diff --git a/di/serverselect/VERSION b/di/serverselect/VERSION
new file mode 100644
index 00000000..6c6aa7cb
--- /dev/null
+++ b/di/serverselect/VERSION
@@ -0,0 +1 @@
+0.1.0
\ No newline at end of file
diff --git a/di/serverselect/deps.q b/di/serverselect/deps.q
new file mode 100644
index 00000000..5b7801b9
--- /dev/null
+++ b/di/serverselect/deps.q
@@ -0,0 +1,10 @@
+/ hard module dependencies and their minimum versions, validated by di.depcheck.
+/ di.serverselect has NONE, and the empty manifest is deliberate rather than the file being absent:
+/ di.depcheck's finddepsq returns (::) for a module that ships no deps.q, which is indistinguishable
+/ from "nobody has decided yet". an explicit empty dict records that the STANDALONE classification in
+/ the modularisation plan was checked against the source and holds.
+/ verified: init.q and serverselect.q contain no `use` at all. logging is INJECTED via init, not a
+/ hard dep - the plan's tier table excludes logging, timer and handler management from the dependency
+/ tree by design. integration.q does load kx.log, but it is a harness run directly rather than loaded
+/ by init.q, so it is not an edge of this module.
+deps:(`$())!();
diff --git a/di/serverselect/init.q b/di/serverselect/init.q
new file mode 100644
index 00000000..c0af8685
--- /dev/null
+++ b/di/serverselect/init.q
@@ -0,0 +1,27 @@
+\l ::serverselect.q
+
+/ logging is an injected dependency: the start-up script that wires the modules together -
+/ or the user at run time - must call init with a required `log dependency before using the
+/ module. kx.log is intentionally NOT loaded here.
+/ note: the injected log dict must already be binary `info`warn`error!{[c;m]} - no adaptation
+/ is done here; init fans it out into .z.m.loginfo/.z.m.logwarn/.z.m.logerr, called as
+/ .z.m.loginfo[`ctx;"msg"]
+
+/ module version, read from the VERSION file rather than hardcoded, so a release bump touches one
+/ plain-text file. read module-relative (`:::` resolves to di/serverselect) and BEFORE the export
+/ line, since export:([...]) evaluates each name.
+/ NB `version` must STAY in the export: di.depcheck resolves a dependency's version from the export
+/ dict (checkdepversion) and classes a missing one as a FAILURE - which makes di.depcheck.init throw
+/ for any process loading a module that declares this one as a hard dependency
+/ trim, and fail LOUD on a missing/unreadable/empty VERSION, rather than a bare `first read0`: a raw
+/ OS error names no module, and read0 strips the line terminator but NOT a trailing \r on a CRLF file
+/ or trailing spaces - and di.depcheck compares versions as STRINGS, so a padded value silently fails
+/ every dependent module's check. an empty value is worse still: it reads to depcheck as
+/ "exports no version", i.e. the exact failure the VERSION file was added to prevent
+version:@[{trim first read0 x};`:::VERSION;{'"di.serverselect: VERSION file missing or unreadable"}];
+if[0=count version;'"di.serverselect: VERSION file is empty"];
+
+export:([init;
+  addserverfull;addserverattr;addserver;setserveractive;setserveridactive;getserverstable;addserversfromtable;
+  getservers;selector;setselector;getserverbytype;gethandlebytype;gethpbytype;getserverids;
+  removeinactive;getapimeta;version])
diff --git a/di/serverselect/integration.q b/di/serverselect/integration.q
new file mode 100644
index 00000000..0eb4f2b5
--- /dev/null
+++ b/di/serverselect/integration.q
@@ -0,0 +1,360 @@
+/ ===========================================================================
+/ di.serverselect integration test (real processes)
+/ Spawns child q listeners, opens REAL IPC handles to them, and drives every
+/ exported function through a realistic gateway lifecycle - register ->
+/ query -> select -> route a live query to the chosen handle -> bulk-register
+/ -> disconnect -> error handling -> init. Unlike a simulated test, the
+/ selection functions hand back handles that are actually queried, so the
+/ assertions prove queries reach the expected backend process.
+/ .
+/ Self-contained: no helper files. The child backends are bare `q` listeners
+/ whose identity (`whoami`) and `ping` api are injected over IPC at setup; the
+/ test launches and tears them down itself.
+/ .
+/ Requirements:
+/   - run THIS script with KDB-X q (needs `use`)
+/   - a q on PATH (override with $QBIN) to launch the child listeners
+/   - some free TCP ports: the test scans for free ports from a pid-derived
+/     base (so concurrent runs don't collide); set $SSPORT to pin the base
+/ Run (QPATH must include this repo and the kx module dir):
+/   QPATH=/path/to/kx/mod:/path/to/kdbx-modules <kdbx>/q integration.q
+/ Exits with a non-zero code equal to the number of failed assertions.
+/ ===========================================================================
+
+srvsel:use`di.serverselect;
+
+/ ---- tiny assertion harness ----
+/ note: avoid `desc`/`exp`/`log` as names - they are reserved words in KDB-X
+PASS:0; FAIL:0;
+lbl:{[ok] $[ok;"  ok   | ";"  FAIL | "]};
+chk:{[nm;got;expd]
+  ok:got~expd;
+  $[ok;PASS+:1;FAIL+:1];
+  m:lbl[ok],nm;
+  if[not ok; m:m," || got=",(.Q.s1 got),"  exp=",.Q.s1 expd];
+  -1 m;
+  };
+errtok:`$"__ERRORED__";
+chkerr:{[nm;f]
+  r:@[f;();{[e](errtok;e)}];
+  ok:(0<count r) and errtok~first r;
+  $[ok;PASS+:1;FAIL+:1];
+  m:lbl[ok],nm;
+  m:m,$[ok;" || signalled: ",(r 1);" || NO ERROR raised, got=",.Q.s1 r];
+  -1 m;
+  };
+hdr:{[t] -1""; -1"==== ",t," ===="; };
+
+d1:2024.01.01; d2:2024.01.02; d3:2024.01.03;
+
+/ ---- child-process management ----
+qbin:$[0<count s:getenv`QBIN; s; "q"];
+/ fleet: 0,1 rdb | 2,3 hdb (attr) | 4 gateway | 5,6 bulk-registered rdb/hdb
+names:`rdb1`rdb2`hdb1`hdb2`gw1`rdb3`hdb3;
+pids:`int$();
+
+/ no hardcoded ports: derive a starting point from this pid (so concurrent runs
+/ on a shared host don't collide) - or take an explicit base from $SSPORT - then
+/ scan upward for ports that are actually free. nothing assumes a fixed port.
+/ probe whether a localhost port is in use: a free port refuses instantly, so this short
+/ timeout only bounds the wait for a filtered (silently-dropped) port - keep it small so a
+/ full scan of 10*count names candidates cannot stall for many seconds
+inuse:{[p] @[{hclose hopen x; 1b}; (`$":localhost:",string p;50); 0b]};
+baseport:$[0<count s:getenv`SSPORT; "I"$s; 20000+`int$.z.i mod 20000];
+findfree:{[start;n]
+  / take the first n free ports from a generous candidate window above start
+  cand:start+til 10*n;
+  free:cand where not inuse each cand;
+  if[n>count free;
+    '"could not find ",string[n]," free ports scanning up from ",string start];
+  :n#free;
+  };
+ports:findfree[baseport;count names];
+
+launch:{[port]
+  / start a bare q listener detached and capture its shell background pid ($!) - so every
+  / child can be reaped by exact pid later, whether or not we ever connect to it, and with
+  / no dependence on the qbin path (identity/api are injected over IPC once connected).
+  / nohup is REQUIRED, not cosmetic: without it system returns the generic null rather than the
+  / echoed pid whenever the backgrounded child is itself a q process, so "I"$first threw a bare
+  / 'type here and the fleet never launched. a backgrounded sleep captures fine, which is what
+  / makes it look like a shell-quoting problem rather than a q-child one. measured, not assumed.
+  / nohup over setsid: it execs rather than forking, so $! is unambiguously the q child's own pid
+  / (verified against pgrep), and it is POSIX where setsid is util-linux. both redirects stay, so
+  / nohup writes no nohup.out
+  :"I"$first system "nohup ",qbin," -p ",string[port]," -q </dev/null >/dev/null 2>&1 & echo $!";
+  };
+
+connect:{[port]
+  / open a handle, retrying for up to ~10s while the child binds and accepts
+  hp:`$":localhost:",string port;
+  step:{[hp;h] if[not null h; :h]; system"sleep 0.2"; @[hopen;(hp;500);{0Ni}]}[hp];
+  :50 step/ 0Ni;
+  };
+
+teardown:{[]
+  / always-run cleanup. kill every launched child by its captured pid (exact). the pkill
+  / fallback is a last resort for the rare case a pid was never captured - keyed on our own
+  / unique port and -q flag (NOT the qbin path, which is configurable), so a custom qbin
+  / cannot break it. the [-]p bracket keeps the pattern from matching this very kill command.
+  live:pids where not null pids;
+  if[count live; @[system;"kill ",(" " sv string live)," 2>/dev/null; true";{}]];
+  {@[system;"pkill -f \"[-]p ",string[x]," -q\" 2>/dev/null; true";{}]} each ports;
+  @[hclose;;{}] each handles where not null handles;
+  };
+
+/ launch the fleet (capturing each child's shell pid for exact-pid teardown), then connect
+-1 "selected free ports: ",.Q.s1 ports;
+pids:launch each ports;
+handles:connect each ports;
+/ guarantee the fleet is reaped on ANY exit (normal, error-abort, or exit code)
+.z.exit:{teardown[]};
+if[any null handles;
+  -2 "failed to connect to child processes on ports: ",(" " sv string ports where null handles);
+  exit 3];
+/ inject each backend's identity + ping api over IPC
+{[h;nm] h "whoami:`",string nm; h "ping:{whoami}";}'[handles;names];
+-1 "spawned ",(string count handles)," backend processes; real handles: ",.Q.s1 handles;
+
+/ route: select a server of type t via strategy sel, then SEND ping[] over the chosen handle
+route:{[t;sel] h:srvsel.gethandlebytype[t;sel]; $[()~h; `NONE; h "ping[]"]};
+/ map serverids -> their handles (to route attribute-path selections)
+sidhandles:{[sids] exec handle from srvsel.getserverstable[] where serverid in sids};
+/ the gateway's host/port for the hpup column - its real (dynamically chosen) address
+gwhp:`$":localhost:",string ports 4;
+
+/ test steps run at top level (a single enclosing function would exceed q's
+/ per-function constant limit). chk/chkerr trap their own assertion failures;
+/ .z.exit guarantees teardown regardless of how the script ends.
+
+/ init must be called before use (log is a required injected dependency, no default)
+srvsel.init[enlist[`log]!enlist `info`warn`error!({[c;m]};{[c;m]};{[c;m]})];
+
+/ =========================================================================
+hdr"STEP 1  initial empty state";
+chk["fresh module: server table empty";0=count srvsel.getserverstable[];1b];
+chk["schema columns correct";`serverid`handle`procname`servertype`hpup`active`lastp`hits`attributes`disconnecttime;cols srvsel.getserverstable[]];
+
+/ =========================================================================
+hdr"STEP 2  registration of live handles (addserver / addserverattr / addserverfull)";
+srvsel.addserver[handles 0;`rdb];
+srvsel.addserver[handles 1;`rdb];
+srvsel.addserverattr[handles 2;`hdb;`date`sym!((d1;d2);`A`B)];
+srvsel.addserverattr[handles 3;`hdb;`date`sym!((d2;d3);`B`C)];
+srvsel.addserverfull[handles 4;`gw1;`gateway;gwhp;(enlist`region)!enlist`EU];
+chk["five servers registered";5=count srvsel.getserverstable[];1b];
+chk["serverids autoincrement 1..5";1 2 3 4 5i;exec serverid from srvsel.getserverstable[]];
+chk["handles stored are the real open handles";handles til 5;exec handle from srvsel.getserverstable[]];
+chk["servertypes as registered";`rdb`rdb`hdb`hdb`gateway;exec servertype from srvsel.getserverstable[]];
+chk["addserverfull populated procname";`gw1;first exec procname from srvsel.getserverstable[] where servertype=`gateway];
+chk["addserverfull populated hpup";gwhp;first exec hpup from srvsel.getserverstable[] where servertype=`gateway];
+chk["addserver -> empty attributes";(()!());first exec attributes from srvsel.getserverstable[] where handle=handles 0];
+chk["all active by default";1b;all exec active from srvsel.getserverstable[]];
+
+/ =========================================================================
+hdr"STEP 3  getservers (lookup + attribute match scoring)";
+chk["lookups=` returns all active";5;count srvsel.getservers[`;`;()!()]];
+chk["servertype=hdb returns 2";2;count srvsel.getservers[`servertype;`hdb;()!()]];
+chk["servertype list rdb,hdb returns 4";4;count srvsel.getservers[`servertype;`rdb`hdb;()!()]];
+chk["procname=gw1 returns the gateway handle";enlist handles 4;exec handle from srvsel.getservers[`procname;`gw1;()!()]];
+chk["unknown servertype returns empty";0;count srvsel.getservers[`servertype;`nope;()!()]];
+chk["attribmatch column present";1b;`attribmatch in cols srvsel.getservers[`;`;()!()]];
+chk["complete date match flagged for some hdb on d1";1b;
+  any {x[`date]0} each (srvsel.getservers[`servertype;`hdb;(enlist`date)!enlist enlist d1])`attribmatch];
+
+/ =========================================================================
+hdr"STEP 4  selector (strategies on a known table)";
+seltab:([]serverid:101 102 103i;handle:201 202 203i;lastp:(2024.01.03D0;2024.01.01D0;2024.01.02D0));
+chk["roundrobin picks oldest lastp";202i;(srvsel.selector[seltab;`roundrobin])`handle];
+chk["last picks newest lastp";201i;(srvsel.selector[seltab;`last])`handle];
+chk["any picks a row from the table";1b;((srvsel.selector[seltab;`any])`handle) in 201 202 203i];
+empt:([]serverid:`int$();handle:`int$();lastp:`timestamp$());
+chk["empty table -> null handle";0Ni;(srvsel.selector[empt;`roundrobin])`handle];
+
+/ =========================================================================
+hdr"STEP 5  live routing (gethandlebytype / gethpbytype / getserverbytype)";
+/ round-robin across the two live rdbs: both start with null lastp, so LRU
+/ visits rdb1, rdb2, rdb1, rdb2 - and each query is answered by that process
+resp:{[i] route[`rdb;`roundrobin]} each til 4;
+chk["round-robin routes to live rdbs in LRU order";`rdb1`rdb2`rdb1`rdb2;resp];
+chk["only the two live rdbs ever answer";`rdb1`rdb2;asc distinct resp];
+chk["gethpbytype gateway returns its hpup";gwhp;srvsel.gethpbytype[`gateway;`roundrobin]];
+chk["getserverbytype returns requested column";`gw1;srvsel.getserverbytype[`gateway;`procname;`roundrobin]];
+chk["gethandlebytype unknown type -> ()";();srvsel.gethandlebytype[`nope;`roundrobin]];
+chk["a single hdb query is answered by an hdb";1b;(route[`hdb;`roundrobin]) in `hdb1`hdb2];
+hitsbefore:exec sum hits from srvsel.getserverstable[] where servertype=`gateway;
+srvsel.gethandlebytype[`gateway;`roundrobin];
+chk["selection increments hits";1b;(hitsbefore+1)=exec sum hits from srvsel.getserverstable[] where servertype=`gateway];
+
+/ =========================================================================
+hdr"STEP 6  getserverids - servertype (symbol) path";
+chk["rdb -> the two rdb serverids";1 2i;asc raze srvsel.getserverids[`rdb]];
+chk["rdb,hdb -> all four serverids";1 2 3 4i;asc raze srvsel.getserverids[`rdb`hdb]];
+srvsel.setserveractive[handles 0;0b]; srvsel.setserveractive[handles 1;0b];
+chkerr["all requested servertype inactive -> error";{srvsel.getserverids[`rdb]}];
+srvsel.setserveractive[handles 0;1b]; srvsel.setserveractive[handles 1;1b];
+
+/ =========================================================================
+hdr"STEP 7  getserverids - attribute path + routing to the matched backend";
+/ hdb1 covers (d1,d2)/(A,B); hdb2 covers (d2,d3)/(B,C)
+chk["date=d1 -> hdb1 only";enlist`hdb1;
+  distinct {x"ping[]"} each sidhandles raze srvsel.getserverids[enlist[`date]!enlist enlist d1]];
+chk["cross (d1,d2)x(A,B) -> hdb1 alone covers it";enlist`hdb1;
+  distinct {x"ping[]"} each sidhandles raze srvsel.getserverids[`date`sym!((d1;d2);`A`B)]];
+chk["independent over d1,d2,d3 + A,B,C -> both hdbs contribute";`hdb1`hdb2;
+  asc distinct {x"ping[]"} each sidhandles raze srvsel.getserverids[`date`sym`attributetype!((d1;d2;d3);`A`B`C;`independent)]];
+chk["servertype key scopes attribute filter to hdbs";3 4i;asc raze srvsel.getserverids[`servertype`date!(`hdb;enlist d2)]];
+chk["empty requirement dict -> all active serverids";1 2 3 4 5i;asc raze srvsel.getserverids[()!()]];
+chkerr["besteffort=0b impossible -> error";{srvsel.getserverids[`date`besteffort!(enlist 2099.01.01;0b)]}];
+chkerr["no server has requested attribute value -> error";{srvsel.getserverids[enlist[`date]!enlist enlist 2099.01.01]}];
+
+/ =========================================================================
+hdr"STEP 8  addserversfromtable (bulk registration of live handles)";
+conntab:([]w:handles 5 6;proctype:`rdb`hdb;attributes:(()!();`date`sym!((d1;d3);`A`C)));
+srvsel.addserversfromtable[`rdb`hdb;conntab];
+chk["bulk-registered handles 5,6 now present";2=count select from srvsel.getserverstable[] where handle in handles 5 6;1b];
+chk["bulk-registered rdb3 is reachable via its handle";`rdb3;(handles 5)"ping[]"];
+chk["bulk-registered rdb3 now appears in rdb serverids";1b;6i in raze srvsel.getserverids[`rdb]];
+/ skip-already-active: re-offering a live handle must not duplicate it
+n0:count srvsel.getserverstable[];
+srvsel.addserversfromtable[`rdb;([]w:enlist handles 0;proctype:enlist`rdb;attributes:enlist()!())];
+chk["already-active handle skipped (no new row)";n0;count srvsel.getserverstable[]];
+/ (proctype filter, `ALL, and optional procname/hpup columns are covered in test.csv)
+
+/ =========================================================================
+hdr"STEP 9  disconnect: kill a backend, deactivate it, prove routing adapts";
+/ a real gateway's .z.pc handler would call setserveractive[h;0b] on the dropped handle
+/ guard: the kill is only a genuine test if rdb1's pid was captured. if pids 0 were null,
+/ string 0Ni -> "0Ni" and the kill silently no-ops, degrading STEP 9 into a deactivation-only
+/ test. fail loudly here rather than pass on a half-exercised path.
+chk["rdb1 pid captured (so the kill below is real)";1b;not null pids 0];
+@[system;"kill ",string[pids 0]," 2>/dev/null; true";{}]; system"sleep 0.3";
+srvsel.setserveractive[handles 0;0b];
+chk["disconnect stamped disconnecttime on the dropped handle";1b;
+  not null first exec disconnecttime from srvsel.getserverstable[] where handle=handles 0];
+chk["a still-active server keeps a null disconnecttime";1b;
+  null first exec disconnecttime from srvsel.getserverstable[] where handle=handles 1];
+/ active rdbs are now rdb2 (live) and rdb3 (live); the dead rdb1 must never be picked
+postresp:{[i] route[`rdb;`roundrobin]} each til 6;
+chk["killed/deactivated rdb1 is never selected";1b;not `rdb1 in postresp];
+chk["no routed query hits a dead handle (all answered)";1b;not `NONE in postresp];
+chk["the two remaining live rdbs both serve";`rdb2`rdb3;asc distinct postresp];
+
+/ =========================================================================
+hdr"STEP 10  error handling (every guarded path signals + logs)";
+chkerr["addserverfull rejects non-int handle";{srvsel.addserverfull[`bad;`;`rdb;`;()!()]}];
+chkerr["addserverfull rejects non-symbol servertype";{srvsel.addserverfull[71i;`;"rdb";`;()!()]}];
+chkerr["addserver rejects bad handle";{srvsel.addserver[`bad;`rdb]}];
+chkerr["addserverattr rejects bad servertype";{srvsel.addserverattr[73i;"hdb";()!()]}];
+chkerr["setserveractive rejects non-int handle";{srvsel.setserveractive["bad";0b]}];
+chkerr["setserveractive rejects non-boolean flag";{srvsel.setserveractive[1i;`yes]}];
+chkerr["getservers rejects bad nameortype";{srvsel.getservers[`badname;`x;()!()]}];
+chkerr["selector rejects unknown strategy";{srvsel.selector[seltab;`bogus]}];
+chkerr["getserverids rejects null servertype";{srvsel.getserverids[`]}];
+chkerr["getserverids rejects unregistered servertype";{srvsel.getserverids[`nope]}];
+chkerr["getserverids rejects non-symbol non-dict arg";{srvsel.getserverids[42]}];
+chkerr["getserverids rejects nested/malformed attribute value";{srvsel.getserverids[(enlist`date)!enlist enlist d1,d2]}];
+chkerr["addserversfromtable rejects missing columns";{srvsel.addserversfromtable[`rdb;([]x:enlist 1i)]}];
+
+/ =========================================================================
+hdr"STEP 11  init (required log dependency - bespoke + kx.log)";
+caplog:([]lvl:`symbol$();msg:());
+caplogger:`info`warn`error!({[c;m]`caplog upsert(`info;m)};{[c;m]`caplog upsert(`warn;m)};{[c;m]`caplog upsert(`error;m)});
+srvsel.init[enlist[`log]!enlist caplogger];
+caplog:0#caplog;
+srvsel.addserver[40i;`rdb];
+chk["injected logger captures an info message";1b;0<count select from caplog where lvl=`info];
+chk["injected logger receives the message text";1b;any caplog[`msg] like "*registering server*"];
+caplog:0#caplog;
+@[{srvsel.selector[([]handle:1 2i;lastp:2#.z.p);`bogus]};();{}];
+chk["injected logger captures an error message";1b;0<count select from caplog where lvl=`error];
+chkerr["init rejects non-dictionary deps";{srvsel.init[(::)]}];
+chkerr["init rejects deps missing log key";{srvsel.init[()!()]}];
+chkerr["init rejects log value that is not a dict";{srvsel.init[enlist[`log]!enlist(::)]}];
+chkerr["init rejects log dict missing error key";{srvsel.init[enlist[`log]!enlist(`info`warn!({[c;m]};{[c;m]}))]}];
+/ the module does no adaptation, so wrap the monadic kx.log instance into a binary {[c;m]} dict caller-side
+kxinst:(use`kx.log)[`createLog][];
+kxbinary:`info`warn`error!(
+  {[c;m]kxinst[`info][string[c],": ",m]};
+  {[c;m]kxinst[`warn][string[c],": ",m]};
+  {[c;m]kxinst[`error][string[c],": ",m]});
+srvsel.init[enlist[`log]!enlist kxbinary];
+srvsel.addserver[41i;`rdb];
+chk["kx.log logger wired and usable";1b;41i in exec handle from srvsel.getservers[`servertype;`rdb;()!()]];
+
+/ =========================================================================
+hdr"STEP 12  setselector / removeinactive / module metadata";
+/ STEP 11 registered synthetic rdb handles (40i, 41i) purely to prove each logger was wired - they
+/ are NOT live processes, so retire everything that is not one of this test's own child handles
+/ before routing again, or a round-robin pick lands on a dead handle. done by difference against
+/ `handles` rather than by listing 40i/41i, so adding another synthetic handle upstream cannot rot this
+srvsel.setserveractive[;0b] each exec distinct handle from srvsel.getserverstable[] where active,not handle in handles;
+/ setselector must demonstrably change WHICH live backend a query reaches, not merely run.
+/ pin the strategy to rdb3 and prove ping[] comes back from rdb3 every time.
+/ NB the pinned handle is captured by PROJECTION, not read from a global: the strategy is invoked
+/ from inside the module, where a bare name resolves against the module's own .z.m rather than the
+/ root namespace this file defines, so a global `pinned` reads as unset and the select throws 'type
+srvsel.setselector[{[h;servertable;selection] first select from servertable where handle=h}[handles 5]];
+chk["setselector overrode routing - every rdb query reaches the pinned backend";enlist`rdb3;
+  distinct {route[`rdb;`roundrobin]} each til 4];
+chk["the exported selector itself is unchanged by setselector";handles 1;
+  (srvsel.selector[select from srvsel.getserverstable[] where handle=handles 1;`roundrobin])`handle];
+srvsel.setselector[srvsel.selector];
+chk["restoring the default puts the live strategy back";1b;.m.di.0serverselect.selector~srvsel.selector];
+chk["default routing spreads across both live rdbs again";`rdb2`rdb3;
+  asc distinct {route[`rdb;`roundrobin]} each til 8];
+chkerr["setselector rejects a non-function";{srvsel.setselector[42]}];
+
+/ removeinactive: rdb1 was killed and deactivated in STEP 9, so it is the real purge candidate
+chk["the disconnected backend is still on record before any purge";1b;
+  0<count select from srvsel.getserverstable[] where handle=handles 0];
+srvsel.removeinactive[1D];
+chk["a recently-disconnected server survives a 1D purge";1b;
+  0<count select from srvsel.getserverstable[] where handle=handles 0];
+/ drive the purge off the injected clock rather than sleeping for a day
+.m.di.0serverselect.cp:{.z.p+2D};
+srvsel.removeinactive[1D];
+.m.di.0serverselect.cp:{.z.p};
+chk["the aged-out disconnected server was purged";0;
+  count select from srvsel.getserverstable[] where handle=handles 0];
+chk["the live backends were untouched by the purge";1b;
+  all (handles 1 2 3 5) in exec handle from srvsel.getserverstable[] where active];
+chk["routing still works against live backends after the purge";`rdb2`rdb3;
+  asc distinct {route[`rdb;`roundrobin]} each til 8];
+chkerr["removeinactive rejects a non-timespan age";{srvsel.removeinactive[42]}];
+
+/ setserveridactive: registration-level retirement on a SHARED live handle. rdb2's handle is
+/ registered a second time under another servertype, so both registrations sit on one real socket
+srvsel.addserverfull[handles 1;`rdb2alt;`rdbalt;`:alt:1;()!()];
+/ plain assignment, NOT `::` - at script top level `name::expr` defines a lazily re-evaluated VIEW,
+/ not a global, and the serverid must be captured once here rather than recomputed on every read
+altsid:first exec serverid from srvsel.getserverstable[] where servertype=`rdbalt;
+chk["both servertypes share one live handle";2;
+  count select from srvsel.getserverstable[] where handle=handles 1];
+chk["the alt servertype routes to the real backend before retirement";`rdb2;route[`rdbalt;`roundrobin]];
+srvsel.setserveridactive[altsid;0b];
+chk["setserveridactive retired only that registration";`NONE;route[`rdbalt;`roundrobin]];
+chk["its handle sibling still routes on the same socket";1b;`rdb2 in {route[`rdb;`roundrobin]} each til 6];
+chk["the sibling registration is still marked active";1b;
+  first exec active from srvsel.getserverstable[] where handle=handles 1,servertype=`rdb];
+srvsel.setserveridactive[altsid;1b];
+chk["reactivating by serverid restores routing";`rdb2;route[`rdbalt;`roundrobin]];
+/ and a genuine handle disconnect still takes every registration on that socket down together
+srvsel.setserveractive[handles 1;0b];
+chk["setserveractive is unchanged - a handle disconnect retires both registrations";0;
+  count select from srvsel.getserverstable[] where handle=handles 1,active];
+srvsel.setserveractive[handles 1;1b];
+chkerr["setserveridactive rejects a non-int serverid";{srvsel.setserveridactive[`nope;0b]}];
+
+/ module metadata di.torq depends on
+chk["version is exported as a major.minor.patch string";1b;
+  (10h=type srvsel.version) and 3=count "." vs srvsel.version];
+chk["getapimeta documents exactly the callable exports";1b;
+  (asc (key srvsel) except `init`getapimeta)~asc exec name from srvsel.getapimeta[]];
+chk["getapimeta carries the di.api registry columns";`name`public`descrip`params`return;
+  cols srvsel.getapimeta[]];
+
+-1"";-1"===========================================================";
+-1"  TOTAL: ",(string PASS+FAIL)," | PASS: ",(string PASS)," | FAIL: ",string FAIL;
+-1"===========================================================";
+exit FAIL
diff --git a/di/serverselect/serverselect.md b/di/serverselect/serverselect.md
new file mode 100644
index 00000000..39c2670e
--- /dev/null
+++ b/di/serverselect/serverselect.md
@@ -0,0 +1,572 @@
+# Server Selection
+
+`serverselect.q` maintains a pool of registered backend servers and selects from them by servertype or attribute requirements. Extracted from the `.gw` namespace in TorQ's `gatewaylib.q` and `gateway.q`, it provides the server-selection layer of a gateway — decoupled from query execution and connection management.
+
+---
+
+## Features
+
+- Register backend servers with servertype, procname, host/port, and attribute dictionaries
+- Track active/inactive state per server, updated on connect and disconnect
+- Select servers using round-robin, most-recently-used, or random strategy
+- Query servers by servertype list or attribute requirement dictionary
+- Attribute matching supports cross-product and independent strategies with configurable best-effort mode
+- Bulk registration from a TorQ-compatible connection table
+- Pluggable selection strategy — override the built-in `selector` at run time via `setselector`
+- Age-based purge of long-departed servers via `removeinactive`, so the registry does not grow without bound
+- Injected logging — supply your own binary `` `info`warn`error `` logger via `init`; required, no default
+- Injected clock — supply your own `cp` to make time-dependent behaviour testable without sleeping
+- Declares its own api metadata via `getapimeta[]` for `di.torq` to register with `di.api`
+- Exports `version`, read from the module's `VERSION` file, as `di.depcheck` requires
+
+---
+
+## Initialisation & Dependencies
+
+`init` wires the module's injected dependencies and **must be called before any other function**. The `log` dependency is **required** — there is no fallback, and the module does not load `kx.log` itself. Initialising the logging framework is the job of the start-up script that ties the modules together, or of the user at run time.
+
+The `log` value must **already** be a binary `` `info`warn`error!{[c;m]} `` dict — each function takes a context symbol `c` and a message string `m`. `init` performs **no** adaptation and fans the dict out into `.z.m.loginfo`/`.z.m.logwarn`/`.z.m.logerr`, called as `.z.m.loginfo[\`ctx;"msg"]`. Build it from `di.log` (the standard logger, which exports binary `info`/`warn`/`error`) or hand-roll one. A raw monadic `kx.log` instance must be wrapped by the caller first — the module will not do it.
+
+```q
+srvsel:use`di.serverselect
+
+/ option 1: di.log (the standard logger) - build the dict from its exports
+logger:use`di.log
+logdep:`info`warn`error!(logger.info;logger.warn;logger.error)
+srvsel.init[enlist[`log]!enlist logdep]
+
+/ option 2: a bespoke binary logger {[c;m]} (context symbol, message string)
+mylog:`info`warn`error!(
+  {[c;m] .my.log.info  string[c],": ",m};
+  {[c;m] .my.log.warn  string[c],": ",m};
+  {[c;m] .my.log.error string[c],": ",m});
+srvsel.init[enlist[`log]!enlist mylog]
+
+/ a raw kx.log instance is monadic - wrap it to binary {[c;m]} before passing:
+/   kxinst:(use`kx.log)[`createLog][]
+/   `info`warn`error!({[c;m]kxinst[`info][string[c],": ",m]};…)
+```
+
+`init` throws with prefix `di.serverselect:` if `deps` is not a dictionary, is missing the `` `log `` key, or the `log` value is not a dictionary exposing `` `info`warn`error ``. All other `di.serverselect:` error conditions are logged via `.z.m.logerr` (with the function as context) before being signalled.
+
+### Optional configuration
+
+Config keys travel on the same flat dict as the dependencies. Each is type-checked at `init`, so a
+misconfiguration fails loudly at startup rather than silently at first use.
+
+| Key | Type | Default | Purpose |
+|---|---|---|---|
+| `cp` | function | `{.z.p}` | Current-time function. Stamps `disconnecttime` and drives `removeinactive`. Override it to fast-forward in tests, or to run on a simulated clock, without sleeping |
+| `maxcrossproduct` | long | `1000000` | Upper bound on the requirement cross product `getserverids` will build in `cross` mode, checked before building it. `0W` disables the bound. Cost is the **product** of the requirement value counts, so a gateway forwarding client-supplied requirements can get very large very cheaply |
+| `clearinactivetime` | timespan | `0D01:00` | How long a disconnected server should be retained. **Not read by any function in this module** — `removeinactive` is caller-invoked, so this is the age `di.torq` passes it when it schedules the purge, mirroring how `di.dataaccess` uses `requestkeeptime`. It is here so the retention policy is configured in one place alongside everything else |
+
+```q
+srvsel.init[`log`cp`clearinactivetime!(logdep;{.z.p};0D06:00)]
+```
+
+`init` is re-callable. A re-init rewires the logger and config and **reseeds the live selection
+strategy from the built-in default**, discarding anything previously installed by `setselector`. It
+does **not** reset the registered server table.
+
+Every public function guards on `init` having run, and says so:
+
+```
+di.serverselect: getserverstable: init must be called first
+```
+
+rather than surfacing a raw `.m.di.0serverselect.loginfo` and leaking the module's internal
+namespace. The two exceptions are deliberate: `version` is a plain string, and `getapimeta[]` is pure
+data that `di.torq` collects at startup — possibly before this module's `init` has run.
+
+---
+
+## Server Table Schema
+
+Servers are tracked in the `servers` keyed table (keyed on `serverid`):
+
+| Column | Type | Description |
+|---|---|---|
+| `serverid` | `int` (key) | Unique auto-assigned server ID |
+| `handle` | `int` | Connection handle |
+| `procname` | `symbol` | Process name (null if not provided) |
+| `servertype` | `symbol` | Process type e.g. `` `rdb ``, `` `hdb `` |
+| `hpup` | `symbol` | Host/port symbol e.g. `` `:host:5010 `` (null if not provided) |
+| `active` | `boolean` | Whether the server is currently active |
+| `lastp` | `timestamp` | Last time this server was selected |
+| `hits` | `int` | Number of times this server has been selected |
+| `attributes` | `any` | Attribute dictionary registered with the server |
+| `disconnecttime` | `timestamp` | When the server was last marked inactive; null while active. Set from the injected `cp`, and read by `removeinactive` |
+
+---
+
+## Functions
+
+### Registration
+
+| Function | Description |
+|---|---|
+| `addserverfull[h;pname;st;hp;att]` | Register a server with full details: handle, procname, servertype, hpup, attributes |
+| `addserverattr[h;st;att]` | Register a server with servertype and attributes; procname and hpup default to null |
+| `addserver[h;st]` | Register a server with no attributes |
+| `setserveractive[h;active]` | Mark **every registration on a handle** active (`1b`) or inactive (`0b`). Stamps `disconnecttime` on the active→inactive transition and clears it on reactivation |
+| `setserveridactive[sid;active]` | Mark **one registration** active or inactive by `serverid`, leaving handle siblings alone |
+| `removeinactive[age]` | Delete inactive servers that disconnected more than `age` ago |
+| `addserversfromtable[proctypes;conntable]` | Bulk-register from a connection table, filtered by proctype |
+| `getserverstable[]` | Return the full registered server table |
+
+`attributes` must be a **symbol-keyed dictionary** (`()!()` when there are none). Note that a keyed
+table is also type `99h`, so the check tests the key type rather than the value's type alone —
+a keyed table, or a dictionary keyed on anything but symbols, is rejected. The same check guards
+`getservers`' `req` and the nested `attrs` requirement dict. This is enforced at
+registration: the column is a general list, so a non-dict used to register happily and then surface
+much later, in a different function, as a raw unlogged `'type` from `attributematch`'s `key avail` —
+and if the *first* registration was malformed the column took that value's type and every subsequent
+well-formed registration failed too.
+
+`addserversfromtable` requires an **unkeyed** table and skips handles that are already active. Pass `` `ALL `` as `proctypes` to register all process types. The `conntable` must have columns `w` (int handle), `proctype` (symbol), `attributes` (dict per row); `procname` and `hpup` are optional.
+
+```q
+/ register on connect
+srvsel.addserverattr[h; getproctype[h]; getattributes[h]]
+
+/ mark inactive on disconnect - stamps disconnecttime
+srvsel.setserveractive[h; 0b]
+
+/ bulk registration from TorQ connection table
+srvsel.addserversfromtable[`rdb`hdb; .servers.SERVERS]
+
+/ purge servers that disconnected over an hour ago
+srvsel.removeinactive[0D01:00]
+```
+
+### Handle-level vs registration-level activation
+
+Several registrations may share one physical handle — the same connected process advertising more
+than one servertype. The two activation functions cover the two different things a caller means:
+
+| | Keys on | Use when |
+|---|---|---|
+| `setserveractive[h;a]` | `handle` — affects **every** registration on it | The socket itself went away. A closed handle really does take everything on it down together, so this is what a `.z.pc` disconnect handler calls |
+| `setserveridactive[sid;a]` | `serverid` — affects **exactly one** | Pulling a single servertype out of routing while its handle siblings keep serving |
+
+Both stamp and clear `disconnecttime` identically, so a registration retired either way ages out of
+`removeinactive` on the same terms. `selector`/`updatestats` already key on `serverid` precisely
+because a handle may be shared; `setserveridactive` closes the same gap for activation. Like
+`setserveractive`, an unmatched id is a no-op rather than an error.
+
+```q
+/ pull one servertype out of routing; the sibling on the same socket keeps serving
+srvsel.setserveridactive[sid; 0b]
+
+/ the socket dropped - retire everything on it
+srvsel.setserveractive[h; 0b]
+```
+
+`setserveractive[h;0b]` only flips a flag — the row stays in the table so the server's history and
+attributes survive a reconnect. Without a purge, a process that connected once and never came back
+would sit in the registry forever, so `removeinactive[age]` deletes inactive rows whose
+`disconnecttime` is more than `age` in the past. Active rows and rows still inside the age window are
+untouched, and reactivating a server clears its `disconnecttime` so it can never be purged while up.
+
+`age` must be a **non-null, non-negative** timespan. `0Wn` is accepted and means *retain forever* —
+it short-circuits rather than reaching the comparison, because `disconnecttime+0Wn` overflows the
+timestamp range (wrapping back to the year 1734), which would make every inactive row compare as aged
+out. `0Nn` is rejected for the same reason (`disconnecttime+0Nn` is `0Np`, and every timestamp is
+greater than null). Both are exactly the values a caller reaches for to mean "don't purge", so both
+are handled explicitly rather than left to do the opposite.
+
+`removeinactive` is **caller-invoked** — this module takes no `timer` dependency, in line with
+`di.asyncdispatch.removeinactive`. `di.torq` schedules it, passing the configured
+`clearinactivetime`. Both the stamping and the age comparison go through the injected `cp`, so a
+caller on a simulated clock — or a test — gets consistent behaviour without sleeping.
+
+---
+
+### Query and Selection
+
+| Function | Description |
+|---|---|
+| `getservers[nameortype;lookups;req]` | Return active servers matching a servertype or procname filter, with per-attribute match scoring |
+| `selector[servertable;selection]` | Pick one row from a server table using a selection strategy |
+| `getserverbytype[ptype;col;sel]` | Return one column value for a servertype using the given strategy; updates `lastp` and `hits` |
+| `gethandlebytype[ptype;sel]` | Convenience projection of `getserverbytype` returning `handle` |
+| `gethpbytype[ptype;sel]` | Convenience projection of `getserverbytype` returning `hpup` |
+| `setselector[f]` | Replace the strategy `getserverbytype` uses to pick one row from the candidate table |
+
+`getservers` returns a table including an `attribmatch` column — a dictionary of `attrname!(complete_match_bool;matched_values)` per attribute key in `req`. When `lookups` is not `` ` ``, `nameortype` must be `` `servertype `` or `` `procname ``; any other value throws (and logs) a `di.serverselect:` error rather than silently falling through to a `procname` lookup.
+
+All `di.serverselect:` error conditions — including the input-type checks on `addserverfull`/`setserveractive` and the connection-table column check on `addserversfromtable` — are logged via `.z.m.logerr` before being signalled.
+
+`selector` supports three strategies:
+
+| Strategy | Behaviour |
+|---|---|
+| `` `roundrobin `` | Pick server with the oldest `lastp` (least recently used) |
+| `` `any `` | Pick a random server |
+| `` `last `` | Pick server with the newest `lastp` (most recently used) |
+
+`selector` expects a non-empty table; called on an empty table it returns a row of nulls (e.g. a null `handle`). The `getserverbytype`/`gethandlebytype`/`gethpbytype` helpers guard against this and return `()` when no active server matches the requested type.
+
+```q
+/ get a handle, round-robin across rdbs
+srvsel.gethandlebytype[`rdb; `roundrobin]
+
+/ get host/port for an hdb
+srvsel.gethpbytype[`hdb; `roundrobin]
+```
+
+`getserverbytype` dispatches through a **live** strategy pointer rather than calling `selector`
+directly, so `setselector` can replace the choice at run time — for a weighted or load-aware policy,
+say — without patching the module. `selector` itself is untouched by this: it stays exported, stays
+the default, and pass it back to `setselector` to restore it.
+
+```q
+/ install a load-aware strategy
+srvsel.setselector[{[servertable;selection] first `myload xasc servertable}]
+
+/ restore the built-in default
+srvsel.setselector[srvsel.selector]
+```
+
+A strategy must be **binary** — `{[servertable;selection] …}` — and return a row containing
+`serverid`. `setselector` checks the arity **where the mistake is** rather than letting it throw
+`'rank` from inside the module at the next `getserverbytype`. The check reads a lambda's parameter
+list, and a projection's remaining arity as its underlying rank minus the arguments already supplied
+— so capturing a value by trailing partial application works as expected:
+
+```q
+srvsel.setselector[{[h;servertable;selection] first select from servertable where handle=h}[myhandle]]
+```
+
+Primitives, compositions and adverb-derived functions report no arity in q, so they are **accepted**
+rather than guessed at — the check declines to apply rather than rejecting a valid strategy.
+
+`setselector` also rejects a non-function argument, and requires `init` first (it used to accept a
+strategy before `init` and then have it silently overwritten by `init`'s reseed). Note that a re-init
+discards a custom strategy.
+
+---
+
+### Server ID Lookup
+
+```q
+srvsel.getserverids[att]
+```
+
+Returns server IDs matching a servertype list or attribute requirement dictionary. Used as the primary dispatch input — pass the result to your async or sync query handler to target specific servers.
+
+#### Symbol list path
+
+Pass a symbol or symbol list of servertypes. Validates that all requested types are registered and currently active.
+
+```q
+srvsel.getserverids[`rdb]
+srvsel.getserverids[`rdb`hdb]
+```
+
+Throws if any requested type is null, unregistered, or all-inactive.
+
+#### Attribute dict path
+
+Pass a dictionary of attribute requirements. Servers whose attribute dictionaries satisfy the requirements are returned. Each requirement value must be an **atom or a simple (flat) vector** of the attribute's type — a nested/general-list value (e.g. from a stray `enlist`, giving `` `date!enlist enlist 2024.01.01 2024.01.02 ``) is rejected with a clear `di.serverselect:` error rather than failing deep in the matcher.
+
+An **atom** requirement value is promoted to a one-element list internally, so the two forms below
+are equivalent and return identical results. (`getservers` always accepted an atom; before this the
+`getserverids` path threw a raw, unlogged `'rank` on the same input.)
+
+```q
+srvsel.getserverids[(enlist`date)!enlist 2024.01.01]        / atom
+srvsel.getserverids[(enlist`date)!enlist enlist 2024.01.01] / one-element list
+```
+
+The three control keys — `` `servertype ``, `` `besteffort `` and `` `attributetype `` — are
+type-checked before matching begins, and a wrong-typed or unrecognised value is a logged
+`di.serverselect:` error. They are **not** subject to the atom promotion above, so their type checks
+still bite.
+
+#### Two request shapes — flat and nested
+
+In the **flat** form above, control keys sit alongside the attribute requirements, so those three
+names are reserved: a server may legitimately *advertise* an attribute called `` `besteffort `` and
+`getservers` will score it normally, but `getserverids` intercepts the name as a control key.
+
+The **nested** form removes the collision entirely. An `` `attrs `` key holds the requirements
+explicitly, leaving the rest of the dict to the controls — so an attribute may carry **any** name,
+control names included:
+
+```q
+/ match a server attribute that is genuinely called `besteffort, with a besteffort CONTROL of 0b
+srvsel.getserverids[`attrs`besteffort!((enlist`besteffort)!enlist enlist`EU; 0b)]
+
+/ requirements and a servertype scope, no reserved names
+srvsel.getserverids[`attrs`servertype!((enlist`date)!enlist 2024.01.01; `hdb)]
+```
+
+Both forms are supported and behave identically for non-colliding names; `attrs` is the way out when
+an attribute name would clash. Atom promotion applies inside `attrs` exactly as in the flat form.
+
+**The nested form is strict about the top level.** Only `` `attrs `` and the three control keys may
+appear beside it; anything else is an error. This is deliberate asymmetry: in the flat form an
+unrecognised key is simply a requirement, but in the nested form every non-`attrs` key is a control,
+so an unknown one would be silently swallowed — dropping a requirement a half-migrated caller left
+outside `attrs`, or ignoring a mistyped `besteffor`. The flat form cannot have that problem, so the
+nested form is made strict to be no less safe.
+
+```q
+/ rejected: `date was left outside attrs and would otherwise vanish
+srvsel.getserverids[`attrs`date!((enlist`sym)!enlist`AAPL; 2024.01.09)]
+```
+
+A repeated servertype is resolved **once**: `` `servertype!`hdb`hdb `` returns the matching serverids
+in a single group, not two, so a caller dispatching on the result cannot query the same server twice.
+
+```q
+/ cross match (default): every date must be available for every sym
+srvsel.getserverids[`date`sym!(2024.01.01 2024.01.02; `AAPL`MSFT)]
+
+/ independent match: each date and sym just needs one server somewhere
+srvsel.getserverids[`date`sym`attributetype!(2024.01.01 2024.01.02; `AAPL`MSFT; `independent)]
+
+/ scope to specific servertypes then apply attribute filter
+srvsel.getserverids[`servertype`date!(`hdb; enlist 2024.01.01)]
+srvsel.getserverids[`servertype`date!(`hdb`rdb; enlist 2024.01.01)]
+
+/ strict mode: error if requirements cannot be fully satisfied
+srvsel.getserverids[`date`besteffort!(enlist 2024.01.01; 0b)]
+```
+
+##### Attribute matching strategies
+
+| `` `attributetype `` | Behaviour |
+|---|---|
+| `` `cross `` (default) | Every combination of attribute values must be coverable by a single server |
+| `` `independent `` | Each individual attribute value only needs to be matched by at least one server |
+
+The reserved key `` `besteffort `` (boolean, default `1b`) controls whether a partial match is acceptable. Set to `0b` to throw if requirements cannot be fully satisfied. It governs partial satisfaction **within** a single servertype's attribute match — it is a different axis from the multi-servertype tolerance described next.
+
+When `` `servertype `` names **several** types, each is resolved independently and a type that matches
+nothing is **tolerated**, not fatal: its miss is logged at `warn` naming the type, and the query
+returns whatever the other types matched. Only when *every* requested type comes back empty does
+`getserverids` log at `error` and signal. This is unconditional — there is no toggle for it.
+
+---
+
+### Module metadata
+
+| Export | Description |
+|---|---|
+| `version` | Module version string, read from the module's `VERSION` file at load |
+| `getapimeta[]` | Table of `` `name`public`descrip`params`return `` rows, one per callable export |
+
+`version` must stay in the export dictionary: `di.depcheck` resolves a dependency's version from
+there and classes a missing one as a **failure**, which stops any process that declares this module
+as a hard dependency from starting.
+
+`getapimeta[]` describes the **callable** api only. `init` and `getapimeta` are deliberately omitted
+— `di.torq` calls both by convention and they are startup plumbing, not part of the api surface
+`di.api` should advertise. The module declares this metadata but does **not** call `di.api.add`
+itself; collecting and registering it centrally is `di.torq`'s job.
+
+---
+
+## Design notes
+
+Recorded from the design and adversarial-review pass, so the reasoning survives the commit.
+
+### The attribute matcher is the risky part, and it is now tested directly
+
+`getserverscross`, `getserversindependent`, `getserversinitial` and `buildcross` implement
+combinatorial matching that cannot be verified by reading. Until this pass the whole suite reached
+them only *indirectly*, through `getserverids`' end-to-end behaviour, so a fully green suite was not
+evidence of correctness. `test.csv` now exercises them **directly** through the internal
+`.m.di.0serverselect.` path — they are deliberately **not** exported for this; internal-path access
+gives full test reachability without widening the public contract.
+
+Verified sound, against a running module rather than by inspection: empty requirements degrading to
+"any server of the type"; partial attribute coverage excluding only the servers actually missing a
+key; `besteffort` `0b`/`1b` divergence; best-match ranking genuinely preferring the widest server
+rather than the first candidate found; a single server covering several combinations being returned
+once, not duplicated; three-way cross products; `independent` mode; duplicate identical servers;
+inactive exclusion; and the empty registry.
+
+### Three defects the review found, and how each was fixed
+
+All three fixes sit at the **boundary** in `getserverids`. The matching engine itself is unchanged.
+
+| | Defect | Fix |
+|---|---|---|
+| **F1** | A multi-servertype request aborted entirely if *any* one type matched nothing, discarding perfectly good matches from the others | Each type is now resolved under its own protected apply; a miss is logged at `warn` and returns empty, and only an all-types miss errors |
+| **F2** | An **atom** requirement value threw a raw, unlogged `'rank` — while `getservers` accepted the same input happily | `normreq` promotes atom values to one-element lists before matching, so both forms behave identically |
+| **F3** | `besteffort` and `attributetype` were silently ignored when wrong-typed: `besteffort:0` (int) kept the `1b` default, and an unknown `attributetype` fell back to cross matching | Both are type- and value-checked at the boundary, and a bad value is a logged error |
+
+**F1 is a design decision, not merely a bug fix.** The evidence that tolerance was the original
+intent is that `getserverids`' own all-empty guard was **unreachable** — `getserveridstype` threw
+before it could ever return empty — so the guard could only have been written for a fan-out that was
+expected to tolerate per-type misses. On that basis the tolerance is **unconditional**: there is no
+toggle for it, and none was added. Note this is a *different axis* from `besteffort`, which governs
+partial satisfaction within one servertype's attribute match; the two are name-adjacent but not the
+same knob.
+
+The accepted tradeoff: a future bug inside the engine, on the multi-type path, would surface as a
+warn-and-no-match rather than a throw. The error text is preserved verbatim in the warning, and the
+call still fails overall when every type misses, so nothing is silently swallowed.
+
+**F3's placement is deliberate.** The control keys are validated in `getserverids`, *before* the
+fan-out, and not inside `getserveridstype`. Because F1 wraps each per-type call in a protected apply,
+an error raised deeper down would be caught and downgraded into a "this servertype did not match"
+warning. A wrong-typed control key is categorically not a per-type miss and must stay loud, so the
+check has to happen at the boundary.
+
+### Error logging: raiseerror at the boundary, plain signals in the engine
+
+Public functions route domain errors through `raiseerror`, which logs at `error` under the calling
+function's name and then signals — so a failure is observable in the log, not only as a thrown
+exception a caller might swallow. `init` is the exception: it signals with a plain `'` because the
+logger is not wired yet while it runs.
+
+The matching engine's internal "no match" conditions instead use `signalnomatch`, which signals
+**without** logging. These are *outcomes*, not faults, and `getserverids` decides the level: `warn`
+for a per-servertype miss that other types may cover, `error` via `raiseerror` only when the whole
+request fails. Logging inside the engine would emit an ERROR line for every routine partial match on
+a multi-servertype query, which is exactly the noise an operator greps for.
+
+### Smoke-test findings — fixed
+
+A second adversarial pass over the finished module found four more defects, all fixed and covered by
+regression rows in `test.csv`:
+
+| | Defect | Fix |
+|---|---|---|
+| **F4** | `attributes` was never validated. A non-dict registered happily, then threw a raw unlogged `'type` at *query* time from `attributematch`. If the **first** registration was malformed the column took that value's type and every later well-formed registration failed too | `addserverfull` requires a dictionary |
+| **F5** | `removeinactive[0Wn]` — infinite age, i.e. "never purge" — **deleted every inactive server**, because `disconnecttime+0Wn` overflows the timestamp range and wraps to the year 1734. `0Nn` did the same via `0Np` | `0Wn` short-circuits as a no-op; null and negative ages are rejected |
+| **F6** | A repeated servertype (`` `hdb`hdb ``) was resolved twice, returning the same serverids in two groups, so a caller dispatching on the result would query the same server twice. The symbol path already deduped; the two disagreed | `distinct` applied to the servertype list |
+| **F7** | The single-servertype/`` `all `` path had been routed through the tolerant fan-out, replacing the engine's specific wording with a generic message and logging a spurious `warn` | That path uses `raisecaught`: logged once at `error`, re-signalled verbatim |
+
+### Handle/serverid activation asymmetry — resolved, not deferred
+
+`updatestats` keys on `serverid` and comments explicitly that a handle "may be shared by multiple
+servers", but `setserveractive` keyed on `handle` — so there was no way to retire one registration
+without taking its handle siblings down with it, and nothing in the design said whether that should
+be possible. Rather than carry this as an open question into `di.torq`'s `.z.pc` wiring — the moment
+it stops being hypothetical and starts firing on real connection churn — `setserveridactive` was
+added. `setserveractive` is unchanged: handle-level bulk retirement is still the correct shape for a
+genuine disconnect, and is still what that future handler will call.
+
+### Second-pass constraints — all resolved
+
+The smoke-test pass logged five constraints as "not changed"; all five have since been closed.
+
+| Constraint | Resolution |
+|---|---|
+| Activation keyed on `handle`, selection on `serverid` | `setserveridactive` added; `setserveractive` unchanged |
+| No `requireinit` guard | Every public entry point guards and names itself; `version`/`getapimeta` deliberately exempt |
+| `setselector` arity unchecked | Checked at the call site for lambdas and projections; undeterminable types accepted rather than guessed |
+| Three attribute names reserved | The nested `attrs` request shape removes the collision; the flat form is unchanged |
+| Cross-product cost unbounded | `maxcrossproduct` (default 1,000,000, `0W` to disable) checked before the product is built |
+
+Two things worth keeping in mind while reading those:
+
+- The `` `attrs `` form is **additive**. The flat form's reserved names are unchanged, so nothing that
+  worked before behaves differently — `attrs` is an opt-in escape hatch, not a migration.
+- The arity check **declines to apply** rather than rejecting when q reports no arity. That is the
+  deliberate trade: a primitive or composition strategy is accepted unchecked, because rejecting a
+  valid strategy is worse than missing an invalid one the next call would catch anyway.
+
+### Third-pass findings — fixed
+
+A further smoke-test pass, aimed squarely at the code the second pass added, found three more:
+
+| | Defect | Fix |
+|---|---|---|
+| **G1** | In the nested `attrs` form every non-`attrs` top-level key was treated as a control, so an unknown one was **silently swallowed** — a requirement left outside `attrs` vanished, and a mistyped `besteffor` was ignored. The flat form errors on the same input, so the new shape was *less* safe than the old one | Unknown top-level keys are rejected |
+| **G2** | `selectorarity` returned null for a projection **of** a projection, so an arity-1 nested projection was accepted and would throw `'rank` later | Resolves the underlying rank recursively |
+| **G3** | A **keyed table is also type `99h`**, so the F4 attributes check let one through; likewise a dictionary keyed on non-symbols, which reached the matcher and produced a raw `'length` | `requiredict` tests the key type, and is shared by `attributes`, `attrs` and `getservers`' `req` |
+
+G1 is the one worth remembering: it was introduced *by the fix for F11*, in the same class of bug F3
+existed to eliminate. A new request shape inherits none of the old shape's safety properties for free.
+
+### q gotchas worth not rediscovering
+
+- **`$` inside q-sql is the dyadic cast operator, not the `cond` special form.** An inline
+  `update disconnecttime:$[a;0Np;.z.m.cp[]] from ...` throws `'rank`. `setserveractive` hoists the
+  conditional out of the `update` for this reason.
+- **`type` is `99h` for a keyed table as well as a dictionary**, and the empty dict `()!()` keys on an
+  empty *general* list (`0h`), not on an empty symbol vector. A "symbol-keyed dictionary" check that
+  tests only `11h=type key d` therefore rejects the most common value there is.
+- **A strategy function passed to `setselector` is invoked from inside the module**, where a bare
+  name resolves against the module's own `.z.m` rather than the caller's root namespace. Capture any
+  value the strategy needs by projection rather than reading it from a global — `integration.q`'s
+  pinned-handle strategy does this, and reads as `'type` if you don't.
+
+---
+
+## Example
+
+```q
+/ load and initialise - init must be called before any other function
+/ pass an already-binary `info`warn`error logger (from di.log or hand-rolled)
+srvsel:use`di.serverselect
+logger:use`di.log
+srvsel.init[enlist[`log]!enlist `info`warn`error!(logger.info;logger.warn;logger.error)]
+
+/ register servers as they connect / mark inactive on disconnect
+/   on connect:    srvsel.addserverattr[h; getproctype[h]; getattributes[h]]
+/   on disconnect: srvsel.setserveractive[h; 0b]
+
+/ bulk register from TorQ stack on startup
+srvsel.addserversfromtable[`rdb`hdb; .servers.SERVERS]
+
+/ get server IDs for a query by servertype
+serverids:srvsel.getserverids[`rdb`hdb]
+
+/ get server IDs by attribute requirement
+serverids:srvsel.getserverids[`date`sym!(enlist 2024.01.01; enlist `AAPL)]
+
+/ get a handle directly (round-robin across rdbs)
+h:srvsel.gethandlebytype[`rdb; `roundrobin]
+
+/ inspect registered server pool
+srvsel.getserverstable[]
+```
+
+---
+
+## Testing
+
+Both test suites require KDB-X (the `use` module system). Set `QPATH` so `di.*` and `kx.*` modules resolve — it must include this repository and the `kx` module directory:
+
+```bash
+export QPATH=/path/to/kx/mod:/path/to/kdbx-modules
+```
+
+### Unit tests (k4unit)
+
+`test.csv` is a k4unit manifest covering every exported function. Run it from a q session (or script):
+
+```q
+k4unit:use`di.k4unit;
+k4unit.moduletest`di.serverselect;   / prints the results table; "All tests passed" on success
+```
+
+The `before` rows load the module and `init` it with a no-op logger, so the tests run standalone with no external logging framework.
+
+Beyond the public api, the suite reaches the matching engine directly on the internal
+`.m.di.0serverselect.` path (`getserveridstype`, `getserversinitial`, `buildcross`) and overrides
+`.m.di.0serverselect.cp` to fast-forward the clock for the `removeinactive` tests rather than
+sleeping. A capturing logger is injected where the *level* of a message is the thing under test —
+notably that a tolerated per-servertype miss logs at `warn` and emits no `error` line.
+
+### Integration test
+
+`integration.q` is an end-to-end test that drives every exported function against **real backend processes**. It spawns a fleet of child `q` listeners, opens genuine IPC handles to them, and exercises a realistic gateway lifecycle (register → query → select → **route a live query to the selected handle** → bulk-register → disconnect → error handling → init). Because the handle returned by `gethandlebytype`/`getserverids` is actually queried, the assertions prove queries reach the *expected* backend process — e.g. round-robin alternates between the live rdbs, attribute selection routes to the hdb whose attributes match, and a killed/deactivated server drops out of selection. Run it directly:
+
+```bash
+QPATH=/path/to/kx/mod:/path/to/kdbx-modules q integration.q
+```
+
+It exits with a non-zero code equal to the number of failed assertions (`0` when all pass), and prints a `PASS`/`FAIL` summary.
+
+The test is self-contained — no helper files: child backends are bare `q` listeners whose identity and `ping` api are injected over IPC, and the test launches and tears them down itself (cleanup is guaranteed via `.z.exit`, even on failure). It additionally requires:
+
+- a `q` on `PATH` to launch the child listeners (override with `$QBIN`);
+- some free TCP ports. There are **no hardcoded ports**: the test derives a base from its own pid (so concurrent runs don't collide) and scans upward for ports that are actually free. Set `$SSPORT` to pin the base if you need a known range.
diff --git a/di/serverselect/serverselect.q b/di/serverselect/serverselect.q
new file mode 100644
index 00000000..8b7cffd3
--- /dev/null
+++ b/di/serverselect/serverselect.q
@@ -0,0 +1,518 @@
+/ library for selecting backend servers from a registered pool based on servertype or attribute requirements
+
+/ registered server pool - populated by addserverfull / addserverattr / addserver
+servers:([serverid:`u#`int$()]
+  handle:`int$();
+  procname:`symbol$();
+  servertype:`symbol$();
+  hpup:`symbol$();
+  active:`boolean$();
+  lastp:`timestamp$();
+  hits:`int$();
+  attributes:();
+  disconnecttime:`timestamp$());
+
+/ autoincrement counter for server IDs
+serverid:0i;
+
+/ attribute-requirement keys that steer the matcher rather than name a server attribute
+ctrlkeys:`servertype`attributetype`besteffort;
+
+raiseerror:{[ctx;msg]
+  / internal - log an error under ctx then signal it, so failures are observable as well as thrown
+  .z.m.logerr[ctx;msg];
+  '"di.serverselect: ",string[ctx],": ",msg;
+  };
+
+signalnomatch:{[ctx;msg]
+  / internal - signal a no-match CONDITION from the matching engine WITHOUT logging. a miss is not a
+  / fault: getserverids decides the level, logging a per-servertype miss at warn (another requested
+  / type may still match) and an all-types miss at error via raiseerror. logging here instead would
+  / emit an ERROR line for every routine partial match on a multi-servertype query
+  '"di.serverselect: ",string[ctx],": ",msg;
+  };
+
+requiredict:{[ctx;nm;d]
+  / internal - insist on a genuine SYMBOL-KEYED dictionary, not merely something of type 99h.
+  / a keyed table is 99h too, so a bare type check lets one through; it then reaches attributematch's
+  / `key avail` and yields garbage scoring or a raw 'length rather than a clear error. a symbol-keyed
+  / dict is the only shape the matcher can use, and a keyed table's key is a TABLE (98h), so the one
+  / key-type test excludes both a keyed table and a dict keyed on anything but symbols
+  / NB the empty dict ()!() keys on an empty GENERAL list (type 0h), not on an empty symbol vector,
+  / so an 11h-only test would reject the single most common attributes value there is
+  if[99h<>type d;raiseerror[ctx;nm," must be a dictionary; got type ",string type d]];
+  if[not $[0=count k:key d;not 98h=type k;11h=type k];
+    raiseerror[ctx;nm," must be a symbol-keyed dictionary; got keys of type ",string type k]];
+  };
+
+requireinit:{[ctx]
+  / internal - every public entry point needs init to have run first. without this guard a bare read
+  / of an unwritten .z.m name surfaces as a raw '.m.di.0serverselect.<name> error, leaking the mangled
+  / internal namespace to the caller instead of naming the actual problem. signals plainly rather than
+  / via raiseerror - there is no logger to log through yet.
+  / getapimeta is deliberately NOT guarded: it is pure data and di.torq collects it at startup, which
+  / may be before this module's init has run
+  if[not `logerr in key .z.m;'"di.serverselect: ",string[ctx],": init must be called first"];
+  };
+
+selectorarity:{[f]
+  / internal - arity of f WHERE Q CAN TELL, else 0N.
+  / a lambda reports its own parameter list. a projection's REMAINING arity is its underlying
+  / function's rank minus the arguments already supplied - counting elided (::) placeholders alone is
+  / wrong, because a trailing partial application such as f[x] carries none at all and would read as
+  / arity 0, rejecting a perfectly valid strategy. the underlying rank is resolved recursively so a
+  / projection OF a projection also works.
+  / primitives, compositions and adverb-derived functions report nothing usable, so they yield 0N and
+  / the caller accepts them unchecked - admitting the check does not apply beats rejecting valid input
+  :$[100h=type f; count value[f]1;
+     104h=type f; $[null b:selectorarity first value f;
+                     0N;
+                     b-count where not (::)~/:1_value f];
+     0N];
+  };
+
+getopt:{[deps;k;dflt]
+  / internal - read an optional config key from the deps dict, falling back to a default
+  $[k in key deps;deps k;dflt]
+  };
+
+checkopt:{[deps;k;ok;what]
+  / internal - validate an optional config value's TYPE at init, so a misconfiguration fails loudly
+  / at startup instead of silently at first use
+  if[k in key deps;
+    if[not ok deps k;'"di.serverselect: ",string[k]," must be ",what]];
+  };
+
+init:{[deps]
+  / wire the injected logger - required, no silent fallback - and the optional config.
+  / deps keys:
+  /   log               (required) `info`warn`error!{[c;m]} dict - binary, already conforming.
+  /                     a raw monadic kx.log instance is NOT adapted here and will 'rank at first use
+  /   cp                (optional) current-time fn, default {.z.p}. stamps disconnecttime and drives
+  /                     removeinactive; override it to fast-forward in tests without sleeping
+  /   clearinactivetime (optional) timespan, default 0D01:00. NOT read by any function here -
+  /                     removeinactive is caller-invoked, so this is the age di.torq passes it when
+  /                     it schedules the purge, mirroring di.dataaccess's requestkeeptime
+  /   maxcrossproduct   (optional) long, default 1000000. upper bound on the requirement cross
+  /                     product getserverids builds when cross matching, checked before it is built -
+  /                     cost is the PRODUCT of the requirement value counts, so a gateway forwarding
+  /                     client-supplied requirements can get very large very cheaply. 0W disables it
+  / e.g. di.serverselect.init[enlist[`log]!enlist logdep]
+  if[99h<>type deps;
+    '"di.serverselect: deps must be a dict with `log key"];
+  if[not `log in key deps;
+    '"di.serverselect: log dependency is required; pass `info`warn`error functions keyed on `log"];
+  if[99h<>type deps`log;
+    '"di.serverselect: log value must be a dict; pass `info`warn`error functions"];
+  if[not all (`info`warn`error) in key deps`log;
+    '"di.serverselect: log dict must have `info`warn`error keys; got: ",(", " sv string key deps`log)];
+  checkopt[deps;`cp;{type[x] within 100 112h};"a function"];
+  checkopt[deps;`clearinactivetime;{-16h=type x};"a timespan"];
+  checkopt[deps;`maxcrossproduct;{(-7h=type x) and 0<x};"a positive long"];
+  .z.m.loginfo:deps[`log]`info;
+  .z.m.logwarn:deps[`log]`warn;
+  .z.m.logerr:deps[`log]`error;
+  .z.m.cp:getopt[deps;`cp;{.z.p}];
+  .z.m.clearinactivetime:getopt[deps;`clearinactivetime;0D01:00];
+  .z.m.maxcrossproduct:getopt[deps;`maxcrossproduct;1000000];
+  / seed the live selection strategy from the built-in default; setselector replaces it at runtime
+  .z.m.selector:selector;
+  };
+
+nextserverid:{
+  / internal - increment and return the next unique server ID
+  .z.m.serverid:serverid+1i;
+  :.z.m.serverid;
+  };
+
+updatestats:{[sid]
+  / internal - update last-access timestamp and hit count for a single server
+  / keyed on serverid (unique) rather than handle, which may be shared by multiple servers
+  .z.m.servers:update lastp:.z.p,hits:hits+1i from servers where serverid=sid;
+  };
+
+addserverfull:{[h;pname;st;hp;att]
+  / register a server with full details: handle, procname, servertype, hpup and attribute dictionary
+  requireinit`addserverfull;
+  if[not -6h=type h;raiseerror[`addserverfull;"handle must be an int; got type ",string type h]];
+  if[not -11h=type st;raiseerror[`addserverfull;"servertype must be a symbol; got type ",string type st]];
+  / attributes MUST be a dict. the column is a general list, so a non-dict registers happily and then
+  / surfaces much later, in a different function, as a raw unlogged 'type from attributematch's
+  / `key avail`. worse, if the very first registration is malformed the column takes that value's
+  / type and every subsequent well-formed registration fails too
+  requiredict[`addserverfull;"attributes";att];
+  .z.m.loginfo[`addserverfull;"registering server: handle=",(string h),", procname=",string[pname],", type=",string st];
+  .z.m.servers:servers upsert (nextserverid[];h;pname;st;hp;1b;0Np;0i;att;0Np);
+  };
+
+addserverattr:{[h;st;att]
+  / register a server with servertype and attributes; procname and hpup default to null
+  addserverfull[h;`;st;`;att];
+  };
+
+addserver:{[h;st]
+  / register a server with no attributes; procname and hpup default to null
+  addserverfull[h;`;st;`;()!()];
+  };
+
+setserveractive:{[h;a]
+  / mark a registered server active (1b) or inactive (0b); called on connect and disconnect.
+  / stamps disconnecttime on the active->inactive transition and clears it on reactivation, so
+  / removeinactive can age out servers that disconnected and never came back
+  requireinit`setserveractive;
+  if[not -6h=type h;raiseerror[`setserveractive;"handle must be an int; got type ",string type h]];
+  if[not -1h=type a;raiseerror[`setserveractive;"active flag must be a boolean; got type ",string type a]];
+  .z.m.loginfo[`setserveractive;"marking handle=",(string h)," active=",string a];
+  / the conditional is hoisted OUT of the update deliberately: inside q-sql, $ resolves as the dyadic
+  / cast operator rather than the cond special form, so an inline $[a;0Np;.z.m.cp[]] throws 'rank
+  dtime:$[a;0Np;.z.m.cp[]];
+  .z.m.servers:update active:a,disconnecttime:dtime from servers where handle=h;
+  };
+
+setserveridactive:{[sid;a]
+  / mark ONE registration active/inactive by serverid, independent of any other servertype sharing
+  / the same physical handle. setserveractive keys on handle and is the right shape for a genuine
+  / disconnect - a closed handle really does take every registration on it down together - but it
+  / cannot express "pull just this servertype out of routing". updatestats already keys on serverid
+  / precisely because a handle may be shared; this closes the same gap for activation.
+  / stamps and clears disconnecttime exactly as setserveractive does, so removeinactive ages a
+  / registration retired this way out on the same terms
+  requireinit`setserveridactive;
+  if[not -6h=type sid;raiseerror[`setserveridactive;"serverid must be an int; got type ",string type sid]];
+  if[not -1h=type a;raiseerror[`setserveridactive;"active flag must be a boolean; got type ",string type a]];
+  .z.m.loginfo[`setserveridactive;"marking serverid=",(string sid)," active=",string a];
+  / hoisted out of the update for the same reason as setserveractive - $ is the cast operator in q-sql
+  dtime:$[a;0Np;.z.m.cp[]];
+  / no existence check: an unmatched serverid is a natural no-op, matching setserveractive's own
+  / established behaviour on an unregistered handle. do not add asymmetric strictness here
+  .z.m.servers:update active:a,disconnecttime:dtime from servers where serverid=sid;
+  };
+
+removeinactive:{[age]
+  / purge inactive servers that disconnected more than age ago, to bound growth of the server table.
+  / setserveractive[h;0b] only flips a flag, so without this a process that connected once and went
+  / away stays in the table forever. caller-invoked - di.torq schedules it with clearinactivetime
+  requireinit`removeinactive;
+  if[not -16h=type age;raiseerror[`removeinactive;"age must be a timespan; got type ",string type age]];
+  if[null age;raiseerror[`removeinactive;"age must not be null"]];
+  if[age<0D;raiseerror[`removeinactive;"age must not be negative; got ",string age]];
+  / 0Wn means "retain forever" and MUST short-circuit: it cannot be expressed by the comparison below,
+  / because disconnecttime+0Wn overflows the timestamp range (wrapping back to the year 1734), so every
+  / inactive row would compare as aged out - the exact opposite of an infinite retention. 0Nn is
+  / rejected above for the same reason: disconnecttime+0Nn is 0Np, and cp[]>0Np is true for everything
+  if[0Wn=age;:()];
+  .z.m.servers:delete from servers where not active,not null disconnecttime,.z.m.cp[]>disconnecttime+age;
+  };
+
+getserverstable:{[]
+  / return the current registered server table
+  requireinit`getserverstable;
+  :servers;
+  };
+
+addserversfromtable:{[proctypes;conntable]
+  / register active servers from a connection table filtered by proctype
+  / conntable must have columns: w (int handle), proctype (symbol), attributes (dict per row)
+  / optional columns: procname (symbol), hpup (symbol) - populated from conntable if present
+  / pass proctypes:`ALL to register all process types
+  requireinit`addserversfromtable;
+  / unkeyed table required: cols works on a keyed table but the select below does not, so without
+  / this the caller gets a raw 'type instead of a message naming the argument
+  if[not 98h=type conntable;
+    raiseerror[`addserversfromtable;"conntable must be an unkeyed table; got type ",string type conntable]];
+  if[not all `w`proctype`attributes in cols conntable;
+    raiseerror[`addserversfromtable;
+      "conntable must have columns w, proctype and attributes; got: ",", " sv string cols conntable]];
+  activehandles:(0i;0Ni),exec handle from servers where active;
+  rows:select from conntable where
+    ((proctype in proctypes) or proctypes~`ALL),
+    not w in activehandles;
+  .z.m.loginfo[`addserversfromtable;"registering ",(string count rows)," servers from connection table"];
+  pnames:$[`procname in cols rows; rows`procname; count[rows]#`];
+  hpups:$[`hpup in cols rows; rows`hpup; count[rows]#`];
+  addserverfull'[rows`w;pnames;rows`proctype;hpups;rows`attributes];
+  };
+
+attributematch:{[req;avail]
+  / compute match result for each key in req against what avail advertises
+  / returns dict of attrname!(complete_match_bool;matched_values) for each required attribute key
+  / keys present in req but absent in avail return (0b;())
+  vals:key[req] inter key avail;
+  notpresent:noval!(count noval:key[req] except key avail)#enlist(0b;());
+  :notpresent,vals!{($[0>type y;x~y;all x in y];(x,()) inter y,())}'[req vals;avail vals];
+  };
+
+getservers:{[nameortype;lookups;req]
+  / look up active servers by servertype or procname with per-attribute match scoring
+  / nameortype: `servertype or `procname; pass ` as lookups to return all active servers
+  / req: attribute requirements dict - use ()!() for no attribute filtering
+  / returns table with attribmatch column showing (complete_bool;matched_values) per attribute key
+  requireinit`getservers;
+  if[(not `~lookups) and not nameortype in `servertype`procname;
+    raiseerror[`getservers;"nameortype must be `servertype or `procname; got: ",string nameortype]];
+  requiredict[`getservers;"req";req];
+  r:$[`~lookups;
+    select serverid,procname,servertype,hpup,handle,lastp,attributes from servers where active;
+    nameortype~`servertype;
+    select serverid,procname,servertype,hpup,handle,lastp,attributes from servers where active,servertype in lookups;
+    select serverid,procname,servertype,hpup,handle,lastp,attributes from servers where active,procname in lookups];
+  if[0=count r;:update attribmatch:attributes from r];
+  am:attributematch[req] each r`attributes;
+  :update attribmatch:am from r;
+  };
+
+selector:{[servertable;selection]
+  / pick one row from servertable using the given strategy
+  / selection: `roundrobin (least recently used), `any (random), `last (most recently used)
+  requireinit`selector;
+  if[not selection in `roundrobin`any`last;
+    raiseerror[`selector;"unknown selection strategy: ",string selection]];
+  :$[selection=`roundrobin; first `lastp xasc servertable;
+     selection=`any;        rand servertable;
+     last `lastp xasc servertable];
+  };
+
+setselector:{[f]
+  / replace the strategy getserverbytype uses to pick one row from a candidate table.
+  / the built-in selector stays exported and unchanged - pass it back here to restore the default
+  requireinit`setselector;
+  if[not type[f] within 100 112h;raiseerror[`setselector;"selector must be a function; got type ",string type f]];
+  / check arity HERE where the mistake is, not at the next getserverbytype. a monadic or niladic
+  / strategy used to be accepted happily and then throw a bare 'rank from inside the module, far from
+  / the call site. 0N means q cannot report an arity for this function type, so it is accepted
+  ar:selectorarity f;
+  if[not null ar;
+    if[2<>ar;
+      raiseerror[`setselector;"selector must take 2 arguments (servertable;selection); got ",string ar]]];
+  .z.m.selector:f;
+  };
+
+getserverbytype:{[ptype;serverval;selection]
+  / return a single server attribute value for a servertype using the given selection strategy
+  / ptype: servertype symbol; serverval: column to return e.g. `handle or `hpup; selection: `roundrobin`any`last
+  / dispatches through the live .z.m.selector so setselector can override the strategy
+  requireinit`getserverbytype;
+  r:getservers[`servertype;ptype;()!()];
+  if[not count r;:()];
+  r:.z.m.selector[r;selection];
+  updatestats[r`serverid];
+  :r serverval;
+  };
+
+gethandlebytype:getserverbytype[;`handle;];
+gethpbytype:getserverbytype[;`hpup;];
+
+normreq:{[req]
+  / internal - promote atom attribute-requirement values to one-element lists, so a caller may write
+  / (enlist`date)!enlist 2024.01.01 as well as the enlist form. getservers already tolerates an atom
+  / via attributematch; without this the cross matcher threw a raw, unlogged 'rank on the same input.
+  / req is PURE requirements by this point - control keys are split off at the boundary - so every
+  / value is promoted, including one whose key happens to be spelled like a control key
+  :(key req)!{(),x} each value req;
+  };
+
+raisecaught:{[ctx;msg]
+  / internal - log an error the engine already prefixed, then re-signal it VERBATIM. the engine's own
+  / text ("no servers match hdb requested attributes") is more specific than anything composed here,
+  / and signalnomatch deliberately does not log - the boundary decides the level. used on the
+  / single-servertype path, where there is nothing to tolerate: one type missing IS the whole answer
+  .z.m.logerr[ctx;msg];
+  'msg;
+  };
+
+fanoutids:{[req;besteffort;attype;typ]
+  / internal - resolve one servertype's ids, tolerating a miss. a miss is NOT a query failure: another
+  / requested type may match, and getserverids errors only when every type comes back empty. this
+  / revives getserverids' all-empty guard, which was unreachable while this call threw instead
+  :@[getserveridstype[req;besteffort;attype;];typ;
+    {[t;e] .z.m.logwarn[`getserverids;"no servers matched servertype ",string[t],": ",e];()}[typ]];
+  };
+
+getserverids:{[att]
+  / return server IDs matching a servertype list or attribute requirement dictionary
+  / att: symbol list of servertypes, or dict of attribute requirements (optionally keyed on `servertype)
+  / dispatch the symbol-list path to getserveridsbytype and the dict path to getserveridstype
+  requireinit`getserverids;
+  if[99h<>type att; :getserveridsbytype att];
+  / TWO request shapes. flat (the original): control keys sit alongside the attribute requirements, so
+  / the three control names are reserved and an attribute cannot be called servertype/besteffort/
+  / attributetype. nested: an `attrs key holds the requirements EXPLICITLY, leaving the rest of the
+  / dict to the controls - which lets an attribute carry any name at all, control names included.
+  / both are supported; nested is the way out of the namespace collision, flat stays for compatibility
+  nested:`attrs in key att;
+  if[nested;
+    requiredict[`getserverids;"attrs";att`attrs];
+    / in the nested form EVERY top-level key that is not `attrs is a control, so an unrecognised one
+    / would be silently swallowed - dropping a requirement left outside attrs by a half-migrated
+    / caller, or ignoring a mistyped control. the flat form cannot have this problem (an unknown key
+    / there is simply a requirement), so the nested form has to be strict to stay as safe
+    if[count unknown:(key att) except `attrs,ctrlkeys;
+      raiseerror[`getserverids;"unknown keys beside attrs: ",(", " sv string unknown),
+        "; only attrs and the control keys belong at the top level of an attrs request"]]];
+  ctl:$[nested;`attrs _ att;(key[att] inter ctrlkeys)#att];
+  req:normreq $[nested;att`attrs;ctrlkeys _ att];
+  / controls are validated HERE, at the boundary, and never inside getserveridstype: the fan-out below
+  / runs under a protected apply, so an error raised deeper down is caught and downgraded to a "this
+  / servertype did not match" warning. a misconfigured request is categorically not a per-type miss and
+  / must stay loud. before this, besteffort:0 (int) silently kept the 1b default and an unknown
+  / attributetype silently fell back to cross matching
+  if[`servertype in key ctl;
+    if[not 11h=abs type ctl`servertype;
+      raiseerror[`getserverids;"servertype must be a symbol or symbol list; got type ",string type ctl`servertype]]];
+  if[`besteffort in key ctl;
+    if[not -1h=type ctl`besteffort;
+      raiseerror[`getserverids;"besteffort must be a boolean; got type ",string type ctl`besteffort]]];
+  if[`attributetype in key ctl;
+    if[not -11h=type ctl`attributetype;
+      raiseerror[`getserverids;"attributetype must be a symbol; got type ",string type ctl`attributetype]];
+    if[not (ctl`attributetype) in `cross`independent;
+      raiseerror[`getserverids;"attributetype must be `cross or `independent; got: ",string ctl`attributetype]]];
+  / a nested/general-list requirement value (type 0h) would crash the cross matcher with a raw 'type
+  if[count badkeys:(key req) where 0h=type each value req;
+    raiseerror[`getserverids;
+      "attribute requirement values must be atoms or simple vectors; nested/mixed for: ",", " sv string badkeys]];
+  besteffort:$[`besteffort in key ctl;ctl`besteffort;1b];
+  attype:$[`attributetype in key ctl;ctl`attributetype;`cross];
+  / bound the cross product before building it. cost is the PRODUCT of the requirement value counts, so
+  / a request a caller forwards straight from a client can get very large very cheaply. only cross
+  / matching builds it - independent matching is not combinatorial, so it is not bounded here.
+  / maxcrossproduct:0W disables the bound
+  / count req guard is NOT optional: prd of an empty list is () rather than 1, so an empty requirement
+  / dict would make the comparison return () and if[()] throw a raw 'type
+  if[attype=`cross;
+    if[.z.m.maxcrossproduct<sz:$[count req;prd count each value req;1];
+      raiseerror[`getserverids;"requirement cross product of ",(string sz)," exceeds maxcrossproduct ",
+        string .z.m.maxcrossproduct]]];
+  / distinct: a repeated servertype would otherwise be resolved twice and return the same serverids in
+  / two groups, so a caller dispatching on the result would query the same server twice. the symbol
+  / path (getserveridsbytype) already dedupes; these two paths disagreed before.
+  / the single-servertype/`all path does NOT go through the tolerant fan-out: there is no sibling type
+  / to fall back on, so its error is logged once and re-signalled with the engine's specific wording
+  serverids:$[`servertype in key ctl;
+    raze fanoutids[req;besteffort;attype] each distinct (),ctl`servertype;
+    @[getserveridstype[req;besteffort;attype];`all;raisecaught[`getserverids;]]];
+  if[all 0=count each serverids;
+    raiseerror[`getserverids;"no servers match requested attributes"]];
+  :serverids;
+  };
+
+getserveridsbytype:{[att]
+  / internal - resolve server IDs for a servertype symbol or symbol list
+  / validates each requested type is registered and currently active
+  requireinit`getserveridsbytype;
+  if[not 11h=abs type att;
+    raiseerror[`getserveridsbytype;"servertype must be a symbol list (11h) or attribute dict (99h)"]];
+  servertype:distinct att,();
+  activeservers:exec distinct servertype from servers where active;
+  allservers:exec distinct servertype from servers;
+  activeserversmsg:". available servers: ",", " sv string activeservers;
+  if[any null att;
+    raiseerror[`getserveridsbytype;"null servertype passed as argument",activeserversmsg]];
+  if[count servertype except activeservers;
+    raiseerror[`getserveridsbytype;$[max not servertype in allservers;
+        "not valid servers: ",", " sv string servertype except allservers;
+        "requested servers currently inactive: ",", " sv string servertype except activeservers
+      ],activeserversmsg]];
+  :(exec serverid by servertype from servers where active)[servertype];
+  };
+
+getserveridstype:{[req;besteffort;attype;typ]
+  / internal - filter active servers of one servertype by pure attribute requirements.
+  / control values arrive as explicit arguments: this function no longer parses them out of the
+  / requirement dict, which is what made the three control names unusable as attribute names
+  svrs:$[typ=`all;
+    exec serverid!attributes from servers where active;
+    exec serverid!attributes from servers where active,servertype=typ];
+  res:$[attype=`independent;
+    getserversindependent[req;svrs;besteffort];
+    getserverscross[req;svrs;besteffort]];
+  serverids:first value flip $[99h=type res; key res; res];
+  if[all 0=count each serverids;
+    signalnomatch[`getserveridstype;"no servers match ",string[typ]," requested attributes"]];
+  :serverids;
+  };
+
+/ internal - build a cross product table from a nested dictionary
+buildcross:{(cross/){flip (enlist y)#x}[x] each key x};
+
+getserversinitial:{[req;att]
+  / internal - initial filter shared by cross and independent matching
+  / drops servers missing any required attribute key, ranks survivors by coverage
+  if[0=count req; :([]serverid:enlist key att)];
+  att:(where all each (key req) in/: key each att)#att;
+  if[not count att;signalnomatch[`getserversinitial;"no servers report all requested attributes"]];
+  s:update serverid:key att from value req in'/: (key req)#/:att;
+  s:s idesc value min each sum each' `serverid xkey s;
+  s:`serverid xkey 0!(key req) xgroup s;
+  :s;
+  };
+
+getserverscross:{[req;att;besteffort]
+  / internal - find servers satisfying the cross product of all attribute requirements
+  / each attribute combination must be coverable by a single server
+  if[0=count req; :([]serverid:enlist key att)];
+  s:getserversinitial[req;att];
+  reqcross:buildcross[req];
+  / scan through each server group accumulating which cross-product rows have been covered
+  util:flip `remaining`found!flip (
+    {[x;y;z] (y[0] except found; y[0] inter found:$[0=count y[0];y[0];buildcross x@'where each z])}[req]\
+    )[(reqcross;());value s];
+  if[(count last util`remaining) and not besteffort;
+    signalnomatch[`getserverscross;"cannot satisfy query - cross product of all attributes cannot be matched"]];
+  s:1!(0!s) w:where not 0=count each util`found;
+  :(key s)!distinct each' flip each util[w]`found;
+  };
+
+getserversindependent:{[req;att;besteffort]
+  / internal - find servers satisfying attribute requirements independently
+  / each individual requirement only needs to be matched by one server
+  if[0=count req; :([]serverid:enlist key att)];
+  s:getserversinitial[req;att];
+  / mask out server groups whose contribution is already covered by earlier groups
+  filter:(value s)&not -1 _ (0b&(value s) enlist 0),maxs value s;
+  alldone:1+first where all each all each' maxs value s;
+  if[(null alldone) and not besteffort;
+    signalnomatch[`getserversindependent;"cannot satisfy query - not all attributes can be matched"]];
+  s:1!(0!s) w:where any each any each' filter;
+  :(key s)!{(key x)!(value x)@'where each y key x}[req] each value s&filter w;
+  };
+
+getapimeta:{[]
+  / this module's api metadata, one row per CALLABLE api function (NOT init/getapimeta - those are
+  / plumbing di.torq calls by convention, never registered), for di.torq to collect and register with
+  / di.api. names are bare; di.torq applies the process-wide qualification
+  :flip `name`public`descrip`params`return!flip(
+    (`version;            1b; "module version string";
+       "[]";                                                                  "string: version");
+    (`addserverfull;      1b; "register a server with handle, procname, servertype, hpup and attributes";
+       "[int: handle; symbol: procname; symbol: servertype; symbol: hpup; dict: attributes]";
+                                                                             "null");
+    (`addserverattr;      1b; "register a server with servertype and attributes; procname and hpup null";
+       "[int: handle; symbol: servertype; dict: attributes]";                 "null");
+    (`addserver;          1b; "register a server with no attributes; procname and hpup null";
+       "[int: handle; symbol: servertype]";                                   "null");
+    (`setserveractive;    1b; "mark every registration on a handle active or inactive, stamping disconnecttime";
+       "[int: handle; boolean: active]";                                      "null");
+    (`setserveridactive;  1b; "mark ONE registration active or inactive by serverid, leaving handle siblings alone";
+       "[int: serverid; boolean: active]";                                    "null");
+    (`getserverstable;    1b; "return the current registered server table";
+       "[]";                                                                  "table: registered servers");
+    (`addserversfromtable;1b; "register active servers from a connection table filtered by proctype";
+       "[symbol: proctypes or `ALL; table: conntable]";                       "null");
+    (`getservers;         1b; "look up active servers by servertype or procname with per-attribute match scoring";
+       "[symbol: nameortype; symbol: lookups; dict: requirements]";           "table: servers with attribmatch");
+    (`selector;           1b; "pick one row from a candidate table using roundrobin, any or last";
+       "[table: servertable; symbol: selection]";                             "dict: the chosen row");
+    (`setselector;        1b; "replace the strategy getserverbytype uses to pick one row";
+       "[function: selector]";                                                "null");
+    (`getserverbytype;    1b; "return one column value for a servertype using the given selection strategy";
+       "[symbol: servertype; symbol: column; symbol: selection]";             "any: column value, () if none");
+    (`gethandlebytype;    1b; "return one handle for a servertype using the given selection strategy";
+       "[symbol: servertype; symbol: selection]";                             "int: handle, () if none");
+    (`gethpbytype;        1b; "return one hpup for a servertype using the given selection strategy";
+       "[symbol: servertype; symbol: selection]";                             "symbol: hpup, () if none");
+    (`getserverids;       1b; "return server ids matching a servertype list or attribute requirement dict";
+       "[symbol list: servertypes, or dict: requirements]";                   "list: matching server ids");
+    (`removeinactive;     1b; "purge inactive servers that disconnected more than age ago";
+       "[timespan: age]";                                                     "null"));
+  };
diff --git a/di/serverselect/test.csv b/di/serverselect/test.csv
new file mode 100644
index 00000000..ba882014
--- /dev/null
+++ b/di/serverselect/test.csv
@@ -0,0 +1,545 @@
+action,ms,bytes,lang,code,repeat,minver,comment
+before,0,0,q,srvsel:use`di.serverselect,1,1,load module
+before,0,0,q,"noop:`info`warn`error!({[c;m]};{[c;m]};{[c;m]})",1,1,define a no-op binary logger {[c;m]}
+before,0,0,q,srvsel.init[enlist[`log]!enlist noop],1,1,init the module with the required log dependency before use
+
+/ ---- getserverstable: initial state ----
+comment,,,,,,,getserverstable - initial state before any addserverattr
+true,0,0,q,0=count srvsel.getserverstable[],1,1,servers empty on fresh module load
+true,0,0,q,`serverid`handle`procname`servertype`hpup`active`lastp`hits`attributes`disconnecttime~cols srvsel.getserverstable[],1,1,servers has correct schema
+
+/ ---- addserverattr / addserver / addserverfull: registration ----
+comment,,,,,,,addserverattr and addserver - server registration
+run,0,0,q,srvsel.addserver[1i;`rdb],1,1,register rdb server with no attributes
+run,0,0,q,srvsel.addserver[2i;`rdb],1,1,register second rdb server
+run,0,0,q,"srvsel.addserverattr[3i;`hdb;`date`sym!(2024.01.01 2024.01.02;`AAPL`MSFT)]",1,1,register hdb server with date and sym attributes
+true,0,0,q,3=count srvsel.getserverstable[],1,1,three servers registered
+true,0,0,q,all exec active from srvsel.getserverstable[],1,1,all registered servers are active by default
+true,0,0,q,`rdb`rdb`hdb~exec servertype from srvsel.getserverstable[],1,1,servertypes match registered order
+true,0,0,q,(1i;2i;3i)~exec handle from srvsel.getserverstable[],1,1,handles match registered order
+true,0,0,q,1 2 3i~exec serverid from srvsel.getserverstable[],1,1,server IDs autoincrement from 1
+true,0,0,q,all null exec procname from srvsel.getserverstable[],1,1,procname is null when registered via addserverattr
+true,0,0,q,all null exec hpup from srvsel.getserverstable[],1,1,hpup is null when registered via addserverattr
+run,0,0,q,"srvsel.addserverfull[4i;`myproc;`hdb;`:localhost:5555;(enlist`date)!enlist 2024.12.01]",1,1,register server with full details via addserverfull
+true,0,0,q,4=count srvsel.getserverstable[],1,1,fourth server registered via addserverfull
+true,0,0,q,`myproc~first exec procname from srvsel.getserverstable[] where handle=4i,1,1,procname populated via addserverfull
+true,0,0,q,`:localhost:5555~first exec hpup from srvsel.getserverstable[] where handle=4i,1,1,hpup populated via addserverfull
+
+/ ---- setserveractive: marking active/inactive ----
+comment,,,,,,,setserveractive - active flag management
+run,0,0,q,srvsel.setserveractive[2i;0b],1,1,mark second rdb server inactive
+true,0,0,q,not (exec active from srvsel.getserverstable[] where handle=2i)[0],1,1,handle 2 is now inactive
+true,0,0,q,(exec active from srvsel.getserverstable[] where handle=1i)[0],1,1,handle 1 remains active
+run,0,0,q,srvsel.setserveractive[2i;1b],1,1,mark second rdb server active again
+true,0,0,q,(exec active from srvsel.getserverstable[] where handle=2i)[0],1,1,handle 2 is active again
+
+
+/ ---- getservers ----
+comment,,,,,,,getservers - server lookup with attribute match scoring
+true,0,0,q,`serverid`procname`servertype`hpup`handle`lastp`attributes`attribmatch~cols srvsel.getservers[`;`;()!()],1,1,getservers returns table with correct columns
+true,0,0,q,count[select from srvsel.getserverstable[] where active]=count srvsel.getservers[`;`;()!()],1,1,getservers with ` lookups returns all active servers
+true,0,0,q,all `hdb=exec servertype from srvsel.getservers[`servertype;`hdb;()!()],1,1,getservers filters by servertype correctly
+true,0,0,q,0=count srvsel.getservers[`servertype;`nonexistent;()!()],1,1,getservers returns empty table for unknown servertype
+true,0,0,q,0<count srvsel.getservers[`procname;`;()!()],1,1,getservers with null procname lookups returns all active servers
+true,0,0,q,"any {(first value x)[0]}each (srvsel.getservers[`servertype;`hdb;(enlist`date)!enlist 2024.01.01])`attribmatch",1,1,getservers attribmatch shows complete match for registered date
+
+/ ---- selector ----
+comment,,,,,,,selector - selection strategy
+run,0,0,q,"seltab:([]handle:1 2i;lastp:(2024.01.01D00:00;2024.01.02D00:00))",1,1,create test server table for selector
+true,0,0,q,1i~(srvsel.selector[seltab;`roundrobin])`handle,1,1,selector roundrobin picks least recently used (oldest lastp)
+true,0,0,q,2i~(srvsel.selector[seltab;`last])`handle,1,1,selector last picks most recently used (newest lastp)
+true,0,0,q,((srvsel.selector[seltab;`any])`handle) in 1 2i,1,1,selector any picks a handle from the table
+fail,0,0,q,srvsel.selector[seltab;`unknown],1,1,selector rejects unknown strategy
+
+/ ---- getserverbytype / gethandlebytype / gethpbytype ----
+comment,,,,,,,getserverbytype and convenience projections
+true,0,0,q,(srvsel.gethandlebytype[`rdb;`roundrobin]) in exec handle from srvsel.getserverstable[] where servertype=`rdb,active,1,1,gethandlebytype returns a live rdb handle
+true,0,0,q,(srvsel.gethandlebytype[`hdb;`roundrobin]) in exec handle from srvsel.getserverstable[] where servertype=`hdb,active,1,1,gethandlebytype returns a live hdb handle
+true,0,0,q,()~srvsel.gethandlebytype[`nonexistent;`roundrobin],1,1,gethandlebytype returns () for unknown servertype
+true,0,0,q,(srvsel.gethpbytype[`hdb;`roundrobin]) in exec hpup from srvsel.getserverstable[] where servertype=`hdb,active,1,1,gethpbytype returns hpup for matching server
+run,0,0,q,srvsel.gethandlebytype[`rdb;`roundrobin],1,1,gethandlebytype call updates lastp and hits via updatestats
+true,0,0,q,"0<(exec hits from srvsel.getserverstable[] where handle in exec handle from srvsel.getserverstable[] where servertype=`rdb,active)[0]",1,1,hits incremented after gethandlebytype call
+
+/ ---- updatestats: keyed on serverid not handle ----
+comment,,,,,,,updatestats - a selection updates only the chosen serverid even when a handle is shared
+run,0,0,q,"srvsel.addserverfull[60i;`dupa;`zdb;`:h:1;()!()]",1,1,register first server on shared handle 60 (unique servertype zdb)
+run,0,0,q,"srvsel.addserverfull[60i;`dupb;`zdb;`:h:2;()!()]",1,1,register second server on same handle 60
+run,0,0,q,srvsel.gethandlebytype[`zdb;`roundrobin],1,1,select one zdb server by handle
+true,0,0,q,1=sum exec hits from srvsel.getserverstable[] where servertype=`zdb,1,1,exactly one hit recorded across both shared-handle servers (not two)
+true,0,0,q,"1=count select from srvsel.getserverstable[] where servertype=`zdb,not null lastp",1,1,only the selected serverid had its lastp updated
+
+/ ---- getserverids: symbol list path ----
+comment,,,,,,,getserverids - symbol list (servertype) path
+true,0,0,q,0<count srvsel.getserverids[`rdb],1,1,getserverids returns IDs for registered rdb type
+true,0,0,q,0<count srvsel.getserverids[`hdb],1,1,getserverids returns IDs for registered hdb type
+fail,0,0,q,srvsel.getserverids[`],1,1,getserverids rejects null servertype
+fail,0,0,q,srvsel.getserverids[`nonexistent],1,1,getserverids errors on unregistered servertype
+fail,0,0,q,srvsel.getserverids[42],1,1,getserverids rejects non-symbol non-dict argument
+run,0,0,q,srvsel.setserveractive[1i;0b],1,1,mark rdb handle 1 inactive for inactive-server test
+run,0,0,q,srvsel.setserveractive[2i;0b],1,1,mark rdb handle 2 inactive - all rdbs now inactive
+fail,0,0,q,srvsel.getserverids[`rdb],1,1,getserverids errors when all requested servers are inactive
+run,0,0,q,srvsel.setserveractive[1i;1b],1,1,restore rdb handle 1
+run,0,0,q,srvsel.setserveractive[2i;1b],1,1,restore rdb handle 2
+
+/ ---- getserverids: attribute dict path ----
+comment,,,,,,,getserverids - attribute dict path
+true,0,0,q,"0<count srvsel.getserverids[enlist[`date]!enlist enlist 2024.01.01]",1,1,getserverids matches hdb with date attribute
+true,0,0,q,"0<count srvsel.getserverids[enlist[`sym]!enlist enlist`AAPL]",1,1,getserverids matches hdb with sym attribute
+fail,0,0,q,"srvsel.getserverids[enlist[`date]!enlist enlist 1999.01.01]",1,1,getserverids errors when no server matches attribute value
+true,0,0,q,"0<count srvsel.getserverids[`servertype`date!(`hdb;enlist 2024.01.01)]",1,1,getserverids handles servertype key in attribute dict
+
+/ ---- addserversfromtable ----
+comment,,,,,,,addserversfromtable - bulk registration from connection table
+run,0,0,q,"conntab:([]w:10 11 12i;proctype:`rdb`hdb`rdb;attributes:(()!();`date`sym!(enlist 2024.12.01;enlist`IBM);()!()))",1,1,define test connection table without optional columns
+run,0,0,q,srvsel.addserversfromtable[`rdb`hdb;conntab],1,1,register rdb and hdb from connection table
+true,0,0,q,3<=count select from srvsel.getserverstable[] where handle in 10 11 12i,1,1,all three handles registered
+run,0,0,q,"conntab2:([]w:10 11i;proctype:`rdb`hdb;attributes:(()!();()!()))",1,1,define connection table with already-active handles
+run,0,0,q,srvsel.addserversfromtable[`rdb`hdb;conntab2],1,1,addserversfromtable skips already-active handles
+run,0,0,q,"conntab3:([]w:20 21i;proctype:`tickerplant`rdb;attributes:(()!();()!()))",1,1,define connection table with mixed proctypes
+run,0,0,q,srvsel.addserversfromtable[`rdb;conntab3],1,1,addserversfromtable filters by proctype - only rdb registered
+true,0,0,q,0<count select from srvsel.getserverstable[] where handle=21i,1,1,rdb handle 21 was registered
+true,0,0,q,0=count select from srvsel.getserverstable[] where handle=20i,1,1,tickerplant handle 20 was not registered
+run,0,0,q,"conntab4:([]w:30 31i;proctype:`rdb`hdb;procname:`p1`p2;hpup:`:host:1001`:host:1002;attributes:(()!();()!()))",1,1,define connection table with optional procname and hpup columns
+run,0,0,q,srvsel.addserversfromtable[`ALL;conntab4],1,1,addserversfromtable with `ALL and optional columns
+true,0,0,q,`p1~first exec procname from srvsel.getserverstable[] where handle=30i,1,1,procname populated from connection table
+true,0,0,q,`:host:1002~first exec hpup from srvsel.getserverstable[] where handle=31i,1,1,hpup populated from connection table
+fail,0,0,q,"srvsel.addserversfromtable[`rdb;([]x:enlist 1i;y:enlist`rdb)]",1,1,addserversfromtable rejects connection table missing required columns
+
+/ ---- addserverfull: edge cases ----
+comment,,,,,,,addserverfull - edge cases
+run,0,0,q,"srvsel.addserverfull[70i;`first;`rdb;`:first:7000;()!()]",1,1,register first entry at handle 70
+run,0,0,q,"srvsel.addserverfull[70i;`second;`hdb;`:second:7070;()!()]",1,1,register second entry at same handle (keyed by serverid not handle)
+true,0,0,q,2=count select from srvsel.getserverstable[] where handle=70i,1,1,addserverfull with duplicate handle creates two distinct rows (new serverid each time)
+fail,0,0,q,"srvsel.addserverfull[`badhandle;`;`rdb;`;()!()]",1,1,addserverfull rejects symbol handle (type error on int column)
+fail,0,0,q,"srvsel.addserverfull[71i;`;""rdb"";`;()!()]",1,1,addserverfull rejects string servertype (type error on symbol column)
+
+/ ---- addserver: edge cases ----
+comment,,,,,,,addserver - edge cases
+true,0,0,q,(()!())~first exec attributes from srvsel.getserverstable[] where handle=1i,1,1,addserver stores empty attributes dict
+true,0,0,q,null first exec procname from srvsel.getserverstable[] where handle=1i,1,1,addserver stores null procname
+true,0,0,q,null first exec hpup from srvsel.getserverstable[] where handle=1i,1,1,addserver stores null hpup
+fail,0,0,q,"srvsel.addserver[`badhandle;`rdb]",1,1,addserver rejects symbol handle (type error)
+fail,0,0,q,"srvsel.addserver[72i;""rdb""]",1,1,addserver rejects string servertype (type error)
+
+/ ---- addserverattr: edge cases ----
+comment,,,,,,,addserverattr - edge cases
+true,0,0,q,null first exec procname from srvsel.getserverstable[] where handle=3i,1,1,addserverattr stores null procname
+true,0,0,q,null first exec hpup from srvsel.getserverstable[] where handle=3i,1,1,addserverattr stores null hpup
+fail,0,0,q,"srvsel.addserverattr[`badhandle;`hdb;()!()]",1,1,addserverattr rejects symbol handle (type error)
+fail,0,0,q,"srvsel.addserverattr[73i;""hdb"";()!()]",1,1,addserverattr rejects string servertype (type error)
+
+/ ---- setserveractive: edge cases ----
+comment,,,,,,,setserveractive - edge cases
+run,0,0,q,srvsel.setserveractive[9999i;0b],1,1,setserveractive on non-existent handle is a no-op
+true,0,0,q,0=count select from srvsel.getserverstable[] where handle=9999i,1,1,non-existent handle not inserted by setserveractive
+fail,0,0,q,"srvsel.setserveractive[1i;`yes]",1,1,setserveractive rejects symbol active flag (type error)
+fail,0,0,q,"srvsel.setserveractive[""badhandle"";0b]",1,1,setserveractive rejects string handle (type error)
+
+/ ---- getservers: edge cases ----
+comment,,,,,,,getservers - edge cases
+run,0,0,q,srvsel.setserveractive[1i;0b],1,1,mark handle 1 inactive for getservers inactive-exclusion test
+true,0,0,q,not (1i) in exec handle from srvsel.getservers[`servertype;`rdb;()!()],1,1,getservers excludes inactive servers from results
+run,0,0,q,srvsel.setserveractive[1i;1b],1,1,restore handle 1 active after inactive-exclusion test
+true,0,0,q,"all (exec servertype from srvsel.getservers[`servertype;`rdb`hdb;()!()]) in `rdb`hdb",1,1,getservers accepts symbol list as lookups
+true,0,0,q,4i in exec handle from srvsel.getservers[`procname;`myproc;()!()],1,1,getservers procname filter returns server with matching procname
+fail,0,0,q,srvsel.getservers[`badname;`x;()!()],1,1,getservers rejects nameortype that is not servertype or procname
+
+/ ---- selector: edge cases ----
+comment,,,,,,,selector - edge cases
+run,0,0,q,"singleseltab:([]handle:enlist 77i;lastp:enlist 2024.01.15D00:00)",1,1,create single-row selector table
+true,0,0,q,77i~(srvsel.selector[singleseltab;`roundrobin])`handle,1,1,selector roundrobin on single row returns that row
+true,0,0,q,77i~(srvsel.selector[singleseltab;`last])`handle,1,1,selector last on single row returns that row
+true,0,0,q,77i~(srvsel.selector[singleseltab;`any])`handle,1,1,selector any on single row returns that row
+run,0,0,q,"emptyseltab:([]handle:`int$();lastp:`timestamp$())",1,1,create empty selector table
+true,0,0,q,0Ni~(srvsel.selector[emptyseltab;`roundrobin])`handle,1,1,selector roundrobin on empty table returns null handle
+true,0,0,q,0Ni~(srvsel.selector[emptyseltab;`last])`handle,1,1,selector last on empty table returns null handle
+
+/ ---- getserverbytype: direct tests ----
+comment,,,,,,,getserverbytype - direct tests
+true,0,0,q,`rdb~srvsel.getserverbytype[`rdb;`servertype;`roundrobin],1,1,getserverbytype returns correct column value for servertype
+true,0,0,q,()~srvsel.getserverbytype[`nonexistent;`handle;`roundrobin],1,1,getserverbytype returns () for unknown servertype
+true,0,0,q,"(srvsel.getserverbytype[`hdb;`hpup;`roundrobin]) in exec hpup from srvsel.getserverstable[] where servertype=`hdb",1,1,getserverbytype returns hpup value for hdb type
+
+/ ---- gethpbytype: edge cases ----
+comment,,,,,,,gethpbytype - edge cases
+true,0,0,q,()~srvsel.gethpbytype[`nonexistent;`roundrobin],1,1,gethpbytype returns () for unknown servertype
+
+/ ---- getserverids: edge cases ----
+comment,,,,,,,getserverids - edge cases
+run,0,0,q,srvsel.getserverids[`symbol$()],1,1,getserverids with empty symbol list runs without error
+true,0,0,q,"0<count srvsel.getserverids[`rdb`hdb]",1,1,getserverids with multiple servertypes returns results for all types
+true,0,0,q,"0<count srvsel.getserverids[`date`attributetype!(enlist 2024.01.01;`independent)]",1,1,getserverids supports independent attribute matching strategy
+fail,0,0,q,"srvsel.getserverids[`date`besteffort!(enlist 1990.01.01;0b)]",1,1,getserverids throws when no servers have requested attribute value
+fail,0,0,q,"srvsel.getserverids[`servertype`date!(`nonexistent;enlist 2024.01.01)]",1,1,getserverids throws for unknown servertype in attribute dict
+fail,0,0,q,"srvsel.getserverids[(enlist`date)!enlist enlist 2024.01.01 2024.01.02]",1,1,getserverids rejects a nested/malformed attribute requirement value with a clear error
+
+/ ---- init: dependency injection (required log) ----
+comment,,,,,,,init - inject and validate the required log dependency
+run,0,0,q,"caplog:([]lvl:`symbol$();msg:())",1,1,initialise log capture table
+run,0,0,q,"caplogger:`info`warn`error!({[c;m]`caplog upsert(`info;m)};{[c;m]`caplog upsert(`warn;m)};{[c;m]`caplog upsert(`error;m)})",1,1,define a bespoke capturing binary logger {[c;m]}
+run,0,0,q,srvsel.init[enlist[`log]!enlist caplogger],1,1,re-init with the bespoke capturing logger
+run,0,0,q,caplog:0#caplog,1,1,reset capture
+run,0,0,q,"srvsel.addserver[40i;`rdb]",1,1,register a server while the capturing logger is active
+true,0,0,q,0<count select from caplog where lvl=`info,1,1,injected logger received an info message
+true,0,0,q,"any caplog[`msg] like ""*registering server*""",1,1,injected logger received the registration message text
+run,0,0,q,caplog:0#caplog,1,1,reset capture
+run,0,0,q,"@[{srvsel.selector[([]handle:1 2i;lastp:2#.z.p);`bogus]};();{}]",1,1,trigger an error path (signal swallowed)
+true,0,0,q,0<count select from caplog where lvl=`error,1,1,injected logger received the error message via .z.m.logerr
+fail,0,0,q,srvsel.init[(::)],1,1,init rejects a non-dictionary deps
+fail,0,0,q,srvsel.init[()!()],1,1,init rejects deps missing the log key
+fail,0,0,q,srvsel.init[enlist[`other]!enlist noop],1,1,init rejects deps without a log key
+fail,0,0,q,srvsel.init[enlist[`log]!enlist(::)],1,1,init rejects a log value that is not a dict
+fail,0,0,q,"srvsel.init[enlist[`log]!enlist(`info`warn!({[c;m]};{[c;m]}))]",1,1,init rejects a log dict missing the error key
+true,0,0,q,"""di.serverselect""~15#@[srvsel.init;(::);{x}]",1,1,init error message is prefixed di.serverselect
+run,0,0,q,srvsel.init[enlist[`log]!enlist noop],1,1,restore the no-op logger
+
+/ ---- version ----
+comment,,,,,,,version - read from the VERSION file and still exported
+true,0,0,q,"""0.1.0""~srvsel.version",1,1,version matches the VERSION file contents
+true,0,0,q,`version in key srvsel,1,1,version is still an export - di.depcheck resolves a dependency version from there
+true,0,0,q,"3=count ""."" vs srvsel.version",1,1,the VERSION file holds a parseable major.minor.patch string
+true,0,0,q,"not any srvsel.version in ""\n\r""",1,1,no stray newline or carriage return came through from the file
+true,0,0,q,srvsel.version~trim srvsel.version,1,1,version has no leading or trailing whitespace
+
+/ ---- getapimeta ----
+comment,,,,,,,getapimeta - api metadata conformance
+true,0,0,q,"(asc (key srvsel) except `init`getapimeta)~asc exec name from srvsel.getapimeta[]",1,1,getapimeta documents exactly the callable exports (plumbing omitted)
+true,0,0,q,"not any `init`getapimeta in exec name from srvsel.getapimeta[]",1,1,framework plumbing is not registered in the api
+true,0,0,q,`name`public`descrip`params`return~cols srvsel.getapimeta[],1,1,getapimeta rows carry the registry columns
+true,0,0,q,all exec public from srvsel.getapimeta[],1,1,every documented function is public
+true,0,0,q,all 0<count each exec descrip from srvsel.getapimeta[],1,1,every documented function carries a description
+true,0,0,q,all 0<count each exec params from srvsel.getapimeta[],1,1,every documented function carries a params string
+
+/ ---- adversarial review: attribute matching engine ----
+comment,,,,,,,adversarial - engine fixture reset (internals reached via .m.di.0serverselect)
+run,0,0,q,"advreset:{.m.di.0serverselect.servers:0#.m.di.0serverselect.servers;.m.di.0serverselect.serverid:0i;}",1,1,helper resetting the registry so each engine fixture has known server ids
+run,0,0,q,advreset[],1,1,reset the registry before building the engine fixture
+run,0,0,q,"srvsel.addserverattr[101i;`hdb;`date`sym!(2024.01.01 2024.01.02;`AAPL`MSFT)]",1,1,fixture sid1 - dates 01.01 and 01.02, syms AAPL and MSFT
+run,0,0,q,"srvsel.addserverattr[102i;`hdb;`date`sym!(2024.01.03 2024.01.04;`AAPL`GOOG)]",1,1,fixture sid2 - dates 01.03 and 01.04, syms AAPL and GOOG
+run,0,0,q,"srvsel.addserverattr[103i;`hdb;(enlist`date)!enlist 2024.01.01 2024.01.05]",1,1,fixture sid3 - date attribute only, no sym attribute at all
+run,0,0,q,"srvsel.addserverattr[104i;`rdb;(enlist`date)!enlist enlist 2024.01.09]",1,1,fixture sid4 - rdb with an unrelated date
+true,0,0,q,4=count srvsel.getserverstable[],1,1,fixture registry holds exactly the four fixture servers
+true,0,0,q,1 2 3 4i~exec serverid from srvsel.getserverstable[],1,1,fixture server ids run 1 to 4 after the reset
+
+comment,,,,,,,adversarial case 1 - empty attribute requirements degrade to any server of the type
+true,0,0,q,1 2 3 4i~raze srvsel.getserverids[()!()],1,1,an empty requirement dict returns every active server rather than none
+true,0,0,q,"1 2 3i~asc raze srvsel.getserverids[enlist[`servertype]!enlist`hdb]",1,1,empty requirements plus a servertype returns all servers of that type
+true,0,0,q,"1 2 3i~asc raze srvsel.getserverids[`hdb]",1,1,the bare symbol path agrees with the empty-requirement dict path
+true,0,0,q,"1 2 3 4i~asc raze srvsel.getserverids[enlist[`besteffort]!enlist 0b]",1,1,a control-key-only dict is still an empty requirement and matches everything
+
+comment,,,,,,,adversarial case 2 - attributes present on some servers but not others
+true,0,0,q,"(enlist 1i)~raze srvsel.getserverids[`date`sym!(enlist 2024.01.01;enlist`AAPL)]",1,1,only the server advertising both date and sym matches
+true,0,0,q,"not 3i in raze srvsel.getserverids[`date`sym!(enlist 2024.01.01;enlist`AAPL)]",1,1,sid3 has the date but advertises no sym attribute so it is excluded not silently included
+true,0,0,q,"1 3i~asc raze srvsel.getserverids[(enlist`date)!enlist enlist 2024.01.01]",1,1,sid3 reappears once sym is dropped - its exclusion was the missing key not a failed match
+true,0,0,q,"1 2i~asc raze srvsel.getserverids[`date`sym!(2024.01.01 2024.01.03;enlist`AAPL)]",1,1,a partial-coverage request does not fail the whole match
+
+comment,,,,,,,adversarial case 3 - besteffort divergence and best-match ranking
+run,0,0,q,advreset[],1,1,reset the registry for the ranking fixture
+run,0,0,q,"srvsel.addserverattr[111i;`hdb;(enlist`date)!enlist enlist 2024.01.01]",1,1,narrow server sid1 - one date only
+run,0,0,q,"srvsel.addserverattr[112i;`hdb;(enlist`date)!enlist 2024.01.01 2024.01.02 2024.01.03]",1,1,wide server sid2 - all three requested dates
+run,0,0,q,"srvsel.addserverattr[113i;`hdb;(enlist`date)!enlist enlist 2024.01.02]",1,1,narrow server sid3 - one different date
+true,0,0,q,"(enlist 2i)~raze srvsel.getserverids[`date`besteffort!(2024.01.01 2024.01.02 2024.01.03;1b)]",1,1,best match is the WIDE server alone - best really is best not merely the first candidate found
+true,0,0,q,"(enlist 2i)~raze srvsel.getserverids[(enlist`date)!enlist 2024.01.01 2024.01.02]",1,1,the wide server is still preferred over the two narrow servers that jointly cover the same dates
+fail,0,0,q,"srvsel.getserverids[`date`besteffort!(2024.01.01 1999.01.01;0b)]",1,1,besteffort 0b fails when the cross product cannot be covered in full
+true,0,0,q,"1 2i~asc raze srvsel.getserverids[`date`besteffort!(2024.01.01 1999.01.01;1b)]",1,1,besteffort 1b returns the partial match - the servers covering the satisfiable date
+fail,0,0,q,"srvsel.getserverids[`date`besteffort!(enlist 1999.01.01;1b)]",1,1,besteffort 1b still errors when no server matches any part of the request
+
+comment,,,,,,,adversarial case 4 - one server satisfying several requirement combinations at once
+run,0,0,q,advreset[],1,1,reset the registry for the cross-product fixture
+run,0,0,q,"srvsel.addserverattr[121i;`hdb;`date`sym!(2024.01.01 2024.01.02;`AAPL`MSFT)]",1,1,single server covering a full 2x2 cross product on its own
+true,0,0,q,"(enlist 1i)~raze srvsel.getserverids[`date`sym!(2024.01.01 2024.01.02;`AAPL`MSFT)]",1,1,a server covering all four combinations is returned once not duplicated
+true,0,0,q,"1=count distinct raze srvsel.getserverids[`date`sym!(2024.01.01 2024.01.02;`AAPL`MSFT)]",1,1,no duplicate server ids come back from the cross-product logic
+run,0,0,q,"srvsel.addserverattr[122i;`hdb;`date`sym!(2024.01.03 2024.01.04;`AAPL`GOOG)]",1,1,add a second server covering a disjoint part of the cross product
+true,0,0,q,"1 2i~asc raze srvsel.getserverids[`date`sym!(2024.01.01 2024.01.03;enlist`AAPL)]",1,1,a cross product spanning two servers returns both
+
+comment,,,,,,,adversarial case 5 - further edges found reading the matcher closely
+true,0,0,q,"1 2i~asc raze srvsel.getserverids[`date`sym`attributetype!(enlist 2024.01.01;enlist`GOOG;`independent)]",1,1,independent mode lets two different servers each satisfy one requirement
+fail,0,0,q,"srvsel.getserverids[`date`sym`attributetype`besteffort!(enlist 2024.01.01;enlist`ZZZ;`independent;0b)]",1,1,independent mode with besteffort 0b fails when one requirement cannot be matched at all
+true,0,0,q,"0<count raze srvsel.getserverids[`date`sym`attributetype`besteffort!(enlist 2024.01.01;enlist`ZZZ;`independent;1b)]",1,1,independent mode with besteffort 1b returns the satisfiable part
+fail,0,0,q,"srvsel.getserverids[`date`sym`attributetype`besteffort!(enlist 1999.01.01;enlist`ZZZ;`independent;0b)]",1,1,independent mode errors when nothing at all can be matched
+true,0,0,q,"1 2i~asc raze srvsel.getserverids[`date`sym!(2024.01.01 2024.01.03;`AAPL`GOOG)]",1,1,a three-way spanning request still resolves across both servers
+true,0,0,q,"`date`sym~cols .m.di.0serverselect.buildcross[`date`sym!(2024.01.01 2024.01.02;`AAPL`MSFT)]",1,1,buildcross returns a table with one column per requirement key
+true,0,0,q,"4=count .m.di.0serverselect.buildcross[`date`sym!(2024.01.01 2024.01.02;`AAPL`MSFT)]",1,1,buildcross produces the full 2x2 cross product
+true,0,0,q,"1=count .m.di.0serverselect.buildcross[(enlist`date)!enlist enlist 2024.01.01]",1,1,buildcross of a single requirement value is a one-row table
+true,0,0,q,"(enlist 1i)~raze .m.di.0serverselect.getserveridstype[(enlist`date)!enlist enlist 2024.01.01;1b;`cross;`hdb]",1,1,getserveridstype called directly on the internal path resolves one servertype (controls now passed explicitly)
+true,0,0,q,"1=count .m.di.0serverselect.getserversinitial[()!();(enlist 1i)!enlist ()!()]",1,1,getserversinitial with no requirements returns a single all-servers row
+fail,0,0,q,"srvsel.getserverids[(enlist`nosuchattr)!enlist enlist 1]",1,1,a requirement key no server advertises errors rather than matching everything
+
+comment,,,,,,,adversarial case 6 - empty registry, duplicates and inactive exclusion
+run,0,0,q,advreset[],1,1,reset to a completely empty registry
+fail,0,0,q,"srvsel.getserverids[(enlist`date)!enlist enlist 2024.01.01]",1,1,an attribute request against an empty registry errors rather than returning nothing
+fail,0,0,q,srvsel.getserverids[()!()],1,1,an empty requirement against an empty registry errors
+true,0,0,q,()~srvsel.gethandlebytype[`hdb;`roundrobin],1,1,gethandlebytype returns () against an empty registry
+run,0,0,q,"srvsel.addserverattr[131i;`hdb;(enlist`date)!enlist enlist 2024.01.01]",1,1,register the first of two identical servers
+run,0,0,q,"srvsel.addserverattr[132i;`hdb;(enlist`date)!enlist enlist 2024.01.01]",1,1,register the second identical server
+true,0,0,q,"1 2i~asc raze srvsel.getserverids[(enlist`date)!enlist enlist 2024.01.01]",1,1,two servers with identical attributes are both returned
+run,0,0,q,srvsel.setserveractive[132i;0b],1,1,deactivate one of the identical pair
+true,0,0,q,"(enlist 1i)~raze srvsel.getserverids[(enlist`date)!enlist enlist 2024.01.01]",1,1,an inactive server is excluded from attribute matching
+run,0,0,q,srvsel.setserveractive[132i;1b],1,1,reactivate it again
+
+/ ---- regression: F1 multi-servertype fan-out ----
+comment,,,,,,,regression F1 - a multi-servertype request tolerates a servertype that matches nothing
+run,0,0,q,advreset[],1,1,reset the registry for the F1 regression fixture
+run,0,0,q,"srvsel.addserverattr[141i;`hdb;(enlist`date)!enlist enlist 2024.01.01]",1,1,hdb server carrying the requested date
+run,0,0,q,"srvsel.addserverattr[142i;`rdb;(enlist`date)!enlist enlist 2024.01.09]",1,1,rdb server carrying a different date
+true,0,0,q,"(enlist 1i)~raze srvsel.getserverids[`servertype`date!(`hdb`rdb;enlist 2024.01.01)]",1,1,F1 - hdb ids come back even though rdb matches nothing (previously aborted the whole query)
+true,0,0,q,"(enlist 1i)~raze srvsel.getserverids[`servertype`date!(`rdb`hdb;enlist 2024.01.01)]",1,1,F1 - the same holds with the servertypes listed in the other order
+true,0,0,q,"(enlist 2i)~raze srvsel.getserverids[`servertype`date!(`hdb`rdb;enlist 2024.01.09)]",1,1,F1 - and symmetrically when only rdb matches
+fail,0,0,q,"srvsel.getserverids[`servertype`date!(`hdb`rdb;enlist 1999.01.01)]",1,1,F1 - an all-types miss still errors through the aggregate guard
+fail,0,0,q,"srvsel.getserverids[`servertype`date!(`nosuchtype;enlist 2024.01.01)]",1,1,F1 - a single unknown servertype still errors
+run,0,0,q,srvsel.init[enlist[`log]!enlist caplogger],1,1,re-init with the capturing logger to observe the F1 log levels
+run,0,0,q,caplog:0#caplog,1,1,reset capture
+run,0,0,q,"srvsel.getserverids[`servertype`date!(`hdb`rdb;enlist 2024.01.01)]",1,1,run the partially-matching multi-servertype request under capture
+true,0,0,q,0<count select from caplog where lvl=`warn,1,1,F1 - the servertype that missed is reported at WARN
+true,0,0,q,0=count select from caplog where lvl=`error,1,1,F1 - a routine partial match logs no ERROR line
+true,0,0,q,"any caplog[`msg] like ""*no servers matched servertype rdb*""",1,1,F1 - the warning names the servertype that missed
+run,0,0,q,caplog:0#caplog,1,1,reset capture before the all-miss case
+run,0,0,q,"@[srvsel.getserverids;`servertype`date!(`hdb`rdb;enlist 1999.01.01);{}]",1,1,run an all-types miss under capture (signal swallowed)
+true,0,0,q,0<count select from caplog where lvl=`error,1,1,F1 - an all-types miss IS logged at error by the aggregate guard
+run,0,0,q,srvsel.init[enlist[`log]!enlist noop],1,1,restore the no-op logger
+
+/ ---- regression: F2 atom attribute requirement ----
+comment,,,,,,,regression F2 - an atom requirement value no longer throws a raw unlogged rank
+true,0,0,q,"(enlist 1i)~raze srvsel.getserverids[(enlist`date)!enlist 2024.01.01]",1,1,F2 - an atom requirement value is accepted (previously a raw rank)
+true,0,0,q,"(raze srvsel.getserverids[(enlist`date)!enlist 2024.01.01])~raze srvsel.getserverids[(enlist`date)!enlist enlist 2024.01.01]",1,1,F2 - the atom form returns exactly what the one-element list form returns
+true,0,0,q,"(raze srvsel.getserverids[`servertype`date!(`hdb;2024.01.01)])~raze srvsel.getserverids[`servertype`date!(`hdb;enlist 2024.01.01)]",1,1,F2 - atom promotion applies alongside a servertype key too
+fail,0,0,q,"srvsel.getserverids[(enlist`date)!enlist enlist 2024.01.01 2024.01.02]",1,1,F2 - a genuinely nested requirement value is still rejected
+true,0,0,q,"""di.serverselect""~15#@[srvsel.getserverids;(enlist`date)!enlist enlist 2024.01.01 2024.01.02;{x}]",1,1,F2 - the nested-value rejection is a prefixed module error not a raw rank
+true,0,0,q,"(enlist 2024.01.01)~.m.di.0serverselect.normreq[(enlist`date)!enlist 2024.01.01]`date",1,1,F2 - normreq promotes an atom requirement value to a one-element list
+true,0,0,q,"(enlist 2024.01.01 2024.01.02)~.m.di.0serverselect.normreq[(enlist`date)!enlist enlist 2024.01.01 2024.01.02]`date",1,1,F2 - normreq leaves a nested value alone so the 0h guard still catches it
+true,0,0,q,"(enlist`EU)~.m.di.0serverselect.normreq[(enlist`besteffort)!enlist`EU]`besteffort",1,1,F2 - normreq now promotes every key because it only ever receives pure requirements
+
+/ ---- regression: F3 control key validation ----
+comment,,,,,,,regression F3 - control keys are validated instead of being silently ignored
+fail,0,0,q,"srvsel.getserverids[`date`besteffort!(2024.01.01;0)]",1,1,F3 - an int besteffort is rejected rather than silently keeping the 1b default
+fail,0,0,q,"srvsel.getserverids[`date`besteffort!(2024.01.01;`no)]",1,1,F3 - a symbol besteffort is rejected
+fail,0,0,q,"srvsel.getserverids[`date`attributetype!(2024.01.01;`bogus)]",1,1,F3 - an unknown attributetype is rejected rather than silently falling back to cross
+fail,0,0,q,"srvsel.getserverids[`date`attributetype!(2024.01.01;""independent"")]",1,1,F3 - a string attributetype is rejected
+fail,0,0,q,"srvsel.getserverids[`servertype`date!(""hdb"";2024.01.01)]",1,1,F3 - a string servertype is rejected
+true,0,0,q,"0<count raze srvsel.getserverids[`date`attributetype!(2024.01.01;`cross)]",1,1,F3 - an explicit cross attributetype is still accepted
+true,0,0,q,"0<count raze srvsel.getserverids[`date`besteffort!(2024.01.01;1b)]",1,1,F3 - a correctly typed besteffort is still accepted
+
+/ ---- setselector ----
+comment,,,,,,,setselector - pluggable selection strategy
+run,0,0,q,advreset[],1,1,reset the registry for the selector fixture
+run,0,0,q,"srvsel.addserverfull[80i;`selA;`seltest;`:sel:1;()!()]",1,1,register the first seltest server
+run,0,0,q,"srvsel.addserverfull[81i;`selB;`seltest;`:sel:2;()!()]",1,1,register the second seltest server
+true,0,0,q,(srvsel.gethandlebytype[`seltest;`roundrobin]) in 80 81i,1,1,the default selector picks one of the registered seltest handles
+run,0,0,q,"srvsel.setselector[{[t;s] first select from t where handle=81i}]",1,1,install a strategy that always picks handle 81
+true,0,0,q,81i~srvsel.gethandlebytype[`seltest;`roundrobin],1,1,setselector override took effect - gethandlebytype returns the forced handle
+true,0,0,q,81i~srvsel.gethandlebytype[`seltest;`any],1,1,the override applies whatever strategy symbol is requested
+true,0,0,q,`:sel:2~srvsel.gethpbytype[`seltest;`roundrobin],1,1,the override also drives gethpbytype
+true,0,0,q,`selB~srvsel.getserverbytype[`seltest;`procname;`roundrobin],1,1,the override also drives getserverbytype
+run,0,0,q,srvsel.setselector[srvsel.selector],1,1,restore the exported default selector
+true,0,0,q,(srvsel.gethandlebytype[`seltest;`roundrobin]) in 80 81i,1,1,default behaviour is restored after setselector
+true,0,0,q,"80i~(srvsel.selector[([]handle:80 81i;lastp:(2024.01.01D00:00;2024.01.02D00:00));`roundrobin])`handle",1,1,the exported selector itself is unchanged by setselector
+fail,0,0,q,srvsel.setselector[42],1,1,setselector rejects a non-function argument
+fail,0,0,q,srvsel.setselector[`notafunction],1,1,setselector rejects a symbol
+
+/ ---- disconnecttime and removeinactive ----
+comment,,,,,,,disconnecttime and removeinactive - age-based purge driven by the injected cp
+run,0,0,q,advreset[],1,1,reset the registry for the purge fixture
+run,0,0,q,"srvsel.addserverfull[90i;`purgeA;`purgetest;`:p:1;()!()]",1,1,register purgetest server A
+run,0,0,q,"srvsel.addserverfull[91i;`purgeB;`purgetest;`:p:2;()!()]",1,1,register purgetest server B
+true,0,0,q,all null exec disconnecttime from srvsel.getserverstable[],1,1,disconnecttime is null while a server is active
+run,0,0,q,srvsel.setserveractive[90i;0b],1,1,deactivate purgetest server A
+true,0,0,q,not null first exec disconnecttime from srvsel.getserverstable[] where handle=90i,1,1,setserveractive 0b stamps disconnecttime
+true,0,0,q,null first exec disconnecttime from srvsel.getserverstable[] where handle=91i,1,1,the still-active server keeps a null disconnecttime
+run,0,0,q,srvsel.setserveractive[90i;1b],1,1,reactivate purgetest server A
+true,0,0,q,null first exec disconnecttime from srvsel.getserverstable[] where handle=90i,1,1,setserveractive 1b clears disconnecttime back to null
+run,0,0,q,srvsel.setserveractive[90i;0b],1,1,deactivate server A again for the purge itself
+run,0,0,q,srvsel.removeinactive[1D],1,1,purge with a one day age immediately after the disconnect
+true,0,0,q,2=count srvsel.getserverstable[],1,1,a recently-inactive server is NOT purged while inside the age window
+run,0,0,q,.m.di.0serverselect.cp:{.z.p+2D},1,1,fast-forward the module clock two days past the disconnect
+run,0,0,q,srvsel.removeinactive[1D],1,1,purge again after the fast-forward
+true,0,0,q,0=count select from srvsel.getserverstable[] where handle=90i,1,1,the aged-out inactive server was purged
+true,0,0,q,1=count select from srvsel.getserverstable[] where handle=91i,1,1,the still-active server was untouched by the purge
+true,0,0,q,1=count srvsel.getserverstable[],1,1,exactly one row was removed
+run,0,0,q,.m.di.0serverselect.cp:{.z.p},1,1,restore the real module clock
+fail,0,0,q,srvsel.removeinactive[42],1,1,removeinactive rejects a non-timespan age
+fail,0,0,q,srvsel.removeinactive[2024.01.01],1,1,removeinactive rejects a date age
+
+/ ---- init: optional cp and clearinactivetime ----
+comment,,,,,,,init - optional cp and clearinactivetime configuration
+fail,0,0,q,"srvsel.init[`log`cp!(noop;42)]",1,1,init rejects a cp that is not a function
+fail,0,0,q,"srvsel.init[`log`clearinactivetime!(noop;42)]",1,1,init rejects a clearinactivetime that is not a timespan
+true,0,0,q,"0<count key .m.di.0serverselect",1,1,a rejected init left the previously wired module state in place
+run,0,0,q,"srvsel.init[`log`cp`clearinactivetime!(noop;{.z.p};0D02:00)]",1,1,init accepts a valid cp and clearinactivetime
+true,0,0,q,0D02:00~.m.di.0serverselect.clearinactivetime,1,1,clearinactivetime is stored in module state
+run,0,0,q,srvsel.init[enlist[`log]!enlist noop],1,1,re-init with defaults
+true,0,0,q,0D01:00~.m.di.0serverselect.clearinactivetime,1,1,clearinactivetime defaults to one hour
+true,0,0,q,-12h=type .m.di.0serverselect.cp[],1,1,the default cp returns a timestamp
+true,0,0,q,.m.di.0serverselect.selector~srvsel.selector,1,1,init reseeds the live selector from the exported default
+
+/ ---- regression: smoke-test findings ----
+comment,,,,,,,regression F4 - attributes must be a dictionary at registration time
+run,0,0,q,advreset[],1,1,reset the registry for the attributes-validation fixture
+fail,0,0,q,"srvsel.addserverattr[1i;`rdb;42]",1,1,F4 - a non-dict attributes value is rejected at registration (was accepted and broke queries later)
+fail,0,0,q,"srvsel.addserverattr[1i;`rdb;()]",1,1,F4 - an empty general list is rejected as attributes
+fail,0,0,q,"srvsel.addserverattr[1i;`rdb;([]a:1 2)]",1,1,F4 - a table is rejected as attributes
+fail,0,0,q,"srvsel.addserverfull[1i;`p;`rdb;`:h:1;""notadict""]",1,1,F4 - a string is rejected as attributes
+fail,0,0,q,"srvsel.addserversfromtable[`ALL;([]w:enlist 5i;proctype:enlist`rdb;attributes:enlist 42)]",1,1,F4 - bulk registration rejects a non-dict attributes cell
+true,0,0,q,0=count srvsel.getserverstable[],1,1,F4 - no malformed row reached the registry
+run,0,0,q,"srvsel.addserverattr[1i;`rdb;()!()]",1,1,F4 - a proper empty dict is still accepted
+run,0,0,q,"srvsel.addserverattr[2i;`hdb;(enlist`date)!enlist enlist 2024.01.01]",1,1,F4 - a populated dict is still accepted
+true,0,0,q,"1=count srvsel.getservers[`servertype;`hdb;(enlist`date)!enlist enlist 2024.01.01]",1,1,F4 - attribute-scored lookup works against the clean registry
+
+comment,,,,,,,regression F5 - removeinactive rejects ages that would silently purge everything
+run,0,0,q,srvsel.setserveractive[2i;0b],1,1,deactivate a server to give the purge something to consider
+fail,0,0,q,srvsel.removeinactive[0Nn],1,1,F5 - a null age is rejected (disconnecttime+0Nn is 0Np so everything compared as aged out)
+fail,0,0,q,srvsel.removeinactive[-1D],1,1,F5 - a negative age is rejected
+true,0,0,q,2=count srvsel.getserverstable[],1,1,F5 - the rejected purges deleted nothing
+run,0,0,q,srvsel.removeinactive[0Wn],1,1,F5 - an infinite age is accepted as a no-op
+true,0,0,q,2=count srvsel.getserverstable[],1,1,F5 - 0Wn means retain forever and purges nothing (it overflowed to year 1734 before)
+run,0,0,q,srvsel.removeinactive[1D],1,1,F5 - a one day age with a fresh disconnect
+true,0,0,q,2=count srvsel.getserverstable[],1,1,F5 - nothing purged inside the age window
+run,0,0,q,srvsel.removeinactive[0D],1,1,F5 - a zero age purges anything already inactive
+true,0,0,q,1=count srvsel.getserverstable[],1,1,F5 - the inactive server was purged by a zero age
+
+comment,,,,,,,regression F6 - a repeated servertype is resolved once not twice
+run,0,0,q,advreset[],1,1,reset the registry for the dedupe fixture
+run,0,0,q,"srvsel.addserverattr[1i;`hdb;(enlist`date)!enlist enlist 2024.01.01]",1,1,register an hdb carrying the requested date
+run,0,0,q,"srvsel.addserverattr[2i;`rdb;(enlist`date)!enlist enlist 2024.01.09]",1,1,register an rdb carrying a different date
+true,0,0,q,"(enlist 1i)~raze srvsel.getserverids[`servertype`date!(`hdb`hdb;enlist 2024.01.01)]",1,1,F6 - a duplicated servertype yields the serverid once not twice
+true,0,0,q,"1=count srvsel.getserverids[`servertype`date!(`hdb`hdb;enlist 2024.01.01)]",1,1,F6 - and produces a single result group
+true,0,0,q,"(raze srvsel.getserverids[`servertype`date!(`hdb`hdb;enlist 2024.01.01)])~raze srvsel.getserverids[`servertype`date!(enlist`hdb;enlist 2024.01.01)]",1,1,F6 - duplicated and single servertype requests agree
+
+comment,,,,,,,regression F7 - the single-servertype path keeps the engine's specific error wording
+run,0,0,q,srvsel.init[enlist[`log]!enlist caplogger],1,1,re-init with the capturing logger
+run,0,0,q,caplog:0#caplog,1,1,reset capture
+run,0,0,q,"@[srvsel.getserverids;(enlist`date)!enlist enlist 1999.01.01;{}]",1,1,run an all-path miss under capture (signal swallowed)
+true,0,0,q,1=count select from caplog where lvl=`error,1,1,F7 - the all-path miss is logged exactly once at error
+true,0,0,q,0=count select from caplog where lvl=`warn,1,1,F7 - and not also downgraded to a warning
+true,0,0,q,"any caplog[`msg] like ""*getserveridstype*""",1,1,F7 - the specific engine wording survives rather than being replaced by a generic message
+run,0,0,q,srvsel.init[enlist[`log]!enlist noop],1,1,restore the no-op logger
+
+/ ---- setserveridactive: registration-level activation on a shared handle ----
+comment,,,,,,,setserveridactive - deactivate one registration without touching handle siblings
+run,0,0,q,advreset[],1,1,reset the registry for the shared-handle fixture
+run,0,0,q,"srvsel.addserverfull[60i;`sha;`zdba;`:h:1;()!()]",1,1,register the first servertype on shared handle 60
+run,0,0,q,"srvsel.addserverfull[60i;`shb;`zdbb;`:h:2;()!()]",1,1,register the second servertype on the same handle 60
+run,0,0,q,"srvsel.addserverfull[61i;`other;`zdbc;`:h:3;()!()]",1,1,register an unrelated server on its own handle
+true,0,0,q,2=count select from srvsel.getserverstable[] where handle=60i,1,1,two distinct registrations share handle 60
+true,0,0,q,all exec active from srvsel.getserverstable[],1,1,all three registrations start active
+run,0,0,q,srvsel.setserveridactive[1i;0b],1,1,deactivate ONLY serverid 1 by serverid
+true,0,0,q,not first exec active from srvsel.getserverstable[] where serverid=1i,1,1,serverid 1 is now inactive
+true,0,0,q,first exec active from srvsel.getserverstable[] where serverid=2i,1,1,its handle sibling serverid 2 is UNTOUCHED - this is the whole point
+true,0,0,q,not null first exec disconnecttime from srvsel.getserverstable[] where serverid=1i,1,1,setserveridactive stamps disconnecttime like setserveractive does
+true,0,0,q,null first exec disconnecttime from srvsel.getserverstable[] where serverid=2i,1,1,the sibling keeps a null disconnecttime
+true,0,0,q,"0=count srvsel.getservers[`servertype;`zdba;()!()]",1,1,the deactivated registration drops out of routing
+true,0,0,q,"1=count srvsel.getservers[`servertype;`zdbb;()!()]",1,1,the sibling servertype is still routable on the same handle
+run,0,0,q,srvsel.setserveridactive[1i;1b],1,1,reactivate serverid 1
+true,0,0,q,first exec active from srvsel.getserverstable[] where serverid=1i,1,1,serverid 1 is active again
+true,0,0,q,null first exec disconnecttime from srvsel.getserverstable[] where serverid=1i,1,1,reactivation clears disconnecttime back to null
+comment,,,,,,,setserveridactive - setserveractive is unchanged and still bulk by handle
+run,0,0,q,srvsel.setserveractive[60i;0b],1,1,a genuine handle disconnect still takes both registrations down together
+true,0,0,q,"0=count select from srvsel.getserverstable[] where handle=60i,active",1,1,setserveractive keeps its handle-level bulk behaviour unchanged
+true,0,0,q,"2=count select from srvsel.getserverstable[] where handle=60i,not null disconnecttime",1,1,both handle siblings were stamped by the handle-level call
+true,0,0,q,first exec active from srvsel.getserverstable[] where handle=61i,1,1,the unrelated handle was not affected
+run,0,0,q,srvsel.setserveractive[60i;1b],1,1,restore both registrations on handle 60
+comment,,,,,,,setserveridactive - validation and no-op semantics
+run,0,0,q,srvsel.setserveridactive[9999i;0b],1,1,setserveridactive on an unregistered serverid is a no-op
+true,0,0,q,3=count srvsel.getserverstable[],1,1,the no-op inserted no row - matching setserveractive on an unknown handle
+fail,0,0,q,"srvsel.setserveridactive[`notanint;0b]",1,1,setserveridactive rejects a symbol serverid
+fail,0,0,q,"srvsel.setserveridactive[1i;`yes]",1,1,setserveridactive rejects a non-boolean active flag
+true,0,0,q,"`setserveridactive in exec name from srvsel.getapimeta[]",1,1,setserveridactive is declared in the api metadata
+run,0,0,q,srvsel.setserveridactive[1i;0b],1,1,retire one registration by serverid ahead of the purge check
+run,0,0,q,.m.di.0serverselect.cp:{.z.p+2D},1,1,fast-forward the module clock
+run,0,0,q,srvsel.removeinactive[1D],1,1,purge aged-out registrations
+true,0,0,q,0=count select from srvsel.getserverstable[] where serverid=1i,1,1,a registration retired by serverid ages out on the same terms as a handle disconnect
+true,0,0,q,"1=count select from srvsel.getserverstable[] where handle=60i",1,1,its handle sibling survived the purge
+run,0,0,q,.m.di.0serverselect.cp:{.z.p},1,1,restore the real module clock
+
+/ ---- requireinit: a pre-init call names the problem instead of leaking internals ----
+comment,,,,,,,requireinit - every public entry point reports that init was not called
+run,0,0,q,"![`.m.di.0serverselect;();0b;enlist`logerr]",1,1,simulate an uninitialised module by removing the wired logger from module state
+true,0,0,q,"""di.serverselect: getserverstable: init must be called first""~@[srvsel.getserverstable;::;{x}]",1,1,a pre-init call names the entry point and the real problem instead of leaking .m.di.0serverselect internals
+true,0,0,q,"""di.serverselect: getserverids: init must be called first""~@[srvsel.getserverids;`rdb;{x}]",1,1,getserverids reports the same
+true,0,0,q,"""di.serverselect: removeinactive: init must be called first""~@[srvsel.removeinactive;1D;{x}]",1,1,removeinactive reports the same
+true,0,0,q,"""di.serverselect: setselector: init must be called first""~@[srvsel.setselector;{[a;b]a};{x}]",1,1,setselector now refuses pre-init instead of silently accepting a strategy init would overwrite
+true,0,0,q,"""di.serverselect: getserverbytype: init must be called first""~@[srvsel.gethandlebytype[`rdb;];`roundrobin;{x}]",1,1,the gethandlebytype projection inherits the guard
+true,0,0,q,"""di.serverselect: addserverfull: init must be called first""~@[srvsel.addserver[1i;];`rdb;{x}]",1,1,registration reports the same through its delegate
+true,0,0,q,0<count srvsel.getapimeta[],1,1,getapimeta is deliberately NOT guarded - di.torq collects api metadata at startup which may precede init
+true,0,0,q,"""0.1.0""~srvsel.version",1,1,version needs no init either
+run,0,0,q,srvsel.init[enlist[`log]!enlist noop],1,1,re-init to restore module state for the remaining tests
+true,0,0,q,`serverid in cols srvsel.getserverstable[],1,1,the module is usable again after re-init (init deliberately does not reset the registry)
+
+/ ---- setselector arity validation ----
+comment,,,,,,,setselector - arity is checked where the mistake is, not at the next getserverbytype
+run,0,0,q,"srvsel.setselector[{[a;b]a}]",1,1,a binary lambda is accepted
+run,0,0,q,"srvsel.setselector[{[a;b;c]a}[;;`x]]",1,1,a projection with two elided arguments is accepted
+run,0,0,q,srvsel.setselector[first],1,1,a primitive is accepted - q reports no arity for it so the check does not apply
+fail,0,0,q,"srvsel.setselector[{[t]t}]",1,1,a monadic lambda is rejected at the setselector call site (used to throw rank later)
+fail,0,0,q,srvsel.setselector[{42}],1,1,a niladic-looking lambda is rejected - it is really arity 1 via implicit x
+fail,0,0,q,"srvsel.setselector[{[a;b;c]a}]",1,1,a ternary lambda is rejected
+fail,0,0,q,"srvsel.setselector[{[a;b;c]a}[;`x;`y]]",1,1,a projection leaving only one argument elided is rejected
+true,0,0,q,"2=.m.di.0serverselect.selectorarity[{[a;b]a}]",1,1,selectorarity reads a lambda parameter count
+true,0,0,q,"2=.m.di.0serverselect.selectorarity[{[a;b;c]a}[;;`x]]",1,1,selectorarity counts a projection's elided arguments
+true,0,0,q,"2=.m.di.0serverselect.selectorarity[{[h;t;s]h}[9i]]",1,1,selectorarity handles a TRAILING partial application - it carries no :: placeholders so counting them alone read it as arity 0
+true,0,0,q,"1=.m.di.0serverselect.selectorarity[{[h;t;s]h}[9i;`t]]",1,1,selectorarity subtracts every supplied argument not just the elided ones
+run,0,0,q,"srvsel.setselector[{[h;t;s] first select from t where handle=h}[9i]]",1,1,a trailing-partial strategy is accepted - this is the natural way to capture a value in a strategy
+run,0,0,q,srvsel.setselector[srvsel.selector],1,1,restore the default after the trailing-partial check
+true,0,0,q,null .m.di.0serverselect.selectorarity[first],1,1,selectorarity returns null where q reports no arity rather than guessing
+true,0,0,q,"null .m.di.0serverselect.selectorarity[('[first;where])]",1,1,a composition also reports no arity and is accepted rather than rejected
+run,0,0,q,srvsel.setselector[srvsel.selector],1,1,restore the default selector
+
+/ ---- nested attrs form: control keys no longer collide with attribute names ----
+comment,,,,,,,getserverids - the attrs form lets an attribute be named like a control key
+run,0,0,q,advreset[],1,1,reset the registry for the attrs fixture
+run,0,0,q,"srvsel.addserverattr[1i;`hdb;`date`besteffort!(2024.01.01 2024.01.02;`EU`US)]",1,1,register a server genuinely advertising an attribute named besteffort
+fail,0,0,q,"srvsel.getserverids[(enlist`besteffort)!enlist enlist`EU]",1,1,flat form still treats besteffort as a control key and rejects a symbol value
+true,0,0,q,"(enlist 1i)~raze srvsel.getserverids[(enlist`attrs)!enlist (enlist`besteffort)!enlist enlist`EU]",1,1,the attrs form matches the real besteffort attribute with no collision
+true,0,0,q,"(enlist 1i)~raze srvsel.getserverids[`attrs`servertype!((enlist`besteffort)!enlist enlist`EU;`hdb)]",1,1,attrs requirements and a servertype control coexist
+true,0,0,q,"(enlist 1i)~raze srvsel.getserverids[`attrs`besteffort!((enlist`besteffort)!enlist enlist`EU;1b)]",1,1,an attribute and a control key of the SAME name are handled independently
+fail,0,0,q,"srvsel.getserverids[`attrs`besteffort!((enlist`besteffort)!enlist enlist`ZZ;0b)]",1,1,the control besteffort 0b still applies strictly to an attrs requirement that cannot match
+true,0,0,q,"(enlist 1i)~raze srvsel.getserverids[(enlist`attrs)!enlist (enlist`date)!enlist 2024.01.01]",1,1,the attrs form promotes atom values exactly as the flat form does
+fail,0,0,q,"srvsel.getserverids[(enlist`attrs)!enlist 42]",1,1,attrs must itself be a dictionary
+true,0,0,q,"(raze srvsel.getserverids[(enlist`attrs)!enlist (enlist`date)!enlist enlist 2024.01.01])~raze srvsel.getserverids[(enlist`date)!enlist enlist 2024.01.01]",1,1,flat and attrs forms agree for a non-colliding attribute name
+
+/ ---- maxcrossproduct bound ----
+comment,,,,,,,getserverids - the requirement cross product is bounded
+true,0,0,q,1000000=.m.di.0serverselect.maxcrossproduct,1,1,maxcrossproduct defaults to one million
+run,0,0,q,"srvsel.init[`log`maxcrossproduct!(noop;1000)]",1,1,re-init with a low bound to exercise it
+run,0,0,q,advreset[],1,1,reset the registry for the bound fixture
+run,0,0,q,"srvsel.addserverattr[1i;`hdb;`a`b!(til 400;til 400)]",1,1,register a server advertising wide attribute ranges
+true,0,0,q,"0<count raze srvsel.getserverids[`a`b!(til 30;til 30)]",1,1,a 900-combination request is under the bound and resolves
+fail,0,0,q,"srvsel.getserverids[`a`b!(til 40;til 40)]",1,1,a 1600-combination request exceeds the bound and is rejected before the cross product is built
+true,0,0,q,"0<count raze srvsel.getserverids[`a`b`attributetype!(til 40;til 40;`independent)]",1,1,independent matching is not combinatorial so it is not bounded
+run,0,0,q,"srvsel.init[`log`maxcrossproduct!(noop;0W)]",1,1,re-init with 0W to disable the bound
+true,0,0,q,"0<count raze srvsel.getserverids[`a`b!(til 400;til 400)]",1,1,maxcrossproduct 0W means unbounded
+fail,0,0,q,"srvsel.init[`log`maxcrossproduct!(noop;-5)]",1,1,init rejects a negative maxcrossproduct
+fail,0,0,q,"srvsel.init[`log`maxcrossproduct!(noop;1.5)]",1,1,init rejects a non-long maxcrossproduct
+run,0,0,q,srvsel.init[enlist[`log]!enlist noop],1,1,restore the default configuration
+true,0,0,q,"0<count raze srvsel.getserverids[()!()]",1,1,an empty requirement dict still works under the bound (prd of an empty list is () not 1)
+
+/ ---- third-pass smoke-test regressions ----
+comment,,,,,,,regression G1 - the attrs form rejects unknown top-level keys instead of swallowing them
+run,0,0,q,advreset[],1,1,reset the registry for the G1 fixture
+run,0,0,q,"srvsel.addserverattr[1i;`hdb;`date`sym!(2024.01.01 2024.01.02;`AAPL`MSFT)]",1,1,register a server with date and sym attributes
+fail,0,0,q,"srvsel.getserverids[`attrs`date!((enlist`sym)!enlist`AAPL;2024.01.09)]",1,1,G1 - a requirement left OUTSIDE attrs is rejected not silently dropped
+fail,0,0,q,"srvsel.getserverids[`attrs`besteffor!((enlist`date)!enlist 2024.01.01;0b)]",1,1,G1 - a mistyped besteffort control is rejected (the flat form errors too so nested must not be laxer)
+fail,0,0,q,"srvsel.getserverids[`attrs`attributetyp!((enlist`date)!enlist 2024.01.01;`independent)]",1,1,G1 - a mistyped attributetype control is rejected
+true,0,0,q,"(enlist 1i)~raze srvsel.getserverids[`attrs`servertype`besteffort`attributetype!((enlist`date)!enlist 2024.01.01;`hdb;1b;`cross)]",1,1,G1 - all three real control keys are still allowed beside attrs
+true,0,0,q,"(enlist 1i)~raze srvsel.getserverids[(enlist`attrs)!enlist (enlist`date)!enlist 2024.01.01]",1,1,G1 - attrs alone still works
+true,0,0,q,"(enlist 1i)~raze srvsel.getserverids[`date`sym!(2024.01.01;`AAPL)]",1,1,G1 - the flat form is unaffected - an unknown key there is simply a requirement
+
+comment,,,,,,,regression G2 - selectorarity resolves nested projections
+true,0,0,q,"2=.m.di.0serverselect.selectorarity[{[x;y;z]x}[;;`c]]",1,1,G2 - a single projection resolves
+true,0,0,q,"1=.m.di.0serverselect.selectorarity[{[x;y;z]x}[;;`c][;`b]]",1,1,G2 - a projection OF a projection resolves rather than falling through to null
+true,0,0,q,"2=.m.di.0serverselect.selectorarity[{[w;x;y;z]w}[`a][;;`d]]",1,1,G2 - a trailing partial then an elided projection resolves
+fail,0,0,q,"srvsel.setselector[{[x;y;z]x}[;;`c][;`b]]",1,1,G2 - a nested projection of the wrong arity is now rejected
+run,0,0,q,"srvsel.setselector[{[w;x;y;z]w}[`a][;;`d]]",1,1,G2 - a nested projection of arity 2 is accepted
+run,0,0,q,srvsel.setselector[srvsel.selector],1,1,restore the default selector
+
+comment,,,,,,,regression G3 - a keyed table is type 99h too so a bare dict check is not enough
+run,0,0,q,"kt:([a:1 2]b:3 4)",1,1,define a keyed table for the G3 checks
+fail,0,0,q,"srvsel.addserverattr[9i;`hdb;kt]",1,1,G3 - a keyed table is rejected as attributes (it is 99h so the old check let it through)
+fail,0,0,q,"srvsel.addserverattr[9i;`hdb;([a:`int$()]b:`int$())]",1,1,G3 - an EMPTY keyed table is rejected too
+fail,0,0,q,"srvsel.addserverattr[9i;`hdb;(enlist 1)!enlist 2]",1,1,G3 - a dictionary keyed on non-symbols is rejected
+fail,0,0,q,"srvsel.getserverids[(enlist`attrs)!enlist kt]",1,1,G3 - attrs rejects a keyed table
+fail,0,0,q,"srvsel.getservers[`servertype;`hdb;kt]",1,1,G3 - getservers validates req the same way
+fail,0,0,q,"srvsel.addserversfromtable[`ALL;([w:enlist 8i]proctype:enlist`rdb;attributes:enlist()!())]",1,1,G3 - addserversfromtable requires an unkeyed table
+fail,0,0,q,srvsel.addserversfromtable[`ALL;42],1,1,G3 - addserversfromtable rejects a non-table
+run,0,0,q,"srvsel.addserver[10i;`rdb]",1,1,G3 - the empty dict ()!() is still accepted as attributes
+true,0,0,q,"(()!())~first exec attributes from srvsel.getserverstable[] where handle=10i",1,1,G3 - ()!() keys on an empty GENERAL list not a symbol vector so the check must allow it
+true,0,0,q,"0<count srvsel.getservers[`servertype;`rdb;()!()]",1,1,G3 - getservers still accepts an empty req dict