns runs with the caller identity set to the **registering** module, so permission rules keyed to that module match instead of failing against whatever module's async context happened to be ambient when the callback fired.
 
+`slothlet.lockCaller.caller` is the exception: it is **denied by default**. It pins the current leaf's _caller_ onto a callback, so the callback acts as another module (or, when the leaf was called from the host, as the host) — a privilege, not a strengthening. The built-in allow on `slothlet.lockCaller` is an exact-path rule and does not cover it. The host grants it to the service modules that run callbacks on their callers' behalf; this holds under both `defaultPolicy: "allow"` and `"deny"`:
+
+```javascript
+// Built-in rule registered for every instance:
+{ caller: "**", target: "slothlet.lockCaller.caller", effect: "deny" }
+
+// Host grant — let the scheduler run jobs as the modules that scheduled them:
+{ caller: "scheduler.**", target: "slothlet.lockCaller.caller", effect: "allow" }
+```
+
+A module without the grant gets `PERMISSION_DENIED`. See [`lockCaller.caller`](HOOKS.md#selfslothletlockcallercallerfn--pin-the-leafs-caller).
+
 `slothlet.metadata.caller` and `slothlet.metadata.self` are **allowed by default** for the same reason. They reveal identity only — which module is calling this one, and which module this is — and grant no data or control access; they are what a module needs to [authorize or scope by its caller](./METADATA.md#selfslothletmetadatacaller) under a `defaultPolicy: "deny"` configuration:
 
 ```javascript
diff --git a/src/lib/builders/api_builder.mjs b/src/lib/builders/api_builder.mjs
index e5b857ede..46f8ade76 100644
--- a/src/lib/builders/api_builder.mjs
+++ b/src/lib/builders/api_builder.mjs
@@ -3517,6 +3517,82 @@ export class ApiBuilder extends ComponentBase {
 			};
 		}
 
+		/**
+		 * Freeze the current leaf's CALLER identity onto a callback (#477).
+		 * @param {Function} fn - The callback whose caller identity should be pinned.
+		 * @returns {Function} A wrapper that invokes `fn` as the current leaf's caller.
+		 * @throws {SlothletError} PERMISSION_DENIED when the calling module has not been granted
+		 *   `slothlet.lockCaller.caller`; INVALID_ARGUMENT when `fn` is not a function.
+		 * @public
+		 *
+		 * @description
+		 * `lockCaller` pins the leaf that calls it, so a service leaf accepting a callback on
+		 * behalf of whoever called it (a scheduler's `every(interval, fn)`, a registry) can only
+		 * pin itself — the callback would run as the service. `lockCaller.caller` pins the
+		 * identity `self.slothlet.metadata.caller()` reports at the moment of the call (the same
+		 * resolution, shared through the metadata handler), so the callback runs as the module
+		 * that called the service.
+		 *
+		 * Acting as your caller is a privilege: the api path `slothlet.lockCaller.caller` is
+		 * denied to every module by a built-in rule, and the host grants it, e.g.
+		 * `{ caller: "scheduler.**", target: "slothlet.lockCaller.caller", effect: "allow" }`.
+		 * The check runs when the wrapper is created, not when it is invoked.
+		 *
+		 * When the leaf itself was called from outside any module (the host, a transport edge),
+		 * the callback is pinned to **no module caller**: it runs as the host, and
+		 * `metadata.caller()` returns null inside it. This is a real pin, not a passthrough.
+		 *
+		 * Otherwise identical to `lockCaller`: captured once at call time and immutable after;
+		 * `this` and arguments are forwarded; errors from `fn` propagate unchanged; the returned
+		 * wrapper exposes `_slothletOriginal`; instanceID/contextManager are resolved live so a
+		 * callback held across `reload()` targets the current instance. Runtime-mode behaviour is
+		 * the same as `lockCaller`'s — in **async** mode the identity propagates through
+		 * `AsyncLocalStorage` across every `await`; in **live** mode there is one identity slot per
+		 * instance, so an async callback resumed while other calls are also suspended is attributed
+		 * from the call stack (failing closed, never to the host) — see docs/HOOKS.md.
+		 *
+		 * @example
+		 * // scheduler/service.mjs — runs each job as the module that scheduled it.
+		 * export function every(ms, job) {
+		 *   setInterval(self.slothlet.lockCaller.caller(job), ms);
+		 * }
+		 */
+		const lockCallerCaller = function slothlet_lockCaller_caller(fn) {
+			// Enforced here as well as on the route: the function is handed out as a plain value
+			// (`caller` is a meta-property of the route proxy), so a reference passed on to another
+			// module must still be refused for that module.
+			enforceInternalPermission("slothlet.lockCaller.caller");
+			if (typeof fn !== "function") {
+				throw new slothlet.SlothletError("INVALID_ARGUMENT", {
+					argument: "fn",
+					expected: "function",
+					received: typeof fn,
+					validationError: true
+				});
+			}
+			// The identity metadata.caller() reports right now — null when the current leaf was
+			// called from outside any module, which pins "no module caller" (run as the host).
+			const capturedCaller = slothlet.handlers.metadata.callerWrapper();
+			const locked = function slothlet_lockedCallerCaller(...args) {
+				// rawErrors: surface fn's own errors unchanged. instanceID/contextManager resolved live
+				// so a callback held across a reload() targets the current instance.
+				return capturedCaller
+					? slothlet.contextManager.runInContext(slothlet.instanceID, fn, this, args, capturedCaller, true)
+					: slothlet.contextManager.runInContext(slothlet.instanceID, fn, this, args, null, true, true);
+			};
+			// Parity with lockCaller / the EventEmitter patch metadata.
+			locked._slothletOriginal = fn;
+			return locked;
+		};
+		// `lockCaller.caller` is its own api path (`slothlet.lockCaller.caller`), so the permission
+		// system gates it independently of `lockCaller`, whose call behaviour is unchanged.
+		Object.defineProperty(namespace.lockCaller, "caller", {
+			value: lockCallerCaller,
+			enumerable: true,
+			writable: false,
+			configurable: false
+		});
+
 		return createInternalRouteProxy(namespace, "slothlet");
 	}
 
diff --git a/src/lib/handlers/context-async.mjs b/src/lib/handlers/context-async.mjs
index 9e879ff18..68fdd8f67 100644
--- a/src/lib/handlers/context-async.mjs
+++ b/src/lib/handlers/context-async.mjs
@@ -22,6 +22,7 @@ import { AsyncLocalStorage } from "@cldmv/slothlet/helpers/platform";
 import { SlothletError } from "@cldmv/slothlet/errors";
 import { runtime_isClassInstance, runtime_wrapClassInstance } from "@cldmv/slothlet/helpers/class-instance-wrapper";
 import { setApiContextChecker } from "@cldmv/slothlet/helpers/eventemitter-context";
+import { TRUSTED_ROOT } from "#handlers/trusted-root";
 
 /**
  * AsyncLocalStorage-based context manager for async runtime
@@ -84,10 +85,14 @@ export class AsyncContextManager {
 	 *   `fn` propagate unchanged instead of wrapping it as `CONTEXT_EXECUTION_FAILED`. Used
 	 *   for framework callbacks (`lockCaller`, pinned hooks) where the caller expects the
 	 *   original error type/code/status.
+	 * @param {boolean} [asHost=false] - When `true`, run `fn` with **no module caller**: both
+	 *   `currentWrapper` and `callerWrapper` are cleared for the execution, so `fn` runs as the host
+	 *   (`metadata.caller()` returns null inside it). `currentWrapper` is ignored. Used by
+	 *   `lockCaller.caller()` when the pinned caller is the host.
 	 * @returns {*} Result of function execution
 	 * @public
 	 */
-	runInContext(instanceID, fn, thisArg, args, currentWrapper, rawErrors = false) {
+	runInContext(instanceID, fn, thisArg, args, currentWrapper, rawErrors = false, asHost = false) {
 		// Check if we're already in an active ALS context
 		const activeStore = this.als.getStore();
 		let baseStore;
@@ -111,7 +116,15 @@ export class AsyncContextManager {
 
 		// Create a new store with currentWrapper for this execution
 		const executionStore = { ...baseStore };
-		if (currentWrapper) {
+		if (asHost) {
+			// Pinned to "no module caller": the flow runs as the host, not as whichever module is ambient.
+			executionStore.callerWrapper = null;
+			executionStore.currentWrapper = null;
+			// Running as the host means enforcement must see a host-initiated flow. The marker is
+			// non-enumerable (never spread onto a module's execution store), so apply it explicitly — the
+			// same marker the instance's base store carries for a genuinely host-initiated call.
+			Object.defineProperty(executionStore, TRUSTED_ROOT, { value: true, configurable: true });
+		} else if (currentWrapper) {
 			executionStore.callerWrapper = baseStore.currentWrapper;
 			executionStore.currentWrapper = currentWrapper;
 		}
diff --git a/src/lib/handlers/context-live.mjs b/src/lib/handlers/context-live.mjs
index 8fa0e6165..a9bbf558f 100644
--- a/src/lib/handlers/context-live.mjs
+++ b/src/lib/handlers/context-live.mjs
@@ -207,8 +207,9 @@ export class LiveContextManager {
 	 * @private
 	 */
 	#resolveSuspendedFromStack(suspended) {
+		// Host-pinned calls (`lockCaller.caller()` with no module caller) are tracked with no filePath:
+		// they have no module frame to match. When only those are suspended, no candidate can match.
 		const candidates = [...suspended].filter((entry) => entry.filePath);
-		/* v8 ignore next — entries always carry a filePath; guards a partial mock. */
 		if (!candidates.length) return null;
 
 		// Raise the frame budget for this capture only: the caller's frame sits below slothlet's own
@@ -367,10 +368,14 @@ export class LiveContextManager {
 	 *   `fn` propagate unchanged instead of wrapping it as `CONTEXT_EXECUTION_FAILED`. Used
 	 *   for framework callbacks (`lockCaller`, pinned hooks) where the caller expects the
 	 *   original error type/code/status.
+	 * @param {boolean} [asHost=false] - When `true`, run `fn` with **no module caller**: both
+	 *   `currentWrapper` and `callerWrapper` are cleared for the execution, so `fn` runs as the host
+	 *   (`metadata.caller()` returns null inside it). `currentWrapper` is ignored. Used by
+	 *   `lockCaller.caller()` when the pinned caller is the host.
 	 * @returns {*} Result of function execution
 	 * @public
 	 */
-	runInContext(instanceID, fn, thisArg, args, currentWrapper, rawErrors = false) {
+	runInContext(instanceID, fn, thisArg, args, currentWrapper, rawErrors = false, asHost = false) {
 		// CHILD INSTANCE APPROACH: Check if current is this instance OR a child of this instance
 		const currentID = this.currentInstanceID;
 		const isAlreadyInContext = this.#flowBelongsToInstance(currentID, instanceID);
@@ -392,6 +397,11 @@ export class LiveContextManager {
 		const previousCallerWrapper = store.callerWrapper;
 
 		this.currentInstanceID = targetInstanceID;
+		if (asHost) {
+			// Pinned to "no module caller": the call runs as the host, not as whichever module is ambient.
+			store.callerWrapper = null;
+			store.currentWrapper = null;
+		}
 		// currentWrapper is optional; false branch is covered directly in context-live-branches tests
 		// but v8 hit-counter overflows to -255 in the parallel matrix, appearing uncovered.
 		/* v8 ignore next */
@@ -429,7 +439,9 @@ export class LiveContextManager {
 			// thenable and hand back a plain promise in its place. Those reads carry their own
 			// caller snapshot taken when the proxy was created, so they stay attributed anyway.
 			if (result instanceof Promise) {
-				/* v8 ignore next — filePath/apiPath are set on every live wrapper; ?? guards a partial mock. */
+				// A host-pinned call (`asHost`) has no wrapper, so it is tracked with an empty api path and
+				// no filePath (see #resolveSuspendedFromStack).
+				/* v8 ignore next — a live wrapper always carries filePath/apiPath; the ?? on a present wrapper guards a partial mock. */
 				const apiPath = currentWrapper?.____slothletInternal?.apiPath ?? "";
 				const entry = {
 					currentWrapper,
@@ -444,8 +456,13 @@ export class LiveContextManager {
 				// identity to disambiguate later, so there is nothing to record. Every promise-returning call
 				// reaching here carries the wrapper being invoked, so the skip arm guards a caller-less entry
 				// this path is not handed.
+				//
+				// A call pinned to the host (`asHost`) is the exception: it deliberately holds the shared
+				// field at null for its whole async lifetime. Were it untracked, a single suspended module
+				// call resuming meanwhile would trust that null field and be treated as the host — failing
+				// open. Tracking it keeps the count honest, so that module is resolved from its stack instead.
 				/* v8 ignore next */
-				if (currentWrapper) this.#suspendedFor(store).add(entry);
+				if (currentWrapper || asHost) this.#suspendedFor(store).add(entry);
 				const settle = () => {
 					this.#suspendedFor(store).delete(entry);
 					restore();
diff --git a/src/lib/handlers/metadata.mjs b/src/lib/handlers/metadata.mjs
index a30e8278a..210f71f17 100644
--- a/src/lib/handlers/metadata.mjs
+++ b/src/lib/handlers/metadata.mjs
@@ -855,8 +855,24 @@ export class Metadata extends ComponentBase {
 	 * @public
 	 */
 	caller() {
+		const callerWrapper = this.callerWrapper();
+		if (!callerWrapper) return null;
+		return this.getMetadata(callerWrapper);
+	}
+
+	/**
+	 * Resolve the wrapper of the API function that called the current function.
+	 *
+	 * The single resolution behind {@link Metadata#caller}: reads `callerWrapper` from the active
+	 * context-manager store. `self.slothlet.lockCaller.caller()` pins exactly this identity, so the
+	 * two can never disagree about who "the caller" is.
+	 *
+	 * @returns {object|null} The calling function's wrapper, or null when there is no module caller
+	 *   in context (the function was invoked from the host or outside the API).
+	 * @public
+	 */
+	callerWrapper() {
 		const ctx = this.slothlet.contextManager?.tryGetContext();
-		if (!ctx || !ctx.callerWrapper) return null;
-		return this.getMetadata(ctx.callerWrapper);
+		return ctx?.callerWrapper ?? null;
 	}
 }
diff --git a/src/lib/handlers/permission-manager.mjs b/src/lib/handlers/permission-manager.mjs
index 2033d4d55..c75d292f4 100644
--- a/src/lib/handlers/permission-manager.mjs
+++ b/src/lib/handlers/permission-manager.mjs
@@ -386,6 +386,14 @@ export class PermissionManager extends ComponentBase {
 		this.addRule({ caller: "**", target: "slothlet.lockCaller", effect: "allow" }, "__builtin__");
 		this.addRule({ caller: "**", target: "slothlet.bind", effect: "allow" }, "__builtin__");
 
+		// Built-in deny rule (#477): `slothlet.lockCaller.caller` pins the current leaf's CALLER onto
+		// a callback, so the callback acts as another module — a privilege, unlike `lockCaller`, which
+		// only pins the module itself. Host-only by default; the host grants it to the service modules
+		// that run callbacks on their callers' behalf (e.g. `{ caller: "scheduler.**", target:
+		// "slothlet.lockCaller.caller", effect: "allow" }`). The exact-path allow on `slothlet.lockCaller`
+		// above does not match this deeper path.
+		this.addRule({ caller: "**", target: "slothlet.lockCaller.caller", effect: "deny" }, "__builtin__");
+
 		// Built-in allow rules (#468): `slothlet.metadata.caller` / `slothlet.metadata.self` reveal
 		// identity only — who is calling this module, and which module this is — which is what a module
 		// needs to enforce its own policy (e.g. scoping records by caller). They grant no data or
diff --git a/src/slothlet.mjs b/src/slothlet.mjs
index 83e53f0b6..97c824b60 100644
--- a/src/slothlet.mjs
+++ b/src/slothlet.mjs
@@ -1717,7 +1717,7 @@ export default slothlet;
  * @property {Function} slothlet.versioning.unregister - Unregister a specific version from a logical API path. Removes the versioned namespace (`vX.path`) and updates or tears down the dispatcher. If the logical path/version is not registered, this resolves without removing anything. %%sig: (logicalPath: string, versionTag: string): Promise.<boolean>%% %%example: // ESM usage via slothlet API|import slothlet from "@cldmv/slothlet";|const api = await slothlet({ base: './api', versionDispatcher: "version" });|await api.slothlet.api.add('auth', './api/v1', {}, { version: 'v1' });|await api.slothlet.api.add('auth', './api/v2', {}, { version: 'v2' });|const removed = await api.slothlet.versioning.unregister('auth', 'v2'); // true%%
  * @property {Function} slothlet.versioning.getVersionMetadata - Retrieve the VersionManager-only metadata stored at registration time via `versionConfig.metadata`. Returns `undefined` if the path or version is not registered, or if versioning has not yet been used. %%sig: (logicalPath: string, versionTag: string): object|undefined%% %%example: // ESM usage via slothlet API|import slothlet from "@cldmv/slothlet";|const api = await slothlet({ base: './api', versionDispatcher: "version" });|await api.slothlet.api.add('auth', './api/v1', {}, { version: 'v1', metadata: { stable: true } });|const meta = api.slothlet.versioning.getVersionMetadata('auth', 'v1'); // { stable: true, version: 'v1', logicalPath: 'auth' }%%
  * @property {Function} slothlet.versioning.setVersionMetadata - Patch (merge) the VersionManager-only metadata for a registered version at runtime. The injected `version` and `logicalPath` keys always win over supplied patch fields. Throws `VERSION_NOT_FOUND` if the path or version is not registered. %%sig: (logicalPath: string, versionTag: string, patch: object): void%% %%example: // ESM usage via slothlet API|import slothlet from "@cldmv/slothlet";|const api = await slothlet({ base: './api', versionDispatcher: "version" });|await api.slothlet.api.add('auth', './api/v1', {}, { version: 'v1' });|api.slothlet.versioning.setVersionMetadata('auth', 'v1', { stable: true });%%
- * @property {Function} slothlet.lockCaller - Freeze the registering module's caller identity onto a callback. The returned wrapper overrides only the caller identity when invoked; request-scoped context stays live. In **async** runtime mode the pinned identity propagates through `AsyncLocalStorage` for the callback's full async lifetime. In **live** runtime mode identity is pinned only for the synchronous portion — once `fn` returns its promise the live context is restored, so an async callback that `await`s before calling `self.*` resumes with no slothlet caller at all (an identity check sees `unknown`); use async runtime mode for async hooks (e.g. Fastify `addHook`) that must keep identity past the first `await`. %%sig: (fn: function): function%% %%example: // Inside a module's init()|server.addHook("onRequest", self.slothlet.lockCaller(handler));%%
+ * @property {Function} slothlet.lockCaller - Freeze the registering module's caller identity onto a callback. The returned wrapper overrides only the caller identity when invoked; request-scoped context stays live. In **async** runtime mode the pinned identity propagates through `AsyncLocalStorage` for the callback's full async lifetime. In **live** runtime mode identity is pinned only for the synchronous portion — once `fn` returns its promise the live context is restored, so an async callback that `await`s before calling `self.*` resumes with no slothlet caller at all (an identity check sees `unknown`); use async runtime mode for async hooks (e.g. Fastify `addHook`) that must keep identity past the first `await`. **`slothlet.lockCaller.caller(fn)`** (a property of this function, same signature) pins the current leaf's **caller** instead — the identity `slothlet.metadata.caller()` reports — so a service that runs callbacks on behalf of whoever called it (a scheduler, a registry) runs each one as that caller rather than as itself. It is denied to modules by a built-in rule on `slothlet.lockCaller.caller`; the host grants it (e.g. `{ caller: "scheduler.**", target: "slothlet.lockCaller.caller", effect: "allow" }`). When the leaf was called from outside any module the callback is pinned to no module caller and runs as the host (`metadata.caller()` returns null inside it). Otherwise it behaves like `lockCaller`, including the runtime-mode caveat. %%sig: (fn: function): function%% %%example: // Inside a module's init()|server.addHook("onRequest", self.slothlet.lockCaller(handler));%% %%example: // Inside a scheduler leaf (host-granted `slothlet.lockCaller.caller`)|export function every(ms, job) {|  setInterval(self.slothlet.lockCaller.caller(job), ms);|}%%
  * @property {Function} slothlet.bind - Freeze the entire async context onto a callback at registration time (convenience re-export of `AsyncResource.bind`). Unlike `lockCaller`, which overrides only caller identity and leaves request-scoped context live, `bind` freezes every `AsyncLocalStorage`, including slothlet's caller and context. Meaningful in async runtime mode; degrades to non-slothlet ALS context in live mode. %%sig: (fn: function): function%% %%example: // Inside a module's init()|server.addHook("onRequest", self.slothlet.bind(handler));%%
  * @property {object} [slothlet.reference] - The `reference` object from config, merged onto the root API and accessible here.
  * @property {Function} slothlet.reload - Reload the entire instance (re-scans the directory and recreates all module references). Accepts `{ keepInstanceID: boolean }`. %%sig: ([options]: Object): Promise.<void>%% %%example: // ESM usage via slothlet API|import slothlet from "@cldmv/slothlet";|const api = await slothlet({ base: './api' });|await api.slothlet.reload(); // full reload%% %%example: // ESM usage via slothlet API (inside async function)|async function example() {|  const { default: slothlet } = await import("@cldmv/slothlet");|  const api = await slothlet({ base: './api' });|  await api.slothlet.reload(); // full reload|}%% %%example: // CJS usage via slothlet API (top-level)|let slothlet;|(async () => {|  ({ slothlet } = await import("@cldmv/slothlet"));|  const api = await slothlet({ base: './api' });|  await api.slothlet.reload(); // full reload|})();%% %%example: // CJS usage via slothlet API (inside async function)|const slothlet = require("@cldmv/slothlet");|const api = await slothlet({ base: './api' });|await api.slothlet.reload(); // full reload%%
diff --git a/tests/vitests/setup/vitest-helper.mjs b/tests/vitests/setup/vitest-helper.mjs
index bfc2d9bbc..a57da9566 100644
--- a/tests/vitests/setup/vitest-helper.mjs
+++ b/tests/vitests/setup/vitest-helper.mjs
@@ -67,6 +67,7 @@ export const TEST_DIRS = {
 	API_TEST_EVENTS: path.resolve(__dirname, `../../../${API_TEST_BASE}/api_test_events`),
 	API_TEST_CROSS_INSTANCE: path.resolve(__dirname, `../../../${API_TEST_BASE}/api_test_cross_instance`),
 	API_TEST_LOCK_CALLER: path.resolve(__dirname, `../../../${API_TEST_BASE}/api_test_lock_caller`),
+	API_TEST_LOCK_CALLER_CALLER: path.resolve(__dirname, `../../../${API_TEST_BASE}/api_test_lock_caller_caller`),
 	API_TEST_BROWSER: path.resolve(__dirname, `../../../${API_TEST_BASE}/api_test_browser`),
 	API_TEST_MULTI_ROOT_FN: path.resolve(__dirname, `../../../${API_TEST_BASE}/api_test_multi_root_fn`),
 	API_TEST_LIFECYCLE_HOOKS: path.resolve(__dirname, `../../../${API_TEST_BASE}/api_test_lifecycle_hooks`),
diff --git a/tests/vitests/suites/permissions/lock-caller-caller.test.vitest.mjs b/tests/vitests/suites/permissions/lock-caller-caller.test.vitest.mjs
new file mode 100644
index 000000000..9b224fb30
--- /dev/null
+++ b/tests/vitests/suites/permissions/lock-caller-caller.test.vitest.mjs
@@ -0,0 +1,399 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/permissions/lock-caller-caller.test.vitest.mjs
+ *	@Date: 2026-09-28 00:00:00 -07:00 (1790578800)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 00:00:00 -07:00 (1790578800)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview #477 — `self.slothlet.lockCaller.caller(fn)` pins the current leaf's CALLER onto a
+ * callback, so a service that runs callbacks on behalf of whoever called it (a scheduler, a registry)
+ * runs each one as that caller rather than as itself. Acting as your caller is a privilege: the path
+ * `slothlet.lockCaller.caller` is denied to every module by a built-in rule and granted by the host.
+ *
+ * Fixture: `scheduler.service` stores jobs (`every` pins the caller, `everyAsSelf` pins itself via
+ * plain `lockCaller`); `client.app` schedules jobs that call `target.probe.*`, which reports / gates on
+ * the identity it is called with; `roles.registry` owns a #459 principal.
+ *
+ * @module tests/vitests/suites/permissions/lock-caller-caller
+ */
+
+import { describe, it, expect, afterEach } from "vitest";
+import slothlet from "@cldmv/slothlet";
+import { getMatrixConfigs, TEST_DIRS, withSuppressedSlothletErrorOutput } from "../../setup/vitest-helper.mjs";
+
+const BASE = TEST_DIRS.API_TEST_LOCK_CALLER_CALLER;
+
+/** The host grant that lets the scheduler pin its callers. */
+const GRANT = { caller: "scheduler.**", target: "slothlet.lockCaller.caller", effect: "allow" };
+
+/** `target.probe.guarded` is for the client only. */
+const GUARD_RULES = [
+	{ caller: "scheduler.**", target: "target.probe.guarded", effect: "deny" },
+	{ caller: "client.**", target: "target.probe.guarded", effect: "allow" }
+];
+
+/** Under `defaultPolicy: "deny"`, the calls the fixture makes besides the one under test. */
+const DENY_POLICY_BASE_RULES = [
+	{ caller: "client.**", target: "scheduler.**", effect: "allow" },
+	{ caller: "client.**", target: "target.probe.whoami", effect: "allow" },
+	{ caller: "scheduler.**", target: "target.probe.whoami", effect: "allow" }
+];
+
+/** The job each client scheduling leaf pins — the identity a pinned job runs as. */
+const CLIENT_WHOAMI = "client.app.scheduleWhoami";
+
+/**
+ * Assert an invocation fails with `PERMISSION_DENIED`, whether it throws synchronously (eager) or
+ * rejects (lazy first call).
+ * @param {() => unknown} invoke - Zero-arg thunk.
+ * @returns {Promise<void>}
+ */
+const expectDenied = (invoke) =>
+	withSuppressedSlothletErrorOutput(async () => {
+		let error;
+		try {
+			await invoke();
+		} catch (err) {
+			error = err;
+		}
+		expect(error).toBeDefined();
+		expect(error.code).toBe("PERMISSION_DENIED");
+	});
+
+describe.each(getMatrixConfigs())("Permissions > lockCaller.caller (#477) > $name", ({ config }) => {
+	let api;
+
+	afterEach(async () => {
+		if (api) {
+			await api.scheduler.service.clear();
+			await api.shutdown();
+		}
+		api = null;
+	});
+
+	/**
+	 * Build the fixture api.
+	 * @param {object[]} rules - Permission rules.
+	 * @param {"allow"|"deny"} [defaultPolicy="allow"] - Default policy.
+	 * @returns {Promise<object>} The api.
+	 */
+	const build = async (rules, defaultPolicy = "allow") => {
+		api = await slothlet({ ...config, base: BASE, permissions: { defaultPolicy, rules } });
+		await api.scheduler.service.clear();
+		return api;
+	};
+
+	// ── Pinning the caller ──────────────────────────────────────────────────────
+
+	it("pins the leaf's caller, not the leaf: the target sees the client that scheduled the job", async () => {
+		await build([GRANT]);
+		await api.client.app.scheduleWhoami();
+		expect(await api.scheduler.service.fire()).toEqual([CLIENT_WHOAMI]);
+	});
+
+	it("plain lockCaller in the same leaf pins the service itself (the problem lockCaller.caller solves)", async () => {
+		await build([GRANT]);
+		await api.client.app.scheduleWhoamiAsService();
+		expect(await api.scheduler.service.fire()).toEqual(["scheduler.service.everyAsSelf"]);
+	});
+
+	it("a permission rule keyed to the caller applies inside the pinned job", async () => {
+		await build([GRANT, ...GUARD_RULES]);
+		await api.client.app.scheduleGuarded();
+		expect(await api.scheduler.service.fire()).toEqual(["guarded-ok"]);
+
+		// Pinned to the scheduler instead, the same job is denied.
+		await api.scheduler.service.clear();
+		await api.client.app.scheduleGuardedAsService();
+		await expectDenied(() => api.scheduler.service.fire());
+	});
+
+	it("the pinned identity holds regardless of which module fires the job", async () => {
+		await build([GRANT]);
+		await api.client.app.scheduleWhoami();
+		// Fired from inside the client (ambient client.app.fireFromClient → scheduler.service.fire).
+		expect(await api.client.app.fireFromClient()).toEqual([CLIENT_WHOAMI]);
+	});
+
+	// ── No module caller ────────────────────────────────────────────────────────
+
+	it("a leaf called from the host pins no module caller: the job runs as the host", async () => {
+		await build([GRANT]);
+		const job = () => ({ seen: api.target.probe.whoami(), caller: api.slothlet.metadata.caller() });
+		await api.scheduler.service.every(job);
+
+		// Fired from inside a module — a passthrough would run the job as scheduler.service.fire.
+		const [result] = await api.client.app.fireFromClient();
+		expect(await result.seen).toBeNull();
+		expect(result.caller).toBeNull();
+	});
+
+	it("the host pin is a real wrapper, not a passthrough of fn", async () => {
+		await build([GRANT]);
+		const job = () => 1;
+		await api.scheduler.service.every(job);
+		const [wrapper] = await api.scheduler.service.list();
+		expect(wrapper).not.toBe(job);
+		expect(wrapper._slothletOriginal).toBe(job);
+		expect(wrapper()).toBe(1);
+	});
+
+	it("host code calling lockCaller.caller directly gets a host pin and does not throw", async () => {
+		await build([]);
+		const job = () => api.target.probe.whoami();
+		const pinned = api.slothlet.lockCaller.caller(job);
+		expect(pinned).not.toBe(job);
+		expect(await pinned()).toBeNull();
+	});
+
+	it("an async host-pinned job keeps running as the host across an await", async () => {
+		await build([GRANT]);
+		await api.scheduler.service.every(async () => {
+			await new Promise((resolve) => setTimeout(resolve, 0));
+			return api.target.probe.whoami();
+		});
+		const [job] = await api.scheduler.service.list();
+		expect(await job()).toBeNull();
+	});
+
+	// Async runtime only — the same caveat lockCaller carries. The live runtime keeps one identity slot
+	// per instance, so while the job is parked at its await, the modules awaiting it (client → scheduler)
+	// are suspended too; the job's resumed call is then attributed from the stack, which names the
+	// awaiting scheduler frame. That fails closed (a module identity, not the host), but it is not the pin.
+	it.skipIf(config.runtime === "live")(
+		"async runtime: a host-pinned job fired from inside a module runs as the host across an await",
+		async () => {
+			await build([GRANT]);
+			await api.scheduler.service.every(async () => {
+				await new Promise((resolve) => setTimeout(resolve, 0));
+				return api.target.probe.whoami();
+			});
+			expect(await api.client.app.fireFromClient()).toEqual([null]);
+		}
+	);
+
+	it("concurrent async host-pinned jobs all run as the host", async () => {
+		await build([GRANT]);
+		const job = async () => {
+			await new Promise((resolve) => setTimeout(resolve, 0));
+			return api.target.probe.whoami();
+		};
+		await api.scheduler.service.every(job);
+		await api.scheduler.service.every(job);
+		const [first, second] = await api.scheduler.service.list();
+		// Invoked straight from the host so only the two host-pinned jobs are in flight.
+		expect(await Promise.all([first(), second()])).toEqual([null, null]);
+	});
+
+	// ── Permission gate ─────────────────────────────────────────────────────────
+
+	it("is denied to a module without a grant under defaultPolicy allow", async () => {
+		await build([]);
+		await expectDenied(() => api.client.app.scheduleWhoami());
+		await expectDenied(() => api.client.app.pinDirectly());
+	});
+
+	it("is denied to a module without a grant under defaultPolicy deny", async () => {
+		await build(DENY_POLICY_BASE_RULES, "deny");
+		await expectDenied(() => api.client.app.scheduleWhoami());
+		await expectDenied(() => api.client.app.pinDirectly());
+	});
+
+	it("is allowed with a host grant under defaultPolicy deny", async () => {
+		await build([...DENY_POLICY_BASE_RULES, GRANT], "deny");
+		await api.client.app.scheduleWhoami();
+		expect(await api.scheduler.service.fire()).toEqual([CLIENT_WHOAMI]);
+		// The grant is scoped: the client itself still may not pin its caller.
+		await expectDenied(() => api.client.app.pinDirectly());
+	});
+
+	it("the built-in exact allow on slothlet.lockCaller does not cover slothlet.lockCaller.caller", async () => {
+		await build([GRANT], "deny");
+		const global = api.slothlet.permissions.global;
+		expect(global.checkAccess("client.app", "slothlet.lockCaller")).toBe(true);
+		expect(global.checkAccess("client.app", "slothlet.lockCaller.caller")).toBe(false);
+		expect(global.checkAccess("scheduler.service", "slothlet.lockCaller.caller")).toBe(true);
+	});
+
+	it("the built-in deny applies under defaultPolicy allow too", async () => {
+		await build([]);
+		const global = api.slothlet.permissions.global;
+		expect(global.checkAccess("anyModule", "slothlet.lockCaller")).toBe(true);
+		expect(global.checkAccess("anyModule", "slothlet.lockCaller.caller")).toBe(false);
+	});
+
+	// ── Principals (#459) ───────────────────────────────────────────────────────
+
+	/**
+	 * Rules for the principals tests: the client may read a project its roles grant "read" on.
+	 * @type {object[]}
+	 */
+	const PRINCIPAL_RULES = [
+		GRANT,
+		{ caller: "client.**", target: "scheduler.**", effect: "allow" },
+		{ caller: "roles.**", target: "slothlet.permissions.principal.**", effect: "allow" },
+		{
+			caller: "client.**",
+			target: "target.probe.files",
+			effect: "allow",
+			requires: ["roles"],
+			condition: (ctx, { args, principals }) => principals.roles.projects[args[0]]?.includes("read") === true
+		}
+	];
+
+	/**
+	 * Build the principals fixture: the roles principal registered and u1 granted read on p1.
+	 * @returns {Promise<(ctx: object, fn: () => unknown) => unknown>} A per-request context runner.
+	 */
+	const buildPrincipals = async () => {
+		await build(PRINCIPAL_RULES, "deny");
+		await api.roles.registry.setup();
+		await api.roles.registry.grant("u1", "p1", ["read"]);
+		return (ctx, fn) => api.slothlet.context.run(ctx, fn);
+	};
+
+	it("principals: the pinned caller's principal-gated rule applies inside the job", async () => {
+		const as = await buildPrincipals();
+		// Resolve u1's roles once through a direct client call, so the job takes the synchronous path.
+		expect(await as({ user: "u1" }, () => api.client.app.readFiles("p1"))).toEqual({ projectId: "p1" });
+
+		await api.client.app.scheduleFiles();
+		expect(await as({ user: "u1" }, () => api.scheduler.service.fire("p1"))).toEqual([{ projectId: "p1" }]);
+		// Same identity, a project its roles grant nothing on: the resolved facts deny it.
+		await expectDenied(() => as({ user: "u1" }, () => api.scheduler.service.fire("p2")));
+
+		// Pinned to the scheduler, the client rule never matches.
+		await api.scheduler.service.clear();
+		await api.client.app.scheduleFilesAsService();
+		await expectDenied(() => as({ user: "u1" }, () => api.scheduler.service.fire("p1")));
+	});
+
+	// Async runtime only: a stale principal promotes the call past an await, and in the live runtime the
+	// deferred enforcement is attributed from the stack while the scheduler is suspended awaiting the job —
+	// the same caveat lockCaller carries (see the async host-pin test above).
+	it.skipIf(config.runtime === "live")("async runtime: a principal is resolved for the pinned caller from inside the job", async () => {
+		const as = await buildPrincipals();
+		await api.client.app.scheduleFiles();
+		// No prior resolve: the job's call is promoted to resolve u1's roles, then gated on them.
+		expect(await as({ user: "u1" }, () => api.scheduler.service.fire("p1"))).toEqual([{ projectId: "p1" }]);
+		await expectDenied(() => as({ user: "u2" }, () => api.scheduler.service.fire("p1")));
+	});
+
+	// ── lockCaller parity ───────────────────────────────────────────────────────
+
+	it("errors thrown by the job propagate unchanged", async () => {
+		await build([GRANT]);
+		await api.client.app.scheduleThrow();
+		const [wrapper] = await api.scheduler.service.list();
+		let error;
+		try {
+			wrapper();
+		} catch (err) {
+			error = err;
+		}
+		expect(error).toBeInstanceOf(TypeError);
+		expect(error.message).toBe("job-boom");
+
+		const hostPinned = api.slothlet.lockCaller.caller(() => {
+			throw new RangeError("host-boom");
+		});
+		expect(() => hostPinned()).toThrow(RangeError);
+	});
+
+	it("forwards `this` and arguments into the job", async () => {
+		await build([GRANT]);
+		await api.client.app.scheduleThisAndArgs();
+		const thisArg = { tag: "the-this" };
+		const [result] = await api.scheduler.service.fireWith(thisArg, 1, 2);
+		expect(result.self).toBe(thisArg);
+		expect(result.args).toEqual([1, 2]);
+	});
+
+	it("exposes the original function via `_slothletOriginal`", async () => {
+		await build([GRANT]);
+		const { wrapper, original } = await api.client.app.pinThroughScheduler();
+		expect(wrapper._slothletOriginal).toBe(original);
+		expect(wrapper()).toBe("original");
+	});
+
+	it("the identity is captured at call time and cannot be changed afterwards", async () => {
+		await build([GRANT]);
+		await api.client.app.scheduleWhoami();
+		const [wrapper] = await api.scheduler.service.list();
+		// Invoked from the host, from another module, and again — always the client.
+		expect(await wrapper()).toBe(CLIENT_WHOAMI);
+		expect(await api.client.app.fireFromClient()).toEqual([CLIENT_WHOAMI]);
+		expect(await wrapper()).toBe(CLIENT_WHOAMI);
+	});
+
+	it("rejects a non-function argument", async () => {
+		await build([]);
+		let error;
+		try {
+			api.slothlet.lockCaller.caller(123);
+		} catch (err) {
+			error = err;
+		}
+		expect(error?.code).toBe("INVALID_ARGUMENT");
+	});
+
+	it("a pinned job still targets the live instance after a full reload", async () => {
+		// Identity marker: only the client is denied the guarded route, so a denial naming the client proves
+		// the job still runs as the client (the host and the scheduler would both be allowed).
+		await build([GRANT, { caller: "client.**", target: "target.probe.guarded", effect: "deny" }]);
+		await api.client.app.scheduleGuarded();
+		const [wrapper] = await api.scheduler.service.list();
+		/**
+		 * Invoke the pinned job and return the error it raised.
+		 * @returns {Promise<Error|undefined>} The error.
+		 */
+		const invoke = () =>
+			withSuppressedSlothletErrorOutput(async () => {
+				try {
+					await wrapper();
+				} catch (err) {
+					return err;
+				}
+				return undefined;
+			});
+		const before = await invoke();
+		expect(before?.code).toBe("PERMISSION_DENIED");
+		expect(before?.message).toContain("client.app.scheduleGuarded");
+
+		await api.slothlet.reload();
+		const after = await invoke();
+		expect(after?.code).toBe("PERMISSION_DENIED");
+		expect(after?.message).toContain("client.app.scheduleGuarded");
+	});
+
+	// Same runtime-mode behaviour as lockCaller (see the lock-caller runtime suite): the identity is held
+	// across the job's await in both runtimes.
+	it("an async job keeps the pinned caller across an await", async () => {
+		await build([GRANT]);
+		await api.client.app.scheduleAsyncWhoami();
+		expect(await api.scheduler.service.fire()).toEqual(["client.app.scheduleAsyncWhoami"]);
+	});
+
+	it("plain lockCaller is unchanged: a function, host passthrough, and reachable .caller", async () => {
+		await build([]);
+		expect(typeof api.slothlet.lockCaller).toBe("function");
+		expect(typeof api.slothlet.lockCaller.caller).toBe("function");
+		const fn = () => 42;
+		expect(api.slothlet.lockCaller(fn)).toBe(fn);
+		expect(api.slothlet.lockCaller(fn)()).toBe(42);
+	});
+
+	it("lockCaller.caller is reachable through self for a granted module", async () => {
+		await build([{ caller: "client.**", target: "slothlet.lockCaller.caller", effect: "allow" }]);
+		const pinned = await api.client.app.pinDirectly();
+		expect(typeof pinned).toBe("function");
+		expect(pinned()).toBe(0);
+	});
+});
diff --git a/types/src/lib/builders/api_builder.d.mts.map b/types/src/lib/builders/api_builder.d.mts.map
index 302e76339..3f1178f0e 100644
--- a/types/src/lib/builders/api_builder.d.mts.map
+++ b/types/src/lib/builders/api_builder.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"api_builder.d.mts","sourceRoot":"","sources":["../../../../src/lib/builders/api_builder.mjs"],"names":[],"mappings":"AAmMA;;;;;;;;;;;;;GAaG;AACH;IACC,gCAAuC;IAEvC;;;;;;;OAOG;IACH,sBANW,MAAM,EAQhB;IAED;;;;;OAKG;IACH,8BAJW,MAAM,GACJ,OAAO,CAAC,MAAM,CAAC,CA6G3B;IAED;;;;;;;;;;;OAWG;IACH,gCA6jGC;IAED;;;;OAIG;IACH,+BA4BC;IAED;;;;OAIG;IACH,0BAgCC;IAED;;;;OAIG;IACH,4BAsTC;IAED;;;;;OAKG;IACH,8BAmEC;IAED;;;;;OAKG;IACH,uBAgCC;CACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAv3H6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"api_builder.d.mts","sourceRoot":"","sources":["../../../../src/lib/builders/api_builder.mjs"],"names":[],"mappings":"AAmMA;;;;;;;;;;;;;GAaG;AACH;IACC,gCAAuC;IAEvC;;;;;;;OAOG;IACH,sBANW,MAAM,EAQhB;IAED;;;;;OAKG;IACH,8BAJW,MAAM,GACJ,OAAO,CAAC,MAAM,CAAC,CA6G3B;IAED;;;;;;;;;;;OAWG;IACH,gCAyoGC;IAED;;;;OAIG;IACH,+BA4BC;IAED;;;;OAIG;IACH,0BAgCC;IAED;;;;OAIG;IACH,4BAsTC;IAED;;;;;OAKG;IACH,8BAmEC;IAED;;;;;OAKG;IACH,uBAgCC;CACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAn8H6B,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/lib/handlers/context-async.d.mts b/types/src/lib/handlers/context-async.d.mts
index 6d800a2c8..0b8dcec69 100644
--- a/types/src/lib/handlers/context-async.d.mts
+++ b/types/src/lib/handlers/context-async.d.mts
@@ -31,10 +31,14 @@ export class AsyncContextManager {
      *   `fn` propagate unchanged instead of wrapping it as `CONTEXT_EXECUTION_FAILED`. Used
      *   for framework callbacks (`lockCaller`, pinned hooks) where the caller expects the
      *   original error type/code/status.
+     * @param {boolean} [asHost=false] - When `true`, run `fn` with **no module caller**: both
+     *   `currentWrapper` and `callerWrapper` are cleared for the execution, so `fn` runs as the host
+     *   (`metadata.caller()` returns null inside it). `currentWrapper` is ignored. Used by
+     *   `lockCaller.caller()` when the pinned caller is the host.
      * @returns {*} Result of function execution
      * @public
      */
-    public runInContext(instanceID: string, fn: Function, thisArg: any, args: any[], currentWrapper?: Object, rawErrors?: boolean): any;
+    public runInContext(instanceID: string, fn: Function, thisArg: any, args: any[], currentWrapper?: Object, rawErrors?: boolean, asHost?: boolean): any;
     /**
      * Get current active context
      * @returns {Object} Current context store
diff --git a/types/src/lib/handlers/context-async.d.mts.map b/types/src/lib/handlers/context-async.d.mts.map
index a3dffb814..80f3f4537 100644
--- a/types/src/lib/handlers/context-async.d.mts.map
+++ b/types/src/lib/handlers/context-async.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"context-async.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/context-async.mjs"],"names":[],"mappings":"AAyBA;;;;GAIG;AACH;IAKE,SAA6D;IAC7D,yBAA0B;IAG3B;;;;OAIG;IACH,kDAKC;IAED;;;;;;OAMG;IACH,8BALW,MAAM,WACN,MAAM,GACJ,MAAM,CAkBlB;IAED;;;;;;;;;;;;;OAaG;IACH,gCAZW,MAAM,yBAEN,GAAC,gCAED,MAAM,cACN,OAAO,GAIL,GAAC,CA4Fb;IAqBD;;;;;OAKG;IACH,qBAJa,MAAM,CAUlB;IAED;;;;;;;;;;;;OAYG;IACH,kCAVW,MAAM,GAOJ,MAAM,GAAC,SAAS,CAe5B;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,sCAVW,MAAM,GAMJ;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAC,GAAC,SAAS,CAQrE;IAED;;;;OAIG;IACH,2BAHW,MAAM,QAoBhB;IAED;;;;OAIG;IACH,yBAHa,MAAM,CAclB;;CACD;AAED;;;GAGG;AACH,sDAA6D"}
\ No newline at end of file
+{"version":3,"file":"context-async.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/context-async.mjs"],"names":[],"mappings":"AA0BA;;;;GAIG;AACH;IAKE,SAA6D;IAC7D,yBAA0B;IAG3B;;;;OAIG;IACH,kDAKC;IAED;;;;;;OAMG;IACH,8BALW,MAAM,WACN,MAAM,GACJ,MAAM,CAkBlB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,gCAhBW,MAAM,yBAEN,GAAC,gCAED,MAAM,cACN,OAAO,WAIP,OAAO,GAIL,GAAC,CAoGb;IAqBD;;;;;OAKG;IACH,qBAJa,MAAM,CAUlB;IAED;;;;;;;;;;;;OAYG;IACH,kCAVW,MAAM,GAOJ,MAAM,GAAC,SAAS,CAe5B;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,sCAVW,MAAM,GAMJ;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAC,GAAC,SAAS,CAQrE;IAED;;;;OAIG;IACH,2BAHW,MAAM,QAoBhB;IAED;;;;OAIG;IACH,yBAHa,MAAM,CAclB;;CACD;AAED;;;GAGG;AACH,sDAA6D"}
\ No newline at end of file
diff --git a/types/src/lib/handlers/context-live.d.mts b/types/src/lib/handlers/context-live.d.mts
index a71c47842..e28db87cc 100644
--- a/types/src/lib/handlers/context-live.d.mts
+++ b/types/src/lib/handlers/context-live.d.mts
@@ -79,10 +79,14 @@ export class LiveContextManager {
      *   `fn` propagate unchanged instead of wrapping it as `CONTEXT_EXECUTION_FAILED`. Used
      *   for framework callbacks (`lockCaller`, pinned hooks) where the caller expects the
      *   original error type/code/status.
+     * @param {boolean} [asHost=false] - When `true`, run `fn` with **no module caller**: both
+     *   `currentWrapper` and `callerWrapper` are cleared for the execution, so `fn` runs as the host
+     *   (`metadata.caller()` returns null inside it). `currentWrapper` is ignored. Used by
+     *   `lockCaller.caller()` when the pinned caller is the host.
      * @returns {*} Result of function execution
      * @public
      */
-    public runInContext(instanceID: string, fn: Function, thisArg: any, args: any[], currentWrapper?: Object, rawErrors?: boolean): any;
+    public runInContext(instanceID: string, fn: Function, thisArg: any, args: any[], currentWrapper?: Object, rawErrors?: boolean, asHost?: boolean): any;
     /**
      * Get current active context
      * @returns {Object} Current context store
diff --git a/types/src/lib/handlers/context-live.d.mts.map b/types/src/lib/handlers/context-live.d.mts.map
index a9a9b3f60..4609c1ee4 100644
--- a/types/src/lib/handlers/context-live.d.mts.map
+++ b/types/src/lib/handlers/context-live.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"context-live.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/context-live.mjs"],"names":[],"mappings":"AAiEA;;;;;;;;;;;;;GAaG;AACH;IAEE,yBAA0B;IAC1B,uBAA6B;IA2B9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,sCAZW,MAAM,GAQJ;QAAC,cAAc,EAAE,MAAM,GAAC,IAAI,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAC,GAAC,SAAS,CAkDhG;IAoGD;;;;OAIG;IACH,kDAgCC;IAED;;;;;;OAMG;IACH,8BALW,MAAM,WACN,MAAM,GACJ,MAAM,CAwBlB;IAED;;;;;;;;;;;;;OAaG;IACH,gCAZW,MAAM,yBAEN,GAAC,gCAED,MAAM,cACN,OAAO,GAIL,GAAC,CA8Gb;IAED;;;;;OAKG;IACH,qBAJa,MAAM,CAuBlB;IAED;;;;;;;;;;;OAWG;IACH,kCATW,MAAM,GAMJ,MAAM,GAAC,SAAS,CAc5B;IAED;;;;OAIG;IACH,2BAHW,MAAM,QAyBhB;IAED;;;;OAIG;IACH,yBAHa,MAAM,CAclB;;CACD;AAED;;;GAGG;AACH,oDAA2D"}
\ No newline at end of file
+{"version":3,"file":"context-live.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/context-live.mjs"],"names":[],"mappings":"AAiEA;;;;;;;;;;;;;GAaG;AACH;IAEE,yBAA0B;IAC1B,uBAA6B;IA2B9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,sCAZW,MAAM,GAQJ;QAAC,cAAc,EAAE,MAAM,GAAC,IAAI,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAC,GAAC,SAAS,CAkDhG;IAqGD;;;;OAIG;IACH,kDAgCC;IAED;;;;;;OAMG;IACH,8BALW,MAAM,WACN,MAAM,GACJ,MAAM,CAwBlB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,gCAhBW,MAAM,yBAEN,GAAC,gCAED,MAAM,cACN,OAAO,WAIP,OAAO,GAIL,GAAC,CA0Hb;IAED;;;;;OAKG;IACH,qBAJa,MAAM,CAuBlB;IAED;;;;;;;;;;;OAWG;IACH,kCATW,MAAM,GAMJ,MAAM,GAAC,SAAS,CAc5B;IAED;;;;OAIG;IACH,2BAHW,MAAM,QAyBhB;IAED;;;;OAIG;IACH,yBAHa,MAAM,CAclB;;CACD;AAED;;;GAGG;AACH,oDAA2D"}
\ No newline at end of file
diff --git a/types/src/lib/handlers/metadata.d.mts b/types/src/lib/handlers/metadata.d.mts
index 4e5c99e63..82e96766f 100644
--- a/types/src/lib/handlers/metadata.d.mts
+++ b/types/src/lib/handlers/metadata.d.mts
@@ -241,6 +241,18 @@ export class Metadata extends ComponentBase {
      * @public
      */
     public caller(): object | null;
+    /**
+     * Resolve the wrapper of the API function that called the current function.
+     *
+     * The single resolution behind {@link Metadata#caller}: reads `callerWrapper` from the active
+     * context-manager store. `self.slothlet.lockCaller.caller()` pins exactly this identity, so the
+     * two can never disagree about who "the caller" is.
+     *
+     * @returns {object|null} The calling function's wrapper, or null when there is no module caller
+     *   in context (the function was invoked from the host or outside the API).
+     * @public
+     */
+    public callerWrapper(): object | null;
     #private;
 }
 import { ComponentBase } from "#factories/component-base";
diff --git a/types/src/lib/handlers/metadata.d.mts.map b/types/src/lib/handlers/metadata.d.mts.map
index a72ba89dd..2b8f21078 100644
--- a/types/src/lib/handlers/metadata.d.mts.map
+++ b/types/src/lib/handlers/metadata.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"metadata.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/metadata.mjs"],"names":[],"mappings":"AAwBA;;;;;;;;;GASG;AACH,kCAHU,MAAM,CAGsC;AAEtD;;;;;GAKG;AACH;IACC,gCAAqC;IAKrC;;;OAGG;IACH,sBAFW,MAAM,EAKhB;IAVD,4BAA4B;IAC5B,aADW,MAAM,GAAG,IAAI,CACL;IA6KnB;;;;;;;;;;;;;;;OAeG;IACH,0BA+CC;IAED;;;;;OAKG;IACH,0BAJW,WAAS,MAAM,GACb,MAAM,GAAC,IAAI,CAYvB;IAED;;;;;;OAMG;IACH,2BAJW,WAAS,MAAM,GACb,MAAM,CAmElB;IAED;;;;;OAKG;IACH,8BAJW,MAAM,SACN,OAAO,QAKjB;IAED;;;;;;OAMG;IACH,8CAJW,MAAM,SACN,OAAO,QA+CjB;IAED;;;;;;;;OAQG;IACH,kDANW,MAAM,GAAC,MAAM,EAAE,GAAC;YAAO,MAAM,GAAE,MAAM,EAAE;KAAC,QAkFlD;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,iCAJW,MAAM,YACN,MAAM,QA0BhB;IAED;;;;;;;;;OASG;IACH,qCAHW,MAAM,QAMhB;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,gCALW,MAAM,YACN,MAAM,GAAC,MAAM,UACb,OAAO,QAyBjB;IAED;;;;;;;;;;;;;OAaG;IACH,gCANW,MAAM,GACJ,MAAM,CAmBlB;IAED;;;;;;;;;;;;OAYG;IACH,mCAJW,MAAM,QACN,MAAM,GAAC,MAAM,EAAE,QA+BzB;IAED;;;;;;;;;;OAUG;IACH,mBAHa;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,iBAAiB,gBAAK;KAAE,CAe9D;IAED;;;;;;;;;;;;;;;OAeG;IACH,uBAHW;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,iBAAiB,gBAAK;KAAE,QAgC5D;IAED;;;;;;;;;;;;;OAaG;IACH,iBAJW,MAAM,GACJ,OAAO,CAAC,MAAM,GAAC,IAAI,CAAC,CAkChC;IAED;;;;;;;;;;;;;OAaG;IACH,eAHa,MAAM,CAalB;IAED;;;;;;;;;;;;OAYG;IACH,iBAHa,MAAM,GAAC,IAAI,CAOvB;;CACD;8BAz0B6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"metadata.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/metadata.mjs"],"names":[],"mappings":"AAwBA;;;;;;;;;GASG;AACH,kCAHU,MAAM,CAGsC;AAEtD;;;;;GAKG;AACH;IACC,gCAAqC;IAKrC;;;OAGG;IACH,sBAFW,MAAM,EAKhB;IAVD,4BAA4B;IAC5B,aADW,MAAM,GAAG,IAAI,CACL;IA6KnB;;;;;;;;;;;;;;;OAeG;IACH,0BA+CC;IAED;;;;;OAKG;IACH,0BAJW,WAAS,MAAM,GACb,MAAM,GAAC,IAAI,CAYvB;IAED;;;;;;OAMG;IACH,2BAJW,WAAS,MAAM,GACb,MAAM,CAmElB;IAED;;;;;OAKG;IACH,8BAJW,MAAM,SACN,OAAO,QAKjB;IAED;;;;;;OAMG;IACH,8CAJW,MAAM,SACN,OAAO,QA+CjB;IAED;;;;;;;;OAQG;IACH,kDANW,MAAM,GAAC,MAAM,EAAE,GAAC;YAAO,MAAM,GAAE,MAAM,EAAE;KAAC,QAkFlD;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,iCAJW,MAAM,YACN,MAAM,QA0BhB;IAED;;;;;;;;;OASG;IACH,qCAHW,MAAM,QAMhB;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,gCALW,MAAM,YACN,MAAM,GAAC,MAAM,UACb,OAAO,QAyBjB;IAED;;;;;;;;;;;;;OAaG;IACH,gCANW,MAAM,GACJ,MAAM,CAmBlB;IAED;;;;;;;;;;;;OAYG;IACH,mCAJW,MAAM,QACN,MAAM,GAAC,MAAM,EAAE,QA+BzB;IAED;;;;;;;;;;OAUG;IACH,mBAHa;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,iBAAiB,gBAAK;KAAE,CAe9D;IAED;;;;;;;;;;;;;;;OAeG;IACH,uBAHW;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,iBAAiB,gBAAK;KAAE,QAgC5D;IAED;;;;;;;;;;;;;OAaG;IACH,iBAJW,MAAM,GACJ,OAAO,CAAC,MAAM,GAAC,IAAI,CAAC,CAkChC;IAED;;;;;;;;;;;;;OAaG;IACH,eAHa,MAAM,CAalB;IAED;;;;;;;;;;;;OAYG;IACH,iBAHa,MAAM,GAAC,IAAI,CAOvB;IAED;;;;;;;;;;OAUG;IACH,wBAJa,MAAM,GAAC,IAAI,CAOvB;;CACD;8BAz1B6B,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/lib/handlers/permission-manager.d.mts.map b/types/src/lib/handlers/permission-manager.d.mts.map
index 9d515e7f0..42a04f6e6 100644
--- a/types/src/lib/handlers/permission-manager.d.mts.map
+++ b/types/src/lib/handlers/permission-manager.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"permission-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/permission-manager.mjs"],"names":[],"mappings":"AA8KA;;;;;;;GAOG;AACH;IACC;;;;OAIG;IACH,yBAHU,MAAM,CAG8B;IA0I9C;;;;;;OAMG;IACH,sBAJW,MAAM,EAsFhB;IAED;;;;;;;;;;;;;OAaG;IACH,cAVG;QAAqB,MAAM,EAAnB,MAAM;QACO,MAAM,EAAnB,MAAM;QACO,MAAM,EAAnB,MAAM;KACd,kBAAQ,MAAM,GAAC,IAAI,WACX,MAAM,GAAC,IAAI,iBACT,MAAM,CAiDlB;IAED;;;;;;;;;;OAUG;IACH,mBAPW,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,OAAO,CAmCnB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,mBAZG;QAAqB,MAAM,EAAnB,MAAM;QACO,KAAK,EAAlB,MAAM;QACwB,MAAM,EAApC,MAAM,GAAC,QAAQ,GAAC,OAAO;QACuB,SAAS;KAC/D,kBAAQ,MAAM,GAAC,IAAI,WACX,MAAM,GAAC,IAAI,UACX,MAAM,GAAC,IAAI,GACT,MAAM,CAqClB;IAED;;;;;;;;OAQG;IACH,wBALW,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,OAAO,CAiBnB;IAED;;;;;;;;;;OAUG;IACH,kCALW,MAAM,GAAC,IAAI,aACX,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,MAAM,GAAC,QAAQ,GAAC,OAAO,CA0BnC;IAED;;;;OAIG;IACH,uBAFa,MAAM,CAIlB;IAED;;;;;OAKG;IACH,gCAFa,OAAO,CAOnB;IAuCD;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,wBAlBW,MAAM,cAEd;QAAwC,GAAG,EAAnC,CAAS,IAAM,EAAN,MAAM,KAAG,GAAC;QAGQ,OAAO,EAAlC,CAAS,IAAC,EAAD,GAAC,KAAG,GAAC;QACM,MAAM;KAClC,kBAAQ,MAAM,GAAC,IAAI,WACX,CAAS,IAAQ,YAAE,IAAQ,EAAR,KAAK,CAAC,GAAC,CAAC,KAAG,GAAC,GAG7B,IAAI,CA0ChB;IAED;;;;;;;;;;;OAWG;IACH,0BARW,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,OAAO,CAanB;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,0BARW,MAAM,gBACN,GAAC,mBACD,MAAM,GAAC,IAAI,GACT,OAAO,CAiBnB;IAED;;;;;;;OAOG;IACH,mBALW,MAAM,GACJ,OAAO,CAMnB;IAED;;;;;;;;OAQG;IACH,0BALW,MAAM,GACJ,IAAI,CAUhB;IAED;;;;;;;;;;;OAWG;IACH,2BALW,MAAM,GACJ,IAAI,CAUhB;IAED;;;;;;;;;;;OAWG;IACH,uBANW,MAAM,iBACN,MAAM,GACJ,IAAI,CAShB;IAED;;;;;;;;;;;;;;;OAeG;IACH,4BATW,MAAM,cACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,GACT,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,GAAC,CAAA;KAAE,CAAC,CAkCnD;IAED;;;;;;;;;OASG;IACH,yBALW,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,GAAC,CAAA;KAAE,CAAC,GACrC,OAAO,CAAC,IAAI,CAAC,CAMzB;IA4SD;;;;;;;;;;;;;;;OAeG;IACH,wBAXW,MAAM,cACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,YACX;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAC,IAAI,GAEzB,OAAO,CA2BnB;IAED;;;;;;;;;OASG;IACH,4BANW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,cAAU,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,WAAS,CAAC,GAAC,IAAI,GAAC,SAAS,mBACvF,MAAM,GAAC,IAAI,GACT,OAAO,CASnB;IAyBD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,0BAjBW,MAAM,cACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,aACX,kBAAkB,GAAC,IAAI,YAGvB;QAAE,cAAc,CAAC,EAAE,OAAO,CAAA;KAAE,GAAC,IAAI,GAG/B,OAAO,CA+BnB;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,8BAbW,MAAM,GAAC,IAAI,YAEX,MAAM,YACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,GACT,OAAO,CAenB;IAED;;;;;;;;;;;;;;;OAeG;IACH,4BAZW,MAAM,GAAC,IAAI,YACX,MAAM,YACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBAGX,MAAM,GAAC,IAAI,GACT,OAAO,CAMnB;IAED;;;;;;;OAOG;IACH,4BALW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAazB;IAED;;;;;;;OAOG;IACH,2BALW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAYzB;IAED;;;;;;;;OAQG;IACH,8BALW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAazB;IAED;;;;;;OAMG;IACH,UAJa,IAAI,CAQhB;IAcD;;;;;;;;OAQG;IACH,QAJa,IAAI,CAMhB;IAED;;;;;OAKG;IACH,YAJa,OAAO,CAMnB;IAED;;;;;;OAMG;IACH,WAJa,IAAI,CAQhB;IAED;;;;;;OAMG;IACH,aAJa,OAAO,CAMnB;IAED;;;;;;;;OAQG;IACH,uBAJa,OAAO,CAMnB;IAED;;;;;;;;;OASG;IACH,oBAJa,OAAO,CAMnB;IAED;;;;;;;;;;;;OAYG;IACH,mCAVW,MAAM,GAAC,IAAI,GAAC,SAAS,GACnB,OAAO,CAWnB;IAED;;;;;;;;;;;OAWG;IACH,qBANW,OAAO,GACL,IAAI,CAgBhB;IAED;;;;;;OAMG;IAIH,eAPa,KAAK,CAAC,MAAM,CAAC,CAgBzB;IAED;;;;;;;;OAQG;IACH,2BALW,KAAK,CAAC,MAAM,CAAC,GACX,IAAI,CAShB;IAGD;;;;;;;OAOG;IACH,YAJa,OAAO,CAAC,IAAI,CAAC,CAczB;IA4kBD;;;;;;;OAOG;IACH,cAEC;;CACD;;;;;;;;;;;;;;;UAplEa,KAAK,CAAC,GAAC,CAAC,GAAC,IAAI;;;;YACb,MAAM,GAAC,IAAI;;8BAtHK,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"permission-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/permission-manager.mjs"],"names":[],"mappings":"AA8KA;;;;;;;GAOG;AACH;IACC;;;;OAIG;IACH,yBAHU,MAAM,CAG8B;IA0I9C;;;;;;OAMG;IACH,sBAJW,MAAM,EA8FhB;IAED;;;;;;;;;;;;;OAaG;IACH,cAVG;QAAqB,MAAM,EAAnB,MAAM;QACO,MAAM,EAAnB,MAAM;QACO,MAAM,EAAnB,MAAM;KACd,kBAAQ,MAAM,GAAC,IAAI,WACX,MAAM,GAAC,IAAI,iBACT,MAAM,CAiDlB;IAED;;;;;;;;;;OAUG;IACH,mBAPW,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,OAAO,CAmCnB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,mBAZG;QAAqB,MAAM,EAAnB,MAAM;QACO,KAAK,EAAlB,MAAM;QACwB,MAAM,EAApC,MAAM,GAAC,QAAQ,GAAC,OAAO;QACuB,SAAS;KAC/D,kBAAQ,MAAM,GAAC,IAAI,WACX,MAAM,GAAC,IAAI,UACX,MAAM,GAAC,IAAI,GACT,MAAM,CAqClB;IAED;;;;;;;;OAQG;IACH,wBALW,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,OAAO,CAiBnB;IAED;;;;;;;;;;OAUG;IACH,kCALW,MAAM,GAAC,IAAI,aACX,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,MAAM,GAAC,QAAQ,GAAC,OAAO,CA0BnC;IAED;;;;OAIG;IACH,uBAFa,MAAM,CAIlB;IAED;;;;;OAKG;IACH,gCAFa,OAAO,CAOnB;IAuCD;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,wBAlBW,MAAM,cAEd;QAAwC,GAAG,EAAnC,CAAS,IAAM,EAAN,MAAM,KAAG,GAAC;QAGQ,OAAO,EAAlC,CAAS,IAAC,EAAD,GAAC,KAAG,GAAC;QACM,MAAM;KAClC,kBAAQ,MAAM,GAAC,IAAI,WACX,CAAS,IAAQ,YAAE,IAAQ,EAAR,KAAK,CAAC,GAAC,CAAC,KAAG,GAAC,GAG7B,IAAI,CA0ChB;IAED;;;;;;;;;;;OAWG;IACH,0BARW,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,OAAO,CAanB;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,0BARW,MAAM,gBACN,GAAC,mBACD,MAAM,GAAC,IAAI,GACT,OAAO,CAiBnB;IAED;;;;;;;OAOG;IACH,mBALW,MAAM,GACJ,OAAO,CAMnB;IAED;;;;;;;;OAQG;IACH,0BALW,MAAM,GACJ,IAAI,CAUhB;IAED;;;;;;;;;;;OAWG;IACH,2BALW,MAAM,GACJ,IAAI,CAUhB;IAED;;;;;;;;;;;OAWG;IACH,uBANW,MAAM,iBACN,MAAM,GACJ,IAAI,CAShB;IAED;;;;;;;;;;;;;;;OAeG;IACH,4BATW,MAAM,cACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,GACT,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,GAAC,CAAA;KAAE,CAAC,CAkCnD;IAED;;;;;;;;;OASG;IACH,yBALW,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,GAAC,CAAA;KAAE,CAAC,GACrC,OAAO,CAAC,IAAI,CAAC,CAMzB;IA4SD;;;;;;;;;;;;;;;OAeG;IACH,wBAXW,MAAM,cACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,YACX;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAC,IAAI,GAEzB,OAAO,CA2BnB;IAED;;;;;;;;;OASG;IACH,4BANW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,cAAU,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,WAAS,CAAC,GAAC,IAAI,GAAC,SAAS,mBACvF,MAAM,GAAC,IAAI,GACT,OAAO,CASnB;IAyBD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,0BAjBW,MAAM,cACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,aACX,kBAAkB,GAAC,IAAI,YAGvB;QAAE,cAAc,CAAC,EAAE,OAAO,CAAA;KAAE,GAAC,IAAI,GAG/B,OAAO,CA+BnB;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,8BAbW,MAAM,GAAC,IAAI,YAEX,MAAM,YACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,GACT,OAAO,CAenB;IAED;;;;;;;;;;;;;;;OAeG;IACH,4BAZW,MAAM,GAAC,IAAI,YACX,MAAM,YACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBAGX,MAAM,GAAC,IAAI,GACT,OAAO,CAMnB;IAED;;;;;;;OAOG;IACH,4BALW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAazB;IAED;;;;;;;OAOG;IACH,2BALW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAYzB;IAED;;;;;;;;OAQG;IACH,8BALW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAazB;IAED;;;;;;OAMG;IACH,UAJa,IAAI,CAQhB;IAcD;;;;;;;;OAQG;IACH,QAJa,IAAI,CAMhB;IAED;;;;;OAKG;IACH,YAJa,OAAO,CAMnB;IAED;;;;;;OAMG;IACH,WAJa,IAAI,CAQhB;IAED;;;;;;OAMG;IACH,aAJa,OAAO,CAMnB;IAED;;;;;;;;OAQG;IACH,uBAJa,OAAO,CAMnB;IAED;;;;;;;;;OASG;IACH,oBAJa,OAAO,CAMnB;IAED;;;;;;;;;;;;OAYG;IACH,mCAVW,MAAM,GAAC,IAAI,GAAC,SAAS,GACnB,OAAO,CAWnB;IAED;;;;;;;;;;;OAWG;IACH,qBANW,OAAO,GACL,IAAI,CAgBhB;IAED;;;;;;OAMG;IAIH,eAPa,KAAK,CAAC,MAAM,CAAC,CAgBzB;IAED;;;;;;;;OAQG;IACH,2BALW,KAAK,CAAC,MAAM,CAAC,GACX,IAAI,CAShB;IAGD;;;;;;;OAOG;IACH,YAJa,OAAO,CAAC,IAAI,CAAC,CAczB;IA4kBD;;;;;;;OAOG;IACH,cAEC;;CACD;;;;;;;;;;;;;;;UA5lEa,KAAK,CAAC,GAAC,CAAC,GAAC,IAAI;;;;YACb,MAAM,GAAC,IAAI;;8BAtHK,2BAA2B"}
\ No newline at end of file

From 0a303ef594bd4aa2ed1924b54984a02685d40d97 Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Mon, 28 Sep 2026 19:40:33 -0700
Subject: [PATCH 19/49] fix(context): attribute live-runtime callers by what is
 actually in flight

Root cause: the live manager resolved the caller from the call stack
whenever two or more module calls were suspended, matching a frame only
by the exact file a suspended call entered through. V8's async stack
traces also carry the `at async` frames of the OUTER suspended calls, so:

- a module entered synchronously (a nested leaf, or a lockCaller-pinned
  callback) whose own file was not a suspended call's was attributed to
  the outer suspended caller further down the stack (run.boot /
  run.runHostBootChain), and the "fresh synchronous entry" branch was
  never reached;
- a suspended call resuming in a sibling file of its module fell through
  to the outer suspended caller the same way.

The shared currentWrapper field is also restored in settle order, not
entry order, so it could name a caller that had already finished (a
synchronous leaf whose unawaited async call settled after it returned),
or be cleared while another call was still suspended. The old fallback
returned that field, which could hand a resumed module a finished,
more privileged caller's rights.

New rule (getCallerIdentity, live runtime):
1. A wrapper whose function body is on the JS stack right now (pushed
   before fn.apply, popped when it returns) is the caller. An await
   continuation only resumes on an empty stack, so the top entry is
   provably what is running, however many calls are suspended.
2. No call in flight: the store's baseline (host, or a module-opened
   run()/scope()'s inherited caller), captured before any call can change
   the field.
3. One call suspended: that call.
4. Two or more: the stack decides, by each frame's LOCATION (parsed per
   engine; function names are never read, since a computed method name
   can spell another module's path). A frame matches a candidate by its
   entry file, or by lying under the root folder of the candidate's
   module (base / api.add folder; deepest root wins; slothlet's own
   frames never match by folder). A frame matching several api paths
   narrows the answer to them; an outer frame outside that set, or the
   end of the walk, is AMBIGUOUS and fails closed. No candidate on the
   stack means the baseline, never the stale field.

Two genuinely concurrent calls resuming interleaved still resolve to
themselves: neither is on the entered stack, and each resumed flow's
own frames name its own call or module. The AMBIGUOUS path is now
reachable and covered, so its v8 ignores (context-live, unified-wrapper,
api_builder) are removed.

Docs: PERMISSIONS.md gains an "Overlapping calls" section with the rule
and its limits (files outside every module root, raw cross-module
imports, bundles, sourceURL); the stale live-mode lockCaller bullet in
HOOKS.md is corrected.

Fixes #512
---
 .../ext/api/activate.mjs                      |  77 ++++
 .../ext/api/entry.mjs                         |  44 ++
 .../ext/api/resume.mjs                        |  60 +++
 .../ext/api/usage/cache/context.mjs           |  29 ++
 .../ext/api/views/running.mjs                 |  26 ++
 .../registry.mjs                              |  51 +++
 .../rogue/api/fanout.mjs                      |  31 ++
 .../rogue/api/forge.mjs                       |  27 ++
 .../rogue/api/forged.mjs                      |  48 ++
 .../rogue/api/hold.mjs                        |  29 ++
 .../rogue/api/start.mjs                       |  27 ++
 .../rogue/api/worker.mjs                      |  29 ++
 .../run/boot.mjs                              |  45 ++
 .../run/chain.mjs                             |  29 ++
 .../run/idle.mjs                              |  27 ++
 .../run/kick.mjs                              |  33 ++
 .../run/quick.mjs                             |  26 ++
 .../shared/attempt.mjs                        |  56 +++
 docs/HOOKS.md                                 |   2 +-
 docs/PERMISSIONS.md                           |  11 +
 src/lib/builders/api_builder.mjs              |   7 +-
 src/lib/handlers/context-live.mjs             | 369 +++++++++++----
 src/lib/handlers/unified-wrapper.mjs          |   7 +-
 ...text-live-suspended-caller.test.vitest.mjs | 424 ++++++++++++++++++
 types/src/lib/builders/api_builder.d.mts.map  |   2 +-
 types/src/lib/handlers/context-live.d.mts     |  72 ++-
 types/src/lib/handlers/context-live.d.mts.map |   2 +-
 .../lib/handlers/unified-wrapper.d.mts.map    |   2 +-
 28 files changed, 1483 insertions(+), 109 deletions(-)
 create mode 100644 api_tests/api_test_live_suspended_caller/ext/api/activate.mjs
 create mode 100644 api_tests/api_test_live_suspended_caller/ext/api/entry.mjs
 create mode 100644 api_tests/api_test_live_suspended_caller/ext/api/resume.mjs
 create mode 100644 api_tests/api_test_live_suspended_caller/ext/api/usage/cache/context.mjs
 create mode 100644 api_tests/api_test_live_suspended_caller/ext/api/views/running.mjs
 create mode 100644 api_tests/api_test_live_suspended_caller/registry.mjs
 create mode 100644 api_tests/api_test_live_suspended_caller/rogue/api/fanout.mjs
 create mode 100644 api_tests/api_test_live_suspended_caller/rogue/api/forge.mjs
 create mode 100644 api_tests/api_test_live_suspended_caller/rogue/api/forged.mjs
 create mode 100644 api_tests/api_test_live_suspended_caller/rogue/api/hold.mjs
 create mode 100644 api_tests/api_test_live_suspended_caller/rogue/api/start.mjs
 create mode 100644 api_tests/api_test_live_suspended_caller/rogue/api/worker.mjs
 create mode 100644 api_tests/api_test_live_suspended_caller/run/boot.mjs
 create mode 100644 api_tests/api_test_live_suspended_caller/run/chain.mjs
 create mode 100644 api_tests/api_test_live_suspended_caller/run/idle.mjs
 create mode 100644 api_tests/api_test_live_suspended_caller/run/kick.mjs
 create mode 100644 api_tests/api_test_live_suspended_caller/run/quick.mjs
 create mode 100644 api_tests/api_test_live_suspended_caller/shared/attempt.mjs
 create mode 100644 tests/vitests/suites/context/context-live-suspended-caller.test.vitest.mjs

diff --git a/api_tests/api_test_live_suspended_caller/ext/api/activate.mjs b/api_tests/api_test_live_suspended_caller/ext/api/activate.mjs
new file mode 100644
index 000000000..df4bcf8fa
--- /dev/null
+++ b/api_tests/api_test_live_suspended_caller/ext/api/activate.mjs
@@ -0,0 +1,77 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_live_suspended_caller/ext/api/activate.mjs
+ *	@Date: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview The extension's per-entity activation routine (`ext.activate`, invoked by the host
+ * as `ext.activate.for(id)`).
+ *
+ * @module api_test_live_suspended_caller.ext.activate
+ */
+import { self } from "@cldmv/slothlet/runtime";
+import { afterGate, afterGateCaptured } from "./resume.mjs";
+import { attempt } from "../../shared/attempt.mjs";
+
+/**
+ * Activate for one scenario. A plain function on purpose: the `sibling` scenario hands back a
+ * promise created in a sibling file, so this file's frame is gone by the time that work resumes.
+ * @param {string} scenario - Which activation to perform.
+ * @param {Promise<void>} [gate] - Gate to wait on before acting.
+ * @returns {Promise<*>} The activation's result.
+ */
+export function activate(scenario, gate) {
+	if (scenario === "sibling") return afterGate(gate);
+	if (scenario === "siblingCaptured") return afterGateCaptured(gate);
+	if (scenario === "awaited") return awaitSibling(gate);
+	if (scenario === "hold") return holdThenRender(gate);
+	return registerThenSettle(scenario);
+}
+
+/**
+ * Register a pinned render callback (for `pinned`), then settle.
+ * @param {string} scenario - Activation scenario.
+ * @returns {Promise<string>} `"activated"`.
+ */
+async function registerThenSettle(scenario) {
+	if (scenario === "pinned") {
+		self.registry.register(self.slothlet.lockCaller(() => attempt(() => self.ext.views.running.render("pinned"))));
+		self.registry.register(
+			self.slothlet.lockCaller(() =>
+				attempt(
+					() => self.ext.usage.cache.context.subscribe(() => {}),
+					() => "subscribed"
+				)
+			)
+		);
+	}
+	await null;
+	return "activated";
+}
+
+/**
+ * Await the sibling file's work from this file, so a frame of this file stays on the resumed stack.
+ * @param {Promise<void>} gate - Released by the test.
+ * @returns {Promise<Array<string>>} The sibling's results.
+ */
+async function awaitSibling(gate) {
+	return await afterGate(gate);
+}
+
+/**
+ * Stay suspended on the gate, then reach the extension's own view from this file.
+ * @param {Promise<void>} gate - Released by the test.
+ * @returns {Promise<string>} The render result, or `"denied"`.
+ */
+async function holdThenRender(gate) {
+	await gate;
+	return attempt(() => self.ext.views.running.render("held"));
+}
diff --git a/api_tests/api_test_live_suspended_caller/ext/api/entry.mjs b/api_tests/api_test_live_suspended_caller/ext/api/entry.mjs
new file mode 100644
index 000000000..602dab415
--- /dev/null
+++ b/api_tests/api_test_live_suspended_caller/ext/api/entry.mjs
@@ -0,0 +1,44 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_live_suspended_caller/ext/api/entry.mjs
+ *	@Date: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview The extension's public entry — the one leaf the host may call directly.
+ * @module api_test_live_suspended_caller.ext.entry
+ */
+import { self } from "@cldmv/slothlet/runtime";
+import { attempt } from "../../shared/attempt.mjs";
+
+/**
+ * Synchronously reach the extension's own leaves. Both calls are made before this returns; only
+ * their results are awaited.
+ * @returns {Promise<Array<string>>} The render and subscribe results, each possibly `"denied"`.
+ */
+export function start() {
+	return Promise.all([
+		attempt(() => self.ext.views.running.render("nested")),
+		attempt(
+			() => self.ext.usage.cache.context.subscribe(() => {}),
+			() => "subscribed"
+		)
+	]);
+}
+
+/**
+ * Stay suspended on the gate — a second api path of this module in flight at the same time.
+ * @param {Promise<void>} gate - Released by the test.
+ * @returns {Promise<string>} `"waited"`.
+ */
+export async function wait(gate) {
+	await gate;
+	return "waited";
+}
diff --git a/api_tests/api_test_live_suspended_caller/ext/api/resume.mjs b/api_tests/api_test_live_suspended_caller/ext/api/resume.mjs
new file mode 100644
index 000000000..a44aa2c5d
--- /dev/null
+++ b/api_tests/api_test_live_suspended_caller/ext/api/resume.mjs
@@ -0,0 +1,60 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_live_suspended_caller/ext/api/resume.mjs
+ *	@Date: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview A sibling file of the extension where an activation resumes after its `await`.
+ * @module api_test_live_suspended_caller.ext.resume
+ */
+import { self } from "@cldmv/slothlet/runtime";
+import { attempt } from "../../shared/attempt.mjs";
+
+/**
+ * Wait on the gate, then reach the extension's own leaves from this sibling file.
+ * @param {Promise<void>} gate - Released by the test.
+ * @returns {Promise<Array<string>>} The render and subscribe results, each possibly `"denied"`.
+ */
+export async function afterGate(gate) {
+	await gate;
+	return Promise.all([
+		attempt(() => self.ext.views.running.render("sibling")),
+		attempt(
+			() => self.ext.usage.cache.context.subscribe(() => {}),
+			() => "subscribed"
+		)
+	]);
+}
+
+/**
+ * Take references to the extension's own leaves and to the permissions namespace up front, wait on
+ * the gate, then use them from this sibling file. Each use is gated on whoever is running when it is
+ * made.
+ * @param {Promise<void>} gate - Released by the test.
+ * @returns {Promise<Array<string>>} The render, subscribe and rule-read results, each possibly `"denied"`.
+ */
+export async function afterGateCaptured(gate) {
+	const render = self.ext.views.running.render;
+	const subscribe = self.ext.usage.cache.context.subscribe;
+	const permissions = self.slothlet.permissions;
+	await gate;
+	return Promise.all([
+		attempt(() => render("sibling")),
+		attempt(
+			() => subscribe(() => {}),
+			() => "subscribed"
+		),
+		attempt(
+			() => permissions.global.rulesForPath("ext.views.running.render"),
+			() => "read"
+		)
+	]);
+}
diff --git a/api_tests/api_test_live_suspended_caller/ext/api/usage/cache/context.mjs b/api_tests/api_test_live_suspended_caller/ext/api/usage/cache/context.mjs
new file mode 100644
index 000000000..73f5de6ef
--- /dev/null
+++ b/api_tests/api_test_live_suspended_caller/ext/api/usage/cache/context.mjs
@@ -0,0 +1,29 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_live_suspended_caller/ext/api/usage/cache/context.mjs
+ *	@Date: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview The extension's context cache — reachable by the extension itself only.
+ * @module api_test_live_suspended_caller.ext.usage.cache.context
+ */
+
+const subscribers = new Set();
+
+/**
+ * Subscribe to updates.
+ * @param {Function} fn - Subscriber.
+ * @returns {Function} Unsubscribe.
+ */
+export function subscribe(fn) {
+	subscribers.add(fn);
+	return () => subscribers.delete(fn);
+}
diff --git a/api_tests/api_test_live_suspended_caller/ext/api/views/running.mjs b/api_tests/api_test_live_suspended_caller/ext/api/views/running.mjs
new file mode 100644
index 000000000..f8a37f4fd
--- /dev/null
+++ b/api_tests/api_test_live_suspended_caller/ext/api/views/running.mjs
@@ -0,0 +1,26 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_live_suspended_caller/ext/api/views/running.mjs
+ *	@Date: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview The extension's view — reachable by the extension itself, never by the host's `run.*`.
+ * @module api_test_live_suspended_caller.ext.views.running
+ */
+
+/**
+ * Render a label.
+ * @param {string} label - What to render.
+ * @returns {string} `"rendered:<label>"`.
+ */
+export function render(label) {
+	return `rendered:${label}`;
+}
diff --git a/api_tests/api_test_live_suspended_caller/registry.mjs b/api_tests/api_test_live_suspended_caller/registry.mjs
new file mode 100644
index 000000000..d8426ac28
--- /dev/null
+++ b/api_tests/api_test_live_suspended_caller/registry.mjs
@@ -0,0 +1,51 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_live_suspended_caller/registry.mjs
+ *	@Date: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Host registry: holds callbacks an extension registers and invokes them later.
+ *
+ * @description
+ * Mirrors a host view registry — an extension registers a render callback during activation and the
+ * host renders it later, from the host's own flow, after the activation has settled.
+ *
+ * @module api_test_live_suspended_caller.registry
+ */
+import { attempt } from "./shared/attempt.mjs";
+
+const callbacks = [];
+
+/**
+ * Store a callback for a later {@link renderAll}.
+ * @param {Function} callback - Callback to hold.
+ * @returns {number} Number of held callbacks.
+ */
+export function register(callback) {
+	callbacks.push(callback);
+	return callbacks.length;
+}
+
+/**
+ * Invoke and drop every held callback. Each is invoked synchronously; only the results are awaited.
+ * @returns {Promise<Array<*>>} Each callback's result, or `"denied"`.
+ */
+export function renderAll() {
+	return Promise.all(callbacks.splice(0).map((callback) => attempt(callback)));
+}
+
+/**
+ * Number of held callbacks — a call the host's own leaves are permitted to make.
+ * @returns {number} Held callback count.
+ */
+export function list() {
+	return callbacks.length;
+}
diff --git a/api_tests/api_test_live_suspended_caller/rogue/api/fanout.mjs b/api_tests/api_test_live_suspended_caller/rogue/api/fanout.mjs
new file mode 100644
index 000000000..86eee2511
--- /dev/null
+++ b/api_tests/api_test_live_suspended_caller/rogue/api/fanout.mjs
@@ -0,0 +1,31 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_live_suspended_caller/rogue/api/fanout.mjs
+ *	@Date: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Unprivileged leaf that starts a privileged call and, without awaiting it, makes its own.
+ * @module api_test_live_suspended_caller.rogue.fanout
+ */
+import { self } from "@cldmv/slothlet/runtime";
+import { attempt } from "../../shared/attempt.mjs";
+
+/**
+ * Start `run.quick` (privileged, suspends at once), then synchronously try the extension's view.
+ * The live runtime's caller field names `run.quick` at that moment; the call is still this leaf's.
+ * @returns {Promise<string>} The render result, or `"denied"`.
+ */
+export async function fanout() {
+	const pending = self.run.quick();
+	const result = attempt(() => self.ext.views.running.render("fanout"));
+	await pending;
+	return result;
+}
diff --git a/api_tests/api_test_live_suspended_caller/rogue/api/forge.mjs b/api_tests/api_test_live_suspended_caller/rogue/api/forge.mjs
new file mode 100644
index 000000000..50f83ecfe
--- /dev/null
+++ b/api_tests/api_test_live_suspended_caller/rogue/api/forge.mjs
@@ -0,0 +1,27 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_live_suspended_caller/rogue/api/forge.mjs
+ *	@Date: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Unprivileged leaf whose call resumes in a function NAMED after the extension's source path.
+ * @module api_test_live_suspended_caller.rogue.forge
+ */
+import { runForged } from "./forged.mjs";
+
+/**
+ * Hand back the promise of the path-named function in the sibling file.
+ * @param {Promise<void>} gate - Released by the test.
+ * @returns {Promise<string>} The render result, or `"denied"`.
+ */
+export function forge(gate) {
+	return runForged(gate);
+}
diff --git a/api_tests/api_test_live_suspended_caller/rogue/api/forged.mjs b/api_tests/api_test_live_suspended_caller/rogue/api/forged.mjs
new file mode 100644
index 000000000..d7ac845da
--- /dev/null
+++ b/api_tests/api_test_live_suspended_caller/rogue/api/forged.mjs
@@ -0,0 +1,48 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_live_suspended_caller/rogue/api/forged.mjs
+ *	@Date: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Sibling file holding a function NAMED after the extension's source path.
+ *
+ * @description
+ * A computed method key becomes the function's name, and V8 prints that name in the stack frame
+ * ahead of the frame's real location — so this frame's text contains the extension's path while
+ * the code actually running is this module's. Attribution must read the location, not the name.
+ *
+ * @module api_test_live_suspended_caller.rogue.forged
+ */
+import { self } from "@cldmv/slothlet/runtime";
+
+const EXT_ACTIVATE = decodeURIComponent(new URL("../../ext/api/activate.mjs", import.meta.url).pathname);
+
+const forged = {
+	async [EXT_ACTIVATE](gate) {
+		await gate;
+		// No helper frame in between: the path-named frame must be the innermost one outside slothlet.
+		try {
+			return self.ext.views.running.render("forged");
+		} catch (error) {
+			if (error?.code === "PERMISSION_DENIED") return "denied";
+			throw error;
+		}
+	}
+};
+
+/**
+ * Run the path-named function.
+ * @param {Promise<void>} gate - Released by the test.
+ * @returns {Promise<string>} The render result, or `"denied"`.
+ */
+export function runForged(gate) {
+	return forged[EXT_ACTIVATE](gate);
+}
diff --git a/api_tests/api_test_live_suspended_caller/rogue/api/hold.mjs b/api_tests/api_test_live_suspended_caller/rogue/api/hold.mjs
new file mode 100644
index 000000000..55a5a3f79
--- /dev/null
+++ b/api_tests/api_test_live_suspended_caller/rogue/api/hold.mjs
@@ -0,0 +1,29 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_live_suspended_caller/rogue/api/hold.mjs
+ *	@Date: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Unprivileged call that stays suspended in its own file.
+ * @module api_test_live_suspended_caller.rogue.hold
+ */
+import { self } from "@cldmv/slothlet/runtime";
+import { attempt } from "../../shared/attempt.mjs";
+
+/**
+ * Wait on the gate, then try the extension's view.
+ * @param {Promise<void>} gate - Released by the test.
+ * @returns {Promise<string>} The render result, or `"denied"`.
+ */
+export async function hold(gate) {
+	await gate;
+	return attempt(() => self.ext.views.running.render("rogue-held"));
+}
diff --git a/api_tests/api_test_live_suspended_caller/rogue/api/start.mjs b/api_tests/api_test_live_suspended_caller/rogue/api/start.mjs
new file mode 100644
index 000000000..fff25ce4b
--- /dev/null
+++ b/api_tests/api_test_live_suspended_caller/rogue/api/start.mjs
@@ -0,0 +1,27 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_live_suspended_caller/rogue/api/start.mjs
+ *	@Date: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview An unprivileged module whose call resumes in a sibling file of its own.
+ * @module api_test_live_suspended_caller.rogue.start
+ */
+import { drain } from "./worker.mjs";
+
+/**
+ * Hand back a promise created in the sibling worker file.
+ * @param {Promise<void>} gate - Released by the test.
+ * @returns {Promise<string>} The render result, or `"denied"`.
+ */
+export function start(gate) {
+	return drain(gate);
+}
diff --git a/api_tests/api_test_live_suspended_caller/rogue/api/worker.mjs b/api_tests/api_test_live_suspended_caller/rogue/api/worker.mjs
new file mode 100644
index 000000000..a81d4c2bb
--- /dev/null
+++ b/api_tests/api_test_live_suspended_caller/rogue/api/worker.mjs
@@ -0,0 +1,29 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_live_suspended_caller/rogue/api/worker.mjs
+ *	@Date: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Sibling file of the unprivileged module, where its call resumes.
+ * @module api_test_live_suspended_caller.rogue.worker
+ */
+import { self } from "@cldmv/slothlet/runtime";
+import { attempt } from "../../shared/attempt.mjs";
+
+/**
+ * Wait on the gate, then try the extension's view — which this module may not reach.
+ * @param {Promise<void>} gate - Released by the test.
+ * @returns {Promise<string>} The render result, or `"denied"`.
+ */
+export async function drain(gate) {
+	await gate;
+	return attempt(() => self.ext.views.running.render("rogue"));
+}
diff --git a/api_tests/api_test_live_suspended_caller/run/boot.mjs b/api_tests/api_test_live_suspended_caller/run/boot.mjs
new file mode 100644
index 000000000..5c6e3b61f
--- /dev/null
+++ b/api_tests/api_test_live_suspended_caller/run/boot.mjs
@@ -0,0 +1,45 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_live_suspended_caller/run/boot.mjs
+ *	@Date: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Host boot step: activates one extension through its per-entity routine.
+ *
+ * @description
+ * `run.*` may call the extension's routine and its public entry, but not the extension's own views,
+ * so anything attributed to this leaf that reaches a view is denied.
+ *
+ * @module api_test_live_suspended_caller.run.boot
+ */
+import { self } from "@cldmv/slothlet/runtime";
+import { attempt } from "../shared/attempt.mjs";
+
+/**
+ * Activate the extension, then act according to `scenario` from this host flow.
+ * @param {string} scenario - Which follow-up to perform.
+ * @param {string} id - Extension moduleID to activate via `ext.activate.for(id)`.
+ * @param {Promise<void>} [gate] - Gate forwarded to the activation.
+ * @returns {Promise<*>} The follow-up's result.
+ */
+export async function boot(scenario, id, gate) {
+	const activation = await self.ext.activate.for(id)(scenario, gate);
+	await null;
+	// The extension's pinned render callback, invoked synchronously from this host flow.
+	if (scenario === "pinned") return self.registry.renderAll();
+	// A nested leaf of the extension, entered synchronously from this host flow.
+	if (scenario === "nested") return attempt(() => self.ext.entry.start());
+	// This leaf reaching the extension's view itself — the outer caller IS the right answer, and it is denied.
+	if (scenario === "direct") return attempt(() => self.ext.views.running.render("direct"));
+	// This leaf making a call it is permitted to make — the outer caller is right, and it is allowed.
+	if (scenario === "own") return attempt(() => self.registry.list());
+	return activation;
+}
diff --git a/api_tests/api_test_live_suspended_caller/run/chain.mjs b/api_tests/api_test_live_suspended_caller/run/chain.mjs
new file mode 100644
index 000000000..20e68c765
--- /dev/null
+++ b/api_tests/api_test_live_suspended_caller/run/chain.mjs
@@ -0,0 +1,29 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_live_suspended_caller/run/chain.mjs
+ *	@Date: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Host boot chain: the outermost suspended call, awaiting `run.boot`.
+ * @module api_test_live_suspended_caller.run.chain
+ */
+import { self } from "@cldmv/slothlet/runtime";
+
+/**
+ * Await the boot step, so this call stays suspended for the whole boot.
+ * @param {string} scenario - Scenario forwarded to `run.boot`.
+ * @param {string} id - Extension moduleID to activate.
+ * @param {Promise<void>} [gate] - Gate forwarded to the activation.
+ * @returns {Promise<*>} Whatever the boot step returned.
+ */
+export async function chain(scenario, id, gate) {
+	return await self.run.boot(scenario, id, gate);
+}
diff --git a/api_tests/api_test_live_suspended_caller/run/idle.mjs b/api_tests/api_test_live_suspended_caller/run/idle.mjs
new file mode 100644
index 000000000..c9dd31263
--- /dev/null
+++ b/api_tests/api_test_live_suspended_caller/run/idle.mjs
@@ -0,0 +1,27 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_live_suspended_caller/run/idle.mjs
+ *	@Date: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Host leaf that stays suspended on a gate, to hold a second call in flight.
+ * @module api_test_live_suspended_caller.run.idle
+ */
+
+/**
+ * Wait on the gate.
+ * @param {Promise<void>} gate - Released by the test.
+ * @returns {Promise<string>} `"idle"`.
+ */
+export async function idle(gate) {
+	await gate;
+	return "idle";
+}
diff --git a/api_tests/api_test_live_suspended_caller/run/kick.mjs b/api_tests/api_test_live_suspended_caller/run/kick.mjs
new file mode 100644
index 000000000..ba63692de
--- /dev/null
+++ b/api_tests/api_test_live_suspended_caller/run/kick.mjs
@@ -0,0 +1,33 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_live_suspended_caller/run/kick.mjs
+ *	@Date: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Privileged synchronous host leaf that starts an async call and does not await it.
+ *
+ * @description
+ * The started call settles after this leaf has returned, and settling restores the live runtime's
+ * caller field to this leaf — which by then is neither running nor suspended. Nothing executing
+ * afterwards may be attributed to it.
+ *
+ * @module api_test_live_suspended_caller.run.kick
+ */
+import { self } from "@cldmv/slothlet/runtime";
+
+/**
+ * Fire `run.quick` without awaiting it.
+ * @returns {string} `"kicked"`.
+ */
+export function kick() {
+	self.run.quick();
+	return "kicked";
+}
diff --git a/api_tests/api_test_live_suspended_caller/run/quick.mjs b/api_tests/api_test_live_suspended_caller/run/quick.mjs
new file mode 100644
index 000000000..f70bcb9c2
--- /dev/null
+++ b/api_tests/api_test_live_suspended_caller/run/quick.mjs
@@ -0,0 +1,26 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_live_suspended_caller/run/quick.mjs
+ *	@Date: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Privileged async host leaf that settles after one microtask.
+ * @module api_test_live_suspended_caller.run.quick
+ */
+
+/**
+ * Settle after a microtask.
+ * @returns {Promise<string>} `"quick"`.
+ */
+export async function quick() {
+	await null;
+	return "quick";
+}
diff --git a/api_tests/api_test_live_suspended_caller/shared/attempt.mjs b/api_tests/api_test_live_suspended_caller/shared/attempt.mjs
new file mode 100644
index 000000000..dc4c636a2
--- /dev/null
+++ b/api_tests/api_test_live_suspended_caller/shared/attempt.mjs
@@ -0,0 +1,56 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_live_suspended_caller/shared/attempt.mjs
+ *	@Date: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Shared test helper for the live suspended-caller fixture (#512).
+ *
+ * @description
+ * Lives in a folder the instance hides, so it is never an api leaf — it is plain module code, the
+ * way a package's internal helper is. Every fixture leaf reports a gated call through here, so a
+ * permission denial comes back as a value the suite can compare instead of a rejection.
+ *
+ * @module api_test_live_suspended_caller.shared.attempt
+ */
+
+/**
+ * Turn a permission denial into the string `"denied"`; rethrow anything else.
+ * @param {unknown} error - What the gated call threw or rejected with.
+ * @returns {string} `"denied"`.
+ * @throws {unknown} Any error other than PERMISSION_DENIED.
+ */
+function denied(error) {
+	if (error?.code === "PERMISSION_DENIED") return "denied";
+	throw error;
+}
+
+/**
+ * Run a gated call, turning a permission denial into the string `"denied"`.
+ *
+ * The call is made synchronously, so it is attributed to whoever is running at this moment. In lazy
+ * mode an unmaterialized leaf answers with a pending value and reports a denial by rejecting, so a
+ * thenable result is settled into the same shape.
+ * @param {Function} thunk - The gated call.
+ * @param {Function} [map] - Maps a permitted result before it is reported.
+ * @returns {*} The (mapped) result, or `"denied"` — a promise of either for a thenable result.
+ * @throws {Error} Any error other than PERMISSION_DENIED.
+ */
+export function attempt(thunk, map = (value) => value) {
+	let value;
+	try {
+		value = thunk();
+	} catch (error) {
+		return denied(error);
+	}
+	if (value && typeof value.then === "function") return Promise.resolve(value).then(map, denied);
+	return map(value);
+}
diff --git a/docs/HOOKS.md b/docs/HOOKS.md
index c3683f5db..c6ee40922 100644
--- a/docs/HOOKS.md
+++ b/docs/HOOKS.md
@@ -744,7 +744,7 @@ server.addHook(
 - The locked callback's caller identity is frozen, but the request context stays **live** — context set later in the request lifecycle is visible inside it.
 - `this` is forwarded, so framework-supplied `this` (the request/reply or the framework instance) is preserved.
 - Called with no active context (no module wrapper to capture), `lockCaller` is a no-op passthrough — it is meaningful only when called from inside a module.
-- **Runtime mode matters for async callbacks.** In **async** runtime mode the pinned identity propagates through `AsyncLocalStorage`, so `self.*` calls after an `await` still resolve to the registering module. In **live** runtime mode the caller is pinned only for the **synchronous** portion of the callback — the live context manager restores the previous wrapper as soon as the callback returns its promise. Once the synchronous `runInContext()` stack has unwound there may be **no slothlet caller at all**, so an `async` callback that `await`s before calling `self.*` resumes with whatever context is then active — typically none, and an identity probe sees `unknown`. Live mode keeps no per-async-task context; use **async** runtime mode for `async` hooks (like the example above) that must keep locked identity past their first `await`. `bind` is **not** an escape hatch here — it has the same live-mode limitation (see below); async runtime mode is the only fix.
+- **Runtime mode matters for async callbacks.** In **async** runtime mode the pinned identity propagates through `AsyncLocalStorage`, so `self.*` calls after an `await` still resolve to the registering module. In **live** runtime mode the pinned caller is held until the callback's promise settles, so `self.*` calls after an `await` resolve to the registering module as well. Live mode keeps no per-async-task context, though: while other module calls are suspended at the same time, the resumed callback is attributed from the call stack (see [PERMISSIONS.md → Overlapping calls](./PERMISSIONS.md#runtime-choice--the-permission-boundary)), which holds for cooperative code but is not an enforced guarantee. Use **async** runtime mode for `async` hooks (like the example above) whose locked identity is load-bearing past their first `await`. `bind` is **not** an escape hatch here — it has the same live-mode limitation (see below).
 
 ### `self.slothlet.lockCaller.caller(fn)` — pin the leaf's caller
 
diff --git a/docs/PERMISSIONS.md b/docs/PERMISSIONS.md
index e578e342a..f83bd8f46 100644
--- a/docs/PERMISSIONS.md
+++ b/docs/PERMISSIONS.md
@@ -127,6 +127,17 @@ One route does not read `self` at call time and so is not covered by that guard:
 
 That identity is a floor, not a substitute for the live caller: both are checked. Handing a captured reference to a module with fewer rights does not lend it anything, because the recipient is still enforced on its own account. Nothing changes for a module using its own reference, or for the host reading through the bound `api` object — with no module executing there is nothing to record, so host access is untouched.
 
+**Overlapping calls.** The live runtime's caller field can name only one call, and it is restored call by call as each settles — in settle order, not entry order — so once module calls overlap it can name a call that is suspended, or one that has already finished. Identity is therefore resolved from what is actually in flight, in this order:
+
+1. **A module entered synchronously is the caller** for as long as its body is on the stack — a nested leaf, or a callback pinned with `self.slothlet.lockCaller()` — however many other calls are suspended. An `await` continuation only resumes on an empty stack, so nothing else can be running underneath it.
+2. **With no module call in flight**, the caller is the host (or, inside a `run()` / `scope()` a module opened, that module).
+3. **With one call suspended**, that call is the caller.
+4. **With two or more suspended**, the call stack decides. The resumed code's frames are matched to a suspended call by their **location** — the file the call entered through, or any file under the root folder of the call's module (`base`, or the folder given to `api.slothlet.api.add()`; the deepest root wins when one module is mounted inside another's folder). Function names are never read, since a computed method name can spell out another module's path. A stack with no suspended call on it is the host's (rule 2).
+
+When the stack reaches a module that has several different api paths suspended and no frame tells them apart — they resume in a file they share, and none of their own entry files is on the stack — identity is **unresolved** and the access is refused rather than guessed.
+
+Because this reads locations, it inherits their limits: code in a file outside every module root (a helper folder beside the mounted api folder) is attributed to the next frame outward, usually the call that awaited it, or to the host when there is no module frame at all; a module running another module's file (a raw import of its helper) is attributed to the module that owns the folder; a bundle that merges files, or a `//# sourceURL=` comment that renames a script, changes the locations an engine reports. These are the cooperative-boundary terms described above.
+
 That is why the live runtime is a cooperative boundary and the async runtime is an enforced one. In Node, prefer the default async runtime whenever the permission system is load-bearing; reach for `runtime: "live"` when the host cannot provide `async_hooks`, and treat its enforcement as least-privilege among modules you trust.
 
 **In the browser the module-privacy guarantee does not hold either**, and cannot. Every module slothlet serves — its own internals _and_ your API leaves — is a plain URL that any script on the page can `import()` directly, regardless of `exports` / `imports` or the importmap; hiding a specifier does not hide the file. Any same-origin script also has full DOM / network / storage / global authority, so it can reach shared state and interfere with setup. Browsers provide real isolation only through **iframes / Web Workers**, which the _application_ must architect — a library cannot impose it.
diff --git a/src/lib/builders/api_builder.mjs b/src/lib/builders/api_builder.mjs
index 46f8ade76..0a7f46d17 100644
--- a/src/lib/builders/api_builder.mjs
+++ b/src/lib/builders/api_builder.mjs
@@ -370,10 +370,8 @@ export class ApiBuilder extends ComponentBase {
 			// high-privilege `slothlet.*` surface.
 			const identity = slothlet.contextManager?.getCallerIdentity?.(slothlet.instanceID);
 			// Ambiguous and unattributable: deny rather than fall through to the host exemption below.
-			// Same unreachable-from-the-suite AMBIGUOUS signal as the other enforcement points; see
-			// context-live. Refusing here is what keeps the internal namespace closed to a caller that
-			// cannot be attributed.
-			/* v8 ignore next 3 */
+			// Same AMBIGUOUS signal as the other enforcement points; see context-live. Refusing here is
+			// what keeps the internal namespace closed to a caller that cannot be attributed.
 			if (identity?.unresolved) {
 				throw new slothlet.SlothletError("PERMISSION_DENIED", { caller: null, target: targetPath });
 			}
@@ -419,7 +417,6 @@ export class ApiBuilder extends ComponentBase {
 			// Per-flow identity, for the same reason as enforceInternalPermission above.
 			const identity = slothlet.contextManager?.getCallerIdentity?.(slothlet.instanceID);
 			// Unattributable under concurrency — refuse the traversal rather than guess.
-			/* v8 ignore next — as above: unresolved comes from a stack shape the suite cannot produce. */
 			if (identity?.unresolved) return false;
 			const callerWrapper = identity?.currentWrapper;
 			// Defensive guard: only reached from the proxy get trap while a currentWrapper is active.
diff --git a/src/lib/handlers/context-live.mjs b/src/lib/handlers/context-live.mjs
index a9bbf558f..300e30829 100644
--- a/src/lib/handlers/context-live.mjs
+++ b/src/lib/handlers/context-live.mjs
@@ -63,6 +63,110 @@ let liveContextManagerRef = null;
 
 const escapeForRegExp = (literal) => literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 
+/**
+ * Reduce a source location — a filesystem path or a URL — to a form two spellings of the same file
+ * compare equal in.
+ *
+ * A stack frame names a module by URL (`file:///…/x.mjs?slothlet_instance=…`, percent-encoded),
+ * while a wrapper records its file and a module its root folder as whatever the loader was handed —
+ * usually a plain path. The scheme, query, hash and percent-encoding are dropped from a URL,
+ * separators are made forward slashes, and a trailing slash is removed, so a root compares as a
+ * prefix of the files inside it.
+ *
+ * @param {string} value - A path or URL.
+ * @returns {string} The comparable form.
+ * @internal
+ *
+ * @example
+ * toComparablePath("file:///srv/app/api/x.mjs?slothlet_instance=a"); // "/srv/app/api/x.mjs"
+ * toComparablePath("C:\\app\\api\\"); // "C:/app/api"
+ */
+export function toComparablePath(value) {
+	// Some loaders (vitest's module runner among them) report a module by bare path with the loader's
+	// cache-busting query still attached, so a query is dropped from a plain path as well.
+	let text = String(value).replace(/\\/g, "/");
+	if (/^[a-z][a-z0-9+.-]*:\/\//i.test(text)) {
+		text = text.replace(/[?#].*$/, "");
+		try {
+			text = decodeURIComponent(text);
+		} catch {
+			// A malformed escape cannot name a real file differently than it is spelled; compare it raw.
+		}
+		text = text.replace(/^file:\/\//i, "");
+		// `file:///C:/x` → `C:/x`, the spelling a Windows path takes once its separators are normalised.
+		if (/^\/[a-z]:\//i.test(text)) text = text.slice(1);
+	} else {
+		text = text.replace(/\?.*$/, "");
+	}
+	return text.replace(/\/+$/, "");
+}
+
+/**
+ * Split one stack-trace line into the text naming the function and the location it runs at.
+ *
+ * Attribution must be decided by the location alone. The function name is printed first and is not
+ * trustworthy — a computed method key (`{ ["/path/to/other/module.mjs"]() {} }`) puts arbitrary text,
+ * including another module's path, into it. So the location is taken from where each engine puts
+ * it, never searched for anywhere in the line:
+ *
+ * - V8: `at name (location)` — the last balanced parenthesis group — or `at [async ]location`.
+ * - SpiderMonkey / JavaScriptCore: `name@location` — after the last `@` that starts a URL or path.
+ *
+ * The trailing `:line:column` is removed and the location reduced with {@link toComparablePath}.
+ *
+ * @param {string} line - One line of `Error#stack`.
+ * @returns {{head: string, path: string}|null} The text before the location and the location's
+ *   comparable path, or null for a line that is not a frame (the message line, an unbalanced one).
+ * @internal
+ *
+ * @example
+ * parseStackFrame("    at run (file:///srv/app/api/run.mjs?q=1:4:9)"); // { head: "at run ", path: "/srv/app/api/run.mjs" }
+ * parseStackFrame("run@http://host/api/run.mjs:4:9"); // { head: "run", path: "http://host/api/run.mjs" }
+ */
+export function parseStackFrame(line) {
+	const text = String(line).trim();
+	let head = "";
+	let location;
+	if (text.startsWith("at ")) {
+		if (text.endsWith(")")) {
+			// Walk back from the closing parenthesis to its partner, so a location containing
+			// parentheses of its own (`C:/Program Files (x86)/…`) stays whole.
+			let depth = 0;
+			let open = -1;
+			for (let index = text.length - 1; index >= 0; index--) {
+				if (text[index] === ")") depth++;
+				else if (text[index] === "(" && --depth === 0) {
+					open = index;
+					break;
+				}
+			}
+			if (open < 0) return null;
+			head = text.slice(0, open);
+			location = text.slice(open + 1, -1);
+		} else {
+			location = text.replace(/^at (?:async )?/, "");
+		}
+	} else {
+		let at = -1;
+		for (const match of text.matchAll(/@(?=[a-z][a-z0-9+.-]*:|\/)/gi)) at = match.index;
+		if (at < 0) return null;
+		head = text.slice(0, at);
+		location = text.slice(at + 1);
+	}
+	return { head, path: toComparablePath(location.replace(/:\d+(?::\d+)?$/, "")) };
+}
+
+/**
+ * Directory holding slothlet's own sources (`src/` or `dist/`).
+ *
+ * The frames at the top of every capture are the framework's — the gate, the wrapper, this
+ * resolver. They are never attributed to a module by folder, even when a module's root folder
+ * happens to contain slothlet's install (a base of `./` with slothlet in `node_modules`).
+ * @type {string}
+ * @private
+ */
+const FRAMEWORK_DIR = toComparablePath(new URL("../../", import.meta.url).href);
+
 /**
  * Live bindings context manager (direct global state)
  * Uses direct instance tracking without AsyncLocalStorage overhead.
@@ -86,12 +190,12 @@ export class LiveContextManager {
 	/**
 	 * Calls that have suspended at an `await` and not yet settled, for one instance.
 	 *
-	 * `currentWrapper` is one mutable field per store, so it can only name one call. While at most
-	 * one call is suspended it is necessarily that call's — nothing else is mid-flight to have
-	 * overwritten it — and the field can be trusted for free. Once two or more are suspended the
-	 * field names whichever entered last, and a call resuming from its `await` would read somebody
-	 * else's identity; {@link LiveContextManager#getCallerIdentity} resolves those from the call
-	 * stack instead.
+	 * `currentWrapper` is one mutable field per store, so it can only name one call, and it is
+	 * restored call by call as each settles — in settle order, not entry order — so once calls
+	 * overlap it can name a call that is not running, or one that has already finished. The set of
+	 * calls actually in flight is what {@link LiveContextManager#getCallerIdentity} reasons from
+	 * instead: one suspended call is necessarily the caller of anything that is not a synchronous
+	 * entry; two or more are told apart from the call stack.
 	 *
 	 * Tracked on the store rather than the manager because the manager is a singleton shared by
 	 * every instance: a set held there would treat two instances running concurrently as ambiguous
@@ -107,24 +211,64 @@ export class LiveContextManager {
 		return store.__suspendedCalls;
 	}
 
+	/**
+	 * Module calls whose function body is executing synchronously right now, innermost last.
+	 *
+	 * A wrapper is pushed immediately before its function is applied and popped as soon as that
+	 * application returns — for an async function, at its first `await`. While a wrapper is on this
+	 * stack its code (or code it called synchronously) is what is running: an `await` continuation
+	 * only ever resumes on an empty JavaScript stack, so no other flow can be executing underneath
+	 * it. The top entry is therefore the caller, with no ambiguity to resolve — which is what makes a
+	 * synchronously entered module (a nested leaf, or a `lockCaller`-pinned callback) attributable
+	 * even while other calls are suspended and their async frames sit further down the stack (#512).
+	 *
+	 * @param {object} store - Instance context store.
+	 * @returns {object[]} That store's synchronously-entered wrappers.
+	 * @private
+	 */
+	#enteredFor(store) {
+		if (!store.__enteredCalls) store.__enteredCalls = [];
+		return store.__enteredCalls;
+	}
+
+	/**
+	 * The identity a store carries when no module call is in flight on it.
+	 *
+	 * For an instance's base store that is no caller at all (host-initiated). For a `run()`/`scope()`
+	 * store it is the caller inherited from the store it was derived from, so a module-initiated scope
+	 * stays attributed to that module. Captured the first time the store is seen — before any call can
+	 * have changed `currentWrapper` — because afterwards the field can be left naming a finished call.
+	 *
+	 * @param {object} store - Instance context store.
+	 * @returns {object|null} The store's resting caller.
+	 * @private
+	 */
+	#baselineFor(store) {
+		if (!Object.prototype.hasOwnProperty.call(store, "__baselineWrapper")) store.__baselineWrapper = store.currentWrapper ?? null;
+		return store.__baselineWrapper;
+	}
+
 	/**
 	 * Resolve the caller identity for the call that is executing right now.
 	 *
 	 * Enforcement asks for identity through here rather than reading `store.currentWrapper`
-	 * directly, because that field can only name one call. Two paths:
+	 * directly, because that field can only name one call and is restored out of order once calls
+	 * overlap. In order:
 	 *
-	 * - **At most one call suspended** — the field is necessarily that call's (or a synchronous
-	 *   nested call's, which set it on the way in), so it is returned as-is. This is the ordinary
-	 *   case and costs nothing.
-	 * - **Two or more suspended** — the field names whichever entered last, so a call resuming
-	 *   from its `await` would read another module's identity and inherit its rights. The true
-	 *   caller is taken from the call stack instead: the gated access happens synchronously inside
-	 *   the caller's own function body, so its frame is on the stack. Interleaving can scramble a
-	 *   shared field; it cannot scramble the stack, since each flow has its own.
+	 * - **A synchronously entered call** — the top of the entered stack is executing now and is the
+	 *   answer outright, however many other calls are suspended (see {@link LiveContextManager#enteredFor}).
+	 * - **No call in flight** — the store's baseline: the host for an instance store, the inherited
+	 *   caller for a `run()`/`scope()` store.
+	 * - **One call suspended** — nothing else is in flight, so that call is the caller. The field is
+	 *   not consulted: a call that settled after the synchronous caller that started it had returned
+	 *   restores the field to that caller, which is then neither running nor suspended.
+	 * - **Two or more suspended** — the true caller is taken from the call stack. The gated access
+	 *   happens synchronously inside the resumed call's code, so a frame of it is on the stack;
+	 *   interleaving can scramble a shared field, but not the stack, since each flow has its own.
 	 *
-	 * Only the suspended calls are candidates, so this never needs a global file→module index —
-	 * and when the stack matches none of them (or matches ambiguously), identity is reported as
-	 * unresolved so enforcement fails closed rather than guessing.
+	 * Only the suspended calls are candidates, so when the stack names none of them the caller is not
+	 * one of the ambiguous calls and the baseline applies; when it names several it cannot tell apart,
+	 * identity is reported as unresolved so enforcement fails closed rather than guessing.
 	 *
 	 * Live runtime only. The async manager scopes identity per flow with AsyncLocalStorage and has
 	 * no such ambiguity.
@@ -153,57 +297,91 @@ export class LiveContextManager {
 		if (store.__authoritativeWrapper) {
 			return { currentWrapper: store.__authoritativeWrapper, callerWrapper: store.callerWrapper };
 		}
+		// Innermost synchronous entry that names a module. An entry without a wrapper (a context-only
+		// `runInContext`) does not change who is calling, so it is looked through.
+		const entered = this.#enteredFor(store);
+		for (let index = entered.length - 1; index >= 0; index--) {
+			if (entered[index]) return { currentWrapper: entered[index], callerWrapper: store.callerWrapper };
+		}
+
 		const suspended = this.#suspendedFor(store);
-		if (suspended.size < 2) {
-			return { currentWrapper: store.currentWrapper, callerWrapper: store.callerWrapper };
+		if (suspended.size === 0) return { currentWrapper: this.#baselineFor(store), callerWrapper: store.callerWrapper };
+		if (suspended.size === 1) {
+			const [only] = suspended;
+			return { currentWrapper: only.currentWrapper, callerWrapper: store.callerWrapper };
 		}
+
 		const resolved = this.#resolveSuspendedFromStack(suspended);
-		// One frame named several suspended calls at once (the same module suspended twice), so which of
-		// them is executing genuinely cannot be told. Deny rather than pick: report no caller AND mark it
-		// unresolved, so enforcement does not fall through to the host-initiated exemption and hand it
-		// that privilege.
-		//
-		// This case DOES occur — it is why the resolver has an unresolved answer at all — but the suite
-		// cannot reach it. Driving it needs the module visibly on the stack with no frame naming any of
-		// its suspended calls, and three approaches all failed to produce that: a module-private helper
-		// frame, a truncated `Error.stackTraceLimit`, and frames reformatted through
-		// `Error.prepareStackTrace` to carry the file path with no names. In each the resolver still
-		// attributed correctly, because V8 retains an async frame naming the export. It is reachable
-		// where that does not hold — minified bundles, renamed frames, engines that format stacks
-		// differently — which is exactly what this guard is for.
-		/* v8 ignore next 3 */
+		// The stack could not tell which of several suspended calls is executing: a frame named more
+		// than one of them (the same module suspended twice under different api paths, resuming in a
+		// file they share), and no frame further out pinned a single one. Deny rather than pick: report
+		// no caller AND mark it unresolved, so enforcement does not fall through to the host-initiated
+		// exemption and hand it that privilege.
 		if (resolved === AMBIGUOUS) {
 			return { currentWrapper: null, callerWrapper: store.callerWrapper, unresolved: true };
 		}
 		if (resolved) return { currentWrapper: resolved.currentWrapper, callerWrapper: store.callerWrapper };
 
-		// No suspended call is on the stack, so the caller is not one of the ambiguous ones and the
-		// ambiguity does not apply to it. It is either the host — which has no module frame by
-		// definition — or a module that entered synchronously and is therefore the field's current,
-		// accurate occupant. Distinguish by whether the field still names a suspended call: if it
-		// does it is stale (that call is parked at an `await`, not calling), so report no caller and
-		// let the trusted-root check decide, which admits a genuine host call and refuses a forged
-		// one. Otherwise the field is a fresh entry and is correct.
-		const fieldIsStale = [...suspended].some((entry) => entry.currentWrapper === store.currentWrapper);
-		if (fieldIsStale) return { currentWrapper: null, callerWrapper: store.callerWrapper };
-		return { currentWrapper: store.currentWrapper, callerWrapper: store.callerWrapper };
+		// No suspended call is on the stack, so the caller is not one of them, and nothing entered
+		// synchronously. What is running is the store's own resting flow — the host, or the scope's
+		// inherited caller — never whichever call the field happens to name.
+		return { currentWrapper: this.#baselineFor(store), callerWrapper: store.callerWrapper };
+	}
+
+	/**
+	 * Module root folders for the instances the candidates belong to, longest first.
+	 *
+	 * Taken from each instance's module cache — the folder every `base`/`api.add()` module was loaded
+	 * from — so a frame in any file of a module's folder can be attributed to that module, not only a
+	 * frame in the exact file its suspended call entered through. Synthetic (in-memory) modules have
+	 * no folder and contribute nothing. Longest first so a module mounted from inside another
+	 * module's folder owns its own files.
+	 *
+	 * @param {Array<{currentWrapper: object}>} candidates - Suspended calls being resolved.
+	 * @returns {Array<{moduleID: string, root: string}>} Module roots, longest first.
+	 * @private
+	 */
+	#moduleRootsFor(candidates) {
+		// Every candidate is a live wrapper, which always reaches its instance's cache; the optional
+		// chain guards a partially-built wrapper handed in by a direct caller.
+		/* v8 ignore next */
+		const caches = new Set(candidates.map((entry) => entry.currentWrapper?.slothlet?.handlers?.apiCacheManager).filter(Boolean));
+		const roots = [];
+		for (const cache of caches) {
+			for (const moduleID of cache.getAllModuleIDs()) {
+				const { folderPath } = cache.get(moduleID);
+				// No base directory (`base: null`) and in-memory modules have no folder to own files by.
+				if (typeof folderPath !== "string" || folderPath.startsWith("synthetic:")) continue;
+				roots.push({ moduleID, root: toComparablePath(folderPath) });
+			}
+		}
+		// An empty root (a module mounted from `/`) would own every absolute path; it owns nothing.
+		return roots.filter(({ root }) => root).sort((a, b) => b.root.length - a.root.length);
 	}
 
 	/**
 	 * Pick which suspended call the current stack belongs to.
 	 *
-	 * Matches the innermost stack frame that contains exactly one candidate's source path. Only a
-	 * substring test is used: a frame carries the module's path (plus the loader's cache-busting
-	 * query, and in a browser as a URL), while the syntax around it differs between V8,
-	 * SpiderMonkey and JavaScriptCore — so nothing else about the line is parsed.
+	 * Walks the frames innermost first, reading each frame's location (never its function name, see
+	 * {@link parseStackFrame}). A frame is matched to candidates two ways:
+	 *
+	 * - **by file** — the location is the file a candidate entered through;
+	 * - **by module** — otherwise, the location lies in a module's root folder and that module has
+	 *   suspended calls: a call that resumes in a helper or sibling file of its module (the entry
+	 *   file's frame is gone once a plain function hands back another file's promise) is still that
+	 *   module's (#512). The deepest root wins, so a module mounted inside another's folder owns its
+	 *   files; slothlet's own frames are never matched by module.
 	 *
-	 * The two negative outcomes are reported distinctly because they mean opposite things: a frame
-	 * naming several candidates is unattributable and must fail closed, while no frame at all means
-	 * the caller simply is not one of the suspended calls and the ambiguity does not concern it.
+	 * Enforcement keys on the api path, so a frame settles the answer only when its matches share
+	 * one. A by-file frame can also pin one of several by the function name before its location. A
+	 * frame matching several api paths otherwise narrows the answer to them: walking on is only
+	 * allowed to pick one of those, because an outer frame belonging to anything else is an outer
+	 * caller — the flow that awaited this one — not the code that is running. Ending the walk still
+	 * narrowed is ambiguous and fails closed.
 	 *
-	 * @param {Set<{currentWrapper: object, filePath: string|null}>} suspended - Candidate calls.
-	 * @returns {{currentWrapper: object, filePath: string}|symbol|null} The matching entry,
-	 *   {@link AMBIGUOUS} when a frame matches more than one candidate, or null when none matches.
+	 * @param {Set<{currentWrapper: object, filePath: string|null, comparablePath: string, moduleID: string|null, apiPath: string, fnName: string}>} suspended - Candidate calls.
+	 * @returns {object|symbol|null} The matching entry, {@link AMBIGUOUS} when the stack cannot tell
+	 *   several candidates apart, or null when no frame names any candidate.
 	 * @private
 	 */
 	#resolveSuspendedFromStack(suspended) {
@@ -211,6 +389,7 @@ export class LiveContextManager {
 		// they have no module frame to match. When only those are suspended, no candidate can match.
 		const candidates = [...suspended].filter((entry) => entry.filePath);
 		if (!candidates.length) return null;
+		const roots = this.#moduleRootsFor(candidates);
 
 		// Raise the frame budget for this capture only: the caller's frame sits below slothlet's own
 		// wrapper frames, and the default of 10 can cut it off in a deep chain.
@@ -233,37 +412,40 @@ export class LiveContextManager {
 		PristineError.stackTraceLimit = previousLimit;
 		PristineError.prepareStackTrace = previousPrepare;
 
-		// Innermost frame outwards. A frame that names the module but not one of the candidate
-		// functions — a module-private helper the leaf called on its way here — resolves nothing, so
-		// keep walking out until a frame does. Only if the module appears and no frame ever pins a
-		// single function is the result genuinely ambiguous.
-		let sawModuleFrame = false;
+		let narrowed = null;
 		for (const line of stack.split("\n")) {
-			const matched = candidates.filter((entry) => line.includes(entry.filePath));
-			if (!matched.length) continue;
-			sawModuleFrame = true;
-			if (matched.length === 1) return matched[0];
-
-			// Several suspended calls share this file. Enforcement keys on the api path, not on the
-			// invocation, so if they are all the same function the identity is the same whichever one
-			// is executing — nothing to disambiguate.
+			const frame = parseStackFrame(line);
+			if (!frame) continue;
+			// A browser-mode wrapper records its file relative to the manifest root, so a relative path
+			// matches as a whole-segment suffix of the frame's location; an absolute one must be equal.
+			let matched = candidates.filter((entry) => frame.path === entry.comparablePath || frame.path.endsWith("/" + entry.comparablePath));
+			const byFile = matched.length > 0;
+			if (!byFile) {
+				if (frame.path.startsWith(FRAMEWORK_DIR + "/")) continue;
+				const owner = roots.find(({ root }) => frame.path.startsWith(root + "/"));
+				if (!owner) continue;
+				matched = candidates.filter((entry) => entry.moduleID === owner.moduleID);
+				// A module with nothing suspended: its code is running on some candidate's behalf (a
+				// helper it lent), so keep walking out to that candidate.
+				if (!matched.length) continue;
+			}
+			if (narrowed) {
+				matched = matched.filter((entry) => narrowed.includes(entry));
+				if (!matched.length) return AMBIGUOUS;
+			}
 			if (new Set(matched.map((entry) => entry.apiPath)).size === 1) return matched[0];
 
-			// Different functions of one module: the frame names the function as well as the file.
-			// Only the text before the path is searched, so a name that also occurs inside the path
-			// cannot match by accident.
-			const head = line.slice(0, line.indexOf(matched[0].filePath));
-			const byName = matched.filter((entry) => entry.fnName && new RegExp(`\\b${escapeForRegExp(entry.fnName)}\\b`).test(head));
-			if (byName.length && new Set(byName.map((entry) => entry.apiPath)).size === 1) return byName[0];
+			// Different functions of one file: the frame names the function as well as the file. Only
+			// the text before the location is searched, so a name inside the path cannot match by
+			// accident. Not tried for a by-module frame — the function there is the helper's, not the
+			// candidate's.
+			if (byFile) {
+				const byName = matched.filter((entry) => entry.fnName && new RegExp(`\\b${escapeForRegExp(entry.fnName)}\\b`).test(frame.head));
+				if (byName.length && new Set(byName.map((entry) => entry.apiPath)).size === 1) return byName[0];
+			}
+			narrowed = matched;
 		}
-		// The module was on the stack but no frame pinned one of its suspended functions (anonymous
-		// or renamed frames), so fail closed. Never seeing it at all means the caller simply is not
-		// one of the suspended calls, which is a different answer entirely.
-		// The AMBIGUOUS arm is reachable — a module on the stack with no frame naming any of its suspended
-		// calls is what minified bundles and renamed frames produce — but the suite cannot manufacture it;
-		// see the note on the consumer above for the three approaches tried. The `null` arm is covered.
-		/* v8 ignore next */
-		return sawModuleFrame ? AMBIGUOUS : null;
+		return narrowed ? AMBIGUOUS : null;
 	}
 
 	/**
@@ -391,6 +573,9 @@ export class LiveContextManager {
 			});
 		}
 
+		// Pin the store's resting identity before anything below can change the field it is read from.
+		this.#baselineFor(store);
+
 		// Set current instance (synchronous)
 		const previousInstanceID = this.currentInstanceID;
 		const previousWrapper = store.currentWrapper;
@@ -425,8 +610,19 @@ export class LiveContextManager {
 			store.callerWrapper = previousCallerWrapper;
 		};
 
+		// Mark this call as executing synchronously for exactly as long as `fn` is on the stack — for an
+		// async function, up to its first `await`. Pushed unconditionally (a wrapper-less entry pushes
+		// null, which the resolver skips) so the pop below always removes what was pushed here.
+		const entered = this.#enteredFor(store);
+		entered.push(currentWrapper ?? null);
+
 		try {
-			const result = fn.apply(thisArg, args);
+			let result;
+			try {
+				result = fn.apply(thisArg, args);
+			} finally {
+				entered.pop();
+			}
 			// An async module function returns at its first `await`, long before its body is done.
 			// Restoring here would drop the caller identity for the rest of that body — and an absent
 			// caller reads as host-initiated, so every permission-gated read or call after an `await`
@@ -443,10 +639,17 @@ export class LiveContextManager {
 				// no filePath (see #resolveSuspendedFromStack).
 				/* v8 ignore next — a live wrapper always carries filePath/apiPath; the ?? on a present wrapper guards a partial mock. */
 				const apiPath = currentWrapper?.____slothletInternal?.apiPath ?? "";
+				/* v8 ignore next */
+				const filePath = currentWrapper?.____slothletInternal?.filePath ?? null;
 				const entry = {
 					currentWrapper,
+					filePath,
+					// The same file as a stack frame spells it, compared by the resolver (relative to the
+					// manifest root in browser mode).
+					comparablePath: toComparablePath(filePath),
+					// Owning module, so a frame in any file of that module can be attributed to this call.
 					/* v8 ignore next */
-					filePath: currentWrapper?.____slothletInternal?.filePath ?? null,
+					moduleID: currentWrapper?.____slothletInternal?.moduleID ?? null,
 					apiPath,
 					// Leaf segment of the api path — the function name as it appears in a stack frame,
 					// used to tell two functions of the same module apart.
diff --git a/src/lib/handlers/unified-wrapper.mjs b/src/lib/handlers/unified-wrapper.mjs
index d1ca9770a..134a3a11f 100644
--- a/src/lib/handlers/unified-wrapper.mjs
+++ b/src/lib/handlers/unified-wrapper.mjs
@@ -80,11 +80,8 @@ function resolveEnforcedCaller(wrapper, ctxOverride) {
 	const identity = ctxOverride !== undefined ? ctxOverride : wrapper.slothlet.contextManager?.getCallerIdentity?.(ownInstanceID);
 	// Identity was ambiguous and could not be attributed. Deny outright — falling through to the
 	// absent-caller branch below would hand it the host-initiated exemption, which is precisely
-	// the privilege it must not inherit.
-	// Downstream of the AMBIGUOUS signal in context-live, which the suite cannot produce (see the note
-	// there). The guard is what stops an unattributable caller inheriting the host-initiated exemption,
-	// so it stays regardless of being unreachable from here.
-	/* v8 ignore next */
+	// the privilege it must not inherit. This is context-live's ambiguous answer: two api paths of one
+	// module suspended and resuming in a file they share, with no frame to tell them apart (#512).
 	if (identity?.unresolved) return { verdict: "deny" };
 	const callerWrapper = identity?.currentWrapper;
 	if (!callerWrapper) {
diff --git a/tests/vitests/suites/context/context-live-suspended-caller.test.vitest.mjs b/tests/vitests/suites/context/context-live-suspended-caller.test.vitest.mjs
new file mode 100644
index 000000000..994b8e74f
--- /dev/null
+++ b/tests/vitests/suites/context/context-live-suspended-caller.test.vitest.mjs
@@ -0,0 +1,424 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/context/context-live-suspended-caller.test.vitest.mjs
+ *	@Date: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 18:00:00 -07:00 (1790644800)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Live-runtime caller attribution while two or more module calls are suspended (#512).
+ *
+ * @description
+ * The live runtime keeps caller identity in one field per store. Once two module calls are
+ * suspended at the same time that field cannot say which of them is running, so the caller is read
+ * off the call stack. V8's async stack traces also carry the `at async …` frames of the OUTER
+ * suspended calls, which is what these cases are about:
+ *
+ * - **A synchronously entered module** — a nested leaf, or a `lockCaller`-pinned callback — whose
+ *   own file is not a suspended call's was attributed to the outer suspended caller found further
+ *   down the stack (`run.boot` here, `run.runHostBootChain` downstream).
+ * - **A suspended call resuming in a sibling file of its module** was matched only by the exact
+ *   file it entered through, so it too fell through to the outer suspended caller.
+ *
+ * Both denied an extension its own leaves. The fixes must not open anything up, so the same suite
+ * pins the cases where a wrong answer would ELEVATE: a finished caller left behind in the field by
+ * an out-of-order settle, a leaf that started a privileged call and keeps running while that call is
+ * suspended, and a function whose NAME carries another module's path. Two concurrent calls resuming
+ * interleaved must still each be attributed to themselves, and a stack that cannot tell two api
+ * paths of one module apart must fail closed.
+ *
+ * Fixture (`api_tests/api_test_live_suspended_caller`): the base holds the host's `run.*` and
+ * `registry.*`; `ext/api` is mounted as `ext` (the extension, with its per-entity `activate`
+ * routine), `rogue/api` as `rogue` (a module permitted nothing on the extension). `run.*` may drive
+ * the extension's routine and entry but not its views; only `run.kick`/`run.quick` are privileged.
+ *
+ * @module tests/vitests/suites/context/context-live-suspended-caller
+ */
+
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, it, expect, afterEach, beforeAll } from "vitest";
+import slothlet from "@cldmv/slothlet";
+import { LiveContextManager, parseStackFrame, toComparablePath } from "#handlers/context-live";
+import { getMatrixConfigs, getBrowserMatrixConfigs, getManifest, makeBrowserConfig } from "../../setup/vitest-helper.mjs";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const ROOT = path.resolve(__dirname, "../../../../api_tests/api_test_live_suspended_caller");
+const EXT_DIR = `${ROOT}/ext/api`;
+const ROGUE_DIR = `${ROOT}/rogue/api`;
+
+const RULES = [
+	// The extension may reach all of its own leaves, and the host registry.
+	{ caller: "ext.**", target: "ext.**", effect: "allow" },
+	{ caller: "ext.**", target: "registry.**", effect: "allow" },
+	{ caller: "ext.**", target: "slothlet.permissions.**", effect: "allow" },
+	// The host's boot leaves may drive each other, the registry, and the extension's routine and entry
+	// — never its views or caches.
+	{ caller: "run.**", target: "run.**", effect: "allow" },
+	{ caller: "run.**", target: "registry.**", effect: "allow" },
+	{ caller: "run.**", target: "ext.entry.**", effect: "allow" },
+	// Two privileged host leaves, so a misattribution to them would be an elevation.
+	{ caller: "run.{kick,quick}", target: "ext.views.**", effect: "allow" },
+	{ caller: "rogue.**", target: "run.quick", effect: "allow" },
+	// Entry points anyone may call. A call made while exactly one module call is suspended is
+	// attributed to that call, so the suite's own driving calls must not depend on who that is.
+	{ caller: "**", target: "run.{chain,idle,kick}", effect: "allow" },
+	{ caller: "**", target: "rogue.**", effect: "allow" },
+	{ caller: "**", target: "ext.activate", effect: "allow" },
+	{ caller: "**", target: "ext.activate.**", effect: "allow" },
+	{ caller: "**", target: "ext.entry.wait", effect: "allow" }
+];
+
+const PLATFORMS = [
+	...getMatrixConfigs({ runtime: "live" }).map(({ name, config }) => ({ name: `node > ${name}`, config, browser: false })),
+	...getBrowserMatrixConfigs().map(({ name, config }) => ({ name: `browser > ${name}`, config, browser: true }))
+];
+
+let MANIFEST;
+
+beforeAll(async () => {
+	MANIFEST = await getManifest(ROOT);
+});
+
+/**
+ * A promise and the function that releases it.
+ * @returns {[Promise<void>, Function]} Gate and release.
+ */
+function gate() {
+	let release;
+	const promise = new Promise((resolve) => (release = resolve));
+	return [promise, release];
+}
+
+/**
+ * Let every pending microtask and one timer turn run.
+ * @returns {Promise<void>} Resolves on the next macrotask.
+ */
+const turn = () => new Promise((resolve) => setTimeout(resolve, 0));
+
+describe.each(PLATFORMS)("Live runtime > suspended caller attribution (#512) > $name", ({ config, browser }) => {
+	let api;
+
+	afterEach(async () => {
+		if (api) await api.shutdown();
+		api = null;
+	});
+
+	/**
+	 * Boot the host with the extension and the rogue module mounted.
+	 * @returns {Promise<{extID: string, rogueID: string}>} The mounted modules' ids.
+	 */
+	async function boot() {
+		const base = browser ? makeBrowserConfig(config, ROOT, MANIFEST) : { ...config, base: ROOT };
+		api = await slothlet({
+			...base,
+			hidden: ["ext", "rogue", "shared"],
+			routines: [{ name: "activate", mode: "manual", cascade: false }],
+			stackRoutines: true,
+			silent: true,
+			permissions: { defaultPolicy: "deny", rules: RULES }
+		});
+		const extID = await api.slothlet.api.add(["ext"], EXT_DIR);
+		const rogueID = await api.slothlet.api.add(["rogue"], ROGUE_DIR);
+		return { extID, rogueID };
+	}
+
+	describe("a synchronously entered module is attributed to itself, not to an outer suspended caller", () => {
+		it("a lockCaller-pinned callback the host invokes from its boot chain runs as the extension", async () => {
+			const { extID } = await boot();
+			// run.chain → run.boot → ext.activate.for(id) registers two pinned callbacks and settles;
+			// run.boot (still suspended inside run.chain) then renders them synchronously.
+			expect(await api.run.chain("pinned", extID)).toEqual(["rendered:pinned", "subscribed"]);
+		});
+
+		it("a nested leaf entered from the boot chain runs as itself", async () => {
+			const { extID } = await boot();
+			expect(await api.run.chain("nested", extID)).toEqual(["rendered:nested", "subscribed"]);
+		});
+
+		it("control: the outer suspended caller reaching the extension's view itself is still denied", async () => {
+			const { extID } = await boot();
+			expect(await api.run.chain("direct", extID)).toBe("denied");
+		});
+
+		it("control: the outer suspended caller keeps the calls it is permitted to make", async () => {
+			const { extID } = await boot();
+			expect(await api.run.chain("own", extID)).toBe(0);
+		});
+	});
+
+	describe("a suspended call resuming in a sibling file is attributed to its module", () => {
+		it("an activation that resumes in a sibling file reaches the extension's own leaves", async () => {
+			const { extID } = await boot();
+			const [released, release] = gate();
+			const pending = api.run.chain("sibling", extID, released);
+			await turn();
+			release();
+			expect(await pending).toEqual(["rendered:sibling", "subscribed"]);
+		});
+
+		it("a frame of the entry file further out still resolves the call when a shared file is ambiguous", async () => {
+			const { extID } = await boot();
+			const [activationGate, releaseActivation] = gate();
+			const [waitGate, releaseWait] = gate();
+			const activation = api.ext.activate.for(extID)("awaited", activationGate);
+			await turn();
+			// A second api path of the same module in flight: the sibling file alone cannot tell them apart.
+			const waiting = api.ext.entry.wait(waitGate);
+			await turn();
+			releaseActivation();
+			expect(await activation).toEqual(["rendered:sibling", "subscribed"]);
+			releaseWait();
+			expect(await waiting).toBe("waited");
+		});
+
+		it("two api paths of one module resuming in a shared file with nothing to tell them apart fail closed", async () => {
+			const { extID } = await boot();
+			const [activationGate, releaseActivation] = gate();
+			const [waitGate, releaseWait] = gate();
+			const activation = api.ext.activate.for(extID)("sibling", activationGate);
+			await turn();
+			const waiting = api.ext.entry.wait(waitGate);
+			await turn();
+			releaseActivation();
+			// ext.activate and ext.entry.wait may differ in rights; the stack names only their shared
+			// module, so neither is chosen. With no caller, `self` itself refuses (reported through the
+			// routine that ran the activation).
+			await expect(activation).rejects.toMatchObject({ code: "ROUTINE_FAILED", cause: { code: "RUNTIME_NO_ACTIVE_CONTEXT_SELF" } });
+			releaseWait();
+			expect(await waiting).toBe("waited");
+		});
+
+		it("an outer caller of another module is not chosen when the resumed module cannot be told apart", async () => {
+			const { extID } = await boot();
+			const [activationGate, releaseActivation] = gate();
+			const [waitGate, releaseWait] = gate();
+			// run.chain → run.boot → ext.activate.for(id), resuming in the sibling file.
+			const chained = api.run.chain("sibling", extID, activationGate);
+			await turn();
+			const waiting = api.ext.entry.wait(waitGate);
+			await turn();
+			releaseActivation();
+			// The sibling file narrows the caller to ext.activate or ext.entry.wait; run.boot's frame
+			// further out is the flow that awaited it, not a way to settle which of the two is running.
+			await expect(chained).rejects.toMatchObject({ code: "ROUTINE_FAILED", cause: { code: "RUNTIME_NO_ACTIVE_CONTEXT_SELF" } });
+			releaseWait();
+			expect(await waiting).toBe("waited");
+		});
+
+		it("references taken before the await are refused too when the caller cannot be told apart", async () => {
+			const { extID } = await boot();
+			const [activationGate, releaseActivation] = gate();
+			const [waitGate, releaseWait] = gate();
+			const activation = api.ext.activate.for(extID)("siblingCaptured", activationGate);
+			await turn();
+			const waiting = api.ext.entry.wait(waitGate);
+			await turn();
+			releaseActivation();
+			// Eager references are the leaves themselves, gated on whoever calls them — unresolved here, so
+			// denied rather than handed the host exemption. A lazy reference to a not-yet-loaded leaf is a
+			// pending value that carries the caller it was taken under (ext.activate), and is gated on that.
+			// The permissions namespace is gated on the live caller in both modes.
+			const expected = config.mode === "lazy" ? ["rendered:sibling", "subscribed", "denied"] : ["denied", "denied", "denied"];
+			expect(await activation).toEqual(expected);
+			releaseWait();
+			expect(await waiting).toBe("waited");
+		});
+	});
+
+	describe("concurrent calls stay attributed to themselves", () => {
+		it.each([
+			["extension released first", true],
+			["rogue released first", false]
+		])("two modules suspended together and resuming interleaved (%s)", async (_label, extensionFirst) => {
+			const { extID } = await boot();
+			const [extGate, releaseExt] = gate();
+			const [rogueGate, releaseRogue] = gate();
+			const extension = api.ext.activate.for(extID)("hold", extGate);
+			await turn();
+			const rogue = api.rogue.hold(rogueGate);
+			await turn();
+
+			// The host itself, while both are suspended: no module frame on the stack, so it is the host.
+			expect(await api.ext.views.running.render("host")).toBe("rendered:host");
+
+			if (extensionFirst) {
+				releaseExt();
+				expect(await extension).toBe("rendered:held");
+				releaseRogue();
+				expect(await rogue).toBe("denied");
+			} else {
+				releaseRogue();
+				expect(await rogue).toBe("denied");
+				releaseExt();
+				expect(await extension).toBe("rendered:held");
+			}
+		});
+	});
+
+	describe("nothing is attributed to a caller that is not running (no elevation)", () => {
+		it("a finished privileged caller left in the field by an out-of-order settle is not inherited (two suspended)", async () => {
+			await boot();
+			const [rogueGate, releaseRogue] = gate();
+			const [idleGate, releaseIdle] = gate();
+			const rogue = api.rogue.start(rogueGate);
+			await turn();
+			const idle = api.run.idle(idleGate);
+			await turn();
+			// run.kick (privileged, synchronous) starts run.quick and returns; run.quick settles after it
+			// and restores the field to run.kick — which is by then neither running nor suspended.
+			expect(await api.run.kick()).toBe("kicked");
+			await turn();
+			releaseRogue();
+			// rogue.start resumes in its sibling worker file.
+			expect(await rogue).toBe("denied");
+			releaseIdle();
+			expect(await idle).toBe("idle");
+		});
+
+		it("a finished privileged caller left in the field by an out-of-order settle is not inherited (one suspended)", async () => {
+			await boot();
+			const [rogueGate, releaseRogue] = gate();
+			const rogue = api.rogue.start(rogueGate);
+			await turn();
+			expect(await api.run.kick()).toBe("kicked");
+			await turn();
+			releaseRogue();
+			expect(await rogue).toBe("denied");
+		});
+
+		it("a leaf that starts a privileged call keeps its own identity while that call is suspended", async () => {
+			await boot();
+			expect(await api.rogue.fanout()).toBe("denied");
+		});
+
+		it("a function named after another module's source path is attributed by its location, not its name", async () => {
+			const { extID } = await boot();
+			const [extGate, releaseExt] = gate();
+			const [forgeGate, releaseForge] = gate();
+			const extension = api.ext.activate.for(extID)("hold", extGate);
+			await turn();
+			const forged = api.rogue.forge(forgeGate);
+			await turn();
+			releaseForge();
+			expect(await forged).toBe("denied");
+			releaseExt();
+			expect(await extension).toBe("rendered:held");
+		});
+	});
+});
+
+describe.each(getMatrixConfigs({ runtime: "live" }))(
+	"Live runtime > suspended caller attribution without a base directory (#512) > $name",
+	({ config }) => {
+		let api;
+
+		afterEach(async () => {
+			if (api) await api.shutdown();
+			api = null;
+		});
+
+		it("modules with no folder (no base, in-memory) own no frames; mounted modules still resolve", async () => {
+			api = await slothlet({
+				...config,
+				base: null,
+				routines: [{ name: "activate", mode: "manual", cascade: false }],
+				stackRoutines: true,
+				silent: true,
+				permissions: { defaultPolicy: "deny", rules: RULES }
+			});
+			const extID = await api.slothlet.api.add(["ext"], EXT_DIR);
+			await api.slothlet.api.add(["rogue"], ROGUE_DIR);
+			await api.slothlet.api.add("memory", { exports: { ping: () => "pong" } });
+
+			const [extGate, releaseExt] = gate();
+			const [rogueGate, releaseRogue] = gate();
+			const extension = api.ext.activate.for(extID)("hold", extGate);
+			await turn();
+			const rogue = api.rogue.start(rogueGate);
+			await turn();
+			releaseRogue();
+			expect(await rogue).toBe("denied");
+			releaseExt();
+			expect(await extension).toBe("rendered:held");
+		});
+	}
+);
+
+describe("Live runtime > stack frame locations (#512)", () => {
+	it("reads a V8 frame's location from its last balanced parenthesis group, ignoring the function name", () => {
+		expect(parseStackFrame("    at run (file:///srv/app/api/run.mjs?slothlet_instance=a&module=b:4:9)")).toEqual({
+			head: "at run ",
+			path: "/srv/app/api/run.mjs"
+		});
+		// A computed-key method name carrying another file's path does not become the location.
+		expect(parseStackFrame("    at /srv/app/ext/activate.mjs (file:///srv/app/rogue/forged.mjs:12:3)").path).toBe(
+			"/srv/app/rogue/forged.mjs"
+		);
+		// A location with parentheses of its own stays whole.
+		expect(parseStackFrame("    at f (C:/Program Files (x86)/app/api/run.mjs:1:2)").path).toBe("C:/Program Files (x86)/app/api/run.mjs");
+	});
+
+	it("reads a V8 frame without a function name, including an async one", () => {
+		expect(parseStackFrame("    at file:///srv/app/api/run.mjs:4:9")).toEqual({ head: "", path: "/srv/app/api/run.mjs" });
+		expect(parseStackFrame("    at async file:///srv/app/api/run.mjs:4:9").path).toBe("/srv/app/api/run.mjs");
+	});
+
+	it("reads a SpiderMonkey/JavaScriptCore frame after the last @ that starts a location", () => {
+		expect(parseStackFrame("run@http://host/app/api/run.mjs:4:9")).toEqual({ head: "run", path: "http://host/app/api/run.mjs" });
+		// A scoped package's @ inside the location is not mistaken for the separator.
+		expect(parseStackFrame("run@/srv/app/node_modules/@scope/pkg/api/run.mjs:4:9").path).toBe(
+			"/srv/app/node_modules/@scope/pkg/api/run.mjs"
+		);
+		expect(parseStackFrame("@file:///srv/app/api/run.mjs:4").path).toBe("/srv/app/api/run.mjs");
+	});
+
+	it("returns null for a line that is not a frame", () => {
+		expect(parseStackFrame("Error: boom")).toBeNull();
+		expect(parseStackFrame("    at broken (no-open-paren)) ")).toBeNull();
+	});
+
+	it("reduces paths and URLs to one comparable spelling", () => {
+		expect(toComparablePath("file:///srv/app/api/x.mjs?slothlet_instance=a#h")).toBe("/srv/app/api/x.mjs");
+		expect(toComparablePath("file:///srv/my%20app/api/x.mjs")).toBe("/srv/my app/api/x.mjs");
+		expect(toComparablePath("file:///C:/app/api/x.mjs")).toBe("C:/app/api/x.mjs");
+		expect(toComparablePath("C:\\app\\api\\")).toBe("C:/app/api");
+		// A malformed escape is compared as spelled.
+		expect(toComparablePath("file:///srv/app/100%/x.mjs")).toBe("/srv/app/100%/x.mjs");
+		expect(toComparablePath("run/boot.mjs")).toBe("run/boot.mjs");
+	});
+});
+
+describe("Live runtime > synchronous entries decide the caller (#512) [direct]", () => {
+	// Direct instantiation: the entered stack is internal bookkeeping, and these shapes — a
+	// context-only entry with no wrapper nested inside a module entry — are what the public paths
+	// produce only incidentally.
+	it("a context-only entry is looked through to the module entry around it", () => {
+		const manager = new LiveContextManager();
+		manager.initialize("direct-512");
+		const outer = { ____slothletInternal: { apiPath: "outer.fn", filePath: "/x/outer.mjs", moduleID: "m" } };
+		const seen = manager.runInContext(
+			"direct-512",
+			() => manager.runInContext("direct-512", () => manager.getCallerIdentity("direct-512"), null, []),
+			null,
+			[],
+			outer
+		);
+		expect(seen.currentWrapper).toBe(outer);
+		manager.cleanup("direct-512");
+	});
+
+	it("with no module entry and nothing suspended the store's baseline is the caller", () => {
+		const manager = new LiveContextManager();
+		manager.initialize("direct-512b");
+		const seen = manager.runInContext("direct-512b", () => manager.getCallerIdentity("direct-512b"), null, []);
+		expect(seen.currentWrapper).toBeNull();
+		manager.cleanup("direct-512b");
+	});
+});
diff --git a/types/src/lib/builders/api_builder.d.mts.map b/types/src/lib/builders/api_builder.d.mts.map
index 3f1178f0e..93609c51f 100644
--- a/types/src/lib/builders/api_builder.d.mts.map
+++ b/types/src/lib/builders/api_builder.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"api_builder.d.mts","sourceRoot":"","sources":["../../../../src/lib/builders/api_builder.mjs"],"names":[],"mappings":"AAmMA;;;;;;;;;;;;;GAaG;AACH;IACC,gCAAuC;IAEvC;;;;;;;OAOG;IACH,sBANW,MAAM,EAQhB;IAED;;;;;OAKG;IACH,8BAJW,MAAM,GACJ,OAAO,CAAC,MAAM,CAAC,CA6G3B;IAED;;;;;;;;;;;OAWG;IACH,gCAyoGC;IAED;;;;OAIG;IACH,+BA4BC;IAED;;;;OAIG;IACH,0BAgCC;IAED;;;;OAIG;IACH,4BAsTC;IAED;;;;;OAKG;IACH,8BAmEC;IAED;;;;;OAKG;IACH,uBAgCC;CACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAn8H6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"api_builder.d.mts","sourceRoot":"","sources":["../../../../src/lib/builders/api_builder.mjs"],"names":[],"mappings":"AAmMA;;;;;;;;;;;;;GAaG;AACH;IACC,gCAAuC;IAEvC;;;;;;;OAOG;IACH,sBANW,MAAM,EAQhB;IAED;;;;;OAKG;IACH,8BAJW,MAAM,GACJ,OAAO,CAAC,MAAM,CAAC,CA6G3B;IAED;;;;;;;;;;;OAWG;IACH,gCA+lGC;IAED;;;;OAIG;IACH,+BA4BC;IAED;;;;OAIG;IACH,0BAgCC;IAED;;;;OAIG;IACH,4BAsTC;IAED;;;;;OAKG;IACH,8BAmEC;IAED;;;;;OAKG;IACH,uBAgCC;CACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAz5H6B,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/lib/handlers/context-live.d.mts b/types/src/lib/handlers/context-live.d.mts
index e28db87cc..52b1bda6d 100644
--- a/types/src/lib/handlers/context-live.d.mts
+++ b/types/src/lib/handlers/context-live.d.mts
@@ -1,3 +1,48 @@
+/**
+ * Reduce a source location — a filesystem path or a URL — to a form two spellings of the same file
+ * compare equal in.
+ *
+ * A stack frame names a module by URL (`file:///…/x.mjs?slothlet_instance=…`, percent-encoded),
+ * while a wrapper records its file and a module its root folder as whatever the loader was handed —
+ * usually a plain path. The scheme, query, hash and percent-encoding are dropped from a URL,
+ * separators are made forward slashes, and a trailing slash is removed, so a root compares as a
+ * prefix of the files inside it.
+ *
+ * @param {string} value - A path or URL.
+ * @returns {string} The comparable form.
+ * @internal
+ *
+ * @example
+ * toComparablePath("file:///srv/app/api/x.mjs?slothlet_instance=a"); // "/srv/app/api/x.mjs"
+ * toComparablePath("C:\\app\\api\\"); // "C:/app/api"
+ */
+export function toComparablePath(value: string): string;
+/**
+ * Split one stack-trace line into the text naming the function and the location it runs at.
+ *
+ * Attribution must be decided by the location alone. The function name is printed first and is not
+ * trustworthy — a computed method key (`{ ["/path/to/other/module.mjs"]() {} }`) puts arbitrary text,
+ * including another module's path, into it. So the location is taken from where each engine puts
+ * it, never searched for anywhere in the line:
+ *
+ * - V8: `at name (location)` — the last balanced parenthesis group — or `at [async ]location`.
+ * - SpiderMonkey / JavaScriptCore: `name@location` — after the last `@` that starts a URL or path.
+ *
+ * The trailing `:line:column` is removed and the location reduced with {@link toComparablePath}.
+ *
+ * @param {string} line - One line of `Error#stack`.
+ * @returns {{head: string, path: string}|null} The text before the location and the location's
+ *   comparable path, or null for a line that is not a frame (the message line, an unbalanced one).
+ * @internal
+ *
+ * @example
+ * parseStackFrame("    at run (file:///srv/app/api/run.mjs?q=1:4:9)"); // { head: "at run ", path: "/srv/app/api/run.mjs" }
+ * parseStackFrame("run@http://host/api/run.mjs:4:9"); // { head: "run", path: "http://host/api/run.mjs" }
+ */
+export function parseStackFrame(line: string): {
+    head: string;
+    path: string;
+} | null;
 /**
  * Live bindings context manager (direct global state)
  * Uses direct instance tracking without AsyncLocalStorage overhead.
@@ -19,20 +64,23 @@ export class LiveContextManager {
      * Resolve the caller identity for the call that is executing right now.
      *
      * Enforcement asks for identity through here rather than reading `store.currentWrapper`
-     * directly, because that field can only name one call. Two paths:
+     * directly, because that field can only name one call and is restored out of order once calls
+     * overlap. In order:
      *
-     * - **At most one call suspended** — the field is necessarily that call's (or a synchronous
-     *   nested call's, which set it on the way in), so it is returned as-is. This is the ordinary
-     *   case and costs nothing.
-     * - **Two or more suspended** — the field names whichever entered last, so a call resuming
-     *   from its `await` would read another module's identity and inherit its rights. The true
-     *   caller is taken from the call stack instead: the gated access happens synchronously inside
-     *   the caller's own function body, so its frame is on the stack. Interleaving can scramble a
-     *   shared field; it cannot scramble the stack, since each flow has its own.
+     * - **A synchronously entered call** — the top of the entered stack is executing now and is the
+     *   answer outright, however many other calls are suspended (see {@link LiveContextManager#enteredFor}).
+     * - **No call in flight** — the store's baseline: the host for an instance store, the inherited
+     *   caller for a `run()`/`scope()` store.
+     * - **One call suspended** — nothing else is in flight, so that call is the caller. The field is
+     *   not consulted: a call that settled after the synchronous caller that started it had returned
+     *   restores the field to that caller, which is then neither running nor suspended.
+     * - **Two or more suspended** — the true caller is taken from the call stack. The gated access
+     *   happens synchronously inside the resumed call's code, so a frame of it is on the stack;
+     *   interleaving can scramble a shared field, but not the stack, since each flow has its own.
      *
-     * Only the suspended calls are candidates, so this never needs a global file→module index —
-     * and when the stack matches none of them (or matches ambiguously), identity is reported as
-     * unresolved so enforcement fails closed rather than guessing.
+     * Only the suspended calls are candidates, so when the stack names none of them the caller is not
+     * one of the ambiguous calls and the baseline applies; when it names several it cannot tell apart,
+     * identity is reported as unresolved so enforcement fails closed rather than guessing.
      *
      * Live runtime only. The async manager scopes identity per flow with AsyncLocalStorage and has
      * no such ambiguity.
diff --git a/types/src/lib/handlers/context-live.d.mts.map b/types/src/lib/handlers/context-live.d.mts.map
index 4609c1ee4..2259763ef 100644
--- a/types/src/lib/handlers/context-live.d.mts.map
+++ b/types/src/lib/handlers/context-live.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"context-live.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/context-live.mjs"],"names":[],"mappings":"AAiEA;;;;;;;;;;;;;GAaG;AACH;IAEE,yBAA0B;IAC1B,uBAA6B;IA2B9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,sCAZW,MAAM,GAQJ;QAAC,cAAc,EAAE,MAAM,GAAC,IAAI,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAC,GAAC,SAAS,CAkDhG;IAqGD;;;;OAIG;IACH,kDAgCC;IAED;;;;;;OAMG;IACH,8BALW,MAAM,WACN,MAAM,GACJ,MAAM,CAwBlB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,gCAhBW,MAAM,yBAEN,GAAC,gCAED,MAAM,cACN,OAAO,WAIP,OAAO,GAIL,GAAC,CA0Hb;IAED;;;;;OAKG;IACH,qBAJa,MAAM,CAuBlB;IAED;;;;;;;;;;;OAWG;IACH,kCATW,MAAM,GAMJ,MAAM,GAAC,SAAS,CAc5B;IAED;;;;OAIG;IACH,2BAHW,MAAM,QAyBhB;IAED;;;;OAIG;IACH,yBAHa,MAAM,CAclB;;CACD;AAED;;;GAGG;AACH,oDAA2D"}
\ No newline at end of file
+{"version":3,"file":"context-live.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/context-live.mjs"],"names":[],"mappings":"AAiEA;;;;;;;;;;;;;;;;;GAiBG;AACH,wCARW,MAAM,GACJ,MAAM,CAyBlB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,sCATW,MAAM,GACJ;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,IAAI,CAuC7C;AAaD;;;;;;;;;;;;;GAaG;AACH;IAEE,yBAA0B;IAC1B,uBAA6B;IAgE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,sCAZW,MAAM,GAQJ;QAAC,cAAc,EAAE,MAAM,GAAC,IAAI,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAC,GAAC,SAAS,CA6ChG;IA+ID;;;;OAIG;IACH,kDAgCC;IAED;;;;;;OAMG;IACH,8BALW,MAAM,WACN,MAAM,GACJ,MAAM,CAwBlB;IAED;;;;;;;;;;;;;OAaG;IACH,gCAZW,MAAM,yBAEN,GAAC,gCAED,MAAM,cACN,OAAO,GAIL,GAAC,CAmIb;IAED;;;;;OAKG;IACH,qBAJa,MAAM,CAuBlB;IAED;;;;;;;;;;;OAWG;IACH,kCATW,MAAM,GAMJ,MAAM,GAAC,SAAS,CAc5B;IAED;;;;OAIG;IACH,2BAHW,MAAM,QAyBhB;IAED;;;;OAIG;IACH,yBAHa,MAAM,CAclB;;CACD;AAED;;;GAGG;AACH,oDAA2D"}
\ No newline at end of file
diff --git a/types/src/lib/handlers/unified-wrapper.d.mts.map b/types/src/lib/handlers/unified-wrapper.d.mts.map
index f90d04420..da20f9e33 100644
--- a/types/src/lib/handlers/unified-wrapper.d.mts.map
+++ b/types/src/lib/handlers/unified-wrapper.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"unified-wrapper.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/unified-wrapper.mjs"],"names":[],"mappings":"AA0xBA;;;;;;;;;;;;;;;;;;GAkBG;AACH,4CAhBW,MAAM,GAAC,MAAM,GACX,OAAO,CAkBnB;AA02ID;;;;;;;;;;;GAWG;AACH,sCAPW,OAAO,GACL,cAAc,GAAC,IAAI,CAkB/B;AAn6ID;;;;;;;;GAQG;AACH,iCAHU,GAAG,CAAC,MAAM,CAAC,CAG2F;;;;;AAuEhH;;;;;;;;;;GAUG;AACH;IAuUC;;;;;;;;;;;;;;;;OAgBG;IACH,0BAsCC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,gCAiEC;IAzbD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,sBApCW,MAAM,mKAEd;QAAwB,IAAI,EAApB,MAAM;QACU,OAAO,EAAvB,MAAM;QACyB,WAAW;QACvB,eAAe;QAChB,UAAU;QACV,mBAAmB;QACpB,QAAQ;QACD,UAAU;QAGjB,QAAQ;QACR,YAAY;QACE,cAAc;QAI3B,eAAe;KAMzC,EA+NF;IAzQD;;;;;;;;;;;OAWG;IACH,4BAFa,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAC,SAAS,CAKzC;IA4PD;;;;;;;;;;OAUG;IACH,uEAHa,GAAC,CA+Bb;IAED;;;;OAIG;IACH,qBAHa,WAAS,MAAM,GAAC,IAAI,CAKhC;IAiJD;;;;;;;;;;;OAWG;IACH,sBA0CC;IAED;;;;;;;;;;;;OAYG;IACH,mBAkDC;IAED;;;;;;;;;OASG;IACH,qBAsDC;IAED;;;;OAIG;IACH,uBA4GC;IAED;;;;;;;;;OASG;IACH,qBAEC;IAED;;;;;;;;;OASG;IACH,sBAiBC;IAED;;;;;;;;;;OAUG;IACH,6BAohBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BA8PC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BA43BC;IAED;;;;;;OAMG;IACH,uCAuyDC;;CACD;8BA/mK6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"unified-wrapper.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/unified-wrapper.mjs"],"names":[],"mappings":"AAuxBA;;;;;;;;;;;;;;;;;;GAkBG;AACH,4CAhBW,MAAM,GAAC,MAAM,GACX,OAAO,CAkBnB;AA02ID;;;;;;;;;;;GAWG;AACH,sCAPW,OAAO,GACL,cAAc,GAAC,IAAI,CAkB/B;AAn6ID;;;;;;;;GAQG;AACH,iCAHU,GAAG,CAAC,MAAM,CAAC,CAG2F;;;;;AAuEhH;;;;;;;;;;GAUG;AACH;IAuUC;;;;;;;;;;;;;;;;OAgBG;IACH,0BAsCC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,gCAiEC;IAzbD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,sBApCW,MAAM,mKAEd;QAAwB,IAAI,EAApB,MAAM;QACU,OAAO,EAAvB,MAAM;QACyB,WAAW;QACvB,eAAe;QAChB,UAAU;QACV,mBAAmB;QACpB,QAAQ;QACD,UAAU;QAGjB,QAAQ;QACR,YAAY;QACE,cAAc;QAI3B,eAAe;KAMzC,EA+NF;IAzQD;;;;;;;;;;;OAWG;IACH,4BAFa,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAC,SAAS,CAKzC;IA4PD;;;;;;;;;;OAUG;IACH,uEAHa,GAAC,CA+Bb;IAED;;;;OAIG;IACH,qBAHa,WAAS,MAAM,GAAC,IAAI,CAKhC;IAiJD;;;;;;;;;;;OAWG;IACH,sBA0CC;IAED;;;;;;;;;;;;OAYG;IACH,mBAkDC;IAED;;;;;;;;;OASG;IACH,qBAsDC;IAED;;;;OAIG;IACH,uBA4GC;IAED;;;;;;;;;OASG;IACH,qBAEC;IAED;;;;;;;;;OASG;IACH,sBAiBC;IAED;;;;;;;;;;OAUG;IACH,6BAohBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BA8PC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BA43BC;IAED;;;;;;OAMG;IACH,uCAuyDC;;CACD;8BA5mK6B,2BAA2B"}
\ No newline at end of file

From eb8ce717043ff06c5278d25b7188f9d56d6e4443 Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Mon, 28 Sep 2026 19:56:27 -0700
Subject: [PATCH 20/49] fix(context): answer a host-pinned call as the host on
 the running-call stack

A call pinned to the host (`lockCaller.caller()` when the leaf's caller
is the host, #477) pushed `null` onto the running-call stack, which the
resolver looks through as a context-only entry. So a host-pinned job
invoked synchronously from inside a module call was attributed to that
module instead of running as the host.

Host pins now push a HOST_ENTRY marker that the resolver answers as "no
module caller". #477's "a leaf called from the host pins no module
caller" test covers it (it failed in the live configs before this).
---
 src/lib/handlers/context-live.mjs             | 16 +++++++++++++---
 types/src/lib/builders/api_builder.d.mts.map  |  2 +-
 types/src/lib/handlers/context-live.d.mts.map |  2 +-
 3 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/src/lib/handlers/context-live.mjs b/src/lib/handlers/context-live.mjs
index 300e30829..34453854a 100644
--- a/src/lib/handlers/context-live.mjs
+++ b/src/lib/handlers/context-live.mjs
@@ -29,6 +29,14 @@ import { setApiCallerPinner } from "@cldmv/slothlet/helpers/caller-pinning";
  */
 const AMBIGUOUS = Symbol("slothlet.callerIdentity.ambiguous");
 
+/**
+ * Marks a call pinned to the host (`runInContext(..., asHost)`, from `lockCaller.caller()` when the
+ * pinned caller is the host) on the running-call stack. Unlike a context-only entry, which is looked
+ * through, it answers "no module caller": the pinned callback runs as the host even when a module
+ * invoked it synchronously.
+ */
+const HOST_ENTRY = Symbol("slothlet.callerIdentity.host");
+
 /**
  * The `Error` constructor as it was at module load, before any leaf could run.
  *
@@ -223,7 +231,7 @@ export class LiveContextManager {
 	 * even while other calls are suspended and their async frames sit further down the stack (#512).
 	 *
 	 * @param {object} store - Instance context store.
-	 * @returns {object[]} That store's synchronously-entered wrappers.
+	 * @returns {Array<object|symbol|null>} That store's synchronously-entered wrappers (`null` for a context-only entry, `HOST_ENTRY` for a host pin).
 	 * @private
 	 */
 	#enteredFor(store) {
@@ -298,9 +306,11 @@ export class LiveContextManager {
 			return { currentWrapper: store.__authoritativeWrapper, callerWrapper: store.callerWrapper };
 		}
 		// Innermost synchronous entry that names a module. An entry without a wrapper (a context-only
-		// `runInContext`) does not change who is calling, so it is looked through.
+		// `runInContext`) does not change who is calling, so it is looked through. A host pin does:
+		// the callback runs as the host, even when a module invoked it synchronously (#477).
 		const entered = this.#enteredFor(store);
 		for (let index = entered.length - 1; index >= 0; index--) {
+			if (entered[index] === HOST_ENTRY) return { currentWrapper: null, callerWrapper: null };
 			if (entered[index]) return { currentWrapper: entered[index], callerWrapper: store.callerWrapper };
 		}
 
@@ -614,7 +624,7 @@ export class LiveContextManager {
 		// async function, up to its first `await`. Pushed unconditionally (a wrapper-less entry pushes
 		// null, which the resolver skips) so the pop below always removes what was pushed here.
 		const entered = this.#enteredFor(store);
-		entered.push(currentWrapper ?? null);
+		entered.push(asHost ? HOST_ENTRY : (currentWrapper ?? null));
 
 		try {
 			let result;
diff --git a/types/src/lib/builders/api_builder.d.mts.map b/types/src/lib/builders/api_builder.d.mts.map
index 93609c51f..8a6c9b6d0 100644
--- a/types/src/lib/builders/api_builder.d.mts.map
+++ b/types/src/lib/builders/api_builder.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"api_builder.d.mts","sourceRoot":"","sources":["../../../../src/lib/builders/api_builder.mjs"],"names":[],"mappings":"AAmMA;;;;;;;;;;;;;GAaG;AACH;IACC,gCAAuC;IAEvC;;;;;;;OAOG;IACH,sBANW,MAAM,EAQhB;IAED;;;;;OAKG;IACH,8BAJW,MAAM,GACJ,OAAO,CAAC,MAAM,CAAC,CA6G3B;IAED;;;;;;;;;;;OAWG;IACH,gCA+lGC;IAED;;;;OAIG;IACH,+BA4BC;IAED;;;;OAIG;IACH,0BAgCC;IAED;;;;OAIG;IACH,4BAsTC;IAED;;;;;OAKG;IACH,8BAmEC;IAED;;;;;OAKG;IACH,uBAgCC;CACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAz5H6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"api_builder.d.mts","sourceRoot":"","sources":["../../../../src/lib/builders/api_builder.mjs"],"names":[],"mappings":"AAmMA;;;;;;;;;;;;;GAaG;AACH;IACC,gCAAuC;IAEvC;;;;;;;OAOG;IACH,sBANW,MAAM,EAQhB;IAED;;;;;OAKG;IACH,8BAJW,MAAM,GACJ,OAAO,CAAC,MAAM,CAAC,CA6G3B;IAED;;;;;;;;;;;OAWG;IACH,gCA2qGC;IAED;;;;OAIG;IACH,+BA4BC;IAED;;;;OAIG;IACH,0BAgCC;IAED;;;;OAIG;IACH,4BAsTC;IAED;;;;;OAKG;IACH,8BAmEC;IAED;;;;;OAKG;IACH,uBAgCC;CACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAr+H6B,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/lib/handlers/context-live.d.mts.map b/types/src/lib/handlers/context-live.d.mts.map
index 2259763ef..1b57f4c9a 100644
--- a/types/src/lib/handlers/context-live.d.mts.map
+++ b/types/src/lib/handlers/context-live.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"context-live.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/context-live.mjs"],"names":[],"mappings":"AAiEA;;;;;;;;;;;;;;;;;GAiBG;AACH,wCARW,MAAM,GACJ,MAAM,CAyBlB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,sCATW,MAAM,GACJ;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,IAAI,CAuC7C;AAaD;;;;;;;;;;;;;GAaG;AACH;IAEE,yBAA0B;IAC1B,uBAA6B;IAgE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,sCAZW,MAAM,GAQJ;QAAC,cAAc,EAAE,MAAM,GAAC,IAAI,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAC,GAAC,SAAS,CA6ChG;IA+ID;;;;OAIG;IACH,kDAgCC;IAED;;;;;;OAMG;IACH,8BALW,MAAM,WACN,MAAM,GACJ,MAAM,CAwBlB;IAED;;;;;;;;;;;;;OAaG;IACH,gCAZW,MAAM,yBAEN,GAAC,gCAED,MAAM,cACN,OAAO,GAIL,GAAC,CAmIb;IAED;;;;;OAKG;IACH,qBAJa,MAAM,CAuBlB;IAED;;;;;;;;;;;OAWG;IACH,kCATW,MAAM,GAMJ,MAAM,GAAC,SAAS,CAc5B;IAED;;;;OAIG;IACH,2BAHW,MAAM,QAyBhB;IAED;;;;OAIG;IACH,yBAHa,MAAM,CAclB;;CACD;AAED;;;GAGG;AACH,oDAA2D"}
\ No newline at end of file
+{"version":3,"file":"context-live.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/context-live.mjs"],"names":[],"mappings":"AAyEA;;;;;;;;;;;;;;;;;GAiBG;AACH,wCARW,MAAM,GACJ,MAAM,CAyBlB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,sCATW,MAAM,GACJ;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,IAAI,CAuC7C;AAaD;;;;;;;;;;;;;GAaG;AACH;IAEE,yBAA0B;IAC1B,uBAA6B;IAgE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,sCAZW,MAAM,GAQJ;QAAC,cAAc,EAAE,MAAM,GAAC,IAAI,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAC,GAAC,SAAS,CA+ChG;IAgJD;;;;OAIG;IACH,kDAgCC;IAED;;;;;;OAMG;IACH,8BALW,MAAM,WACN,MAAM,GACJ,MAAM,CAwBlB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,gCAhBW,MAAM,yBAEN,GAAC,gCAED,MAAM,cACN,OAAO,WAIP,OAAO,GAIL,GAAC,CA+Ib;IAED;;;;;OAKG;IACH,qBAJa,MAAM,CAuBlB;IAED;;;;;;;;;;;OAWG;IACH,kCATW,MAAM,GAMJ,MAAM,GAAC,SAAS,CAc5B;IAED;;;;OAIG;IACH,2BAHW,MAAM,QAyBhB;IAED;;;;OAIG;IACH,yBAHa,MAAM,CAclB;;CACD;AAED;;;GAGG;AACH,oDAA2D"}
\ No newline at end of file

From 6edafe567cb9ddb2995e3c4bc2c02eb56322e2b3 Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Mon, 28 Sep 2026 20:05:24 -0700
Subject: [PATCH 21/49] chore: add the missing file header to
 event-rule-condition-context.test.vitest.mjs

---
 .../event-rule-condition-context.test.vitest.mjs  | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/tests/vitests/suites/permissions/event-rule-condition-context.test.vitest.mjs b/tests/vitests/suites/permissions/event-rule-condition-context.test.vitest.mjs
index b8e38f3d6..cb76a98e2 100644
--- a/tests/vitests/suites/permissions/event-rule-condition-context.test.vitest.mjs
+++ b/tests/vitests/suites/permissions/event-rule-condition-context.test.vitest.mjs
@@ -1,13 +1,16 @@
 /**
  *	@Project: @cldmv/slothlet
  *	@Filename: /tests/vitests/suites/permissions/event-rule-condition-context.test.vitest.mjs
- *
- * Event-rule conditions see the same `ctx` as call-rule conditions (#511): the user context set by
- * `context.run()`, not the whole async-context store. Covers both event-side resolution sites — the
- * host `event.resolveLevel()` query and the per-emit re-resolution of a subscriber when a conditional
- * event rule is present — for object (deep-match) and function conditions, and pins parity with a
- * call rule carrying the identical condition, checked through `global.checkAccess` in the same scope.
+ *	@Date: 2026-09-28T17:05:22-07:00 (1790640322)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 20:02:02 -07:00 (1790650922)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
  */
+
 import { describe, it, expect, afterEach } from "vitest";
 import slothlet from "@cldmv/slothlet";
 import { TEST_DIRS } from "../../setup/vitest-helper.mjs";

From 830687d4d6a9763b994cf35a8da193fbb7aba9d2 Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Mon, 28 Sep 2026 14:17:18 -0700
Subject: [PATCH 22/49] feat(hooks): add an around hook type that wraps the
 call pipeline

`hook.on("<pattern>:around", ({ path, args, next, caller, entry }) => next(args))`
wraps the rest of the pipeline. `next(args?)` runs the remaining (lower
priority) around hooks, then the before hooks, the function and the after
hooks, and returns the result or throws the error; with no argument it
forwards the current args. A handler that never calls `next` short-circuits
and its return value is the result. Calling `next` twice throws
HOOK_AROUND_NEXT_CALLED_TWICE; a non-array argument throws
HOOK_AROUND_NEXT_INVALID_ARGS.

Order, outermost first: always/error observers -> around hooks (highest
priority outermost) -> before -> function -> after. Inside an around
pipeline, before/after/function failures are recorded with their source
and propagate through next(), so error hooks and suppressErrors apply only
to what escapes the around chain: an error an around swallows is never
reported, a rethrown one is reported once with its original source, and an
error an around throws itself carries a new `around` source type. always
fires once after the chain settles. Paths without around hooks keep the
existing pipelines untouched; the per-path dispatch strategy gains
`hasAround`/`asyncAround`.

`entry` is true when the call has no module caller in the active flow (the
condition under which metadata.caller() inside the target is null) and
`caller` is that caller's metadata. Around hooks fire for nested calls too,
each with its own next().

Sync/async follows the before/after rule: a synchronous around keeps a
synchronous call synchronous, an async (or `{ async: true }`) one promotes
the call, including the promotion guard and the epoch-cached strategy. On
the synchronous pipeline a handler may only return a thenable that its own
next() returned (a plain promise-returning target passed through); any
other thenable fails with HOOK_AROUND_RETURNED_PROMISE. next() starts the
rest of the pipeline synchronously, so `als.run(store, () => next())`
exposes the store to the target, including after an await inside it.

Around hooks are permission-gated like before hooks (`pattern:around`
targets, `:hook` covers them, fire-time glob filtering) and force-pinned
when registered from a module. A pinned around's next() re-enters the
intercepted call's own flow (new captureFlow/runInFlow on both context
managers) so the target still sees its real caller, not the hook owner.

New error codes are translated in all 12 languages; HOOKS.md,
PERMISSIONS.md and the hook JSDoc document the type.

Fixes #496
---
 README.md                                     |   2 +-
 docs/HOOKS.md                                 | 106 +++-
 docs/LIFECYCLE.md                             |   2 +-
 docs/PERMISSIONS.md                           |   2 +-
 src/lib/builders/api_builder.mjs              |   7 +-
 src/lib/handlers/context-async.mjs            |  28 +
 src/lib/handlers/context-live.mjs             |  46 ++
 src/lib/handlers/hook-manager.mjs             | 223 +++++++-
 src/lib/handlers/permission-manager.mjs       |   8 +-
 src/lib/handlers/unified-wrapper.mjs          | 174 +++++-
 src/lib/i18n/languages/de-de.json             |   6 +
 src/lib/i18n/languages/en-gb.json             |   6 +
 src/lib/i18n/languages/en-us.json             |   6 +
 src/lib/i18n/languages/es-es.json             |   6 +
 src/lib/i18n/languages/es-mx.json             |   6 +
 src/lib/i18n/languages/fr-fr.json             |   6 +
 src/lib/i18n/languages/hi-in.json             |   6 +
 src/lib/i18n/languages/ja-jp.json             |   6 +
 src/lib/i18n/languages/ko-kr.json             |   6 +
 src/lib/i18n/languages/pt-br.json             |   6 +
 src/lib/i18n/languages/ru-ru.json             |   6 +
 src/lib/i18n/languages/zh-cn.json             |   6 +
 src/slothlet.mjs                              |   2 +-
 .../hooks/hooks-around-async.test.vitest.mjs  | 425 +++++++++++++++
 .../hooks-around-permissions.test.vitest.mjs  | 153 ++++++
 .../suites/hooks/hooks-around.test.vitest.mjs | 515 ++++++++++++++++++
 tools/ci/i18n-latin-tokens-accepted.json      |   4 +
 types/src/lib/builders/api_builder.d.mts.map  |   2 +-
 types/src/lib/handlers/context-async.d.mts    |  26 +
 .../src/lib/handlers/context-async.d.mts.map  |   2 +-
 types/src/lib/handlers/context-live.d.mts     |  34 ++
 types/src/lib/handlers/context-live.d.mts.map |   2 +-
 types/src/lib/handlers/hook-manager.d.mts     | 107 +++-
 types/src/lib/handlers/hook-manager.d.mts.map |   2 +-
 .../src/lib/handlers/permission-manager.d.mts |   4 +-
 .../lib/handlers/unified-wrapper.d.mts.map    |   2 +-
 36 files changed, 1898 insertions(+), 52 deletions(-)
 create mode 100644 tests/vitests/suites/hooks/hooks-around-async.test.vitest.mjs
 create mode 100644 tests/vitests/suites/hooks/hooks-around-permissions.test.vitest.mjs
 create mode 100644 tests/vitests/suites/hooks/hooks-around.test.vitest.mjs

diff --git a/README.md b/README.md
index 7def8cb3a..6f05637aa 100644
--- a/README.md
+++ b/README.md
@@ -243,7 +243,7 @@ await api.slothlet.materialize.wait(); // optional: gate traffic on ready
 
 ## 🎣 Hooks
 
-Four hook types (`before`, `after`, `always`, `error`) with three-phase subset ordering (`"before"` → `"primary"` → `"after"`), pattern matching, priority, and runtime enable/disable.
+Five hook types (`before`, `after`, `always`, `error`, `around`) with three-phase subset ordering (`"before"` → `"primary"` → `"after"`), pattern matching, priority, and runtime enable/disable.
 
 ```javascript
 const api = await slothlet({ dir: "./api", hook: true });
diff --git a/docs/HOOKS.md b/docs/HOOKS.md
index c6ee40922..ec9815e44 100644
--- a/docs/HOOKS.md
+++ b/docs/HOOKS.md
@@ -8,11 +8,11 @@ Hooks work across all loading modes (eager/lazy) and runtime types (async/live),
 
 **Key capabilities:**
 
-- Four hook types: `before`, `after`, `always`, and `error`
+- Five hook types: `before`, `after`, `always`, `error`, and `around`
 - Pattern matching with wildcards, brace expansion, and negation
 - Priority-based execution ordering within three-phase subsets
 - Runtime enable/disable globally or by filter
-- Short-circuit execution support
+- Short-circuit execution support (from a `before` hook, or an `around` hook that never calls `next`)
 - Synchronous hooks with correct async function handling
 - Zero-overhead when disabled
 
@@ -97,11 +97,21 @@ if (result === undefined) {
 
 ### Error Flow
 
-1. Error occurs (in before hook, function, or after hook)
+1. Error occurs (in an around hook, before hook, the function, or an after hook)
 2. Error hooks execute with full source context
 3. If `suppressErrors: false` → error is re-thrown
 4. If `suppressErrors: true` → error is NOT thrown; function returns `undefined`
 
+The full pipeline, outermost first:
+
+```text
+always / error observers
+└─ around hooks (highest priority outermost, nesting down)
+   └─ before hooks → function → after hooks
+```
+
+The observers sit **outside** the around hooks, so they see exactly what the caller receives. On a path with `around` hooks, a failure inside the pipeline propagates through `next()` so an around hook can handle it: an error an around hook catches and swallows never reaches the error hooks, and one it rethrows (after a rollback, say) reaches them once, carrying the source of wherever it was first thrown. `suppressErrors` applies to what escapes the around chain. Error hooks and `always` hooks on such a path receive the arguments the caller passed, since that is the call they observe.
+
 ---
 
 ## Hook Types
@@ -133,6 +143,33 @@ Executes after the function completes regardless of success or failure. Receives
 
 Executes only when an error occurs. Receives the error with detailed source tracking (where the error originated - before hook, the function itself, after hook, etc.).
 
+### around
+
+Wraps the rest of the pipeline — lower-priority around hooks, then before hooks, the function and after hooks — the way middleware does. The handler receives `next(args?)`, which runs everything inside it and returns its result or throws its error. Can:
+
+- Replace the arguments (`next(newArgs)`) — `next()` with no argument forwards the current args
+- Replace the result (return something other than what `next()` returned)
+- Handle, translate or roll back after a failure (`try { return next(); } catch (error) { … }`)
+- Skip the call entirely — a handler that never calls `next` short-circuits, and its return value is the result
+- Run the call inside a scope — `als.run(store, () => next())` makes an `AsyncLocalStorage` store visible to the target, including after an `await` inside it
+
+The handler's return value is **always** the call's result, so `({ next }) => next()` is the pass-through form; forgetting the `return` yields `undefined`. `next` runs the rest of the pipeline once — a second call throws `HOOK_AROUND_NEXT_CALLED_TWICE`, and a non-array argument throws `HOOK_AROUND_NEXT_INVALID_ARGS`.
+
+Around hooks fire for nested wrapper-to-wrapper calls too, exactly like before/after hooks, and each call's `next()` is scoped to that one call. `entry` and `caller` tell an outside call from a nested one:
+
+```javascript
+api.slothlet.hook.on(
+	"db.**:around",
+	({ args, next, entry }) => {
+		if (!entry) return next(); // nested call — the outer call already opened the transaction
+		return db.transaction(() => next(args));
+	},
+	{ id: "tx" }
+);
+```
+
+**May be sync or async**, under the same rule as before/after (see [Sync and Async Function Behavior](#sync-and-async-function-behavior)): a synchronous around keeps a synchronous call synchronous, an `async` one promotes it. A _plain_ function that returns a Promise it did not get from `next()` must declare `{ async: true }`, or the synchronous pipeline refuses it with `HOOK_AROUND_RETURNED_PROMISE`.
+
 ---
 
 ## Basic Usage
@@ -234,6 +271,22 @@ api.slothlet.hook.on("**:always", ({ path, args, result, hasError, errors, api,
 });
 ```
 
+### Around hook context
+
+```javascript
+api.slothlet.hook.on("math.*:around", ({ path, args, next, entry, caller, api, ctx }) => {
+	// path: string - API path being called
+	// args: Array - arguments as this around hook received them
+	// next: (args?: Array) => * - runs the rest of the pipeline; returns its result or throws its error
+	// entry: boolean - true when the call has no module caller (an outside call); false for a nested call
+	// caller: object|null - the calling module's metadata (the shape metadata.caller() returns), null when entry
+	// api, ctx - as above
+	return next(args);
+});
+```
+
+**Return value:** always the call's result — return what `next()` returned to pass it through. `entry` is `true` exactly when `self.slothlet.metadata.caller()` inside the target would return `null`.
+
 ### Error hook context
 
 ```javascript
@@ -244,7 +297,7 @@ api.slothlet.hook.on("**:error", ({ path, args, error, errorType, source, timest
 	// errorType: string - error constructor name
 	// timestamp: Date - when the error occurred
 	// source: object - error source details
-	//   source.type: "before" | "after" | "always" | "function"
+	//   source.type: "around" | "before" | "after" | "always" | "function"
 	//   source.subset: hook subset (if hook error)
 	//   source.hookId: hook ID (if hook error)
 	//   source.hookTag: hook tag/name (if hook error)
@@ -294,6 +347,18 @@ When a before hook short-circuits:
 - After hooks are skipped
 - Always hooks still execute with the short-circuit result
 
+An `around` hook short-circuits by returning without calling `next` — the lower-priority around hooks, the before hooks, the function and the after hooks are all skipped, and always hooks observe the returned value:
+
+```javascript
+api.slothlet.hook.on("**:around", ({ path, args, next }) => {
+	const key = JSON.stringify({ path, args });
+	if (cache.has(key)) return cache.get(key);
+	const result = next();
+	cache.set(key, result);
+	return result;
+});
+```
+
 ---
 
 ## Pattern Matching
@@ -426,17 +491,22 @@ api.slothlet.hook.on(
 **Complete execution order** for a function call:
 
 ```text
+around hooks:  [subset=before, ↓priority] → [subset=primary, ↓priority] → [subset=after, ↓priority]  (each nested inside the previous)
+↓ innermost around calls next()
 before hooks:  [subset=before, ↓priority] → [subset=primary, ↓priority] → [subset=after, ↓priority]
 ↓ function executes
 after hooks:   [subset=before, ↓priority] → [subset=primary, ↓priority] → [subset=after, ↓priority]
+↑ unwinds back out through the around hooks
 always hooks:  [subset=before, ↓priority] → [subset=primary, ↓priority] → [subset=after, ↓priority]
 ```
 
+For around hooks, "runs first" means "outermost": the first around hook in this order wraps every other one.
+
 ---
 
 ## Permissions and Pinning
 
-When a `permissions` block is configured, registering and firing a hook on a path is permission-gated: the rule target uses the same `pattern:type` suffix form (e.g. `"db.*:error"`), and `:hook` as the type matches any hook type on that path. Module-registered hooks are force-pinned to their owner module by default — this prevents permission bypass through the bound `api`; opt out per-instance via `hook: { pin: false }` in the slothlet init config, or at runtime with `api.slothlet.hook.pin.disable()` (`.enable()` re-enables, `.enabled` reads the current state).
+When a `permissions` block is configured, registering and firing a hook on a path is permission-gated: the rule target uses the same `pattern:type` suffix form (e.g. `"db.*:error"`, `"db.*:around"`), and `:hook` as the type matches any hook type on that path. An `around` hook is gated exactly like a `before` hook — it can rewrite the call and prevent it — so grant `:around` as deliberately. Module-registered hooks are force-pinned to their owner module by default — this prevents permission bypass through the bound `api`; opt out per-instance via `hook: { pin: false }` in the slothlet init config, or at runtime with `api.slothlet.hook.pin.disable()` (`.enable()` re-enables, `.enabled` reads the current state). A pinned `around` handler runs as its owner, but the rest of the pipeline its `next()` runs belongs to the intercepted call: the target still sees that call's own caller.
 
 ---
 
@@ -506,6 +576,7 @@ api.slothlet.hook.remove({ type: "before", pattern: "math.*" });
 
 // Remove all hooks of a type
 api.slothlet.hook.remove({ type: "error" });
+api.slothlet.hook.remove({ type: "around" });
 
 // off() is an alias for remove - accepts ID string or filter object
 api.slothlet.hook.off(hookId);
@@ -543,7 +614,7 @@ api.slothlet.hook.on(
 	"**:error",
 	({ path, error, source }) => {
 		console.error(`Error in ${path}:`, error.message);
-		console.error(`Source type: ${source.type}`); // "before" | "function" | "after" | "always" | "unknown"
+		console.error(`Source type: ${source.type}`); // "around" | "before" | "function" | "after" | "always" | "unknown"
 
 		if (source.type === "function") {
 			console.error("Error in function body");
@@ -558,6 +629,7 @@ api.slothlet.hook.on(
 **Important notes:**
 
 - Errors from `before` and `after` hooks are re-thrown after error hooks run (unless `suppressErrors: true`)
+- On a path with `around` hooks, error hooks run only for the error that escapes the around chain — see [Error Flow](#error-flow)
 - Errors from `always` hooks are caught and passed to error hooks, but do NOT re-throw (never crash execution)
 - Error hooks do not receive errors thrown by other error hooks (no recursion)
 
@@ -570,6 +642,7 @@ api.slothlet.hook.on(
 | `source.type` | Description                       |
 | ------------- | --------------------------------- |
 | `"function"`  | Error in the target function body |
+| `"around"`    | Error thrown by an around hook    |
 | `"before"`    | Error in a before hook            |
 | `"after"`     | Error in an after hook            |
 | `"always"`    | Error in an always hook           |
@@ -586,7 +659,7 @@ api.slothlet.hook.on(
 ### Comprehensive Error Monitoring Example
 
 ```javascript
-const errorStats = { function: 0, before: 0, after: 0, always: 0, byHook: {} };
+const errorStats = { function: 0, around: 0, before: 0, after: 0, always: 0, byHook: {} };
 
 api.slothlet.hook.on(
 	"**:error",
@@ -646,7 +719,7 @@ A pattern no versioned mount covers throws `HOOK_VERSION_UNRESOLVED` at registra
 
 ## Sync and Async Function Behavior
 
-Any mix of sync/async targets and handlers composes correctly. The dispatch strategy is derived **per call** from the current hook set: when every matching before/after handler is synchronous the call runs the synchronous pipeline, and when any is asynchronous the whole call runs an asynchronous one. `always` and `error` handlers are **observers** — their return values are never consumed, so they may be async without affecting the caller's contract in any way.
+Any mix of sync/async targets and handlers composes correctly. The dispatch strategy is derived **per call** from the current hook set: when every matching before/after/around handler is synchronous the call runs the synchronous pipeline, and when any is asynchronous the whole call runs an asynchronous one. `always` and `error` handlers are **observers** — their return values are never consumed, so they may be async without affecting the caller's contract in any way.
 
 **Synchronous pipeline** (sync target, only sync transforming handlers):
 
@@ -662,6 +735,16 @@ All steps run synchronously in sequence; a synchronous target returns a plain va
 await before-chain → fn() [awaited if thenable] → await after-chain → executeAlwaysHooks()
 ```
 
+**With around hooks** the before → function → after sequence runs inside the innermost around hook's `next()`, and the observers run once the around chain settles:
+
+```text
+around₁ → around₂ → … → next(): before-chain → fn() → after-chain → … unwind … → error hooks (if it threw) → executeAlwaysHooks()
+```
+
+A synchronous around handler on a synchronous path gets a plain value back from `next()`, and the call returns a plain value. An `async` around handler — or one declared `{ async: true }` — promotes the call exactly as an async before/after handler does, including the promotion guard and the per-path strategy cache below; inside the promoted pipeline `next()` returns a Promise. A path whose target is declared `async` (or, under `mode: "lazy"`, is not materialized yet) also runs its around hooks on the asynchronous pipeline, since `next()` cannot hand back its value synchronously there anyway. `next()` always starts the rest of the pipeline synchronously, so a scope an around hook opens around it — `als.run(store, () => next())` — is active when the before hooks and the target run, and stays active across the target's own `await`s.
+
+On the synchronous pipeline an around handler may return a Promise only when it is the value its own `next()` returned — a target that is a plain function returning a Promise, passed straight through. Any other thenable fails loudly with `HOOK_AROUND_RETURNED_PROMISE`; declare the handler `{ async: true }` (or make it `async`) to transform an asynchronous result.
+
 Handlers run in strict registration order in both pipelines; inside the asynchronous one only actual thenables are awaited, so a synchronous handler costs no microtask tick. Chained `before` hooks feed transformed args forward; a `before` short-circuit still resolves through the pipeline without invoking the target.
 
 **Promotion is transient and per-call.** Attaching an async hook to a synchronous target makes _calls made while it is attached_ return a Promise; removing the hook restores plain synchronous returns. The strategy is never baked onto the leaf.
@@ -680,7 +763,7 @@ Under `mode: "lazy"` there is one more call in the guarded category: a promoted
 api.slothlet.hook.on("svc.compute:after", (ctx) => somePromiseReturningHelper(ctx.result), { async: true });
 ```
 
-Undeclared and undetected handlers stay in the synchronous pipeline, where a thenable return **fails loudly** (`HOOK_BEFORE_RETURNED_PROMISE` / `HOOK_AFTER_RETURNED_PROMISE`) rather than corrupting the result.
+Undeclared and undetected handlers stay in the synchronous pipeline, where a thenable return **fails loudly** (`HOOK_BEFORE_RETURNED_PROMISE` / `HOOK_AFTER_RETURNED_PROMISE` / `HOOK_AROUND_RETURNED_PROMISE`) rather than corrupting the result.
 
 This design ensures:
 
@@ -692,7 +775,7 @@ This design ensures:
 
 ## Caller Identity in Callbacks
 
-Slothlet's hook system above governs slothlet's own `before`/`after`/`always`/`error` phases. A related concern is **callbacks you register with a third-party framework** — most commonly a web framework's request hook (e.g. Fastify's `server.addHook("onRequest", …)`).
+Slothlet's hook system above governs slothlet's own `before`/`after`/`always`/`error`/`around` phases. A related concern is **callbacks you register with a third-party framework** — most commonly a web framework's request hook (e.g. Fastify's `server.addHook("onRequest", …)`).
 
 ### Hooks auto-pin caller identity
 
@@ -796,11 +879,12 @@ Register a hook.
 **Parameters:**
 
 - `typePattern` (string) - Combined pattern and type, format: `"pattern:type"` (e.g. `"math.*:before"`). The legacy type-first form `"type:pattern"` (e.g. `"before:math.*"`) is deprecated — it still works but emits a deprecation warning and will be removed in v4.
-- `handler` (Function) - Synchronous hook handler
+- `handler` (Function) - Hook handler (sync or async — see [Sync and Async Function Behavior](#sync-and-async-function-behavior))
 - `options.id` (string, optional) - Unique identifier (auto-generated if omitted)
 - `options.priority` (number, optional) - Execution priority; higher executes first (default: `0`)
 - `options.subset` (string, optional) - Execution phase: `"before"`, `"primary"` (default), or `"after"`
 - `options.lockCaller` (boolean, optional) - Pin the registering module's caller identity onto the handler (default: `true`). See [Hooks auto-pin caller identity](#hooks-auto-pin-caller-identity).
+- `options.async` (boolean, optional) - Declare a handler asynchronous when the native async brand cannot show it (a plain function returning a Promise). Applies to `before`, `after` and `around` handlers.
 
 **Returns:** string - The hook ID
 
diff --git a/docs/LIFECYCLE.md b/docs/LIFECYCLE.md
index edff39f43..0a3ad8a97 100644
--- a/docs/LIFECYCLE.md
+++ b/docs/LIFECYCLE.md
@@ -737,5 +737,5 @@ Direct property on any lazy-mode proxy. Returns `api.slothlet.types.UNMATERIALIZ
 ## See Also
 
 - [Module Structure](MODULE-STRUCTURE.md) - All structural patterns including lazy mode
-- [Hooks](HOOKS.md) - Intercept function calls with before/after/always/error hooks
+- [Hooks](HOOKS.md) - Intercept function calls with before/after/always/error/around hooks
 - [Performance](PERFORMANCE.md) - Eager vs. lazy mode performance characteristics
diff --git a/docs/PERMISSIONS.md b/docs/PERMISSIONS.md
index f83bd8f46..d694525cb 100644
--- a/docs/PERMISSIONS.md
+++ b/docs/PERMISSIONS.md
@@ -582,7 +582,7 @@ The [self-call bypass](#self-call-bypass) still applies — a module reading a d
 
 The [hook system](HOOKS.md) is governed by these same permission rules. When a `permissions` block is configured, **registering and firing a hook is permission-checked** through the same decision function used for calls and reads — a module can only hook a path it is itself allowed to access. This closes the side-channel where any module reaching `api.slothlet.hook.on` could otherwise observe or tamper with leaves the permission rules were meant to protect.
 
-Hook rule targets use the `pattern:type` **suffix** form: the trailing `:type` names the hook phase, and `:hook` matches any hook type on a path.
+Hook rule targets use the `pattern:type` **suffix** form: the trailing `:type` names the hook phase (`before`, `after`, `always`, `error` or `around`), and `:hook` matches any hook type on a path. An `around` hook can rewrite arguments and results and prevent the call entirely, so grant `:around` as deliberately as `:before`.
 
 ```javascript
 const api = await slothlet({
diff --git a/src/lib/builders/api_builder.mjs b/src/lib/builders/api_builder.mjs
index 0a7f46d17..0e78a871b 100644
--- a/src/lib/builders/api_builder.mjs
+++ b/src/lib/builders/api_builder.mjs
@@ -1707,6 +1707,7 @@ export class ApiBuilder extends ComponentBase {
 				 * @param {string} [options.id] - Unique identifier (auto-generated if not provided)
 				 * @param {number} [options.priority=0] - Higher = earlier execution
 				 * @param {string} [options.subset=DEFAULT_HOOK_SUBSET] - Phase: "before", "primary", or "after" (`DEFAULT_HOOK_SUBSET` / `HOOK_SUBSETS` in `handlers/hook-manager.mjs`)
+				 * @param {boolean} [options.async] - Declare a before/after/around handler asynchronous when the native async brand cannot show it
 				 * @returns {string} Hook ID
 				 * @public
 				 *
@@ -1715,6 +1716,10 @@ export class ApiBuilder extends ComponentBase {
 				 *   console.log("Calling math function with:", args);
 				 *   return args;
 				 * });
+				 *
+				 * @example
+				 * // around: wrap the rest of the pipeline; next() runs it and returns its result
+				 * api.slothlet.hook.on("db.**:around", ({ next, entry }) => (entry ? db.transaction(() => next()) : next()));
 				 */
 				on: function slothlet_hook_on(typePattern, handler, options = {}) {
 					if (!slothlet.handlers?.hookManager) {
@@ -1727,7 +1732,7 @@ export class ApiBuilder extends ComponentBase {
 				 * Remove hooks matching filter criteria.
 				 * @param {object} [filter={}] - Filter criteria
 				 * @param {string} [filter.id] - Remove hook by ID
-				 * @param {string} [filter.type] - Remove hooks by type (before/after/always/error)
+				 * @param {string} [filter.type] - Remove hooks by type (before/after/always/error/around)
 				 * @param {string} [filter.pattern] - Remove hooks matching pattern
 				 * @returns {number} Number of hooks removed
 				 * @public
diff --git a/src/lib/handlers/context-async.mjs b/src/lib/handlers/context-async.mjs
index 68fdd8f67..9fcfa7305 100644
--- a/src/lib/handlers/context-async.mjs
+++ b/src/lib/handlers/context-async.mjs
@@ -210,6 +210,34 @@ export class AsyncContextManager {
 		return value;
 	}
 
+	/**
+	 * Capture the executing async flow's slothlet store so it can be re-entered later.
+	 *
+	 * Used by around hooks: a pinned around handler runs as the module that registered it, but the
+	 * rest of the pipeline its `next()` runs belongs to the intercepted call, whose target must see
+	 * that call's own caller.
+	 *
+	 * @returns {{store: object|undefined}} Snapshot for {@link AsyncContextManager#runInFlow}.
+	 * @public
+	 */
+	captureFlow() {
+		return { store: this.als.getStore() };
+	}
+
+	/**
+	 * Run a callback with a flow captured by {@link AsyncContextManager#captureFlow} active. Only
+	 * slothlet's own AsyncLocalStorage is switched — any other async context (an application's own
+	 * `AsyncLocalStorage.run()` scope around `next()`) stays exactly as it is.
+	 *
+	 * @param {{store: object|undefined}} flow - Captured flow.
+	 * @param {function(): *} fn - Callback to run.
+	 * @returns {*} The callback's return value.
+	 * @public
+	 */
+	runInFlow(flow, fn) {
+		return this.als.run(flow.store, fn);
+	}
+
 	/**
 	 * Get current active context
 	 * @returns {Object} Current context store
diff --git a/src/lib/handlers/context-live.mjs b/src/lib/handlers/context-live.mjs
index 34453854a..5f6a8ef8d 100644
--- a/src/lib/handlers/context-live.mjs
+++ b/src/lib/handlers/context-live.mjs
@@ -709,6 +709,52 @@ export class LiveContextManager {
 		}
 	}
 
+	/**
+	 * Capture the caller identity of the executing flow so it can be re-entered later.
+	 *
+	 * Used by around hooks: a pinned around handler runs as the module that registered it, but the
+	 * rest of the pipeline its `next()` runs belongs to the intercepted call, whose target must see
+	 * that call's own caller.
+	 *
+	 * @param {string} instanceID - Instance whose flow to capture.
+	 * @returns {{instanceID: string|null, store: object, currentWrapper: object|undefined, callerWrapper: object|undefined}|null}
+	 *   Snapshot for {@link LiveContextManager#runInFlow}, or null when the instance has no store.
+	 * @public
+	 */
+	captureFlow(instanceID) {
+		const store = this.tryGetContext(instanceID);
+		/* v8 ignore next — a live instance always has a store while its api is callable; guards a torn-down instance. */
+		if (!store) return null;
+		return { instanceID: this.currentInstanceID, store, currentWrapper: store.currentWrapper, callerWrapper: store.callerWrapper };
+	}
+
+	/**
+	 * Run a callback with a flow captured by {@link LiveContextManager#captureFlow} active, then put
+	 * back whatever was active before. Only the synchronous portion runs under the captured identity;
+	 * a call started inside it holds its own identity until it settles, as every live call does.
+	 *
+	 * @param {{instanceID: string|null, store: object, currentWrapper: object|undefined, callerWrapper: object|undefined}} flow - Captured flow.
+	 * @param {function(): *} fn - Callback to run.
+	 * @returns {*} The callback's return value.
+	 * @public
+	 */
+	runInFlow(flow, fn) {
+		const { store } = flow;
+		const previousInstanceID = this.currentInstanceID;
+		const previousWrapper = store.currentWrapper;
+		const previousCallerWrapper = store.callerWrapper;
+		this.currentInstanceID = flow.instanceID;
+		store.currentWrapper = flow.currentWrapper;
+		store.callerWrapper = flow.callerWrapper;
+		try {
+			return fn();
+		} finally {
+			this.currentInstanceID = previousInstanceID;
+			store.currentWrapper = previousWrapper;
+			store.callerWrapper = previousCallerWrapper;
+		}
+	}
+
 	/**
 	 * Get current active context
 	 * @returns {Object} Current context store
diff --git a/src/lib/handlers/hook-manager.mjs b/src/lib/handlers/hook-manager.mjs
index 8a0590dc7..7bbd58585 100644
--- a/src/lib/handlers/hook-manager.mjs
+++ b/src/lib/handlers/hook-manager.mjs
@@ -40,6 +40,42 @@ const DEFAULT_HOOK_SUBSET = "primary";
  * @property {*} [result] - The final (possibly hook-modified) return value.
  */
 
+/**
+ * Receives a failure raised inside an around pipeline together with where it came from, so the
+ * pipeline can report the right source once the error escapes the around chain.
+ * @callback HookErrorSink
+ * @param {*} error - The thrown value.
+ * @param {object} source - Error source details (`type`, `subset`, `hookId`, `hookTag`, `timestamp`, `stack`).
+ * @returns {void}
+ */
+
+/**
+ * The innermost stage of an around pipeline: before hooks, the target function and after hooks.
+ * @callback HookAroundCore
+ * @param {Array} args - Arguments the innermost around hook forwarded through `next()`.
+ * @returns {*} The call's result (a Promise in the asynchronous pipeline).
+ */
+
+/**
+ * Runs a callback with the slothlet caller identity that was active when the call entered the
+ * pipeline, so a pinned around hook's `next()` does not leak the hook owner's identity into the
+ * target.
+ * @callback HookFlowRunner
+ * @param {function(): *} fn - Callback to run.
+ * @returns {*} The callback's return value.
+ */
+
+/**
+ * Options for {@link HookManager#executeAroundChain}.
+ * @typedef {Object} AroundChainOptions
+ * @property {HookAroundCore} core - Innermost stage invoked by the last around hook's `next()`.
+ * @property {boolean} isAsync - Whether the call runs the asynchronous pipeline.
+ * @property {object|null} caller - Calling module's metadata, or null for an entry call.
+ * @property {boolean} entry - True when the call has no module caller.
+ * @property {HookErrorSink} errorSink - Records where each failure originated.
+ * @property {HookFlowRunner|null} runInCallerFlow - Restores the call's own identity inside a pinned hook's `next()`.
+ */
+
 /**
  * Symbol to mark errors that have already been processed by hook error handlers
  * @private
@@ -67,7 +103,7 @@ const VERSION_BINDING = Symbol("@cldmv/slothlet/hook-version-binding");
 
 /**
  * Manages hooks for API function interception.
- * Supports before/after/always/error hooks with pattern matching and priority ordering.
+ * Supports before/after/always/error/around hooks with pattern matching and priority ordering.
  *
  * @class HookManager
  * @extends ComponentBase
@@ -89,7 +125,8 @@ export class HookManager extends ComponentBase {
 		before: { before: {}, primary: {}, after: {} },
 		after: { before: {}, primary: {}, after: {} },
 		always: { before: {}, primary: {}, after: {} },
-		error: { before: {}, primary: {}, after: {} }
+		error: { before: {}, primary: {}, after: {} },
+		around: { before: {}, primary: {}, after: {} }
 	};
 
 	/**
@@ -111,7 +148,7 @@ export class HookManager extends ComponentBase {
 	 * @type {Set<string>}
 	 * @private
 	 */
-	#validTypes = new Set(["before", "after", "always", "error"]);
+	#validTypes = new Set(["before", "after", "always", "error", "around"]);
 
 	/**
 	 * Valid subset phases
@@ -180,7 +217,7 @@ export class HookManager extends ComponentBase {
 	/**
 	 * Per-path dispatch strategy cache: path → { epoch, strategy }. Valid only while the entry's
 	 * epoch equals {@link #registryEpoch}; per-call cost on the hot path is one integer compare.
-	 * @type {Map<string, {epoch: number, strategy: {asyncBefore: boolean, asyncAfter: boolean}}>}
+	 * @type {Map<string, {epoch: number, strategy: {asyncBefore: boolean, asyncAfter: boolean, asyncAround: boolean, hasAround: boolean}}>}
 	 */
 	#strategyCache = new Map();
 
@@ -789,7 +826,7 @@ export class HookManager extends ComponentBase {
 	 * Get hooks for a specific API path and type.
 	 * Used internally by UnifiedWrapper.
 	 *
-	 * @param {string} type - Hook type (before/after/always/error)
+	 * @param {string} type - Hook type (before/after/always/error/around)
 	 * @param {string} apiPath - API path (e.g., "math.add")
 	 * @returns {Array<object>} Sorted array of matching hooks
 	 * @public
@@ -889,14 +926,14 @@ export class HookManager extends ComponentBase {
 	 * Derive the dispatch strategy for a path from the current hook set.
 	 *
 	 * @param {string} path - API path about to be called
-	 * @returns {{asyncBefore: boolean, asyncAfter: boolean}} Whether any matching transforming
-	 *   hook is asynchronous.
+	 * @returns {{asyncBefore: boolean, asyncAfter: boolean, asyncAround: boolean, hasAround: boolean}}
+	 *   Whether any matching transforming hook is asynchronous, and whether the path has around hooks.
 	 * @public
 	 *
 	 * @description
 	 * The strategy is a property of the CALL, derived per invocation from the registration state —
 	 * never baked onto the leaf, so removing an async hook returns the path to synchronous
-	 * dispatch. Only TRANSFORMING hooks (before/after) are consulted: `always` and `error` are
+	 * dispatch. Only TRANSFORMING hooks (before/after/around) are consulted: `always` and `error` are
 	 * observers whose return values are never consumed, so they never force promotion. Cached per
 	 * path behind the registry epoch; the hot-path cost is one integer compare.
 	 */
@@ -905,9 +942,17 @@ export class HookManager extends ComponentBase {
 		if (cached && cached.epoch === this.#registryEpoch) {
 			return cached.strategy;
 		}
+		const arounds = this.#matchHooksForPath("around", path);
 		const strategy = {
 			asyncBefore: this.#matchHooksForPath("before", path).some((hook) => hook.handlerIsAsync),
-			asyncAfter: this.#matchHooksForPath("after", path).some((hook) => hook.handlerIsAsync)
+			asyncAfter: this.#matchHooksForPath("after", path).some((hook) => hook.handlerIsAsync),
+			// Around hooks are transforming too (they can replace args and the result, or skip the
+			// call outright), so an async one promotes exactly as an async before/after does.
+			asyncAround: arounds.some((hook) => hook.handlerIsAsync),
+			// Whether any around hook is registered for the path at all. The wrapper keys its
+			// around-pipeline branch off this one flag, so a path with no around hooks never pays
+			// for the extra fire-time lookup.
+			hasAround: arounds.length > 0
 		};
 		this.#strategyCache.set(path, { epoch: this.#registryEpoch, strategy });
 		return strategy;
@@ -920,10 +965,12 @@ export class HookManager extends ComponentBase {
 	 * @param {Array} args - Function arguments
 	 * @param {object} api - Bound API object
 	 * @param {object} ctx - User context object
+	 * @param {HookErrorSink} [errorSink] - Around-pipeline error sink. When given, a failing hook is
+	 *   reported to it and rethrown instead of running the error hooks and honouring suppressErrors.
 	 * @returns {object} Result object: { args, shortCircuit, value }
 	 * @public
 	 */
-	executeBeforeHooks(path, args, api, ctx) {
+	executeBeforeHooks(path, args, api, ctx, errorSink) {
 		const hooks = this.getHooksForPath("before", path);
 
 		for (const hook of hooks) {
@@ -956,6 +1003,14 @@ export class HookManager extends ComponentBase {
 					timestamp: Date.now(),
 					stack: error.stack
 				};
+				// Inside an around pipeline the observers sit OUTSIDE the around chain: the failure is
+				// handed to the pipeline (which remembers where it came from) and propagates through
+				// next() so an around hook can catch it. Error hooks and suppression apply only to what
+				// finally escapes to the caller.
+				if (errorSink) {
+					errorSink(error, sourceInfo);
+					throw error;
+				}
 				this.executeErrorHooks(path, error, sourceInfo, args, api, ctx);
 				// Only throw if suppressErrors is false
 				if (!this.suppressErrors) {
@@ -977,10 +1032,12 @@ export class HookManager extends ComponentBase {
 	 * @param {Array} args - Original function arguments
 	 * @param {object} api - Bound API object
 	 * @param {object} ctx - User context object
+	 * @param {HookErrorSink} [errorSink] - Around-pipeline error sink. When given, a failing hook is
+	 *   reported to it and rethrown instead of running the error hooks and honouring suppressErrors.
 	 * @returns {HookExecutionResult} Object indicating if result was modified and the final result
 	 * @public
 	 */
-	executeAfterHooks(path, result, args, api, ctx) {
+	executeAfterHooks(path, result, args, api, ctx, errorSink) {
 		const hooks = this.getHooksForPath("after", path);
 		const originalResult = result;
 		let currentResult = result;
@@ -1026,6 +1083,14 @@ export class HookManager extends ComponentBase {
 					timestamp: Date.now(),
 					stack: error.stack
 				};
+				// Inside an around pipeline the observers sit OUTSIDE the around chain: the failure is
+				// handed to the pipeline (which remembers where it came from) and propagates through
+				// next() so an around hook can catch it. Error hooks and suppression apply only to what
+				// finally escapes to the caller.
+				if (errorSink) {
+					errorSink(error, sourceInfo);
+					throw error;
+				}
 				this.executeErrorHooks(path, error, sourceInfo, args, api, ctx);
 				// Only throw if suppressErrors is false
 				if (!this.suppressErrors) {
@@ -1050,6 +1115,8 @@ export class HookManager extends ComponentBase {
 	 * @param {Array} args - Function arguments
 	 * @param {object} api - Bound API object
 	 * @param {object} ctx - User context object
+	 * @param {HookErrorSink} [errorSink] - Around-pipeline error sink. When given, a failing hook is
+	 *   reported to it and rethrown instead of running the error hooks and honouring suppressErrors.
 	 * @returns {Promise<object>} Result object: { args, shortCircuit, value }
 	 * @public
 	 *
@@ -1059,7 +1126,7 @@ export class HookManager extends ComponentBase {
 	 * already receives a Promise, so awaiting the chain changes nothing observable. A synchronous
 	 * handler's return is used as-is (no microtask tick is inserted for it).
 	 */
-	async executeBeforeHooksAsync(path, args, api, ctx) {
+	async executeBeforeHooksAsync(path, args, api, ctx, errorSink) {
 		const hooks = this.getHooksForPath("before", path);
 
 		for (const hook of hooks) {
@@ -1086,6 +1153,14 @@ export class HookManager extends ComponentBase {
 					timestamp: Date.now(),
 					stack: error.stack
 				};
+				// Inside an around pipeline the observers sit OUTSIDE the around chain: the failure is
+				// handed to the pipeline (which remembers where it came from) and propagates through
+				// next() so an around hook can catch it. Error hooks and suppression apply only to what
+				// finally escapes to the caller.
+				if (errorSink) {
+					errorSink(error, sourceInfo);
+					throw error;
+				}
 				this.executeErrorHooks(path, error, sourceInfo, args, api, ctx);
 				// Only throw if suppressErrors is false
 				if (!this.suppressErrors) {
@@ -1108,6 +1183,8 @@ export class HookManager extends ComponentBase {
 	 * @param {Array} args - Original function arguments
 	 * @param {object} api - Bound API object
 	 * @param {object} ctx - User context object
+	 * @param {HookErrorSink} [errorSink] - Around-pipeline error sink. When given, a failing hook is
+	 *   reported to it and rethrown instead of running the error hooks and honouring suppressErrors.
 	 * @returns {Promise<HookExecutionResult>} Object indicating if result was modified and the final result
 	 * @public
 	 *
@@ -1115,7 +1192,7 @@ export class HookManager extends ComponentBase {
 	 * Same protocol and ordering as the sync variant; a thenable transform is awaited (that is the
 	 * cell this pipeline exists for) and a synchronous transform costs no microtask tick.
 	 */
-	async executeAfterHooksAsync(path, result, args, api, ctx) {
+	async executeAfterHooksAsync(path, result, args, api, ctx, errorSink) {
 		const hooks = this.getHooksForPath("after", path);
 		const originalResult = result;
 		let currentResult = result;
@@ -1139,6 +1216,14 @@ export class HookManager extends ComponentBase {
 					timestamp: Date.now(),
 					stack: error.stack
 				};
+				// Inside an around pipeline the observers sit OUTSIDE the around chain: the failure is
+				// handed to the pipeline (which remembers where it came from) and propagates through
+				// next() so an around hook can catch it. Error hooks and suppression apply only to what
+				// finally escapes to the caller.
+				if (errorSink) {
+					errorSink(error, sourceInfo);
+					throw error;
+				}
 				this.executeErrorHooks(path, error, sourceInfo, args, api, ctx);
 				// Only throw if suppressErrors is false
 				if (!this.suppressErrors) {
@@ -1155,6 +1240,113 @@ export class HookManager extends ComponentBase {
 		}
 	}
 
+	/**
+	 * Run a call through its around hooks, highest priority outermost.
+	 *
+	 * @param {Array<object>} hooks - Around hooks for the path, in execution order (from {@link getHooksForPath}).
+	 * @param {string} path - API path being called
+	 * @param {Array} args - Arguments the caller passed
+	 * @param {object} api - Bound API object
+	 * @param {object} ctx - User context object
+	 * @param {AroundChainOptions} options - Pipeline wiring supplied by the wrapper.
+	 * @returns {*} The outermost around hook's return value — the call's result. A Promise when
+	 *   `options.isAsync` is set.
+	 * @public
+	 *
+	 * @description
+	 * Each hook receives `next(args?)`, which runs the rest of the pipeline — the remaining around
+	 * hooks, then `options.core` (before hooks, the function, after hooks) — and returns its result or
+	 * throws its error. `next()` with no argument forwards the args the hook itself received. A hook
+	 * that never calls `next` short-circuits: whatever it returns is the result. `next` is single-use
+	 * per hook invocation; a second call throws `HOOK_AROUND_NEXT_CALLED_TWICE`.
+	 *
+	 * `next()` starts the rest of the pipeline synchronously in both modes, so a hook that wraps it in
+	 * an `AsyncLocalStorage.run()` (or any other synchronous scope) has that scope active while the
+	 * target runs — including after an `await` inside the target, since async context follows the
+	 * target's own continuation.
+	 *
+	 * In the synchronous pipeline a handler's thenable return is refused with
+	 * `HOOK_AROUND_RETURNED_PROMISE` (the handler was not detected as asynchronous and did not declare
+	 * `{ async: true }`), except when it is the very value its own `next()` returned: that is the
+	 * target's own Promise (a plain function returning one) passed straight through, not something
+	 * the hook produced. In the asynchronous pipeline thenables are awaited.
+	 *
+	 * Failures are reported to `options.errorSink` with an `around` source and rethrown; error hooks
+	 * and suppression are the caller's concern, since they observe only what escapes the whole chain.
+	 */
+	executeAroundChain(hooks, path, args, api, ctx, options) {
+		const { core, isAsync, caller, entry, errorSink, runInCallerFlow } = options;
+		const count = hooks.length;
+
+		const sinkAround = (hook, error) => {
+			errorSink(error, {
+				type: "around",
+				subset: hook.subset,
+				hookTag: hook.id,
+				hookId: hook.id,
+				timestamp: Date.now(),
+				stack: error?.stack
+			});
+		};
+
+		// Builds the single-use `next` for one hook invocation. `state.returned` records what `next`
+		// handed back so the synchronous pipeline can recognise a passed-through target Promise.
+		const makeNext = (hook, index, currentArgs, state, invoke) => (nextArgs) => {
+			if (state.called) {
+				throw new this.SlothletError("HOOK_AROUND_NEXT_CALLED_TWICE", { id: hook.id, path }, null, { validationError: true });
+			}
+			if (nextArgs !== undefined && !Array.isArray(nextArgs)) {
+				throw new this.SlothletError("HOOK_AROUND_NEXT_INVALID_ARGS", { id: hook.id, path, received: typeof nextArgs }, null, {
+					validationError: true
+				});
+			}
+			state.called = true;
+			const forwarded = nextArgs === undefined ? currentArgs : nextArgs;
+			const rest = () => invoke(index + 1, forwarded);
+			// A pinned handler runs as the module that registered it. The rest of the pipeline belongs
+			// to the call being intercepted, so the target must see the call's own caller again.
+			state.returned = runInCallerFlow && typeof hook.handler._slothletOriginal === "function" ? runInCallerFlow(rest) : rest();
+			return state.returned;
+		};
+
+		if (isAsync) {
+			const invokeAsync = async (index, currentArgs) => {
+				if (index === count) return core(currentArgs);
+				const hook = hooks[index];
+				const state = { called: false, returned: undefined };
+				const next = makeNext(hook, index, currentArgs, state, invokeAsync);
+				try {
+					const raw = hook.handler({ path, args: currentArgs, next, caller, entry, api, ctx, version: hook.version });
+					return raw && typeof raw === "object" && typeof raw.then === "function" ? await raw : raw;
+				} catch (error) {
+					sinkAround(hook, error);
+					throw error;
+				}
+			};
+			return invokeAsync(0, args);
+		}
+
+		const invokeSync = (index, currentArgs) => {
+			if (index === count) return core(currentArgs);
+			const hook = hooks[index];
+			const state = { called: false, returned: undefined };
+			const next = makeNext(hook, index, currentArgs, state, invokeSync);
+			try {
+				const result = hook.handler({ path, args: currentArgs, next, caller, entry, api, ctx, version: hook.version });
+				// Object-only thenable test, as everywhere else on a value path: a lazy callable wrapper
+				// answers `.then` on purpose (see executeAfterHooks).
+				if (result && typeof result === "object" && typeof result.then === "function" && !(state.called && result === state.returned)) {
+					throw new this.SlothletError("HOOK_AROUND_RETURNED_PROMISE", { id: hook.id, path }, null, { validationError: true });
+				}
+				return result;
+			} catch (error) {
+				sinkAround(hook, error);
+				throw error;
+			}
+		};
+		return invokeSync(0, args);
+	}
+
 	/**
 	 * Execute always hooks for an API path.
 	 *
@@ -1240,7 +1432,7 @@ export class HookManager extends ComponentBase {
 	 * Parse a hook type/pattern string into its type and path pattern.
 	 *
 	 * The canonical form is `pattern:type` (path first), where `type` is the trailing token and
-	 * one of the valid hook types (before/after/always/error) — e.g. `"math.*:before"`, `"**:error"`.
+	 * one of the valid hook types (before/after/always/error/around) — e.g. `"math.*:before"`, `"**:error"`.
 	 * This matches the suffix form used by permission rule targets, so a hook and the permission
 	 * that gates it read identically.
 	 *
@@ -1616,7 +1808,8 @@ export class HookManager extends ComponentBase {
 			before: { before: {}, primary: {}, after: {} },
 			after: { before: {}, primary: {}, after: {} },
 			always: { before: {}, primary: {}, after: {} },
-			error: { before: {}, primary: {}, after: {} }
+			error: { before: {}, primary: {}, after: {} },
+			around: { before: {}, primary: {}, after: {} }
 		};
 		this.#byId.clear();
 		this.#idCounter = 0;
diff --git a/src/lib/handlers/permission-manager.mjs b/src/lib/handlers/permission-manager.mjs
index c75d292f4..eaa0682bb 100644
--- a/src/lib/handlers/permission-manager.mjs
+++ b/src/lib/handlers/permission-manager.mjs
@@ -53,7 +53,7 @@ let ruleRegistrationSeq = 0;
  * rule that gates it read identically (e.g. `hook.on("db.*:error")` ↔ `target: "db.*:error"`).
  * @type {Set<string>}
  */
-const HOOK_TARGET_TYPES = new Set(["before", "after", "always", "error", "hook"]);
+const HOOK_TARGET_TYPES = new Set(["before", "after", "always", "error", "around", "hook"]);
 
 /**
  * Precedence layers used to break ties when two matching rules have EQUAL specificity.
@@ -1488,7 +1488,7 @@ export class PermissionManager extends ComponentBase {
 	 * @param {string|null} callerPath - Hook owner's API path (the registering module); null for a
 	 *   host-registered hook (no owner identity), which is always allowed.
 	 * @param {string} hookPath - Concrete API path (fire-time) or registration pattern (registration).
-	 * @param {string} hookType - Hook type: "before", "after", "always", or "error".
+	 * @param {string} hookType - Hook type: "before", "after", "always", "error", or "around".
 	 * @param {string|null} [callerFilePath=null] - Owner's source file path (for self-hook bypass).
 	 * @param {string|null} [targetFilePath=null] - Hooked path's source file path (for self-hook bypass).
 	 * @param {object|null} [runtimeContext=null] - Per-request ALS context for condition evaluation.
@@ -1515,7 +1515,7 @@ export class PermissionManager extends ComponentBase {
 	 *
 	 * @param {string|null} callerPath - Hook owner's API path; null for a host-registered hook (always allowed).
 	 * @param {string} hookPath - Concrete API path being hooked.
-	 * @param {string} hookType - Hook type: "before", "after", "always", or "error".
+	 * @param {string} hookType - Hook type: "before", "after", "always", "error", or "around".
 	 * @param {string|null} [callerFilePath=null] - Owner's source file path (for self-hook bypass).
 	 * @param {string|null} [targetFilePath=null] - Hooked path's source file path (for self-hook bypass).
 	 *   Typically null at fire time, where the target's source file isn't resolved — the filepath
@@ -2243,7 +2243,7 @@ export class PermissionManager extends ComponentBase {
 	 * Parse a permission target into its hook-path pattern and hook type when it is a hook target.
 	 *
 	 * A hook target uses the suffix form `pattern:type`, where `type` is the trailing colon-delimited
-	 * token and one of before/after/always/error or `hook` (any type) — e.g. `"db.*:error"`, `"**:hook"`.
+	 * token and one of before/after/always/error/around or `hook` (any type) — e.g. `"db.*:error"`, `"**:hook"`.
 	 * Ordinary call targets (no recognized hook-type suffix, e.g. `"db.write"`) return null.
 	 *
 	 * @param {string} target - Rule target string.
diff --git a/src/lib/handlers/unified-wrapper.mjs b/src/lib/handlers/unified-wrapper.mjs
index 134a3a11f..39bf9560a 100644
--- a/src/lib/handlers/unified-wrapper.mjs
+++ b/src/lib/handlers/unified-wrapper.mjs
@@ -756,6 +756,166 @@ function runtime_guardPromotedResult(promise, path, SlothletErrorCtor) {
 	});
 }
 
+/**
+ * Run a hooked call whose path has around hooks.
+ *
+ * @param {object} wrapper - The UnifiedWrapper being invoked.
+ * @param {object} hookManager - The instance's HookManager.
+ * @param {Array<object>} arounds - Around hooks that fire for this call (already permission-filtered).
+ * @param {{asyncBefore: boolean, asyncAfter: boolean, asyncAround: boolean}} strategy - The path's dispatch strategy.
+ * @param {*} thisArg - Receiver for the target.
+ * @param {Array} callArgs - Arguments the caller passed.
+ * @param {object} api - Bound API handed to hooks.
+ * @param {object} ctx - User context handed to hooks.
+ * @returns {*} The call's result — a plain value on the synchronous pipeline, a Promise on the
+ *   asynchronous one (guarded when a synchronous target was promoted).
+ * @private
+ *
+ * @description
+ * Pipeline order, outermost first: `always`/`error` observers → around hooks (highest priority
+ * outermost) → before hooks → the function → after hooks. The observers sit outside the around
+ * chain, so they see exactly what the caller receives: an error an around hook rethrows reaches the
+ * error hooks (with the source of wherever it was first thrown), one it swallows does not, and
+ * `always` fires once after the chain settles. `suppressErrors` likewise applies to what escapes the
+ * chain — inside it, failures propagate through `next()` so an around hook can handle them.
+ *
+ * The synchronous pipeline is kept when every matching before/after/around handler is synchronous
+ * and the target is not declared `async` (and, in lazy mode, is already materialized); otherwise the
+ * whole call runs asynchronously, with the same promotion guard as a call promoted by an async
+ * before/after hook.
+ */
+function runtime_runAroundPipeline(wrapper, hookManager, arounds, strategy, thisArg, callArgs, api, ctx) {
+	const internal = wrapper.____slothletInternal;
+	const path = internal.apiPath;
+	const contextManager = wrapper.slothlet.contextManager;
+	const instanceID = wrapper.slothlet.instanceID;
+
+	// Who is calling: the same resolution that makes `metadata.caller()` inside the target null —
+	// the target's execution store takes its caller from the wrapper active in THIS instance's flow
+	// at the moment of the call.
+	const callerWrapper = contextManager.getCallerIdentity(instanceID)?.currentWrapper ?? null;
+	const entry = !callerWrapper;
+	const caller = callerWrapper ? wrapper.slothlet.handlers.metadata.getMetadata(callerWrapper) : null;
+
+	// Only a pinned (module-registered) around hook runs under a different identity than the call, so
+	// only then is the call's own flow captured for its next() to restore.
+	const flow = arounds.some((hook) => typeof hook.handler._slothletOriginal === "function") ? contextManager.captureFlow(instanceID) : null;
+	const runInCallerFlow = flow ? (fn) => contextManager.runInFlow(flow, fn) : null;
+
+	// First record wins: an error rethrown by an around hook keeps the source it was first thrown
+	// from; an error an around hook throws itself is recorded as an `around` failure.
+	const sources = [];
+	const errorSink = (error, source) => {
+		if (!sources.some((entryRecord) => entryRecord.error === error)) sources.push({ error, source });
+	};
+	const functionSource = (error) => ({ type: "function", timestamp: Date.now(), stack: unwrapError(error)?.stack });
+
+	const invokeTarget = (targetArgs) => {
+		const impl = internal.impl;
+		// rawErrors: a leaf's throw is application data — never re-typed (#252).
+		if (typeof impl === "function") {
+			return contextManager.runInContext(wrapper.instanceID, impl, thisArg, targetArgs, wrapper, true);
+		}
+		if (impl && typeof impl === "object" && typeof impl.default === "function") {
+			return contextManager.runInContext(wrapper.instanceID, impl.default, impl, targetArgs, wrapper, true);
+		}
+		throw new wrapper.SlothletError("INVALID_CONFIG_NOT_A_FUNCTION", { apiPath: path, actualType: typeof impl }, null, {
+			validationError: true
+		});
+	};
+
+	// Observers, run once per call on the way out.
+	const settleValue = (value) => {
+		hookManager.executeAlwaysHooks(path, callArgs, value, false, [], api, ctx);
+		return value;
+	};
+	const settleError = (error) => {
+		const originalError = unwrapError(error);
+		// A failure an inner hooked call already reported is not reported again (same rule as the
+		// pipeline without around hooks); `always` still observes this call.
+		if (!error?.[ERROR_HOOK_PROCESSED]) {
+			hookManager.executeErrorHooks(path, originalError, sources.find((record) => record.error === error).source, callArgs, api, ctx);
+		}
+		hookManager.executeAlwaysHooks(path, callArgs, undefined, true, [originalError], api, ctx);
+		if (wrapper.slothlet.config?.hook?.suppressErrors === true) return undefined;
+		throw error;
+	};
+
+	const leafIsAsync = util.types.isAsyncFunction(internal.impl) || util.types.isAsyncFunction(internal.impl?.default);
+	const lazyPending = internal.mode === "lazy" && !internal.state.materialized;
+	const promoted = strategy.asyncBefore || strategy.asyncAfter || strategy.asyncAround;
+	const options = { caller, entry, errorSink, runInCallerFlow };
+
+	if (promoted || leafIsAsync || lazyPending) {
+		const core = async (coreArgs) => {
+			const beforeResult = await hookManager.executeBeforeHooksAsync(path, coreArgs, api, ctx, errorSink);
+			if (beforeResult.shortCircuit) return beforeResult.value;
+			coreArgs = beforeResult.args;
+			let settled;
+			try {
+				if (internal.mode === "lazy" && !internal.state.materialized) {
+					await wrapper._materialize();
+				}
+				const raw = invokeTarget(coreArgs);
+				settled = raw && typeof raw === "object" && typeof raw.then === "function" ? await raw : raw;
+			} catch (error) {
+				errorSink(error, functionSource(error));
+				throw error;
+			}
+			const afterResult = await hookManager.executeAfterHooksAsync(path, settled, coreArgs, api, ctx, errorSink);
+			return afterResult.modified ? afterResult.result : settled;
+		};
+		const run = hookManager
+			.executeAroundChain(arounds, path, callArgs, api, ctx, { ...options, core, isAsync: true })
+			.then(settleValue, settleError);
+		// Same contract as a call promoted by an async before/after hook: a target declared `async`
+		// already hands its callers a Promise; a promoted synchronous one hands back a guarded one.
+		return promoted && !leafIsAsync ? runtime_guardPromotedResult(run, path, wrapper.SlothletError) : run;
+	}
+
+	const core = (coreArgs) => {
+		const beforeResult = hookManager.executeBeforeHooks(path, coreArgs, api, ctx, errorSink);
+		if (beforeResult.shortCircuit) return beforeResult.value;
+		coreArgs = beforeResult.args;
+		let result;
+		try {
+			result = invokeTarget(coreArgs);
+		} catch (error) {
+			errorSink(error, functionSource(error));
+			throw error;
+		}
+		// A plain (not `async`-declared) target returning a Promise: after hooks attach to it, exactly
+		// as on the pipeline without around hooks.
+		if (result && typeof result === "object" && typeof result.then === "function") {
+			return result.then(
+				(resolved) => {
+					const afterResult = hookManager.executeAfterHooks(path, resolved, coreArgs, api, ctx, errorSink);
+					return afterResult.modified ? afterResult.result : resolved;
+				},
+				(error) => {
+					errorSink(error, functionSource(error));
+					throw error;
+				}
+			);
+		}
+		const afterResult = hookManager.executeAfterHooks(path, result, coreArgs, api, ctx, errorSink);
+		return afterResult.modified ? afterResult.result : result;
+	};
+
+	let value;
+	try {
+		value = hookManager.executeAroundChain(arounds, path, callArgs, api, ctx, { ...options, core, isAsync: false });
+	} catch (error) {
+		return settleError(error);
+	}
+	// The only thenable an around hook may return on this pipeline is the target's own Promise passed
+	// through `next()`; observe it when it settles.
+	if (value && typeof value === "object" && typeof value.then === "function") {
+		return value.then(settleValue, settleError);
+	}
+	return settleValue(value);
+}
+
 /**
  * Extract the original error from a SlothletError wrapper if present.
  * Hooks should receive the actual error that occurred, not the wrapped SlothletError.
@@ -4293,7 +4453,19 @@ export class UnifiedWrapper extends ComponentBase {
 			// synchronous fast path below. Observers (always/error) never force promotion.
 			if (hasHooks) {
 				const ___strategy = hookManager.getDispatchStrategy(wrapper.____slothletInternal.apiPath);
-				if (___strategy.asyncBefore || ___strategy.asyncAfter) {
+				// Around hooks (#496) wrap the whole before → function → after pipeline, with the
+				// always/error observers outside them — a different shape from the paths below, so a
+				// call that has any runs its own pipeline. A path with none never gets past this flag.
+				if (___strategy.hasAround) {
+					const ___arounds = hookManager.getHooksForPath("around", wrapper.____slothletInternal.apiPath);
+					// The permission filter can leave this caller with no around hooks at all; the call
+					// then takes the ordinary pipeline (still promoted below when an async around is
+					// registered for the path — promotion is a property of the path, not the caller).
+					if (___arounds.length > 0) {
+						return runtime_runAroundPipeline(wrapper, hookManager, ___arounds, ___strategy, effectiveThisArg, args, api, ctx);
+					}
+				}
+				if (___strategy.asyncBefore || ___strategy.asyncAfter || ___strategy.asyncAround) {
 					const ___path = wrapper.____slothletInternal.apiPath;
 					const ___leafIsAsync =
 						util.types.isAsyncFunction(wrapper.____slothletInternal.impl) ||
diff --git a/src/lib/i18n/languages/de-de.json b/src/lib/i18n/languages/de-de.json
index a31caba44..6390e8292 100644
--- a/src/lib/i18n/languages/de-de.json
+++ b/src/lib/i18n/languages/de-de.json
@@ -316,6 +316,12 @@
 		"HINT_HOOK_AFTER_RETURNED_PROMISE": "Ein 'after'-Handler wurde nicht als asynchron erkannt. Verwenden Sie eine native async-Funktion oder registrieren Sie ihn mit { async: true }, damit der Aufruf in die asynchrone Pipeline befördert wird.",
 		"HOOK_PROMOTED_RESULT_NOT_AWAITED": "Pfad '{path}' hat ein Promise zurückgegeben, weil ein asynchroner Hook angehängt ist — verwenden Sie await für das Ergebnis.",
 		"HINT_HOOK_PROMOTED_RESULT_NOT_AWAITED": "Ein synchrones Ziel wird zur asynchronen Verarbeitung befördert, solange ein asynchroner before/after-Hook angehängt ist. Verwenden Sie await, oder entfernen Sie den asynchronen Hook, um synchrone Rückgaben wiederherzustellen.",
+		"HOOK_AROUND_RETURNED_PROMISE": "Der 'around' Hook '{id}' für Pfad '{path}' hat in einer synchronen Pipeline ein Promise zurückgegeben.",
+		"HINT_HOOK_AROUND_RETURNED_PROMISE": "Ein 'around'-Handler wurde nicht als asynchron erkannt. Verwenden Sie eine native async-Funktion oder registrieren Sie ihn mit { async: true }, damit der Aufruf in die asynchrone Pipeline befördert wird. Den Rückgabewert von next() unverändert zurückzugeben ist immer erlaubt.",
+		"HOOK_AROUND_NEXT_CALLED_TWICE": "Der 'around' Hook '{id}' für Pfad '{path}' hat next() mehr als einmal aufgerufen.",
+		"HINT_HOOK_AROUND_NEXT_CALLED_TWICE": "next() führt den Rest der Pipeline genau einmal pro Aufruf des around-Hooks aus. Rufen Sie es einmal auf und verwenden Sie sein Ergebnis wieder, oder rufen Sie das Ziel erneut über die API auf.",
+		"HOOK_AROUND_NEXT_INVALID_ARGS": "Der 'around' Hook '{id}' für Pfad '{path}' hat next() mit einem Wert vom Typ {received} aufgerufen; erwartet wurde ein Array von Argumenten.",
+		"HINT_HOOK_AROUND_NEXT_INVALID_ARGS": "Rufen Sie next() ohne Argument auf, um die aktuellen Argumente weiterzugeben, oder übergeben Sie ein Array, um sie zu ersetzen.",
 		"HOOK_BRACE_EXPANSION_MAX_DEPTH": "Die Klammererweiterung (Brace Expansion) im Hook-Muster überschreitet die maximale Verschachtelungstiefe von {maxDepth}.",
 		"HINT_HOOK_BRACE_EXPANSION_MAX_DEPTH": "Vereinfachen Sie das Hook-Pfad-Muster, um die Klammerverschachtelung zu reduzieren. Die maximal erlaubte Tiefe beträgt {maxDepth} Ebenen.",
 		"SCOPE_DISABLED": "Die Kontext-Isolation pro Anfrage ist deaktiviert. Setzen Sie 'scope: {}' in Ihrer Slothlet-Konfiguration, um sie zu aktivieren.",
diff --git a/src/lib/i18n/languages/en-gb.json b/src/lib/i18n/languages/en-gb.json
index 9b41963b5..ef72f225f 100644
--- a/src/lib/i18n/languages/en-gb.json
+++ b/src/lib/i18n/languages/en-gb.json
@@ -316,6 +316,12 @@
 		"HINT_HOOK_AFTER_RETURNED_PROMISE": "An 'after' handler was not detected as asynchronous. Use a native async function, or register it with { async: true }, so the call promotes to the asynchronous pipeline.",
 		"HOOK_PROMOTED_RESULT_NOT_AWAITED": "Path '{path}' returned a Promise because an asynchronous hook is attached — await the result.",
 		"HINT_HOOK_PROMOTED_RESULT_NOT_AWAITED": "A synchronous target promotes to asynchronous dispatch while an async before/after hook is attached. Await the call, or remove the async hook to restore synchronous returns.",
+		"HOOK_AROUND_RETURNED_PROMISE": "Around hook '{id}' for path '{path}' returned a Promise in a synchronous pipeline.",
+		"HINT_HOOK_AROUND_RETURNED_PROMISE": "An 'around' handler was not detected as asynchronous. Use a native async function, or register it with { async: true }, so the call promotes to the asynchronous pipeline. Returning the value next() returned unchanged is always allowed.",
+		"HOOK_AROUND_NEXT_CALLED_TWICE": "Around hook '{id}' for path '{path}' called next() more than once.",
+		"HINT_HOOK_AROUND_NEXT_CALLED_TWICE": "next() runs the rest of the pipeline exactly once per around-hook invocation. Call it once and reuse its result, or make a separate call through the API to run the target again.",
+		"HOOK_AROUND_NEXT_INVALID_ARGS": "Around hook '{id}' for path '{path}' called next() with a {received}; expected an array of arguments.",
+		"HINT_HOOK_AROUND_NEXT_INVALID_ARGS": "Call next() with no argument to forward the current arguments, or pass an array to replace them.",
 		"HOOK_BRACE_EXPANSION_MAX_DEPTH": "Brace expansion in hook pattern exceeds the maximum nesting depth of {maxDepth}.",
 		"HINT_HOOK_BRACE_EXPANSION_MAX_DEPTH": "Simplify the hook path pattern to reduce brace nesting. Maximum allowed depth is {maxDepth} levels.",
 		"SCOPE_DISABLED": "Per-request context isolation is disabled. Set 'scope: {}' in your slothlet configuration to enable it.",
diff --git a/src/lib/i18n/languages/en-us.json b/src/lib/i18n/languages/en-us.json
index df6823976..a17fbabcc 100644
--- a/src/lib/i18n/languages/en-us.json
+++ b/src/lib/i18n/languages/en-us.json
@@ -316,6 +316,12 @@
 		"HINT_HOOK_AFTER_RETURNED_PROMISE": "An 'after' handler was not detected as asynchronous. Use a native async function, or register it with { async: true }, so the call promotes to the asynchronous pipeline.",
 		"HOOK_PROMOTED_RESULT_NOT_AWAITED": "Path '{path}' returned a Promise because an asynchronous hook is attached — await the result.",
 		"HINT_HOOK_PROMOTED_RESULT_NOT_AWAITED": "A synchronous target promotes to asynchronous dispatch while an async before/after hook is attached. Await the call, or remove the async hook to restore synchronous returns.",
+		"HOOK_AROUND_RETURNED_PROMISE": "Around hook '{id}' for path '{path}' returned a Promise in a synchronous pipeline.",
+		"HINT_HOOK_AROUND_RETURNED_PROMISE": "An 'around' handler was not detected as asynchronous. Use a native async function, or register it with { async: true }, so the call promotes to the asynchronous pipeline. Returning the value next() returned unchanged is always allowed.",
+		"HOOK_AROUND_NEXT_CALLED_TWICE": "Around hook '{id}' for path '{path}' called next() more than once.",
+		"HINT_HOOK_AROUND_NEXT_CALLED_TWICE": "next() runs the rest of the pipeline exactly once per around-hook invocation. Call it once and reuse its result, or make a separate call through the API to run the target again.",
+		"HOOK_AROUND_NEXT_INVALID_ARGS": "Around hook '{id}' for path '{path}' called next() with a {received}; expected an array of arguments.",
+		"HINT_HOOK_AROUND_NEXT_INVALID_ARGS": "Call next() with no argument to forward the current arguments, or pass an array to replace them.",
 		"HOOK_BRACE_EXPANSION_MAX_DEPTH": "Brace expansion in hook pattern exceeds the maximum nesting depth of {maxDepth}.",
 		"HINT_HOOK_BRACE_EXPANSION_MAX_DEPTH": "Simplify the hook path pattern to reduce brace nesting. Maximum allowed depth is {maxDepth} levels.",
 		"SCOPE_DISABLED": "Per-request context isolation is disabled. Set 'scope: {}' in your slothlet configuration to enable it.",
diff --git a/src/lib/i18n/languages/es-es.json b/src/lib/i18n/languages/es-es.json
index 471f0f51a..3cc178fbf 100644
--- a/src/lib/i18n/languages/es-es.json
+++ b/src/lib/i18n/languages/es-es.json
@@ -316,6 +316,12 @@
 		"HINT_HOOK_AFTER_RETURNED_PROMISE": "Un manejador 'after' no fue detectado como asíncrono. Usa una función async nativa, o regístralo con { async: true }, para que la llamada se promueva a la canalización asíncrona.",
 		"HOOK_PROMOTED_RESULT_NOT_AWAITED": "La ruta '{path}' devolvió una Promesa porque hay un gancho asíncrono adjunto — usa await sobre el resultado.",
 		"HINT_HOOK_PROMOTED_RESULT_NOT_AWAITED": "Un objetivo síncrono se promueve al despacho asíncrono mientras haya un gancho before/after asíncrono adjunto. Usa await en la llamada, o elimina el gancho asíncrono para restaurar los retornos síncronos.",
+		"HOOK_AROUND_RETURNED_PROMISE": "El gancho 'around' '{id}' para la ruta '{path}' devolvió una Promesa en una canalización síncrona.",
+		"HINT_HOOK_AROUND_RETURNED_PROMISE": "Un manejador 'around' no fue detectado como asíncrono. Usa una función async nativa, o regístralo con { async: true }, para que la llamada se promueva a la canalización asíncrona. Devolver sin cambios el valor que devolvió next() siempre está permitido.",
+		"HOOK_AROUND_NEXT_CALLED_TWICE": "El gancho 'around' '{id}' para la ruta '{path}' llamó a next() más de una vez.",
+		"HINT_HOOK_AROUND_NEXT_CALLED_TWICE": "next() ejecuta el resto de la canalización exactamente una vez por invocación del gancho around. Llámalo una vez y reutiliza su resultado, o haz otra llamada a través de la API para volver a ejecutar el objetivo.",
+		"HOOK_AROUND_NEXT_INVALID_ARGS": "El gancho 'around' '{id}' para la ruta '{path}' llamó a next() con un valor de tipo {received}; se esperaba un arreglo de argumentos.",
+		"HINT_HOOK_AROUND_NEXT_INVALID_ARGS": "Llama a next() sin argumentos para reenviar los argumentos actuales, o pasa un arreglo para reemplazarlos.",
 		"HOOK_BRACE_EXPANSION_MAX_DEPTH": "La expansión de llaves en el patrón del gancho excede la profundidad máxima de anidamiento de {maxDepth}.",
 		"HINT_HOOK_BRACE_EXPANSION_MAX_DEPTH": "Simplifica el patrón de ruta del gancho para reducir el anidamiento de llaves. La profundidad máxima permitida es de {maxDepth} niveles.",
 		"SCOPE_DISABLED": "El aislamiento de contexto por solicitud está deshabilitado. Establece 'scope: {}' en tu configuración de slothlet para habilitarlo.",
diff --git a/src/lib/i18n/languages/es-mx.json b/src/lib/i18n/languages/es-mx.json
index 3ff6d35ed..983ab25fe 100644
--- a/src/lib/i18n/languages/es-mx.json
+++ b/src/lib/i18n/languages/es-mx.json
@@ -316,6 +316,12 @@
 		"HINT_HOOK_AFTER_RETURNED_PROMISE": "Un manejador 'after' no fue detectado como asíncrono. Usa una función async nativa, o regístralo con { async: true }, para que la llamada se promueva a la canalización asíncrona.",
 		"HOOK_PROMOTED_RESULT_NOT_AWAITED": "La ruta '{path}' devolvió una Promesa porque hay un gancho asíncrono adjunto — usa await sobre el resultado.",
 		"HINT_HOOK_PROMOTED_RESULT_NOT_AWAITED": "Un objetivo síncrono se promueve al despacho asíncrono mientras haya un gancho before/after asíncrono adjunto. Usa await en la llamada, o elimina el gancho asíncrono para restaurar los retornos síncronos.",
+		"HOOK_AROUND_RETURNED_PROMISE": "El gancho 'around' '{id}' para la ruta '{path}' devolvió una Promesa en una canalización síncrona.",
+		"HINT_HOOK_AROUND_RETURNED_PROMISE": "Un manejador 'around' no fue detectado como asíncrono. Usa una función async nativa, o regístralo con { async: true }, para que la llamada se promueva a la canalización asíncrona. Devolver sin cambios el valor que devolvió next() siempre está permitido.",
+		"HOOK_AROUND_NEXT_CALLED_TWICE": "El gancho 'around' '{id}' para la ruta '{path}' llamó a next() más de una vez.",
+		"HINT_HOOK_AROUND_NEXT_CALLED_TWICE": "next() ejecuta el resto de la canalización exactamente una vez por invocación del gancho around. Llámalo una vez y reutiliza su resultado, o haz otra llamada a través de la API para volver a ejecutar el objetivo.",
+		"HOOK_AROUND_NEXT_INVALID_ARGS": "El gancho 'around' '{id}' para la ruta '{path}' llamó a next() con un valor de tipo {received}; se esperaba un arreglo de argumentos.",
+		"HINT_HOOK_AROUND_NEXT_INVALID_ARGS": "Llama a next() sin argumentos para reenviar los argumentos actuales, o pasa un arreglo para reemplazarlos.",
 		"HOOK_BRACE_EXPANSION_MAX_DEPTH": "La expansión de llaves en el patrón del gancho excede la profundidad máxima de anidamiento de {maxDepth}.",
 		"HINT_HOOK_BRACE_EXPANSION_MAX_DEPTH": "Simplifique el patrón de ruta del gancho para reducir el anidamiento de llaves. La profundidad máxima permitida es de {maxDepth} niveles.",
 		"SCOPE_DISABLED": "El aislamiento de contexto por solicitud está deshabilitado. Establezca 'scope: {}' en su configuración de slothlet para habilitarlo.",
diff --git a/src/lib/i18n/languages/fr-fr.json b/src/lib/i18n/languages/fr-fr.json
index 51c5390f2..abb85ffb6 100644
--- a/src/lib/i18n/languages/fr-fr.json
+++ b/src/lib/i18n/languages/fr-fr.json
@@ -316,6 +316,12 @@
 		"HINT_HOOK_AFTER_RETURNED_PROMISE": "Un gestionnaire 'after' n'a pas été détecté comme asynchrone. Utilisez une fonction async native, ou enregistrez-le avec { async: true }, pour que l'appel soit promu vers le pipeline asynchrone.",
 		"HOOK_PROMOTED_RESULT_NOT_AWAITED": "Le chemin '{path}' a renvoyé une Promesse parce qu'un hook asynchrone est attaché — utilisez await sur le résultat.",
 		"HINT_HOOK_PROMOTED_RESULT_NOT_AWAITED": "Une cible synchrone est promue vers la répartition asynchrone tant qu'un hook before/after asynchrone est attaché. Utilisez await sur l'appel, ou retirez le hook asynchrone pour rétablir les retours synchrones.",
+		"HOOK_AROUND_RETURNED_PROMISE": "Le hook 'around' '{id}' pour le chemin '{path}' a renvoyé une Promesse dans un pipeline synchrone.",
+		"HINT_HOOK_AROUND_RETURNED_PROMISE": "Un gestionnaire 'around' n'a pas été détecté comme asynchrone. Utilisez une fonction async native, ou enregistrez-le avec { async: true }, pour que l'appel soit promu vers le pipeline asynchrone. Renvoyer tel quel ce que next() a renvoyé est toujours autorisé.",
+		"HOOK_AROUND_NEXT_CALLED_TWICE": "Le hook 'around' '{id}' pour le chemin '{path}' a appelé next() plus d'une fois.",
+		"HINT_HOOK_AROUND_NEXT_CALLED_TWICE": "next() exécute le reste du pipeline exactement une fois par invocation du hook around. Appelez-le une seule fois et réutilisez son résultat, ou effectuez un autre appel via l'API pour exécuter à nouveau la cible.",
+		"HOOK_AROUND_NEXT_INVALID_ARGS": "Le hook 'around' '{id}' pour le chemin '{path}' a appelé next() avec une valeur de type {received} ; un tableau d'arguments était attendu.",
+		"HINT_HOOK_AROUND_NEXT_INVALID_ARGS": "Appelez next() sans argument pour transmettre les arguments actuels, ou passez un tableau pour les remplacer.",
 		"HOOK_BRACE_EXPANSION_MAX_DEPTH": "L'expansion des accolades dans le modèle de hook dépasse la profondeur d'imbrication maximale de {maxDepth}.",
 		"HINT_HOOK_BRACE_EXPANSION_MAX_DEPTH": "Simplifiez le modèle de chemin de hook pour réduire l'imbrication des accolades. La profondeur maximale autorisée est de {maxDepth} niveaux.",
 		"SCOPE_DISABLED": "L'isolation du contexte par requête est désactivée. Réglez 'scope: {}' dans votre configuration Slothlet pour l'activer.",
diff --git a/src/lib/i18n/languages/hi-in.json b/src/lib/i18n/languages/hi-in.json
index e18ff3626..041042acf 100644
--- a/src/lib/i18n/languages/hi-in.json
+++ b/src/lib/i18n/languages/hi-in.json
@@ -316,6 +316,12 @@
 		"HINT_HOOK_AFTER_RETURNED_PROMISE": "'after' हैंडलर असिंक्रोनस के रूप में पहचाना नहीं गया। नेटिव async फ़ंक्शन का उपयोग करें, या इसे { async: true } के साथ पंजीकृत करें, ताकि कॉल असिंक्रोनस पाइपलाइन में प्रमोट हो जाए।",
 		"HOOK_PROMOTED_RESULT_NOT_AWAITED": "पथ '{path}' ने Promise लौटाया क्योंकि एक असिंक्रोनस हुक जुड़ा है — परिणाम पर await का उपयोग करें।",
 		"HINT_HOOK_PROMOTED_RESULT_NOT_AWAITED": "जब तक कोई असिंक्रोनस before/after हुक जुड़ा है, सिंक्रोनस लक्ष्य असिंक्रोनस डिस्पैच में प्रमोट होता है। कॉल पर await करें, या सिंक्रोनस रिटर्न बहाल करने के लिए असिंक्रोनस हुक हटा दें।",
+		"HOOK_AROUND_RETURNED_PROMISE": "पथ '{path}' के around हुक '{id}' ने एक सिंक्रोनस पाइपलाइन में Promise लौटाया।",
+		"HINT_HOOK_AROUND_RETURNED_PROMISE": "'around' हैंडलर असिंक्रोनस के रूप में पहचाना नहीं गया। नेटिव async फ़ंक्शन का उपयोग करें, या इसे { async: true } के साथ पंजीकृत करें, ताकि कॉल असिंक्रोनस पाइपलाइन में प्रमोट हो जाए। next() द्वारा लौटाया गया मान बिना बदले लौटाना हमेशा अनुमत है।",
+		"HOOK_AROUND_NEXT_CALLED_TWICE": "पथ '{path}' के around हुक '{id}' ने next() को एक से अधिक बार कॉल किया।",
+		"HINT_HOOK_AROUND_NEXT_CALLED_TWICE": "next() हर around हुक कॉल में पाइपलाइन का शेष भाग ठीक एक बार चलाता है। इसे एक बार कॉल करें और परिणाम दोबारा उपयोग करें, या लक्ष्य को फिर से चलाने के लिए API के माध्यम से अलग कॉल करें।",
+		"HOOK_AROUND_NEXT_INVALID_ARGS": "पथ '{path}' के around हुक '{id}' ने next() को {received} प्रकार के मान के साथ कॉल किया; आर्गुमेंट्स की ऐरे अपेक्षित थी।",
+		"HINT_HOOK_AROUND_NEXT_INVALID_ARGS": "वर्तमान आर्गुमेंट्स आगे भेजने के लिए next() को बिना आर्गुमेंट के कॉल करें, या उन्हें बदलने के लिए एक ऐरे पास करें।",
 		"HOOK_BRACE_EXPANSION_MAX_DEPTH": "हुक पैटर्न में ब्रेस विस्तार {maxDepth} की अधिकतम नेस्टिंग गहराई से अधिक है।",
 		"HINT_HOOK_BRACE_EXPANSION_MAX_DEPTH": "ब्रेस नेस्टिंग को कम करने के लिए हुक पथ पैटर्न को सरल बनाएं। अधिकतम अनुमत गहराई {maxDepth} स्तर है।",
 		"SCOPE_DISABLED": "प्रति-अनुरोध संदर्भ अलगाव (context isolation) अक्षम है। इसे सक्षम करने के लिए अपने slothlet कॉन्फ़िगरेशन में 'scope: {}' सेट करें।",
diff --git a/src/lib/i18n/languages/ja-jp.json b/src/lib/i18n/languages/ja-jp.json
index 6c4ef3529..f22e012d3 100644
--- a/src/lib/i18n/languages/ja-jp.json
+++ b/src/lib/i18n/languages/ja-jp.json
@@ -316,6 +316,12 @@
 		"HINT_HOOK_AFTER_RETURNED_PROMISE": "after ハンドラーが非同期として検出されませんでした。ネイティブの async 関数を使用するか、{ async: true } を指定して登録すると、呼び出しが非同期パイプラインに昇格します。",
 		"HOOK_PROMOTED_RESULT_NOT_AWAITED": "パス '{path}' は非同期フックが接続されているため Promise を返しました — 結果を await してください。",
 		"HINT_HOOK_PROMOTED_RESULT_NOT_AWAITED": "非同期の before/after フックが接続されている間、同期ターゲットは非同期ディスパッチに昇格します。呼び出しを await するか、非同期フックを削除して同期の戻り値を復元してください。",
+		"HOOK_AROUND_RETURNED_PROMISE": "パス '{path}' の around フック '{id}' が同期パイプラインで Promise を返しました。",
+		"HINT_HOOK_AROUND_RETURNED_PROMISE": "around ハンドラーが非同期として検出されませんでした。ネイティブの async 関数を使用するか、{ async: true } を指定して登録すると、呼び出しが非同期パイプラインに昇格します。next() が返した値をそのまま返すことは常に許可されます。",
+		"HOOK_AROUND_NEXT_CALLED_TWICE": "パス '{path}' の around フック '{id}' が next() を複数回呼び出しました。",
+		"HINT_HOOK_AROUND_NEXT_CALLED_TWICE": "next() は around フックの呼び出しごとにパイプラインの残りを一度だけ実行します。一度だけ呼び出して結果を再利用するか、ターゲットを再実行するには API を通じて別途呼び出してください。",
+		"HOOK_AROUND_NEXT_INVALID_ARGS": "パス '{path}' の around フック '{id}' が {received} 型の値で next() を呼び出しました。引数の配列が必要です。",
+		"HINT_HOOK_AROUND_NEXT_INVALID_ARGS": "現在の引数をそのまま渡すには引数なしで next() を呼び出し、置き換えるには配列を渡してください。",
 		"HOOK_BRACE_EXPANSION_MAX_DEPTH": "フックパターンの波括弧展開が最大入れ子深さ {maxDepth} を超えました。",
 		"HINT_HOOK_BRACE_EXPANSION_MAX_DEPTH": "フックのパスパターンを簡略化して、波括弧の入れ子を減らしてください。許容される最大深さは {maxDepth} レベルです。",
 		"SCOPE_DISABLED": "リクエストごとのコンテキスト分離が無効になっています。有効にするには Slothlet 構成で 'scope: {}' を設定してください。",
diff --git a/src/lib/i18n/languages/ko-kr.json b/src/lib/i18n/languages/ko-kr.json
index ae635bf6c..af3185ab4 100644
--- a/src/lib/i18n/languages/ko-kr.json
+++ b/src/lib/i18n/languages/ko-kr.json
@@ -316,6 +316,12 @@
 		"HINT_HOOK_AFTER_RETURNED_PROMISE": "after 핸들러가 비동기로 감지되지 않았습니다. 네이티브 async 함수를 사용하거나 { async: true }로 등록하면 호출이 비동기 파이프라인으로 승격됩니다.",
 		"HOOK_PROMOTED_RESULT_NOT_AWAITED": "경로 '{path}'은(는) 비동기 훅이 연결되어 있어 Promise를 반환했습니다 — 결과를 await 하세요.",
 		"HINT_HOOK_PROMOTED_RESULT_NOT_AWAITED": "비동기 before/after 훅이 연결되어 있는 동안 동기 대상은 비동기 디스패치로 승격됩니다. 호출을 await 하거나 비동기 훅을 제거하여 동기 반환을 복원하세요.",
+		"HOOK_AROUND_RETURNED_PROMISE": "경로 '{path}'의 around 훅 '{id}'이(가) 동기 파이프라인에서 Promise를 반환했습니다.",
+		"HINT_HOOK_AROUND_RETURNED_PROMISE": "around 핸들러가 비동기로 감지되지 않았습니다. 네이티브 async 함수를 사용하거나 { async: true }로 등록하면 호출이 비동기 파이프라인으로 승격됩니다. next()가 반환한 값을 그대로 반환하는 것은 항상 허용됩니다.",
+		"HOOK_AROUND_NEXT_CALLED_TWICE": "경로 '{path}'의 around 훅 '{id}'이(가) next()를 두 번 이상 호출했습니다.",
+		"HINT_HOOK_AROUND_NEXT_CALLED_TWICE": "next()는 around 훅 호출마다 파이프라인의 나머지를 정확히 한 번 실행합니다. 한 번만 호출하고 결과를 재사용하거나, 대상을 다시 실행하려면 API를 통해 별도로 호출하세요.",
+		"HOOK_AROUND_NEXT_INVALID_ARGS": "경로 '{path}'의 around 훅 '{id}'이(가) {received} 형식의 값으로 next()를 호출했습니다. 인수 배열이 필요합니다.",
+		"HINT_HOOK_AROUND_NEXT_INVALID_ARGS": "현재 인수를 그대로 전달하려면 인수 없이 next()를 호출하고, 교체하려면 배열을 전달하세요.",
 		"HOOK_BRACE_EXPANSION_MAX_DEPTH": "후크 패턴의 중괄호 확장이 최대 중첩 깊이 {maxDepth}를 초과했습니다.",
 		"HINT_HOOK_BRACE_EXPANSION_MAX_DEPTH": "중괄호 중첩을 줄이도록 후크 경로 패턴을 단순화하십시오. 최대 허용 깊이는 {maxDepth}단계입니다.",
 		"SCOPE_DISABLED": "요청별 컨텍스트 격리가 비활성화되었습니다. 이를 활성화하려면 slothlet 설정에 'scope: {}'를 설정하십시오.",
diff --git a/src/lib/i18n/languages/pt-br.json b/src/lib/i18n/languages/pt-br.json
index 2f3debc41..b3847d8bb 100644
--- a/src/lib/i18n/languages/pt-br.json
+++ b/src/lib/i18n/languages/pt-br.json
@@ -316,6 +316,12 @@
 		"HINT_HOOK_AFTER_RETURNED_PROMISE": "Um manipulador 'after' não foi detectado como assíncrono. Use uma função async nativa, ou registre-o com { async: true }, para que a chamada seja promovida ao pipeline assíncrono.",
 		"HOOK_PROMOTED_RESULT_NOT_AWAITED": "O caminho '{path}' retornou uma Promise porque um hook assíncrono está anexado — use await no resultado.",
 		"HINT_HOOK_PROMOTED_RESULT_NOT_AWAITED": "Um alvo síncrono é promovido ao despacho assíncrono enquanto um hook before/after assíncrono estiver anexado. Use await na chamada, ou remova o hook assíncrono para restaurar retornos síncronos.",
+		"HOOK_AROUND_RETURNED_PROMISE": "O hook 'around' '{id}' para o caminho '{path}' retornou uma Promise em um pipeline síncrono.",
+		"HINT_HOOK_AROUND_RETURNED_PROMISE": "Um manipulador 'around' não foi detectado como assíncrono. Use uma função async nativa, ou registre-o com { async: true }, para que a chamada seja promovida ao pipeline assíncrono. Retornar sem alterações o valor que next() retornou é sempre permitido.",
+		"HOOK_AROUND_NEXT_CALLED_TWICE": "O hook 'around' '{id}' para o caminho '{path}' chamou next() mais de uma vez.",
+		"HINT_HOOK_AROUND_NEXT_CALLED_TWICE": "next() executa o restante do pipeline exatamente uma vez por invocação do hook around. Chame-o uma vez e reutilize o resultado, ou faça outra chamada pela API para executar o alvo novamente.",
+		"HOOK_AROUND_NEXT_INVALID_ARGS": "O hook 'around' '{id}' para o caminho '{path}' chamou next() com um valor do tipo {received}; era esperado um array de argumentos.",
+		"HINT_HOOK_AROUND_NEXT_INVALID_ARGS": "Chame next() sem argumento para repassar os argumentos atuais, ou passe um array para substituí-los.",
 		"HOOK_BRACE_EXPANSION_MAX_DEPTH": "A expansão de chaves no padrão de gancho excede a profundidade máxima de aninhamento de {maxDepth}.",
 		"HINT_HOOK_BRACE_EXPANSION_MAX_DEPTH": "Simplifique o padrão de caminho do gancho para reduzir o aninhamento de chaves. A profundidade máxima permitida é de {maxDepth} níveis.",
 		"SCOPE_DISABLED": "O isolamento de contexto por solicitação está desativado. Defina 'scope: {}' em sua configuração do slothlet para habilitá-lo.",
diff --git a/src/lib/i18n/languages/ru-ru.json b/src/lib/i18n/languages/ru-ru.json
index 6db47c2fd..2f76e1267 100644
--- a/src/lib/i18n/languages/ru-ru.json
+++ b/src/lib/i18n/languages/ru-ru.json
@@ -316,6 +316,12 @@
 		"HINT_HOOK_AFTER_RETURNED_PROMISE": "Обработчик 'after' не был распознан как асинхронный. Используйте нативную async-функцию или зарегистрируйте его с { async: true }, чтобы вызов был повышен до асинхронного конвейера.",
 		"HOOK_PROMOTED_RESULT_NOT_AWAITED": "Путь '{path}' вернул Promise, потому что подключён асинхронный hook — используйте await для результата.",
 		"HINT_HOOK_PROMOTED_RESULT_NOT_AWAITED": "Синхронная цель повышается до асинхронной диспетчеризации, пока подключён асинхронный before/after-hook. Используйте await для вызова или удалите асинхронный hook, чтобы восстановить синхронные возвраты.",
+		"HOOK_AROUND_RETURNED_PROMISE": "Хук 'around' '{id}' для пути '{path}' вернул Promise в синхронном конвейере.",
+		"HINT_HOOK_AROUND_RETURNED_PROMISE": "Обработчик 'around' не был распознан как асинхронный. Используйте нативную async-функцию или зарегистрируйте его с { async: true }, чтобы вызов был повышен до асинхронного конвейера. Вернуть без изменений значение, которое вернул next(), можно всегда.",
+		"HOOK_AROUND_NEXT_CALLED_TWICE": "Хук 'around' '{id}' для пути '{path}' вызвал next() более одного раза.",
+		"HINT_HOOK_AROUND_NEXT_CALLED_TWICE": "next() выполняет оставшуюся часть конвейера ровно один раз за вызов хука around. Вызовите его один раз и используйте результат повторно, либо выполните отдельный вызов через API, чтобы снова запустить цель.",
+		"HOOK_AROUND_NEXT_INVALID_ARGS": "Хук 'around' '{id}' для пути '{path}' вызвал next() со значением типа {received}; ожидался массив аргументов.",
+		"HINT_HOOK_AROUND_NEXT_INVALID_ARGS": "Вызовите next() без аргумента, чтобы передать текущие аргументы, или передайте массив, чтобы заменить их.",
 		"HOOK_BRACE_EXPANSION_MAX_DEPTH": "Развёртывание скобок в паттерне hook превысило максимальную глубину {maxDepth}.",
 		"HINT_HOOK_BRACE_EXPANSION_MAX_DEPTH": "Упростите паттерн пути, чтобы уменьшить вложенность.",
 		"SCOPE_DISABLED": "Per-request context isolation отключена. Установите 'scope: {}' в конфигурации Slothlet для включения.",
diff --git a/src/lib/i18n/languages/zh-cn.json b/src/lib/i18n/languages/zh-cn.json
index aecb9d3e5..c22a09f41 100644
--- a/src/lib/i18n/languages/zh-cn.json
+++ b/src/lib/i18n/languages/zh-cn.json
@@ -316,6 +316,12 @@
 		"HINT_HOOK_AFTER_RETURNED_PROMISE": "后置处理器未被检测为异步。请使用原生 async 函数，或在注册时传入 { async: true }，使调用提升到异步管道。",
 		"HOOK_PROMOTED_RESULT_NOT_AWAITED": "路径 '{path}' 返回了一个 Promise，因为附加了异步钩子 — 请对结果使用 await。",
 		"HINT_HOOK_PROMOTED_RESULT_NOT_AWAITED": "只要附加了异步的前置/后置钩子，同步目标就会提升为异步调度。请对调用使用 await，或移除异步钩子以恢复同步返回。",
+		"HOOK_AROUND_RETURNED_PROMISE": "路径 '{path}' 的环绕钩子 '{id}' 在同步管道中返回了一个 Promise。",
+		"HINT_HOOK_AROUND_RETURNED_PROMISE": "环绕处理器未被检测为异步。请使用原生 async 函数，或在注册时传入 { async: true }，使调用提升到异步管道。原样返回 next() 的返回值始终是允许的。",
+		"HOOK_AROUND_NEXT_CALLED_TWICE": "路径 '{path}' 的环绕钩子 '{id}' 多次调用了 next()。",
+		"HINT_HOOK_AROUND_NEXT_CALLED_TWICE": "每次环绕钩子调用中，next() 只会执行一次管道的其余部分。请只调用一次并复用其结果，或通过 API 另行调用以再次执行目标。",
+		"HOOK_AROUND_NEXT_INVALID_ARGS": "路径 '{path}' 的环绕钩子 '{id}' 以 {received} 类型的值调用了 next()；需要参数数组。",
+		"HINT_HOOK_AROUND_NEXT_INVALID_ARGS": "不带参数调用 next() 以转发当前参数，或传入一个数组来替换它们。",
 		"HOOK_BRACE_EXPANSION_MAX_DEPTH": "钩子模式中的大括号扩展超过了最大嵌套深度 {maxDepth}。",
 		"HINT_HOOK_BRACE_EXPANSION_MAX_DEPTH": "请简化钩子路径模式以减少大括号嵌套。最大允许深度为 {maxDepth} 层。",
 		"SCOPE_DISABLED": "每请求上下文隔离已禁用。请在 slothlet 配置中设置 'scope: {}' 以启用该功能。",
diff --git a/src/slothlet.mjs b/src/slothlet.mjs
index 97c824b60..e959cb283 100644
--- a/src/slothlet.mjs
+++ b/src/slothlet.mjs
@@ -1673,7 +1673,7 @@ export default slothlet;
  * @property {Function} slothlet.hook.enablePattern - Restrict hook execution to an API path pattern at runtime (global path filter; the runtime form of `hook.pattern`). Distinct from enable/disable, which toggle individual registered hooks. %%sig: (pattern: string): number%% %%example: // ESM usage via slothlet API|import slothlet from "@cldmv/slothlet";|const api = await slothlet({ base: './api', hook: true });|api.slothlet.hook.enablePattern('database.*'); // only intercept database.* paths%% %%example: // ESM usage via slothlet API (inside async function)|async function example() {|  const { default: slothlet } = await import("@cldmv/slothlet");|  const api = await slothlet({ base: './api', hook: true });|  api.slothlet.hook.enablePattern('database.*');|}%% %%example: // CJS usage via slothlet API (top-level)|let slothlet;|(async () => {|  ({ slothlet } = await import("@cldmv/slothlet"));|  const api = await slothlet({ base: './api', hook: true });|  api.slothlet.hook.enablePattern('database.*');|})();%% %%example: // CJS usage via slothlet API (inside async function)|const slothlet = require("@cldmv/slothlet");|const api = await slothlet({ base: './api', hook: true });|api.slothlet.hook.enablePattern('database.*');%%
  * @property {Function} slothlet.hook.list - List registered hooks matching a filter. %%sig: ([filter]: Object): Object[]%% %%example: // ESM usage via slothlet API|import slothlet from "@cldmv/slothlet";|const api = await slothlet({ base: './api', hook: true });|const allHooks = api.slothlet.hook.list();|const beforeHooks = api.slothlet.hook.list({ type: 'before' });%% %%example: // ESM usage via slothlet API (inside async function)|async function example() {|  const { default: slothlet } = await import("@cldmv/slothlet");|  const api = await slothlet({ base: './api', hook: true });|  const allHooks = api.slothlet.hook.list();|  const beforeHooks = api.slothlet.hook.list({ type: 'before' });|}%% %%example: // CJS usage via slothlet API (top-level)|let slothlet;|(async () => {|  ({ slothlet } = await import("@cldmv/slothlet"));|  const api = await slothlet({ base: './api', hook: true });|  const allHooks = api.slothlet.hook.list();|  const beforeHooks = api.slothlet.hook.list({ type: 'before' });|})();%% %%example: // CJS usage via slothlet API (inside async function)|const slothlet = require("@cldmv/slothlet");|const api = await slothlet({ base: './api', hook: true });|const allHooks = api.slothlet.hook.list();|const beforeHooks = api.slothlet.hook.list({ type: 'before' });%%
  * @property {Function} slothlet.hook.off - Remove hooks by ID or filter object (v2 alias for `remove()`). %%sig: (idOrFilter: string|Object): void%% %%example: // ESM usage via slothlet API|import slothlet from "@cldmv/slothlet";|const api = await slothlet({ base: './api', hook: true });|const hookId = api.slothlet.hook.on('math.*:before', handler);|api.slothlet.hook.off(hookId); // remove by ID|api.slothlet.hook.off({ type: 'after' }); // remove by filter%% %%example: // ESM usage via slothlet API (inside async function)|async function example() {|  const { default: slothlet } = await import("@cldmv/slothlet");|  const api = await slothlet({ base: './api', hook: true });|  const hookId = api.slothlet.hook.on('math.*:before', handler);|  api.slothlet.hook.off(hookId); // remove by ID|  api.slothlet.hook.off({ type: 'after' }); // remove by filter|}%% %%example: // CJS usage via slothlet API (top-level)|let slothlet;|(async () => {|  ({ slothlet } = await import("@cldmv/slothlet"));|  const api = await slothlet({ base: './api', hook: true });|  const hookId = api.slothlet.hook.on('math.*:before', handler);|  api.slothlet.hook.off(hookId); // remove by ID|  api.slothlet.hook.off({ type: 'after' }); // remove by filter|})();%% %%example: // CJS usage via slothlet API (inside async function)|const slothlet = require("@cldmv/slothlet");|const api = await slothlet({ base: './api', hook: true });|const hookId = api.slothlet.hook.on('math.*:before', handler);|api.slothlet.hook.off(hookId); // remove by ID|api.slothlet.hook.off({ type: 'after' }); // remove by filter%%
- * @property {Function} slothlet.hook.on - Register a hook handler for a path-then-type pattern (e.g. `"math.*:before"`; the legacy `"before:math.*"` form is deprecated). %%sig: (typePattern: string, handler: function, [options]: Object): string%% %%example: // ESM usage via slothlet API|import slothlet from "@cldmv/slothlet";|const api = await slothlet({ base: './api', hook: true });|const hookId = api.slothlet.hook.on('math.*:before', ({ args }) => {|  console.log('math called with', args);|});%% %%example: // ESM usage via slothlet API (inside async function)|async function example() {|  const { default: slothlet } = await import("@cldmv/slothlet");|  const api = await slothlet({ base: './api', hook: true });|  const hookId = api.slothlet.hook.on('math.*:before', ({ args }) => {|    console.log('math called with', args);|  });|}%% %%example: // CJS usage via slothlet API (top-level)|let slothlet;|(async () => {|  ({ slothlet } = await import("@cldmv/slothlet"));|  const api = await slothlet({ base: './api', hook: true });|  const hookId = api.slothlet.hook.on('math.*:before', ({ args }) => {|    console.log('math called with', args);|  });|})();%% %%example: // CJS usage via slothlet API (inside async function)|const slothlet = require("@cldmv/slothlet");|const api = await slothlet({ base: './api', hook: true });|const hookId = api.slothlet.hook.on('math.*:before', ({ args }) => {|  console.log('math called with', args);|});%%
+ * @property {Function} slothlet.hook.on - Register a hook handler for a path-then-type pattern (e.g. `"math.*:before"`; the legacy `"before:math.*"` form is deprecated). Types: `before`, `after`, `always`, `error`, and `around` (wraps the rest of the pipeline through `next(args?)`). %%sig: (typePattern: string, handler: function, [options]: Object): string%% %%example: // ESM usage via slothlet API|import slothlet from "@cldmv/slothlet";|const api = await slothlet({ base: './api', hook: true });|const hookId = api.slothlet.hook.on('math.*:before', ({ args }) => {|  console.log('math called with', args);|});%% %%example: // ESM usage via slothlet API (inside async function)|async function example() {|  const { default: slothlet } = await import("@cldmv/slothlet");|  const api = await slothlet({ base: './api', hook: true });|  const hookId = api.slothlet.hook.on('math.*:before', ({ args }) => {|    console.log('math called with', args);|  });|}%% %%example: // CJS usage via slothlet API (top-level)|let slothlet;|(async () => {|  ({ slothlet } = await import("@cldmv/slothlet"));|  const api = await slothlet({ base: './api', hook: true });|  const hookId = api.slothlet.hook.on('math.*:before', ({ args }) => {|    console.log('math called with', args);|  });|})();%% %%example: // CJS usage via slothlet API (inside async function)|const slothlet = require("@cldmv/slothlet");|const api = await slothlet({ base: './api', hook: true });|const hookId = api.slothlet.hook.on('math.*:before', ({ args }) => {|  console.log('math called with', args);|});%%
  * @property {object} slothlet.hook.pin - Host-only runtime control over hook-pinning enforcement (mirrors `permissions.control`). "Host-only" is enforced by the built-in `slothlet.hook.**` permission deny baseline, so it only holds when the permission system is enabled — without permissions a module reaching the hook surface can toggle it. Force-pinning makes a module hook always run under its registering module's identity; an unpinned module hook is a permission-bypass vector. Enabled by default (config `hook.pin`).
  * @property {boolean} slothlet.hook.pin.enabled - Whether hook pinning is currently enforced (true = module hooks are force-pinned, the default). %%sig: boolean%% %%example: // ESM usage via slothlet API|import slothlet from "@cldmv/slothlet";|const api = await slothlet({ base: './api', hook: true });|const enforced = api.slothlet.hook.pin.enabled;%%
  * @property {Function} slothlet.hook.pin.enable - Enforce hook pinning: a module hook's `lockCaller: false` is ignored (force-pinned). Host-only. %%sig: (): boolean%% %%example: // ESM usage via slothlet API|import slothlet from "@cldmv/slothlet";|const api = await slothlet({ base: './api', hook: true });|api.slothlet.hook.pin.enable(); // force-pin module hooks (host only)%%
diff --git a/tests/vitests/suites/hooks/hooks-around-async.test.vitest.mjs b/tests/vitests/suites/hooks/hooks-around-async.test.vitest.mjs
new file mode 100644
index 000000000..60b0dfc5c
--- /dev/null
+++ b/tests/vitests/suites/hooks/hooks-around-async.test.vitest.mjs
@@ -0,0 +1,425 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/hooks/hooks-around-async.test.vitest.mjs
+ *	@Date: 2026-09-28 12:00:00 -07:00 (1790622000)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 12:00:00 -07:00 (1790622000)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Sync/async dispatch of `around` hooks (#496), and the async-context use case the
+ * hook exists for.
+ *
+ * @description
+ * Around hooks follow the same rule as before/after: a synchronous around keeps a synchronous call
+ * synchronous (`next()` returns the plain value); an async one — native async brand, or registered
+ * with `{ async: true }` — promotes the call to the asynchronous pipeline, with the promotion guard
+ * and the per-path strategy cache. A synchronous around returning a thenable it did not get from
+ * `next()` fails loudly with `HOOK_AROUND_RETURNED_PROMISE`.
+ *
+ * The use case (#496): an around hook that runs `next()` inside `AsyncLocalStorage.run(store, …)`
+ * makes that store visible to the target — including after an `await` inside the target.
+ */
+
+import { describe, it, expect, afterEach } from "vitest";
+import { AsyncLocalStorage } from "node:async_hooks";
+import slothlet from "@cldmv/slothlet";
+import { getMatrixConfigs } from "../../setup/vitest-helper.mjs";
+
+// Minimal boot base; targets are mounted inline per test.
+const BASE = new URL("../../../../api_tests/api_test_underscore", import.meta.url).pathname;
+
+/** Application-owned async context the around hooks establish. */
+const requestStore = new AsyncLocalStorage();
+
+const TARGETS = {
+	exports: {
+		/**
+		 * Synchronous target.
+		 * @param {number} a - Left operand.
+		 * @param {number} b - Right operand.
+		 * @returns {number} Product.
+		 */
+		mulSync(a, b) {
+			return a * b;
+		},
+		/**
+		 * Asynchronous target.
+		 * @param {number} a - Left operand.
+		 * @param {number} b - Right operand.
+		 * @returns {Promise<number>} Product.
+		 */
+		async mulAsync(a, b) {
+			await Promise.resolve();
+			return a * b;
+		},
+		/**
+		 * A plain (not `async`-declared) function that returns a Promise.
+		 * @param {number} a - Left operand.
+		 * @param {number} b - Right operand.
+		 * @returns {Promise<number>} Product.
+		 */
+		mulThenable(a, b) {
+			return Promise.resolve(a * b);
+		},
+		/**
+		 * A plain (not `async`-declared) function that returns a rejected Promise.
+		 * @param {string} message - Error message.
+		 * @returns {Promise<never>} Rejection.
+		 */
+		rejectThenable(message) {
+			return Promise.reject(new Error(message));
+		},
+		/**
+		 * Rejects after a tick.
+		 * @param {string} message - Error message.
+		 * @returns {Promise<never>} Rejection.
+		 */
+		async failAsync(message) {
+			await Promise.resolve();
+			throw new Error(message);
+		},
+		/**
+		 * Reads the application store synchronously.
+		 * @returns {string|undefined} The active request id.
+		 */
+		whoSync() {
+			return requestStore.getStore()?.requestId;
+		},
+		/**
+		 * Reads the application store before and after an await.
+		 * @returns {Promise<Array<string|undefined>>} The request id seen on both sides of the await.
+		 */
+		async whoAsync() {
+			const before = requestStore.getStore()?.requestId;
+			await new Promise((resolve) => setTimeout(resolve, 5));
+			const after = requestStore.getStore()?.requestId;
+			return [before, after];
+		}
+	}
+};
+
+/**
+ * Boots an api with hooks enabled over the shared base and mounts the targets.
+ * @param {object} config - Matrix configuration for this run.
+ * @returns {Promise<object>} The bound api.
+ */
+async function boot(config) {
+	const api = await slothlet({ ...config, base: BASE, hook: { enabled: true } });
+	await api.slothlet.api.add("svc", TARGETS);
+	return api;
+}
+
+/**
+ * Captures a synchronous or asynchronous failure of a call.
+ * @param {function(): *} fn - Thunk making the call.
+ * @returns {Promise<{ok: boolean, value?: *, error?: *}>} Outcome.
+ */
+async function outcome(fn) {
+	try {
+		return { ok: true, value: await fn() };
+	} catch (error) {
+		return { ok: false, error };
+	}
+}
+
+describe.each(getMatrixConfigs({ hook: { enabled: true } }))("Hooks > around sync/async dispatch (#496) > $name", ({ config }) => {
+	let api;
+
+	afterEach(async () => {
+		if (api) await api.shutdown();
+		api = null;
+	});
+
+	it("a sync around keeps a sync target synchronous: next() and the call return plain values", async () => {
+		api = await boot(config);
+		const fromNext = [];
+		api.slothlet.hook.on(
+			"svc.mulSync:around",
+			({ next }) => {
+				const value = next();
+				fromNext.push(typeof value);
+				return value + 1;
+			},
+			{ id: "sync-around" }
+		);
+
+		const out = api.svc.mulSync(2, 3);
+		expect(typeof out).toBe("number");
+		expect(out).toBe(7);
+		expect(fromNext).toEqual(["number"]);
+	});
+
+	it("an async around promotes a sync target; the promoted return is guarded", async () => {
+		api = await boot(config);
+		api.slothlet.hook.on(
+			"svc.mulSync:around",
+			async ({ next }) => {
+				await Promise.resolve();
+				return (await next()) * 10;
+			},
+			{ id: "async-around" }
+		);
+
+		const pending = api.svc.mulSync(2, 3);
+		expect(typeof pending.then).toBe("function");
+		expect(() => pending * 1).toThrow(/svc\.mulSync/);
+		expect(await pending).toBe(60);
+	});
+
+	it("removing the async around restores synchronous returns", async () => {
+		api = await boot(config);
+		api.slothlet.hook.on("svc.mulSync:around", async ({ next }) => next(), { id: "async-around" });
+		expect(await api.svc.mulSync(2, 3)).toBe(6);
+
+		api.slothlet.hook.remove({ id: "async-around" });
+		api.slothlet.hook.on("svc.mulSync:around", ({ next }) => next(), { id: "sync-around" });
+		const out = api.svc.mulSync(2, 3);
+		expect(typeof out).toBe("number");
+		expect(out).toBe(6);
+	});
+
+	it("a plain handler declared { async: true } promotes like a native async one", async () => {
+		api = await boot(config);
+		api.slothlet.hook.on("svc.mulSync:around", ({ next }) => Promise.resolve().then(() => next([4, 5])), {
+			id: "declared",
+			async: true
+		});
+
+		expect(await api.svc.mulSync(2, 3)).toBe(20);
+	});
+
+	it("an async around on an async target transforms the awaited result, unguarded", async () => {
+		api = await boot(config);
+		api.slothlet.hook.on("svc.mulAsync:around", async ({ next }) => (await next()) + 1, { id: "async-around" });
+
+		const pending = api.svc.mulAsync(2, 3);
+		expect(await pending).toBe(7);
+		// Async targets already hand their callers a Promise, so it is not guarded.
+		expect(String(api.svc.mulAsync(1, 1))).toBe("[object Promise]");
+	});
+
+	it("a sync around over an async target passes the target Promise through, after hooks applied", async () => {
+		api = await boot(config);
+		api.slothlet.hook.on("svc.mulAsync:after", ({ result }) => result + 100, { id: "after" });
+		api.slothlet.hook.on("svc.mulAsync:around", ({ next }) => next(), { id: "sync-around" });
+
+		expect(await api.svc.mulAsync(2, 3)).toBe(106);
+	});
+
+	it("a sync around may pass through the Promise a plain promise-returning target produced", async () => {
+		api = await boot(config);
+		const always = [];
+		api.slothlet.hook.on("svc.mulThenable:after", ({ result }) => result + 1, { id: "after" });
+		api.slothlet.hook.on("svc.mulThenable:always", ({ result }) => always.push(result), { id: "always" });
+		api.slothlet.hook.on("svc.mulThenable:around", ({ next }) => next(), { id: "pass-through" });
+
+		expect(await api.svc.mulThenable(2, 3)).toBe(7);
+		expect(always).toEqual([7]);
+	});
+
+	it("an undeclared thenable from a sync around fails loudly with HOOK_AROUND_RETURNED_PROMISE", async () => {
+		api = await boot(config);
+		const sources = [];
+		api.slothlet.hook.on("svc.mulSync:error", ({ error, source }) => sources.push({ code: error.code, type: source.type }), { id: "er" });
+		// A plain function returning a Promise reads as synchronous — the brand check cannot see it.
+		api.slothlet.hook.on("svc.mulSync:around", ({ next }) => Promise.resolve(next()), { id: "undeclared" });
+
+		const result = await outcome(() => api.svc.mulSync(2, 3));
+		expect(result.ok).toBe(false);
+		expect(result.error.code).toBe("HOOK_AROUND_RETURNED_PROMISE");
+		expect(result.error.message).toContain("undeclared");
+		expect(sources).toEqual([{ code: "HOOK_AROUND_RETURNED_PROMISE", type: "around" }]);
+	});
+
+	it("a sync around deriving a new thenable from next() is refused too — only pass-through is allowed", async () => {
+		api = await boot(config);
+		api.slothlet.hook.on("svc.mulThenable:around", ({ next }) => next().then((value) => value * 2), { id: "derived" });
+
+		const result = await outcome(() => api.svc.mulThenable(2, 3));
+		expect(result.error.code).toBe("HOOK_AROUND_RETURNED_PROMISE");
+	});
+
+	it("async pipeline error flow: a swallowed rejection is hidden from error hooks, a rethrown one is not", async () => {
+		api = await boot(config);
+		const errors = [];
+		api.slothlet.hook.on("svc.failAsync:error", ({ error, source }) => errors.push(`${error.message}:${source.type}`), { id: "er" });
+		const swallowId = api.slothlet.hook.on(
+			"svc.failAsync:around",
+			async ({ next }) => {
+				try {
+					return await next();
+				} catch {
+					return "fallback";
+				}
+			},
+			{ id: "swallow" }
+		);
+
+		expect(await api.svc.failAsync("gone")).toBe("fallback");
+		expect(errors).toEqual([]);
+
+		api.slothlet.hook.remove({ id: swallowId });
+		const rolledBack = [];
+		api.slothlet.hook.on(
+			"svc.failAsync:around",
+			async ({ next }) => {
+				try {
+					return await next();
+				} catch (error) {
+					rolledBack.push(error.message);
+					throw error;
+				}
+			},
+			{ id: "rethrow" }
+		);
+		const result = await outcome(() => api.svc.failAsync("seen"));
+		expect(result.error.message).toBe("seen");
+		expect(rolledBack).toEqual(["seen"]);
+		expect(errors).toEqual(["seen:function"]);
+	});
+
+	it("#496: next() inside AsyncLocalStorage.run makes the store visible to a sync target", async () => {
+		api = await boot(config);
+		api.slothlet.hook.on("svc.whoSync:around", ({ next }) => requestStore.run({ requestId: "req-1" }, () => next()), { id: "als" });
+
+		expect(api.svc.whoSync()).toBe("req-1");
+		expect(requestStore.getStore(), "the store does not leak out of the call").toBeUndefined();
+	});
+
+	it("#496: the store survives an await inside the target (sync around)", async () => {
+		api = await boot(config);
+		api.slothlet.hook.on("svc.whoAsync:around", ({ next }) => requestStore.run({ requestId: "req-2" }, () => next()), { id: "als" });
+
+		expect(await api.svc.whoAsync()).toEqual(["req-2", "req-2"]);
+	});
+
+	it("#496: the store survives an await inside the target (async around, before hooks awaited first)", async () => {
+		api = await boot(config);
+		// An async before hook forces an await ahead of the target inside the pipeline next() runs.
+		api.slothlet.hook.on(
+			"svc.whoAsync:before",
+			async () => {
+				await Promise.resolve();
+			},
+			{ id: "async-before" }
+		);
+		api.slothlet.hook.on(
+			"svc.whoAsync:around",
+			async ({ next }) => {
+				await Promise.resolve();
+				return requestStore.run({ requestId: "req-3" }, () => next());
+			},
+			{ id: "als" }
+		);
+
+		expect(await api.svc.whoAsync()).toEqual(["req-3", "req-3"]);
+	});
+
+	it("async pipeline: before and after hook failures reach the around hook with their own sources", async () => {
+		api = await boot(config);
+		const sources = [];
+		const caught = [];
+		api.slothlet.hook.on("svc.mulSync:error", ({ source }) => sources.push(source.type), { id: "er" });
+		api.slothlet.hook.on(
+			"svc.mulSync:around",
+			async ({ next }) => {
+				try {
+					return await next();
+				} catch (error) {
+					caught.push(error.message);
+					throw error;
+				}
+			},
+			{ id: "ar" }
+		);
+		const beforeId = api.slothlet.hook.on(
+			"svc.mulSync:before",
+			async () => {
+				throw new Error("pre");
+			},
+			{ id: "be" }
+		);
+
+		expect((await outcome(() => api.svc.mulSync(1, 2))).error.message).toBe("pre");
+		api.slothlet.hook.remove({ id: beforeId });
+		api.slothlet.hook.on(
+			"svc.mulSync:after",
+			async () => {
+				throw new Error("post");
+			},
+			{ id: "af" }
+		);
+		expect((await outcome(() => api.svc.mulSync(1, 2))).error.message).toBe("post");
+
+		expect(caught).toEqual(["pre", "post"]);
+		expect(sources).toEqual(["before", "after"]);
+	});
+
+	it("a passed-through rejection from a plain promise-returning target reaches error and always hooks", async () => {
+		api = await boot(config);
+		const errors = [];
+		const always = [];
+		api.slothlet.hook.on("svc.rejectThenable:error", ({ error, source }) => errors.push(`${error.message}:${source.type}`), { id: "er" });
+		api.slothlet.hook.on("svc.rejectThenable:always", ({ hasError }) => always.push(hasError), { id: "al" });
+		api.slothlet.hook.on("svc.rejectThenable:around", ({ next }) => next(), { id: "pass-through" });
+
+		const result = await outcome(() => api.svc.rejectThenable("late"));
+		expect(result.error.message).toBe("late");
+		expect(errors).toEqual(["late:function"]);
+		expect(always).toEqual([true]);
+	});
+
+	it("an async before hook promotes the call with a sync around in place", async () => {
+		api = await boot(config);
+		api.slothlet.hook.on("svc.mulSync:before", async ({ args }) => [args[0] * 2, args[1]], { id: "async-before" });
+		api.slothlet.hook.on("svc.mulSync:around", ({ next }) => next(), { id: "sync-around" });
+
+		const pending = api.svc.mulSync(2, 3);
+		expect(() => `${pending}`).toThrow(/svc\.mulSync/);
+		expect(await pending).toBe(12);
+	});
+});
+
+describe("Hooks > around dispatch strategy (#496)", () => {
+	let api;
+
+	afterEach(async () => {
+		if (api) await api.shutdown();
+		api = null;
+	});
+
+	it("reports around hooks in the cached per-path strategy and invalidates on change", async () => {
+		const { resolveWrapper } = await import("#handlers/unified-wrapper");
+		api = await boot({ mode: "eager" });
+		const hookManager = resolveWrapper(api.svc).slothlet.handlers.hookManager;
+
+		expect(hookManager.getDispatchStrategy("svc.mulSync")).toMatchObject({ hasAround: false, asyncAround: false });
+
+		api.slothlet.hook.on("svc.*:around", ({ next }) => next(), { id: "sync" });
+		const strategy = hookManager.getDispatchStrategy("svc.mulSync");
+		expect(strategy).toMatchObject({ hasAround: true, asyncAround: false });
+		expect(hookManager.getDispatchStrategy("svc.mulSync"), "cached").toBe(strategy);
+
+		api.slothlet.hook.on("svc.*:around", async ({ next }) => next(), { id: "async" });
+		expect(hookManager.getDispatchStrategy("svc.mulSync")).toMatchObject({ hasAround: true, asyncAround: true });
+
+		api.slothlet.hook.disable({ type: "around" });
+		expect(hookManager.getDispatchStrategy("svc.mulSync")).toMatchObject({ hasAround: false, asyncAround: false });
+	});
+
+	it("preserves an around hook's { async: true } declaration across a full reload", async () => {
+		api = await boot({ mode: "eager" });
+		api.slothlet.hook.on("svc.mulSync:around", ({ next }) => Promise.resolve().then(() => next()), { id: "declared", async: true });
+		expect(await api.svc.mulSync(2, 3)).toBe(6);
+
+		await api.slothlet.reload();
+		expect(api.slothlet.hook.list({ type: "around" }).registeredHooks.map((hook) => hook.id)).toEqual(["declared"]);
+		expect(await api.svc.mulSync(2, 3)).toBe(6);
+	});
+});
diff --git a/tests/vitests/suites/hooks/hooks-around-permissions.test.vitest.mjs b/tests/vitests/suites/hooks/hooks-around-permissions.test.vitest.mjs
new file mode 100644
index 000000000..904f11183
--- /dev/null
+++ b/tests/vitests/suites/hooks/hooks-around-permissions.test.vitest.mjs
@@ -0,0 +1,153 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/hooks/hooks-around-permissions.test.vitest.mjs
+ *	@Date: 2026-09-28 12:00:00 -07:00 (1790622000)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 12:00:00 -07:00 (1790622000)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Permissions and pinning for `around` hooks (#496).
+ *
+ * @description
+ * An around hook can replace args and results and prevent the call entirely, so it is gated exactly
+ * like a transforming (`before`) hook: rule targets use the `pattern:around` suffix (`:hook` covers
+ * it), concrete registrations are checked up front, glob registrations are filtered per concrete
+ * path at fire time, and module-registered hooks are force-pinned to their owner.
+ *
+ * Pinning runs the around handler as its owner — but the rest of the pipeline its `next()` runs
+ * belongs to the intercepted call, so the target still sees that call's own caller.
+ */
+
+import { describe, it, expect, beforeAll, afterAll, beforeEach, afterEach } from "vitest";
+import { mkdirSync, writeFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import slothlet from "@cldmv/slothlet";
+import { SlothletWarning } from "@cldmv/slothlet/errors";
+import { getMatrixConfigs } from "../../setup/vitest-helper.mjs";
+
+const DIR = join(process.cwd(), "tmp", "hook-around-permissions-fixture");
+
+beforeAll(() => {
+	mkdirSync(join(DIR, "db"), { recursive: true });
+	writeFileSync(join(DIR, "db", "read.mjs"), `export function read() { return "data"; }\n`);
+	writeFileSync(join(DIR, "db", "write.mjs"), `export function write(x) { return "wrote:" + x; }\n`);
+	writeFileSync(
+		join(DIR, "db", "who.mjs"),
+		`import { self } from "@cldmv/slothlet/runtime";
+export function who() { return self.slothlet.metadata.caller()?.apiPath ?? null; }
+`
+	);
+	writeFileSync(
+		join(DIR, "client.mjs"),
+		`import { self } from "@cldmv/slothlet/runtime";
+export function callWho() { return self.db.who(); }
+`
+	);
+	writeFileSync(
+		join(DIR, "auditor.mjs"),
+		`import { self } from "@cldmv/slothlet/runtime";
+export function arm(typePattern, sink) {
+	return self.slothlet.hook.on(typePattern, (ctx) => {
+		if (sink) sink.push({ path: ctx.path, entry: ctx.entry, caller: ctx.caller ? ctx.caller.apiPath : null });
+		return typeof ctx.next === "function" ? ctx.next() : undefined;
+	});
+}
+export function armOpts(typePattern, options) { return self.slothlet.hook.on(typePattern, ({ next }) => next(), options); }
+`
+	);
+});
+
+afterAll(() => rmSync(DIR, { recursive: true, force: true }));
+
+describe.each(getMatrixConfigs())("Hooks > around permissions and pinning (#496) > $name", ({ config }) => {
+	let api;
+
+	beforeEach(() => {
+		SlothletWarning.suppressConsole = true;
+		SlothletWarning.clearCaptured();
+	});
+
+	afterEach(async () => {
+		if (api) await api.shutdown();
+		api = null;
+		SlothletWarning.clearCaptured();
+	});
+
+	const boot = (permissions) => slothlet({ ...config, base: DIR, hook: true, ...(permissions ? { permissions } : {}) });
+	// Takes a thunk so the call happens INSIDE try — a synchronous throw is caught the same as a rejection.
+	const tryCall = async (fn) => {
+		try {
+			return { ok: true, value: await fn() };
+		} catch (e) {
+			return { ok: false, code: e.code };
+		}
+	};
+
+	it("denies a module registering a concrete-target around hook on a denied path", async () => {
+		api = await boot({ defaultPolicy: "deny", rules: [] });
+		const r = await tryCall(() => api.auditor.arm("db.write:around"));
+		expect(r.ok).toBe(false);
+		expect(r.code).toBe("PERMISSION_DENIED");
+	});
+
+	it("allows and fires an around hook with a matching `:around` rule", async () => {
+		api = await boot({ defaultPolicy: "deny", rules: [{ caller: "auditor.**", target: "db.read:around", effect: "allow" }] });
+		const sink = [];
+		expect((await tryCall(() => api.auditor.arm("db.read:around", sink))).ok).toBe(true);
+		expect(await api.db.read()).toBe("data");
+		expect(sink).toEqual([{ path: "db.read", entry: true, caller: null }]);
+	});
+
+	it("an `:around` rule grants only around — a before hook on the same path stays denied", async () => {
+		api = await boot({ defaultPolicy: "deny", rules: [{ caller: "auditor.**", target: "db.read:around", effect: "allow" }] });
+		expect((await tryCall(() => api.auditor.arm("db.read:before"))).code).toBe("PERMISSION_DENIED");
+	});
+
+	it("`:hook` grants around hooks too", async () => {
+		api = await boot({ defaultPolicy: "deny", rules: [{ caller: "auditor.**", target: "db.read:hook", effect: "allow" }] });
+		expect((await tryCall(() => api.auditor.arm("db.read:around"))).ok).toBe(true);
+	});
+
+	it("an around-only deny blocks the hook while the path stays callable", async () => {
+		api = await boot({ defaultPolicy: "allow", rules: [{ caller: "auditor.**", target: "db.read:around", effect: "deny" }] });
+		expect((await tryCall(() => api.auditor.arm("db.read:around"))).code).toBe("PERMISSION_DENIED");
+		expect(await api.db.read()).toBe("data");
+	});
+
+	it("fire-time gating: a glob around hook fires only on paths its owner may hook", async () => {
+		api = await boot({ defaultPolicy: "deny", rules: [{ caller: "auditor.**", target: "db.read:around", effect: "allow" }] });
+		const sink = [];
+		await api.auditor.arm("db.*:around", sink);
+		expect(await api.db.write(1)).toBe("wrote:1");
+		expect(await api.db.read()).toBe("data");
+		expect(sink.map((entry) => entry.path)).toEqual(["db.read"]);
+	});
+
+	it("force-pins a module around hook registered with lockCaller:false and warns", async () => {
+		api = await boot(null);
+		const id = await api.auditor.armOpts("db.read:around", { lockCaller: false });
+		expect(api.slothlet.hook.list({ id }).registeredHooks[0].lockCaller).toBe(true);
+		expect(SlothletWarning.captured.some((w) => w.code === "HOOK_UNPINNED_IGNORED")).toBe(true);
+	});
+
+	it("a pinned around hook's next() runs the target as the intercepted call, not as the hook owner", async () => {
+		api = await boot(null);
+		const sink = [];
+		await api.auditor.arm("db.who:around", sink);
+
+		// Entry call: no module caller — the hook owner must not leak in as the target's caller.
+		expect(await api.db.who()).toBeNull();
+		// Nested call: the target sees the module that actually called it.
+		expect(await api.client.callWho()).toBe("client.callWho");
+		expect(sink).toEqual([
+			{ path: "db.who", entry: true, caller: null },
+			{ path: "db.who", entry: false, caller: "client.callWho" }
+		]);
+	});
+});
diff --git a/tests/vitests/suites/hooks/hooks-around.test.vitest.mjs b/tests/vitests/suites/hooks/hooks-around.test.vitest.mjs
new file mode 100644
index 000000000..6f12b310c
--- /dev/null
+++ b/tests/vitests/suites/hooks/hooks-around.test.vitest.mjs
@@ -0,0 +1,515 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/hooks/hooks-around.test.vitest.mjs
+ *	@Date: 2026-09-28 12:00:00 -07:00 (1790622000)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 12:00:00 -07:00 (1790622000)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview The `around` hook type (#496): pipeline shape, args/result transforms, short-circuit,
+ * error flow, priority nesting, caller/entry context, `next()` misuse and hook management.
+ *
+ * @description
+ * `hook.on("<pattern>:around", ({ path, args, next, caller, entry }) => next(args))` wraps the rest of
+ * the pipeline. Order, outermost first: `always`/`error` observers → around hooks (highest priority
+ * outermost) → before hooks → the function → after hooks. Because the observers sit outside the
+ * around chain they see what the caller receives: an error an around rethrows reaches the error
+ * hooks, one it swallows does not, and `always` fires once after the chain settles.
+ */
+
+import { describe, it, expect, afterEach } from "vitest";
+import slothlet from "@cldmv/slothlet";
+import { getMatrixConfigs } from "../../setup/vitest-helper.mjs";
+
+// Minimal boot base; targets are mounted inline per test.
+const BASE = new URL("../../../../api_tests/api_test_underscore", import.meta.url).pathname;
+
+/** The api the inline targets call back into for nested calls; set by boot(). */
+let current = null;
+
+/** Probe log shared by the targets and the hooks of one test. */
+const log = [];
+
+const TARGETS = {
+	exports: {
+		/**
+		 * Synchronous target that records its own execution.
+		 * @param {number} a - Left operand.
+		 * @param {number} b - Right operand.
+		 * @returns {number} Product.
+		 */
+		mul(a, b) {
+			log.push(`fn(${a},${b})`);
+			return a * b;
+		},
+		/**
+		 * Target that always throws.
+		 * @param {string} message - Error message.
+		 * @returns {never} Never returns.
+		 */
+		fail(message) {
+			log.push("fn-fail");
+			throw new Error(message);
+		},
+		/**
+		 * Makes a nested wrapper-to-wrapper call.
+		 * @param {number} a - Operand.
+		 * @returns {number} `svc.mul(a, 2)`.
+		 */
+		outer(a) {
+			log.push("fn-outer");
+			return current.svc.mul(a, 2);
+		}
+	}
+};
+
+/**
+ * Boots an api with hooks enabled over the shared base and mounts the targets.
+ * @param {object} config - Matrix configuration for this run.
+ * @param {object} [hook={}] - Extra hook config.
+ * @returns {Promise<object>} The bound api.
+ */
+async function boot(config, hook = {}) {
+	log.length = 0;
+	const api = await slothlet({ ...config, base: BASE, hook: { enabled: true, ...hook } });
+	await api.slothlet.api.add("svc", TARGETS);
+	current = api;
+	return api;
+}
+
+/**
+ * Captures a synchronous or asynchronous failure of a call.
+ * @param {function(): *} fn - Thunk making the call.
+ * @returns {Promise<{ok: boolean, value?: *, error?: *}>} Outcome.
+ */
+async function outcome(fn) {
+	try {
+		return { ok: true, value: await fn() };
+	} catch (error) {
+		return { ok: false, error };
+	}
+}
+
+describe.each(getMatrixConfigs({ hook: { enabled: true } }))("Hooks > around (#496) > $name", ({ config }) => {
+	let api;
+
+	afterEach(async () => {
+		if (api) await api.shutdown();
+		api = null;
+		current = null;
+	});
+
+	it("wraps before → function → after, with always outside the around", async () => {
+		api = await boot(config);
+		api.slothlet.hook.on("svc.mul:always", () => log.push("always"), { id: "al" });
+		// Block bodies: a before hook returning a non-array value would short-circuit, and an after
+		// hook returning one would replace the result.
+		api.slothlet.hook.on(
+			"svc.mul:before",
+			() => {
+				log.push("before");
+			},
+			{ id: "be" }
+		);
+		api.slothlet.hook.on(
+			"svc.mul:after",
+			() => {
+				log.push("after");
+			},
+			{ id: "af" }
+		);
+		api.slothlet.hook.on(
+			"svc.mul:around",
+			({ next }) => {
+				log.push("around-in");
+				const result = next();
+				log.push("around-out");
+				return result;
+			},
+			{ id: "ar" }
+		);
+
+		expect(await api.svc.mul(2, 3)).toBe(6);
+		expect(log).toEqual(["around-in", "before", "fn(2,3)", "after", "around-out", "always"]);
+	});
+
+	it("receives path and args, and next(args) replaces the args for the rest of the pipeline", async () => {
+		api = await boot(config);
+		const seen = [];
+		api.slothlet.hook.on(
+			"svc.mul:around",
+			({ path, args, next }) => {
+				seen.push({ path, args });
+				return next([args[0] + 1, args[1]]);
+			},
+			{ id: "ar" }
+		);
+		api.slothlet.hook.on(
+			"svc.mul:before",
+			({ args }) => {
+				seen.push({ before: args });
+			},
+			{ id: "be" }
+		);
+
+		expect(await api.svc.mul(2, 3)).toBe(9);
+		expect(seen).toEqual([{ path: "svc.mul", args: [2, 3] }, { before: [3, 3] }]);
+	});
+
+	it("next() with no argument forwards the current args", async () => {
+		api = await boot(config);
+		api.slothlet.hook.on("svc.mul:around", ({ next }) => next([10, 2]), { id: "outer", priority: 10 });
+		api.slothlet.hook.on("svc.mul:around", ({ next }) => next(), { id: "inner", priority: 1 });
+
+		expect(await api.svc.mul(2, 3)).toBe(20);
+		expect(log).toEqual(["fn(10,2)"]);
+	});
+
+	it("transforms the result — after hooks have already run inside next()", async () => {
+		api = await boot(config);
+		api.slothlet.hook.on("svc.mul:after", ({ result }) => result + 1, { id: "af" });
+		api.slothlet.hook.on("svc.mul:around", ({ next }) => next() * 10, { id: "ar" });
+
+		// (2*3 + 1) * 10
+		expect(await api.svc.mul(2, 3)).toBe(70);
+	});
+
+	it("short-circuits when next is never called: its return value is the result", async () => {
+		api = await boot(config);
+		const always = [];
+		api.slothlet.hook.on("svc.mul:before", () => log.push("before"), { id: "be" });
+		api.slothlet.hook.on("svc.mul:after", () => log.push("after"), { id: "af" });
+		api.slothlet.hook.on("svc.mul:always", ({ result, hasError }) => always.push({ result, hasError }), { id: "al" });
+		api.slothlet.hook.on("svc.mul:around", () => "cached", { id: "ar" });
+
+		expect(await api.svc.mul(2, 3)).toBe("cached");
+		expect(log, "before, function and after never ran").toEqual([]);
+		expect(always).toEqual([{ result: "cached", hasError: false }]);
+	});
+
+	it("an around that swallows the function's error hides it from error hooks", async () => {
+		api = await boot(config);
+		const errors = [];
+		const always = [];
+		api.slothlet.hook.on("svc.fail:error", ({ error }) => errors.push(error.message), { id: "er" });
+		api.slothlet.hook.on("svc.fail:always", ({ result, hasError }) => always.push({ result, hasError }), { id: "al" });
+		api.slothlet.hook.on(
+			"svc.fail:around",
+			({ next }) => {
+				try {
+					return next();
+				} catch (error) {
+					return `recovered:${error.message}`;
+				}
+			},
+			{ id: "ar" }
+		);
+
+		expect(await api.svc.fail("boom")).toBe("recovered:boom");
+		expect(errors, "the caller never saw an error, so neither do error hooks").toEqual([]);
+		expect(always).toEqual([{ result: "recovered:boom", hasError: false }]);
+	});
+
+	it("an error rethrown after a rollback reaches error hooks once, with its original source", async () => {
+		api = await boot(config);
+		const errors = [];
+		const always = [];
+		api.slothlet.hook.on("svc.fail:error", ({ error, source }) => errors.push({ message: error.message, type: source.type }), { id: "er" });
+		api.slothlet.hook.on("svc.fail:always", ({ hasError, errors: errs }) => always.push({ hasError, count: errs.length }), { id: "al" });
+		api.slothlet.hook.on(
+			"svc.fail:around",
+			({ next }) => {
+				try {
+					return next();
+				} catch (error) {
+					log.push("rollback");
+					throw error;
+				}
+			},
+			{ id: "ar" }
+		);
+
+		const result = await outcome(() => api.svc.fail("boom"));
+		expect(result.ok).toBe(false);
+		expect(result.error.message).toBe("boom");
+		expect(log).toEqual(["fn-fail", "rollback"]);
+		expect(errors).toEqual([{ message: "boom", type: "function" }]);
+		expect(always).toEqual([{ hasError: true, count: 1 }]);
+	});
+
+	it("an around hook's own error is reported with an `around` source", async () => {
+		api = await boot(config);
+		const sources = [];
+		api.slothlet.hook.on("svc.mul:error", ({ source }) => sources.push(source), { id: "er" });
+		api.slothlet.hook.on(
+			"svc.mul:around",
+			() => {
+				throw new Error("denied");
+			},
+			{ id: "gate", subset: "before" }
+		);
+
+		const result = await outcome(() => api.svc.mul(1, 2));
+		expect(result.error.message).toBe("denied");
+		expect(sources).toHaveLength(1);
+		expect(sources[0]).toMatchObject({ type: "around", hookId: "gate", hookTag: "gate", subset: "before" });
+		expect(typeof sources[0].timestamp).toBe("number");
+		expect(log, "target never ran").toEqual([]);
+	});
+
+	it("a before hook's error propagates through next() to the around hook", async () => {
+		api = await boot(config);
+		const sources = [];
+		const caught = [];
+		api.slothlet.hook.on("svc.mul:error", ({ source }) => sources.push(source.type), { id: "er" });
+		api.slothlet.hook.on(
+			"svc.mul:before",
+			() => {
+				throw new Error("invalid");
+			},
+			{ id: "be" }
+		);
+		api.slothlet.hook.on(
+			"svc.mul:around",
+			({ next }) => {
+				try {
+					return next();
+				} catch (error) {
+					caught.push(error.message);
+					throw error;
+				}
+			},
+			{ id: "ar" }
+		);
+
+		const result = await outcome(() => api.svc.mul(1, 2));
+		expect(result.error.message).toBe("invalid");
+		expect(caught).toEqual(["invalid"]);
+		expect(sources).toEqual(["before"]);
+	});
+
+	it("an after hook's error propagates through next() and is reported with an `after` source", async () => {
+		api = await boot(config);
+		const sources = [];
+		const caught = [];
+		api.slothlet.hook.on("svc.mul:error", ({ source }) => sources.push({ type: source.type, hookId: source.hookId }), { id: "er" });
+		api.slothlet.hook.on(
+			"svc.mul:after",
+			() => {
+				throw new Error("post");
+			},
+			{ id: "af" }
+		);
+		api.slothlet.hook.on(
+			"svc.mul:around",
+			({ next }) => {
+				try {
+					return next();
+				} catch (error) {
+					caught.push(error.message);
+					throw error;
+				}
+			},
+			{ id: "ar" }
+		);
+
+		const result = await outcome(() => api.svc.mul(1, 2));
+		expect(result.error.message).toBe("post");
+		expect(caught).toEqual(["post"]);
+		expect(sources).toEqual([{ type: "after", hookId: "af" }]);
+	});
+
+	it("suppressErrors applies to what escapes the around chain", async () => {
+		api = await boot(config, { suppressErrors: true });
+		const errors = [];
+		api.slothlet.hook.on("svc.fail:error", ({ error }) => errors.push(error.message), { id: "er" });
+		api.slothlet.hook.on("svc.fail:around", ({ next }) => next(), { id: "ar" });
+
+		expect(await api.svc.fail("quiet")).toBeUndefined();
+		expect(errors).toEqual(["quiet"]);
+	});
+
+	it("always fires exactly once per call, after the around chain settles", async () => {
+		api = await boot(config);
+		let alwaysCount = 0;
+		api.slothlet.hook.on(
+			"svc.mul:always",
+			() => {
+				alwaysCount++;
+				log.push("always");
+			},
+			{ id: "al" }
+		);
+		api.slothlet.hook.on("svc.mul:around", ({ next }) => (log.push("outer"), next()), { id: "a1", priority: 2 });
+		api.slothlet.hook.on("svc.mul:around", ({ next }) => (log.push("inner"), next()), { id: "a2", priority: 1 });
+
+		await api.svc.mul(1, 1);
+		expect(alwaysCount).toBe(1);
+		expect(log.at(-1)).toBe("always");
+	});
+
+	it("nests multiple around hooks by priority — highest outermost, subsets ordered first", async () => {
+		api = await boot(config);
+		const wrap =
+			(name) =>
+			({ next }) => {
+				log.push(`${name}>`);
+				const value = next();
+				log.push(`<${name}`);
+				return value;
+			};
+		api.slothlet.hook.on("svc.mul:around", wrap("low"), { id: "low", priority: 1 });
+		api.slothlet.hook.on("svc.mul:around", wrap("high"), { id: "high", priority: 100 });
+		api.slothlet.hook.on("svc.mul:around", wrap("auth"), { id: "auth", subset: "before", priority: 0 });
+		api.slothlet.hook.on("svc.mul:around", wrap("audit"), { id: "audit", subset: "after", priority: 1000 });
+
+		expect(await api.svc.mul(2, 2)).toBe(4);
+		expect(log).toEqual(["auth>", "high>", "low>", "audit>", "fn(2,2)", "<audit", "<low", "<high", "<auth"]);
+	});
+
+	it("reports entry/caller: an outside call is an entry, a nested call carries its caller", async () => {
+		api = await boot(config);
+		const seen = [];
+		api.slothlet.hook.on(
+			"svc.**:around",
+			({ path, entry, caller, next }) => {
+				seen.push({ path, entry, caller: caller ? caller.apiPath : caller });
+				return next();
+			},
+			{ id: "ar" }
+		);
+
+		expect(await api.svc.outer(5)).toBe(10);
+		expect(seen).toEqual([
+			{ path: "svc.outer", entry: true, caller: null },
+			{ path: "svc.mul", entry: false, caller: "svc.outer" }
+		]);
+	});
+
+	it("scopes next() to its own call: a nested call's args change does not leak outward", async () => {
+		api = await boot(config);
+		api.slothlet.hook.on("svc.mul:around", ({ args, next }) => next([args[0], 100]), { id: "nested" });
+		api.slothlet.hook.on("svc.outer:around", ({ next }) => next() + 1, { id: "outer" });
+
+		// outer(5) → mul(5, 2) rewritten to mul(5, 100) = 500, then the outer around adds 1.
+		expect(await api.svc.outer(5)).toBe(501);
+		expect(log).toEqual(["fn-outer", "fn(5,100)"]);
+	});
+
+	it("calling next() twice throws HOOK_AROUND_NEXT_CALLED_TWICE (reported as an around failure)", async () => {
+		api = await boot(config);
+		const sources = [];
+		api.slothlet.hook.on("svc.mul:error", ({ error, source }) => sources.push({ code: error.code, type: source.type }), { id: "er" });
+		api.slothlet.hook.on(
+			"svc.mul:around",
+			({ next }) => {
+				next();
+				return next();
+			},
+			{ id: "twice" }
+		);
+
+		const result = await outcome(() => api.svc.mul(2, 3));
+		expect(result.ok).toBe(false);
+		expect(result.error.code).toBe("HOOK_AROUND_NEXT_CALLED_TWICE");
+		expect(result.error.message).toContain("svc.mul");
+		expect(log, "the target ran exactly once").toEqual(["fn(2,3)"]);
+		expect(sources).toEqual([{ code: "HOOK_AROUND_NEXT_CALLED_TWICE", type: "around" }]);
+	});
+
+	it("next() with a non-array argument throws HOOK_AROUND_NEXT_INVALID_ARGS", async () => {
+		api = await boot(config);
+		api.slothlet.hook.on("svc.mul:around", ({ next }) => next(5), { id: "bad" });
+
+		const result = await outcome(() => api.svc.mul(2, 3));
+		expect(result.error.code).toBe("HOOK_AROUND_NEXT_INVALID_ARGS");
+		expect(log).toEqual([]);
+	});
+
+	it("is managed like any other hook type: list, disable/enable, remove", async () => {
+		api = await boot(config);
+		api.slothlet.hook.on("svc.mul:around", ({ next }) => next() * 2, { id: "double" });
+
+		const { registeredHooks } = api.slothlet.hook.list({ type: "around" });
+		expect(registeredHooks).toEqual([expect.objectContaining({ id: "double", type: "around", pattern: "svc.mul", subset: "primary" })]);
+		expect(api.slothlet.hook.list("around").registeredHooks).toHaveLength(1);
+		expect(await api.svc.mul(2, 3)).toBe(12);
+
+		api.slothlet.hook.disable({ id: "double" });
+		expect(await api.svc.mul(2, 3)).toBe(6);
+		api.slothlet.hook.enable({ id: "double" });
+		expect(await api.svc.mul(2, 3)).toBe(12);
+
+		expect(api.slothlet.hook.remove({ type: "around" })).toBe(1);
+		expect(await api.svc.mul(2, 3)).toBe(6);
+		expect(api.slothlet.hook.list({ type: "around" }).registeredHooks).toEqual([]);
+	});
+
+	it("honours the global path filter", async () => {
+		api = await boot(config);
+		api.slothlet.hook.on("svc.**:around", ({ next }) => next() * 2, { id: "double" });
+		expect(await api.svc.mul(2, 3)).toBe(12);
+
+		api.slothlet.hook.enablePattern("other.**");
+		expect(await api.svc.mul(2, 3), "path excluded by the filter").toBe(6);
+
+		api.slothlet.hook.resetPatternFilter();
+		expect(await api.svc.mul(2, 3)).toBe(12);
+	});
+});
+
+describe("Hooks > around (#496) > versioned registration", () => {
+	let api;
+
+	afterEach(async () => {
+		if (api) await api.shutdown();
+		api = null;
+	});
+
+	it("resolves through the version dispatcher and fires with the version in context", async () => {
+		api = await slothlet({ mode: "eager", base: BASE, hook: { enabled: true } });
+		for (const version of ["v1", "v2"]) {
+			await api.slothlet.api.add(
+				"auth",
+				{
+					exports: {
+						/**
+						 * Versioned leaf.
+						 * @returns {string} Identifier.
+						 */
+						login() {
+							return `login-${version}`;
+						}
+					}
+				},
+				{},
+				{ version, default: version === "v1" }
+			);
+		}
+		const fired = [];
+		const id = api.slothlet.hook.on(
+			"auth.login:around",
+			({ version, path, next }) => {
+				fired.push({ version, path });
+				return `${next()}!`;
+			},
+			{ id: "audit", versionDispatcher: () => ["v1", "v2"] }
+		);
+
+		expect(api.v1.auth.login()).toBe("login-v1!");
+		expect(api.v2.auth.login()).toBe("login-v2!");
+		expect(fired).toEqual([
+			{ version: "v1", path: "v1.auth.login" },
+			{ version: "v2", path: "v2.auth.login" }
+		]);
+
+		expect(api.slothlet.hook.remove({ id })).toBe(2);
+		expect(api.v1.auth.login()).toBe("login-v1");
+	});
+});
diff --git a/tools/ci/i18n-latin-tokens-accepted.json b/tools/ci/i18n-latin-tokens-accepted.json
index 464d84371..dd0c2a0c6 100644
--- a/tools/ci/i18n-latin-tokens-accepted.json
+++ b/tools/ci/i18n-latin-tokens-accepted.json
@@ -73,6 +73,8 @@
 			"error",
 			"before",
 			"after",
+			"around",
+			"next",
 			"lazy",
 			"Lazy",
 			"eager",
@@ -324,6 +326,8 @@
 		"error",
 		"before",
 		"after",
+		"around",
+		"next",
 		"lazy",
 		"Lazy",
 		"eager",
diff --git a/types/src/lib/builders/api_builder.d.mts.map b/types/src/lib/builders/api_builder.d.mts.map
index 8a6c9b6d0..474363b25 100644
--- a/types/src/lib/builders/api_builder.d.mts.map
+++ b/types/src/lib/builders/api_builder.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"api_builder.d.mts","sourceRoot":"","sources":["../../../../src/lib/builders/api_builder.mjs"],"names":[],"mappings":"AAmMA;;;;;;;;;;;;;GAaG;AACH;IACC,gCAAuC;IAEvC;;;;;;;OAOG;IACH,sBANW,MAAM,EAQhB;IAED;;;;;OAKG;IACH,8BAJW,MAAM,GACJ,OAAO,CAAC,MAAM,CAAC,CA6G3B;IAED;;;;;;;;;;;OAWG;IACH,gCA2qGC;IAED;;;;OAIG;IACH,+BA4BC;IAED;;;;OAIG;IACH,0BAgCC;IAED;;;;OAIG;IACH,4BAsTC;IAED;;;;;OAKG;IACH,8BAmEC;IAED;;;;;OAKG;IACH,uBAgCC;CACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAr+H6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"api_builder.d.mts","sourceRoot":"","sources":["../../../../src/lib/builders/api_builder.mjs"],"names":[],"mappings":"AAmMA;;;;;;;;;;;;;GAaG;AACH;IACC,gCAAuC;IAEvC;;;;;;;OAOG;IACH,sBANW,MAAM,EAQhB;IAED;;;;;OAKG;IACH,8BAJW,MAAM,GACJ,OAAO,CAAC,MAAM,CAAC,CA6G3B;IAED;;;;;;;;;;;OAWG;IACH,gCAmrGC;IAED;;;;OAIG;IACH,+BA4BC;IAED;;;;OAIG;IACH,0BAgCC;IAED;;;;OAIG;IACH,4BAsTC;IAED;;;;;OAKG;IACH,8BAmEC;IAED;;;;;OAKG;IACH,uBAgCC;CACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BA7+H6B,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/lib/handlers/context-async.d.mts b/types/src/lib/handlers/context-async.d.mts
index 0b8dcec69..b99602337 100644
--- a/types/src/lib/handlers/context-async.d.mts
+++ b/types/src/lib/handlers/context-async.d.mts
@@ -39,6 +39,32 @@ export class AsyncContextManager {
      * @public
      */
     public runInContext(instanceID: string, fn: Function, thisArg: any, args: any[], currentWrapper?: Object, rawErrors?: boolean, asHost?: boolean): any;
+    /**
+     * Capture the executing async flow's slothlet store so it can be re-entered later.
+     *
+     * Used by around hooks: a pinned around handler runs as the module that registered it, but the
+     * rest of the pipeline its `next()` runs belongs to the intercepted call, whose target must see
+     * that call's own caller.
+     *
+     * @returns {{store: object|undefined}} Snapshot for {@link AsyncContextManager#runInFlow}.
+     * @public
+     */
+    public captureFlow(): {
+        store: object | undefined;
+    };
+    /**
+     * Run a callback with a flow captured by {@link AsyncContextManager#captureFlow} active. Only
+     * slothlet's own AsyncLocalStorage is switched — any other async context (an application's own
+     * `AsyncLocalStorage.run()` scope around `next()`) stays exactly as it is.
+     *
+     * @param {{store: object|undefined}} flow - Captured flow.
+     * @param {function(): *} fn - Callback to run.
+     * @returns {*} The callback's return value.
+     * @public
+     */
+    public runInFlow(flow: {
+        store: object | undefined;
+    }, fn: () => any): any;
     /**
      * Get current active context
      * @returns {Object} Current context store
diff --git a/types/src/lib/handlers/context-async.d.mts.map b/types/src/lib/handlers/context-async.d.mts.map
index 80f3f4537..c28320feb 100644
--- a/types/src/lib/handlers/context-async.d.mts.map
+++ b/types/src/lib/handlers/context-async.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"context-async.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/context-async.mjs"],"names":[],"mappings":"AA0BA;;;;GAIG;AACH;IAKE,SAA6D;IAC7D,yBAA0B;IAG3B;;;;OAIG;IACH,kDAKC;IAED;;;;;;OAMG;IACH,8BALW,MAAM,WACN,MAAM,GACJ,MAAM,CAkBlB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,gCAhBW,MAAM,yBAEN,GAAC,gCAED,MAAM,cACN,OAAO,WAIP,OAAO,GAIL,GAAC,CAoGb;IAqBD;;;;;OAKG;IACH,qBAJa,MAAM,CAUlB;IAED;;;;;;;;;;;;OAYG;IACH,kCAVW,MAAM,GAOJ,MAAM,GAAC,SAAS,CAe5B;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,sCAVW,MAAM,GAMJ;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAC,GAAC,SAAS,CAQrE;IAED;;;;OAIG;IACH,2BAHW,MAAM,QAoBhB;IAED;;;;OAIG;IACH,yBAHa,MAAM,CAclB;;CACD;AAED;;;GAGG;AACH,sDAA6D"}
\ No newline at end of file
+{"version":3,"file":"context-async.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/context-async.mjs"],"names":[],"mappings":"AA0BA;;;;GAIG;AACH;IAKE,SAA6D;IAC7D,yBAA0B;IAG3B;;;;OAIG;IACH,kDAKC;IAED;;;;;;OAMG;IACH,8BALW,MAAM,WACN,MAAM,GACJ,MAAM,CAkBlB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,gCAhBW,MAAM,yBAEN,GAAC,gCAED,MAAM,cACN,OAAO,WAIP,OAAO,GAIL,GAAC,CAoGb;IAqBD;;;;;;;;;OASG;IACH,sBAHa;QAAC,KAAK,EAAE,MAAM,GAAC,SAAS,CAAA;KAAC,CAKrC;IAED;;;;;;;;;OASG;IACH,uBALW;QAAC,KAAK,EAAE,MAAM,GAAC,SAAS,CAAA;KAAC,MACzB,MAAY,GAAC,GACX,GAAC,CAKb;IAED;;;;;OAKG;IACH,qBAJa,MAAM,CAUlB;IAED;;;;;;;;;;;;OAYG;IACH,kCAVW,MAAM,GAOJ,MAAM,GAAC,SAAS,CAe5B;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,sCAVW,MAAM,GAMJ;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAC,GAAC,SAAS,CAQrE;IAED;;;;OAIG;IACH,2BAHW,MAAM,QAoBhB;IAED;;;;OAIG;IACH,yBAHa,MAAM,CAclB;;CACD;AAED;;;GAGG;AACH,sDAA6D"}
\ No newline at end of file
diff --git a/types/src/lib/handlers/context-live.d.mts b/types/src/lib/handlers/context-live.d.mts
index 52b1bda6d..bba2e48df 100644
--- a/types/src/lib/handlers/context-live.d.mts
+++ b/types/src/lib/handlers/context-live.d.mts
@@ -135,6 +135,40 @@ export class LiveContextManager {
      * @public
      */
     public runInContext(instanceID: string, fn: Function, thisArg: any, args: any[], currentWrapper?: Object, rawErrors?: boolean, asHost?: boolean): any;
+    /**
+     * Capture the caller identity of the executing flow so it can be re-entered later.
+     *
+     * Used by around hooks: a pinned around handler runs as the module that registered it, but the
+     * rest of the pipeline its `next()` runs belongs to the intercepted call, whose target must see
+     * that call's own caller.
+     *
+     * @param {string} instanceID - Instance whose flow to capture.
+     * @returns {{instanceID: string|null, store: object, currentWrapper: object|undefined, callerWrapper: object|undefined}|null}
+     *   Snapshot for {@link LiveContextManager#runInFlow}, or null when the instance has no store.
+     * @public
+     */
+    public captureFlow(instanceID: string): {
+        instanceID: string | null;
+        store: object;
+        currentWrapper: object | undefined;
+        callerWrapper: object | undefined;
+    } | null;
+    /**
+     * Run a callback with a flow captured by {@link LiveContextManager#captureFlow} active, then put
+     * back whatever was active before. Only the synchronous portion runs under the captured identity;
+     * a call started inside it holds its own identity until it settles, as every live call does.
+     *
+     * @param {{instanceID: string|null, store: object, currentWrapper: object|undefined, callerWrapper: object|undefined}} flow - Captured flow.
+     * @param {function(): *} fn - Callback to run.
+     * @returns {*} The callback's return value.
+     * @public
+     */
+    public runInFlow(flow: {
+        instanceID: string | null;
+        store: object;
+        currentWrapper: object | undefined;
+        callerWrapper: object | undefined;
+    }, fn: () => any): any;
     /**
      * Get current active context
      * @returns {Object} Current context store
diff --git a/types/src/lib/handlers/context-live.d.mts.map b/types/src/lib/handlers/context-live.d.mts.map
index 1b57f4c9a..9c3bb5148 100644
--- a/types/src/lib/handlers/context-live.d.mts.map
+++ b/types/src/lib/handlers/context-live.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"context-live.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/context-live.mjs"],"names":[],"mappings":"AAyEA;;;;;;;;;;;;;;;;;GAiBG;AACH,wCARW,MAAM,GACJ,MAAM,CAyBlB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,sCATW,MAAM,GACJ;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,IAAI,CAuC7C;AAaD;;;;;;;;;;;;;GAaG;AACH;IAEE,yBAA0B;IAC1B,uBAA6B;IAgE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,sCAZW,MAAM,GAQJ;QAAC,cAAc,EAAE,MAAM,GAAC,IAAI,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAC,GAAC,SAAS,CA+ChG;IAgJD;;;;OAIG;IACH,kDAgCC;IAED;;;;;;OAMG;IACH,8BALW,MAAM,WACN,MAAM,GACJ,MAAM,CAwBlB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,gCAhBW,MAAM,yBAEN,GAAC,gCAED,MAAM,cACN,OAAO,WAIP,OAAO,GAIL,GAAC,CA+Ib;IAED;;;;;OAKG;IACH,qBAJa,MAAM,CAuBlB;IAED;;;;;;;;;;;OAWG;IACH,kCATW,MAAM,GAMJ,MAAM,GAAC,SAAS,CAc5B;IAED;;;;OAIG;IACH,2BAHW,MAAM,QAyBhB;IAED;;;;OAIG;IACH,yBAHa,MAAM,CAclB;;CACD;AAED;;;GAGG;AACH,oDAA2D"}
\ No newline at end of file
+{"version":3,"file":"context-live.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/context-live.mjs"],"names":[],"mappings":"AAiEA;;;;;;;;;;;;;GAaG;AACH;IAEE,yBAA0B;IAC1B,uBAA6B;IA2B9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,sCAZW,MAAM,GAQJ;QAAC,cAAc,EAAE,MAAM,GAAC,IAAI,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAC,GAAC,SAAS,CAkDhG;IAqGD;;;;OAIG;IACH,kDAgCC;IAED;;;;;;OAMG;IACH,8BALW,MAAM,WACN,MAAM,GACJ,MAAM,CAwBlB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,gCAhBW,MAAM,yBAEN,GAAC,gCAED,MAAM,cACN,OAAO,WAIP,OAAO,GAIL,GAAC,CA0Hb;IAED;;;;;;;;;;;OAWG;IACH,+BALW,MAAM,GACJ;QAAC,UAAU,EAAE,MAAM,GAAC,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,GAAC,SAAS,CAAC;QAAC,aAAa,EAAE,MAAM,GAAC,SAAS,CAAA;KAAC,GAAC,IAAI,CAS5H;IAED;;;;;;;;;OASG;IACH,uBALW;QAAC,UAAU,EAAE,MAAM,GAAC,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,GAAC,SAAS,CAAC;QAAC,aAAa,EAAE,MAAM,GAAC,SAAS,CAAA;KAAC,MAC3G,MAAY,GAAC,GACX,GAAC,CAkBb;IAED;;;;;OAKG;IACH,qBAJa,MAAM,CAuBlB;IAED;;;;;;;;;;;OAWG;IACH,kCATW,MAAM,GAMJ,MAAM,GAAC,SAAS,CAc5B;IAED;;;;OAIG;IACH,2BAHW,MAAM,QAyBhB;IAED;;;;OAIG;IACH,yBAHa,MAAM,CAclB;;CACD;AAED;;;GAGG;AACH,oDAA2D"}
\ No newline at end of file
diff --git a/types/src/lib/handlers/hook-manager.d.mts b/types/src/lib/handlers/hook-manager.d.mts
index 5656b0555..cc0a9a13a 100644
--- a/types/src/lib/handlers/hook-manager.d.mts
+++ b/types/src/lib/handlers/hook-manager.d.mts
@@ -1,6 +1,6 @@
 /**
  * Manages hooks for API function interception.
- * Supports before/after/always/error hooks with pattern matching and priority ordering.
+ * Supports before/after/always/error/around hooks with pattern matching and priority ordering.
  *
  * @class HookManager
  * @extends ComponentBase
@@ -165,7 +165,7 @@ export class HookManager extends ComponentBase {
      * Get hooks for a specific API path and type.
      * Used internally by UnifiedWrapper.
      *
-     * @param {string} type - Hook type (before/after/always/error)
+     * @param {string} type - Hook type (before/after/always/error/around)
      * @param {string} apiPath - API path (e.g., "math.add")
      * @returns {Array<object>} Sorted array of matching hooks
      * @public
@@ -175,20 +175,22 @@ export class HookManager extends ComponentBase {
      * Derive the dispatch strategy for a path from the current hook set.
      *
      * @param {string} path - API path about to be called
-     * @returns {{asyncBefore: boolean, asyncAfter: boolean}} Whether any matching transforming
-     *   hook is asynchronous.
+     * @returns {{asyncBefore: boolean, asyncAfter: boolean, asyncAround: boolean, hasAround: boolean}}
+     *   Whether any matching transforming hook is asynchronous, and whether the path has around hooks.
      * @public
      *
      * @description
      * The strategy is a property of the CALL, derived per invocation from the registration state —
      * never baked onto the leaf, so removing an async hook returns the path to synchronous
-     * dispatch. Only TRANSFORMING hooks (before/after) are consulted: `always` and `error` are
+     * dispatch. Only TRANSFORMING hooks (before/after/around) are consulted: `always` and `error` are
      * observers whose return values are never consumed, so they never force promotion. Cached per
      * path behind the registry epoch; the hot-path cost is one integer compare.
      */
     public getDispatchStrategy(path: string): {
         asyncBefore: boolean;
         asyncAfter: boolean;
+        asyncAround: boolean;
+        hasAround: boolean;
     };
     /**
      * Execute before hooks for an API path.
@@ -197,10 +199,12 @@ export class HookManager extends ComponentBase {
      * @param {Array} args - Function arguments
      * @param {object} api - Bound API object
      * @param {object} ctx - User context object
+     * @param {HookErrorSink} [errorSink] - Around-pipeline error sink. When given, a failing hook is
+     *   reported to it and rethrown instead of running the error hooks and honouring suppressErrors.
      * @returns {object} Result object: { args, shortCircuit, value }
      * @public
      */
-    public executeBeforeHooks(path: string, args: any[], api: object, ctx: object): object;
+    public executeBeforeHooks(path: string, args: any[], api: object, ctx: object, errorSink?: HookErrorSink): object;
     /**
      * Execute after hooks for an API path.
      *
@@ -209,10 +213,12 @@ export class HookManager extends ComponentBase {
      * @param {Array} args - Original function arguments
      * @param {object} api - Bound API object
      * @param {object} ctx - User context object
+     * @param {HookErrorSink} [errorSink] - Around-pipeline error sink. When given, a failing hook is
+     *   reported to it and rethrown instead of running the error hooks and honouring suppressErrors.
      * @returns {HookExecutionResult} Object indicating if result was modified and the final result
      * @public
      */
-    public executeAfterHooks(path: string, result: any, args: any[], api: object, ctx: object): HookExecutionResult;
+    public executeAfterHooks(path: string, result: any, args: any[], api: object, ctx: object, errorSink?: HookErrorSink): HookExecutionResult;
     /**
      * Execute before hooks asynchronously — the promoted-pipeline twin of
      * {@link executeBeforeHooks}.
@@ -221,6 +227,8 @@ export class HookManager extends ComponentBase {
      * @param {Array} args - Function arguments
      * @param {object} api - Bound API object
      * @param {object} ctx - User context object
+     * @param {HookErrorSink} [errorSink] - Around-pipeline error sink. When given, a failing hook is
+     *   reported to it and rethrown instead of running the error hooks and honouring suppressErrors.
      * @returns {Promise<object>} Result object: { args, shortCircuit, value }
      * @public
      *
@@ -230,7 +238,7 @@ export class HookManager extends ComponentBase {
      * already receives a Promise, so awaiting the chain changes nothing observable. A synchronous
      * handler's return is used as-is (no microtask tick is inserted for it).
      */
-    public executeBeforeHooksAsync(path: string, args: any[], api: object, ctx: object): Promise<object>;
+    public executeBeforeHooksAsync(path: string, args: any[], api: object, ctx: object, errorSink?: HookErrorSink): Promise<object>;
     /**
      * Execute after hooks asynchronously — the promoted-pipeline twin of
      * {@link executeAfterHooks}.
@@ -240,6 +248,8 @@ export class HookManager extends ComponentBase {
      * @param {Array} args - Original function arguments
      * @param {object} api - Bound API object
      * @param {object} ctx - User context object
+     * @param {HookErrorSink} [errorSink] - Around-pipeline error sink. When given, a failing hook is
+     *   reported to it and rethrown instead of running the error hooks and honouring suppressErrors.
      * @returns {Promise<HookExecutionResult>} Object indicating if result was modified and the final result
      * @public
      *
@@ -247,7 +257,42 @@ export class HookManager extends ComponentBase {
      * Same protocol and ordering as the sync variant; a thenable transform is awaited (that is the
      * cell this pipeline exists for) and a synchronous transform costs no microtask tick.
      */
-    public executeAfterHooksAsync(path: string, result: any, args: any[], api: object, ctx: object): Promise<HookExecutionResult>;
+    public executeAfterHooksAsync(path: string, result: any, args: any[], api: object, ctx: object, errorSink?: HookErrorSink): Promise<HookExecutionResult>;
+    /**
+     * Run a call through its around hooks, highest priority outermost.
+     *
+     * @param {Array<object>} hooks - Around hooks for the path, in execution order (from {@link getHooksForPath}).
+     * @param {string} path - API path being called
+     * @param {Array} args - Arguments the caller passed
+     * @param {object} api - Bound API object
+     * @param {object} ctx - User context object
+     * @param {AroundChainOptions} options - Pipeline wiring supplied by the wrapper.
+     * @returns {*} The outermost around hook's return value — the call's result. A Promise when
+     *   `options.isAsync` is set.
+     * @public
+     *
+     * @description
+     * Each hook receives `next(args?)`, which runs the rest of the pipeline — the remaining around
+     * hooks, then `options.core` (before hooks, the function, after hooks) — and returns its result or
+     * throws its error. `next()` with no argument forwards the args the hook itself received. A hook
+     * that never calls `next` short-circuits: whatever it returns is the result. `next` is single-use
+     * per hook invocation; a second call throws `HOOK_AROUND_NEXT_CALLED_TWICE`.
+     *
+     * `next()` starts the rest of the pipeline synchronously in both modes, so a hook that wraps it in
+     * an `AsyncLocalStorage.run()` (or any other synchronous scope) has that scope active while the
+     * target runs — including after an `await` inside the target, since async context follows the
+     * target's own continuation.
+     *
+     * In the synchronous pipeline a handler's thenable return is refused with
+     * `HOOK_AROUND_RETURNED_PROMISE` (the handler was not detected as asynchronous and did not declare
+     * `{ async: true }`), except when it is the very value its own `next()` returned: that is the
+     * target's own Promise (a plain function returning one) passed straight through, not something
+     * the hook produced. In the asynchronous pipeline thenables are awaited.
+     *
+     * Failures are reported to `options.errorSink` with an `around` source and rethrown; error hooks
+     * and suppression are the caller's concern, since they observe only what escapes the whole chain.
+     */
+    public executeAroundChain(hooks: Array<object>, path: string, args: any[], api: object, ctx: object, options: AroundChainOptions): any;
     /**
      * Execute always hooks for an API path.
      *
@@ -318,5 +363,49 @@ export type HookExecutionResult = {
      */
     result?: any;
 };
+/**
+ * Receives a failure raised inside an around pipeline together with where it came from, so the
+ * pipeline can report the right source once the error escapes the around chain.
+ */
+export type HookErrorSink = (error: any, source: object) => void;
+/**
+ * The innermost stage of an around pipeline: before hooks, the target function and after hooks.
+ */
+export type HookAroundCore = (args: any[]) => any;
+/**
+ * Runs a callback with the slothlet caller identity that was active when the call entered the
+ * pipeline, so a pinned around hook's `next()` does not leak the hook owner's identity into the
+ * target.
+ */
+export type HookFlowRunner = (fn: () => any) => any;
+/**
+ * Options for {@link HookManager#executeAroundChain}.
+ */
+export type AroundChainOptions = {
+    /**
+     * - Innermost stage invoked by the last around hook's `next()`.
+     */
+    core: HookAroundCore;
+    /**
+     * - Whether the call runs the asynchronous pipeline.
+     */
+    isAsync: boolean;
+    /**
+     * - Calling module's metadata, or null for an entry call.
+     */
+    caller: object | null;
+    /**
+     * - True when the call has no module caller.
+     */
+    entry: boolean;
+    /**
+     * - Records where each failure originated.
+     */
+    errorSink: HookErrorSink;
+    /**
+     * - Restores the call's own identity inside a pinned hook's `next()`.
+     */
+    runInCallerFlow: HookFlowRunner | null;
+};
 import { ComponentBase } from "#factories/component-base";
 //# sourceMappingURL=hook-manager.d.mts.map
\ No newline at end of file
diff --git a/types/src/lib/handlers/hook-manager.d.mts.map b/types/src/lib/handlers/hook-manager.d.mts.map
index 91f207ba0..979aee027 100644
--- a/types/src/lib/handlers/hook-manager.d.mts.map
+++ b/types/src/lib/handlers/hook-manager.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"hook-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/hook-manager.mjs"],"names":[],"mappings":"AAmEA;;;;;;GAMG;AACH;IACC;;;;OAIG;IACH,yBAHU,MAAM,CAGwB;IA0CxC;;;OAGG;IACH,sBAFW,MAAM,EAmChB;IAvBA,iBAAiC;IACjC,uBAAgD;IAChD,wBAAwD;IAMxD,qBAAiC;IAKjC,0BAAgC;IAChC,6BAAgC;IAMhC,qBAAsB;IACtB,0BAA0B;IAC1B,gCAAmC;IA6DpC;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,uBAxBW,MAAM,+BAId;QAAyB,EAAE;QACF,QAAQ;QACR,MAAM;QACL,UAAU;KAQpC,GAAU,MAAM,CA8NlB;IAgDD;;;;;;;;;OASG;IACH,uBANG;QAAwB,EAAE;QACF,IAAI;QACJ,OAAO;KAC/B,GAAU,MAAM,CA6DlB;IAED;;;;;;;;;OASG;IACH,uBAPW,MAAM,GAAC,MAAM,GAIX,MAAM,CAalB;IAED;;;;;;;;;OASG;IACH,wBAPW,MAAM,GAAC,MAAM,GAIX,MAAM,CAclB;IAED;;;;;;;;;;;;;;;OAeG;IACH,8BAPW,MAAM,GACJ,MAAM,CAkBlB;IAED;;;;;;;;;;;;OAYG;IACH,+BAPW,MAAM,GACJ,MAAM,CAkBlB;IAED;;;;;;;;;OASG;IACH,6BAHa,IAAI,CAYhB;IAED;;;;;;;;;OASG;IACH,6BAJW,OAAO,GACL,OAAO,CAMnB;IAED;;;;;;;;;;OAUG;IACH,qBARW,MAAM,GAAC,MAAM,GAKX,MAAM,CA8DlB;IAED;;;;;;;;OAQG;IACH,6BALW,MAAM,WACN,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAqBzB;IAyED;;;;;;;;;;;;;;OAcG;IACH,iCAZW,MAAM,GACJ;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAC,CAsBvD;IAED;;;;;;;;;OASG;IACH,gCAPW,MAAM,oBAEN,MAAM,OACN,MAAM,GACJ,MAAM,CA+ClB;IAED;;;;;;;;;;OAUG;IACH,+BARW,MAAM,UACN,GAAC,oBAED,MAAM,OACN,MAAM,GACJ,mBAAmB,CA+D/B;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,qCAbW,MAAM,oBAEN,MAAM,OACN,MAAM,GACJ,OAAO,CAAC,MAAM,CAAC,CA+C3B;IAED;;;;;;;;;;;;;;;OAeG;IACH,oCAZW,MAAM,UACN,GAAC,oBAED,MAAM,OACN,MAAM,GACJ,OAAO,CAAC,mBAAmB,CAAC,CA6CxC;IAED;;;;;;;;;;;OAWG;IACH,gCATW,MAAM,8BAEN,GAAC,YACD,OAAO,sBACP,KAAK,CAAC,KAAK,CAAC,mBACZ,MAAM,OACN,MAAM,QA+BhB;IAED;;;;;;;;;;OAUG;IACH,+BARW,MAAM,SACN,KAAK,UACL,MAAM,oBAEN,MAAM,OACN,MAAM,QA6BhB;IA4GD;;;;;;OAMG;IACH,4CAEC;IAwLD;;;;;;OAMG;IACH,sBAHa,KAAK,CAAC,MAAM,CAAC,CAwCzB;IAED;;;;;;;OAOG;IACH,kCAJW,KAAK,CAAC,MAAM,CAAC,GACX,IAAI,CAkBhB;IAED;;;OAGG;IACH,iCAUC;;CACD;;;;;;;;cAjjDa,OAAO;;;;aACP,GAAC;;8BAnBe,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"hook-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/hook-manager.mjs"],"names":[],"mappings":"AAuGA;;;;;;GAMG;AACH;IACC;;;;OAIG;IACH,yBAHU,MAAM,CAGwB;IA2CxC;;;OAGG;IACH,sBAFW,MAAM,EAmChB;IAvBA,iBAAiC;IACjC,uBAAgD;IAChD,wBAAwD;IAMxD,qBAAiC;IAKjC,0BAAgC;IAChC,6BAAgC;IAMhC,qBAAsB;IACtB,0BAA0B;IAC1B,gCAAmC;IA6DpC;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,uBAxBW,MAAM,+BAId;QAAyB,EAAE;QACF,QAAQ;QACR,MAAM;QACL,UAAU;KAQpC,GAAU,MAAM,CA8NlB;IAgDD;;;;;;;;;OASG;IACH,uBANG;QAAwB,EAAE;QACF,IAAI;QACJ,OAAO;KAC/B,GAAU,MAAM,CA6DlB;IAED;;;;;;;;;OASG;IACH,uBAPW,MAAM,GAAC,MAAM,GAIX,MAAM,CAalB;IAED;;;;;;;;;OASG;IACH,wBAPW,MAAM,GAAC,MAAM,GAIX,MAAM,CAclB;IAED;;;;;;;;;;;;;;;OAeG;IACH,8BAPW,MAAM,GACJ,MAAM,CAkBlB;IAED;;;;;;;;;;;;OAYG;IACH,+BAPW,MAAM,GACJ,MAAM,CAkBlB;IAED;;;;;;;;;OASG;IACH,6BAHa,IAAI,CAYhB;IAED;;;;;;;;;OASG;IACH,6BAJW,OAAO,GACL,OAAO,CAMnB;IAED;;;;;;;;;;OAUG;IACH,qBARW,MAAM,GAAC,MAAM,GAKX,MAAM,CA8DlB;IAED;;;;;;;;OAQG;IACH,6BALW,MAAM,WACN,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAqBzB;IAyED;;;;;;;;;;;;;;OAcG;IACH,iCAZW,MAAM,GACJ;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAC,CA8BjG;IAED;;;;;;;;;;;OAWG;IACH,gCATW,MAAM,oBAEN,MAAM,OACN,MAAM,cACN,aAAa,GAEX,MAAM,CAuDlB;IAED;;;;;;;;;;;;OAYG;IACH,+BAVW,MAAM,UACN,GAAC,oBAED,MAAM,OACN,MAAM,cACN,aAAa,GAEX,mBAAmB,CAuE/B;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,qCAfW,MAAM,oBAEN,MAAM,OACN,MAAM,cACN,aAAa,GAEX,OAAO,CAAC,MAAM,CAAC,CAuD3B;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,oCAdW,MAAM,UACN,GAAC,oBAED,MAAM,OACN,MAAM,cACN,aAAa,GAEX,OAAO,CAAC,mBAAmB,CAAC,CAqDxC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,iCA/BW,KAAK,CAAC,MAAM,CAAC,QACb,MAAM,oBAEN,MAAM,OACN,MAAM,WACN,kBAAkB,GAChB,GAAC,CAgGb;IAED;;;;;;;;;;;OAWG;IACH,gCATW,MAAM,8BAEN,GAAC,YACD,OAAO,sBACP,KAAK,CAAC,KAAK,CAAC,mBACZ,MAAM,OACN,MAAM,QA+BhB;IAED;;;;;;;;;;OAUG;IACH,+BARW,MAAM,SACN,KAAK,UACL,MAAM,oBAEN,MAAM,OACN,MAAM,QA6BhB;IA4GD;;;;;;OAMG;IACH,4CAEC;IAwLD;;;;;;OAMG;IACH,sBAHa,KAAK,CAAC,MAAM,CAAC,CAwCzB;IAED;;;;;;;OAOG;IACH,kCAJW,KAAK,CAAC,MAAM,CAAC,GACX,IAAI,CAkBhB;IAED;;;OAGG;IACH,iCAWC;;CACD;;;;;;;;cAlvDa,OAAO;;;;aACP,GAAC;;;;;;oCAOJ,GAAC,UACD,MAAM,KACJ,IAAI;;;;8CAOJ,GAAC;;;;;;kCAQH,MAAY,GAAC,KACX,GAAC;;;;;;;;UAMA,cAAc;;;;aACd,OAAO;;;;YACP,MAAM,GAAC,IAAI;;;;WACX,OAAO;;;;eACP,aAAa;;;;qBACb,cAAc,GAAC,IAAI;;8BAvDH,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/lib/handlers/permission-manager.d.mts b/types/src/lib/handlers/permission-manager.d.mts
index 091ed2a6f..daeb14a15 100644
--- a/types/src/lib/handlers/permission-manager.d.mts
+++ b/types/src/lib/handlers/permission-manager.d.mts
@@ -319,7 +319,7 @@ export class PermissionManager extends ComponentBase {
      * @param {string|null} callerPath - Hook owner's API path (the registering module); null for a
      *   host-registered hook (no owner identity), which is always allowed.
      * @param {string} hookPath - Concrete API path (fire-time) or registration pattern (registration).
-     * @param {string} hookType - Hook type: "before", "after", "always", or "error".
+     * @param {string} hookType - Hook type: "before", "after", "always", "error", or "around".
      * @param {string|null} [callerFilePath=null] - Owner's source file path (for self-hook bypass).
      * @param {string|null} [targetFilePath=null] - Hooked path's source file path (for self-hook bypass).
      * @param {object|null} [runtimeContext=null] - Per-request ALS context for condition evaluation.
@@ -336,7 +336,7 @@ export class PermissionManager extends ComponentBase {
      *
      * @param {string|null} callerPath - Hook owner's API path; null for a host-registered hook (always allowed).
      * @param {string} hookPath - Concrete API path being hooked.
-     * @param {string} hookType - Hook type: "before", "after", "always", or "error".
+     * @param {string} hookType - Hook type: "before", "after", "always", "error", or "around".
      * @param {string|null} [callerFilePath=null] - Owner's source file path (for self-hook bypass).
      * @param {string|null} [targetFilePath=null] - Hooked path's source file path (for self-hook bypass).
      *   Typically null at fire time, where the target's source file isn't resolved — the filepath
diff --git a/types/src/lib/handlers/unified-wrapper.d.mts.map b/types/src/lib/handlers/unified-wrapper.d.mts.map
index da20f9e33..0ba1fcee0 100644
--- a/types/src/lib/handlers/unified-wrapper.d.mts.map
+++ b/types/src/lib/handlers/unified-wrapper.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"unified-wrapper.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/unified-wrapper.mjs"],"names":[],"mappings":"AAuxBA;;;;;;;;;;;;;;;;;;GAkBG;AACH,4CAhBW,MAAM,GAAC,MAAM,GACX,OAAO,CAkBnB;AA02ID;;;;;;;;;;;GAWG;AACH,sCAPW,OAAO,GACL,cAAc,GAAC,IAAI,CAkB/B;AAn6ID;;;;;;;;GAQG;AACH,iCAHU,GAAG,CAAC,MAAM,CAAC,CAG2F;;;;;AAuEhH;;;;;;;;;;GAUG;AACH;IAuUC;;;;;;;;;;;;;;;;OAgBG;IACH,0BAsCC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,gCAiEC;IAzbD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,sBApCW,MAAM,mKAEd;QAAwB,IAAI,EAApB,MAAM;QACU,OAAO,EAAvB,MAAM;QACyB,WAAW;QACvB,eAAe;QAChB,UAAU;QACV,mBAAmB;QACpB,QAAQ;QACD,UAAU;QAGjB,QAAQ;QACR,YAAY;QACE,cAAc;QAI3B,eAAe;KAMzC,EA+NF;IAzQD;;;;;;;;;;;OAWG;IACH,4BAFa,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAC,SAAS,CAKzC;IA4PD;;;;;;;;;;OAUG;IACH,uEAHa,GAAC,CA+Bb;IAED;;;;OAIG;IACH,qBAHa,WAAS,MAAM,GAAC,IAAI,CAKhC;IAiJD;;;;;;;;;;;OAWG;IACH,sBA0CC;IAED;;;;;;;;;;;;OAYG;IACH,mBAkDC;IAED;;;;;;;;;OASG;IACH,qBAsDC;IAED;;;;OAIG;IACH,uBA4GC;IAED;;;;;;;;;OASG;IACH,qBAEC;IAED;;;;;;;;;OASG;IACH,sBAiBC;IAED;;;;;;;;;;OAUG;IACH,6BAohBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BA8PC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BA43BC;IAED;;;;;;OAMG;IACH,uCAuyDC;;CACD;8BA5mK6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"unified-wrapper.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/unified-wrapper.mjs"],"names":[],"mappings":"AA07BA;;;;;;;;;;;;;;;;;;GAkBG;AACH,4CAhBW,MAAM,GAAC,MAAM,GACX,OAAO,CAkBnB;AAs3ID;;;;;;;;;;;GAWG;AACH,sCAPW,OAAO,GACL,cAAc,GAAC,IAAI,CAkB/B;AA/6ID;;;;;;;;GAQG;AACH,iCAHU,GAAG,CAAC,MAAM,CAAC,CAG2F;;;;;AAuEhH;;;;;;;;;;GAUG;AACH;IAuUC;;;;;;;;;;;;;;;;OAgBG;IACH,0BAsCC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,gCAiEC;IAzbD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,sBApCW,MAAM,mKAEd;QAAwB,IAAI,EAApB,MAAM;QACU,OAAO,EAAvB,MAAM;QACyB,WAAW;QACvB,eAAe;QAChB,UAAU;QACV,mBAAmB;QACpB,QAAQ;QACD,UAAU;QAGjB,QAAQ;QACR,YAAY;QACE,cAAc;QAI3B,eAAe;KAMzC,EA+NF;IAzQD;;;;;;;;;;;OAWG;IACH,4BAFa,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAC,SAAS,CAKzC;IA4PD;;;;;;;;;;OAUG;IACH,uEAHa,GAAC,CA+Bb;IAED;;;;OAIG;IACH,qBAHa,WAAS,MAAM,GAAC,IAAI,CAKhC;IAiJD;;;;;;;;;;;OAWG;IACH,sBA0CC;IAED;;;;;;;;;;;;OAYG;IACH,mBAkDC;IAED;;;;;;;;;OASG;IACH,qBAsDC;IAED;;;;OAIG;IACH,uBA4GC;IAED;;;;;;;;;OASG;IACH,qBAEC;IAED;;;;;;;;;OASG;IACH,sBAiBC;IAED;;;;;;;;;;OAUG;IACH,6BAohBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BA8PC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BA43BC;IAED;;;;;;OAMG;IACH,uCAmzDC;;CACD;8BA3xK6B,2BAA2B"}
\ No newline at end of file

From 8411e7c32d009120b020b83b80891aa996d0ee31 Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Mon, 28 Sep 2026 21:13:49 -0700
Subject: [PATCH 23/49] deps: update @cldmv/vitest-runner to 1.5.1 and exclude
 tmp/ from test discovery

Bumps @cldmv/vitest-runner ^1.2.0 -> ^1.5.1 to pick up the v1.5.0 `exclude`
discovery option (v1.5.1 only backfills its changelog). Wires
exclude: ["tmp/**", "trash/**"] through the run-all-vitest.mjs wrapper
(default set, plus a repeatable --exclude CLI flag mirroring
--solo-pattern) so test discovery never enters the repo's scratch
directories, which hold per-agent git worktrees each carrying their own
copy of tests/vitests/suites.

Fixes #520
---
 package-lock.json                |  8 ++++----
 package.json                     |  2 +-
 tests/vitests/run-all-vitest.mjs | 27 +++++++++++++++++++++++++++
 3 files changed, 32 insertions(+), 5 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index e1dc8d79a..41088894f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -13,7 +13,7 @@
 			},
 			"devDependencies": {
 				"@cldmv/fix-headers": "^1.3.10",
-				"@cldmv/vitest-runner": "^1.2.0",
+				"@cldmv/vitest-runner": "^1.5.1",
 				"@eslint/css": "^2.0.0",
 				"@eslint/js": "^10.0.1",
 				"@eslint/json": "^2.0.1",
@@ -185,9 +185,9 @@
 			}
 		},
 		"node_modules/@cldmv/vitest-runner": {
-			"version": "1.2.0",
-			"resolved": "https://registry.npmjs.org/@cldmv/vitest-runner/-/vitest-runner-1.2.0.tgz",
-			"integrity": "sha512-RhmXwFNB68OsgnIFSoQeTWgqEAZt/A+MYfc9lf2JdCUIRhzq2Z3gVeuw1pYOV0LihqfPWRNSmaVVDEEQKa93Tw==",
+			"version": "1.5.1",
+			"resolved": "https://registry.npmjs.org/@cldmv/vitest-runner/-/vitest-runner-1.5.1.tgz",
+			"integrity": "sha512-Q64qMfJe9TbJOOKE382eqyJiEVbyc8ycfkPFheE4nMOUyV/z7+VRkE3K4viSlCAhUjmlFyU+oxD6DDkax84KDA==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
diff --git a/package.json b/package.json
index 688ca6631..93ff13bde 100644
--- a/package.json
+++ b/package.json
@@ -314,7 +314,7 @@
 	},
 	"devDependencies": {
 		"@cldmv/fix-headers": "^1.3.10",
-		"@cldmv/vitest-runner": "^1.2.0",
+		"@cldmv/vitest-runner": "^1.5.1",
 		"@eslint/css": "^2.0.0",
 		"@eslint/js": "^10.0.1",
 		"@eslint/json": "^2.0.1",
diff --git a/tests/vitests/run-all-vitest.mjs b/tests/vitests/run-all-vitest.mjs
index 936fa4a94..d23e6e026 100644
--- a/tests/vitests/run-all-vitest.mjs
+++ b/tests/vitests/run-all-vitest.mjs
@@ -153,6 +153,13 @@ const PER_FILE_HEAP_OVERRIDES = [
 	{ pattern: "metadata/metadata-edge-cases", heapMb: 6144 }
 ];
 
+// Scratch dirs (gitignored, same pair the repo's own eslint/prettier ignores use) that test
+// discovery must never enter. `tmp/` holds per-agent git worktrees (tmp/agents/*/wt) and staged
+// fixtures — each carries its own full copy of tests/vitests/suites, which partial-path pattern
+// resolution could otherwise match and run against the wrong (worktree's) tree. `trash/` is the
+// same class of scratch bucket. See @cldmv/vitest-runner's `exclude` option.
+const DEFAULT_EXCLUDE_PATTERNS = ["tmp/**", "trash/**"];
+
 /**
  * Print CLI help for the compatibility wrapper.
  * @returns {void} Prints help text to stdout.
@@ -176,6 +183,8 @@ LEGACY FLAGS:
 RUNNER FLAGS (forwarded to @cldmv/vitest-runner API):
   --workers <n>           Number of workers (overrides VITEST_WORKERS)
   --solo-pattern <pat>    Add extra solo pattern (repeatable)
+  --exclude <glob>        Add extra discovery-exclude glob, relative to cwd (repeatable;
+                          default: tmp/**, trash/**)
   --test-list <file>      JSON list of test files
   --file-pattern <regex>  Custom discovery regex
   --log-file <path>       Mirror output log path (quiet coverage mode)
@@ -204,6 +213,7 @@ EXAMPLES:
  * 	testFilePattern?: RegExp,
  * 	logFile?: string,
  * 	earlyRunPatterns: string[],
+ * 	excludePatterns: string[],
  * 	vitestArgs: string[],
  * 	testPatterns: string[]
  * }} Parsed argument groups.
@@ -220,6 +230,7 @@ function parseArguments(args) {
 	let testFilePattern;
 	let logFile;
 	const earlyRunPatterns = [...SOLO_RUN_PATTERNS];
+	const excludePatterns = [...DEFAULT_EXCLUDE_PATTERNS];
 	const vitestArgs = [];
 	const testPatterns = [];
 
@@ -274,6 +285,20 @@ function parseArguments(args) {
 			continue;
 		}
 
+		if (arg === "--exclude") {
+			const next = args[i + 1];
+			if (next && !next.startsWith("-")) {
+				excludePatterns.push(next);
+				i++;
+			}
+			continue;
+		}
+
+		if (arg.startsWith("--exclude=")) {
+			excludePatterns.push(arg.split("=").slice(1).join("="));
+			continue;
+		}
+
 		if (arg === "--test-list") {
 			const next = args[i + 1];
 			if (next && !next.startsWith("-")) {
@@ -342,6 +367,7 @@ function parseArguments(args) {
 		testFilePattern,
 		logFile,
 		earlyRunPatterns,
+		excludePatterns,
 		vitestArgs,
 		testPatterns
 	};
@@ -392,6 +418,7 @@ function buildRunOptions(parsed) {
 		testPatterns: normalizedPatterns,
 		vitestArgs: [...parsed.vitestArgs],
 		earlyRunPatterns: parsed.earlyRunPatterns,
+		exclude: parsed.excludePatterns,
 		perFileHeapOverrides: PER_FILE_HEAP_OVERRIDES,
 		conditions: ["slothlet-dev"],
 		nodeEnv: process.env.NODE_ENV || "development"

From 43a02cf2130223d02f761d0b89cda1a1830d7fa3 Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Mon, 28 Sep 2026 21:50:48 -0700
Subject: [PATCH 24/49] fix(typescript): turn source maps on during coverage
 runs and document TypeScript coverage

A TypeScript leaf executes from its .slothlet-cache copy, so coverage can only reach the .ts
source through the copy's inline source map. typescript.sourcemap is now tri-state: an explicit
boolean wins, and when it is not set, source maps are on exactly during a coverage run - a vitest
coverage run (the same defensive __vitest_worker__ read the #235 hint uses) or any process with
NODE_V8_COVERAGE set (c8 / native coverage). The cache file name already hashes the transpiled
output, map included, so mapped and unmapped output never share a cache file.

A coverage run that loads TypeScript leaves with sourcemap explicitly false emits a one-shot
WARNING_COVERAGE_TS_SOURCEMAP_OFF per instance (silenced by silent), in all 12 languages.

docs/TESTING.md gains a TypeScript section: source maps (auto under coverage), adding
**/.slothlet-cache/** to coverage.include (@vitest/coverage-v8 and c8 both filter by the executed
cache file before remapping, so src/** alone reports 0% for .ts leaves), a complete vitest config
for a mixed .mjs/.cjs/.ts tree, and the plain-Node c8 route. It also corrects the inlining advice:
externalized loads are collected but mis-mapped (numbers without a fix are unreliable in both
directions), inlining is noticeably slower and can surface timing races, vitest 3 / vite-node needs
server.fs.allow for leaves outside the workspace, and with server.deps.inline a .cjs leaf that
imports @cldmv/slothlet/runtime gets a second runtime copy (RUNTIME_NO_ACTIVE_CONTEXT_SELF), so the
import hook is the recommended setup. docs/TYPESCRIPT.md describes the new sourcemap default.

Fixes #484
Fixes #486
---
 docs/TESTING.md                               |  77 +++++-
 docs/TYPESCRIPT.md                            |   8 +-
 src/lib/helpers/config.mjs                    |   3 +-
 src/lib/i18n/languages/de-de.json             |   2 +
 src/lib/i18n/languages/en-gb.json             |   2 +
 src/lib/i18n/languages/en-us.json             |   2 +
 src/lib/i18n/languages/es-es.json             |   2 +
 src/lib/i18n/languages/es-mx.json             |   2 +
 src/lib/i18n/languages/fr-fr.json             |   2 +
 src/lib/i18n/languages/hi-in.json             |   2 +
 src/lib/i18n/languages/ja-jp.json             |   2 +
 src/lib/i18n/languages/ko-kr.json             |   2 +
 src/lib/i18n/languages/pt-br.json             |   2 +
 src/lib/i18n/languages/ru-ru.json             |   2 +
 src/lib/i18n/languages/zh-cn.json             |   2 +
 src/lib/processors/loader.mjs                 |  78 +++++-
 ...escript-coverage-sourcemap.test.vitest.mjs | 246 ++++++++++++++++++
 tools/ci/i18n-script-purity-accepted.json     |  20 +-
 types/src/lib/helpers/config.d.mts.map        |   2 +-
 types/src/lib/processors/loader.d.mts         |  48 ++++
 types/src/lib/processors/loader.d.mts.map     |   2 +-
 21 files changed, 489 insertions(+), 19 deletions(-)
 create mode 100644 tests/vitests/suites/typescript/typescript-coverage-sourcemap.test.vitest.mjs

diff --git a/docs/TESTING.md b/docs/TESTING.md
index 045ba8e90..099573735 100644
--- a/docs/TESTING.md
+++ b/docs/TESTING.md
@@ -6,7 +6,7 @@ This guide covers a coverage-measurement gotcha that surfaces when a **consumer*
 
 When a consumer measures coverage with `vitest` + `@vitest/coverage-v8`, any leaf reached **only through slothlet composition** reports near-zero coverage of its function body — even though the leaf executes and its output is asserted. The module-level lines (the `spec` / `default` export) attribute, but everything inside the exported functions reads as uncovered.
 
-The functions genuinely run; the coverage collector simply never sees them. It looks like slothlet is "blocking" coverage, but it is purely a **measurement artifact** — worth knowing about so it doesn't cost a debugging session.
+The functions genuinely run; the coverage collector just can't attribute them correctly. It looks like slothlet is "blocking" coverage, but it is a **measurement artifact** — worth knowing about so it doesn't cost a debugging session.
 
 ## Why it happens
 
@@ -18,11 +18,13 @@ const moduleUrl = `${fileUrl}?slothlet_instance=${instanceID}`; // cache-bust pe
 const module = await import(moduleUrl);
 ```
 
-In a consumer project, `@cldmv/slothlet` is an **externalized** `node_modules` dependency — and vitest externalizes `node_modules` by default. So slothlet runs as native Node code and that `import()` is a **native** import that never enters vitest's module runner / module graph. `@vitest/coverage-v8` attributes execution only for modules in that graph, so the leaf's execution instance (`…/leaf.mjs?slothlet_instance=…`) is invisible to it. The only coverage a leaf gets is the module-level baseline from vitest's all-files scan over `coverage.include` (`src/**`) — the pass that reports every included file once, even ones no test imported. Hence the floor, with the whole function body reading as uncovered.
+In a consumer project, `@cldmv/slothlet` is an **externalized** `node_modules` dependency — and vitest externalizes `node_modules` by default. So slothlet runs as native Node code and that `import()` is a **native** import that never enters vitest's module runner / module graph.
+
+That native load is not invisible to `@vitest/coverage-v8` — it is collected and **mis-mapped**. V8 records the leaf's execution against the raw file (`…/leaf.mjs?slothlet_instance=…`), and the provider maps those raw-file offsets onto vite's _transformed_ code for the same path. The offsets don't line up, so functions that never ran can be marked executed and functions that did run can read as uncovered. Measured on one consumer (vitest 4.1.7), a function V8 reported at its raw offset with a count of 0 was nevertheless marked executed, along with several of its neighbours. Numbers taken without one of the fixes below are therefore **unreliable in both directions**, and the change in totals after applying a fix is not a measure of how much coverage improved: on that consumer, line coverage _dropped_ from 58.1% to 56.9% once leaves attributed correctly, because inflated false coverage was removed along with the false misses.
 
 This is **not** a source-vs-`dist` issue. The `slothlet-dev` condition only changes which files resolve; it does not change externalization. The axis is **externalized vs inlined**. (slothlet's own repo does not hit this: there the loader is _project code_, transformed by vitest by default, so its `import()` rides the runner and the query-URL loads attribute via cross-file aggregation.)
 
-## The fix: inline slothlet in your test config
+## Fix 1: inline slothlet in your test config
 
 Add `@cldmv/slothlet` to vitest's `server.deps.inline` so vitest runs it through its own module runner; the leaf imports then route through vitest and attribute correctly:
 
@@ -38,7 +40,7 @@ export default defineConfig({
 });
 ```
 
-No test changes are needed — this is purely a measurement fix, and all tests stay green. Measured on a real consumer project (same published `dist`, identical suite, only the config line added):
+No test changes are needed to get correct attribution. Measured on a real consumer project (same published `dist`, identical suite, only the config line added):
 
 | Metric     | externalized (default) | `server.deps.inline` |
 | ---------- | ---------------------- | -------------------- |
@@ -46,9 +48,17 @@ No test changes are needed — this is purely a measurement fix, and all tests s
 | Statements | 75%                    | 91%                  |
 | Functions  | 80%                    | 95%                  |
 
-**Tradeoff:** the shipped `dist` is re-processed by Vite during tests rather than loaded byte-for-byte by Node — a small fidelity cost in exchange for accurate coverage attribution.
+(As explained above, the "externalized" column is not a trustworthy baseline; the right-hand column is the real figure.)
+
+Inlining has costs beyond fidelity:
 
-## The fidelity-preserving alternative: `slothlet({ import })`
+- **Fidelity.** The shipped `dist` is re-processed by Vite during tests rather than loaded byte-for-byte by Node.
+- **Speed.** Composition becomes noticeably slower. Measured on one consumer (vitest 4.1.7), the first composing test went from 1.1–1.8 s to 6.0–9.5 s and vitest's transform time from ~0.2 s to 22–28 s. Suites that compose an api per test may need a larger `hookTimeout` / `testTimeout`; one of two full inline runs there hit `Hook timed out in 10000ms` in a `beforeEach` composition.
+- **Timing.** The slower boot can expose latent races in the tests themselves — for example, a worker's first message arriving before the test attached its handler.
+- **Files outside the workspace (vitest 3 / vite-node).** With slothlet inlined, every leaf load goes through vite, and vite only loads files inside `server.fs.allow`. Leaves written to `os.tmpdir()` (or anywhere else outside the project) then fail with `MODULE_IMPORT_FAILED … Cannot find module '/tmp/…/leaf.mjs?slothlet_instance=…'`. Extend the allow-list — `server: { fs: { allow: [projectRoot, os.tmpdir()] } }` at the top level of the config. The same limit applies to the `import` hook below, and to a test file's own `import()` of such a path. This was observed on vitest 3.2.4; the same probe loaded fine on vitest 5.
+- **A second runtime copy for `.cjs` leaves.** A `.cjs` leaf is loaded natively by `require`, outside vite, so its `await import("@cldmv/slothlet/runtime")` resolves Node's copy of the runtime while the inlined slothlet uses vite's copy. The leaf then sees no active context: `self` access throws `RUNTIME_NO_ACTIVE_CONTEXT_SELF`. Measured on vitest 5.0.2. Use the `import` hook instead when any `.cjs` leaf uses the runtime.
+
+## Fix 2 (recommended): `slothlet({ import })`
 
 Instead of inlining the whole package, hand the loader an importer bound to **your** module graph. The loader then routes every leaf load through it — with the exact cache-busted URL it would have imported natively (`?slothlet_instance=…`, `&module=…` for mounts, `&_reload=…` during reload), and the module namespace you resolve is used unchanged:
 
@@ -62,12 +72,65 @@ const api = await slothlet({
 
 Because the `import()` executes in the consumer's (vitest-transformed) code, the leaf load enters the runner's module graph and attributes — while slothlet itself stays externalized and byte-for-byte native. Unset, the loader uses its own native import and nothing changes; per-instance isolation and hot reload behave identically either way, since everything that matters rides the URL.
 
+This keeps a single copy of slothlet and its runtime, so `.cjs` leaves that use `@cldmv/slothlet/runtime` keep working, and `.cjs` leaves themselves attribute correctly without any setting (they load through a native `require` of the plain path). Prefer it over inlining. Don't combine the two: with `server.deps.inline` also set, the `.cjs` runtime problem above comes back.
+
 A non-function value throws `INVALID_CONFIG_IMPORT` at construction.
 
 Slothlet also detects the misattribution scenario itself: booting under a vitest **coverage** run (a plain test run stays quiet) while this slothlet copy is externalized and no `import` importer is configured emits a one-shot `WARNING_COVERAGE_IMPORTER_UNSET` pointing here. The detection reads vitest's worker state defensively — if vitest ever changes its internals the hint simply stops appearing; behavior never changes. `silent: true` suppresses it like any other warning.
 
 **Trust model:** the importer controls what code loads for every leaf, so it carries the same authority as choosing `base` or `node_modules` — which is why it is host-only, boot-time configuration, like `versionDispatcher` and `resolveModuleSpecifier`. Never construct it from untrusted input; an importer built from external configuration is a code-injection point. (It grants modules nothing: in-process code can already `import()` natively — see the enforcement boundary in [PERMISSIONS.md](PERMISSIONS.md).)
 
+## TypeScript leaves
+
+A `.ts` / `.mts` leaf never executes from its own file. Slothlet transpiles it and imports the output from a cache file, `<package root>/.slothlet-cache/<pid>-<instanceID>/<hash>.mjs`, where the package root is the nearest directory above the leaf with a `package.json`. (A leaf with no `package.json` above it is cached in a private directory under `os.tmpdir()` instead, which no coverage `include` can reach — keep TypeScript leaves inside a package.) Coverage of a TypeScript leaf reaches the `.ts` source only through the **inline source map** in that cache file. Two things are needed:
+
+1. **Source maps on.** `typescript.sourcemap` turns on automatically during a coverage run — a vitest run with coverage enabled, or a process started with `NODE_V8_COVERAGE` set (c8, or Node's native coverage) — so leave it unset. An explicit `sourcemap: false` wins; with it, a coverage run that loads TypeScript leaves emits a one-shot `WARNING_COVERAGE_TS_SOURCEMAP_OFF`, because that coverage can only land on the cache copies. Relative `.ts` imports between your modules are cached and mapped the same way.
+2. **The cache directory in `coverage.include`.** `@vitest/coverage-v8` filters coverage by the file that _executed_ — the cache `.mjs` — before it remaps through the source map. With `include: ["src/**"]` alone, the cache files are dropped before remapping and every TypeScript leaf reports 0%. Add `**/.slothlet-cache/**`; after remapping, the results land on your `.ts` files and the cache files themselves do not appear in the report.
+
+A complete config for a mixed `.mjs` / `.cjs` / `.ts` api under `api/`:
+
+```js
+// vitest.config.mjs
+import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+	test: {
+		coverage: {
+			provider: "v8",
+			include: ["api/**", "**/.slothlet-cache/**"]
+		}
+	}
+});
+```
+
+```js
+// api.test.mjs
+import { test, expect } from "vitest";
+import slothlet from "@cldmv/slothlet";
+
+test("composes", async () => {
+	const api = await slothlet({
+		base: new URL("./api", import.meta.url).pathname,
+		typescript: "fast", // sourcemap left unset: on during coverage
+		import: (url) => import(url)
+	});
+	expect(api.typed.pick(true)).toBe("r");
+	await api.slothlet.shutdown();
+});
+```
+
+With this setup (vitest 5.0.2, `@vitest/coverage-v8` 5.0.2), the `.ts` leaf reported its exact uncovered lines — including an enum and an untaken branch — alongside the `.mjs` and `.cjs` leaves. Dropping `**/.slothlet-cache/**` from `include`, or setting `sourcemap: false`, left the `.ts` leaf at 0%. Per-instance isolation is unaffected.
+
+### Plain Node with c8
+
+Outside vitest, c8 (or any tool built on `NODE_V8_COVERAGE`) remaps TypeScript leaves the same way. c8 sets `NODE_V8_COVERAGE`, so source maps turn on automatically, and Node records each loaded module's source map into the coverage output, which c8 uses to remap the cache files onto the `.ts` sources:
+
+```bash
+npx c8 --include "api/**" --include "**/.slothlet-cache/**" node app-test.mjs
+```
+
+`--enable-source-maps` is not needed for coverage; it only changes stack traces.
+
 ## Scope
 
-The artifact appears with any setup that externalizes `node_modules` and attributes coverage from the runner's module graph (vitest + the v8 provider). It is independent of eager vs lazy mode and of the `slothlet-dev` condition — the deciding axis is externalized vs inlined, nothing else.
+The `.mjs` artifact appears with any setup that externalizes `node_modules` and attributes coverage from the runner's module graph (vitest + the v8 provider). It is independent of eager vs lazy mode and of the `slothlet-dev` condition — the deciding axis is externalized vs inlined, nothing else. The TypeScript requirements (source maps and the cache directory in `include`) apply in every setup, including inlined slothlet and slothlet's own repo.
diff --git a/docs/TYPESCRIPT.md b/docs/TYPESCRIPT.md
index 1c7f0e999..2685d20c9 100644
--- a/docs/TYPESCRIPT.md
+++ b/docs/TYPESCRIPT.md
@@ -146,7 +146,7 @@ typescript: "strict"; // Strict mode (tsc)
 typescript: {
     mode: "fast" | "strict",   // Required. Defaults to "fast" if omitted
     target: "es2020",          // ECMAScript target. Default: "es2020"
-    sourcemap: false,          // Inline source maps. Default: false
+    sourcemap: true,           // Inline source maps. Default: on during a coverage run, otherwise off
     module: "esnext",          // Strict mode only. Module kind for the type check. Default: "esnext"
     strict: true,              // Strict mode only. tsc's strict checking. Default: true
     compilerOptions: {},       // Strict mode only. Extra tsc compiler options (tsconfig.json form)
@@ -163,7 +163,11 @@ Accepts any valid ECMAScript target string: `"es2015"`, `"es2017"`, `"es2018"`,
 
 #### `sourcemap`
 
-When `true`, each transpiled module carries an inline source map whose `sources` entry is the absolute path of the `.ts` file. Transpiled modules are loaded from a cache directory (`.slothlet-cache/`), so without a map, stack frames point at the cached copy; with a map and Node's `--enable-source-maps` flag (or any tool that reads inline maps, such as a debugger), they point at the original `.ts` source. Applies to both fast and strict mode. Default: `false`.
+When `true`, each transpiled module carries an inline source map whose `sources` entry is the absolute path of the `.ts` file. Transpiled modules are loaded from a cache directory (`.slothlet-cache/`), so without a map, stack frames point at the cached copy; with a map and Node's `--enable-source-maps` flag (or any tool that reads inline maps, such as a debugger), they point at the original `.ts` source. Applies to both fast and strict mode.
+
+Default: not set, which means **on during a coverage run and off otherwise**. A coverage run is a vitest run with coverage enabled, or any process started with `NODE_V8_COVERAGE` set (c8, or Node's native coverage). The map is what lets coverage reach the `.ts` source at all: the code that executes is the cached copy, and coverage tools remap it through the inline map. An explicit `true` or `false` always wins. A coverage run that loads TypeScript leaves with `sourcemap: false` emits a one-shot `WARNING_COVERAGE_TS_SOURCEMAP_OFF`, because that coverage can only ever land on the cached copies. The coverage tool also has to include the cache directory — see [Testing a slothlet-composed API](TESTING.md#typescript-leaves).
+
+The cache file name hashes the transpiled output, map included, so mapped and unmapped output never share a cache file.
 
 ```bash
 node --enable-source-maps app.mjs
diff --git a/src/lib/helpers/config.mjs b/src/lib/helpers/config.mjs
index b1805d687..a1a56f502 100644
--- a/src/lib/helpers/config.mjs
+++ b/src/lib/helpers/config.mjs
@@ -751,7 +751,8 @@ export class Config extends ComponentBase {
 				mode,
 				types: typescript.types || null,
 				target: typescript.target || "es2020",
-				sourcemap: typescript.sourcemap || false,
+				// null = not set: the loader turns source maps on during a coverage run (#484).
+				sourcemap: typescript.sourcemap ?? null,
 				module: typescript.module ?? null,
 				strict: typescript.strict ?? null,
 				compilerOptions: typescript.compilerOptions ?? null
diff --git a/src/lib/i18n/languages/de-de.json b/src/lib/i18n/languages/de-de.json
index 6390e8292..e9fc54f75 100644
--- a/src/lib/i18n/languages/de-de.json
+++ b/src/lib/i18n/languages/de-de.json
@@ -508,6 +508,8 @@
 		"PRINCIPAL_READ_ONLY": "Principal '{name}' ist schreibgeschützt; sein Wert wird nur durch erneutes Auflösen ersetzt.",
 		"WARNING_COVERAGE_IMPORTER_UNSET": "Ein Coverage-Lauf ist aktiv, aber kein injizierbarer Leaf-Importer ist konfiguriert — die Leaf-Ladungen dieses externalisierten slothlet werden Ihrem Coverage-Bericht nicht zugeordnet.",
 		"HINT_WARNING_COVERAGE_IMPORTER_UNSET": "Übergeben Sie die Option 'import' aus Ihrem Test-Setup — eine Funktion wie (url) => import(url) — damit Leaf-Ladungen über den Modulgraphen Ihres Runners laufen. Siehe docs/TESTING.md.",
+		"WARNING_COVERAGE_TS_SOURCEMAP_OFF": "Ein Coverage-Lauf ist aktiv und TypeScript-Leaves werden mit typescript.sourcemap auf false geladen — ihre Coverage wird den transpilierten .slothlet-cache-Kopien zugeordnet und kann die .ts-Quellen nicht erreichen.",
+		"HINT_WARNING_COVERAGE_TS_SOURCEMAP_OFF": "Entfernen Sie typescript.sourcemap: false (während eines Coverage-Laufs wird es automatisch aktiviert) oder setzen Sie es auf true, und nehmen Sie das Cache-Verzeichnis (.slothlet-cache/**) in Ihr Coverage-include auf. Siehe docs/TESTING.md.",
 		"HOOK_VERSION_UNRESOLVED": "Das Hook-Muster '{pattern}' konnte keiner registrierten Version zugeordnet werden.",
 		"HINT_HOOK_VERSION_UNRESOLVED": "Der Versions-Dispatch benötigt einen versionierten Mount, der den Pfad des Musters abdeckt (api.add(path, source, options, { version })). Ein Dispatcher muss ein registriertes Tag, ein Array davon oder nichts (für die Standardversion) zurückgeben — oder entfernen Sie die Option versioned/versionDispatcher, um das Muster wörtlich zu registrieren.",
 		"HOOK_VERSION_UNKNOWN_TAG": "Der Versions-Dispatch für das Hook-Muster '{pattern}' hat '{version}' gewählt, das keine registrierte Version ist.",
diff --git a/src/lib/i18n/languages/en-gb.json b/src/lib/i18n/languages/en-gb.json
index ef72f225f..ad30dfc37 100644
--- a/src/lib/i18n/languages/en-gb.json
+++ b/src/lib/i18n/languages/en-gb.json
@@ -508,6 +508,8 @@
 		"PRINCIPAL_READ_ONLY": "Principal '{name}' is read-only; its value is replaced only when it is resolved again.",
 		"WARNING_COVERAGE_IMPORTER_UNSET": "A coverage run is active but no injectable leaf importer is configured — this externalised slothlet's leaf loads will not attribute to your coverage report.",
 		"HINT_WARNING_COVERAGE_IMPORTER_UNSET": "Pass the 'import' option from your test setup — a function like (url) => import(url) — so leaf loads ride your runner's module graph. See docs/TESTING.md.",
+		"WARNING_COVERAGE_TS_SOURCEMAP_OFF": "A coverage run is active and TypeScript leaves are loading with typescript.sourcemap set to false — their coverage is recorded against the transpiled .slothlet-cache copies and cannot reach the .ts sources.",
+		"HINT_WARNING_COVERAGE_TS_SOURCEMAP_OFF": "Remove typescript.sourcemap: false (it turns on automatically during a coverage run) or set it to true, and add the cache directory (.slothlet-cache/**) to your coverage include. See docs/TESTING.md.",
 		"HOOK_VERSION_UNRESOLVED": "Hook pattern '{pattern}' could not be resolved to a registered version.",
 		"HINT_HOOK_VERSION_UNRESOLVED": "Version dispatch needs a versioned mount covering the pattern's path (api.add(path, source, options, { version })). A dispatcher must return a registered tag, an array of them, or nothing to take the default version — or drop the versioned/versionDispatcher option to register the pattern literally.",
 		"HOOK_VERSION_UNKNOWN_TAG": "Version dispatch for hook pattern '{pattern}' selected '{version}', which is not a registered version.",
diff --git a/src/lib/i18n/languages/en-us.json b/src/lib/i18n/languages/en-us.json
index a17fbabcc..0bf562390 100644
--- a/src/lib/i18n/languages/en-us.json
+++ b/src/lib/i18n/languages/en-us.json
@@ -508,6 +508,8 @@
 		"PRINCIPAL_READ_ONLY": "Principal '{name}' is read-only; its value is replaced only when it is resolved again.",
 		"WARNING_COVERAGE_IMPORTER_UNSET": "A coverage run is active but no injectable leaf importer is configured — this externalized slothlet's leaf loads will not attribute to your coverage report.",
 		"HINT_WARNING_COVERAGE_IMPORTER_UNSET": "Pass the 'import' option from your test setup — a function like (url) => import(url) — so leaf loads ride your runner's module graph. See docs/TESTING.md.",
+		"WARNING_COVERAGE_TS_SOURCEMAP_OFF": "A coverage run is active and TypeScript leaves are loading with typescript.sourcemap set to false — their coverage is recorded against the transpiled .slothlet-cache copies and cannot reach the .ts sources.",
+		"HINT_WARNING_COVERAGE_TS_SOURCEMAP_OFF": "Remove typescript.sourcemap: false (it turns on automatically during a coverage run) or set it to true, and add the cache directory (.slothlet-cache/**) to your coverage include. See docs/TESTING.md.",
 		"HOOK_VERSION_UNRESOLVED": "Hook pattern '{pattern}' could not be resolved to a registered version.",
 		"HINT_HOOK_VERSION_UNRESOLVED": "Version dispatch needs a versioned mount covering the pattern's path (api.add(path, source, options, { version })). A dispatcher must return a registered tag, an array of them, or nothing to take the default version — or drop the versioned/versionDispatcher option to register the pattern literally.",
 		"HOOK_VERSION_UNKNOWN_TAG": "Version dispatch for hook pattern '{pattern}' selected '{version}', which is not a registered version.",
diff --git a/src/lib/i18n/languages/es-es.json b/src/lib/i18n/languages/es-es.json
index 3cc178fbf..0f9052475 100644
--- a/src/lib/i18n/languages/es-es.json
+++ b/src/lib/i18n/languages/es-es.json
@@ -508,6 +508,8 @@
 		"PRINCIPAL_READ_ONLY": "El principal '{name}' es de solo lectura; su valor solo se reemplaza al resolverlo de nuevo.",
 		"WARNING_COVERAGE_IMPORTER_UNSET": "Hay una ejecución de cobertura activa pero no se ha configurado ningún importador de hojas inyectable — las cargas de hojas de este slothlet externalizado no se atribuirán a tu informe de cobertura.",
 		"HINT_WARNING_COVERAGE_IMPORTER_UNSET": "Pasa la opción 'import' desde tu configuración de pruebas — una función como (url) => import(url) — para que las cargas de hojas pasen por el grafo de módulos de tu ejecutor. Consulta docs/TESTING.md.",
+		"WARNING_COVERAGE_TS_SOURCEMAP_OFF": "Hay una ejecución de cobertura activa y se están cargando leaves de TypeScript con typescript.sourcemap en false — su cobertura se registra sobre las copias transpiladas de .slothlet-cache y no puede llegar a los fuentes .ts.",
+		"HINT_WARNING_COVERAGE_TS_SOURCEMAP_OFF": "Elimine typescript.sourcemap: false (se activa automáticamente durante una ejecución de cobertura) o establézcalo en true, y añada el directorio de caché (.slothlet-cache/**) al include de cobertura. Consulte docs/TESTING.md.",
 		"HOOK_VERSION_UNRESOLVED": "El patrón de gancho '{pattern}' no pudo resolverse a una versión registrada.",
 		"HINT_HOOK_VERSION_UNRESOLVED": "El despacho por versión necesita un montaje versionado que cubra la ruta del patrón (api.add(path, source, options, { version })). Un despachador debe devolver una etiqueta registrada, un array de ellas, o nada para tomar la versión por defecto — o quita la opción versioned/versionDispatcher para registrar el patrón literalmente.",
 		"HOOK_VERSION_UNKNOWN_TAG": "El despacho por versión para el patrón de gancho '{pattern}' seleccionó '{version}', que no es una versión registrada.",
diff --git a/src/lib/i18n/languages/es-mx.json b/src/lib/i18n/languages/es-mx.json
index 983ab25fe..702c03c8c 100644
--- a/src/lib/i18n/languages/es-mx.json
+++ b/src/lib/i18n/languages/es-mx.json
@@ -508,6 +508,8 @@
 		"PRINCIPAL_READ_ONLY": "El principal '{name}' es de solo lectura; su valor solo se reemplaza al resolverlo de nuevo.",
 		"WARNING_COVERAGE_IMPORTER_UNSET": "Hay una ejecución de cobertura activa pero no se ha configurado ningún importador de hojas inyectable — las cargas de hojas de este slothlet externalizado no se atribuirán a tu informe de cobertura.",
 		"HINT_WARNING_COVERAGE_IMPORTER_UNSET": "Pasa la opción 'import' desde tu configuración de pruebas — una función como (url) => import(url) — para que las cargas de hojas pasen por el grafo de módulos de tu ejecutor. Consulta docs/TESTING.md.",
+		"WARNING_COVERAGE_TS_SOURCEMAP_OFF": "Hay una ejecución de cobertura activa y se están cargando leaves de TypeScript con typescript.sourcemap en false — su cobertura se registra sobre las copias transpiladas de .slothlet-cache y no puede llegar a los archivos fuente .ts.",
+		"HINT_WARNING_COVERAGE_TS_SOURCEMAP_OFF": "Quita typescript.sourcemap: false (se activa automáticamente durante una ejecución de cobertura) o ponlo en true, y agrega el directorio de caché (.slothlet-cache/**) al include de cobertura. Consulta docs/TESTING.md.",
 		"HOOK_VERSION_UNRESOLVED": "El patrón de gancho '{pattern}' no pudo resolverse a una versión registrada.",
 		"HINT_HOOK_VERSION_UNRESOLVED": "El despacho por versión necesita un montaje versionado que cubra la ruta del patrón (api.add(path, source, options, { version })). Un despachador debe devolver una etiqueta registrada, un array de ellas, o nada para tomar la versión por defecto — o quita la opción versioned/versionDispatcher para registrar el patrón literalmente.",
 		"HOOK_VERSION_UNKNOWN_TAG": "El despacho por versión para el patrón de gancho '{pattern}' seleccionó '{version}', que no es una versión registrada.",
diff --git a/src/lib/i18n/languages/fr-fr.json b/src/lib/i18n/languages/fr-fr.json
index abb85ffb6..3d707df11 100644
--- a/src/lib/i18n/languages/fr-fr.json
+++ b/src/lib/i18n/languages/fr-fr.json
@@ -508,6 +508,8 @@
 		"PRINCIPAL_READ_ONLY": "Le principal '{name}' est en lecture seule ; sa valeur n'est remplacée que lorsqu'il est résolu à nouveau.",
 		"WARNING_COVERAGE_IMPORTER_UNSET": "Une exécution de couverture est active mais aucun importateur de feuilles injectable n'est configuré — les chargements de feuilles de ce slothlet externalisé ne seront pas attribués à votre rapport de couverture.",
 		"HINT_WARNING_COVERAGE_IMPORTER_UNSET": "Passez l'option 'import' depuis votre configuration de test — une fonction comme (url) => import(url) — pour que les chargements de feuilles passent par le graphe de modules de votre exécuteur. Voir docs/TESTING.md.",
+		"WARNING_COVERAGE_TS_SOURCEMAP_OFF": "Une exécution de couverture est active et des leaves TypeScript sont chargés avec typescript.sourcemap à false — leur couverture est enregistrée sur les copies transpilées de .slothlet-cache et ne peut pas atteindre les sources .ts.",
+		"HINT_WARNING_COVERAGE_TS_SOURCEMAP_OFF": "Supprimez typescript.sourcemap: false (il s'active automatiquement pendant une exécution de couverture) ou mettez-le à true, et ajoutez le répertoire de cache (.slothlet-cache/**) à l'include de couverture. Voir docs/TESTING.md.",
 		"HOOK_VERSION_UNRESOLVED": "Le motif de hook '{pattern}' n'a pas pu être résolu vers une version enregistrée.",
 		"HINT_HOOK_VERSION_UNRESOLVED": "La répartition par version nécessite un montage versionné couvrant le chemin du motif (api.add(path, source, options, { version })). Un dispatcher doit renvoyer un tag enregistré, un tableau de tags, ou rien pour prendre la version par défaut — ou retirez l'option versioned/versionDispatcher pour enregistrer le motif littéralement.",
 		"HOOK_VERSION_UNKNOWN_TAG": "La répartition par version pour le motif de hook '{pattern}' a sélectionné '{version}', qui n'est pas une version enregistrée.",
diff --git a/src/lib/i18n/languages/hi-in.json b/src/lib/i18n/languages/hi-in.json
index 041042acf..6787f92e9 100644
--- a/src/lib/i18n/languages/hi-in.json
+++ b/src/lib/i18n/languages/hi-in.json
@@ -508,6 +508,8 @@
 		"PRINCIPAL_READ_ONLY": "प्रिंसिपल '{name}' केवल-पठन है; इसका मान केवल दोबारा हल करने पर ही बदला जाता है।",
 		"WARNING_COVERAGE_IMPORTER_UNSET": "कवरेज रन सक्रिय है लेकिन कोई इंजेक्ट करने योग्य लीफ़ इम्पोर्टर सेट नहीं है — इस बाहरी slothlet की लीफ़ लोडिंग आपकी कवरेज रिपोर्ट में दर्ज नहीं होगी।",
 		"HINT_WARNING_COVERAGE_IMPORTER_UNSET": "अपने टेस्ट सेटअप से 'import' विकल्प — (url) => import(url) जैसा फ़ंक्शन — पास करें, ताकि लीफ़ लोडिंग आपके रनर के मॉड्यूल ग्राफ़ से गुज़रे। docs/TESTING.md देखें।",
+		"WARNING_COVERAGE_TS_SOURCEMAP_OFF": "एक कवरेज रन सक्रिय है और TypeScript लीफ़ typescript.sourcemap को false रखकर लोड हो रहे हैं — उनका कवरेज ट्रांसपाइल की गई .slothlet-cache प्रतियों पर दर्ज होता है और .ts स्रोतों तक नहीं पहुँच सकता।",
+		"HINT_WARNING_COVERAGE_TS_SOURCEMAP_OFF": "typescript.sourcemap: false हटाएँ (कवरेज रन के दौरान यह अपने-आप चालू हो जाता है) या इसे true पर सेट करें, और कैश डायरेक्टरी (.slothlet-cache/**) को अपने कवरेज include में जोड़ें। docs/TESTING.md देखें।",
 		"HOOK_VERSION_UNRESOLVED": "हुक पैटर्न '{pattern}' किसी पंजीकृत संस्करण से हल नहीं हो सका।",
 		"HINT_HOOK_VERSION_UNRESOLVED": "संस्करण डिस्पैच के लिए पैटर्न के पथ को कवर करने वाला संस्करणित माउंट चाहिए (api.add(path, source, options, { version }))। डिस्पैचर को पंजीकृत टैग, उनका array, या डिफ़ॉल्ट संस्करण के लिए कुछ नहीं लौटाना चाहिए — या पैटर्न को यथावत पंजीकृत करने के लिए versioned/versionDispatcher विकल्प हटा दें।",
 		"HOOK_VERSION_UNKNOWN_TAG": "हुक पैटर्न '{pattern}' के संस्करण डिस्पैच ने '{version}' चुना, जो पंजीकृत संस्करण नहीं है।",
diff --git a/src/lib/i18n/languages/ja-jp.json b/src/lib/i18n/languages/ja-jp.json
index f22e012d3..845cb70ef 100644
--- a/src/lib/i18n/languages/ja-jp.json
+++ b/src/lib/i18n/languages/ja-jp.json
@@ -508,6 +508,8 @@
 		"PRINCIPAL_READ_ONLY": "プリンシパル '{name}' は読み取り専用です。値は再解決されたときにのみ置き換えられます。",
 		"WARNING_COVERAGE_IMPORTER_UNSET": "カバレッジ実行が有効ですが、注入可能なリーフインポーターが設定されていません — この外部化された slothlet のリーフ読み込みはカバレッジレポートに計上されません。",
 		"HINT_WARNING_COVERAGE_IMPORTER_UNSET": "テストセットアップから 'import' オプション — (url) => import(url) のような関数 — を渡し、リーフ読み込みがランナーのモジュールグラフを通るようにしてください。docs/TESTING.md を参照。",
+		"WARNING_COVERAGE_TS_SOURCEMAP_OFF": "カバレッジ実行中に typescript.sourcemap が false のまま TypeScript のリーフが読み込まれています — そのカバレッジはトランスパイル済みの .slothlet-cache のコピーに記録され、.ts ソースには届きません。",
+		"HINT_WARNING_COVERAGE_TS_SOURCEMAP_OFF": "typescript.sourcemap: false を削除する（カバレッジ実行中は自動的に有効になります）か true に設定し、キャッシュディレクトリ（.slothlet-cache/**）をカバレッジの include に追加してください。docs/TESTING.md を参照してください。",
 		"HOOK_VERSION_UNRESOLVED": "フックパターン '{pattern}' を登録済みバージョンに解決できませんでした。",
 		"HINT_HOOK_VERSION_UNRESOLVED": "バージョンディスパッチには、パターンのパスをカバーするバージョン付きマウントが必要です (api.add(path, source, options, { version }))。ディスパッチャーは登録済みタグ、その配列、または既定バージョンを使う場合は何も返さない必要があります — あるいは versioned/versionDispatcher オプションを外してパターンをそのまま登録してください。",
 		"HOOK_VERSION_UNKNOWN_TAG": "フックパターン '{pattern}' のバージョンディスパッチが、登録されていないバージョン '{version}' を選択しました。",
diff --git a/src/lib/i18n/languages/ko-kr.json b/src/lib/i18n/languages/ko-kr.json
index af3185ab4..4dded1d79 100644
--- a/src/lib/i18n/languages/ko-kr.json
+++ b/src/lib/i18n/languages/ko-kr.json
@@ -508,6 +508,8 @@
 		"PRINCIPAL_READ_ONLY": "프린시펄 '{name}'은(는) 읽기 전용입니다. 값은 다시 해석될 때만 교체됩니다.",
 		"WARNING_COVERAGE_IMPORTER_UNSET": "커버리지 실행이 활성화되어 있지만 주입 가능한 리프 임포터가 설정되지 않았습니다 — 외부화된 이 slothlet의 리프 로드는 커버리지 보고서에 귀속되지 않습니다.",
 		"HINT_WARNING_COVERAGE_IMPORTER_UNSET": "테스트 설정에서 'import' 옵션 — (url) => import(url) 같은 함수 — 을 전달하여 리프 로드가 러너의 모듈 그래프를 타도록 하세요. docs/TESTING.md 참조.",
+		"WARNING_COVERAGE_TS_SOURCEMAP_OFF": "커버리지 실행이 활성화된 상태에서 typescript.sourcemap이 false로 설정된 채 TypeScript 리프가 로드되고 있습니다 — 해당 커버리지는 트랜스파일된 .slothlet-cache 사본에 기록되어 .ts 소스에 도달할 수 없습니다.",
+		"HINT_WARNING_COVERAGE_TS_SOURCEMAP_OFF": "typescript.sourcemap: false를 제거하거나(커버리지 실행 중에는 자동으로 켜집니다) true로 설정하고, 캐시 디렉터리(.slothlet-cache/**)를 커버리지 include에 추가하세요. docs/TESTING.md를 참조하세요.",
 		"HOOK_VERSION_UNRESOLVED": "훅 패턴 '{pattern}'을(를) 등록된 버전으로 해석할 수 없습니다.",
 		"HINT_HOOK_VERSION_UNRESOLVED": "버전 디스패치에는 패턴 경로를 포함하는 버전 마운트가 필요합니다 (api.add(path, source, options, { version })). 디스패처는 등록된 태그, 태그 배열, 또는 기본 버전을 사용하려면 아무것도 반환하지 않아야 합니다 — 아니면 versioned/versionDispatcher 옵션을 제거하고 패턴을 그대로 등록하세요.",
 		"HOOK_VERSION_UNKNOWN_TAG": "훅 패턴 '{pattern}'의 버전 디스패치가 등록되지 않은 버전 '{version}'을(를) 선택했습니다.",
diff --git a/src/lib/i18n/languages/pt-br.json b/src/lib/i18n/languages/pt-br.json
index b3847d8bb..af4b0803a 100644
--- a/src/lib/i18n/languages/pt-br.json
+++ b/src/lib/i18n/languages/pt-br.json
@@ -508,6 +508,8 @@
 		"PRINCIPAL_READ_ONLY": "O principal '{name}' é somente leitura; seu valor só é substituído quando ele é resolvido novamente.",
 		"WARNING_COVERAGE_IMPORTER_UNSET": "Uma execução de cobertura está ativa, mas nenhum importador de folhas injetável está configurado — os carregamentos de folhas deste slothlet externalizado não serão atribuídos ao seu relatório de cobertura.",
 		"HINT_WARNING_COVERAGE_IMPORTER_UNSET": "Passe a opção 'import' do seu setup de testes — uma função como (url) => import(url) — para que os carregamentos de folhas passem pelo grafo de módulos do seu executor. Veja docs/TESTING.md.",
+		"WARNING_COVERAGE_TS_SOURCEMAP_OFF": "Uma execução de cobertura está ativa e leaves TypeScript estão sendo carregados com typescript.sourcemap definido como false — a cobertura deles é registrada nas cópias transpiladas em .slothlet-cache e não consegue chegar aos fontes .ts.",
+		"HINT_WARNING_COVERAGE_TS_SOURCEMAP_OFF": "Remova typescript.sourcemap: false (ele é ativado automaticamente durante uma execução de cobertura) ou defina-o como true, e adicione o diretório de cache (.slothlet-cache/**) ao include de cobertura. Veja docs/TESTING.md.",
 		"HOOK_VERSION_UNRESOLVED": "O padrão de hook '{pattern}' não pôde ser resolvido para uma versão registrada.",
 		"HINT_HOOK_VERSION_UNRESOLVED": "O despacho por versão precisa de uma montagem versionada cobrindo o caminho do padrão (api.add(path, source, options, { version })). Um despachante deve retornar uma tag registrada, um array delas, ou nada para usar a versão padrão — ou remova a opção versioned/versionDispatcher para registrar o padrão literalmente.",
 		"HOOK_VERSION_UNKNOWN_TAG": "O despacho por versão para o padrão de hook '{pattern}' selecionou '{version}', que não é uma versão registrada.",
diff --git a/src/lib/i18n/languages/ru-ru.json b/src/lib/i18n/languages/ru-ru.json
index 2f76e1267..e7009e951 100644
--- a/src/lib/i18n/languages/ru-ru.json
+++ b/src/lib/i18n/languages/ru-ru.json
@@ -508,6 +508,8 @@
 		"PRINCIPAL_READ_ONLY": "Принципал '{name}' доступен только для чтения; его значение заменяется только при повторном разрешении.",
 		"WARNING_COVERAGE_IMPORTER_UNSET": "Активен запуск с покрытием, но внедряемый импортер листьев не настроен — загрузки листьев этого внешнего slothlet не будут учтены в отчёте о покрытии.",
 		"HINT_WARNING_COVERAGE_IMPORTER_UNSET": "Передайте опцию 'import' из вашей тестовой настройки — функцию вида (url) => import(url) — чтобы загрузки листьев шли через модульный граф вашего раннера. См. docs/TESTING.md.",
+		"WARNING_COVERAGE_TS_SOURCEMAP_OFF": "Активен прогон покрытия, а листья TypeScript загружаются с typescript.sourcemap, равным false, — их покрытие записывается на транспилированные копии в .slothlet-cache и не может попасть в исходники .ts.",
+		"HINT_WARNING_COVERAGE_TS_SOURCEMAP_OFF": "Уберите typescript.sourcemap: false (во время прогона покрытия он включается автоматически) или установите true и добавьте каталог кэша (.slothlet-cache/**) в include покрытия. См. docs/TESTING.md.",
 		"HOOK_VERSION_UNRESOLVED": "Шаблон hook '{pattern}' не удалось сопоставить с зарегистрированной версией.",
 		"HINT_HOOK_VERSION_UNRESOLVED": "Диспетчеризация по версии требует версионированного монтирования, покрывающего путь шаблона (api.add(path, source, options, { version })). Диспетчер должен вернуть зарегистрированный тег, массив тегов или ничего — для версии по умолчанию; либо уберите опцию versioned/versionDispatcher, чтобы зарегистрировать шаблон буквально.",
 		"HOOK_VERSION_UNKNOWN_TAG": "Диспетчеризация по версии для шаблона hook '{pattern}' выбрала '{version}' — это не зарегистрированная версия.",
diff --git a/src/lib/i18n/languages/zh-cn.json b/src/lib/i18n/languages/zh-cn.json
index c22a09f41..d4ec818c0 100644
--- a/src/lib/i18n/languages/zh-cn.json
+++ b/src/lib/i18n/languages/zh-cn.json
@@ -508,6 +508,8 @@
 		"PRINCIPAL_READ_ONLY": "主体 '{name}' 为只读；其值仅在重新解析时被替换。",
 		"WARNING_COVERAGE_IMPORTER_UNSET": "覆盖率运行处于活动状态，但未配置可注入的叶子导入器 — 这个外部化的 slothlet 的叶子加载将不会归因到你的覆盖率报告。",
 		"HINT_WARNING_COVERAGE_IMPORTER_UNSET": "请在测试设置中传入 'import' 选项 — 类似 (url) => import(url) 的函数 — 使叶子加载经过你的运行器的模块图。参见 docs/TESTING.md。",
+		"WARNING_COVERAGE_TS_SOURCEMAP_OFF": "覆盖率运行处于活动状态，而 TypeScript 叶子模块在 typescript.sourcemap 为 false 的情况下加载——其覆盖率记录在转译后的 .slothlet-cache 副本上，无法映射到 .ts 源文件。",
+		"HINT_WARNING_COVERAGE_TS_SOURCEMAP_OFF": "删除 typescript.sourcemap: false（覆盖率运行期间会自动开启）或将其设为 true，并将缓存目录（.slothlet-cache/**）加入覆盖率的 include。参见 docs/TESTING.md。",
 		"HOOK_VERSION_UNRESOLVED": "钩子模式 '{pattern}' 无法解析到已注册的版本。",
 		"HINT_HOOK_VERSION_UNRESOLVED": "版本调度需要一个覆盖该模式路径的版本化挂载 (api.add(path, source, options, { version }))。调度器必须返回已注册的标签、标签数组，或不返回任何内容以使用默认版本 — 或者去掉 versioned/versionDispatcher 选项以按字面注册该模式。",
 		"HOOK_VERSION_UNKNOWN_TAG": "钩子模式 '{pattern}' 的版本调度选择了 '{version}'，但它不是已注册的版本。",
diff --git a/src/lib/processors/loader.mjs b/src/lib/processors/loader.mjs
index fe35e5a6b..2b3810441 100644
--- a/src/lib/processors/loader.mjs
+++ b/src/lib/processors/loader.mjs
@@ -87,6 +87,67 @@ export function warnIfCoverageWithoutImporter(config, { worker = globalThis.__vi
 	return true;
 }
 
+/**
+ * Whether a coverage run is collecting this process's coverage (#484).
+ *
+ * @param {object} [overrides] - Environment inputs, injectable for tests.
+ * @param {object|undefined} [overrides.worker] - The vitest worker global, when present.
+ * @param {object} [overrides.env] - The environment variables to read (default `process.env`).
+ * @returns {boolean} True under a vitest coverage run or a native/c8 `NODE_V8_COVERAGE` run.
+ * @package
+ *
+ * @description
+ * A vitest coverage run is read from `__vitest_worker__.config.coverage.enabled`, exactly as
+ * {@link warnIfCoverageWithoutImporter} reads it: the global is vitest-internal, so a missing or
+ * reshaped value means "not detected", never a throw. A native or c8 run is read from
+ * `NODE_V8_COVERAGE`, which Node itself honours to write coverage (and each loaded module's source
+ * map) for the process.
+ */
+export function isCoverageRun({ worker = globalThis.__vitest_worker__, env = globalThis.process?.env } = {}) {
+	if (worker?.config?.coverage?.enabled === true) return true;
+	return typeof env?.NODE_V8_COVERAGE === "string" && env.NODE_V8_COVERAGE.length > 0;
+}
+
+/**
+ * The effective `sourcemap` setting for TypeScript transforms (#484).
+ *
+ * @param {object} typescriptConfig - The instance's normalized `typescript` config.
+ * @param {object} [overrides] - Environment inputs forwarded to {@link isCoverageRun}.
+ * @returns {boolean} True when transpiled output should carry an inline source map.
+ * @package
+ *
+ * @description
+ * An explicit boolean wins. When `sourcemap` is not set, source maps are on exactly during a
+ * coverage run: a TypeScript leaf executes from its `.slothlet-cache/` copy, and the inline map is
+ * the only way coverage can be remapped onto the `.ts` source.
+ */
+export function resolveSourcemap(typescriptConfig, overrides) {
+	const explicit = typescriptConfig?.sourcemap;
+	if (typeof explicit === "boolean") return explicit;
+	return isCoverageRun(overrides);
+}
+
+/**
+ * Warns when a coverage run loads TypeScript leaves with source maps explicitly off (#484).
+ *
+ * @param {object} config - The instance's transformed config.
+ * @param {object} [overrides] - Environment inputs forwarded to {@link isCoverageRun}.
+ * @returns {boolean} True when the warning was emitted.
+ * @package
+ *
+ * @description
+ * Without the inline map, coverage for a TypeScript leaf is recorded against its cache copy and
+ * can never reach the `.ts` source. The Loader calls this once per instance, on the first
+ * TypeScript leaf it loads; a `silent` instance stays quiet.
+ */
+export function warnIfCoverageWithoutSourcemap(config, overrides) {
+	if (config?.typescript?.sourcemap !== false) return false;
+	if (config?.silent) return false;
+	if (!isCoverageRun(overrides)) return false;
+	new SlothletWarning("WARNING_COVERAGE_TS_SOURCEMAP_OFF", {});
+	return true;
+}
+
 /**
  * Compile a `hidden` option (a glob string or array of globs) into a matcher, or null when there's
  * nothing to hide. Globs match an entry's path relative to the API root, built from the RAW on-disk
@@ -149,6 +210,13 @@ export function typeGenerationWorkerPath() {
 export class Loader extends ComponentBase {
 	static slothletProperty = "loader";
 
+	/**
+	 * Whether the one-shot TypeScript-coverage source-map check has run for this instance (#484).
+	 * @type {boolean}
+	 * @private
+	 */
+	#coverageSourcemapChecked = false;
+
 	/**
 	 * Create a Loader instance.
 	 * @param {object} slothlet - Slothlet class instance.
@@ -189,6 +257,12 @@ export class Loader extends ComponentBase {
 
 			if (isTypeScript && typescriptConfig?.enabled) {
 				const mode = typescriptConfig.mode;
+				// Source maps: explicit setting, else on during a coverage run (#484).
+				const sourcemap = resolveSourcemap(typescriptConfig);
+				if (!this.#coverageSourcemapChecked) {
+					this.#coverageSourcemapChecked = true;
+					warnIfCoverageWithoutSourcemap(this.slothlet.config);
+				}
 				if (mode === "strict") {
 					// Validate strict mode config
 					if (!typescriptConfig.types?.output) {
@@ -279,7 +353,7 @@ export class Loader extends ComponentBase {
 							strict: typescriptConfig.strict,
 							typeDefinitionPath: typescriptConfig.types.output,
 							compilerOptions: typescriptConfig.compilerOptions,
-							sourcemap: typescriptConfig.sourcemap
+							sourcemap
 						});
 						// Check for type errors
 						if (result.diagnostics && result.diagnostics.length > 0) {
@@ -313,7 +387,7 @@ export class Loader extends ComponentBase {
 
 					const transformOptions = {
 						target: typescriptConfig.target,
-						sourcemap: typescriptConfig.sourcemap
+						sourcemap
 					};
 					// Transform TypeScript to JavaScript. The same transform is used to
 					// follow relative .ts/.mts imports between user modules.
diff --git a/tests/vitests/suites/typescript/typescript-coverage-sourcemap.test.vitest.mjs b/tests/vitests/suites/typescript/typescript-coverage-sourcemap.test.vitest.mjs
new file mode 100644
index 000000000..7a392823b
--- /dev/null
+++ b/tests/vitests/suites/typescript/typescript-coverage-sourcemap.test.vitest.mjs
@@ -0,0 +1,246 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/typescript/typescript-coverage-sourcemap.test.vitest.mjs
+ *	@Date: 2026-09-28T00:00:00-07:00 (1790578800)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 00:00:00 -07:00 (1790578800)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview TypeScript source maps during a coverage run (#484).
+ *
+ * @description
+ * A TypeScript leaf executes from its `.slothlet-cache/` copy, so coverage can only land on the
+ * `.ts` source through the copy's inline source map. When `typescript.sourcemap` is not set,
+ * slothlet turns it on for a coverage run — a vitest coverage run (the worker global the #235
+ * hint already reads) or a native/c8 run (`NODE_V8_COVERAGE`). An explicit `sourcemap: false`
+ * wins, and then a one-shot `WARNING_COVERAGE_TS_SOURCEMAP_OFF` says the TS coverage can't reach
+ * the source (silenced by `silent`).
+ *
+ * @module tests/vitests/suites/typescript/typescript-coverage-sourcemap.test.vitest
+ */
+
+import { describe, it, expect, beforeAll, afterAll } from "vitest";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { writeFile, rm, mkdir, readdir, readFile } from "node:fs/promises";
+import { makeTestTmpDir } from "../../setup/test-fixtures-tmp.mjs";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = path.resolve(__dirname, "../../../..");
+
+const WARNING_CODE = "WARNING_COVERAGE_TS_SOURCEMAP_OFF";
+const COVERAGE_WORKER = { config: { coverage: { enabled: true, provider: "v8" } } };
+const PLAIN_WORKER = { config: { coverage: { enabled: false } } };
+
+let root;
+let apiDir;
+let leafPath;
+
+beforeAll(async () => {
+	root = await makeTestTmpDir("ts-coverage-sourcemap");
+	apiDir = path.join(root, "api");
+	await mkdir(apiDir, { recursive: true });
+	leafPath = path.join(apiDir, "boom.ts");
+	await writeFile(
+		leafPath,
+		[
+			"export function boom(label: string): never {",
+			"\tconst message: string = `boom-484:${label}`;",
+			"\tthrow new Error(message);",
+			"}",
+			""
+		].join("\n"),
+		"utf8"
+	);
+	// A second TS leaf, so the one-shot warning is proven to fire once per instance, not per leaf.
+	await writeFile(path.join(apiDir, "other.ts"), "export function other(): number {\n\treturn 484;\n}\n", "utf8");
+});
+
+afterAll(async () => {
+	if (root) await rm(root, { recursive: true, force: true });
+});
+
+describe("coverage-run detection", () => {
+	it("detects a vitest coverage run from the worker global", async () => {
+		const { isCoverageRun } = await import("@cldmv/slothlet/processors/loader");
+		expect(isCoverageRun({ worker: COVERAGE_WORKER, env: {} })).toBe(true);
+	});
+
+	it("detects a native/c8 run from NODE_V8_COVERAGE", async () => {
+		const { isCoverageRun } = await import("@cldmv/slothlet/processors/loader");
+		expect(isCoverageRun({ worker: null, env: { NODE_V8_COVERAGE: "/some/dir" } })).toBe(true);
+	});
+
+	it("reports no coverage run for a plain test run or plain process", async () => {
+		const { isCoverageRun } = await import("@cldmv/slothlet/processors/loader");
+		expect(isCoverageRun({ worker: PLAIN_WORKER, env: {} })).toBe(false);
+		expect(isCoverageRun({ worker: null, env: {} })).toBe(false);
+		expect(isCoverageRun({ worker: null, env: { NODE_V8_COVERAGE: "" } })).toBe(false);
+		// A malformed worker global means no detection, never a throw.
+		expect(isCoverageRun({ worker: { config: null }, env: {} })).toBe(false);
+	});
+});
+
+describe("resolveSourcemap", () => {
+	it("turns source maps on under a coverage run when sourcemap is not set", async () => {
+		const { resolveSourcemap } = await import("@cldmv/slothlet/processors/loader");
+		expect(resolveSourcemap({ enabled: true, mode: "fast" }, { worker: COVERAGE_WORKER, env: {} })).toBe(true);
+		expect(resolveSourcemap({ enabled: true, mode: "fast", sourcemap: null }, { worker: null, env: { NODE_V8_COVERAGE: "/x" } })).toBe(
+			true
+		);
+	});
+
+	it("leaves source maps off outside a coverage run when sourcemap is not set", async () => {
+		const { resolveSourcemap } = await import("@cldmv/slothlet/processors/loader");
+		expect(resolveSourcemap({ enabled: true, mode: "fast" }, { worker: PLAIN_WORKER, env: {} })).toBe(false);
+	});
+
+	it("lets an explicit sourcemap value win over detection", async () => {
+		const { resolveSourcemap } = await import("@cldmv/slothlet/processors/loader");
+		expect(resolveSourcemap({ enabled: true, mode: "fast", sourcemap: false }, { worker: COVERAGE_WORKER, env: {} })).toBe(false);
+		expect(resolveSourcemap({ enabled: true, mode: "fast", sourcemap: true }, { worker: null, env: {} })).toBe(true);
+	});
+
+	it("keeps an unset sourcemap unset through config normalization", async () => {
+		const { Config } = await import("@cldmv/slothlet/helpers/config");
+		const { SlothletError, SlothletWarning } = await import("@cldmv/slothlet/errors");
+		const cfg = new Config({
+			config: {},
+			debug: () => {},
+			SlothletError,
+			SlothletWarning,
+			helpers: { resolver: { resolvePathFromCaller: (dir) => dir } }
+		});
+		expect(cfg.normalizeTypeScript({ mode: "fast" }).sourcemap).toBeNull();
+		expect(cfg.normalizeTypeScript({ mode: "fast", sourcemap: false }).sourcemap).toBe(false);
+	});
+});
+
+describe("warnIfCoverageWithoutSourcemap", () => {
+	/**
+	 * Run the decision helper with captured warnings.
+	 * @param {object} config - Instance config under test.
+	 * @param {object} overrides - Injected environment inputs.
+	 * @returns {Promise<{fired: boolean, captured: number}>} Whether it warned and how many captures.
+	 */
+	async function probe(config, overrides) {
+		const { warnIfCoverageWithoutSourcemap } = await import("@cldmv/slothlet/processors/loader");
+		const { SlothletWarning } = await import("@cldmv/slothlet/errors");
+		SlothletWarning.clearCaptured();
+		const prior = SlothletWarning.suppressConsole;
+		SlothletWarning.suppressConsole = true;
+		try {
+			const fired = warnIfCoverageWithoutSourcemap(config, overrides);
+			return { fired, captured: SlothletWarning.captured.filter((w) => w.code === WARNING_CODE).length };
+		} finally {
+			SlothletWarning.suppressConsole = prior;
+			SlothletWarning.clearCaptured();
+		}
+	}
+
+	const OFF = { typescript: { enabled: true, mode: "fast", sourcemap: false } };
+
+	it("warns under a coverage run with sourcemap explicitly off", async () => {
+		expect(await probe(OFF, { worker: COVERAGE_WORKER, env: {} })).toEqual({ fired: true, captured: 1 });
+		expect(await probe(OFF, { worker: null, env: { NODE_V8_COVERAGE: "/x" } })).toEqual({ fired: true, captured: 1 });
+	});
+
+	it("stays silent outside a coverage run", async () => {
+		expect(await probe(OFF, { worker: PLAIN_WORKER, env: {} })).toEqual({ fired: false, captured: 0 });
+	});
+
+	it("stays silent when sourcemap is on or unset (auto-on)", async () => {
+		const on = { typescript: { enabled: true, mode: "fast", sourcemap: true } };
+		const unset = { typescript: { enabled: true, mode: "fast", sourcemap: null } };
+		expect((await probe(on, { worker: COVERAGE_WORKER, env: {} })).fired).toBe(false);
+		expect((await probe(unset, { worker: COVERAGE_WORKER, env: {} })).fired).toBe(false);
+	});
+
+	it("respects silent instances", async () => {
+		expect(await probe({ ...OFF, silent: true }, { worker: COVERAGE_WORKER, env: {} })).toEqual({ fired: false, captured: 0 });
+	});
+});
+
+describe("a real NODE_V8_COVERAGE process", () => {
+	/**
+	 * Boot slothlet against the fixture in a child process, call both leaves, and shut down.
+	 * @param {object} options - Child options.
+	 * @param {object} options.typescript - The `typescript` config to boot with.
+	 * @param {boolean} [options.silent=false] - Boot the instance silent.
+	 * @param {string|null} options.coverageDir - NODE_V8_COVERAGE for the child, or null for none.
+	 * @returns {{stdout: string, stderr: string}} The child's output (stdout carries the error stack).
+	 */
+	function runChild({ typescript, silent = false, coverageDir }) {
+		const script = [
+			`import slothlet from ${JSON.stringify(pathToFileURL(path.join(REPO_ROOT, "index.mjs")).href)};`,
+			`const api = await slothlet({ dir: ${JSON.stringify(apiDir)}, mode: "eager", silent: ${silent}, typescript: ${JSON.stringify(typescript)} });`,
+			`await api.other();`,
+			`try { await api.boom("x"); } catch (error) { process.stdout.write(String(error.stack)); }`,
+			`await api.slothlet.shutdown();`
+		].join("\n");
+		const scriptPath = path.join(root, `child-${Date.now()}-${Math.random().toString(36).slice(2)}.mjs`);
+		const env = { ...process.env };
+		delete env.NODE_V8_COVERAGE;
+		if (coverageDir) env.NODE_V8_COVERAGE = coverageDir;
+		return (async () => {
+			await writeFile(scriptPath, script, "utf8");
+			const result = spawnSync(process.execPath, ["--enable-source-maps", scriptPath], {
+				cwd: REPO_ROOT,
+				env,
+				encoding: "utf8",
+				timeout: 90000
+			});
+			expect(result.status, result.stderr).toBe(0);
+			return { stdout: result.stdout, stderr: result.stderr };
+		})();
+	}
+
+	it("inlines the map automatically and the coverage output maps the cache copy to the .ts source", async () => {
+		const coverageDir = path.join(root, "v8-auto");
+		const { stdout, stderr } = await runChild({ typescript: { mode: "fast" }, coverageDir });
+		expect(stdout).toContain("boom-484:x");
+		expect(stdout, "stack frame remapped through the inline map").toContain(`${leafPath}:3`);
+		expect(stderr).not.toContain(WARNING_CODE);
+
+		// Node records each loaded module's source map into the coverage output (`source-map-cache`),
+		// which c8 uses to remap. The cache copy's entry must name the .ts source.
+		const sources = [];
+		for (const name of await readdir(coverageDir)) {
+			const data = JSON.parse(await readFile(path.join(coverageDir, name), "utf8"));
+			for (const [key, entry] of Object.entries(data["source-map-cache"] ?? {})) {
+				if (key.includes(".slothlet-cache")) sources.push(...(entry.data?.sources ?? []));
+			}
+		}
+		expect(sources.some((source) => source === leafPath || source === pathToFileURL(leafPath).href)).toBe(true);
+	}, 90000);
+
+	it("keeps source maps off when sourcemap is explicitly false, and warns once", async () => {
+		const { stdout, stderr } = await runChild({ typescript: { mode: "fast", sourcemap: false }, coverageDir: path.join(root, "v8-off") });
+		expect(stdout).toContain("boom-484:x");
+		expect(stdout).not.toContain(leafPath);
+		expect(stderr.split(WARNING_CODE).length - 1, "one warning for two TS leaves").toBe(1);
+	}, 90000);
+
+	it("does not warn a silent instance", async () => {
+		const { stderr } = await runChild({
+			typescript: { mode: "fast", sourcemap: false },
+			silent: true,
+			coverageDir: path.join(root, "v8-silent")
+		});
+		expect(stderr).not.toContain(WARNING_CODE);
+	}, 90000);
+
+	it("leaves source maps off without a coverage run", async () => {
+		const { stdout, stderr } = await runChild({ typescript: { mode: "fast" }, coverageDir: null });
+		expect(stdout).toContain("boom-484:x");
+		expect(stdout).not.toContain(leafPath);
+		expect(stderr).not.toContain(WARNING_CODE);
+	}, 90000);
+});
diff --git a/tools/ci/i18n-script-purity-accepted.json b/tools/ci/i18n-script-purity-accepted.json
index 7c4b04975..ee611006c 100644
--- a/tools/ci/i18n-script-purity-accepted.json
+++ b/tools/ci/i18n-script-purity-accepted.json
@@ -7,7 +7,9 @@
 		"संस्करण डिस्पैच के लिए पैटर्न के पथ को कवर करने वाला संस्करणित माउंट चाहिए (api.add(path, source, options, { version }))। डिस्पैचर को पंजीकृत टैग, उनका array, या डिफ़ॉल्ट संस्करण के लिए कुछ नहीं लौटाना चाहिए — या पैटर्न को यथावत पंजीकृत करने के लिए versioned/versionDispatcher विकल्प हटा दें।",
 		"डिस्पैचर को allVersions में दिए गए पंजीकृत टैग में से चुनना चाहिए। पहले माउंट पंजीकृत करें (संस्करण के साथ api.add), या डिस्पैचर का रिटर्न मान ठीक करें।",
 		"आरक्षित नाम (INTERNAL_KEYS जैसे _materialize, _impl) फ्रेमवर्क के अपने रैपर हैंडल हैं; उसी नाम की मॉड्यूल फ़ाइल चाइल्ड अपनाने के दौरान उन्हें अधिलेखित कर देगी। फ़ाइल का नाम बदलें।",
-		"आरक्षित नाम (_materialize, __impl, ...) फ्रेमवर्क के अपने रैपर हैंडल हैं — ऐसा एक्सपोर्ट केवल छिपा और अप्राप्य रह सकता है। एक्सपोर्ट का नाम बदलें।"
+		"आरक्षित नाम (_materialize, __impl, ...) फ्रेमवर्क के अपने रैपर हैंडल हैं — ऐसा एक्सपोर्ट केवल छिपा और अप्राप्य रह सकता है। एक्सपोर्ट का नाम बदलें।",
+		"एक कवरेज रन सक्रिय है और TypeScript लीफ़ typescript.sourcemap को false रखकर लोड हो रहे हैं — उनका कवरेज ट्रांसपाइल की गई .slothlet-cache प्रतियों पर दर्ज होता है और .ts स्रोतों तक नहीं पहुँच सकता।",
+		"typescript.sourcemap: false हटाएँ (कवरेज रन के दौरान यह अपने-आप चालू हो जाता है) या इसे true पर सेट करें, और कैश डायरेक्टरी (.slothlet-cache/**) को अपने कवरेज include में जोड़ें। docs/TESTING.md देखें।"
 	],
 	"ja-jp": [
 		"leaves() はキーを所有権レコードに対して解決します: moduleID、モジュールのマウントパス、またはそのモジュールが所有する任意のパスです。現在のマウントは api.slothlet.owner.get() で一覧できます。",
@@ -17,7 +19,9 @@
 		"バージョンディスパッチには、パターンのパスをカバーするバージョン付きマウントが必要です (api.add(path, source, options, { version }))。ディスパッチャーは登録済みタグ、その配列、または既定バージョンを使う場合は何も返さない必要があります — あるいは versioned/versionDispatcher オプションを外してパターンをそのまま登録してください。",
 		"ディスパッチャーは allVersions で渡された登録済みタグから選択する必要があります。先にマウントを登録するか (バージョン付き api.add)、ディスパッチャーの戻り値を修正してください。",
 		"予約名 (INTERNAL_KEYS の _materialize、_impl など) はフレームワーク自身のラッパーハンドルです。同名のモジュールファイルは子の取り込み時にそれらを上書きしてしまいます。ファイル名を変更してください。",
-		"予約名 (_materialize、__impl など) はフレームワーク自身のラッパーハンドルです — そのようなエクスポートは隠されて到達不能になるだけです。エクスポート名を変更してください。"
+		"予約名 (_materialize、__impl など) はフレームワーク自身のラッパーハンドルです — そのようなエクスポートは隠されて到達不能になるだけです。エクスポート名を変更してください。",
+		"カバレッジ実行中に typescript.sourcemap が false のまま TypeScript のリーフが読み込まれています — そのカバレッジはトランスパイル済みの .slothlet-cache のコピーに記録され、.ts ソースには届きません。",
+		"typescript.sourcemap: false を削除する（カバレッジ実行中は自動的に有効になります）か true に設定し、キャッシュディレクトリ（.slothlet-cache/**）をカバレッジの include に追加してください。docs/TESTING.md を参照してください。"
 	],
 	"ko-kr": [
 		"leaves()는 키를 소유권 레코드에 대해 해석합니다: moduleID, 모듈이 마운트된 경로, 또는 해당 모듈이 소유한 임의의 경로입니다. 현재 마운트는 api.slothlet.owner.get()으로 확인할 수 있습니다.",
@@ -27,7 +31,9 @@
 		"버전 디스패치에는 패턴 경로를 포함하는 버전 마운트가 필요합니다 (api.add(path, source, options, { version })). 디스패처는 등록된 태그, 태그 배열, 또는 기본 버전을 사용하려면 아무것도 반환하지 않아야 합니다 — 아니면 versioned/versionDispatcher 옵션을 제거하고 패턴을 그대로 등록하세요.",
 		"디스패처는 allVersions로 전달된 등록된 태그 중에서 선택해야 합니다. 먼저 마운트를 등록하거나 (버전이 있는 api.add), 디스패처의 반환값을 수정하세요.",
 		"예약 이름 (INTERNAL_KEYS의 _materialize, _impl 등)은 프레임워크 자체의 래퍼 핸들입니다. 같은 이름의 모듈 파일은 자식 채택 시 이를 덮어씁니다. 파일 이름을 변경하세요.",
-		"예약 이름 (_materialize, __impl 등)은 프레임워크 자체의 래퍼 핸들입니다 — 이런 내보내기는 가려져 도달할 수 없을 뿐입니다. 내보내기 이름을 변경하세요."
+		"예약 이름 (_materialize, __impl 등)은 프레임워크 자체의 래퍼 핸들입니다 — 이런 내보내기는 가려져 도달할 수 없을 뿐입니다. 내보내기 이름을 변경하세요.",
+		"커버리지 실행이 활성화된 상태에서 typescript.sourcemap이 false로 설정된 채 TypeScript 리프가 로드되고 있습니다 — 해당 커버리지는 트랜스파일된 .slothlet-cache 사본에 기록되어 .ts 소스에 도달할 수 없습니다.",
+		"typescript.sourcemap: false를 제거하거나(커버리지 실행 중에는 자동으로 켜집니다) true로 설정하고, 캐시 디렉터리(.slothlet-cache/**)를 커버리지 include에 추가하세요. docs/TESTING.md를 참조하세요."
 	],
 	"ru-ru": [
 		"leaves() разрешает ключ по записям владения: moduleID, путь монтирования модуля или любой путь, которым владеет этот модуль. Текущие монтирования можно получить через api.slothlet.owner.get().",
@@ -37,7 +43,9 @@
 		"Диспетчеризация по версии требует версионированного монтирования, покрывающего путь шаблона (api.add(path, source, options, { version })). Диспетчер должен вернуть зарегистрированный тег, массив тегов или ничего — для версии по умолчанию; либо уберите опцию versioned/versionDispatcher, чтобы зарегистрировать шаблон буквально.",
 		"Диспетчер должен выбирать из зарегистрированных тегов, переданных в allVersions. Сначала зарегистрируйте монтирование (api.add с версией) или исправьте возвращаемое значение диспетчера.",
 		"Зарезервированные имена (INTERNAL_KEYS, такие как _materialize, _impl) — это собственные обработчики оболочки фреймворка; файл модуля с таким именем перезаписал бы их при принятии потомков. Переименуйте файл.",
-		"Зарезервированные имена (_materialize, __impl, ...) — это собственные обработчики оболочки фреймворка — такой экспорт может быть лишь скрыт и недостижим. Переименуйте экспорт."
+		"Зарезервированные имена (_materialize, __impl, ...) — это собственные обработчики оболочки фреймворка — такой экспорт может быть лишь скрыт и недостижим. Переименуйте экспорт.",
+		"Активен прогон покрытия, а листья TypeScript загружаются с typescript.sourcemap, равным false, — их покрытие записывается на транспилированные копии в .slothlet-cache и не может попасть в исходники .ts.",
+		"Уберите typescript.sourcemap: false (во время прогона покрытия он включается автоматически) или установите true и добавьте каталог кэша (.slothlet-cache/**) в include покрытия. См. docs/TESTING.md."
 	],
 	"zh-cn": [
 		"leaves() 根据所有权记录解析键：moduleID、模块的挂载路径，或该模块拥有的任意路径。可通过 api.slothlet.owner.get() 列出当前挂载。",
@@ -47,6 +55,8 @@
 		"版本调度需要一个覆盖该模式路径的版本化挂载 (api.add(path, source, options, { version }))。调度器必须返回已注册的标签、标签数组，或不返回任何内容以使用默认版本 — 或者去掉 versioned/versionDispatcher 选项以按字面注册该模式。",
 		"调度器必须从 allVersions 中提供的已注册标签中选择。请先注册挂载（带版本的 api.add），或修正调度器的返回值。",
 		"保留名称（INTERNAL_KEYS 中的 _materialize、_impl 等）是框架自身的包装器句柄；同名模块文件会在子级收养时覆盖它们。请重命名该文件。",
-		"保留名称（_materialize、__impl 等）是框架自身的包装器句柄 — 这样的导出只会被遮蔽且不可达。请重命名该导出。"
+		"保留名称（_materialize、__impl 等）是框架自身的包装器句柄 — 这样的导出只会被遮蔽且不可达。请重命名该导出。",
+		"覆盖率运行处于活动状态，而 TypeScript 叶子模块在 typescript.sourcemap 为 false 的情况下加载——其覆盖率记录在转译后的 .slothlet-cache 副本上，无法映射到 .ts 源文件。",
+		"删除 typescript.sourcemap: false（覆盖率运行期间会自动开启）或将其设为 true，并将缓存目录（.slothlet-cache/**）加入覆盖率的 include。参见 docs/TESTING.md。"
 	]
 }
diff --git a/types/src/lib/helpers/config.d.mts.map b/types/src/lib/helpers/config.d.mts.map
index 580cbde93..ca5532640 100644
--- a/types/src/lib/helpers/config.d.mts.map
+++ b/types/src/lib/helpers/config.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"config.d.mts","sourceRoot":"","sources":["../../../../src/lib/helpers/config.mjs"],"names":[],"mappings":"AAwEA;;;;;;;;;;;;;;;;;GAiBG;AACH,2CAJW,OAAO,GAAC,MAAM,GAAC,MAAM,GACnB;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;IAAC,cAAc,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,OAAO,CAAA;CAAC,CAqB7F;AAED;;;;;GAKG;AACH;IACC,gCAAmC;IAEnC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,qCAxBW,MAAM,GAAC,MAAM,GACX,MAAM,CAiDlB;IAED;;;;;OAKG;IACH,iCAJW,MAAM,GACJ,MAAM,CAsBlB;IAED;;;;;OAKG;IACH,2BAJW,MAAM,GACJ,MAAM,CAsBlB;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,qCAnBW,MAAM,GACJ,MAAM,CAyClB;IAED;;;;;OAKG;IACH,6BAJW,OAAO,GAAC,MAAM,GACZ,MAAM,CAoElB;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,oCATW,GAAC,0BACC,SAAS,GAAC,MAAM,CAoB5B;IAED;;;;;;;;;;;;;;OAcG;IACH,4BAJW,OAAO,GAAC,MAAM,GAAC,MAAM,GACnB;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,cAAc,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,OAAO,CAAA;KAAC,CAK7F;IAED;;;;;;OAMG;IACH,gCALW,MAAM,GACJ,MAAM,CAuQlB;IAED;;;;;;;;;;;OAWG;IACH,6CARW,MAAM,EAAE,GAAC,SAAS,UAClB,OAAO,GACL,GAAG,CAAC,MAAM,CAAC,CA8BvB;IAED;;;;;OAKG;IACH,uCAJW,OAAO,GAAC,MAAM,GAAC,MAAM,GACnB,MAAM,GAAC,IAAI,CAmDvB;IAqCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,yBArBW,MAAM,GAAC,IAAI,GAAC,SAAS,GAEnB;QAAE,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,GAAC,IAAI,CA4BtC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,qCAbW,MAAM,GAAC,IAAI,GAAC,SAAS,GACnB,MAAM,GAAC,IAAI,CAqEvB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6CG;IACH,mCApBW,SAAS,GAAC,IAAI,GAAC,KAAK,CAAC,MAAM,GAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAC,CAAC,GAChH,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,GAAC,SAAS,GAAC,UAAU,GAAC,SAAS,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,OAAO,GAAC,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAC,CAAC,CAiO9I;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,mCAvBW,MAAM,GAAC,IAAI,GAiBT,MAAM,GAAC,IAAI,CAgQvB;;CACD;8BA95C6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"config.d.mts","sourceRoot":"","sources":["../../../../src/lib/helpers/config.mjs"],"names":[],"mappings":"AAwEA;;;;;;;;;;;;;;;;;GAiBG;AACH,2CAJW,OAAO,GAAC,MAAM,GAAC,MAAM,GACnB;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;IAAC,cAAc,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,OAAO,CAAA;CAAC,CAqB7F;AAED;;;;;GAKG;AACH;IACC,gCAAmC;IAEnC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,qCAxBW,MAAM,GAAC,MAAM,GACX,MAAM,CAiDlB;IAED;;;;;OAKG;IACH,iCAJW,MAAM,GACJ,MAAM,CAsBlB;IAED;;;;;OAKG;IACH,2BAJW,MAAM,GACJ,MAAM,CAsBlB;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,qCAnBW,MAAM,GACJ,MAAM,CAyClB;IAED;;;;;OAKG;IACH,6BAJW,OAAO,GAAC,MAAM,GACZ,MAAM,CAoElB;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,oCATW,GAAC,0BACC,SAAS,GAAC,MAAM,CAoB5B;IAED;;;;;;;;;;;;;;OAcG;IACH,4BAJW,OAAO,GAAC,MAAM,GAAC,MAAM,GACnB;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,cAAc,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,OAAO,CAAA;KAAC,CAK7F;IAED;;;;;;OAMG;IACH,gCALW,MAAM,GACJ,MAAM,CAuQlB;IAED;;;;;;;;;;;OAWG;IACH,6CARW,MAAM,EAAE,GAAC,SAAS,UAClB,OAAO,GACL,GAAG,CAAC,MAAM,CAAC,CA8BvB;IAED;;;;;OAKG;IACH,uCAJW,OAAO,GAAC,MAAM,GAAC,MAAM,GACnB,MAAM,GAAC,IAAI,CAoDvB;IAqCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,yBArBW,MAAM,GAAC,IAAI,GAAC,SAAS,GAEnB;QAAE,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,GAAC,IAAI,CA4BtC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,qCAbW,MAAM,GAAC,IAAI,GAAC,SAAS,GACnB,MAAM,GAAC,IAAI,CAqEvB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6CG;IACH,mCApBW,SAAS,GAAC,IAAI,GAAC,KAAK,CAAC,MAAM,GAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAC,CAAC,GAChH,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,GAAC,SAAS,GAAC,UAAU,GAAC,SAAS,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,OAAO,GAAC,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAC,CAAC,CAiO9I;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,mCAvBW,MAAM,GAAC,IAAI,GAiBT,MAAM,GAAC,IAAI,CAgQvB;;CACD;8BA/5C6B,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/lib/processors/loader.d.mts b/types/src/lib/processors/loader.d.mts
index 660415ef5..f9f600e71 100644
--- a/types/src/lib/processors/loader.d.mts
+++ b/types/src/lib/processors/loader.d.mts
@@ -22,6 +22,54 @@ export function warnIfCoverageWithoutImporter(config: object, { worker, external
     worker?: object | undefined;
     externalized?: boolean | undefined;
 }): boolean;
+/**
+ * Whether a coverage run is collecting this process's coverage (#484).
+ *
+ * @param {object} [overrides] - Environment inputs, injectable for tests.
+ * @param {object|undefined} [overrides.worker] - The vitest worker global, when present.
+ * @param {object} [overrides.env] - The environment variables to read (default `process.env`).
+ * @returns {boolean} True under a vitest coverage run or a native/c8 `NODE_V8_COVERAGE` run.
+ * @package
+ *
+ * @description
+ * A vitest coverage run is read from `__vitest_worker__.config.coverage.enabled`, exactly as
+ * {@link warnIfCoverageWithoutImporter} reads it: the global is vitest-internal, so a missing or
+ * reshaped value means "not detected", never a throw. A native or c8 run is read from
+ * `NODE_V8_COVERAGE`, which Node itself honours to write coverage (and each loaded module's source
+ * map) for the process.
+ */
+export function isCoverageRun({ worker, env }?: {
+    worker?: object | undefined;
+    env?: object | undefined;
+}): boolean;
+/**
+ * The effective `sourcemap` setting for TypeScript transforms (#484).
+ *
+ * @param {object} typescriptConfig - The instance's normalized `typescript` config.
+ * @param {object} [overrides] - Environment inputs forwarded to {@link isCoverageRun}.
+ * @returns {boolean} True when transpiled output should carry an inline source map.
+ * @package
+ *
+ * @description
+ * An explicit boolean wins. When `sourcemap` is not set, source maps are on exactly during a
+ * coverage run: a TypeScript leaf executes from its `.slothlet-cache/` copy, and the inline map is
+ * the only way coverage can be remapped onto the `.ts` source.
+ */
+export function resolveSourcemap(typescriptConfig: object, overrides?: object): boolean;
+/**
+ * Warns when a coverage run loads TypeScript leaves with source maps explicitly off (#484).
+ *
+ * @param {object} config - The instance's transformed config.
+ * @param {object} [overrides] - Environment inputs forwarded to {@link isCoverageRun}.
+ * @returns {boolean} True when the warning was emitted.
+ * @package
+ *
+ * @description
+ * Without the inline map, coverage for a TypeScript leaf is recorded against its cache copy and
+ * can never reach the `.ts` source. The Loader calls this once per instance, on the first
+ * TypeScript leaf it loads; a `silent` instance stays quiet.
+ */
+export function warnIfCoverageWithoutSourcemap(config: object, overrides?: object): boolean;
 /**
  * Loader component for module loading, directory scanning, and API merging
  * @class Loader
diff --git a/types/src/lib/processors/loader.d.mts.map b/types/src/lib/processors/loader.d.mts.map
index 82614ac2d..a0d24c883 100644
--- a/types/src/lib/processors/loader.d.mts.map
+++ b/types/src/lib/processors/loader.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"loader.d.mts","sourceRoot":"","sources":["../../../../src/lib/processors/loader.mjs"],"names":[],"mappings":"AA4DA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,sDAjBW,MAAM,6BAEd;IAAqC,MAAM,GAAnC,MAAM,GAAC,SAAS;IACI,YAAY;CAExC,GAAU,OAAO,CAmBnB;AAwCD;;;;;GAKG;AACH;;;;;;;;;;GAUG;AACH,4CALa,MAAM,CAOlB;AAED;IACC,gCAAmC;IAEnC;;;;OAIG;IACH,sBAHW,MAAM,EAKhB;IAED;;;;;;;;OAQG;IACH,4BAPW,MAAM,eACN,MAAM,aACN,MAAM,cACN,MAAM,GAAC,IAAI,GACT,OAAO,CAAC,MAAM,CAAC,CAwM3B;IAyED;;;;;;;;;;;;;;OAcG;IACH,0BAbW,MAAM,YAEd;QAA0B,UAAU;QACX,YAAY;QACZ,QAAQ;QACD,UAAU;QACM,MAAM;QAE5B,iBAAiB;QAClB,OAAO;KAChC,GAAU,OAAO,CAAC,MAAM,CAAC,CAqJ3B;IA8PD;;;;;OAKG;IACH,8BAJW,MAAM,GACJ,MAAM,CA+ClB;;CACD;8BAj3B6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"loader.d.mts","sourceRoot":"","sources":["../../../../src/lib/processors/loader.mjs"],"names":[],"mappings":"AA4DA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,sDAjBW,MAAM,6BAEd;IAAqC,MAAM,GAAnC,MAAM,GAAC,SAAS;IACI,YAAY;CAExC,GAAU,OAAO,CAmBnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,gDAZG;IAAqC,MAAM,GAAnC,MAAM,GAAC,SAAS;IACG,GAAG;CAC9B,GAAU,OAAO,CAanB;AAED;;;;;;;;;;;;GAYG;AACH,mDAVW,MAAM,cACN,MAAM,GACJ,OAAO,CAYnB;AAED;;;;;;;;;;;;GAYG;AACH,uDAVW,MAAM,cACN,MAAM,GACJ,OAAO,CAcnB;AAwCD;;;;;GAKG;AACH;;;;;;;;;;GAUG;AACH,4CALa,MAAM,CAOlB;AAED;IACC,gCAAmC;IASnC;;;;OAIG;IACH,sBAHW,MAAM,EAKhB;IAED;;;;;;;;OAQG;IACH,4BAPW,MAAM,eACN,MAAM,aACN,MAAM,cACN,MAAM,GAAC,IAAI,GACT,OAAO,CAAC,MAAM,CAAC,CA8M3B;IAyED;;;;;;;;;;;;;;OAcG;IACH,0BAbW,MAAM,YAEd;QAA0B,UAAU;QACX,YAAY;QACZ,QAAQ;QACD,UAAU;QACM,MAAM;QAE5B,iBAAiB;QAClB,OAAO;KAChC,GAAU,OAAO,CAAC,MAAM,CAAC,CAqJ3B;IA8PD;;;;;OAKG;IACH,8BAJW,MAAM,GACJ,MAAM,CA+ClB;;CACD;8BA37B6B,2BAA2B"}
\ No newline at end of file

From 9d8873904734fa72f78afeb6c7cc1b481737ad6b Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Mon, 28 Sep 2026 21:27:17 -0700
Subject: [PATCH 25/49] fix(loader): load CommonJS .js leaves through the
 per-instance CommonJS path

A .js file Node treats as CommonJS (nearest package.json "type": "commonjs",
or no type field with source that parses as CommonJS) went through import()
with a ?slothlet_instance= query. Node's CommonJS cache is keyed on the file
path alone and ignores that query, so two instances shared one module scope.

The loader now classifies .js leaves the way Node does: it walks up to the
nearest package.json (stopping at a node_modules boundary; cached per
directory), routes "commonjs" to the isolated CommonJS loader, leaves
"module" on the import() path, and for a missing type mirrors Node's syntax
detection by compiling the source as a CommonJS function body - CommonJS when
it compiles, import() otherwise so Node itself loads it as ESM or reports the
error. A malformed or non-object package.json is left to import() so Node
reports ERR_INVALID_PACKAGE_CONFIG.

The synthetic CommonJS namespace now carries a non-enumerable
"module.exports" binding so the ownership index recognises a CommonJS
namespace whose file is not named .cjs.

Fixes #521
---
 .configs/eslint.config.mjs                    |   3 +
 .../commonjs/counter/counter.js               |  17 ++
 .../api_test_cjs_js/commonjs/package.json     |   5 +
 .../api_test_cjs_js/esm/counter/counter.js    |  17 ++
 api_tests/api_test_cjs_js/esm/package.json    |   5 +
 .../untypedcjs/counter/counter.js             |  17 ++
 .../api_test_cjs_js/untypedcjs/package.json   |   4 +
 .../untypedcjs/shebang/shebang.js             |  18 ++
 .../untypedesm/counter/counter.js             |  27 ++
 .../api_test_cjs_js/untypedesm/package.json   |   4 +
 docs/API-RULES/API-DISCOVERY-CONDITIONS.md    |   2 +-
 docs/MODULE-STRUCTURE.md                      |  16 +
 docs/RELOAD.md                                |   2 +-
 src/lib/processors/loader.mjs                 | 105 ++++++-
 .../cjs/cjs-js-leaf-isolation.test.vitest.mjs | 287 ++++++++++++++++++
 types/src/lib/processors/loader.d.mts.map     |   2 +-
 16 files changed, 527 insertions(+), 4 deletions(-)
 create mode 100644 api_tests/api_test_cjs_js/commonjs/counter/counter.js
 create mode 100644 api_tests/api_test_cjs_js/commonjs/package.json
 create mode 100644 api_tests/api_test_cjs_js/esm/counter/counter.js
 create mode 100644 api_tests/api_test_cjs_js/esm/package.json
 create mode 100644 api_tests/api_test_cjs_js/untypedcjs/counter/counter.js
 create mode 100644 api_tests/api_test_cjs_js/untypedcjs/package.json
 create mode 100644 api_tests/api_test_cjs_js/untypedcjs/shebang/shebang.js
 create mode 100644 api_tests/api_test_cjs_js/untypedesm/counter/counter.js
 create mode 100644 api_tests/api_test_cjs_js/untypedesm/package.json
 create mode 100644 tests/vitests/suites/cjs/cjs-js-leaf-isolation.test.vitest.mjs

diff --git a/.configs/eslint.config.mjs b/.configs/eslint.config.mjs
index 5bf56dad1..59383541d 100644
--- a/.configs/eslint.config.mjs
+++ b/.configs/eslint.config.mjs
@@ -72,6 +72,9 @@ export default defineConfig([
 		}
 	},
 	{ files: ["**/*.js"], languageOptions: { sourceType: "commonjs" } },
+	// ESM-syntax `.js` fixtures for #521 (a "type": "module" package and a package with no type field,
+	// which Node loads as ESM by syntax detection).
+	{ files: ["api_tests/api_test_cjs_js/esm/**/*.js", "api_tests/api_test_cjs_js/untypedesm/**/*.js"], languageOptions: { sourceType: "module" } },
 	{ files: ["**/*.{js,mjs,cjs}"], languageOptions: { globals: { ...globals.node, ...globals.browser } } },
 	{
 		files: ["**/test/**/*test.js"],
diff --git a/api_tests/api_test_cjs_js/commonjs/counter/counter.js b/api_tests/api_test_cjs_js/commonjs/counter/counter.js
new file mode 100644
index 000000000..db91a5c9f
--- /dev/null
+++ b/api_tests/api_test_cjs_js/commonjs/counter/counter.js
@@ -0,0 +1,17 @@
+/**
+ * @fileoverview CommonJS `.js` leaf in a `"type": "commonjs"` package (#521). Module-scope state must be
+ * per slothlet instance, exactly as for a `.cjs` leaf.
+ * @module api_test_cjs_js.commonjs.counter
+ */
+
+let count = 0;
+
+module.exports = {
+	/**
+	 * Increment and return this module scope's counter.
+	 * @returns {number} The new count.
+	 * @example
+	 * api.commonjs.counter.next(); // 1
+	 */
+	next: () => ++count
+};
diff --git a/api_tests/api_test_cjs_js/commonjs/package.json b/api_tests/api_test_cjs_js/commonjs/package.json
new file mode 100644
index 000000000..1250a57d3
--- /dev/null
+++ b/api_tests/api_test_cjs_js/commonjs/package.json
@@ -0,0 +1,5 @@
+{
+	"name": "api-test-cjs-js-commonjs",
+	"private": true,
+	"type": "commonjs"
+}
diff --git a/api_tests/api_test_cjs_js/esm/counter/counter.js b/api_tests/api_test_cjs_js/esm/counter/counter.js
new file mode 100644
index 000000000..1bc88b7e2
--- /dev/null
+++ b/api_tests/api_test_cjs_js/esm/counter/counter.js
@@ -0,0 +1,17 @@
+/**
+ * @fileoverview ESM `.js` leaf in a `"type": "module"` package — the control case for #521: it loads
+ * through `import()` exactly as before.
+ * @module api_test_cjs_js.esm.counter
+ */
+
+let count = 0;
+
+/**
+ * Increment and return this module scope's counter.
+ * @returns {number} The new count.
+ * @example
+ * api.esm.counter.next(); // 1
+ */
+export function next() {
+	return ++count;
+}
diff --git a/api_tests/api_test_cjs_js/esm/package.json b/api_tests/api_test_cjs_js/esm/package.json
new file mode 100644
index 000000000..764a0877e
--- /dev/null
+++ b/api_tests/api_test_cjs_js/esm/package.json
@@ -0,0 +1,5 @@
+{
+	"name": "api-test-cjs-js-esm",
+	"private": true,
+	"type": "module"
+}
diff --git a/api_tests/api_test_cjs_js/untypedcjs/counter/counter.js b/api_tests/api_test_cjs_js/untypedcjs/counter/counter.js
new file mode 100644
index 000000000..d7b3a3310
--- /dev/null
+++ b/api_tests/api_test_cjs_js/untypedcjs/counter/counter.js
@@ -0,0 +1,17 @@
+/**
+ * @fileoverview CommonJS-syntax `.js` leaf in a package whose package.json has no `type` field (#521).
+ * Node loads it as CommonJS, so its module-scope state must be per slothlet instance.
+ * @module api_test_cjs_js.untypedcjs.counter
+ */
+
+let count = 0;
+
+module.exports = {
+	/**
+	 * Increment and return this module scope's counter.
+	 * @returns {number} The new count.
+	 * @example
+	 * api.untypedcjs.counter.next(); // 1
+	 */
+	next: () => ++count
+};
diff --git a/api_tests/api_test_cjs_js/untypedcjs/package.json b/api_tests/api_test_cjs_js/untypedcjs/package.json
new file mode 100644
index 000000000..b50f77914
--- /dev/null
+++ b/api_tests/api_test_cjs_js/untypedcjs/package.json
@@ -0,0 +1,4 @@
+{
+	"name": "api-test-cjs-js-untypedcjs",
+	"private": true
+}
diff --git a/api_tests/api_test_cjs_js/untypedcjs/shebang/shebang.js b/api_tests/api_test_cjs_js/untypedcjs/shebang/shebang.js
new file mode 100644
index 000000000..ad0991df2
--- /dev/null
+++ b/api_tests/api_test_cjs_js/untypedcjs/shebang/shebang.js
@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+/**
+ * @fileoverview CommonJS `.js` leaf with a leading hashbang, in a package with no `type` field (#521).
+ * Node strips the hashbang and loads the file as CommonJS.
+ * @module api_test_cjs_js.untypedcjs.shebang
+ */
+
+let count = 0;
+
+module.exports = {
+	/**
+	 * Increment and return this module scope's counter.
+	 * @returns {number} The new count.
+	 * @example
+	 * api.untypedcjs.shebang.next(); // 1
+	 */
+	next: () => ++count
+};
diff --git a/api_tests/api_test_cjs_js/untypedesm/counter/counter.js b/api_tests/api_test_cjs_js/untypedesm/counter/counter.js
new file mode 100644
index 000000000..7e40531e0
--- /dev/null
+++ b/api_tests/api_test_cjs_js/untypedesm/counter/counter.js
@@ -0,0 +1,27 @@
+/**
+ * @fileoverview ESM-syntax `.js` leaf in a package whose package.json has no `type` field (#521). Node's
+ * syntax detection loads it as an ES module, so it must keep loading through `import()`.
+ * @module api_test_cjs_js.untypedesm.counter
+ */
+
+let count = 0;
+
+/**
+ * Increment and return this module scope's counter.
+ * @returns {number} The new count.
+ * @example
+ * api.untypedesm.counter.next(); // 1
+ */
+export function next() {
+	return ++count;
+}
+
+/**
+ * Whether this module was evaluated as an ES module (`import.meta` exists only there).
+ * @returns {boolean} True under ESM.
+ * @example
+ * api.untypedesm.counter.isModule(); // true
+ */
+export function isModule() {
+	return typeof import.meta.url === "string";
+}
diff --git a/api_tests/api_test_cjs_js/untypedesm/package.json b/api_tests/api_test_cjs_js/untypedesm/package.json
new file mode 100644
index 000000000..dc95b5425
--- /dev/null
+++ b/api_tests/api_test_cjs_js/untypedesm/package.json
@@ -0,0 +1,4 @@
+{
+	"name": "api-test-cjs-js-untypedesm",
+	"private": true
+}
diff --git a/docs/API-RULES/API-DISCOVERY-CONDITIONS.md b/docs/API-RULES/API-DISCOVERY-CONDITIONS.md
index cf0e27e26..ed82c762a 100644
--- a/docs/API-RULES/API-DISCOVERY-CONDITIONS.md
+++ b/docs/API-RULES/API-DISCOVERY-CONDITIONS.md
@@ -306,7 +306,7 @@ if (stat.isDirectory()) return "npm";
 **Related Rule**: [Rule 15](../API-RULES.md#rule-15-external-module-discovery)
 **Status**: ✅ Active
 
-**Pattern**: `.cjs` (and CJS-interop) modules surface exports asymmetrically: named exports are promoted only when `module.exports` is an object; a callable/primitive CJS export yields only `default`; a Node ESM-interop double-wrap is unwrapped; a module with no default gets no `default` key at all.
+**Pattern**: CommonJS modules — `.cjs`, and `.js` files Node treats as CommonJS (nearest `package.json` `"type": "commonjs"`, or no `type` and CommonJS-parsable source) — take the per-instance CommonJS load path, and together with CJS-interop modules they surface exports asymmetrically: named exports are promoted only when `module.exports` is an object; a callable/primitive CJS export yields only `default`; a Node ESM-interop double-wrap is unwrapped; a module with no default gets no `default` key at all.
 
 **Source(s)**: `src/lib/processors/loader.mjs:154-156` (`.cjs` route) · `368-378` (named-export promotion iff object) · `807-809` (no default → no key) · `812-824` (exclude `default`/`module.exports`; reserved-name throw) · `826-844` (double-wrap unwrap heuristic)
 
diff --git a/docs/MODULE-STRUCTURE.md b/docs/MODULE-STRUCTURE.md
index ca3f48624..8e98c3b5b 100644
--- a/docs/MODULE-STRUCTURE.md
+++ b/docs/MODULE-STRUCTURE.md
@@ -317,6 +317,22 @@ api.interop.mixed.callBoth("test");
 
 > **CJS default exports**: `module.exports = { fn }` is always accessible directly as `api.module.fn` - never as `api.module.default.fn`. Slothlet normalizes the CJS `default` wrapper so CJS and ESM modules have identical access patterns.
 
+### Which files are CommonJS
+
+Slothlet decides a leaf's format the same way Node does:
+
+| File                                                        | Loaded as                                                      |
+| ----------------------------------------------------------- | -------------------------------------------------------------- |
+| `.cjs`                                                      | CommonJS                                                       |
+| `.mjs`                                                      | ES module                                                      |
+| `.js`, nearest `package.json` has `"type": "module"`        | ES module                                                      |
+| `.js`, nearest `package.json` has `"type": "commonjs"`      | CommonJS                                                       |
+| `.js`, no `type` field (or no `package.json` above it)      | CommonJS, unless it only parses as ESM (`import` / `export`, `import.meta`, top-level `await`) — then ES module, as Node's syntax detection does |
+
+The nearest `package.json` is the first one found walking up from the file (the walk stops at a `node_modules` folder), and each directory's answer is cached so a tree of leaves reads it once.
+
+Every CommonJS leaf gets its own module scope per slothlet instance, per `reload()`, and per `api.slothlet.api.add` mount — module-level state such as `let count = 0` is never shared between two instances loading the same file. Slothlet loads CommonJS leaves itself (clearing the file's `require.cache` entry around the load) rather than through `import()`, because Node's CommonJS cache is keyed on the file path alone and ignores the per-instance query slothlet adds to ESM imports. For the same reason, a configured `import` importer (see [TESTING.md](TESTING.md)) is not used for CommonJS leaves.
+
 ---
 
 ## Hybrid Export Patterns
diff --git a/docs/RELOAD.md b/docs/RELOAD.md
index bb3b9d97e..a10aac0d3 100644
--- a/docs/RELOAD.md
+++ b/docs/RELOAD.md
@@ -329,7 +329,7 @@ Runtime mutations (`api.myProp = ...`) are intentionally cleared on full reload
 
 Slothlet forces fresh module loading on every rebuild rather than serving cached imports:
 
-**CommonJS**: `require.cache` entries for the target directory are deleted before re-importing.
+**CommonJS** (`.cjs`, and `.js` files Node treats as CommonJS): `require.cache` entries for the target directory are deleted before re-importing, and each CommonJS leaf is loaded with its own `require.cache` entry cleared, so every instance and every reload gets a fresh module scope.
 
 **ESM**: A temporary instance ID suffix is appended to the cache-busted import path, causing Node's ESM loader to treat it as a new module specifier and re-execute the file.
 
diff --git a/src/lib/processors/loader.mjs b/src/lib/processors/loader.mjs
index 2b3810441..5d055e171 100644
--- a/src/lib/processors/loader.mjs
+++ b/src/lib/processors/loader.mjs
@@ -186,6 +186,22 @@ function compileHidden(globs) {
 	};
 }
 
+/**
+ * Parse JSON text, returning null when it is not valid JSON.
+ * @param {string} text - JSON text.
+ * @returns {*} The parsed value, or null.
+ * @example
+ * parseJsonOrNull('{"type":"module"}'); // { type: "module" }
+ * @private
+ */
+function parseJsonOrNull(text) {
+	try {
+		return JSON.parse(text);
+	} catch {
+		return null;
+	}
+}
+
 /**
  * Loader component for module loading, directory scanning, and API merging
  * @class Loader
@@ -245,7 +261,8 @@ export class Loader extends ComponentBase {
 
 			// CJS files must bypass the shared require() cache; query-param cache-busting
 			// has no effect on require() because it keys on the resolved file path only.
-			if (filePath.endsWith(".cjs")) {
+			// A `.js` file Node treats as CommonJS (#521) takes the same path as `.cjs`.
+			if (filePath.endsWith(".cjs") || (filePath.endsWith(".js") && (await this.#isCommonJSFile(filePath)))) {
 				return this.#loadCJSIsolated(filePath);
 			}
 
@@ -474,9 +491,95 @@ export class Loader extends ComponentBase {
 				}
 			}
 		}
+		// import() of a CommonJS file exposes a "module.exports" binding, which is how the ownership index
+		// recognises a CommonJS namespace whose file is not named `.cjs` (a CommonJS `.js`, #521). It is
+		// non-enumerable so every key walk over the namespace sees exactly the exports listed above.
+		Object.defineProperty(namespace, "module.exports", { value: exports, enumerable: false });
 		return namespace;
 	}
 
+	/**
+	 * Per-directory cache of the nearest package.json `type` scope, so a tree of `.js` leaves reads each
+	 * package.json once. Values: `"module"`, `"commonjs"`, `"none"` (no package.json / no `type`), or
+	 * `"invalid"` (unreadable or malformed package.json — left for Node's own loader to report).
+	 * @type {Map<string, string>}
+	 * @private
+	 */
+	#packageTypeCache = new Map();
+
+	/**
+	 * Resolve the `type` of the package scope a directory belongs to, the way Node does: walk up to the
+	 * nearest `package.json` (the first one found ends the walk, with or without a `type`), stopping at a
+	 * `node_modules` boundary or the filesystem root.
+	 * @param {string} dir - Absolute directory of the file being loaded.
+	 * @returns {Promise<string>} `"module"`, `"commonjs"`, `"none"`, or `"invalid"`.
+	 * @example
+	 * await this.#packageScopeType("/abs/api/counter"); // "commonjs"
+	 * @private
+	 */
+	async #packageScopeType(dir) {
+		const visited = [];
+		let current = dir;
+		let type = "none";
+		for (;;) {
+			const cached = this.#packageTypeCache.get(current);
+			if (cached !== undefined) {
+				type = cached;
+				break;
+			}
+			visited.push(current);
+			const raw = await fsp.readFile(path.join(current, "package.json"), "utf8").catch(() => null);
+			if (raw !== null) {
+				const pkg = parseJsonOrNull(raw);
+				// Node rejects a package.json that is not a JSON object (ERR_INVALID_PACKAGE_CONFIG) and
+				// ignores a `type` other than "module" / "commonjs".
+				if (pkg === null || typeof pkg !== "object" || Array.isArray(pkg)) type = "invalid";
+				else type = pkg.type === "module" || pkg.type === "commonjs" ? pkg.type : "none";
+				break;
+			}
+			const parent = path.dirname(current);
+			if (parent === current || path.basename(current) === "node_modules") break;
+			current = parent;
+		}
+		for (const d of visited) this.#packageTypeCache.set(d, type);
+		return type;
+	}
+
+	/**
+	 * Whether Node loads this `.js` file as CommonJS (#521).
+	 * @param {string} filePath - Absolute path to a `.js` file.
+	 * @returns {Promise<boolean>} True when the file is CommonJS and must take the isolated CJS path.
+	 * @example
+	 * if (await this.#isCommonJSFile("/abs/api/counter.js")) return this.#loadCJSIsolated(...);
+	 * @private
+	 *
+	 * @description
+	 * Mirrors Node's own format resolution for `.js`:
+	 * - nearest package.json `"type": "module"` → ES module;
+	 * - `"type": "commonjs"` → CommonJS, with no syntax detection (Node reports ESM syntax there as an
+	 *   error either way);
+	 * - no `type` (or no package.json) → Node's syntax detection: the source is compiled as a CommonJS
+	 *   function body, exactly as Node's CJS loader wraps it; when that compiles, Node loads the file as
+	 *   CommonJS, and when it throws (an `import`/`export` statement, `import.meta`, top-level `await`, or
+	 *   a genuine syntax error), the file is left to `import()` so Node itself decides — loading it as
+	 *   an ES module or reporting the error.
+	 * - an unreadable/malformed package.json → `import()`, which surfaces Node's own error.
+	 */
+	async #isCommonJSFile(filePath) {
+		const type = await this.#packageScopeType(path.dirname(filePath));
+		if (type === "commonjs") return true;
+		if (type !== "none") return false;
+		const { compileFunction } = await import("node:vm");
+		// A leading hashbang is valid in a CommonJS file (Node strips it) but not in a function body.
+		const source = (await fsp.readFile(filePath, "utf8")).replace(/^#!.*/, "");
+		try {
+			compileFunction(source, ["exports", "require", "module", "__filename", "__dirname"], { filename: filePath });
+			return true;
+		} catch {
+			return false;
+		}
+	}
+
 	/**
 	 * Persist transformed TS code to a project-local cache file and build the
 	 * file URL with the same `?slothlet_instance=…&module=…&_reload=…` suffix
diff --git a/tests/vitests/suites/cjs/cjs-js-leaf-isolation.test.vitest.mjs b/tests/vitests/suites/cjs/cjs-js-leaf-isolation.test.vitest.mjs
new file mode 100644
index 000000000..5ec478560
--- /dev/null
+++ b/tests/vitests/suites/cjs/cjs-js-leaf-isolation.test.vitest.mjs
@@ -0,0 +1,287 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/cjs/cjs-js-leaf-isolation.test.vitest.mjs
+ *	@Date: 2026-09-28 20:31:41 -07:00 (1790652701)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 20:56:44 -07:00 (1790654204)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview A `.js` leaf that Node treats as CommonJS is loaded per instance, like a `.cjs` leaf (#521).
+ *
+ * @description
+ * Node decides a `.js` file's format from the nearest package.json: `"type": "module"` → ES module,
+ * `"type": "commonjs"` → CommonJS, and no `type` → syntax detection (CommonJS unless the source only
+ * parses as an ES module). Before #521 only `.cjs` took the loader's per-instance CommonJS path; a
+ * CommonJS `.js` went through `import()` with a `?slothlet_instance=` query, which Node's CommonJS
+ * cache ignores — so two instances shared one module scope.
+ *
+ * Fixture `api_tests/api_test_cjs_js/` holds one package per case, each with a `counter` leaf whose
+ * `next()` increments a module-scope counter:
+ * - `commonjs/`   — `"type": "commonjs"`, CommonJS `.js`
+ * - `untypedcjs/` — no `type`, CommonJS `.js` (plus a hashbang leaf, `shebang/`)
+ * - `untypedesm/` — no `type`, ESM-syntax `.js` (Node's syntax detection loads it as ESM)
+ * - `esm/`        — `"type": "module"`, ESM `.js` (control)
+ *
+ * Every case must give each instance, each reload, and each `api.slothlet.api.add` mount its own
+ * module scope. The test runner's module runner evaluates each distinct `import()` URL afresh, which
+ * masks the bug for files it inlines, so the regression check proper runs slothlet in a child Node
+ * process (the "native Node" block).
+ */
+
+import { describe, it, expect, afterEach } from "vitest";
+import fsp from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { pathToFileURL } from "node:url";
+import slothlet from "@cldmv/slothlet";
+import { API_TEST_BASE } from "../../setup/vitest-helper.mjs";
+import { makeTestTmpDir } from "../../setup/test-fixtures-tmp.mjs";
+
+const REPO_ROOT = path.resolve(import.meta.dirname, "../../../..");
+const FIXTURE = path.join(REPO_ROOT, API_TEST_BASE, "api_test_cjs_js");
+
+/** Each case: the api key of the package and the leaf holding `next()`. */
+const CASES = [
+	{ label: '"type": "commonjs" + CommonJS .js', pkg: "commonjs", leaf: "counter" },
+	{ label: "no type + CommonJS .js", pkg: "untypedcjs", leaf: "counter" },
+	{ label: "no type + CommonJS .js with a hashbang", pkg: "untypedcjs", leaf: "shebang" },
+	{ label: "no type + ESM-syntax .js", pkg: "untypedesm", leaf: "counter" },
+	{ label: '"type": "module" + ESM .js (control)', pkg: "esm", leaf: "counter" }
+];
+
+const MODES = ["eager", "lazy"];
+
+describe("CommonJS .js leaves load per instance (#521)", () => {
+	const instances = [];
+	const tmpDirs = [];
+
+	/**
+	 * Create a tracked slothlet instance.
+	 * @param {object} config - slothlet config.
+	 * @returns {Promise<object>} The api.
+	 */
+	const make = async (config) => {
+		const api = await slothlet({ silent: true, ...config });
+		instances.push(api);
+		return api;
+	};
+
+	afterEach(async () => {
+		while (instances.length) await instances.pop().shutdown();
+		while (tmpDirs.length) await fsp.rm(tmpDirs.pop(), { recursive: true, force: true });
+	});
+
+	for (const mode of MODES) {
+		describe(`${mode} mode`, () => {
+			for (const { label, pkg, leaf } of CASES) {
+				it(`${label}: two instances do not share module scope`, async () => {
+					const a = await make({ base: FIXTURE, mode });
+					const b = await make({ base: FIXTURE, mode });
+
+					expect(await a[pkg][leaf].next()).toBe(1);
+					expect(await a[pkg][leaf].next()).toBe(2);
+					expect(await b[pkg][leaf].next()).toBe(1);
+					expect(await a[pkg][leaf].next()).toBe(3);
+				});
+
+				it(`${label}: reload gives a fresh scope without touching the other instance`, async () => {
+					const a = await make({ base: FIXTURE, mode });
+					const b = await make({ base: FIXTURE, mode });
+
+					await a[pkg][leaf].next();
+					await a[pkg][leaf].next();
+					expect(await b[pkg][leaf].next()).toBe(1);
+
+					await a.slothlet.reload();
+					expect(await a[pkg][leaf].next()).toBe(1);
+					expect(await b[pkg][leaf].next()).toBe(2);
+				});
+
+				it(`${label}: an api.slothlet.api.add mount gets its own scope`, async () => {
+					const a = await make({ base: FIXTURE, mode });
+
+					expect(await a[pkg][leaf].next()).toBe(1);
+					await a.slothlet.api.add("mounted", path.join(FIXTURE, pkg));
+					expect(await a.mounted[leaf].next()).toBe(1);
+					expect(await a[pkg][leaf].next()).toBe(2);
+					expect(await a.mounted[leaf].next()).toBe(2);
+				});
+			}
+
+			it("no type + ESM-syntax .js is still evaluated as an ES module", async () => {
+				const a = await make({ base: FIXTURE, mode });
+				expect(await a.untypedesm.counter.isModule()).toBe(true);
+			});
+		});
+	}
+
+	/**
+	 * Write a package with one CommonJS `.js` counter leaf.
+	 * @param {string} dir - Package directory.
+	 * @param {string|null} pkgJson - package.json text, or null for none.
+	 * @returns {Promise<void>}
+	 */
+	const writeCounterPackage = async (dir, pkgJson) => {
+		await fsp.mkdir(path.join(dir, "counter"), { recursive: true });
+		if (pkgJson !== null) await fsp.writeFile(path.join(dir, "package.json"), pkgJson);
+		await fsp.writeFile(path.join(dir, "counter", "counter.js"), "let count = 0;\nmodule.exports = { next: () => ++count };\n");
+	};
+
+	it("a .js under a node_modules boundary with no package.json below it is CommonJS", async () => {
+		// Node's package-scope lookup stops at a node_modules segment, so the repo's own
+		// "type": "module" package.json above it does not apply.
+		const root = await makeTestTmpDir("cjs-js-node-modules");
+		tmpDirs.push(root);
+		const base = path.join(root, "node_modules");
+		await writeCounterPackage(base, null);
+
+		const a = await make({ base, mode: "eager" });
+		const b = await make({ base, mode: "eager" });
+		expect(a.counter.next()).toBe(1);
+		expect(a.counter.next()).toBe(2);
+		expect(b.counter.next()).toBe(1);
+	});
+
+	it("a .js with no package.json anywhere above it is CommonJS", async () => {
+		// Needs a location with no package.json up to the filesystem root, which rules out the repo's
+		// tmp/ (the repo root has one), so this uses the system temp directory and removes it after.
+		const root = await fsp.mkdtemp(path.join(os.tmpdir(), "slothlet-cjs-js-"));
+		tmpDirs.push(root);
+		await writeCounterPackage(root, null);
+
+		const a = await make({ base: root, mode: "eager" });
+		const b = await make({ base: root, mode: "eager" });
+		expect(a.counter.next()).toBe(1);
+		expect(a.counter.next()).toBe(2);
+		expect(b.counter.next()).toBe(1);
+	});
+
+	it("a malformed package.json is left to the module loader to report", async () => {
+		const root = await makeTestTmpDir("cjs-js-bad-pkg");
+		tmpDirs.push(root);
+		await writeCounterPackage(root, "{ not json");
+
+		await expect(make({ base: root, mode: "eager" })).rejects.toThrow();
+	});
+
+	it("an unrecognised package.json type is ignored, as Node ignores it", async () => {
+		const root = await makeTestTmpDir("cjs-js-odd-type");
+		tmpDirs.push(root);
+		await writeCounterPackage(root, '{ "type": "script" }\n');
+
+		const a = await make({ base: root, mode: "eager" });
+		expect(a.counter.next()).toBe(1);
+	});
+});
+
+/**
+ * The suites above run inside the test runner, whose own module runner evaluates every distinct
+ * `import()` URL afresh — which hides the bug for files it inlines. Native Node keys its CommonJS cache
+ * on the file path alone, so the real regression check runs slothlet in a plain child Node process.
+ */
+describe("CommonJS .js leaves load per instance under native Node (#521)", () => {
+	let root;
+
+	afterEach(async () => {
+		if (root) await fsp.rm(root, { recursive: true, force: true });
+		root = undefined;
+	});
+
+	/**
+	 * Run the two-instance / reload / mount scenario for every case in a child Node process.
+	 * @param {string} mode - `"eager"` or `"lazy"`.
+	 * @returns {Promise<object>} Per-package results.
+	 */
+	const runNative = async (mode) => {
+		root = await makeTestTmpDir(`cjs-js-native-${mode}`);
+		const script = [
+			`import slothlet from ${JSON.stringify(pathToFileURL(path.join(REPO_ROOT, "index.mjs")).href)};`,
+			`const base = ${JSON.stringify(FIXTURE)};`,
+			`const cases = ${JSON.stringify(CASES.map(({ pkg, leaf }) => ({ pkg, leaf })))};`,
+			`const a = await slothlet({ base, mode: ${JSON.stringify(mode)}, silent: true });`,
+			`const b = await slothlet({ base, mode: ${JSON.stringify(mode)}, silent: true });`,
+			`const out = {};`,
+			`for (const { pkg, leaf } of cases) {`,
+			`	const r = (out[pkg + "." + leaf] = {});`,
+			`	r.a = [await a[pkg][leaf].next(), await a[pkg][leaf].next()];`,
+			`	r.b = [await b[pkg][leaf].next()];`,
+			`}`,
+			`await a.slothlet.reload();`,
+			`for (const { pkg, leaf } of cases) {`,
+			`	const r = out[pkg + "." + leaf];`,
+			`	r.aAfterReload = await a[pkg][leaf].next();`,
+			`	r.bAfterReload = await b[pkg][leaf].next();`,
+			`}`,
+			`for (const { pkg } of cases) await b.slothlet.api.add("mounted_" + pkg, base + "/" + pkg);`,
+			`for (const { pkg, leaf } of cases) {`,
+			`	const r = out[pkg + "." + leaf];`,
+			`	r.mounted = await b["mounted_" + pkg][leaf].next();`,
+			`	r.bAfterMount = await b[pkg][leaf].next();`,
+			`}`,
+			`out.untypedesmIsModule = await a.untypedesm.counter.isModule();`,
+			`await a.shutdown();`,
+			`await b.shutdown();`,
+			`process.stdout.write(JSON.stringify(out));`
+		].join("\n");
+		const scriptPath = path.join(root, "child.mjs");
+		await fsp.writeFile(scriptPath, script, "utf8");
+		const result = spawnSync(process.execPath, [scriptPath], { cwd: REPO_ROOT, env: process.env, encoding: "utf8", timeout: 90000 });
+		expect(result.status, result.stderr).toBe(0);
+		return JSON.parse(result.stdout);
+	};
+
+	for (const mode of MODES) {
+		it(`${mode} mode: every case gets its own module scope per instance, reload and mount`, async () => {
+			const out = await runNative(mode);
+			for (const { label, pkg, leaf } of CASES) {
+				expect(out[`${pkg}.${leaf}`], label).toEqual({
+					a: [1, 2],
+					b: [1],
+					aAfterReload: 1,
+					bAfterReload: 2,
+					mounted: 1,
+					bAfterMount: 3
+				});
+			}
+			expect(out.untypedesmIsModule).toBe(true);
+		}, 90000);
+	}
+
+	for (const [label, pkgJson] of [
+		["malformed JSON", "{ not json"],
+		["valid JSON that is not an object", "null\n"],
+		["a JSON array", "[]\n"]
+	]) {
+		it(`a package.json holding ${label} is reported by Node's own loader`, async () => {
+			root = await makeTestTmpDir("cjs-js-native-bad-pkg");
+			const base = path.join(root, "api");
+			await fsp.mkdir(base);
+			await fsp.writeFile(path.join(base, "package.json"), pkgJson);
+			await fsp.writeFile(path.join(base, "leaf.js"), "module.exports = { ok: () => true };\n");
+			const script = [
+				`import slothlet from ${JSON.stringify(pathToFileURL(path.join(REPO_ROOT, "index.mjs")).href)};`,
+				`try {`,
+				`	const api = await slothlet({ base: ${JSON.stringify(base)}, mode: "eager", silent: true });`,
+				`	await api.shutdown();`,
+				`	process.stdout.write("loaded");`,
+				`} catch (error) {`,
+				`	let e = error;`,
+				`	while (e?.cause && !e.code?.startsWith("ERR_")) e = e.cause;`,
+				`	process.stdout.write(String(e?.code));`,
+				`}`
+			].join("\n");
+			const scriptPath = path.join(root, "child.mjs");
+			await fsp.writeFile(scriptPath, script, "utf8");
+			const result = spawnSync(process.execPath, [scriptPath], { cwd: REPO_ROOT, env: process.env, encoding: "utf8", timeout: 90000 });
+			expect(result.status, result.stderr).toBe(0);
+			expect(result.stdout).toBe("ERR_INVALID_PACKAGE_CONFIG");
+		}, 90000);
+	}
+});
diff --git a/types/src/lib/processors/loader.d.mts.map b/types/src/lib/processors/loader.d.mts.map
index a0d24c883..896341303 100644
--- a/types/src/lib/processors/loader.d.mts.map
+++ b/types/src/lib/processors/loader.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"loader.d.mts","sourceRoot":"","sources":["../../../../src/lib/processors/loader.mjs"],"names":[],"mappings":"AA4DA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,sDAjBW,MAAM,6BAEd;IAAqC,MAAM,GAAnC,MAAM,GAAC,SAAS;IACI,YAAY;CAExC,GAAU,OAAO,CAmBnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,gDAZG;IAAqC,MAAM,GAAnC,MAAM,GAAC,SAAS;IACG,GAAG;CAC9B,GAAU,OAAO,CAanB;AAED;;;;;;;;;;;;GAYG;AACH,mDAVW,MAAM,cACN,MAAM,GACJ,OAAO,CAYnB;AAED;;;;;;;;;;;;GAYG;AACH,uDAVW,MAAM,cACN,MAAM,GACJ,OAAO,CAcnB;AAwCD;;;;;GAKG;AACH;;;;;;;;;;GAUG;AACH,4CALa,MAAM,CAOlB;AAED;IACC,gCAAmC;IASnC;;;;OAIG;IACH,sBAHW,MAAM,EAKhB;IAED;;;;;;;;OAQG;IACH,4BAPW,MAAM,eACN,MAAM,aACN,MAAM,cACN,MAAM,GAAC,IAAI,GACT,OAAO,CAAC,MAAM,CAAC,CA8M3B;IAyED;;;;;;;;;;;;;;OAcG;IACH,0BAbW,MAAM,YAEd;QAA0B,UAAU;QACX,YAAY;QACZ,QAAQ;QACD,UAAU;QACM,MAAM;QAE5B,iBAAiB;QAClB,OAAO;KAChC,GAAU,OAAO,CAAC,MAAM,CAAC,CAqJ3B;IA8PD;;;;;OAKG;IACH,8BAJW,MAAM,GACJ,MAAM,CA+ClB;;CACD;8BA37B6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"loader.d.mts","sourceRoot":"","sources":["../../../../src/lib/processors/loader.mjs"],"names":[],"mappings":"AA4DA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,sDAjBW,MAAM,6BAEd;IAAqC,MAAM,GAAnC,MAAM,GAAC,SAAS;IACI,YAAY;CAExC,GAAU,OAAO,CAmBnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,gDAZG;IAAqC,MAAM,GAAnC,MAAM,GAAC,SAAS;IACG,GAAG;CAC9B,GAAU,OAAO,CAanB;AAED;;;;;;;;;;;;GAYG;AACH,mDAVW,MAAM,cACN,MAAM,GACJ,OAAO,CAYnB;AAED;;;;;;;;;;;;GAYG;AACH,uDAVW,MAAM,cACN,MAAM,GACJ,OAAO,CAcnB;AAwDD;;;;;GAKG;AACH;;;;;;;;;;GAUG;AACH,4CALa,MAAM,CAOlB;AAED;IACC,gCAAmC;IASnC;;;;OAIG;IACH,sBAHW,MAAM,EAKhB;IAED;;;;;;;;OAQG;IACH,4BAPW,MAAM,eACN,MAAM,aACN,MAAM,cACN,MAAM,GAAC,IAAI,GACT,OAAO,CAAC,MAAM,CAAC,CA+M3B;IA+JD;;;;;;;;;;;;;;OAcG;IACH,0BAbW,MAAM,YAEd;QAA0B,UAAU;QACX,YAAY;QACZ,QAAQ;QACD,UAAU;QACM,MAAM;QAE5B,iBAAiB;QAClB,OAAO;KAChC,GAAU,OAAO,CAAC,MAAM,CAAC,CAqJ3B;IA8PD;;;;;OAKG;IACH,8BAJW,MAAM,GACJ,MAAM,CA+ClB;;CACD;8BAliC6B,2BAA2B"}
\ No newline at end of file

From 79c93ab4378ddd3a259c708a4c8e28865af7efdd Mon Sep 17 00:00:00 2001
From: cldmv-bot <230939188+cldmv-bot@users.noreply.github.com>
Date: Tue, 29 Sep 2026 05:33:45 +0000
Subject: [PATCH 26/49] style: apply automated lint/format fixes

---
 .configs/eslint.config.mjs |  5 ++++-
 docs/MODULE-STRUCTURE.md   | 14 +++++++-------
 2 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/.configs/eslint.config.mjs b/.configs/eslint.config.mjs
index 59383541d..518cb18ef 100644
--- a/.configs/eslint.config.mjs
+++ b/.configs/eslint.config.mjs
@@ -74,7 +74,10 @@ export default defineConfig([
 	{ files: ["**/*.js"], languageOptions: { sourceType: "commonjs" } },
 	// ESM-syntax `.js` fixtures for #521 (a "type": "module" package and a package with no type field,
 	// which Node loads as ESM by syntax detection).
-	{ files: ["api_tests/api_test_cjs_js/esm/**/*.js", "api_tests/api_test_cjs_js/untypedesm/**/*.js"], languageOptions: { sourceType: "module" } },
+	{
+		files: ["api_tests/api_test_cjs_js/esm/**/*.js", "api_tests/api_test_cjs_js/untypedesm/**/*.js"],
+		languageOptions: { sourceType: "module" }
+	},
 	{ files: ["**/*.{js,mjs,cjs}"], languageOptions: { globals: { ...globals.node, ...globals.browser } } },
 	{
 		files: ["**/test/**/*test.js"],
diff --git a/docs/MODULE-STRUCTURE.md b/docs/MODULE-STRUCTURE.md
index 8e98c3b5b..5c196c85b 100644
--- a/docs/MODULE-STRUCTURE.md
+++ b/docs/MODULE-STRUCTURE.md
@@ -321,13 +321,13 @@ api.interop.mixed.callBoth("test");
 
 Slothlet decides a leaf's format the same way Node does:
 
-| File                                                        | Loaded as                                                      |
-| ----------------------------------------------------------- | -------------------------------------------------------------- |
-| `.cjs`                                                      | CommonJS                                                       |
-| `.mjs`                                                      | ES module                                                      |
-| `.js`, nearest `package.json` has `"type": "module"`        | ES module                                                      |
-| `.js`, nearest `package.json` has `"type": "commonjs"`      | CommonJS                                                       |
-| `.js`, no `type` field (or no `package.json` above it)      | CommonJS, unless it only parses as ESM (`import` / `export`, `import.meta`, top-level `await`) — then ES module, as Node's syntax detection does |
+| File                                                   | Loaded as                                                                                                                                        |
+| ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `.cjs`                                                 | CommonJS                                                                                                                                         |
+| `.mjs`                                                 | ES module                                                                                                                                        |
+| `.js`, nearest `package.json` has `"type": "module"`   | ES module                                                                                                                                        |
+| `.js`, nearest `package.json` has `"type": "commonjs"` | CommonJS                                                                                                                                         |
+| `.js`, no `type` field (or no `package.json` above it) | CommonJS, unless it only parses as ESM (`import` / `export`, `import.meta`, top-level `await`) — then ES module, as Node's syntax detection does |
 
 The nearest `package.json` is the first one found walking up from the file (the walk stops at a `node_modules` folder), and each directory's answer is cached so a tree of leaves reads it once.
 

From d5e9fe1c0e9d55110493f86b9fb3b7d74ef28ac0 Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Mon, 28 Sep 2026 22:07:44 -0700
Subject: [PATCH 27/49] fix(typescript): guard strict mode against TypeScript
 7's compiler-API-less package

TypeScript 7's current npm release resolves only { default, "module.exports",
version, versionMajorMinor } via `await import("typescript")` - its compiler
API lives under unstable/ paths pending a stable surface promised for 7.1.
Strict mode called ts.ScriptTarget.ES3 unconditionally and crashed with
"Cannot read properties of undefined (reading 'ES3')" instead of a clear error.

getTypeScript() now checks for createProgram/ScriptTarget (handling both the
namespace and .default shapes) after import succeeds, and throws a new
TYPESCRIPT_STRICT_REQUIRES_TS6 SlothletError naming the installed version and
hinting to install typescript@6, before any strict-mode code touches the
missing API. loader.mjs's separate diagnostic-formatting import is routed
through the same guarded, memoized function instead of a second raw import.

The typescript peer range (^6.0.3 || ^7.0.0) is unchanged - narrowing it would
break npm install for every TS-7 repo not using strict mode. Fast mode
(esbuild) and `slothlet typegen` never touch the compiler API and are
unaffected on TypeScript 7.

Fixes #510
---
 docs/TYPESCRIPT.md                            |  12 ++
 src/lib/i18n/languages/de-de.json             |   2 +
 src/lib/i18n/languages/en-gb.json             |   2 +
 src/lib/i18n/languages/en-us.json             |   2 +
 src/lib/i18n/languages/es-es.json             |   2 +
 src/lib/i18n/languages/es-mx.json             |   2 +
 src/lib/i18n/languages/fr-fr.json             |   2 +
 src/lib/i18n/languages/hi-in.json             |   2 +
 src/lib/i18n/languages/ja-jp.json             |   2 +
 src/lib/i18n/languages/ko-kr.json             |   2 +
 src/lib/i18n/languages/pt-br.json             |   2 +
 src/lib/i18n/languages/ru-ru.json             |   2 +
 src/lib/i18n/languages/zh-cn.json             |   2 +
 src/lib/processors/loader.mjs                 |  10 +-
 src/lib/processors/typescript.mjs             |  46 +++++-
 .../typescript-strict-ts7.test.vitest.mjs     | 156 ++++++++++++++++++
 tools/ci/i18n-latin-tokens-accepted.json      |   3 +-
 types/src/lib/processors/loader.d.mts.map     |   2 +-
 types/src/lib/processors/typescript.d.mts     |  16 ++
 types/src/lib/processors/typescript.d.mts.map |   2 +-
 20 files changed, 259 insertions(+), 12 deletions(-)
 create mode 100644 tests/vitests/suites/typescript/typescript-strict-ts7.test.vitest.mjs

diff --git a/docs/TYPESCRIPT.md b/docs/TYPESCRIPT.md
index 2685d20c9..c49d5f571 100644
--- a/docs/TYPESCRIPT.md
+++ b/docs/TYPESCRIPT.md
@@ -76,6 +76,8 @@ npm install typescript
 
 `typescript ^6.0.3 || ^7.0.0` is required. It is an optional peer dependency - Slothlet will throw a clear error at load time if you enable strict mode without it installed.
 
+> **TypeScript 7.** The peer range accepts `typescript@7`, but TypeScript 7's current npm release exposes no compiler API at all (it lives under unstable `unstable/` import paths pending a stable surface promised for version 7.1) - only version metadata. **Strict mode needs the TypeScript 6 compiler API and will throw `TYPESCRIPT_STRICT_REQUIRES_TS6` on TypeScript 7 until 7.1 ships one.** Fast mode (esbuild) and `slothlet typegen` do not use the compiler API and work fine on TypeScript 7 today. If you need strict mode now, install `typescript@6`.
+
 ### Both Modes
 
 ```bash
@@ -236,6 +238,8 @@ const api = await slothlet({
 
 **Peer dependency required:** `typescript ^6.0.3 || ^7.0.0`
 
+> **TypeScript 7 note:** strict mode needs the TypeScript 6 compiler API, which TypeScript 7's current npm release does not expose yet (a stable API is promised for 7.1). Installing `typescript@7` and enabling strict mode throws `TYPESCRIPT_STRICT_REQUIRES_TS6`; install `typescript@6` for strict mode in the meantime. Fast mode and `slothlet typegen` are unaffected and work with TypeScript 7.
+
 Strict mode is slower than fast mode due to full compilation. It is well-suited for production validation, CI checks, or anywhere you want to catch type errors at startup.
 
 How strict the check is can be tuned with [`strict`](#strict), [`module`](#module), and [`compilerOptions`](#compileroptions):
@@ -474,6 +478,14 @@ TypeScript strict mode requires 'typescript' to be installed.
 Hint: Install it with: npm install typescript
 ```
 
+If TypeScript **is** installed but does not expose the compiler API strict mode needs - true of TypeScript 7's current npm release, see the [TypeScript 7 note](#strict-mode) above:
+
+```text
+[TYPESCRIPT_STRICT_REQUIRES_TS6] SlothletError
+TypeScript strict mode requires the TypeScript 6 compiler API; the installed 'typescript' package (version 7.0.0) does not expose it. TypeScript 7 will not expose a stable compiler API until version 7.1.
+Hint: Install typescript@6 for strict mode: npm install typescript@6. Fast mode (esbuild) and 'slothlet typegen' work fine with TypeScript 7.
+```
+
 ### Type errors in strict mode
 
 When strict mode catches type errors in your source files, `slothlet()` throws with the full TypeScript diagnostic output:
diff --git a/src/lib/i18n/languages/de-de.json b/src/lib/i18n/languages/de-de.json
index e9fc54f75..d9f870492 100644
--- a/src/lib/i18n/languages/de-de.json
+++ b/src/lib/i18n/languages/de-de.json
@@ -350,6 +350,8 @@
 		"HINT_TYPESCRIPT_ESBUILD_NOT_INSTALLED": "Installieren Sie es mit: npm install esbuild",
 		"TYPESCRIPT_TSC_NOT_INSTALLED": "Der TypeScript {mode} Modus erfordert die Installation von 'typescript'.",
 		"HINT_TYPESCRIPT_TSC_NOT_INSTALLED": "Installieren Sie es mit: npm install typescript",
+		"TYPESCRIPT_STRICT_REQUIRES_TS6": "Der TypeScript Strict-Modus erfordert die TypeScript-6-Compiler-API; das installierte 'typescript'-Paket (Version {version}) stellt sie nicht bereit. TypeScript 7 bietet erst ab Version 7.1 eine stabile Compiler-API.",
+		"HINT_TYPESCRIPT_STRICT_REQUIRES_TS6": "Installieren Sie typescript@6 für den Strict-Modus: npm install typescript@6. Der Fast-Modus (esbuild) und 'slothlet typegen' funktionieren mit TypeScript 7.",
 		"TS_STRICT_REQUIRES_OUTPUT": "Der TypeScript Strict-Modus erfordert die Konfiguration von 'types.output' in Ihrer TypeScript-Konfiguration.",
 		"HINT_TS_STRICT_REQUIRES_OUTPUT": "Fügen Sie 'types: { output: './types/api.d.ts', interfaceName: 'MeineAPI' }' zu Ihrer TypeScript-Konfiguration hinzu.",
 		"TS_STRICT_REQUIRES_INTERFACE_NAME": "Der TypeScript Strict-Modus erfordert die Konfiguration von 'types.interfaceName' in Ihrer TypeScript-Konfiguration.",
diff --git a/src/lib/i18n/languages/en-gb.json b/src/lib/i18n/languages/en-gb.json
index ad30dfc37..c2dee7193 100644
--- a/src/lib/i18n/languages/en-gb.json
+++ b/src/lib/i18n/languages/en-gb.json
@@ -350,6 +350,8 @@
 		"HINT_TYPESCRIPT_ESBUILD_NOT_INSTALLED": "Install it with: npm install esbuild",
 		"TYPESCRIPT_TSC_NOT_INSTALLED": "TypeScript {mode} mode requires 'typescript' to be installed.",
 		"HINT_TYPESCRIPT_TSC_NOT_INSTALLED": "Install it with: npm install typescript",
+		"TYPESCRIPT_STRICT_REQUIRES_TS6": "TypeScript strict mode requires the TypeScript 6 compiler API; the installed 'typescript' package (version {version}) does not expose it. TypeScript 7 will not expose a stable compiler API until version 7.1.",
+		"HINT_TYPESCRIPT_STRICT_REQUIRES_TS6": "Install typescript@6 for strict mode: npm install typescript@6. Fast mode (esbuild) and 'slothlet typegen' work fine with TypeScript 7.",
 		"TS_STRICT_REQUIRES_OUTPUT": "TypeScript strict mode requires 'types.output' to be configured in your typescript config.",
 		"HINT_TS_STRICT_REQUIRES_OUTPUT": "Add 'types: { output: './types/api.d.ts', interfaceName: 'MyAPI' }' to your typescript configuration.",
 		"TS_STRICT_REQUIRES_INTERFACE_NAME": "TypeScript strict mode requires 'types.interfaceName' to be configured in your typescript config.",
diff --git a/src/lib/i18n/languages/en-us.json b/src/lib/i18n/languages/en-us.json
index 0bf562390..e206d00dd 100644
--- a/src/lib/i18n/languages/en-us.json
+++ b/src/lib/i18n/languages/en-us.json
@@ -350,6 +350,8 @@
 		"HINT_TYPESCRIPT_ESBUILD_NOT_INSTALLED": "Install it with: npm install esbuild",
 		"TYPESCRIPT_TSC_NOT_INSTALLED": "TypeScript {mode} mode requires 'typescript' to be installed.",
 		"HINT_TYPESCRIPT_TSC_NOT_INSTALLED": "Install it with: npm install typescript",
+		"TYPESCRIPT_STRICT_REQUIRES_TS6": "TypeScript strict mode requires the TypeScript 6 compiler API; the installed 'typescript' package (version {version}) does not expose it. TypeScript 7 will not expose a stable compiler API until version 7.1.",
+		"HINT_TYPESCRIPT_STRICT_REQUIRES_TS6": "Install typescript@6 for strict mode: npm install typescript@6. Fast mode (esbuild) and 'slothlet typegen' work fine with TypeScript 7.",
 		"TS_STRICT_REQUIRES_OUTPUT": "TypeScript strict mode requires 'types.output' to be configured in your typescript config.",
 		"HINT_TS_STRICT_REQUIRES_OUTPUT": "Add 'types: { output: './types/api.d.ts', interfaceName: 'MyAPI' }' to your typescript configuration.",
 		"TS_STRICT_REQUIRES_INTERFACE_NAME": "TypeScript strict mode requires 'types.interfaceName' to be configured in your typescript config.",
diff --git a/src/lib/i18n/languages/es-es.json b/src/lib/i18n/languages/es-es.json
index 0f9052475..cc2d3a722 100644
--- a/src/lib/i18n/languages/es-es.json
+++ b/src/lib/i18n/languages/es-es.json
@@ -350,6 +350,8 @@
 		"HINT_TYPESCRIPT_ESBUILD_NOT_INSTALLED": "Instálalo con: npm install esbuild",
 		"TYPESCRIPT_TSC_NOT_INSTALLED": "El modo TypeScript {mode} requiere que 'typescript' esté instalado.",
 		"HINT_TYPESCRIPT_TSC_NOT_INSTALLED": "Instálalo con: npm install typescript",
+		"TYPESCRIPT_STRICT_REQUIRES_TS6": "El modo estricto de TypeScript requiere la API del compilador de TypeScript 6; el paquete 'typescript' instalado (versión {version}) no la expone. TypeScript 7 no ofrecerá una API de compilador estable hasta la versión 7.1.",
+		"HINT_TYPESCRIPT_STRICT_REQUIRES_TS6": "Instala typescript@6 para el modo estricto: npm install typescript@6. El modo rápido (esbuild) y 'slothlet typegen' funcionan con TypeScript 7.",
 		"TS_STRICT_REQUIRES_OUTPUT": "El modo estricto de TypeScript requiere que 'types.output' esté configurado en tu configuración de typescript.",
 		"HINT_TS_STRICT_REQUIRES_OUTPUT": "Añade 'types: { output: './types/api.d.ts', interfaceName: 'MyAPI' }' a tu configuración de typescript.",
 		"TS_STRICT_REQUIRES_INTERFACE_NAME": "El modo estricto de TypeScript requiere que 'types.interfaceName' esté configurado en tu configuración de typescript.",
diff --git a/src/lib/i18n/languages/es-mx.json b/src/lib/i18n/languages/es-mx.json
index 702c03c8c..cdc5d4a6f 100644
--- a/src/lib/i18n/languages/es-mx.json
+++ b/src/lib/i18n/languages/es-mx.json
@@ -350,6 +350,8 @@
 		"HINT_TYPESCRIPT_ESBUILD_NOT_INSTALLED": "Instálelo con: npm install esbuild",
 		"TYPESCRIPT_TSC_NOT_INSTALLED": "El modo TypeScript {mode} requiere que 'typescript' esté instalado.",
 		"HINT_TYPESCRIPT_TSC_NOT_INSTALLED": "Instálelo con: npm install typescript",
+		"TYPESCRIPT_STRICT_REQUIRES_TS6": "El modo estricto de TypeScript requiere la API del compilador de TypeScript 6; el paquete 'typescript' instalado (versión {version}) no la expone. TypeScript 7 no ofrecerá una API de compilador estable hasta la versión 7.1.",
+		"HINT_TYPESCRIPT_STRICT_REQUIRES_TS6": "Instale typescript@6 para el modo estricto: npm install typescript@6. El modo rápido (esbuild) y 'slothlet typegen' funcionan con TypeScript 7.",
 		"TS_STRICT_REQUIRES_OUTPUT": "El modo estricto de TypeScript requiere que 'types.output' esté configurado en su configuración de typescript.",
 		"HINT_TS_STRICT_REQUIRES_OUTPUT": "Añada 'types: { output: './types/api.d.ts', interfaceName: 'MyAPI' }' a su configuración de typescript.",
 		"TS_STRICT_REQUIRES_INTERFACE_NAME": "El modo estricto de TypeScript requiere que 'types.interfaceName' esté configurado en su configuración de typescript.",
diff --git a/src/lib/i18n/languages/fr-fr.json b/src/lib/i18n/languages/fr-fr.json
index 3d707df11..772de4b26 100644
--- a/src/lib/i18n/languages/fr-fr.json
+++ b/src/lib/i18n/languages/fr-fr.json
@@ -350,6 +350,8 @@
 		"HINT_TYPESCRIPT_ESBUILD_NOT_INSTALLED": "Installez-le avec : npm install esbuild",
 		"TYPESCRIPT_TSC_NOT_INSTALLED": "Le mode TypeScript {mode} nécessite l'installation de 'typescript'.",
 		"HINT_TYPESCRIPT_TSC_NOT_INSTALLED": "Installez-le avec : npm install typescript",
+		"TYPESCRIPT_STRICT_REQUIRES_TS6": "Le mode strict de TypeScript nécessite l'API du compilateur TypeScript 6 ; le paquet 'typescript' installé (version {version}) ne l'expose pas. TypeScript 7 n'exposera une API de compilateur stable qu'à partir de la version 7.1.",
+		"HINT_TYPESCRIPT_STRICT_REQUIRES_TS6": "Installez typescript@6 pour le mode strict : npm install typescript@6. Le mode rapide (esbuild) et 'slothlet typegen' fonctionnent avec TypeScript 7.",
 		"TS_STRICT_REQUIRES_OUTPUT": "Le mode strict de TypeScript nécessite la configuration de 'types.output' dans votre configuration typescript.",
 		"HINT_TS_STRICT_REQUIRES_OUTPUT": "Ajoutez 'types: { output: './types/api.d.ts', interfaceName: 'MonAPI' }' à votre configuration typescript.",
 		"TS_STRICT_REQUIRES_INTERFACE_NAME": "Le mode strict de TypeScript nécessite la configuration de 'types.interfaceName' dans votre configuration typescript.",
diff --git a/src/lib/i18n/languages/hi-in.json b/src/lib/i18n/languages/hi-in.json
index 6787f92e9..5b74ceea0 100644
--- a/src/lib/i18n/languages/hi-in.json
+++ b/src/lib/i18n/languages/hi-in.json
@@ -350,6 +350,8 @@
 		"HINT_TYPESCRIPT_ESBUILD_NOT_INSTALLED": "इसे इसके साथ स्थापित करें: npm install esbuild",
 		"TYPESCRIPT_TSC_NOT_INSTALLED": "TypeScript {mode} मोड के लिए 'typescript' स्थापित होना आवश्यक है।",
 		"HINT_TYPESCRIPT_TSC_NOT_INSTALLED": "इसे इसके साथ स्थापित करें: npm install typescript",
+		"TYPESCRIPT_STRICT_REQUIRES_TS6": "TypeScript strict मोड के लिए TypeScript 6 कंपाइलर API आवश्यक है; इंस्टॉल किया गया 'typescript' पैकेज (संस्करण {version}) इसे उपलब्ध नहीं कराता। TypeScript 7 में स्थिर कंपाइलर API केवल संस्करण 7.1 से उपलब्ध होगा।",
+		"HINT_TYPESCRIPT_STRICT_REQUIRES_TS6": "strict मोड के लिए typescript@6 स्थापित करें: npm install typescript@6। तेज़ मोड (esbuild) और 'slothlet typegen' TypeScript 7 के साथ भी काम करते हैं।",
 		"TS_STRICT_REQUIRES_OUTPUT": "TypeScript strict मोड के लिए आपके typescript कॉन्फ़िगरेशन में 'types.output' कॉन्फ़िगर होना आवश्यक है।",
 		"HINT_TS_STRICT_REQUIRES_OUTPUT": "अपने typescript कॉन्फ़िगरेशन में 'types: { output: './types/api.d.ts', interfaceName: 'MyAPI' }' जोड़ें।",
 		"TS_STRICT_REQUIRES_INTERFACE_NAME": "TypeScript strict मोड के लिए आपके typescript कॉन्फ़िगरेशन में 'types.interfaceName' कॉन्फ़िगर होना आवश्यक है।",
diff --git a/src/lib/i18n/languages/ja-jp.json b/src/lib/i18n/languages/ja-jp.json
index 845cb70ef..b992cd26e 100644
--- a/src/lib/i18n/languages/ja-jp.json
+++ b/src/lib/i18n/languages/ja-jp.json
@@ -350,6 +350,8 @@
 		"HINT_TYPESCRIPT_ESBUILD_NOT_INSTALLED": "インストール方法: npm install esbuild",
 		"TYPESCRIPT_TSC_NOT_INSTALLED": "TypeScript の {mode} モードには 'typescript' のインストールが必要です。",
 		"HINT_TYPESCRIPT_TSC_NOT_INSTALLED": "インストール方法: npm install typescript",
+		"TYPESCRIPT_STRICT_REQUIRES_TS6": "TypeScript の strict モードには TypeScript 6 のコンパイラ API が必要です。インストールされている 'typescript' パッケージ（バージョン {version}）はこれを提供していません。TypeScript 7 で安定したコンパイラ API が提供されるのはバージョン 7.1 以降です。",
+		"HINT_TYPESCRIPT_STRICT_REQUIRES_TS6": "strict モードには typescript@6 をインストールしてください: npm install typescript@6。高速モード（esbuild）と 'slothlet typegen' は TypeScript 7 でも動作します。",
 		"TS_STRICT_REQUIRES_OUTPUT": "TypeScript の strict モードでは、構成の typescript セクションで 'types.output' を設定する必要があります。",
 		"HINT_TS_STRICT_REQUIRES_OUTPUT": "typescript 構成に 'types: { output: './types/api.d.ts', interfaceName: 'MyAPI' }' を追加してください。",
 		"TS_STRICT_REQUIRES_INTERFACE_NAME": "TypeScript の strict モードでは、構成の typescript セクションで 'types.interfaceName' を設定する必要があります。",
diff --git a/src/lib/i18n/languages/ko-kr.json b/src/lib/i18n/languages/ko-kr.json
index 4dded1d79..f4f84d8a1 100644
--- a/src/lib/i18n/languages/ko-kr.json
+++ b/src/lib/i18n/languages/ko-kr.json
@@ -350,6 +350,8 @@
 		"HINT_TYPESCRIPT_ESBUILD_NOT_INSTALLED": "설치 명령: npm install esbuild",
 		"TYPESCRIPT_TSC_NOT_INSTALLED": "TypeScript {mode} 모드에는 'typescript' 설치가 필요합니다.",
 		"HINT_TYPESCRIPT_TSC_NOT_INSTALLED": "설치 명령: npm install typescript",
+		"TYPESCRIPT_STRICT_REQUIRES_TS6": "TypeScript strict 모드에는 TypeScript 6 컴파일러 API가 필요합니다. 설치된 'typescript' 패키지(버전 {version})는 이를 제공하지 않습니다. TypeScript 7은 버전 7.1부터 안정적인 컴파일러 API를 제공할 예정입니다.",
+		"HINT_TYPESCRIPT_STRICT_REQUIRES_TS6": "strict 모드를 사용하려면 typescript@6을 설치하십시오: npm install typescript@6. 빠른 모드(esbuild)와 'slothlet typegen'은 TypeScript 7에서도 동작합니다.",
 		"TS_STRICT_REQUIRES_OUTPUT": "TypeScript 엄격(strict) 모드에는 typescript 설정에 'types.output' 설정이 필요합니다.",
 		"HINT_TS_STRICT_REQUIRES_OUTPUT": "typescript 설정에 'types: { output: './types/api.d.ts', interfaceName: 'MyAPI' }'를 추가하십시오.",
 		"TS_STRICT_REQUIRES_INTERFACE_NAME": "TypeScript 엄격 모드에는 typescript 설정에 'types.interfaceName' 설정이 필요합니다.",
diff --git a/src/lib/i18n/languages/pt-br.json b/src/lib/i18n/languages/pt-br.json
index af4b0803a..8ee7f555b 100644
--- a/src/lib/i18n/languages/pt-br.json
+++ b/src/lib/i18n/languages/pt-br.json
@@ -350,6 +350,8 @@
 		"HINT_TYPESCRIPT_ESBUILD_NOT_INSTALLED": "Instale-o com: npm install esbuild",
 		"TYPESCRIPT_TSC_NOT_INSTALLED": "O modo TypeScript {mode} requer que o 'typescript' esteja instalado.",
 		"HINT_TYPESCRIPT_TSC_NOT_INSTALLED": "Instale-o com: npm install typescript",
+		"TYPESCRIPT_STRICT_REQUIRES_TS6": "O modo estrito do TypeScript requer a API do compilador do TypeScript 6; o pacote 'typescript' instalado (versão {version}) não a expõe. O TypeScript 7 só exporá uma API de compilador estável a partir da versão 7.1.",
+		"HINT_TYPESCRIPT_STRICT_REQUIRES_TS6": "Instale o typescript@6 para o modo estrito: npm install typescript@6. O modo rápido (esbuild) e o 'slothlet typegen' funcionam com o TypeScript 7.",
 		"TS_STRICT_REQUIRES_OUTPUT": "O modo estrito do TypeScript requer que 'types.output' seja configurado em sua configuração typescript.",
 		"HINT_TS_STRICT_REQUIRES_OUTPUT": "Adicione 'types: { output: './types/api.d.ts', interfaceName: 'MyAPI' }' à sua configuração typescript.",
 		"TS_STRICT_REQUIRES_INTERFACE_NAME": "O modo estrito do TypeScript requer que 'types.interfaceName' seja configurado em sua configuração typescript.",
diff --git a/src/lib/i18n/languages/ru-ru.json b/src/lib/i18n/languages/ru-ru.json
index e7009e951..0c0edb836 100644
--- a/src/lib/i18n/languages/ru-ru.json
+++ b/src/lib/i18n/languages/ru-ru.json
@@ -350,6 +350,8 @@
 		"HINT_TYPESCRIPT_ESBUILD_NOT_INSTALLED": "Установите: npm install esbuild",
 		"TYPESCRIPT_TSC_NOT_INSTALLED": "Для режима TypeScript {mode} требуется 'typescript'.",
 		"HINT_TYPESCRIPT_TSC_NOT_INSTALLED": "Установите: npm install typescript",
+		"TYPESCRIPT_STRICT_REQUIRES_TS6": "Строгий режим TypeScript требует API компилятора TypeScript 6; установленный пакет 'typescript' (версия {version}) его не предоставляет. Стабильный API компилятора появится в TypeScript 7 только начиная с версии 7.1.",
+		"HINT_TYPESCRIPT_STRICT_REQUIRES_TS6": "Установите typescript@6 для строгого режима: npm install typescript@6. Быстрый режим (esbuild) и 'slothlet typegen' работают с TypeScript 7.",
 		"TS_STRICT_REQUIRES_OUTPUT": "Режим TS strict требует настройки 'types.output' в конфигурации.",
 		"HINT_TS_STRICT_REQUIRES_OUTPUT": "Добавьте 'types: { output: './types/api.d.ts', interfaceName: 'MyAPI' }'.",
 		"TS_STRICT_REQUIRES_INTERFACE_NAME": "TS strict требует 'types.interfaceName'.",
diff --git a/src/lib/i18n/languages/zh-cn.json b/src/lib/i18n/languages/zh-cn.json
index d4ec818c0..2ffa8eeac 100644
--- a/src/lib/i18n/languages/zh-cn.json
+++ b/src/lib/i18n/languages/zh-cn.json
@@ -350,6 +350,8 @@
 		"HINT_TYPESCRIPT_ESBUILD_NOT_INSTALLED": "请安装：npm install esbuild",
 		"TYPESCRIPT_TSC_NOT_INSTALLED": "TypeScript {mode} 模式需要安装 'typescript'。",
 		"HINT_TYPESCRIPT_TSC_NOT_INSTALLED": "请安装：npm install typescript",
+		"TYPESCRIPT_STRICT_REQUIRES_TS6": "TypeScript 严格模式需要 TypeScript 6 的编译器 API；已安装的 'typescript' 包(版本 {version})未提供该 API。TypeScript 7 要到 7.1 版本才会提供稳定的编译器 API。",
+		"HINT_TYPESCRIPT_STRICT_REQUIRES_TS6": "请为严格模式安装 typescript@6：npm install typescript@6。快速模式(esbuild)和 'slothlet typegen' 可以在 TypeScript 7 下正常工作。",
 		"TS_STRICT_REQUIRES_OUTPUT": "TypeScript 严格模式要求在您的 TypeScript 配置中配置 'types.output'。",
 		"HINT_TS_STRICT_REQUIRES_OUTPUT": "在您的 TypeScript 配置中添加 'types: { output: './types/api.d.ts', interfaceName: 'MyAPI' }'。",
 		"TS_STRICT_REQUIRES_INTERFACE_NAME": "TypeScript 严格模式要求在您的 TypeScript 配置中配置 'types.interfaceName'。",
diff --git a/src/lib/processors/loader.mjs b/src/lib/processors/loader.mjs
index 5d055e171..26a7d9c67 100644
--- a/src/lib/processors/loader.mjs
+++ b/src/lib/processors/loader.mjs
@@ -357,7 +357,7 @@ export class Loader extends ComponentBase {
 					}
 
 					// Lazy load TypeScript strict mode processor
-					const { transformTypeScriptStrict, writeTransformedToCache, formatDiagnostics } =
+					const { transformTypeScriptStrict, writeTransformedToCache, formatDiagnostics, getTypeScript } =
 						await import("@cldmv/slothlet/processors/typescript");
 
 					// Transform + type-check a single .ts/.mts file. Reused for the entry
@@ -374,9 +374,11 @@ export class Loader extends ComponentBase {
 						});
 						// Check for type errors
 						if (result.diagnostics && result.diagnostics.length > 0) {
-							// Get TypeScript module to format diagnostics
-							const ts = await import("typescript");
-							const errors = formatDiagnostics(result.diagnostics, ts.default);
+							// Route through the same guarded loader transformTypeScriptStrict just used
+							// (memoized — this is not a second capability check) so a TypeScript 7
+							// install without the compiler API is reported the same way here as there.
+							const ts = await getTypeScript();
+							const errors = formatDiagnostics(result.diagnostics, ts);
 
 							// Throw error with formatted diagnostics
 							const error = new this.SlothletError("TS_TYPE_CHECK_ERRORS", { filePath: tsPath, errors: errors.join("\n") }, null, {
diff --git a/src/lib/processors/typescript.mjs b/src/lib/processors/typescript.mjs
index 774d0664b..ec58fd2b1 100644
--- a/src/lib/processors/typescript.mjs
+++ b/src/lib/processors/typescript.mjs
@@ -51,15 +51,44 @@ async function getEsbuild() {
 }
 
 /**
- * Lazy-load TypeScript compiler to avoid requiring installation when not using strict mode
- * @returns {Promise<object>} typescript module
- * @throws {SlothletError} TYPESCRIPT_TSC_NOT_INSTALLED if typescript is not installed
+ * Resolve the object within a `typescript` module namespace that actually exposes the compiler
+ * API strict mode needs (`createProgram`, `ScriptTarget`).
+ *
+ * Node's dynamic `import()` of the CJS `typescript` package can surface the compiler API two
+ * ways: hoisted onto the namespace itself (TypeScript 6.x — every named export is also a
+ * top-level property) or only under a `default` wrapper. TypeScript 7's current npm release
+ * exposes NEITHER shape — its compiler API lives under unstable/ import paths pending a stable
+ * surface promised for 7.1 — so both checks fail here and this returns `null`.
+ * @param {object} ts - The awaited `import("typescript")` namespace.
+ * @returns {object|null} The object exposing the compiler API, or `null` when neither shape does.
  * @private
  */
-async function getTypeScript() {
+function resolveStrictCompilerApi(ts) {
+	if (ts && typeof ts.createProgram === "function" && ts.ScriptTarget) return ts;
+	if (ts?.default && typeof ts.default.createProgram === "function" && ts.default.ScriptTarget) return ts.default;
+	return null;
+}
+
+/**
+ * Lazy-load the TypeScript compiler API needed by strict mode (and by strict-mode diagnostic
+ * formatting), to avoid requiring installation when not using strict mode.
+ *
+ * Beyond the "package not installed" case, this also guards against a `typescript` package that
+ * installs successfully but does not expose the compiler API strict mode needs — true of
+ * TypeScript 7's current npm release (see {@link resolveStrictCompilerApi}). Both loader.mjs's
+ * direct diagnostic-formatting use and {@link transformTypeScriptStrict} route through this one
+ * function so the capability is checked in exactly one place.
+ * @returns {Promise<object>} The TypeScript compiler API object (`createProgram`, `ScriptTarget`, etc.)
+ * @throws {SlothletError} TYPESCRIPT_TSC_NOT_INSTALLED if typescript is not installed
+ * @throws {SlothletError} TYPESCRIPT_STRICT_REQUIRES_TS6 if the installed typescript package does
+ *   not expose the compiler API (e.g. TypeScript 7 before its 7.1 stable API)
+ * @public
+ */
+export async function getTypeScript() {
 	if (!typescriptInstance) {
+		let ts;
 		try {
-			typescriptInstance = await import("typescript");
+			ts = await import("typescript");
 			// unreachable via tests: typescript is a devDependency always present during testing.
 			// The catch only fires in end-user environments where typescript is not installed.
 			/* v8 ignore start */
@@ -67,6 +96,13 @@ async function getTypeScript() {
 			throw new SlothletError("TYPESCRIPT_TSC_NOT_INSTALLED", { mode: "strict" }, error);
 		}
 		/* v8 ignore stop */
+		const api = resolveStrictCompilerApi(ts);
+		if (!api) {
+			throw new SlothletError("TYPESCRIPT_STRICT_REQUIRES_TS6", { version: ts?.version ?? ts?.default?.version ?? "unknown" }, null, {
+				validationError: true
+			});
+		}
+		typescriptInstance = api;
 	}
 	return typescriptInstance;
 }
diff --git a/tests/vitests/suites/typescript/typescript-strict-ts7.test.vitest.mjs b/tests/vitests/suites/typescript/typescript-strict-ts7.test.vitest.mjs
new file mode 100644
index 000000000..97b92f554
--- /dev/null
+++ b/tests/vitests/suites/typescript/typescript-strict-ts7.test.vitest.mjs
@@ -0,0 +1,156 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/typescript/typescript-strict-ts7.test.vitest.mjs
+ *	@Date: 2026-09-28T00:00:00-07:00 (1798873200)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28T00:00:00-07:00 (1798873200)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Regression coverage for #510 — TypeScript 7's current npm release exposes no
+ * compiler API (only `{ default, "module.exports", version, versionMajorMinor }`), which crashed
+ * strict mode with a raw `Cannot read properties of undefined (reading 'ES3')` instead of a clear
+ * SlothletError. Simulates that shape via `vi.doMock("typescript", …)` rather than installing
+ * TypeScript 7 into the shared node_modules.
+ */
+import { describe, it, expect, afterEach, vi } from "vitest";
+import { writeFile, rm } from "node:fs/promises";
+import path from "node:path";
+import { withSuppressedSlothletErrorOutput } from "../../setup/vitest-helper.mjs";
+import { makeTestTmpDir } from "../../setup/test-fixtures-tmp.mjs";
+
+/**
+ * The shape TypeScript 7's current npm release actually resolves to via `await import("typescript")`
+ * — no compiler API, just package metadata. Mirrors the issue's verified `{ default,
+ * "module.exports", version, versionMajorMinor }` namespace.
+ *
+ * `createProgram`/`ScriptTarget` are listed explicitly (as `undefined`) rather than simply
+ * omitted: Vitest 5's `vi.mock`/`vi.doMock` wraps the factory's return in a Proxy that throws its
+ * own "No '<prop>' export is defined on the mock" error for any accessed key the factory didn't
+ * return at all (`!(prop in target)`), which would misrepresent the source's plain-JS
+ * `typeof ts.createProgram === "function"` feature-detection as a test-harness failure instead of
+ * exercising it. A real, un-mocked TypeScript 7 import simply yields `undefined` for these — this
+ * mock reproduces that value while staying inside Vitest's export-validation guard.
+ * @param {string} version - Fake installed version to report.
+ * @returns {object} A `vi.doMock` factory return value simulating the TS7 namespace.
+ */
+function ts7NamespaceShape(version) {
+	const metadata = { version, versionMajorMinor: version.split(".").slice(0, 2).join(".") };
+	return {
+		default: metadata,
+		"module.exports": metadata,
+		version: metadata.version,
+		versionMajorMinor: metadata.versionMajorMinor,
+		createProgram: undefined,
+		ScriptTarget: undefined
+	};
+}
+
+describe("TypeScript strict mode vs. a compiler-API-less 'typescript' install (#510)", () => {
+	const tempRoots = [];
+
+	afterEach(async () => {
+		vi.doUnmock("typescript");
+		vi.resetModules();
+		await Promise.allSettled(tempRoots.map((r) => rm(r, { recursive: true, force: true })));
+		tempRoots.length = 0;
+	});
+
+	it("getTypeScript() throws TYPESCRIPT_STRICT_REQUIRES_TS6 naming the installed version, with a typescript@6 hint", async () => {
+		vi.resetModules();
+		vi.doMock("typescript", () => ts7NamespaceShape("7.0.0-simulated"));
+
+		const { getTypeScript } = await import("@cldmv/slothlet/processors/typescript");
+
+		let caught;
+		await withSuppressedSlothletErrorOutput(async () => {
+			try {
+				await getTypeScript();
+			} catch (error) {
+				caught = error;
+			}
+		});
+
+		expect(caught).toBeDefined();
+		expect(caught.code).toBe("TYPESCRIPT_STRICT_REQUIRES_TS6");
+		expect(caught.message).toContain("7.0.0-simulated");
+		expect(caught.message).not.toContain("Cannot read properties of undefined");
+		expect(caught.hint).toMatch(/typescript@6/);
+	});
+
+	it("getTypeScript() resolves the compiler API from a default-only namespace (interop shape)", async () => {
+		vi.resetModules();
+		const fakeCompilerApi = {
+			createProgram: () => ({}),
+			ScriptTarget: { ES2020: 7, Latest: 99 },
+			ModuleKind: { ESNext: 99 },
+			flattenDiagnosticMessageText: () => "",
+			version: "6.9.9-default-only"
+		};
+		// createProgram/ScriptTarget are declared (as undefined) for the same reason noted on
+		// ts7NamespaceShape() above — Vitest's mock-export Proxy guard needs the top-level key to
+		// exist even when its value is absent, to distinguish "absent" from "typo'd export name".
+		vi.doMock("typescript", () => ({
+			default: fakeCompilerApi,
+			version: "6.9.9-default-only",
+			createProgram: undefined,
+			ScriptTarget: undefined
+		}));
+
+		const { getTypeScript } = await import("@cldmv/slothlet/processors/typescript");
+		const ts = await getTypeScript();
+
+		expect(ts).toBe(fakeCompilerApi);
+		expect(typeof ts.createProgram).toBe("function");
+	});
+
+	it("getTypeScript() still resolves the real TypeScript 6 compiler API unmodified (no mock)", async () => {
+		vi.resetModules();
+
+		const { getTypeScript } = await import("@cldmv/slothlet/processors/typescript");
+		const ts = await getTypeScript();
+
+		expect(typeof ts.createProgram).toBe("function");
+		expect(ts.ScriptTarget).toBeDefined();
+		expect(typeof ts.flattenDiagnosticMessageText).toBe("function");
+	});
+
+	it("transformTypeScriptStrict() surfaces TYPESCRIPT_STRICT_REQUIRES_TS6 instead of crashing on ts.ScriptTarget.ES3", async () => {
+		vi.resetModules();
+		vi.doMock("typescript", () => ts7NamespaceShape("7.0.0-simulated"));
+
+		const { transformTypeScriptStrict } = await import("@cldmv/slothlet/processors/typescript");
+
+		const root = await makeTestTmpDir("ts7-strict");
+		tempRoots.push(root);
+		const tsFile = path.join(root, "widget.ts");
+		await writeFile(tsFile, "export const widget: number = 1;\n", "utf8");
+
+		await withSuppressedSlothletErrorOutput(async () => {
+			await expect(transformTypeScriptStrict(tsFile, {})).rejects.toMatchObject({
+				code: "TYPESCRIPT_STRICT_REQUIRES_TS6"
+			});
+		});
+	});
+
+	it("fast mode (esbuild) still transforms .ts source when 'typescript' lacks the compiler API", async () => {
+		vi.resetModules();
+		vi.doMock("typescript", () => ts7NamespaceShape("7.0.0-simulated"));
+
+		const { transformTypeScript } = await import("@cldmv/slothlet/processors/typescript");
+
+		const root = await makeTestTmpDir("ts7-fast");
+		tempRoots.push(root);
+		const tsFile = path.join(root, "widget.ts");
+		await writeFile(tsFile, "export const widget: number = 1;\nexport function double(n: number): number { return n * 2; }\n", "utf8");
+
+		const code = await transformTypeScript(tsFile);
+		expect(code).toContain("widget");
+		expect(code).toContain("double");
+	});
+});
diff --git a/tools/ci/i18n-latin-tokens-accepted.json b/tools/ci/i18n-latin-tokens-accepted.json
index dd0c2a0c6..8963190d8 100644
--- a/tools/ci/i18n-latin-tokens-accepted.json
+++ b/tools/ci/i18n-latin-tokens-accepted.json
@@ -124,7 +124,7 @@
 			"callback"
 		],
 		"file_extensions": ["mjs", "cjs", "js", "json"],
-		"typescript_feature": ["TypeScript", "typescript", "types", "esbuild"],
+		"typescript_feature": ["TypeScript", "typescript", "types", "esbuild", "typegen"],
 		"lifecycle_hook_method_names": [
 			"lifecycle",
 			"hook",
@@ -383,6 +383,7 @@
 		"typescript",
 		"types",
 		"esbuild",
+		"typegen",
 		"lifecycle",
 		"hook",
 		"hooks",
diff --git a/types/src/lib/processors/loader.d.mts.map b/types/src/lib/processors/loader.d.mts.map
index 896341303..b87fe12be 100644
--- a/types/src/lib/processors/loader.d.mts.map
+++ b/types/src/lib/processors/loader.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"loader.d.mts","sourceRoot":"","sources":["../../../../src/lib/processors/loader.mjs"],"names":[],"mappings":"AA4DA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,sDAjBW,MAAM,6BAEd;IAAqC,MAAM,GAAnC,MAAM,GAAC,SAAS;IACI,YAAY;CAExC,GAAU,OAAO,CAmBnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,gDAZG;IAAqC,MAAM,GAAnC,MAAM,GAAC,SAAS;IACG,GAAG;CAC9B,GAAU,OAAO,CAanB;AAED;;;;;;;;;;;;GAYG;AACH,mDAVW,MAAM,cACN,MAAM,GACJ,OAAO,CAYnB;AAED;;;;;;;;;;;;GAYG;AACH,uDAVW,MAAM,cACN,MAAM,GACJ,OAAO,CAcnB;AAwDD;;;;;GAKG;AACH;;;;;;;;;;GAUG;AACH,4CALa,MAAM,CAOlB;AAED;IACC,gCAAmC;IASnC;;;;OAIG;IACH,sBAHW,MAAM,EAKhB;IAED;;;;;;;;OAQG;IACH,4BAPW,MAAM,eACN,MAAM,aACN,MAAM,cACN,MAAM,GAAC,IAAI,GACT,OAAO,CAAC,MAAM,CAAC,CA+M3B;IA+JD;;;;;;;;;;;;;;OAcG;IACH,0BAbW,MAAM,YAEd;QAA0B,UAAU;QACX,YAAY;QACZ,QAAQ;QACD,UAAU;QACM,MAAM;QAE5B,iBAAiB;QAClB,OAAO;KAChC,GAAU,OAAO,CAAC,MAAM,CAAC,CAqJ3B;IA8PD;;;;;OAKG;IACH,8BAJW,MAAM,GACJ,MAAM,CA+ClB;;CACD;8BAliC6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"loader.d.mts","sourceRoot":"","sources":["../../../../src/lib/processors/loader.mjs"],"names":[],"mappings":"AA4DA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,sDAjBW,MAAM,6BAEd;IAAqC,MAAM,GAAnC,MAAM,GAAC,SAAS;IACI,YAAY;CAExC,GAAU,OAAO,CAmBnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,gDAZG;IAAqC,MAAM,GAAnC,MAAM,GAAC,SAAS;IACG,GAAG;CAC9B,GAAU,OAAO,CAanB;AAED;;;;;;;;;;;;GAYG;AACH,mDAVW,MAAM,cACN,MAAM,GACJ,OAAO,CAYnB;AAED;;;;;;;;;;;;GAYG;AACH,uDAVW,MAAM,cACN,MAAM,GACJ,OAAO,CAcnB;AAwDD;;;;;GAKG;AACH;;;;;;;;;;GAUG;AACH,4CALa,MAAM,CAOlB;AAED;IACC,gCAAmC;IASnC;;;;OAIG;IACH,sBAHW,MAAM,EAKhB;IAED;;;;;;;;OAQG;IACH,4BAPW,MAAM,eACN,MAAM,aACN,MAAM,cACN,MAAM,GAAC,IAAI,GACT,OAAO,CAAC,MAAM,CAAC,CAiN3B;IA+JD;;;;;;;;;;;;;;OAcG;IACH,0BAbW,MAAM,YAEd;QAA0B,UAAU;QACX,YAAY;QACZ,QAAQ;QACD,UAAU;QACM,MAAM;QAE5B,iBAAiB;QAClB,OAAO;KAChC,GAAU,OAAO,CAAC,MAAM,CAAC,CAqJ3B;IA8PD;;;;;OAKG;IACH,8BAJW,MAAM,GACJ,MAAM,CA+ClB;;CACD;8BApiC6B,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/lib/processors/typescript.d.mts b/types/src/lib/processors/typescript.d.mts
index 5fe5f7700..7419756b7 100644
--- a/types/src/lib/processors/typescript.d.mts
+++ b/types/src/lib/processors/typescript.d.mts
@@ -1,3 +1,19 @@
+/**
+ * Lazy-load the TypeScript compiler API needed by strict mode (and by strict-mode diagnostic
+ * formatting), to avoid requiring installation when not using strict mode.
+ *
+ * Beyond the "package not installed" case, this also guards against a `typescript` package that
+ * installs successfully but does not expose the compiler API strict mode needs — true of
+ * TypeScript 7's current npm release (see {@link resolveStrictCompilerApi}). Both loader.mjs's
+ * direct diagnostic-formatting use and {@link transformTypeScriptStrict} route through this one
+ * function so the capability is checked in exactly one place.
+ * @returns {Promise<object>} The TypeScript compiler API object (`createProgram`, `ScriptTarget`, etc.)
+ * @throws {SlothletError} TYPESCRIPT_TSC_NOT_INSTALLED if typescript is not installed
+ * @throws {SlothletError} TYPESCRIPT_STRICT_REQUIRES_TS6 if the installed typescript package does
+ *   not expose the compiler API (e.g. TypeScript 7 before its 7.1 stable API)
+ * @public
+ */
+export function getTypeScript(): Promise<object>;
 /**
  * Transform TypeScript code to JavaScript using esbuild
  * @param {string} filePath - Path to the TypeScript file
diff --git a/types/src/lib/processors/typescript.d.mts.map b/types/src/lib/processors/typescript.d.mts.map
index 0b27ef3d5..6b8d95b15 100644
--- a/types/src/lib/processors/typescript.d.mts.map
+++ b/types/src/lib/processors/typescript.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"typescript.d.mts","sourceRoot":"","sources":["../../../../src/lib/processors/typescript.mjs"],"names":[],"mappings":"AAyEA;;;;;;;;;;;GAWG;AACH,8CAVW,MAAM,YAEd;IAAyB,MAAM;IACN,MAAM;IACL,SAAS;CAEnC,GAAU,OAAO,CAAC,MAAM,CAAC,CAqB3B;AAED;;;;;GAKG;AACH,oCAJW,MAAM,GACJ,MAAM,CAQlB;AA6HD;;;;;;;;;;;;;GAaG;AACH,2CAHa,OAAO,CAAC,IAAI,CAAC,CAyCzB;AAED;;;;;;;;GAQG;AACH,6CAHa,OAAO,CAAC,OAAO,CAAC,CAiB5B;AA+CD;;;;;;;;;;;GAWG;AACH,kDAJW,MAAM,GACJ;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CA4B3C;AA+CD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,6CAJW,MAAM,GACJ,UAAU,CA2EtB;AAmDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,gDATW,MAAM,cACN,MAAM,YACN,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,MAAM,GAInE,MAAM,CA4ClB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,sDARW,MAAM,QACN,MAAM,cACN,MAAM,cACN,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GAEnC,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAC,CAAC,CAwBpD;AA4GD;;;;;;;;;;;;;;;;;;GAkBG;AACH,oDAjBW,MAAM,YAEd;IAAyB,MAAM;IACN,MAAM;IACL,MAAM;IACN,aAAa;IACd,kBAAkB;IACjB,SAAS;IAEV,eAAe;CAGxC,GAAU,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAA;CAAC,CAAC,CAgG1D;AAiDD;;;;;;GAMG;AACH,+CALW,MAAM,EAAE,MACR,MAAM,GACJ,MAAM,EAAE,CAapB"}
\ No newline at end of file
+{"version":3,"file":"typescript.d.mts","sourceRoot":"","sources":["../../../../src/lib/processors/typescript.mjs"],"names":[],"mappings":"AAuEA;;;;;;;;;;;;;;GAcG;AACH,iCANa,OAAO,CAAC,MAAM,CAAC,CA2B3B;AAED;;;;;;;;;;;GAWG;AACH,8CAVW,MAAM,YAEd;IAAyB,MAAM;IACN,MAAM;IACL,SAAS;CAEnC,GAAU,OAAO,CAAC,MAAM,CAAC,CAqB3B;AAED;;;;;GAKG;AACH,oCAJW,MAAM,GACJ,MAAM,CAQlB;AA6HD;;;;;;;;;;;;;GAaG;AACH,2CAHa,OAAO,CAAC,IAAI,CAAC,CAyCzB;AAED;;;;;;;;GAQG;AACH,6CAHa,OAAO,CAAC,OAAO,CAAC,CAiB5B;AA+CD;;;;;;;;;;;GAWG;AACH,kDAJW,MAAM,GACJ;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CA4B3C;AA+CD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,6CAJW,MAAM,GACJ,UAAU,CA2EtB;AAmDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,gDATW,MAAM,cACN,MAAM,YACN,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,MAAM,GAInE,MAAM,CA4ClB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,sDARW,MAAM,QACN,MAAM,cACN,MAAM,cACN,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GAEnC,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAC,CAAC,CAwBpD;AA4GD;;;;;;;;;;;;;;;;;;GAkBG;AACH,oDAjBW,MAAM,YAEd;IAAyB,MAAM;IACN,MAAM;IACL,MAAM;IACN,aAAa;IACd,kBAAkB;IACjB,SAAS;IAEV,eAAe;CAGxC,GAAU,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAA;CAAC,CAAC,CAgG1D;AAiDD;;;;;;GAMG;AACH,+CALW,MAAM,EAAE,MACR,MAAM,GACJ,MAAM,EAAE,CAapB"}
\ No newline at end of file

From 77f71a0d429b5e4ffbf137c1c85097cea675a7ec Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Mon, 28 Sep 2026 21:41:34 -0700
Subject: [PATCH 28/49] feat(permissions): add permissions.owner to let a
 module reach every leaf it owns

Under defaultPolicy "deny", a module composed with one api.add(path, folder,
{ moduleID }) could not call or read its own leaves across subdirectories:
the self-call bypass covers the same file and private members the same
directory, but each subdirectory is its own permission module.

permissions.owner: true (default false) adds an implicit allow that stands in
for the default policy: when no rule decided and the default policy denies, a
caller leaf may access a target whose current owner in the ownership registry
is the caller leaf's own current owner. Matching is by owner, not path, so a
second module merged into the same namespace gets nothing; an explicit deny
rule still wins; defaultPolicy "allow" is unaffected. The grant is applied
after the resolved-decision cache and never stored in it, so ownership changes
from add, remove and reload are followed live. The framework's reserved roots
(slothlet.*, shutdown, destroy) are never granted. A granted access emits
permission:owner-allow under audit "verbose". The option is validated as a
boolean (INVALID_CONFIG otherwise).

Fixes #509
---
 .../base/core/alpha.mjs                       |  46 ++++
 .../base/core/sub/beta.mjs                    |  28 ++
 .../api_test_permissions_owner/ext/main.mjs   |  70 +++++
 .../ext/session/store.mjs                     |  39 +++
 .../ext/settings/data.mjs                     |  24 ++
 .../other/intruder.mjs                        |  46 ++++
 docs/PERMISSIONS.md                           |  71 +++++
 docs/generated/API.md                         |  11 +
 src/lib/handlers/permission-manager.mjs       |  75 +++++-
 src/lib/helpers/config.mjs                    |  27 +-
 src/slothlet.mjs                              |  14 +
 .../permissions-owner.test.vitest.mjs         | 255 ++++++++++++++++++
 .../src/lib/handlers/permission-manager.d.mts |  47 +++-
 .../lib/handlers/permission-manager.d.mts.map |   2 +-
 types/src/lib/helpers/config.d.mts            |   5 +-
 types/src/lib/helpers/config.d.mts.map        |   2 +-
 types/src/slothlet.d.mts                      |  48 ++++
 types/src/slothlet.d.mts.map                  |   2 +-
 18 files changed, 796 insertions(+), 16 deletions(-)
 create mode 100644 api_tests/api_test_permissions_owner/base/core/alpha.mjs
 create mode 100644 api_tests/api_test_permissions_owner/base/core/sub/beta.mjs
 create mode 100644 api_tests/api_test_permissions_owner/ext/main.mjs
 create mode 100644 api_tests/api_test_permissions_owner/ext/session/store.mjs
 create mode 100644 api_tests/api_test_permissions_owner/ext/settings/data.mjs
 create mode 100644 api_tests/api_test_permissions_owner/other/intruder.mjs
 create mode 100644 tests/vitests/suites/permissions/permissions-owner.test.vitest.mjs

diff --git a/api_tests/api_test_permissions_owner/base/core/alpha.mjs b/api_tests/api_test_permissions_owner/base/core/alpha.mjs
new file mode 100644
index 000000000..a10f5c9ce
--- /dev/null
+++ b/api_tests/api_test_permissions_owner/base/core/alpha.mjs
@@ -0,0 +1,46 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_permissions_owner/base/core/alpha.mjs
+ *	@Date: 2026-09-28 12:00:00 -07:00 (1790622000)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 12:00:00 -07:00 (1790622000)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Base-loaded leaf that calls into a subdirectory (#509).
+ *
+ * @description
+ * Everything the initial load composes is owned by the base module, so this cross-directory call is
+ * an own call under `permissions.owner`.
+ *
+ * @module api_tests/api_test_permissions_owner/base/core/alpha
+ */
+
+import { self } from "@cldmv/slothlet/runtime";
+
+/**
+ * Call the base tree's own leaf in `core/sub/beta.mjs`.
+ * @returns {string} The beta leaf's result.
+ * @public
+ * @example
+ * api.core.alpha.callBeta(); // "pong"
+ */
+export function callBeta() {
+	return self.core.sub.beta.ping();
+}
+
+/**
+ * Call a leaf of the added extension, which the base module does not own.
+ * @returns {string} The store's result.
+ * @public
+ * @example
+ * api.core.alpha.reachExt();
+ */
+export function reachExt() {
+	return self.launcher.session.store.create();
+}
diff --git a/api_tests/api_test_permissions_owner/base/core/sub/beta.mjs b/api_tests/api_test_permissions_owner/base/core/sub/beta.mjs
new file mode 100644
index 000000000..f461fb304
--- /dev/null
+++ b/api_tests/api_test_permissions_owner/base/core/sub/beta.mjs
@@ -0,0 +1,28 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_permissions_owner/base/core/sub/beta.mjs
+ *	@Date: 2026-09-28 12:00:00 -07:00 (1790622000)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 12:00:00 -07:00 (1790622000)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Base-loaded leaf in a subdirectory (#509).
+ * @module api_tests/api_test_permissions_owner/base/core/sub/beta
+ */
+
+/**
+ * Ping.
+ * @returns {string} Marker.
+ * @public
+ * @example
+ * api.core.sub.beta.ping(); // "pong"
+ */
+export function ping() {
+	return "pong";
+}
diff --git a/api_tests/api_test_permissions_owner/ext/main.mjs b/api_tests/api_test_permissions_owner/ext/main.mjs
new file mode 100644
index 000000000..4e07335de
--- /dev/null
+++ b/api_tests/api_test_permissions_owner/ext/main.mjs
@@ -0,0 +1,70 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_permissions_owner/ext/main.mjs
+ *	@Date: 2026-09-28 12:00:00 -07:00 (1790622000)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 12:00:00 -07:00 (1790622000)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Entry leaf of the owner-grant extension (#509).
+ *
+ * @description
+ * Mounted with one `api.add(..., { moduleID })`, so every leaf of this folder is owned by that one
+ * module even though its files sit in different directories. Each export calls or reads a leaf in a
+ * SUBDIRECTORY, which is its own permission module — a cross-directory call that `defaultPolicy:
+ * "deny"` refuses unless `permissions.owner` grants it.
+ *
+ * @module api_tests/api_test_permissions_owner/ext/main
+ */
+
+import { self } from "@cldmv/slothlet/runtime";
+
+/**
+ * Call the module's own leaf in `session/store.mjs`.
+ * @returns {string} The store's result.
+ * @public
+ * @example
+ * api.launcher.main.activate(); // "created"
+ */
+export function activate() {
+	return self.launcher.session.store.create();
+}
+
+/**
+ * Call the module's own leaf that an explicit deny rule covers in the owner tests.
+ * @returns {string} The store's result.
+ * @public
+ * @example
+ * api.launcher.main.teardown();
+ */
+export function teardown() {
+	return self.launcher.session.store.destroy();
+}
+
+/**
+ * Read the module's own data leaf in `settings/data.mjs`.
+ * @returns {number} The configured limit.
+ * @public
+ * @example
+ * api.launcher.main.limit(); // 5
+ */
+export function limit() {
+	return self.launcher.settings.data.limit;
+}
+
+/**
+ * Call a leaf of the base-loaded tree, which this module does not own.
+ * @returns {string} The base leaf's result.
+ * @public
+ * @example
+ * api.launcher.main.reachBase();
+ */
+export function reachBase() {
+	return self.core.sub.beta.ping();
+}
diff --git a/api_tests/api_test_permissions_owner/ext/session/store.mjs b/api_tests/api_test_permissions_owner/ext/session/store.mjs
new file mode 100644
index 000000000..028e91305
--- /dev/null
+++ b/api_tests/api_test_permissions_owner/ext/session/store.mjs
@@ -0,0 +1,39 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_permissions_owner/ext/session/store.mjs
+ *	@Date: 2026-09-28 12:00:00 -07:00 (1790622000)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 12:00:00 -07:00 (1790622000)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Session store of the owner-grant extension (#509) — a subdirectory of the module.
+ * @module api_tests/api_test_permissions_owner/ext/session/store
+ */
+
+/**
+ * Create a session.
+ * @returns {string} Marker.
+ * @public
+ * @example
+ * api.launcher.session.store.create(); // "created"
+ */
+export function create() {
+	return "created";
+}
+
+/**
+ * Destroy a session.
+ * @returns {string} Marker.
+ * @public
+ * @example
+ * api.launcher.session.store.destroy(); // "destroyed"
+ */
+export function destroy() {
+	return "destroyed";
+}
diff --git a/api_tests/api_test_permissions_owner/ext/settings/data.mjs b/api_tests/api_test_permissions_owner/ext/settings/data.mjs
new file mode 100644
index 000000000..4e576f144
--- /dev/null
+++ b/api_tests/api_test_permissions_owner/ext/settings/data.mjs
@@ -0,0 +1,24 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_permissions_owner/ext/settings/data.mjs
+ *	@Date: 2026-09-28 12:00:00 -07:00 (1790622000)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 12:00:00 -07:00 (1790622000)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Data leaves of the owner-grant extension (#509), read-gated like any terminal value.
+ * @module api_tests/api_test_permissions_owner/ext/settings/data
+ */
+
+/**
+ * Session limit.
+ * @type {number}
+ * @public
+ */
+export const limit = 5;
diff --git a/api_tests/api_test_permissions_owner/other/intruder.mjs b/api_tests/api_test_permissions_owner/other/intruder.mjs
new file mode 100644
index 000000000..b49a21e7a
--- /dev/null
+++ b/api_tests/api_test_permissions_owner/other/intruder.mjs
@@ -0,0 +1,46 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_permissions_owner/other/intruder.mjs
+ *	@Date: 2026-09-28 12:00:00 -07:00 (1790622000)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 12:00:00 -07:00 (1790622000)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview A second module mounted into the extension's namespace (#509).
+ *
+ * @description
+ * Shares the extension's mount path but is added under its own moduleID, so it owns none of the
+ * extension's leaves: the owner grant must not reach across to it.
+ *
+ * @module api_tests/api_test_permissions_owner/other/intruder
+ */
+
+import { self } from "@cldmv/slothlet/runtime";
+
+/**
+ * Call the extension's store leaf.
+ * @returns {string} The store's result.
+ * @public
+ * @example
+ * api.launcher.intruder.poke();
+ */
+export function poke() {
+	return self.launcher.session.store.create();
+}
+
+/**
+ * Read the extension's data leaf.
+ * @returns {number} The limit.
+ * @public
+ * @example
+ * api.launcher.intruder.peek();
+ */
+export function peek() {
+	return self.launcher.settings.data.limit;
+}
diff --git a/docs/PERMISSIONS.md b/docs/PERMISSIONS.md
index d694525cb..493418cc6 100644
--- a/docs/PERMISSIONS.md
+++ b/docs/PERMISSIONS.md
@@ -13,6 +13,7 @@ When permissions are enabled, every inter-module call (`self.payments.charge.pro
 - Same glob pattern syntax as hooks (`*`, `**`, `?`, `{a,b}`, `!negation`)
 - Enforcement before hooks — denied calls never trigger `before:` hooks
 - Self-calls (same source file) always bypass the permission system
+- Opt-in owner grant (`owner: true`) lets a module reach every leaf it owns, across its own directories
 - Most-specific-wins evaluation, tiebroken by rule layer then registration order
 - Compiled-pattern cache for zero-overhead repeat checks
 - Caller/target result cache with automatic invalidation
@@ -31,6 +32,7 @@ When permissions are enabled, every inter-module call (`self.payments.charge.pro
 - [Evaluation Order](#evaluation-order)
 - [Module-Private Exports](#module-private-exports)
 - [Self-Call Bypass](#self-call-bypass)
+- [Owner Grant](#owner-grant)
 - [Read-Level Gating](#read-level-gating)
 - [Hook Permission Gating](#hook-permission-gating)
 - [Event Rules](#event-rules) → [Full Reference](./EVENTS.md)
@@ -74,6 +76,7 @@ const api = await slothlet({
 | `readGating`             | `boolean` | `true`      | When `true` (the default), reading a terminal data value (primitive, `Buffer`, `TypedArray`, `Date`, `Map`, etc.) off a module API path is permission-checked the same way calls are. Set `false` to gate calls only. See [Read-Level Gating](#read-level-gating).                                                                                                                                                                                                                          |
 | `failOpenOnAbsentCaller` | `boolean` | `false`     | When `false` (the default), a call or read made with **no resolvable caller identity** is denied — fail closed. Set `true` to restore the pre-3.12.0 fail-open behavior for such calls. See [Caller Identity & Fail-Closed Enforcement](#caller-identity--fail-closed-enforcement).                                                                                                                                                                                                         |
 | `references.capture`     | `boolean` | `true`      | When `true` (the default), a function read out of the api carries the identity of the module that read it, so it stays enforced as that module wherever it is later invoked. Costs a per-reader object per wrapper read — see the measured overhead below. Set `false` to restore the older behavior, where a reference invoked with no active caller was treated as host-initiated. See [Captured references remember who captured them](#captured-references-remember-who-captured-them). |
+| `owner`                  | `boolean` | `false`     | When `true`, a module may access every leaf it currently owns — across its own subdirectories — wherever `defaultPolicy` would otherwise deny. An explicit deny rule still wins. See [Owner Grant](#owner-grant).                                                                                                                                                                                                                                                                           |
 | `rules`                  | `array`   | `[]`        | Array of rule objects applied at initialization (earliest stacking order)                                                                                                                                                                                                                                                                                                                                                                                                                   |
 
 When `permissions` is not provided or `undefined`, the permission system is **disabled** — `isEnabled()` returns `false` and no permission checks run. Existing users pay zero runtime cost.
@@ -483,6 +486,9 @@ When `checkAccess(callerPath, targetPath)` is called, the `PermissionManager`:
    - Combined score = caller specificity + target specificity (range: 2–6)
 5. **Tiebreak**: Among rules at the same specificity, the higher precedence **layer** wins — `runtime` > `instance` (config) > `manifest` (a module's own `slothlet.module.json` rules) > `builtin` (framework defaults) — and only within a single layer does the **last-registered** rule win. So a composing host's config or runtime rule overrides a module's manifest rule of equal specificity, which overrides a framework built-in.
 6. **No match → default policy**: If no rules match, fall back to `config.permissions.defaultPolicy`.
+7. **Owner grant** (only with `owner: true`): if the default policy just denied, and the caller leaf and the target are currently owned by the same module, allow instead. An explicit rule — allow or deny — that matched in steps 3–5 has already decided, so it is never overridden. See [Owner Grant](#owner-grant).
+
+[Module-private members](#module-private-exports) resolve before step 2 and are not affected by the owner grant.
 
 ### Specificity Examples
 
@@ -540,6 +546,70 @@ export const helper = () => ({ ok: true });
 
 ---
 
+## Owner Grant
+
+A module is rarely one directory. An extension added with a single `api.slothlet.api.add(path, folder, { moduleID })` typically spreads its files over subdirectories — and each subdirectory is its own permission module. The [self-call bypass](#self-call-bypass) covers only the same file, and [private members](#module-private-exports) only the same directory, so under `defaultPolicy: "deny"` every call a module makes between its own directories is denied:
+
+```text
+launcher/                          added as moduleID "launcher-ext" at "launcher"
+├── main.mjs         → launcher.main.activate()   calls self.launcher.session.store.create()
+└── session/
+    └── store.mjs    → launcher.session.store.create()
+```
+
+```javascript
+// defaultPolicy: "deny", no owner grant
+api.launcher.main.activate();
+// PERMISSION_DENIED: caller 'launcher.main.activate' is not permitted to access 'launcher.session.store.create'
+```
+
+Writing rules for this means one allow per module, keyed by api path — which is exactly what a composing host cannot know in advance. `permissions.owner: true` grants it instead:
+
+```javascript
+const api = await slothlet({
+	base: "./api",
+	permissions: { defaultPolicy: "deny", owner: true }
+});
+await api.slothlet.api.add("launcher", "./extensions/launcher", { moduleID: "launcher-ext" });
+
+api.launcher.main.activate(); // "created" — both leaves are owned by "launcher-ext"
+```
+
+**Who owns what.** Ownership is the one slothlet already tracks for `api.slothlet.api.remove()` / `reload()`: every leaf of the initial load is owned by the base module, and every leaf an `api.add()` composes is owned by that call's `moduleID`. A caller leaf owned by module M may access a target — call it or [read it](#read-level-gating) — when M is the target path's **current** owner, regardless of directory or api path. A path with no recorded owner grants nothing; under `mode: "lazy"` a leaf's ownership is recorded when it materializes, which a real call or read always does first, so only a silent query such as `global.checkAccess` about a not-yet-materialized leaf answers `false`.
+
+**Matched by owner, not by path.** A second module mounted into the same namespace owns its own leaves, not the first module's, so it gets nothing:
+
+```javascript
+await api.slothlet.api.add("launcher", "./extensions/tools", { moduleID: "tools" });
+// tools/intruder.mjs → launcher.intruder.poke() calls self.launcher.session.store.create()
+api.launcher.intruder.poke(); // PERMISSION_DENIED — shared path, different owner
+```
+
+**Precedence.** The grant is an implicit allow that stands in for the default policy only:
+
+- An explicit **deny** rule still wins — the grant applies only when no rule matched (or every matching rule's condition failed) and `defaultPolicy` denied.
+- Under `defaultPolicy: "allow"` it changes nothing.
+- It does not open [module-private members](#module-private-exports) across directories; privacy is still per directory.
+- It never covers the framework's reserved roots (`slothlet.*`, `shutdown`, `destroy`), even though the composed tree registers them to the base module.
+
+```javascript
+permissions: {
+	defaultPolicy: "deny",
+	owner: true,
+	rules: [{ caller: "launcher.**", target: "launcher.session.store.destroy", effect: "deny" }]
+}
+// launcher.main.activate() → store.create()   allowed (owner grant)
+// launcher.main.teardown() → store.destroy()  denied  (explicit rule)
+```
+
+**Base-loaded modules.** Everything the initial load composes shares the base module's ownership, so with `owner: true` the base tree's modules may all reach each other. Keep `owner` off (and write rules) when the base tree itself needs internal boundaries, or add the modules that need isolating with their own `moduleID`s.
+
+**Ownership changes follow automatically.** Ownership is read live at every check and the grant is never stored in the [resolved cache](#cache-behavior), so a runtime `api.add`, `api.slothlet.api.remove()`, and scoped or full `reload()` keep it correct with no host bookkeeping.
+
+With `audit: "verbose"`, a granted access emits `permission:owner-allow` (see [Audit Events](#audit-events)).
+
+---
+
 ## Read-Level Gating
 
 Permission enforcement covers **function calls** _and_ **property reads**. Every inter-module call (`self.payments.charge.process(100)`) is checked, and so is reading a terminal data value off a module path (`self.db.secrets.token`) — both against the same rule set. Without read gating, a module exporting a `Buffer`, `TypedArray`, `Date`, primitive, etc. would be readable by any other module regardless of deny rules, because the check otherwise happens only at _invocation_ and a data value has no invocation step.
@@ -772,6 +842,7 @@ The `PermissionManager` emits lifecycle events for enforcement decisions:
 | `permission:self-bypass` | `{ caller, target, filePath, timestamp }`               | A self-call was detected and bypassed   | Always                  |
 | `permission:allowed`     | `{ caller, target, rule, conditionMatched, timestamp }` | A call was explicitly allowed by a rule | `audit: "verbose"` only |
 | `permission:default`     | `{ caller, target, policy, timestamp }`                 | No rule matched; default policy applied | `audit: "verbose"` only |
+| `permission:owner-allow` | `{ caller, target, moduleID, timestamp }`               | The [owner grant](#owner-grant) allowed | `audit: "verbose"` only |
 
 A decision reached through [`global.checkCall`](#checkcall-vs-checkaccess) emits the same events with an extra `via: "checkCall"` field in the payload, so an audit consumer can tell a query from the gate of a real call.
 
diff --git a/docs/generated/API.md b/docs/generated/API.md
index 21434c21b..b68f68440 100644
--- a/docs/generated/API.md
+++ b/docs/generated/API.md
@@ -233,6 +233,17 @@ Only relevant when modules are registered via <code>api.slothlet.api.add()</code
 | <a id="typedef_module_at_cldmv_slash_slothlet_SlothletOptions_prop_api-collision"></a>[api.collision] | <code>string \| Object</code> | <code>"merge"</code> | Collision strategy when two modules export the same path. Modes: `"merge"` (default), `"merge-replace"`, `"replace"`, `"skip"`, `"warn"`, `"error"`. Pass an object to use different strategies for the initial build vs. runtime `api.slothlet.api.add()` calls. |
 | <a id="typedef_module_at_cldmv_slash_slothlet_SlothletOptions_prop_api-mutations"></a>[api.mutations] | <code>object</code> | <code>{add:true,remove:true,reload:true}</code> | Enable or disable runtime mutation methods on `api.slothlet.api`. Object with boolean keys `add`, `remove`, `reload` (all default `true`). |
 | <a id="typedef_module_at_cldmv_slash_slothlet_SlothletOptions_prop_hook"></a>[hook] | <code>boolean \| string \| object</code> | <code>false</code> | Hook system configuration. <ul> <li>`false` — disabled (default).</li> <li>`true` — enabled, all endpoints.</li> <li>`string` — enabled with a default glob pattern.</li> <li>`object` — full control: `{ enabled: boolean, pattern?: string, suppressErrors?: boolean }`.</li> </ul> |
+| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletOptions_prop_permissions"></a>[permissions] | <code>object</code> |  | Permission system configuration. Omit it and the system is off entirely. See <a href="docs/PERMISSIONS.md#configuration">PERMISSIONS.md</a>. |
+| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletOptions_prop_permissions-defaultPolicy"></a>[permissions.defaultPolicy] | <code>"allow" \| "deny"</code> | <code>"allow"</code> | Fallback when no rule matches. |
+| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletOptions_prop_permissions-enabled"></a>[permissions.enabled] | <code>boolean</code> | <code>true</code> | Global enforcement toggle. |
+| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletOptions_prop_permissions-audit"></a>[permissions.audit] | <code>"default" \| "verbose" \| boolean</code> | <code>"default"</code> | Audit level; `true`/`false` normalize to `"default"`. |
+| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletOptions_prop_permissions-readGating"></a>[permissions.readGating] | <code>boolean</code> | <code>true</code> | Gate terminal data-value reads the same way calls are gated. |
+| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletOptions_prop_permissions-failOpenOnAbsentCaller"></a>[permissions.failOpenOnAbsentCaller] | <code>boolean</code> | <code>false</code> | Restore the legacy fail-open treatment of calls with no resolvable caller. |
+| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletOptions_prop_permissions-owner"></a>[permissions.owner] | <code>boolean</code> | <code>false</code> | Owner grant (#509): a caller leaf may access any target leaf currently owned by the same module (the initial load's base module, or an `api.add()`'s `moduleID`) — across that module's own directories — wherever `defaultPolicy` would otherwise deny. Matched by owner, not path, so another module mounted into the same namespace gets nothing; an explicit deny rule still wins. See <a href="docs/PERMISSIONS.md#owner-grant">PERMISSIONS.md</a>. |
+| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletOptions_prop_permissions-references"></a>[permissions.references] | <code>object</code> |  | Options for api functions held as references (`{ capture?: boolean }`). |
+| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletOptions_prop_permissions-private"></a>[permissions.private] | <code>object</code> |  | Module-privacy host policy (`{ host?: "deny"\|"allow" }`). |
+| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletOptions_prop_permissions-rules"></a>[permissions.rules] | <code>Array.<object></code> |  | Initial `{ caller, target, effect, condition?, requires? }` rules. |
+| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletOptions_prop_permissions-events"></a>[permissions.events] | <code>object</code> |  | Event-rule section (`{ default?: "deny"\|"notify"\|"allow", rules?: Array<object> }`). |
 | <a id="typedef_module_at_cldmv_slash_slothlet_SlothletOptions_prop_debug"></a>[debug] | <code>boolean \| object</code> | <code>false</code> | Enable verbose internal logging. `true` enables all categories. Pass an object with sub-keys `builder`, `api`, `index`, `modes`, `wrapper`, `ownership`, `context` to target specific subsystems. |
 | <a id="typedef_module_at_cldmv_slash_slothlet_SlothletOptions_prop_silent"></a>[silent] | <code>boolean</code> | <code>false</code> | Suppress all console output from slothlet (warnings, deprecations). Does not affect `debug`. |
 | <a id="typedef_module_at_cldmv_slash_slothlet_SlothletOptions_prop_diagnostics"></a>[diagnostics] | <code>boolean</code> | <code>false</code> | Enable the `api.slothlet.diag.*` introspection namespace. Intended for testing; do not enable in production. |
diff --git a/src/lib/handlers/permission-manager.mjs b/src/lib/handlers/permission-manager.mjs
index eaa0682bb..6abb78f27 100644
--- a/src/lib/handlers/permission-manager.mjs
+++ b/src/lib/handlers/permission-manager.mjs
@@ -117,6 +117,14 @@ function runtime_isPrivateName(targetPath) {
 	return targetPath.charCodeAt(cut + 1) === 95; // "_"
 }
 
+/**
+ * Framework-reserved api roots (#509). The composed tree registers them to the base module, but they
+ * are framework surface rather than module code, so the owner grant never covers them.
+ * @type {ReadonlySet<string>}
+ * @internal
+ */
+const FRAMEWORK_ROOTS = Object.freeze(new Set(["slothlet", "shutdown", "destroy"]));
+
 /**
  * Whether two source files belong to the same module — the same directory of files (#260).
  *
@@ -253,6 +261,15 @@ export class PermissionManager extends ComponentBase {
 	 */
 	#privateHost = "deny";
 
+	/**
+	 * Owner grant (#509): when true, a caller leaf may access any target leaf whose CURRENT owner
+	 * (per the ownership registry) is the caller leaf's own current owner, wherever the default policy
+	 * would otherwise deny. Opt in via `permissions.owner: true`.
+	 * @type {boolean}
+	 * @private
+	 */
+	#owner = false;
+
 	/**
 	 * Event rules (#407): the separate three-level (deny/notify/allow) rule pool for the event
 	 * system, distinct from the binary call/hook {@link #rules} above. Keyed by rule id.
@@ -355,6 +372,8 @@ export class PermissionManager extends ComponentBase {
 			this.#capture = permConfig.references?.capture !== false;
 			// Module privacy (#260): whether the HOST may read `_`/`__` exports. Secure default deny.
 			this.#privateHost = permConfig.private?.host === "allow" ? "allow" : "deny";
+			// Owner grant (#509): a module may reach every leaf it owns. Opt-in; normalization guarantees a boolean.
+			this.#owner = permConfig.owner === true;
 
 			// Register config-level rules (earliest in stacking order)
 			if (Array.isArray(permConfig.rules)) {
@@ -1783,6 +1802,7 @@ export class PermissionManager extends ComponentBase {
 		this.#defaultPolicy = "allow";
 		this.#audit = "default";
 		this.#readGating = false;
+		this.#owner = false;
 	}
 
 	// ──────────────────── Private methods ────────────────────
@@ -2057,19 +2077,62 @@ export class PermissionManager extends ComponentBase {
 
 		// Check resolved cache
 		const cacheKey = `${callerPath}::${targetPath}`;
+		let entry;
 		if (useCache && this.#resolvedCache.has(cacheKey)) {
-			return this.#resolvedCache.get(cacheKey);
+			entry = this.#resolvedCache.get(cacheKey);
+		} else {
+			// Evaluate rules — returns { allowed, event, payload, hasConditionalRules }
+			entry = this.#evaluate(callerPath, targetPath, runtimeContext, callMeta);
+			// Do NOT cache when any matching rule has a condition — results vary by runtime context
+			if (useCache && !entry.hasConditionalRules) {
+				this.#resolvedCache.set(cacheKey, entry);
+			}
 		}
 
-		// Evaluate rules — returns { allowed, event, payload, hasConditionalRules }
-		const entry = this.#evaluate(callerPath, targetPath, runtimeContext, callMeta);
-		// Do NOT cache when any matching rule has a condition — results vary by runtime context
-		if (useCache && !entry.hasConditionalRules) {
-			this.#resolvedCache.set(cacheKey, entry);
+		// Owner grant (#509): an implicit allow that stands in for the DEFAULT policy only — a matching
+		// explicit rule (allow or deny) has already decided, so a deny rule always wins over it. Applied
+		// after the cache, never stored in it: ownership moves with add/remove/reload without touching any
+		// rule, so the cached record stays the rules-only verdict and ownership is read live each time.
+		if (this.#owner && !entry.allowed && entry.event === "permission:default") {
+			const moduleID = this.#sharedOwner(callerPath, targetPath);
+			if (moduleID !== null) {
+				return {
+					allowed: true,
+					event: "permission:owner-allow",
+					payload: { caller: callerPath, target: targetPath, moduleID }
+				};
+			}
 		}
 		return entry;
 	}
 
+	/**
+	 * The module that currently owns both `callerPath` and `targetPath`, or null (#509).
+	 *
+	 * @param {string|null} callerPath - Caller leaf's api path.
+	 * @param {string} targetPath - Target api path.
+	 * @returns {string|null} The shared owner's moduleID, or null when the owners differ or either is unknown.
+	 * @private
+	 *
+	 * @description
+	 * Ownership is the registry's CURRENT owner of each exact path — the module whose contribution is
+	 * live there after collision handling (the initial load's base module, or the moduleID of an
+	 * `api.add()`). Matching by owner rather than by path keeps a shared mount honest: a second module
+	 * merged into the same namespace owns its own leaves, not the first module's. A path with no
+	 * ownership entry grants nothing (fail closed) — the grant never climbs to an ancestor namespace,
+	 * whose current owner under a shared mount is whichever module registered it last. The framework's
+	 * reserved roots (`slothlet.*`, `shutdown`, `destroy`) are registered to the base module as part of
+	 * the composed tree, but they are framework surface, not module code, so they are never granted.
+	 */
+	#sharedOwner(callerPath, targetPath) {
+		if (FRAMEWORK_ROOTS.has(String(targetPath).split(".", 1)[0])) return null;
+		const ownership = this.slothlet.handlers.ownership;
+		// A caller path with no ownership entry (null/empty, or a path nothing registered) owns nothing.
+		const callerOwner = ownership.getCurrentOwner(callerPath)?.moduleID;
+		if (!callerOwner) return null;
+		return ownership.getCurrentOwner(targetPath)?.moduleID === callerOwner ? callerOwner : null;
+	}
+
 	/**
 	 * Evaluate all rules for a caller→target pair.
 	 * Most-specific-wins; tiebreak: last-registered wins.
diff --git a/src/lib/helpers/config.mjs b/src/lib/helpers/config.mjs
index a1a56f502..8166d6dc3 100644
--- a/src/lib/helpers/config.mjs
+++ b/src/lib/helpers/config.mjs
@@ -1197,12 +1197,15 @@ export class Config extends ComponentBase {
 	 * @param {boolean} [permissions.readGating=true] - When `true` (the default), reading a terminal
 	 *   data value (primitive, Buffer, TypedArray, Date, Map, etc.) off a module API path is
 	 *   permission-checked, the same way calls are. Set `false` to opt out and gate calls only.
+	 * @param {boolean} [permissions.owner=false] - When `true`, a caller leaf may access any target leaf
+	 *   currently owned by the same module (the moduleID of the initial load or of an `api.add()`), across
+	 *   directories, where the default policy would otherwise deny. An explicit deny rule still wins (#509).
 	 * @param {Array<object>} [permissions.rules=[]] - Initial permission rules.
 	 * @returns {object|null} Normalized permissions config, or null when permissions is absent or not an object.
 	 *
 	 * @example
 	 * normalizePermissions({ defaultPolicy: "deny", rules: [{ caller: "**", target: "admin.**", effect: "deny" }] });
-	 * // => { defaultPolicy: "deny", enabled: true, audit: "default", readGating: true, rules: [...] }
+	 * // => { defaultPolicy: "deny", enabled: true, audit: "default", readGating: true, owner: false, rules: [...] }
 	 */
 	normalizePermissions(permissions) {
 		if (!permissions || typeof permissions !== "object") {
@@ -1301,6 +1304,27 @@ export class Config extends ComponentBase {
 			);
 		}
 
+		// Validate owner (#509) — lets a module reach every leaf it owns, across its own directories,
+		// where the default policy would otherwise deny. Defaults to false (opt-in).
+		let owner;
+		if (permissions.owner === true) {
+			owner = true;
+		} else if (permissions.owner === false || permissions.owner === undefined) {
+			owner = false;
+		} else {
+			throw new SlothletError(
+				"INVALID_CONFIG",
+				{
+					option: "permissions.owner",
+					value: permissions.owner,
+					expected: "boolean",
+					hint: "HINT_INVALID_CONFIG"
+				},
+				null,
+				{ validationError: true }
+			);
+		}
+
 		// Validate references.capture — controls whether a function read out of the api keeps the identity of
 		// the module that read it, so it stays enforced as that module when invoked later from a boundary
 		// carrying no caller. Defaults to true. Set false to restore the older behaviour, where such a call
@@ -1449,6 +1473,7 @@ export class Config extends ComponentBase {
 			audit,
 			readGating,
 			failOpenOnAbsentCaller,
+			owner,
 			references: { capture },
 			private: { host: privateHost },
 			rules,
diff --git a/src/slothlet.mjs b/src/slothlet.mjs
index e959cb283..2e4b6fa3a 100644
--- a/src/slothlet.mjs
+++ b/src/slothlet.mjs
@@ -1574,6 +1574,20 @@ export default slothlet;
  *   - `true` — enabled, all endpoints.
  *   - `string` — enabled with a default glob pattern.
  *   - `object` — full control: `{ enabled: boolean, pattern?: string, suppressErrors?: boolean }`.
+ * @property {object} [permissions] - Permission system configuration. Omit it and the system is off entirely. See [PERMISSIONS.md](docs/PERMISSIONS.md#configuration).
+ * @property {"allow"|"deny"} [permissions.defaultPolicy="allow"] - Fallback when no rule matches.
+ * @property {boolean} [permissions.enabled=true] - Global enforcement toggle.
+ * @property {"default"|"verbose"|boolean} [permissions.audit="default"] - Audit level; `true`/`false` normalize to `"default"`.
+ * @property {boolean} [permissions.readGating=true] - Gate terminal data-value reads the same way calls are gated.
+ * @property {boolean} [permissions.failOpenOnAbsentCaller=false] - Restore the legacy fail-open treatment of calls with no resolvable caller.
+ * @property {boolean} [permissions.owner=false] - Owner grant (#509): a caller leaf may access any target leaf currently owned
+ *   by the same module (the initial load's base module, or an `api.add()`'s `moduleID`) — across that module's own directories —
+ *   wherever `defaultPolicy` would otherwise deny. Matched by owner, not path, so another module mounted into the same namespace
+ *   gets nothing; an explicit deny rule still wins. See [PERMISSIONS.md](docs/PERMISSIONS.md#owner-grant).
+ * @property {object} [permissions.references] - Options for api functions held as references (`{ capture?: boolean }`).
+ * @property {object} [permissions.private] - Module-privacy host policy (`{ host?: "deny"|"allow" }`).
+ * @property {Array<object>} [permissions.rules] - Initial `{ caller, target, effect, condition?, requires? }` rules.
+ * @property {object} [permissions.events] - Event-rule section (`{ default?: "deny"|"notify"|"allow", rules?: Array<object> }`).
  * @property {boolean|object} [debug=false] - Enable verbose internal logging. `true` enables all categories.
  *   Pass an object with sub-keys `builder`, `api`, `index`, `modes`, `wrapper`, `ownership`, `context` to target specific subsystems.
  * @property {boolean} [silent=false] - Suppress all console output from slothlet (warnings, deprecations). Does not affect `debug`.
diff --git a/tests/vitests/suites/permissions/permissions-owner.test.vitest.mjs b/tests/vitests/suites/permissions/permissions-owner.test.vitest.mjs
new file mode 100644
index 000000000..840c55158
--- /dev/null
+++ b/tests/vitests/suites/permissions/permissions-owner.test.vitest.mjs
@@ -0,0 +1,255 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/permissions/permissions-owner.test.vitest.mjs
+ *	@Date: 2026-09-28 12:00:00 -07:00 (1790622000)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 12:00:00 -07:00 (1790622000)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview `permissions.owner` (#509): a module may reach every leaf it owns.
+ *
+ * @description
+ * A subdirectory is its own permission module, so under `defaultPolicy: "deny"` a module added with
+ * one `api.add(path, folder, { moduleID })` cannot call its own leaves across directories. With
+ * `permissions.owner: true`, a caller leaf owned by module M may access any target leaf whose CURRENT
+ * owner is M — matched by owner, never by path, so a second module mounted into the same namespace
+ * gets nothing. The grant is an implicit allow in place of the default policy: an explicit deny rule
+ * still wins, and under `defaultPolicy: "allow"` nothing changes.
+ *
+ * Fixture (`api_tests/api_test_permissions_owner`):
+ * - `base/core/alpha.mjs` → `core.alpha.*`, calls `core.sub.beta.ping` (base-loaded, own subdirectory)
+ * - `ext/main.mjs` → `launcher.main.*` (added as moduleID "ext" at "launcher")
+ * - `ext/session/store.mjs` → `launcher.session.store.{create,destroy}`
+ * - `ext/settings/data.mjs` → `launcher.settings.data.limit` (data leaf)
+ * - `other/intruder.mjs` → `launcher.intruder.*` (moduleID "other", same mount)
+ */
+
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, it, expect, afterEach } from "vitest";
+import slothlet from "@cldmv/slothlet";
+import { getMatrixConfigs } from "../../setup/vitest-helper.mjs";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const FIXTURE = path.resolve(__dirname, "../../../../api_tests/api_test_permissions_owner");
+const BASE = `${FIXTURE}/base`;
+const EXT = `${FIXTURE}/ext`;
+const OTHER = `${FIXTURE}/other`;
+
+/**
+ * Run `fn` and report its settled outcome: the resolved value, or the error code it rejected with.
+ * @param {function(): *} fn - Call to make.
+ * @returns {Promise<{ ok: boolean, value?: *, code?: string }>} Outcome.
+ */
+async function outcome(fn) {
+	try {
+		return { ok: true, value: await fn() };
+	} catch (err) {
+		return { ok: false, code: err?.code };
+	}
+}
+
+describe.each(getMatrixConfigs())("Permissions > owner grant (#509) > $name", ({ config }) => {
+	let api;
+
+	afterEach(async () => {
+		if (api) await api.shutdown();
+		api = null;
+	});
+
+	/**
+	 * Build an instance over the base fixture and mount the extension (+ optionally the co-mounted module).
+	 * @param {object} permissions - `permissions` config block.
+	 * @param {{ other?: boolean }} [opts] - Whether to mount the second module into the same namespace.
+	 * @returns {Promise<object>} The api.
+	 */
+	async function build(permissions, { other = false } = {}) {
+		api = await slothlet({ ...config, base: BASE, permissions });
+		await api.slothlet.api.add("launcher", EXT, { moduleID: "ext" });
+		if (other) await api.slothlet.api.add("launcher", OTHER, { moduleID: "other" });
+		return api;
+	}
+
+	it("allows a module's cross-subdirectory call to its own leaf with owner: true", async () => {
+		await build({ defaultPolicy: "deny", owner: true });
+		expect(await outcome(() => api.launcher.main.activate())).toEqual({ ok: true, value: "created" });
+	});
+
+	it("denies the same cross-subdirectory call without the option", async () => {
+		await build({ defaultPolicy: "deny" });
+		expect(await outcome(() => api.launcher.main.activate())).toEqual({ ok: false, code: "PERMISSION_DENIED" });
+	});
+
+	it("denies it with owner: false (the default)", async () => {
+		await build({ defaultPolicy: "deny", owner: false });
+		expect(await outcome(() => api.launcher.main.activate())).toEqual({ ok: false, code: "PERMISSION_DENIED" });
+	});
+
+	it("read-gates a module's own data leaf in a subdirectory: allowed with owner, denied without", async () => {
+		await build({ defaultPolicy: "deny", owner: true });
+		expect(await outcome(() => api.launcher.main.limit())).toEqual({ ok: true, value: 5 });
+		await api.shutdown();
+
+		await build({ defaultPolicy: "deny" });
+		expect(await outcome(() => api.launcher.main.limit())).toEqual({ ok: false, code: "PERMISSION_DENIED" });
+	});
+
+	it("gives a second module mounted into the same namespace nothing", async () => {
+		await build({ defaultPolicy: "deny", owner: true }, { other: true });
+		// The extension still reaches its own leaves with the other module merged in beside them.
+		expect(await outcome(() => api.launcher.main.activate())).toEqual({ ok: true, value: "created" });
+		expect(await outcome(() => api.launcher.main.limit())).toEqual({ ok: true, value: 5 });
+		// The co-mounted module shares the path, not the owner: calls and reads are both denied.
+		expect(await outcome(() => api.launcher.intruder.poke())).toEqual({ ok: false, code: "PERMISSION_DENIED" });
+		expect(await outcome(() => api.launcher.intruder.peek())).toEqual({ ok: false, code: "PERMISSION_DENIED" });
+	});
+
+	it("an explicit deny rule on one of the module's own leaves still denies it", async () => {
+		await build({
+			defaultPolicy: "deny",
+			owner: true,
+			rules: [{ caller: "launcher.**", target: "launcher.session.store.destroy", effect: "deny" }]
+		});
+		expect(await outcome(() => api.launcher.main.teardown())).toEqual({ ok: false, code: "PERMISSION_DENIED" });
+		// The rule is scoped to one leaf; the module's other own leaves stay reachable.
+		expect(await outcome(() => api.launcher.main.activate())).toEqual({ ok: true, value: "created" });
+	});
+
+	it("an explicit deny rule added at runtime overrides the grant too", async () => {
+		await build({ defaultPolicy: "deny", owner: true });
+		expect(await outcome(() => api.launcher.main.activate())).toEqual({ ok: true, value: "created" });
+		api.slothlet.permissions.addRule({ caller: "launcher.main.**", target: "launcher.session.**", effect: "deny" });
+		expect(await outcome(() => api.launcher.main.activate())).toEqual({ ok: false, code: "PERMISSION_DENIED" });
+	});
+
+	it("grants base-loaded modules their own cross-directory calls, and nothing across owners", async () => {
+		await build({ defaultPolicy: "deny", owner: true });
+		// Everything the initial load composes is owned by the base module.
+		expect(await outcome(() => api.core.alpha.callBeta())).toEqual({ ok: true, value: "pong" });
+		// Base → added extension and extension → base cross owners: denied.
+		expect(await outcome(() => api.core.alpha.reachExt())).toEqual({ ok: false, code: "PERMISSION_DENIED" });
+		expect(await outcome(() => api.launcher.main.reachBase())).toEqual({ ok: false, code: "PERMISSION_DENIED" });
+	});
+
+	it("denies base-loaded cross-directory calls without the option", async () => {
+		await build({ defaultPolicy: "deny" });
+		expect(await outcome(() => api.core.alpha.callBeta())).toEqual({ ok: false, code: "PERMISSION_DENIED" });
+	});
+
+	it("changes nothing under defaultPolicy: \"allow\"", async () => {
+		for (const owner of [false, true]) {
+			await build(
+				{
+					defaultPolicy: "allow",
+					owner,
+					rules: [{ caller: "launcher.**", target: "launcher.session.store.destroy", effect: "deny" }]
+				},
+				{ other: true }
+			);
+			expect(await outcome(() => api.launcher.main.activate())).toEqual({ ok: true, value: "created" });
+			expect(await outcome(() => api.launcher.intruder.poke())).toEqual({ ok: true, value: "created" });
+			expect(await outcome(() => api.core.alpha.reachExt())).toEqual({ ok: true, value: "created" });
+			expect(await outcome(() => api.launcher.main.teardown())).toEqual({ ok: false, code: "PERMISSION_DENIED" });
+			await api.shutdown();
+			api = null;
+		}
+	});
+
+	it("keeps the grant correct after the co-mounted module is removed", async () => {
+		await build({ defaultPolicy: "deny", owner: true }, { other: true });
+		expect(await outcome(() => api.launcher.intruder.poke())).toEqual({ ok: false, code: "PERMISSION_DENIED" });
+
+		await api.slothlet.api.remove("other");
+		expect(api.launcher.intruder).toBeUndefined();
+		expect(await outcome(() => api.launcher.main.activate())).toEqual({ ok: true, value: "created" });
+		expect(await outcome(() => api.launcher.main.limit())).toEqual({ ok: true, value: 5 });
+		expect(await outcome(() => api.core.alpha.reachExt())).toEqual({ ok: false, code: "PERMISSION_DENIED" });
+	});
+
+	it("tracks the new owner after the module is removed and its folder re-added under another moduleID", async () => {
+		await build({ defaultPolicy: "deny", owner: true }, { other: true });
+		expect(await outcome(() => api.launcher.main.activate())).toEqual({ ok: true, value: "created" });
+
+		await api.slothlet.api.remove("ext");
+		await api.slothlet.api.add("launcher", EXT, { moduleID: "ext2" });
+		expect(await outcome(() => api.launcher.main.activate())).toEqual({ ok: true, value: "created" });
+		// The co-mounted module still owns none of it.
+		expect(await outcome(() => api.launcher.intruder.poke())).toEqual({ ok: false, code: "PERMISSION_DENIED" });
+	});
+
+	it("keeps the grant correct across a scoped reload", async () => {
+		await build({ defaultPolicy: "deny", owner: true });
+		expect(await outcome(() => api.launcher.main.activate())).toEqual({ ok: true, value: "created" });
+
+		await api.slothlet.api.reload("ext");
+		expect(await outcome(() => api.launcher.main.activate())).toEqual({ ok: true, value: "created" });
+		expect(await outcome(() => api.launcher.main.limit())).toEqual({ ok: true, value: 5 });
+		expect(await outcome(() => api.launcher.main.reachBase())).toEqual({ ok: false, code: "PERMISSION_DENIED" });
+		expect(await outcome(() => api.core.alpha.reachExt())).toEqual({ ok: false, code: "PERMISSION_DENIED" });
+	});
+
+	it("keeps the grant correct across a full reload", async () => {
+		await build({ defaultPolicy: "deny", owner: true }, { other: true });
+		expect(await outcome(() => api.launcher.main.activate())).toEqual({ ok: true, value: "created" });
+
+		const reloaded = await api.slothlet.reload();
+		if (reloaded) api = reloaded;
+		expect(await outcome(() => api.launcher.main.activate())).toEqual({ ok: true, value: "created" });
+		expect(await outcome(() => api.core.alpha.callBeta())).toEqual({ ok: true, value: "pong" });
+		expect(await outcome(() => api.launcher.intruder.poke())).toEqual({ ok: false, code: "PERMISSION_DENIED" });
+		expect(await outcome(() => api.core.alpha.reachExt())).toEqual({ ok: false, code: "PERMISSION_DENIED" });
+	});
+
+	it("answers silent checkAccess queries by current owner, and never grants the framework surface", async () => {
+		await build({ defaultPolicy: "deny", owner: true }, { other: true });
+		// Ownership is recorded as leaves compose; under lazy mode that is on first use, so use them first.
+		expect(await outcome(() => api.launcher.main.activate())).toEqual({ ok: true, value: "created" });
+		expect(await outcome(() => api.core.alpha.callBeta())).toEqual({ ok: true, value: "pong" });
+		const check = (caller, target) => api.slothlet.permissions.global.checkAccess(caller, target);
+		expect(check("launcher.main.activate", "launcher.session.store.create")).toBe(true);
+		expect(check("core.alpha.callBeta", "core.sub.beta.ping")).toBe(true);
+		expect(check("launcher.intruder.poke", "launcher.session.store.create")).toBe(false);
+		// A caller or a target nothing registered has no owner, so it is never granted.
+		expect(check("no.such.caller", "launcher.session.store.create")).toBe(false);
+		expect(check("launcher.main.activate", "launcher.no.such.target")).toBe(false);
+		// The reserved roots belong to the base tree in the ownership registry but are framework surface.
+		expect(check("core.alpha.callBeta", "slothlet.metadata.get")).toBe(false);
+		expect(check("core.alpha.callBeta", "shutdown")).toBe(false);
+	});
+
+	it("emits permission:owner-allow for a granted access under audit: \"verbose\"", async () => {
+		await build({ defaultPolicy: "deny", owner: true, audit: "verbose" });
+		const seen = [];
+		api.slothlet.lifecycle.on("permission:owner-allow", (data) => {
+			seen.push(data);
+		});
+		expect(await outcome(() => api.launcher.main.activate())).toEqual({ ok: true, value: "created" });
+		// Lifecycle delivery is asynchronous.
+		await new Promise((resolve) => setTimeout(resolve, 0));
+		const hit = seen.find((e) => e.caller === "launcher.main.activate" && String(e.target).startsWith("launcher.session"));
+		expect(hit).toBeDefined();
+		expect(hit.moduleID).toEqual(expect.any(String));
+	});
+});
+
+describe("Permissions > owner grant (#509) > config validation", () => {
+	it.each([["yes"], [1], [null], [{}]])("rejects owner: %j with INVALID_CONFIG", async (value) => {
+		await expect(slothlet({ base: BASE, permissions: { defaultPolicy: "deny", owner: value } })).rejects.toMatchObject({
+			code: "INVALID_CONFIG"
+		});
+	});
+
+	it("accepts owner: true and owner: false", async () => {
+		for (const owner of [true, false]) {
+			const inst = await slothlet({ base: BASE, permissions: { defaultPolicy: "deny", owner } });
+			expect(typeof inst.core.alpha.callBeta).toBe("function");
+			await inst.shutdown();
+		}
+	});
+});
diff --git a/types/src/lib/handlers/permission-manager.d.mts b/types/src/lib/handlers/permission-manager.d.mts
index daeb14a15..e0678a7be 100644
--- a/types/src/lib/handlers/permission-manager.d.mts
+++ b/types/src/lib/handlers/permission-manager.d.mts
@@ -295,9 +295,14 @@ export class PermissionManager extends ComponentBase {
      * @param {PermissionCallMeta|null} [callMeta=null] - Call/construct metadata (#455): `{ args, target }`
      *   from the invocation, forwarded to function conditions as their second argument. Null for reads,
      *   hooks, the internal control surface, and silent queries.
-     * @param {{ principalGrace?: boolean }|null} [options=null] - Enforcement options.
+     * @param {{ principalGrace?: boolean, moduleCaller?: boolean, via?: string }|null} [options=null] - Enforcement options.
      * @param {boolean} [options.principalGrace=false] - Accept a principal whose epoch is current even if its
      *   `maxAge` has elapsed (#459). Set only by a promoted call re-enforcing right after its resolve.
+     * @param {boolean} [options.moduleCaller=false] - The caller is a module even though no source file is
+     *   known for it (#508). A module-private target is then denied outright instead of being judged by
+     *   the `permissions.private.host` policy, which is what a null `callerFilePath` otherwise means.
+     * @param {string} [options.via] - Origin marker added to the audit payload (`via: "checkCall"`), so an
+     *   audit consumer can tell a query from the gate of a real call.
      * @returns {boolean} True if access is allowed.
      * @example
      * if (!pm.enforceAccess("payments.charge", "db.write", "/src/pay.mjs", "/src/db.mjs")) {
@@ -306,7 +311,38 @@ export class PermissionManager extends ComponentBase {
      */
     enforceAccess(callerPath: string, targetPath: string, callerFilePath?: string | null, targetFilePath?: string | null, runtimeContext?: object | null, callMeta?: PermissionCallMeta | null, options?: {
         principalGrace?: boolean;
+        moduleCaller?: boolean;
+        via?: string;
     } | null): boolean;
+    /**
+     * Call-gate query (#508): would `callerPath` be allowed to CALL `targetPath` with `args`? The
+     * audited, argument-aware twin of {@link checkAccess} — it evaluates exactly what the real call gate
+     * evaluates, for a supplied caller identity, without invoking anything.
+     *
+     * - Function conditions receive `callMeta = { args, target: targetPath }`, the shape the call gate
+     *   builds, so a rule that authorizes on the resource named in the call answers correctly.
+     * - The caller is a MODULE with no source file: the self-call bypass never applies, and a
+     *   module-private (`_`-prefixed) target is denied outright rather than judged by the
+     *   `permissions.private.host` policy.
+     * - A `requires` rule whose principal is stale is resolved first and the decision re-evaluated
+     *   with principal grace, mirroring a promoted call (#459). Only then is the result a Promise; the
+     *   fast path (nothing stale) answers synchronously.
+     * - Audit events emit as for a real call (`permission:denied` always, `allowed`/`default` under
+     *   `audit: "verbose"`), with `via: "checkCall"` in the payload so a probing peer is visible.
+     * - Disabled enforcement answers `true`, like {@link checkAccess}.
+     *
+     * @param {string} callerPath - The supplied caller's api path (non-empty).
+     * @param {string} targetPath - The target api path being called (non-empty).
+     * @param {Array<*>} [args=[]] - The arguments of the call being asked about; omit for an argument-less call.
+     * @param {object|null} [runtimeContext=null] - Per-request ALS context for condition evaluation.
+     * @returns {boolean|Promise<boolean>} The gate's decision; a Promise only when a stale principal had to be resolved.
+     * @throws {SlothletError} INVALID_ARGUMENT when `callerPath` / `targetPath` is not a non-empty string
+     *   or `args` is neither an array nor null/undefined.
+     * @example
+     * const ok = pm.checkCall("client.app", "project.files.list", ["p1"], { user: "u1" });
+     * if (ok instanceof Promise) await ok;
+     */
+    checkCall(callerPath: string, targetPath: string, args?: Array<any>, runtimeContext?: object | null): boolean | Promise<boolean>;
     /**
      * Enforce whether a caller may register or fire a hook of `hookType` on `hookPath`.
      *
@@ -507,10 +543,11 @@ export class PermissionManager extends ComponentBase {
  * authorize on the resource named in the call itself, not just ambient context (#455).
  *
  * Provided only at the call and construct enforcement gates — where the invocation's arguments
- * exist. Read gating, hook gating, event delivery, the internal `slothlet.*` control surface, and
- * silent queries evaluate conditions with `callMeta === null`, so a function condition that reads
- * `callMeta.args` must guard for its absence (or the rule must only match targets that always gate
- * at a call/construct site).
+ * exist — and by the call-gate query {@link PermissionManager#checkCall} (#508), which is handed the
+ * arguments it should evaluate against. Read gating, hook gating, event delivery, the internal
+ * `slothlet.*` control surface, and silent queries evaluate conditions with `callMeta === null`, so a
+ * function condition that reads `callMeta.args` must guard for its absence (or the rule must only
+ * match targets that always gate at a call/construct site).
  */
 export type PermissionCallMeta = {
     /**
diff --git a/types/src/lib/handlers/permission-manager.d.mts.map b/types/src/lib/handlers/permission-manager.d.mts.map
index 42a04f6e6..bac655d28 100644
--- a/types/src/lib/handlers/permission-manager.d.mts.map
+++ b/types/src/lib/handlers/permission-manager.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"permission-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/permission-manager.mjs"],"names":[],"mappings":"AA8KA;;;;;;;GAOG;AACH;IACC;;;;OAIG;IACH,yBAHU,MAAM,CAG8B;IA0I9C;;;;;;OAMG;IACH,sBAJW,MAAM,EA8FhB;IAED;;;;;;;;;;;;;OAaG;IACH,cAVG;QAAqB,MAAM,EAAnB,MAAM;QACO,MAAM,EAAnB,MAAM;QACO,MAAM,EAAnB,MAAM;KACd,kBAAQ,MAAM,GAAC,IAAI,WACX,MAAM,GAAC,IAAI,iBACT,MAAM,CAiDlB;IAED;;;;;;;;;;OAUG;IACH,mBAPW,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,OAAO,CAmCnB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,mBAZG;QAAqB,MAAM,EAAnB,MAAM;QACO,KAAK,EAAlB,MAAM;QACwB,MAAM,EAApC,MAAM,GAAC,QAAQ,GAAC,OAAO;QACuB,SAAS;KAC/D,kBAAQ,MAAM,GAAC,IAAI,WACX,MAAM,GAAC,IAAI,UACX,MAAM,GAAC,IAAI,GACT,MAAM,CAqClB;IAED;;;;;;;;OAQG;IACH,wBALW,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,OAAO,CAiBnB;IAED;;;;;;;;;;OAUG;IACH,kCALW,MAAM,GAAC,IAAI,aACX,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,MAAM,GAAC,QAAQ,GAAC,OAAO,CA0BnC;IAED;;;;OAIG;IACH,uBAFa,MAAM,CAIlB;IAED;;;;;OAKG;IACH,gCAFa,OAAO,CAOnB;IAuCD;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,wBAlBW,MAAM,cAEd;QAAwC,GAAG,EAAnC,CAAS,IAAM,EAAN,MAAM,KAAG,GAAC;QAGQ,OAAO,EAAlC,CAAS,IAAC,EAAD,GAAC,KAAG,GAAC;QACM,MAAM;KAClC,kBAAQ,MAAM,GAAC,IAAI,WACX,CAAS,IAAQ,YAAE,IAAQ,EAAR,KAAK,CAAC,GAAC,CAAC,KAAG,GAAC,GAG7B,IAAI,CA0ChB;IAED;;;;;;;;;;;OAWG;IACH,0BARW,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,OAAO,CAanB;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,0BARW,MAAM,gBACN,GAAC,mBACD,MAAM,GAAC,IAAI,GACT,OAAO,CAiBnB;IAED;;;;;;;OAOG;IACH,mBALW,MAAM,GACJ,OAAO,CAMnB;IAED;;;;;;;;OAQG;IACH,0BALW,MAAM,GACJ,IAAI,CAUhB;IAED;;;;;;;;;;;OAWG;IACH,2BALW,MAAM,GACJ,IAAI,CAUhB;IAED;;;;;;;;;;;OAWG;IACH,uBANW,MAAM,iBACN,MAAM,GACJ,IAAI,CAShB;IAED;;;;;;;;;;;;;;;OAeG;IACH,4BATW,MAAM,cACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,GACT,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,GAAC,CAAA;KAAE,CAAC,CAkCnD;IAED;;;;;;;;;OASG;IACH,yBALW,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,GAAC,CAAA;KAAE,CAAC,GACrC,OAAO,CAAC,IAAI,CAAC,CAMzB;IA4SD;;;;;;;;;;;;;;;OAeG;IACH,wBAXW,MAAM,cACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,YACX;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAC,IAAI,GAEzB,OAAO,CA2BnB;IAED;;;;;;;;;OASG;IACH,4BANW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,cAAU,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,WAAS,CAAC,GAAC,IAAI,GAAC,SAAS,mBACvF,MAAM,GAAC,IAAI,GACT,OAAO,CASnB;IAyBD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,0BAjBW,MAAM,cACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,aACX,kBAAkB,GAAC,IAAI,YAGvB;QAAE,cAAc,CAAC,EAAE,OAAO,CAAA;KAAE,GAAC,IAAI,GAG/B,OAAO,CA+BnB;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,8BAbW,MAAM,GAAC,IAAI,YAEX,MAAM,YACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,GACT,OAAO,CAenB;IAED;;;;;;;;;;;;;;;OAeG;IACH,4BAZW,MAAM,GAAC,IAAI,YACX,MAAM,YACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBAGX,MAAM,GAAC,IAAI,GACT,OAAO,CAMnB;IAED;;;;;;;OAOG;IACH,4BALW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAazB;IAED;;;;;;;OAOG;IACH,2BALW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAYzB;IAED;;;;;;;;OAQG;IACH,8BALW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAazB;IAED;;;;;;OAMG;IACH,UAJa,IAAI,CAQhB;IAcD;;;;;;;;OAQG;IACH,QAJa,IAAI,CAMhB;IAED;;;;;OAKG;IACH,YAJa,OAAO,CAMnB;IAED;;;;;;OAMG;IACH,WAJa,IAAI,CAQhB;IAED;;;;;;OAMG;IACH,aAJa,OAAO,CAMnB;IAED;;;;;;;;OAQG;IACH,uBAJa,OAAO,CAMnB;IAED;;;;;;;;;OASG;IACH,oBAJa,OAAO,CAMnB;IAED;;;;;;;;;;;;OAYG;IACH,mCAVW,MAAM,GAAC,IAAI,GAAC,SAAS,GACnB,OAAO,CAWnB;IAED;;;;;;;;;;;OAWG;IACH,qBANW,OAAO,GACL,IAAI,CAgBhB;IAED;;;;;;OAMG;IAIH,eAPa,KAAK,CAAC,MAAM,CAAC,CAgBzB;IAED;;;;;;;;OAQG;IACH,2BALW,KAAK,CAAC,MAAM,CAAC,GACX,IAAI,CAShB;IAGD;;;;;;;OAOG;IACH,YAJa,OAAO,CAAC,IAAI,CAAC,CAczB;IA4kBD;;;;;;;OAOG;IACH,cAEC;;CACD;;;;;;;;;;;;;;;UA5lEa,KAAK,CAAC,GAAC,CAAC,GAAC,IAAI;;;;YACb,MAAM,GAAC,IAAI;;8BAtHK,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"permission-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/permission-manager.mjs"],"names":[],"mappings":"AAgMA;;;;;;;GAOG;AACH;IACC;;;;OAIG;IACH,yBAHU,MAAM,CAG8B;IAmJ9C;;;;;;OAMG;IACH,sBAJW,MAAM,EAyGhB;IAED;;;;;;;;;;;;;OAaG;IACH,cAVG;QAAqB,MAAM,EAAnB,MAAM;QACO,MAAM,EAAnB,MAAM;QACO,MAAM,EAAnB,MAAM;KACd,kBAAQ,MAAM,GAAC,IAAI,WACX,MAAM,GAAC,IAAI,iBACT,MAAM,CAiDlB;IAED;;;;;;;;;;OAUG;IACH,mBAPW,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,OAAO,CAmCnB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,mBAZG;QAAqB,MAAM,EAAnB,MAAM;QACO,KAAK,EAAlB,MAAM;QACwB,MAAM,EAApC,MAAM,GAAC,QAAQ,GAAC,OAAO;QACuB,SAAS;KAC/D,kBAAQ,MAAM,GAAC,IAAI,WACX,MAAM,GAAC,IAAI,UACX,MAAM,GAAC,IAAI,GACT,MAAM,CAqClB;IAED;;;;;;;;OAQG;IACH,wBALW,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,OAAO,CAiBnB;IAED;;;;;;;;;;OAUG;IACH,kCALW,MAAM,GAAC,IAAI,aACX,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,MAAM,GAAC,QAAQ,GAAC,OAAO,CA0BnC;IAED;;;;OAIG;IACH,uBAFa,MAAM,CAIlB;IAED;;;;;OAKG;IACH,gCAFa,OAAO,CAOnB;IAuCD;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,wBAlBW,MAAM,cAEd;QAAwC,GAAG,EAAnC,CAAS,IAAM,EAAN,MAAM,KAAG,GAAC;QAGQ,OAAO,EAAlC,CAAS,IAAC,EAAD,GAAC,KAAG,GAAC;QACM,MAAM;KAClC,kBAAQ,MAAM,GAAC,IAAI,WACX,CAAS,IAAQ,YAAE,IAAQ,EAAR,KAAK,CAAC,GAAC,CAAC,KAAG,GAAC,GAG7B,IAAI,CA0ChB;IAED;;;;;;;;;;;OAWG;IACH,0BARW,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,OAAO,CAanB;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,0BARW,MAAM,gBACN,GAAC,mBACD,MAAM,GAAC,IAAI,GACT,OAAO,CAiBnB;IAED;;;;;;;OAOG;IACH,mBALW,MAAM,GACJ,OAAO,CAMnB;IAED;;;;;;;;OAQG;IACH,0BALW,MAAM,GACJ,IAAI,CAUhB;IAED;;;;;;;;;;;OAWG;IACH,2BALW,MAAM,GACJ,IAAI,CAUhB;IAED;;;;;;;;;;;OAWG;IACH,uBANW,MAAM,iBACN,MAAM,GACJ,IAAI,CAShB;IAED;;;;;;;;;;;;;;;OAeG;IACH,4BATW,MAAM,cACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,GACT,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,GAAC,CAAA;KAAE,CAAC,CAkCnD;IAED;;;;;;;;;OASG;IACH,yBALW,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,GAAC,CAAA;KAAE,CAAC,GACrC,OAAO,CAAC,IAAI,CAAC,CAMzB;IA4SD;;;;;;;;;;;;;;;OAeG;IACH,wBAXW,MAAM,cACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,YACX;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAC,IAAI,GAEzB,OAAO,CA2BnB;IAED;;;;;;;;;OASG;IACH,4BANW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,cAAU,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,WAAS,CAAC,GAAC,IAAI,GAAC,SAAS,mBACvF,MAAM,GAAC,IAAI,GACT,OAAO,CASnB;IAyBD;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,0BAtBW,MAAM,cACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,aACX,kBAAkB,GAAC,IAAI,YAGvB;QAAE,cAAc,CAAC,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GAAC,IAAI,GAQrE,OAAO,CA0CnB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,sBAXW,MAAM,cACN,MAAM,SACN,KAAK,CAAC,GAAC,CAAC,mBACR,MAAM,GAAC,IAAI,GACT,OAAO,GAAC,OAAO,CAAC,OAAO,CAAC,CA8CpC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,8BAbW,MAAM,GAAC,IAAI,YAEX,MAAM,YACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,GACT,OAAO,CAenB;IAED;;;;;;;;;;;;;;;OAeG;IACH,4BAZW,MAAM,GAAC,IAAI,YACX,MAAM,YACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBAGX,MAAM,GAAC,IAAI,GACT,OAAO,CAMnB;IAED;;;;;;;OAOG;IACH,4BALW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAazB;IAED;;;;;;;OAOG;IACH,2BALW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAYzB;IAED;;;;;;;;OAQG;IACH,8BALW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAazB;IAED;;;;;;OAMG;IACH,UAJa,IAAI,CAQhB;IAcD;;;;;;;;OAQG;IACH,QAJa,IAAI,CAMhB;IAED;;;;;OAKG;IACH,YAJa,OAAO,CAMnB;IAED;;;;;;OAMG;IACH,WAJa,IAAI,CAQhB;IAED;;;;;;OAMG;IACH,aAJa,OAAO,CAMnB;IAED;;;;;;;;OAQG;IACH,uBAJa,OAAO,CAMnB;IAED;;;;;;;;;OASG;IACH,oBAJa,OAAO,CAMnB;IAED;;;;;;;;;;;;OAYG;IACH,mCAVW,MAAM,GAAC,IAAI,GAAC,SAAS,GACnB,OAAO,CAWnB;IAED;;;;;;;;;;;OAWG;IACH,qBANW,OAAO,GACL,IAAI,CAgBhB;IAED;;;;;;OAMG;IAIH,eAPa,KAAK,CAAC,MAAM,CAAC,CAgBzB;IAED;;;;;;;;OAQG;IACH,2BALW,KAAK,CAAC,MAAM,CAAC,GACX,IAAI,CAShB;IAGD;;;;;;;OAOG;IACH,YAJa,OAAO,CAAC,IAAI,CAAC,CAezB;IA4nBD;;;;;;;OAOG;IACH,cAEC;;CACD;;;;;;;;;;;;;;;;UAtvEa,KAAK,CAAC,GAAC,CAAC,GAAC,IAAI;;;;YACb,MAAM,GAAC,IAAI;;8BAxIK,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/lib/helpers/config.d.mts b/types/src/lib/helpers/config.d.mts
index ef3f9ab26..e3fa53935 100644
--- a/types/src/lib/helpers/config.d.mts
+++ b/types/src/lib/helpers/config.d.mts
@@ -311,12 +311,15 @@ export class Config extends ComponentBase {
      * @param {boolean} [permissions.readGating=true] - When `true` (the default), reading a terminal
      *   data value (primitive, Buffer, TypedArray, Date, Map, etc.) off a module API path is
      *   permission-checked, the same way calls are. Set `false` to opt out and gate calls only.
+     * @param {boolean} [permissions.owner=false] - When `true`, a caller leaf may access any target leaf
+     *   currently owned by the same module (the moduleID of the initial load or of an `api.add()`), across
+     *   directories, where the default policy would otherwise deny. An explicit deny rule still wins (#509).
      * @param {Array<object>} [permissions.rules=[]] - Initial permission rules.
      * @returns {object|null} Normalized permissions config, or null when permissions is absent or not an object.
      *
      * @example
      * normalizePermissions({ defaultPolicy: "deny", rules: [{ caller: "**", target: "admin.**", effect: "deny" }] });
-     * // => { defaultPolicy: "deny", enabled: true, audit: "default", readGating: true, rules: [...] }
+     * // => { defaultPolicy: "deny", enabled: true, audit: "default", readGating: true, owner: false, rules: [...] }
      */
     normalizePermissions(permissions?: object | null): object | null;
     #private;
diff --git a/types/src/lib/helpers/config.d.mts.map b/types/src/lib/helpers/config.d.mts.map
index ca5532640..04d7cc073 100644
--- a/types/src/lib/helpers/config.d.mts.map
+++ b/types/src/lib/helpers/config.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"config.d.mts","sourceRoot":"","sources":["../../../../src/lib/helpers/config.mjs"],"names":[],"mappings":"AAwEA;;;;;;;;;;;;;;;;;GAiBG;AACH,2CAJW,OAAO,GAAC,MAAM,GAAC,MAAM,GACnB;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;IAAC,cAAc,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,OAAO,CAAA;CAAC,CAqB7F;AAED;;;;;GAKG;AACH;IACC,gCAAmC;IAEnC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,qCAxBW,MAAM,GAAC,MAAM,GACX,MAAM,CAiDlB;IAED;;;;;OAKG;IACH,iCAJW,MAAM,GACJ,MAAM,CAsBlB;IAED;;;;;OAKG;IACH,2BAJW,MAAM,GACJ,MAAM,CAsBlB;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,qCAnBW,MAAM,GACJ,MAAM,CAyClB;IAED;;;;;OAKG;IACH,6BAJW,OAAO,GAAC,MAAM,GACZ,MAAM,CAoElB;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,oCATW,GAAC,0BACC,SAAS,GAAC,MAAM,CAoB5B;IAED;;;;;;;;;;;;;;OAcG;IACH,4BAJW,OAAO,GAAC,MAAM,GAAC,MAAM,GACnB;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,cAAc,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,OAAO,CAAA;KAAC,CAK7F;IAED;;;;;;OAMG;IACH,gCALW,MAAM,GACJ,MAAM,CAuQlB;IAED;;;;;;;;;;;OAWG;IACH,6CARW,MAAM,EAAE,GAAC,SAAS,UAClB,OAAO,GACL,GAAG,CAAC,MAAM,CAAC,CA8BvB;IAED;;;;;OAKG;IACH,uCAJW,OAAO,GAAC,MAAM,GAAC,MAAM,GACnB,MAAM,GAAC,IAAI,CAoDvB;IAqCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,yBArBW,MAAM,GAAC,IAAI,GAAC,SAAS,GAEnB;QAAE,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,GAAC,IAAI,CA4BtC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,qCAbW,MAAM,GAAC,IAAI,GAAC,SAAS,GACnB,MAAM,GAAC,IAAI,CAqEvB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6CG;IACH,mCApBW,SAAS,GAAC,IAAI,GAAC,KAAK,CAAC,MAAM,GAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAC,CAAC,GAChH,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,GAAC,SAAS,GAAC,UAAU,GAAC,SAAS,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,OAAO,GAAC,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAC,CAAC,CAiO9I;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,mCAvBW,MAAM,GAAC,IAAI,GAiBT,MAAM,GAAC,IAAI,CAgQvB;;CACD;8BA/5C6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"config.d.mts","sourceRoot":"","sources":["../../../../src/lib/helpers/config.mjs"],"names":[],"mappings":"AAwEA;;;;;;;;;;;;;;;;;GAiBG;AACH,2CAJW,OAAO,GAAC,MAAM,GAAC,MAAM,GACnB;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;IAAC,cAAc,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,OAAO,CAAA;CAAC,CAqB7F;AAED;;;;;GAKG;AACH;IACC,gCAAmC;IAEnC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,qCAxBW,MAAM,GAAC,MAAM,GACX,MAAM,CAiDlB;IAED;;;;;OAKG;IACH,iCAJW,MAAM,GACJ,MAAM,CAsBlB;IAED;;;;;OAKG;IACH,2BAJW,MAAM,GACJ,MAAM,CAsBlB;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,qCAnBW,MAAM,GACJ,MAAM,CAyClB;IAED;;;;;OAKG;IACH,6BAJW,OAAO,GAAC,MAAM,GACZ,MAAM,CAoElB;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,oCATW,GAAC,0BACC,SAAS,GAAC,MAAM,CAoB5B;IAED;;;;;;;;;;;;;;OAcG;IACH,4BAJW,OAAO,GAAC,MAAM,GAAC,MAAM,GACnB;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,cAAc,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,OAAO,CAAA;KAAC,CAK7F;IAED;;;;;;OAMG;IACH,gCALW,MAAM,GACJ,MAAM,CAuQlB;IAED;;;;;;;;;;;OAWG;IACH,6CARW,MAAM,EAAE,GAAC,SAAS,UAClB,OAAO,GACL,GAAG,CAAC,MAAM,CAAC,CA8BvB;IAED;;;;;OAKG;IACH,uCAJW,OAAO,GAAC,MAAM,GAAC,MAAM,GACnB,MAAM,GAAC,IAAI,CAoDvB;IAqCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,yBArBW,MAAM,GAAC,IAAI,GAAC,SAAS,GAEnB;QAAE,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,GAAC,IAAI,CA4BtC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,qCAbW,MAAM,GAAC,IAAI,GAAC,SAAS,GACnB,MAAM,GAAC,IAAI,CAqEvB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6CG;IACH,mCApBW,SAAS,GAAC,IAAI,GAAC,KAAK,CAAC,MAAM,GAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAC,CAAC,GAChH,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,GAAC,SAAS,GAAC,UAAU,GAAC,SAAS,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,OAAO,GAAC,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAC,CAAC,CAiO9I;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,mCA1BW,MAAM,GAAC,IAAI,GAoBT,MAAM,GAAC,IAAI,CAsRvB;;CACD;8BAx7C6B,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/slothlet.d.mts b/types/src/slothlet.d.mts
index 39a6f720a..f04100d25 100644
--- a/types/src/slothlet.d.mts
+++ b/types/src/slothlet.d.mts
@@ -135,6 +135,54 @@ export type SlothletOptions = {
      * - `object` — full control: `{ enabled: boolean, pattern?: string, suppressErrors?: boolean }`.
      */
     hook?: string | boolean | object | undefined;
+    /**
+     * - Permission system configuration. Omit it and the system is off entirely. See [PERMISSIONS.md](docs/PERMISSIONS.md#configuration).
+     */
+    permissions?: {
+        /**
+         * - Fallback when no rule matches.
+         */
+        defaultPolicy?: "allow" | "deny" | undefined;
+        /**
+         * - Global enforcement toggle.
+         */
+        enabled?: boolean | undefined;
+        /**
+         * - Audit level; `true`/`false` normalize to `"default"`.
+         */
+        audit?: boolean | "default" | "verbose" | undefined;
+        /**
+         * - Gate terminal data-value reads the same way calls are gated.
+         */
+        readGating?: boolean | undefined;
+        /**
+         * - Restore the legacy fail-open treatment of calls with no resolvable caller.
+         */
+        failOpenOnAbsentCaller?: boolean | undefined;
+        /**
+         * - Owner grant (#509): a caller leaf may access any target leaf currently owned
+         * by the same module (the initial load's base module, or an `api.add()`'s `moduleID`) — across that module's own directories —
+         * wherever `defaultPolicy` would otherwise deny. Matched by owner, not path, so another module mounted into the same namespace
+         * gets nothing; an explicit deny rule still wins. See [PERMISSIONS.md](docs/PERMISSIONS.md#owner-grant).
+         */
+        owner?: boolean | undefined;
+        /**
+         * - Options for api functions held as references (`{ capture?: boolean }`).
+         */
+        references?: object | undefined;
+        /**
+         * - Module-privacy host policy (`{ host?: "deny"|"allow" }`).
+         */
+        private?: object | undefined;
+        /**
+         * - Initial `{ caller, target, effect, condition?, requires? }` rules.
+         */
+        rules?: object[] | undefined;
+        /**
+         * - Event-rule section (`{ default?: "deny"|"notify"|"allow", rules?: Array<object> }`).
+         */
+        events?: object | undefined;
+    } | undefined;
     /**
      * - Enable verbose internal logging. `true` enables all categories.
      * Pass an object with sub-keys `builder`, `api`, `index`, `modes`, `wrapper`, `ownership`, `context` to target specific subsystems.
diff --git a/types/src/slothlet.d.mts.map b/types/src/slothlet.d.mts.map
index 4b2d3e7e3..249a6de52 100644
--- a/types/src/slothlet.d.mts.map
+++ b/types/src/slothlet.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"slothlet.d.mts","sourceRoot":"","sources":["../../src/slothlet.mjs"],"names":[],"mappings":"AAm7CA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,yBApCuB,CAAC,SAAX,MAAQ,6DAGV,eAAe,GACb,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,CAsCpC;;kBASS,QAAQ,CAAC;QAAC,QAAQ,EAAE,aAAa,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAC,CAAC,CAAC;QAAC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;KAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAgD3F,SAAS,GAAC,MAAM;;;;;;;;;;;;qBAEP,MAAM;iBAAO,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAgBhB,MAAM;eAAS,CAAC,QAAQ,GAAC,SAAS,GAAC,UAAU,GAAC,SAAS,CAAC;oBAAc,OAAO;gBAAU,CAAC,OAAO,GAAC,OAAO,CAAC;kBAAY,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAevI,KAAK,CAAC;YAAC,IAAI,EAAC,MAAM,CAAC;YAAA,IAAI,EAAC,MAAM,CAAC;YAAA,QAAQ,EAAC,MAAM,CAAA;SAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aA8BxD,MAAY,IAAI;;;;cAChB,MAAY,IAAI;;;;cAE3B;QAAgE,GAAG,EAAxD,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAC,SAAS,CAAC,CAAC;QACzB,GAAG,EAC/B;YAAkC,GAAG;YACH,MAAM;YACN,MAAM;YACN,MAAM;YACR,OAAO,EACvC;gBAA0C,QAAQ;gBACR,IAAI;gBACJ,SAAS;gBACT,UAAU;gBACV,YAAY;gBACZ,aAAa;gBACb,iBAAiB;gBACjB,mBAAmB;gBACnB,cAAc;aACxD;SAAA;QAA4B,OAAO,EACnC;YAAsC,GAAG;YACO,OAAO,EAA5C,MAAY,MAAM;YACS,GAAG;YACH,KAAK;YACL,GAAG;SACzC;QAA6B,IAAI;;;;;;;;6BAEV,MAAM;;;;yCACN,MAAM,EAAE;;;;;;;;;;;;;;;;;4BAIR,MAAM;;;;kCACN,MAAM;;;;;;;;6BAEN,MAAM;;;;;;;;;;;;;;;;;qCAIN,eAAe;;QACV,IAAI,EAChC;YAAmC,KAAK;YACL,OAAO;YACP,cAAc;YACd,MAAM;YACN,aAAa;YACb,IAAI;YACJ,GAAG;YACH,EAAE;YACJ,GAAG,EACpC;gBAAsC,OAAO,EAAlC,OAAO;gBACqB,MAAM;gBACN,OAAO;aAC9C;YAAmC,MAAM;YACN,kBAAkB;SACrD;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,EAAE;SAC1C;QAA4B,WAAW,EACvC;YAAoD,GAAG,EAA5C,MAAY,MAAM;YACY,YAAY,EAA1C,OAAO;YAC0C,IAAI,EAArD,MAAY,OAAO,CAAE,IAAI,CAAC;SACrC;QAA4B,QAAQ,EACpC;YAAsD,MAAM,EAAjD,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,MAAM;YACN,SAAS;YACM,IAAI,EAA/C,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,SAAS;SAChD;QAA4B,KAAK,EACjC;YAAoC,GAAG;SACvC;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,UAAU;SAClD;QAA4B,WAAW,EACvC;YAAwC,OAAO,EAC/C;gBAAiD,OAAO,EAA7C,OAAO;gBACwC,MAAM,EAArD,MAAY,IAAI;gBAC+B,OAAO,EAAtD,MAAY,IAAI;gBACsB,iBAAiB,EAAvD,OAAO;gBAC+C,UAAU,EAAhE,CAAS,IAAO,EAAP,OAAO,KAAG,IAAI;gBACwB,IAAI,EAAnD,MAAY,IAAI;gBACsB,MAAM,EAA5C,OAAO;aAClB;SAAA;QAA4B,UAAU,EACtC;YAAyC,IAAI;YACJ,UAAU;YACV,UAAU;YACV,kBAAkB;YAClB,kBAAkB;SAC3D;QAA8B,UAAU;QACV,IAAI;QACL,SAAS;QACR,MAAM;QACN,GAAG;QACH,KAAK;QACa,QAAQ,EAA7C,MAAY,OAAO,CAAE,IAAI,CAAC;KACvC;;gCApmD6D,wBAAwB"}
\ No newline at end of file
+{"version":3,"file":"slothlet.d.mts","sourceRoot":"","sources":["../../src/slothlet.mjs"],"names":[],"mappings":"AAm7CA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,yBApCuB,CAAC,SAAX,MAAQ,6DAGV,eAAe,GACb,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,CAsCpC;;kBASS,QAAQ,CAAC;QAAC,QAAQ,EAAE,aAAa,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAC,CAAC,CAAC;QAAC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;KAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAgD3F,SAAS,GAAC,MAAM;;;;;;;;;;;;qBAEP,MAAM;iBAAO,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA8BhB,MAAM;eAAS,CAAC,QAAQ,GAAC,SAAS,GAAC,UAAU,GAAC,SAAS,CAAC;oBAAc,OAAO;gBAAU,CAAC,OAAO,GAAC,OAAO,CAAC;kBAAY,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAevI,KAAK,CAAC;YAAC,IAAI,EAAC,MAAM,CAAC;YAAA,IAAI,EAAC,MAAM,CAAC;YAAA,QAAQ,EAAC,MAAM,CAAA;SAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aA8BxD,MAAY,IAAI;;;;cAChB,MAAY,IAAI;;;;cAE3B;QAAgE,GAAG,EAAxD,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAC,SAAS,CAAC,CAAC;QACzB,GAAG,EAC/B;YAAkC,GAAG;YACH,MAAM;YACN,MAAM;YACN,MAAM;YACR,OAAO,EACvC;gBAA0C,QAAQ;gBACR,IAAI;gBACJ,SAAS;gBACT,UAAU;gBACV,YAAY;gBACZ,aAAa;gBACb,iBAAiB;gBACjB,mBAAmB;gBACnB,cAAc;aACxD;SAAA;QAA4B,OAAO,EACnC;YAAsC,GAAG;YACO,OAAO,EAA5C,MAAY,MAAM;YACS,GAAG;YACH,KAAK;YACL,GAAG;SACzC;QAA6B,IAAI;;;;;;;;6BAEV,MAAM;;;;yCACN,MAAM,EAAE;;;;;;;;;;;;;;;;;4BAIR,MAAM;;;;kCACN,MAAM;;;;;;;;6BAEN,MAAM;;;;;;;;;;;;;;;;;qCAIN,eAAe;;QACV,IAAI,EAChC;YAAmC,KAAK;YACL,OAAO;YACP,cAAc;YACd,MAAM;YACN,aAAa;YACb,IAAI;YACJ,GAAG;YACH,EAAE;YACJ,GAAG,EACpC;gBAAsC,OAAO,EAAlC,OAAO;gBACqB,MAAM;gBACN,OAAO;aAC9C;YAAmC,MAAM;YACN,kBAAkB;SACrD;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,EAAE;SAC1C;QAA4B,WAAW,EACvC;YAAoD,GAAG,EAA5C,MAAY,MAAM;YACY,YAAY,EAA1C,OAAO;YAC0C,IAAI,EAArD,MAAY,OAAO,CAAE,IAAI,CAAC;SACrC;QAA4B,QAAQ,EACpC;YAAsD,MAAM,EAAjD,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,MAAM;YACN,SAAS;YACM,IAAI,EAA/C,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,SAAS;SAChD;QAA4B,KAAK,EACjC;YAAoC,GAAG;SACvC;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,UAAU;SAClD;QAA4B,WAAW,EACvC;YAAwC,OAAO,EAC/C;gBAAiD,OAAO,EAA7C,OAAO;gBACwC,MAAM,EAArD,MAAY,IAAI;gBAC+B,OAAO,EAAtD,MAAY,IAAI;gBACsB,iBAAiB,EAAvD,OAAO;gBAC+C,UAAU,EAAhE,CAAS,IAAO,EAAP,OAAO,KAAG,IAAI;gBACwB,IAAI,EAAnD,MAAY,IAAI;gBACsB,MAAM,EAA5C,OAAO;aAClB;SAAA;QAA4B,UAAU,EACtC;YAAyC,IAAI;YACJ,UAAU;YACV,UAAU;YACV,kBAAkB;YAClB,kBAAkB;SAC3D;QAA8B,UAAU;QACV,IAAI;QACL,SAAS;QACR,MAAM;QACN,GAAG;QACH,KAAK;QACa,QAAQ,EAA7C,MAAY,OAAO,CAAE,IAAI,CAAC;KACvC;;gCAlnD6D,wBAAwB"}
\ No newline at end of file

From 0231ad94bbd16117f4b8d776c25aa13bb4944360 Mon Sep 17 00:00:00 2001
From: cldmv-bot <230939188+cldmv-bot@users.noreply.github.com>
Date: Tue, 29 Sep 2026 07:00:35 +0000
Subject: [PATCH 29/49] style: apply automated lint/format fixes

---
 .../suites/permissions/permissions-owner.test.vitest.mjs      | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/vitests/suites/permissions/permissions-owner.test.vitest.mjs b/tests/vitests/suites/permissions/permissions-owner.test.vitest.mjs
index 840c55158..010c722fe 100644
--- a/tests/vitests/suites/permissions/permissions-owner.test.vitest.mjs
+++ b/tests/vitests/suites/permissions/permissions-owner.test.vitest.mjs
@@ -142,7 +142,7 @@ describe.each(getMatrixConfigs())("Permissions > owner grant (#509) > $name", ({
 		expect(await outcome(() => api.core.alpha.callBeta())).toEqual({ ok: false, code: "PERMISSION_DENIED" });
 	});
 
-	it("changes nothing under defaultPolicy: \"allow\"", async () => {
+	it('changes nothing under defaultPolicy: "allow"', async () => {
 		for (const owner of [false, true]) {
 			await build(
 				{
@@ -223,7 +223,7 @@ describe.each(getMatrixConfigs())("Permissions > owner grant (#509) > $name", ({
 		expect(check("core.alpha.callBeta", "shutdown")).toBe(false);
 	});
 
-	it("emits permission:owner-allow for a granted access under audit: \"verbose\"", async () => {
+	it('emits permission:owner-allow for a granted access under audit: "verbose"', async () => {
 		await build({ defaultPolicy: "deny", owner: true, audit: "verbose" });
 		const seen = [];
 		api.slothlet.lifecycle.on("permission:owner-allow", (data) => {

From e91b261321df3047488ad3ea593ae4b373bfae68 Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Mon, 28 Sep 2026 22:09:59 -0700
Subject: [PATCH 30/49] feat(events): host-controlled event delivery via
 event.strategy and event.deliver

A host that wraps work in a transaction needs events emitted inside it
delivered only if the transaction commits, each listener as its own
retried unit of work, without editing the modules that emit.

- api.slothlet.event.strategy(fn) installs a host delivery strategy,
  called per emit as fn(envelope, listeners, defaultDeliver). The frozen
  envelope carries the event, payload, emitter { moduleID, apiPath }
  (null for the host) and each recipient's emit-time level. A strategy
  that calls defaultDeliver() before its return value settles delivers
  now and emit resolves on settle; one that returns without calling it
  defers the event and emit resolves on acceptance; one that throws
  rejects emit. strategy(null) clears it; it survives a full reload.
- api.slothlet.event.deliver(envelope, listenerId) delivers a held
  envelope to one listener, so a retry never re-runs listeners that
  already succeeded. It resolves { delivered: true, level },
  { delivered: false, reason: "listener-gone" } or
  { delivered: false, reason: "denied" }, and rejects with the
  listener's own error when it throws. Rules and levels are enforced at
  delivery time, and the listener and rule conditions run inside the
  flow captured at emit (user context, caller identity, owner-locked
  keys, trust), rebuilt on the instance's current base store.
- on()/once() now return a listener id, <owner moduleID>:<event>:<n>,
  where n is the owner's registration ordinal for that event (the host
  owner is empty) and { key } replaces n. Ids are resolved against live
  registrations at delivery, so they survive a full or scoped reload
  once the module re-registers. A scoped reload drops the reloaded
  module's listeners and ordinals before rebuilding it, and removing a
  module drops its listeners.
- Both new surfaces are host-only through the existing built-in
  slothlet.event.** deny.

Fixes #497
---
 api_tests/api_test_events/listeners.mjs       |  62 +++
 api_tests/api_test_events/strategist.mjs      |  40 ++
 docs/EVENTS.md                                | 134 +++++-
 docs/PERMISSIONS.md                           |  11 +
 src/lib/builders/api_builder.mjs              |  21 +-
 src/lib/handlers/api-manager.mjs              |   9 +
 src/lib/handlers/context-async.mjs            |  49 +-
 src/lib/handlers/context-live.mjs             |  53 +++
 src/lib/handlers/event-manager.mjs            | 378 ++++++++++++++-
 src/lib/handlers/permission-manager.mjs       |   5 +-
 src/lib/handlers/trusted-root.mjs             |  41 ++
 src/slothlet.mjs                              |  21 +
 .../event-delivery-strategy.test.vitest.mjs   | 434 ++++++++++++++++++
 .../event-strategy-unit.test.vitest.mjs       | 142 ++++++
 types/src/lib/builders/api_builder.d.mts.map  |   2 +-
 types/src/lib/handlers/api-manager.d.mts.map  |   2 +-
 types/src/lib/handlers/context-async.d.mts    |  26 ++
 .../src/lib/handlers/context-async.d.mts.map  |   2 +-
 types/src/lib/handlers/context-live.d.mts     |  28 ++
 types/src/lib/handlers/context-live.d.mts.map |   2 +-
 types/src/lib/handlers/event-manager.d.mts    | 109 ++++-
 .../src/lib/handlers/event-manager.d.mts.map  |   2 +-
 .../lib/handlers/permission-manager.d.mts.map |   2 +-
 types/src/lib/handlers/trusted-root.d.mts     |  16 +
 types/src/lib/handlers/trusted-root.d.mts.map |   2 +-
 types/src/slothlet.d.mts                      |  13 +
 types/src/slothlet.d.mts.map                  |   2 +-
 27 files changed, 1561 insertions(+), 47 deletions(-)
 create mode 100644 api_tests/api_test_events/listeners.mjs
 create mode 100644 api_tests/api_test_events/strategist.mjs
 create mode 100644 tests/vitests/suites/events/event-delivery-strategy.test.vitest.mjs
 create mode 100644 tests/vitests/suites/events/event-strategy-unit.test.vitest.mjs

diff --git a/api_tests/api_test_events/listeners.mjs b/api_tests/api_test_events/listeners.mjs
new file mode 100644
index 000000000..42c0ef3b4
--- /dev/null
+++ b/api_tests/api_test_events/listeners.mjs
@@ -0,0 +1,62 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_events/listeners.mjs
+ *	@Date: 2026-09-28T21:34:06-07:00 (1790656446)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 21:34:06 -07:00 (1790656446)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+import { self, context } from "@cldmv/slothlet/runtime";
+
+const received = [];
+const failures = new Map();
+
+/**
+ * Subscribe a tagged listener as this module. Each delivery is recorded (tag, payload, event, and
+ * the `user` key of the context the listener runs in) so a test can assert who received what, and
+ * under which context. A listener armed with {@link failNext} throws instead of recording.
+ * @param {string} eventName - Event to subscribe to.
+ * @param {string} tag - Label recorded with each delivery.
+ * @param {object} [options] - Options forwarded to `event.on` (`key`, `once`).
+ * @returns {{ level: string, id: string }} The granted level and the listener identity.
+ */
+export function listen(eventName, tag, options = {}) {
+	const { level, id } = self.slothlet.event.on(
+		eventName,
+		async (payload, meta) => {
+			const remaining = failures.get(tag) ?? 0;
+			if (remaining > 0) {
+				failures.set(tag, remaining - 1);
+				throw new TypeError(`listener ${tag} failed`);
+			}
+			received.push({ tag, payload, event: meta.event, user: context.user ?? null });
+		},
+		options
+	);
+	return { level, id };
+}
+
+/**
+ * Make the listener with this tag throw on its next `times` deliveries.
+ * @param {string} tag - Listener tag.
+ * @param {number} [times=1] - Number of deliveries that should throw.
+ * @returns {void}
+ */
+export function failNext(tag, times = 1) {
+	failures.set(tag, times);
+}
+
+/**
+ * Return and clear the recorded deliveries.
+ * @returns {Array<{tag: string, payload: *, event: string, user: *}>} Deliveries since the last drain.
+ */
+export function drain() {
+	const out = received.slice();
+	received.length = 0;
+	return out;
+}
diff --git a/api_tests/api_test_events/strategist.mjs b/api_tests/api_test_events/strategist.mjs
new file mode 100644
index 000000000..17733ae30
--- /dev/null
+++ b/api_tests/api_test_events/strategist.mjs
@@ -0,0 +1,40 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_events/strategist.mjs
+ *	@Date: 2026-09-28T21:34:06-07:00 (1790656446)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 21:34:06 -07:00 (1790656446)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+import { self } from "@cldmv/slothlet/runtime";
+
+/**
+ * Attempt the host-only `event.strategy` from a MODULE context. Returns the outcome instead of throwing.
+ * @returns {{ ok: boolean, code?: string }} `ok:true` if permitted (it should not be); otherwise the error code.
+ */
+export function attemptStrategy() {
+	try {
+		self.slothlet.event.strategy(null);
+		return { ok: true };
+	} catch (error) {
+		return { ok: false, code: error.code || error.name };
+	}
+}
+
+/**
+ * Attempt the host-only `event.deliver` from a MODULE context. Returns the outcome instead of throwing.
+ * @returns {Promise<{ ok: boolean, code?: string }>} `ok:true` if permitted (it should not be); otherwise the error code.
+ */
+export async function attemptDeliver() {
+	try {
+		await self.slothlet.event.deliver({}, "x");
+		return { ok: true };
+	} catch (error) {
+		return { ok: false, code: error.code || error.name };
+	}
+}
diff --git a/docs/EVENTS.md b/docs/EVENTS.md
index 8c4ea57b9..c6509da4b 100644
--- a/docs/EVENTS.md
+++ b/docs/EVENTS.md
@@ -15,6 +15,8 @@ Slothlet stays boundary-agnostic: it knows nothing about processes, browsers, or
 - [Declaring event rules in a manifest](#declaring-event-rules-in-a-manifest)
 - [Runtime rule mutation](#runtime-rule-mutation)
 - [Listener identity and error isolation](#listener-identity-and-error-isolation)
+- [Listener ids](#listener-ids)
+- [Host-controlled delivery: `strategy` and `deliver`](#host-controlled-delivery-strategy-and-deliver)
 
 ## Overview
 
@@ -39,15 +41,17 @@ off(); // stop receiving
 
 All verbs live under `api.slothlet.event` (and `self.slothlet.event` inside modules).
 
-| Member         | Signature                                                         | Notes                                                                                                                                                                            |
-| -------------- | ----------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `on`           | `on(event, listener, { once? }) → { level, off }`                 | Subscribe. Returns the granted level (`deny`/`notify`/`allow`) and an unsubscribe. At `deny` the listener is not registered and `off` is a no-op.                                |
-| `once`         | `once(event, listener) → { level, off }`                          | Subscribe for a single delivery, then auto-unsubscribe.                                                                                                                          |
-| `off`          | `off(event, listener) → boolean`                                  | Remove a listener by reference.                                                                                                                                                  |
-| `emit`         | `emit(event, payload?) → Promise<void>`                           | Publish. Ungated. Resolves once all listeners settle.                                                                                                                            |
-| `resolveLevel` | `resolveLevel(subscriberPath, event) → "deny"\|"notify"\|"allow"` | Resolve the level a **supplied** identity would be granted, without subscribing. Host-only. See [Resolving a level without subscribing](#resolving-a-level-without-subscribing). |
-| `rules.add`    | `rules.add(rule) → ruleId`                                        | Add an event rule at runtime. Host-only; gated by `api.mutations.events`. See [Runtime rule mutation](#runtime-rule-mutation).                                                   |
-| `rules.remove` | `rules.remove(ruleId) → boolean`                                  | Remove a runtime event rule. Host-only; gated.                                                                                                                                   |
+| Member         | Signature                                                         | Notes                                                                                                                                                                                |
+| -------------- | ----------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `on`           | `on(event, listener, { once?, key? }) → { level, off, id }`       | Subscribe. Returns the granted level (`deny`/`notify`/`allow`), an unsubscribe, and the [listener id](#listener-ids). At `deny` the listener is not registered and `off` is a no-op. |
+| `once`         | `once(event, listener, { key? }) → { level, off, id }`            | Subscribe for a single delivery, then auto-unsubscribe.                                                                                                                              |
+| `off`          | `off(event, listener) → boolean`                                  | Remove a listener by reference.                                                                                                                                                      |
+| `emit`         | `emit(event, payload?) → Promise<void>`                           | Publish. Ungated. Resolves once all listeners settle — or, under a deferring [strategy](#host-controlled-delivery-strategy-and-deliver), once the strategy accepts the event.        |
+| `resolveLevel` | `resolveLevel(subscriberPath, event) → "deny"\|"notify"\|"allow"` | Resolve the level a **supplied** identity would be granted, without subscribing. Host-only. See [Resolving a level without subscribing](#resolving-a-level-without-subscribing).     |
+| `rules.add`    | `rules.add(rule) → ruleId`                                        | Add an event rule at runtime. Host-only; gated by `api.mutations.events`. See [Runtime rule mutation](#runtime-rule-mutation).                                                       |
+| `rules.remove` | `rules.remove(ruleId) → boolean`                                  | Remove a runtime event rule. Host-only; gated.                                                                                                                                       |
+| `strategy`     | `strategy(fn \| null) → void`                                     | Hand every emit to a host delivery strategy; `null` restores immediate delivery. Host-only. See [Host-controlled delivery](#host-controlled-delivery-strategy-and-deliver).          |
+| `deliver`      | `deliver(envelope, listenerId) → Promise<result>`                 | Deliver a strategy-held envelope to one listener. Host-only. See [Host-controlled delivery](#host-controlled-delivery-strategy-and-deliver).                                         |
 
 A listener is always called `(payload, meta)`:
 
@@ -177,3 +181,115 @@ Changing the rule set re-resolves the delivery level of existing subscribers on
 A listener is captured with the identity of the module that registered it, and runs pinned to that identity, so `self.*` inside a listener resolves as that module — the same discipline hooks use. A listener error (thrown or rejected) is isolated: it surfaces as a non-fatal `SlothletWarning` and never affects the other listeners or the emitter.
 
 Delivery is asynchronous and fire-and-forget; `emit` awaits all listeners so a caller can sequence work after them when needed.
+
+## Listener ids
+
+Every registration gets a listener id, returned as `id` from `on` / `once`:
+
+```text
+<owner moduleID>:<event>:<n>
+```
+
+- **owner moduleID** — the id of the module that registered the listener (e.g. `plug` for a module added with `{ moduleID: "plug" }`, `base_slothlet` for the base directory). A host registration has an empty owner, so its ids start with `:` — an empty string is never a real module id, so a host id cannot collide with a module's.
+- **event** — the event name.
+- **n** — the listener's registration ordinal among its owner's registrations for that event: `0`, `1`, `2`, … Every `on` / `once` call counts, including one that was refused at `deny`, so a rule change cannot shift the ids of a module's other listeners.
+
+Because `n` is a registration ordinal, the same module registering its listeners in the same order gets the same ids again after a reload. A listener that is registered conditionally (so its position is not stable) passes an explicit key, which replaces `n`:
+
+```javascript
+const { id } = self.slothlet.event.on("orders.created", onCreated, { key: "audit" });
+// id === "<moduleID>:orders.created:audit"
+```
+
+A key is a non-empty string or a finite number. Keys share the namespace with ordinals, so prefer non-numeric keys. Registering a listener whose id is already held by a registered listener throws `INVALID_ARGUMENT`.
+
+## Host-controlled delivery: `strategy` and `deliver`
+
+By default `emit` delivers to every listener immediately. A host that wraps work in a transaction can instead take over delivery for the whole instance — without touching the modules that emit — so that events emitted inside a transaction are delivered only if it commits, each listener as its own unit of work with retry, and a rolled-back transaction delivers nothing.
+
+```javascript
+const pending = []; // the current transaction's events
+
+api.slothlet.event.strategy((envelope, listeners, defaultDeliver) => {
+	if (!inTransaction()) return defaultDeliver(); // deliver now, exactly as without a strategy
+	pending.push({ envelope, listeners }); // defer: emit resolves as soon as this returns
+});
+
+// On commit — each listener is its own retried unit of work:
+for (const { envelope, listeners } of pending.splice(0)) {
+	for (const id of listeners) {
+		await retry(() => api.slothlet.event.deliver(envelope, id));
+	}
+}
+
+// On rollback — discard; nothing is ever delivered:
+pending.length = 0;
+```
+
+### `strategy(fn)`
+
+`api.slothlet.event.strategy(fn)` installs `fn` for the instance; `strategy(null)` clears it. It is **host-only**, gated exactly like `rules.*` by the built-in `slothlet.event.**` deny — a module calling it is refused with `PERMISSION_DENIED`. The strategy survives `api.slothlet.reload()`.
+
+It is called once per emit as `fn(envelope, listeners, defaultDeliver)`:
+
+- **`envelope`** — a frozen object:
+  - `event`, `payload` — what was emitted.
+  - `at`, `instanceID` — the emit time and instance, as in the listener `meta`.
+  - `emitter` — `{ moduleID, apiPath }` of the emitting module, or `null` when the host emitted.
+  - `levels` — each recipient's listener id mapped to its level (`notify` / `allow`) **resolved at emit time**. It is informational: levels are enforced again at delivery (see below).
+  - `listeners` — the recipients' listener ids.
+- **`listeners`** — the listener ids that would receive the event (the same array as `envelope.listeners`). A listener the rules deny at emit time is not a recipient.
+- **`defaultDeliver()`** — delivers the event now, exactly as `emit` does without a strategy, and returns a promise that settles when those listeners have. Calling it more than once delivers once.
+
+The strategy signals what it did through `defaultDeliver` and its own return value:
+
+| The strategy …                                               | `emit` resolves …                                                     |
+| ------------------------------------------------------------ | --------------------------------------------------------------------- |
+| calls `defaultDeliver()` before its return value settles     | once its return value **and** the delivery have settled — **settle**  |
+| returns (or its returned promise settles) without calling it | once its return value settles — **acceptance**; the event is deferred |
+| throws, or returns a promise that rejects                    | rejects with that error — the event was not accepted                  |
+
+An `async` strategy can therefore make `emit` wait for durable acceptance (e.g. writing the envelope's metadata to a transaction log) without waiting for delivery. A `defaultDeliver` called later, after the strategy has settled, still delivers but `emit` no longer waits for it — to deliver a kept envelope later, use `deliver`.
+
+### `deliver(envelope, listenerId)`
+
+`api.slothlet.event.deliver(envelope, listenerId)` delivers a strategy-held envelope to **one** listener, so retrying a listener that failed never re-runs the listeners that already succeeded. It is host-only, gated like `strategy`.
+
+- `envelope` must be an envelope this instance passed to its strategy (a copy is refused), and `listenerId` must be one of its `listeners`; otherwise it rejects with `INVALID_ARGUMENT`.
+- The id is resolved against the listeners registered **now**, not at emit time.
+
+It resolves or rejects as follows:
+
+| Outcome                                                                                                          | Result                                                                                                    |
+| ---------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- |
+| The listener ran and settled                                                                                     | resolves `{ delivered: true, level }` (`level` is the level it was delivered at: `notify` or `allow`)     |
+| No listener holds that id any more — its module was removed, or a reload dropped it and it has not re-registered | resolves `{ delivered: false, reason: "listener-gone" }`                                                  |
+| The current rules deny that listener the event                                                                   | resolves `{ delivered: false, reason: "denied" }` (the subscription is dropped, as on the immediate path) |
+| The listener threw or rejected                                                                                   | rejects with the listener's own error                                                                     |
+
+The listener's return value is discarded, as on the immediate path. A `once` listener is consumed by its first delivery; a later `deliver` of another envelope to it resolves `listener-gone`.
+
+### What is enforced at delivery time
+
+Delivery rules and levels are enforced when each listener is delivered, not when the event is queued. A rule added or removed between `emit` and `deliver` applies to the delivery: a listener downgraded to `notify` receives only the trigger `meta`, and one now denied is not called.
+
+### Context
+
+A deferred delivery runs exactly as the immediate delivery would have. The envelope carries — in memory — the flow captured at `emit()`: the `context.run()` / `scope()` user context, the emitter's caller identity, owner-locked context keys and host trust. `deliver` runs the listener, **and** the event-rule conditions that decide its level, inside that captured flow:
+
+```javascript
+await api.slothlet.context.run({ user: "alice" }, () => api.slothlet.event.emit("orders.created", order));
+
+// Later, from anywhere — even inside another request's context:
+await api.slothlet.context.run({ user: "bob" }, () => api.slothlet.event.deliver(envelope, id));
+// The listener sees context.user === "alice", and a rule condition { user: "alice" } matches.
+```
+
+The deliverer's own context is not merged in. The listener still runs pinned to its registering module, as on the immediate path.
+
+### Lifetime
+
+- **Process restart** — a fresh instance; envelopes do not survive it. Slothlet does not serialize envelopes: the payload and the captured context are held by reference. Persisting what a host needs to re-emit after a crash is the host's concern.
+- **`api.slothlet.reload()`** — kept envelopes stay deliverable. A full reload replaces every module, so all subscriptions are dropped; once modules register their listeners again (in the same order, or with the same keys), their ids match and `deliver` reaches the re-registered listeners. Host subscriptions are not re-registered by a reload.
+- **`api.slothlet.api.reload(pathOrModuleID)`** — a scoped reload drops the reloaded module's subscriptions before rebuilding it and resets its ordinals, so the reloaded module's re-registrations get the same ids. Other modules' listeners are untouched.
+- **`api.slothlet.api.remove(moduleID)`** — removing a module drops its subscriptions; `deliver` to one of its listener ids resolves `listener-gone`.
diff --git a/docs/PERMISSIONS.md b/docs/PERMISSIONS.md
index 493418cc6..8ad8ca08b 100644
--- a/docs/PERMISSIONS.md
+++ b/docs/PERMISSIONS.md
@@ -695,6 +695,17 @@ const api = await slothlet({
 
 `caller` matches the **subscriber's** api path and `event` matches the **event name**. A module may also declare event rules in its `slothlet.module.json` (the `manifest` layer), and the host may mutate them at runtime via the gated, host-only `api.slothlet.event.rules.*`. See [EVENTS.md](EVENTS.md) for the full reference.
 
+The event surface itself is a `slothlet.*` route: a built-in `slothlet.event.**` deny keeps everything but `on` / `once` / `off` / `emit` host-only — `rules.*`, [`resolveLevel`](EVENTS.md#resolving-a-level-without-subscribing), and the delivery controls [`strategy` and `deliver`](EVENTS.md#host-controlled-delivery-strategy-and-deliver) — so a module calling one is refused with `PERMISSION_DENIED` under both `defaultPolicy: "allow"` and `"deny"`:
+
+```javascript
+// Built-in rules registered for every instance:
+{ caller: "**", target: "slothlet.event.**",   effect: "deny" }
+{ caller: "**", target: "slothlet.event.on",   effect: "allow" }
+{ caller: "**", target: "slothlet.event.once", effect: "allow" }
+{ caller: "**", target: "slothlet.event.off",  effect: "allow" }
+{ caller: "**", target: "slothlet.event.emit", effect: "allow" }
+```
+
 ---
 
 ## API Surface — api.slothlet.permissions
diff --git a/src/lib/builders/api_builder.mjs b/src/lib/builders/api_builder.mjs
index 0e78a871b..de3187f3f 100644
--- a/src/lib/builders/api_builder.mjs
+++ b/src/lib/builders/api_builder.mjs
@@ -31,6 +31,7 @@
 import { isNode, AsyncResource, loadJson } from "@cldmv/slothlet/helpers/platform";
 import { ComponentBase } from "#factories/component-base";
 import { TYPE_STATES, resolveWrapper } from "#handlers/unified-wrapper";
+import { DELIVERY_REASONS } from "#handlers/event-manager";
 import { TRUSTED_ROOT, PROTECT_SENTINEL } from "#handlers/trusted-root";
 import { getLanguage, initI18n, setLanguage, setLanguageAsync, t, translate } from "@cldmv/slothlet/i18n";
 
@@ -2532,13 +2533,15 @@ export class ApiBuilder extends ComponentBase {
 			/**
 			 * Instance-wide, permission-gated event system (#407) — named pub/sub scoped to this
 			 * composed instance, the third member of the family alongside `hook` and `lifecycle`.
-			 * `on`/`once` return `{ level, off }` (the granted deny/notify/allow level + an unsubscribe);
-			 * `emit` is open to any caller — delivery is enforced per subscriber, not on the emit side.
-			 * `resolveLevel(subscriberPath, event)` answers the level a supplied identity WOULD be granted
-			 * without subscribing (host-only; for trusted boundary layers such as `@cldmv/slothlet-vine` to
-			 * enforce delivery on the serving side). `rules.add`/`rules.remove` mutate the event-rule pool at
-			 * runtime, gated by `config.api.mutations.events` (defaults to true) and host-only, mirroring
-			 * `permissions.addRule`.
+			 * `on`/`once` return `{ level, off, id }` (the granted deny/notify/allow level, an unsubscribe,
+			 * and the listener id); `emit` is open to any caller — delivery is enforced per subscriber, not
+			 * on the emit side. `resolveLevel(subscriberPath, event)` answers the level a supplied identity
+			 * WOULD be granted without subscribing (host-only; for trusted boundary layers such as
+			 * `@cldmv/slothlet-vine` to enforce delivery on the serving side). `rules.add`/`rules.remove`
+			 * mutate the event-rule pool at runtime, gated by `config.api.mutations.events` (defaults to
+			 * true) and host-only, mirroring `permissions.addRule`. `strategy(fn)` hands every emit to a host
+			 * delivery strategy and `deliver(envelope, listenerId)` delivers a strategy-held envelope to one
+			 * listener (#497) — both host-only.
 			 * @type {object}
 			 * @public
 			 *
@@ -2559,6 +2562,8 @@ export class ApiBuilder extends ComponentBase {
 						off: () => false,
 						emit: async () => {},
 						resolveLevel: () => "notify",
+						strategy: noop,
+						deliver: async () => ({ delivered: false, reason: DELIVERY_REASONS.LISTENER_GONE }),
 						rules: { add: noop, remove: noop }
 					};
 				}
@@ -2569,6 +2574,8 @@ export class ApiBuilder extends ComponentBase {
 					off: handler.off.bind(handler),
 					emit: handler.emit.bind(handler),
 					resolveLevel: handler.resolveLevel.bind(handler),
+					strategy: handler.strategy.bind(handler),
+					deliver: handler.deliver.bind(handler),
 					rules: {
 						/**
 						 * Add an event rule at runtime (host-only; gated by `config.api.mutations.events`).
diff --git a/src/lib/handlers/api-manager.mjs b/src/lib/handlers/api-manager.mjs
index 857bcba5c..7b4cefe1c 100644
--- a/src/lib/handlers/api-manager.mjs
+++ b/src/lib/handlers/api-manager.mjs
@@ -2967,6 +2967,8 @@ export class ApiManager extends ComponentBase {
 				ownership?.markUnregistered?.(scopedModuleIDKey);
 				// The module is going away entirely, so its principals (#459) go with it.
 				this.slothlet.handlers.permissionManager?.onModuleRemoved?.(scopedModuleIDKey);
+				// ...and so do its event listeners (#497): they are closures over code that is gone.
+				this.slothlet.handlers.eventManager?.onModuleRemoved?.(scopedModuleIDKey);
 			}
 			for (const target of targets) {
 				const targetParts = this.normalizeApiPath(target).parts;
@@ -3168,6 +3170,8 @@ export class ApiManager extends ComponentBase {
 			this.slothlet.handlers.routineManager?.pruneModule?.(moduleIDKey);
 			// Principals (#459) the module registered go with it — a resolver never outlives its code.
 			this.slothlet.handlers.permissionManager?.onModuleRemoved?.(moduleIDKey);
+			// So do its event listeners (#497), for the same reason.
+			this.slothlet.handlers.eventManager?.onModuleRemoved?.(moduleIDKey);
 
 			// Clean up VersionManager registration if this was a versioned module.
 			// The apiPath+moduleID branch above handles this for path-based removals;
@@ -3561,6 +3565,11 @@ export class ApiManager extends ComponentBase {
 			folderPath: oldEntry.folderPath
 		});
 
+		// Event listeners (#497) the module registered are closures over the pre-reload module: drop them
+		// (and reset its listener ordinals) BEFORE the rebuild, so the reloaded module re-registering in
+		// the same order gets the same listener ids — which a strategy-held envelope delivers against.
+		this.slothlet.handlers.eventManager?.onModuleReloaded?.(moduleID);
+
 		// Rebuild API from disk (or, for a synthetic leaf, from the stored exports — rebuildCache
 		// re-runs buildAPI with the original value so it flattens exactly as the add did).
 		const freshApi = await cacheManager.rebuildCache(moduleID);
diff --git a/src/lib/handlers/context-async.mjs b/src/lib/handlers/context-async.mjs
index 9fcfa7305..037c752a5 100644
--- a/src/lib/handlers/context-async.mjs
+++ b/src/lib/handlers/context-async.mjs
@@ -22,7 +22,7 @@ import { AsyncLocalStorage } from "@cldmv/slothlet/helpers/platform";
 import { SlothletError } from "@cldmv/slothlet/errors";
 import { runtime_isClassInstance, runtime_wrapClassInstance } from "@cldmv/slothlet/helpers/class-instance-wrapper";
 import { setApiContextChecker } from "@cldmv/slothlet/helpers/eventemitter-context";
-import { TRUSTED_ROOT } from "#handlers/trusted-root";
+import { TRUSTED_ROOT, buildCapturedFlowStore } from "#handlers/trusted-root";
 
 /**
  * AsyncLocalStorage-based context manager for async runtime
@@ -303,6 +303,53 @@ export class AsyncContextManager {
 		return { currentWrapper: store.currentWrapper, callerWrapper: store.callerWrapper };
 	}
 
+	/**
+	 * Capture the parts of this instance's executing flow that a later, out-of-band run must
+	 * reproduce: the user context (`context.run()`'s), the caller identity, the owner-locked context
+	 * keys and whether the flow is host-trusted. Used by the event system (#497) so a deferred
+	 * delivery runs exactly as an immediate one would have. Holds references only — nothing is cloned
+	 * or serialized.
+	 *
+	 * @param {string} instanceID - Instance whose flow to capture.
+	 * @returns {object|null} An opaque flow snapshot for {@link runInSnapshotFlow}, or null when the
+	 *   instance has no context store.
+	 * @public
+	 */
+	snapshotFlow(instanceID) {
+		const store = this.tryGetContext(instanceID);
+		if (!store) return null;
+		const identity = this.getCallerIdentity(instanceID);
+		return {
+			context: store.context,
+			currentWrapper: identity.currentWrapper ?? null,
+			callerWrapper: identity.callerWrapper ?? null,
+			contextOwners: store.__contextOwners ?? null,
+			trusted: store[TRUSTED_ROOT] === true
+		};
+	}
+
+	/**
+	 * Run `fn` inside a flow rebuilt from a {@link snapshotFlow} snapshot, on top of the instance's
+	 * CURRENT base store (so a snapshot taken before a reload runs against the reloaded instance).
+	 * The deliverer's own ambient context is not merged in: the snapshot's context replaces it.
+	 *
+	 * @param {string} instanceID - Instance to run against.
+	 * @param {object} captured - Snapshot from {@link snapshotFlow}.
+	 * @param {Function} fn - Function to run (may be async).
+	 * @returns {Promise<*>} Resolves/rejects with `fn`'s outcome.
+	 * @throws {SlothletError} CONTEXT_NOT_FOUND when the instance has no base store.
+	 * @public
+	 */
+	async runInSnapshotFlow(instanceID, captured, fn) {
+		const childStore = buildCapturedFlowStore(this.instances, instanceID, captured);
+		this.instances.set(childStore.instanceID, childStore);
+		try {
+			return await this.als.run(childStore, fn);
+		} finally {
+			this.instances.delete(childStore.instanceID);
+		}
+	}
+
 	/**
 	 * Cleanup instance context
 	 * @param {string} instanceID - Instance to cleanup
diff --git a/src/lib/handlers/context-live.mjs b/src/lib/handlers/context-live.mjs
index 5f6a8ef8d..c102cecfc 100644
--- a/src/lib/handlers/context-live.mjs
+++ b/src/lib/handlers/context-live.mjs
@@ -19,6 +19,7 @@
 import { SlothletError } from "@cldmv/slothlet/errors";
 import { setApiContextChecker } from "@cldmv/slothlet/helpers/eventemitter-context";
 import { setApiCallerPinner } from "@cldmv/slothlet/helpers/caller-pinning";
+import { TRUSTED_ROOT, buildCapturedFlowStore } from "#handlers/trusted-root";
 
 /**
  * Stack resolution found a frame naming more than one suspended call, so which of them is
@@ -807,6 +808,58 @@ export class LiveContextManager {
 		return this.instances.get(instanceID);
 	}
 
+	/**
+	 * Capture the parts of this instance's executing flow that a later, out-of-band run must
+	 * reproduce: the user context (`context.run()`'s), the caller identity, the owner-locked context
+	 * keys and whether the flow is host-trusted. Used by the event system (#497) so a deferred
+	 * delivery runs exactly as an immediate one would have. Holds references only — nothing is cloned
+	 * or serialized.
+	 *
+	 * @param {string} instanceID - Instance whose flow to capture.
+	 * @returns {object|null} An opaque flow snapshot for {@link runInSnapshotFlow}, or null when the
+	 *   instance has no context store.
+	 * @public
+	 */
+	snapshotFlow(instanceID) {
+		const store = this.tryGetContext(instanceID);
+		if (!store) return null;
+		const identity = this.getCallerIdentity(instanceID);
+		return {
+			context: store.context,
+			currentWrapper: identity.currentWrapper ?? null,
+			callerWrapper: identity.callerWrapper ?? null,
+			contextOwners: store.__contextOwners ?? null,
+			trusted: store[TRUSTED_ROOT] === true
+		};
+	}
+
+	/**
+	 * Run `fn` inside a flow rebuilt from a {@link snapshotFlow} snapshot, on top of the instance's
+	 * CURRENT base store (so a snapshot taken before a reload runs against the reloaded instance).
+	 * The replayed store is made the active instance for the duration of `fn` — including its async
+	 * tail — exactly as `run()`/`scope()` do in the live runtime. The deliverer's own ambient context
+	 * is not merged in: the snapshot's context replaces it.
+	 *
+	 * @param {string} instanceID - Instance to run against.
+	 * @param {object} captured - Snapshot from {@link snapshotFlow}.
+	 * @param {Function} fn - Function to run (may be async).
+	 * @returns {Promise<*>} Resolves/rejects with `fn`'s outcome.
+	 * @throws {SlothletError} CONTEXT_NOT_FOUND when the instance has no base store.
+	 * @public
+	 */
+	async runInSnapshotFlow(instanceID, captured, fn) {
+		const childStore = buildCapturedFlowStore(this.instances, instanceID, captured);
+		this.instances.set(childStore.instanceID, childStore);
+		const previousInstanceID = this.currentInstanceID;
+		try {
+			this.currentInstanceID = childStore.instanceID;
+			return await fn();
+		} finally {
+			this.currentInstanceID = previousInstanceID;
+			this.instances.delete(childStore.instanceID);
+		}
+	}
+
 	/**
 	 * Cleanup instance context
 	 * @param {string} instanceID - Instance to cleanup
diff --git a/src/lib/handlers/event-manager.mjs b/src/lib/handlers/event-manager.mjs
index b47a56253..569e032e5 100644
--- a/src/lib/handlers/event-manager.mjs
+++ b/src/lib/handlers/event-manager.mjs
@@ -36,9 +36,49 @@
  * breaks the others or the emitter). Each listener runs pinned to its registering module's identity
  * (captured at subscribe) so `self.*` inside a listener is attributed correctly — the same discipline
  * the hook manager uses. `emit` is NOT gated (emitting must not break); only subscription/delivery is.
+ *
+ * Delivery can be taken over by the host (#497): `strategy(fn)` installs a function called per emit
+ * with the event's envelope, the recipients' listener ids, and a `defaultDeliver` that delivers now.
+ * A strategy that does not call `defaultDeliver` defers the event; the host later delivers it one
+ * listener at a time with `deliver(envelope, listenerId)`, which enforces the event rules at that
+ * moment and runs inside the context captured at emit time. Listener ids —
+ * `<owner moduleID>:<event>:<n or key>` — are resolved against the live registrations on every
+ * `deliver`, so an envelope stays deliverable across a reload once the listener re-registers.
  */
 
 import { ComponentBase } from "#factories/component-base";
+import { MODULE_ID_SEPARATOR } from "#handlers/metadata";
+
+/**
+ * Envelope → its private delivery record `{ slothlet, meta, flow, subs }`. Module-level (not per
+ * EventManager) so an envelope kept by the host stays deliverable after a full reload, which replaces
+ * the instance's EventManager; the record names the owning Slothlet instance so another instance
+ * refuses it. A WeakMap, so a discarded (rolled-back) envelope is collected with its record.
+ * @type {WeakMap<object, object>}
+ * @private
+ */
+const ENVELOPES = new WeakMap();
+
+/**
+ * Machine-readable `reason` codes of an undelivered `deliver()` result (#497). Stable tokens a host
+ * branches on — not display text, so not translated.
+ * @type {Readonly<{ LISTENER_GONE: "listener-gone", DENIED: "denied" }>}
+ * @internal
+ */
+export const DELIVERY_REASONS = Object.freeze({ LISTENER_GONE: "listener-gone", DENIED: "denied" });
+
+/**
+ * The owner segment of a listener id: the registering module's base moduleID, or `""` for a host
+ * subscription. `""` can never be a real moduleID (an empty `moduleID` option falls back to the
+ * generated default), so a host id never collides with a module's.
+ * @param {object|null} wrapper - The registering (or emitting) module's wrapper, or null for the host.
+ * @returns {string} The owner id.
+ * @private
+ */
+function ownerIdOf(wrapper) {
+	if (!wrapper) return "";
+	return String(wrapper.____slothletInternal.moduleID).split(MODULE_ID_SEPARATOR)[0];
+}
 
 /**
  * Instance-wide event manager (#407).
@@ -54,18 +94,36 @@ export class EventManager extends ComponentBase {
 
 	/**
 	 * Event name → Set of subscription records. Each record:
-	 * `{ listener, once, subscriberPath, ownerWrapper, level, levelEpoch }`.
+	 * `{ listener, once, subscriberPath, ownerWrapper, ownerID, id, level, levelEpoch }`.
 	 * @type {Map<string, Set<object>>}
 	 * @private
 	 */
 	#subscribers = new Map();
 
+	/**
+	 * Owner id → (event → next keyless listener ordinal). The `<n>` of a listener id is the ordinal of
+	 * its registration among its owner's registrations for that event, so the same registration order
+	 * reproduces the same ids after a reload. Reset for an owner whose module is reloaded or removed.
+	 * @type {Map<string, Map<string, number>>}
+	 * @private
+	 */
+	#ordinals = new Map();
+
+	/**
+	 * The host's delivery strategy (#497), or null for immediate delivery.
+	 * @type {Function|null}
+	 * @private
+	 */
+	#strategy = null;
+
 	/**
 	 * @param {object} slothlet - Slothlet instance.
 	 */
 	constructor(slothlet) {
 		super(slothlet);
 		this.#subscribers = new Map();
+		this.#ordinals = new Map();
+		this.#strategy = null;
 	}
 
 	/**
@@ -87,9 +145,13 @@ export class EventManager extends ComponentBase {
 	 *   is `undefined`; `meta` is `{ event, at, instanceID }`.
 	 * @param {object} [options={}] - Options.
 	 * @param {boolean} [options.once=false] - Remove the subscription after its first delivery.
-	 * @returns {{ level: "deny"|"notify"|"allow", off: Function }} The granted level and an unsubscribe
-	 *   function. At `deny` the listener is not registered and `off` is a no-op.
-	 * @throws {SlothletError} INVALID_ARGUMENT for a non-string event or non-function listener.
+	 * @param {string|number} [options.key] - Replaces the ordinal `<n>` in the listener id, for a listener
+	 *   that is registered conditionally (so its position among its module's listeners is not stable).
+	 * @returns {{ level: "deny"|"notify"|"allow", off: Function, id: string }} The granted level, an
+	 *   unsubscribe function, and the listener id (`<owner moduleID>:<event>:<n or key>`, owner `""` for
+	 *   the host). At `deny` the listener is not registered and `off` is a no-op.
+	 * @throws {SlothletError} INVALID_ARGUMENT for a non-string event, a non-function listener, an empty
+	 *   or non-string/number `key`, or an id already held by another registered listener.
 	 * @public
 	 */
 	on(event, listener, options = {}) {
@@ -99,6 +161,14 @@ export class EventManager extends ComponentBase {
 		if (typeof listener !== "function") {
 			throw new this.SlothletError("INVALID_ARGUMENT", { argument: "listener", expected: "a function", received: typeof listener });
 		}
+		const key = options.key;
+		if (key !== undefined && !((typeof key === "string" && key !== "") || (typeof key === "number" && Number.isFinite(key)))) {
+			throw new this.SlothletError("INVALID_ARGUMENT", {
+				argument: "options.key",
+				expected: "a non-empty string or a finite number",
+				received: key === "" ? "empty string" : typeof key
+			});
+		}
 
 		// Capture the SUBSCRIBER's identity at registration — the module that called on(). Null for the
 		// host (no module caller). Mirrors HookManager: the caller-supplied identity is never trusted.
@@ -111,26 +181,58 @@ export class EventManager extends ComponentBase {
 		// for this instance's own — the same instance-scoping the read-gate (#290) already uses.
 		const ownerWrapper = this.slothlet.contextManager?.getCallerIdentity?.(this.instanceID)?.currentWrapper ?? null;
 		const subscriberPath = ownerWrapper?.____slothletInternal?.apiPath ?? null;
+		const ownerID = ownerIdOf(ownerWrapper);
+		const id = `${ownerID}:${event}:${key === undefined ? this.#nextOrdinal(ownerID, event) : String(key)}`;
+		for (const existing of this.#subscribers.get(event) ?? []) {
+			if (existing.id === id) {
+				throw new this.SlothletError("INVALID_ARGUMENT", {
+					argument: "options.key",
+					expected: "a listener id not already registered for this event",
+					received: id
+				});
+			}
+		}
 
 		const sub = {
 			listener,
 			once: options.once === true,
 			subscriberPath,
 			ownerWrapper,
+			ownerID,
+			id,
 			level: null,
 			levelEpoch: -1
 		};
 
 		const level = this.#levelFor(sub, event);
-		// deny → subscription refused; do not register, hand back a no-op unsubscribe.
+		// deny → subscription refused; do not register, hand back a no-op unsubscribe. The ordinal is
+		// still consumed, so a later rule change cannot shift the ids of this module's other listeners.
 		if (level === "deny") {
-			return { level, off: () => {} };
+			return { level, off: () => {}, id };
 		}
 
 		if (!this.#subscribers.has(event)) this.#subscribers.set(event, new Set());
 		this.#subscribers.get(event).add(sub);
 
-		return { level, off: () => this.#removeSub(event, sub) };
+		return { level, off: () => this.#removeSub(event, sub), id };
+	}
+
+	/**
+	 * Take the next keyless-listener ordinal for an owner and event.
+	 * @param {string} ownerID - Owner id (`""` for the host).
+	 * @param {string} event - Event name.
+	 * @returns {number} The ordinal.
+	 * @private
+	 */
+	#nextOrdinal(ownerID, event) {
+		let perEvent = this.#ordinals.get(ownerID);
+		if (!perEvent) {
+			perEvent = new Map();
+			this.#ordinals.set(ownerID, perEvent);
+		}
+		const n = perEvent.get(event) ?? 0;
+		perEvent.set(event, n + 1);
+		return n;
 	}
 
 	/**
@@ -138,7 +240,7 @@ export class EventManager extends ComponentBase {
 	 * @param {string} event - Event name.
 	 * @param {Function} listener - Listener.
 	 * @param {object} [options={}] - Options (merged with `once: true`).
-	 * @returns {{ level: "deny"|"notify"|"allow", off: Function }} The granted level and unsubscribe.
+	 * @returns {{ level: "deny"|"notify"|"allow", off: Function, id: string }} The granted level, unsubscribe, and listener id.
 	 * @public
 	 */
 	once(event, listener, options = {}) {
@@ -169,9 +271,16 @@ export class EventManager extends ComponentBase {
 	 * enforced per subscriber at delivery. Async, fire-and-forget, per-listener error isolation:
 	 * a throwing listener surfaces a `SlothletWarning` and never affects the others or the emitter.
 	 *
+	 * With a host {@link strategy} installed, the event is handed to it instead of being delivered:
+	 * `emit` resolves once the strategy has ACCEPTED it (its return value has settled), plus — when the
+	 * strategy called `defaultDeliver` by then — once that delivery has settled too. A strategy that
+	 * returns without calling `defaultDeliver` has deferred the event; a strategy that throws or rejects
+	 * rejects `emit` with that error.
+	 *
 	 * @param {string} event - Event name.
 	 * @param {*} [payload] - Domain payload, delivered only to `allow`-level subscribers.
-	 * @returns {Promise<void>} Resolves once all listeners (including async) have settled.
+	 * @returns {Promise<void>} Resolves once all listeners (including async) have settled, or — under a
+	 *   deferring strategy — once the strategy has accepted the event.
 	 * @throws {SlothletError} INVALID_ARGUMENT for a non-string event.
 	 * @public
 	 */
@@ -180,14 +289,33 @@ export class EventManager extends ComponentBase {
 			throw new this.SlothletError("INVALID_ARGUMENT", { argument: "event", expected: "a non-empty string", received: typeof event });
 		}
 		const set = this.#subscribers.get(event);
+		const strategy = this.#strategy;
+		if (strategy) {
+			await this.#emitThroughStrategy(strategy, event, payload, set ? [...set] : []);
+			return;
+		}
 		if (!set || set.size === 0) return;
 
 		const meta = { event, at: Date.now(), instanceID: this.instanceID };
+		// Snapshot: allow listeners to off()/subscribe during dispatch, and support `once` removal.
+		await this.#dispatch(event, payload, meta, [...set]);
+	}
+
+	/**
+	 * Deliver an event to a snapshot of its subscribers now — the immediate path, shared by a plain
+	 * `emit` and a strategy's `defaultDeliver`.
+	 * @param {string} event - Event name.
+	 * @param {*} payload - Domain payload.
+	 * @param {object} meta - Trigger envelope `{ event, at, instanceID }` handed to every listener.
+	 * @param {Array<object>} subs - Subscription records to deliver to.
+	 * @returns {Promise<void>} Resolves once every listener has settled.
+	 * @private
+	 */
+	async #dispatch(event, payload, meta, subs) {
 		const cm = this.slothlet.contextManager;
 		const promises = [];
 
-		// Snapshot: allow listeners to off()/subscribe during dispatch, and support `once` removal.
-		for (const sub of [...set]) {
+		for (const sub of subs) {
 			const level = this.#levelFor(sub, event);
 			// A (gated) rule change may have downgraded this subscriber to deny → drop it.
 			if (level === "deny") {
@@ -200,10 +328,7 @@ export class EventManager extends ComponentBase {
 			try {
 				// Run pinned to the subscriber's identity/context so self.* resolves as that module.
 				// rawErrors:true surfaces the listener's own error so we can isolate + warn on it.
-				const result =
-					sub.ownerWrapper && cm?.runInContext
-						? cm.runInContext(this.instanceID, sub.listener, undefined, callArgs, sub.ownerWrapper, true)
-						: sub.listener(...callArgs);
+				const result = this.#invoke(sub, callArgs, cm);
 				if (result && typeof result.then === "function") {
 					promises.push(result.catch((error) => this.#warnListener(event, error)));
 				}
@@ -215,6 +340,227 @@ export class EventManager extends ComponentBase {
 		if (promises.length > 0) await Promise.all(promises);
 	}
 
+	/**
+	 * Call a subscription's listener, pinned to its registering module's identity when it has one.
+	 * @param {object} sub - Subscription record.
+	 * @param {Array} callArgs - `[payload, meta]`.
+	 * @param {object} cm - Context manager.
+	 * @returns {*} The listener's return value.
+	 * @private
+	 */
+	#invoke(sub, callArgs, cm) {
+		return sub.ownerWrapper && cm?.runInContext
+			? cm.runInContext(this.instanceID, sub.listener, undefined, callArgs, sub.ownerWrapper, true)
+			: sub.listener(...callArgs);
+	}
+
+	/**
+	 * Hand an emit to the host's strategy (#497). Builds the envelope — event, payload, emitter
+	 * identity, and the emit-time level of each recipient — records its private delivery state
+	 * (the captured flow, the trigger meta), and calls `strategy(envelope, listeners, defaultDeliver)`.
+	 * @param {Function} strategy - The host strategy.
+	 * @param {string} event - Event name.
+	 * @param {*} payload - Domain payload.
+	 * @param {Array<object>} subs - Snapshot of the event's subscription records.
+	 * @returns {Promise<void>} Resolves on acceptance, and after any `defaultDeliver` it triggered.
+	 * @private
+	 */
+	async #emitThroughStrategy(strategy, event, payload, subs) {
+		const meta = { event, at: Date.now(), instanceID: this.instanceID };
+		const cm = this.slothlet.contextManager;
+		// The emitter's flow — its user context, caller identity and trust — so a deferred delivery runs
+		// in it, exactly as the immediate one would have. Also the emitter identity for the envelope.
+		const flow = cm?.snapshotFlow?.(this.instanceID) ?? null;
+		const emitterWrapper = flow?.currentWrapper ?? null;
+
+		const listeners = [];
+		const levels = {};
+		for (const sub of subs) {
+			// Informational only: rules are enforced again when each listener is actually delivered.
+			// A listener denied at emit time is not a recipient.
+			const level = this.#levelFor(sub, event);
+			if (level === "deny") continue;
+			listeners.push(sub.id);
+			levels[sub.id] = level;
+		}
+		Object.freeze(listeners);
+
+		const envelope = Object.freeze({
+			event,
+			payload,
+			at: meta.at,
+			instanceID: this.instanceID,
+			emitter: emitterWrapper
+				? Object.freeze({ moduleID: ownerIdOf(emitterWrapper), apiPath: emitterWrapper.____slothletInternal.apiPath })
+				: null,
+			levels: Object.freeze(levels),
+			listeners
+		});
+		ENVELOPES.set(envelope, { slothlet: this.slothlet, meta, flow });
+
+		let delivery = null;
+		const defaultDeliver = () => {
+			// Idempotent: a second call returns the first delivery rather than delivering twice.
+			if (!delivery) delivery = this.#dispatch(event, payload, meta, subs);
+			return delivery;
+		};
+
+		await strategy(envelope, listeners, defaultDeliver);
+		if (delivery) await delivery;
+	}
+
+	/**
+	 * Install (or clear) the host's delivery strategy (#497). Host-only — gated like `rules.*` by the
+	 * built-in `slothlet.event.**` deny. The strategy is called per emit as
+	 * `strategy(envelope, listeners, defaultDeliver)`:
+	 *
+	 * - `envelope` — frozen `{ event, payload, at, instanceID, emitter, levels, listeners }`: `emitter` is
+	 *   `{ moduleID, apiPath }` of the emitting module (null for the host); `levels` maps each recipient's
+	 *   listener id to its level resolved at emit time (informational — levels are enforced at delivery).
+	 * - `listeners` — the recipients' listener ids (the same array as `envelope.listeners`).
+	 * - `defaultDeliver()` — delivers now, exactly as without a strategy; returns a promise that settles
+	 *   when the listeners have. Idempotent.
+	 *
+	 * Returning without calling `defaultDeliver` defers the event: `emit` resolves once the strategy's
+	 * return value settles, and the host delivers later with {@link deliver}. The strategy survives a
+	 * reload.
+	 *
+	 * @param {Function|null} fn - The strategy, or null to restore immediate delivery.
+	 * @returns {void}
+	 * @throws {SlothletError} INVALID_ARGUMENT when `fn` is neither a function nor null.
+	 * @public
+	 */
+	strategy(fn) {
+		if (fn !== null && typeof fn !== "function") {
+			throw new this.SlothletError("INVALID_ARGUMENT", { argument: "fn", expected: "a function or null", received: typeof fn });
+		}
+		this.#strategy = fn;
+	}
+
+	/**
+	 * The installed strategy, so a full reload can carry it into the rebuilt EventManager.
+	 * @returns {Function|null} The strategy, or null.
+	 * @internal
+	 */
+	exportStrategy() {
+		return this.#strategy;
+	}
+
+	/**
+	 * Deliver a strategy-held envelope to ONE listener (#497), so a per-listener retry never re-runs
+	 * listeners that already succeeded. Host-only — gated like `rules.*` by the built-in
+	 * `slothlet.event.**` deny.
+	 *
+	 * The listener id is resolved against the CURRENT registrations, so after a full or scoped reload
+	 * it reaches the re-registered listener with that id. The delivery runs inside the flow captured at
+	 * `emit()` — the emitter's user context and caller identity — and the listener's level is resolved
+	 * now, against the current rules, in that flow; a listener runs pinned to its module, as on the
+	 * immediate path. A `once` listener is consumed by its first delivery.
+	 *
+	 * @param {object} envelope - An envelope this instance passed to its strategy.
+	 * @param {string} listenerId - One of `envelope.listeners`.
+	 * @returns {Promise<{ delivered: true, level: "notify"|"allow" }|{ delivered: false, reason: "listener-gone"|"denied" }>}
+	 *   `delivered: true` with the level it was delivered at; `listener-gone` when no listener holds that
+	 *   id any more (its module was removed, or a reload dropped it and it has not re-registered);
+	 *   `denied` when the current rules deny that listener the event (the subscription is dropped, as on
+	 *   the immediate path). The listener's return value is discarded, as on the immediate path.
+	 * @throws {SlothletError} INVALID_ARGUMENT (as a rejection) for an envelope this instance did not
+	 *   produce or a listener id not on it. A listener that throws or rejects rejects with its own error.
+	 * @public
+	 */
+	async deliver(envelope, listenerId) {
+		const record = envelope !== null && typeof envelope === "object" ? ENVELOPES.get(envelope) : undefined;
+		if (!record || record.slothlet !== this.slothlet) {
+			throw new this.SlothletError("INVALID_ARGUMENT", {
+				argument: "envelope",
+				expected: "an envelope this instance passed to its event strategy",
+				received: envelope === null ? "null" : typeof envelope
+			});
+		}
+		if (typeof listenerId !== "string" || !envelope.listeners.includes(listenerId)) {
+			throw new this.SlothletError("INVALID_ARGUMENT", {
+				argument: "listenerId",
+				expected: "a listener id listed on the envelope",
+				received: typeof listenerId === "string" ? listenerId : typeof listenerId
+			});
+		}
+		const cm = this.slothlet.contextManager;
+		const run = () => this.#deliverOne(envelope, record, listenerId, cm);
+		return record.flow && cm?.runInSnapshotFlow ? cm.runInSnapshotFlow(this.instanceID, record.flow, run) : run();
+	}
+
+	/**
+	 * Resolve one listener id against the current registrations and deliver the envelope to it.
+	 * Runs inside the captured flow (see {@link deliver}).
+	 * @param {object} envelope - The envelope.
+	 * @param {object} record - Its private delivery record.
+	 * @param {string} listenerId - Listener id.
+	 * @param {object} cm - Context manager.
+	 * @returns {Promise<object>} The delivery result.
+	 * @private
+	 */
+	async #deliverOne(envelope, record, listenerId, cm) {
+		const { event } = envelope;
+		let sub = null;
+		for (const candidate of this.#subscribers.get(event) ?? []) {
+			if (candidate.id === listenerId) {
+				sub = candidate;
+				break;
+			}
+		}
+		if (!sub) return { delivered: false, reason: DELIVERY_REASONS.LISTENER_GONE };
+
+		const level = this.#levelFor(sub, event);
+		if (level === "deny") {
+			this.#removeSub(event, sub);
+			return { delivered: false, reason: DELIVERY_REASONS.DENIED };
+		}
+		if (sub.once) this.#removeSub(event, sub);
+		const callArgs = level === "allow" ? [envelope.payload, record.meta] : [undefined, record.meta];
+		await this.#invoke(sub, callArgs, cm);
+		return { delivered: true, level };
+	}
+
+	/**
+	 * Drop every subscription a module registered and reset its listener ordinals. Called when the
+	 * module is removed: its listeners are closures over code that is gone.
+	 * @param {string} moduleID - The removed module's id.
+	 * @returns {void}
+	 * @internal
+	 */
+	onModuleRemoved(moduleID) {
+		this.#dropOwner(moduleID);
+	}
+
+	/**
+	 * Drop every subscription a module registered and reset its listener ordinals, BEFORE the module is
+	 * rebuilt by a scoped reload. The old listeners are closures over the pre-reload module; the
+	 * reloaded module registers its listeners again and, in the same order, gets the same ids — which
+	 * is what lets a strategy-held envelope reach them.
+	 * @param {string} moduleID - The reloaded module's id.
+	 * @returns {void}
+	 * @internal
+	 */
+	onModuleReloaded(moduleID) {
+		this.#dropOwner(moduleID);
+	}
+
+	/**
+	 * Remove an owner's subscriptions and ordinals.
+	 * @param {string} moduleID - Module id (plain or composite).
+	 * @returns {void}
+	 * @private
+	 */
+	#dropOwner(moduleID) {
+		const ownerID = String(moduleID).split(MODULE_ID_SEPARATOR)[0];
+		for (const [event, set] of [...this.#subscribers]) {
+			for (const sub of [...set]) {
+				if (sub.ownerID === ownerID) this.#removeSub(event, sub);
+			}
+		}
+		this.#ordinals.delete(ownerID);
+	}
+
 	/**
 	 * Resolve the delivery level a given subscriber identity WOULD be granted for an event, WITHOUT
 	 * subscribing. Host-only (gated like `rules.*` by the built-in `slothlet.event.**` deny), because
@@ -323,5 +669,7 @@ export class EventManager extends ComponentBase {
 	 */
 	shutdown() {
 		this.#subscribers.clear();
+		this.#ordinals.clear();
+		this.#strategy = null;
 	}
 }
diff --git a/src/lib/handlers/permission-manager.mjs b/src/lib/handlers/permission-manager.mjs
index 6abb78f27..222738328 100644
--- a/src/lib/handlers/permission-manager.mjs
+++ b/src/lib/handlers/permission-manager.mjs
@@ -450,8 +450,9 @@ export class PermissionManager extends ComponentBase {
 
 		// Event system (#407): modules may USE the event surface (subscribe/emit); per-subscriber
 		// DELIVERY is governed by the separate three-level event-rule pool (resolveEventLevel), not this
-		// coarse call gate. The broad deny keeps runtime rule mutation (`slothlet.event.rules.*`)
-		// host-only — modules cannot override event rules at runtime — while the specific allows keep
+		// coarse call gate. The broad deny keeps runtime rule mutation (`slothlet.event.rules.*`), the
+		// supplied-identity query (`resolveLevel`) and the delivery controls (`strategy`/`deliver`, #497)
+		// host-only — modules cannot override event policy or delivery — while the specific allows keep
 		// on/once/off/emit usable under a `defaultPolicy: "deny"` configuration. A consumer rule of equal
 		// specificity still wins (instance layer > builtin), so the host can tighten any of these.
 		this.addRule({ caller: "**", target: "slothlet.event.**", effect: "deny" }, "__builtin__");
diff --git a/src/lib/handlers/trusted-root.mjs b/src/lib/handlers/trusted-root.mjs
index 86a8e0535..238fc2066 100644
--- a/src/lib/handlers/trusted-root.mjs
+++ b/src/lib/handlers/trusted-root.mjs
@@ -252,3 +252,44 @@ export function readProtectedContextValue(ctx, prop, getContext) {
 	}
 	return ctx.context[prop];
 }
+
+/**
+ * Build the context store a {@link snapshotFlow}-snapshotted flow is replayed in (#497), shared by the
+ * async and live context managers. The store is a `run()`/`scope()`-style child of the instance's
+ * CURRENT base store — fresh `self` / `config` / `slothlet` references, so a snapshot taken before a
+ * reload runs against the reloaded instance — carrying the snapshot's user context, caller identity,
+ * owner-locked keys and host trust. The deliverer's own ambient context is deliberately not merged
+ * in: the flow is the emitter's, not whoever replays it.
+ *
+ * @param {Map<string, object>} instances - The context manager's instance-store registry.
+ * @param {string} instanceID - The instance to replay against.
+ * @param {object} captured - The snapshot (`{ context, currentWrapper, callerWrapper, contextOwners, trusted }`).
+ * @returns {object} The child store (not yet registered).
+ * @throws {SlothletError} CONTEXT_NOT_FOUND when the instance has no base store.
+ * @internal
+ */
+export function buildCapturedFlowStore(instances, instanceID, captured) {
+	const baseStore = instances.get(instanceID);
+	if (!baseStore) {
+		throw new SlothletError("CONTEXT_NOT_FOUND", {
+			instanceID,
+			availableInstances: Array.from(instances.keys()).join(", ") || "none"
+		});
+	}
+	const childStore = {
+		instanceID: `${instanceID}__run_${Date.now()}_${Math.random().toString(36).slice(2, 9)}`,
+		context: captured.context,
+		self: baseStore.self,
+		config: baseStore.config,
+		createdAt: baseStore.createdAt,
+		parentInstanceID: instanceID,
+		currentWrapper: captured.currentWrapper,
+		callerWrapper: captured.callerWrapper,
+		slothlet: baseStore.slothlet,
+		__contextOwners: captured.contextOwners
+	};
+	if (captured.trusted) {
+		Object.defineProperty(childStore, TRUSTED_ROOT, { value: true, configurable: true });
+	}
+	return childStore;
+}
diff --git a/src/slothlet.mjs b/src/slothlet.mjs
index 2e4b6fa3a..44b9d6c5b 100644
--- a/src/slothlet.mjs
+++ b/src/slothlet.mjs
@@ -1044,6 +1044,11 @@ class Slothlet {
 		//     This preserves hook.on() registrations across full reload.
 		const savedHooks = this.handlers.hookManager?.exportHooks?.();
 
+		// 3c'. Save the host's event-delivery strategy (#497) — host configuration, like hooks — before
+		//      load() replaces the EventManager. Subscriptions themselves are not carried: modules
+		//      re-register theirs, and listener ids are stable across that re-registration.
+		const savedEventStrategy = this.handlers.eventManager?.exportStrategy?.() ?? null;
+
 		// 3d. Save the permission-control seal state before load() constructs a fresh
 		//     PermissionManager (whose #sealed resets to false). seal() is a one-way lock,
 		//     so a reload must not silently unseal it; it is re-applied after rule replay below.
@@ -1067,6 +1072,11 @@ class Slothlet {
 			this.handlers.hookManager.importHooks(savedHooks);
 		}
 
+		// 4d. Restore the event-delivery strategy into the new EventManager.
+		if (savedEventStrategy) {
+			this.handlers.eventManager.strategy(savedEventStrategy);
+		}
+
 		// 5. Reparent any child __run_ context stores that were created before reload.
 		//    Their parentInstanceID points to the old base instanceID; updating it lets
 		//    context.get() still find them for callers that call reload() inside a .run() scope.
@@ -1694,6 +1704,17 @@ export default slothlet;
  * @property {Function} slothlet.hook.pin.disable - Stop enforcing hook pinning: permit a per-registration `lockCaller: false` on module hooks. Host-only. %%sig: (): boolean%% %%example: // ESM usage via slothlet API|import slothlet from "@cldmv/slothlet";|const api = await slothlet({ base: './api', hook: true });|api.slothlet.hook.pin.disable(); // permit unpinned module hooks (host only)%%
  * @property {Function} slothlet.hook.remove - Remove hooks matching a filter (`id`, `type`, `pattern`). %%sig: ([filter]: Object): void%% %%example: // ESM usage via slothlet API|import slothlet from "@cldmv/slothlet";|const api = await slothlet({ base: './api', hook: true });|api.slothlet.hook.remove({ type: 'before', pattern: 'math.*' });%% %%example: // ESM usage via slothlet API (inside async function)|async function example() {|  const { default: slothlet } = await import("@cldmv/slothlet");|  const api = await slothlet({ base: './api', hook: true });|  api.slothlet.hook.remove({ type: 'before', pattern: 'math.*' });|}%% %%example: // CJS usage via slothlet API (top-level)|let slothlet;|(async () => {|  ({ slothlet } = await import("@cldmv/slothlet"));|  const api = await slothlet({ base: './api', hook: true });|  api.slothlet.hook.remove({ type: 'before', pattern: 'math.*' });|})();%% %%example: // CJS usage via slothlet API (inside async function)|const slothlet = require("@cldmv/slothlet");|const api = await slothlet({ base: './api', hook: true });|api.slothlet.hook.remove({ type: 'before', pattern: 'math.*' });%%
  * @property {Function} slothlet.hook.resetPatternFilter - Reset the runtime global path filter back to the configured `hook.pattern` default (fully unrestricted if that default was `"**"`). %%sig: (): void%% %%example: // ESM usage via slothlet API|import slothlet from "@cldmv/slothlet";|const api = await slothlet({ base: './api', hook: 'database.*' });|api.slothlet.hook.enablePattern('cache.*');|api.slothlet.hook.resetPatternFilter(); // back to database.* only%% %%example: // ESM usage via slothlet API (inside async function)|async function example() {|  const { default: slothlet } = await import("@cldmv/slothlet");|  const api = await slothlet({ base: './api', hook: 'database.*' });|  api.slothlet.hook.resetPatternFilter();|}%% %%example: // CJS usage via slothlet API (top-level)|let slothlet;|(async () => {|  ({ slothlet } = await import("@cldmv/slothlet"));|  const api = await slothlet({ base: './api', hook: 'database.*' });|  api.slothlet.hook.resetPatternFilter();|})();%% %%example: // CJS usage via slothlet API (inside async function)|const slothlet = require("@cldmv/slothlet");|const api = await slothlet({ base: './api', hook: 'database.*' });|api.slothlet.hook.resetPatternFilter();%%
+ * @property {object} slothlet.event - Instance-wide, permission-gated event system — named pub/sub scoped to this instance. Each subscriber's delivery level (`deny`/`notify`/`allow`) is resolved from the event-rule pool. `on`/`once`/`off`/`emit` are open to modules; `resolveLevel`, `rules.*`, `strategy` and `deliver` are host-only (built-in `slothlet.event.**` deny).
+ * @property {Function} slothlet.event.on - Subscribe a listener, called `(payload, meta)`. Returns the granted level, an unsubscribe, and the listener id `<owner moduleID>:<event>:<n>` (`options.key` replaces `n`; the host's owner is empty). %%sig: (event: string, listener: function, options?: { once?: boolean, key?: string|number }): { level: string, off: function, id: string }%% %%example: // ESM usage via slothlet API|import slothlet from "@cldmv/slothlet";|const api = await slothlet({ base: './api' });|const { level, off, id } = api.slothlet.event.on('orders.created', (payload, meta) => {});%%
+ * @property {Function} slothlet.event.once - Subscribe for a single delivery, then auto-unsubscribe. %%sig: (event: string, listener: function, options?: { key?: string|number }): { level: string, off: function, id: string }%% %%example: // ESM usage via slothlet API|import slothlet from "@cldmv/slothlet";|const api = await slothlet({ base: './api' });|api.slothlet.event.once('orders.created', (payload) => console.log(payload));%%
+ * @property {Function} slothlet.event.off - Remove a listener by reference. %%sig: (event: string, listener: function): boolean%% %%example: // ESM usage via slothlet API|import slothlet from "@cldmv/slothlet";|const api = await slothlet({ base: './api' });|const onCreated = () => {};|api.slothlet.event.on('orders.created', onCreated);|api.slothlet.event.off('orders.created', onCreated);%%
+ * @property {Function} slothlet.event.emit - Publish an event. Ungated. Resolves once every listener has settled — or, under a strategy that defers, once the strategy has accepted it. %%sig: (event: string, payload?: any): Promise<void>%% %%example: // ESM usage via slothlet API|import slothlet from "@cldmv/slothlet";|const api = await slothlet({ base: './api' });|await api.slothlet.event.emit('orders.created', { id: 42 });%%
+ * @property {Function} slothlet.event.resolveLevel - Resolve the delivery level a supplied subscriber identity would be granted, without subscribing. Host-only. %%sig: (subscriberPath: string|null, event: string): string%% %%example: // ESM usage via slothlet API|import slothlet from "@cldmv/slothlet";|const api = await slothlet({ base: './api' });|api.slothlet.event.resolveLevel('reporting.dashboard', 'orders.created'); // "deny" | "notify" | "allow"%%
+ * @property {object} slothlet.event.rules - Runtime event-rule mutation. Host-only; gated by `api.mutations.events`.
+ * @property {Function} slothlet.event.rules.add - Add an event rule in the runtime layer; returns its id. %%sig: (rule: { caller: string, event: string, effect: string, condition?: any }): string%% %%example: // ESM usage via slothlet API|import slothlet from "@cldmv/slothlet";|const api = await slothlet({ base: './api' });|const ruleId = api.slothlet.event.rules.add({ caller: 'reporting.**', event: 'orders.*', effect: 'allow' });%%
+ * @property {Function} slothlet.event.rules.remove - Remove a runtime event rule by id. %%sig: (ruleId: string): boolean%% %%example: // ESM usage via slothlet API|import slothlet from "@cldmv/slothlet";|const api = await slothlet({ base: './api' });|api.slothlet.event.rules.remove(ruleId);%%
+ * @property {Function} slothlet.event.strategy - Hand every emit to a host delivery strategy, called `(envelope, listeners, defaultDeliver)`; `null` restores immediate delivery. A strategy that returns without calling `defaultDeliver` defers the event (emit resolves on acceptance); one that calls it delivers now (emit resolves on settle). Host-only; survives reload. %%sig: (fn: function|null): void%% %%example: // ESM usage via slothlet API|import slothlet from "@cldmv/slothlet";|const api = await slothlet({ base: './api' });|const pending = [];|api.slothlet.event.strategy((envelope, listeners, defaultDeliver) => {|  if (!inTransaction()) return defaultDeliver();|  pending.push({ envelope, listeners });|});%%
+ * @property {Function} slothlet.event.deliver - Deliver a strategy-held envelope to one listener, inside the context captured at emit, enforcing the rules as they stand now. Resolves `{ delivered: true, level }`, or `{ delivered: false, reason: "listener-gone" | "denied" }`; rejects with the listener's error when it throws. Host-only. %%sig: (envelope: object, listenerId: string): Promise<{ delivered: boolean, level?: string, reason?: string }>%% %%example: // ESM usage via slothlet API|import slothlet from "@cldmv/slothlet";|const api = await slothlet({ base: './api' });|for (const { envelope, listeners } of pending.splice(0)) {|  for (const id of listeners) await api.slothlet.event.deliver(envelope, id);|}%%
  * @property {object} slothlet.lifecycle - Lifecycle event emitter.
  * @property {Function} slothlet.lifecycle.off - Unsubscribe a handler from a lifecycle event. %%sig: (event: string, handler: function): void%% %%example: // ESM usage via slothlet API|import slothlet from "@cldmv/slothlet";|const api = await slothlet({ base: './api' });|const handler = () => console.log('shutdown');|api.slothlet.lifecycle.on('shutdown', handler);|api.slothlet.lifecycle.off('shutdown', handler);%% %%example: // ESM usage via slothlet API (inside async function)|async function example() {|  const { default: slothlet } = await import("@cldmv/slothlet");|  const api = await slothlet({ base: './api' });|  const handler = () => console.log('shutdown');|  api.slothlet.lifecycle.on('shutdown', handler);|  api.slothlet.lifecycle.off('shutdown', handler);|}%% %%example: // CJS usage via slothlet API (top-level)|let slothlet;|(async () => {|  ({ slothlet } = await import("@cldmv/slothlet"));|  const api = await slothlet({ base: './api' });|  const handler = () => console.log('shutdown');|  api.slothlet.lifecycle.on('shutdown', handler);|  api.slothlet.lifecycle.off('shutdown', handler);|})();%% %%example: // CJS usage via slothlet API (inside async function)|const slothlet = require("@cldmv/slothlet");|const api = await slothlet({ base: './api' });|const handler = () => console.log('shutdown');|api.slothlet.lifecycle.on('shutdown', handler);|api.slothlet.lifecycle.off('shutdown', handler);%%
  * @property {Function} slothlet.lifecycle.on - Subscribe to a lifecycle event (e.g. `"materialized:complete"`). %%sig: (event: string, handler: function): void%% %%example: // ESM usage via slothlet API|import slothlet from "@cldmv/slothlet";|const api = await slothlet({ base: './api' });|api.slothlet.lifecycle.on('shutdown', () => {|  console.log('Slothlet is shutting down');|});%% %%example: // ESM usage via slothlet API (inside async function)|async function example() {|  const { default: slothlet } = await import("@cldmv/slothlet");|  const api = await slothlet({ base: './api' });|  api.slothlet.lifecycle.on('shutdown', () => {|    console.log('Slothlet is shutting down');|  });|}%% %%example: // CJS usage via slothlet API (top-level)|let slothlet;|(async () => {|  ({ slothlet } = await import("@cldmv/slothlet"));|  const api = await slothlet({ base: './api' });|  api.slothlet.lifecycle.on('shutdown', () => {|    console.log('Slothlet is shutting down');|  });|})();%% %%example: // CJS usage via slothlet API (inside async function)|const slothlet = require("@cldmv/slothlet");|const api = await slothlet({ base: './api' });|api.slothlet.lifecycle.on('shutdown', () => {|  console.log('Slothlet is shutting down');|});%%
diff --git a/tests/vitests/suites/events/event-delivery-strategy.test.vitest.mjs b/tests/vitests/suites/events/event-delivery-strategy.test.vitest.mjs
new file mode 100644
index 000000000..155e2807e
--- /dev/null
+++ b/tests/vitests/suites/events/event-delivery-strategy.test.vitest.mjs
@@ -0,0 +1,434 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/events/event-delivery-strategy.test.vitest.mjs
+ *	@Date: 2026-09-28T21:34:06-07:00 (1790656446)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 21:34:06 -07:00 (1790656446)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview #497 — host-controlled event delivery: `event.strategy(fn)` and `event.deliver(envelope, listenerId)`.
+ *
+ * @description
+ * A host that wraps work in a transaction needs events emitted inside it delivered only once the
+ * transaction commits, each listener as its own retried unit of work. Exercises, across the full
+ * eager/lazy × async/live matrix: unchanged behavior with no strategy; immediate delivery through
+ * `defaultDeliver`; deferred delivery through per-listener `deliver`; a discarded (rolled-back)
+ * envelope never delivering; a per-listener retry not re-running listeners that already succeeded;
+ * rules and levels enforced at delivery time; the emit-time context used at delivery; the listener
+ * identity format and its `{ key }` override; identity stability across full and scoped reload;
+ * `listener-gone` after a module is removed; a throwing listener rejecting `deliver`; host-only
+ * gating; and `emit`'s acceptance-vs-settle timing.
+ *
+ * @module tests/vitests/suites/events/event-delivery-strategy.test.vitest
+ */
+
+import { describe, it, expect, afterEach } from "vitest";
+import slothlet from "@cldmv/slothlet";
+import { getMatrixConfigs, TEST_DIRS } from "../../setup/vitest-helper.mjs";
+
+const BASE = TEST_DIRS.API_TEST_EVENTS;
+
+/**
+ * A strategy that records every envelope instead of delivering it — the "transaction" a test
+ * later commits (delivers) or rolls back (discards).
+ * @returns {{ strategy: Function, queue: Array<{ envelope: object, listeners: string[] }> }} The strategy and its queue.
+ */
+function makeQueueStrategy() {
+	const queue = [];
+	const strategy = (envelope, listeners) => {
+		queue.push({ envelope, listeners });
+	};
+	return { strategy, queue };
+}
+
+describe.each(getMatrixConfigs())("Events > delivery strategy (#497) > $name", ({ config }) => {
+	let api;
+
+	afterEach(async () => {
+		if (api) await api.shutdown();
+		api = null;
+	});
+
+	/**
+	 * Compose the events api and mount it a second time at `plug` under the explicit moduleID `plug`,
+	 * so module listener identities are deterministic (`plug:<event>:<n>`). Unless a permissions block
+	 * is supplied, `plug.**` listeners are granted `allow` (the built-in module default is `notify`).
+	 * @param {object} [permissions] - Optional permissions block.
+	 * @returns {Promise<object>} The composed api.
+	 */
+	const compose = async (permissions) => {
+		const effective = permissions ?? {
+			defaultPolicy: "allow",
+			events: { default: "notify", rules: [{ caller: "plug.**", event: "**", effect: "allow" }] }
+		};
+		const instance = await slothlet({ ...config, base: BASE, permissions: effective });
+		await instance.slothlet.api.add("plug", BASE, { moduleID: "plug" });
+		return instance;
+	};
+
+	// ── No strategy ─────────────────────────────────────────────────────────────
+	it("without a strategy, emit delivers immediately and resolves once listeners settle", async () => {
+		api = await compose();
+		const order = [];
+		api.slothlet.event.on("orders.created", async (payload) => {
+			await new Promise((r) => setTimeout(r, 20));
+			order.push(payload.id);
+		});
+		await api.slothlet.event.emit("orders.created", { id: 1 });
+		expect(order).toEqual([1]);
+	});
+
+	// ── Listener identity ───────────────────────────────────────────────────────
+	it("listener ids are <owner moduleID>:<event>:<n>, `{ key }` overrides n, and the host owner is empty", async () => {
+		api = await compose();
+		const first = await api.plug.listeners.listen("evt.a", "one");
+		const second = await api.plug.listeners.listen("evt.a", "two");
+		const other = await api.plug.listeners.listen("evt.b", "three");
+		const keyed = await api.plug.listeners.listen("evt.a", "keyed", { key: "audit" });
+		expect(first.id).toBe("plug:evt.a:0");
+		expect(second.id).toBe("plug:evt.a:1");
+		expect(other.id).toBe("plug:evt.b:0"); // n counts per event
+		expect(keyed.id).toBe("plug:evt.a:audit");
+
+		const host = api.slothlet.event.on("evt.a", () => {});
+		expect(host.id).toBe(":evt.a:0");
+		expect(api.slothlet.event.on("evt.a", () => {}, { key: "k" }).id).toBe(":evt.a:k");
+	});
+
+	it("registering a second listener with an id already in use throws INVALID_ARGUMENT", async () => {
+		api = await compose();
+		api.slothlet.event.on("evt", () => {}, { key: "same" });
+		expect(() => api.slothlet.event.on("evt", () => {}, { key: "same" })).toThrow(/INVALID_ARGUMENT/);
+		expect(() => api.slothlet.event.on("evt", () => {}, { key: "" })).toThrow(/INVALID_ARGUMENT/);
+	});
+
+	// ── Strategy: immediate ─────────────────────────────────────────────────────
+	it("a strategy that calls defaultDeliver delivers now, and emit resolves after the listeners settle", async () => {
+		api = await compose();
+		const seen = [];
+		let settled = false;
+		const { id } = api.slothlet.event.on("orders.created", async (payload, meta) => {
+			await new Promise((r) => setTimeout(r, 20));
+			settled = true;
+			seen.push({ payload, event: meta.event });
+		});
+		let captured = null;
+		api.slothlet.event.strategy((envelope, listeners, defaultDeliver) => {
+			captured = { envelope, listeners };
+			return defaultDeliver();
+		});
+		await api.slothlet.event.emit("orders.created", { id: 7 });
+		expect(settled).toBe(true);
+		expect(seen).toEqual([{ payload: { id: 7 }, event: "orders.created" }]);
+		expect(captured.listeners).toEqual([id]);
+		expect(captured.envelope.event).toBe("orders.created");
+		expect(captured.envelope.payload).toEqual({ id: 7 });
+		expect(captured.envelope.emitter).toBe(null); // host emit
+		expect(captured.envelope.levels).toEqual({ [id]: "allow" });
+	});
+
+	it("defaultDeliver called without returning its promise still makes emit wait for delivery", async () => {
+		api = await compose();
+		let settled = false;
+		api.slothlet.event.on("evt", async () => {
+			await new Promise((r) => setTimeout(r, 20));
+			settled = true;
+		});
+		api.slothlet.event.strategy((envelope, listeners, defaultDeliver) => {
+			defaultDeliver();
+		});
+		await api.slothlet.event.emit("evt");
+		expect(settled).toBe(true);
+	});
+
+	it("the envelope names the emitting module when a module emits", async () => {
+		api = await compose();
+		api.slothlet.event.on("evt", () => {});
+		let envelope = null;
+		api.slothlet.event.strategy((env, listeners, defaultDeliver) => {
+			envelope = env;
+			return defaultDeliver();
+		});
+		await api.plug.emitter.fire("evt", { n: 1 });
+		expect(envelope.emitter).toEqual({ moduleID: "plug", apiPath: "plug.emitter.fire" });
+	});
+
+	// ── Strategy: deferred ──────────────────────────────────────────────────────
+	it("a deferring strategy: emit resolves on acceptance, and deliver() later delivers per listener", async () => {
+		api = await compose();
+		const { strategy, queue } = makeQueueStrategy();
+		api.slothlet.event.strategy(strategy);
+		const a = await api.plug.listeners.listen("orders.created", "a");
+		const b = await api.plug.listeners.listen("orders.created", "b");
+
+		await api.slothlet.event.emit("orders.created", { id: 42 });
+		expect(await api.plug.listeners.drain()).toEqual([]); // accepted, nothing delivered yet
+		expect(queue).toHaveLength(1);
+		expect(queue[0].listeners).toEqual([a.id, b.id]);
+
+		const { envelope } = queue[0];
+		const r1 = await api.slothlet.event.deliver(envelope, a.id);
+		expect(r1).toEqual({ delivered: true, level: "allow" });
+		expect((await api.plug.listeners.drain()).map((d) => d.tag)).toEqual(["a"]);
+		const r2 = await api.slothlet.event.deliver(envelope, b.id);
+		expect(r2).toEqual({ delivered: true, level: "allow" });
+		const got = await api.plug.listeners.drain();
+		expect(got.map((d) => d.tag)).toEqual(["b"]);
+		expect(got[0].payload).toEqual({ id: 42 });
+	});
+
+	it("a rolled-back envelope (never delivered) reaches no listener", async () => {
+		api = await compose();
+		const { strategy, queue } = makeQueueStrategy();
+		api.slothlet.event.strategy(strategy);
+		await api.plug.listeners.listen("orders.created", "a");
+		let hostCalls = 0;
+		api.slothlet.event.on("orders.created", () => hostCalls++);
+
+		await api.slothlet.event.emit("orders.created", { id: 1 });
+		queue.length = 0; // roll back: the host discards the transaction's envelopes
+
+		await new Promise((r) => setTimeout(r, 20));
+		expect(await api.plug.listeners.drain()).toEqual([]);
+		expect(hostCalls).toBe(0);
+	});
+
+	it("a per-listener retry re-runs only the failed listener, never ones that already succeeded", async () => {
+		api = await compose();
+		const { strategy, queue } = makeQueueStrategy();
+		api.slothlet.event.strategy(strategy);
+		const ok = await api.plug.listeners.listen("evt", "ok");
+		const flaky = await api.plug.listeners.listen("evt", "flaky");
+		await api.plug.listeners.failNext("flaky", 1);
+
+		await api.slothlet.event.emit("evt", { v: 1 });
+		const { envelope, listeners } = queue[0];
+		const failed = [];
+		for (const id of listeners) {
+			try {
+				await api.slothlet.event.deliver(envelope, id);
+			} catch {
+				failed.push(id);
+			}
+		}
+		expect(failed).toEqual([flaky.id]);
+		expect((await api.plug.listeners.drain()).map((d) => d.tag)).toEqual(["ok"]);
+
+		// Retry only what failed.
+		for (const id of failed) {
+			expect(await api.slothlet.event.deliver(envelope, id)).toEqual({ delivered: true, level: "allow" });
+		}
+		expect((await api.plug.listeners.drain()).map((d) => d.tag)).toEqual(["flaky"]);
+		expect(ok.id).not.toBe(flaky.id);
+	});
+
+	it("a listener that throws makes deliver reject with the listener's own error", async () => {
+		api = await compose();
+		const { strategy, queue } = makeQueueStrategy();
+		api.slothlet.event.strategy(strategy);
+		const { id } = await api.plug.listeners.listen("evt", "boom");
+		await api.plug.listeners.failNext("boom", 1);
+		await api.slothlet.event.emit("evt");
+		await expect(api.slothlet.event.deliver(queue[0].envelope, id)).rejects.toThrow("listener boom failed");
+
+		const hostError = new RangeError("host listener failed");
+		const host = api.slothlet.event.on("evt2", () => {
+			throw hostError;
+		});
+		await api.slothlet.event.emit("evt2");
+		await expect(api.slothlet.event.deliver(queue[1].envelope, host.id)).rejects.toBe(hostError);
+	});
+
+	it("a once listener is consumed by its first delivery; a second envelope then finds it gone", async () => {
+		api = await compose();
+		const { strategy, queue } = makeQueueStrategy();
+		api.slothlet.event.strategy(strategy);
+		let calls = 0;
+		const { id } = api.slothlet.event.once("evt", () => calls++);
+		await api.slothlet.event.emit("evt");
+		await api.slothlet.event.emit("evt");
+		expect(await api.slothlet.event.deliver(queue[0].envelope, id)).toEqual({ delivered: true, level: "allow" });
+		expect(await api.slothlet.event.deliver(queue[1].envelope, id)).toEqual({ delivered: false, reason: "listener-gone" });
+		expect(calls).toBe(1);
+	});
+
+	// ── Delivery-time enforcement ───────────────────────────────────────────────
+	it("rules and levels are enforced at delivery time: a rule changed after emit applies to the delivery", async () => {
+		api = await compose({
+			defaultPolicy: "allow",
+			events: { default: "notify", rules: [{ caller: "plug.**", event: "evt.*", effect: "allow" }] }
+		});
+		const { strategy, queue } = makeQueueStrategy();
+		api.slothlet.event.strategy(strategy);
+		const first = await api.plug.listeners.listen("evt.one", "first");
+		const second = await api.plug.listeners.listen("evt.one", "second");
+		expect(first.level).toBe("allow");
+
+		await api.slothlet.event.emit("evt.one", { secret: 1 });
+		const { envelope } = queue[0];
+		expect(envelope.levels).toEqual({ [first.id]: "allow", [second.id]: "allow" }); // emit-time levels
+
+		// Downgrade after the emit: the delivery is trigger-only.
+		api.slothlet.event.rules.add({ caller: "plug.**", event: "evt.*", effect: "notify" });
+		expect(await api.slothlet.event.deliver(envelope, first.id)).toEqual({ delivered: true, level: "notify" });
+		const got = await api.plug.listeners.drain();
+		expect(got).toHaveLength(1);
+		expect(got[0].payload).toBeUndefined();
+
+		// Deny after the emit: the delivery is refused.
+		api.slothlet.event.rules.add({ caller: "plug.**", event: "evt.one", effect: "deny" });
+		expect(await api.slothlet.event.deliver(envelope, second.id)).toEqual({ delivered: false, reason: "denied" });
+		expect(await api.plug.listeners.drain()).toEqual([]);
+	});
+
+	it("delivery runs the listener and the rule condition inside the emit-time context", async () => {
+		api = await compose({
+			defaultPolicy: "allow",
+			events: {
+				default: "notify",
+				rules: [{ caller: "plug.**", event: "cond.*", effect: "allow", condition: { user: "alice" } }]
+			}
+		});
+		const { strategy, queue } = makeQueueStrategy();
+		api.slothlet.event.strategy(strategy);
+		const { id } = await api.plug.listeners.listen("cond.data", "c");
+
+		await api.slothlet.context.run({ user: "alice" }, () => api.slothlet.event.emit("cond.data", { n: 1 }));
+		await api.slothlet.context.run({ user: "bob" }, () => api.slothlet.event.emit("cond.data", { n: 2 }));
+
+		// Delivered from outside any context: alice's envelope still sees alice (and passes the condition).
+		expect(await api.slothlet.event.deliver(queue[0].envelope, id)).toEqual({ delivered: true, level: "allow" });
+		// Delivered from inside a DIFFERENT context: bob's envelope sees bob, not the deliverer's context.
+		const viaOther = await api.slothlet.context.run({ user: "alice" }, () => api.slothlet.event.deliver(queue[1].envelope, id));
+		expect(viaOther).toEqual({ delivered: true, level: "notify" });
+
+		const got = await api.plug.listeners.drain();
+		expect(got.map((d) => d.user)).toEqual(["alice", "bob"]);
+		expect(got[0].payload).toEqual({ n: 1 });
+		expect(got[1].payload).toBeUndefined();
+	});
+
+	// ── Reload / removal ────────────────────────────────────────────────────────
+	it("listener ids survive a full reload: deliver resolves them against the re-registered listeners", async () => {
+		api = await compose();
+		const { strategy, queue } = makeQueueStrategy();
+		api.slothlet.event.strategy(strategy);
+		const a = await api.plug.listeners.listen("evt", "a");
+		const b = await api.plug.listeners.listen("evt", "b", { key: "bee" });
+		await api.slothlet.event.emit("evt", { v: 1 });
+
+		await api.slothlet.reload();
+
+		// Before re-registration the listeners are gone.
+		expect(await api.slothlet.event.deliver(queue[0].envelope, a.id)).toEqual({ delivered: false, reason: "listener-gone" });
+		// Re-register in the same order: same ids.
+		const a2 = await api.plug.listeners.listen("evt", "a2");
+		const b2 = await api.plug.listeners.listen("evt", "b2", { key: "bee" });
+		expect([a2.id, b2.id]).toEqual([a.id, b.id]);
+		expect(await api.slothlet.event.deliver(queue[0].envelope, a.id)).toEqual({ delivered: true, level: "allow" });
+		expect(await api.slothlet.event.deliver(queue[0].envelope, b.id)).toEqual({ delivered: true, level: "allow" });
+		expect((await api.plug.listeners.drain()).map((d) => d.tag)).toEqual(["a2", "b2"]);
+
+		// The strategy itself survives the reload.
+		await api.slothlet.event.emit("evt", { v: 2 });
+		expect(queue).toHaveLength(2);
+		expect(await api.plug.listeners.drain()).toEqual([]);
+	});
+
+	it("listener ids survive a scoped reload: the module's old listeners are dropped and the re-registered ones receive", async () => {
+		api = await compose();
+		const { strategy, queue } = makeQueueStrategy();
+		api.slothlet.event.strategy(strategy);
+		const a = await api.plug.listeners.listen("evt", "a");
+		await api.slothlet.event.emit("evt", { v: 1 });
+
+		await api.slothlet.api.reload("plug");
+
+		expect(await api.slothlet.event.deliver(queue[0].envelope, a.id)).toEqual({ delivered: false, reason: "listener-gone" });
+		const a2 = await api.plug.listeners.listen("evt", "a2");
+		expect(a2.id).toBe(a.id);
+		expect(await api.slothlet.event.deliver(queue[0].envelope, a.id)).toEqual({ delivered: true, level: "allow" });
+		const got = await api.plug.listeners.drain();
+		expect(got.map((d) => d.tag)).toEqual(["a2"]);
+		expect(got[0].payload).toEqual({ v: 1 });
+	});
+
+	it("deliver resolves { delivered: false, reason: 'listener-gone' } once the owning module is removed", async () => {
+		api = await compose();
+		const { strategy, queue } = makeQueueStrategy();
+		api.slothlet.event.strategy(strategy);
+		const a = await api.plug.listeners.listen("evt", "a");
+		await api.slothlet.event.emit("evt", { v: 1 });
+
+		await api.slothlet.api.remove("plug");
+
+		expect(await api.slothlet.event.deliver(queue[0].envelope, a.id)).toEqual({ delivered: false, reason: "listener-gone" });
+	});
+
+	// ── Validation and gating ───────────────────────────────────────────────────
+	it("strategy(null) clears the strategy; a non-function strategy is refused", async () => {
+		api = await compose();
+		const { strategy, queue } = makeQueueStrategy();
+		let calls = 0;
+		api.slothlet.event.on("evt", () => calls++);
+		api.slothlet.event.strategy(strategy);
+		await api.slothlet.event.emit("evt");
+		expect(calls).toBe(0);
+		api.slothlet.event.strategy(null);
+		await api.slothlet.event.emit("evt");
+		expect(calls).toBe(1);
+		expect(queue).toHaveLength(1);
+		expect(() => api.slothlet.event.strategy("nope")).toThrow(/INVALID_ARGUMENT/);
+	});
+
+	it("deliver refuses an envelope this instance did not produce, or a listener id not on the envelope", async () => {
+		api = await compose();
+		const { strategy, queue } = makeQueueStrategy();
+		api.slothlet.event.strategy(strategy);
+		const { id } = api.slothlet.event.on("evt", () => {});
+		await api.slothlet.event.emit("evt");
+		await expect(api.slothlet.event.deliver({ ...queue[0].envelope }, id)).rejects.toThrow(/INVALID_ARGUMENT/);
+		await expect(api.slothlet.event.deliver(queue[0].envelope, ":evt:99")).rejects.toThrow(/INVALID_ARGUMENT/);
+	});
+
+	it("a strategy that throws rejects emit with its error", async () => {
+		api = await compose();
+		api.slothlet.event.on("evt", () => {});
+		const failure = new RangeError("transaction log unavailable");
+		api.slothlet.event.strategy(() => {
+			throw failure;
+		});
+		await expect(api.slothlet.event.emit("evt")).rejects.toBe(failure);
+	});
+
+	it("emit waits for an async strategy's acceptance, but not for a deferred delivery", async () => {
+		api = await compose();
+		let delivered = false;
+		api.slothlet.event.on("evt", () => {
+			delivered = true;
+		});
+		let accepted = false;
+		api.slothlet.event.strategy(async () => {
+			await new Promise((r) => setTimeout(r, 20));
+			accepted = true;
+		});
+		await api.slothlet.event.emit("evt");
+		expect(accepted).toBe(true);
+		expect(delivered).toBe(false);
+	});
+
+	it.each([["allow"], ["deny"]])(
+		"strategy and deliver are host-only: a module caller is refused under defaultPolicy %s",
+		async (defaultPolicy) => {
+			api = await compose({ defaultPolicy });
+			expect(await api.strategist.attemptStrategy()).toEqual({ ok: false, code: "PERMISSION_DENIED" });
+			expect(await api.strategist.attemptDeliver()).toEqual({ ok: false, code: "PERMISSION_DENIED" });
+		}
+	);
+});
diff --git a/tests/vitests/suites/events/event-strategy-unit.test.vitest.mjs b/tests/vitests/suites/events/event-strategy-unit.test.vitest.mjs
new file mode 100644
index 000000000..2e6e93175
--- /dev/null
+++ b/tests/vitests/suites/events/event-strategy-unit.test.vitest.mjs
@@ -0,0 +1,142 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/events/event-strategy-unit.test.vitest.mjs
+ *	@Date: 2026-09-28T21:34:06-07:00 (1790656446)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 21:34:06 -07:00 (1790656446)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Unit coverage for the #497 delivery-strategy edges of EventManager and the context
+ * managers' captured-flow replay that the full-instance suite does not reach: argument guards on
+ * `on({ key })` / `strategy` / `deliver`, numeric keys, a strategy seeing an event with no listeners,
+ * `defaultDeliver` idempotence, delivery without a flow-capturing context manager, a foreign
+ * instance's envelope, and replay against an instance whose context store is gone.
+ *
+ * @module tests/vitests/suites/events/event-strategy-unit.test.vitest
+ */
+
+import { describe, it, expect, afterEach } from "vitest";
+import slothlet from "@cldmv/slothlet";
+import { EventManager } from "#handlers/event-manager";
+import { SlothletError, SlothletWarning } from "@cldmv/slothlet/errors";
+import { getMatrixConfigs, TEST_DIRS } from "../../setup/vitest-helper.mjs";
+
+/**
+ * Minimal mock Slothlet instance with no permission manager and a context manager that cannot
+ * capture flows (the "no flow" delivery path).
+ * @returns {object} Mock slothlet.
+ */
+function makeSlothlet() {
+	return {
+		SlothletError,
+		SlothletWarning,
+		instanceID: "evt-strategy-unit",
+		config: { silent: true },
+		contextManager: { getCallerIdentity: () => null, tryGetContext: () => null },
+		handlers: {}
+	};
+}
+
+describe("EventManager strategy/deliver — unit edges", () => {
+	it("on() rejects a key that is empty, or neither a string nor a finite number, and accepts a numeric key", () => {
+		const em = new EventManager(makeSlothlet());
+		expect(() => em.on("evt", () => {}, { key: "" })).toThrow(/INVALID_ARGUMENT/);
+		expect(() => em.on("evt", () => {}, { key: {} })).toThrow(/INVALID_ARGUMENT/);
+		expect(() => em.on("evt", () => {}, { key: Number.NaN })).toThrow(/INVALID_ARGUMENT/);
+		expect(em.on("evt", () => {}, { key: 5 }).id).toBe(":evt:5");
+		expect(em.once("evt", () => {}).id).toBe(":evt:0");
+	});
+
+	it("strategy() rejects a non-function, non-null value", () => {
+		const em = new EventManager(makeSlothlet());
+		expect(() => em.strategy(42)).toThrow(/INVALID_ARGUMENT/);
+		expect(() => em.strategy(undefined)).toThrow(/INVALID_ARGUMENT/);
+		em.strategy(null);
+		expect(em.exportStrategy()).toBe(null);
+	});
+
+	it("a strategy is called even for an event with no listeners, with an empty recipient list", async () => {
+		const em = new EventManager(makeSlothlet());
+		const calls = [];
+		em.strategy((envelope, listeners) => calls.push({ envelope, listeners }));
+		await em.emit("nobody.listens", { x: 1 });
+		expect(calls).toHaveLength(1);
+		expect(calls[0].listeners).toEqual([]);
+		expect(calls[0].envelope.emitter).toBe(null);
+		expect(Object.isFrozen(calls[0].envelope)).toBe(true);
+	});
+
+	it("defaultDeliver is idempotent — calling it twice delivers once", async () => {
+		const em = new EventManager(makeSlothlet());
+		let count = 0;
+		em.on("evt", () => count++);
+		em.strategy((envelope, listeners, defaultDeliver) => {
+			const first = defaultDeliver();
+			expect(defaultDeliver()).toBe(first);
+			return first;
+		});
+		await em.emit("evt");
+		expect(count).toBe(1);
+	});
+
+	it("deliver works without a flow-capturing context manager, and rejects bad envelopes / ids", async () => {
+		const em = new EventManager(makeSlothlet());
+		const queue = [];
+		em.strategy((envelope) => queue.push(envelope));
+		let got = null;
+		const { id } = em.on("evt", (payload) => {
+			got = payload;
+		});
+		await em.emit("evt", { n: 3 });
+		expect(await em.deliver(queue[0], id)).toEqual({ delivered: true, level: "allow" });
+		expect(got).toEqual({ n: 3 });
+
+		await expect(em.deliver(null, id)).rejects.toThrow(/INVALID_ARGUMENT/);
+		await expect(em.deliver("envelope", id)).rejects.toThrow(/INVALID_ARGUMENT/);
+		await expect(em.deliver(queue[0], 7)).rejects.toThrow(/INVALID_ARGUMENT/);
+	});
+
+	it("an envelope produced by another instance is refused", async () => {
+		const a = new EventManager(makeSlothlet());
+		const b = new EventManager(makeSlothlet());
+		const queue = [];
+		a.strategy((envelope) => queue.push(envelope));
+		const { id } = a.on("evt", () => {});
+		await a.emit("evt");
+		await expect(b.deliver(queue[0], id)).rejects.toThrow(/INVALID_ARGUMENT/);
+	});
+
+	it("shutdown clears the strategy", async () => {
+		const em = new EventManager(makeSlothlet());
+		em.strategy(() => {});
+		em.shutdown();
+		expect(em.exportStrategy()).toBe(null);
+	});
+});
+
+describe.each(getMatrixConfigs({ mode: "eager" }))("Events > captured-flow replay after shutdown > $name", ({ config }) => {
+	let api;
+
+	afterEach(async () => {
+		if (api) await api.shutdown();
+		api = null;
+	});
+
+	it("deliver rejects with CONTEXT_NOT_FOUND once the instance's context store is gone", async () => {
+		api = await slothlet({ ...config, base: TEST_DIRS.API_TEST_EVENTS });
+		const queue = [];
+		api.slothlet.event.strategy((envelope) => queue.push(envelope));
+		const { id } = api.slothlet.event.on("evt", () => {});
+		await api.slothlet.event.emit("evt");
+		const deliver = api.slothlet.event.deliver;
+		await api.shutdown();
+		api = null;
+		await expect(deliver(queue[0], id)).rejects.toThrow(/CONTEXT_NOT_FOUND/);
+	});
+});
diff --git a/types/src/lib/builders/api_builder.d.mts.map b/types/src/lib/builders/api_builder.d.mts.map
index 474363b25..12ef43b8b 100644
--- a/types/src/lib/builders/api_builder.d.mts.map
+++ b/types/src/lib/builders/api_builder.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"api_builder.d.mts","sourceRoot":"","sources":["../../../../src/lib/builders/api_builder.mjs"],"names":[],"mappings":"AAmMA;;;;;;;;;;;;;GAaG;AACH;IACC,gCAAuC;IAEvC;;;;;;;OAOG;IACH,sBANW,MAAM,EAQhB;IAED;;;;;OAKG;IACH,8BAJW,MAAM,GACJ,OAAO,CAAC,MAAM,CAAC,CA6G3B;IAED;;;;;;;;;;;OAWG;IACH,gCAmrGC;IAED;;;;OAIG;IACH,+BA4BC;IAED;;;;OAIG;IACH,0BAgCC;IAED;;;;OAIG;IACH,4BAsTC;IAED;;;;;OAKG;IACH,8BAmEC;IAED;;;;;OAKG;IACH,uBAgCC;CACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BA7+H6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"api_builder.d.mts","sourceRoot":"","sources":["../../../../src/lib/builders/api_builder.mjs"],"names":[],"mappings":"AAoMA;;;;;;;;;;;;;GAaG;AACH;IACC,gCAAuC;IAEvC;;;;;;;OAOG;IACH,sBANW,MAAM,EAQhB;IAED;;;;;OAKG;IACH,8BAJW,MAAM,GACJ,OAAO,CAAC,MAAM,CAAC,CA6G3B;IAED;;;;;;;;;;;OAWG;IACH,gCAsrGC;IAED;;;;OAIG;IACH,+BA4BC;IAED;;;;OAIG;IACH,0BAgCC;IAED;;;;OAIG;IACH,4BAsTC;IAED;;;;;OAKG;IACH,8BAmEC;IAED;;;;;OAKG;IACH,uBAgCC;CACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAj/H6B,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/lib/handlers/api-manager.d.mts.map b/types/src/lib/handlers/api-manager.d.mts.map
index faa30e3f3..ed9ee80c5 100644
--- a/types/src/lib/handlers/api-manager.d.mts.map
+++ b/types/src/lib/handlers/api-manager.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"api-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/api-manager.mjs"],"names":[],"mappings":"AAgFA;;;;;;;;;;;;;;GAcG;AACH;IACC,gCAAuC;IAEvC;;;;;;;;;;;OAWG;IACH,sBAVW,MAAM,EAuBhB;IAXA,sIAAsI;IACtI,OADW;QAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,MAAM,GAAC,IAAI,CAAC;QAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;KAAE,CAUjI;IAGF;;;;;;;;;;;;;;;;;;OAkBG;IACH,yBA+GC;IAED;;;;;;;;;;;;;;OAcG;IACH,oBA4CC;IAED;;;;;;;;;;;;;;OAcG;IACH,0BA4BC;IAED;;;;;;;;;;;;OAYG;IACH,6BAIC;IAED;;;;;;;;;;;;OAYG;IACH,uBASC;IAED;;;;;;;;;;;;;OAaG;IACH,yBAkCC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,iCAbW,MAAM,SACN,OAAO,iBACP,MAAM,GAAC,IAAI,GACT,IAAI,CAqHhB;IAED;;;;;;;;;;;;;OAaG;IACH,uBAEC;IAED;;;;;;;;;;;;;;OAcG;IACH,oBAoVC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,8BAiCC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,sCAmBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,uBAyGC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,uBA6MC;IAED;;;;;;;;;;;;OAYG;IACH,mBAwHC;IACD;;;;;;;;;;;;OAYG;IACH,uBAsEC;IA6CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkDG;IACH,wBAhDG;QAAuB,OAAO,EAAtB,MAAM;QACmD,UAAU,EAAnE,MAAM,GAAC,MAAM,EAAE,cAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;QACf,OAAO;KAChD,GAAU,OAAO,CAAC,MAAM,GAAC,MAAM,EAAE,CAAC,CAu+BpC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,yEATG;QAAqB,QAAQ,EAArB,MAAM;QACO,aAAa,EAA1B,MAAM;QACO,cAAc,EAA3B,MAAM;KACd,GAAU,OAAO,CAAC,IAAI,CAAC,CAgDzB;IA8BD;;;;;;;;;;;OAWG;IACH,mCAeC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,mCA1BW,MAAM,YAEd;QAAyB,aAAa;QAGZ,aAAa;KACvC,GAAU,OAAO,CAAC,OAAO,CAAC,CA+nB5B;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,2BAdG;QAAwB,OAAO,EAAtB,MAAM,OAAA;QACS,QAAQ,EAAvB,MAAM,OAAA;KACf,GAAU,OAAO,CAAC,IAAI,CAAC,CAuCzB;IAED;;;;;;;;;;OAUG;IACH,0BA0EC;IAED;;;;;;;;;;;;;;OAcG;IACH,yBAsFC;IAED;;;;;;;;;;;;;OAaG;IACH,4BA0FC;IAED;;;;;;;;OAQG;IACH,iCAyDC;IAED;;;;;OAKG;IACH,iCAeC;IAED;;;;;;;;;;;;;OAaG;IACH,wBAoUC;;CACD;8BA5mI6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"api-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/api-manager.mjs"],"names":[],"mappings":"AAgFA;;;;;;;;;;;;;;GAcG;AACH;IACC,gCAAuC;IAEvC;;;;;;;;;;;OAWG;IACH,sBAVW,MAAM,EAuBhB;IAXA,sIAAsI;IACtI,OADW;QAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,MAAM,GAAC,IAAI,CAAC;QAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;KAAE,CAUjI;IAGF;;;;;;;;;;;;;;;;;;OAkBG;IACH,yBA+GC;IAED;;;;;;;;;;;;;;OAcG;IACH,oBA4CC;IAED;;;;;;;;;;;;;;OAcG;IACH,0BA4BC;IAED;;;;;;;;;;;;OAYG;IACH,6BAIC;IAED;;;;;;;;;;;;OAYG;IACH,uBASC;IAED;;;;;;;;;;;;;OAaG;IACH,yBAkCC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,iCAbW,MAAM,SACN,OAAO,iBACP,MAAM,GAAC,IAAI,GACT,IAAI,CAqHhB;IAED;;;;;;;;;;;;;OAaG;IACH,uBAEC;IAED;;;;;;;;;;;;;;OAcG;IACH,oBAoVC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,8BAiCC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,sCAmBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,uBAyGC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,uBA6MC;IAED;;;;;;;;;;;;OAYG;IACH,mBAwHC;IACD;;;;;;;;;;;;OAYG;IACH,uBAsEC;IA6CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkDG;IACH,wBAhDG;QAAuB,OAAO,EAAtB,MAAM;QACmD,UAAU,EAAnE,MAAM,GAAC,MAAM,EAAE,cAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;QACf,OAAO;KAChD,GAAU,OAAO,CAAC,MAAM,GAAC,MAAM,EAAE,CAAC,CAu+BpC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,yEATG;QAAqB,QAAQ,EAArB,MAAM;QACO,aAAa,EAA1B,MAAM;QACO,cAAc,EAA3B,MAAM;KACd,GAAU,OAAO,CAAC,IAAI,CAAC,CAgDzB;IA8BD;;;;;;;;;;;OAWG;IACH,mCAeC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,mCA1BW,MAAM,YAEd;QAAyB,aAAa;QAGZ,aAAa;KACvC,GAAU,OAAO,CAAC,OAAO,CAAC,CAmoB5B;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,2BAdG;QAAwB,OAAO,EAAtB,MAAM,OAAA;QACS,QAAQ,EAAvB,MAAM,OAAA;KACf,GAAU,OAAO,CAAC,IAAI,CAAC,CAuCzB;IAED;;;;;;;;;;OAUG;IACH,0BA+EC;IAED;;;;;;;;;;;;;;OAcG;IACH,yBAsFC;IAED;;;;;;;;;;;;;OAaG;IACH,4BA0FC;IAED;;;;;;;;OAQG;IACH,iCAyDC;IAED;;;;;OAKG;IACH,iCAeC;IAED;;;;;;;;;;;;;OAaG;IACH,wBAoUC;;CACD;8BArnI6B,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/lib/handlers/context-async.d.mts b/types/src/lib/handlers/context-async.d.mts
index b99602337..8e352e4cb 100644
--- a/types/src/lib/handlers/context-async.d.mts
+++ b/types/src/lib/handlers/context-async.d.mts
@@ -108,6 +108,32 @@ export class AsyncContextManager {
         currentWrapper: object;
         callerWrapper: object;
     } | undefined;
+    /**
+     * Capture the parts of this instance's executing flow that a later, out-of-band run must
+     * reproduce: the user context (`context.run()`'s), the caller identity, the owner-locked context
+     * keys and whether the flow is host-trusted. Used by the event system (#497) so a deferred
+     * delivery runs exactly as an immediate one would have. Holds references only — nothing is cloned
+     * or serialized.
+     *
+     * @param {string} instanceID - Instance whose flow to capture.
+     * @returns {object|null} An opaque flow snapshot for {@link runInSnapshotFlow}, or null when the
+     *   instance has no context store.
+     * @public
+     */
+    public snapshotFlow(instanceID: string): object | null;
+    /**
+     * Run `fn` inside a flow rebuilt from a {@link snapshotFlow} snapshot, on top of the instance's
+     * CURRENT base store (so a snapshot taken before a reload runs against the reloaded instance).
+     * The deliverer's own ambient context is not merged in: the snapshot's context replaces it.
+     *
+     * @param {string} instanceID - Instance to run against.
+     * @param {object} captured - Snapshot from {@link snapshotFlow}.
+     * @param {Function} fn - Function to run (may be async).
+     * @returns {Promise<*>} Resolves/rejects with `fn`'s outcome.
+     * @throws {SlothletError} CONTEXT_NOT_FOUND when the instance has no base store.
+     * @public
+     */
+    public runInSnapshotFlow(instanceID: string, captured: object, fn: Function): Promise<any>;
     /**
      * Cleanup instance context
      * @param {string} instanceID - Instance to cleanup
diff --git a/types/src/lib/handlers/context-async.d.mts.map b/types/src/lib/handlers/context-async.d.mts.map
index c28320feb..d5eb54687 100644
--- a/types/src/lib/handlers/context-async.d.mts.map
+++ b/types/src/lib/handlers/context-async.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"context-async.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/context-async.mjs"],"names":[],"mappings":"AA0BA;;;;GAIG;AACH;IAKE,SAA6D;IAC7D,yBAA0B;IAG3B;;;;OAIG;IACH,kDAKC;IAED;;;;;;OAMG;IACH,8BALW,MAAM,WACN,MAAM,GACJ,MAAM,CAkBlB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,gCAhBW,MAAM,yBAEN,GAAC,gCAED,MAAM,cACN,OAAO,WAIP,OAAO,GAIL,GAAC,CAoGb;IAqBD;;;;;;;;;OASG;IACH,sBAHa;QAAC,KAAK,EAAE,MAAM,GAAC,SAAS,CAAA;KAAC,CAKrC;IAED;;;;;;;;;OASG;IACH,uBALW;QAAC,KAAK,EAAE,MAAM,GAAC,SAAS,CAAA;KAAC,MACzB,MAAY,GAAC,GACX,GAAC,CAKb;IAED;;;;;OAKG;IACH,qBAJa,MAAM,CAUlB;IAED;;;;;;;;;;;;OAYG;IACH,kCAVW,MAAM,GAOJ,MAAM,GAAC,SAAS,CAe5B;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,sCAVW,MAAM,GAMJ;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAC,GAAC,SAAS,CAQrE;IAED;;;;OAIG;IACH,2BAHW,MAAM,QAoBhB;IAED;;;;OAIG;IACH,yBAHa,MAAM,CAclB;;CACD;AAED;;;GAGG;AACH,sDAA6D"}
\ No newline at end of file
+{"version":3,"file":"context-async.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/context-async.mjs"],"names":[],"mappings":"AA0BA;;;;GAIG;AACH;IAKE,SAA6D;IAC7D,yBAA0B;IAG3B;;;;OAIG;IACH,kDAKC;IAED;;;;;;OAMG;IACH,8BALW,MAAM,WACN,MAAM,GACJ,MAAM,CAkBlB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,gCAhBW,MAAM,yBAEN,GAAC,gCAED,MAAM,cACN,OAAO,WAIP,OAAO,GAIL,GAAC,CAoGb;IAqBD;;;;;;;;;OASG;IACH,sBAHa;QAAC,KAAK,EAAE,MAAM,GAAC,SAAS,CAAA;KAAC,CAKrC;IAED;;;;;;;;;OASG;IACH,uBALW;QAAC,KAAK,EAAE,MAAM,GAAC,SAAS,CAAA;KAAC,MACzB,MAAY,GAAC,GACX,GAAC,CAKb;IAED;;;;;OAKG;IACH,qBAJa,MAAM,CAUlB;IAED;;;;;;;;;;;;OAYG;IACH,kCAVW,MAAM,GAOJ,MAAM,GAAC,SAAS,CAe5B;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,sCAVW,MAAM,GAMJ;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAC,GAAC,SAAS,CAQrE;IAED;;;;;;;;;;;OAWG;IACH,gCALW,MAAM,GACJ,MAAM,GAAC,IAAI,CAevB;IAED;;;;;;;;;;;OAWG;IACH,qCAPW,MAAM,YACN,MAAM,iBAEJ,OAAO,CAAC,GAAC,CAAC,CAYtB;IAED;;;;OAIG;IACH,2BAHW,MAAM,QAoBhB;IAED;;;;OAIG;IACH,yBAHa,MAAM,CAclB;;CACD;AAED;;;GAGG;AACH,sDAA6D"}
\ No newline at end of file
diff --git a/types/src/lib/handlers/context-live.d.mts b/types/src/lib/handlers/context-live.d.mts
index bba2e48df..25216bfed 100644
--- a/types/src/lib/handlers/context-live.d.mts
+++ b/types/src/lib/handlers/context-live.d.mts
@@ -189,6 +189,34 @@ export class LiveContextManager {
      * @public
      */
     public tryGetContext(instanceID?: string): Object | undefined;
+    /**
+     * Capture the parts of this instance's executing flow that a later, out-of-band run must
+     * reproduce: the user context (`context.run()`'s), the caller identity, the owner-locked context
+     * keys and whether the flow is host-trusted. Used by the event system (#497) so a deferred
+     * delivery runs exactly as an immediate one would have. Holds references only — nothing is cloned
+     * or serialized.
+     *
+     * @param {string} instanceID - Instance whose flow to capture.
+     * @returns {object|null} An opaque flow snapshot for {@link runInSnapshotFlow}, or null when the
+     *   instance has no context store.
+     * @public
+     */
+    public snapshotFlow(instanceID: string): object | null;
+    /**
+     * Run `fn` inside a flow rebuilt from a {@link snapshotFlow} snapshot, on top of the instance's
+     * CURRENT base store (so a snapshot taken before a reload runs against the reloaded instance).
+     * The replayed store is made the active instance for the duration of `fn` — including its async
+     * tail — exactly as `run()`/`scope()` do in the live runtime. The deliverer's own ambient context
+     * is not merged in: the snapshot's context replaces it.
+     *
+     * @param {string} instanceID - Instance to run against.
+     * @param {object} captured - Snapshot from {@link snapshotFlow}.
+     * @param {Function} fn - Function to run (may be async).
+     * @returns {Promise<*>} Resolves/rejects with `fn`'s outcome.
+     * @throws {SlothletError} CONTEXT_NOT_FOUND when the instance has no base store.
+     * @public
+     */
+    public runInSnapshotFlow(instanceID: string, captured: object, fn: Function): Promise<any>;
     /**
      * Cleanup instance context
      * @param {string} instanceID - Instance to cleanup
diff --git a/types/src/lib/handlers/context-live.d.mts.map b/types/src/lib/handlers/context-live.d.mts.map
index 9c3bb5148..606b2db51 100644
--- a/types/src/lib/handlers/context-live.d.mts.map
+++ b/types/src/lib/handlers/context-live.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"context-live.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/context-live.mjs"],"names":[],"mappings":"AAiEA;;;;;;;;;;;;;GAaG;AACH;IAEE,yBAA0B;IAC1B,uBAA6B;IA2B9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,sCAZW,MAAM,GAQJ;QAAC,cAAc,EAAE,MAAM,GAAC,IAAI,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAC,GAAC,SAAS,CAkDhG;IAqGD;;;;OAIG;IACH,kDAgCC;IAED;;;;;;OAMG;IACH,8BALW,MAAM,WACN,MAAM,GACJ,MAAM,CAwBlB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,gCAhBW,MAAM,yBAEN,GAAC,gCAED,MAAM,cACN,OAAO,WAIP,OAAO,GAIL,GAAC,CA0Hb;IAED;;;;;;;;;;;OAWG;IACH,+BALW,MAAM,GACJ;QAAC,UAAU,EAAE,MAAM,GAAC,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,GAAC,SAAS,CAAC;QAAC,aAAa,EAAE,MAAM,GAAC,SAAS,CAAA;KAAC,GAAC,IAAI,CAS5H;IAED;;;;;;;;;OASG;IACH,uBALW;QAAC,UAAU,EAAE,MAAM,GAAC,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,GAAC,SAAS,CAAC;QAAC,aAAa,EAAE,MAAM,GAAC,SAAS,CAAA;KAAC,MAC3G,MAAY,GAAC,GACX,GAAC,CAkBb;IAED;;;;;OAKG;IACH,qBAJa,MAAM,CAuBlB;IAED;;;;;;;;;;;OAWG;IACH,kCATW,MAAM,GAMJ,MAAM,GAAC,SAAS,CAc5B;IAED;;;;OAIG;IACH,2BAHW,MAAM,QAyBhB;IAED;;;;OAIG;IACH,yBAHa,MAAM,CAclB;;CACD;AAED;;;GAGG;AACH,oDAA2D"}
\ No newline at end of file
+{"version":3,"file":"context-live.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/context-live.mjs"],"names":[],"mappings":"AA0EA;;;;;;;;;;;;;;;;;GAiBG;AACH,wCARW,MAAM,GACJ,MAAM,CAyBlB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,sCATW,MAAM,GACJ;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAC,IAAI,CAuC7C;AAaD;;;;;;;;;;;;;GAaG;AACH;IAEE,yBAA0B;IAC1B,uBAA6B;IAgE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,sCAZW,MAAM,GAQJ;QAAC,cAAc,EAAE,MAAM,GAAC,IAAI,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAC,GAAC,SAAS,CA+ChG;IAgJD;;;;OAIG;IACH,kDAgCC;IAED;;;;;;OAMG;IACH,8BALW,MAAM,WACN,MAAM,GACJ,MAAM,CAwBlB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,gCAhBW,MAAM,yBAEN,GAAC,gCAED,MAAM,cACN,OAAO,WAIP,OAAO,GAIL,GAAC,CA+Ib;IAED;;;;;;;;;;;OAWG;IACH,+BALW,MAAM,GACJ;QAAC,UAAU,EAAE,MAAM,GAAC,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,GAAC,SAAS,CAAC;QAAC,aAAa,EAAE,MAAM,GAAC,SAAS,CAAA;KAAC,GAAC,IAAI,CAS5H;IAED;;;;;;;;;OASG;IACH,uBALW;QAAC,UAAU,EAAE,MAAM,GAAC,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,GAAC,SAAS,CAAC;QAAC,aAAa,EAAE,MAAM,GAAC,SAAS,CAAA;KAAC,MAC3G,MAAY,GAAC,GACX,GAAC,CAkBb;IAED;;;;;OAKG;IACH,qBAJa,MAAM,CAuBlB;IAED;;;;;;;;;;;OAWG;IACH,kCATW,MAAM,GAMJ,MAAM,GAAC,SAAS,CAc5B;IAED;;;;;;;;;;;OAWG;IACH,gCALW,MAAM,GACJ,MAAM,GAAC,IAAI,CAevB;IAED;;;;;;;;;;;;;OAaG;IACH,qCAPW,MAAM,YACN,MAAM,iBAEJ,OAAO,CAAC,GAAC,CAAC,CAetB;IAED;;;;OAIG;IACH,2BAHW,MAAM,QAyBhB;IAED;;;;OAIG;IACH,yBAHa,MAAM,CAclB;;CACD;AAED;;;GAGG;AACH,oDAA2D"}
\ No newline at end of file
diff --git a/types/src/lib/handlers/event-manager.d.mts b/types/src/lib/handlers/event-manager.d.mts
index 0100bf95a..1bf90dd11 100644
--- a/types/src/lib/handlers/event-manager.d.mts
+++ b/types/src/lib/handlers/event-manager.d.mts
@@ -1,3 +1,13 @@
+/**
+ * Machine-readable `reason` codes of an undelivered `deliver()` result (#497). Stable tokens a host
+ * branches on — not display text, so not translated.
+ * @type {Readonly<{ LISTENER_GONE: "listener-gone", DENIED: "denied" }>}
+ * @internal
+ */
+export const DELIVERY_REASONS: Readonly<{
+    LISTENER_GONE: "listener-gone";
+    DENIED: "denied";
+}>;
 /**
  * Instance-wide event manager (#407).
  * @extends ComponentBase
@@ -23,28 +33,35 @@ export class EventManager extends ComponentBase {
      *   is `undefined`; `meta` is `{ event, at, instanceID }`.
      * @param {object} [options={}] - Options.
      * @param {boolean} [options.once=false] - Remove the subscription after its first delivery.
-     * @returns {{ level: "deny"|"notify"|"allow", off: Function }} The granted level and an unsubscribe
-     *   function. At `deny` the listener is not registered and `off` is a no-op.
-     * @throws {SlothletError} INVALID_ARGUMENT for a non-string event or non-function listener.
+     * @param {string|number} [options.key] - Replaces the ordinal `<n>` in the listener id, for a listener
+     *   that is registered conditionally (so its position among its module's listeners is not stable).
+     * @returns {{ level: "deny"|"notify"|"allow", off: Function, id: string }} The granted level, an
+     *   unsubscribe function, and the listener id (`<owner moduleID>:<event>:<n or key>`, owner `""` for
+     *   the host). At `deny` the listener is not registered and `off` is a no-op.
+     * @throws {SlothletError} INVALID_ARGUMENT for a non-string event, a non-function listener, an empty
+     *   or non-string/number `key`, or an id already held by another registered listener.
      * @public
      */
     public on(event: string, listener: Function, options?: {
         once?: boolean | undefined;
+        key?: string | number | undefined;
     }): {
         level: "deny" | "notify" | "allow";
         off: Function;
+        id: string;
     };
     /**
      * Subscribe for a single delivery, then auto-unsubscribe. Shorthand for `on(event, listener, { once: true })`.
      * @param {string} event - Event name.
      * @param {Function} listener - Listener.
      * @param {object} [options={}] - Options (merged with `once: true`).
-     * @returns {{ level: "deny"|"notify"|"allow", off: Function }} The granted level and unsubscribe.
+     * @returns {{ level: "deny"|"notify"|"allow", off: Function, id: string }} The granted level, unsubscribe, and listener id.
      * @public
      */
     public once(event: string, listener: Function, options?: object): {
         level: "deny" | "notify" | "allow";
         off: Function;
+        id: string;
     };
     /**
      * Remove a specific listener from an event.
@@ -59,13 +76,95 @@ export class EventManager extends ComponentBase {
      * enforced per subscriber at delivery. Async, fire-and-forget, per-listener error isolation:
      * a throwing listener surfaces a `SlothletWarning` and never affects the others or the emitter.
      *
+     * With a host {@link strategy} installed, the event is handed to it instead of being delivered:
+     * `emit` resolves once the strategy has ACCEPTED it (its return value has settled), plus — when the
+     * strategy called `defaultDeliver` by then — once that delivery has settled too. A strategy that
+     * returns without calling `defaultDeliver` has deferred the event; a strategy that throws or rejects
+     * rejects `emit` with that error.
+     *
      * @param {string} event - Event name.
      * @param {*} [payload] - Domain payload, delivered only to `allow`-level subscribers.
-     * @returns {Promise<void>} Resolves once all listeners (including async) have settled.
+     * @returns {Promise<void>} Resolves once all listeners (including async) have settled, or — under a
+     *   deferring strategy — once the strategy has accepted the event.
      * @throws {SlothletError} INVALID_ARGUMENT for a non-string event.
      * @public
      */
     public emit(event: string, payload?: any): Promise<void>;
+    /**
+     * Install (or clear) the host's delivery strategy (#497). Host-only — gated like `rules.*` by the
+     * built-in `slothlet.event.**` deny. The strategy is called per emit as
+     * `strategy(envelope, listeners, defaultDeliver)`:
+     *
+     * - `envelope` — frozen `{ event, payload, at, instanceID, emitter, levels, listeners }`: `emitter` is
+     *   `{ moduleID, apiPath }` of the emitting module (null for the host); `levels` maps each recipient's
+     *   listener id to its level resolved at emit time (informational — levels are enforced at delivery).
+     * - `listeners` — the recipients' listener ids (the same array as `envelope.listeners`).
+     * - `defaultDeliver()` — delivers now, exactly as without a strategy; returns a promise that settles
+     *   when the listeners have. Idempotent.
+     *
+     * Returning without calling `defaultDeliver` defers the event: `emit` resolves once the strategy's
+     * return value settles, and the host delivers later with {@link deliver}. The strategy survives a
+     * reload.
+     *
+     * @param {Function|null} fn - The strategy, or null to restore immediate delivery.
+     * @returns {void}
+     * @throws {SlothletError} INVALID_ARGUMENT when `fn` is neither a function nor null.
+     * @public
+     */
+    public strategy(fn: Function | null): void;
+    /**
+     * The installed strategy, so a full reload can carry it into the rebuilt EventManager.
+     * @returns {Function|null} The strategy, or null.
+     * @internal
+     */
+    exportStrategy(): Function | null;
+    /**
+     * Deliver a strategy-held envelope to ONE listener (#497), so a per-listener retry never re-runs
+     * listeners that already succeeded. Host-only — gated like `rules.*` by the built-in
+     * `slothlet.event.**` deny.
+     *
+     * The listener id is resolved against the CURRENT registrations, so after a full or scoped reload
+     * it reaches the re-registered listener with that id. The delivery runs inside the flow captured at
+     * `emit()` — the emitter's user context and caller identity — and the listener's level is resolved
+     * now, against the current rules, in that flow; a listener runs pinned to its module, as on the
+     * immediate path. A `once` listener is consumed by its first delivery.
+     *
+     * @param {object} envelope - An envelope this instance passed to its strategy.
+     * @param {string} listenerId - One of `envelope.listeners`.
+     * @returns {Promise<{ delivered: true, level: "notify"|"allow" }|{ delivered: false, reason: "listener-gone"|"denied" }>}
+     *   `delivered: true` with the level it was delivered at; `listener-gone` when no listener holds that
+     *   id any more (its module was removed, or a reload dropped it and it has not re-registered);
+     *   `denied` when the current rules deny that listener the event (the subscription is dropped, as on
+     *   the immediate path). The listener's return value is discarded, as on the immediate path.
+     * @throws {SlothletError} INVALID_ARGUMENT (as a rejection) for an envelope this instance did not
+     *   produce or a listener id not on it. A listener that throws or rejects rejects with its own error.
+     * @public
+     */
+    public deliver(envelope: object, listenerId: string): Promise<{
+        delivered: true;
+        level: "notify" | "allow";
+    } | {
+        delivered: false;
+        reason: "listener-gone" | "denied";
+    }>;
+    /**
+     * Drop every subscription a module registered and reset its listener ordinals. Called when the
+     * module is removed: its listeners are closures over code that is gone.
+     * @param {string} moduleID - The removed module's id.
+     * @returns {void}
+     * @internal
+     */
+    onModuleRemoved(moduleID: string): void;
+    /**
+     * Drop every subscription a module registered and reset its listener ordinals, BEFORE the module is
+     * rebuilt by a scoped reload. The old listeners are closures over the pre-reload module; the
+     * reloaded module registers its listeners again and, in the same order, gets the same ids — which
+     * is what lets a strategy-held envelope reach them.
+     * @param {string} moduleID - The reloaded module's id.
+     * @returns {void}
+     * @internal
+     */
+    onModuleReloaded(moduleID: string): void;
     /**
      * Resolve the delivery level a given subscriber identity WOULD be granted for an event, WITHOUT
      * subscribing. Host-only (gated like `rules.*` by the built-in `slothlet.event.**` deny), because
diff --git a/types/src/lib/handlers/event-manager.d.mts.map b/types/src/lib/handlers/event-manager.d.mts.map
index a2216445a..cdd176a94 100644
--- a/types/src/lib/handlers/event-manager.d.mts.map
+++ b/types/src/lib/handlers/event-manager.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"event-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/event-manager.mjs"],"names":[],"mappings":"AA0CA;;;;GAIG;AACH;IACC;;;OAGG;IACH,yBAFU,MAAM,CAEyB;IAUzC;;OAEG;IACH,sBAFW,MAAM,EAKhB;IAWD;;;;;;;;;;;;;;OAcG;IACH,iBAVW,MAAM,gCAId;QAA0B,IAAI;KAC9B,GAAU;QAAE,KAAK,EAAE,MAAM,GAAC,QAAQ,GAAC,OAAO,CAAC;QAAC,GAAG,WAAU;KAAE,CA4C7D;IAED;;;;;;;OAOG;IACH,mBANW,MAAM,gCAEN,MAAM,GACJ;QAAE,KAAK,EAAE,MAAM,GAAC,QAAQ,GAAC,OAAO,CAAC;QAAC,GAAG,WAAU;KAAE,CAK7D;IAED;;;;;;OAMG;IACH,kBALW,MAAM,uBAEJ,OAAO,CAanB;IAED;;;;;;;;;;OAUG;IACH,mBANW,MAAM,YACN,GAAC,GACC,OAAO,CAAC,IAAI,CAAC,CA0CzB;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,oCATW,MAAM,GAAC,IAAI,SAEX,MAAM,GACJ,MAAM,GAAC,QAAQ,GAAC,OAAO,CAsBnC;IAyDD;;;;OAIG;IACH,mBAHa,IAAI,CAKhB;;CACD;8BA3R6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"event-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/event-manager.mjs"],"names":[],"mappings":"AA6DA;;;;;GAKG;AACH,+BAHU,QAAQ,CAAC;IAAE,aAAa,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAA;CAAE,CAAC,CAG4B;AAepG;;;;GAIG;AACH;IACC;;;OAGG;IACH,yBAFU,MAAM,CAEyB;IA0BzC;;OAEG;IACH,sBAFW,MAAM,EAOhB;IAWD;;;;;;;;;;;;;;;;;;OAkBG;IACH,iBAdW,MAAM,gCAId;QAA0B,IAAI;QACE,GAAG;KAEnC,GAAU;QAAE,KAAK,EAAE,MAAM,GAAC,QAAQ,GAAC,OAAO,CAAC;QAAC,GAAG,WAAW;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAoEzE;IAoBD;;;;;;;OAOG;IACH,mBANW,MAAM,gCAEN,MAAM,GACJ;QAAE,KAAK,EAAE,MAAM,GAAC,QAAQ,GAAC,OAAO,CAAC;QAAC,GAAG,WAAW;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAKzE;IAED;;;;;;OAMG;IACH,kBALW,MAAM,uBAEJ,OAAO,CAanB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,mBAPW,MAAM,YACN,GAAC,GACC,OAAO,CAAC,IAAI,CAAC,CAoBzB;IA8GD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,oBALW,WAAS,IAAI,GACX,IAAI,CAShB;IAED;;;;OAIG;IACH,kBAHa,WAAS,IAAI,CAKzB;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,yBAXW,MAAM,cACN,MAAM,GACJ,OAAO,CAAC;QAAE,SAAS,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,QAAQ,GAAC,OAAO,CAAA;KAAE,GAAC;QAAE,SAAS,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,eAAe,GAAC,QAAQ,CAAA;KAAE,CAAC,CA4BxH;IAkCD;;;;;;OAMG;IACH,0BAJW,MAAM,GACJ,IAAI,CAKhB;IAED;;;;;;;;OAQG;IACH,2BAJW,MAAM,GACJ,IAAI,CAKhB;IAkBD;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,oCATW,MAAM,GAAC,IAAI,SAEX,MAAM,GACJ,MAAM,GAAC,QAAQ,GAAC,OAAO,CAwBnC;IA0DD;;;;OAIG;IACH,mBAHa,IAAI,CAOhB;;CACD;8BAlnB6B,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/lib/handlers/permission-manager.d.mts.map b/types/src/lib/handlers/permission-manager.d.mts.map
index bac655d28..d6d192b90 100644
--- a/types/src/lib/handlers/permission-manager.d.mts.map
+++ b/types/src/lib/handlers/permission-manager.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"permission-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/permission-manager.mjs"],"names":[],"mappings":"AAgMA;;;;;;;GAOG;AACH;IACC;;;;OAIG;IACH,yBAHU,MAAM,CAG8B;IAmJ9C;;;;;;OAMG;IACH,sBAJW,MAAM,EAyGhB;IAED;;;;;;;;;;;;;OAaG;IACH,cAVG;QAAqB,MAAM,EAAnB,MAAM;QACO,MAAM,EAAnB,MAAM;QACO,MAAM,EAAnB,MAAM;KACd,kBAAQ,MAAM,GAAC,IAAI,WACX,MAAM,GAAC,IAAI,iBACT,MAAM,CAiDlB;IAED;;;;;;;;;;OAUG;IACH,mBAPW,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,OAAO,CAmCnB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,mBAZG;QAAqB,MAAM,EAAnB,MAAM;QACO,KAAK,EAAlB,MAAM;QACwB,MAAM,EAApC,MAAM,GAAC,QAAQ,GAAC,OAAO;QACuB,SAAS;KAC/D,kBAAQ,MAAM,GAAC,IAAI,WACX,MAAM,GAAC,IAAI,UACX,MAAM,GAAC,IAAI,GACT,MAAM,CAqClB;IAED;;;;;;;;OAQG;IACH,wBALW,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,OAAO,CAiBnB;IAED;;;;;;;;;;OAUG;IACH,kCALW,MAAM,GAAC,IAAI,aACX,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,MAAM,GAAC,QAAQ,GAAC,OAAO,CA0BnC;IAED;;;;OAIG;IACH,uBAFa,MAAM,CAIlB;IAED;;;;;OAKG;IACH,gCAFa,OAAO,CAOnB;IAuCD;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,wBAlBW,MAAM,cAEd;QAAwC,GAAG,EAAnC,CAAS,IAAM,EAAN,MAAM,KAAG,GAAC;QAGQ,OAAO,EAAlC,CAAS,IAAC,EAAD,GAAC,KAAG,GAAC;QACM,MAAM;KAClC,kBAAQ,MAAM,GAAC,IAAI,WACX,CAAS,IAAQ,YAAE,IAAQ,EAAR,KAAK,CAAC,GAAC,CAAC,KAAG,GAAC,GAG7B,IAAI,CA0ChB;IAED;;;;;;;;;;;OAWG;IACH,0BARW,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,OAAO,CAanB;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,0BARW,MAAM,gBACN,GAAC,mBACD,MAAM,GAAC,IAAI,GACT,OAAO,CAiBnB;IAED;;;;;;;OAOG;IACH,mBALW,MAAM,GACJ,OAAO,CAMnB;IAED;;;;;;;;OAQG;IACH,0BALW,MAAM,GACJ,IAAI,CAUhB;IAED;;;;;;;;;;;OAWG;IACH,2BALW,MAAM,GACJ,IAAI,CAUhB;IAED;;;;;;;;;;;OAWG;IACH,uBANW,MAAM,iBACN,MAAM,GACJ,IAAI,CAShB;IAED;;;;;;;;;;;;;;;OAeG;IACH,4BATW,MAAM,cACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,GACT,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,GAAC,CAAA;KAAE,CAAC,CAkCnD;IAED;;;;;;;;;OASG;IACH,yBALW,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,GAAC,CAAA;KAAE,CAAC,GACrC,OAAO,CAAC,IAAI,CAAC,CAMzB;IA4SD;;;;;;;;;;;;;;;OAeG;IACH,wBAXW,MAAM,cACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,YACX;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAC,IAAI,GAEzB,OAAO,CA2BnB;IAED;;;;;;;;;OASG;IACH,4BANW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,cAAU,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,WAAS,CAAC,GAAC,IAAI,GAAC,SAAS,mBACvF,MAAM,GAAC,IAAI,GACT,OAAO,CASnB;IAyBD;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,0BAtBW,MAAM,cACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,aACX,kBAAkB,GAAC,IAAI,YAGvB;QAAE,cAAc,CAAC,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GAAC,IAAI,GAQrE,OAAO,CA0CnB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,sBAXW,MAAM,cACN,MAAM,SACN,KAAK,CAAC,GAAC,CAAC,mBACR,MAAM,GAAC,IAAI,GACT,OAAO,GAAC,OAAO,CAAC,OAAO,CAAC,CA8CpC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,8BAbW,MAAM,GAAC,IAAI,YAEX,MAAM,YACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,GACT,OAAO,CAenB;IAED;;;;;;;;;;;;;;;OAeG;IACH,4BAZW,MAAM,GAAC,IAAI,YACX,MAAM,YACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBAGX,MAAM,GAAC,IAAI,GACT,OAAO,CAMnB;IAED;;;;;;;OAOG;IACH,4BALW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAazB;IAED;;;;;;;OAOG;IACH,2BALW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAYzB;IAED;;;;;;;;OAQG;IACH,8BALW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAazB;IAED;;;;;;OAMG;IACH,UAJa,IAAI,CAQhB;IAcD;;;;;;;;OAQG;IACH,QAJa,IAAI,CAMhB;IAED;;;;;OAKG;IACH,YAJa,OAAO,CAMnB;IAED;;;;;;OAMG;IACH,WAJa,IAAI,CAQhB;IAED;;;;;;OAMG;IACH,aAJa,OAAO,CAMnB;IAED;;;;;;;;OAQG;IACH,uBAJa,OAAO,CAMnB;IAED;;;;;;;;;OASG;IACH,oBAJa,OAAO,CAMnB;IAED;;;;;;;;;;;;OAYG;IACH,mCAVW,MAAM,GAAC,IAAI,GAAC,SAAS,GACnB,OAAO,CAWnB;IAED;;;;;;;;;;;OAWG;IACH,qBANW,OAAO,GACL,IAAI,CAgBhB;IAED;;;;;;OAMG;IAIH,eAPa,KAAK,CAAC,MAAM,CAAC,CAgBzB;IAED;;;;;;;;OAQG;IACH,2BALW,KAAK,CAAC,MAAM,CAAC,GACX,IAAI,CAShB;IAGD;;;;;;;OAOG;IACH,YAJa,OAAO,CAAC,IAAI,CAAC,CAezB;IA4nBD;;;;;;;OAOG;IACH,cAEC;;CACD;;;;;;;;;;;;;;;;UAtvEa,KAAK,CAAC,GAAC,CAAC,GAAC,IAAI;;;;YACb,MAAM,GAAC,IAAI;;8BAxIK,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"permission-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/permission-manager.mjs"],"names":[],"mappings":"AAgMA;;;;;;;GAOG;AACH;IACC;;;;OAIG;IACH,yBAHU,MAAM,CAG8B;IAmJ9C;;;;;;OAMG;IACH,sBAJW,MAAM,EA0GhB;IAED;;;;;;;;;;;;;OAaG;IACH,cAVG;QAAqB,MAAM,EAAnB,MAAM;QACO,MAAM,EAAnB,MAAM;QACO,MAAM,EAAnB,MAAM;KACd,kBAAQ,MAAM,GAAC,IAAI,WACX,MAAM,GAAC,IAAI,iBACT,MAAM,CAiDlB;IAED;;;;;;;;;;OAUG;IACH,mBAPW,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,OAAO,CAmCnB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,mBAZG;QAAqB,MAAM,EAAnB,MAAM;QACO,KAAK,EAAlB,MAAM;QACwB,MAAM,EAApC,MAAM,GAAC,QAAQ,GAAC,OAAO;QACuB,SAAS;KAC/D,kBAAQ,MAAM,GAAC,IAAI,WACX,MAAM,GAAC,IAAI,UACX,MAAM,GAAC,IAAI,GACT,MAAM,CAqClB;IAED;;;;;;;;OAQG;IACH,wBALW,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,OAAO,CAiBnB;IAED;;;;;;;;;;OAUG;IACH,kCALW,MAAM,GAAC,IAAI,aACX,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,MAAM,GAAC,QAAQ,GAAC,OAAO,CA0BnC;IAED;;;;OAIG;IACH,uBAFa,MAAM,CAIlB;IAED;;;;;OAKG;IACH,gCAFa,OAAO,CAOnB;IAuCD;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,wBAlBW,MAAM,cAEd;QAAwC,GAAG,EAAnC,CAAS,IAAM,EAAN,MAAM,KAAG,GAAC;QAGQ,OAAO,EAAlC,CAAS,IAAC,EAAD,GAAC,KAAG,GAAC;QACM,MAAM;KAClC,kBAAQ,MAAM,GAAC,IAAI,WACX,CAAS,IAAQ,YAAE,IAAQ,EAAR,KAAK,CAAC,GAAC,CAAC,KAAG,GAAC,GAG7B,IAAI,CA0ChB;IAED;;;;;;;;;;;OAWG;IACH,0BARW,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,OAAO,CAanB;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,0BARW,MAAM,gBACN,GAAC,mBACD,MAAM,GAAC,IAAI,GACT,OAAO,CAiBnB;IAED;;;;;;;OAOG;IACH,mBALW,MAAM,GACJ,OAAO,CAMnB;IAED;;;;;;;;OAQG;IACH,0BALW,MAAM,GACJ,IAAI,CAUhB;IAED;;;;;;;;;;;OAWG;IACH,2BALW,MAAM,GACJ,IAAI,CAUhB;IAED;;;;;;;;;;;OAWG;IACH,uBANW,MAAM,iBACN,MAAM,GACJ,IAAI,CAShB;IAED;;;;;;;;;;;;;;;OAeG;IACH,4BATW,MAAM,cACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,GACT,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,GAAC,CAAA;KAAE,CAAC,CAkCnD;IAED;;;;;;;;;OASG;IACH,yBALW,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,GAAC,CAAA;KAAE,CAAC,GACrC,OAAO,CAAC,IAAI,CAAC,CAMzB;IA4SD;;;;;;;;;;;;;;;OAeG;IACH,wBAXW,MAAM,cACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,YACX;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAC,IAAI,GAEzB,OAAO,CA2BnB;IAED;;;;;;;;;OASG;IACH,4BANW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,cAAU,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,WAAS,CAAC,GAAC,IAAI,GAAC,SAAS,mBACvF,MAAM,GAAC,IAAI,GACT,OAAO,CASnB;IAyBD;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,0BAtBW,MAAM,cACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,aACX,kBAAkB,GAAC,IAAI,YAGvB;QAAE,cAAc,CAAC,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GAAC,IAAI,GAQrE,OAAO,CA0CnB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,sBAXW,MAAM,cACN,MAAM,SACN,KAAK,CAAC,GAAC,CAAC,mBACR,MAAM,GAAC,IAAI,GACT,OAAO,GAAC,OAAO,CAAC,OAAO,CAAC,CA8CpC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,8BAbW,MAAM,GAAC,IAAI,YAEX,MAAM,YACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,GACT,OAAO,CAenB;IAED;;;;;;;;;;;;;;;OAeG;IACH,4BAZW,MAAM,GAAC,IAAI,YACX,MAAM,YACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBAGX,MAAM,GAAC,IAAI,GACT,OAAO,CAMnB;IAED;;;;;;;OAOG;IACH,4BALW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAazB;IAED;;;;;;;OAOG;IACH,2BALW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAYzB;IAED;;;;;;;;OAQG;IACH,8BALW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAazB;IAED;;;;;;OAMG;IACH,UAJa,IAAI,CAQhB;IAcD;;;;;;;;OAQG;IACH,QAJa,IAAI,CAMhB;IAED;;;;;OAKG;IACH,YAJa,OAAO,CAMnB;IAED;;;;;;OAMG;IACH,WAJa,IAAI,CAQhB;IAED;;;;;;OAMG;IACH,aAJa,OAAO,CAMnB;IAED;;;;;;;;OAQG;IACH,uBAJa,OAAO,CAMnB;IAED;;;;;;;;;OASG;IACH,oBAJa,OAAO,CAMnB;IAED;;;;;;;;;;;;OAYG;IACH,mCAVW,MAAM,GAAC,IAAI,GAAC,SAAS,GACnB,OAAO,CAWnB;IAED;;;;;;;;;;;OAWG;IACH,qBANW,OAAO,GACL,IAAI,CAgBhB;IAED;;;;;;OAMG;IAIH,eAPa,KAAK,CAAC,MAAM,CAAC,CAgBzB;IAED;;;;;;;;OAQG;IACH,2BALW,KAAK,CAAC,MAAM,CAAC,GACX,IAAI,CAShB;IAGD;;;;;;;OAOG;IACH,YAJa,OAAO,CAAC,IAAI,CAAC,CAezB;IA4nBD;;;;;;;OAOG;IACH,cAEC;;CACD;;;;;;;;;;;;;;;;UAvvEa,KAAK,CAAC,GAAC,CAAC,GAAC,IAAI;;;;YACb,MAAM,GAAC,IAAI;;8BAxIK,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/lib/handlers/trusted-root.d.mts b/types/src/lib/handlers/trusted-root.d.mts
index 52d1aa4d7..087a6ead5 100644
--- a/types/src/lib/handlers/trusted-root.d.mts
+++ b/types/src/lib/handlers/trusted-root.d.mts
@@ -25,6 +25,22 @@ export function enforceContextKeyWrite(ctx: object, prop: string | symbol): void
  * @internal
  */
 export function readProtectedContextValue(ctx: object, prop: string | symbol, getContext: () => object | null): any;
+/**
+ * Build the context store a {@link snapshotFlow}-snapshotted flow is replayed in (#497), shared by the
+ * async and live context managers. The store is a `run()`/`scope()`-style child of the instance's
+ * CURRENT base store — fresh `self` / `config` / `slothlet` references, so a snapshot taken before a
+ * reload runs against the reloaded instance — carrying the snapshot's user context, caller identity,
+ * owner-locked keys and host trust. The deliverer's own ambient context is deliberately not merged
+ * in: the flow is the emitter's, not whoever replays it.
+ *
+ * @param {Map<string, object>} instances - The context manager's instance-store registry.
+ * @param {string} instanceID - The instance to replay against.
+ * @param {object} captured - The snapshot (`{ context, currentWrapper, callerWrapper, contextOwners, trusted }`).
+ * @returns {object} The child store (not yet registered).
+ * @throws {SlothletError} CONTEXT_NOT_FOUND when the instance has no base store.
+ * @internal
+ */
+export function buildCapturedFlowStore(instances: Map<string, object>, instanceID: string, captured: object): object;
 /**
  * Marker set on a slothlet instance's base context store to identify host-initiated calls.
  * @type {symbol}
diff --git a/types/src/lib/handlers/trusted-root.d.mts.map b/types/src/lib/handlers/trusted-root.d.mts.map
index 28c2a93a1..4b10a6a64 100644
--- a/types/src/lib/handlers/trusted-root.d.mts.map
+++ b/types/src/lib/handlers/trusted-root.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"trusted-root.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/trusted-root.mjs"],"names":[],"mappings":"AA4DA;;;;;;;;;;;GAWG;AACH,4CANW,MAAM,QACN,MAAM,GAAC,MAAM,GACX,IAAI,CAOhB;AA+JD;;;;;;;;;;;;GAYG;AACH,+CAPW,MAAM,QACN,MAAM,GAAC,MAAM,cACb,MAAY,MAAM,GAAC,IAAI,GAErB,GAAC,CASb;AAvND;;;;GAIG;AACH,2BAHU,MAAM,CAG2C;AAE3D;;;;;GAKG;AACH,8BAHU,OAAO,CAAC,MAAM,CAAC,CAGoB;AAE7C;;;;GAIG;AACH,+BAHU,MAAM,CAG2C"}
\ No newline at end of file
+{"version":3,"file":"trusted-root.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/trusted-root.mjs"],"names":[],"mappings":"AA4DA;;;;;;;;;;;GAWG;AACH,4CANW,MAAM,QACN,MAAM,GAAC,MAAM,GACX,IAAI,CAOhB;AA+JD;;;;;;;;;;;;GAYG;AACH,+CAPW,MAAM,QACN,MAAM,GAAC,MAAM,cACb,MAAY,MAAM,GAAC,IAAI,GAErB,GAAC,CASb;AAED;;;;;;;;;;;;;;GAcG;AACH,kDAPW,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,cACnB,MAAM,YACN,MAAM,GACJ,MAAM,CA4BlB;AAhQD;;;;GAIG;AACH,2BAHU,MAAM,CAG2C;AAE3D;;;;;GAKG;AACH,8BAHU,OAAO,CAAC,MAAM,CAAC,CAGoB;AAE7C;;;;GAIG;AACH,+BAHU,MAAM,CAG2C"}
\ No newline at end of file
diff --git a/types/src/slothlet.d.mts b/types/src/slothlet.d.mts
index f04100d25..2af030f29 100644
--- a/types/src/slothlet.d.mts
+++ b/types/src/slothlet.d.mts
@@ -423,6 +423,19 @@ export type SlothletAPI = {
             remove: Function;
             resetPatternFilter: Function;
         };
+        event: {
+            on: Function;
+            once: Function;
+            off: Function;
+            emit: Function;
+            resolveLevel: Function;
+            rules: {
+                add: Function;
+                remove: Function;
+            };
+            strategy: Function;
+            deliver: Function;
+        };
         lifecycle: {
             off: Function;
             on: Function;
diff --git a/types/src/slothlet.d.mts.map b/types/src/slothlet.d.mts.map
index 249a6de52..b01483963 100644
--- a/types/src/slothlet.d.mts.map
+++ b/types/src/slothlet.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"slothlet.d.mts","sourceRoot":"","sources":["../../src/slothlet.mjs"],"names":[],"mappings":"AAm7CA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,yBApCuB,CAAC,SAAX,MAAQ,6DAGV,eAAe,GACb,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,CAsCpC;;kBASS,QAAQ,CAAC;QAAC,QAAQ,EAAE,aAAa,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAC,CAAC,CAAC;QAAC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;KAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAgD3F,SAAS,GAAC,MAAM;;;;;;;;;;;;qBAEP,MAAM;iBAAO,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA8BhB,MAAM;eAAS,CAAC,QAAQ,GAAC,SAAS,GAAC,UAAU,GAAC,SAAS,CAAC;oBAAc,OAAO;gBAAU,CAAC,OAAO,GAAC,OAAO,CAAC;kBAAY,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAevI,KAAK,CAAC;YAAC,IAAI,EAAC,MAAM,CAAC;YAAA,IAAI,EAAC,MAAM,CAAC;YAAA,QAAQ,EAAC,MAAM,CAAA;SAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aA8BxD,MAAY,IAAI;;;;cAChB,MAAY,IAAI;;;;cAE3B;QAAgE,GAAG,EAAxD,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAC,SAAS,CAAC,CAAC;QACzB,GAAG,EAC/B;YAAkC,GAAG;YACH,MAAM;YACN,MAAM;YACN,MAAM;YACR,OAAO,EACvC;gBAA0C,QAAQ;gBACR,IAAI;gBACJ,SAAS;gBACT,UAAU;gBACV,YAAY;gBACZ,aAAa;gBACb,iBAAiB;gBACjB,mBAAmB;gBACnB,cAAc;aACxD;SAAA;QAA4B,OAAO,EACnC;YAAsC,GAAG;YACO,OAAO,EAA5C,MAAY,MAAM;YACS,GAAG;YACH,KAAK;YACL,GAAG;SACzC;QAA6B,IAAI;;;;;;;;6BAEV,MAAM;;;;yCACN,MAAM,EAAE;;;;;;;;;;;;;;;;;4BAIR,MAAM;;;;kCACN,MAAM;;;;;;;;6BAEN,MAAM;;;;;;;;;;;;;;;;;qCAIN,eAAe;;QACV,IAAI,EAChC;YAAmC,KAAK;YACL,OAAO;YACP,cAAc;YACd,MAAM;YACN,aAAa;YACb,IAAI;YACJ,GAAG;YACH,EAAE;YACJ,GAAG,EACpC;gBAAsC,OAAO,EAAlC,OAAO;gBACqB,MAAM;gBACN,OAAO;aAC9C;YAAmC,MAAM;YACN,kBAAkB;SACrD;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,EAAE;SAC1C;QAA4B,WAAW,EACvC;YAAoD,GAAG,EAA5C,MAAY,MAAM;YACY,YAAY,EAA1C,OAAO;YAC0C,IAAI,EAArD,MAAY,OAAO,CAAE,IAAI,CAAC;SACrC;QAA4B,QAAQ,EACpC;YAAsD,MAAM,EAAjD,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,MAAM;YACN,SAAS;YACM,IAAI,EAA/C,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,SAAS;SAChD;QAA4B,KAAK,EACjC;YAAoC,GAAG;SACvC;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,UAAU;SAClD;QAA4B,WAAW,EACvC;YAAwC,OAAO,EAC/C;gBAAiD,OAAO,EAA7C,OAAO;gBACwC,MAAM,EAArD,MAAY,IAAI;gBAC+B,OAAO,EAAtD,MAAY,IAAI;gBACsB,iBAAiB,EAAvD,OAAO;gBAC+C,UAAU,EAAhE,CAAS,IAAO,EAAP,OAAO,KAAG,IAAI;gBACwB,IAAI,EAAnD,MAAY,IAAI;gBACsB,MAAM,EAA5C,OAAO;aAClB;SAAA;QAA4B,UAAU,EACtC;YAAyC,IAAI;YACJ,UAAU;YACV,UAAU;YACV,kBAAkB;YAClB,kBAAkB;SAC3D;QAA8B,UAAU;QACV,IAAI;QACL,SAAS;QACR,MAAM;QACN,GAAG;QACH,KAAK;QACa,QAAQ,EAA7C,MAAY,OAAO,CAAE,IAAI,CAAC;KACvC;;gCAlnD6D,wBAAwB"}
\ No newline at end of file
+{"version":3,"file":"slothlet.d.mts","sourceRoot":"","sources":["../../src/slothlet.mjs"],"names":[],"mappings":"AA67CA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,yBApCuB,CAAC,SAAX,MAAQ,6DAGV,eAAe,GACb,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,CAsCpC;;kBASS,QAAQ,CAAC;QAAC,QAAQ,EAAE,aAAa,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAC,CAAC,CAAC;QAAC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;KAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAgD3F,SAAS,GAAC,MAAM;;;;;;;;;;;;qBAEP,MAAM;iBAAO,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA8BhB,MAAM;eAAS,CAAC,QAAQ,GAAC,SAAS,GAAC,UAAU,GAAC,SAAS,CAAC;oBAAc,OAAO;gBAAU,CAAC,OAAO,GAAC,OAAO,CAAC;kBAAY,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAevI,KAAK,CAAC;YAAC,IAAI,EAAC,MAAM,CAAC;YAAA,IAAI,EAAC,MAAM,CAAC;YAAA,QAAQ,EAAC,MAAM,CAAA;SAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aA8BxD,MAAY,IAAI;;;;cAChB,MAAY,IAAI;;;;cAE3B;QAAgE,GAAG,EAAxD,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAC,SAAS,CAAC,CAAC;QACzB,GAAG,EAC/B;YAAkC,GAAG;YACH,MAAM;YACN,MAAM;YACN,MAAM;YACR,OAAO,EACvC;gBAA0C,QAAQ;gBACR,IAAI;gBACJ,SAAS;gBACT,UAAU;gBACV,YAAY;gBACZ,aAAa;gBACb,iBAAiB;gBACjB,mBAAmB;gBACnB,cAAc;aACxD;SAAA;QAA4B,OAAO,EACnC;YAAsC,GAAG;YACO,OAAO,EAA5C,MAAY,MAAM;YACS,GAAG;YACH,KAAK;YACL,GAAG;SACzC;QAA6B,IAAI;;;;;;;;6BAEV,MAAM;;;;yCACN,MAAM,EAAE;;;;;;;;;;;;;;;;;4BAIR,MAAM;;;;kCACN,MAAM;;;;;;;;6BAEN,MAAM;;;;;;;;;;;;;;;;;qCAIN,eAAe;;QACV,IAAI,EAChC;YAAmC,KAAK;YACL,OAAO;YACP,cAAc;YACd,MAAM;YACN,aAAa;YACb,IAAI;YACJ,GAAG;YACH,EAAE;YACJ,GAAG,EACpC;gBAAsC,OAAO,EAAlC,OAAO;gBACqB,MAAM;gBACN,OAAO;aAC9C;YAAmC,MAAM;YACN,kBAAkB;SACrD;QAA4B,KAAK,EACjC;YAAoC,EAAE;YACF,IAAI;YACJ,GAAG;YACH,IAAI;YACJ,YAAY;YACd,KAAK,EACvC;gBAA0C,GAAG;gBACH,MAAM;aAChD;YAAoC,QAAQ;YACR,OAAO;SAC3C;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,EAAE;SAC1C;QAA4B,WAAW,EACvC;YAAoD,GAAG,EAA5C,MAAY,MAAM;YACY,YAAY,EAA1C,OAAO;YAC0C,IAAI,EAArD,MAAY,OAAO,CAAE,IAAI,CAAC;SACrC;QAA4B,QAAQ,EACpC;YAAsD,MAAM,EAAjD,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,MAAM;YACN,SAAS;YACM,IAAI,EAA/C,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,SAAS;SAChD;QAA4B,KAAK,EACjC;YAAoC,GAAG;SACvC;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,UAAU;SAClD;QAA4B,WAAW,EACvC;YAAwC,OAAO,EAC/C;gBAAiD,OAAO,EAA7C,OAAO;gBACwC,MAAM,EAArD,MAAY,IAAI;gBAC+B,OAAO,EAAtD,MAAY,IAAI;gBACsB,iBAAiB,EAAvD,OAAO;gBAC+C,UAAU,EAAhE,CAAS,IAAO,EAAP,OAAO,KAAG,IAAI;gBACwB,IAAI,EAAnD,MAAY,IAAI;gBACsB,MAAM,EAA5C,OAAO;aAClB;SAAA;QAA4B,UAAU,EACtC;YAAyC,IAAI;YACJ,UAAU;YACV,UAAU;YACV,kBAAkB;YAClB,kBAAkB;SAC3D;QAA8B,UAAU;QACV,IAAI;QACL,SAAS;QACR,MAAM;QACN,GAAG;QACH,KAAK;QACa,QAAQ,EAA7C,MAAY,OAAO,CAAE,IAAI,CAAC;KACvC;;gCAvoD6D,wBAAwB"}
\ No newline at end of file

From a951d9a96b9ac3404b158c684b446112346647ae Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Mon, 28 Sep 2026 23:25:39 -0700
Subject: [PATCH 31/49] fix(ownership): record a forceOverwrite add's module as
 owner of the paths it overwrites

After api.add(path, dir, { moduleID, forceOverwrite: true }) the added
module's implementation is live at every path it provides, but the ownership
registry kept the overwritten module as the current owner, and eager and lazy
mode disagreed on which paths were affected:

- Registrations made while the new content is built or materialized come
  through the generic impl:created/impl:changed subscribers, which only know
  the instance's default collision mode ("merge"). The added module's leaves
  were therefore recorded as merge losers wherever the overwritten module
  already had a function (eager, and lazy leaves materializing later).
- In lazy mode the overwritten module's wrappers are materialized during the
  collision and registered after the added module's own entries, taking the
  mount path and its namespaces back.

addApiComponent now records the add's collision mode per (moduleID, endpoint)
in the ownership manager before building, and the subscribers register with
that mode for any path under the endpoint. registerSubtree takes the add's
collision mode and, under replace/merge-replace, claims every path it walks
(un-flags the entry and moves it to the top of the stack). The record is
restored when the add is abandoned and dropped on unregister, a full scoped
removal, and clear.

Fixes #524
---
 .../base/core/alpha.mjs                       |  25 ++
 .../ext/main.mjs                              |  25 ++
 .../ext/session/store.mjs                     |  33 +++
 .../ext/session/vault/lock.mjs                |  25 ++
 .../shadow/store.mjs                          |  33 +++
 .../shadow/vault/lock.mjs                     |  25 ++
 src/lib/handlers/api-manager.mjs              |  19 +-
 src/lib/handlers/ownership.mjs                | 136 +++++++--
 src/slothlet.mjs                              |  16 +-
 .../ownership-force-overwrite.test.vitest.mjs | 259 ++++++++++++++++++
 types/src/lib/handlers/api-manager.d.mts.map  |   2 +-
 types/src/lib/handlers/ownership.d.mts        |  57 +++-
 types/src/lib/handlers/ownership.d.mts.map    |   2 +-
 types/src/slothlet.d.mts.map                  |   2 +-
 14 files changed, 629 insertions(+), 30 deletions(-)
 create mode 100644 api_tests/api_test_force_overwrite_ownership/base/core/alpha.mjs
 create mode 100644 api_tests/api_test_force_overwrite_ownership/ext/main.mjs
 create mode 100644 api_tests/api_test_force_overwrite_ownership/ext/session/store.mjs
 create mode 100644 api_tests/api_test_force_overwrite_ownership/ext/session/vault/lock.mjs
 create mode 100644 api_tests/api_test_force_overwrite_ownership/shadow/store.mjs
 create mode 100644 api_tests/api_test_force_overwrite_ownership/shadow/vault/lock.mjs
 create mode 100644 tests/vitests/suites/ownership/ownership-force-overwrite.test.vitest.mjs

diff --git a/api_tests/api_test_force_overwrite_ownership/base/core/alpha.mjs b/api_tests/api_test_force_overwrite_ownership/base/core/alpha.mjs
new file mode 100644
index 000000000..5ca98517a
--- /dev/null
+++ b/api_tests/api_test_force_overwrite_ownership/base/core/alpha.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_force_overwrite_ownership/base/core/alpha.mjs
+ *	@Date: 2026-09-28 21:58:00 -07:00 (1790657880)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 22:41:59 -07:00 (1790660519)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Base-module leaf, untouched by the overwriting add (#524).
+ * @module api_test_force_overwrite_ownership
+ */
+
+/**
+ * Return a marker identifying which module's implementation ran.
+ * @returns {string} Marker string.
+ */
+export function ping() {
+	return "base-ping";
+}
diff --git a/api_tests/api_test_force_overwrite_ownership/ext/main.mjs b/api_tests/api_test_force_overwrite_ownership/ext/main.mjs
new file mode 100644
index 000000000..fd2eb1831
--- /dev/null
+++ b/api_tests/api_test_force_overwrite_ownership/ext/main.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_force_overwrite_ownership/ext/main.mjs
+ *	@Date: 2026-09-28 21:58:00 -07:00 (1790657880)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 22:41:59 -07:00 (1790660519)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Original module's own leaf outside the overwritten path (#524).
+ * @module api_test_force_overwrite_ownership
+ */
+
+/**
+ * Return a marker identifying which module's implementation ran.
+ * @returns {string} Marker string.
+ */
+export function activate() {
+	return "ext-activate";
+}
diff --git a/api_tests/api_test_force_overwrite_ownership/ext/session/store.mjs b/api_tests/api_test_force_overwrite_ownership/ext/session/store.mjs
new file mode 100644
index 000000000..848d610a8
--- /dev/null
+++ b/api_tests/api_test_force_overwrite_ownership/ext/session/store.mjs
@@ -0,0 +1,33 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_force_overwrite_ownership/ext/session/store.mjs
+ *	@Date: 2026-09-28 21:58:00 -07:00 (1790657880)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 22:41:59 -07:00 (1790660519)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Original module's leaves at the path the shadow module overwrites (#524).
+ * @module api_test_force_overwrite_ownership
+ */
+
+/**
+ * Return a marker identifying which module's implementation ran.
+ * @returns {string} Marker string.
+ */
+export function create() {
+	return "ext-create";
+}
+
+/**
+ * Return a marker identifying which module's implementation ran.
+ * @returns {string} Marker string.
+ */
+export function destroy() {
+	return "ext-destroy";
+}
diff --git a/api_tests/api_test_force_overwrite_ownership/ext/session/vault/lock.mjs b/api_tests/api_test_force_overwrite_ownership/ext/session/vault/lock.mjs
new file mode 100644
index 000000000..a01bb0318
--- /dev/null
+++ b/api_tests/api_test_force_overwrite_ownership/ext/session/vault/lock.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_force_overwrite_ownership/ext/session/vault/lock.mjs
+ *	@Date: 2026-09-28 21:58:00 -07:00 (1790657880)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 22:41:59 -07:00 (1790660519)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Original module's nested leaf under the overwritten path (#524).
+ * @module api_test_force_overwrite_ownership
+ */
+
+/**
+ * Return a marker identifying which module's implementation ran.
+ * @returns {string} Marker string.
+ */
+export function open() {
+	return "ext-open";
+}
diff --git a/api_tests/api_test_force_overwrite_ownership/shadow/store.mjs b/api_tests/api_test_force_overwrite_ownership/shadow/store.mjs
new file mode 100644
index 000000000..c706feca8
--- /dev/null
+++ b/api_tests/api_test_force_overwrite_ownership/shadow/store.mjs
@@ -0,0 +1,33 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_force_overwrite_ownership/shadow/store.mjs
+ *	@Date: 2026-09-28 21:58:00 -07:00 (1790657880)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 22:41:59 -07:00 (1790660519)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Shadow module's replacement leaves, added with forceOverwrite (#524).
+ * @module api_test_force_overwrite_ownership
+ */
+
+/**
+ * Return a marker identifying which module's implementation ran.
+ * @returns {string} Marker string.
+ */
+export function create() {
+	return "shadow-create";
+}
+
+/**
+ * Return a marker identifying which module's implementation ran.
+ * @returns {string} Marker string.
+ */
+export function destroy() {
+	return "shadow-destroy";
+}
diff --git a/api_tests/api_test_force_overwrite_ownership/shadow/vault/lock.mjs b/api_tests/api_test_force_overwrite_ownership/shadow/vault/lock.mjs
new file mode 100644
index 000000000..fce510082
--- /dev/null
+++ b/api_tests/api_test_force_overwrite_ownership/shadow/vault/lock.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_force_overwrite_ownership/shadow/vault/lock.mjs
+ *	@Date: 2026-09-28 21:58:00 -07:00 (1790657880)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 22:42:00 -07:00 (1790660520)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Shadow module's nested replacement leaf, added with forceOverwrite (#524).
+ * @module api_test_force_overwrite_ownership
+ */
+
+/**
+ * Return a marker identifying which module's implementation ran.
+ * @returns {string} Marker string.
+ */
+export function open() {
+	return "shadow-open";
+}
diff --git a/src/lib/handlers/api-manager.mjs b/src/lib/handlers/api-manager.mjs
index 7b4cefe1c..837d25c60 100644
--- a/src/lib/handlers/api-manager.mjs
+++ b/src/lib/handlers/api-manager.mjs
@@ -2077,6 +2077,14 @@ export class ApiManager extends ComponentBase {
 		// routineManager is always registered and snapshotRawEntries always returns a Map, so the `|| new Map()` fallback is unreachable.
 		/* v8 ignore next */
 		const priorRawEntriesForModule = this.slothlet.handlers.routineManager?.snapshotRawEntries(moduleID) || new Map();
+		// Record the collision mode this add places moduleID's content under BEFORE buildAPI runs, so the
+		// registrations its wrapper construction (and any later lazy materialization) triggers through the
+		// generic impl:created/impl:changed subscribers use it rather than the instance default — under
+		// "replace"/"merge-replace" (forceOverwrite included) this module's content is what goes live, and
+		// the default "merge" recorded it as a merge loser wherever another module's function already sat
+		// (#524). Restored if the add is abandoned.
+		const priorPlacementMode = this.slothlet.handlers.ownership.setPlacementMode(moduleID, effectivePath, collisionMode);
+		const restorePlacementMode = () => this.slothlet.handlers.ownership.setPlacementMode(moduleID, effectivePath, priorPlacementMode);
 		// Revert whatever speculative ownership/raw state this candidate build has created for
 		// moduleID so far. Unlike the skip/warn cleanup calls elsewhere in this function (which walk
 		// a concrete apiToMerge value), this is also the recovery path for buildAPI()/setValueAtPath()
@@ -2085,6 +2093,7 @@ export class ApiManager extends ComponentBase {
 		// valid api-tree reference left to walk at that point, so both managers' state-driven variant
 		// is used instead (#372 review).
 		const revertSpeculativeState = () => {
+			restorePlacementMode();
 			this.slothlet.handlers.ownership?.revertSpeculativeState(moduleID, priorEntriesForModule);
 			this.slothlet.handlers.routineManager?.revertSpeculativeState(moduleID, priorRawEntriesForModule);
 		};
@@ -2428,6 +2437,7 @@ export class ApiManager extends ComponentBase {
 				this.slothlet.handlers.routineManager?.revertSpeculativeSubtree(apiToMerge, moduleID, effectivePath, priorRawEntriesForModule);
 				this.invalidateSpeculativeWrappers(apiToMerge);
 			}
+			restorePlacementMode();
 			throw err;
 		}
 
@@ -2586,15 +2596,20 @@ export class ApiManager extends ComponentBase {
 				// one whose own assignment was rejected under skip/warn and already had its
 				// speculative registration reverted above — silently undoing that revert (#366 review).
 				for (const key of rootSucceededKeys) {
-					this.slothlet.handlers.ownership.registerSubtree(rootSource[key], moduleID, key);
+					this.slothlet.handlers.ownership.registerSubtree(rootSource[key], moduleID, key, { collisionMode });
 				}
 			} else {
-				this.slothlet.handlers.ownership.registerSubtree(apiToMerge, moduleID, effectivePath);
+				// Passing the real collision mode lets a "replace"/"merge-replace" add claim every path it
+				// placed, over registrations that landed during the collision itself — in lazy mode the
+				// replaced module's wrappers materialize there and register after this module's (#524).
+				this.slothlet.handlers.ownership.registerSubtree(apiToMerge, moduleID, effectivePath, { collisionMode });
 			}
 			// Record the mount endpoint so setOwnedProperty can resolve this
 			// module's ownership root without consulting apiCacheManager.
 			this.slothlet.handlers.ownership.setModuleEndpoint(moduleID, effectivePath);
 		}
+		// Nothing of this add went live (skip/warn), so the placement it recorded does not apply (#524).
+		if (!anyAssignmentSucceeded) restorePlacementMode();
 
 		// Store API in cache (PRIMARY STORAGE). Gated on anyAssignmentSucceeded — the same guard the
 		// ownership registration above uses — and, for a root-level add, filtered to only the keys
diff --git a/src/lib/handlers/ownership.mjs b/src/lib/handlers/ownership.mjs
index dfb76d0fa..b4b001c58 100644
--- a/src/lib/handlers/ownership.mjs
+++ b/src/lib/handlers/ownership.mjs
@@ -209,6 +209,9 @@ export class OwnershipManager extends ComponentBase {
 		this.pathToModule = new Map(); // apiPath → Array<{moduleID, source, timestamp, value}>
 		this._unregisteredModules = new Set(); // moduleIDs that have been explicitly unregistered
 		this.moduleEndpoints = new Map(); // moduleID → mount endpoint (e.g. ".", "lib.config")
+		// moduleID → Map<endpoint, "replace"|"merge-replace"> — the winning collision mode each of the
+		// module's api.add() calls placed its content under (#524). See setPlacementMode().
+		this.placementModes = new Map();
 		// filePath → { values: WeakMap<value, exportPath>, members: WeakMap<value, {key: exportPath}> } —
 		// where each value a loaded file exported sits inside that file's module namespace (#484).
 		this.exportIndex = new Map();
@@ -491,6 +494,68 @@ export class OwnershipManager extends ComponentBase {
 		return this.moduleEndpoints.get(moduleID);
 	}
 
+	/**
+	 * Record the collision mode an `api.add()` places a module's content under at `endpoint` (#524).
+	 * @param {string} moduleID - Module identifier.
+	 * @param {string} endpoint - The add's mount path (`""` for a root-level add).
+	 * @param {string|null} collisionMode - The add's resolved collision mode. Only `"replace"` and
+	 *   `"merge-replace"` are recorded; any other value (or `null`) clears the endpoint's record.
+	 * @returns {string|null} The mode previously recorded for this endpoint, for a caller to restore
+	 *   with a second call when the add is abandoned.
+	 * @public
+	 *
+	 * @description
+	 * Under `"replace"`/`"merge-replace"` (`forceOverwrite` included) the incoming module's content is
+	 * what goes live at every path it provides. The registrations made while that content is built and
+	 * materialized — wrapper construction, lazy materialization, impl reassignment — come through the
+	 * generic `impl:created`/`impl:changed` subscribers, which otherwise only know the instance's default
+	 * collision mode and would record the incoming module as a merge loser wherever another module's
+	 * function already sits. {@link OwnershipManager#getPlacementMode} lets them register with the mode
+	 * that actually decided placement instead, including for a lazy leaf that materializes after the
+	 * add has returned.
+	 *
+	 * @example
+	 * const previous = ownership.setPlacementMode("shadow", "launcher.session", "replace");
+	 */
+	setPlacementMode(moduleID, endpoint, collisionMode) {
+		const modes = this.placementModes.get(moduleID);
+		const previous = modes?.get(endpoint) ?? null;
+		if (collisionMode === "replace" || collisionMode === "merge-replace") {
+			if (modes) modes.set(endpoint, collisionMode);
+			else this.placementModes.set(moduleID, new Map([[endpoint, collisionMode]]));
+		} else if (modes) {
+			modes.delete(endpoint);
+			if (modes.size === 0) this.placementModes.delete(moduleID);
+		}
+		return previous;
+	}
+
+	/**
+	 * Look up the collision mode a module's content at `apiPath` was placed under (#524).
+	 * @param {string} moduleID - Module identifier.
+	 * @param {string} apiPath - API path being registered.
+	 * @returns {string|null} `"replace"` or `"merge-replace"` when `apiPath` lies at or below an endpoint
+	 *   the module was added at under that mode (the deepest such endpoint wins); otherwise `null`.
+	 * @public
+	 *
+	 * @example
+	 * ownership.getPlacementMode("shadow", "launcher.session.store.create"); // "replace"
+	 */
+	getPlacementMode(moduleID, apiPath) {
+		const modes = this.placementModes.get(moduleID);
+		if (!modes || typeof apiPath !== "string") return null;
+		let match = null;
+		let matchLength = -1;
+		for (const [endpoint, mode] of modes) {
+			const covers = endpoint === "" || apiPath === endpoint || apiPath.startsWith(`${endpoint}.`);
+			if (covers && endpoint.length > matchLength) {
+				match = mode;
+				matchLength = endpoint.length;
+			}
+		}
+		return match;
+	}
+
 	/**
 	 * Register module ownership of API path with its value
 	 * @param {Object} options - Registration options
@@ -790,6 +855,7 @@ export class OwnershipManager extends ComponentBase {
 
 		this.moduleToPath.delete(moduleID);
 		this.moduleEndpoints.delete(moduleID);
+		this.placementModes.delete(moduleID);
 
 		return { removed, rolledBack };
 	}
@@ -822,6 +888,7 @@ export class OwnershipManager extends ComponentBase {
 	markUnregistered(moduleID) {
 		this._unregisteredModules.add(moduleID);
 		this.moduleEndpoints.delete(moduleID);
+		this.placementModes.delete(moduleID);
 	}
 
 	/**
@@ -1020,7 +1087,11 @@ export class OwnershipManager extends ComponentBase {
 	 * @param {object} api - API object or subtree
 	 * @param {string} moduleID - Module identifier (owner)
 	 * @param {string} path - Current API path
-	 * @param {WeakSet} [visited] - Visited objects (prevents circular refs)
+	 * @param {object} [options] - Walk options.
+	 * @param {string} [options.collisionMode="merge"] - The collision mode the subtree was placed on the
+	 *   live api under. `"replace"`/`"merge-replace"` make `moduleID` the current owner of every path the
+	 *   walk reaches (#524); any other value only confirms the paths without changing their order.
+	 * @param {WeakSet} [options.visited] - Visited objects (prevents circular refs)
 	 * @returns {void}
 	 * @public
 	 *
@@ -1028,10 +1099,19 @@ export class OwnershipManager extends ComponentBase {
 	 * Registers entire API subtree structure with ownership manager.
 	 * Used during load, reload, and api.add to establish ownership relationships.
 	 *
+	 * Under `"replace"`/`"merge-replace"` the subtree's content is what is live at each of its paths, so the
+	 * walk also claims them: the module's entry is un-flagged as a merge loss and moved to the top of the
+	 * path's stack. That overrides registrations made while the add was in progress that do not reflect the
+	 * placement — in lazy mode the replaced module's wrappers are materialized during the collision and
+	 * register after the incoming module's own construction-time entries.
+	 *
 	 * @example
 	 * ownership.registerSubtree(api, "base_abc123", "");
+	 *
+	 * @example
+	 * ownership.registerSubtree(apiToMerge, "shadow", "launcher.session", { collisionMode: "replace" });
 	 */
-	registerSubtree(api, moduleID, path, visited = new WeakSet()) {
+	registerSubtree(api, moduleID, path, { collisionMode = "merge", visited = new WeakSet() } = {}) {
 		if (!api || typeof api !== "object") return;
 
 		// Prevent infinite recursion on circular references
@@ -1040,16 +1120,11 @@ export class OwnershipManager extends ComponentBase {
 		}
 		visited.add(api);
 
+		const claims = collisionMode === "replace" || collisionMode === "merge-replace";
+
 		// Register this level if path exists
 		if (path) {
-			this.register({
-				moduleID,
-				apiPath: path,
-				value: api,
-				source: REGISTRATION_SOURCE_CONFIRM,
-				collisionMode: "merge",
-				filePath: null
-			});
+			this.#confirm(moduleID, path, api, claims);
 		}
 
 		// Recursively register children. Reads go through the proxy (its get trap produces the values
@@ -1069,23 +1144,45 @@ export class OwnershipManager extends ComponentBase {
 
 			const childPath = path ? `${path}.${key}` : key;
 			if (typeof value === "function" || (value && typeof value === "object")) {
-				this.register({
-					moduleID,
-					apiPath: childPath,
-					value,
-					source: REGISTRATION_SOURCE_CONFIRM,
-					collisionMode: "merge",
-					filePath: null
-				});
+				this.#confirm(moduleID, childPath, value, claims);
 
 				// Recurse for objects (not functions with properties)
 				if (typeof value === "object" && !Array.isArray(value)) {
-					this.registerSubtree(value, moduleID, childPath, visited);
+					this.registerSubtree(value, moduleID, childPath, { collisionMode, visited });
 				}
 			}
 		}
 	}
 
+	/**
+	 * One {@link OwnershipManager#registerSubtree} registration, optionally claiming the path (#524).
+	 * @param {string} moduleID - Module identifier (owner).
+	 * @param {string} apiPath - API path to register.
+	 * @param {*} value - The value at the path.
+	 * @param {boolean} claim - Whether `moduleID`'s content is what is live at the path, so its entry must
+	 *   become the path's current owner.
+	 * @returns {void}
+	 * @private
+	 */
+	#confirm(moduleID, apiPath, value, claim) {
+		const entry = this.register({
+			moduleID,
+			apiPath,
+			value,
+			source: REGISTRATION_SOURCE_CONFIRM,
+			collisionMode: "merge",
+			filePath: null
+		});
+		if (!claim || !entry) return;
+		entry.isMergeLoss = false;
+		const stack = this.pathToModule.get(apiPath);
+		const index = stack.indexOf(entry);
+		if (index !== stack.length - 1) {
+			stack.splice(index, 1);
+			stack.push(entry);
+		}
+	}
+
 	/**
 	 * Snapshot the entries moduleID currently owns, keyed by apiPath, for later restoration
 	 * @param {string} moduleID - Module identifier to snapshot.
@@ -1318,6 +1415,7 @@ export class OwnershipManager extends ComponentBase {
 		this.pathToModule.clear();
 		this._unregisteredModules.clear();
 		this.moduleEndpoints.clear();
+		this.placementModes.clear();
 		this.exportIndex.clear();
 	}
 
diff --git a/src/slothlet.mjs b/src/slothlet.mjs
index 44b9d6c5b..a2525dd89 100644
--- a/src/slothlet.mjs
+++ b/src/slothlet.mjs
@@ -438,7 +438,13 @@ class Slothlet {
 				// forceOverwrite-driven build throws OWNERSHIP_CONFLICT before its own override is
 				// ever applied. The authoritative "error" enforcement point is the top-level
 				// setValueAtPath check, which runs with the real resolved mode directly (#366 review).
-				const collisionMode = configCollisionMode === "replace" || configCollisionMode === "merge-replace" ? configCollisionMode : "merge";
+				// A module an api.add() placed under "replace"/"merge-replace" (forceOverwrite included)
+				// registers with that mode instead: its content is what is live at the paths it provides,
+				// and without the real mode it was recorded as a merge loser wherever another module's
+				// function already sat — including a lazy leaf materializing after the add returned (#524).
+				const collisionMode =
+					this.handlers.ownership.getPlacementMode(data.moduleID, data.apiPath) ??
+					(configCollisionMode === "replace" || configCollisionMode === "merge-replace" ? configCollisionMode : "merge");
 				// The leaf's impl. On a LAZY construction event `wrapper.__impl` is still null (the leaf
 				// hasn't materialized), so fall back to the real wrapper (`__wrapperRef`) exactly as the
 				// former `?? data.impl` did — `data.impl` used to be `this` on the construction emit, and
@@ -498,9 +504,11 @@ class Slothlet {
 				// config.collision.api is always set after normalization; "merge" fallback never reached.
 				/* v8 ignore next */
 				const configCollisionMode = this.config?.collision?.api || "merge";
-				// Same clamp as the impl:created subscriber above, and for the same reason — see its
-				// comment.
-				const collisionMode = configCollisionMode === "replace" || configCollisionMode === "merge-replace" ? configCollisionMode : "merge";
+				// Same placement lookup and clamp as the impl:created subscriber above, and for the same
+				// reasons — see its comments.
+				const collisionMode =
+					this.handlers.ownership.getPlacementMode(data.moduleID, data.apiPath) ??
+					(configCollisionMode === "replace" || configCollisionMode === "merge-replace" ? configCollisionMode : "merge");
 				// The leaf's impl. data.wrapper.__impl is normally set for impl:changed events; the
 				// `?? data.__wrapperRef` fallback mirrors the impl:created subscriber (see its note) — the
 				// former `?? data.impl` referenced the wrapper `this`, now carried on `__wrapperRef` (#398).
diff --git a/tests/vitests/suites/ownership/ownership-force-overwrite.test.vitest.mjs b/tests/vitests/suites/ownership/ownership-force-overwrite.test.vitest.mjs
new file mode 100644
index 000000000..47e9a1259
--- /dev/null
+++ b/tests/vitests/suites/ownership/ownership-force-overwrite.test.vitest.mjs
@@ -0,0 +1,259 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/ownership/ownership-force-overwrite.test.vitest.mjs
+ *	@Date: 2026-09-28 21:59:12 -07:00 (1790657952)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 22:46:01 -07:00 (1790660761)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Regression coverage (#524): after `api.slothlet.api.add(path, dir, { moduleID, forceOverwrite: true })`
+ * the overwriting module's implementation is the live one at every path it overwrote, so the ownership registry
+ * must record that module as the current owner of each of those paths, identically in eager and lazy mode.
+ *
+ * Before the fix, the registry kept the overwritten module as current owner of the overwritten leaves (eager) or
+ * of the mount path and some of its namespaces (lazy): every construction-time registration used the instance's
+ * default collision mode, so the overwriting module's leaves were recorded as merge losers, and in lazy mode the
+ * overwritten module's forced materialization registered after the overwriting module and took the path back.
+ * Anything reading the current owner (e.g. `permissions.owner`, #509) then attributed the overwriting module's
+ * live code to the module it replaced.
+ * @module tests/vitests/suites/ownership/ownership-force-overwrite
+ */
+
+process.env.SLOTHLET_INTERNAL_TEST_MODE = "true";
+
+import path from "node:path";
+import { describe, it, expect, afterEach } from "vitest";
+import slothlet from "@cldmv/slothlet";
+import { resolveWrapper } from "#handlers/unified-wrapper";
+import { OwnershipManager } from "#handlers/ownership";
+import { SlothletError, SlothletWarning } from "@cldmv/slothlet/errors";
+import { getMatrixConfigs, TEST_DIRS } from "../../setup/vitest-helper.mjs";
+
+const FIXTURES = path.join(path.dirname(TEST_DIRS.API_TEST), "api_test_force_overwrite_ownership");
+const BASE = path.join(FIXTURES, "base"); // core/alpha.mjs: ping()
+const EXT = path.join(FIXTURES, "ext"); // main.mjs: activate(); session/store.mjs: create(), destroy(); session/vault/lock.mjs: open()
+const SHADOW = path.join(FIXTURES, "shadow"); // store.mjs: create(), destroy(); vault/lock.mjs: open()
+
+/**
+ * The paths the shadow module's content occupies below its mount point.
+ * @type {string[]}
+ */
+const SHADOW_SUBPATHS = ["store", "store.create", "store.destroy", "vault", "vault.lock", "vault.lock.open"];
+
+/**
+ * Read the ownership handler behind a composed api.
+ * @param {object} api - Composed api.
+ * @returns {object} The instance's OwnershipManager.
+ */
+function ownershipOf(api) {
+	return resolveWrapper(api.core).slothlet.handlers.ownership;
+}
+
+/**
+ * Map each path to its current owner's moduleID.
+ * @param {object} ownership - OwnershipManager.
+ * @param {string[]} paths - API paths.
+ * @returns {Object<string, (string|null)>} Path → current owner moduleID.
+ */
+function currentOwners(ownership, paths) {
+	return Object.fromEntries(paths.map((apiPath) => [apiPath, ownership.getCurrentOwner(apiPath)?.moduleID ?? null]));
+}
+
+/**
+ * Call every shadow leaf under `node`, materializing it in lazy mode.
+ * @param {object} node - The api node the shadow module is mounted at.
+ * @returns {Promise<string[]>} The leaves' return values.
+ */
+async function callShadowLeaves(node) {
+	return [await node.store.create(), await node.store.destroy(), await node.vault.lock.open()];
+}
+
+describe.each(getMatrixConfigs())("ownership after a forceOverwrite add (#524) > $name", ({ config }) => {
+	let api;
+
+	afterEach(async () => {
+		if (api?.shutdown) await api.shutdown();
+		api = null;
+	});
+
+	it("records the overwriting module as current owner of every overwritten path of another added module", async () => {
+		api = await slothlet({ ...config, base: BASE, silent: true });
+		await api.slothlet.api.add("launcher", EXT, { moduleID: "launcher" });
+		await api.slothlet.api.add("launcher.session", SHADOW, { moduleID: "shadow", forceOverwrite: true });
+
+		expect(await callShadowLeaves(api.launcher.session)).toEqual(["shadow-create", "shadow-destroy", "shadow-open"]);
+
+		const paths = ["launcher.session", ...SHADOW_SUBPATHS.map((p) => `launcher.session.${p}`)];
+		expect(currentOwners(ownershipOf(api), paths)).toEqual(Object.fromEntries(paths.map((p) => [p, "shadow"])));
+		// A path the overwrite did not touch keeps its own owner.
+		expect(await api.launcher.main.activate()).toBe("ext-activate");
+		expect(ownershipOf(api).getCurrentOwner("launcher.main.activate")?.moduleID).toBe("launcher");
+	});
+
+	it("records the overwriting module as current owner when the overwritten leaves were already called", async () => {
+		api = await slothlet({ ...config, base: BASE, silent: true });
+		await api.slothlet.api.add("launcher", EXT, { moduleID: "launcher" });
+		expect([await api.launcher.session.store.create(), await api.launcher.session.vault.lock.open()]).toEqual(["ext-create", "ext-open"]);
+
+		await api.slothlet.api.add("launcher.session", SHADOW, { moduleID: "shadow", forceOverwrite: true });
+
+		expect(await callShadowLeaves(api.launcher.session)).toEqual(["shadow-create", "shadow-destroy", "shadow-open"]);
+
+		const paths = ["launcher.session", ...SHADOW_SUBPATHS.map((p) => `launcher.session.${p}`)];
+		expect(currentOwners(ownershipOf(api), paths)).toEqual(Object.fromEntries(paths.map((p) => [p, "shadow"])));
+	});
+
+	it("records the overwriting module as current owner of an overwritten base-module path", async () => {
+		api = await slothlet({ ...config, base: BASE, silent: true });
+		await api.slothlet.api.add("core", SHADOW, { moduleID: "shadow", forceOverwrite: true });
+
+		expect(await callShadowLeaves(api.core)).toEqual(["shadow-create", "shadow-destroy", "shadow-open"]);
+
+		const paths = ["core", ...SHADOW_SUBPATHS.map((p) => `core.${p}`)];
+		expect(currentOwners(ownershipOf(api), paths)).toEqual(Object.fromEntries(paths.map((p) => [p, "shadow"])));
+	});
+
+	it("keeps the overwriting module as current owner across a full reload", async () => {
+		api = await slothlet({ ...config, base: BASE, silent: true });
+		await api.slothlet.api.add("launcher", EXT, { moduleID: "launcher" });
+		await api.slothlet.api.add("launcher.session", SHADOW, { moduleID: "shadow", forceOverwrite: true });
+		await api.slothlet.reload();
+
+		expect(await callShadowLeaves(api.launcher.session)).toEqual(["shadow-create", "shadow-destroy", "shadow-open"]);
+
+		const paths = ["launcher.session", ...SHADOW_SUBPATHS.map((p) => `launcher.session.${p}`)];
+		expect(currentOwners(ownershipOf(api), paths)).toEqual(Object.fromEntries(paths.map((p) => [p, "shadow"])));
+	});
+});
+
+describe.each(getMatrixConfigs().filter(({ name }) => name === "EAGER" || name === "LAZY"))(
+	"placement mode bookkeeping of a rejected add (#524) > $name",
+	({ config }) => {
+		let api;
+
+		afterEach(async () => {
+			if (api?.shutdown) await api.shutdown();
+			api = null;
+		});
+
+		it.each(["skip", "warn"])("a %s-rejected re-add keeps the placement the live content was added under", async (collisionMode) => {
+			api = await slothlet({ ...config, base: BASE, silent: true, api: { mutations: { allowCollisionOverride: true } } });
+			await api.slothlet.api.add("launcher", EXT, { moduleID: "launcher" });
+			await api.slothlet.api.add("launcher.session", SHADOW, { moduleID: "shadow", forceOverwrite: true });
+			await api.slothlet.api.add("launcher.session", SHADOW, { moduleID: "shadow", collisionMode });
+
+			const ownership = ownershipOf(api);
+			expect(ownership.getPlacementMode("shadow", "launcher.session.store.create")).toBe("replace");
+			expect(await callShadowLeaves(api.launcher.session)).toEqual(["shadow-create", "shadow-destroy", "shadow-open"]);
+			expect(ownership.getCurrentOwner("launcher.session.vault.lock.open")?.moduleID).toBe("shadow");
+		});
+
+		it("a merge re-add of the same module at the same endpoint replaces the recorded placement", async () => {
+			api = await slothlet({ ...config, base: BASE, silent: true, api: { mutations: { allowCollisionOverride: true } } });
+			await api.slothlet.api.add("launcher.session", SHADOW, { moduleID: "shadow", forceOverwrite: true });
+			await api.slothlet.api.add("launcher.session", SHADOW, { moduleID: "shadow", collisionMode: "merge" });
+
+			expect(ownershipOf(api).getPlacementMode("shadow", "launcher.session.store")).toBeNull();
+		});
+	}
+);
+
+/**
+ * Minimal mock slothlet sufficient for OwnershipManager.
+ * @returns {object} Mock slothlet object.
+ */
+function makeMock() {
+	return { config: {}, debug: () => {}, SlothletError, SlothletWarning };
+}
+
+describe("OwnershipManager placement modes (#524)", () => {
+	it("records only replace/merge-replace and resolves the deepest covering endpoint", () => {
+		const ownership = new OwnershipManager(makeMock());
+
+		expect(ownership.setPlacementMode("mod", "a", "merge")).toBeNull();
+		expect(ownership.getPlacementMode("mod", "a.b")).toBeNull();
+
+		expect(ownership.setPlacementMode("mod", "a", "replace")).toBeNull();
+		expect(ownership.setPlacementMode("mod", "a.b", "merge-replace")).toBeNull();
+		expect(ownership.getPlacementMode("mod", "a")).toBe("replace");
+		expect(ownership.getPlacementMode("mod", "a.x")).toBe("replace");
+		expect(ownership.getPlacementMode("mod", "a.b.c")).toBe("merge-replace");
+		// A sibling that merely shares a prefix is not under the endpoint.
+		expect(ownership.getPlacementMode("mod", "ab")).toBeNull();
+		expect(ownership.getPlacementMode("other", "a.b")).toBeNull();
+		expect(ownership.getPlacementMode("mod", undefined)).toBeNull();
+
+		// Re-recording returns the previous mode; a non-winning mode clears the endpoint.
+		expect(ownership.setPlacementMode("mod", "a.b", "error")).toBe("merge-replace");
+		expect(ownership.getPlacementMode("mod", "a.b.c")).toBe("replace");
+		expect(ownership.setPlacementMode("mod", "a", null)).toBe("replace");
+		expect(ownership.placementModes.has("mod")).toBe(false);
+	});
+
+	it("a root-level endpoint covers every path", () => {
+		const ownership = new OwnershipManager(makeMock());
+		ownership.setPlacementMode("mod", "", "replace");
+		expect(ownership.getPlacementMode("mod", "anything.at.all")).toBe("replace");
+	});
+
+	it("unregister, markUnregistered and clear drop a module's placement modes", () => {
+		const ownership = new OwnershipManager(makeMock());
+		ownership.register({ moduleID: "a", apiPath: "x", value: function () {}, collisionMode: "replace" });
+		ownership.setPlacementMode("a", "x", "replace");
+		ownership.setPlacementMode("b", "y", "replace");
+		ownership.setPlacementMode("c", "z", "replace");
+
+		ownership.unregister("a");
+		expect(ownership.getPlacementMode("a", "x")).toBeNull();
+		ownership.markUnregistered("b");
+		expect(ownership.getPlacementMode("b", "y")).toBeNull();
+		ownership.clear();
+		expect(ownership.getPlacementMode("c", "z")).toBeNull();
+	});
+
+	it.each(["replace", "merge-replace"])("registerSubtree under %s claims every path it walks", (collisionMode) => {
+		const ownership = new OwnershipManager(makeMock());
+		const incomingLeaf = function () {};
+		// The incoming module's leaf was recorded as a merge loser against the original's, and the original
+		// module's container registered after the incoming one (a lazy wrapper materialized mid-collision).
+		ownership.register({ moduleID: "original", apiPath: "ns.leaf", value: function () {}, collisionMode: "merge" });
+		ownership.register({ moduleID: "incoming", apiPath: "ns.leaf", value: incomingLeaf, collisionMode: "merge" });
+		ownership.register({ moduleID: "incoming", apiPath: "ns", value: {}, collisionMode: "merge" });
+		ownership.register({ moduleID: "original", apiPath: "ns", value: {}, collisionMode: "merge" });
+		expect(ownership.getCurrentOwner("ns").moduleID).toBe("original");
+		expect(ownership.getCurrentOwner("ns.leaf").moduleID).toBe("original");
+
+		ownership.registerSubtree({ leaf: incomingLeaf }, "incoming", "ns", { collisionMode });
+
+		expect(ownership.getCurrentOwner("ns").moduleID).toBe("incoming");
+		expect(ownership.getCurrentOwner("ns.leaf").moduleID).toBe("incoming");
+		expect(ownership.getCurrentValue("ns.leaf")).toBe(incomingLeaf);
+	});
+
+	it("registerSubtree without a winning mode only confirms, leaving the current owner alone", () => {
+		const ownership = new OwnershipManager(makeMock());
+		ownership.register({ moduleID: "original", apiPath: "ns.leaf", value: function () {}, collisionMode: "merge" });
+		ownership.register({ moduleID: "incoming", apiPath: "ns.leaf", value: function () {}, collisionMode: "merge" });
+
+		ownership.registerSubtree({ leaf: function () {} }, "incoming", "ns");
+
+		expect(ownership.getCurrentOwner("ns.leaf").moduleID).toBe("original");
+	});
+
+	it("registerSubtree under replace claims nothing for a module whose registrations are rejected", () => {
+		const ownership = new OwnershipManager(makeMock());
+		ownership.register({ moduleID: "original", apiPath: "ns.leaf", value: function () {}, collisionMode: "merge" });
+		ownership.markUnregistered("gone");
+
+		ownership.registerSubtree({ leaf: function () {} }, "gone", "ns", { collisionMode: "replace" });
+
+		expect(ownership.getPathOwnership("ns.leaf")).toEqual(new Set(["original"]));
+		expect(ownership.getPathOwnership("ns")).toBeNull();
+	});
+});
diff --git a/types/src/lib/handlers/api-manager.d.mts.map b/types/src/lib/handlers/api-manager.d.mts.map
index ed9ee80c5..5211d5c29 100644
--- a/types/src/lib/handlers/api-manager.d.mts.map
+++ b/types/src/lib/handlers/api-manager.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"api-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/api-manager.mjs"],"names":[],"mappings":"AAgFA;;;;;;;;;;;;;;GAcG;AACH;IACC,gCAAuC;IAEvC;;;;;;;;;;;OAWG;IACH,sBAVW,MAAM,EAuBhB;IAXA,sIAAsI;IACtI,OADW;QAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,MAAM,GAAC,IAAI,CAAC;QAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;KAAE,CAUjI;IAGF;;;;;;;;;;;;;;;;;;OAkBG;IACH,yBA+GC;IAED;;;;;;;;;;;;;;OAcG;IACH,oBA4CC;IAED;;;;;;;;;;;;;;OAcG;IACH,0BA4BC;IAED;;;;;;;;;;;;OAYG;IACH,6BAIC;IAED;;;;;;;;;;;;OAYG;IACH,uBASC;IAED;;;;;;;;;;;;;OAaG;IACH,yBAkCC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,iCAbW,MAAM,SACN,OAAO,iBACP,MAAM,GAAC,IAAI,GACT,IAAI,CAqHhB;IAED;;;;;;;;;;;;;OAaG;IACH,uBAEC;IAED;;;;;;;;;;;;;;OAcG;IACH,oBAoVC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,8BAiCC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,sCAmBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,uBAyGC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,uBA6MC;IAED;;;;;;;;;;;;OAYG;IACH,mBAwHC;IACD;;;;;;;;;;;;OAYG;IACH,uBAsEC;IA6CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkDG;IACH,wBAhDG;QAAuB,OAAO,EAAtB,MAAM;QACmD,UAAU,EAAnE,MAAM,GAAC,MAAM,EAAE,cAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;QACf,OAAO;KAChD,GAAU,OAAO,CAAC,MAAM,GAAC,MAAM,EAAE,CAAC,CAu+BpC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,yEATG;QAAqB,QAAQ,EAArB,MAAM;QACO,aAAa,EAA1B,MAAM;QACO,cAAc,EAA3B,MAAM;KACd,GAAU,OAAO,CAAC,IAAI,CAAC,CAgDzB;IA8BD;;;;;;;;;;;OAWG;IACH,mCAeC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,mCA1BW,MAAM,YAEd;QAAyB,aAAa;QAGZ,aAAa;KACvC,GAAU,OAAO,CAAC,OAAO,CAAC,CAmoB5B;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,2BAdG;QAAwB,OAAO,EAAtB,MAAM,OAAA;QACS,QAAQ,EAAvB,MAAM,OAAA;KACf,GAAU,OAAO,CAAC,IAAI,CAAC,CAuCzB;IAED;;;;;;;;;;OAUG;IACH,0BA+EC;IAED;;;;;;;;;;;;;;OAcG;IACH,yBAsFC;IAED;;;;;;;;;;;;;OAaG;IACH,4BA0FC;IAED;;;;;;;;OAQG;IACH,iCAyDC;IAED;;;;;OAKG;IACH,iCAeC;IAED;;;;;;;;;;;;;OAaG;IACH,wBAoUC;;CACD;8BArnI6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"api-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/api-manager.mjs"],"names":[],"mappings":"AAgFA;;;;;;;;;;;;;;GAcG;AACH;IACC,gCAAuC;IAEvC;;;;;;;;;;;OAWG;IACH,sBAVW,MAAM,EAuBhB;IAXA,sIAAsI;IACtI,OADW;QAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,MAAM,GAAC,IAAI,CAAC;QAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;KAAE,CAUjI;IAGF;;;;;;;;;;;;;;;;;;OAkBG;IACH,yBA+GC;IAED;;;;;;;;;;;;;;OAcG;IACH,oBA4CC;IAED;;;;;;;;;;;;;;OAcG;IACH,0BA4BC;IAED;;;;;;;;;;;;OAYG;IACH,6BAIC;IAED;;;;;;;;;;;;OAYG;IACH,uBASC;IAED;;;;;;;;;;;;;OAaG;IACH,yBAkCC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,iCAbW,MAAM,SACN,OAAO,iBACP,MAAM,GAAC,IAAI,GACT,IAAI,CAqHhB;IAED;;;;;;;;;;;;;OAaG;IACH,uBAEC;IAED;;;;;;;;;;;;;;OAcG;IACH,oBAoVC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,8BAiCC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,sCAmBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,uBAyGC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,uBA6MC;IAED;;;;;;;;;;;;OAYG;IACH,mBAwHC;IACD;;;;;;;;;;;;OAYG;IACH,uBAsEC;IA6CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkDG;IACH,wBAhDG;QAAuB,OAAO,EAAtB,MAAM;QACmD,UAAU,EAAnE,MAAM,GAAC,MAAM,EAAE,cAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;QACf,OAAO;KAChD,GAAU,OAAO,CAAC,MAAM,GAAC,MAAM,EAAE,CAAC,CAs/BpC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,yEATG;QAAqB,QAAQ,EAArB,MAAM;QACO,aAAa,EAA1B,MAAM;QACO,cAAc,EAA3B,MAAM;KACd,GAAU,OAAO,CAAC,IAAI,CAAC,CAgDzB;IA8BD;;;;;;;;;;;OAWG;IACH,mCAeC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,mCA1BW,MAAM,YAEd;QAAyB,aAAa;QAGZ,aAAa;KACvC,GAAU,OAAO,CAAC,OAAO,CAAC,CAmoB5B;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,2BAdG;QAAwB,OAAO,EAAtB,MAAM,OAAA;QACS,QAAQ,EAAvB,MAAM,OAAA;KACf,GAAU,OAAO,CAAC,IAAI,CAAC,CAuCzB;IAED;;;;;;;;;;OAUG;IACH,0BA+EC;IAED;;;;;;;;;;;;;;OAcG;IACH,yBAsFC;IAED;;;;;;;;;;;;;OAaG;IACH,4BA0FC;IAED;;;;;;;;OAQG;IACH,iCAyDC;IAED;;;;;OAKG;IACH,iCAeC;IAED;;;;;;;;;;;;;OAaG;IACH,wBAoUC;;CACD;8BApoI6B,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/lib/handlers/ownership.d.mts b/types/src/lib/handlers/ownership.d.mts
index 75d90199f..a146fe422 100644
--- a/types/src/lib/handlers/ownership.d.mts
+++ b/types/src/lib/handlers/ownership.d.mts
@@ -21,6 +21,7 @@ export class OwnershipManager extends ComponentBase {
     pathToModule: Map<any, any>;
     _unregisteredModules: Set<any>;
     moduleEndpoints: Map<any, any>;
+    placementModes: Map<any, any>;
     exportIndex: Map<any, any>;
     cloneSources: WeakMap<object, any>;
     /**
@@ -186,6 +187,42 @@ export class OwnershipManager extends ComponentBase {
      * @public
      */
     public getModuleEndpoint(moduleID: string): string | undefined;
+    /**
+     * Record the collision mode an `api.add()` places a module's content under at `endpoint` (#524).
+     * @param {string} moduleID - Module identifier.
+     * @param {string} endpoint - The add's mount path (`""` for a root-level add).
+     * @param {string|null} collisionMode - The add's resolved collision mode. Only `"replace"` and
+     *   `"merge-replace"` are recorded; any other value (or `null`) clears the endpoint's record.
+     * @returns {string|null} The mode previously recorded for this endpoint, for a caller to restore
+     *   with a second call when the add is abandoned.
+     * @public
+     *
+     * @description
+     * Under `"replace"`/`"merge-replace"` (`forceOverwrite` included) the incoming module's content is
+     * what goes live at every path it provides. The registrations made while that content is built and
+     * materialized — wrapper construction, lazy materialization, impl reassignment — come through the
+     * generic `impl:created`/`impl:changed` subscribers, which otherwise only know the instance's default
+     * collision mode and would record the incoming module as a merge loser wherever another module's
+     * function already sits. {@link OwnershipManager#getPlacementMode} lets them register with the mode
+     * that actually decided placement instead, including for a lazy leaf that materializes after the
+     * add has returned.
+     *
+     * @example
+     * const previous = ownership.setPlacementMode("shadow", "launcher.session", "replace");
+     */
+    public setPlacementMode(moduleID: string, endpoint: string, collisionMode: string | null): string | null;
+    /**
+     * Look up the collision mode a module's content at `apiPath` was placed under (#524).
+     * @param {string} moduleID - Module identifier.
+     * @param {string} apiPath - API path being registered.
+     * @returns {string|null} `"replace"` or `"merge-replace"` when `apiPath` lies at or below an endpoint
+     *   the module was added at under that mode (the deepest such endpoint wins); otherwise `null`.
+     * @public
+     *
+     * @example
+     * ownership.getPlacementMode("shadow", "launcher.session.store.create"); // "replace"
+     */
+    public getPlacementMode(moduleID: string, apiPath: string): string | null;
     /**
      * Register module ownership of API path with its value
      * @param {Object} options - Registration options
@@ -351,7 +388,11 @@ export class OwnershipManager extends ComponentBase {
      * @param {object} api - API object or subtree
      * @param {string} moduleID - Module identifier (owner)
      * @param {string} path - Current API path
-     * @param {WeakSet} [visited] - Visited objects (prevents circular refs)
+     * @param {object} [options] - Walk options.
+     * @param {string} [options.collisionMode="merge"] - The collision mode the subtree was placed on the
+     *   live api under. `"replace"`/`"merge-replace"` make `moduleID` the current owner of every path the
+     *   walk reaches (#524); any other value only confirms the paths without changing their order.
+     * @param {WeakSet} [options.visited] - Visited objects (prevents circular refs)
      * @returns {void}
      * @public
      *
@@ -359,10 +400,22 @@ export class OwnershipManager extends ComponentBase {
      * Registers entire API subtree structure with ownership manager.
      * Used during load, reload, and api.add to establish ownership relationships.
      *
+     * Under `"replace"`/`"merge-replace"` the subtree's content is what is live at each of its paths, so the
+     * walk also claims them: the module's entry is un-flagged as a merge loss and moved to the top of the
+     * path's stack. That overrides registrations made while the add was in progress that do not reflect the
+     * placement — in lazy mode the replaced module's wrappers are materialized during the collision and
+     * register after the incoming module's own construction-time entries.
+     *
      * @example
      * ownership.registerSubtree(api, "base_abc123", "");
+     *
+     * @example
+     * ownership.registerSubtree(apiToMerge, "shadow", "launcher.session", { collisionMode: "replace" });
      */
-    public registerSubtree(api: object, moduleID: string, path: string, visited?: WeakSet<any>): void;
+    public registerSubtree(api: object, moduleID: string, path: string, { collisionMode, visited }?: {
+        collisionMode?: string | undefined;
+        visited?: WeakSet<any> | undefined;
+    }): void;
     /**
      * Snapshot the entries moduleID currently owns, keyed by apiPath, for later restoration
      * @param {string} moduleID - Module identifier to snapshot.
diff --git a/types/src/lib/handlers/ownership.d.mts.map b/types/src/lib/handlers/ownership.d.mts.map
index 4e2066e76..5bacdb691 100644
--- a/types/src/lib/handlers/ownership.d.mts.map
+++ b/types/src/lib/handlers/ownership.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"ownership.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/ownership.mjs"],"names":[],"mappings":"AAyLA;;;;;GAKG;AAEH;;;;;GAKG;AACH;IACC,gCAAsC;IAEtC;;;OAGG;IACH,sBAFW,MAAM,EAahB;IATA,4BAA6B;IAC7B,4BAA6B;IAC7B,+BAAqC;IACrC,+BAAgC;IAGhC,2BAA4B;IAE5B,mCAAiC;IAGlC;;;;;;;;;;;;;;;;;OAiBG;IACH,oCAhBW,MAAM,OACN,MAAM,GAEJ,IAAI,CA6DhB;IAED;;;;;;;;OAQG;IACH,kCAPW,MAAM,GACJ,OAAO,CAQnB;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,uCAjBW,MAAM,WACN,MAAM,WAAS,WAEf;YAAO,MAAM,GAAE,MAAM,EAAE;KAAC,GAAC,IAAI,SAC7B,MAAM,EAAE,GAAC,IAAI,GACX,IAAI,CAoBhB;IAED;;;;;;;;;OASG;IACH,wBARW,GAAC,YACD,GAAC,GACC,IAAI,CAQhB;IAED;;;;;;;;;OASG;IACH,mCARW,MAAM,GAAC,IAAI,SACX,GAAC,GACC,MAAM,EAAE,GAAC,IAAI,CASzB;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,wCAfW,MAAM,GAAC,IAAI,OACX,MAAM,SACN,GAAC,GACC,MAAM,EAAE,GAAC,IAAI,CAgBzB;IAED;;;;;;;;;OASG;IACH,0CARW,MAAM,GAAC,IAAI,SACX,GAAC,GACC;YAAO,MAAM,GAAE,MAAM,EAAE;KAAC,GAAC,IAAI,CAQzC;IAyBD;;;;;;;;;;;;;;;OAeG;IACH,0BAdW,MAAM,GACJ;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,UAAU,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;QAAC,OAAO,EAAE,CAAC;gBAAO,MAAM,GAAE,MAAM,EAAE;SAAC,GAAC,IAAI,CAAC,CAAA;KAAC,GAAC,IAAI,CAsBnI;IAED;;;;;;;;;;;;OAYG;IACH,+BATW,MAAM,WACN,MAAM,UACN;QAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;QAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAA;KAAC,GACzF,IAAI,CAYhB;IAED;;;;;;;;OAQG;IACH,mCALW,MAAM,YACN,MAAM,GACJ,IAAI,CAUhB;IAED;;;;;OAKG;IACH,mCAJW,MAAM,GACJ,MAAM,GAAC,SAAS,CAK5B;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,sHAfG;QAAwB,QAAQ,EAAxB,MAAM;QACU,OAAO,EAAvB,MAAM;QACK,KAAK,EAAhB,GAAC;QACgB,MAAM;QACN,aAAa;QACb,MAAM;QACN,QAAQ;QACD,UAAU;QAGM,iBAAiB;;;KAEjE,GAAU,MAAM,GAAC,IAAI,CA0NvB;IA2BD;;;;;;;;;;OAUG;IACH,4BAVW,MAAM,GACJ,gBAAgB,CAuC5B;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,kCAtBW,MAAM,GACJ,IAAI,CAwBhB;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,mCApBW,MAAM,GACJ,IAAI,CAqBhB;IAED;;;;;;;;;;;;;OAaG;IACH,2BAbW,MAAM,aACN,MAAM,GAAC,IAAI,GACT;QAAE,MAAM,EAAE,QAAQ,GAAC,MAAM,GAAC,SAAS,CAAC;QAAC,eAAe,EAAE,MAAM,GAAC,IAAI,CAAC;QAC5E,eAAe,EAAE,MAAM,GAAC,IAAI,CAAA;KAAE,CAgDhC;IAED;;;;;OAKG;IACH,gCAJW,MAAM,GACJ,MAAM,GAAC,IAAI,CAevB;IAED;;;;;OAKG;IACH,gCAJW,MAAM,GACJ,GAAC,CAkBb;IAED;;;;;OAKG;IACH,gCAJW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAKzB;IAED;;;;;OAKG;IACH,+BAJW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAKzB;IAED;;;;;;OAMG;IACH,0BALW,MAAM,WACN,MAAM,GACJ,OAAO,CAMnB;IAED;;;;OAIG;IACH,yBAHa,MAAM,CAkBlB;IAED;;;;;OAKG;IACH,iCAJW,MAAM,GACJ,GAAG,CAAC,MAAM,CAAC,GAAC,IAAI,CAS5B;IAED;;;;;;;;;;;;;;;OAeG;IACH,4BAdW,MAAM,YACN,MAAM,QACN,MAAM,2BAEJ,IAAI,CA+DhB;IAED;;;;;;;;;;;;;;;OAeG;IACH,uCAdW,MAAM,GACJ,GAAG,CAAC,MAAM,EAAE;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,UAAU,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;QAAC,iBAAiB,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,CAAC,CAiCjK;IAED;;;;;;;;;;;;OAYG;IACH,8BAVW,MAAM,WACN,MAAM,YACN;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;QAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,GAExI,IAAI,CAehB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,kCA1BW,MAAM,YACN,MAAM,GACJ;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,UAAU,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;QAAC,iBAAiB,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,GAAC,SAAS,CAmC9J;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,qCA5BW,MAAM,YACN,MAAM,QACN,MAAM,gBACN,GAAG,CAAC,MAAM,EAAE;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAC,CAAC,2BAI9D,IAAI,CAmEhB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,wCA3BW,MAAM,gBACN,GAAG,CAAC,MAAM,EAAE;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,CAAC,GAGpF,IAAI,CAgChB;IAED;;;OAGG;IACH,qBAMC;IAED;;;;OAIG;IACH,sBAHa,MAAM,CAQlB;IAED;;;;OAIG;IACH,0BAHW,MAAM,QAgBhB;;CACD;;;;;;;;aA9oCa,MAAM,EAAE;;;;gBACR,MAAM,EAAE;;8BA3KQ,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"ownership.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/ownership.mjs"],"names":[],"mappings":"AAyLA;;;;;GAKG;AAEH;;;;;GAKG;AACH;IACC,gCAAsC;IAEtC;;;OAGG;IACH,sBAFW,MAAM,EAgBhB;IAZA,4BAA6B;IAC7B,4BAA6B;IAC7B,+BAAqC;IACrC,+BAAgC;IAGhC,8BAA+B;IAG/B,2BAA4B;IAE5B,mCAAiC;IAGlC;;;;;;;;;;;;;;;;;OAiBG;IACH,oCAhBW,MAAM,OACN,MAAM,GAEJ,IAAI,CA6DhB;IAED;;;;;;;;OAQG;IACH,kCAPW,MAAM,GACJ,OAAO,CAQnB;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,uCAjBW,MAAM,WACN,MAAM,WAAS,WAEf;YAAO,MAAM,GAAE,MAAM,EAAE;KAAC,GAAC,IAAI,SAC7B,MAAM,EAAE,GAAC,IAAI,GACX,IAAI,CAoBhB;IAED;;;;;;;;;OASG;IACH,wBARW,GAAC,YACD,GAAC,GACC,IAAI,CAQhB;IAED;;;;;;;;;OASG;IACH,mCARW,MAAM,GAAC,IAAI,SACX,GAAC,GACC,MAAM,EAAE,GAAC,IAAI,CASzB;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,wCAfW,MAAM,GAAC,IAAI,OACX,MAAM,SACN,GAAC,GACC,MAAM,EAAE,GAAC,IAAI,CAgBzB;IAED;;;;;;;;;OASG;IACH,0CARW,MAAM,GAAC,IAAI,SACX,GAAC,GACC;YAAO,MAAM,GAAE,MAAM,EAAE;KAAC,GAAC,IAAI,CAQzC;IAyBD;;;;;;;;;;;;;;;OAeG;IACH,0BAdW,MAAM,GACJ;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,UAAU,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;QAAC,OAAO,EAAE,CAAC;gBAAO,MAAM,GAAE,MAAM,EAAE;SAAC,GAAC,IAAI,CAAC,CAAA;KAAC,GAAC,IAAI,CAsBnI;IAED;;;;;;;;;;;;OAYG;IACH,+BATW,MAAM,WACN,MAAM,UACN;QAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;QAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAA;KAAC,GACzF,IAAI,CAYhB;IAED;;;;;;;;OAQG;IACH,mCALW,MAAM,YACN,MAAM,GACJ,IAAI,CAUhB;IAED;;;;;OAKG;IACH,mCAJW,MAAM,GACJ,MAAM,GAAC,SAAS,CAK5B;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,kCArBW,MAAM,YACN,MAAM,iBACN,MAAM,GAAC,IAAI,GAET,MAAM,GAAC,IAAI,CA4BvB;IAED;;;;;;;;;;OAUG;IACH,kCATW,MAAM,WACN,MAAM,GACJ,MAAM,GAAC,IAAI,CAoBvB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,sHAfG;QAAwB,QAAQ,EAAxB,MAAM;QACU,OAAO,EAAvB,MAAM;QACK,KAAK,EAAhB,GAAC;QACgB,MAAM;QACN,aAAa;QACb,MAAM;QACN,QAAQ;QACD,UAAU;QAGM,iBAAiB;;;KAEjE,GAAU,MAAM,GAAC,IAAI,CA0NvB;IA2BD;;;;;;;;;;OAUG;IACH,4BAVW,MAAM,GACJ,gBAAgB,CAwC5B;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,kCAtBW,MAAM,GACJ,IAAI,CAyBhB;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,mCApBW,MAAM,GACJ,IAAI,CAqBhB;IAED;;;;;;;;;;;;;OAaG;IACH,2BAbW,MAAM,aACN,MAAM,GAAC,IAAI,GACT;QAAE,MAAM,EAAE,QAAQ,GAAC,MAAM,GAAC,SAAS,CAAC;QAAC,eAAe,EAAE,MAAM,GAAC,IAAI,CAAC;QAC5E,eAAe,EAAE,MAAM,GAAC,IAAI,CAAA;KAAE,CAgDhC;IAED;;;;;OAKG;IACH,gCAJW,MAAM,GACJ,MAAM,GAAC,IAAI,CAevB;IAED;;;;;OAKG;IACH,gCAJW,MAAM,GACJ,GAAC,CAkBb;IAED;;;;;OAKG;IACH,gCAJW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAKzB;IAED;;;;;OAKG;IACH,+BAJW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAKzB;IAED;;;;;;OAMG;IACH,0BALW,MAAM,WACN,MAAM,GACJ,OAAO,CAMnB;IAED;;;;OAIG;IACH,yBAHa,MAAM,CAkBlB;IAED;;;;;OAKG;IACH,iCAJW,MAAM,GACJ,GAAG,CAAC,MAAM,CAAC,GAAC,IAAI,CAS5B;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,4BA3BW,MAAM,YACN,MAAM,QACN,MAAM,+BAEd;QAAyB,aAAa;QAGZ,OAAO;KACjC,GAAU,IAAI,CA4DhB;IA+BD;;;;;;;;;;;;;;;OAeG;IACH,uCAdW,MAAM,GACJ,GAAG,CAAC,MAAM,EAAE;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,UAAU,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;QAAC,iBAAiB,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,CAAC,CAiCjK;IAED;;;;;;;;;;;;OAYG;IACH,8BAVW,MAAM,WACN,MAAM,YACN;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;QAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,GAExI,IAAI,CAehB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,kCA1BW,MAAM,YACN,MAAM,GACJ;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,UAAU,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;QAAC,iBAAiB,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,GAAC,SAAS,CAmC9J;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,qCA5BW,MAAM,YACN,MAAM,QACN,MAAM,gBACN,GAAG,CAAC,MAAM,EAAE;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAC,CAAC,2BAI9D,IAAI,CAmEhB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,wCA3BW,MAAM,gBACN,GAAG,CAAC,MAAM,EAAE;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,CAAC,GAGpF,IAAI,CAgChB;IAED;;;OAGG;IACH,qBAOC;IAED;;;;OAIG;IACH,sBAHa,MAAM,CAQlB;IAED;;;;OAIG;IACH,0BAHW,MAAM,QAgBhB;;CACD;;;;;;;;aAhvCa,MAAM,EAAE;;;;gBACR,MAAM,EAAE;;8BA3KQ,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/slothlet.d.mts.map b/types/src/slothlet.d.mts.map
index b01483963..a2042b6b2 100644
--- a/types/src/slothlet.d.mts.map
+++ b/types/src/slothlet.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"slothlet.d.mts","sourceRoot":"","sources":["../../src/slothlet.mjs"],"names":[],"mappings":"AA67CA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,yBApCuB,CAAC,SAAX,MAAQ,6DAGV,eAAe,GACb,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,CAsCpC;;kBASS,QAAQ,CAAC;QAAC,QAAQ,EAAE,aAAa,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAC,CAAC,CAAC;QAAC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;KAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAgD3F,SAAS,GAAC,MAAM;;;;;;;;;;;;qBAEP,MAAM;iBAAO,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA8BhB,MAAM;eAAS,CAAC,QAAQ,GAAC,SAAS,GAAC,UAAU,GAAC,SAAS,CAAC;oBAAc,OAAO;gBAAU,CAAC,OAAO,GAAC,OAAO,CAAC;kBAAY,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAevI,KAAK,CAAC;YAAC,IAAI,EAAC,MAAM,CAAC;YAAA,IAAI,EAAC,MAAM,CAAC;YAAA,QAAQ,EAAC,MAAM,CAAA;SAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aA8BxD,MAAY,IAAI;;;;cAChB,MAAY,IAAI;;;;cAE3B;QAAgE,GAAG,EAAxD,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAC,SAAS,CAAC,CAAC;QACzB,GAAG,EAC/B;YAAkC,GAAG;YACH,MAAM;YACN,MAAM;YACN,MAAM;YACR,OAAO,EACvC;gBAA0C,QAAQ;gBACR,IAAI;gBACJ,SAAS;gBACT,UAAU;gBACV,YAAY;gBACZ,aAAa;gBACb,iBAAiB;gBACjB,mBAAmB;gBACnB,cAAc;aACxD;SAAA;QAA4B,OAAO,EACnC;YAAsC,GAAG;YACO,OAAO,EAA5C,MAAY,MAAM;YACS,GAAG;YACH,KAAK;YACL,GAAG;SACzC;QAA6B,IAAI;;;;;;;;6BAEV,MAAM;;;;yCACN,MAAM,EAAE;;;;;;;;;;;;;;;;;4BAIR,MAAM;;;;kCACN,MAAM;;;;;;;;6BAEN,MAAM;;;;;;;;;;;;;;;;;qCAIN,eAAe;;QACV,IAAI,EAChC;YAAmC,KAAK;YACL,OAAO;YACP,cAAc;YACd,MAAM;YACN,aAAa;YACb,IAAI;YACJ,GAAG;YACH,EAAE;YACJ,GAAG,EACpC;gBAAsC,OAAO,EAAlC,OAAO;gBACqB,MAAM;gBACN,OAAO;aAC9C;YAAmC,MAAM;YACN,kBAAkB;SACrD;QAA4B,KAAK,EACjC;YAAoC,EAAE;YACF,IAAI;YACJ,GAAG;YACH,IAAI;YACJ,YAAY;YACd,KAAK,EACvC;gBAA0C,GAAG;gBACH,MAAM;aAChD;YAAoC,QAAQ;YACR,OAAO;SAC3C;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,EAAE;SAC1C;QAA4B,WAAW,EACvC;YAAoD,GAAG,EAA5C,MAAY,MAAM;YACY,YAAY,EAA1C,OAAO;YAC0C,IAAI,EAArD,MAAY,OAAO,CAAE,IAAI,CAAC;SACrC;QAA4B,QAAQ,EACpC;YAAsD,MAAM,EAAjD,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,MAAM;YACN,SAAS;YACM,IAAI,EAA/C,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,SAAS;SAChD;QAA4B,KAAK,EACjC;YAAoC,GAAG;SACvC;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,UAAU;SAClD;QAA4B,WAAW,EACvC;YAAwC,OAAO,EAC/C;gBAAiD,OAAO,EAA7C,OAAO;gBACwC,MAAM,EAArD,MAAY,IAAI;gBAC+B,OAAO,EAAtD,MAAY,IAAI;gBACsB,iBAAiB,EAAvD,OAAO;gBAC+C,UAAU,EAAhE,CAAS,IAAO,EAAP,OAAO,KAAG,IAAI;gBACwB,IAAI,EAAnD,MAAY,IAAI;gBACsB,MAAM,EAA5C,OAAO;aAClB;SAAA;QAA4B,UAAU,EACtC;YAAyC,IAAI;YACJ,UAAU;YACV,UAAU;YACV,kBAAkB;YAClB,kBAAkB;SAC3D;QAA8B,UAAU;QACV,IAAI;QACL,SAAS;QACR,MAAM;QACN,GAAG;QACH,KAAK;QACa,QAAQ,EAA7C,MAAY,OAAO,CAAE,IAAI,CAAC;KACvC;;gCAvoD6D,wBAAwB"}
\ No newline at end of file
+{"version":3,"file":"slothlet.d.mts","sourceRoot":"","sources":["../../src/slothlet.mjs"],"names":[],"mappings":"AAq8CA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,yBApCuB,CAAC,SAAX,MAAQ,6DAGV,eAAe,GACb,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,CAsCpC;;kBASS,QAAQ,CAAC;QAAC,QAAQ,EAAE,aAAa,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAC,CAAC,CAAC;QAAC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;KAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAgD3F,SAAS,GAAC,MAAM;;;;;;;;;;;;qBAEP,MAAM;iBAAO,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA8BhB,MAAM;eAAS,CAAC,QAAQ,GAAC,SAAS,GAAC,UAAU,GAAC,SAAS,CAAC;oBAAc,OAAO;gBAAU,CAAC,OAAO,GAAC,OAAO,CAAC;kBAAY,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAevI,KAAK,CAAC;YAAC,IAAI,EAAC,MAAM,CAAC;YAAA,IAAI,EAAC,MAAM,CAAC;YAAA,QAAQ,EAAC,MAAM,CAAA;SAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aA8BxD,MAAY,IAAI;;;;cAChB,MAAY,IAAI;;;;cAE3B;QAAgE,GAAG,EAAxD,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAC,SAAS,CAAC,CAAC;QACzB,GAAG,EAC/B;YAAkC,GAAG;YACH,MAAM;YACN,MAAM;YACN,MAAM;YACR,OAAO,EACvC;gBAA0C,QAAQ;gBACR,IAAI;gBACJ,SAAS;gBACT,UAAU;gBACV,YAAY;gBACZ,aAAa;gBACb,iBAAiB;gBACjB,mBAAmB;gBACnB,cAAc;aACxD;SAAA;QAA4B,OAAO,EACnC;YAAsC,GAAG;YACO,OAAO,EAA5C,MAAY,MAAM;YACS,GAAG;YACH,KAAK;YACL,GAAG;SACzC;QAA6B,IAAI;;;;;;;;6BAEV,MAAM;;;;yCACN,MAAM,EAAE;;;;;;;;;;;;;;;;;4BAIR,MAAM;;;;kCACN,MAAM;;;;;;;;6BAEN,MAAM;;;;;;;;;;;;;;;;;qCAIN,eAAe;;QACV,IAAI,EAChC;YAAmC,KAAK;YACL,OAAO;YACP,cAAc;YACd,MAAM;YACN,aAAa;YACb,IAAI;YACJ,GAAG;YACH,EAAE;YACJ,GAAG,EACpC;gBAAsC,OAAO,EAAlC,OAAO;gBACqB,MAAM;gBACN,OAAO;aAC9C;YAAmC,MAAM;YACN,kBAAkB;SACrD;QAA4B,KAAK,EACjC;YAAoC,EAAE;YACF,IAAI;YACJ,GAAG;YACH,IAAI;YACJ,YAAY;YACd,KAAK,EACvC;gBAA0C,GAAG;gBACH,MAAM;aAChD;YAAoC,QAAQ;YACR,OAAO;SAC3C;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,EAAE;SAC1C;QAA4B,WAAW,EACvC;YAAoD,GAAG,EAA5C,MAAY,MAAM;YACY,YAAY,EAA1C,OAAO;YAC0C,IAAI,EAArD,MAAY,OAAO,CAAE,IAAI,CAAC;SACrC;QAA4B,QAAQ,EACpC;YAAsD,MAAM,EAAjD,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,MAAM;YACN,SAAS;YACM,IAAI,EAA/C,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,SAAS;SAChD;QAA4B,KAAK,EACjC;YAAoC,GAAG;SACvC;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,UAAU;SAClD;QAA4B,WAAW,EACvC;YAAwC,OAAO,EAC/C;gBAAiD,OAAO,EAA7C,OAAO;gBACwC,MAAM,EAArD,MAAY,IAAI;gBAC+B,OAAO,EAAtD,MAAY,IAAI;gBACsB,iBAAiB,EAAvD,OAAO;gBAC+C,UAAU,EAAhE,CAAS,IAAO,EAAP,OAAO,KAAG,IAAI;gBACwB,IAAI,EAAnD,MAAY,IAAI;gBACsB,MAAM,EAA5C,OAAO;aAClB;SAAA;QAA4B,UAAU,EACtC;YAAyC,IAAI;YACJ,UAAU;YACV,UAAU;YACV,kBAAkB;YAClB,kBAAkB;SAC3D;QAA8B,UAAU;QACV,IAAI;QACL,SAAS;QACR,MAAM;QACN,GAAG;QACH,KAAK;QACa,QAAQ,EAA7C,MAAY,OAAO,CAAE,IAAI,CAAC;KACvC;;gCA/oD6D,wBAAwB"}
\ No newline at end of file

From 287e43bb0dca9b06180c13cd71ccbadcb24f63ee Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 30 Sep 2026 01:05:34 +0000
Subject: [PATCH 32/49] deps: bump vitest from 5.0.1 to 5.0.2 in the vitest
 group

Bumps the vitest group with 1 update: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest).


Updates `vitest` from 5.0.1 to 5.0.2
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.2/packages/vitest)

---
updated-dependencies:
- dependency-name: vitest
  dependency-version: 5.0.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: vitest
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 package-lock.json | 130 ++++++++++++++++++++--------------------------
 1 file changed, 56 insertions(+), 74 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 41088894f..842446f4e 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1547,16 +1547,16 @@
 			"license": "MIT"
 		},
 		"node_modules/@vitest/browser": {
-			"version": "5.0.1",
-			"resolved": "https://registry.npmjs.org/@vitest/browser/-/browser-5.0.1.tgz",
-			"integrity": "sha512-s2UroEhP2BZPoen1qrXXTtVqnUcs6y2sxMLGCZ8tZDkH2iM/6tTC2GVTPCgF+oVF3X5M6wC/X2O0MvvoHNmH0Q==",
+			"version": "5.0.2",
+			"resolved": "https://registry.npmjs.org/@vitest/browser/-/browser-5.0.2.tgz",
+			"integrity": "sha512-nX9xXZ/j8YfU7KTeFa+tpSP331SbI81qBQTASRlcopYeaTgBerNmJryzHXHrFOW0NYldd3Dn5gw651zGnmaQzw==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
 				"@blazediff/core": "1.10.0",
-				"@vitest/mocker": "5.0.1",
-				"@vitest/ui": "5.0.1",
-				"@vitest/utils": "5.0.1",
+				"@vitest/mocker": "5.0.2",
+				"@vitest/ui": "5.0.2",
+				"@vitest/utils": "5.0.2",
 				"magic-string": "^1.2.3",
 				"pngjs": "^7.0.0",
 				"sirv": "^3.0.2",
@@ -1567,18 +1567,18 @@
 				"url": "https://opencollective.com/vitest"
 			},
 			"peerDependencies": {
-				"vitest": "5.0.1"
+				"vitest": "5.0.2"
 			}
 		},
 		"node_modules/@vitest/browser-playwright": {
-			"version": "5.0.1",
-			"resolved": "https://registry.npmjs.org/@vitest/browser-playwright/-/browser-playwright-5.0.1.tgz",
-			"integrity": "sha512-BlknN81ZeoCyP5CSm5u7+1BTlS7d0cDU5DfndNSjEC3SmbzOESGrp+DQpNhQmTlggawWc+yKVEM03mM/aBynqg==",
+			"version": "5.0.2",
+			"resolved": "https://registry.npmjs.org/@vitest/browser-playwright/-/browser-playwright-5.0.2.tgz",
+			"integrity": "sha512-wU0B1Zy9+a55fdUT7JBCcnnjpTx0HHvUlQT6yFnuwCSY244BkPPwabNX+9PAljc96gRELcfm5APtnsn/3qiaPw==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
-				"@vitest/browser": "5.0.1",
-				"@vitest/mocker": "5.0.1",
+				"@vitest/browser": "5.0.2",
+				"@vitest/mocker": "5.0.2",
 				"tinyrainbow": "^3.1.1"
 			},
 			"funding": {
@@ -1586,7 +1586,7 @@
 			},
 			"peerDependencies": {
 				"playwright": "*",
-				"vitest": "5.0.1"
+				"vitest": "5.0.2"
 			},
 			"peerDependenciesMeta": {
 				"playwright": {
@@ -1595,9 +1595,9 @@
 			}
 		},
 		"node_modules/@vitest/coverage-v8": {
-			"version": "5.0.1",
-			"resolved": "https://registry.npmjs.org/@vitest/coverage-v8/-/coverage-v8-5.0.1.tgz",
-			"integrity": "sha512-FRC8ACiudC3dI6MTplzRSYWHDRnIv2IPfbzs4FdoJNsMal/35sWV8hwIfV8ZcqzSPy+uXHeMVONt9CEqtOU17w==",
+			"version": "5.0.2",
+			"resolved": "https://registry.npmjs.org/@vitest/coverage-v8/-/coverage-v8-5.0.2.tgz",
+			"integrity": "sha512-3ffHBEi8DOOBLwIGBhOBZbRfYFYWjMUuxZicONdhuFEFEG5AVsMOSrVeuROskqnqpbOmEJwxM2eTVZ9N3a1t+A==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
@@ -1614,8 +1614,8 @@
 				"url": "https://opencollective.com/vitest"
 			},
 			"peerDependencies": {
-				"@vitest/browser": "5.0.1",
-				"vitest": "5.0.1"
+				"@vitest/browser": "5.0.2",
+				"vitest": "5.0.2"
 			},
 			"peerDependenciesMeta": {
 				"@vitest/browser": {
@@ -1647,14 +1647,14 @@
 			}
 		},
 		"node_modules/@vitest/mocker": {
-			"version": "5.0.1",
-			"resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-5.0.1.tgz",
-			"integrity": "sha512-6K1DoBNAPGvuOcSsGA4D6x+5zEEff/KmOOP3uetT2TrGpVfI+HRHRnJJfKi5ib/g1vx8IYHQD8s0pbJz8WQI7Q==",
+			"version": "5.0.2",
+			"resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-5.0.2.tgz",
+			"integrity": "sha512-Z5FS00Q1SJHkB35xATsmWGdQ5WA1/0MV3CDjqyv7GavHv1OfOj145MNfHOlHk7QLes21dKFDHr8EO2zvL+9WGA==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
 				"@jridgewell/trace-mapping": "0.3.31",
-				"@vitest/spy": "5.0.1",
+				"@vitest/spy": "5.0.2",
 				"estree-walker": "^3.0.3",
 				"magic-string": "^1.2.3"
 			},
@@ -1675,9 +1675,9 @@
 			}
 		},
 		"node_modules/@vitest/pretty-format": {
-			"version": "5.0.1",
-			"resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-5.0.1.tgz",
-			"integrity": "sha512-6guWwj5d9bguuefTOvJoq387tfpkzSv554YdUEGzjJH2PnnmvzTLQ1UQSuAk5wBFVhf2CUmy/S/palOcb6dmpA==",
+			"version": "5.0.2",
+			"resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-5.0.2.tgz",
+			"integrity": "sha512-YHM+mQQ7N1ROHMugJ7P/M+fC/q1G4zs/iAMZZCvhHcY8WkwPQcXBHD+z18oz+808Cfa12K7jOr3XPQMcLIovjw==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
@@ -1688,9 +1688,9 @@
 			}
 		},
 		"node_modules/@vitest/spy": {
-			"version": "5.0.1",
-			"resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-5.0.1.tgz",
-			"integrity": "sha512-rbto/mF/SGERxEgYOek7Xm6B9b+y+mVoo+f4b2LymYO8zM1b7uB5nHuhVMTP2hxdzgxvGiZYGxGIaMvL5y180Q==",
+			"version": "5.0.2",
+			"resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-5.0.2.tgz",
+			"integrity": "sha512-Ijc7T1nT9efNb5LxvjaBrEqw3f/QwUv5EE0nKqZxgqsaV/FxAAZ8baGylA8X/Z2oS4Lp+K74Jr6dTJsDKxJDeg==",
 			"dev": true,
 			"license": "MIT",
 			"funding": {
@@ -1698,13 +1698,13 @@
 			}
 		},
 		"node_modules/@vitest/ui": {
-			"version": "5.0.1",
-			"resolved": "https://registry.npmjs.org/@vitest/ui/-/ui-5.0.1.tgz",
-			"integrity": "sha512-7PvQu/X9/pQoHYfNLAYL22qsD4/+sx2k7zpUA7XvjW0sc40r3/r0lGZ2fsEyOHMuO8Q1KjiO1QQVjJdnWUy/WQ==",
+			"version": "5.0.2",
+			"resolved": "https://registry.npmjs.org/@vitest/ui/-/ui-5.0.2.tgz",
+			"integrity": "sha512-FRGWhLK/S+aaAtty/5d+jTtY5l+9pGNcjz6IHbyUiP3VWs6a+zIgU4lc1SzWCR7H+OXgetAI06i/VpCWQmVorQ==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
-				"@vitest/utils": "5.0.1",
+				"@vitest/utils": "5.0.2",
 				"fflate": "^0.8.3",
 				"flatted": "^3.4.4",
 				"pathe": "^2.0.3",
@@ -1715,17 +1715,17 @@
 				"url": "https://opencollective.com/vitest"
 			},
 			"peerDependencies": {
-				"vitest": "5.0.1"
+				"vitest": "5.0.2"
 			}
 		},
 		"node_modules/@vitest/utils": {
-			"version": "5.0.1",
-			"resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-5.0.1.tgz",
-			"integrity": "sha512-E9+yEA+jsfaoxZcUHFzEqUrQcoNh2EwrPT5efIqkUPUwD5Ua2Li9BRWaYeRwvzvdLgTSVrre8oKNeyrfg7KkdQ==",
+			"version": "5.0.2",
+			"resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-5.0.2.tgz",
+			"integrity": "sha512-mgpUtxFhKeOKVaArBVHNJGdYHAeRh135o59l13uVmPUCS1OUtis5pBqXEgE25iqRgFqEBwXvJlkhknRsYnMeqg==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
-				"@vitest/pretty-format": "5.0.1",
+				"@vitest/pretty-format": "5.0.2",
 				"convert-source-map": "^2.0.0",
 				"tinyrainbow": "^3.1.1"
 			},
@@ -5245,13 +5245,6 @@
 				"node": ">=18"
 			}
 		},
-		"node_modules/siginfo": {
-			"version": "2.0.0",
-			"resolved": "https://registry.npmjs.org/siginfo/-/siginfo-2.0.0.tgz",
-			"integrity": "sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==",
-			"dev": true,
-			"license": "ISC"
-		},
 		"node_modules/signal-exit": {
 			"version": "3.0.7",
 			"resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
@@ -5316,13 +5309,6 @@
 				"node": ">=0.10.0"
 			}
 		},
-		"node_modules/stackback": {
-			"version": "0.0.2",
-			"resolved": "https://registry.npmjs.org/stackback/-/stackback-0.0.2.tgz",
-			"integrity": "sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==",
-			"dev": true,
-			"license": "MIT"
-		},
 		"node_modules/std-env": {
 			"version": "4.2.0",
 			"resolved": "https://registry.npmjs.org/std-env/-/std-env-4.2.0.tgz",
@@ -5753,14 +5739,14 @@
 			}
 		},
 		"node_modules/vitest": {
-			"version": "5.0.1",
-			"resolved": "https://registry.npmjs.org/vitest/-/vitest-5.0.1.tgz",
-			"integrity": "sha512-iA95lQbKEkvrtTkdAgnWbXfbipWiiWe/hDl2P5tMi6WFwD76G0NxXAGp/M9EOcYupeGJRr6wppMc7CoA41TQjg==",
+			"version": "5.0.2",
+			"resolved": "https://registry.npmjs.org/vitest/-/vitest-5.0.2.tgz",
+			"integrity": "sha512-7MQrx9pDv5aHiUcovIb/70Ys3tgtkUVgCtledvKdCmEO+/1Dicq5ZqoSxOW034m03oqC+oHOKui2dM6qtMLoJg==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
 				"@types/chai": "^5.2.2",
-				"@vitest/mocker": "5.0.1",
+				"@vitest/mocker": "5.0.2",
 				"chai": "^6.2.2",
 				"es-module-lexer": "^2.3.2",
 				"expect-type": "^1.4.0",
@@ -5768,10 +5754,10 @@
 				"obug": "^2.1.4",
 				"picomatch": "^4.0.7",
 				"std-env": "^4.2.0",
-				"tinybench": "6.1.4",
-				"tinyexec": "1.3.0",
+				"tinybench": "^6.1.4",
+				"tinyexec": "^1.3.0",
 				"tinyglobby": "^0.2.17",
-				"why-is-node-running": "^2.3.0"
+				"why-is-node-running": "^3.2.1"
 			},
 			"bin": {
 				"vitest": "vitest.mjs"
@@ -5786,12 +5772,12 @@
 				"@edge-runtime/vm": "*",
 				"@opentelemetry/api": "^1.9.0",
 				"@types/node": "^22.0.0 || >=24.0.0",
-				"@vitest/browser-playwright": "5.0.1",
-				"@vitest/browser-preview": "5.0.1",
+				"@vitest/browser-playwright": "5.0.2",
+				"@vitest/browser-preview": "5.0.2",
 				"@vitest/browser-webdriverio": "^5.0.0-beta.5 || >=5.0.0",
-				"@vitest/coverage-istanbul": "5.0.1",
-				"@vitest/coverage-v8": "5.0.1",
-				"@vitest/ui": "5.0.1",
+				"@vitest/coverage-istanbul": "5.0.2",
+				"@vitest/coverage-v8": "5.0.2",
+				"@vitest/ui": "5.0.2",
 				"happy-dom": "*",
 				"jsdom": "*",
 				"vite": "^6.4.0 || ^7.0.0 || ^8.0.0"
@@ -5883,20 +5869,16 @@
 			}
 		},
 		"node_modules/why-is-node-running": {
-			"version": "2.3.0",
-			"resolved": "https://registry.npmjs.org/why-is-node-running/-/why-is-node-running-2.3.0.tgz",
-			"integrity": "sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w==",
+			"version": "3.2.2",
+			"resolved": "https://registry.npmjs.org/why-is-node-running/-/why-is-node-running-3.2.2.tgz",
+			"integrity": "sha512-NKUzAelcoCXhXL4dJzKIwXeR8iEVqsA0Lq6Vnd0UXvgaKbzVo4ZTHROF2Jidrv+SgxOQ03fMinnNhzZATxOD3A==",
 			"dev": true,
 			"license": "MIT",
-			"dependencies": {
-				"siginfo": "^2.0.0",
-				"stackback": "0.0.2"
-			},
 			"bin": {
 				"why-is-node-running": "cli.js"
 			},
 			"engines": {
-				"node": ">=8"
+				"node": ">=20.11"
 			}
 		},
 		"node_modules/word-wrap": {
@@ -5934,9 +5916,9 @@
 			"license": "ISC"
 		},
 		"node_modules/ws": {
-			"version": "8.21.3",
-			"resolved": "https://registry.npmjs.org/ws/-/ws-8.21.3.tgz",
-			"integrity": "sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw==",
+			"version": "8.22.0",
+			"resolved": "https://registry.npmjs.org/ws/-/ws-8.22.0.tgz",
+			"integrity": "sha512-Ydggc987+RO0AnWtZ/7Wq9FtNvcrL1b/RO0ud9mWjUPgDrsAAwQSF51sm2hm1XofbU/4jkpGEsLFsZZxU+1DOg==",
 			"dev": true,
 			"license": "MIT",
 			"engines": {

From 2341ca3f367225bea470a626e1b2b32fc3ad35ed Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 30 Sep 2026 01:05:41 +0000
Subject: [PATCH 33/49] deps: bump prettier from 3.9.8 to 3.9.9 in the prettier
 group

Bumps the prettier group with 1 update: [prettier](https://github.com/prettier/prettier).


Updates `prettier` from 3.9.8 to 3.9.9
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.9.8...3.9.9)

---
updated-dependencies:
- dependency-name: prettier
  dependency-version: 3.9.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: prettier
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 41088894f..82e27552d 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -4971,9 +4971,9 @@
 			}
 		},
 		"node_modules/prettier": {
-			"version": "3.9.8",
-			"resolved": "https://registry.npmjs.org/prettier/-/prettier-3.9.8.tgz",
-			"integrity": "sha512-WRFq3Wn3WId7LLROfMLdH7xaFr2jR62wU8nLO6rQUOLOxNZUviyJQs1M0iIhLexSFy+L+w0ch66wtoO2jRjG0A==",
+			"version": "3.9.9",
+			"resolved": "https://registry.npmjs.org/prettier/-/prettier-3.9.9.tgz",
+			"integrity": "sha512-Z/CJHIkdujO/OtN7nXUii0Rf3VT5SRuhjBA82Xvu2XhBUgX3nhP67T0LHceBdQLex7OOFGTox+Q5Yg8Jk2Qivg==",
 			"dev": true,
 			"license": "MIT",
 			"bin": {

From 562094ee5de0a9c0279c3127e78fd08ec72b47b0 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 30 Sep 2026 01:09:51 +0000
Subject: [PATCH 34/49] deps: bump @types/node in the patch group across 1
 directory

Bumps the patch group with 1 update in the / directory: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node).


Updates `@types/node` from 26.6.2 to 26.6.3
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 26.6.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 614917ee5..63d4f0476 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1530,9 +1530,9 @@
 			"license": "MIT"
 		},
 		"node_modules/@types/node": {
-			"version": "26.6.2",
-			"resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.2.tgz",
-			"integrity": "sha512-X1P21scMv4zGKLYqjdGjaKa7COa0RKVYYZZN/NfvLQ1JegxFhdhpZG/Lyn8AXx6CDUavKAd11v6BvfpkDByK8g==",
+			"version": "26.6.3",
+			"resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.3.tgz",
+			"integrity": "sha512-dsqMQQoeTLqu9wynDD00q573mNzso3IdQOAfHRJqLCcmCFPoGo9A1bDpUcv/9tnKpErQWv9uKeGfl37EIS02Yg==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {

From c5fa0c8fd10213a52fa4e04aae5e1c5e07156cd0 Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Mon, 28 Sep 2026 22:40:10 -0700
Subject: [PATCH 35/49] fix(loader): give every relative helper a leaf imports
 the leaf's instance

A module a leaf imports through a relative or file: specifier is now
evaluated once per slothlet instance instead of once per process, for
.mjs, .ts and .cjs leaves. A full reload gives every helper a fresh
copy; a partial reload keeps the instance's existing copy.

Helper isolation uses the in-thread module.registerHooks() resolve hook,
so engines.node rises from >=22.12.0 to >=22.15.0. The off-thread
module.register() is not used: it slows every import in the process and
reorders evaluation enough to break leaves that start a fire-and-forget
runtime import.

Fixes #518
---
 .configs/vitest.config.mjs                    |  12 +-
 .github/workflows/ci.yml                      |   6 +-
 .github/workflows/publish.yml                 |   6 +-
 README.md                                     |   2 +-
 .../api/cjsleaf/cjsleaf.cjs                   |  35 +++
 .../api/cjspeer/cjspeer.cjs                   |  29 ++
 .../api_test_helper_imports/api/peer/peer.mjs |  27 ++
 .../api/shared/shared.mjs                     |  38 +++
 .../api/tally/__lib/nested.mjs                |  27 ++
 .../api/tally/tally.mjs                       |  43 +++
 .../api/tsleaf/tsleaf.ts                      |  23 ++
 .../lib/chain/level1.mjs                      |  27 ++
 .../lib/chain/level2.mjs                      |  27 ++
 .../api_test_helper_imports/lib/cjs-inner.cjs |  29 ++
 .../api_test_helper_imports/lib/cjs-state.cjs |  38 +++
 .../api_test_helper_imports/lib/state.mjs     |  38 +++
 .../api_test_helper_imports/lib/ts-helper.ts  |  14 +
 .../mount/cjsextra/cjsextra.cjs               |  29 ++
 .../mount/extra/extra.mjs                     |  27 ++
 .../api_test_helper_imports/native-probe.mjs  |  68 +++++
 docs/MODULE-STRUCTURE.md                      |  52 ++++
 docs/RELOAD.md                                |   6 +-
 docs/TESTING.md                               |  21 ++
 docs/TYPESCRIPT.md                            |   2 +-
 docs/generated/API.md                         |  38 +++
 package-lock.json                             |   2 +-
 package.json                                  |   2 +-
 src/lib/helpers/instance-imports.mjs          | 288 ++++++++++++++++++
 src/lib/processors/loader.mjs                 |  87 +++++-
 src/slothlet.mjs                              |   5 +
 tests/vitests/setup/vitest-helper.mjs         |   2 +
 .../helpers/instance-imports.test.vitest.mjs  | 190 ++++++++++++
 ...elper-imports-per-instance.test.vitest.mjs | 286 +++++++++++++++++
 types/src/lib/helpers/instance-imports.d.mts  | 144 +++++++++
 .../lib/helpers/instance-imports.d.mts.map    |   1 +
 types/src/lib/processors/loader.d.mts.map     |   2 +-
 types/src/slothlet.d.mts.map                  |   2 +-
 37 files changed, 1648 insertions(+), 27 deletions(-)
 create mode 100644 api_tests/api_test_helper_imports/api/cjsleaf/cjsleaf.cjs
 create mode 100644 api_tests/api_test_helper_imports/api/cjspeer/cjspeer.cjs
 create mode 100644 api_tests/api_test_helper_imports/api/peer/peer.mjs
 create mode 100644 api_tests/api_test_helper_imports/api/shared/shared.mjs
 create mode 100644 api_tests/api_test_helper_imports/api/tally/__lib/nested.mjs
 create mode 100644 api_tests/api_test_helper_imports/api/tally/tally.mjs
 create mode 100644 api_tests/api_test_helper_imports/api/tsleaf/tsleaf.ts
 create mode 100644 api_tests/api_test_helper_imports/lib/chain/level1.mjs
 create mode 100644 api_tests/api_test_helper_imports/lib/chain/level2.mjs
 create mode 100644 api_tests/api_test_helper_imports/lib/cjs-inner.cjs
 create mode 100644 api_tests/api_test_helper_imports/lib/cjs-state.cjs
 create mode 100644 api_tests/api_test_helper_imports/lib/state.mjs
 create mode 100644 api_tests/api_test_helper_imports/lib/ts-helper.ts
 create mode 100644 api_tests/api_test_helper_imports/mount/cjsextra/cjsextra.cjs
 create mode 100644 api_tests/api_test_helper_imports/mount/extra/extra.mjs
 create mode 100644 api_tests/api_test_helper_imports/native-probe.mjs
 create mode 100644 src/lib/helpers/instance-imports.mjs
 create mode 100644 tests/vitests/suites/helpers/instance-imports.test.vitest.mjs
 create mode 100644 tests/vitests/suites/isolation/helper-imports-per-instance.test.vitest.mjs
 create mode 100644 types/src/lib/helpers/instance-imports.d.mts
 create mode 100644 types/src/lib/helpers/instance-imports.d.mts.map

diff --git a/.configs/vitest.config.mjs b/.configs/vitest.config.mjs
index 3c26f7275..9f98a9fe7 100644
--- a/.configs/vitest.config.mjs
+++ b/.configs/vitest.config.mjs
@@ -15,7 +15,7 @@ import { defineConfig } from "vitest/config";
 import { DefaultReporter } from "vitest/node";
 import { existsSync } from "node:fs";
 import path from "node:path";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
@@ -94,7 +94,17 @@ const workerNodeOptions = useSourceCondition
 	? [`--conditions=${slothletCondition}`, "--import=./tests/vitests/setup/env-preload.mjs"]
 	: ["--import=./tests/vitests/setup/env-preload.mjs"];
 
+// Leaves load through this config's vite module graph (slothlet's source is inlined here, so its
+// `import()` of a leaf is vite's), where Node's resolve hooks never see a leaf's imports. The
+// plugin gives a leaf's relative helpers the leaf's per-instance query inside that graph (#518) —
+// the same step a consumer takes when loading leaves through slothlet's `import` hook.
+// A computed file URL (not a literal specifier) so the config bundler leaves the import to runtime.
+const { slothletInstanceImports } = await import(
+	pathToFileURL(path.resolve(__dirname, srcExists ? "../src" : "../dist", "lib/helpers/instance-imports.mjs")).href
+);
+
 export default defineConfig({
+	plugins: [slothletInstanceImports()],
 	pool: "forks",
 	// pool: "threads",
 	resolve: {
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f0a80cee3..0e0c0e4a1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -54,10 +54,10 @@ on:
                 required: false
                 default: "lts/*"
             min_node_version:
-                description: "Minimum Node.js version for matrix testing (default: 22.12.0 — the floor vitest 5 actually runs on)"
+                description: "Minimum Node.js version for matrix testing (default: 22.15.0 — slothlet's engines floor (in-thread module.registerHooks))"
                 type: string
                 required: false
-                default: "22.12.0"
+                default: "22.15.0"
             max_node_major:
                 description: "Max Node.js major version for the test matrix. Leave blank (the default) to inherit the CLDMV/.github reusable workflow's default; set a value only to pin/override for a specific run."
                 type: string
@@ -220,7 +220,7 @@ jobs:
               .gitignore
             debug: ${{ github.event.inputs.debug == 'true' }}
             node_version: ${{ github.event.inputs.node_version || 'lts/*' }}
-            min_node_version: ${{ github.event.inputs.min_node_version || '22.12.0' }}
+            min_node_version: ${{ github.event.inputs.min_node_version || '22.15.0' }}
             max_node_major: ${{ github.event.inputs.max_node_major || '' }} # blank ⇒ inherit the CLDMV/.github reusable default
             # LTS-only matrix (even majors: 20, 22, 24, …) on every event. Odd majors
             # (21, 23, …) are non-LTS interim releases, and the native-binding test
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index e5cefa69d..8e11a837c 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -60,10 +60,10 @@ on:
                 required: false
                 default: true
             min_node_version:
-                description: "Minimum Node.js version for matrix testing (enables matrix when set; default: 22.12.0 — the floor vitest 5 actually runs on)"
+                description: "Minimum Node.js version for matrix testing (enables matrix when set; default: 22.15.0 — slothlet's engines floor (in-thread module.registerHooks))"
                 type: string
                 required: false
-                default: "22.12.0"
+                default: "22.15.0"
             max_node_major:
                 description: "Max Node.js major version for the test matrix. Leave blank (the default) to inherit the CLDMV/.github reusable workflow's default; set a value only to pin/override for a specific run."
                 type: string
@@ -104,7 +104,7 @@ jobs:
             publish_to_github_packages: ${{ github.event.inputs.publish_to_github_packages != 'false' }}
             publish_command: ""
             github_packages_publish_command: ""
-            min_node_version: ${{ github.event.inputs.min_node_version || '22.12.0' }}
+            min_node_version: ${{ github.event.inputs.min_node_version || '22.15.0' }}
             max_node_major: ${{ github.event.inputs.max_node_major || '' }} # blank ⇒ inherit the CLDMV/.github reusable default
             test_command: "npm test" # Use defaults: NODE_ENV=development, NODE_OPTIONS=--conditions=development
             # test_command: "NODE_OPTIONS='--conditions=slothlet-dev' npm test"  # Override NODE_OPTIONS only
diff --git a/README.md b/README.md
index 6f05637aa..ed1f19549 100644
--- a/README.md
+++ b/README.md
@@ -166,7 +166,7 @@ Run slothlet in the browser, web workers, and Electron renderers — anywhere th
 
 ### Requirements
 
-- **Node.js v22.12.0 or higher**
+- **Node.js v22.15.0 or higher**
 
 ### Install
 
diff --git a/api_tests/api_test_helper_imports/api/cjsleaf/cjsleaf.cjs b/api_tests/api_test_helper_imports/api/cjsleaf/cjsleaf.cjs
new file mode 100644
index 000000000..9d5bf47f9
--- /dev/null
+++ b/api_tests/api_test_helper_imports/api/cjsleaf/cjsleaf.cjs
@@ -0,0 +1,35 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_helper_imports/api/cjsleaf/cjsleaf.cjs
+ *	@Date: 2026-09-28 20:29:31 -07:00 (1790652571)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 20:49:46 -07:00 (1790653786)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview CommonJS leaf whose state lives in relatively required helpers (#518).
+ * @module api_test_helper_imports.cjsleaf
+ */
+const state = require("../../lib/cjs-state.cjs");
+
+module.exports = {
+	/**
+	 * Bump the `lib/cjs-state.cjs` counter.
+	 * @returns {number} The counter after incrementing.
+	 */
+	count() {
+		return state.bump();
+	},
+	/**
+	 * Bump the second-level `lib/cjs-inner.cjs` counter.
+	 * @returns {number} The counter after incrementing.
+	 */
+	inner() {
+		return state.innerBump();
+	}
+};
diff --git a/api_tests/api_test_helper_imports/api/cjspeer/cjspeer.cjs b/api_tests/api_test_helper_imports/api/cjspeer/cjspeer.cjs
new file mode 100644
index 000000000..3e9f64f37
--- /dev/null
+++ b/api_tests/api_test_helper_imports/api/cjspeer/cjspeer.cjs
@@ -0,0 +1,29 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_helper_imports/api/cjspeer/cjspeer.cjs
+ *	@Date: 2026-09-28 20:29:31 -07:00 (1790652571)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 20:49:46 -07:00 (1790653786)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Second CommonJS leaf requiring the same helper as `cjsleaf` — within one instance
+ * both must see ONE helper copy (#518).
+ * @module api_test_helper_imports.cjspeer
+ */
+const state = require("../../lib/cjs-state.cjs");
+
+module.exports = {
+	/**
+	 * Bump the `lib/cjs-state.cjs` counter.
+	 * @returns {number} The counter after incrementing.
+	 */
+	count() {
+		return state.bump();
+	}
+};
diff --git a/api_tests/api_test_helper_imports/api/peer/peer.mjs b/api_tests/api_test_helper_imports/api/peer/peer.mjs
new file mode 100644
index 000000000..b8e1c2c52
--- /dev/null
+++ b/api_tests/api_test_helper_imports/api/peer/peer.mjs
@@ -0,0 +1,27 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_helper_imports/api/peer/peer.mjs
+ *	@Date: 2026-09-28 20:29:31 -07:00 (1790652571)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 20:49:47 -07:00 (1790653787)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Second ESM leaf importing the same helper as `tally` — within one instance both
+ * must see ONE helper copy (#518).
+ * @module api_test_helper_imports.peer
+ */
+import { bump } from "../../lib/state.mjs";
+
+/**
+ * Bump the shared `lib/state.mjs` counter.
+ * @returns {number} The counter after incrementing.
+ */
+export function count() {
+	return bump();
+}
diff --git a/api_tests/api_test_helper_imports/api/shared/shared.mjs b/api_tests/api_test_helper_imports/api/shared/shared.mjs
new file mode 100644
index 000000000..cb6d28db2
--- /dev/null
+++ b/api_tests/api_test_helper_imports/api/shared/shared.mjs
@@ -0,0 +1,38 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_helper_imports/api/shared/shared.mjs
+ *	@Date: 2026-09-28 20:29:31 -07:00 (1790652571)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 20:49:47 -07:00 (1790653787)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf importing a bare package specifier, a node builtin and slothlet's own runtime —
+ * all three must stay SHARED across instances, never duplicated per instance (#518).
+ * @module api_test_helper_imports.shared
+ */
+import { self } from "@cldmv/slothlet/runtime";
+import * as runtime from "@cldmv/slothlet/runtime";
+import { EventEmitter } from "node:events";
+import { Parser } from "acorn";
+
+/**
+ * The module objects this leaf imported, for identity comparison across instances.
+ * @returns {{ runtime: object, EventEmitter: Function, Parser: Function }} The imported references.
+ */
+export function refs() {
+	return { runtime, EventEmitter, Parser };
+}
+
+/**
+ * Reach a sibling through the live-binding runtime, proving it serves this instance.
+ * @returns {Promise<number>} The `peer.count()` result.
+ */
+export async function viaSelf() {
+	return self.peer.count();
+}
diff --git a/api_tests/api_test_helper_imports/api/tally/__lib/nested.mjs b/api_tests/api_test_helper_imports/api/tally/__lib/nested.mjs
new file mode 100644
index 000000000..6fc285850
--- /dev/null
+++ b/api_tests/api_test_helper_imports/api/tally/__lib/nested.mjs
@@ -0,0 +1,27 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_helper_imports/api/tally/__lib/nested.mjs
+ *	@Date: 2026-09-28 20:29:31 -07:00 (1790652571)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 20:49:48 -07:00 (1790653788)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Helper inside the api folder, hidden from the scan by its `__` folder (#518).
+ * @module api_test_helper_imports.api.tally.nested
+ * @internal
+ */
+let count = 0;
+
+/**
+ * Increment this module's counter.
+ * @returns {number} The counter after incrementing.
+ */
+export function nestedBump() {
+	return ++count;
+}
diff --git a/api_tests/api_test_helper_imports/api/tally/tally.mjs b/api_tests/api_test_helper_imports/api/tally/tally.mjs
new file mode 100644
index 000000000..9ef90abc1
--- /dev/null
+++ b/api_tests/api_test_helper_imports/api/tally/tally.mjs
@@ -0,0 +1,43 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_helper_imports/api/tally/tally.mjs
+ *	@Date: 2026-09-28 20:29:31 -07:00 (1790652571)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 20:49:48 -07:00 (1790653788)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview ESM leaf whose state lives in relatively imported helpers (#518).
+ * @module api_test_helper_imports.tally
+ */
+import { bump, chainBump } from "../../lib/state.mjs";
+import { nestedBump } from "./__lib/nested.mjs";
+
+/**
+ * Bump the shared `lib/state.mjs` counter.
+ * @returns {number} The counter after incrementing.
+ */
+export function count() {
+	return bump();
+}
+
+/**
+ * Bump the counter at the bottom of the two-level helper chain.
+ * @returns {number} The counter after incrementing.
+ */
+export function chain() {
+	return chainBump();
+}
+
+/**
+ * Bump the helper nested inside the api folder.
+ * @returns {number} The counter after incrementing.
+ */
+export function nested() {
+	return nestedBump();
+}
diff --git a/api_tests/api_test_helper_imports/api/tsleaf/tsleaf.ts b/api_tests/api_test_helper_imports/api/tsleaf/tsleaf.ts
new file mode 100644
index 000000000..d7be3af2c
--- /dev/null
+++ b/api_tests/api_test_helper_imports/api/tsleaf/tsleaf.ts
@@ -0,0 +1,23 @@
+/**
+ * @fileoverview TypeScript leaf importing a `.ts` helper and the SAME `.mjs` helper the ESM leaves
+ * import — within one instance the `.mjs` helper must be one copy across formats (#518).
+ * @module api_test_helper_imports.tsleaf
+ */
+import { tsBump } from "../../lib/ts-helper.ts";
+import { bump } from "../../lib/state.mjs";
+
+/**
+ * Bump the `.ts` helper's counter.
+ * @returns {number} The counter after incrementing.
+ */
+export function tsCount(): number {
+	return tsBump();
+}
+
+/**
+ * Bump the shared `lib/state.mjs` counter.
+ * @returns {number} The counter after incrementing.
+ */
+export function count(): number {
+	return bump();
+}
diff --git a/api_tests/api_test_helper_imports/lib/chain/level1.mjs b/api_tests/api_test_helper_imports/lib/chain/level1.mjs
new file mode 100644
index 000000000..3f2f2827a
--- /dev/null
+++ b/api_tests/api_test_helper_imports/lib/chain/level1.mjs
@@ -0,0 +1,27 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_helper_imports/lib/chain/level1.mjs
+ *	@Date: 2026-09-28 20:29:31 -07:00 (1790652571)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 20:49:48 -07:00 (1790653788)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview First link of a two-level helper chain (#518).
+ * @module api_test_helper_imports.lib.chain.level1
+ * @internal
+ */
+import { level2Bump } from "./level2.mjs";
+
+/**
+ * Forward to the second link.
+ * @returns {number} The level-2 counter after incrementing.
+ */
+export function level1Bump() {
+	return level2Bump();
+}
diff --git a/api_tests/api_test_helper_imports/lib/chain/level2.mjs b/api_tests/api_test_helper_imports/lib/chain/level2.mjs
new file mode 100644
index 000000000..24e863060
--- /dev/null
+++ b/api_tests/api_test_helper_imports/lib/chain/level2.mjs
@@ -0,0 +1,27 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_helper_imports/lib/chain/level2.mjs
+ *	@Date: 2026-09-28 20:29:31 -07:00 (1790652571)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 20:49:49 -07:00 (1790653789)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Second link of a two-level helper chain — holds the state (#518).
+ * @module api_test_helper_imports.lib.chain.level2
+ * @internal
+ */
+let count = 0;
+
+/**
+ * Increment this module's counter.
+ * @returns {number} The counter after incrementing.
+ */
+export function level2Bump() {
+	return ++count;
+}
diff --git a/api_tests/api_test_helper_imports/lib/cjs-inner.cjs b/api_tests/api_test_helper_imports/lib/cjs-inner.cjs
new file mode 100644
index 000000000..685a33c86
--- /dev/null
+++ b/api_tests/api_test_helper_imports/lib/cjs-inner.cjs
@@ -0,0 +1,29 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_helper_imports/lib/cjs-inner.cjs
+ *	@Date: 2026-09-28 20:29:31 -07:00 (1790652571)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 20:49:49 -07:00 (1790653789)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Second-level CommonJS helper (#518).
+ * @module api_test_helper_imports.lib.cjsInner
+ * @internal
+ */
+let count = 0;
+
+module.exports = {
+	/**
+	 * Increment this module's counter.
+	 * @returns {number} The counter after incrementing.
+	 */
+	bump() {
+		return ++count;
+	}
+};
diff --git a/api_tests/api_test_helper_imports/lib/cjs-state.cjs b/api_tests/api_test_helper_imports/lib/cjs-state.cjs
new file mode 100644
index 000000000..33228c07c
--- /dev/null
+++ b/api_tests/api_test_helper_imports/lib/cjs-state.cjs
@@ -0,0 +1,38 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_helper_imports/lib/cjs-state.cjs
+ *	@Date: 2026-09-28 20:29:31 -07:00 (1790652571)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 20:49:49 -07:00 (1790653789)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview CommonJS helper required by the `.cjs` leaves; requires a second-level helper (#518).
+ * @module api_test_helper_imports.lib.cjsState
+ * @internal
+ */
+const inner = require("./cjs-inner.cjs");
+
+let count = 0;
+
+module.exports = {
+	/**
+	 * Increment this module's counter.
+	 * @returns {number} The counter after incrementing.
+	 */
+	bump() {
+		return ++count;
+	},
+	/**
+	 * Increment the second-level helper's counter.
+	 * @returns {number} The counter after incrementing.
+	 */
+	innerBump() {
+		return inner.bump();
+	}
+};
diff --git a/api_tests/api_test_helper_imports/lib/state.mjs b/api_tests/api_test_helper_imports/lib/state.mjs
new file mode 100644
index 000000000..ce2d9d0e4
--- /dev/null
+++ b/api_tests/api_test_helper_imports/lib/state.mjs
@@ -0,0 +1,38 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_helper_imports/lib/state.mjs
+ *	@Date: 2026-09-28 20:29:31 -07:00 (1790652571)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 20:49:49 -07:00 (1790653789)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Module-level counter imported by several leaves, OUTSIDE the api folder (#518).
+ * Imports a two-level helper chain so isolation is proven below the first import.
+ * @module api_test_helper_imports.lib.state
+ * @internal
+ */
+import { level1Bump } from "./chain/level1.mjs";
+
+let count = 0;
+
+/**
+ * Increment this module's counter.
+ * @returns {number} The counter after incrementing.
+ */
+export function bump() {
+	return ++count;
+}
+
+/**
+ * Increment the counter at the bottom of the two-level chain.
+ * @returns {number} The chain counter after incrementing.
+ */
+export function chainBump() {
+	return level1Bump();
+}
diff --git a/api_tests/api_test_helper_imports/lib/ts-helper.ts b/api_tests/api_test_helper_imports/lib/ts-helper.ts
new file mode 100644
index 000000000..82e0a62bc
--- /dev/null
+++ b/api_tests/api_test_helper_imports/lib/ts-helper.ts
@@ -0,0 +1,14 @@
+/**
+ * @fileoverview TypeScript helper imported by the `.ts` leaf (#518).
+ * @module api_test_helper_imports.lib.tsHelper
+ * @internal
+ */
+let count: number = 0;
+
+/**
+ * Increment this module's counter.
+ * @returns {number} The counter after incrementing.
+ */
+export function tsBump(): number {
+	return ++count;
+}
diff --git a/api_tests/api_test_helper_imports/mount/cjsextra/cjsextra.cjs b/api_tests/api_test_helper_imports/mount/cjsextra/cjsextra.cjs
new file mode 100644
index 000000000..9157a8995
--- /dev/null
+++ b/api_tests/api_test_helper_imports/mount/cjsextra/cjsextra.cjs
@@ -0,0 +1,29 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_helper_imports/mount/cjsextra/cjsextra.cjs
+ *	@Date: 2026-09-28 23:11:25 -07:00 (1790662285)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 23:21:40 -07:00 (1790662900)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview CommonJS leaf mounted with `api.slothlet.api.add` that requires the same helper as
+ * the base `.cjs` leaves — within one instance both must see ONE helper copy (#518).
+ * @module api_test_helper_imports.mount.cjsextra
+ */
+const state = require("../../lib/cjs-state.cjs");
+
+module.exports = {
+	/**
+	 * Bump the `lib/cjs-state.cjs` counter.
+	 * @returns {number} The counter after incrementing.
+	 */
+	count() {
+		return state.bump();
+	}
+};
diff --git a/api_tests/api_test_helper_imports/mount/extra/extra.mjs b/api_tests/api_test_helper_imports/mount/extra/extra.mjs
new file mode 100644
index 000000000..39aa03fc7
--- /dev/null
+++ b/api_tests/api_test_helper_imports/mount/extra/extra.mjs
@@ -0,0 +1,27 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_helper_imports/mount/extra/extra.mjs
+ *	@Date: 2026-09-28 23:11:25 -07:00 (1790662285)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 23:21:41 -07:00 (1790662901)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf mounted with `api.slothlet.api.add` that imports the same helper as the base
+ * leaves — within one instance a mounted leaf and a base leaf must see ONE helper copy (#518).
+ * @module api_test_helper_imports.mount.extra
+ */
+import { bump } from "../../lib/state.mjs";
+
+/**
+ * Bump the shared `lib/state.mjs` counter.
+ * @returns {number} The counter after incrementing.
+ */
+export function count() {
+	return bump();
+}
diff --git a/api_tests/api_test_helper_imports/native-probe.mjs b/api_tests/api_test_helper_imports/native-probe.mjs
new file mode 100644
index 000000000..67273de2f
--- /dev/null
+++ b/api_tests/api_test_helper_imports/native-probe.mjs
@@ -0,0 +1,68 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_helper_imports/native-probe.mjs
+ *	@Date: 2026-09-28 20:35:50 -07:00 (1790652950)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 20:49:50 -07:00 (1790653790)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Native-Node probe for #518: composes the helper-imports fixture OUTSIDE any vite
+ * module graph, so the leaves and their helpers load through Node's own resolver and slothlet's
+ * resolve hook. Prints one JSON line of observed counters for the test to assert on.
+ * @module api_test_helper_imports.nativeProbe
+ * @internal
+ */
+import slothlet from "@cldmv/slothlet";
+import * as nodeModule from "node:module";
+
+const base = new URL("./api/", import.meta.url).pathname;
+const mount = new URL("./mount/", import.meta.url).pathname;
+const out = { hookApi: typeof nodeModule.registerHooks === "function" ? "registerHooks" : "register" };
+
+for (const mode of ["eager", "lazy"]) {
+	const r = {};
+	const a = await slothlet({ mode, base, typescript: true, silent: true });
+	const b = await slothlet({ mode, base, typescript: true, silent: true });
+	r.esm = [await a.tally.count(), await a.tally.count(), await b.tally.count()];
+	r.chain = [await a.tally.chain(), await a.tally.chain(), await b.tally.chain()];
+	r.nested = [await a.tally.nested(), await b.tally.nested()];
+	r.peer = [await a.peer.count(), await b.peer.count()];
+	r.cjs = [await a.cjsleaf.count(), await a.cjspeer.count(), await b.cjsleaf.count(), await a.cjsleaf.inner(), await b.cjsleaf.inner()];
+	r.ts = [await a.tsleaf.tsCount(), await a.tsleaf.tsCount(), await b.tsleaf.tsCount(), await a.tsleaf.count(), await b.tsleaf.count()];
+	const refsA = await a.shared.refs();
+	const refsB = await b.shared.refs();
+	r.sharedRefs = refsA.runtime === refsB.runtime && refsA.EventEmitter === refsB.EventEmitter && refsA.Parser === refsB.Parser;
+	r.viaSelf = [await a.shared.viaSelf(), await b.shared.viaSelf()];
+	// An api.add mount shares the base leaves' helper copy within each instance.
+	await a.slothlet.api.add("plugins", mount);
+	await b.slothlet.api.add("plugins", mount);
+	r.mount = [
+		await a.plugins.extra.count(),
+		await b.plugins.extra.count(),
+		await a.plugins.cjsextra.count(),
+		await b.plugins.cjsextra.count()
+	];
+	await a.slothlet.reload();
+	r.afterFullReload = [
+		await a.tally.count(),
+		await a.tally.chain(),
+		await a.cjsleaf.count(),
+		await a.tsleaf.tsCount(),
+		await b.tally.count()
+	];
+	await b.slothlet.api.reload("tally");
+	r.afterScopedReload = [await b.tally.count(), await b.tally.chain(), await a.tally.count()];
+	await b.slothlet.api.reload("plugins");
+	r.afterMountReload = [await b.plugins.extra.count(), await b.tally.count(), await b.plugins.cjsextra.count(), await b.cjsleaf.count()];
+	await a.shutdown();
+	await b.shutdown();
+	out[mode] = r;
+}
+
+process.stdout.write(JSON.stringify(out) + "\n");
diff --git a/docs/MODULE-STRUCTURE.md b/docs/MODULE-STRUCTURE.md
index 5c196c85b..9c0240d8d 100644
--- a/docs/MODULE-STRUCTURE.md
+++ b/docs/MODULE-STRUCTURE.md
@@ -18,6 +18,7 @@ Slothlet's module loader automatically transforms your file structure into a cle
 - [Nested Structure](#nested-structure)
 - [Hidden Entries](#hidden-entries)
 - [Utility Modules](#utility-modules)
+- [Helper Modules Are Per Instance](#helper-modules-are-per-instance)
 - [Smart Function Naming](#smart-function-naming)
 - [TypeScript Modules](#typescript-modules)
 
@@ -461,6 +462,57 @@ api.util.url.builder.buildUrl("https://example.com", "path");
 
 ---
 
+## Helper Modules Are Per Instance
+
+Every slothlet instance loads its own copy of each leaf. The modules a leaf imports through **relative or `file:` specifiers** — at any depth, from `.mjs` / `.js`, `.ts` / `.mts`, or `.cjs` leaves — belong to that same instance: each instance gets its own copy, so module-level state in a helper never leaks from one instance into another.
+
+```text
+project/
+├── lib/
+│   └── state.mjs      let count = 0; export const bump = () => ++count;
+└── api/
+    ├── tally/
+    │   └── tally.mjs  import { bump } from "../../lib/state.mjs"; export const count = () => bump();
+    └── peer/
+        └── peer.mjs   import { bump } from "../../lib/state.mjs"; export const count = () => bump();
+```
+
+```javascript
+const a = await slothlet({ base: "./api" });
+const b = await slothlet({ base: "./api" });
+
+a.tally.count(); // 1
+a.tally.count(); // 2
+a.peer.count(); // 3  — one lib/state.mjs copy shared by every leaf of instance a
+
+await a.slothlet.api.add("plugins", "./plugins"); // a mounted leaf importing ../lib/state.mjs
+a.plugins.extra.count(); // 4  — api.add mounts share the same instance copy
+b.tally.count(); // 1  — instance b has its own copy
+```
+
+A helper is one copy per **instance** — the base leaves and every `api.slothlet.api.add` mount of that instance share it, and it lives as long as the instance ID does:
+
+- **Partial reload** — `api.slothlet.api.reload()`, `api.slothlet.api.reload(path)` or a reload by moduleID re-imports the reloaded leaves, but they link against the instance's **existing** helper copy. Helper state is preserved, and reloaded and untouched leaves keep sharing it.
+- **Full reload** — `api.slothlet.reload()` (or a restart) gives the instance a new ID, and every leaf shares one **fresh** helper copy.
+
+Edits to a helper's code therefore take effect on a full reload, not a partial one. (A TypeScript helper whose source changed is re-transpiled to a new cache file, so it is re-evaluated on a partial reload as well.) See [RELOAD.md → ESM / CJS Cache Busting](RELOAD.md#esm--cjs-cache-busting).
+
+Shared across instances, never duplicated:
+
+- **Bare specifiers** — `node_modules` packages, `node:` builtins, subpath `#imports`, and `@cldmv/slothlet` itself (its runtime, `@cldmv/slothlet/runtime`, stays the single live-binding runtime every instance uses).
+- **Files inside another `node_modules` package**, even when reached by a relative path. A leaf that lives inside an installed package (a plugin mounted from `node_modules`) still gets its own package's relative helpers per instance.
+
+How it works: the loader imports each leaf with a per-instance query (`?slothlet_instance=…`, plus `&module=…` for `api.slothlet.api.add` mounts and `&_reload=…` during a reload). Under Node, a resolve hook slothlet registers once per process copies the instance parameter — not the mount or the reload stamp — onto every relative / `file:` import below the leaf. CommonJS leaves keep a private `require` cache per instance for the files they reach. When leaves load through a vite module graph instead — slothlet's `import` hook or `server.deps.inline` under vitest — add the `slothletInstanceImports()` plugin; see [TESTING.md](TESTING.md#per-instance-helpers-under-vitest-slothletinstanceimports).
+
+Limits of the rule:
+
+- **Helper code edits need a full reload.** A partial reload keeps the instance's helper copy (see above); `api.slothlet.reload({ keepInstanceID: true })` keeps the instance ID and so keeps the helper copy too.
+- **Node 22.15 or later.** Helper isolation uses `module.registerHooks()`, the synchronous in-thread resolve hook added in Node 22.15 / 23.5, so slothlet requires Node 22.15+. It adds no measurable overhead. The off-thread `module.register()` is not used: it puts a cross-thread round trip on every import in the process (roughly 1.5–2× the cost of an uncached import) and changes evaluation timing enough that a leaf starting a fire-and-forget `import("@cldmv/slothlet/runtime")` could be called before the import settles.
+- **Mixed module systems.** An ESM leaf that `import`s a relative `.cjs` helper, and a CommonJS leaf that `require()`s an ES module, cross into a loader cache keyed by file path alone — those modules are shared across instances.
+- Browser mode loads leaves from the manifest without a per-instance query, so neither leaves nor their helpers are per instance there.
+
+---
+
 ## Smart Function Naming
 
 Slothlet preserves function name capitalization for technical acronyms. When a module's exported function name contains an acronym (IP, JSON, HTTP, API, etc.), Slothlet uses the function's own name as the API key rather than deriving it from the filename:
diff --git a/docs/RELOAD.md b/docs/RELOAD.md
index a10aac0d3..2a85a9039 100644
--- a/docs/RELOAD.md
+++ b/docs/RELOAD.md
@@ -329,9 +329,11 @@ Runtime mutations (`api.myProp = ...`) are intentionally cleared on full reload
 
 Slothlet forces fresh module loading on every rebuild rather than serving cached imports:
 
-**CommonJS** (`.cjs`, and `.js` files Node treats as CommonJS): `require.cache` entries for the target directory are deleted before re-importing, and each CommonJS leaf is loaded with its own `require.cache` entry cleared, so every instance and every reload gets a fresh module scope.
+**CommonJS** (`.cjs`, and `.js` files Node treats as CommonJS): each CommonJS leaf is loaded with its own `require.cache` entry cleared, so every instance and every reload gets a fresh module scope. The relative helpers it `require()`s come from a private cache per instance (see below).
 
-**ESM**: A temporary instance ID suffix is appended to the cache-busted import path, causing Node's ESM loader to treat it as a new module specifier and re-execute the file.
+**ESM**: A reload timestamp (`&_reload=…`) is appended to the cache-busted import path, causing Node's ESM loader to treat it as a new module specifier and re-execute the file. Bare package imports are not reloaded.
+
+**Helpers** (relative / `file:` modules a leaf imports or requires) are one copy per instance, not per reload. A partial reload — `api.slothlet.api.reload()`, `api.slothlet.api.reload(path)`, or a reload by moduleID — re-imports the reloaded leaves against the instance's existing helper copy, so helper state is preserved and reloaded leaves keep sharing it with the rest of the instance. A full reload, `api.slothlet.reload()`, rotates the instance ID and gives every leaf one fresh helper copy. **Edits to helper code need a full reload** (a changed TypeScript helper is the exception: it is re-transpiled to a new cache file). See [MODULE-STRUCTURE.md → Helper Modules Are Per Instance](MODULE-STRUCTURE.md#helper-modules-are-per-instance).
 
 This means `reload()` is suitable as a real hot-reload trigger in development workflows - simply editing a source file and calling `reload()` is sufficient.
 
diff --git a/docs/TESTING.md b/docs/TESTING.md
index 099573735..48da6a017 100644
--- a/docs/TESTING.md
+++ b/docs/TESTING.md
@@ -131,6 +131,27 @@ npx c8 --include "api/**" --include "**/.slothlet-cache/**" node app-test.mjs
 
 `--enable-source-maps` is not needed for coverage; it only changes stack traces.
 
+## Per-instance helpers under vitest: `slothletInstanceImports()`
+
+Every relative (or `file:`) module a leaf imports belongs to the leaf's instance: slothlet copies the leaf's instance parameter (`?slothlet_instance=…`) onto those helpers, so module-level state in a helper is never shared between two instances, and a full reload (`api.slothlet.reload()`) gives the instance fresh helpers (see [MODULE-STRUCTURE.md → Helper Modules Are Per Instance](MODULE-STRUCTURE.md#helper-modules-are-per-instance)). Under native Node this happens through a resolve hook slothlet registers itself — nothing to configure.
+
+Both coverage fixes above move leaf loading into **vitest's** module graph, and Node's resolve hooks never see the imports vite resolves. Without a matching vite plugin, a leaf's relative helpers are resolved by vite without the query and become one module shared by every instance in the test run. Add the plugin slothlet ships for this:
+
+```js
+// vitest.config.mjs
+import { defineConfig } from "vitest/config";
+import { slothletInstanceImports } from "@cldmv/slothlet/helpers/instance-imports";
+
+export default defineConfig({
+	plugins: [slothletInstanceImports()],
+	test: {
+		coverage: { provider: "v8", include: ["api/**"] }
+	}
+});
+```
+
+The plugin applies the same rule as the Node hook: only relative / `file:` specifiers imported by a module that carries a slothlet instance query are rewritten; bare packages, `node:` builtins and `@cldmv/slothlet` itself stay shared. A plain test run that leaves slothlet externalized and sets no `import` importer does not need it — the leaves then load natively and the Node hook covers them.
+
 ## Scope
 
 The `.mjs` artifact appears with any setup that externalizes `node_modules` and attributes coverage from the runner's module graph (vitest + the v8 provider). It is independent of eager vs lazy mode and of the `slothlet-dev` condition — the deciding axis is externalized vs inlined, nothing else. The TypeScript requirements (source maps and the cache directory in `include`) apply in every setup, including inlined slothlet and slothlet's own repo.
diff --git a/docs/TYPESCRIPT.md b/docs/TYPESCRIPT.md
index c49d5f571..1feec58d3 100644
--- a/docs/TYPESCRIPT.md
+++ b/docs/TYPESCRIPT.md
@@ -329,7 +329,7 @@ declare module "@cldmv/slothlet/runtime" {
 
 ### Runtime Imports (`self`, `context`, `instanceID`)
 
-All three named exports of `@cldmv/slothlet/runtime` — `self`, `context`, and `instanceID` — work the same way from TypeScript modules as they do from `.mjs` modules. Slothlet writes the transpiled `.ts` output to a project-local cache file (see [Limitations](#limitations)) so Node's resolver can anchor bare-specifier imports normally; relative imports resolve too — to plain `.mjs` / `.cjs` / `.js` files and to other `.ts` / `.mts` modules, which are transpiled and linked automatically. Nothing about TypeScript changes the runtime API surface.
+All three named exports of `@cldmv/slothlet/runtime` — `self`, `context`, and `instanceID` — work the same way from TypeScript modules as they do from `.mjs` modules. Slothlet writes the transpiled `.ts` output to a project-local cache file (see [Limitations](#limitations)) so Node's resolver can anchor bare-specifier imports normally; relative imports resolve too — to plain `.mjs` / `.cjs` / `.js` files and to other `.ts` / `.mts` modules, which are transpiled and linked automatically. Those relative helpers are per instance exactly as they are for `.mjs` leaves — see [MODULE-STRUCTURE.md → Helper Modules Are Per Instance](MODULE-STRUCTURE.md#helper-modules-are-per-instance). Nothing about TypeScript changes the runtime API surface.
 
 ```typescript
 // api/utils.ts
diff --git a/docs/generated/API.md b/docs/generated/API.md
index b68f68440..ca37fdcdc 100644
--- a/docs/generated/API.md
+++ b/docs/generated/API.md
@@ -402,6 +402,44 @@ const api = await slothlet({
 
 
 
+<a id="at_cldmv_slash_slothlet_slash_helpers_slash_instance-imports"></a>
+
+## @cldmv/slothlet/helpers/instance-imports
+> <p><strong style="font-size: 1.1em;"><p>The loader imports every leaf with a per-instance query
+> (<code>?slothlet_instance=&lt;id&gt;[&amp;module=&lt;moduleID&gt;][&amp;_reload=&lt;timestamp&gt;]</code>), so each instance — and each
+> reload — evaluates its own copy of the leaf. A module the leaf IMPORTS is resolved by the host,
+> which knows nothing about that query: a relative helper would be one module shared by every
+> instance and every reload, and module-level state in it would leak between instances.</p>
+> <p>This module closes that gap for everything reachable through relative or <code>file:</code> specifiers,
+> at any depth:</p>
+> <ul>
+> <li><strong>Native Node</strong> — {@link installInstanceImportHooks} registers a process-wide, in-thread resolve
+> hook (<code>module.registerHooks()</code>, Node &gt;= 22.15 — slothlet's engines floor) that copies the
+> importing module's instance parameter onto the child. Registered once per process; a no-op
+> for every import whose parent carries no slothlet query.</li>
+> <li><strong>Vite / vitest</strong> — {@link slothletInstanceImports} is the same rule as a vite <code>resolveId</code>
+> plugin, for leaves loaded through a consumer's <code>import</code> hook into a vite module graph (where
+> Node's resolve hooks never run).</li>
+> </ul>
+> <p>A helper is ONE copy per instance. Only <code>slothlet_instance</code> is copied: not the leaf's <code>module</code>
+> (mount) parameter, so the base leaves and every <code>api.slothlet.api.add</code> mount share the copy; and
+> not the leaf's <code>_reload</code> stamp, so a partial reload (<code>api.slothlet.api.reload(…)</code>) re-imports the
+> reloaded leaves against the instance's existing helper copy — helper state survives it. A full
+> reload (<code>api.slothlet.reload()</code>) rotates the instance ID, which is what gives helpers a fresh
+> copy; edits to helper code therefore need a full reload.</p>
+> <p>What stays shared: bare specifiers (<code>node_modules</code> packages, <code>node:</code> builtins, subpath <code>#imports</code>,
+> <code>@cldmv/slothlet</code> and its runtime), any file inside a <code>node_modules</code> package other than the
+> importer's own, and slothlet's own source files — the live-binding runtime must remain one
+> module per process.</p></strong></p>
+> 
+
+
+
+
+
+
+
+
 <a id="at_cldmv_slash_slothlet_slash_helpers_slash_manifest-resolver"></a>
 
 ## @cldmv/slothlet/helpers/manifest-resolver
diff --git a/package-lock.json b/package-lock.json
index 63d4f0476..602bea966 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -43,7 +43,7 @@
 				"vitest": "^5.0.0"
 			},
 			"engines": {
-				"node": ">=22.12.0"
+				"node": ">=22.15.0"
 			},
 			"funding": {
 				"type": "github",
diff --git a/package.json b/package.json
index 93ff13bde..8c1ee5731 100644
--- a/package.json
+++ b/package.json
@@ -272,7 +272,7 @@
 		"zero-dependencies"
 	],
 	"engines": {
-		"node": ">=22.12.0"
+		"node": ">=22.15.0"
 	},
 	"author": {
 		"name": "Shinrai",
diff --git a/src/lib/helpers/instance-imports.mjs b/src/lib/helpers/instance-imports.mjs
new file mode 100644
index 000000000..0782f978c
--- /dev/null
+++ b/src/lib/helpers/instance-imports.mjs
@@ -0,0 +1,288 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /src/lib/helpers/instance-imports.mjs
+ *	@Date: 2026-09-28 20:32:55 -07:00 (1790652775)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 20:55:29 -07:00 (1790654129)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Carry a leaf's per-instance import query onto the relative helpers it imports (#518).
+ * @module @cldmv/slothlet/helpers/instance-imports
+ *
+ * @description
+ * The loader imports every leaf with a per-instance query
+ * (`?slothlet_instance=<id>[&module=<moduleID>][&_reload=<timestamp>]`), so each instance — and each
+ * reload — evaluates its own copy of the leaf. A module the leaf IMPORTS is resolved by the host,
+ * which knows nothing about that query: a relative helper would be one module shared by every
+ * instance and every reload, and module-level state in it would leak between instances.
+ *
+ * This module closes that gap for everything reachable through relative or `file:` specifiers,
+ * at any depth:
+ *
+ * - **Native Node** — {@link installInstanceImportHooks} registers a process-wide, in-thread resolve
+ *   hook (`module.registerHooks()`, Node >= 22.15 — slothlet's engines floor) that copies the
+ *   importing module's instance parameter onto the child. Registered once per process; a no-op
+ *   for every import whose parent carries no slothlet query.
+ * - **Vite / vitest** — {@link slothletInstanceImports} is the same rule as a vite `resolveId`
+ *   plugin, for leaves loaded through a consumer's `import` hook into a vite module graph (where
+ *   Node's resolve hooks never run).
+ *
+ * A helper is ONE copy per instance. Only `slothlet_instance` is copied: not the leaf's `module`
+ * (mount) parameter, so the base leaves and every `api.slothlet.api.add` mount share the copy; and
+ * not the leaf's `_reload` stamp, so a partial reload (`api.slothlet.api.reload(…)`) re-imports the
+ * reloaded leaves against the instance's existing helper copy — helper state survives it. A full
+ * reload (`api.slothlet.reload()`) rotates the instance ID, which is what gives helpers a fresh
+ * copy; edits to helper code therefore need a full reload.
+ *
+ * What stays shared: bare specifiers (`node_modules` packages, `node:` builtins, subpath `#imports`,
+ * `@cldmv/slothlet` and its runtime), any file inside a `node_modules` package other than the
+ * importer's own, and slothlet's own source files — the live-binding runtime must remain one
+ * module per process.
+ */
+
+/**
+ * Query parameters copied from a leaf onto its helpers: the instance only. The leaf's `module`
+ * (mount) and `_reload` (partial-reload stamp) parameters are deliberately NOT copied — a helper is
+ * one copy per instance, shared by every mount and kept across partial reloads; a full reload
+ * rotates the instance ID and so yields a fresh copy.
+ * @type {ReadonlyArray<string>}
+ * @internal
+ */
+export const INSTANCE_QUERY_KEYS = Object.freeze(["slothlet_instance"]);
+
+/**
+ * The marker a parent's URL/id must carry for its imports to be rewritten.
+ * @type {string}
+ * @private
+ */
+const MARKER = "slothlet_instance=";
+
+/**
+ * Global flag marking the Node resolve hook as registered, shared across slothlet copies.
+ * @type {symbol}
+ * @private
+ */
+const INSTALLED = Symbol.for("@cldmv/slothlet.instanceImportHooks");
+
+/**
+ * Slothlet's own files, as forward-slash paths: the `lib/` tree (`src/lib/` or `dist/lib/`) and the
+ * package's two entry files. Imports resolving here are never duplicated per instance.
+ * @type {string[]}
+ * @private
+ */
+const OWN_PREFIXES = [
+	new URL("../", import.meta.url),
+	new URL("../../../index.mjs", import.meta.url),
+	new URL("../../../index.cjs", import.meta.url)
+]
+	.filter((u) => u.protocol === "file:")
+	.map((u) => toSlashPath(u.href));
+
+/**
+ * Whether a specifier names a file relative to (or absolute from) its importer, as opposed to a
+ * bare package/builtin/subpath-import specifier.
+ * @param {string} specifier - The import/require specifier as written.
+ * @returns {boolean} True for `./`, `../`, `/` and `file:` specifiers.
+ * @internal
+ * @example
+ * isFileSpecifier("../lib/state.mjs"); // true
+ * isFileSpecifier("@cldmv/slothlet/runtime"); // false
+ */
+export function isFileSpecifier(specifier) {
+	return (
+		typeof specifier === "string" &&
+		(specifier.startsWith("./") || specifier.startsWith("../") || specifier.startsWith("/") || specifier.startsWith("file:"))
+	);
+}
+
+/**
+ * Normalize a `file:` URL, filesystem path or vite id to a forward-slash path without query/hash.
+ * @param {string} ref - A `file:` URL, an absolute path (either separator), or a vite id.
+ * @returns {string} The forward-slash path.
+ * @private
+ */
+function toSlashPath(ref) {
+	let p = ref;
+	const cut = p.search(/[?#]/);
+	if (cut !== -1) p = p.slice(0, cut);
+	if (p.startsWith("file:")) {
+		p = decodeURIComponent(p.replace(/^file:\/\/[^/]*/, ""));
+	}
+	return p.replace(/\\/g, "/");
+}
+
+/**
+ * The `node_modules` package directory a path lives in (`…/node_modules/pkg` or
+ * `…/node_modules/@scope/pkg`), or null when the path is outside every `node_modules`.
+ * @param {string} slashPath - A forward-slash path.
+ * @returns {string|null} The package directory, or null.
+ * @private
+ */
+function nodeModulesPackage(slashPath) {
+	const idx = slashPath.lastIndexOf("/node_modules/");
+	if (idx === -1) return null;
+	const rest = slashPath.slice(idx + "/node_modules/".length).split("/");
+	const depth = rest[0]?.startsWith("@") ? 2 : 1;
+	return slashPath.slice(0, idx) + "/node_modules/" + rest.slice(0, depth).join("/");
+}
+
+/**
+ * Whether a module resolved at `child` (imported from `parent`) belongs to the importing leaf's
+ * per-instance graph. Slothlet's own files are always shared. A file inside a `node_modules`
+ * package is per instance only when the importer lives in that same package — a slothlet plugin
+ * installed as a dependency keeps its own helpers per instance, while a relative path that
+ * reaches into some other package does not duplicate that package.
+ * @param {string} child - Resolved child (`file:` URL, path or vite id).
+ * @param {string} parent - The importer (`file:` URL, path or vite id).
+ * @returns {boolean} True when the child should carry the parent's instance query.
+ * @internal
+ * @example
+ * isInstanceScopedFile("/app/lib/state.mjs", "/app/api/tally.mjs"); // true
+ * isInstanceScopedFile("/app/node_modules/x/index.js", "/app/api/tally.mjs"); // false
+ */
+export function isInstanceScopedFile(child, parent) {
+	const childPath = toSlashPath(child);
+	if (OWN_PREFIXES.some((own) => childPath === own || (own.endsWith("/") && childPath.startsWith(own)))) return false;
+	const childPkg = nodeModulesPackage(childPath);
+	return childPkg === null || childPkg === nodeModulesPackage(toSlashPath(parent));
+}
+
+/**
+ * Copy the slothlet instance query from `parent` onto `child` when the import belongs to the
+ * leaf's per-instance graph; otherwise return `child` unchanged. Works on `file:` URLs (Node) and
+ * on vite ids (absolute paths with an optional query) alike.
+ * @param {string} specifier - The specifier as written in the importer.
+ * @param {string|undefined} parent - The importer's URL or id.
+ * @param {string} child - The resolved child URL or id.
+ * @returns {string} `child`, with the instance query appended when it applies.
+ * @internal
+ * @example
+ * propagateInstanceQuery("../lib/state.mjs", "file:///app/api/tally.mjs?slothlet_instance=a", "file:///app/lib/state.mjs");
+ * // → "file:///app/lib/state.mjs?slothlet_instance=a"
+ */
+export function propagateInstanceQuery(specifier, parent, child) {
+	if (typeof parent !== "string" || !parent.includes(MARKER)) return child;
+	if (typeof child !== "string" || !isFileSpecifier(specifier)) return child;
+	if (!(child.startsWith("file:") || child.startsWith("/") || /^[A-Za-z]:[\\/]/.test(child))) return child;
+	const [childBase, childQuery = ""] = splitQuery(child);
+	const childParams = new URLSearchParams(childQuery);
+	if (childParams.has("slothlet_instance")) return child;
+	if (!isInstanceScopedFile(childBase, parent)) return child;
+	const parentParams = new URLSearchParams(splitQuery(parent)[1] ?? "");
+	for (const key of INSTANCE_QUERY_KEYS) {
+		if (parentParams.has(key)) childParams.set(key, parentParams.get(key));
+	}
+	const hashIdx = childBase.indexOf("#");
+	const base = hashIdx === -1 ? childBase : childBase.slice(0, hashIdx);
+	const hash = hashIdx === -1 ? "" : childBase.slice(hashIdx);
+	return `${base}?${childParams.toString()}${hash}`;
+}
+
+/**
+ * Split a URL/id into its part before `?` and its query (without `?` and without any `#hash`).
+ * @param {string} ref - URL or id.
+ * @returns {string[]} `[base, query]`; `query` is undefined when there is none.
+ * @private
+ */
+function splitQuery(ref) {
+	const q = ref.indexOf("?");
+	if (q === -1) return [ref];
+	const hash = ref.indexOf("#", q);
+	return hash === -1 ? [ref.slice(0, q), ref.slice(q + 1)] : [ref.slice(0, q) + ref.slice(hash), ref.slice(q + 1, hash)];
+}
+
+/**
+ * Resolve-result shape shared by Node's resolve hooks.
+ * @typedef {object} ResolveResult
+ * @property {string} url - The resolved module URL.
+ * @property {string} [format] - The module format hint.
+ * @property {boolean} [shortCircuit] - Whether the chain was short-circuited.
+ * @internal
+ */
+
+/**
+ * Node's next-in-chain resolve function.
+ * @callback NextResolve
+ * @param {string} specifier - The specifier to resolve.
+ * @param {object} [context] - The resolve context.
+ * @returns {ResolveResult|Promise<ResolveResult>} The resolution.
+ * @internal
+ */
+
+/**
+ * Apply the propagation rule to one resolution result.
+ * @param {string} specifier - The specifier as written.
+ * @param {object} context - Node's resolve context (`parentURL`).
+ * @param {ResolveResult} result - The next hook's result.
+ * @returns {ResolveResult} `result`, with its url carrying the instance query when it applies.
+ * @private
+ */
+function applyToResult(specifier, context, result) {
+	const url = propagateInstanceQuery(specifier, context?.parentURL, result?.url);
+	return url === result?.url ? result : { ...result, url };
+}
+
+/**
+ * Register the resolve hook with Node, once per process (idempotent across slothlet copies).
+ * Uses the synchronous in-thread `module.registerHooks()` (Node >= 22.15 / 23.5, slothlet's engines
+ * floor). The off-thread `module.register()` is deliberately not used: it adds a cross-thread round
+ * trip to every import in the process and reorders module evaluation enough to break leaves that
+ * start a fire-and-forget runtime import. A host without `registerHooks()` is left untouched.
+ * @param {object} nodeModule - The `node:module` namespace.
+ * @param {object} [registry=globalThis] - Where the process-wide "registered" flag lives; the global
+ *   object in production, so every slothlet copy in the process sees one registration.
+ * @returns {boolean} True when a hook is (now or already) registered.
+ * @internal
+ * @example
+ * installInstanceImportHooks(await import("node:module"));
+ */
+export function installInstanceImportHooks(nodeModule, registry = globalThis) {
+	if (registry[INSTALLED]) return true;
+	if (typeof nodeModule?.registerHooks === "function") {
+		nodeModule.registerHooks({
+			resolve: (specifier, context, nextResolve) => applyToResult(specifier, context, nextResolve(specifier, context))
+		});
+	} else {
+		return false;
+	}
+	Object.defineProperty(registry, INSTALLED, { value: true, enumerable: false });
+	return true;
+}
+
+/**
+ * Vite plugin applying the same rule inside a vite module graph — for leaves a consumer loads
+ * through slothlet's `import` hook under vitest (docs/TESTING.md), where Node's resolve hooks
+ * never see the leaf's imports. Add it to the consumer's `vitest.config` `plugins`.
+ * @returns {object} A vite plugin (`name`, `enforce`, `resolveId`).
+ * @public
+ * @example
+ * // vitest.config.mjs
+ * import { slothletInstanceImports } from "@cldmv/slothlet/helpers/instance-imports";
+ * export default defineConfig({ plugins: [slothletInstanceImports()] });
+ */
+export function slothletInstanceImports() {
+	return {
+		name: "slothlet-instance-imports",
+		enforce: "pre",
+		/**
+		 * Resolve a relative/`file:` import of a slothlet leaf with the leaf's instance query.
+		 * @param {string} source - The specifier as written.
+		 * @param {string|undefined} importer - The importing module's id.
+		 * @param {object} [options] - Vite resolve options.
+		 * @returns {Promise<object|null>} The resolution, or null to defer to other resolvers.
+		 */
+		async resolveId(source, importer, options) {
+			if (typeof importer !== "string" || !importer.includes(MARKER) || !isFileSpecifier(source)) return null;
+			const resolved = await this.resolve(source, importer, { ...options, skipSelf: true });
+			if (!resolved || resolved.external) return resolved;
+			const id = propagateInstanceQuery(source, importer, resolved.id);
+			return id === resolved.id ? resolved : { ...resolved, id };
+		}
+	};
+}
diff --git a/src/lib/processors/loader.mjs b/src/lib/processors/loader.mjs
index 26a7d9c67..4b4180b75 100644
--- a/src/lib/processors/loader.mjs
+++ b/src/lib/processors/loader.mjs
@@ -37,6 +37,7 @@ import { fsp, path, url, createRequire } from "@cldmv/slothlet/helpers/platform"
 import { compilePattern } from "@cldmv/slothlet/helpers/pattern-matcher";
 import { isFrameworkReservedKey } from "#handlers/unified-wrapper";
 import { SlothletWarning } from "@cldmv/slothlet/errors";
+import { installInstanceImportHooks, isInstanceScopedFile } from "@cldmv/slothlet/helpers/instance-imports";
 
 /**
  * Whether THIS copy of slothlet runs outside a bundler/test-runner module graph.
@@ -223,6 +224,26 @@ export function typeGenerationWorkerPath() {
 	return path.join(path.dirname(url.fileURLToPath(import.meta.url)), "type-generation-worker.mjs");
 }
 
+/**
+ * Whether this loader copy has registered the per-instance helper-import resolve hook (#518).
+ * @type {boolean}
+ * @private
+ */
+let instanceImportHooksInstalled = false;
+
+/**
+ * Register the Node resolve hook that carries a leaf's `?slothlet_instance=…` query onto the
+ * relative helpers it imports, once per process. Node-only: called from the disk-loading path,
+ * never in browser mode. `node:module` is read through the platform's createRequire rather than an
+ * `import("node:module")` literal, which would pull a `node:` specifier into browser bundles.
+ * @returns {void}
+ * @private
+ */
+function ensureInstanceImportHooks() {
+	if (instanceImportHooksInstalled) return;
+	instanceImportHooksInstalled = installInstanceImportHooks(createRequire(import.meta.url)("node:module"));
+}
+
 export class Loader extends ComponentBase {
 	static slothletProperty = "loader";
 
@@ -261,11 +282,16 @@ export class Loader extends ComponentBase {
 
 			// CJS files must bypass the shared require() cache; query-param cache-busting
 			// has no effect on require() because it keys on the resolved file path only.
-			// A `.js` file Node treats as CommonJS (#521) takes the same path as `.cjs`.
+			// A `.js` file Node treats as CommonJS (#521) takes the same path as `.cjs`. Its relative
+			// requires share one private cache per instance (#518) — kept across partial reloads, like ESM helpers.
 			if (filePath.endsWith(".cjs") || (filePath.endsWith(".js") && (await this.#isCommonJSFile(filePath)))) {
-				return this.#loadCJSIsolated(filePath);
+				return this.#loadCJSIsolated(filePath, instanceID);
 			}
 
+			// Relative helpers a leaf imports must follow the leaf's per-instance query (#518): the
+			// process-wide resolve hook copies it onto every relative/`file:` child below the leaf.
+			ensureInstanceImportHooks();
+
 			// Check if TypeScript transformation is needed
 			const isTypeScript = filePath.endsWith(".ts") || filePath.endsWith(".mts");
 			const typescriptConfig = this.slothlet.config?.typescript;
@@ -460,27 +486,64 @@ export class Loader extends ComponentBase {
 	}
 
 	/**
-	 * Load a CJS module with a fresh module.exports on every call by clearing
-	 * its entry from require.cache before loading.
+	 * Load a CJS module with a fresh module.exports on every call, and give its relative
+	 * dependency graph one copy per instance (#518).
 	 * Node's require() cache is keyed on the resolved file path and ignores URL
 	 * query parameters, so two Slothlet instances loading the same .cjs file
-	 * would otherwise share the exact same module.exports object.
+	 * would otherwise share the exact same module.exports object — and so would
+	 * every helper the leaf require()s.
+	 *
+	 * The leaf itself is always evaluated fresh. The instance-scoped files it reaches
+	 * (see isInstanceScopedFile: its relative helpers, never `node_modules` packages or
+	 * slothlet's own files) are kept in a private cache per instance — the same scope the ESM
+	 * helper query carries: shared by every mount and kept across partial reloads (a full
+	 * reload rotates the instance ID and so starts a fresh cache) — and swapped into
+	 * `require.cache` only for the duration of this synchronous require: global entries
+	 * for those files are set aside and restored afterwards, so neither the host's copies
+	 * nor another scope's copies are ever served, and `require.cache` does not grow.
 	 * @param {string} filePath - Absolute path to the .cjs file
+	 * @param {string} scopeKey - The instance ID whose helper copies the leaf's requires are served from
 	 * @returns {Promise<Object>} Synthetic ESM namespace: { default, ...namedExports }
 	 * @example
-	 * const ns = await this.#loadCJSIsolated("/path/to/module.cjs");
+	 * const ns = await this.#loadCJSIsolated("/path/to/module.cjs", "inst");
 	 * ns.default; // module.exports
 	 * @private
 	 */
-	#loadCJSIsolated(filePath) {
+	#loadCJSIsolated(filePath, scopeKey) {
 		const requireFn = createRequire(filePath);
 		const resolved = requireFn.resolve(filePath);
+		const cache = requireFn.cache;
+		const scopes = (this.slothlet._cjsHelperScopes ??= new Map());
+		let scope = scopes.get(scopeKey);
+		if (!scope) {
+			scope = new Map();
+			scopes.set(scopeKey, scope);
+		}
+		const inScope = (file) => file !== resolved && isInstanceScopedFile(file, resolved);
+
+		// Set aside every global entry the leaf's graph must not share, then serve this scope's copies.
+		const setAside = new Map();
+		for (const file of Object.keys(cache)) {
+			if (file === resolved || inScope(file)) {
+				setAside.set(file, cache[file]);
+				delete cache[file];
+			}
+		}
+		for (const [file, mod] of scope) cache[file] = mod;
 
-		// Clear from require.cache so each call gets a fresh module.exports.
-		delete requireFn.cache[resolved];
-		const exports = requireFn(resolved);
-		// Remove after loading so the cache doesn't grow unboundedly across instances.
-		delete requireFn.cache[resolved];
+		let exports;
+		try {
+			exports = requireFn(resolved);
+		} finally {
+			// Collect this scope's (possibly new) helper copies, then put the global cache back.
+			for (const file of Object.keys(cache)) {
+				if (file === resolved || inScope(file)) {
+					if (file !== resolved) scope.set(file, cache[file]);
+					delete cache[file];
+				}
+			}
+			for (const [file, mod] of setAside) cache[file] = mod;
+		}
 
 		// Build a synthetic ESM namespace that mirrors what import() returns for CJS:
 		//   - default = module.exports
diff --git a/src/slothlet.mjs b/src/slothlet.mjs
index a2525dd89..949ad1ba1 100644
--- a/src/slothlet.mjs
+++ b/src/slothlet.mjs
@@ -1032,6 +1032,8 @@ class Slothlet {
 		const oldInstanceID = this.instanceID;
 		if (!keepInstanceID) {
 			this.instanceID = `${oldInstanceID}_reload_${Date.now()}`;
+			// The previous instanceID's private CommonJS helper copies (#518) can no longer be served.
+			this._cjsHelperScopes?.clear();
 
 			// The TS transform cache dirs from the previous instanceID are stale: the
 			// startup sweep only removes dirs whose owning PID is dead (same-PID dirs
@@ -1385,6 +1387,9 @@ class Slothlet {
 		// Shutdown event manager (#407) — clears all subscriptions.
 		this.handlers.eventManager?.shutdown();
 
+		// Drop this instance's private CommonJS helper copies (#518).
+		this._cjsHelperScopes?.clear();
+
 		// Remove on-disk TS transform cache (<projectRoot>/.slothlet-cache/<pid>-<instanceID>/).
 		// Hash-keyed filenames make repeat loads cheap; this keeps the directory bounded
 		// across process runs. Node-only: `fsp` is null in a browser (helpers/platform), so guard
diff --git a/tests/vitests/setup/vitest-helper.mjs b/tests/vitests/setup/vitest-helper.mjs
index a57da9566..f539df278 100644
--- a/tests/vitests/setup/vitest-helper.mjs
+++ b/tests/vitests/setup/vitest-helper.mjs
@@ -73,6 +73,8 @@ export const TEST_DIRS = {
 	API_TEST_LIFECYCLE_HOOKS: path.resolve(__dirname, `../../../${API_TEST_BASE}/api_test_lifecycle_hooks`),
 	API_TEST_LIFECYCLE_HOOKS_FAIL: path.resolve(__dirname, `../../../${API_TEST_BASE}/api_test_lifecycle_hooks_fail`),
 	API_TEST_LIFECYCLE_HOOKS_WALK: path.resolve(__dirname, `../../../${API_TEST_BASE}/api_test_lifecycle_hooks_walk`),
+	// #518 — relative helper imports below a leaf are per instance (the api lives in `api/`, helpers in `lib/`).
+	API_TEST_HELPER_IMPORTS: path.resolve(__dirname, `../../../${API_TEST_BASE}/api_test_helper_imports/api`),
 	API_TEST_NESTED_ISOLATION: path.resolve(__dirname, `../../../${API_TEST_BASE}/api_test_nested_isolation/outer`),
 	API_TEST_ROUTINES: path.resolve(__dirname, `../../../${API_TEST_BASE}/api_test_routines`),
 	API_TEST_ROUTINES_AUTH1: path.resolve(__dirname, `../../../${API_TEST_BASE}/api_test_routines_auth1`),
diff --git a/tests/vitests/suites/helpers/instance-imports.test.vitest.mjs b/tests/vitests/suites/helpers/instance-imports.test.vitest.mjs
new file mode 100644
index 000000000..e38ef60d8
--- /dev/null
+++ b/tests/vitests/suites/helpers/instance-imports.test.vitest.mjs
@@ -0,0 +1,190 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/helpers/instance-imports.test.vitest.mjs
+ *	@Date: 2026-09-28 21:41:18 -07:00 (1790656878)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 22:26:04 -07:00 (1790659564)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Unit tests for the per-instance helper-import rule (#518): which imports carry a
+ * leaf's instance query, the Node resolve-hook registration, and the vite plugin.
+ */
+
+import { describe, it, expect } from "vitest";
+import {
+	INSTANCE_QUERY_KEYS,
+	isFileSpecifier,
+	isInstanceScopedFile,
+	propagateInstanceQuery,
+	installInstanceImportHooks,
+	slothletInstanceImports
+} from "@cldmv/slothlet/helpers/instance-imports";
+
+const LEAF = "file:///app/api/tally/tally.mjs?slothlet_instance=abc";
+const OWN_LIB = new URL("../../../../src/lib/", import.meta.url).href;
+
+describe("Helpers > instance-imports (#518)", () => {
+	describe("isFileSpecifier", () => {
+		it("accepts relative, absolute and file: specifiers", () => {
+			expect(isFileSpecifier("./x.mjs")).toBe(true);
+			expect(isFileSpecifier("../x.mjs")).toBe(true);
+			expect(isFileSpecifier("/abs/x.mjs")).toBe(true);
+			expect(isFileSpecifier("file:///abs/x.mjs")).toBe(true);
+		});
+
+		it("rejects bare, builtin and subpath-import specifiers", () => {
+			expect(isFileSpecifier("acorn")).toBe(false);
+			expect(isFileSpecifier("@cldmv/slothlet/runtime")).toBe(false);
+			expect(isFileSpecifier("node:path")).toBe(false);
+			expect(isFileSpecifier("#lib/state")).toBe(false);
+			expect(isFileSpecifier(undefined)).toBe(false);
+		});
+	});
+
+	describe("isInstanceScopedFile", () => {
+		it("scopes files outside node_modules", () => {
+			expect(isInstanceScopedFile("file:///app/lib/state.mjs", LEAF)).toBe(true);
+			expect(isInstanceScopedFile("/app/lib/state.mjs?x=1#h", "/app/api/tally.mjs")).toBe(true);
+		});
+
+		it("normalizes Windows separators", () => {
+			expect(isInstanceScopedFile("C:\\app\\lib\\state.cjs", "C:\\app\\api\\leaf.cjs")).toBe(true);
+			expect(isInstanceScopedFile("C:\\app\\node_modules\\x\\index.js", "C:\\app\\api\\leaf.cjs")).toBe(false);
+		});
+
+		it("keeps another node_modules package shared", () => {
+			expect(isInstanceScopedFile("file:///app/node_modules/acorn/dist/acorn.mjs", LEAF)).toBe(false);
+			expect(isInstanceScopedFile("/app/node_modules/@scope/pkg/index.js", "/app/node_modules/@scope/other/api/x.mjs")).toBe(false);
+		});
+
+		it("scopes a node_modules package's own helpers when the importer lives in that package", () => {
+			const leaf = "file:///app/node_modules/@org/plugin/dist/api/leaf.mjs?slothlet_instance=abc";
+			expect(isInstanceScopedFile("file:///app/node_modules/@org/plugin/dist/lib/state.mjs", leaf)).toBe(true);
+			expect(isInstanceScopedFile("/app/node_modules/plain/lib/a.js", "/app/node_modules/plain/api/b.js")).toBe(true);
+		});
+
+		it("never scopes slothlet's own files", () => {
+			expect(isInstanceScopedFile(`${OWN_LIB}runtime/runtime.mjs`, LEAF)).toBe(false);
+			expect(isInstanceScopedFile(new URL("../../../../index.mjs", import.meta.url).href, LEAF)).toBe(false);
+			expect(isInstanceScopedFile(decodeURIComponent(new URL("../../../../index.cjs", import.meta.url).pathname), LEAF)).toBe(false);
+		});
+	});
+
+	describe("propagateInstanceQuery", () => {
+		it("copies only the instance key from the parent, not the mount or reload stamp", () => {
+			const parent = "file:///app/api/a.mjs?slothlet_instance=abc&module=m1&_reload=42&other=1";
+			const out = propagateInstanceQuery("../lib/s.mjs", parent, "file:///app/lib/s.mjs");
+			const params = new URL(out).searchParams;
+			for (const key of INSTANCE_QUERY_KEYS) expect(params.has(key)).toBe(true);
+			expect(params.get("slothlet_instance")).toBe("abc");
+			// The partial-reload stamp is not copied: helpers keep the instance copy across partial reloads.
+			expect(params.has("_reload")).toBe(false);
+			expect(params.has("other")).toBe(false);
+			// The mount identity is not copied: a helper is one copy per instance across every mount.
+			expect(params.has("module")).toBe(false);
+			expect(INSTANCE_QUERY_KEYS).toEqual(["slothlet_instance"]);
+		});
+
+		it("keeps an existing child query and hash", () => {
+			expect(propagateInstanceQuery("./s.mjs?v=1#frag", LEAF, "file:///app/api/tally/s.mjs?v=1#frag")).toBe(
+				"file:///app/api/tally/s.mjs?v=1&slothlet_instance=abc#frag"
+			);
+			expect(propagateInstanceQuery("./s.mjs#frag", LEAF, "file:///app/api/tally/s.mjs#frag")).toBe(
+				"file:///app/api/tally/s.mjs?slothlet_instance=abc#frag"
+			);
+		});
+
+		it("works on vite ids (absolute paths)", () => {
+			expect(propagateInstanceQuery("../lib/s.mjs", "/app/api/a.mjs?slothlet_instance=abc", "/app/lib/s.mjs")).toBe(
+				"/app/lib/s.mjs?slothlet_instance=abc"
+			);
+			expect(propagateInstanceQuery("../lib/s.mjs", "C:/app/api/a.mjs?slothlet_instance=abc", "C:/app/lib/s.mjs")).toBe(
+				"C:/app/lib/s.mjs?slothlet_instance=abc"
+			);
+		});
+
+		it("leaves the child alone when the rule does not apply", () => {
+			// No slothlet query on the parent.
+			expect(propagateInstanceQuery("./s.mjs", "file:///app/x.mjs", "file:///app/s.mjs")).toBe("file:///app/s.mjs");
+			expect(propagateInstanceQuery("./s.mjs", undefined, "file:///app/s.mjs")).toBe("file:///app/s.mjs");
+			// Bare specifier.
+			expect(propagateInstanceQuery("acorn", LEAF, "file:///app/node_modules/acorn/x.mjs")).toBe("file:///app/node_modules/acorn/x.mjs");
+			// Non-file results.
+			expect(propagateInstanceQuery("./s.mjs", LEAF, "data:text/javascript,1")).toBe("data:text/javascript,1");
+			expect(propagateInstanceQuery("./s.mjs", LEAF, undefined)).toBe(undefined);
+			// Already carries an instance query.
+			const tagged = "file:///app/s.mjs?slothlet_instance=other";
+			expect(propagateInstanceQuery("./s.mjs", LEAF, tagged)).toBe(tagged);
+			// Relative path into another package.
+			const pkg = "file:///app/node_modules/x/index.mjs";
+			expect(propagateInstanceQuery("../../node_modules/x/index.mjs", LEAF, pkg)).toBe(pkg);
+		});
+	});
+
+	describe("installInstanceImportHooks", () => {
+		it("prefers registerHooks and registers once per registry", () => {
+			const calls = [];
+			const nodeModule = { registerHooks: (hooks) => calls.push(hooks), register: () => calls.push("register") };
+			const registry = {};
+			expect(installInstanceImportHooks(nodeModule, registry)).toBe(true);
+			expect(installInstanceImportHooks(nodeModule, registry)).toBe(true);
+			expect(calls).toHaveLength(1);
+			const next = (specifier) => ({ url: `file:///app/lib/${specifier.split("/").pop()}` });
+			expect(calls[0].resolve("../lib/s.mjs", { parentURL: LEAF }, next).url).toBe("file:///app/lib/s.mjs?slothlet_instance=abc");
+		});
+
+		it("never falls back to the off-thread module.register", () => {
+			const urls = [];
+			expect(installInstanceImportHooks({ register: (u) => urls.push(u) }, {})).toBe(false);
+			expect(urls).toHaveLength(0);
+		});
+
+		it("returns false on a host with neither API", () => {
+			const registry = {};
+			expect(installInstanceImportHooks({}, registry)).toBe(false);
+			expect(installInstanceImportHooks(undefined, registry)).toBe(false);
+		});
+	});
+
+	describe("slothletInstanceImports (vite plugin)", () => {
+		const plugin = slothletInstanceImports();
+
+		it("is a pre-enforced resolveId plugin", () => {
+			expect(plugin.name).toBe("slothlet-instance-imports");
+			expect(plugin.enforce).toBe("pre");
+		});
+
+		it("adds the importer's instance query to a relative import", async () => {
+			const ctx = { resolve: async (source, importer, options) => ({ id: "/app/lib/s.mjs", seen: options }) };
+			const out = await plugin.resolveId.call(ctx, "../lib/s.mjs", "/app/api/a.mjs?slothlet_instance=abc", { ssr: true });
+			expect(out.id).toBe("/app/lib/s.mjs?slothlet_instance=abc");
+			expect(out.seen).toEqual({ ssr: true, skipSelf: true });
+		});
+
+		it("defers when the rule does not apply", async () => {
+			const ctx = {
+				resolve: async () => {
+					throw new Error("must not resolve");
+				}
+			};
+			expect(await plugin.resolveId.call(ctx, "./s.mjs", undefined, {})).toBe(null);
+			expect(await plugin.resolveId.call(ctx, "./s.mjs", "/app/api/a.mjs", {})).toBe(null);
+			expect(await plugin.resolveId.call(ctx, "acorn", "/app/api/a.mjs?slothlet_instance=abc", {})).toBe(null);
+		});
+
+		it("returns unresolved, external and non-scoped resolutions unchanged", async () => {
+			const importer = "/app/api/a.mjs?slothlet_instance=abc";
+			expect(await plugin.resolveId.call({ resolve: async () => null }, "./s.mjs", importer, {})).toBe(null);
+			const external = { id: "/app/s.mjs", external: true };
+			expect(await plugin.resolveId.call({ resolve: async () => external }, "./s.mjs", importer, {})).toBe(external);
+			const pkg = { id: "/app/node_modules/x/index.mjs" };
+			expect(await plugin.resolveId.call({ resolve: async () => pkg }, "../node_modules/x/index.mjs", importer, {})).toBe(pkg);
+		});
+	});
+});
diff --git a/tests/vitests/suites/isolation/helper-imports-per-instance.test.vitest.mjs b/tests/vitests/suites/isolation/helper-imports-per-instance.test.vitest.mjs
new file mode 100644
index 000000000..15ba29acb
--- /dev/null
+++ b/tests/vitests/suites/isolation/helper-imports-per-instance.test.vitest.mjs
@@ -0,0 +1,286 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/isolation/helper-imports-per-instance.test.vitest.mjs
+ *	@Date: 2026-09-28 20:29:53 -07:00 (1790652593)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 20:57:31 -07:00 (1790654251)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Relative helper imports below a leaf are per instance (#518).
+ *
+ * @description
+ * Each slothlet instance loads its own copy of every leaf. The modules a leaf IMPORTS — a relative
+ * or `file:` helper, at any depth and in any format — must follow the leaf's instance: one copy per
+ * instance, so module-level state in a helper never leaks between two instances. Within ONE instance
+ * a helper imported by several leaves — any format, base or `api.add` mount — stays a single copy,
+ * and a partial reload (`api.slothlet.api.reload(…)`) keeps that copy; only a full reload
+ * (`api.slothlet.reload()`) gives the instance a fresh one.
+ *
+ * Bare specifiers stay shared: a `node_modules` package, a `node:` builtin, and slothlet's own
+ * runtime (which must remain the single live-binding runtime) are never duplicated per instance.
+ */
+
+import { describe, it, expect, afterEach } from "vitest";
+import { spawnSync } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import slothlet from "@cldmv/slothlet";
+import { TEST_DIRS } from "../../setup/vitest-helper.mjs";
+
+const BASE = TEST_DIRS.API_TEST_HELPER_IMPORTS;
+const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../../..");
+const NATIVE_PROBE = path.resolve(BASE, "../native-probe.mjs");
+const MOUNT = path.resolve(BASE, "../mount");
+
+const CONFIGS = [
+	{ name: "eager", config: { mode: "eager" } },
+	{ name: "lazy", config: { mode: "lazy" } },
+	{ name: "eager + typescript", config: { mode: "eager", typescript: true } },
+	{ name: "lazy + typescript", config: { mode: "lazy", typescript: true } }
+];
+
+describe.each(CONFIGS)("Isolation > helper imports per instance (#518) > '$name'", ({ config }) => {
+	const instances = [];
+
+	/**
+	 * Create an instance over the helper-imports fixture and track it for shutdown.
+	 * @returns {Promise<object>} The composed api.
+	 */
+	const create = async () => {
+		const api = await slothlet({ ...config, base: BASE, silent: true });
+		instances.push(api);
+		return api;
+	};
+
+	afterEach(async () => {
+		while (instances.length) await instances.pop().shutdown();
+	});
+
+	it("gives each instance its own copy of an ESM leaf's relative helper", async () => {
+		const a = await create();
+		const b = await create();
+		expect(await a.tally.count()).toBe(1);
+		expect(await a.tally.count()).toBe(2);
+		expect(await b.tally.count()).toBe(1);
+	});
+
+	it("isolates a two-level helper chain below the leaf", async () => {
+		const a = await create();
+		const b = await create();
+		expect(await a.tally.chain()).toBe(1);
+		expect(await a.tally.chain()).toBe(2);
+		expect(await b.tally.chain()).toBe(1);
+	});
+
+	it("isolates a helper nested inside the api folder", async () => {
+		const a = await create();
+		const b = await create();
+		expect(await a.tally.nested()).toBe(1);
+		expect(await a.tally.nested()).toBe(2);
+		expect(await b.tally.nested()).toBe(1);
+	});
+
+	it("keeps ONE helper copy shared by every leaf of the same instance", async () => {
+		const a = await create();
+		const b = await create();
+		expect(await a.tally.count()).toBe(1);
+		expect(await a.peer.count()).toBe(2);
+		expect(await b.peer.count()).toBe(1);
+		expect(await b.tally.count()).toBe(2);
+	});
+
+	it("gives each instance its own copy of a .cjs leaf's relatively required helpers", async () => {
+		const a = await create();
+		const b = await create();
+		expect(await a.cjsleaf.count()).toBe(1);
+		expect(await a.cjsleaf.count()).toBe(2);
+		expect(await b.cjsleaf.count()).toBe(1);
+		// Second-level require below the helper.
+		expect(await a.cjsleaf.inner()).toBe(1);
+		expect(await a.cjsleaf.inner()).toBe(2);
+		expect(await b.cjsleaf.inner()).toBe(1);
+	});
+
+	it("keeps ONE required helper copy shared by every .cjs leaf of the same instance", async () => {
+		const a = await create();
+		const b = await create();
+		expect(await a.cjsleaf.count()).toBe(1);
+		expect(await a.cjspeer.count()).toBe(2);
+		expect(await b.cjspeer.count()).toBe(1);
+	});
+
+	it("keeps bare packages, node builtins and slothlet's runtime shared across instances", async () => {
+		const a = await create();
+		const b = await create();
+		const refsA = await a.shared.refs();
+		const refsB = await b.shared.refs();
+		expect(refsA.runtime).toBe(refsB.runtime);
+		expect(refsA.EventEmitter).toBe(refsB.EventEmitter);
+		expect(refsA.Parser).toBe(refsB.Parser);
+		// The single live-binding runtime still serves each instance its own api.
+		expect(await a.shared.viaSelf()).toBe(1);
+		expect(await a.shared.viaSelf()).toBe(2);
+		expect(await b.shared.viaSelf()).toBe(1);
+	});
+
+	it("shares one helper copy between a base leaf and an api.add leaf of the same instance", async () => {
+		const a = await create();
+		const b = await create();
+		await a.slothlet.api.add("plugins", MOUNT);
+		await b.slothlet.api.add("plugins", MOUNT);
+		expect(await a.tally.count()).toBe(1);
+		expect(await a.plugins.extra.count()).toBe(2);
+		expect(await a.peer.count()).toBe(3);
+		expect(await b.plugins.extra.count()).toBe(1);
+		expect(await a.cjsleaf.count()).toBe(1);
+		expect(await a.plugins.cjsextra.count()).toBe(2);
+		expect(await b.plugins.cjsextra.count()).toBe(1);
+	});
+
+	it("keeps base and api.add leaves on one fresh helper copy after an instance reload", async () => {
+		const a = await create();
+		await a.slothlet.api.add("plugins", MOUNT);
+		expect(await a.tally.count()).toBe(1);
+		expect(await a.plugins.extra.count()).toBe(2);
+		expect(await a.cjsleaf.count()).toBe(1);
+		expect(await a.plugins.cjsextra.count()).toBe(2);
+		await a.slothlet.reload();
+		expect(await a.tally.count()).toBe(1);
+		expect(await a.plugins.extra.count()).toBe(2);
+		expect(await a.cjsleaf.count()).toBe(1);
+		expect(await a.plugins.cjsextra.count()).toBe(2);
+	});
+
+	it("refreshes relative helpers on a full reload", async () => {
+		const a = await create();
+		expect(await a.tally.count()).toBe(1);
+		expect(await a.tally.count()).toBe(2);
+		expect(await a.tally.chain()).toBe(1);
+		expect(await a.cjsleaf.count()).toBe(1);
+		await a.slothlet.reload();
+		expect(await a.tally.count()).toBe(1);
+		expect(await a.tally.chain()).toBe(1);
+		expect(await a.cjsleaf.count()).toBe(1);
+		// Reloaded leaves of the instance still share one helper copy.
+		expect(await a.peer.count()).toBe(2);
+	});
+
+	it("keeps the instance's helper copy across a base api reload", async () => {
+		const a = await create();
+		expect(await a.tally.count()).toBe(1);
+		expect(await a.cjsleaf.count()).toBe(1);
+		await a.slothlet.api.reload();
+		expect(await a.tally.count()).toBe(2);
+		expect(await a.peer.count()).toBe(3);
+		expect(await a.cjsleaf.count()).toBe(2);
+		expect(await a.cjspeer.count()).toBe(3);
+	});
+
+	it("keeps the instance's helper copy across a scoped reload", async () => {
+		const a = await create();
+		const b = await create();
+		expect(await a.tally.count()).toBe(1);
+		expect(await a.tally.count()).toBe(2);
+		expect(await b.tally.count()).toBe(1);
+		await a.slothlet.api.reload("tally");
+		expect(await a.tally.count()).toBe(3);
+		expect(await a.peer.count()).toBe(4);
+		// The other instance is untouched by a's reload.
+		expect(await b.tally.count()).toBe(2);
+	});
+
+	it("keeps base and reloaded api.add leaves on one helper copy after a mount reload", async () => {
+		const a = await create();
+		const b = await create();
+		await a.slothlet.api.add("plugins", MOUNT);
+		await b.slothlet.api.add("plugins", MOUNT);
+		expect(await a.tally.count()).toBe(1);
+		expect(await a.plugins.extra.count()).toBe(2);
+		expect(await a.cjsleaf.count()).toBe(1);
+		expect(await a.plugins.cjsextra.count()).toBe(2);
+		await a.slothlet.api.reload("plugins");
+		expect(await a.plugins.extra.count()).toBe(3);
+		expect(await a.tally.count()).toBe(4);
+		expect(await a.plugins.cjsextra.count()).toBe(3);
+		expect(await a.cjsleaf.count()).toBe(4);
+		expect(await b.plugins.extra.count()).toBe(1);
+		expect(await b.plugins.cjsextra.count()).toBe(1);
+	});
+
+	if (config.typescript) {
+		it("gives each instance its own copy of a .ts leaf's .ts and .mjs helpers", async () => {
+			const a = await create();
+			const b = await create();
+			expect(await a.tsleaf.tsCount()).toBe(1);
+			expect(await a.tsleaf.tsCount()).toBe(2);
+			expect(await b.tsleaf.tsCount()).toBe(1);
+			expect(await a.tsleaf.count()).toBe(1);
+			expect(await b.tsleaf.count()).toBe(1);
+		});
+
+		it("shares one .mjs helper copy between .ts and .mjs leaves of the same instance", async () => {
+			const a = await create();
+			expect(await a.tally.count()).toBe(1);
+			expect(await a.tsleaf.count()).toBe(2);
+			expect(await a.peer.count()).toBe(3);
+		});
+
+		it("keeps a .ts leaf's helpers across a partial reload and refreshes them on a full reload", async () => {
+			const a = await create();
+			expect(await a.tsleaf.tsCount()).toBe(1);
+			expect(await a.tsleaf.tsCount()).toBe(2);
+			expect(await a.tsleaf.count()).toBe(1);
+			await a.slothlet.api.reload("tsleaf");
+			expect(await a.tsleaf.tsCount()).toBe(3);
+			expect(await a.tsleaf.count()).toBe(2);
+			await a.slothlet.reload();
+			expect(await a.tsleaf.tsCount()).toBe(1);
+			expect(await a.tsleaf.count()).toBe(1);
+		});
+	}
+});
+
+// Inside vitest the leaves load through vite's module graph (covered above, via the config's
+// slothletInstanceImports plugin). A real Node process exercises the other path: Node's own resolver
+// with slothlet's registered resolve hook, and require() for the .cjs leaves.
+describe("Isolation > helper imports per instance (#518) > native Node resolver", () => {
+	it("isolates every helper format per instance, keeps helpers across partial reloads, refreshes them on a full reload, and keeps bare imports shared", () => {
+		const result = spawnSync(process.execPath, [NATIVE_PROBE], { cwd: REPO_ROOT, env: process.env, encoding: "utf8", timeout: 120000 });
+		expect(result.status, result.stderr).toBe(0);
+		const out = JSON.parse(result.stdout.trim().split("\n").pop());
+		const expected = {
+			// a, a, b — each instance counts from 1.
+			esm: [1, 2, 1],
+			chain: [1, 2, 1],
+			nested: [1, 1],
+			// peer shares tally's helper copy within each instance.
+			peer: [3, 2],
+			// cjsleaf a, cjspeer a (same copy), cjsleaf b, then the second-level helper for a and b.
+			cjs: [1, 2, 1, 1, 1],
+			// .ts helper a, a, b; then the .mjs helper shared with tally/peer (a: 4th bump, b: 3rd).
+			ts: [1, 2, 1, 4, 3],
+			sharedRefs: true,
+			viaSelf: [5, 4],
+			// api.add leaves continue the base leaves' helper copies: .mjs (a: 6th, b: 5th) and .cjs
+			// (a: 3rd after cjsleaf + cjspeer, b: 2nd).
+			mount: [6, 5, 3, 2],
+			// After a's full reload (api.slothlet.reload()): tally, chain, cjs and .ts helpers restart;
+			// b is untouched.
+			afterFullReload: [1, 1, 1, 1, 6],
+			// After b's scoped reload of tally: b keeps its helper copy (tally 7th bump, chain 2nd);
+			// a is untouched.
+			afterScopedReload: [7, 2, 2],
+			// After b's reload of the plugins mount: the reloaded mount leaves and the base leaves still
+			// share b's .mjs and .cjs helper copies.
+			afterMountReload: [8, 9, 3, 4]
+		};
+		expect(out.eager).toEqual(expected);
+		expect(out.lazy).toEqual(expected);
+	}, 150000);
+});
diff --git a/types/src/lib/helpers/instance-imports.d.mts b/types/src/lib/helpers/instance-imports.d.mts
new file mode 100644
index 000000000..f1b72794e
--- /dev/null
+++ b/types/src/lib/helpers/instance-imports.d.mts
@@ -0,0 +1,144 @@
+/**
+ * Whether a specifier names a file relative to (or absolute from) its importer, as opposed to a
+ * bare package/builtin/subpath-import specifier.
+ * @param {string} specifier - The import/require specifier as written.
+ * @returns {boolean} True for `./`, `../`, `/` and `file:` specifiers.
+ * @internal
+ * @example
+ * isFileSpecifier("../lib/state.mjs"); // true
+ * isFileSpecifier("@cldmv/slothlet/runtime"); // false
+ */
+export function isFileSpecifier(specifier: string): boolean;
+/**
+ * Whether a module resolved at `child` (imported from `parent`) belongs to the importing leaf's
+ * per-instance graph. Slothlet's own files are always shared. A file inside a `node_modules`
+ * package is per instance only when the importer lives in that same package — a slothlet plugin
+ * installed as a dependency keeps its own helpers per instance, while a relative path that
+ * reaches into some other package does not duplicate that package.
+ * @param {string} child - Resolved child (`file:` URL, path or vite id).
+ * @param {string} parent - The importer (`file:` URL, path or vite id).
+ * @returns {boolean} True when the child should carry the parent's instance query.
+ * @internal
+ * @example
+ * isInstanceScopedFile("/app/lib/state.mjs", "/app/api/tally.mjs"); // true
+ * isInstanceScopedFile("/app/node_modules/x/index.js", "/app/api/tally.mjs"); // false
+ */
+export function isInstanceScopedFile(child: string, parent: string): boolean;
+/**
+ * Copy the slothlet instance query from `parent` onto `child` when the import belongs to the
+ * leaf's per-instance graph; otherwise return `child` unchanged. Works on `file:` URLs (Node) and
+ * on vite ids (absolute paths with an optional query) alike.
+ * @param {string} specifier - The specifier as written in the importer.
+ * @param {string|undefined} parent - The importer's URL or id.
+ * @param {string} child - The resolved child URL or id.
+ * @returns {string} `child`, with the instance query appended when it applies.
+ * @internal
+ * @example
+ * propagateInstanceQuery("../lib/state.mjs", "file:///app/api/tally.mjs?slothlet_instance=a", "file:///app/lib/state.mjs");
+ * // → "file:///app/lib/state.mjs?slothlet_instance=a"
+ */
+export function propagateInstanceQuery(specifier: string, parent: string | undefined, child: string): string;
+/**
+ * Register the resolve hook with Node, once per process (idempotent across slothlet copies).
+ * Uses the synchronous in-thread `module.registerHooks()` (Node >= 22.15 / 23.5, slothlet's engines
+ * floor). The off-thread `module.register()` is deliberately not used: it adds a cross-thread round
+ * trip to every import in the process and reorders module evaluation enough to break leaves that
+ * start a fire-and-forget runtime import. A host without `registerHooks()` is left untouched.
+ * @param {object} nodeModule - The `node:module` namespace.
+ * @param {object} [registry=globalThis] - Where the process-wide "registered" flag lives; the global
+ *   object in production, so every slothlet copy in the process sees one registration.
+ * @returns {boolean} True when a hook is (now or already) registered.
+ * @internal
+ * @example
+ * installInstanceImportHooks(await import("node:module"));
+ */
+export function installInstanceImportHooks(nodeModule: object, registry?: object): boolean;
+/**
+ * Vite plugin applying the same rule inside a vite module graph — for leaves a consumer loads
+ * through slothlet's `import` hook under vitest (docs/TESTING.md), where Node's resolve hooks
+ * never see the leaf's imports. Add it to the consumer's `vitest.config` `plugins`.
+ * @returns {object} A vite plugin (`name`, `enforce`, `resolveId`).
+ * @public
+ * @example
+ * // vitest.config.mjs
+ * import { slothletInstanceImports } from "@cldmv/slothlet/helpers/instance-imports";
+ * export default defineConfig({ plugins: [slothletInstanceImports()] });
+ */
+export function slothletInstanceImports(): object;
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /src/lib/helpers/instance-imports.mjs
+ *	@Date: 2026-09-28 20:32:55 -07:00 (1790652775)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 20:55:29 -07:00 (1790654129)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+/**
+ * @fileoverview Carry a leaf's per-instance import query onto the relative helpers it imports (#518).
+ * @module @cldmv/slothlet/helpers/instance-imports
+ *
+ * @description
+ * The loader imports every leaf with a per-instance query
+ * (`?slothlet_instance=<id>[&module=<moduleID>][&_reload=<timestamp>]`), so each instance — and each
+ * reload — evaluates its own copy of the leaf. A module the leaf IMPORTS is resolved by the host,
+ * which knows nothing about that query: a relative helper would be one module shared by every
+ * instance and every reload, and module-level state in it would leak between instances.
+ *
+ * This module closes that gap for everything reachable through relative or `file:` specifiers,
+ * at any depth:
+ *
+ * - **Native Node** — {@link installInstanceImportHooks} registers a process-wide, in-thread resolve
+ *   hook (`module.registerHooks()`, Node >= 22.15 — slothlet's engines floor) that copies the
+ *   importing module's instance parameter onto the child. Registered once per process; a no-op
+ *   for every import whose parent carries no slothlet query.
+ * - **Vite / vitest** — {@link slothletInstanceImports} is the same rule as a vite `resolveId`
+ *   plugin, for leaves loaded through a consumer's `import` hook into a vite module graph (where
+ *   Node's resolve hooks never run).
+ *
+ * A helper is ONE copy per instance. Only `slothlet_instance` is copied: not the leaf's `module`
+ * (mount) parameter, so the base leaves and every `api.slothlet.api.add` mount share the copy; and
+ * not the leaf's `_reload` stamp, so a partial reload (`api.slothlet.api.reload(…)`) re-imports the
+ * reloaded leaves against the instance's existing helper copy — helper state survives it. A full
+ * reload (`api.slothlet.reload()`) rotates the instance ID, which is what gives helpers a fresh
+ * copy; edits to helper code therefore need a full reload.
+ *
+ * What stays shared: bare specifiers (`node_modules` packages, `node:` builtins, subpath `#imports`,
+ * `@cldmv/slothlet` and its runtime), any file inside a `node_modules` package other than the
+ * importer's own, and slothlet's own source files — the live-binding runtime must remain one
+ * module per process.
+ */
+/**
+ * Query parameters copied from a leaf onto its helpers: the instance only. The leaf's `module`
+ * (mount) and `_reload` (partial-reload stamp) parameters are deliberately NOT copied — a helper is
+ * one copy per instance, shared by every mount and kept across partial reloads; a full reload
+ * rotates the instance ID and so yields a fresh copy.
+ * @type {ReadonlyArray<string>}
+ * @internal
+ */
+export const INSTANCE_QUERY_KEYS: ReadonlyArray<string>;
+/**
+ * Resolve-result shape shared by Node's resolve hooks.
+ */
+export type ResolveResult = {
+    /**
+     * - The resolved module URL.
+     */
+    url: string;
+    /**
+     * - The module format hint.
+     */
+    format?: string | undefined;
+    /**
+     * - Whether the chain was short-circuited.
+     */
+    shortCircuit?: boolean | undefined;
+};
+/**
+ * Node's next-in-chain resolve function.
+ */
+export type NextResolve = (specifier: string, context?: object | undefined) => ResolveResult | Promise<ResolveResult>;
+//# sourceMappingURL=instance-imports.d.mts.map
\ No newline at end of file
diff --git a/types/src/lib/helpers/instance-imports.d.mts.map b/types/src/lib/helpers/instance-imports.d.mts.map
new file mode 100644
index 000000000..9eb720364
--- /dev/null
+++ b/types/src/lib/helpers/instance-imports.d.mts.map
@@ -0,0 +1 @@
+{"version":3,"file":"instance-imports.d.mts","sourceRoot":"","sources":["../../../../src/lib/helpers/instance-imports.mjs"],"names":[],"mappings":"AAsFA;;;;;;;;;GASG;AACH,2CAPW,MAAM,GACJ,OAAO,CAWnB;AAiCD;;;;;;;;;;;;;GAaG;AACH,4CARW,MAAM,UACN,MAAM,GACJ,OAAO,CAWnB;AAED;;;;;;;;;;;;GAYG;AACH,kDATW,MAAM,UACN,MAAM,GAAC,SAAS,SAChB,MAAM,GACJ,MAAM,CAsBlB;AA8CD;;;;;;;;;;;;;GAaG;AACH,uDARW,MAAM,aACN,MAAM,GAEJ,OAAO,CAgBnB;AAED;;;;;;;;;;GAUG;AACH,2CAPa,MAAM,CA0BlB;AA/RD;;;;;;;;;;;GAWG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH;;;;;;;GAOG;AACH,kCAHU,aAAa,CAAC,MAAM,CAAC,CAGyC;;;;;;;;SAkJ1D,MAAM;;;;;;;;;;;;;sCAST,MAAM,mCAEJ,aAAa,GAAC,OAAO,CAAC,aAAa,CAAC"}
\ No newline at end of file
diff --git a/types/src/lib/processors/loader.d.mts.map b/types/src/lib/processors/loader.d.mts.map
index b87fe12be..5db6cf89d 100644
--- a/types/src/lib/processors/loader.d.mts.map
+++ b/types/src/lib/processors/loader.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"loader.d.mts","sourceRoot":"","sources":["../../../../src/lib/processors/loader.mjs"],"names":[],"mappings":"AA4DA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,sDAjBW,MAAM,6BAEd;IAAqC,MAAM,GAAnC,MAAM,GAAC,SAAS;IACI,YAAY;CAExC,GAAU,OAAO,CAmBnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,gDAZG;IAAqC,MAAM,GAAnC,MAAM,GAAC,SAAS;IACG,GAAG;CAC9B,GAAU,OAAO,CAanB;AAED;;;;;;;;;;;;GAYG;AACH,mDAVW,MAAM,cACN,MAAM,GACJ,OAAO,CAYnB;AAED;;;;;;;;;;;;GAYG;AACH,uDAVW,MAAM,cACN,MAAM,GACJ,OAAO,CAcnB;AAwDD;;;;;GAKG;AACH;;;;;;;;;;GAUG;AACH,4CALa,MAAM,CAOlB;AAED;IACC,gCAAmC;IASnC;;;;OAIG;IACH,sBAHW,MAAM,EAKhB;IAED;;;;;;;;OAQG;IACH,4BAPW,MAAM,eACN,MAAM,aACN,MAAM,cACN,MAAM,GAAC,IAAI,GACT,OAAO,CAAC,MAAM,CAAC,CAiN3B;IA+JD;;;;;;;;;;;;;;OAcG;IACH,0BAbW,MAAM,YAEd;QAA0B,UAAU;QACX,YAAY;QACZ,QAAQ;QACD,UAAU;QACM,MAAM;QAE5B,iBAAiB;QAClB,OAAO;KAChC,GAAU,OAAO,CAAC,MAAM,CAAC,CAqJ3B;IA8PD;;;;;OAKG;IACH,8BAJW,MAAM,GACJ,MAAM,CA+ClB;;CACD;8BApiC6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"loader.d.mts","sourceRoot":"","sources":["../../../../src/lib/processors/loader.mjs"],"names":[],"mappings":"AA6DA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,sDAjBW,MAAM,6BAEd;IAAqC,MAAM,GAAnC,MAAM,GAAC,SAAS;IACI,YAAY;CAExC,GAAU,OAAO,CAmBnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,gDAZG;IAAqC,MAAM,GAAnC,MAAM,GAAC,SAAS;IACG,GAAG;CAC9B,GAAU,OAAO,CAanB;AAED;;;;;;;;;;;;GAYG;AACH,mDAVW,MAAM,cACN,MAAM,GACJ,OAAO,CAYnB;AAED;;;;;;;;;;;;GAYG;AACH,uDAVW,MAAM,cACN,MAAM,GACJ,OAAO,CAcnB;AAwDD;;;;;GAKG;AACH;;;;;;;;;;GAUG;AACH,4CALa,MAAM,CAOlB;AAsBD;IACC,gCAAmC;IASnC;;;;OAIG;IACH,sBAHW,MAAM,EAKhB;IAED;;;;;;;;OAQG;IACH,4BAPW,MAAM,eACN,MAAM,aACN,MAAM,cACN,MAAM,GAAC,IAAI,GACT,OAAO,CAAC,MAAM,CAAC,CAsN3B;IAoMD;;;;;;;;;;;;;;OAcG;IACH,0BAbW,MAAM,YAEd;QAA0B,UAAU;QACX,YAAY;QACZ,QAAQ;QACD,UAAU;QACM,MAAM;QAE5B,iBAAiB;QAClB,OAAO;KAChC,GAAU,OAAO,CAAC,MAAM,CAAC,CAqJ3B;IA8PD;;;;;OAKG;IACH,8BAJW,MAAM,GACJ,MAAM,CA+ClB;;CACD;8BAnmC6B,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/slothlet.d.mts.map b/types/src/slothlet.d.mts.map
index a2042b6b2..d830d9277 100644
--- a/types/src/slothlet.d.mts.map
+++ b/types/src/slothlet.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"slothlet.d.mts","sourceRoot":"","sources":["../../src/slothlet.mjs"],"names":[],"mappings":"AAq8CA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,yBApCuB,CAAC,SAAX,MAAQ,6DAGV,eAAe,GACb,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,CAsCpC;;kBASS,QAAQ,CAAC;QAAC,QAAQ,EAAE,aAAa,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAC,CAAC,CAAC;QAAC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;KAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAgD3F,SAAS,GAAC,MAAM;;;;;;;;;;;;qBAEP,MAAM;iBAAO,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA8BhB,MAAM;eAAS,CAAC,QAAQ,GAAC,SAAS,GAAC,UAAU,GAAC,SAAS,CAAC;oBAAc,OAAO;gBAAU,CAAC,OAAO,GAAC,OAAO,CAAC;kBAAY,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAevI,KAAK,CAAC;YAAC,IAAI,EAAC,MAAM,CAAC;YAAA,IAAI,EAAC,MAAM,CAAC;YAAA,QAAQ,EAAC,MAAM,CAAA;SAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aA8BxD,MAAY,IAAI;;;;cAChB,MAAY,IAAI;;;;cAE3B;QAAgE,GAAG,EAAxD,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAC,SAAS,CAAC,CAAC;QACzB,GAAG,EAC/B;YAAkC,GAAG;YACH,MAAM;YACN,MAAM;YACN,MAAM;YACR,OAAO,EACvC;gBAA0C,QAAQ;gBACR,IAAI;gBACJ,SAAS;gBACT,UAAU;gBACV,YAAY;gBACZ,aAAa;gBACb,iBAAiB;gBACjB,mBAAmB;gBACnB,cAAc;aACxD;SAAA;QAA4B,OAAO,EACnC;YAAsC,GAAG;YACO,OAAO,EAA5C,MAAY,MAAM;YACS,GAAG;YACH,KAAK;YACL,GAAG;SACzC;QAA6B,IAAI;;;;;;;;6BAEV,MAAM;;;;yCACN,MAAM,EAAE;;;;;;;;;;;;;;;;;4BAIR,MAAM;;;;kCACN,MAAM;;;;;;;;6BAEN,MAAM;;;;;;;;;;;;;;;;;qCAIN,eAAe;;QACV,IAAI,EAChC;YAAmC,KAAK;YACL,OAAO;YACP,cAAc;YACd,MAAM;YACN,aAAa;YACb,IAAI;YACJ,GAAG;YACH,EAAE;YACJ,GAAG,EACpC;gBAAsC,OAAO,EAAlC,OAAO;gBACqB,MAAM;gBACN,OAAO;aAC9C;YAAmC,MAAM;YACN,kBAAkB;SACrD;QAA4B,KAAK,EACjC;YAAoC,EAAE;YACF,IAAI;YACJ,GAAG;YACH,IAAI;YACJ,YAAY;YACd,KAAK,EACvC;gBAA0C,GAAG;gBACH,MAAM;aAChD;YAAoC,QAAQ;YACR,OAAO;SAC3C;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,EAAE;SAC1C;QAA4B,WAAW,EACvC;YAAoD,GAAG,EAA5C,MAAY,MAAM;YACY,YAAY,EAA1C,OAAO;YAC0C,IAAI,EAArD,MAAY,OAAO,CAAE,IAAI,CAAC;SACrC;QAA4B,QAAQ,EACpC;YAAsD,MAAM,EAAjD,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,MAAM;YACN,SAAS;YACM,IAAI,EAA/C,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,SAAS;SAChD;QAA4B,KAAK,EACjC;YAAoC,GAAG;SACvC;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,UAAU;SAClD;QAA4B,WAAW,EACvC;YAAwC,OAAO,EAC/C;gBAAiD,OAAO,EAA7C,OAAO;gBACwC,MAAM,EAArD,MAAY,IAAI;gBAC+B,OAAO,EAAtD,MAAY,IAAI;gBACsB,iBAAiB,EAAvD,OAAO;gBAC+C,UAAU,EAAhE,CAAS,IAAO,EAAP,OAAO,KAAG,IAAI;gBACwB,IAAI,EAAnD,MAAY,IAAI;gBACsB,MAAM,EAA5C,OAAO;aAClB;SAAA;QAA4B,UAAU,EACtC;YAAyC,IAAI;YACJ,UAAU;YACV,UAAU;YACV,kBAAkB;YAClB,kBAAkB;SAC3D;QAA8B,UAAU;QACV,IAAI;QACL,SAAS;QACR,MAAM;QACN,GAAG;QACH,KAAK;QACa,QAAQ,EAA7C,MAAY,OAAO,CAAE,IAAI,CAAC;KACvC;;gCA/oD6D,wBAAwB"}
\ No newline at end of file
+{"version":3,"file":"slothlet.d.mts","sourceRoot":"","sources":["../../src/slothlet.mjs"],"names":[],"mappings":"AA08CA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,yBApCuB,CAAC,SAAX,MAAQ,6DAGV,eAAe,GACb,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,CAsCpC;;kBASS,QAAQ,CAAC;QAAC,QAAQ,EAAE,aAAa,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAC,CAAC,CAAC;QAAC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;KAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAgD3F,SAAS,GAAC,MAAM;;;;;;;;;;;;qBAEP,MAAM;iBAAO,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA8BhB,MAAM;eAAS,CAAC,QAAQ,GAAC,SAAS,GAAC,UAAU,GAAC,SAAS,CAAC;oBAAc,OAAO;gBAAU,CAAC,OAAO,GAAC,OAAO,CAAC;kBAAY,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAevI,KAAK,CAAC;YAAC,IAAI,EAAC,MAAM,CAAC;YAAA,IAAI,EAAC,MAAM,CAAC;YAAA,QAAQ,EAAC,MAAM,CAAA;SAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aA8BxD,MAAY,IAAI;;;;cAChB,MAAY,IAAI;;;;cAE3B;QAAgE,GAAG,EAAxD,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAC,SAAS,CAAC,CAAC;QACzB,GAAG,EAC/B;YAAkC,GAAG;YACH,MAAM;YACN,MAAM;YACN,MAAM;YACR,OAAO,EACvC;gBAA0C,QAAQ;gBACR,IAAI;gBACJ,SAAS;gBACT,UAAU;gBACV,YAAY;gBACZ,aAAa;gBACb,iBAAiB;gBACjB,mBAAmB;gBACnB,cAAc;aACxD;SAAA;QAA4B,OAAO,EACnC;YAAsC,GAAG;YACO,OAAO,EAA5C,MAAY,MAAM;YACS,GAAG;YACH,KAAK;YACL,GAAG;SACzC;QAA6B,IAAI;;;;;;;;6BAEV,MAAM;;;;yCACN,MAAM,EAAE;;;;;;;;;;;;;;;;;4BAIR,MAAM;;;;kCACN,MAAM;;;;;;;;6BAEN,MAAM;;;;;;;;;;;;;;;;;qCAIN,eAAe;;QACV,IAAI,EAChC;YAAmC,KAAK;YACL,OAAO;YACP,cAAc;YACd,MAAM;YACN,aAAa;YACb,IAAI;YACJ,GAAG;YACH,EAAE;YACJ,GAAG,EACpC;gBAAsC,OAAO,EAAlC,OAAO;gBACqB,MAAM;gBACN,OAAO;aAC9C;YAAmC,MAAM;YACN,kBAAkB;SACrD;QAA4B,KAAK,EACjC;YAAoC,EAAE;YACF,IAAI;YACJ,GAAG;YACH,IAAI;YACJ,YAAY;YACd,KAAK,EACvC;gBAA0C,GAAG;gBACH,MAAM;aAChD;YAAoC,QAAQ;YACR,OAAO;SAC3C;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,EAAE;SAC1C;QAA4B,WAAW,EACvC;YAAoD,GAAG,EAA5C,MAAY,MAAM;YACY,YAAY,EAA1C,OAAO;YAC0C,IAAI,EAArD,MAAY,OAAO,CAAE,IAAI,CAAC;SACrC;QAA4B,QAAQ,EACpC;YAAsD,MAAM,EAAjD,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,MAAM;YACN,SAAS;YACM,IAAI,EAA/C,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,SAAS;SAChD;QAA4B,KAAK,EACjC;YAAoC,GAAG;SACvC;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,UAAU;SAClD;QAA4B,WAAW,EACvC;YAAwC,OAAO,EAC/C;gBAAiD,OAAO,EAA7C,OAAO;gBACwC,MAAM,EAArD,MAAY,IAAI;gBAC+B,OAAO,EAAtD,MAAY,IAAI;gBACsB,iBAAiB,EAAvD,OAAO;gBAC+C,UAAU,EAAhE,CAAS,IAAO,EAAP,OAAO,KAAG,IAAI;gBACwB,IAAI,EAAnD,MAAY,IAAI;gBACsB,MAAM,EAA5C,OAAO;aAClB;SAAA;QAA4B,UAAU,EACtC;YAAyC,IAAI;YACJ,UAAU;YACV,UAAU;YACV,kBAAkB;YAClB,kBAAkB;SAC3D;QAA8B,UAAU;QACV,IAAI;QACL,SAAS;QACR,MAAM;QACN,GAAG;QACH,KAAK;QACa,QAAQ,EAA7C,MAAY,OAAO,CAAE,IAAI,CAAC;KACvC;;gCAppD6D,wBAAwB"}
\ No newline at end of file

From 0e0bab70b9d5459d23f7b85fe1d48daba6147ecb Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Tue, 29 Sep 2026 00:49:24 -0700
Subject: [PATCH 36/49] fix(api-manager): restore an overwritten namespace into
 its live wrappers when the overwriting module is removed

Removing a module that forceOverwrite-replaced part of another module's mount
rolled each co-owned path back by writing the surviving owner's impl onto the
live wrapper. A namespace's children live on the wrapper, not in its impl,
which is depleted once they are adopted and still null while a lazy wrapper is
unmaterialized. In lazy mode the overwriting module's namespace wrapper was
unmaterialized when the rollback ran, so it was marked materialized with an
empty impl and the overwritten module's nested leaves (launcher.session.vault
.lock) were lost or overflowed the stack when reached. Deleting the removed
module's sole-owned descendants first also pruned the emptied namespace off
the tree before its rollback could run.

The moduleID removal now restores, before deleting anything and
shallow-first, the surviving owners' content INTO the live wrapper at each
rolled-back path: the live wrapper and the surviving contributions the
overwrite detached are materialized, the impl is restored, and each child is
reconciled recursively. A child the live wrapper also has is restored into
the live child, so references taken while the overwriting module was live
keep working and run the restored code; a child only the surviving owners
have is re-attached; a live child ownership records as the removed
module's, with no surviving owner, is dropped, and any other live child is
kept. A value set on the namespace by hand belongs to neither module and is
kept verbatim, detected the way a selective reload detects the custom
properties it carries across (_collectCustomProperties). Keys are laid out
in the surviving owners' order, then the kept live keys, then the hand-set
values, so the namespace reads as it did before the overwrite. Deletions
under a restored path are left to the restore.

Fixes #531
---
 .../base/core/alpha.mjs                       |  25 +++
 .../ext/main.mjs                              |  25 +++
 .../ext/session/store.mjs                     |  33 ++++
 .../ext/session/vault/lock.mjs                |  25 +++
 .../shadow/store.mjs                          |  33 ++++
 .../shadow/vault/lock.mjs                     |  25 +++
 .../third/extra.mjs                           |  25 +++
 src/lib/handlers/api-manager.mjs              | 143 +++++++++++++-
 ...r-remove-overwrite-restore.test.vitest.mjs | 182 ++++++++++++++++++
 types/src/lib/handlers/api-manager.d.mts.map  |   2 +-
 10 files changed, 514 insertions(+), 4 deletions(-)
 create mode 100644 api_tests/api_test_lazy_remove_overwrite/base/core/alpha.mjs
 create mode 100644 api_tests/api_test_lazy_remove_overwrite/ext/main.mjs
 create mode 100644 api_tests/api_test_lazy_remove_overwrite/ext/session/store.mjs
 create mode 100644 api_tests/api_test_lazy_remove_overwrite/ext/session/vault/lock.mjs
 create mode 100644 api_tests/api_test_lazy_remove_overwrite/shadow/store.mjs
 create mode 100644 api_tests/api_test_lazy_remove_overwrite/shadow/vault/lock.mjs
 create mode 100644 api_tests/api_test_lazy_remove_overwrite/third/extra.mjs
 create mode 100644 tests/vitests/suites/api-manager/api-manager-remove-overwrite-restore.test.vitest.mjs

diff --git a/api_tests/api_test_lazy_remove_overwrite/base/core/alpha.mjs b/api_tests/api_test_lazy_remove_overwrite/base/core/alpha.mjs
new file mode 100644
index 000000000..8e18cdeec
--- /dev/null
+++ b/api_tests/api_test_lazy_remove_overwrite/base/core/alpha.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_lazy_remove_overwrite/base/core/alpha.mjs
+ *	@Date: 2026-09-28 21:58:00 -07:00 (1790657880)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-29 00:19:48 -07:00 (1790666388)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Base-module leaf, untouched by the overwriting add (#524).
+ * @module api_test_force_overwrite_ownership
+ */
+
+/**
+ * Return a marker identifying which module's implementation ran.
+ * @returns {string} Marker string.
+ */
+export function ping() {
+	return "base-ping";
+}
diff --git a/api_tests/api_test_lazy_remove_overwrite/ext/main.mjs b/api_tests/api_test_lazy_remove_overwrite/ext/main.mjs
new file mode 100644
index 000000000..b39d2300f
--- /dev/null
+++ b/api_tests/api_test_lazy_remove_overwrite/ext/main.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_lazy_remove_overwrite/ext/main.mjs
+ *	@Date: 2026-09-28 21:58:00 -07:00 (1790657880)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-29 00:19:48 -07:00 (1790666388)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Original module's own leaf outside the overwritten path (#524).
+ * @module api_test_force_overwrite_ownership
+ */
+
+/**
+ * Return a marker identifying which module's implementation ran.
+ * @returns {string} Marker string.
+ */
+export function activate() {
+	return "ext-activate";
+}
diff --git a/api_tests/api_test_lazy_remove_overwrite/ext/session/store.mjs b/api_tests/api_test_lazy_remove_overwrite/ext/session/store.mjs
new file mode 100644
index 000000000..f03868d4d
--- /dev/null
+++ b/api_tests/api_test_lazy_remove_overwrite/ext/session/store.mjs
@@ -0,0 +1,33 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_lazy_remove_overwrite/ext/session/store.mjs
+ *	@Date: 2026-09-28 21:58:00 -07:00 (1790657880)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-29 00:19:48 -07:00 (1790666388)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Original module's leaves at the path the shadow module overwrites (#524).
+ * @module api_test_force_overwrite_ownership
+ */
+
+/**
+ * Return a marker identifying which module's implementation ran.
+ * @returns {string} Marker string.
+ */
+export function create() {
+	return "ext-create";
+}
+
+/**
+ * Return a marker identifying which module's implementation ran.
+ * @returns {string} Marker string.
+ */
+export function destroy() {
+	return "ext-destroy";
+}
diff --git a/api_tests/api_test_lazy_remove_overwrite/ext/session/vault/lock.mjs b/api_tests/api_test_lazy_remove_overwrite/ext/session/vault/lock.mjs
new file mode 100644
index 000000000..fe7554795
--- /dev/null
+++ b/api_tests/api_test_lazy_remove_overwrite/ext/session/vault/lock.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_lazy_remove_overwrite/ext/session/vault/lock.mjs
+ *	@Date: 2026-09-28 21:58:00 -07:00 (1790657880)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-29 00:19:49 -07:00 (1790666389)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Original module's nested leaf under the overwritten path (#524).
+ * @module api_test_force_overwrite_ownership
+ */
+
+/**
+ * Return a marker identifying which module's implementation ran.
+ * @returns {string} Marker string.
+ */
+export function open() {
+	return "ext-open";
+}
diff --git a/api_tests/api_test_lazy_remove_overwrite/shadow/store.mjs b/api_tests/api_test_lazy_remove_overwrite/shadow/store.mjs
new file mode 100644
index 000000000..44e862750
--- /dev/null
+++ b/api_tests/api_test_lazy_remove_overwrite/shadow/store.mjs
@@ -0,0 +1,33 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_lazy_remove_overwrite/shadow/store.mjs
+ *	@Date: 2026-09-28 21:58:00 -07:00 (1790657880)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-29 00:19:49 -07:00 (1790666389)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Shadow module's replacement leaves, added with forceOverwrite (#524).
+ * @module api_test_force_overwrite_ownership
+ */
+
+/**
+ * Return a marker identifying which module's implementation ran.
+ * @returns {string} Marker string.
+ */
+export function create() {
+	return "shadow-create";
+}
+
+/**
+ * Return a marker identifying which module's implementation ran.
+ * @returns {string} Marker string.
+ */
+export function destroy() {
+	return "shadow-destroy";
+}
diff --git a/api_tests/api_test_lazy_remove_overwrite/shadow/vault/lock.mjs b/api_tests/api_test_lazy_remove_overwrite/shadow/vault/lock.mjs
new file mode 100644
index 000000000..f0e43b906
--- /dev/null
+++ b/api_tests/api_test_lazy_remove_overwrite/shadow/vault/lock.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_lazy_remove_overwrite/shadow/vault/lock.mjs
+ *	@Date: 2026-09-28 21:58:00 -07:00 (1790657880)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-29 00:19:49 -07:00 (1790666389)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Shadow module's nested replacement leaf, added with forceOverwrite (#524).
+ * @module api_test_force_overwrite_ownership
+ */
+
+/**
+ * Return a marker identifying which module's implementation ran.
+ * @returns {string} Marker string.
+ */
+export function open() {
+	return "shadow-open";
+}
diff --git a/api_tests/api_test_lazy_remove_overwrite/third/extra.mjs b/api_tests/api_test_lazy_remove_overwrite/third/extra.mjs
new file mode 100644
index 000000000..eb4d4a577
--- /dev/null
+++ b/api_tests/api_test_lazy_remove_overwrite/third/extra.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_lazy_remove_overwrite/third/extra.mjs
+ *	@Date: 2026-09-28 23:35:31 -07:00 (1790663731)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-29 00:19:49 -07:00 (1790666389)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Third module's leaf, merged into the overwritten namespace after the overwrite (#531).
+ * @module api_test_lazy_remove_overwrite
+ */
+
+/**
+ * Return a marker identifying which module's implementation ran.
+ * @returns {string} Marker string.
+ */
+export function hello() {
+	return "third-hello";
+}
diff --git a/src/lib/handlers/api-manager.mjs b/src/lib/handlers/api-manager.mjs
index 837d25c60..cb73bd349 100644
--- a/src/lib/handlers/api-manager.mjs
+++ b/src/lib/handlers/api-manager.mjs
@@ -2842,6 +2842,120 @@ export class ApiManager extends ComponentBase {
 		return false;
 	}
 
+	/**
+	 * The wrappers the modules still owning `apiPath` contributed there, other than the live one (#531).
+	 * @param {string} apiPath - A rolled-back path.
+	 * @param {object} live - The live (raw) wrapper at `apiPath`.
+	 * @returns {object[]} Raw wrappers, in ownership order; empty when the live wrapper is the only one.
+	 * @private
+	 *
+	 * @description
+	 * A cross-module `replace` swaps a namespace's colliding children for the overwriting module's, which
+	 * detaches the overwritten module's wrappers from the live tree with their own children intact. They stay
+	 * reachable through the ownership stack, so a removal can restore their content from them. Merge-loss
+	 * entries are included: a namespace merged into another is flagged a loss against a lazy (callable)
+	 * wrapper, yet its children are live; the impl restored at the path still comes from the current owner.
+	 */
+	#survivingContributions(apiPath, live) {
+		const contributions = [];
+		for (const entry of this.slothlet.handlers.ownership.getPathHistory(apiPath)) {
+			const wrapper = resolveWrapper(entry.value);
+			if (wrapper && wrapper !== live && !contributions.includes(wrapper)) contributions.push(wrapper);
+		}
+		return contributions;
+	}
+
+	/**
+	 * Restore surviving contributions' content into a live wrapper, keeping the live wrapper itself (#531).
+	 * @param {object} live - The live (raw) wrapper at `apiPath`.
+	 * @param {object[]} sources - Surviving contributions at `apiPath` (raw wrappers), in ownership order.
+	 * @param {string} apiPath - The path being restored.
+	 * @param {{restored: Set<object>, removedPaths: Set<string>}} context - Live wrappers already restored
+	 *   during this removal, and every path the removed module owned.
+	 * @param {{impl: *, moduleID: (string|null)}} [target] - The impl and owner to restore at `apiPath`;
+	 *   defaults to the last source's.
+	 * @returns {Promise<void>}
+	 * @private
+	 *
+	 * @description
+	 * Rolling back only the impl (`___setImpl`) cannot restore a namespace: its children live on the
+	 * wrapper, not in its impl — which is depleted once they are adopted, and still `null` while a lazy
+	 * wrapper is unmaterialized. In lazy mode that left the live namespace empty and every leaf beneath it
+	 * unreachable. So the live wrapper and the sources are materialized, the impl is restored, and each
+	 * child is reconciled recursively: a key the live wrapper also has is restored INTO the live child, so
+	 * a reference taken to it while the overwriting module was live keeps working and now runs the restored
+	 * code; a key only the sources have is re-attached from them; a live key ownership records as the
+	 * removed module's, with no surviving owner, is dropped, and any other live key is kept. A value set on
+	 * the namespace by hand (a selective reload's custom property) is kept verbatim, whatever its key. Keys
+	 * are laid out in the sources' order, then the kept live keys, then the hand-set values, so the namespace
+	 * reads as it did before the overwrite.
+	 */
+	async #restoreInto(live, sources, apiPath, context, target = null) {
+		context.restored.add(live);
+		for (const wrapper of [live, ...sources]) {
+			if (wrapper.____slothletInternal.mode === "lazy" && !wrapper.____slothletInternal.state.materialized) {
+				await wrapper._materialize();
+			}
+		}
+		const childKeys = (wrapper) => Object.keys(wrapper).filter((key) => !key.startsWith("_"));
+		// Snapshot the live children first: ___setImpl re-adopts children from an impl that still carries
+		// them (a lazily materialized namespace's), building NEW child wrappers that would replace the live
+		// ones and drop any child another module merged in.
+		const liveChildren = new Map(childKeys(live).map((key) => [key, Object.getOwnPropertyDescriptor(live, key)]));
+		// Values set on the namespace by hand belong to neither module, so they are kept verbatim — detected
+		// exactly as a selective reload detects the custom properties it carries across (an empty fresh api:
+		// every plain or user-assigned value counts).
+		const customKeys = new Set(Object.keys(this._collectCustomProperties(live, {})));
+		const last = sources[sources.length - 1];
+		const impl = target ? target.impl : last.____slothletInternal.impl;
+		const moduleID = target ? target.moduleID : last.____slothletInternal.moduleID;
+		if (impl !== undefined) live.___setImpl(impl, moduleID);
+
+		const candidates = new Map();
+		for (const source of sources) {
+			for (const key of childKeys(source)) {
+				if (!candidates.has(key)) candidates.set(key, []);
+				candidates.get(key).push(source[key]);
+			}
+		}
+		const readOnly = (value) => ({ value, writable: false, enumerable: true, configurable: true });
+		const layout = [];
+		for (const [key, values] of candidates) {
+			if (customKeys.has(key)) continue;
+			const liveChild = liveChildren.get(key)?.value;
+			const liveChildRaw = resolveWrapper(liveChild);
+			if (!liveChildRaw) {
+				layout.push([key, readOnly(values[values.length - 1])]);
+				continue;
+			}
+			const childSources = [];
+			for (const value of values) {
+				const raw = resolveWrapper(value);
+				if (raw && raw !== liveChildRaw && !childSources.includes(raw)) childSources.push(raw);
+			}
+			if (childSources.length > 0 && !context.restored.has(liveChildRaw)) {
+				await this.#restoreInto(liveChildRaw, childSources, `${apiPath}.${key}`, context);
+			}
+			layout.push([key, readOnly(liveChild)]);
+		}
+		// Any other live child is kept unless ownership records it as the removed module's and no surviving
+		// module owns it; hand-set values go last, in their own order, with their own descriptors.
+		const ownership = this.slothlet.handlers.ownership;
+		const custom = [];
+		for (const [key, descriptor] of liveChildren) {
+			if (customKeys.has(key)) {
+				custom.push([key, descriptor]);
+				continue;
+			}
+			if (candidates.has(key)) continue;
+			const childPath = `${apiPath}.${key}`;
+			if (context.removedPaths.has(childPath) && !ownership.getCurrentOwner(childPath)) continue;
+			layout.push([key, descriptor]);
+		}
+		for (const key of childKeys(live)) delete live[key];
+		for (const [key, descriptor] of [...layout, ...custom]) Object.defineProperty(live, key, descriptor);
+	}
+
 	/**
 	 * Remove API modules at runtime.
 	 * @param {string} pathOrModuleId - An apiPath (dotted), a moduleID, or the composite `__metadata.moduleID`.
@@ -3248,8 +3362,31 @@ export class ApiManager extends ComponentBase {
 				return depthB - depthA; // Reverse sort for deep-to-shallow
 			});
 
+			// Restore the surviving owners' content INTO the live wrappers of each rolled-back path, before
+			// anything is deleted (#531). Shallow-first, so a namespace is restored before the paths beneath it.
+			// The whole subtree under a restored path is reconciled by that restore (the removed module's own
+			// children there are dropped), so the deletions below leave it alone: deletePath prunes an emptied
+			// ancestor, which took the rolled-back namespace itself off the tree before it could be restored.
+			pathsToRollback.sort((a, b) => a.apiPath.split(".").length - b.apiPath.split(".").length);
+			const restoredWrappers = new Set();
+			const restoreContext = { restored: restoredWrappers, removedPaths: new Set(uniquePaths) };
+			const restoredRoots = [];
+			for (const rollback of pathsToRollback) {
+				const { parts } = this.normalizeApiPath(rollback.apiPath);
+				const previousImpl = this.slothlet.handlers.ownership?.getCurrentValue?.(rollback.apiPath);
+				for (const tree of [this.slothlet.api, this.slothlet.boundApi]) {
+					const live = resolveWrapper(this.getValueAtPath(tree, parts));
+					if (!live || restoredWrappers.has(live)) continue;
+					const sources = this.#survivingContributions(rollback.apiPath, live);
+					if (sources.length === 0) continue;
+					await this.#restoreInto(live, sources, rollback.apiPath, restoreContext, { impl: previousImpl, moduleID: rollback.restoredTo });
+					restoredRoots.push(`${rollback.apiPath}.`);
+				}
+			}
+
 			// Delete paths with no owners
 			for (const removedPath of pathsToDelete) {
+				if (restoredRoots.some((prefix) => removedPath.startsWith(prefix))) continue;
 				const { parts } = this.normalizeApiPath(removedPath);
 				await this.deletePath(this.slothlet.api, parts);
 				await this.deletePath(this.slothlet.boundApi, parts);
@@ -3313,17 +3450,17 @@ export class ApiManager extends ComponentBase {
 				const previousImpl = this.slothlet.handlers.ownership?.getCurrentValue?.(rollback.apiPath);
 
 				if (previousImpl !== undefined) {
-					// Get the existing wrapper and update its _impl
+					// Get the existing wrapper and update its _impl — unless the restore above already did.
 					const existingWrapper = this.getValueAtPath(this.slothlet.api, parts);
 					const existingWrapperRaw = resolveWrapper(existingWrapper);
-					if (existingWrapperRaw) {
+					if (existingWrapperRaw && !restoredWrappers.has(existingWrapperRaw)) {
 						// Pass the restored moduleID for correct ownership tracking
 						existingWrapperRaw.___setImpl(previousImpl, rollback.restoredTo);
 					}
 					// Also update boundApi
 					const existingBoundWrapper = this.getValueAtPath(this.slothlet.boundApi, parts);
 					const existingBoundWrapperRaw = resolveWrapper(existingBoundWrapper);
-					if (existingBoundWrapperRaw) {
+					if (existingBoundWrapperRaw && !restoredWrappers.has(existingBoundWrapperRaw)) {
 						existingBoundWrapperRaw.___setImpl(previousImpl, rollback.restoredTo);
 					}
 				}
diff --git a/tests/vitests/suites/api-manager/api-manager-remove-overwrite-restore.test.vitest.mjs b/tests/vitests/suites/api-manager/api-manager-remove-overwrite-restore.test.vitest.mjs
new file mode 100644
index 000000000..ce2eccd1e
--- /dev/null
+++ b/tests/vitests/suites/api-manager/api-manager-remove-overwrite-restore.test.vitest.mjs
@@ -0,0 +1,182 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/api-manager/api-manager-remove-overwrite-restore.test.vitest.mjs
+ *	@Date: 2026-09-28 23:29:42 -07:00 (1790663382)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-29 00:23:56 -07:00 (1790666636)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Regression coverage (#531): removing a module that `forceOverwrite`-replaced part of another
+ * module's mount must restore the overwritten module's FULL subtree, in lazy mode exactly as in eager mode.
+ *
+ * `launcher` is added with `session/store.mjs` and `session/vault/lock.mjs`; `shadow` then replaces
+ * `launcher.session` with its own `store.mjs` and `vault/lock.mjs`. After `remove("shadow")`, every one of
+ * launcher's leaves must be reachable and run launcher's code again. Before the fix, lazy mode lost
+ * `launcher.session.vault.lock` entirely (or overflowed the stack reaching it): the rollback wrote the previous
+ * owner's impl onto shadow's still-unmaterialized namespace wrapper, which leaves a namespace empty — its
+ * children live on the wrapper, not in the impl — so launcher's nested leaves were never brought back.
+ * Eager is the control: its namespaces are already populated, so it restored correctly. The restore goes INTO
+ * the live wrappers, so a reference taken while `shadow` was live keeps working and runs launcher's code; a
+ * third module merged into the overwritten namespace keeps its content; values set on the namespace by hand
+ * are kept after the restored keys; and keys read in their pre-overwrite order — in both modes.
+ * @module tests/vitests/suites/api-manager/api-manager-remove-overwrite-restore
+ */
+
+process.env.SLOTHLET_INTERNAL_TEST_MODE = "true";
+
+import path from "node:path";
+import { describe, it, expect, afterEach } from "vitest";
+import slothlet from "@cldmv/slothlet";
+import { getMatrixConfigs, TEST_DIRS } from "../../setup/vitest-helper.mjs";
+
+const FIXTURES = path.join(path.dirname(TEST_DIRS.API_TEST), "api_test_lazy_remove_overwrite");
+const BASE = path.join(FIXTURES, "base"); // core/alpha.mjs: ping()
+const EXT = path.join(FIXTURES, "ext"); // main.mjs: activate(); session/store.mjs: create(), destroy(); session/vault/lock.mjs: open()
+const SHADOW = path.join(FIXTURES, "shadow"); // store.mjs: create(), destroy(); vault/lock.mjs: open()
+const THIRD = path.join(FIXTURES, "third"); // extra.mjs: hello()
+
+/**
+ * Call every leaf `launcher` provides, reporting a thrown error as `"ERR <message>"` instead of failing
+ * on the first one, so one assertion shows the whole restored surface.
+ * @param {object} api - Composed api.
+ * @returns {Promise<Object<string, string>>} Leaf name → return value (or error marker).
+ */
+async function callLauncherLeaves(api) {
+	const calls = {
+		create: () => api.launcher.session.store.create(),
+		destroy: () => api.launcher.session.store.destroy(),
+		open: () => api.launcher.session.vault.lock.open(),
+		activate: () => api.launcher.main.activate()
+	};
+	const results = {};
+	for (const [name, call] of Object.entries(calls)) {
+		try {
+			results[name] = await call();
+		} catch (error) {
+			results[name] = `ERR ${error.message}`;
+		}
+	}
+	return results;
+}
+
+const LAUNCHER_RESULTS = { create: "ext-create", destroy: "ext-destroy", open: "ext-open", activate: "ext-activate" };
+
+describe.each(getMatrixConfigs())("remove() of a forceOverwrite module restores the overwritten subtree (#531) > $name", ({ config }) => {
+	let api;
+
+	afterEach(async () => {
+		if (api?.shutdown) await api.shutdown();
+		api = null;
+	});
+
+	it("restores every overwritten leaf when the original leaves were never called", async () => {
+		api = await slothlet({ ...config, base: BASE, silent: true });
+		await api.slothlet.api.add("launcher", EXT, { moduleID: "launcher" });
+		await api.slothlet.api.add("launcher.session", SHADOW, { moduleID: "shadow", forceOverwrite: true });
+
+		expect(await api.slothlet.api.remove("shadow")).toBe(true);
+
+		expect(await callLauncherLeaves(api)).toEqual(LAUNCHER_RESULTS);
+		expect(Object.keys(api.launcher.session.vault)).toContain("lock");
+	});
+
+	it("restores every overwritten leaf when the original leaves were called before the overwrite", async () => {
+		api = await slothlet({ ...config, base: BASE, silent: true });
+		await api.slothlet.api.add("launcher", EXT, { moduleID: "launcher" });
+		expect(await callLauncherLeaves(api)).toEqual(LAUNCHER_RESULTS);
+		await api.slothlet.api.add("launcher.session", SHADOW, { moduleID: "shadow", forceOverwrite: true });
+
+		expect(await api.slothlet.api.remove("shadow")).toBe(true);
+
+		expect(await callLauncherLeaves(api)).toEqual(LAUNCHER_RESULTS);
+		expect(Object.keys(api.launcher.session.vault)).toContain("lock");
+	});
+
+	it("restores every overwritten leaf when the overwriting leaves were called before the remove", async () => {
+		api = await slothlet({ ...config, base: BASE, silent: true });
+		await api.slothlet.api.add("launcher", EXT, { moduleID: "launcher" });
+		await api.slothlet.api.add("launcher.session", SHADOW, { moduleID: "shadow", forceOverwrite: true });
+		expect([await api.launcher.session.store.create(), await api.launcher.session.vault.lock.open()]).toEqual([
+			"shadow-create",
+			"shadow-open"
+		]);
+
+		expect(await api.slothlet.api.remove("shadow")).toBe(true);
+
+		expect(await callLauncherLeaves(api)).toEqual(LAUNCHER_RESULTS);
+		expect(Object.keys(api.launcher.session.vault)).toContain("lock");
+	});
+
+	it("keeps a third module's content merged into the overwritten namespace alongside the restored leaves", async () => {
+		api = await slothlet({ ...config, base: BASE, silent: true });
+		await api.slothlet.api.add("launcher", EXT, { moduleID: "launcher" });
+		await api.slothlet.api.add("launcher.session", SHADOW, { moduleID: "shadow", forceOverwrite: true });
+		await api.slothlet.api.add("launcher.session.vault", THIRD, { moduleID: "third" });
+		expect(await api.launcher.session.vault.extra.hello()).toBe("third-hello");
+
+		expect(await api.slothlet.api.remove("shadow")).toBe(true);
+
+		expect(await callLauncherLeaves(api)).toEqual(LAUNCHER_RESULTS);
+		expect(await api.launcher.session.vault.extra.hello()).toBe("third-hello");
+		// launcher's key first, as before the overwrite, then the key the third module merged in.
+		expect(Object.keys(api.launcher.session.vault)).toEqual(["lock", "extra"]);
+		expect(Object.keys(api.launcher.session)).toEqual(["store", "vault"]);
+	});
+
+	it.each([
+		["the original leaves were never called", false],
+		["the original leaves were called before the overwrite", true]
+	])("keeps references taken while the overwriting module was live working when %s", async (_label, touchFirst) => {
+		api = await slothlet({ ...config, base: BASE, silent: true });
+		await api.slothlet.api.add("launcher", EXT, { moduleID: "launcher" });
+		if (touchFirst) expect(await callLauncherLeaves(api)).toEqual(LAUNCHER_RESULTS);
+		await api.slothlet.api.add("launcher.session", SHADOW, { moduleID: "shadow", forceOverwrite: true });
+
+		// Held while shadow is live: a namespace, a nested namespace, and a leaf.
+		const vault = api.launcher.session.vault;
+		const lock = vault.lock;
+		const open = lock.open;
+		const store = api.launcher.session.store;
+		const create = store.create;
+		expect([await open(), await create()]).toEqual(["shadow-open", "shadow-create"]);
+
+		expect(await api.slothlet.api.remove("shadow")).toBe(true);
+
+		// The held namespace is still the live node at its path. (Under lazy, the deeper references were taken
+		// through a not-yet-materialized parent and are waiting proxies, so only their behavior is comparable.)
+		// Every held reference now runs launcher's code.
+		expect(api.launcher.session.vault).toBe(vault);
+		if (config.mode === "eager") {
+			expect(api.launcher.session.vault.lock).toBe(lock);
+			expect(api.launcher.session.vault.lock.open).toBe(open);
+			expect(api.launcher.session.store.create).toBe(create);
+		}
+		expect([await open(), await lock.open(), await vault.lock.open()]).toEqual(["ext-open", "ext-open", "ext-open"]);
+		expect([await create(), await store.destroy()]).toEqual(["ext-create", "ext-destroy"]);
+		expect(Object.keys(vault)).toEqual(["lock"]);
+	});
+
+	it("keeps values set by hand on the overwritten namespace, after the restored keys", async () => {
+		api = await slothlet({ ...config, base: BASE, silent: true });
+		await api.slothlet.api.add("launcher", EXT, { moduleID: "launcher" });
+		await api.slothlet.api.add("launcher.session", SHADOW, { moduleID: "shadow", forceOverwrite: true });
+		const vault = api.launcher.session.vault;
+		// Reached first so a lazy namespace has materialized before the hand-set values land on it.
+		expect(await vault.lock.open()).toBe("shadow-open");
+		vault.note = "x";
+		vault.settings = { retries: 3 };
+
+		expect(await api.slothlet.api.remove("shadow")).toBe(true);
+
+		expect(api.launcher.session.vault.note).toBe("x");
+		expect(api.launcher.session.vault.settings.retries).toBe(3);
+		expect(Object.keys(api.launcher.session.vault)).toEqual(["lock", "note", "settings"]);
+		expect(await callLauncherLeaves(api)).toEqual(LAUNCHER_RESULTS);
+	});
+});
diff --git a/types/src/lib/handlers/api-manager.d.mts.map b/types/src/lib/handlers/api-manager.d.mts.map
index 5211d5c29..05254f4d9 100644
--- a/types/src/lib/handlers/api-manager.d.mts.map
+++ b/types/src/lib/handlers/api-manager.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"api-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/api-manager.mjs"],"names":[],"mappings":"AAgFA;;;;;;;;;;;;;;GAcG;AACH;IACC,gCAAuC;IAEvC;;;;;;;;;;;OAWG;IACH,sBAVW,MAAM,EAuBhB;IAXA,sIAAsI;IACtI,OADW;QAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,MAAM,GAAC,IAAI,CAAC;QAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;KAAE,CAUjI;IAGF;;;;;;;;;;;;;;;;;;OAkBG;IACH,yBA+GC;IAED;;;;;;;;;;;;;;OAcG;IACH,oBA4CC;IAED;;;;;;;;;;;;;;OAcG;IACH,0BA4BC;IAED;;;;;;;;;;;;OAYG;IACH,6BAIC;IAED;;;;;;;;;;;;OAYG;IACH,uBASC;IAED;;;;;;;;;;;;;OAaG;IACH,yBAkCC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,iCAbW,MAAM,SACN,OAAO,iBACP,MAAM,GAAC,IAAI,GACT,IAAI,CAqHhB;IAED;;;;;;;;;;;;;OAaG;IACH,uBAEC;IAED;;;;;;;;;;;;;;OAcG;IACH,oBAoVC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,8BAiCC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,sCAmBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,uBAyGC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,uBA6MC;IAED;;;;;;;;;;;;OAYG;IACH,mBAwHC;IACD;;;;;;;;;;;;OAYG;IACH,uBAsEC;IA6CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkDG;IACH,wBAhDG;QAAuB,OAAO,EAAtB,MAAM;QACmD,UAAU,EAAnE,MAAM,GAAC,MAAM,EAAE,cAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;QACf,OAAO;KAChD,GAAU,OAAO,CAAC,MAAM,GAAC,MAAM,EAAE,CAAC,CAs/BpC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,yEATG;QAAqB,QAAQ,EAArB,MAAM;QACO,aAAa,EAA1B,MAAM;QACO,cAAc,EAA3B,MAAM;KACd,GAAU,OAAO,CAAC,IAAI,CAAC,CAgDzB;IA8BD;;;;;;;;;;;OAWG;IACH,mCAeC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,mCA1BW,MAAM,YAEd;QAAyB,aAAa;QAGZ,aAAa;KACvC,GAAU,OAAO,CAAC,OAAO,CAAC,CAmoB5B;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,2BAdG;QAAwB,OAAO,EAAtB,MAAM,OAAA;QACS,QAAQ,EAAvB,MAAM,OAAA;KACf,GAAU,OAAO,CAAC,IAAI,CAAC,CAuCzB;IAED;;;;;;;;;;OAUG;IACH,0BA+EC;IAED;;;;;;;;;;;;;;OAcG;IACH,yBAsFC;IAED;;;;;;;;;;;;;OAaG;IACH,4BA0FC;IAED;;;;;;;;OAQG;IACH,iCAyDC;IAED;;;;;OAKG;IACH,iCAeC;IAED;;;;;;;;;;;;;OAaG;IACH,wBAoUC;;CACD;8BApoI6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"api-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/api-manager.mjs"],"names":[],"mappings":"AAgFA;;;;;;;;;;;;;;GAcG;AACH;IACC,gCAAuC;IAEvC;;;;;;;;;;;OAWG;IACH,sBAVW,MAAM,EAuBhB;IAXA,sIAAsI;IACtI,OADW;QAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,MAAM,GAAC,IAAI,CAAC;QAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;KAAE,CAUjI;IAGF;;;;;;;;;;;;;;;;;;OAkBG;IACH,yBA+GC;IAED;;;;;;;;;;;;;;OAcG;IACH,oBA4CC;IAED;;;;;;;;;;;;;;OAcG;IACH,0BA4BC;IAED;;;;;;;;;;;;OAYG;IACH,6BAIC;IAED;;;;;;;;;;;;OAYG;IACH,uBASC;IAED;;;;;;;;;;;;;OAaG;IACH,yBAkCC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,iCAbW,MAAM,SACN,OAAO,iBACP,MAAM,GAAC,IAAI,GACT,IAAI,CAqHhB;IAED;;;;;;;;;;;;;OAaG;IACH,uBAEC;IAED;;;;;;;;;;;;;;OAcG;IACH,oBAoVC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,8BAiCC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,sCAmBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,uBAyGC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,uBA6MC;IAED;;;;;;;;;;;;OAYG;IACH,mBAwHC;IACD;;;;;;;;;;;;OAYG;IACH,uBAsEC;IA6CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkDG;IACH,wBAhDG;QAAuB,OAAO,EAAtB,MAAM;QACmD,UAAU,EAAnE,MAAM,GAAC,MAAM,EAAE,cAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;QACf,OAAO;KAChD,GAAU,OAAO,CAAC,MAAM,GAAC,MAAM,EAAE,CAAC,CAs/BpC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,yEATG;QAAqB,QAAQ,EAArB,MAAM;QACO,aAAa,EAA1B,MAAM;QACO,cAAc,EAA3B,MAAM;KACd,GAAU,OAAO,CAAC,IAAI,CAAC,CAgDzB;IA8BD;;;;;;;;;;;OAWG;IACH,mCAeC;IAoHD;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,mCA1BW,MAAM,YAEd;QAAyB,aAAa;QAGZ,aAAa;KACvC,GAAU,OAAO,CAAC,OAAO,CAAC,CA0pB5B;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,2BAdG;QAAwB,OAAO,EAAtB,MAAM,OAAA;QACS,QAAQ,EAAvB,MAAM,OAAA;KACf,GAAU,OAAO,CAAC,IAAI,CAAC,CAuCzB;IAED;;;;;;;;;;OAUG;IACH,0BA+EC;IAED;;;;;;;;;;;;;;OAcG;IACH,yBAsFC;IAED;;;;;;;;;;;;;OAaG;IACH,4BA0FC;IAED;;;;;;;;OAQG;IACH,iCAyDC;IAED;;;;;OAKG;IACH,iCAeC;IAED;;;;;;;;;;;;;OAaG;IACH,wBAoUC;;CACD;8BA7wI6B,2BAA2B"}
\ No newline at end of file

From 9732e9e3144fc599dd4ecb5e6aef431c41e1aa35 Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Fri, 2 Oct 2026 10:09:05 -0700
Subject: [PATCH 37/49] fix(unified-wrapper): keep values assigned to a lazy
 namespace while its materialization is in flight

A value assigned to a lazy namespace (a primitive, a plain object or a
function) after its materialization had started but before it settled was
lost when the namespace carried the "replace" collision mode, as a namespace
placed by a forceOverwrite add does. Adopting the materialized impl under
"replace" treats every key already on the wrapper as a stale child of the
replaced content: it deletes them up front and never marks them observed, so
the assigned values were dropped along with any real stale children. A plain
namespace was unaffected only because its default merge mode keeps existing
keys.

The proxy's set trap now records every key assigned outside a build in the
wrapper's userAssignedKeys (the delete trap forgets it), and the replace
branch of ___adoptImplChildren keeps a key that is user-assigned, by that
record or as a wrap-on-set userAssigned wrapper, and marks it observed so
the final sweep leaves it too. Stale module children are still cleared.

Fixes #543
---
 .../base/core/alpha.mjs                       | 25 ++++++
 .../ext/session/store.mjs                     | 25 ++++++
 .../ext/session/vault/lock.mjs                | 25 ++++++
 .../shadow/store.mjs                          | 25 ++++++
 .../shadow/vault/lock.mjs                     | 25 ++++++
 src/lib/handlers/unified-wrapper.mjs          | 30 ++++++++
 ...azy-set-during-materialize.test.vitest.mjs | 77 +++++++++++++++++++
 types/src/lib/handlers/unified-wrapper.d.mts  |  9 +++
 .../lib/handlers/unified-wrapper.d.mts.map    |  2 +-
 9 files changed, 242 insertions(+), 1 deletion(-)
 create mode 100644 api_tests/api_test_lazy_set_materialize/base/core/alpha.mjs
 create mode 100644 api_tests/api_test_lazy_set_materialize/ext/session/store.mjs
 create mode 100644 api_tests/api_test_lazy_set_materialize/ext/session/vault/lock.mjs
 create mode 100644 api_tests/api_test_lazy_set_materialize/shadow/store.mjs
 create mode 100644 api_tests/api_test_lazy_set_materialize/shadow/vault/lock.mjs
 create mode 100644 tests/vitests/suites/lazy/lazy-set-during-materialize.test.vitest.mjs

diff --git a/api_tests/api_test_lazy_set_materialize/base/core/alpha.mjs b/api_tests/api_test_lazy_set_materialize/base/core/alpha.mjs
new file mode 100644
index 000000000..147e32f33
--- /dev/null
+++ b/api_tests/api_test_lazy_set_materialize/base/core/alpha.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_lazy_set_materialize/base/core/alpha.mjs
+ *	@Date: 2026-10-02 09:52:13 -07:00 (1790959933)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 09:57:55 -07:00 (1790960275)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Base-module leaf so the instance has a base tree (#543).
+ * @module api_test_lazy_set_materialize
+ */
+
+/**
+ * Return a marker identifying which module's implementation ran.
+ * @returns {string} Marker string.
+ */
+export function ping() {
+	return "base-ping";
+}
diff --git a/api_tests/api_test_lazy_set_materialize/ext/session/store.mjs b/api_tests/api_test_lazy_set_materialize/ext/session/store.mjs
new file mode 100644
index 000000000..8c111a7d4
--- /dev/null
+++ b/api_tests/api_test_lazy_set_materialize/ext/session/store.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_lazy_set_materialize/ext/session/store.mjs
+ *	@Date: 2026-10-02 09:52:13 -07:00 (1790959933)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 09:57:55 -07:00 (1790960275)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Module leaf used to materialize the session namespace first (#543).
+ * @module api_test_lazy_set_materialize
+ */
+
+/**
+ * Return a marker identifying which module's implementation ran.
+ * @returns {string} Marker string.
+ */
+export function create() {
+	return "ext-create";
+}
diff --git a/api_tests/api_test_lazy_set_materialize/ext/session/vault/lock.mjs b/api_tests/api_test_lazy_set_materialize/ext/session/vault/lock.mjs
new file mode 100644
index 000000000..27f344919
--- /dev/null
+++ b/api_tests/api_test_lazy_set_materialize/ext/session/vault/lock.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_lazy_set_materialize/ext/session/vault/lock.mjs
+ *	@Date: 2026-10-02 09:52:13 -07:00 (1790959933)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 09:57:55 -07:00 (1790960275)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Nested module leaf under the namespace values are set on (#543).
+ * @module api_test_lazy_set_materialize
+ */
+
+/**
+ * Return a marker identifying which module's implementation ran.
+ * @returns {string} Marker string.
+ */
+export function open() {
+	return "ext-open";
+}
diff --git a/api_tests/api_test_lazy_set_materialize/shadow/store.mjs b/api_tests/api_test_lazy_set_materialize/shadow/store.mjs
new file mode 100644
index 000000000..8bf99bec8
--- /dev/null
+++ b/api_tests/api_test_lazy_set_materialize/shadow/store.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_lazy_set_materialize/shadow/store.mjs
+ *	@Date: 2026-10-02 09:52:29 -07:00 (1790959949)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 09:57:55 -07:00 (1790960275)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Replacement leaf used to materialize the session namespace first (#543).
+ * @module api_test_lazy_set_materialize
+ */
+
+/**
+ * Return a marker identifying which module's implementation ran.
+ * @returns {string} Marker string.
+ */
+export function create() {
+	return "shadow-create";
+}
diff --git a/api_tests/api_test_lazy_set_materialize/shadow/vault/lock.mjs b/api_tests/api_test_lazy_set_materialize/shadow/vault/lock.mjs
new file mode 100644
index 000000000..69cb9afad
--- /dev/null
+++ b/api_tests/api_test_lazy_set_materialize/shadow/vault/lock.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_lazy_set_materialize/shadow/vault/lock.mjs
+ *	@Date: 2026-10-02 09:52:13 -07:00 (1790959933)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 09:57:55 -07:00 (1790960275)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Replacement nested leaf, added with forceOverwrite (#543).
+ * @module api_test_lazy_set_materialize
+ */
+
+/**
+ * Return a marker identifying which module's implementation ran.
+ * @returns {string} Marker string.
+ */
+export function open() {
+	return "shadow-open";
+}
diff --git a/src/lib/handlers/unified-wrapper.mjs b/src/lib/handlers/unified-wrapper.mjs
index 39bf9560a..2c2e8d00a 100644
--- a/src/lib/handlers/unified-wrapper.mjs
+++ b/src/lib/handlers/unified-wrapper.mjs
@@ -1844,6 +1844,19 @@ export class UnifiedWrapper extends ComponentBase {
 		}
 	}
 
+	/**
+	 * Whether the value at `key` on this wrapper was assigned by the user rather than adopted from a
+	 * module's impl (#543).
+	 * @param {string} key - Own child key.
+	 * @returns {boolean} True for a key assigned through the proxy outside a build (any value kind), or
+	 *   holding a wrap-on-set `userAssigned` wrapper.
+	 * @private
+	 */
+	___isUserAssignedKey(key) {
+		if (this.____slothletInternal.userAssignedKeys?.has(key)) return true;
+		return resolveWrapper(this[key])?.____slothletInternal?.userAssigned === true;
+	}
+
 	/**
 	 * @private
 	 * @returns {void}
@@ -1972,6 +1985,15 @@ export class UnifiedWrapper extends ComponentBase {
 			});
 
 			for (const key of existingKeys) {
+				// A value the user assigned onto this wrapper is not a stale child of the replaced content —
+				// it belongs to neither module (a lazy wrapper can be assigned to while its materialization is
+				// still in flight, and only then does this adoption run). Keep it, and mark it observed so the
+				// sweep below leaves it alone too (#543). A key the new impl also provides is still resolved
+				// by the per-key loop, which keeps a userAssigned wrapper over the module's value.
+				if (this.___isUserAssignedKey(key)) {
+					observedKeys.add(key);
+					continue;
+				}
 				const child = this[key];
 				if (resolveWrapper(child) !== null) {
 					savedChildren.set(key, child);
@@ -5160,6 +5182,12 @@ export class UnifiedWrapper extends ComponentBase {
 					enumerable: true,
 					configurable: true
 				});
+				// Remember a genuine user assignment by key, so adopting a (re)materialized impl never mistakes
+				// it for a stale module child and clears it (#543). Build-time scaffolding is not recorded.
+				if (!inBuild) {
+					if (!wrapper.____slothletInternal.userAssignedKeys) wrapper.____slothletInternal.userAssignedKeys = new Set();
+					wrapper.____slothletInternal.userAssignedKeys.add(prop);
+				}
 			} else {
 				// For internal properties, just assign directly
 				target[prop] = value;
@@ -5219,6 +5247,8 @@ export class UnifiedWrapper extends ComponentBase {
 
 			// If deleting a child wrapper, invalidate it
 			const isInternal = isFrameworkReservedKey(prop);
+			// A deleted key is no longer a user assignment to preserve across adoption (#543).
+			wrapper.____slothletInternal.userAssignedKeys?.delete(prop);
 			if (!isInternal && hasOwn(wrapper, prop)) {
 				const childWrapper = wrapper[prop];
 				const childWrapperRaw = resolveWrapper(childWrapper);
diff --git a/tests/vitests/suites/lazy/lazy-set-during-materialize.test.vitest.mjs b/tests/vitests/suites/lazy/lazy-set-during-materialize.test.vitest.mjs
new file mode 100644
index 000000000..dcc6c40a4
--- /dev/null
+++ b/tests/vitests/suites/lazy/lazy-set-during-materialize.test.vitest.mjs
@@ -0,0 +1,77 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/lazy/lazy-set-during-materialize.test.vitest.mjs
+ *	@Date: 2026-10-02 09:52:29 -07:00 (1790959949)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 09:59:17 -07:00 (1790960357)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Regression coverage (#543): a value assigned to a lazy namespace while its materialization is
+ * in flight must survive once the materialization settles, alongside the module's own children — whether the
+ * value is a primitive, a plain object or a function. Eager mode is the control (nothing is ever in flight).
+ *
+ * Two shapes: a plain namespace, and a namespace placed by a `forceOverwrite` add (its wrapper carries the
+ * "replace" collision mode). Before the fix the second lost every assigned value: adopting the materialized
+ * impl under "replace" clears the wrapper's existing keys as stale module children, and the assigned values
+ * were cleared with them.
+ * @module tests/vitests/suites/lazy/lazy-set-during-materialize
+ */
+
+process.env.SLOTHLET_INTERNAL_TEST_MODE = "true";
+
+import path from "node:path";
+import { describe, it, expect, afterEach } from "vitest";
+import slothlet from "@cldmv/slothlet";
+import { resolveWrapper } from "#handlers/unified-wrapper";
+import { getMatrixConfigs, TEST_DIRS } from "../../setup/vitest-helper.mjs";
+
+const FIXTURES = path.join(path.dirname(TEST_DIRS.API_TEST), "api_test_lazy_set_materialize");
+const BASE = path.join(FIXTURES, "base"); // core/alpha.mjs: ping()
+const EXT = path.join(FIXTURES, "ext"); // session/store.mjs: create(); session/vault/lock.mjs: open() => "ext-open"
+const SHADOW = path.join(FIXTURES, "shadow"); // store.mjs: create(); vault/lock.mjs: open() => "shadow-open"
+
+describe.each(getMatrixConfigs())("values set on a lazy namespace during its materialization (#543) > $name", ({ config }) => {
+	let api;
+
+	afterEach(async () => {
+		if (api?.shutdown) await api.shutdown();
+		api = null;
+	});
+
+	it.each([
+		["a plain namespace", false, "ext-open"],
+		["a namespace placed by a forceOverwrite add", true, "shadow-open"]
+	])("keeps a primitive, a plain object and a function set on %s while it materializes", async (_label, overwrite, lockResult) => {
+		api = await slothlet({ ...config, base: BASE, silent: true });
+		await api.slothlet.api.add("launcher", EXT, { moduleID: "launcher" });
+		if (overwrite) await api.slothlet.api.add("launcher.session", SHADOW, { moduleID: "shadow", forceOverwrite: true });
+		// Materialize the parent, so `vault` below is the namespace's own wrapper rather than a waiting proxy.
+		await api.launcher.session.store.create();
+
+		const vault = api.launcher.session.vault;
+		if (config.mode === "lazy") {
+			// Reading `vault` started its materialization; it has not settled yet.
+			expect(resolveWrapper(vault).____slothletInternal.state.inFlight).toBe(true);
+		}
+		const settings = { retries: 3 };
+		vault.note = "x";
+		vault.settings = settings;
+		vault.describe = () => "described";
+
+		// Settles the materialization.
+		expect(await vault.lock.open()).toBe(lockResult);
+
+		const settled = api.launcher.session.vault;
+		expect(settled.note).toBe("x");
+		expect(settled.settings.retries).toBe(3);
+		expect(await settled.describe()).toBe("described");
+		expect(Object.keys(settled)).toHaveLength(4);
+		expect(Object.keys(settled)).toEqual(expect.arrayContaining(["lock", "note", "settings", "describe"]));
+	});
+});
diff --git a/types/src/lib/handlers/unified-wrapper.d.mts b/types/src/lib/handlers/unified-wrapper.d.mts
index 8acf98b9b..533c25974 100644
--- a/types/src/lib/handlers/unified-wrapper.d.mts
+++ b/types/src/lib/handlers/unified-wrapper.d.mts
@@ -243,6 +243,15 @@ export class UnifiedWrapper extends ComponentBase {
      * wrapper.___invalidate();
      */
     private ___invalidate;
+    /**
+     * Whether the value at `key` on this wrapper was assigned by the user rather than adopted from a
+     * module's impl (#543).
+     * @param {string} key - Own child key.
+     * @returns {boolean} True for a key assigned through the proxy outside a build (any value kind), or
+     *   holding a wrap-on-set `userAssigned` wrapper.
+     * @private
+     */
+    private ___isUserAssignedKey;
     /**
      * @private
      * @returns {void}
diff --git a/types/src/lib/handlers/unified-wrapper.d.mts.map b/types/src/lib/handlers/unified-wrapper.d.mts.map
index 0ba1fcee0..6b5d13a07 100644
--- a/types/src/lib/handlers/unified-wrapper.d.mts.map
+++ b/types/src/lib/handlers/unified-wrapper.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"unified-wrapper.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/unified-wrapper.mjs"],"names":[],"mappings":"AA07BA;;;;;;;;;;;;;;;;;;GAkBG;AACH,4CAhBW,MAAM,GAAC,MAAM,GACX,OAAO,CAkBnB;AAs3ID;;;;;;;;;;;GAWG;AACH,sCAPW,OAAO,GACL,cAAc,GAAC,IAAI,CAkB/B;AA/6ID;;;;;;;;GAQG;AACH,iCAHU,GAAG,CAAC,MAAM,CAAC,CAG2F;;;;;AAuEhH;;;;;;;;;;GAUG;AACH;IAuUC;;;;;;;;;;;;;;;;OAgBG;IACH,0BAsCC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,gCAiEC;IAzbD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,sBApCW,MAAM,mKAEd;QAAwB,IAAI,EAApB,MAAM;QACU,OAAO,EAAvB,MAAM;QACyB,WAAW;QACvB,eAAe;QAChB,UAAU;QACV,mBAAmB;QACpB,QAAQ;QACD,UAAU;QAGjB,QAAQ;QACR,YAAY;QACE,cAAc;QAI3B,eAAe;KAMzC,EA+NF;IAzQD;;;;;;;;;;;OAWG;IACH,4BAFa,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAC,SAAS,CAKzC;IA4PD;;;;;;;;;;OAUG;IACH,uEAHa,GAAC,CA+Bb;IAED;;;;OAIG;IACH,qBAHa,WAAS,MAAM,GAAC,IAAI,CAKhC;IAiJD;;;;;;;;;;;OAWG;IACH,sBA0CC;IAED;;;;;;;;;;;;OAYG;IACH,mBAkDC;IAED;;;;;;;;;OASG;IACH,qBAsDC;IAED;;;;OAIG;IACH,uBA4GC;IAED;;;;;;;;;OASG;IACH,qBAEC;IAED;;;;;;;;;OASG;IACH,sBAiBC;IAED;;;;;;;;;;OAUG;IACH,6BAohBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BA8PC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BA43BC;IAED;;;;;;OAMG;IACH,uCAmzDC;;CACD;8BA3xK6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"unified-wrapper.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/unified-wrapper.mjs"],"names":[],"mappings":"AAu7BA;;;;;;;;;;;;;;;;;;GAkBG;AACH,4CAhBW,MAAM,GAAC,MAAM,GACX,OAAO,CAkBnB;AAo5ID;;;;;;;;;;;GAWG;AACH,sCAPW,OAAO,GACL,cAAc,GAAC,IAAI,CAkB/B;AA78ID;;;;;;;;GAQG;AACH,iCAHU,GAAG,CAAC,MAAM,CAAC,CAG2F;;;;;AAuEhH;;;;;;;;;;GAUG;AACH;IAuUC;;;;;;;;;;;;;;;;OAgBG;IACH,0BAsCC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,gCAiEC;IAzbD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,sBApCW,MAAM,mKAEd;QAAwB,IAAI,EAApB,MAAM;QACU,OAAO,EAAvB,MAAM;QACyB,WAAW;QACvB,eAAe;QAChB,UAAU;QACV,mBAAmB;QACpB,QAAQ;QACD,UAAU;QAGjB,QAAQ;QACR,YAAY;QACE,cAAc;QAI3B,eAAe;KAMzC,EA+NF;IAzQD;;;;;;;;;;;OAWG;IACH,4BAFa,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAC,SAAS,CAKzC;IA4PD;;;;;;;;;;OAUG;IACH,uEAHa,GAAC,CA+Bb;IAED;;;;OAIG;IACH,qBAHa,WAAS,MAAM,GAAC,IAAI,CAKhC;IAiJD;;;;;;;;;;;OAWG;IACH,sBA0CC;IAED;;;;;;;;;;;;OAYG;IACH,mBAkDC;IAED;;;;;;;;;OASG;IACH,qBAsDC;IAED;;;;OAIG;IACH,uBA4GC;IAED;;;;;;;;;OASG;IACH,qBAEC;IAED;;;;;;;;;OASG;IACH,sBAiBC;IAED;;;;;;;OAOG;IACH,6BAGC;IAED;;;;;;;;;;OAUG;IACH,6BA6hBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BA8PC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BA43BC;IAED;;;;;;OAMG;IACH,uCA2zDC;;CACD;8BAtzK6B,2BAA2B"}
\ No newline at end of file

From 7ec43e5fecd0cedbd9fc5594e762755155d66976 Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Mon, 28 Sep 2026 23:18:29 -0700
Subject: [PATCH 38/49] fix(permissions): make reload, shutdown and the default
 routines' root paths host-only

With a permissions config, modules could reload or shut down the whole
instance: nothing denied the framework's own lifecycle methods, and the
root teardown entry points were not checked at all.

- Built-in deny rules for slothlet.reload and slothlet.shutdown, the
  framework's fixed methods, regardless of the routines config.
- Built-in deny rules for the root path of each default routine
  (initialize/startup, shutdown/shutdown), added per instance only while
  that default is in the effective routines config (matched on name and
  mode). A renamed, replaced or removed default leaves the path a plain
  routine governed by the host's own rules; destroy is not a default and
  gets no built-in rule.
- The root api.shutdown(), api.destroy() and routine cascades check their
  path at entry, so ordinary rules on shutdown/destroy/<routine> apply.
- Framework-internal teardown (destroy's own shutdown, the routines and
  hooks the dispose path runs) runs as the host, so a permitted caller is
  never refused halfway.
- As with every built-in, the rules apply only when a permissions config
  is present; an exact-target instance rule re-opens each for a module.

Fixes #529
---
 api_tests/api_test_lifecycle_gate/caller.mjs  |  59 +++++
 .../api_test_lifecycle_gate/initialize.mjs    |  25 +++
 .../api_test_lifecycle_gate/shutdown.mjs      |  26 +++
 api_tests/api_test_lifecycle_gate/target.mjs  |  24 ++
 .../api_test_lifecycle_gate/teardown.mjs      |  25 +++
 docs/LIFECYCLE.md                             |   3 +
 docs/PERMISSIONS.md                           |  38 ++++
 src/lib/builders/api_builder.mjs              | 208 ++++++++++++------
 src/lib/handlers/permission-manager.mjs       |  38 ++++
 src/lib/handlers/routine-manager.mjs          |   4 +
 src/slothlet.mjs                              |   4 +
 .../builtin-deny-lifecycle.test.vitest.mjs    | 207 +++++++++++++++++
 types/src/lib/builders/api_builder.d.mts.map  |   2 +-
 .../src/lib/handlers/permission-manager.d.mts |  24 ++
 .../lib/handlers/permission-manager.d.mts.map |   2 +-
 .../lib/handlers/routine-manager.d.mts.map    |   2 +-
 types/src/slothlet.d.mts.map                  |   2 +-
 17 files changed, 616 insertions(+), 77 deletions(-)
 create mode 100644 api_tests/api_test_lifecycle_gate/caller.mjs
 create mode 100644 api_tests/api_test_lifecycle_gate/initialize.mjs
 create mode 100644 api_tests/api_test_lifecycle_gate/shutdown.mjs
 create mode 100644 api_tests/api_test_lifecycle_gate/target.mjs
 create mode 100644 api_tests/api_test_lifecycle_gate/teardown.mjs
 create mode 100644 tests/vitests/suites/permissions/builtin-deny-lifecycle.test.vitest.mjs

diff --git a/api_tests/api_test_lifecycle_gate/caller.mjs b/api_tests/api_test_lifecycle_gate/caller.mjs
new file mode 100644
index 000000000..1a7b0fd77
--- /dev/null
+++ b/api_tests/api_test_lifecycle_gate/caller.mjs
@@ -0,0 +1,59 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_lifecycle_gate/caller.mjs
+ *	@Date: 2026-09-28T22:30:00-07:00 (1790659800)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 22:30:00 -07:00 (1790659800)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Fixture for #529: a module that calls the framework's lifecycle methods and the root routine paths.
+ * @module api_test_lifecycle_gate.caller
+ */
+import { self } from "@cldmv/slothlet/runtime";
+
+/**
+ * Call `self.slothlet.reload()` as this module.
+ * @returns {Promise<unknown>} The reload result.
+ */
+export async function nsReload() {
+	return self.slothlet.reload();
+}
+
+/**
+ * Call `self.slothlet.shutdown()` as this module.
+ * @returns {Promise<unknown>} The shutdown result.
+ */
+export async function nsShutdown() {
+	return self.slothlet.shutdown();
+}
+
+/**
+ * Call the root `self.shutdown()` as this module.
+ * @returns {Promise<unknown>} The shutdown result.
+ */
+export async function rootShutdown() {
+	return self.shutdown();
+}
+
+/**
+ * Call a root-level function by name as this module (routine paths such as a renamed routine).
+ * @param {string} name - Root key.
+ * @returns {Promise<unknown>} The call's result.
+ */
+export async function callRoot(name) {
+	return self[name]();
+}
+
+/**
+ * Call the root `self.destroy()` as this module (framework-internal shutdown must not be gated).
+ * @returns {Promise<unknown>} The destroy result.
+ */
+export async function rootDestroy() {
+	return self.destroy();
+}
diff --git a/api_tests/api_test_lifecycle_gate/initialize.mjs b/api_tests/api_test_lifecycle_gate/initialize.mjs
new file mode 100644
index 000000000..056d4fefe
--- /dev/null
+++ b/api_tests/api_test_lifecycle_gate/initialize.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_lifecycle_gate/initialize.mjs
+ *	@Date: 2026-09-28T22:30:00-07:00 (1790659800)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 22:30:00 -07:00 (1790659800)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Fixture for #529: a root contribution to the default `initialize` (startup) routine.
+ * @module api_test_lifecycle_gate.initialize
+ */
+
+/**
+ * Record that the user's initialize ran.
+ * @returns {void}
+ */
+export default function initialize() {
+	(globalThis.__slothletLifecycleGateLog ??= []).push("user:initialize");
+}
diff --git a/api_tests/api_test_lifecycle_gate/shutdown.mjs b/api_tests/api_test_lifecycle_gate/shutdown.mjs
new file mode 100644
index 000000000..3bcfe143b
--- /dev/null
+++ b/api_tests/api_test_lifecycle_gate/shutdown.mjs
@@ -0,0 +1,26 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_lifecycle_gate/shutdown.mjs
+ *	@Date: 2026-09-28T22:30:00-07:00 (1790659800)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 22:30:00 -07:00 (1790659800)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Fixture for #529: the user's own root `shutdown` (a contribution to the default
+ * `shutdown` routine), run by the root `api.shutdown()` teardown.
+ * @module api_test_lifecycle_gate.shutdown
+ */
+
+/**
+ * Record that the user's shutdown ran.
+ * @returns {void}
+ */
+export default function shutdown() {
+	(globalThis.__slothletLifecycleGateLog ??= []).push("user:shutdown");
+}
diff --git a/api_tests/api_test_lifecycle_gate/target.mjs b/api_tests/api_test_lifecycle_gate/target.mjs
new file mode 100644
index 000000000..0d622f34c
--- /dev/null
+++ b/api_tests/api_test_lifecycle_gate/target.mjs
@@ -0,0 +1,24 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_lifecycle_gate/target.mjs
+ *	@Date: 2026-09-28T22:30:00-07:00 (1790659800)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 22:30:00 -07:00 (1790659800)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Fixture for #529: an ordinary leaf used to check the instance is still up.
+ * @module api_test_lifecycle_gate.target
+ */
+
+/**
+ * @returns {string} "pong".
+ */
+export function ping() {
+	return "pong";
+}
diff --git a/api_tests/api_test_lifecycle_gate/teardown.mjs b/api_tests/api_test_lifecycle_gate/teardown.mjs
new file mode 100644
index 000000000..55bf620df
--- /dev/null
+++ b/api_tests/api_test_lifecycle_gate/teardown.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_lifecycle_gate/teardown.mjs
+ *	@Date: 2026-09-28T22:30:00-07:00 (1790659800)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 22:30:00 -07:00 (1790659800)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Fixture for #529: a root contribution to a renamed `mode: "shutdown"` routine.
+ * @module api_test_lifecycle_gate.teardown
+ */
+
+/**
+ * Record that the renamed shutdown-mode routine ran.
+ * @returns {void}
+ */
+export default function teardown() {
+	(globalThis.__slothletLifecycleGateLog ??= []).push("user:teardown");
+}
diff --git a/docs/LIFECYCLE.md b/docs/LIFECYCLE.md
index 0a3ad8a97..ce5083c3b 100644
--- a/docs/LIFECYCLE.md
+++ b/docs/LIFECYCLE.md
@@ -404,6 +404,9 @@ Each array entry normalizes to `{ name, mode, recursive, order, cascade }`:
 - **`"startup"`** — runs once, as the final awaited step of composition. `await slothlet(...)` resolves only after every `"startup"` routine's cascade completes.
 - **`"shutdown"`** — runs on dispose, via the existing teardown path (`api.shutdown()` and `api.slothlet.shutdown()` both trigger it) — not a competing `self.shutdown` property.
 - **`"destroy"`** — runs from `api.destroy()` specifically. `"shutdown"`-mode routines still also run as part of `destroy()` (it calls the root `shutdown()` internally) — `"destroy"` mode is for a routine meant to fire on `destroy()` only.
+
+**Permissions.** With a `permissions` config, a default routine's root path (`api.initialize()`, `api.shutdown()`) is host-only while that default is in the effective `routines` config; renamed, replaced or removed defaults leave the root paths as plain routines governed by the host's own rules. Even with `routines: []`, the top-level `api.shutdown()` / `api.destroy()` still run the root shutdown hook and tear the instance down, so a host that drops the defaults and wants modules kept away from teardown adds its own deny rules on `shutdown` / `destroy`. See [PERMISSIONS.md](PERMISSIONS.md#lifecycle-methods-and-default-routines--host-only).
+
 - **`"manual"`** (default when omitted) — never runs automatically; the host calls it explicitly.
 
 Every mode's wrapping happens unconditionally — `self.<path>()` is always directly callable regardless of mode. The _automatic_ firing at the mode's trigger point (compose end for `startup`, dispose for `shutdown`/`destroy`) is gated by [`autoRoutines`](#autoroutines) (`false` by default). Whether **more than one** contributor at the same exact api path actually runs is a separate, independent question — see [`stackRoutines`](#stackroutines) below; by default only the single contributor that actually owns that path (per whatever `collisionMode` resolved) runs, matching how every other part of the framework has always worked.
diff --git a/docs/PERMISSIONS.md b/docs/PERMISSIONS.md
index 8ad8ca08b..c610e29ce 100644
--- a/docs/PERMISSIONS.md
+++ b/docs/PERMISSIONS.md
@@ -805,6 +805,44 @@ To allow a trusted module to toggle permissions, add a more specific allow rule:
 
 **Sealing the policy.** `control.seal()` locks the permission policy so it cannot be mutated again for the life of the instance — useful once a host has finished wiring rules and wants to guarantee no later code (including a rule-managing leaf) can widen access. Only the host or an explicitly-allowed module can call it, since `control.**` is deny-by-default for modules. The seal is preserved across `reload()`. It never blocks `shutdown()`, so teardown always works, and it does not change enforcement — sealed or not, rules evaluate the same.
 
+### Lifecycle methods and default routines — Host-Only
+
+Reloading or shutting the instance down is a host decision, so built-in rules deny it to modules.
+
+**Framework methods — always.** `slothlet.reload` and `slothlet.shutdown` are fixed methods on the `slothlet.*` namespace, whatever the `routines` config says:
+
+```javascript
+// Built-in rules registered for every instance:
+{ caller: "**", target: "slothlet.reload",   effect: "deny" }
+{ caller: "**", target: "slothlet.shutdown", effect: "deny" }
+```
+
+**Default routines — only while they are configured.** The root path of each [default routine](LIFECYCLE.md#routines) (`slothlet.defaults.routines`: `initialize` with mode `startup`, `shutdown` with mode `shutdown`) is host-only **while that default is present in the instance's effective `routines` config**, matched on name and mode:
+
+```javascript
+// Built-in rules, added per instance only for the defaults its routines config contains:
+{ caller: "**", target: "initialize", effect: "deny" } // root api.initialize() cascade
+{ caller: "**", target: "shutdown",   effect: "deny" } // root api.shutdown()
+```
+
+A renamed routine, a default's name with a different mode, a replaced list or `routines: []` leaves those root paths as **plain routines**: no built-in rule, governed only by the ordinary rules the host configures on their paths (`shutdown`, `destroy`, `initialize`, or a custom routine's name). `destroy` is not a default routine, so the root `api.destroy()` never gets a built-in rule. The decision is made per instance when its config is loaded — a `reload()` applies it to the same config, a `restart()` to the original one.
+
+> **Caveat — removing the default routines does not disarm the root teardown.** Even with the default `shutdown` routine removed (for example `routines: []`), the top-level `api.shutdown()` / `api.destroy()` are still wired to slothlet's internal teardown: they run any root `shutdown` hook and then shut the instance down (and `destroy()` then clears it). A module that can reach them can therefore tear the instance down. A host that removes the default routines and wants that protection adds its own rules:
+>
+> ```javascript
+> { caller: "**", target: "shutdown", effect: "deny" }
+> { caller: "**", target: "destroy",  effect: "deny" }
+> ```
+
+The root entry points (`api.shutdown()`, `api.destroy()`, a routine's root cascade) are checked **at entry only**. Framework-internal teardown is never gated: `destroy()`'s own shutdown, the routines and hooks the dispose path runs, and a restart's teardown all run as the host, so a module that is allowed to trigger them is not refused halfway.
+
+As with every built-in, these rules apply only when the instance has a `permissions` config — with no `permissions` block the permission system is off and modules can call all of these. The host is never gated. To grant one to a trusted module, add an instance rule on the same exact target; it outranks the built-in under both `defaultPolicy: "allow"` and `"deny"`:
+
+```javascript
+{ caller: "admin.**", target: "slothlet.reload", effect: "allow" }
+{ caller: "admin.**", target: "shutdown",        effect: "allow" }
+```
+
 ### Other `slothlet.*` Routes Are Gated Too
 
 The entire `slothlet` namespace is wrapped by an internal route proxy, so every `slothlet.*` member a module calls through `self` is a permission-gated route — including the caller-identity utilities `slothlet.lockCaller` and `slothlet.bind` (see [Caller Identity in Callbacks](HOOKS.md#caller-identity-in-callbacks)).
diff --git a/src/lib/builders/api_builder.mjs b/src/lib/builders/api_builder.mjs
index de3187f3f..4b3747ef0 100644
--- a/src/lib/builders/api_builder.mjs
+++ b/src/lib/builders/api_builder.mjs
@@ -84,6 +84,30 @@ function _resolvePathOrModuleId(slothlet, pathOrModuleId) {
 	return pathOrModuleId;
 }
 
+/**
+ * Run framework-internal teardown (the dispose path's routines and hooks) as the host (#529).
+ *
+ * @description
+ * A module allowed to trigger teardown (for example `api.destroy()`) must not be refused halfway: the
+ * teardown invokes the user's routine contributions and root hooks, whose own call gate would
+ * otherwise see that module as the caller and apply the host-only rule on a default routine's root
+ * path. Runs `fn` with no module caller when one is active; host-initiated teardown runs as is.
+ *
+ * @param {object} slothlet - Slothlet instance.
+ * @param {Function} fn - The teardown body.
+ * @returns {unknown} Whatever `fn` returns.
+ * @private
+ *
+ * @example
+ * await runTeardownAsHost(slothlet, () => slothlet._runShutdown());
+ */
+function runTeardownAsHost(slothlet, fn) {
+	const contextManager = slothlet.contextManager;
+	const identity = contextManager?.getCallerIdentity?.(slothlet.instanceID);
+	if (!identity?.currentWrapper && !identity?.unresolved) return fn();
+	return contextManager.runInContext(slothlet.instanceID, fn, null, [], null, true, true);
+}
+
 /**
  * Describe a value's shape for a `scope()`/`run()` validation error's `received` context field.
  *
@@ -404,6 +428,11 @@ export class ApiBuilder extends ComponentBase {
 			}
 		};
 
+		// The root routine entry points (`api.shutdown()`, a default routine's root cascade) live outside
+		// the `slothlet.*` route proxy, so they check their permission target through this same enforcer
+		// at entry (#529). Re-set on every load, alongside the namespace it belongs to.
+		slothlet._enforceInternalPermission = enforceInternalPermission;
+
 		/**
 		 * Determine whether a denied namespace read can be traversed because an allow rule
 		 * for the same caller explicitly targets a deeper descendant under that namespace.
@@ -3612,29 +3641,48 @@ export class ApiBuilder extends ComponentBase {
 	 */
 	createShutdownFunction() {
 		const slothlet = this.slothlet;
+		/**
+		 * The root dispose path, ungated: what the `api.shutdown()` entry below runs after its permission
+		 * check, and what framework-internal callers (`api.destroy()`) run directly, so an allowed caller
+		 * is never refused halfway (#529).
+		 * @returns {Promise<void>}
+		 */
+		const runShutdown = () => runTeardownAsHost(slothlet, runShutdownBody);
+		/**
+		 * The dispose path's body — see `runShutdown`.
+		 * @returns {Promise<void>}
+		 */
+		const runShutdownBody = async () => {
+			// Stackable lifecycle routines (#341) — this IS the dispose path, replacing what used
+			// to be a separate `collectLifecycleHooks` walk (`_collectLifecycleHooks`, removed):
+			// `collectLifecycleHooks: true` now expands into an implicit root-anchored
+			// `mode: "shutdown"` routine (see `Config.normalizeRoutines`), so this single call
+			// covers both the default `shutdown` routine and that legacy option alike. A failing
+			// contributor must not block the rest of teardown below, but must still surface to the
+			// caller, so its error is captured and re-thrown only after everything else has run.
+			let routineError = null;
+			try {
+				await slothlet.handlers.routineManager?.runShutdownModeRoutines();
+			} catch (error) {
+				routineError = error;
+			}
+
+			// Call user's shutdown hook first if they provided one (check dynamically)
+			if (slothlet.userHooks?.shutdown && typeof slothlet.userHooks.shutdown === "function") {
+				await slothlet.userHooks.shutdown();
+			}
+			const result = await slothlet.shutdown();
+			if (routineError) throw routineError;
+			return result;
+		};
+		slothlet._runShutdown = runShutdown;
 		const shutdownFunction = {
 			shutdown: async () => {
-				// Stackable lifecycle routines (#341) — this IS the dispose path, replacing what used
-				// to be a separate `collectLifecycleHooks` walk (`_collectLifecycleHooks`, removed):
-				// `collectLifecycleHooks: true` now expands into an implicit root-anchored
-				// `mode: "shutdown"` routine (see `Config.normalizeRoutines`), so this single call
-				// covers both the default `shutdown` routine and that legacy option alike. A failing
-				// contributor must not block the rest of teardown below, but must still surface to the
-				// caller, so its error is captured and re-thrown only after everything else has run.
-				let routineError = null;
-				try {
-					await slothlet.handlers.routineManager?.runShutdownModeRoutines();
-				} catch (error) {
-					routineError = error;
-				}
-
-				// Call user's shutdown hook first if they provided one (check dynamically)
-				if (slothlet.userHooks?.shutdown && typeof slothlet.userHooks.shutdown === "function") {
-					await slothlet.userHooks.shutdown();
-				}
-				const result = await slothlet.shutdown();
-				if (routineError) throw routineError;
-				return result;
+				// #529: the root `shutdown` path is permission-checked at entry, like a call to any other api
+				// path — ordinary rules on `shutdown` govern it, and while the default `shutdown` routine is
+				// configured a built-in rule makes it host-only. Entry only: internal teardown is not gated.
+				slothlet._enforceInternalPermission?.("shutdown");
+				return runShutdown();
 			}
 		}.shutdown;
 		return shutdownFunction;
@@ -4005,69 +4053,83 @@ export class ApiBuilder extends ComponentBase {
 	createDestroyFunction(api) {
 		const slothlet = this.slothlet;
 		const destroyFunction = {
+			// Framework-internal teardown runs as the host (#529), so a module that may call destroy() is
+			// not refused halfway by a routine contribution's own call gate.
 			destroy: async () => {
-				// Stackable lifecycle routines (#341) — this IS the dispose path for `destroy`,
-				// replacing what used to be a separate `collectLifecycleHooks` walk
-				// (`_collectLifecycleHooks("destroy")`, removed): `collectLifecycleHooks: true` now
-				// expands into an implicit root-anchored `mode: "destroy"` routine (see
-				// `Config.normalizeRoutines`). `mode: "shutdown"` routines still run too, via the
-				// `api.shutdown()` call below — this only covers routines meant to fire on `destroy()`
-				// specifically. Same capture-then-rethrow-after-teardown shape as
-				// `createShutdownFunction()`: a failing contributor must not block the rest of
-				// teardown, but must still surface to the caller.
-				let routineError = null;
-				try {
-					await slothlet.handlers.routineManager?.runDestroyModeRoutines();
-				} catch (error) {
-					routineError = error;
-				}
+				// #529: the root `destroy` path is permission-checked at entry against ordinary rules on
+				// `destroy` (it is not a default routine, so no built-in rule applies). Entry only.
+				slothlet._enforceInternalPermission?.("destroy");
+				return runTeardownAsHost(slothlet, destroyBody);
+			}
+		}.destroy;
+		/**
+		 * The destroy path's body — see `destroyFunction`.
+		 * @returns {Promise<void>}
+		 */
+		const destroyBody = async () => {
+			// Stackable lifecycle routines (#341) — this IS the dispose path for `destroy`,
+			// replacing what used to be a separate `collectLifecycleHooks` walk
+			// (`_collectLifecycleHooks("destroy")`, removed): `collectLifecycleHooks: true` now
+			// expands into an implicit root-anchored `mode: "destroy"` routine (see
+			// `Config.normalizeRoutines`). `mode: "shutdown"` routines still run too, via the
+			// `api.shutdown()` call below — this only covers routines meant to fire on `destroy()`
+			// specifically. Same capture-then-rethrow-after-teardown shape as
+			// `createShutdownFunction()`: a failing contributor must not block the rest of
+			// teardown, but must still surface to the caller.
+			let routineError = null;
+			try {
+				await slothlet.handlers.routineManager?.runDestroyModeRoutines();
+			} catch (error) {
+				routineError = error;
+			}
 
-				// Call user's destroy hook first if they provided one (check dynamically)
-				if (slothlet.userHooks?.destroy && typeof slothlet.userHooks.destroy === "function") {
-					await slothlet.userHooks.destroy();
-				}
+			// Call user's destroy hook first if they provided one (check dynamically)
+			if (slothlet.userHooks?.destroy && typeof slothlet.userHooks.destroy === "function") {
+				await slothlet.userHooks.destroy();
+			}
 
-				// Then shutdown cleanly using wrapped api.shutdown() (which calls user's shutdown hook).
-				// `api.shutdown()` can itself throw a deferred `mode: "shutdown"` routine aggregate
-				// (createShutdownFunction() has the same capture-then-rethrow-after-teardown shape) —
-				// capture that here too, rather than letting it propagate immediately, so a shutdown-mode
-				// routine failure can't abort destroy() before isDestroyed/key-clearing/api-nulling below.
-				try {
-					if (api && typeof api.shutdown === "function") {
-						await api.shutdown();
-					} else {
-						// Fallback if api.shutdown not available
-						await slothlet.shutdown();
-					}
-				} catch (error) {
-					if (!routineError) routineError = error;
+			// Then shutdown cleanly using wrapped api.shutdown() (which calls user's shutdown hook).
+			// `api.shutdown()` can itself throw a deferred `mode: "shutdown"` routine aggregate
+			// (createShutdownFunction() has the same capture-then-rethrow-after-teardown shape) —
+			// capture that here too, rather than letting it propagate immediately, so a shutdown-mode
+			// routine failure can't abort destroy() before isDestroyed/key-clearing/api-nulling below.
+			try {
+				if (api && typeof api.shutdown === "function") {
+					// The ungated dispose path: destroy()'s own shutdown is framework-internal, so a caller
+					// allowed to destroy is not refused halfway by the root `shutdown` rule (#529).
+					await slothlet._runShutdown();
+				} else {
+					// Fallback if api.shutdown not available
+					await slothlet.shutdown();
 				}
+			} catch (error) {
+				if (!routineError) routineError = error;
+			}
 
-				// Then try to destroy the API object itself
-				// Note: This can't truly delete properties from the returned object
-				// but we can mark it as destroyed and prevent further use
-				slothlet.isDestroyed = true;
+			// Then try to destroy the API object itself
+			// Note: This can't truly delete properties from the returned object
+			// but we can mark it as destroyed and prevent further use
+			slothlet.isDestroyed = true;
 
-				// Clear all references we can from both api and slothlet.api
-				const objectsToClear = [api, slothlet.api].filter((obj) => obj && typeof obj === "object");
+			// Clear all references we can from both api and slothlet.api
+			const objectsToClear = [api, slothlet.api].filter((obj) => obj && typeof obj === "object");
 
-				for (const obj of objectsToClear) {
-					const keys = Object.keys(obj);
-					for (const key of keys) {
-						try {
-							delete obj[key];
-						} catch (_) {
-							// Some properties may not be deletable
-						}
+			for (const obj of objectsToClear) {
+				const keys = Object.keys(obj);
+				for (const key of keys) {
+					try {
+						delete obj[key];
+					} catch (_) {
+						// Some properties may not be deletable
 					}
 				}
+			}
 
-				// Clear slothlet.api reference
-				slothlet.api = null;
+			// Clear slothlet.api reference
+			slothlet.api = null;
 
-				if (routineError) throw routineError;
-			}
-		}.destroy;
+			if (routineError) throw routineError;
+		};
 		return destroyFunction;
 	}
 
diff --git a/src/lib/handlers/permission-manager.mjs b/src/lib/handlers/permission-manager.mjs
index 222738328..36dc70f0a 100644
--- a/src/lib/handlers/permission-manager.mjs
+++ b/src/lib/handlers/permission-manager.mjs
@@ -25,6 +25,7 @@ import { ComponentBase } from "#factories/component-base";
 import { compilePattern } from "@cldmv/slothlet/helpers/pattern-matcher";
 import { translate } from "@cldmv/slothlet/i18n";
 import { MODULE_ID_SEPARATOR } from "#handlers/metadata";
+import { DEFAULT_ROUTINES } from "@cldmv/slothlet/helpers/defaults";
 
 /**
  * Cache size above which a principal with a `maxAge` sweeps its expired identities on the next
@@ -397,6 +398,15 @@ export class PermissionManager extends ComponentBase {
 		// Built-in deny rule: block all modules from calling control.enable/disable by default.
 		this.addRule({ caller: "**", target: "slothlet.permissions.control.**", effect: "deny" }, "__builtin__");
 
+		// Built-in deny rules (#529): `slothlet.reload` and `slothlet.shutdown` are the framework's own
+		// lifecycle methods — a module that could call them could rebuild the tree under every other
+		// module, or take the whole instance down. Host-only by default; an instance rule on the same
+		// exact target outranks these, which is how the host grants them to a trusted module. The
+		// default routines' root paths get the same treatment only while those defaults are configured
+		// — see {@link PermissionManager#applyDefaultRoutineRules}.
+		this.addRule({ caller: "**", target: "slothlet.reload", effect: "deny" }, "__builtin__");
+		this.addRule({ caller: "**", target: "slothlet.shutdown", effect: "deny" }, "__builtin__");
+
 		// Built-in allow rules: the caller-identity utilities `slothlet.lockCaller` and
 		// `slothlet.bind` grant no security-sensitive access — they only pin a callback's
 		// caller identity, which strengthens enforcement. Allowing them by default means a
@@ -1644,6 +1654,34 @@ export class PermissionManager extends ComponentBase {
 		this.#sealed = true;
 	}
 
+	/**
+	 * Built-in deny rules for the default routines' root paths (#529), applied once the instance's
+	 * `routines` config has been normalized.
+	 *
+	 * @description
+	 * A default routine (`slothlet.defaults.routines` — `initialize` → `startup`, `shutdown` →
+	 * `shutdown`) is the framework's own lifecycle entry point while it is configured, so its root path
+	 * (`api.initialize()`, `api.shutdown()`) is host-only, like `slothlet.shutdown`. The rule is added
+	 * only for a default that is present in the effective `routines` list, matched on name AND mode: a
+	 * renamed routine, the same name with a different mode, a replaced list or `routines: []` leaves
+	 * those paths as ordinary routines with no built-in rule. Decided per instance at load time — a
+	 * reload re-runs it against the same config, a restart against the original one. The root entry
+	 * points (`api.shutdown()`, a routine's root cascade) check their path at entry only;
+	 * framework-internal runs of the same routines are never gated.
+	 *
+	 * @param {Array<{name: string, mode: string}>|null|undefined} routines - Normalized routines config.
+	 * @returns {void}
+	 * @example
+	 * pm.applyDefaultRoutineRules(config.routines);
+	 */
+	applyDefaultRoutineRules(routines) {
+		if (!Array.isArray(routines)) return;
+		for (const fallback of DEFAULT_ROUTINES) {
+			if (!routines.some((routine) => routine?.name === fallback.name && routine?.mode === fallback.mode)) continue;
+			this.addRule({ caller: "**", target: fallback.name, effect: "deny" }, "__builtin__");
+		}
+	}
+
 	/**
 	 * Whether the control surface has been sealed.
 	 * @returns {boolean} True if sealed.
diff --git a/src/lib/handlers/routine-manager.mjs b/src/lib/handlers/routine-manager.mjs
index d7f13213b..cba7d7dfd 100644
--- a/src/lib/handlers/routine-manager.mjs
+++ b/src/lib/handlers/routine-manager.mjs
@@ -1665,6 +1665,10 @@ export class RoutineManager extends ComponentBase {
 	#buildCascadeCallable(name) {
 		const manager = this;
 		const cascade = async function slothletRoutineCascade(...args) {
+			// #529: the root cascade is permission-checked at entry against ordinary rules on its path; a
+			// configured default routine's path is host-only by a built-in rule. Entry only — the
+			// framework's own mode runs call runCascade() directly and are never gated.
+			manager.slothlet._enforceInternalPermission?.(name);
 			return manager.runCascade(name, args);
 		};
 		// #443: configurable for the same proxy-invariant reason as #buildStackedCallable — a cascade
diff --git a/src/slothlet.mjs b/src/slothlet.mjs
index 949ad1ba1..6562b0728 100644
--- a/src/slothlet.mjs
+++ b/src/slothlet.mjs
@@ -736,6 +736,10 @@ class Slothlet {
 		// Transform and validate config using component classes
 		this.config = this.helpers.config.transformConfig(config);
 
+		// Default routines present in the normalized routines config make their root paths host-only
+		// (#529) — decided here, per load, once the effective list is known.
+		this.handlers.permissionManager?.applyDefaultRoutineRules(this.config.routines);
+
 		// One-shot DX hint (#235): under a vitest COVERAGE run with this slothlet copy externalized
 		// and no injectable importer configured, the consumer's leaf coverage will misattribute —
 		// say so at boot, pointing at the fix, instead of leaving a mysteriously low report.
diff --git a/tests/vitests/suites/permissions/builtin-deny-lifecycle.test.vitest.mjs b/tests/vitests/suites/permissions/builtin-deny-lifecycle.test.vitest.mjs
new file mode 100644
index 000000000..22fb35eb6
--- /dev/null
+++ b/tests/vitests/suites/permissions/builtin-deny-lifecycle.test.vitest.mjs
@@ -0,0 +1,207 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/permissions/builtin-deny-lifecycle.test.vitest.mjs
+ *	@Date: 2026-09-28T22:30:00-07:00 (1790659800)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 22:30:00 -07:00 (1790659800)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Built-in deny rules for the lifecycle surface (#529).
+ *
+ * @description
+ * With a `permissions` config:
+ * - `slothlet.reload` and `slothlet.shutdown` — the framework's own methods — are always denied to
+ *   modules by built-in rules.
+ * - The root path of each DEFAULT routine (`initialize` → startup, `shutdown` → shutdown) is denied to
+ *   modules only while that default is in the effective `routines` config (matched on name and mode).
+ *   With `routines: []` or the default replaced, those paths are ordinary routines with no built-in
+ *   rule — though the root `api.shutdown()` still tears the instance down, so a host wanting that
+ *   protection adds its own rule.
+ * The host is never gated, an explicit allow re-opens each target, framework-internal teardown is not
+ * refused midway, and with no `permissions` config (enforcement off) everything is reachable.
+ */
+
+import path from "node:path";
+import { describe, it, expect, afterEach, beforeEach } from "vitest";
+import slothlet from "@cldmv/slothlet";
+import { getMatrixConfigs, TEST_DIRS } from "../../setup/vitest-helper.mjs";
+
+const BASE = path.join(path.dirname(TEST_DIRS.API_TEST), "api_test_lifecycle_gate");
+
+/**
+ * Module-side calls and the built-in target each is gated by under the default routines.
+ * @type {Array<{label: string, call: Function, target: string}>}
+ */
+const GATED = [
+	{ label: "self.slothlet.reload()", call: (api) => api.caller.nsReload(), target: "slothlet.reload" },
+	{ label: "self.slothlet.shutdown()", call: (api) => api.caller.nsShutdown(), target: "slothlet.shutdown" },
+	{ label: "root self.shutdown()", call: (api) => api.caller.rootShutdown(), target: "shutdown" },
+	{ label: "root self.initialize()", call: (api) => api.caller.callRoot("initialize"), target: "initialize" }
+];
+
+/**
+ * Permission configs under which the built-ins apply.
+ * @type {Array<{label: string, permissions: object}>}
+ */
+const POLICIES = [
+	{ label: "defaultPolicy allow", permissions: { defaultPolicy: "allow" } },
+	{ label: "defaultPolicy deny", permissions: { defaultPolicy: "deny" } }
+];
+
+/**
+ * Run a call that may throw synchronously (eager) or reject (lazy) as a promise either way.
+ * @param {Function} fn - The call.
+ * @returns {Promise<unknown>} Its settled result.
+ */
+function settle(fn) {
+	return Promise.resolve().then(fn);
+}
+
+/**
+ * The fixture's call log (user routine contributions record themselves here).
+ * @returns {string[]} The log.
+ */
+function log() {
+	return globalThis.__slothletLifecycleGateLog;
+}
+
+describe.each(getMatrixConfigs({}))("Permissions > built-in deny for the lifecycle surface (#529) > $name", ({ config }) => {
+	let api;
+
+	beforeEach(() => {
+		globalThis.__slothletLifecycleGateLog = [];
+	});
+
+	afterEach(async () => {
+		if (api?.shutdown) await api.shutdown().catch(() => {});
+		api = null;
+	});
+
+	/**
+	 * Boot the fixture api for the current matrix config.
+	 * @param {object} [overrides] - Extra config.
+	 * @returns {Promise<object>} The api.
+	 */
+	async function create(overrides = {}) {
+		api = await slothlet({ ...config, base: BASE, silent: true, diagnostics: true, ...overrides });
+		return api;
+	}
+
+	/**
+	 * Whether the instance is still up.
+	 * @returns {boolean} `isLoaded` from diagnostics.
+	 */
+	function isLoaded() {
+		return api.slothlet.diag.inspect().isLoaded;
+	}
+
+	/**
+	 * Assert the two framework methods are denied to the `caller` module and the instance is untouched.
+	 * @returns {Promise<void>}
+	 */
+	async function expectFrameworkMethodsDenied() {
+		const before = api.slothlet.instanceID;
+		await expect(settle(() => api.caller.nsReload())).rejects.toThrow("PERMISSION_DENIED");
+		await expect(settle(() => api.caller.nsShutdown())).rejects.toThrow("PERMISSION_DENIED");
+		expect(api.slothlet.instanceID).toBe(before);
+		expect(isLoaded()).toBe(true);
+	}
+
+	for (const { label: policy, permissions } of POLICIES) {
+		for (const { label, call, target } of GATED) {
+			it(`denies a module ${label} (${target}) with the default routines under ${policy}`, async () => {
+				await create({ permissions });
+				const before = api.slothlet.instanceID;
+				await expect(settle(() => call(api))).rejects.toThrow("PERMISSION_DENIED");
+				expect(api.slothlet.instanceID).toBe(before);
+				expect(isLoaded()).toBe(true);
+				expect(await api.target.ping()).toBe("pong");
+			});
+
+			it(`re-opens ${label} for a module with an explicit allow on ${target} under ${policy}`, async () => {
+				await create({ permissions: { ...permissions, rules: [{ caller: "caller.**", target, effect: "allow" }] } });
+				const before = api.slothlet.instanceID;
+				await call(api);
+				if (target === "slothlet.reload") {
+					expect(api.slothlet.instanceID).not.toBe(before);
+				} else if (target === "initialize") {
+					expect(log()).toContain("user:initialize");
+					expect(isLoaded()).toBe(true);
+				} else {
+					expect(isLoaded()).toBe(false);
+				}
+			});
+		}
+	}
+
+	it("does not gate the host", async () => {
+		await create({ permissions: { defaultPolicy: "deny" } });
+		const before = api.slothlet.instanceID;
+		await api.slothlet.reload();
+		expect(api.slothlet.instanceID).not.toBe(before);
+		await api.initialize();
+		expect(log()).toContain("user:initialize");
+		await api.slothlet.shutdown();
+		expect(isLoaded()).toBe(false);
+		await api.slothlet.reload();
+		await api.shutdown();
+		expect(isLoaded()).toBe(false);
+	});
+
+	for (const { label, call, target } of GATED) {
+		it(`leaves ${label} reachable from a module with no permissions config (built-ins inert)`, async () => {
+			await create();
+			const before = api.slothlet.instanceID;
+			await call(api);
+			if (target === "slothlet.reload") {
+				expect(api.slothlet.instanceID).not.toBe(before);
+			} else if (target === "initialize") {
+				expect(log()).toContain("user:initialize");
+			} else {
+				expect(isLoaded()).toBe(false);
+			}
+		});
+	}
+
+	it("with routines: [] the root shutdown is an ordinary path: a module's call tears the instance down; slothlet.* stays denied", async () => {
+		await create({ permissions: { defaultPolicy: "allow" }, routines: [] });
+		await expectFrameworkMethodsDenied();
+		await api.caller.rootShutdown();
+		// No built-in deny — and the root shutdown is still wired to the internal teardown.
+		expect(isLoaded()).toBe(false);
+		await expect(settle(() => api.target.ping())).rejects.toThrow("CONTEXT_NOT_FOUND");
+	});
+
+	it("with routines: [] a host rule on `shutdown` blocks a module's root shutdown", async () => {
+		await create({
+			permissions: { defaultPolicy: "allow", rules: [{ caller: "caller.**", target: "shutdown", effect: "deny" }] },
+			routines: []
+		});
+		await expect(settle(() => api.caller.rootShutdown())).rejects.toThrow("PERMISSION_DENIED");
+		expect(isLoaded()).toBe(true);
+		expect(await api.target.ping()).toBe("pong");
+	});
+
+	it("with the shutdown default replaced by a renamed shutdown-mode routine, the root paths are ordinary routines", async () => {
+		await create({ permissions: { defaultPolicy: "allow" }, routines: [{ name: "teardown", mode: "shutdown" }] });
+		await expectFrameworkMethodsDenied();
+		await api.caller.callRoot("teardown");
+		expect(log()).toContain("user:teardown");
+		await api.caller.rootShutdown();
+		expect(isLoaded()).toBe(false);
+	});
+
+	it("does not refuse framework-internal teardown midway: a module's destroy() runs the user's shutdown", async () => {
+		await create({ permissions: { defaultPolicy: "allow" } });
+		await api.caller.rootDestroy();
+		expect(log()).toContain("user:shutdown");
+		expect(api.target).toBeUndefined();
+		api = null;
+	});
+});
diff --git a/types/src/lib/builders/api_builder.d.mts.map b/types/src/lib/builders/api_builder.d.mts.map
index 12ef43b8b..d814551c1 100644
--- a/types/src/lib/builders/api_builder.d.mts.map
+++ b/types/src/lib/builders/api_builder.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"api_builder.d.mts","sourceRoot":"","sources":["../../../../src/lib/builders/api_builder.mjs"],"names":[],"mappings":"AAoMA;;;;;;;;;;;;;GAaG;AACH;IACC,gCAAuC;IAEvC;;;;;;;OAOG;IACH,sBANW,MAAM,EAQhB;IAED;;;;;OAKG;IACH,8BAJW,MAAM,GACJ,OAAO,CAAC,MAAM,CAAC,CA6G3B;IAED;;;;;;;;;;;OAWG;IACH,gCAsrGC;IAED;;;;OAIG;IACH,+BA4BC;IAED;;;;OAIG;IACH,0BAgCC;IAED;;;;OAIG;IACH,4BAsTC;IAED;;;;;OAKG;IACH,8BAmEC;IAED;;;;;OAKG;IACH,uBAgCC;CACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAj/H6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"api_builder.d.mts","sourceRoot":"","sources":["../../../../src/lib/builders/api_builder.mjs"],"names":[],"mappings":"AA4NA;;;;;;;;;;;;;GAaG;AACH;IACC,gCAAuC;IAEvC;;;;;;;OAOG;IACH,sBANW,MAAM,EAQhB;IAED;;;;;OAKG;IACH,8BAJW,MAAM,GACJ,OAAO,CAAC,MAAM,CAAC,CA6G3B;IAED;;;;;;;;;;;OAWG;IACH,gCA2rGC;IAED;;;;OAIG;IACH,+BA+CC;IAED;;;;OAIG;IACH,0BAgCC;IAED;;;;OAIG;IACH,4BAsTC;IAED;;;;;OAKG;IACH,8BAiFC;IAED;;;;;OAKG;IACH,uBAgCC;CACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BA/iI6B,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/lib/handlers/permission-manager.d.mts b/types/src/lib/handlers/permission-manager.d.mts
index e0678a7be..2a6aaea0f 100644
--- a/types/src/lib/handlers/permission-manager.d.mts
+++ b/types/src/lib/handlers/permission-manager.d.mts
@@ -429,6 +429,30 @@ export class PermissionManager extends ComponentBase {
      * pm.seal();
      */
     seal(): void;
+    /**
+     * Built-in deny rules for the default routines' root paths (#529), applied once the instance's
+     * `routines` config has been normalized.
+     *
+     * @description
+     * A default routine (`slothlet.defaults.routines` — `initialize` → `startup`, `shutdown` →
+     * `shutdown`) is the framework's own lifecycle entry point while it is configured, so its root path
+     * (`api.initialize()`, `api.shutdown()`) is host-only, like `slothlet.shutdown`. The rule is added
+     * only for a default that is present in the effective `routines` list, matched on name AND mode: a
+     * renamed routine, the same name with a different mode, a replaced list or `routines: []` leaves
+     * those paths as ordinary routines with no built-in rule. Decided per instance at load time — a
+     * reload re-runs it against the same config, a restart against the original one. The root entry
+     * points (`api.shutdown()`, a routine's root cascade) check their path at entry only;
+     * framework-internal runs of the same routines are never gated.
+     *
+     * @param {Array<{name: string, mode: string}>|null|undefined} routines - Normalized routines config.
+     * @returns {void}
+     * @example
+     * pm.applyDefaultRoutineRules(config.routines);
+     */
+    applyDefaultRoutineRules(routines: Array<{
+        name: string;
+        mode: string;
+    }> | null | undefined): void;
     /**
      * Whether the control surface has been sealed.
      * @returns {boolean} True if sealed.
diff --git a/types/src/lib/handlers/permission-manager.d.mts.map b/types/src/lib/handlers/permission-manager.d.mts.map
index d6d192b90..297a5f396 100644
--- a/types/src/lib/handlers/permission-manager.d.mts.map
+++ b/types/src/lib/handlers/permission-manager.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"permission-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/permission-manager.mjs"],"names":[],"mappings":"AAgMA;;;;;;;GAOG;AACH;IACC;;;;OAIG;IACH,yBAHU,MAAM,CAG8B;IAmJ9C;;;;;;OAMG;IACH,sBAJW,MAAM,EA0GhB;IAED;;;;;;;;;;;;;OAaG;IACH,cAVG;QAAqB,MAAM,EAAnB,MAAM;QACO,MAAM,EAAnB,MAAM;QACO,MAAM,EAAnB,MAAM;KACd,kBAAQ,MAAM,GAAC,IAAI,WACX,MAAM,GAAC,IAAI,iBACT,MAAM,CAiDlB;IAED;;;;;;;;;;OAUG;IACH,mBAPW,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,OAAO,CAmCnB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,mBAZG;QAAqB,MAAM,EAAnB,MAAM;QACO,KAAK,EAAlB,MAAM;QACwB,MAAM,EAApC,MAAM,GAAC,QAAQ,GAAC,OAAO;QACuB,SAAS;KAC/D,kBAAQ,MAAM,GAAC,IAAI,WACX,MAAM,GAAC,IAAI,UACX,MAAM,GAAC,IAAI,GACT,MAAM,CAqClB;IAED;;;;;;;;OAQG;IACH,wBALW,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,OAAO,CAiBnB;IAED;;;;;;;;;;OAUG;IACH,kCALW,MAAM,GAAC,IAAI,aACX,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,MAAM,GAAC,QAAQ,GAAC,OAAO,CA0BnC;IAED;;;;OAIG;IACH,uBAFa,MAAM,CAIlB;IAED;;;;;OAKG;IACH,gCAFa,OAAO,CAOnB;IAuCD;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,wBAlBW,MAAM,cAEd;QAAwC,GAAG,EAAnC,CAAS,IAAM,EAAN,MAAM,KAAG,GAAC;QAGQ,OAAO,EAAlC,CAAS,IAAC,EAAD,GAAC,KAAG,GAAC;QACM,MAAM;KAClC,kBAAQ,MAAM,GAAC,IAAI,WACX,CAAS,IAAQ,YAAE,IAAQ,EAAR,KAAK,CAAC,GAAC,CAAC,KAAG,GAAC,GAG7B,IAAI,CA0ChB;IAED;;;;;;;;;;;OAWG;IACH,0BARW,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,OAAO,CAanB;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,0BARW,MAAM,gBACN,GAAC,mBACD,MAAM,GAAC,IAAI,GACT,OAAO,CAiBnB;IAED;;;;;;;OAOG;IACH,mBALW,MAAM,GACJ,OAAO,CAMnB;IAED;;;;;;;;OAQG;IACH,0BALW,MAAM,GACJ,IAAI,CAUhB;IAED;;;;;;;;;;;OAWG;IACH,2BALW,MAAM,GACJ,IAAI,CAUhB;IAED;;;;;;;;;;;OAWG;IACH,uBANW,MAAM,iBACN,MAAM,GACJ,IAAI,CAShB;IAED;;;;;;;;;;;;;;;OAeG;IACH,4BATW,MAAM,cACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,GACT,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,GAAC,CAAA;KAAE,CAAC,CAkCnD;IAED;;;;;;;;;OASG;IACH,yBALW,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,GAAC,CAAA;KAAE,CAAC,GACrC,OAAO,CAAC,IAAI,CAAC,CAMzB;IA4SD;;;;;;;;;;;;;;;OAeG;IACH,wBAXW,MAAM,cACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,YACX;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAC,IAAI,GAEzB,OAAO,CA2BnB;IAED;;;;;;;;;OASG;IACH,4BANW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,cAAU,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,WAAS,CAAC,GAAC,IAAI,GAAC,SAAS,mBACvF,MAAM,GAAC,IAAI,GACT,OAAO,CASnB;IAyBD;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,0BAtBW,MAAM,cACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,aACX,kBAAkB,GAAC,IAAI,YAGvB;QAAE,cAAc,CAAC,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GAAC,IAAI,GAQrE,OAAO,CA0CnB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,sBAXW,MAAM,cACN,MAAM,SACN,KAAK,CAAC,GAAC,CAAC,mBACR,MAAM,GAAC,IAAI,GACT,OAAO,GAAC,OAAO,CAAC,OAAO,CAAC,CA8CpC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,8BAbW,MAAM,GAAC,IAAI,YAEX,MAAM,YACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,GACT,OAAO,CAenB;IAED;;;;;;;;;;;;;;;OAeG;IACH,4BAZW,MAAM,GAAC,IAAI,YACX,MAAM,YACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBAGX,MAAM,GAAC,IAAI,GACT,OAAO,CAMnB;IAED;;;;;;;OAOG;IACH,4BALW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAazB;IAED;;;;;;;OAOG;IACH,2BALW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAYzB;IAED;;;;;;;;OAQG;IACH,8BALW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAazB;IAED;;;;;;OAMG;IACH,UAJa,IAAI,CAQhB;IAcD;;;;;;;;OAQG;IACH,QAJa,IAAI,CAMhB;IAED;;;;;OAKG;IACH,YAJa,OAAO,CAMnB;IAED;;;;;;OAMG;IACH,WAJa,IAAI,CAQhB;IAED;;;;;;OAMG;IACH,aAJa,OAAO,CAMnB;IAED;;;;;;;;OAQG;IACH,uBAJa,OAAO,CAMnB;IAED;;;;;;;;;OASG;IACH,oBAJa,OAAO,CAMnB;IAED;;;;;;;;;;;;OAYG;IACH,mCAVW,MAAM,GAAC,IAAI,GAAC,SAAS,GACnB,OAAO,CAWnB;IAED;;;;;;;;;;;OAWG;IACH,qBANW,OAAO,GACL,IAAI,CAgBhB;IAED;;;;;;OAMG;IAIH,eAPa,KAAK,CAAC,MAAM,CAAC,CAgBzB;IAED;;;;;;;;OAQG;IACH,2BALW,KAAK,CAAC,MAAM,CAAC,GACX,IAAI,CAShB;IAGD;;;;;;;OAOG;IACH,YAJa,OAAO,CAAC,IAAI,CAAC,CAezB;IA4nBD;;;;;;;OAOG;IACH,cAEC;;CACD;;;;;;;;;;;;;;;;UAvvEa,KAAK,CAAC,GAAC,CAAC,GAAC,IAAI;;;;YACb,MAAM,GAAC,IAAI;;8BAxIK,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"permission-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/permission-manager.mjs"],"names":[],"mappings":"AAiMA;;;;;;;GAOG;AACH;IACC;;;;OAIG;IACH,yBAHU,MAAM,CAG8B;IAmJ9C;;;;;;OAMG;IACH,sBAJW,MAAM,EAmHhB;IAED;;;;;;;;;;;;;OAaG;IACH,cAVG;QAAqB,MAAM,EAAnB,MAAM;QACO,MAAM,EAAnB,MAAM;QACO,MAAM,EAAnB,MAAM;KACd,kBAAQ,MAAM,GAAC,IAAI,WACX,MAAM,GAAC,IAAI,iBACT,MAAM,CAiDlB;IAED;;;;;;;;;;OAUG;IACH,mBAPW,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,OAAO,CAmCnB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,mBAZG;QAAqB,MAAM,EAAnB,MAAM;QACO,KAAK,EAAlB,MAAM;QACwB,MAAM,EAApC,MAAM,GAAC,QAAQ,GAAC,OAAO;QACuB,SAAS;KAC/D,kBAAQ,MAAM,GAAC,IAAI,WACX,MAAM,GAAC,IAAI,UACX,MAAM,GAAC,IAAI,GACT,MAAM,CAqClB;IAED;;;;;;;;OAQG;IACH,wBALW,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,OAAO,CAiBnB;IAED;;;;;;;;;;OAUG;IACH,kCALW,MAAM,GAAC,IAAI,aACX,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,MAAM,GAAC,QAAQ,GAAC,OAAO,CA0BnC;IAED;;;;OAIG;IACH,uBAFa,MAAM,CAIlB;IAED;;;;;OAKG;IACH,gCAFa,OAAO,CAOnB;IAuCD;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,wBAlBW,MAAM,cAEd;QAAwC,GAAG,EAAnC,CAAS,IAAM,EAAN,MAAM,KAAG,GAAC;QAGQ,OAAO,EAAlC,CAAS,IAAC,EAAD,GAAC,KAAG,GAAC;QACM,MAAM;KAClC,kBAAQ,MAAM,GAAC,IAAI,WACX,CAAS,IAAQ,YAAE,IAAQ,EAAR,KAAK,CAAC,GAAC,CAAC,KAAG,GAAC,GAG7B,IAAI,CA0ChB;IAED;;;;;;;;;;;OAWG;IACH,0BARW,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,OAAO,CAanB;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,0BARW,MAAM,gBACN,GAAC,mBACD,MAAM,GAAC,IAAI,GACT,OAAO,CAiBnB;IAED;;;;;;;OAOG;IACH,mBALW,MAAM,GACJ,OAAO,CAMnB;IAED;;;;;;;;OAQG;IACH,0BALW,MAAM,GACJ,IAAI,CAUhB;IAED;;;;;;;;;;;OAWG;IACH,2BALW,MAAM,GACJ,IAAI,CAUhB;IAED;;;;;;;;;;;OAWG;IACH,uBANW,MAAM,iBACN,MAAM,GACJ,IAAI,CAShB;IAED;;;;;;;;;;;;;;;OAeG;IACH,4BATW,MAAM,cACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,GACT,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,GAAC,CAAA;KAAE,CAAC,CAkCnD;IAED;;;;;;;;;OASG;IACH,yBALW,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,GAAC,CAAA;KAAE,CAAC,GACrC,OAAO,CAAC,IAAI,CAAC,CAMzB;IA4SD;;;;;;;;;;;;;;;OAeG;IACH,wBAXW,MAAM,cACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,YACX;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAC,IAAI,GAEzB,OAAO,CA2BnB;IAED;;;;;;;;;OASG;IACH,4BANW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,cAAU,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,WAAS,CAAC,GAAC,IAAI,GAAC,SAAS,mBACvF,MAAM,GAAC,IAAI,GACT,OAAO,CASnB;IAyBD;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,0BAtBW,MAAM,cACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,aACX,kBAAkB,GAAC,IAAI,YAGvB;QAAE,cAAc,CAAC,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GAAC,IAAI,GAQrE,OAAO,CA0CnB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,sBAXW,MAAM,cACN,MAAM,SACN,KAAK,CAAC,GAAC,CAAC,mBACR,MAAM,GAAC,IAAI,GACT,OAAO,GAAC,OAAO,CAAC,OAAO,CAAC,CA8CpC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,8BAbW,MAAM,GAAC,IAAI,YAEX,MAAM,YACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,GACT,OAAO,CAenB;IAED;;;;;;;;;;;;;;;OAeG;IACH,4BAZW,MAAM,GAAC,IAAI,YACX,MAAM,YACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBAGX,MAAM,GAAC,IAAI,GACT,OAAO,CAMnB;IAED;;;;;;;OAOG;IACH,4BALW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAazB;IAED;;;;;;;OAOG;IACH,2BALW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAYzB;IAED;;;;;;;;OAQG;IACH,8BALW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAazB;IAED;;;;;;OAMG;IACH,UAJa,IAAI,CAQhB;IAcD;;;;;;;;OAQG;IACH,QAJa,IAAI,CAMhB;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,mCALW,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAC,CAAC,GAAC,IAAI,GAAC,SAAS,GAChD,IAAI,CAUhB;IAED;;;;;OAKG;IACH,YAJa,OAAO,CAMnB;IAED;;;;;;OAMG;IACH,WAJa,IAAI,CAQhB;IAED;;;;;;OAMG;IACH,aAJa,OAAO,CAMnB;IAED;;;;;;;;OAQG;IACH,uBAJa,OAAO,CAMnB;IAED;;;;;;;;;OASG;IACH,oBAJa,OAAO,CAMnB;IAED;;;;;;;;;;;;OAYG;IACH,mCAVW,MAAM,GAAC,IAAI,GAAC,SAAS,GACnB,OAAO,CAWnB;IAED;;;;;;;;;;;OAWG;IACH,qBANW,OAAO,GACL,IAAI,CAgBhB;IAED;;;;;;OAMG;IAIH,eAPa,KAAK,CAAC,MAAM,CAAC,CAgBzB;IAED;;;;;;;;OAQG;IACH,2BALW,KAAK,CAAC,MAAM,CAAC,GACX,IAAI,CAShB;IAGD;;;;;;;OAOG;IACH,YAJa,OAAO,CAAC,IAAI,CAAC,CAezB;IA4nBD;;;;;;;OAOG;IACH,cAEC;;CACD;;;;;;;;;;;;;;;;UA5xEa,KAAK,CAAC,GAAC,CAAC,GAAC,IAAI;;;;YACb,MAAM,GAAC,IAAI;;8BAzIK,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/lib/handlers/routine-manager.d.mts.map b/types/src/lib/handlers/routine-manager.d.mts.map
index e81b0faa9..fb7880e43 100644
--- a/types/src/lib/handlers/routine-manager.d.mts.map
+++ b/types/src/lib/handlers/routine-manager.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"routine-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/routine-manager.mjs"],"names":[],"mappings":"AAqDA;;;;;;;;;;;;;;;;;;GAkBG;AACH;IACC,gCAA2C;IAE3C;;;OAGG;IACH,sBAFW,MAAM,EA6ChB;IAxCA;;;;;;OAMG;IACH,KAFU,KAAK,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,EAAE,WAAU;KAAC,CAAC,CAErD;IAEb;;;;;;;;;;;;OAYG;IACH,aAFU,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAEd;IAE5B;;;;;;;OAOG;IACH,WAFU,OAAO,CAEI;IAErB;;;;OAIG;IACH,cAFU,GAAG,CAAC,MAAM,EAAE,CAAS,IAAM,EAAN,MAAM,KAAG,OAAO,CAAC,CAEnB;IAG9B;;;;;;OAMG;IACH,gBAHa,IAAI,CAOhB;IAwMD;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,2BAJW,MAAM,GACJ,IAAI,CAgFhB;IAgLD;;;;;OAKG;IACH,2BAJW,MAAM,GACJ,IAAI,CAShB;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,6BAhBW,MAAM,YACN,MAAM,GACJ,IAAI,CAyBhB;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,6BApBW,MAAM,GACJ,IAAI,CAkChB;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,oCAlBW,MAAM,GACJ,GAAG,CAAC,MAAM,EAAE;QAAC,EAAE,WAAW;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,GAAC,SAAS,CAAA;KAAC,CAAC,CAwBjF;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,iCAvBW,MAAM,YACN,MAAM,GACJ;QAAC,EAAE,WAAW;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,GAAC,SAAS,CAAA;KAAC,GAAC,SAAS,CAyB9E;IAED;;;;;;;;;;;;;;;OAeG;IACH,+BAZW,MAAM,YACN,MAAM,cACN;QAAC,EAAE,WAAW;QAAC,KAAK,EAAE,MAAM,CAAA;KAAC,GAAC,SAAS,GAIrC,IAAI,CA4BhB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,qCA5BW,MAAM,YACN,MAAM,QACN,MAAM,gBACN,GAAG,CAAC,MAAM,WAAW,2BAInB,IAAI,CA2EhB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,wCAlCW,MAAM,gBACN,GAAG,CAAC,MAAM,WAAW,GAEnB,IAAI,CA8DhB;IAyGD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,wBAhBW,MAAM,0BAEN,MAAM,GAOJ,OAAO,CAAC,GAAC,CAAC,CAgBtB;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,2BAVW,MAAM,OACN,MAAM,0BAEN,MAAM,GAEJ,OAAO,CAAC,GAAC,CAAC,CAiCtB;IAED;;;;;;;;;;;OAWG;IACH,+BANW,MAAM,YACN,MAAM,GAEJ,MAAM,EAAE,CAOpB;IA8QD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,wBAjBW,MAAM,kCAIN,OAAO,GAML,OAAO,CAAC,GAAC,CAAC,CA8BtB;IA0BD;;;;;;;;;;;;;;;;OAgBG;IACH,kCAHa,OAAO,CAAC,IAAI,CAAC,CAKzB;IAED;;;;;;;;;;;;;OAaG;IACH,iCAHa,OAAO,CAAC,IAAI,CAAC,CAKzB;IAED;;;;;;;;;;OAUG;IACH,iCAHa,OAAO,CAAC,IAAI,CAAC,CAKzB;IA0HD;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,0BAJW,MAAM,GACJ,OAAO,CAAC,IAAI,CAAC,CAkDzB;;CACD;8BAhsD6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"routine-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/routine-manager.mjs"],"names":[],"mappings":"AAqDA;;;;;;;;;;;;;;;;;;GAkBG;AACH;IACC,gCAA2C;IAE3C;;;OAGG;IACH,sBAFW,MAAM,EA6ChB;IAxCA;;;;;;OAMG;IACH,KAFU,KAAK,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,EAAE,WAAU;KAAC,CAAC,CAErD;IAEb;;;;;;;;;;;;OAYG;IACH,aAFU,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAEd;IAE5B;;;;;;;OAOG;IACH,WAFU,OAAO,CAEI;IAErB;;;;OAIG;IACH,cAFU,GAAG,CAAC,MAAM,EAAE,CAAS,IAAM,EAAN,MAAM,KAAG,OAAO,CAAC,CAEnB;IAG9B;;;;;;OAMG;IACH,gBAHa,IAAI,CAOhB;IAwMD;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,2BAJW,MAAM,GACJ,IAAI,CAgFhB;IAgLD;;;;;OAKG;IACH,2BAJW,MAAM,GACJ,IAAI,CAShB;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,6BAhBW,MAAM,YACN,MAAM,GACJ,IAAI,CAyBhB;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,6BApBW,MAAM,GACJ,IAAI,CAkChB;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,oCAlBW,MAAM,GACJ,GAAG,CAAC,MAAM,EAAE;QAAC,EAAE,WAAW;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,GAAC,SAAS,CAAA;KAAC,CAAC,CAwBjF;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,iCAvBW,MAAM,YACN,MAAM,GACJ;QAAC,EAAE,WAAW;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,GAAC,SAAS,CAAA;KAAC,GAAC,SAAS,CAyB9E;IAED;;;;;;;;;;;;;;;OAeG;IACH,+BAZW,MAAM,YACN,MAAM,cACN;QAAC,EAAE,WAAW;QAAC,KAAK,EAAE,MAAM,CAAA;KAAC,GAAC,SAAS,GAIrC,IAAI,CA4BhB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,qCA5BW,MAAM,YACN,MAAM,QACN,MAAM,gBACN,GAAG,CAAC,MAAM,WAAW,2BAInB,IAAI,CA2EhB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,wCAlCW,MAAM,gBACN,GAAG,CAAC,MAAM,WAAW,GAEnB,IAAI,CA8DhB;IAyGD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,wBAhBW,MAAM,0BAEN,MAAM,GAOJ,OAAO,CAAC,GAAC,CAAC,CAgBtB;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,2BAVW,MAAM,OACN,MAAM,0BAEN,MAAM,GAEJ,OAAO,CAAC,GAAC,CAAC,CAiCtB;IAED;;;;;;;;;;;OAWG;IACH,+BANW,MAAM,YACN,MAAM,GAEJ,MAAM,EAAE,CAOpB;IA8QD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,wBAjBW,MAAM,kCAIN,OAAO,GAML,OAAO,CAAC,GAAC,CAAC,CA8BtB;IA0BD;;;;;;;;;;;;;;;;OAgBG;IACH,kCAHa,OAAO,CAAC,IAAI,CAAC,CAKzB;IAED;;;;;;;;;;;;;OAaG;IACH,iCAHa,OAAO,CAAC,IAAI,CAAC,CAKzB;IAED;;;;;;;;;;OAUG;IACH,iCAHa,OAAO,CAAC,IAAI,CAAC,CAKzB;IA8HD;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,0BAJW,MAAM,GACJ,OAAO,CAAC,IAAI,CAAC,CAkDzB;;CACD;8BApsD6B,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/slothlet.d.mts.map b/types/src/slothlet.d.mts.map
index d830d9277..45bab9426 100644
--- a/types/src/slothlet.d.mts.map
+++ b/types/src/slothlet.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"slothlet.d.mts","sourceRoot":"","sources":["../../src/slothlet.mjs"],"names":[],"mappings":"AA08CA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,yBApCuB,CAAC,SAAX,MAAQ,6DAGV,eAAe,GACb,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,CAsCpC;;kBASS,QAAQ,CAAC;QAAC,QAAQ,EAAE,aAAa,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAC,CAAC,CAAC;QAAC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;KAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAgD3F,SAAS,GAAC,MAAM;;;;;;;;;;;;qBAEP,MAAM;iBAAO,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA8BhB,MAAM;eAAS,CAAC,QAAQ,GAAC,SAAS,GAAC,UAAU,GAAC,SAAS,CAAC;oBAAc,OAAO;gBAAU,CAAC,OAAO,GAAC,OAAO,CAAC;kBAAY,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAevI,KAAK,CAAC;YAAC,IAAI,EAAC,MAAM,CAAC;YAAA,IAAI,EAAC,MAAM,CAAC;YAAA,QAAQ,EAAC,MAAM,CAAA;SAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aA8BxD,MAAY,IAAI;;;;cAChB,MAAY,IAAI;;;;cAE3B;QAAgE,GAAG,EAAxD,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAC,SAAS,CAAC,CAAC;QACzB,GAAG,EAC/B;YAAkC,GAAG;YACH,MAAM;YACN,MAAM;YACN,MAAM;YACR,OAAO,EACvC;gBAA0C,QAAQ;gBACR,IAAI;gBACJ,SAAS;gBACT,UAAU;gBACV,YAAY;gBACZ,aAAa;gBACb,iBAAiB;gBACjB,mBAAmB;gBACnB,cAAc;aACxD;SAAA;QAA4B,OAAO,EACnC;YAAsC,GAAG;YACO,OAAO,EAA5C,MAAY,MAAM;YACS,GAAG;YACH,KAAK;YACL,GAAG;SACzC;QAA6B,IAAI;;;;;;;;6BAEV,MAAM;;;;yCACN,MAAM,EAAE;;;;;;;;;;;;;;;;;4BAIR,MAAM;;;;kCACN,MAAM;;;;;;;;6BAEN,MAAM;;;;;;;;;;;;;;;;;qCAIN,eAAe;;QACV,IAAI,EAChC;YAAmC,KAAK;YACL,OAAO;YACP,cAAc;YACd,MAAM;YACN,aAAa;YACb,IAAI;YACJ,GAAG;YACH,EAAE;YACJ,GAAG,EACpC;gBAAsC,OAAO,EAAlC,OAAO;gBACqB,MAAM;gBACN,OAAO;aAC9C;YAAmC,MAAM;YACN,kBAAkB;SACrD;QAA4B,KAAK,EACjC;YAAoC,EAAE;YACF,IAAI;YACJ,GAAG;YACH,IAAI;YACJ,YAAY;YACd,KAAK,EACvC;gBAA0C,GAAG;gBACH,MAAM;aAChD;YAAoC,QAAQ;YACR,OAAO;SAC3C;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,EAAE;SAC1C;QAA4B,WAAW,EACvC;YAAoD,GAAG,EAA5C,MAAY,MAAM;YACY,YAAY,EAA1C,OAAO;YAC0C,IAAI,EAArD,MAAY,OAAO,CAAE,IAAI,CAAC;SACrC;QAA4B,QAAQ,EACpC;YAAsD,MAAM,EAAjD,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,MAAM;YACN,SAAS;YACM,IAAI,EAA/C,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,SAAS;SAChD;QAA4B,KAAK,EACjC;YAAoC,GAAG;SACvC;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,UAAU;SAClD;QAA4B,WAAW,EACvC;YAAwC,OAAO,EAC/C;gBAAiD,OAAO,EAA7C,OAAO;gBACwC,MAAM,EAArD,MAAY,IAAI;gBAC+B,OAAO,EAAtD,MAAY,IAAI;gBACsB,iBAAiB,EAAvD,OAAO;gBAC+C,UAAU,EAAhE,CAAS,IAAO,EAAP,OAAO,KAAG,IAAI;gBACwB,IAAI,EAAnD,MAAY,IAAI;gBACsB,MAAM,EAA5C,OAAO;aAClB;SAAA;QAA4B,UAAU,EACtC;YAAyC,IAAI;YACJ,UAAU;YACV,UAAU;YACV,kBAAkB;YAClB,kBAAkB;SAC3D;QAA8B,UAAU;QACV,IAAI;QACL,SAAS;QACR,MAAM;QACN,GAAG;QACH,KAAK;QACa,QAAQ,EAA7C,MAAY,OAAO,CAAE,IAAI,CAAC;KACvC;;gCAppD6D,wBAAwB"}
\ No newline at end of file
+{"version":3,"file":"slothlet.d.mts","sourceRoot":"","sources":["../../src/slothlet.mjs"],"names":[],"mappings":"AA88CA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,yBApCuB,CAAC,SAAX,MAAQ,6DAGV,eAAe,GACb,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,CAsCpC;;kBASS,QAAQ,CAAC;QAAC,QAAQ,EAAE,aAAa,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAC,CAAC,CAAC;QAAC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;KAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAgD3F,SAAS,GAAC,MAAM;;;;;;;;;;;;qBAEP,MAAM;iBAAO,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA8BhB,MAAM;eAAS,CAAC,QAAQ,GAAC,SAAS,GAAC,UAAU,GAAC,SAAS,CAAC;oBAAc,OAAO;gBAAU,CAAC,OAAO,GAAC,OAAO,CAAC;kBAAY,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAevI,KAAK,CAAC;YAAC,IAAI,EAAC,MAAM,CAAC;YAAA,IAAI,EAAC,MAAM,CAAC;YAAA,QAAQ,EAAC,MAAM,CAAA;SAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aA8BxD,MAAY,IAAI;;;;cAChB,MAAY,IAAI;;;;cAE3B;QAAgE,GAAG,EAAxD,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAC,SAAS,CAAC,CAAC;QACzB,GAAG,EAC/B;YAAkC,GAAG;YACH,MAAM;YACN,MAAM;YACN,MAAM;YACR,OAAO,EACvC;gBAA0C,QAAQ;gBACR,IAAI;gBACJ,SAAS;gBACT,UAAU;gBACV,YAAY;gBACZ,aAAa;gBACb,iBAAiB;gBACjB,mBAAmB;gBACnB,cAAc;aACxD;SAAA;QAA4B,OAAO,EACnC;YAAsC,GAAG;YACO,OAAO,EAA5C,MAAY,MAAM;YACS,GAAG;YACH,KAAK;YACL,GAAG;SACzC;QAA6B,IAAI;;;;;;;;6BAEV,MAAM;;;;yCACN,MAAM,EAAE;;;;;;;;;;;;;;;;;4BAIR,MAAM;;;;kCACN,MAAM;;;;;;;;6BAEN,MAAM;;;;;;;;;;;;;;;;;qCAIN,eAAe;;QACV,IAAI,EAChC;YAAmC,KAAK;YACL,OAAO;YACP,cAAc;YACd,MAAM;YACN,aAAa;YACb,IAAI;YACJ,GAAG;YACH,EAAE;YACJ,GAAG,EACpC;gBAAsC,OAAO,EAAlC,OAAO;gBACqB,MAAM;gBACN,OAAO;aAC9C;YAAmC,MAAM;YACN,kBAAkB;SACrD;QAA4B,KAAK,EACjC;YAAoC,EAAE;YACF,IAAI;YACJ,GAAG;YACH,IAAI;YACJ,YAAY;YACd,KAAK,EACvC;gBAA0C,GAAG;gBACH,MAAM;aAChD;YAAoC,QAAQ;YACR,OAAO;SAC3C;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,EAAE;SAC1C;QAA4B,WAAW,EACvC;YAAoD,GAAG,EAA5C,MAAY,MAAM;YACY,YAAY,EAA1C,OAAO;YAC0C,IAAI,EAArD,MAAY,OAAO,CAAE,IAAI,CAAC;SACrC;QAA4B,QAAQ,EACpC;YAAsD,MAAM,EAAjD,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,MAAM;YACN,SAAS;YACM,IAAI,EAA/C,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,SAAS;SAChD;QAA4B,KAAK,EACjC;YAAoC,GAAG;SACvC;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,UAAU;SAClD;QAA4B,WAAW,EACvC;YAAwC,OAAO,EAC/C;gBAAiD,OAAO,EAA7C,OAAO;gBACwC,MAAM,EAArD,MAAY,IAAI;gBAC+B,OAAO,EAAtD,MAAY,IAAI;gBACsB,iBAAiB,EAAvD,OAAO;gBAC+C,UAAU,EAAhE,CAAS,IAAO,EAAP,OAAO,KAAG,IAAI;gBACwB,IAAI,EAAnD,MAAY,IAAI;gBACsB,MAAM,EAA5C,OAAO;aAClB;SAAA;QAA4B,UAAU,EACtC;YAAyC,IAAI;YACJ,UAAU;YACV,UAAU;YACV,kBAAkB;YAClB,kBAAkB;SAC3D;QAA8B,UAAU;QACV,IAAI;QACL,SAAS;QACR,MAAM;QACN,GAAG;QACH,KAAK;QACa,QAAQ,EAA7C,MAAY,OAAO,CAAE,IAAI,CAAC;KACvC;;gCAxpD6D,wBAAwB"}
\ No newline at end of file

From a8a63553a918b4c5e0eb0228c1cfab360eb189d1 Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Tue, 29 Sep 2026 00:02:58 -0700
Subject: [PATCH 39/49] fix(reload): keep co-mounted modules' contributions
 across a scoped reload

A reload of one module forced the shared namespace wrapper into "replace"
mode and handed it only the reloaded module's fresh impl, so every child
another module had added at the same api path was cleared along with it.

The reload now splits each namespace's children by contributor, at every
depth. Children only other modules contribute are set aside and reattached
unchanged (same references, same key order; a lazy subtree is not
materialized). A subfolder both sides contribute to is rebuilt the same
way one level down, so the reloaded module's changes inside it apply and
the other module's leaves stay. A leaf both export follows the ownership
stack. Contributors are read from the ownership stacks as they stood
before the rebuild, whose own registrations could otherwise move the
reloaded module back over a path another module overrode; those stacks
are restored afterwards, so a later remove still reverts to the right
module. Rebuilt children are attributed to the reloaded module rather
than to whichever module created the namespace, which kept repeated
reloads from misclassifying them. A callable namespace keeps the function
of the co-mounted module that exported it.

Adding a lazy module whose folder collides with an existing namespace
under merge or merge-replace now merges that folder's children in too;
leaving it lazy dropped them (merge) or the existing side's (merge-replace).

Fixes #525
---
 .../api_test_reload_comount_callable/main.mjs |  33 ++
 .../api_test_reload_comount_ext/alpha.mjs     |  25 ++
 .../api_test_reload_comount_ext/beta.mjs      |  25 ++
 .../api_test_reload_comount_ext/shared.mjs    |  25 ++
 .../tools/hammer.mjs                          |  25 ++
 .../tools/net/http.mjs                        |  25 ++
 .../tools/net/ping.mjs                        |  25 ++
 .../tools/net/smtp.mjs                        |  25 ++
 .../api_test_reload_comount_ext/tools/saw.mjs |  25 ++
 .../api_test_reload_comount_other/delta.mjs   |  25 ++
 .../api_test_reload_comount_other/gamma.mjs   |  25 ++
 .../gear/cog.mjs                              |  25 ++
 .../gear/spring.mjs                           |  25 ++
 .../api_test_reload_comount_other/shared.mjs  |  25 ++
 .../tools/kit/box/nail.mjs                    |  25 ++
 .../tools/kit/box/screw.mjs                   |  25 ++
 .../tools/kit/glue.mjs                        |  25 ++
 .../tools/kit/tape.mjs                        |  25 ++
 .../tools/net/dns.mjs                         |  25 ++
 .../tools/net/ntp.mjs                         |  25 ++
 .../tools/net/ping.mjs                        |  25 ++
 .../tools/wrench.mjs                          |  25 ++
 api_tests/api_test_reload_revert_a/am.mjs     |  25 ++
 api_tests/api_test_reload_revert_a/an.mjs     |  25 ++
 api_tests/api_test_reload_revert_b/an.mjs     |  25 ++
 api_tests/api_test_reload_revert_b/bx.mjs     |  25 ++
 src/lib/handlers/api-manager.mjs              | 332 +++++++++++++--
 src/lib/handlers/ownership.mjs                |  71 ++++
 src/lib/handlers/unified-wrapper.mjs          |  37 +-
 .../addapi-reload-comount.test.vitest.mjs     | 385 ++++++++++++++++++
 types/src/lib/handlers/api-manager.d.mts      |  89 ++++
 types/src/lib/handlers/api-manager.d.mts.map  |   2 +-
 types/src/lib/handlers/ownership.d.mts        |  46 +++
 types/src/lib/handlers/ownership.d.mts.map    |   2 +-
 types/src/lib/handlers/unified-wrapper.d.mts  |   4 +
 .../lib/handlers/unified-wrapper.d.mts.map    |   2 +-
 36 files changed, 1583 insertions(+), 45 deletions(-)
 create mode 100644 api_tests/api_test_reload_comount_callable/main.mjs
 create mode 100644 api_tests/api_test_reload_comount_ext/alpha.mjs
 create mode 100644 api_tests/api_test_reload_comount_ext/beta.mjs
 create mode 100644 api_tests/api_test_reload_comount_ext/shared.mjs
 create mode 100644 api_tests/api_test_reload_comount_ext/tools/hammer.mjs
 create mode 100644 api_tests/api_test_reload_comount_ext/tools/net/http.mjs
 create mode 100644 api_tests/api_test_reload_comount_ext/tools/net/ping.mjs
 create mode 100644 api_tests/api_test_reload_comount_ext/tools/net/smtp.mjs
 create mode 100644 api_tests/api_test_reload_comount_ext/tools/saw.mjs
 create mode 100644 api_tests/api_test_reload_comount_other/delta.mjs
 create mode 100644 api_tests/api_test_reload_comount_other/gamma.mjs
 create mode 100644 api_tests/api_test_reload_comount_other/gear/cog.mjs
 create mode 100644 api_tests/api_test_reload_comount_other/gear/spring.mjs
 create mode 100644 api_tests/api_test_reload_comount_other/shared.mjs
 create mode 100644 api_tests/api_test_reload_comount_other/tools/kit/box/nail.mjs
 create mode 100644 api_tests/api_test_reload_comount_other/tools/kit/box/screw.mjs
 create mode 100644 api_tests/api_test_reload_comount_other/tools/kit/glue.mjs
 create mode 100644 api_tests/api_test_reload_comount_other/tools/kit/tape.mjs
 create mode 100644 api_tests/api_test_reload_comount_other/tools/net/dns.mjs
 create mode 100644 api_tests/api_test_reload_comount_other/tools/net/ntp.mjs
 create mode 100644 api_tests/api_test_reload_comount_other/tools/net/ping.mjs
 create mode 100644 api_tests/api_test_reload_comount_other/tools/wrench.mjs
 create mode 100644 api_tests/api_test_reload_revert_a/am.mjs
 create mode 100644 api_tests/api_test_reload_revert_a/an.mjs
 create mode 100644 api_tests/api_test_reload_revert_b/an.mjs
 create mode 100644 api_tests/api_test_reload_revert_b/bx.mjs
 create mode 100644 tests/vitests/suites/addapi/addapi-reload-comount.test.vitest.mjs

diff --git a/api_tests/api_test_reload_comount_callable/main.mjs b/api_tests/api_test_reload_comount_callable/main.mjs
new file mode 100644
index 000000000..9f2e9bf75
--- /dev/null
+++ b/api_tests/api_test_reload_comount_callable/main.mjs
@@ -0,0 +1,33 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_reload_comount_callable/main.mjs
+ *	@Date: 2026-09-28 22:25:33 -07:00 (1790659533)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 23:24:24 -07:00 (1790663064)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Single-file module whose default export makes the shared namespace callable (#525).
+ * @module api_test_reload_comount_callable.main
+ */
+
+/**
+ * @function main
+ * @returns {string} `"callable:main"`.
+ */
+export default function main() {
+	return "callable:main";
+}
+
+/**
+ * @function extra
+ * @returns {string} `"callable:extra"`.
+ */
+export function extra() {
+	return "callable:extra";
+}
diff --git a/api_tests/api_test_reload_comount_ext/alpha.mjs b/api_tests/api_test_reload_comount_ext/alpha.mjs
new file mode 100644
index 000000000..10ad2d087
--- /dev/null
+++ b/api_tests/api_test_reload_comount_ext/alpha.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_reload_comount_ext/alpha.mjs
+ *	@Date: 2026-09-28 21:56:24 -07:00 (1790657784)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 23:24:24 -07:00 (1790663064)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf contributed by the first co-mounted module (#525).
+ * @module api_test_reload_comount_ext.alpha
+ */
+
+/**
+ * @function alpha
+ * @returns {string} `"ext:alpha"`.
+ */
+export function alpha() {
+	return "ext:alpha";
+}
diff --git a/api_tests/api_test_reload_comount_ext/beta.mjs b/api_tests/api_test_reload_comount_ext/beta.mjs
new file mode 100644
index 000000000..3ab68da6e
--- /dev/null
+++ b/api_tests/api_test_reload_comount_ext/beta.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_reload_comount_ext/beta.mjs
+ *	@Date: 2026-09-28 21:56:24 -07:00 (1790657784)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 23:24:25 -07:00 (1790663065)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf contributed by the first co-mounted module (#525).
+ * @module api_test_reload_comount_ext.beta
+ */
+
+/**
+ * @function beta
+ * @returns {string} `"ext:beta"`.
+ */
+export function beta() {
+	return "ext:beta";
+}
diff --git a/api_tests/api_test_reload_comount_ext/shared.mjs b/api_tests/api_test_reload_comount_ext/shared.mjs
new file mode 100644
index 000000000..28e6484c2
--- /dev/null
+++ b/api_tests/api_test_reload_comount_ext/shared.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_reload_comount_ext/shared.mjs
+ *	@Date: 2026-09-28 22:25:33 -07:00 (1790659533)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 23:24:25 -07:00 (1790663065)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf both co-mounted modules export under the same name (#525).
+ * @module api_test_reload_comount_ext.shared
+ */
+
+/**
+ * @function shared
+ * @returns {string} `"ext:shared"`.
+ */
+export function shared() {
+	return "ext:shared";
+}
diff --git a/api_tests/api_test_reload_comount_ext/tools/hammer.mjs b/api_tests/api_test_reload_comount_ext/tools/hammer.mjs
new file mode 100644
index 000000000..9900a5aba
--- /dev/null
+++ b/api_tests/api_test_reload_comount_ext/tools/hammer.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_reload_comount_ext/tools/hammer.mjs
+ *	@Date: 2026-09-28 21:56:24 -07:00 (1790657784)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 23:24:25 -07:00 (1790663065)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Nested leaf contributed by the first co-mounted module (#525).
+ * @module api_test_reload_comount_ext.tools.hammer
+ */
+
+/**
+ * @function hammer
+ * @returns {string} `"ext:hammer"`.
+ */
+export function hammer() {
+	return "ext:hammer";
+}
diff --git a/api_tests/api_test_reload_comount_ext/tools/net/http.mjs b/api_tests/api_test_reload_comount_ext/tools/net/http.mjs
new file mode 100644
index 000000000..be4b7b909
--- /dev/null
+++ b/api_tests/api_test_reload_comount_ext/tools/net/http.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_reload_comount_ext/tools/net/http.mjs
+ *	@Date: 2026-09-29 00:13:10 -07:00 (1790665990)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-29 01:29:36 -07:00 (1790670576)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf three levels into a subfolder both co-mounted modules contribute to (#525).
+ * @module api_test_reload_comount_ext.tools.net.http
+ */
+
+/**
+ * @function http
+ * @returns {string} `"ext:http"`.
+ */
+export function http() {
+	return "ext:http";
+}
diff --git a/api_tests/api_test_reload_comount_ext/tools/net/ping.mjs b/api_tests/api_test_reload_comount_ext/tools/net/ping.mjs
new file mode 100644
index 000000000..70f112011
--- /dev/null
+++ b/api_tests/api_test_reload_comount_ext/tools/net/ping.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_reload_comount_ext/tools/net/ping.mjs
+ *	@Date: 2026-09-29 00:13:10 -07:00 (1790665990)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-29 01:29:36 -07:00 (1790670576)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf both co-mounted modules export three levels down (#525).
+ * @module api_test_reload_comount_ext.tools.net.ping
+ */
+
+/**
+ * @function ping
+ * @returns {string} `"ext:ping"`.
+ */
+export function ping() {
+	return "ext:ping";
+}
diff --git a/api_tests/api_test_reload_comount_ext/tools/net/smtp.mjs b/api_tests/api_test_reload_comount_ext/tools/net/smtp.mjs
new file mode 100644
index 000000000..5233618c4
--- /dev/null
+++ b/api_tests/api_test_reload_comount_ext/tools/net/smtp.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_reload_comount_ext/tools/net/smtp.mjs
+ *	@Date: 2026-09-29 00:13:10 -07:00 (1790665990)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-29 01:29:36 -07:00 (1790670576)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf three levels into a subfolder both co-mounted modules contribute to (#525).
+ * @module api_test_reload_comount_ext.tools.net.smtp
+ */
+
+/**
+ * @function smtp
+ * @returns {string} `"ext:smtp"`.
+ */
+export function smtp() {
+	return "ext:smtp";
+}
diff --git a/api_tests/api_test_reload_comount_ext/tools/saw.mjs b/api_tests/api_test_reload_comount_ext/tools/saw.mjs
new file mode 100644
index 000000000..ddac6c4ad
--- /dev/null
+++ b/api_tests/api_test_reload_comount_ext/tools/saw.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_reload_comount_ext/tools/saw.mjs
+ *	@Date: 2026-09-28 21:56:25 -07:00 (1790657785)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 23:24:26 -07:00 (1790663066)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Nested leaf contributed by the first co-mounted module (#525).
+ * @module api_test_reload_comount_ext.tools.saw
+ */
+
+/**
+ * @function saw
+ * @returns {string} `"ext:saw"`.
+ */
+export function saw() {
+	return "ext:saw";
+}
diff --git a/api_tests/api_test_reload_comount_other/delta.mjs b/api_tests/api_test_reload_comount_other/delta.mjs
new file mode 100644
index 000000000..3a347728a
--- /dev/null
+++ b/api_tests/api_test_reload_comount_other/delta.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_reload_comount_other/delta.mjs
+ *	@Date: 2026-09-28 21:56:24 -07:00 (1790657784)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 23:24:26 -07:00 (1790663066)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf contributed by the second co-mounted module (#525).
+ * @module api_test_reload_comount_other.delta
+ */
+
+/**
+ * @function delta
+ * @returns {string} `"other:delta"`.
+ */
+export function delta() {
+	return "other:delta";
+}
diff --git a/api_tests/api_test_reload_comount_other/gamma.mjs b/api_tests/api_test_reload_comount_other/gamma.mjs
new file mode 100644
index 000000000..e12617287
--- /dev/null
+++ b/api_tests/api_test_reload_comount_other/gamma.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_reload_comount_other/gamma.mjs
+ *	@Date: 2026-09-28 21:56:24 -07:00 (1790657784)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 23:24:27 -07:00 (1790663067)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf contributed by the second co-mounted module (#525).
+ * @module api_test_reload_comount_other.gamma
+ */
+
+/**
+ * @function gamma
+ * @returns {string} `"other:gamma"`.
+ */
+export function gamma() {
+	return "other:gamma";
+}
diff --git a/api_tests/api_test_reload_comount_other/gear/cog.mjs b/api_tests/api_test_reload_comount_other/gear/cog.mjs
new file mode 100644
index 000000000..e8f786c95
--- /dev/null
+++ b/api_tests/api_test_reload_comount_other/gear/cog.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_reload_comount_other/gear/cog.mjs
+ *	@Date: 2026-09-28 21:56:25 -07:00 (1790657785)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 23:24:27 -07:00 (1790663067)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Nested leaf contributed by the second co-mounted module (#525).
+ * @module api_test_reload_comount_other.gear.cog
+ */
+
+/**
+ * @function cog
+ * @returns {string} `"other:cog"`.
+ */
+export function cog() {
+	return "other:cog";
+}
diff --git a/api_tests/api_test_reload_comount_other/gear/spring.mjs b/api_tests/api_test_reload_comount_other/gear/spring.mjs
new file mode 100644
index 000000000..40a4effdb
--- /dev/null
+++ b/api_tests/api_test_reload_comount_other/gear/spring.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_reload_comount_other/gear/spring.mjs
+ *	@Date: 2026-09-28 21:56:25 -07:00 (1790657785)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 23:24:28 -07:00 (1790663068)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Nested leaf contributed by the second co-mounted module (#525).
+ * @module api_test_reload_comount_other.gear.spring
+ */
+
+/**
+ * @function spring
+ * @returns {string} `"other:spring"`.
+ */
+export function spring() {
+	return "other:spring";
+}
diff --git a/api_tests/api_test_reload_comount_other/shared.mjs b/api_tests/api_test_reload_comount_other/shared.mjs
new file mode 100644
index 000000000..f2051b6cc
--- /dev/null
+++ b/api_tests/api_test_reload_comount_other/shared.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_reload_comount_other/shared.mjs
+ *	@Date: 2026-09-28 22:25:33 -07:00 (1790659533)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 23:24:28 -07:00 (1790663068)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf both co-mounted modules export under the same name (#525).
+ * @module api_test_reload_comount_other.shared
+ */
+
+/**
+ * @function shared
+ * @returns {string} `"other:shared"`.
+ */
+export function shared() {
+	return "other:shared";
+}
diff --git a/api_tests/api_test_reload_comount_other/tools/kit/box/nail.mjs b/api_tests/api_test_reload_comount_other/tools/kit/box/nail.mjs
new file mode 100644
index 000000000..9b4886525
--- /dev/null
+++ b/api_tests/api_test_reload_comount_other/tools/kit/box/nail.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_reload_comount_other/tools/kit/box/nail.mjs
+ *	@Date: 2026-09-29 00:16:42 -07:00 (1790666202)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-29 01:29:38 -07:00 (1790670578)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf in a lazy subfolder only the second module contributes, below a shared one (#525).
+ * @module api_test_reload_comount_other.tools.kit.box.nail
+ */
+
+/**
+ * @function nail
+ * @returns {string} `"other:nail"`.
+ */
+export function nail() {
+	return "other:nail";
+}
diff --git a/api_tests/api_test_reload_comount_other/tools/kit/box/screw.mjs b/api_tests/api_test_reload_comount_other/tools/kit/box/screw.mjs
new file mode 100644
index 000000000..806831c06
--- /dev/null
+++ b/api_tests/api_test_reload_comount_other/tools/kit/box/screw.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_reload_comount_other/tools/kit/box/screw.mjs
+ *	@Date: 2026-09-29 00:16:42 -07:00 (1790666202)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-29 01:29:38 -07:00 (1790670578)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf in a lazy subfolder only the second module contributes, below a shared one (#525).
+ * @module api_test_reload_comount_other.tools.kit.box.screw
+ */
+
+/**
+ * @function screw
+ * @returns {string} `"other:screw"`.
+ */
+export function screw() {
+	return "other:screw";
+}
diff --git a/api_tests/api_test_reload_comount_other/tools/kit/glue.mjs b/api_tests/api_test_reload_comount_other/tools/kit/glue.mjs
new file mode 100644
index 000000000..6e99d35ef
--- /dev/null
+++ b/api_tests/api_test_reload_comount_other/tools/kit/glue.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_reload_comount_other/tools/kit/glue.mjs
+ *	@Date: 2026-09-29 00:13:10 -07:00 (1790665990)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-29 01:29:38 -07:00 (1790670578)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf in a subfolder only the second module contributes, inside a shared one (#525).
+ * @module api_test_reload_comount_other.tools.kit.glue
+ */
+
+/**
+ * @function glue
+ * @returns {string} `"other:glue"`.
+ */
+export function glue() {
+	return "other:glue";
+}
diff --git a/api_tests/api_test_reload_comount_other/tools/kit/tape.mjs b/api_tests/api_test_reload_comount_other/tools/kit/tape.mjs
new file mode 100644
index 000000000..c283fa91d
--- /dev/null
+++ b/api_tests/api_test_reload_comount_other/tools/kit/tape.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_reload_comount_other/tools/kit/tape.mjs
+ *	@Date: 2026-09-29 00:13:10 -07:00 (1790665990)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-29 01:29:39 -07:00 (1790670579)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf in a subfolder only the second module contributes, inside a shared one (#525).
+ * @module api_test_reload_comount_other.tools.kit.tape
+ */
+
+/**
+ * @function tape
+ * @returns {string} `"other:tape"`.
+ */
+export function tape() {
+	return "other:tape";
+}
diff --git a/api_tests/api_test_reload_comount_other/tools/net/dns.mjs b/api_tests/api_test_reload_comount_other/tools/net/dns.mjs
new file mode 100644
index 000000000..2e6ae7102
--- /dev/null
+++ b/api_tests/api_test_reload_comount_other/tools/net/dns.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_reload_comount_other/tools/net/dns.mjs
+ *	@Date: 2026-09-29 00:13:10 -07:00 (1790665990)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-29 01:29:39 -07:00 (1790670579)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf three levels into a subfolder both co-mounted modules contribute to (#525).
+ * @module api_test_reload_comount_other.tools.net.dns
+ */
+
+/**
+ * @function dns
+ * @returns {string} `"other:dns"`.
+ */
+export function dns() {
+	return "other:dns";
+}
diff --git a/api_tests/api_test_reload_comount_other/tools/net/ntp.mjs b/api_tests/api_test_reload_comount_other/tools/net/ntp.mjs
new file mode 100644
index 000000000..9e1421e5e
--- /dev/null
+++ b/api_tests/api_test_reload_comount_other/tools/net/ntp.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_reload_comount_other/tools/net/ntp.mjs
+ *	@Date: 2026-09-29 00:13:10 -07:00 (1790665990)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-29 01:29:39 -07:00 (1790670579)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf three levels into a subfolder both co-mounted modules contribute to (#525).
+ * @module api_test_reload_comount_other.tools.net.ntp
+ */
+
+/**
+ * @function ntp
+ * @returns {string} `"other:ntp"`.
+ */
+export function ntp() {
+	return "other:ntp";
+}
diff --git a/api_tests/api_test_reload_comount_other/tools/net/ping.mjs b/api_tests/api_test_reload_comount_other/tools/net/ping.mjs
new file mode 100644
index 000000000..929f01852
--- /dev/null
+++ b/api_tests/api_test_reload_comount_other/tools/net/ping.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_reload_comount_other/tools/net/ping.mjs
+ *	@Date: 2026-09-29 00:13:10 -07:00 (1790665990)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-29 01:29:39 -07:00 (1790670579)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf both co-mounted modules export three levels down (#525).
+ * @module api_test_reload_comount_other.tools.net.ping
+ */
+
+/**
+ * @function ping
+ * @returns {string} `"other:ping"`.
+ */
+export function ping() {
+	return "other:ping";
+}
diff --git a/api_tests/api_test_reload_comount_other/tools/wrench.mjs b/api_tests/api_test_reload_comount_other/tools/wrench.mjs
new file mode 100644
index 000000000..86dabc44d
--- /dev/null
+++ b/api_tests/api_test_reload_comount_other/tools/wrench.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_reload_comount_other/tools/wrench.mjs
+ *	@Date: 2026-09-29 00:13:10 -07:00 (1790665990)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-29 01:29:39 -07:00 (1790670579)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf the second module adds to a subfolder both co-mounted modules contribute to (#525).
+ * @module api_test_reload_comount_other.tools.wrench
+ */
+
+/**
+ * @function wrench
+ * @returns {string} `"other:wrench"`.
+ */
+export function wrench() {
+	return "other:wrench";
+}
diff --git a/api_tests/api_test_reload_revert_a/am.mjs b/api_tests/api_test_reload_revert_a/am.mjs
new file mode 100644
index 000000000..4acc49730
--- /dev/null
+++ b/api_tests/api_test_reload_revert_a/am.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_reload_revert_a/am.mjs
+ *	@Date: 2026-09-29 00:10:26 -07:00 (1790665826)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-29 01:29:40 -07:00 (1790670580)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf only the first module exports (#525).
+ * @module api_test_reload_revert_a.am
+ */
+
+/**
+ * @function am
+ * @returns {string} `"A:am"`.
+ */
+export function am() {
+	return "A:am";
+}
diff --git a/api_tests/api_test_reload_revert_a/an.mjs b/api_tests/api_test_reload_revert_a/an.mjs
new file mode 100644
index 000000000..0bbe1ca97
--- /dev/null
+++ b/api_tests/api_test_reload_revert_a/an.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_reload_revert_a/an.mjs
+ *	@Date: 2026-09-29 00:10:26 -07:00 (1790665826)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-29 01:29:40 -07:00 (1790670580)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf both modules export at the same path; the first module's version (#525).
+ * @module api_test_reload_revert_a.an
+ */
+
+/**
+ * @function an
+ * @returns {string} `"A:an"`.
+ */
+export function an() {
+	return "A:an";
+}
diff --git a/api_tests/api_test_reload_revert_b/an.mjs b/api_tests/api_test_reload_revert_b/an.mjs
new file mode 100644
index 000000000..04f658b25
--- /dev/null
+++ b/api_tests/api_test_reload_revert_b/an.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_reload_revert_b/an.mjs
+ *	@Date: 2026-09-29 00:10:26 -07:00 (1790665826)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-29 01:29:40 -07:00 (1790670580)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf both modules export at the same path; the overriding module's version (#525).
+ * @module api_test_reload_revert_b.an
+ */
+
+/**
+ * @function an
+ * @returns {string} `"B:an"`.
+ */
+export function an() {
+	return "B:an";
+}
diff --git a/api_tests/api_test_reload_revert_b/bx.mjs b/api_tests/api_test_reload_revert_b/bx.mjs
new file mode 100644
index 000000000..ab75df909
--- /dev/null
+++ b/api_tests/api_test_reload_revert_b/bx.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_reload_revert_b/bx.mjs
+ *	@Date: 2026-09-29 00:10:26 -07:00 (1790665826)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-29 01:29:40 -07:00 (1790670580)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf only the overriding module exports (#525).
+ * @module api_test_reload_revert_b.bx
+ */
+
+/**
+ * @function bx
+ * @returns {string} `"B:bx"`.
+ */
+export function bx() {
+	return "B:bx";
+}
diff --git a/src/lib/handlers/api-manager.mjs b/src/lib/handlers/api-manager.mjs
index cb73bd349..7beb6e7a3 100644
--- a/src/lib/handlers/api-manager.mjs
+++ b/src/lib/handlers/api-manager.mjs
@@ -866,18 +866,25 @@ export class ApiManager extends ComponentBase {
 								});
 							}
 							await this.syncWrapper(existingChild, nextChild, config, collisionMode, moduleID, emitCollisions);
-						} else if (emitCollisions && syncWrapper_nextIsDeferredNamespace) {
+						} else if (syncWrapper_nextIsDeferredNamespace && existingChild !== nextChild) {
 							// A namespace both modules contribute, but the incoming side is a still-lazy folder:
-							// the nodes merge (both retained); conflicts among their children surface as the
-							// folder materializes, not here.
-							this.emitImplCollision({
-								apiPath: syncWrapper_existingChildWrapper.____slothletInternal.apiPath,
-								resolution: "merged",
-								incoming: moduleID,
-								owner: syncWrapper_existingChildWrapper.____slothletInternal.moduleID,
-								kind: "namespace",
-								collisionMode: "merge"
-							});
+							// the nodes merge (both retained).
+							if (emitCollisions) {
+								this.emitImplCollision({
+									apiPath: syncWrapper_existingChildWrapper.____slothletInternal.apiPath,
+									resolution: "merged",
+									incoming: moduleID,
+									owner: syncWrapper_existingChildWrapper.____slothletInternal.moduleID,
+									kind: "namespace",
+									collisionMode: "merge"
+								});
+							}
+							// Merge its children in now, exactly as for a materialized namespace above: only the
+							// existing side's materializer survives a merge, so leaving the incoming folder lazy
+							// dropped every child it contributes (#525). The recursive call materializes both sides
+							// before comparing their keys. (The same wrapper on both sides — the boundApi pass over a
+							// child the api pass already copied across — has nothing to merge and stays lazy.)
+							await this.syncWrapper(existingChild, nextChild, config, collisionMode, moduleID, emitCollisions);
 						} else if (emitCollisions) {
 							// A terminal leaf both modules define — under `merge` the FIRST writer wins, so the
 							// incoming leaf is silently dropped. impl:created fired only for the winner, so
@@ -914,7 +921,14 @@ export class ApiManager extends ComponentBase {
 						/* v8 ignore next */
 						const nextChildWrapper = resolveWrapper(childValue) ?? childValue;
 						const hasGrandChildren = Object.keys(nextChildWrapper).some((k) => !k.startsWith("_") && !k.startsWith("__"));
-						if (hasGrandChildren) {
+						// A still-lazy incoming folder is a namespace too, whose children are not visible yet:
+						// merge it rather than swapping it in, which dropped the existing side's children (#525).
+						// The recursive call materializes both sides before comparing their keys.
+						const nextIsDeferredNamespace =
+							existingChild !== childValue &&
+							!!nextChildWrapper.____slothletInternal.materializeFunc &&
+							!nextChildWrapper.____slothletInternal.state?.materialized;
+						if (hasGrandChildren || nextIsDeferredNamespace) {
 							await this.syncWrapper(existingChild, childValue, config, collisionMode, moduleID);
 						} else {
 							delete existingWrapper[key];
@@ -3686,10 +3700,13 @@ export class ApiManager extends ComponentBase {
 	 *   When true, temporarily overrides collision mode to "replace" so the fresh impl
 	 *   fully replaces the old one. When false, the wrapper's original collision mode is
 	 *   preserved, allowing merge behavior for multi-cache rebuilds.
+	 * @param {?Set<string>} [options.reloadGroup=null] - Every moduleID rebuilt at this endpoint in
+	 *   the same reload cycle. A forced replace keeps children owned by any other module (#525).
+	 *   Omitted for a single-module reload, where only this moduleID is rebuilt.
 	 * @returns {Promise<void>}
 	 * @private
 	 */
-	async _reloadByModuleID(moduleID, { forceReplace = true } = {}) {
+	async _reloadByModuleID(moduleID, { forceReplace = true, reloadGroup = null } = {}) {
 		const cacheManager = this.slothlet.handlers.apiCacheManager;
 		if (!cacheManager) {
 			throw new this.SlothletError("CACHE_MANAGER_NOT_AVAILABLE", {
@@ -3724,6 +3741,13 @@ export class ApiManager extends ComponentBase {
 
 		// Rebuild API from disk (or, for a synthetic leaf, from the stored exports — rebuildCache
 		// re-runs buildAPI with the original value so it flattens exactly as the add did).
+		// The rebuild re-registers this module's ownership under the instance's collision mode, which can
+		// move it back over paths another module has since overridden. Decide what to keep from the
+		// ownership as it stood before the rebuild, and put those paths' order back afterwards (#525).
+		const cycle = reloadGroup ?? new Set([moduleID]);
+		const ownership = this.slothlet.handlers.ownership;
+		const ownershipBefore = ownership?.snapshotStacks(oldEntry.endpoint) ?? null;
+
 		const freshApi = await cacheManager.rebuildCache(moduleID);
 
 		// Update cache with fresh API
@@ -3744,7 +3768,11 @@ export class ApiManager extends ComponentBase {
 		});
 
 		// Traverse fresh API and update/create wrappers
-		await this._restoreApiTree(freshApi, oldEntry.endpoint, moduleID, oldEntry.collisionMode, forceReplace);
+		await this._restoreApiTree(freshApi, oldEntry.endpoint, moduleID, oldEntry.collisionMode, forceReplace, {
+			reloadGroup: cycle,
+			previousApi: oldEntry.api,
+			ownershipBefore
+		});
 
 		// DEBUG: Check if freshApi was mutated
 		this.slothlet.debug("reload", {
@@ -3761,6 +3789,8 @@ export class ApiManager extends ComponentBase {
 			moduleID
 		});
 
+		if (ownershipBefore) ownership.restoreStacks(ownershipBefore, cycle);
+
 		// Principals (#459) this module owns: values resolved by the pre-reload code are stale now.
 		this.slothlet.handlers.permissionManager?.onModuleReloaded?.(moduleID);
 
@@ -3845,8 +3875,9 @@ export class ApiManager extends ComponentBase {
 		}
 
 		for (const [, moduleIDs] of endpointOrder) {
+			const reloadGroup = new Set(moduleIDs);
 			for (let i = 0; i < moduleIDs.length; i++) {
-				await this._reloadByModuleID(moduleIDs[i], { forceReplace: i === 0 });
+				await this._reloadByModuleID(moduleIDs[i], { forceReplace: i === 0, reloadGroup });
 			}
 		}
 
@@ -4070,6 +4101,231 @@ export class ApiManager extends ComponentBase {
 		}
 	}
 
+	/**
+	 * Apply one module's rebuilt contribution to a namespace wrapper during a reload, rebuilding only
+	 * the modules in the reload cycle (#525).
+	 *
+	 * @description
+	 * A namespace can be shared: modules added at the same apiPath (and the module that already owned
+	 * it) each contribute children to it. A forced replace would clear all of them, so first the
+	 * children are split by contributor (see `_partitionNamespaceChildren`):
+	 * - a child only modules outside the cycle contribute is set aside and put back untouched (same
+	 *   wrapper reference);
+	 * - a subfolder both sides contribute to is set aside too, then rebuilt the same way one level
+	 *   down, so the cycle's changes inside it apply and the other modules' children there stay;
+	 * - everything else is the cycle's own and is rebuilt by the replace.
+	 * The rebuilt children are attributed to `moduleID`, whichever module created the namespace.
+	 * A callable namespace keeps its function when that function is another module's: the one that
+	 * created the namespace (a later add merges its children in but never makes it callable).
+	 * @param {object} wrapper - The raw namespace wrapper receiving the rebuilt contribution.
+	 * @param {string} apiPath - The namespace's api path.
+	 * @param {*} implForReload - The module's rebuilt contribution at this level.
+	 * @param {string} moduleID - The module being restored.
+	 * @param {object} scope - Reload scope.
+	 * @param {boolean} scope.forceReplace - Whether this level is replaced (else merged).
+	 * @param {Set<string>} scope.reloadGroup - Every moduleID rebuilt at this endpoint in this cycle.
+	 * @param {*} scope.previousApi - The module's contribution at this level before the reload.
+	 * @param {?Map<string, Array<{entry: Object, isMergeLoss: boolean}>>} scope.ownershipBefore - Ownership
+	 *   stacks from before the rebuild (null when ownership tracking is off).
+	 * @returns {Promise<void>}
+	 * @private
+	 */
+	async _applyScopedImpl(wrapper, apiPath, implForReload, moduleID, { forceReplace, reloadGroup, previousApi, ownershipBefore }) {
+		const split = forceReplace ? this._partitionNamespaceChildren(wrapper, apiPath, reloadGroup, ownershipBefore) : null;
+		const freshContribution = implForReload;
+		// A callable impl keeps its own properties and is applied as built; an object impl drops the
+		// keys set aside (implForReload is never null here — the caller checked the build).
+		if (split && (split.foreign.size > 0 || split.shared.size > 0) && typeof implForReload === "object") {
+			const withoutSetAside = {};
+			for (const k of Object.keys(implForReload)) {
+				if (!split.foreign.has(k) && !split.shared.has(k)) withoutSetAside[k] = implForReload[k];
+			}
+			implForReload = withoutSetAside;
+		}
+
+		// Recursively extract full impls from any child wrapper proxies with depleted _impl.
+		// This handles the common case where freshApi is a function (no ___getState) but
+		// its enumerable properties are wrapper proxies from eager rebuild.
+		// IMPORTANT: Only extract from MATERIALIZED wrappers (eager mode). Unmaterialized
+		// lazy wrappers should be preserved as-is so ___adoptImplChildren can call
+		// ___resetLazy with the fresh materializeFunc.
+		// implForReload is always an object here — freshApi is always a plain object from buildAPI.
+		/* v8 ignore next */
+		if (implForReload && typeof implForReload === "object") {
+			for (const key of Object.keys(implForReload)) {
+				const val = implForReload[key];
+				if (resolveWrapper(val) !== null) {
+					const childWrapper = resolveWrapper(val);
+					if (childWrapper.____slothletInternal.state.materialized) {
+						implForReload[key] = UnifiedWrapper._extractFullImpl(childWrapper);
+					}
+				}
+			}
+		}
+
+		const previousImpl = wrapper.____slothletInternal.impl;
+		const keepForeignCallable =
+			typeof previousImpl === "function" && typeof implForReload !== "function" && typeof previousApi !== "function";
+
+		wrapper.___setImpl(implForReload, moduleID, false, true);
+
+		if (split) this._reattachSetAsideChildren(wrapper, split);
+		if (keepForeignCallable) wrapper.____slothletInternal.impl = previousImpl;
+
+		// Rebuild each subfolder both sides contribute to, one level down.
+		for (const [key, descriptor] of split?.shared ?? []) {
+			const child = resolveWrapper(descriptor.value);
+			const freshChild = await this._namespaceImplOf(freshContribution?.[key]);
+			const previousChild = typeof child.____slothletInternal.impl === "function" ? previousApi?.[key] : undefined;
+			const customProps = this._collectCustomProperties(descriptor.value, freshChild);
+			const originalCollisionMode = child.____slothletInternal.state.collisionMode;
+			child.____slothletInternal.state.collisionMode = "replace";
+			try {
+				await this._applyScopedImpl(child, `${apiPath}.${key}`, freshChild, moduleID, {
+					forceReplace: true,
+					reloadGroup,
+					previousApi: previousChild,
+					ownershipBefore
+				});
+			} finally {
+				child.____slothletInternal.state.collisionMode = originalCollisionMode;
+			}
+			this._restoreCustomProperties(descriptor.value, customProps);
+		}
+	}
+
+	/**
+	 * The impl to rebuild a shared subfolder from: the module's rebuilt node at that path, as a plain
+	 * object of its children (or its function, for a callable node). A lazy node is materialized
+	 * first; a module that no longer contributes there yields an empty object (#525).
+	 * @param {*} node - The rebuilt module's value at the subfolder's path, if any.
+	 * @returns {Promise<*>} The impl to apply.
+	 * @private
+	 */
+	async _namespaceImplOf(node) {
+		const nodeWrapper = resolveWrapper(node);
+		if (!nodeWrapper) return node ?? {};
+		if (nodeWrapper.____slothletInternal.mode === "lazy" && !nodeWrapper.____slothletInternal.state.materialized) {
+			await nodeWrapper._materialize();
+		}
+		const impl = nodeWrapper.____slothletInternal.impl;
+		if (typeof impl === "function") return impl;
+		const children = {};
+		for (const key of Object.keys(nodeWrapper)) children[key] = nodeWrapper[key];
+		return children;
+	}
+
+	/**
+	 * Split a namespace's children by who contributes them, for a forced replace that rebuilds only
+	 * the modules in `reloadGroup`, and set aside every child the replace must not rebuild (#525).
+	 * Contributors come from the ownership stack at `<apiPath>.<key>` as it stood before the rebuild (the
+	 * live stack for a path that had none), or the child wrapper's own moduleID when ownership tracking
+	 * is off. User-assigned overrides and plain values are left in
+	 * place: `_collectCustomProperties` already carries those across the reload.
+	 * @param {object} wrapper - The raw namespace wrapper about to receive the rebuilt impl.
+	 * @param {string} apiPath - The namespace's api path.
+	 * @param {Set<string>} reloadGroup - moduleIDs being rebuilt at this endpoint in this cycle.
+	 * @param {?Map<string, Array<{entry: Object, isMergeLoss: boolean}>>} ownershipBefore - Ownership stacks
+	 *   from before the rebuild.
+	 * @returns {{ foreign: Map<string, PropertyDescriptor>, shared: Map<string, PropertyDescriptor>, keyOrder: string[] }}
+	 *   Children only other modules contribute (`foreign`), subfolders both sides contribute to
+	 *   (`shared`), and the namespace's key order before they were set aside.
+	 * @private
+	 */
+	_partitionNamespaceChildren(wrapper, apiPath, reloadGroup, ownershipBefore) {
+		const foreign = new Map();
+		const shared = new Map();
+		const ownership = this.slothlet.handlers.ownership;
+		const keyOrder = Object.keys(wrapper);
+		for (const key of keyOrder) {
+			// Read the descriptor, not the property: a getter-backed child is not a module child and
+			// resolves to no wrapper here, so it stays where it is.
+			const descriptor = Object.getOwnPropertyDescriptor(wrapper, key);
+			const child = resolveWrapper(descriptor.value);
+			if (!child || child.____slothletInternal.userAssigned) continue;
+			const childPath = `${apiPath}.${key}`;
+			const prior = ownershipBefore?.get(childPath);
+			const history = prior ? prior.map(({ entry }) => entry) : (ownership?.getPathHistory(childPath) ?? []);
+			const contributors =
+				history.length > 0
+					? history.map((entry) => entry.moduleID)
+					: ownership
+						? [child.____slothletInternal.moduleID]
+						: this._subtreeModuleIDs(child);
+			if (contributors.every((id) => reloadGroup.has(id))) continue;
+			if (contributors.some((id) => reloadGroup.has(id))) {
+				// Both sides contribute here. A namespace holds children from each, so it is rebuilt level by
+				// level; a leaf has one live value, which the cycle rebuilds only when it currently owns it.
+				const internal = child.____slothletInternal;
+				const isNamespace = Object.keys(child).length > 0 || (internal.mode === "lazy" && !internal.state.materialized);
+				if (isNamespace) {
+					shared.set(key, descriptor);
+					Reflect.deleteProperty(wrapper, key);
+					continue;
+				}
+				const owner = prior ? ownership.snapshotOwner(prior) : ownership.getCurrentOwner(childPath)?.moduleID;
+				if (reloadGroup.has(owner)) continue;
+			}
+			foreign.set(key, descriptor);
+			// Adopted children are configurable, so this removes them. Were one not, the replace could
+			// not remove it either, and reattaching its identical descriptor is a no-op.
+			Reflect.deleteProperty(wrapper, key);
+		}
+		return { foreign, shared, keyOrder };
+	}
+
+	/**
+	 * Every module a wrapper's materialized subtree carries, from each wrapper's own moduleID — the
+	 * contributors of a namespace when ownership tracking is off (#525). Walks raw wrappers only, so an
+	 * unmaterialized lazy subtree is never materialized by the walk.
+	 * @param {object} rawWrapper - The raw wrapper to start from.
+	 * @param {Set<object>} [seen] - Wrappers already walked.
+	 * @returns {string[]} The moduleIDs found.
+	 * @private
+	 */
+	_subtreeModuleIDs(rawWrapper, seen = new Set()) {
+		seen.add(rawWrapper);
+		const ids = new Set([rawWrapper.____slothletInternal.moduleID]);
+		for (const key of Object.keys(rawWrapper)) {
+			const child = resolveWrapper(Object.getOwnPropertyDescriptor(rawWrapper, key).value);
+			if (!child || seen.has(child)) continue;
+			for (const id of this._subtreeModuleIDs(child, seen)) ids.add(id);
+		}
+		return [...ids];
+	}
+
+	/**
+	 * Put the children `_partitionNamespaceChildren` set aside back on the namespace wrapper, keeping
+	 * the namespace's original key order: keys that existed before the reload keep their place, keys
+	 * the reload introduced follow them (#525).
+	 * @param {object} wrapper - The raw namespace wrapper that received the rebuilt impl.
+	 * @param {{ foreign: Map<string, PropertyDescriptor>, shared: Map<string, PropertyDescriptor>, keyOrder: string[] }} split -
+	 *   Result of `_partitionNamespaceChildren`.
+	 * @returns {void}
+	 * @private
+	 */
+	_reattachSetAsideChildren(wrapper, { foreign, shared, keyOrder }) {
+		for (const [key, descriptor] of [...foreign, ...shared]) {
+			// A key the rebuilt contribution also placed here yields to the set-aside child (the filter above
+			// keeps set-aside keys out of the impl, so this only replaces an adoption artefact).
+			Reflect.deleteProperty(wrapper, key);
+			Object.defineProperty(wrapper, key, descriptor);
+		}
+		// Re-insert every enumerable child in order: prior keys first (in their prior order), then new.
+		const current = Object.keys(wrapper);
+		const currentSet = new Set(current);
+		const ordered = keyOrder.filter((k) => currentSet.has(k));
+		const orderedSet = new Set(ordered);
+		for (const k of current) if (!orderedSet.has(k)) ordered.push(k);
+		for (const key of ordered) {
+			const descriptor = Object.getOwnPropertyDescriptor(wrapper, key);
+			// A non-configurable key cannot move: the delete fails and redefining its identical
+			// descriptor is a no-op, so it simply keeps its slot.
+			Reflect.deleteProperty(wrapper, key);
+			Object.defineProperty(wrapper, key, descriptor);
+		}
+	}
+
 	/**
 	 * Restore API from fresh rebuild by updating existing wrapper.
 	 * For non-root endpoints, updates the wrapper's implementation without replacing structure.
@@ -4081,10 +4337,25 @@ export class ApiManager extends ComponentBase {
 	 * @param {boolean} [forceReplace=true] - When true, temporarily overrides wrapper collision
 	 *   mode to "replace" so fresh impl fully replaces old. When false, preserves original
 	 *   collision mode for proper merge behavior in multi-cache rebuilds.
+	 * @param {object} [scope] - What else shares the namespace (#525).
+	 * @param {Set<string>} [scope.reloadGroup] - Every moduleID rebuilt at this endpoint in the same
+	 *   reload cycle (defaults to just `moduleID`). A forced replace keeps the children owned by any
+	 *   module outside this group, so a co-mounted module's leaves survive a scoped reload.
+	 * @param {*} [scope.previousApi=null] - This module's build from before the reload, used to tell
+	 *   whether a callable namespace's function came from this module or from a co-mounted one.
+	 * @param {?Map<string, Array<{entry: Object, isMergeLoss: boolean}>>} [scope.ownershipBefore=null] -
+	 *   Ownership stacks from before the rebuild, which decide what the reload keeps.
 	 * @returns {Promise<void>}
 	 * @private
 	 */
-	async _restoreApiTree(freshApi, endpoint, moduleID, collisionMode, forceReplace = true) {
+	async _restoreApiTree(
+		freshApi,
+		endpoint,
+		moduleID,
+		collisionMode,
+		forceReplace = true,
+		{ reloadGroup = new Set([moduleID]), previousApi = null, ownershipBefore = null } = {}
+	) {
 		// Defensive: _restoreApiTree is always called with a valid freshApi object produced
 		// by buildAPI. A null/primitive freshApi would indicate a build failure handled elsewhere.
 		/* v8 ignore next */
@@ -4309,27 +4580,14 @@ export class ApiManager extends ComponentBase {
 					}
 				}
 
-				// Recursively extract full impls from any child wrapper proxies with depleted _impl.
-				// This handles the common case where freshApi is a function (no ___getState) but
-				// its enumerable properties are wrapper proxies from eager rebuild.
-				// IMPORTANT: Only extract from MATERIALIZED wrappers (eager mode). Unmaterialized
-				// lazy wrappers should be preserved as-is so ___adoptImplChildren can call
-				// ___resetLazy with the fresh materializeFunc.
-				// implForReload is always an object here — freshApi is always a plain object from buildAPI.
-				/* v8 ignore next */
-				if (implForReload && typeof implForReload === "object") {
-					for (const key of Object.keys(implForReload)) {
-						const val = implForReload[key];
-						if (resolveWrapper(val) !== null) {
-							const childWrapper = resolveWrapper(val);
-							if (childWrapper.____slothletInternal.state.materialized) {
-								implForReload[key] = UnifiedWrapper._extractFullImpl(childWrapper);
-							}
-						}
-					}
-				}
-
-				resolveWrapper(existing).___setImpl(implForReload, moduleID);
+				// Apply the rebuilt contribution, rebuilding only the modules in this reload cycle: every other
+				// module's children here — and inside any subfolder both contribute to — are kept as they are.
+				await this._applyScopedImpl(wrapper, endpoint, implForReload, moduleID, {
+					forceReplace,
+					reloadGroup,
+					previousApi,
+					ownershipBefore
+				});
 
 				// Restore original collision mode
 				// wrapper is always truthy here — resolveWrapper(existing) returned non-null above.
diff --git a/src/lib/handlers/ownership.mjs b/src/lib/handlers/ownership.mjs
index b4b001c58..145a2c6e5 100644
--- a/src/lib/handlers/ownership.mjs
+++ b/src/lib/handlers/ownership.mjs
@@ -1406,6 +1406,77 @@ export class OwnershipManager extends ComponentBase {
 		}
 	}
 
+	/**
+	 * Snapshot the ownership stacks at and under an api path, before a reload rebuilds a module there.
+	 * @param {string} apiPath - The reloaded module's endpoint ("" or "." for the root).
+	 * @returns {Map<string, Array<{entry: Object, isMergeLoss: boolean}>>} Each path's stack, in order,
+	 *   with every entry's merge-loss flag as it was.
+	 * @public
+	 *
+	 * @description
+	 * Rebuilding a module constructs its wrappers afresh, and each construction registers the module
+	 * again under the instance's collision mode — which, under `replace`/`merge-replace`, moves it back
+	 * on top of paths another module had since overridden. The reload itself keeps those paths'
+	 * live values (#525), so {@link OwnershipManager#restoreStacks} puts their stacks back in order.
+	 */
+	snapshotStacks(apiPath) {
+		const prefix = apiPath === "." ? "" : apiPath;
+		const snapshot = new Map();
+		for (const [path, stack] of this.pathToModule) {
+			if (prefix === "" || path === prefix || path.startsWith(`${prefix}.`)) {
+				snapshot.set(
+					path,
+					stack.map((entry) => ({ entry, isMergeLoss: entry.isMergeLoss }))
+				);
+			}
+		}
+		return snapshot;
+	}
+
+	/**
+	 * The module that owned a path in a {@link OwnershipManager#snapshotStacks} snapshot.
+	 * @param {Array<{entry: Object, isMergeLoss: boolean}>|undefined} prior - One path's snapshotted stack.
+	 * @returns {string|undefined} The owning moduleID, or undefined when the path had no stack.
+	 * @public
+	 */
+	snapshotOwner(prior) {
+		if (!prior || prior.length === 0) return undefined;
+		for (let i = prior.length - 1; i >= 0; i--) {
+			if (!prior[i].isMergeLoss) return prior[i].entry.moduleID;
+		}
+		// Defensive floor, as in #currentEntry: register() never leaves a stack all merge-losses.
+		/* v8 ignore next */
+		return prior[prior.length - 1].entry.moduleID;
+	}
+
+	/**
+	 * Put back the ownership order a reload's rebuild disturbed, on every path the reloaded modules did
+	 * not own before the reload (#525).
+	 * @param {Map<string, Array<{entry: Object, isMergeLoss: boolean}>>} snapshot - From
+	 *   {@link OwnershipManager#snapshotStacks}, taken before the rebuild.
+	 * @param {Set<string>} moduleIDs - The modules rebuilt in this reload cycle.
+	 * @returns {void}
+	 * @public
+	 *
+	 * @description
+	 * On a path another module owned, that module stays the owner: the entries that were on the stack
+	 * return to their prior order and merge-loss flags (keeping any value a rebuild refreshed, so a later
+	 * remove of the owner reverts to the reloaded module's current code), and an entry the rebuild added
+	 * goes beneath them. Paths the reloaded modules owned are left as the rebuild registered them.
+	 */
+	restoreStacks(snapshot, moduleIDs) {
+		for (const [path, prior] of snapshot) {
+			if (moduleIDs.has(this.snapshotOwner(prior))) continue;
+			const stack = this.pathToModule.get(path);
+			if (!stack) continue;
+			const kept = prior.filter(({ entry }) => stack.includes(entry));
+			const keptEntries = new Set(kept.map(({ entry }) => entry));
+			const added = stack.filter((entry) => !keptEntries.has(entry));
+			for (const { entry, isMergeLoss } of kept) entry.isMergeLoss = isMergeLoss;
+			stack.splice(0, stack.length, ...added, ...kept.map(({ entry }) => entry));
+		}
+	}
+
 	/**
 	 * Clear all ownership data
 	 * @public
diff --git a/src/lib/handlers/unified-wrapper.mjs b/src/lib/handlers/unified-wrapper.mjs
index 2c2e8d00a..3a8f4b707 100644
--- a/src/lib/handlers/unified-wrapper.mjs
+++ b/src/lib/handlers/unified-wrapper.mjs
@@ -1139,6 +1139,10 @@ export class UnifiedWrapper extends ComponentBase {
 		internal.isCallable = isCallableValue;
 		internal.isCallableLocked = isCallableLocked;
 		internal.moduleID = moduleID;
+		// The module the children adopted by an in-flight ___setImpl belong to, when that call names one
+		// explicitly (a reload rebuilding one module's contribution to a namespace another module created).
+		// Null otherwise: children then belong to this wrapper's own module (#525).
+		internal.adoptOwner = null;
 		internal.filePath = filePath;
 		// Where initialImpl sits in filePath's module namespace (#484) — resolved before the clone below,
 		// against the value the module actually exported. Read by typegen through the ownership record.
@@ -1566,9 +1570,13 @@ export class UnifiedWrapper extends ComponentBase {
 	 *   wrappers and bypass collision-merged key guards. Use this for direct/explicit
 	 *   ___setImpl calls where reference preservation is the intent. Do NOT set for
 	 *   hot-reload paths (syncWrapper) where lazy refs should intentionally break.
+	 * @param {boolean} [attributeChildren=false] - When true, the children this call adopts (new ones and
+	 *   reused ones, all the way down) belong to `moduleID` rather than to this wrapper's own module. A
+	 *   reload passes it when it rebuilds one module's contribution to a namespace that another module
+	 *   created, so the rebuilt leaves stay attributed to the module that exports them (#525).
 	 * @private
 	 */
-	___setImpl(newImpl, moduleID = null, forceReuseChildren = false) {
+	___setImpl(newImpl, moduleID = null, forceReuseChildren = false, attributeChildren = false) {
 		// Debug block only fires when wrapperDebugEnabled AND apiPath === "string"; neither condition is met in tests.
 		/* v8 ignore start */
 		if ((wrapperDebugEnabled || this.____config?.debug?.wrapper) && this.____slothletInternal.apiPath === "string") {
@@ -1582,7 +1590,13 @@ export class UnifiedWrapper extends ComponentBase {
 		}
 		/* v8 ignore stop */
 
-		this._applyNewImpl(newImpl, forceReuseChildren);
+		const priorAdoptOwner = this.____slothletInternal.adoptOwner;
+		if (attributeChildren && moduleID) this.____slothletInternal.adoptOwner = moduleID;
+		try {
+			this._applyNewImpl(newImpl, forceReuseChildren);
+		} finally {
+			this.____slothletInternal.adoptOwner = priorAdoptOwner;
+		}
 
 		// Emit impl:changed event for lifecycle management
 		if (newImpl && this.slothlet.handlers?.lifecycle) {
@@ -2183,7 +2197,12 @@ export class UnifiedWrapper extends ComponentBase {
 						// (the parent's moduleID) and force child reuse, not `this.slothlet` (which the
 						// guard coerced to "[object Object]", registering a garbage ownership entry on the
 						// namespace children of every reloaded module).
-						resolveWrapper(existingChild).___setImpl(rawImpl, this.____slothletInternal.moduleID, true);
+						resolveWrapper(existingChild).___setImpl(
+							rawImpl,
+							this.____slothletInternal.adoptOwner ?? this.____slothletInternal.moduleID,
+							true,
+							this.____slothletInternal.adoptOwner != null
+						);
 					} else if (newWrapper && newWrapper.____slothletInternal.materializeFunc) {
 						// Lazy wrapper not yet materialized - fully reset existing child to lazy
 						// state using ___resetLazy for proper cleanup (clears stale _impl,
@@ -2204,7 +2223,12 @@ export class UnifiedWrapper extends ComponentBase {
 					// registered a garbage ownership entry on every reload. Pass the child's real owner
 					// (the parent's moduleID) and force child reuse — reference preservation is the intent
 					// here (adopting existing children during a reload), matching the doc's guidance.
-					resolveWrapper(existingChild).___setImpl(value, this.____slothletInternal.moduleID, true);
+					resolveWrapper(existingChild).___setImpl(
+						value,
+						this.____slothletInternal.adoptOwner ?? this.____slothletInternal.moduleID,
+						true,
+						this.____slothletInternal.adoptOwner != null
+					);
 					wrapped = existingChild;
 				}
 				// Symbol keys are not used as API module names in practice.
@@ -2610,7 +2634,10 @@ export class UnifiedWrapper extends ComponentBase {
 		// code used the child VALUE's own moduleID whenever it carried its own metadata, which
 		// attributed re-mounted base leaves to base_slothlet and made api.remove() roll them back
 		// instead of deleting them (impl:removed never fired).
-		if (parentMetadata?.baseModuleID) {
+		if (this.____slothletInternal.adoptOwner) {
+			// An in-flight ___setImpl named the module these children belong to (#525).
+			childModuleId = this.____slothletInternal.adoptOwner;
+		} else if (parentMetadata?.baseModuleID) {
 			// The raw base id, stored verbatim — read directly rather than recovered from the composite
 			// metadata tag. The composite joins the id and apiPath with the reserved MODULE_ID_SEPARATOR
 			// specifically so an id may contain any character (a user `vine:abc` convention, an internal
diff --git a/tests/vitests/suites/addapi/addapi-reload-comount.test.vitest.mjs b/tests/vitests/suites/addapi/addapi-reload-comount.test.vitest.mjs
new file mode 100644
index 000000000..311b2a360
--- /dev/null
+++ b/tests/vitests/suites/addapi/addapi-reload-comount.test.vitest.mjs
@@ -0,0 +1,385 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/addapi/addapi-reload-comount.test.vitest.mjs
+ *	@Date: 2026-09-28 21:57:05 -07:00 (1790657825)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 23:30:48 -07:00 (1790663448)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Scoped reload of one module keeps a co-mounted module's leaves (#525).
+ *
+ * @description
+ * Two modules added at the same api path (`plugins`) with different moduleIDs (`ext`, `other`)
+ * share one namespace wrapper. `api.slothlet.api.reload("ext")` must rebuild only `ext`'s
+ * contribution: every leaf `other` mounted there stays reachable (with the same reference), and
+ * the reverse holds for `reload("other")`, with the namespace's key order unchanged. A name both
+ * modules export keeps the value the adds resolved it to. The reloaded module's own contribution is
+ * still rebuilt from disk — a changed leaf picks up its new code and a deleted file's leaf goes away.
+ * Also covered: a callable namespace (a module whose default export flattens onto the mount),
+ * user-set values on the namespace, and a reload with ownership tracking unavailable.
+ *
+ * The split by contributor applies at every depth: `plugins.tools` and `plugins.tools.net` are
+ * subfolders both modules contribute to, so a reload rebuilds the reloaded module's leaves inside
+ * them and keeps the other's (same references, same key order); `plugins.tools.net.ping`, which both
+ * export, follows the ownership stack. A subfolder only the other module contributes
+ * (`plugins.tools.kit`) is kept whole and, under lazy mode, is not materialized by the reload.
+ * Last, a leaf an overriding module won keeps reverting to the first module's code on remove after
+ * either module reloads.
+ *
+ * Runs across the full matrix (eager/lazy × async/live × hooks on/off).
+ *
+ * @module tests/vitests/suites/addapi/addapi-reload-comount
+ */
+
+process.env.SLOTHLET_INTERNAL_TEST_MODE = "true";
+
+import { describe, it, expect, afterEach, vi } from "vitest";
+import { cpSync, rmSync, writeFileSync, unlinkSync } from "node:fs";
+import path from "node:path";
+import slothlet from "@cldmv/slothlet";
+import { resolveWrapper } from "#handlers/unified-wrapper";
+import { getMatrixConfigs, TEST_DIRS } from "../../setup/vitest-helper.mjs";
+
+// Instance creation plus two adds can exceed the default hook/test timeout on a loaded machine.
+vi.setConfig({ hookTimeout: 60000, testTimeout: 60000 });
+
+const API_TESTS_ROOT = path.dirname(TEST_DIRS.API_TEST);
+const EXT_DIR = path.join(API_TESTS_ROOT, "api_test_reload_comount_ext");
+const OTHER_DIR = path.join(API_TESTS_ROOT, "api_test_reload_comount_other");
+const CALLABLE_DIR = path.join(API_TESTS_ROOT, "api_test_reload_comount_callable");
+const REVERT_A_DIR = path.join(API_TESTS_ROOT, "api_test_reload_revert_a");
+const REVERT_B_DIR = path.join(API_TESTS_ROOT, "api_test_reload_revert_b");
+
+/** Leaves each module contributes under `api.plugins`, with the value each returns. */
+const EXT_LEAVES = {
+	alpha: "ext:alpha",
+	beta: "ext:beta",
+	"tools.hammer": "ext:hammer",
+	"tools.saw": "ext:saw",
+	"tools.net.http": "ext:http",
+	"tools.net.smtp": "ext:smtp"
+};
+const OTHER_LEAVES = {
+	gamma: "other:gamma",
+	delta: "other:delta",
+	"gear.cog": "other:cog",
+	"gear.spring": "other:spring",
+	"tools.wrench": "other:wrench",
+	"tools.net.dns": "other:dns",
+	"tools.net.ntp": "other:ntp",
+	"tools.kit.tape": "other:tape",
+	"tools.kit.box.nail": "other:nail"
+};
+
+/**
+ * Resolve a dotted path under `api.plugins`.
+ * @param {object} api - Slothlet API proxy.
+ * @param {string} dotted - Path relative to `api.plugins`.
+ * @returns {*} The value at that path, or undefined.
+ */
+function at(api, dotted) {
+	let cur = api.plugins;
+	for (const part of dotted.split(".")) {
+		if (cur === undefined || cur === null) return undefined;
+		cur = cur[part];
+	}
+	return cur;
+}
+
+/**
+ * Assert every listed leaf is callable under `api.plugins` and returns its expected value.
+ * @param {object} api - Slothlet API proxy.
+ * @param {Record<string, string>} leaves - Map of dotted path → expected return value.
+ * @returns {Promise<void>}
+ */
+async function expectLeaves(api, leaves) {
+	for (const [dotted, expected] of Object.entries(leaves)) {
+		const fn = at(api, dotted);
+		expect(typeof fn, `api.plugins.${dotted}`).toBe("function");
+		expect(await fn(), `api.plugins.${dotted}()`).toBe(expected);
+	}
+}
+
+/**
+ * Create an instance with the api collision mode set and every mutation enabled.
+ * @param {object} config - Matrix config.
+ * @param {string} [collisionApi] - `api.collision.api` to use; the matrix config's when omitted.
+ * @returns {Promise<object>} Slothlet API proxy.
+ */
+async function createInstance(config, collisionApi) {
+	const apiConfig = { ...config.api, mutations: { add: true, remove: true, reload: true } };
+	if (collisionApi) apiConfig.collision = { ...(config.api?.collision ?? {}), api: collisionApi };
+	return slothlet({ ...config, base: TEST_DIRS.API_TEST, api: apiConfig });
+}
+
+/**
+ * Create an instance with `ext` and `other` co-mounted at `plugins`.
+ * @param {object} config - Matrix config.
+ * @param {string} extDir - Folder to mount as `ext`.
+ * @param {string} extID - moduleID for that folder.
+ * @param {object} [options] - Options.
+ * @param {string} [options.otherDir] - Folder to mount as `other`.
+ * @param {string} [options.collisionApi] - `api.collision.api` to use.
+ * @returns {Promise<object>} Slothlet API proxy.
+ */
+async function createComounted(config, extDir = EXT_DIR, extID = "ext", { otherDir = OTHER_DIR, collisionApi } = {}) {
+	const api = await createInstance(config, collisionApi);
+	await api.slothlet.api.add("plugins", extDir, { moduleID: extID });
+	await api.slothlet.api.add("plugins", otherDir, { moduleID: "other" });
+	return api;
+}
+
+/**
+ * Copy both co-mounted fixtures into a scratch folder so a test can change them on disk.
+ * @param {string} scratchDir - Folder to copy into (recreated).
+ * @returns {{ extDir: string, otherDir: string }} The copies.
+ */
+function copyFixtures(scratchDir) {
+	rmSync(scratchDir, { recursive: true, force: true });
+	const extDir = path.join(scratchDir, "ext");
+	const otherDir = path.join(scratchDir, "other");
+	cpSync(EXT_DIR, extDir, { recursive: true });
+	cpSync(OTHER_DIR, otherDir, { recursive: true });
+	return { extDir, otherDir };
+}
+
+/**
+ * Write a single-function leaf module.
+ * @param {string} file - File to write.
+ * @param {string} name - Exported function name.
+ * @param {string} value - Value the function returns.
+ * @returns {void}
+ */
+function writeLeaf(file, name, value) {
+	writeFileSync(file, `export function ${name}() {\n\treturn "${value}";\n}\n`);
+}
+
+for (const { config, name } of getMatrixConfigs()) {
+	describe(`scoped reload keeps co-mounted modules' leaves (#525) - ${name}`, () => {
+		let api;
+		let scratchDir = null;
+
+		afterEach(async () => {
+			if (api) await api.shutdown();
+			api = null;
+			if (scratchDir) rmSync(scratchDir, { recursive: true, force: true });
+			scratchDir = null;
+		});
+
+		it("reload('ext') keeps every leaf 'other' mounted at the same path", async () => {
+			api = await createComounted(config);
+			await expectLeaves(api, { ...EXT_LEAVES, ...OTHER_LEAVES });
+			const keysBefore = Object.keys(api.plugins);
+
+			await api.slothlet.api.reload("ext");
+
+			await expectLeaves(api, { ...EXT_LEAVES, ...OTHER_LEAVES });
+			expect(Object.keys(api.plugins)).toEqual(keysBefore);
+		});
+
+		it("reload('other') keeps every leaf 'ext' mounted at the same path", async () => {
+			api = await createComounted(config);
+			await expectLeaves(api, { ...EXT_LEAVES, ...OTHER_LEAVES });
+			const keysBefore = Object.keys(api.plugins);
+
+			await api.slothlet.api.reload("other");
+
+			await expectLeaves(api, { ...EXT_LEAVES, ...OTHER_LEAVES });
+			expect(Object.keys(api.plugins)).toEqual(keysBefore);
+		});
+
+		it("reloading one module leaves the other module's leaf references untouched", async () => {
+			api = await createComounted(config);
+			await expectLeaves(api, { ...EXT_LEAVES, ...OTHER_LEAVES });
+			const gammaBefore = api.plugins.gamma;
+			const gearBefore = api.plugins.gear;
+
+			await api.slothlet.api.reload("ext");
+
+			expect(api.plugins.gamma).toBe(gammaBefore);
+			expect(api.plugins.gear).toBe(gearBefore);
+			await expectLeaves(api, OTHER_LEAVES);
+		});
+
+		it("still rebuilds the reloaded module's own contribution from disk", async () => {
+			scratchDir = path.join(process.cwd(), "tmp", `reload-comount-525-${name.replace(/[^a-z0-9]+/gi, "-")}`);
+			rmSync(scratchDir, { recursive: true, force: true });
+			cpSync(EXT_DIR, scratchDir, { recursive: true });
+
+			api = await createComounted(config, scratchDir);
+			await expectLeaves(api, { ...EXT_LEAVES, ...OTHER_LEAVES });
+
+			// Change one of ext's leaves and delete another, then reload only ext.
+			writeFileSync(path.join(scratchDir, "alpha.mjs"), `export function alpha() {\n\treturn "ext:alpha:v2";\n}\n`);
+			unlinkSync(path.join(scratchDir, "beta.mjs"));
+			await api.slothlet.api.reload("ext");
+
+			await expectLeaves(api, { alpha: "ext:alpha:v2", "tools.hammer": "ext:hammer", "tools.saw": "ext:saw", ...OTHER_LEAVES });
+			expect(api.plugins.beta).toBeUndefined();
+		});
+
+		it.each([["ext"], ["other"]])("a name both modules export keeps its resolved value across reload('%s')", async (target) => {
+			api = await createComounted(config);
+			const sharedBefore = await api.plugins.shared();
+
+			await api.slothlet.api.reload(target);
+
+			expect(await api.plugins.shared()).toBe(sharedBefore);
+		});
+
+		it("keeps user-set values on the shared namespace across a scoped reload", async () => {
+			api = await createComounted(config);
+			api.plugins.flag = 42;
+			api.plugins.custom = () => "user:custom";
+
+			await api.slothlet.api.reload("ext");
+
+			expect(api.plugins.flag).toBe(42);
+			expect(await api.plugins.custom()).toBe("user:custom");
+			await expectLeaves(api, { ...EXT_LEAVES, ...OTHER_LEAVES });
+		});
+
+		it("keeps the co-mounted leaves when ownership tracking is unavailable", async () => {
+			api = await createComounted(config);
+			await expectLeaves(api, { ...EXT_LEAVES, ...OTHER_LEAVES });
+			const sl = resolveWrapper(api.plugins).slothlet;
+			const ownership = sl.handlers.ownership;
+			sl.handlers.ownership = null;
+			try {
+				await api.slothlet.api.reload("ext");
+			} finally {
+				sl.handlers.ownership = ownership;
+			}
+
+			await expectLeaves(api, { ...EXT_LEAVES, ...OTHER_LEAVES });
+		});
+
+		it.each([["callable"], ["other"]])(
+			"a callable namespace keeps its callable and the co-mounted leaves across reload('%s')",
+			async (target) => {
+				api = await createComounted(config, CALLABLE_DIR, "callable");
+				expect(await api.plugins()).toBe("callable:main");
+				await expectLeaves(api, { extra: "callable:extra", ...OTHER_LEAVES });
+
+				await api.slothlet.api.reload(target);
+
+				expect(await api.plugins()).toBe("callable:main");
+				await expectLeaves(api, { extra: "callable:extra", ...OTHER_LEAVES });
+			}
+		);
+
+		it("a path reload that rebuilds every co-mounted module keeps the callable and every leaf", async () => {
+			api = await createComounted(config, CALLABLE_DIR, "callable");
+			expect(await api.plugins()).toBe("callable:main");
+
+			await api.slothlet.api.reload("plugins");
+
+			expect(await api.plugins()).toBe("callable:main");
+			await expectLeaves(api, { extra: "callable:extra", ...OTHER_LEAVES });
+		});
+
+		it("drops the callable when the module that exported it no longer does after its reload", async () => {
+			scratchDir = path.join(process.cwd(), "tmp", `reload-comount-525-callable-${name.replace(/[^a-z0-9]+/gi, "-")}`);
+			rmSync(scratchDir, { recursive: true, force: true });
+			cpSync(CALLABLE_DIR, scratchDir, { recursive: true });
+
+			api = await createComounted(config, scratchDir, "callable");
+			expect(await api.plugins()).toBe("callable:main");
+
+			writeFileSync(path.join(scratchDir, "main.mjs"), `export function extra() {\n\treturn "callable:extra:v2";\n}\n`);
+			await api.slothlet.api.reload("callable");
+
+			expect(() => api.plugins()).toThrow();
+			await expectLeaves(api, OTHER_LEAVES);
+		});
+
+		it.each([
+			["ext", "tools.net.http", "net/http.mjs", "http", ["tools.net.dns", "tools.wrench", "tools.kit", "gear"]],
+			["other", "tools.net.dns", "net/dns.mjs", "dns", ["tools.net.http", "tools.hammer", "alpha"]]
+		])(
+			"reload('%s') rebuilds its leaves three levels into shared subfolders and keeps the other module's",
+			async (target, changedPath, changedFile, changedName, keptPaths) => {
+				scratchDir = path.join(process.cwd(), "tmp", `reload-comount-525-deep-${target}-${name.replace(/[^a-z0-9]+/gi, "-")}`);
+				const { extDir, otherDir } = copyFixtures(scratchDir);
+				api = await createComounted(config, extDir, "ext", { otherDir });
+				await expectLeaves(api, { ...EXT_LEAVES, ...OTHER_LEAVES });
+				const keptRefs = keptPaths.map((p) => at(api, p));
+				const orders = ["", "tools", "tools.net"].map((p) => Object.keys(p ? at(api, p) : api.plugins));
+
+				writeLeaf(path.join(target === "ext" ? extDir : otherDir, "tools", changedFile), changedName, `${target}:${changedName}:v2`);
+				await api.slothlet.api.reload(target);
+
+				await expectLeaves(api, { ...EXT_LEAVES, ...OTHER_LEAVES, [changedPath]: `${target}:${changedName}:v2` });
+				keptPaths.forEach((p, i) => expect(at(api, p), `api.plugins.${p} reference`).toBe(keptRefs[i]));
+				expect(["", "tools", "tools.net"].map((p) => Object.keys(p ? at(api, p) : api.plugins))).toEqual(orders);
+			}
+		);
+
+		it.each([
+			["merge", "ext", "ext"],
+			["merge", "other", "ext"],
+			["merge-replace", "ext", "other"],
+			["merge-replace", "other", "other"]
+		])(
+			"under %s, a leaf both modules export at depth follows the ownership stack across reload('%s')",
+			async (collisionApi, target, owner) => {
+				scratchDir = path.join(
+					process.cwd(),
+					"tmp",
+					`reload-comount-525-ping-${collisionApi}-${target}-${name.replace(/[^a-z0-9]+/gi, "-")}`
+				);
+				const { extDir, otherDir } = copyFixtures(scratchDir);
+				api = await createComounted(config, extDir, "ext", { otherDir, collisionApi });
+				expect(await api.plugins.tools.net.ping()).toBe(`${owner}:ping`);
+
+				writeLeaf(path.join(extDir, "tools", "net", "ping.mjs"), "ping", "ext:ping:v2");
+				writeLeaf(path.join(otherDir, "tools", "net", "ping.mjs"), "ping", "other:ping:v2");
+				await api.slothlet.api.reload(target);
+
+				// The owner's leaf is live; it carries new code only when the owner is the module reloaded.
+				expect(await api.plugins.tools.net.ping()).toBe(owner === target ? `${owner}:ping:v2` : `${owner}:ping`);
+				await expectLeaves(api, { ...EXT_LEAVES, ...OTHER_LEAVES });
+				const ownership = resolveWrapper(api.plugins).slothlet.handlers.ownership;
+				expect(ownership.getCurrentOwner("plugins.tools.net.ping")?.moduleID).toBe(owner);
+			}
+		);
+
+		it.skipIf(config.mode !== "lazy")("does not materialize the other module's untouched lazy subtrees", async () => {
+			api = await createComounted(config);
+			const untouched = ["gear", "tools.kit"].map((p) => resolveWrapper(at(api, p)));
+			const spies = untouched.map((w) => vi.spyOn(w, "_materialize"));
+
+			await api.slothlet.api.reload("ext");
+
+			spies.forEach((spy, i) => expect(spy, `${["gear", "tools.kit"][i]}._materialize`).not.toHaveBeenCalled());
+			await expectLeaves(api, { ...EXT_LEAVES, ...OTHER_LEAVES });
+		});
+
+		it.each([
+			["merge-replace", ["A", "B"]],
+			["merge-replace", ["A"]],
+			["forceOverwrite", ["A", "B"]],
+			["forceOverwrite", ["A"]]
+		])("with B overriding A's leaf (%s), reloading %j then removing B reverts the leaf to A's code", async (how, reloads) => {
+			api = await createInstance(config, how === "merge-replace" ? "merge-replace" : undefined);
+			await api.slothlet.api.add("leaf", REVERT_A_DIR, { moduleID: "A" });
+			await api.slothlet.api.add("leaf", REVERT_B_DIR, { moduleID: "B", ...(how === "forceOverwrite" ? { forceOverwrite: true } : {}) });
+			expect(await api.leaf.an()).toBe("B:an");
+
+			for (const id of reloads) await api.slothlet.api.reload(id);
+			expect(await api.leaf.an()).toBe("B:an");
+
+			await api.slothlet.api.remove("B");
+
+			expect(await api.leaf.an()).toBe("A:an");
+			expect(await api.leaf.am()).toBe("A:am");
+			expect(api.leaf.bx).toBeUndefined();
+		});
+	});
+}
diff --git a/types/src/lib/handlers/api-manager.d.mts b/types/src/lib/handlers/api-manager.d.mts
index 9e93fc06e..780deb1cf 100644
--- a/types/src/lib/handlers/api-manager.d.mts
+++ b/types/src/lib/handlers/api-manager.d.mts
@@ -478,6 +478,9 @@ export class ApiManager extends ComponentBase {
      *   When true, temporarily overrides collision mode to "replace" so the fresh impl
      *   fully replaces the old one. When false, the wrapper's original collision mode is
      *   preserved, allowing merge behavior for multi-cache rebuilds.
+     * @param {?Set<string>} [options.reloadGroup=null] - Every moduleID rebuilt at this endpoint in
+     *   the same reload cycle. A forced replace keeps children owned by any other module (#525).
+     *   Omitted for a single-module reload, where only this moduleID is rebuilt.
      * @returns {Promise<void>}
      * @private
      */
@@ -530,6 +533,84 @@ export class ApiManager extends ComponentBase {
      * @private
      */
     private _restoreCustomProperties;
+    /**
+     * Apply one module's rebuilt contribution to a namespace wrapper during a reload, rebuilding only
+     * the modules in the reload cycle (#525).
+     *
+     * @description
+     * A namespace can be shared: modules added at the same apiPath (and the module that already owned
+     * it) each contribute children to it. A forced replace would clear all of them, so first the
+     * children are split by contributor (see `_partitionNamespaceChildren`):
+     * - a child only modules outside the cycle contribute is set aside and put back untouched (same
+     *   wrapper reference);
+     * - a subfolder both sides contribute to is set aside too, then rebuilt the same way one level
+     *   down, so the cycle's changes inside it apply and the other modules' children there stay;
+     * - everything else is the cycle's own and is rebuilt by the replace.
+     * The rebuilt children are attributed to `moduleID`, whichever module created the namespace.
+     * A callable namespace keeps its function when that function is another module's: the one that
+     * created the namespace (a later add merges its children in but never makes it callable).
+     * @param {object} wrapper - The raw namespace wrapper receiving the rebuilt contribution.
+     * @param {string} apiPath - The namespace's api path.
+     * @param {*} implForReload - The module's rebuilt contribution at this level.
+     * @param {string} moduleID - The module being restored.
+     * @param {object} scope - Reload scope.
+     * @param {boolean} scope.forceReplace - Whether this level is replaced (else merged).
+     * @param {Set<string>} scope.reloadGroup - Every moduleID rebuilt at this endpoint in this cycle.
+     * @param {*} scope.previousApi - The module's contribution at this level before the reload.
+     * @param {?Map<string, Array<{entry: Object, isMergeLoss: boolean}>>} scope.ownershipBefore - Ownership
+     *   stacks from before the rebuild (null when ownership tracking is off).
+     * @returns {Promise<void>}
+     * @private
+     */
+    private _applyScopedImpl;
+    /**
+     * The impl to rebuild a shared subfolder from: the module's rebuilt node at that path, as a plain
+     * object of its children (or its function, for a callable node). A lazy node is materialized
+     * first; a module that no longer contributes there yields an empty object (#525).
+     * @param {*} node - The rebuilt module's value at the subfolder's path, if any.
+     * @returns {Promise<*>} The impl to apply.
+     * @private
+     */
+    private _namespaceImplOf;
+    /**
+     * Split a namespace's children by who contributes them, for a forced replace that rebuilds only
+     * the modules in `reloadGroup`, and set aside every child the replace must not rebuild (#525).
+     * Contributors come from the ownership stack at `<apiPath>.<key>` as it stood before the rebuild (the
+     * live stack for a path that had none), or the child wrapper's own moduleID when ownership tracking
+     * is off. User-assigned overrides and plain values are left in
+     * place: `_collectCustomProperties` already carries those across the reload.
+     * @param {object} wrapper - The raw namespace wrapper about to receive the rebuilt impl.
+     * @param {string} apiPath - The namespace's api path.
+     * @param {Set<string>} reloadGroup - moduleIDs being rebuilt at this endpoint in this cycle.
+     * @param {?Map<string, Array<{entry: Object, isMergeLoss: boolean}>>} ownershipBefore - Ownership stacks
+     *   from before the rebuild.
+     * @returns {{ foreign: Map<string, PropertyDescriptor>, shared: Map<string, PropertyDescriptor>, keyOrder: string[] }}
+     *   Children only other modules contribute (`foreign`), subfolders both sides contribute to
+     *   (`shared`), and the namespace's key order before they were set aside.
+     * @private
+     */
+    private _partitionNamespaceChildren;
+    /**
+     * Every module a wrapper's materialized subtree carries, from each wrapper's own moduleID — the
+     * contributors of a namespace when ownership tracking is off (#525). Walks raw wrappers only, so an
+     * unmaterialized lazy subtree is never materialized by the walk.
+     * @param {object} rawWrapper - The raw wrapper to start from.
+     * @param {Set<object>} [seen] - Wrappers already walked.
+     * @returns {string[]} The moduleIDs found.
+     * @private
+     */
+    private _subtreeModuleIDs;
+    /**
+     * Put the children `_partitionNamespaceChildren` set aside back on the namespace wrapper, keeping
+     * the namespace's original key order: keys that existed before the reload keep their place, keys
+     * the reload introduced follow them (#525).
+     * @param {object} wrapper - The raw namespace wrapper that received the rebuilt impl.
+     * @param {{ foreign: Map<string, PropertyDescriptor>, shared: Map<string, PropertyDescriptor>, keyOrder: string[] }} split -
+     *   Result of `_partitionNamespaceChildren`.
+     * @returns {void}
+     * @private
+     */
+    private _reattachSetAsideChildren;
     /**
      * Restore API from fresh rebuild by updating existing wrapper.
      * For non-root endpoints, updates the wrapper's implementation without replacing structure.
@@ -541,6 +622,14 @@ export class ApiManager extends ComponentBase {
      * @param {boolean} [forceReplace=true] - When true, temporarily overrides wrapper collision
      *   mode to "replace" so fresh impl fully replaces old. When false, preserves original
      *   collision mode for proper merge behavior in multi-cache rebuilds.
+     * @param {object} [scope] - What else shares the namespace (#525).
+     * @param {Set<string>} [scope.reloadGroup] - Every moduleID rebuilt at this endpoint in the same
+     *   reload cycle (defaults to just `moduleID`). A forced replace keeps the children owned by any
+     *   module outside this group, so a co-mounted module's leaves survive a scoped reload.
+     * @param {*} [scope.previousApi=null] - This module's build from before the reload, used to tell
+     *   whether a callable namespace's function came from this module or from a co-mounted one.
+     * @param {?Map<string, Array<{entry: Object, isMergeLoss: boolean}>>} [scope.ownershipBefore=null] -
+     *   Ownership stacks from before the rebuild, which decide what the reload keeps.
      * @returns {Promise<void>}
      * @private
      */
diff --git a/types/src/lib/handlers/api-manager.d.mts.map b/types/src/lib/handlers/api-manager.d.mts.map
index 05254f4d9..6028a66e1 100644
--- a/types/src/lib/handlers/api-manager.d.mts.map
+++ b/types/src/lib/handlers/api-manager.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"api-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/api-manager.mjs"],"names":[],"mappings":"AAgFA;;;;;;;;;;;;;;GAcG;AACH;IACC,gCAAuC;IAEvC;;;;;;;;;;;OAWG;IACH,sBAVW,MAAM,EAuBhB;IAXA,sIAAsI;IACtI,OADW;QAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,MAAM,GAAC,IAAI,CAAC;QAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;KAAE,CAUjI;IAGF;;;;;;;;;;;;;;;;;;OAkBG;IACH,yBA+GC;IAED;;;;;;;;;;;;;;OAcG;IACH,oBA4CC;IAED;;;;;;;;;;;;;;OAcG;IACH,0BA4BC;IAED;;;;;;;;;;;;OAYG;IACH,6BAIC;IAED;;;;;;;;;;;;OAYG;IACH,uBASC;IAED;;;;;;;;;;;;;OAaG;IACH,yBAkCC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,iCAbW,MAAM,SACN,OAAO,iBACP,MAAM,GAAC,IAAI,GACT,IAAI,CAqHhB;IAED;;;;;;;;;;;;;OAaG;IACH,uBAEC;IAED;;;;;;;;;;;;;;OAcG;IACH,oBAoVC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,8BAiCC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,sCAmBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,uBAyGC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,uBA6MC;IAED;;;;;;;;;;;;OAYG;IACH,mBAwHC;IACD;;;;;;;;;;;;OAYG;IACH,uBAsEC;IA6CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkDG;IACH,wBAhDG;QAAuB,OAAO,EAAtB,MAAM;QACmD,UAAU,EAAnE,MAAM,GAAC,MAAM,EAAE,cAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;QACf,OAAO;KAChD,GAAU,OAAO,CAAC,MAAM,GAAC,MAAM,EAAE,CAAC,CAs/BpC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,yEATG;QAAqB,QAAQ,EAArB,MAAM;QACO,aAAa,EAA1B,MAAM;QACO,cAAc,EAA3B,MAAM;KACd,GAAU,OAAO,CAAC,IAAI,CAAC,CAgDzB;IA8BD;;;;;;;;;;;OAWG;IACH,mCAeC;IAoHD;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,mCA1BW,MAAM,YAEd;QAAyB,aAAa;QAGZ,aAAa;KACvC,GAAU,OAAO,CAAC,OAAO,CAAC,CA0pB5B;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,2BAdG;QAAwB,OAAO,EAAtB,MAAM,OAAA;QACS,QAAQ,EAAvB,MAAM,OAAA;KACf,GAAU,OAAO,CAAC,IAAI,CAAC,CAuCzB;IAED;;;;;;;;;;OAUG;IACH,0BA+EC;IAED;;;;;;;;;;;;;;OAcG;IACH,yBAsFC;IAED;;;;;;;;;;;;;OAaG;IACH,4BA0FC;IAED;;;;;;;;OAQG;IACH,iCAyDC;IAED;;;;;OAKG;IACH,iCAeC;IAED;;;;;;;;;;;;;OAaG;IACH,wBAoUC;;CACD;8BA7wI6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"api-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/api-manager.mjs"],"names":[],"mappings":"AAgFA;;;;;;;;;;;;;;GAcG;AACH;IACC,gCAAuC;IAEvC;;;;;;;;;;;OAWG;IACH,sBAVW,MAAM,EAuBhB;IAXA,sIAAsI;IACtI,OADW;QAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,MAAM,GAAC,IAAI,CAAC;QAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;KAAE,CAUjI;IAGF;;;;;;;;;;;;;;;;;;OAkBG;IACH,yBA+GC;IAED;;;;;;;;;;;;;;OAcG;IACH,oBA4CC;IAED;;;;;;;;;;;;;;OAcG;IACH,0BA4BC;IAED;;;;;;;;;;;;OAYG;IACH,6BAIC;IAED;;;;;;;;;;;;OAYG;IACH,uBASC;IAED;;;;;;;;;;;;;OAaG;IACH,yBAkCC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,iCAbW,MAAM,SACN,OAAO,iBACP,MAAM,GAAC,IAAI,GACT,IAAI,CAqHhB;IAED;;;;;;;;;;;;;OAaG;IACH,uBAEC;IAED;;;;;;;;;;;;;;OAcG;IACH,oBAkWC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,8BAiCC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,sCAmBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,uBAyGC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,uBA6MC;IAED;;;;;;;;;;;;OAYG;IACH,mBAwHC;IACD;;;;;;;;;;;;OAYG;IACH,uBAsEC;IA6CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkDG;IACH,wBAhDG;QAAuB,OAAO,EAAtB,MAAM;QACmD,UAAU,EAAnE,MAAM,GAAC,MAAM,EAAE,cAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;QACf,OAAO;KAChD,GAAU,OAAO,CAAC,MAAM,GAAC,MAAM,EAAE,CAAC,CAs/BpC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,yEATG;QAAqB,QAAQ,EAArB,MAAM;QACO,aAAa,EAA1B,MAAM;QACO,cAAc,EAA3B,MAAM;KACd,GAAU,OAAO,CAAC,IAAI,CAAC,CAgDzB;IA8BD;;;;;;;;;;;OAWG;IACH,mCAeC;IAoHD;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,mCA1BW,MAAM,YAEd;QAAyB,aAAa;QAGZ,aAAa;KACvC,GAAU,OAAO,CAAC,OAAO,CAAC,CA0pB5B;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,2BAdG;QAAwB,OAAO,EAAtB,MAAM,OAAA;QACS,QAAQ,EAAvB,MAAM,OAAA;KACf,GAAU,OAAO,CAAC,IAAI,CAAC,CAuCzB;IAED;;;;;;;;;;;;;OAaG;IACH,0BA4FC;IAED;;;;;;;;;;;;;;OAcG;IACH,yBAuFC;IAED;;;;;;;;;;;;;OAaG;IACH,4BA0FC;IAED;;;;;;;;OAQG;IACH,iCAyDC;IAED;;;;;OAKG;IACH,iCAeC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,yBA8DC;IAED;;;;;;;OAOG;IACH,yBAWC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,oCAwCC;IAED;;;;;;;;OAQG;IACH,0BASC;IAED;;;;;;;;;OASG;IACH,kCAoBC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,wBA8TC;;CACD;8BA/gJ6B,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/lib/handlers/ownership.d.mts b/types/src/lib/handlers/ownership.d.mts
index a146fe422..e2241286f 100644
--- a/types/src/lib/handlers/ownership.d.mts
+++ b/types/src/lib/handlers/ownership.d.mts
@@ -569,6 +569,52 @@ export class OwnershipManager extends ComponentBase {
         source: string;
         isMergeLoss: boolean;
     }>): void;
+    /**
+     * Snapshot the ownership stacks at and under an api path, before a reload rebuilds a module there.
+     * @param {string} apiPath - The reloaded module's endpoint ("" or "." for the root).
+     * @returns {Map<string, Array<{entry: Object, isMergeLoss: boolean}>>} Each path's stack, in order,
+     *   with every entry's merge-loss flag as it was.
+     * @public
+     *
+     * @description
+     * Rebuilding a module constructs its wrappers afresh, and each construction registers the module
+     * again under the instance's collision mode — which, under `replace`/`merge-replace`, moves it back
+     * on top of paths another module had since overridden. The reload itself keeps those paths'
+     * live values (#525), so {@link OwnershipManager#restoreStacks} puts their stacks back in order.
+     */
+    public snapshotStacks(apiPath: string): Map<string, Array<{
+        entry: Object;
+        isMergeLoss: boolean;
+    }>>;
+    /**
+     * The module that owned a path in a {@link OwnershipManager#snapshotStacks} snapshot.
+     * @param {Array<{entry: Object, isMergeLoss: boolean}>|undefined} prior - One path's snapshotted stack.
+     * @returns {string|undefined} The owning moduleID, or undefined when the path had no stack.
+     * @public
+     */
+    public snapshotOwner(prior: Array<{
+        entry: Object;
+        isMergeLoss: boolean;
+    }> | undefined): string | undefined;
+    /**
+     * Put back the ownership order a reload's rebuild disturbed, on every path the reloaded modules did
+     * not own before the reload (#525).
+     * @param {Map<string, Array<{entry: Object, isMergeLoss: boolean}>>} snapshot - From
+     *   {@link OwnershipManager#snapshotStacks}, taken before the rebuild.
+     * @param {Set<string>} moduleIDs - The modules rebuilt in this reload cycle.
+     * @returns {void}
+     * @public
+     *
+     * @description
+     * On a path another module owned, that module stays the owner: the entries that were on the stack
+     * return to their prior order and merge-loss flags (keeping any value a rebuild refreshed, so a later
+     * remove of the owner reverts to the reloaded module's current code), and an entry the rebuild added
+     * goes beneath them. Paths the reloaded modules owned are left as the rebuild registered them.
+     */
+    public restoreStacks(snapshot: Map<string, Array<{
+        entry: Object;
+        isMergeLoss: boolean;
+    }>>, moduleIDs: Set<string>): void;
     /**
      * Clear all ownership data
      * @public
diff --git a/types/src/lib/handlers/ownership.d.mts.map b/types/src/lib/handlers/ownership.d.mts.map
index 5bacdb691..52d4d286f 100644
--- a/types/src/lib/handlers/ownership.d.mts.map
+++ b/types/src/lib/handlers/ownership.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"ownership.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/ownership.mjs"],"names":[],"mappings":"AAyLA;;;;;GAKG;AAEH;;;;;GAKG;AACH;IACC,gCAAsC;IAEtC;;;OAGG;IACH,sBAFW,MAAM,EAgBhB;IAZA,4BAA6B;IAC7B,4BAA6B;IAC7B,+BAAqC;IACrC,+BAAgC;IAGhC,8BAA+B;IAG/B,2BAA4B;IAE5B,mCAAiC;IAGlC;;;;;;;;;;;;;;;;;OAiBG;IACH,oCAhBW,MAAM,OACN,MAAM,GAEJ,IAAI,CA6DhB;IAED;;;;;;;;OAQG;IACH,kCAPW,MAAM,GACJ,OAAO,CAQnB;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,uCAjBW,MAAM,WACN,MAAM,WAAS,WAEf;YAAO,MAAM,GAAE,MAAM,EAAE;KAAC,GAAC,IAAI,SAC7B,MAAM,EAAE,GAAC,IAAI,GACX,IAAI,CAoBhB;IAED;;;;;;;;;OASG;IACH,wBARW,GAAC,YACD,GAAC,GACC,IAAI,CAQhB;IAED;;;;;;;;;OASG;IACH,mCARW,MAAM,GAAC,IAAI,SACX,GAAC,GACC,MAAM,EAAE,GAAC,IAAI,CASzB;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,wCAfW,MAAM,GAAC,IAAI,OACX,MAAM,SACN,GAAC,GACC,MAAM,EAAE,GAAC,IAAI,CAgBzB;IAED;;;;;;;;;OASG;IACH,0CARW,MAAM,GAAC,IAAI,SACX,GAAC,GACC;YAAO,MAAM,GAAE,MAAM,EAAE;KAAC,GAAC,IAAI,CAQzC;IAyBD;;;;;;;;;;;;;;;OAeG;IACH,0BAdW,MAAM,GACJ;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,UAAU,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;QAAC,OAAO,EAAE,CAAC;gBAAO,MAAM,GAAE,MAAM,EAAE;SAAC,GAAC,IAAI,CAAC,CAAA;KAAC,GAAC,IAAI,CAsBnI;IAED;;;;;;;;;;;;OAYG;IACH,+BATW,MAAM,WACN,MAAM,UACN;QAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;QAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAA;KAAC,GACzF,IAAI,CAYhB;IAED;;;;;;;;OAQG;IACH,mCALW,MAAM,YACN,MAAM,GACJ,IAAI,CAUhB;IAED;;;;;OAKG;IACH,mCAJW,MAAM,GACJ,MAAM,GAAC,SAAS,CAK5B;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,kCArBW,MAAM,YACN,MAAM,iBACN,MAAM,GAAC,IAAI,GAET,MAAM,GAAC,IAAI,CA4BvB;IAED;;;;;;;;;;OAUG;IACH,kCATW,MAAM,WACN,MAAM,GACJ,MAAM,GAAC,IAAI,CAoBvB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,sHAfG;QAAwB,QAAQ,EAAxB,MAAM;QACU,OAAO,EAAvB,MAAM;QACK,KAAK,EAAhB,GAAC;QACgB,MAAM;QACN,aAAa;QACb,MAAM;QACN,QAAQ;QACD,UAAU;QAGM,iBAAiB;;;KAEjE,GAAU,MAAM,GAAC,IAAI,CA0NvB;IA2BD;;;;;;;;;;OAUG;IACH,4BAVW,MAAM,GACJ,gBAAgB,CAwC5B;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,kCAtBW,MAAM,GACJ,IAAI,CAyBhB;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,mCApBW,MAAM,GACJ,IAAI,CAqBhB;IAED;;;;;;;;;;;;;OAaG;IACH,2BAbW,MAAM,aACN,MAAM,GAAC,IAAI,GACT;QAAE,MAAM,EAAE,QAAQ,GAAC,MAAM,GAAC,SAAS,CAAC;QAAC,eAAe,EAAE,MAAM,GAAC,IAAI,CAAC;QAC5E,eAAe,EAAE,MAAM,GAAC,IAAI,CAAA;KAAE,CAgDhC;IAED;;;;;OAKG;IACH,gCAJW,MAAM,GACJ,MAAM,GAAC,IAAI,CAevB;IAED;;;;;OAKG;IACH,gCAJW,MAAM,GACJ,GAAC,CAkBb;IAED;;;;;OAKG;IACH,gCAJW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAKzB;IAED;;;;;OAKG;IACH,+BAJW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAKzB;IAED;;;;;;OAMG;IACH,0BALW,MAAM,WACN,MAAM,GACJ,OAAO,CAMnB;IAED;;;;OAIG;IACH,yBAHa,MAAM,CAkBlB;IAED;;;;;OAKG;IACH,iCAJW,MAAM,GACJ,GAAG,CAAC,MAAM,CAAC,GAAC,IAAI,CAS5B;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,4BA3BW,MAAM,YACN,MAAM,QACN,MAAM,+BAEd;QAAyB,aAAa;QAGZ,OAAO;KACjC,GAAU,IAAI,CA4DhB;IA+BD;;;;;;;;;;;;;;;OAeG;IACH,uCAdW,MAAM,GACJ,GAAG,CAAC,MAAM,EAAE;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,UAAU,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;QAAC,iBAAiB,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,CAAC,CAiCjK;IAED;;;;;;;;;;;;OAYG;IACH,8BAVW,MAAM,WACN,MAAM,YACN;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;QAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,GAExI,IAAI,CAehB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,kCA1BW,MAAM,YACN,MAAM,GACJ;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,UAAU,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;QAAC,iBAAiB,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,GAAC,SAAS,CAmC9J;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,qCA5BW,MAAM,YACN,MAAM,QACN,MAAM,gBACN,GAAG,CAAC,MAAM,EAAE;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAC,CAAC,2BAI9D,IAAI,CAmEhB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,wCA3BW,MAAM,gBACN,GAAG,CAAC,MAAM,EAAE;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,CAAC,GAGpF,IAAI,CAgChB;IAED;;;OAGG;IACH,qBAOC;IAED;;;;OAIG;IACH,sBAHa,MAAM,CAQlB;IAED;;;;OAIG;IACH,0BAHW,MAAM,QAgBhB;;CACD;;;;;;;;aAhvCa,MAAM,EAAE;;;;gBACR,MAAM,EAAE;;8BA3KQ,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"ownership.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/ownership.mjs"],"names":[],"mappings":"AAyLA;;;;;GAKG;AAEH;;;;;GAKG;AACH;IACC,gCAAsC;IAEtC;;;OAGG;IACH,sBAFW,MAAM,EAgBhB;IAZA,4BAA6B;IAC7B,4BAA6B;IAC7B,+BAAqC;IACrC,+BAAgC;IAGhC,8BAA+B;IAG/B,2BAA4B;IAE5B,mCAAiC;IAGlC;;;;;;;;;;;;;;;;;OAiBG;IACH,oCAhBW,MAAM,OACN,MAAM,GAEJ,IAAI,CA6DhB;IAED;;;;;;;;OAQG;IACH,kCAPW,MAAM,GACJ,OAAO,CAQnB;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,uCAjBW,MAAM,WACN,MAAM,WAAS,WAEf;YAAO,MAAM,GAAE,MAAM,EAAE;KAAC,GAAC,IAAI,SAC7B,MAAM,EAAE,GAAC,IAAI,GACX,IAAI,CAoBhB;IAED;;;;;;;;;OASG;IACH,wBARW,GAAC,YACD,GAAC,GACC,IAAI,CAQhB;IAED;;;;;;;;;OASG;IACH,mCARW,MAAM,GAAC,IAAI,SACX,GAAC,GACC,MAAM,EAAE,GAAC,IAAI,CASzB;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,wCAfW,MAAM,GAAC,IAAI,OACX,MAAM,SACN,GAAC,GACC,MAAM,EAAE,GAAC,IAAI,CAgBzB;IAED;;;;;;;;;OASG;IACH,0CARW,MAAM,GAAC,IAAI,SACX,GAAC,GACC;YAAO,MAAM,GAAE,MAAM,EAAE;KAAC,GAAC,IAAI,CAQzC;IAyBD;;;;;;;;;;;;;;;OAeG;IACH,0BAdW,MAAM,GACJ;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,UAAU,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;QAAC,OAAO,EAAE,CAAC;gBAAO,MAAM,GAAE,MAAM,EAAE;SAAC,GAAC,IAAI,CAAC,CAAA;KAAC,GAAC,IAAI,CAsBnI;IAED;;;;;;;;;;;;OAYG;IACH,+BATW,MAAM,WACN,MAAM,UACN;QAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;QAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAA;KAAC,GACzF,IAAI,CAYhB;IAED;;;;;;;;OAQG;IACH,mCALW,MAAM,YACN,MAAM,GACJ,IAAI,CAUhB;IAED;;;;;OAKG;IACH,mCAJW,MAAM,GACJ,MAAM,GAAC,SAAS,CAK5B;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,kCArBW,MAAM,YACN,MAAM,iBACN,MAAM,GAAC,IAAI,GAET,MAAM,GAAC,IAAI,CA4BvB;IAED;;;;;;;;;;OAUG;IACH,kCATW,MAAM,WACN,MAAM,GACJ,MAAM,GAAC,IAAI,CAoBvB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,sHAfG;QAAwB,QAAQ,EAAxB,MAAM;QACU,OAAO,EAAvB,MAAM;QACK,KAAK,EAAhB,GAAC;QACgB,MAAM;QACN,aAAa;QACb,MAAM;QACN,QAAQ;QACD,UAAU;QAGM,iBAAiB;;;KAEjE,GAAU,MAAM,GAAC,IAAI,CA0NvB;IA2BD;;;;;;;;;;OAUG;IACH,4BAVW,MAAM,GACJ,gBAAgB,CAwC5B;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,kCAtBW,MAAM,GACJ,IAAI,CAyBhB;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,mCApBW,MAAM,GACJ,IAAI,CAqBhB;IAED;;;;;;;;;;;;;OAaG;IACH,2BAbW,MAAM,aACN,MAAM,GAAC,IAAI,GACT;QAAE,MAAM,EAAE,QAAQ,GAAC,MAAM,GAAC,SAAS,CAAC;QAAC,eAAe,EAAE,MAAM,GAAC,IAAI,CAAC;QAC5E,eAAe,EAAE,MAAM,GAAC,IAAI,CAAA;KAAE,CAgDhC;IAED;;;;;OAKG;IACH,gCAJW,MAAM,GACJ,MAAM,GAAC,IAAI,CAevB;IAED;;;;;OAKG;IACH,gCAJW,MAAM,GACJ,GAAC,CAkBb;IAED;;;;;OAKG;IACH,gCAJW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAKzB;IAED;;;;;OAKG;IACH,+BAJW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAKzB;IAED;;;;;;OAMG;IACH,0BALW,MAAM,WACN,MAAM,GACJ,OAAO,CAMnB;IAED;;;;OAIG;IACH,yBAHa,MAAM,CAkBlB;IAED;;;;;OAKG;IACH,iCAJW,MAAM,GACJ,GAAG,CAAC,MAAM,CAAC,GAAC,IAAI,CAS5B;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,4BA3BW,MAAM,YACN,MAAM,QACN,MAAM,+BAEd;QAAyB,aAAa;QAGZ,OAAO;KACjC,GAAU,IAAI,CA4DhB;IA+BD;;;;;;;;;;;;;;;OAeG;IACH,uCAdW,MAAM,GACJ,GAAG,CAAC,MAAM,EAAE;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,UAAU,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;QAAC,iBAAiB,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,CAAC,CAiCjK;IAED;;;;;;;;;;;;OAYG;IACH,8BAVW,MAAM,WACN,MAAM,YACN;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;QAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,GAExI,IAAI,CAehB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,kCA1BW,MAAM,YACN,MAAM,GACJ;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,UAAU,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;QAAC,iBAAiB,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,GAAC,SAAS,CAmC9J;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,qCA5BW,MAAM,YACN,MAAM,QACN,MAAM,gBACN,GAAG,CAAC,MAAM,EAAE;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAC,CAAC,2BAI9D,IAAI,CAmEhB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,wCA3BW,MAAM,gBACN,GAAG,CAAC,MAAM,EAAE;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,CAAC,GAGpF,IAAI,CAgChB;IAED;;;;;;;;;;;;OAYG;IACH,+BAXW,MAAM,GACJ,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,CAAC,CAAC,CAsBrE;IAED;;;;;OAKG;IACH,4BAJW,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,CAAC,GAAC,SAAS,GACpD,MAAM,GAAC,SAAS,CAW5B;IAED;;;;;;;;;;;;;;OAcG;IACH,+BAZW,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,CAAC,CAAC,aAEzD,GAAG,CAAC,MAAM,CAAC,GACT,IAAI,CAoBhB;IAED;;;OAGG;IACH,qBAOC;IAED;;;;OAIG;IACH,sBAHa,MAAM,CAQlB;IAED;;;;OAIG;IACH,0BAHW,MAAM,QAgBhB;;CACD;;;;;;;;aAvzCa,MAAM,EAAE;;;;gBACR,MAAM,EAAE;;8BA3KQ,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/lib/handlers/unified-wrapper.d.mts b/types/src/lib/handlers/unified-wrapper.d.mts
index 533c25974..0205e0207 100644
--- a/types/src/lib/handlers/unified-wrapper.d.mts
+++ b/types/src/lib/handlers/unified-wrapper.d.mts
@@ -201,6 +201,10 @@ export class UnifiedWrapper extends ComponentBase {
      *   wrappers and bypass collision-merged key guards. Use this for direct/explicit
      *   ___setImpl calls where reference preservation is the intent. Do NOT set for
      *   hot-reload paths (syncWrapper) where lazy refs should intentionally break.
+     * @param {boolean} [attributeChildren=false] - When true, the children this call adopts (new ones and
+     *   reused ones, all the way down) belong to `moduleID` rather than to this wrapper's own module. A
+     *   reload passes it when it rebuilds one module's contribution to a namespace that another module
+     *   created, so the rebuilt leaves stay attributed to the module that exports them (#525).
      * @private
      */
     private ___setImpl;
diff --git a/types/src/lib/handlers/unified-wrapper.d.mts.map b/types/src/lib/handlers/unified-wrapper.d.mts.map
index 6b5d13a07..d578f2aa0 100644
--- a/types/src/lib/handlers/unified-wrapper.d.mts.map
+++ b/types/src/lib/handlers/unified-wrapper.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"unified-wrapper.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/unified-wrapper.mjs"],"names":[],"mappings":"AAu7BA;;;;;;;;;;;;;;;;;;GAkBG;AACH,4CAhBW,MAAM,GAAC,MAAM,GACX,OAAO,CAkBnB;AAo5ID;;;;;;;;;;;GAWG;AACH,sCAPW,OAAO,GACL,cAAc,GAAC,IAAI,CAkB/B;AA78ID;;;;;;;;GAQG;AACH,iCAHU,GAAG,CAAC,MAAM,CAAC,CAG2F;;;;;AAuEhH;;;;;;;;;;GAUG;AACH;IAuUC;;;;;;;;;;;;;;;;OAgBG;IACH,0BAsCC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,gCAiEC;IAzbD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,sBApCW,MAAM,mKAEd;QAAwB,IAAI,EAApB,MAAM;QACU,OAAO,EAAvB,MAAM;QACyB,WAAW;QACvB,eAAe;QAChB,UAAU;QACV,mBAAmB;QACpB,QAAQ;QACD,UAAU;QAGjB,QAAQ;QACR,YAAY;QACE,cAAc;QAI3B,eAAe;KAMzC,EA+NF;IAzQD;;;;;;;;;;;OAWG;IACH,4BAFa,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAC,SAAS,CAKzC;IA4PD;;;;;;;;;;OAUG;IACH,uEAHa,GAAC,CA+Bb;IAED;;;;OAIG;IACH,qBAHa,WAAS,MAAM,GAAC,IAAI,CAKhC;IAiJD;;;;;;;;;;;OAWG;IACH,sBA0CC;IAED;;;;;;;;;;;;OAYG;IACH,mBAkDC;IAED;;;;;;;;;OASG;IACH,qBAsDC;IAED;;;;OAIG;IACH,uBA4GC;IAED;;;;;;;;;OASG;IACH,qBAEC;IAED;;;;;;;;;OASG;IACH,sBAiBC;IAED;;;;;;;OAOG;IACH,6BAGC;IAED;;;;;;;;;;OAUG;IACH,6BA6hBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BA8PC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BA43BC;IAED;;;;;;OAMG;IACH,uCA2zDC;;CACD;8BAtzK6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"unified-wrapper.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/unified-wrapper.mjs"],"names":[],"mappings":"AAu7BA;;;;;;;;;;;;;;;;;;GAkBG;AACH,4CAhBW,MAAM,GAAC,MAAM,GACX,OAAO,CAkBnB;AA+6ID;;;;;;;;;;;GAWG;AACH,sCAPW,OAAO,GACL,cAAc,GAAC,IAAI,CAkB/B;AAx+ID;;;;;;;;GAQG;AACH,iCAHU,GAAG,CAAC,MAAM,CAAC,CAG2F;;;;;AAuEhH;;;;;;;;;;GAUG;AACH;IA2UC;;;;;;;;;;;;;;;;OAgBG;IACH,0BAsCC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,gCAiEC;IA7bD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,sBApCW,MAAM,mKAEd;QAAwB,IAAI,EAApB,MAAM;QACU,OAAO,EAAvB,MAAM;QACyB,WAAW;QACvB,eAAe;QAChB,UAAU;QACV,mBAAmB;QACpB,QAAQ;QACD,UAAU;QAGjB,QAAQ;QACR,YAAY;QACE,cAAc;QAI3B,eAAe;KAMzC,EAmOF;IA7QD;;;;;;;;;;;OAWG;IACH,4BAFa,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAC,SAAS,CAKzC;IAgQD;;;;;;;;;;OAUG;IACH,uEAHa,GAAC,CA+Bb;IAED;;;;OAIG;IACH,qBAHa,WAAS,MAAM,GAAC,IAAI,CAKhC;IAiJD;;;;;;;;;;;OAWG;IACH,sBA0CC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,mBAwDC;IAED;;;;;;;;;OASG;IACH,qBAsDC;IAED;;;;OAIG;IACH,uBA4GC;IAED;;;;;;;;;OASG;IACH,qBAEC;IAED;;;;;;;;;OASG;IACH,sBAiBC;IAED;;;;;;;OAOG;IACH,6BAGC;IAED;;;;;;;;;;OAUG;IACH,6BAuiBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BAiQC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BA43BC;IAED;;;;;;OAMG;IACH,uCA2zDC;;CACD;8BAj1K6B,2BAA2B"}
\ No newline at end of file

From 0e11353765599d488a1f63d0408ff50234779a5a Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Mon, 28 Sep 2026 21:58:47 -0700
Subject: [PATCH 40/49] =?UTF-8?q?feat(reload):=20add=20api.slothlet.restar?=
 =?UTF-8?q?t()=20=E2=80=94=20a=20clean-slate=20rebuild=20behind=20the=20sa?=
 =?UTF-8?q?me=20api=20reference?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

reload() deliberately keeps runtime state. restart() is the opposite: it
tears the instance down through the normal teardown path and builds a new
one from the original slothlet({...}) config, swapped in behind the same
api proxy.

- The config passed to slothlet() is snapshotted at creation (plain
  objects/arrays copied and frozen; reference/context kept by identity;
  a relative base stays resolved against the creating call).
- Nothing runtime is carried over: add()/remove() history, runtime hooks,
  permission/event rules, principals, event and lifecycle subscriptions,
  metadata, runtime assignments and module-scope state are dropped;
  config-declared settings are re-applied.
- Held child references are re-pointed: wrappers record a restart epoch,
  and once a newer tree is live their proxy traps (and lazy waiting
  proxies) forward to the node at the same path, resolved on each use.
  A path that no longer exists throws RESTART_REFERENCE_UNRESOLVED.
- Lifecycle: restart -> shutdown (old instance) -> init (new instance)
  -> restarted. shutdown now fires on every teardown and init on the
  cold start; config-declared lifecycle handlers receive all four,
  runtime subscribers go with the old instance.
- Concurrent restart() calls share one restart; in-flight calls finish
  on the old implementation. The teardown runs as the host, so a module
  allowed to restart is not refused halfway. Gated by
  api.mutations.reload.
- Permissions: the new instance has only the original config's rules and
  is not sealed, even after control.seal(). With a permissions config, a
  built-in rule denies slothlet.restart to modules; an exact-target
  instance rule re-opens it. With no permissions config it is reachable.

Fixes #504
---
 api_tests/api_test_restart/conn.mjs           |  26 +
 api_tests/api_test_restart/counter.mjs        |  36 ++
 api_tests/api_test_restart/factory/widget.mjs |  28 +
 api_tests/api_test_restart/initialize.mjs     |  26 +
 api_tests/api_test_restart/probe.mjs          |  70 +++
 api_tests/api_test_restart/secret.mjs         |  33 +
 api_tests/api_test_restart/shutdown.mjs       |  27 +
 api_tests/api_test_restart/tracker.mjs        |  30 +
 api_tests/api_test_restart_extra/plugin.mjs   |  24 +
 docs/LIFECYCLE.md                             |  47 ++
 docs/PERMISSIONS.md                           |  17 +-
 docs/RELOAD.md                                |  94 ++-
 docs/generated/API.md                         |   2 +-
 src/lib/builders/api_builder.mjs              |  16 +
 src/lib/handlers/permission-manager.mjs       |   7 +
 src/lib/handlers/unified-wrapper.mjs          | 157 ++++-
 src/lib/i18n/languages/de-de.json             |   2 +
 src/lib/i18n/languages/en-gb.json             |   2 +
 src/lib/i18n/languages/en-us.json             |   2 +
 src/lib/i18n/languages/es-es.json             |   2 +
 src/lib/i18n/languages/es-mx.json             |   2 +
 src/lib/i18n/languages/fr-fr.json             |   2 +
 src/lib/i18n/languages/hi-in.json             |   2 +
 src/lib/i18n/languages/ja-jp.json             |   2 +
 src/lib/i18n/languages/ko-kr.json             |   2 +
 src/lib/i18n/languages/pt-br.json             |   2 +
 src/lib/i18n/languages/ru-ru.json             |   2 +
 src/lib/i18n/languages/zh-cn.json             |   2 +
 src/slothlet.mjs                              | 266 +++++++-
 .../api-manager/restart.test.vitest.mjs       | 574 ++++++++++++++++++
 tools/ci/i18n-latin-tokens-accepted.json      |   2 +
 types/src/lib/builders/api_builder.d.mts.map  |   2 +-
 .../lib/handlers/permission-manager.d.mts.map |   2 +-
 .../lib/handlers/unified-wrapper.d.mts.map    |   2 +-
 types/src/slothlet.d.mts                      |   3 +-
 types/src/slothlet.d.mts.map                  |   2 +-
 36 files changed, 1504 insertions(+), 13 deletions(-)
 create mode 100644 api_tests/api_test_restart/conn.mjs
 create mode 100644 api_tests/api_test_restart/counter.mjs
 create mode 100644 api_tests/api_test_restart/factory/widget.mjs
 create mode 100644 api_tests/api_test_restart/initialize.mjs
 create mode 100644 api_tests/api_test_restart/probe.mjs
 create mode 100644 api_tests/api_test_restart/secret.mjs
 create mode 100644 api_tests/api_test_restart/shutdown.mjs
 create mode 100644 api_tests/api_test_restart/tracker.mjs
 create mode 100644 api_tests/api_test_restart_extra/plugin.mjs
 create mode 100644 tests/vitests/suites/api-manager/restart.test.vitest.mjs

diff --git a/api_tests/api_test_restart/conn.mjs b/api_tests/api_test_restart/conn.mjs
new file mode 100644
index 000000000..6346330cb
--- /dev/null
+++ b/api_tests/api_test_restart/conn.mjs
@@ -0,0 +1,26 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_restart/conn.mjs
+ *	@Date: 2026-09-21T01:27:16+00:00 (1789954036)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-26 22:30:51 -07:00 (1790487051)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview restart() fixture (#504): the module's top level creates the emitter, so every fresh
+ * import yields a new one stamped with the import generation.
+ * @module api_test_restart.conn
+ */
+import { EventEmitter } from "node:events";
+
+const state = (globalThis.__slothletRestartFixture ??= { imports: 0, shutdowns: [] });
+
+const conn = new EventEmitter();
+conn.generation = ++state.imports;
+
+export default conn;
diff --git a/api_tests/api_test_restart/counter.mjs b/api_tests/api_test_restart/counter.mjs
new file mode 100644
index 000000000..b00564a92
--- /dev/null
+++ b/api_tests/api_test_restart/counter.mjs
@@ -0,0 +1,36 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_restart/counter.mjs
+ *	@Date: 2026-09-21T01:27:16+00:00 (1789954036)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-26 22:30:51 -07:00 (1790487051)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview restart() fixture (#504): module-scope state that only a fresh import resets.
+ * @module api_test_restart.counter
+ */
+
+let count = 0;
+
+/**
+ * Increment the module-scope counter.
+ * @returns {number} The new count.
+ */
+export function increment() {
+	count += 1;
+	return count;
+}
+
+/**
+ * Read the module-scope counter.
+ * @returns {number} The current count.
+ */
+export function current() {
+	return count;
+}
diff --git a/api_tests/api_test_restart/factory/widget.mjs b/api_tests/api_test_restart/factory/widget.mjs
new file mode 100644
index 000000000..144d210e4
--- /dev/null
+++ b/api_tests/api_test_restart/factory/widget.mjs
@@ -0,0 +1,28 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_restart/factory/widget.mjs
+ *	@Date: 2026-09-21T01:27:16+00:00 (1789954036)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-26 22:30:51 -07:00 (1790487051)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview restart() fixture (#504): a constructible default export stamped with the emitter
+ * generation of the import that defined it.
+ * @module api_test_restart.factory.widget
+ */
+
+const state = (globalThis.__slothletRestartFixture ??= { imports: 0, shutdowns: [] });
+
+/**
+ * A constructor function whose instances record the conn generation current at construction.
+ * @returns {void}
+ */
+export default function Widget() {
+	this.generation = state.imports;
+}
diff --git a/api_tests/api_test_restart/initialize.mjs b/api_tests/api_test_restart/initialize.mjs
new file mode 100644
index 000000000..91a423240
--- /dev/null
+++ b/api_tests/api_test_restart/initialize.mjs
@@ -0,0 +1,26 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_restart/initialize.mjs
+ *	@Date: 2026-09-21T01:27:16+00:00 (1789954036)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-26 22:30:51 -07:00 (1790487051)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview restart() fixture (#504): the user's own root `initialize` (default startup routine).
+ * @module api_test_restart.initialize
+ */
+
+/**
+ * Record that the user's root initialize ran.
+ * @returns {void}
+ */
+export default function initialize() {
+	const state = (globalThis.__slothletRestartFixture ??= { imports: 0, shutdowns: [] });
+	(state.userInitializes ??= []).push(state.imports);
+}
diff --git a/api_tests/api_test_restart/probe.mjs b/api_tests/api_test_restart/probe.mjs
new file mode 100644
index 000000000..5e0978a4f
--- /dev/null
+++ b/api_tests/api_test_restart/probe.mjs
@@ -0,0 +1,70 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_restart/probe.mjs
+ *	@Date: 2026-09-21T01:27:16+00:00 (1789954036)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-26 22:30:51 -07:00 (1790487051)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview restart() fixture (#504): reads through `self` from inside a leaf, so a test can check
+ * which instance `self` resolves to, and exposes a slow call for in-flight behavior.
+ * @module api_test_restart.probe
+ */
+import { self } from "@cldmv/slothlet/runtime";
+
+/**
+ * The instance ID `self` resolves to.
+ * @returns {string} `self.slothlet.instanceID`.
+ */
+export function instanceID() {
+	return self.slothlet.instanceID;
+}
+
+/**
+ * The emitter generation `self.conn` resolves to.
+ * @returns {number} `self.conn.generation`.
+ */
+export function connGeneration() {
+	return self.conn.generation;
+}
+
+/**
+ * Wait, then report the emitter generation captured when the call started.
+ * @param {number} ms - Delay in milliseconds.
+ * @returns {Promise<number>} The generation seen at call start.
+ */
+export async function slow(ms) {
+	const generation = self.conn.generation;
+	await new Promise((resolve) => setTimeout(resolve, ms));
+	return generation;
+}
+
+/**
+ * Call the `blocked` leaf as this module (permission tests).
+ * @returns {string} The leaf's result.
+ */
+export function callBlocked() {
+	return self.secret.blocked();
+}
+
+/**
+ * Call the `open` leaf as this module (permission tests).
+ * @returns {string} The leaf's result.
+ */
+export function callOpen() {
+	return self.secret.open();
+}
+
+/**
+ * Restart the instance from inside this module (permission tests: host-only by default).
+ * @returns {Promise<unknown>} The restart result.
+ */
+export async function restartInstance() {
+	return self.slothlet.restart();
+}
diff --git a/api_tests/api_test_restart/secret.mjs b/api_tests/api_test_restart/secret.mjs
new file mode 100644
index 000000000..fa1e36f3f
--- /dev/null
+++ b/api_tests/api_test_restart/secret.mjs
@@ -0,0 +1,33 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_restart/secret.mjs
+ *	@Date: 2026-09-21T01:27:16+00:00 (1789954036)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-26 22:30:51 -07:00 (1790487051)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview restart() fixture (#504): permission targets.
+ * @module api_test_restart.secret
+ */
+
+/**
+ * Target of a config-declared deny rule.
+ * @returns {string} "blocked".
+ */
+export function blocked() {
+	return "blocked";
+}
+
+/**
+ * Target of a runtime-added deny rule.
+ * @returns {string} "open".
+ */
+export function open() {
+	return "open";
+}
diff --git a/api_tests/api_test_restart/shutdown.mjs b/api_tests/api_test_restart/shutdown.mjs
new file mode 100644
index 000000000..a32bc74f7
--- /dev/null
+++ b/api_tests/api_test_restart/shutdown.mjs
@@ -0,0 +1,27 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_restart/shutdown.mjs
+ *	@Date: 2026-09-21T01:27:16+00:00 (1789954036)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-26 22:30:51 -07:00 (1790487051)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview restart() fixture (#504): the user's own root `shutdown`, which a restart's teardown
+ * must run — also when the restart was triggered by a module.
+ * @module api_test_restart.shutdown
+ */
+
+/**
+ * Record that the user's root shutdown ran.
+ * @returns {void}
+ */
+export default function shutdown() {
+	const state = (globalThis.__slothletRestartFixture ??= { imports: 0, shutdowns: [] });
+	(state.userShutdowns ??= []).push(state.imports);
+}
diff --git a/api_tests/api_test_restart/tracker.mjs b/api_tests/api_test_restart/tracker.mjs
new file mode 100644
index 000000000..676533225
--- /dev/null
+++ b/api_tests/api_test_restart/tracker.mjs
@@ -0,0 +1,30 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_restart/tracker.mjs
+ *	@Date: 2026-09-21T01:27:16+00:00 (1789954036)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-26 22:30:51 -07:00 (1790487051)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview restart() fixture (#504): a shutdown routine contributor that records which import
+ * generation was torn down.
+ * @module api_test_restart.tracker
+ */
+
+const state = (globalThis.__slothletRestartFixture ??= { imports: 0, shutdowns: [] });
+const generation = (state.trackerImports = (state.trackerImports ?? 0) + 1);
+
+/**
+ * Shutdown routine: record this module's generation.
+ * @returns {void}
+ */
+export function shutdown() {
+	state.shutdowns.push(generation);
+	if (state.throwOnShutdown) throw new Error("tracker shutdown failure");
+}
diff --git a/api_tests/api_test_restart_extra/plugin.mjs b/api_tests/api_test_restart_extra/plugin.mjs
new file mode 100644
index 000000000..1dbdf97ac
--- /dev/null
+++ b/api_tests/api_test_restart_extra/plugin.mjs
@@ -0,0 +1,24 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_restart_extra/plugin.mjs
+ *	@Date: 2026-09-21T01:27:16+00:00 (1789954036)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-26 22:30:51 -07:00 (1790487051)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview restart() fixture (#504): mounted at runtime with api.slothlet.api.add().
+ * @module api_test_restart_extra.plugin
+ */
+
+/**
+ * @returns {string} "plugin".
+ */
+export function ping() {
+	return "plugin";
+}
diff --git a/docs/LIFECYCLE.md b/docs/LIFECYCLE.md
index ce5083c3b..5cbbd8176 100644
--- a/docs/LIFECYCLE.md
+++ b/docs/LIFECYCLE.md
@@ -216,6 +216,53 @@ Emitted when all lazy-mode modules have been materialized. Requires `tracking: {
 
 ---
 
+## Instance Events
+
+Four events mark an instance coming up, going down, and being replaced by [`api.slothlet.restart()`](RELOAD.md#apislothletrestart). A restart emits all four, in this order:
+
+| Order | Event       | Emitted on   | Fires when                                                                                                                    |
+| ----- | ----------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------- |
+| 1     | `restart`   | old instance | `restart()` begins — before anything is torn down                                                                             |
+| 2     | `shutdown`  | old instance | internal teardown begins (after `mode: "shutdown"` routines and the root `shutdown` hook have run), while the api is still up |
+| 3     | `init`      | new instance | the new instance has finished building, including `mode: "startup"` routines                                                  |
+| 4     | `restarted` | new instance | the new instance is live behind the same `api` reference and held references have been re-pointed at it                       |
+
+`shutdown` and `init` are not restart-specific: `shutdown` fires on every teardown (`api.shutdown()`, `api.slothlet.shutdown()`, `api.destroy()`), and `init` fires when `slothlet()` finishes the cold start. A `reload()` is the same instance re-reading its modules, so it emits neither.
+
+**Event data:**
+
+```javascript
+// restart
+{ instanceID: "slothlet_…" }                                    // the instance being replaced
+// shutdown
+{ instanceID: "slothlet_…", restart: true }                     // restart: false for a plain shutdown
+// init
+{ instanceID: "slothlet_…", restart: true }                     // restart: false for the cold start
+// restarted
+{ instanceID: "slothlet_…", previousInstanceID: "slothlet_…" }
+```
+
+**Who receives them.** Each event reaches the subscribers of the instance it is emitted on. A restart builds the new instance from the original config and carries nothing runtime over, so:
+
+- Handlers declared in the [`lifecycle` config option](#construction-time-subscription-lifecycle-config-option) receive **all four** — they are subscribed on the old instance and subscribed again on the new one, because the new one is built from the same config. The same handlers receive `init` at the cold start too.
+- Handlers added at runtime with `api.slothlet.lifecycle.on(...)` belong to the old instance: they receive `restart` and `shutdown`, then are dropped with it. They never see `init` or `restarted`, nor any later event.
+
+To act once a restart has completed, either declare a `restarted` (or `init`) handler in the `lifecycle` config option, or simply await the call — `await api.slothlet.restart()` resolves after `restarted` has been emitted.
+
+```javascript
+const api = await slothlet({
+	base: "./api",
+	lifecycle: {
+		restart: ({ instanceID }) => log(`restarting ${instanceID}`),
+		restarted: ({ instanceID, previousInstanceID }) => log(`${previousInstanceID} → ${instanceID}`)
+	}
+});
+
+await api.slothlet.restart();
+```
+
+---
+
 ## Module Discovery Events
 
 These fire from the module discovery + mount pipeline at `api.slothlet.api.modules.*` (see the dedicated module discovery docs for the full surface). They observe both the discovery phase and the per-module mount phase.
diff --git a/docs/PERMISSIONS.md b/docs/PERMISSIONS.md
index c610e29ce..de6c38576 100644
--- a/docs/PERMISSIONS.md
+++ b/docs/PERMISSIONS.md
@@ -803,7 +803,22 @@ To allow a trusted module to toggle permissions, add a more specific allow rule:
 | `control.seal()`            | One-way lock (v3.12.0+). Freezes the policy: after sealing, `enable`, `disable`, `addRule`, `removeRule`, `readGating`, and `principal.register` / `principal.unregister` throw `PERMISSION_SEALED`. Idempotent; there is no unseal. Enforcement keeps running, `principal.invalidate` keeps working, and `shutdown()` is never blocked. |
 | `control.sealed`            | Accessor — whether the control surface has been sealed (`boolean`).                                                                                                                                                                                                                                                                      |
 
-**Sealing the policy.** `control.seal()` locks the permission policy so it cannot be mutated again for the life of the instance — useful once a host has finished wiring rules and wants to guarantee no later code (including a rule-managing leaf) can widen access. Only the host or an explicitly-allowed module can call it, since `control.**` is deny-by-default for modules. The seal is preserved across `reload()`. It never blocks `shutdown()`, so teardown always works, and it does not change enforcement — sealed or not, rules evaluate the same.
+**Sealing the policy.** `control.seal()` locks the permission policy so it cannot be mutated again for the life of the instance — useful once a host has finished wiring rules and wants to guarantee no later code (including a rule-managing leaf) can widen access. Only the host or an explicitly-allowed module can call it, since `control.**` is deny-by-default for modules. The seal is preserved across `reload()`. [`restart()`](RELOAD.md#apislothletrestart) is different: it rebuilds the instance from its original config, so the new instance has only the config's rules and is **not sealed** — seal it again afterwards if needed. The seal never blocks `shutdown()`, so teardown always works, and it does not change enforcement — sealed or not, rules evaluate the same.
+
+### `restart` — Host-Only by Default
+
+[`api.slothlet.restart()`](RELOAD.md#apislothletrestart) rebuilds the instance from its original config and discards every runtime rule, event rule, principal and the seal. A module that could call it could undo the host's runtime policy, so a built-in rule denies it to every module:
+
+```javascript
+// Built-in rule registered for every instance:
+{ caller: "**", target: "slothlet.restart", effect: "deny" }
+```
+
+Like every built-in rule, it is enforced only when the instance has a `permissions` config. With no `permissions` block the permission system is off entirely, so modules can call `restart()`; configure `permissions` (even just `{ defaultPolicy: "allow" }`) to make it host-only. The host is never gated. To let a trusted module restart the instance, add an instance rule on the same exact target — equal specificity, higher layer, so it outranks the built-in (this holds under both `defaultPolicy: "allow"` and `"deny"`):
+
+```javascript
+{ caller: "admin.**", target: "slothlet.restart", effect: "allow" }
+```
 
 ### Lifecycle methods and default routines — Host-Only
 
diff --git a/docs/RELOAD.md b/docs/RELOAD.md
index 2a85a9039..e73861905 100644
--- a/docs/RELOAD.md
+++ b/docs/RELOAD.md
@@ -1,6 +1,6 @@
 # Runtime API Mutations & Reload
 
-Slothlet supports three runtime mutation operations - `add`, `remove`, and `reload` - that let you evolve the API surface after initialization without destroying existing references. All three share a common proxy-based reference preservation system so callers never need to re-acquire the API object.
+Slothlet supports three runtime mutation operations - `add`, `remove`, and `reload` - that let you evolve the API surface after initialization without destroying existing references. All three share a common proxy-based reference preservation system so callers never need to re-acquire the API object. For the opposite of a reload — throwing away everything that happened at runtime — see [`api.slothlet.restart()`](#apislothletrestart).
 
 ---
 
@@ -16,6 +16,7 @@ Slothlet supports three runtime mutation operations - `add`, `remove`, and `relo
 - [ESM / CJS Cache Busting](#esm--cjs-cache-busting)
 - [Operation History and Replay](#operation-history-and-replay)
 - [Module Ownership (moduleID)](#module-ownership-moduleid)
+- [api.slothlet.restart()](#apislothletrestart)
 - [Lifecycle Events](#lifecycle-events)
 
 ---
@@ -397,6 +398,97 @@ See [CONFIGURATION.md](CONFIGURATION.md#the-apislothletdiag-namespace) for the f
 
 ---
 
+## `api.slothlet.restart()`
+
+`reload()` is deliberately **not** a clean slate: it keeps references, replays the runtime `add()` / `remove()` history, and keeps hooks, runtime permission rules, metadata and runtime assignments. `restart()` is the opposite — it behaves exactly as if the instance were created again from the `slothlet({...})` call that made it, but behind the same `api` reference.
+
+```javascript
+const api = await slothlet({ base: "./api" });
+
+api.conn.handlers = { onSend }; // runtime assignment
+await api.slothlet.api.add("plugins", "./plugins");
+
+await api.slothlet.api.reload(); // api.conn.handlers and api.plugins are still there
+await api.slothlet.restart(); // both gone — the instance is back to its original config
+```
+
+A restart:
+
+1. emits `restart` on the old instance,
+2. shuts the old instance down through the normal teardown path — `mode: "shutdown"` routines, the root `shutdown` hook, then the internal teardown (emits `shutdown`; clears the context store, ownership, the permission / version / event managers, the EventEmitter and scheduler patches it holds, and the TypeScript transform cache),
+3. builds a **new instance** from the **original config** under a new instance ID — every module is imported fresh (cache-busted), so module-scope state starts over — and emits `init` on it,
+4. swaps it in behind the existing `api` root proxy, re-points held references, and emits `restarted`.
+
+See [LIFECYCLE.md](LIFECYCLE.md#instance-events) for the four events and who receives them.
+
+### Reload vs restart
+
+|                                                   | full reload (`api.slothlet.reload()`)                   | `restart()`                                             |
+| ------------------------------------------------- | ------------------------------------------------------- | ------------------------------------------------------- |
+| Rebuilds from                                     | the current config                                      | the **original** `slothlet({...})` config               |
+| Module-scope state                                | fresh (modules re-imported)                             | fresh (modules re-imported)                             |
+| Runtime `add()` / `remove()` history              | replayed                                                | **dropped**                                             |
+| Runtime hooks (`hook.on`)                         | kept                                                    | **dropped**                                             |
+| Runtime permission rules, event rules, principals | replayed                                                | **dropped** (config-declared rules re-applied)          |
+| Runtime event subscriptions (`event.on`)          | dropped                                                 | **dropped**                                             |
+| Runtime lifecycle subscribers (`lifecycle.on`)    | dropped                                                 | **dropped** (config `lifecycle` handlers re-subscribed) |
+| User metadata (`metadata.set` / `setGlobal`)      | kept                                                    | **dropped** (config `metadata` re-applied)              |
+| Runtime assignments (`api.x = …`, `self.x = …`)   | cleared (a base `api.slothlet.api.reload()` keeps them) | **dropped**                                             |
+| `control.seal()`                                  | preserved                                               | **dropped** — the new instance starts unsealed          |
+| `api.slothlet.env` snapshot                       | kept                                                    | re-captured (a new instance)                            |
+| Instance ID                                       | rotated (`<id>_reload_<ts>`)                            | new                                                     |
+| `api` reference                                   | preserved                                               | preserved                                               |
+| Held child references (`const conn = api.conn`)   | see [Reference Preservation](#reference-preservation)   | re-pointed to the new instance's node at the same path  |
+| Lifecycle events                                  | `impl:changed` per replaced leaf                        | `restart` → `shutdown` → `init` → `restarted`           |
+| Gated by                                          | `api.mutations.reload`                                  | `api.mutations.reload`                                  |
+
+### The original config
+
+The config object passed to `slothlet()` is snapshotted when the instance is created: plain objects and arrays are copied (and the copy frozen), so mutating your own options object afterwards does not change what a restart rebuilds from. Functions, class instances and other non-plain values are kept as passed, and the top-level `reference` and `context` objects are kept by identity — they are your live objects, handed to the new instance just as the original call handed them over. A relative `base` stays resolved against the file that made the original `slothlet()` call, not against the caller of `restart()`.
+
+### Held references
+
+The `api` root keeps working unchanged. A reference to anything below it — `const conn = api.conn`, `const add = api.math.add` — is re-pointed: from the moment the swap completes, every operation on it (property reads and writes, calls, `in`, key enumeration) is forwarded to the node at the **same path** in the new instance, resolved afresh on each use, so the reference keeps following any number of restarts. The resolution is ordinary property access from the root, with the same lazy materialization and the same read-level permission gate as re-reading `api.<path>` would have.
+
+If the path no longer exists after the restart — typically a mount made at runtime with `add()`, which a restart does not replay — using the reference throws `RESTART_REFERENCE_UNRESOLVED`:
+
+```javascript
+await api.slothlet.api.add("plugin", "./plugin");
+const plugin = api.plugin;
+
+await api.slothlet.restart();
+plugin.ping(); // throws SlothletError RESTART_REFERENCE_UNRESOLVED ('plugin' no longer exists)
+```
+
+A held reference keeps the `typeof` it had when it was taken (a proxy's callability is fixed at creation), so a path that changed from a namespace object to a function across the restart is best re-read from `api`.
+
+### Calls in flight and concurrent restarts
+
+`restart()` does not wait for calls that are already running, and does not reject them: as with `reload()`, a call that began before the restart finishes on the old implementation (only in-flight lazy materializations are drained, by the teardown). A `self` lookup inside such a call reaches the new instance once the swap is complete. Calling `restart()` again while one is in progress returns the same promise — the two calls share one restart.
+
+### Errors
+
+- A throwing `mode: "shutdown"` routine or root `shutdown` hook does not stop the restart; the old instance is still torn down, the new one is built, and the error is re-thrown once `restarted` has been emitted.
+- If building the new instance fails (for example a module that no longer parses), the old instance is already shut down and the error propagates; fix the cause and call `restart()` again — the original config is still retained.
+- `restart()` throws `INVALID_CONFIG_MUTATIONS_DISABLED` when `api.mutations.reload` is `false`.
+
+### Permissions and the seal
+
+A restart is a fresh `slothlet({...})` call, and that includes the permission policy: the new instance has **exactly the rules declared in the original config** — every rule, event rule and principal added at runtime is gone — and it is **not sealed**, even if the old instance was. If the host relies on `control.seal()`, it seals the new instance again after the restart (for example from a config-declared `restarted` lifecycle handler, or after `await api.slothlet.restart()`).
+
+Because a restart discards the runtime policy, **modules cannot call it by default**: a built-in rule denies `slothlet.restart` to every module, the same way `slothlet.permissions.control.**` is protected. Like every built-in rule, it applies only when the instance has a `permissions` config: with no `permissions` block the permission system is off, and modules can call `restart()` (as they can `reload()` and `shutdown()`). The host is never gated. To let a trusted module restart the instance, add an instance rule on the same exact target — it outranks the built-in:
+
+```javascript
+const api = await slothlet({
+	base: "./api",
+	permissions: { rules: [{ caller: "admin.**", target: "slothlet.restart", effect: "allow" }] }
+});
+```
+
+See [PERMISSIONS.md](PERMISSIONS.md#restart--host-only-by-default).
+
+---
+
 ## Lifecycle Events
 
 The lifecycle system emits events for each wrapper impl change during mutations. Subscribe via `api.slothlet.lifecycle`:
diff --git a/docs/generated/API.md b/docs/generated/API.md
index ca37fdcdc..45e04ed91 100644
--- a/docs/generated/API.md
+++ b/docs/generated/API.md
@@ -247,7 +247,7 @@ Only relevant when modules are registered via <code>api.slothlet.api.add()</code
 | <a id="typedef_module_at_cldmv_slash_slothlet_SlothletOptions_prop_debug"></a>[debug] | <code>boolean \| object</code> | <code>false</code> | Enable verbose internal logging. `true` enables all categories. Pass an object with sub-keys `builder`, `api`, `index`, `modes`, `wrapper`, `ownership`, `context` to target specific subsystems. |
 | <a id="typedef_module_at_cldmv_slash_slothlet_SlothletOptions_prop_silent"></a>[silent] | <code>boolean</code> | <code>false</code> | Suppress all console output from slothlet (warnings, deprecations). Does not affect `debug`. |
 | <a id="typedef_module_at_cldmv_slash_slothlet_SlothletOptions_prop_diagnostics"></a>[diagnostics] | <code>boolean</code> | <code>false</code> | Enable the `api.slothlet.diag.*` introspection namespace. Intended for testing; do not enable in production. |
-| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletOptions_prop_lifecycle"></a>[lifecycle] | <code>Object.<string, (function()|Array.<function()>)></code> |  | Construction-time lifecycle subscribers, registered on the lifecycle emitter BEFORE the api builds so events emitted during cold-start `buildAPI` (init-time `impl:warning` / `impl:created` / …) are observable. Maps an event name to a handler `function(data, token)` or an array of them; any event name is accepted. Because they are ordinary subscribers, they also receive runtime events afterward — equivalent to calling `api.slothlet.lifecycle.on(event, fn)` for each, but early enough to catch initialization diagnostics. Example: `{ "impl:warning": (d) => log(d), "impl:error": [onError, audit] }`. |
+| <a id="typedef_module_at_cldmv_slash_slothlet_SlothletOptions_prop_lifecycle"></a>[lifecycle] | <code>Object.<string, (function()|Array.<function()>)></code> |  | Construction-time lifecycle subscribers, registered on the lifecycle emitter BEFORE the api builds so events emitted during cold-start `buildAPI` (init-time `impl:warning` / `impl:created` / …) are observable. Maps an event name to a handler `function(data, token)` or an array of them; any event name is accepted. Because they are ordinary subscribers, they also receive runtime events afterward — equivalent to calling `api.slothlet.lifecycle.on(event, fn)` for each, but early enough to catch initialization diagnostics. Because they come from the config, `api.slothlet.restart()` subscribes them again on the new instance, so they also receive the new instance's `init` and `restarted` events (runtime `lifecycle.on` subscribers are dropped with the old instance). Example: `{ "impl:warning": (d) => log(d), "impl:error": [onError, audit] }`. |
 | <a id="typedef_module_at_cldmv_slash_slothlet_SlothletOptions_prop_collectLifecycleHooks"></a>[collectLifecycleHooks] | <code>boolean</code> | <code>false</code> | DEPRECATED — will be removed in v4. Expands into two implicit `routines` entries (`{name: "^**.shutdown", mode: "shutdown", order: "depth"}` and the `destroy` equivalent) reproducing this option's original whole-tree, cross-mount, deepest-first scope for literally-named `shutdown`/`destroy` leaves, dropping any existing `shutdown`/`destroy`-mode routine (including the built-in `shutdown` default) in favor of these — and sets the effective `autoRoutines` to `true` unless `autoRoutines` is given explicitly. Nested hooks remain directly callable regardless. Emits a `V3_CONFIG_DEPRECATED` warning unless `silent: true`. |
 | <a id="typedef_module_at_cldmv_slash_slothlet_SlothletOptions_prop_routines"></a>[routines] | <code>Array.<(string|{name: string, mode: ("manual"|"startup"|"shutdown"|"destroy"), recursive: boolean, order: ("mount"|"depth"), cascade: boolean})></code> |  | Stackable lifecycle routines (#341). Every mounted module exporting a function matching a configured routine name is composed into one callable at its exact composed api path, plus a root cascade (`self.<name>()`, i.e. `api.<name>()`) that runs every matching contribution anywhere. Entries: `"name"` (mode `"manual"`), `"name:mode"`, or `{ name, mode?, recursive?, order?, cascade? }` (`recursive`/`order`/`cascade` only settable via the object form). `name` is mount-relative by default (a bare name matches only a mount's own top level; a dotted name matches a fixed relative sub-path, or with `recursive: true` any depth within the mount); a `^`-prefixed name is root-anchored, matched via glob (`*`, `**`, `{}`, `!`) against the full api path, crossing mount boundaries. `order` (`"mount"` \| `"depth"`, mode-defaulted) controls the root cascade's grouping order. `cascade` (default `true`) controls whether the root `api.<name>()` run-all cascade is created at all — set `cascade: false` (#400) for a per-entity lifecycle routine, where the host must invoke exactly one co-owner by key via `api.<path>.<name>.for(moduleID)(...)` rather than a run-all; every stacked path also exposes `api.<path>.<name>.contributors` (the moduleIDs present there). `.for(key)` runs that one contributor in its own extent/identity with the args passed straight through, and bypasses the `stackRoutines` owner-filter so a specific co-owner runs even if it lost the shared-path collision. Providing `routines` at all REPLACES the built-in defaults (`slothlet.defaults.routines`: `initialize` → `startup`, `shutdown` → `shutdown`) — spread `slothlet.defaults.routines` to extend them instead, or pass `[]` to disable every routine. Every configured routine is always wrapped and directly callable regardless of `autoRoutines`. Whether two or more contributors colliding at the identical api path all run is governed by `stackRoutines` (#365), independent of `collisionMode` — by default only the single contribution that actually owns that path runs, matching ordinary collision behavior. A throwing contributor doesn't stop the chain — every contributor runs (best-effort), and one aggregate `ROUTINE_FAILED` error is thrown afterward if any failed. See <a href="docs/LIFECYCLE.md#routines">LIFECYCLE.md</a>. |
 | <a id="typedef_module_at_cldmv_slash_slothlet_SlothletOptions_prop_autoRoutines"></a>[autoRoutines] | <code>boolean</code> | <code>false</code> | The non-deprecated replacement for `collectLifecycleHooks`. TEMPORARY v3-compat default (#341): `false` for now, so a project upgrading sees no behavior change from a pre-existing nested leaf that happens to share a routine's name (e.g. `shutdown`) — it stays stacked and directly callable, but does not start auto-firing. When `true`, every `mode: "startup"` routine's cascade runs at the end of compose, and every `mode: "shutdown"`/`"destroy"` routine's cascade runs on the corresponding dispose call. Planned to default to `true` in v4 (`collectLifecycleHooks` removed at the same time) — see <a href="docs/LIFECYCLE.md#routines">LIFECYCLE.md</a>. |
diff --git a/src/lib/builders/api_builder.mjs b/src/lib/builders/api_builder.mjs
index 4b3747ef0..3d17fa0d3 100644
--- a/src/lib/builders/api_builder.mjs
+++ b/src/lib/builders/api_builder.mjs
@@ -2387,6 +2387,22 @@ export class ApiBuilder extends ComponentBase {
 				return slothlet.reload(options);
 			},
 
+			/**
+			 * Clean-slate restart (#504): shut this instance down and build a new one from the original
+			 * `slothlet({...})` config behind the same `api` reference. Nothing runtime is carried over.
+			 * Gated by `api.mutations.reload`, like `reload()` — it re-reads every module from disk.
+			 * @returns {Promise<Object>} The same bound API reference.
+			 */
+			restart: async () => {
+				if (!config.api?.mutations?.reload) {
+					throw new slothlet.SlothletError("INVALID_CONFIG_MUTATIONS_DISABLED", {
+						operation: "restart",
+						validationError: true
+					});
+				}
+				return slothlet.restart();
+			},
+
 			/**
 			 * Shutdown instance and cleanup resources
 			 * @returns {Promise<void>}
diff --git a/src/lib/handlers/permission-manager.mjs b/src/lib/handlers/permission-manager.mjs
index 36dc70f0a..c0d78112d 100644
--- a/src/lib/handlers/permission-manager.mjs
+++ b/src/lib/handlers/permission-manager.mjs
@@ -407,6 +407,13 @@ export class PermissionManager extends ComponentBase {
 		this.addRule({ caller: "**", target: "slothlet.reload", effect: "deny" }, "__builtin__");
 		this.addRule({ caller: "**", target: "slothlet.shutdown", effect: "deny" }, "__builtin__");
 
+		// Built-in deny rule (#504): `slothlet.restart` rebuilds the whole instance from its original
+		// config, discarding every runtime rule, principal, subscription and the permission seal — so a
+		// module that could call it could undo the host's runtime policy. Host-only by default; an
+		// instance rule on the same exact target outranks this one, which is how the host grants it to a
+		// trusted module (`{ caller: "admin.**", target: "slothlet.restart", effect: "allow" }`).
+		this.addRule({ caller: "**", target: "slothlet.restart", effect: "deny" }, "__builtin__");
+
 		// Built-in allow rules: the caller-identity utilities `slothlet.lockCaller` and
 		// `slothlet.bind` grant no security-sensitive access — they only pin a callback's
 		// caller identity, which strengthens enforcement. Allowing them by default means a
diff --git a/src/lib/handlers/unified-wrapper.mjs b/src/lib/handlers/unified-wrapper.mjs
index 3a8f4b707..59c4245c3 100644
--- a/src/lib/handlers/unified-wrapper.mjs
+++ b/src/lib/handlers/unified-wrapper.mjs
@@ -1018,6 +1018,148 @@ function createNamedProxyTarget(nameHint, fallback) {
  */
 const _proxyRegistry = new WeakMap();
 
+/**
+ * Whether a wrapper belongs to an api tree that a restart() has since replaced (#504).
+ *
+ * @param {UnifiedWrapper} wrapper - Wrapper to test.
+ * @returns {boolean} True when a newer tree is live and this wrapper's traps must forward to it.
+ * @private
+ *
+ * @example
+ * if (runtime_isRestartStale(wrapper)) return forwardToLiveTree();
+ */
+function runtime_isRestartStale(wrapper) {
+	return wrapper.____slothletInternal.epoch < wrapper.____slothlet._liveEpoch;
+}
+
+/**
+ * Resolve the node at a stale wrapper's path (plus an optional property chain below it, for a
+ * waiting proxy) in the LIVE api tree after a restart() (#504).
+ *
+ * @description
+ * The walk is ordinary property access from the live root, so it behaves exactly as re-reading
+ * `api.<path>` would — the same lazy materialization and the same read-level permission gate for
+ * whoever holds the reference. The path is re-resolved on every use, so a held reference follows any
+ * number of restarts. A path that no longer exists throws `RESTART_REFERENCE_UNRESOLVED`.
+ *
+ * @param {UnifiedWrapper} wrapper - The stale wrapper.
+ * @param {string[]} [propChain=[]] - Property chain below the wrapper (waiting proxies).
+ * @returns {unknown} The live node.
+ * @throws {SlothletError} RESTART_REFERENCE_UNRESOLVED when the path is gone after the restart.
+ * @private
+ *
+ * @example
+ * const live = runtime_resolveRestartTarget(wrapper, ["handlers"]);
+ */
+function runtime_resolveRestartTarget(wrapper, propChain = []) {
+	const apiPath = wrapper.____slothletInternal.apiPath;
+	const segments = [...(apiPath ? String(apiPath).split(".") : []), ...propChain.map(String)];
+	const fail = () => {
+		throw new wrapper.SlothletError("RESTART_REFERENCE_UNRESOLVED", { apiPath: segments.join(".") }, null, { validationError: true });
+	};
+	let node = wrapper.____slothlet.api;
+	for (const segment of segments) {
+		if (node === null || node === undefined) fail();
+		node = node[segment];
+	}
+	if (node === null || node === undefined) fail();
+	return node;
+}
+
+/**
+ * Map a `this` argument that is itself a stale (restart-replaced) proxy to its live counterpart, so
+ * a method reached through a held reference runs against the live node rather than the old one.
+ *
+ * @param {unknown} value - The `this` argument (or `new.target`).
+ * @returns {unknown} The live node when `value` is a stale wrapper proxy, otherwise `value`.
+ * @private
+ *
+ * @example
+ * Reflect.apply(live, runtime_liveThis(thisArg), args);
+ */
+function runtime_liveThis(value) {
+	const wrapper = _proxyRegistry.get(value);
+	if (wrapper && runtime_isRestartStale(wrapper)) return runtime_resolveRestartTarget(wrapper);
+	return value;
+}
+
+/**
+ * Whether `prop` is a non-configurable own property of a proxy target. Proxy invariants tie the
+ * answers for such a property to the target itself, so the forwarding traps report it from there.
+ *
+ * @param {object} target - Proxy target.
+ * @param {string|symbol} prop - Property key.
+ * @returns {boolean} True when the target owns `prop` non-configurably.
+ * @private
+ *
+ * @example
+ * runtime_isFixedOnTarget(function () {}, "prototype"); // true
+ */
+function runtime_isFixedOnTarget(target, prop) {
+	const descriptor = Reflect.getOwnPropertyDescriptor(target, prop);
+	return descriptor !== undefined && descriptor.configurable === false;
+}
+
+/**
+ * Proxy traps used once a wrapper's tree has been replaced by restart() (#504): each forwards the
+ * operation to the node at the same path in the live tree, staying within the proxy invariants of the
+ * original target (a function target's non-configurable `prototype`, a non-extensible target).
+ * @type {Record<string, Function>}
+ * @private
+ */
+const RESTART_FORWARD_TRAPS = {
+	get: (live, target, prop) => live[prop],
+	set: (live, target, prop, value) => Reflect.set(Object(live), prop, value),
+	has: (live, target, prop) => prop in Object(live) || runtime_isFixedOnTarget(target, prop),
+	deleteProperty: (live, target, prop) => (runtime_isFixedOnTarget(target, prop) ? false : Reflect.deleteProperty(Object(live), prop)),
+	ownKeys: (live, target) => {
+		if (!Reflect.isExtensible(target)) return Reflect.ownKeys(target);
+		const keys = new Set(Reflect.ownKeys(Object(live)));
+		for (const key of Reflect.ownKeys(target)) {
+			if (runtime_isFixedOnTarget(target, key)) keys.add(key);
+		}
+		return [...keys];
+	},
+	getOwnPropertyDescriptor: (live, target, prop) => {
+		if (runtime_isFixedOnTarget(target, prop) || !Reflect.isExtensible(target)) return Reflect.getOwnPropertyDescriptor(target, prop);
+		const descriptor = Reflect.getOwnPropertyDescriptor(Object(live), prop);
+		return descriptor ? { ...descriptor, configurable: true } : undefined;
+	},
+	apply: (live, target, thisArg, args) => Reflect.apply(live, runtime_liveThis(thisArg), args),
+	construct: (live, target, args, newTarget) => Reflect.construct(live, args, runtime_liveThis(newTarget)),
+	getPrototypeOf: (live, target) => (Reflect.isExtensible(target) ? Reflect.getPrototypeOf(Object(live)) : Reflect.getPrototypeOf(target))
+};
+
+/**
+ * Wrap a proxy handler so that, once restart() has replaced the wrapper's tree, every trap the
+ * handler defines forwards to the live node at the wrapper's path instead (#504). Until then the
+ * original traps run unchanged; the check is one epoch comparison per trap.
+ *
+ * @param {object} handler - The proxy handler (as passed to `new Proxy`).
+ * @param {UnifiedWrapper} wrapper - The wrapper whose epoch decides staleness.
+ * @param {string[]} [propChain=[]] - Property chain below the wrapper (waiting proxies).
+ * @returns {object} The wrapped handler.
+ * @private
+ *
+ * @example
+ * new Proxy(target, runtime_withRestartForwarding({ get, apply }, wrapper));
+ */
+function runtime_withRestartForwarding(handler, wrapper, propChain = []) {
+	const wrapped = {};
+	for (const [trap, original] of Object.entries(handler)) {
+		const forward = RESTART_FORWARD_TRAPS[trap];
+		// Fixed arity (no rest/spread): these traps sit on every property access and call, so the
+		// common, non-stale path must not allocate. No trap takes more than four arguments.
+		wrapped[trap] = function slothlet_restartForwardingTrap(a, b, c, d) {
+			if (runtime_isRestartStale(wrapper)) {
+				return forward(runtime_resolveRestartTarget(wrapper, propChain), a, b, c, d);
+			}
+			return original.call(handler, a, b, c, d);
+		};
+	}
+	return wrapped;
+}
+
 /**
  * Unified wrapper class that handles all proxy concerns in one place:
  * - __impl pattern for reload support
@@ -1166,6 +1308,9 @@ export class UnifiedWrapper extends ComponentBase {
 		// Propagated to getTrap-created descendants so a whole wrap-on-set subtree adopts lazily (#329).
 		internal.deferChildAdopt = deferChildAdopt;
 		internal.invalid = false;
+		// Restart epoch (#504): the tree this wrapper belongs to. Once a restart() swaps in a newer tree,
+		// the proxy traps forward to the node at this wrapper's path in the live tree instead.
+		internal.epoch = slothlet._buildEpoch ?? 0;
 		internal.state = {
 			materialized: initialImpl !== null,
 			inFlight: false,
@@ -2799,7 +2944,7 @@ export class UnifiedWrapper extends ComponentBase {
 		// Note: wrapper lookup is via _proxyRegistry (set below) - do NOT attach ____slothletInternal
 		// as an own property on waitingTarget; that was the attack vector we closed in step 2.
 
-		const waitingProxy = new Proxy(waitingTarget, {
+		const waitingHandler = {
 			get(___target, prop) {
 				if (prop === "then") {
 					// Make waiting proxies thenable so `await lg[0]` resolves after materialization
@@ -3609,7 +3754,9 @@ export class UnifiedWrapper extends ComponentBase {
 				);
 			},
 			getPrototypeOf: () => null
-		});
+		};
+		// Once a restart() replaces this wrapper's tree, the waiting proxy forwards to the live tree too (#504).
+		const waitingProxy = new Proxy(waitingTarget, runtime_withRestartForwarding(waitingHandler, wrapper, propChain));
 
 		// Register waiting proxy in the global registry so resolveWrapper() can find the
 		// root wrapper from it - mirrors the old .____slothletInternal.wrapper path that
@@ -5431,7 +5578,7 @@ export class UnifiedWrapper extends ComponentBase {
 			);
 		};
 
-		wrapper.____slothletInternal.proxy = new Proxy(proxyTarget, {
+		const proxyHandler = {
 			// One chokepoint for capture-binding rather than the many return paths inside getTrap: whatever
 			// the trap resolved, a wrapper handed to a module carries that module's identity from here on.
 			get: (target, prop, receiver) => runtime_bindCapturedIdentity(wrapper, prop, getTrap(target, prop, receiver)),
@@ -5473,7 +5620,9 @@ export class UnifiedWrapper extends ComponentBase {
 				if (isLiveIdentity && impl && typeof impl === "object") return Object.getPrototypeOf(impl);
 				return null;
 			}
-		});
+		};
+		// Once a restart() replaces this wrapper's tree, every trap forwards to the live tree (#504).
+		wrapper.____slothletInternal.proxy = new Proxy(proxyTarget, runtime_withRestartForwarding(proxyHandler, wrapper));
 
 		_proxyRegistry.set(wrapper.____slothletInternal.proxy, wrapper);
 		// Register this wrapper instance as genuine so permission enforcement can distinguish a real
diff --git a/src/lib/i18n/languages/de-de.json b/src/lib/i18n/languages/de-de.json
index d9f870492..b738cb1c7 100644
--- a/src/lib/i18n/languages/de-de.json
+++ b/src/lib/i18n/languages/de-de.json
@@ -505,6 +505,8 @@
 		"SCOPE_INVALID_PROTECT": "'protect' muss ein Array von String-Schlüsseln sein. Erhalten: {received}.",
 		"SCOPE_INVALID_OWNERS": "'owners' muss ein einfaches Objekt sein, das Schlüssel auf Eigentümernamen abbildet. Erhalten: {received}.",
 		"PERMISSION_SEALED": "Die Berechtigungssteuerung ist versiegelt; die Richtlinie kann nicht mehr geändert werden.",
+		"RESTART_REFERENCE_UNRESOLVED": "Die Referenz auf '{apiPath}' wurde über einen Neustart hinweg gehalten, und '{apiPath}' existiert in der neu gestarteten API nicht mehr.",
+		"HINT_RESTART_REFERENCE_UNRESOLVED": "Eine gehaltene Referenz löst ihren Pfad bei jeder Verwendung in der neu gestarteten Instanz neu auf. Lesen Sie den Wert erneut über die API-Wurzel oder prüfen Sie, ob die ursprüngliche Konfiguration '{apiPath}' noch erzeugt — zur Laufzeit per add() eingehängte Module übernimmt restart() nicht.",
 		"PRINCIPAL_NAME_OWNED": "Principal '{name}' gehört '{owner}' und kann nicht von '{claimant}' registriert werden.",
 		"PRINCIPAL_NOT_OWNER": "Die Operation '{operation}' für Principal '{name}' ist dem Besitzer ('{owner}') oder dem Host vorbehalten; Aufrufer: '{caller}'.",
 		"PRINCIPAL_READ_ONLY": "Principal '{name}' ist schreibgeschützt; sein Wert wird nur durch erneutes Auflösen ersetzt.",
diff --git a/src/lib/i18n/languages/en-gb.json b/src/lib/i18n/languages/en-gb.json
index c2dee7193..d566dd389 100644
--- a/src/lib/i18n/languages/en-gb.json
+++ b/src/lib/i18n/languages/en-gb.json
@@ -505,6 +505,8 @@
 		"SCOPE_INVALID_PROTECT": "'protect' must be an array of string keys. Received: {received}.",
 		"SCOPE_INVALID_OWNERS": "'owners' must be a plain object mapping keys to owner names. Received: {received}.",
 		"PERMISSION_SEALED": "The permission control surface is sealed; policy can no longer be modified.",
+		"RESTART_REFERENCE_UNRESOLVED": "The reference to '{apiPath}' was held across a restart, and '{apiPath}' no longer exists in the restarted API.",
+		"HINT_RESTART_REFERENCE_UNRESOLVED": "A held reference re-resolves its path in the restarted instance on every use. Re-read the value from the api root, or check that the original config still produces '{apiPath}' — runtime add() mounts are not carried over by restart().",
 		"PRINCIPAL_NAME_OWNED": "Principal '{name}' is owned by '{owner}' and cannot be registered by '{claimant}'.",
 		"PRINCIPAL_NOT_OWNER": "Operation '{operation}' on principal '{name}' is reserved for its owner ('{owner}') or the host; caller: '{caller}'.",
 		"PRINCIPAL_READ_ONLY": "Principal '{name}' is read-only; its value is replaced only when it is resolved again.",
diff --git a/src/lib/i18n/languages/en-us.json b/src/lib/i18n/languages/en-us.json
index e206d00dd..513ccc4a6 100644
--- a/src/lib/i18n/languages/en-us.json
+++ b/src/lib/i18n/languages/en-us.json
@@ -505,6 +505,8 @@
 		"SCOPE_INVALID_PROTECT": "'protect' must be an array of string keys. Received: {received}.",
 		"SCOPE_INVALID_OWNERS": "'owners' must be a plain object mapping keys to owner names. Received: {received}.",
 		"PERMISSION_SEALED": "The permission control surface is sealed; policy can no longer be modified.",
+		"RESTART_REFERENCE_UNRESOLVED": "The reference to '{apiPath}' was held across a restart, and '{apiPath}' no longer exists in the restarted API.",
+		"HINT_RESTART_REFERENCE_UNRESOLVED": "A held reference re-resolves its path in the restarted instance on every use. Re-read the value from the api root, or check that the original config still produces '{apiPath}' — runtime add() mounts are not carried over by restart().",
 		"PRINCIPAL_NAME_OWNED": "Principal '{name}' is owned by '{owner}' and cannot be registered by '{claimant}'.",
 		"PRINCIPAL_NOT_OWNER": "Operation '{operation}' on principal '{name}' is reserved for its owner ('{owner}') or the host; caller: '{caller}'.",
 		"PRINCIPAL_READ_ONLY": "Principal '{name}' is read-only; its value is replaced only when it is resolved again.",
diff --git a/src/lib/i18n/languages/es-es.json b/src/lib/i18n/languages/es-es.json
index cc2d3a722..c856adb11 100644
--- a/src/lib/i18n/languages/es-es.json
+++ b/src/lib/i18n/languages/es-es.json
@@ -505,6 +505,8 @@
 		"SCOPE_INVALID_PROTECT": "'protect' debe ser un array de claves de tipo cadena. Recibido: {received}.",
 		"SCOPE_INVALID_OWNERS": "'owners' debe ser un objeto simple que asigne claves a nombres de propietario. Recibido: {received}.",
 		"PERMISSION_SEALED": "La superficie de control de permisos está sellada; la política ya no se puede modificar.",
+		"RESTART_REFERENCE_UNRESOLVED": "La referencia a '{apiPath}' se mantuvo durante un reinicio y '{apiPath}' ya no existe en la API reiniciada.",
+		"HINT_RESTART_REFERENCE_UNRESOLVED": "Una referencia retenida vuelve a resolver su ruta en la instancia reiniciada en cada uso. Vuelve a leer el valor desde la raíz de la API o comprueba que la configuración original todavía produce '{apiPath}': restart() no conserva los montajes hechos con add() en tiempo de ejecución.",
 		"PRINCIPAL_NAME_OWNED": "El principal '{name}' pertenece a '{owner}' y '{claimant}' no puede registrarlo.",
 		"PRINCIPAL_NOT_OWNER": "La operación '{operation}' sobre el principal '{name}' está reservada a su propietario ('{owner}') o al host; llamador: '{caller}'.",
 		"PRINCIPAL_READ_ONLY": "El principal '{name}' es de solo lectura; su valor solo se reemplaza al resolverlo de nuevo.",
diff --git a/src/lib/i18n/languages/es-mx.json b/src/lib/i18n/languages/es-mx.json
index cdc5d4a6f..36d678dfe 100644
--- a/src/lib/i18n/languages/es-mx.json
+++ b/src/lib/i18n/languages/es-mx.json
@@ -505,6 +505,8 @@
 		"SCOPE_INVALID_PROTECT": "'protect' tiene que ser un arreglo de claves de tipo cadena. Recibido: {received}.",
 		"SCOPE_INVALID_OWNERS": "'owners' tiene que ser un objeto simple que asigne claves a nombres de propietario. Recibido: {received}.",
 		"PERMISSION_SEALED": "La superficie de control de permisos está sellada; ya no es posible modificar la política.",
+		"RESTART_REFERENCE_UNRESOLVED": "La referencia a '{apiPath}' se conservó durante un reinicio y '{apiPath}' ya no existe en la API reiniciada.",
+		"HINT_RESTART_REFERENCE_UNRESOLVED": "Una referencia conservada vuelve a resolver su ruta en la instancia reiniciada cada vez que se usa. Vuelve a leer el valor desde la raíz de la API o verifica que la configuración original todavía genere '{apiPath}': restart() no conserva los montajes hechos con add() en tiempo de ejecución.",
 		"PRINCIPAL_NAME_OWNED": "El principal '{name}' pertenece a '{owner}' y '{claimant}' no puede registrarlo.",
 		"PRINCIPAL_NOT_OWNER": "La operación '{operation}' sobre el principal '{name}' está reservada a su propietario ('{owner}') o al host; llamador: '{caller}'.",
 		"PRINCIPAL_READ_ONLY": "El principal '{name}' es de solo lectura; su valor solo se reemplaza al resolverlo de nuevo.",
diff --git a/src/lib/i18n/languages/fr-fr.json b/src/lib/i18n/languages/fr-fr.json
index 772de4b26..869e5e4bd 100644
--- a/src/lib/i18n/languages/fr-fr.json
+++ b/src/lib/i18n/languages/fr-fr.json
@@ -505,6 +505,8 @@
 		"SCOPE_INVALID_PROTECT": "'protect' doit être un tableau de clés de type chaîne. Reçu : {received}.",
 		"SCOPE_INVALID_OWNERS": "'owners' doit être un objet simple associant des clés à des noms de propriétaire. Reçu : {received}.",
 		"PERMISSION_SEALED": "La surface de contrôle des permissions est scellée ; la politique ne peut plus être modifiée.",
+		"RESTART_REFERENCE_UNRESOLVED": "La référence à '{apiPath}' a été conservée pendant un redémarrage, et '{apiPath}' n'existe plus dans l'API redémarrée.",
+		"HINT_RESTART_REFERENCE_UNRESOLVED": "Une référence conservée résout à nouveau son chemin dans l'instance redémarrée à chaque utilisation. Relisez la valeur depuis la racine de l'API, ou vérifiez que la configuration d'origine produit toujours '{apiPath}' : restart() ne conserve pas les montages add() effectués à l'exécution.",
 		"PRINCIPAL_NAME_OWNED": "Le principal '{name}' appartient à '{owner}' et ne peut pas être enregistré par '{claimant}'.",
 		"PRINCIPAL_NOT_OWNER": "L'opération '{operation}' sur le principal '{name}' est réservée à son propriétaire ('{owner}') ou à l'hôte ; appelant : '{caller}'.",
 		"PRINCIPAL_READ_ONLY": "Le principal '{name}' est en lecture seule ; sa valeur n'est remplacée que lorsqu'il est résolu à nouveau.",
diff --git a/src/lib/i18n/languages/hi-in.json b/src/lib/i18n/languages/hi-in.json
index 5b74ceea0..055b7e2b3 100644
--- a/src/lib/i18n/languages/hi-in.json
+++ b/src/lib/i18n/languages/hi-in.json
@@ -505,6 +505,8 @@
 		"SCOPE_INVALID_PROTECT": "'protect' स्ट्रिंग कुंजियों की एक सरणी होनी चाहिए। प्राप्त: {received}।",
 		"SCOPE_INVALID_OWNERS": "'owners' एक सादा ऑब्जेक्ट होना चाहिए जो कुंजियों को स्वामी नामों से मैप करता है। प्राप्त: {received}।",
 		"PERMISSION_SEALED": "अनुमति नियंत्रण सतह सील है; नीति अब संशोधित नहीं की जा सकती।",
+		"RESTART_REFERENCE_UNRESOLVED": "'{apiPath}' का संदर्भ पुनः आरंभ के दौरान रखा गया था, और पुनः आरंभ किए गए API में '{apiPath}' अब मौजूद नहीं है।",
+		"HINT_RESTART_REFERENCE_UNRESOLVED": "रखा गया संदर्भ हर उपयोग पर पुनः आरंभ किए गए इंस्टेंस में अपना पथ फिर से हल करता है। API रूट से मान फिर से पढ़ें, या जाँचें कि मूल कॉन्फ़िगरेशन अब भी '{apiPath}' बनाता है — restart() रनटाइम पर add() से जोड़े गए माउंट नहीं रखता।",
 		"PRINCIPAL_NAME_OWNED": "प्रिंसिपल '{name}' का स्वामी '{owner}' है; '{claimant}' इसे पंजीकृत नहीं कर सकता।",
 		"PRINCIPAL_NOT_OWNER": "प्रिंसिपल '{name}' पर संचालन '{operation}' केवल उसके स्वामी ('{owner}') या होस्ट के लिए आरक्षित है; कॉलर: '{caller}'।",
 		"PRINCIPAL_READ_ONLY": "प्रिंसिपल '{name}' केवल-पठन है; इसका मान केवल दोबारा हल करने पर ही बदला जाता है।",
diff --git a/src/lib/i18n/languages/ja-jp.json b/src/lib/i18n/languages/ja-jp.json
index b992cd26e..b7658d961 100644
--- a/src/lib/i18n/languages/ja-jp.json
+++ b/src/lib/i18n/languages/ja-jp.json
@@ -505,6 +505,8 @@
 		"SCOPE_INVALID_PROTECT": "'protect' は文字列キーの配列である必要があります。受け取った値: {received}。",
 		"SCOPE_INVALID_OWNERS": "'owners' はキーを所有者名にマッピングするプレーンオブジェクトである必要があります。受け取った値: {received}。",
 		"PERMISSION_SEALED": "権限制御サーフェスは封印されており、ポリシーを変更できません。",
+		"RESTART_REFERENCE_UNRESOLVED": "'{apiPath}' への参照が再起動をまたいで保持されましたが、再起動後の API に '{apiPath}' は存在しません。",
+		"HINT_RESTART_REFERENCE_UNRESOLVED": "保持された参照は、使用するたびに再起動後のインスタンスでパスを解決し直します。API のルートから値を読み直すか、元の設定がまだ '{apiPath}' を生成するか確認してください。実行時の add() によるマウントは restart() で引き継がれません。",
 		"PRINCIPAL_NAME_OWNED": "プリンシパル '{name}' の所有者は '{owner}' であり、'{claimant}' は登録できません。",
 		"PRINCIPAL_NOT_OWNER": "プリンシパル '{name}' に対する操作 '{operation}' は所有者（'{owner}'）またはホストのみが実行できます。呼び出し元: '{caller}'。",
 		"PRINCIPAL_READ_ONLY": "プリンシパル '{name}' は読み取り専用です。値は再解決されたときにのみ置き換えられます。",
diff --git a/src/lib/i18n/languages/ko-kr.json b/src/lib/i18n/languages/ko-kr.json
index f4f84d8a1..dd27176aa 100644
--- a/src/lib/i18n/languages/ko-kr.json
+++ b/src/lib/i18n/languages/ko-kr.json
@@ -505,6 +505,8 @@
 		"SCOPE_INVALID_PROTECT": "'protect'는 문자열 키의 배열이어야 합니다. 받은 값: {received}.",
 		"SCOPE_INVALID_OWNERS": "'owners'는 키를 소유자 이름에 매핑하는 일반 객체여야 합니다. 받은 값: {received}.",
 		"PERMISSION_SEALED": "권한 제어 표면이 봉인되어 있어 정책을 더 이상 수정할 수 없습니다.",
+		"RESTART_REFERENCE_UNRESOLVED": "'{apiPath}'에 대한 참조가 재시작 동안 유지되었지만, 재시작된 API에 '{apiPath}'가 더 이상 존재하지 않습니다.",
+		"HINT_RESTART_REFERENCE_UNRESOLVED": "유지된 참조는 사용할 때마다 재시작된 인스턴스에서 경로를 다시 확인합니다. API 루트에서 값을 다시 읽거나, 원래 설정이 여전히 '{apiPath}'를 생성하는지 확인하세요. 런타임 add() 마운트는 restart() 후에 유지되지 않습니다.",
 		"PRINCIPAL_NAME_OWNED": "프린시펄 '{name}'의 소유자는 '{owner}'이며 '{claimant}'은(는) 등록할 수 없습니다.",
 		"PRINCIPAL_NOT_OWNER": "프린시펄 '{name}'에 대한 작업 '{operation}'은(는) 소유자('{owner}') 또는 호스트만 수행할 수 있습니다. 호출자: '{caller}'.",
 		"PRINCIPAL_READ_ONLY": "프린시펄 '{name}'은(는) 읽기 전용입니다. 값은 다시 해석될 때만 교체됩니다.",
diff --git a/src/lib/i18n/languages/pt-br.json b/src/lib/i18n/languages/pt-br.json
index 8ee7f555b..de30a818c 100644
--- a/src/lib/i18n/languages/pt-br.json
+++ b/src/lib/i18n/languages/pt-br.json
@@ -505,6 +505,8 @@
 		"SCOPE_INVALID_PROTECT": "'protect' deve ser um array de chaves do tipo string. Recebido: {received}.",
 		"SCOPE_INVALID_OWNERS": "'owners' deve ser um objeto simples que mapeia chaves para nomes de proprietário. Recebido: {received}.",
 		"PERMISSION_SEALED": "A superfície de controle de permissões está selada; a política não pode mais ser modificada.",
+		"RESTART_REFERENCE_UNRESOLVED": "A referência a '{apiPath}' foi mantida durante uma reinicialização, e '{apiPath}' não existe mais na API reiniciada.",
+		"HINT_RESTART_REFERENCE_UNRESOLVED": "Uma referência mantida resolve seu caminho novamente na instância reiniciada a cada uso. Leia o valor de novo a partir da raiz da API ou verifique se a configuração original ainda produz '{apiPath}' — restart() não mantém montagens add() feitas em tempo de execução.",
 		"PRINCIPAL_NAME_OWNED": "O principal '{name}' pertence a '{owner}' e não pode ser registrado por '{claimant}'.",
 		"PRINCIPAL_NOT_OWNER": "A operação '{operation}' no principal '{name}' é reservada ao seu proprietário ('{owner}') ou ao host; chamador: '{caller}'.",
 		"PRINCIPAL_READ_ONLY": "O principal '{name}' é somente leitura; seu valor só é substituído quando ele é resolvido novamente.",
diff --git a/src/lib/i18n/languages/ru-ru.json b/src/lib/i18n/languages/ru-ru.json
index 0c0edb836..eff1f5133 100644
--- a/src/lib/i18n/languages/ru-ru.json
+++ b/src/lib/i18n/languages/ru-ru.json
@@ -505,6 +505,8 @@
 		"SCOPE_INVALID_PROTECT": "'protect' должен быть массивом строковых ключей. Получено: {received}.",
 		"SCOPE_INVALID_OWNERS": "'owners' должен быть простым объектом, сопоставляющим ключи с именами владельцев. Получено: {received}.",
 		"PERMISSION_SEALED": "Поверхность управления разрешениями запечатана; политику больше нельзя изменить.",
+		"RESTART_REFERENCE_UNRESOLVED": "Ссылка на '{apiPath}' была сохранена во время перезапуска, и '{apiPath}' больше не существует в перезапущенном API.",
+		"HINT_RESTART_REFERENCE_UNRESOLVED": "Сохранённая ссылка заново разрешает свой путь в перезапущенном экземпляре при каждом использовании. Прочитайте значение заново от корня API или проверьте, что исходная конфигурация всё ещё создаёт '{apiPath}': restart() не переносит модули, подключённые через add() во время выполнения.",
 		"PRINCIPAL_NAME_OWNED": "Принципал '{name}' принадлежит '{owner}' и не может быть зарегистрирован '{claimant}'.",
 		"PRINCIPAL_NOT_OWNER": "Операция '{operation}' над принципалом '{name}' доступна только его владельцу ('{owner}') или хосту; вызывающий: '{caller}'.",
 		"PRINCIPAL_READ_ONLY": "Принципал '{name}' доступен только для чтения; его значение заменяется только при повторном разрешении.",
diff --git a/src/lib/i18n/languages/zh-cn.json b/src/lib/i18n/languages/zh-cn.json
index 2ffa8eeac..b93ca53c8 100644
--- a/src/lib/i18n/languages/zh-cn.json
+++ b/src/lib/i18n/languages/zh-cn.json
@@ -505,6 +505,8 @@
 		"SCOPE_INVALID_PROTECT": "'protect' 必须是字符串键的数组。收到: {received}。",
 		"SCOPE_INVALID_OWNERS": "'owners' 必须是将键映射到所有者名称的普通对象。收到: {received}。",
 		"PERMISSION_SEALED": "权限控制面已封印；无法再修改策略。",
+		"RESTART_REFERENCE_UNRESOLVED": "对 '{apiPath}' 的引用在重启期间被保留，但重启后的 API 中已不存在 '{apiPath}'。",
+		"HINT_RESTART_REFERENCE_UNRESOLVED": "被保留的引用每次使用时都会在重启后的实例中重新解析其路径。请从 API 根重新读取该值，或确认原始配置仍会生成 '{apiPath}'——restart() 不会保留运行时通过 add() 挂载的内容。",
 		"PRINCIPAL_NAME_OWNED": "主体 '{name}' 归 '{owner}' 所有，'{claimant}' 无法注册它。",
 		"PRINCIPAL_NOT_OWNER": "对主体 '{name}' 的操作 '{operation}' 仅限其所有者（'{owner}'）或宿主执行；调用方：'{caller}'。",
 		"PRINCIPAL_READ_ONLY": "主体 '{name}' 为只读；其值仅在重新解析时被替换。",
diff --git a/src/slothlet.mjs b/src/slothlet.mjs
index 6562b0728..9ca4293d2 100644
--- a/src/slothlet.mjs
+++ b/src/slothlet.mjs
@@ -124,6 +124,77 @@ import { DEFAULT_ROUTINES, RESERVED_EXPORTS } from "@cldmv/slothlet/helpers/defa
  */
 const boundaryPatchHolders = new Set();
 
+/**
+ * Top-level config keys retained by identity when the original config is snapshotted for
+ * `restart()`: `reference` and `context` are user-owned live objects the instance exposes as-is, so
+ * a restart hands the new instance the same objects the original `slothlet({...})` call received.
+ *
+ * @type {ReadonlySet<string>}
+ * @private
+ */
+const CONFIG_IDENTITY_KEYS = new Set(["reference", "context"]);
+
+/**
+ * Copy a config value for the retained original-config snapshot (#504).
+ *
+ * @description
+ * Plain objects and arrays are copied recursively so a later mutation of the caller's own options
+ * object (or of anything config normalization touches) cannot change what `restart()` rebuilds from.
+ * Everything else — functions, class instances, `Map`/`Set`, `Date`, `RegExp`, `URL` — is kept by
+ * identity, as the original call passed it. With `freeze`, every copied container is frozen so the
+ * retained snapshot itself is immutable; `restart()` takes an unfrozen copy of it for each rebuild,
+ * because normalization receives a config it is free to read into new objects.
+ *
+ * @param {unknown} value - Value to copy.
+ * @param {boolean} freeze - Freeze each copied container.
+ * @param {Map<object, object>} [seen=new Map()] - Cycle guard: source container → its copy.
+ * @returns {unknown} The copy (or the value itself for anything that is not a plain container).
+ * @private
+ *
+ * @example
+ * const snapshot = copyConfigValue({ base: "./api", permissions: { rules: [] } }, true);
+ */
+function copyConfigValue(value, freeze, seen = new Map()) {
+	if (!value || typeof value !== "object") return value;
+	if (seen.has(value)) return seen.get(value);
+	if (Array.isArray(value)) {
+		const out = [];
+		seen.set(value, out);
+		for (const item of value) out.push(copyConfigValue(item, freeze, seen));
+		return freeze ? Object.freeze(out) : out;
+	}
+	const proto = Object.getPrototypeOf(value);
+	if (proto !== Object.prototype && proto !== null) return value;
+	const out = proto === null ? Object.create(null) : {};
+	seen.set(value, out);
+	for (const key of Reflect.ownKeys(value)) {
+		const descriptor = Object.getOwnPropertyDescriptor(value, key);
+		if (!descriptor.enumerable) continue;
+		out[key] = copyConfigValue(value[key], freeze, seen);
+	}
+	return freeze ? Object.freeze(out) : out;
+}
+
+/**
+ * Copy a top-level config object for the retained snapshot, keeping {@link CONFIG_IDENTITY_KEYS} by
+ * identity.
+ *
+ * @param {object} config - Top-level config.
+ * @param {boolean} freeze - Freeze the copied containers.
+ * @returns {object} The copy.
+ * @private
+ *
+ * @example
+ * const snapshot = copyTopLevelConfig({ base: "./api", context: ctx }, true); // snapshot.context === ctx
+ */
+function copyTopLevelConfig(config, freeze) {
+	const out = {};
+	for (const key of Object.keys(config)) {
+		out[key] = CONFIG_IDENTITY_KEYS.has(key) ? config[key] : copyConfigValue(config[key], freeze);
+	}
+	return freeze ? Object.freeze(out) : out;
+}
+
 /**
  * Slothlet instance - clean architecture prototype
  * @private
@@ -157,6 +228,21 @@ class Slothlet {
 		// Environment snapshot (captured before any module lifecycle in load())
 		this.envSnapshot = null;
 
+		// Clean-slate restart (#504). `_originalConfig` is the frozen snapshot of the config the
+		// `slothlet({...})` call received; `_originalBase` is its base as resolved against that call's
+		// caller (a relative base must not be re-resolved against whoever calls restart()).
+		this._originalConfig = null;
+		this._originalBase = undefined;
+		// Restart epochs: every UnifiedWrapper records `_buildEpoch` at construction; a wrapper whose
+		// epoch is below `_liveEpoch` belongs to a tree a restart replaced, and its proxy forwards to the
+		// node at the same path in the live tree (see unified-wrapper.mjs).
+		this._buildEpoch = 0;
+		this._liveEpoch = 0;
+		// In-flight restart() promise — concurrent calls share it.
+		this._restartPromise = null;
+		// True for the duration of restart() (tags the `shutdown` / `init` lifecycle events).
+		this._restarting = false;
+
 		// Lazy materialization tracking (for api.slothlet.materialize)
 		this._totalLazyCount = 0; // Total lazy wrappers created
 		this._unmaterializedLazyCount = 0; // Currently unmaterialized lazy wrappers
@@ -740,6 +826,12 @@ class Slothlet {
 		// (#529) — decided here, per load, once the effective list is known.
 		this.handlers.permissionManager?.applyDefaultRoutineRules(this.config.routines);
 
+		// Pin the original base as resolved against the creating call's caller, so restart() rebuilds
+		// from the same directory rather than re-resolving a relative base from its own call site (#504).
+		if (this._originalConfig && this._originalBase === undefined) {
+			this._originalBase = this.config.dir;
+		}
+
 		// One-shot DX hint (#235): under a vitest COVERAGE run with this slothlet copy externalized
 		// and no injectable importer configured, the consumer's leaf coverage will misattribute —
 		// say so at boot, pointing at the fix, instead of leaving a mysteriously low report.
@@ -980,6 +1072,13 @@ class Slothlet {
 
 		this.isLoaded = true;
 
+		// `init` (#504): a new instance finished building — the cold start, and the rebuild inside
+		// restart(). A reload (which always passes an instance ID to preserve or rotate) is the same
+		// instance re-reading its modules, not a new one, so it does not emit this.
+		if (!preservedInstanceID) {
+			await this.handlers.lifecycle.emit("init", { instanceID: this.instanceID, restart: this._restarting });
+		}
+
 		return this.boundApi;
 	}
 
@@ -1204,6 +1303,163 @@ class Slothlet {
 		return this.boundApi;
 	}
 
+	/**
+	 * Retain an immutable snapshot of the config a `slothlet({...})` call received, for restart() (#504).
+	 *
+	 * @param {object} [config={}] - The config exactly as the creating call passed it.
+	 * @returns {void}
+	 * @private
+	 *
+	 * @example
+	 * instance._retainOriginalConfig({ base: "./api", mode: "lazy" });
+	 */
+	_retainOriginalConfig(config = {}) {
+		this._originalConfig = copyTopLevelConfig(config ?? {}, true);
+	}
+
+	/**
+	 * Clean-slate restart: tear this instance down and build a new one from its ORIGINAL config,
+	 * behind the same `api` reference (#504).
+	 * @public
+	 *
+	 * @description
+	 * Unlike {@link Slothlet#reload}, nothing runtime survives: no replayed `add()` / `remove()`
+	 * history, no runtime hooks, permission rules, event subscriptions, principals, metadata or
+	 * lifecycle subscribers, no `self.x = …` assignments, and no module-scope state (every module is
+	 * re-imported under a new instance ID). Everything declared in the original config is applied
+	 * again, because the new instance is built from it. That includes the permission policy: the new
+	 * instance has exactly the original config's rules and is NOT sealed, even if the old one was —
+	 * exactly as a fresh `slothlet({...})` call would be. When a `permissions` config is present,
+	 * modules cannot call it (a built-in rule denies `slothlet.restart`; the host can allow a trusted
+	 * module explicitly); with no `permissions` config the permission system is off and it is reachable.
+	 *
+	 * Sequence: `restart` lifecycle event (old instance, nothing torn down yet) → the normal teardown
+	 * (`mode: "shutdown"` routines, the root `shutdown` hook, then the internal teardown, which emits
+	 * `shutdown`) → a fresh load from the original config (emits `init` on the new instance) → held
+	 * child references from the old tree are re-pointed at the new tree → `restarted`.
+	 *
+	 * Events on the old instance reach the old instance's subscribers (config-declared and runtime);
+	 * `init` and `restarted` fire on the new instance, where only config-declared (`lifecycle` option)
+	 * subscribers exist — runtime subscribers were dropped with the old instance.
+	 *
+	 * Calls already running when restart() starts finish on the old implementation; restart() does not
+	 * wait for them (as with reload(), only in-flight lazy materializations are drained). Concurrent
+	 * restart() calls share one restart. A failing teardown step (a throwing shutdown routine or hook)
+	 * does not stop the rebuild; its error is re-thrown once the new instance is in place.
+	 *
+	 * @returns {Promise<Object>} The same bound API reference.
+	 * @throws {SlothletError} INVALID_CONFIG_NOT_LOADED when the instance was never created via `slothlet()`.
+	 *
+	 * @example
+	 * await api.slothlet.restart();
+	 */
+	restart() {
+		if (this._restartPromise) return this._restartPromise;
+		this._restartPromise = this._restart().finally(() => {
+			this._restartPromise = null;
+		});
+		return this._restartPromise;
+	}
+
+	/**
+	 * restart() body — see {@link Slothlet#restart}.
+	 * @returns {Promise<Object>} The same bound API reference.
+	 * @private
+	 *
+	 * @example
+	 * await this._restart();
+	 */
+	async _restart() {
+		if (!this._originalConfig) {
+			throw new SlothletError("INVALID_CONFIG_NOT_LOADED", {
+				operation: "restart",
+				validationError: true
+			});
+		}
+
+		const previousInstanceID = this.instanceID;
+		let teardownError = null;
+		this._restarting = true;
+		try {
+			// 1. `restart` — before anything is torn down.
+			await this.handlers.lifecycle.emit("restart", { instanceID: previousInstanceID });
+
+			// 2. Normal teardown of the old instance — the same steps as the root `api.shutdown()` dispose
+			//    path: `mode: "shutdown"` routines, the root shutdown hook (whatever the user's routines
+			//    config makes of it), then the internal teardown that emits `shutdown`. Run directly rather
+			//    than through the root builtin, and as the host: this is framework-internal teardown, so a
+			//    module that was allowed to call restart() must not be refused halfway by a routine's or
+			//    hook's own call gate. A throwing routine/hook is captured and re-thrown at the end.
+			if (this.isLoaded) {
+				teardownError = await this._runAsHost(async () => {
+					let firstError = null;
+					try {
+						await this.handlers.routineManager?.runShutdownModeRoutines();
+					} catch (error) {
+						firstError = error;
+					}
+					try {
+						if (typeof this.userHooks?.shutdown === "function") {
+							await this.userHooks.shutdown();
+						}
+					} catch (error) {
+						firstError ??= error;
+					}
+					await this.shutdown();
+					return firstError;
+				});
+			}
+
+			// 3. Reset the per-instance state the Slothlet shell carries between loads, so the new
+			//    instance starts exactly as a fresh `slothlet({...})` would.
+			await this._clearModuleCaches();
+			this.envSnapshot = null;
+			this._typesGenerated = false;
+			this._totalLazyCount = 0;
+			this._unmaterializedLazyCount = 0;
+			this._materializationComplete = false;
+			this._materializationCompleteEmitted = false;
+
+			// 4. Build the new instance from the original config. New wrappers carry the next epoch;
+			//    the old tree's wrappers keep answering as themselves until the swap below.
+			const config = copyTopLevelConfig(this._originalConfig, false);
+			if (this._originalBase !== undefined) {
+				config.base = this._originalBase;
+			}
+			this._buildEpoch = this._liveEpoch + 1;
+			await this.load(config);
+
+			// 5. Swap complete: every wrapper from an earlier epoch now forwards to the node at its path
+			//    in the new tree (or throws RESTART_REFERENCE_UNRESOLVED if the path is gone).
+			this._liveEpoch = this._buildEpoch;
+		} finally {
+			this._restarting = false;
+		}
+
+		// 6. `restarted` — on the new instance.
+		await this.handlers.lifecycle.emit("restarted", { instanceID: this.instanceID, previousInstanceID });
+
+		if (teardownError) throw teardownError;
+		return this.boundApi;
+	}
+
+	/**
+	 * Run framework-internal work as the host: with no module caller, even when a module's call is what
+	 * triggered it (e.g. a module allowed to call `restart()`). Host-initiated work runs as is.
+	 *
+	 * @param {Function} fn - The work.
+	 * @returns {Promise<unknown>} Whatever `fn` resolves to.
+	 * @private
+	 *
+	 * @example
+	 * await this._runAsHost(() => this.shutdown());
+	 */
+	async _runAsHost(fn) {
+		const identity = this.contextManager?.getCallerIdentity?.(this.instanceID);
+		if (!identity?.currentWrapper && !identity?.unresolved) return fn();
+		return this.contextManager.runInContext(this.instanceID, fn, null, [], null, true, true);
+	}
+
 	/**
 	 * Clear Node.js module caches for reloading
 	 * @private
@@ -1346,6 +1602,11 @@ class Slothlet {
 			return;
 		}
 
+		// `shutdown` (#504): teardown is starting — emitted on the instance's own emitter while every
+		// system is still up, so its subscribers (config-declared and runtime alike) can still reach the
+		// api. `restart` is true when the teardown is the first half of a restart().
+		await this.handlers.lifecycle.emit("shutdown", { instanceID: this.instanceID, restart: this._restarting });
+
 		// Drain any in-flight lazy-mode module loads before tearing down, so that
 		// background import() calls can complete and won't cause "Closing rpc while
 		// fetch was pending" errors in Vitest workers.
@@ -1528,6 +1789,8 @@ class Slothlet {
  */
 export async function slothlet(config) {
 	const instance = new Slothlet();
+	// Retain the config as passed, before anything reads it, so restart() can rebuild from it (#504).
+	instance._retainOriginalConfig(config);
 	const api = await instance.load(config);
 
 	// API already has builtins attached from load()
@@ -1619,7 +1882,7 @@ export default slothlet;
  *   Pass an object with sub-keys `builder`, `api`, `index`, `modes`, `wrapper`, `ownership`, `context` to target specific subsystems.
  * @property {boolean} [silent=false] - Suppress all console output from slothlet (warnings, deprecations). Does not affect `debug`.
  * @property {boolean} [diagnostics=false] - Enable the `api.slothlet.diag.*` introspection namespace. Intended for testing; do not enable in production.
- * @property {Object.<string, (Function|Function[])>} [lifecycle] - Construction-time lifecycle subscribers, registered on the lifecycle emitter BEFORE the api builds so events emitted during cold-start `buildAPI` (init-time `impl:warning` / `impl:created` / …) are observable. Maps an event name to a handler `function(data, token)` or an array of them; any event name is accepted. Because they are ordinary subscribers, they also receive runtime events afterward — equivalent to calling `api.slothlet.lifecycle.on(event, fn)` for each, but early enough to catch initialization diagnostics. Example: `{ "impl:warning": (d) => log(d), "impl:error": [onError, audit] }`.
+ * @property {Object.<string, (Function|Function[])>} [lifecycle] - Construction-time lifecycle subscribers, registered on the lifecycle emitter BEFORE the api builds so events emitted during cold-start `buildAPI` (init-time `impl:warning` / `impl:created` / …) are observable. Maps an event name to a handler `function(data, token)` or an array of them; any event name is accepted. Because they are ordinary subscribers, they also receive runtime events afterward — equivalent to calling `api.slothlet.lifecycle.on(event, fn)` for each, but early enough to catch initialization diagnostics. Because they come from the config, `api.slothlet.restart()` subscribes them again on the new instance, so they also receive the new instance's `init` and `restarted` events (runtime `lifecycle.on` subscribers are dropped with the old instance). Example: `{ "impl:warning": (d) => log(d), "impl:error": [onError, audit] }`.
  * @property {boolean} [collectLifecycleHooks=false] - DEPRECATED — will be removed in v4. Expands into two implicit `routines` entries (`{name: "^**.shutdown", mode: "shutdown", order: "depth"}` and the `destroy` equivalent) reproducing this option's original whole-tree, cross-mount, deepest-first scope for literally-named `shutdown`/`destroy` leaves, dropping any existing `shutdown`/`destroy`-mode routine (including the built-in `shutdown` default) in favor of these — and sets the effective `autoRoutines` to `true` unless `autoRoutines` is given explicitly. Nested hooks remain directly callable regardless. Emits a `V3_CONFIG_DEPRECATED` warning unless `silent: true`.
  * @property {Array<string|{name: string, mode?: ("manual"|"startup"|"shutdown"|"destroy"), recursive?: boolean, order?: ("mount"|"depth"), cascade?: boolean}>} [routines] - Stackable lifecycle routines (#341). Every mounted module exporting a function matching a configured routine name is composed into one callable at its exact composed api path, plus a root cascade (`self.<name>()`, i.e. `api.<name>()`) that runs every matching contribution anywhere. Entries: `"name"` (mode `"manual"`), `"name:mode"`, or `{ name, mode?, recursive?, order?, cascade? }` (`recursive`/`order`/`cascade` only settable via the object form). `name` is mount-relative by default (a bare name matches only a mount's own top level; a dotted name matches a fixed relative sub-path, or with `recursive: true` any depth within the mount); a `^`-prefixed name is root-anchored, matched via glob (`*`, `**`, `{}`, `!`) against the full api path, crossing mount boundaries. `order` (`"mount"` | `"depth"`, mode-defaulted) controls the root cascade's grouping order. `cascade` (default `true`) controls whether the root `api.<name>()` run-all cascade is created at all — set `cascade: false` (#400) for a per-entity lifecycle routine, where the host must invoke exactly one co-owner by key via `api.<path>.<name>.for(moduleID)(...)` rather than a run-all; every stacked path also exposes `api.<path>.<name>.contributors` (the moduleIDs present there). `.for(key)` runs that one contributor in its own extent/identity with the args passed straight through, and bypasses the `stackRoutines` owner-filter so a specific co-owner runs even if it lost the shared-path collision. Providing `routines` at all REPLACES the built-in defaults (`slothlet.defaults.routines`: `initialize` → `startup`, `shutdown` → `shutdown`) — spread `slothlet.defaults.routines` to extend them instead, or pass `[]` to disable every routine. Every configured routine is always wrapped and directly callable regardless of `autoRoutines`. Whether two or more contributors colliding at the identical api path all run is governed by `stackRoutines` (#365), independent of `collisionMode` — by default only the single contribution that actually owns that path runs, matching ordinary collision behavior. A throwing contributor doesn't stop the chain — every contributor runs (best-effort), and one aggregate `ROUTINE_FAILED` error is thrown afterward if any failed. See [LIFECYCLE.md](docs/LIFECYCLE.md#routines).
  * @property {boolean} [autoRoutines=false] - The non-deprecated replacement for `collectLifecycleHooks`. TEMPORARY v3-compat default (#341): `false` for now, so a project upgrading sees no behavior change from a pre-existing nested leaf that happens to share a routine's name (e.g. `shutdown`) — it stays stacked and directly callable, but does not start auto-firing. When `true`, every `mode: "startup"` routine's cascade runs at the end of compose, and every `mode: "shutdown"`/`"destroy"` routine's cascade runs on the corresponding dispose call. Planned to default to `true` in v4 (`collectLifecycleHooks` removed at the same time) — see [LIFECYCLE.md](docs/LIFECYCLE.md#routines).
@@ -1773,6 +2036,7 @@ export default slothlet;
  * @property {Function} slothlet.bind - Freeze the entire async context onto a callback at registration time (convenience re-export of `AsyncResource.bind`). Unlike `lockCaller`, which overrides only caller identity and leaves request-scoped context live, `bind` freezes every `AsyncLocalStorage`, including slothlet's caller and context. Meaningful in async runtime mode; degrades to non-slothlet ALS context in live mode. %%sig: (fn: function): function%% %%example: // Inside a module's init()|server.addHook("onRequest", self.slothlet.bind(handler));%%
  * @property {object} [slothlet.reference] - The `reference` object from config, merged onto the root API and accessible here.
  * @property {Function} slothlet.reload - Reload the entire instance (re-scans the directory and recreates all module references). Accepts `{ keepInstanceID: boolean }`. %%sig: ([options]: Object): Promise.<void>%% %%example: // ESM usage via slothlet API|import slothlet from "@cldmv/slothlet";|const api = await slothlet({ base: './api' });|await api.slothlet.reload(); // full reload%% %%example: // ESM usage via slothlet API (inside async function)|async function example() {|  const { default: slothlet } = await import("@cldmv/slothlet");|  const api = await slothlet({ base: './api' });|  await api.slothlet.reload(); // full reload|}%% %%example: // CJS usage via slothlet API (top-level)|let slothlet;|(async () => {|  ({ slothlet } = await import("@cldmv/slothlet"));|  const api = await slothlet({ base: './api' });|  await api.slothlet.reload(); // full reload|})();%% %%example: // CJS usage via slothlet API (inside async function)|const slothlet = require("@cldmv/slothlet");|const api = await slothlet({ base: './api' });|await api.slothlet.reload(); // full reload%%
+ * @property {Function} slothlet.restart - Clean-slate restart: shut this instance down through the normal teardown path and build a new one from the ORIGINAL `slothlet({...})` config behind the same `api` reference. Unlike `reload()`, nothing runtime is carried over — no replayed `add()`/`remove()` history, runtime hooks, permission rules, event or lifecycle subscriptions, metadata, runtime assignments or module-scope state (modules are re-imported under a new instance ID). Held child references are re-pointed to the node at the same path in the new instance; one whose path no longer exists throws `RESTART_REFERENCE_UNRESOLVED` on use. Emits `restart` → `shutdown` → `init` → `restarted`. Refused with `INVALID_CONFIG_MUTATIONS_DISABLED` when `api.mutations.reload` is `false`, and, when a `permissions` config is present, host-only (a built-in rule denies `slothlet.restart` to modules; an explicit host rule can allow a trusted module — with no `permissions` config the permission system is off and modules can call it). The new instance comes up with only the original config's permission rules and unsealed, even if the old one was sealed. See [RELOAD.md](docs/RELOAD.md#apislothletrestart). %%sig: (): Promise.<Object>%% %%example: // ESM usage via slothlet API|import slothlet from "@cldmv/slothlet";|const api = await slothlet({ base: './api' });|api.conn.handlers = { onSend };|await api.slothlet.restart(); // clean slate from the original config|api.conn.handlers; // undefined%% %%example: // ESM usage via slothlet API (inside async function)|async function example() {|  const { default: slothlet } = await import("@cldmv/slothlet");|  const api = await slothlet({ base: './api' });|  await api.slothlet.restart();|}%% %%example: // CJS usage via slothlet API (top-level)|let slothlet;|(async () => {|  ({ slothlet } = await import("@cldmv/slothlet"));|  const api = await slothlet({ base: './api' });|  await api.slothlet.restart();|})();%% %%example: // CJS usage via slothlet API (inside async function)|const slothlet = require("@cldmv/slothlet");|const api = await slothlet({ base: './api' });|await api.slothlet.restart();%%
  * @property {Function} slothlet.run - Execute a callback with isolated per-request context data. Convenience alias for `slothlet.context.run()`. %%sig: (contextData: Object, callback: function, args: *): *%% %%example: // ESM usage via slothlet API|import slothlet from "@cldmv/slothlet";|const api = await slothlet({ base: './api' });|const result = await api.slothlet.run({ userId: 42 }, async () => {|  return api.myModule.getUser();|});%% %%example: // ESM usage via slothlet API (inside async function)|async function example() {|  const { default: slothlet } = await import("@cldmv/slothlet");|  const api = await slothlet({ base: './api' });|  const result = await api.slothlet.run({ userId: 42 }, async () => {|    return api.myModule.getUser();|  });|}%% %%example: // CJS usage via slothlet API (top-level)|let slothlet;|(async () => {|  ({ slothlet } = await import("@cldmv/slothlet"));|  const api = await slothlet({ base: './api' });|  const result = await api.slothlet.run({ userId: 42 }, async () => {|    return api.myModule.getUser();|  });|})();%% %%example: // CJS usage via slothlet API (inside async function)|const slothlet = require("@cldmv/slothlet");|const api = await slothlet({ base: './api' });|const result = await api.slothlet.run({ userId: 42 }, async () => {|  return api.myModule.getUser();|});%%
  * @property {Function} slothlet.scope - Execute a function with full structured per-request context options. Convenience alias for `slothlet.context.scope()`. %%sig: (options: Object): *%% %%example: // ESM usage via slothlet API|import slothlet from "@cldmv/slothlet";|const api = await slothlet({ base: './api' });|const result = await api.slothlet.scope({|  context: { userId: 42 },|  fn: async () => api.myModule.getUser()|});%% %%example: // ESM usage via slothlet API (inside async function)|async function example() {|  const { default: slothlet } = await import("@cldmv/slothlet");|  const api = await slothlet({ base: './api' });|  const result = await api.slothlet.scope({|    context: { userId: 42 },|    fn: async () => api.myModule.getUser()|  });|}%% %%example: // CJS usage via slothlet API (top-level)|let slothlet;|(async () => {|  ({ slothlet } = await import("@cldmv/slothlet"));|  const api = await slothlet({ base: './api' });|  const result = await api.slothlet.scope({|    context: { userId: 42 },|    fn: async () => api.myModule.getUser()|  });|})();%% %%example: // CJS usage via slothlet API (inside async function)|const slothlet = require("@cldmv/slothlet");|const api = await slothlet({ base: './api' });|const result = await api.slothlet.scope({|  context: { userId: 42 },|  fn: async () => api.myModule.getUser()|});%%
  * @property {function(): Promise.<void>} slothlet.shutdown - Shut down the instance and release all resources. %%sig: (): Promise.<void>%% %%example: // ESM usage via slothlet API|import slothlet from "@cldmv/slothlet";|const api = await slothlet({ base: './api' });|await api.slothlet.shutdown();%% %%example: // ESM usage via slothlet API (inside async function)|async function example() {|  const { default: slothlet } = await import("@cldmv/slothlet");|  const api = await slothlet({ base: './api' });|  await api.slothlet.shutdown();|}%% %%example: // CJS usage via slothlet API (top-level)|let slothlet;|(async () => {|  ({ slothlet } = await import("@cldmv/slothlet"));|  const api = await slothlet({ base: './api' });|  await api.slothlet.shutdown();|})();%% %%example: // CJS usage via slothlet API (inside async function)|const slothlet = require("@cldmv/slothlet");|const api = await slothlet({ base: './api' });|await api.slothlet.shutdown();%%
diff --git a/tests/vitests/suites/api-manager/restart.test.vitest.mjs b/tests/vitests/suites/api-manager/restart.test.vitest.mjs
new file mode 100644
index 000000000..6c43653de
--- /dev/null
+++ b/tests/vitests/suites/api-manager/restart.test.vitest.mjs
@@ -0,0 +1,574 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/api-manager/restart.test.vitest.mjs
+ *	@Date: 2026-09-28T00:00:00-07:00 (1790578800)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-28 00:00:00 -07:00 (1790578800)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview `api.slothlet.restart()` (#504) — a clean-slate rebuild from the original config,
+ * swapped in behind the same `api` reference.
+ *
+ * @description
+ * Contrast with reload(): a restart drops every runtime change (runtime-assigned values, `add()` /
+ * `remove()` history, runtime hooks, permission rules, event and lifecycle subscriptions) and every
+ * module's module-scope state, while the api reference and held child references keep working —
+ * re-pointed at the node at the same path in the new instance. Lifecycle order is
+ * `restart` → `shutdown` → `init` → `restarted`.
+ */
+
+import path from "node:path";
+import { describe, it, expect, afterEach, beforeEach } from "vitest";
+import slothlet from "@cldmv/slothlet";
+import { resolveWrapper } from "#handlers/unified-wrapper";
+import { getMatrixConfigs, TEST_DIRS } from "../../setup/vitest-helper.mjs";
+
+const BASE = path.join(path.dirname(TEST_DIRS.API_TEST), "api_test_restart");
+const EXTRA = path.join(path.dirname(TEST_DIRS.API_TEST), "api_test_restart_extra");
+
+/**
+ * Tracker routine config: runs `tracker.shutdown` on every teardown, so a test can see which import
+ * generation of the fixture was shut down.
+ * @type {object}
+ */
+const TRACKER_ROUTINES = { autoRoutines: true, routines: [{ name: "^tracker.shutdown", mode: "shutdown" }] };
+
+/**
+ * Read the fixture's shared module-state record.
+ * @returns {{imports: number, shutdowns: number[]}} The record.
+ */
+function fixtureState() {
+	return globalThis.__slothletRestartFixture;
+}
+
+/**
+ * Run a call that may throw synchronously (eager) or reject (lazy) as a promise either way.
+ * @param {Function} fn - The call.
+ * @returns {Promise<unknown>} Its settled result.
+ */
+function settle(fn) {
+	return Promise.resolve().then(fn);
+}
+
+describe.each(getMatrixConfigs({}))("api.slothlet.restart() (#504) > $name", ({ config }) => {
+	let api;
+	let other;
+
+	beforeEach(() => {
+		globalThis.__slothletRestartFixture = { imports: 0, shutdowns: [] };
+	});
+
+	afterEach(async () => {
+		if (api?.shutdown) await api.shutdown();
+		if (other?.shutdown) await other.shutdown();
+		api = null;
+		other = null;
+	});
+
+	/**
+	 * Boot the fixture api for the current matrix config.
+	 * @param {object} [overrides] - Extra config.
+	 * @returns {Promise<object>} The api.
+	 */
+	async function create(overrides = {}) {
+		api = await slothlet({ ...config, base: BASE, silent: true, ...overrides });
+		return api;
+	}
+
+	it("drops a runtime-assigned value that reload() keeps, and re-runs the module's top level (issue example)", async () => {
+		await create();
+		const firstGeneration = api.conn.generation;
+
+		api.conn.handlers = { onSend: "x" };
+		await api.slothlet.api.reload();
+		// reload() re-imports conn.mjs but re-applies the runtime assignment on top of the new emitter.
+		expect(api.conn.generation).toBeGreaterThan(firstGeneration);
+		expect(api.conn.handlers).toEqual({ onSend: "x" });
+
+		const beforeRestart = api.conn.generation;
+		await api.slothlet.restart();
+		expect(api.conn.handlers).toBeUndefined();
+		expect(api.conn.generation).toBeGreaterThan(beforeRestart);
+		expect(typeof api.conn.on).toBe("function");
+	});
+
+	it("keeps the api reference and returns it", async () => {
+		await create();
+		const ref = api;
+		const returned = await api.slothlet.restart();
+		expect(returned).toBe(ref);
+		expect(api).toBe(ref);
+		expect(await api.secret.open()).toBe("open");
+	});
+
+	it("starts module-scope state fresh", async () => {
+		await create();
+		await api.counter.increment();
+		await api.counter.increment();
+		expect(await api.counter.current()).toBe(2);
+		await api.slothlet.restart();
+		expect(await api.counter.current()).toBe(0);
+		expect(await api.counter.increment()).toBe(1);
+	});
+
+	it("rebuilds under a new instance ID and `self` inside leaves resolves to the new instance", async () => {
+		await create();
+		const oldID = api.slothlet.instanceID;
+		expect(await api.probe.instanceID()).toBe(oldID);
+		await api.slothlet.restart();
+		const newID = api.slothlet.instanceID;
+		expect(newID).not.toBe(oldID);
+		expect(await api.probe.instanceID()).toBe(newID);
+		expect(await api.probe.connGeneration()).toBe(api.conn.generation);
+	});
+
+	it("does not replay runtime add() / remove() history (reload does)", async () => {
+		await create();
+		await api.slothlet.api.add("plugin", EXTRA, { moduleID: "restart-plugin" });
+		await api.slothlet.api.remove("secret");
+		expect(await api.plugin.ping()).toBe("plugin");
+		expect(api.secret).toBeUndefined();
+
+		await api.slothlet.reload();
+		expect(await api.plugin.ping()).toBe("plugin");
+		expect(api.secret).toBeUndefined();
+
+		await api.slothlet.restart();
+		expect(api.plugin).toBeUndefined();
+		expect(await api.secret.blocked()).toBe("blocked");
+	});
+
+	it("re-points a held child reference to the new instance's node at the same path", async () => {
+		await create();
+		const conn = api.conn;
+		const increment = api.counter.increment;
+		await increment();
+		await increment();
+		const firstGeneration = conn.generation;
+
+		await api.slothlet.restart();
+		expect(conn.generation).toBe(api.conn.generation);
+		expect(conn.generation).toBeGreaterThan(firstGeneration);
+		// The held leaf now calls the fresh module (count restarts from zero).
+		expect(await increment()).toBe(1);
+		expect(await api.counter.current()).toBe(1);
+		// Writes through the held reference land on the new instance.
+		conn.handlers = { live: true };
+		expect(api.conn.handlers).toEqual({ live: true });
+	});
+
+	it("follows a held reference across two restarts", async () => {
+		await create();
+		const conn = api.conn;
+		const g1 = conn.generation;
+		await api.slothlet.restart();
+		const g2 = conn.generation;
+		await api.slothlet.restart();
+		const g3 = conn.generation;
+		expect(g2).toBeGreaterThan(g1);
+		expect(g3).toBeGreaterThan(g2);
+		expect(g3).toBe(api.conn.generation);
+		expect(await api.counter.increment()).toBe(1);
+	});
+
+	it("throws RESTART_REFERENCE_UNRESOLVED when a held reference's path no longer exists", async () => {
+		await create();
+		await api.slothlet.api.add("plugin", EXTRA, { moduleID: "restart-plugin" });
+		const plugin = api.plugin;
+		expect(await plugin.ping()).toBe("plugin");
+
+		await api.slothlet.restart();
+		expect(api.plugin).toBeUndefined();
+		let caught = null;
+		try {
+			await plugin.ping();
+		} catch (error) {
+			caught = error;
+		}
+		expect(caught?.code).toBe("RESTART_REFERENCE_UNRESOLVED");
+		expect(caught?.message).toContain("plugin");
+	});
+
+	it("drops runtime permission rules while config-declared rules apply", async () => {
+		await create({
+			permissions: { defaultPolicy: "allow", rules: [{ caller: "probe.**", target: "secret.blocked", effect: "deny" }] }
+		});
+		api.slothlet.permissions.addRule({ caller: "probe.**", target: "secret.open", effect: "deny" });
+		await expect(settle(() => api.probe.callBlocked())).rejects.toThrow("PERMISSION_DENIED");
+		await expect(settle(() => api.probe.callOpen())).rejects.toThrow("PERMISSION_DENIED");
+
+		await api.slothlet.restart();
+		await expect(settle(() => api.probe.callBlocked())).rejects.toThrow("PERMISSION_DENIED");
+		expect(await api.probe.callOpen()).toBe("open");
+	});
+
+	it("drops runtime hooks", async () => {
+		await create({ hook: { enabled: true } });
+		const fired = [];
+		api.slothlet.hook.on("counter.increment:before", () => {
+			fired.push("before");
+		});
+		await api.counter.increment();
+		expect(fired).toEqual(["before"]);
+
+		await api.slothlet.restart();
+		await api.counter.increment();
+		expect(fired).toEqual(["before"]);
+	});
+
+	it("drops runtime event subscriptions", async () => {
+		await create();
+		const received = [];
+		api.slothlet.event.on("restart.test", (payload) => received.push(payload));
+		await api.slothlet.event.emit("restart.test", 1);
+		expect(received).toEqual([1]);
+
+		await api.slothlet.restart();
+		await api.slothlet.event.emit("restart.test", 2);
+		expect(received).toEqual([1]);
+	});
+
+	it("emits restart → shutdown → init → restarted; runtime subscribers only see the old instance's events", async () => {
+		const configEvents = [];
+		/**
+		 * Record a config-declared lifecycle event.
+		 * @param {string} name - Event name.
+		 * @returns {Function} Handler.
+		 */
+		const record = (name) => (data) => configEvents.push({ name, data });
+		await create({
+			lifecycle: { restart: record("restart"), shutdown: record("shutdown"), init: record("init"), restarted: record("restarted") }
+		});
+		const oldID = api.slothlet.instanceID;
+		expect(configEvents.map((e) => e.name)).toEqual(["init"]);
+		expect(configEvents[0].data).toMatchObject({ instanceID: oldID, restart: false });
+
+		const runtimeEvents = [];
+		for (const name of ["restart", "shutdown", "init", "restarted"]) {
+			api.slothlet.lifecycle.on(name, () => runtimeEvents.push(name));
+		}
+
+		configEvents.length = 0;
+		await api.slothlet.restart();
+		const newID = api.slothlet.instanceID;
+		expect(configEvents.map((e) => e.name)).toEqual(["restart", "shutdown", "init", "restarted"]);
+		expect(configEvents[0].data).toEqual({ instanceID: oldID });
+		expect(configEvents[1].data).toEqual({ instanceID: oldID, restart: true });
+		expect(configEvents[2].data).toEqual({ instanceID: newID, restart: true });
+		expect(configEvents[3].data).toEqual({ instanceID: newID, previousInstanceID: oldID });
+		expect(runtimeEvents).toEqual(["restart", "shutdown"]);
+
+		// The runtime subscriber went with the old instance.
+		await api.slothlet.shutdown();
+		expect(runtimeEvents).toEqual(["restart", "shutdown"]);
+		expect(configEvents.at(-1)).toEqual({ name: "shutdown", data: { instanceID: newID, restart: false } });
+		api = null;
+	});
+
+	it("shuts the old instance down through the normal teardown path", async () => {
+		await create(TRACKER_ROUTINES);
+		const oldID = api.slothlet.instanceID;
+		expect(fixtureState().shutdowns).toEqual([]);
+
+		await api.slothlet.restart();
+		const newID = api.slothlet.instanceID;
+		// The old generation's shutdown routine ran exactly once.
+		expect(fixtureState().shutdowns).toEqual([1]);
+		// The old context store is gone; only the new instance's remains for this api.
+		const ids = api.slothlet.diag.inspect().context.instances.map((entry) => entry.id);
+		expect(ids).toContain(newID);
+		expect(ids.some((id) => id === oldID || id.startsWith(`${oldID}__run_`))).toBe(false);
+
+		await api.shutdown();
+		expect(fixtureState().shutdowns).toEqual([1, 2]);
+		api = null;
+	});
+
+	it("leaves other instances untouched", async () => {
+		await create();
+		other = await slothlet({ ...config, base: BASE, silent: true });
+		await other.counter.increment();
+		const otherConn = other.conn;
+		const otherGeneration = other.conn.generation;
+		const otherID = other.slothlet.instanceID;
+
+		await api.slothlet.restart();
+		expect(other.slothlet.instanceID).toBe(otherID);
+		expect(await other.probe.instanceID()).toBe(otherID);
+		expect(await other.counter.current()).toBe(1);
+		expect(other.conn).toBe(otherConn);
+		expect(other.conn.generation).toBe(otherGeneration);
+		expect(await api.probe.instanceID()).toBe(api.slothlet.instanceID);
+	});
+
+	it("lets calls already in flight finish on the old implementation", async () => {
+		await create();
+		const startGeneration = api.conn.generation;
+		const pending = api.probe.slow(150);
+		await api.slothlet.restart();
+		expect(await pending).toBe(startGeneration);
+		expect(api.conn.generation).toBeGreaterThan(startGeneration);
+	});
+
+	it("coalesces concurrent restart() calls into one restart", async () => {
+		const inits = [];
+		await create({ lifecycle: { init: (data) => inits.push(data.instanceID) } });
+		const [a, b] = await Promise.all([api.slothlet.restart(), api.slothlet.restart()]);
+		expect(a).toBe(api);
+		expect(b).toBe(api);
+		expect(inits).toHaveLength(2);
+		expect(inits[1]).toBe(api.slothlet.instanceID);
+	});
+
+	it("rebuilds from the config as passed at creation, not from later mutations of that object", async () => {
+		const options = {
+			...config,
+			base: BASE,
+			silent: true,
+			permissions: { defaultPolicy: "allow", rules: [{ caller: "probe.**", target: "secret.blocked", effect: "deny" }] }
+		};
+		api = await slothlet(options);
+		options.base = EXTRA;
+		options.permissions.rules.length = 0;
+		options.permissions.rules.push({ caller: "probe.**", target: "secret.open", effect: "deny" });
+
+		await api.slothlet.restart();
+		expect(api.plugin).toBeUndefined();
+		await expect(settle(() => api.probe.callBlocked())).rejects.toThrow("PERMISSION_DENIED");
+		expect(await api.probe.callOpen()).toBe("open");
+	});
+
+	it("is refused when reload mutations are disabled", async () => {
+		await create({ api: { mutations: { add: true, remove: true, reload: false } } });
+		let caught = null;
+		try {
+			await api.slothlet.restart();
+		} catch (error) {
+			caught = error;
+		}
+		expect(caught?.code).toBe("INVALID_CONFIG_MUTATIONS_DISABLED");
+	});
+
+	it("restarts a sealed instance into an unsealed one with only the original config's rules", async () => {
+		await create({
+			permissions: { defaultPolicy: "allow", rules: [{ caller: "probe.**", target: "secret.blocked", effect: "deny" }] }
+		});
+		api.slothlet.permissions.addRule({ caller: "probe.**", target: "secret.open", effect: "deny" });
+		api.slothlet.permissions.control.seal();
+		expect(api.slothlet.permissions.control.sealed).toBe(true);
+
+		await api.slothlet.restart();
+		expect(api.slothlet.permissions.control.sealed).toBe(false);
+		await expect(settle(() => api.probe.callBlocked())).rejects.toThrow("PERMISSION_DENIED");
+		expect(await api.probe.callOpen()).toBe("open");
+		// Unsealed: the policy can be changed (and sealed) again.
+		expect(() => api.slothlet.permissions.addRule({ caller: "probe.**", target: "secret.open", effect: "deny" })).not.toThrow();
+		api.slothlet.permissions.control.seal();
+		expect(api.slothlet.permissions.control.sealed).toBe(true);
+	});
+
+	it("leaves restart() reachable from a module when there is no permissions config (built-ins inert)", async () => {
+		await create();
+		const before = api.slothlet.instanceID;
+		await api.probe.restartInstance();
+		expect(api.slothlet.instanceID).not.toBe(before);
+		expect(await api.probe.instanceID()).toBe(api.slothlet.instanceID);
+	});
+
+	it("is host-only by default: a module calling restart() is denied (defaultPolicy allow)", async () => {
+		await create({ permissions: { defaultPolicy: "allow" } });
+		const before = api.slothlet.instanceID;
+		await expect(settle(() => api.probe.restartInstance())).rejects.toThrow("PERMISSION_DENIED");
+		expect(api.slothlet.instanceID).toBe(before);
+	});
+
+	it("runs the user's root shutdown during the teardown, also when a permitted module triggered the restart", async () => {
+		await create({ permissions: { defaultPolicy: "allow", rules: [{ caller: "probe.**", target: "slothlet.restart", effect: "allow" }] } });
+		const first = api.slothlet.instanceID;
+		await api.slothlet.restart();
+		expect(fixtureState().userShutdowns).toHaveLength(1);
+
+		const second = api.slothlet.instanceID;
+		expect(second).not.toBe(first);
+		await api.probe.restartInstance();
+		// The module-triggered teardown ran the user's shutdown too — it was not refused halfway.
+		expect(fixtureState().userShutdowns).toHaveLength(2);
+		expect(api.slothlet.instanceID).not.toBe(second);
+		expect(await api.counter.increment()).toBe(1);
+	});
+
+	it("lets the host restart, and a host allow rule lets a trusted module restart", async () => {
+		await create({ permissions: { defaultPolicy: "allow", rules: [{ caller: "probe.**", target: "slothlet.restart", effect: "allow" }] } });
+		const first = api.slothlet.instanceID;
+		await api.slothlet.restart();
+		const second = api.slothlet.instanceID;
+		expect(second).not.toBe(first);
+
+		await api.probe.restartInstance();
+		expect(api.slothlet.instanceID).not.toBe(second);
+		expect(await api.probe.instanceID()).toBe(api.slothlet.instanceID);
+	});
+});
+
+describe.each(getMatrixConfigs({}))("api.slothlet.restart() (#504) > held references and teardown edges > $name", ({ config }) => {
+	let api;
+
+	beforeEach(() => {
+		globalThis.__slothletRestartFixture = { imports: 0, shutdowns: [] };
+	});
+
+	afterEach(async () => {
+		if (api?.shutdown) await api.shutdown().catch(() => {});
+		api = null;
+	});
+
+	/**
+	 * Boot the fixture api for the current matrix config.
+	 * @param {object} [overrides] - Extra config.
+	 * @returns {Promise<object>} The api.
+	 */
+	async function create(overrides = {}) {
+		api = await slothlet({ ...config, base: BASE, silent: true, ...overrides });
+		return api;
+	}
+
+	it("forwards reflection on a held reference to the new instance's node", async () => {
+		await create();
+		const conn = api.conn;
+		await api.slothlet.restart();
+
+		conn.handlers = { a: 1 };
+		expect("handlers" in conn).toBe(true);
+		expect(Object.keys(conn)).toEqual(Object.keys(api.conn));
+		expect(Object.getOwnPropertyDescriptor(conn, "handlers")?.value).toEqual({ a: 1 });
+		expect(Object.getOwnPropertyDescriptor(conn, "no-such-key")).toBeUndefined();
+		expect(Object.getPrototypeOf(conn)).toBe(Object.getPrototypeOf(api.conn));
+		expect(delete conn.handlers).toBe(true);
+		expect(api.conn.handlers).toBeUndefined();
+	});
+
+	it("keeps a held function reference within its proxy invariants", async () => {
+		await create();
+		const increment = api.counter.increment;
+		const counter = api.counter;
+		await api.slothlet.restart();
+
+		// A function-backed proxy target owns a non-configurable `prototype`; its answers stay tied to it.
+		expect("prototype" in increment).toBe(true);
+		expect(Reflect.deleteProperty(increment, "prototype")).toBe(false);
+		expect(Reflect.ownKeys(increment)).toContain("prototype");
+		// A stale `this` is mapped to its live counterpart.
+		expect(await increment.call(counter)).toBe(1);
+
+		// Once the target is non-extensible, reflection answers from the target itself.
+		Object.preventExtensions(counter);
+		expect(() => Reflect.ownKeys(counter)).not.toThrow();
+		expect(() => Object.getPrototypeOf(counter)).not.toThrow();
+		expect(() => Object.getOwnPropertyDescriptor(counter, "current")).not.toThrow();
+	});
+
+	it("constructs through a held class reference against the new instance", async () => {
+		await create();
+		// Lazy: a namespace read before materialization is a waiting proxy, which is not constructible —
+		// the same as a fresh read, so materialize the namespace first (before and after the restart).
+		if (config.mode === "lazy") await api.factory.Widget;
+		const Widget = api.factory.Widget;
+		expect(new Widget().generation).toBe(api.conn.generation);
+		await api.slothlet.restart();
+		if (config.mode === "lazy") await api.factory.Widget;
+		const instance = new Widget();
+		expect(instance.generation).toBe(api.conn.generation);
+	});
+
+	it("restarts an instance that was already shut down", async () => {
+		await create();
+		const oldID = api.slothlet.instanceID;
+		await api.slothlet.shutdown();
+		await api.slothlet.restart();
+		expect(api.slothlet.instanceID).not.toBe(oldID);
+		expect(await api.counter.increment()).toBe(1);
+	});
+
+	it("still rebuilds when a shutdown routine throws, then re-throws its error", async () => {
+		await create(TRACKER_ROUTINES);
+		const oldID = api.slothlet.instanceID;
+		fixtureState().throwOnShutdown = true;
+		let caught = null;
+		try {
+			await api.slothlet.restart();
+		} catch (error) {
+			caught = error;
+		}
+		fixtureState().throwOnShutdown = false;
+		expect(caught?.code).toBe("ROUTINE_FAILED");
+		expect(api.slothlet.instanceID).not.toBe(oldID);
+		expect(await api.counter.increment()).toBe(1);
+	});
+
+	it("finishes the internal teardown when the root shutdown hook throws", async () => {
+		await create();
+		const instance = resolveWrapper(api.counter).slothlet;
+		const oldID = api.slothlet.instanceID;
+		instance.userHooks.shutdown = () => {
+			throw new Error("hook failure");
+		};
+		await expect(api.slothlet.restart()).rejects.toThrow("hook failure");
+		const ids = api.slothlet.diag.inspect().context.instances.map((entry) => entry.id);
+		expect(ids).not.toContain(oldID);
+		expect(await api.counter.increment()).toBe(1);
+	});
+
+	it("refuses restart() on an instance with no retained original config", async () => {
+		await create();
+		resolveWrapper(api.counter).slothlet._originalConfig = null;
+		let caught = null;
+		try {
+			await api.slothlet.restart();
+		} catch (error) {
+			caught = error;
+		}
+		expect(caught?.code).toBe("INVALID_CONFIG_NOT_LOADED");
+	});
+
+	it("retains an immutable snapshot of the original config", async () => {
+		const context = { user: "u" };
+		const map = new Map([["k", 1]]);
+		const extra = { list: [1, { deep: true }], map, bare: Object.create(null) };
+		extra.self = extra;
+		Object.defineProperty(extra, "hidden", { value: 1, enumerable: false });
+		extra.bare.flag = true;
+		await create({ context, extra });
+		const snapshot = resolveWrapper(api.counter).slothlet._originalConfig;
+
+		expect(Object.isFrozen(snapshot)).toBe(true);
+		expect(snapshot.context).toBe(context);
+		expect(snapshot.extra).not.toBe(extra);
+		expect(Object.isFrozen(snapshot.extra)).toBe(true);
+		expect(Object.isFrozen(snapshot.extra.list[1])).toBe(true);
+		expect(snapshot.extra.self).toBe(snapshot.extra);
+		expect(snapshot.extra.map).toBe(map);
+		expect(Object.getPrototypeOf(snapshot.extra.bare)).toBe(null);
+		expect(snapshot.extra.bare.flag).toBe(true);
+		expect("hidden" in snapshot.extra).toBe(false);
+
+		await api.slothlet.restart();
+		expect(resolveWrapper(api.counter).slothlet.context).toBe(context);
+	});
+
+	if (config.mode === "lazy") {
+		it("forwards a held lazy waiting reference to the new instance", async () => {
+			await create();
+			// Taken before `counter` materializes: a waiting proxy for `counter.increment`.
+			const increment = api.counter.increment;
+			await api.slothlet.restart();
+			expect(await increment()).toBe(1);
+			expect(typeof increment.name).toBe("string");
+		});
+	}
+});
diff --git a/tools/ci/i18n-latin-tokens-accepted.json b/tools/ci/i18n-latin-tokens-accepted.json
index 8963190d8..ff238dd82 100644
--- a/tools/ci/i18n-latin-tokens-accepted.json
+++ b/tools/ci/i18n-latin-tokens-accepted.json
@@ -21,6 +21,7 @@
 			"removeApi",
 			"removeModule",
 			"reload",
+			"restart",
 			"shutdown",
 			"destroy",
 			"run",
@@ -272,6 +273,7 @@
 		"removeApi",
 		"removeModule",
 		"reload",
+		"restart",
 		"shutdown",
 		"destroy",
 		"run",
diff --git a/types/src/lib/builders/api_builder.d.mts.map b/types/src/lib/builders/api_builder.d.mts.map
index d814551c1..dd1cfefac 100644
--- a/types/src/lib/builders/api_builder.d.mts.map
+++ b/types/src/lib/builders/api_builder.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"api_builder.d.mts","sourceRoot":"","sources":["../../../../src/lib/builders/api_builder.mjs"],"names":[],"mappings":"AA4NA;;;;;;;;;;;;;GAaG;AACH;IACC,gCAAuC;IAEvC;;;;;;;OAOG;IACH,sBANW,MAAM,EAQhB;IAED;;;;;OAKG;IACH,8BAJW,MAAM,GACJ,OAAO,CAAC,MAAM,CAAC,CA6G3B;IAED;;;;;;;;;;;OAWG;IACH,gCA2rGC;IAED;;;;OAIG;IACH,+BA+CC;IAED;;;;OAIG;IACH,0BAgCC;IAED;;;;OAIG;IACH,4BAsTC;IAED;;;;;OAKG;IACH,8BAiFC;IAED;;;;;OAKG;IACH,uBAgCC;CACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BA/iI6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"api_builder.d.mts","sourceRoot":"","sources":["../../../../src/lib/builders/api_builder.mjs"],"names":[],"mappings":"AA4NA;;;;;;;;;;;;;GAaG;AACH;IACC,gCAAuC;IAEvC;;;;;;;OAOG;IACH,sBANW,MAAM,EAQhB;IAED;;;;;OAKG;IACH,8BAJW,MAAM,GACJ,OAAO,CAAC,MAAM,CAAC,CA6G3B;IAED;;;;;;;;;;;OAWG;IACH,gCA2sGC;IAED;;;;OAIG;IACH,+BA+CC;IAED;;;;OAIG;IACH,0BAgCC;IAED;;;;OAIG;IACH,4BAsTC;IAED;;;;;OAKG;IACH,8BAiFC;IAED;;;;;OAKG;IACH,uBAgCC;CACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BA/jI6B,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/lib/handlers/permission-manager.d.mts.map b/types/src/lib/handlers/permission-manager.d.mts.map
index 297a5f396..11278dbd2 100644
--- a/types/src/lib/handlers/permission-manager.d.mts.map
+++ b/types/src/lib/handlers/permission-manager.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"permission-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/permission-manager.mjs"],"names":[],"mappings":"AAiMA;;;;;;;GAOG;AACH;IACC;;;;OAIG;IACH,yBAHU,MAAM,CAG8B;IAmJ9C;;;;;;OAMG;IACH,sBAJW,MAAM,EAmHhB;IAED;;;;;;;;;;;;;OAaG;IACH,cAVG;QAAqB,MAAM,EAAnB,MAAM;QACO,MAAM,EAAnB,MAAM;QACO,MAAM,EAAnB,MAAM;KACd,kBAAQ,MAAM,GAAC,IAAI,WACX,MAAM,GAAC,IAAI,iBACT,MAAM,CAiDlB;IAED;;;;;;;;;;OAUG;IACH,mBAPW,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,OAAO,CAmCnB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,mBAZG;QAAqB,MAAM,EAAnB,MAAM;QACO,KAAK,EAAlB,MAAM;QACwB,MAAM,EAApC,MAAM,GAAC,QAAQ,GAAC,OAAO;QACuB,SAAS;KAC/D,kBAAQ,MAAM,GAAC,IAAI,WACX,MAAM,GAAC,IAAI,UACX,MAAM,GAAC,IAAI,GACT,MAAM,CAqClB;IAED;;;;;;;;OAQG;IACH,wBALW,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,OAAO,CAiBnB;IAED;;;;;;;;;;OAUG;IACH,kCALW,MAAM,GAAC,IAAI,aACX,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,MAAM,GAAC,QAAQ,GAAC,OAAO,CA0BnC;IAED;;;;OAIG;IACH,uBAFa,MAAM,CAIlB;IAED;;;;;OAKG;IACH,gCAFa,OAAO,CAOnB;IAuCD;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,wBAlBW,MAAM,cAEd;QAAwC,GAAG,EAAnC,CAAS,IAAM,EAAN,MAAM,KAAG,GAAC;QAGQ,OAAO,EAAlC,CAAS,IAAC,EAAD,GAAC,KAAG,GAAC;QACM,MAAM;KAClC,kBAAQ,MAAM,GAAC,IAAI,WACX,CAAS,IAAQ,YAAE,IAAQ,EAAR,KAAK,CAAC,GAAC,CAAC,KAAG,GAAC,GAG7B,IAAI,CA0ChB;IAED;;;;;;;;;;;OAWG;IACH,0BARW,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,OAAO,CAanB;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,0BARW,MAAM,gBACN,GAAC,mBACD,MAAM,GAAC,IAAI,GACT,OAAO,CAiBnB;IAED;;;;;;;OAOG;IACH,mBALW,MAAM,GACJ,OAAO,CAMnB;IAED;;;;;;;;OAQG;IACH,0BALW,MAAM,GACJ,IAAI,CAUhB;IAED;;;;;;;;;;;OAWG;IACH,2BALW,MAAM,GACJ,IAAI,CAUhB;IAED;;;;;;;;;;;OAWG;IACH,uBANW,MAAM,iBACN,MAAM,GACJ,IAAI,CAShB;IAED;;;;;;;;;;;;;;;OAeG;IACH,4BATW,MAAM,cACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,GACT,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,GAAC,CAAA;KAAE,CAAC,CAkCnD;IAED;;;;;;;;;OASG;IACH,yBALW,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,GAAC,CAAA;KAAE,CAAC,GACrC,OAAO,CAAC,IAAI,CAAC,CAMzB;IA4SD;;;;;;;;;;;;;;;OAeG;IACH,wBAXW,MAAM,cACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,YACX;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAC,IAAI,GAEzB,OAAO,CA2BnB;IAED;;;;;;;;;OASG;IACH,4BANW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,cAAU,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,WAAS,CAAC,GAAC,IAAI,GAAC,SAAS,mBACvF,MAAM,GAAC,IAAI,GACT,OAAO,CASnB;IAyBD;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,0BAtBW,MAAM,cACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,aACX,kBAAkB,GAAC,IAAI,YAGvB;QAAE,cAAc,CAAC,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GAAC,IAAI,GAQrE,OAAO,CA0CnB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,sBAXW,MAAM,cACN,MAAM,SACN,KAAK,CAAC,GAAC,CAAC,mBACR,MAAM,GAAC,IAAI,GACT,OAAO,GAAC,OAAO,CAAC,OAAO,CAAC,CA8CpC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,8BAbW,MAAM,GAAC,IAAI,YAEX,MAAM,YACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,GACT,OAAO,CAenB;IAED;;;;;;;;;;;;;;;OAeG;IACH,4BAZW,MAAM,GAAC,IAAI,YACX,MAAM,YACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBAGX,MAAM,GAAC,IAAI,GACT,OAAO,CAMnB;IAED;;;;;;;OAOG;IACH,4BALW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAazB;IAED;;;;;;;OAOG;IACH,2BALW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAYzB;IAED;;;;;;;;OAQG;IACH,8BALW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAazB;IAED;;;;;;OAMG;IACH,UAJa,IAAI,CAQhB;IAcD;;;;;;;;OAQG;IACH,QAJa,IAAI,CAMhB;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,mCALW,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAC,CAAC,GAAC,IAAI,GAAC,SAAS,GAChD,IAAI,CAUhB;IAED;;;;;OAKG;IACH,YAJa,OAAO,CAMnB;IAED;;;;;;OAMG;IACH,WAJa,IAAI,CAQhB;IAED;;;;;;OAMG;IACH,aAJa,OAAO,CAMnB;IAED;;;;;;;;OAQG;IACH,uBAJa,OAAO,CAMnB;IAED;;;;;;;;;OASG;IACH,oBAJa,OAAO,CAMnB;IAED;;;;;;;;;;;;OAYG;IACH,mCAVW,MAAM,GAAC,IAAI,GAAC,SAAS,GACnB,OAAO,CAWnB;IAED;;;;;;;;;;;OAWG;IACH,qBANW,OAAO,GACL,IAAI,CAgBhB;IAED;;;;;;OAMG;IAIH,eAPa,KAAK,CAAC,MAAM,CAAC,CAgBzB;IAED;;;;;;;;OAQG;IACH,2BALW,KAAK,CAAC,MAAM,CAAC,GACX,IAAI,CAShB;IAGD;;;;;;;OAOG;IACH,YAJa,OAAO,CAAC,IAAI,CAAC,CAezB;IA4nBD;;;;;;;OAOG;IACH,cAEC;;CACD;;;;;;;;;;;;;;;;UA5xEa,KAAK,CAAC,GAAC,CAAC,GAAC,IAAI;;;;YACb,MAAM,GAAC,IAAI;;8BAzIK,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"permission-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/permission-manager.mjs"],"names":[],"mappings":"AAiMA;;;;;;;GAOG;AACH;IACC;;;;OAIG;IACH,yBAHU,MAAM,CAG8B;IAmJ9C;;;;;;OAMG;IACH,sBAJW,MAAM,EA0HhB;IAED;;;;;;;;;;;;;OAaG;IACH,cAVG;QAAqB,MAAM,EAAnB,MAAM;QACO,MAAM,EAAnB,MAAM;QACO,MAAM,EAAnB,MAAM;KACd,kBAAQ,MAAM,GAAC,IAAI,WACX,MAAM,GAAC,IAAI,iBACT,MAAM,CAiDlB;IAED;;;;;;;;;;OAUG;IACH,mBAPW,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,OAAO,CAmCnB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,mBAZG;QAAqB,MAAM,EAAnB,MAAM;QACO,KAAK,EAAlB,MAAM;QACwB,MAAM,EAApC,MAAM,GAAC,QAAQ,GAAC,OAAO;QACuB,SAAS;KAC/D,kBAAQ,MAAM,GAAC,IAAI,WACX,MAAM,GAAC,IAAI,UACX,MAAM,GAAC,IAAI,GACT,MAAM,CAqClB;IAED;;;;;;;;OAQG;IACH,wBALW,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,OAAO,CAiBnB;IAED;;;;;;;;;;OAUG;IACH,kCALW,MAAM,GAAC,IAAI,aACX,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,MAAM,GAAC,QAAQ,GAAC,OAAO,CA0BnC;IAED;;;;OAIG;IACH,uBAFa,MAAM,CAIlB;IAED;;;;;OAKG;IACH,gCAFa,OAAO,CAOnB;IAuCD;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,wBAlBW,MAAM,cAEd;QAAwC,GAAG,EAAnC,CAAS,IAAM,EAAN,MAAM,KAAG,GAAC;QAGQ,OAAO,EAAlC,CAAS,IAAC,EAAD,GAAC,KAAG,GAAC;QACM,MAAM;KAClC,kBAAQ,MAAM,GAAC,IAAI,WACX,CAAS,IAAQ,YAAE,IAAQ,EAAR,KAAK,CAAC,GAAC,CAAC,KAAG,GAAC,GAG7B,IAAI,CA0ChB;IAED;;;;;;;;;;;OAWG;IACH,0BARW,MAAM,mBACN,MAAM,GAAC,IAAI,GACT,OAAO,CAanB;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,0BARW,MAAM,gBACN,GAAC,mBACD,MAAM,GAAC,IAAI,GACT,OAAO,CAiBnB;IAED;;;;;;;OAOG;IACH,mBALW,MAAM,GACJ,OAAO,CAMnB;IAED;;;;;;;;OAQG;IACH,0BALW,MAAM,GACJ,IAAI,CAUhB;IAED;;;;;;;;;;;OAWG;IACH,2BALW,MAAM,GACJ,IAAI,CAUhB;IAED;;;;;;;;;;;OAWG;IACH,uBANW,MAAM,iBACN,MAAM,GACJ,IAAI,CAShB;IAED;;;;;;;;;;;;;;;OAeG;IACH,4BATW,MAAM,cACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,GACT,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,GAAC,CAAA;KAAE,CAAC,CAkCnD;IAED;;;;;;;;;OASG;IACH,yBALW,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,GAAC,CAAA;KAAE,CAAC,GACrC,OAAO,CAAC,IAAI,CAAC,CAMzB;IA4SD;;;;;;;;;;;;;;;OAeG;IACH,wBAXW,MAAM,cACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,YACX;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAC,IAAI,GAEzB,OAAO,CA2BnB;IAED;;;;;;;;;OASG;IACH,4BANW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,cAAU,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,WAAS,CAAC,GAAC,IAAI,GAAC,SAAS,mBACvF,MAAM,GAAC,IAAI,GACT,OAAO,CASnB;IAyBD;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,0BAtBW,MAAM,cACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,aACX,kBAAkB,GAAC,IAAI,YAGvB;QAAE,cAAc,CAAC,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GAAC,IAAI,GAQrE,OAAO,CA0CnB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,sBAXW,MAAM,cACN,MAAM,SACN,KAAK,CAAC,GAAC,CAAC,mBACR,MAAM,GAAC,IAAI,GACT,OAAO,GAAC,OAAO,CAAC,OAAO,CAAC,CA8CpC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,8BAbW,MAAM,GAAC,IAAI,YAEX,MAAM,YACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,GACT,OAAO,CAenB;IAED;;;;;;;;;;;;;;;OAeG;IACH,4BAZW,MAAM,GAAC,IAAI,YACX,MAAM,YACN,MAAM,mBACN,MAAM,GAAC,IAAI,mBACX,MAAM,GAAC,IAAI,mBAGX,MAAM,GAAC,IAAI,GACT,OAAO,CAMnB;IAED;;;;;;;OAOG;IACH,4BALW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAazB;IAED;;;;;;;OAOG;IACH,2BALW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAYzB;IAED;;;;;;;;OAQG;IACH,8BALW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAazB;IAED;;;;;;OAMG;IACH,UAJa,IAAI,CAQhB;IAcD;;;;;;;;OAQG;IACH,QAJa,IAAI,CAMhB;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,mCALW,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAC,CAAC,GAAC,IAAI,GAAC,SAAS,GAChD,IAAI,CAUhB;IAED;;;;;OAKG;IACH,YAJa,OAAO,CAMnB;IAED;;;;;;OAMG;IACH,WAJa,IAAI,CAQhB;IAED;;;;;;OAMG;IACH,aAJa,OAAO,CAMnB;IAED;;;;;;;;OAQG;IACH,uBAJa,OAAO,CAMnB;IAED;;;;;;;;;OASG;IACH,oBAJa,OAAO,CAMnB;IAED;;;;;;;;;;;;OAYG;IACH,mCAVW,MAAM,GAAC,IAAI,GAAC,SAAS,GACnB,OAAO,CAWnB;IAED;;;;;;;;;;;OAWG;IACH,qBANW,OAAO,GACL,IAAI,CAgBhB;IAED;;;;;;OAMG;IAIH,eAPa,KAAK,CAAC,MAAM,CAAC,CAgBzB;IAED;;;;;;;;OAQG;IACH,2BALW,KAAK,CAAC,MAAM,CAAC,GACX,IAAI,CAShB;IAGD;;;;;;;OAOG;IACH,YAJa,OAAO,CAAC,IAAI,CAAC,CAezB;IA4nBD;;;;;;;OAOG;IACH,cAEC;;CACD;;;;;;;;;;;;;;;;UAnyEa,KAAK,CAAC,GAAC,CAAC,GAAC,IAAI;;;;YACb,MAAM,GAAC,IAAI;;8BAzIK,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/lib/handlers/unified-wrapper.d.mts.map b/types/src/lib/handlers/unified-wrapper.d.mts.map
index d578f2aa0..69b3534d5 100644
--- a/types/src/lib/handlers/unified-wrapper.d.mts.map
+++ b/types/src/lib/handlers/unified-wrapper.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"unified-wrapper.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/unified-wrapper.mjs"],"names":[],"mappings":"AAu7BA;;;;;;;;;;;;;;;;;;GAkBG;AACH,4CAhBW,MAAM,GAAC,MAAM,GACX,OAAO,CAkBnB;AA+6ID;;;;;;;;;;;GAWG;AACH,sCAPW,OAAO,GACL,cAAc,GAAC,IAAI,CAkB/B;AAx+ID;;;;;;;;GAQG;AACH,iCAHU,GAAG,CAAC,MAAM,CAAC,CAG2F;;;;;AAuEhH;;;;;;;;;;GAUG;AACH;IA2UC;;;;;;;;;;;;;;;;OAgBG;IACH,0BAsCC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,gCAiEC;IA7bD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,sBApCW,MAAM,mKAEd;QAAwB,IAAI,EAApB,MAAM;QACU,OAAO,EAAvB,MAAM;QACyB,WAAW;QACvB,eAAe;QAChB,UAAU;QACV,mBAAmB;QACpB,QAAQ;QACD,UAAU;QAGjB,QAAQ;QACR,YAAY;QACE,cAAc;QAI3B,eAAe;KAMzC,EAmOF;IA7QD;;;;;;;;;;;OAWG;IACH,4BAFa,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAC,SAAS,CAKzC;IAgQD;;;;;;;;;;OAUG;IACH,uEAHa,GAAC,CA+Bb;IAED;;;;OAIG;IACH,qBAHa,WAAS,MAAM,GAAC,IAAI,CAKhC;IAiJD;;;;;;;;;;;OAWG;IACH,sBA0CC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,mBAwDC;IAED;;;;;;;;;OASG;IACH,qBAsDC;IAED;;;;OAIG;IACH,uBA4GC;IAED;;;;;;;;;OASG;IACH,qBAEC;IAED;;;;;;;;;OASG;IACH,sBAiBC;IAED;;;;;;;OAOG;IACH,6BAGC;IAED;;;;;;;;;;OAUG;IACH,6BAuiBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BAiQC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BA43BC;IAED;;;;;;OAMG;IACH,uCA2zDC;;CACD;8BAj1K6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"unified-wrapper.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/unified-wrapper.mjs"],"names":[],"mappings":"AAu7BA;;;;;;;;;;;;;;;;;;GAkBG;AACH,4CAhBW,MAAM,GAAC,MAAM,GACX,OAAO,CAkBnB;AAokJD;;;;;;;;;;;GAWG;AACH,sCAPW,OAAO,GACL,cAAc,GAAC,IAAI,CAkB/B;AA7nJD;;;;;;;;GAQG;AACH,iCAHU,GAAG,CAAC,MAAM,CAAC,CAG2F;;;;;AAqNhH;;;;;;;;;;GAUG;AACH;IA8UC;;;;;;;;;;;;;;;;OAgBG;IACH,0BAsCC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,gCAiEC;IAhcD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,sBApCW,MAAM,mKAEd;QAAwB,IAAI,EAApB,MAAM;QACU,OAAO,EAAvB,MAAM;QACyB,WAAW;QACvB,eAAe;QAChB,UAAU;QACV,mBAAmB;QACpB,QAAQ;QACD,UAAU;QAGjB,QAAQ;QACR,YAAY;QACE,cAAc;QAI3B,eAAe;KAMzC,EAsOF;IAhRD;;;;;;;;;;;OAWG;IACH,4BAFa,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAC,SAAS,CAKzC;IAmQD;;;;;;;;;;OAUG;IACH,uEAHa,GAAC,CA+Bb;IAED;;;;OAIG;IACH,qBAHa,WAAS,MAAM,GAAC,IAAI,CAKhC;IAiJD;;;;;;;;;;;OAWG;IACH,sBA0CC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,mBAwDC;IAED;;;;;;;;;OASG;IACH,qBAsDC;IAED;;;;OAIG;IACH,uBA4GC;IAED;;;;;;;;;OASG;IACH,qBAEC;IAED;;;;;;;;;OASG;IACH,sBAiBC;IAED;;;;;;;OAOG;IACH,6BAGC;IAED;;;;;;;;;;OAUG;IACH,6BAuiBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BAiQC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BA83BC;IAED;;;;;;OAMG;IACH,uCA6zDC;;CACD;8BAt+K6B,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/slothlet.d.mts b/types/src/slothlet.d.mts
index 2af030f29..a252f8db2 100644
--- a/types/src/slothlet.d.mts
+++ b/types/src/slothlet.d.mts
@@ -197,7 +197,7 @@ export type SlothletOptions = {
      */
     diagnostics?: boolean | undefined;
     /**
-     * - Construction-time lifecycle subscribers, registered on the lifecycle emitter BEFORE the api builds so events emitted during cold-start `buildAPI` (init-time `impl:warning` / `impl:created` / …) are observable. Maps an event name to a handler `function(data, token)` or an array of them; any event name is accepted. Because they are ordinary subscribers, they also receive runtime events afterward — equivalent to calling `api.slothlet.lifecycle.on(event, fn)` for each, but early enough to catch initialization diagnostics. Example: `{ "impl:warning": (d) => log(d), "impl:error": [onError, audit] }`.
+     * - Construction-time lifecycle subscribers, registered on the lifecycle emitter BEFORE the api builds so events emitted during cold-start `buildAPI` (init-time `impl:warning` / `impl:created` / …) are observable. Maps an event name to a handler `function(data, token)` or an array of them; any event name is accepted. Because they are ordinary subscribers, they also receive runtime events afterward — equivalent to calling `api.slothlet.lifecycle.on(event, fn)` for each, but early enough to catch initialization diagnostics. Because they come from the config, `api.slothlet.restart()` subscribes them again on the new instance, so they also receive the new instance's `init` and `restarted` events (runtime `lifecycle.on` subscribers are dropped with the old instance). Example: `{ "impl:warning": (d) => log(d), "impl:error": [onError, audit] }`.
      */
     lifecycle?: {
         [x: string]: Function | Function[];
@@ -485,6 +485,7 @@ export type SlothletAPI = {
         bind: Function;
         reference?: object | undefined;
         reload: Function;
+        restart: Function;
         run: Function;
         scope: Function;
         shutdown: () => Promise<void>;
diff --git a/types/src/slothlet.d.mts.map b/types/src/slothlet.d.mts.map
index 45bab9426..1e8164086 100644
--- a/types/src/slothlet.d.mts.map
+++ b/types/src/slothlet.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"slothlet.d.mts","sourceRoot":"","sources":["../../src/slothlet.mjs"],"names":[],"mappings":"AA88CA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,yBApCuB,CAAC,SAAX,MAAQ,6DAGV,eAAe,GACb,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,CAsCpC;;kBASS,QAAQ,CAAC;QAAC,QAAQ,EAAE,aAAa,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAC,CAAC,CAAC;QAAC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;KAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAgD3F,SAAS,GAAC,MAAM;;;;;;;;;;;;qBAEP,MAAM;iBAAO,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA8BhB,MAAM;eAAS,CAAC,QAAQ,GAAC,SAAS,GAAC,UAAU,GAAC,SAAS,CAAC;oBAAc,OAAO;gBAAU,CAAC,OAAO,GAAC,OAAO,CAAC;kBAAY,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAevI,KAAK,CAAC;YAAC,IAAI,EAAC,MAAM,CAAC;YAAA,IAAI,EAAC,MAAM,CAAC;YAAA,QAAQ,EAAC,MAAM,CAAA;SAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aA8BxD,MAAY,IAAI;;;;cAChB,MAAY,IAAI;;;;cAE3B;QAAgE,GAAG,EAAxD,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAC,SAAS,CAAC,CAAC;QACzB,GAAG,EAC/B;YAAkC,GAAG;YACH,MAAM;YACN,MAAM;YACN,MAAM;YACR,OAAO,EACvC;gBAA0C,QAAQ;gBACR,IAAI;gBACJ,SAAS;gBACT,UAAU;gBACV,YAAY;gBACZ,aAAa;gBACb,iBAAiB;gBACjB,mBAAmB;gBACnB,cAAc;aACxD;SAAA;QAA4B,OAAO,EACnC;YAAsC,GAAG;YACO,OAAO,EAA5C,MAAY,MAAM;YACS,GAAG;YACH,KAAK;YACL,GAAG;SACzC;QAA6B,IAAI;;;;;;;;6BAEV,MAAM;;;;yCACN,MAAM,EAAE;;;;;;;;;;;;;;;;;4BAIR,MAAM;;;;kCACN,MAAM;;;;;;;;6BAEN,MAAM;;;;;;;;;;;;;;;;;qCAIN,eAAe;;QACV,IAAI,EAChC;YAAmC,KAAK;YACL,OAAO;YACP,cAAc;YACd,MAAM;YACN,aAAa;YACb,IAAI;YACJ,GAAG;YACH,EAAE;YACJ,GAAG,EACpC;gBAAsC,OAAO,EAAlC,OAAO;gBACqB,MAAM;gBACN,OAAO;aAC9C;YAAmC,MAAM;YACN,kBAAkB;SACrD;QAA4B,KAAK,EACjC;YAAoC,EAAE;YACF,IAAI;YACJ,GAAG;YACH,IAAI;YACJ,YAAY;YACd,KAAK,EACvC;gBAA0C,GAAG;gBACH,MAAM;aAChD;YAAoC,QAAQ;YACR,OAAO;SAC3C;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,EAAE;SAC1C;QAA4B,WAAW,EACvC;YAAoD,GAAG,EAA5C,MAAY,MAAM;YACY,YAAY,EAA1C,OAAO;YAC0C,IAAI,EAArD,MAAY,OAAO,CAAE,IAAI,CAAC;SACrC;QAA4B,QAAQ,EACpC;YAAsD,MAAM,EAAjD,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,MAAM;YACN,SAAS;YACM,IAAI,EAA/C,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,SAAS;SAChD;QAA4B,KAAK,EACjC;YAAoC,GAAG;SACvC;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,UAAU;SAClD;QAA4B,WAAW,EACvC;YAAwC,OAAO,EAC/C;gBAAiD,OAAO,EAA7C,OAAO;gBACwC,MAAM,EAArD,MAAY,IAAI;gBAC+B,OAAO,EAAtD,MAAY,IAAI;gBACsB,iBAAiB,EAAvD,OAAO;gBAC+C,UAAU,EAAhE,CAAS,IAAO,EAAP,OAAO,KAAG,IAAI;gBACwB,IAAI,EAAnD,MAAY,IAAI;gBACsB,MAAM,EAA5C,OAAO;aAClB;SAAA;QAA4B,UAAU,EACtC;YAAyC,IAAI;YACJ,UAAU;YACV,UAAU;YACV,kBAAkB;YAClB,kBAAkB;SAC3D;QAA8B,UAAU;QACV,IAAI;QACL,SAAS;QACR,MAAM;QACN,GAAG;QACH,KAAK;QACa,QAAQ,EAA7C,MAAY,OAAO,CAAE,IAAI,CAAC;KACvC;;gCAxpD6D,wBAAwB"}
\ No newline at end of file
+{"version":3,"file":"slothlet.d.mts","sourceRoot":"","sources":["../../src/slothlet.mjs"],"names":[],"mappings":"AAmtDA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,yBApCuB,CAAC,SAAX,MAAQ,6DAGV,eAAe,GACb,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,CAwCpC;;kBASS,QAAQ,CAAC;QAAC,QAAQ,EAAE,aAAa,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAC,CAAC,CAAC;QAAC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;KAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAgD3F,SAAS,GAAC,MAAM;;;;;;;;;;;;qBAEP,MAAM;iBAAO,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA8BhB,MAAM;eAAS,CAAC,QAAQ,GAAC,SAAS,GAAC,UAAU,GAAC,SAAS,CAAC;oBAAc,OAAO;gBAAU,CAAC,OAAO,GAAC,OAAO,CAAC;kBAAY,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAevI,KAAK,CAAC;YAAC,IAAI,EAAC,MAAM,CAAC;YAAA,IAAI,EAAC,MAAM,CAAC;YAAA,QAAQ,EAAC,MAAM,CAAA;SAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aA8BxD,MAAY,IAAI;;;;cAChB,MAAY,IAAI;;;;cAE3B;QAAgE,GAAG,EAAxD,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAC,SAAS,CAAC,CAAC;QACzB,GAAG,EAC/B;YAAkC,GAAG;YACH,MAAM;YACN,MAAM;YACN,MAAM;YACR,OAAO,EACvC;gBAA0C,QAAQ;gBACR,IAAI;gBACJ,SAAS;gBACT,UAAU;gBACV,YAAY;gBACZ,aAAa;gBACb,iBAAiB;gBACjB,mBAAmB;gBACnB,cAAc;aACxD;SAAA;QAA4B,OAAO,EACnC;YAAsC,GAAG;YACO,OAAO,EAA5C,MAAY,MAAM;YACS,GAAG;YACH,KAAK;YACL,GAAG;SACzC;QAA6B,IAAI;;;;;;;;6BAEV,MAAM;;;;yCACN,MAAM,EAAE;;;;;;;;;;;;;;;;;4BAIR,MAAM;;;;kCACN,MAAM;;;;;;;;6BAEN,MAAM;;;;;;;;;;;;;;;;;qCAIN,eAAe;;QACV,IAAI,EAChC;YAAmC,KAAK;YACL,OAAO;YACP,cAAc;YACd,MAAM;YACN,aAAa;YACb,IAAI;YACJ,GAAG;YACH,EAAE;YACJ,GAAG,EACpC;gBAAsC,OAAO,EAAlC,OAAO;gBACqB,MAAM;gBACN,OAAO;aAC9C;YAAmC,MAAM;YACN,kBAAkB;SACrD;QAA4B,KAAK,EACjC;YAAoC,EAAE;YACF,IAAI;YACJ,GAAG;YACH,IAAI;YACJ,YAAY;YACd,KAAK,EACvC;gBAA0C,GAAG;gBACH,MAAM;aAChD;YAAoC,QAAQ;YACR,OAAO;SAC3C;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,EAAE;SAC1C;QAA4B,WAAW,EACvC;YAAoD,GAAG,EAA5C,MAAY,MAAM;YACY,YAAY,EAA1C,OAAO;YAC0C,IAAI,EAArD,MAAY,OAAO,CAAE,IAAI,CAAC;SACrC;QAA4B,QAAQ,EACpC;YAAsD,MAAM,EAAjD,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,MAAM;YACN,SAAS;YACM,IAAI,EAA/C,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,SAAS;SAChD;QAA4B,KAAK,EACjC;YAAoC,GAAG;SACvC;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,UAAU;SAClD;QAA4B,WAAW,EACvC;YAAwC,OAAO,EAC/C;gBAAiD,OAAO,EAA7C,OAAO;gBACwC,MAAM,EAArD,MAAY,IAAI;gBAC+B,OAAO,EAAtD,MAAY,IAAI;gBACsB,iBAAiB,EAAvD,OAAO;gBAC+C,UAAU,EAAhE,CAAS,IAAO,EAAP,OAAO,KAAG,IAAI;gBACwB,IAAI,EAAnD,MAAY,IAAI;gBACsB,MAAM,EAA5C,OAAO;aAClB;SAAA;QAA4B,UAAU,EACtC;YAAyC,IAAI;YACJ,UAAU;YACV,UAAU;YACV,kBAAkB;YAClB,kBAAkB;SAC3D;QAA8B,UAAU;QACV,IAAI;QACL,SAAS;QACR,MAAM;QACN,OAAO;QACP,GAAG;QACH,KAAK;QACa,QAAQ,EAA7C,MAAY,OAAO,CAAE,IAAI,CAAC;KACvC;;gCAh6D6D,wBAAwB"}
\ No newline at end of file

From f6b235a7408bf4b2ec9d9d63544884820ea6fb19 Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Fri, 2 Oct 2026 10:17:45 -0700
Subject: [PATCH 41/49] fix(reload): keep a replace/forceOverwrite add's
 outcome across a scoped reload

After add("launcher.session", dir, { moduleID: "shadow", forceOverwrite:
true }), reload("launcher") rebuilt launcher's whole mount, putting
launcher's members that the overwrite had shadowed back under
launcher.session while ownership still named shadow.

The reload now finds the endpoints other modules were added at under
"replace" (forceOverwrite included) and still own, by the ownership
record's owner there as it stood before the rebuild (by add order when
ownership tracking is off), and keeps those subtrees exactly as the add
left them: the reloaded module's content inside them stays shadowed. A
child of the reloaded module with another module mounted inside it is
rebuilt level by level, so that module's leaves stay too. The members
the overwrite shadowed are refreshed with the reloaded code, so removing
the overwriting module later restores the module's current code.

Fixes #530
---
 .../api_test_reload_force_launcher/boot.mjs   |  25 ++
 .../session/close.mjs                         |  25 ++
 .../session/create.mjs                        |  25 ++
 .../api_test_reload_force_launcher/status.mjs |  25 ++
 .../api_test_reload_force_shadow/create.mjs   |  25 ++
 .../api_test_reload_force_shadow/peek.mjs     |  25 ++
 src/lib/handlers/api-manager.mjs              | 142 ++++++++++-
 ...api-reload-force-overwrite.test.vitest.mjs | 232 ++++++++++++++++++
 types/src/lib/handlers/api-manager.d.mts      |  38 +++
 types/src/lib/handlers/api-manager.d.mts.map  |   2 +-
 10 files changed, 554 insertions(+), 10 deletions(-)
 create mode 100644 api_tests/api_test_reload_force_launcher/boot.mjs
 create mode 100644 api_tests/api_test_reload_force_launcher/session/close.mjs
 create mode 100644 api_tests/api_test_reload_force_launcher/session/create.mjs
 create mode 100644 api_tests/api_test_reload_force_launcher/status.mjs
 create mode 100644 api_tests/api_test_reload_force_shadow/create.mjs
 create mode 100644 api_tests/api_test_reload_force_shadow/peek.mjs
 create mode 100644 tests/vitests/suites/addapi/addapi-reload-force-overwrite.test.vitest.mjs

diff --git a/api_tests/api_test_reload_force_launcher/boot.mjs b/api_tests/api_test_reload_force_launcher/boot.mjs
new file mode 100644
index 000000000..519a5c710
--- /dev/null
+++ b/api_tests/api_test_reload_force_launcher/boot.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_reload_force_launcher/boot.mjs
+ *	@Date: 2026-09-29 02:01:58 -07:00 (1790672518)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-29 02:09:53 -07:00 (1790672993)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf of the module a later add overwrites part of (#530).
+ * @module api_test_reload_force_launcher.boot
+ */
+
+/**
+ * @function boot
+ * @returns {string} `"launcher:boot"`.
+ */
+export function boot() {
+	return "launcher:boot";
+}
diff --git a/api_tests/api_test_reload_force_launcher/session/close.mjs b/api_tests/api_test_reload_force_launcher/session/close.mjs
new file mode 100644
index 000000000..3d7db90f9
--- /dev/null
+++ b/api_tests/api_test_reload_force_launcher/session/close.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_reload_force_launcher/session/close.mjs
+ *	@Date: 2026-09-29 02:01:58 -07:00 (1790672518)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-29 02:09:53 -07:00 (1790672993)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf only the overwritten module provides, shadowed by the overwrite (#530).
+ * @module api_test_reload_force_launcher.session.close
+ */
+
+/**
+ * @function close
+ * @returns {string} `"launcher:close"`.
+ */
+export function close() {
+	return "launcher:close";
+}
diff --git a/api_tests/api_test_reload_force_launcher/session/create.mjs b/api_tests/api_test_reload_force_launcher/session/create.mjs
new file mode 100644
index 000000000..459538f9d
--- /dev/null
+++ b/api_tests/api_test_reload_force_launcher/session/create.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_reload_force_launcher/session/create.mjs
+ *	@Date: 2026-09-29 02:01:58 -07:00 (1790672518)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-29 02:09:53 -07:00 (1790672993)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf the overwriting module also provides (#530).
+ * @module api_test_reload_force_launcher.session.create
+ */
+
+/**
+ * @function create
+ * @returns {string} `"launcher:create"`.
+ */
+export function create() {
+	return "launcher:create";
+}
diff --git a/api_tests/api_test_reload_force_launcher/status.mjs b/api_tests/api_test_reload_force_launcher/status.mjs
new file mode 100644
index 000000000..021366b08
--- /dev/null
+++ b/api_tests/api_test_reload_force_launcher/status.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_reload_force_launcher/status.mjs
+ *	@Date: 2026-09-29 02:01:58 -07:00 (1790672518)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-29 02:09:54 -07:00 (1790672994)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf of the module a later add overwrites part of (#530).
+ * @module api_test_reload_force_launcher.status
+ */
+
+/**
+ * @function status
+ * @returns {string} `"launcher:status"`.
+ */
+export function status() {
+	return "launcher:status";
+}
diff --git a/api_tests/api_test_reload_force_shadow/create.mjs b/api_tests/api_test_reload_force_shadow/create.mjs
new file mode 100644
index 000000000..554a3fa3a
--- /dev/null
+++ b/api_tests/api_test_reload_force_shadow/create.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_reload_force_shadow/create.mjs
+ *	@Date: 2026-09-29 02:01:58 -07:00 (1790672518)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-29 02:09:54 -07:00 (1790672994)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf that overwrites the first module's at the same path (#530).
+ * @module api_test_reload_force_shadow.create
+ */
+
+/**
+ * @function create
+ * @returns {string} `"shadow:create"`.
+ */
+export function create() {
+	return "shadow:create";
+}
diff --git a/api_tests/api_test_reload_force_shadow/peek.mjs b/api_tests/api_test_reload_force_shadow/peek.mjs
new file mode 100644
index 000000000..1e01bf5bb
--- /dev/null
+++ b/api_tests/api_test_reload_force_shadow/peek.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_reload_force_shadow/peek.mjs
+ *	@Date: 2026-09-29 02:01:58 -07:00 (1790672518)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-29 02:09:54 -07:00 (1790672994)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf only the overwriting module provides (#530).
+ * @module api_test_reload_force_shadow.peek
+ */
+
+/**
+ * @function peek
+ * @returns {string} `"shadow:peek"`.
+ */
+export function peek() {
+	return "shadow:peek";
+}
diff --git a/src/lib/handlers/api-manager.mjs b/src/lib/handlers/api-manager.mjs
index 7beb6e7a3..67497977c 100644
--- a/src/lib/handlers/api-manager.mjs
+++ b/src/lib/handlers/api-manager.mjs
@@ -3747,6 +3747,8 @@ export class ApiManager extends ComponentBase {
 		const cycle = reloadGroup ?? new Set([moduleID]);
 		const ownership = this.slothlet.handlers.ownership;
 		const ownershipBefore = ownership?.snapshotStacks(oldEntry.endpoint) ?? null;
+		// Where other modules are mounted, and which of those mounts replaced what was there (#530).
+		const placement = this._foreignPlacement(cycle, ownershipBefore);
 
 		const freshApi = await cacheManager.rebuildCache(moduleID);
 
@@ -3771,7 +3773,8 @@ export class ApiManager extends ComponentBase {
 		await this._restoreApiTree(freshApi, oldEntry.endpoint, moduleID, oldEntry.collisionMode, forceReplace, {
 			reloadGroup: cycle,
 			previousApi: oldEntry.api,
-			ownershipBefore
+			ownershipBefore,
+			placement
 		});
 
 		// DEBUG: Check if freshApi was mutated
@@ -3790,6 +3793,9 @@ export class ApiManager extends ComponentBase {
 		});
 
 		if (ownershipBefore) ownership.restoreStacks(ownershipBefore, cycle);
+		// A later remove of a module that replaced part of this one re-attaches this module's members it
+		// shadowed: give them this reload's code, not the code from before it (#530).
+		await this._refreshReplaceShadows(moduleID, oldEntry.endpoint, freshApi);
 
 		// Principals (#459) this module owns: values resolved by the pre-reload code are stale now.
 		this.slothlet.handlers.permissionManager?.onModuleReloaded?.(moduleID);
@@ -4127,11 +4133,22 @@ export class ApiManager extends ComponentBase {
 	 * @param {*} scope.previousApi - The module's contribution at this level before the reload.
 	 * @param {?Map<string, Array<{entry: Object, isMergeLoss: boolean}>>} scope.ownershipBefore - Ownership
 	 *   stacks from before the rebuild (null when ownership tracking is off).
+	 * @param {{ held: Set<string>, mounts: string[] }} [scope.placement] - Other modules' mounts, and the ones that replaced what was there
+	 *   (from `_foreignPlacement`).
 	 * @returns {Promise<void>}
 	 * @private
 	 */
-	async _applyScopedImpl(wrapper, apiPath, implForReload, moduleID, { forceReplace, reloadGroup, previousApi, ownershipBefore }) {
-		const split = forceReplace ? this._partitionNamespaceChildren(wrapper, apiPath, reloadGroup, ownershipBefore) : null;
+	async _applyScopedImpl(
+		wrapper,
+		apiPath,
+		implForReload,
+		moduleID,
+		{ forceReplace, reloadGroup, previousApi, ownershipBefore, placement }
+	) {
+		// Another module replaced this whole namespace (forceOverwrite / a "replace" add) and still holds it:
+		// the reloaded module's content here stays shadowed, exactly as that add left it (#530).
+		if (placement?.held.has(apiPath)) return;
+		const split = forceReplace ? this._partitionNamespaceChildren(wrapper, apiPath, reloadGroup, ownershipBefore, placement) : null;
 		const freshContribution = implForReload;
 		// A callable impl keeps its own properties and is applied as built; an object impl drops the
 		// keys set aside (implForReload is never null here — the caller checked the build).
@@ -4185,7 +4202,8 @@ export class ApiManager extends ComponentBase {
 					forceReplace: true,
 					reloadGroup,
 					previousApi: previousChild,
-					ownershipBefore
+					ownershipBefore,
+					placement
 				});
 			} finally {
 				child.____slothletInternal.state.collisionMode = originalCollisionMode;
@@ -4215,6 +4233,97 @@ export class ApiManager extends ComponentBase {
 		return children;
 	}
 
+	/**
+	 * Where modules outside a reload cycle are mounted, and which of those mounts replaced what was
+	 * there and still hold it (#530).
+	 * @param {Set<string>} reloadGroup - moduleIDs rebuilt in this reload cycle.
+	 * @param {?Map<string, Array<{entry: Object, isMergeLoss: boolean}>>} ownershipBefore - Ownership stacks
+	 *   from before the rebuild (null when ownership tracking is off).
+	 * @returns {{ held: Set<string>, mounts: string[] }} `mounts`: every other module's endpoint.
+	 *   `held`: the endpoints another module was added at under "replace" (forceOverwrite included) and
+	 *   still owns.
+	 * @private
+	 *
+	 * @description
+	 * A "replace" add swaps the whole subtree at its endpoint: the incoming module's content is what is
+	 * live there and the overwritten module's members under it are shadowed off the surface. A reload
+	 * of the overwritten module must leave that outcome alone. Whether the overwriting module still
+	 * holds its endpoint is read from the ownership record's owner there (as it stood before the
+	 * rebuild); with ownership tracking off, from add order — no later "replace" add from the cycle
+	 * covering it.
+	 */
+	_foreignPlacement(reloadGroup, ownershipBefore) {
+		const ownership = this.slothlet.handlers.ownership;
+		const cacheManager = this.slothlet.handlers.apiCacheManager;
+		const addOrder = (id) => this.state.addHistory.findIndex((entry) => entry.moduleID === id);
+		const covers = (outer, inner) => outer === "." || inner === outer || inner.startsWith(`${outer}.`);
+		const held = new Set();
+		const mounts = [];
+		for (const id of cacheManager.getAllModuleIDs()) {
+			if (reloadGroup.has(id)) continue;
+			const entry = cacheManager.get(id);
+			mounts.push(entry.endpoint);
+			if (entry.collisionMode !== "replace") continue;
+			if (ownership) {
+				const prior = ownershipBefore?.get(entry.endpoint);
+				const owner = prior ? ownership.snapshotOwner(prior) : ownership.getCurrentOwner(entry.endpoint)?.moduleID;
+				if (owner === id) held.add(entry.endpoint);
+				continue;
+			}
+			const retaken = [...reloadGroup].some((groupID) => {
+				const groupEntry = cacheManager.get(groupID);
+				return groupEntry?.collisionMode === "replace" && covers(groupEntry.endpoint, entry.endpoint) && addOrder(groupID) > addOrder(id);
+			});
+			if (!retaken) held.add(entry.endpoint);
+		}
+		return { held, mounts };
+	}
+
+	/**
+	 * Give the members a "replace" add shadowed off a module's mount this reload's code, so removing the
+	 * overwriting module later re-attaches the module's current code rather than its code from before
+	 * the reload (#530). A shadowed member the rebuilt module no longer exports is dropped.
+	 * @param {string} moduleID - The reloaded module.
+	 * @param {string} endpoint - Its mount path.
+	 * @param {*} freshApi - Its rebuilt api.
+	 * @returns {Promise<void>}
+	 * @private
+	 */
+	async _refreshReplaceShadows(moduleID, endpoint, freshApi) {
+		for (const [overwriter, shadows] of this.state.replaceShadows) {
+			const kept = [];
+			for (const shadow of shadows) {
+				const containerPath = shadow.container.____slothletInternal.apiPath;
+				const shadowPath = `${containerPath}.${shadow.key}`;
+				const inMount = endpoint === "." || shadowPath.startsWith(`${endpoint}.`);
+				if (shadow.ownerModuleID !== moduleID || !inMount) {
+					kept.push(shadow);
+					continue;
+				}
+				// Find the rebuilt value at the shadowed member's path, relative to the mount.
+				let fresh = freshApi;
+				for (const part of (endpoint === "." ? shadowPath : shadowPath.slice(endpoint.length + 1)).split(".")) {
+					const node = await this._namespaceImplOf(fresh);
+					fresh = node === null || node === undefined ? undefined : node[part];
+					if (fresh === undefined) break;
+				}
+				if (fresh === undefined) continue;
+				const child = resolveWrapper(shadow.child);
+				const freshWrapper = resolveWrapper(fresh);
+				if (freshWrapper?.____slothletInternal.mode === "lazy" && !freshWrapper.____slothletInternal.state.materialized) {
+					child.___resetLazy(freshWrapper.____slothletInternal.materializeFunc);
+				} else {
+					const originalCollisionMode = child.____slothletInternal.state.collisionMode;
+					child.____slothletInternal.state.collisionMode = "replace";
+					child.___setImpl(freshWrapper ? UnifiedWrapper._extractFullImpl(freshWrapper) : fresh, moduleID, false, true);
+					child.____slothletInternal.state.collisionMode = originalCollisionMode;
+				}
+				kept.push(shadow);
+			}
+			this.state.replaceShadows.set(overwriter, kept);
+		}
+	}
+
 	/**
 	 * Split a namespace's children by who contributes them, for a forced replace that rebuilds only
 	 * the modules in `reloadGroup`, and set aside every child the replace must not rebuild (#525).
@@ -4227,12 +4336,15 @@ export class ApiManager extends ComponentBase {
 	 * @param {Set<string>} reloadGroup - moduleIDs being rebuilt at this endpoint in this cycle.
 	 * @param {?Map<string, Array<{entry: Object, isMergeLoss: boolean}>>} ownershipBefore - Ownership stacks
 	 *   from before the rebuild.
+	 * @param {{ held: Set<string>, mounts: string[] }} [placement] - Other modules' mounts, and the ones that replaced what was there. A
+	 *   child another module replaced is kept whole; a child with another module mounted inside it is
+	 *   rebuilt level by level (#530).
 	 * @returns {{ foreign: Map<string, PropertyDescriptor>, shared: Map<string, PropertyDescriptor>, keyOrder: string[] }}
 	 *   Children only other modules contribute (`foreign`), subfolders both sides contribute to
 	 *   (`shared`), and the namespace's key order before they were set aside.
 	 * @private
 	 */
-	_partitionNamespaceChildren(wrapper, apiPath, reloadGroup, ownershipBefore) {
+	_partitionNamespaceChildren(wrapper, apiPath, reloadGroup, ownershipBefore, placement) {
 		const foreign = new Map();
 		const shared = new Map();
 		const ownership = this.slothlet.handlers.ownership;
@@ -4244,6 +4356,12 @@ export class ApiManager extends ComponentBase {
 			const child = resolveWrapper(descriptor.value);
 			if (!child || child.____slothletInternal.userAssigned) continue;
 			const childPath = `${apiPath}.${key}`;
+			if (placement?.held.has(childPath)) {
+				// Another module replaced this child and still holds it: keep its content as that add left it.
+				foreign.set(key, descriptor);
+				Reflect.deleteProperty(wrapper, key);
+				continue;
+			}
 			const prior = ownershipBefore?.get(childPath);
 			const history = prior ? prior.map(({ entry }) => entry) : (ownership?.getPathHistory(childPath) ?? []);
 			const contributors =
@@ -4252,8 +4370,11 @@ export class ApiManager extends ComponentBase {
 					: ownership
 						? [child.____slothletInternal.moduleID]
 						: this._subtreeModuleIDs(child);
-			if (contributors.every((id) => reloadGroup.has(id))) continue;
-			if (contributors.some((id) => reloadGroup.has(id))) {
+			// Another module mounted somewhere inside this child contributes to it too, whatever the
+			// child's own ownership stack records (a mount registers its own path and below, not its parents).
+			const hostsForeignMount = placement?.mounts.some((mount) => mount.startsWith(`${childPath}.`)) ?? false;
+			if (!hostsForeignMount && contributors.every((id) => reloadGroup.has(id))) continue;
+			if (hostsForeignMount || contributors.some((id) => reloadGroup.has(id))) {
 				// Both sides contribute here. A namespace holds children from each, so it is rebuilt level by
 				// level; a leaf has one live value, which the cycle rebuilds only when it currently owns it.
 				const internal = child.____slothletInternal;
@@ -4345,6 +4466,8 @@ export class ApiManager extends ComponentBase {
 	 *   whether a callable namespace's function came from this module or from a co-mounted one.
 	 * @param {?Map<string, Array<{entry: Object, isMergeLoss: boolean}>>} [scope.ownershipBefore=null] -
 	 *   Ownership stacks from before the rebuild, which decide what the reload keeps.
+	 * @param {{ held: Set<string>, mounts: string[] }} [scope.placement=null] - Other modules' mounts, and the ones that replaced what was
+	 *   there (#530).
 	 * @returns {Promise<void>}
 	 * @private
 	 */
@@ -4354,7 +4477,7 @@ export class ApiManager extends ComponentBase {
 		moduleID,
 		collisionMode,
 		forceReplace = true,
-		{ reloadGroup = new Set([moduleID]), previousApi = null, ownershipBefore = null } = {}
+		{ reloadGroup = new Set([moduleID]), previousApi = null, ownershipBefore = null, placement = null } = {}
 	) {
 		// Defensive: _restoreApiTree is always called with a valid freshApi object produced
 		// by buildAPI. A null/primitive freshApi would indicate a build failure handled elsewhere.
@@ -4586,7 +4709,8 @@ export class ApiManager extends ComponentBase {
 					forceReplace,
 					reloadGroup,
 					previousApi,
-					ownershipBefore
+					ownershipBefore,
+					placement
 				});
 
 				// Restore original collision mode
diff --git a/tests/vitests/suites/addapi/addapi-reload-force-overwrite.test.vitest.mjs b/tests/vitests/suites/addapi/addapi-reload-force-overwrite.test.vitest.mjs
new file mode 100644
index 000000000..f18846fd7
--- /dev/null
+++ b/tests/vitests/suites/addapi/addapi-reload-force-overwrite.test.vitest.mjs
@@ -0,0 +1,232 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/addapi/addapi-reload-force-overwrite.test.vitest.mjs
+ *	@Date: 2026-09-29 02:02:27 -07:00 (1790672547)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-09-29 02:14:01 -07:00 (1790673241)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Scoped reload respects a forceOverwrite add's collision outcome (#530).
+ *
+ * @description
+ * `launcher` is added at `launcher`; `shadow` is then added at `launcher.session` with
+ * `forceOverwrite: true`, replacing that subtree: `shadow`'s `create` and `peek` are live there and
+ * `launcher`'s own `session.close` is shadowed off the surface. `api.slothlet.api.reload("launcher")`
+ * must rebuild only `launcher`'s own contribution: `launcher.session` keeps `shadow`'s code and
+ * ownership and `launcher.session.close` stays shadowed, while `launcher`'s leaves outside the
+ * overwritten subtree pick up their new code. Removing `shadow` afterwards reverts
+ * `launcher.session` to `launcher`'s current code. The same holds when the overwrite covers the
+ * reloaded module's whole mount. A module mounted (without an overwrite) inside one of the reloaded
+ * module's own subfolders keeps its leaves too.
+ *
+ * Runs across the full matrix (eager/lazy × async/live × hooks on/off).
+ *
+ * @module tests/vitests/suites/addapi/addapi-reload-force-overwrite
+ */
+
+process.env.SLOTHLET_INTERNAL_TEST_MODE = "true";
+
+import { describe, it, expect, afterEach, vi } from "vitest";
+import { cpSync, rmSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import slothlet from "@cldmv/slothlet";
+import { resolveWrapper } from "#handlers/unified-wrapper";
+import { getMatrixConfigs, TEST_DIRS } from "../../setup/vitest-helper.mjs";
+
+// Instance creation plus two adds can exceed the default hook/test timeout on a loaded machine.
+vi.setConfig({ hookTimeout: 60000, testTimeout: 60000 });
+
+const API_TESTS_ROOT = path.dirname(TEST_DIRS.API_TEST);
+const LAUNCHER_DIR = path.join(API_TESTS_ROOT, "api_test_reload_force_launcher");
+const SHADOW_DIR = path.join(API_TESTS_ROOT, "api_test_reload_force_shadow");
+const REVERT_A_DIR = path.join(API_TESTS_ROOT, "api_test_reload_revert_a");
+const REVERT_B_DIR = path.join(API_TESTS_ROOT, "api_test_reload_revert_b");
+
+/**
+ * Write a single-function leaf module.
+ * @param {string} file - File to write.
+ * @param {string} name - Exported function name.
+ * @param {string} value - Value the function returns.
+ * @returns {void}
+ */
+function writeLeaf(file, name, value) {
+	writeFileSync(file, `export function ${name}() {\n\treturn "${value}";\n}\n`);
+}
+
+/**
+ * Create an instance with every mutation enabled.
+ * @param {object} config - Matrix config.
+ * @returns {Promise<object>} Slothlet API proxy.
+ */
+function createInstance(config) {
+	return slothlet({ ...config, base: TEST_DIRS.API_TEST, api: { ...config.api, mutations: { add: true, remove: true, reload: true } } });
+}
+
+/**
+ * Ownership of every `launcher.session` path: each path's stack (moduleIDs, in order) and owner.
+ * @param {object} api - Slothlet API proxy.
+ * @returns {Record<string, {stack: string[], owner: (string|undefined)}>} Ownership by path.
+ */
+function sessionOwnership(api) {
+	const ownership = resolveWrapper(api.launcher).slothlet.handlers.ownership;
+	const result = {};
+	for (const apiPath of ["launcher.session", "launcher.session.create", "launcher.session.peek", "launcher.session.close"]) {
+		result[apiPath] = {
+			stack: ownership.getPathHistory(apiPath).map((entry) => entry.moduleID),
+			owner: ownership.getCurrentOwner(apiPath)?.moduleID
+		};
+	}
+	return result;
+}
+
+for (const { config, name } of getMatrixConfigs()) {
+	describe(`scoped reload respects a forceOverwrite add (#530) - ${name}`, () => {
+		let api;
+		let scratchDir = null;
+
+		afterEach(async () => {
+			if (api) await api.shutdown();
+			api = null;
+			if (scratchDir) rmSync(scratchDir, { recursive: true, force: true });
+			scratchDir = null;
+		});
+
+		/**
+		 * Mount `launcher`, then force-overwrite `launcher.session` with `shadow`.
+		 * @param {string} [launcherDir] - Folder to mount as `launcher`.
+		 * @returns {Promise<void>}
+		 */
+		async function mount(launcherDir = LAUNCHER_DIR) {
+			api = await createInstance(config);
+			await api.slothlet.api.add("launcher", launcherDir, { moduleID: "launcher" });
+			await api.slothlet.api.add("launcher.session", SHADOW_DIR, { moduleID: "shadow", forceOverwrite: true });
+			expect(await api.launcher.session.create()).toBe("shadow:create");
+			expect(await api.launcher.session.peek()).toBe("shadow:peek");
+			expect(api.launcher.session.close).toBeUndefined();
+		}
+
+		/**
+		 * Copy the `launcher` fixture into a scratch folder so a test can change it on disk.
+		 * @returns {string} The copy.
+		 */
+		function copyLauncher() {
+			scratchDir = path.join(process.cwd(), "tmp", `reload-force-530-${name.replace(/[^a-z0-9]+/gi, "-")}`);
+			rmSync(scratchDir, { recursive: true, force: true });
+			cpSync(LAUNCHER_DIR, scratchDir, { recursive: true });
+			return scratchDir;
+		}
+
+		it("reload('launcher') keeps shadow's code, shadowed members and ownership under launcher.session", async () => {
+			await mount();
+			const keysBefore = Object.keys(api.launcher.session);
+			const ownershipBefore = sessionOwnership(api);
+
+			await api.slothlet.api.reload("launcher");
+
+			expect(await api.launcher.session.create()).toBe("shadow:create");
+			expect(await api.launcher.session.peek()).toBe("shadow:peek");
+			expect(api.launcher.session.close).toBeUndefined();
+			expect(Object.keys(api.launcher.session)).toEqual(keysBefore);
+			expect(await api.launcher.status()).toBe("launcher:status");
+			expect(sessionOwnership(api)).toEqual(ownershipBefore);
+			expect(sessionOwnership(api)["launcher.session.create"].owner).toBe("shadow");
+		});
+
+		it("reload('launcher') picks up launcher's changes outside the overwritten subtree", async () => {
+			const launcherDir = copyLauncher();
+			await mount(launcherDir);
+
+			writeLeaf(path.join(launcherDir, "status.mjs"), "status", "launcher:status:v2");
+			writeLeaf(path.join(launcherDir, "session", "create.mjs"), "create", "launcher:create:v2");
+			await api.slothlet.api.reload("launcher");
+
+			expect(await api.launcher.status()).toBe("launcher:status:v2");
+			expect(await api.launcher.boot()).toBe("launcher:boot");
+			expect(await api.launcher.session.create()).toBe("shadow:create");
+		});
+
+		it("removing shadow after reload('launcher') reverts launcher.session to launcher's current code", async () => {
+			const launcherDir = copyLauncher();
+			await mount(launcherDir);
+
+			writeLeaf(path.join(launcherDir, "session", "create.mjs"), "create", "launcher:create:v2");
+			writeLeaf(path.join(launcherDir, "session", "close.mjs"), "close", "launcher:close:v2");
+			await api.slothlet.api.reload("launcher");
+			await api.slothlet.api.remove("shadow");
+
+			expect(await api.launcher.session.create()).toBe("launcher:create:v2");
+			expect(await api.launcher.session.close()).toBe("launcher:close:v2");
+			expect(api.launcher.session.peek).toBeUndefined();
+			expect(await api.launcher.status()).toBe("launcher:status");
+		});
+
+		it("reload('shadow') still rebuilds shadow and leaves launcher's own leaves alone", async () => {
+			await mount();
+			const statusBefore = api.launcher.status;
+
+			await api.slothlet.api.reload("shadow");
+
+			expect(await api.launcher.session.create()).toBe("shadow:create");
+			expect(await api.launcher.session.peek()).toBe("shadow:peek");
+			expect(api.launcher.session.close).toBeUndefined();
+			expect(api.launcher.status).toBe(statusBefore);
+		});
+
+		it("an overwrite of the reloaded module's whole mount keeps its outcome across the reload", async () => {
+			api = await createInstance(config);
+			await api.slothlet.api.add("leaf", REVERT_A_DIR, { moduleID: "A" });
+			await api.slothlet.api.add("leaf", REVERT_B_DIR, { moduleID: "B", forceOverwrite: true });
+			expect(api.leaf.am).toBeUndefined();
+
+			await api.slothlet.api.reload("A");
+
+			expect(await api.leaf.an()).toBe("B:an");
+			expect(await api.leaf.bx()).toBe("B:bx");
+			expect(api.leaf.am).toBeUndefined();
+
+			await api.slothlet.api.remove("B");
+
+			expect(await api.leaf.an()).toBe("A:an");
+			expect(await api.leaf.am()).toBe("A:am");
+			expect(api.leaf.bx).toBeUndefined();
+		});
+
+		it("a module mounted inside the reloaded module's own subfolder keeps its leaves", async () => {
+			api = await createInstance(config);
+			await api.slothlet.api.add("launcher", LAUNCHER_DIR, { moduleID: "launcher" });
+			await api.slothlet.api.add("launcher.session.extra", SHADOW_DIR, { moduleID: "shadow" });
+			const extraBefore = api.launcher.session.extra;
+
+			await api.slothlet.api.reload("launcher");
+
+			expect(api.launcher.session.extra).toBe(extraBefore);
+			expect(await api.launcher.session.extra.create()).toBe("shadow:create");
+			expect(await api.launcher.session.extra.peek()).toBe("shadow:peek");
+			expect(await api.launcher.session.create()).toBe("launcher:create");
+			expect(await api.launcher.session.close()).toBe("launcher:close");
+		});
+
+		it("keeps shadow's overwrite when ownership tracking is unavailable", async () => {
+			await mount();
+			const sl = resolveWrapper(api.launcher).slothlet;
+			const ownership = sl.handlers.ownership;
+			sl.handlers.ownership = null;
+			try {
+				await api.slothlet.api.reload("launcher");
+			} finally {
+				sl.handlers.ownership = ownership;
+			}
+
+			expect(await api.launcher.session.create()).toBe("shadow:create");
+			expect(await api.launcher.session.peek()).toBe("shadow:peek");
+			expect(api.launcher.session.close).toBeUndefined();
+			expect(await api.launcher.status()).toBe("launcher:status");
+		});
+	});
+}
diff --git a/types/src/lib/handlers/api-manager.d.mts b/types/src/lib/handlers/api-manager.d.mts
index 780deb1cf..f64d2aaae 100644
--- a/types/src/lib/handlers/api-manager.d.mts
+++ b/types/src/lib/handlers/api-manager.d.mts
@@ -559,6 +559,8 @@ export class ApiManager extends ComponentBase {
      * @param {*} scope.previousApi - The module's contribution at this level before the reload.
      * @param {?Map<string, Array<{entry: Object, isMergeLoss: boolean}>>} scope.ownershipBefore - Ownership
      *   stacks from before the rebuild (null when ownership tracking is off).
+     * @param {{ held: Set<string>, mounts: string[] }} [scope.placement] - Other modules' mounts, and the ones that replaced what was there
+     *   (from `_foreignPlacement`).
      * @returns {Promise<void>}
      * @private
      */
@@ -572,6 +574,37 @@ export class ApiManager extends ComponentBase {
      * @private
      */
     private _namespaceImplOf;
+    /**
+     * Where modules outside a reload cycle are mounted, and which of those mounts replaced what was
+     * there and still hold it (#530).
+     * @param {Set<string>} reloadGroup - moduleIDs rebuilt in this reload cycle.
+     * @param {?Map<string, Array<{entry: Object, isMergeLoss: boolean}>>} ownershipBefore - Ownership stacks
+     *   from before the rebuild (null when ownership tracking is off).
+     * @returns {{ held: Set<string>, mounts: string[] }} `mounts`: every other module's endpoint.
+     *   `held`: the endpoints another module was added at under "replace" (forceOverwrite included) and
+     *   still owns.
+     * @private
+     *
+     * @description
+     * A "replace" add swaps the whole subtree at its endpoint: the incoming module's content is what is
+     * live there and the overwritten module's members under it are shadowed off the surface. A reload
+     * of the overwritten module must leave that outcome alone. Whether the overwriting module still
+     * holds its endpoint is read from the ownership record's owner there (as it stood before the
+     * rebuild); with ownership tracking off, from add order — no later "replace" add from the cycle
+     * covering it.
+     */
+    private _foreignPlacement;
+    /**
+     * Give the members a "replace" add shadowed off a module's mount this reload's code, so removing the
+     * overwriting module later re-attaches the module's current code rather than its code from before
+     * the reload (#530). A shadowed member the rebuilt module no longer exports is dropped.
+     * @param {string} moduleID - The reloaded module.
+     * @param {string} endpoint - Its mount path.
+     * @param {*} freshApi - Its rebuilt api.
+     * @returns {Promise<void>}
+     * @private
+     */
+    private _refreshReplaceShadows;
     /**
      * Split a namespace's children by who contributes them, for a forced replace that rebuilds only
      * the modules in `reloadGroup`, and set aside every child the replace must not rebuild (#525).
@@ -584,6 +617,9 @@ export class ApiManager extends ComponentBase {
      * @param {Set<string>} reloadGroup - moduleIDs being rebuilt at this endpoint in this cycle.
      * @param {?Map<string, Array<{entry: Object, isMergeLoss: boolean}>>} ownershipBefore - Ownership stacks
      *   from before the rebuild.
+     * @param {{ held: Set<string>, mounts: string[] }} [placement] - Other modules' mounts, and the ones that replaced what was there. A
+     *   child another module replaced is kept whole; a child with another module mounted inside it is
+     *   rebuilt level by level (#530).
      * @returns {{ foreign: Map<string, PropertyDescriptor>, shared: Map<string, PropertyDescriptor>, keyOrder: string[] }}
      *   Children only other modules contribute (`foreign`), subfolders both sides contribute to
      *   (`shared`), and the namespace's key order before they were set aside.
@@ -630,6 +666,8 @@ export class ApiManager extends ComponentBase {
      *   whether a callable namespace's function came from this module or from a co-mounted one.
      * @param {?Map<string, Array<{entry: Object, isMergeLoss: boolean}>>} [scope.ownershipBefore=null] -
      *   Ownership stacks from before the rebuild, which decide what the reload keeps.
+     * @param {{ held: Set<string>, mounts: string[] }} [scope.placement=null] - Other modules' mounts, and the ones that replaced what was
+     *   there (#530).
      * @returns {Promise<void>}
      * @private
      */
diff --git a/types/src/lib/handlers/api-manager.d.mts.map b/types/src/lib/handlers/api-manager.d.mts.map
index 6028a66e1..294821e3f 100644
--- a/types/src/lib/handlers/api-manager.d.mts.map
+++ b/types/src/lib/handlers/api-manager.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"api-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/api-manager.mjs"],"names":[],"mappings":"AAgFA;;;;;;;;;;;;;;GAcG;AACH;IACC,gCAAuC;IAEvC;;;;;;;;;;;OAWG;IACH,sBAVW,MAAM,EAuBhB;IAXA,sIAAsI;IACtI,OADW;QAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,MAAM,GAAC,IAAI,CAAC;QAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;KAAE,CAUjI;IAGF;;;;;;;;;;;;;;;;;;OAkBG;IACH,yBA+GC;IAED;;;;;;;;;;;;;;OAcG;IACH,oBA4CC;IAED;;;;;;;;;;;;;;OAcG;IACH,0BA4BC;IAED;;;;;;;;;;;;OAYG;IACH,6BAIC;IAED;;;;;;;;;;;;OAYG;IACH,uBASC;IAED;;;;;;;;;;;;;OAaG;IACH,yBAkCC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,iCAbW,MAAM,SACN,OAAO,iBACP,MAAM,GAAC,IAAI,GACT,IAAI,CAqHhB;IAED;;;;;;;;;;;;;OAaG;IACH,uBAEC;IAED;;;;;;;;;;;;;;OAcG;IACH,oBAkWC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,8BAiCC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,sCAmBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,uBAyGC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,uBA6MC;IAED;;;;;;;;;;;;OAYG;IACH,mBAwHC;IACD;;;;;;;;;;;;OAYG;IACH,uBAsEC;IA6CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkDG;IACH,wBAhDG;QAAuB,OAAO,EAAtB,MAAM;QACmD,UAAU,EAAnE,MAAM,GAAC,MAAM,EAAE,cAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;QACf,OAAO;KAChD,GAAU,OAAO,CAAC,MAAM,GAAC,MAAM,EAAE,CAAC,CAs/BpC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,yEATG;QAAqB,QAAQ,EAArB,MAAM;QACO,aAAa,EAA1B,MAAM;QACO,cAAc,EAA3B,MAAM;KACd,GAAU,OAAO,CAAC,IAAI,CAAC,CAgDzB;IA8BD;;;;;;;;;;;OAWG;IACH,mCAeC;IAoHD;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,mCA1BW,MAAM,YAEd;QAAyB,aAAa;QAGZ,aAAa;KACvC,GAAU,OAAO,CAAC,OAAO,CAAC,CA0pB5B;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,2BAdG;QAAwB,OAAO,EAAtB,MAAM,OAAA;QACS,QAAQ,EAAvB,MAAM,OAAA;KACf,GAAU,OAAO,CAAC,IAAI,CAAC,CAuCzB;IAED;;;;;;;;;;;;;OAaG;IACH,0BA4FC;IAED;;;;;;;;;;;;;;OAcG;IACH,yBAuFC;IAED;;;;;;;;;;;;;OAaG;IACH,4BA0FC;IAED;;;;;;;;OAQG;IACH,iCAyDC;IAED;;;;;OAKG;IACH,iCAeC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,yBA8DC;IAED;;;;;;;OAOG;IACH,yBAWC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,oCAwCC;IAED;;;;;;;;OAQG;IACH,0BASC;IAED;;;;;;;;;OASG;IACH,kCAoBC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,wBA8TC;;CACD;8BA/gJ6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"api-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/api-manager.mjs"],"names":[],"mappings":"AAgFA;;;;;;;;;;;;;;GAcG;AACH;IACC,gCAAuC;IAEvC;;;;;;;;;;;OAWG;IACH,sBAVW,MAAM,EAuBhB;IAXA,sIAAsI;IACtI,OADW;QAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,MAAM,GAAC,IAAI,CAAC;QAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;KAAE,CAUjI;IAGF;;;;;;;;;;;;;;;;;;OAkBG;IACH,yBA+GC;IAED;;;;;;;;;;;;;;OAcG;IACH,oBA4CC;IAED;;;;;;;;;;;;;;OAcG;IACH,0BA4BC;IAED;;;;;;;;;;;;OAYG;IACH,6BAIC;IAED;;;;;;;;;;;;OAYG;IACH,uBASC;IAED;;;;;;;;;;;;;OAaG;IACH,yBAkCC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,iCAbW,MAAM,SACN,OAAO,iBACP,MAAM,GAAC,IAAI,GACT,IAAI,CAqHhB;IAED;;;;;;;;;;;;;OAaG;IACH,uBAEC;IAED;;;;;;;;;;;;;;OAcG;IACH,oBAkWC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,8BAiCC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,sCAmBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,uBAyGC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,uBA6MC;IAED;;;;;;;;;;;;OAYG;IACH,mBAwHC;IACD;;;;;;;;;;;;OAYG;IACH,uBAsEC;IA6CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkDG;IACH,wBAhDG;QAAuB,OAAO,EAAtB,MAAM;QACmD,UAAU,EAAnE,MAAM,GAAC,MAAM,EAAE,cAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;QACf,OAAO;KAChD,GAAU,OAAO,CAAC,MAAM,GAAC,MAAM,EAAE,CAAC,CAs/BpC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,yEATG;QAAqB,QAAQ,EAArB,MAAM;QACO,aAAa,EAA1B,MAAM;QACO,cAAc,EAA3B,MAAM;KACd,GAAU,OAAO,CAAC,IAAI,CAAC,CAgDzB;IA8BD;;;;;;;;;;;OAWG;IACH,mCAeC;IAoHD;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,mCA1BW,MAAM,YAEd;QAAyB,aAAa;QAGZ,aAAa;KACvC,GAAU,OAAO,CAAC,OAAO,CAAC,CA0pB5B;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,2BAdG;QAAwB,OAAO,EAAtB,MAAM,OAAA;QACS,QAAQ,EAAvB,MAAM,OAAA;KACf,GAAU,OAAO,CAAC,IAAI,CAAC,CAuCzB;IAED;;;;;;;;;;;;;OAaG;IACH,0BAkGC;IAED;;;;;;;;;;;;;;OAcG;IACH,yBAuFC;IAED;;;;;;;;;;;;;OAaG;IACH,4BA0FC;IAED;;;;;;;;OAQG;IACH,iCAyDC;IAED;;;;;OAKG;IACH,iCAeC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,yBAwEC;IAED;;;;;;;OAOG;IACH,yBAWC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,0BAyBC;IAED;;;;;;;;;OASG;IACH,+BAiCC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,oCAiDC;IAED;;;;;;;;OAQG;IACH,0BASC;IAED;;;;;;;;;OASG;IACH,kCAoBC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,wBA+TC;;CACD;8BA3oJ6B,2BAA2B"}
\ No newline at end of file

From 6f7bd7028229b7a9b593cbf4eee38ba712f58119 Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Fri, 2 Oct 2026 10:27:12 -0700
Subject: [PATCH 42/49] fix(routines): run a root shutdown/destroy export once
 per teardown

With autoRoutines: true, a module's root-level shutdown export is both a
contribution to the default mode: "shutdown" routine and the root shutdown
hook the dispose builtins capture in userHooks. api.shutdown() ran the
routine (invoking it) and then called the hook again, and api.destroy()
inherited that through its own api.shutdown() call. A root destroy export
was invoked twice by api.destroy() the same way under a mode: "destroy"
routine.

The routine manager now records, per mode, what the most recent automatic
mode run invoked (each contributor's raw function and leaf wrapper, whether
or not it threw), and exposes ranInModeRun(mode, value). The root shutdown
and destroy builtins (their runShutdownBody/destroyBody dispose paths) and
restart()'s teardown of the old instance skip the user hook when that run
already invoked it.
With autoRoutines false nothing is recorded, so the hooks are called exactly
as before.

api.slothlet.shutdown() stays framework-only: it runs the shutdown-mode
routines but never calls the root hooks itself, so with autoRoutines false
it runs no module code. docs/LIFECYCLE.md now states each teardown entry
point's behavior for root shutdown/destroy exports (restart() included), and the builtin's JSDoc
and the public slothlet.shutdown typedef say the same.

Fixes #542
---
 .../base/destroy.mjs                          |  26 ++++
 .../base/ping.mjs                             |  25 ++++
 .../base/shutdown.mjs                         |  26 ++++
 .../plugin/destroy.mjs                        |  26 ++++
 .../plugin/shutdown.mjs                       |  26 ++++
 docs/LIFECYCLE.md                             |  13 ++
 src/lib/builders/api_builder.mjs              |  26 +++-
 src/lib/handlers/routine-manager.mjs          |  64 +++++++++-
 src/slothlet.mjs                              |   9 +-
 .../routines-teardown-once.test.vitest.mjs    | 111 ++++++++++++++++++
 types/src/lib/builders/api_builder.d.mts.map  |   2 +-
 types/src/lib/handlers/routine-manager.d.mts  |  30 +++++
 .../lib/handlers/routine-manager.d.mts.map    |   2 +-
 types/src/slothlet.d.mts.map                  |   2 +-
 14 files changed, 373 insertions(+), 15 deletions(-)
 create mode 100644 api_tests/api_test_routines_teardown_once/base/destroy.mjs
 create mode 100644 api_tests/api_test_routines_teardown_once/base/ping.mjs
 create mode 100644 api_tests/api_test_routines_teardown_once/base/shutdown.mjs
 create mode 100644 api_tests/api_test_routines_teardown_once/plugin/destroy.mjs
 create mode 100644 api_tests/api_test_routines_teardown_once/plugin/shutdown.mjs
 create mode 100644 tests/vitests/suites/lifecycle/routines-teardown-once.test.vitest.mjs

diff --git a/api_tests/api_test_routines_teardown_once/base/destroy.mjs b/api_tests/api_test_routines_teardown_once/base/destroy.mjs
new file mode 100644
index 000000000..6a8248cde
--- /dev/null
+++ b/api_tests/api_test_routines_teardown_once/base/destroy.mjs
@@ -0,0 +1,26 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_routines_teardown_once/base/destroy.mjs
+ *	@Date: 2026-10-02 10:18:15 -07:00 (1790961495)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 10:21:46 -07:00 (1790961706)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Root-level destroy export of the base module (#542).
+ * @module api_test_routines_teardown_once
+ */
+
+/**
+ * Record that this teardown contribution ran.
+ * @returns {string} Marker string.
+ */
+export function destroy() {
+	(globalThis.__slothletTeardownCalls ??= []).push("root.destroy");
+	return "root.destroy";
+}
diff --git a/api_tests/api_test_routines_teardown_once/base/ping.mjs b/api_tests/api_test_routines_teardown_once/base/ping.mjs
new file mode 100644
index 000000000..538b25f6b
--- /dev/null
+++ b/api_tests/api_test_routines_teardown_once/base/ping.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_routines_teardown_once/base/ping.mjs
+ *	@Date: 2026-10-02 10:18:15 -07:00 (1790961495)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 10:21:46 -07:00 (1790961706)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Ordinary base leaf (#542).
+ * @module api_test_routines_teardown_once
+ */
+
+/**
+ * Plain leaf.
+ * @returns {string} Marker string.
+ */
+export function ping() {
+	return "pong";
+}
diff --git a/api_tests/api_test_routines_teardown_once/base/shutdown.mjs b/api_tests/api_test_routines_teardown_once/base/shutdown.mjs
new file mode 100644
index 000000000..9c619771b
--- /dev/null
+++ b/api_tests/api_test_routines_teardown_once/base/shutdown.mjs
@@ -0,0 +1,26 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_routines_teardown_once/base/shutdown.mjs
+ *	@Date: 2026-10-02 10:18:15 -07:00 (1790961495)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 10:21:46 -07:00 (1790961706)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Root-level shutdown export of the base module (#542).
+ * @module api_test_routines_teardown_once
+ */
+
+/**
+ * Record that this teardown contribution ran.
+ * @returns {string} Marker string.
+ */
+export function shutdown() {
+	(globalThis.__slothletTeardownCalls ??= []).push("root.shutdown");
+	return "root.shutdown";
+}
diff --git a/api_tests/api_test_routines_teardown_once/plugin/destroy.mjs b/api_tests/api_test_routines_teardown_once/plugin/destroy.mjs
new file mode 100644
index 000000000..dfe3839ed
--- /dev/null
+++ b/api_tests/api_test_routines_teardown_once/plugin/destroy.mjs
@@ -0,0 +1,26 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_routines_teardown_once/plugin/destroy.mjs
+ *	@Date: 2026-10-02 10:18:15 -07:00 (1790961495)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 10:21:46 -07:00 (1790961706)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Destroy export at the top level of a mounted module, below the api root (#542).
+ * @module api_test_routines_teardown_once
+ */
+
+/**
+ * Record that this teardown contribution ran.
+ * @returns {string} Marker string.
+ */
+export function destroy() {
+	(globalThis.__slothletTeardownCalls ??= []).push("plugin.destroy");
+	return "plugin.destroy";
+}
diff --git a/api_tests/api_test_routines_teardown_once/plugin/shutdown.mjs b/api_tests/api_test_routines_teardown_once/plugin/shutdown.mjs
new file mode 100644
index 000000000..e272a188d
--- /dev/null
+++ b/api_tests/api_test_routines_teardown_once/plugin/shutdown.mjs
@@ -0,0 +1,26 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_routines_teardown_once/plugin/shutdown.mjs
+ *	@Date: 2026-10-02 10:18:15 -07:00 (1790961495)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 10:21:46 -07:00 (1790961706)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Shutdown export at the top level of a mounted module, below the api root (#542).
+ * @module api_test_routines_teardown_once
+ */
+
+/**
+ * Record that this teardown contribution ran.
+ * @returns {string} Marker string.
+ */
+export function shutdown() {
+	(globalThis.__slothletTeardownCalls ??= []).push("plugin.shutdown");
+	return "plugin.shutdown";
+}
diff --git a/docs/LIFECYCLE.md b/docs/LIFECYCLE.md
index 5cbbd8176..94cafc5b9 100644
--- a/docs/LIFECYCLE.md
+++ b/docs/LIFECYCLE.md
@@ -571,6 +571,19 @@ try {
 
 TEMPORARY v3-compat gate: a project upgrading to a slothlet version carrying routines sees no behavior change by default — a pre-existing nested leaf that happens to share a routine's name (e.g. `shutdown`) stays stacked and directly callable, but does not start auto-firing. Set `true` to enable automatic firing (`startup` at compose end, `shutdown`/`destroy` at dispose). Planned to default to `true` in v4, at which point `collectLifecycleHooks` (below) is removed.
 
+#### Root `shutdown`/`destroy` exports at teardown
+
+A function exported at the api root as `shutdown` or `destroy` is also the root teardown hook. Each teardown entry point calls it at most once:
+
+| Entry point               | `autoRoutines: true`                                                                                               | `autoRoutines: false`                                                       |
+| ------------------------- | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------- |
+| `api.shutdown()`          | Runs the `shutdown`-mode routines; the root `shutdown` export runs once, as a routine contribution                 | Calls the root `shutdown` export once, as the hook                          |
+| `api.destroy()`           | Runs the `destroy`-mode routines, then `api.shutdown()`; each root export runs once                                | Calls the root `destroy` export, then the root `shutdown` export, once each |
+| `api.slothlet.shutdown()` | Runs the `shutdown`-mode routines; the root `shutdown` export runs once, as a routine contribution                 | **Framework-only: never calls the root `shutdown` export**                  |
+| `api.slothlet.restart()`  | Tears the old instance down like `api.shutdown()`; the root `shutdown` export runs once, as a routine contribution | Calls the root `shutdown` export once, as the hook                          |
+
+`api.slothlet.shutdown()` is the framework's own teardown. It runs the `shutdown`-mode routines (so with `autoRoutines: true` a root `shutdown` export runs as a contribution), but it never calls the root hooks itself. With `autoRoutines: false` it releases the instance without running any module code; use `api.shutdown()` when the root `shutdown` export must run.
+
 ### `stackRoutines`
 
 **Type**: `boolean` · **Default**: `false`
diff --git a/src/lib/builders/api_builder.mjs b/src/lib/builders/api_builder.mjs
index 3d17fa0d3..b36b9ddc0 100644
--- a/src/lib/builders/api_builder.mjs
+++ b/src/lib/builders/api_builder.mjs
@@ -2404,8 +2404,14 @@ export class ApiBuilder extends ComponentBase {
 			},
 
 			/**
-			 * Shutdown instance and cleanup resources
+			 * Shutdown instance and cleanup resources — framework-only teardown.
 			 * @returns {Promise<void>}
+			 *
+			 * @description
+			 * Runs every `mode: "shutdown"` routine's cascade (when `autoRoutines` is `true`; a root
+			 * `shutdown` export then runs once, as a contribution), then releases the instance. It never
+			 * calls the root `shutdown`/`destroy` user hooks itself, so with `autoRoutines: false` no module
+			 * code runs. `api.shutdown()` is the entry point that also calls the root `shutdown` hook.
 			 */
 			shutdown: async () => {
 				// Stackable lifecycle routines (#341): this is the OTHER of the two shutdown entry
@@ -3683,8 +3689,13 @@ export class ApiBuilder extends ComponentBase {
 				routineError = error;
 			}
 
-			// Call user's shutdown hook first if they provided one (check dynamically)
-			if (slothlet.userHooks?.shutdown && typeof slothlet.userHooks.shutdown === "function") {
+			// Call user's shutdown hook first if they provided one (check dynamically) — unless the routine
+			// run above already invoked it as a `mode: "shutdown"` contribution (#542).
+			if (
+				slothlet.userHooks?.shutdown &&
+				typeof slothlet.userHooks.shutdown === "function" &&
+				!slothlet.handlers.routineManager?.ranInModeRun("shutdown", slothlet.userHooks.shutdown)
+			) {
 				await slothlet.userHooks.shutdown();
 			}
 			const result = await slothlet.shutdown();
@@ -4099,8 +4110,13 @@ export class ApiBuilder extends ComponentBase {
 				routineError = error;
 			}
 
-			// Call user's destroy hook first if they provided one (check dynamically)
-			if (slothlet.userHooks?.destroy && typeof slothlet.userHooks.destroy === "function") {
+			// Call user's destroy hook first if they provided one (check dynamically) — unless the routine
+			// run above already invoked it as a `mode: "destroy"` contribution (#542).
+			if (
+				slothlet.userHooks?.destroy &&
+				typeof slothlet.userHooks.destroy === "function" &&
+				!slothlet.handlers.routineManager?.ranInModeRun("destroy", slothlet.userHooks.destroy)
+			) {
 				await slothlet.userHooks.destroy();
 			}
 
diff --git a/src/lib/handlers/routine-manager.mjs b/src/lib/handlers/routine-manager.mjs
index cba7d7dfd..0e72a2262 100644
--- a/src/lib/handlers/routine-manager.mjs
+++ b/src/lib/handlers/routine-manager.mjs
@@ -120,6 +120,21 @@ export class RoutineManager extends ComponentBase {
 		 * @type {Map<string, function(string): boolean>}
 		 */
 		this.patternCache = new Map();
+
+		/**
+		 * What the most recent automatic run of each mode actually invoked, keyed by mode: every
+		 * contributor's raw `fn` and its leaf wrapper (#542). The dispose builtins consult it through
+		 * {@link RoutineManager#ranInModeRun} so a root `shutdown`/`destroy` export the routine run
+		 * already invoked is not invoked a second time as the root user hook.
+		 * @type {Map<string, Set<unknown>>}
+		 */
+		this.modeRunInvoked = new Map();
+
+		/**
+		 * The set the mode run in progress records into, or `null` outside one (#542).
+		 * @type {Set<unknown>|null}
+		 */
+		this.activeModeRun = null;
 	}
 
 	/**
@@ -999,6 +1014,13 @@ export class RoutineManager extends ComponentBase {
 		const canEnterExtent =
 			contextManager && typeof contextManager.runInContext === "function" && contextManager.instances?.has?.(instanceID);
 		for (const { moduleID, fn } of entries) {
+			// An automatic mode run records what it invokes, so the dispose builtins can tell a root hook
+			// it already ran (#542).
+			if (this.activeModeRun) {
+				this.activeModeRun.add(fn);
+				const leafWrapper = this.rawWrappers.get(moduleID)?.get(apiPath);
+				if (leafWrapper) this.activeModeRun.add(leafWrapper);
+			}
 			try {
 				// Sequential-by-contract: each contributor must observe the previous one's completed side effects.
 				if (canEnterExtent) {
@@ -1487,6 +1509,9 @@ export class RoutineManager extends ComponentBase {
 	 * @private
 	 */
 	async #runModeRoutines(mode) {
+		// Recorded fresh on every run (#542), so a skipped run never leaves an earlier run's record behind.
+		const invoked = new Set();
+		this.modeRunInvoked.set(mode, invoked);
 		if (!this.slothlet.config?.autoRoutines) return;
 		const routines = this.#routines.filter((routine) => routine.mode === mode);
 		if (routines.length === 0) return;
@@ -1494,14 +1519,43 @@ export class RoutineManager extends ComponentBase {
 			await this.#materializeFor(routine);
 		}
 		await this.rebuildStacks(this.slothlet.api);
-		for (const routine of routines) {
-			// Sequential-by-contract: routines run in declared order, each fully drained.
-			// skipMaterialize: true — the loop above already force-materialized this exact routine;
-			// letting runCascade() do it again would re-walk the same tree for no new information.
-			await this.runCascade(routine.name, [], true);
+		this.activeModeRun = invoked;
+		try {
+			for (const routine of routines) {
+				// Sequential-by-contract: routines run in declared order, each fully drained.
+				// skipMaterialize: true — the loop above already force-materialized this exact routine;
+				// letting runCascade() do it again would re-walk the same tree for no new information.
+				await this.runCascade(routine.name, [], true);
+			}
+		} finally {
+			this.activeModeRun = null;
 		}
 	}
 
+	/**
+	 * Whether the most recent automatic run of `mode` invoked `value` as one of its contributions (#542).
+	 * @param {"startup"|"shutdown"|"destroy"} mode - Mode whose last run to check.
+	 * @param {unknown} value - A contribution: its api-facing wrapper proxy, raw wrapper, or raw function.
+	 * @returns {boolean} True when that run invoked it (whether or not it threw).
+	 * @public
+	 *
+	 * @description
+	 * The dispose builtins also call the root `shutdown`/`destroy` export captured as a user hook. When
+	 * `autoRoutines` is on, that same export is a contribution to the default `mode: "shutdown"` routine
+	 * (or a configured `mode: "destroy"` one), so the routine run has already invoked it — the builtin
+	 * asks here and skips the second call.
+	 *
+	 * @example
+	 * if (!routineManager.ranInModeRun("shutdown", slothlet.userHooks.shutdown)) await slothlet.userHooks.shutdown();
+	 */
+	ranInModeRun(mode, value) {
+		const invoked = this.modeRunInvoked.get(mode);
+		if (!invoked || invoked.size === 0 || !value) return false;
+		if (invoked.has(value)) return true;
+		const wrapper = resolveWrapper(value);
+		return !!wrapper && (invoked.has(wrapper) || invoked.has(wrapper.__impl));
+	}
+
 	/**
 	 * Run every configured `mode: "shutdown"` routine's cascade. Called from the framework's
 	 * existing dispose builtin (`createShutdownFunction()` in api_builder.mjs) — the
diff --git a/src/slothlet.mjs b/src/slothlet.mjs
index 9ca4293d2..3e7925332 100644
--- a/src/slothlet.mjs
+++ b/src/slothlet.mjs
@@ -1399,7 +1399,12 @@ class Slothlet {
 						firstError = error;
 					}
 					try {
-						if (typeof this.userHooks?.shutdown === "function") {
+						// Skipped when the routine run above already invoked it as a `mode: "shutdown"`
+						// contribution, so it runs once per restart (#542).
+						if (
+							typeof this.userHooks?.shutdown === "function" &&
+							!this.handlers.routineManager?.ranInModeRun("shutdown", this.userHooks.shutdown)
+						) {
 							await this.userHooks.shutdown();
 						}
 					} catch (error) {
@@ -2039,5 +2044,5 @@ export default slothlet;
  * @property {Function} slothlet.restart - Clean-slate restart: shut this instance down through the normal teardown path and build a new one from the ORIGINAL `slothlet({...})` config behind the same `api` reference. Unlike `reload()`, nothing runtime is carried over — no replayed `add()`/`remove()` history, runtime hooks, permission rules, event or lifecycle subscriptions, metadata, runtime assignments or module-scope state (modules are re-imported under a new instance ID). Held child references are re-pointed to the node at the same path in the new instance; one whose path no longer exists throws `RESTART_REFERENCE_UNRESOLVED` on use. Emits `restart` → `shutdown` → `init` → `restarted`. Refused with `INVALID_CONFIG_MUTATIONS_DISABLED` when `api.mutations.reload` is `false`, and, when a `permissions` config is present, host-only (a built-in rule denies `slothlet.restart` to modules; an explicit host rule can allow a trusted module — with no `permissions` config the permission system is off and modules can call it). The new instance comes up with only the original config's permission rules and unsealed, even if the old one was sealed. See [RELOAD.md](docs/RELOAD.md#apislothletrestart). %%sig: (): Promise.<Object>%% %%example: // ESM usage via slothlet API|import slothlet from "@cldmv/slothlet";|const api = await slothlet({ base: './api' });|api.conn.handlers = { onSend };|await api.slothlet.restart(); // clean slate from the original config|api.conn.handlers; // undefined%% %%example: // ESM usage via slothlet API (inside async function)|async function example() {|  const { default: slothlet } = await import("@cldmv/slothlet");|  const api = await slothlet({ base: './api' });|  await api.slothlet.restart();|}%% %%example: // CJS usage via slothlet API (top-level)|let slothlet;|(async () => {|  ({ slothlet } = await import("@cldmv/slothlet"));|  const api = await slothlet({ base: './api' });|  await api.slothlet.restart();|})();%% %%example: // CJS usage via slothlet API (inside async function)|const slothlet = require("@cldmv/slothlet");|const api = await slothlet({ base: './api' });|await api.slothlet.restart();%%
  * @property {Function} slothlet.run - Execute a callback with isolated per-request context data. Convenience alias for `slothlet.context.run()`. %%sig: (contextData: Object, callback: function, args: *): *%% %%example: // ESM usage via slothlet API|import slothlet from "@cldmv/slothlet";|const api = await slothlet({ base: './api' });|const result = await api.slothlet.run({ userId: 42 }, async () => {|  return api.myModule.getUser();|});%% %%example: // ESM usage via slothlet API (inside async function)|async function example() {|  const { default: slothlet } = await import("@cldmv/slothlet");|  const api = await slothlet({ base: './api' });|  const result = await api.slothlet.run({ userId: 42 }, async () => {|    return api.myModule.getUser();|  });|}%% %%example: // CJS usage via slothlet API (top-level)|let slothlet;|(async () => {|  ({ slothlet } = await import("@cldmv/slothlet"));|  const api = await slothlet({ base: './api' });|  const result = await api.slothlet.run({ userId: 42 }, async () => {|    return api.myModule.getUser();|  });|})();%% %%example: // CJS usage via slothlet API (inside async function)|const slothlet = require("@cldmv/slothlet");|const api = await slothlet({ base: './api' });|const result = await api.slothlet.run({ userId: 42 }, async () => {|  return api.myModule.getUser();|});%%
  * @property {Function} slothlet.scope - Execute a function with full structured per-request context options. Convenience alias for `slothlet.context.scope()`. %%sig: (options: Object): *%% %%example: // ESM usage via slothlet API|import slothlet from "@cldmv/slothlet";|const api = await slothlet({ base: './api' });|const result = await api.slothlet.scope({|  context: { userId: 42 },|  fn: async () => api.myModule.getUser()|});%% %%example: // ESM usage via slothlet API (inside async function)|async function example() {|  const { default: slothlet } = await import("@cldmv/slothlet");|  const api = await slothlet({ base: './api' });|  const result = await api.slothlet.scope({|    context: { userId: 42 },|    fn: async () => api.myModule.getUser()|  });|}%% %%example: // CJS usage via slothlet API (top-level)|let slothlet;|(async () => {|  ({ slothlet } = await import("@cldmv/slothlet"));|  const api = await slothlet({ base: './api' });|  const result = await api.slothlet.scope({|    context: { userId: 42 },|    fn: async () => api.myModule.getUser()|  });|})();%% %%example: // CJS usage via slothlet API (inside async function)|const slothlet = require("@cldmv/slothlet");|const api = await slothlet({ base: './api' });|const result = await api.slothlet.scope({|  context: { userId: 42 },|  fn: async () => api.myModule.getUser()|});%%
- * @property {function(): Promise.<void>} slothlet.shutdown - Shut down the instance and release all resources. %%sig: (): Promise.<void>%% %%example: // ESM usage via slothlet API|import slothlet from "@cldmv/slothlet";|const api = await slothlet({ base: './api' });|await api.slothlet.shutdown();%% %%example: // ESM usage via slothlet API (inside async function)|async function example() {|  const { default: slothlet } = await import("@cldmv/slothlet");|  const api = await slothlet({ base: './api' });|  await api.slothlet.shutdown();|}%% %%example: // CJS usage via slothlet API (top-level)|let slothlet;|(async () => {|  ({ slothlet } = await import("@cldmv/slothlet"));|  const api = await slothlet({ base: './api' });|  await api.slothlet.shutdown();|})();%% %%example: // CJS usage via slothlet API (inside async function)|const slothlet = require("@cldmv/slothlet");|const api = await slothlet({ base: './api' });|await api.slothlet.shutdown();%%
+ * @property {function(): Promise.<void>} slothlet.shutdown - Shut down the instance and release all resources. Framework-only teardown: runs the `mode: "shutdown"` routines (with `autoRoutines: true` a root `shutdown` export runs once, as a contribution) but never calls the root `shutdown`/`destroy` hooks itself, so with `autoRoutines: false` no module code runs — use `api.shutdown()` to also call the root `shutdown` hook. %%sig: (): Promise.<void>%% %%example: // ESM usage via slothlet API|import slothlet from "@cldmv/slothlet";|const api = await slothlet({ base: './api' });|await api.slothlet.shutdown();%% %%example: // ESM usage via slothlet API (inside async function)|async function example() {|  const { default: slothlet } = await import("@cldmv/slothlet");|  const api = await slothlet({ base: './api' });|  await api.slothlet.shutdown();|}%% %%example: // CJS usage via slothlet API (top-level)|let slothlet;|(async () => {|  ({ slothlet } = await import("@cldmv/slothlet"));|  const api = await slothlet({ base: './api' });|  await api.slothlet.shutdown();|})();%% %%example: // CJS usage via slothlet API (inside async function)|const slothlet = require("@cldmv/slothlet");|const api = await slothlet({ base: './api' });|await api.slothlet.shutdown();%%
  */
diff --git a/tests/vitests/suites/lifecycle/routines-teardown-once.test.vitest.mjs b/tests/vitests/suites/lifecycle/routines-teardown-once.test.vitest.mjs
new file mode 100644
index 000000000..d6994069f
--- /dev/null
+++ b/tests/vitests/suites/lifecycle/routines-teardown-once.test.vitest.mjs
@@ -0,0 +1,111 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/lifecycle/routines-teardown-once.test.vitest.mjs
+ *	@Date: 2026-10-02 10:19:37 -07:00 (1790961577)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 10:22:43 -07:00 (1790961763)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Regression coverage (#542): every teardown contribution runs exactly once per teardown.
+ *
+ * With `autoRoutines: true`, a module's root-level `shutdown` export is both a contribution to the default
+ * `mode: "shutdown"` routine and the root shutdown hook the dispose builtin calls. It ran twice: once in the
+ * routine run and again as the hook. A root `destroy` export did the same under a `mode: "destroy"` routine.
+ *
+ * The instance has a root `shutdown`/`destroy` export (the base module) and the same exports one level below
+ * the root (a module mounted at `plugin`). Teardown runs through `api.shutdown()`, `api.slothlet.shutdown()`,
+ * `api.destroy()` and `api.slothlet.restart()`, with `autoRoutines` on and off:
+ * - `autoRoutines: true` — every contribution of every mode the entry point runs fires once.
+ * - `autoRoutines: false` — no routine fires automatically; the root hooks still fire once from the root
+ *   builtins (`api.shutdown()`, `api.destroy()`) and from `restart()`'s teardown. `api.slothlet.shutdown()` does not call the root hooks
+ *   (it runs only the routines), so nothing fires there.
+ * @module tests/vitests/suites/lifecycle/routines-teardown-once
+ */
+
+import path from "node:path";
+import { describe, it, expect, afterEach } from "vitest";
+import slothlet from "@cldmv/slothlet";
+import { getMatrixConfigs, TEST_DIRS } from "../../setup/vitest-helper.mjs";
+
+const FIXTURES = path.join(path.dirname(TEST_DIRS.API_TEST), "api_test_routines_teardown_once");
+const BASE = path.join(FIXTURES, "base"); // shutdown.mjs, destroy.mjs (root exports), ping.mjs
+const PLUGIN = path.join(FIXTURES, "plugin"); // shutdown.mjs, destroy.mjs — mounted at "plugin"
+
+/** The default routines plus a `mode: "destroy"` routine, so `destroy` exports are contributions too. */
+const ROUTINES = [...slothlet.defaults.routines, { name: "destroy", mode: "destroy" }];
+
+const TEARDOWNS = {
+	"api.shutdown()": (api) => api.shutdown(),
+	"api.slothlet.shutdown()": (api) => api.slothlet.shutdown(),
+	"api.destroy()": (api) => api.destroy(),
+	"api.slothlet.restart()": (api) => api.slothlet.restart()
+};
+
+/** Expected call counts per teardown entry point, by `autoRoutines`. */
+const EXPECTED = {
+	true: {
+		"api.shutdown()": { "root.shutdown": 1, "plugin.shutdown": 1 },
+		"api.slothlet.shutdown()": { "root.shutdown": 1, "plugin.shutdown": 1 },
+		"api.destroy()": { "root.destroy": 1, "plugin.destroy": 1, "root.shutdown": 1, "plugin.shutdown": 1 },
+		"api.slothlet.restart()": { "root.shutdown": 1, "plugin.shutdown": 1 }
+	},
+	false: {
+		"api.shutdown()": { "root.shutdown": 1 },
+		"api.slothlet.shutdown()": {},
+		"api.destroy()": { "root.destroy": 1, "root.shutdown": 1 },
+		"api.slothlet.restart()": { "root.shutdown": 1 }
+	}
+};
+
+/**
+ * Count the teardown calls recorded by the fixture modules.
+ * @returns {Object<string, number>} Contribution → call count.
+ */
+function countCalls() {
+	const counts = {};
+	for (const name of globalThis.__slothletTeardownCalls ?? []) counts[name] = (counts[name] ?? 0) + 1;
+	return counts;
+}
+
+describe.each(getMatrixConfigs())("each teardown contribution runs once (#542) > $name", ({ config }) => {
+	let api;
+
+	afterEach(async () => {
+		if (api && !api.slothlet?.isDestroyed) {
+			try {
+				await api.slothlet?.shutdown?.();
+			} catch {
+				// Already torn down by the test.
+			}
+		}
+		api = null;
+		delete globalThis.__slothletTeardownCalls;
+	});
+
+	describe.each([true, false])("autoRoutines: %s", (autoRoutines) => {
+		it.each(Object.keys(TEARDOWNS))("via %s", async (entry) => {
+			api = await slothlet({ ...config, base: BASE, silent: true, autoRoutines, routines: ROUTINES });
+			await api.slothlet.api.add("plugin", PLUGIN, { moduleID: "plugin" });
+			globalThis.__slothletTeardownCalls = [];
+
+			await TEARDOWNS[entry](api);
+
+			expect(countCalls()).toEqual(EXPECTED[autoRoutines][entry]);
+		});
+	});
+
+	it("runs the root shutdown export once per restart(), across consecutive restarts (autoRoutines: true)", async () => {
+		api = await slothlet({ ...config, base: BASE, silent: true, autoRoutines: true, routines: ROUTINES });
+		for (let restart = 1; restart <= 2; restart++) {
+			globalThis.__slothletTeardownCalls = [];
+			await api.slothlet.restart();
+			expect(countCalls(), `restart #${restart}`).toEqual({ "root.shutdown": 1 });
+		}
+	});
+});
diff --git a/types/src/lib/builders/api_builder.d.mts.map b/types/src/lib/builders/api_builder.d.mts.map
index dd1cfefac..bb76a67dd 100644
--- a/types/src/lib/builders/api_builder.d.mts.map
+++ b/types/src/lib/builders/api_builder.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"api_builder.d.mts","sourceRoot":"","sources":["../../../../src/lib/builders/api_builder.mjs"],"names":[],"mappings":"AA4NA;;;;;;;;;;;;;GAaG;AACH;IACC,gCAAuC;IAEvC;;;;;;;OAOG;IACH,sBANW,MAAM,EAQhB;IAED;;;;;OAKG;IACH,8BAJW,MAAM,GACJ,OAAO,CAAC,MAAM,CAAC,CA6G3B;IAED;;;;;;;;;;;OAWG;IACH,gCA2sGC;IAED;;;;OAIG;IACH,+BA+CC;IAED;;;;OAIG;IACH,0BAgCC;IAED;;;;OAIG;IACH,4BAsTC;IAED;;;;;OAKG;IACH,8BAiFC;IAED;;;;;OAKG;IACH,uBAgCC;CACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BA/jI6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"api_builder.d.mts","sourceRoot":"","sources":["../../../../src/lib/builders/api_builder.mjs"],"names":[],"mappings":"AA4NA;;;;;;;;;;;;;GAaG;AACH;IACC,gCAAuC;IAEvC;;;;;;;OAOG;IACH,sBANW,MAAM,EAQhB;IAED;;;;;OAKG;IACH,8BAJW,MAAM,GACJ,OAAO,CAAC,MAAM,CAAC,CA6G3B;IAED;;;;;;;;;;;OAWG;IACH,gCAitGC;IAED;;;;OAIG;IACH,+BAoDC;IAED;;;;OAIG;IACH,0BAgCC;IAED;;;;OAIG;IACH,4BAsTC;IAED;;;;;OAKG;IACH,8BAsFC;IAED;;;;;OAKG;IACH,uBAgCC;CACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BA/kI6B,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/lib/handlers/routine-manager.d.mts b/types/src/lib/handlers/routine-manager.d.mts
index 0a56d5212..55a888142 100644
--- a/types/src/lib/handlers/routine-manager.d.mts
+++ b/types/src/lib/handlers/routine-manager.d.mts
@@ -65,6 +65,19 @@ export class RoutineManager extends ComponentBase {
      * @type {Map<string, function(string): boolean>}
      */
     patternCache: Map<string, (arg0: string) => boolean>;
+    /**
+     * What the most recent automatic run of each mode actually invoked, keyed by mode: every
+     * contributor's raw `fn` and its leaf wrapper (#542). The dispose builtins consult it through
+     * {@link RoutineManager#ranInModeRun} so a root `shutdown`/`destroy` export the routine run
+     * already invoked is not invoked a second time as the root user hook.
+     * @type {Map<string, Set<unknown>>}
+     */
+    modeRunInvoked: Map<string, Set<unknown>>;
+    /**
+     * The set the mode run in progress records into, or `null` outside one (#542).
+     * @type {Set<unknown>|null}
+     */
+    activeModeRun: Set<unknown> | null;
     /**
      * Discard all captured state. Called at the start of every `load()` (including `reload()`,
      * which re-invokes `load()` on the same instance) so a previous cycle's contributors never
@@ -380,6 +393,23 @@ export class RoutineManager extends ComponentBase {
      * @public
      */
     public runCascade(name: string, args?: any[], skipMaterialize?: boolean): Promise<any>;
+    /**
+     * Whether the most recent automatic run of `mode` invoked `value` as one of its contributions (#542).
+     * @param {"startup"|"shutdown"|"destroy"} mode - Mode whose last run to check.
+     * @param {unknown} value - A contribution: its api-facing wrapper proxy, raw wrapper, or raw function.
+     * @returns {boolean} True when that run invoked it (whether or not it threw).
+     * @public
+     *
+     * @description
+     * The dispose builtins also call the root `shutdown`/`destroy` export captured as a user hook. When
+     * `autoRoutines` is on, that same export is a contribution to the default `mode: "shutdown"` routine
+     * (or a configured `mode: "destroy"` one), so the routine run has already invoked it — the builtin
+     * asks here and skips the second call.
+     *
+     * @example
+     * if (!routineManager.ranInModeRun("shutdown", slothlet.userHooks.shutdown)) await slothlet.userHooks.shutdown();
+     */
+    public ranInModeRun(mode: "startup" | "shutdown" | "destroy", value: unknown): boolean;
     /**
      * Run every configured `mode: "shutdown"` routine's cascade. Called from the framework's
      * existing dispose builtin (`createShutdownFunction()` in api_builder.mjs) — the
diff --git a/types/src/lib/handlers/routine-manager.d.mts.map b/types/src/lib/handlers/routine-manager.d.mts.map
index fb7880e43..edcf3370b 100644
--- a/types/src/lib/handlers/routine-manager.d.mts.map
+++ b/types/src/lib/handlers/routine-manager.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"routine-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/routine-manager.mjs"],"names":[],"mappings":"AAqDA;;;;;;;;;;;;;;;;;;GAkBG;AACH;IACC,gCAA2C;IAE3C;;;OAGG;IACH,sBAFW,MAAM,EA6ChB;IAxCA;;;;;;OAMG;IACH,KAFU,KAAK,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,EAAE,WAAU;KAAC,CAAC,CAErD;IAEb;;;;;;;;;;;;OAYG;IACH,aAFU,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAEd;IAE5B;;;;;;;OAOG;IACH,WAFU,OAAO,CAEI;IAErB;;;;OAIG;IACH,cAFU,GAAG,CAAC,MAAM,EAAE,CAAS,IAAM,EAAN,MAAM,KAAG,OAAO,CAAC,CAEnB;IAG9B;;;;;;OAMG;IACH,gBAHa,IAAI,CAOhB;IAwMD;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,2BAJW,MAAM,GACJ,IAAI,CAgFhB;IAgLD;;;;;OAKG;IACH,2BAJW,MAAM,GACJ,IAAI,CAShB;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,6BAhBW,MAAM,YACN,MAAM,GACJ,IAAI,CAyBhB;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,6BApBW,MAAM,GACJ,IAAI,CAkChB;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,oCAlBW,MAAM,GACJ,GAAG,CAAC,MAAM,EAAE;QAAC,EAAE,WAAW;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,GAAC,SAAS,CAAA;KAAC,CAAC,CAwBjF;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,iCAvBW,MAAM,YACN,MAAM,GACJ;QAAC,EAAE,WAAW;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,GAAC,SAAS,CAAA;KAAC,GAAC,SAAS,CAyB9E;IAED;;;;;;;;;;;;;;;OAeG;IACH,+BAZW,MAAM,YACN,MAAM,cACN;QAAC,EAAE,WAAW;QAAC,KAAK,EAAE,MAAM,CAAA;KAAC,GAAC,SAAS,GAIrC,IAAI,CA4BhB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,qCA5BW,MAAM,YACN,MAAM,QACN,MAAM,gBACN,GAAG,CAAC,MAAM,WAAW,2BAInB,IAAI,CA2EhB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,wCAlCW,MAAM,gBACN,GAAG,CAAC,MAAM,WAAW,GAEnB,IAAI,CA8DhB;IAyGD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,wBAhBW,MAAM,0BAEN,MAAM,GAOJ,OAAO,CAAC,GAAC,CAAC,CAgBtB;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,2BAVW,MAAM,OACN,MAAM,0BAEN,MAAM,GAEJ,OAAO,CAAC,GAAC,CAAC,CAiCtB;IAED;;;;;;;;;;;OAWG;IACH,+BANW,MAAM,YACN,MAAM,GAEJ,MAAM,EAAE,CAOpB;IA8QD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,wBAjBW,MAAM,kCAIN,OAAO,GAML,OAAO,CAAC,GAAC,CAAC,CA8BtB;IA0BD;;;;;;;;;;;;;;;;OAgBG;IACH,kCAHa,OAAO,CAAC,IAAI,CAAC,CAKzB;IAED;;;;;;;;;;;;;OAaG;IACH,iCAHa,OAAO,CAAC,IAAI,CAAC,CAKzB;IAED;;;;;;;;;;OAUG;IACH,iCAHa,OAAO,CAAC,IAAI,CAAC,CAKzB;IA8HD;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,0BAJW,MAAM,GACJ,OAAO,CAAC,IAAI,CAAC,CAkDzB;;CACD;8BApsD6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"routine-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/routine-manager.mjs"],"names":[],"mappings":"AAqDA;;;;;;;;;;;;;;;;;;GAkBG;AACH;IACC,gCAA2C;IAE3C;;;OAGG;IACH,sBAFW,MAAM,EA4DhB;IAvDA;;;;;;OAMG;IACH,KAFU,KAAK,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,EAAE,WAAU;KAAC,CAAC,CAErD;IAEb;;;;;;;;;;;;OAYG;IACH,aAFU,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAEd;IAE5B;;;;;;;OAOG;IACH,WAFU,OAAO,CAEI;IAErB;;;;OAIG;IACH,cAFU,GAAG,CAAC,MAAM,EAAE,CAAS,IAAM,EAAN,MAAM,KAAG,OAAO,CAAC,CAEnB;IAE7B;;;;;;OAMG;IACH,gBAFU,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAEJ;IAE/B;;;OAGG;IACH,eAFU,GAAG,CAAC,OAAO,CAAC,GAAC,IAAI,CAEF;IAG1B;;;;;;OAMG;IACH,gBAHa,IAAI,CAOhB;IAwMD;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,2BAJW,MAAM,GACJ,IAAI,CAgFhB;IAgLD;;;;;OAKG;IACH,2BAJW,MAAM,GACJ,IAAI,CAShB;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,6BAhBW,MAAM,YACN,MAAM,GACJ,IAAI,CAyBhB;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,6BApBW,MAAM,GACJ,IAAI,CAkChB;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,oCAlBW,MAAM,GACJ,GAAG,CAAC,MAAM,EAAE;QAAC,EAAE,WAAW;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,GAAC,SAAS,CAAA;KAAC,CAAC,CAwBjF;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,iCAvBW,MAAM,YACN,MAAM,GACJ;QAAC,EAAE,WAAW;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,GAAC,SAAS,CAAA;KAAC,GAAC,SAAS,CAyB9E;IAED;;;;;;;;;;;;;;;OAeG;IACH,+BAZW,MAAM,YACN,MAAM,cACN;QAAC,EAAE,WAAW;QAAC,KAAK,EAAE,MAAM,CAAA;KAAC,GAAC,SAAS,GAIrC,IAAI,CA4BhB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,qCA5BW,MAAM,YACN,MAAM,QACN,MAAM,gBACN,GAAG,CAAC,MAAM,WAAW,2BAInB,IAAI,CA2EhB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,wCAlCW,MAAM,gBACN,GAAG,CAAC,MAAM,WAAW,GAEnB,IAAI,CA8DhB;IAgHD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,wBAhBW,MAAM,0BAEN,MAAM,GAOJ,OAAO,CAAC,GAAC,CAAC,CAgBtB;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,2BAVW,MAAM,OACN,MAAM,0BAEN,MAAM,GAEJ,OAAO,CAAC,GAAC,CAAC,CAiCtB;IAED;;;;;;;;;;;OAWG;IACH,+BANW,MAAM,YACN,MAAM,GAEJ,MAAM,EAAE,CAOpB;IA8QD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,wBAjBW,MAAM,kCAIN,OAAO,GAML,OAAO,CAAC,GAAC,CAAC,CA8BtB;IAkCD;;;;;;;;;;;;;;;OAeG;IACH,0BAdW,SAAS,GAAC,UAAU,GAAC,SAAS,SAC9B,OAAO,GACL,OAAO,CAkBnB;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,kCAHa,OAAO,CAAC,IAAI,CAAC,CAKzB;IAED;;;;;;;;;;;;;OAaG;IACH,iCAHa,OAAO,CAAC,IAAI,CAAC,CAKzB;IAED;;;;;;;;;;OAUG;IACH,iCAHa,OAAO,CAAC,IAAI,CAAC,CAKzB;IA8HD;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,0BAJW,MAAM,GACJ,OAAO,CAAC,IAAI,CAAC,CAkDzB;;CACD;8BA1vD6B,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/slothlet.d.mts.map b/types/src/slothlet.d.mts.map
index 1e8164086..acdd7ab66 100644
--- a/types/src/slothlet.d.mts.map
+++ b/types/src/slothlet.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"slothlet.d.mts","sourceRoot":"","sources":["../../src/slothlet.mjs"],"names":[],"mappings":"AAmtDA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,yBApCuB,CAAC,SAAX,MAAQ,6DAGV,eAAe,GACb,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,CAwCpC;;kBASS,QAAQ,CAAC;QAAC,QAAQ,EAAE,aAAa,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAC,CAAC,CAAC;QAAC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;KAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAgD3F,SAAS,GAAC,MAAM;;;;;;;;;;;;qBAEP,MAAM;iBAAO,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA8BhB,MAAM;eAAS,CAAC,QAAQ,GAAC,SAAS,GAAC,UAAU,GAAC,SAAS,CAAC;oBAAc,OAAO;gBAAU,CAAC,OAAO,GAAC,OAAO,CAAC;kBAAY,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAevI,KAAK,CAAC;YAAC,IAAI,EAAC,MAAM,CAAC;YAAA,IAAI,EAAC,MAAM,CAAC;YAAA,QAAQ,EAAC,MAAM,CAAA;SAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aA8BxD,MAAY,IAAI;;;;cAChB,MAAY,IAAI;;;;cAE3B;QAAgE,GAAG,EAAxD,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAC,SAAS,CAAC,CAAC;QACzB,GAAG,EAC/B;YAAkC,GAAG;YACH,MAAM;YACN,MAAM;YACN,MAAM;YACR,OAAO,EACvC;gBAA0C,QAAQ;gBACR,IAAI;gBACJ,SAAS;gBACT,UAAU;gBACV,YAAY;gBACZ,aAAa;gBACb,iBAAiB;gBACjB,mBAAmB;gBACnB,cAAc;aACxD;SAAA;QAA4B,OAAO,EACnC;YAAsC,GAAG;YACO,OAAO,EAA5C,MAAY,MAAM;YACS,GAAG;YACH,KAAK;YACL,GAAG;SACzC;QAA6B,IAAI;;;;;;;;6BAEV,MAAM;;;;yCACN,MAAM,EAAE;;;;;;;;;;;;;;;;;4BAIR,MAAM;;;;kCACN,MAAM;;;;;;;;6BAEN,MAAM;;;;;;;;;;;;;;;;;qCAIN,eAAe;;QACV,IAAI,EAChC;YAAmC,KAAK;YACL,OAAO;YACP,cAAc;YACd,MAAM;YACN,aAAa;YACb,IAAI;YACJ,GAAG;YACH,EAAE;YACJ,GAAG,EACpC;gBAAsC,OAAO,EAAlC,OAAO;gBACqB,MAAM;gBACN,OAAO;aAC9C;YAAmC,MAAM;YACN,kBAAkB;SACrD;QAA4B,KAAK,EACjC;YAAoC,EAAE;YACF,IAAI;YACJ,GAAG;YACH,IAAI;YACJ,YAAY;YACd,KAAK,EACvC;gBAA0C,GAAG;gBACH,MAAM;aAChD;YAAoC,QAAQ;YACR,OAAO;SAC3C;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,EAAE;SAC1C;QAA4B,WAAW,EACvC;YAAoD,GAAG,EAA5C,MAAY,MAAM;YACY,YAAY,EAA1C,OAAO;YAC0C,IAAI,EAArD,MAAY,OAAO,CAAE,IAAI,CAAC;SACrC;QAA4B,QAAQ,EACpC;YAAsD,MAAM,EAAjD,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,MAAM;YACN,SAAS;YACM,IAAI,EAA/C,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,SAAS;SAChD;QAA4B,KAAK,EACjC;YAAoC,GAAG;SACvC;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,UAAU;SAClD;QAA4B,WAAW,EACvC;YAAwC,OAAO,EAC/C;gBAAiD,OAAO,EAA7C,OAAO;gBACwC,MAAM,EAArD,MAAY,IAAI;gBAC+B,OAAO,EAAtD,MAAY,IAAI;gBACsB,iBAAiB,EAAvD,OAAO;gBAC+C,UAAU,EAAhE,CAAS,IAAO,EAAP,OAAO,KAAG,IAAI;gBACwB,IAAI,EAAnD,MAAY,IAAI;gBACsB,MAAM,EAA5C,OAAO;aAClB;SAAA;QAA4B,UAAU,EACtC;YAAyC,IAAI;YACJ,UAAU;YACV,UAAU;YACV,kBAAkB;YAClB,kBAAkB;SAC3D;QAA8B,UAAU;QACV,IAAI;QACL,SAAS;QACR,MAAM;QACN,OAAO;QACP,GAAG;QACH,KAAK;QACa,QAAQ,EAA7C,MAAY,OAAO,CAAE,IAAI,CAAC;KACvC;;gCAh6D6D,wBAAwB"}
\ No newline at end of file
+{"version":3,"file":"slothlet.d.mts","sourceRoot":"","sources":["../../src/slothlet.mjs"],"names":[],"mappings":"AAwtDA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,yBApCuB,CAAC,SAAX,MAAQ,6DAGV,eAAe,GACb,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,CAwCpC;;kBASS,QAAQ,CAAC;QAAC,QAAQ,EAAE,aAAa,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAC,CAAC,CAAC;QAAC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;KAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAgD3F,SAAS,GAAC,MAAM;;;;;;;;;;;;qBAEP,MAAM;iBAAO,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA8BhB,MAAM;eAAS,CAAC,QAAQ,GAAC,SAAS,GAAC,UAAU,GAAC,SAAS,CAAC;oBAAc,OAAO;gBAAU,CAAC,OAAO,GAAC,OAAO,CAAC;kBAAY,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAevI,KAAK,CAAC;YAAC,IAAI,EAAC,MAAM,CAAC;YAAA,IAAI,EAAC,MAAM,CAAC;YAAA,QAAQ,EAAC,MAAM,CAAA;SAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aA8BxD,MAAY,IAAI;;;;cAChB,MAAY,IAAI;;;;cAE3B;QAAgE,GAAG,EAAxD,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAC,SAAS,CAAC,CAAC;QACzB,GAAG,EAC/B;YAAkC,GAAG;YACH,MAAM;YACN,MAAM;YACN,MAAM;YACR,OAAO,EACvC;gBAA0C,QAAQ;gBACR,IAAI;gBACJ,SAAS;gBACT,UAAU;gBACV,YAAY;gBACZ,aAAa;gBACb,iBAAiB;gBACjB,mBAAmB;gBACnB,cAAc;aACxD;SAAA;QAA4B,OAAO,EACnC;YAAsC,GAAG;YACO,OAAO,EAA5C,MAAY,MAAM;YACS,GAAG;YACH,KAAK;YACL,GAAG;SACzC;QAA6B,IAAI;;;;;;;;6BAEV,MAAM;;;;yCACN,MAAM,EAAE;;;;;;;;;;;;;;;;;4BAIR,MAAM;;;;kCACN,MAAM;;;;;;;;6BAEN,MAAM;;;;;;;;;;;;;;;;;qCAIN,eAAe;;QACV,IAAI,EAChC;YAAmC,KAAK;YACL,OAAO;YACP,cAAc;YACd,MAAM;YACN,aAAa;YACb,IAAI;YACJ,GAAG;YACH,EAAE;YACJ,GAAG,EACpC;gBAAsC,OAAO,EAAlC,OAAO;gBACqB,MAAM;gBACN,OAAO;aAC9C;YAAmC,MAAM;YACN,kBAAkB;SACrD;QAA4B,KAAK,EACjC;YAAoC,EAAE;YACF,IAAI;YACJ,GAAG;YACH,IAAI;YACJ,YAAY;YACd,KAAK,EACvC;gBAA0C,GAAG;gBACH,MAAM;aAChD;YAAoC,QAAQ;YACR,OAAO;SAC3C;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,EAAE;SAC1C;QAA4B,WAAW,EACvC;YAAoD,GAAG,EAA5C,MAAY,MAAM;YACY,YAAY,EAA1C,OAAO;YAC0C,IAAI,EAArD,MAAY,OAAO,CAAE,IAAI,CAAC;SACrC;QAA4B,QAAQ,EACpC;YAAsD,MAAM,EAAjD,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,MAAM;YACN,SAAS;YACM,IAAI,EAA/C,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,SAAS;SAChD;QAA4B,KAAK,EACjC;YAAoC,GAAG;SACvC;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,UAAU;SAClD;QAA4B,WAAW,EACvC;YAAwC,OAAO,EAC/C;gBAAiD,OAAO,EAA7C,OAAO;gBACwC,MAAM,EAArD,MAAY,IAAI;gBAC+B,OAAO,EAAtD,MAAY,IAAI;gBACsB,iBAAiB,EAAvD,OAAO;gBAC+C,UAAU,EAAhE,CAAS,IAAO,EAAP,OAAO,KAAG,IAAI;gBACwB,IAAI,EAAnD,MAAY,IAAI;gBACsB,MAAM,EAA5C,OAAO;aAClB;SAAA;QAA4B,UAAU,EACtC;YAAyC,IAAI;YACJ,UAAU;YACV,UAAU;YACV,kBAAkB;YAClB,kBAAkB;SAC3D;QAA8B,UAAU;QACV,IAAI;QACL,SAAS;QACR,MAAM;QACN,OAAO;QACP,GAAG;QACH,KAAK;QACa,QAAQ,EAA7C,MAAY,OAAO,CAAE,IAAI,CAAC;KACvC;;gCAr6D6D,wBAAwB"}
\ No newline at end of file

From 18d529562da51c6c30c9028b1e28d8c133c85efe Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Fri, 2 Oct 2026 13:04:20 -0700
Subject: [PATCH 43/49] test(lazy): guard that a lazy api.add loads only the
 shared subfolders it merges

A lazy api.slothlet.api.add() into an existing namespace loads exactly the
subfolders the collision merge has to compare: both sides of each subfolder
the two modules share. Every subfolder only the added module contributes
stays unloaded after the add, including once pending microtasks and timers
have run, and loads only on first access, one at a time. Eager mode is the
control.

The background loading reported in #548 could not be reproduced on next
across merge, merge-replace and replace, async and live runtimes, and hooks
on and off. What does start a load is reading a lazy subfolder through its
parent: the parent's get trap starts loading the child it hands out, with or
without an add (unified-wrapper.mjs, cached-child branch of the get trap).
A test that checks `api.plugins.kit.__materialized` therefore loads `kit`
itself. This test reaches each subfolder through own-property descriptors so
the check never triggers a load.

Refs #548
---
 .../shared/alpha.mjs                          |  25 +++
 api_tests/api_test_lazy_add_comount_a/top.mjs |  25 +++
 .../api_test_lazy_add_comount_b/gear/cog.mjs  |  25 +++
 .../gear/spring.mjs                           |  25 +++
 .../kit/box/nail.mjs                          |  25 +++
 .../api_test_lazy_add_comount_b/kit/tape.mjs  |  25 +++
 .../api_test_lazy_add_comount_b/net/dns.mjs   |  25 +++
 .../shared/beta.mjs                           |  25 +++
 .../shared/inner/gamma.mjs                    |  25 +++
 ...zy-comount-materialization.test.vitest.mjs | 161 ++++++++++++++++++
 10 files changed, 386 insertions(+)
 create mode 100644 api_tests/api_test_lazy_add_comount_a/shared/alpha.mjs
 create mode 100644 api_tests/api_test_lazy_add_comount_a/top.mjs
 create mode 100644 api_tests/api_test_lazy_add_comount_b/gear/cog.mjs
 create mode 100644 api_tests/api_test_lazy_add_comount_b/gear/spring.mjs
 create mode 100644 api_tests/api_test_lazy_add_comount_b/kit/box/nail.mjs
 create mode 100644 api_tests/api_test_lazy_add_comount_b/kit/tape.mjs
 create mode 100644 api_tests/api_test_lazy_add_comount_b/net/dns.mjs
 create mode 100644 api_tests/api_test_lazy_add_comount_b/shared/beta.mjs
 create mode 100644 api_tests/api_test_lazy_add_comount_b/shared/inner/gamma.mjs
 create mode 100644 tests/vitests/suites/addapi/addapi-lazy-comount-materialization.test.vitest.mjs

diff --git a/api_tests/api_test_lazy_add_comount_a/shared/alpha.mjs b/api_tests/api_test_lazy_add_comount_a/shared/alpha.mjs
new file mode 100644
index 000000000..bbb8101e7
--- /dev/null
+++ b/api_tests/api_test_lazy_add_comount_a/shared/alpha.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_lazy_add_comount_a/shared/alpha.mjs
+ *	@Date: 2026-10-02 12:32:25 -07:00 (1790969545)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 12:37:59 -07:00 (1790969879)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf the first module contributes to the shared subfolder (#548).
+ * @module api_test_lazy_add_comount_a.shared.alpha
+ */
+
+/**
+ * @function alpha
+ * @returns {string} `"a:alpha"`.
+ */
+export function alpha() {
+	return "a:alpha";
+}
diff --git a/api_tests/api_test_lazy_add_comount_a/top.mjs b/api_tests/api_test_lazy_add_comount_a/top.mjs
new file mode 100644
index 000000000..1018e98d5
--- /dev/null
+++ b/api_tests/api_test_lazy_add_comount_a/top.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_lazy_add_comount_a/top.mjs
+ *	@Date: 2026-10-02 12:32:25 -07:00 (1790969545)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 12:37:59 -07:00 (1790969879)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf only the first module contributes (#548).
+ * @module api_test_lazy_add_comount_a.top
+ */
+
+/**
+ * @function top
+ * @returns {string} `"a:top"`.
+ */
+export function top() {
+	return "a:top";
+}
diff --git a/api_tests/api_test_lazy_add_comount_b/gear/cog.mjs b/api_tests/api_test_lazy_add_comount_b/gear/cog.mjs
new file mode 100644
index 000000000..31b0b9ef1
--- /dev/null
+++ b/api_tests/api_test_lazy_add_comount_b/gear/cog.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_lazy_add_comount_b/gear/cog.mjs
+ *	@Date: 2026-10-02 12:32:25 -07:00 (1790969545)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 12:37:59 -07:00 (1790969879)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf in a subfolder only the second module contributes (#548).
+ * @module api_test_lazy_add_comount_b.gear.cog
+ */
+
+/**
+ * @function cog
+ * @returns {string} `"b:cog"`.
+ */
+export function cog() {
+	return "b:cog";
+}
diff --git a/api_tests/api_test_lazy_add_comount_b/gear/spring.mjs b/api_tests/api_test_lazy_add_comount_b/gear/spring.mjs
new file mode 100644
index 000000000..bf151c6ed
--- /dev/null
+++ b/api_tests/api_test_lazy_add_comount_b/gear/spring.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_lazy_add_comount_b/gear/spring.mjs
+ *	@Date: 2026-10-02 12:32:25 -07:00 (1790969545)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 12:37:59 -07:00 (1790969879)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Second leaf in a subfolder only the second module contributes (#548).
+ * @module api_test_lazy_add_comount_b.gear.spring
+ */
+
+/**
+ * @function spring
+ * @returns {string} `"b:spring"`.
+ */
+export function spring() {
+	return "b:spring";
+}
diff --git a/api_tests/api_test_lazy_add_comount_b/kit/box/nail.mjs b/api_tests/api_test_lazy_add_comount_b/kit/box/nail.mjs
new file mode 100644
index 000000000..a3114238b
--- /dev/null
+++ b/api_tests/api_test_lazy_add_comount_b/kit/box/nail.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_lazy_add_comount_b/kit/box/nail.mjs
+ *	@Date: 2026-10-02 12:32:25 -07:00 (1790969545)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 12:37:59 -07:00 (1790969879)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf two levels into a subfolder only the second module contributes (#548).
+ * @module api_test_lazy_add_comount_b.kit.box.nail
+ */
+
+/**
+ * @function nail
+ * @returns {string} `"b:nail"`.
+ */
+export function nail() {
+	return "b:nail";
+}
diff --git a/api_tests/api_test_lazy_add_comount_b/kit/tape.mjs b/api_tests/api_test_lazy_add_comount_b/kit/tape.mjs
new file mode 100644
index 000000000..578ed6f4c
--- /dev/null
+++ b/api_tests/api_test_lazy_add_comount_b/kit/tape.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_lazy_add_comount_b/kit/tape.mjs
+ *	@Date: 2026-10-02 12:32:25 -07:00 (1790969545)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 12:37:59 -07:00 (1790969879)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf in a subfolder only the second module contributes (#548).
+ * @module api_test_lazy_add_comount_b.kit.tape
+ */
+
+/**
+ * @function tape
+ * @returns {string} `"b:tape"`.
+ */
+export function tape() {
+	return "b:tape";
+}
diff --git a/api_tests/api_test_lazy_add_comount_b/net/dns.mjs b/api_tests/api_test_lazy_add_comount_b/net/dns.mjs
new file mode 100644
index 000000000..7e64df5ef
--- /dev/null
+++ b/api_tests/api_test_lazy_add_comount_b/net/dns.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_lazy_add_comount_b/net/dns.mjs
+ *	@Date: 2026-10-02 12:32:25 -07:00 (1790969545)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 12:37:59 -07:00 (1790969879)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf in a subfolder only the second module contributes (#548).
+ * @module api_test_lazy_add_comount_b.net.dns
+ */
+
+/**
+ * @function dns
+ * @returns {string} `"b:dns"`.
+ */
+export function dns() {
+	return "b:dns";
+}
diff --git a/api_tests/api_test_lazy_add_comount_b/shared/beta.mjs b/api_tests/api_test_lazy_add_comount_b/shared/beta.mjs
new file mode 100644
index 000000000..c867d525c
--- /dev/null
+++ b/api_tests/api_test_lazy_add_comount_b/shared/beta.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_lazy_add_comount_b/shared/beta.mjs
+ *	@Date: 2026-10-02 12:32:25 -07:00 (1790969545)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 12:38:03 -07:00 (1790969883)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf the second module contributes to the shared subfolder (#548).
+ * @module api_test_lazy_add_comount_b.shared.beta
+ */
+
+/**
+ * @function beta
+ * @returns {string} `"b:beta"`.
+ */
+export function beta() {
+	return "b:beta";
+}
diff --git a/api_tests/api_test_lazy_add_comount_b/shared/inner/gamma.mjs b/api_tests/api_test_lazy_add_comount_b/shared/inner/gamma.mjs
new file mode 100644
index 000000000..a07282bb7
--- /dev/null
+++ b/api_tests/api_test_lazy_add_comount_b/shared/inner/gamma.mjs
@@ -0,0 +1,25 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_lazy_add_comount_b/shared/inner/gamma.mjs
+ *	@Date: 2026-10-02 12:32:25 -07:00 (1790969545)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 12:38:03 -07:00 (1790969883)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Leaf in a subfolder only the second module contributes, inside the shared one (#548).
+ * @module api_test_lazy_add_comount_b.shared.inner.gamma
+ */
+
+/**
+ * @function gamma
+ * @returns {string} `"b:gamma"`.
+ */
+export function gamma() {
+	return "b:gamma";
+}
diff --git a/tests/vitests/suites/addapi/addapi-lazy-comount-materialization.test.vitest.mjs b/tests/vitests/suites/addapi/addapi-lazy-comount-materialization.test.vitest.mjs
new file mode 100644
index 000000000..3c82fe939
--- /dev/null
+++ b/tests/vitests/suites/addapi/addapi-lazy-comount-materialization.test.vitest.mjs
@@ -0,0 +1,161 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/addapi/addapi-lazy-comount-materialization.test.vitest.mjs
+ *	@Date: 2026-10-02 12:32:44 -07:00 (1790969564)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 12:43:14 -07:00 (1790970194)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview A lazy add into an existing namespace loads only what the merge inspects (#548).
+ *
+ * @description
+ * Module `a` is added at `plugins`, then module `b` is added at the same path. `plugins.shared` is a
+ * subfolder both modules contribute to, so the merge has to load both sides of it to combine their
+ * children. Every other subfolder `b` brings (`gear`, `kit`, `net`, and `shared.inner` inside the
+ * shared one) is `b`'s alone: nothing reads it during the add, so under lazy mode it must stay
+ * unmaterialized after the add — including once pending microtasks and timers have run — and load
+ * only on first access, one subfolder at a time. Eager mode is the control: there every subfolder
+ * is already loaded by the add.
+ *
+ * Materialization state is read through the public `__materialized` / `__inFlight` diagnostics on
+ * each subfolder, reached by own-property descriptors so the probe itself loads nothing. A plain
+ * property read (`api.plugins.kit`) would not do: handing out a reference to a lazy subfolder through
+ * its parent starts loading it, with or without an add.
+ *
+ * Runs across the full matrix (eager/lazy × async/live × hooks on/off).
+ *
+ * @module tests/vitests/suites/addapi/addapi-lazy-comount-materialization
+ */
+
+import { describe, it, expect, afterEach, vi } from "vitest";
+import path from "node:path";
+import slothlet from "@cldmv/slothlet";
+import { getMatrixConfigs, TEST_DIRS } from "../../setup/vitest-helper.mjs";
+
+// Instance creation plus two adds can exceed the default hook/test timeout on a loaded machine.
+vi.setConfig({ hookTimeout: 60000, testTimeout: 60000 });
+
+const API_TESTS_ROOT = path.dirname(TEST_DIRS.API_TEST);
+const A_DIR = path.join(API_TESTS_ROOT, "api_test_lazy_add_comount_a");
+const B_DIR = path.join(API_TESTS_ROOT, "api_test_lazy_add_comount_b");
+
+/** Subfolders only `b` contributes, relative to `api.plugins`. */
+const B_ONLY_FOLDERS = ["gear", "kit", "net", "shared.inner"];
+
+/** Every leaf under `api.plugins` once both modules are added, with the value each returns. */
+const LEAVES = {
+	top: "a:top",
+	"shared.alpha": "a:alpha",
+	"shared.beta": "b:beta",
+	"shared.inner.gamma": "b:gamma",
+	"gear.cog": "b:cog",
+	"gear.spring": "b:spring",
+	"kit.tape": "b:tape",
+	"kit.box.nail": "b:nail",
+	"net.dns": "b:dns"
+};
+
+/**
+ * Resolve a dotted path under `api.plugins`.
+ * @param {object} api - Slothlet API proxy.
+ * @param {string} dotted - Path relative to `api.plugins`.
+ * @returns {*} The value at that path, or undefined.
+ */
+function at(api, dotted) {
+	let cur = api.plugins;
+	for (const part of dotted.split(".")) {
+		if (cur === undefined || cur === null) return undefined;
+		cur = cur[part];
+	}
+	return cur;
+}
+
+/**
+ * Whether the namespace at a path has been loaded or has started loading.
+ * @description
+ * Reading a lazy child through its parent (`api.plugins.gear`) counts as accessing it and starts
+ * loading it, so this walks own-property descriptors instead: a descriptor read hands back the child
+ * without touching it, and `__materialized` / `__inFlight` are answered without loading anything.
+ * @param {object} api - Slothlet API proxy.
+ * @param {string} dotted - Path relative to `api.plugins`.
+ * @returns {boolean} True once the namespace is materialized or its materialization is in flight.
+ */
+function loaded(api, dotted) {
+	let node = api.plugins;
+	for (const part of dotted.split(".")) node = Object.getOwnPropertyDescriptor(node, part)?.value;
+	return node.__materialized === true || node.__inFlight === true;
+}
+
+/**
+ * Let pending microtasks, immediates and short timers run.
+ * @returns {Promise<void>}
+ */
+async function settle() {
+	await new Promise((resolve) => setImmediate(resolve));
+	await new Promise((resolve) => setTimeout(resolve, 50));
+}
+
+describe.each(getMatrixConfigs())("api.add into an existing namespace: materialization (#548) > Config: $name", ({ config }) => {
+	let api;
+
+	afterEach(async () => {
+		await api?.shutdown();
+		api = null;
+	});
+
+	/**
+	 * Create an instance and add `a` then `b` at `plugins`.
+	 * @returns {Promise<object>} Slothlet API proxy.
+	 */
+	async function createComounted() {
+		const instance = await slothlet({
+			...config,
+			base: TEST_DIRS.API_TEST,
+			api: { ...config.api, mutations: { add: true, remove: true, reload: true } }
+		});
+		await instance.slothlet.api.add("plugins", A_DIR, { moduleID: "a" });
+		await instance.slothlet.api.add("plugins", B_DIR, { moduleID: "b" });
+		return instance;
+	}
+
+	it.skipIf(config.mode !== "lazy")("leaves the added module's untouched subfolders unmaterialized", async () => {
+		api = await createComounted();
+		for (const folder of B_ONLY_FOLDERS) expect(loaded(api, folder), `plugins.${folder} right after the add`).toBe(false);
+
+		await settle();
+		for (const folder of B_ONLY_FOLDERS) expect(loaded(api, folder), `plugins.${folder} once the add has settled`).toBe(false);
+	});
+
+	it.skipIf(config.mode !== "lazy")("materializes only the subfolder that is accessed", async () => {
+		api = await createComounted();
+		await settle();
+
+		expect(await api.plugins.gear.cog()).toBe("b:cog");
+		await settle();
+
+		expect(loaded(api, "gear")).toBe(true);
+		for (const folder of B_ONLY_FOLDERS.filter((f) => f !== "gear")) {
+			expect(loaded(api, folder), `plugins.${folder} after reading plugins.gear`).toBe(false);
+		}
+	});
+
+	it.skipIf(config.mode !== "eager")("eager control: every subfolder is materialized by the add", async () => {
+		api = await createComounted();
+		for (const folder of B_ONLY_FOLDERS) expect(at(api, folder).__materialized, `plugins.${folder}`).toBe(true);
+	});
+
+	it("keeps every leaf of both modules reachable", async () => {
+		api = await createComounted();
+		for (const [dotted, expected] of Object.entries(LEAVES)) {
+			const fn = at(api, dotted);
+			expect(typeof fn, `api.plugins.${dotted}`).toBe("function");
+			expect(await fn(), `api.plugins.${dotted}()`).toBe(expected);
+		}
+	});
+});

From f703cd605d2262e5aac4e9532f722e5a2bb0533b Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Fri, 2 Oct 2026 12:44:30 -0700
Subject: [PATCH 44/49] fix(loader): keep helpers per instance across
 ESM/CommonJS boundaries

Per-instance helper isolation (#518) left two combinations shared by every
instance, because Node keys both on the plain file path:

- an ES module leaf importing a relative .cjs helper: the CommonJS translator
  caches the module under fileURLToPath(url), dropping the instance query;
- a CommonJS leaf require()ing an ES module: require(esm) compiles and caches
  the module under pathToFileURL(filename), so a query added by a resolve hook
  never reaches the ESM loader's cache.

The instance-import hooks now cover both directions:

- requireInInstance() holds the per-instance CommonJS cache, keyed by instance
  ID in process-wide state, and marks the scope active for the duration of its
  synchronous require. The loader's .cjs leaf path uses it; shutdown and a full
  reload release the old instance's scope.
- A load hook serves an instance-marked CommonJS URL as an ES module wrapper
  that runs the file through that cache. Named exports come from a static scan
  modelled on Node's cjs-module-lexer (exports.x, module.exports literals,
  defineProperty, re-exports, Babel/TS star exports), biased to report extra
  names rather than miss one, plus the live keys of an already-loaded copy.
- A relative require() from a file of the active scope that resolves to an ES
  module is answered with a CommonJS stub returning the module imported under
  the instance URL, through two virtual modules that reproduce Node's
  require(esm) value (the "module.exports" export, or the __esModule facade).
- The vite plugin loads instance-marked CommonJS helpers as the same wrapper,
  so their own requires are per instance under vitest too.

Fixes #534
---
 .configs/eslint.config.mjs                    |   8 +-
 .../__mixed/api/cjsesm/cjsesm.cjs             |  58 +++
 .../__mixed/api/esmcjs/esmcjs.mjs             |  67 +++
 .../__mixed/api/esmcjspeer/esmcjspeer.mjs     |  27 +
 .../__mixed/api/esmpeer/esmpeer.mjs           |  26 +
 .../__mixed/lib/cjs-counter.cjs               |  44 ++
 .../__mixed/lib/cjs-inner.cjs                 |  29 ++
 .../__mixed/lib/cjs-object.cjs                |  31 ++
 .../__mixed/lib/esm-chain.mjs                 |  27 +
 .../__mixed/lib/esm-counter.mjs               |  46 ++
 .../__mixed/lib/esm-deep.mjs                  |  27 +
 .../__mixed/lib/esm-plain.js                  |  28 ++
 .../__mixed/native-probe.mjs                  |  88 ++++
 docs/MODULE-STRUCTURE.md                      |  12 +-
 docs/TESTING.md                               |   2 +-
 src/lib/helpers/cjs-export-names.mjs          | 461 ++++++++++++++++++
 src/lib/helpers/instance-imports.mjs          | 410 +++++++++++++++-
 src/lib/processors/loader.mjs                 |  57 +--
 src/slothlet.mjs                              |   9 +-
 ...tance-imports-cross-format.test.vitest.mjs | 406 +++++++++++++++
 ...lper-imports-mixed-formats.test.vitest.mjs | 190 ++++++++
 types/src/lib/helpers/cjs-export-names.d.mts  |  33 ++
 .../lib/helpers/cjs-export-names.d.mts.map    |   1 +
 types/src/lib/helpers/instance-imports.d.mts  | 152 ++++--
 .../lib/helpers/instance-imports.d.mts.map    |   2 +-
 types/src/lib/processors/loader.d.mts.map     |   2 +-
 types/src/slothlet.d.mts.map                  |   2 +-
 27 files changed, 2133 insertions(+), 112 deletions(-)
 create mode 100644 api_tests/api_test_helper_imports/__mixed/api/cjsesm/cjsesm.cjs
 create mode 100644 api_tests/api_test_helper_imports/__mixed/api/esmcjs/esmcjs.mjs
 create mode 100644 api_tests/api_test_helper_imports/__mixed/api/esmcjspeer/esmcjspeer.mjs
 create mode 100644 api_tests/api_test_helper_imports/__mixed/api/esmpeer/esmpeer.mjs
 create mode 100644 api_tests/api_test_helper_imports/__mixed/lib/cjs-counter.cjs
 create mode 100644 api_tests/api_test_helper_imports/__mixed/lib/cjs-inner.cjs
 create mode 100644 api_tests/api_test_helper_imports/__mixed/lib/cjs-object.cjs
 create mode 100644 api_tests/api_test_helper_imports/__mixed/lib/esm-chain.mjs
 create mode 100644 api_tests/api_test_helper_imports/__mixed/lib/esm-counter.mjs
 create mode 100644 api_tests/api_test_helper_imports/__mixed/lib/esm-deep.mjs
 create mode 100644 api_tests/api_test_helper_imports/__mixed/lib/esm-plain.js
 create mode 100644 api_tests/api_test_helper_imports/__mixed/native-probe.mjs
 create mode 100644 src/lib/helpers/cjs-export-names.mjs
 create mode 100644 tests/vitests/suites/helpers/instance-imports-cross-format.test.vitest.mjs
 create mode 100644 tests/vitests/suites/isolation/helper-imports-mixed-formats.test.vitest.mjs
 create mode 100644 types/src/lib/helpers/cjs-export-names.d.mts
 create mode 100644 types/src/lib/helpers/cjs-export-names.d.mts.map

diff --git a/.configs/eslint.config.mjs b/.configs/eslint.config.mjs
index 518cb18ef..76de0eba3 100644
--- a/.configs/eslint.config.mjs
+++ b/.configs/eslint.config.mjs
@@ -73,9 +73,13 @@ export default defineConfig([
 	},
 	{ files: ["**/*.js"], languageOptions: { sourceType: "commonjs" } },
 	// ESM-syntax `.js` fixtures for #521 (a "type": "module" package and a package with no type field,
-	// which Node loads as ESM by syntax detection).
+	// which Node loads as ESM by syntax detection), and the `.js` ES module a CommonJS leaf requires (#534).
 	{
-		files: ["api_tests/api_test_cjs_js/esm/**/*.js", "api_tests/api_test_cjs_js/untypedesm/**/*.js"],
+		files: [
+			"api_tests/api_test_cjs_js/esm/**/*.js",
+			"api_tests/api_test_cjs_js/untypedesm/**/*.js",
+			"api_tests/api_test_helper_imports/__mixed/lib/esm-plain.js"
+		],
 		languageOptions: { sourceType: "module" }
 	},
 	{ files: ["**/*.{js,mjs,cjs}"], languageOptions: { globals: { ...globals.node, ...globals.browser } } },
diff --git a/api_tests/api_test_helper_imports/__mixed/api/cjsesm/cjsesm.cjs b/api_tests/api_test_helper_imports/__mixed/api/cjsesm/cjsesm.cjs
new file mode 100644
index 000000000..5e96a0a99
--- /dev/null
+++ b/api_tests/api_test_helper_imports/__mixed/api/cjsesm/cjsesm.cjs
@@ -0,0 +1,58 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_helper_imports/__mixed/api/cjsesm/cjsesm.cjs
+ *	@Date: 2026-10-02 12:27:51 -07:00 (1790969271)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 12:27:51 -07:00 (1790969271)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview CommonJS leaf that `require()`s relative ES modules and a CommonJS helper (#534).
+ * @module api_test_helper_imports.mixed.cjsesm
+ */
+const esm = require("../../lib/esm-counter.mjs");
+const plain = require("../../lib/esm-plain.js");
+const counter = require("../../lib/cjs-counter.cjs");
+
+module.exports = {
+	/**
+	 * Bump the `esm-counter.mjs` counter.
+	 * @returns {number} The counter after incrementing.
+	 */
+	count() {
+		return esm.bump();
+	},
+	/**
+	 * Bump the helper below `esm-counter.mjs`.
+	 * @returns {number} The counter after incrementing.
+	 */
+	chain() {
+		return esm.chain();
+	},
+	/**
+	 * Bump the `.js` ES module's counter.
+	 * @returns {number} The counter after incrementing.
+	 */
+	plain() {
+		return plain.bump();
+	},
+	/**
+	 * Bump the `cjs-counter.cjs` counter the ESM leaves also import.
+	 * @returns {number} The counter after incrementing.
+	 */
+	cjs() {
+		return counter.bump();
+	},
+	/**
+	 * Describe what `require()` returned for an ES module with a default export.
+	 * @returns {{ esModule: boolean, defaultType: string }} Node's `__esModule` flag and the default export's type.
+	 */
+	interop() {
+		return { esModule: esm.__esModule === true, defaultType: typeof esm.default };
+	}
+};
diff --git a/api_tests/api_test_helper_imports/__mixed/api/esmcjs/esmcjs.mjs b/api_tests/api_test_helper_imports/__mixed/api/esmcjs/esmcjs.mjs
new file mode 100644
index 000000000..e3a22a5ac
--- /dev/null
+++ b/api_tests/api_test_helper_imports/__mixed/api/esmcjs/esmcjs.mjs
@@ -0,0 +1,67 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_helper_imports/__mixed/api/esmcjs/esmcjs.mjs
+ *	@Date: 2026-10-02 12:27:51 -07:00 (1790969271)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 12:27:51 -07:00 (1790969271)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview ESM leaf importing relative CommonJS helpers (#534).
+ * @module api_test_helper_imports.mixed.esmcjs
+ */
+import counter, { bump, innerBump, deepBump } from "../../lib/cjs-counter.cjs";
+import objectHelper, { bump as objectBump, label } from "../../lib/cjs-object.cjs";
+
+/**
+ * Bump the `cjs-counter.cjs` counter through a named import.
+ * @returns {number} The counter after incrementing.
+ */
+export function count() {
+	return bump();
+}
+
+/**
+ * Bump the `cjs-counter.cjs` counter through the default import (`module.exports`).
+ * @returns {number} The counter after incrementing.
+ */
+export function viaDefault() {
+	return counter.bump();
+}
+
+/**
+ * Bump the CommonJS helper below `cjs-counter.cjs`.
+ * @returns {number} The counter after incrementing.
+ */
+export function inner() {
+	return innerBump();
+}
+
+/**
+ * Bump the ES module `cjs-counter.cjs` requires.
+ * @returns {number} The counter after incrementing.
+ */
+export function deep() {
+	return deepBump();
+}
+
+/**
+ * Bump the `module.exports = { … }` helper through a named import.
+ * @returns {number} The counter after incrementing.
+ */
+export function object() {
+	return objectBump();
+}
+
+/**
+ * Describe how the object-literal helper was imported.
+ * @returns {{ defaultIsExports: boolean, label: string }} Whether the default import is `module.exports`, and the named `label`.
+ */
+export function shape() {
+	return { defaultIsExports: objectHelper.bump === objectBump, label };
+}
diff --git a/api_tests/api_test_helper_imports/__mixed/api/esmcjspeer/esmcjspeer.mjs b/api_tests/api_test_helper_imports/__mixed/api/esmcjspeer/esmcjspeer.mjs
new file mode 100644
index 000000000..2c3d5785c
--- /dev/null
+++ b/api_tests/api_test_helper_imports/__mixed/api/esmcjspeer/esmcjspeer.mjs
@@ -0,0 +1,27 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_helper_imports/__mixed/api/esmcjspeer/esmcjspeer.mjs
+ *	@Date: 2026-10-02 12:27:51 -07:00 (1790969271)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 12:27:51 -07:00 (1790969271)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Second ESM leaf importing the same CommonJS helper as `esmcjs` — within one instance
+ * both must see ONE helper copy (#534).
+ * @module api_test_helper_imports.mixed.esmcjspeer
+ */
+import { bump } from "../../lib/cjs-counter.cjs";
+
+/**
+ * Bump the `cjs-counter.cjs` counter.
+ * @returns {number} The counter after incrementing.
+ */
+export function count() {
+	return bump();
+}
diff --git a/api_tests/api_test_helper_imports/__mixed/api/esmpeer/esmpeer.mjs b/api_tests/api_test_helper_imports/__mixed/api/esmpeer/esmpeer.mjs
new file mode 100644
index 000000000..57603f09a
--- /dev/null
+++ b/api_tests/api_test_helper_imports/__mixed/api/esmpeer/esmpeer.mjs
@@ -0,0 +1,26 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_helper_imports/__mixed/api/esmpeer/esmpeer.mjs
+ *	@Date: 2026-10-02 12:27:51 -07:00 (1790969271)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 12:27:51 -07:00 (1790969271)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview ESM leaf importing the ES module the `cjsesm` leaf requires (#534).
+ * @module api_test_helper_imports.mixed.esmpeer
+ */
+import { bump } from "../../lib/esm-counter.mjs";
+
+/**
+ * Bump the `esm-counter.mjs` counter.
+ * @returns {number} The counter after incrementing.
+ */
+export function count() {
+	return bump();
+}
diff --git a/api_tests/api_test_helper_imports/__mixed/lib/cjs-counter.cjs b/api_tests/api_test_helper_imports/__mixed/lib/cjs-counter.cjs
new file mode 100644
index 000000000..b18b59814
--- /dev/null
+++ b/api_tests/api_test_helper_imports/__mixed/lib/cjs-counter.cjs
@@ -0,0 +1,44 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_helper_imports/__mixed/lib/cjs-counter.cjs
+ *	@Date: 2026-10-02 12:27:51 -07:00 (1790969271)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 12:27:51 -07:00 (1790969271)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview CommonJS helper imported by ESM leaves (#534). Uses `exports.x =` assignments and
+ * requires a second-level CommonJS helper and an ES module, so isolation is proven below it in both
+ * module systems.
+ * @module api_test_helper_imports.mixed.lib.cjsCounter
+ * @internal
+ */
+const inner = require("./cjs-inner.cjs");
+const deep = require("./esm-deep.mjs");
+
+let count = 0;
+
+/**
+ * Increment this module's counter.
+ * @returns {number} The counter after incrementing.
+ */
+exports.bump = function bump() {
+	return ++count;
+};
+
+/**
+ * Increment the second-level CommonJS helper's counter.
+ * @returns {number} The counter after incrementing.
+ */
+exports.innerBump = () => inner.bump();
+
+/**
+ * Increment the counter of the ES module this helper requires.
+ * @returns {number} The counter after incrementing.
+ */
+exports.deepBump = () => deep.bump();
diff --git a/api_tests/api_test_helper_imports/__mixed/lib/cjs-inner.cjs b/api_tests/api_test_helper_imports/__mixed/lib/cjs-inner.cjs
new file mode 100644
index 000000000..513f942b8
--- /dev/null
+++ b/api_tests/api_test_helper_imports/__mixed/lib/cjs-inner.cjs
@@ -0,0 +1,29 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_helper_imports/__mixed/lib/cjs-inner.cjs
+ *	@Date: 2026-10-02 12:27:51 -07:00 (1790969271)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 12:27:51 -07:00 (1790969271)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Second-level CommonJS helper below `cjs-counter.cjs` (#534).
+ * @module api_test_helper_imports.mixed.lib.cjsInner
+ * @internal
+ */
+let count = 0;
+
+module.exports = {
+	/**
+	 * Increment this module's counter.
+	 * @returns {number} The counter after incrementing.
+	 */
+	bump() {
+		return ++count;
+	}
+};
diff --git a/api_tests/api_test_helper_imports/__mixed/lib/cjs-object.cjs b/api_tests/api_test_helper_imports/__mixed/lib/cjs-object.cjs
new file mode 100644
index 000000000..b0784b7e1
--- /dev/null
+++ b/api_tests/api_test_helper_imports/__mixed/lib/cjs-object.cjs
@@ -0,0 +1,31 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_helper_imports/__mixed/lib/cjs-object.cjs
+ *	@Date: 2026-10-02 12:27:51 -07:00 (1790969271)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 12:27:51 -07:00 (1790969271)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview CommonJS helper exporting a `module.exports = { … }` object literal (#534): its keys
+ * must still be importable as named exports by an ESM leaf.
+ * @module api_test_helper_imports.mixed.lib.cjsObject
+ * @internal
+ */
+let count = 0;
+const label = "object";
+
+/**
+ * Increment this module's counter.
+ * @returns {number} The counter after incrementing.
+ */
+function bump() {
+	return ++count;
+}
+
+module.exports = { bump, label };
diff --git a/api_tests/api_test_helper_imports/__mixed/lib/esm-chain.mjs b/api_tests/api_test_helper_imports/__mixed/lib/esm-chain.mjs
new file mode 100644
index 000000000..6b73828b4
--- /dev/null
+++ b/api_tests/api_test_helper_imports/__mixed/lib/esm-chain.mjs
@@ -0,0 +1,27 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_helper_imports/__mixed/lib/esm-chain.mjs
+ *	@Date: 2026-10-02 12:27:51 -07:00 (1790969271)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 12:27:51 -07:00 (1790969271)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Second-level ES module below `esm-counter.mjs` (#534).
+ * @module api_test_helper_imports.mixed.lib.esmChain
+ * @internal
+ */
+let count = 0;
+
+/**
+ * Increment this module's counter.
+ * @returns {number} The counter after incrementing.
+ */
+export function bump() {
+	return ++count;
+}
diff --git a/api_tests/api_test_helper_imports/__mixed/lib/esm-counter.mjs b/api_tests/api_test_helper_imports/__mixed/lib/esm-counter.mjs
new file mode 100644
index 000000000..e31cff791
--- /dev/null
+++ b/api_tests/api_test_helper_imports/__mixed/lib/esm-counter.mjs
@@ -0,0 +1,46 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_helper_imports/__mixed/lib/esm-counter.mjs
+ *	@Date: 2026-10-02 12:27:51 -07:00 (1790969271)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 12:27:51 -07:00 (1790969271)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview ES module required by a CommonJS leaf and imported by an ESM leaf (#534). It has a
+ * default export, so `require()` returns Node's `__esModule` facade, and imports a second-level helper.
+ * @module api_test_helper_imports.mixed.lib.esmCounter
+ * @internal
+ */
+import { bump as chainBump } from "./esm-chain.mjs";
+
+let count = 0;
+
+/**
+ * Increment this module's counter.
+ * @returns {number} The counter after incrementing.
+ */
+export function bump() {
+	return ++count;
+}
+
+/**
+ * Increment the second-level helper's counter.
+ * @returns {number} The counter after incrementing.
+ */
+export function chain() {
+	return chainBump();
+}
+
+/**
+ * Default export: also increments this module's counter.
+ * @returns {number} The counter after incrementing.
+ */
+export default function defaultBump() {
+	return ++count;
+}
diff --git a/api_tests/api_test_helper_imports/__mixed/lib/esm-deep.mjs b/api_tests/api_test_helper_imports/__mixed/lib/esm-deep.mjs
new file mode 100644
index 000000000..6a94de979
--- /dev/null
+++ b/api_tests/api_test_helper_imports/__mixed/lib/esm-deep.mjs
@@ -0,0 +1,27 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_helper_imports/__mixed/lib/esm-deep.mjs
+ *	@Date: 2026-10-02 12:27:51 -07:00 (1790969271)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 12:27:51 -07:00 (1790969271)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview ES module required by the CommonJS helper `cjs-counter.cjs` (#534).
+ * @module api_test_helper_imports.mixed.lib.esmDeep
+ * @internal
+ */
+let count = 0;
+
+/**
+ * Increment this module's counter.
+ * @returns {number} The counter after incrementing.
+ */
+export function bump() {
+	return ++count;
+}
diff --git a/api_tests/api_test_helper_imports/__mixed/lib/esm-plain.js b/api_tests/api_test_helper_imports/__mixed/lib/esm-plain.js
new file mode 100644
index 000000000..7f5d33d59
--- /dev/null
+++ b/api_tests/api_test_helper_imports/__mixed/lib/esm-plain.js
@@ -0,0 +1,28 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_helper_imports/__mixed/lib/esm-plain.js
+ *	@Date: 2026-10-02 12:27:51 -07:00 (1790969271)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 12:27:51 -07:00 (1790969271)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview An ES module with a `.js` extension (the package scope is `"type": "module"`),
+ * required by a CommonJS leaf (#534).
+ * @module api_test_helper_imports.mixed.lib.esmPlain
+ * @internal
+ */
+let count = 0;
+
+/**
+ * Increment this module's counter.
+ * @returns {number} The counter after incrementing.
+ */
+export function bump() {
+	return ++count;
+}
diff --git a/api_tests/api_test_helper_imports/__mixed/native-probe.mjs b/api_tests/api_test_helper_imports/__mixed/native-probe.mjs
new file mode 100644
index 000000000..bc5aaea20
--- /dev/null
+++ b/api_tests/api_test_helper_imports/__mixed/native-probe.mjs
@@ -0,0 +1,88 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_helper_imports/__mixed/native-probe.mjs
+ *	@Date: 2026-10-02 12:27:51 -07:00 (1790969271)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 12:27:51 -07:00 (1790969271)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Native-Node probe for #534: composes the mixed-format fixture OUTSIDE any vite module
+ * graph, so ESM→CommonJS imports and CommonJS→ESM `require()` calls go through Node's own loaders and
+ * slothlet's module hooks. Prints one JSON line of observed counters for the test to assert on.
+ * @module api_test_helper_imports.mixed.nativeProbe
+ * @internal
+ */
+import slothlet from "@cldmv/slothlet";
+
+const base = new URL("./api/", import.meta.url).pathname;
+const out = {};
+
+for (const mode of ["eager", "lazy"]) {
+	const r = {};
+	const a = await slothlet({ mode, base, silent: true });
+	const b = await slothlet({ mode, base, silent: true });
+	// ESM leaf → .cjs helper: named import (a, a, b), then the default import (module.exports) for a and b.
+	r.esmToCjs = [
+		await a.esmcjs.count(),
+		await a.esmcjs.count(),
+		await b.esmcjs.count(),
+		await a.esmcjs.viaDefault(),
+		await b.esmcjs.viaDefault()
+	];
+	// Below the .cjs helper: its CommonJS require (a, a, b) and its require() of an ES module (a, a, b).
+	r.esmToCjsChain = [
+		await a.esmcjs.inner(),
+		await a.esmcjs.inner(),
+		await b.esmcjs.inner(),
+		await a.esmcjs.deep(),
+		await a.esmcjs.deep(),
+		await b.esmcjs.deep()
+	];
+	r.esmToCjsObject = [await a.esmcjs.object(), await a.esmcjs.object(), await b.esmcjs.object()];
+	r.esmToCjsShape = await a.esmcjs.shape();
+	r.esmToCjsPeer = [await a.esmcjspeer.count(), await b.esmcjspeer.count()];
+	// .cjs leaf → .mjs helper (a, a, b), its own import chain (a, b), and a `.js` ES module (a, a, b).
+	r.cjsToEsm = [
+		await a.cjsesm.count(),
+		await a.cjsesm.count(),
+		await b.cjsesm.count(),
+		await a.cjsesm.chain(),
+		await b.cjsesm.chain(),
+		await a.cjsesm.plain(),
+		await a.cjsesm.plain(),
+		await b.cjsesm.plain()
+	];
+	r.cjsToEsmInterop = await a.cjsesm.interop();
+	// One copy per instance across module systems: an ESM leaf importing the .mjs helper the .cjs leaf
+	// requires, and the .cjs leaf requiring the .cjs helper the ESM leaves import.
+	r.crossFormat = [await a.esmpeer.count(), await b.esmpeer.count(), await a.cjsesm.cjs(), await b.cjsesm.cjs()];
+	await a.slothlet.reload();
+	r.afterFullReload = [
+		await a.esmcjs.count(),
+		await a.esmcjs.deep(),
+		await a.cjsesm.count(),
+		await a.cjsesm.chain(),
+		await a.cjsesm.plain(),
+		await b.esmcjs.count()
+	];
+	await b.slothlet.api.reload("esmcjs");
+	await b.slothlet.api.reload("cjsesm");
+	r.afterPartialReload = [
+		await b.esmcjs.count(),
+		await b.esmcjs.deep(),
+		await b.cjsesm.count(),
+		await b.cjsesm.plain(),
+		await a.esmcjs.count()
+	];
+	await a.shutdown();
+	await b.shutdown();
+	out[mode] = r;
+}
+
+process.stdout.write(JSON.stringify(out) + "\n");
diff --git a/docs/MODULE-STRUCTURE.md b/docs/MODULE-STRUCTURE.md
index 9c0240d8d..9298cdc70 100644
--- a/docs/MODULE-STRUCTURE.md
+++ b/docs/MODULE-STRUCTURE.md
@@ -464,7 +464,7 @@ api.util.url.builder.buildUrl("https://example.com", "path");
 
 ## Helper Modules Are Per Instance
 
-Every slothlet instance loads its own copy of each leaf. The modules a leaf imports through **relative or `file:` specifiers** — at any depth, from `.mjs` / `.js`, `.ts` / `.mts`, or `.cjs` leaves — belong to that same instance: each instance gets its own copy, so module-level state in a helper never leaks from one instance into another.
+Every slothlet instance loads its own copy of each leaf. The modules a leaf imports through **relative or `file:` specifiers** — at any depth, from `.mjs` / `.js`, `.ts` / `.mts`, or `.cjs` leaves, and across module systems (an ES module leaf importing a `.cjs` helper, a CommonJS leaf `require()`ing an ES module) — belong to that same instance: each instance gets its own copy, so module-level state in a helper never leaks from one instance into another.
 
 ```text
 project/
@@ -502,13 +502,19 @@ Shared across instances, never duplicated:
 - **Bare specifiers** — `node_modules` packages, `node:` builtins, subpath `#imports`, and `@cldmv/slothlet` itself (its runtime, `@cldmv/slothlet/runtime`, stays the single live-binding runtime every instance uses).
 - **Files inside another `node_modules` package**, even when reached by a relative path. A leaf that lives inside an installed package (a plugin mounted from `node_modules`) still gets its own package's relative helpers per instance.
 
-How it works: the loader imports each leaf with a per-instance query (`?slothlet_instance=…`, plus `&module=…` for `api.slothlet.api.add` mounts and `&_reload=…` during a reload). Under Node, a resolve hook slothlet registers once per process copies the instance parameter — not the mount or the reload stamp — onto every relative / `file:` import below the leaf. CommonJS leaves keep a private `require` cache per instance for the files they reach. When leaves load through a vite module graph instead — slothlet's `import` hook or `server.deps.inline` under vitest — add the `slothletInstanceImports()` plugin; see [TESTING.md](TESTING.md#per-instance-helpers-under-vitest-slothletinstanceimports).
+How it works: the loader imports each leaf with a per-instance query (`?slothlet_instance=…`, plus `&module=…` for `api.slothlet.api.add` mounts and `&_reload=…` during a reload). Under Node, a resolve hook slothlet registers once per process copies the instance parameter — not the mount or the reload stamp — onto every relative / `file:` import below the leaf. CommonJS code runs through a private `require` cache per instance for the files it reaches. When leaves load through a vite module graph instead — slothlet's `import` hook or `server.deps.inline` under vitest — add the `slothletInstanceImports()` plugin; see [TESTING.md](TESTING.md#per-instance-helpers-under-vitest-slothletinstanceimports).
+
+Node caches CommonJS by file path and loads a `require()`d ES module under its plain file URL, so a query alone cannot separate instances where the two module systems meet. A load hook covers both directions:
+
+- **ES module → `.cjs` helper.** The helper is served as a small ES module wrapper that runs the file through the instance's CommonJS cache — the same copy the instance's `.cjs` leaves `require()`. The import keeps Node's shape: `default` is `module.exports`, and the named exports are the ones Node finds by reading the source (`exports.x = …`, `module.exports = { a, b }`, `Object.defineProperty(exports, "x", …)`, re-exports of other CommonJS files). Slothlet reads them with its own static scan, which can find a few more names than Node does — those read `undefined`, as a missing key would — but never fewer. Once the instance has already loaded the helper, its actual `module.exports` keys count too, as they do in Node.
+- **`.cjs` code → ES module.** While a CommonJS leaf (or a CommonJS helper of the instance) is being loaded, a relative `require()` that resolves to an ES module returns the instance's copy — the same module an ES module leaf of the instance imports. The value is what Node's `require(esm)` returns: the namespace, its `"module.exports"` export if it has one, or for a module with a default export the namespace with `__esModule: true`.
 
 Limits of the rule:
 
 - **Helper code edits need a full reload.** A partial reload keeps the instance's helper copy (see above); `api.slothlet.reload({ keepInstanceID: true })` keeps the instance ID and so keeps the helper copy too.
 - **Node 22.15 or later.** Helper isolation uses `module.registerHooks()`, the synchronous in-thread resolve hook added in Node 22.15 / 23.5, so slothlet requires Node 22.15+. It adds no measurable overhead. The off-thread `module.register()` is not used: it puts a cross-thread round trip on every import in the process (roughly 1.5–2× the cost of an uncached import) and changes evaluation timing enough that a leaf starting a fire-and-forget `import("@cldmv/slothlet/runtime")` could be called before the import settles.
-- **Mixed module systems.** An ESM leaf that `import`s a relative `.cjs` helper, and a CommonJS leaf that `require()`s an ES module, cross into a loader cache keyed by file path alone — those modules are shared across instances.
+- **Requires that run after a CommonJS module has loaded.** The per-instance `require` cache is in place only while a CommonJS leaf or helper is being loaded. A `require()` — or `import()` — that a CommonJS module makes later, inside a function the api calls, reaches the shared copy. Require helpers at the top of the file.
+- **ES modules required under vitest.** A `.cjs` leaf always loads natively, so an ES module it `require()`s is Node's per-instance copy, while the instance's ES module leaves import their copy through vite's module graph — two copies within one instance (each still separate from other instances). `.cjs` helpers do not have this split: the plugin serves them through the same per-instance CommonJS cache.
 - Browser mode loads leaves from the manifest without a per-instance query, so neither leaves nor their helpers are per instance there.
 
 ---
diff --git a/docs/TESTING.md b/docs/TESTING.md
index 48da6a017..bbbbbb92d 100644
--- a/docs/TESTING.md
+++ b/docs/TESTING.md
@@ -150,7 +150,7 @@ export default defineConfig({
 });
 ```
 
-The plugin applies the same rule as the Node hook: only relative / `file:` specifiers imported by a module that carries a slothlet instance query are rewritten; bare packages, `node:` builtins and `@cldmv/slothlet` itself stay shared. A plain test run that leaves slothlet externalized and sets no `import` importer does not need it — the leaves then load natively and the Node hook covers them.
+The plugin applies the same rule as the Node hook: only relative / `file:` specifiers imported by a module that carries a slothlet instance query are rewritten; bare packages, `node:` builtins and `@cldmv/slothlet` itself stay shared. A CommonJS helper imported this way (a `.cjs` file, or a `.js` file Node treats as CommonJS) is loaded as the same per-instance wrapper the Node hook uses, so the helper and everything it `require()`s run natively through the instance's CommonJS cache, shared with the instance's `.cjs` leaves. A plain test run that leaves slothlet externalized and sets no `import` importer does not need the plugin — the leaves then load natively and the Node hook covers them.
 
 ## Scope
 
diff --git a/src/lib/helpers/cjs-export-names.mjs b/src/lib/helpers/cjs-export-names.mjs
new file mode 100644
index 000000000..dd93542e9
--- /dev/null
+++ b/src/lib/helpers/cjs-export-names.mjs
@@ -0,0 +1,461 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /src/lib/helpers/cjs-export-names.mjs
+ *	@Date: 2026-10-02 12:27:51 -07:00 (1790969271)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 12:27:51 -07:00 (1790969271)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Static detection of a CommonJS module's named exports (#534).
+ * @module @cldmv/slothlet/helpers/cjs-export-names
+ *
+ * @description
+ * When an ESM leaf imports a CommonJS helper, Node exposes `default` (= `module.exports`) plus the
+ * names its built-in lexer (cjs-module-lexer) finds by reading the source — the module has not run
+ * yet when the importer links, so the names must come from the text. Slothlet's per-instance wrapper
+ * for such a helper (see `instance-imports.mjs`) has to declare its export names at the same point,
+ * so it reads them the same way.
+ *
+ * The scan recognises the patterns Node's lexer documents:
+ *
+ * - `exports.name = …`, `exports["name"] = …`, and the `module.exports.` forms of both;
+ * - `Object.defineProperty(exports, "name", …)` (also on `module.exports`);
+ * - `module.exports = { a, b: c, "d": e, f() {}, ...require("./x") }` object literals, including
+ *   esbuild's `0 && (module.exports = { … })` annotation;
+ * - re-exports: `module.exports = require("./x")`, `...require("./x")` in the literal,
+ *   `__exportStar(require("./x"), exports)` and `__export(require("./x"))`, followed into the
+ *   required file.
+ *
+ * It errs towards MORE names than Node's lexer, never fewer: an object-literal key is taken whatever
+ * its value expression is, and a pattern inside a comment-free string still counts. An extra name is
+ * harmless (it reads `undefined` from `module.exports`, as a real import of a missing key would),
+ * while a missing one would turn an import that links natively into a SyntaxError.
+ */
+
+/**
+ * Characters after which a `/` starts a regular-expression literal rather than a division.
+ * @type {string}
+ * @private
+ */
+const REGEX_PREFIX_CHARS = "(,=:[!&|?{};+-*%<>~^";
+
+/**
+ * Keywords after which a `/` starts a regular-expression literal.
+ * @type {Set<string>}
+ * @private
+ */
+const REGEX_PREFIX_WORDS = new Set([
+	"return",
+	"typeof",
+	"instanceof",
+	"in",
+	"of",
+	"new",
+	"delete",
+	"void",
+	"throw",
+	"case",
+	"do",
+	"else",
+	"yield",
+	"await"
+]);
+
+/**
+ * Index just past the string literal starting at `start` (a `'` or `"`).
+ * @param {string} src - Source text.
+ * @param {number} start - Index of the opening quote.
+ * @returns {number} Index after the closing quote (or the end of the text).
+ * @private
+ */
+function skipString(src, start) {
+	const quote = src[start];
+	let i = start + 1;
+	while (i < src.length) {
+		const ch = src[i];
+		if (ch === "\\") i += 2;
+		else if (ch === quote || ch === "\n") return i + 1;
+		else i++;
+	}
+	return i;
+}
+
+/**
+ * Replace every comment with spaces, keeping strings, template literals and regular expressions
+ * intact (so a `//` or `/*` inside them is not mistaken for a comment). Line breaks are preserved.
+ * @param {string} src - Source text.
+ * @returns {string} The source without comments.
+ * @private
+ */
+function stripComments(src) {
+	let out = "";
+	let i = 0;
+	let last = "";
+	// Brace depth of each open `${` in a template literal, innermost last.
+	const templates = [];
+	let depth = 0;
+	/**
+	 * Copy a template literal's text from `i` until its end or its next `${`.
+	 * @returns {void}
+	 */
+	const templateText = () => {
+		while (i < src.length) {
+			const ch = src[i];
+			if (ch === "\\") {
+				out += src.slice(i, i + 2);
+				i += 2;
+			} else if (ch === "`") {
+				out += ch;
+				i++;
+				last = "`";
+				return;
+			} else if (ch === "$" && src[i + 1] === "{") {
+				out += "${";
+				i += 2;
+				templates.push(depth);
+				depth++;
+				last = "{";
+				return;
+			} else {
+				out += ch;
+				i++;
+			}
+		}
+	};
+	while (i < src.length) {
+		const ch = src[i];
+		const next = src[i + 1];
+		if (ch === "/" && next === "/") {
+			while (i < src.length && src[i] !== "\n") {
+				out += " ";
+				i++;
+			}
+		} else if (ch === "/" && next === "*") {
+			const end = src.indexOf("*/", i + 2);
+			const stop = end === -1 ? src.length : end + 2;
+			out += src.slice(i, stop).replace(/[^\n]/g, " ");
+			i = stop;
+		} else if (ch === "'" || ch === '"') {
+			const end = skipString(src, i);
+			out += src.slice(i, end);
+			i = end;
+			last = ch;
+		} else if (ch === "`") {
+			out += ch;
+			i++;
+			templateText();
+		} else if (ch === "/") {
+			const word = /([A-Za-z_$][\w$]*)\s*$/.exec(out);
+			const isRegex = last === "" || REGEX_PREFIX_CHARS.includes(last) || (word !== null && REGEX_PREFIX_WORDS.has(word[1]));
+			if (isRegex) {
+				let j = i + 1;
+				let inClass = false;
+				while (j < src.length && src[j] !== "\n") {
+					const c = src[j];
+					if (c === "\\") j++;
+					else if (c === "[") inClass = true;
+					else if (c === "]") inClass = false;
+					else if (c === "/" && !inClass) break;
+					j++;
+				}
+				// A regular expression's body never names an export; blank it so a bracket or quote in it
+				// cannot unbalance the object-literal walk.
+				out += "/" + " ".repeat(Math.max(0, j - i - 1)) + "/";
+				i = j + 1;
+				last = "/";
+			} else {
+				out += ch;
+				i++;
+				last = ch;
+			}
+		} else {
+			if (ch === "{") depth++;
+			else if (ch === "}") {
+				depth--;
+				if (templates.length && templates[templates.length - 1] === depth) {
+					templates.pop();
+					out += ch;
+					i++;
+					templateText();
+					continue;
+				}
+			}
+			out += ch;
+			i++;
+			if (!/\s/.test(ch)) last = /[\w$]/.test(ch) ? "a" : ch;
+		}
+	}
+	return out;
+}
+
+/**
+ * Single-character escapes of a JavaScript string literal, mapped to the character they stand for.
+ * @type {Readonly<Record<string, string>>}
+ * @private
+ */
+const SIMPLE_ESCAPES = Object.freeze({ b: "\b", f: "\f", n: "\n", r: "\r", t: "\t", v: "\v", 0: "\0" });
+
+/**
+ * Decode the body of a quoted JavaScript string literal (without its quotes), the way the language
+ * does: `\n`-style escapes, `\xHH`, `\uHHHH`, `\u{H…}`, line continuations, and any other escaped
+ * character standing for itself (`\\`, `\'`, `\"`). A malformed `\x` / `\u` escape is a syntax
+ * error in JavaScript, so such a body is returned undecoded.
+ * @param {string} body - The text between the quotes.
+ * @returns {string} The decoded string, or the raw body when it holds a malformed escape.
+ * @private
+ */
+function decodeStringBody(body) {
+	if (/\\(?:x(?![\da-f]{2})|u(?![\da-f]{4}|\{[\da-f]{1,6}\}))/i.test(body.replace(/\\\\/g, ""))) return body;
+	// A line continuation is `\` + any line terminator; CRLF and CR count as one, so fold them to LF.
+	body = body.replace(/\r\n?/g, "\n");
+	let out = "";
+	for (let i = 0; i < body.length; i++) {
+		const ch = body[i];
+		if (ch !== "\\" || i === body.length - 1) {
+			out += ch;
+			continue;
+		}
+		const next = body[++i];
+		if (next in SIMPLE_ESCAPES) out += SIMPLE_ESCAPES[next];
+		else if (next === "x" && /^[\da-f]{2}$/i.test(body.slice(i + 1, i + 3))) {
+			out += String.fromCharCode(parseInt(body.slice(i + 1, i + 3), 16));
+			i += 2;
+		} else if (next === "u" && body[i + 1] === "{") {
+			const close = body.indexOf("}", i + 2);
+			const codePoint = parseInt(body.slice(i + 2, close), 16);
+			// An out-of-range code point is a syntax error in JavaScript: keep the raw body.
+			if (codePoint > 0x10ffff) return body;
+			out += String.fromCodePoint(codePoint);
+			i = close;
+		} else if (next === "u" && /^[\da-f]{4}$/i.test(body.slice(i + 1, i + 5))) {
+			out += String.fromCharCode(parseInt(body.slice(i + 1, i + 5), 16));
+			i += 4;
+		} else if (next !== "\n" && next !== "\u2028" && next !== "\u2029") out += next; // else a line continuation
+	}
+	return out;
+}
+
+/**
+ * Escape every regular-expression metacharacter in a string so it matches literally.
+ * @param {string} text - Text to embed in a RegExp source.
+ * @returns {string} The escaped text.
+ * @private
+ */
+function escapeRegExp(text) {
+	return text.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&");
+}
+
+/**
+ * Index just past a bracketed or quoted construct starting at `start`, or past one other character.
+ * @param {string} src - Comment-free source.
+ * @param {number} start - Index of the construct.
+ * @returns {number} Index after it.
+ * @private
+ */
+function skipBalanced(src, start) {
+	const ch = src[start];
+	if (ch === "'" || ch === '"') return skipString(src, start);
+	if (ch === "`") {
+		let i = start + 1;
+		while (i < src.length && src[i] !== "`") {
+			if (src[i] === "\\") i++;
+			else if (src[i] === "$" && src[i + 1] === "{") {
+				i = skipBalanced(src, i + 1) - 1;
+			}
+			i++;
+		}
+		return i + 1;
+	}
+	const close = ch === "(" ? ")" : ch === "[" ? "]" : ch === "{" ? "}" : null;
+	if (close === null) return start + 1;
+	let i = start + 1;
+	while (i < src.length && src[i] !== close) i = skipBalanced(src, i);
+	return i + 1;
+}
+
+/**
+ * The require() specifier a text starts with (`require("./x")`), or null.
+ * @param {string} text - Comment-free source text.
+ * @returns {string|null} The specifier.
+ * @private
+ */
+function leadingRequire(text) {
+	const m = /^require\s*\(\s*(["'])((?:\\.|(?!\1)[^\\\n])*)\1\s*\)/.exec(text);
+	return m ? decodeStringBody(m[2]) : null;
+}
+
+/**
+ * Collect the keys of the object literal whose `{` is at `start`.
+ * @param {string} src - Comment-free source.
+ * @param {number} start - Index of the opening brace.
+ * @param {Set<string>} names - Receives the keys.
+ * @param {string[]} reexports - Receives the specifiers of `...require("x")` spreads.
+ * @returns {void}
+ * @private
+ */
+function readObjectKeys(src, start, names, reexports) {
+	const end = skipBalanced(src, start) - 1;
+	let i = start + 1;
+	/**
+	 * Skip whitespace from `i`.
+	 * @returns {void}
+	 */
+	const ws = () => {
+		while (i < end && /\s/.test(src[i])) i++;
+	};
+	/**
+	 * Read one property-name token at `i` (identifier, string or number), or null.
+	 * @returns {string|null} The name.
+	 */
+	const token = () => {
+		ws();
+		const ch = src[i];
+		if (ch === "'" || ch === '"') {
+			const stop = skipString(src, i);
+			const name = decodeStringBody(src.slice(i + 1, stop - 1));
+			i = stop;
+			return name;
+		}
+		const m = /^(?:[A-Za-z_$\u0080-\uffff][\w$\u0080-\uffff]*|\d[\w.]*)/.exec(src.slice(i, end));
+		if (!m) return null;
+		i += m[0].length;
+		return m[0];
+	};
+	while (i < end) {
+		ws();
+		if (src.startsWith("...", i)) {
+			i += 3;
+			ws();
+			const spec = leadingRequire(src.slice(i, end));
+			if (spec !== null) reexports.push(spec);
+		} else if (src[i] === "[") {
+			// Computed key: not statically known.
+			i = skipBalanced(src, i);
+		} else {
+			let name = token();
+			if (src[i] === "*") {
+				i++;
+				name = token();
+			}
+			ws();
+			// `get x()`, `set x(v)`, `async x()`, `async *x()`: the modifier is followed by the real key.
+			if ((name === "get" || name === "set" || name === "async") && i < end && !",:(}".includes(src[i])) {
+				if (src[i] === "*") i++;
+				name = token();
+			}
+			if (name !== null) names.add(name);
+			// Node's lexer also follows a `key: require("./x")` value as a re-export of `./x`.
+			if (src[i] === ":") {
+				i++;
+				ws();
+				const spec = leadingRequire(src.slice(i, end));
+				if (spec !== null) reexports.push(spec);
+			}
+		}
+		// Skip the value (or method body) up to the next top-level comma.
+		while (i < end && src[i] !== ",") i = skipBalanced(src, i);
+		i++;
+	}
+}
+
+/**
+ * Scan CommonJS source for its named exports and re-exported specifiers.
+ * @param {string} source - The module source.
+ * @returns {{ names: Set<string>, reexports: string[] }} Names it assigns, and the specifiers whose
+ *   exports it re-exports.
+ * @internal
+ * @example
+ * scanCommonJSExports('exports.a = 1; module.exports.b = 2;').names; // Set { "a", "b" }
+ */
+export function scanCommonJSExports(source) {
+	const src = stripComments(String(source).replace(/^#!.*/, ""));
+	const names = new Set();
+	const reexports = [];
+	/**
+	 * A quoted string literal pattern whose quote is capture group `group` and body group `group + 1`.
+	 * @param {number} group - The quote's capture-group number.
+	 * @returns {string} Regular-expression source.
+	 */
+	const str = (group) => `(["'])((?:\\\\.|(?!\\${group})[^\\\\\\n])*)\\${group}`;
+
+	// exports.x = / exports["x"] = / module.exports.x = (not `==`/`===`, not `foo.exports`).
+	const assign = new RegExp(
+		String.raw`(?<![\w$.])(?:module\s*\.\s*)?exports\s*(?:\.\s*([A-Za-z_$\u0080-\uffff][\w$\u0080-\uffff]*)|\[\s*${str(2)}\s*\])\s*=(?!=)`,
+		"g"
+	);
+	for (const m of src.matchAll(assign)) names.add(m[1] ?? decodeStringBody(m[3]));
+
+	const define = new RegExp(String.raw`Object\s*\.\s*defineProperty\s*\(\s*(?:module\s*\.\s*)?exports\s*,\s*${str(1)}`, "g");
+	for (const m of src.matchAll(define)) names.add(decodeStringBody(m[2]));
+
+	// module.exports = { … } / module.exports = require("x").
+	const whole = /(?<![\w$.])module\s*\.\s*exports\s*=(?!=)\s*/g;
+	for (const m of src.matchAll(whole)) {
+		const at = m.index + m[0].length;
+		if (src[at] === "{") readObjectKeys(src, at, names, reexports);
+		else {
+			const spec = leadingRequire(src.slice(at));
+			if (spec !== null) reexports.push(spec);
+		}
+	}
+
+	// TypeScript / Babel star re-exports.
+	const star = new RegExp(String.raw`__export(?:Star)?\s*\(\s*require\s*\(\s*${str(1)}\s*\)`, "g");
+	for (const m of src.matchAll(star)) reexports.push(decodeStringBody(m[2]));
+
+	// Babel's star re-export: `var _x = require("x"); Object.keys(_x).forEach(function (key) { … exports[key] … })`.
+	const forEachKeys = /Object\s*\.\s*keys\s*\(\s*([A-Za-z_$][\w$]*)\s*\)\s*\.\s*forEach\s*\(/g;
+	for (const m of src.matchAll(forEachKeys)) {
+		const binding = new RegExp(
+			String.raw`(?<![\w$.])${escapeRegExp(m[1])}\s*=\s*(?:[A-Za-z_$][\w$]*\s*\(\s*)?require\s*\(\s*${str(1)}\s*\)`
+		).exec(src);
+		if (binding) reexports.push(decodeStringBody(binding[2]));
+	}
+
+	return { names, reexports };
+}
+
+/**
+ * The named exports an ESM importer sees for a CommonJS file: the scan of the file plus, recursively,
+ * the names of every CommonJS file it re-exports. `default` is excluded (it is always
+ * `module.exports`), as are names that are not well-formed strings.
+ * @param {string} filePath - Absolute path of the CommonJS file.
+ * @param {string} source - Its source text.
+ * @param {object} io - File access.
+ * @param {(file: string) => string} io.readFile - Read a file as UTF-8.
+ * @param {(specifier: string, fromFile: string) => string} io.resolve - Resolve a require() specifier
+ *   from a file to an absolute path (throws when it cannot).
+ * @returns {string[]} The export names, in discovery order.
+ * @internal
+ * @example
+ * commonJSExportNames("/app/lib/h.cjs", source, { readFile, resolve }); // ["bump", "label"]
+ */
+export function commonJSExportNames(filePath, source, io) {
+	const names = new Set();
+	const visited = new Set([filePath]);
+	const queue = [[filePath, source]];
+	while (queue.length) {
+		const [file, text] = queue.shift();
+		const scan = scanCommonJSExports(text);
+		for (const name of scan.names) names.add(name);
+		for (const spec of scan.reexports) {
+			let target;
+			try {
+				target = io.resolve(spec, file);
+				if (visited.has(target) || !/\.(?:c?js)$/.test(target)) continue;
+				visited.add(target);
+				queue.push([target, io.readFile(target)]);
+			} catch {
+				// An unresolvable or unreadable re-export contributes no names (Node's lexer skips it too).
+			}
+		}
+	}
+	names.delete("default");
+	return [...names].filter((name) => typeof name === "string" && name.isWellFormed());
+}
diff --git a/src/lib/helpers/instance-imports.mjs b/src/lib/helpers/instance-imports.mjs
index 0782f978c..f34c22296 100644
--- a/src/lib/helpers/instance-imports.mjs
+++ b/src/lib/helpers/instance-imports.mjs
@@ -44,8 +44,22 @@
  * `@cldmv/slothlet` and its runtime), any file inside a `node_modules` package other than the
  * importer's own, and slothlet's own source files — the live-binding runtime must remain one
  * module per process.
+ *
+ * Crossing module systems (#534). Node caches CommonJS by file path, so a query on a CommonJS URL is
+ * ignored, and `require(esm)` loads an ES module under its plain file URL. Two more hooks close that:
+ *
+ * - **ESM → CommonJS** — a `load` hook turns an instance-marked CommonJS URL into a small ES module
+ *   wrapper that runs the file through the instance's private CommonJS cache
+ *   ({@link requireInInstance}, the same cache a `.cjs` leaf's own requires use). Its export names come
+ *   from a static scan of the source (see `cjs-export-names.mjs`), as Node's own are.
+ * - **CommonJS → ESM** — while {@link requireInInstance} runs its synchronous require, the scope is
+ *   active: a relative `require()` from a file of that scope resolving to an ES module is marked, and
+ *   the `load` hook answers it with a CommonJS stub that returns the ES module imported under the
+ *   instance query — the same module record an ESM leaf of the instance imports.
  */
 
+import { commonJSExportNames } from "./cjs-export-names.mjs";
+
 /**
  * Query parameters copied from a leaf onto its helpers: the instance only. The leaf's `module`
  * (mount) and `_reload` (partial-reload stamp) parameters are deliberately NOT copied — a helper is
@@ -70,6 +84,76 @@ const MARKER = "slothlet_instance=";
  */
 const INSTALLED = Symbol.for("@cldmv/slothlet.instanceImportHooks");
 
+/**
+ * Query parameter marking a URL that a `require()` resolved inside an active instance scope (#534).
+ * @type {string}
+ * @private
+ */
+const REQUIRE_PARAM = "slothlet_require";
+
+/**
+ * Virtual-module prefix: `slothlet-esm:<url>` is an ES module whose `"module.exports"` export is the
+ * namespace of `<url>`, so a synchronous `require()` of it returns that namespace (#534).
+ * @type {string}
+ * @private
+ */
+const ESM_PREFIX = "slothlet-esm:";
+
+/**
+ * Virtual-module prefix: `slothlet-esm-facade:<url>` re-exports `<url>` plus `__esModule: true`, the
+ * shape Node's `require(esm)` returns for an ES module with a default export (#534).
+ * @type {string}
+ * @private
+ */
+const FACADE_PREFIX = "slothlet-esm-facade:";
+
+/**
+ * Global key of the process-wide state shared by every slothlet copy in the process (#534).
+ * @type {symbol}
+ * @private
+ */
+const STATE = Symbol.for("@cldmv/slothlet.instanceImportState");
+
+/**
+ * Process-wide instance-import state.
+ * @typedef {object} InstanceImportState
+ * @property {Map<string, Map<string, object>>} scopes - Per instance ID: the private CommonJS module
+ *   copies of that instance, by filename.
+ * @property {{ instanceID: string, anchor: string }|null} active - The scope a synchronous
+ *   {@link requireInInstance} is running in (`anchor` is the file it required), else null.
+ * @property {(filePath: string, instanceID: string) => *} requireCJS - Entry point of the ESM wrapper
+ *   generated for a CommonJS helper.
+ * @property {(url: string) => *} requireESM - Entry point of the CommonJS stub generated for a
+ *   `require()` of an ES module.
+ * @internal
+ */
+
+/**
+ * The process-wide state, created on first use. Shared through the global object so a leaf loaded by
+ * one slothlet copy and a hook registered by another agree on the same per-instance caches.
+ * @returns {InstanceImportState} The state.
+ * @private
+ */
+function sharedState() {
+	let state = globalThis[STATE];
+	if (state === undefined) {
+		state = { scopes: new Map(), active: null, requireCJS: (filePath, instanceID) => requireInInstance(filePath, instanceID), requireESM };
+		Object.defineProperty(globalThis, STATE, { value: state, enumerable: false, configurable: true });
+	}
+	return state;
+}
+
+/**
+ * A Node builtin, read through `process.getBuiltinModule()` so this module has no static `node:`
+ * import (it is also loaded by browser bundles and by vite configs).
+ * @param {string} id - The builtin's id (`"node:module"`, …).
+ * @returns {object} The builtin module.
+ * @private
+ */
+function nodeBuiltin(id) {
+	return globalThis.process.getBuiltinModule(id);
+}
+
 /**
  * Slothlet's own files, as forward-slash paths: the `lib/` tree (`src/lib/` or `dist/lib/`) and the
  * package's two entry files. Imports resolving here are never duplicated per instance.
@@ -197,6 +281,248 @@ function splitQuery(ref) {
 	return hash === -1 ? [ref.slice(0, q), ref.slice(q + 1)] : [ref.slice(0, q) + ref.slice(hash), ref.slice(q + 1, hash)];
 }
 
+/**
+ * Run a CommonJS file through an instance's private CommonJS cache (#518, #534) and return its
+ * `module.exports`.
+ *
+ * Node's `require.cache` is keyed on the file path alone, so the instance-scoped files the require
+ * reaches (see {@link isInstanceScopedFile} — the file itself and its relative helpers, never
+ * `node_modules` packages or slothlet's own files) are kept in a private cache per instance ID and
+ * swapped into `require.cache` only for the duration of this synchronous require: global entries for
+ * those files are set aside and restored afterwards, so neither the host's copies nor another
+ * instance's copies are ever served, and `require.cache` does not grow. The cache is shared by every
+ * leaf and mount of the instance and kept across partial reloads; a full reload rotates the instance
+ * ID and so starts a fresh one ({@link releaseInstanceScope} drops the old one).
+ *
+ * While the require runs, the scope is active: a relative `require()` of an ES module from a file of
+ * the scope is served the instance's copy of that module (the resolve and load hooks of
+ * {@link installInstanceImportHooks}).
+ * @param {string} filePath - Absolute path of the CommonJS file.
+ * @param {string} instanceID - The instance whose copies are served.
+ * @param {object} [options] - Options.
+ * @param {boolean} [options.fresh=false] - Evaluate the file itself anew instead of serving (and
+ *   keeping) the instance's copy of it — how a leaf is loaded, so a partial reload re-runs it.
+ * @returns {*} The file's `module.exports`.
+ * @internal
+ * @example
+ * const exports = requireInInstance("/app/api/counter.cjs", "inst-a", { fresh: true });
+ */
+export function requireInInstance(filePath, instanceID, { fresh = false } = {}) {
+	const requireFn = nodeBuiltin("node:module").createRequire(filePath);
+	const resolved = requireFn.resolve(filePath);
+	const cache = requireFn.cache;
+	const state = sharedState();
+	const outer = state.active;
+	// Already inside this instance's scope (a helper reached during its require): the cache is swapped in.
+	if (!fresh && outer !== null && outer.instanceID === instanceID) return requireFn(resolved);
+
+	let scope = state.scopes.get(instanceID);
+	if (!scope) {
+		scope = new Map();
+		state.scopes.set(instanceID, scope);
+	}
+	const owned = (file) => file === resolved || isInstanceScopedFile(file, resolved);
+	const keep = (file) => !(fresh && file === resolved);
+
+	// Set aside every global entry the require must not share, then serve this instance's copies.
+	const setAside = new Map();
+	for (const file of Object.keys(cache)) {
+		if (owned(file)) {
+			setAside.set(file, cache[file]);
+			delete cache[file];
+		}
+	}
+	const served = [];
+	for (const [file, mod] of scope) {
+		if (!keep(file)) continue;
+		if (cache[file] !== undefined) setAside.set(file, cache[file]);
+		cache[file] = mod;
+		served.push(file);
+	}
+
+	state.active = { instanceID, anchor: resolved };
+	try {
+		return requireFn(resolved);
+	} finally {
+		state.active = outer;
+		// Collect this instance's (possibly new) copies, then put the global cache back.
+		for (const file of [...Object.keys(cache).filter(owned), ...served]) {
+			if (!(file in cache)) continue;
+			if (keep(file)) scope.set(file, cache[file]);
+			delete cache[file];
+		}
+		for (const [file, mod] of setAside) cache[file] = mod;
+	}
+}
+
+/**
+ * Drop an instance's private CommonJS copies (#534): on shutdown, and for the old instance ID on a
+ * full reload. Its ES module copies stay in Node's module cache (which has no eviction) but are no
+ * longer reachable from a live instance.
+ * @param {string|null|undefined} instanceID - The instance ID.
+ * @returns {void}
+ * @internal
+ * @example
+ * releaseInstanceScope(oldInstanceID);
+ */
+export function releaseInstanceScope(instanceID) {
+	if (instanceID != null) globalThis[STATE]?.scopes.delete(instanceID);
+}
+
+/**
+ * `require()` an ES module under its instance URL: return what Node's own `require(esm)` returns —
+ * the namespace, its `"module.exports"` export when it has one, or for a module with a default export
+ * (and no `__esModule` export) the namespace with `__esModule: true` added. The namespace is the one
+ * an `import` of the same instance URL yields, so ESM and CommonJS importers of the instance share
+ * one copy.
+ * @param {string} url - The ES module's `file:` URL carrying the instance query.
+ * @returns {*} The value `require()` returns.
+ * @private
+ */
+function requireESM(url) {
+	const requireFn = nodeBuiltin("node:module").createRequire(import.meta.url);
+	/**
+	 * Synchronously load one virtual module, without leaving it in `require.cache`.
+	 * @param {string} id - The virtual module id.
+	 * @returns {*} Its `require()` value.
+	 */
+	const requireVirtual = (id) => {
+		try {
+			return requireFn(id);
+		} finally {
+			delete requireFn.cache[id];
+		}
+	};
+	const namespace = requireVirtual(ESM_PREFIX + url);
+	if ("module.exports" in namespace) return namespace["module.exports"];
+	if (!("default" in namespace) || "__esModule" in namespace) return namespace;
+	return requireVirtual(FACADE_PREFIX + url);
+}
+
+/**
+ * Whether a resolve/load context's conditions include `name` (an array on the import path; a Set on
+ * Node 22's require path).
+ * @param {Iterable<string>|undefined} conditions - The context's conditions.
+ * @param {string} name - The condition.
+ * @returns {boolean} True when present.
+ * @private
+ */
+function hasCondition(conditions, name) {
+	if (conditions == null) return false;
+	return typeof conditions.has === "function" ? conditions.has(name) : Array.prototype.includes.call(conditions, name);
+}
+
+/**
+ * Mark a `require()` resolution made inside an active instance scope (#534): a relative require from
+ * a file of the scope that resolves to a possible ES module gets the instance query plus
+ * {@link REQUIRE_PARAM}, so the load hook can serve it the instance's copy. CommonJS targets are
+ * already served by the scope's private cache and are left alone.
+ * @param {string} specifier - The specifier as written.
+ * @param {object} context - Node's resolve context.
+ * @param {ResolveResult} result - The next hook's result.
+ * @param {{ instanceID: string, anchor: string }} active - The active scope.
+ * @returns {ResolveResult} `result`, marked when the rule applies.
+ * @private
+ */
+function markScopedRequire(specifier, context, result, active) {
+	const url = result?.url;
+	if (typeof url !== "string" || !url.startsWith("file:") || url.includes("?") || /\.(?:cjs|json|node)$/.test(url)) return result;
+	if (!isFileSpecifier(specifier) || !hasCondition(context?.conditions, "require")) return result;
+	const parent = context.parentURL;
+	if (typeof parent !== "string" || !isInstanceScopedFile(parent, active.anchor) || !isInstanceScopedFile(url, parent)) return result;
+	const query = new URLSearchParams({ slothlet_instance: active.instanceID });
+	query.set(REQUIRE_PARAM, "1");
+	return { ...result, url: `${url}?${query}` };
+}
+
+/**
+ * Source of the ES module that stands in for a CommonJS helper imported by an instance (#534): it
+ * runs the file through the instance's private CommonJS cache and exports what Node's own
+ * ESM-to-CommonJS import exports — `default` (`module.exports`), `"module.exports"`, and the named
+ * exports found by a static scan of the source, read from `module.exports` once it has run.
+ * @param {string} filePath - Absolute path of the CommonJS file.
+ * @param {string} instanceID - The instance ID.
+ * @param {string|null|undefined|Uint8Array} source - Its source, when the loader already read it.
+ * @returns {string} The wrapper's ES module source.
+ * @internal
+ * @example
+ * commonJSWrapperSource("/app/lib/state.cjs", "inst-a", null);
+ */
+export function commonJSWrapperSource(filePath, instanceID, source) {
+	const fs = nodeBuiltin("node:fs");
+	const { createRequire } = nodeBuiltin("node:module");
+	const text = source == null ? fs.readFileSync(filePath, "utf8") : typeof source === "string" ? source : new TextDecoder().decode(source);
+	const names = new Set(
+		commonJSExportNames(filePath, text, {
+			readFile: (file) => fs.readFileSync(file, "utf8"),
+			resolve: (specifier, fromFile) => createRequire(fromFile).resolve(specifier)
+		})
+	);
+	// Like Node, a module that has already run contributes the keys it actually exports.
+	const loaded = globalThis[STATE]?.scopes.get(instanceID)?.get(filePath);
+	if (loaded?.loaded && loaded.exports !== null && (typeof loaded.exports === "object" || typeof loaded.exports === "function")) {
+		for (const key of Object.keys(loaded.exports)) if (key !== "default" && key.isWellFormed()) names.add(key);
+	}
+	names.delete("module.exports");
+	const lines = [
+		`const m = globalThis[Symbol.for(${JSON.stringify(STATE.description)})].requireCJS(${JSON.stringify(filePath)}, ${JSON.stringify(instanceID)});`,
+		"export default m;",
+		'export { m as "module.exports" };'
+	];
+	let n = 0;
+	for (const name of names) {
+		lines.push(`const n${n} = m == null ? undefined : m[${JSON.stringify(name)}];`, `export { n${n} as ${JSON.stringify(name)} };`);
+		n++;
+	}
+	return lines.join("\n") + "\n";
+}
+
+/**
+ * Load-hook body for a URL carrying the instance marker (#534).
+ * @param {string} url - The module URL.
+ * @param {object} context - Node's load context.
+ * @param {Function} nextLoad - Node's next load function.
+ * @returns {object} The load result.
+ * @private
+ */
+function loadInstanceModule(url, context, nextLoad) {
+	if (url.startsWith(ESM_PREFIX)) {
+		const target = JSON.stringify(url.slice(ESM_PREFIX.length));
+		return { format: "module", shortCircuit: true, source: `import * as ns from ${target};\nexport { ns as "module.exports" };\n` };
+	}
+	if (url.startsWith(FACADE_PREFIX)) {
+		const target = JSON.stringify(url.slice(FACADE_PREFIX.length));
+		return {
+			format: "module",
+			shortCircuit: true,
+			source: `export * from ${target};\nexport { default } from ${target};\nexport const __esModule = true;\n`
+		};
+	}
+	const result = nextLoad(url, context);
+	if (!url.startsWith("file:")) return result;
+	const [base, query = ""] = splitQuery(url);
+	const params = new URLSearchParams(query);
+	if (params.has(REQUIRE_PARAM)) {
+		// require() of a file in an instance scope: an ES module is served the instance's copy;
+		// anything else is CommonJS (or JSON/addon) and already served by the scope's private cache.
+		if (result?.format !== "module") return result;
+		params.delete(REQUIRE_PARAM);
+		const target = JSON.stringify(`${base}?${params}`);
+		return {
+			format: "commonjs",
+			shortCircuit: true,
+			source: `module.exports = globalThis[Symbol.for(${JSON.stringify(STATE.description)})].requireESM(${target});\n`
+		};
+	}
+	const instanceID = params.get("slothlet_instance");
+	if (result?.format !== "commonjs" || instanceID === null) return result;
+	return {
+		format: "module",
+		shortCircuit: true,
+		source: commonJSWrapperSource(nodeBuiltin("node:url").fileURLToPath(base), instanceID, result.source)
+	};
+}
+
 /**
  * Resolve-result shape shared by Node's resolve hooks.
  * @typedef {object} ResolveResult
@@ -224,12 +550,20 @@ function splitQuery(ref) {
  * @private
  */
 function applyToResult(specifier, context, result) {
-	const url = propagateInstanceQuery(specifier, context?.parentURL, result?.url);
-	return url === result?.url ? result : { ...result, url };
+	const parentURL = context?.parentURL;
+	if (typeof parentURL === "string" && parentURL.includes(MARKER)) {
+		const url = propagateInstanceQuery(specifier, parentURL, result?.url);
+		return url === result?.url ? result : { ...result, url };
+	}
+	const active = globalThis[STATE]?.active;
+	return active ? markScopedRequire(specifier, context, result, active) : result;
 }
 
 /**
- * Register the resolve hook with Node, once per process (idempotent across slothlet copies).
+ * Register the resolve and load hooks with Node, once per process (idempotent across slothlet copies).
+ * The resolve hook copies a leaf's instance query onto its relative imports and marks relative
+ * `require()`s made inside an instance scope; the load hook serves the cross-module-system cases
+ * (#534) and passes every unmarked URL straight through.
  * Uses the synchronous in-thread `module.registerHooks()` (Node >= 22.15 / 23.5, slothlet's engines
  * floor). The off-thread `module.register()` is deliberately not used: it adds a cross-thread round
  * trip to every import in the process and reorders module evaluation enough to break leaves that
@@ -245,8 +579,17 @@ function applyToResult(specifier, context, result) {
 export function installInstanceImportHooks(nodeModule, registry = globalThis) {
 	if (registry[INSTALLED]) return true;
 	if (typeof nodeModule?.registerHooks === "function") {
+		sharedState();
 		nodeModule.registerHooks({
-			resolve: (specifier, context, nextResolve) => applyToResult(specifier, context, nextResolve(specifier, context))
+			resolve: (specifier, context, nextResolve) => {
+				// The two virtual modules behind require(esm) (#534) resolve to themselves.
+				if (specifier.startsWith(ESM_PREFIX) || specifier.startsWith(FACADE_PREFIX)) {
+					return { url: specifier, format: "module", shortCircuit: true };
+				}
+				return applyToResult(specifier, context, nextResolve(specifier, context));
+			},
+			// Only instance-marked URLs are touched; every other load passes straight through.
+			load: (url, context, nextLoad) => (url.includes(MARKER) ? loadInstanceModule(url, context, nextLoad) : nextLoad(url, context))
 		});
 	} else {
 		return false;
@@ -255,11 +598,56 @@ export function installInstanceImportHooks(nodeModule, registry = globalThis) {
 	return true;
 }
 
+/**
+ * Whether Node loads a file as CommonJS, decided the way Node decides it: `.cjs` always; `.js` by the
+ * nearest `package.json` `type` (the first one found ends the walk), and with no `type` by syntax
+ * detection (the source compiles as a CommonJS function body). Used by the vite plugin, which sees
+ * file ids rather than Node's resolved formats.
+ * @param {string} filePath - Absolute file path.
+ * @returns {boolean} True when the file is CommonJS.
+ * @internal
+ * @example
+ * isCommonJSFile("/app/lib/state.cjs"); // true
+ */
+export function isCommonJSFile(filePath) {
+	if (filePath.endsWith(".cjs")) return true;
+	if (!filePath.endsWith(".js")) return false;
+	const fs = nodeBuiltin("node:fs");
+	const path = nodeBuiltin("node:path");
+	for (let dir = path.dirname(filePath); ; dir = path.dirname(dir)) {
+		const manifest = path.join(dir, "package.json");
+		if (fs.existsSync(manifest)) {
+			let type;
+			try {
+				type = JSON.parse(fs.readFileSync(manifest, "utf8"))?.type;
+			} catch {
+				// Malformed package.json: leave the file to the host's own loader, which reports it.
+				return false;
+			}
+			if (type === "module" || type === "commonjs") return type === "commonjs";
+			break;
+		}
+		if (path.dirname(dir) === dir || path.basename(dir) === "node_modules") break;
+	}
+	try {
+		const source = fs.readFileSync(filePath, "utf8").replace(/^#!.*/, "");
+		nodeBuiltin("node:vm").compileFunction(source, ["exports", "require", "module", "__filename", "__dirname"]);
+		return true;
+	} catch {
+		return false;
+	}
+}
+
 /**
  * Vite plugin applying the same rule inside a vite module graph — for leaves a consumer loads
  * through slothlet's `import` hook under vitest (docs/TESTING.md), where Node's resolve hooks
  * never see the leaf's imports. Add it to the consumer's `vitest.config` `plugins`.
- * @returns {object} A vite plugin (`name`, `enforce`, `resolveId`).
+ *
+ * A CommonJS helper imported under an instance id (#534) is loaded as the same ES module wrapper the
+ * Node load hook generates: the file runs through the instance's private CommonJS cache in the
+ * test's own process, so its own `require()`s — CommonJS or ES module — are per instance too, and
+ * the copy is shared with the instance's `.cjs` leaves.
+ * @returns {object} A vite plugin (`name`, `enforce`, `resolveId`, `load`).
  * @public
  * @example
  * // vitest.config.mjs
@@ -283,6 +671,18 @@ export function slothletInstanceImports() {
 			if (!resolved || resolved.external) return resolved;
 			const id = propagateInstanceQuery(source, importer, resolved.id);
 			return id === resolved.id ? resolved : { ...resolved, id };
+		},
+		/**
+		 * Load a CommonJS helper carrying an instance query as its per-instance ES module wrapper.
+		 * @param {string} id - The module id.
+		 * @returns {object|null} The wrapper code, or null to defer to vite's own loading.
+		 */
+		load(id) {
+			if (typeof id !== "string" || !id.includes(MARKER)) return null;
+			const [base, query = ""] = splitQuery(id);
+			const instanceID = new URLSearchParams(query).get("slothlet_instance");
+			if (instanceID === null || !isCommonJSFile(base)) return null;
+			return { code: commonJSWrapperSource(base, instanceID, null) };
 		}
 	};
 }
diff --git a/src/lib/processors/loader.mjs b/src/lib/processors/loader.mjs
index 4b4180b75..36cad7279 100644
--- a/src/lib/processors/loader.mjs
+++ b/src/lib/processors/loader.mjs
@@ -37,7 +37,7 @@ import { fsp, path, url, createRequire } from "@cldmv/slothlet/helpers/platform"
 import { compilePattern } from "@cldmv/slothlet/helpers/pattern-matcher";
 import { isFrameworkReservedKey } from "#handlers/unified-wrapper";
 import { SlothletWarning } from "@cldmv/slothlet/errors";
-import { installInstanceImportHooks, isInstanceScopedFile } from "@cldmv/slothlet/helpers/instance-imports";
+import { installInstanceImportHooks, requireInInstance } from "@cldmv/slothlet/helpers/instance-imports";
 
 /**
  * Whether THIS copy of slothlet runs outside a bundler/test-runner module graph.
@@ -284,7 +284,9 @@ export class Loader extends ComponentBase {
 			// has no effect on require() because it keys on the resolved file path only.
 			// A `.js` file Node treats as CommonJS (#521) takes the same path as `.cjs`. Its relative
 			// requires share one private cache per instance (#518) — kept across partial reloads, like ESM helpers.
+			// The hooks serve its require() of an ES module the instance's copy (#534).
 			if (filePath.endsWith(".cjs") || (filePath.endsWith(".js") && (await this.#isCommonJSFile(filePath)))) {
+				ensureInstanceImportHooks();
 				return this.#loadCJSIsolated(filePath, instanceID);
 			}
 
@@ -487,63 +489,26 @@ export class Loader extends ComponentBase {
 
 	/**
 	 * Load a CJS module with a fresh module.exports on every call, and give its relative
-	 * dependency graph one copy per instance (#518).
+	 * dependency graph one copy per instance (#518, #534).
 	 * Node's require() cache is keyed on the resolved file path and ignores URL
 	 * query parameters, so two Slothlet instances loading the same .cjs file
 	 * would otherwise share the exact same module.exports object — and so would
 	 * every helper the leaf require()s.
 	 *
-	 * The leaf itself is always evaluated fresh. The instance-scoped files it reaches
-	 * (see isInstanceScopedFile: its relative helpers, never `node_modules` packages or
-	 * slothlet's own files) are kept in a private cache per instance — the same scope the ESM
-	 * helper query carries: shared by every mount and kept across partial reloads (a full
-	 * reload rotates the instance ID and so starts a fresh cache) — and swapped into
-	 * `require.cache` only for the duration of this synchronous require: global entries
-	 * for those files are set aside and restored afterwards, so neither the host's copies
-	 * nor another scope's copies are ever served, and `require.cache` does not grow.
+	 * The leaf itself is always evaluated fresh. The instance-scoped files it reaches are served from
+	 * the instance's private CommonJS cache — shared by every mount and kept across partial reloads; a
+	 * full reload rotates the instance ID and so starts a fresh one — and an ES module it require()s is
+	 * the instance's copy of that module (see requireInInstance in helpers/instance-imports).
 	 * @param {string} filePath - Absolute path to the .cjs file
 	 * @param {string} scopeKey - The instance ID whose helper copies the leaf's requires are served from
-	 * @returns {Promise<Object>} Synthetic ESM namespace: { default, ...namedExports }
+	 * @returns {Object} Synthetic ESM namespace: { default, ...namedExports }
 	 * @example
-	 * const ns = await this.#loadCJSIsolated("/path/to/module.cjs", "inst");
+	 * const ns = this.#loadCJSIsolated("/path/to/module.cjs", "inst");
 	 * ns.default; // module.exports
 	 * @private
 	 */
 	#loadCJSIsolated(filePath, scopeKey) {
-		const requireFn = createRequire(filePath);
-		const resolved = requireFn.resolve(filePath);
-		const cache = requireFn.cache;
-		const scopes = (this.slothlet._cjsHelperScopes ??= new Map());
-		let scope = scopes.get(scopeKey);
-		if (!scope) {
-			scope = new Map();
-			scopes.set(scopeKey, scope);
-		}
-		const inScope = (file) => file !== resolved && isInstanceScopedFile(file, resolved);
-
-		// Set aside every global entry the leaf's graph must not share, then serve this scope's copies.
-		const setAside = new Map();
-		for (const file of Object.keys(cache)) {
-			if (file === resolved || inScope(file)) {
-				setAside.set(file, cache[file]);
-				delete cache[file];
-			}
-		}
-		for (const [file, mod] of scope) cache[file] = mod;
-
-		let exports;
-		try {
-			exports = requireFn(resolved);
-		} finally {
-			// Collect this scope's (possibly new) helper copies, then put the global cache back.
-			for (const file of Object.keys(cache)) {
-				if (file === resolved || inScope(file)) {
-					if (file !== resolved) scope.set(file, cache[file]);
-					delete cache[file];
-				}
-			}
-			for (const [file, mod] of setAside) cache[file] = mod;
-		}
+		const exports = requireInInstance(filePath, scopeKey, { fresh: true });
 
 		// Build a synthetic ESM namespace that mirrors what import() returns for CJS:
 		//   - default = module.exports
diff --git a/src/slothlet.mjs b/src/slothlet.mjs
index 9ca4293d2..f38db7fac 100644
--- a/src/slothlet.mjs
+++ b/src/slothlet.mjs
@@ -108,6 +108,7 @@ import {
 } from "@cldmv/slothlet/helpers/eventtarget-property-context";
 import { enableObserverPatching, disableObserverPatching } from "@cldmv/slothlet/helpers/observer-context";
 import { DEFAULT_ROUTINES, RESERVED_EXPORTS } from "@cldmv/slothlet/helpers/defaults";
+import { releaseInstanceScope } from "@cldmv/slothlet/helpers/instance-imports";
 
 /**
  * Instances currently relying on the globally-patched boundaries.
@@ -1135,8 +1136,8 @@ class Slothlet {
 		const oldInstanceID = this.instanceID;
 		if (!keepInstanceID) {
 			this.instanceID = `${oldInstanceID}_reload_${Date.now()}`;
-			// The previous instanceID's private CommonJS helper copies (#518) can no longer be served.
-			this._cjsHelperScopes?.clear();
+			// The previous instanceID's private CommonJS helper copies (#518, #534) can no longer be served.
+			releaseInstanceScope(oldInstanceID);
 
 			// The TS transform cache dirs from the previous instanceID are stale: the
 			// startup sweep only removes dirs whose owning PID is dead (same-PID dirs
@@ -1652,8 +1653,8 @@ class Slothlet {
 		// Shutdown event manager (#407) — clears all subscriptions.
 		this.handlers.eventManager?.shutdown();
 
-		// Drop this instance's private CommonJS helper copies (#518).
-		this._cjsHelperScopes?.clear();
+		// Drop this instance's private CommonJS helper copies (#518, #534).
+		releaseInstanceScope(this.instanceID);
 
 		// Remove on-disk TS transform cache (<projectRoot>/.slothlet-cache/<pid>-<instanceID>/).
 		// Hash-keyed filenames make repeat loads cheap; this keeps the directory bounded
diff --git a/tests/vitests/suites/helpers/instance-imports-cross-format.test.vitest.mjs b/tests/vitests/suites/helpers/instance-imports-cross-format.test.vitest.mjs
new file mode 100644
index 000000000..d811554ed
--- /dev/null
+++ b/tests/vitests/suites/helpers/instance-imports-cross-format.test.vitest.mjs
@@ -0,0 +1,406 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/helpers/instance-imports-cross-format.test.vitest.mjs
+ *	@Date: 2026-10-02 12:27:51 -07:00 (1790969271)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 12:27:51 -07:00 (1790969271)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Unit tests for the cross-module-system helper rule (#534): the CommonJS export-name
+ * scan, the per-instance CommonJS cache, the Node load hook, and the vite plugin's load hook.
+ */
+
+import { describe, it, expect, beforeAll, afterAll } from "vitest";
+import fs from "node:fs";
+import fsp from "node:fs/promises";
+import path from "node:path";
+import { createRequire } from "node:module";
+import * as nodeModule from "node:module";
+import { scanCommonJSExports, commonJSExportNames } from "@cldmv/slothlet/helpers/cjs-export-names";
+import {
+	requireInInstance,
+	releaseInstanceScope,
+	commonJSWrapperSource,
+	isCommonJSFile,
+	installInstanceImportHooks,
+	slothletInstanceImports
+} from "@cldmv/slothlet/helpers/instance-imports";
+import { makeTestTmpDir } from "../../setup/test-fixtures-tmp.mjs";
+
+/**
+ * The process-wide instance-import state (documented global of helpers/instance-imports).
+ * @returns {object} The state.
+ */
+const state = () => globalThis[Symbol.for("@cldmv/slothlet.instanceImportState")];
+
+/**
+ * Names found by the scan, as an array.
+ * @param {string} source - CommonJS source.
+ * @returns {string[]} The names.
+ */
+const names = (source) => [...scanCommonJSExports(source).names];
+
+describe("Helpers > cjs-export-names (#534)", () => {
+	it("finds exports.x / module.exports.x / bracket assignments, not comparisons or other objects", () => {
+		expect(names("exports.a = 1; module.exports.b = 2; exports['c'] = 3; module.exports[\"d\"] = 4;")).toEqual(["a", "b", "c", "d"]);
+		expect(names("if (exports.x == 1) {} if (module.exports.y === 2) {} foo.exports.z = 3;")).toEqual([]);
+	});
+
+	it("finds Object.defineProperty exports, including TypeScript's __esModule marker", () => {
+		expect(names('Object.defineProperty(exports, "__esModule", { value: true }); Object.defineProperty(module.exports, "x", {});')).toEqual(
+			["__esModule", "x"]
+		);
+	});
+
+	it("ignores comments but keeps strings, templates and regular expressions from hiding code", () => {
+		const src = [
+			"#!/usr/bin/env node",
+			"// exports.lineComment = 1",
+			"/* exports.blockComment = 1 */",
+			'const url = "http://example.com"; exports.afterString = 1;',
+			"const t = `x ${ { a: 1 }.a } y`; exports.afterTemplate = 1;",
+			"const r = /\\/\\/[}{'\"]/g; exports.afterRegex = 1;",
+			"const d = 4 / 2; exports.afterDivision = d / 1;",
+			"function f() { return /x/.test('y'); } exports.afterReturnRegex = 1;"
+		].join("\n");
+		expect(names(src)).toEqual(["afterString", "afterTemplate", "afterRegex", "afterDivision", "afterReturnRegex"]);
+	});
+
+	it("handles escapes in templates and strings, spreads of non-requires, and trailing commas", () => {
+		expect(names("const t = `a\\`b`; exports.afterEscapedTemplate = 1;")).toEqual(["afterEscapedTemplate"]);
+		expect(names("module.exports = { a: `x\\`${'}'}`, ...other, b, };")).toEqual(["a", "b"]);
+		expect(names("exports['\\x'] = 1;")).toEqual(["\\x"]);
+	});
+
+	it("survives an unterminated comment, string or template", () => {
+		expect(names("exports.a = 1; /* never closed")).toEqual(["a"]);
+		expect(names("exports.a = 1; const s = 'never closed")).toEqual(["a"]);
+		expect(names("exports.a = 1; const s = `never ${closed")).toEqual(["a"]);
+	});
+
+	it("reads every key of a module.exports object literal, whatever the value", () => {
+		const src =
+			"module.exports = { a, b: c, 'd-e': 1, \"f\": 2, 3: 4, g() { return { x: 1 }; }, get h() { return 1; }, set i(v) {}," +
+			" async j() {}, async *k() {}, *l() {}, get, set: 1, async, [computed]: 1, m: /}/g, n: `${'{'}`, o: (1, 2), p }";
+		expect(names(src)).toEqual(["a", "b", "d-e", "f", "3", "g", "h", "i", "j", "k", "l", "get", "set", "async", "m", "n", "o", "p"]);
+	});
+
+	it("reads esbuild's 0 && (module.exports = { … }) annotation", () => {
+		expect(names("module.exports = __toCommonJS(src_exports);\n0 && (module.exports = {\n  bar,\n  foo\n});")).toEqual(["bar", "foo"]);
+	});
+
+	it("collects re-exported specifiers", () => {
+		const reexports = (source) => scanCommonJSExports(source).reexports;
+		expect(reexports("module.exports = require('./a.cjs');")).toEqual(["./a.cjs"]);
+		expect(reexports("module.exports = { ...require('./b'), x: require(\"./c\") };")).toEqual(["./b", "./c"]);
+		expect(reexports('__exportStar(require("./d"), exports); __export(require("./e"));')).toEqual(["./d", "./e"]);
+		expect(reexports('var _f = require("./f"); Object.keys(_f).forEach(function (key) { exports[key] = _f[key]; });')).toEqual(["./f"]);
+		expect(reexports('var _g = _interopRequireWildcard(require("./g")); Object.keys(_g).forEach(function (k) {});')).toEqual(["./g"]);
+		expect(reexports("Object.keys(unbound).forEach(function (k) {}); module.exports = makeApi();")).toEqual([]);
+	});
+
+	it("decodes quoted export names exactly as JavaScript would", () => {
+		expect(names(`exports['a""b'] = 1;`)).toEqual(['a""b']);
+		expect(names(`exports['a\\\\"b'] = 1;`)).toEqual(['a\\"b']);
+		expect(names(`exports["it's"] = 1; exports['\\x41\\u0042\\u{43}'] = 2;`)).toEqual(["it's", "ABC"]);
+		expect(names(`Object.defineProperty(exports, 'q"\\t', { value: 1 });`)).toEqual(['q"\t']);
+		expect(names(`exports['\\u{110000}'] = 1;`)).toEqual(["\\u{110000}"]);
+		// Line continuations contribute nothing.
+		expect(names(`module.exports = { "a\\\nb": 1, "e\\\u2028f": 3 };`)).toEqual(["ab", "ef"]);
+		// A key left unterminated at end of input after a lone backslash keeps that backslash.
+		expect(names(`module.exports = { "z\\`)).toEqual(["z\\"]);
+	});
+
+	it("matches a re-export binding name literally", () => {
+		const reexports = (source) => scanCommonJSExports(source).reexports;
+		expect(reexports('var $_ = require("./h"); Object.keys($_).forEach(function (k) {});')).toEqual(["./h"]);
+		expect(reexports('var a$b = require("./i"); Object.keys(a$b).forEach(function (k) {});')).toEqual(["./i"]);
+	});
+
+	it("follows re-exports into CommonJS files, once each, and drops default and ill-formed names", () => {
+		const files = {
+			"/p/index.cjs":
+				"module.exports = { ...require('./a.cjs'), ...require('./missing.cjs'), ...require('./esm.mjs') }; exports.default = 1;",
+			"/p/a.cjs": "exports.a = 1; exports['\\uD800'] = 2; module.exports = require('./b.js');",
+			"/p/b.js": "exports.b = 1; module.exports = require('./index.cjs');"
+		};
+		const io = {
+			readFile: (file) => files[file],
+			resolve: (specifier, from) => {
+				const target = path.posix.join(path.posix.dirname(from), specifier);
+				if (!(target in files) && !target.endsWith(".mjs")) throw new Error("not found");
+				return target;
+			}
+		};
+		expect(commonJSExportNames("/p/index.cjs", files["/p/index.cjs"], io)).toEqual(["a", "b"]);
+	});
+});
+
+describe("Helpers > instance-imports across module systems (#534)", () => {
+	let root;
+
+	beforeAll(async () => {
+		installInstanceImportHooks(nodeModule);
+		root = await makeTestTmpDir("instance-imports-cross");
+		const write = (rel, text) => {
+			fs.mkdirSync(path.dirname(path.join(root, rel)), { recursive: true });
+			fs.writeFileSync(path.join(root, rel), text);
+		};
+		write("package.json", "{}");
+		write("helper.cjs", "let n = 0; exports.bump = () => ++n;");
+		write("leaf.cjs", "const h = require('./helper.cjs'); module.exports = { bump: () => h.bump(), self: Math.random() };");
+		write("esm-exports.mjs", 'const value = { custom: true }; export { value as "module.exports" };');
+		write("esm-marked.mjs", "export const __esModule = false; export default 1;");
+		write("esm-plain.mjs", "let n = 0; export const bump = () => ++n;");
+		write(
+			"requires-esm.cjs",
+			"module.exports = { exp: require('./esm-exports.mjs'), marked: require('./esm-marked.mjs'), plain: require('./esm-plain.mjs'), json: require('./data.json') };"
+		);
+		write("data.json", '{ "ok": true }');
+		write("node_modules/pkg/package.json", '{ "main": "index.cjs" }');
+		write("node_modules/pkg/index.cjs", "const inner = require('./inner.cjs'); module.exports = { inner };");
+		write("node_modules/pkg/inner.cjs", "module.exports = { id: Math.random() };");
+		write("uses-pkg.cjs", "module.exports = require('pkg');");
+		write("typed-cjs/package.json", '{ "type": "commonjs" }');
+		write("typed-cjs/a.js", "export const notReallyCjs = 1;");
+		write("typed-esm/package.json", '{ "type": "module" }');
+		write("typed-esm/a.js", "module.exports = 1;");
+		write("untyped/package.json", '{ "name": "untyped" }');
+		write("untyped/cjs.js", "#!/usr/bin/env node\nmodule.exports = 1;");
+		write("untyped/esm.js", "export const x = 1;");
+		write("malformed/package.json", "{ not json");
+		write("malformed/a.js", "module.exports = 1;");
+		write("node_modules/bare/a.js", "module.exports = 1;");
+		write(
+			"bridge-leaf.cjs",
+			"const viaEsm = require('./bridge.mjs'); const direct = require('./helper.cjs'); module.exports = { viaEsm, direct };"
+		);
+		write("bridge.mjs", "import helper from './helper.cjs'; export { helper };");
+		write("reexporting.cjs", "module.exports = require('./helper.cjs');");
+	});
+
+	afterAll(async () => {
+		await fsp.rm(root, { recursive: true, force: true });
+	});
+
+	it("keeps one helper copy per instance, evaluates a fresh leaf each time, and leaves require.cache as it was", () => {
+		const leaf = path.join(root, "leaf.cjs");
+		const helper = path.join(root, "helper.cjs");
+		const cache = createRequire(leaf).cache;
+		const hostCopy = { id: helper, exports: { host: true }, loaded: true };
+		cache[helper] = hostCopy;
+		const a1 = requireInInstance(leaf, "unit-a", { fresh: true });
+		const a2 = requireInInstance(leaf, "unit-a", { fresh: true });
+		const b = requireInInstance(leaf, "unit-b", { fresh: true });
+		expect(a1.self).not.toBe(a2.self);
+		expect([a1.bump(), a2.bump(), b.bump()]).toEqual([1, 2, 1]);
+		expect(cache[helper]).toBe(hostCopy);
+		expect(cache[leaf]).toBeUndefined();
+		// A helper required directly (not fresh) is the instance's copy.
+		expect(requireInInstance(helper, "unit-a").bump()).toBe(3);
+		releaseInstanceScope("unit-a");
+		releaseInstanceScope("unit-b");
+		releaseInstanceScope(null);
+		expect(requireInInstance(leaf, "unit-a", { fresh: true }).bump()).toBe(1);
+		releaseInstanceScope("unit-a");
+		delete cache[helper];
+	});
+
+	it("serves an instance's copy of a package file it reached earlier and puts the host's copy back", () => {
+		const pkgIndex = path.join(root, "node_modules/pkg/index.cjs");
+		const cache = createRequire(pkgIndex).cache;
+		const first = requireInInstance(pkgIndex, "unit-pkg");
+		const viaApp = requireInInstance(path.join(root, "uses-pkg.cjs"), "unit-pkg", { fresh: true });
+		expect(viaApp).toBe(first);
+		expect(cache[pkgIndex]).toBeUndefined();
+		// With the host holding its own copy, the instance still gets its copy and the host's is restored.
+		const hostCopy = createRequire(pkgIndex)(pkgIndex);
+		expect(requireInInstance(path.join(root, "uses-pkg.cjs"), "unit-pkg", { fresh: true })).toBe(first);
+		expect(cache[pkgIndex].exports).toBe(hostCopy);
+		delete cache[pkgIndex];
+		delete cache[path.join(root, "node_modules/pkg/inner.cjs")];
+		releaseInstanceScope("unit-pkg");
+	});
+
+	it("evaluates a file afresh as a leaf even when the instance holds it as a helper", () => {
+		const helper = path.join(root, "helper.cjs");
+		const asHelper = requireInInstance(helper, "unit-fresh");
+		expect(asHelper.bump()).toBe(1);
+		const asLeaf = requireInInstance(helper, "unit-fresh", { fresh: true });
+		expect(asLeaf).not.toBe(asHelper);
+		expect(asLeaf.bump()).toBe(1);
+		expect(requireInInstance(helper, "unit-fresh")).toBe(asHelper);
+		releaseInstanceScope("unit-fresh");
+	});
+
+	it("shares one CommonJS helper copy between a leaf's require and an ES module it requires that imports the helper", () => {
+		const out = requireInInstance(path.join(root, "bridge-leaf.cjs"), "unit-bridge", { fresh: true });
+		expect(out.viaEsm.helper).toBe(out.direct);
+		const other = requireInInstance(path.join(root, "bridge-leaf.cjs"), "unit-bridge-2", { fresh: true });
+		expect(other.direct).not.toBe(out.direct);
+		releaseInstanceScope("unit-bridge");
+		releaseInstanceScope("unit-bridge-2");
+	});
+
+	it("returns what Node's require(esm) returns: a 'module.exports' export, an own __esModule, a plain namespace", () => {
+		const out = requireInInstance(path.join(root, "requires-esm.cjs"), "unit-esm", { fresh: true });
+		expect(out.exp).toEqual({ custom: true });
+		expect(out.marked.__esModule).toBe(false);
+		expect(out.marked.default).toBe(1);
+		expect(out.plain.bump()).toBe(1);
+		expect(out.json).toEqual({ ok: true });
+		const again = requireInInstance(path.join(root, "requires-esm.cjs"), "unit-esm", { fresh: true });
+		expect(again.plain).toBe(out.plain);
+		const other = requireInInstance(path.join(root, "requires-esm.cjs"), "unit-esm-2", { fresh: true });
+		expect(other.plain).not.toBe(out.plain);
+		const leaked = Object.keys(createRequire(import.meta.url).cache).filter((k) => k.startsWith("slothlet-esm"));
+		expect(leaked).toEqual([]);
+		releaseInstanceScope("unit-esm");
+		releaseInstanceScope("unit-esm-2");
+	});
+
+	it("generates a wrapper exporting default, 'module.exports', scanned names and an already-loaded copy's keys", () => {
+		const helper = path.join(root, "helper.cjs");
+		const fresh = commonJSWrapperSource(helper, "unit-w", null);
+		expect(fresh).toContain('export { n0 as "bump" };');
+		expect(fresh).toContain("export default m;");
+		expect(fresh).toContain('export { m as "module.exports" };');
+		state().scopes.set("unit-w", new Map([[helper, { loaded: true, exports: { bump() {}, late: 1, default: 2 } }]]));
+		const withLoaded = commonJSWrapperSource(helper, "unit-w", new TextEncoder().encode("exports.bump = 1;"));
+		expect(withLoaded).toContain('as "late"');
+		expect(withLoaded).not.toContain('as "default"');
+		state().scopes.set("unit-w", new Map([[helper, { loaded: true, exports: 42 }]]));
+		expect(commonJSWrapperSource(helper, "unit-w", "exports.only = 1;")).toContain('as "only"');
+		// A re-export is followed into the required file.
+		expect(commonJSWrapperSource(path.join(root, "reexporting.cjs"), "unit-w", null)).toContain('as "bump"');
+		releaseInstanceScope("unit-w");
+	});
+
+	it("decides CommonJS the way Node does", () => {
+		expect(isCommonJSFile(path.join(root, "helper.cjs"))).toBe(true);
+		expect(isCommonJSFile(path.join(root, "esm-plain.mjs"))).toBe(false);
+		expect(isCommonJSFile(path.join(root, "typed-cjs/a.js"))).toBe(true);
+		expect(isCommonJSFile(path.join(root, "typed-esm/a.js"))).toBe(false);
+		expect(isCommonJSFile(path.join(root, "untyped/cjs.js"))).toBe(true);
+		expect(isCommonJSFile(path.join(root, "untyped/esm.js"))).toBe(false);
+		expect(isCommonJSFile(path.join(root, "malformed/a.js"))).toBe(false);
+		// No package.json inside the package: the walk stops at node_modules, then syntax decides.
+		expect(isCommonJSFile(path.join(root, "node_modules/bare/a.js"))).toBe(true);
+		expect(isCommonJSFile(path.join(root, "missing.js"))).toBe(false);
+	});
+
+	describe("Node hooks", () => {
+		let hooks;
+
+		beforeAll(() => {
+			installInstanceImportHooks({ registerHooks: (h) => (hooks = h) }, {});
+		});
+
+		it("resolves the require(esm) virtual modules to themselves", () => {
+			const next = () => {
+				throw new Error("must not resolve");
+			};
+			expect(hooks.resolve("slothlet-esm:file:///x.mjs?slothlet_instance=a", {}, next)).toEqual({
+				url: "slothlet-esm:file:///x.mjs?slothlet_instance=a",
+				format: "module",
+				shortCircuit: true
+			});
+			expect(hooks.resolve("slothlet-esm-facade:file:///x.mjs?slothlet_instance=a", {}, next).shortCircuit).toBe(true);
+		});
+
+		it("passes unmarked and non-file loads through unchanged", () => {
+			const result = { format: "module", source: "" };
+			const next = () => result;
+			expect(hooks.load("file:///x.mjs", {}, next)).toBe(result);
+			expect(hooks.load("data:text/javascript,1?slothlet_instance=a", {}, next)).toBe(result);
+			expect(hooks.load("file:///x.mjs?slothlet_instance=a", {}, next)).toBe(result);
+		});
+
+		it("answers the virtual modules with re-export source", () => {
+			const next = () => {
+				throw new Error("must not load");
+			};
+			expect(hooks.load("slothlet-esm:file:///x.mjs?slothlet_instance=a", {}, next).source).toContain('export { ns as "module.exports" }');
+			expect(hooks.load("slothlet-esm-facade:file:///x.mjs?slothlet_instance=a", {}, next).source).toContain(
+				"export const __esModule = true;"
+			);
+		});
+
+		it("serves a scoped require of an ES module through a CommonJS stub, and leaves CommonJS alone", () => {
+			const url = "file:///x.mjs?slothlet_instance=a&slothlet_require=1";
+			const stub = hooks.load(url, {}, () => ({ format: "module", source: "" }));
+			expect(stub.format).toBe("commonjs");
+			expect(stub.source).toContain('requireESM("file:///x.mjs?slothlet_instance=a")');
+			const cjs = { format: "commonjs", source: "" };
+			expect(hooks.load("file:///x.js?slothlet_instance=a&slothlet_require=1", {}, () => cjs)).toBe(cjs);
+		});
+
+		it("wraps an instance-marked CommonJS module, reading the file when the loader gave no source", () => {
+			const helper = path.join(root, "helper.cjs");
+			const url = `${new URL(`file://${helper}`).href}?slothlet_instance=unit-h`;
+			const out = hooks.load(url, {}, () => ({ format: "commonjs", source: null }));
+			expect(out.format).toBe("module");
+			expect(out.source).toContain('as "bump"');
+			const noInstance = { format: "commonjs", source: null };
+			expect(hooks.load(`${new URL(`file://${helper}`).href}?x=1&a_slothlet_instance=1`, {}, () => noInstance)).toBe(noInstance);
+		});
+
+		it("marks only relative require()s from the active scope's files that resolve to a possible ES module", () => {
+			const s = state();
+			const outer = s.active;
+			const leaf = path.join(root, "leaf.cjs");
+			s.active = { instanceID: "a b", anchor: leaf };
+			try {
+				const parentURL = new URL(`file://${leaf}`).href;
+				const req = new Set(["require", "node"]);
+				const at = (url) => () => ({ url });
+				const esm = new URL(`file://${path.join(root, "esm-plain.mjs")}`).href;
+				expect(hooks.resolve("./esm-plain.mjs", { parentURL, conditions: req }, at(esm)).url).toBe(
+					`${esm}?slothlet_instance=a+b&slothlet_require=1`
+				);
+				expect(hooks.resolve("./esm-plain.mjs", { parentURL, conditions: ["require"] }, at(esm)).url).toContain("slothlet_require=1");
+				// Not marked: an import, a bare specifier, a query already present, CommonJS/JSON/addon targets,
+				// non-file targets, a parent outside the scope, a target in another package.
+				expect(hooks.resolve("./esm-plain.mjs", { parentURL, conditions: ["import"] }, at(esm)).url).toBe(esm);
+				expect(hooks.resolve("./esm-plain.mjs", { parentURL }, at(esm)).url).toBe(esm);
+				expect(hooks.resolve("pkg", { parentURL, conditions: req }, at(esm)).url).toBe(esm);
+				expect(hooks.resolve("./x", { parentURL, conditions: req }, at(`${esm}?q=1`)).url).toBe(`${esm}?q=1`);
+				for (const ext of ["cjs", "json", "node"]) {
+					expect(hooks.resolve("./x", { parentURL, conditions: req }, at(`file:///app/x.${ext}`)).url).toBe(`file:///app/x.${ext}`);
+				}
+				expect(hooks.resolve("./x", { parentURL, conditions: req }, at("node:fs")).url).toBe("node:fs");
+				expect(hooks.resolve("./x", { parentURL, conditions: req }, () => ({})).url).toBeUndefined();
+				const pkgParent = new URL(`file://${path.join(root, "node_modules/pkg/index.cjs")}`).href;
+				expect(hooks.resolve("./x.mjs", { parentURL: pkgParent, conditions: req }, at(esm)).url).toBe(esm);
+				expect(hooks.resolve("./x.mjs", { conditions: req }, at(esm)).url).toBe(esm);
+				const pkgFile = new URL(`file://${path.join(root, "node_modules/pkg/x.mjs")}`).href;
+				expect(hooks.resolve("./node_modules/pkg/x.mjs", { parentURL, conditions: req }, at(pkgFile)).url).toBe(pkgFile);
+			} finally {
+				s.active = outer;
+			}
+		});
+	});
+
+	describe("vite plugin load", () => {
+		const plugin = slothletInstanceImports();
+
+		it("loads an instance-marked CommonJS file as the per-instance wrapper", () => {
+			const out = plugin.load(`${path.join(root, "helper.cjs")}?slothlet_instance=unit-v`);
+			expect(out.code).toContain("requireCJS(");
+			expect(out.code).toContain('as "bump"');
+		});
+
+		it("defers everything else to vite", () => {
+			expect(plugin.load(undefined)).toBe(null);
+			expect(plugin.load(path.join(root, "helper.cjs"))).toBe(null);
+			expect(plugin.load(`${path.join(root, "esm-plain.mjs")}?slothlet_instance=unit-v`)).toBe(null);
+			expect(plugin.load(`${path.join(root, "helper.cjs")}?not_slothlet_instance=1`)).toBe(null);
+		});
+	});
+});
diff --git a/tests/vitests/suites/isolation/helper-imports-mixed-formats.test.vitest.mjs b/tests/vitests/suites/isolation/helper-imports-mixed-formats.test.vitest.mjs
new file mode 100644
index 000000000..207111026
--- /dev/null
+++ b/tests/vitests/suites/isolation/helper-imports-mixed-formats.test.vitest.mjs
@@ -0,0 +1,190 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/isolation/helper-imports-mixed-formats.test.vitest.mjs
+ *	@Date: 2026-10-02 12:27:51 -07:00 (1790969271)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 12:27:51 -07:00 (1790969271)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Helpers that cross module systems are per instance too (#534).
+ *
+ * @description
+ * #518 made a leaf's relative helpers one copy per instance. Two combinations cross into a loader
+ * cache keyed by file path alone, and so were still shared by every instance:
+ *
+ * 1. an ESM leaf that `import`s a relative `.cjs` helper — Node caches CommonJS by filename and
+ *    ignores the instance query;
+ * 2. a `.cjs` leaf that `require()`s an ES module — `require(esm)` loads the module under its plain
+ *    file URL.
+ *
+ * Both now follow the #518 rule: one copy per instance, kept across a partial reload, fresh after a
+ * full reload. The `.cjs` helper keeps Node's import shape (`default` is `module.exports`, plus named
+ * exports), and `require()` of an ES module keeps Node's (`__esModule` facade for a default export).
+ */
+
+import { describe, it, expect, afterEach } from "vitest";
+import { spawnSync } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import slothlet from "@cldmv/slothlet";
+import { TEST_DIRS } from "../../setup/vitest-helper.mjs";
+
+const FIXTURE = path.resolve(TEST_DIRS.API_TEST_HELPER_IMPORTS, "../__mixed");
+const BASE = path.join(FIXTURE, "api");
+const NATIVE_PROBE = path.join(FIXTURE, "native-probe.mjs");
+const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../../..");
+
+const CONFIGS = [
+	{ name: "eager", config: { mode: "eager" } },
+	{ name: "lazy", config: { mode: "lazy" } }
+];
+
+describe.each(CONFIGS)("Isolation > helper imports across module systems (#534) > '$name'", ({ config }) => {
+	const instances = [];
+
+	/**
+	 * Create an instance over the mixed-format fixture and track it for shutdown.
+	 * @returns {Promise<object>} The composed api.
+	 */
+	const create = async () => {
+		const api = await slothlet({ ...config, base: BASE, silent: true });
+		instances.push(api);
+		return api;
+	};
+
+	afterEach(async () => {
+		while (instances.length) await instances.pop().shutdown();
+	});
+
+	it("gives each instance its own copy of an ESM leaf's .cjs helper, through named and default imports", async () => {
+		const a = await create();
+		const b = await create();
+		expect(await a.esmcjs.count()).toBe(1);
+		expect(await a.esmcjs.count()).toBe(2);
+		expect(await b.esmcjs.count()).toBe(1);
+		expect(await a.esmcjs.viaDefault()).toBe(3);
+		expect(await b.esmcjs.viaDefault()).toBe(2);
+	});
+
+	it("isolates the .cjs helper's own CommonJS and ES module requires", async () => {
+		const a = await create();
+		const b = await create();
+		expect(await a.esmcjs.inner()).toBe(1);
+		expect(await a.esmcjs.inner()).toBe(2);
+		expect(await b.esmcjs.inner()).toBe(1);
+		expect(await a.esmcjs.deep()).toBe(1);
+		expect(await a.esmcjs.deep()).toBe(2);
+		expect(await b.esmcjs.deep()).toBe(1);
+	});
+
+	it("keeps Node's import shape for a module.exports object literal", async () => {
+		const a = await create();
+		const b = await create();
+		expect(await a.esmcjs.object()).toBe(1);
+		expect(await a.esmcjs.object()).toBe(2);
+		expect(await b.esmcjs.object()).toBe(1);
+		expect(await a.esmcjs.shape()).toEqual({ defaultIsExports: true, label: "object" });
+	});
+
+	it("keeps ONE .cjs helper copy shared by every ESM leaf of the same instance", async () => {
+		const a = await create();
+		const b = await create();
+		expect(await a.esmcjs.count()).toBe(1);
+		expect(await a.esmcjspeer.count()).toBe(2);
+		expect(await b.esmcjspeer.count()).toBe(1);
+	});
+
+	it("gives each instance its own copy of a .cjs leaf's required ES modules", async () => {
+		const a = await create();
+		const b = await create();
+		expect(await a.cjsesm.count()).toBe(1);
+		expect(await a.cjsesm.count()).toBe(2);
+		expect(await b.cjsesm.count()).toBe(1);
+		// The required module's own import chain.
+		expect(await a.cjsesm.chain()).toBe(1);
+		expect(await b.cjsesm.chain()).toBe(1);
+		// A `.js` file in a `"type": "module"` scope.
+		expect(await a.cjsesm.plain()).toBe(1);
+		expect(await a.cjsesm.plain()).toBe(2);
+		expect(await b.cjsesm.plain()).toBe(1);
+	});
+
+	it("keeps Node's require(esm) shape for an ES module with a default export", async () => {
+		const a = await create();
+		expect(await a.cjsesm.interop()).toEqual({ esModule: true, defaultType: "function" });
+	});
+
+	it("refreshes cross-format helpers on a full reload and leaves the other instance alone", async () => {
+		const a = await create();
+		const b = await create();
+		expect(await a.esmcjs.count()).toBe(1);
+		expect(await a.esmcjs.deep()).toBe(1);
+		expect(await a.cjsesm.count()).toBe(1);
+		expect(await a.cjsesm.plain()).toBe(1);
+		expect(await b.esmcjs.count()).toBe(1);
+		await a.slothlet.reload();
+		expect(await a.esmcjs.count()).toBe(1);
+		expect(await a.esmcjs.deep()).toBe(1);
+		expect(await a.cjsesm.count()).toBe(1);
+		expect(await a.cjsesm.plain()).toBe(1);
+		expect(await b.esmcjs.count()).toBe(2);
+	});
+
+	it("keeps the instance's cross-format helper copies across a partial reload", async () => {
+		const a = await create();
+		const b = await create();
+		expect(await a.esmcjs.count()).toBe(1);
+		expect(await a.esmcjs.deep()).toBe(1);
+		expect(await a.cjsesm.count()).toBe(1);
+		expect(await a.cjsesm.plain()).toBe(1);
+		await a.slothlet.api.reload("esmcjs");
+		await a.slothlet.api.reload("cjsesm");
+		expect(await a.esmcjs.count()).toBe(2);
+		expect(await a.esmcjspeer.count()).toBe(3);
+		expect(await a.esmcjs.deep()).toBe(2);
+		expect(await a.cjsesm.count()).toBe(2);
+		expect(await a.cjsesm.plain()).toBe(2);
+		expect(await b.esmcjs.count()).toBe(1);
+		expect(await b.cjsesm.count()).toBe(1);
+	});
+});
+
+// Inside vitest an ESM leaf loads through vite's module graph, while a .cjs leaf and everything it
+// require()s load natively. A real Node process runs every leaf through Node's own loaders and
+// slothlet's module hooks — including one copy per instance ACROSS module systems.
+describe("Isolation > helper imports across module systems (#534) > native Node loaders", () => {
+	it("isolates ESM→.cjs and .cjs→ESM helpers per instance, shares them across formats within an instance, keeps them across partial reloads and refreshes them on a full reload", () => {
+		const result = spawnSync(process.execPath, [NATIVE_PROBE], { cwd: REPO_ROOT, env: process.env, encoding: "utf8", timeout: 120000 });
+		expect(result.status, result.stderr).toBe(0);
+		const out = JSON.parse(result.stdout.trim().split("\n").pop());
+		const expected = {
+			// a, a, b through the named import; then the default import (module.exports) for a and b.
+			esmToCjs: [1, 2, 1, 3, 2],
+			// The .cjs helper's own require of a .cjs (a, a, b) and of an ES module (a, a, b).
+			esmToCjsChain: [1, 2, 1, 1, 2, 1],
+			esmToCjsObject: [1, 2, 1],
+			esmToCjsShape: { defaultIsExports: true, label: "object" },
+			// A second ESM leaf shares the .cjs helper copy within each instance (a: 4th bump, b: 3rd).
+			esmToCjsPeer: [4, 3],
+			// .cjs leaf → .mjs helper (a, a, b), its import chain (a, b), a `.js` ES module (a, a, b).
+			cjsToEsm: [1, 2, 1, 1, 1, 1, 2, 1],
+			cjsToEsmInterop: { esModule: true, defaultType: "function" },
+			// One copy per instance across module systems: the ESM leaf continues the .mjs helper the .cjs
+			// leaf required (a: 3rd, b: 2nd); the .cjs leaf continues the .cjs helper the ESM leaves
+			// imported (a: 5th, b: 4th).
+			crossFormat: [3, 2, 5, 4],
+			// After a's full reload every helper restarts; b is untouched (5th bump).
+			afterFullReload: [1, 1, 1, 1, 1, 5],
+			// After b's partial reloads b keeps its helper copies; a is untouched.
+			afterPartialReload: [6, 2, 3, 2, 2]
+		};
+		expect(out.eager).toEqual(expected);
+		expect(out.lazy).toEqual(expected);
+	}, 150000);
+});
diff --git a/types/src/lib/helpers/cjs-export-names.d.mts b/types/src/lib/helpers/cjs-export-names.d.mts
new file mode 100644
index 000000000..75e0b095b
--- /dev/null
+++ b/types/src/lib/helpers/cjs-export-names.d.mts
@@ -0,0 +1,33 @@
+/**
+ * Scan CommonJS source for its named exports and re-exported specifiers.
+ * @param {string} source - The module source.
+ * @returns {{ names: Set<string>, reexports: string[] }} Names it assigns, and the specifiers whose
+ *   exports it re-exports.
+ * @internal
+ * @example
+ * scanCommonJSExports('exports.a = 1; module.exports.b = 2;').names; // Set { "a", "b" }
+ */
+export function scanCommonJSExports(source: string): {
+    names: Set<string>;
+    reexports: string[];
+};
+/**
+ * The named exports an ESM importer sees for a CommonJS file: the scan of the file plus, recursively,
+ * the names of every CommonJS file it re-exports. `default` is excluded (it is always
+ * `module.exports`), as are names that are not well-formed strings.
+ * @param {string} filePath - Absolute path of the CommonJS file.
+ * @param {string} source - Its source text.
+ * @param {object} io - File access.
+ * @param {(file: string) => string} io.readFile - Read a file as UTF-8.
+ * @param {(specifier: string, fromFile: string) => string} io.resolve - Resolve a require() specifier
+ *   from a file to an absolute path (throws when it cannot).
+ * @returns {string[]} The export names, in discovery order.
+ * @internal
+ * @example
+ * commonJSExportNames("/app/lib/h.cjs", source, { readFile, resolve }); // ["bump", "label"]
+ */
+export function commonJSExportNames(filePath: string, source: string, io: {
+    readFile: (file: string) => string;
+    resolve: (specifier: string, fromFile: string) => string;
+}): string[];
+//# sourceMappingURL=cjs-export-names.d.mts.map
\ No newline at end of file
diff --git a/types/src/lib/helpers/cjs-export-names.d.mts.map b/types/src/lib/helpers/cjs-export-names.d.mts.map
new file mode 100644
index 000000000..b340dede0
--- /dev/null
+++ b/types/src/lib/helpers/cjs-export-names.d.mts.map
@@ -0,0 +1 @@
+{"version":3,"file":"cjs-export-names.d.mts","sourceRoot":"","sources":["../../../../src/lib/helpers/cjs-export-names.mjs"],"names":[],"mappings":"AAmUA;;;;;;;;GAQG;AACH,4CAPW,MAAM,GACJ;IAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAoDvD;AAED;;;;;;;;;;;;;;GAcG;AACH,8CAXW,MAAM,UACN,MAAM,MAEd;IAAqC,QAAQ,EAArC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM;IAC4B,OAAO,EAA3D,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM;CAEvD,GAAU,MAAM,EAAE,CA2BpB"}
\ No newline at end of file
diff --git a/types/src/lib/helpers/instance-imports.d.mts b/types/src/lib/helpers/instance-imports.d.mts
index f1b72794e..946575a26 100644
--- a/types/src/lib/helpers/instance-imports.d.mts
+++ b/types/src/lib/helpers/instance-imports.d.mts
@@ -39,7 +39,64 @@ export function isInstanceScopedFile(child: string, parent: string): boolean;
  */
 export function propagateInstanceQuery(specifier: string, parent: string | undefined, child: string): string;
 /**
- * Register the resolve hook with Node, once per process (idempotent across slothlet copies).
+ * Run a CommonJS file through an instance's private CommonJS cache (#518, #534) and return its
+ * `module.exports`.
+ *
+ * Node's `require.cache` is keyed on the file path alone, so the instance-scoped files the require
+ * reaches (see {@link isInstanceScopedFile} — the file itself and its relative helpers, never
+ * `node_modules` packages or slothlet's own files) are kept in a private cache per instance ID and
+ * swapped into `require.cache` only for the duration of this synchronous require: global entries for
+ * those files are set aside and restored afterwards, so neither the host's copies nor another
+ * instance's copies are ever served, and `require.cache` does not grow. The cache is shared by every
+ * leaf and mount of the instance and kept across partial reloads; a full reload rotates the instance
+ * ID and so starts a fresh one ({@link releaseInstanceScope} drops the old one).
+ *
+ * While the require runs, the scope is active: a relative `require()` of an ES module from a file of
+ * the scope is served the instance's copy of that module (the resolve and load hooks of
+ * {@link installInstanceImportHooks}).
+ * @param {string} filePath - Absolute path of the CommonJS file.
+ * @param {string} instanceID - The instance whose copies are served.
+ * @param {object} [options] - Options.
+ * @param {boolean} [options.fresh=false] - Evaluate the file itself anew instead of serving (and
+ *   keeping) the instance's copy of it — how a leaf is loaded, so a partial reload re-runs it.
+ * @returns {*} The file's `module.exports`.
+ * @internal
+ * @example
+ * const exports = requireInInstance("/app/api/counter.cjs", "inst-a", { fresh: true });
+ */
+export function requireInInstance(filePath: string, instanceID: string, { fresh }?: {
+    fresh?: boolean | undefined;
+}): any;
+/**
+ * Drop an instance's private CommonJS copies (#534): on shutdown, and for the old instance ID on a
+ * full reload. Its ES module copies stay in Node's module cache (which has no eviction) but are no
+ * longer reachable from a live instance.
+ * @param {string|null|undefined} instanceID - The instance ID.
+ * @returns {void}
+ * @internal
+ * @example
+ * releaseInstanceScope(oldInstanceID);
+ */
+export function releaseInstanceScope(instanceID: string | null | undefined): void;
+/**
+ * Source of the ES module that stands in for a CommonJS helper imported by an instance (#534): it
+ * runs the file through the instance's private CommonJS cache and exports what Node's own
+ * ESM-to-CommonJS import exports — `default` (`module.exports`), `"module.exports"`, and the named
+ * exports found by a static scan of the source, read from `module.exports` once it has run.
+ * @param {string} filePath - Absolute path of the CommonJS file.
+ * @param {string} instanceID - The instance ID.
+ * @param {string|null|undefined|Uint8Array} source - Its source, when the loader already read it.
+ * @returns {string} The wrapper's ES module source.
+ * @internal
+ * @example
+ * commonJSWrapperSource("/app/lib/state.cjs", "inst-a", null);
+ */
+export function commonJSWrapperSource(filePath: string, instanceID: string, source: string | null | undefined | Uint8Array): string;
+/**
+ * Register the resolve and load hooks with Node, once per process (idempotent across slothlet copies).
+ * The resolve hook copies a leaf's instance query onto its relative imports and marks relative
+ * `require()`s made inside an instance scope; the load hook serves the cross-module-system cases
+ * (#534) and passes every unmarked URL straight through.
  * Uses the synchronous in-thread `module.registerHooks()` (Node >= 22.15 / 23.5, slothlet's engines
  * floor). The off-thread `module.register()` is deliberately not used: it adds a cross-thread round
  * trip to every import in the process and reorders module evaluation enough to break leaves that
@@ -53,11 +110,28 @@ export function propagateInstanceQuery(specifier: string, parent: string | undef
  * installInstanceImportHooks(await import("node:module"));
  */
 export function installInstanceImportHooks(nodeModule: object, registry?: object): boolean;
+/**
+ * Whether Node loads a file as CommonJS, decided the way Node decides it: `.cjs` always; `.js` by the
+ * nearest `package.json` `type` (the first one found ends the walk), and with no `type` by syntax
+ * detection (the source compiles as a CommonJS function body). Used by the vite plugin, which sees
+ * file ids rather than Node's resolved formats.
+ * @param {string} filePath - Absolute file path.
+ * @returns {boolean} True when the file is CommonJS.
+ * @internal
+ * @example
+ * isCommonJSFile("/app/lib/state.cjs"); // true
+ */
+export function isCommonJSFile(filePath: string): boolean;
 /**
  * Vite plugin applying the same rule inside a vite module graph — for leaves a consumer loads
  * through slothlet's `import` hook under vitest (docs/TESTING.md), where Node's resolve hooks
  * never see the leaf's imports. Add it to the consumer's `vitest.config` `plugins`.
- * @returns {object} A vite plugin (`name`, `enforce`, `resolveId`).
+ *
+ * A CommonJS helper imported under an instance id (#534) is loaded as the same ES module wrapper the
+ * Node load hook generates: the file runs through the instance's private CommonJS cache in the
+ * test's own process, so its own `require()`s — CommonJS or ES module — are per instance too, and
+ * the copy is shared with the instance's `.cjs` leaves.
+ * @returns {object} A vite plugin (`name`, `enforce`, `resolveId`, `load`).
  * @public
  * @example
  * // vitest.config.mjs
@@ -65,52 +139,6 @@ export function installInstanceImportHooks(nodeModule: object, registry?: object
  * export default defineConfig({ plugins: [slothletInstanceImports()] });
  */
 export function slothletInstanceImports(): object;
-/**
- *	@Project: @cldmv/slothlet
- *	@Filename: /src/lib/helpers/instance-imports.mjs
- *	@Date: 2026-09-28 20:32:55 -07:00 (1790652775)
- *	@Author: Shinrai <CLDMV>
- *	@Email: <Shinrai@users.noreply.github.com>
- *	-----
- *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
- *	@Last modified time: 2026-09-28 20:55:29 -07:00 (1790654129)
- *	-----
- *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
- */
-/**
- * @fileoverview Carry a leaf's per-instance import query onto the relative helpers it imports (#518).
- * @module @cldmv/slothlet/helpers/instance-imports
- *
- * @description
- * The loader imports every leaf with a per-instance query
- * (`?slothlet_instance=<id>[&module=<moduleID>][&_reload=<timestamp>]`), so each instance — and each
- * reload — evaluates its own copy of the leaf. A module the leaf IMPORTS is resolved by the host,
- * which knows nothing about that query: a relative helper would be one module shared by every
- * instance and every reload, and module-level state in it would leak between instances.
- *
- * This module closes that gap for everything reachable through relative or `file:` specifiers,
- * at any depth:
- *
- * - **Native Node** — {@link installInstanceImportHooks} registers a process-wide, in-thread resolve
- *   hook (`module.registerHooks()`, Node >= 22.15 — slothlet's engines floor) that copies the
- *   importing module's instance parameter onto the child. Registered once per process; a no-op
- *   for every import whose parent carries no slothlet query.
- * - **Vite / vitest** — {@link slothletInstanceImports} is the same rule as a vite `resolveId`
- *   plugin, for leaves loaded through a consumer's `import` hook into a vite module graph (where
- *   Node's resolve hooks never run).
- *
- * A helper is ONE copy per instance. Only `slothlet_instance` is copied: not the leaf's `module`
- * (mount) parameter, so the base leaves and every `api.slothlet.api.add` mount share the copy; and
- * not the leaf's `_reload` stamp, so a partial reload (`api.slothlet.api.reload(…)`) re-imports the
- * reloaded leaves against the instance's existing helper copy — helper state survives it. A full
- * reload (`api.slothlet.reload()`) rotates the instance ID, which is what gives helpers a fresh
- * copy; edits to helper code therefore need a full reload.
- *
- * What stays shared: bare specifiers (`node_modules` packages, `node:` builtins, subpath `#imports`,
- * `@cldmv/slothlet` and its runtime), any file inside a `node_modules` package other than the
- * importer's own, and slothlet's own source files — the live-binding runtime must remain one
- * module per process.
- */
 /**
  * Query parameters copied from a leaf onto its helpers: the instance only. The leaf's `module`
  * (mount) and `_reload` (partial-reload stamp) parameters are deliberately NOT copied — a helper is
@@ -120,6 +148,34 @@ export function slothletInstanceImports(): object;
  * @internal
  */
 export const INSTANCE_QUERY_KEYS: ReadonlyArray<string>;
+/**
+ * Process-wide instance-import state.
+ */
+export type InstanceImportState = {
+    /**
+     * - Per instance ID: the private CommonJS module
+     * copies of that instance, by filename.
+     */
+    scopes: Map<string, Map<string, object>>;
+    /**
+     * - The scope a synchronous
+     * {@link requireInInstance} is running in (`anchor` is the file it required), else null.
+     */
+    active: {
+        instanceID: string;
+        anchor: string;
+    } | null;
+    /**
+     * - Entry point of the ESM wrapper
+     * generated for a CommonJS helper.
+     */
+    requireCJS: (filePath: string, instanceID: string) => any;
+    /**
+     * - Entry point of the CommonJS stub generated for a
+     * `require()` of an ES module.
+     */
+    requireESM: (url: string) => any;
+};
 /**
  * Resolve-result shape shared by Node's resolve hooks.
  */
diff --git a/types/src/lib/helpers/instance-imports.d.mts.map b/types/src/lib/helpers/instance-imports.d.mts.map
index 9eb720364..1b54ca669 100644
--- a/types/src/lib/helpers/instance-imports.d.mts.map
+++ b/types/src/lib/helpers/instance-imports.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"instance-imports.d.mts","sourceRoot":"","sources":["../../../../src/lib/helpers/instance-imports.mjs"],"names":[],"mappings":"AAsFA;;;;;;;;;GASG;AACH,2CAPW,MAAM,GACJ,OAAO,CAWnB;AAiCD;;;;;;;;;;;;;GAaG;AACH,4CARW,MAAM,UACN,MAAM,GACJ,OAAO,CAWnB;AAED;;;;;;;;;;;;GAYG;AACH,kDATW,MAAM,UACN,MAAM,GAAC,SAAS,SAChB,MAAM,GACJ,MAAM,CAsBlB;AA8CD;;;;;;;;;;;;;GAaG;AACH,uDARW,MAAM,aACN,MAAM,GAEJ,OAAO,CAgBnB;AAED;;;;;;;;;;GAUG;AACH,2CAPa,MAAM,CA0BlB;AA/RD;;;;;;;;;;;GAWG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH;;;;;;;GAOG;AACH,kCAHU,aAAa,CAAC,MAAM,CAAC,CAGyC;;;;;;;;SAkJ1D,MAAM;;;;;;;;;;;;;sCAST,MAAM,mCAEJ,aAAa,GAAC,OAAO,CAAC,aAAa,CAAC"}
\ No newline at end of file
+{"version":3,"file":"instance-imports.d.mts","sourceRoot":"","sources":["../../../../src/lib/helpers/instance-imports.mjs"],"names":[],"mappings":"AA0KA;;;;;;;;;GASG;AACH,2CAPW,MAAM,GACJ,OAAO,CAWnB;AAiCD;;;;;;;;;;;;;GAaG;AACH,4CARW,MAAM,UACN,MAAM,GACJ,OAAO,CAWnB;AAED;;;;;;;;;;;;GAYG;AACH,kDATW,MAAM,UACN,MAAM,GAAC,SAAS,SAChB,MAAM,GACJ,MAAM,CAsBlB;AAeD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,4CAVW,MAAM,cACN,MAAM,cAEd;IAA0B,KAAK;CAE/B,GAAU,GAAC,CAmDb;AAED;;;;;;;;;GASG;AACH,iDANW,MAAM,GAAC,IAAI,GAAC,SAAS,GACnB,IAAI,CAOhB;AAoED;;;;;;;;;;;;GAYG;AACH,gDARW,MAAM,cACN,MAAM,UACN,MAAM,GAAC,IAAI,GAAC,SAAS,GAAC,UAAU,GAC9B,MAAM,CAgClB;AAoFD;;;;;;;;;;;;;;;;GAgBG;AACH,uDARW,MAAM,aACN,MAAM,GAEJ,OAAO,CAyBnB;AAED;;;;;;;;;;GAUG;AACH,yCANW,MAAM,GACJ,OAAO,CAgCnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,2CAPa,MAAM,CAsClB;AAjnBD;;;;;;;GAOG;AACH,kCAHU,aAAa,CAAC,MAAM,CAAC,CAGyC;;;;;;;;;YAiD1D,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;;;;;YAEhC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAC,IAAI;;;;;gBAE3C,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,GAAC;;;;;gBAE3C,CAAC,GAAG,EAAE,MAAM,KAAK,GAAC;;;;;;;;;SAmZlB,MAAM;;;;;;;;;;;;;sCAST,MAAM,mCAEJ,aAAa,GAAC,OAAO,CAAC,aAAa,CAAC"}
\ No newline at end of file
diff --git a/types/src/lib/processors/loader.d.mts.map b/types/src/lib/processors/loader.d.mts.map
index 5db6cf89d..af7da06f2 100644
--- a/types/src/lib/processors/loader.d.mts.map
+++ b/types/src/lib/processors/loader.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"loader.d.mts","sourceRoot":"","sources":["../../../../src/lib/processors/loader.mjs"],"names":[],"mappings":"AA6DA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,sDAjBW,MAAM,6BAEd;IAAqC,MAAM,GAAnC,MAAM,GAAC,SAAS;IACI,YAAY;CAExC,GAAU,OAAO,CAmBnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,gDAZG;IAAqC,MAAM,GAAnC,MAAM,GAAC,SAAS;IACG,GAAG;CAC9B,GAAU,OAAO,CAanB;AAED;;;;;;;;;;;;GAYG;AACH,mDAVW,MAAM,cACN,MAAM,GACJ,OAAO,CAYnB;AAED;;;;;;;;;;;;GAYG;AACH,uDAVW,MAAM,cACN,MAAM,GACJ,OAAO,CAcnB;AAwDD;;;;;GAKG;AACH;;;;;;;;;;GAUG;AACH,4CALa,MAAM,CAOlB;AAsBD;IACC,gCAAmC;IASnC;;;;OAIG;IACH,sBAHW,MAAM,EAKhB;IAED;;;;;;;;OAQG;IACH,4BAPW,MAAM,eACN,MAAM,aACN,MAAM,cACN,MAAM,GAAC,IAAI,GACT,OAAO,CAAC,MAAM,CAAC,CAsN3B;IAoMD;;;;;;;;;;;;;;OAcG;IACH,0BAbW,MAAM,YAEd;QAA0B,UAAU;QACX,YAAY;QACZ,QAAQ;QACD,UAAU;QACM,MAAM;QAE5B,iBAAiB;QAClB,OAAO;KAChC,GAAU,OAAO,CAAC,MAAM,CAAC,CAqJ3B;IA8PD;;;;;OAKG;IACH,8BAJW,MAAM,GACJ,MAAM,CA+ClB;;CACD;8BAnmC6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"loader.d.mts","sourceRoot":"","sources":["../../../../src/lib/processors/loader.mjs"],"names":[],"mappings":"AA6DA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,sDAjBW,MAAM,6BAEd;IAAqC,MAAM,GAAnC,MAAM,GAAC,SAAS;IACI,YAAY;CAExC,GAAU,OAAO,CAmBnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,gDAZG;IAAqC,MAAM,GAAnC,MAAM,GAAC,SAAS;IACG,GAAG;CAC9B,GAAU,OAAO,CAanB;AAED;;;;;;;;;;;;GAYG;AACH,mDAVW,MAAM,cACN,MAAM,GACJ,OAAO,CAYnB;AAED;;;;;;;;;;;;GAYG;AACH,uDAVW,MAAM,cACN,MAAM,GACJ,OAAO,CAcnB;AAwDD;;;;;GAKG;AACH;;;;;;;;;;GAUG;AACH,4CALa,MAAM,CAOlB;AAsBD;IACC,gCAAmC;IASnC;;;;OAIG;IACH,sBAHW,MAAM,EAKhB;IAED;;;;;;;;OAQG;IACH,4BAPW,MAAM,eACN,MAAM,aACN,MAAM,cACN,MAAM,GAAC,IAAI,GACT,OAAO,CAAC,MAAM,CAAC,CAwN3B;IA+JD;;;;;;;;;;;;;;OAcG;IACH,0BAbW,MAAM,YAEd;QAA0B,UAAU;QACX,YAAY;QACZ,QAAQ;QACD,UAAU;QACM,MAAM;QAE5B,iBAAiB;QAClB,OAAO;KAChC,GAAU,OAAO,CAAC,MAAM,CAAC,CAqJ3B;IA8PD;;;;;OAKG;IACH,8BAJW,MAAM,GACJ,MAAM,CA+ClB;;CACD;8BAhkC6B,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/slothlet.d.mts.map b/types/src/slothlet.d.mts.map
index 1e8164086..99193c928 100644
--- a/types/src/slothlet.d.mts.map
+++ b/types/src/slothlet.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"slothlet.d.mts","sourceRoot":"","sources":["../../src/slothlet.mjs"],"names":[],"mappings":"AAmtDA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,yBApCuB,CAAC,SAAX,MAAQ,6DAGV,eAAe,GACb,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,CAwCpC;;kBASS,QAAQ,CAAC;QAAC,QAAQ,EAAE,aAAa,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAC,CAAC,CAAC;QAAC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;KAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAgD3F,SAAS,GAAC,MAAM;;;;;;;;;;;;qBAEP,MAAM;iBAAO,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA8BhB,MAAM;eAAS,CAAC,QAAQ,GAAC,SAAS,GAAC,UAAU,GAAC,SAAS,CAAC;oBAAc,OAAO;gBAAU,CAAC,OAAO,GAAC,OAAO,CAAC;kBAAY,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAevI,KAAK,CAAC;YAAC,IAAI,EAAC,MAAM,CAAC;YAAA,IAAI,EAAC,MAAM,CAAC;YAAA,QAAQ,EAAC,MAAM,CAAA;SAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aA8BxD,MAAY,IAAI;;;;cAChB,MAAY,IAAI;;;;cAE3B;QAAgE,GAAG,EAAxD,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAC,SAAS,CAAC,CAAC;QACzB,GAAG,EAC/B;YAAkC,GAAG;YACH,MAAM;YACN,MAAM;YACN,MAAM;YACR,OAAO,EACvC;gBAA0C,QAAQ;gBACR,IAAI;gBACJ,SAAS;gBACT,UAAU;gBACV,YAAY;gBACZ,aAAa;gBACb,iBAAiB;gBACjB,mBAAmB;gBACnB,cAAc;aACxD;SAAA;QAA4B,OAAO,EACnC;YAAsC,GAAG;YACO,OAAO,EAA5C,MAAY,MAAM;YACS,GAAG;YACH,KAAK;YACL,GAAG;SACzC;QAA6B,IAAI;;;;;;;;6BAEV,MAAM;;;;yCACN,MAAM,EAAE;;;;;;;;;;;;;;;;;4BAIR,MAAM;;;;kCACN,MAAM;;;;;;;;6BAEN,MAAM;;;;;;;;;;;;;;;;;qCAIN,eAAe;;QACV,IAAI,EAChC;YAAmC,KAAK;YACL,OAAO;YACP,cAAc;YACd,MAAM;YACN,aAAa;YACb,IAAI;YACJ,GAAG;YACH,EAAE;YACJ,GAAG,EACpC;gBAAsC,OAAO,EAAlC,OAAO;gBACqB,MAAM;gBACN,OAAO;aAC9C;YAAmC,MAAM;YACN,kBAAkB;SACrD;QAA4B,KAAK,EACjC;YAAoC,EAAE;YACF,IAAI;YACJ,GAAG;YACH,IAAI;YACJ,YAAY;YACd,KAAK,EACvC;gBAA0C,GAAG;gBACH,MAAM;aAChD;YAAoC,QAAQ;YACR,OAAO;SAC3C;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,EAAE;SAC1C;QAA4B,WAAW,EACvC;YAAoD,GAAG,EAA5C,MAAY,MAAM;YACY,YAAY,EAA1C,OAAO;YAC0C,IAAI,EAArD,MAAY,OAAO,CAAE,IAAI,CAAC;SACrC;QAA4B,QAAQ,EACpC;YAAsD,MAAM,EAAjD,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,MAAM;YACN,SAAS;YACM,IAAI,EAA/C,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,SAAS;SAChD;QAA4B,KAAK,EACjC;YAAoC,GAAG;SACvC;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,UAAU;SAClD;QAA4B,WAAW,EACvC;YAAwC,OAAO,EAC/C;gBAAiD,OAAO,EAA7C,OAAO;gBACwC,MAAM,EAArD,MAAY,IAAI;gBAC+B,OAAO,EAAtD,MAAY,IAAI;gBACsB,iBAAiB,EAAvD,OAAO;gBAC+C,UAAU,EAAhE,CAAS,IAAO,EAAP,OAAO,KAAG,IAAI;gBACwB,IAAI,EAAnD,MAAY,IAAI;gBACsB,MAAM,EAA5C,OAAO;aAClB;SAAA;QAA4B,UAAU,EACtC;YAAyC,IAAI;YACJ,UAAU;YACV,UAAU;YACV,kBAAkB;YAClB,kBAAkB;SAC3D;QAA8B,UAAU;QACV,IAAI;QACL,SAAS;QACR,MAAM;QACN,OAAO;QACP,GAAG;QACH,KAAK;QACa,QAAQ,EAA7C,MAAY,OAAO,CAAE,IAAI,CAAC;KACvC;;gCAh6D6D,wBAAwB"}
\ No newline at end of file
+{"version":3,"file":"slothlet.d.mts","sourceRoot":"","sources":["../../src/slothlet.mjs"],"names":[],"mappings":"AAotDA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,yBApCuB,CAAC,SAAX,MAAQ,6DAGV,eAAe,GACb,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,CAwCpC;;kBASS,QAAQ,CAAC;QAAC,QAAQ,EAAE,aAAa,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAC,CAAC,CAAC;QAAC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;KAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAgD3F,SAAS,GAAC,MAAM;;;;;;;;;;;;qBAEP,MAAM;iBAAO,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA8BhB,MAAM;eAAS,CAAC,QAAQ,GAAC,SAAS,GAAC,UAAU,GAAC,SAAS,CAAC;oBAAc,OAAO;gBAAU,CAAC,OAAO,GAAC,OAAO,CAAC;kBAAY,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAevI,KAAK,CAAC;YAAC,IAAI,EAAC,MAAM,CAAC;YAAA,IAAI,EAAC,MAAM,CAAC;YAAA,QAAQ,EAAC,MAAM,CAAA;SAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aA8BxD,MAAY,IAAI;;;;cAChB,MAAY,IAAI;;;;cAE3B;QAAgE,GAAG,EAAxD,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAC,SAAS,CAAC,CAAC;QACzB,GAAG,EAC/B;YAAkC,GAAG;YACH,MAAM;YACN,MAAM;YACN,MAAM;YACR,OAAO,EACvC;gBAA0C,QAAQ;gBACR,IAAI;gBACJ,SAAS;gBACT,UAAU;gBACV,YAAY;gBACZ,aAAa;gBACb,iBAAiB;gBACjB,mBAAmB;gBACnB,cAAc;aACxD;SAAA;QAA4B,OAAO,EACnC;YAAsC,GAAG;YACO,OAAO,EAA5C,MAAY,MAAM;YACS,GAAG;YACH,KAAK;YACL,GAAG;SACzC;QAA6B,IAAI;;;;;;;;6BAEV,MAAM;;;;yCACN,MAAM,EAAE;;;;;;;;;;;;;;;;;4BAIR,MAAM;;;;kCACN,MAAM;;;;;;;;6BAEN,MAAM;;;;;;;;;;;;;;;;;qCAIN,eAAe;;QACV,IAAI,EAChC;YAAmC,KAAK;YACL,OAAO;YACP,cAAc;YACd,MAAM;YACN,aAAa;YACb,IAAI;YACJ,GAAG;YACH,EAAE;YACJ,GAAG,EACpC;gBAAsC,OAAO,EAAlC,OAAO;gBACqB,MAAM;gBACN,OAAO;aAC9C;YAAmC,MAAM;YACN,kBAAkB;SACrD;QAA4B,KAAK,EACjC;YAAoC,EAAE;YACF,IAAI;YACJ,GAAG;YACH,IAAI;YACJ,YAAY;YACd,KAAK,EACvC;gBAA0C,GAAG;gBACH,MAAM;aAChD;YAAoC,QAAQ;YACR,OAAO;SAC3C;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,EAAE;SAC1C;QAA4B,WAAW,EACvC;YAAoD,GAAG,EAA5C,MAAY,MAAM;YACY,YAAY,EAA1C,OAAO;YAC0C,IAAI,EAArD,MAAY,OAAO,CAAE,IAAI,CAAC;SACrC;QAA4B,QAAQ,EACpC;YAAsD,MAAM,EAAjD,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,MAAM;YACN,SAAS;YACM,IAAI,EAA/C,MAAY,MAAM,GAAC,IAAI;YACK,GAAG;YACH,MAAM;YACN,SAAS;SAChD;QAA4B,KAAK,EACjC;YAAoC,GAAG;SACvC;QAA4B,SAAS,EACrC;YAAwC,GAAG;YACH,UAAU;SAClD;QAA4B,WAAW,EACvC;YAAwC,OAAO,EAC/C;gBAAiD,OAAO,EAA7C,OAAO;gBACwC,MAAM,EAArD,MAAY,IAAI;gBAC+B,OAAO,EAAtD,MAAY,IAAI;gBACsB,iBAAiB,EAAvD,OAAO;gBAC+C,UAAU,EAAhE,CAAS,IAAO,EAAP,OAAO,KAAG,IAAI;gBACwB,IAAI,EAAnD,MAAY,IAAI;gBACsB,MAAM,EAA5C,OAAO;aAClB;SAAA;QAA4B,UAAU,EACtC;YAAyC,IAAI;YACJ,UAAU;YACV,UAAU;YACV,kBAAkB;YAClB,kBAAkB;SAC3D;QAA8B,UAAU;QACV,IAAI;QACL,SAAS;QACR,MAAM;QACN,OAAO;QACP,GAAG;QACH,KAAK;QACa,QAAQ,EAA7C,MAAY,OAAO,CAAE,IAAI,CAAC;KACvC;;gCAj6D6D,wBAAwB"}
\ No newline at end of file

From 53d46b17f511343817291256178528db0d4a31a2 Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Fri, 2 Oct 2026 13:56:36 -0700
Subject: [PATCH 45/49] ci: stop the skipped PR-run mirror from satisfying
 Required PR Check
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

On an in-repo feature PR, the `pull_request` run skips the
`required-check` job because the push run owns the status. A skipped job
still posts a check run under its name, and GitHub treats a skipped
required check as satisfied. The push run's mirror is only created once
`ci` finishes, so for the whole test window the only `✅ Required PR
Check` on the head SHA was the skipped one, and the PR could merge while
tests were still running.

Give the job a conditional name so the skipped path posts under a
different name and the required check stays pending until the push run
reports. Synced from CLDMV/.github#346.
---
 .github/workflows/ci.yml | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0e0c0e4a1..32acdeb66 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -300,7 +300,21 @@ jobs:
     # automatically — no `pull_request` round-trip needed for non-fork
     # non-release PRs.
     required-check:
-        name: ✅ Required PR Check
+        # The name is conditional on purpose. On an in-repo feature PR the
+        # `pull_request` run skips this job (the push run owns the status), and
+        # a skipped job still posts a check run under its name. GitHub treats a
+        # SKIPPED required check as satisfied — so if the skipped job were named
+        # `✅ Required PR Check`, it would green-light the ruleset (and enable
+        # auto-merge) while the push run's real mirror hadn't been created yet
+        # (it only appears once `ci` finishes), letting a PR merge mid-test or
+        # even override a red result. An expression name keeps the skipped job
+        # off the required name: GitHub does not evaluate the name of a skipped
+        # job, so it shows up as the raw expression text (still not the
+        # required name), while every path that runs evaluates to
+        # `✅ Required PR Check`. The condition is written out anyway so the
+        # name stays correct if GitHub ever starts evaluating it, and must stay
+        # identical to the `if:` below.
+        name: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == true || github.event.pull_request.head.ref == 'next' || github.event.pull_request.head.ref == 'hotfixes') && '✅ Required PR Check' || '⏭️ Required PR Check (reported by the push run)' }}
         needs: ci
         # Mirror the `ci` job's gating exactly. The four cases that run:
         #   1. push events                                            (job needs CI run)
@@ -308,8 +322,8 @@ jobs:
         #   3. release PRs from `next` → master/main                  (push covers SHA but commit-gate skips chore-bump)
         #   4. release PRs from `hotfixes` → master/main              (same reason)
         # In-repo feature PRs targeting `next` / `hotfixes` skip on
-        # pull_request — push on the head branch already posted the status
-        # on the SHA, and mirroring here would overwrite it.
+        # pull_request — the push run on the head branch reports the status
+        # on the SHA. See the `name:` above for why the skipped job is renamed.
         if: |
           always() && (
             github.event_name != 'pull_request' ||

From 070d022523ecad35cfb2ddf7f6077a307edb895c Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Fri, 2 Oct 2026 13:23:16 -0700
Subject: [PATCH 46/49] fix(unified-wrapper): make a plain namespace callable
 when a later module supplies its function

A non-callable wrapper uses the wrapper object as its proxy target, and a
Proxy's callability is fixed at creation, so a namespace that one module
created as a plain namespace stayed non-callable after another module added
a function at the same path (and a merge dropped that function entirely).

- syncWrapper's merge / merge-replace branches now hand the incoming impl to
  ___adoptCallableImpl(), which resolves the namespace's function slot like
  any merged member: an empty slot always takes it, `merge` keeps an
  existing function, `merge-replace` takes the incoming one. Ownership
  entries that record the namespace wrapper itself are pinned to the impl
  their module supplied first, so a removal can revert to it.
- When a function reaches a wrapper whose proxy is non-callable (merge, a
  replace/reload/rollback through _applyNewImpl, a lazy materialization),
  ___upgradeToCallableProxy() builds a proxy on a function target from the
  same handler, installs it in the parent, and re-points the old proxy's
  traps at it through the restart() forwarding traps. A held reference keeps
  reading, writing and enumerating the namespace but stays non-callable;
  api.<path> is callable.
- remove(moduleID) resolves a rolled-back namespace's function again from
  the remaining contributors (first supplier, replaced only by one placed
  under merge-replace/replace; merge losers never), so removing the winning
  module reverts to the previous function and removing a loser or a
  children-only module keeps it.
- The upgrade is one-way: with no function left the callable proxy is kept
  and a call throws INVALID_CONFIG_NOT_A_FUNCTION, as for a namespace that
  was callable from the start. A never-callable namespace stays
  typeof "object". The trap hot path is unchanged.

Fixes #533
---
 .../main.mjs                                  |  34 ++
 docs/API-RULES.md                             |   2 +
 docs/API-RULES/API-COLLISION-CONDITIONS.md    |  29 ++
 docs/RELOAD.md                                |   2 +
 src/lib/handlers/api-manager.mjs              |  67 ++-
 src/lib/handlers/ownership.mjs                |  25 +
 src/lib/handlers/unified-wrapper.mjs          | 286 +++++++++--
 ...namespace-becomes-callable.test.vitest.mjs | 459 ++++++++++++++++++
 types/src/lib/handlers/api-manager.d.mts      |   4 +-
 types/src/lib/handlers/api-manager.d.mts.map  |   2 +-
 types/src/lib/handlers/ownership.d.mts        |  20 +
 types/src/lib/handlers/ownership.d.mts.map    |   2 +-
 types/src/lib/handlers/unified-wrapper.d.mts  |  75 +++
 .../lib/handlers/unified-wrapper.d.mts.map    |   2 +-
 14 files changed, 955 insertions(+), 54 deletions(-)
 create mode 100644 api_tests/api_test_namespace_callable_second/main.mjs
 create mode 100644 tests/vitests/suites/addapi/addapi-namespace-becomes-callable.test.vitest.mjs

diff --git a/api_tests/api_test_namespace_callable_second/main.mjs b/api_tests/api_test_namespace_callable_second/main.mjs
new file mode 100644
index 000000000..0afb53cde
--- /dev/null
+++ b/api_tests/api_test_namespace_callable_second/main.mjs
@@ -0,0 +1,34 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /api_tests/api_test_namespace_callable_second/main.mjs
+ *	@Date: 2026-10-02 00:00:00 -07:00 (1790924400)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 00:00:00 -07:00 (1790924400)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview A second single-file module whose default export makes a shared namespace callable, so
+ * two modules compete for the same namespace function (#533).
+ * @module api_test_namespace_callable_second.main
+ */
+
+/**
+ * @function main
+ * @returns {string} `"second:main"`.
+ */
+export default function main() {
+	return "second:main";
+}
+
+/**
+ * @function more
+ * @returns {string} `"second:more"`.
+ */
+export function more() {
+	return "second:more";
+}
diff --git a/docs/API-RULES.md b/docs/API-RULES.md
index d68a2c6b7..c4803dcf5 100644
--- a/docs/API-RULES.md
+++ b/docs/API-RULES.md
@@ -745,6 +745,8 @@ api.thing("x"); // ✅ the leaf itself, mounted directly (nothing to hoist)
 
 **Note**: `warn` is intentionally context-dependent — a cross-module conflict keeps the existing owner, an intra-build file/folder collision merges (see O05).
 
+**Note**: a plain namespace becomes callable as soon as any contribution supplies its function, whatever the add order (O09) — `typeof api.<path>` turns "function" and the existing children stay. When two modules supply one, `merge` keeps the first and `merge-replace` takes the incoming one; `remove()` resolves it again from the modules that remain. A reference to the namespace taken before that keeps working for reads, writes and enumeration but stays non-callable; read `api.<path>` again to call it. A namespace no module makes callable stays `typeof` "object".
+
 ---
 
 ## Rule 18: Dynamic API Mutation
diff --git a/docs/API-RULES/API-COLLISION-CONDITIONS.md b/docs/API-RULES/API-COLLISION-CONDITIONS.md
index 638607871..ea24dfe58 100644
--- a/docs/API-RULES/API-COLLISION-CONDITIONS.md
+++ b/docs/API-RULES/API-COLLISION-CONDITIONS.md
@@ -135,6 +135,35 @@ Collision-resolution conditions — which value wins when two contributions land
 **Trigger**: `!existingIsCallable && valueIsCallable`
 **Result**: callable occupies the slot, existing children merged on (merge: existing child wins; merge-replace: incoming wins).
 
+**At runtime** (`api.slothlet.api.add()`, `reload()`, a `remove()` that reverts to a function owner, a lazy materialization that turns out callable): the same holds regardless of add order. When a later module supplies the function for a namespace an earlier module created as a plain namespace, the namespace becomes callable and keeps every child (`src/lib/handlers/unified-wrapper.mjs` `___adoptCallableImpl` / `___upgradeToCallableProxy`). The function slot resolves like any other merged member: a namespace with no function always takes the incoming one; one that already has a function keeps it under `merge` (first writer wins, as in O08) and takes the incoming one under `merge-replace` (incoming wins).
+
+```javascript
+await api.slothlet.api.add("plugins", "./plugins-a", { moduleID: "a" }); // plain namespace
+const held = api.plugins; // typeof "object"
+await api.slothlet.api.add("plugins", "./plugins-b", { moduleID: "b" }); // b's default export flattens onto plugins
+
+typeof api.plugins; // "function"
+api.plugins(); // runs b's function
+api.plugins.fromA(); // a's children stay
+
+held.fromA(); // a held reference keeps reading, enumerating and writing through
+typeof held; // "object" — it stays non-callable; read api.plugins again to call it
+```
+
+A Proxy's callability is fixed when it is created, so the namespace gets a new proxy on a function target, installed in its parent in place of the old one; the old proxy forwards every operation to the new one (the same forwarding `restart()` gives held references). A reference taken before the change therefore stays non-callable, while `api.<path>` is callable. A namespace no module ever makes callable keeps `typeof` "object".
+
+On `remove()`, the namespace's function is resolved again from the modules that remain, in the order they were added: the first one that supplies a function takes the slot, and a later one replaces it only if it was added under `merge-replace` or `replace` (a merge loser never does). So removing the module whose function won reverts to the function that was there before it — under `merge-replace`, the previous function — and removing a module whose function lost, or one that only contributed children, leaves the function as it is.
+
+```javascript
+// collision.api: "merge-replace"
+await api.slothlet.api.add("plugins", "./plugins-a", { moduleID: "a" }); // plain namespace
+await api.slothlet.api.add("plugins", "./plugins-b", { moduleID: "b" }); // supplies a function
+await api.slothlet.api.add("plugins", "./plugins-c", { moduleID: "c" }); // supplies another: c's wins
+await api.slothlet.api.remove("c"); // api.plugins() runs b's function again
+```
+
+The change to a callable proxy is one-way: when no function is left (`remove()` of the only module that supplied one, or a `reload()` after which no module exports one), the namespace's children revert as usual but it keeps the callable proxy — `typeof` stays "function" and a call throws `INVALID_CONFIG_NOT_A_FUNCTION`, exactly as for a namespace that was callable from the start.
+
 ---
 
 ## O10: Wrapper / Plain Fall-Through Winners
diff --git a/docs/RELOAD.md b/docs/RELOAD.md
index e73861905..031767c80 100644
--- a/docs/RELOAD.md
+++ b/docs/RELOAD.md
@@ -324,6 +324,8 @@ console.log(api.myProp); // undefined - runtime mutations cleared on reload
 
 Runtime mutations (`api.myProp = ...`) are intentionally cleared on full reload because the wrapper tree is rebuilt. Mutations to properties that belong to loaded modules (e.g. `api.math.add = customFn`) are also cleared - the reload replaces the impl inside those wrappers.
 
+One case changes the reference at a path: a plain namespace that an `add()`, `reload()` or `remove()` makes callable (a later module's default export flattens onto it). A proxy's callability is fixed when it is created, so `api.<path>` gets a new, callable proxy; a reference taken before keeps reading, writing and enumerating the same namespace but stays non-callable. Re-read `api.<path>` to call it. See [O09](API-RULES/API-COLLISION-CONDITIONS.md#o09-namespace-vs-callable--callable-wins).
+
 ---
 
 ## ESM / CJS Cache Busting
diff --git a/src/lib/handlers/api-manager.mjs b/src/lib/handlers/api-manager.mjs
index 67497977c..e4c202b23 100644
--- a/src/lib/handlers/api-manager.mjs
+++ b/src/lib/handlers/api-manager.mjs
@@ -814,6 +814,9 @@ export class ApiManager extends ComponentBase {
 			}
 		} else if (collisionMode === "merge") {
 			/* v8 ignore stop */
+			// A plain namespace takes the function the incoming module supplies (#533); one that already
+			// has a function keeps it.
+			existingWrapper.___adoptCallableImpl(nextWrapper.____slothletInternal.impl);
 			// Keep existing, only add new keys
 			// CRITICAL: Use hasOwnProperty instead of 'in' to avoid matching ComponentBase
 			// prototype getters (e.g., 'config', 'debug') which would prevent child adoption
@@ -906,6 +909,8 @@ export class ApiManager extends ComponentBase {
 			// above, and skip/warn/error never reach syncWrapper (mutateApiValue runs only for
 			// merge/merge-replace). nextChildKeys already excludes `_`/`__` keys (built above), so no
 			// per-key internal guard is needed. Add new keys and replace existing.
+			// The incoming module's function fills the namespace's function slot, replacing an existing one (#533).
+			existingWrapper.___adoptCallableImpl(nextWrapper.____slothletInternal.impl, true);
 			for (const key of nextChildKeys) {
 				const childValue = nextWrapper[key];
 				// Use hasOwnProperty to avoid matching ComponentBase prototype getters
@@ -2879,6 +2884,59 @@ export class ApiManager extends ComponentBase {
 		return contributions;
 	}
 
+	/**
+	 * Collect the live wrapper of every rolled-back path and snapshot the function of each that has one,
+	 * before a removal restores into them (#533).
+	 * @param {Array<{apiPath: string}>} rollbacks - The removal's rolled-back paths.
+	 * @returns {Array<[string, object]>} `[apiPath, live raw wrapper]` for each path still in the tree.
+	 * @private
+	 *
+	 * @description
+	 * A module that created a namespace records the namespace's own wrapper as its ownership value, so its
+	 * contribution reads through to the wrapper's current impl. The restore replaces that impl with the
+	 * current owner's contribution — for a namespace, often a plain object from a module merged in later —
+	 * so those entries are pinned to the function they hold now, for `#restoreNamespaceFunction` to read.
+	 */
+	#collectRolledBackNodes(rollbacks) {
+		const callable = [];
+		for (const { apiPath } of rollbacks) {
+			const live = resolveWrapper(this.getValueAtPath(this.slothlet.api, this.normalizeApiPath(apiPath).parts));
+			if (!live) continue;
+			const impl = live.____slothletInternal.impl;
+			if (UnifiedWrapper._isCallableImpl(impl)) this.slothlet.handlers.ownership.pinLiveEntries(apiPath, live, impl, resolveWrapper);
+			callable.push([apiPath, live]);
+		}
+		return callable;
+	}
+
+	/**
+	 * Give a namespace the function its remaining contributors resolve to, after a removal (#533).
+	 * @param {object} live - The live (raw) namespace wrapper.
+	 * @param {string} apiPath - Its api path.
+	 * @returns {void}
+	 * @private
+	 *
+	 * @description
+	 * The function is resolved the way the adds resolved it: in ownership order, the first contributor
+	 * that supplies a function takes the slot, and a later one replaces it only when it was placed under
+	 * `merge-replace` / `replace`; a merge loser never does. With no function left, the namespace keeps
+	 * the impl the restore gave it (a call then throws `INVALID_CONFIG_NOT_A_FUNCTION`).
+	 */
+	#restoreNamespaceFunction(live, apiPath) {
+		// Only a namespace: a rolled-back leaf already holds the value its current owner resolves to.
+		if (!Object.keys(live).some((key) => !key.startsWith("_"))) return;
+		const ownership = this.slothlet.handlers.ownership;
+		let fn = null;
+		for (const entry of ownership.getPathHistory(apiPath)) {
+			if (entry.isMergeLoss) continue;
+			const raw = resolveWrapper(entry.value);
+			const impl = raw ? raw.____slothletInternal.impl : entry.value;
+			if (!UnifiedWrapper._isCallableImpl(impl)) continue;
+			if (fn === null || ownership.getPlacementMode(entry.moduleID, apiPath) !== null) fn = impl;
+		}
+		if (fn !== null) live.___adoptCallableImpl(fn, true);
+	}
+
 	/**
 	 * Restore surviving contributions' content into a live wrapper, keeping the live wrapper itself (#531).
 	 * @param {object} live - The live (raw) wrapper at `apiPath`.
@@ -3382,6 +3440,9 @@ export class ApiManager extends ComponentBase {
 			// children there are dropped), so the deletions below leave it alone: deletePath prunes an emptied
 			// ancestor, which took the rolled-back namespace itself off the tree before it could be restored.
 			pathsToRollback.sort((a, b) => a.apiPath.split(".").length - b.apiPath.split(".").length);
+			// A callable namespace's function is resolved separately from its children (#533): pin it first,
+			// since the restores below replace the live impl with the current owner's contribution.
+			const rolledBackNodes = this.#collectRolledBackNodes(pathsToRollback);
 			const restoredWrappers = new Set();
 			const restoreContext = { restored: restoredWrappers, removedPaths: new Set(uniquePaths) };
 			const restoredRoots = [];
@@ -3501,6 +3562,8 @@ export class ApiManager extends ComponentBase {
 				this.state.replaceShadows.delete(moduleIDKey);
 			}
 
+			for (const [apiPath, live] of rolledBackNodes) this.#restoreNamespaceFunction(live, apiPath);
+
 			this.state.addHistory = this.state.addHistory.filter((entry) => String(entry.moduleID) !== moduleIDKey);
 
 			// Delete cache entry for this moduleID (complete module removal)
@@ -4121,8 +4184,8 @@ export class ApiManager extends ComponentBase {
 	 *   down, so the cycle's changes inside it apply and the other modules' children there stay;
 	 * - everything else is the cycle's own and is rebuilt by the replace.
 	 * The rebuilt children are attributed to `moduleID`, whichever module created the namespace.
-	 * A callable namespace keeps its function when that function is another module's: the one that
-	 * created the namespace (a later add merges its children in but never makes it callable).
+	 * A callable namespace keeps its function when that function is another module's — whichever module
+	 * supplied it, the one that created the namespace or a later add that merged it in (#533).
 	 * @param {object} wrapper - The raw namespace wrapper receiving the rebuilt contribution.
 	 * @param {string} apiPath - The namespace's api path.
 	 * @param {*} implForReload - The module's rebuilt contribution at this level.
diff --git a/src/lib/handlers/ownership.mjs b/src/lib/handlers/ownership.mjs
index 145a2c6e5..3efbccadd 100644
--- a/src/lib/handlers/ownership.mjs
+++ b/src/lib/handlers/ownership.mjs
@@ -466,6 +466,31 @@ export class OwnershipManager extends ComponentBase {
 		entry.memberExportPaths = origin.memberExportPaths ?? null;
 	}
 
+	/**
+	 * Pin the entries at `apiPath` that record a live wrapper by reference to a snapshot of its impl,
+	 * before the wrapper's impl is replaced in place (#533).
+	 *
+	 * @description
+	 * A module that created a namespace records the namespace's own wrapper as its value, so its
+	 * contribution reads through to whatever impl the wrapper holds now. When a later module's function
+	 * is merged into that namespace, the wrapper's impl becomes that function; without a snapshot, a
+	 * rollback to the creating module would re-apply the function it never supplied.
+	 * @param {string} apiPath - API path of the entries.
+	 * @param {object} wrapper - The raw wrapper whose impl is about to change.
+	 * @param {*} impl - The wrapper's impl before the change.
+	 * @param {Function} resolve - Maps a recorded value to its raw wrapper (or null).
+	 * @returns {void}
+	 * @public
+	 *
+	 * @example
+	 * ownership.pinLiveEntries("plugins", wrapper, previousImpl, resolveWrapper);
+	 */
+	pinLiveEntries(apiPath, wrapper, impl, resolve) {
+		for (const entry of this.pathToModule.get(apiPath) ?? []) {
+			if (resolve(entry.value) === wrapper) entry.value = impl;
+		}
+	}
+
 	/**
 	 * Record a module's mount endpoint (the apiPath it was loaded/added at).
 	 * This is the module's ownership root — the subtree it is allowed to write
diff --git a/src/lib/handlers/unified-wrapper.mjs b/src/lib/handlers/unified-wrapper.mjs
index 59c4245c3..afea4c4fc 100644
--- a/src/lib/handlers/unified-wrapper.mjs
+++ b/src/lib/handlers/unified-wrapper.mjs
@@ -1160,6 +1160,99 @@ function runtime_withRestartForwarding(handler, wrapper, propChain = []) {
 	return wrapped;
 }
 
+/**
+ * Re-point every trap of a proxy's (live, already-installed) handler at another node, so the proxy
+ * built on it forwards every operation there from now on (#533).
+ *
+ * @description
+ * The same forwarding restart() gives a held reference (#504), reused for a wrapper whose proxy is
+ * replaced in place: when a plain namespace becomes callable, its non-callable proxy is swapped for one
+ * on a function target, and the old proxy forwards to the new one. A Proxy looks its traps up on the
+ * handler object at each operation, so overwriting them here changes the old proxy's behaviour without
+ * adding anything to the traps the new proxy runs. The `RESTART_FORWARD_TRAPS` keep the old target's
+ * proxy invariants (a non-configurable property of the target, a non-extensible target). `apply` and
+ * `construct` are re-pointed too but never fire: a proxy built on a non-callable target has no
+ * [[Call]], so a held reference to it stays non-callable.
+ *
+ * @param {object} trapHandler - The handler object the old proxy was created with.
+ * @param {Function} resolveLive - Returns the node to forward to (re-read on every operation).
+ * @returns {void}
+ * @private
+ *
+ * @example
+ * runtime_forwardHandlerTo(internal.proxyTraps, () => internal.proxy);
+ */
+function runtime_forwardHandlerTo(trapHandler, resolveLive) {
+	for (const [trap, forward] of Object.entries(RESTART_FORWARD_TRAPS)) {
+		trapHandler[trap] = function slothlet_replacedProxyForwardingTrap(a, b, c, d) {
+			return forward(resolveLive(), a, b, c, d);
+		};
+	}
+}
+
+/**
+ * Give a wrapper's proxy target the custom `util.inspect` hook that shows the wrapper's children
+ * (or its impl), unless the target already has one.
+ *
+ * @description
+ * Array proxy targets are skipped: the array IS the user's data, so defining a symbol on it would
+ * mutate the live array — and throw on a frozen/sealed one. Arrays inspect natively, and the get
+ * trap's array delegation already yields faithful output, so no custom inspect is needed for them.
+ * (Non-array targets — the wrapper instance or a function — are always extensible, so no
+ * extensibility guard is needed.) Shared by createProxy() and the callable-proxy upgrade (#533).
+ *
+ * @param {UnifiedWrapper} wrapper - The wrapper the target belongs to.
+ * @param {object|Function|Array} target - The proxy target.
+ * @returns {void}
+ * @private
+ *
+ * @example
+ * runtime_defineProxyInspect(wrapper, createNamedProxyTarget(apiPath, "callableProxy"));
+ */
+function runtime_defineProxyInspect(wrapper, target) {
+	if (!Array.isArray(target) && !(util.inspect.custom in target)) {
+		Object.defineProperty(target, util.inspect.custom, {
+			value: function () {
+				// Show children from wrapper (filter internal properties)
+				const childKeys = Object.keys(wrapper).filter((k) => !k.startsWith("_") && !k.startsWith("__"));
+				if (childKeys.length > 0 && !wrapper.____slothletInternal.isCallable) {
+					const obj = {};
+					for (const key of childKeys) {
+						// Return the proxy if value is a wrapper
+						const child = wrapper[key];
+						// child.createProxy is never present on wrapper children; the true branch is unreachable.
+						/* v8 ignore next 2 */
+						if (child && typeof child.createProxy === "function") {
+							obj[key] = child.createProxy();
+						} else {
+							obj[key] = child;
+						}
+					}
+					return obj;
+				}
+				// For lazy unmaterialized wrappers with null _impl, return the proxy itself
+				// impl is always null (not undefined) at this point; the || undefined branch is never evaluated.
+				/* v8 ignore start */
+				if (
+					wrapper.____slothletInternal.mode === "lazy" &&
+					!wrapper.____slothletInternal.state.materialized &&
+					(wrapper.____slothletInternal.impl === null || wrapper.____slothletInternal.impl === undefined)
+				) {
+					/* v8 ignore stop */
+					// proxy is always set here; the || wrapper fallback is dead.
+					/* v8 ignore next */
+					return wrapper.____slothletInternal.proxy || wrapper;
+				}
+				// Otherwise return _impl (functions, primitives, etc)
+				return wrapper.____slothletInternal.impl;
+			},
+			writable: false,
+			enumerable: false,
+			configurable: true
+		});
+	}
+}
+
 /**
  * Unified wrapper class that handles all proxy concerns in one place:
  * - __impl pattern for reload support
@@ -1345,6 +1438,10 @@ export class UnifiedWrapper extends ComponentBase {
 		internal.waitingProxyCache = new Map(); // Cache waiting proxies for the no-context (external) reader bucket
 		internal.waitingProxyCacheByContext = new WeakMap(); // context object → inner Map of cache key → waiting proxy
 		internal.proxy = null;
+		// A non-callable proxy's handler and installed traps, for the callable upgrade (#533). Null once
+		// the proxy is callable (or before it exists).
+		internal.proxyHandler = null;
+		internal.proxyTraps = null;
 
 		// No clone WITHIN a wrap-on-set-grafted subtree (`deferChildAdopt`, #340): initialImpl
 		// becomes the wrapper's live impl reference verbatim, so a `self.X = obj` assignment (and
@@ -1687,6 +1784,13 @@ export class UnifiedWrapper extends ComponentBase {
 			this.____slothletInternal.isCallableLocked = true;
 		}
 
+		// A function arriving at a wrapper whose proxy was built non-callable (a plain namespace that a
+		// reload, a remove's revert or a lazy materialization now gives a function) needs a callable
+		// proxy: a Proxy's callability is fixed when it is created (#533).
+		if (this.____slothletInternal.proxyTraps !== null && UnifiedWrapper._isCallableImpl(newImpl)) {
+			this.___upgradeToCallableProxy();
+		}
+
 		// Update wrapper's filePath if not yet set.
 		// This handles lazy folder wrappers that import a file - the file path is
 		// stored on the impl by modes-processor and needs to be promoted to the wrapper.
@@ -1704,6 +1808,132 @@ export class UnifiedWrapper extends ComponentBase {
 		this.___adoptImplChildren(forceReuseChildren);
 	}
 
+	/**
+	 * Whether an impl makes its wrapper callable: a function, or an object with a default-exported
+	 * function.
+	 * @param {*} impl - The impl.
+	 * @returns {boolean} True for a callable impl.
+	 * @private
+	 *
+	 * @example
+	 * UnifiedWrapper._isCallableImpl({ default() {} }); // true
+	 */
+	static _isCallableImpl(impl) {
+		return typeof impl === "function" || (!!impl && typeof impl === "object" && typeof impl.default === "function");
+	}
+
+	/**
+	 * Give a namespace the function a later contribution supplies, keeping its children (#533).
+	 *
+	 * @description
+	 * A merge (`merge` / `merge-replace`) keeps the existing node and only adds the incoming children,
+	 * so the incoming module's own function was dropped and a namespace created by an earlier module
+	 * could never become callable. The function is resolved like any other merged member: a namespace
+	 * with no function yet always takes it; one that already has a function keeps it under `merge`
+	 * (first writer wins) and takes the incoming one under `merge-replace` (incoming wins). The children
+	 * are untouched: the incoming impl's own members were already adopted into child wrappers, which the
+	 * caller merges separately.
+	 *
+	 * @param {*} impl - The incoming contribution's impl at this node.
+	 * @param {boolean} [replaceExisting=false] - True under `merge-replace`: the incoming function
+	 *   replaces an existing one.
+	 * @returns {boolean} True when the namespace took the function.
+	 * @private
+	 *
+	 * @example
+	 * existingWrapper.___adoptCallableImpl(nextWrapper.____slothletInternal.impl, collisionMode === "merge-replace");
+	 */
+	___adoptCallableImpl(impl, replaceExisting = false) {
+		const internal = this.____slothletInternal;
+		if (!UnifiedWrapper._isCallableImpl(impl) || impl === internal.impl) return false;
+		if (!replaceExisting && UnifiedWrapper._isCallableImpl(internal.impl)) return false;
+		// The module(s) that built this namespace record the wrapper itself as their value; pin that to the
+		// impl they actually supplied (their function, or their plain namespace), so removing the incoming
+		// module reverts to it.
+		this.slothlet.handlers.ownership.pinLiveEntries(internal.apiPath, this, internal.impl, resolveWrapper);
+		internal.impl = impl;
+		internal.isCallable = true;
+		internal.isCallableLocked = true;
+		if (internal.proxyTraps !== null) this.___upgradeToCallableProxy();
+		return true;
+	}
+
+	/**
+	 * Replace this wrapper's non-callable proxy with a callable one (#533).
+	 *
+	 * @description
+	 * A Proxy's callability is fixed when it is created, and a namespace that started non-callable
+	 * uses the wrapper itself as its target (so `typeof` reads "object"). When a function arrives, a new
+	 * proxy is built from the same handler on a function target, registered for this wrapper, and
+	 * installed in the parent in place of the old one, so `api.<path>` is callable from then on. The
+	 * old proxy's traps are re-pointed at the new proxy (the same forwarding restart() gives a held
+	 * reference, #504), so a reference held from before keeps reading, enumerating and writing through
+	 * to the live namespace — but stays non-callable itself and keeps `typeof` "object".
+	 *
+	 * The upgrade is one-way: when the function later goes away (a remove or a reload), the callable
+	 * proxy stays and a call throws `INVALID_CONFIG_NOT_A_FUNCTION`, the same as for a namespace that
+	 * was callable from the start.
+	 *
+	 * @returns {void}
+	 * @private
+	 *
+	 * @example
+	 * if (internal.proxyTraps !== null) wrapper.___upgradeToCallableProxy();
+	 */
+	___upgradeToCallableProxy() {
+		const wrapper = this;
+		const internal = wrapper.____slothletInternal;
+		const oldProxy = internal.proxy;
+		const oldTraps = internal.proxyTraps;
+		internal.isCallable = true;
+		internal.isCallableLocked = true;
+
+		const target = createNamedProxyTarget(internal.apiPath, "callableProxy");
+		runtime_defineProxyInspect(wrapper, target);
+		const newProxy = new Proxy(target, runtime_withRestartForwarding(internal.proxyHandler, wrapper));
+		internal.proxy = newProxy;
+		internal.proxyHandler = null;
+		internal.proxyTraps = null;
+		_proxyRegistry.set(newProxy, wrapper);
+
+		// The old proxy stays registered for this wrapper (resolveWrapper keeps working on a held
+		// reference) and forwards everything to whichever proxy is current.
+		runtime_forwardHandlerTo(oldTraps, () => internal.proxy);
+		wrapper.___replaceInParent(oldProxy, newProxy);
+	}
+
+	/**
+	 * Swap the proxy the parent node holds for this wrapper at its apiPath (#533).
+	 *
+	 * @description
+	 * Walks the live api tree from the root along `apiPath` through raw wrappers' own properties (no
+	 * proxy traps, so nothing materializes) and replaces the child only where it is exactly `oldProxy`,
+	 * keeping its property descriptor (children are defined configurable). `boundApi`/`self` forward to
+	 * the same root, so one swap covers them. When the path no longer leads to `oldProxy` (the node was
+	 * detached or replaced), nothing changes; the old proxy forwards to the new one regardless.
+	 *
+	 * @param {object} oldProxy - The proxy being replaced.
+	 * @param {object} newProxy - Its replacement.
+	 * @returns {void}
+	 * @private
+	 *
+	 * @example
+	 * wrapper.___replaceInParent(oldProxy, newProxy);
+	 */
+	___replaceInParent(oldProxy, newProxy) {
+		const segments = String(this.____slothletInternal.apiPath).split(".");
+		const key = segments[segments.length - 1];
+		let holder = null;
+		let node = this.slothlet.api;
+		for (const segment of segments) {
+			// Raw wrappers hold their children as own data properties, so this read runs no trap.
+			holder = resolveWrapper(node) ?? node;
+			node = holder?.[segment];
+		}
+		if (node !== oldProxy) return;
+		Object.defineProperty(holder, key, { ...Reflect.getOwnPropertyDescriptor(holder, key), value: newProxy });
+	}
+
 	/**
 	 * Set new implementation and adopt children.
 	 * Delegates core impl work to _applyNewImpl, then emits lifecycle events
@@ -3821,52 +4051,7 @@ export class UnifiedWrapper extends ComponentBase {
 			proxyTarget = wrapper;
 		}
 
-		// Add custom inspect to wrapper if not already present. Skip array proxy targets: the array
-		// IS the user's data, so defining a symbol on it would mutate the live array — and throw on a
-		// frozen/sealed one. Arrays inspect natively, and the get trap's array delegation already
-		// yields faithful output, so no custom inspect is needed for them. (Non-array targets — the
-		// wrapper instance or a function — are always extensible, so no extensibility guard is needed.)
-		if (!Array.isArray(proxyTarget) && !(util.inspect.custom in proxyTarget)) {
-			Object.defineProperty(proxyTarget, util.inspect.custom, {
-				value: function () {
-					// Show children from wrapper (filter internal properties)
-					const childKeys = Object.keys(wrapper).filter((k) => !k.startsWith("_") && !k.startsWith("__"));
-					if (childKeys.length > 0 && !wrapper.____slothletInternal.isCallable) {
-						const obj = {};
-						for (const key of childKeys) {
-							// Return the proxy if value is a wrapper
-							const child = wrapper[key];
-							// child.createProxy is never present on wrapper children; the true branch is unreachable.
-							/* v8 ignore next 2 */
-							if (child && typeof child.createProxy === "function") {
-								obj[key] = child.createProxy();
-							} else {
-								obj[key] = child;
-							}
-						}
-						return obj;
-					}
-					// For lazy unmaterialized wrappers with null _impl, return the proxy itself
-					// impl is always null (not undefined) at this point; the || undefined branch is never evaluated.
-					/* v8 ignore start */
-					if (
-						wrapper.____slothletInternal.mode === "lazy" &&
-						!wrapper.____slothletInternal.state.materialized &&
-						(wrapper.____slothletInternal.impl === null || wrapper.____slothletInternal.impl === undefined)
-					) {
-						/* v8 ignore stop */
-						// proxy is always set here; the || wrapper fallback is dead.
-						/* v8 ignore next */
-						return wrapper.____slothletInternal.proxy || wrapper;
-					}
-					// Otherwise return _impl (functions, primitives, etc)
-					return wrapper.____slothletInternal.impl;
-				},
-				writable: false,
-				enumerable: false,
-				configurable: true
-			});
-		}
+		runtime_defineProxyInspect(wrapper, proxyTarget);
 
 		/**
 		 * @private
@@ -5622,7 +5807,14 @@ export class UnifiedWrapper extends ComponentBase {
 			}
 		};
 		// Once a restart() replaces this wrapper's tree, every trap forwards to the live tree (#504).
-		wrapper.____slothletInternal.proxy = new Proxy(proxyTarget, runtime_withRestartForwarding(proxyHandler, wrapper));
+		const proxyTraps = runtime_withRestartForwarding(proxyHandler, wrapper);
+		wrapper.____slothletInternal.proxy = new Proxy(proxyTarget, proxyTraps);
+		// Kept only for a proxy that is not callable yet: ___upgradeToCallableProxy() builds the callable
+		// replacement from the same handler and re-points these traps at it (#533).
+		if (typeof proxyTarget !== "function") {
+			wrapper.____slothletInternal.proxyHandler = proxyHandler;
+			wrapper.____slothletInternal.proxyTraps = proxyTraps;
+		}
 
 		_proxyRegistry.set(wrapper.____slothletInternal.proxy, wrapper);
 		// Register this wrapper instance as genuine so permission enforcement can distinguish a real
diff --git a/tests/vitests/suites/addapi/addapi-namespace-becomes-callable.test.vitest.mjs b/tests/vitests/suites/addapi/addapi-namespace-becomes-callable.test.vitest.mjs
new file mode 100644
index 000000000..8ff1b891a
--- /dev/null
+++ b/tests/vitests/suites/addapi/addapi-namespace-becomes-callable.test.vitest.mjs
@@ -0,0 +1,459 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/addapi/addapi-namespace-becomes-callable.test.vitest.mjs
+ *	@Date: 2026-10-02 00:00:00 -07:00 (1790924400)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 00:00:00 -07:00 (1790924400)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview A plain namespace becomes callable when a later module supplies its function (#533).
+ *
+ * @description
+ * Module `other` mounts a plain namespace at `plugins`; module `callable` then adds a folder whose single
+ * file default-exports a function, which flattens onto the same mount. The namespace must become callable
+ * (`typeof api.plugins === "function"`, `api.plugins()` runs the function) while every child `other`
+ * contributed stays reachable. A reference to `api.plugins` held from before the change keeps reading,
+ * enumerating and writing through to the live namespace; it stays non-callable itself, because a Proxy's
+ * callability is fixed when it is created.
+ *
+ * Under each instance collision mode, two modules can supply the namespace's function: `merge` keeps the
+ * first one (first writer wins), `merge-replace` takes the incoming one, in every add order, and removing
+ * either module resolves the function again from the modules that remain.
+ *
+ * Also covered: both add orders, the per-call `merge-replace` and `replace` collision modes, a reload that gives
+ * the namespace its function, a reload of either module, removing the module that supplied the
+ * function (its children go, the namespace keeps the callable shape and throws a clean "not a function"),
+ * re-adding it, and a namespace no module ever makes callable staying `typeof` "object".
+ *
+ * Runs across the full matrix (eager/lazy × async/live × hooks on/off).
+ *
+ * @module tests/vitests/suites/addapi/addapi-namespace-becomes-callable
+ */
+
+process.env.SLOTHLET_INTERNAL_TEST_MODE = "true";
+
+import { describe, it, expect, afterEach, vi } from "vitest";
+import { cpSync, rmSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import slothlet from "@cldmv/slothlet";
+import { resolveWrapper } from "#handlers/unified-wrapper";
+import { getMatrixConfigs, TEST_DIRS } from "../../setup/vitest-helper.mjs";
+
+// Instance creation plus several adds can exceed the default hook/test timeout on a loaded machine.
+vi.setConfig({ hookTimeout: 60000, testTimeout: 60000 });
+
+const API_TESTS_ROOT = path.dirname(TEST_DIRS.API_TEST);
+const OTHER_DIR = path.join(API_TESTS_ROOT, "api_test_reload_comount_other");
+const EXT_DIR = path.join(API_TESTS_ROOT, "api_test_reload_comount_ext");
+const CALLABLE_DIR = path.join(API_TESTS_ROOT, "api_test_reload_comount_callable");
+const SECOND_DIR = path.join(API_TESTS_ROOT, "api_test_namespace_callable_second");
+
+/** Folder per moduleID, for the add-order permutations. */
+const DIRS = { other: OTHER_DIR, callable: CALLABLE_DIR, second: SECOND_DIR };
+/** What each function-supplying module's namespace function returns. */
+const MAIN = { callable: "callable:main", second: "second:main" };
+
+/** Leaves `other` contributes under `api.plugins`, with the value each returns. */
+const OTHER_LEAVES = {
+	gamma: "other:gamma",
+	delta: "other:delta",
+	"gear.cog": "other:cog",
+	"tools.wrench": "other:wrench",
+	"tools.kit.box.nail": "other:nail"
+};
+
+/**
+ * Resolve a dotted path below a node.
+ * @param {*} node - Starting node.
+ * @param {string} dotted - Dotted path relative to `node`.
+ * @returns {*} The value at that path, or undefined.
+ */
+function at(node, dotted) {
+	let cur = node;
+	for (const part of dotted.split(".")) {
+		if (cur === undefined || cur === null) return undefined;
+		cur = cur[part];
+	}
+	return cur;
+}
+
+/**
+ * Assert every listed leaf below `node` is callable and returns its expected value.
+ * @param {*} node - Namespace to read from.
+ * @param {Record<string, string>} leaves - Map of dotted path → expected return value.
+ * @returns {Promise<void>}
+ */
+async function expectLeaves(node, leaves) {
+	for (const [dotted, expected] of Object.entries(leaves)) {
+		const fn = at(node, dotted);
+		expect(typeof fn, dotted).toBe("function");
+		expect(await fn(), `${dotted}()`).toBe(expected);
+	}
+}
+
+/**
+ * Create an instance with add/remove/reload enabled.
+ * @param {object} config - Matrix config.
+ * @param {string} [collisionApi] - `api.collision.api` to use; the matrix config's when omitted.
+ * @returns {Promise<object>} Slothlet API proxy.
+ */
+function createInstance(config, collisionApi) {
+	const apiConfig = { ...config.api, mutations: { add: true, remove: true, reload: true, allowCollisionOverride: true } };
+	if (collisionApi) apiConfig.collision = { ...(config.api?.collision ?? {}), api: collisionApi };
+	// allowCollisionOverride lets a per-call `collisionMode` take effect.
+	return slothlet({ ...config, base: TEST_DIRS.API_TEST, silent: true, api: apiConfig });
+}
+
+/**
+ * Run a call that may throw synchronously or reject, as a promise either way.
+ * @param {Function} fn - The call.
+ * @returns {Promise<unknown>} Its settled result.
+ */
+function settle(fn) {
+	return Promise.resolve().then(fn);
+}
+
+for (const { config, name } of getMatrixConfigs()) {
+	describe(`A namespace becomes callable when a later module adds its function (#533) > ${name}`, () => {
+		let api;
+		let scratchDir;
+
+		afterEach(async () => {
+			if (api?.shutdown) await api.shutdown();
+			api = null;
+			if (scratchDir) rmSync(scratchDir, { recursive: true, force: true });
+			scratchDir = null;
+		});
+
+		/**
+		 * Mount `other` (plain namespace) at `plugins`, read it once, then add `callable` there.
+		 * @returns {Promise<object>} The reference to `api.plugins` held from before the callable add.
+		 */
+		async function namespaceThenCallable() {
+			api = await createInstance(config);
+			await api.slothlet.api.add("plugins", OTHER_DIR, { moduleID: "other" });
+			const held = api.plugins;
+			expect(typeof held).toBe("object");
+			await expectLeaves(held, OTHER_LEAVES);
+			await api.slothlet.api.add("plugins", CALLABLE_DIR, { moduleID: "callable" });
+			return held;
+		}
+
+		it("makes api.plugins callable and keeps the existing namespace's children", async () => {
+			await namespaceThenCallable();
+
+			expect(typeof api.plugins).toBe("function");
+			expect(await api.plugins()).toBe("callable:main");
+			await expectLeaves(api.plugins, { extra: "callable:extra", ...OTHER_LEAVES });
+			expect(Object.keys(api.plugins)).toEqual(expect.arrayContaining(["gamma", "delta", "gear", "tools", "extra"]));
+		});
+
+		it("a reference held from before keeps reading, enumerating and writing through to the namespace", async () => {
+			const held = await namespaceThenCallable();
+
+			await expectLeaves(held, { extra: "callable:extra", ...OTHER_LEAVES });
+			expect(held.gamma).toBe(api.plugins.gamma);
+			expect(Object.keys(held).sort()).toEqual(Object.keys(api.plugins).sort());
+			expect("extra" in held).toBe(true);
+
+			held.note = "from-held";
+			expect(api.plugins.note).toBe("from-held");
+			api.plugins.note2 = "from-live";
+			expect(held.note2).toBe("from-live");
+
+			// A held reference stays non-callable: a Proxy's callability is fixed at creation.
+			expect(typeof held).toBe("object");
+			expect(() => held()).toThrow(TypeError);
+		});
+
+		it.each([
+			["merge-replace", { extra: "callable:extra", ...OTHER_LEAVES }],
+			["replace", { extra: "callable:extra" }]
+		])("becomes callable when the function arrives under collisionMode %s", async (collisionMode, leaves) => {
+			api = await createInstance(config);
+			await api.slothlet.api.add("plugins", OTHER_DIR, { moduleID: "other" });
+			const held = api.plugins;
+			expect(typeof held).toBe("object");
+			await api.slothlet.api.add("plugins", CALLABLE_DIR, { moduleID: "callable", collisionMode });
+
+			expect(typeof api.plugins).toBe("function");
+			expect(await api.plugins()).toBe("callable:main");
+			await expectLeaves(api.plugins, leaves);
+			await expectLeaves(held, leaves);
+			expect(typeof held).toBe("object");
+		});
+
+		it("becomes callable when a reload gives the namespace its function", async () => {
+			scratchDir = path.join(process.cwd(), "tmp", `namespace-callable-533-${name.replace(/[^a-z0-9]+/gi, "-")}`);
+			rmSync(scratchDir, { recursive: true, force: true });
+			cpSync(CALLABLE_DIR, scratchDir, { recursive: true });
+			const mainFile = path.join(scratchDir, "main.mjs");
+			writeFileSync(mainFile, `export function extra() {\n\treturn "callable:extra";\n}\n`);
+
+			api = await createInstance(config);
+			await api.slothlet.api.add("plugins", OTHER_DIR, { moduleID: "other" });
+			await api.slothlet.api.add("plugins", scratchDir, { moduleID: "callable" });
+			const held = api.plugins;
+			expect(typeof held).toBe("object");
+			// Without a default export the file does not flatten onto the mount.
+			await expectLeaves(held, { "main.extra": "callable:extra", ...OTHER_LEAVES });
+
+			writeFileSync(
+				mainFile,
+				`export default function main() {\n\treturn "callable:main:v2";\n}\nexport function extra() {\n\treturn "callable:extra";\n}\n`
+			);
+			await api.slothlet.api.reload("callable");
+
+			expect(typeof api.plugins).toBe("function");
+			expect(await api.plugins()).toBe("callable:main:v2");
+			await expectLeaves(api.plugins, { extra: "callable:extra", ...OTHER_LEAVES });
+			await expectLeaves(held, OTHER_LEAVES);
+		});
+
+		it("is callable whichever module is added first", async () => {
+			api = await createInstance(config);
+			await api.slothlet.api.add("plugins", CALLABLE_DIR, { moduleID: "callable" });
+			await api.slothlet.api.add("plugins", OTHER_DIR, { moduleID: "other" });
+
+			expect(typeof api.plugins).toBe("function");
+			expect(await api.plugins()).toBe("callable:main");
+			await expectLeaves(api.plugins, { extra: "callable:extra", ...OTHER_LEAVES });
+		});
+
+		it("stays callable when a third, plain module is added afterwards", async () => {
+			await namespaceThenCallable();
+			await api.slothlet.api.add("plugins", EXT_DIR, { moduleID: "ext" });
+
+			expect(typeof api.plugins).toBe("function");
+			expect(await api.plugins()).toBe("callable:main");
+			await expectLeaves(api.plugins, { extra: "callable:extra", alpha: "ext:alpha", ...OTHER_LEAVES });
+		});
+
+		it.each(["other", "callable"])("stays callable with every child after reload('%s')", async (target) => {
+			const held = await namespaceThenCallable();
+
+			await api.slothlet.api.reload(target);
+
+			expect(typeof api.plugins).toBe("function");
+			expect(await api.plugins()).toBe("callable:main");
+			await expectLeaves(api.plugins, { extra: "callable:extra", ...OTHER_LEAVES });
+			await expectLeaves(held, OTHER_LEAVES);
+		});
+
+		it("removing the module that supplied the function reverts the namespace's children", async () => {
+			const held = await namespaceThenCallable();
+
+			await api.slothlet.api.remove("callable");
+
+			expect(api.plugins.extra).toBeUndefined();
+			await expectLeaves(api.plugins, OTHER_LEAVES);
+			await expectLeaves(held, OTHER_LEAVES);
+			// The callable proxy is kept; with no function behind it, a call fails cleanly.
+			expect(typeof api.plugins).toBe("function");
+			await expect(settle(() => api.plugins())).rejects.toThrow(/not a function/);
+		});
+
+		it("becomes callable again when the removed module is added back", async () => {
+			await namespaceThenCallable();
+			await api.slothlet.api.remove("callable");
+			await api.slothlet.api.add("plugins", CALLABLE_DIR, { moduleID: "callable" });
+
+			expect(typeof api.plugins).toBe("function");
+			expect(await api.plugins()).toBe("callable:main");
+			await expectLeaves(api.plugins, { extra: "callable:extra", ...OTHER_LEAVES });
+		});
+
+		it("swapping the proxy in the parent leaves a node the path no longer leads to alone", async () => {
+			api = await createInstance(config);
+			await api.slothlet.api.add("plugins", OTHER_DIR, { moduleID: "other" });
+			const gear = api.plugins.gear;
+			const gearWrapper = resolveWrapper(gear);
+			const stranger = {};
+
+			// Still attached, but the parent holds a different proxy than the one named: no change.
+			gearWrapper.___replaceInParent(stranger, {});
+			expect(api.plugins.gear).toBe(gear);
+
+			// Detached: the walk runs off the end of the tree and changes nothing.
+			await api.slothlet.api.remove("other");
+			expect(api.plugins).toBeUndefined();
+			expect(() => gearWrapper.___replaceInParent(gear, stranger)).not.toThrow();
+			expect(api.plugins).toBeUndefined();
+		});
+
+		it("a namespace no module makes callable stays typeof object", async () => {
+			api = await createInstance(config);
+			await api.slothlet.api.add("plugins", OTHER_DIR, { moduleID: "other" });
+			const held = api.plugins;
+			await api.slothlet.api.add("plugins", EXT_DIR, { moduleID: "ext" });
+
+			expect(typeof api.plugins).toBe("object");
+			expect(api.plugins).toBe(held);
+			await expectLeaves(api.plugins, { alpha: "ext:alpha", ...OTHER_LEAVES });
+
+			await api.slothlet.api.reload("ext");
+			expect(typeof api.plugins).toBe("object");
+			expect(api.plugins).toBe(held);
+		});
+	});
+}
+
+for (const { config, name } of getMatrixConfigs()) {
+	for (const collisionApi of ["merge", "merge-replace"]) {
+		describe(`A namespace's function under collision mode ${collisionApi} (#533) > ${name}`, () => {
+			let api;
+
+			afterEach(async () => {
+				if (api?.shutdown) await api.shutdown();
+				api = null;
+			});
+
+			// Children are checked after a removal only when the removed module did not create the namespace:
+			// removing the creating module also invalidates the children other modules merged into it, which is
+			// a separate, pre-existing removal issue independent of the namespace's function.
+
+			/**
+			 * Add each module at `plugins` in order.
+			 * @param {string[]} order - moduleIDs, in add order.
+			 * @returns {Promise<void>}
+			 */
+			async function addInOrder(order) {
+				api = await createInstance(config, collisionApi);
+				for (const moduleID of order) await api.slothlet.api.add("plugins", DIRS[moduleID], { moduleID });
+			}
+
+			it.each([[["other", "callable"]], [["callable", "other"]]])("a namespace and a function: %j", async (order) => {
+				await addInOrder(order);
+
+				expect(typeof api.plugins).toBe("function");
+				expect(await api.plugins()).toBe("callable:main");
+				await expectLeaves(api.plugins, { extra: "callable:extra", ...OTHER_LEAVES });
+			});
+
+			it.each([[["other", "callable", "second"]], [["callable", "second", "other"]], [["second", "other", "callable"]]])(
+				"two functions, added %j, resolve by the mode and again on removal",
+				async (order) => {
+					const suppliers = order.filter((moduleID) => moduleID !== "other");
+					const winner = collisionApi === "merge" ? suppliers[0] : suppliers[1];
+					const loser = suppliers.find((moduleID) => moduleID !== winner);
+					await addInOrder(order);
+
+					expect(typeof api.plugins).toBe("function");
+					expect(await api.plugins()).toBe(MAIN[winner]);
+					await expectLeaves(api.plugins, { extra: "callable:extra", more: "second:more", ...OTHER_LEAVES });
+
+					// Removing the module whose function lost keeps the winner's.
+					await api.slothlet.api.remove(loser);
+					expect(await api.plugins()).toBe(MAIN[winner]);
+					if (loser !== order[0]) await expectLeaves(api.plugins, OTHER_LEAVES);
+				}
+			);
+
+			it.each([[["other", "callable", "second"]], [["callable", "second", "other"]], [["second", "other", "callable"]]])(
+				"two functions, added %j: removing the winning module reverts to the other function",
+				async (order) => {
+					const suppliers = order.filter((moduleID) => moduleID !== "other");
+					const winner = collisionApi === "merge" ? suppliers[0] : suppliers[1];
+					const remaining = suppliers.find((moduleID) => moduleID !== winner);
+					await addInOrder(order);
+					expect(await api.plugins()).toBe(MAIN[winner]);
+
+					await api.slothlet.api.remove(winner);
+
+					expect(typeof api.plugins).toBe("function");
+					expect(await api.plugins()).toBe(MAIN[remaining]);
+					if (winner !== order[0]) await expectLeaves(api.plugins, OTHER_LEAVES);
+				}
+			);
+
+			it("two functions and a namespace: removing the namespace's module keeps the winning function", async () => {
+				const winner = collisionApi === "merge" ? "callable" : "second";
+				await addInOrder(["callable", "second", "other"]);
+				expect(await api.plugins()).toBe(MAIN[winner]);
+
+				await api.slothlet.api.remove("other");
+
+				expect(await api.plugins()).toBe(MAIN[winner]);
+				expect(api.plugins.gamma).toBeUndefined();
+				await expectLeaves(api.plugins, { extra: "callable:extra", more: "second:more" });
+			});
+		});
+	}
+}
+
+describe("UnifiedWrapper callable-impl helpers (#533)", () => {
+	let api;
+
+	afterEach(async () => {
+		if (api?.shutdown) await api.shutdown();
+		api = null;
+	});
+
+	it("_isCallableImpl recognizes a function and a default-exported function, and nothing else", async () => {
+		api = await createInstance(getMatrixConfigs()[0].config);
+		await api.slothlet.api.add("plugins", OTHER_DIR, { moduleID: "other" });
+		const UnifiedWrapper = resolveWrapper(api.plugins).constructor;
+
+		expect(UnifiedWrapper._isCallableImpl(() => {})).toBe(true);
+		expect(UnifiedWrapper._isCallableImpl({ default() {} })).toBe(true);
+		expect(UnifiedWrapper._isCallableImpl({ default: "x" })).toBe(false);
+		expect(UnifiedWrapper._isCallableImpl({})).toBe(false);
+		expect(UnifiedWrapper._isCallableImpl(null)).toBe(false);
+		expect(UnifiedWrapper._isCallableImpl(undefined)).toBe(false);
+	});
+
+	it("a namespace adopts a default-exported function impl and calls it", async () => {
+		api = await createInstance(getMatrixConfigs()[0].config);
+		await api.slothlet.api.add("plugins", OTHER_DIR, { moduleID: "other" });
+		const wrapper = resolveWrapper(api.plugins);
+
+		expect(wrapper.___adoptCallableImpl({ default: () => "from-default" })).toBe(true);
+		expect(typeof api.plugins).toBe("function");
+		expect(await api.plugins()).toBe("from-default");
+		// A non-callable impl, or the impl the namespace already has, changes nothing.
+		expect(wrapper.___adoptCallableImpl({ gamma: 1 }, true)).toBe(false);
+		expect(wrapper.___adoptCallableImpl(wrapper.____slothletInternal.impl, true)).toBe(false);
+		// Under merge semantics an existing function is kept.
+		expect(wrapper.___adoptCallableImpl(() => "later")).toBe(false);
+		expect(await api.plugins()).toBe("from-default");
+		await expectLeaves(api.plugins, OTHER_LEAVES);
+	});
+
+	it("a merge loser's function is never restored as the namespace's function", async () => {
+		api = await createInstance(getMatrixConfigs()[0].config, "merge");
+		await api.slothlet.api.add("plugins", OTHER_DIR, { moduleID: "other" });
+		await api.slothlet.api.add("plugins", EXT_DIR, { moduleID: "ext" });
+		// Two functions recorded at the namespace under merge: the first owns it, the second loses (O08).
+		const ownership = resolveWrapper(api.plugins).slothlet.handlers.ownership;
+		const register = (moduleID, value) =>
+			ownership.register({ moduleID, apiPath: "plugins", value, source: "core", collisionMode: "merge" });
+		expect(register("winner", () => "winner").isMergeLoss).toBe(false);
+		expect(register("loser", () => "loser").isMergeLoss).toBe(true);
+
+		// Removing ext rolls the namespace back; its function is resolved from the remaining entries.
+		await api.slothlet.api.remove("ext");
+
+		expect(typeof api.plugins).toBe("function");
+		expect(await api.plugins()).toBe("winner");
+		await expectLeaves(api.plugins, OTHER_LEAVES);
+	});
+
+	it("pinLiveEntries leaves a path with no ownership stack, and entries for other wrappers, alone", async () => {
+		api = await createInstance(getMatrixConfigs()[0].config);
+		await api.slothlet.api.add("plugins", OTHER_DIR, { moduleID: "other" });
+		const wrapper = resolveWrapper(api.plugins);
+		const ownership = wrapper.slothlet.handlers.ownership;
+		const before = ownership.getPathHistory("plugins").map((entry) => entry.value);
+
+		expect(() => ownership.pinLiveEntries("no.such.path", wrapper, {}, resolveWrapper)).not.toThrow();
+		ownership.pinLiveEntries("plugins", resolveWrapper(api.plugins.gear), {}, resolveWrapper);
+
+		expect(ownership.getPathHistory("plugins").map((entry) => entry.value)).toEqual(before);
+	});
+});
diff --git a/types/src/lib/handlers/api-manager.d.mts b/types/src/lib/handlers/api-manager.d.mts
index f64d2aaae..7895b81dd 100644
--- a/types/src/lib/handlers/api-manager.d.mts
+++ b/types/src/lib/handlers/api-manager.d.mts
@@ -547,8 +547,8 @@ export class ApiManager extends ComponentBase {
      *   down, so the cycle's changes inside it apply and the other modules' children there stay;
      * - everything else is the cycle's own and is rebuilt by the replace.
      * The rebuilt children are attributed to `moduleID`, whichever module created the namespace.
-     * A callable namespace keeps its function when that function is another module's: the one that
-     * created the namespace (a later add merges its children in but never makes it callable).
+     * A callable namespace keeps its function when that function is another module's — whichever module
+     * supplied it, the one that created the namespace or a later add that merged it in (#533).
      * @param {object} wrapper - The raw namespace wrapper receiving the rebuilt contribution.
      * @param {string} apiPath - The namespace's api path.
      * @param {*} implForReload - The module's rebuilt contribution at this level.
diff --git a/types/src/lib/handlers/api-manager.d.mts.map b/types/src/lib/handlers/api-manager.d.mts.map
index 294821e3f..6de403451 100644
--- a/types/src/lib/handlers/api-manager.d.mts.map
+++ b/types/src/lib/handlers/api-manager.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"api-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/api-manager.mjs"],"names":[],"mappings":"AAgFA;;;;;;;;;;;;;;GAcG;AACH;IACC,gCAAuC;IAEvC;;;;;;;;;;;OAWG;IACH,sBAVW,MAAM,EAuBhB;IAXA,sIAAsI;IACtI,OADW;QAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,MAAM,GAAC,IAAI,CAAC;QAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;KAAE,CAUjI;IAGF;;;;;;;;;;;;;;;;;;OAkBG;IACH,yBA+GC;IAED;;;;;;;;;;;;;;OAcG;IACH,oBA4CC;IAED;;;;;;;;;;;;;;OAcG;IACH,0BA4BC;IAED;;;;;;;;;;;;OAYG;IACH,6BAIC;IAED;;;;;;;;;;;;OAYG;IACH,uBASC;IAED;;;;;;;;;;;;;OAaG;IACH,yBAkCC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,iCAbW,MAAM,SACN,OAAO,iBACP,MAAM,GAAC,IAAI,GACT,IAAI,CAqHhB;IAED;;;;;;;;;;;;;OAaG;IACH,uBAEC;IAED;;;;;;;;;;;;;;OAcG;IACH,oBAkWC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,8BAiCC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,sCAmBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,uBAyGC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,uBA6MC;IAED;;;;;;;;;;;;OAYG;IACH,mBAwHC;IACD;;;;;;;;;;;;OAYG;IACH,uBAsEC;IA6CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkDG;IACH,wBAhDG;QAAuB,OAAO,EAAtB,MAAM;QACmD,UAAU,EAAnE,MAAM,GAAC,MAAM,EAAE,cAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;QACf,OAAO;KAChD,GAAU,OAAO,CAAC,MAAM,GAAC,MAAM,EAAE,CAAC,CAs/BpC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,yEATG;QAAqB,QAAQ,EAArB,MAAM;QACO,aAAa,EAA1B,MAAM;QACO,cAAc,EAA3B,MAAM;KACd,GAAU,OAAO,CAAC,IAAI,CAAC,CAgDzB;IA8BD;;;;;;;;;;;OAWG;IACH,mCAeC;IAoHD;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,mCA1BW,MAAM,YAEd;QAAyB,aAAa;QAGZ,aAAa;KACvC,GAAU,OAAO,CAAC,OAAO,CAAC,CA0pB5B;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,2BAdG;QAAwB,OAAO,EAAtB,MAAM,OAAA;QACS,QAAQ,EAAvB,MAAM,OAAA;KACf,GAAU,OAAO,CAAC,IAAI,CAAC,CAuCzB;IAED;;;;;;;;;;;;;OAaG;IACH,0BAkGC;IAED;;;;;;;;;;;;;;OAcG;IACH,yBAuFC;IAED;;;;;;;;;;;;;OAaG;IACH,4BA0FC;IAED;;;;;;;;OAQG;IACH,iCAyDC;IAED;;;;;OAKG;IACH,iCAeC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,yBAwEC;IAED;;;;;;;OAOG;IACH,yBAWC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,0BAyBC;IAED;;;;;;;;;OASG;IACH,+BAiCC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,oCAiDC;IAED;;;;;;;;OAQG;IACH,0BASC;IAED;;;;;;;;;OASG;IACH,kCAoBC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,wBA+TC;;CACD;8BA3oJ6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"api-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/api-manager.mjs"],"names":[],"mappings":"AAgFA;;;;;;;;;;;;;;GAcG;AACH;IACC,gCAAuC;IAEvC;;;;;;;;;;;OAWG;IACH,sBAVW,MAAM,EAuBhB;IAXA,sIAAsI;IACtI,OADW;QAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,MAAM,GAAC,IAAI,CAAC;QAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;KAAE,CAUjI;IAGF;;;;;;;;;;;;;;;;;;OAkBG;IACH,yBA+GC;IAED;;;;;;;;;;;;;;OAcG;IACH,oBA4CC;IAED;;;;;;;;;;;;;;OAcG;IACH,0BA4BC;IAED;;;;;;;;;;;;OAYG;IACH,6BAIC;IAED;;;;;;;;;;;;OAYG;IACH,uBASC;IAED;;;;;;;;;;;;;OAaG;IACH,yBAkCC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,iCAbW,MAAM,SACN,OAAO,iBACP,MAAM,GAAC,IAAI,GACT,IAAI,CAqHhB;IAED;;;;;;;;;;;;;OAaG;IACH,uBAEC;IAED;;;;;;;;;;;;;;OAcG;IACH,oBAuWC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,8BAiCC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,sCAmBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,uBAyGC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,uBA6MC;IAED;;;;;;;;;;;;OAYG;IACH,mBAwHC;IACD;;;;;;;;;;;;OAYG;IACH,uBAsEC;IA6CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkDG;IACH,wBAhDG;QAAuB,OAAO,EAAtB,MAAM;QACmD,UAAU,EAAnE,MAAM,GAAC,MAAM,EAAE,cAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;QACf,OAAO;KAChD,GAAU,OAAO,CAAC,MAAM,GAAC,MAAM,EAAE,CAAC,CAs/BpC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,yEATG;QAAqB,QAAQ,EAArB,MAAM;QACO,aAAa,EAA1B,MAAM;QACO,cAAc,EAA3B,MAAM;KACd,GAAU,OAAO,CAAC,IAAI,CAAC,CAgDzB;IA8BD;;;;;;;;;;;OAWG;IACH,mCAeC;IAyKD;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,mCA1BW,MAAM,YAEd;QAAyB,aAAa;QAGZ,aAAa;KACvC,GAAU,OAAO,CAAC,OAAO,CAAC,CA+pB5B;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,2BAdG;QAAwB,OAAO,EAAtB,MAAM,OAAA;QACS,QAAQ,EAAvB,MAAM,OAAA;KACf,GAAU,OAAO,CAAC,IAAI,CAAC,CAuCzB;IAED;;;;;;;;;;;;;OAaG;IACH,0BAkGC;IAED;;;;;;;;;;;;;;OAcG;IACH,yBAuFC;IAED;;;;;;;;;;;;;OAaG;IACH,4BA0FC;IAED;;;;;;;;OAQG;IACH,iCAyDC;IAED;;;;;OAKG;IACH,iCAeC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,yBAwEC;IAED;;;;;;;OAOG;IACH,yBAWC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,0BAyBC;IAED;;;;;;;;;OASG;IACH,+BAiCC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,oCAiDC;IAED;;;;;;;;OAQG;IACH,0BASC;IAED;;;;;;;;;OASG;IACH,kCAoBC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,wBA+TC;;CACD;8BA1sJ6B,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/lib/handlers/ownership.d.mts b/types/src/lib/handlers/ownership.d.mts
index e2241286f..5d24e510b 100644
--- a/types/src/lib/handlers/ownership.d.mts
+++ b/types/src/lib/handlers/ownership.d.mts
@@ -170,6 +170,26 @@ export class OwnershipManager extends ComponentBase {
         exportPath?: (string[] | null);
         memberExportPaths?: (Object | null);
     }): void;
+    /**
+     * Pin the entries at `apiPath` that record a live wrapper by reference to a snapshot of its impl,
+     * before the wrapper's impl is replaced in place (#533).
+     *
+     * @description
+     * A module that created a namespace records the namespace's own wrapper as its value, so its
+     * contribution reads through to whatever impl the wrapper holds now. When a later module's function
+     * is merged into that namespace, the wrapper's impl becomes that function; without a snapshot, a
+     * rollback to the creating module would re-apply the function it never supplied.
+     * @param {string} apiPath - API path of the entries.
+     * @param {object} wrapper - The raw wrapper whose impl is about to change.
+     * @param {*} impl - The wrapper's impl before the change.
+     * @param {Function} resolve - Maps a recorded value to its raw wrapper (or null).
+     * @returns {void}
+     * @public
+     *
+     * @example
+     * ownership.pinLiveEntries("plugins", wrapper, previousImpl, resolveWrapper);
+     */
+    public pinLiveEntries(apiPath: string, wrapper: object, impl: any, resolve: Function): void;
     /**
      * Record a module's mount endpoint (the apiPath it was loaded/added at).
      * This is the module's ownership root — the subtree it is allowed to write
diff --git a/types/src/lib/handlers/ownership.d.mts.map b/types/src/lib/handlers/ownership.d.mts.map
index 52d4d286f..1ba1cff89 100644
--- a/types/src/lib/handlers/ownership.d.mts.map
+++ b/types/src/lib/handlers/ownership.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"ownership.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/ownership.mjs"],"names":[],"mappings":"AAyLA;;;;;GAKG;AAEH;;;;;GAKG;AACH;IACC,gCAAsC;IAEtC;;;OAGG;IACH,sBAFW,MAAM,EAgBhB;IAZA,4BAA6B;IAC7B,4BAA6B;IAC7B,+BAAqC;IACrC,+BAAgC;IAGhC,8BAA+B;IAG/B,2BAA4B;IAE5B,mCAAiC;IAGlC;;;;;;;;;;;;;;;;;OAiBG;IACH,oCAhBW,MAAM,OACN,MAAM,GAEJ,IAAI,CA6DhB;IAED;;;;;;;;OAQG;IACH,kCAPW,MAAM,GACJ,OAAO,CAQnB;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,uCAjBW,MAAM,WACN,MAAM,WAAS,WAEf;YAAO,MAAM,GAAE,MAAM,EAAE;KAAC,GAAC,IAAI,SAC7B,MAAM,EAAE,GAAC,IAAI,GACX,IAAI,CAoBhB;IAED;;;;;;;;;OASG;IACH,wBARW,GAAC,YACD,GAAC,GACC,IAAI,CAQhB;IAED;;;;;;;;;OASG;IACH,mCARW,MAAM,GAAC,IAAI,SACX,GAAC,GACC,MAAM,EAAE,GAAC,IAAI,CASzB;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,wCAfW,MAAM,GAAC,IAAI,OACX,MAAM,SACN,GAAC,GACC,MAAM,EAAE,GAAC,IAAI,CAgBzB;IAED;;;;;;;;;OASG;IACH,0CARW,MAAM,GAAC,IAAI,SACX,GAAC,GACC;YAAO,MAAM,GAAE,MAAM,EAAE;KAAC,GAAC,IAAI,CAQzC;IAyBD;;;;;;;;;;;;;;;OAeG;IACH,0BAdW,MAAM,GACJ;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,UAAU,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;QAAC,OAAO,EAAE,CAAC;gBAAO,MAAM,GAAE,MAAM,EAAE;SAAC,GAAC,IAAI,CAAC,CAAA;KAAC,GAAC,IAAI,CAsBnI;IAED;;;;;;;;;;;;OAYG;IACH,+BATW,MAAM,WACN,MAAM,UACN;QAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;QAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAA;KAAC,GACzF,IAAI,CAYhB;IAED;;;;;;;;OAQG;IACH,mCALW,MAAM,YACN,MAAM,GACJ,IAAI,CAUhB;IAED;;;;;OAKG;IACH,mCAJW,MAAM,GACJ,MAAM,GAAC,SAAS,CAK5B;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,kCArBW,MAAM,YACN,MAAM,iBACN,MAAM,GAAC,IAAI,GAET,MAAM,GAAC,IAAI,CA4BvB;IAED;;;;;;;;;;OAUG;IACH,kCATW,MAAM,WACN,MAAM,GACJ,MAAM,GAAC,IAAI,CAoBvB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,sHAfG;QAAwB,QAAQ,EAAxB,MAAM;QACU,OAAO,EAAvB,MAAM;QACK,KAAK,EAAhB,GAAC;QACgB,MAAM;QACN,aAAa;QACb,MAAM;QACN,QAAQ;QACD,UAAU;QAGM,iBAAiB;;;KAEjE,GAAU,MAAM,GAAC,IAAI,CA0NvB;IA2BD;;;;;;;;;;OAUG;IACH,4BAVW,MAAM,GACJ,gBAAgB,CAwC5B;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,kCAtBW,MAAM,GACJ,IAAI,CAyBhB;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,mCApBW,MAAM,GACJ,IAAI,CAqBhB;IAED;;;;;;;;;;;;;OAaG;IACH,2BAbW,MAAM,aACN,MAAM,GAAC,IAAI,GACT;QAAE,MAAM,EAAE,QAAQ,GAAC,MAAM,GAAC,SAAS,CAAC;QAAC,eAAe,EAAE,MAAM,GAAC,IAAI,CAAC;QAC5E,eAAe,EAAE,MAAM,GAAC,IAAI,CAAA;KAAE,CAgDhC;IAED;;;;;OAKG;IACH,gCAJW,MAAM,GACJ,MAAM,GAAC,IAAI,CAevB;IAED;;;;;OAKG;IACH,gCAJW,MAAM,GACJ,GAAC,CAkBb;IAED;;;;;OAKG;IACH,gCAJW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAKzB;IAED;;;;;OAKG;IACH,+BAJW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAKzB;IAED;;;;;;OAMG;IACH,0BALW,MAAM,WACN,MAAM,GACJ,OAAO,CAMnB;IAED;;;;OAIG;IACH,yBAHa,MAAM,CAkBlB;IAED;;;;;OAKG;IACH,iCAJW,MAAM,GACJ,GAAG,CAAC,MAAM,CAAC,GAAC,IAAI,CAS5B;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,4BA3BW,MAAM,YACN,MAAM,QACN,MAAM,+BAEd;QAAyB,aAAa;QAGZ,OAAO;KACjC,GAAU,IAAI,CA4DhB;IA+BD;;;;;;;;;;;;;;;OAeG;IACH,uCAdW,MAAM,GACJ,GAAG,CAAC,MAAM,EAAE;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,UAAU,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;QAAC,iBAAiB,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,CAAC,CAiCjK;IAED;;;;;;;;;;;;OAYG;IACH,8BAVW,MAAM,WACN,MAAM,YACN;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;QAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,GAExI,IAAI,CAehB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,kCA1BW,MAAM,YACN,MAAM,GACJ;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,UAAU,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;QAAC,iBAAiB,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,GAAC,SAAS,CAmC9J;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,qCA5BW,MAAM,YACN,MAAM,QACN,MAAM,gBACN,GAAG,CAAC,MAAM,EAAE;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAC,CAAC,2BAI9D,IAAI,CAmEhB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,wCA3BW,MAAM,gBACN,GAAG,CAAC,MAAM,EAAE;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,CAAC,GAGpF,IAAI,CAgChB;IAED;;;;;;;;;;;;OAYG;IACH,+BAXW,MAAM,GACJ,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,CAAC,CAAC,CAsBrE;IAED;;;;;OAKG;IACH,4BAJW,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,CAAC,GAAC,SAAS,GACpD,MAAM,GAAC,SAAS,CAW5B;IAED;;;;;;;;;;;;;;OAcG;IACH,+BAZW,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,CAAC,CAAC,aAEzD,GAAG,CAAC,MAAM,CAAC,GACT,IAAI,CAoBhB;IAED;;;OAGG;IACH,qBAOC;IAED;;;;OAIG;IACH,sBAHa,MAAM,CAQlB;IAED;;;;OAIG;IACH,0BAHW,MAAM,QAgBhB;;CACD;;;;;;;;aAvzCa,MAAM,EAAE;;;;gBACR,MAAM,EAAE;;8BA3KQ,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"ownership.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/ownership.mjs"],"names":[],"mappings":"AAyLA;;;;;GAKG;AAEH;;;;;GAKG;AACH;IACC,gCAAsC;IAEtC;;;OAGG;IACH,sBAFW,MAAM,EAgBhB;IAZA,4BAA6B;IAC7B,4BAA6B;IAC7B,+BAAqC;IACrC,+BAAgC;IAGhC,8BAA+B;IAG/B,2BAA4B;IAE5B,mCAAiC;IAGlC;;;;;;;;;;;;;;;;;OAiBG;IACH,oCAhBW,MAAM,OACN,MAAM,GAEJ,IAAI,CA6DhB;IAED;;;;;;;;OAQG;IACH,kCAPW,MAAM,GACJ,OAAO,CAQnB;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,uCAjBW,MAAM,WACN,MAAM,WAAS,WAEf;YAAO,MAAM,GAAE,MAAM,EAAE;KAAC,GAAC,IAAI,SAC7B,MAAM,EAAE,GAAC,IAAI,GACX,IAAI,CAoBhB;IAED;;;;;;;;;OASG;IACH,wBARW,GAAC,YACD,GAAC,GACC,IAAI,CAQhB;IAED;;;;;;;;;OASG;IACH,mCARW,MAAM,GAAC,IAAI,SACX,GAAC,GACC,MAAM,EAAE,GAAC,IAAI,CASzB;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,wCAfW,MAAM,GAAC,IAAI,OACX,MAAM,SACN,GAAC,GACC,MAAM,EAAE,GAAC,IAAI,CAgBzB;IAED;;;;;;;;;OASG;IACH,0CARW,MAAM,GAAC,IAAI,SACX,GAAC,GACC;YAAO,MAAM,GAAE,MAAM,EAAE;KAAC,GAAC,IAAI,CAQzC;IAyBD;;;;;;;;;;;;;;;OAeG;IACH,0BAdW,MAAM,GACJ;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,UAAU,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;QAAC,OAAO,EAAE,CAAC;gBAAO,MAAM,GAAE,MAAM,EAAE;SAAC,GAAC,IAAI,CAAC,CAAA;KAAC,GAAC,IAAI,CAsBnI;IAED;;;;;;;;;;;;OAYG;IACH,+BATW,MAAM,WACN,MAAM,UACN;QAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;QAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAA;KAAC,GACzF,IAAI,CAYhB;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,+BAVW,MAAM,WACN,MAAM,QACN,GAAC,sBAEC,IAAI,CAUhB;IAED;;;;;;;;OAQG;IACH,mCALW,MAAM,YACN,MAAM,GACJ,IAAI,CAUhB;IAED;;;;;OAKG;IACH,mCAJW,MAAM,GACJ,MAAM,GAAC,SAAS,CAK5B;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,kCArBW,MAAM,YACN,MAAM,iBACN,MAAM,GAAC,IAAI,GAET,MAAM,GAAC,IAAI,CA4BvB;IAED;;;;;;;;;;OAUG;IACH,kCATW,MAAM,WACN,MAAM,GACJ,MAAM,GAAC,IAAI,CAoBvB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,sHAfG;QAAwB,QAAQ,EAAxB,MAAM;QACU,OAAO,EAAvB,MAAM;QACK,KAAK,EAAhB,GAAC;QACgB,MAAM;QACN,aAAa;QACb,MAAM;QACN,QAAQ;QACD,UAAU;QAGM,iBAAiB;;;KAEjE,GAAU,MAAM,GAAC,IAAI,CA0NvB;IA2BD;;;;;;;;;;OAUG;IACH,4BAVW,MAAM,GACJ,gBAAgB,CAwC5B;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,kCAtBW,MAAM,GACJ,IAAI,CAyBhB;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,mCApBW,MAAM,GACJ,IAAI,CAqBhB;IAED;;;;;;;;;;;;;OAaG;IACH,2BAbW,MAAM,aACN,MAAM,GAAC,IAAI,GACT;QAAE,MAAM,EAAE,QAAQ,GAAC,MAAM,GAAC,SAAS,CAAC;QAAC,eAAe,EAAE,MAAM,GAAC,IAAI,CAAC;QAC5E,eAAe,EAAE,MAAM,GAAC,IAAI,CAAA;KAAE,CAgDhC;IAED;;;;;OAKG;IACH,gCAJW,MAAM,GACJ,MAAM,GAAC,IAAI,CAevB;IAED;;;;;OAKG;IACH,gCAJW,MAAM,GACJ,GAAC,CAkBb;IAED;;;;;OAKG;IACH,gCAJW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAKzB;IAED;;;;;OAKG;IACH,+BAJW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAKzB;IAED;;;;;;OAMG;IACH,0BALW,MAAM,WACN,MAAM,GACJ,OAAO,CAMnB;IAED;;;;OAIG;IACH,yBAHa,MAAM,CAkBlB;IAED;;;;;OAKG;IACH,iCAJW,MAAM,GACJ,GAAG,CAAC,MAAM,CAAC,GAAC,IAAI,CAS5B;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,4BA3BW,MAAM,YACN,MAAM,QACN,MAAM,+BAEd;QAAyB,aAAa;QAGZ,OAAO;KACjC,GAAU,IAAI,CA4DhB;IA+BD;;;;;;;;;;;;;;;OAeG;IACH,uCAdW,MAAM,GACJ,GAAG,CAAC,MAAM,EAAE;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,UAAU,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;QAAC,iBAAiB,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,CAAC,CAiCjK;IAED;;;;;;;;;;;;OAYG;IACH,8BAVW,MAAM,WACN,MAAM,YACN;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;QAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,GAExI,IAAI,CAehB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,kCA1BW,MAAM,YACN,MAAM,GACJ;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,UAAU,EAAE,CAAC,MAAM,EAAE,GAAC,IAAI,CAAC,CAAC;QAAC,iBAAiB,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,GAAC,SAAS,CAmC9J;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,qCA5BW,MAAM,YACN,MAAM,QACN,MAAM,gBACN,GAAG,CAAC,MAAM,EAAE;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAC,CAAC,2BAI9D,IAAI,CAmEhB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,wCA3BW,MAAM,gBACN,GAAG,CAAC,MAAM,EAAE;QAAC,KAAK,EAAE,GAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,MAAM,GAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,CAAC,GAGpF,IAAI,CAgChB;IAED;;;;;;;;;;;;OAYG;IACH,+BAXW,MAAM,GACJ,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,CAAC,CAAC,CAsBrE;IAED;;;;;OAKG;IACH,4BAJW,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,CAAC,GAAC,SAAS,GACpD,MAAM,GAAC,SAAS,CAW5B;IAED;;;;;;;;;;;;;;OAcG;IACH,+BAZW,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,CAAC,CAAC,aAEzD,GAAG,CAAC,MAAM,CAAC,GACT,IAAI,CAoBhB;IAED;;;OAGG;IACH,qBAOC;IAED;;;;OAIG;IACH,sBAHa,MAAM,CAQlB;IAED;;;;OAIG;IACH,0BAHW,MAAM,QAgBhB;;CACD;;;;;;;;aAh1Ca,MAAM,EAAE;;;;gBACR,MAAM,EAAE;;8BA3KQ,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/lib/handlers/unified-wrapper.d.mts b/types/src/lib/handlers/unified-wrapper.d.mts
index 0205e0207..055ce1c56 100644
--- a/types/src/lib/handlers/unified-wrapper.d.mts
+++ b/types/src/lib/handlers/unified-wrapper.d.mts
@@ -95,6 +95,17 @@ export class UnifiedWrapper extends ComponentBase {
      * @private
      */
     private static _extractFullImpl;
+    /**
+     * Whether an impl makes its wrapper callable: a function, or an object with a default-exported
+     * function.
+     * @param {*} impl - The impl.
+     * @returns {boolean} True for a callable impl.
+     * @private
+     *
+     * @example
+     * UnifiedWrapper._isCallableImpl({ default() {} }); // true
+     */
+    private static _isCallableImpl;
     /**
      * @param {Object} slothlet - Slothlet instance (provides contextManager, instanceID, ownership)
      * @param {Object} options - Configuration options
@@ -190,6 +201,70 @@ export class UnifiedWrapper extends ComponentBase {
      * @private
      */
     private _applyNewImpl;
+    /**
+     * Give a namespace the function a later contribution supplies, keeping its children (#533).
+     *
+     * @description
+     * A merge (`merge` / `merge-replace`) keeps the existing node and only adds the incoming children,
+     * so the incoming module's own function was dropped and a namespace created by an earlier module
+     * could never become callable. The function is resolved like any other merged member: a namespace
+     * with no function yet always takes it; one that already has a function keeps it under `merge`
+     * (first writer wins) and takes the incoming one under `merge-replace` (incoming wins). The children
+     * are untouched: the incoming impl's own members were already adopted into child wrappers, which the
+     * caller merges separately.
+     *
+     * @param {*} impl - The incoming contribution's impl at this node.
+     * @param {boolean} [replaceExisting=false] - True under `merge-replace`: the incoming function
+     *   replaces an existing one.
+     * @returns {boolean} True when the namespace took the function.
+     * @private
+     *
+     * @example
+     * existingWrapper.___adoptCallableImpl(nextWrapper.____slothletInternal.impl, collisionMode === "merge-replace");
+     */
+    private ___adoptCallableImpl;
+    /**
+     * Replace this wrapper's non-callable proxy with a callable one (#533).
+     *
+     * @description
+     * A Proxy's callability is fixed when it is created, and a namespace that started non-callable
+     * uses the wrapper itself as its target (so `typeof` reads "object"). When a function arrives, a new
+     * proxy is built from the same handler on a function target, registered for this wrapper, and
+     * installed in the parent in place of the old one, so `api.<path>` is callable from then on. The
+     * old proxy's traps are re-pointed at the new proxy (the same forwarding restart() gives a held
+     * reference, #504), so a reference held from before keeps reading, enumerating and writing through
+     * to the live namespace — but stays non-callable itself and keeps `typeof` "object".
+     *
+     * The upgrade is one-way: when the function later goes away (a remove or a reload), the callable
+     * proxy stays and a call throws `INVALID_CONFIG_NOT_A_FUNCTION`, the same as for a namespace that
+     * was callable from the start.
+     *
+     * @returns {void}
+     * @private
+     *
+     * @example
+     * if (internal.proxyTraps !== null) wrapper.___upgradeToCallableProxy();
+     */
+    private ___upgradeToCallableProxy;
+    /**
+     * Swap the proxy the parent node holds for this wrapper at its apiPath (#533).
+     *
+     * @description
+     * Walks the live api tree from the root along `apiPath` through raw wrappers' own properties (no
+     * proxy traps, so nothing materializes) and replaces the child only where it is exactly `oldProxy`,
+     * keeping its property descriptor (children are defined configurable). `boundApi`/`self` forward to
+     * the same root, so one swap covers them. When the path no longer leads to `oldProxy` (the node was
+     * detached or replaced), nothing changes; the old proxy forwards to the new one regardless.
+     *
+     * @param {object} oldProxy - The proxy being replaced.
+     * @param {object} newProxy - Its replacement.
+     * @returns {void}
+     * @private
+     *
+     * @example
+     * wrapper.___replaceInParent(oldProxy, newProxy);
+     */
+    private ___replaceInParent;
     /**
      * Set new implementation and adopt children.
      * Delegates core impl work to _applyNewImpl, then emits lifecycle events
diff --git a/types/src/lib/handlers/unified-wrapper.d.mts.map b/types/src/lib/handlers/unified-wrapper.d.mts.map
index 69b3534d5..9d782e864 100644
--- a/types/src/lib/handlers/unified-wrapper.d.mts.map
+++ b/types/src/lib/handlers/unified-wrapper.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"unified-wrapper.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/unified-wrapper.mjs"],"names":[],"mappings":"AAu7BA;;;;;;;;;;;;;;;;;;GAkBG;AACH,4CAhBW,MAAM,GAAC,MAAM,GACX,OAAO,CAkBnB;AAokJD;;;;;;;;;;;GAWG;AACH,sCAPW,OAAO,GACL,cAAc,GAAC,IAAI,CAkB/B;AA7nJD;;;;;;;;GAQG;AACH,iCAHU,GAAG,CAAC,MAAM,CAAC,CAG2F;;;;;AAqNhH;;;;;;;;;;GAUG;AACH;IA8UC;;;;;;;;;;;;;;;;OAgBG;IACH,0BAsCC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,gCAiEC;IAhcD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,sBApCW,MAAM,mKAEd;QAAwB,IAAI,EAApB,MAAM;QACU,OAAO,EAAvB,MAAM;QACyB,WAAW;QACvB,eAAe;QAChB,UAAU;QACV,mBAAmB;QACpB,QAAQ;QACD,UAAU;QAGjB,QAAQ;QACR,YAAY;QACE,cAAc;QAI3B,eAAe;KAMzC,EAsOF;IAhRD;;;;;;;;;;;OAWG;IACH,4BAFa,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAC,SAAS,CAKzC;IAmQD;;;;;;;;;;OAUG;IACH,uEAHa,GAAC,CA+Bb;IAED;;;;OAIG;IACH,qBAHa,WAAS,MAAM,GAAC,IAAI,CAKhC;IAiJD;;;;;;;;;;;OAWG;IACH,sBA0CC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,mBAwDC;IAED;;;;;;;;;OASG;IACH,qBAsDC;IAED;;;;OAIG;IACH,uBA4GC;IAED;;;;;;;;;OASG;IACH,qBAEC;IAED;;;;;;;;;OASG;IACH,sBAiBC;IAED;;;;;;;OAOG;IACH,6BAGC;IAED;;;;;;;;;;OAUG;IACH,6BAuiBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BAiQC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BA83BC;IAED;;;;;;OAMG;IACH,uCA6zDC;;CACD;8BAt+K6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"unified-wrapper.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/unified-wrapper.mjs"],"names":[],"mappings":"AAu7BA;;;;;;;;;;;;;;;;;;GAkBG;AACH,4CAhBW,MAAM,GAAC,MAAM,GACX,OAAO,CAkBnB;AAowJD;;;;;;;;;;;GAWG;AACH,sCAPW,OAAO,GACL,cAAc,GAAC,IAAI,CAkB/B;AA7zJD;;;;;;;;GAQG;AACH,iCAHU,GAAG,CAAC,MAAM,CAAC,CAG2F;;;;;AAkThH;;;;;;;;;;GAUG;AACH;IAkVC;;;;;;;;;;;;;;;;OAgBG;IACH,0BAsCC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,gCAiEC;IAiED;;;;;;;;;OASG;IACH,+BAEC;IAjhBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,sBApCW,MAAM,mKAEd;QAAwB,IAAI,EAApB,MAAM;QACU,OAAO,EAAvB,MAAM;QACyB,WAAW;QACvB,eAAe;QAChB,UAAU;QACV,mBAAmB;QACpB,QAAQ;QACD,UAAU;QAGjB,QAAQ;QACR,YAAY;QACE,cAAc;QAI3B,eAAe;KAMzC,EA0OF;IApRD;;;;;;;;;;;OAWG;IACH,4BAFa,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAC,SAAS,CAKzC;IAuQD;;;;;;;;;;OAUG;IACH,uEAHa,GAAC,CA+Bb;IAED;;;;OAIG;IACH,qBAHa,WAAS,MAAM,GAAC,IAAI,CAKhC;IAiJD;;;;;;;;;;;OAWG;IACH,sBAiDC;IAgBD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,6BAaC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,kCAoBC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,2BAYC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,mBAwDC;IAED;;;;;;;;;OASG;IACH,qBAsDC;IAED;;;;OAIG;IACH,uBA4GC;IAED;;;;;;;;;OASG;IACH,qBAEC;IAED;;;;;;;;;OASG;IACH,sBAiBC;IAED;;;;;;;OAOG;IACH,6BAGC;IAED;;;;;;;;;;OAUG;IACH,6BAuiBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BAiQC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,8BA83BC;IAED;;;;;;OAMG;IACH,uCAuxDC;;CACD;8BAtqL6B,2BAA2B"}
\ No newline at end of file

From 70d2ec4b9355ed3bda51d53062332cd29d2e521e Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Fri, 2 Oct 2026 16:14:41 -0700
Subject: [PATCH 47/49] ci: run the in-repo PR mirror job instead of skipping
 it
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Required PR Check mirror job was skipped on the `pull_request` run of
an in-repo feature PR, with a conditional name keeping the skipped check
off `✅ Required PR Check`. GitHub never evaluates a skipped job's
`name:`, so every in-repo PR showed the raw expression as a check name.

The job now uses `if: always()` and never skips, so its name is always
evaluated. On the in-repo PR path it lands on
`⏭️ Required PR Check (reported by the push run)` and passes as a no-op;
the push run still posts `✅ Required PR Check`. Every path that posts
the required name keeps `needs: ci`, so that check still only exists
once the full test matrix for the SHA has finished.

Synced from CLDMV/.github#351 (CLDMV/.github#350).
---
 .github/workflows/ci.yml | 63 +++++++++++++++++++++++-----------------
 1 file changed, 36 insertions(+), 27 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 32acdeb66..3e67772d5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -300,37 +300,37 @@ jobs:
     # automatically — no `pull_request` round-trip needed for non-fork
     # non-release PRs.
     required-check:
-        # The name is conditional on purpose. On an in-repo feature PR the
-        # `pull_request` run skips this job (the push run owns the status), and
-        # a skipped job still posts a check run under its name. GitHub treats a
-        # SKIPPED required check as satisfied — so if the skipped job were named
-        # `✅ Required PR Check`, it would green-light the ruleset (and enable
-        # auto-merge) while the push run's real mirror hadn't been created yet
-        # (it only appears once `ci` finishes), letting a PR merge mid-test or
-        # even override a red result. An expression name keeps the skipped job
-        # off the required name: GitHub does not evaluate the name of a skipped
-        # job, so it shows up as the raw expression text (still not the
-        # required name), while every path that runs evaluates to
-        # `✅ Required PR Check`. The condition is written out anyway so the
-        # name stays correct if GitHub ever starts evaluating it, and must stay
-        # identical to the `if:` below.
-        name: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == true || github.event.pull_request.head.ref == 'next' || github.event.pull_request.head.ref == 'hotfixes') && '✅ Required PR Check' || '⏭️ Required PR Check (reported by the push run)' }}
-        needs: ci
-        # Mirror the `ci` job's gating exactly. The four cases that run:
+        # Which name this job reports under is the whole point of it.
+        #
+        # The ruleset gates merges on `✅ Required PR Check`, so a check with that
+        # name must only ever exist on a head SHA after the full test matrix for
+        # that SHA has finished, mirroring its result. `needs: ci` guarantees the
+        # timing: the job is only created once every Build & Test leg and the
+        # coverage job are done.
+        #
+        # On an in-repo feature PR the `pull_request` run does not own the status
+        # (the push run on the head branch does), so it must not post
+        # `✅ Required PR Check` at all. Two traps rule out the obvious shapes:
+        #   - A job SKIPPED by `if:` still posts a check run under its name, and
+        #     GitHub treats a skipped required check as satisfied. Under the real
+        #     name that let PRs merge mid-test (CLDMV/slothlet#553).
+        #   - GitHub does not evaluate the `name:` of a skipped job, so a
+        #     conditional name on a skippable job shows up as the raw expression
+        #     text (#350).
+        # So the job never skips: it runs on every path, the name expression is
+        # always evaluated, and the in-repo PR path lands on a readable,
+        # non-required name and passes as a no-op. The condition below is
+        # repeated in the step's OWNS_STATUS and must stay identical. The paths
+        # that own the status:
         #   1. push events                                            (job needs CI run)
         #   2. fork PRs                                               (push doesn't cover forks)
         #   3. release PRs from `next` → master/main                  (push covers SHA but commit-gate skips chore-bump)
         #   4. release PRs from `hotfixes` → master/main              (same reason)
-        # In-repo feature PRs targeting `next` / `hotfixes` skip on
-        # pull_request — the push run on the head branch reports the status
-        # on the SHA. See the `name:` above for why the skipped job is renamed.
-        if: |
-          always() && (
-            github.event_name != 'pull_request' ||
-            github.event.pull_request.head.repo.fork == true ||
-            github.event.pull_request.head.ref == 'next' ||
-            github.event.pull_request.head.ref == 'hotfixes'
-          )
+        name: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == true || github.event.pull_request.head.ref == 'next' || github.event.pull_request.head.ref == 'hotfixes') && '✅ Required PR Check' || '⏭️ Required PR Check (reported by the push run)' }}
+        needs: ci
+        # always(): run even when `ci` is skipped (the in-repo PR path) or failed
+        # (so the mirror can report red).
+        if: always()
         # Match the reusable's runner routing (workflow-ci.yml): private CLDMV
         # repos run on self-hosted cldmv-runners (GitHub-hosted Actions budget is
         # private-metered and exhausted), public repos use free GitHub-hosted, and
@@ -344,10 +344,19 @@ jobs:
         steps:
             - name: Mirror reusable result
               env:
+                  OWNS_STATUS: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == true || github.event.pull_request.head.ref == 'next' || github.event.pull_request.head.ref == 'hotfixes' }}
                   IS_MASTER_SYNC: ${{ needs.ci.outputs.is_master_sync }}
                   DOCS_ONLY: ${{ needs.ci.outputs.docs_only }}
                   CI_RESULT: ${{ needs.ci.result }}
               run: |
+                # In-repo feature PR: the push run on the head branch reports
+                # `✅ Required PR Check`. This job runs under the
+                # `⏭️ Required PR Check (reported by the push run)` name and
+                # must not gate anything.
+                if [ "$OWNS_STATUS" != "true" ]; then
+                  echo "In-repo PR event — the push run reports ✅ Required PR Check for this SHA."
+                  exit 0
+                fi
                 echo "ci.result=$CI_RESULT  docs_only=$DOCS_ONLY  is_master_sync=$IS_MASTER_SYNC"
                 # next/hotfixes was force-synced to master — head SHA matches the
                 # default branch, nothing new to test, green-light without running CI.

From a563571e3e58de452ebee3735d741c3f1c8e74c8 Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Fri, 2 Oct 2026 15:58:14 -0700
Subject: [PATCH 48/49] fix(remove): keep other modules' children when the
 module that created a namespace is removed

Removing a module prunes its routine-captured wrappers and invalidates them
recursively, so a backgrounded materialization cannot re-capture removed
content (#372). When the removed module created a namespace (for example
its default export made `plugins` callable), its captured wrapper is that
live namespace, and the recursive invalidation walked into every child
other modules had merged into it: `plugins.gamma` then threw
"plugins.gamma is invalidated" although its module was still mounted.

RoutineManager#pruneModule now invalidates only captured wrappers that are
no longer the live node at their apiPath, and returns the live ones.
removeApiComponent invalidates those after its restore/delete passes, once
it is known which of them the removal actually took off the tree: a
removed leaf still becomes unusable through a held reference, while a
namespace that other modules' children keep standing stays usable, along
with those children (same references, the survivor's key order).

Fixes #555
---
 src/lib/handlers/api-manager.mjs              |  38 ++-
 src/lib/handlers/routine-manager.mjs          |  12 +-
 ...namespace-becomes-callable.test.vitest.mjs |   8 +-
 ...i-remove-namespace-creator.test.vitest.mjs | 227 ++++++++++++++++++
 types/src/lib/handlers/api-manager.d.mts      |   4 +
 types/src/lib/handlers/api-manager.d.mts.map  |   2 +-
 types/src/lib/handlers/routine-manager.d.mts  |   5 +-
 .../lib/handlers/routine-manager.d.mts.map    |   2 +-
 8 files changed, 282 insertions(+), 16 deletions(-)
 create mode 100644 tests/vitests/suites/addapi/addapi-remove-namespace-creator.test.vitest.mjs

diff --git a/src/lib/handlers/api-manager.mjs b/src/lib/handlers/api-manager.mjs
index e4c202b23..bf5d983f4 100644
--- a/src/lib/handlers/api-manager.mjs
+++ b/src/lib/handlers/api-manager.mjs
@@ -1049,11 +1049,34 @@ export class ApiManager extends ComponentBase {
 		}
 	}
 
+	/**
+	 * Whether a wrapper is the live node at its own apiPath in the api tree (#555).
+	 * @param {?object} raw - A raw wrapper, or null for a non-wrapper value.
+	 * @returns {boolean} True when walking the tree from the root along the wrapper's apiPath reaches it.
+	 * @private
+	 *
+	 * @description
+	 * The walk reads raw wrappers' own properties (children are own data properties), so no proxy trap
+	 * runs and nothing materializes.
+	 */
+	#isLiveWrapper(raw) {
+		if (!raw) return false;
+		let node = this.slothlet.api;
+		for (const segment of String(raw.____slothletInternal.apiPath).split(".")) {
+			node = (resolveWrapper(node) ?? node)?.[segment];
+		}
+		return resolveWrapper(node) === raw;
+	}
+
 	/**
 	 * Invalidate every UnifiedWrapper found in a rejected candidate's subtree, so a still-in-flight
 	 * `backgroundMaterialize: true` materialization cannot re-apply the rejected content later.
 	 * @param {unknown} api - Candidate subtree (or leaf) to walk.
 	 * @param {WeakSet} [visited] - Cycle guard for the recursive walk.
+	 * @param {?Array<object>} [liveKept=null] - When given, a wrapper that is still the live node at its own
+	 *   apiPath is left alone (with everything beneath it) and pushed here instead. A removed module's
+	 *   captured wrapper can be the very namespace other modules merged their children into, so a removal
+	 *   invalidates only what its restore/delete pass actually detached (#555).
 	 * @returns {void}
 	 * @private
 	 *
@@ -1072,10 +1095,14 @@ export class ApiManager extends ComponentBase {
 	 * @example
 	 * this.invalidateSpeculativeWrappers(rootSource[key]);
 	 */
-	invalidateSpeculativeWrappers(api, visited = new WeakSet()) {
+	invalidateSpeculativeWrappers(api, visited = new WeakSet(), liveKept = null) {
 		if (!api || (typeof api !== "object" && typeof api !== "function")) return;
 		if (visited.has(api)) return;
 		visited.add(api);
+		if (liveKept && this.#isLiveWrapper(resolveWrapper(api))) {
+			liveKept.push(api);
+			return;
+		}
 
 		// Children FIRST, parent LAST: ___invalidate() deletes every one of its own child
 		// properties as part of invalidating a wrapper. Invalidating the parent before walking
@@ -1086,7 +1113,7 @@ export class ApiManager extends ComponentBase {
 			const skipProps = ["__metadata", "__type", "_materialize", "_impl", "____slothletInternal"];
 			if (skipProps.includes(key)) continue;
 			if (typeof value === "function" || (value && typeof value === "object")) {
-				this.invalidateSpeculativeWrappers(value, visited);
+				this.invalidateSpeculativeWrappers(value, visited, liveKept);
 			}
 		}
 
@@ -3368,7 +3395,9 @@ export class ApiManager extends ComponentBase {
 			// A merge-loser's raw routine contribution is never pruned by impl:removed (it was never
 			// the live property at its path), so it must be pruned explicitly here alongside the
 			// ownership removal that just discarded every path this module owned (#372).
-			this.slothlet.handlers.routineManager?.pruneModule?.(moduleIDKey);
+			// Captured wrappers still live in the tree are left to the restore/delete passes below and
+			// invalidated after them, once it is known which of them those passes detached (#555).
+			const capturedLive = this.slothlet.handlers.routineManager.pruneModule(moduleIDKey);
 			// Principals (#459) the module registered go with it — a resolver never outlives its code.
 			this.slothlet.handlers.permissionManager?.onModuleRemoved?.(moduleIDKey);
 			// So do its event listeners (#497), for the same reason.
@@ -3563,6 +3592,9 @@ export class ApiManager extends ComponentBase {
 			}
 
 			for (const [apiPath, live] of rolledBackNodes) this.#restoreNamespaceFunction(live, apiPath);
+			// Now invalidate the removed module's captured wrappers that the passes above took off the tree; any
+			// still live (a namespace it created that other modules' children keep standing) stays usable (#555).
+			for (const wrapper of capturedLive) this.invalidateSpeculativeWrappers(wrapper, undefined, []);
 
 			this.state.addHistory = this.state.addHistory.filter((entry) => String(entry.moduleID) !== moduleIDKey);
 
diff --git a/src/lib/handlers/routine-manager.mjs b/src/lib/handlers/routine-manager.mjs
index 0e72a2262..9dab2f972 100644
--- a/src/lib/handlers/routine-manager.mjs
+++ b/src/lib/handlers/routine-manager.mjs
@@ -675,7 +675,8 @@ export class RoutineManager extends ComponentBase {
 	 * Prune every raw-captured contribution belonging to a module, regardless of whether it was
 	 * ever the live property at its own path.
 	 * @param {string} moduleID - Module identifier being fully removed.
-	 * @returns {void}
+	 * @returns {Array<object>} The captured wrappers still live in the api tree, left un-invalidated for the
+	 *   caller to invalidate once its removal has detached them (#555).
 	 * @public
 	 *
 	 * @description
@@ -697,7 +698,7 @@ export class RoutineManager extends ComponentBase {
 	pruneModule(moduleID) {
 		this.raw = this.raw.filter((e) => e.moduleID !== moduleID);
 		const moduleWrappers = this.rawWrappers.get(moduleID);
-		if (!moduleWrappers) return;
+		if (!moduleWrappers) return [];
 		// A merge-loser's wrapper is never the live api-tree property at its path — ownership's
 		// own unregister()/removePath() has nothing to invalidate it via. Without this, a
 		// still-in-flight backgroundMaterialize: true materialization on this detached wrapper (or
@@ -705,10 +706,15 @@ export class RoutineManager extends ComponentBase {
 		// re-capturing the just-removed module into `raw` (#372/#373 review, suppressed finding).
 		// Recursive + children-before-parent ordering via ApiManager's own helper, since this
 		// wrapper can itself carry adopted child wrappers.
+		// A captured wrapper that is still the live node at its path is left alone and returned: it can be
+		// a namespace this module created and other modules merged their children into, so the caller's
+		// removal decides — after its restore/delete pass — whether it actually leaves the tree (#555).
+		const liveKept = [];
 		for (const wrapper of moduleWrappers.values()) {
-			this.slothlet.handlers.apiManager?.invalidateSpeculativeWrappers(wrapper);
+			this.slothlet.handlers.apiManager?.invalidateSpeculativeWrappers(wrapper, undefined, liveKept);
 		}
 		this.rawWrappers.delete(moduleID);
+		return liveKept;
 	}
 
 	/**
diff --git a/tests/vitests/suites/addapi/addapi-namespace-becomes-callable.test.vitest.mjs b/tests/vitests/suites/addapi/addapi-namespace-becomes-callable.test.vitest.mjs
index 8ff1b891a..534c8ca43 100644
--- a/tests/vitests/suites/addapi/addapi-namespace-becomes-callable.test.vitest.mjs
+++ b/tests/vitests/suites/addapi/addapi-namespace-becomes-callable.test.vitest.mjs
@@ -314,10 +314,6 @@ for (const { config, name } of getMatrixConfigs()) {
 				api = null;
 			});
 
-			// Children are checked after a removal only when the removed module did not create the namespace:
-			// removing the creating module also invalidates the children other modules merged into it, which is
-			// a separate, pre-existing removal issue independent of the namespace's function.
-
 			/**
 			 * Add each module at `plugins` in order.
 			 * @param {string[]} order - moduleIDs, in add order.
@@ -351,7 +347,7 @@ for (const { config, name } of getMatrixConfigs()) {
 					// Removing the module whose function lost keeps the winner's.
 					await api.slothlet.api.remove(loser);
 					expect(await api.plugins()).toBe(MAIN[winner]);
-					if (loser !== order[0]) await expectLeaves(api.plugins, OTHER_LEAVES);
+					await expectLeaves(api.plugins, OTHER_LEAVES);
 				}
 			);
 
@@ -368,7 +364,7 @@ for (const { config, name } of getMatrixConfigs()) {
 
 					expect(typeof api.plugins).toBe("function");
 					expect(await api.plugins()).toBe(MAIN[remaining]);
-					if (winner !== order[0]) await expectLeaves(api.plugins, OTHER_LEAVES);
+					await expectLeaves(api.plugins, OTHER_LEAVES);
 				}
 			);
 
diff --git a/tests/vitests/suites/addapi/addapi-remove-namespace-creator.test.vitest.mjs b/tests/vitests/suites/addapi/addapi-remove-namespace-creator.test.vitest.mjs
new file mode 100644
index 000000000..dae35c689
--- /dev/null
+++ b/tests/vitests/suites/addapi/addapi-remove-namespace-creator.test.vitest.mjs
@@ -0,0 +1,227 @@
+/**
+ *	@Project: @cldmv/slothlet
+ *	@Filename: /tests/vitests/suites/addapi/addapi-remove-namespace-creator.test.vitest.mjs
+ *	@Date: 2026-10-02 00:00:00 -07:00 (1790924400)
+ *	@Author: Shinrai <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Shinrai <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02 00:00:00 -07:00 (1790924400)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ */
+
+/**
+ * @fileoverview Removing the module that created a shared namespace keeps the children other modules
+ * merged into it (#555).
+ *
+ * @description
+ * Two modules are added at `plugins`: the first creates the namespace, the second merges its children
+ * in (shared subfolders `tools` / `tools.net` and a leaf both export, `shared`, included). Removing the
+ * first module must leave every leaf of the second reachable and callable — with the same references —
+ * drop the first module's own leaves, hand a leaf both export to the survivor, and leave the namespace's
+ * keys as the survivor alone lays them out. Covered for a plain namespace creator and for one whose default export makes
+ * the namespace callable, in both add orders, under the `merge` and `merge-replace` collision modes.
+ *
+ * Runs across the full matrix (eager/lazy × async/live × hooks on/off).
+ *
+ * @module tests/vitests/suites/addapi/addapi-remove-namespace-creator
+ */
+
+process.env.SLOTHLET_INTERNAL_TEST_MODE = "true";
+
+import { describe, it, expect, afterEach, vi } from "vitest";
+import path from "node:path";
+import slothlet from "@cldmv/slothlet";
+import { resolveWrapper } from "#handlers/unified-wrapper";
+import { getMatrixConfigs, TEST_DIRS } from "../../setup/vitest-helper.mjs";
+
+// Instance creation plus two adds and a remove can exceed the default hook/test timeout on a loaded machine.
+vi.setConfig({ hookTimeout: 60000, testTimeout: 60000 });
+
+const API_TESTS_ROOT = path.dirname(TEST_DIRS.API_TEST);
+
+/** Each module: its folder, the leaves it contributes (dotted path → return value), and its function. */
+const MODULES = {
+	other: {
+		dir: path.join(API_TESTS_ROOT, "api_test_reload_comount_other"),
+		leaves: {
+			gamma: "other:gamma",
+			delta: "other:delta",
+			shared: "other:shared",
+			"gear.cog": "other:cog",
+			"gear.spring": "other:spring",
+			"tools.wrench": "other:wrench",
+			"tools.net.dns": "other:dns",
+			"tools.net.ntp": "other:ntp",
+			"tools.kit.tape": "other:tape",
+			"tools.kit.box.nail": "other:nail"
+		},
+		main: null
+	},
+	ext: {
+		dir: path.join(API_TESTS_ROOT, "api_test_reload_comount_ext"),
+		leaves: {
+			alpha: "ext:alpha",
+			beta: "ext:beta",
+			shared: "ext:shared",
+			"tools.hammer": "ext:hammer",
+			"tools.saw": "ext:saw",
+			"tools.net.http": "ext:http",
+			"tools.net.smtp": "ext:smtp"
+		},
+		main: null
+	},
+	callable: {
+		dir: path.join(API_TESTS_ROOT, "api_test_reload_comount_callable"),
+		leaves: { extra: "callable:extra" },
+		main: "callable:main"
+	}
+};
+
+/**
+ * Resolve a dotted path below a node.
+ * @param {*} node - Starting node.
+ * @param {string} dotted - Dotted path relative to `node`.
+ * @returns {*} The value at that path, or undefined.
+ */
+function at(node, dotted) {
+	let cur = node;
+	for (const part of dotted.split(".")) {
+		if (cur === undefined || cur === null) return undefined;
+		cur = cur[part];
+	}
+	return cur;
+}
+
+/**
+ * Run a call that may throw synchronously or reject, as a promise either way.
+ * @param {Function} fn - The call.
+ * @returns {Promise<unknown>} Its settled result.
+ */
+function settle(fn) {
+	return Promise.resolve().then(fn);
+}
+
+for (const { config, name } of getMatrixConfigs()) {
+	for (const collisionApi of ["merge", "merge-replace"]) {
+		describe(`Removing the module that created a namespace (#555) > ${collisionApi} > ${name}`, () => {
+			let api;
+
+			afterEach(async () => {
+				if (api?.shutdown) await api.shutdown();
+				api = null;
+			});
+
+			/**
+			 * Create an instance with this suite's collision mode and every mutation enabled.
+			 * @returns {Promise<object>} Slothlet API proxy.
+			 */
+			function createInstance() {
+				return slothlet({
+					...config,
+					base: TEST_DIRS.API_TEST,
+					silent: true,
+					api: {
+						...config.api,
+						collision: { ...(config.api?.collision ?? {}), api: collisionApi },
+						mutations: { add: true, remove: true, reload: true }
+					}
+				});
+			}
+
+			it.each([
+				["a plain namespace", ["ext", "other"]],
+				["a plain namespace", ["other", "ext"]],
+				["a callable namespace", ["callable", "other"]],
+				["a plain namespace under a callable merge", ["other", "callable"]]
+			])("%s created by the first of %j", async (_label, [creator, survivor]) => {
+				// The key order the survivor's namespace has on its own.
+				const alone = await createInstance();
+				await alone.slothlet.api.add("plugins", MODULES[survivor].dir, { moduleID: survivor });
+				const survivorOrder = Object.keys(alone.plugins);
+				await alone.shutdown();
+
+				api = await createInstance();
+				await api.slothlet.api.add("plugins", MODULES[creator].dir, { moduleID: creator });
+				await api.slothlet.api.add("plugins", MODULES[survivor].dir, { moduleID: survivor });
+
+				// Call every surviving leaf once (materializing it under lazy mode), then hold its reference.
+				const survivorLeaves = MODULES[survivor].leaves;
+				for (const dotted of Object.keys(survivorLeaves)) await at(api.plugins, dotted)();
+				const refs = Object.fromEntries(Object.keys(survivorLeaves).map((dotted) => [dotted, at(api.plugins, dotted)]));
+
+				await api.slothlet.api.remove(creator);
+
+				// Every surviving leaf is reachable, callable, and returns the survivor's value. A leaf the
+				// survivor shared with the removed module (`shared`) now resolves to the survivor's.
+				for (const [dotted, expected] of Object.entries(survivorLeaves)) {
+					const live = at(api.plugins, dotted);
+					expect(typeof live, dotted).toBe("function");
+					expect(await live(), `${dotted}()`).toBe(expected);
+					if (!(dotted in MODULES[creator].leaves)) {
+						// Same reference as before the removal, and a held reference still works.
+						expect(live, `${dotted} reference`).toBe(refs[dotted]);
+						expect(await refs[dotted](), `held ${dotted}()`).toBe(expected);
+					}
+				}
+
+				// The removed module's own leaves are gone.
+				for (const dotted of Object.keys(MODULES[creator].leaves)) {
+					if (dotted in survivorLeaves) continue;
+					expect(at(api.plugins, dotted), dotted).toBeUndefined();
+				}
+
+				// The namespace now reads as the survivor's alone: its keys, in its order.
+				expect(Object.keys(api.plugins)).toEqual(survivorOrder);
+
+				// The namespace's function follows the modules that remain (#533).
+				if (MODULES[survivor].main) {
+					expect(await api.plugins()).toBe(MODULES[survivor].main);
+				} else if (MODULES[creator].main) {
+					expect(typeof api.plugins).toBe("function");
+					await expect(settle(() => api.plugins())).rejects.toThrow(/not a function/);
+				} else {
+					expect(typeof api.plugins).toBe("object");
+				}
+			});
+		});
+	}
+}
+
+describe("invalidateSpeculativeWrappers with a live-kept list (#555)", () => {
+	let api;
+
+	afterEach(async () => {
+		if (api?.shutdown) await api.shutdown();
+		api = null;
+	});
+
+	it("invalidates detached wrappers and plain values' wrappers, but keeps and reports live ones", async () => {
+		api = await slothlet({
+			...getMatrixConfigs()[0].config,
+			base: TEST_DIRS.API_TEST,
+			silent: true,
+			api: { mutations: { add: true, remove: true } }
+		});
+		await api.slothlet.api.add("plugins", MODULES.other.dir, { moduleID: "other" });
+		const slothletInstance = resolveWrapper(api.plugins).slothlet;
+		const UnifiedWrapper = resolveWrapper(api.plugins).constructor;
+		const gamma = api.plugins.gamma;
+		// A wrapper that was never placed in the tree, at a path nothing occupies.
+		const detached = new UnifiedWrapper(slothletInstance, { mode: "eager", apiPath: "nowhere.thing", initialImpl: () => "detached" });
+		const detachedProxy = detached.createProxy();
+		expect(await detachedProxy()).toBe("detached");
+
+		const kept = [];
+		slothletInstance.handlers.apiManager.invalidateSpeculativeWrappers(
+			{ plain: { live: gamma, detached: detachedProxy, value: 1 } },
+			undefined,
+			kept
+		);
+
+		expect(kept).toEqual([gamma]);
+		expect(await api.plugins.gamma()).toBe("other:gamma");
+		expect(() => detachedProxy()).toThrow(/invalidated/);
+	});
+});
diff --git a/types/src/lib/handlers/api-manager.d.mts b/types/src/lib/handlers/api-manager.d.mts
index 7895b81dd..8e2650e55 100644
--- a/types/src/lib/handlers/api-manager.d.mts
+++ b/types/src/lib/handlers/api-manager.d.mts
@@ -225,6 +225,10 @@ export class ApiManager extends ComponentBase {
      * `backgroundMaterialize: true` materialization cannot re-apply the rejected content later.
      * @param {unknown} api - Candidate subtree (or leaf) to walk.
      * @param {WeakSet} [visited] - Cycle guard for the recursive walk.
+     * @param {?Array<object>} [liveKept=null] - When given, a wrapper that is still the live node at its own
+     *   apiPath is left alone (with everything beneath it) and pushed here instead. A removed module's
+     *   captured wrapper can be the very namespace other modules merged their children into, so a removal
+     *   invalidates only what its restore/delete pass actually detached (#555).
      * @returns {void}
      * @private
      *
diff --git a/types/src/lib/handlers/api-manager.d.mts.map b/types/src/lib/handlers/api-manager.d.mts.map
index 6de403451..ceaeeeb9e 100644
--- a/types/src/lib/handlers/api-manager.d.mts.map
+++ b/types/src/lib/handlers/api-manager.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"api-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/api-manager.mjs"],"names":[],"mappings":"AAgFA;;;;;;;;;;;;;;GAcG;AACH;IACC,gCAAuC;IAEvC;;;;;;;;;;;OAWG;IACH,sBAVW,MAAM,EAuBhB;IAXA,sIAAsI;IACtI,OADW;QAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,MAAM,GAAC,IAAI,CAAC;QAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;KAAE,CAUjI;IAGF;;;;;;;;;;;;;;;;;;OAkBG;IACH,yBA+GC;IAED;;;;;;;;;;;;;;OAcG;IACH,oBA4CC;IAED;;;;;;;;;;;;;;OAcG;IACH,0BA4BC;IAED;;;;;;;;;;;;OAYG;IACH,6BAIC;IAED;;;;;;;;;;;;OAYG;IACH,uBASC;IAED;;;;;;;;;;;;;OAaG;IACH,yBAkCC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,iCAbW,MAAM,SACN,OAAO,iBACP,MAAM,GAAC,IAAI,GACT,IAAI,CAqHhB;IAED;;;;;;;;;;;;;OAaG;IACH,uBAEC;IAED;;;;;;;;;;;;;;OAcG;IACH,oBAuWC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,8BAiCC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,sCAmBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,uBAyGC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,uBA6MC;IAED;;;;;;;;;;;;OAYG;IACH,mBAwHC;IACD;;;;;;;;;;;;OAYG;IACH,uBAsEC;IA6CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkDG;IACH,wBAhDG;QAAuB,OAAO,EAAtB,MAAM;QACmD,UAAU,EAAnE,MAAM,GAAC,MAAM,EAAE,cAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;QACf,OAAO;KAChD,GAAU,OAAO,CAAC,MAAM,GAAC,MAAM,EAAE,CAAC,CAs/BpC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,yEATG;QAAqB,QAAQ,EAArB,MAAM;QACO,aAAa,EAA1B,MAAM;QACO,cAAc,EAA3B,MAAM;KACd,GAAU,OAAO,CAAC,IAAI,CAAC,CAgDzB;IA8BD;;;;;;;;;;;OAWG;IACH,mCAeC;IAyKD;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,mCA1BW,MAAM,YAEd;QAAyB,aAAa;QAGZ,aAAa;KACvC,GAAU,OAAO,CAAC,OAAO,CAAC,CA+pB5B;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,2BAdG;QAAwB,OAAO,EAAtB,MAAM,OAAA;QACS,QAAQ,EAAvB,MAAM,OAAA;KACf,GAAU,OAAO,CAAC,IAAI,CAAC,CAuCzB;IAED;;;;;;;;;;;;;OAaG;IACH,0BAkGC;IAED;;;;;;;;;;;;;;OAcG;IACH,yBAuFC;IAED;;;;;;;;;;;;;OAaG;IACH,4BA0FC;IAED;;;;;;;;OAQG;IACH,iCAyDC;IAED;;;;;OAKG;IACH,iCAeC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,yBAwEC;IAED;;;;;;;OAOG;IACH,yBAWC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,0BAyBC;IAED;;;;;;;;;OASG;IACH,+BAiCC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,oCAiDC;IAED;;;;;;;;OAQG;IACH,0BASC;IAED;;;;;;;;;OASG;IACH,kCAoBC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,wBA+TC;;CACD;8BA1sJ6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"api-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/api-manager.mjs"],"names":[],"mappings":"AAgFA;;;;;;;;;;;;;;GAcG;AACH;IACC,gCAAuC;IAEvC;;;;;;;;;;;OAWG;IACH,sBAVW,MAAM,EAuBhB;IAXA,sIAAsI;IACtI,OADW;QAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,MAAM,GAAC,IAAI,CAAC;QAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;KAAE,CAUjI;IAGF;;;;;;;;;;;;;;;;;;OAkBG;IACH,yBA+GC;IAED;;;;;;;;;;;;;;OAcG;IACH,oBA4CC;IAED;;;;;;;;;;;;;;OAcG;IACH,0BA4BC;IAED;;;;;;;;;;;;OAYG;IACH,6BAIC;IAED;;;;;;;;;;;;OAYG;IACH,uBASC;IAED;;;;;;;;;;;;;OAaG;IACH,yBAkCC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,iCAbW,MAAM,SACN,OAAO,iBACP,MAAM,GAAC,IAAI,GACT,IAAI,CAqHhB;IAED;;;;;;;;;;;;;OAaG;IACH,uBAEC;IAED;;;;;;;;;;;;;;OAcG;IACH,oBAuWC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,8BAiCC;IAqBD;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,sCAuBC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,uBAyGC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,uBA6MC;IAED;;;;;;;;;;;;OAYG;IACH,mBAwHC;IACD;;;;;;;;;;;;OAYG;IACH,uBAsEC;IA6CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkDG;IACH,wBAhDG;QAAuB,OAAO,EAAtB,MAAM;QACmD,UAAU,EAAnE,MAAM,GAAC,MAAM,EAAE,cAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;QACf,OAAO;KAChD,GAAU,OAAO,CAAC,MAAM,GAAC,MAAM,EAAE,CAAC,CAs/BpC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,yEATG;QAAqB,QAAQ,EAArB,MAAM;QACO,aAAa,EAA1B,MAAM;QACO,cAAc,EAA3B,MAAM;KACd,GAAU,OAAO,CAAC,IAAI,CAAC,CAgDzB;IA8BD;;;;;;;;;;;OAWG;IACH,mCAeC;IAyKD;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,mCA1BW,MAAM,YAEd;QAAyB,aAAa;QAGZ,aAAa;KACvC,GAAU,OAAO,CAAC,OAAO,CAAC,CAoqB5B;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,2BAdG;QAAwB,OAAO,EAAtB,MAAM,OAAA;QACS,QAAQ,EAAvB,MAAM,OAAA;KACf,GAAU,OAAO,CAAC,IAAI,CAAC,CAuCzB;IAED;;;;;;;;;;;;;OAaG;IACH,0BAkGC;IAED;;;;;;;;;;;;;;OAcG;IACH,yBAuFC;IAED;;;;;;;;;;;;;OAaG;IACH,4BA0FC;IAED;;;;;;;;OAQG;IACH,iCAyDC;IAED;;;;;OAKG;IACH,iCAeC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,yBAwEC;IAED;;;;;;;OAOG;IACH,yBAWC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,0BAyBC;IAED;;;;;;;;;OASG;IACH,+BAiCC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,oCAiDC;IAED;;;;;;;;OAQG;IACH,0BASC;IAED;;;;;;;;;OASG;IACH,kCAoBC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,wBA+TC;;CACD;8BA1uJ6B,2BAA2B"}
\ No newline at end of file
diff --git a/types/src/lib/handlers/routine-manager.d.mts b/types/src/lib/handlers/routine-manager.d.mts
index 55a888142..47570063e 100644
--- a/types/src/lib/handlers/routine-manager.d.mts
+++ b/types/src/lib/handlers/routine-manager.d.mts
@@ -142,7 +142,8 @@ export class RoutineManager extends ComponentBase {
      * Prune every raw-captured contribution belonging to a module, regardless of whether it was
      * ever the live property at its own path.
      * @param {string} moduleID - Module identifier being fully removed.
-     * @returns {void}
+     * @returns {Array<object>} The captured wrappers still live in the api tree, left un-invalidated for the
+     *   caller to invalidate once its removal has detached them (#555).
      * @public
      *
      * @description
@@ -161,7 +162,7 @@ export class RoutineManager extends ComponentBase {
      * ownership.unregister(moduleID);
      * routineManager.pruneModule(moduleID);
      */
-    public pruneModule(moduleID: string): void;
+    public pruneModule(moduleID: string): Array<object>;
     /**
      * Snapshot the raw contributions moduleID currently has, keyed by apiPath, for later restoration
      * @param {string} moduleID - Module identifier to snapshot.
diff --git a/types/src/lib/handlers/routine-manager.d.mts.map b/types/src/lib/handlers/routine-manager.d.mts.map
index edcf3370b..2f596e899 100644
--- a/types/src/lib/handlers/routine-manager.d.mts.map
+++ b/types/src/lib/handlers/routine-manager.d.mts.map
@@ -1 +1 @@
-{"version":3,"file":"routine-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/routine-manager.mjs"],"names":[],"mappings":"AAqDA;;;;;;;;;;;;;;;;;;GAkBG;AACH;IACC,gCAA2C;IAE3C;;;OAGG;IACH,sBAFW,MAAM,EA4DhB;IAvDA;;;;;;OAMG;IACH,KAFU,KAAK,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,EAAE,WAAU;KAAC,CAAC,CAErD;IAEb;;;;;;;;;;;;OAYG;IACH,aAFU,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAEd;IAE5B;;;;;;;OAOG;IACH,WAFU,OAAO,CAEI;IAErB;;;;OAIG;IACH,cAFU,GAAG,CAAC,MAAM,EAAE,CAAS,IAAM,EAAN,MAAM,KAAG,OAAO,CAAC,CAEnB;IAE7B;;;;;;OAMG;IACH,gBAFU,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAEJ;IAE/B;;;OAGG;IACH,eAFU,GAAG,CAAC,OAAO,CAAC,GAAC,IAAI,CAEF;IAG1B;;;;;;OAMG;IACH,gBAHa,IAAI,CAOhB;IAwMD;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,2BAJW,MAAM,GACJ,IAAI,CAgFhB;IAgLD;;;;;OAKG;IACH,2BAJW,MAAM,GACJ,IAAI,CAShB;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,6BAhBW,MAAM,YACN,MAAM,GACJ,IAAI,CAyBhB;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,6BApBW,MAAM,GACJ,IAAI,CAkChB;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,oCAlBW,MAAM,GACJ,GAAG,CAAC,MAAM,EAAE;QAAC,EAAE,WAAW;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,GAAC,SAAS,CAAA;KAAC,CAAC,CAwBjF;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,iCAvBW,MAAM,YACN,MAAM,GACJ;QAAC,EAAE,WAAW;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,GAAC,SAAS,CAAA;KAAC,GAAC,SAAS,CAyB9E;IAED;;;;;;;;;;;;;;;OAeG;IACH,+BAZW,MAAM,YACN,MAAM,cACN;QAAC,EAAE,WAAW;QAAC,KAAK,EAAE,MAAM,CAAA;KAAC,GAAC,SAAS,GAIrC,IAAI,CA4BhB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,qCA5BW,MAAM,YACN,MAAM,QACN,MAAM,gBACN,GAAG,CAAC,MAAM,WAAW,2BAInB,IAAI,CA2EhB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,wCAlCW,MAAM,gBACN,GAAG,CAAC,MAAM,WAAW,GAEnB,IAAI,CA8DhB;IAgHD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,wBAhBW,MAAM,0BAEN,MAAM,GAOJ,OAAO,CAAC,GAAC,CAAC,CAgBtB;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,2BAVW,MAAM,OACN,MAAM,0BAEN,MAAM,GAEJ,OAAO,CAAC,GAAC,CAAC,CAiCtB;IAED;;;;;;;;;;;OAWG;IACH,+BANW,MAAM,YACN,MAAM,GAEJ,MAAM,EAAE,CAOpB;IA8QD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,wBAjBW,MAAM,kCAIN,OAAO,GAML,OAAO,CAAC,GAAC,CAAC,CA8BtB;IAkCD;;;;;;;;;;;;;;;OAeG;IACH,0BAdW,SAAS,GAAC,UAAU,GAAC,SAAS,SAC9B,OAAO,GACL,OAAO,CAkBnB;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,kCAHa,OAAO,CAAC,IAAI,CAAC,CAKzB;IAED;;;;;;;;;;;;;OAaG;IACH,iCAHa,OAAO,CAAC,IAAI,CAAC,CAKzB;IAED;;;;;;;;;;OAUG;IACH,iCAHa,OAAO,CAAC,IAAI,CAAC,CAKzB;IA8HD;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,0BAJW,MAAM,GACJ,OAAO,CAAC,IAAI,CAAC,CAkDzB;;CACD;8BA1vD6B,2BAA2B"}
\ No newline at end of file
+{"version":3,"file":"routine-manager.d.mts","sourceRoot":"","sources":["../../../../src/lib/handlers/routine-manager.mjs"],"names":[],"mappings":"AAqDA;;;;;;;;;;;;;;;;;;GAkBG;AACH;IACC,gCAA2C;IAE3C;;;OAGG;IACH,sBAFW,MAAM,EA4DhB;IAvDA;;;;;;OAMG;IACH,KAFU,KAAK,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,EAAE,WAAU;KAAC,CAAC,CAErD;IAEb;;;;;;;;;;;;OAYG;IACH,aAFU,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAEd;IAE5B;;;;;;;OAOG;IACH,WAFU,OAAO,CAEI;IAErB;;;;OAIG;IACH,cAFU,GAAG,CAAC,MAAM,EAAE,CAAS,IAAM,EAAN,MAAM,KAAG,OAAO,CAAC,CAEnB;IAE7B;;;;;;OAMG;IACH,gBAFU,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAEJ;IAE/B;;;OAGG;IACH,eAFU,GAAG,CAAC,OAAO,CAAC,GAAC,IAAI,CAEF;IAG1B;;;;;;OAMG;IACH,gBAHa,IAAI,CAOhB;IAwMD;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,2BAJW,MAAM,GACJ,IAAI,CAgFhB;IAgLD;;;;;OAKG;IACH,2BAJW,MAAM,GACJ,IAAI,CAShB;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,6BAhBW,MAAM,YACN,MAAM,GACJ,IAAI,CAyBhB;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,6BArBW,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAwCzB;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,oCAlBW,MAAM,GACJ,GAAG,CAAC,MAAM,EAAE;QAAC,EAAE,WAAW;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,GAAC,SAAS,CAAA;KAAC,CAAC,CAwBjF;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,iCAvBW,MAAM,YACN,MAAM,GACJ;QAAC,EAAE,WAAW;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,GAAC,SAAS,CAAA;KAAC,GAAC,SAAS,CAyB9E;IAED;;;;;;;;;;;;;;;OAeG;IACH,+BAZW,MAAM,YACN,MAAM,cACN;QAAC,EAAE,WAAW;QAAC,KAAK,EAAE,MAAM,CAAA;KAAC,GAAC,SAAS,GAIrC,IAAI,CA4BhB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,qCA5BW,MAAM,YACN,MAAM,QACN,MAAM,gBACN,GAAG,CAAC,MAAM,WAAW,2BAInB,IAAI,CA2EhB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,wCAlCW,MAAM,gBACN,GAAG,CAAC,MAAM,WAAW,GAEnB,IAAI,CA8DhB;IAgHD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,wBAhBW,MAAM,0BAEN,MAAM,GAOJ,OAAO,CAAC,GAAC,CAAC,CAgBtB;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,2BAVW,MAAM,OACN,MAAM,0BAEN,MAAM,GAEJ,OAAO,CAAC,GAAC,CAAC,CAiCtB;IAED;;;;;;;;;;;OAWG;IACH,+BANW,MAAM,YACN,MAAM,GAEJ,MAAM,EAAE,CAOpB;IA8QD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,wBAjBW,MAAM,kCAIN,OAAO,GAML,OAAO,CAAC,GAAC,CAAC,CA8BtB;IAkCD;;;;;;;;;;;;;;;OAeG;IACH,0BAdW,SAAS,GAAC,UAAU,GAAC,SAAS,SAC9B,OAAO,GACL,OAAO,CAkBnB;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,kCAHa,OAAO,CAAC,IAAI,CAAC,CAKzB;IAED;;;;;;;;;;;;;OAaG;IACH,iCAHa,OAAO,CAAC,IAAI,CAAC,CAKzB;IAED;;;;;;;;;;OAUG;IACH,iCAHa,OAAO,CAAC,IAAI,CAAC,CAKzB;IA8HD;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,0BAJW,MAAM,GACJ,OAAO,CAAC,IAAI,CAAC,CAkDzB;;CACD;8BAhwD6B,2BAA2B"}
\ No newline at end of file

From 59ed33ec2c72cdab7dc947d920f708c41faa0d15 Mon Sep 17 00:00:00 2001
From: Shinrai <Shinrai@users.noreply.github.com>
Date: Fri, 2 Oct 2026 14:02:45 -0700
Subject: [PATCH 49/49] docs: v3.22.0 changelog and README What's New

---
 README.md                    |  12 +-
 docs/changelog/v3/v3.22.0.md | 251 +++++++++++++++++++++++++++++++++++
 2 files changed, 258 insertions(+), 5 deletions(-)
 create mode 100644 docs/changelog/v3/v3.22.0.md

diff --git a/README.md b/README.md
index ed1f19549..1d3b90915 100644
--- a/README.md
+++ b/README.md
@@ -43,18 +43,20 @@ Every feature has been hardened with a comprehensive test suite - over **5,300 t
 
 ## ✨ What's New
 
-### Latest: v3.21.0 (September 2026)
+### Latest: v3.22.0 (October 2026)
 
-- **Principals for permission conditions** — a principal is a named, module-owned async resolver that turns a caller identity into authorization facts (a user's per-project roles, an org's plan). Slothlet resolves it lazily, caches it per identity, and hands it read-only to the synchronous conditions of rules that declare `requires: ["roles"]` → `condition(ctx, { args, target, principals })`. Unavailable or stale principals fail closed; only a call that needs a stale principal waits for it (#459).
-- **No base directory required, plus fixes** — an instance (node or browser) can start with no `base` and be built entirely through `api.slothlet.api.add()` (#471). `slothlet.metadata.caller()` / `.self()` are allowed by default under `defaultPolicy: "deny"` (#468). Exports named `name` / `length` / … now resolve to the export and are read-gated (#475), and lazy `api.add()` resolves with its mount fully built (#462).
-- [View full v3.21.0 Changelog](https://github.com/CLDMV/slothlet/blob/master/docs/changelog/v3/v3.21.0.md)
+- **Requires Node.js 22.15+; restart, around hooks and per-instance helpers** — the minimum Node.js version rises to `22.15.0`, because helpers a leaf imports through relative or `file:` specifiers are now one copy per instance, across ESM and CommonJS, using the in-thread `module.registerHooks()` hook (#518, #534, #521). `api.slothlet.restart()` rebuilds an instance from its original config behind the same `api` reference (#504), a new `around` hook wraps the whole call pipeline (#496), and `event.strategy` / `event.deliver` let a host defer or retry event delivery, for example until a transaction commits (#497). Typegen now types the composed `api`, `self` and `slothlet()` from each leaf's own source (#484).
+- **Permissions and upgrade notes** — adds `permissions.owner`, `lockCaller.caller` and `permissions.global.checkCall` (#509, #477, #508), and with a permissions config `slothlet.reload` / `shutdown` / `restart` and the default routines' root paths are now host-only (#529); with `routines: []`, add your own deny rules for `shutdown` and `destroy`. Live-runtime caller attribution is fixed, so hosts using `defaultPolicy: "deny"` there should re-check their grants (#512). Strict mode throws a clear error on TypeScript 7, so stay on TypeScript 6 (#510), and TypeScript source maps turn on automatically in coverage runs (#484, #486). Also fixes a set of reload, remove and ownership bugs (#524, #525, #530, #531, #533, #542, #543, #555).
+- [View full v3.22.0 Changelog](https://github.com/CLDMV/slothlet/blob/master/docs/changelog/v3/v3.22.0.md)
 
 ### Recent Releases
 
+- **v3.21.0** (September 2026) — principals for permission conditions: named, module-owned async resolvers whose cached, read-only facts reach the sync conditions of rules that declare `requires`; plus instances with no base directory and `metadata.caller()` / `.self()` allowed by default (#459, #471, #468) ([Changelog](https://github.com/CLDMV/slothlet/blob/master/docs/changelog/v3/v3.21.0.md))
 - **v3.20.0** (September 2026) — permission-rule function conditions receive a second argument, `condition(ctx, { args, target })`, carrying the call's own arguments and the concrete target path, so a rule can authorize on the resource named in the call itself; additive and backward-compatible (#455) ([Changelog](https://github.com/CLDMV/slothlet/blob/master/docs/changelog/v3/v3.20.0.md))
 - **v3.19.0** (September 2026) — new `impl:collision` lifecycle event carrying both writers and how a compose-time collision resolved (`dropped` / `replaced` / `merged`), surfacing dropped or shadowed leaves that `impl:created` structurally cannot; plus two ES Proxy `getOwnPropertyDescriptor` invariant fixes for routine selectors and virtual properties read through the composed wrapper (#441, #443, #446) ([Changelog](https://github.com/CLDMV/slothlet/blob/master/docs/changelog/v3/v3.19.0.md))
 - **v3.18.2** (September 2026) — CI / release-automation only (no runtime change): the persistent next→master release PR now re-evaluates via `workflow_run` on `ci.yml` instead of `check_suite: completed`, which GitHub never delivers for an Actions-authored check suite — so a green, approved release converges to a merge instead of stalling (#439) ([Changelog](https://github.com/CLDMV/slothlet/blob/master/docs/changelog/v3/v3.18.2.md))
-- **v3.18.1** (September 2026) — `api.slothlet.caller()` and event delivery no longer leak a **foreign instance's** caller across the process-shared async context, so a **same-process** forwarding layer — two slothlet instances in one process, such as [`@cldmv/slothlet-vine`](https://github.com/CLDMV/slothlet-vine) over its loopback transport — receives its forwarded events again; both accessors now scope their identity read to the querying instance (#436) ([Changelog](https://github.com/CLDMV/slothlet/blob/master/docs/changelog/v3/v3.18.1.md)) 📚 **For complete version history and detailed release notes, see [docs/changelog/](https://github.com/CLDMV/slothlet/tree/master/docs/changelog/) folder.**
+
+📚 **For complete version history and detailed release notes, see [docs/changelog/](https://github.com/CLDMV/slothlet/tree/master/docs/changelog/) folder.**
 
 ---
 
diff --git a/docs/changelog/v3/v3.22.0.md b/docs/changelog/v3/v3.22.0.md
new file mode 100644
index 000000000..9ae119791
--- /dev/null
+++ b/docs/changelog/v3/v3.22.0.md
@@ -0,0 +1,251 @@
+# Slothlet v3.22.0 Changelog
+
+**Release Date**: October 2026
+**Release Type**: Minor
+**Branch**: `release/3.22.0`
+
+---
+
+## Overview
+
+Version 3.22.0 is a large release. It adds **`api.slothlet.restart()`**, a clean-slate rebuild of an instance from its original config behind the same `api` reference, and an **`around` hook** type that wraps the whole call pipeline. It also lets a host take over **event delivery** (`event.strategy` / `event.deliver`), for example to deliver events only after a transaction commits. On the permission side it adds **`permissions.owner`**, **`slothlet.lockCaller.caller`** and **`permissions.global.checkCall`**. **Typegen** now types the composed `api`, `self` and `slothlet()` from each node's real module origin, so an imported `self` and an awaited `slothlet()` are typed with no annotation.
+
+Every module a leaf imports through a relative or `file:` specifier is now **per instance**, across `.mjs`, `.ts`, `.cjs` and CommonJS `.js` leaves and across ESM/CommonJS boundaries. This uses the in-thread `module.registerHooks()` resolve hook, so **the minimum Node.js version rises from `22.12.0` to `22.15.0`**.
+
+The release also fixes caller attribution in the live runtime, makes the framework's lifecycle methods host-only under a permissions config, and fixes a long list of reload, remove and ownership bugs around `forceOverwrite` and co-mounted modules. Read **Requirement and behavior changes** and the upgrade notes at the end before upgrading.
+
+---
+
+## ⚠️ Requirement and behavior changes
+
+### Node.js `>=22.15.0` is now required (#518)
+
+`engines.node` rises from `>=22.12.0` to `>=22.15.0`. Per-instance helper isolation (see [Helper modules are per instance](#helper-modules-are-per-instance-518-534)) is built on `module.registerHooks()`, the synchronous in-thread resolve hook added in Node 22.15 / 23.5. The off-thread `module.register()` was deliberately not used: it puts a cross-thread round trip on every import in the process and changes evaluation timing enough to break a leaf that starts a fire-and-forget runtime import. Changed in [#537](https://github.com/CLDMV/slothlet/pull/537).
+
+**Upgrade:** move to Node 22.15 or later (any Node 24 or 26 release qualifies). On older Node versions npm reports `EBADENGINE` and helper isolation cannot be installed.
+
+### Live-runtime caller attribution is now correct (#512)
+
+With `runtime: "live"`, the caller was resolved from the call stack whenever two or more module calls were suspended, and frames were matched only by the exact file a suspended call had entered through. V8's async stack traces also carry the frames of the outer suspended calls, so:
+
+- a module entered synchronously (a nested leaf, or a `lockCaller`-pinned callback) whose own file was not a suspended call's was attributed to the outer suspended caller further down the stack;
+- a suspended call resuming in a sibling file of its module fell through to the outer suspended caller the same way;
+- the fallback read a shared field that is restored in settle order, not entry order, so a resumed module could be handed the rights of a caller that had already finished.
+
+The caller is now resolved from what is actually in flight: the call whose function body is on the JS stack right now; otherwise the baseline caller when nothing is in flight; otherwise the single suspended call; and with two or more suspended calls, the stack frames matched by location against each candidate's entry file or module root folder. A frame that matches several candidates ambiguously fails closed. A call pinned to the host with `lockCaller.caller()` now runs as the host on the running-call stack instead of being attributed to the module that invoked it. Fixed in [#519](https://github.com/CLDMV/slothlet/pull/519); the rule and its limits are documented under **Overlapping calls** in [docs/PERMISSIONS.md](../../PERMISSIONS.md).
+
+**Upgrade:** hosts on the live runtime with `defaultPolicy: "deny"` should re-check their permission grants. Calls that were previously misattributed, typically to an outer boot or host-chain caller with broader rights, are now attributed to the module that actually made them, so a grant that only worked because of the misattribution now denies. The async runtime is unaffected.
+
+### New built-in denies when a permissions config is present (#529, #504, #477, #508)
+
+Reloading, restarting or shutting down the instance is a host decision, so new built-in rules deny it to modules:
+
+| Built-in deny target                                                               | Applies                                                                                                                                      |
+| ---------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
+| `slothlet.reload`, `slothlet.shutdown`                                             | always                                                                                                                                       |
+| `slothlet.restart`                                                                 | always                                                                                                                                       |
+| `initialize` (root `api.initialize()` cascade), `shutdown` (root `api.shutdown()`) | only while the matching default routine (`initialize` / `startup`, `shutdown` / `shutdown`) is in the instance's effective `routines` config |
+| `slothlet.lockCaller.caller`                                                       | always                                                                                                                                       |
+| `slothlet.permissions.global.checkCall`                                            | always                                                                                                                                       |
+
+The root `api.shutdown()`, `api.destroy()` and routine cascades now check their own path at entry, so ordinary rules on `shutdown`, `destroy` or a routine name apply to them. Framework-internal teardown runs as the host, so a permitted caller is never refused halfway. As with every built-in rule, these apply only when the instance has a `permissions` config, and an instance rule on the same exact target re-opens one for a trusted module. The new `event.strategy` / `event.deliver` surfaces are host-only through the existing `slothlet.event.**` deny. Changed in [#544](https://github.com/CLDMV/slothlet/pull/544), [#545](https://github.com/CLDMV/slothlet/pull/545), [#516](https://github.com/CLDMV/slothlet/pull/516) and [#513](https://github.com/CLDMV/slothlet/pull/513).
+
+> **Caveat:** removing the default routines (for example `routines: []`) removes the built-in rules on their root paths, but the top-level `api.shutdown()` / `api.destroy()` still tear the instance down. A host that removes the defaults and wants modules kept away from teardown must add its own rules:
+>
+> ```javascript
+> { caller: "**", target: "shutdown", effect: "deny" }
+> { caller: "**", target: "destroy",  effect: "deny" }
+> ```
+
+**Upgrade:** a module that legitimately calls `self.slothlet.reload()`, `restart()`, `shutdown()`, the root `shutdown()` / `initialize()`, `lockCaller.caller()` or `permissions.global.checkCall()` needs an exact-target allow rule from the host, for example `{ caller: "admin.**", target: "slothlet.reload", effect: "allow" }`.
+
+### TypeScript 7: strict mode fails with a clear error (#510)
+
+TypeScript 7's current npm release exposes no compiler API (it lives under unstable paths until 7.1). Strict mode crashed with `Cannot read properties of undefined (reading 'ES3')`; it now throws `TYPESCRIPT_STRICT_REQUIRES_TS6`, naming the installed version and pointing at `typescript@6`, before any strict-mode code runs. The peer range (`^6.0.3 || ^7.0.0`) is unchanged so TypeScript 7 projects that don't use strict mode still install cleanly. Fast mode (esbuild) and `slothlet typegen` don't use the compiler API and work on TypeScript 7. Fixed in [#532](https://github.com/CLDMV/slothlet/pull/532).
+
+**Upgrade:** stay on `typescript@6` if you use `typescript: { mode: "strict" }`.
+
+### Other behavior changes
+
+- **Event-rule conditions see the user context (#511).** An event rule's condition received the whole async-context store, while a call rule's condition receives the user context from `context.run()`, so the same condition behaved differently on the two rule types. Both now receive the user context, and principal key resolvers on event rules see it too. A condition that worked around the bug by reading `ctx.context.*` must read `ctx.*`. Fixed in [#514](https://github.com/CLDMV/slothlet/pull/514).
+- **Helpers are no longer shared across instances (#518, #534).** Module-level state in a relative helper used to be one copy per process; it is now one copy per instance. Code that relied on two instances sharing a helper's state should move that state into a package (bare specifiers stay shared) or pass it in through `reference`.
+- **TypeScript source maps default on during coverage runs (#484, #486).** When `typescript.sourcemap` is not set, source maps are now on exactly during a coverage run; see **TypeScript coverage works out of the box** under Bug Fixes.
+- **Function impls no longer expose non-enumerable own properties as api children.** On Node 22, every sloppy-mode (CommonJS) function carries own non-enumerable `arguments` and `caller`, so a `module.exports = function` leaf reported `Object.keys(api.x)` as `["arguments", "caller"]`, and typegen emitted them as `unknown` members. Only a function's own enumerable properties are children now; the values stay readable. Fixed in [#498](https://github.com/CLDMV/slothlet/pull/498).
+
+---
+
+## ✨ Features
+
+### `api.slothlet.restart()` — a clean-slate rebuild behind the same `api` (#504)
+
+`reload()` deliberately keeps runtime state. `restart()` is the opposite: it tears the instance down through the normal teardown path and builds a new one from the original `slothlet({...})` config, swapped in behind the same `api` proxy.
+
+```javascript
+const api = await slothlet({ base: "./api" });
+
+api.conn.handlers = { onSend }; // runtime assignment
+await api.slothlet.api.add("plugins", "./plugins");
+
+await api.slothlet.restart(); // both gone; the instance is back to its original config
+```
+
+- **Original config:** the config passed to `slothlet()` is snapshotted at creation. Plain objects and arrays are copied and frozen, `reference` and `context` are kept by identity, and a relative `base` stays resolved against the creating call.
+- **Nothing runtime carries over:** `add()` / `remove()` history, runtime hooks, permission and event rules, principals, event and lifecycle subscriptions, metadata, runtime assignments and module-scope state are dropped; config-declared settings are re-applied. The new instance is not sealed, even after `control.seal()`.
+- **Held references are re-pointed:** after the swap, `const conn = api.conn` forwards every operation to the node at the same path in the new instance. A path that no longer exists throws `RESTART_REFERENCE_UNRESOLVED`.
+- **Lifecycle:** `restart` (old instance) → `shutdown` (old) → `init` (new) → `restarted` (new). `shutdown` now fires on every teardown and `init` on the cold start. Handlers in the `lifecycle` config option receive all four; runtime subscribers go with the old instance.
+- **Concurrency:** concurrent `restart()` calls share one restart, and calls already in flight finish on the old implementation. Gated by `api.mutations.reload`, and host-only under a permissions config.
+
+Implemented in [#545](https://github.com/CLDMV/slothlet/pull/545). See [docs/RELOAD.md → `api.slothlet.restart()`](../../RELOAD.md#apislothletrestart) and [docs/LIFECYCLE.md → Instance Events](../../LIFECYCLE.md#instance-events).
+
+### `around` hooks (#496)
+
+A fifth hook type wraps the rest of the call pipeline:
+
+```javascript
+api.slothlet.hook.on("db.**:around", async ({ path, args, next, caller, entry }) => {
+	const started = Date.now();
+	try {
+		return await next(args); // remaining around hooks → before → function → after
+	} finally {
+		metrics.record(path, Date.now() - started);
+	}
+});
+```
+
+- `next(args?)` runs the remaining (lower-priority) around hooks, then the before hooks, the function and the after hooks, and returns the result or throws. With no argument it forwards the current args. A handler that never calls `next` short-circuits, and its return value is the result. Calling `next` twice throws `HOOK_AROUND_NEXT_CALLED_TWICE`.
+- Order, outermost first: `always` / `error` observers → around hooks (highest priority outermost) → `before` → function → `after`. `error` hooks and `suppressErrors` apply only to what escapes the around chain; an error an around throws itself carries the new `around` source type.
+- `entry` is `true` when the call has no module caller in the active flow, and `caller` is that caller's metadata.
+- A synchronous around keeps a synchronous call synchronous; an async one promotes it, as with before/after hooks.
+- Around hooks are permission-gated like before hooks, and are pinned when registered from a module. A pinned around's `next()` re-enters the intercepted call's own flow, so the target still sees its real caller.
+
+Implemented in [#517](https://github.com/CLDMV/slothlet/pull/517). See [docs/HOOKS.md](../../HOOKS.md).
+
+### Host-controlled event delivery — `event.strategy` / `event.deliver` (#497)
+
+A host that wraps work in a transaction can deliver events emitted inside it only if the transaction commits, each listener as its own retried unit of work, without editing the modules that emit.
+
+```javascript
+const pending = [];
+
+api.slothlet.event.strategy((envelope, listeners, defaultDeliver) => {
+	if (!inTransaction()) return defaultDeliver(); // deliver now
+	pending.push({ envelope, listeners }); // defer; emit resolves once this returns
+});
+
+// On commit:
+for (const { envelope, listeners } of pending.splice(0)) {
+	for (const id of listeners) await retry(() => api.slothlet.event.deliver(envelope, id));
+}
+```
+
+- `strategy(fn)` is called per emit as `fn(envelope, listeners, defaultDeliver)`. The frozen envelope carries the event, payload, emitter and each recipient's emit-time level. `strategy(null)` clears it; it survives a full reload.
+- `deliver(envelope, listenerId)` delivers a held envelope to one listener, so a retry never re-runs listeners that already succeeded. It resolves `{ delivered: true, level }` or `{ delivered: false, reason: "listener-gone" | "denied" }`, and rejects with the listener's own error. Rules and levels are enforced at delivery time, inside the flow captured at emit.
+- `on()` / `once()` now also return a stable listener **`id`** (`<owner moduleID>:<event>:<n>`, or an explicit `{ key }` in place of `n`), which survives reloads once the module re-registers.
+
+Both surfaces are host-only. Implemented in [#535](https://github.com/CLDMV/slothlet/pull/535). See [docs/EVENTS.md](../../EVENTS.md).
+
+### `permissions.owner` — a module reaches every leaf it owns (#509)
+
+Under `defaultPolicy: "deny"`, a module added with one `api.add(path, folder, { moduleID })` couldn't call or read its own leaves across subdirectories, because each subdirectory is its own permission module. `permissions: { owner: true }` (default `false`) adds an implicit allow that stands in for the default policy: when no rule decided, a caller may access a target whose current owner is the caller's own current owner. Matching is by owner, not path, so another module merged into the same namespace gets nothing; an explicit deny still wins; and ownership changes from add, remove and reload are followed live. The reserved roots (`slothlet.*`, `shutdown`, `destroy`) are never granted. Granted accesses emit `permission:owner-allow` under `audit: "verbose"`. Implemented in [#528](https://github.com/CLDMV/slothlet/pull/528). See **Owner Grant** in [docs/PERMISSIONS.md](../../PERMISSIONS.md#owner-grant).
+
+### `slothlet.lockCaller.caller(fn)` — pin your caller onto a callback (#477)
+
+`lockCaller(fn)` pins the leaf that calls it, so a service that accepts a callback on behalf of its caller (a scheduler's `every()`, a registry) could only pin itself. `self.slothlet.lockCaller.caller(fn)` pins the current leaf's **caller**: the identity `metadata.caller()` reports. When the leaf was called from outside any module, the callback runs as the host. Acting as your caller is a privilege, so the path has a built-in deny for every module; the host grants it, for example `{ caller: "scheduler.**", target: "slothlet.lockCaller.caller", effect: "allow" }`. Implemented in [#516](https://github.com/CLDMV/slothlet/pull/516). See [docs/HOOKS.md](../../HOOKS.md).
+
+### `permissions.global.checkCall(caller, target, args)` (#508)
+
+`global.checkAccess` is a silent query: it passes no call metadata to conditions, never resolves a stale principal, emits no audit event, and treats a caller with no source file as the host. A trusted boundary layer that forwards a remote call (such as `@cldmv/slothlet-vine`) needs the answer the call gate would give. `api.slothlet.permissions.global.checkCall(callerPath, targetPath, args)` forwards `{ args, target }` to function conditions, resolves stale `requires` principals (returning a Promise only on that path), treats the caller as a module (no self-call bypass, `_`-private targets denied), and emits the gate's audit events with `via: "checkCall"`. It is host-only by default. Implemented in [#513](https://github.com/CLDMV/slothlet/pull/513). See [docs/PERMISSIONS.md](../../PERMISSIONS.md).
+
+### Typed composed `api`, `self` and `slothlet()` via typegen (#484)
+
+Typegen used to guess each node's type by matching the last path segment against a file's ESM export syntax, so CommonJS leaves, default exports, flattened and hoisted members, object-leaf methods and non-function values came out as `any` or went missing. The builder now records each node's module origin (`exportPath` next to `filePath` in the ownership registry, readable through `ownership.getOrigin(apiPath)`), in eager mode, lazy materialization, reload and `api.add()` mounts alike. The type generator emits `typeof import("<leaf>")[...]` for every member, so each leaf is typed from its own source whatever the format (`.mjs` JSDoc, `.cjs`, `.ts` / `.mts`). Typegen no longer needs the `typescript` package.
+
+`@cldmv/slothlet/runtime` exports a `SlothletSelf` type anchor and types `self` as it; the generated declaration extends it, and `slothlet()` is `<T = SlothletSelf>(...) => Promise<SlothletAPI & T>`. An imported `self` and an awaited `slothlet()` are both typed with no annotation. `augmentRuntime: false` (`--no-augment-runtime`) opts out for programs that load more than one api. Implemented in [#498](https://github.com/CLDMV/slothlet/pull/498). See [docs/TYPESCRIPT.md](../../TYPESCRIPT.md#generating-types-on-demand-slothlet-typegen).
+
+### Helper modules are per instance (#518, #534)
+
+A module a leaf imports through a relative or `file:` specifier, at any depth, is now evaluated once per slothlet instance instead of once per process, for `.mjs` / `.js`, `.ts` / `.mts` and `.cjs` leaves. Base leaves and every `api.add()` mount of an instance share that instance's copy. A full reload (or a restart) gives the instance fresh helpers; a partial reload keeps the existing copy. Bare specifiers (packages, `node:` builtins, `#imports`, `@cldmv/slothlet` itself) stay shared.
+
+Isolation also holds where the module systems meet: an ES module leaf importing a `.cjs` helper gets the helper through the instance's own CommonJS cache, and a relative `require()` of an ES module from a CommonJS leaf returns the instance's copy with Node's `require(esm)` shape. Under vitest, when leaves load through vite's module graph, add the `slothletInstanceImports()` plugin from `@cldmv/slothlet/helpers/instance-imports`. Implemented in [#537](https://github.com/CLDMV/slothlet/pull/537) and [#551](https://github.com/CLDMV/slothlet/pull/551). See [docs/MODULE-STRUCTURE.md → Helper Modules Are Per Instance](../../MODULE-STRUCTURE.md#helper-modules-are-per-instance) and [docs/TESTING.md](../../TESTING.md#per-instance-helpers-under-vitest-slothletinstanceimports).
+
+---
+
+## 🐛 Bug Fixes
+
+### Loading and TypeScript
+
+- **CommonJS `.js` leaves are isolated per instance (#521).** A `.js` file Node treats as CommonJS went through `import()` with an instance query that Node's path-keyed CommonJS cache ignores, so two instances shared one module scope. The loader now classifies `.js` leaves the way Node does (nearest `package.json` `type`, then syntax detection) and routes CommonJS ones through the per-instance CommonJS loader ([#523](https://github.com/CLDMV/slothlet/pull/523)).
+- **TypeScript coverage works out of the box (#484, #486).** A TypeScript leaf executes from its `.slothlet-cache` copy, so coverage reaches the `.ts` source only through the copy's inline source map. `typescript.sourcemap` is now tri-state: an explicit boolean wins, and when unset, source maps are on exactly during a coverage run (vitest coverage, or any process with `NODE_V8_COVERAGE` set). A coverage run with `sourcemap: false` warns once with `WARNING_COVERAGE_TS_SOURCEMAP_OFF`. [docs/TESTING.md](../../TESTING.md#typescript-leaves) gains a TypeScript section, including adding `**/.slothlet-cache/**` to `coverage.include` ([#527](https://github.com/CLDMV/slothlet/pull/527)).
+- **`module`, `strict`, `compilerOptions` and `sourcemap` TypeScript options are honoured (#499).** Normalization dropped the first three, so strict mode always used fixed defaults, and `sourcemap` had no effect in either mode. They are now carried through and validated (`INVALID_CONFIG` on a bad value); `compilerOptions` takes the `tsconfig.json` form, and both modes emit an inline source map pointing at the leaf's absolute path ([#515](https://github.com/CLDMV/slothlet/pull/515)).
+- **Strict mode's type-generation worker ships in the package (#500).** The worker lived under `tools/` and imported `src/`, neither of which is published, so strict mode failed with `MODULE_NOT_FOUND` from an npm install. It now ships as `dist/lib/processors/type-generation-worker.mjs` ([#502](https://github.com/CLDMV/slothlet/pull/502)).
+
+### Reload, remove and ownership
+
+- **A scoped reload keeps co-mounted modules' contributions (#525).** Reloading one module handed the shared namespace only that module's fresh impl in `replace` mode, clearing every child another module had added at the same path. Children are now split by contributor at every depth: other modules' children are reattached unchanged, shared subfolders are rebuilt one level down, and ownership stacks are restored afterwards so a later remove still reverts correctly. A lazy add that collides with an existing namespace under `merge` / `merge-replace` now merges that folder's children too ([#549](https://github.com/CLDMV/slothlet/pull/549)).
+- **A scoped reload keeps a `replace` / `forceOverwrite` add's outcome (#530).** After `add("launcher.session", dir, { moduleID: "shadow", forceOverwrite: true })`, `reload("launcher")` put launcher's shadowed members back under `launcher.session` while ownership still named `shadow`. The overwritten subtree now stays as the add left it, and the shadowed members are refreshed with the reloaded code so a later remove restores current code ([#550](https://github.com/CLDMV/slothlet/pull/550)).
+- **`forceOverwrite` adds own the paths they overwrite (#524).** The ownership registry kept the overwritten module as current owner, and eager and lazy mode disagreed on which paths were affected. The add's collision mode is now recorded per module and endpoint, and a `replace` / `merge-replace` add claims every path it provides ([#536](https://github.com/CLDMV/slothlet/pull/536)).
+- **Removing an overwriting module restores the overwritten namespace in place (#531).** In lazy mode, removing a module that `forceOverwrite`-replaced part of another mount could lose the overwritten module's nested leaves or overflow the stack. The surviving owners' content is now restored into the live wrappers, shallow-first and before anything is deleted, so references taken while the overwriting module was live keep working and values set by hand are kept ([#546](https://github.com/CLDMV/slothlet/pull/546)).
+- **Values assigned to a lazy namespace during materialization are kept (#543).** A value assigned while a `replace`-mode namespace (such as one placed by a `forceOverwrite` add) was still materializing was deleted as a stale child. User-assigned keys are now tracked and survive the adoption ([#547](https://github.com/CLDMV/slothlet/pull/547)).
+- **A namespace becomes callable when a later module supplies its function (#533).** A Proxy's callability is fixed at creation, so a namespace created as a plain object by one module stayed non-callable after another module added a function at the same path, and a `merge` dropped the function entirely. The namespace is now upgraded to a callable proxy so `api.<path>()` works: `merge` keeps an existing function and fills an empty slot, and `merge-replace` takes the incoming function. Removing a module rebuilds the namespace's function from the remaining modules in add order, so removing the module whose function won reverts to the previous function, while removing a module whose function lost, or one that contributed only children, keeps the current one. A reference held from before the upgrade keeps reading, writing and enumerating the namespace but stays non-callable; re-read it from `api`. The upgrade is one-way: if the function later goes away, calling the namespace throws `INVALID_CONFIG_NOT_A_FUNCTION` ([#556](https://github.com/CLDMV/slothlet/pull/556)).
+- **Removing the module that created a namespace keeps other modules' children (#555).** When a module's callable default export created a namespace (for example `plugins`) and other modules merged children into it (`plugins.gamma`), removing that module invalidated every one of those children recursively, because the routine manager's prune walked the live namespace; calling `api.plugins.gamma()` then threw "plugins.gamma is invalidated". Only wrappers that are no longer live are invalidated now, so every other module's children stay reachable and callable, with the same references, in eager and lazy mode ([#558](https://github.com/CLDMV/slothlet/pull/558)).
+- **`remove()` no longer throws on frozen or sealed exports (#485).** Removing a module that exported a frozen or sealed object aborted with "Cannot delete property", leaving stale leaves behind ([#491](https://github.com/CLDMV/slothlet/pull/491)).
+
+### Lifecycle and routines
+
+- **A root `shutdown` export runs once per teardown (#542).** With `autoRoutines: true`, a module's root `shutdown` export is both a contribution to the default `shutdown` routine and the root shutdown hook, so `api.shutdown()` ran it twice, and `api.destroy()` and `restart()` inherited that. A root `destroy` export under a `mode: "destroy"` routine was invoked twice the same way. Each now runs exactly once per teardown, `restart()` included. `api.slothlet.shutdown()` stays framework-only: it runs the shutdown-mode routines but never calls the root hooks itself, so with `autoRoutines: false` it runs no module code ([#553](https://github.com/CLDMV/slothlet/pull/553)).
+
+### Wrapper, context and events
+
+- **Object and function writes through a live view land on the underlying object (#495).** A wrap-on-set view (`self.X = obj`) forwarded primitive writes to the live object but stored object- and function-valued writes on the wrapper, which then shadowed later raw updates. Those writes now go to the underlying object, and a refused write on a frozen object throws `TypeError` like the primitive path ([#501](https://github.com/CLDMV/slothlet/pull/501)).
+- **`once("data")` fires with the EventEmitter context patch enabled (#503).** The patched `once` attached through the base `EventEmitter.prototype.on`, bypassing `Readable`'s override that resumes a paused stream, so `socket.once("data")` and `events.once(socket, "data")` hung. It now attaches through the emitter's own `on` / `removeListener` ([#505](https://github.com/CLDMV/slothlet/pull/505)).
+
+### Packaging
+
+- **The rolldown native binding is no longer installed for consumers (#461).** `@rolldown/binding-linux-x64-gnu` was listed in `optionalDependencies` as a lockfile workaround, so every consumer installed a 20 MB Linux bundler binary slothlet never uses. The entry is removed ([#493](https://github.com/CLDMV/slothlet/pull/493)).
+
+---
+
+## 🔧 CI & tooling
+
+- **Release merge re-arms on every check-producing workflow.** `release-merge.yml` re-synced from the `CLDMV/.github` v4.29.2 template, so an approval given before CodeQL or another non-CI check finishes no longer leaves the release PR stuck ([#490](https://github.com/CLDMV/slothlet/pull/490)).
+- **The required PR check can no longer pass while tests are still running.** On an in-repo feature PR, the skipped `pull_request` run posted a skipped `✅ Required PR Check`, which GitHub treats as satisfied, so a PR could merge before the push run finished testing. On that path the mirror job now runs as a no-op under the name `⏭️ Required PR Check (reported by the push run)`, so `✅ Required PR Check` only ever comes from a run that has finished the test matrix, synced from `CLDMV/.github` ([#554](https://github.com/CLDMV/slothlet/pull/554), [#557](https://github.com/CLDMV/slothlet/pull/557)).
+- **Bundle-size measures the published JS files.** The workflow now measures exactly the 62 JS files `npm pack` publishes instead of `dist/**` ([#494](https://github.com/CLDMV/slothlet/pull/494)).
+- **`analyze` and `i18n:check` skip gitignored paths** through a shared `.gitignore` matcher ([#492](https://github.com/CLDMV/slothlet/pull/492)).
+- **Test discovery excludes `tmp/` and `trash/`** via `@cldmv/vitest-runner` 1.5.1's `exclude` option, plus a repeatable `--exclude` flag on the runner wrapper (#520, [#522](https://github.com/CLDMV/slothlet/pull/522)).
+- **Tests:** a regression guard that a lazy `api.add()` loads only the shared subfolders its merge compares; the background loading reported in #548 could not be reproduced ([#552](https://github.com/CLDMV/slothlet/pull/552)). A `resolve-from-caller` test no longer depends on the checkout's folder name (#506, [#507](https://github.com/CLDMV/slothlet/pull/507)).
+
+---
+
+## 📚 Documentation
+
+- **NEW:** [docs/changelog/v3/v3.22.0.md](./v3.22.0.md) — this changelog.
+- [docs/RELOAD.md](../../RELOAD.md#apislothletrestart) — `api.slothlet.restart()`, reload vs restart, held references, and scoped-reload behavior for co-mounted and overwritten modules (#504, #525, #530).
+- [docs/LIFECYCLE.md](../../LIFECYCLE.md) — the `restart` / `shutdown` / `init` / `restarted` instance events, and how each teardown entry point treats root `shutdown` / `destroy` exports (#504, #542).
+- [docs/HOOKS.md](../../HOOKS.md) — the `around` hook type, and `lockCaller.caller` (#496, #477).
+- [docs/EVENTS.md](../../EVENTS.md) — listener ids, `event.strategy` / `event.deliver`, and event-rule conditions (#497, #511).
+- [docs/PERMISSIONS.md](../../PERMISSIONS.md) — Owner Grant, `checkCall`, Overlapping calls, and the host-only lifecycle methods and default routines (#509, #508, #512, #529, #504).
+- [docs/PERMISSIONS-CONDITIONS.md](../../PERMISSIONS-CONDITIONS.md) and [docs/CONTEXT-PROPAGATION.md](../../CONTEXT-PROPAGATION.md) — cross-references for `checkCall` and `lockCaller.caller`.
+- [docs/MODULE-STRUCTURE.md](../../MODULE-STRUCTURE.md#helper-modules-are-per-instance) — Helper Modules Are Per Instance, and which `.js` files are CommonJS (#518, #534, #521).
+- [docs/TESTING.md](../../TESTING.md) — TypeScript leaves under coverage and the `slothletInstanceImports()` vite plugin (#484, #486, #534).
+- [docs/TYPESCRIPT.md](../../TYPESCRIPT.md) — strict-mode options, the `sourcemap` default, TypeScript 7, and origin-based typegen with `SlothletSelf` (#499, #484, #510).
+
+---
+
+## 🔧 Dependencies
+
+- **Removed** `@rolldown/binding-linux-x64-gnu` from `optionalDependencies` (#461).
+- **Engines:** `node` `>=22.12.0` → `>=22.15.0` (#518).
+- Development only: `@cldmv/vitest-runner` `^1.5.1` ([#522](https://github.com/CLDMV/slothlet/pull/522)), `vitest` 5.0.2 ([#538](https://github.com/CLDMV/slothlet/pull/538)), `prettier` 3.9.9 ([#539](https://github.com/CLDMV/slothlet/pull/539)), `@types/node` 26.6.3 ([#541](https://github.com/CLDMV/slothlet/pull/541)), and `ignore` added for the gitignore-aware tooling ([#492](https://github.com/CLDMV/slothlet/pull/492)).
+
+---
+
+## Upgrade notes
+
+1. **Node.js 22.15 or later is required.** Upgrade the runtime before installing 3.22.0.
+2. **Live runtime with `defaultPolicy: "deny"`:** re-check permission grants. Callers that were previously misattributed to an outer caller are now attributed to the module that made the call, so a grant that depended on the misattribution now denies.
+3. **Permissions config present:** modules can no longer call `slothlet.reload`, `slothlet.shutdown`, `slothlet.restart`, `slothlet.lockCaller.caller`, `slothlet.permissions.global.checkCall`, or the root `initialize` / `shutdown` paths while the default routines are configured. Grant trusted modules an exact-target allow rule. With `routines: []`, add your own deny rules on `shutdown` and `destroy`, because the top-level `api.shutdown()` / `api.destroy()` still tear the instance down.
+4. **TypeScript strict mode:** stay on `typescript@6`. Strict mode throws `TYPESCRIPT_STRICT_REQUIRES_TS6` on TypeScript 7; fast mode and typegen are unaffected.
+5. **Event-rule conditions** that read `ctx.context.*` to work around the old store shape must read `ctx.*`.
+6. **Helper state is per instance.** If two instances relied on sharing module-level state in a relative helper, move that state into a package or pass it through `reference`.
+7. **Coverage:** TypeScript source maps are now on automatically during coverage runs. Add `**/.slothlet-cache/**` to `coverage.include` to see `.ts` leaves reported; set `typescript.sourcemap` explicitly to override.
+8. **Typegen:** regenerate declarations to pick up origin-based types. Programs loading more than one api should pass `--no-augment-runtime` for the extra declarations and type `slothlet<OtherApi>()` explicitly.